)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f963ce53be48089688d232570084ee8072f227fa","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     hyakuhei \u003crobert.clark@hp.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-12-09 15:07:03 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Adds OSSN-0042 Keystone Trusts"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I56975221e62de4dd6272cce1a69e5742ca5b0f2f"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"3a961159_3f670127","line":7,"updated":"2014-12-09 19:40:44.000000000","message":"The title mentions trusts but the document is about normal token scoping.","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3a58106e50ed2dc1d0977b40277029b4d5638ca7","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-12-12 09:44:13 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Adds OSSN-0042 Keystone Scoping"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I56975221e62de4dd6272cce1a69e5742ca5b0f2f"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"3a961159_bb8f1074","line":8,"updated":"2014-12-12 16:25:16.000000000","message":"Add \u0027Closes-bug: #1341816\u0027.","commit_id":"5c7d2cd44f5b1b191ea994598f8b4a0f88026e85"}],"security-notes/OSSN-0042":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"46bb73a0c55315e3d0ad9dff508a2b5dea950d8a","unresolved":false,"context_lines":[{"line_number":28,"context_line":"other services requires the extra step of requesting an un-scoped token"},{"line_number":29,"context_line":"from Keystone. They can help with audit trails and good code practices"},{"line_number":30,"context_line":"when used correctly but there\u0027s currently no way to enforce that they"},{"line_number":31,"context_line":"are used correctly."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"### Recommended Action ###"},{"line_number":34,"context_line":"Users and deployers of OpenStack should not rely on scoped tokens to"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"3a961159_d41457f7","line":31,"updated":"2014-12-08 14:25:52.000000000","message":"nit: I would say simply \"... but there\u0027s currently no way to enforce this.\"","commit_id":"76c22d2cade7b89681104dcc5b346d7bc0577906"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"49a1a1d191f9c32193a3ee760cd088b94a752019","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone provides \"Scoped\" tokens that can be constrained to use by a"},{"line_number":6,"context_line":"single project. This mechanism does not enhance security as any project"},{"line_number":7,"context_line":"can use a scoped token to request an un-scoped token from Keystone."},{"line_number":8,"context_line":"If users expect their scoped token to be usable only by the project the"},{"line_number":9,"context_line":"token was given to this could be considered a privilege escalation."},{"line_number":10,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_456fc2c5","line":7,"updated":"2014-12-08 23:37:00.000000000","message":"Not just any project, but anyone possessing a scoped token.  It\u0027s probably worth being more generic here.","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"efed0a43ed9279e73a8628b0b3c082fb1092705a","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone provides \"Scoped\" tokens that can be constrained to use by a"},{"line_number":6,"context_line":"single project. This mechanism does not enhance security as any project"},{"line_number":7,"context_line":"can use a scoped token to request an un-scoped token from Keystone."},{"line_number":8,"context_line":"If users expect their scoped token to be usable only by the project the"},{"line_number":9,"context_line":"token was given to this could be considered a privilege escalation."},{"line_number":10,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_2da60d54","line":7,"in_reply_to":"3a961159_456fc2c5","updated":"2014-12-09 12:50:55.000000000","message":"Done","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"49a1a1d191f9c32193a3ee760cd088b94a752019","unresolved":false,"context_lines":[{"line_number":6,"context_line":"single project. This mechanism does not enhance security as any project"},{"line_number":7,"context_line":"can use a scoped token to request an un-scoped token from Keystone."},{"line_number":8,"context_line":"If users expect their scoped token to be usable only by the project the"},{"line_number":9,"context_line":"token was given to this could be considered a privilege escalation."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Keystone, Icehouse, Juno, Kilo"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_854b6a2a","line":9,"updated":"2014-12-08 23:37:00.000000000","message":"This sentence is a bit off.  A user gives their token to a service, not a project.  It\u0027s expected that one service may forward your token to another service to perform the requested action, so we can\u0027t simply replace \u0027project\u0027 with \u0027service\u0027 here either.  What about:\n\n\"A user may expect that their scoped token can only be used to perform operations for the project it is scoped to, which is not the case.  A service or other party who obtains the scoped token can use it to obtain a token for a different authorized scope, which may be considered a privilege escalation.\"","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"efed0a43ed9279e73a8628b0b3c082fb1092705a","unresolved":false,"context_lines":[{"line_number":6,"context_line":"single project. This mechanism does not enhance security as any project"},{"line_number":7,"context_line":"can use a scoped token to request an un-scoped token from Keystone."},{"line_number":8,"context_line":"If users expect their scoped token to be usable only by the project the"},{"line_number":9,"context_line":"token was given to this could be considered a privilege escalation."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Keystone, Icehouse, Juno, Kilo"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_ed2085b2","line":9,"in_reply_to":"3a961159_854b6a2a","updated":"2014-12-09 12:50:55.000000000","message":"Done","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"0e2e70f0858fc27647150d380f80e36a1ec70919","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Keystone, Icehouse, Juno, Kilo"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"This is not a bug in Keystone, it\u0027s a design feature that we believe"},{"line_number":16,"context_line":"some users may expect to bring security enhancement when it does not."},{"line_number":17,"context_line":"The OSSG is issuing this security note to highlight the issue."},{"line_number":18,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_6d4e5598","line":15,"updated":"2014-12-09 12:46:13.000000000","message":"\u0027we believe\u0027 adds nothing in this sentence.","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"49a1a1d191f9c32193a3ee760cd088b94a752019","unresolved":false,"context_lines":[{"line_number":20,"context_line":"and pass it to another service to perform some portion of the intended"},{"line_number":21,"context_line":"operation. This token is very powerful and can be used to perform"},{"line_number":22,"context_line":"many actions for the user. Scoped tokens limit their use to the roles"},{"line_number":23,"context_line":"or project they were granted for. However, currently Keystone allows"},{"line_number":24,"context_line":"projects to request un-scoped tokens and will issue them if a scoped"},{"line_number":25,"context_line":"token is presented."},{"line_number":26,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_455982fd","line":23,"updated":"2014-12-08 23:37:00.000000000","message":"roles and project","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"efed0a43ed9279e73a8628b0b3c082fb1092705a","unresolved":false,"context_lines":[{"line_number":20,"context_line":"and pass it to another service to perform some portion of the intended"},{"line_number":21,"context_line":"operation. This token is very powerful and can be used to perform"},{"line_number":22,"context_line":"many actions for the user. Scoped tokens limit their use to the roles"},{"line_number":23,"context_line":"or project they were granted for. However, currently Keystone allows"},{"line_number":24,"context_line":"projects to request un-scoped tokens and will issue them if a scoped"},{"line_number":25,"context_line":"token is presented."},{"line_number":26,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_ad167d53","line":23,"in_reply_to":"3a961159_455982fd","updated":"2014-12-09 12:50:55.000000000","message":"Done","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"49a1a1d191f9c32193a3ee760cd088b94a752019","unresolved":false,"context_lines":[{"line_number":22,"context_line":"many actions for the user. Scoped tokens limit their use to the roles"},{"line_number":23,"context_line":"or project they were granted for. However, currently Keystone allows"},{"line_number":24,"context_line":"projects to request un-scoped tokens and will issue them if a scoped"},{"line_number":25,"context_line":"token is presented."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Scoped tokens stop accidental leakage of tokens as to use them with"},{"line_number":28,"context_line":"other services requires the extra step of requesting an un-scoped token"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_85728a7a","line":25,"updated":"2014-12-08 23:37:00.000000000","message":"I believe that it also allows using a scoped token to get a token for another scope.  I\u0027ll double check this path in the code.","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"0e2e70f0858fc27647150d380f80e36a1ec70919","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Scoped tokens stop accidental leakage of tokens as to use them with"},{"line_number":28,"context_line":"other services requires the extra step of requesting an un-scoped token"},{"line_number":29,"context_line":"from Keystone. They can help with audit trails and good code practices"},{"line_number":30,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"### Recommended Action ###"},{"line_number":33,"context_line":"Users and deployers of OpenStack should not rely on scoped tokens to"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_b8a959e1","line":30,"updated":"2014-12-09 12:46:13.000000000","message":"\u0027no way to enforce this\u0027. Do you mean there is no way to force the use of scoped tokens?","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"49a1a1d191f9c32193a3ee760cd088b94a752019","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Scoped tokens stop accidental leakage of tokens as to use them with"},{"line_number":28,"context_line":"other services requires the extra step of requesting an un-scoped token"},{"line_number":29,"context_line":"from Keystone. They can help with audit trails and good code practices"},{"line_number":30,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"### Recommended Action ###"},{"line_number":33,"context_line":"Users and deployers of OpenStack should not rely on scoped tokens to"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_4527c264","line":30,"updated":"2014-12-08 23:37:00.000000000","message":"We should mention that this only works with a non-expired token.  If a token is no longer valid, it can\u0027t be used to obtain another token at any scope.","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"efed0a43ed9279e73a8628b0b3c082fb1092705a","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Scoped tokens stop accidental leakage of tokens as to use them with"},{"line_number":28,"context_line":"other services requires the extra step of requesting an un-scoped token"},{"line_number":29,"context_line":"from Keystone. They can help with audit trails and good code practices"},{"line_number":30,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"### Recommended Action ###"},{"line_number":33,"context_line":"Users and deployers of OpenStack should not rely on scoped tokens to"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_78ed3125","line":30,"in_reply_to":"3a961159_4527c264","updated":"2014-12-09 12:50:55.000000000","message":"Done","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"959e133dc64020a94b91683af44c192081f763fa","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Scoped tokens stop accidental leakage of tokens as to use them with"},{"line_number":28,"context_line":"other services requires the extra step of requesting an un-scoped token"},{"line_number":29,"context_line":"from Keystone. They can help with audit trails and good code practices"},{"line_number":30,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"### Recommended Action ###"},{"line_number":33,"context_line":"Users and deployers of OpenStack should not rely on scoped tokens to"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3a961159_b886b911","line":30,"in_reply_to":"3a961159_b8a959e1","updated":"2014-12-09 12:52:42.000000000","message":"I mean there\u0027s no way to enforce they\u0027re used correctly","commit_id":"f0c58323eea44b49404200e86d8c97e7fd75bd81"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"da5944c6d96860edbaa75efcd77e09f5416d1587","unresolved":false,"context_lines":[{"line_number":23,"context_line":"and pass it to another service to perform some portion of the intended"},{"line_number":24,"context_line":"operation. This token is very powerful and can be used to perform"},{"line_number":25,"context_line":"many actions for the user. Scoped tokens limit their use to the project"},{"line_number":26,"context_line":"and roles they were granted for. However, currently Keystone allows"},{"line_number":27,"context_line":"projects to request un-scoped tokens and will issue them if a scoped"},{"line_number":28,"context_line":"token is presented. It\u0027s important to note that this only works with"},{"line_number":29,"context_line":"currently valid tokens. Once a token expires it cannot be used to gain"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"3a961159_6b271ab7","line":26,"updated":"2014-12-09 14:43:56.000000000","message":"\"Scoped tokens limit their use to the project and roles they were granted for.\" -- Isn\u0027t this false and the purpose of this note?","commit_id":"2dba3fc82172e4e1ce1315cda617b26b31cf0d85"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"a559283e054b72d1eb3df530849465036a2ddc4d","unresolved":false,"context_lines":[{"line_number":23,"context_line":"and pass it to another service to perform some portion of the intended"},{"line_number":24,"context_line":"operation. This token is very powerful and can be used to perform"},{"line_number":25,"context_line":"many actions for the user. Scoped tokens limit their use to the project"},{"line_number":26,"context_line":"and roles they were granted for. However, currently Keystone allows"},{"line_number":27,"context_line":"projects to request un-scoped tokens and will issue them if a scoped"},{"line_number":28,"context_line":"token is presented. It\u0027s important to note that this only works with"},{"line_number":29,"context_line":"currently valid tokens. Once a token expires it cannot be used to gain"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"3a961159_ce801c49","line":26,"in_reply_to":"3a961159_6b271ab7","updated":"2014-12-09 15:06:01.000000000","message":"Done","commit_id":"2dba3fc82172e4e1ce1315cda617b26b31cf0d85"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"da5944c6d96860edbaa75efcd77e09f5416d1587","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Scoped tokens stop accidental leakage of tokens as to use them with"},{"line_number":33,"context_line":"other services requires the extra step of requesting an un-scoped token"},{"line_number":34,"context_line":"from Keystone. They can help with audit trails and good code practices"},{"line_number":35,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"### Recommended Action ###"},{"line_number":38,"context_line":"Users and deployers of OpenStack should not rely on scoped tokens to"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"3a961159_2bba7223","line":35,"updated":"2014-12-09 14:43:56.000000000","message":"If there\u0027s no way to enforce this, then how can it help?","commit_id":"2dba3fc82172e4e1ce1315cda617b26b31cf0d85"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"a559283e054b72d1eb3df530849465036a2ddc4d","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Scoped tokens stop accidental leakage of tokens as to use them with"},{"line_number":33,"context_line":"other services requires the extra step of requesting an un-scoped token"},{"line_number":34,"context_line":"from Keystone. They can help with audit trails and good code practices"},{"line_number":35,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"### Recommended Action ###"},{"line_number":38,"context_line":"Users and deployers of OpenStack should not rely on scoped tokens to"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"3a961159_6b2d5a46","line":35,"in_reply_to":"3a961159_2bba7223","updated":"2014-12-09 15:06:01.000000000","message":"I think your question is predicated on this being a security enforcing feature, which it is not. It can, in a well functioning system, promote sensible use of tokens and aid in debugging of AuthN/Z issues because issued tokens should typically have a clear purpose.\n\nI\u0027m open to alternative suggestions for wording.","commit_id":"2dba3fc82172e4e1ce1315cda617b26b31cf0d85"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f963ce53be48089688d232570084ee8072f227fa","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Keystone scoped tokens provide no security benefit"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_df58bd58","line":1,"updated":"2014-12-09 19:40:44.000000000","message":"suggest change \"scoped tokens\" to \"token scoping\"","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"dbd0e14dd917d32bb9509a01c2b2ca6cdbb46636","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Keystone scoped tokens provide no security benefit"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_8f2192fd","line":1,"in_reply_to":"3a961159_df58bd58","updated":"2014-12-10 10:57:14.000000000","message":"Done","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f963ce53be48089688d232570084ee8072f227fa","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone provides \"Scoped\" tokens that can be constrained to use by a"},{"line_number":6,"context_line":"single project. This mechanism does not enhance security as any project,"},{"line_number":7,"context_line":"service or user possessing a scoped token can use said token to request"},{"line_number":8,"context_line":"an un-scoped token from Keystone. A user may expect that their scoped"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_bf7211e1","line":5,"updated":"2014-12-09 19:40:44.000000000","message":"lowercase \"scoped\"","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"dbd0e14dd917d32bb9509a01c2b2ca6cdbb46636","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone provides \"Scoped\" tokens that can be constrained to use by a"},{"line_number":6,"context_line":"single project. This mechanism does not enhance security as any project,"},{"line_number":7,"context_line":"service or user possessing a scoped token can use said token to request"},{"line_number":8,"context_line":"an un-scoped token from Keystone. A user may expect that their scoped"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_af1c8ec2","line":5,"in_reply_to":"3a961159_bf7211e1","updated":"2014-12-10 10:57:14.000000000","message":"Done","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f963ce53be48089688d232570084ee8072f227fa","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Keystone provides \"Scoped\" tokens that can be constrained to use by a"},{"line_number":6,"context_line":"single project. This mechanism does not enhance security as any project,"},{"line_number":7,"context_line":"service or user possessing a scoped token can use said token to request"},{"line_number":8,"context_line":"an un-scoped token from Keystone. A user may expect that their scoped"},{"line_number":9,"context_line":"token can only be used to perform operations for the project it is"},{"line_number":10,"context_line":"scoped to, which is not the case. A service or other party who obtains"},{"line_number":11,"context_line":"the scoped token can use it to obtain a token for a different authorized"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_4a216d9e","line":8,"updated":"2014-12-09 19:40:44.000000000","message":"having an un-scoped token is pretty useless... how about say that a service or user possessing a token can use it to get a token scoped to any project that the user has access to (has a role for).","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"dbd0e14dd917d32bb9509a01c2b2ca6cdbb46636","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Keystone provides \"Scoped\" tokens that can be constrained to use by a"},{"line_number":6,"context_line":"single project. This mechanism does not enhance security as any project,"},{"line_number":7,"context_line":"service or user possessing a scoped token can use said token to request"},{"line_number":8,"context_line":"an un-scoped token from Keystone. A user may expect that their scoped"},{"line_number":9,"context_line":"token can only be used to perform operations for the project it is"},{"line_number":10,"context_line":"scoped to, which is not the case. A service or other party who obtains"},{"line_number":11,"context_line":"the scoped token can use it to obtain a token for a different authorized"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_aff80e4a","line":8,"in_reply_to":"3a961159_4a216d9e","updated":"2014-12-10 10:57:14.000000000","message":"Done","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f963ce53be48089688d232570084ee8072f227fa","unresolved":false,"context_lines":[{"line_number":12,"context_line":"scope, which may be considered a privilege escalation."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Affected Services / Software ###"},{"line_number":15,"context_line":"Keystone, Icehouse, Juno, Kilo"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"### Discussion ###"},{"line_number":18,"context_line":"This is not a bug in Keystone, it\u0027s a design feature that some users may"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_ea2f7986","line":15,"updated":"2014-12-09 19:40:44.000000000","message":"I assume this goes back to the original keystone and isn\u0027t limited to Icehouse.","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"dbd0e14dd917d32bb9509a01c2b2ca6cdbb46636","unresolved":false,"context_lines":[{"line_number":12,"context_line":"scope, which may be considered a privilege escalation."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Affected Services / Software ###"},{"line_number":15,"context_line":"Keystone, Icehouse, Juno, Kilo"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"### Discussion ###"},{"line_number":18,"context_line":"This is not a bug in Keystone, it\u0027s a design feature that some users may"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_72c0c97c","line":15,"in_reply_to":"3a961159_ea2f7986","updated":"2014-12-10 10:57:14.000000000","message":"Done","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f963ce53be48089688d232570084ee8072f227fa","unresolved":false,"context_lines":[{"line_number":24,"context_line":"operation. This token is very powerful and can be used to perform"},{"line_number":25,"context_line":"many actions for the user. Scoped tokens appear to limit their use to"},{"line_number":26,"context_line":"the project and roles they were granted for but can also be used to"},{"line_number":27,"context_line":"request un-scoped tokens from Keystone. It\u0027s important to note that this"},{"line_number":28,"context_line":"only works with currently valid tokens. Once a token expires it cannot"},{"line_number":29,"context_line":"be used to gain a new scoped or un-scoped token."},{"line_number":30,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_ea5db916","line":27,"updated":"2014-12-09 19:40:44.000000000","message":"I\u0027m not sure why this mentions un-scoped tokens?","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"dbd0e14dd917d32bb9509a01c2b2ca6cdbb46636","unresolved":false,"context_lines":[{"line_number":24,"context_line":"operation. This token is very powerful and can be used to perform"},{"line_number":25,"context_line":"many actions for the user. Scoped tokens appear to limit their use to"},{"line_number":26,"context_line":"the project and roles they were granted for but can also be used to"},{"line_number":27,"context_line":"request un-scoped tokens from Keystone. It\u0027s important to note that this"},{"line_number":28,"context_line":"only works with currently valid tokens. Once a token expires it cannot"},{"line_number":29,"context_line":"be used to gain a new scoped or un-scoped token."},{"line_number":30,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_7291a951","line":27,"in_reply_to":"3a961159_ea5db916","updated":"2014-12-10 10:57:14.000000000","message":"Done","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f963ce53be48089688d232570084ee8072f227fa","unresolved":false,"context_lines":[{"line_number":34,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"### Recommended Action ###"},{"line_number":37,"context_line":"Users and deployers of OpenStack should not rely on scoped tokens to"},{"line_number":38,"context_line":"limit what actions can be performed using specific tokens."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Concerned users are encouraged to read (OSSG member) Nathan Kinder\u0027s"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_2a86e165","line":37,"updated":"2014-12-09 19:40:44.000000000","message":"change \"should not\" to \"must not\"","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"dbd0e14dd917d32bb9509a01c2b2ca6cdbb46636","unresolved":false,"context_lines":[{"line_number":34,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"### Recommended Action ###"},{"line_number":37,"context_line":"Users and deployers of OpenStack should not rely on scoped tokens to"},{"line_number":38,"context_line":"limit what actions can be performed using specific tokens."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Concerned users are encouraged to read (OSSG member) Nathan Kinder\u0027s"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"3a961159_329e4157","line":37,"in_reply_to":"3a961159_2a86e165","updated":"2014-12-10 10:57:14.000000000","message":"Done","commit_id":"fa9ac7039487a0dabacef62ed67c6e9c80a8c683"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8c6f4f86cede12a7fd5b1a476e1b21c1ebe9419e","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Keystone provides \"scoped\" tokens that can be constrained to use by a"},{"line_number":6,"context_line":"single project. A user may expect that their scoped token can only be"},{"line_number":7,"context_line":"used to perform operations for the project it is scoped to, which is not"},{"line_number":8,"context_line":"the case. A service or other party who obtains the scoped token can use"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_44083928","line":5,"updated":"2014-12-11 14:52:05.000000000","message":"suggest change \"can be\" to \"are\"","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"4d6be25466afde73ad718f48b8bc3943807a0d71","unresolved":false,"context_lines":[{"line_number":9,"context_line":"it to obtain a token for a different authorized scope, which may be"},{"line_number":10,"context_line":"considered a privilege escalation."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Affected Services / Software ###"},{"line_number":13,"context_line":"Keystone, Diablo, Essex, Folsom, Grizzly, Havana, Icehouse, Juno, Kilo"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_69399040","line":12,"updated":"2014-12-11 14:36:54.000000000","message":"Oh now I see the slash is part of the template, and I\u0027m not sure I like it (I reviewed https://review.openstack.org/#/c/128636/ and said I don\u0027t like the wording). Is it more accurate to say \"Affected Services Across Releases\" here? I\u0027d also like to ensure we match service to release somehow. Perhaps it\u0027s Keystone for these releases:Diablo, Essex,.... and so on?","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"751715a168d9c9ebb3226f36ac607c3e1a6f3432","unresolved":false,"context_lines":[{"line_number":9,"context_line":"it to obtain a token for a different authorized scope, which may be"},{"line_number":10,"context_line":"considered a privilege escalation."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Affected Services / Software ###"},{"line_number":13,"context_line":"Keystone, Diablo, Essex, Folsom, Grizzly, Havana, Icehouse, Juno, Kilo"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_81391aa6","line":12,"in_reply_to":"3a961159_69399040","updated":"2014-12-12 05:09:46.000000000","message":"In this case, it\u0027s one service (keystone) across multiple releases.  That\u0027s not always the case though.  Some security notes are more complex, requiring multiple services to be listed which may each be affected in different releases.\n\nI like your suggestion in https://review.openstack.org/#/c/128636/ about specifying the affected releases for each service:\n\n  \"nova: havana, icehouse; keystone: icehouse\"\n\nI\u0027ll propose a template change for this, but I think we can let this note go ahead and use the existing format if that OK with you.","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"bd8d4ecb8a008c0c22bb93c92790a0a1dca41d23","unresolved":false,"context_lines":[{"line_number":9,"context_line":"it to obtain a token for a different authorized scope, which may be"},{"line_number":10,"context_line":"considered a privilege escalation."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Affected Services / Software ###"},{"line_number":13,"context_line":"Keystone, Diablo, Essex, Folsom, Grizzly, Havana, Icehouse, Juno, Kilo"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_bc39d8f3","line":12,"in_reply_to":"3a961159_81391aa6","updated":"2014-12-12 09:44:57.000000000","message":"Agreed","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8c6f4f86cede12a7fd5b1a476e1b21c1ebe9419e","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Keystone, Diablo, Essex, Folsom, Grizzly, Havana, Icehouse, Juno, Kilo"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"},{"line_number":16,"context_line":"This is not a bug in Keystone, it\u0027s a design feature that some users may"},{"line_number":17,"context_line":"expect to bring security enhancement when it does not. The OSSG is"},{"line_number":18,"context_line":"issuing this security note to highlight the issue."},{"line_number":19,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_843ce1c9","line":16,"updated":"2014-12-11 14:52:05.000000000","message":"I heard the doc convention is to use lowercase for codenames, so \"keystone\" rather than \"Keystone\" -- see https://wiki.openstack.org/wiki/Documentation/Conventions#OpenStack.2C_not_Openstack_or_openstack","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"bd8d4ecb8a008c0c22bb93c92790a0a1dca41d23","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Keystone, Diablo, Essex, Folsom, Grizzly, Havana, Icehouse, Juno, Kilo"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"},{"line_number":16,"context_line":"This is not a bug in Keystone, it\u0027s a design feature that some users may"},{"line_number":17,"context_line":"expect to bring security enhancement when it does not. The OSSG is"},{"line_number":18,"context_line":"issuing this security note to highlight the issue."},{"line_number":19,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_af07dc16","line":16,"in_reply_to":"3a961159_843ce1c9","updated":"2014-12-12 09:44:57.000000000","message":"Done","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8c6f4f86cede12a7fd5b1a476e1b21c1ebe9419e","unresolved":false,"context_lines":[{"line_number":17,"context_line":"expect to bring security enhancement when it does not. The OSSG is"},{"line_number":18,"context_line":"issuing this security note to highlight the issue."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Many operations in OpenStack will take a Keystone token from the user"},{"line_number":21,"context_line":"and pass it to another service to perform some portion of the intended"},{"line_number":22,"context_line":"operation. This token is very powerful and can be used to perform"},{"line_number":23,"context_line":"many actions for the user. Scoped tokens appear to limit their use to"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_242ecd92","line":20,"updated":"2014-12-11 14:52:05.000000000","message":"suggest remove \"Keystone\".","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"bd8d4ecb8a008c0c22bb93c92790a0a1dca41d23","unresolved":false,"context_lines":[{"line_number":17,"context_line":"expect to bring security enhancement when it does not. The OSSG is"},{"line_number":18,"context_line":"issuing this security note to highlight the issue."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Many operations in OpenStack will take a Keystone token from the user"},{"line_number":21,"context_line":"and pass it to another service to perform some portion of the intended"},{"line_number":22,"context_line":"operation. This token is very powerful and can be used to perform"},{"line_number":23,"context_line":"many actions for the user. Scoped tokens appear to limit their use to"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_2fe5ac37","line":20,"in_reply_to":"3a961159_242ecd92","updated":"2014-12-12 09:44:57.000000000","message":"Done","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8c6f4f86cede12a7fd5b1a476e1b21c1ebe9419e","unresolved":false,"context_lines":[{"line_number":27,"context_line":"be used to gain a new token."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Scoped tokens stop accidental leakage of tokens as to use them with"},{"line_number":30,"context_line":"other services requires the extra step of requesting an un-scoped token"},{"line_number":31,"context_line":"from Keystone. They can help with audit trails and good code practices"},{"line_number":32,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":33,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_e45da516","line":30,"updated":"2014-12-11 14:52:05.000000000","message":"rather than \"un-scoped\" change this to... \"requesting a new rescoped token from keystone\".","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"bd8d4ecb8a008c0c22bb93c92790a0a1dca41d23","unresolved":false,"context_lines":[{"line_number":27,"context_line":"be used to gain a new token."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Scoped tokens stop accidental leakage of tokens as to use them with"},{"line_number":30,"context_line":"other services requires the extra step of requesting an un-scoped token"},{"line_number":31,"context_line":"from Keystone. They can help with audit trails and good code practices"},{"line_number":32,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":33,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_2f912cf1","line":30,"in_reply_to":"3a961159_e45da516","updated":"2014-12-12 09:44:57.000000000","message":"Done","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8c6f4f86cede12a7fd5b1a476e1b21c1ebe9419e","unresolved":false,"context_lines":[{"line_number":32,"context_line":"when used correctly but there\u0027s currently no way to enforce this."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### Recommended Action ###"},{"line_number":35,"context_line":"Users and deployers of OpenStack must not rely on scoped tokens to"},{"line_number":36,"context_line":"limit what actions can be performed using specific tokens."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Concerned users are encouraged to read (OSSG member) Nathan Kinder\u0027s"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_c4e50939","line":35,"updated":"2014-12-11 14:52:05.000000000","message":"suggest change \"scoped tokens\" to \"the scope of the token\"","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8c6f4f86cede12a7fd5b1a476e1b21c1ebe9419e","unresolved":false,"context_lines":[{"line_number":39,"context_line":"blog post on this issue and some of the potential future solutions."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Contacts / References ###"},{"line_number":42,"context_line":"Keystone Trusts : https://wiki.openstack.org/wiki/Keystone/Trusts"},{"line_number":43,"context_line":"Nkinder on Trusts : https://blog-nkinder.rhcloud.com/?p\u003d101"},{"line_number":44,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0042"},{"line_number":45,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341816"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_844dc140","line":42,"updated":"2014-12-11 14:52:05.000000000","message":"This isn\u0027t mentioned in the doc... is it suggested as a potential solution? I don\u0027t know if you\u0027re given a trust token you can rescope it?","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"751715a168d9c9ebb3226f36ac607c3e1a6f3432","unresolved":false,"context_lines":[{"line_number":39,"context_line":"blog post on this issue and some of the potential future solutions."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Contacts / References ###"},{"line_number":42,"context_line":"Keystone Trusts : https://wiki.openstack.org/wiki/Keystone/Trusts"},{"line_number":43,"context_line":"Nkinder on Trusts : https://blog-nkinder.rhcloud.com/?p\u003d101"},{"line_number":44,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0042"},{"line_number":45,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341816"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_21aea6e6","line":42,"in_reply_to":"3a961159_844dc140","updated":"2014-12-12 05:09:46.000000000","message":"I agree that we don\u0027t need to mention trusts here.\n\nAs for your question, you can\u0027t rescope a trust token.","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"751715a168d9c9ebb3226f36ac607c3e1a6f3432","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Contacts / References ###"},{"line_number":42,"context_line":"Keystone Trusts : https://wiki.openstack.org/wiki/Keystone/Trusts"},{"line_number":43,"context_line":"Nkinder on Trusts : https://blog-nkinder.rhcloud.com/?p\u003d101"},{"line_number":44,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0042"},{"line_number":45,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341816"},{"line_number":46,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_e1a81edd","line":43,"updated":"2014-12-12 05:09:46.000000000","message":"It would be more appropriate to say \"Nathan Kinder on token scope\", as my article is not related to the Keystone \"Trusts\" functionality.","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8c6f4f86cede12a7fd5b1a476e1b21c1ebe9419e","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"### Contacts / References ###"},{"line_number":42,"context_line":"Keystone Trusts : https://wiki.openstack.org/wiki/Keystone/Trusts"},{"line_number":43,"context_line":"Nkinder on Trusts : https://blog-nkinder.rhcloud.com/?p\u003d101"},{"line_number":44,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0042"},{"line_number":45,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1341816"},{"line_number":46,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"3a961159_64ce15b6","line":43,"updated":"2014-12-11 14:52:05.000000000","message":"suggest change \"Nkinder\" to \"Nathan Kinder\" so readers don\u0027t have to guess.","commit_id":"02a6e71ef29b29ab36f61ea9674edcd22fae8f0c"}]}