)]}'
{"specs/liberty/add-isdomain-to-token.rst":[{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"ab8fb2f2e1007c4d3544ce79b31ab86535d0a47e","unresolved":false,"context_lines":[{"line_number":33,"context_line":"for a project that is acting as a domain. With that change, it would then"},{"line_number":34,"context_line":"be possible to write policy rules that today require a domain token, to"},{"line_number":35,"context_line":"instead work with regular project tokens, while still providing the same"},{"line_number":36,"context_line":"level of protection. For example, the a typical policy rule of::"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"\"identity:create_user\": \"rule:admin_required and domain_id:%(user.domain_id)s\""},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa32b979_fbffa531","line":36,"updated":"2015-06-24 21:45:14.000000000","message":"nit: \"the a\"","commit_id":"fd8cb61da920da411832fa912ff3097ae2db6288"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e13648217c31a92a148d5730376608e636e14e37","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"would be replaced with::"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"\"identity:create_user\": \"rule:admin_required and project_id:%(user.domain_id)s and is_domain:True\""},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"In a similar way, this would allow a nova policy file to specify that, for"},{"line_number":45,"context_line":"instance, servers were not allowed to be created in a project acting as a"}],"source_content_type":"text/x-rst","patch_set":10,"id":"fa32b979_bd676350","line":42,"updated":"2015-06-27 02:24:33.000000000","message":"to be clear, only the \u0027domain admin\u0027 rules should need the new is_domain:True part right?\n\ni don\u0027t want to have to re-write all the rules (like you suggest in compute:create below)","commit_id":"dd5369c01c649da1e2f8a4c540abd0e41ac443a3"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"11a3318f17925dcb571269efb7207c0dd4c06b51","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"would be replaced with::"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"\"identity:create_user\": \"rule:admin_required and project_id:%(user.domain_id)s and is_domain:True\""},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"In a similar way, this would allow a nova policy file to specify that, for"},{"line_number":45,"context_line":"instance, servers were not allowed to be created in a project acting as a"}],"source_content_type":"text/x-rst","patch_set":10,"id":"fa32b979_7d29db9a","line":42,"in_reply_to":"fa32b979_bd676350","updated":"2015-06-27 02:30:41.000000000","message":"Yes, you just need to change the domain admin, this compute:create was just an example that we can extend the \"is_domain\" for other services, like nova, without the service know about domain_id.","commit_id":"dd5369c01c649da1e2f8a4c540abd0e41ac443a3"}]}