<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-family: Calibri, sans-serif; ">
<div style="color: rgb(0, 0, 0); font-size: 14px; ">We've trimmed down the API significantly and decoupled it from the reference implementation we have. That means that behavior can now be determined by the implementation or deployment. As long as the contract
is adhered to, the way the roles and tenants are returned can vary. Here are two examples:</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; "><br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; ">1. In the case of Rackspace, for example, we'll return a token that gives you access to a the tenants you own.</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; ">2. In the use case documented in the code repo under docs/design, the token returned does not have access to any tenants by default and a call to GET /tenants is used to get a list of tenants available.</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; "><br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; ">That means the following in answering your questions:</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; "><span class="Apple-style-span" style="color: rgb(31, 73, 125); font-size: 15px; ">>> Are all possible Service Endpoints returned after authentication based upon the users relationship to various tenants via
roles? </span></div>
<div><font class="Apple-style-span" color="#1f497d"><span class="Apple-style-span" style="font-size: 15px;">Not necessarily. All endpoints that you get access to by default (as determined by the provider) are returned. A further call to GET /tenants could return
additional tenants you could access by making a scoped authentication call.</span></font></div>
<div><font class="Apple-style-span" color="#1f497d"><span class="Apple-style-span" style="font-size: 15px;"><br>
</span></font></div>
<div style="color: rgb(0, 0, 0); font-size: 14px; "><span class="Apple-style-span" style="color: rgb(31, 73, 125); font-size: 15px; ">>> When the Auth Component validates the token, are all possible roles and Groups across tenants for that user returned?</span></div>
<div style="color: rgb(0, 0, 0); font-size: 14px; "><span class="Apple-style-span" style="color: rgb(31, 73, 125); font-size: 15px; ">All roles (no groups, we've moved those out to an extension for now) that that token provides access to should be returned.
However, the spec does not dictate that these roles be fixed or even stored in the backend. This allows for someone implementing a Keystone-compatible API endpoint on top of a system which dynamically evaluates and returns a list of roles based on the credentials
provided (or maybe even the time of day they were presented).</span></div>
<div style="color: rgb(0, 0, 0); font-size: 14px; "><span class="Apple-style-span" style="color: rgb(31, 73, 125); font-size: 15px; "><br>
</span></div>
<div style="color: rgb(0, 0, 0); font-size: 14px; "><span class="Apple-style-span" style="color: rgb(31, 73, 125); font-size: 15px; ">Z</span></div>
<div style="color: rgb(0, 0, 0); font-size: 14px; "><br>
</div>
<span id="OLK_SRC_BODY_SECTION" style="color: rgb(0, 0, 0); font-size: 14px; ">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>"Rouault, Jason (Cloud Services)" <<a href="mailto:jason.rouault@hp.com">jason.rouault@hp.com</a>><br>
<span style="font-weight:bold">Date: </span>Thu, 21 Jul 2011 19:53:14 +0000<br>
<span style="font-weight:bold">To: </span>Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com">ziad.sawalha@rackspace.com</a>>, "<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>" <<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>><br>
<span style="font-weight:bold">Subject: </span>RE: OpenStack Identity: Keystone API Proposal<br>
</div>
<div><br>
</div>
<div xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:951866630;
mso-list-template-ids:742927426;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:1676036416;
mso-list-template-ids:-799366044;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">Ziad,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">What is the expected behavior when requesting and using an unscoped token? Are all possible Service Endpoints returned after authentication based
upon the users relationship to various tenants via roles? When the Auth Component validates the token, are all possible roles and Groups across tenants for that user returned?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">Jason<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">
<a href="mailto:openstack-bounces+jason.rouault=hp.com@lists.launchpad.net">openstack-bounces+jason.rouault=hp.com@lists.launchpad.net</a> [<a href="mailto:openstack-bounces+jason.rouault=hp.com@lists.launchpad.net">mailto:openstack-bounces+jason.rouault=hp.com@lists.launchpad.net</a>]
<b>On Behalf Of </b>Ziad Sawalha<br>
<b>Sent:</b> Thursday, July 21, 2011 12:52 PM<br>
<b>To:</b> <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
<b>Subject:</b> Re: [Openstack] OpenStack Identity: Keystone API Proposal<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">Hot, Texas summer regards to all!<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">Since my last note we have had much progress on Keystone. Particularly:<o:p></o:p></span></p>
</div>
<ul type="disc">
<li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif; ">We now have Nova, Dashboard, Glance, and Keystone integration (<a href="https://github.com/cloudbuilders/deploy.sh">https://github.com/cloudbuilders/deploy.sh</a> <o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif; ">We've done some work on Swift integration (<a href="https://github.com/rackspace/keystone/blob/master/keystone/middleware/swift_auth.py">https://github.com/rackspace/keystone/blob/master/keystone/middleware/swift_auth.py</a>)<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif; ">LDAP an be your backend (<a href="https://github.com/rackspace/keystone/pull/102">https://github.com/rackspace/keystone/pull/102</a>)<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif; ">We're incubating! Keystone is now officially an OpenStack Incubation project.<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif; ">And many other updates, enhanced testing, stability improvements, etc…<o:p></o:p></span></li></ul>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">In my last note I called out our latest API proposal and asked for input. We've received much of that input – thank you - and have four new blueprints to
change the API. These are:<o:p></o:p></span></p>
</div>
<ol start="1" type="1">
<li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo2">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif; ">Support Service Registration (blueprint here <a href="https://blueprints.launchpad.net/keystone/+spec/keystone-service-registration">https://blueprints.launchpad.net/keystone/+spec/keystone-service-registration</a>).<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo2">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif; ">Remove support for 'default' tenant. Instead, a 'Member' or 'default' role can be used to manage a default tenant (this may be implemented in the legacy_token_auth front end (blueprint here: <a href="https://blueprints.launchpad.net/keystone/+spec/remove-default-tenant">https://blueprints.launchpad.net/keystone/+spec/remove-default-tenant</a>). <o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo2">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif; ">Support for EC2 API and non-password credentials (blueprint here: <a href="https://blueprints.launchpad.net/keystone/+spec/support-multiple-credentials">https://blueprints.launchpad.net/keystone/+spec/support-multiple-credentials</a>).<o:p></o:p></span></li><li class="MsoNormal" style="color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo2">
<span style="font-size: 10.5pt; font-family: Calibri, sans-serif; ">Support for API versioning in the service catalog (blueprint here: <a href="https://blueprints.launchpad.net/keystone/+spec/service-catalog-version-support">https://blueprints.launchpad.net/keystone/+spec/service-catalog-version-support</a>).<o:p></o:p></span></li></ol>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">I'd like to invite comments on those blueprints (here, by email, or on the whiteboards or on the keystone issues list on github. Use the medium you prefer).
As well as any new blueprint proposals to change the API.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">I'd also like to propose a date for locking down the 2.0 API for Diablo. We're going to need some time to finish the implementation by feature freeze (Sept
10th), so I'd like to open the debate up for about three weeks and propose we lock down the API by the end of the weekend of
<b><u>August 14th</u></b>.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">Give us your requirements… and let me know if the dates don't work for you or your projects/teams.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">Best,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">Ziad<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size: 11pt; color: black; font-family: Calibri, sans-serif; ">From:
</span></b><span style="font-size: 11pt; color: black; font-family: Calibri, sans-serif; ">Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com">ziad.sawalha@rackspace.com</a>><br>
<b>Date: </b>Fri, 10 Jun 2011 18:24:21 -0500<br>
<b>To: </b>"<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>" <<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>><br>
<b>Subject: </b>OpenStack Identity: Keystone API Proposal<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">Time flies! It's June 10th already. In my last email to this community I had proposed today as the day to lock down the Keystone API so we can finalize implementation
by Diablo-D2 (June 30th).<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">We've been working on this feverishly over the past couple of weeks and have just pushed out a proposed API here:
<a href="https://github.com/rackspace/keystone/raw/master/keystone/content/identitydevguide.pdf">
https://github.com/rackspace/keystone/raw/master/keystone/content/identitydevguide.pdf</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">For any and all interested, the original source and code is on Github (<a href="https://github.com/rackspace/keystone/raw/master/keystone/content/identitydevguide.pdf">https://github.com/rackspace/keystone</a>),
along with the current implementation of Keystone, examples, sample data, tests, instructions, and all the goodies we could muster to put together. The project also lives on Launchpad at
<a href="http://launchpad.net/keystone">http://launchpad.net/keystone</a>.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">The API we just put out there is still a proposal. We're going to be focusing on the implementation, but would still love to get community input, feedback,
and participation.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">Have a great weekend and regards to all,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; ">Ziad<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p> </o:p></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size: 10.5pt; color: black; font-family: 'Courier New'; ">This email may include confidential information. If you received it in error, please delete it.</span><span style="font-size: 10.5pt; color: black; font-family: Calibri, sans-serif; "><o:p></o:p></span></p>
</div>
</div>
</div>
</span>
<font face="monospace">This email may include confidential information. If you received it in error, please delete it.</font></body>
</html>