<div dir="ltr"><div>David, </div><div><br></div><div>FYI, I've submitted a patch to enable registering Identity Providers in horizon:</div><div><br></div><div><a href="https://review.openstack.org/#/c/244991/">https://review.openstack.org/#/c/244991/</a><br></div><div><br></div><div>The next logical step for this is to look at the IdP mapping.</div><div><br></div><div>I can follow-up on the work by Anton to add that support for horizon. </div><div><br></div><div>Can you send me the code and documents you may have related to this?</div><div><br></div><div>Thanks,</div><div>Lin</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Oct 7, 2015 at 11:12 AM, David Chadwick <span dir="ltr"><<a href="mailto:d.w.chadwick@kent.ac.uk" target="_blank">d.w.chadwick@kent.ac.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
<br>
On 07/10/2015 18:29, Adam Young wrote:<br>
> On 10/07/2015 11:51 AM, Adam Young wrote:<br>
>> Send me what you have, and I will post it as a Work in progress review<br>
>> against Horizon. That way at least it will be available for others to<br>
>> look at and potentially adopt.<br>
><br>
> Review has been posted here<br>
> <a href="https://review.openstack.org/232114" rel="noreferrer" target="_blank">https://review.openstack.org/232114</a><br>
><br>
<br>
</span>thanks Adam<br>
<span class=""><br>
><br>
> I made a best guess as far as where it it should be placed in the source<br>
> tree. I have not tested the code.<br>
><br>
> David and I have both signed the CLA. I am fairly certon Anton did not.<br>
> It would be easiest for OpenStack to accept this code if he did, as<br>
> there would be no question about copyright or licensing.<br>
<br>
</span>Legally speaking it is not necessary, since any code produced by<br>
students as part of their degree course does not belong to them.<br>
However, it would be courteous of us to ask him, so I have done this.<br>
<span class=""><br>
><br>
> David also provided me with a PDF version of Anton's dissertation. I do<br>
> not know what the status of that document, but it would be a great<br>
> resource to anyone that wants to take this code and get it integrated<br>
> into Horizon.<br>
<br>
</span>This can be made publicly available after the exam board next month.<br>
Until then I will give out personal copies for private study.<br>
<br>
regards<br>
<span class="HOEnZb"><font color="#888888"><br>
David<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
><br>
> This does not look like a radical stretch. It would be a decent<br>
> opportunity for anyone looking to get involved with OpenStack to step<br>
> into something immediately.<br>
><br>
><br>
><br>
><br>
>><br>
>><br>
>><br>
>> On 10/07/2015 11:37 AM, David Chadwick wrote:<br>
>>> Hi Douglas<br>
>>><br>
>>> we are happy for you (or someone else) to submit the code in 3 names:<br>
>>> theirs, mine and Anton's. Then this third person can do all the work<br>
>>> necessary to get it approved. In this way it is legitimate, since the<br>
>>> third person will have contributed to the overall effort.<br>
>>><br>
>>> I dont have any spare time yet for another month or so. After that I<br>
>>> could submit it, but having never done it before for Horizon, there will<br>
>>> be a big learning curve. And I might not have time to learn it<br>
>>><br>
>>> regards<br>
>>><br>
>>> David<br>
>>><br>
>>> On 07/10/2015 16:05, Douglas Fish wrote:<br>
>>>> Hi David,<br>
>>>> This sounds like a great set of code, I'm sure we are going to<br>
>>>> realize<br>
>>>> we want it sooner or later! Unfortunately I can't consume code in this<br>
>>>> way (I can't propose code written by somebody else) and I can't spend<br>
>>>> significant time on it right now.<br>
>>>> Would you or Anton be willing to propose whatever code and<br>
>>>> documentation<br>
>>>> you have to Horizon? It doesn't have to be complete; it doesn't need to<br>
>>>> have grammar cleaned up or anything like that. You could mark it as a<br>
>>>> "Work in progress", and make it clear in the commit message that you<br>
>>>> aren't planning further work on this, so the patch is available for<br>
>>>> adoption. That way somebody else may be able to pick this up and<br>
>>>> work on<br>
>>>> it in the future, but Anton could get credit for the work he has done.<br>
>>>><br>
>>>> Doug Fish<br>
>>>><br>
>>>> ----- Original message -----<br>
>>>> From: David Chadwick <<a href="mailto:d.w.chadwick@kent.ac.uk">d.w.chadwick@kent.ac.uk</a>><br>
>>>> To: OpenStack Development Mailing List<br>
>>>> <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
>>>> Cc:<br>
>>>> Subject: [openstack-dev] [horizon][keystone]<br>
>>>> Date: Tue, Oct 6, 2015 2:13 PM<br>
>>>> Dear All<br>
>>>><br>
>>>> One of my students, Anton Brida, has developed an Attribute<br>
>>>> Mapping GUI<br>
>>>> for Horizon as part of his MSc project. Attribute mappings are an<br>
>>>> essential, though complex, part of federated Keystone.<br>
>>>> Currently they<br>
>>>> can only be created as JSON objects in the config file. The<br>
>>>> Horizon code<br>
>>>> allows them to be dynamically created via an easy to use GUI.<br>
>>>><br>
>>>> Since Anton has now left the university for full time<br>
>>>> employment, he is<br>
>>>> not able to go through the process of submitting his code to<br>
>>>> the next<br>
>>>> release of Horizon. His design however was submitted to<br>
>>>> InVision and<br>
>>>> commented on by various people at the time of the development.<br>
>>>><br>
>>>> I am now looking for someone who would like to take a copy of<br>
>>>> this code<br>
>>>> and go through the process of submitting this to the next<br>
>>>> release of<br>
>>>> Horizon. I have a copy of Anton's MSc dissertation as well which<br>
>>>> explains the work that he has done.<br>
>>>><br>
>>>> All the attribute mapping features are supported in Anton's code<br>
>>>> (groups, users, direct mapping, multiple attribute values etc.)<br>
>>>> However the whitelist/blacklist feature is not, since this was<br>
>>>> not fully<br>
>>>> incorporated into Keystone when Anton was doing his<br>
>>>> implementation. (I<br>
>>>> am still not sure if it has been.)<br>
>>>><br>
>>>> The code has a couple of known bugs:<br>
>>>><br>
>>>> 1. when a user tries to enter an email address into an<br>
>>>> attribute value<br>
>>>> (i.e. <a href="mailto:username@example.com">username@example.com</a>) and saves the mapping rule into the<br>
>>>> database, after reloading the new list of mappings rules the<br>
>>>> interface<br>
>>>> does not work as intended. The particular reason why this is<br>
>>>> happening<br>
>>>> is yet unknown. The only way to avoid such disruption is to<br>
>>>> delete the<br>
>>>> faulty mapping rule from the table. After removing the faulty<br>
>>>> rule the<br>
>>>> interface works as intended.<br>
>>>><br>
>>>> 2. Some of the descriptive text needs improvement due to incorrect<br>
>>>> grammar.<br>
>>>><br>
>>>> There is also the following suggested enhancement which can be<br>
>>>> added<br>
>>>> later:<br>
>>>><br>
>>>> 1. After the mapping rules are created with the GUI, when they are<br>
>>>> displayed, they are still in JSON format. It would be nice to<br>
>>>> be able to<br>
>>>> display the rules in a table or similar.<br>
>>>><br>
>>>> If you would like to take on the job of submitting this code to<br>
>>>> Horizon<br>
>>>> for review and incorporation, please contact me<br>
>>>><br>
>>>> regards<br>
>>>><br>
>>>> David<br>
>>>><br>
>>>> __________________________________________________________________________<br>
>>>><br>
>>>> OpenStack Development Mailing List (not for usage questions)<br>
>>>> Unsubscribe:<br>
>>>> <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>> __________________________________________________________________________<br>
>>>><br>
>>>> OpenStack Development Mailing List (not for usage questions)<br>
>>>> Unsubscribe:<br>
>>>> <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>>>><br>
>>> __________________________________________________________________________<br>
>>><br>
>>> OpenStack Development Mailing List (not for usage questions)<br>
>>> Unsubscribe:<br>
>>> <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
>><br>
>><br>
>> __________________________________________________________________________<br>
>><br>
>> OpenStack Development Mailing List (not for usage questions)<br>
>> Unsubscribe:<br>
>> <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
><br>
><br>
> __________________________________________________________________________<br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
><br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div></div></blockquote></div><br></div>