)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"b80a4d7dfd073bd89caeead392d8a1c7abd7dc93","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Attribute Issuing Policy for External Identity Providers"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Allows fine grained control of which attributes an external identity provider can issue and which values of those attributes can be issued."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: Ib17b19da9fd6a0b88b9d3336d8f663128c8b9cde"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"AAAATn%2F9hZ8%3D","line":10,"updated":"2013-12-10 16:30:54.000000000","message":"Its not what can be issued by an IDP. An IDP can issue whatever it wants to issue. Its what Keystone will accept as being trustworthy. Change this text to \n\n\nAllows fine grained control over which attributes (both types and values) Keystone will accept as trustworthy from an external identity provider. All attributes (types and/or values) that are not in the Issuing Policy will be discarded by Keystone.","commit_id":"2a89c05f035a2e6054397446764e47a6c8a83f1d"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"3d146f8e91263f8bc873b7489114d7aa19e1a9e5","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     kwss \u003ckwss@kent.ac.uk\u003e"},{"line_number":5,"context_line":"CommitDate: 2013-12-11 16:13:55 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Attribute Issuing Policy for External Identity Providers"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Allows fine grained control over which attributes (both types and values) Keystone will accept as"},{"line_number":10,"context_line":"trustworthy from an external identity provider. All attributes (types and/or values) that are not"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"AAAATn%2F9auM%3D","line":7,"updated":"2013-12-11 18:47:00.000000000","message":"Can we name space all federation specif the commit message with \"Federation\"\nThe way it is done in \"Add IdP management extension (Federation pt1)\" will help grouping of different federation work.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5a54c797c70cd0ef3679099e3eaf16050e71d573","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     kwss \u003ckwss@kent.ac.uk\u003e"},{"line_number":5,"context_line":"CommitDate: 2013-12-11 16:13:55 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Attribute Issuing Policy for External Identity Providers"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Allows fine grained control over which attributes (both types and values) Keystone will accept as"},{"line_number":10,"context_line":"trustworthy from an external identity provider. All attributes (types and/or values) that are not"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"AAAATn%2F9aLw%3D","line":7,"in_reply_to":"AAAATn%2F9auM%3D","updated":"2013-12-11 20:26:44.000000000","message":"Sure. Whatever is the normally accepted practice we will follow","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"a49e000743822d27e72863075fd635a47ae60a32","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Co-Authored-By: Kristy Siu \u003ckwss@kent.ac.uk\u003e"},{"line_number":15,"context_line":"Co-Authored-By: David Chadwick \u003cd.w.chadwick@kent.ac.uk\u003e"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Change-Id: Ib17b19da9fd6a0b88b9d3336d8f663128c8b9cde"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":12,"id":"7adec928_9634d54a","line":16,"updated":"2014-05-20 01:56:10.000000000","message":"also, this needs to reference a blueprint, i couldn\u0027t find an open one in keystone that relates to this.\n\nit should be written as:\nimplements: bp xyz123","commit_id":"2664a377ccff6aead7f7bd85404be4722e2c2fed"}],"openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"075de17dac724fbf500f27554dbc541169a8e82a","unresolved":false,"context_lines":[{"line_number":138,"context_line":"      expression](http://docs.python.org/2/library/re.html) search against the"},{"line_number":139,"context_line":"      remote attribute `type`."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"### Trusted Attribute:`/OS-FEDERATION/identity_providers/{idp-id}/trusted_attributes`"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"      A trusted attributes policy defines which attributes an identity provider is"},{"line_number":144,"context_line":"      trusted to issue."}],"source_content_type":"text/x-markdown","patch_set":12,"id":"7adec928_76bca9bb","line":141,"updated":"2014-05-20 01:53:23.000000000","message":"typo: ipd_id*","commit_id":"2664a377ccff6aead7f7bd85404be4722e2c2fed"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"075de17dac724fbf500f27554dbc541169a8e82a","unresolved":false,"context_lines":[{"line_number":148,"context_line":"    - `attributes` (list)"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"      This is the list of trusted attributes. Each attribute is specified as a"},{"line_number":151,"context_line":"      type and an optional set of values. An list of zero values denotes that"},{"line_number":152,"context_line":"      any value should be accepted."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"Identity Provider API"}],"source_content_type":"text/x-markdown","patch_set":12,"id":"7adec928_56b96dca","line":151,"updated":"2014-05-20 01:53:23.000000000","message":"typo: A* list of ...","commit_id":"2664a377ccff6aead7f7bd85404be4722e2c2fed"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"075de17dac724fbf500f27554dbc541169a8e82a","unresolved":false,"context_lines":[{"line_number":578,"context_line":"Trusted Attribute API"},{"line_number":579,"context_line":"---------------------"},{"line_number":580,"context_line":""},{"line_number":581,"context_line":"### List an Identity Provider\u0027s set of trusted attributes: `GET /OS-FEDERATED/identity_providers/{idp-id}/trusted_attributes`"},{"line_number":582,"context_line":""},{"line_number":583,"context_line":"Response:"},{"line_number":584,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":12,"id":"7adec928_d6cc9d6c","line":581,"updated":"2014-05-20 01:53:23.000000000","message":"I\u0027m not sure if this should be defined as Get or List, I think we generally reserve list if many entities are returned, in this case it\u0027s always going to be a single \u0027trusted_attributes\u0027 object.\n\ntypo: idp_id","commit_id":"2664a377ccff6aead7f7bd85404be4722e2c2fed"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"075de17dac724fbf500f27554dbc541169a8e82a","unresolved":false,"context_lines":[{"line_number":606,"context_line":"        }"},{"line_number":607,"context_line":"    }"},{"line_number":608,"context_line":""},{"line_number":609,"context_line":"### Create an Identity Provider\u0027s Trusted Attributes Policy: `POST /OS-FEDERATED/identity_providers/{idp-id}/trusted_attributes`"},{"line_number":610,"context_line":""},{"line_number":611,"context_line":"Request:"},{"line_number":612,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":12,"id":"7adec928_f6c7d942","line":609,"updated":"2014-05-20 01:53:23.000000000","message":"typo: idp_id","commit_id":"2664a377ccff6aead7f7bd85404be4722e2c2fed"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"075de17dac724fbf500f27554dbc541169a8e82a","unresolved":false,"context_lines":[{"line_number":654,"context_line":"        }"},{"line_number":655,"context_line":"    }"},{"line_number":656,"context_line":""},{"line_number":657,"context_line":"### Update an Identity Provider\u0027s Trusted Attributes Policy: `PATCH /OS-FEDERATED/identity_providers/{idp-id}/trusted_attributes`"},{"line_number":658,"context_line":""},{"line_number":659,"context_line":"Request:"},{"line_number":660,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":12,"id":"7adec928_b6e9d1b8","line":657,"updated":"2014-05-20 01:53:23.000000000","message":"typo: idp_id","commit_id":"2664a377ccff6aead7f7bd85404be4722e2c2fed"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"075de17dac724fbf500f27554dbc541169a8e82a","unresolved":false,"context_lines":[{"line_number":702,"context_line":"        }"},{"line_number":703,"context_line":"    }"},{"line_number":704,"context_line":""},{"line_number":705,"context_line":"### Delete from an Identity Provider\u0027s Trusted Attributes Policy: `DELETE /OS-FEDERATED/identity_providers/{idp-id}/trusted_attributes`"},{"line_number":706,"context_line":""},{"line_number":707,"context_line":"Response:"},{"line_number":708,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":12,"id":"7adec928_d6d3bd01","line":705,"updated":"2014-05-20 01:53:23.000000000","message":"typo: idp_id","commit_id":"2664a377ccff6aead7f7bd85404be4722e2c2fed"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"e260b98e3e1f7fccbc9834f281d4534a8d570813","unresolved":false,"context_lines":[{"line_number":18,"context_line":"  may not align 1:1 with the Identity API concepts. To help overcome such"},{"line_number":19,"context_line":"  mismatches, a mapping can be done either on the sending side (third party"},{"line_number":20,"context_line":"  identity provider), on the consuming side (Identity API service), or both."},{"line_number":21,"context_line":"- *Trusted Attribute*: An attribute trusted to be issued by a Trusted Identity"},{"line_number":22,"context_line":"  Provider."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"API Resources"}],"source_content_type":"text/x-markdown","patch_set":14,"id":"7adec928_bf5401cb","line":21,"updated":"2014-05-22 04:31:25.000000000","message":"I would make them \u0027optional\u0027, and if missing, all parameters would be trusted.","commit_id":"c33fd2b1bde740050219189370eee7caaedd715d"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5583a8b04541789ae3ccbbba3eddbbce323a63ae","unresolved":false,"context_lines":[{"line_number":18,"context_line":"  may not align 1:1 with the Identity API concepts. To help overcome such"},{"line_number":19,"context_line":"  mismatches, a mapping can be done either on the sending side (third party"},{"line_number":20,"context_line":"  identity provider), on the consuming side (Identity API service), or both."},{"line_number":21,"context_line":"- *Trusted Attribute*: An attribute trusted to be issued by a Trusted Identity"},{"line_number":22,"context_line":"  Provider."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"API Resources"}],"source_content_type":"text/x-markdown","patch_set":14,"id":"7adec928_25361e04","line":21,"in_reply_to":"7adec928_bf5401cb","updated":"2014-05-22 07:19:48.000000000","message":"This is not secure. A \"trust all\" policy is what we currently have in the Ice-house release and this is why we are introducing this policy. If administrators don\u0027t say what is trusted then everything will be discarded as untrusted. It is not an onerous task to say which few attributes are the ones you want.","commit_id":"c33fd2b1bde740050219189370eee7caaedd715d"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3827fc3e427e2a97145ffe9af17302e7c7932335","unresolved":false,"context_lines":[{"line_number":173,"context_line":"        \"identity_provider\": {"},{"line_number":174,"context_line":"            \"description\": \"Stores ACME identities\","},{"line_number":175,"context_line":"            \"enabled\": true,"},{"line_number":176,"context_line":"            \"id\": \"ACME\","},{"line_number":177,"context_line":"            \"links\": {"},{"line_number":178,"context_line":"                \"protocols\": \"http://identity:35357/v3/OS-FEDERATION/identity_providers/ACME/protocols\","},{"line_number":179,"context_line":"                \"self\": \"http://identity:35357/v3/OS-FEDERATION/identity_providers/ACME\""}],"source_content_type":"text/x-markdown","patch_set":14,"id":"7adec928_e1d9aaf5","line":176,"updated":"2014-05-21 09:07:25.000000000","message":"I think this section should also containt something like: \n \"trusted_attributes\": \"http://identity:35357/v3/OS-FEDERATION/identity_providers/ACME/trusted_attributes\"","commit_id":"c33fd2b1bde740050219189370eee7caaedd715d"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"df3a840861248ea0eaad256765cda4394a1441ba","unresolved":false,"context_lines":[{"line_number":173,"context_line":"        \"identity_provider\": {"},{"line_number":174,"context_line":"            \"description\": \"Stores ACME identities\","},{"line_number":175,"context_line":"            \"enabled\": true,"},{"line_number":176,"context_line":"            \"id\": \"ACME\","},{"line_number":177,"context_line":"            \"links\": {"},{"line_number":178,"context_line":"                \"protocols\": \"http://identity:35357/v3/OS-FEDERATION/identity_providers/ACME/protocols\","},{"line_number":179,"context_line":"                \"self\": \"http://identity:35357/v3/OS-FEDERATION/identity_providers/ACME\""}],"source_content_type":"text/x-markdown","patch_set":14,"id":"7adec928_76c0ff2a","line":176,"in_reply_to":"7adec928_e1d9aaf5","updated":"2014-05-22 10:44:49.000000000","message":"Good call, I agree completely.","commit_id":"c33fd2b1bde740050219189370eee7caaedd715d"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3827fc3e427e2a97145ffe9af17302e7c7932335","unresolved":false,"context_lines":[{"line_number":606,"context_line":"        }"},{"line_number":607,"context_line":"    }"},{"line_number":608,"context_line":""},{"line_number":609,"context_line":"### Create an Identity Provider\u0027s Trusted Attributes Policy: `POST /OS-FEDERATED/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":610,"context_line":""},{"line_number":611,"context_line":"Request:"},{"line_number":612,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":14,"id":"7adec928_a1e6c2e6","line":609,"updated":"2014-05-21 09:07:25.000000000","message":"let\u0027s be consistent with other federation related operations and use PUT method instead of POST.","commit_id":"c33fd2b1bde740050219189370eee7caaedd715d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"21064afd1908ed4e765921080de4012e242da7e4","unresolved":false,"context_lines":[{"line_number":647,"context_line":"                    \"type\": \"uid\","},{"line_number":648,"context_line":"                    \"values\": []"},{"line_number":649,"context_line":"                }"},{"line_number":650,"context_line":"            ]"},{"line_number":651,"context_line":"            \"links\": {"},{"line_number":652,"context_line":"                \"self\": \"http://identity:35357/v3/OS-FEDERATED/identity_providers/7e23a6/trusted_attributes\""},{"line_number":653,"context_line":"            }"}],"source_content_type":"text/x-markdown","patch_set":14,"id":"7adec928_b36555e2","line":650,"updated":"2014-05-20 14:00:24.000000000","message":"Most of the return dictionaries are not valid json. Missing a comma before links in most cases. \n\nWhat do you think of getting rid of the \u0027attributes\u0027 layer and get listing them under trusted attributes?","commit_id":"c33fd2b1bde740050219189370eee7caaedd715d"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3827fc3e427e2a97145ffe9af17302e7c7932335","unresolved":false,"context_lines":[{"line_number":647,"context_line":"                    \"type\": \"uid\","},{"line_number":648,"context_line":"                    \"values\": []"},{"line_number":649,"context_line":"                }"},{"line_number":650,"context_line":"            ]"},{"line_number":651,"context_line":"            \"links\": {"},{"line_number":652,"context_line":"                \"self\": \"http://identity:35357/v3/OS-FEDERATED/identity_providers/7e23a6/trusted_attributes\""},{"line_number":653,"context_line":"            }"}],"source_content_type":"text/x-markdown","patch_set":14,"id":"7adec928_211f12b9","line":650,"in_reply_to":"7adec928_b36555e2","updated":"2014-05-21 09:07:25.000000000","message":"++","commit_id":"c33fd2b1bde740050219189370eee7caaedd715d"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"f0ba6952cb0a79975fdb3d2a0446042fd6f6453f","unresolved":false,"context_lines":[{"line_number":647,"context_line":"                    \"type\": \"uid\","},{"line_number":648,"context_line":"                    \"values\": []"},{"line_number":649,"context_line":"                }"},{"line_number":650,"context_line":"            ]"},{"line_number":651,"context_line":"            \"links\": {"},{"line_number":652,"context_line":"                \"self\": \"http://identity:35357/v3/OS-FEDERATED/identity_providers/7e23a6/trusted_attributes\""},{"line_number":653,"context_line":"            }"}],"source_content_type":"text/x-markdown","patch_set":14,"id":"7adec928_530b317c","line":650,"in_reply_to":"7adec928_b36555e2","updated":"2014-05-20 14:14:08.000000000","message":"I can\u0027t see a problem with this. I don\u0027t think it makes any difference to the way it works, I suspect we originally had the IDP identifier in the JSON but moved it to the URL. I\u0027ll fix it in the next patch.","commit_id":"c33fd2b1bde740050219189370eee7caaedd715d"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"f0ba6952cb0a79975fdb3d2a0446042fd6f6453f","unresolved":false,"context_lines":[{"line_number":702,"context_line":"        }"},{"line_number":703,"context_line":"    }"},{"line_number":704,"context_line":""},{"line_number":705,"context_line":"### Delete from an Identity Provider\u0027s Trusted Attributes Policy: `DELETE /OS-FEDERATED/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":706,"context_line":""},{"line_number":707,"context_line":"Response:"},{"line_number":708,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":14,"id":"7adec928_b3239503","line":705,"updated":"2014-05-20 14:14:08.000000000","message":"I just noticed that this reads \u0027Delete from an\" instead of \u0027Delete an\u0027 so will fix it in the next patch.","commit_id":"c33fd2b1bde740050219189370eee7caaedd715d"}],"openstack-identity-api/v3/src/markdown/identity-api-v3-os-idp-issuing-policy-ext.md":[{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"2a511625baeff3eeb959affd4c7b203abc4d3c20","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-IDP Issuing Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"Provide the ability for users to manage the issuing policy of identity providers. This"},{"line_number":5,"context_line":"extension requires v3.0+ of the Identity API and the proposed OS-IDP extension."},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Definitions"}],"source_content_type":"text/x-markdown","patch_set":1,"id":"AAAATn%2F9hwk%3D","line":4,"updated":"2013-12-10 15:25:37.000000000","message":"Provide the ability for an administrator to manage the attributes that are trusted to be issued by an identity provider. Each issuing policy comprises the set of attributes (optionally with values) that the IDP is trusted to issue. If the values are missing, then the IdP is trusted to issue all the values of a particular attribute.","commit_id":"443e2d19e5a88e21e34b3568b8f3161ec6429eea"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"3d146f8e91263f8bc873b7489114d7aa19e1a9e5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-IDP Issuing Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Provides the ability for an administrator to manage the attributes that are trusted to be issued by an identity provider. Each issuing policy comprises the set of attributes (optionally with values) that the IDP is trusted to issue. If the values are missing, then the IdP is trusted to issue all the values of a particular attribute."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"This extension requires v3.0+ of the Identity API and the proposed OS-IDP extension."},{"line_number":6,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9arc%3D","line":3,"updated":"2013-12-11 18:47:00.000000000","message":"I am not in favor of cloud admin managing any federation artifact on behalf of me (a domain owner on a public cloud). It has to be done by me, it is OK in case of private cloud where a cloud admin  can manage all these artifacts.\n\nWe have to enhance https://review.openstack.org/#/c/59846/4/openstack-identity-api/v3/src/markdown/identity-api-v3-os-idp-ext.md to support notion of domain specific IdPs and provision domain admin managed IdPs\n\nIt seems we are totally deviating from summit agreement if we are not having a domain managed IdPs.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"e3b9d9d506abb0bfb253061bc24a7c39de1c3703","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-IDP Issuing Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Provides the ability for an administrator to manage the attributes that are trusted to be issued by an identity provider. Each issuing policy comprises the set of attributes (optionally with values) that the IDP is trusted to issue. If the values are missing, then the IdP is trusted to issue all the values of a particular attribute."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"This extension requires v3.0+ of the Identity API and the proposed OS-IDP extension."},{"line_number":6,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9Y4Y%3D","line":3,"in_reply_to":"AAAATn%2F9Z8U%3D","updated":"2013-12-12 00:29:56.000000000","message":"that wd help","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"e3b9d9d506abb0bfb253061bc24a7c39de1c3703","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-IDP Issuing Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Provides the ability for an administrator to manage the attributes that are trusted to be issued by an identity provider. Each issuing policy comprises the set of attributes (optionally with values) that the IDP is trusted to issue. If the values are missing, then the IdP is trusted to issue all the values of a particular attribute."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"This extension requires v3.0+ of the Identity API and the proposed OS-IDP extension."},{"line_number":6,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9Y4o%3D","line":3,"in_reply_to":"AAAATn%2F9aOU%3D","updated":"2013-12-12 00:29:56.000000000","message":"Agreed, my major concern was with IdP data model which was not enough to support domain isolation.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e69ec92a1070816b4f3d784aa992faa8dea92a70","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-IDP Issuing Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Provides the ability for an administrator to manage the attributes that are trusted to be issued by an identity provider. Each issuing policy comprises the set of attributes (optionally with values) that the IDP is trusted to issue. If the values are missing, then the IdP is trusted to issue all the values of a particular attribute."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"This extension requires v3.0+ of the Identity API and the proposed OS-IDP extension."},{"line_number":6,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9Z8U%3D","line":3,"in_reply_to":"AAAATn%2F9aOU%3D","updated":"2013-12-11 21:17:36.000000000","message":"I agreed. Arvind, there\u0027s an optional domain_id field for the identity provider. You should be able to set up your authorization policy accordingly.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5a54c797c70cd0ef3679099e3eaf16050e71d573","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-IDP Issuing Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Provides the ability for an administrator to manage the attributes that are trusted to be issued by an identity provider. Each issuing policy comprises the set of attributes (optionally with values) that the IDP is trusted to issue. If the values are missing, then the IdP is trusted to issue all the values of a particular attribute."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"This extension requires v3.0+ of the Identity API and the proposed OS-IDP extension."},{"line_number":6,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9aOU%3D","line":3,"in_reply_to":"AAAATn%2F9arc%3D","updated":"2013-12-11 20:26:44.000000000","message":"If you read this introduction carefully, it says \"AN administrator\", not \"THE administrator\". Who can perform any operation on any Keystone API is an access control issue which is not being dealt with in this API specification. This API is simply providing the operation for managing which IDPs are trusted by federated Keystone to issue which attributes. I agree that the access control rules do need to be specified, but these should be done by the OpenStack implementation rather than the API specification, providing the access control model is flexible enough to support all user requirements. For example, one implementation could have the policy that the Keystone admin sets all the IDP issuing policy rules. Another could have the policy that each domain admin sets the IDP issuing policies for the IDPs trusted by his domain. Another policy could be that several domains are grouped together for access  control purposes. Another access control policy could be that only the admin that adds an issuing policy rule can delete it. So I would rather not complicate this API with access control issues.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"c9721817f197bcc4c53d46a933a627c9ff8da286","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    {"},{"line_number":24,"context_line":"        \"issuing_policy\": {"},{"line_number":25,"context_line":"            \"identity_provider_id\": \"7e23a6\","},{"line_number":26,"context_line":"            \"attributes\": ["},{"line_number":27,"context_line":"                {"},{"line_number":28,"context_line":"                    \"type\": \"email\","}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9a3E%3D","line":25,"updated":"2013-12-11 18:09:51.000000000","message":"Are these attributes protocol-specific or applicable to all protocols? Looking at the API, I am guessing an IdP can have only one issuing policy?","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5a54c797c70cd0ef3679099e3eaf16050e71d573","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    {"},{"line_number":24,"context_line":"        \"issuing_policy\": {"},{"line_number":25,"context_line":"            \"identity_provider_id\": \"7e23a6\","},{"line_number":26,"context_line":"            \"attributes\": ["},{"line_number":27,"context_line":"                {"},{"line_number":28,"context_line":"                    \"type\": \"email\","}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9aNo%3D","line":25,"in_reply_to":"AAAATn%2F9a3E%3D","updated":"2013-12-11 20:26:44.000000000","message":"They are protocol independent. The whole purpose of building a protocol independent federation infrastructure is that all the complexity of trust management is made protocol independent. Then all that the protocol implementers need to care about is handling the protocol correctly and returning the asserted attributes to the protocol independent federation code.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e69ec92a1070816b4f3d784aa992faa8dea92a70","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    {"},{"line_number":24,"context_line":"        \"issuing_policy\": {"},{"line_number":25,"context_line":"            \"identity_provider_id\": \"7e23a6\","},{"line_number":26,"context_line":"            \"attributes\": ["},{"line_number":27,"context_line":"                {"},{"line_number":28,"context_line":"                    \"type\": \"email\","}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9Z78%3D","line":25,"in_reply_to":"AAAATn%2F9aNo%3D","updated":"2013-12-11 21:17:36.000000000","message":"Understood. Just want to make sure a given attribute does not have different meanings for different protocol.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"c9721817f197bcc4c53d46a933a627c9ff8da286","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        }"},{"line_number":44,"context_line":"    }"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"### Add to or modify an Identity Provider Issuing Policy: `POST /OS-IDP/identity_providers/{idp-id}/issuing_policy`"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Request:"},{"line_number":49,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9a18%3D","line":46,"updated":"2013-12-11 18:09:51.000000000","message":"This is an update operation. Use PATCH instead of POST.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5a54c797c70cd0ef3679099e3eaf16050e71d573","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        }"},{"line_number":44,"context_line":"    }"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"### Add to or modify an Identity Provider Issuing Policy: `POST /OS-IDP/identity_providers/{idp-id}/issuing_policy`"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Request:"},{"line_number":49,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9aNk%3D","line":46,"in_reply_to":"AAAATn%2F9a18%3D","updated":"2013-12-11 20:26:44.000000000","message":"Sure. Whatever is the norm for this.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d7cd51bc1f30f89e3cd203cc73e53c2376fe9fec","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        }"},{"line_number":44,"context_line":"    }"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"### Add to or modify an Identity Provider Issuing Policy: `POST /OS-IDP/identity_providers/{idp-id}/issuing_policy`"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Request:"},{"line_number":49,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9OOw%3D","line":46,"in_reply_to":"AAAATn%2F9aNk%3D","updated":"2013-12-13 20:41:47.000000000","message":"One concern about this is, when an update is perform, I think over-writing the whole object would be better.\n\nThe current example makes it seem like you are adding to the attributes, when they are in fact under the issuing_policy of the request. \n\nMy suggestion is:\n\n1) Separate create and update to two methods (post for create and patch for update)\n\n2) When an update is performed, over-write everything in attributes, otherwise, we will need to have attribute specific calls.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"c9721817f197bcc4c53d46a933a627c9ff8da286","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        }"},{"line_number":90,"context_line":"    }"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"### Delete from an Identity Provider Issuing Policy: `DELETE /OS-IDP/identity_providers/{idp-id}/issuing_policy`"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Request:"},{"line_number":95,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9a2k%3D","line":92,"updated":"2013-12-11 18:09:51.000000000","message":"The example is wrong. You are essentially showing an update example. If I understand you intention, DELETE completely remove the the issuing_policy. So there shouldn\u0027t be a request body and the response code should be 204.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"9a39afe41d5e7d5902f0db4eed09608589ee42ac","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        }"},{"line_number":90,"context_line":"    }"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"### Delete from an Identity Provider Issuing Policy: `DELETE /OS-IDP/identity_providers/{idp-id}/issuing_policy`"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Request:"},{"line_number":95,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9Ovk%3D","line":92,"in_reply_to":"AAAATn%2F9Z7E%3D","updated":"2013-12-13 18:54:34.000000000","message":"Understood. This will be fixed in the next version","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5a54c797c70cd0ef3679099e3eaf16050e71d573","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        }"},{"line_number":90,"context_line":"    }"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"### Delete from an Identity Provider Issuing Policy: `DELETE /OS-IDP/identity_providers/{idp-id}/issuing_policy`"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Request:"},{"line_number":95,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9aMw%3D","line":92,"in_reply_to":"AAAATn%2F9a2k%3D","updated":"2013-12-11 20:26:44.000000000","message":"What Kristy was trying to do was show the administrator what policy was left after the rule had been deleted. Of course this can be achieved by two separate operations: delete rule which returns nothing, and list rules which returns the current policy. So we can remove the list result from the delete operation if this is the majority view","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e69ec92a1070816b4f3d784aa992faa8dea92a70","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        }"},{"line_number":90,"context_line":"    }"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"### Delete from an Identity Provider Issuing Policy: `DELETE /OS-IDP/identity_providers/{idp-id}/issuing_policy`"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Request:"},{"line_number":95,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":5,"id":"AAAATn%2F9Z7E%3D","line":92,"in_reply_to":"AAAATn%2F9aMw%3D","updated":"2013-12-11 21:17:36.000000000","message":"This API implies you are deleting the entire issuing_policy. We need this API, just want to make sure the examples match the intention.","commit_id":"5d2e26be9932ac309e427ecca9a44006411ed02e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b6b4df7c14610c13a0f0c5b3e23114ff592df94a","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Note: Domains are currently not included in the spec until IDP management (Federation pt 1) has domains added."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Definitions"},{"line_number":12,"context_line":"-----------"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"API Resources"},{"line_number":15,"context_line":"-------------"}],"source_content_type":"text/x-markdown","patch_set":6,"id":"AAAATn%2F87Hw%3D","line":12,"updated":"2013-12-18 18:23:53.000000000","message":"still needs to be filled in.","commit_id":"835bb62728c7449a4483df40ca1bc05ad83e850a"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"2f989a06e67b6fe02385a66e5086435921c2ab53","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Definitions"},{"line_number":12,"context_line":"-----------"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"API Resources"},{"line_number":15,"context_line":"-------------"},{"line_number":16,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":6,"id":"AAAATn%2F8xDw%3D","line":13,"updated":"2013-12-20 14:48:33.000000000","message":"will remove this","commit_id":"835bb62728c7449a4483df40ca1bc05ad83e850a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b6b4df7c14610c13a0f0c5b3e23114ff592df94a","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"API Resources"},{"line_number":15,"context_line":"-------------"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Identity Provider API"},{"line_number":18,"context_line":"---------------------"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":6,"id":"AAAATn%2F87Hs%3D","line":16,"updated":"2013-12-18 18:23:53.000000000","message":"still needs to be filled in.","commit_id":"835bb62728c7449a4483df40ca1bc05ad83e850a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"b6b4df7c14610c13a0f0c5b3e23114ff592df94a","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Identity Provider API"},{"line_number":18,"context_line":"---------------------"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### List an Identity Provider Issuing Policy: `GET /OS-IDP/identity_providers/{idp-id}/issuing_policy/`"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Response:"}],"source_content_type":"text/x-markdown","patch_set":6,"id":"AAAATn%2F87H8%3D","line":20,"updated":"2013-12-18 18:23:53.000000000","message":"This should read, \"Get an Identity ... \" as we reserve \"List yyy\" for multiple entities that get returned.","commit_id":"835bb62728c7449a4483df40ca1bc05ad83e850a"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"2f989a06e67b6fe02385a66e5086435921c2ab53","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Identity Provider API"},{"line_number":18,"context_line":"---------------------"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"### List an Identity Provider Issuing Policy: `GET /OS-IDP/identity_providers/{idp-id}/issuing_policy/`"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Response:"}],"source_content_type":"text/x-markdown","patch_set":6,"id":"AAAATn%2F8xDU%3D","line":20,"in_reply_to":"AAAATn%2F87H8%3D","updated":"2013-12-20 14:48:33.000000000","message":"agreed","commit_id":"835bb62728c7449a4483df40ca1bc05ad83e850a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"134369290c2529f38c476977bc58dc42c523a12d","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-IDP Issuing Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Provides the ability for an administrator to manage the attributes that are trusted to be issued by an identity provider."},{"line_number":4,"context_line":"Each issuing policy comprises the set of attributes (optionally with values) that the IDP is trusted to issue."},{"line_number":5,"context_line":"If the values are missing, then the IdP is trusted to issue all the values of a particular attribute."}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F6w4%3D","line":2,"updated":"2014-01-06 20:07:16.000000000","message":"(markdown syntax) the length of the underline should match the number of characters in the title line","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"134369290c2529f38c476977bc58dc42c523a12d","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-IDP Issuing Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Provides the ability for an administrator to manage the attributes that are trusted to be issued by an identity provider."},{"line_number":4,"context_line":"Each issuing policy comprises the set of attributes (optionally with values) that the IDP is trusted to issue."},{"line_number":5,"context_line":"If the values are missing, then the IdP is trusted to issue all the values of a particular attribute."},{"line_number":6,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F6w0%3D","line":3,"updated":"2014-01-06 20:07:16.000000000","message":"(markdown syntax) manually wrap at 79 chars, or use an editor that\u0027ll take care of it for you\n\nintroduce the abbreviation before you use it in the next line, and then use consistent capitalization as in other documents... i think we settled on Identity Provider (IdP)","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"134369290c2529f38c476977bc58dc42c523a12d","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-IDP Issuing Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Provides the ability for an administrator to manage the attributes that are trusted to be issued by an identity provider."},{"line_number":4,"context_line":"Each issuing policy comprises the set of attributes (optionally with values) that the IDP is trusted to issue."},{"line_number":5,"context_line":"If the values are missing, then the IdP is trusted to issue all the values of a particular attribute."},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This extension requires v3.0+ of the Identity API and the proposed OS-IDP extension."}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F6wg%3D","line":4,"updated":"2014-01-06 20:07:16.000000000","message":"IdP","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"134369290c2529f38c476977bc58dc42c523a12d","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Each issuing policy comprises the set of attributes (optionally with values) that the IDP is trusted to issue."},{"line_number":5,"context_line":"If the values are missing, then the IdP is trusted to issue all the values of a particular attribute."},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This extension requires v3.0+ of the Identity API and the proposed OS-IDP extension."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Note: Domains are currently not included in the spec until IDP management (Federation pt 1) has domains added."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F6wQ%3D","line":7,"updated":"2014-01-06 20:07:16.000000000","message":"by the time this merges, it\u0027ll be renamed OS-FEDERATION i think","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"134369290c2529f38c476977bc58dc42c523a12d","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Note: Domains are currently not included in the spec until IDP management (Federation pt 1) has domains added."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"API Resources"},{"line_number":12,"context_line":"-------------"},{"line_number":13,"context_line":"### Attribute Issuing Policy: `/OS-FEDERATION/identity_providers/{idp-id}/issuing_policy`"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"An attribute issuing policy defines which attributes an identity provider is trusted to issue."}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F6vw%3D","line":12,"updated":"2014-01-06 20:07:16.000000000","message":"(markdown syntax) missing whitespace after subtitles","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"134369290c2529f38c476977bc58dc42c523a12d","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"API Resources"},{"line_number":12,"context_line":"-------------"},{"line_number":13,"context_line":"### Attribute Issuing Policy: `/OS-FEDERATION/identity_providers/{idp-id}/issuing_policy`"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"An attribute issuing policy defines which attributes an identity provider is trusted to issue."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F6vI%3D","line":13,"updated":"2014-01-06 20:07:16.000000000","message":"using the term \u0027issuing_policy\u0027 as an API resource caught me off guard... i don\u0027t find it intuitive. why not call it trusted_attributes or something? does the list of trusted attributes not need to vary per protocol?","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"8a433cb57bdda43e6508e5620260efcf215ead27","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"API Resources"},{"line_number":12,"context_line":"-------------"},{"line_number":13,"context_line":"### Attribute Issuing Policy: `/OS-FEDERATION/identity_providers/{idp-id}/issuing_policy`"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"An attribute issuing policy defines which attributes an identity provider is trusted to issue."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F3k4%3D","line":13,"in_reply_to":"AAAAUH%2F%2F6vI%3D","updated":"2014-01-07 13:20:32.000000000","message":"We will change the name from issuing_policy to trusted_attributes policy. This is conceptually protocol independent since it is tied to the attributes that an IdP issues, regardless of how these are packaged in a protocol. But in practice it will be indirectly tied to a protocol if an IdP supports only one protocol.","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"134369290c2529f38c476977bc58dc42c523a12d","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Attributes:"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"-`attributes` (list)"},{"line_number":20,"context_line":"-`identity_provider_id` (string)"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Identity Provider API"}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F6v4%3D","line":19,"updated":"2014-01-06 20:07:16.000000000","message":"list of what?","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"8a433cb57bdda43e6508e5620260efcf215ead27","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Attributes:"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"-`attributes` (list)"},{"line_number":20,"context_line":"-`identity_provider_id` (string)"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Identity Provider API"}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F3kU%3D","line":19,"in_reply_to":"AAAAUH%2F%2F6v4%3D","updated":"2014-01-07 13:20:32.000000000","message":"This is the list of trusted attributes, which takes the form of a dict of type and optional values,  but we dont know how to represent a list of dicts.","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"134369290c2529f38c476977bc58dc42c523a12d","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Attributes:"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"-`attributes` (list)"},{"line_number":20,"context_line":"-`identity_provider_id` (string)"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Identity Provider API"},{"line_number":23,"context_line":"---------------------"}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F6wI%3D","line":20,"updated":"2014-01-06 20:07:16.000000000","message":"define these","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"134369290c2529f38c476977bc58dc42c523a12d","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"### Get an Identity Provider Issuing Policy: `GET /OS-IDP/identity_providers/{idp-id}/issuing_policy/`"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Response:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"    Status: 200 OK"}],"source_content_type":"text/x-markdown","patch_set":8,"id":"AAAAUH%2F%2F6vo%3D","line":27,"updated":"2014-01-06 20:07:16.000000000","message":"(markdown syntax) extra whitespace","commit_id":"98f309d75a5962e53db82b1f7b7dba4d9e2a8e35"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ff48cb2ae15b593fa197aaf9f77721ed36f1a970","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-FEDERATED Trusted Attribute Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Provides the ability for an administrator to manage the attributes that are"},{"line_number":4,"context_line":"trusted to be issued by an identity provider (IdP)."},{"line_number":5,"context_line":"Each trusted attribute policy comprises the set of attributes (optionally with"}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FlvE%3D","line":2,"updated":"2014-01-10 18:20:52.000000000","message":"missing whitespace after title","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"b4667ad64f5ed0dbe40d9058a08f52172214cea8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"OpenStack Identity API v3 OS-FEDERATED Trusted Attribute Policy Extension"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"Provides the ability for an administrator to manage the attributes that are"},{"line_number":4,"context_line":"trusted to be issued by an identity provider (IdP)."},{"line_number":5,"context_line":"Each trusted attribute policy comprises the set of attributes (optionally with"}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FjOA%3D","line":2,"in_reply_to":"AAAAUH%2F%2FlvE%3D","updated":"2014-01-11 17:09:03.000000000","message":"Done in next version","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"ea78cf86265d39318b6166a38887da585d23edb6","unresolved":false,"context_lines":[{"line_number":10,"context_line":"extension."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Note: Domains are currently not included in the spec until IdP management"},{"line_number":13,"context_line":"(Federation pt 1) has domains added."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"API Resources"},{"line_number":16,"context_line":"-------------"}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2F2eQ%3D","line":13,"updated":"2014-01-07 17:17:50.000000000","message":"What is the relation of domain_id as trusted attribute from Idp with  \"Federation pt 1\"\nAPI id is avoiding IdP association with domain?\n\nI think these are two separate concepts.","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ff48cb2ae15b593fa197aaf9f77721ed36f1a970","unresolved":false,"context_lines":[{"line_number":10,"context_line":"extension."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Note: Domains are currently not included in the spec until IdP management"},{"line_number":13,"context_line":"(Federation pt 1) has domains added."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"API Resources"},{"line_number":16,"context_line":"-------------"}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2Flro%3D","line":13,"updated":"2014-01-10 18:20:52.000000000","message":"please don\u0027t refer to \"part 1\" etc in the final document. that will all be meaningless once merged","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"b4667ad64f5ed0dbe40d9058a08f52172214cea8","unresolved":false,"context_lines":[{"line_number":10,"context_line":"extension."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Note: Domains are currently not included in the spec until IdP management"},{"line_number":13,"context_line":"(Federation pt 1) has domains added."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"API Resources"},{"line_number":16,"context_line":"-------------"}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FjOk%3D","line":13,"in_reply_to":"AAAAUH%2F%2F2eQ%3D","updated":"2014-01-11 17:09:03.000000000","message":"Correct. Domains and trusted IdPs are separate concepts, but we thought that eventually you wanted to let different administrators for different domains add different trust rules for the same IdP.\n\nI will remove all mention of domains for now. We can add them later if we decide to have different trust rules for different domains.","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"b4667ad64f5ed0dbe40d9058a08f52172214cea8","unresolved":false,"context_lines":[{"line_number":10,"context_line":"extension."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Note: Domains are currently not included in the spec until IdP management"},{"line_number":13,"context_line":"(Federation pt 1) has domains added."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"API Resources"},{"line_number":16,"context_line":"-------------"}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FjN8%3D","line":13,"in_reply_to":"AAAAUH%2F%2Flro%3D","updated":"2014-01-11 17:09:03.000000000","message":"Done","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ff48cb2ae15b593fa197aaf9f77721ed36f1a970","unresolved":false,"context_lines":[{"line_number":18,"context_line":"### Trusted Attribute:`/OS-FEDERATION/identity_providers/{idp-id}/trusted_attributes`"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"A trusted attribute policy defines which attributes an identity provider is"},{"line_number":21,"context_line":"trusted to issue."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Attributes:"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2Flr8%3D","line":21,"updated":"2014-01-10 18:20:52.000000000","message":"what is the intended behavior when a list of trusted attributes conflicts with a mapping? (i.e. the mapping is trying to utilize an assertion, but the assertion is not included in the list of trusted attributes?\n\nwhat is the intended behavior when an IdP does not have any trusted attributes? ... is adding trusted attributes a required pre-requisite to processing a mapping?","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"b4667ad64f5ed0dbe40d9058a08f52172214cea8","unresolved":false,"context_lines":[{"line_number":18,"context_line":"### Trusted Attribute:`/OS-FEDERATION/identity_providers/{idp-id}/trusted_attributes`"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"A trusted attribute policy defines which attributes an identity provider is"},{"line_number":21,"context_line":"trusted to issue."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Attributes:"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FjOU%3D","line":21,"in_reply_to":"AAAAUH%2F%2Flr8%3D","updated":"2014-01-11 17:09:03.000000000","message":"Trusted attributes cannot conflict with mappings. The order of processing is as follows (taking into account assertions from multiple or single IdPs)\n\n1. Check that each IDP returning attributes is trusted. If not throw away all the information from each untrusted IDP. If none of the IDPs are trusted, then reject the user (he has been authenticated by an untrusted IdP).\n\n2. Check that each attribute from each trusted IDP is trusted. Throw away all untrusted attributes.\n\n3. Enter the attribute mapping phase. At this point in time all you have left are trusted attributes from trusted IDPs, so there cannot be any conflict. You can have mapping rules for attributes that are not present, but these are simply ignored.\n\nIf an IDP does not have any trusted attributes then it cannot provide any authz properties to its users. (It can authenticate the users, but that\u0027s all. Their users would only get access to OpenStack resources that are available to any authenticated user.) Note that there is a difference between an untrusted IDP and a trusted IDP that does not provide any trusted attributes. The former\u0027s users must be rejected (authn not trusted) whilst the latter\u0027s users are accepted but might have very limited access to OpenStack resources.","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ff48cb2ae15b593fa197aaf9f77721ed36f1a970","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Attributes:"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"-`attributes` (list)"},{"line_number":26,"context_line":"this is the list of trusted attributes. Each attribute is specified as a type"},{"line_number":27,"context_line":"and an optional set of values."},{"line_number":28,"context_line":"-`identity_provider_id` (string)"}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2Flu4%3D","line":25,"updated":"2014-01-10 18:20:52.000000000","message":"missing whitespace","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"b4667ad64f5ed0dbe40d9058a08f52172214cea8","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Attributes:"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"-`attributes` (list)"},{"line_number":26,"context_line":"this is the list of trusted attributes. Each attribute is specified as a type"},{"line_number":27,"context_line":"and an optional set of values."},{"line_number":28,"context_line":"-`identity_provider_id` (string)"}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FjNM%3D","line":25,"in_reply_to":"AAAAUH%2F%2Flu4%3D","updated":"2014-01-11 17:09:03.000000000","message":"Can you be specific and say where please","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ff48cb2ae15b593fa197aaf9f77721ed36f1a970","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Attributes:"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"-`attributes` (list)"},{"line_number":26,"context_line":"this is the list of trusted attributes. Each attribute is specified as a type"},{"line_number":27,"context_line":"and an optional set of values."},{"line_number":28,"context_line":"-`identity_provider_id` (string)"},{"line_number":29,"context_line":"this is the IdP that is trusted to issue the above list of attributes."}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2Flus%3D","line":26,"updated":"2014-01-10 18:20:52.000000000","message":"sentence case, missing indentation to make this render as a list","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"b4667ad64f5ed0dbe40d9058a08f52172214cea8","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Attributes:"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"-`attributes` (list)"},{"line_number":26,"context_line":"this is the list of trusted attributes. Each attribute is specified as a type"},{"line_number":27,"context_line":"and an optional set of values."},{"line_number":28,"context_line":"-`identity_provider_id` (string)"},{"line_number":29,"context_line":"this is the IdP that is trusted to issue the above list of attributes."}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FjNE%3D","line":26,"in_reply_to":"AAAAUH%2F%2Flus%3D","updated":"2014-01-11 17:09:03.000000000","message":"Can you tell me how to insert the whitespace to make this a list","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ff48cb2ae15b593fa197aaf9f77721ed36f1a970","unresolved":false,"context_lines":[{"line_number":26,"context_line":"this is the list of trusted attributes. Each attribute is specified as a type"},{"line_number":27,"context_line":"and an optional set of values."},{"line_number":28,"context_line":"-`identity_provider_id` (string)"},{"line_number":29,"context_line":"this is the IdP that is trusted to issue the above list of attributes."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Identity Provider API"},{"line_number":32,"context_line":"---------------------"}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2Fluo%3D","line":29,"updated":"2014-01-10 18:20:52.000000000","message":"sentence case","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"b4667ad64f5ed0dbe40d9058a08f52172214cea8","unresolved":false,"context_lines":[{"line_number":26,"context_line":"this is the list of trusted attributes. Each attribute is specified as a type"},{"line_number":27,"context_line":"and an optional set of values."},{"line_number":28,"context_line":"-`identity_provider_id` (string)"},{"line_number":29,"context_line":"this is the IdP that is trusted to issue the above list of attributes."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Identity Provider API"},{"line_number":32,"context_line":"---------------------"}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FjNI%3D","line":29,"in_reply_to":"AAAAUH%2F%2Fluo%3D","updated":"2014-01-11 17:09:03.000000000","message":"Done","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ff48cb2ae15b593fa197aaf9f77721ed36f1a970","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Identity Provider API"},{"line_number":32,"context_line":"---------------------"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### List an Identity Provider\u0027s set of trusted attributes: `GET /OS-IDP/identity_providers/{idp-id}/trusted_attributes/`"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Response:"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FltI%3D","line":34,"updated":"2014-01-10 18:20:52.000000000","message":"remove the trailing slash","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"b4667ad64f5ed0dbe40d9058a08f52172214cea8","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Identity Provider API"},{"line_number":32,"context_line":"---------------------"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### List an Identity Provider\u0027s set of trusted attributes: `GET /OS-IDP/identity_providers/{idp-id}/trusted_attributes/`"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Response:"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FjOE%3D","line":34,"in_reply_to":"AAAAUH%2F%2FltI%3D","updated":"2014-01-11 17:09:03.000000000","message":"Done in next version","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"ea78cf86265d39318b6166a38887da585d23edb6","unresolved":false,"context_lines":[{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Response:"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"    Status: 204 Deleted"},{"line_number":163,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2F2gg%3D","line":162,"updated":"2014-01-07 17:17:50.000000000","message":"What happen to those tokens which are created before attribute policy update/delete?\nThey have to be revoked?","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"b4667ad64f5ed0dbe40d9058a08f52172214cea8","unresolved":false,"context_lines":[{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Response:"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"    Status: 204 Deleted"},{"line_number":163,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":9,"id":"AAAAUH%2F%2FjOI%3D","line":162,"in_reply_to":"AAAAUH%2F%2F2gg%3D","updated":"2014-01-11 17:09:03.000000000","message":"This is a good question, and the answer is, do what is currently the norm. There are many instances when policies are dynamically changed. If the norm is to revoke all existing tokens when a policy is changed, then do this. If the norm is to revoke all tokens covered by a policy that is changed, then do this. If the norm is to say all tokens in existence were valid when issued so they can live until they time out, then do nothing.\n\nI think this is an implementation issue, is it not?","commit_id":"6612cd79c0d328d303b574d48e95824a58df2e86"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bf31ee68877101ecd03a829adc24e33113224e25","unresolved":false,"context_lines":[{"line_number":23,"context_line":"- `attributes` (list): This is the list of trusted attributes. Each attribute"},{"line_number":24,"context_line":"  is specified as a type and an optional set of values."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"- `identity_provider_id` (string): This is the IdP that is trusted to issue the"},{"line_number":27,"context_line":"  above list of attributes."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Identity Provider API"}],"source_content_type":"text/x-markdown","patch_set":10,"id":"AAAAUH%2F%2FgBg%3D","line":26,"updated":"2014-01-13 09:40:51.000000000","message":"I don\u0027t see this attribute in any request below. Probably should be erased, since idps specified in the URLs and this can define links between trusted_attributes and idps.","commit_id":"161f118563c2d0f7caf5d76e2eadf75bac338327"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"ef5cc89afdc173bfccd57e51b0d90f3ece7df2aa","unresolved":false,"context_lines":[{"line_number":23,"context_line":"- `attributes` (list): This is the list of trusted attributes. Each attribute"},{"line_number":24,"context_line":"  is specified as a type and an optional set of values."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"- `identity_provider_id` (string): This is the IdP that is trusted to issue the"},{"line_number":27,"context_line":"  above list of attributes."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Identity Provider API"}],"source_content_type":"text/x-markdown","patch_set":10,"id":"AAAAUH%2F%2FfxA%3D","line":26,"in_reply_to":"AAAAUH%2F%2FgBg%3D","updated":"2014-01-13 10:29:45.000000000","message":"Correct. Well spotted","commit_id":"161f118563c2d0f7caf5d76e2eadf75bac338327"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0360e6df8ae29d231b44ea0a1c7ccc2ba271f818","unresolved":false,"context_lines":[{"line_number":26,"context_line":"Identity Provider API"},{"line_number":27,"context_line":"---------------------"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"### List an Identity Provider\u0027s set of trusted attributes: `GET /OS-IDP/identity_providers/{idp-id}/trusted_attributes`"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Response:"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":11,"id":"7adec928_38917d47","line":29,"updated":"2014-05-17 05:09:39.000000000","message":"OS-IDP doesn\u0027t exist, it\u0027s OS-FEDERATION, same goes for the other calls.","commit_id":"796a6c15d443303177f329adbb80617dfca97bc7"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0360e6df8ae29d231b44ea0a1c7ccc2ba271f818","unresolved":false,"context_lines":[{"line_number":49,"context_line":"                }"},{"line_number":50,"context_line":"            ]"},{"line_number":51,"context_line":"            \"links\": {"},{"line_number":52,"context_line":"                \"self\": \"http:/identity:35357/v3/OS-IDP/identity_providers/7e23a6/trusted_attributes\""},{"line_number":53,"context_line":"            }"},{"line_number":54,"context_line":"        }"},{"line_number":55,"context_line":"    }"}],"source_content_type":"text/x-markdown","patch_set":11,"id":"7adec928_b8a4ada6","line":52,"updated":"2014-05-17 05:09:39.000000000","message":"missing a / here after http:/\n\nsame goes for the other calls\n\nAlso, OS-IDP doesn\u0027t exist, it\u0027s all under OS-FEDERATION","commit_id":"796a6c15d443303177f329adbb80617dfca97bc7"}],"v3/src/markdown/identity-api-v3-os-federation-ext.md":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f7a5b5fb01bd3493446c23d5901dbcbf87288e05","unresolved":false,"context_lines":[{"line_number":140,"context_line":""},{"line_number":141,"context_line":"### Trusted Attribute:`/OS-FEDERATION/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"      A trusted attributes policy defines which attributes an identity provider is"},{"line_number":144,"context_line":"      trusted to issue."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"      Attributes:"}],"source_content_type":"text/x-markdown","patch_set":16,"id":"1ae5cdf2_1c0cd641","line":143,"updated":"2014-06-11 02:33:04.000000000","message":"nit: this line shouldn\u0027t be indented","commit_id":"c32084efe890f586b2529219400765c0ba74b250"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f7a5b5fb01bd3493446c23d5901dbcbf87288e05","unresolved":false,"context_lines":[{"line_number":143,"context_line":"      A trusted attributes policy defines which attributes an identity provider is"},{"line_number":144,"context_line":"      trusted to issue."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"      Attributes:"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"    - `attributes` (list)"},{"line_number":149,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":16,"id":"1ae5cdf2_3c07d21e","line":146,"updated":"2014-06-11 02:33:04.000000000","message":"nit: this line shouldn\u0027t be indented","commit_id":"c32084efe890f586b2529219400765c0ba74b250"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"529d9315a3ebc3974446b890fd059c6e77ff0362","unresolved":false,"context_lines":[{"line_number":141,"context_line":"### Trusted Attribute:`/OS-FEDERATION/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"A trusted attributes policy defines which attributes an identity provider is"},{"line_number":144,"context_line":"trusted to issue."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Attributes:"},{"line_number":147,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":17,"id":"1ae5cdf2_c300bc04","line":144,"updated":"2014-06-11 13:58:45.000000000","message":"Maybe it\u0027s worth adding some information, that after trusted_attributes are added, the IdP will automatically filter assertions. Otherwise people may wonder \"okay, but what I do with it?\". It\u0027s not used explicitely anywhere (like protocols are in the authn url, and mapping ids are withing protocols).","commit_id":"275cbe36413f8c1af9c57e3ae9c58eddcd101f15"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c4597834fe6bb22f109e6b8149ea9bb303cf090f","unresolved":false,"context_lines":[{"line_number":138,"context_line":"      expression](http://docs.python.org/2/library/re.html) search against the"},{"line_number":139,"context_line":"      remote attribute `type`."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"### Trusted Attribute:`/OS-FEDERATION/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"A trusted attributes policy defines which attributes an identity provider is"},{"line_number":144,"context_line":"trusted to issue. When a policy is created for a IDP, the attributes received"}],"source_content_type":"text/x-markdown","patch_set":18,"id":"1ae5cdf2_c671aa0d","line":141,"updated":"2014-06-11 14:19:55.000000000","message":"I think you can add a space between \u003e\u003e:\u003c\u003c and \u003e\u003e`\u003c\u003c\n\nAlso, in this section I would either write \u0027Identity Provider\u0027 or IdP instead of IDP.","commit_id":"18d147d7bc4c438d5f1ac100bd9be55921dbdd50"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c4597834fe6bb22f109e6b8149ea9bb303cf090f","unresolved":false,"context_lines":[{"line_number":610,"context_line":"        ],"},{"line_number":611,"context_line":"        \"links\": {"},{"line_number":612,"context_line":"            \"identity_provider\": \"http://identity:35357/v3/OS-FEDERATION/identity_providers/ACME\","},{"line_number":613,"context_line":"            \"self\": \"http://identity:35357/v3/OS-FEDERATED/identity_providers/7e23a6/trusted_attributes\""},{"line_number":614,"context_line":"        }"},{"line_number":615,"context_line":"    }"},{"line_number":616,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":18,"id":"1ae5cdf2_66cb7653","line":613,"updated":"2014-06-11 14:19:55.000000000","message":"let\u0027s be consistent : s/7e23a6/ACME","commit_id":"18d147d7bc4c438d5f1ac100bd9be55921dbdd50"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c4597834fe6bb22f109e6b8149ea9bb303cf090f","unresolved":false,"context_lines":[{"line_number":655,"context_line":"        ],"},{"line_number":656,"context_line":"        \"links\": {"},{"line_number":657,"context_line":"            \"identity_provider\": \"http://identity:35357/v3/OS-FEDERATION/identity_providers/ACME\","},{"line_number":658,"context_line":"            \"self\": \"http://identity:35357/v3/OS-FEDERATED/identity_providers/7e23a6/trusted_attributes\""},{"line_number":659,"context_line":"        }"},{"line_number":660,"context_line":"    }"},{"line_number":661,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":18,"id":"1ae5cdf2_86a16296","line":658,"updated":"2014-06-11 14:19:55.000000000","message":"let\u0027s be consistent : s/7e23a6/ACME","commit_id":"18d147d7bc4c438d5f1ac100bd9be55921dbdd50"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c4597834fe6bb22f109e6b8149ea9bb303cf090f","unresolved":false,"context_lines":[{"line_number":700,"context_line":"        ],"},{"line_number":701,"context_line":"        \"links\": {"},{"line_number":702,"context_line":"            \"identity_provider\": \"http://identity:35357/v3/OS-FEDERATION/identity_providers/ACME\","},{"line_number":703,"context_line":"            \"self\": \"http://identity:35357/v3/OS-FEDERATED/identity_providers/7e23a6/trusted_attributes\""},{"line_number":704,"context_line":"        }"},{"line_number":705,"context_line":"    }"},{"line_number":706,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":18,"id":"1ae5cdf2_26aece81","line":703,"updated":"2014-06-11 14:19:55.000000000","message":"let\u0027s be consistent : s/7e23a6/ACME","commit_id":"18d147d7bc4c438d5f1ac100bd9be55921dbdd50"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Definitions"},{"line_number":9,"context_line":"-----------"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"- *Trusted Identity Provider*: An identity provider set up within the Identity"},{"line_number":12,"context_line":"   API that is trusted to provide authenticated user information."},{"line_number":13,"context_line":"- *Service Provider*: A system entity that provides services to principals or"},{"line_number":14,"context_line":"  other system entities, in this case, the OpenStack Identity API is"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_fdd51f43","line":11,"updated":"2014-06-12 20:08:09.000000000","message":"An Identity provider is a third-party service that the Identity API trusts to authenticate identities.","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":11,"context_line":"- *Trusted Identity Provider*: An identity provider set up within the Identity"},{"line_number":12,"context_line":"   API that is trusted to provide authenticated user information."},{"line_number":13,"context_line":"- *Service Provider*: A system entity that provides services to principals or"},{"line_number":14,"context_line":"  other system entities, in this case, the OpenStack Identity API is"},{"line_number":15,"context_line":"  the Service Provider."},{"line_number":16,"context_line":"- *Attribute Mapping*: The user information passed by a federation protocol for"},{"line_number":17,"context_line":"  an already authenticated identity are called `attributes`. Those `attributes`"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_9dbc1b08","line":14,"updated":"2014-06-12 20:08:09.000000000","message":"entities. The OpenStack Identity API is ...","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":12,"context_line":"   API that is trusted to provide authenticated user information."},{"line_number":13,"context_line":"- *Service Provider*: A system entity that provides services to principals or"},{"line_number":14,"context_line":"  other system entities, in this case, the OpenStack Identity API is"},{"line_number":15,"context_line":"  the Service Provider."},{"line_number":16,"context_line":"- *Attribute Mapping*: The user information passed by a federation protocol for"},{"line_number":17,"context_line":"  an already authenticated identity are called `attributes`. Those `attributes`"},{"line_number":18,"context_line":"  may not align 1:1 with the Identity API concepts. To help overcome such"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_bdb71720","line":15,"updated":"2014-06-12 20:08:09.000000000","message":"the service provider","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":15,"context_line":"  the Service Provider."},{"line_number":16,"context_line":"- *Attribute Mapping*: The user information passed by a federation protocol for"},{"line_number":17,"context_line":"  an already authenticated identity are called `attributes`. Those `attributes`"},{"line_number":18,"context_line":"  may not align 1:1 with the Identity API concepts. To help overcome such"},{"line_number":19,"context_line":"  mismatches, a mapping can be done either on the sending side (third party"},{"line_number":20,"context_line":"  identity provider), on the consuming side (Identity API service), or both."},{"line_number":21,"context_line":"- *Trusted Attribute*: An attribute trusted to be issued by a Trusted Identity"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_1d400b06","line":18,"updated":"2014-06-12 20:08:09.000000000","message":"might","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":17,"context_line":"  an already authenticated identity are called `attributes`. Those `attributes`"},{"line_number":18,"context_line":"  may not align 1:1 with the Identity API concepts. To help overcome such"},{"line_number":19,"context_line":"  mismatches, a mapping can be done either on the sending side (third party"},{"line_number":20,"context_line":"  identity provider), on the consuming side (Identity API service), or both."},{"line_number":21,"context_line":"- *Trusted Attribute*: An attribute trusted to be issued by a Trusted Identity"},{"line_number":22,"context_line":"  Provider."},{"line_number":23,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_7d482f2d","line":20,"updated":"2014-06-12 20:08:09.000000000","message":"Identity","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":18,"context_line":"  may not align 1:1 with the Identity API concepts. To help overcome such"},{"line_number":19,"context_line":"  mismatches, a mapping can be done either on the sending side (third party"},{"line_number":20,"context_line":"  identity provider), on the consuming side (Identity API service), or both."},{"line_number":21,"context_line":"- *Trusted Attribute*: An attribute trusted to be issued by a Trusted Identity"},{"line_number":22,"context_line":"  Provider."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"API Resources"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_bd2d5791","line":21,"updated":"2014-06-12 20:08:09.000000000","message":"An attribute that is trusted to be issued by a trusted Identity provider.","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"### Identity Providers: `/OS-FEDERATION/identity_providers`"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"An Identity Provider is a third party service that is trusted by the Identity"},{"line_number":30,"context_line":"API to authenticate identities."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Optional attributes:"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_7d6f4f92","line":29,"updated":"2014-06-12 20:08:09.000000000","message":"provider is a third-party service that the Identity API trusts to authenticate identities.","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":140,"context_line":""},{"line_number":141,"context_line":"### Trusted Attribute: `/OS-FEDERATION/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"A trusted attributes policy defines which attributes an Identity Provider is"},{"line_number":144,"context_line":"trusted to issue. When a policy is created for a Identity Provider, the"},{"line_number":145,"context_line":"attributes received in assertions from this Identity Provider will be"},{"line_number":146,"context_line":"automatically filtered. In order to maintain backwards compatibility, if no"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_fd527f11","line":143,"updated":"2014-06-12 20:08:09.000000000","message":"provider","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":141,"context_line":"### Trusted Attribute: `/OS-FEDERATION/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"A trusted attributes policy defines which attributes an Identity Provider is"},{"line_number":144,"context_line":"trusted to issue. When a policy is created for a Identity Provider, the"},{"line_number":145,"context_line":"attributes received in assertions from this Identity Provider will be"},{"line_number":146,"context_line":"automatically filtered. In order to maintain backwards compatibility, if no"},{"line_number":147,"context_line":"policy is set then all attributes should be accepted from this Identity"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_1d564b06","line":144,"updated":"2014-06-12 20:08:09.000000000","message":"provider","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":142,"context_line":""},{"line_number":143,"context_line":"A trusted attributes policy defines which attributes an Identity Provider is"},{"line_number":144,"context_line":"trusted to issue. When a policy is created for a Identity Provider, the"},{"line_number":145,"context_line":"attributes received in assertions from this Identity Provider will be"},{"line_number":146,"context_line":"automatically filtered. In order to maintain backwards compatibility, if no"},{"line_number":147,"context_line":"policy is set then all attributes should be accepted from this Identity"},{"line_number":148,"context_line":"Provider. If an empty policy is set then no attributes should be accepted."}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_3d594735","line":145,"updated":"2014-06-12 20:08:09.000000000","message":"this provider are automatically filtered","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":143,"context_line":"A trusted attributes policy defines which attributes an Identity Provider is"},{"line_number":144,"context_line":"trusted to issue. When a policy is created for a Identity Provider, the"},{"line_number":145,"context_line":"attributes received in assertions from this Identity Provider will be"},{"line_number":146,"context_line":"automatically filtered. In order to maintain backwards compatibility, if no"},{"line_number":147,"context_line":"policy is set then all attributes should be accepted from this Identity"},{"line_number":148,"context_line":"Provider. If an empty policy is set then no attributes should be accepted."},{"line_number":149,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_dd76a3a3","line":146,"updated":"2014-06-12 20:08:09.000000000","message":"To maintain backwards xxx, all attributes are accepted from this provider if no policy is defined.","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":145,"context_line":"attributes received in assertions from this Identity Provider will be"},{"line_number":146,"context_line":"automatically filtered. In order to maintain backwards compatibility, if no"},{"line_number":147,"context_line":"policy is set then all attributes should be accepted from this Identity"},{"line_number":148,"context_line":"Provider. If an empty policy is set then no attributes should be accepted."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Attributes:"},{"line_number":151,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_5d6a93b3","line":148,"updated":"2014-06-12 20:08:09.000000000","message":"If the policy is empty, no attributes are accepted.","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":152,"context_line":"    - `attributes` (list)"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"      A list of trusted attributes. Each attribute is specified as a"},{"line_number":155,"context_line":"      type and an optional set of values. An list of zero values denotes that"},{"line_number":156,"context_line":"      any value should be accepted."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Identity Provider API"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_fda0bff5","line":155,"updated":"2014-06-12 20:08:09.000000000","message":"A list","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":587,"context_line":"Trusted Attribute API"},{"line_number":588,"context_line":"---------------------"},{"line_number":589,"context_line":""},{"line_number":590,"context_line":"### Get an Identity Provider\u0027s set of trusted attributes: `GET /OS-FEDERATION/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":591,"context_line":""},{"line_number":592,"context_line":"Response:"},{"line_number":593,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_bdb2b746","line":590,"updated":"2014-06-12 20:08:09.000000000","message":"Get a set of trusted attributes from an Identity provider:","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":614,"context_line":"        }"},{"line_number":615,"context_line":"    }"},{"line_number":616,"context_line":""},{"line_number":617,"context_line":"### Create an Identity Provider\u0027s Trusted Attributes Policy: `PUT /OS-FEDERATION/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":618,"context_line":""},{"line_number":619,"context_line":"Request:"},{"line_number":620,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_5db1b345","line":617,"updated":"2014-06-12 20:08:09.000000000","message":"Create an Identity provider trusted attributes policy:","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":659,"context_line":"        }"},{"line_number":660,"context_line":"    }"},{"line_number":661,"context_line":""},{"line_number":662,"context_line":"### Update an Identity Provider\u0027s Trusted Attributes Policy: `PATCH /OS-FEDERATION/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":663,"context_line":""},{"line_number":664,"context_line":"Request:"},{"line_number":665,"context_line":"    {"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_9d8edb77","line":662,"updated":"2014-06-12 20:08:09.000000000","message":"Update a trusted attributes policy for an Identity provider:","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":704,"context_line":"        }"},{"line_number":705,"context_line":"    }"},{"line_number":706,"context_line":""},{"line_number":707,"context_line":"### Delete an Identity Provider\u0027s Trusted Attributes Policy: `DELETE /OS-FEDERATION/identity_providers/{idp_id}/trusted_attributes`"},{"line_number":708,"context_line":""},{"line_number":709,"context_line":"Response:"},{"line_number":710,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_3df5c7ec","line":707,"updated":"2014-06-12 20:08:09.000000000","message":"Delete a trusted attributes policy for an Identity provider:","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"},{"author":{"_account_id":2448,"name":"Diane Fleming","email":"dfleming@austin.rr.com","username":"diane-fleming"},"change_message_id":"fc5e0d5727a949c7004bffe8e42440f084d0ccad","unresolved":false,"context_lines":[{"line_number":713,"context_line":"Listing projects and domains"},{"line_number":714,"context_line":"----------------------------"},{"line_number":715,"context_line":""},{"line_number":716,"context_line":"### List projects a federated user can access: `GET /OS-FEDERATION/projects`"},{"line_number":717,"context_line":""},{"line_number":718,"context_line":"Returns a collection of projects to which the federated user has authorization"},{"line_number":719,"context_line":"to access. To access this resource, an unscoped token is used, the user can"}],"source_content_type":"text/x-markdown","patch_set":20,"id":"1ae5cdf2_9de5fb39","line":716,"updated":"2014-06-12 20:08:09.000000000","message":"List projects that a xxx","commit_id":"09546fabb1237c0979fd59a3cae66fb96e0cbcb8"}]}