)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"d2414508f3fff731d1dba6b647e208929105bb5f","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Context_is_admin policy definition from OpenStack services are"},{"line_number":10,"context_line":"not going to work well unless it is namespaced.  Namespacing"},{"line_number":11,"context_line":"allows each service to has its service admin defined under"},{"line_number":12,"context_line":"Unified Policy.  This is part of an ongoing effort to make"},{"line_number":13,"context_line":"policy better and resolve global admin bug."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"3afb71cf_f76b381c","line":11,"updated":"2015-06-10 16:15:41.000000000","message":"s/has/have/","commit_id":"1125feb3cb2f32b1db0cf548d18f2df3b6af6dc0"}],"specs/backlog/unified-namespaced-is-admin.rst":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"32ea437bf09a83db392558139a2908c8e3a7a3c5","unresolved":false,"context_lines":[{"line_number":21,"context_line":"on all scopes.  See bug 968696, https://bugs.launchpad.net/keystone/+bug/968696."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"In large organizations, this does not meet the need of restricting service"},{"line_number":24,"context_line":"access to only those authorized.  Oslo policy today provides the mechanism"},{"line_number":25,"context_line":"to do this, however due to lack of better default policy, there are a lot"},{"line_number":26,"context_line":"of hoops to jump through. Better common policy definition and vocabulary"},{"line_number":27,"context_line":"are needed."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_33b46b33","line":24,"updated":"2015-06-10 18:47:59.000000000","message":"this essentially amount to escalated privilege","commit_id":"1125feb3cb2f32b1db0cf548d18f2df3b6af6dc0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"32ea437bf09a83db392558139a2908c8e3a7a3c5","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Many services today have the following default context_is_admin"},{"line_number":33,"context_line":"definition."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"  \"context_is_admin\":  \"role:admin\""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Further name spacing is necessary to further distinguish service specific"},{"line_number":38,"context_line":"is_admin context in the common header.  For example,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_73dc2373","line":35,"updated":"2015-06-10 18:47:59.000000000","message":"an alternative would be something like\n\n    \"context_is_admin\": \"role:admin and project_id:%(service_admin_project_id)s\",\n\nwhere each service would define an \"admin\" project. But that\u0027s more of a hack than an elegant solution.","commit_id":"1125feb3cb2f32b1db0cf548d18f2df3b6af6dc0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"32ea437bf09a83db392558139a2908c8e3a7a3c5","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"  \"context_is_admin\":  \"role:admin\""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Further name spacing is necessary to further distinguish service specific"},{"line_number":38,"context_line":"is_admin context in the common header.  For example,"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  \"compute:context_is_admin\":  \"role:admin\""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_d3c75796","line":37,"updated":"2015-06-10 18:47:59.000000000","message":"didn\u0027t we have a separate spec to deal with namespacing? Not sure if we want to mix the two here. As one is not a requirement for the other.","commit_id":"1125feb3cb2f32b1db0cf548d18f2df3b6af6dc0"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"d2414508f3fff731d1dba6b647e208929105bb5f","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  \"compute:context_is_admin\":  \"role:admin\""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Take it one step further to allow users with computer_admin role to"},{"line_number":43,"context_line":"perform computer admin actions.  For example,"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"  “compute:context_is_admin\":  \"role:admin or role:compute_admin\""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_373d50dd","line":42,"updated":"2015-06-10 16:15:41.000000000","message":"s/computer_admin/compute_admin/","commit_id":"1125feb3cb2f32b1db0cf548d18f2df3b6af6dc0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"32ea437bf09a83db392558139a2908c8e3a7a3c5","unresolved":false,"context_lines":[{"line_number":67,"context_line":"  \"compute_admin\": \"rule:admin_required and domain_id:compute_admin_domain_id\""},{"line_number":68,"context_line":"  \"storage_admin\": \"rule:admin_required and domain_id:storage_admin_domain_id\""},{"line_number":69,"context_line":"  \"network_admin\": \"rule:admin_required and domain_id:network_admin_domain_id\""},{"line_number":70,"context_line":"  \"image_admin\": \"rule:admin_required and domain_id:image_admin_domain_id\""},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"  “compute:context_is_admin\":  \"rule:compute_admin\""},{"line_number":73,"context_line":"  “storage:context_is_admin\":  \"rule:storage_admin\""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_6b81a0fa","line":70,"updated":"2015-06-10 18:47:59.000000000","message":"would be much easier to create a different project for the service admin then creating a different domain","commit_id":"1125feb3cb2f32b1db0cf548d18f2df3b6af6dc0"}]}