)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"61b0d2dc4a5e98fb3fae44e87946ccf094002072","unresolved":false,"context_lines":[{"line_number":15,"context_line":"\"examples\" of ACLs in other documents, and it\u0027s better that"},{"line_number":16,"context_line":"someone coming here from those sources become aware that the"},{"line_number":17,"context_line":"specific ACL might not apply to them. In addition, the"},{"line_number":18,"context_line":"refferer and .rlistings is common to both."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Some changes were also made to the api-ref document. The doc"},{"line_number":21,"context_line":"and api-ref documents are published as seperate documents, so"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"5a8bc5a2_f3453417","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":8},"updated":"2016-09-23 16:06:34.000000000","message":"typo","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"3e6c5167269684c92e4feed9d778b007746a1c96","unresolved":false,"context_lines":[{"line_number":15,"context_line":"\"examples\" of ACLs in other documents, and it\u0027s better that"},{"line_number":16,"context_line":"someone coming here from those sources become aware that the"},{"line_number":17,"context_line":"specific ACL might not apply to them. In addition, the"},{"line_number":18,"context_line":"refferer and .rlistings is common to both."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Some changes were also made to the api-ref document. The doc"},{"line_number":21,"context_line":"and api-ref documents are published as seperate documents, so"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"5a8bc5a2_fa96a93c","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":8},"in_reply_to":"5a8bc5a2_f3453417","updated":"2016-09-26 13:19:11.000000000","message":"Done","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"}],"api-ref/source/storage-account-services.inc":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"26ad1c0c93411646abdaa830f70233a6335c6d3d","unresolved":false,"context_lines":[{"line_number":360,"context_line":"   - X-Account-Storage-Policy-name-Container-Count: X-Account-Storage-Policy-name-Container-Count"},{"line_number":361,"context_line":"   - X-Account-Storage-Policy-name-Object-Count: X-Account-Storage-Policy-name-Object-Count"},{"line_number":362,"context_line":"   - X-Account-Meta-Quota-Bytes: X-Account-Meta-Quota-Bytes_resp"},{"line_number":363,"context_line":"   - X-Account-Access-Control: X-Account-Access-Control_resp"},{"line_number":364,"context_line":"   - Content-Type: Content-Type_cud_resp"}],"source_content_type":"text/x-c++src","patch_set":5,"id":"9a629dbe_e2266515","line":363,"updated":"2016-11-08 11:34:28.000000000","message":"should be in the GET responses too","commit_id":"5f8ca36867b9c4df350fce80281ab03f67479cb7"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c28ab0e105b8bcd08016f7af89cf1588a1f4a074","unresolved":false,"context_lines":[{"line_number":360,"context_line":"   - X-Account-Storage-Policy-name-Container-Count: X-Account-Storage-Policy-name-Container-Count"},{"line_number":361,"context_line":"   - X-Account-Storage-Policy-name-Object-Count: X-Account-Storage-Policy-name-Object-Count"},{"line_number":362,"context_line":"   - X-Account-Meta-Quota-Bytes: X-Account-Meta-Quota-Bytes_resp"},{"line_number":363,"context_line":"   - X-Account-Access-Control: X-Account-Access-Control_resp"},{"line_number":364,"context_line":"   - Content-Type: Content-Type_cud_resp"}],"source_content_type":"text/x-c++src","patch_set":5,"id":"9a629dbe_b307581b","line":363,"in_reply_to":"9a629dbe_e2266515","updated":"2016-11-08 14:17:01.000000000","message":"Done","commit_id":"5f8ca36867b9c4df350fce80281ab03f67479cb7"}],"doc/source/overview_acl.rst":[{"author":{"_account_id":7233,"name":"Matthew Oliver","email":"matt@oliver.net.au","username":"mattoliverau"},"change_message_id":"70345b300c541a892d97101255e9611919ea5e95","unresolved":false,"context_lines":[{"line_number":26,"context_line":"  elements also grant the ability to perform HEAD or GET operations on the"},{"line_number":27,"context_line":"  container."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"- ``X-Container-Read`` grants the ability to perform PUT, POST and DELETE"},{"line_number":30,"context_line":"  operations on objects within a container. Some of the ACL elements also grant"},{"line_number":31,"context_line":"  the ability to perform HEAD or GET operations on the container itself."},{"line_number":32,"context_line":"  However, a container ACL does not allow access to privileged metadata (such"},{"line_number":33,"context_line":"  as ``X-Container-Sync-Key``)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_1b7d7b6e","line":30,"range":{"start_line":29,"start_character":23,"end_line":30,"end_character":42},"updated":"2016-09-23 03:53:30.000000000","message":"Wow, X-Container-Read allows users to PUT, POST, and DELETE.. that\u0027s new. I think I found a copy and paste error :)","commit_id":"56aefba18e05b8c4ad68ffb9ce4c4d86f399417a"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"f9cf29705e163ed654de440d1e7b23b19b15dea1","unresolved":false,"context_lines":[{"line_number":26,"context_line":"  elements also grant the ability to perform HEAD or GET operations on the"},{"line_number":27,"context_line":"  container."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"- ``X-Container-Read`` grants the ability to perform PUT, POST and DELETE"},{"line_number":30,"context_line":"  operations on objects within a container. Some of the ACL elements also grant"},{"line_number":31,"context_line":"  the ability to perform HEAD or GET operations on the container itself."},{"line_number":32,"context_line":"  However, a container ACL does not allow access to privileged metadata (such"},{"line_number":33,"context_line":"  as ``X-Container-Sync-Key``)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_92c5e58f","line":30,"range":{"start_line":29,"start_character":23,"end_line":30,"end_character":42},"in_reply_to":"5a8bc5a2_1b7d7b6e","updated":"2016-09-23 14:26:23.000000000","message":"Will fix","commit_id":"56aefba18e05b8c4ad68ffb9ce4c4d86f399417a"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"61b0d2dc4a5e98fb3fae44e87946ccf094002072","unresolved":false,"context_lines":[{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Access Control Lists (ACLs)"},{"line_number":4,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"There are two types of ACLs:"},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"- :ref:`container_acls`. These are specified on a container and"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_285ba755","line":5,"updated":"2016-09-23 16:06:34.000000000","message":"Would a couple of lines about what ACLs are used for be useful here, before getting into the detail? (Just a suggestion... people may feel it\u0027s obvious and not required.)","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"3e6c5167269684c92e4feed9d778b007746a1c96","unresolved":false,"context_lines":[{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Access Control Lists (ACLs)"},{"line_number":4,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"There are two types of ACLs:"},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"- :ref:`container_acls`. These are specified on a container and"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_ba7a5c86","line":5,"in_reply_to":"5a8bc5a2_285ba755","updated":"2016-09-26 13:19:11.000000000","message":"Done","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"61b0d2dc4a5e98fb3fae44e87946ccf094002072","unresolved":false,"context_lines":[{"line_number":13,"context_line":".. _container_acls:"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"-------------------------"},{"line_number":16,"context_line":"Container ACLs (\"V1\" ACL)"},{"line_number":17,"context_line":"-------------------------"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Container ACLs are stored in the ``X-Container-Write`` and ``X-Container-Read``"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_682ccfab","line":16,"range":{"start_line":16,"start_character":17,"end_line":16,"end_character":19},"updated":"2016-09-23 16:06:34.000000000","message":"V1 - is that the swift v1 api?","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"3e6c5167269684c92e4feed9d778b007746a1c96","unresolved":false,"context_lines":[{"line_number":13,"context_line":".. _container_acls:"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"-------------------------"},{"line_number":16,"context_line":"Container ACLs (\"V1\" ACL)"},{"line_number":17,"context_line":"-------------------------"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Container ACLs are stored in the ``X-Container-Write`` and ``X-Container-Read``"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_5abcf805","line":16,"range":{"start_line":16,"start_character":17,"end_line":16,"end_character":19},"in_reply_to":"5a8bc5a2_682ccfab","updated":"2016-09-26 13:19:11.000000000","message":"I will remove these references. I agree, these could be confused with auth v1/v2 (esp in keystone). They were intended to distinguish Swift\u0027s ACL sytax, of which there are two: v1 (string, text, list) and v2 (a json structure)","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"61b0d2dc4a5e98fb3fae44e87946ccf094002072","unresolved":false,"context_lines":[{"line_number":137,"context_line":""},{"line_number":138,"context_line":".. note::"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"    Keystone project (tenant) or user *names* must no longer be"},{"line_number":141,"context_line":"    used because with the introduction"},{"line_number":142,"context_line":"    of domains in Keystone, names are not globally unique."},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_b351ec10","line":140,"range":{"start_line":140,"start_character":46,"end_line":140,"end_character":50},"updated":"2016-09-23 16:06:34.000000000","message":"must or should?","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"3e6c5167269684c92e4feed9d778b007746a1c96","unresolved":false,"context_lines":[{"line_number":137,"context_line":""},{"line_number":138,"context_line":".. note::"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"    Keystone project (tenant) or user *names* must no longer be"},{"line_number":141,"context_line":"    used because with the introduction"},{"line_number":142,"context_line":"    of domains in Keystone, names are not globally unique."},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_9d759a99","line":140,"range":{"start_line":140,"start_character":46,"end_line":140,"end_character":50},"in_reply_to":"5a8bc5a2_b351ec10","updated":"2016-09-26 13:19:11.000000000","message":"\"must\" -- apart from the exception in the the next paragraph","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"61b0d2dc4a5e98fb3fae44e87946ccf094002072","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"    Keystone project (tenant) or user *names* must no longer be"},{"line_number":141,"context_line":"    used because with the introduction"},{"line_number":142,"context_line":"    of domains in Keystone, names are not globally unique."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    For backwards compatibility, ACLs using names will be granted by"},{"line_number":145,"context_line":"    keystoneauth when it can be established that"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_d32118a1","line":142,"range":{"start_line":142,"start_character":57,"end_line":142,"end_character":58},"updated":"2016-09-23 16:06:34.000000000","message":"Are you saying you must use project (tenant) ids here?","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"3e6c5167269684c92e4feed9d778b007746a1c96","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"    Keystone project (tenant) or user *names* must no longer be"},{"line_number":141,"context_line":"    used because with the introduction"},{"line_number":142,"context_line":"    of domains in Keystone, names are not globally unique."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    For backwards compatibility, ACLs using names will be granted by"},{"line_number":145,"context_line":"    keystoneauth when it can be established that"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_fd705ea6","line":142,"range":{"start_line":142,"start_character":57,"end_line":142,"end_character":58},"in_reply_to":"5a8bc5a2_d32118a1","updated":"2016-09-26 13:19:11.000000000","message":"Yes... I\u0027ll clarify that","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"61b0d2dc4a5e98fb3fae44e87946ccf094002072","unresolved":false,"context_lines":[{"line_number":237,"context_line":".. _account_acls:"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"-----------------------"},{"line_number":240,"context_line":"Account ACLs (\"V2\" ACL)"},{"line_number":241,"context_line":"-----------------------"},{"line_number":242,"context_line":""},{"line_number":243,"context_line":".. note::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_d36f58c3","line":240,"range":{"start_line":240,"start_character":15,"end_line":240,"end_character":17},"updated":"2016-09-23 16:06:34.000000000","message":"keystone v2?\n\n(I\u0027m not 100% clear what V2 is here)","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"3e6c5167269684c92e4feed9d778b007746a1c96","unresolved":false,"context_lines":[{"line_number":237,"context_line":".. _account_acls:"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"-----------------------"},{"line_number":240,"context_line":"Account ACLs (\"V2\" ACL)"},{"line_number":241,"context_line":"-----------------------"},{"line_number":242,"context_line":""},{"line_number":243,"context_line":".. note::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_bd889672","line":240,"range":{"start_line":240,"start_character":15,"end_line":240,"end_character":17},"in_reply_to":"5a8bc5a2_d36f58c3","updated":"2016-09-26 13:19:11.000000000","message":"removing","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  However, a container ACL does not allow access to privileged metadata (such"},{"line_number":38,"context_line":"  as ``X-Container-Sync-Key``)."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Container ACLs use the \"V1\" syntax which is a comma separated string"},{"line_number":41,"context_line":"of elements as shown in the following example::"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    .r:*,.rlistings,7ec59e87c6584c348b563254aae4c221:*"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_b9493291","line":40,"updated":"2016-11-07 14:02:29.000000000","message":"nit: s/\"V1\" syntax/\"V1\" ACL syntax/","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  However, a container ACL does not allow access to privileged metadata (such"},{"line_number":38,"context_line":"  as ``X-Container-Sync-Key``)."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Container ACLs use the \"V1\" syntax which is a comma separated string"},{"line_number":41,"context_line":"of elements as shown in the following example::"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    .r:*,.rlistings,7ec59e87c6584c348b563254aae4c221:*"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_585e4746","line":40,"in_reply_to":"9a629dbe_b9493291","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":67,"context_line":"-------------------"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"The following table describes elements of an ACL that are"},{"line_number":70,"context_line":"supported by both Keystone auth and TempAuth:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":73,"context_line":"Element                        Description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_eabaeabf","line":70,"updated":"2016-11-07 14:02:29.000000000","message":"all the entries say they don\u0027t work with X-Container-Write so that could be stated up-front","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":67,"context_line":"-------------------"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"The following table describes elements of an ACL that are"},{"line_number":70,"context_line":"supported by both Keystone auth and TempAuth:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":73,"context_line":"Element                        Description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_63960096","line":70,"in_reply_to":"9a629dbe_eabaeabf","updated":"2016-11-08 08:51:04.000000000","message":"Will rewrite.\nActually, it does not apply to all....rlistings is ignored on x-container-write, but .r:\u003cany\u003e results in error","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":80,"context_line":"                               request header in the request. No token is"},{"line_number":81,"context_line":"                               required. This element cannot be used"},{"line_number":82,"context_line":"                               in ``X-Container-Write``."},{"line_number":83,"context_line":"``.r:-\u003creferrer\u003e``             The referrer is refused access to objects. The"},{"line_number":84,"context_line":"                               referrer is identified by the ``Referer``"},{"line_number":85,"context_line":"                               request header in the request. No token is"},{"line_number":86,"context_line":"                               required. This element cannot be used"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_6537ede3","line":83,"updated":"2016-11-07 14:02:29.000000000","message":"I had never played with this before, but it seems odd - the exclusion does not override inclusion, so\n\n  .r:*, .r:-test2\n\nwill allow access to test2.\n\nSo when is the -\u003creferrer\u003e form useful?","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":80,"context_line":"                               request header in the request. No token is"},{"line_number":81,"context_line":"                               required. This element cannot be used"},{"line_number":82,"context_line":"                               in ``X-Container-Write``."},{"line_number":83,"context_line":"``.r:-\u003creferrer\u003e``             The referrer is refused access to objects. The"},{"line_number":84,"context_line":"                               referrer is identified by the ``Referer``"},{"line_number":85,"context_line":"                               request header in the request. No token is"},{"line_number":86,"context_line":"                               required. This element cannot be used"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_fe3543f7","line":83,"in_reply_to":"9a629dbe_6537ede3","updated":"2016-11-08 08:51:04.000000000","message":"I can\u0027t find a use for it.","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":85,"context_line":"                               request header in the request. No token is"},{"line_number":86,"context_line":"                               required. This element cannot be used"},{"line_number":87,"context_line":"                               in ``X-Container-Write``."},{"line_number":88,"context_line":"``.rlistings``                 Any user can perform a HEAD or GET operation"},{"line_number":89,"context_line":"                               on the container. No token is required."},{"line_number":90,"context_line":"                               This element is ignored"},{"line_number":91,"context_line":"                               in ``X-Container-Write``. This element does"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_0a99de6e","line":88,"updated":"2016-11-07 14:02:29.000000000","message":"The request must also be auth\u0027d as a referer I think? An ACL \n\n  X-Container-Read: .rlistings\n\nis not sufficient to list the container","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":85,"context_line":"                               request header in the request. No token is"},{"line_number":86,"context_line":"                               required. This element cannot be used"},{"line_number":87,"context_line":"                               in ``X-Container-Write``."},{"line_number":88,"context_line":"``.rlistings``                 Any user can perform a HEAD or GET operation"},{"line_number":89,"context_line":"                               on the container. No token is required."},{"line_number":90,"context_line":"                               This element is ignored"},{"line_number":91,"context_line":"                               in ``X-Container-Write``. This element does"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_122cab49","line":88,"in_reply_to":"9a629dbe_0a99de6e","updated":"2016-11-08 08:51:04.000000000","message":"Correct. Thanks for finding this.","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":98,"context_line":"--------------------------"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The following table describes elements of an ACL that are"},{"line_number":101,"context_line":"supported only by Keystone auth. Keystome auth also supports"},{"line_number":102,"context_line":"the elements described in :ref:`acl_common_elements`."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_96735d4d","line":101,"updated":"2016-11-07 14:02:29.000000000","message":"s/Keystome/Keystone/","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":98,"context_line":"--------------------------"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The following table describes elements of an ACL that are"},{"line_number":101,"context_line":"supported only by Keystone auth. Keystome auth also supports"},{"line_number":102,"context_line":"the elements described in :ref:`acl_common_elements`."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_72e24705","line":101,"in_reply_to":"9a629dbe_96735d4d","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The following table describes elements of an ACL that are"},{"line_number":101,"context_line":"supported only by Keystone auth. Keystome auth also supports"},{"line_number":102,"context_line":"the elements described in :ref:`acl_common_elements`."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":105,"context_line":"Element                        Description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_f97baa79","line":102,"updated":"2016-11-07 14:02:29.000000000","message":"Add that a token is required for any of these ACL elements to be granted.","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The following table describes elements of an ACL that are"},{"line_number":101,"context_line":"supported only by Keystone auth. Keystome auth also supports"},{"line_number":102,"context_line":"the elements described in :ref:`acl_common_elements`."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":105,"context_line":"Element                        Description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_927c3b22","line":102,"in_reply_to":"9a629dbe_f97baa79","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":128,"context_line":"                               does not require a token. In addition,"},{"line_number":129,"context_line":"                               ``.r:*`` does not grant access to the"},{"line_number":130,"context_line":"                               container."},{"line_number":131,"context_line":"``\u003cproject-name\u003e:\u003cuser-name\u003e`` This is similar to the"},{"line_number":132,"context_line":"                               ``\u003cproject-id\u003e:\u003cuser-id\u003e`` element"},{"line_number":133,"context_line":"                               except that the project and"},{"line_number":134,"context_line":"                               user *names* are used."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_f611f95e","line":131,"updated":"2016-11-07 14:02:29.000000000","message":"Given that this form is essentially deprecated and the description says you must not use this form, perhaps we should not include in the table at all, and at most leave the note below (modified to show the \u003cproject-name\u003e:\u003cuser-name\u003e syntax)?","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":128,"context_line":"                               does not require a token. In addition,"},{"line_number":129,"context_line":"                               ``.r:*`` does not grant access to the"},{"line_number":130,"context_line":"                               container."},{"line_number":131,"context_line":"``\u003cproject-name\u003e:\u003cuser-name\u003e`` This is similar to the"},{"line_number":132,"context_line":"                               ``\u003cproject-id\u003e:\u003cuser-id\u003e`` element"},{"line_number":133,"context_line":"                               except that the project and"},{"line_number":134,"context_line":"                               user *names* are used."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_3209af96","line":131,"in_reply_to":"9a629dbe_f611f95e","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":147,"context_line":"    of domains in Keystone, names are not globally unique. You should"},{"line_number":148,"context_line":"    use user and project *ids* instead."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"    For backwards compatibility, ACLs using names will be granted by"},{"line_number":151,"context_line":"    keystoneauth when it can be established that"},{"line_number":152,"context_line":"    the grantee project, the grantee user and the project being"},{"line_number":153,"context_line":"    accessed are either not yet in a domain (e.g. the ``X-Auth-Token`` has"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_991aae6d","line":150,"updated":"2016-11-07 14:02:29.000000000","message":"...so, following on from comment at line 131, modify to:\n\n  ..., ACLs using names (i.e. ``\u003cproject-name\u003e:\u003cuser-name\u003e``) will be granted...","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":147,"context_line":"    of domains in Keystone, names are not globally unique. You should"},{"line_number":148,"context_line":"    use user and project *ids* instead."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"    For backwards compatibility, ACLs using names will be granted by"},{"line_number":151,"context_line":"    keystoneauth when it can be established that"},{"line_number":152,"context_line":"    the grantee project, the grantee user and the project being"},{"line_number":153,"context_line":"    accessed are either not yet in a domain (e.g. the ``X-Auth-Token`` has"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_b2d85ff1","line":150,"in_reply_to":"9a629dbe_991aae6d","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":167,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":168,"context_line":"Element                        Description"},{"line_number":169,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":170,"context_line":"``\u003cuser-name\u003e``                The named user is granted access. A token"},{"line_number":171,"context_line":"                               from the user must be included in the request."},{"line_number":172,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":173,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_0a5abe83","line":170,"updated":"2016-11-07 14:02:29.000000000","message":"might be worth stating that * wildcard is not supported","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":167,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":168,"context_line":"Element                        Description"},{"line_number":169,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":170,"context_line":"``\u003cuser-name\u003e``                The named user is granted access. A token"},{"line_number":171,"context_line":"                               from the user must be included in the request."},{"line_number":172,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":173,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_f2e2d79e","line":170,"in_reply_to":"9a629dbe_0a5abe83","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":172,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"------------"},{"line_number":175,"context_line":"ACL Examples"},{"line_number":176,"context_line":"------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Example: Public Container"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_79db1a1c","line":175,"updated":"2016-11-07 14:02:29.000000000","message":"qualify the section title : \"Container ACL Examples\"\n\nAlso this section is at same level as Container ACLs and Account ACls, which is ok provided \"Container\" is prepended, but could be dropped a level (along with subsections).","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":172,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"------------"},{"line_number":175,"context_line":"ACL Examples"},{"line_number":176,"context_line":"------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Example: Public Container"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_757311b2","line":175,"in_reply_to":"9a629dbe_79db1a1c","updated":"2016-11-08 08:51:04.000000000","message":"I\u0027ll leave at this level, but change the title as you suggest","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"------------"},{"line_number":175,"context_line":"ACL Examples"},{"line_number":176,"context_line":"------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Example: Public Container"},{"line_number":179,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_998d4e7e","line":176,"updated":"2016-11-07 14:02:29.000000000","message":"This is a really useful section. However, using swift CLI in examples obscures the X-Container-Read and X-Container-Write header names and requires understanding of the --read-acl and --write-acl options.\n\nPerhaps add an intro paragraph:\n\n  Container ACLs may be set by including X-Container-Write and/or X-Container-Read headers with a PUT or a POST request to the container URL. The following examples use the ``swift`` command line client which support these headers being set via its ``--write-acl`` and ``--read-acl`` options.","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"------------"},{"line_number":175,"context_line":"ACL Examples"},{"line_number":176,"context_line":"------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Example: Public Container"},{"line_number":179,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_b51da911","line":176,"in_reply_to":"9a629dbe_998d4e7e","updated":"2016-11-08 08:51:04.000000000","message":"I used bin/swift for three reasons:\n\n- the examples are compact (vs, curl distractions)\n\n- this happens in other places in specification-style information (including code)\n\n- more useful for the average reader/user\n\nI\u0027ve taken your suggested text. Thanks","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"eeac655f1facfe17a963d156502ab1be32938b98","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"------------"},{"line_number":175,"context_line":"ACL Examples"},{"line_number":176,"context_line":"------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Example: Public Container"},{"line_number":179,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_447f21aa","line":176,"in_reply_to":"9a629dbe_b51da911","updated":"2016-11-08 15:31:01.000000000","message":"I agree the swift examples are easier on the eye than curl","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":178,"context_line":"Example: Public Container"},{"line_number":179,"context_line":"-------------------------"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The following allows anybody to list objects in the ``www`` container and"},{"line_number":182,"context_line":"download objects. The users do not need to include a token in"},{"line_number":183,"context_line":"their request. This ACL is commonly referred to as making the"},{"line_number":184,"context_line":"container \"public\". It is useful when used with :ref:`staticweb`::"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_99ef0eb0","line":181,"updated":"2016-11-07 14:02:29.000000000","message":"nit: s/anybody/any user/  for consistency","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"eeac655f1facfe17a963d156502ab1be32938b98","unresolved":false,"context_lines":[{"line_number":178,"context_line":"Example: Public Container"},{"line_number":179,"context_line":"-------------------------"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The following allows anybody to list objects in the ``www`` container and"},{"line_number":182,"context_line":"download objects. The users do not need to include a token in"},{"line_number":183,"context_line":"their request. This ACL is commonly referred to as making the"},{"line_number":184,"context_line":"container \"public\". It is useful when used with :ref:`staticweb`::"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_c4409159","line":181,"in_reply_to":"9a629dbe_755f9172","updated":"2016-11-08 15:31:01.000000000","message":"OK, makes sense, no token -\u003e no \"user\" required","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":178,"context_line":"Example: Public Container"},{"line_number":179,"context_line":"-------------------------"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"The following allows anybody to list objects in the ``www`` container and"},{"line_number":182,"context_line":"download objects. The users do not need to include a token in"},{"line_number":183,"context_line":"their request. This ACL is commonly referred to as making the"},{"line_number":184,"context_line":"container \"public\". It is useful when used with :ref:`staticweb`::"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_755f9172","line":181,"in_reply_to":"9a629dbe_99ef0eb0","updated":"2016-11-08 08:51:04.000000000","message":"Besides being \"foksy\", I use this term on purpose -- in this context, the person need not be a keystone *user*","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":189,"context_line":"Example: Shared Writable Container"},{"line_number":190,"context_line":"----------------------------------"},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"The following allows anybody to upload or download objects. However, to"},{"line_number":193,"context_line":"download an object, the exact name of the object must be known since"},{"line_number":194,"context_line":"users cannot list the objects in the container."},{"line_number":195,"context_line":"The users must include a Keystone token in the upload request. However, it does not"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_59f57681","line":192,"updated":"2016-11-07 14:02:29.000000000","message":"nit: s/anybody/any user/  for consistency","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":189,"context_line":"Example: Shared Writable Container"},{"line_number":190,"context_line":"----------------------------------"},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"The following allows anybody to upload or download objects. However, to"},{"line_number":193,"context_line":"download an object, the exact name of the object must be known since"},{"line_number":194,"context_line":"users cannot list the objects in the container."},{"line_number":195,"context_line":"The users must include a Keystone token in the upload request. However, it does not"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_d54e9dc0","line":192,"in_reply_to":"9a629dbe_59f57681","updated":"2016-11-08 08:51:04.000000000","message":"ditto","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":229,"context_line":"    since it is easy to create a request with any desired value in the"},{"line_number":230,"context_line":"    `Referer` header, the referrer ACL has very weak security."},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"Example: Legacy Keystone V2 ACL"},{"line_number":233,"context_line":"-------------------------------"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"The following example allows a user named ``mary`` to download objects"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_195f7e73","line":232,"updated":"2016-11-07 14:02:29.000000000","message":"I wonder if we should drop this example so as not to encourage continued usage.","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":229,"context_line":"    since it is easy to create a request with any desired value in the"},{"line_number":230,"context_line":"    `Referer` header, the referrer ACL has very weak security."},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"Example: Legacy Keystone V2 ACL"},{"line_number":233,"context_line":"-------------------------------"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"The following example allows a user named ``mary`` to download objects"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_55e8cd7c","line":232,"in_reply_to":"9a629dbe_195f7e73","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":251,"context_line":"    Account ACLs are not currently supported by Keystone auth"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"The ``X-Account-Access-Control`` header is used to specify"},{"line_number":254,"context_line":"account-level ACLs in a format specific to that auth system."},{"line_number":255,"context_line":"These headers are visible and settable only by account owners (those for whom"},{"line_number":256,"context_line":"``swift_owner`` is true)."},{"line_number":257,"context_line":"Behavior of account ACLs is auth-system-dependent.  In the case of TempAuth,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_79fcfa3e","line":254,"updated":"2016-11-07 14:02:29.000000000","message":"what does \"that\" refer to - should it be \"the\"?","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":251,"context_line":"    Account ACLs are not currently supported by Keystone auth"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"The ``X-Account-Access-Control`` header is used to specify"},{"line_number":254,"context_line":"account-level ACLs in a format specific to that auth system."},{"line_number":255,"context_line":"These headers are visible and settable only by account owners (those for whom"},{"line_number":256,"context_line":"``swift_owner`` is true)."},{"line_number":257,"context_line":"Behavior of account ACLs is auth-system-dependent.  In the case of TempAuth,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_958985cd","line":254,"in_reply_to":"9a629dbe_79fcfa3e","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":262,"context_line":"named \"admin\", \"read-write\", and \"read-only\".  (Note the case sensitivity.)"},{"line_number":263,"context_line":"An example value for the ``X-Account-Access-Control`` header looks like this::"},{"line_number":264,"context_line":""},{"line_number":265,"context_line":"   {\"admin\":[\"a\",\"b\"],\"read-only\":[\"c\"]}"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"Keys may be absent (as shown in above example)."},{"line_number":268,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_5909f630","line":265,"updated":"2016-11-07 14:02:29.000000000","message":"nit: add \"where a, b and c are user names\"","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":262,"context_line":"named \"admin\", \"read-write\", and \"read-only\".  (Note the case sensitivity.)"},{"line_number":263,"context_line":"An example value for the ``X-Account-Access-Control`` header looks like this::"},{"line_number":264,"context_line":""},{"line_number":265,"context_line":"   {\"admin\":[\"a\",\"b\"],\"read-only\":[\"c\"]}"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"Keys may be absent (as shown in above example)."},{"line_number":268,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_757231e7","line":265,"in_reply_to":"9a629dbe_5909f630","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"}],"doc/source/overview_auth.rst":[{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"8a2c5be5e01251e4d4101664c40803c88696d067","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Other users may be granted the ability to perform operations on"},{"line_number":60,"context_line":"an account or container via ACLs. TempAuth supports two types of ACL:"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"- Per container based on the"},{"line_number":63,"context_line":"  container\u0027s ``X-Container-Read`` and ``X-Container-Write`` ACLs.  Container ACLs"},{"line_number":64,"context_line":"  use the \"V1\" ACL syntax, which looks like this::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"      mary, bob, .r:example.com, .r:-hacker.site, .rlistings"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8ec9b2_262485c3","line":63,"range":{"start_line":62,"start_character":2,"end_line":63,"end_character":65},"updated":"2016-09-21 15:32:00.000000000","message":"Should read:\n\n   Per container ACLs based on the\n  container\u0027s ``X-Container-Read`` and ``X-Container-Write`` metdata.","commit_id":"bf3869322d49aa5229aac8f5a765c6f53fa1d38c"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"8a2c5be5e01251e4d4101664c40803c88696d067","unresolved":false,"context_lines":[{"line_number":88,"context_line":"implementing the auth system within Swift as described here."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The :ref:`keystoneauth` middleware supports per container based on the"},{"line_number":91,"context_line":"container\u0027s ``X-Container-Read`` and ``X-Container-Write`` ACLs.  Container ACLs"},{"line_number":92,"context_line":"use the \"V1\" ACL syntax, which looks like this::"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    *:*, .rlistings"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8ec9b2_060ea93a","line":91,"range":{"start_line":91,"start_character":59,"end_line":91,"end_character":63},"updated":"2016-09-21 15:32:00.000000000","message":"ditto","commit_id":"bf3869322d49aa5229aac8f5a765c6f53fa1d38c"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"61b0d2dc4a5e98fb3fae44e87946ccf094002072","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"For more information see :ref:`container_acls`."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"The account-level (\"V2\" ACL) is not supported by Keystone auth."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"In order to use the ``keystoneauth`` middleware the ``auth_token``"},{"line_number":101,"context_line":"middleware from KeystoneMiddleware_ will need to be configured."}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_b3d48c47","line":98,"range":{"start_line":98,"start_character":20,"end_line":98,"end_character":22},"updated":"2016-09-23 16:06:34.000000000","message":"Not sure what v2 means here.","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"3e6c5167269684c92e4feed9d778b007746a1c96","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"For more information see :ref:`container_acls`."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"The account-level (\"V2\" ACL) is not supported by Keystone auth."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"In order to use the ``keystoneauth`` middleware the ``auth_token``"},{"line_number":101,"context_line":"middleware from KeystoneMiddleware_ will need to be configured."}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_fd113e05","line":98,"range":{"start_line":98,"start_character":20,"end_line":98,"end_character":22},"in_reply_to":"5a8bc5a2_b3d48c47","updated":"2016-09-26 13:19:11.000000000","message":"I\u0027ve removed the reference here. However, the concept of V1 and V2  *syntax* is not entirely removed from the documentation.","commit_id":"9c484ecead39464cfb4fd726a9b2d106c27e4fa8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The auth system for Swift is loosely based on the auth system from the existing"},{"line_number":10,"context_line":"Rackspace architecture -- actually from a few existing auth systems -- and is"},{"line_number":11,"context_line":"therefore a bit disjointed. The distilled points about it are:"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"* The authentication/authorization part can be an external system or a"},{"line_number":14,"context_line":"  subsystem run within Swift as WSGI middleware"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_746fa192","line":11,"updated":"2016-11-07 14:02:29.000000000","message":"IMHO this paragraph should be deleted - it is no longer current or relevant.\n\nMaybe replace with:\n\n  \"Swift supports a number of auth systems that share the following common charactersitics:\"","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The auth system for Swift is loosely based on the auth system from the existing"},{"line_number":10,"context_line":"Rackspace architecture -- actually from a few existing auth systems -- and is"},{"line_number":11,"context_line":"therefore a bit disjointed. The distilled points about it are:"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"* The authentication/authorization part can be an external system or a"},{"line_number":14,"context_line":"  subsystem run within Swift as WSGI middleware"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_d52f7d9f","line":11,"in_reply_to":"9a629dbe_746fa192","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Swift will make calls to the auth system, giving the auth token to be"},{"line_number":28,"context_line":"validated. For a valid token, the auth system responds with an overall"},{"line_number":29,"context_line":"expiration in seconds from now. To avoid the overhead in validating the same"},{"line_number":30,"context_line":"token over and over again, Swift will cache the"},{"line_number":31,"context_line":"token for a configurable time, but no longer than the expiration"},{"line_number":32,"context_line":"time."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_b40059ac","line":29,"updated":"2016-11-07 14:02:29.000000000","message":"nit s/expiration/expiration time/","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Swift will make calls to the auth system, giving the auth token to be"},{"line_number":28,"context_line":"validated. For a valid token, the auth system responds with an overall"},{"line_number":29,"context_line":"expiration in seconds from now. To avoid the overhead in validating the same"},{"line_number":30,"context_line":"token over and over again, Swift will cache the"},{"line_number":31,"context_line":"token for a configurable time, but no longer than the expiration"},{"line_number":32,"context_line":"time."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_c84b6458","line":29,"in_reply_to":"9a629dbe_b40059ac","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":29,"context_line":"expiration in seconds from now. To avoid the overhead in validating the same"},{"line_number":30,"context_line":"token over and over again, Swift will cache the"},{"line_number":31,"context_line":"token for a configurable time, but no longer than the expiration"},{"line_number":32,"context_line":"time."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The Swift project includes two auth systems:"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_b4c13931","line":32,"updated":"2016-11-07 14:02:29.000000000","message":"I think we lost a piece of info from the original, that could be included here:\n\n  \"In addition to granting a request, the auth system may also selectively set a request environ\u0027s swift_owner key to\nTrue. This causes the proxy to return additional header information in some requests,\nsuch as the X-Container-Sync-Key for a container GET or HEAD.\"\n\nThat said, I would not be too concerned if we just dropped the info - it is an internal detail and the point is covered by discussion of admin vs non-admin users.","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"eeac655f1facfe17a963d156502ab1be32938b98","unresolved":false,"context_lines":[{"line_number":29,"context_line":"expiration in seconds from now. To avoid the overhead in validating the same"},{"line_number":30,"context_line":"token over and over again, Swift will cache the"},{"line_number":31,"context_line":"token for a configurable time, but no longer than the expiration"},{"line_number":32,"context_line":"time."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The Swift project includes two auth systems:"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_24078d1d","line":32,"in_reply_to":"9a629dbe_a8c1d082","updated":"2016-11-08 15:31:01.000000000","message":"Agree","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":29,"context_line":"expiration in seconds from now. To avoid the overhead in validating the same"},{"line_number":30,"context_line":"token over and over again, Swift will cache the"},{"line_number":31,"context_line":"token for a configurable time, but no longer than the expiration"},{"line_number":32,"context_line":"time."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The Swift project includes two auth systems:"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_a8c1d082","line":32,"in_reply_to":"9a629dbe_b4c13931","updated":"2016-11-08 08:51:04.000000000","message":"I dropped it on purpose because it did not seem to fit with the level/detail of the text here and also seemed out of context.\n\nI considered putting it elsewhere, but was afraid of feature creep. Why document swift_owner, but not the other internal pieces such as override, defer, etc.?","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"- Per container ACLs based on the"},{"line_number":63,"context_line":"  container\u0027s ``X-Container-Read`` and ``X-Container-Write`` metadata.  Container ACLs"},{"line_number":64,"context_line":"  use the \"V1\" ACL syntax, which looks like this::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"      mary, bob, .r:example.com, .r:-hacker.site, .rlistings"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_8f4b4059","line":64,"updated":"2016-11-07 14:02:29.000000000","message":"nit: I\u0027d vote for just referring to the ACL doc and drop all examples from here","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"- Per container ACLs based on the"},{"line_number":63,"context_line":"  container\u0027s ``X-Container-Read`` and ``X-Container-Write`` metadata.  Container ACLs"},{"line_number":64,"context_line":"  use the \"V1\" ACL syntax, which looks like this::"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"      mary, bob, .r:example.com, .r:-hacker.site, .rlistings"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_c80364b7","line":64,"in_reply_to":"9a629dbe_8f4b4059","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":74,"context_line":"TempAuth will now allow OPTIONS requests to go through without a token."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"The user starts a session by sending a REST request to the auth system to"},{"line_number":77,"context_line":"receive the auth token and a URL to the Swift system."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":".. _keystone_auth:"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_b4a7794e","line":77,"updated":"2016-11-07 14:02:29.000000000","message":"Should we delete this paragraph?","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":74,"context_line":"TempAuth will now allow OPTIONS requests to go through without a token."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"The user starts a session by sending a REST request to the auth system to"},{"line_number":77,"context_line":"receive the auth token and a URL to the Swift system."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":".. _keystone_auth:"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_681178ac","line":77,"in_reply_to":"9a629dbe_b4a7794e","updated":"2016-11-08 08:51:04.000000000","message":"I\u0027ll reword -- it\u0027s useful to contrast with keystone here the token generation is done in keystone, whereas tempauth does both token generation and then validates them.","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"d7bee0da904c1bbb2716e65ad602c5e9664e6382","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The :ref:`keystoneauth` middleware supports per container based ACLs on the"},{"line_number":91,"context_line":"container\u0027s ``X-Container-Read`` and ``X-Container-Write`` metadata.  Container ACLs"},{"line_number":92,"context_line":"use the \"V1\" ACL syntax, which looks like this::"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    *:*, .rlistings"},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_0f573003","line":92,"updated":"2016-11-07 14:02:29.000000000","message":"nit: I\u0027d vote for just referring to the ACL doc and drop all examples from here","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"ecc0a5b53084075ee2ef53e8c460a2fb5f15aa3c","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The :ref:`keystoneauth` middleware supports per container based ACLs on the"},{"line_number":91,"context_line":"container\u0027s ``X-Container-Read`` and ``X-Container-Write`` metadata.  Container ACLs"},{"line_number":92,"context_line":"use the \"V1\" ACL syntax, which looks like this::"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    *:*, .rlistings"},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a629dbe_e84bc8ae","line":92,"in_reply_to":"9a629dbe_0f573003","updated":"2016-11-08 08:51:04.000000000","message":"Done","commit_id":"8333a74099816146255199cf30b4167668b4877b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"26ad1c0c93411646abdaa830f70233a6335c6d3d","unresolved":false,"context_lines":[{"line_number":7,"context_line":"--------"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Swift supports a number of auth systems that share the following common"},{"line_number":10,"context_line":"charactersitics:"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"* The authentication/authorization part can be an external system or a"},{"line_number":13,"context_line":"  subsystem run within Swift as WSGI middleware"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_040a8926","line":10,"updated":"2016-11-08 11:34:28.000000000","message":"Bah! my bad - typo in my suggested text :/ ... charactersitics","commit_id":"5f8ca36867b9c4df350fce80281ab03f67479cb7"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"c28ab0e105b8bcd08016f7af89cf1588a1f4a074","unresolved":false,"context_lines":[{"line_number":7,"context_line":"--------"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Swift supports a number of auth systems that share the following common"},{"line_number":10,"context_line":"charactersitics:"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"* The authentication/authorization part can be an external system or a"},{"line_number":13,"context_line":"  subsystem run within Swift as WSGI middleware"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_2e211fa0","line":10,"in_reply_to":"9a629dbe_040a8926","updated":"2016-11-08 14:17:01.000000000","message":"Done","commit_id":"5f8ca36867b9c4df350fce80281ab03f67479cb7"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"26ad1c0c93411646abdaa830f70233a6335c6d3d","unresolved":false,"context_lines":[{"line_number":70,"context_line":"The TempAuth middleware is responsible for creating its own tokens. A user"},{"line_number":71,"context_line":"makes a request containing their username and password and TempAuth"},{"line_number":72,"context_line":"responds with a token. This token is then used to perform subsequent"},{"line_number":73,"context_line":"requests on the user\u0027s account, containers and objects."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":".. _keystone_auth:"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_e76837bd","line":73,"updated":"2016-11-08 11:34:28.000000000","message":"much better and more useful, thanks","commit_id":"5f8ca36867b9c4df350fce80281ab03f67479cb7"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"0012074e813735c3f088ec8c5e996b8b55238c7f","unresolved":false,"context_lines":[{"line_number":41,"context_line":".. _temp_auth:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"--------"},{"line_number":44,"context_line":"TempAuth"},{"line_number":45,"context_line":"--------"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"The included TempAuth has the concept of admin and non-admin users"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_9867bcb6","line":44,"range":{"start_line":44,"start_character":0,"end_line":44,"end_character":8},"updated":"2016-11-22 20:11:07.000000000","message":"I just noticed that this section does not about how unsafe tempauth is or even the purpose for it to exist. I think it would probably be nice to make that clear to readers, but it can be done in a follow-up patch.","commit_id":"c0fdc53b4999528791ff7e57cecf74d2208a7f00"}]}