)]}'
{"specs/backlog/token-constraints.rst":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"1e88f454ec4fa6dfe5b91e3ac5958dfc9e4ddf7f","unresolved":false,"context_lines":[{"line_number":33,"context_line":"Token Middleware (or analog) based on RBAC."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The token shall carry additional constraints placed there by the person who"},{"line_number":36,"context_line":"requested the token\u0027s creation.  If a constraint is placed on the token, it"},{"line_number":37,"context_line":"can only be used for an operation where that constraint is met."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The set of additional constraints are:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a80dd14_de2c53ae","line":36,"updated":"2015-03-05 03:42:15.000000000","message":"So how are the new constraints declared when the token is created? Can you provide an example?","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f59aaa2b4bb8997ae943e0872d3a7e0cee18299b","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The token shall carry additional constraints placed there by the person who"},{"line_number":36,"context_line":"requested the token\u0027s creation.  If a constraint is placed on the token, it"},{"line_number":37,"context_line":"can only be used for an operation where that constraint is met."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The set of additional constraints are:"},{"line_number":40,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aaa499b_4bcc066a","line":37,"updated":"2015-04-14 23:45:55.000000000","message":"Token constraint should be transparent to the end user. Otherwise, it would be a big drawback for UX. I don\u0027t think end users necessary need to know the intricacies at the API level, unless we have higher level of abstractions that can be easily comprehend.","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"1e88f454ec4fa6dfe5b91e3ac5958dfc9e4ddf7f","unresolved":false,"context_lines":[{"line_number":36,"context_line":"requested the token\u0027s creation.  If a constraint is placed on the token, it"},{"line_number":37,"context_line":"can only be used for an operation where that constraint is met."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The set of additional constraints are:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a80dd14_9ead7b34","line":39,"updated":"2015-03-05 03:42:15.000000000","message":"Very cool!  I really like how you modeled this as constraints!","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"3e7aa2f9fa0b2df982b32b51d484d05df8aa83f2","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Each of these will be a list of one or more unique identifiers."},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa53dc9_86c2b932","line":43,"updated":"2015-04-10 09:37:15.000000000","message":"should we include service type as well?  Two concerns: 1) in a dynamic cloud the endpoints of a given service might change quicker than a token lifetime, 2) If you really just want a \"nova\" token, then having to specify all the endpoints leads to token bloat.","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"42d82ad5a2f56fd7f34a5da402cae80bcdb42006","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Each of these will be a list of one or more unique identifiers."},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aaa499b_06fd053a","line":43,"in_reply_to":"9aa53dc9_86c2b932","updated":"2015-04-13 21:04:28.000000000","message":"Had some time to think about it.  I think this can be done with judicious use of policy.  Something like not:constraint(...) or constraint_service(serve) or constraint_endpoint(endpoint)  so that if any one of the rules pass, the whole thing passes.","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f59aaa2b4bb8997ae943e0872d3a7e0cee18299b","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be"},{"line_number":48,"context_line":"used for.  If a valid token is handed to an endpoint, and the endpoint"},{"line_number":49,"context_line":"identifier of that endpoint is not in the list, the endpoint will reject the"},{"line_number":50,"context_line":"request as unauthorized."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Operations are the specific list of operations that the token can be used to"},{"line_number":53,"context_line":"perform.  If a requested operation is not in the list, the endpoint will reject"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aaa499b_4bd3e604","line":50,"updated":"2015-04-14 23:45:55.000000000","message":"This use case will be satisfied by endpoint enforcement middleware. Endpoint group definition and assignments APIs has been implemented at the server side.","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"1e88f454ec4fa6dfe5b91e3ac5958dfc9e4ddf7f","unresolved":false,"context_lines":[{"line_number":58,"context_line":"operations.  If a requested  operation is on an entity not in the list, the"},{"line_number":59,"context_line":"endpoint will reject the request as unauthorized."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The absense of an entity identifier will not preclude a new entity of that type"},{"line_number":62,"context_line":"being created with the token and additional operations performed on it;  they"},{"line_number":63,"context_line":"refer to existing entities only."},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a80dd14_de7e13ae","line":61,"updated":"2015-03-05 03:42:15.000000000","message":"Nit: absense should be absence","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f59aaa2b4bb8997ae943e0872d3a7e0cee18299b","unresolved":false,"context_lines":[{"line_number":81,"context_line":"                   \u0027network:get_floating_ip\u0027, \u0027image:get_image\u0027,"},{"line_number":82,"context_line":"                   \u0027network:update_port\u0027 ]"},{"line_number":83,"context_line":"      entities:[\u0027imageid1\u0027,\u0027networkport2\u0027]"},{"line_number":84,"context_line":"  }"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Since the nova server would not have created the instance yet, there would be"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7aaa499b_2bf53a82","line":84,"updated":"2015-04-14 23:45:55.000000000","message":"ouch! just imagine nova renamed one of those APIs as part of refactoring effort. :)","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"5ed7677d78b250120b13038fef6dedcfe7b226bd","unresolved":false,"context_lines":[{"line_number":130,"context_line":"  single API interaction to consume significant server resources? Some examples"},{"line_number":131,"context_line":"  of this include launching subprocesses for each connection, or entity"},{"line_number":132,"context_line":"  expansion attacks in XML."},{"line_number":133,"context_line":"* No.  There will be no database lookups based on the additional data.  All the"},{"line_number":134,"context_line":"* data required to enforce the new constraints will be in the request or in the"},{"line_number":135,"context_line":"  token."},{"line_number":136,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_2eb43033","line":133,"updated":"2015-12-02 18:07:33.000000000","message":"not even if not existing entities are passed?","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"5ed7677d78b250120b13038fef6dedcfe7b226bd","unresolved":false,"context_lines":[{"line_number":155,"context_line":"------------------"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"There should be an imperceptable change in the enforcement of RBAC to account"},{"line_number":158,"context_line":"for the confirmation of additional constraints."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Other Deployer Impact"},{"line_number":161,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_aecca0bb","line":158,"updated":"2015-12-02 18:07:33.000000000","message":"I guess in overall it is improved, once keystone will restrict some things that would be done on the service itself","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"5ed7677d78b250120b13038fef6dedcfe7b226bd","unresolved":false,"context_lines":[{"line_number":212,"context_line":"Dependencies"},{"line_number":213,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"Constrain enforcement depends on policy enforcement.  This is currently done"},{"line_number":216,"context_line":"throughout OpenStack on a one off basis per project.  This enforcement needs"},{"line_number":217,"context_line":"to be centralized in Keystone Client."},{"line_number":218,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_53283de2","line":215,"updated":"2015-12-02 18:07:33.000000000","message":"nit: Constraint","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"5ed7677d78b250120b13038fef6dedcfe7b226bd","unresolved":false,"context_lines":[{"line_number":214,"context_line":""},{"line_number":215,"context_line":"Constrain enforcement depends on policy enforcement.  This is currently done"},{"line_number":216,"context_line":"throughout OpenStack on a one off basis per project.  This enforcement needs"},{"line_number":217,"context_line":"to be centralized in Keystone Client."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_f31851d5","line":217,"updated":"2015-12-02 18:07:33.000000000","message":"keystoneauth now, right?","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"5ed7677d78b250120b13038fef6dedcfe7b226bd","unresolved":false,"context_lines":[{"line_number":221,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"Requires documentation of the changes to request and token format, as well as"},{"line_number":224,"context_line":"the implications for using the constrains."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_d37aedf0","line":224,"updated":"2015-12-02 18:07:33.000000000","message":"nit: constraints","commit_id":"636743e3f41e08f10189ce8f643448aef1c4e5c0"}],"specs/kilo/token-constraints.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"61405eb07c5fa43d416efebdb4a897c7923d0b05","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"da9df570_aec0122b","updated":"2014-09-24 14:52:49.000000000","message":"I think this will have an impact on keystonemiddleware or keystoneclient, but it\u0027s not mentioned anywhere","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"19073056e359568411c66c23d92b71b5f501af68","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"da9df570_71717ddf","in_reply_to":"da9df570_aec0122b","updated":"2014-09-26 01:58:00.000000000","message":"It certainly will, and also oslo policy, as I don\u0027t think keystone alone can enforce the operation and entity constraints.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fc45110386caacaf4a9c1e625c9c8fa465a1de56","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem Description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"A token can be used to perform any action in OpenStack that the user has permission to do.  However, the user quickly loses control of the token by handing it to another service.  Horizon and Nova are both responsible for a wide array of tokens that have outlived their intended operations."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_e8718978","line":21,"updated":"2014-09-29 16:09:37.000000000","message":"How does it work from end-to-end? Can you please specify some use case here? We need to make sure user experience is not adversely impacted.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fdd59c0f225f7aada6caa7b1d9ebdb394eccaed0","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem Description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"A token can be used to perform any action in OpenStack that the user has permission to do.  However, the user quickly loses control of the token by handing it to another service.  Horizon and Nova are both responsible for a wide array of tokens that have outlived their intended operations."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_e15fc60c","line":21,"in_reply_to":"baa201ad_e8718978","updated":"2014-09-30 16:11:00.000000000","message":"To start with, no constraints will be added to tokens, and there will be no impact. I\u0027ll try to spell out the expected path below.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fc45110386caacaf4a9c1e625c9c8fa465a1de56","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"A token is an authorization document.  The primary data used for authorization today is the set of roles. This limitation is enforced on the endpoint via Auth Token Middleware (or analog) based on RBAC."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The token shall carry additional constraints placed there by the person who reqeusted the token\u0027s creation.  If a constraint is placed on the token, it can only be used for an operation where that constraint is met."},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_e81fc907","line":28,"updated":"2014-09-29 16:09:37.000000000","message":"That\u0027s not entirely true. Oslo.policy can match any user attributes, not necessarily just roles. i.e. I can setup a policy to authorize on user_id.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fdd59c0f225f7aada6caa7b1d9ebdb394eccaed0","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"A token is an authorization document.  The primary data used for authorization today is the set of roles. This limitation is enforced on the endpoint via Auth Token Middleware (or analog) based on RBAC."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The token shall carry additional constraints placed there by the person who reqeusted the token\u0027s creation.  If a constraint is placed on the token, it can only be used for an operation where that constraint is met."},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_a1acdeee","line":28,"in_reply_to":"baa201ad_e81fc907","updated":"2014-09-30 16:11:00.000000000","message":"That is why I said \"Primary Data.\"","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fc45110386caacaf4a9c1e625c9c8fa465a1de56","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"A token is an authorization document.  The primary data used for authorization today is the set of roles. This limitation is enforced on the endpoint via Auth Token Middleware (or analog) based on RBAC."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The token shall carry additional constraints placed there by the person who reqeusted the token\u0027s creation.  If a constraint is placed on the token, it can only be used for an operation where that constraint is met."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"The set of additional constraints are:"},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_28ad5189","line":30,"updated":"2014-09-29 16:09:37.000000000","message":"That\u0027s fine. But we need to be careful about the size of token data. For example, if a deployment is consists of hundreds of endpoints, token data could get big if one have access to all the endpoints.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fdd59c0f225f7aada6caa7b1d9ebdb394eccaed0","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"A token is an authorization document.  The primary data used for authorization today is the set of roles. This limitation is enforced on the endpoint via Auth Token Middleware (or analog) based on RBAC."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The token shall carry additional constraints placed there by the person who reqeusted the token\u0027s creation.  If a constraint is placed on the token, it can only be used for an operation where that constraint is met."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"The set of additional constraints are:"},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_0183ea56","line":30,"in_reply_to":"baa201ad_28ad5189","updated":"2014-09-30 16:11:00.000000000","message":"So I think that endpoint contraints wopuld fill the \"id only service catalog\" proposal Morgan has been touting.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"246266307b3f7836febcef3210283031f27a85a0","unresolved":false,"context_lines":[{"line_number":32,"context_line":"The set of additional constraints are:"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":35,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":36,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Each of these will be a list of one or more unique identifiers. "}],"source_content_type":"text/x-rst","patch_set":1,"id":"da9df570_c7da824b","line":35,"updated":"2014-09-25 10:04:53.000000000","message":"The endpoints can be listed from keystone. Should the operations be listable as well (from keystone, or from the concerned service), or is the user expected to know in advance the exact unique identifier of the API call she wants to put a constraint on ?","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fdd59c0f225f7aada6caa7b1d9ebdb394eccaed0","unresolved":false,"context_lines":[{"line_number":32,"context_line":"The set of additional constraints are:"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":35,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":36,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Each of these will be a list of one or more unique identifiers. "}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_6182f650","line":35,"in_reply_to":"baa201ad_e8c9895b","updated":"2014-09-30 16:11:00.000000000","message":"No.  A user should be able to restrict delegation to a subset of what they can do, regardless of what roles they are assigned.  Roles are course grained, Constraints would be fine grained.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fc45110386caacaf4a9c1e625c9c8fa465a1de56","unresolved":false,"context_lines":[{"line_number":32,"context_line":"The set of additional constraints are:"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":35,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":36,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Each of these will be a list of one or more unique identifiers. "}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_e8c9895b","line":35,"in_reply_to":"da9df570_917981ca","updated":"2014-09-29 16:09:37.000000000","message":"IMO, constraint operations is overkill. Isn\u0027t that what policy is used for?","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"19073056e359568411c66c23d92b71b5f501af68","unresolved":false,"context_lines":[{"line_number":32,"context_line":"The set of additional constraints are:"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":35,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":36,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Each of these will be a list of one or more unique identifiers. "}],"source_content_type":"text/x-rst","patch_set":1,"id":"da9df570_917981ca","line":35,"in_reply_to":"da9df570_c7da824b","updated":"2014-09-26 01:58:00.000000000","message":"Operations should be listable, and that should be part of the policy API.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fc45110386caacaf4a9c1e625c9c8fa465a1de56","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":35,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":36,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Each of these will be a list of one or more unique identifiers. "},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_28db911c","line":36,"updated":"2014-09-29 16:09:37.000000000","message":"This one is too vague. Can you please be more specific? What\u0027s the use case?","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fdd59c0f225f7aada6caa7b1d9ebdb394eccaed0","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":35,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":36,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Each of these will be a list of one or more unique identifiers. "},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_61f916e9","line":36,"in_reply_to":"baa201ad_28db911c","updated":"2014-09-30 16:11:00.000000000","message":"Its a generic way of saying \"only this vm can mount this image and link to this network port\"\n\n\nThe assumption is that IDs are very unlike to clash between, say, vms and images, so that if we just specify the image id, we won\u0027t accidentally provide access to valid VM.  There is no real reason to specify the type of the entity.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fc45110386caacaf4a9c1e625c9c8fa465a1de56","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Each of these will be a list of one or more unique identifiers. "},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be used for.  If a valid token is handed to an endpoint, and the endpoint identifier of that endpoint is not in the list, the endpoint will reject the request as unauthorized."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Operations are the specific list of operations that the token can be used to perform.  If a requested operation is not in the list, the endpoint will reject the request as unauthorized. "},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_086a4d1a","line":40,"updated":"2014-09-29 16:09:37.000000000","message":"If one have access to hundreds of endpoints, token data size will be a concern. I think we need some alternatives. Like\n\n 1. filter/wildcard match\n 2. filter by region/service combination\n 3. extension API to call back to Keystone to validate endpoint","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fdd59c0f225f7aada6caa7b1d9ebdb394eccaed0","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Each of these will be a list of one or more unique identifiers. "},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be used for.  If a valid token is handed to an endpoint, and the endpoint identifier of that endpoint is not in the list, the endpoint will reject the request as unauthorized."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Operations are the specific list of operations that the token can be used to perform.  If a requested operation is not in the list, the endpoint will reject the request as unauthorized. "},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_e15266dc","line":40,"in_reply_to":"baa201ad_086a4d1a","updated":"2014-09-30 16:11:00.000000000","message":"Only those actually requested will be in the token;  assumption is only one of any particular service ,as otherwise finind entities is impossible anyway (where do I look for image id XYZ if I have multiple glance servers?)\n\nWildcards won;t work on endpoint ids.\n\n  This has to be enforceable at the endpoint.  We could add in services and regions as potential constraint types, but I don\u0027t know if an endpoint even knows its service ID or region id.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fc45110386caacaf4a9c1e625c9c8fa465a1de56","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be used for.  If a valid token is handed to an endpoint, and the endpoint identifier of that endpoint is not in the list, the endpoint will reject the request as unauthorized."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Operations are the specific list of operations that the token can be used to perform.  If a requested operation is not in the list, the endpoint will reject the request as unauthorized. "},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Entities are the specific unique identifiers for entities of all types;  the scoping of the type of entities is assumed to be performed by the set of operations.  If a requested  operation is on an entity not in the list, the endpoint will reject the request as unauthorized.  "},{"line_number":45,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_08ffad35","line":42,"updated":"2014-09-29 16:09:37.000000000","message":"As mentioned above, I think this is overkill. We should let the policy do its thing. I am also concern about user experience. Some operation may be compound operations, asking the end user to explicitly requesting the operations will hurt user experience.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fdd59c0f225f7aada6caa7b1d9ebdb394eccaed0","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be used for.  If a valid token is handed to an endpoint, and the endpoint identifier of that endpoint is not in the list, the endpoint will reject the request as unauthorized."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Operations are the specific list of operations that the token can be used to perform.  If a requested operation is not in the list, the endpoint will reject the request as unauthorized. "},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Entities are the specific unique identifiers for entities of all types;  the scoping of the type of entities is assumed to be performed by the set of operations.  If a requested  operation is on an entity not in the list, the endpoint will reject the request as unauthorized.  "},{"line_number":45,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_81727a7a","line":42,"in_reply_to":"baa201ad_08ffad35","updated":"2014-09-30 16:11:00.000000000","message":"I think the constraint list  can be automatically generated for certain workloads.  Lets get the enforcement mechanism in place, and then we can streamline the mechanism for definition.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fc45110386caacaf4a9c1e625c9c8fa465a1de56","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Operations are the specific list of operations that the token can be used to perform.  If a requested operation is not in the list, the endpoint will reject the request as unauthorized. "},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Entities are the specific unique identifiers for entities of all types;  the scoping of the type of entities is assumed to be performed by the set of operations.  If a requested  operation is on an entity not in the list, the endpoint will reject the request as unauthorized.  "},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"The absense of an entity identifier will not preclude a new entity of that type being created with the token and additional operations performed on it;  they refer to existing entities only."},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_c8bbe570","line":44,"updated":"2014-09-29 16:09:37.000000000","message":"Again, user experience is a concern here. We are placing too much responsibility on the end users.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fdd59c0f225f7aada6caa7b1d9ebdb394eccaed0","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Operations are the specific list of operations that the token can be used to perform.  If a requested operation is not in the list, the endpoint will reject the request as unauthorized. "},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Entities are the specific unique identifiers for entities of all types;  the scoping of the type of entities is assumed to be performed by the set of operations.  If a requested  operation is on an entity not in the list, the endpoint will reject the request as unauthorized.  "},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"The absense of an entity identifier will not preclude a new entity of that type being created with the token and additional operations performed on it;  they refer to existing entities only."},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_21d9ce57","line":44,"in_reply_to":"baa201ad_c8bbe570","updated":"2014-09-30 16:11:00.000000000","message":"Should not have to be explicit.  Trusts are a great example of ways that limited tokens could be precanned;  A user could say \"use a specifiec trust whenever I am going to create a new vm\"  and have that user be both trustor and trustee, with only the operations and endpoints required for that operation specified in the trust.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"246266307b3f7836febcef3210283031f27a85a0","unresolved":false,"context_lines":[{"line_number":58,"context_line":"------------"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"None.  This is a new feature that can only be enforced this way."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Security Impact"},{"line_number":63,"context_line":"---------------"},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da9df570_e70dc6e9","line":61,"updated":"2014-09-25 10:04:53.000000000","message":"If this functionality is to be applied to trust-issued tokens only, couldn\u0027t this be achieved through (very fine-grained, as in one role per operation) roles definitions ?","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"19073056e359568411c66c23d92b71b5f501af68","unresolved":false,"context_lines":[{"line_number":58,"context_line":"------------"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"None.  This is a new feature that can only be enforced this way."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Security Impact"},{"line_number":63,"context_line":"---------------"},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da9df570_5143996b","line":61,"in_reply_to":"da9df570_e70dc6e9","updated":"2014-09-26 01:58:00.000000000","message":"For Trust tokens, yes, but that seems excessive.  A user cannot current request a token for themselves with a subset of their roles unless they create a trusts with themselves as trustee, which seems excessive, too.","commit_id":"f16e733ff3722fec37d9ebe35d058069c140dc25"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"4b2e261a9c966a91e0ae4ee7ae459710b275bf94","unresolved":false,"context_lines":[{"line_number":34,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":35,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":36,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Each of these will be a list of one or more unique identifiers. "},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be used for.  If a valid token is handed to an endpoint, and the endpoint identifier of that endpoint is not in the list, the endpoint will reject the request as unauthorized."}],"source_content_type":"text/x-rst","patch_set":2,"id":"baa201ad_1f4833b2","line":37,"updated":"2014-10-15 18:07:48.000000000","message":"validity time is another constraint. The validity time of the delegated token may be less than the validity time of the creator\u0027s authz token.\n\nwhether the token is delegate-able or not is another constraint. The creator may or may not wish the delegated entity to be able to further delegate the token","commit_id":"1c9e43a4b9ebb331eb4f6bb6b48557ccf1b5e39d"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"4b2e261a9c966a91e0ae4ee7ae459710b275bf94","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Each of these will be a list of one or more unique identifiers. "},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be used for.  If a valid token is handed to an endpoint, and the endpoint identifier of that endpoint is not in the list, the endpoint will reject the request as unauthorized."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Operations are the specific list of operations that the token can be used to perform.  If a requested operation is not in the list, the endpoint will reject the request as unauthorized. "}],"source_content_type":"text/x-rst","patch_set":2,"id":"baa201ad_7fb3ff99","line":39,"updated":"2014-10-15 18:07:48.000000000","message":"Clearly validity time and delegate-able are not of this format.\nValidity time will be a time period (or maybe expiration time).\nDelegate-able could be a boolean, or an integer (depth of delegation)","commit_id":"1c9e43a4b9ebb331eb4f6bb6b48557ccf1b5e39d"},{"author":{"_account_id":11428,"name":"Ajaya Agrawal","email":"ajku.agr@gmail.com","username":"ajayaa"},"change_message_id":"acbad0c422ea8ecc27c531e6e2288565cee38a42","unresolved":false,"context_lines":[{"line_number":124,"context_line":"Performance Impact"},{"line_number":125,"context_line":"------------------"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"There should be an imperceptable change in the enforcement of RBAC to account for the confirmation of additional constraints."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Other Deployer Impact"},{"line_number":130,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baa201ad_8fb07c44","line":127,"updated":"2014-10-15 16:03:09.000000000","message":"As tokens will become more restrictive, you would require either same or more number of tokens to perform same set of actions. This would be an impact on performance, although it is hard to come up with numbers to support this.","commit_id":"1c9e43a4b9ebb331eb4f6bb6b48557ccf1b5e39d"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"4b2e261a9c966a91e0ae4ee7ae459710b275bf94","unresolved":false,"context_lines":[{"line_number":124,"context_line":"Performance Impact"},{"line_number":125,"context_line":"------------------"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"There should be an imperceptable change in the enforcement of RBAC to account for the confirmation of additional constraints."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Other Deployer Impact"},{"line_number":130,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baa201ad_1f52f334","line":127,"in_reply_to":"baa201ad_8fb07c44","updated":"2014-10-15 18:07:48.000000000","message":"Tokens only optionally become more restrictive. So there is no need to increase the number of tokens. You simply add less restrictions","commit_id":"1c9e43a4b9ebb331eb4f6bb6b48557ccf1b5e39d"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"2843ba51c16e322f34fea508d296bc9d8f864cba","unresolved":false,"context_lines":[{"line_number":33,"context_line":"Token Middleware (or analog) based on RBAC."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The token shall carry additional constraints placed there by the person who"},{"line_number":36,"context_line":"reqeusted the token\u0027s creation.  If a constraint is placed on the token, it"},{"line_number":37,"context_line":"can only be used for an operation where that constraint is met."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The set of additional constraints are:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_c37bbf79","line":36,"updated":"2014-10-29 18:25:21.000000000","message":"\"reqeusted\" \u003d\u003e  \"requested\"","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"3e3670d14b410168f0f73b82afaf466676529be1","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The set of additional constraints are:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_71aad41a","line":41,"updated":"2014-10-20 16:42:57.000000000","message":"Can\u0027t this be achieved by scoping roles to service?  If a service has NovaRole then it can execute only nova operations.  If we use the roles scoped to service or qualified with namespace, that should solve all these issues.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"15d20726f111af3097c680dc7806835a4ed55ee0","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The set of additional constraints are:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_97992d7b","line":41,"in_reply_to":"9aa7fdbe_71aad41a","updated":"2014-10-28 00:55:28.000000000","message":"@Haneef,\n\nThe only difference is that NovaRole might work on 15 nova endpoints where you want to limit a project\u0027s scoped tokens to interact with a limited subset of these endpoints.\n\nI think that there is value of the Service-Scoped role concept as well.\n\nThink of this as something that would allow the *same* configurations and roles to work (based on limiting interaction with the endpoints) for a production deployment (nova endpoints X, Y, Z) and a staging deployment (nova endpoints, Q, R). It also would allow the user/consumer of the token to know what endpoints they can interact with. In the case of the service-scoped roles you would still need to attempt to interact with a service to know if you were allowed.\n\nIn short, 2 different concepts with different benefits.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e79d8b367a57682d1204171d09545b7cf9d1e293","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The set of additional constraints are:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_94c3cc89","line":41,"in_reply_to":"9aa7fdbe_93cdc033","updated":"2014-10-29 23:56:21.000000000","message":"@Haneef, I think we are talking about endpoint enforcement here. Endpoint group, like role assignment, is just setting up the relationship. This spec is for enforcement.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"3f5a4317301fb6b40124e521316630d0e893ff72","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The set of additional constraints are:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_93cdc033","line":41,"in_reply_to":"9aa7fdbe_97992d7b","updated":"2014-10-28 02:21:58.000000000","message":"@Morgan\nI think we discussed this in Atlanta.  Won\u0027t endpoint grouping and endpoint filtering handle your usecase?","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"15d20726f111af3097c680dc7806835a4ed55ee0","unresolved":false,"context_lines":[{"line_number":39,"context_line":"The set of additional constraints are:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Each of these will be a list of one or more unique identifiers."}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_d78e552d","line":42,"updated":"2014-10-28 00:55:28.000000000","message":"This bit is dependent on the discussions at the Paris summit.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e79d8b367a57682d1204171d09545b7cf9d1e293","unresolved":false,"context_lines":[{"line_number":39,"context_line":"The set of additional constraints are:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Each of these will be a list of one or more unique identifiers."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_14d0bc52","line":42,"in_reply_to":"9aa7fdbe_d78e552d","updated":"2014-10-29 23:56:21.000000000","message":"I agreed. Think UX. I doubt average end user can comprehend this kind of complexity. Or perhaps this is transparent to the end users? Like endpoint grouping/filtering APIs? An example would be nice.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e79d8b367a57682d1204171d09545b7cf9d1e293","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Operations are the specific list of operations that the token can be used to"},{"line_number":53,"context_line":"perform.  If a requested operation is not in the list, the endpoint will reject"},{"line_number":54,"context_line":"the request as unauthorized."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Entities are the specific unique identifiers for entities of all types;  the"},{"line_number":57,"context_line":"scoping of the type of entities is assumed to be performed by the set of"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_343138a3","line":54,"updated":"2014-10-29 23:56:21.000000000","message":"This is interesting. Still some missing details I think. How does it work from end-to-end? How does end user know which operation to restrict?","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"15d20726f111af3097c680dc7806835a4ed55ee0","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Entities are the specific unique identifiers for entities of all types;  the"},{"line_number":57,"context_line":"scoping of the type of entities is assumed to be performed by the set of"},{"line_number":58,"context_line":"operations.  If a requested  operation is on an entity not in the list, the"},{"line_number":59,"context_line":"endpoint will reject the request as unauthorized."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The absense of an entity identifier will not preclude a new entity of that type"},{"line_number":62,"context_line":"being created with the token and additional operations performed on it;  they"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_f78199fb","line":59,"updated":"2014-10-28 00:55:28.000000000","message":"I am concerned this might lead to some more token bloat, as would the policy operation list. I also think the policy list depends on discussions and the results from the Paris summit.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e79d8b367a57682d1204171d09545b7cf9d1e293","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Entities are the specific unique identifiers for entities of all types;  the"},{"line_number":57,"context_line":"scoping of the type of entities is assumed to be performed by the set of"},{"line_number":58,"context_line":"operations.  If a requested  operation is on an entity not in the list, the"},{"line_number":59,"context_line":"endpoint will reject the request as unauthorized."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The absense of an entity identifier will not preclude a new entity of that type"},{"line_number":62,"context_line":"being created with the token and additional operations performed on it;  they"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_f416d0f0","line":59,"in_reply_to":"9aa7fdbe_f78199fb","updated":"2014-10-29 23:56:21.000000000","message":"++, this is an reincarnation of \"extra\" :)\n\nbtw, are we unifying the token binding concept with this one?","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"901dd77359fc2f8c08c066f0c037905e24124c19","unresolved":false,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"  constraints: {"},{"line_number":79,"context_line":"      endpoints: [\u0027novaep\u0027, \u0027glanceep2id\u0027],"},{"line_number":80,"context_line":"      operations: [\u0027\"compute:create\", \"compute:start\", \"network:associate\","},{"line_number":81,"context_line":"                    \"network:get_floating_ip\", \"image:get_image\","},{"line_number":82,"context_line":"                    \"network:update_port\" ]"},{"line_number":83,"context_line":"      entities:[\u0027imageid1\u0027,\u0027networkport2\u0027]"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_2ff2aa9a","line":80,"updated":"2014-10-20 15:40:22.000000000","message":"remove \u0027 or suggest using \u0027 to be consistent with entities and endpoints.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"15d20726f111af3097c680dc7806835a4ed55ee0","unresolved":false,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"  constraints: {"},{"line_number":79,"context_line":"      endpoints: [\u0027novaep\u0027, \u0027glanceep2id\u0027],"},{"line_number":80,"context_line":"      operations: [\u0027\"compute:create\", \"compute:start\", \"network:associate\","},{"line_number":81,"context_line":"                    \"network:get_floating_ip\", \"image:get_image\","},{"line_number":82,"context_line":"                    \"network:update_port\" ]"},{"line_number":83,"context_line":"      entities:[\u0027imageid1\u0027,\u0027networkport2\u0027]"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_7775a930","line":80,"in_reply_to":"9aa7fdbe_2ff2aa9a","updated":"2014-10-28 00:55:28.000000000","message":"move to \" as \u0027 is not valid for json.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e79d8b367a57682d1204171d09545b7cf9d1e293","unresolved":false,"context_lines":[{"line_number":79,"context_line":"      endpoints: [\u0027novaep\u0027, \u0027glanceep2id\u0027],"},{"line_number":80,"context_line":"      operations: [\u0027\"compute:create\", \"compute:start\", \"network:associate\","},{"line_number":81,"context_line":"                    \"network:get_floating_ip\", \"image:get_image\","},{"line_number":82,"context_line":"                    \"network:update_port\" ]"},{"line_number":83,"context_line":"      entities:[\u0027imageid1\u0027,\u0027networkport2\u0027]"},{"line_number":84,"context_line":"  }"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_74b900e9","line":82,"updated":"2014-10-29 23:56:21.000000000","message":"this list could get big. We may ended up dealing with the same problem as service catalog size.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e79d8b367a57682d1204171d09545b7cf9d1e293","unresolved":false,"context_lines":[{"line_number":80,"context_line":"      operations: [\u0027\"compute:create\", \"compute:start\", \"network:associate\","},{"line_number":81,"context_line":"                    \"network:get_floating_ip\", \"image:get_image\","},{"line_number":82,"context_line":"                    \"network:update_port\" ]"},{"line_number":83,"context_line":"      entities:[\u0027imageid1\u0027,\u0027networkport2\u0027]"},{"line_number":84,"context_line":"  }"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_14a19ca9","line":83,"updated":"2014-10-29 23:56:21.000000000","message":"this list doesn\u0027t make sense? are these IDs of various resources? If so, how do we which one is which?","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"15d20726f111af3097c680dc7806835a4ed55ee0","unresolved":false,"context_lines":[{"line_number":140,"context_line":"--------------------"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Audit notifications  might expand to report the new reason for rejected"},{"line_number":143,"context_line":"authorization."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"Other End User Impact"},{"line_number":146,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_f7afd97a","line":143,"updated":"2014-10-28 00:55:28.000000000","message":"I encourage either \"will\" or \"won\u0027t\". Might makes it hard to hit the target - e.g. do we need to do this or not.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"901dd77359fc2f8c08c066f0c037905e24124c19","unresolved":false,"context_lines":[{"line_number":148,"context_line":"Initially there will be no impact.  Over time, as more workflows make use"},{"line_number":149,"context_line":"of the constraints, certain operations that were permitted before will no"},{"line_number":150,"context_line":"longer be permitted, and use behavior may have to change.  Probably the most"},{"line_number":151,"context_line":"common pattern will be for token requests to be more targetted to the"},{"line_number":152,"context_line":"operations for which they are performing."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_8f1716a3","line":151,"updated":"2014-10-20 15:40:22.000000000","message":"targeted*","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"3e3670d14b410168f0f73b82afaf466676529be1","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Discuss things that will affect how you deploy and configure OpenStack"},{"line_number":165,"context_line":"that have not already been mentioned, such as:"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"* No configuration changes will be necessary."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_912c98ad","line":166,"updated":"2014-10-20 16:42:57.000000000","message":"Doesn\u0027t  this impact other services?  Who is going to enforce it? Are the services even willing to enforce?","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"15d20726f111af3097c680dc7806835a4ed55ee0","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Discuss things that will affect how you deploy and configure OpenStack"},{"line_number":165,"context_line":"that have not already been mentioned, such as:"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"* No configuration changes will be necessary."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_97d5ade6","line":166,"in_reply_to":"9aa7fdbe_912c98ad","updated":"2014-10-28 00:55:28.000000000","message":"Largely this will depend on what the next logical step in policy will be. It will be more of a deployer choice than anything else, but we have some bigger questions to answer about policy before we can know what has to be implemented for the various services.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"3f5a4317301fb6b40124e521316630d0e893ff72","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Discuss things that will affect how you deploy and configure OpenStack"},{"line_number":165,"context_line":"that have not already been mentioned, such as:"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"* No configuration changes will be necessary."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_d3a10847","line":166,"in_reply_to":"9aa7fdbe_97d5ade6","updated":"2014-10-28 02:21:58.000000000","message":"How about the user experience?  This also talks about limiting APIs.  Do we expect the deployer to keeptrack of  api changes?  Whenever nova add/change/remove an api, someone should keep track of it and update it.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"15d20726f111af3097c680dc7806835a4ed55ee0","unresolved":false,"context_lines":[{"line_number":170,"context_line":"* This change will take effect once it is implemented.  It will require changes"},{"line_number":171,"context_line":"  to both Keystone server in order to create  tokens with the new constraints,"},{"line_number":172,"context_line":"  and to auth_token middleware in order to process the constraints.  The"},{"line_number":173,"context_line":"  mechanism will not be supported until the auth_token changes are deployed."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"Developer Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_37fb217a","line":173,"updated":"2014-10-28 00:55:28.000000000","message":"See above comment.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"15d20726f111af3097c680dc7806835a4ed55ee0","unresolved":false,"context_lines":[{"line_number":198,"context_line":""},{"line_number":199,"context_line":"Work items or tasks -- break the feature up into the things that need to be"},{"line_number":200,"context_line":"done to implement it. Those parts might end up being done by different people,"},{"line_number":201,"context_line":"but we\u0027re mostly trying to understand the timeline for implementation."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_77f12994","line":201,"updated":"2014-10-28 00:55:28.000000000","message":"This needs work items before it can be approved, but generally the spec is saying all the right things.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"901dd77359fc2f8c08c066f0c037905e24124c19","unresolved":false,"context_lines":[{"line_number":204,"context_line":"Dependencies"},{"line_number":205,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"* Include specific references to specs and/or blueprints in keystone, or in"},{"line_number":208,"context_line":"  other projects, that this one either depends on or is related to."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"* If this requires functionality of another project that is not currently used"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_0f232606","line":207,"updated":"2014-10-20 15:40:22.000000000","message":"Keystone","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"15d20726f111af3097c680dc7806835a4ed55ee0","unresolved":false,"context_lines":[{"line_number":204,"context_line":"Dependencies"},{"line_number":205,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"* Include specific references to specs and/or blueprints in keystone, or in"},{"line_number":208,"context_line":"  other projects, that this one either depends on or is related to."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"* If this requires functionality of another project that is not currently used"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_f734394b","line":207,"in_reply_to":"9aa7fdbe_0f232606","updated":"2014-10-28 00:55:28.000000000","message":"@Lance, this is boilerplate text, it would need to be removed before acceptance.","commit_id":"89e2dd0f130d52f3e323e5bfac0ff4cf63ad356c"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5dcd90006c210600569d52c9eee6dd3a6472e519","unresolved":false,"context_lines":[{"line_number":31,"context_line":"A token is an authorization document.  The primary data used for authorization"},{"line_number":32,"context_line":"today is the set of roles. This limitation is enforced on the endpoint via Auth"},{"line_number":33,"context_line":"Token Middleware (or analog) based on RBAC."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The token shall carry additional constraints placed there by the person who"},{"line_number":36,"context_line":"requested the token\u0027s creation.  If a constraint is placed on the token, it"},{"line_number":37,"context_line":"can only be used for an operation where that constraint is met."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_37af0ee5","line":34,"updated":"2014-11-21 08:31:25.000000000","message":"The token already contains one constraint, namely its validity period. Once its validity period has expired, the token can no longer be used.","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9cc76ed42ccc04eb2a74a70f505d66b5d0708b23","unresolved":false,"context_lines":[{"line_number":31,"context_line":"A token is an authorization document.  The primary data used for authorization"},{"line_number":32,"context_line":"today is the set of roles. This limitation is enforced on the endpoint via Auth"},{"line_number":33,"context_line":"Token Middleware (or analog) based on RBAC."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The token shall carry additional constraints placed there by the person who"},{"line_number":36,"context_line":"requested the token\u0027s creation.  If a constraint is placed on the token, it"},{"line_number":37,"context_line":"can only be used for an operation where that constraint is met."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_6bcf2fb1","line":34,"in_reply_to":"5a890539_37af0ee5","updated":"2014-12-16 22:37:13.000000000","message":"++","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"6007e0d589b185a794e3d4cb33958bfd17f735ee","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The token shall carry additional constraints placed there by the person who"},{"line_number":36,"context_line":"requested the token\u0027s creation.  If a constraint is placed on the token, it"},{"line_number":37,"context_line":"can only be used for an operation where that constraint is met."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The set of additional constraints are:"},{"line_number":40,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_4a32b110","line":37,"updated":"2015-01-09 18:33:02.000000000","message":"Could the token include both these new constraints and the service catalog? If so we should filter the service catalog according to the list of endpoints defined by the new token endpoint constraint.","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9cc76ed42ccc04eb2a74a70f505d66b5d0708b23","unresolved":false,"context_lines":[{"line_number":39,"context_line":"The set of additional constraints are:"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Each of these will be a list of one or more unique identifiers."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_0b378bb1","line":42,"updated":"2014-12-16 22:37:13.000000000","message":"\"API\" is super vague here.","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"6007e0d589b185a794e3d4cb33958bfd17f735ee","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Each of these will be a list of one or more unique identifiers."},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_335dc77d","line":43,"updated":"2015-01-09 18:33:02.000000000","message":"Defining a specific list of endpoint identifiers could be a management headache. Can we support endpoint type/region constraints that would simplify assigning access to groups of endpoints and will dynamically allow access to new endpoints of a particular type and region?","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5dcd90006c210600569d52c9eee6dd3a6472e519","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Each of these will be a list of one or more unique identifiers."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_978b6267","line":44,"updated":"2014-11-21 08:31:25.000000000","message":"Validity Period: The user may set a reduced validity period\n\n(this is assuming the user currently has no control over the validity period and that it is automatically set. If this is not true, then scap this additional constraint)","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"680b96b8a9e37c389e3ac3cf47abc23896558abc","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    Endpoints:  a list of endpoint identifiers"},{"line_number":42,"context_line":"    Operations:   a list of APIs that match the values from a policy.json file"},{"line_number":43,"context_line":"    Entities:  A list of entity identifiers"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Each of these will be a list of one or more unique identifiers."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_47852d09","line":44,"in_reply_to":"5a890539_978b6267","updated":"2015-01-09 21:09:46.000000000","message":"Users currently do not have control over validity period of a token. They *can* revoke a token when it is done being used (same effect, just requires manual intervention).","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9cc76ed42ccc04eb2a74a70f505d66b5d0708b23","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be"},{"line_number":48,"context_line":"used for.  If a valid token is handed to an endpoint, and the endpoint"},{"line_number":49,"context_line":"identifier of that endpoint is not in the list, the endpoint will reject the"},{"line_number":50,"context_line":"request as unauthorized."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Operations are the specific list of operations that the token can be used to"},{"line_number":53,"context_line":"perform.  If a requested operation is not in the list, the endpoint will reject"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_4b0fd3e1","line":50,"updated":"2014-12-16 22:37:13.000000000","message":"is this just exposing endpoint filtering to token creation?","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"680b96b8a9e37c389e3ac3cf47abc23896558abc","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Endpoint identifiers are to restrict which service endpoints a token can be"},{"line_number":48,"context_line":"used for.  If a valid token is handed to an endpoint, and the endpoint"},{"line_number":49,"context_line":"identifier of that endpoint is not in the list, the endpoint will reject the"},{"line_number":50,"context_line":"request as unauthorized."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Operations are the specific list of operations that the token can be used to"},{"line_number":53,"context_line":"perform.  If a requested operation is not in the list, the endpoint will reject"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_877f1517","line":50,"in_reply_to":"3a961159_4b0fd3e1","updated":"2015-01-09 21:09:46.000000000","message":"That was my understanding, but clarification would be good.","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9cc76ed42ccc04eb2a74a70f505d66b5d0708b23","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Operations are the specific list of operations that the token can be used to"},{"line_number":53,"context_line":"perform.  If a requested operation is not in the list, the endpoint will reject"},{"line_number":54,"context_line":"the request as unauthorized."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Entities are the specific unique identifiers for entities of all types;  the"},{"line_number":57,"context_line":"scoping of the type of entities is assumed to be performed by the set of"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_4b26f369","line":54,"updated":"2014-12-16 22:37:13.000000000","message":"how does the client know what all the operations are that might be used for a single token?","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"680b96b8a9e37c389e3ac3cf47abc23896558abc","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Operations are the specific list of operations that the token can be used to"},{"line_number":53,"context_line":"perform.  If a requested operation is not in the list, the endpoint will reject"},{"line_number":54,"context_line":"the request as unauthorized."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Entities are the specific unique identifiers for entities of all types;  the"},{"line_number":57,"context_line":"scoping of the type of entities is assumed to be performed by the set of"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_e7753934","line":54,"in_reply_to":"3a961159_4b26f369","updated":"2015-01-09 21:09:46.000000000","message":"I think this is out of scope for this spec and should be moved to a later spec once we have the \"what do i need to do X\" question answerable.\n\nDesign can be kept to allow this in the future.","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5dcd90006c210600569d52c9eee6dd3a6472e519","unresolved":false,"context_lines":[{"line_number":52,"context_line":"Operations are the specific list of operations that the token can be used to"},{"line_number":53,"context_line":"perform.  If a requested operation is not in the list, the endpoint will reject"},{"line_number":54,"context_line":"the request as unauthorized."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Entities are the specific unique identifiers for entities of all types;  the"},{"line_number":57,"context_line":"scoping of the type of entities is assumed to be performed by the set of"},{"line_number":58,"context_line":"operations.  If a requested  operation is on an entity not in the list, the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_d73a4a97","line":55,"updated":"2014-11-21 08:31:25.000000000","message":"Operations should be called permissions, since each is defined as an operation on resource (see later example)","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"d714c2f8015feefb2b85f23a5b2e3f4e259510af","unresolved":false,"context_lines":[{"line_number":52,"context_line":"Operations are the specific list of operations that the token can be used to"},{"line_number":53,"context_line":"perform.  If a requested operation is not in the list, the endpoint will reject"},{"line_number":54,"context_line":"the request as unauthorized."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Entities are the specific unique identifiers for entities of all types;  the"},{"line_number":57,"context_line":"scoping of the type of entities is assumed to be performed by the set of"},{"line_number":58,"context_line":"operations.  If a requested  operation is on an entity not in the list, the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_4b55c8c4","line":55,"in_reply_to":"5a890539_d73a4a97","updated":"2014-12-18 19:18:21.000000000","message":"++","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"680b96b8a9e37c389e3ac3cf47abc23896558abc","unresolved":false,"context_lines":[{"line_number":53,"context_line":"perform.  If a requested operation is not in the list, the endpoint will reject"},{"line_number":54,"context_line":"the request as unauthorized."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Entities are the specific unique identifiers for entities of all types;  the"},{"line_number":57,"context_line":"scoping of the type of entities is assumed to be performed by the set of"},{"line_number":58,"context_line":"operations.  If a requested  operation is on an entity not in the list, the"},{"line_number":59,"context_line":"endpoint will reject the request as unauthorized."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_a79b3165","line":56,"updated":"2015-01-09 21:09:46.000000000","message":"This verbiage is confusing, it looks ot be self defnining what \"entities\" is.","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5dcd90006c210600569d52c9eee6dd3a6472e519","unresolved":false,"context_lines":[{"line_number":61,"context_line":"The absense of an entity identifier will not preclude a new entity of that type"},{"line_number":62,"context_line":"being created with the token and additional operations performed on it;  they"},{"line_number":63,"context_line":"refer to existing entities only."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"The create_trust API will allow specifying restrictions on trust definitions."},{"line_number":67,"context_line":"These constraints will be added to all tokens created with the trust."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_b705bec3","line":64,"updated":"2014-11-21 08:31:25.000000000","message":"This is broken. If the token can create entity A, then subsequently if the requester wants to read entity A, it will fail, since A is not in the list of entities. What component of the infrastructure is going to remember that A was created by this requester sometime previously using this same token?","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"680b96b8a9e37c389e3ac3cf47abc23896558abc","unresolved":false,"context_lines":[{"line_number":61,"context_line":"The absense of an entity identifier will not preclude a new entity of that type"},{"line_number":62,"context_line":"being created with the token and additional operations performed on it;  they"},{"line_number":63,"context_line":"refer to existing entities only."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"The create_trust API will allow specifying restrictions on trust definitions."},{"line_number":67,"context_line":"These constraints will be added to all tokens created with the trust."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_27a741a9","line":64,"in_reply_to":"5a890539_b705bec3","updated":"2015-01-09 21:09:46.000000000","message":"++ This is a bad ux. I am not sure how we should fix it. Perhaps the entity list is also out-of-scope for the original spec.","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9cc76ed42ccc04eb2a74a70f505d66b5d0708b23","unresolved":false,"context_lines":[{"line_number":75,"context_line":""},{"line_number":76,"context_line":".. code-block:: javascript"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"  constraints: {"},{"line_number":79,"context_line":"      endpoints: [\u0027novaep\u0027, \u0027glanceep2id\u0027],"},{"line_number":80,"context_line":"      operations: [\u0027compute:create\u0027, \u0027compute:start\u0027, \u0027network:associate\u0027,"},{"line_number":81,"context_line":"                   \u0027network:get_floating_ip\u0027, \u0027image:get_image\u0027,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_2bd8c752","line":78,"updated":"2014-12-16 22:37:13.000000000","message":"this isn\u0027t javascript","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"680b96b8a9e37c389e3ac3cf47abc23896558abc","unresolved":false,"context_lines":[{"line_number":75,"context_line":""},{"line_number":76,"context_line":".. code-block:: javascript"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"  constraints: {"},{"line_number":79,"context_line":"      endpoints: [\u0027novaep\u0027, \u0027glanceep2id\u0027],"},{"line_number":80,"context_line":"      operations: [\u0027compute:create\u0027, \u0027compute:start\u0027, \u0027network:associate\u0027,"},{"line_number":81,"context_line":"                   \u0027network:get_floating_ip\u0027, \u0027image:get_image\u0027,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_87ad5587","line":78,"in_reply_to":"3a961159_2bd8c752","updated":"2015-01-09 21:09:46.000000000","message":"Isn\u0027t javascript the correct form for JSON code blocks in RST?","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":11819,"name":"Chaoyi Huang","email":"joehuang@huawei.com","username":"joehuang"},"change_message_id":"7a24d667b97021911c747392588ec3209e624a1d","unresolved":false,"context_lines":[{"line_number":76,"context_line":".. code-block:: javascript"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"  constraints: {"},{"line_number":79,"context_line":"      endpoints: [\u0027novaep\u0027, \u0027glanceep2id\u0027],"},{"line_number":80,"context_line":"      operations: [\u0027compute:create\u0027, \u0027compute:start\u0027, \u0027network:associate\u0027,"},{"line_number":81,"context_line":"                   \u0027network:get_floating_ip\u0027, \u0027image:get_image\u0027,"},{"line_number":82,"context_line":"                   \u0027network:update_port\u0027 ]"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_3a1ff30a","line":79,"updated":"2014-12-02 03:40:01.000000000","message":"constraints should also indicate which url(publicURL, adminURL,internalURL) the user can access","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9cc76ed42ccc04eb2a74a70f505d66b5d0708b23","unresolved":false,"context_lines":[{"line_number":76,"context_line":".. code-block:: javascript"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"  constraints: {"},{"line_number":79,"context_line":"      endpoints: [\u0027novaep\u0027, \u0027glanceep2id\u0027],"},{"line_number":80,"context_line":"      operations: [\u0027compute:create\u0027, \u0027compute:start\u0027, \u0027network:associate\u0027,"},{"line_number":81,"context_line":"                   \u0027network:get_floating_ip\u0027, \u0027image:get_image\u0027,"},{"line_number":82,"context_line":"                   \u0027network:update_port\u0027 ]"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_8be61b15","line":79,"in_reply_to":"5a890539_3a1ff30a","updated":"2014-12-16 22:37:13.000000000","message":"v3 API refers to those as interfaces","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"6007e0d589b185a794e3d4cb33958bfd17f735ee","unresolved":false,"context_lines":[{"line_number":79,"context_line":"      endpoints: [\u0027novaep\u0027, \u0027glanceep2id\u0027],"},{"line_number":80,"context_line":"      operations: [\u0027compute:create\u0027, \u0027compute:start\u0027, \u0027network:associate\u0027,"},{"line_number":81,"context_line":"                   \u0027network:get_floating_ip\u0027, \u0027image:get_image\u0027,"},{"line_number":82,"context_line":"                   \u0027network:update_port\u0027 ]"},{"line_number":83,"context_line":"      entities:[\u0027imageid1\u0027,\u0027networkport2\u0027]"},{"line_number":84,"context_line":"  }"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_53d5f319","line":82,"updated":"2015-01-09 18:33:02.000000000","message":"Are we going to support wild cards to represent permission to execute all operations on a service e.g. compute:*","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"680b96b8a9e37c389e3ac3cf47abc23896558abc","unresolved":false,"context_lines":[{"line_number":79,"context_line":"      endpoints: [\u0027novaep\u0027, \u0027glanceep2id\u0027],"},{"line_number":80,"context_line":"      operations: [\u0027compute:create\u0027, \u0027compute:start\u0027, \u0027network:associate\u0027,"},{"line_number":81,"context_line":"                   \u0027network:get_floating_ip\u0027, \u0027image:get_image\u0027,"},{"line_number":82,"context_line":"                   \u0027network:update_port\u0027 ]"},{"line_number":83,"context_line":"      entities:[\u0027imageid1\u0027,\u0027networkport2\u0027]"},{"line_number":84,"context_line":"  }"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_07c1652f","line":82,"in_reply_to":"3a961159_53d5f319","updated":"2015-01-09 21:09:46.000000000","message":"See above comment on scope of this spec.","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"d714c2f8015feefb2b85f23a5b2e3f4e259510af","unresolved":false,"context_lines":[{"line_number":80,"context_line":"      operations: [\u0027compute:create\u0027, \u0027compute:start\u0027, \u0027network:associate\u0027,"},{"line_number":81,"context_line":"                   \u0027network:get_floating_ip\u0027, \u0027image:get_image\u0027,"},{"line_number":82,"context_line":"                   \u0027network:update_port\u0027 ]"},{"line_number":83,"context_line":"      entities:[\u0027imageid1\u0027,\u0027networkport2\u0027]"},{"line_number":84,"context_line":"  }"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_0b4bc02b","line":83,"updated":"2014-12-18 19:18:21.000000000","message":"How does policy enforcement knows id1 is for glance operations and id2 is for neutron operations? Ids are just random uuid strings.","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"5dcd90006c210600569d52c9eee6dd3a6472e519","unresolved":false,"context_lines":[{"line_number":89,"context_line":"would be accessable from glance, and only the \"get_image\" API would be allowed"},{"line_number":90,"context_line":"on glance.  Only access to \u0027networkport2\u0027 would be granted from Neutron."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":""},{"line_number":93,"context_line":""},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_f7b4a6f3","line":92,"updated":"2014-11-21 08:31:25.000000000","message":"How can compute:start work, since the instance ID is not in the list of entities","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9cc76ed42ccc04eb2a74a70f505d66b5d0708b23","unresolved":false,"context_lines":[{"line_number":95,"context_line":"Alternatives"},{"line_number":96,"context_line":"------------"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"None.  This is a new feature that can only be enforced this way."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Security Impact"},{"line_number":101,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_ebc4ff60","line":98,"updated":"2014-12-16 22:37:13.000000000","message":"you\u0027re focusing on the solution, not the problem. what other solutions will solve the same problem?","commit_id":"ce80215cbef000272f19cf23aeea3d5f7373d405"}]}