)]}'
{"specs/kilo/pluggable_assignments.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0cb5a19ac2a71705561b357f3507561db760b6a4","unresolved":false,"context_lines":[{"line_number":24,"context_line":"actual identity piece (i.e. users and groups). Within this \"assignment\""},{"line_number":25,"context_line":"component we have the store for domains, projects, roles....and the actual"},{"line_number":26,"context_line":"assignments themselves. Domains, projects and roles are the lingua franca"},{"line_number":27,"context_line":"used throughout openstack for policy control to APIs. The actual assignment"},{"line_number":28,"context_line":"relationships between these entities (which are stored in keystone) are not"},{"line_number":29,"context_line":"shared outside of keystone - rather these assignments are used to determine"},{"line_number":30,"context_line":"which roles are included in a token for a given user for a given scope of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_f43eb728","line":27,"updated":"2014-10-20 15:13:32.000000000","message":"OpenStack*","commit_id":"7f6e6cc05b1bfa246f2c17d4d399751a6168a407"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"74756db2e0907f42fe866b14583346cd155f88c2","unresolved":false,"context_lines":[{"line_number":24,"context_line":"actual identity piece (i.e. users and groups). Within this \"assignment\""},{"line_number":25,"context_line":"component we have the store for domains, projects, roles....and the actual"},{"line_number":26,"context_line":"assignments themselves. Domains, projects and roles are the lingua franca"},{"line_number":27,"context_line":"used throughout openstack for policy control to APIs. The actual assignment"},{"line_number":28,"context_line":"relationships between these entities (which are stored in keystone) are not"},{"line_number":29,"context_line":"shared outside of keystone - rather these assignments are used to determine"},{"line_number":30,"context_line":"which roles are included in a token for a given user for a given scope of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_c672bfac","line":27,"in_reply_to":"9aa7fdbe_f43eb728","updated":"2014-10-21 19:02:31.000000000","message":"Done","commit_id":"7f6e6cc05b1bfa246f2c17d4d399751a6168a407"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0cb5a19ac2a71705561b357f3507561db760b6a4","unresolved":false,"context_lines":[{"line_number":25,"context_line":"component we have the store for domains, projects, roles....and the actual"},{"line_number":26,"context_line":"assignments themselves. Domains, projects and roles are the lingua franca"},{"line_number":27,"context_line":"used throughout openstack for policy control to APIs. The actual assignment"},{"line_number":28,"context_line":"relationships between these entities (which are stored in keystone) are not"},{"line_number":29,"context_line":"shared outside of keystone - rather these assignments are used to determine"},{"line_number":30,"context_line":"which roles are included in a token for a given user for a given scope of"},{"line_number":31,"context_line":"target entity (i.e. project or domain).  Hence in reality what we call"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_94172ba3","line":28,"updated":"2014-10-20 15:13:32.000000000","message":"Keystone*","commit_id":"7f6e6cc05b1bfa246f2c17d4d399751a6168a407"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"74756db2e0907f42fe866b14583346cd155f88c2","unresolved":false,"context_lines":[{"line_number":25,"context_line":"component we have the store for domains, projects, roles....and the actual"},{"line_number":26,"context_line":"assignments themselves. Domains, projects and roles are the lingua franca"},{"line_number":27,"context_line":"used throughout openstack for policy control to APIs. The actual assignment"},{"line_number":28,"context_line":"relationships between these entities (which are stored in keystone) are not"},{"line_number":29,"context_line":"shared outside of keystone - rather these assignments are used to determine"},{"line_number":30,"context_line":"which roles are included in a token for a given user for a given scope of"},{"line_number":31,"context_line":"target entity (i.e. project or domain).  Hence in reality what we call"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_0664c7e3","line":28,"in_reply_to":"9aa7fdbe_94172ba3","updated":"2014-10-21 19:02:31.000000000","message":"Done","commit_id":"7f6e6cc05b1bfa246f2c17d4d399751a6168a407"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"5162b3af0cdbfe4f2d3a1daf8a0c0355a13b3792","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"This change would split the current \"assignment\" backend into two:"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"* base-entities, containing domains, projects and roles"},{"line_number":54,"context_line":"* assignments, containing current assignment model"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Making this split will not, in and of itself, have any functional change, but"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_b25a9e4e","line":53,"updated":"2014-10-17 23:16:00.000000000","message":"no, I don\u0027t like the name either...open to suggestions!","commit_id":"7f6e6cc05b1bfa246f2c17d4d399751a6168a407"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0cb5a19ac2a71705561b357f3507561db760b6a4","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":"- Split the controller and backends"},{"line_number":128,"context_line":"- Split up the test cases into relevant files"},{"line_number":129,"context_line":"- Provide a sample alternative controller and backend"},{"line_number":130,"context_line":"- Document how to provide a new assignment controller and backend"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_b4d18fcf","line":129,"updated":"2014-10-20 15:13:32.000000000","message":"Do we have anything in the pipe that will directly benefit from this change?","commit_id":"7f6e6cc05b1bfa246f2c17d4d399751a6168a407"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"f0b0d9608f454125614b18cd81ad0dea6fb196aa","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":"- Split the controller and backends"},{"line_number":128,"context_line":"- Split up the test cases into relevant files"},{"line_number":129,"context_line":"- Provide a sample alternative controller and backend"},{"line_number":130,"context_line":"- Document how to provide a new assignment controller and backend"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_31720c7d","line":129,"in_reply_to":"9aa7fdbe_b4d18fcf","updated":"2014-10-20 16:30:54.000000000","message":"so we have a number of people doing research in this area (e.g. Tahmina Ahmed, as well as various ABAC experimenters)...the idea is to provide a platform for them to experiment with extensions to see which find favour with the community","commit_id":"7f6e6cc05b1bfa246f2c17d4d399751a6168a407"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e3658423d6e2dc52fa52d618ba4228d411c1b750","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"This change would split the current \"assignment\" backend into two:"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"* base-entities, containing domains, projects and roles"},{"line_number":57,"context_line":"* assignments, containing current assignment model"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Making this split will not, in and of itself, have any functional change, but"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_8554bbff","line":56,"updated":"2014-10-26 05:56:06.000000000","message":"Can we call roles/projects/domains \u0027assets\u0027 instead of base? As in... An \u0027assignment\u0027 is a relationship between an \u0027identity\u0027 and an \u0027asset\u0027\n\nOr \u0027resource\u0027, but that is an over used term...","commit_id":"841e7c546c8487db7f47f3246a86f545cfeb14f9"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"7595e99e75a3ae34a0e15d1ae29fae9183e6b404","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"1. Storage and APIs for defining domains, projects and roles."},{"line_number":35,"context_line":"2. Storage and APIs for defining assignment relationships"},{"line_number":36,"context_line":"3. An API to provide a list of roles, for a given user and target so a token"},{"line_number":37,"context_line":"   can be generated"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The fact that the above are all lumped together in one component leads to a"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_92e6a342","line":36,"updated":"2014-10-28 01:06:25.000000000","message":"What about \u0027a list of role assignments\u0027 ... ?","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"339c6bdfdbef37d98fd989ea01bdcf12e8277ba8","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"1. Storage and APIs for defining domains, projects and roles."},{"line_number":35,"context_line":"2. Storage and APIs for defining assignment relationships"},{"line_number":36,"context_line":"3. An API to provide a list of roles, for a given user and target so a token"},{"line_number":37,"context_line":"   can be generated"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The fact that the above are all lumped together in one component leads to a"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_f00ef539","line":36,"in_reply_to":"9aa7fdbe_92e6a342","updated":"2014-10-28 13:20:01.000000000","message":"So i wanted to be more general...since today we have (unfortunately) a number of APIs that do some subset of list_role_assignments.  I\u0027ll make this clearer","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"7595e99e75a3ae34a0e15d1ae29fae9183e6b404","unresolved":false,"context_lines":[{"line_number":50,"context_line":"really need to provide is their own version of 2. (above) and honor the API of"},{"line_number":51,"context_line":"3. However, since the \"assignments\" backend contains all of the three items"},{"line_number":52,"context_line":"above, it is not simple to provide just the actual assignments piece. The"},{"line_number":53,"context_line":"advantage or enabling alternative access control models in this way is that the"},{"line_number":54,"context_line":"rest of OpenStack will continue to work - i.e. not change to token formats or"},{"line_number":55,"context_line":"policy files in other projects. The OpenStack community as a whole will benefit"},{"line_number":56,"context_line":"if we can let Keystone be a platform through which new forms of access control"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_52051b44","line":53,"updated":"2014-10-28 01:06:25.000000000","message":"s/advantage or/advantage of ?","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"7595e99e75a3ae34a0e15d1ae29fae9183e6b404","unresolved":false,"context_lines":[{"line_number":51,"context_line":"3. However, since the \"assignments\" backend contains all of the three items"},{"line_number":52,"context_line":"above, it is not simple to provide just the actual assignments piece. The"},{"line_number":53,"context_line":"advantage or enabling alternative access control models in this way is that the"},{"line_number":54,"context_line":"rest of OpenStack will continue to work - i.e. not change to token formats or"},{"line_number":55,"context_line":"policy files in other projects. The OpenStack community as a whole will benefit"},{"line_number":56,"context_line":"if we can let Keystone be a platform through which new forms of access control"},{"line_number":57,"context_line":"can be brought into play, with the market eventually deciding which of those"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_f29b6f15","line":54,"updated":"2014-10-28 01:06:25.000000000","message":"s/not change/no change ?","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"339c6bdfdbef37d98fd989ea01bdcf12e8277ba8","unresolved":false,"context_lines":[{"line_number":51,"context_line":"3. However, since the \"assignments\" backend contains all of the three items"},{"line_number":52,"context_line":"above, it is not simple to provide just the actual assignments piece. The"},{"line_number":53,"context_line":"advantage or enabling alternative access control models in this way is that the"},{"line_number":54,"context_line":"rest of OpenStack will continue to work - i.e. not change to token formats or"},{"line_number":55,"context_line":"policy files in other projects. The OpenStack community as a whole will benefit"},{"line_number":56,"context_line":"if we can let Keystone be a platform through which new forms of access control"},{"line_number":57,"context_line":"can be brought into play, with the market eventually deciding which of those"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_0b942c89","line":54,"in_reply_to":"9aa7fdbe_f29b6f15","updated":"2014-10-28 13:20:01.000000000","message":"Done","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db3c1a39081dd84bd3d632c024522d7c5d4f26f3","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"This change would split the current \"assignment\" backend into two:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* base-entities, containing domains, projects and roles"},{"line_number":66,"context_line":"* assignments, containing current assignment model"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Making this split will not, in and of itself, have any functional change, but"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_9c5cf21a","line":65,"updated":"2014-10-27 23:48:33.000000000","message":"(nit): As a point from a pure \"python-thinking world\" I\u0027d call it something without a hyphen. This should not hold up the spec.","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"339c6bdfdbef37d98fd989ea01bdcf12e8277ba8","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"This change would split the current \"assignment\" backend into two:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* base-entities, containing domains, projects and roles"},{"line_number":66,"context_line":"* assignments, containing current assignment model"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Making this split will not, in and of itself, have any functional change, but"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_6becd82a","line":65,"in_reply_to":"9aa7fdbe_9c5cf21a","updated":"2014-10-28 13:20:01.000000000","message":"Done","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"7595e99e75a3ae34a0e15d1ae29fae9183e6b404","unresolved":false,"context_lines":[{"line_number":63,"context_line":"This change would split the current \"assignment\" backend into two:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* base-entities, containing domains, projects and roles"},{"line_number":66,"context_line":"* assignments, containing current assignment model"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Making this split will not, in and of itself, have any functional change, but"},{"line_number":69,"context_line":"will enable new assignment models to be introduced with their own APIs via an"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_958f6d74","line":66,"updated":"2014-10-28 01:06:25.000000000","message":"So 2. and 3. above would be merged here?\n\nI think we have grants and role assignments split on Keystone because we wanted to have compatibility with v2 (by not changing the old \u0027grants\u0027 to the new \u0027role assignments\u0027), right? If so, maybe makes sense to have them as a single concept (they have the same semantic).","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db3c1a39081dd84bd3d632c024522d7c5d4f26f3","unresolved":false,"context_lines":[{"line_number":63,"context_line":"This change would split the current \"assignment\" backend into two:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* base-entities, containing domains, projects and roles"},{"line_number":66,"context_line":"* assignments, containing current assignment model"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Making this split will not, in and of itself, have any functional change, but"},{"line_number":69,"context_line":"will enable new assignment models to be introduced with their own APIs via an"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_3cb2264c","line":66,"updated":"2014-10-27 23:48:33.000000000","message":"We could also rename these to something (we call them grants internally, right? maybe we should go with base-entities [some non-hyphen version] and grants?\n\nThis comment should not hold the spec up.","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"339c6bdfdbef37d98fd989ea01bdcf12e8277ba8","unresolved":false,"context_lines":[{"line_number":63,"context_line":"This change would split the current \"assignment\" backend into two:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* base-entities, containing domains, projects and roles"},{"line_number":66,"context_line":"* assignments, containing current assignment model"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Making this split will not, in and of itself, have any functional change, but"},{"line_number":69,"context_line":"will enable new assignment models to be introduced with their own APIs via an"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_2b6bb085","line":66,"in_reply_to":"9aa7fdbe_3cb2264c","updated":"2014-10-28 13:20:01.000000000","message":"so once upon a time we called them grants (in fact the original v3 API use that term).  However, the access control experts (e.g. David Chadwick et al) really don\u0027t like that term...I think for two reasons a) \"granting access\" has other meanings, and b) the grant/assignment here is only one piece of the puzzle, since it doesn\u0027t actually grant them anything on the entity itself - it is used in conjunction with the policy file to actually do the grant of access to a some API....of which Keystone knows nothing.","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"339c6bdfdbef37d98fd989ea01bdcf12e8277ba8","unresolved":false,"context_lines":[{"line_number":63,"context_line":"This change would split the current \"assignment\" backend into two:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* base-entities, containing domains, projects and roles"},{"line_number":66,"context_line":"* assignments, containing current assignment model"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Making this split will not, in and of itself, have any functional change, but"},{"line_number":69,"context_line":"will enable new assignment models to be introduced with their own APIs via an"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_8b32dca4","line":66,"in_reply_to":"9aa7fdbe_958f6d74","updated":"2014-10-28 13:20:01.000000000","message":"So i think we have the API layer (which we need to keep for compatibility)...and then we decide what we want to rationalise at the backend.  You could re-implment (I think) all the various v2 \"list APIs that have something to do with grants/assignment\" all on the one (efficient) manager/driver implementation of list_role_assignments().  The purpose of this spec is not to propose that specific solution - but to make it easier for us to do so.","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db3c1a39081dd84bd3d632c024522d7c5d4f26f3","unresolved":false,"context_lines":[{"line_number":69,"context_line":"will enable new assignment models to be introduced with their own APIs via an"},{"line_number":70,"context_line":"extension.  Such an extension would provide whatever API would be used to"},{"line_number":71,"context_line":"manage the new assignment model, as well as a backend implementation of the"},{"line_number":72,"context_line":"API to get a list of roles, for a given user and target."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"A extremely valuable side benefit of this change would be to make it more"},{"line_number":75,"context_line":"obvious how (and easier) to normalize the various (slightly different) backend"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_dcc03a52","line":72,"updated":"2014-10-27 23:48:33.000000000","message":"This paragraph adds a chunk of confusion - I read it as \"we may manage roles the same way as we do today we may have some future extension that does this\".\n\nI think this is not a directly relevant part of the spec and should be dropped or it should be expanded on how we\u0027re enhancing role management. I would like to see the API be well defined and separated (REST) or it explicitly called out as optional.\n\nThis is thinking from the various movements (e.g. DEFCORE) etc and what we\u0027re validating against both now and future looking.","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"339c6bdfdbef37d98fd989ea01bdcf12e8277ba8","unresolved":false,"context_lines":[{"line_number":69,"context_line":"will enable new assignment models to be introduced with their own APIs via an"},{"line_number":70,"context_line":"extension.  Such an extension would provide whatever API would be used to"},{"line_number":71,"context_line":"manage the new assignment model, as well as a backend implementation of the"},{"line_number":72,"context_line":"API to get a list of roles, for a given user and target."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"A extremely valuable side benefit of this change would be to make it more"},{"line_number":75,"context_line":"obvious how (and easier) to normalize the various (slightly different) backend"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_2b19f021","line":72,"in_reply_to":"9aa7fdbe_dcc03a52","updated":"2014-10-28 13:20:01.000000000","message":"I\u0027ll reword this...","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"85043e81c1df86374f118ce94c3c0706df1cfdfb","unresolved":false,"context_lines":[{"line_number":128,"context_line":"There is likely to be a mild performance impact from this change for list"},{"line_number":129,"context_line":"assignment API calls that return the refs of projects, domains or roles since"},{"line_number":130,"context_line":"we can no longer execute the extraction of assignment ids and their subsequent"},{"line_number":131,"context_line":"turning to refs in one go. The impact of this would be mitigate by supporting"},{"line_number":132,"context_line":"bulk loads of refs from a list of ids in the new base entity drivers. See the"},{"line_number":133,"context_line":"references section for details of early WIP code that shows how this would"},{"line_number":134,"context_line":"be done."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_d232f0a5","line":131,"updated":"2014-10-27 16:18:36.000000000","message":"mitigated*","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"339c6bdfdbef37d98fd989ea01bdcf12e8277ba8","unresolved":false,"context_lines":[{"line_number":128,"context_line":"There is likely to be a mild performance impact from this change for list"},{"line_number":129,"context_line":"assignment API calls that return the refs of projects, domains or roles since"},{"line_number":130,"context_line":"we can no longer execute the extraction of assignment ids and their subsequent"},{"line_number":131,"context_line":"turning to refs in one go. The impact of this would be mitigate by supporting"},{"line_number":132,"context_line":"bulk loads of refs from a list of ids in the new base entity drivers. See the"},{"line_number":133,"context_line":"references section for details of early WIP code that shows how this would"},{"line_number":134,"context_line":"be done."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_ebd0c820","line":131,"in_reply_to":"9aa7fdbe_d232f0a5","updated":"2014-10-28 13:20:01.000000000","message":"Done","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"7595e99e75a3ae34a0e15d1ae29fae9183e6b404","unresolved":false,"context_lines":[{"line_number":137,"context_line":"---------------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Deployers would be able to set the backends for base-entities and assignments"},{"line_number":140,"context_line":"separately, and be default they would be the same (to keep with existing"},{"line_number":141,"context_line":"configuration settings)."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"Developer Impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_3757a159","line":140,"updated":"2014-10-28 01:06:25.000000000","message":"s/be default/by default ?","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"339c6bdfdbef37d98fd989ea01bdcf12e8277ba8","unresolved":false,"context_lines":[{"line_number":137,"context_line":"---------------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Deployers would be able to set the backends for base-entities and assignments"},{"line_number":140,"context_line":"separately, and be default they would be the same (to keep with existing"},{"line_number":141,"context_line":"configuration settings)."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"Developer Impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_0bcc2c88","line":140,"in_reply_to":"9aa7fdbe_3757a159","updated":"2014-10-28 13:20:01.000000000","message":"Done","commit_id":"074590d32131558fe3676ffa852637a39a5a9d4f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"9b7d7ffafd52c72806b8b871ffcb6233e48471c8","unresolved":false,"context_lines":[{"line_number":52,"context_line":"above, it is not simple to provide just the actual assignments piece. The"},{"line_number":53,"context_line":"advantage of enabling alternative access control models in this way is that the"},{"line_number":54,"context_line":"rest of OpenStack will continue to work - i.e. no change to token formats or"},{"line_number":55,"context_line":"policy files in other projects. The OpenStack community as a whole will benefit"},{"line_number":56,"context_line":"if we can let Keystone be a platform through which new forms of access control"},{"line_number":57,"context_line":"can be brought into play, with the market eventually deciding which of those"},{"line_number":58,"context_line":"best matches customer requirements."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aa7fdbe_457700a0","line":55,"updated":"2014-10-28 14:29:31.000000000","message":"I love this last sentence","commit_id":"a7ae4749c0c59facea799b36ede49da134f0fe79"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"58e4d3f2f7383dcdc27ff788eeb2b3adef5070b0","unresolved":false,"context_lines":[{"line_number":63,"context_line":"This change would split the current \"assignment\" controller and backend into"},{"line_number":64,"context_line":"two:"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"* base - containing domains, projects and roles"},{"line_number":67,"context_line":"* assignments - containing current assignment model"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"This change will both simplify the support for the core base entities on which"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aa7fdbe_462e2b8d","line":66,"updated":"2014-10-28 13:21:02.000000000","message":"\u0027base\u0027 ?  \u0027asset\u0027 ? open to other ideas....","commit_id":"a7ae4749c0c59facea799b36ede49da134f0fe79"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"f9f2c01dc7da4a0410b9995a38757b5d42dc2127","unresolved":false,"context_lines":[{"line_number":63,"context_line":"This change would split the current \"assignment\" controller and backend into"},{"line_number":64,"context_line":"two:"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"* base - containing domains, projects and roles"},{"line_number":67,"context_line":"* assignments - containing current assignment model"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"This change will both simplify the support for the core base entities on which"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aa7fdbe_f5189077","line":66,"in_reply_to":"9aa7fdbe_45bd40d7","updated":"2014-10-28 23:25:45.000000000","message":"ok, so \u0027base\u0027 is out.  How about \u0027resource\u0027 (since certainly in ABAC that\u0027s you would call the thing that approximates to domains/projects)?  Or (as suggested by SteveM: \u0027asset\u0027)? Other ideas from other reviewers?","commit_id":"a7ae4749c0c59facea799b36ede49da134f0fe79"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"9b7d7ffafd52c72806b8b871ffcb6233e48471c8","unresolved":false,"context_lines":[{"line_number":63,"context_line":"This change would split the current \"assignment\" controller and backend into"},{"line_number":64,"context_line":"two:"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"* base - containing domains, projects and roles"},{"line_number":67,"context_line":"* assignments - containing current assignment model"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"This change will both simplify the support for the core base entities on which"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aa7fdbe_45bd40d7","line":66,"in_reply_to":"9aa7fdbe_462e2b8d","updated":"2014-10-28 14:29:31.000000000","message":"I don\u0027t like base because to me that implies that the other component will \u0027inherit\u0027 from it in some way. I suck at naming, but in my mind we have (\u0027assignment-entities\u0027 or \u0027assignment-models\u0027) and \u0027assignments\u0027 as the two components we are creating.","commit_id":"a7ae4749c0c59facea799b36ede49da134f0fe79"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9ac6f87e830a4c6a8b79d4b7ca9ec2b79512ed33","unresolved":false,"context_lines":[{"line_number":63,"context_line":"This change would split the current \"assignment\" controller and backend into"},{"line_number":64,"context_line":"two:"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"* base - containing domains, projects and roles"},{"line_number":67,"context_line":"* assignments - containing current assignment model"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"This change will both simplify the support for the core base entities on which"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aa7fdbe_8730ec9f","line":66,"in_reply_to":"9aa7fdbe_f5189077","updated":"2014-10-29 14:18:13.000000000","message":"..remember (as we think about naming) that it is likely that if we do eventually remove domains as an entity (and make it an attribute of a project), then we\u0027ll have just projects and roles left in this part...","commit_id":"a7ae4749c0c59facea799b36ede49da134f0fe79"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"9b7d7ffafd52c72806b8b871ffcb6233e48471c8","unresolved":false,"context_lines":[{"line_number":78,"context_line":"* list_projects_for_user"},{"line_number":79,"context_line":"* list_domains_for_groups"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"This is particular important when inheritance is considered - there is a"},{"line_number":82,"context_line":"general lack of conformity of how assignment inheritance is handled across"},{"line_number":83,"context_line":"the various flavors of driver call - that is currently leading to a number"},{"line_number":84,"context_line":"of defects."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aa7fdbe_255cbc18","line":81,"updated":"2014-10-28 14:29:31.000000000","message":"particularly","commit_id":"a7ae4749c0c59facea799b36ede49da134f0fe79"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e2a9c22a8db08416226bae9f1d3924f8888819c2","unresolved":false,"context_lines":[{"line_number":78,"context_line":"* list_projects_for_user"},{"line_number":79,"context_line":"* list_domains_for_groups"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"This is particular important when inheritance is considered - there is a"},{"line_number":82,"context_line":"general lack of conformity of how assignment inheritance is handled across"},{"line_number":83,"context_line":"the various flavors of driver call - that is currently leading to a number"},{"line_number":84,"context_line":"of defects."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a8c0949_19a3709f","line":81,"in_reply_to":"9aa7fdbe_255cbc18","updated":"2014-10-31 12:27:57.000000000","message":"Done","commit_id":"a7ae4749c0c59facea799b36ede49da134f0fe79"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"9b7d7ffafd52c72806b8b871ffcb6233e48471c8","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"This is particular important when inheritance is considered - there is a"},{"line_number":82,"context_line":"general lack of conformity of how assignment inheritance is handled across"},{"line_number":83,"context_line":"the various flavors of driver call - that is currently leading to a number"},{"line_number":84,"context_line":"of defects."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"A further side benefit of this change is that deployers could choose different"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9aa7fdbe_85a48808","line":83,"updated":"2014-10-28 14:29:31.000000000","message":"calls","commit_id":"a7ae4749c0c59facea799b36ede49da134f0fe79"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e2a9c22a8db08416226bae9f1d3924f8888819c2","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"This is particular important when inheritance is considered - there is a"},{"line_number":82,"context_line":"general lack of conformity of how assignment inheritance is handled across"},{"line_number":83,"context_line":"the various flavors of driver call - that is currently leading to a number"},{"line_number":84,"context_line":"of defects."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"A further side benefit of this change is that deployers could choose different"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a8c0949_d999e86f","line":83,"in_reply_to":"9aa7fdbe_85a48808","updated":"2014-10-31 12:27:57.000000000","message":"Done","commit_id":"a7ae4749c0c59facea799b36ede49da134f0fe79"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"651ba09bf2df5d788f9e1ee338306570a61afa56","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"The assignment controller and backend are really a misnomers - there are"},{"line_number":23,"context_line":"effectively the \"rest-of-identity\", that was left over when we split out the"},{"line_number":24,"context_line":"actual identity piece (i.e. users and groups). Within this \"assignment\""},{"line_number":25,"context_line":"component we have the store for domains, projects, roles....and the actual"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_1e0a6221","line":22,"updated":"2014-11-11 19:35:22.000000000","message":"\u0027a misnomers\u0027 -\u003e \u0027misnomers\u0027 or \u0027a misnomer\u0027","commit_id":"bb508502a7276a894b9110a5713069b6bed23b0b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"60401ff964e0e42b4e71626a00cfb86babc04a16","unresolved":false,"context_lines":[{"line_number":34,"context_line":"1. Storage and APIs for defining domains, projects and roles."},{"line_number":35,"context_line":"2. Storage and APIs for defining assignment relationships."},{"line_number":36,"context_line":"3. A set of APIs that evaluate the assignments, in order that the correct set"},{"line_number":37,"context_line":"   of roles can be places in a scoped token."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The fact that the above are all lumped together in one component leads to a"},{"line_number":40,"context_line":"number of issues."}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a8c0949_c680ff48","line":37,"updated":"2014-11-04 11:54:01.000000000","message":"typo: places should be placed","commit_id":"bb508502a7276a894b9110a5713069b6bed23b0b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"60401ff964e0e42b4e71626a00cfb86babc04a16","unresolved":false,"context_lines":[{"line_number":48,"context_line":"Second, for developers and cloud providers that would like to offer alternative"},{"line_number":49,"context_line":"types of assignments (e.g. ABAC, enhanced relationship models etc.), all they"},{"line_number":50,"context_line":"really need to provide is their own version of 2 (above) and honor the API of"},{"line_number":51,"context_line":"3. However, since the \"assignments\" backend contains all of the three items"},{"line_number":52,"context_line":"above, it is not simple to provide just the actual assignments piece. The"},{"line_number":53,"context_line":"advantage of enabling alternative access control models in this way is that the"},{"line_number":54,"context_line":"rest of OpenStack will continue to work - i.e. no change to token formats or"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a8c0949_0692079f","line":51,"updated":"2014-11-04 11:54:01.000000000","message":"Great Points!!!","commit_id":"bb508502a7276a894b9110a5713069b6bed23b0b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"16ec7840965d6c9812ea4944d9c651b7e7ce3dc0","unresolved":false,"context_lines":[{"line_number":28,"context_line":"relationships between these entities (which are stored in Keystone) are not"},{"line_number":29,"context_line":"shared outside of Keystone - rather these assignments are used to determine"},{"line_number":30,"context_line":"which roles are included in a token for a given user for a given scope of"},{"line_number":31,"context_line":"target entity (i.e. project or domain).  Hence in reality what we call"},{"line_number":32,"context_line":"the \"assignment\" component of Keystone today, consists of:"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"1. Storage and APIs for defining domains, projects and roles."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_dc82a251","line":31,"updated":"2014-11-11 21:08:12.000000000","message":"Great description!","commit_id":"76553273c454479fa95a5082e19f818f00096f93"}]}