Keystone Release Notes - en to en_GB translation catalogue (41 entries)

en: **Experimental** - Keystone now supports tokenless authorization with X.509 SSL client certificate.
en_GB: **Experimental** - Keystone now supports tokenless authorisation with X.509 SSL client certificate.

en: A Federated user gets an entry in the shadow-users table. This entry has a unique ID. It was generated using a UUID. This fix changes to reuse the mechanism for LDAP, where the ID is generated from the domain ID + the local id of the user (an attribute that uniquely ids the user from the IdP). This generator is specified by the configuration file. Now Both LDAP and Federated Ids are generated the same way. It also means that Federated IDs can be kept in sync between two independtent Keystone servers.
en_GB: A Federated user gets an entry in the shadow-users table. This entry has a unique ID. It was generated using a UUID. This fix changes to reuse the mechanism for LDAP, where the ID is generated from the domain ID + the local id of the user (an attribute that uniquely ids the user from the IdP). This generator is specified by the configuration file. Now Both LDAP and Federated Ids are generated the same way. It also means that Federated IDs can be kept in sync between two independent Keystone servers.

en: Allow the creating of a domain with the additional, optional parameter of `explicit_domain_id` instead of auto-creating a domain_id from a uuid.
en_GB: Allow the creating of a domain with the additional, optional parameter of `explicit_domain_id` instead of auto-creating a domain_id from a UUID.

en: Any middleware defined in Keystone's tree is no longer loaded via stevedore, and likewise the entry points were removed.
en_GB: Any middleware defined in Keystone's tree is no longer loaded via Stevedore, and likewise the entry points were removed.

en: Certain deprecated methods from the assignment manager were removed in favor of the same methods in the [resource] and [role] manager.
en_GB: Certain deprecated methods from the assignment manager were removed in favour of the same methods in the [resource] and [role] manager.

en: In ``keystone-paste.ini``, using ``paste.filter_factory`` is deprecated in favor of the "use" directive, specifying an entrypoint.
en_GB: In ``keystone-paste.ini``, using ``paste.filter_factory`` is deprecated in favour of the "use" directive, specifying an entrypoint.

en: In the case a user should be exempt from MFA Rules, regardless if they are set, the User-Option ``multi_factor_auth_enabled`` may  be set to ``False`` for that user via the user create and update API (``POST/PATCH /v3/users``) call. If this option is set to ``False`` the MFA rules will be ignored for the user. Any other value except ``False`` will result in the MFA Rules being processed; the option can only be a boolean (``True`` or ``False``) or "None" (which will result in the default behavior (same as ``True``) but the option will no longer be shown in the ``user["options"]`` dictionary.
en_GB: In the case a user should be exempt from MFA Rules, regardless if they are set, the User-Option ``multi_factor_auth_enabled`` may  be set to ``False`` for that user via the user create and update API (``POST/PATCH /v3/users``) call. If this option is set to ``False`` the MFA rules will be ignored for the user. Any other value except ``False`` will result in the MFA Rules being processed; the option can only be a boolean (``True`` or ``False``) or "None" (which will result in the default behaviour (same as ``True``) but the option will no longer be shown in the ``user["options"]`` dictionary.

en: Included in this change is a removal of a legacy WSGI environment data holder calld `openstack.params`. The data holder was used exclusively for communicating data down the chain under paste-deploy. The data in `openstack.params` was generally "normalized" in an odd way and unreferenced in the rest of the openstack code-base.
en_GB: Included in this change is a removal of a legacy WSGI environment data holder calld `openstack.params`. The data holder was used exclusively for communicating data down the chain under paste-deploy. The data in `openstack.params` was generally "normalized" in an odd way and unreferenced in the rest of the OpenStack code-base.

en: It is no longer possible to, via the ``paste.ini`` file to inject middleware into the running keystone application. This reduces the attack surface area. While this is not a huge reduction in surface area, it is one less potential place that malicious code could be loaded. Malicious middleware historically could collect information and/or modify the requests and responses from Keystone.
en_GB: It is no longer possible to, via the ``paste.ini`` file to inject middleware into the running Keystone application. This reduces the attack surface area. While this is not a huge reduction in surface area, it is one less potential place that malicious code could be loaded. Malicious middleware historically could collect information and/or modify the requests and responses from Keystone.

en: JSON Body and URL Normalizing middleware were move to a flask-native model.
en_GB: JSON Body and URL Normalising middleware were moved to a flask-native model.

en: Keystone cache backends have been removed in favor of their `oslo.cache` counter-part. This affects:
en_GB: Keystone cache backends have been removed in favour of their `oslo.cache` counter-part. This affects:

en: Keystone now supports authorizing a request token by providing a role name. A `role` in the `roles` parameter can include either a role name or role id, but not both.
en_GB: Keystone now supports authorising a request token by providing a role name. A `role` in the `roles` parameter can include either a role name or role id, but not both.

en: Keystone supports ``$(project_id)s`` in the catalog. It works the same as ``$(tenant_id)s``. Use of ``$(tenant_id)s`` is deprecated and catalog endpoints should be updated to use ``$(project_id)s``.
en_GB: Keystone supports ``$(project_id)s`` in the catalogue. It works the same as ``$(tenant_id)s``. Use of ``$(tenant_id)s`` is deprecated and catalogue endpoints should be updated to use ``$(project_id)s``.

en: PKI and PKIz token formats have been removed in favor of Fernet tokens.
en_GB: PKI and PKIz token formats have been removed in favour of Fernet tokens.

en: Remove token_auth from your keystone paste.ini file. Failure to remove these elements from your paste ini file will result in keystone to no longer start/run when the `token_auth` is removed in the Stein release.
en_GB: Remove token_auth from your Keystone paste.ini file. Failure to remove these elements from your paste ini file will result in Keystone to no longer start/run when the `token_auth` is removed in the Stein release.

en: Replaced the usage of SQLAlchemy Inspector.from_engine() with the sqlalchemy.inspect() call, within several Alembic migration files as well as a test suite.   SQLAlchemy will be deprecating the former syntax, so this change allows forwads compatibility with the next series of SQLAlchemy.
en_GB: Replaced the usage of SQLAlchemy Inspector.from_engine() with the sqlalchemy.inspect() call, within several Alembic migration files as well as a test suite.   SQLAlchemy will be deprecating the former syntax, so this change allows forward compatibility with the next series of SQLAlchemy.

en: Restores the configurability of the resource driver, so it is now possible to create a custom resource driver if the built-in sql driver does not meet business requirements.
en_GB: Restores the configurability of the resource driver, so it is now possible to create a custom resource driver if the built-in SQL driver does not meet business requirements.

en: Routes and SQL backends for the contrib extensions have been removed, they have been incorporated into keystone and are no longer optional. This affects:
en_GB: Routes and SQL backends for the contrib extensions have been removed, they have been incorporated into Keystone and are no longer optional. This affects:

en: Running keystone in eventlet remains deprecated and will be removed in the Mitaka release.
en_GB: Running Keystone in eventlet remains deprecated and will be removed in the Mitaka release.

en: Several token issuance methods from the abstract class ``keystone.token.providers.base.Provider`` were removed (see below) in favor of a single method to issue tokens (``issue_token``). If using a custom token provider, updated the custom provider accordingly.
en_GB: Several token issuance methods from the abstract class ``keystone.token.providers.base.Provider`` were removed (see below) in favour of a single method to issue tokens (``issue_token``). If using a custom token provider, updated the custom provider accordingly.

en: Several token validation methods from the abstract class ``keystone.token.providers.base.Provider`` were removed (see below) in favor of a single method to validate tokens (``validate_token``), that has the signature ``validate_token(self, token_ref)``. If using a custom token provider, update the custom provider accordingly.
en_GB: Several token validation methods from the abstract class ``keystone.token.providers.base.Provider`` were removed (see below) in favour of a single method to validate tokens (``validate_token``), that has the signature ``validate_token(self, token_ref)``. If using a custom token provider, update the custom provider accordingly.

en: The EC2 token middleware, deprecated in Juno, is no longer available in keystone. It has been moved to the keystonemiddleware package.
en_GB: The EC2 token middleware, deprecated in Juno, is no longer available in Keystone. It has been moved to the keystonemiddleware package.

en: The LDAP driver now also maps the user description attribute after user retrieval from LDAP. If this is undesired behavior for your setup, please add `description` to the `user_attribute_ignore` LDAP driver config setting. The default mapping of the description attribute is set to `description`. Please adjust the LDAP driver config setting `user_description_attribute` if your LDAP uses a different attribute name (for instance to `displayName` in case of an AD backed LDAP). If your `user_additional_attribute_mapping` setting contains `description:description` you can remove this mapping, since this is now the default behavior.
en_GB: The LDAP driver now also maps the user description attribute after user retrieval from LDAP. If this is undesired behaviour for your setup, please add `description` to the `user_attribute_ignore` LDAP driver config setting. The default mapping of the description attribute is set to `description`. Please adjust the LDAP driver config setting `user_description_attribute` if your LDAP uses a different attribute name (for instance to `displayName` in case of an AD backed LDAP). If your `user_additional_attribute_mapping` setting contains `description:description` you can remove this mapping, since this is now the default behaviour.

en: The V8 Federation driver interface is deprecated in favor of the V9 Federation driver interface. Support for the V8 Federation driver interface is planned to be removed in the 'O' release of OpenStack.
en_GB: The V8 Federation driver interface is deprecated in favour of the V9 Federation driver interface. Support for the V8 Federation driver interface is planned to be removed in the 'O' release of OpenStack.

en: The ``/OS-FEDERATION/projects`` and ``/OS-FEDERATION/domains`` APIs are deprecated in favor of the ``/v3/auth/projects`` and ``/v3/auth/domains`` APIs. These APIs were originally marked as deprecated during the Juno release cycle, but we never deprecated using ``versionutils`` from oslo. More information regarding this deprecation can be found in the `patch <https://review.openstack.org/#/c/115423/>`_ that proposed the deprecation.
en_GB: The ``/OS-FEDERATION/projects`` and ``/OS-FEDERATION/domains`` APIs are deprecated in favour of the ``/v3/auth/projects`` and ``/v3/auth/domains`` APIs. These APIs were originally marked as deprecated during the Juno release cycle, but we never deprecated using ``versionutils`` from oslo. More information regarding this deprecation can be found in the `patch <https://review.openstack.org/#/c/115423/>`_ that proposed the deprecation.

en: The ``[DEFAULT] domain_id_immutable`` configuration option has been removed in favor of strictly immutable domain IDs.
en_GB: The ``[DEFAULT] domain_id_immutable`` configuration option has been removed in favour of strictly immutable domain IDs.

en: The ``[DEFAULT] domain_id_immutable`` option has been removed. This removes the ability to change the ``domain_id`` attribute of users, groups, and projects. The behavior was introduced to allow deployers to migrate entities from one domain to another by updating the ``domain_id`` attribute of an entity. This functionality was deprecated in the Mitaka release is now removed.
en_GB: The ``[DEFAULT] domain_id_immutable`` option has been removed. This removes the ability to change the ``domain_id`` attribute of users, groups, and projects. The behaviour was introduced to allow deployers to migrate entities from one domain to another by updating the ``domain_id`` attribute of an entity. This functionality was deprecated in the Mitaka release is now removed.

en: The ``[endpoint_policy] enabled`` configuration option has been removed in favor of always enabling the endpoint policy extension.
en_GB: The ``[endpoint_policy] enabled`` configuration option has been removed in favour of always enabling the endpoint policy extension.

en: The ``httpd/keystone.py`` file has been removed in favor of the ``keystone-wsgi-admin`` and ``keystone-wsgi-public`` scripts.
en_GB: The ``httpd/keystone.py`` file has been removed in favour of the ``keystone-wsgi-admin`` and ``keystone-wsgi-public`` scripts.

en: The ``memcache`` and ``memcache_pool`` token persistence backends have been removed in favor of using Fernet tokens (which require no persistence).
en_GB: The ``memcache`` and ``memcache_pool`` token persistence backends have been removed in favour of using Fernet tokens (which require no persistence).

en: The ability to validate a trust-scoped token against the v2.0 API has been removed, in favor of using the version 3 of the API.
en_GB: The ability to validate a trust-scoped token against the v2.0 API has been removed, in favour of using the version 3 of the API.

en: The auth plugin ``keystone.auth.plugins.saml2.Saml2`` has been removed in favor of the auth plugin ``keystone.auth.plugins.mapped.Mapped``.
en_GB: The auth plugin ``keystone.auth.plugins.saml2.Saml2`` has been removed in favour of the auth plugin ``keystone.auth.plugins.mapped.Mapped``.

en: The catalog backend ``endpoint_filter.sql`` has been removed. It has been consolidated with the ``sql`` backend, therefore replace the ``endpoint_filter.sql`` catalog backend with the ``sql`` backend.
en_GB: The catalogue backend ``endpoint_filter.sql`` has been removed. It has been consolidated with the ``sql`` backend, therefore replace the ``endpoint_filter.sql`` catalogue backend with the ``sql`` backend.

en: The resource backend cannot be configured to anything but SQL if the SQL Identity backend is being used. The resource backend must now be SQL which allows for the use of Foreign Keys to domains/projects wherever desired. This makes managing project relationships and such much more straight forward. The inability to configure non-SQL resource backends has been in Keystone since at least Ocata. This is eliminating some complexity and preventing the need for some really ugly back-port SQL migrations in favor of a better model. Resource is highly relational and should be SQL based.
en_GB: The resource backend cannot be configured to anything but SQL if the SQL Identity backend is being used. The resource backend must now be SQL which allows for the use of Foreign Keys to domains/projects wherever desired. This makes managing project relationships and such much more straight forward. The inability to configure non-SQL resource backends has been in Keystone since at least Ocata. This is eliminating some complexity and preventing the need for some really ugly back-port SQL migrations in favour of a better model. Resource is highly relational and should be SQL based.

en: The use of admin_token filter is insecure compared to the use of a proper username/password. Historically the admin_token filter has been left enabled in Keystone after initialization due to the way CMS systems work. Moving to an out-of-band initialization using ``keystone-manage bootstrap`` will eliminate the security concerns around a static shared string that conveys admin access to keystone and therefore to the entire installation.
en_GB: The use of admin_token filter is insecure compared to the use of a proper username/password. Historically the admin_token filter has been left enabled in Keystone after initialisation due to the way CMS systems work. Moving to an out-of-band initialisation using ``keystone-manage bootstrap`` will eliminate the security concerns around a static shared string that conveys admin access to Keystone and therefore to the entire installation.

en: UUID token provider ``[token] provider=uuid`` has been deprecated in favor of Fernet tokens ``[token] provider=fernet``. With Fernet tokens becoming the default UUID tokens can be slated for removal in the R release. This also deprecates token-bind support as it was never implemented for fernet.
en_GB: UUID token provider ``[token] provider=uuid`` has been deprecated in favour of Fernet tokens ``[token] provider=fernet``. With Fernet tokens becoming the default UUID tokens can be slated for removal in the R release. This also deprecates token-bind support as it was never implemented for fernet.

en: Use of ``$(tenant_id)s`` in the catalog endpoints is deprecated in favor of ``$(project_id)s``.
en_GB: Use of ``$(tenant_id)s`` in the catalogue endpoints is deprecated in favour of ``$(project_id)s``.

en: Using the full path to the driver class is deprecated in favor of using the entrypoint. In the Mitaka release, the entrypoint must be used.
en_GB: Using the full path to the driver class is deprecated in favour of using the entrypoint. In the Mitaka release, the entrypoint must be used.

en: Write support for the LDAP has been removed in favor of read-only support. The following operations are no longer supported for LDAP:
en_GB: Write support for the LDAP has been removed in favour of read-only support. The following operations are no longer supported for LDAP:

en: [`Bug 1649446 <https://bugs.launchpad.net/keystone/+bug/1651989>`_] The default policy for listing revocation events has changed. Previously, any authenticated user could list revocation events; it is now, by default, an admin or service user only function. This can be changed by modifying the policy file being used by keystone.
en_GB: [`Bug 1649446 <https://bugs.launchpad.net/keystone/+bug/1651989>`_] The default policy for listing revocation events has changed. Previously, any authenticated user could list revocation events; it is now, by default, an admin or service user only function. This can be changed by modifying the policy file being used by Keystone.

en: [`blueprint bootstrap <https://blueprints.launchpad.net/keystone/+spec/bootstrap>`_] keystone-manage now supports the bootstrap command on the CLI so that a keystone install can be initialized without the need of the admin_token filter in the paste-ini.
en_GB: [`blueprint bootstrap <https://blueprints.launchpad.net/keystone/+spec/bootstrap>`_] keystone-manage now supports the bootstrap command on the CLI so that a keystone install can be initialised without the need of the admin_token filter in the paste-ini.
