)]}'
{"specs/backlog/domain-roles.rst":[{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"1c1da0ddc79419b5aaef217dd9e8514e43c805bc","unresolved":false,"context_lines":[{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"It is proposed that we allow the creation of domain-roles, which can contain a"},{"line_number":40,"context_line":"list of one or more roles and/or other domain-roles. For example, to use the"},{"line_number":41,"context_line":"problem described above, if fine grained roles such as create-vm, delete-vm"},{"line_number":42,"context_line":"etc. exist, which give a user access to specific APIs via the policy file for"},{"line_number":43,"context_line":"a service, then creating a domain-role of vm-manager that contained these roles"}],"source_content_type":"text/x-rst","patch_set":11,"id":"fa32b979_256298d9","line":40,"updated":"2015-06-12 23:22:42.000000000","message":"Can you clarify \"other domain-roles\"?  Is it other domain-roles from the same domain?  Other domain-roles from a different domain?","commit_id":"0691c1fc56d3befac58ad50a7a72c9e549f18c29"}],"specs/kilo/domain-roles.rst":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"2c7e8b86517973a4a24747797f5826be431ea3be","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp role-groups \u003chttps://blueprints.launchpad.net/keystone/+spec/role-groups\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of domain roles (which can be hierarchical), allowing a"},{"line_number":14,"context_line":"domain role to be used as part of an assignment, in the same was as you can"},{"line_number":15,"context_line":"assign an individual, global role."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_9253a3e1","line":13,"updated":"2014-11-28 18:05:04.000000000","message":"the \"which can be hierarchical\" sentence can be elaborated so is clear for the reader the concept of \"group\"","commit_id":"a32554f77e64d9b30330cea43e9635a844d840f4"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"cfbf9328b3a67513ca30f0d8526374c2d6eb9d26","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp role-groups \u003chttps://blueprints.launchpad.net/keystone/+spec/role-groups\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of domain roles (which can be hierarchical), allowing a"},{"line_number":14,"context_line":"domain role to be used as part of an assignment, in the same was as you can"},{"line_number":15,"context_line":"assign an individual, global role."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_32e10fff","line":13,"in_reply_to":"5a890539_9253a3e1","updated":"2014-11-28 18:14:36.000000000","message":"Done","commit_id":"a32554f77e64d9b30330cea43e9635a844d840f4"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"2c7e8b86517973a4a24747797f5826be431ea3be","unresolved":false,"context_lines":[{"line_number":49,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Domain-roles will be name-spaced by domain, allowing each domain to create their"},{"line_number":52,"context_line":"own set of domain-roles that map to the global roles."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Although outside of the scope of this specification, it is anticipated that with"},{"line_number":55,"context_line":"the introduction of hierarchical multitenancy, domain-roles will be treated like"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_b28b3f67","line":52,"updated":"2014-11-28 18:05:04.000000000","message":"is this relashionship between domain roles and global roles a \"must\"? It will always need to reference a global role?","commit_id":"a32554f77e64d9b30330cea43e9635a844d840f4"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"cfbf9328b3a67513ca30f0d8526374c2d6eb9d26","unresolved":false,"context_lines":[{"line_number":49,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Domain-roles will be name-spaced by domain, allowing each domain to create their"},{"line_number":52,"context_line":"own set of domain-roles that map to the global roles."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Although outside of the scope of this specification, it is anticipated that with"},{"line_number":55,"context_line":"the introduction of hierarchical multitenancy, domain-roles will be treated like"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_d22a8b2e","line":52,"in_reply_to":"5a890539_b28b3f67","updated":"2014-11-28 18:14:36.000000000","message":"well, it must resolve to a role at some point...otherwise there is nothing to be in the token.","commit_id":"a32554f77e64d9b30330cea43e9635a844d840f4"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"2c7e8b86517973a4a24747797f5826be431ea3be","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Data Model Impact"},{"line_number":77,"context_line":"-----------------"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"For SQL, a new table will be created to hold the domain-roles and the"},{"line_number":80,"context_line":"assignments table will be able to store a domain_role_id in place of a role_id."},{"line_number":81,"context_line":"It is proposed to not support domain-roles with the LDAP backend, until we"},{"line_number":82,"context_line":"enable an un-fettered R/W LDAP backend that can impose its own schema."}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_b2b97f17","line":79,"updated":"2014-11-28 18:05:04.000000000","message":"Are domain roles so different that should have their own table? I mean, what are the disadvantages of adding the domain id column to the current roles table and consider global those roles without domain_id?","commit_id":"a32554f77e64d9b30330cea43e9635a844d840f4"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"cfbf9328b3a67513ca30f0d8526374c2d6eb9d26","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Data Model Impact"},{"line_number":77,"context_line":"-----------------"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"For SQL, a new table will be created to hold the domain-roles and the"},{"line_number":80,"context_line":"assignments table will be able to store a domain_role_id in place of a role_id."},{"line_number":81,"context_line":"It is proposed to not support domain-roles with the LDAP backend, until we"},{"line_number":82,"context_line":"enable an un-fettered R/W LDAP backend that can impose its own schema."}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_b215ffe6","line":79,"in_reply_to":"5a890539_b2b97f17","updated":"2014-11-28 18:14:36.000000000","message":"That\u0027s a fair point.  Although it would need more than that, since you need membership of a domain role (which can be a role or another domain role).  I tended to feel this made it more suitable for a separate table,","commit_id":"a32554f77e64d9b30330cea43e9635a844d840f4"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"2c7e8b86517973a4a24747797f5826be431ea3be","unresolved":false,"context_lines":[{"line_number":84,"context_line":"REST API Impact"},{"line_number":85,"context_line":"---------------"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"A new CRUD API will be provided for the management of domain-roles. The"},{"line_number":88,"context_line":"grant APIs will also allow a domain-role ID to specified in place of a role ID."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_12409306","line":87,"updated":"2014-11-28 18:05:04.000000000","message":"Same question as for the data model: why not extend the CRUD API from roles?","commit_id":"a32554f77e64d9b30330cea43e9635a844d840f4"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"cfbf9328b3a67513ca30f0d8526374c2d6eb9d26","unresolved":false,"context_lines":[{"line_number":84,"context_line":"REST API Impact"},{"line_number":85,"context_line":"---------------"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"A new CRUD API will be provided for the management of domain-roles. The"},{"line_number":88,"context_line":"grant APIs will also allow a domain-role ID to specified in place of a role ID."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_1225f35b","line":87,"in_reply_to":"5a890539_12409306","updated":"2014-11-28 18:14:36.000000000","message":"I think the issue will be keystone police on who can update a domain role vs a global role.  The domain admin will do the former, while typically a cloud admin will do the later.  If it is the same API, we cannot easily distinguish this in the keystone policy rule for this API.","commit_id":"a32554f77e64d9b30330cea43e9635a844d840f4"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"80009041174e88f1eede77b6e20a76507a42fd65","unresolved":false,"context_lines":[{"line_number":31,"context_line":"of roles that exist in the service policy files, for instance the domain role"},{"line_number":32,"context_line":"\"vm-manager\" might actually represent of a series of service capabilities,"},{"line_number":33,"context_line":"e.g. create-vm, delete-vm, backup-vm etc. (which are, today, what we define"},{"line_number":34,"context_line":"as roles)."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_6d0e5634","line":34,"updated":"2014-11-28 19:21:47.000000000","message":"This isn\u0027t always the case, since a role today can have the capability to perform multiple capabilities. So whilst it is possible to define separate roles for each capability, it is also possible to define a role that has many capabilities e.g. the role of admin","commit_id":"f0194327e35803bbd78cffb6d47dc17ba7711bdb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d7da726a6fc9846451c8ea2313297cd561ce198a","unresolved":false,"context_lines":[{"line_number":31,"context_line":"of roles that exist in the service policy files, for instance the domain role"},{"line_number":32,"context_line":"\"vm-manager\" might actually represent of a series of service capabilities,"},{"line_number":33,"context_line":"e.g. create-vm, delete-vm, backup-vm etc. (which are, today, what we define"},{"line_number":34,"context_line":"as roles)."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_0505aa13","line":34,"in_reply_to":"5a890539_6d0e5634","updated":"2014-11-29 00:03:38.000000000","message":"I agree - I am not discounting the ability of roles to have a broader scope than a single API, as we do today in a policy file.  What I am trying to get it is that the introduction of domain roles lets the opposite happen, i.e. roles can, if the cloud provider wishes, now tend towards individual capabilities (because the domain scoped abstraction we introduce here).","commit_id":"f0194327e35803bbd78cffb6d47dc17ba7711bdb"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"80009041174e88f1eede77b6e20a76507a42fd65","unresolved":false,"context_lines":[{"line_number":43,"context_line":"a service, then creating a domain-roles of vm-manager that contained these roles"},{"line_number":44,"context_line":"would give a user with that role-group on a given project access to all those"},{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_4d3fdab5","line":46,"updated":"2014-11-28 19:21:47.000000000","message":"What you are describing here is hierarchical roles, where a superior role e.g. vm-manager, is superior to the create-vm role, delete-vm role etc.\n\nI think it would be negative to introduce a different terminology into Keystone for something that is already well established in RBAC, namely role hierarchies. So lets call role groups role hierarchies instead.","commit_id":"f0194327e35803bbd78cffb6d47dc17ba7711bdb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d7da726a6fc9846451c8ea2313297cd561ce198a","unresolved":false,"context_lines":[{"line_number":43,"context_line":"a service, then creating a domain-roles of vm-manager that contained these roles"},{"line_number":44,"context_line":"would give a user with that role-group on a given project access to all those"},{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_c50ac226","line":46,"in_reply_to":"5a890539_4d3fdab5","updated":"2014-11-29 00:03:38.000000000","message":"I don\u0027t want to use the naked term role here....since the whole point IS to keep whatever we call the thing I am describing here (now called domain roles) and the existing roles as different entities.  The crucial thing is who manages them.  Global roles are managed by a cloud provider (they are tied to the service policy file).  Domain roles can be managed by a domain admin who has no ability to change the policy file.  We don\u0027t have the ability to protect on an object-by-object basis, only on an entity API basis - hence keeping them as different entities.","commit_id":"f0194327e35803bbd78cffb6d47dc17ba7711bdb"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"80009041174e88f1eede77b6e20a76507a42fd65","unresolved":false,"context_lines":[{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Domain-roles will be name-spaced by domain, allowing each domain to create their"},{"line_number":53,"context_line":"own set of domain-roles that map to the global roles."},{"line_number":54,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_cd72eaaf","line":51,"updated":"2014-11-28 19:21:47.000000000","message":"We can implement role hierarchies in exactly the same way where we include all the subordinate roles in tokens, making no impact on services or policies.","commit_id":"f0194327e35803bbd78cffb6d47dc17ba7711bdb"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"80009041174e88f1eede77b6e20a76507a42fd65","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Domain-roles will be name-spaced by domain, allowing each domain to create their"},{"line_number":53,"context_line":"own set of domain-roles that map to the global roles."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Although outside of the scope of this specification, it is anticipated that with"},{"line_number":56,"context_line":"the introduction of hierarchical multitenancy, domain-roles will be treated like"},{"line_number":57,"context_line":"other domain-specific inheritable objects."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_0da4f206","line":54,"updated":"2014-11-28 19:21:47.000000000","message":"Agreed","commit_id":"f0194327e35803bbd78cffb6d47dc17ba7711bdb"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"80009041174e88f1eede77b6e20a76507a42fd65","unresolved":false,"context_lines":[{"line_number":59,"context_line":"One further impact of this change is allows what we currently call roles to"},{"line_number":60,"context_line":"become service capabilities, while the domain-roles provide the abstraction"},{"line_number":61,"context_line":"that a domain admin would use, more often than not, for their users."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatives"},{"line_number":64,"context_line":"------------"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_6d63b6dd","line":62,"updated":"2014-11-28 19:21:47.000000000","message":"In summary, this document specifies two different concepts, namely\n\nrole hierarchies, termed role groups here, and\n\ndomain scoped roles.\n\nThese are separate concepts and can be dealt with in separate specifications, since they are independent of each other. (and we already have a spec for role hierarchies).\n\nIncidentally, domain scoped roles are very similar in concept to VO roles, and therefore the same concept (with whatever label we give it) can be used to implement both.","commit_id":"f0194327e35803bbd78cffb6d47dc17ba7711bdb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d7da726a6fc9846451c8ea2313297cd561ce198a","unresolved":false,"context_lines":[{"line_number":59,"context_line":"One further impact of this change is allows what we currently call roles to"},{"line_number":60,"context_line":"become service capabilities, while the domain-roles provide the abstraction"},{"line_number":61,"context_line":"that a domain admin would use, more often than not, for their users."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatives"},{"line_number":64,"context_line":"------------"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_e505fe15","line":62,"in_reply_to":"5a890539_6d63b6dd","updated":"2014-11-29 00:03:38.000000000","message":"there are no role groups....I am just describing domain roles here - as per the comment in gerrit - I just have started using the term domain roles for what the previous version of this spec called role groups (because others complained they did not like the \"group\" part of the name)","commit_id":"f0194327e35803bbd78cffb6d47dc17ba7711bdb"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"80009041174e88f1eede77b6e20a76507a42fd65","unresolved":false,"context_lines":[{"line_number":67,"context_line":"which represent today\u0027s roles, and then reference these capabilities from"},{"line_number":68,"context_line":"policy and/or domain roles. This is maybe where we end up, this spec is"},{"line_number":69,"context_line":"designed to take us there in smaller increments"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"2) We could create a hierarchy of the global roles which are used in policy"},{"line_number":72,"context_line":"files directly, to encapsulate relationships between roles. This is outlined"},{"line_number":73,"context_line":"in the hierarchical roles spec:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_8d8e2278","line":70,"updated":"2014-11-28 19:21:47.000000000","message":"Actually there is little difference between having capabilities and roles which represent single capabilities. You just need a mapping between one string and another. The recipient has to know the meaning of the string whether it says RoleX or CreateVM.","commit_id":"f0194327e35803bbd78cffb6d47dc17ba7711bdb"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"369338816aee8e476c8eef1394c83ae70e87d270","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Allow the creation of domain roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"roles or other domain roles). A domain role to be used as part of an"},{"line_number":15,"context_line":"assignment, in the same was as you can assign an individual, global role."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_9f5723ca","line":16,"updated":"2014-11-30 08:38:22.000000000","message":"Henry, could you please add the following text.\n\n\nIn federated Keystone, the users who are members of a given domain role, may originate from different IdPs. Furthermore, users from a given IdP may be members of different domain roles in different domains (e.g. consider IBM, which has dozens of different Keystone domains used by its different organisational units, but runs a single IDP for all its employees).\n\nConsequently there needs to be a many to many mapping between IdPs and domain roles.","commit_id":"904e8c30d45def2cf7071008ad3e26e808fcf5d5"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"ff58783601e910c375f2f77e776e656c3be51ef5","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Allow the creation of domain roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"roles or other domain roles). A domain role to be used as part of an"},{"line_number":15,"context_line":"assignment, in the same was as you can assign an individual, global role."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_a4c92fae","line":16,"in_reply_to":"5a890539_5ae86916","updated":"2014-11-30 19:40:24.000000000","message":"Yes this covers what I mean by the proposed text. If you think it does not say that, then please edit it as appropriate to be more clear.\n\nThere is no intention in the non-federated case that domain-roles can cross reference each other. This is why my proposed  text specifically started with \"In federated Keystone...\"","commit_id":"904e8c30d45def2cf7071008ad3e26e808fcf5d5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"34701c6253924e3c343c280418a8bb2b052406da","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Allow the creation of domain roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"roles or other domain roles). A domain role to be used as part of an"},{"line_number":15,"context_line":"assignment, in the same was as you can assign an individual, global role."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_5ae86916","line":16,"in_reply_to":"5a890539_9f5723ca","updated":"2014-11-30 10:35:16.000000000","message":"So my assumption of how this would work is:\n\n1) A Keystone domain has the ability to trust one or more IdPs, allowing federation from any users attested by those IdPs\n\n2) A domain-role can be assigned to any user or group within a given domain (including one that trusts many IdPs)\n\nDoes that cover what you mean, or are you trying to make it more flexible than that?\n\nWhat I don\u0027t think we want is for (in a non federated case), that I can include in my domain-role, a domain-role from some other arbitrary domain.  The exception to this would be (once we have hierarchical inheritance working for \"projects marked with domain-ness\" down the tree), that I can see and reference domain-roles that are in my ancestors (provided such inheritance has not been blocked)","commit_id":"904e8c30d45def2cf7071008ad3e26e808fcf5d5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"ab0d4351551bf568630942be252cb57ce2144625","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Allow the creation of domain roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"roles or other domain roles). A domain role to be used as part of an"},{"line_number":15,"context_line":"assignment, in the same was as you can assign an individual, global role."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_4234f249","line":16,"in_reply_to":"5a890539_a4c92fae","updated":"2014-12-01 12:38:09.000000000","message":"Ok, I\u0027ll add some text under the \"proposed change\" section","commit_id":"904e8c30d45def2cf7071008ad3e26e808fcf5d5"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"369338816aee8e476c8eef1394c83ae70e87d270","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"One further impact of this change is that it allows what we currently call"},{"line_number":60,"context_line":"roles to become, if appropriate for the cloud provider, service capabilities,"},{"line_number":61,"context_line":"while the domain-roles provide the bstraction that a domain admin would use,"},{"line_number":62,"context_line":"more often than not, for their users."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_7fd2775c","line":61,"updated":"2014-11-30 08:38:22.000000000","message":"abstraction","commit_id":"904e8c30d45def2cf7071008ad3e26e808fcf5d5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"34701c6253924e3c343c280418a8bb2b052406da","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"One further impact of this change is that it allows what we currently call"},{"line_number":60,"context_line":"roles to become, if appropriate for the cloud provider, service capabilities,"},{"line_number":61,"context_line":"while the domain-roles provide the bstraction that a domain admin would use,"},{"line_number":62,"context_line":"more often than not, for their users."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_da94598e","line":61,"in_reply_to":"5a890539_7fd2775c","updated":"2014-11-30 10:35:16.000000000","message":"Will change, thanks.","commit_id":"904e8c30d45def2cf7071008ad3e26e808fcf5d5"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"3d48d91fdee9a7e23813518662ea18238a76ec37","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Problem Description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"The existing definition of a role is a direct link to the policy rules, i.e."},{"line_number":21,"context_line":"the role name is the item that is referenced directly from policy."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"An individual domain (which might represent, for example, a customer)"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_156e93c9","line":20,"updated":"2014-12-01 22:02:59.000000000","message":"Problem description is very clear and motivates the why this problem needs to be solved","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"3d48d91fdee9a7e23813518662ea18238a76ec37","unresolved":false,"context_lines":[{"line_number":27,"context_line":"that a domain administrator can typically change. This issue will only become"},{"line_number":28,"context_line":"more problematic with the introduction of hierarchical projects and domains."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Further, the role that is meaningful at a domain level, maybe be a collection"},{"line_number":31,"context_line":"of roles that exist in the service policy files, for instance the domain role"},{"line_number":32,"context_line":"\"vm-manager\" might actually represent of a series of service capabilities,"},{"line_number":33,"context_line":"e.g. create-vm, delete-vm, backup-vm etc. (which are, today, what we define"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_f5282787","line":30,"updated":"2014-12-01 22:02:59.000000000","message":"nit:typo \"maybe be\"  may be","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fe1de49283ecc7f51dafebce8ee8f8a4e0440930","unresolved":false,"context_lines":[{"line_number":27,"context_line":"that a domain administrator can typically change. This issue will only become"},{"line_number":28,"context_line":"more problematic with the introduction of hierarchical projects and domains."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Further, the role that is meaningful at a domain level, maybe be a collection"},{"line_number":31,"context_line":"of roles that exist in the service policy files, for instance the domain role"},{"line_number":32,"context_line":"\"vm-manager\" might actually represent of a series of service capabilities,"},{"line_number":33,"context_line":"e.g. create-vm, delete-vm, backup-vm etc. (which are, today, what we define"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_f5a643c0","line":30,"in_reply_to":"5a890539_f5282787","updated":"2014-12-02 19:05:14.000000000","message":"Done","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"3d48d91fdee9a7e23813518662ea18238a76ec37","unresolved":false,"context_lines":[{"line_number":32,"context_line":"\"vm-manager\" might actually represent of a series of service capabilities,"},{"line_number":33,"context_line":"e.g. create-vm, delete-vm, backup-vm etc. (which are, today, what we define"},{"line_number":34,"context_line":"as roles)."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_954a8353","line":35,"updated":"2014-12-01 22:02:59.000000000","message":"Outstanding how you clarify how the domain role can actually be a collection of roles","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"3d48d91fdee9a7e23813518662ea18238a76ec37","unresolved":false,"context_lines":[{"line_number":44,"context_line":"would give a user with that domain on a given project access to all those"},{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_55c3bb89","line":47,"updated":"2014-12-01 22:02:59.000000000","message":"So in the token the domain roles are expanded into their member roles which is great. But is there also a domain-role id added that enables someone to determine that a particular domain role was actually in use?  If not is there a way to determine the relationship here (from expanded roles to the used domain role)  for troubleshooting purposes?","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fe1de49283ecc7f51dafebce8ee8f8a4e0440930","unresolved":false,"context_lines":[{"line_number":44,"context_line":"would give a user with that domain on a given project access to all those"},{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_5520f748","line":47,"in_reply_to":"5a890539_55c3bb89","updated":"2014-12-02 19:05:14.000000000","message":"so we don\u0027t add a domain-role...in the same way we don\u0027t include (for instance) what group membership led to the inclusion of group roles being added to the token.  We\u0027d need a much more flexible token format to support that.","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"3d48d91fdee9a7e23813518662ea18238a76ec37","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"One further impact of this change is that it allows what we currently call"},{"line_number":63,"context_line":"roles to become, if appropriate for the cloud provider, service capabilities,"},{"line_number":64,"context_line":"while the domain-roles provide the abstraction that a domain admin would use,"},{"line_number":65,"context_line":"more often than not, for their users."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_75f357e7","line":64,"updated":"2014-12-01 22:02:59.000000000","message":"Very good to point out the side effect benefit of being able to spport service capabilities","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"3d48d91fdee9a7e23813518662ea18238a76ec37","unresolved":false,"context_lines":[{"line_number":77,"context_line":"in the hierarchical roles spec:"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"`bp hierarchical-roles \u003chttps://blueprints.launchpad.net/keystone/+spec/hierarchical-roles\u003e`_"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Data Model Impact"},{"line_number":82,"context_line":"-----------------"},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_d5d24b33","line":80,"updated":"2014-12-01 22:02:59.000000000","message":"Can you add some justification for why you feel the proposed solution is a better choice that the alternatives that you list?","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fe1de49283ecc7f51dafebce8ee8f8a4e0440930","unresolved":false,"context_lines":[{"line_number":77,"context_line":"in the hierarchical roles spec:"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"`bp hierarchical-roles \u003chttps://blueprints.launchpad.net/keystone/+spec/hierarchical-roles\u003e`_"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Data Model Impact"},{"line_number":82,"context_line":"-----------------"},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_75cb3372","line":80,"in_reply_to":"5a890539_d5d24b33","updated":"2014-12-02 19:05:14.000000000","message":"will do","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"3d48d91fdee9a7e23813518662ea18238a76ec37","unresolved":false,"context_lines":[{"line_number":84,"context_line":"For SQL, a new table will be created to hold the domain-roles and the"},{"line_number":85,"context_line":"assignments table will be able to store a domain_role_id in place of a role_id."},{"line_number":86,"context_line":"It is proposed to not support domain-roles with the LDAP backend, until we"},{"line_number":87,"context_line":"enable an un-fettered R/W LDAP backend that can impose its own schema."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"REST API Impact"},{"line_number":90,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_95752334","line":87,"updated":"2014-12-01 22:02:59.000000000","message":"Are we implying that for a typical read only LDAP backend there is not a typically used construct that maps to the concept of a domain role and as a result we don\u0027t know how we would support domain roles for a typical read only LDAP that has just users and groups?","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fe1de49283ecc7f51dafebce8ee8f8a4e0440930","unresolved":false,"context_lines":[{"line_number":84,"context_line":"For SQL, a new table will be created to hold the domain-roles and the"},{"line_number":85,"context_line":"assignments table will be able to store a domain_role_id in place of a role_id."},{"line_number":86,"context_line":"It is proposed to not support domain-roles with the LDAP backend, until we"},{"line_number":87,"context_line":"enable an un-fettered R/W LDAP backend that can impose its own schema."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"REST API Impact"},{"line_number":90,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5a890539_55e71712","line":87,"in_reply_to":"5a890539_95752334","updated":"2014-12-02 19:05:14.000000000","message":"yes, that is what I am implying.","commit_id":"6169c4224a3b07707088985d72b18ccd787bc9f6"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"6e0bd70dc86c15dd70cbb42ef82a2c6887d9454b","unresolved":false,"context_lines":[{"line_number":82,"context_line":"solve the issue that two different personas are involved - a cloud"},{"line_number":83,"context_line":"administrator who is typically responsible for creating the policy files (and"},{"line_number":84,"context_line":"hence the roles contained therein) and a domain administrator who wants to"},{"line_number":85,"context_line":"create meaningful roles for his/her users but typically has not ability to"},{"line_number":86,"context_line":"change policy files."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Data Model Impact"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_11e3ded9","line":85,"updated":"2014-12-02 20:55:26.000000000","message":"very small nit, just fyi. need a \"the\" between \"not\" and \"ability\"","commit_id":"6b110b90e96a381e36e0139b998e0e59e96f9434"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a37c7b31f2371aa3c1d27296cec6d32a8e6f7df9","unresolved":false,"context_lines":[{"line_number":82,"context_line":"solve the issue that two different personas are involved - a cloud"},{"line_number":83,"context_line":"administrator who is typically responsible for creating the policy files (and"},{"line_number":84,"context_line":"hence the roles contained therein) and a domain administrator who wants to"},{"line_number":85,"context_line":"create meaningful roles for his/her users but typically has not ability to"},{"line_number":86,"context_line":"change policy files."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Data Model Impact"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_2055dec1","line":85,"in_reply_to":"5a890539_11e3ded9","updated":"2014-12-02 22:57:56.000000000","message":"Done","commit_id":"6b110b90e96a381e36e0139b998e0e59e96f9434"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"2d07c062254513136dde5ce9a7f614e8426e54ae","unresolved":false,"context_lines":[{"line_number":27,"context_line":"that a domain administrator can typically change. This issue will only become"},{"line_number":28,"context_line":"more problematic with the introduction of hierarchical projects and domains."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Further, the role that is meaningful at a domain level, may be be a collection"},{"line_number":31,"context_line":"of roles that exist in the service policy files, for instance the domain role"},{"line_number":32,"context_line":"\"vm-manager\" might actually represent of a series of service capabilities,"},{"line_number":33,"context_line":"e.g. create-vm, delete-vm, backup-vm etc. (which are, today, what we define"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_2aec85ba","line":30,"updated":"2014-12-15 11:24:29.000000000","message":"remove one be","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"2d07c062254513136dde5ce9a7f614e8426e54ae","unresolved":false,"context_lines":[{"line_number":31,"context_line":"of roles that exist in the service policy files, for instance the domain role"},{"line_number":32,"context_line":"\"vm-manager\" might actually represent of a series of service capabilities,"},{"line_number":33,"context_line":"e.g. create-vm, delete-vm, backup-vm etc. (which are, today, what we define"},{"line_number":34,"context_line":"as roles)."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_2a4805b2","line":34,"updated":"2014-12-15 11:24:29.000000000","message":"a domain role vm-manager (usable only for one domain) would in fact  be \u0027container role\u0027 of roles create-vm, delete-vm, backup-vm etc, right?","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c4c0f6b403bd503d70277e2118816d8ba9588030","unresolved":false,"context_lines":[{"line_number":31,"context_line":"of roles that exist in the service policy files, for instance the domain role"},{"line_number":32,"context_line":"\"vm-manager\" might actually represent of a series of service capabilities,"},{"line_number":33,"context_line":"e.g. create-vm, delete-vm, backup-vm etc. (which are, today, what we define"},{"line_number":34,"context_line":"as roles)."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_67e149d0","line":34,"in_reply_to":"3a961159_2a4805b2","updated":"2014-12-17 10:38:46.000000000","message":"correct","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"734c80b2fb5468b6b9f1299d733751f785f894cf","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_8896b492","line":48,"updated":"2014-12-03 02:45:36.000000000","message":"Does that mean domain roles by itself are inheritable?","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"019fbc8a4520e17eed5b76259f297e64440a89c4","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_509c20c0","line":48,"in_reply_to":"5a890539_1048d85a","updated":"2014-12-04 19:04:15.000000000","message":"Thanks got it","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"fd40775610b6e4b720bfc2d4705f3bed53692811","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_47eaa9a0","line":48,"in_reply_to":"5a890539_2e3bbf38","updated":"2014-12-04 17:15:53.000000000","message":"This is the part I don\u0027t understand.\n\nDomain roles are tied to domain. (i.e) A domain admin creates for his domain\u0027s use\n\nAre we going to make sure that that the following api is used only by the owner of domain_roles\n\nPUT /OS-INHERIT/domains/{domain_id}/users/{user_id}/domain_roles/{domain_role_id}/inherited_to_projects\n\nHow about \n\nPUT /OS-INHERIT/projects/{project_id}/users/{user_id}/domain_roles/{domain_role_id}/inherited_to_projects\n\nBasically here domain_roles can leak to any projects which may not part of domain","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"f5737df820ff6ce810ac629faf470ca4a3cf8ea6","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_6778848f","line":48,"in_reply_to":"5a890539_47eaa9a0","updated":"2014-12-04 17:32:36.000000000","message":"Yes, we need to check that the scope  where the role grant is being applied (domain or project) matches with the domain-role namespace.","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"d21ab103307702ab1b076d6d4666ad564063c162","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_8a783f2c","line":48,"in_reply_to":"5a890539_5bb1d38d","updated":"2014-12-03 21:10:01.000000000","message":"My question is more towards, can I say a domain roles itself can be inherited ( domain role name is bit confusing,)  \n\n (i.e)  In the call below\n\nPUT /OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects \n\nDo you intent to support domain_roles_id  besides of role_id  in the above call?","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b8dedc0813052a2e47d60497dccdd1abc5035030","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_85901fee","line":48,"in_reply_to":"5a890539_65917351","updated":"2014-12-04 07:24:45.000000000","message":"Why do we need a separate resource for domain roles definitions? They are role definition. Only difference is that they are namespaced or identified by a specific flag.\n\nWhy not just\n\nPUT /OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{domain_role_id}/inherited_to_projects\n\nThis is essentially the same argument for merging projects with domains. I have no problem either way, but please try to keep it consistent with the others.","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"f4c3ab32de6c2c2581a231ed1c761be479840950","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_ca95bd40","line":48,"in_reply_to":"5a890539_6778848f","updated":"2014-12-04 18:16:29.000000000","message":"for domain role  inheritance we can check. How about inheritance for HMT?\n\nPUT /OS-INHERIT/projects/{project_id}/users/{user_id}/domain_roles/{domain_role_id}/inherited_to_projects\n\nIf this is parent of another project in another domain, then  the role  can be inherited from here to some other domain. Is that  acceptable?","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"859bc08162d291d82babffa38b45a20d90800558","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_2e3bbf38","line":48,"in_reply_to":"5a890539_85901fee","updated":"2014-12-04 13:46:55.000000000","message":"I think you make a valid point Guang....I\u0027d been mulling that idea...gonna lay out the API spec so we can review.","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"faea2d74e892c58f327bf2112dfa7c22ad2ef136","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_5bb1d38d","line":48,"in_reply_to":"5a890539_8896b492","updated":"2014-12-03 19:37:57.000000000","message":"On lines 59-60 it says, \"domain-roles will be\ttreated like other domain-specific inheritable objects\"","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"764f33b96bd2a8160beb28f2073d230fd48baaf8","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_65917351","line":48,"in_reply_to":"5a890539_8a783f2c","updated":"2014-12-04 07:00:20.000000000","message":"Yes, absolutely.  They API will be something like:\n\nPUT /OS-INHERIT/domains/{domain_id}/users/{user_id}/domain_roles/{domain_role_id}/inherited_to_projects","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"f94cebce7d40819e53fede030b4db1715918d61a","unresolved":false,"context_lines":[{"line_number":45,"context_line":"APIs."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_1048d85a","line":48,"in_reply_to":"5a890539_ca95bd40","updated":"2014-12-04 19:03:18.000000000","message":"A project cannot be parent of another project on another domain.\nThe allowed structure is:\ni) domains can only be created under other domains;\nii) projects can be created under domains or under other projects.\n\nThat implies that a project cannot be parent of a domain.","commit_id":"f01aa67350560e50c5a17ab0b5ad68c35ebf2087"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"7cbbda70c61c87b1e90d7d6a2652d21ad6563fb6","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp role-groups \u003chttps://blueprints.launchpad.net/keystone/+spec/role-groups\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of domain roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"roles or other domain roles). A domain role to be used as part of an"},{"line_number":15,"context_line":"assignment, in the same was as you can assign an individual, global role."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_fe3bc9c5","line":14,"updated":"2014-12-18 13:24:14.000000000","message":"can be used ?","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"1a05895a05d90bb4f2722e6a362468d2c37c74ac","unresolved":false,"context_lines":[{"line_number":31,"context_line":"of roles that exist in the service policy files, for instance the domain role"},{"line_number":32,"context_line":"\"vm-manager\" might actually represent of a series of service capabilities,"},{"line_number":33,"context_line":"e.g. create-vm, delete-vm, backup-vm etc. (which are, today, what we define"},{"line_number":34,"context_line":"as roles)."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Proposed Change"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_09ee2122","line":34,"updated":"2015-01-07 18:25:00.000000000","message":"Great problem description!","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"1a05895a05d90bb4f2722e6a362468d2c37c74ac","unresolved":false,"context_lines":[{"line_number":47,"context_line":"A domain-role can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":48,"context_line":"can be used today. In terms of token generation, domain-roles will be expanded"},{"line_number":49,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":50,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":51,"context_line":"Further, domain-roles can be used with federation, allowing any of the attested"},{"line_number":52,"context_line":"users from IdPs, that are trusted by the domain, to gain domain-role"},{"line_number":53,"context_line":"assignments via the existing federated mapping to Keystone groups."}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_a9bb4d0d","line":50,"updated":"2015-01-07 18:25:00.000000000","message":"Nice job mentioning how the role expansion results in no impact outside of Keystone!","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"e2c04a7e9b93724050525ae92d7a5b862b0b6131","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Domain-roles will be name-spaced by domain, allowing each domain to create"},{"line_number":56,"context_line":"their own set of domain-roles that map to the global roles."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Although outside of the scope of this specification, it is anticipated that"},{"line_number":59,"context_line":"with the introduction of hierarchical multitenancy, domain-roles will be"},{"line_number":60,"context_line":"treated like other domain-specific inheritable objects."}],"source_content_type":"text/x-rst","patch_set":10,"id":"7a016987_02be2dff","line":57,"updated":"2015-05-27 06:35:39.000000000","message":"Why do you want to map domain roles into global roles? If a domain role has an equivalent global role, then arent they just aliases of each other?","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"e2c04a7e9b93724050525ae92d7a5b862b0b6131","unresolved":false,"context_lines":[{"line_number":60,"context_line":"treated like other domain-specific inheritable objects."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"One further impact of this change is that it allows what we currently call"},{"line_number":63,"context_line":"roles to become, if appropriate for the cloud provider, service capabilities,"},{"line_number":64,"context_line":"while the domain-roles provide the abstraction that a domain admin would use,"},{"line_number":65,"context_line":"more often than not, for their users."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"7a016987_a262b9ab","line":63,"updated":"2015-05-27 06:35:39.000000000","message":"I dont follow the logic of this comment, since a role is already a set of service capabilities. So what is the new thing you are proposing?","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"7cbbda70c61c87b1e90d7d6a2652d21ad6563fb6","unresolved":false,"context_lines":[{"line_number":70,"context_line":"1) We could go further and introduce \"capabilities\" as a first class citizen,"},{"line_number":71,"context_line":"which represent today\u0027s roles, and then reference these capabilities from"},{"line_number":72,"context_line":"policy and/or domain roles. This is maybe where we end up, this spec is"},{"line_number":73,"context_line":"designed to take us there in smaller increments."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"2) We could create a hierarchy of the global roles which are used in policy"},{"line_number":76,"context_line":"files directly, to encapsulate relationships between roles. This is outlined"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_3ee2b12f","line":73,"updated":"2014-12-18 13:24:14.000000000","message":"Great!","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"e2c04a7e9b93724050525ae92d7a5b862b0b6131","unresolved":false,"context_lines":[{"line_number":71,"context_line":"which represent today\u0027s roles, and then reference these capabilities from"},{"line_number":72,"context_line":"policy and/or domain roles. This is maybe where we end up, this spec is"},{"line_number":73,"context_line":"designed to take us there in smaller increments."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"2) We could create a hierarchy of the global roles which are used in policy"},{"line_number":76,"context_line":"files directly, to encapsulate relationships between roles. This is outlined"},{"line_number":77,"context_line":"in the hierarchical roles spec:"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7a016987_02dbcd1c","line":74,"updated":"2015-05-27 06:35:39.000000000","message":"I am assuming by capability you mean an action on a resource. But if not. then please say what you do mean by a capability. \nSince a role is simply an indirect reference to a set of capabilities, and currently policies contain capabilities and roles, then I don\u0027t understand what you mean by a policy that references capabilities.","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"1a05895a05d90bb4f2722e6a362468d2c37c74ac","unresolved":false,"context_lines":[{"line_number":83,"context_line":"administrator who is typically responsible for creating the policy files (and"},{"line_number":84,"context_line":"hence the roles contained therein) and a domain administrator who wants to"},{"line_number":85,"context_line":"create meaningful roles for his/her users but typically has no ability to"},{"line_number":86,"context_line":"change policy files."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Data Model Impact"},{"line_number":89,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_296bddf1","line":86,"updated":"2015-01-07 18:25:00.000000000","message":"Great clarification describing how domain administrator has less capability than the cloud administrator","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"1a05895a05d90bb4f2722e6a362468d2c37c74ac","unresolved":false,"context_lines":[{"line_number":91,"context_line":"For SQL, a new table will be created to hold the domain-roles and the"},{"line_number":92,"context_line":"assignments table will be able to store a domain_role_id in place of a role_id."},{"line_number":93,"context_line":"It is proposed to not support domain-roles with the LDAP backend, until we"},{"line_number":94,"context_line":"enable an un-fettered R/W LDAP backend that can impose its own schema."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"REST API Impact"},{"line_number":97,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_dbb13c45","line":94,"updated":"2015-01-07 18:25:00.000000000","message":"So this is in an interesting ramification on the R/W LDAP backend.  A lot of LDAP schema work will be needed to keep function parity :-(. And then that will require migration or a design thats backward compatible.... Seems like this is highlighting that the problems we used to have when trying to support a R/W LDAP backend will repeat themselves.","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"cdafc30356b44cb06c114d7a86a237faa55ec0f0","unresolved":false,"context_lines":[{"line_number":91,"context_line":"For SQL, a new table will be created to hold the domain-roles and the"},{"line_number":92,"context_line":"assignments table will be able to store a domain_role_id in place of a role_id."},{"line_number":93,"context_line":"It is proposed to not support domain-roles with the LDAP backend, until we"},{"line_number":94,"context_line":"enable an un-fettered R/W LDAP backend that can impose its own schema."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"REST API Impact"},{"line_number":97,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_1c0333bf","line":94,"in_reply_to":"3a961159_dbb13c45","updated":"2015-01-19 18:31:04.000000000","message":"One thing that we could do is have the domain-roles in their own backend (within assignment, much like we are about to do for roles).  That way, for instance, you could use SQL for domain-roles and LDAP for the actual assignments if you wanted.","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"7cbbda70c61c87b1e90d7d6a2652d21ad6563fb6","unresolved":false,"context_lines":[{"line_number":97,"context_line":"---------------"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"A new CRUD API will be provided for the management of domain-roles. The"},{"line_number":100,"context_line":"grant APIs will also allow a domain-role ID to specified in place of a role ID"},{"line_number":101,"context_line":"(See https://review.openstack.org/#/c/139531)."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_c12ae62b","line":100,"updated":"2014-12-18 13:24:14.000000000","message":"to be specified ?","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"5d2e07f5252c64f130132e43ffc1157c417963ba","unresolved":false,"context_lines":[{"line_number":168,"context_line":"References"},{"line_number":169,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_de8718d6","line":171,"updated":"2014-12-16 11:35:13.000000000","message":"Suggestion: add a reference to the Reseller spec (https://review.openstack.org/#/c/139824/), there is no dependency IMHO, but would help someone who is going through this and is not aware about both efforts.","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"3ced98babc166e9f70409690f1fdfab19318e834","unresolved":false,"context_lines":[{"line_number":168,"context_line":"References"},{"line_number":169,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_aed5ae44","line":171,"in_reply_to":"3a961159_5e5e9dea","updated":"2015-01-21 20:04:37.000000000","message":"Where?","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"7cbbda70c61c87b1e90d7d6a2652d21ad6563fb6","unresolved":false,"context_lines":[{"line_number":168,"context_line":"References"},{"line_number":169,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_5e5e9dea","line":171,"in_reply_to":"3a961159_de8718d6","updated":"2014-12-18 13:24:14.000000000","message":"There is a reference in the REST API Impact subsection","commit_id":"92dadf01939639f398762c5c5e088dfed03a2509"}],"specs/kilo/role-groups.rst":[{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"42f865ad5093df31462bd3011d9e62a44d8c920c","unresolved":false,"context_lines":[{"line_number":21,"context_line":"typically what happens with RBAC, where the role might actually be mapped"},{"line_number":22,"context_line":"onto some lower set of capabilities, for instance the role \"vm-manager\" might"},{"line_number":23,"context_line":"actually consist of a series of capabilities, e.g. create-vm, delete-vm,"},{"line_number":24,"context_line":"backup-vm etc."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"A second problem exists when we consider a Keystone installation with multiple"},{"line_number":27,"context_line":"domains. An individual domain (which might represent, for example, a customer)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_b6d63326","line":24,"updated":"2014-11-17 21:01:22.000000000","message":"Can you please explain how role role groups helps in mapping to capabilities?","commit_id":"0355775fd317478263d29459504b248a33f23ae1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"94ccec68e5233d86ca68f0c5549cce993fb238a0","unresolved":false,"context_lines":[{"line_number":21,"context_line":"typically what happens with RBAC, where the role might actually be mapped"},{"line_number":22,"context_line":"onto some lower set of capabilities, for instance the role \"vm-manager\" might"},{"line_number":23,"context_line":"actually consist of a series of capabilities, e.g. create-vm, delete-vm,"},{"line_number":24,"context_line":"backup-vm etc."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"A second problem exists when we consider a Keystone installation with multiple"},{"line_number":27,"context_line":"domains. An individual domain (which might represent, for example, a customer)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_f347d1b9","line":24,"in_reply_to":"5a890539_b6d63326","updated":"2014-11-18 14:39:09.000000000","message":"Well that should\u0027t be done in the problem description section - it should be in the proposed change section. I\u0027ll add a bit more detail to that.","commit_id":"0355775fd317478263d29459504b248a33f23ae1"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"3a1a930ec922b913a75f28a3d050f02179b1f318","unresolved":false,"context_lines":[{"line_number":34,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"It is proposed that we allow the creation of role groups, which can contain a"},{"line_number":37,"context_line":"list of one or more roles and/or other role groups. A role group can be used"},{"line_number":38,"context_line":"(in terms of assignment APIs) everywhere that a role can be used today. In"},{"line_number":39,"context_line":"terms of token generation, role groups will be expanded into their member roles at"},{"line_number":40,"context_line":"token generation time, meaning that there will be no impact on services"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_cd8f4a22","line":37,"updated":"2014-11-12 00:18:37.000000000","message":"nice! with nested role groups, this should cover the hierarchical role proposal as well. Kill two birds with one stone! :)","commit_id":"0355775fd317478263d29459504b248a33f23ae1"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"42f865ad5093df31462bd3011d9e62a44d8c920c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"token generation time, meaning that there will be no impact on services"},{"line_number":41,"context_line":"outside of Keystone."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Role groups will be name-spaced by domain, allowing each domain to create their"},{"line_number":44,"context_line":"own set of role groups that map to the global roles."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Although outside of the scope of this specification, it is anticipated that with"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_36c7a397","line":43,"updated":"2014-11-17 21:01:22.000000000","message":"What will happen to current policy file?  Is it based on role or role group?","commit_id":"0355775fd317478263d29459504b248a33f23ae1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"94ccec68e5233d86ca68f0c5549cce993fb238a0","unresolved":false,"context_lines":[{"line_number":40,"context_line":"token generation time, meaning that there will be no impact on services"},{"line_number":41,"context_line":"outside of Keystone."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Role groups will be name-spaced by domain, allowing each domain to create their"},{"line_number":44,"context_line":"own set of role groups that map to the global roles."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Although outside of the scope of this specification, it is anticipated that with"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_530a658a","line":43,"in_reply_to":"5a890539_36c7a397","updated":"2014-11-18 14:39:09.000000000","message":"No changes are required to the policy file, since as it says above, only roles get added to tokens....I\u0027ll try and make it clearer.","commit_id":"0355775fd317478263d29459504b248a33f23ae1"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"3a1a930ec922b913a75f28a3d050f02179b1f318","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Although outside of the scope of this specification, it is anticipated that with"},{"line_number":47,"context_line":"the introduction of hierarchical multitenancy, role groups will be treated like"},{"line_number":48,"context_line":"other domain-specific inheritable objects."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Alternatives"},{"line_number":51,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_0db152e1","line":48,"updated":"2014-11-12 00:18:37.000000000","message":"if it quacks like a duck, walks like a duck, then it must be a duck! :)","commit_id":"0355775fd317478263d29459504b248a33f23ae1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"94ccec68e5233d86ca68f0c5549cce993fb238a0","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Although outside of the scope of this specification, it is anticipated that with"},{"line_number":47,"context_line":"the introduction of hierarchical multitenancy, role groups will be treated like"},{"line_number":48,"context_line":"other domain-specific inheritable objects."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Alternatives"},{"line_number":51,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_3315d99b","line":48,"in_reply_to":"5a890539_0db152e1","updated":"2014-11-18 14:39:09.000000000","message":"..or a goose...","commit_id":"0355775fd317478263d29459504b248a33f23ae1"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"3a1a930ec922b913a75f28a3d050f02179b1f318","unresolved":false,"context_lines":[{"line_number":63,"context_line":"REST API Impact"},{"line_number":64,"context_line":"---------------"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"A new crud APi will be provided for the managament of role groups. The"},{"line_number":67,"context_line":"grant APIs will also allow a rolegroup ID to specifed in place of a role ID."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_6dc73646","line":66,"updated":"2014-11-12 00:18:37.000000000","message":"s/crud/CRUD/\n s/APi/API/","commit_id":"0355775fd317478263d29459504b248a33f23ae1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"94ccec68e5233d86ca68f0c5549cce993fb238a0","unresolved":false,"context_lines":[{"line_number":63,"context_line":"REST API Impact"},{"line_number":64,"context_line":"---------------"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"A new crud APi will be provided for the managament of role groups. The"},{"line_number":67,"context_line":"grant APIs will also allow a rolegroup ID to specifed in place of a role ID."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a890539_d323b502","line":66,"in_reply_to":"5a890539_6dc73646","updated":"2014-11-18 14:39:09.000000000","message":"Done","commit_id":"0355775fd317478263d29459504b248a33f23ae1"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"9bbcaba8301eddf8d615a4d6e7a54cf5e123f1c3","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Implement Role Groups"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp role-groups \u003chttps://blueprints.launchpad.net/keystone/+spec/role-groups\u003e`_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_1919ce79","line":8,"updated":"2014-11-18 20:47:19.000000000","message":"Can we change the name to \"private role groups?\"","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"4e96dd98b1d1d4aeb66a48e0e2fcec10f3ff7a4b","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Implement Role Groups"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp role-groups \u003chttps://blueprints.launchpad.net/keystone/+spec/role-groups\u003e`_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_79f2d207","line":8,"in_reply_to":"5a890539_1919ce79","updated":"2014-11-18 21:07:07.000000000","message":"Since they\u0027ll be private to domains, +1 to have a more meaningful name..\n\nAnother alternative could be \u0027domain role groups\u0027 ?","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"ad789e191262fa0ed46926ccbd2103403541d5dd","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of groups of roles, allowing a role group to be used as"},{"line_number":14,"context_line":"part of an assignment, in the same was as you can assign an individual role."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_53a88177","line":15,"updated":"2014-11-27 12:08:19.000000000","message":"I think the concept of a role group is a misnomer. What you call a role group is nothing more than a simple role that encapsulates other roles. In hierarchical RBAC a role can be superior to another role and is therefore the same as your role group. Implementing Hierarchical RBAC will provide the role group functionality that you are looking for. So I suggest this spec is replaced with one to implement hierarchical RBAC.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"ad789e191262fa0ed46926ccbd2103403541d5dd","unresolved":false,"context_lines":[{"line_number":22,"context_line":"onto some lower set of capabilities, for instance the role \"vm-manager\" might"},{"line_number":23,"context_line":"actually consist of a series of capabilities, e.g. create-vm, delete-vm,"},{"line_number":24,"context_line":"backup-vm etc."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"A second problem exists when we consider a Keystone installation with multiple"},{"line_number":27,"context_line":"domains. An individual domain (which might represent, for example, a customer)"},{"line_number":28,"context_line":"might wish to define a set of roles that are meaningful to them.  Today,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_33ef75eb","line":25,"updated":"2014-11-27 12:08:19.000000000","message":"I am not sure I agree with the above problem statement. Maybe it needs stating more clearly what the exact problem is. In RBAC, roles are directly referenced in RBAC policies, they have to be, since each policy says what permissions a role has. Therefore RBAC policies do contain roles in their rules. A typical RBAC rule might be\n\nIn order to create a VM you must have role X.\n\nIn order to delete a VM you must have role X.\netc.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"ad789e191262fa0ed46926ccbd2103403541d5dd","unresolved":false,"context_lines":[{"line_number":40,"context_line":"a service, then creating a role group of vm-manager that contained these roles"},{"line_number":41,"context_line":"would give a user with that role-group on a given project access to all those"},{"line_number":42,"context_line":"APIs."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"A role group can be used (in terms of assignment APIs) everywhere that a role"},{"line_number":45,"context_line":"can be used today. In terms of token generation, role groups will be expanded"},{"line_number":46,"context_line":"into their member roles at token generation time, meaning that there will be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_93074981","line":43,"updated":"2014-11-27 12:08:19.000000000","message":"Why is this not hierarchical RBAC by another name?","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"2a5c3dae2bd2abc9525255666becefc2606cc82b","unresolved":false,"context_lines":[{"line_number":46,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":47,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Role groups will be name-spaced by domain, allowing each domain to create their"},{"line_number":50,"context_line":"own set of role groups that map to the global roles."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Although outside of the scope of this specification, it is anticipated that with"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_960af225","line":49,"updated":"2014-11-18 18:34:35.000000000","message":"1) Is the naming scheme enforced internally or the caller is supposed to create the name prefixed with namespace? I believe it is enforced internally\n\n2) Are we going to enforce the role group assignment to only that domain?  e.g  If I have role group for DomainA, can I assign it to DomainB users.  If DomainB is inherited, can I assign it?","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"ef52ad7e2cc872982977d30290f4d224db20f460","unresolved":false,"context_lines":[{"line_number":46,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":47,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Role groups will be name-spaced by domain, allowing each domain to create their"},{"line_number":50,"context_line":"own set of role groups that map to the global roles."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Although outside of the scope of this specification, it is anticipated that with"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_5b78a5f8","line":49,"in_reply_to":"5a890539_59f27670","updated":"2014-11-19 00:40:39.000000000","message":"no, role groups are only visible within its owning domain. They should not be visible across domains.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"18a046e14c69f8966d639245385581c29216c255","unresolved":false,"context_lines":[{"line_number":46,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":47,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Role groups will be name-spaced by domain, allowing each domain to create their"},{"line_number":50,"context_line":"own set of role groups that map to the global roles."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Although outside of the scope of this specification, it is anticipated that with"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_bc68ad22","line":49,"in_reply_to":"5a890539_960af225","updated":"2014-11-18 19:19:24.000000000","message":"1) It\u0027s like when you great a usergroup (or user)...you explicitly create it in a domain - and that places it in the name space.\n\n2) Thinking about that one...:-)","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"4e96dd98b1d1d4aeb66a48e0e2fcec10f3ff7a4b","unresolved":false,"context_lines":[{"line_number":46,"context_line":"into their member roles at token generation time, meaning that there will be"},{"line_number":47,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Role groups will be name-spaced by domain, allowing each domain to create their"},{"line_number":50,"context_line":"own set of role groups that map to the global roles."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Although outside of the scope of this specification, it is anticipated that with"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_59f27670","line":49,"in_reply_to":"5a890539_bc68ad22","updated":"2014-11-18 21:07:07.000000000","message":"2) IMO, role-groups (that are by definition domain namespaced (scoped)) should not be applied cross-domains. Use global roles instead, if you want.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"287fe5404280e0e0e75ee608653ec5d99bd0e828","unresolved":false,"context_lines":[{"line_number":47,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Role groups will be name-spaced by domain, allowing each domain to create their"},{"line_number":50,"context_line":"own set of role groups that map to the global roles."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Although outside of the scope of this specification, it is anticipated that with"},{"line_number":53,"context_line":"the introduction of hierarchical multitenancy, role groups will be treated like"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_a622654f","line":50,"updated":"2014-11-18 14:48:52.000000000","message":"Do they always need to map to the global roles?\nA given domain should be able to have its own policy, using its defined roles, and the  owning domain don\u0027t need to know that, right?","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"ef52ad7e2cc872982977d30290f4d224db20f460","unresolved":false,"context_lines":[{"line_number":47,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Role groups will be name-spaced by domain, allowing each domain to create their"},{"line_number":50,"context_line":"own set of role groups that map to the global roles."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Although outside of the scope of this specification, it is anticipated that with"},{"line_number":53,"context_line":"the introduction of hierarchical multitenancy, role groups will be treated like"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_fb687123","line":50,"in_reply_to":"5a890539_7ce1e5fd","updated":"2014-11-19 00:40:39.000000000","message":"we don\u0027t have domain-specific policies today","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"18a046e14c69f8966d639245385581c29216c255","unresolved":false,"context_lines":[{"line_number":47,"context_line":"no impact on services outside of Keystone (and no change to policy files)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Role groups will be name-spaced by domain, allowing each domain to create their"},{"line_number":50,"context_line":"own set of role groups that map to the global roles."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Although outside of the scope of this specification, it is anticipated that with"},{"line_number":53,"context_line":"the introduction of hierarchical multitenancy, role groups will be treated like"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_7ce1e5fd","line":50,"in_reply_to":"5a890539_a622654f","updated":"2014-11-18 19:19:24.000000000","message":"Well, that\u0027s a step further...that the underlying roles are name spaced...but that\u0027s not part of this proposal.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"287fe5404280e0e0e75ee608653ec5d99bd0e828","unresolved":false,"context_lines":[{"line_number":50,"context_line":"own set of role groups that map to the global roles."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Although outside of the scope of this specification, it is anticipated that with"},{"line_number":53,"context_line":"the introduction of hierarchical multitenancy, role groups will be treated like"},{"line_number":54,"context_line":"other domain-specific inheritable objects."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_66815dfa","line":53,"updated":"2014-11-18 14:48:52.000000000","message":"s/will be/may be ?\nI think role groups may be inherited by the child domain, if needed, but not necessarily.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"18a046e14c69f8966d639245385581c29216c255","unresolved":false,"context_lines":[{"line_number":50,"context_line":"own set of role groups that map to the global roles."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Although outside of the scope of this specification, it is anticipated that with"},{"line_number":53,"context_line":"the introduction of hierarchical multitenancy, role groups will be treated like"},{"line_number":54,"context_line":"other domain-specific inheritable objects."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_3c62fdad","line":53,"in_reply_to":"5a890539_66815dfa","updated":"2014-11-18 19:19:24.000000000","message":"agreed","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"4b420d42032bee31e5a7cf619b86d6527c5bd42f","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Alternatives"},{"line_number":57,"context_line":"------------"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"None"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Data Model Impact"},{"line_number":62,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_1b5e1e13","line":59,"updated":"2014-11-18 23:44:38.000000000","message":"Introduce capabilities as a first class citizen (with it\u0027s own CRUD) and utilize Policy to tie capabilities to roles.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"ad789e191262fa0ed46926ccbd2103403541d5dd","unresolved":false,"context_lines":[{"line_number":57,"context_line":"------------"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"None"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Data Model Impact"},{"line_number":62,"context_line":"-----------------"},{"line_number":63,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_b3fc4574","line":60,"updated":"2014-11-27 12:08:19.000000000","message":"1. Implement Hierachical RBAC.\n\n2. Implement domain scoped roles.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"f8dffd88d3639457badb6ce891a558dc9826596a","unresolved":false,"context_lines":[{"line_number":70,"context_line":"---------------"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"A new CRUD API will be provided for the management of role groups. The"},{"line_number":73,"context_line":"grant APIs will also allow a rolegroup ID to specified in place of a role ID."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Security Impact"},{"line_number":76,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_c291109c","line":73,"updated":"2014-11-18 19:59:16.000000000","message":"Given that we are doing a fair bit of changing to the way roles work anyway do we want to use the existing roles concepts.\n\nie POST /roles with a \u0027roles\u0027: field means you create a role which contains these capabilities? seems like we might want this for the \u0027aliasing\u0027 concept anyway.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"ef52ad7e2cc872982977d30290f4d224db20f460","unresolved":false,"context_lines":[{"line_number":70,"context_line":"---------------"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"A new CRUD API will be provided for the management of role groups. The"},{"line_number":73,"context_line":"grant APIs will also allow a rolegroup ID to specified in place of a role ID."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Security Impact"},{"line_number":76,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_fb4f91bc","line":73,"in_reply_to":"5a890539_766d81cc","updated":"2014-11-19 00:40:39.000000000","message":"Samuel, correct","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"6b081e9d8ef887e895b26ff44aec2f6837e11d91","unresolved":false,"context_lines":[{"line_number":70,"context_line":"---------------"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"A new CRUD API will be provided for the management of role groups. The"},{"line_number":73,"context_line":"grant APIs will also allow a rolegroup ID to specified in place of a role ID."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Security Impact"},{"line_number":76,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_766d81cc","line":73,"in_reply_to":"5a890539_c291109c","updated":"2014-11-18 20:32:52.000000000","message":"In fact we\u0027re not changing the way roles work.\nThey will still work as they do today, and role-groups will work as roles.\n\nI think a new CRUD API would have its own /role-groups operations, instead of using the existing /role CRUD.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"6b081e9d8ef887e895b26ff44aec2f6837e11d91","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Other End User Impact"},{"line_number":86,"context_line":"---------------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"None"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Performance Impact"},{"line_number":91,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_760e61e7","line":88,"updated":"2014-11-18 20:32:52.000000000","message":"Should we describe that this change can \u0027inflate\u0027 the token?\n\nIn the worst case (most fine grained possible case) we would have one role per API call, right? If I create a group containing all the API calls for a given service, the token would be huge.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"ef52ad7e2cc872982977d30290f4d224db20f460","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Other End User Impact"},{"line_number":86,"context_line":"---------------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"None"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Performance Impact"},{"line_number":91,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_fbd6b1c2","line":88,"in_reply_to":"5a890539_760e61e7","updated":"2014-11-19 00:40:39.000000000","message":"the effective roles (global role definitions) don\u0027t change so there\u0027s no inflated token at the moment\n\nIf and when we decide to centralize role and capabilities management (and possibly authorization), then we\u0027ll probably need a better mechanism.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"a012dccb7c6d876cf649768f476470bd023f76a4","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Other End User Impact"},{"line_number":86,"context_line":"---------------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"None"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Performance Impact"},{"line_number":91,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_a48c0137","line":88,"in_reply_to":"5a890539_fbd6b1c2","updated":"2014-11-19 07:50:56.000000000","message":"In fact, this functionality itself *does not* inflate the token.\n\nActually, the scenario where it makes more sense does: having more fine granularity than today, e.g having one role per API call - create-vm, delete-vm, backup-vm etc. But it is independent of the use of this functionality.","commit_id":"123947a283e59b3f938336469c5b268d79721191"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"6b081e9d8ef887e895b26ff44aec2f6837e11d91","unresolved":false,"context_lines":[{"line_number":113,"context_line":"Work Items"},{"line_number":114,"context_line":"----------"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"TBA"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Dependencies"},{"line_number":119,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_d61b951a","line":116,"updated":"2014-11-18 20:32:52.000000000","message":"We still need to list work items","commit_id":"123947a283e59b3f938336469c5b268d79721191"}]}