)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"83bd0b37ae996d9fa8dbabf6603be5423f9fc499","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Modify the policy in etc/policy.json to a new one that provide the cloud"},{"line_number":10,"context_line":"administrator with more roles for better control."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: Ice6766f6cfaec2d0f94baee5cf93a463c9bea2d5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"5a890539_8451afda","line":12,"updated":"2014-11-19 17:55:27.000000000","message":"missing blueprint","commit_id":"265a9086afde868b548b6757607dc1373f71ac30"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2488ce75448fff8c1d77866531d11f768e311f27","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Andre \u003cafaranha@lsd.ufcg.edu.br\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-12-09 16:51:44 -0300"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Modify the policy file"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Modify the policy in etc/policy.json to a new one that provide the cloud"},{"line_number":10,"context_line":"administrator with more roles for better control."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":12,"id":"1a930d6b_0413feb8","line":7,"updated":"2015-01-22 01:01:34.000000000","message":"This should be a little more descriptive. Something like \u0027Expand roles in policy file\u0027 would be better when looking through the commit summaries.","commit_id":"2706e8247e01143d375f97c5e20473ad1304147b"}],"specs/kilo/modify-policy.rst":[{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/modify-policy\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The current policies rules doesn\u0027t reflect the needs of an enterprise using"},{"line_number":15,"context_line":"Openstack, we propose to change the rules of the policies so that it now has"},{"line_number":16,"context_line":"more users: cloud_admin, domain_admin, project_admin and project_member."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_dafc7875","line":15,"updated":"2014-11-27 20:19:48.000000000","message":"[...]s/Openstack, we propose/Openstack. This spec proposes/g","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"bc5140b93dd210c8ec69c4fe1c5ddf08e882336c","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/modify-policy\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The current policies rules doesn\u0027t reflect the needs of an enterprise using"},{"line_number":15,"context_line":"Openstack, we propose to change the rules of the policies so that it now has"},{"line_number":16,"context_line":"more users: cloud_admin, domain_admin, project_admin and project_member."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_bd8b261d","line":15,"updated":"2014-11-27 20:50:45.000000000","message":"s/Openstack/OpenStack","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The current policies rules doesn\u0027t reflect the needs of an enterprise using"},{"line_number":15,"context_line":"Openstack, we propose to change the rules of the policies so that it now has"},{"line_number":16,"context_line":"more users: cloud_admin, domain_admin, project_admin and project_member."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem Description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_da339860","line":16,"updated":"2014-11-27 20:19:48.000000000","message":"[...]checks against a more realistic set of user\u0027s roles[...]","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"The current policy rule definitions only divides the cloud in two kind of"},{"line_number":22,"context_line":"users: admin and member it has low granularity and also it\u0027s unclear to the"},{"line_number":23,"context_line":"cloud administrator the rule for a common user, it has _member_ and Member, by"},{"line_number":24,"context_line":"the syntax both can be assigned to a regular user, but they differ in some"},{"line_number":25,"context_line":"rules."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_5a47a8bc","line":22,"updated":"2014-11-27 20:19:48.000000000","message":"s/member it has low/member. It has low/g","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"The current policy rule definitions only divides the cloud in two kind of"},{"line_number":22,"context_line":"users: admin and member it has low granularity and also it\u0027s unclear to the"},{"line_number":23,"context_line":"cloud administrator the rule for a common user, it has _member_ and Member, by"},{"line_number":24,"context_line":"the syntax both can be assigned to a regular user, but they differ in some"},{"line_number":25,"context_line":"rules."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_ba7c0ced","line":23,"updated":"2014-11-27 20:19:48.000000000","message":"s/the rule/which is the role/g\ns/, it has _member_ and Member+/\\(_member_ or Member?\\)/","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":24,"context_line":"the syntax both can be assigned to a regular user, but they differ in some"},{"line_number":25,"context_line":"rules."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Also the policy is not ready to use for a bigger company that needs clear"},{"line_number":28,"context_line":"division of the users, the policy defines the user member and the user admin,"},{"line_number":29,"context_line":"where the admin has permission to perform any action in the cloud, it\u0027s"},{"line_number":30,"context_line":"undesirable sine a company needs a user with only some admin permissions to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_7ae0e496","line":27,"updated":"2014-11-27 20:19:48.000000000","message":"s/to use for/for use by/\nBigger than what? I\u0027d use a combination of [real|large][environment|corporation|company].","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":25,"context_line":"rules."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Also the policy is not ready to use for a bigger company that needs clear"},{"line_number":28,"context_line":"division of the users, the policy defines the user member and the user admin,"},{"line_number":29,"context_line":"where the admin has permission to perform any action in the cloud, it\u0027s"},{"line_number":30,"context_line":"undesirable sine a company needs a user with only some admin permissions to"},{"line_number":31,"context_line":"perform that actions in parts of the cloud."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_5a040818","line":28,"updated":"2014-11-27 20:19:48.000000000","message":"s/users, the policy defines the user member and the user admin/users. The policy also defines the roles member and admin/","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Also the policy is not ready to use for a bigger company that needs clear"},{"line_number":28,"context_line":"division of the users, the policy defines the user member and the user admin,"},{"line_number":29,"context_line":"where the admin has permission to perform any action in the cloud, it\u0027s"},{"line_number":30,"context_line":"undesirable sine a company needs a user with only some admin permissions to"},{"line_number":31,"context_line":"perform that actions in parts of the cloud."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_5afa4844","line":29,"updated":"2014-11-27 20:19:48.000000000","message":"[...]cloud. It is undesirable[...]","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Also the policy is not ready to use for a bigger company that needs clear"},{"line_number":28,"context_line":"division of the users, the policy defines the user member and the user admin,"},{"line_number":29,"context_line":"where the admin has permission to perform any action in the cloud, it\u0027s"},{"line_number":30,"context_line":"undesirable sine a company needs a user with only some admin permissions to"},{"line_number":31,"context_line":"perform that actions in parts of the cloud."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Our proposal is to change the rules, so that it will ha smore kind of users:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_ba988c1c","line":30,"updated":"2014-11-27 20:19:48.000000000","message":"typo: I believe it should be \u0027since\u0027?","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":30,"context_line":"undesirable sine a company needs a user with only some admin permissions to"},{"line_number":31,"context_line":"perform that actions in parts of the cloud."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Our proposal is to change the rules, so that it will ha smore kind of users:"},{"line_number":34,"context_line":"cloud_admin, domain_admin, project_admin and project_member, that are detailed"},{"line_number":35,"context_line":"in the next topic."},{"line_number":36,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_dab47884","line":33,"updated":"2014-11-27 20:19:48.000000000","message":"change the policy to consider a new set of roles","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":37,"context_line":"Proposed Change"},{"line_number":38,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"We are going to change the rules definition to accept the new role proposed and"},{"line_number":41,"context_line":"mantain compatibility with the old roles, so that a cloud can migrate the"},{"line_number":42,"context_line":"policy and the users still with the same permissions than before."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_3aabbc1f","line":40,"updated":"2014-11-27 20:19:48.000000000","message":"roles proposed, while maintaining","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"We are going to change the rules definition to accept the new role proposed and"},{"line_number":41,"context_line":"mantain compatibility with the old roles, so that a cloud can migrate the"},{"line_number":42,"context_line":"policy and the users still with the same permissions than before."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The new role proposed are:"},{"line_number":45,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_fa477475","line":42,"updated":"2014-11-27 20:19:48.000000000","message":"so users will hold the same rights on their old roles while the migration to new roles occurs.","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":41,"context_line":"mantain compatibility with the old roles, so that a cloud can migrate the"},{"line_number":42,"context_line":"policy and the users still with the same permissions than before."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The new role proposed are:"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* cloud_admin is the role to users that need to manage the cloud, they can"},{"line_number":47,"context_line":"  perform actions such as CRUD of domains, roles, hypervisors;"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_3a59fc5b","line":44,"updated":"2014-11-27 20:19:48.000000000","message":"roles","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The new role proposed are:"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"* cloud_admin is the role to users that need to manage the cloud, they can"},{"line_number":47,"context_line":"  perform actions such as CRUD of domains, roles, hypervisors;"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"* domain_admin is the role for admin users in domain context, they can only"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_ba340cfc","line":46,"updated":"2014-11-27 20:19:48.000000000","message":"role for users[...] cloud. It has permission to [...]","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":46,"context_line":"* cloud_admin is the role to users that need to manage the cloud, they can"},{"line_number":47,"context_line":"  perform actions such as CRUD of domains, roles, hypervisors;"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"* domain_admin is the role for admin users in domain context, they can only"},{"line_number":50,"context_line":"  perform actions regarding domain, like, update the domain information s/he"},{"line_number":51,"context_line":"  are associated to, CRUD of projects, users."},{"line_number":52,"context_line":"  Note that domain_admin is a rule that only makes sense to Keystone, since"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_9a167057","line":49,"updated":"2014-11-27 20:19:48.000000000","message":"context. They can[...]","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":47,"context_line":"  perform actions such as CRUD of domains, roles, hypervisors;"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"* domain_admin is the role for admin users in domain context, they can only"},{"line_number":50,"context_line":"  perform actions regarding domain, like, update the domain information s/he"},{"line_number":51,"context_line":"  are associated to, CRUD of projects, users."},{"line_number":52,"context_line":"  Note that domain_admin is a rule that only makes sense to Keystone, since"},{"line_number":53,"context_line":"  other services doesn\u0027t recognize the concept of domain;"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_3a073c1f","line":50,"updated":"2014-11-27 20:19:48.000000000","message":"regarding the domain s/he is associated to, like update domain\u0027s information, CRUD of projects and users.","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"* project_admin is the role for users that need to manage projects, they can\u0027t"},{"line_number":56,"context_line":"  do operations like create users or create projects but are able to update the"},{"line_number":57,"context_line":"  project information s/he are associate to, associate and dissociate users"},{"line_number":58,"context_line":"  with roles in the project;"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"* project_member is the role for common members with no admin permissions at"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_dd071217","line":57,"updated":"2014-11-27 20:19:48.000000000","message":"s/he is","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"The cloud administrator can associate the role admin for every user that needs"},{"line_number":67,"context_line":"to perform any admin operation. For a user who needs to create projects, the"},{"line_number":68,"context_line":"role admin could be associate, but this is undesirable since the user with role"},{"line_number":69,"context_line":"admin can perform any operation s/he wants, including deleting domains,"},{"line_number":70,"context_line":"hypervisors and delete users;"},{"line_number":71,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_1d38bad3","line":68,"updated":"2014-11-27 20:19:48.000000000","message":"associated","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":66,"context_line":"The cloud administrator can associate the role admin for every user that needs"},{"line_number":67,"context_line":"to perform any admin operation. For a user who needs to create projects, the"},{"line_number":68,"context_line":"role admin could be associate, but this is undesirable since the user with role"},{"line_number":69,"context_line":"admin can perform any operation s/he wants, including deleting domains,"},{"line_number":70,"context_line":"hypervisors and delete users;"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_fd5a0e29","line":69,"updated":"2014-11-27 20:19:48.000000000","message":"operations allowed","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"We may have some hard coded checks that expects that the user has the role"},{"line_number":76,"context_line":"admin instead of the role defined in the policy rule."},{"line_number":77,"context_line":"Also, as we are giving the Project_Admin permission to assign users to his/her"},{"line_number":78,"context_line":"project with determined role, a Project_Admin could grants a user the role"},{"line_number":79,"context_line":"Cloud_Admin, to avoid this we are defining the rule in Keystone that the"},{"line_number":80,"context_line":"cloud_admin needs to be associated with the domain cloud_admin_domain (We are"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_1d3fdab6","line":77,"updated":"2014-11-27 20:19:48.000000000","message":"project_admin. Maintain typing coherence with other mentions of the role on the text.","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":75,"context_line":"We may have some hard coded checks that expects that the user has the role"},{"line_number":76,"context_line":"admin instead of the role defined in the policy rule."},{"line_number":77,"context_line":"Also, as we are giving the Project_Admin permission to assign users to his/her"},{"line_number":78,"context_line":"project with determined role, a Project_Admin could grants a user the role"},{"line_number":79,"context_line":"Cloud_Admin, to avoid this we are defining the rule in Keystone that the"},{"line_number":80,"context_line":"cloud_admin needs to be associated with the domain cloud_admin_domain (We are"},{"line_number":81,"context_line":"following the same approach as keystone.v3cloudsample.json). The problem of"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_bd77a69e","line":78,"updated":"2014-11-27 20:19:48.000000000","message":"a project_admin could grant[...]","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":76,"context_line":"admin instead of the role defined in the policy rule."},{"line_number":77,"context_line":"Also, as we are giving the Project_Admin permission to assign users to his/her"},{"line_number":78,"context_line":"project with determined role, a Project_Admin could grants a user the role"},{"line_number":79,"context_line":"Cloud_Admin, to avoid this we are defining the rule in Keystone that the"},{"line_number":80,"context_line":"cloud_admin needs to be associated with the domain cloud_admin_domain (We are"},{"line_number":81,"context_line":"following the same approach as keystone.v3cloudsample.json). The problem of"},{"line_number":82,"context_line":"this solution is that others services regarding Keystone don\u0027t have the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_dd6c72d3","line":79,"updated":"2014-11-27 20:19:48.000000000","message":"cloud_admin. To avoid that, we are[...] rule to check if the cloud_admin is associated with the domain[...]","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":79,"context_line":"Cloud_Admin, to avoid this we are defining the rule in Keystone that the"},{"line_number":80,"context_line":"cloud_admin needs to be associated with the domain cloud_admin_domain (We are"},{"line_number":81,"context_line":"following the same approach as keystone.v3cloudsample.json). The problem of"},{"line_number":82,"context_line":"this solution is that others services regarding Keystone don\u0027t have the"},{"line_number":83,"context_line":"information of domain in their context. We are investigating an approach to"},{"line_number":84,"context_line":"avoid that."},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_3d63b6de","line":82,"updated":"2014-11-27 20:19:48.000000000","message":"s/other services regarding Keystone/some services/","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":81,"context_line":"following the same approach as keystone.v3cloudsample.json). The problem of"},{"line_number":82,"context_line":"this solution is that others services regarding Keystone don\u0027t have the"},{"line_number":83,"context_line":"information of domain in their context. We are investigating an approach to"},{"line_number":84,"context_line":"avoid that."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Notifications Impact"},{"line_number":87,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_5d6082cf","line":84,"updated":"2014-11-27 20:19:48.000000000","message":"workaround that.","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"The users that are in the cloud with the old roles (admin and _member_/Member)"},{"line_number":95,"context_line":"will not have any impact, but for the users that are assigned with the new"},{"line_number":96,"context_line":"roles they will not have the same permissions as before."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Performance Impact"},{"line_number":99,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_1dad1aeb","line":96,"updated":"2014-11-27 20:19:48.000000000","message":"roles, they may not have the same permissions[...]","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":140,"context_line":"* Glance;"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"* Keystone;"},{"line_number":143,"context_line":"  Because Keystone has the policy.v3samplecloud.json we are going to first"},{"line_number":144,"context_line":"  update this policy with the new configuration, and second make this policy"},{"line_number":145,"context_line":"  as the default, modifying it to have compatibility with the old policy, i.e.,"},{"line_number":146,"context_line":"  recognizing the role admin and all it\u0027s capabilities."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_9d802a4b","line":143,"updated":"2014-11-27 20:19:48.000000000","message":"Since Keystone already[...], we are going to[...]","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":141,"context_line":""},{"line_number":142,"context_line":"* Keystone;"},{"line_number":143,"context_line":"  Because Keystone has the policy.v3samplecloud.json we are going to first"},{"line_number":144,"context_line":"  update this policy with the new configuration, and second make this policy"},{"line_number":145,"context_line":"  as the default, modifying it to have compatibility with the old policy, i.e.,"},{"line_number":146,"context_line":"  recognizing the role admin and all it\u0027s capabilities."},{"line_number":147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_bd85e65a","line":144,"updated":"2014-11-27 20:19:48.000000000","message":"configuration and then, make this policy the default one[...]","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"bc5140b93dd210c8ec69c4fe1c5ddf08e882336c","unresolved":false,"context_lines":[{"line_number":155,"context_line":""},{"line_number":156,"context_line":"2. Fix the tests to pass in the new policies rules;"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"3. Modify the user admin created by Openstack instalation to have the role"},{"line_number":159,"context_line":"cloud_admin instead of role admin;"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_dd80f2f9","line":158,"updated":"2014-11-27 20:50:45.000000000","message":"s/Openstck/OpenStack","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":167,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"A documentation will be provided to explain how does the policy works, what is"},{"line_number":170,"context_line":"the cloud_admin, the domain_admin, the project_admin and the project_member,"},{"line_number":171,"context_line":"what capabilities each one has, and how they are related."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_3d91f69a","line":170,"updated":"2014-11-27 20:19:48.000000000","message":"project_member;","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"fce798629da59b98079ea91447121bd3c3297431","unresolved":false,"context_lines":[{"line_number":168,"context_line":""},{"line_number":169,"context_line":"A documentation will be provided to explain how does the policy works, what is"},{"line_number":170,"context_line":"the cloud_admin, the domain_admin, the project_admin and the project_member,"},{"line_number":171,"context_line":"what capabilities each one has, and how they are related."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"References"},{"line_number":174,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_5d8ec27a","line":171,"updated":"2014-11-27 20:19:48.000000000","message":"which[...] has and how they are related.","commit_id":"78013c4c0d7daabb93a8ffbdff73128ca71b83ad"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"f49bc1b42699932809a8434df1e5665d789ae00b","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"The current policy rule definitions segregates the cloud in two types of users:"},{"line_number":23,"context_line":"admin and member. It has low granularity and also the role for an ordinary user"},{"line_number":24,"context_line":"is unclear to the administrator: _member_ or Member. Hence, the policy isn\u0027t"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_3c13a60e","line":21,"updated":"2014-11-28 16:48:07.000000000","message":"I would think in this section we should mention that policy.v3cloudsample exists, which is closer to what is required, but a) is not the default, and b) still needs further separation of duties","commit_id":"e9f84fe4c26c33f3dda7d2af5fc71f5495bff5e1"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"7e934e583de541e0e4016d9d5df6f1f3d0c79763","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"The current policy rule definitions segregates the cloud in two types of users:"},{"line_number":23,"context_line":"admin and member. It has low granularity and also the role for an ordinary user"},{"line_number":24,"context_line":"is unclear to the administrator: _member_ or Member. Hence, the policy isn\u0027t"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_61edcc24","line":21,"in_reply_to":"5a890539_3c13a60e","updated":"2014-12-04 20:40:28.000000000","message":"Done and submitted in the patch 10","commit_id":"e9f84fe4c26c33f3dda7d2af5fc71f5495bff5e1"},{"author":{"_account_id":6549,"name":"Zhi Yan Liu","email":"lzy.dev@gmail.com","username":"lzy-dev"},"change_message_id":"429a63d6b0846d182c89ec93b5cd4fcb939327d8","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"The current policy rule definitions segregates the cloud in two types of users:"},{"line_number":23,"context_line":"admin and member. It has low granularity and also the role for an ordinary user"},{"line_number":24,"context_line":"is unclear to the administrator: _member_ or Member. Hence, the policy isn\u0027t"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_bee393d6","line":21,"in_reply_to":"5a890539_3c13a60e","updated":"2014-12-03 15:38:37.000000000","message":"For the idea, I see it\u0027s a little complicated TBH, and before this proposal I didn\u0027t get any negative complaints on now Glance policy content. So I have to say I don\u0027t have fully confidence to sure if this is a requirement from the operation perspective.\n\nSo, for the proposed policy content, first +1 on Henry\u0027s point, and I think operator/deployer probably need to configure policy rules be usecase-driven, so IMO, we can keep policy.v3cloudsample stuff as a template (probably it can be in-tree if project team ok) instead of changing default one, and let\u0027s real cloud deployer/operator to make decision if their enviroment/usecase needs to follow your principle/practice.","commit_id":"e9f84fe4c26c33f3dda7d2af5fc71f5495bff5e1"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"ad19e8f3ccecaad3f7192ae1aa1e844d3d7e1767","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"The current policy rule definitions segregates the cloud in two types of users:"},{"line_number":23,"context_line":"admin and member. It has low granularity and also the role for an ordinary user"},{"line_number":24,"context_line":"is unclear to the administrator: _member_ or Member. Hence, the policy isn\u0027t"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_f6e34431","line":21,"in_reply_to":"5a890539_bee393d6","updated":"2014-12-04 20:08:51.000000000","message":"The policy provided by Openstack is just a temple for organizations to use it as they wish, modifying it or not is their choice, we are not denying it. What we would like to proposed is a template that reflects better the organizations structure, so, if they are going to change the policy, we would like that this change would be as minimum as possible.\nAlso, proposing a template is not a good solution, because the policy changes, new rules are being added, and to have both policies synchronized is difficult.","commit_id":"e9f84fe4c26c33f3dda7d2af5fc71f5495bff5e1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"f49bc1b42699932809a8434df1e5665d789ae00b","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"* project_member is the role for ordinaries users with no admin permissions at"},{"line_number":61,"context_line":"  all;"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatives"},{"line_number":64,"context_line":"------------"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_9c181a20","line":62,"updated":"2014-11-28 16:48:07.000000000","message":"I would think we would outline that we would take policy.v3cloudsample as the basis, improved it - and then make this the default.","commit_id":"e9f84fe4c26c33f3dda7d2af5fc71f5495bff5e1"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"7e934e583de541e0e4016d9d5df6f1f3d0c79763","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"* project_member is the role for ordinaries users with no admin permissions at"},{"line_number":61,"context_line":"  all;"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatives"},{"line_number":64,"context_line":"------------"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_a1f33407","line":62,"in_reply_to":"5a890539_9c181a20","updated":"2014-12-04 20:40:28.000000000","message":"Done and submitted in the patch 10","commit_id":"e9f84fe4c26c33f3dda7d2af5fc71f5495bff5e1"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"ec1de8f9579093c11de5ab320eca08f924841eef","unresolved":false,"context_lines":[{"line_number":67,"context_line":"to perform any admin operation. For a user who needs to create projects, the"},{"line_number":68,"context_line":"role admin could be associate, but this is undesirable since the user with role"},{"line_number":69,"context_line":"admin can perform any operation, including managing hypervisors and delete"},{"line_number":70,"context_line":"users;"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Security Impact"},{"line_number":73,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_1ec10780","line":70,"updated":"2014-12-03 15:40:34.000000000","message":"The cloud deployer can also create their own roles reflecting their organization and use those in their policy configuration without need to have the role structure \"forced\" on them from OS side.","commit_id":"e9f84fe4c26c33f3dda7d2af5fc71f5495bff5e1"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"ad19e8f3ccecaad3f7192ae1aa1e844d3d7e1767","unresolved":false,"context_lines":[{"line_number":67,"context_line":"to perform any admin operation. For a user who needs to create projects, the"},{"line_number":68,"context_line":"role admin could be associate, but this is undesirable since the user with role"},{"line_number":69,"context_line":"admin can perform any operation, including managing hypervisors and delete"},{"line_number":70,"context_line":"users;"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Security Impact"},{"line_number":73,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5a890539_36d14c57","line":70,"in_reply_to":"5a890539_1ec10780","updated":"2014-12-04 20:08:51.000000000","message":"Explained in the comment above","commit_id":"e9f84fe4c26c33f3dda7d2af5fc71f5495bff5e1"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"7cd52d4bcf73d0a933f32a49fc610a346469fd4d","unresolved":false,"context_lines":[{"line_number":24,"context_line":"with rules for cloud admin and domain admin."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"The sample cloud policy divides the administrator permission into 2 levels of"},{"line_number":27,"context_line":"admins, the cloud admin, that have all the administrator capabilities. And the"},{"line_number":28,"context_line":"domain admin, that have a restrict set of administrator permissions. We are"},{"line_number":29,"context_line":"providing now the policy with the concept of project admin, that will have"},{"line_number":30,"context_line":"admin capabilities on a project. Also, it doesn\u0027t have clear definition of"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_db4f51bc","line":27,"updated":"2014-12-04 20:00:04.000000000","message":"s/. And/ and","commit_id":"2b55a154debe0f8991638393354dd0dfaa33215f"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"7cd52d4bcf73d0a933f32a49fc610a346469fd4d","unresolved":false,"context_lines":[{"line_number":37,"context_line":"organization needs users with a subset of the administrator\u0027s permissions to"},{"line_number":38,"context_line":"perform actions in parts of the cloud."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"This spec proposes to change the default policy to consider a new set of roles:"},{"line_number":41,"context_line":"cloud_admin, domain_admin, project_admin and project_member. They are detailed"},{"line_number":42,"context_line":"in the next section."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_dbd671c2","line":40,"updated":"2014-12-04 20:00:04.000000000","message":"I think that this is part of the Proposed Change, not Problem Description.","commit_id":"2b55a154debe0f8991638393354dd0dfaa33215f"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"7cd52d4bcf73d0a933f32a49fc610a346469fd4d","unresolved":false,"context_lines":[{"line_number":100,"context_line":"---------------------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"The users that are in the cloud with the old roles (admin or _member_/Member)"},{"line_number":103,"context_line":"won\u0027t have any impact, but the users that are assigned with the new roles may"},{"line_number":104,"context_line":"not be able to perform the same actions as the users with the old roles."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_7b41fd61","line":103,"updated":"2014-12-04 20:00:04.000000000","message":"I see some impact to the old roles, I\u0027m not saying that is a bad impact, but when you modify the role capabilities in the policy, the old roles ( now mapping for new roles, like cloud_admin and project_member) will be impacted for this new policy. Right?","commit_id":"2b55a154debe0f8991638393354dd0dfaa33215f"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"7cd52d4bcf73d0a933f32a49fc610a346469fd4d","unresolved":false,"context_lines":[{"line_number":157,"context_line":""},{"line_number":158,"context_line":"* Nova;"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"The new rules to be added for all the services are: cloud_admin, project_admin"},{"line_number":161,"context_line":"and project_member, they will have the same behavior. And for Keystone there is"},{"line_number":162,"context_line":"the rule domain_admin, that use the concept of domain."},{"line_number":163,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"5a890539_1b2719c8","line":160,"updated":"2014-12-04 20:00:04.000000000","message":"s/ . And/ and","commit_id":"2b55a154debe0f8991638393354dd0dfaa33215f"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Currently in Keystone there is two policies, the default policy (policy.json)"},{"line_number":23,"context_line":"and the sample cloud policy (policy.v3samplecloud.json) that\u0027s a sample policy"},{"line_number":24,"context_line":"with rules for cloud admin and domain admin."},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_9e0af0d0","line":22,"updated":"2014-12-08 13:41:05.000000000","message":"there are two policies:","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Currently in Keystone there is two policies, the default policy (policy.json)"},{"line_number":23,"context_line":"and the sample cloud policy (policy.v3samplecloud.json) that\u0027s a sample policy"},{"line_number":24,"context_line":"with rules for cloud admin and domain admin."},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_0d94f1e0","line":22,"in_reply_to":"3a961159_9e0af0d0","updated":"2014-12-09 13:42:52.000000000","message":"Done","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"The sample cloud policy divides the administrator permission into 2 levels of"},{"line_number":27,"context_line":"admins, the cloud admin, that have all the administrator capabilities, and the"},{"line_number":28,"context_line":"domain admin, that have a restrict set of administrator permissions. We are"},{"line_number":29,"context_line":"providing now the policy with the concept of project admin, that will have"},{"line_number":30,"context_line":"admin capabilities on a project. Also, it doesn\u0027t have clear definition of"},{"line_number":31,"context_line":"roles, it only uses the role admin and make difference between cloud_admin and"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_3e03bcb9","line":28,"updated":"2014-12-08 13:41:05.000000000","message":"restrict-\u003erestricted","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"The sample cloud policy divides the administrator permission into 2 levels of"},{"line_number":27,"context_line":"admins, the cloud admin, that have all the administrator capabilities, and the"},{"line_number":28,"context_line":"domain admin, that have a restrict set of administrator permissions. We are"},{"line_number":29,"context_line":"providing now the policy with the concept of project admin, that will have"},{"line_number":30,"context_line":"admin capabilities on a project. Also, it doesn\u0027t have clear definition of"},{"line_number":31,"context_line":"roles, it only uses the role admin and make difference between cloud_admin and"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_f807611b","line":28,"in_reply_to":"3a961159_3e03bcb9","updated":"2014-12-09 13:42:52.000000000","message":"Done","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":28,"context_line":"domain admin, that have a restrict set of administrator permissions. We are"},{"line_number":29,"context_line":"providing now the policy with the concept of project admin, that will have"},{"line_number":30,"context_line":"admin capabilities on a project. Also, it doesn\u0027t have clear definition of"},{"line_number":31,"context_line":"roles, it only uses the role admin and make difference between cloud_admin and"},{"line_number":32,"context_line":"domain_admin using the scope of the assignment. Beside this, this policy isn\u0027t"},{"line_number":33,"context_line":"the default one."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_be26cc66","line":31,"updated":"2014-12-08 13:41:05.000000000","message":"the admin role; make-\u003emakes","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":28,"context_line":"domain admin, that have a restrict set of administrator permissions. We are"},{"line_number":29,"context_line":"providing now the policy with the concept of project admin, that will have"},{"line_number":30,"context_line":"admin capabilities on a project. Also, it doesn\u0027t have clear definition of"},{"line_number":31,"context_line":"roles, it only uses the role admin and make difference between cloud_admin and"},{"line_number":32,"context_line":"domain_admin using the scope of the assignment. Beside this, this policy isn\u0027t"},{"line_number":33,"context_line":"the default one."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_1807cd1d","line":31,"in_reply_to":"3a961159_be26cc66","updated":"2014-12-09 13:42:52.000000000","message":"Done","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":33,"context_line":"the default one."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The default policy defines the member and the admin users, where the admin has"},{"line_number":36,"context_line":"permission to perform any action in the cloud. It\u0027s undesirable since a"},{"line_number":37,"context_line":"organization needs users with a subset of the administrator\u0027s permissions to"},{"line_number":38,"context_line":"perform actions in parts of the cloud."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_3ef1fccd","line":36,"updated":"2014-12-08 13:41:05.000000000","message":"a-\u003e an","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":33,"context_line":"the default one."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The default policy defines the member and the admin users, where the admin has"},{"line_number":36,"context_line":"permission to perform any action in the cloud. It\u0027s undesirable since a"},{"line_number":37,"context_line":"organization needs users with a subset of the administrator\u0027s permissions to"},{"line_number":38,"context_line":"perform actions in parts of the cloud."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_930abe1f","line":36,"in_reply_to":"3a961159_3ef1fccd","updated":"2014-12-09 13:42:52.000000000","message":"Done","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The cloud administrator can associate the role admin for every user that needs"},{"line_number":76,"context_line":"to perform any admin operation. For a user who needs to create projects, the"},{"line_number":77,"context_line":"role admin could be associate, but this is undesirable since the user with role"},{"line_number":78,"context_line":"admin can perform any operation, including managing hypervisors and delete"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_fe94d445","line":75,"updated":"2014-12-08 13:41:05.000000000","message":"the admin role","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The cloud administrator can associate the role admin for every user that needs"},{"line_number":76,"context_line":"to perform any admin operation. For a user who needs to create projects, the"},{"line_number":77,"context_line":"role admin could be associate, but this is undesirable since the user with role"},{"line_number":78,"context_line":"admin can perform any operation, including managing hypervisors and delete"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_939abe61","line":75,"in_reply_to":"3a961159_fe94d445","updated":"2014-12-09 13:42:52.000000000","message":"Done","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The cloud administrator can associate the role admin for every user that needs"},{"line_number":76,"context_line":"to perform any admin operation. For a user who needs to create projects, the"},{"line_number":77,"context_line":"role admin could be associate, but this is undesirable since the user with role"},{"line_number":78,"context_line":"admin can perform any operation, including managing hypervisors and delete"},{"line_number":79,"context_line":"users;"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_1e928057","line":77,"updated":"2014-12-08 13:41:05.000000000","message":"associated?","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"The cloud administrator can associate the role admin for every user that needs"},{"line_number":76,"context_line":"to perform any admin operation. For a user who needs to create projects, the"},{"line_number":77,"context_line":"role admin could be associate, but this is undesirable since the user with role"},{"line_number":78,"context_line":"admin can perform any operation, including managing hypervisors and delete"},{"line_number":79,"context_line":"users;"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_d3a3669c","line":77,"in_reply_to":"3a961159_1e928057","updated":"2014-12-09 13:42:52.000000000","message":"Done","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":76,"context_line":"to perform any admin operation. For a user who needs to create projects, the"},{"line_number":77,"context_line":"role admin could be associate, but this is undesirable since the user with role"},{"line_number":78,"context_line":"admin can perform any operation, including managing hypervisors and delete"},{"line_number":79,"context_line":"users;"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Security Impact"},{"line_number":82,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_3e9f3c61","line":79,"updated":"2014-12-08 13:41:05.000000000","message":"; -\u003e .","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":76,"context_line":"to perform any admin operation. For a user who needs to create projects, the"},{"line_number":77,"context_line":"role admin could be associate, but this is undesirable since the user with role"},{"line_number":78,"context_line":"admin can perform any operation, including managing hypervisors and delete"},{"line_number":79,"context_line":"users;"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Security Impact"},{"line_number":82,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_13aece85","line":79,"in_reply_to":"3a961159_3e9f3c61","updated":"2014-12-09 13:42:52.000000000","message":"Done","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":81,"context_line":"Security Impact"},{"line_number":82,"context_line":"---------------"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"The services may have some hard coded checks that expects that the user has the"},{"line_number":85,"context_line":"role admin instead of the role defined in the policy rule. Also, as we are"},{"line_number":86,"context_line":"providing to project_admin the permission to assign users to his project, a"},{"line_number":87,"context_line":"project_admin could grant a user the role cloud_admin. To avoid this, the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_7eb624de","line":84,"updated":"2014-12-08 13:41:05.000000000","message":"expects -\u003e that verifies","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":81,"context_line":"Security Impact"},{"line_number":82,"context_line":"---------------"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"The services may have some hard coded checks that expects that the user has the"},{"line_number":85,"context_line":"role admin instead of the role defined in the policy rule. Also, as we are"},{"line_number":86,"context_line":"providing to project_admin the permission to assign users to his project, a"},{"line_number":87,"context_line":"project_admin could grant a user the role cloud_admin. To avoid this, the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_53b776d8","line":84,"in_reply_to":"3a961159_7eb624de","updated":"2014-12-09 13:42:52.000000000","message":"Done","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":83,"context_line":""},{"line_number":84,"context_line":"The services may have some hard coded checks that expects that the user has the"},{"line_number":85,"context_line":"role admin instead of the role defined in the policy rule. Also, as we are"},{"line_number":86,"context_line":"providing to project_admin the permission to assign users to his project, a"},{"line_number":87,"context_line":"project_admin could grant a user the role cloud_admin. To avoid this, the"},{"line_number":88,"context_line":"implementation of this spec needs to enforce that only the cloud_admin are able"},{"line_number":89,"context_line":"to grant cloud_admin role, and that only the domain_admin are able to grant"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_7edd4414","line":86,"updated":"2014-12-08 13:41:05.000000000","message":"his -\u003e to a specific project","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":83,"context_line":""},{"line_number":84,"context_line":"The services may have some hard coded checks that expects that the user has the"},{"line_number":85,"context_line":"role admin instead of the role defined in the policy rule. Also, as we are"},{"line_number":86,"context_line":"providing to project_admin the permission to assign users to his project, a"},{"line_number":87,"context_line":"project_admin could grant a user the role cloud_admin. To avoid this, the"},{"line_number":88,"context_line":"implementation of this spec needs to enforce that only the cloud_admin are able"},{"line_number":89,"context_line":"to grant cloud_admin role, and that only the domain_admin are able to grant"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_b3eb3aaf","line":86,"in_reply_to":"3a961159_7edd4414","updated":"2014-12-09 13:42:52.000000000","message":"I think this one should be \u0027his\u0027, to specify that the project is the one the user is the project_admin.","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":84,"context_line":"The services may have some hard coded checks that expects that the user has the"},{"line_number":85,"context_line":"role admin instead of the role defined in the policy rule. Also, as we are"},{"line_number":86,"context_line":"providing to project_admin the permission to assign users to his project, a"},{"line_number":87,"context_line":"project_admin could grant a user the role cloud_admin. To avoid this, the"},{"line_number":88,"context_line":"implementation of this spec needs to enforce that only the cloud_admin are able"},{"line_number":89,"context_line":"to grant cloud_admin role, and that only the domain_admin are able to grant"},{"line_number":90,"context_line":"domain_admin role."}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_bee7ace3","line":87,"updated":"2014-12-08 13:41:05.000000000","message":"cloud_admin role","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":85,"context_line":"role admin instead of the role defined in the policy rule. Also, as we are"},{"line_number":86,"context_line":"providing to project_admin the permission to assign users to his project, a"},{"line_number":87,"context_line":"project_admin could grant a user the role cloud_admin. To avoid this, the"},{"line_number":88,"context_line":"implementation of this spec needs to enforce that only the cloud_admin are able"},{"line_number":89,"context_line":"to grant cloud_admin role, and that only the domain_admin are able to grant"},{"line_number":90,"context_line":"domain_admin role."},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_fed054f9","line":88,"updated":"2014-12-08 13:41:05.000000000","message":"cloud_admin users are able...","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":85,"context_line":"role admin instead of the role defined in the policy rule. Also, as we are"},{"line_number":86,"context_line":"providing to project_admin the permission to assign users to his project, a"},{"line_number":87,"context_line":"project_admin could grant a user the role cloud_admin. To avoid this, the"},{"line_number":88,"context_line":"implementation of this spec needs to enforce that only the cloud_admin are able"},{"line_number":89,"context_line":"to grant cloud_admin role, and that only the domain_admin are able to grant"},{"line_number":90,"context_line":"domain_admin role."},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_13f32e9f","line":88,"in_reply_to":"3a961159_fed054f9","updated":"2014-12-09 13:42:52.000000000","message":"Done","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The users that are in the cloud with the old roles (admin or _member_/Member)"},{"line_number":101,"context_line":"will be impacted since they will now behave like the new role. Role admin that"},{"line_number":102,"context_line":"now have all permissions, will behave as cloud admin, it won\u0027t be able to"},{"line_number":103,"context_line":"perform all permissions, only the one the cloud admin can. For _member_ or"},{"line_number":104,"context_line":"Member, they will also be impacted to behave as a project member."},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_3edbbc1c","line":102,"updated":"2014-12-08 13:41:05.000000000","message":"it -\u003e this user/user with this role","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"49f2dde44ed879c1cc79ae3428209552202002ca","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The users that are in the cloud with the old roles (admin or _member_/Member)"},{"line_number":101,"context_line":"will be impacted since they will now behave like the new role. Role admin that"},{"line_number":102,"context_line":"now have all permissions, will behave as cloud admin, it won\u0027t be able to"},{"line_number":103,"context_line":"perform all permissions, only the one the cloud admin can. For _member_ or"},{"line_number":104,"context_line":"Member, they will also be impacted to behave as a project member."},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_93847ed5","line":102,"in_reply_to":"3a961159_3edbbc1c","updated":"2014-12-09 13:42:52.000000000","message":"Done","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":13082,"name":"Irina","email":"ipovolotskaya@mirantis.com","username":"ipovolotskaya"},"change_message_id":"6967acd94d325f707a299196d29e34e6b139f5f9","unresolved":false,"context_lines":[{"line_number":174,"context_line":"Documentation Impact"},{"line_number":175,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"A documentation will be provided to explain how does the policy works, what is"},{"line_number":178,"context_line":"the cloud_admin, the domain_admin, the project_admin and the project_member."},{"line_number":179,"context_line":"What capabilities each one has and how they are related."},{"line_number":180,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_befecc69","line":177,"updated":"2014-12-08 13:41:05.000000000","message":"The documentation; how the policy works","commit_id":"4209fa4b37d98cab8d56f16680370ad01764789a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"270bff1f03cfcea59741e3c2d22d6b31cf741e96","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/modify-policy\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The current policy rules don\u0027t reflect the needs of an organization using"},{"line_number":15,"context_line":"Openstack. This spec proposes to change the rules of the policies so that it"},{"line_number":16,"context_line":"now has checks against a more realistic set of users: cloud admin, domain"},{"line_number":17,"context_line":"admin, project admin and a member of a project."},{"line_number":18,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_b6f31e9e","line":15,"updated":"2014-12-09 18:11:37.000000000","message":"OpenStack*","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"c6c2fdbacd82e5d443bffc8d480ff437de4e0ce4","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/modify-policy\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The current policy rules don\u0027t reflect the needs of an organization using"},{"line_number":15,"context_line":"Openstack. This spec proposes to change the rules of the policies so that it"},{"line_number":16,"context_line":"now has checks against a more realistic set of users: cloud admin, domain"},{"line_number":17,"context_line":"admin, project admin and a member of a project."},{"line_number":18,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_7fcee9b5","line":15,"in_reply_to":"3a961159_b6f31e9e","updated":"2014-12-09 19:49:54.000000000","message":"Done","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"270bff1f03cfcea59741e3c2d22d6b31cf741e96","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Currently in Keystone there are two policies, the default policy (policy.json)"},{"line_number":23,"context_line":"and the sample cloud policy (policy.v3samplecloud.json) that\u0027s a sample policy"},{"line_number":24,"context_line":"with rules for cloud admin and domain admin."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"The sample cloud policy divides the administrator permission into 2 levels of"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_162cf201","line":23,"updated":"2014-12-09 18:11:37.000000000","message":"link to these two files would be helpful","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"c6c2fdbacd82e5d443bffc8d480ff437de4e0ce4","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Currently in Keystone there are two policies, the default policy (policy.json)"},{"line_number":23,"context_line":"and the sample cloud policy (policy.v3samplecloud.json) that\u0027s a sample policy"},{"line_number":24,"context_line":"with rules for cloud admin and domain admin."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"The sample cloud policy divides the administrator permission into 2 levels of"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_5f592dfd","line":23,"in_reply_to":"3a961159_162cf201","updated":"2014-12-09 19:49:54.000000000","message":"Done","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"270bff1f03cfcea59741e3c2d22d6b31cf741e96","unresolved":false,"context_lines":[{"line_number":27,"context_line":"admins, the cloud admin, that have all the administrator capabilities, and the"},{"line_number":28,"context_line":"domain admin, that have a restricted set of administrator permissions. We are"},{"line_number":29,"context_line":"providing now the policy with the concept of project admin, that will have"},{"line_number":30,"context_line":"admin capabilities on a project. Also, it doesn\u0027t have clear definition of"},{"line_number":31,"context_line":"roles, it only uses the role admin and makes difference between cloud_admin and"},{"line_number":32,"context_line":"domain_admin using the scope of the assignment. Beside this, this policy isn\u0027t"},{"line_number":33,"context_line":"the default one."}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_f644c6b8","line":30,"updated":"2014-12-09 18:11:37.000000000","message":"This kinda sounds like hierarchical roles.","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"270bff1f03cfcea59741e3c2d22d6b31cf741e96","unresolved":false,"context_lines":[{"line_number":58,"context_line":"  perform actions on the domain he manages, e.g., update the domain\u0027s"},{"line_number":59,"context_line":"  information, CRUD of projects, users."},{"line_number":60,"context_line":"  Note that domain_admin is a role that only makes sense to Keystone, since"},{"line_number":61,"context_line":"  other services doesn\u0027t recognize domain;"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"* project_admin is the role for users that need to manage projects. It can\u0027t"},{"line_number":64,"context_line":"  do operations like create users or create projects but are able to update the"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_f61be6c7","line":61,"updated":"2014-12-09 18:11:37.000000000","message":"don\u0027t*","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"c6c2fdbacd82e5d443bffc8d480ff437de4e0ce4","unresolved":false,"context_lines":[{"line_number":58,"context_line":"  perform actions on the domain he manages, e.g., update the domain\u0027s"},{"line_number":59,"context_line":"  information, CRUD of projects, users."},{"line_number":60,"context_line":"  Note that domain_admin is a role that only makes sense to Keystone, since"},{"line_number":61,"context_line":"  other services doesn\u0027t recognize domain;"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"* project_admin is the role for users that need to manage projects. It can\u0027t"},{"line_number":64,"context_line":"  do operations like create users or create projects but are able to update the"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_1fa245ae","line":61,"in_reply_to":"3a961159_f61be6c7","updated":"2014-12-09 19:49:54.000000000","message":"Done","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"270bff1f03cfcea59741e3c2d22d6b31cf741e96","unresolved":false,"context_lines":[{"line_number":68,"context_line":"* project_member is the role for ordinaries users with no admin permissions at"},{"line_number":69,"context_line":"  all;"},{"line_number":70,"context_line":"  The current roles _member_ and Member will be mapped into this role;"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_f6720610","line":71,"updated":"2014-12-09 18:11:37.000000000","message":"These are all sets of permissions with the next level down always being a subset of the parent role it sounds like. This seems very similar to hierarchical roles.","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"7b3fbffa68066ff01360951129dd7761b51dfb83","unresolved":false,"context_lines":[{"line_number":68,"context_line":"* project_member is the role for ordinaries users with no admin permissions at"},{"line_number":69,"context_line":"  all;"},{"line_number":70,"context_line":"  The current roles _member_ and Member will be mapped into this role;"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_398c8135","line":71,"in_reply_to":"3a961159_f6720610","updated":"2014-12-09 18:38:05.000000000","message":"What\u0027s your opinion on the cloud admin managing projects, vms, and users inside projects?\nIf you think the cloud_admin shouldn\u0027t have permission to look inside a domain, then it\u0027s not hierarchical roles.\nWe think of cloud_admin as the user who manages the infrastructure of the cloud, create domains, initial users, assign user to a domain, and so on, but don\u0027t have permission to look inside a domain We wanna make domains as much independent as possible.\nI\u0027ll explain better in the next patch.","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"270bff1f03cfcea59741e3c2d22d6b31cf741e96","unresolved":false,"context_lines":[{"line_number":87,"context_line":"project_admin could grant a user the cloud_admin role. To avoid this, the"},{"line_number":88,"context_line":"implementation of this spec needs to enforce that only the cloud admin users"},{"line_number":89,"context_line":"are able to grant cloud_admin role, and that only the domain admin users are"},{"line_number":90,"context_line":"able to grant domain_admin role."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Notifications Impact"},{"line_number":93,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_b6fdde3d","line":90,"updated":"2014-12-09 18:11:37.000000000","message":"So the role grant call work for everyone but in limited scope, correct? If I\u0027m a domain_admin I can only grant certain permissions versus a cloud_admin, or a project_admin.","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"7b3fbffa68066ff01360951129dd7761b51dfb83","unresolved":false,"context_lines":[{"line_number":87,"context_line":"project_admin could grant a user the cloud_admin role. To avoid this, the"},{"line_number":88,"context_line":"implementation of this spec needs to enforce that only the cloud admin users"},{"line_number":89,"context_line":"are able to grant cloud_admin role, and that only the domain admin users are"},{"line_number":90,"context_line":"able to grant domain_admin role."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Notifications Impact"},{"line_number":93,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_39bac1c0","line":90,"in_reply_to":"3a961159_b6fdde3d","updated":"2014-12-09 18:38:05.000000000","message":"cloud_admin can grant any role. domain_admin can grant any role except for cloud_admin role ( for security reasons ), and the project_admin any role except for cloud_admin and domain_admin.","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"270bff1f03cfcea59741e3c2d22d6b31cf741e96","unresolved":false,"context_lines":[{"line_number":112,"context_line":"Other Deployer Impact"},{"line_number":113,"context_line":"---------------------"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"The roles provided need to be added to the Openstack instantiation:"},{"line_number":116,"context_line":"cloud_admin, domain_admin, project_admin and project_member."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Developer Impact"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_1696b2f0","line":115,"updated":"2014-12-09 18:11:37.000000000","message":"OpenStack","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"c6c2fdbacd82e5d443bffc8d480ff437de4e0ce4","unresolved":false,"context_lines":[{"line_number":112,"context_line":"Other Deployer Impact"},{"line_number":113,"context_line":"---------------------"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"The roles provided need to be added to the Openstack instantiation:"},{"line_number":116,"context_line":"cloud_admin, domain_admin, project_admin and project_member."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Developer Impact"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_df9fdd5d","line":115,"in_reply_to":"3a961159_1696b2f0","updated":"2014-12-09 19:49:54.000000000","message":"Done","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"270bff1f03cfcea59741e3c2d22d6b31cf741e96","unresolved":false,"context_lines":[{"line_number":153,"context_line":"  policy with concepts of domain admin, this spec aims to: First, update the"},{"line_number":154,"context_line":"  policy.v3samplecloud with the new configuration. And second, make the"},{"line_number":155,"context_line":"  modified policy.v3cloudsample as default."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"* Neutron;"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"* Nova;"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_76ba966f","line":156,"updated":"2014-12-09 18:11:37.000000000","message":"Will this include pulling all other integrated policy files into Keystone?","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8532440b0aa43ff7685cfeacecec2c7216aafd8c","unresolved":false,"context_lines":[{"line_number":153,"context_line":"  policy with concepts of domain admin, this spec aims to: First, update the"},{"line_number":154,"context_line":"  policy.v3samplecloud with the new configuration. And second, make the"},{"line_number":155,"context_line":"  modified policy.v3cloudsample as default."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"* Neutron;"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"* Nova;"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_3c3b8f9d","line":156,"in_reply_to":"3a961159_391641a8","updated":"2014-12-09 18:53:39.000000000","message":"Cool, that might be a nice thing to clarify here. Since there is a lot of policy specs floating around, it would be nice to see how they tie together with respect to each other.","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"c6c2fdbacd82e5d443bffc8d480ff437de4e0ce4","unresolved":false,"context_lines":[{"line_number":153,"context_line":"  policy with concepts of domain admin, this spec aims to: First, update the"},{"line_number":154,"context_line":"  policy.v3samplecloud with the new configuration. And second, make the"},{"line_number":155,"context_line":"  modified policy.v3cloudsample as default."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"* Neutron;"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"* Nova;"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_8a7c3522","line":156,"in_reply_to":"3a961159_3c3b8f9d","updated":"2014-12-09 19:49:54.000000000","message":"Done","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"7b3fbffa68066ff01360951129dd7761b51dfb83","unresolved":false,"context_lines":[{"line_number":153,"context_line":"  policy with concepts of domain admin, this spec aims to: First, update the"},{"line_number":154,"context_line":"  policy.v3samplecloud with the new configuration. And second, make the"},{"line_number":155,"context_line":"  modified policy.v3cloudsample as default."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"* Neutron;"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"* Nova;"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_391641a8","line":156,"in_reply_to":"3a961159_76ba966f","updated":"2014-12-09 18:38:05.000000000","message":"Initially we intend to submit separated patches for each service, after that if we\u0027ll create a unified policy it\u0027s an independent point.","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"270bff1f03cfcea59741e3c2d22d6b31cf741e96","unresolved":false,"context_lines":[{"line_number":183,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"Github for sample policies project with tests:"},{"line_number":186,"context_line":"* https://github.com/andre-lsd/sample-policies-for-openstack"},{"line_number":187,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_b6723ee1","line":186,"updated":"2014-12-09 18:11:37.000000000","message":"nit: suggest turning this into an .rst formatted link","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"c6c2fdbacd82e5d443bffc8d480ff437de4e0ce4","unresolved":false,"context_lines":[{"line_number":183,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"Github for sample policies project with tests:"},{"line_number":186,"context_line":"* https://github.com/andre-lsd/sample-policies-for-openstack"},{"line_number":187,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_9f263515","line":186,"in_reply_to":"3a961159_b6723ee1","updated":"2014-12-09 19:49:54.000000000","message":"Done","commit_id":"2eea21873223751d7ca76e12cba7142275734995"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2488ce75448fff8c1d77866531d11f768e311f27","unresolved":false,"context_lines":[{"line_number":27,"context_line":"admins: the cloud admin, that have all the administrator capabilities, and the"},{"line_number":28,"context_line":"domain admin, that have a restricted set of administrator permissions. We are"},{"line_number":29,"context_line":"providing now the policy with the concept of project admin, that will have"},{"line_number":30,"context_line":"admin capabilities on a project. Also, it doesn\u0027t have clear definition of"},{"line_number":31,"context_line":"roles, it only uses the role admin and makes difference between cloud_admin and"},{"line_number":32,"context_line":"domain_admin using the scope of the assignment. Beside, this policy isn\u0027t the"},{"line_number":33,"context_line":"default one."}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a930d6b_448426d4","line":30,"updated":"2015-01-22 01:01:34.000000000","message":"What\u0027s \u0027it\u0027 in this sentence? Maybe something more like: \"The existing cloud policy doesn\u0027t ...\"","commit_id":"2706e8247e01143d375f97c5e20473ad1304147b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2488ce75448fff8c1d77866531d11f768e311f27","unresolved":false,"context_lines":[{"line_number":29,"context_line":"providing now the policy with the concept of project admin, that will have"},{"line_number":30,"context_line":"admin capabilities on a project. Also, it doesn\u0027t have clear definition of"},{"line_number":31,"context_line":"roles, it only uses the role admin and makes difference between cloud_admin and"},{"line_number":32,"context_line":"domain_admin using the scope of the assignment. Beside, this policy isn\u0027t the"},{"line_number":33,"context_line":"default one."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The default policy defines the member and the admin users, where the admin has"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a930d6b_445b4687","line":32,"updated":"2015-01-22 01:01:34.000000000","message":"The last sentence here sounds a little strange.","commit_id":"2706e8247e01143d375f97c5e20473ad1304147b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2488ce75448fff8c1d77866531d11f768e311f27","unresolved":false,"context_lines":[{"line_number":38,"context_line":"perform actions in parts of the cloud."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"The proposed policy will replace the global admin role into cloud_admin,"},{"line_number":41,"context_line":"domani_admin, project_admin and project_member. The cloud_admin will be the"},{"line_number":42,"context_line":"user responsible for the cloud infrastructure, this user will manage domains"},{"line_number":43,"context_line":"and assign users to it, but no further than this. We are proposing that the"},{"line_number":44,"context_line":"domains is as much independent as possible. The domain_admin user will have"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a930d6b_c4fc9641","line":41,"updated":"2015-01-22 01:01:34.000000000","message":"domain_admin","commit_id":"2706e8247e01143d375f97c5e20473ad1304147b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2488ce75448fff8c1d77866531d11f768e311f27","unresolved":false,"context_lines":[{"line_number":41,"context_line":"domani_admin, project_admin and project_member. The cloud_admin will be the"},{"line_number":42,"context_line":"user responsible for the cloud infrastructure, this user will manage domains"},{"line_number":43,"context_line":"and assign users to it, but no further than this. We are proposing that the"},{"line_number":44,"context_line":"domains is as much independent as possible. The domain_admin user will have"},{"line_number":45,"context_line":"permission to update it\u0027s domain, manage projects, list roles, manage users,"},{"line_number":46,"context_line":"assign users to projects, and so on. The project_admin user will have the"},{"line_number":47,"context_line":"permission to list users, list roles, assign users to it\u0027s project, and so on."}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a930d6b_0464de20","line":44,"updated":"2015-01-22 01:01:34.000000000","message":"\u0027domains are as independent\u0027","commit_id":"2706e8247e01143d375f97c5e20473ad1304147b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2488ce75448fff8c1d77866531d11f768e311f27","unresolved":false,"context_lines":[{"line_number":42,"context_line":"user responsible for the cloud infrastructure, this user will manage domains"},{"line_number":43,"context_line":"and assign users to it, but no further than this. We are proposing that the"},{"line_number":44,"context_line":"domains is as much independent as possible. The domain_admin user will have"},{"line_number":45,"context_line":"permission to update it\u0027s domain, manage projects, list roles, manage users,"},{"line_number":46,"context_line":"assign users to projects, and so on. The project_admin user will have the"},{"line_number":47,"context_line":"permission to list users, list roles, assign users to it\u0027s project, and so on."},{"line_number":48,"context_line":"A project in a domain will not interfere in any other project, the same goes"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a930d6b_446ee602","line":45,"updated":"2015-01-22 01:01:34.000000000","message":"its","commit_id":"2706e8247e01143d375f97c5e20473ad1304147b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2488ce75448fff8c1d77866531d11f768e311f27","unresolved":false,"context_lines":[{"line_number":96,"context_line":"Security Impact"},{"line_number":97,"context_line":"---------------"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The services may have some hard coded checks that verifies if the user has the"},{"line_number":100,"context_line":"admin role instead of the role defined in the policy rule. Also, as we are"},{"line_number":101,"context_line":"providing to domain_admin and project_admin the permission to assign users to"},{"line_number":102,"context_line":"his domain/project, a project_admin cannot grant to a user the cloud_admin role"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a930d6b_845e0e44","line":99,"updated":"2015-01-22 01:01:34.000000000","message":"verify","commit_id":"2706e8247e01143d375f97c5e20473ad1304147b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2488ce75448fff8c1d77866531d11f768e311f27","unresolved":false,"context_lines":[{"line_number":103,"context_line":"nor the domain_admin role, and a domain_admin user cannot be able to grant to"},{"line_number":104,"context_line":"a user the cloud_admin role. To avoid this, the implementation of this spec"},{"line_number":105,"context_line":"needs to enforce that only the cloud admin users are able to grant cloud_admin"},{"line_number":106,"context_line":"role, and that only the domain admin users are able to grant domain_admin"},{"line_number":107,"context_line":"role."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a930d6b_e42c32ae","line":106,"updated":"2015-01-22 01:01:34.000000000","message":"So this adds more role names into the code?","commit_id":"2706e8247e01143d375f97c5e20473ad1304147b"}],"specs/kilo/modify_policy.rst":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"e7b3fe23e4f086ceb0cd72373151f88086321c97","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/modify_policy\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The current policies rules doesn\u0027t reflect the needs of an enterprise using"},{"line_number":15,"context_line":"Openstack, we propose to change the rules of the policies so that it now has"},{"line_number":16,"context_line":"more kind of users: cloud_admin, domain_admin, project_admin and"},{"line_number":17,"context_line":"project_member."},{"line_number":18,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_24f8fbc3","line":15,"updated":"2014-11-19 17:56:44.000000000","message":"OpenStack","commit_id":"265a9086afde868b548b6757607dc1373f71ac30"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"e7b3fe23e4f086ceb0cd72373151f88086321c97","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The current policies rules doesn\u0027t reflect the needs of an enterprise using"},{"line_number":15,"context_line":"Openstack, we propose to change the rules of the policies so that it now has"},{"line_number":16,"context_line":"more kind of users: cloud_admin, domain_admin, project_admin and"},{"line_number":17,"context_line":"project_member."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_a42b0b32","line":16,"updated":"2014-11-19 17:56:44.000000000","message":"\"more kind\" sounds weird here...","commit_id":"265a9086afde868b548b6757607dc1373f71ac30"}]}