)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Ioram Schechtman Sette \u003ciss@cin.ufpe.br\u003e"},{"line_number":5,"context_line":"CommitDate: 2015-04-30 11:37:07 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Policy rules mangaged from a database"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"bp policy-database \u003chttps://blueprints.launchpad.net/keystone/+spec/policy-database\u003e"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":23,"id":"da20952f_2b976491","line":7,"updated":"2015-09-03 13:05:44.000000000","message":"s/mangaged/managed/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c991170d5901ab943ee43e8ce0cf0fe901275e34","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Ioram Schechtman Sette \u003ciss@cin.ufpe.br\u003e"},{"line_number":5,"context_line":"CommitDate: 2015-04-30 11:37:07 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Policy rules mangaged from a database"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"bp policy-database \u003chttps://blueprints.launchpad.net/keystone/+spec/policy-database\u003e"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":23,"id":"9abb7d3a_f3b21fe4","line":7,"in_reply_to":"da20952f_2b976491","updated":"2016-05-31 21:41:18.000000000","message":"++","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"}],"specs/backlog/policy-database.rst":[{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"bf9ef6e803d6c7ab22e4afd26b75db22d618217a","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":"The DNF policy structure can be represented by the tree structure below."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":".. code-block::"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"                                   OR"},{"line_number":153,"context_line":"                               /    |    \\"}],"source_content_type":"text/x-rst","patch_set":13,"id":"9a80dd14_675dd279","line":150,"updated":"2015-03-16 17:06:42.000000000","message":"The error seems to be right here.  The following might resolve the issue:\ns/.. code-block::/.. code-block:: ini/gp\nAlso, if there\u0027s still an error, maybe right after each instance of the updated line, you may want to add\n :linenos:","commit_id":"dd58bb18b4f02ed56ef0e191602cc158cf7ccf80"},{"author":{"_account_id":9729,"name":"Ioram Schechtman Sette","email":"iss@cin.ufpe.br","username":"Ioram7"},"change_message_id":"65dcfd2a5e4e212451ba651410bf0c4cabf5dc68","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":"The DNF policy structure can be represented by the tree structure below."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":".. code-block::"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"                                   OR"},{"line_number":153,"context_line":"                               /    |    \\"}],"source_content_type":"text/x-rst","patch_set":13,"id":"9a80dd14_f0e1762b","line":150,"in_reply_to":"9a80dd14_675dd279","updated":"2015-03-16 17:48:48.000000000","message":"Done","commit_id":"dd58bb18b4f02ed56ef0e191602cc158cf7ccf80"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"ecf9562c5edfe3b6bffb57f562d8f012c51d2a59","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":"The DNF policy structure can be represented by the tree structure below."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":".. code-block:: ini/gp"},{"line_number":151,"context_line":"   :linenos:"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"                                   OR"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9a80dd14_5cdb394f","line":150,"updated":"2015-03-16 19:16:32.000000000","message":"There should be no \u0027/gp\u0027 at the end of each of these lines.  It should be\n.. code-block:: ini\n\nPlease remove the /gp in each of the 15 lines where they are present in this file.","commit_id":"00d9bcc09997f126adf658516b181836932eedf6"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fa3516bdff75c55bc79f22d0bffa7609f1a0b8d0","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Storing policies in a database schema behind Keystone makes them easy to be"},{"line_number":15,"context_line":"managed by Administrators.  Policies can be imported and exported from"},{"line_number":16,"context_line":"policy.json files, from where policy engines on each openstack service will"},{"line_number":17,"context_line":"take them to evaluate.  Policies can be also imported from and exported to"},{"line_number":18,"context_line":"other clouds systems that are members of a cloud federation, so that they"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9a80dd14_9bd11232","line":15,"updated":"2015-03-17 13:43:33.000000000","message":"Actually, this is not a good lead in, as flat files  for config are handled by Puppet, and that is what is easiest for administrators.\n\nInstead, this should discuss the difficulty of working with individual rules for the policy files, and the need to generate multiple policies files with a mix of common and distinct code.","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"7b78d7d8429a4bd5b4041db8abfaa9cceaa2dc74","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Storing policies in a database schema behind Keystone makes them easy to be"},{"line_number":15,"context_line":"managed by Administrators.  Policies can be imported and exported from"},{"line_number":16,"context_line":"policy.json files, from where policy engines on each openstack service will"},{"line_number":17,"context_line":"take them to evaluate.  Policies can be also imported from and exported to"},{"line_number":18,"context_line":"other clouds systems that are members of a cloud federation, so that they"}],"source_content_type":"text/x-rst","patch_set":18,"id":"1a6ced46_1add2071","line":15,"in_reply_to":"1a6ced46_4f60d335","updated":"2015-03-23 17:51:47.000000000","message":"\"Use a database to manage the policy rules used to produce policy files consumed by the remote services.  While continuing to support upload and fetching of the policy files in bulk, also allow for finer grained control of the rules that will then be used to  generate multiple policies files with a mix of common and distinct code.\"","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"03f63dc68498f27f212390facde74c4af96db868","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Storing policies in a database schema behind Keystone makes them easy to be"},{"line_number":15,"context_line":"managed by Administrators.  Policies can be imported and exported from"},{"line_number":16,"context_line":"policy.json files, from where policy engines on each openstack service will"},{"line_number":17,"context_line":"take them to evaluate.  Policies can be also imported from and exported to"},{"line_number":18,"context_line":"other clouds systems that are members of a cloud federation, so that they"}],"source_content_type":"text/x-rst","patch_set":18,"id":"1a6ced46_4f60d335","line":15,"in_reply_to":"9a80dd14_9bd11232","updated":"2015-03-23 10:31:58.000000000","message":"If you can provide appropriate text we will be happy to use it","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fa3516bdff75c55bc79f22d0bffa7609f1a0b8d0","unresolved":false,"context_lines":[{"line_number":26,"context_line":"difficult to answer questions like \"which actions can I perform with a role?\""},{"line_number":27,"context_line":"and \"which role do I need to perform this action on a resource?\"."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Another important problem is the handling of hierarchical roles that are"},{"line_number":30,"context_line":"common across multiple Openstack projects. In this case, the policy engines"},{"line_number":31,"context_line":"need to get common data generated from the role definitions."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"9a80dd14_bbbdf6d9","line":29,"updated":"2015-03-17 13:43:33.000000000","message":"I would say this is the primary concern:  manageability.  Making it so that the term \u0027admin\u0027 has a consistent meaning across openst stack services, for instance.","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"7b78d7d8429a4bd5b4041db8abfaa9cceaa2dc74","unresolved":false,"context_lines":[{"line_number":26,"context_line":"difficult to answer questions like \"which actions can I perform with a role?\""},{"line_number":27,"context_line":"and \"which role do I need to perform this action on a resource?\"."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Another important problem is the handling of hierarchical roles that are"},{"line_number":30,"context_line":"common across multiple Openstack projects. In this case, the policy engines"},{"line_number":31,"context_line":"need to get common data generated from the role definitions."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"1a6ced46_7ae4543b","line":29,"in_reply_to":"1a6ced46_af7227e3","updated":"2015-03-23 17:51:47.000000000","message":"Drop the term \"Another\" and make it clear that this is the primary reason for the spec.","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"03f63dc68498f27f212390facde74c4af96db868","unresolved":false,"context_lines":[{"line_number":26,"context_line":"difficult to answer questions like \"which actions can I perform with a role?\""},{"line_number":27,"context_line":"and \"which role do I need to perform this action on a resource?\"."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Another important problem is the handling of hierarchical roles that are"},{"line_number":30,"context_line":"common across multiple Openstack projects. In this case, the policy engines"},{"line_number":31,"context_line":"need to get common data generated from the role definitions."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"1a6ced46_af7227e3","line":29,"in_reply_to":"9a80dd14_bbbdf6d9","updated":"2015-03-23 10:31:58.000000000","message":"You are not actually requesting any change here are you?","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fa3516bdff75c55bc79f22d0bffa7609f1a0b8d0","unresolved":false,"context_lines":[{"line_number":270,"context_line":"Supported Operations"},{"line_number":271,"context_line":"--------------------"},{"line_number":272,"context_line":""},{"line_number":273,"context_line":"Policies stored in the database will support CRUD operations and also complex"},{"line_number":274,"context_line":"SQL queries. For instance, it will be possible to find out what are the"},{"line_number":275,"context_line":"necessary conditions to perform a given action on a service, or what actions a"},{"line_number":276,"context_line":"particular role can perform."}],"source_content_type":"text/x-rst","patch_set":18,"id":"9a80dd14_7b445eb7","line":273,"updated":"2015-03-17 13:43:33.000000000","message":"Limit this spec to using the existing V3 API, and that any new APIs for managing individual rules, for sharing of common data, and that make use of the power of the new schema will be in follow on specs.","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"03f63dc68498f27f212390facde74c4af96db868","unresolved":false,"context_lines":[{"line_number":270,"context_line":"Supported Operations"},{"line_number":271,"context_line":"--------------------"},{"line_number":272,"context_line":""},{"line_number":273,"context_line":"Policies stored in the database will support CRUD operations and also complex"},{"line_number":274,"context_line":"SQL queries. For instance, it will be possible to find out what are the"},{"line_number":275,"context_line":"necessary conditions to perform a given action on a service, or what actions a"},{"line_number":276,"context_line":"particular role can perform."}],"source_content_type":"text/x-rst","patch_set":18,"id":"1a6ced46_6a2bbd82","line":273,"in_reply_to":"9a80dd14_7b445eb7","updated":"2015-03-23 10:31:58.000000000","message":"Yes, we can certainly do this. We will change the text  to say\n\n\"Policies stored in the database will use the existing V3 API CRUD operations to create and modify them. More complex operations such as individual rule modification or finding out what are.......perform will be the subject of follow on specs.\"","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fa3516bdff75c55bc79f22d0bffa7609f1a0b8d0","unresolved":false,"context_lines":[{"line_number":279,"context_line":""},{"line_number":280,"context_line":"1. Import policy.json file into the database: This will parse the json file"},{"line_number":281,"context_line":"   and convert it into the relational tables. During this operation, any"},{"line_number":282,"context_line":"   duplicate rules will be removed."},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"2. Export policies from database to new policy.json files. These new files"},{"line_number":285,"context_line":"   will reflect the managed set of rules. It is important to note that, since"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9a80dd14_bb15f69c","line":282,"updated":"2015-03-17 13:43:33.000000000","message":"Is this using the existing Web API, or are you talking about a CLI utility?  The exisitng upload is:\nhttp://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n5276\n\n\nand the update is\n\nhttp://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n5385","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"03f63dc68498f27f212390facde74c4af96db868","unresolved":false,"context_lines":[{"line_number":279,"context_line":""},{"line_number":280,"context_line":"1. Import policy.json file into the database: This will parse the json file"},{"line_number":281,"context_line":"   and convert it into the relational tables. During this operation, any"},{"line_number":282,"context_line":"   duplicate rules will be removed."},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"2. Export policies from database to new policy.json files. These new files"},{"line_number":285,"context_line":"   will reflect the managed set of rules. It is important to note that, since"}],"source_content_type":"text/x-rst","patch_set":18,"id":"1a6ced46_6a9add15","line":282,"in_reply_to":"9a80dd14_bb15f69c","updated":"2015-03-23 10:31:58.000000000","message":"Yes we can use the existing create policy API to import the policy.json file into the database. The API call will have to include the policy.json file as a serialised blob, as now.","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fa3516bdff75c55bc79f22d0bffa7609f1a0b8d0","unresolved":false,"context_lines":[{"line_number":285,"context_line":"   will reflect the managed set of rules. It is important to note that, since"},{"line_number":286,"context_line":"   the rules are decomposed to and stored in DNF, and not stored in their"},{"line_number":287,"context_line":"   original syntax, the new generated policy files will be semantically"},{"line_number":288,"context_line":"   equivalent to their original, but can be syntactically different."},{"line_number":289,"context_line":""},{"line_number":290,"context_line":"Note. By supporting different import and export utilities, we will be able to"},{"line_number":291,"context_line":"      support the storage and retrieval of policies from other (non-OpenStack)"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9a80dd14_5b4cfac8","line":288,"updated":"2015-03-17 13:43:33.000000000","message":"The current API for this is : GET /policy/{id}\n\nhttp://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n5363","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"03f63dc68498f27f212390facde74c4af96db868","unresolved":false,"context_lines":[{"line_number":285,"context_line":"   will reflect the managed set of rules. It is important to note that, since"},{"line_number":286,"context_line":"   the rules are decomposed to and stored in DNF, and not stored in their"},{"line_number":287,"context_line":"   original syntax, the new generated policy files will be semantically"},{"line_number":288,"context_line":"   equivalent to their original, but can be syntactically different."},{"line_number":289,"context_line":""},{"line_number":290,"context_line":"Note. By supporting different import and export utilities, we will be able to"},{"line_number":291,"context_line":"      support the storage and retrieval of policies from other (non-OpenStack)"}],"source_content_type":"text/x-rst","patch_set":18,"id":"1a6ced46_6a681df6","line":288,"in_reply_to":"9a80dd14_5b4cfac8","updated":"2015-03-23 10:31:58.000000000","message":"And we can use GET policy (Policy ID) to export the policy as a serialised blob.","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"fa3516bdff75c55bc79f22d0bffa7609f1a0b8d0","unresolved":false,"context_lines":[{"line_number":628,"context_line":"If more than one person is working on the implementation, please designate the"},{"line_number":629,"context_line":"primary author and contact."},{"line_number":630,"context_line":""},{"line_number":631,"context_line":"Primary assignee:"},{"line_number":632,"context_line":"  ayoung@redhat.com"},{"line_number":633,"context_line":""},{"line_number":634,"context_line":"Other contributors:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9a80dd14_fba20e4a","line":631,"updated":"2015-03-17 13:43:33.000000000","message":"Set yourself as primary, and move me to \"other\"","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"7b78d7d8429a4bd5b4041db8abfaa9cceaa2dc74","unresolved":false,"context_lines":[{"line_number":628,"context_line":"If more than one person is working on the implementation, please designate the"},{"line_number":629,"context_line":"primary author and contact."},{"line_number":630,"context_line":""},{"line_number":631,"context_line":"Primary assignee:"},{"line_number":632,"context_line":"  ayoung@redhat.com"},{"line_number":633,"context_line":""},{"line_number":634,"context_line":"Other contributors:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"1a6ced46_7a5294de","line":631,"in_reply_to":"1a6ced46_8a447975","updated":"2015-03-23 17:51:47.000000000","message":"Yeah, that is a shortcoming of the spec process.  I don\u0027t know how to change \"spec owner\"  but this is the documentation for the fact that you guys will own the implementation after the spec is approved.","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"03f63dc68498f27f212390facde74c4af96db868","unresolved":false,"context_lines":[{"line_number":628,"context_line":"If more than one person is working on the implementation, please designate the"},{"line_number":629,"context_line":"primary author and contact."},{"line_number":630,"context_line":""},{"line_number":631,"context_line":"Primary assignee:"},{"line_number":632,"context_line":"  ayoung@redhat.com"},{"line_number":633,"context_line":""},{"line_number":634,"context_line":"Other contributors:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"1a6ced46_8a447975","line":631,"in_reply_to":"9a80dd14_fba20e4a","updated":"2015-03-23 10:31:58.000000000","message":"will do. However changing it here does not change the owner of the spec from you to one of us","commit_id":"38ce14011a8db431f40c7f772aff6c0f01f57fce"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"4279fc5744c863d2c386d456303755ad98cd98b6","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Create a Database Schema that reflects the current policy engine rules in a"},{"line_number":43,"context_line":"generic way, that can be used by other cloud services."},{"line_number":44,"context_line":"Allow the import of the existing policy.json files into the database schema,"},{"line_number":45,"context_line":"and the export of database schema policies to policy.json files."},{"line_number":46,"context_line":"Remove duplicate rule definitions during the import."},{"line_number":47,"context_line":"Allow the creation of new policy rules in the database schema."},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_8ea04492","line":45,"updated":"2015-04-22 23:11:30.000000000","message":"Explicit import of existing policy.json or implicit?  Meaning deployer has to run an utility to do the import or keystone does the import every time it starts.\n\nThe follow on question is whether an administrator has to edit policy.json then import policy.json in order to modify the policy or a utility/tool is going to be needed which takes inputs from administrator then talks to db to modify policy.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"194152a3c3b372f73490266624b42170f67e49c5","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Create a Database Schema that reflects the current policy engine rules in a"},{"line_number":43,"context_line":"generic way, that can be used by other cloud services."},{"line_number":44,"context_line":"Allow the import of the existing policy.json files into the database schema,"},{"line_number":45,"context_line":"and the export of database schema policies to policy.json files."},{"line_number":46,"context_line":"Remove duplicate rule definitions during the import."},{"line_number":47,"context_line":"Allow the creation of new policy rules in the database schema."},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"3acd31a7_1a0a2bd3","line":45,"in_reply_to":"bab921fb_458d5b30","updated":"2015-04-29 21:42:39.000000000","message":"I am glad that there is a plan to allow admins to mod policy through API.  What is missing is capturing the proposal in a spec somewhere.  Let me know if it is already in a spec somewhere.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"c36d2df539b0e1367e7de0e87361aedd2ba22592","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Create a Database Schema that reflects the current policy engine rules in a"},{"line_number":43,"context_line":"generic way, that can be used by other cloud services."},{"line_number":44,"context_line":"Allow the import of the existing policy.json files into the database schema,"},{"line_number":45,"context_line":"and the export of database schema policies to policy.json files."},{"line_number":46,"context_line":"Remove duplicate rule definitions during the import."},{"line_number":47,"context_line":"Allow the creation of new policy rules in the database schema."},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_458d5b30","line":45,"in_reply_to":"bab921fb_8ea04492","updated":"2015-04-23 09:30:59.000000000","message":"Explicit. There is an existing API to pass in a serialised json policy file, and another to export one from the database. This CRUD API already exists in Keystone, but all the DB currently stores is the entire policy as one long string. With this spec, the DB will hold the separate policy elements.\n\nThe next objective is to develop an API that will allow administrators to modify particular policy fields. Currently all that can be done is the entire policy file has to be replaced.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"3ef0ca2656c685989df4d9ebf9c554222c713a2a","unresolved":false,"context_lines":[{"line_number":74,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":75,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":76,"context_line":"* Yes.  The policy.json files need to be merged from the indivdual project"},{"line_number":77,"context_line":"  repos.  The Merging process will require both parsing of JSON and"},{"line_number":78,"context_line":"  the removal of duplicate rules."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"}],"source_content_type":"text/x-rst","patch_set":19,"id":"9aa53dc9_01225d00","line":77,"updated":"2015-04-13 21:27:12.000000000","message":"Merging of policies is not part of the current spec. This should be a separate spec since policy merging in general is very complex","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e6cd19f95a1260d6cf00ee6567ba466a9f4aec7e","unresolved":false,"context_lines":[{"line_number":130,"context_line":"Amazon, to allow cloud federations to share a common policy store."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"An OpenStack Policy file comprises a set of policy rules. For example,"},{"line_number":133,"context_line":"\"identity:create_region\": \"role:admin or is_admin:1\" may be a policy rule from"},{"line_number":134,"context_line":"Keystone\u0027s policy file. This says that the principal must either be the"},{"line_number":135,"context_line":"administrator or have the role of admin in order to create a region with the"},{"line_number":136,"context_line":"identity API. A policy rule logically comprises a set of conditions. The"}],"source_content_type":"text/x-rst","patch_set":19,"id":"9aa53dc9_7521f9fa","line":133,"updated":"2015-04-08 14:25:48.000000000","message":"nit: maybe not chose one with the infamous: is_admin:1 in it.....it might add confusion with the two admins in the same rule.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"049c7e11d8f7e3aaf5a71143347856b2adf07896","unresolved":false,"context_lines":[{"line_number":130,"context_line":"Amazon, to allow cloud federations to share a common policy store."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"An OpenStack Policy file comprises a set of policy rules. For example,"},{"line_number":133,"context_line":"\"identity:create_region\": \"role:admin or is_admin:1\" may be a policy rule from"},{"line_number":134,"context_line":"Keystone\u0027s policy file. This says that the principal must either be the"},{"line_number":135,"context_line":"administrator or have the role of admin in order to create a region with the"},{"line_number":136,"context_line":"identity API. A policy rule logically comprises a set of conditions. The"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7aaa499b_4640ada5","line":133,"in_reply_to":"9aa53dc9_7521f9fa","updated":"2015-04-13 20:58:15.000000000","message":"Agreed.  is_admin is horribly implemented.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"3ef0ca2656c685989df4d9ebf9c554222c713a2a","unresolved":false,"context_lines":[{"line_number":130,"context_line":"Amazon, to allow cloud federations to share a common policy store."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"An OpenStack Policy file comprises a set of policy rules. For example,"},{"line_number":133,"context_line":"\"identity:create_region\": \"role:admin or is_admin:1\" may be a policy rule from"},{"line_number":134,"context_line":"Keystone\u0027s policy file. This says that the principal must either be the"},{"line_number":135,"context_line":"administrator or have the role of admin in order to create a region with the"},{"line_number":136,"context_line":"identity API. A policy rule logically comprises a set of conditions. The"}],"source_content_type":"text/x-rst","patch_set":19,"id":"9aa53dc9_2bc78046","line":133,"in_reply_to":"9aa53dc9_7521f9fa","updated":"2015-04-13 21:27:12.000000000","message":"This was chosen on purpose because it seems to be a common rule in keystone policies.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"c36d2df539b0e1367e7de0e87361aedd2ba22592","unresolved":false,"context_lines":[{"line_number":147,"context_line":"_`Disjunctive Normal Form (DNF)`: http://en.wikipedia.org/wiki/Disjunctive_normal_form"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"The DNF policy structure can be represented by the tree structure below."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":".. code-block:: python"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"                                   OR"}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_c5c72b44","line":150,"updated":"2015-04-23 09:30:59.000000000","message":"replace with\nThe DNF policy structure can be represented as a tree with an OR root, with AND branches and condition leaves, one hypothetical example of which is given below.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"c36d2df539b0e1367e7de0e87361aedd2ba22592","unresolved":false,"context_lines":[{"line_number":156,"context_line":"                          /  | \\    |    /   \\"},{"line_number":157,"context_line":"                         C1 C2 C3  C4   C5   C6"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Using the example policy rule from above, this converts into the following"},{"line_number":160,"context_line":"simple conditions:"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"* C1: role \u003d \"admin\""}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_a54e77bf","line":159,"updated":"2015-04-23 09:30:59.000000000","message":"Using the create_region policy rule from above,...","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"4279fc5744c863d2c386d456303755ad98cd98b6","unresolved":false,"context_lines":[{"line_number":162,"context_line":"* C1: role \u003d \"admin\""},{"line_number":163,"context_line":"* C2: is_admin \u003d TRUE"},{"line_number":164,"context_line":"* C3: service \u003d \"identity\""},{"line_number":165,"context_line":"* C4: action \u003d \"create_region\""},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"The policy rule in DNF forms two sets of simple conditions, namely:"},{"line_number":168,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_d8fde26f","line":165,"updated":"2015-04-22 23:11:30.000000000","message":"So, C5 and C6 are additional services, actions or roles?","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e6cd19f95a1260d6cf00ee6567ba466a9f4aec7e","unresolved":false,"context_lines":[{"line_number":162,"context_line":"* C1: role \u003d \"admin\""},{"line_number":163,"context_line":"* C2: is_admin \u003d TRUE"},{"line_number":164,"context_line":"* C3: service \u003d \"identity\""},{"line_number":165,"context_line":"* C4: action \u003d \"create_region\""},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"The policy rule in DNF forms two sets of simple conditions, namely:"},{"line_number":168,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"9aa53dc9_88e1f700","line":165,"updated":"2015-04-08 14:25:48.000000000","message":"is this tree structure above meant to represent the example policy rule?","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"3ef0ca2656c685989df4d9ebf9c554222c713a2a","unresolved":false,"context_lines":[{"line_number":162,"context_line":"* C1: role \u003d \"admin\""},{"line_number":163,"context_line":"* C2: is_admin \u003d TRUE"},{"line_number":164,"context_line":"* C3: service \u003d \"identity\""},{"line_number":165,"context_line":"* C4: action \u003d \"create_region\""},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"The policy rule in DNF forms two sets of simple conditions, namely:"},{"line_number":168,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"9aa53dc9_0b795cf6","line":165,"in_reply_to":"9aa53dc9_88e1f700","updated":"2015-04-13 21:27:12.000000000","message":"No, but I can see why it might be confusing on first read that it does not. However, when one gets to the next paragraph one can see that it does not.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"c36d2df539b0e1367e7de0e87361aedd2ba22592","unresolved":false,"context_lines":[{"line_number":162,"context_line":"* C1: role \u003d \"admin\""},{"line_number":163,"context_line":"* C2: is_admin \u003d TRUE"},{"line_number":164,"context_line":"* C3: service \u003d \"identity\""},{"line_number":165,"context_line":"* C4: action \u003d \"create_region\""},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"The policy rule in DNF forms two sets of simple conditions, namely:"},{"line_number":168,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_a5fc373f","line":165,"in_reply_to":"bab921fb_d8fde26f","updated":"2015-04-23 09:30:59.000000000","message":"C5 and C6 are conditions in the hypothetical tree, and are not part of the example rule","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"4279fc5744c863d2c386d456303755ad98cd98b6","unresolved":false,"context_lines":[{"line_number":168,"context_line":""},{"line_number":169,"context_line":".. code-block:: python"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":" (C3 and C4 and C1) or (C3 and C4 and C2)"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Database Schema"},{"line_number":174,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_381dfebd","line":171,"updated":"2015-04-22 23:11:30.000000000","message":"or ...\n\n[assuming C5 and C6 are additional actions]\n\n(C3 and C5 and C1) or (C3 and C5 and C2) or (C3 and C6 and C1) or (C3 and C6 and C2) ?","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"c36d2df539b0e1367e7de0e87361aedd2ba22592","unresolved":false,"context_lines":[{"line_number":168,"context_line":""},{"line_number":169,"context_line":".. code-block:: python"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":" (C3 and C4 and C1) or (C3 and C4 and C2)"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Database Schema"},{"line_number":174,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_859013ee","line":171,"in_reply_to":"bab921fb_381dfebd","updated":"2015-04-23 09:30:59.000000000","message":"Yes, true if admin was allowed to perform these additonal actions","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e6cd19f95a1260d6cf00ee6567ba466a9f4aec7e","unresolved":false,"context_lines":[{"line_number":191,"context_line":" | id          VARCHAR(64) [PK] +--------------+"},{"line_number":192,"context_line":" | policy_id   VARCHAR(64) [FK] | 1          n |"},{"line_number":193,"context_line":" | description TEXT             |      +-------+--------------------------+"},{"line_number":194,"context_line":" | enabled     TINYINT(1)  [NN] |      | and_rule_has_condition           |"},{"line_number":195,"context_line":" +------------------------------+      | -------------------------------- |"},{"line_number":196,"context_line":"                                       | and_rule_id  VARCHAR(64) [PK/FK] |"},{"line_number":197,"context_line":"                                       | condition_id VARCHAR(64) [PK/FK] |"}],"source_content_type":"text/x-rst","patch_set":19,"id":"9aa53dc9_2878ab29","line":194,"updated":"2015-04-08 14:25:48.000000000","message":"Tinyint?  is boolean not a column type?","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"3ef0ca2656c685989df4d9ebf9c554222c713a2a","unresolved":false,"context_lines":[{"line_number":191,"context_line":" | id          VARCHAR(64) [PK] +--------------+"},{"line_number":192,"context_line":" | policy_id   VARCHAR(64) [FK] | 1          n |"},{"line_number":193,"context_line":" | description TEXT             |      +-------+--------------------------+"},{"line_number":194,"context_line":" | enabled     TINYINT(1)  [NN] |      | and_rule_has_condition           |"},{"line_number":195,"context_line":" +------------------------------+      | -------------------------------- |"},{"line_number":196,"context_line":"                                       | and_rule_id  VARCHAR(64) [PK/FK] |"},{"line_number":197,"context_line":"                                       | condition_id VARCHAR(64) [PK/FK] |"}],"source_content_type":"text/x-rst","patch_set":19,"id":"9aa53dc9_8158ad33","line":194,"in_reply_to":"9aa53dc9_2878ab29","updated":"2015-04-13 21:27:12.000000000","message":"Apparently this is following the existing convention used in other tables","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"049c7e11d8f7e3aaf5a71143347856b2adf07896","unresolved":false,"context_lines":[{"line_number":191,"context_line":" | id          VARCHAR(64) [PK] +--------------+"},{"line_number":192,"context_line":" | policy_id   VARCHAR(64) [FK] | 1          n |"},{"line_number":193,"context_line":" | description TEXT             |      +-------+--------------------------+"},{"line_number":194,"context_line":" | enabled     TINYINT(1)  [NN] |      | and_rule_has_condition           |"},{"line_number":195,"context_line":" +------------------------------+      | -------------------------------- |"},{"line_number":196,"context_line":"                                       | and_rule_id  VARCHAR(64) [PK/FK] |"},{"line_number":197,"context_line":"                                       | condition_id VARCHAR(64) [PK/FK] |"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7aaa499b_860c7595","line":194,"in_reply_to":"9aa53dc9_2878ab29","updated":"2015-04-13 20:58:15.000000000","message":"boolean is tinyint(1) in MySQL.  It is an int of length 1...I always thought that was bits, but it is probably the smallest addressable location in an mysql system, which would be a byte.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"4279fc5744c863d2c386d456303755ad98cd98b6","unresolved":false,"context_lines":[{"line_number":384,"context_line":""},{"line_number":385,"context_line":"* Policy rules are represented as:"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"  { R(\"service:action\"): \u003csubject conditions\u003e }"},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"LINE 1:"},{"line_number":390,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_ae4b082b","line":387,"updated":"2015-04-22 23:11:30.000000000","message":"Since curl brackets presents items temporarily stored in memory, is policy rules actually stored in the database, then read into the memory?  I hope it is.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"c36d2df539b0e1367e7de0e87361aedd2ba22592","unresolved":false,"context_lines":[{"line_number":384,"context_line":""},{"line_number":385,"context_line":"* Policy rules are represented as:"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"  { R(\"service:action\"): \u003csubject conditions\u003e }"},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"LINE 1:"},{"line_number":390,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_2544a772","line":387,"in_reply_to":"bab921fb_ae4b082b","updated":"2015-04-23 09:30:59.000000000","message":"No, there is no plan to store the actual policy rules. The rules are only stored in DNF form. So the semantics are kept but the syntax is not.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"c36d2df539b0e1367e7de0e87361aedd2ba22592","unresolved":false,"context_lines":[{"line_number":622,"context_line":"Assignee(s)"},{"line_number":623,"context_line":"-----------"},{"line_number":624,"context_line":""},{"line_number":625,"context_line":"Who is leading the writing of the code? Or is this a blueprint where you\u0027re"},{"line_number":626,"context_line":"throwing it out there to see who picks it up?"},{"line_number":627,"context_line":""},{"line_number":628,"context_line":"If more than one person is working on the implementation, please designate the"}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_60260dbc","line":625,"updated":"2015-04-23 09:30:59.000000000","message":"Ioram has already written the code that does this, using a python library. However, the python library is written in Python 3 and so is currently incompatible with the Keystone code (Python 2). We presume that there must be a plan to migrate Keystone to Python 3 in the near future.","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"c36d2df539b0e1367e7de0e87361aedd2ba22592","unresolved":false,"context_lines":[{"line_number":628,"context_line":"If more than one person is working on the implementation, please designate the"},{"line_number":629,"context_line":"primary author and contact."},{"line_number":630,"context_line":""},{"line_number":631,"context_line":"Primary assignee:"},{"line_number":632,"context_line":"  ayoung@redhat.com"},{"line_number":633,"context_line":""},{"line_number":634,"context_line":"Other contributors:"}],"source_content_type":"text/x-rst","patch_set":19,"id":"bab921fb_e041fd3a","line":631,"updated":"2015-04-23 09:30:59.000000000","message":"Should be Ioram Sette,\n\niss@cin.ufpe.br","commit_id":"4e92c78e32c7731cb262aa5a2bf6e24818321999"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Policies are currently represented in multiple policy files spread across"},{"line_number":25,"context_line":"openstack services.  This makes their manageability difficult, and also"},{"line_number":26,"context_line":"difficult to answer questions like \"which actions can I perform with a role?\""},{"line_number":27,"context_line":"and \"which role do I need to perform this action on a resource?\"."},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_4be3b805","line":25,"updated":"2015-09-03 13:05:44.000000000","message":"s/openstack/OpenStack/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":27,"context_line":"and \"which role do I need to perform this action on a resource?\"."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"When handling hierarchical roles that are common across multiple"},{"line_number":30,"context_line":"Openstack projects, the policy engines need to get common data"},{"line_number":31,"context_line":"generated from the role definitions."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Sharing policies with other cloud systems that are part of a cloud"}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_6bdd5c41","line":30,"updated":"2015-09-03 13:05:44.000000000","message":"s/Openstack/OpenStack/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":75,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":76,"context_line":"* Yes.  The policy.json files need to be merged from the indivdual project"},{"line_number":77,"context_line":"  repos.  The Merging process will require both parsing of JSON and"},{"line_number":78,"context_line":"  the removal of duplicate rules. Note that the removal of conflicting rules"},{"line_number":79,"context_line":"  will not be performed. However, we assume that there wont be conflicting"}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_ebbe4cfe","line":76,"updated":"2015-09-03 13:05:44.000000000","message":"s/indivdual/individual/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":127,"context_line":"Overview"},{"line_number":128,"context_line":"--------"},{"line_number":129,"context_line":"This section describes a relational database schema that stores security"},{"line_number":130,"context_line":"policies for Openstack. However, it has been designed to be generic enough so"},{"line_number":131,"context_line":"that it could also store policies for other cloud systems such as Azure and"},{"line_number":132,"context_line":"Amazon, to allow cloud federations to share a common policy store."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_6bb47cf1","line":130,"updated":"2015-09-03 13:05:44.000000000","message":"s/Openstack/OpenStack/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4b386c8c5d31a0c35f5befbbc90e7bdf852df650","unresolved":false,"context_lines":[{"line_number":152,"context_line":"AND branches and condition leaves, one hypothetical example of which is given"},{"line_number":153,"context_line":"below."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":".. code-block:: python"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"                                   OR"},{"line_number":158,"context_line":"                               /    |    \\"}],"source_content_type":"text/x-rst","patch_set":23,"id":"3a50d1a3_a91376b7","line":155,"updated":"2015-07-21 15:56:37.000000000","message":"this is some unfamiliar python","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"371538a2d8723a5ae63ee5cb26ab8d8a72f5e11e","unresolved":false,"context_lines":[{"line_number":166,"context_line":"* C1: role \u003d \"admin\""},{"line_number":167,"context_line":"* C2: is_admin \u003d TRUE"},{"line_number":168,"context_line":"* C3: service \u003d \"identity\""},{"line_number":169,"context_line":"* C4: action \u003d \"create_region\""},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"The policy rule in DNF forms two sets of simple conditions, namely:"},{"line_number":172,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"9abb7d3a_f324f160","line":169,"updated":"2016-05-31 15:39:04.000000000","message":"According to create_region policy rule from above, this should be rearranged:\n\n\"identity:create_region\": \"role:admin or is_admin:1\"\n\nturning to DNF:\n\n(service\u003didentity AND action\u003dcreate_region AND role\u003dadmin)\n\nOR\n\n(service\u003didentity AND action\u003dcreate_region AND is_admin\u003dTRUE)\n\nThat will even give a different tree.","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":177,"context_line":"Database Schema"},{"line_number":178,"context_line":"---------------"},{"line_number":179,"context_line":"The following figure presents the database schema to store security policies in"},{"line_number":180,"context_line":"Openstack."},{"line_number":181,"context_line":""},{"line_number":182,"context_line":".. code-block:: python"},{"line_number":183,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_0bc4e05c","line":180,"updated":"2015-09-03 13:05:44.000000000","message":"s/Openstack/OpenStack/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Policy"},{"line_number":215,"context_line":"~~~~~~"},{"line_number":216,"context_line":"Represents the Openstack Policy. Each entry in this table can represent one or"},{"line_number":217,"context_line":"multiple Openstack Policy files."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"* The id is the unique key for this policy."}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_cba4a8ba","line":216,"updated":"2015-09-03 13:05:44.000000000","message":"s/Openstack/OpenStack/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":214,"context_line":"Policy"},{"line_number":215,"context_line":"~~~~~~"},{"line_number":216,"context_line":"Represents the Openstack Policy. Each entry in this table can represent one or"},{"line_number":217,"context_line":"multiple Openstack Policy files."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"* The id is the unique key for this policy."},{"line_number":220,"context_line":"* The description field is optional, and describes the meaning of the Policy."}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_8baeb096","line":217,"updated":"2015-09-03 13:05:44.000000000","message":"s/Openstack/OpenStack/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":255,"context_line":""},{"line_number":256,"context_line":"* Role"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"  Roles in Openstack represent Subjects. A user in a domain or project can be"},{"line_number":259,"context_line":"  directly assigned to roles, or can be part of a group which is assigned to a"},{"line_number":260,"context_line":"  role."},{"line_number":261,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_0b9b8073","line":258,"updated":"2015-09-03 13:05:44.000000000","message":"s/Openstack/OpenStack/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":261,"context_line":""},{"line_number":262,"context_line":"* Other types"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"  Despite the fact that Openstack uses an RBAC engine, it allows other"},{"line_number":265,"context_line":"  attributes from the subject to be verified in its policies, for example,"},{"line_number":266,"context_line":"  user_id and project_id."},{"line_number":267,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_cb8b481d","line":264,"updated":"2015-09-03 13:05:44.000000000","message":"s/Openstack/OpenStack/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":369,"context_line":"* Terms in [ square brackets ] represent items stored in the database:"},{"line_number":370,"context_line":"  conditions and \"and rules\"."},{"line_number":371,"context_line":""},{"line_number":372,"context_line":"* Terms in { curl brackets } represent items (i.e.subject rules and policy"},{"line_number":373,"context_line":"  rules) temporarily stored in memory whilst the json policy file is imported."},{"line_number":374,"context_line":"  These items will subsequently be discarded."},{"line_number":375,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_6b58fcfa","line":372,"updated":"2015-09-03 13:05:44.000000000","message":"s/i.e.subject/i.e. subject/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":512,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":513,"context_line":"   id            description"},{"line_number":514,"context_line":"-------- ---------------------------"},{"line_number":515,"context_line":"\"a2f57b\" \"Openstack Security Policy\""},{"line_number":516,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"and_rule"}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_4b78982b","line":515,"updated":"2015-09-03 13:05:44.000000000","message":"s/Openstack/OpenStack/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"503008db60bec5a2d89a06cb1e644b3013e2cd7c","unresolved":false,"context_lines":[{"line_number":553,"context_line":"\"C0C\" \"user_id\"  \"\u003d\"      \"%(target.credential.user_id)s\" 12."},{"line_number":554,"context_line":"\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":555,"context_line":""},{"line_number":556,"context_line":"With the desciption values of:"},{"line_number":557,"context_line":""},{"line_number":558,"context_line":"1. \"role:admin\""},{"line_number":559,"context_line":"2. \"is_admin:1\""}],"source_content_type":"text/x-rst","patch_set":23,"id":"da20952f_eb03acb6","line":556,"updated":"2015-09-03 13:05:44.000000000","message":"s/desciption/description/","commit_id":"a68b12f16a1fd15ab46f75d029999ead1a9191b8"}],"specs/kilo/policy-database.rst":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"8e15198c5706d7798ee3c0d3fd9ca72a59cc42b4","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"In order to enforce a common policy mechanism across OpenStack, we need to be"},{"line_number":21,"context_line":"able to have common definitions for roles.  The policy engine needs to"},{"line_number":22,"context_line":"interpret these roles.  But the Hierarchical role scheme is going to be common"},{"line_number":23,"context_line":"across multiple OpenStack projects.  That means that the policy engine needs to"},{"line_number":24,"context_line":"get data generated from the role definitions."},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_ab066e1e","line":22,"updated":"2014-11-11 19:38:20.000000000","message":"maybe rewrite the sentence to \"needs to interpret these roles and the Hierarchical role scheme ...\"","commit_id":"e2f0a23849784f84ab36afbccaaf238b66511761"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"8e15198c5706d7798ee3c0d3fd9ca72a59cc42b4","unresolved":false,"context_lines":[{"line_number":26,"context_line":"Proposed Change"},{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Create a Database Schema that reflects the current policy engine rules."},{"line_number":30,"context_line":"Allow the import of the existing policy.json files, deconflicting of duplicate"},{"line_number":31,"context_line":"rule defintions, and the definitions of new rules."},{"line_number":32,"context_line":"Produce a new policy.json file that reflects the managed set of rules."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_de261aba","line":29,"updated":"2014-11-11 19:38:20.000000000","message":"Is the schema itself in the scope of this spec on in a following one?","commit_id":"e2f0a23849784f84ab36afbccaaf238b66511761"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"8e15198c5706d7798ee3c0d3fd9ca72a59cc42b4","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Alternatives"},{"line_number":35,"context_line":"------------"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Manage the rules manually.  This is labor intensive and error prone."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_5e3a2ace","line":37,"updated":"2014-11-11 19:38:20.000000000","message":"Maybe cite that it\u0027s how we do today and be specific about the errors in that case, with examples.","commit_id":"e2f0a23849784f84ab36afbccaaf238b66511761"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"8e15198c5706d7798ee3c0d3fd9ca72a59cc42b4","unresolved":false,"context_lines":[{"line_number":71,"context_line":"Notifications Impact"},{"line_number":72,"context_line":"--------------------"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Changes to the policy rules will require sending a notification."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Other End User Impact"},{"line_number":77,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_de745a9e","line":74,"updated":"2014-11-11 19:38:20.000000000","message":"How will work the process of changing rules/generating new policy.json? When the interested service requests it?","commit_id":"e2f0a23849784f84ab36afbccaaf238b66511761"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"13a052e39f751b201b941875f193207f88749b4d","unresolved":false,"context_lines":[{"line_number":57,"context_line":"* No"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":60,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":61,"context_line":"* Yes.  The policy.json files need to be merged from the indivdual project"},{"line_number":62,"context_line":"  repos.  The Merging process will require both parsing of JSON and"},{"line_number":63,"context_line":"  deconflicting of rules."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_0d5952fe","line":60,"updated":"2014-11-12 01:18:15.000000000","message":"individual","commit_id":"429604625a75bb1a9407704a9d59bc99018a59f3"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"13a052e39f751b201b941875f193207f88749b4d","unresolved":false,"context_lines":[{"line_number":71,"context_line":"Notifications Impact"},{"line_number":72,"context_line":"--------------------"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Changes to the policy rules will require sending a notification."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Other End User Impact"},{"line_number":77,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_6d1d760f","line":74,"updated":"2014-11-12 01:18:15.000000000","message":"this requires a few more details.. maybe briefly mention oslo.messaging and how it will be done?","commit_id":"429604625a75bb1a9407704a9d59bc99018a59f3"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"13a052e39f751b201b941875f193207f88749b4d","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Performance Impact"},{"line_number":86,"context_line":"------------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Should have no performance impact.  Generating the policy.json files will be"},{"line_number":89,"context_line":"done once, and then cached for future requests.  They should be static during"},{"line_number":90,"context_line":"normal operations."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_2de36e08","line":87,"updated":"2014-11-12 01:18:15.000000000","message":"what about the overhead that every operation in every service will require more work from keystone?","commit_id":"429604625a75bb1a9407704a9d59bc99018a59f3"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"13a052e39f751b201b941875f193207f88749b4d","unresolved":false,"context_lines":[{"line_number":95,"context_line":"Discuss things that will affect how you deploy and configure OpenStack"},{"line_number":96,"context_line":"that have not already been mentioned, such as:"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"* The Dynamic backend will be a different Backend for the policy API."},{"line_number":99,"context_line":"  Configuration will require enabling it as teh Driver in the [policy] section"},{"line_number":100,"context_line":"  of keystone.conf."},{"line_number":101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_6dcbb672","line":98,"updated":"2014-11-12 01:18:15.000000000","message":"the*","commit_id":"429604625a75bb1a9407704a9d59bc99018a59f3"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"1dada1e5dc0a025e3ddd1785ef27a14feb3851dc","unresolved":false,"context_lines":[{"line_number":40,"context_line":"Security Impact"},{"line_number":41,"context_line":"---------------"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":44,"context_line":"consider include:"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a961159_e01bfc7d","line":43,"updated":"2014-12-18 14:34:01.000000000","message":"these questions are not intended to provide a question-answer format wherein you complete a questionnaire like it\u0027s some sort of doctor\u0027s office form. they\u0027re intended to motivate a thoughtful discussion and drive you to begin considering several angles on the subject. please put some thought into these specs, as they\u0027re all just incomplete thoughts, otherwise.","commit_id":"d0fce80ceb14cf809755c0b342f8abf661594762"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"704b08efacb223ca1fd61feedfc702ea54d2cd9e","unresolved":false,"context_lines":[{"line_number":40,"context_line":"Security Impact"},{"line_number":41,"context_line":"---------------"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":44,"context_line":"consider include:"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a961159_c53d2091","line":43,"in_reply_to":"3a961159_e01bfc7d","updated":"2014-12-18 21:50:50.000000000","message":"I don\u0027t think a spec is the medium for a discussion, but certainly can be the receptical for update once a discussion has generated new ideas.  I\u0027ve treated this section as a starting point to generate such discussion, but made sure as not to delete any of the questions:  they are all good questions, and even an \"no\" answer should be maintained.\n\nI feel like this section reflects the current understanding of how the change in the policy mechanism will change the security profile.  If there is any point that you feel should be expanded please add a comment.\n\nBut this is a complete spec, not a partial.","commit_id":"d0fce80ceb14cf809755c0b342f8abf661594762"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"890384f6c2fe4a60db3e38fc4eff38d72787532f","unresolved":false,"context_lines":[{"line_number":148,"context_line":""},{"line_number":149,"context_line":"References"},{"line_number":150,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":151,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_132199fc","line":151,"updated":"2014-11-27 12:12:51.000000000","message":"Seems like this is going some way to implement the Policy Administration Point blueprint documented here\n\nhttps://blueprints.launchpad.net/keystone/+spec/pap","commit_id":"d0fce80ceb14cf809755c0b342f8abf661594762"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"37b28716b07eb0321f190f0ea3b17da45b4e32e9","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"In order to enforce a common policy mechanism across OpenStack, we need to be"},{"line_number":21,"context_line":"able to have common definitions for roles.  The policy engine needs to"},{"line_number":22,"context_line":"interpret these roles.  But the Hierarchical role scheme is going to be common"},{"line_number":23,"context_line":"across multiple OpenStack projects.  That means that the policy engine needs to"},{"line_number":24,"context_line":"get data generated from the role definitions."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_11fc55b4","line":21,"updated":"2014-12-24 12:36:45.000000000","message":"In general, you will need common definitions for every concept in the policies.","commit_id":"7c86ff0c9c598e26b36911133e18719e6a2878c4"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"37b28716b07eb0321f190f0ea3b17da45b4e32e9","unresolved":false,"context_lines":[{"line_number":22,"context_line":"interpret these roles.  But the Hierarchical role scheme is going to be common"},{"line_number":23,"context_line":"across multiple OpenStack projects.  That means that the policy engine needs to"},{"line_number":24,"context_line":"get data generated from the role definitions."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Proposed Change"},{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_f173494b","line":25,"updated":"2014-12-24 12:36:45.000000000","message":"This depends upon where the concept of role hierarchies is understood. If role hierarchies are understood throughout Openstack policies, then you only need to define the hierarchy once and this can be copied to each policy. However, if role hierarchies are not understood by policy engines, then roles need to be expanded either in the token (in which case the policy does not need to change) or in the policy (in which case the token does not need to change).\n\nIt is not clear to me from this spec which of the above models you are proposing.","commit_id":"7c86ff0c9c598e26b36911133e18719e6a2878c4"}]}