)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"accdc578be1fe8655c49e9a2b2ed21813a4c47bb","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     NiallBunting \u003cniall.bunting@hp.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2015-11-25 18:06:12 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Property modification with service tokens"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This proposes to use the roles from a service token within property"},{"line_number":10,"context_line":"modification."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"9a8ffd7b_ee6aa8ed","line":7,"updated":"2015-11-26 17:08:28.000000000","message":"s/Property/Protected Property/ - other properties are unaffected.\n\nAlso, properties can be read protected, so it\u0027s not just modification, the service token may grant you read access. \"Integrate protected properties with service tokens\"?","commit_id":"2ef4224197db439d7e75807a979cd3f177ef7a74"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"accdc578be1fe8655c49e9a2b2ed21813a4c47bb","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Property modification with service tokens"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This proposes to use the roles from a service token within property"},{"line_number":10,"context_line":"modification."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I5c9b7df1661fdbdfb3f57c6234d0440cd1a06e27"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"9a8ffd7b_ce4c84a0","line":10,"updated":"2015-11-26 17:08:28.000000000","message":"property-\u003eprotected property\n\nmodification-\u003eaccess control","commit_id":"2ef4224197db439d7e75807a979cd3f177ef7a74"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"da5d907f525ee1c1ecda55bc7b259fdf50394bf4","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     NiallBunting \u003cniall.bunting@hp.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2015-11-27 16:43:17 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Protected property modification with service tokens"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This proposes to use the roles from a service token within protected"},{"line_number":10,"context_line":"property access control."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9a8ffd7b_34c3f158","line":7,"updated":"2015-11-27 17:32:58.000000000","message":"nit: modification -\u003e read isn\u0027t modification.","commit_id":"e8b21f3e7983eb25157e1a970e5428fb5aaf7a5e"}],"specs/mitaka/protected-properties-use-roles-from-service-tokens.rst":[{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"accdc578be1fe8655c49e9a2b2ed21813a4c47bb","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"protected properties use roles from service tokens"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Allow Glance to use the additional roles gained by supplying a service"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_ae3ee0d7","line":8,"updated":"2015-11-26 17:08:28.000000000","message":"Capital \u0027p\u0027","commit_id":"2ef4224197db439d7e75807a979cd3f177ef7a74"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"accdc578be1fe8655c49e9a2b2ed21813a4c47bb","unresolved":false,"context_lines":[{"line_number":26,"context_line":"the X-Auth-Token."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"This change would combine the additional roles gained from a service token"},{"line_number":29,"context_line":"with a users usual roles. The combined roles would be considered when"},{"line_number":30,"context_line":"authorizing changes to procteded properties meaning the administrators"},{"line_number":31,"context_line":"could restrict to the additional roles."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_8e10bc5a","line":29,"updated":"2015-11-26 17:08:28.000000000","message":"nit: user\u0027s","commit_id":"2ef4224197db439d7e75807a979cd3f177ef7a74"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"accdc578be1fe8655c49e9a2b2ed21813a4c47bb","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"This change would combine the additional roles gained from a service token"},{"line_number":29,"context_line":"with a users usual roles. The combined roles would be considered when"},{"line_number":30,"context_line":"authorizing changes to procteded properties meaning the administrators"},{"line_number":31,"context_line":"could restrict to the additional roles."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"An example would be licence cost on an image, you would not usally want"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_2e02f00b","line":30,"updated":"2015-11-26 17:08:28.000000000","message":"typo: procteded","commit_id":"2ef4224197db439d7e75807a979cd3f177ef7a74"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"accdc578be1fe8655c49e9a2b2ed21813a4c47bb","unresolved":false,"context_lines":[{"line_number":33,"context_line":"An example would be licence cost on an image, you would not usally want"},{"line_number":34,"context_line":"an user to be able to modify the cost. However when Nova is creating a"},{"line_number":35,"context_line":"child image it would be useful if Nova could then add a new licence"},{"line_number":36,"context_line":"cost property to the new image."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Alternatives"},{"line_number":39,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_c9d23e5c","line":36,"updated":"2015-11-26 17:08:28.000000000","message":"I think an example of how this would work in practice would be useful.\n\nEg give an example protected property file, and an example API call which includes the X-Service-Token header. Show what the the X-Roles and X-Service-Roles would look like, and explain the new behaviour with respect to your example protected property file.","commit_id":"2ef4224197db439d7e75807a979cd3f177ef7a74"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"accdc578be1fe8655c49e9a2b2ed21813a4c47bb","unresolved":false,"context_lines":[{"line_number":127,"context_line":"References"},{"line_number":128,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Here is Nova impementing the example used:"},{"line_number":131,"context_line":"https://review.openstack.org/#/c/206431/"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_c976bea3","line":130,"updated":"2015-11-26 17:08:28.000000000","message":"typo: impementing","commit_id":"2ef4224197db439d7e75807a979cd3f177ef7a74"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"da5d907f525ee1c1ecda55bc7b259fdf50394bf4","unresolved":false,"context_lines":[{"line_number":44,"context_line":"the following::"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    [^billing_.*]"},{"line_number":47,"context_line":"    create \u003d admin,service:nova"},{"line_number":48,"context_line":"    read \u003d admin,service:nova"},{"line_number":49,"context_line":"    update \u003d admin,service:nova"},{"line_number":50,"context_line":"    delete \u003d admin,service:nova"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_6f5d2446","line":47,"updated":"2015-11-27 17:32:58.000000000","message":"This can be interpreted in two ways:\n\n1) you need both an X-Roles with admin *and* an X-Service-Roles with nova\n\nor\n\n\n2) you need either an X-Roles with admin *or* an X-Service-Roles with nova\n\nwhich would you like to propose?","commit_id":"e8b21f3e7983eb25157e1a970e5428fb5aaf7a5e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"60a30577162e6bc41ec8c9e7104aa25add2caa09","unresolved":false,"context_lines":[{"line_number":44,"context_line":"the following::"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    [^billing_.*]"},{"line_number":47,"context_line":"    create \u003d admin,service:nova"},{"line_number":48,"context_line":"    read \u003d admin,service:nova"},{"line_number":49,"context_line":"    update \u003d admin,service:nova"},{"line_number":50,"context_line":"    delete \u003d admin,service:nova"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_6a3992d6","line":47,"in_reply_to":"9a8ffd7b_6f5d2446","updated":"2015-11-27 17:34:51.000000000","message":"Can roles contain \u0027:\u0027?","commit_id":"e8b21f3e7983eb25157e1a970e5428fb5aaf7a5e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"da5d907f525ee1c1ecda55bc7b259fdf50394bf4","unresolved":false,"context_lines":[{"line_number":49,"context_line":"    update \u003d admin,service:nova"},{"line_number":50,"context_line":"    delete \u003d admin,service:nova"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Example: User creating child image::"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":" Sequence Diagram                    +------------------------------------+"},{"line_number":55,"context_line":"                                     |              GLANCE                |"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_0f4ed8c0","line":52,"updated":"2015-11-27 17:32:58.000000000","message":"Maybe make a note that Nova\u0027s \u0027shelve\u0027 is used as part of a snapshot (some people may not be familiar with it.)","commit_id":"e8b21f3e7983eb25157e1a970e5428fb5aaf7a5e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"da5d907f525ee1c1ecda55bc7b259fdf50394bf4","unresolved":false,"context_lines":[{"line_number":52,"context_line":"Example: User creating child image::"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":" Sequence Diagram                    +------------------------------------+"},{"line_number":55,"context_line":"                                     |              GLANCE                |"},{"line_number":56,"context_line":"                                     +------------------------------------+"},{"line_number":57,"context_line":" +---------+ +---------+ +---------+ +----------+ +----------+ +----------+"},{"line_number":58,"context_line":" |  Nova   | |         | |         | | Keystone | | Context  | |Protected |"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_6f88c4c5","line":55,"updated":"2015-11-27 17:32:58.000000000","message":"Maybe GLANCE-\u003eGlance? (Others are lower case.)","commit_id":"e8b21f3e7983eb25157e1a970e5428fb5aaf7a5e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"da5d907f525ee1c1ecda55bc7b259fdf50394bf4","unresolved":false,"context_lines":[{"line_number":82,"context_line":"      |           |          |-|          |            |            |"},{"line_number":83,"context_line":"      |          +-+\u003c\u003c---------|          |            |            |"},{"line_number":84,"context_line":"      |          |-|         |-|          |            |            |"},{"line_number":85,"context_line":"      | Response: 200        |-|          |            |            |"},{"line_number":86,"context_line":"      | Body: {\u0027token\u0027: 4321}|-|          |            |            |"},{"line_number":87,"context_line":"      |          |-|         |-|          |            |            |"},{"line_number":88,"context_line":"      |          +-+-------\u003e\u003e|-|          |            |            |"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_14ad8d87","line":85,"updated":"2015-11-27 17:32:58.000000000","message":"Does this return 200 or 201?\n\n(Similar below)","commit_id":"e8b21f3e7983eb25157e1a970e5428fb5aaf7a5e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"da5d907f525ee1c1ecda55bc7b259fdf50394bf4","unresolved":false,"context_lines":[{"line_number":89,"context_line":"      |           |          |-|          |            |            |"},{"line_number":90,"context_line":"      | Glance POST /v2/images-|          |            |            |"},{"line_number":91,"context_line":"      | X-Auth-Token: 1234   |-|          |            |            |"},{"line_number":92,"context_line":"      | X-Service-Token: 4321|-|          |            |            |"},{"line_number":93,"context_line":"      |           |          |-|          |            |            |"},{"line_number":94,"context_line":"      |           |          |-|-------\u003e\u003e+-+           |            |"},{"line_number":95,"context_line":"      |           |          |-|         |-|           |            |"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_afea2c72","line":92,"updated":"2015-11-27 17:32:58.000000000","message":"Note: Will this have the body with the protected properties specified? It would be useful to include that.","commit_id":"e8b21f3e7983eb25157e1a970e5428fb5aaf7a5e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"da5d907f525ee1c1ecda55bc7b259fdf50394bf4","unresolved":false,"context_lines":[{"line_number":130,"context_line":"      |           |          |-|          |            |           |-|"},{"line_number":131,"context_line":"      |           |          |-|\u003c\u003c---------------------------------+-+"},{"line_number":132,"context_line":"      |           |          |-|          |            |            |"},{"line_number":133,"context_line":"      | Nova successfully shelves image.  |            |            |"},{"line_number":134,"context_line":"      |           |          |-|          |            |            |"},{"line_number":135,"context_line":"      +\u003c\u003c---------+----------+-+          +            +            +"},{"line_number":136,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_cf7c50ee","line":133,"updated":"2015-11-27 17:32:58.000000000","message":"I think this is asynchronous. Ie the nova client will get a response after the image is created, but before the bits are uploaded. So we can\u0027t say the snapshot has been successfully created at this point. Maybe something like \u0027Nova returns id of newly created (queued) image\u0027","commit_id":"e8b21f3e7983eb25157e1a970e5428fb5aaf7a5e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"54efede704c8b6686052e26e45bba90ffd26ae44","unresolved":false,"context_lines":[{"line_number":59,"context_line":"   to be still role specific."},{"line_number":60,"context_line":" * The second option is to have all tokens interpreted as a OR"},{"line_number":61,"context_line":"   statement. This may be a bit easier to understand the file, however"},{"line_number":62,"context_line":"   gives less flexibility."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Example: User snapshotting an image therefore creating a child image::"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_b4195c8a","line":62,"updated":"2015-12-02 15:49:01.000000000","message":"Ok, I think what you\u0027re saying here is that we can do:\n\nOption 1:\n\n update \u003d member, service\n\nie the configuration treats all roles the same\n\nif the user token or the service token provide either a member or a service role then permission is granted.\n\nOption 2:\n\n update \u003d member\n update_service \u003d service\n\nthe configuration allows distinguishing between user and service derived roles.\n\nIn this case we could require both a \"member\" role (from user) and a \"service\" role (from service user) or just one of either as in Option 1.","commit_id":"35e333f17866741f7916d200ea276b9b0c124935"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"5aa1f5ee8a751ffbcf5c85ecd651fff1b2df01a4","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Proposed change"},{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"By using the protected property fuctionality operators can restrict"},{"line_number":27,"context_line":"the ablity to create, read, update and delete image properties based on"},{"line_number":28,"context_line":"the user\u0027s role. However this currently only uses the roles provided by"},{"line_number":29,"context_line":"the X-Auth-Token."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_e8cf7627","line":26,"updated":"2015-12-09 21:39:37.000000000","message":"Maybe \"specify\" instead of \"restrict\"?","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"391a7a5c696c24328d1013ef94d057a78224d430","unresolved":false,"context_lines":[{"line_number":23,"context_line":"Proposed change"},{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"By using the protected property fuctionality operators can restrict"},{"line_number":27,"context_line":"the ablity to create, read, update and delete image properties based on"},{"line_number":28,"context_line":"the user\u0027s role. However this currently only uses the roles provided by"},{"line_number":29,"context_line":"the X-Auth-Token."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_fa7e3969","line":26,"in_reply_to":"7a740942_e8cf7627","updated":"2015-12-10 12:07:38.000000000","message":"Done","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"5aa1f5ee8a751ffbcf5c85ecd651fff1b2df01a4","unresolved":false,"context_lines":[{"line_number":31,"context_line":"This change would combine the additional roles gained from a service token"},{"line_number":32,"context_line":"with a user\u0027s usual roles. The combined roles would be considered when"},{"line_number":33,"context_line":"authorizing changes to protected properties meaning the administrators"},{"line_number":34,"context_line":"could restrict to the additional roles."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"An example would be licence cost on an image, you would not usally want"},{"line_number":37,"context_line":"an user to be able to modify the cost. However when Nova is creating a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_1210f04d","line":34,"updated":"2015-12-09 21:39:37.000000000","message":"\"restrict\" is kind of weird here because you\u0027re presumably broadening what can be done by the user.  Maybe simply end the sentence after \"protected properties\".","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"391a7a5c696c24328d1013ef94d057a78224d430","unresolved":false,"context_lines":[{"line_number":31,"context_line":"This change would combine the additional roles gained from a service token"},{"line_number":32,"context_line":"with a user\u0027s usual roles. The combined roles would be considered when"},{"line_number":33,"context_line":"authorizing changes to protected properties meaning the administrators"},{"line_number":34,"context_line":"could restrict to the additional roles."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"An example would be licence cost on an image, you would not usally want"},{"line_number":37,"context_line":"an user to be able to modify the cost. However when Nova is creating a"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_da7b3d7a","line":34,"in_reply_to":"7a740942_1210f04d","updated":"2015-12-10 12:07:38.000000000","message":"Done","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"5aa1f5ee8a751ffbcf5c85ecd651fff1b2df01a4","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    update \u003d admin,service-nova"},{"line_number":53,"context_line":"    delete \u003d admin,service-nova"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"There are two possible ways to interpret the above file."},{"line_number":56,"context_line":" * Option one is that if both normal roles and service roles are specified"},{"line_number":57,"context_line":"   at least one from each group is required, is is probably the option that"},{"line_number":58,"context_line":"   could allow for a bit more flexiblity. As it would cause certain options"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_d59b3271","line":55,"updated":"2015-12-09 21:39:37.000000000","message":"I think it would be good to try to implement this without changing the semantics of the property protection configuration file.  When property_protection_rule_format \u003d roles, the current interpretation is your second option.  I think we should stick with that.\n\nDeployers who want something more complex can set property_protection_rule_format \u003d policies and then write appropriate rules in policy.json to do what they want.\n\nThis would have the advantage that we won\u0027t have to distinguish service roles from user roles in the code, as you seem to be proposing for your option one.  I\u0027m not clear on what advantage knowing a role came from a service gives you that a deployer can\u0027t get from careful role naming and assignment in their deployment.","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"9b447c2c5cbbd510f7861a0dc83e3bcb0f0a350e","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    update \u003d admin,service-nova"},{"line_number":53,"context_line":"    delete \u003d admin,service-nova"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"There are two possible ways to interpret the above file."},{"line_number":56,"context_line":" * Option one is that if both normal roles and service roles are specified"},{"line_number":57,"context_line":"   at least one from each group is required, is is probably the option that"},{"line_number":58,"context_line":"   could allow for a bit more flexiblity. As it would cause certain options"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_e6d0dbcb","line":55,"in_reply_to":"7a740942_4302010b","updated":"2015-12-10 14:07:24.000000000","message":"I agree with you here. Yeah enforcing it in the policies file seems like a good way to go about it to me. I think option 2 makes more sense.","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"e05efde38dcc74a07d6a3cd1df94832c605a7b69","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    update \u003d admin,service-nova"},{"line_number":53,"context_line":"    delete \u003d admin,service-nova"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"There are two possible ways to interpret the above file."},{"line_number":56,"context_line":" * Option one is that if both normal roles and service roles are specified"},{"line_number":57,"context_line":"   at least one from each group is required, is is probably the option that"},{"line_number":58,"context_line":"   could allow for a bit more flexiblity. As it would cause certain options"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_4302010b","line":55,"in_reply_to":"7a740942_9ac4d592","updated":"2015-12-10 13:43:00.000000000","message":"Makes sense, but if that\u0027s the kind of restriction someone wants to enforce, couldn\u0027t they just use the \"policies\" setting instead of the \"roles\"?  (I don\u0027t mean to be a jerk, I\u0027m just trying to understand what extending the semantics of the roles-style property protections gets you that\u0027s not already available from the policies-style property protections.","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"391a7a5c696c24328d1013ef94d057a78224d430","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    update \u003d admin,service-nova"},{"line_number":53,"context_line":"    delete \u003d admin,service-nova"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"There are two possible ways to interpret the above file."},{"line_number":56,"context_line":" * Option one is that if both normal roles and service roles are specified"},{"line_number":57,"context_line":"   at least one from each group is required, is is probably the option that"},{"line_number":58,"context_line":"   could allow for a bit more flexiblity. As it would cause certain options"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_9ac4d592","line":55,"in_reply_to":"7a740942_d59b3271","updated":"2015-12-10 12:07:38.000000000","message":"The advantage I see is that you could require someone to be potentially have the service role nova and role member. This could mean you can restrict to certain user roles.","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"5aa1f5ee8a751ffbcf5c85ecd651fff1b2df01a4","unresolved":false,"context_lines":[{"line_number":157,"context_line":"------------"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Possibly give Nova administrator permissions and have it update the"},{"line_number":160,"context_line":"images, however this is not practial."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Data model impact"},{"line_number":163,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_381f0d5d","line":160,"updated":"2015-12-09 21:39:37.000000000","message":"I\u0027m not sure it\u0027s not practical, so much as it\u0027s unnecessarily allowing Nova full admin privileges simply to do CRUD on some image properties.","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"391a7a5c696c24328d1013ef94d057a78224d430","unresolved":false,"context_lines":[{"line_number":157,"context_line":"------------"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Possibly give Nova administrator permissions and have it update the"},{"line_number":160,"context_line":"images, however this is not practial."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Data model impact"},{"line_number":163,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_5a550dc4","line":160,"in_reply_to":"7a740942_381f0d5d","updated":"2015-12-10 12:07:38.000000000","message":"\"After creation of the image from snapshotting or shelving the instance, those properties will be set by nova using its admin credentials.\"\n\nThis is the current thing being suggested by the nova spec: \thttps://review.openstack.org/#/c/206431/.\n\nIt may not be practical but its what was proposed in nova.","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"9b447c2c5cbbd510f7861a0dc83e3bcb0f0a350e","unresolved":false,"context_lines":[{"line_number":157,"context_line":"------------"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Possibly give Nova administrator permissions and have it update the"},{"line_number":160,"context_line":"images, however this is not practial."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Data model impact"},{"line_number":163,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_437c41eb","line":160,"in_reply_to":"7a740942_43ec4129","updated":"2015-12-10 14:07:24.000000000","message":"I misunderstood, I incorrectly read the double negative. Yeah I completely agree.","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"e05efde38dcc74a07d6a3cd1df94832c605a7b69","unresolved":false,"context_lines":[{"line_number":157,"context_line":"------------"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Possibly give Nova administrator permissions and have it update the"},{"line_number":160,"context_line":"images, however this is not practial."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Data model impact"},{"line_number":163,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_43ec4129","line":160,"in_reply_to":"7a740942_5a550dc4","updated":"2015-12-10 13:43:00.000000000","message":"Sorry, I wasn\u0027t clear in my earlier comment.  What I meant is that you\u0027re saying that a reason *not* to take the nova alternative is that it\u0027s not practical ... I think it is practical (and easy, we wouldn\u0027t have to do anything on our end), it\u0027s just that it\u0027s like using a sledgehammer to kill a gnat.  I think the objection is that the Nova-admin-creds alternative gives Nova way more privileges than it needs simply to set some image properties.","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"5aa1f5ee8a751ffbcf5c85ecd651fff1b2df01a4","unresolved":false,"context_lines":[{"line_number":174,"context_line":""},{"line_number":175,"context_line":"The user would have additional roles than normal when authorizing changes"},{"line_number":176,"context_line":"to protected properties. However for most cases these still would be"},{"line_number":177,"context_line":"considered separately."},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Notifications impact"},{"line_number":180,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_989f21b4","line":177,"updated":"2015-12-09 21:39:37.000000000","message":"I don\u0027t quite follow your second sentence.","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"391a7a5c696c24328d1013ef94d057a78224d430","unresolved":false,"context_lines":[{"line_number":174,"context_line":""},{"line_number":175,"context_line":"The user would have additional roles than normal when authorizing changes"},{"line_number":176,"context_line":"to protected properties. However for most cases these still would be"},{"line_number":177,"context_line":"considered separately."},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Notifications impact"},{"line_number":180,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a740942_9af935cb","line":177,"in_reply_to":"7a740942_989f21b4","updated":"2015-12-10 12:07:38.000000000","message":"Done","commit_id":"9a871ee821e3fb43faecff16615c5732ff028541"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"cfa8a4a8558b666e5716c240e61d3b91064b07ae","unresolved":false,"context_lines":[{"line_number":38,"context_line":"cost property to the new image."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"In the following example the X-Auth-Token is for tennant \u0027joe\u0027 and he"},{"line_number":41,"context_line":"has the role \u0027member\u0027. The X-Servce-Token is for the tenant \u0027nova\u0027 with"},{"line_number":42,"context_line":"the role \u0027nova\u0027. These roles are not hardcoded, and Glance can work with"},{"line_number":43,"context_line":"any user and service roles supplied."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a740942_da256fae","line":41,"updated":"2015-12-10 15:38:48.000000000","message":"Missing \u0027i\u0027 in \u0027Servce\u0027","commit_id":"010896c2cfc387e726a7b90a09d240301d90b91d"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"e59dc78afc82d74a645ff1ff65a5d2a011393bb5","unresolved":false,"context_lines":[{"line_number":38,"context_line":"cost property to the new image."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"In the following example the X-Auth-Token is for tennant \u0027joe\u0027 and he"},{"line_number":41,"context_line":"has the role \u0027member\u0027. The X-Servce-Token is for the tenant \u0027nova\u0027 with"},{"line_number":42,"context_line":"the role \u0027nova\u0027. These roles are not hardcoded, and Glance can work with"},{"line_number":43,"context_line":"any user and service roles supplied."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a740942_2109b884","line":41,"in_reply_to":"7a740942_da256fae","updated":"2015-12-11 10:56:40.000000000","message":"Done","commit_id":"010896c2cfc387e726a7b90a09d240301d90b91d"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"cfa8a4a8558b666e5716c240e61d3b91064b07ae","unresolved":false,"context_lines":[{"line_number":49,"context_line":"    create \u003d admin,service-nova"},{"line_number":50,"context_line":"    read \u003d admin,service-nova"},{"line_number":51,"context_line":"    update \u003d admin,service-nova"},{"line_number":52,"context_line":"    delete \u003d admin,service-nova"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"The configuration treats all roles the same. If it contains a member or"},{"line_number":55,"context_line":"service role permission is granted. If the user needs to do more complex"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a740942_5ae73f12","line":52,"updated":"2015-12-10 15:38:48.000000000","message":"I have a question about this example.  You said above that the service has the role \u0027nova\u0027 ... are you proposing that your new code would prefix a service\u0027s roles with \u0027service-\u0027 before handing them over?  (This may be left over from your earlier patch where you needed to distinguish between user roles and service roles.)","commit_id":"010896c2cfc387e726a7b90a09d240301d90b91d"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"e59dc78afc82d74a645ff1ff65a5d2a011393bb5","unresolved":false,"context_lines":[{"line_number":49,"context_line":"    create \u003d admin,service-nova"},{"line_number":50,"context_line":"    read \u003d admin,service-nova"},{"line_number":51,"context_line":"    update \u003d admin,service-nova"},{"line_number":52,"context_line":"    delete \u003d admin,service-nova"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"The configuration treats all roles the same. If it contains a member or"},{"line_number":55,"context_line":"service role permission is granted. If the user needs to do more complex"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a740942_41eac475","line":52,"in_reply_to":"7a740942_5ae73f12","updated":"2015-12-11 10:56:40.000000000","message":"I have updated this to just nova in the next patch. Yeah it was left over, it was initially done to make the service roles clearer.","commit_id":"010896c2cfc387e726a7b90a09d240301d90b91d"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"95903621d05cd9301261c19ff53e1c38fad45a35","unresolved":false,"context_lines":[{"line_number":37,"context_line":"child image it would be useful if Nova could then add a new licence"},{"line_number":38,"context_line":"cost property to the new image."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"In the following example the X-Auth-Token is for tennant \u0027joe\u0027 and he"},{"line_number":41,"context_line":"has the role \u0027member\u0027. The X-Service-Token is for the tenant \u0027nova\u0027 with"},{"line_number":42,"context_line":"the role \u0027nova\u0027. These roles are not hardcoded, and Glance can work with"},{"line_number":43,"context_line":"any user and service roles supplied."}],"source_content_type":"text/x-rst","patch_set":8,"id":"7a740942_94d46120","line":40,"updated":"2015-12-11 15:23:13.000000000","message":"nit: tennant -\u003e tenant","commit_id":"d7c53bca93a709ef405a216ce2821a130b35bb1d"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"ba3b0a90bb54d6428389201cb2e445b5f2f578a9","unresolved":false,"context_lines":[{"line_number":37,"context_line":"child image it would be useful if Nova could then add a new licence"},{"line_number":38,"context_line":"cost property to the new image."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"In the following example the X-Auth-Token is for tennant \u0027joe\u0027 and he"},{"line_number":41,"context_line":"has the role \u0027member\u0027. The X-Service-Token is for the tenant \u0027nova\u0027 with"},{"line_number":42,"context_line":"the role \u0027nova\u0027. These roles are not hardcoded, and Glance can work with"},{"line_number":43,"context_line":"any user and service roles supplied."}],"source_content_type":"text/x-rst","patch_set":8,"id":"7a740942_66326060","line":40,"in_reply_to":"7a740942_94d46120","updated":"2015-12-11 17:03:30.000000000","message":"Done","commit_id":"d7c53bca93a709ef405a216ce2821a130b35bb1d"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"95903621d05cd9301261c19ff53e1c38fad45a35","unresolved":false,"context_lines":[{"line_number":54,"context_line":"The configuration treats all roles the same. If it contains a member or"},{"line_number":55,"context_line":"service role permission is granted. If the user needs to do more complex"},{"line_number":56,"context_line":"things such as make sure a user has the member role and the nova role"},{"line_number":57,"context_line":"they can use the policy file."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Example: User snapshotting an image therefore creating a child image::"},{"line_number":60,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"7a740942_efb86e13","line":57,"updated":"2015-12-11 15:23:13.000000000","message":"I think it would be worth rewriting this paragraph.\n\nFirst, you want to emphasize that the semantics of the prop protection conf file is unchanged by this spec.  Thus if the deployer has configured property_protection_rule_format \u003d roles ... (explain how it works).  (By the way, it would be a good idea to add \u0027member\u0027 to the read privileges in the above example--it would make it more realistic, plus since you introduced the role in the paragraph setting up the example, you might as well use it.)\n\nThen you could mention the \"complex\" case you describe and point out that it can be handled by configuring property_protection_rule_format \u003d policies and writing rules in policy.json to handle that case.\n\nIt\u0027s up to you whether you want to do a full-fledged example of that case.  In one sense it\u0027s kind of tedious both to write up and read, but in another, I find it useful to at least sketch out the example on paper (in this case, the changes in both the policy.json and in the prop protect config file) because sometimes something that seems simple and easy turns out to have some weird corner cases that you encounter in doing an actual example.\n\nIn any case, the key thing here is to make it clear that the semantics of the pp config is not changed under your proposal.  (It\u0027s helpful for whoever\u0027s following up on the DocImpact of your spec.)","commit_id":"d7c53bca93a709ef405a216ce2821a130b35bb1d"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"ba3b0a90bb54d6428389201cb2e445b5f2f578a9","unresolved":false,"context_lines":[{"line_number":54,"context_line":"The configuration treats all roles the same. If it contains a member or"},{"line_number":55,"context_line":"service role permission is granted. If the user needs to do more complex"},{"line_number":56,"context_line":"things such as make sure a user has the member role and the nova role"},{"line_number":57,"context_line":"they can use the policy file."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Example: User snapshotting an image therefore creating a child image::"},{"line_number":60,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"7a740942_db73f14c","line":57,"in_reply_to":"7a740942_efb86e13","updated":"2015-12-11 17:03:30.000000000","message":"Yeah I decided to do an example as that is the more complicated one would be the policy one.","commit_id":"d7c53bca93a709ef405a216ce2821a130b35bb1d"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"95903621d05cd9301261c19ff53e1c38fad45a35","unresolved":false,"context_lines":[{"line_number":151,"context_line":"Possibly give Nova administrator permissions and have it update the"},{"line_number":152,"context_line":"images. This would mean that we have to do nothing our end. However"},{"line_number":153,"context_line":"this would give the Nova admin credentials unnecessary privileges it"},{"line_number":154,"context_line":"does not need."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Data model impact"},{"line_number":157,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"7a740942_8f89aa28","line":154,"updated":"2015-12-11 15:23:13.000000000","message":"You might as well include a reference to the review for that nova spec, as it indicates that your alternative has actually been seriously considered by the community.","commit_id":"d7c53bca93a709ef405a216ce2821a130b35bb1d"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"ba3b0a90bb54d6428389201cb2e445b5f2f578a9","unresolved":false,"context_lines":[{"line_number":151,"context_line":"Possibly give Nova administrator permissions and have it update the"},{"line_number":152,"context_line":"images. This would mean that we have to do nothing our end. However"},{"line_number":153,"context_line":"this would give the Nova admin credentials unnecessary privileges it"},{"line_number":154,"context_line":"does not need."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Data model impact"},{"line_number":157,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"7a740942_db9c516c","line":154,"in_reply_to":"7a740942_8f89aa28","updated":"2015-12-11 17:03:30.000000000","message":"Linked to the bottom.","commit_id":"d7c53bca93a709ef405a216ce2821a130b35bb1d"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"95903621d05cd9301261c19ff53e1c38fad45a35","unresolved":false,"context_lines":[{"line_number":167,"context_line":"---------------"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"The user would have additional roles than normal when authorizing changes"},{"line_number":170,"context_line":"to protected properties."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"Notifications impact"},{"line_number":173,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"7a740942_2cfbe1c2","line":170,"updated":"2015-12-11 15:23:13.000000000","message":"It would be good to be more precise here.  The additional roles only occur in a particular context where a service is making a call on behalf of a user (and the prop protections config recognizes the additional service roles).  What I mean is, using your example, if joe just makes a normal PATCH v2/images/image_id call directly to the API, he\u0027s only going to have the \u0027member\u0027 role, and won\u0027t be able to change the billing_whatever property on his image.  So it\u0027s more like there will be additional roles showing up in particular request contexts, and unless the deployer modifies the prop protect config, there will be no impact at all.  (I think that\u0027s an important point to make.)\n\nBacking up a bit, the security considerations with respect to protected properties are: after this change, will a user be able to modify properties that he previously could not?\n\nAnd actually, this brings up an important point, because the Compute API does allow end users like joe to modify image properties [1].  How are you going to distinguish Nova making a \"good\" request to modify properties (e.g., when it\u0027s creating a snapshot) from a \"bad\" request to modify properties (e.g., joe makes a PUT /v2.1/​{tenant_id}​/images/​{image_id}​/metadata/​billing_whatever call to the compute API)?\n\n[1] http://developer.openstack.org/api-ref-compute-v2.1.html#compute_image_metadata-v2.1","commit_id":"d7c53bca93a709ef405a216ce2821a130b35bb1d"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"ba3b0a90bb54d6428389201cb2e445b5f2f578a9","unresolved":false,"context_lines":[{"line_number":167,"context_line":"---------------"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"The user would have additional roles than normal when authorizing changes"},{"line_number":170,"context_line":"to protected properties."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"Notifications impact"},{"line_number":173,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"7a740942_a605a87a","line":170,"in_reply_to":"7a740942_2cfbe1c2","updated":"2015-12-11 17:03:30.000000000","message":"That is a good point, I guess we would have to rely upon the other services to either have different tokens for different purposes. Or sometimes not supply us with the service token.","commit_id":"d7c53bca93a709ef405a216ce2821a130b35bb1d"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"1e5de498b6ca5ca706830cca9ba00d745a79c3c1","unresolved":false,"context_lines":[{"line_number":32,"context_line":"with a user\u0027s usual roles. The combined roles would be considered when"},{"line_number":33,"context_line":"authorizing changes to protected properties."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"An example would be licence cost on an image, you would not usally want"},{"line_number":36,"context_line":"an user to be able to modify the cost. However when Nova is creating a"},{"line_number":37,"context_line":"child image it would be useful if Nova could then add a new licence"},{"line_number":38,"context_line":"cost property to the new image."}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a7e1126_e2609203","line":35,"range":{"start_line":35,"start_character":60,"end_line":35,"end_character":66},"updated":"2015-12-18 14:41:41.000000000","message":"usually","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"3a4a6ce8c32856a3b1f0b56df9a8c72e32b59664","unresolved":false,"context_lines":[{"line_number":32,"context_line":"with a user\u0027s usual roles. The combined roles would be considered when"},{"line_number":33,"context_line":"authorizing changes to protected properties."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"An example would be licence cost on an image, you would not usally want"},{"line_number":36,"context_line":"an user to be able to modify the cost. However when Nova is creating a"},{"line_number":37,"context_line":"child image it would be useful if Nova could then add a new licence"},{"line_number":38,"context_line":"cost property to the new image."}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa69d971_89eb0eb0","line":35,"range":{"start_line":35,"start_character":60,"end_line":35,"end_character":66},"in_reply_to":"3a7e1126_e2609203","updated":"2016-01-04 14:34:44.000000000","message":"Done","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"1e5de498b6ca5ca706830cca9ba00d745a79c3c1","unresolved":false,"context_lines":[{"line_number":46,"context_line":"the following(where nova is the service role)::"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    [^billing_.*]"},{"line_number":49,"context_line":"    create \u003d admin,nova"},{"line_number":50,"context_line":"    read \u003d admin,member,nova"},{"line_number":51,"context_line":"    update \u003d admin,nova"},{"line_number":52,"context_line":"    delete \u003d admin,nova"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a7e1126_515b6ef6","line":49,"range":{"start_line":49,"start_character":13,"end_line":49,"end_character":18},"updated":"2015-12-18 14:41:41.000000000","message":"Would it be useful to allow admin to manage properties by default?","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"61ce40944c69c292a4b7ca9158aa11ca4a04894b","unresolved":false,"context_lines":[{"line_number":46,"context_line":"the following(where nova is the service role)::"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    [^billing_.*]"},{"line_number":49,"context_line":"    create \u003d admin,nova"},{"line_number":50,"context_line":"    read \u003d admin,member,nova"},{"line_number":51,"context_line":"    update \u003d admin,nova"},{"line_number":52,"context_line":"    delete \u003d admin,nova"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a7e1126_52cd3485","line":49,"range":{"start_line":49,"start_character":13,"end_line":49,"end_character":18},"in_reply_to":"3a7e1126_515b6ef6","updated":"2015-12-22 15:30:07.000000000","message":"Interesting idea, Kairat, but I think property protections have been around too long for us to change that aspect.","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"3a4a6ce8c32856a3b1f0b56df9a8c72e32b59664","unresolved":false,"context_lines":[{"line_number":46,"context_line":"the following(where nova is the service role)::"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    [^billing_.*]"},{"line_number":49,"context_line":"    create \u003d admin,nova"},{"line_number":50,"context_line":"    read \u003d admin,member,nova"},{"line_number":51,"context_line":"    update \u003d admin,nova"},{"line_number":52,"context_line":"    delete \u003d admin,nova"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa69d971_6e5ee077","line":49,"range":{"start_line":49,"start_character":13,"end_line":49,"end_character":18},"in_reply_to":"3a7e1126_52cd3485","updated":"2016-01-04 14:34:44.000000000","message":"I agree, It does not seem like a change we can really make.","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"1e5de498b6ca5ca706830cca9ba00d745a79c3c1","unresolved":false,"context_lines":[{"line_number":60,"context_line":"use the property-protections-policy.conf file. It may look something"},{"line_number":61,"context_line":"like the following::"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"    [^billing_.*]"},{"line_number":64,"context_line":"    create \u003d user_and_service (\"role:user and role:nova\")"},{"line_number":65,"context_line":"    read \u003d default (\"\")"},{"line_number":66,"context_line":"    update \u003d context_is_admin (\"role:admin\")"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a7e1126_e3717145","line":63,"range":{"start_line":63,"start_character":6,"end_line":63,"end_character":14},"updated":"2015-12-18 14:41:41.000000000","message":"Do I understand correctly that this restriction will be applied to all tenants?\nSo all users will be prohibited to create an image with\nbilling_price (or smth else properties) property. Do we need to be tenant-specific here? Could you please explain how to avoid this?","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"61ce40944c69c292a4b7ca9158aa11ca4a04894b","unresolved":false,"context_lines":[{"line_number":60,"context_line":"use the property-protections-policy.conf file. It may look something"},{"line_number":61,"context_line":"like the following::"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"    [^billing_.*]"},{"line_number":64,"context_line":"    create \u003d user_and_service (\"role:user and role:nova\")"},{"line_number":65,"context_line":"    read \u003d default (\"\")"},{"line_number":66,"context_line":"    update \u003d context_is_admin (\"role:admin\")"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a7e1126_92815cc6","line":63,"range":{"start_line":63,"start_character":6,"end_line":63,"end_character":14},"in_reply_to":"3a7e1126_e3717145","updated":"2015-12-22 15:30:07.000000000","message":"I\u0027m not sure this is actually a problem.  In practice, a deployer would most likely block off \"^com.mycloud_.*\" and tell users not to try to name any of their properties with that prefix.  Or the deployer could enumerate each protected property in the config file.  Not sure exactly what you mean about being tenant-specific, but a deployer does have the ability to refer to particular tenants in the policy file.","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"1e5de498b6ca5ca706830cca9ba00d745a79c3c1","unresolved":false,"context_lines":[{"line_number":114,"context_line":"      |           |          |-|-------\u003e\u003e+-+           |            |"},{"line_number":115,"context_line":"      |           |          |-|         |-|           |            |"},{"line_number":116,"context_line":"      | Keystone POST /v3/auth/tokens (admin port)     |            |"},{"line_number":117,"context_line":"      | X-Subject-Token: 1234|-|         |-|           |            |"},{"line_number":118,"context_line":"      | Body: {\u0027adminuser\u0027: \u0027admin\u0027, \u0027adminpassword\u0027: \u0027pass\u0027}       |"},{"line_number":119,"context_line":"      |           |          |-|         |-|           |            |"},{"line_number":120,"context_line":"      |          +-+\u003c\u003c-------------------|-|           |            |"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a7e1126_b6fac841","line":117,"range":{"start_line":117,"start_character":10,"end_line":117,"end_character":17},"updated":"2015-12-18 14:41:41.000000000","message":"Subject-token?","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"61ce40944c69c292a4b7ca9158aa11ca4a04894b","unresolved":false,"context_lines":[{"line_number":114,"context_line":"      |           |          |-|-------\u003e\u003e+-+           |            |"},{"line_number":115,"context_line":"      |           |          |-|         |-|           |            |"},{"line_number":116,"context_line":"      | Keystone POST /v3/auth/tokens (admin port)     |            |"},{"line_number":117,"context_line":"      | X-Subject-Token: 1234|-|         |-|           |            |"},{"line_number":118,"context_line":"      | Body: {\u0027adminuser\u0027: \u0027admin\u0027, \u0027adminpassword\u0027: \u0027pass\u0027}       |"},{"line_number":119,"context_line":"      |           |          |-|         |-|           |            |"},{"line_number":120,"context_line":"      |          +-+\u003c\u003c-------------------|-|           |            |"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a7b0d38_6ef64fd9","line":117,"range":{"start_line":117,"start_character":10,"end_line":117,"end_character":17},"in_reply_to":"3a7e1126_b6fac841","updated":"2015-12-22 15:30:07.000000000","message":"This is glance validating the user\u0027s token.  In keystone v3 the token you want to validate is passed in the X-Subject-Token header.  (This happens again at line 128 when glance is validating the service token.)","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"61ce40944c69c292a4b7ca9158aa11ca4a04894b","unresolved":false,"context_lines":[{"line_number":184,"context_line":"of a user. So if no changes are made to accept the service tokens from"},{"line_number":185,"context_line":"a service this will have no change at all. However with the service the"},{"line_number":186,"context_line":"user will be able to make changes he previously could not."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Notifications impact"},{"line_number":189,"context_line":"--------------------"},{"line_number":190,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a7b0d38_51ca1451","line":187,"updated":"2015-12-22 15:30:07.000000000","message":"I want to follow up on a comment I made on PS8.\n\nThe Compute API does allow end users like \u0027joe\u0027 (defined above) to modify image properties [1].  How are you going to distinguish Nova making a \"good\" request to modify properties (e.g., when it\u0027s creating a snapshot) from a \"bad\" request to modify properties (e.g., joe makes a PUT /v2.1/​{tenant_id}​/images/​{image_id}​/metadata/​billing_whatever call to the Compute API)?  (I\u0027m pretty sure that in the process of creating a snapshot, Nova updates some image properties.  From the Nova point of view, this is all happening in a single transaction, but from the Glance point of view, it\u0027s receiving separate calls from Nova.)\n\nI don\u0027t think you can just say, \"don\u0027t configure Glance to allow the nova service token to modify image properties if you\u0027re worried about this\", because the motivation for this spec is to handle precisely this situation, i.e., allow Nova to have an escalation of privileges during snapshot creation.\n\nI\u0027m pretty sure this situation is unique to the nova-glance relationship, given that nova acts as a proxy to glance for the Compute API\u0027s image-related calls.  And it may be as easy to implement as making sure that nova only passes the service token in the snapshot context, and no where else.  My point is that somehow we have to make sure this information is communicated to the people who are maintaining the nova code.  Or (and probably better) we need to make sure that on the glance side, we can distinguish image property changes happening during a snapshot from those not occurring in that context.\n\n[1] http://developer.openstack.org/api-ref-compute-v2.1.html#compute_image_metadata-v2.1","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"},{"author":{"_account_id":17116,"name":"Niall Bunting","email":"niall.bunting@hpe.com","username":"NiallBunting"},"change_message_id":"3a4a6ce8c32856a3b1f0b56df9a8c72e32b59664","unresolved":false,"context_lines":[{"line_number":184,"context_line":"of a user. So if no changes are made to accept the service tokens from"},{"line_number":185,"context_line":"a service this will have no change at all. However with the service the"},{"line_number":186,"context_line":"user will be able to make changes he previously could not."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Notifications impact"},{"line_number":189,"context_line":"--------------------"},{"line_number":190,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa69d971_e9c5ea3b","line":187,"in_reply_to":"1a7b0d38_51ca1451","updated":"2016-01-04 14:34:44.000000000","message":"I think it will come down to nova only using there service token when they want increased privileges.\n\nIf we consider what the alternative was of them using there Admin token we would be in the same situation as if they always use it.\n\nI agree with you that the hard part is communicating it to the Nova people but I think this is the best solution.","commit_id":"795418bb97334557c9249f66cd3730b8d44226db"}]}