<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">++<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Same here.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"> Marek Denis [mailto:marek.denis@cern.ch]
<br>
<b>Sent:</b> Tuesday, March 24, 2015 1:51 AM<br>
<b>To:</b> openstack-dev@lists.openstack.org<br>
<b>Subject:</b> Re: [openstack-dev] [Keystone][FFE] ECP wrapped assertions<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi,<br>
<br>
I strongly support this request.<o:p></o:p></p>
<div>
<p class="MsoNormal">On 23.03.2015 22:42, Steve Martinelli wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">I'd like to request an exemption for the following to go into the Kilo release.
</span><br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">This work is crucial for:</span>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">- Keystone to Keystone communication. An ECP wrapped SAML assertion will make it much easier for consumers and clients to use the K2K feature in Keystone. Currently, a client must take the generated
SAML response and must prepare the ECP envelope themselves. This should be handled by Keystone, and not the clients. The client should be able to ask for the ECP wrapped assertion and hand it off to another Keystone.</span>
<br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">Why this needs an FFE?</span>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">- To properly created an ECP wrapped a SAML assertion, a relay state property must be known, (as it's used to compute a value in an ECP specific field). This depends on how the service provider has
their mod_shib configured. We will need to add a new property to the keystone resource 'service provider' - the spec change is here:
</span><a href="https://review.openstack.org/#/c/166086/"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">https://review.openstack.org/#/c/166086/</span></a>
<br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">Status of the work:</span>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">- The patches necessary for this feature already and split into two patches. 1) To add a new relay_state_prefix property to the service provider resource:
</span><a href="https://review.openstack.org/#/c/166078/"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">https://review.openstack.org/#/c/166078/</span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif"> and 2) to actually use
this new property in order to generate the ECP assertion: </span><a href="https://review.openstack.org/#/c/162866/"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">https://review.openstack.org/#/c/162866/</span></a>
<br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">Thanks,<br>
<br>
Steve Martinelli<br>
OpenStack Keystone Core</span> <o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
<br>
Marek Denis<br>
OpenStack Keystone Core<o:p></o:p></p>
</div>
</body>
</html>