)]}'
{"security-guide/section_identity-federated-keystone.xml":[{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    \u003cpara\u003eFederated identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and the OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity enables a user to securely access resources, servers,"},{"line_number":12,"context_line":"      files, volumes, databases, across multiple endpoints provided in multiple"},{"line_number":13,"context_line":"      authorized clouds using a single credential without having to provision"},{"line_number":14,"context_line":"      additional identities or re-login multiple times. The credential is"},{"line_number":15,"context_line":"      maintained by the user\u0027s Identity Provider.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_132b1595","line":12,"updated":"2014-09-02 08:14:20.000000000","message":"I think it is better to not list everything. I think it is also possible to access objects on a object storage, for example. Also I think that a federated identity mechanism does not provide a secure access (transfer encryption).","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"09f0d01b2ee9d1a80519df1feae5d9fb55608342","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    \u003cpara\u003eFederated identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and the OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity enables a user to securely access resources, servers,"},{"line_number":12,"context_line":"      files, volumes, databases, across multiple endpoints provided in multiple"},{"line_number":13,"context_line":"      authorized clouds using a single credential without having to provision"},{"line_number":14,"context_line":"      additional identities or re-login multiple times. The credential is"},{"line_number":15,"context_line":"      maintained by the user\u0027s Identity Provider.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_88c32b56","line":12,"in_reply_to":"fa98f980_132b1595","updated":"2014-09-03 02:22:28.000000000","message":"Changed to \"...securely access resources across multiple...\"","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"455b964ee6f515244fafc6c09d3ff20f52f3969f","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    \u003cpara\u003eFederated identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and the OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity enables a user to securely access resources, servers,"},{"line_number":12,"context_line":"      files, volumes, databases, across multiple endpoints provided in multiple"},{"line_number":13,"context_line":"      authorized clouds using a single credential without having to provision"},{"line_number":14,"context_line":"      additional identities or re-login multiple times. The credential is"},{"line_number":15,"context_line":"      maintained by the user\u0027s Identity Provider.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_fd5ba984","line":12,"in_reply_to":"fa98f980_132b1595","updated":"2014-09-02 21:15:07.000000000","message":"Christian... what do you mean by \"federated identity mechanism does not provide a secure access\"?","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"a4e7144084a5543c367a0ea93ded0c3de7bc866b","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    \u003cpara\u003eFederated identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and the OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity enables a user to securely access resources, servers,"},{"line_number":12,"context_line":"      files, volumes, databases, across multiple endpoints provided in multiple"},{"line_number":13,"context_line":"      authorized clouds using a single credential without having to provision"},{"line_number":14,"context_line":"      additional identities or re-login multiple times. The credential is"},{"line_number":15,"context_line":"      maintained by the user\u0027s Identity Provider.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_d3b4f836","line":12,"in_reply_to":"fa98f980_88c32b56","updated":"2014-09-03 09:18:08.000000000","message":"\"secure access\" means \"using an encrypted connection\" for me. Without using an encrypted connection it is not possible to securely access resources. But I think it is not part of federated identity to provide encrypted connections. Maybe I just have a wrong point of view.","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"a154d3df1fde18a68da2b0709d7379e910ee4b67","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    \u003cpara\u003eFederated identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and the OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity enables a user to securely access resources, servers,"},{"line_number":12,"context_line":"      files, volumes, databases, across multiple endpoints provided in multiple"},{"line_number":13,"context_line":"      authorized clouds using a single credential without having to provision"},{"line_number":14,"context_line":"      additional identities or re-login multiple times. The credential is"},{"line_number":15,"context_line":"      maintained by the user\u0027s Identity Provider.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_876bf8ef","line":12,"in_reply_to":"fa98f980_d3b4f836","updated":"2014-09-03 17:47:17.000000000","message":"Fair point.  Perhaps this should be changed to \"Federated identity provides a way to securely use existing credentials to access cloud resources such as...\"","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"455b964ee6f515244fafc6c09d3ff20f52f3969f","unresolved":false,"context_lines":[{"line_number":25,"context_line":"          Identity Provider has exactly one mapping specified per protocol.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":26,"context_line":"      \u003clistitem\u003e\u003cpara\u003eProtocol - A protocol contains information that dictates"},{"line_number":27,"context_line":"          which Mapping rules to use for an incoming request made by an IdP. An"},{"line_number":28,"context_line":"          IdP may have multiple supported protocols.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":29,"context_line":"    \u003c/itemizedlist\u003e"},{"line_number":30,"context_line":"      \u003cpara\u003eFederated users are not mirrored in the Identity service backend (for example,"},{"line_number":31,"context_line":"      using the SQL driver). The external IdP is responsible for authenticating users,"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_032baa30","line":28,"updated":"2014-09-02 21:15:07.000000000","message":"Minor nit, but my preference is to use parallel wording for the start of each bullet.  So \"provides a service\", \"contains information\", etc.  But perhaps reword \"service that stores...\".","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"09f0d01b2ee9d1a80519df1feae5d9fb55608342","unresolved":false,"context_lines":[{"line_number":25,"context_line":"          Identity Provider has exactly one mapping specified per protocol.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":26,"context_line":"      \u003clistitem\u003e\u003cpara\u003eProtocol - A protocol contains information that dictates"},{"line_number":27,"context_line":"          which Mapping rules to use for an incoming request made by an IdP. An"},{"line_number":28,"context_line":"          IdP may have multiple supported protocols.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":29,"context_line":"    \u003c/itemizedlist\u003e"},{"line_number":30,"context_line":"      \u003cpara\u003eFederated users are not mirrored in the Identity service backend (for example,"},{"line_number":31,"context_line":"      using the SQL driver). The external IdP is responsible for authenticating users,"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_487b0328","line":28,"in_reply_to":"fa98f980_032baa30","updated":"2014-09-03 02:22:28.000000000","message":"Done","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"455b964ee6f515244fafc6c09d3ff20f52f3969f","unresolved":false,"context_lines":[{"line_number":50,"context_line":"      \u003c/itemizedlist\u003e"},{"line_number":51,"context_line":"      \u003c/section\u003e"},{"line_number":52,"context_line":"      \u003csection xml:id\u003d\"section_identity-federated-advantages\"\u003e"},{"line_number":53,"context_line":"        \u003ctitle\u003eAdvantages of using an external Identity Provider\u003c/title\u003e"},{"line_number":54,"context_line":"        \u003citemizedlist\u003e"},{"line_number":55,"context_line":"          \u003clistitem\u003e\u003cpara\u003eThere is no longer any need to provision user entries in"},{"line_number":56,"context_line":"              Identity, since the user entries already exist in the IdP\u0027s databases."}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_cf8460d6","line":53,"updated":"2014-09-02 21:15:07.000000000","message":"This seems very similar to the last set of bullets.  Rather than having two sets of bullets on why federated identity is great... perhaps we should have just a set of pros and cons?  To me, this feels a little too much like a sales pitch.","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"a154d3df1fde18a68da2b0709d7379e910ee4b67","unresolved":false,"context_lines":[{"line_number":50,"context_line":"      \u003c/itemizedlist\u003e"},{"line_number":51,"context_line":"      \u003c/section\u003e"},{"line_number":52,"context_line":"      \u003csection xml:id\u003d\"section_identity-federated-advantages\"\u003e"},{"line_number":53,"context_line":"        \u003ctitle\u003eAdvantages of using an external Identity Provider\u003c/title\u003e"},{"line_number":54,"context_line":"        \u003citemizedlist\u003e"},{"line_number":55,"context_line":"          \u003clistitem\u003e\u003cpara\u003eThere is no longer any need to provision user entries in"},{"line_number":56,"context_line":"              Identity, since the user entries already exist in the IdP\u0027s databases."}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_e75cc44d","line":53,"in_reply_to":"fa98f980_8b2a458e","updated":"2014-09-03 17:47:17.000000000","message":"I can comment more when I see the update, but this sounds reasonable.","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"09f0d01b2ee9d1a80519df1feae5d9fb55608342","unresolved":false,"context_lines":[{"line_number":50,"context_line":"      \u003c/itemizedlist\u003e"},{"line_number":51,"context_line":"      \u003c/section\u003e"},{"line_number":52,"context_line":"      \u003csection xml:id\u003d\"section_identity-federated-advantages\"\u003e"},{"line_number":53,"context_line":"        \u003ctitle\u003eAdvantages of using an external Identity Provider\u003c/title\u003e"},{"line_number":54,"context_line":"        \u003citemizedlist\u003e"},{"line_number":55,"context_line":"          \u003clistitem\u003e\u003cpara\u003eThere is no longer any need to provision user entries in"},{"line_number":56,"context_line":"              Identity, since the user entries already exist in the IdP\u0027s databases."}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_8b2a458e","line":53,"in_reply_to":"fa98f980_cf8460d6","updated":"2014-09-03 02:22:28.000000000","message":"Bryan, I have combined similar points from the 2 section together and just have one section listing all the reasons to use federated identity. Does this update seem like a better way to include the information?","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":75,"context_line":"          \u003ctitle\u003eEnabling federation\u003c/title\u003e"},{"line_number":76,"context_line":"          \u003cpara\u003eTo enable federation, perform the following steps:\u003c/para\u003e"},{"line_number":77,"context_line":"            \u003cprocedure\u003e"},{"line_number":78,"context_line":"              \u003cstep\u003e\u003cpara\u003eRun the Identity Service under Apache, instead of using"},{"line_number":79,"context_line":"                \u003cliteral\u003ekeystone-all\u003c/literal\u003e.\u003c/para\u003e\u003c/step\u003e"},{"line_number":80,"context_line":"              \u003cstep\u003e\u003cpara\u003eConfigure Apache to use a federation capable authentication"},{"line_number":81,"context_line":"                method.\u003c/para\u003e\u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_f393f1f7","line":78,"updated":"2014-09-02 08:14:20.000000000","message":"How?","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":76,"context_line":"          \u003cpara\u003eTo enable federation, perform the following steps:\u003c/para\u003e"},{"line_number":77,"context_line":"            \u003cprocedure\u003e"},{"line_number":78,"context_line":"              \u003cstep\u003e\u003cpara\u003eRun the Identity Service under Apache, instead of using"},{"line_number":79,"context_line":"                \u003cliteral\u003ekeystone-all\u003c/literal\u003e.\u003c/para\u003e\u003c/step\u003e"},{"line_number":80,"context_line":"              \u003cstep\u003e\u003cpara\u003eConfigure Apache to use a federation capable authentication"},{"line_number":81,"context_line":"                method.\u003c/para\u003e\u003c/step\u003e"},{"line_number":82,"context_line":"              \u003cstep\u003e\u003cpara\u003eEnable \u003cliteral\u003eOS-FEDERATION\u003c/literal\u003e extension.\u003c/para\u003e\u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_f3fcd140","line":79,"updated":"2014-09-02 08:14:20.000000000","message":"\u003ccommand\u003e...\u003c/command\u003e instead of \u003cliteral\u003e...\u003c/literal\u003e","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"09f0d01b2ee9d1a80519df1feae5d9fb55608342","unresolved":false,"context_lines":[{"line_number":76,"context_line":"          \u003cpara\u003eTo enable federation, perform the following steps:\u003c/para\u003e"},{"line_number":77,"context_line":"            \u003cprocedure\u003e"},{"line_number":78,"context_line":"              \u003cstep\u003e\u003cpara\u003eRun the Identity Service under Apache, instead of using"},{"line_number":79,"context_line":"                \u003cliteral\u003ekeystone-all\u003c/literal\u003e.\u003c/para\u003e\u003c/step\u003e"},{"line_number":80,"context_line":"              \u003cstep\u003e\u003cpara\u003eConfigure Apache to use a federation capable authentication"},{"line_number":81,"context_line":"                method.\u003c/para\u003e\u003c/step\u003e"},{"line_number":82,"context_line":"              \u003cstep\u003e\u003cpara\u003eEnable \u003cliteral\u003eOS-FEDERATION\u003c/literal\u003e extension.\u003c/para\u003e\u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_a8b8efc8","line":79,"in_reply_to":"fa98f980_f3fcd140","updated":"2014-09-03 02:22:28.000000000","message":"Done","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":78,"context_line":"              \u003cstep\u003e\u003cpara\u003eRun the Identity Service under Apache, instead of using"},{"line_number":79,"context_line":"                \u003cliteral\u003ekeystone-all\u003c/literal\u003e.\u003c/para\u003e\u003c/step\u003e"},{"line_number":80,"context_line":"              \u003cstep\u003e\u003cpara\u003eConfigure Apache to use a federation capable authentication"},{"line_number":81,"context_line":"                method.\u003c/para\u003e\u003c/step\u003e"},{"line_number":82,"context_line":"              \u003cstep\u003e\u003cpara\u003eEnable \u003cliteral\u003eOS-FEDERATION\u003c/literal\u003e extension.\u003c/para\u003e\u003c/step\u003e"},{"line_number":83,"context_line":"            \u003c/procedure\u003e"},{"line_number":84,"context_line":"        \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_d3842db3","line":81,"updated":"2014-09-02 08:14:20.000000000","message":"How?","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":79,"context_line":"                \u003cliteral\u003ekeystone-all\u003c/literal\u003e.\u003c/para\u003e\u003c/step\u003e"},{"line_number":80,"context_line":"              \u003cstep\u003e\u003cpara\u003eConfigure Apache to use a federation capable authentication"},{"line_number":81,"context_line":"                method.\u003c/para\u003e\u003c/step\u003e"},{"line_number":82,"context_line":"              \u003cstep\u003e\u003cpara\u003eEnable \u003cliteral\u003eOS-FEDERATION\u003c/literal\u003e extension.\u003c/para\u003e\u003c/step\u003e"},{"line_number":83,"context_line":"            \u003c/procedure\u003e"},{"line_number":84,"context_line":"        \u003c/section\u003e"},{"line_number":85,"context_line":"        \u003csection xml:id\u003d\"section_identity-federated-config\"\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_53c03de0","line":82,"updated":"2014-09-02 08:14:20.000000000","message":"How?","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":99,"context_line":"                domains.\u003c/para\u003e\u003c/step\u003e"},{"line_number":100,"context_line":"            \u003cstep\u003e\u003cpara\u003eAdd Identity Providers, Mappings and Protocols.\u003c/para\u003e"},{"line_number":101,"context_line":"              \u003cpara\u003eTo utilize federation, create the following in the Identity Service:"},{"line_number":102,"context_line":"                Identity Provider, Mapping, Protocol.\u003c/para\u003e\u003c/step\u003e"},{"line_number":103,"context_line":"          \u003c/procedure\u003e"},{"line_number":104,"context_line":"        \u003c/section\u003e"},{"line_number":105,"context_line":"        \u003csection xml:id\u003d\"section_identity-federated-authentication\"\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_6e58f632","line":102,"updated":"2014-09-02 08:14:20.000000000","message":"How?","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":110,"context_line":"            \u003cpara\u003eTo start federated authentication a user must access the dedicated"},{"line_number":111,"context_line":"              URL with Identity Provider’s and Protocol’s identifiers stored within"},{"line_number":112,"context_line":"              a protected URL. The URL has a format of:"},{"line_number":113,"context_line":"              /v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth.\u003c/para\u003e"},{"line_number":114,"context_line":"            \u003cpara\u003eIn this instance we follow a standard SAML2 authentication procedure,"},{"line_number":115,"context_line":"              that is, the user will be redirected to the Identity Provider’s"},{"line_number":116,"context_line":"              authentication webpage and be prompted for credentials. After successfully"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_53cbdd1d","line":113,"updated":"2014-09-02 08:14:20.000000000","message":"\u003cliteral\u003e...\u003c/literal\u003e","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"09f0d01b2ee9d1a80519df1feae5d9fb55608342","unresolved":false,"context_lines":[{"line_number":110,"context_line":"            \u003cpara\u003eTo start federated authentication a user must access the dedicated"},{"line_number":111,"context_line":"              URL with Identity Provider’s and Protocol’s identifiers stored within"},{"line_number":112,"context_line":"              a protected URL. The URL has a format of:"},{"line_number":113,"context_line":"              /v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth.\u003c/para\u003e"},{"line_number":114,"context_line":"            \u003cpara\u003eIn this instance we follow a standard SAML2 authentication procedure,"},{"line_number":115,"context_line":"              that is, the user will be redirected to the Identity Provider’s"},{"line_number":116,"context_line":"              authentication webpage and be prompted for credentials. After successfully"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_48d063f6","line":113,"in_reply_to":"fa98f980_53cbdd1d","updated":"2014-09-03 02:22:28.000000000","message":"Done","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":112,"context_line":"              a protected URL. The URL has a format of:"},{"line_number":113,"context_line":"              /v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth.\u003c/para\u003e"},{"line_number":114,"context_line":"            \u003cpara\u003eIn this instance we follow a standard SAML2 authentication procedure,"},{"line_number":115,"context_line":"              that is, the user will be redirected to the Identity Provider’s"},{"line_number":116,"context_line":"              authentication webpage and be prompted for credentials. After successfully"},{"line_number":117,"context_line":"              authenticating the user will be redirected to the Service Provider’s"},{"line_number":118,"context_line":"              endpoint. If using a web browser, a token will be returned in XML format.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_13a6b553","line":115,"updated":"2014-09-02 08:14:20.000000000","message":"Please use \u0027 instead of ’.","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"09f0d01b2ee9d1a80519df1feae5d9fb55608342","unresolved":false,"context_lines":[{"line_number":112,"context_line":"              a protected URL. The URL has a format of:"},{"line_number":113,"context_line":"              /v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth.\u003c/para\u003e"},{"line_number":114,"context_line":"            \u003cpara\u003eIn this instance we follow a standard SAML2 authentication procedure,"},{"line_number":115,"context_line":"              that is, the user will be redirected to the Identity Provider’s"},{"line_number":116,"context_line":"              authentication webpage and be prompted for credentials. After successfully"},{"line_number":117,"context_line":"              authenticating the user will be redirected to the Service Provider’s"},{"line_number":118,"context_line":"              endpoint. If using a web browser, a token will be returned in XML format.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_1c5cddec","line":115,"in_reply_to":"fa98f980_13a6b553","updated":"2014-09-03 02:22:28.000000000","message":"Christian, Am not sure where you want me to use \u0027instead of\u0027.","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                requests to the list projects and domains that are accessible.\u003c/para\u003e"},{"line_number":124,"context_line":"              \u003citemizedlist\u003e"},{"line_number":125,"context_line":"                \u003clistitem\u003e\u003cpara\u003eList projects a federated user can access:"},{"line_number":126,"context_line":"                    GET /OS-FEDERATION/projects"},{"line_number":127,"context_line":"                    \u003c/para\u003e\u003c/listitem\u003e"},{"line_number":128,"context_line":"                \u003clistitem\u003e\u003cpara\u003eList domains a federated user can access:"},{"line_number":129,"context_line":"                    GET /OS-FEDERATION/domains\u003c/para\u003e\u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_d34fcdbc","line":126,"updated":"2014-09-02 08:14:20.000000000","message":"\u003cliteral\u003e...\u003c/literal\u003e","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"09f0d01b2ee9d1a80519df1feae5d9fb55608342","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                requests to the list projects and domains that are accessible.\u003c/para\u003e"},{"line_number":124,"context_line":"              \u003citemizedlist\u003e"},{"line_number":125,"context_line":"                \u003clistitem\u003e\u003cpara\u003eList projects a federated user can access:"},{"line_number":126,"context_line":"                    GET /OS-FEDERATION/projects"},{"line_number":127,"context_line":"                    \u003c/para\u003e\u003c/listitem\u003e"},{"line_number":128,"context_line":"                \u003clistitem\u003e\u003cpara\u003eList domains a federated user can access:"},{"line_number":129,"context_line":"                    GET /OS-FEDERATION/domains\u003c/para\u003e\u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_e80af777","line":126,"in_reply_to":"fa98f980_d34fcdbc","updated":"2014-09-03 02:22:28.000000000","message":"Done","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":126,"context_line":"                    GET /OS-FEDERATION/projects"},{"line_number":127,"context_line":"                    \u003c/para\u003e\u003c/listitem\u003e"},{"line_number":128,"context_line":"                \u003clistitem\u003e\u003cpara\u003eList domains a federated user can access:"},{"line_number":129,"context_line":"                    GET /OS-FEDERATION/domains\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":130,"context_line":"              \u003c/itemizedlist\u003e\u003c/step\u003e"},{"line_number":131,"context_line":"            \u003cstep\u003e\u003cpara\u003eGet a scoped token\u003c/para\u003e"},{"line_number":132,"context_line":"              \u003cpara\u003eA federated user may request a scoped token, by using the"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_f34e91c0","line":129,"updated":"2014-09-02 08:14:20.000000000","message":"\u003cliteral\u003e...\u003c/literal\u003e","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"09f0d01b2ee9d1a80519df1feae5d9fb55608342","unresolved":false,"context_lines":[{"line_number":126,"context_line":"                    GET /OS-FEDERATION/projects"},{"line_number":127,"context_line":"                    \u003c/para\u003e\u003c/listitem\u003e"},{"line_number":128,"context_line":"                \u003clistitem\u003e\u003cpara\u003eList domains a federated user can access:"},{"line_number":129,"context_line":"                    GET /OS-FEDERATION/domains\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":130,"context_line":"              \u003c/itemizedlist\u003e\u003c/step\u003e"},{"line_number":131,"context_line":"            \u003cstep\u003e\u003cpara\u003eGet a scoped token\u003c/para\u003e"},{"line_number":132,"context_line":"              \u003cpara\u003eA federated user may request a scoped token, by using the"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_08101ba7","line":129,"in_reply_to":"fa98f980_f34e91c0","updated":"2014-09-03 02:22:28.000000000","message":"Done","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"9148c7b4bb27fb1e48059b93bd3bd82797946f2b","unresolved":false,"context_lines":[{"line_number":130,"context_line":"              \u003c/itemizedlist\u003e\u003c/step\u003e"},{"line_number":131,"context_line":"            \u003cstep\u003e\u003cpara\u003eGet a scoped token\u003c/para\u003e"},{"line_number":132,"context_line":"              \u003cpara\u003eA federated user may request a scoped token, by using the"},{"line_number":133,"context_line":"                unscoped token. A project or domain may be specified by either"},{"line_number":134,"context_line":"                ID or name. An ID is sufficient to uniquely identify a project"},{"line_number":135,"context_line":"                or domain.\u003c/para\u003e\u003c/step\u003e"},{"line_number":136,"context_line":"          \u003c/procedure\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_2e750e98","line":133,"updated":"2014-09-02 08:14:20.000000000","message":"What is the difference between a scoped and an unscoped token?","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"09f0d01b2ee9d1a80519df1feae5d9fb55608342","unresolved":false,"context_lines":[{"line_number":130,"context_line":"              \u003c/itemizedlist\u003e\u003c/step\u003e"},{"line_number":131,"context_line":"            \u003cstep\u003e\u003cpara\u003eGet a scoped token\u003c/para\u003e"},{"line_number":132,"context_line":"              \u003cpara\u003eA federated user may request a scoped token, by using the"},{"line_number":133,"context_line":"                unscoped token. A project or domain may be specified by either"},{"line_number":134,"context_line":"                ID or name. An ID is sufficient to uniquely identify a project"},{"line_number":135,"context_line":"                or domain.\u003c/para\u003e\u003c/step\u003e"},{"line_number":136,"context_line":"          \u003c/procedure\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"fa98f980_51764ed8","line":133,"in_reply_to":"fa98f980_2e750e98","updated":"2014-09-03 02:22:28.000000000","message":"Included a line about scoped and unscoped tokens in the list of definitions.","commit_id":"c93b7d84a215d086aae9545a65e39344d7a89c0b"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":15,"context_line":"      multiple times. The credential is maintained by the user\u0027s Identity Provider.\u003c/para\u003e"},{"line_number":16,"context_line":"    \u003cpara\u003eSome important definitions:\u003c/para\u003e"},{"line_number":17,"context_line":"      \u003citemizedlist\u003e"},{"line_number":18,"context_line":"        \u003clistitem\u003e\u003cpara\u003eService Provider (SP) - provides a service to an end-user.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":19,"context_line":"        \u003clistitem\u003e\u003cpara\u003eIdentity Provider (IdP) - stores information about users"},{"line_number":20,"context_line":"          and groups.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":21,"context_line":"        \u003clistitem\u003e\u003cpara\u003eSAML assertion - contains information about a user as provided"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_a6e7b0ab","line":18,"updated":"2014-09-08 05:32:20.000000000","message":"This should be a variablelist, see https://wiki.openstack.org/wiki/Documentation/DocBook_conventions#Term.2Fdescription_or_key.2Fvalue_pairs","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":61,"context_line":"      \u003c/itemizedlist\u003e"},{"line_number":62,"context_line":"      \u003c/section\u003e"},{"line_number":63,"context_line":"      \u003csection xml:id\u003d\"section-identity-configuring-identity-for-federation\"\u003e"},{"line_number":64,"context_line":"        \u003ctitle\u003eConfiguring Identity Service for federation\u003c/title\u003e"},{"line_number":65,"context_line":"        \u003cpara\u003eFederated users are not mirrored in the Identity Service backend (for example,"},{"line_number":66,"context_line":"          using the SQL driver). The external IdP is responsible for authenticating users,"},{"line_number":67,"context_line":"          and communicates the result of authentication to Identity Service using SAML assertions."}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_26fbc048","line":64,"updated":"2014-09-08 05:32:20.000000000","message":"service lowercase, also line 65 and 68, 69, 74 etc.","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":77,"context_line":"                  \u003cstep\u003e\u003cpara\u003eEnable SSL support. Install \u003cliteral\u003emod_nss\u003c/literal\u003e"},{"line_number":78,"context_line":"                    according to your distribution, then apply the following patch"},{"line_number":79,"context_line":"                    and restart HTTPD:\u003c/para\u003e"},{"line_number":80,"context_line":"                  \u003cscreen\u003e--- /etc/httpd/conf.d/nss.conf.orig 2012-03-29 12:59:06.319470425 -0400"},{"line_number":81,"context_line":"+++ /etc/httpd/conf.d/nss.conf      2012-03-29 12:19:38.862721465 -0400"},{"line_number":82,"context_line":"@@ -17,7 +17,7 @@"},{"line_number":83,"context_line":"# Note: Configurations that use IPv6 but not IPv4-mapped addresses need two"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_2692e0f6","line":80,"updated":"2014-09-08 05:32:20.000000000","message":"Use \u003cprogramlisting\u003e or \u003cscreen\u003e\u003ccomputeroutput\u003e","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":99,"context_line":" #DocumentRoot \"/etc/httpd/htdocs\""},{"line_number":100,"context_line":"\u0026lt;/virtualhost\u003e\u0026lt;/virtualhost\u003e\u003c/screen\u003e"},{"line_number":101,"context_line":"                  \u003c/step\u003e"},{"line_number":102,"context_line":"                  \u003cstep\u003e\u003cpara\u003eAdd the following rule to IPTables in order to ensure the SSL traffic can pass your firewall:\u003c/para\u003e"},{"line_number":103,"context_line":"                    \u003cscreen\u003e-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT\u003c/screen\u003e"},{"line_number":104,"context_line":"                    \u003cpara\u003ebefore the line:\u003c/para\u003e"},{"line_number":105,"context_line":"                    \u003cscreen\u003e-A INPUT -j REJECT --reject-with icmp-host-prohibited\u003c/screen\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_e6ae182f","line":102,"updated":"2014-09-08 05:32:20.000000000","message":"Just say: Allow SSL traffic to pass the firewall, add the following rule to iptables:","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":101,"context_line":"                  \u003c/step\u003e"},{"line_number":102,"context_line":"                  \u003cstep\u003e\u003cpara\u003eAdd the following rule to IPTables in order to ensure the SSL traffic can pass your firewall:\u003c/para\u003e"},{"line_number":103,"context_line":"                    \u003cscreen\u003e-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT\u003c/screen\u003e"},{"line_number":104,"context_line":"                    \u003cpara\u003ebefore the line:\u003c/para\u003e"},{"line_number":105,"context_line":"                    \u003cscreen\u003e-A INPUT -j REJECT --reject-with icmp-host-prohibited\u003c/screen\u003e"},{"line_number":106,"context_line":"                  \u003c/step\u003e"},{"line_number":107,"context_line":"                  \u003cstep\u003e\u003cpara\u003eCopy the \u003cfilename\u003ehttpd/wsgi-keystone.conf\u003c/filename\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_a66c100a","line":104,"updated":"2014-09-08 05:32:20.000000000","message":"This is highly OS dependent, what about saying:\nNote this needs to be added before your reject all rule which might be:","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":120,"context_line":"                      context to access the linked file. For example, if you have"},{"line_number":121,"context_line":"                      the file in \u003cliteral\u003e/var/www/cgi-bin\u003c/literal\u003e location,"},{"line_number":122,"context_line":"                      you can do this by running:\u003c/para\u003e"},{"line_number":123,"context_line":"                    \u003cscreen\u003e\u003cuserinput\u003esudo restorecon /var/www/cgi-bin\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":124,"context_line":"                      \u003cpara\u003eAdding it in a different location requires you set up"},{"line_number":125,"context_line":"                      your SELinux policy accordingly.\u003c/para\u003e"},{"line_number":126,"context_line":"                  \u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_e62378bc","line":123,"updated":"2014-09-08 05:32:20.000000000","message":"We\u0027re not using sudo, see for complete syntax: https://wiki.openstack.org/wiki/Documentation/DocBook_conventions#Command_line_prompt\n\nuse:\n\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003erestorecon...","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":141,"context_line":"                      instance.\u003c/para\u003e"},{"line_number":142,"context_line":"                  \u003c/step\u003e"},{"line_number":143,"context_line":"                  \u003cstep\u003e\u003cpara\u003eInstall Shibboleth:\u003c/para\u003e"},{"line_number":144,"context_line":"\u003cscreen\u003e\u003cuserinput\u003e\u003cprompt\u003e$\u003c/prompt\u003e apt-get install libapache2-mod-shib2\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":145,"context_line":"                  \u003c/step\u003e"},{"line_number":146,"context_line":"                  \u003cstep\u003e\u003cpara\u003eConfigure the Identity Service virtual host and"},{"line_number":147,"context_line":"                      adjust the config to properly handle SAML2 workflow.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_a611705f","line":144,"updated":"2014-09-08 05:32:20.000000000","message":"See above on how to use userinput/prompt correctly.","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":146,"context_line":"                  \u003cstep\u003e\u003cpara\u003eConfigure the Identity Service virtual host and"},{"line_number":147,"context_line":"                      adjust the config to properly handle SAML2 workflow.\u003c/para\u003e"},{"line_number":148,"context_line":"                    \u003cpara\u003eAdd \u003cliteral\u003eWSGIScriptAlias\u003c/literal\u003e directive to your vhost configuration:\u003c/para\u003e"},{"line_number":149,"context_line":"                    \u003cscreen\u003eWSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/.*?/protocols/.*?/auth)$ /var/www/keystone/main/$1\u003c/screen\u003e"},{"line_number":150,"context_line":"                  \u003c/step\u003e"},{"line_number":151,"context_line":"                  \u003cstep\u003e\u003cpara\u003eAdd two \u003cliteral\u003e\u0026lt;Location\u003e\u003c/literal\u003e directives"},{"line_number":152,"context_line":"                to the \u003cfilename\u003ewsgi-keystone.conf\u003c/filename\u003e file:\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_06087c2c","line":149,"updated":"2014-09-08 05:32:20.000000000","message":"\u003cprogramlisting\u003e","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":162,"context_line":"ShibExportAssertion Off"},{"line_number":163,"context_line":"Require valid-user"},{"line_number":164,"context_line":"\u0026lt;/LocationMatch\u003e\u003c/programlisting\u003e"},{"line_number":165,"context_line":"                  \u003cnote\u003e\u003cpara\u003e\u003cliteral\u003esaml2\u003c/literal\u003e may be different in your"},{"line_number":166,"context_line":"                      deployment, but do not use a wildcard value. Otherwise every"},{"line_number":167,"context_line":"                      federated protocol will be handled by Shibboleth.\u003c/para\u003e"},{"line_number":168,"context_line":"                    \u003cpara\u003eThe \u003cliteral\u003eShibRequireSession\u003c/literal\u003e rule is invalid"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_c90da739","line":165,"updated":"2014-09-08 05:32:20.000000000","message":"Start this with a capital word, rework if needed. What about \"The option saml2..\"","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":166,"context_line":"                      deployment, but do not use a wildcard value. Otherwise every"},{"line_number":167,"context_line":"                      federated protocol will be handled by Shibboleth.\u003c/para\u003e"},{"line_number":168,"context_line":"                    \u003cpara\u003eThe \u003cliteral\u003eShibRequireSession\u003c/literal\u003e rule is invalid"},{"line_number":169,"context_line":"                      in Apache 2.4+ and should be dropped in that specific setup.\u003c/para\u003e\u003c/note\u003e"},{"line_number":170,"context_line":"                  \u003c/step\u003e"},{"line_number":171,"context_line":"                  \u003cstep\u003e\u003cpara\u003eEnable the Identity Service virtual host:\u003c/para\u003e"},{"line_number":172,"context_line":"\u003cscreen\u003e\u003cuserinput\u003e\u003cprompt\u003e$\u003c/prompt\u003e a2ensite wsgi-keystone.conf\u003c/userinput\u003e\u003c/screen\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_090faf2f","line":169,"updated":"2014-09-08 05:32:20.000000000","message":"2.4 or newer","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":169,"context_line":"                      in Apache 2.4+ and should be dropped in that specific setup.\u003c/para\u003e\u003c/note\u003e"},{"line_number":170,"context_line":"                  \u003c/step\u003e"},{"line_number":171,"context_line":"                  \u003cstep\u003e\u003cpara\u003eEnable the Identity Service virtual host:\u003c/para\u003e"},{"line_number":172,"context_line":"\u003cscreen\u003e\u003cuserinput\u003e\u003cprompt\u003e$\u003c/prompt\u003e a2ensite wsgi-keystone.conf\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":173,"context_line":"                  \u003c/step\u003e"},{"line_number":174,"context_line":"                  \u003cstep\u003e\u003cpara\u003eEnable the \u003cliteral\u003essl\u003c/literal\u003e and \u003cliteral\u003eshib2\u003c/literal\u003e"},{"line_number":175,"context_line":"                      modules:\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_4919b778","line":172,"updated":"2014-09-08 05:32:20.000000000","message":"Like above, see https://wiki.openstack.org/wiki/Documentation/DocBook_conventions#Command_line_prompt","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":173,"context_line":"                  \u003c/step\u003e"},{"line_number":174,"context_line":"                  \u003cstep\u003e\u003cpara\u003eEnable the \u003cliteral\u003essl\u003c/literal\u003e and \u003cliteral\u003eshib2\u003c/literal\u003e"},{"line_number":175,"context_line":"                      modules:\u003c/para\u003e"},{"line_number":176,"context_line":"\u003cscreen\u003e\u003cuserinput\u003e\u003cprompt\u003e$\u003c/prompt\u003e a2enmod ssl\u003c/userinput\u003e"},{"line_number":177,"context_line":"\u003cuserinput\u003e\u003cprompt\u003e$\u003c/prompt\u003e a2enmod shib2\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":178,"context_line":"                  \u003c/step\u003e"},{"line_number":179,"context_line":"                  \u003cstep\u003e\u003cpara\u003eRestart Apache:\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_892abf7c","line":176,"updated":"2014-09-08 05:32:20.000000000","message":"Like above","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":177,"context_line":"\u003cuserinput\u003e\u003cprompt\u003e$\u003c/prompt\u003e a2enmod shib2\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":178,"context_line":"                  \u003c/step\u003e"},{"line_number":179,"context_line":"                  \u003cstep\u003e\u003cpara\u003eRestart Apache:\u003c/para\u003e"},{"line_number":180,"context_line":"\u003cscreen\u003e\u003cuserinput\u003e\u003cprompt\u003e$\u003c/prompt\u003e service apache2 restart\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":181,"context_line":"                  \u003c/step\u003e"},{"line_number":182,"context_line":"                \u003c/substeps\u003e"},{"line_number":183,"context_line":"              \u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_a91f835a","line":180,"updated":"2014-09-08 05:32:20.000000000","message":"Like above","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":187,"context_line":"                  \u003cstep\u003e\u003cpara\u003eOnce you have your Identity Service virtual host ready,"},{"line_number":188,"context_line":"                      configure Shibboleth and upload your metadata to the Identity Provider.\u003c/para\u003e"},{"line_number":189,"context_line":"                    \u003cpara\u003eIf new certificates are required, they can be easily created by executing:\u003c/para\u003e"},{"line_number":190,"context_line":"\u003cscreen\u003e\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003eshib-keygen -y \u003creplaceable\u003eNUMBER_OF_YEARS\u003c/replaceable\u003e\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":191,"context_line":"                    \u003cpara\u003eThe newly created file will be stored under"},{"line_number":192,"context_line":"                      \u003cliteral\u003e/etc/shibboleth/sp-key.pem\u003c/literal\u003e\u003c/para\u003e"},{"line_number":193,"context_line":"                  \u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_c924c7b1","line":190,"updated":"2014-09-08 05:32:20.000000000","message":"Like above","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":189,"context_line":"                    \u003cpara\u003eIf new certificates are required, they can be easily created by executing:\u003c/para\u003e"},{"line_number":190,"context_line":"\u003cscreen\u003e\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003eshib-keygen -y \u003creplaceable\u003eNUMBER_OF_YEARS\u003c/replaceable\u003e\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":191,"context_line":"                    \u003cpara\u003eThe newly created file will be stored under"},{"line_number":192,"context_line":"                      \u003cliteral\u003e/etc/shibboleth/sp-key.pem\u003c/literal\u003e\u003c/para\u003e"},{"line_number":193,"context_line":"                  \u003c/step\u003e"},{"line_number":194,"context_line":"                  \u003cstep\u003e\u003cpara\u003eUpload your Service Provider’s metadata file to your"},{"line_number":195,"context_line":"                      Identity Provider.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_0936cfe7","line":192,"updated":"2014-09-08 05:32:20.000000000","message":"\u003cfilename\u003e","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":199,"context_line":"                    \u003cpara\u003eFor more information, see \u003clink xlink:href\u003d\"https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration\"\u003e"},{"line_number":200,"context_line":"                        \u003ccitetitle\u003eShibboleth Service Provider Configuration\u003c/citetitle\u003e\u003c/link\u003e.\u003c/para\u003e"},{"line_number":201,"context_line":"                  \u003c/step\u003e"},{"line_number":202,"context_line":"                  \u003cstep\u003e\u003cpara\u003eIdentity Servuce enforces \u003cliteral\u003eexternal\u003c/literal\u003e"},{"line_number":203,"context_line":"                      authentication when environment variable \u003cliteral\u003eREMOTE_USER\u003c/literal\u003e"},{"line_number":204,"context_line":"                      is present so make sure Shibboleth does not set the"},{"line_number":205,"context_line":"                      \u003cliteral\u003eREMOTE_USER\u003c/literal\u003e environment variable. To do"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_694cbb77","line":202,"updated":"2014-09-08 05:32:20.000000000","message":"Identity service (typo+capitalization)","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":214,"context_line":"                        \u003ccitetitle\u003eShibboleth Attributes\u003c/citetitle\u003e\u003c/link\u003e.\u003c/para\u003e"},{"line_number":215,"context_line":"                  \u003c/step\u003e"},{"line_number":216,"context_line":"                  \u003cstep\u003e\u003cpara\u003eRestart the Shibboleth daemon:\u003c/para\u003e"},{"line_number":217,"context_line":"\u003cscreen\u003e\u003cuserinput\u003e\u003cprompt\u003e$\u003c/prompt\u003e service shibd restart\u003c/userinput\u003e"},{"line_number":218,"context_line":"\u003cuserinput\u003e\u003cprompt\u003e$\u003c/prompt\u003e service apache2 restart\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":219,"context_line":"                  \u003c/step\u003e"},{"line_number":220,"context_line":"                \u003c/substeps\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_294ab355","line":217,"updated":"2014-09-08 05:32:20.000000000","message":"See above- Note also that most of your prompts are root prompts thus should use \"#\"","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":234,"context_line":"methods \u003d external,password,token,saml2"},{"line_number":235,"context_line":"saml2 \u003d keystone.auth.plugins.saml2.Saml2\u003c/programlisting\u003e"},{"line_number":236,"context_line":"                      \u003cnote\u003e\u003cpara\u003eThe \u003cliteral\u003eexternal\u003c/literal\u003e method should be"},{"line_number":237,"context_line":"                          dropped to avoid any interference with some Apache + Shibboleth"},{"line_number":238,"context_line":"                          SP setups, where a REMOTE_USER environment variable is"},{"line_number":239,"context_line":"                          always set, even as an empty value.\u003c/para\u003e\u003c/note\u003e"},{"line_number":240,"context_line":"                  \u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_c9a927e1","line":237,"updated":"2014-09-08 05:32:20.000000000","message":"+ -\u003e and","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":235,"context_line":"saml2 \u003d keystone.auth.plugins.saml2.Saml2\u003c/programlisting\u003e"},{"line_number":236,"context_line":"                      \u003cnote\u003e\u003cpara\u003eThe \u003cliteral\u003eexternal\u003c/literal\u003e method should be"},{"line_number":237,"context_line":"                          dropped to avoid any interference with some Apache + Shibboleth"},{"line_number":238,"context_line":"                          SP setups, where a REMOTE_USER environment variable is"},{"line_number":239,"context_line":"                          always set, even as an empty value.\u003c/para\u003e\u003c/note\u003e"},{"line_number":240,"context_line":"                  \u003c/step\u003e"},{"line_number":241,"context_line":"                  \u003cstep\u003e\u003cpara\u003eAdd the \u003cliteral\u003efederation_extension\u003c/literal\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_699afbc6","line":238,"updated":"2014-09-08 05:32:20.000000000","message":"\u003cliteral\u003eREMOTE_USER\u003c/literal\u003e","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":239,"context_line":"                          always set, even as an empty value.\u003c/para\u003e\u003c/note\u003e"},{"line_number":240,"context_line":"                  \u003c/step\u003e"},{"line_number":241,"context_line":"                  \u003cstep\u003e\u003cpara\u003eAdd the \u003cliteral\u003efederation_extension\u003c/literal\u003e"},{"line_number":242,"context_line":"                          middleware to the api_v3 pipeline in \u003cfilename\u003ekeystone-paste.ini\u003c/filename\u003e"},{"line_number":243,"context_line":"                          file. For example:\u003c/para\u003e"},{"line_number":244,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[pipeline:api_v3]"},{"line_number":245,"context_line":"pipeline \u003d access_log sizelimit url_normalize token_auth admin_token_auth"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_69811b4d","line":242,"updated":"2014-09-08 05:32:20.000000000","message":"\u003cliteral\u003eapi_v3\u003c/literal\u003e pipeline in *the* \u003cfilename\u003e","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":247,"context_line":"service_v3\u003c/programlisting\u003e"},{"line_number":248,"context_line":"                  \u003c/step\u003e"},{"line_number":249,"context_line":"                  \u003cstep\u003e\u003cpara\u003eCreate the federation extension tables if using the provided SQL backend. For example:\u003c/para\u003e"},{"line_number":250,"context_line":"                    \u003cscreen\u003e./bin/keystone-manage db_sync --extension federation\u003c/screen\u003e"},{"line_number":251,"context_line":"                  \u003c/step\u003e"},{"line_number":252,"context_line":"                \u003c/substeps\u003e"},{"line_number":253,"context_line":"                \u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_c9804749","line":250,"updated":"2014-09-08 05:32:20.000000000","message":"Add proper prompts. Use \"keystone-manage\"","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":255,"context_line":"        \u003c/section\u003e"},{"line_number":256,"context_line":"        \u003csection xml:id\u003d\"section_identity-federated-config\"\u003e"},{"line_number":257,"context_line":"          \u003ctitle\u003eConfiguring federation\u003c/title\u003e"},{"line_number":258,"context_line":"          \u003cpara\u003eNow that the Identity Provider and Identity Service are communicating,"},{"line_number":259,"context_line":"            you can start to configure the \u003cliteral\u003eOS-FEDERATION\u003c/literal\u003e extension.\u003c/para\u003e"},{"line_number":260,"context_line":"          \u003cprocedure\u003e"},{"line_number":261,"context_line":"            \u003cstep\u003e\u003cpara\u003eCreate Identity groups and assign roles.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_e9942b8e","line":258,"updated":"2014-09-08 05:32:20.000000000","message":"Identiy service, please fix everywhere","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":293,"context_line":"              by \u003cliteral\u003emod_shib\u003c/literal\u003e and Apache, as such a request made"},{"line_number":294,"context_line":"              to the URL would be redirected to the Identity Provider, to start"},{"line_number":295,"context_line":"              the SAML authentication procedure.\u003c/para\u003e"},{"line_number":296,"context_line":"\u003cscreen\u003e\u003cprompt\u003e$\u003c/prompt\u003e curl -X GET -D - http://localhost:5000/v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth\u003c/screen\u003e\u003c/step\u003e"},{"line_number":297,"context_line":"            \u003cstep\u003e\u003cpara\u003eDetermine accessible resources.\u003c/para\u003e"},{"line_number":298,"context_line":"              \u003cpara\u003eBy using the previously returned token, the user can issue"},{"line_number":299,"context_line":"                requests to the list projects and domains that are accessible.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_09924f9f","line":296,"updated":"2014-09-08 05:32:20.000000000","message":"Missing \u003cuserinput\u003e - see above","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":305,"context_line":"                    \u003cliteral\u003eGET /OS-FEDERATION/domains\u003c/literal\u003e\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":306,"context_line":"              \u003c/itemizedlist\u003e"},{"line_number":307,"context_line":"              \u003cpara\u003eFor example,\u003c/para\u003e"},{"line_number":308,"context_line":"              \u003cscreen\u003e\u003cprompt\u003e$\u003c/prompt\u003e curl -X GET -H \"X-Auth-Token: \u0026lt;unscoped token\u003e\" http://localhost:5000/v3/OS-FEDERATION/projects\u003c/screen\u003e"},{"line_number":309,"context_line":"          \u003cpara\u003eor\u003c/para\u003e"},{"line_number":310,"context_line":"          \u003cscreen\u003e\u003cprompt\u003e$\u003c/prompt\u003e curl -X GET -H \"X-Auth-Token: \u0026lt;unscoped token\u003e\" http://localhost:5000/v3/OS-FEDERATION/domains\u003c/screen\u003e\u003c/step\u003e"},{"line_number":311,"context_line":"            \u003cstep\u003e\u003cpara\u003eGet a scoped token.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_298f1377","line":308,"updated":"2014-09-08 05:32:20.000000000","message":"see above","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":307,"context_line":"              \u003cpara\u003eFor example,\u003c/para\u003e"},{"line_number":308,"context_line":"              \u003cscreen\u003e\u003cprompt\u003e$\u003c/prompt\u003e curl -X GET -H \"X-Auth-Token: \u0026lt;unscoped token\u003e\" http://localhost:5000/v3/OS-FEDERATION/projects\u003c/screen\u003e"},{"line_number":309,"context_line":"          \u003cpara\u003eor\u003c/para\u003e"},{"line_number":310,"context_line":"          \u003cscreen\u003e\u003cprompt\u003e$\u003c/prompt\u003e curl -X GET -H \"X-Auth-Token: \u0026lt;unscoped token\u003e\" http://localhost:5000/v3/OS-FEDERATION/domains\u003c/screen\u003e\u003c/step\u003e"},{"line_number":311,"context_line":"            \u003cstep\u003e\u003cpara\u003eGet a scoped token.\u003c/para\u003e"},{"line_number":312,"context_line":"              \u003cpara\u003eA federated user may request a scoped token, by using the"},{"line_number":313,"context_line":"                unscoped token. A project or domain may be specified by either"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_69e83b17","line":310,"updated":"2014-09-08 05:32:20.000000000","message":"see above","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5ba32574e9dfb6f215884854ab89e5b87d37a591","unresolved":false,"context_lines":[{"line_number":313,"context_line":"                unscoped token. A project or domain may be specified by either"},{"line_number":314,"context_line":"                ID or name. An ID is sufficient to uniquely identify a project"},{"line_number":315,"context_line":"                or domain. For example,\u003c/para\u003e"},{"line_number":316,"context_line":"              \u003cscreen\u003e\u003cprompt\u003e$\u003c/prompt\u003e curl -X POST -H \"Content-Type: application/json\" -d \u0027{\"auth\":{\"identity\":{\"methods\":[\"saml2\"],\"saml2\":{\"id\":\"\u0026lt;unscoped_token_id\u003e\"}},\"scope\":{\"project\":{\"domain\": {\"name\": \"Default\"},\"name\":\"service\"}}}}\u0027 -D - http://localhost:5000/v3/auth/tokens\u003c/screen\u003e\u003c/step\u003e"},{"line_number":317,"context_line":"          \u003c/procedure\u003e"},{"line_number":318,"context_line":"        \u003c/section\u003e"},{"line_number":319,"context_line":"      \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_498c5780","line":316,"updated":"2014-09-08 05:32:20.000000000","message":"see above","commit_id":"10e8afb3f3d617feeaa64e609f545a2ad9588d99"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"3b07ae5a1a70457802c52a559fa8a39f6afec272","unresolved":false,"context_lines":[{"line_number":5,"context_line":"         version\u003d\"5.0\""},{"line_number":6,"context_line":"         xml:id\u003d\"section_identity-federated-keystone\"\u003e"},{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eFederated identity\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eFederated identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and the OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity provides a way to securely use existing credentials"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_cf1e870d","line":8,"updated":"2014-09-08 07:25:16.000000000","message":"Are there any terms in here - like federated identiy - that should be added to the glossary as well? If yes, please propose a patch to the glossary in openstack-manuals.","commit_id":"a654b34537855f0ea68877918768d6a3413c5647"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"3b07ae5a1a70457802c52a559fa8a39f6afec272","unresolved":false,"context_lines":[{"line_number":44,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":45,"context_line":"        \u003cterm\u003eUnscoped token\u003c/term\u003e"},{"line_number":46,"context_line":"        \u003clistitem\u003e\u003cpara\u003eAllows a user to authenticate with Identity"},{"line_number":47,"context_line":"            Service to exchange it for a scoped token, by providing a project ID.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":48,"context_line":"      \u003c/varlistentry\u003e"},{"line_number":49,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":50,"context_line":"        \u003cterm\u003eScoped token\u003c/term\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_af2a232a","line":47,"updated":"2014-09-08 07:25:16.000000000","message":"service","commit_id":"a654b34537855f0ea68877918768d6a3413c5647"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"3b07ae5a1a70457802c52a559fa8a39f6afec272","unresolved":false,"context_lines":[{"line_number":162,"context_line":"                      instance.\u003c/para\u003e"},{"line_number":163,"context_line":"                  \u003c/step\u003e"},{"line_number":164,"context_line":"                  \u003cstep\u003e\u003cpara\u003eInstall Shibboleth:\u003c/para\u003e"},{"line_number":165,"context_line":"\u003cscreen\u003e\u003cuserinput\u003e\u003cprompt\u003e#\u003c/prompt\u003e apt-get install libapache2-mod-shib2\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":166,"context_line":"                  \u003c/step\u003e"},{"line_number":167,"context_line":"                  \u003cstep\u003e\u003cpara\u003eConfigure the Identity service virtual host and"},{"line_number":168,"context_line":"                      adjust the config to properly handle SAML2 workflow.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_2f1633f2","line":165,"updated":"2014-09-08 07:25:16.000000000","message":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003e...","commit_id":"a654b34537855f0ea68877918768d6a3413c5647"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"3b07ae5a1a70457802c52a559fa8a39f6afec272","unresolved":false,"context_lines":[{"line_number":280,"context_line":"            you can start to configure the \u003cliteral\u003eOS-FEDERATION\u003c/literal\u003e extension.\u003c/para\u003e"},{"line_number":281,"context_line":"          \u003cprocedure\u003e"},{"line_number":282,"context_line":"            \u003cstep\u003e\u003cpara\u003eCreate Identity groups and assign roles.\u003c/para\u003e"},{"line_number":283,"context_line":"              \u003cpara\u003eNo new users will be added to the Identity backend, but the Identity"},{"line_number":284,"context_line":"                Service requires group-based role assignments to authorize federated"},{"line_number":285,"context_line":"                users. The federation mapping function will map the user into local"},{"line_number":286,"context_line":"                Identity service groups objects, and hence to local role"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_4fb9b7eb","line":283,"updated":"2014-09-08 07:25:16.000000000","message":"back end - see conventions page for details: https://wiki.openstack.org/wiki/Documentation/Conventions#backend.2C_back_end.2C_and_back-end","commit_id":"a654b34537855f0ea68877918768d6a3413c5647"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"3b07ae5a1a70457802c52a559fa8a39f6afec272","unresolved":false,"context_lines":[{"line_number":281,"context_line":"          \u003cprocedure\u003e"},{"line_number":282,"context_line":"            \u003cstep\u003e\u003cpara\u003eCreate Identity groups and assign roles.\u003c/para\u003e"},{"line_number":283,"context_line":"              \u003cpara\u003eNo new users will be added to the Identity backend, but the Identity"},{"line_number":284,"context_line":"                Service requires group-based role assignments to authorize federated"},{"line_number":285,"context_line":"                users. The federation mapping function will map the user into local"},{"line_number":286,"context_line":"                Identity service groups objects, and hence to local role"},{"line_number":287,"context_line":"                assignments.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_6fbe7bd6","line":284,"updated":"2014-09-08 07:25:16.000000000","message":"service","commit_id":"a654b34537855f0ea68877918768d6a3413c5647"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4436830ecb1a88e1b17372ddc842ac63f53db078","unresolved":false,"context_lines":[{"line_number":5,"context_line":"         version\u003d\"5.0\""},{"line_number":6,"context_line":"         xml:id\u003d\"section_identity-federated-keystone\"\u003e"},{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eFederated identity\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eFederated identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and the OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity provides a way to securely use existing credentials"}],"source_content_type":"application/xml","patch_set":4,"id":"fa98f980_051a9dc5","line":8,"updated":"2014-09-12 05:29:35.000000000","message":"s/identity/Identity\n\nin particular for the title","commit_id":"99b0e94a03ef7da9765fa2a8d4da78b2801928d1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4436830ecb1a88e1b17372ddc842ac63f53db078","unresolved":false,"context_lines":[{"line_number":6,"context_line":"         xml:id\u003d\"section_identity-federated-keystone\"\u003e"},{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eFederated identity\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eFederated identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and the OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity provides a way to securely use existing credentials"},{"line_number":12,"context_line":"      to access cloud resources such as servers, files, volumes, databases, across"}],"source_content_type":"application/xml","patch_set":4,"id":"fa98f980_257a41f1","line":9,"updated":"2014-09-12 05:29:35.000000000","message":"In the Keystone docs, we normally capitalize:\n\n  - Federated Identity\n  - Identity Provider(s)\n  - Service Provider(s)\n\nI\u0027d like to see the same here (there are a few instances of inconsistencies in this doc so far).\n\nFWIW, this is a nit-pick at best.","commit_id":"99b0e94a03ef7da9765fa2a8d4da78b2801928d1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4436830ecb1a88e1b17372ddc842ac63f53db078","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eFederated identity\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eFederated identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and the OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity provides a way to securely use existing credentials"},{"line_number":12,"context_line":"      to access cloud resources such as servers, files, volumes, databases, across"},{"line_number":13,"context_line":"      multiple endpoints provided in multiple authorized clouds using a single"}],"source_content_type":"application/xml","patch_set":4,"id":"fa98f980_457f45e0","line":10,"updated":"2014-09-12 05:29:35.000000000","message":"s/the/an","commit_id":"99b0e94a03ef7da9765fa2a8d4da78b2801928d1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4436830ecb1a88e1b17372ddc842ac63f53db078","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    \u003cpara\u003eFederated identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and the OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity provides a way to securely use existing credentials"},{"line_number":12,"context_line":"      to access cloud resources such as servers, files, volumes, databases, across"},{"line_number":13,"context_line":"      multiple endpoints provided in multiple authorized clouds using a single"},{"line_number":14,"context_line":"      credential without having to provision additional identities or re-login"},{"line_number":15,"context_line":"      multiple times. The credential is maintained by the user\u0027s Identity Provider.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"fa98f980_855ccd7e","line":12,"updated":"2014-09-12 05:29:35.000000000","message":"s/volumes, databases/volumes and databases","commit_id":"99b0e94a03ef7da9765fa2a8d4da78b2801928d1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4436830ecb1a88e1b17372ddc842ac63f53db078","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    \u003cpara\u003eFederated identity provides a way to securely use existing credentials"},{"line_number":12,"context_line":"      to access cloud resources such as servers, files, volumes, databases, across"},{"line_number":13,"context_line":"      multiple endpoints provided in multiple authorized clouds using a single"},{"line_number":14,"context_line":"      credential without having to provision additional identities or re-login"},{"line_number":15,"context_line":"      multiple times. The credential is maintained by the user\u0027s Identity Provider.\u003c/para\u003e"},{"line_number":16,"context_line":"    \u003cpara\u003eSome important definitions:\u003c/para\u003e"},{"line_number":17,"context_line":"    \u003cvariablelist\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"fa98f980_e54af9ab","line":14,"updated":"2014-09-12 05:29:35.000000000","message":"comma after credential?","commit_id":"99b0e94a03ef7da9765fa2a8d4da78b2801928d1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4436830ecb1a88e1b17372ddc842ac63f53db078","unresolved":false,"context_lines":[{"line_number":13,"context_line":"      multiple endpoints provided in multiple authorized clouds using a single"},{"line_number":14,"context_line":"      credential without having to provision additional identities or re-login"},{"line_number":15,"context_line":"      multiple times. The credential is maintained by the user\u0027s Identity Provider.\u003c/para\u003e"},{"line_number":16,"context_line":"    \u003cpara\u003eSome important definitions:\u003c/para\u003e"},{"line_number":17,"context_line":"    \u003cvariablelist\u003e"},{"line_number":18,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":19,"context_line":"        \u003cterm\u003eService Provider (SP)\u003c/term\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"fa98f980_e58f59cb","line":16,"updated":"2014-09-12 05:29:35.000000000","message":"FWIW, we have some of these defined in the API too:\n\nhttps://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#definitions\n\nslightly different context, might I figured it might help","commit_id":"99b0e94a03ef7da9765fa2a8d4da78b2801928d1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4436830ecb1a88e1b17372ddc842ac63f53db078","unresolved":false,"context_lines":[{"line_number":44,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":45,"context_line":"        \u003cterm\u003eUnscoped token\u003c/term\u003e"},{"line_number":46,"context_line":"        \u003clistitem\u003e\u003cpara\u003eAllows a user to authenticate with Identity"},{"line_number":47,"context_line":"            service to exchange it for a scoped token, by providing a project ID.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":48,"context_line":"      \u003c/varlistentry\u003e"},{"line_number":49,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":50,"context_line":"        \u003cterm\u003eScoped token\u003c/term\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"fa98f980_25bde168","line":47,"updated":"2014-09-12 05:29:35.000000000","message":"or domain ID","commit_id":"99b0e94a03ef7da9765fa2a8d4da78b2801928d1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4436830ecb1a88e1b17372ddc842ac63f53db078","unresolved":false,"context_lines":[{"line_number":53,"context_line":"      \u003c/varlistentry\u003e"},{"line_number":54,"context_line":"    \u003c/variablelist\u003e"},{"line_number":55,"context_line":"      \u003csection xml:id\u003d\"section_identity-federated-overview\"\u003e"},{"line_number":56,"context_line":"        \u003ctitle\u003eWhy use federated identity?\u003c/title\u003e"},{"line_number":57,"context_line":"        \u003citemizedlist\u003e"},{"line_number":58,"context_line":"          \u003clistitem\u003e\u003cpara\u003eIt is a security risk every time a new identity is"},{"line_number":59,"context_line":"            provisioned. With federated identity, there is no longer any need to"}],"source_content_type":"application/xml","patch_set":4,"id":"fa98f980_a86d2834","line":56,"updated":"2014-09-12 05:29:35.000000000","message":"again, caps","commit_id":"99b0e94a03ef7da9765fa2a8d4da78b2801928d1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4436830ecb1a88e1b17372ddc842ac63f53db078","unresolved":false,"context_lines":[{"line_number":57,"context_line":"        \u003citemizedlist\u003e"},{"line_number":58,"context_line":"          \u003clistitem\u003e\u003cpara\u003eIt is a security risk every time a new identity is"},{"line_number":59,"context_line":"            provisioned. With federated identity, there is no longer any need to"},{"line_number":60,"context_line":"            provision user entries in Identity, since the user entries already"},{"line_number":61,"context_line":"            exist in the IdP\u0027s databases."},{"line_number":62,"context_line":"            \u003c/para\u003e\u003c/listitem\u003e"},{"line_number":63,"context_line":"        \u003clistitem\u003e\u003cpara\u003eBurden on the clients to deal with multiple tokens"}],"source_content_type":"application/xml","patch_set":4,"id":"fa98f980_a8544854","line":60,"updated":"2014-09-12 05:29:35.000000000","message":"suggestion: Identity Service, Identity Backend?","commit_id":"99b0e94a03ef7da9765fa2a8d4da78b2801928d1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4436830ecb1a88e1b17372ddc842ac63f53db078","unresolved":false,"context_lines":[{"line_number":68,"context_line":"            \u0027Forget Password\u0027 workflows. With federated identity, there is no"},{"line_number":69,"context_line":"            need to support users who forget their passwords. The IdPs already"},{"line_number":70,"context_line":"            do this.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":71,"context_line":"        \u003clistitem\u003e\u003cpara\u003eSpend too much time administering identities in various"},{"line_number":72,"context_line":"            service providers.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":73,"context_line":"        \u003clistitem\u003e\u003cpara\u003eBest test of interoperability in the cloud is to enable"},{"line_number":74,"context_line":"            one identity access across multiple clouds. Multiple collaborating"}],"source_content_type":"application/xml","patch_set":4,"id":"fa98f980_68e500a3","line":71,"updated":"2014-09-12 05:29:35.000000000","message":"wording here is funky...\n\nToo much time is spent ...","commit_id":"99b0e94a03ef7da9765fa2a8d4da78b2801928d1"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c5bfba3b593ca54f8e82194e12e8ebc63bf55bcc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"da9df570_b340d257","updated":"2014-09-22 05:22:41.000000000","message":"@bryan - regarding some of distro specific stuff, would it be easier to just call it out and say this stuff is distro specific, or did you want to actually list the alternatives?","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":19,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":20,"context_line":"        \u003cterm\u003eService Provider (SP)\u003c/term\u003e"},{"line_number":21,"context_line":"        \u003clistitem\u003e\u003cpara\u003eA system entity that provides services to principals or"},{"line_number":22,"context_line":"            other system entities, in this case, the OpenStack Identity is the"},{"line_number":23,"context_line":"            Service Provider.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":24,"context_line":"      \u003c/varlistentry\u003e"},{"line_number":25,"context_line":"      \u003cvarlistentry\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_6d15ae9a","line":22,"updated":"2014-09-16 19:24:23.000000000","message":"\"the OpenStack Identity\" should be \"OpenStack Identity\"","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"9feaae63ecfaf3c6cf4d5ded1554b1b80e437065","unresolved":false,"context_lines":[{"line_number":19,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":20,"context_line":"        \u003cterm\u003eService Provider (SP)\u003c/term\u003e"},{"line_number":21,"context_line":"        \u003clistitem\u003e\u003cpara\u003eA system entity that provides services to principals or"},{"line_number":22,"context_line":"            other system entities, in this case, the OpenStack Identity is the"},{"line_number":23,"context_line":"            Service Provider.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":24,"context_line":"      \u003c/varlistentry\u003e"},{"line_number":25,"context_line":"      \u003cvarlistentry\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_3553e43a","line":22,"in_reply_to":"fa98f980_6d15ae9a","updated":"2014-09-17 06:14:55.000000000","message":"Done","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":46,"context_line":"      \u003c/varlistentry\u003e"},{"line_number":47,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":48,"context_line":"        \u003cterm\u003eUnscoped token\u003c/term\u003e"},{"line_number":49,"context_line":"        \u003clistitem\u003e\u003cpara\u003eAllows a user to authenticate with Identity"},{"line_number":50,"context_line":"            service to exchange it for a scoped token, by providing a project"},{"line_number":51,"context_line":"            ID or domain ID.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":52,"context_line":"      \u003c/varlistentry\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_88248061","line":49,"updated":"2014-09-16 19:24:23.000000000","message":"with _the_ Identity servce...","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"9feaae63ecfaf3c6cf4d5ded1554b1b80e437065","unresolved":false,"context_lines":[{"line_number":46,"context_line":"      \u003c/varlistentry\u003e"},{"line_number":47,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":48,"context_line":"        \u003cterm\u003eUnscoped token\u003c/term\u003e"},{"line_number":49,"context_line":"        \u003clistitem\u003e\u003cpara\u003eAllows a user to authenticate with Identity"},{"line_number":50,"context_line":"            service to exchange it for a scoped token, by providing a project"},{"line_number":51,"context_line":"            ID or domain ID.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":52,"context_line":"      \u003c/varlistentry\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_75348cfb","line":49,"in_reply_to":"fa98f980_88248061","updated":"2014-09-17 06:14:55.000000000","message":"Done","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":59,"context_line":"      \u003csection xml:id\u003d\"section_identity-federated-overview\"\u003e"},{"line_number":60,"context_line":"        \u003ctitle\u003eWhy use Federated Identity?\u003c/title\u003e"},{"line_number":61,"context_line":"        \u003citemizedlist\u003e"},{"line_number":62,"context_line":"          \u003clistitem\u003e\u003cpara\u003eIt is a security risk every time a new identity is"},{"line_number":63,"context_line":"            provisioned. With Federated Identity, there is no longer any need to"},{"line_number":64,"context_line":"            provision user entries in Identity service, since the user entries"},{"line_number":65,"context_line":"            already exist in the IdP\u0027s databases."}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_e8c42c43","line":62,"updated":"2014-09-16 19:24:23.000000000","message":"It can also be a security risk to have a single identity that can be used in lots of places.  So I think this bullet should have a little more balance.\n\nI\u0027d suggest something that mentions that it is difficult to secure credential storage and to deploy it with proper policies, etc.  Therefore, having a common identity store is useful as it can be setup properly once and used in multiple places.  This does introduce new challenges around protecting that identity (or the impact of a compromised identity).  However, many people are finding that this is a worthwhile tradeoff given the greater control, and fewer credential databases that come with this model.","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c5bfba3b593ca54f8e82194e12e8ebc63bf55bcc","unresolved":false,"context_lines":[{"line_number":59,"context_line":"      \u003csection xml:id\u003d\"section_identity-federated-overview\"\u003e"},{"line_number":60,"context_line":"        \u003ctitle\u003eWhy use Federated Identity?\u003c/title\u003e"},{"line_number":61,"context_line":"        \u003citemizedlist\u003e"},{"line_number":62,"context_line":"          \u003clistitem\u003e\u003cpara\u003eIt is a security risk every time a new identity is"},{"line_number":63,"context_line":"            provisioned. With Federated Identity, there is no longer any need to"},{"line_number":64,"context_line":"            provision user entries in Identity service, since the user entries"},{"line_number":65,"context_line":"            already exist in the IdP\u0027s databases."}],"source_content_type":"application/xml","patch_set":5,"id":"da9df570_d388f6c8","line":62,"in_reply_to":"fa98f980_e8c42c43","updated":"2014-09-22 05:22:41.000000000","message":"Good point, at a minimum i\u0027d add \"having a common identity store is useful as it can be setup properly once and used in multiple places.\" to the end of this paragraph.","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":100,"context_line":"                \u003ccommand\u003ekeystone-all\u003c/command\u003e.\u003c/para\u003e"},{"line_number":101,"context_line":"                \u003csubsteps\u003e"},{"line_number":102,"context_line":"                  \u003cstep\u003e\u003cpara\u003eEnable SSL support. Install \u003cliteral\u003emod_nss\u003c/literal\u003e"},{"line_number":103,"context_line":"                    according to your distribution, then apply the following patch"},{"line_number":104,"context_line":"                    and restart HTTPD:\u003c/para\u003e"},{"line_number":105,"context_line":"\u003cprogramlisting\u003e--- /etc/httpd/conf.d/nss.conf.orig 2012-03-29 12:59:06.319470425 -0400"},{"line_number":106,"context_line":"+++ /etc/httpd/conf.d/nss.conf      2012-03-29 12:19:38.862721465 -0400"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_e310ca51","line":103,"updated":"2014-09-16 19:24:23.000000000","message":"This patch appears to be specific to a certain distribution of mod_nss.  Perhaps, instead, there should be a discussion of what parameters matter and how to configure those?","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":124,"context_line":" #DocumentRoot \"/etc/httpd/htdocs\""},{"line_number":125,"context_line":"\u0026lt;/virtualhost\u003e\u0026lt;/virtualhost\u003e\u003c/programlisting\u003e"},{"line_number":126,"context_line":"                  \u003c/step\u003e"},{"line_number":127,"context_line":"                  \u003cstep\u003e\u003cpara\u003eAllow SSL traffic to pass the firewall, add the following rule to iptables:\u003c/para\u003e"},{"line_number":128,"context_line":"\u003cprogramlisting\u003e-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT\u003c/programlisting\u003e"},{"line_number":129,"context_line":"                    \u003cpara\u003eNote this needs to be added before your reject all rule which might be:\u003c/para\u003e"},{"line_number":130,"context_line":"\u003cprogramlisting\u003e-A INPUT -j REJECT --reject-with icmp-host-prohibited\u003c/programlisting\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_63721ab2","line":127,"updated":"2014-09-16 19:24:23.000000000","message":"This is assuming that there is a firewall and that it uses IPtables.  Perhaps start by saying \"if you have a firewall in place\" and then add \"then you should configure it to allow SSL/TLS traffic... and here\u0027s an example of how to do that using IPtables\".","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c5bfba3b593ca54f8e82194e12e8ebc63bf55bcc","unresolved":false,"context_lines":[{"line_number":124,"context_line":" #DocumentRoot \"/etc/httpd/htdocs\""},{"line_number":125,"context_line":"\u0026lt;/virtualhost\u003e\u0026lt;/virtualhost\u003e\u003c/programlisting\u003e"},{"line_number":126,"context_line":"                  \u003c/step\u003e"},{"line_number":127,"context_line":"                  \u003cstep\u003e\u003cpara\u003eAllow SSL traffic to pass the firewall, add the following rule to iptables:\u003c/para\u003e"},{"line_number":128,"context_line":"\u003cprogramlisting\u003e-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT\u003c/programlisting\u003e"},{"line_number":129,"context_line":"                    \u003cpara\u003eNote this needs to be added before your reject all rule which might be:\u003c/para\u003e"},{"line_number":130,"context_line":"\u003cprogramlisting\u003e-A INPUT -j REJECT --reject-with icmp-host-prohibited\u003c/programlisting\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"da9df570_13935efb","line":127,"in_reply_to":"fa98f980_63721ab2","updated":"2014-09-22 05:22:41.000000000","message":"Good point.","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":131,"context_line":"                  \u003c/step\u003e"},{"line_number":132,"context_line":"                  \u003cstep\u003e\u003cpara\u003eCopy the \u003cfilename\u003ehttpd/wsgi-keystone.conf\u003c/filename\u003e"},{"line_number":133,"context_line":"                      file to the appropriate location for your Apache server,"},{"line_number":134,"context_line":"                      \u003cfilename\u003e/etc/httpd/conf.d/wsgi-keystone.conf"},{"line_number":135,"context_line":"                        \u003c/filename\u003e file.\u003c/para\u003e"},{"line_number":136,"context_line":"                  \u003c/step\u003e"},{"line_number":137,"context_line":"                  \u003cstep\u003e\u003cpara\u003eCreate the directory \u003cliteral\u003e/var/www/cgi-bin/keystone/\u003c/literal\u003e."}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_a36c02d2","line":134,"updated":"2014-09-16 19:24:23.000000000","message":"_for example_ /etc/https/conf.d/wsgi-keystone.conf","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"9feaae63ecfaf3c6cf4d5ded1554b1b80e437065","unresolved":false,"context_lines":[{"line_number":131,"context_line":"                  \u003c/step\u003e"},{"line_number":132,"context_line":"                  \u003cstep\u003e\u003cpara\u003eCopy the \u003cfilename\u003ehttpd/wsgi-keystone.conf\u003c/filename\u003e"},{"line_number":133,"context_line":"                      file to the appropriate location for your Apache server,"},{"line_number":134,"context_line":"                      \u003cfilename\u003e/etc/httpd/conf.d/wsgi-keystone.conf"},{"line_number":135,"context_line":"                        \u003c/filename\u003e file.\u003c/para\u003e"},{"line_number":136,"context_line":"                  \u003c/step\u003e"},{"line_number":137,"context_line":"                  \u003cstep\u003e\u003cpara\u003eCreate the directory \u003cliteral\u003e/var/www/cgi-bin/keystone/\u003c/literal\u003e."}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_07115353","line":134,"in_reply_to":"fa98f980_a36c02d2","updated":"2014-09-17 06:14:55.000000000","message":"Done","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":138,"context_line":"                      Then link the files \u003cliteral\u003emain\u003c/literal\u003e and \u003cliteral\u003eadmin\u003c/literal\u003e"},{"line_number":139,"context_line":"                      to the \u003cfilename\u003ekeystone.py\u003c/filename\u003e file in this directory.\u003c/para\u003e"},{"line_number":140,"context_line":"                    \u003cpara\u003eFor a distribution appropriate place, it should probably be copied to"},{"line_number":141,"context_line":"                      \u003cliteral\u003e/usr/share/openstack/keystone/httpd/keystone.py\u003c/literal\u003e.\u003c/para\u003e"},{"line_number":142,"context_line":"                  \u003c/step\u003e"},{"line_number":143,"context_line":"                  \u003cstep\u003e\u003cpara\u003eIf you are running with SELinux enabled (and you"},{"line_number":144,"context_line":"                      should be) ensure that the file has the appropriate SELinux"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_c3f666f9","line":141,"updated":"2014-09-16 19:24:23.000000000","message":"Again, be careful here with paths that may be distribution specific.","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":141,"context_line":"                      \u003cliteral\u003e/usr/share/openstack/keystone/httpd/keystone.py\u003c/literal\u003e.\u003c/para\u003e"},{"line_number":142,"context_line":"                  \u003c/step\u003e"},{"line_number":143,"context_line":"                  \u003cstep\u003e\u003cpara\u003eIf you are running with SELinux enabled (and you"},{"line_number":144,"context_line":"                      should be) ensure that the file has the appropriate SELinux"},{"line_number":145,"context_line":"                      context to access the linked file. For example, if you have"},{"line_number":146,"context_line":"                      the file in \u003cliteral\u003e/var/www/cgi-bin\u003c/literal\u003e location,"},{"line_number":147,"context_line":"                      you can do this by running:\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_03bf8efd","line":144,"updated":"2014-09-16 19:24:23.000000000","message":"I\u0027d remove the \"(and you should be)\".  While true, I try to keep that kind of commentary out of the guide.","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"9feaae63ecfaf3c6cf4d5ded1554b1b80e437065","unresolved":false,"context_lines":[{"line_number":141,"context_line":"                      \u003cliteral\u003e/usr/share/openstack/keystone/httpd/keystone.py\u003c/literal\u003e.\u003c/para\u003e"},{"line_number":142,"context_line":"                  \u003c/step\u003e"},{"line_number":143,"context_line":"                  \u003cstep\u003e\u003cpara\u003eIf you are running with SELinux enabled (and you"},{"line_number":144,"context_line":"                      should be) ensure that the file has the appropriate SELinux"},{"line_number":145,"context_line":"                      context to access the linked file. For example, if you have"},{"line_number":146,"context_line":"                      the file in \u003cliteral\u003e/var/www/cgi-bin\u003c/literal\u003e location,"},{"line_number":147,"context_line":"                      you can do this by running:\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_c71e6b5f","line":144,"in_reply_to":"fa98f980_03bf8efd","updated":"2014-09-17 06:14:55.000000000","message":"Done","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                      driver for tokens, otherwise the tokens will not be shared"},{"line_number":154,"context_line":"                      between the processes of the Apache HTTPD server.\u003c/para\u003e"},{"line_number":155,"context_line":"                    \u003cpara\u003eFor SQL, in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"},{"line_number":156,"context_line":"                      file, set:\u003c/para\u003e"},{"line_number":157,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[token]"},{"line_number":158,"context_line":"driver \u003d keystone.token.backends.sql.Token\u003c/programlisting\u003e"},{"line_number":159,"context_line":"                    \u003cpara\u003eFor memcache, in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_c344a61d","line":156,"updated":"2014-09-16 19:24:23.000000000","message":"the word \"file\" doesn\u0027t appear to be needed here","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"9feaae63ecfaf3c6cf4d5ded1554b1b80e437065","unresolved":false,"context_lines":[{"line_number":153,"context_line":"                      driver for tokens, otherwise the tokens will not be shared"},{"line_number":154,"context_line":"                      between the processes of the Apache HTTPD server.\u003c/para\u003e"},{"line_number":155,"context_line":"                    \u003cpara\u003eFor SQL, in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"},{"line_number":156,"context_line":"                      file, set:\u003c/para\u003e"},{"line_number":157,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[token]"},{"line_number":158,"context_line":"driver \u003d keystone.token.backends.sql.Token\u003c/programlisting\u003e"},{"line_number":159,"context_line":"                    \u003cpara\u003eFor memcache, in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_073873d3","line":156,"in_reply_to":"fa98f980_c344a61d","updated":"2014-09-17 06:14:55.000000000","message":"Done","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":156,"context_line":"                      file, set:\u003c/para\u003e"},{"line_number":157,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[token]"},{"line_number":158,"context_line":"driver \u003d keystone.token.backends.sql.Token\u003c/programlisting\u003e"},{"line_number":159,"context_line":"                    \u003cpara\u003eFor memcache, in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"},{"line_number":160,"context_line":"                      file, set:\u003c/para\u003e"},{"line_number":161,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[token]"},{"line_number":162,"context_line":"driver \u003d keystone.token.backends.memcache.Token\u003c/programlisting\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_e3f60ad8","line":159,"updated":"2014-09-16 19:24:23.000000000","message":"memcache or memcached?","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"9feaae63ecfaf3c6cf4d5ded1554b1b80e437065","unresolved":false,"context_lines":[{"line_number":156,"context_line":"                      file, set:\u003c/para\u003e"},{"line_number":157,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[token]"},{"line_number":158,"context_line":"driver \u003d keystone.token.backends.sql.Token\u003c/programlisting\u003e"},{"line_number":159,"context_line":"                    \u003cpara\u003eFor memcache, in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"},{"line_number":160,"context_line":"                      file, set:\u003c/para\u003e"},{"line_number":161,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[token]"},{"line_number":162,"context_line":"driver \u003d keystone.token.backends.memcache.Token\u003c/programlisting\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_672f7f89","line":159,"in_reply_to":"fa98f980_e3f60ad8","updated":"2014-09-17 06:14:55.000000000","message":"Done","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":157,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[token]"},{"line_number":158,"context_line":"driver \u003d keystone.token.backends.sql.Token\u003c/programlisting\u003e"},{"line_number":159,"context_line":"                    \u003cpara\u003eFor memcache, in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"},{"line_number":160,"context_line":"                      file, set:\u003c/para\u003e"},{"line_number":161,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[token]"},{"line_number":162,"context_line":"driver \u003d keystone.token.backends.memcache.Token\u003c/programlisting\u003e"},{"line_number":163,"context_line":"                    \u003cpara\u003eIn both cases, all servers that are storing tokens need"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_c35bc6f4","line":160,"updated":"2014-09-16 19:24:23.000000000","message":"remote \"file\"","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"9feaae63ecfaf3c6cf4d5ded1554b1b80e437065","unresolved":false,"context_lines":[{"line_number":157,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[token]"},{"line_number":158,"context_line":"driver \u003d keystone.token.backends.sql.Token\u003c/programlisting\u003e"},{"line_number":159,"context_line":"                    \u003cpara\u003eFor memcache, in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"},{"line_number":160,"context_line":"                      file, set:\u003c/para\u003e"},{"line_number":161,"context_line":"\u003cprogramlisting language\u003d\"ini\"\u003e[token]"},{"line_number":162,"context_line":"driver \u003d keystone.token.backends.memcache.Token\u003c/programlisting\u003e"},{"line_number":163,"context_line":"                    \u003cpara\u003eIn both cases, all servers that are storing tokens need"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_874b835e","line":160,"in_reply_to":"fa98f980_c35bc6f4","updated":"2014-09-17 06:14:55.000000000","message":"Done","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":166,"context_line":"                      instance.\u003c/para\u003e"},{"line_number":167,"context_line":"                  \u003c/step\u003e"},{"line_number":168,"context_line":"                  \u003cstep\u003e\u003cpara\u003eInstall Shibboleth:\u003c/para\u003e"},{"line_number":169,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003eapt-get install libapache2-mod-shib2\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":170,"context_line":"                  \u003c/step\u003e"},{"line_number":171,"context_line":"                  \u003cstep\u003e\u003cpara\u003eConfigure the Identity service virtual host and"},{"line_number":172,"context_line":"                      adjust the config to properly handle SAML2 workflow.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_2318121e","line":169,"updated":"2014-09-16 19:24:23.000000000","message":"\"apt-get\" is distro specific... perhaps make it clear that this is an example and that other systems would be installed differently","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"9feaae63ecfaf3c6cf4d5ded1554b1b80e437065","unresolved":false,"context_lines":[{"line_number":166,"context_line":"                      instance.\u003c/para\u003e"},{"line_number":167,"context_line":"                  \u003c/step\u003e"},{"line_number":168,"context_line":"                  \u003cstep\u003e\u003cpara\u003eInstall Shibboleth:\u003c/para\u003e"},{"line_number":169,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003eapt-get install libapache2-mod-shib2\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":170,"context_line":"                  \u003c/step\u003e"},{"line_number":171,"context_line":"                  \u003cstep\u003e\u003cpara\u003eConfigure the Identity service virtual host and"},{"line_number":172,"context_line":"                      adjust the config to properly handle SAML2 workflow.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_d6129b08","line":169,"in_reply_to":"fa98f980_2318121e","updated":"2014-09-17 06:14:55.000000000","message":"Done","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":202,"context_line":"\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003ea2enmod shib2\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":203,"context_line":"                  \u003c/step\u003e"},{"line_number":204,"context_line":"                  \u003cstep\u003e\u003cpara\u003eRestart Apache:\u003c/para\u003e"},{"line_number":205,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003eservice apache2 restart\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":206,"context_line":"                  \u003c/step\u003e"},{"line_number":207,"context_line":"                \u003c/substeps\u003e"},{"line_number":208,"context_line":"              \u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_e379aa31","line":205,"updated":"2014-09-16 19:24:23.000000000","message":"This command is distro specific","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":220,"context_line":"                      Identity Provider.\u003c/para\u003e"},{"line_number":221,"context_line":"                  \u003c/step\u003e"},{"line_number":222,"context_line":"                  \u003cstep\u003e\u003cpara\u003eConfigure your Service Provider by editing"},{"line_number":223,"context_line":"                      \u003cfilename\u003e/etc/shibboleth/shibboleth2.xml\u003c/filename\u003e file.\u003c/para\u003e"},{"line_number":224,"context_line":"                    \u003cpara\u003eFor more information, see \u003clink xlink:href\u003d\"https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration\"\u003e"},{"line_number":225,"context_line":"                        \u003ccitetitle\u003eShibboleth Service Provider Configuration\u003c/citetitle\u003e\u003c/link\u003e.\u003c/para\u003e"},{"line_number":226,"context_line":"                  \u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_039eae54","line":223,"updated":"2014-09-16 19:24:23.000000000","message":"Remove \"file\"","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":8103,"name":"Deepti Navale","email":"dnavale@redhat.com","username":"dnavale"},"change_message_id":"9feaae63ecfaf3c6cf4d5ded1554b1b80e437065","unresolved":false,"context_lines":[{"line_number":220,"context_line":"                      Identity Provider.\u003c/para\u003e"},{"line_number":221,"context_line":"                  \u003c/step\u003e"},{"line_number":222,"context_line":"                  \u003cstep\u003e\u003cpara\u003eConfigure your Service Provider by editing"},{"line_number":223,"context_line":"                      \u003cfilename\u003e/etc/shibboleth/shibboleth2.xml\u003c/filename\u003e file.\u003c/para\u003e"},{"line_number":224,"context_line":"                    \u003cpara\u003eFor more information, see \u003clink xlink:href\u003d\"https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration\"\u003e"},{"line_number":225,"context_line":"                        \u003ccitetitle\u003eShibboleth Service Provider Configuration\u003c/citetitle\u003e\u003c/link\u003e.\u003c/para\u003e"},{"line_number":226,"context_line":"                  \u003c/step\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_2763b7de","line":223,"in_reply_to":"fa98f980_039eae54","updated":"2014-09-17 06:14:55.000000000","message":"Done","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":280,"context_line":"        \u003c/section\u003e"},{"line_number":281,"context_line":"        \u003csection xml:id\u003d\"section_identity-federated-config\"\u003e"},{"line_number":282,"context_line":"          \u003ctitle\u003eConfiguring Federation\u003c/title\u003e"},{"line_number":283,"context_line":"          \u003cpara\u003eNow that the Identity Provider and Identity service are communicating,"},{"line_number":284,"context_line":"            you can start to configure the \u003cliteral\u003eOS-FEDERATION\u003c/literal\u003e extension.\u003c/para\u003e"},{"line_number":285,"context_line":"          \u003cprocedure\u003e"},{"line_number":286,"context_line":"            \u003cstep\u003e\u003cpara\u003eCreate Identity groups and assign roles.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_434996b6","line":283,"updated":"2014-09-16 19:24:23.000000000","message":"How can one verify that they are communicating as expected?\n\nAlso, perhaps it would be useful to have a section at the end of all of this with complete versions of the working config files (that are examples that people can build off of).","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c5bfba3b593ca54f8e82194e12e8ebc63bf55bcc","unresolved":false,"context_lines":[{"line_number":280,"context_line":"        \u003c/section\u003e"},{"line_number":281,"context_line":"        \u003csection xml:id\u003d\"section_identity-federated-config\"\u003e"},{"line_number":282,"context_line":"          \u003ctitle\u003eConfiguring Federation\u003c/title\u003e"},{"line_number":283,"context_line":"          \u003cpara\u003eNow that the Identity Provider and Identity service are communicating,"},{"line_number":284,"context_line":"            you can start to configure the \u003cliteral\u003eOS-FEDERATION\u003c/literal\u003e extension.\u003c/para\u003e"},{"line_number":285,"context_line":"          \u003cprocedure\u003e"},{"line_number":286,"context_line":"            \u003cstep\u003e\u003cpara\u003eCreate Identity groups and assign roles.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"da9df570_b3bb7271","line":283,"in_reply_to":"fa98f980_434996b6","updated":"2014-09-22 05:22:41.000000000","message":"Ideally this would be tested by navigating to the protected URL and attempting to sign in, and getting a response back from keystone. It may be wrong, but you should get *something* back.\n\n\nFWIW - maybe not in this patch, but there are some sample config files in the samplecode.zip attachment here: http://www.ibm.com/developerworks/cloud/library/cl-keystone-tfim/","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":290,"context_line":"                Identity service groups objects, and hence to local role"},{"line_number":291,"context_line":"                assignments.\u003c/para\u003e"},{"line_number":292,"context_line":"              \u003cpara\u003eThus, it is required to create the necessary Identity service"},{"line_number":293,"context_line":"                groups that correspond to the Identity Provider’s groups; additionally,"},{"line_number":294,"context_line":"                these groups should be assigned roles on one or more projects or"},{"line_number":295,"context_line":"                domains.\u003c/para\u003e\u003c/step\u003e"},{"line_number":296,"context_line":"            \u003cstep\u003e\u003cpara\u003eAdd Identity Providers, Mappings and Protocols.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_432a7691","line":293,"updated":"2014-09-16 19:24:23.000000000","message":"What are the groups that are needed?","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c5bfba3b593ca54f8e82194e12e8ebc63bf55bcc","unresolved":false,"context_lines":[{"line_number":290,"context_line":"                Identity service groups objects, and hence to local role"},{"line_number":291,"context_line":"                assignments.\u003c/para\u003e"},{"line_number":292,"context_line":"              \u003cpara\u003eThus, it is required to create the necessary Identity service"},{"line_number":293,"context_line":"                groups that correspond to the Identity Provider’s groups; additionally,"},{"line_number":294,"context_line":"                these groups should be assigned roles on one or more projects or"},{"line_number":295,"context_line":"                domains.\u003c/para\u003e\u003c/step\u003e"},{"line_number":296,"context_line":"            \u003cstep\u003e\u003cpara\u003eAdd Identity Providers, Mappings and Protocols.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"da9df570_f3ac1a38","line":293,"in_reply_to":"fa98f980_432a7691","updated":"2014-09-22 05:22:41.000000000","message":"The groups word here refers to Keystone groups that should be created so that when mapping from the SAML attribute \"Employees\", you can map it to a Keystone group \"devs\".\n\nThe Keystone administator can create as many groups as there are SAML attributes, whatever the mapping calls for.","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":311,"context_line":"              that is, the user will be redirected to the Identity Provider’s"},{"line_number":312,"context_line":"              authentication webpage and be prompted for credentials. After successfully"},{"line_number":313,"context_line":"              authenticating the user will be redirected to the Service Provider’s"},{"line_number":314,"context_line":"              endpoint. If using a web browser, a token will be returned in XML format.\u003c/para\u003e"},{"line_number":315,"context_line":"            \u003cpara\u003eIn the returned unscoped token, a list of Identity service groups"},{"line_number":316,"context_line":"              the user belongs to will be included.\u003c/para\u003e"},{"line_number":317,"context_line":"            \u003cpara\u003eFor example, the following URL would be considered protected"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_8602ac07","line":314,"updated":"2014-09-16 19:24:23.000000000","message":"And if not using a web browser?","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c5bfba3b593ca54f8e82194e12e8ebc63bf55bcc","unresolved":false,"context_lines":[{"line_number":311,"context_line":"              that is, the user will be redirected to the Identity Provider’s"},{"line_number":312,"context_line":"              authentication webpage and be prompted for credentials. After successfully"},{"line_number":313,"context_line":"              authenticating the user will be redirected to the Service Provider’s"},{"line_number":314,"context_line":"              endpoint. If using a web browser, a token will be returned in XML format.\u003c/para\u003e"},{"line_number":315,"context_line":"            \u003cpara\u003eIn the returned unscoped token, a list of Identity service groups"},{"line_number":316,"context_line":"              the user belongs to will be included.\u003c/para\u003e"},{"line_number":317,"context_line":"            \u003cpara\u003eFor example, the following URL would be considered protected"}],"source_content_type":"application/xml","patch_set":5,"id":"da9df570_3355c21d","line":314,"in_reply_to":"fa98f980_8602ac07","updated":"2014-09-22 05:22:41.000000000","message":"The alternative to a web browser would be using ECP (Enhanced Client or Proxy) which is available in keystoneclient from a client/API perspective, not a fully fledged command line.","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":318,"context_line":"              by \u003cliteral\u003emod_shib\u003c/literal\u003e and Apache, as such a request made"},{"line_number":319,"context_line":"              to the URL would be redirected to the Identity Provider, to start"},{"line_number":320,"context_line":"              the SAML authentication procedure.\u003c/para\u003e"},{"line_number":321,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003ecurl -X GET -D - http://localhost:5000/v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth\u003c/userinput\u003e\u003c/screen\u003e\u003c/step\u003e"},{"line_number":322,"context_line":"            \u003cstep\u003e\u003cpara\u003eDetermine accessible resources.\u003c/para\u003e"},{"line_number":323,"context_line":"              \u003cpara\u003eBy using the previously returned token, the user can issue"},{"line_number":324,"context_line":"                requests to the list projects and domains that are accessible.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_261bc074","line":321,"updated":"2014-09-16 19:24:23.000000000","message":"Is this the url that would be redirected?  This isn\u0027t clear... esp since it is represented as a curl command.  If this isn\u0027t that url, then what is it?","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c5bfba3b593ca54f8e82194e12e8ebc63bf55bcc","unresolved":false,"context_lines":[{"line_number":318,"context_line":"              by \u003cliteral\u003emod_shib\u003c/literal\u003e and Apache, as such a request made"},{"line_number":319,"context_line":"              to the URL would be redirected to the Identity Provider, to start"},{"line_number":320,"context_line":"              the SAML authentication procedure.\u003c/para\u003e"},{"line_number":321,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003ecurl -X GET -D - http://localhost:5000/v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth\u003c/userinput\u003e\u003c/screen\u003e\u003c/step\u003e"},{"line_number":322,"context_line":"            \u003cstep\u003e\u003cpara\u003eDetermine accessible resources.\u003c/para\u003e"},{"line_number":323,"context_line":"              \u003cpara\u003eBy using the previously returned token, the user can issue"},{"line_number":324,"context_line":"                requests to the list projects and domains that are accessible.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"da9df570_f35a5a4f","line":321,"in_reply_to":"fa98f980_261bc074","updated":"2014-09-22 05:22:41.000000000","message":"This probably shouldn\u0027t be a curl command.\n\nHitting the protected url with a browser will redirect you to the log in page.","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":330,"context_line":"                    \u003cliteral\u003eGET /OS-FEDERATION/domains\u003c/literal\u003e\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":331,"context_line":"              \u003c/itemizedlist\u003e"},{"line_number":332,"context_line":"              \u003cpara\u003eFor example,\u003c/para\u003e"},{"line_number":333,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003ecurl -X GET -H \"X-Auth-Token: \u0026lt;unscoped token\u003e\" http://localhost:5000/v3/OS-FEDERATION/projects\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":334,"context_line":"          \u003cpara\u003eor\u003c/para\u003e"},{"line_number":335,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e curl -X GET -H \"X-Auth-Token: \u0026lt;unscoped token\u003e\" http://localhost:5000/v3/OS-FEDERATION/domains\u003c/screen\u003e\u003c/step\u003e"},{"line_number":336,"context_line":"            \u003cstep\u003e\u003cpara\u003eGet a scoped token.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_46460451","line":333,"updated":"2014-09-16 19:24:23.000000000","message":"What service are you assuming is running on port 5000 on localhost.  I didn\u0027t see that in any of the config files anywhere.","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c5bfba3b593ca54f8e82194e12e8ebc63bf55bcc","unresolved":false,"context_lines":[{"line_number":330,"context_line":"                    \u003cliteral\u003eGET /OS-FEDERATION/domains\u003c/literal\u003e\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":331,"context_line":"              \u003c/itemizedlist\u003e"},{"line_number":332,"context_line":"              \u003cpara\u003eFor example,\u003c/para\u003e"},{"line_number":333,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003ecurl -X GET -H \"X-Auth-Token: \u0026lt;unscoped token\u003e\" http://localhost:5000/v3/OS-FEDERATION/projects\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":334,"context_line":"          \u003cpara\u003eor\u003c/para\u003e"},{"line_number":335,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e curl -X GET -H \"X-Auth-Token: \u0026lt;unscoped token\u003e\" http://localhost:5000/v3/OS-FEDERATION/domains\u003c/screen\u003e\u003c/step\u003e"},{"line_number":336,"context_line":"            \u003cstep\u003e\u003cpara\u003eGet a scoped token.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"da9df570_9344ae75","line":333,"in_reply_to":"fa98f980_46460451","updated":"2014-09-22 05:22:41.000000000","message":"Keystone should be running on port 5000","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"8f1c722ce0de596b9346fb05188853951c4c6d56","unresolved":false,"context_lines":[{"line_number":341,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003ecurl -X POST -H \"Content-Type: application/json\" -d \u0027{\"auth\":{\"identity\":{\"methods\":[\"saml2\"],\"saml2\":{\"id\":\"\u0026lt;unscoped_token_id\u003e\"}},\"scope\":{\"project\":{\"domain\": {\"name\": \"Default\"},\"name\":\"service\"}}}}\u0027 -D - http://localhost:5000/v3/auth/tokens\u003c/userinput\u003e\u003c/screen\u003e\u003c/step\u003e"},{"line_number":342,"context_line":"          \u003c/procedure\u003e"},{"line_number":343,"context_line":"        \u003c/section\u003e"},{"line_number":344,"context_line":"      \u003c/section\u003e"},{"line_number":345,"context_line":"  \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"fa98f980_e66538e3","line":344,"updated":"2014-09-16 19:24:23.000000000","message":"It would be nice to have a brief discussion about the extent to which this is supported in the command line clients today and where that support is headed in the future.  Also, perhaps the same for web dashboard support (e.g., Horizon).","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c5bfba3b593ca54f8e82194e12e8ebc63bf55bcc","unresolved":false,"context_lines":[{"line_number":341,"context_line":"\u003cscreen\u003e\u003cprompt\u003e#\u003c/prompt\u003e \u003cuserinput\u003ecurl -X POST -H \"Content-Type: application/json\" -d \u0027{\"auth\":{\"identity\":{\"methods\":[\"saml2\"],\"saml2\":{\"id\":\"\u0026lt;unscoped_token_id\u003e\"}},\"scope\":{\"project\":{\"domain\": {\"name\": \"Default\"},\"name\":\"service\"}}}}\u0027 -D - http://localhost:5000/v3/auth/tokens\u003c/userinput\u003e\u003c/screen\u003e\u003c/step\u003e"},{"line_number":342,"context_line":"          \u003c/procedure\u003e"},{"line_number":343,"context_line":"        \u003c/section\u003e"},{"line_number":344,"context_line":"      \u003c/section\u003e"},{"line_number":345,"context_line":"  \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"da9df570_734f4a93","line":344,"in_reply_to":"fa98f980_e66538e3","updated":"2014-09-22 05:22:41.000000000","message":"For the dashboard, there is no support.\nFor the command line, we landed a few patches that enables ECP (basically non-browser) support for keystoneclient, from an API perspective. \n\nSo if using keystoneclient, you can create a client instance and use the SAML Authorization plugin.","commit_id":"39713ef56bd0a67e6b061674359781d12064ba7e"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"eaf020af25ee56f554590e94085c7f760a409d9d","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    \u003cpara\u003eFederated Identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and an OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated Identity provides a way to securely use existing credentials"},{"line_number":12,"context_line":"      to access cloud resources such as servers, files, volumes, and databases,"},{"line_number":13,"context_line":"      across multiple endpoints provided in multiple authorized clouds using a"},{"line_number":14,"context_line":"      single credential, without having to provision additional identities or"},{"line_number":15,"context_line":"      re-login multiple times. The credential is maintained by the user\u0027s"}],"source_content_type":"application/xml","patch_set":6,"id":"da9df570_d7bb7970","line":12,"updated":"2014-09-22 14:44:07.000000000","message":"This list of resources feels a bit clunky but I think the rest of this section is really good.","commit_id":"2e72c62d9a7989b7e2a9bb4a873770931d674b05"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"eaf020af25ee56f554590e94085c7f760a409d9d","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        \u003ctitle\u003eWhy use Federated Identity?\u003c/title\u003e"},{"line_number":62,"context_line":"        \u003citemizedlist\u003e"},{"line_number":63,"context_line":"          \u003clistitem\u003e\u003cpara\u003eIt is a security risk every time a new identity is"},{"line_number":64,"context_line":"            provisioned. It is difficult to secure credential storage and to"},{"line_number":65,"context_line":"            deploy it with proper policies, etc. With Federated Identity, a common"},{"line_number":66,"context_line":"            identity store is useful as it can be setup properly once and used in"},{"line_number":67,"context_line":"            multiple places and there is no longer a need to provision user entries"}],"source_content_type":"application/xml","patch_set":6,"id":"da9df570_adca229f","line":64,"updated":"2014-09-22 14:44:07.000000000","message":"First sentence is a bit harsh, perhaps:\nProvisioning new identities often incurs some security risk..","commit_id":"2e72c62d9a7989b7e2a9bb4a873770931d674b05"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eFederated Identity\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eFederated Identity is a mechanism to establish trusts between identity"},{"line_number":10,"context_line":"      providers and an OpenStack cloud.\u003c/para\u003e"},{"line_number":11,"context_line":"    \u003cpara\u003eFederated Identity provides a way to securely use existing credentials"},{"line_number":12,"context_line":"      to access cloud resources such as servers, volumes, and databases,"},{"line_number":13,"context_line":"      across multiple endpoints provided in multiple authorized clouds using a"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_f63caae4","line":10,"updated":"2014-10-02 21:30:01.000000000","message":"between Identity Providers and Service Providers (SP), in this case, between Identity Providers and the services provided by an OpenStack Cloud.","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    \u003cpara\u003eFederated Identity provides a way to securely use existing credentials"},{"line_number":12,"context_line":"      to access cloud resources such as servers, volumes, and databases,"},{"line_number":13,"context_line":"      across multiple endpoints provided in multiple authorized clouds using a"},{"line_number":14,"context_line":"      single credential, without having to provision additional identities or"},{"line_number":15,"context_line":"      re-login multiple times. The credential is maintained by the user\u0027s"},{"line_number":16,"context_line":"      Identity Provider.\u003c/para\u003e"},{"line_number":17,"context_line":"    \u003cpara\u003eSome important definitions:\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_b619428a","line":14,"updated":"2014-10-02 21:30:01.000000000","message":"a single set of credentials","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":13,"context_line":"      across multiple endpoints provided in multiple authorized clouds using a"},{"line_number":14,"context_line":"      single credential, without having to provision additional identities or"},{"line_number":15,"context_line":"      re-login multiple times. The credential is maintained by the user\u0027s"},{"line_number":16,"context_line":"      Identity Provider.\u003c/para\u003e"},{"line_number":17,"context_line":"    \u003cpara\u003eSome important definitions:\u003c/para\u003e"},{"line_number":18,"context_line":"    \u003cvariablelist\u003e"},{"line_number":19,"context_line":"      \u003cvarlistentry\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_5608162d","line":16,"updated":"2014-10-02 21:30:01.000000000","message":"log in multiple times (not relog in multiple times)","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":23,"context_line":"            Service Provider.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":24,"context_line":"      \u003c/varlistentry\u003e"},{"line_number":25,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":26,"context_line":"        \u003cterm\u003eIdentity Provider (IdP)\u003c/term\u003e"},{"line_number":27,"context_line":"        \u003clistitem\u003e\u003cpara\u003eA third party service that stores information about users"},{"line_number":28,"context_line":"            and groups.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":29,"context_line":"      \u003c/varlistentry\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_b92775b5","line":26,"updated":"2014-10-02 21:30:01.000000000","message":"I admit that this net line is stolen from Wikipedia, but I think we should at least let readers know the names of some of the more commonly used Identity Providers.  Edit as you see fit of course.\n\n\"A directory service, such as LDAP, RADIUS and Active Directory, which allows users to login with a user name and password, is a typical source of authentication tokens (e.g. passwords) at an identity provider.\"","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        \u003cterm\u003eProtocol\u003c/term\u003e"},{"line_number":44,"context_line":"        \u003clistitem\u003e\u003cpara\u003eContains information that dictates which Mapping"},{"line_number":45,"context_line":"            rules to use for an incoming request made by an IdP. An IdP may have"},{"line_number":46,"context_line":"            multiple supported protocols.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":47,"context_line":"      \u003c/varlistentry\u003e"},{"line_number":48,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":49,"context_line":"        \u003cterm\u003eUnscoped token\u003c/term\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_f9a65d0f","line":46,"updated":"2014-10-02 21:30:01.000000000","message":"change to \"may support multiple protocols\".  Could be good to give a couple of examples of the common protocols","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":48,"context_line":"      \u003cvarlistentry\u003e"},{"line_number":49,"context_line":"        \u003cterm\u003eUnscoped token\u003c/term\u003e"},{"line_number":50,"context_line":"        \u003clistitem\u003e\u003cpara\u003eAllows a user to authenticate with the Identity"},{"line_number":51,"context_line":"            service to exchange it for a scoped token, by providing a project"},{"line_number":52,"context_line":"            ID or a domain ID.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":53,"context_line":"      \u003c/varlistentry\u003e"},{"line_number":54,"context_line":"      \u003cvarlistentry\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_d986f964","line":51,"updated":"2014-10-02 21:30:01.000000000","message":"change \"it\" to \"the unscoped token\"","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":63,"context_line":"          \u003clistitem\u003e\u003cpara\u003eProvisioning new identities often incurs some security"},{"line_number":64,"context_line":"           risk. It is difficult to secure credential storage and to deploy it"},{"line_number":65,"context_line":"           with proper policies. A common identity store is useful as it can be"},{"line_number":66,"context_line":"           setup properly once and used in multiple places. With Federated Identity,"},{"line_number":67,"context_line":"           there is no longer a need to provision user entries in Identity service,"},{"line_number":68,"context_line":"           since the user entries already exist in the IdP\u0027s databases.\u003c/para\u003e"},{"line_number":69,"context_line":"            \u003cpara\u003eThis does introduce new challenges around protecting that"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_599209a0","line":66,"updated":"2014-10-02 21:30:01.000000000","message":"change \"setup\" to \"set up\"","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":68,"context_line":"           since the user entries already exist in the IdP\u0027s databases.\u003c/para\u003e"},{"line_number":69,"context_line":"            \u003cpara\u003eThis does introduce new challenges around protecting that"},{"line_number":70,"context_line":"             identity. However, this is a worthwhile tradeoff given the greater"},{"line_number":71,"context_line":"             control, and fewer credential databases that come with this model.\u003c/para\u003e"},{"line_number":72,"context_line":"            \u003c/listitem\u003e"},{"line_number":73,"context_line":"        \u003clistitem\u003e\u003cpara\u003eIt is a burden on the clients to deal with multiple tokens"},{"line_number":74,"context_line":"            across multiple cloud service providers. Federated Identity provides"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_19f881e4","line":71,"updated":"2014-10-02 21:30:01.000000000","message":"change \"that come with this model\" to \"that come with a centralized common identity store\".","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        \u003clistitem\u003e\u003cpara\u003eIt is a burden on the clients to deal with multiple tokens"},{"line_number":74,"context_line":"            across multiple cloud service providers. Federated Identity provides"},{"line_number":75,"context_line":"            single sign on to the user, who can use the same set of credentials"},{"line_number":76,"context_line":"            with his IdP to access many different services on the Internet.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":77,"context_line":"        \u003clistitem\u003e\u003cpara\u003eUsers spend too much time logging in or going through"},{"line_number":78,"context_line":"            \u0027Forget Password\u0027 workflows. With Federated Identity, there is no"},{"line_number":79,"context_line":"            need to support users who forget their passwords. The IdPs already"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_99bab108","line":76,"updated":"2014-10-02 21:30:01.000000000","message":"who can use the credentials provided and maintained by the user\u0027s IdP to access.........","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":77,"context_line":"        \u003clistitem\u003e\u003cpara\u003eUsers spend too much time logging in or going through"},{"line_number":78,"context_line":"            \u0027Forget Password\u0027 workflows. With Federated Identity, there is no"},{"line_number":79,"context_line":"            need to support users who forget their passwords. The IdPs already"},{"line_number":80,"context_line":"            do this.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":81,"context_line":"        \u003clistitem\u003e\u003cpara\u003eToo much time is spent administering identities in various"},{"line_number":82,"context_line":"            service providers.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":83,"context_line":"        \u003clistitem\u003e\u003cpara\u003eBest test of interoperability in the cloud is to enable"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_596e8997","line":80,"updated":"2014-10-02 21:30:01.000000000","message":"Federated identity allows for single sign on, which is easier and faster for users and requires fewer password resets.  The IdPs manage user identities and passwords so that OpenStack does not have to.","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":80,"context_line":"            do this.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":81,"context_line":"        \u003clistitem\u003e\u003cpara\u003eToo much time is spent administering identities in various"},{"line_number":82,"context_line":"            service providers.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":83,"context_line":"        \u003clistitem\u003e\u003cpara\u003eBest test of interoperability in the cloud is to enable"},{"line_number":84,"context_line":"            one identity access across multiple clouds. Multiple collaborating"},{"line_number":85,"context_line":"            organizations can quickly share the same cloud services by each"},{"line_number":86,"context_line":"            using their own local IdP to authenticate their users.\u003c/para\u003e\u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_19ec01c7","line":83,"updated":"2014-10-02 21:30:01.000000000","message":"The best test of interoperability in the cloud is the ability to enable a user with one set of credentials in an IdP to access multiple cloud services.","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":83,"context_line":"        \u003clistitem\u003e\u003cpara\u003eBest test of interoperability in the cloud is to enable"},{"line_number":84,"context_line":"            one identity access across multiple clouds. Multiple collaborating"},{"line_number":85,"context_line":"            organizations can quickly share the same cloud services by each"},{"line_number":86,"context_line":"            using their own local IdP to authenticate their users.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":87,"context_line":"        \u003clistitem\u003e\u003cpara\u003eRemoves a blocker to cloud brokering and multi-cloud"},{"line_number":88,"context_line":"            workload management. There is no need to build additional authentication"},{"line_number":89,"context_line":"            mechanisms into Identity, since the IdPs take care of authenticating"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_59cda95c","line":86,"updated":"2014-10-02 21:30:01.000000000","message":"Organizations, each using its own IdP can easily allow their users to collaborate and quickly share the same cloud services","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":86,"context_line":"            using their own local IdP to authenticate their users.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":87,"context_line":"        \u003clistitem\u003e\u003cpara\u003eRemoves a blocker to cloud brokering and multi-cloud"},{"line_number":88,"context_line":"            workload management. There is no need to build additional authentication"},{"line_number":89,"context_line":"            mechanisms into Identity, since the IdPs take care of authenticating"},{"line_number":90,"context_line":"            their own users using whichever technologies they deem to be appropriate."},{"line_number":91,"context_line":"            So multiple authentication technologies are already in use.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":92,"context_line":"      \u003c/itemizedlist\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_b9905544","line":89,"updated":"2014-10-02 21:30:01.000000000","message":"change \"to Identity\" to \"authenticate users\"","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":88,"context_line":"            workload management. There is no need to build additional authentication"},{"line_number":89,"context_line":"            mechanisms into Identity, since the IdPs take care of authenticating"},{"line_number":90,"context_line":"            their own users using whichever technologies they deem to be appropriate."},{"line_number":91,"context_line":"            So multiple authentication technologies are already in use.\u003c/para\u003e\u003c/listitem\u003e"},{"line_number":92,"context_line":"      \u003c/itemizedlist\u003e"},{"line_number":93,"context_line":"      \u003c/section\u003e"},{"line_number":94,"context_line":"      \u003csection xml:id\u003d\"section-identity-configuring-identity-for-federation\"\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_99a9d17d","line":91,"updated":"2014-10-02 21:30:01.000000000","message":"Change \"So\" to \"In most organizations, multiple ....\"","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":95,"context_line":"        \u003ctitle\u003eConfiguring Identity service for Federation\u003c/title\u003e"},{"line_number":96,"context_line":"        \u003cpara\u003eFederated users are not mirrored in the Identity service back end (for example,"},{"line_number":97,"context_line":"          using the SQL driver). The external IdP is responsible for authenticating users,"},{"line_number":98,"context_line":"          and communicates the result of authentication to Identity service using SAML assertions."},{"line_number":99,"context_line":"          Identity service maps the SAML assertions to keystone user groups and assignments"},{"line_number":100,"context_line":"          created in Identity service.\u003c/para\u003e"},{"line_number":101,"context_line":"        \u003csection xml:id\u003d\"section_identity-enabling-federation\"\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_79c50d3b","line":98,"updated":"2014-10-02 21:30:01.000000000","message":"change \"result of authentication\" to \"result of the authentication\"","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":13243,"name":"Ellen","email":"enewland@redhat.com","username":"e_newlands"},"change_message_id":"b7068840ad08e4d92166ca42fead870acc8c46fe","unresolved":false,"context_lines":[{"line_number":96,"context_line":"        \u003cpara\u003eFederated users are not mirrored in the Identity service back end (for example,"},{"line_number":97,"context_line":"          using the SQL driver). The external IdP is responsible for authenticating users,"},{"line_number":98,"context_line":"          and communicates the result of authentication to Identity service using SAML assertions."},{"line_number":99,"context_line":"          Identity service maps the SAML assertions to keystone user groups and assignments"},{"line_number":100,"context_line":"          created in Identity service.\u003c/para\u003e"},{"line_number":101,"context_line":"        \u003csection xml:id\u003d\"section_identity-enabling-federation\"\u003e"},{"line_number":102,"context_line":"          \u003ctitle\u003eEnabling Federation\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"baa201ad_39d2a500","line":99,"updated":"2014-10-02 21:30:01.000000000","message":"Capitalize keystone","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"758f08001036abe04c3d78b2683778d73f874570","unresolved":false,"context_lines":[{"line_number":146,"context_line":"                      to the \u003cfilename\u003ekeystone.py\u003c/filename\u003e file in this directory.\u003c/para\u003e"},{"line_number":147,"context_line":"                    \u003cpara\u003eFor a distribution appropriate place, it should probably be copied to"},{"line_number":148,"context_line":"                      \u003cliteral\u003e/usr/share/openstack/keystone/httpd/keystone.py\u003c/literal\u003e.\u003c/para\u003e"},{"line_number":149,"context_line":"                      \u003cnote\u003e\u003cpara\u003eThis path is  is Ubuntu-specific. For other"},{"line_number":150,"context_line":"                       distributions, replace with appropriate path.\u003c/para\u003e\u003c/note\u003e"},{"line_number":151,"context_line":"                  \u003c/step\u003e"},{"line_number":152,"context_line":"                  \u003cstep\u003e\u003cpara\u003eIf you are running with SELinux enabled ensure"}],"source_content_type":"application/xml","patch_set":7,"id":"da9df570_ffc26fe7","line":149,"updated":"2014-10-02 19:41:36.000000000","message":"typo here: is  is","commit_id":"113508328795105add9a1312e05d64b0210a9f2f"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"c5af907ef1b43f9fb53145506edea25229a05ab2","unresolved":false,"context_lines":[{"line_number":457,"context_line":"    \u003c/section\u003e"},{"line_number":458,"context_line":"    \u003csection xml:id\u003d\"section-federated-future\"\u003e"},{"line_number":459,"context_line":"      \u003ctitle\u003eFuture\u003c/title\u003e"},{"line_number":460,"context_line":"      \u003cpara\u003eCurrently, the CLI supports the Ehnanced Client or Proxy (ECP),"},{"line_number":461,"context_line":"       (the non-browser) support for \u003cliteral\u003ekeystoneclient\u003c/literal\u003e from an"},{"line_number":462,"context_line":"       API perspective. So, if you are using the \u003cliteral\u003ekeystoneclient\u003c/literal\u003e,"},{"line_number":463,"context_line":"       you can create a client instance and use the SAML authorization plugin."}],"source_content_type":"application/xml","patch_set":9,"id":"baa201ad_0c275613","line":460,"updated":"2014-10-03 10:23:51.000000000","message":"Enhanced","commit_id":"6df1cb4ef3b655debd9eafb85d26467294a6ea29"}]}