)]}'
{"specs/backlog/dynamic-policy.rst":[{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"75037cde6681bc04ecce9358049f031a1617976e","unresolved":false,"context_lines":[{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"},{"line_number":18,"context_line":"the chain of delagtion by how we delegate roles."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"In order to delegate cleanly, a user should be able to to break apart"},{"line_number":21,"context_line":"the permissions that compose a large role and deleget only a subset of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_5614d64c","line":18,"updated":"2015-01-20 16:44:52.000000000","message":"s/delagtion/delegation/","commit_id":"18728160cd5f34a116143a775c8833173fae7266"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"25018596afc8a0b97b34cb53e9269524bc5df5b9","unresolved":false,"context_lines":[{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"},{"line_number":18,"context_line":"the chain of delagtion by how we delegate roles."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"In order to delegate cleanly, a user should be able to to break apart"},{"line_number":21,"context_line":"the permissions that compose a large role and deleget only a subset of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a930d6b_148e5679","line":18,"in_reply_to":"3a961159_5614d64c","updated":"2015-01-26 12:26:05.000000000","message":"Done","commit_id":"18728160cd5f34a116143a775c8833173fae7266"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"75037cde6681bc04ecce9358049f031a1617976e","unresolved":false,"context_lines":[{"line_number":18,"context_line":"the chain of delagtion by how we delegate roles."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"In order to delegate cleanly, a user should be able to to break apart"},{"line_number":21,"context_line":"the permissions that compose a large role and deleget only a subset of"},{"line_number":22,"context_line":"them.  Tokens should reflect only this subset of permissions, but"},{"line_number":23,"context_line":"should not explicitly enumerate each and every permission.  Role"},{"line_number":24,"context_line":"inheritance should be expanded by policy enforcement."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_910c883b","line":21,"updated":"2015-01-20 16:44:52.000000000","message":"s/deleget/delegate/","commit_id":"18728160cd5f34a116143a775c8833173fae7266"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"25018596afc8a0b97b34cb53e9269524bc5df5b9","unresolved":false,"context_lines":[{"line_number":18,"context_line":"the chain of delagtion by how we delegate roles."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"In order to delegate cleanly, a user should be able to to break apart"},{"line_number":21,"context_line":"the permissions that compose a large role and deleget only a subset of"},{"line_number":22,"context_line":"them.  Tokens should reflect only this subset of permissions, but"},{"line_number":23,"context_line":"should not explicitly enumerate each and every permission.  Role"},{"line_number":24,"context_line":"inheritance should be expanded by policy enforcement."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a930d6b_f4946a8c","line":21,"in_reply_to":"3a961159_910c883b","updated":"2015-01-26 12:26:05.000000000","message":"Done","commit_id":"18728160cd5f34a116143a775c8833173fae7266"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"75037cde6681bc04ecce9358049f031a1617976e","unresolved":false,"context_lines":[{"line_number":36,"context_line":"   based on their roles"},{"line_number":37,"context_line":"*  Establish an iterative process solve the long-standing bug that a user"},{"line_number":38,"context_line":"   with admin on any scope has admin on all scoped."},{"line_number":39,"context_line":"*  Allow a user to delegate a subset of their capabilites to a remote service."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Proposed Change"},{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_5114e04c","line":39,"updated":"2015-01-20 16:44:52.000000000","message":"s/capabilities/permissions/","commit_id":"18728160cd5f34a116143a775c8833173fae7266"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"25018596afc8a0b97b34cb53e9269524bc5df5b9","unresolved":false,"context_lines":[{"line_number":36,"context_line":"   based on their roles"},{"line_number":37,"context_line":"*  Establish an iterative process solve the long-standing bug that a user"},{"line_number":38,"context_line":"   with admin on any scope has admin on all scoped."},{"line_number":39,"context_line":"*  Allow a user to delegate a subset of their capabilites to a remote service."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Proposed Change"},{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a930d6b_d4976e8e","line":39,"in_reply_to":"3a961159_5114e04c","updated":"2015-01-26 12:26:05.000000000","message":"Done","commit_id":"18728160cd5f34a116143a775c8833173fae7266"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"75037cde6681bc04ecce9358049f031a1617976e","unresolved":false,"context_lines":[{"line_number":57,"context_line":"     into a single policy file, with namespaces that keep the rules"},{"line_number":58,"context_line":"     from conflicting across services.  Reduce the duplication of"},{"line_number":59,"context_line":"     rules like “admin_or_owner” so that we have a consistent catalog"},{"line_number":60,"context_line":"     of capabilities across OpenStack.  Make this merged file the"},{"line_number":61,"context_line":"     default that is served out of Keystone when an endpoint asks for"},{"line_number":62,"context_line":"     a policy file and Keystone does not have an endpoint specific"},{"line_number":63,"context_line":"     file to give it."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_7cab73d7","line":60,"updated":"2015-01-20 16:44:52.000000000","message":"s/capabilities/permissions/","commit_id":"18728160cd5f34a116143a775c8833173fae7266"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"25018596afc8a0b97b34cb53e9269524bc5df5b9","unresolved":false,"context_lines":[{"line_number":57,"context_line":"     into a single policy file, with namespaces that keep the rules"},{"line_number":58,"context_line":"     from conflicting across services.  Reduce the duplication of"},{"line_number":59,"context_line":"     rules like “admin_or_owner” so that we have a consistent catalog"},{"line_number":60,"context_line":"     of capabilities across OpenStack.  Make this merged file the"},{"line_number":61,"context_line":"     default that is served out of Keystone when an endpoint asks for"},{"line_number":62,"context_line":"     a policy file and Keystone does not have an endpoint specific"},{"line_number":63,"context_line":"     file to give it."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a930d6b_b47f4265","line":60,"in_reply_to":"3a961159_7cab73d7","updated":"2015-01-26 12:26:05.000000000","message":"Done","commit_id":"18728160cd5f34a116143a775c8833173fae7266"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"75037cde6681bc04ecce9358049f031a1617976e","unresolved":false,"context_lines":[{"line_number":59,"context_line":"     rules like “admin_or_owner” so that we have a consistent catalog"},{"line_number":60,"context_line":"     of capabilities across OpenStack.  Make this merged file the"},{"line_number":61,"context_line":"     default that is served out of Keystone when an endpoint asks for"},{"line_number":62,"context_line":"     a policy file and Keystone does not have an endpoint specific"},{"line_number":63,"context_line":"     file to give it."},{"line_number":64,"context_line":"* Make a database schema to hold the rules from the policy file.  Use"},{"line_number":65,"context_line":"     this to generate the policy files served by Keystone.  There"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_7c3d33bc","line":62,"updated":"2015-01-20 16:44:52.000000000","message":"In some cases a merge may not make sense. \"Admin\" for PAAS may be different than \"Admin\" for IAAS\"","commit_id":"18728160cd5f34a116143a775c8833173fae7266"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"25018596afc8a0b97b34cb53e9269524bc5df5b9","unresolved":false,"context_lines":[{"line_number":59,"context_line":"     rules like “admin_or_owner” so that we have a consistent catalog"},{"line_number":60,"context_line":"     of capabilities across OpenStack.  Make this merged file the"},{"line_number":61,"context_line":"     default that is served out of Keystone when an endpoint asks for"},{"line_number":62,"context_line":"     a policy file and Keystone does not have an endpoint specific"},{"line_number":63,"context_line":"     file to give it."},{"line_number":64,"context_line":"* Make a database schema to hold the rules from the policy file.  Use"},{"line_number":65,"context_line":"     this to generate the policy files served by Keystone.  There"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a930d6b_947a4675","line":62,"in_reply_to":"3a961159_7c3d33bc","updated":"2015-01-26 12:26:05.000000000","message":"Done","commit_id":"18728160cd5f34a116143a775c8833173fae7266"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"22accca52d95cd4e08128a8cbafa57ffc154d043","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Dynamic Policy Overview"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp dynamic-policy \u003chttps://blueprints.launchpad.net/keystone/+spec/dynamic-policy\u003e`_"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_0c13965c","line":9,"updated":"2015-04-09 09:34:46.000000000","message":"(nit): too many \u003d\u003d\u003d\u003d\u003d\u003d","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Dynamic Policy Overview"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp dynamic-policy \u003chttps://blueprints.launchpad.net/keystone/+spec/dynamic-policy\u003e`_"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_16ba11e2","line":9,"in_reply_to":"9aa53dc9_0c13965c","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"222db59184b0928f3bbf2876e86453752f308e24","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp dynamic-policy \u003chttps://blueprints.launchpad.net/keystone/+spec/dynamic-policy\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The OAUTH1.0 extension to Keystone are very similar to trusts.  The"},{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_d7eb4477","line":14,"updated":"2015-04-07 17:57:20.000000000","message":"I believe you should have OAUTH1.0a listed here. The Keystone Authentication Plugins conform to OAUTH1.0a http://docs.openstack.org/developer/python-keystoneclient/authentication-plugins.html . OAUTH1 has a unsigned authorization step vulnerability that allows an attacker to set another person\u0027s session identifier.  This issue is resolved in OAUTH1.0a.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp dynamic-policy \u003chttps://blueprints.launchpad.net/keystone/+spec/dynamic-policy\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The OAUTH1.0 extension to Keystone are very similar to trusts.  The"},{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_24bf10d2","line":14,"in_reply_to":"7aaa499b_a68d3133","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"8957d529f439c0a92c6a8292ca65858db39fd949","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp dynamic-policy \u003chttps://blueprints.launchpad.net/keystone/+spec/dynamic-policy\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The OAUTH1.0 extension to Keystone are very similar to trusts.  The"},{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aaa499b_a68d3133","line":14,"in_reply_to":"9aa53dc9_d7eb4477","updated":"2015-04-13 20:53:04.000000000","message":"I should probably drop the references to OAUTH from this doc.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The OAUTH1.0 extension to Keystone are very similar to trusts.  The"},{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"},{"line_number":18,"context_line":"the chain of delegtion by how we delegate roles."}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_2e13040f","line":15,"updated":"2015-04-08 20:28:00.000000000","message":"typo: theat -\u003e that","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The OAUTH1.0 extension to Keystone are very similar to trusts.  The"},{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"},{"line_number":18,"context_line":"the chain of delegtion by how we delegate roles."}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_04b414f0","line":15,"in_reply_to":"9aa53dc9_2e13040f","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"22accca52d95cd4e08128a8cbafa57ffc154d043","unresolved":false,"context_lines":[{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"},{"line_number":18,"context_line":"the chain of delegtion by how we delegate roles."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"In order to delegate cleanly, a user should be able to to break apart"},{"line_number":21,"context_line":"the permissions that compose a large role and delegate only a subset of"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_ac014a07","line":18,"updated":"2015-04-09 09:34:46.000000000","message":"So as an intro paragraph, I\u0027d suggest inverting this a bit.  The title is Policy Overview...but we kick off talking about OAUTH, which to most people is confusing.  The thing they know about policy is to do with roles, tokens and policy.json.  And most of the rest of the document is about how we massage these pieces (and then OAUTH etc. will follow suit).  So maybe starting with roles, tokens and policy.json would be a better intro.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"},{"line_number":18,"context_line":"the chain of delegtion by how we delegate roles."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"In order to delegate cleanly, a user should be able to to break apart"},{"line_number":21,"context_line":"the permissions that compose a large role and delegate only a subset of"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_e4b8f8e7","line":18,"in_reply_to":"7aaa499b_267a4125","updated":"2015-04-27 19:48:27.000000000","message":"I am changing this intro. I will send a patch set soon for review, thanks.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"8957d529f439c0a92c6a8292ca65858db39fd949","unresolved":false,"context_lines":[{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"},{"line_number":18,"context_line":"the chain of delegtion by how we delegate roles."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"In order to delegate cleanly, a user should be able to to break apart"},{"line_number":21,"context_line":"the permissions that compose a large role and delegate only a subset of"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aaa499b_267a4125","line":18,"in_reply_to":"9aa53dc9_ac014a07","updated":"2015-04-13 20:53:04.000000000","message":"Agreed.  I think this was a \"need something to prime the pump\" lead in that should go away.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ee535a0daeffd78a67da0bb47d8c0df6180ba","unresolved":false,"context_lines":[{"line_number":15,"context_line":"mechanisms theat implement them duplicate functionality; they should"},{"line_number":16,"context_line":"have a unified mechanism between them for delegation. Role assignments"},{"line_number":17,"context_line":"themselves are a form of delegation, and today Keystone is losing"},{"line_number":18,"context_line":"the chain of delegtion by how we delegate roles."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"In order to delegate cleanly, a user should be able to to break apart"},{"line_number":21,"context_line":"the permissions that compose a large role and delegate only a subset of"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_005460fc","line":18,"in_reply_to":"9aa53dc9_ac014a07","updated":"2015-04-09 22:41:59.000000000","message":"typo: delegation","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":34,"context_line":"*  Allow a user to determine what roles they need to perform some action"},{"line_number":35,"context_line":"*  Allow some user interface to determine what a user is capable of doing"},{"line_number":36,"context_line":"   based on their roles"},{"line_number":37,"context_line":"*  Establish an iterative process solve the long-standing bug that a user"},{"line_number":38,"context_line":"   with admin on any scope has admin on all scoped."},{"line_number":39,"context_line":"*  Allow a user to delegate a subset of their permissions to a remote service."},{"line_number":40,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_6ebeacd5","line":37,"updated":"2015-04-08 20:28:00.000000000","message":"process solve -\u003e process to solve","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":34,"context_line":"*  Allow a user to determine what roles they need to perform some action"},{"line_number":35,"context_line":"*  Allow some user interface to determine what a user is capable of doing"},{"line_number":36,"context_line":"   based on their roles"},{"line_number":37,"context_line":"*  Establish an iterative process solve the long-standing bug that a user"},{"line_number":38,"context_line":"   with admin on any scope has admin on all scoped."},{"line_number":39,"context_line":"*  Allow a user to delegate a subset of their permissions to a remote service."},{"line_number":40,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_27d03553","line":37,"in_reply_to":"9aa53dc9_6ebeacd5","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":35,"context_line":"*  Allow some user interface to determine what a user is capable of doing"},{"line_number":36,"context_line":"   based on their roles"},{"line_number":37,"context_line":"*  Establish an iterative process solve the long-standing bug that a user"},{"line_number":38,"context_line":"   with admin on any scope has admin on all scoped."},{"line_number":39,"context_line":"*  Allow a user to delegate a subset of their permissions to a remote service."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_4eb528ec","line":38,"updated":"2015-04-08 20:28:00.000000000","message":"All scoped what?","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":35,"context_line":"*  Allow some user interface to determine what a user is capable of doing"},{"line_number":36,"context_line":"   based on their roles"},{"line_number":37,"context_line":"*  Establish an iterative process solve the long-standing bug that a user"},{"line_number":38,"context_line":"   with admin on any scope has admin on all scoped."},{"line_number":39,"context_line":"*  Allow a user to delegate a subset of their permissions to a remote service."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_649ce869","line":38,"in_reply_to":"9aa53dc9_4eb528ec","updated":"2015-04-27 19:48:27.000000000","message":"I will rephrase this, but basically a user with admin anywhere can do admin operations everywhere. It\u0027s caused by the fact the scope is not being verified in our current default policy definitions.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ee535a0daeffd78a67da0bb47d8c0df6180ba","unresolved":false,"context_lines":[{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"What we have now is a simple set of specs that build on each other that will,"},{"line_number":45,"context_line":"in the end, provide a much more powerful, flexible, and consistant delegation"},{"line_number":46,"context_line":"mechanism for Keystone. Here are the General steps:"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* Graduate oslo policy to a library"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_2039a4a4","line":45,"updated":"2015-04-09 22:41:59.000000000","message":"typo: consistent","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"What we have now is a simple set of specs that build on each other that will,"},{"line_number":45,"context_line":"in the end, provide a much more powerful, flexible, and consistant delegation"},{"line_number":46,"context_line":"mechanism for Keystone. Here are the General steps:"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* Graduate oslo policy to a library"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_67e74d41","line":45,"in_reply_to":"9aa53dc9_2039a4a4","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ee535a0daeffd78a67da0bb47d8c0df6180ba","unresolved":false,"context_lines":[{"line_number":48,"context_line":"* Graduate oslo policy to a library"},{"line_number":49,"context_line":"* Add to the policy library the essential code to enforce policy based"},{"line_number":50,"context_line":"  on a keystone token.  I\u0027ve looked at both the Keystone and Nova"},{"line_number":51,"context_line":"  pieces that do this, and they are similar enough that we should"},{"line_number":52,"context_line":"  not have too much problem making this happen."},{"line_number":53,"context_line":"* Add in the ability to fetch the policy.json file from Keystone."},{"line_number":54,"context_line":"* Add a rule to the Keystone policy API to return the default policy file if"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_6a978648","line":51,"updated":"2015-04-09 22:41:59.000000000","message":"\"to\" do this","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":48,"context_line":"* Graduate oslo policy to a library"},{"line_number":49,"context_line":"* Add to the policy library the essential code to enforce policy based"},{"line_number":50,"context_line":"  on a keystone token.  I\u0027ve looked at both the Keystone and Nova"},{"line_number":51,"context_line":"  pieces that do this, and they are similar enough that we should"},{"line_number":52,"context_line":"  not have too much problem making this happen."},{"line_number":53,"context_line":"* Add in the ability to fetch the policy.json file from Keystone."},{"line_number":54,"context_line":"* Add a rule to the Keystone policy API to return the default policy file if"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_a479e031","line":51,"in_reply_to":"9aa53dc9_6a978648","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ee535a0daeffd78a67da0bb47d8c0df6180ba","unresolved":false,"context_lines":[{"line_number":50,"context_line":"  on a keystone token.  I\u0027ve looked at both the Keystone and Nova"},{"line_number":51,"context_line":"  pieces that do this, and they are similar enough that we should"},{"line_number":52,"context_line":"  not have too much problem making this happen."},{"line_number":53,"context_line":"* Add in the ability to fetch the policy.json file from Keystone."},{"line_number":54,"context_line":"* Add a rule to the Keystone policy API to return the default policy file if"},{"line_number":55,"context_line":"  no policy file is specified for an endpoint."},{"line_number":56,"context_line":"* Merge the current default policy files from all of the projects"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_ca957233","line":53,"updated":"2015-04-09 22:41:59.000000000","message":"would oslo policy be responsible for caching policy.json?\n\nWould be nice to have oslo policy to do this, and refresh based on some defined interval.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":50,"context_line":"  on a keystone token.  I\u0027ve looked at both the Keystone and Nova"},{"line_number":51,"context_line":"  pieces that do this, and they are similar enough that we should"},{"line_number":52,"context_line":"  not have too much problem making this happen."},{"line_number":53,"context_line":"* Add in the ability to fetch the policy.json file from Keystone."},{"line_number":54,"context_line":"* Add a rule to the Keystone policy API to return the default policy file if"},{"line_number":55,"context_line":"  no policy file is specified for an endpoint."},{"line_number":56,"context_line":"* Merge the current default policy files from all of the projects"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_04e774e5","line":53,"in_reply_to":"9aa53dc9_ca957233","updated":"2015-04-27 19:48:27.000000000","message":"Actually there is a discussion around where we will fetch the file. It\u0027s proposed to be on the keystoneclient, but some people see it as belonging to keystonemiddleware. See the spec for this step https://review.openstack.org/#/c/134655/","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"04fd64fd11692288528395c0aafb8bbd1b159bff","unresolved":false,"context_lines":[{"line_number":53,"context_line":"* Add in the ability to fetch the policy.json file from Keystone."},{"line_number":54,"context_line":"* Add a rule to the Keystone policy API to return the default policy file if"},{"line_number":55,"context_line":"  no policy file is specified for an endpoint."},{"line_number":56,"context_line":"* Merge the current default policy files from all of the projects"},{"line_number":57,"context_line":"  into a single policy file, with namespaces that keep the rules"},{"line_number":58,"context_line":"  from conflicting across services.  Reduce the duplication of"},{"line_number":59,"context_line":"  rules like \"admin_or_owner\" so that we have a consistent catalog"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da9b358b_e3a7af4d","line":56,"updated":"2015-03-30 22:42:11.000000000","message":"What about existing deployments with customized policy.json files.  Do we expect deployers to manually migrate the customized settings to this merged single policy file?  If yes, perhaps there needs to be a way to make this policy file migration migration as painless as possible.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":53,"context_line":"* Add in the ability to fetch the policy.json file from Keystone."},{"line_number":54,"context_line":"* Add a rule to the Keystone policy API to return the default policy file if"},{"line_number":55,"context_line":"  no policy file is specified for an endpoint."},{"line_number":56,"context_line":"* Merge the current default policy files from all of the projects"},{"line_number":57,"context_line":"  into a single policy file, with namespaces that keep the rules"},{"line_number":58,"context_line":"  from conflicting across services.  Reduce the duplication of"},{"line_number":59,"context_line":"  rules like \"admin_or_owner\" so that we have a consistent catalog"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_241dd073","line":56,"in_reply_to":"9aa53dc9_2ac29e34","updated":"2015-04-27 19:48:27.000000000","message":"I will add a point making for migrating existing policy files to the new mechanism","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ee535a0daeffd78a67da0bb47d8c0df6180ba","unresolved":false,"context_lines":[{"line_number":53,"context_line":"* Add in the ability to fetch the policy.json file from Keystone."},{"line_number":54,"context_line":"* Add a rule to the Keystone policy API to return the default policy file if"},{"line_number":55,"context_line":"  no policy file is specified for an endpoint."},{"line_number":56,"context_line":"* Merge the current default policy files from all of the projects"},{"line_number":57,"context_line":"  into a single policy file, with namespaces that keep the rules"},{"line_number":58,"context_line":"  from conflicting across services.  Reduce the duplication of"},{"line_number":59,"context_line":"  rules like \"admin_or_owner\" so that we have a consistent catalog"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_2ac29e34","line":56,"in_reply_to":"da9b358b_e3a7af4d","updated":"2015-04-09 22:41:59.000000000","message":"++ we can figure out the details later, but at least add the task for that","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":77,"context_line":"* Break member up into smaller roles.  For example, we could"},{"line_number":78,"context_line":"  distinguish between actions that can only read state from those"},{"line_number":79,"context_line":"  that can change it: \"Observer\" and \"Editor\" Member would inherit"},{"line_number":80,"context_line":"  editor, and editor would inherit observer."},{"line_number":81,"context_line":"* Change the rules for specific API policy enforcement points to know"},{"line_number":82,"context_line":"  about the new roles.  For example, the API to create a new image"},{"line_number":83,"context_line":"  in glance might now require the editor role instead of the member"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_4eb1a8e0","line":80,"updated":"2015-04-08 20:28:00.000000000","message":"I think this sentence should be\n\n  \"Observer\" would inherit member, and editor would inherit observer.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":77,"context_line":"* Break member up into smaller roles.  For example, we could"},{"line_number":78,"context_line":"  distinguish between actions that can only read state from those"},{"line_number":79,"context_line":"  that can change it: \"Observer\" and \"Editor\" Member would inherit"},{"line_number":80,"context_line":"  editor, and editor would inherit observer."},{"line_number":81,"context_line":"* Change the rules for specific API policy enforcement points to know"},{"line_number":82,"context_line":"  about the new roles.  For example, the API to create a new image"},{"line_number":83,"context_line":"  in glance might now require the editor role instead of the member"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_246830f5","line":80,"in_reply_to":"9aa53dc9_4eb1a8e0","updated":"2015-04-27 19:48:27.000000000","message":"It should be  member-\u003eeditor-\u003eobserver. thanks","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0f4ee535a0daeffd78a67da0bb47d8c0df6180ba","unresolved":false,"context_lines":[{"line_number":119,"context_line":"what they are capable of performing based on the roles they have assigned."},{"line_number":120,"context_line":"This means that they will be able to request tokens specific to the workflows"},{"line_number":121,"context_line":"that they perform.  For Horizon, this has the potential to allow the UI to"},{"line_number":122,"context_line":"display only those actions that the user can potentiall perform, and taylor"},{"line_number":123,"context_line":"the user experience accordingly."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_6afae676","line":122,"updated":"2015-04-09 22:41:59.000000000","message":"typo: tailor\n\nHorizon actually already hides actions that user does not have privileged to based on the policy.json stored in Horizon.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":119,"context_line":"what they are capable of performing based on the roles they have assigned."},{"line_number":120,"context_line":"This means that they will be able to request tokens specific to the workflows"},{"line_number":121,"context_line":"that they perform.  For Horizon, this has the potential to allow the UI to"},{"line_number":122,"context_line":"display only those actions that the user can potentiall perform, and taylor"},{"line_number":123,"context_line":"the user experience accordingly."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_acdb0ced","line":122,"in_reply_to":"9aa53dc9_6afae676","updated":"2015-04-27 19:48:27.000000000","message":"Today it\u0027s by panel right ? For instance, if you could do everything with users but create, you couldn\u0027t see the users painel with only the \u0027create user\u0027 button disabled, right ?\n\nWhat is being proposed here is to get a list of actions a token can perform.\nThis way, horizon will need to change the way it knows what it should show (from querying the policy to asking keystone).","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":125,"context_line":"Performance Impact"},{"line_number":126,"context_line":"------------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Dynamic Policy should have littel impact on the normal function of"},{"line_number":129,"context_line":"openStack process, both inside Keystone and outside.  THe size of"},{"line_number":130,"context_line":"policy rule files will increase, but the changes should be minimal."},{"line_number":131,"context_line":"There is always the possibility that the management of hte policy"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_ae45d4b3","line":128,"updated":"2015-04-08 20:28:00.000000000","message":"typo: littel -\u003e little","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":125,"context_line":"Performance Impact"},{"line_number":126,"context_line":"------------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Dynamic Policy should have littel impact on the normal function of"},{"line_number":129,"context_line":"openStack process, both inside Keystone and outside.  THe size of"},{"line_number":130,"context_line":"policy rule files will increase, but the changes should be minimal."},{"line_number":131,"context_line":"There is always the possibility that the management of hte policy"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_11a69bc1","line":128,"in_reply_to":"9aa53dc9_ae45d4b3","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":126,"context_line":"------------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Dynamic Policy should have littel impact on the normal function of"},{"line_number":129,"context_line":"openStack process, both inside Keystone and outside.  THe size of"},{"line_number":130,"context_line":"policy rule files will increase, but the changes should be minimal."},{"line_number":131,"context_line":"There is always the possibility that the management of hte policy"},{"line_number":132,"context_line":"rules in the database will have some hidden complixity, but managing"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_8e1330b8","line":129,"updated":"2015-04-08 20:28:00.000000000","message":"typo: openStack -\u003e OpenStack\n\ntypo: THe -\u003e The","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":126,"context_line":"------------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Dynamic Policy should have littel impact on the normal function of"},{"line_number":129,"context_line":"openStack process, both inside Keystone and outside.  THe size of"},{"line_number":130,"context_line":"policy rule files will increase, but the changes should be minimal."},{"line_number":131,"context_line":"There is always the possibility that the management of hte policy"},{"line_number":132,"context_line":"rules in the database will have some hidden complixity, but managing"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_f181dffc","line":129,"in_reply_to":"9aa53dc9_8e1330b8","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":128,"context_line":"Dynamic Policy should have littel impact on the normal function of"},{"line_number":129,"context_line":"openStack process, both inside Keystone and outside.  THe size of"},{"line_number":130,"context_line":"policy rule files will increase, but the changes should be minimal."},{"line_number":131,"context_line":"There is always the possibility that the management of hte policy"},{"line_number":132,"context_line":"rules in the database will have some hidden complixity, but managing"},{"line_number":133,"context_line":"these should be a very rare operation."},{"line_number":134,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_ee22bc00","line":131,"updated":"2015-04-08 20:28:00.000000000","message":"typo: hte -\u003e the","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":128,"context_line":"Dynamic Policy should have littel impact on the normal function of"},{"line_number":129,"context_line":"openStack process, both inside Keystone and outside.  THe size of"},{"line_number":130,"context_line":"policy rule files will increase, but the changes should be minimal."},{"line_number":131,"context_line":"There is always the possibility that the management of hte policy"},{"line_number":132,"context_line":"rules in the database will have some hidden complixity, but managing"},{"line_number":133,"context_line":"these should be a very rare operation."},{"line_number":134,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_91798b32","line":131,"in_reply_to":"9aa53dc9_ee22bc00","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":129,"context_line":"openStack process, both inside Keystone and outside.  THe size of"},{"line_number":130,"context_line":"policy rule files will increase, but the changes should be minimal."},{"line_number":131,"context_line":"There is always the possibility that the management of hte policy"},{"line_number":132,"context_line":"rules in the database will have some hidden complixity, but managing"},{"line_number":133,"context_line":"these should be a very rare operation."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_ce2138fd","line":132,"updated":"2015-04-08 20:28:00.000000000","message":"typo: complixity -\u003e complexity","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":129,"context_line":"openStack process, both inside Keystone and outside.  THe size of"},{"line_number":130,"context_line":"policy rule files will increase, but the changes should be minimal."},{"line_number":131,"context_line":"There is always the possibility that the management of hte policy"},{"line_number":132,"context_line":"rules in the database will have some hidden complixity, but managing"},{"line_number":133,"context_line":"these should be a very rare operation."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_7155cfc4","line":132,"in_reply_to":"9aa53dc9_ce2138fd","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"04fd64fd11692288528395c0aafb8bbd1b159bff","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Other Deployer Impact"},{"line_number":137,"context_line":"---------------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"The set of standard roles will now be able to evolve over time.  This"},{"line_number":141,"context_line":"will allow a deployment to map the roles specific to their"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da9b358b_63883fe8","line":138,"updated":"2015-03-30 22:42:11.000000000","message":"Extra vertical space here.","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Other Deployer Impact"},{"line_number":137,"context_line":"---------------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"The set of standard roles will now be able to evolve over time.  This"},{"line_number":141,"context_line":"will allow a deployment to map the roles specific to their"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_f140bf09","line":138,"in_reply_to":"da9b358b_63883fe8","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Configuration options will be addressed in the individual specs.  Very"},{"line_number":147,"context_line":"little of the dynamic policy approach is likely to need new"},{"line_number":148,"context_line":"configuration options.  One such chane will be that the policy file,"},{"line_number":149,"context_line":"currently specifed in config file will be come an automatically"},{"line_number":150,"context_line":"generated file, and will not require that config option anymore."},{"line_number":151,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_9100f102","line":148,"updated":"2015-04-08 20:28:00.000000000","message":"typo: chane (change or chain, perhaps?)","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Configuration options will be addressed in the individual specs.  Very"},{"line_number":147,"context_line":"little of the dynamic policy approach is likely to need new"},{"line_number":148,"context_line":"configuration options.  One such chane will be that the policy file,"},{"line_number":149,"context_line":"currently specifed in config file will be come an automatically"},{"line_number":150,"context_line":"generated file, and will not require that config option anymore."},{"line_number":151,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_31d07753","line":148,"in_reply_to":"9aa53dc9_9100f102","updated":"2015-04-27 19:48:27.000000000","message":"change\n\nDone","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":146,"context_line":"Configuration options will be addressed in the individual specs.  Very"},{"line_number":147,"context_line":"little of the dynamic policy approach is likely to need new"},{"line_number":148,"context_line":"configuration options.  One such chane will be that the policy file,"},{"line_number":149,"context_line":"currently specifed in config file will be come an automatically"},{"line_number":150,"context_line":"generated file, and will not require that config option anymore."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_f10f3d2c","line":149,"updated":"2015-04-08 20:28:00.000000000","message":"typo: be come -\u003e become","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":146,"context_line":"Configuration options will be addressed in the individual specs.  Very"},{"line_number":147,"context_line":"little of the dynamic policy approach is likely to need new"},{"line_number":148,"context_line":"configuration options.  One such chane will be that the policy file,"},{"line_number":149,"context_line":"currently specifed in config file will be come an automatically"},{"line_number":150,"context_line":"generated file, and will not require that config option anymore."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_b1dda772","line":149,"in_reply_to":"9aa53dc9_f10f3d2c","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":154,"context_line":"----------------"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"As described above, policy will become inspectable.  That means that all of the"},{"line_number":157,"context_line":"user experience can be taylored.  Aside from Horizon, the CLI may want to take"},{"line_number":158,"context_line":"advantage of this operation,  perhaps to warn a user ahead of time that the"},{"line_number":159,"context_line":"operation they want to perform may not be allowed."},{"line_number":160,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_f1361de6","line":157,"updated":"2015-04-08 20:28:00.000000000","message":"typo: taylored -\u003e tailored","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":154,"context_line":"----------------"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"As described above, policy will become inspectable.  That means that all of the"},{"line_number":157,"context_line":"user experience can be taylored.  Aside from Horizon, the CLI may want to take"},{"line_number":158,"context_line":"advantage of this operation,  perhaps to warn a user ahead of time that the"},{"line_number":159,"context_line":"operation they want to perform may not be allowed."},{"line_number":160,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_d6b37909","line":157,"in_reply_to":"9aa53dc9_f1361de6","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"719c119bd74a7df783183cf5eafaf4e3348c177c","unresolved":false,"context_lines":[{"line_number":191,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"Aside from the need to document the individual APIs, Dynamic Policy"},{"line_number":194,"context_line":"calls fro a set of documents covering the simple and complex use"},{"line_number":195,"context_line":"cases, security implications, and best practices."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_f13dfdbb","line":194,"updated":"2015-04-08 20:28:00.000000000","message":"typo: fro -\u003e for","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":191,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"Aside from the need to document the individual APIs, Dynamic Policy"},{"line_number":194,"context_line":"calls fro a set of documents covering the simple and complex use"},{"line_number":195,"context_line":"cases, security implications, and best practices."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_f17b1f7a","line":194,"in_reply_to":"9aa53dc9_f13dfdbb","updated":"2015-04-27 19:48:27.000000000","message":"Done","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"222db59184b0928f3bbf2876e86453752f308e24","unresolved":false,"context_lines":[{"line_number":199,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"https://etherpad.openstack.org/p/kilo-keystone-authorization"},{"line_number":202,"context_line":"https://etherpad.openstack.org/p/kilo-keystone-policy-model-token-capabilities"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa53dc9_9a6e0195","line":202,"updated":"2015-04-07 17:57:20.000000000","message":"I suggest adding an OAuth reference here.  http://oauth.net/core/1.0a/","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"180511c1b7ab07018cff0d0a51a2da1af14cc665","unresolved":false,"context_lines":[{"line_number":199,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"https://etherpad.openstack.org/p/kilo-keystone-authorization"},{"line_number":202,"context_line":"https://etherpad.openstack.org/p/kilo-keystone-policy-model-token-capabilities"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_24095096","line":202,"in_reply_to":"9aa53dc9_9a6e0195","updated":"2015-04-27 19:48:27.000000000","message":"If we keep the OAuth reference on this spec, I will add it. Thanks","commit_id":"fa5417890d94ff0505632fb41bd4bc24f646ce19"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"976a29d3fc152b10a3e19650db6b3f6ba2f4bd72","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"This requires the use of an out-of-band mechanism to customize and place the"},{"line_number":60,"context_line":"policy file in the service respective server. In addition, this leads to cross-"},{"line_number":61,"context_line":"project inconsistency across global roles like admin and owner."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Delegation"},{"line_number":64,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_aaa50d05","line":61,"updated":"2015-04-30 14:27:53.000000000","message":"This isn\u0027t a keystone problem - we already allow services to store and retrieve their polices from keystone.  The problem is that other services don\u0027t yet call this API.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"5e246dd1754bb7a976b1b3a2f843d39f5d2547ee","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"This requires the use of an out-of-band mechanism to customize and place the"},{"line_number":60,"context_line":"policy file in the service respective server. In addition, this leads to cross-"},{"line_number":61,"context_line":"project inconsistency across global roles like admin and owner."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Delegation"},{"line_number":64,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_d418e386","line":61,"in_reply_to":"3acd31a7_aaa50d05","updated":"2015-04-30 18:12:01.000000000","message":"If we can provide a simplified way to do this, it would help with the adaption rate.  \n\nFrom service admin perspective, Keystone v3 policies api currently takes serialized string as input and output.  For ease of use, we have to get to a point where admins can simply simply run a command to modify policies.\n\nFrom service developer perspective, perhaps a way to abstract policies in a library (keystone middleware?), so that developer does not need to explicitly deal with policies in a local file store or remote from keystone.  If we get rid of the physical policy.json file in the future, it would mostly be transparent (still got migration to deal with, file -\u003e db).","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"This requires the use of an out-of-band mechanism to customize and place the"},{"line_number":60,"context_line":"policy file in the service respective server. In addition, this leads to cross-"},{"line_number":61,"context_line":"project inconsistency across global roles like admin and owner."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Delegation"},{"line_number":64,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_ed2194b5","line":61,"in_reply_to":"3acd31a7_d418e386","updated":"2015-05-04 18:09:24.000000000","message":"Yes we want to ease the policy management through that API, we must have a spec/api change to describe the changes we want.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3075aa3de0bba360dd0a3ce6399688f2eae19109","unresolved":false,"context_lines":[{"line_number":66,"context_line":"The existing mechanisms of delegation are based on trusting someone to act on"},{"line_number":67,"context_line":"your behalf or simply granting new role assignments."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"When grating role assingments, since there is no relationship between roles, a"},{"line_number":70,"context_line":"user with a more restrictive role assignment could grant someone else a less"},{"line_number":71,"context_line":"restrictive role assignment. For example, a member would be able to grant admin"},{"line_number":72,"context_line":"privilegies."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_a473034d","line":69,"updated":"2015-04-30 14:17:57.000000000","message":"grating?  Not sure if you mean granting, but creating role assignemnts, or just assinging roles would be clearer.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":66,"context_line":"The existing mechanisms of delegation are based on trusting someone to act on"},{"line_number":67,"context_line":"your behalf or simply granting new role assignments."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"When grating role assingments, since there is no relationship between roles, a"},{"line_number":70,"context_line":"user with a more restrictive role assignment could grant someone else a less"},{"line_number":71,"context_line":"restrictive role assignment. For example, a member would be able to grant admin"},{"line_number":72,"context_line":"privilegies."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_8dbd806a","line":69,"in_reply_to":"3acd31a7_a473034d","updated":"2015-05-04 18:09:24.000000000","message":"Done","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"976a29d3fc152b10a3e19650db6b3f6ba2f4bd72","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"There is a known bug in which users with admin role on any project have"},{"line_number":78,"context_line":"unlimited admin-ness throughout the system because there is no differentiation"},{"line_number":79,"context_line":"between scoped and global admin-ness."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"New Features"},{"line_number":82,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_4a11d951","line":79,"updated":"2015-04-30 14:27:53.000000000","message":"I don\u0027t think this is a bug in our code.  It\u0027s just that the services don\u0027t use sufficiently strict policy file.  The keystone v3 sample policy shows how to solve it.  The problem with this is that writing such policy files is quite complex and difficult.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"77fe9584bebe1551f4e50235fa139092e79b1272","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"There is a known bug in which users with admin role on any project have"},{"line_number":78,"context_line":"unlimited admin-ness throughout the system because there is no differentiation"},{"line_number":79,"context_line":"between scoped and global admin-ness."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"New Features"},{"line_number":82,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_4dc8d355","line":79,"in_reply_to":"3acd31a7_4a11d951","updated":"2015-04-30 14:51:24.000000000","message":"\"admin\"-ness not properly scoped\nhttps://bugs.launchpad.net/keystone/+bug/968696","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"There is a known bug in which users with admin role on any project have"},{"line_number":78,"context_line":"unlimited admin-ness throughout the system because there is no differentiation"},{"line_number":79,"context_line":"between scoped and global admin-ness."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"New Features"},{"line_number":82,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_cd9498e3","line":79,"in_reply_to":"3acd31a7_4dc8d355","updated":"2015-05-04 18:09:24.000000000","message":"Yes we want to establish an interactive process to solve this bug in OpenStakc services by providing a powerful API which makes changes in the policies safer.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3075aa3de0bba360dd0a3ce6399688f2eae19109","unresolved":false,"context_lines":[{"line_number":101,"context_line":"proposed to create an oslo policy library which contains the essential code to"},{"line_number":102,"context_line":"enforce policy based on a Keystone token."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Once the oslo policy library is graduated, individual services should use it"},{"line_number":105,"context_line":"for policy enforcement."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Staticity"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_e4c7bb43","line":104,"updated":"2015-04-30 14:17:57.000000000","message":"already been graduated...but hadn\u0027t been when I was writing this.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":101,"context_line":"proposed to create an oslo policy library which contains the essential code to"},{"line_number":102,"context_line":"enforce policy based on a Keystone token."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Once the oslo policy library is graduated, individual services should use it"},{"line_number":105,"context_line":"for policy enforcement."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Staticity"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_0d2850e1","line":104,"in_reply_to":"3acd31a7_e4c7bb43","updated":"2015-05-04 18:09:24.000000000","message":"Done","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3075aa3de0bba360dd0a3ce6399688f2eae19109","unresolved":false,"context_lines":[{"line_number":109,"context_line":""},{"line_number":110,"context_line":"In order to remove the need of an out-of-band mechanism to customize and place"},{"line_number":111,"context_line":"the policy file in the OpenStack servers, it is proposed the use of an API to"},{"line_number":112,"context_line":"manage policies."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"The policy management API will be defined in the Keystone server and will be"},{"line_number":115,"context_line":"used by other services through Keystone Middleware and Python Client."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_64096b95","line":112,"updated":"2015-04-30 14:17:57.000000000","message":"\"We will maintain the potential for using an out of band mechanism\"","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"976a29d3fc152b10a3e19650db6b3f6ba2f4bd72","unresolved":false,"context_lines":[{"line_number":109,"context_line":""},{"line_number":110,"context_line":"In order to remove the need of an out-of-band mechanism to customize and place"},{"line_number":111,"context_line":"the policy file in the OpenStack servers, it is proposed the use of an API to"},{"line_number":112,"context_line":"manage policies."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"The policy management API will be defined in the Keystone server and will be"},{"line_number":115,"context_line":"used by other services through Keystone Middleware and Python Client."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_ead0a555","line":112,"updated":"2015-04-30 14:27:53.000000000","message":"...there already is one....","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":109,"context_line":""},{"line_number":110,"context_line":"In order to remove the need of an out-of-band mechanism to customize and place"},{"line_number":111,"context_line":"the policy file in the OpenStack servers, it is proposed the use of an API to"},{"line_number":112,"context_line":"manage policies."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"The policy management API will be defined in the Keystone server and will be"},{"line_number":115,"context_line":"used by other services through Keystone Middleware and Python Client."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_6d7d84e6","line":112,"in_reply_to":"3acd31a7_ead0a555","updated":"2015-05-04 18:09:24.000000000","message":"Yes, I am clarifying an API already exists, and what we want is to improve the policy management.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3075aa3de0bba360dd0a3ce6399688f2eae19109","unresolved":false,"context_lines":[{"line_number":114,"context_line":"The policy management API will be defined in the Keystone server and will be"},{"line_number":115,"context_line":"used by other services through Keystone Middleware and Python Client."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Incrementally, the following steps are designed to bring the new policy API:"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"* Create a database schema to hold the policy rules and use it to generate the"},{"line_number":120,"context_line":"  policy files served by Keystone;"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_a44b03b0","line":117,"updated":"2015-04-30 14:17:57.000000000","message":"THis makes it sound like they have to be done in this order.  I don\u0027t think that is true.  Much of this work can be done in parallel, and has value in and of itself.\n\nThe essential CRUD operations are there already;  fetch policy for endpoint.  We need the other APIs to help manage, but if we only had the current, policy could still be served from Keystone and enforced by the middleware.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":114,"context_line":"The policy management API will be defined in the Keystone server and will be"},{"line_number":115,"context_line":"used by other services through Keystone Middleware and Python Client."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Incrementally, the following steps are designed to bring the new policy API:"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"* Create a database schema to hold the policy rules and use it to generate the"},{"line_number":120,"context_line":"  policy files served by Keystone;"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_2d866c13","line":117,"in_reply_to":"3acd31a7_a44b03b0","updated":"2015-05-04 18:09:24.000000000","message":"Great, I am updating the description to make it clear the steps can be done in parallel.\n\nAlso, I will clarify in the second step that the basic CRUD is already implemented, and we will implement operations to help management.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3996f9548313808fe231bcd9e28878d6d23e8eef","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"* Create a database schema to hold the policy rules and use it to generate the"},{"line_number":120,"context_line":"  policy files served by Keystone;"},{"line_number":121,"context_line":"* Create the Keystone API endpoints to enable the CRUD of policies;"},{"line_number":122,"context_line":"* Add support for the new policy API on Keystone Client;"},{"line_number":123,"context_line":"* Place the enforcement logic in Keystone Middleware, which will use Keystone"},{"line_number":124,"context_line":"  Client to fetch the policy."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_fcca686d","line":121,"updated":"2015-05-04 16:27:36.000000000","message":"would the response body differ from what we have today (serialized blob)?","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3996f9548313808fe231bcd9e28878d6d23e8eef","unresolved":false,"context_lines":[{"line_number":121,"context_line":"* Create the Keystone API endpoints to enable the CRUD of policies;"},{"line_number":122,"context_line":"* Add support for the new policy API on Keystone Client;"},{"line_number":123,"context_line":"* Place the enforcement logic in Keystone Middleware, which will use Keystone"},{"line_number":124,"context_line":"  Client to fetch the policy."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Once this management mechanism is in-place, in order ease the create cross-"},{"line_number":127,"context_line":"project policy consistency, it is proposed to have a single policy file which"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_9c05b47b","line":124,"updated":"2015-05-04 16:27:36.000000000","message":"Keystonemiddleware would poll Keystone in some intervals, yes?","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":121,"context_line":"* Create the Keystone API endpoints to enable the CRUD of policies;"},{"line_number":122,"context_line":"* Add support for the new policy API on Keystone Client;"},{"line_number":123,"context_line":"* Place the enforcement logic in Keystone Middleware, which will use Keystone"},{"line_number":124,"context_line":"  Client to fetch the policy."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Once this management mechanism is in-place, in order ease the create cross-"},{"line_number":127,"context_line":"project policy consistency, it is proposed to have a single policy file which"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_2d2aec2c","line":124,"in_reply_to":"3acd31a7_9c05b47b","updated":"2015-05-04 18:09:24.000000000","message":"Basically yes, we will have a timeout to ksmiddleware check if the cache is invalid. We could also implement a timestamp updated_at for the unified policy, so the ksmiddleware can check to see if the cache is invalid.\n\nThis will be defined in details in the spec https://review.openstack.org/#/c/133480/ (which still says ksclient will enforce, I will update this).","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3075aa3de0bba360dd0a3ce6399688f2eae19109","unresolved":false,"context_lines":[{"line_number":123,"context_line":"* Place the enforcement logic in Keystone Middleware, which will use Keystone"},{"line_number":124,"context_line":"  Client to fetch the policy."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Once this management mechanism is in-place, in order ease the create cross-"},{"line_number":127,"context_line":"project policy consistency, it is proposed to have a single policy file which"},{"line_number":128,"context_line":"is a merge of the current default policy files from all of the services."},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_e4ffbb32","line":126,"updated":"2015-04-30 14:17:57.000000000","message":"THis should actually happen first, to get all of the projects aligned on the meaning of the common rules.  If all we did was this, and then used puppet to synchronize, we\u0027d still be better off.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":123,"context_line":"* Place the enforcement logic in Keystone Middleware, which will use Keystone"},{"line_number":124,"context_line":"  Client to fetch the policy."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Once this management mechanism is in-place, in order ease the create cross-"},{"line_number":127,"context_line":"project policy consistency, it is proposed to have a single policy file which"},{"line_number":128,"context_line":"is a merge of the current default policy files from all of the services."},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_52270364","line":126,"in_reply_to":"3acd31a7_e4ffbb32","updated":"2015-05-04 18:09:24.000000000","message":"I clarified we want to make the works in parallel.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"5a576a79531a02c4e32e3ddcb2185bf560f4d522","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Once this management mechanism is in-place, in order ease the create cross-"},{"line_number":127,"context_line":"project policy consistency, it is proposed to have a single policy file which"},{"line_number":128,"context_line":"is a merge of the current default policy files from all of the services."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"The new policy file define different namespaces for services to avoid"},{"line_number":131,"context_line":"conflicting rules across services and reduces duplication of rules like"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_7f40cd56","line":128,"updated":"2015-04-30 17:20:35.000000000","message":"Where would that file live in git and how would it be updated as new projects come into the ecosystem?","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Once this management mechanism is in-place, in order ease the create cross-"},{"line_number":127,"context_line":"project policy consistency, it is proposed to have a single policy file which"},{"line_number":128,"context_line":"is a merge of the current default policy files from all of the services."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"The new policy file define different namespaces for services to avoid"},{"line_number":131,"context_line":"conflicting rules across services and reduces duplication of rules like"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_322487ad","line":128,"in_reply_to":"3acd31a7_7f40cd56","updated":"2015-05-04 18:09:24.000000000","message":"This is an interesting question. We are planning to have a separate project to be the container of the unified policy file. It would live under oslo umbrella.\n\nThe advantages would be that it would be easier to keep cross-project consistency, a specialized core team looking into policy changes, etc.\n\nThere is a spec to describe details on the unified policy: \u0027unified policy file\u0027 (https://review.openstack.org/#/c/134656/)\n\nI will be updating it soon. I will copy your review there to make sure we cover all this there.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3075aa3de0bba360dd0a3ce6399688f2eae19109","unresolved":false,"context_lines":[{"line_number":127,"context_line":"project policy consistency, it is proposed to have a single policy file which"},{"line_number":128,"context_line":"is a merge of the current default policy files from all of the services."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"The new policy file define different namespaces for services to avoid"},{"line_number":131,"context_line":"conflicting rules across services and reduces duplication of rules like"},{"line_number":132,"context_line":"\"admin_or_owner\" to have a consistent catalog of permissions across OpenStack."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_048ab7bf","line":130,"updated":"2015-04-30 14:17:57.000000000","message":"this is not new.  Namespace is an existing mechanism.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":127,"context_line":"project policy consistency, it is proposed to have a single policy file which"},{"line_number":128,"context_line":"is a merge of the current default policy files from all of the services."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"The new policy file define different namespaces for services to avoid"},{"line_number":131,"context_line":"conflicting rules across services and reduces duplication of rules like"},{"line_number":132,"context_line":"\"admin_or_owner\" to have a consistent catalog of permissions across OpenStack."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_32d37206","line":130,"in_reply_to":"3acd31a7_048ab7bf","updated":"2015-05-04 18:09:24.000000000","message":"Done","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"739a4084de664ae78efe224b02abc2e10429c561","unresolved":false,"context_lines":[{"line_number":138,"context_line":""},{"line_number":139,"context_line":"In order to delegate cleanly and solve the problem in which a user would be"},{"line_number":140,"context_line":"able to delegate a higher role to someone else, large roles should be broken"},{"line_number":141,"context_line":"apart the permissions that compose them and users should be able to delegate"},{"line_number":142,"context_line":"only a subset of their permissions. This will result in a role hierarchy."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"Tokens should reflect only this subset of permissions, but should not"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_4c2411ae","line":141,"updated":"2015-05-04 15:04:18.000000000","message":"I think this is a really important feature, but the sentence needs to be clarified.  I\u0027d suggest:\ns/broken apart the permissions that compose them and users should be able to delegate only a subset of their permissions/broken apart.  Users should be able to delegate only a subset of their permissions by selecting one or more of these specific, more narrowly defined roles./","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":138,"context_line":""},{"line_number":139,"context_line":"In order to delegate cleanly and solve the problem in which a user would be"},{"line_number":140,"context_line":"able to delegate a higher role to someone else, large roles should be broken"},{"line_number":141,"context_line":"apart the permissions that compose them and users should be able to delegate"},{"line_number":142,"context_line":"only a subset of their permissions. This will result in a role hierarchy."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"Tokens should reflect only this subset of permissions, but should not"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_4fb76086","line":141,"in_reply_to":"3acd31a7_4c2411ae","updated":"2015-05-04 18:09:24.000000000","message":"Agreed, thanks","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3996f9548313808fe231bcd9e28878d6d23e8eef","unresolved":false,"context_lines":[{"line_number":152,"context_line":"* Update Keystone Middleware enforcement logic to consider the role hierarchies"},{"line_number":153,"context_line":"  when enforcing policy rules."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Note that any change on the role hierarchy will be automatically be reflected"},{"line_number":156,"context_line":"in policy enforcement, since it changes the roles section of the token."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Global Admin Bug"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_7c93f84f","line":155,"updated":"2015-05-04 16:27:36.000000000","message":"you can remove one of the \u0027be\u0027s","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":152,"context_line":"* Update Keystone Middleware enforcement logic to consider the role hierarchies"},{"line_number":153,"context_line":"  when enforcing policy rules."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Note that any change on the role hierarchy will be automatically be reflected"},{"line_number":156,"context_line":"in policy enforcement, since it changes the roles section of the token."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Global Admin Bug"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_4fff6067","line":155,"in_reply_to":"3acd31a7_7c93f84f","updated":"2015-05-04 18:09:24.000000000","message":"Done","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3075aa3de0bba360dd0a3ce6399688f2eae19109","unresolved":false,"context_lines":[{"line_number":243,"context_line":""},{"line_number":244,"context_line":"Other contributors:"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"* Samuel de Medeiros Queiroz (samueldmq) - samuel@lsd.ufcg.edu.br"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"Work Items"},{"line_number":249,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_e4745bd0","line":246,"updated":"2015-04-30 14:17:57.000000000","message":"Add in Ioram and David8hu, please.","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"c96917c4bb1737e2c8ceedffe89c5404f6c45e02","unresolved":false,"context_lines":[{"line_number":243,"context_line":""},{"line_number":244,"context_line":"Other contributors:"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"* Samuel de Medeiros Queiroz (samueldmq) - samuel@lsd.ufcg.edu.br"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"Work Items"},{"line_number":249,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3acd31a7_74aa2fd6","line":246,"in_reply_to":"3acd31a7_e4745bd0","updated":"2015-05-04 18:09:24.000000000","message":"Done","commit_id":"44425bdb8377eb5fc2c31686c5fd9a6adc4bf4ec"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"996f6ba314399440b66c6d0ca39ae4663b09f85b","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Resources include VMs, volumes, networks, etc and are organized into projects,"},{"line_number":19,"context_line":"which are owned by domains. Users have roles assigned on domains or projects."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Users get scoped token on domains or projects, which contains the roles the"},{"line_number":22,"context_line":"user has assigned on them, and pass this token along to services in requests to"},{"line_number":23,"context_line":"perform actions on resources."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_07f829c2","line":21,"updated":"2015-05-28 22:48:59.000000000","message":"first three paragraphs are an outstanding overview. Great job!","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"996f6ba314399440b66c6d0ca39ae4663b09f85b","unresolved":false,"context_lines":[{"line_number":22,"context_line":"user has assigned on them, and pass this token along to services in requests to"},{"line_number":23,"context_line":"perform actions on resources."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The service check the roles in the token against the rules defined for the"},{"line_number":26,"context_line":"requested action on the policy.json file to define if the user has enough"},{"line_number":27,"context_line":"privilegies."},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_c7fd71b2","line":25,"updated":"2015-05-28 22:48:59.000000000","message":"nit: check should be checks","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"996f6ba314399440b66c6d0ca39ae4663b09f85b","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The service check the roles in the token against the rules defined for the"},{"line_number":26,"context_line":"requested action on the policy.json file to define if the user has enough"},{"line_number":27,"context_line":"privilegies."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This authorization architecture is in-place since the project inception and has"},{"line_number":30,"context_line":"some known limitations as code duplication, staticity, delegation and hardness"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_a7d4b51f","line":27,"updated":"2015-05-28 22:48:59.000000000","message":"nit: typo privilegies should be privileges","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"996f6ba314399440b66c6d0ca39ae4663b09f85b","unresolved":false,"context_lines":[{"line_number":26,"context_line":"requested action on the policy.json file to define if the user has enough"},{"line_number":27,"context_line":"privilegies."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This authorization architecture is in-place since the project inception and has"},{"line_number":30,"context_line":"some known limitations as code duplication, staticity, delegation and hardness"},{"line_number":31,"context_line":"to solve the long-standing global admin bug and to include new features."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_27d0c51e","line":29,"updated":"2015-05-28 22:48:59.000000000","message":"typo: \"is\" should be \"has been\"","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"996f6ba314399440b66c6d0ca39ae4663b09f85b","unresolved":false,"context_lines":[{"line_number":27,"context_line":"privilegies."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This authorization architecture is in-place since the project inception and has"},{"line_number":30,"context_line":"some known limitations as code duplication, staticity, delegation and hardness"},{"line_number":31,"context_line":"to solve the long-standing global admin bug and to include new features."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This specification gives an overview of the new concept being introduced to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_67ad9d83","line":30,"updated":"2015-05-28 22:48:59.000000000","message":"what do you mean by \"hardness to solve\" ? Do you mean \"inability to solve the long-standing global admin bug\n\nAlso, any chance you have a bug reference for the global admin bug?  Or as an alternative just mention this is more thoroughly described below.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3011759173eed8c31d31f0827c9faffd487763c3","unresolved":false,"context_lines":[{"line_number":27,"context_line":"privilegies."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This authorization architecture is in-place since the project inception and has"},{"line_number":30,"context_line":"some known limitations as code duplication, staticity, delegation and hardness"},{"line_number":31,"context_line":"to solve the long-standing global admin bug and to include new features."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This specification gives an overview of the new concept being introduced to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_b8005302","line":30,"in_reply_to":"7a016987_67ad9d83","updated":"2015-05-29 01:41:07.000000000","message":"But 968696.  Chant the mantra","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"145f4648df2f88a272c3ed820524405f3ff25225","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This authorization architecture is in-place since the project inception and has"},{"line_number":30,"context_line":"some known limitations as code duplication, staticity, delegation and hardness"},{"line_number":31,"context_line":"to solve the long-standing global admin bug and to include new features."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This specification gives an overview of the new concept being introduced to"},{"line_number":34,"context_line":"solve those known limitations: Dynamic Policy. A set of specs will be"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5afe65bd_5f9dea57","line":31,"updated":"2015-06-03 19:43:53.000000000","message":"The global admin bug can be addressed today through better policy.json definition.  In order to solve this from the get go, we need a better default for unified policy.  A policy that separates service admins.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"996f6ba314399440b66c6d0ca39ae4663b09f85b","unresolved":false,"context_lines":[{"line_number":39,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"The problems addressed in this spec are the known limitations on the current"},{"line_number":42,"context_line":"policy architecture: code duplication, staticity, delegation and hardness to"},{"line_number":43,"context_line":"solve the long-standing global admin bug and to include new features."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Code Duplication"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_07d029f5","line":42,"updated":"2015-05-28 22:48:59.000000000","message":"Similar comments as above since this is the same text","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"7a341c57552af62b0b7d3bdeface2a2d63f33d95","unresolved":false,"context_lines":[{"line_number":59,"context_line":"This requires the use of an out-of-band mechanism to customize and place the"},{"line_number":60,"context_line":"policy file in the service respective server. In addition, this leads to cross-"},{"line_number":61,"context_line":"project inconsistency across global roles like admin and owner."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Delegation"},{"line_number":64,"context_line":"----------"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_2b187274","line":62,"updated":"2015-05-20 21:06:27.000000000","message":"Please expand what you mean by inconsistency. The fact that one role e.g. admin, can have different permissions on different services, is not inconsistent, but simply means that different permissions are appropropriate. In fact it would be rather strange if one global role had the same permissions on every OpenStack service.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3011759173eed8c31d31f0827c9faffd487763c3","unresolved":false,"context_lines":[{"line_number":59,"context_line":"This requires the use of an out-of-band mechanism to customize and place the"},{"line_number":60,"context_line":"policy file in the service respective server. In addition, this leads to cross-"},{"line_number":61,"context_line":"project inconsistency across global roles like admin and owner."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Delegation"},{"line_number":64,"context_line":"----------"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_580b9f24","line":62,"in_reply_to":"7a016987_2b187274","updated":"2015-05-29 01:41:07.000000000","message":"Take a look tat the actual policy files.  Things like the definition of \"owner\" are all over the place, and mean different things.  people are not sure how to write policy, so several of the projects have definied policy rules that essentially say \"let anyone do anything\"","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"6dbbca863c36cf132b4b74e6af0b95ef5ac397ca","unresolved":false,"context_lines":[{"line_number":59,"context_line":"This requires the use of an out-of-band mechanism to customize and place the"},{"line_number":60,"context_line":"policy file in the service respective server. In addition, this leads to cross-"},{"line_number":61,"context_line":"project inconsistency across global roles like admin and owner."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Delegation"},{"line_number":64,"context_line":"----------"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5afe65bd_9d8f3723","line":62,"in_reply_to":"7a016987_580b9f24","updated":"2015-06-02 12:16:54.000000000","message":"I\u0027m not sure projects no knowing how to write policy is going to be solved out of band. They\u0027ll still need check points correctly.\n\nI\u0027d suggest specific examples of bad policy should be referenced here.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"7a341c57552af62b0b7d3bdeface2a2d63f33d95","unresolved":false,"context_lines":[{"line_number":61,"context_line":"project inconsistency across global roles like admin and owner."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Delegation"},{"line_number":64,"context_line":"----------"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"The existing mechanisms of delegation are based on trusting someone to act on"},{"line_number":67,"context_line":"your behalf or simply granting new role assignments."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_cb6b1eb8","line":64,"updated":"2015-05-20 21:06:27.000000000","message":"Title should be Delegation Bug","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"7a341c57552af62b0b7d3bdeface2a2d63f33d95","unresolved":false,"context_lines":[{"line_number":69,"context_line":"When assigning roles, since there is no relationship between them, a user with"},{"line_number":70,"context_line":"a more restrictive role assignment could grant someone else a less restrictive"},{"line_number":71,"context_line":"role assignment. For example, a member would be able to grant admin"},{"line_number":72,"context_line":"privilegies."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Global Admin Bug"},{"line_number":75,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_0b76d6a3","line":72,"updated":"2015-05-20 21:06:27.000000000","message":"This is a bug in delegation which should be fixed regardless of dynamic policies","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3011759173eed8c31d31f0827c9faffd487763c3","unresolved":false,"context_lines":[{"line_number":69,"context_line":"When assigning roles, since there is no relationship between them, a user with"},{"line_number":70,"context_line":"a more restrictive role assignment could grant someone else a less restrictive"},{"line_number":71,"context_line":"role assignment. For example, a member would be able to grant admin"},{"line_number":72,"context_line":"privilegies."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Global Admin Bug"},{"line_number":75,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_1812c757","line":72,"in_reply_to":"7a016987_0b76d6a3","updated":"2015-05-29 01:41:07.000000000","message":"But we can\u0027t with out the rest of the fixes, specially y hierarchical roles.  This is an overview spec trying to explain why we have the rest of the specs.  The deatils should be more fully explained in the subordinate specs.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c733f78850a6bade59ffbfc216636d8e523b9fb2","unresolved":false,"context_lines":[{"line_number":70,"context_line":"a more restrictive role assignment could grant someone else a less restrictive"},{"line_number":71,"context_line":"role assignment. For example, a member would be able to grant admin"},{"line_number":72,"context_line":"privilegies."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Global Admin Bug"},{"line_number":75,"context_line":"----------------"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5afe65bd_8b9d6d5b","line":73,"updated":"2015-06-03 16:15:55.000000000","message":"s/privilegies/privileges/","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"996f6ba314399440b66c6d0ca39ae4663b09f85b","unresolved":false,"context_lines":[{"line_number":74,"context_line":"Global Admin Bug"},{"line_number":75,"context_line":"----------------"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"There is a known bug in which users with admin role on any project have"},{"line_number":78,"context_line":"unlimited admin-ness throughout the system because there is no differentiation"},{"line_number":79,"context_line":"between scoped and global admin-ness."},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_0725c907","line":77,"updated":"2015-05-28 22:48:59.000000000","message":"OK. Great to see you describe this here. So if you don\u0027t have a bug reference for this the description here is good enough","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"7a341c57552af62b0b7d3bdeface2a2d63f33d95","unresolved":false,"context_lines":[{"line_number":77,"context_line":"There is a known bug in which users with admin role on any project have"},{"line_number":78,"context_line":"unlimited admin-ness throughout the system because there is no differentiation"},{"line_number":79,"context_line":"between scoped and global admin-ness."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"New Features"},{"line_number":82,"context_line":"------------"},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_6bae6ae7","line":80,"updated":"2015-05-20 21:06:27.000000000","message":"Cant this simply be fixed now by creating a bunch of different admin roles?","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3011759173eed8c31d31f0827c9faffd487763c3","unresolved":false,"context_lines":[{"line_number":77,"context_line":"There is a known bug in which users with admin role on any project have"},{"line_number":78,"context_line":"unlimited admin-ness throughout the system because there is no differentiation"},{"line_number":79,"context_line":"between scoped and global admin-ness."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"New Features"},{"line_number":82,"context_line":"------------"},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_982c779a","line":80,"in_reply_to":"7a016987_6bae6ae7","updated":"2015-05-29 01:41:07.000000000","message":"The checks need to also enforce the scope of the token matches the scope of the resopurce; the rules do not match scope.  Additional roles won\u0027t help.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"996f6ba314399440b66c6d0ca39ae4663b09f85b","unresolved":false,"context_lines":[{"line_number":91,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Dynamic Policy is a new concept which aims to make the access control dynamic"},{"line_number":94,"context_line":"for OpenStack deployments, this means that API changes on the policy management"},{"line_number":95,"context_line":"server affect the enforcement on individual services."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Code Duplication"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_87f4195b","line":94,"updated":"2015-05-28 22:48:59.000000000","message":"why do you say API changes on the policy management server. Isnt it really changes to the policy itself (dynamically) that affect enforcement and those changes would occur via API invocations?","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3011759173eed8c31d31f0827c9faffd487763c3","unresolved":false,"context_lines":[{"line_number":91,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Dynamic Policy is a new concept which aims to make the access control dynamic"},{"line_number":94,"context_line":"for OpenStack deployments, this means that API changes on the policy management"},{"line_number":95,"context_line":"server affect the enforcement on individual services."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Code Duplication"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_383c63c7","line":94,"in_reply_to":"7a016987_87f4195b","updated":"2015-05-29 01:41:07.000000000","message":"We need changes on the server, too.  Default policy for an endpoint for example.  The ability to define hierarchcial roles for another.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"7a341c57552af62b0b7d3bdeface2a2d63f33d95","unresolved":false,"context_lines":[{"line_number":119,"context_line":"be represented by the following steps:"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* Create a database schema to hold the policy rules and use it to generate the"},{"line_number":122,"context_line":"  policy files served by Keystone;"},{"line_number":123,"context_line":"* Improve the Keystone API to provide a better policy management;"},{"line_number":124,"context_line":"* Add support for the new policy API on Keystone Client;"},{"line_number":125,"context_line":"* Place the enforcement logic in Keystone Middleware, which will use Keystone"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_8871a946","line":122,"updated":"2015-05-20 21:06:27.000000000","message":"A spec for this already exists at \n\nhttps://review.openstack.org/#/c/133814/","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3011759173eed8c31d31f0827c9faffd487763c3","unresolved":false,"context_lines":[{"line_number":119,"context_line":"be represented by the following steps:"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* Create a database schema to hold the policy rules and use it to generate the"},{"line_number":122,"context_line":"  policy files served by Keystone;"},{"line_number":123,"context_line":"* Improve the Keystone API to provide a better policy management;"},{"line_number":124,"context_line":"* Add support for the new policy API on Keystone Client;"},{"line_number":125,"context_line":"* Place the enforcement logic in Keystone Middleware, which will use Keystone"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_f8312bee","line":122,"in_reply_to":"7a016987_8871a946","updated":"2015-05-29 01:41:07.000000000","message":"THis is an over view, referenceing the other specs.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"7a341c57552af62b0b7d3bdeface2a2d63f33d95","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* Create a database schema to hold the policy rules and use it to generate the"},{"line_number":122,"context_line":"  policy files served by Keystone;"},{"line_number":123,"context_line":"* Improve the Keystone API to provide a better policy management;"},{"line_number":124,"context_line":"* Add support for the new policy API on Keystone Client;"},{"line_number":125,"context_line":"* Place the enforcement logic in Keystone Middleware, which will use Keystone"},{"line_number":126,"context_line":"  Client to fetch the policy."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_2897553b","line":123,"updated":"2015-05-20 21:06:27.000000000","message":"A draft for this will be published this week","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3011759173eed8c31d31f0827c9faffd487763c3","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* Create a database schema to hold the policy rules and use it to generate the"},{"line_number":122,"context_line":"  policy files served by Keystone;"},{"line_number":123,"context_line":"* Improve the Keystone API to provide a better policy management;"},{"line_number":124,"context_line":"* Add support for the new policy API on Keystone Client;"},{"line_number":125,"context_line":"* Place the enforcement logic in Keystone Middleware, which will use Keystone"},{"line_number":126,"context_line":"  Client to fetch the policy."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_b84e136d","line":123,"in_reply_to":"7a016987_2897553b","updated":"2015-05-29 01:41:07.000000000","message":"We don\u0027t need to update this over view when it is published, as the concepts will not radically change.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"8a9b3d7c9e55295608351c1c9ee1f1864b6ca3d9","unresolved":false,"context_lines":[{"line_number":125,"context_line":"* Place the enforcement logic in Keystone Middleware, which will use Keystone"},{"line_number":126,"context_line":"  Client to fetch the policy."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"In parallel to the work to get this management mechanism in-place, in order"},{"line_number":129,"context_line":"ease the create cross-project policy consistency, it is proposed to have a"},{"line_number":130,"context_line":"single policy file which is a merge of the current default policy files from"},{"line_number":131,"context_line":"all of the services."}],"source_content_type":"text/x-rst","patch_set":5,"id":"3afb71cf_7b80358b","line":128,"updated":"2015-06-11 09:50:55.000000000","message":"in order to","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"7a341c57552af62b0b7d3bdeface2a2d63f33d95","unresolved":false,"context_lines":[{"line_number":132,"context_line":""},{"line_number":133,"context_line":"The new policy file will reduce the duplication of rules like \"admin_or_owner\""},{"line_number":134,"context_line":"to have a consistent catalog of permissions across OpenStack."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"At last, a script will be used to upload the global policy file using the new"},{"line_number":137,"context_line":"API."},{"line_number":138,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_28e515db","line":135,"updated":"2015-05-20 21:06:27.000000000","message":"This is mixing up two concepts\n\ni) rules like admin or owner indicate the need for role hierarchies and a new subordinate role which has the intersection of privileges of the two superior roles\n\nii) consistent permissions is a misnomer since a permission is an action on a resource, Different resources will therefore by definition have different permissions. Perhaps what you really mean is consistent actions?","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3011759173eed8c31d31f0827c9faffd487763c3","unresolved":false,"context_lines":[{"line_number":132,"context_line":""},{"line_number":133,"context_line":"The new policy file will reduce the duplication of rules like \"admin_or_owner\""},{"line_number":134,"context_line":"to have a consistent catalog of permissions across OpenStack."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"At last, a script will be used to upload the global policy file using the new"},{"line_number":137,"context_line":"API."},{"line_number":138,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_78541bfd","line":135,"in_reply_to":"7a016987_28e515db","updated":"2015-05-29 01:41:07.000000000","message":"this is  specifying the cleanup of the policy files, not a new capability.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"8a9b3d7c9e55295608351c1c9ee1f1864b6ca3d9","unresolved":false,"context_lines":[{"line_number":134,"context_line":"to have a consistent catalog of permissions across OpenStack."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"At last, a script will be used to upload the global policy file using the new"},{"line_number":137,"context_line":"API."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Delegation"},{"line_number":140,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3afb71cf_06efa81e","line":137,"updated":"2015-06-11 09:50:55.000000000","message":"What\u0027s kind of scripts? maybe we can use keystone-manage to handle it, just like PKI setup or fernet token stuff. Is this what you meant?","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"996f6ba314399440b66c6d0ca39ae4663b09f85b","unresolved":false,"context_lines":[{"line_number":140,"context_line":"----------"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"In order to delegate cleanly and solve the problem in which a user would be"},{"line_number":143,"context_line":"able to delegate a higher role to someone else, large roles should be broken"},{"line_number":144,"context_line":"apart. Users should be able to delegate only a subset of their permissions by"},{"line_number":145,"context_line":"selecting one or more of these specific, more narrowly defined roles. This will"},{"line_number":146,"context_line":"result in a role hierarchy."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_27b20595","line":143,"updated":"2015-05-28 22:48:59.000000000","message":"Nioe description!","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"996f6ba314399440b66c6d0ca39ae4663b09f85b","unresolved":false,"context_lines":[{"line_number":154,"context_line":"* Create the API on Keystone server for creating and managing role hierarchies;"},{"line_number":155,"context_line":"* Support this new API on Keystone Client;"},{"line_number":156,"context_line":"* Update Keystone Middleware enforcement logic to consider the role hierarchies"},{"line_number":157,"context_line":"  when enforcing policy rules."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Note that any change on the role hierarchy will be automatically reflected in"},{"line_number":160,"context_line":"policy enforcement, since it changes the roles section of the token."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_2779e5c8","line":157,"updated":"2015-05-28 22:48:59.000000000","message":"These three feel like a lot of work","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3011759173eed8c31d31f0827c9faffd487763c3","unresolved":false,"context_lines":[{"line_number":154,"context_line":"* Create the API on Keystone server for creating and managing role hierarchies;"},{"line_number":155,"context_line":"* Support this new API on Keystone Client;"},{"line_number":156,"context_line":"* Update Keystone Middleware enforcement logic to consider the role hierarchies"},{"line_number":157,"context_line":"  when enforcing policy rules."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Note that any change on the role hierarchy will be automatically reflected in"},{"line_number":160,"context_line":"policy enforcement, since it changes the roles section of the token."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_58595f34","line":157,"in_reply_to":"7a016987_2779e5c8","updated":"2015-05-29 01:41:07.000000000","message":"That is why they have their own specs","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"7a341c57552af62b0b7d3bdeface2a2d63f33d95","unresolved":false,"context_lines":[{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Establish an iterative process to solve the long-standing bug that a user with"},{"line_number":166,"context_line":"admin on any scope has admin on all scoped."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"New Features"},{"line_number":169,"context_line":"------------"},{"line_number":170,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_88ed29b9","line":167,"updated":"2015-05-20 21:06:27.000000000","message":"How is this not solved by simply creating a set of different admin roles?","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"9079a4ee41a8fb224a1bc301a3eb1329c7d58e02","unresolved":false,"context_lines":[{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Establish an iterative process to solve the long-standing bug that a user with"},{"line_number":166,"context_line":"admin on any scope has admin on all scoped."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"New Features"},{"line_number":169,"context_line":"------------"},{"line_number":170,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_79d7ef23","line":167,"in_reply_to":"7a016987_88ed29b9","updated":"2015-05-28 13:25:59.000000000","message":"We can\u0027t change the defaults without breaking people depending on the existing defaults.  We need to make it a process to get to the better set of admin roles.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"c733f78850a6bade59ffbfc216636d8e523b9fb2","unresolved":false,"context_lines":[{"line_number":165,"context_line":"Establish an iterative process to solve the long-standing bug that a user with"},{"line_number":166,"context_line":"admin on any scope has admin on all scoped."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"New Features"},{"line_number":169,"context_line":"------------"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"The new policy architecture described above introduces a much more powerful,"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5afe65bd_aba02944","line":168,"updated":"2015-06-03 16:15:55.000000000","message":"It would be good to add a sentence or two with possible migration steps that would mitigate this issue.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"7a341c57552af62b0b7d3bdeface2a2d63f33d95","unresolved":false,"context_lines":[{"line_number":207,"context_line":"Dynamic Policy should have little impact on the normal function of OpenStack"},{"line_number":208,"context_line":"process, both inside and outside Keystone."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"The size of policy rule files will increase, but the changes should be minimal."},{"line_number":211,"context_line":"There is always the possibility that the management of the policy rules in the"},{"line_number":212,"context_line":"database will have some hidden complexity, but managing these should be a very"},{"line_number":213,"context_line":"rare operation."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a016987_085db978","line":210,"updated":"2015-05-20 21:06:27.000000000","message":"Given that each OpenStack service represents a different resource, and a permission is an action on a resource, there is nothing to be gained (and everything to loose wrt performance) by giving one huge policy file to each service. It is surely better to only send the relevant policy rules to each service, as is done now with the current policy files, rather than to send a complete policy file that will contain lots of useless rules that can never be activated","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0c492fac370924097c6385e4f1b528fbc8cc9a74","unresolved":false,"context_lines":[{"line_number":207,"context_line":"Dynamic Policy should have little impact on the normal function of OpenStack"},{"line_number":208,"context_line":"process, both inside and outside Keystone."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"The size of policy rule files will increase, but the changes should be minimal."},{"line_number":211,"context_line":"There is always the possibility that the management of the policy rules in the"},{"line_number":212,"context_line":"database will have some hidden complexity, but managing these should be a very"},{"line_number":213,"context_line":"rare operation."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5afe65bd_e902b208","line":210,"in_reply_to":"7a016987_085db978","updated":"2015-06-03 13:52:13.000000000","message":"Yeah, that is true.  What we want is a unified deinfitions of roles, and common mechanisms, applied across all services.  the unified policy file just seems like the right first step to getting there.  It is based on input from Dolph that the policy was designed to keep the rules eparate for each service.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"6dbbca863c36cf132b4b74e6af0b95ef5ac397ca","unresolved":false,"context_lines":[{"line_number":210,"context_line":"The size of policy rule files will increase, but the changes should be minimal."},{"line_number":211,"context_line":"There is always the possibility that the management of the policy rules in the"},{"line_number":212,"context_line":"database will have some hidden complexity, but managing these should be a very"},{"line_number":213,"context_line":"rare operation."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"Other Deployer Impact"},{"line_number":216,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5afe65bd_3db963ea","line":213,"updated":"2015-06-02 12:16:54.000000000","message":"I actually don\u0027t understand how this doesn\u0027t have a performance impact. Today policy is checked locally against data that\u0027s on the server. In the future the policy check is going to require interaction with Keystone. That might be cachable content, however there is still a revocation concern here, which means the cache has to be punchable. Which means some kind of active channel from Keystone back to services.\n\nI think the expected flow of data and call path need to be sorted before moving forward on this.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0c492fac370924097c6385e4f1b528fbc8cc9a74","unresolved":false,"context_lines":[{"line_number":210,"context_line":"The size of policy rule files will increase, but the changes should be minimal."},{"line_number":211,"context_line":"There is always the possibility that the management of the policy rules in the"},{"line_number":212,"context_line":"database will have some hidden complexity, but managing these should be a very"},{"line_number":213,"context_line":"rare operation."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"Other Deployer Impact"},{"line_number":216,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5afe65bd_ee34f8fb","line":213,"in_reply_to":"5afe65bd_3db963ea","updated":"2015-06-03 13:52:13.000000000","message":"Policy will still be checked in the Service endpoints, just that the policy file will be fetched and cached by a plugin to the oslo.policy engine.  The fetching will happen infrequently enough to not hamper the regular flow of operations, and I would expect changes to be infrequent enough that the policy file should rarely change.  We do need to make sure we don\u0027t have a stampeding herd when policy does change.","commit_id":"d089023f22324b5d92b411c6447d05d652cfe10e"}]}