)]}'
{"security-guide/ch_identity.xml":[{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"8528005f9b6232efcb55f86f25b059f81b6617e1","unresolved":false,"context_lines":[{"line_number":83,"context_line":"        requests to Identity service are delegated to"},{"line_number":84,"context_line":"        the LDAP service, in which requests will authorize or deny based"},{"line_number":85,"context_line":"        on locally set policies. A token is generated on successful"},{"line_number":86,"context_line":"        authentication.\u003c/para\u003e"},{"line_number":87,"context_line":"      \u003cpara\u003eNote that if the LDAP system has attributes defined for"},{"line_number":88,"context_line":"        the user such as admin, finance, HR etc, these must be mapped"},{"line_number":89,"context_line":"        into roles and groups within Identity for use by the various"}],"source_content_type":"application/xml","patch_set":1,"id":"9a80dd14_87865d63","line":86,"updated":"2015-03-20 20:58:32.000000000","message":"So this still uses LDAP the same number of times and has a few rough spots. I\u0027d recommend something like:\n\nAuthentication and authorization policy in OpenStack may be delegated to another service. A typical use case is an organization that seeks to deploy a private cloud and already has a database of employees and users in an LDAP system. Using this as the authentication authority, requests to the Identity service are delegated to the LDAP system, which will then authorize or deny based on its policies. Upon successful authentication, the Identity service then generates a token that is used for access to authorized services.","commit_id":"53a7dcdad6256483ef764735f8b2a0739d95c1fc"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"836101cb7eb625b7e706378e339d146ca0ff6bd6","unresolved":false,"context_lines":[{"line_number":80,"context_line":"      that seeks to deploy a private cloud and already has a database of employees"},{"line_number":81,"context_line":"      and users in an LDAP system. Using this as the authentication authority,"},{"line_number":82,"context_line":"      requests to the Identity service are delegated to the LDAP system,"},{"line_number":83,"context_line":"      which will then authorize or deny based on its policies.Upon successful authentication,"},{"line_number":84,"context_line":"      the Identity service then generates a token that is used for access to"},{"line_number":85,"context_line":"      authorized services.\u003c/para\u003e"},{"line_number":86,"context_line":"      \u003cpara\u003eNote that if the LDAP system has attributes defined for"}],"source_content_type":"application/xml","patch_set":6,"id":"1a6ced46_21e39e08","line":83,"updated":"2015-03-23 15:26:04.000000000","message":"There should be a space between the period and \u0027Upon\u0027","commit_id":"b8cc15c981f28e5cfb1e0944e1d3ecc2be9e12ab"}]}