)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Tokens with subsets of roles or endpoints"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Request at token with a subset of the roles or endpoints that would"},{"line_number":10,"context_line":"otherwise be assigned."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I25d77c63568e6b3b095d2d234d29f83300a30815"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"5afe65bd_eb777cd2","line":9,"updated":"2015-06-02 14:38:14.000000000","message":"than?","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"4d5ee599e51a645f47cbe34ff5629d0e0e488c50","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Tokens with subsets of roles or endpoints"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Request at token with a subset of the roles or endpoints that would"},{"line_number":10,"context_line":"otherwise be assigned."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I25d77c63568e6b3b095d2d234d29f83300a30815"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"3afb71cf_4baf6b94","line":9,"in_reply_to":"5afe65bd_eb777cd2","updated":"2017-10-07 02:41:52.000000000","message":"I thin \u0027that\u0027 is more correct. \" ... a subset of the roles that would otherwise...\"","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Tokens with subsets of roles or endpoints"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Request at token with a subset of the roles or endpoints that would"},{"line_number":10,"context_line":"otherwise be assigned."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I25d77c63568e6b3b095d2d234d29f83300a30815"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"5afe65bd_8ba7e84e","line":10,"updated":"2015-06-02 14:38:14.000000000","message":"a token","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"}],"api/v3/identity-api-v3.rst":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":1824,"context_line":""},{"line_number":1825,"context_line":"*New in version 3.5* A user may explicitly request a token with only a subset"},{"line_number":1826,"context_line":"of the roles the user is assigned.  If the user does not specify, all"},{"line_number":1827,"context_line":"explicitly assigend roles are contained with in the token.  A subset of the"},{"line_number":1828,"context_line":"roles may be requested by specifying by an array of  ``roles`` in the the"},{"line_number":1829,"context_line":"``scope`` dictionary.  The Roles only may be specified by name, not by id."},{"line_number":1830,"context_line":"Example of requesting a project scoped token with only the Member role:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_eb953c40","line":1827,"updated":"2015-06-02 14:38:14.000000000","message":"assigned","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":1826,"context_line":"of the roles the user is assigned.  If the user does not specify, all"},{"line_number":1827,"context_line":"explicitly assigend roles are contained with in the token.  A subset of the"},{"line_number":1828,"context_line":"roles may be requested by specifying by an array of  ``roles`` in the the"},{"line_number":1829,"context_line":"``scope`` dictionary.  The Roles only may be specified by name, not by id."},{"line_number":1830,"context_line":"Example of requesting a project scoped token with only the Member role:"},{"line_number":1831,"context_line":""},{"line_number":1832,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_6b882c23","line":1829,"updated":"2015-06-02 14:38:14.000000000","message":"roles","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":2066,"context_line":""},{"line_number":2067,"context_line":"*New in version 3.5* A user may explicitly request a token with only a subset"},{"line_number":2068,"context_line":"of the endpoints associated with the project.  If the user does not specify,"},{"line_number":2069,"context_line":"all explicitly assigned endpoints are contained with in the token.  A subset"},{"line_number":2070,"context_line":"of the endpoints may be requested by specifying by an array of"},{"line_number":2071,"context_line":"``endpoint_ids`` or by specifying an array of ``endpoint_urls``in the the"},{"line_number":2072,"context_line":"``scope`` dictionary. A user may also limit the token containing endpoints of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_6bb6ecdd","line":2069,"updated":"2015-06-02 14:38:14.000000000","message":"What is an explicitly assigned endpoint? The won\u0027t have all possible endpoints in their token right?","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"4f7602d594ec4c0b0d6f429f92c7fd55c80fd644","unresolved":false,"context_lines":[{"line_number":2066,"context_line":""},{"line_number":2067,"context_line":"*New in version 3.5* A user may explicitly request a token with only a subset"},{"line_number":2068,"context_line":"of the endpoints associated with the project.  If the user does not specify,"},{"line_number":2069,"context_line":"all explicitly assigned endpoints are contained with in the token.  A subset"},{"line_number":2070,"context_line":"of the endpoints may be requested by specifying by an array of"},{"line_number":2071,"context_line":"``endpoint_ids`` or by specifying an array of ``endpoint_urls``in the the"},{"line_number":2072,"context_line":"``scope`` dictionary. A user may also limit the token containing endpoints of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_4b5c0bed","line":2069,"in_reply_to":"5afe65bd_6bb6ecdd","updated":"2015-06-08 21:59:02.000000000","message":"There is the endpoint filter extension which just became / is becoming core.  I don\u0027t want to have to explain that here, though.","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":2071,"context_line":"``endpoint_ids`` or by specifying an array of ``endpoint_urls``in the the"},{"line_number":2072,"context_line":"``scope`` dictionary. A user may also limit the token containing endpoints of"},{"line_number":2073,"context_line":"a specified service. A subset of the services may be requested by specifying"},{"line_number":2074,"context_line":"by an array of ``service_iuds`` or an array of ``service_types`` in the the"},{"line_number":2075,"context_line":"``scope`` dictionary.  These methods are additive;  If multiple options are"},{"line_number":2076,"context_line":"specified specified, all endpoints in the token are required to meet all"},{"line_number":2077,"context_line":"criteria."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_0b03f874","line":2074,"updated":"2015-06-02 14:38:14.000000000","message":"service_ids","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":2102,"context_line":"        }"},{"line_number":2103,"context_line":"    }"},{"line_number":2104,"context_line":""},{"line_number":2105,"context_line":"Example of requesting a project scoped token with two endpoints by url:"},{"line_number":2106,"context_line":""},{"line_number":2107,"context_line":"::"},{"line_number":2108,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_ab4984d2","line":2105,"updated":"2015-06-02 14:38:14.000000000","message":"three","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":2130,"context_line":"        }"},{"line_number":2131,"context_line":"    }"},{"line_number":2132,"context_line":""},{"line_number":2133,"context_line":"Example of requesting a project scoped token with three service types :"},{"line_number":2134,"context_line":""},{"line_number":2135,"context_line":"::"},{"line_number":2136,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_8b1da8bf","line":2133,"updated":"2015-06-02 14:38:14.000000000","message":"space after \u0027types\u0027","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":2159,"context_line":"    }"},{"line_number":2160,"context_line":""},{"line_number":2161,"context_line":""},{"line_number":2162,"context_line":"Example of requesting a project scoped token with three service_ids :"},{"line_number":2163,"context_line":""},{"line_number":2164,"context_line":"::"},{"line_number":2165,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_4b7e90e5","line":2162,"updated":"2015-06-02 14:38:14.000000000","message":"space after service_ids","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bb5cc8f625be688b6c47d048f58e83439a976541","unresolved":false,"context_lines":[{"line_number":1822,"context_line":"behave the same as a token request with no scope, where the user has no"},{"line_number":1823,"context_line":"default project defined."},{"line_number":1824,"context_line":""},{"line_number":1825,"context_line":"*New in version 3.5* A user may explicitly request a token with only a subset"},{"line_number":1826,"context_line":"of the roles the user is assigned.  If the user does not specify, all"},{"line_number":1827,"context_line":"explicitly assignd roles are contained with in the token.  A subset of the"},{"line_number":1828,"context_line":"roles may be requested by specifying by an array of  ``roles`` in the the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a7e1126_d67271ad","line":1825,"range":{"start_line":1825,"start_character":17,"end_line":1825,"end_character":18},"updated":"2015-12-17 01:03:01.000000000","message":"3.4 or 3.5? See line 15 above.","commit_id":"901ed59193e7126e46dad4ae798ac2c3b6edddee"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bb5cc8f625be688b6c47d048f58e83439a976541","unresolved":false,"context_lines":[{"line_number":1827,"context_line":"explicitly assignd roles are contained with in the token.  A subset of the"},{"line_number":1828,"context_line":"roles may be requested by specifying by an array of  ``roles`` in the the"},{"line_number":1829,"context_line":"``scope`` dictionary.  The roles only may be specified by name, not by id."},{"line_number":1830,"context_line":"Example of requesting a project scoped token with only the Member role:"},{"line_number":1831,"context_line":""},{"line_number":1832,"context_line":"::"},{"line_number":1833,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a7e1126_f6b9aded","line":1830,"range":{"start_line":1830,"start_character":70,"end_line":1830,"end_character":71},"updated":"2015-12-17 01:03:01.000000000","message":"What happen if user requested rules he doesn\u0027t have? Would that constitute auth failure, or silently ignored?","commit_id":"901ed59193e7126e46dad4ae798ac2c3b6edddee"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"105b3664147d21471de2b2afbb8afc1513397334","unresolved":false,"context_lines":[{"line_number":1827,"context_line":"explicitly assignd roles are contained with in the token.  A subset of the"},{"line_number":1828,"context_line":"roles may be requested by specifying by an array of  ``roles`` in the the"},{"line_number":1829,"context_line":"``scope`` dictionary.  The roles only may be specified by name, not by id."},{"line_number":1830,"context_line":"Example of requesting a project scoped token with only the Member role:"},{"line_number":1831,"context_line":""},{"line_number":1832,"context_line":"::"},{"line_number":1833,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa69d971_212d0b46","line":1830,"range":{"start_line":1830,"start_character":70,"end_line":1830,"end_character":71},"in_reply_to":"3a7e1126_f6b9aded","updated":"2016-01-11 17:46:06.000000000","message":"Auth failure.","commit_id":"901ed59193e7126e46dad4ae798ac2c3b6edddee"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bb5cc8f625be688b6c47d048f58e83439a976541","unresolved":false,"context_lines":[{"line_number":2064,"context_line":"    }"},{"line_number":2065,"context_line":""},{"line_number":2066,"context_line":""},{"line_number":2067,"context_line":"*New in version 3.5* A user may explicitly request a token with only a subset"},{"line_number":2068,"context_line":"of the endpoints associated with the project.  If the user does not specify,"},{"line_number":2069,"context_line":"all explicitly assigned endpoints are contained with in the token.  A subset"},{"line_number":2070,"context_line":"of the endpoints may be requested by specifying by an array of"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a7e1126_36c89574","line":2067,"range":{"start_line":2067,"start_character":16,"end_line":2067,"end_character":17},"updated":"2015-12-17 01:03:01.000000000","message":"same as above, 3.4","commit_id":"901ed59193e7126e46dad4ae798ac2c3b6edddee"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bb5cc8f625be688b6c47d048f58e83439a976541","unresolved":false,"context_lines":[{"line_number":2066,"context_line":""},{"line_number":2067,"context_line":"*New in version 3.5* A user may explicitly request a token with only a subset"},{"line_number":2068,"context_line":"of the endpoints associated with the project.  If the user does not specify,"},{"line_number":2069,"context_line":"all explicitly assigned endpoints are contained with in the token.  A subset"},{"line_number":2070,"context_line":"of the endpoints may be requested by specifying by an array of"},{"line_number":2071,"context_line":"``endpoint_ids`` or by specifying an array of ``endpoint_urls``in the the"},{"line_number":2072,"context_line":"``scope`` dictionary. A user may also limit the token containing endpoints of"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a7e1126_b6aa4584","line":2069,"range":{"start_line":2069,"start_character":52,"end_line":2069,"end_character":53},"updated":"2015-12-17 01:03:01.000000000","message":"within","commit_id":"901ed59193e7126e46dad4ae798ac2c3b6edddee"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bb5cc8f625be688b6c47d048f58e83439a976541","unresolved":false,"context_lines":[{"line_number":2074,"context_line":"by an array of ``service_ids`` or an array of ``service_types`` in the the"},{"line_number":2075,"context_line":"``scope`` dictionary.  These methods are additive;  If multiple options are"},{"line_number":2076,"context_line":"specified specified, all endpoints in the token are required to meet all"},{"line_number":2077,"context_line":"criteria."},{"line_number":2078,"context_line":""},{"line_number":2079,"context_line":"Example of requesting a project scoped token with two endpoints by id:"},{"line_number":2080,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a7e1126_96238905","line":2077,"range":{"start_line":2077,"start_character":8,"end_line":2077,"end_character":9},"updated":"2015-12-17 01:03:01.000000000","message":"how about reusing our existing endpoint group filters? That way, its more consistent.","commit_id":"901ed59193e7126e46dad4ae798ac2c3b6edddee"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"4ceca09408ec3b9c10cab00a20d397b540b5ce7e","unresolved":false,"context_lines":[{"line_number":12,"context_line":"What\u0027s New in Version 3.7"},{"line_number":13,"context_line":"-------------------------"},{"line_number":14,"context_line":"- Request a token associated with only a subset of roles or endpoints for the"},{"line_number":15,"context_line":"  scope."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"What\u0027s New in Version 3.6"},{"line_number":18,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da6ed579_e3780efb","line":15,"updated":"2016-01-12 01:34:56.000000000","message":"What is the point of a subset of endpoints. The endpoint filtering is pretty terrible. The subset of roles makes a lot of sense.","commit_id":"7c39adb3f4332b6e5fcf6e4949c13488a580e552"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"a8ce849ce4534227f169a6e8e20ce75a0e388b0a","unresolved":false,"context_lines":[{"line_number":12,"context_line":"What\u0027s New in Version 3.7"},{"line_number":13,"context_line":"-------------------------"},{"line_number":14,"context_line":"- Request a token associated with only a subset of roles or endpoints for the"},{"line_number":15,"context_line":"  scope."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"What\u0027s New in Version 3.6"},{"line_number":18,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da6ed579_e881c64e","line":15,"in_reply_to":"da6ed579_e3780efb","updated":"2016-01-12 03:43:58.000000000","message":"endpoint binding of tokens is already in, but is   useless with out this fix.","commit_id":"7c39adb3f4332b6e5fcf6e4949c13488a580e552"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"a8ce849ce4534227f169a6e8e20ce75a0e388b0a","unresolved":false,"context_lines":[{"line_number":1990,"context_line":"``scope`` dictionary.  The roles only may be specified by name, not by id."},{"line_number":1991,"context_line":""},{"line_number":1992,"context_line":"If the user does not have the role assigned, either explicitly or implicitly,"},{"line_number":1993,"context_line":"the authrorization request is invalid and the Identity"},{"line_number":1994,"context_line":"service implementation shall return an HTTP 403 Forbidden."},{"line_number":1995,"context_line":""},{"line_number":1996,"context_line":"Example of requesting a project scoped token with only the Member role:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da6ed579_5e95313e","line":1993,"updated":"2016-01-12 03:43:58.000000000","message":"typo","commit_id":"7c39adb3f4332b6e5fcf6e4949c13488a580e552"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3a31363dd4f254b4e121e72f8107b10b8aa7de2d","unresolved":false,"context_lines":[{"line_number":1984,"context_line":"behave the same as a token request with no scope, where the user has no"},{"line_number":1985,"context_line":"default project defined."},{"line_number":1986,"context_line":""},{"line_number":1987,"context_line":"*New in version 3.7* A user may explicitly request a token with only a subset"},{"line_number":1988,"context_line":"of the roles the user is assigned.  If the user does not specify, all"},{"line_number":1989,"context_line":"explicitly assignd roles are contained with in the token.  A subset of the"},{"line_number":1990,"context_line":"roles may be requested by specifying by an array of  ``roles`` in the the"},{"line_number":1991,"context_line":"``scope`` dictionary.  The roles only may be specified by name, not by id."},{"line_number":1992,"context_line":""},{"line_number":1993,"context_line":"If the user does not have the role assigned, either explicitly or implicitly,"},{"line_number":1994,"context_line":"the authorization request is invalid and the Identity"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5a9d85d2_7ebe39d5","line":1991,"range":{"start_line":1987,"start_character":0,"end_line":1991,"end_character":74},"updated":"2016-06-21 15:41:31.000000000","message":"User has no idea what roles he needs to perform a given operation. Making this up to the user is the wrong direction IMO. Operators configure/change policies and users have no idea about it","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f709a93b6ca532e4e12e7d57279c916b07d559f4","unresolved":false,"context_lines":[{"line_number":1984,"context_line":"behave the same as a token request with no scope, where the user has no"},{"line_number":1985,"context_line":"default project defined."},{"line_number":1986,"context_line":""},{"line_number":1987,"context_line":"*New in version 3.7* A user may explicitly request a token with only a subset"},{"line_number":1988,"context_line":"of the roles the user is assigned.  If the user does not specify, all"},{"line_number":1989,"context_line":"explicitly assignd roles are contained with in the token.  A subset of the"},{"line_number":1990,"context_line":"roles may be requested by specifying by an array of  ``roles`` in the the"},{"line_number":1991,"context_line":"``scope`` dictionary.  The roles only may be specified by name, not by id."},{"line_number":1992,"context_line":""},{"line_number":1993,"context_line":"If the user does not have the role assigned, either explicitly or implicitly,"},{"line_number":1994,"context_line":"the authorization request is invalid and the Identity"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a71b18c_1452bb67","line":1991,"range":{"start_line":1987,"start_character":0,"end_line":1991,"end_character":74},"in_reply_to":"5a9d85d2_7ebe39d5","updated":"2017-04-28 19:10:30.000000000","message":"This ability is coming with the RBAC code.","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"643933da25007f5169bb75d753469626f48dc5e9","unresolved":false,"context_lines":[{"line_number":2015,"context_line":"                \"project\": {"},{"line_number":2016,"context_line":"                    \"id\": \"263fd9\""},{"line_number":2017,"context_line":"                },"},{"line_number":2018,"context_line":"                \"roles\": [\"Member\"]"},{"line_number":2019,"context_line":"            }"},{"line_number":2020,"context_line":"        }"},{"line_number":2021,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":11,"id":"bab6814e_c46dd79a","line":2018,"range":{"start_line":2018,"start_character":27,"end_line":2018,"end_character":33},"updated":"2016-05-25 13:36:13.000000000","message":"can this role be domain specific? From how this is defined, I guess not? What if the is a domain specific and a global role of this name (and the uses has one or other (or both)?","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4ec21879a8cba6c4c2501f2f57038847174e2a85","unresolved":false,"context_lines":[{"line_number":2015,"context_line":"                \"project\": {"},{"line_number":2016,"context_line":"                    \"id\": \"263fd9\""},{"line_number":2017,"context_line":"                },"},{"line_number":2018,"context_line":"                \"roles\": [\"Member\"]"},{"line_number":2019,"context_line":"            }"},{"line_number":2020,"context_line":"        }"},{"line_number":2021,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1aa78d24_fa2a7e7d","line":2018,"range":{"start_line":2018,"start_character":16,"end_line":2018,"end_character":35},"updated":"2016-07-04 04:03:02.000000000","message":"role IDs would also have to be honored, it would have to look like:\n\n  roles: [\n    {name: member},\n    {id: 12345},\n    {name, member2, domain: domainX}\n  ]","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f709a93b6ca532e4e12e7d57279c916b07d559f4","unresolved":false,"context_lines":[{"line_number":2015,"context_line":"                \"project\": {"},{"line_number":2016,"context_line":"                    \"id\": \"263fd9\""},{"line_number":2017,"context_line":"                },"},{"line_number":2018,"context_line":"                \"roles\": [\"Member\"]"},{"line_number":2019,"context_line":"            }"},{"line_number":2020,"context_line":"        }"},{"line_number":2021,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a71b18c_b49f4702","line":2018,"range":{"start_line":2018,"start_character":16,"end_line":2018,"end_character":35},"in_reply_to":"1aa78d24_fa2a7e7d","updated":"2017-04-28 19:10:30.000000000","message":"Agreed, although it would be either/or.\n\nI think we should reduce this down to allowing a user to request a single role, not multiple, and let implied roles fill out the token.  Domain specific roles would cover the case where an admin needed to make a new role for a workflow that needed 2.","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f709a93b6ca532e4e12e7d57279c916b07d559f4","unresolved":false,"context_lines":[{"line_number":2015,"context_line":"                \"project\": {"},{"line_number":2016,"context_line":"                    \"id\": \"263fd9\""},{"line_number":2017,"context_line":"                },"},{"line_number":2018,"context_line":"                \"roles\": [\"Member\"]"},{"line_number":2019,"context_line":"            }"},{"line_number":2020,"context_line":"        }"},{"line_number":2021,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a71b18c_f4db7feb","line":2018,"range":{"start_line":2018,"start_character":27,"end_line":2018,"end_character":33},"in_reply_to":"bab6814e_c46dd79a","updated":"2017-04-28 19:10:30.000000000","message":"Absolutely.  That is one of the primary ways I see this used.  A global role would mask a domain specific one, and the Domain specific would have to be renamed.","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"643933da25007f5169bb75d753469626f48dc5e9","unresolved":false,"context_lines":[{"line_number":2237,"context_line":"        }"},{"line_number":2238,"context_line":"    }"},{"line_number":2239,"context_line":""},{"line_number":2240,"context_line":""},{"line_number":2241,"context_line":"Authentication failures"},{"line_number":2242,"context_line":"\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027"},{"line_number":2243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"bab6814e_2435c3d9","line":2240,"updated":"2016-05-25 13:36:13.000000000","message":"nit: should probably not have an extra line here","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"}],"specs/backlog/subset-tokens.rst":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":23,"context_line":"operations that a user can perform. With the recent spec for endpoint binding"},{"line_number":24,"context_line":"of tokens, users will have a way to enforce that a token can only be used on"},{"line_number":25,"context_line":"an endpoint who\u0027s service catalog is associated with the token.  However,"},{"line_number":26,"context_line":"users have no way to request a subset of theservice catalog in the token."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"In addition, with dynamic policy, a user shouild be able to delegate only a"},{"line_number":29,"context_line":"subset of the roels that they are assigned, but they have not way today, short"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_2bd114ce","line":26,"updated":"2015-06-02 14:38:14.000000000","message":"the service","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":26,"context_line":"users have no way to request a subset of theservice catalog in the token."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"In addition, with dynamic policy, a user shouild be able to delegate only a"},{"line_number":29,"context_line":"subset of the roels that they are assigned, but they have not way today, short"},{"line_number":30,"context_line":"of creating a trust, to request a token with a subset of their assigned roles."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_ebdbfceb","line":29,"updated":"2015-06-02 14:38:14.000000000","message":"roles","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":41,"context_line":"Alternatives"},{"line_number":42,"context_line":"------------"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"For roles, users could create  trusts.  This is expensive."},{"line_number":45,"context_line":"For the service catalog, there does not seem to be an alternative way to limit"},{"line_number":46,"context_line":"what gets put in with the token."},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_2be8f47b","line":44,"updated":"2015-06-02 14:38:14.000000000","message":"space after create","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":57,"context_line":"Notifications Impact"},{"line_number":58,"context_line":"--------------------"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"No CHange"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Other End User Impact"},{"line_number":63,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_8bf92850","line":60,"updated":"2015-06-02 14:38:14.000000000","message":"change","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Performance Impact"},{"line_number":72,"context_line":"------------------"},{"line_number":73,"context_line":"None.  Creating the token will rquire filterin out some data, but this is"},{"line_number":74,"context_line":"neither CPU nor IO intensive."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Other Deployer Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_0ba41855","line":73,"updated":"2015-06-02 14:38:14.000000000","message":"require filtering","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":81,"context_line":"Developer Impact"},{"line_number":82,"context_line":"----------------"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Developers caan and should use this mechanism to reduce the power of tokens to"},{"line_number":85,"context_line":"match the requested operations."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_eb89bccb","line":84,"updated":"2015-06-02 14:38:14.000000000","message":"can","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Primary assignee:"},{"line_number":96,"context_line":"Adam Yyoung ayoung ayoung@redhat.com"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Other contributors:"},{"line_number":99,"context_line":"  \u003claunchpad-id or None\u003e"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_2b5a3484","line":96,"updated":"2015-06-02 14:38:14.000000000","message":"Young!","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f32e8f663151e1cd26f16ed4a99816f25e789fb4","unresolved":false,"context_lines":[{"line_number":102,"context_line":"----------"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"This should be performed in a single patch."},{"line_number":105,"context_line":"Follow on work in the client will be reqquired to take advantage of it."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5afe65bd_cb516064","line":105,"updated":"2015-06-02 14:38:14.000000000","message":"required","commit_id":"14034ce874119f85301d882dbacaf25a3f6c2380"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"bc407eb6837e8803bc34ac5f935aa1a2f95d07d2","unresolved":false,"context_lines":[{"line_number":23,"context_line":"operations that a user can perform. With the recent spec for endpoint binding"},{"line_number":24,"context_line":"of tokens, users will have a way to enforce that a token can only be used on"},{"line_number":25,"context_line":"an endpoint who\u0027s service catalog is associated with the token.  However,"},{"line_number":26,"context_line":"users have no way to request a subset of theservice catalog in the token."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"In addition, with dynamic policy, a user shouild be able to delegate only a"},{"line_number":29,"context_line":"subset of the roels that they are assigned, but they have not way today, short"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da20952f_2b5f6442","line":26,"updated":"2015-09-03 13:19:26.000000000","message":"s/theservice/the service/","commit_id":"6c95ec00c11751547deaa1ffb4ce753abdce80dd"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"bc407eb6837e8803bc34ac5f935aa1a2f95d07d2","unresolved":false,"context_lines":[{"line_number":25,"context_line":"an endpoint who\u0027s service catalog is associated with the token.  However,"},{"line_number":26,"context_line":"users have no way to request a subset of theservice catalog in the token."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"In addition, with dynamic policy, a user shouild be able to delegate only a"},{"line_number":29,"context_line":"subset of the roels that they are assigned, but they have not way today, short"},{"line_number":30,"context_line":"of creating a trust, to request a token with a subset of their assigned roles."},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"da20952f_ab31340d","line":28,"updated":"2015-09-03 13:19:26.000000000","message":"s/shouild/should/","commit_id":"6c95ec00c11751547deaa1ffb4ce753abdce80dd"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"bc407eb6837e8803bc34ac5f935aa1a2f95d07d2","unresolved":false,"context_lines":[{"line_number":26,"context_line":"users have no way to request a subset of theservice catalog in the token."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"In addition, with dynamic policy, a user shouild be able to delegate only a"},{"line_number":29,"context_line":"subset of the roels that they are assigned, but they have not way today, short"},{"line_number":30,"context_line":"of creating a trust, to request a token with a subset of their assigned roles."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"da20952f_0b2b8095","line":29,"updated":"2015-09-03 13:19:26.000000000","message":"s/roels/roles/","commit_id":"6c95ec00c11751547deaa1ffb4ce753abdce80dd"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"bc407eb6837e8803bc34ac5f935aa1a2f95d07d2","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Keystone client can take advantage of this change in the future to request"},{"line_number":66,"context_line":"tokens specifically for the endpoint that will service a request.  If it"},{"line_number":67,"context_line":"knows the reoels required for the request, it could automatically request a"},{"line_number":68,"context_line":"token with only the minimal set of roles required to service the request."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"da20952f_2b3683e7","line":67,"updated":"2015-09-03 13:19:26.000000000","message":"s/reoels/rules/","commit_id":"6c95ec00c11751547deaa1ffb4ce753abdce80dd"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"bc407eb6837e8803bc34ac5f935aa1a2f95d07d2","unresolved":false,"context_lines":[{"line_number":102,"context_line":"----------"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"This should be performed in a single patch."},{"line_number":105,"context_line":"Follow on work in the client will be reqquired to take advantage of it."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da20952f_eb188b77","line":105,"updated":"2015-09-03 13:19:26.000000000","message":"s/reqquired/required/","commit_id":"6c95ec00c11751547deaa1ffb4ce753abdce80dd"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"9a6dbc231af954efe7af4fd8bceae3f5a753ab51","unresolved":false,"context_lines":[{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Subset Tokens"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp Subset Tokens"},{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/subset-tokens\u003e`_"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a740942_247e746a","line":10,"updated":"2015-12-12 18:06:56.000000000","message":"Maybe a better title is Constrained Roles or Constrained Delegation or Constrained Tokens or even Least Privileges.\n\nAlso can you make it clear that this spec if referring to scoped tokens and not unscoped tokens","commit_id":"52eba78a24337e58423accd7b0b8476d6209a900"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"43ae9cc9c04aee2729323b72a194190606304965","unresolved":false,"context_lines":[{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Subset Tokens"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp Subset Tokens"},{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/subset-tokens\u003e`_"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a7e1126_21e7f441","line":10,"in_reply_to":"7a740942_247e746a","updated":"2015-12-17 00:23:29.000000000","message":"Done","commit_id":"52eba78a24337e58423accd7b0b8476d6209a900"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"9a6dbc231af954efe7af4fd8bceae3f5a753ab51","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp Subset Tokens"},{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/subset-tokens\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Add to the token request the ability to limit the token to a subset of roles"},{"line_number":16,"context_line":"and endpoints."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a740942_6488fc71","line":13,"updated":"2015-12-12 18:06:56.000000000","message":"This link to the blueprint is broken. Can you fix it please","commit_id":"52eba78a24337e58423accd7b0b8476d6209a900"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"43ae9cc9c04aee2729323b72a194190606304965","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp Subset Tokens"},{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/subset-tokens\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Add to the token request the ability to limit the token to a subset of roles"},{"line_number":16,"context_line":"and endpoints."}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a7e1126_615e5c47","line":13,"in_reply_to":"7a740942_6488fc71","updated":"2015-12-17 00:23:29.000000000","message":"Done.  Note the this is an artifact of the revie, but the BP is there:  https://blueprints.launchpad.net/keystone/+spec/subset-tokens","commit_id":"52eba78a24337e58423accd7b0b8476d6209a900"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"9a6dbc231af954efe7af4fd8bceae3f5a753ab51","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"If a token is intercepted, the token today provides full access to all"},{"line_number":23,"context_line":"operations that a user can perform. With the recent spec for endpoint binding"},{"line_number":24,"context_line":"of tokens, users will have a way to enforce that a token can only be used on"},{"line_number":25,"context_line":"an endpoint who\u0027s service catalog is associated with the token.  However,"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a740942_44eaa010","line":22,"updated":"2015-12-12 18:06:56.000000000","message":"This draft is not addressing the problem of interception. It is addressing the issue of Least Privileges, in that it wants a token to be constrained rather than having full privileges.","commit_id":"52eba78a24337e58423accd7b0b8476d6209a900"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"43ae9cc9c04aee2729323b72a194190606304965","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"If a token is intercepted, the token today provides full access to all"},{"line_number":23,"context_line":"operations that a user can perform. With the recent spec for endpoint binding"},{"line_number":24,"context_line":"of tokens, users will have a way to enforce that a token can only be used on"},{"line_number":25,"context_line":"an endpoint who\u0027s service catalog is associated with the token.  However,"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a7e1126_f3369fb3","line":22,"in_reply_to":"7a740942_44eaa010","updated":"2015-12-17 00:23:29.000000000","message":"Done","commit_id":"52eba78a24337e58423accd7b0b8476d6209a900"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"9a6dbc231af954efe7af4fd8bceae3f5a753ab51","unresolved":false,"context_lines":[{"line_number":29,"context_line":"subset of the roles that they are assigned, but they have not way today, short"},{"line_number":30,"context_line":"of creating a trust, to request a token with a subset of their assigned roles."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":""},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Proposed Change"},{"line_number":35,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a740942_8469688e","line":32,"updated":"2015-12-12 18:06:56.000000000","message":"You need to make clear whether this feature is for delegation of privileges to a third party or simply a user swapping a token for a less privilege one for himself","commit_id":"52eba78a24337e58423accd7b0b8476d6209a900"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"43ae9cc9c04aee2729323b72a194190606304965","unresolved":false,"context_lines":[{"line_number":29,"context_line":"subset of the roles that they are assigned, but they have not way today, short"},{"line_number":30,"context_line":"of creating a trust, to request a token with a subset of their assigned roles."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":""},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Proposed Change"},{"line_number":35,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a7e1126_535213df","line":32,"in_reply_to":"7a740942_8469688e","updated":"2015-12-17 00:23:29.000000000","message":"Removed this last paragraph, as I think that was making things less clear.  It is only the \"request for  self\" that is addressed in this spec.","commit_id":"52eba78a24337e58423accd7b0b8476d6209a900"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bb5cc8f625be688b6c47d048f58e83439a976541","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"If a token is intercepted, the token today provides full access to all"},{"line_number":50,"context_line":"operations that a user can perform. With the recent spec for endpoint binding"},{"line_number":51,"context_line":"of tokens, users will have a way to enforce that a token can only be used on"},{"line_number":52,"context_line":"an endpoint who\u0027s service catalog is associated with the token.  However,"},{"line_number":53,"context_line":"users have no way to request a subset of the service catalog in the token."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a7e1126_73894fca","line":50,"range":{"start_line":50,"start_character":27,"end_line":50,"end_character":34},"updated":"2015-12-17 01:03:01.000000000","message":"can perform with that token.","commit_id":"901ed59193e7126e46dad4ae798ac2c3b6edddee"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"105b3664147d21471de2b2afbb8afc1513397334","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"If a token is intercepted, the token today provides full access to all"},{"line_number":50,"context_line":"operations that a user can perform. With the recent spec for endpoint binding"},{"line_number":51,"context_line":"of tokens, users will have a way to enforce that a token can only be used on"},{"line_number":52,"context_line":"an endpoint who\u0027s service catalog is associated with the token.  However,"},{"line_number":53,"context_line":"users have no way to request a subset of the service catalog in the token."}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa69d971_c1dbcf7a","line":50,"range":{"start_line":50,"start_character":27,"end_line":50,"end_character":34},"in_reply_to":"3a7e1126_73894fca","updated":"2016-01-11 17:46:06.000000000","message":"No. Just Perform.  The token provides all access.","commit_id":"901ed59193e7126e46dad4ae798ac2c3b6edddee"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"bb5cc8f625be688b6c47d048f58e83439a976541","unresolved":false,"context_lines":[{"line_number":88,"context_line":"tokens specifically for the endpoint that will service a request.  If it"},{"line_number":89,"context_line":"knows the roles required for the request, it could automatically request a"},{"line_number":90,"context_line":"token with only the minimal set of roles required to service the request."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Performance Impact"},{"line_number":94,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a7e1126_5631a1eb","line":91,"updated":"2015-12-17 01:03:01.000000000","message":"I think there will be a UX trade-off, which requiring user to know exactly which roles and which endpoints to request.","commit_id":"901ed59193e7126e46dad4ae798ac2c3b6edddee"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"105b3664147d21471de2b2afbb8afc1513397334","unresolved":false,"context_lines":[{"line_number":88,"context_line":"tokens specifically for the endpoint that will service a request.  If it"},{"line_number":89,"context_line":"knows the roles required for the request, it could automatically request a"},{"line_number":90,"context_line":"token with only the minimal set of roles required to service the request."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Performance Impact"},{"line_number":94,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa69d971_01432714","line":91,"in_reply_to":"3a7e1126_5631a1eb","updated":"2016-01-11 17:46:06.000000000","message":"Beyond the scope of this spec.  Ability to map from actions back to roles or endpoints is parallel to this.","commit_id":"901ed59193e7126e46dad4ae798ac2c3b6edddee"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"4ceca09408ec3b9c10cab00a20d397b540b5ce7e","unresolved":false,"context_lines":[{"line_number":51,"context_line":"of tokens, users will have a way to enforce that a token can only be used on"},{"line_number":52,"context_line":"an endpoint who\u0027s service catalog is associated with the token.  However,"},{"line_number":53,"context_line":"users have no way to request a subset of the service catalog in the token."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Proposed Change"},{"line_number":57,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da6ed579_836a7219","line":54,"updated":"2016-01-12 01:34:56.000000000","message":"the endpoint filtering doesn\u0027t provide security and really isn\u0027t worth adding in. the cost of caching/CPU/etc makes endpoint filtering not really worth it at any real scale.\n\nthe role subset is worth continuing.","commit_id":"7c39adb3f4332b6e5fcf6e4949c13488a580e552"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"a8ce849ce4534227f169a6e8e20ce75a0e388b0a","unresolved":false,"context_lines":[{"line_number":51,"context_line":"of tokens, users will have a way to enforce that a token can only be used on"},{"line_number":52,"context_line":"an endpoint who\u0027s service catalog is associated with the token.  However,"},{"line_number":53,"context_line":"users have no way to request a subset of the service catalog in the token."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Proposed Change"},{"line_number":57,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da6ed579_68af16e4","line":54,"in_reply_to":"da6ed579_836a7219","updated":"2016-01-12 03:43:58.000000000","message":"THis does not actually require endpoint filtering to be effective.  It just means you can get a token for glance without also exposing access to nova APIs as well.","commit_id":"7c39adb3f4332b6e5fcf6e4949c13488a580e552"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"01d8291e1d1b7a27ccdadbd42c95042b0835f696","unresolved":false,"context_lines":[{"line_number":54,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Add an entry to the token request that indicate what subset of the roles"},{"line_number":57,"context_line":"should be added to the token."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a122d0e_08dcae71","line":57,"updated":"2016-04-20 14:36:58.000000000","message":"To maintain the size of Fernet tokens, the request should have only a single role, although, via role inference rules, the token may then have multiple roles associated.","commit_id":"c71f9b508d5e034b41f9b1bbfa1c5ab28db56f68"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce8daf41959d0a41495f74eec7983700881091b0","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/subset-tokens\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Add to the token request the ability to limit a scopeed token to a"},{"line_number":16,"context_line":"subset of roles."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"9abb7d3a_a198136b","line":15,"updated":"2016-06-01 16:33:22.000000000","message":"scoped*","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3a31363dd4f254b4e121e72f8107b10b8aa7de2d","unresolved":false,"context_lines":[{"line_number":32,"context_line":"back to 1974 but as he points out, this concept was already a well"},{"line_number":33,"context_line":"established security principal."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"\"f) Least privilege: Every program and every user of the system should"},{"line_number":36,"context_line":"operate using the least set of privileges necessary to complete the"},{"line_number":37,"context_line":"job. Primarily, this principle limits the damage that can result from"},{"line_number":38,"context_line":"an accident or error. It also reduces the number of potential"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5a9d85d2_7ea599b3","line":35,"range":{"start_line":35,"start_character":0,"end_line":35,"end_character":4},"updated":"2016-06-21 15:41:31.000000000","message":"What is this ?","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3a31363dd4f254b4e121e72f8107b10b8aa7de2d","unresolved":false,"context_lines":[{"line_number":53,"context_line":"Proposed Change"},{"line_number":54,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Add an entry to the token request that indicate what subset of the roles"},{"line_number":57,"context_line":"should be added to the token.  In order to keep the resulting tokens small,"},{"line_number":58,"context_line":"This will be a single role, defined by its roled_id.  The resultant token may"},{"line_number":59,"context_line":"have multiple roles associated with it via role inference rules."},{"line_number":60,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"5a9d85d2_9eb7a5d7","line":57,"range":{"start_line":56,"start_character":0,"end_line":57,"end_character":29},"updated":"2016-06-21 15:41:31.000000000","message":"User has no idea what roles he needs to perform a given operation. Making this up to the user is the wrong direction IMO. Operators configure/change policies and users have no idea about it","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3a31363dd4f254b4e121e72f8107b10b8aa7de2d","unresolved":false,"context_lines":[{"line_number":78,"context_line":"Other End User Impact"},{"line_number":79,"context_line":"---------------------"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Keystone client can take advantage of this change in the future to request"},{"line_number":82,"context_line":"tokens specifically with only the minimal set of roles required to"},{"line_number":83,"context_line":"service the request."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5a9d85d2_5edd3d0d","line":83,"range":{"start_line":81,"start_character":0,"end_line":83,"end_character":20},"updated":"2016-06-21 15:41:31.000000000","message":"How does it know what roles are needed for performing a given workflow? Does it even know what the workflow is supposed to be run with that token (e.g spin up an instance) ?","commit_id":"fc15a36ab217115f3bc7cf2e4e063dcef4634fd0"}],"specs/keystone/ongoing/subset-tokens.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd44ce5a9090ee2e435a3026027fc7528fd88883","unresolved":false,"context_lines":[{"line_number":23,"context_line":"operations that the user can perform on the associated project.  If an"},{"line_number":24,"context_line":"admin user needs to perform a mundane operation that any member of the"},{"line_number":25,"context_line":"project can perform, they are still required to pass a token with full"},{"line_number":26,"context_line":"admin privileges."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":29,"context_line":"the most cited paper on this,"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3a71b18c_b74845ce","line":26,"updated":"2016-12-07 22:31:45.000000000","message":"I thought we already discussed this route in Vancouver. What was the outcome?","commit_id":"46e0c65a2070cea9a4a47b4d3e2999baff8bb453"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6f327eb53233fa10b7353a3124f7d71dcb4d49dd","unresolved":false,"context_lines":[{"line_number":24,"context_line":"admin user needs to perform a mundane operation that any member of the"},{"line_number":25,"context_line":"project can perform, they are still required to pass a token with full"},{"line_number":26,"context_line":"admin privileges."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":29,"context_line":"the most cited paper on this,"},{"line_number":30,"context_line":"`web.mit.edu/Saltzer/www/publications/protection/Basic.html`, dates"}],"source_content_type":"text/x-rst","patch_set":12,"id":"ba2be162_0fb4a6cf","line":27,"updated":"2017-03-06 18:47:46.000000000","message":"So the workflow of this requires a user to:\n\n- know the required role of an operation in another service\n- ask keystone for a token scoped to a specific role on a specific project\n- pass the token to the service\n\nHow is this going to be effectively used by horizon or other clients? Right now horizon will get a token scoped to a project for all operations a user wants to do within that project. This will be a pretty big change for clients to implement and I\u0027m wondering what their feedback is.","commit_id":"46e0c65a2070cea9a4a47b4d3e2999baff8bb453"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"4e068e8ddd97ae90da3f5f5034fd5e510c9ecfb6","unresolved":false,"context_lines":[{"line_number":24,"context_line":"admin user needs to perform a mundane operation that any member of the"},{"line_number":25,"context_line":"project can perform, they are still required to pass a token with full"},{"line_number":26,"context_line":"admin privileges."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":29,"context_line":"the most cited paper on this,"},{"line_number":30,"context_line":"`web.mit.edu/Saltzer/www/publications/protection/Basic.html`, dates"}],"source_content_type":"text/x-rst","patch_set":12,"id":"5ff73747_dddd9ee0","line":27,"in_reply_to":"ba2be162_0fb4a6cf","updated":"2017-04-28 18:57:22.000000000","message":"Horizon should use an unscoped token for maintaint the user session, and token scoped as narrowly as possible for the operations requested.","commit_id":"46e0c65a2070cea9a4a47b4d3e2999baff8bb453"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"33b5dd0852fb091a7eedd34c9b340c4236a7406d","unresolved":false,"context_lines":[{"line_number":23,"context_line":"operations that the user can perform on the associated project.  If an"},{"line_number":24,"context_line":"admin user needs to perform a mundane operation that any member of the"},{"line_number":25,"context_line":"project can perform, they are still required to pass a token with full"},{"line_number":26,"context_line":"admin privileges."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":29,"context_line":"the most cited paper on this,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_2572dce5","line":26,"updated":"2018-10-08 19:38:04.000000000","message":"Depending on the intended use case, this could be partially solved with application credentials or trusts.","commit_id":"76224f84ffb1d98a846206a6af12041e7b6f7696"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"33b5dd0852fb091a7eedd34c9b340c4236a7406d","unresolved":false,"context_lines":[{"line_number":23,"context_line":"operations that the user can perform on the associated project.  If an"},{"line_number":24,"context_line":"admin user needs to perform a mundane operation that any member of the"},{"line_number":25,"context_line":"project can perform, they are still required to pass a token with full"},{"line_number":26,"context_line":"admin privileges."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":29,"context_line":"the most cited paper on this,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_e57b84bc","line":26,"range":{"start_line":26,"start_character":0,"end_line":26,"end_character":5},"updated":"2018-10-08 19:38:04.000000000","message":"nit: This isn\u0027t necessarily specific to \"admin\" roles.","commit_id":"76224f84ffb1d98a846206a6af12041e7b6f7696"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"6ab000215badd6ccebab96d9e32ebe183fbefe6a","unresolved":false,"context_lines":[{"line_number":78,"context_line":"                \"project\": {"},{"line_number":79,"context_line":"                    \"id\": \"263fd9\""},{"line_number":80,"context_line":"                },"},{"line_number":81,"context_line":"                \"role\": \"Member\""},{"line_number":82,"context_line":"            }"},{"line_number":83,"context_line":"        }"},{"line_number":84,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_d366b229","line":81,"updated":"2018-09-07 15:34:21.000000000","message":"lets make this a list.","commit_id":"76224f84ffb1d98a846206a6af12041e7b6f7696"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"6ab000215badd6ccebab96d9e32ebe183fbefe6a","unresolved":false,"context_lines":[{"line_number":104,"context_line":"                \"project\": {"},{"line_number":105,"context_line":"                    \"id\": \"263fd9\""},{"line_number":106,"context_line":"                },"},{"line_number":107,"context_line":"                \"role_id\": \"987edf\""},{"line_number":108,"context_line":"            }"},{"line_number":109,"context_line":"        }"},{"line_number":110,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_1378aabe","line":107,"updated":"2018-09-07 15:34:21.000000000","message":"this should be the same as the existing token format","commit_id":"76224f84ffb1d98a846206a6af12041e7b6f7696"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"6ab000215badd6ccebab96d9e32ebe183fbefe6a","unresolved":false,"context_lines":[{"line_number":116,"context_line":"There has been no viable alternative proposed."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Users could create self-trusts.  This is expensive, and breaks most"},{"line_number":119,"context_line":"major workflows."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Security Impact"},{"line_number":122,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3f79a3b5_b34c569e","line":119,"updated":"2018-09-07 15:34:21.000000000","message":"Application credentials as well","commit_id":"76224f84ffb1d98a846206a6af12041e7b6f7696"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7e071be49f039930ee7494dc2e7b3cc26c6fdaaf","unresolved":false,"context_lines":[{"line_number":23,"context_line":"operations that the user can perform on the associated project.  If an"},{"line_number":24,"context_line":"admin user needs to perform a mundane operation that any member of the"},{"line_number":25,"context_line":"project can perform, they are still required to pass a token with full"},{"line_number":26,"context_line":"admin privileges."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":29,"context_line":"the most cited paper on this,"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3f79a3b5_e554e424","line":26,"range":{"start_line":26,"start_character":0,"end_line":26,"end_character":5},"updated":"2018-10-08 19:44:31.000000000","message":"This isn\u0027t necessarily specific to admin roles.","commit_id":"f487a2d7a44e03c41cf7b00fde1ce947004c0d2d"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"034df013bec2d9325fd0987d78d318c37d772323","unresolved":false,"context_lines":[{"line_number":23,"context_line":"operations that the user can perform on the associated project.  If an"},{"line_number":24,"context_line":"admin user needs to perform a mundane operation that any member of the"},{"line_number":25,"context_line":"project can perform, they are still required to pass a token with full"},{"line_number":26,"context_line":"admin privileges."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":29,"context_line":"the most cited paper on this,"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3f79a3b5_e58739b3","line":26,"range":{"start_line":26,"start_character":0,"end_line":26,"end_character":5},"in_reply_to":"3f79a3b5_e554e424","updated":"2018-10-30 21:41:36.000000000","message":"Done:  Added comment that it is for Member-\u003e readonly as well.","commit_id":"f487a2d7a44e03c41cf7b00fde1ce947004c0d2d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7e071be49f039930ee7494dc2e7b3cc26c6fdaaf","unresolved":false,"context_lines":[{"line_number":24,"context_line":"admin user needs to perform a mundane operation that any member of the"},{"line_number":25,"context_line":"project can perform, they are still required to pass a token with full"},{"line_number":26,"context_line":"admin privileges."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":29,"context_line":"the most cited paper on this,"},{"line_number":30,"context_line":"`web.mit.edu/Saltzer/www/publications/protection/Basic.html`, dates"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3f79a3b5_451b5883","line":27,"updated":"2018-10-08 19:44:31.000000000","message":"Depending on the use case, this is partially solved with application credentials or trusts.","commit_id":"f487a2d7a44e03c41cf7b00fde1ce947004c0d2d"},{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"8def831049fa62340274c62972f1e8076716caa1","unresolved":false,"context_lines":[{"line_number":24,"context_line":"admin user needs to perform a mundane operation that any member of the"},{"line_number":25,"context_line":"project can perform, they are still required to pass a token with full"},{"line_number":26,"context_line":"admin privileges."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":29,"context_line":"the most cited paper on this,"},{"line_number":30,"context_line":"`web.mit.edu/Saltzer/www/publications/protection/Basic.html`, dates"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3f79a3b5_558c387f","line":27,"in_reply_to":"3f79a3b5_451b5883","updated":"2018-10-23 02:27:11.000000000","message":"Like adam wrote in Alternatives, I think app_cred or trust is usually used for a case that user want to keep the delegation for a period of time. If a user just want to use the sub-role one time or just for a while, app_cred or trust seems a little heavy.\n\nIn this case, I\u0027m +1 for adam\u0027s proposal.","commit_id":"f487a2d7a44e03c41cf7b00fde1ce947004c0d2d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7e071be49f039930ee7494dc2e7b3cc26c6fdaaf","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"For this example, the user has the role `admin` assigned.  In this"},{"line_number":61,"context_line":"system, the role `admin` implies the role `Member`.  THe use wants to"},{"line_number":62,"context_line":"request a token with the `Member` role, but not the `admin` role."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"The request by role name would look like this:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3f79a3b5_b0faa80e","line":61,"range":{"start_line":61,"start_character":53,"end_line":61,"end_character":60},"updated":"2018-10-08 19:44:31.000000000","message":"The user*","commit_id":"f487a2d7a44e03c41cf7b00fde1ce947004c0d2d"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"034df013bec2d9325fd0987d78d318c37d772323","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"For this example, the user has the role `admin` assigned.  In this"},{"line_number":61,"context_line":"system, the role `admin` implies the role `Member`.  THe use wants to"},{"line_number":62,"context_line":"request a token with the `Member` role, but not the `admin` role."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"The request by role name would look like this:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3f79a3b5_45b06d8e","line":61,"range":{"start_line":61,"start_character":53,"end_line":61,"end_character":60},"in_reply_to":"3f79a3b5_b0faa80e","updated":"2018-10-30 21:41:36.000000000","message":"Done","commit_id":"f487a2d7a44e03c41cf7b00fde1ce947004c0d2d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7e071be49f039930ee7494dc2e7b3cc26c6fdaaf","unresolved":false,"context_lines":[{"line_number":111,"context_line":"                \"roles\": [{\"id\": \"987edf\",\"name\":\"Member\"}]"},{"line_number":112,"context_line":"            }"},{"line_number":113,"context_line":"        }"},{"line_number":114,"context_line":"    }"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3f79a3b5_90076c18","line":114,"updated":"2018-10-08 19:44:31.000000000","message":"Is this supposed to be a valid token response?","commit_id":"f487a2d7a44e03c41cf7b00fde1ce947004c0d2d"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"034df013bec2d9325fd0987d78d318c37d772323","unresolved":false,"context_lines":[{"line_number":111,"context_line":"                \"roles\": [{\"id\": \"987edf\",\"name\":\"Member\"}]"},{"line_number":112,"context_line":"            }"},{"line_number":113,"context_line":"        }"},{"line_number":114,"context_line":"    }"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3f79a3b5_05aa751a","line":114,"in_reply_to":"3f79a3b5_90076c18","updated":"2018-10-30 21:41:36.000000000","message":"It is supposed to be the subset that is relevant.  Updated to reflect that.","commit_id":"f487a2d7a44e03c41cf7b00fde1ce947004c0d2d"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a691ffad0b7df949de22ab0ebde0c7b31159020c","unresolved":false,"context_lines":[{"line_number":27,"context_line":"delegate a read-only operations as well."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":30,"context_line":"the most cited paper on this,"},{"line_number":31,"context_line":"`web.mit.edu/Saltzer/www/publications/protection/Basic.html`, dates"},{"line_number":32,"context_line":"back to 1974 but as he points out, this concept was already a well"},{"line_number":33,"context_line":"established security principal."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"ffb9cba7_8ff98081","line":31,"range":{"start_line":30,"start_character":0,"end_line":31,"end_character":60},"updated":"2019-04-24 00:31:08.000000000","message":"would be nice to have a proper RST link","commit_id":"cd0a6b4a0ecfa9f5c91100608ecb64263845b08a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a691ffad0b7df949de22ab0ebde0c7b31159020c","unresolved":false,"context_lines":[{"line_number":115,"context_line":"    }"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"In order to keep the implementation simple, the token would show up as"},{"line_number":119,"context_line":"a a trust token.    Upon the first request, Keystone would create a self"},{"line_number":120,"context_line":"trust with the user as both the trustor and trustee.  There would be"},{"line_number":121,"context_line":"no need to time-bound this trust.  By default, they would not be"},{"line_number":122,"context_line":"re-delegatable,  as that should be an explicit decision by the user."}],"source_content_type":"text/x-rst","patch_set":20,"id":"ffb9cba7_aff6c48e","line":119,"range":{"start_line":118,"start_character":0,"end_line":119,"end_character":16},"updated":"2019-04-24 00:31:08.000000000","message":"Why does it need to be a trust token and not just a regular project-scoped token?","commit_id":"cd0a6b4a0ecfa9f5c91100608ecb64263845b08a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a691ffad0b7df949de22ab0ebde0c7b31159020c","unresolved":false,"context_lines":[{"line_number":130,"context_line":"This breaks most major workflows.  It also means that users would need"},{"line_number":131,"context_line":"to set up such a delegation whenever they do any workflow;"},{"line_number":132,"context_line":"e.g. Horizon would Have to use tokens from one of those mechanisms to"},{"line_number":133,"context_line":"limit attack surface. Without this mechanism, standard token"},{"line_number":134,"context_line":"requests. This is much lighter."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":20,"id":"ffb9cba7_0f2b50eb","line":134,"range":{"start_line":133,"start_character":22,"end_line":134,"end_character":9},"updated":"2019-04-24 00:31:08.000000000","message":"finish this sentence?","commit_id":"cd0a6b4a0ecfa9f5c91100608ecb64263845b08a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a691ffad0b7df949de22ab0ebde0c7b31159020c","unresolved":false,"context_lines":[{"line_number":148,"context_line":"Other End User Impact"},{"line_number":149,"context_line":"---------------------"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Keystone client can take advantage of this change in the future to request"},{"line_number":152,"context_line":"tokens specifically with only the minimal set of roles required to"},{"line_number":153,"context_line":"service the request."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":20,"id":"ffb9cba7_8f3e6027","line":153,"range":{"start_line":151,"start_character":0,"end_line":153,"end_character":20},"updated":"2019-04-24 00:31:08.000000000","message":"keystoneclient/openstackclient don\u0027t usually just request tokens, they do that as step 1 of doing something else. What\u0027s the mechanism that will allow them to know which subset of roles they should add to the token to let them perform the operation they actually want to do?","commit_id":"cd0a6b4a0ecfa9f5c91100608ecb64263845b08a"}]}