<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>Short answer: it's going in that direction, but doesn't implement it all yet.</div>
<div><br>
</div>
<div>Longer answer: </div>
<div>Federation (and delegation) are going to be quick follows once we get the first phase of work done. The first phase was to build Keystone and support the current SWIFT and NOVA use cases. Once we have all services able to work with one auth/identity systems,
we will iterate and add functionality.</div>
<div><br>
</div>
<div>We're trying to keep Keystone as modular and pluggable as possible to support any back-end (LDAP, Active Directory, etc…) and many protocols (such as OAUTH2.0, SAML, etc…). That should allow us to build in the necessary delegation and federation with Keystone.</div>
<div><br>
</div>
<div>We've also given Keystone the task of maintaining tenants (which are an implementation of Resource Group). This does not preclude us from creating additional, arbitrarily created resource groups, but gives us a basic implementation to start with.</div>
<div><br>
</div>
<div>Keystone will also contain a set of extensions for global user groups and tenant groups (groups of users that are contained in and scoped to a single tenant). We're keeping those as extensions for now until we've had the chance to make sure the model will
work with as many back-end stores as possible.</div>
<div><br>
</div>
<div>You're welcome,</div>
<div>Z</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>andi abes <<a href="mailto:andi.abes@gmail.com">andi.abes@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Sun, 12 Jun 2011 10:58:54 -0400<br>
<span style="font-weight:bold">To: </span>Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com">ziad.sawalha@rackspace.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>" <<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack] OpenStack Identity: Keystone API Proposal<br>
</div>
<div><br>
</div>
Ziad, thanks the quick edits.
<div><br>
</div>
<div>One more quick question, mostly because I haven't followed the full keystone discussions. How does this API relate (if at all) to: <a href="http://wiki.openstack.org/FederatedAuthZwithZones">http://wiki.openstack.org/FederatedAuthZwithZones</a></div>
<div><br>
</div>
<div>Specifically, around resource groups and federated authentication.</div>
<div><br>
</div>
<div>tia,</div>
<div>a.<br>
<br>
<div class="gmail_quote">On Sat, Jun 11, 2011 at 11:40 AM, Ziad Sawalha <span dir="ltr">
<<a href="mailto:ziad.sawalha@rackspace.com">ziad.sawalha@rackspace.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div style="word-wrap:break-word;color:rgb(0, 0, 0);font-size:14px;font-family:Calibri, sans-serif">
<div>I've updated the dev guide with your suggestions:</div>
<div>- Section 4.4 explains the GET /tenants call needs to be authenticated and the examples now show passing in the authentication header.</div>
<div>- Section 5.2.1 is new and talks about authenticating for the Admin API and puts in a reference for bootstrapping the system (creating a first administrator). Here, I've left it as a reference to the admin guide which is yet to be developed (jaypipes volunteered
to help us create that in RST), but I also refer to the readme which today has instructions for setting up your Keystone instance.</div>
<div><br>
</div>
<div>Let me know if that gets you going, Andi.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Ziad</div>
<div><br>
</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;border-bottom:medium none;border-left:medium none;padding-bottom:0in;padding-left:0in;padding-right:0in;border-top:#b5c4df 1pt solid;border-right:medium none;padding-top:3pt">
<span style="font-weight:bold">From: </span>Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com" target="_blank">ziad.sawalha@rackspace.com</a>><br>
<span style="font-weight:bold">Date: </span>Sat, 11 Jun 2011 14:44:12 +0000<br>
<span style="font-weight:bold">To: </span>Andiabes <<a href="mailto:andi.abes@gmail.com" target="_blank">andi.abes@gmail.com</a>>
<div>
<div></div>
<div class="h5"><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a>" <<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack] OpenStack Identity: Keystone API Proposal<br>
</div>
</div>
</div>
<div>
<div></div>
<div class="h5">
<div><br>
</div>
<div>
<div style="word-wrap:break-word;color:rgb(0, 0, 0);font-size:14px;font-family:Calibri, sans-serif">
<div>Your guess is correct. The only calls you should be able to make without having a token are the calls to discover the service (getting version info, WADL contract, dev guide, help, etc…) and to get a token. After that, all other calls require passing in
a token.</div>
<div><br>
</div>
<div>On the Admin APIs, the token passed in must have the necessary administrative privileges.</div>
<div><br>
</div>
<div>To bootstrap Keystone with a blank identity store, you can execute bin/keystone-manage to create your initial administrative identity(ies).</div>
<div><br>
</div>
<div>If you use the sample data creation script provided, it will create an admin user (and create a token for that user) which you can use.</div>
<div><br>
</div>
<div>We'll clarify that in the dev guide.</div>
<div><br>
</div>
<div>Thanks Andi</div>
<div><br>
</div>
<div>Ziad</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;border-bottom:medium none;border-left:medium none;padding-bottom:0in;padding-left:0in;padding-right:0in;border-top:#b5c4df 1pt solid;border-right:medium none;padding-top:3pt">
<span style="font-weight:bold">From: </span>Andiabes <<a href="mailto:andi.abes@gmail.com" target="_blank">andi.abes@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Fri, 10 Jun 2011 21:08:18 -0400<br>
<span style="font-weight:bold">To: </span>Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com" target="_blank">ziad.sawalha@rackspace.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a>" <<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack] OpenStack Identity: Keystone API Proposal<br>
</div>
<div><br>
</div>
<div>
<div bgcolor="#FFFFFF">
<div>
<div>It might be useful to include in the API guide some information about authentication to keystone itself. I.e when requesting a list of users,tenants etc the requestor should somehow authenticate itself</div>
<div>I'm guessing that the flow involve acquiring a token that authenticates the user to keystone as a user who has privileges to manage the relevant entities.?</div>
<div><br>
</div>
<div>Sent from my iPad</div>
<div><br>
On Jun 10, 2011, at 7:24 PM, Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com" target="_blank">ziad.sawalha@rackspace.com</a>> wrote:<br>
<br>
</div>
<div></div>
<blockquote type="cite">
<div>
<div>Time flies! It's June 10th already. In my last email to this community I had proposed today as the day to lock down the Keystone API so we can finalize implementation by Diablo-D2 (June 30th).</div>
<div><br>
</div>
<div>We've been working on this feverishly over the past couple of weeks and have just pushed out a proposed API here:<a href="https://github.com/rackspace/keystone/raw/master/keystone/content/identitydevguide.pdf" target="_blank"></a><a href="https://github.com/rackspace/keystone/raw/master/keystone/content/identitydevguide.pdf" target="_blank">https://github.com/rackspace/keystone/raw/master/keystone/content/identitydevguide.pdf</a></div>
<div><br>
</div>
<div>For any and all interested, the original source and code is on Github (<a href="https://github.com/rackspace/keystone/raw/master/keystone/content/identitydevguide.pdf" target="_blank"></a><a href="https://github.com/rackspace/keystone" target="_blank">https://github.com/rackspace/keystone</a>),
along with the current implementation of Keystone, examples, sample data, tests, instructions, and all the goodies we could muster to put together. The project also lives on Launchpad at
<a href="http://launchpad.net/keystone" target="_blank"></a><a href="http://launchpad.net/keystone" target="_blank">http://launchpad.net/keystone</a>.</div>
<div><br>
</div>
<div>The API we just put out there is still a proposal. We're going to be focusing on the implementation, but would still love to get community input, feedback, and participation.</div>
<div><br>
</div>
<div>Have a great weekend and regards to all,</div>
<div><br>
</div>
<div>Ziad</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<pre>Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at <a href="mailto:abuse@rackspace.com" target="_blank">abuse@rackspace.com</a>, and delete the original message.
Your cooperation is appreciated.
</pre>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>Mailing list: <a href="https://launchpad.net/~openstack" target="_blank"></a><a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a></span><br>
<span>Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">
</a><a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a></span><br>
<span>Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank"></a><a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a></span><br>
<span>More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">
</a><a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a></span><br>
</div>
</blockquote>
</div>
<div><span></span></div>
</div>
</div>
</span>
<pre>Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at <a href="mailto:abuse@rackspace.com" target="_blank">abuse@rackspace.com</a>, and delete the original message.
Your cooperation is appreciated.
</pre>
</div>
</div>
</div>
</div>
_______________________________________________ Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">
https://launchpad.net/~openstack</a> Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">
openstack@lists.launchpad.net</a> Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">
https://launchpad.net/~openstack</a> More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">
https://help.launchpad.net/ListHelp</a> </span>
<div class="im">
<pre>Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at <a href="mailto:abuse@rackspace.com" target="_blank">abuse@rackspace.com</a>, and delete the original message.
Your cooperation is appreciated.
</pre>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</span>
<PRE>
Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at abuse@rackspace.com, and delete the original message.
Your cooperation is appreciated.
</PRE></body>
</html>