)]}'
{"v3/src/markdown/identity-api-v3-os-federation-ext.md":[{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"2b8e3713ae58f56a5987266ffc18fe6f0c6ca25b","unresolved":false,"context_lines":[{"line_number":43,"context_line":"  Indicates whether this identity provider should accept federated"},{"line_number":44,"context_line":"  authentication requests."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"  If a value is not specified by the client, the service may default this to"},{"line_number":47,"context_line":"  either `true` or `false`."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"- `public_key` (string)"}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_50135e00","line":46,"updated":"2014-07-20 21:24:59.000000000","message":"The the client does not specify a value, the service can default this value to true or false.","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"668130e8c26b309fb726aa5b88227c21b513d49b","unresolved":false,"context_lines":[{"line_number":49,"context_line":"- `public_key` (string)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"  Public key issued by a Keystone Identity Provider used for checking"},{"line_number":52,"context_line":"  token signature."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"  If a value is not specified by the client, the service may default this value"},{"line_number":55,"context_line":"  to either an empty string or `null`."}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_51484fcc","line":52,"updated":"2014-07-09 10:53:35.000000000","message":"I think perhaps this should use more generic wording, as IdPs using other protocols might use public keys as well.\n\nPerhaps:\n\"Public key issued by an external Identity Provider used for validating assertions\"\n?","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"069615ca8f5441f9a511454d1e8ffd7f4c69aa1c","unresolved":false,"context_lines":[{"line_number":49,"context_line":"- `public_key` (string)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"  Public key issued by a Keystone Identity Provider used for checking"},{"line_number":52,"context_line":"  token signature."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"  If a value is not specified by the client, the service may default this value"},{"line_number":55,"context_line":"  to either an empty string or `null`."}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_39b464d0","line":52,"in_reply_to":"baada198_51484fcc","updated":"2014-07-10 18:49:58.000000000","message":"+1","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"2b8e3713ae58f56a5987266ffc18fe6f0c6ca25b","unresolved":false,"context_lines":[{"line_number":49,"context_line":"- `public_key` (string)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"  Public key issued by a Keystone Identity Provider used for checking"},{"line_number":52,"context_line":"  token signature."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"  If a value is not specified by the client, the service may default this value"},{"line_number":55,"context_line":"  to either an empty string or `null`."}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_101d660f","line":52,"in_reply_to":"baada198_51484fcc","updated":"2014-07-20 21:24:59.000000000","message":"The public key that an external identity provider issues to validate assertions.","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"2b8e3713ae58f56a5987266ffc18fe6f0c6ca25b","unresolved":false,"context_lines":[{"line_number":52,"context_line":"  token signature."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"  If a value is not specified by the client, the service may default this value"},{"line_number":55,"context_line":"  to either an empty string or `null`."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"### Protocols: `/OS-FEDERATION/identity_providers/{idp_id}/protocols`"},{"line_number":58,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_70d30238","line":55,"updated":"2014-07-20 21:24:59.000000000","message":"If the client does not specify a value, the service can default this value to an empty string or null.","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"2b8e3713ae58f56a5987266ffc18fe6f0c6ca25b","unresolved":false,"context_lines":[{"line_number":57,"context_line":"### Protocols: `/OS-FEDERATION/identity_providers/{idp_id}/protocols`"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"A protocol entry contains information that dictates which mapping rules"},{"line_number":60,"context_line":"to use for a given incoming request. An IdP may have multiple supported"},{"line_number":61,"context_line":"protocols."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Required attributes:"}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_90d89654","line":60,"updated":"2014-07-20 21:24:59.000000000","message":"can have","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"2b8e3713ae58f56a5987266ffc18fe6f0c6ca25b","unresolved":false,"context_lines":[{"line_number":166,"context_line":"Identity Provider API"},{"line_number":167,"context_line":"---------------------"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"### Register an Identity Provider: `PUT /OS-FEDERATION/identity_providers/{idp_id}`"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Request:"},{"line_number":172,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_d0de8e3d","line":169,"updated":"2014-07-20 21:24:59.000000000","message":"Register an identity provider","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"2b8e3713ae58f56a5987266ffc18fe6f0c6ca25b","unresolved":false,"context_lines":[{"line_number":292,"context_line":"        }"},{"line_number":293,"context_line":"    }"},{"line_number":294,"context_line":""},{"line_number":295,"context_line":"When an identity provider is disabled, any tokens generated by that identity"},{"line_number":296,"context_line":"provider will be revoked."},{"line_number":297,"context_line":""},{"line_number":298,"context_line":"### Add a supported protocol and attribute mapping combination to an identity provider: `PUT /OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}`"}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_30ed0af1","line":295,"updated":"2014-07-20 21:24:59.000000000","message":"When an identity provider is disabled, any tokens that the identity provider generated are revoked.","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"79d7f57882a43868725fe6dec16ef4d7c21ce1cd","unresolved":false,"context_lines":[{"line_number":293,"context_line":"    }"},{"line_number":294,"context_line":""},{"line_number":295,"context_line":"When an identity provider is disabled, any tokens generated by that identity"},{"line_number":296,"context_line":"provider will be revoked."},{"line_number":297,"context_line":""},{"line_number":298,"context_line":"### Add a supported protocol and attribute mapping combination to an identity provider: `PUT /OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}`"},{"line_number":299,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_bb1a5d15","line":296,"updated":"2014-07-01 18:13:29.000000000","message":"When an identity provider is disabled, should we remove the public key and force them to upload a new one upon re-enablement? The use case being that an identity provider could be disabled for a while, and potentially due to key compromise.","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"668130e8c26b309fb726aa5b88227c21b513d49b","unresolved":false,"context_lines":[{"line_number":293,"context_line":"    }"},{"line_number":294,"context_line":""},{"line_number":295,"context_line":"When an identity provider is disabled, any tokens generated by that identity"},{"line_number":296,"context_line":"provider will be revoked."},{"line_number":297,"context_line":""},{"line_number":298,"context_line":"### Add a supported protocol and attribute mapping combination to an identity provider: `PUT /OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}`"},{"line_number":299,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_11f7b78d","line":296,"in_reply_to":"baada198_6113b35c","updated":"2014-07-09 10:53:35.000000000","message":"I agree with Marek, I think there could be a number of use cases where an identity provider is disabled without the keys being invalidated, if ACME only purchases resources from BETA for a few months during busy periods, for example. I would hope that if a cloud deployer disables an identity provider due to key compromise, then they would only reenable once they had updated to the new keys.","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"ab8b71cce77a4aef5f5c7b43b5385307f340dacb","unresolved":false,"context_lines":[{"line_number":293,"context_line":"    }"},{"line_number":294,"context_line":""},{"line_number":295,"context_line":"When an identity provider is disabled, any tokens generated by that identity"},{"line_number":296,"context_line":"provider will be revoked."},{"line_number":297,"context_line":""},{"line_number":298,"context_line":"### Add a supported protocol and attribute mapping combination to an identity provider: `PUT /OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}`"},{"line_number":299,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":2,"id":"baada198_6113b35c","line":296,"in_reply_to":"baada198_bb1a5d15","updated":"2014-07-01 20:19:47.000000000","message":"I would say no. Imagine situation where ACME, BETA and GAMMA federate each other. Now, ACME didn\u0027t pay BETA on time, so BETA wants to disable ACME as IdP (ACME\u0027s users cannot burst to BETA) until ACME pays all the money. After ACME pays, BETA enables ACME IdP again. If we enforce uploading new keys this would mean ACME needs to generate new priv/pubkey pair and propagate it to BETA...but also poor GAMMA. Now imagine how this would look like with federation with 10 or 20 clouds....","commit_id":"303cffcd1503d7c0fc850bafbe057b15f82e9205"}]}