<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi,<br>
<br>
I strongly support this request.<br>
<br>
<div class="moz-cite-prefix">On 23.03.2015 22:42, Steve Martinelli
wrote:<br>
</div>
<blockquote
cite="mid:OFB127F74E.3B4975FE-ON85257E11.00673ED7-85257E11.00773DBD@ca.ibm.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<font face="sans-serif" size="2">I'd like to request an exemption
for the
following to go into the Kilo release. </font>
<br>
<br>
<font face="sans-serif" size="2">This work is crucial for:</font>
<br>
<font face="sans-serif" size="2">- Keystone to Keystone
communication.
An ECP wrapped SAML assertion will make it much easier for
consumers and
clients to use the K2K feature in Keystone. Currently, a client
must take
the generated SAML response and must prepare the ECP envelope
themselves.
This should be handled by Keystone, and not the clients. The
client should
be able to ask for the ECP wrapped assertion and hand it off to
another
Keystone.</font>
<br>
<br>
<font face="sans-serif" size="2">Why this needs an FFE?</font>
<br>
<font face="sans-serif" size="2">- To properly created an ECP
wrapped
a SAML assertion, a relay state property must be known, (as it's
used to
compute a value in an ECP specific field). This depends on how
the service
provider has their mod_shib configured. We will need to add a
new property
to the keystone resource 'service provider' - the spec change is
here:
</font><a moz-do-not-send="true"
href="https://review.openstack.org/#/c/166086/"><font
face="sans-serif" size="2" color="blue">https://review.openstack.org/#/c/166086/</font></a>
<br>
<br>
<font face="sans-serif" size="2">Status of the work:</font>
<br>
<font face="sans-serif" size="2">- The patches necessary for this
feature
already and split into two patches. 1) To add a new
relay_state_prefix
property to the service provider resource: </font><a
moz-do-not-send="true"
href="https://review.openstack.org/#/c/166078/"><font
face="sans-serif" size="2" color="blue">https://review.openstack.org/#/c/166078/</font></a><font
face="sans-serif" size="2">
and 2) to actually use this new property in order to generate
the ECP assertion:
</font><a moz-do-not-send="true"
href="https://review.openstack.org/#/c/162866/"><font
face="sans-serif" size="2" color="blue">https://review.openstack.org/#/c/162866/</font></a>
<br>
<br>
<font face="sans-serif" size="2">Thanks,<br>
<br>
Steve Martinelli<br>
OpenStack Keystone Core</font>
<br>
</blockquote>
<br>
<br>
Marek Denis<br>
OpenStack Keystone Core<br>
</body>
</html>