)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"0dad9cf5cb17867ee685dee4a6daac1503c1c8b9","unresolved":false,"context_lines":[{"line_number":10,"context_line":"used with the implied roles functionality to allow a domain"},{"line_number":11,"context_line":"administrator to better model their role usage."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Implments domain-specific-roles"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: I2aa390edca32734857e5f3cc8decacf4072e697a"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":25,"id":"ba8a016a_902b25eb","line":13,"updated":"2015-11-25 12:21:11.000000000","message":"(typo) Implements\n\nImplements: blueprint domain-specific-roles","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"275005881a2a2993ad2a59ebe5cd5392ab4c5432","unresolved":false,"context_lines":[{"line_number":10,"context_line":"used with the implied roles functionality to allow a domain"},{"line_number":11,"context_line":"administrator to better model their role usage."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Implments domain-specific-roles"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: I2aa390edca32734857e5f3cc8decacf4072e697a"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":25,"id":"9a8ffd7b_5c4c2170","line":13,"in_reply_to":"ba8a016a_902b25eb","updated":"2015-11-25 12:38:03.000000000","message":"Done","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"}],"api/v3/identity-api-v3.rst":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9401be4c644cbb15f2ba1905b313c4f2fb1f2748","unresolved":false,"context_lines":[{"line_number":987,"context_line":"                \"self\": \"http://identity:35357/v3/roles/76e72a\""},{"line_number":988,"context_line":"            },"},{"line_number":989,"context_line":"            \"name\": \"admin\","},{"line_number":990,"context_line":"            \"virtual\": \"false\","},{"line_number":991,"context_line":"        }"},{"line_number":992,"context_line":"    }"},{"line_number":993,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_6f831e57","line":990,"updated":"2015-09-28 18:46:03.000000000","message":"I don\u0027t see a need for the \"virtual\" flag. I am not a big fan of overloading existing concepts. A new resource like role_group would be more intuitive.","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"132ad0354048e0046d07b98d15b81eee6be6352a","unresolved":false,"context_lines":[{"line_number":987,"context_line":"                \"self\": \"http://identity:35357/v3/roles/76e72a\""},{"line_number":988,"context_line":"            },"},{"line_number":989,"context_line":"            \"name\": \"admin\","},{"line_number":990,"context_line":"            \"virtual\": \"false\","},{"line_number":991,"context_line":"        }"},{"line_number":992,"context_line":"    }"},{"line_number":993,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_4f522069","line":990,"in_reply_to":"9a1a9d01_455b9b2e","updated":"2015-10-06 16:05:58.000000000","message":"I do apologize if I suggested overloading roles last time. This is essentially the same argument for not overloading domains with *special projects*. Its hard to explain to users the difference.","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"55c7230998b0a6215e643206de28deeb25f33773","unresolved":false,"context_lines":[{"line_number":987,"context_line":"                \"self\": \"http://identity:35357/v3/roles/76e72a\""},{"line_number":988,"context_line":"            },"},{"line_number":989,"context_line":"            \"name\": \"admin\","},{"line_number":990,"context_line":"            \"virtual\": \"false\","},{"line_number":991,"context_line":"        }"},{"line_number":992,"context_line":"    }"},{"line_number":993,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_455b9b2e","line":990,"in_reply_to":"9a1a9d01_6f831e57","updated":"2015-09-28 19:55:52.000000000","message":"I thought last time around you argued strongly to use the same role entities for this and NOT great a different entity type....","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":20,"context_line":"- Enable or disable a subtree in the project hierarchy."},{"line_number":21,"context_line":"- Delete a subtree in the project hierarchy."},{"line_number":22,"context_line":"- Support for domain specific roles."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"What\u0027s New in Version 3.5"},{"line_number":25,"context_line":"-------------------------"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_1fd94222","line":23,"updated":"2015-11-02 20:31:16.000000000","message":"What\u0027s New in Version 3.6\n\n...","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"141c239545008115ff1576b015a80cf8f362174e","unresolved":false,"context_lines":[{"line_number":4844,"context_line":""},{"line_number":4845,"context_line":"Request:"},{"line_number":4846,"context_line":""},{"line_number":4847,"context_line":"::"},{"line_number":4848,"context_line":""},{"line_number":4849,"context_line":"    {"},{"line_number":4850,"context_line":"        \"role\": {"}],"source_content_type":"text/x-rst","patch_set":23,"id":"ba8a016a_cdbecc64","line":4847,"updated":"2015-11-18 18:04:49.000000000","message":"Maybe an aexample here for creating a DSR?","commit_id":"167fd090f15df0497a34b72699bfbeba6ab11033"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4ebe83be528234f09377556e573ba823d99b1be5","unresolved":false,"context_lines":[{"line_number":4844,"context_line":""},{"line_number":4845,"context_line":"Request:"},{"line_number":4846,"context_line":""},{"line_number":4847,"context_line":"::"},{"line_number":4848,"context_line":""},{"line_number":4849,"context_line":"    {"},{"line_number":4850,"context_line":"        \"role\": {"}],"source_content_type":"text/x-rst","patch_set":23,"id":"ba8a016a_f65cb47e","line":4847,"in_reply_to":"ba8a016a_cdbecc64","updated":"2015-11-18 21:46:28.000000000","message":"Done","commit_id":"167fd090f15df0497a34b72699bfbeba6ab11033"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"141c239545008115ff1576b015a80cf8f362174e","unresolved":false,"context_lines":[{"line_number":4934,"context_line":""},{"line_number":4935,"context_line":"    {"},{"line_number":4936,"context_line":"        \"role\": {"},{"line_number":4937,"context_line":"            \"domain_id\": \"--domain-id--\","},{"line_number":4938,"context_line":"            \"id\": \"--role-id--\","},{"line_number":4939,"context_line":"            \"links\": {"},{"line_number":4940,"context_line":"                \"self\": \"http://identity:35357/v3/roles/--role-id--\""}],"source_content_type":"text/x-rst","patch_set":23,"id":"ba8a016a_0dfb7448","line":4937,"updated":"2015-11-18 18:04:49.000000000","message":"I think we need to specify that this value is immutable.  If a DSR can overwrite a Non DSR we will have trouble.","commit_id":"167fd090f15df0497a34b72699bfbeba6ab11033"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4ebe83be528234f09377556e573ba823d99b1be5","unresolved":false,"context_lines":[{"line_number":4934,"context_line":""},{"line_number":4935,"context_line":"    {"},{"line_number":4936,"context_line":"        \"role\": {"},{"line_number":4937,"context_line":"            \"domain_id\": \"--domain-id--\","},{"line_number":4938,"context_line":"            \"id\": \"--role-id--\","},{"line_number":4939,"context_line":"            \"links\": {"},{"line_number":4940,"context_line":"                \"self\": \"http://identity:35357/v3/roles/--role-id--\""}],"source_content_type":"text/x-rst","patch_set":23,"id":"ba8a016a_b6538c6a","line":4937,"in_reply_to":"ba8a016a_0dfb7448","updated":"2015-11-18 21:46:28.000000000","message":"Done","commit_id":"167fd090f15df0497a34b72699bfbeba6ab11033"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"0dad9cf5cb17867ee685dee4a6daac1503c1c8b9","unresolved":false,"context_lines":[{"line_number":966,"context_line":"specific role can be used to build role inference rules that better model the"},{"line_number":967,"context_line":"sets of policy roles that need to be assigned for users or groups of a"},{"line_number":968,"context_line":"particular domain. Domain specific roles never actually appear in policy files,"},{"line_number":969,"context_line":"they are expanded into their implied policy roles at token"},{"line_number":970,"context_line":"generation/validation time."},{"line_number":971,"context_line":""},{"line_number":972,"context_line":"Additional required attributes:"}],"source_content_type":"text/x-rst","patch_set":25,"id":"9a8ffd7b_d6e792e2","line":969,"updated":"2015-11-25 12:21:11.000000000","message":"(nit) \"global policy roles\" would make it clearer, imo","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"275005881a2a2993ad2a59ebe5cd5392ab4c5432","unresolved":false,"context_lines":[{"line_number":966,"context_line":"specific role can be used to build role inference rules that better model the"},{"line_number":967,"context_line":"sets of policy roles that need to be assigned for users or groups of a"},{"line_number":968,"context_line":"particular domain. Domain specific roles never actually appear in policy files,"},{"line_number":969,"context_line":"they are expanded into their implied policy roles at token"},{"line_number":970,"context_line":"generation/validation time."},{"line_number":971,"context_line":""},{"line_number":972,"context_line":"Additional required attributes:"}],"source_content_type":"text/x-rst","patch_set":25,"id":"9a8ffd7b_814546b4","line":969,"in_reply_to":"9a8ffd7b_d6e792e2","updated":"2015-11-25 12:38:03.000000000","message":"Done","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"43ef32ae886007612f452323eb6dd51122de7fb9","unresolved":false,"context_lines":[{"line_number":977,"context_line":""},{"line_number":978,"context_line":"Optional attributes:"},{"line_number":979,"context_line":""},{"line_number":980,"context_line":"- ``domain_id`` (string, defaults to null) *New in version 3.6*"},{"line_number":981,"context_line":"  This attribute is immutable."},{"line_number":982,"context_line":""},{"line_number":983,"context_line":"Example entity:"}],"source_content_type":"text/x-rst","patch_set":25,"id":"ba8a016a_7be14c29","line":980,"updated":"2015-11-19 22:11:10.000000000","message":"i would have just settled for:\n\n  ``domain_id`` (string) *New in version 3.6*\n\nI would like this treated the same way as \u0027name\u0027","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"275005881a2a2993ad2a59ebe5cd5392ab4c5432","unresolved":false,"context_lines":[{"line_number":977,"context_line":""},{"line_number":978,"context_line":"Optional attributes:"},{"line_number":979,"context_line":""},{"line_number":980,"context_line":"- ``domain_id`` (string, defaults to null) *New in version 3.6*"},{"line_number":981,"context_line":"  This attribute is immutable."},{"line_number":982,"context_line":""},{"line_number":983,"context_line":"Example entity:"}],"source_content_type":"text/x-rst","patch_set":25,"id":"9a8ffd7b_812b0694","line":980,"in_reply_to":"ba8a016a_7be14c29","updated":"2015-11-25 12:38:03.000000000","message":"Done","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"0dad9cf5cb17867ee685dee4a6daac1503c1c8b9","unresolved":false,"context_lines":[{"line_number":5001,"context_line":"            \"links\": {"},{"line_number":5002,"context_line":"                \"self\": \"http://identity:35357/v3/roles/--role-id--\""},{"line_number":5003,"context_line":"            },"},{"line_number":5004,"context_line":"            \"name\": \"a role name\""},{"line_number":5005,"context_line":"        }"},{"line_number":5006,"context_line":"    }"},{"line_number":5007,"context_line":""}],"source_content_type":"text/x-rst","patch_set":25,"id":"9a8ffd7b_b669ae27","line":5004,"updated":"2015-11-25 12:21:11.000000000","message":"Perhaps \"a global role name\" ?","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"275005881a2a2993ad2a59ebe5cd5392ab4c5432","unresolved":false,"context_lines":[{"line_number":5001,"context_line":"            \"links\": {"},{"line_number":5002,"context_line":"                \"self\": \"http://identity:35357/v3/roles/--role-id--\""},{"line_number":5003,"context_line":"            },"},{"line_number":5004,"context_line":"            \"name\": \"a role name\""},{"line_number":5005,"context_line":"        }"},{"line_number":5006,"context_line":"    }"},{"line_number":5007,"context_line":""}],"source_content_type":"text/x-rst","patch_set":25,"id":"9a8ffd7b_a1f96a82","line":5004,"in_reply_to":"9a8ffd7b_b669ae27","updated":"2015-11-25 12:38:03.000000000","message":"Done","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ed65c1f50198979e9a7f1e62f36bcc3dec79b820","unresolved":false,"context_lines":[{"line_number":4917,"context_line":""},{"line_number":4918,"context_line":"  Since this defaults to null, listing roles without specifying ``domain_id``"},{"line_number":4919,"context_line":"  in the query string will result in a collection containing only global roles."},{"line_number":4920,"context_line":""},{"line_number":4921,"context_line":"Response:"},{"line_number":4922,"context_line":""},{"line_number":4923,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":28,"id":"9a8ffd7b_c5a47e4c","line":4920,"updated":"2015-12-02 14:34:06.000000000","message":"should we provide a way to display ALLl domain specific roles for cloud admin?\n\nor provide a way to determine what domains has domain specific roles.","commit_id":"15713bf9b55a3335f54fe9e8983580b28bb1fbc2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"6dd64269f794808cace806268f6f522894695f3a","unresolved":false,"context_lines":[{"line_number":4917,"context_line":""},{"line_number":4918,"context_line":"  Since this defaults to null, listing roles without specifying ``domain_id``"},{"line_number":4919,"context_line":"  in the query string will result in a collection containing only global roles."},{"line_number":4920,"context_line":""},{"line_number":4921,"context_line":"Response:"},{"line_number":4922,"context_line":""},{"line_number":4923,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":28,"id":"9a8ffd7b_6555571c","line":4920,"in_reply_to":"9a8ffd7b_c5a47e4c","updated":"2015-12-03 08:35:11.000000000","message":"So we could.  Alternatively, over time, we could relax (with deprecation) that the domain_id defaults to none (once UIs have got used to the fact that there could be more than role with with same Name, if you include domain specific roles). I\u0027d like to suggest that we leave this to a follow on enhancement, once we see how this is taken up.","commit_id":"15713bf9b55a3335f54fe9e8983580b28bb1fbc2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ed65c1f50198979e9a7f1e62f36bcc3dec79b820","unresolved":false,"context_lines":[{"line_number":4968,"context_line":""},{"line_number":4969,"context_line":"    {"},{"line_number":4970,"context_line":"        \"role\": {"},{"line_number":4971,"context_line":"            \"domain_id\": \"--domain-id--\","},{"line_number":4972,"context_line":"            \"id\": \"--role-id--\","},{"line_number":4973,"context_line":"            \"links\": {"},{"line_number":4974,"context_line":"                \"self\": \"http://identity:35357/v3/roles/--role-id--\""}],"source_content_type":"text/x-rst","patch_set":28,"id":"9a8ffd7b_c548feb5","line":4971,"updated":"2015-12-02 14:34:06.000000000","message":"should this be null? so that all our examples are using global roles.","commit_id":"15713bf9b55a3335f54fe9e8983580b28bb1fbc2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"6dd64269f794808cace806268f6f522894695f3a","unresolved":false,"context_lines":[{"line_number":4968,"context_line":""},{"line_number":4969,"context_line":"    {"},{"line_number":4970,"context_line":"        \"role\": {"},{"line_number":4971,"context_line":"            \"domain_id\": \"--domain-id--\","},{"line_number":4972,"context_line":"            \"id\": \"--role-id--\","},{"line_number":4973,"context_line":"            \"links\": {"},{"line_number":4974,"context_line":"                \"self\": \"http://identity:35357/v3/roles/--role-id--\""}],"source_content_type":"text/x-rst","patch_set":28,"id":"9a8ffd7b_654b17b2","line":4971,"in_reply_to":"9a8ffd7b_c548feb5","updated":"2015-12-03 08:35:11.000000000","message":"so this is, of course, meant to be a domain specific role...I don\u0027t think that\u0027s an issue - other examples show global roles.","commit_id":"15713bf9b55a3335f54fe9e8983580b28bb1fbc2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ed65c1f50198979e9a7f1e62f36bcc3dec79b820","unresolved":false,"context_lines":[{"line_number":4998,"context_line":""},{"line_number":4999,"context_line":"    {"},{"line_number":5000,"context_line":"        \"role\": {"},{"line_number":5001,"context_line":"            \"domain_id\": null\","},{"line_number":5002,"context_line":"            \"id\": \"--role-id--\","},{"line_number":5003,"context_line":"            \"links\": {"},{"line_number":5004,"context_line":"                \"self\": \"http://identity:35357/v3/roles/--role-id--\""}],"source_content_type":"text/x-rst","patch_set":28,"id":"9a8ffd7b_2580eabe","line":5001,"updated":"2015-12-02 14:34:06.000000000","message":"extra \" at the end","commit_id":"15713bf9b55a3335f54fe9e8983580b28bb1fbc2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"6dd64269f794808cace806268f6f522894695f3a","unresolved":false,"context_lines":[{"line_number":4998,"context_line":""},{"line_number":4999,"context_line":"    {"},{"line_number":5000,"context_line":"        \"role\": {"},{"line_number":5001,"context_line":"            \"domain_id\": null\","},{"line_number":5002,"context_line":"            \"id\": \"--role-id--\","},{"line_number":5003,"context_line":"            \"links\": {"},{"line_number":5004,"context_line":"                \"self\": \"http://identity:35357/v3/roles/--role-id--\""}],"source_content_type":"text/x-rst","patch_set":28,"id":"9a8ffd7b_c523e3bb","line":5001,"in_reply_to":"9a8ffd7b_2580eabe","updated":"2015-12-03 08:35:11.000000000","message":"happy to clear this up as a follow on patch, if that\u0027s Ok","commit_id":"15713bf9b55a3335f54fe9e8983580b28bb1fbc2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7723d253e18479691527463d8cf0957d03e3fc16","unresolved":false,"context_lines":[{"line_number":4998,"context_line":""},{"line_number":4999,"context_line":"    {"},{"line_number":5000,"context_line":"        \"role\": {"},{"line_number":5001,"context_line":"            \"domain_id\": null\","},{"line_number":5002,"context_line":"            \"id\": \"--role-id--\","},{"line_number":5003,"context_line":"            \"links\": {"},{"line_number":5004,"context_line":"                \"self\": \"http://identity:35357/v3/roles/--role-id--\""}],"source_content_type":"text/x-rst","patch_set":28,"id":"9a8ffd7b_00f559eb","line":5001,"in_reply_to":"9a8ffd7b_c523e3bb","updated":"2015-12-03 08:39:41.000000000","message":"actually - had to rebase, so fixed it.","commit_id":"15713bf9b55a3335f54fe9e8983580b28bb1fbc2"}],"specs/backlog/virtual-roles.rst":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4a790075a4b88f4f9f72fe2228c969ff9f569fb7","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of virtual roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"policy roles or other virtual roles). A virtual role can be used as part of an"},{"line_number":15,"context_line":"assignment, in the same was as you can assign an individual, global policy"},{"line_number":16,"context_line":"role."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This proposal replaces previous ones for domain-roles and role-groups, which"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_489c46c0","line":15,"updated":"2015-09-26 04:56:56.000000000","message":"s/was/way","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d992c29b9a066df966bddb7ad96a49f87e508352","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of virtual roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"policy roles or other virtual roles). A virtual role can be used as part of an"},{"line_number":15,"context_line":"assignment, in the same was as you can assign an individual, global policy"},{"line_number":16,"context_line":"role."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This proposal replaces previous ones for domain-roles and role-groups, which"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_042dc545","line":15,"in_reply_to":"9a1a9d01_489c46c0","updated":"2015-09-28 09:14:02.000000000","message":"Done","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4a790075a4b88f4f9f72fe2228c969ff9f569fb7","unresolved":false,"context_lines":[{"line_number":15,"context_line":"assignment, in the same was as you can assign an individual, global policy"},{"line_number":16,"context_line":"role."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This proposal replaces previous ones for domain-roles and role-groups, which"},{"line_number":19,"context_line":"this essentially encompasses and extends."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_a85e4210","line":18,"updated":"2015-09-26 04:56:56.000000000","message":"Can you include a reference to the other proposals?","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d992c29b9a066df966bddb7ad96a49f87e508352","unresolved":false,"context_lines":[{"line_number":15,"context_line":"assignment, in the same was as you can assign an individual, global policy"},{"line_number":16,"context_line":"role."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This proposal replaces previous ones for domain-roles and role-groups, which"},{"line_number":19,"context_line":"this essentially encompasses and extends."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_2430099e","line":18,"in_reply_to":"9a1a9d01_a85e4210","updated":"2015-09-28 09:14:02.000000000","message":"Done","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4a790075a4b88f4f9f72fe2228c969ff9f569fb7","unresolved":false,"context_lines":[{"line_number":32,"context_line":"may change quite often. There are two classic examples of this:"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"- A cloud administrator wanting to create roles that allow their users or"},{"line_number":35,"context_line":"  customers to better model they usage patterns, independent of specific"},{"line_number":36,"context_line":"  service policy files."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- A domain administrator wanting to create roles that are meaningful to the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_087dee6d","line":35,"updated":"2015-09-26 04:56:56.000000000","message":"s/they/their","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4a790075a4b88f4f9f72fe2228c969ff9f569fb7","unresolved":false,"context_lines":[{"line_number":46,"context_line":"Proposed Change"},{"line_number":47,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"It is proposed that we allow the creation of virtual roles, which can contain a"},{"line_number":50,"context_line":"list of one or more policy roles and/or other virtual roles. These virtual"},{"line_number":51,"context_line":"roles can either be global or domain specific."},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_c8b05646","line":49,"updated":"2015-09-26 04:56:56.000000000","message":"This change makes sense, but why the name \"virtual\" roles.","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d992c29b9a066df966bddb7ad96a49f87e508352","unresolved":false,"context_lines":[{"line_number":46,"context_line":"Proposed Change"},{"line_number":47,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"It is proposed that we allow the creation of virtual roles, which can contain a"},{"line_number":50,"context_line":"list of one or more policy roles and/or other virtual roles. These virtual"},{"line_number":51,"context_line":"roles can either be global or domain specific."},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_7ec9c077","line":49,"in_reply_to":"9a1a9d01_c8b05646","updated":"2015-09-28 09:14:02.000000000","message":"So we\u0027ve alway struggled with a name for this! In the ideal world what is described here would be \"roles\"and what we call roles today would be \"policy roles\"...but we\u0027re not starting from a blank sheet of paper.  I\u0027m totally open to a different name for what I\u0027m proposing here!","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4a790075a4b88f4f9f72fe2228c969ff9f569fb7","unresolved":false,"context_lines":[{"line_number":94,"context_line":"Data Model Impact"},{"line_number":95,"context_line":"-----------------"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"For SQL, the roles table will expanded to support virtual roles. A new table"},{"line_number":98,"context_line":"virtual-members tables will be created to support the member roles of a vitrual"},{"line_number":99,"context_line":"role (in a similar way to groups). Since roles are stored in the Assignment"},{"line_number":100,"context_line":"backend, it is proposed that we do not support these in the Assignment LDAP"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_6886ea66","line":97,"updated":"2015-09-26 04:56:56.000000000","message":"Can we please make sure these new user facing roles have a description associated with them?  The existing policy roles do not.  And I think descriptions are essential when following the use cases described for this new type of role.","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d992c29b9a066df966bddb7ad96a49f87e508352","unresolved":false,"context_lines":[{"line_number":94,"context_line":"Data Model Impact"},{"line_number":95,"context_line":"-----------------"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"For SQL, the roles table will expanded to support virtual roles. A new table"},{"line_number":98,"context_line":"virtual-members tables will be created to support the member roles of a vitrual"},{"line_number":99,"context_line":"role (in a similar way to groups). Since roles are stored in the Assignment"},{"line_number":100,"context_line":"backend, it is proposed that we do not support these in the Assignment LDAP"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_9ec4d45f","line":97,"in_reply_to":"9a1a9d01_6886ea66","updated":"2015-09-28 09:14:02.000000000","message":"Agreed.","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"0b4ef4c2abfe904f3640bcbe7a77c21e108919c3","unresolved":false,"context_lines":[{"line_number":94,"context_line":"Data Model Impact"},{"line_number":95,"context_line":"-----------------"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"For SQL, the roles table will expanded to support virtual roles. A new table"},{"line_number":98,"context_line":"virtual-members tables will be created to support the member roles of a vitrual"},{"line_number":99,"context_line":"role (in a similar way to groups). Since roles are stored in the Assignment"},{"line_number":100,"context_line":"backend, it is proposed that we do not support these in the Assignment LDAP"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_5fee24b5","line":97,"in_reply_to":"9a1a9d01_9ec4d45f","updated":"2015-09-28 09:16:57.000000000","message":"...although I think I will introduce that as a separate change...","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"6096f4a9d51fb911a1f1bec74f1f6bdbf593493d","unresolved":false,"context_lines":[{"line_number":95,"context_line":"-----------------"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"For SQL, the roles table will expanded to support virtual roles. A new table"},{"line_number":98,"context_line":"virtual-members tables will be created to support the member roles of a vitrual"},{"line_number":99,"context_line":"role (in a similar way to groups). Since roles are stored in the Assignment"},{"line_number":100,"context_line":"backend, it is proposed that we do not support these in the Assignment LDAP"},{"line_number":101,"context_line":"backend."}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_22cb3d55","line":98,"updated":"2015-09-25 18:57:49.000000000","message":"s/vitrual/virtual/","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d992c29b9a066df966bddb7ad96a49f87e508352","unresolved":false,"context_lines":[{"line_number":95,"context_line":"-----------------"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"For SQL, the roles table will expanded to support virtual roles. A new table"},{"line_number":98,"context_line":"virtual-members tables will be created to support the member roles of a vitrual"},{"line_number":99,"context_line":"role (in a similar way to groups). Since roles are stored in the Assignment"},{"line_number":100,"context_line":"backend, it is proposed that we do not support these in the Assignment LDAP"},{"line_number":101,"context_line":"backend."}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_441bbd1b","line":98,"in_reply_to":"9a1a9d01_22cb3d55","updated":"2015-09-28 09:14:02.000000000","message":"Done","commit_id":"918a089d527e8b7a14b25ed9a730ea54157918fe"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9401be4c644cbb15f2ba1905b313c4f2fb1f2748","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp virtual-roles \u003chttps://blueprints.launchpad.net/keystone/+spec/virtual-roles\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of virtual roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"policy roles or other virtual roles). A virtual role can be used as part of an"},{"line_number":15,"context_line":"assignment, in the same way as you can assign an individual, global policy"},{"line_number":16,"context_line":"role."}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_0cce305a","line":13,"updated":"2015-09-28 18:46:03.000000000","message":"Not trying to be picky, but why do we decided to call them \"virtual roles\"? They are essentially role groups.","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"b28c0a536746db9bf2dd7315c5c7c5dea0e2a7de","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp virtual-roles \u003chttps://blueprints.launchpad.net/keystone/+spec/virtual-roles\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of virtual roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"policy roles or other virtual roles). A virtual role can be used as part of an"},{"line_number":15,"context_line":"assignment, in the same way as you can assign an individual, global policy"},{"line_number":16,"context_line":"role."}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_2ae7fdac","line":13,"in_reply_to":"9a1a9d01_0565a3df","updated":"2015-09-30 14:24:23.000000000","message":"I think it would be good to define the terms in order to exclude guessing: you use \"virtual role\", \"policy role\", \"domain scoped role\" and just \"role\".","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"55c7230998b0a6215e643206de28deeb25f33773","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp virtual-roles \u003chttps://blueprints.launchpad.net/keystone/+spec/virtual-roles\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of virtual roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"policy roles or other virtual roles). A virtual role can be used as part of an"},{"line_number":15,"context_line":"assignment, in the same way as you can assign an individual, global policy"},{"line_number":16,"context_line":"role."}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_0565a3df","line":13,"in_reply_to":"9a1a9d01_0cce305a","updated":"2015-09-28 19:55:52.000000000","message":"so last time I called these role-groups many people objected...I\u0027m totally open to a new name! If we want to go back to role groups, that\u0027s fine too...","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"132ad0354048e0046d07b98d15b81eee6be6352a","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp virtual-roles \u003chttps://blueprints.launchpad.net/keystone/+spec/virtual-roles\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of virtual roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"policy roles or other virtual roles). A virtual role can be used as part of an"},{"line_number":15,"context_line":"assignment, in the same way as you can assign an individual, global policy"},{"line_number":16,"context_line":"role."}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_f2b9932f","line":13,"in_reply_to":"9a1a9d01_2ae7fdac","updated":"2015-10-06 16:05:58.000000000","message":"The issue is that these are fundamentally different from the *roles* in the services\u0027 policy.json files. Lets give it a more distinguished name so we can easily tell them apart.\n\nbtw, unrelated, but we are already having a hard time explaining to people the difference between project and special project, region and virtual region, etc. Lets not go down this path again.","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9401be4c644cbb15f2ba1905b313c4f2fb1f2748","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Allow the creation of virtual roles (which can be hierarchical and contain"},{"line_number":14,"context_line":"policy roles or other virtual roles). A virtual role can be used as part of an"},{"line_number":15,"context_line":"assignment, in the same way as you can assign an individual, global policy"},{"line_number":16,"context_line":"role."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This proposal replaces previous ones for domain-roles and role-groups, which"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_ecf97c81","line":15,"updated":"2015-09-28 18:46:03.000000000","message":"again, this sound like role groups, much the same way as user groups","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9401be4c644cbb15f2ba1905b313c4f2fb1f2748","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"The existing definition of a role is a direct link to the policy rules, i.e."},{"line_number":27,"context_line":"the role name is the item that is referenced directly from policy. This will be"},{"line_number":28,"context_line":"referred to as a \"policy role\" in this blueprint."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The policy files that reference policy roles are and should be tightly"},{"line_number":31,"context_line":"controlled in any cloud. An error in one of these files could be very"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_ac4aa4c3","line":28,"updated":"2015-09-28 18:46:03.000000000","message":"call them what they are, a rule","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"55c7230998b0a6215e643206de28deeb25f33773","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"The existing definition of a role is a direct link to the policy rules, i.e."},{"line_number":27,"context_line":"the role name is the item that is referenced directly from policy. This will be"},{"line_number":28,"context_line":"referred to as a \"policy role\" in this blueprint."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The policy files that reference policy roles are and should be tightly"},{"line_number":31,"context_line":"controlled in any cloud. An error in one of these files could be very"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_e5de6f6c","line":28,"in_reply_to":"9a1a9d01_ac4aa4c3","updated":"2015-09-28 19:55:52.000000000","message":"...no I don\u0027t think so...there are a role that appears in a policy rule","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e5298d2257c347356d366e85e33f8b07f40102b3","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"The existing definition of a role is a direct link to the policy rules, i.e."},{"line_number":27,"context_line":"the role name is the item that is referenced directly from policy. This will be"},{"line_number":28,"context_line":"referred to as a \"policy role\" in this blueprint."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The policy files that reference policy roles are and should be tightly"},{"line_number":31,"context_line":"controlled in any cloud. An error in one of these files could be very"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_6f57dc02","line":28,"in_reply_to":"9a1a9d01_e5de6f6c","updated":"2015-10-06 15:47:29.000000000","message":"Even so this needs to be made more clear in the write up.   Need to clearly define and distinguish between policy roles and policy rules","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9401be4c644cbb15f2ba1905b313c4f2fb1f2748","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The policy files that reference policy roles are and should be tightly"},{"line_number":31,"context_line":"controlled in any cloud. An error in one of these files could be very"},{"line_number":32,"context_line":"damaging. As such, they are not likely to be changed too often. The modeling"},{"line_number":33,"context_line":"of a set of human-understandable roles that might be given to users, however,"},{"line_number":34,"context_line":"may change quite often. There are two classic examples of this:"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_6c96ccf1","line":32,"updated":"2015-09-28 18:46:03.000000000","message":"This requires granular \"rules\" in the policy files in order for your proposal to be effective. If the policies continues to have either \"admin\" or \"owner\", virtual roles/role groups aren\u0027t going to be very useful. For example, how are you going to crate a read-only observor without changing the existing policies?","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"55c7230998b0a6215e643206de28deeb25f33773","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The policy files that reference policy roles are and should be tightly"},{"line_number":31,"context_line":"controlled in any cloud. An error in one of these files could be very"},{"line_number":32,"context_line":"damaging. As such, they are not likely to be changed too often. The modeling"},{"line_number":33,"context_line":"of a set of human-understandable roles that might be given to users, however,"},{"line_number":34,"context_line":"may change quite often. There are two classic examples of this:"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_c5b56b31","line":32,"in_reply_to":"9a1a9d01_6c96ccf1","updated":"2015-09-28 19:55:52.000000000","message":"we\u0027re not trying to enforce what they should do....just give a cloud provider the option on how they split their policy file creation and role naming.","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"132ad0354048e0046d07b98d15b81eee6be6352a","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The policy files that reference policy roles are and should be tightly"},{"line_number":31,"context_line":"controlled in any cloud. An error in one of these files could be very"},{"line_number":32,"context_line":"damaging. As such, they are not likely to be changed too often. The modeling"},{"line_number":33,"context_line":"of a set of human-understandable roles that might be given to users, however,"},{"line_number":34,"context_line":"may change quite often. There are two classic examples of this:"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_f2be73fe","line":32,"in_reply_to":"9a1a9d01_c5b56b31","updated":"2015-10-06 16:05:58.000000000","message":"I am merely pointing out that policy customization inevitable in order for this feature to be effective.","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9401be4c644cbb15f2ba1905b313c4f2fb1f2748","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"- A cloud administrator wanting to create roles that allow their users or"},{"line_number":37,"context_line":"  customers to better model they usage patterns, independent of specific"},{"line_number":38,"context_line":"  service policy files."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"- A domain administrator wanting to create roles that are meaningful to the"},{"line_number":41,"context_line":"  particular users of that domain (but may make no sense to users in other"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_ac59445c","line":38,"updated":"2015-09-28 18:46:03.000000000","message":"See above. How are we going to create a read-only observor without changing the existing policies? Point is this functionality is very much limited to what the policies can offer.","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9401be4c644cbb15f2ba1905b313c4f2fb1f2748","unresolved":false,"context_lines":[{"line_number":40,"context_line":"- A domain administrator wanting to create roles that are meaningful to the"},{"line_number":41,"context_line":"  particular users of that domain (but may make no sense to users in other"},{"line_number":42,"context_line":"  domains). They also want to be able to name the roles within the domain"},{"line_number":43,"context_line":"  namespace (like users, groups and projects)."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Today, however, all roles are global in scope and new roles are only relevant"},{"line_number":46,"context_line":"if the policy files are modified - so neither of the above are possible."}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_ac82a492","line":43,"updated":"2015-09-28 18:46:03.000000000","message":"Can you please provide an example on how they are being utilized?","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e5298d2257c347356d366e85e33f8b07f40102b3","unresolved":false,"context_lines":[{"line_number":40,"context_line":"- A domain administrator wanting to create roles that are meaningful to the"},{"line_number":41,"context_line":"  particular users of that domain (but may make no sense to users in other"},{"line_number":42,"context_line":"  domains). They also want to be able to name the roles within the domain"},{"line_number":43,"context_line":"  namespace (like users, groups and projects)."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Today, however, all roles are global in scope and new roles are only relevant"},{"line_number":46,"context_line":"if the policy files are modified - so neither of the above are possible."}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_2fdec46d","line":43,"in_reply_to":"9a1a9d01_25b547ed","updated":"2015-10-06 15:47:29.000000000","message":"These type of descriptions should be added to the spec","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"55c7230998b0a6215e643206de28deeb25f33773","unresolved":false,"context_lines":[{"line_number":40,"context_line":"- A domain administrator wanting to create roles that are meaningful to the"},{"line_number":41,"context_line":"  particular users of that domain (but may make no sense to users in other"},{"line_number":42,"context_line":"  domains). They also want to be able to name the roles within the domain"},{"line_number":43,"context_line":"  namespace (like users, groups and projects)."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Today, however, all roles are global in scope and new roles are only relevant"},{"line_number":46,"context_line":"if the policy files are modified - so neither of the above are possible."}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_25b547ed","line":43,"in_reply_to":"9a1a9d01_ac82a492","updated":"2015-09-28 19:55:52.000000000","message":"we have multiple customers asking for this. We see cloud providers wanting to set down a set of policy roles, then allowing a customers (i.e. per domain) to combine these into roles that are meaningful to them.  One example ITAdmin in smaller startups is VERY different to ITAdmin in a larger enterprise. Today they try and model this with user groups....but if these are tied to LDAP, they have limited scope.","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9401be4c644cbb15f2ba1905b313c4f2fb1f2748","unresolved":false,"context_lines":[{"line_number":43,"context_line":"  namespace (like users, groups and projects)."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Today, however, all roles are global in scope and new roles are only relevant"},{"line_number":46,"context_line":"if the policy files are modified - so neither of the above are possible."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed Change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_2c3c54e1","line":46,"updated":"2015-09-28 18:46:03.000000000","message":"It is in theory possible if we do centralized managed policies. :)","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"132ad0354048e0046d07b98d15b81eee6be6352a","unresolved":false,"context_lines":[{"line_number":43,"context_line":"  namespace (like users, groups and projects)."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Today, however, all roles are global in scope and new roles are only relevant"},{"line_number":46,"context_line":"if the policy files are modified - so neither of the above are possible."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed Change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_b2a1dbab","line":46,"in_reply_to":"9a1a9d01_05928357","updated":"2015-10-06 16:05:58.000000000","message":"cloud admin possibly","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"55c7230998b0a6215e643206de28deeb25f33773","unresolved":false,"context_lines":[{"line_number":43,"context_line":"  namespace (like users, groups and projects)."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Today, however, all roles are global in scope and new roles are only relevant"},{"line_number":46,"context_line":"if the policy files are modified - so neither of the above are possible."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed Change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_05928357","line":46,"in_reply_to":"9a1a9d01_2c3c54e1","updated":"2015-09-28 19:55:52.000000000","message":"only assuming that a domain administrator would be allowed to mess with policies directly..","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9401be4c644cbb15f2ba1905b313c4f2fb1f2748","unresolved":false,"context_lines":[{"line_number":52,"context_line":"list of one or more policy roles and/or other virtual roles. These virtual"},{"line_number":53,"context_line":"roles can either be global or domain specific."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"For example, if fine grained policy roles such as create-vm, delete-vm etc."},{"line_number":56,"context_line":"exist, which give a user access to specific APIs via the policy file for a"},{"line_number":57,"context_line":"service, then creating a virtual role of vm-manager that contained these roles"},{"line_number":58,"context_line":"would give a user with this virtual role on a given project access to all"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_2f21a69f","line":55,"updated":"2015-09-28 18:46:03.000000000","message":"We don\u0027t have \"fine grained policy roles\" today do we?","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"132ad0354048e0046d07b98d15b81eee6be6352a","unresolved":false,"context_lines":[{"line_number":52,"context_line":"list of one or more policy roles and/or other virtual roles. These virtual"},{"line_number":53,"context_line":"roles can either be global or domain specific."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"For example, if fine grained policy roles such as create-vm, delete-vm etc."},{"line_number":56,"context_line":"exist, which give a user access to specific APIs via the policy file for a"},{"line_number":57,"context_line":"service, then creating a virtual role of vm-manager that contained these roles"},{"line_number":58,"context_line":"would give a user with this virtual role on a given project access to all"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_f29f535d","line":55,"in_reply_to":"7a2fa921_2fe804e2","updated":"2015-10-06 16:05:58.000000000","message":"I agree with Brad","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"55c7230998b0a6215e643206de28deeb25f33773","unresolved":false,"context_lines":[{"line_number":52,"context_line":"list of one or more policy roles and/or other virtual roles. These virtual"},{"line_number":53,"context_line":"roles can either be global or domain specific."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"For example, if fine grained policy roles such as create-vm, delete-vm etc."},{"line_number":56,"context_line":"exist, which give a user access to specific APIs via the policy file for a"},{"line_number":57,"context_line":"service, then creating a virtual role of vm-manager that contained these roles"},{"line_number":58,"context_line":"would give a user with this virtual role on a given project access to all"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_6589ff25","line":55,"in_reply_to":"9a1a9d01_2f21a69f","updated":"2015-09-28 19:55:52.000000000","message":"any cloud provider could set up their policy files that way if they wish","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e5298d2257c347356d366e85e33f8b07f40102b3","unresolved":false,"context_lines":[{"line_number":52,"context_line":"list of one or more policy roles and/or other virtual roles. These virtual"},{"line_number":53,"context_line":"roles can either be global or domain specific."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"For example, if fine grained policy roles such as create-vm, delete-vm etc."},{"line_number":56,"context_line":"exist, which give a user access to specific APIs via the policy file for a"},{"line_number":57,"context_line":"service, then creating a virtual role of vm-manager that contained these roles"},{"line_number":58,"context_line":"would give a user with this virtual role on a given project access to all"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_2fe804e2","line":55,"in_reply_to":"9a1a9d01_6589ff25","updated":"2015-10-06 15:47:29.000000000","message":"Is virtual role the right terminology to use for this?  Virtual is a very overloaded term. Aren\u0027t these just composite roles?","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"b28c0a536746db9bf2dd7315c5c7c5dea0e2a7de","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Alternatives"},{"line_number":83,"context_line":"------------"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"We could create a hierarchy of the policy roles which are used in policy"},{"line_number":86,"context_line":"files directly, to encapsulate relationships between roles. This is outlined"},{"line_number":87,"context_line":"in the hierarchical roles spec as well as the specification for implied roles:"},{"line_number":88,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_15349a47","line":85,"updated":"2015-09-30 14:24:23.000000000","message":"Do your proposal interfere with Adam Young\u0027s implied roles somehow? He was speaking about organizing roles as a net, and here I see a hierarchy approach (I prefer this one).","commit_id":"10644598b805ec2e6893125eeff06e24177f1ccf"}],"specs/liberty/domain-specific-roles.rst":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Support the concept of domain specific roles, that allows a domain"},{"line_number":14,"context_line":"administrator to create roles that are meaningful to their users. These roles"},{"line_number":15,"context_line":"are just management roles, and expand out to actually global policy roles that"},{"line_number":16,"context_line":"will be placed in the token."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem Description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_9579b384","line":16,"updated":"2015-11-02 20:31:16.000000000","message":"Can we have a \"Definitions\" section here which define the following:\n\n 1. policy role\n 2. implied role\n 3. domain-specific role\n 4. role in global scope","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"7e74166d4b96351c394573cb713ca31e43de5b74","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Support the concept of domain specific roles, that allows a domain"},{"line_number":14,"context_line":"administrator to create roles that are meaningful to their users. These roles"},{"line_number":15,"context_line":"are just management roles, and expand out to actually global policy roles that"},{"line_number":16,"context_line":"will be placed in the token."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem Description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_351bffcb","line":16,"in_reply_to":"1a26ad4f_9579b384","updated":"2015-11-02 21:23:38.000000000","message":"Agreed! That would be a huge help!","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The policy files that reference policy roles are and should be tightly"},{"line_number":26,"context_line":"controlled in any cloud. An error in one of these files could be very"},{"line_number":27,"context_line":"damaging. As such, they are not likely to be changed too often. The modeling"},{"line_number":28,"context_line":"of a set of human-understandable roles that might be given to users, however,"},{"line_number":29,"context_line":"may change quite often. In public clouds, for instance, the cloud provider"},{"line_number":30,"context_line":"will most likely publish their \"role model\", listing what roles customer"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_fa31f45a","line":27,"updated":"2015-11-02 20:31:16.000000000","message":"Agreed. But how\u0027s that different with implied or domain-specific roles? Whoever create and assign these roles must understand the implications of doing so as well. Moreover, any capability changes in the service\u0027s policy file may affect the entire implied role chain. One may even argue that the \"policy roles\" should be immutable canned roles.","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":27,"context_line":"damaging. As such, they are not likely to be changed too often. The modeling"},{"line_number":28,"context_line":"of a set of human-understandable roles that might be given to users, however,"},{"line_number":29,"context_line":"may change quite often. In public clouds, for instance, the cloud provider"},{"line_number":30,"context_line":"will most likely publish their \"role model\", listing what roles customer"},{"line_number":31,"context_line":"admins should assign their users to be able to issue given APIs."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"For customers, it is unlikely that such roles will be meaningful or represent"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_9a09e086","line":30,"updated":"2015-11-02 20:31:16.000000000","message":"customer admins \u003d domain admins? May want to clarify that.","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"7e74166d4b96351c394573cb713ca31e43de5b74","unresolved":false,"context_lines":[{"line_number":27,"context_line":"damaging. As such, they are not likely to be changed too often. The modeling"},{"line_number":28,"context_line":"of a set of human-understandable roles that might be given to users, however,"},{"line_number":29,"context_line":"may change quite often. In public clouds, for instance, the cloud provider"},{"line_number":30,"context_line":"will most likely publish their \"role model\", listing what roles customer"},{"line_number":31,"context_line":"admins should assign their users to be able to issue given APIs."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"For customers, it is unlikely that such roles will be meaningful or represent"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_1575a3f8","line":30,"in_reply_to":"1a26ad4f_9a09e086","updated":"2015-11-02 21:23:38.000000000","message":"++ Agree","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":37,"context_line":"domains). They also want to be able to name the roles within the domain"},{"line_number":38,"context_line":"namespace (like users, groups and projects). Being able to create domain"},{"line_number":39,"context_line":"specific roles that can be used to map to the underlying roles placed in the"},{"line_number":40,"context_line":"policy files by the cloud provider would significantly aid this task."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Today, however, all roles are global in scope and new roles are only relevant"},{"line_number":43,"context_line":"if the policy files are modified - so the above is not possible."}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_7a016437","line":40,"updated":"2015-11-02 20:31:16.000000000","message":"May want to mention that domain admin is still limited to use the \"policy roles\" and global implied roles as the building blocks for the domain roles. Domain roles are also implied roles.","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":40,"context_line":"policy files by the cloud provider would significantly aid this task."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Today, however, all roles are global in scope and new roles are only relevant"},{"line_number":43,"context_line":"if the policy files are modified - so the above is not possible."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Proposed Change"},{"line_number":46,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_3aa52c46","line":43,"updated":"2015-11-02 20:31:16.000000000","message":"Implied roles can be building blocks, but they may still lacking fine-grained access control, meaning we still can\u0027t customize role to capability mapping via API.","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"It is proposed that we build on this and all the creating of a domain specific"},{"line_number":53,"context_line":"role. Domain specific roles (which are simply role entities with a new"},{"line_number":54,"context_line":"domain_id attribute) can be used with implied roles (i.e. by implying a"},{"line_number":55,"context_line":"set of policy rules), with the only difference being that when the effective"},{"line_number":56,"context_line":"roles are calculated for the token, the domain specific role itself will"},{"line_number":57,"context_line":"not be included."}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_ba14dc4c","line":54,"updated":"2015-11-02 20:31:16.000000000","message":"domain specific roles ARE implied roles","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":57,"context_line":"not be included."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"A domain specific role can be used (in terms of assignment APIs) everywhere"},{"line_number":60,"context_line":"that a global role can be used today. Given that at token generation, domain"},{"line_number":61,"context_line":"specific roles will be expanded into their policy roles, there will be"},{"line_number":62,"context_line":"no impact on services outside of Keystone (and no change to policy files). For"},{"line_number":63,"context_line":"fernet tokens (which don\u0027t contain the roles anyway), they will be expanded at"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_f5534715","line":60,"updated":"2015-11-02 20:31:16.000000000","message":"please clarify \"global role\" as it may introduce more confusion :)","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":61,"context_line":"specific roles will be expanded into their policy roles, there will be"},{"line_number":62,"context_line":"no impact on services outside of Keystone (and no change to policy files). For"},{"line_number":63,"context_line":"fernet tokens (which don\u0027t contain the roles anyway), they will be expanded at"},{"line_number":64,"context_line":"token validation time. Further, domain specific roles can be used with"},{"line_number":65,"context_line":"federation, allowing any of the attested users from IdPs, that are trusted by"},{"line_number":66,"context_line":"the domain, to gain domain specific role assignments via the existing federated"},{"line_number":67,"context_line":"mapping to Keystone groups."}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_b5706fa5","line":64,"updated":"2015-11-02 20:31:16.000000000","message":"s/domain specific/domain-specific/?","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":79,"context_line":"REST API Impact"},{"line_number":80,"context_line":"---------------"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Modifications to the role API to allow creation of domain specific roles."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Security Impact"},{"line_number":85,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_158e0379","line":82,"updated":"2015-11-02 20:31:16.000000000","message":"can a domain-specific role contain no implied roles?","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":87,"context_line":"Any change to the role or policy model has the potential to affect security."},{"line_number":88,"context_line":"The proposal doesn\u0027t, however, significantly increase the attack vectors, since"},{"line_number":89,"context_line":"in essence this is allowing a shorthand for manually adding many existing"},{"line_number":90,"context_line":"policy roles to users rather than using role-groups."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Notifications Impact"},{"line_number":93,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_75c3b789","line":90,"updated":"2015-11-02 20:31:16.000000000","message":"We still need to figure out the security boundaries.\n\n 1) who can see the domain-specific roles?\n 2) who can create the implied roles?\n 3) what happen if an implied role is changed at the bottom of the hierarchy?\n 4) can a domain-specific role contain no implied roles?","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":98,"context_line":"Other End User Impact"},{"line_number":99,"context_line":"---------------------"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"None"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Performance Impact"},{"line_number":104,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_35fe9fae","line":101,"updated":"2015-11-02 20:31:16.000000000","message":"I am also curious how the UX folks see this. When do they look like in Horizon role management tab.","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"00d5731d9cb85d1c14dd66d293c5618373d25a88","unresolved":false,"context_lines":[{"line_number":104,"context_line":"------------------"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"The main impact would be at token generation and validation time, but this"},{"line_number":107,"context_line":"will be not different that implied roles in general."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Other Deployer Impact"},{"line_number":110,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"1a26ad4f_9523f357","line":107,"updated":"2015-11-02 20:31:16.000000000","message":"they should be cacheable as they are highly static. I have no idea why we don\u0027t cache roles today.","commit_id":"9b23b7896e1beb9b1f2208221764f31966bdfb3b"}],"specs/mitaka/domain-specific-roles.rst":[{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"4785196b8fb99e21003ef22f1b77b8f16898c9e8","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"`spec implied-roles \u003chttps://review.openstack.org/#/c/125704/\u003e`_"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Policy files that reference policy roles are and should be tightly"},{"line_number":33,"context_line":"controlled in any cloud. An error in one of these files could be very"},{"line_number":34,"context_line":"damaging. As such, they are not likely to be changed too often. The modeling"},{"line_number":35,"context_line":"of a set of human-understandable roles that might be given to users, however,"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_342dad46","line":32,"updated":"2015-11-17 15:00:57.000000000","message":"roles are*, and should be*, tightly","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"06249f73733e677f4f074b42f83b6ed59c0bf366","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"`spec implied-roles \u003chttps://review.openstack.org/#/c/125704/\u003e`_"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Policy files that reference policy roles are and should be tightly"},{"line_number":33,"context_line":"controlled in any cloud. An error in one of these files could be very"},{"line_number":34,"context_line":"damaging. As such, they are not likely to be changed too often. The modeling"},{"line_number":35,"context_line":"of a set of human-understandable roles that might be given to users, however,"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_c6b349e8","line":32,"in_reply_to":"ba8a016a_342dad46","updated":"2015-11-17 18:59:45.000000000","message":"Done","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"4785196b8fb99e21003ef22f1b77b8f16898c9e8","unresolved":false,"context_lines":[{"line_number":34,"context_line":"damaging. As such, they are not likely to be changed too often. The modeling"},{"line_number":35,"context_line":"of a set of human-understandable roles that might be given to users, however,"},{"line_number":36,"context_line":"may change quite often. In public clouds (or multi-customer clouds in general),"},{"line_number":37,"context_line":"for instance, the cloud provider will most likely publish their \"role model\","},{"line_number":38,"context_line":"listing what roles customer admins should assign their users to be able to"},{"line_number":39,"context_line":"issue given APIs. In order to service the greatest number of differing"},{"line_number":40,"context_line":"customers, this role model is likely to become much more granular than it is"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_14ebc9b1","line":37,"updated":"2015-11-17 15:00:57.000000000","message":"publish their \"role model\"*.","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"06249f73733e677f4f074b42f83b6ed59c0bf366","unresolved":false,"context_lines":[{"line_number":34,"context_line":"damaging. As such, they are not likely to be changed too often. The modeling"},{"line_number":35,"context_line":"of a set of human-understandable roles that might be given to users, however,"},{"line_number":36,"context_line":"may change quite often. In public clouds (or multi-customer clouds in general),"},{"line_number":37,"context_line":"for instance, the cloud provider will most likely publish their \"role model\","},{"line_number":38,"context_line":"listing what roles customer admins should assign their users to be able to"},{"line_number":39,"context_line":"issue given APIs. In order to service the greatest number of differing"},{"line_number":40,"context_line":"customers, this role model is likely to become much more granular than it is"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_0699511f","line":37,"in_reply_to":"ba8a016a_14ebc9b1","updated":"2015-11-17 18:59:45.000000000","message":"not quite sure what you are mean here...the next part is part of this sentence...","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"4785196b8fb99e21003ef22f1b77b8f16898c9e8","unresolved":false,"context_lines":[{"line_number":35,"context_line":"of a set of human-understandable roles that might be given to users, however,"},{"line_number":36,"context_line":"may change quite often. In public clouds (or multi-customer clouds in general),"},{"line_number":37,"context_line":"for instance, the cloud provider will most likely publish their \"role model\","},{"line_number":38,"context_line":"listing what roles customer admins should assign their users to be able to"},{"line_number":39,"context_line":"issue given APIs. In order to service the greatest number of differing"},{"line_number":40,"context_line":"customers, this role model is likely to become much more granular than it is"},{"line_number":41,"context_line":"today (since, of course, the role model is common to all their customers)."}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_3405ad79","line":38,"updated":"2015-11-17 15:00:57.000000000","message":"their users*,","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"06249f73733e677f4f074b42f83b6ed59c0bf366","unresolved":false,"context_lines":[{"line_number":35,"context_line":"of a set of human-understandable roles that might be given to users, however,"},{"line_number":36,"context_line":"may change quite often. In public clouds (or multi-customer clouds in general),"},{"line_number":37,"context_line":"for instance, the cloud provider will most likely publish their \"role model\","},{"line_number":38,"context_line":"listing what roles customer admins should assign their users to be able to"},{"line_number":39,"context_line":"issue given APIs. In order to service the greatest number of differing"},{"line_number":40,"context_line":"customers, this role model is likely to become much more granular than it is"},{"line_number":41,"context_line":"today (since, of course, the role model is common to all their customers)."}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_a69f2502","line":38,"in_reply_to":"ba8a016a_3405ad79","updated":"2015-11-17 18:59:45.000000000","message":"not quiet sure what you mean here","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"4785196b8fb99e21003ef22f1b77b8f16898c9e8","unresolved":false,"context_lines":[{"line_number":41,"context_line":"today (since, of course, the role model is common to all their customers)."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"For a specific customer, however, it is unlikely that whatever set of granular"},{"line_number":44,"context_line":"roles a cloud provider chooses will be meaningful or represent relevant"},{"line_number":45,"context_line":"grouping of roles that will suit their particular usage model. Ideally a domain"},{"line_number":46,"context_line":"administrator would want to create roles that are meaningful to the particular"},{"line_number":47,"context_line":"users of that domain and somehow map these onto the role model defined by the"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_5a217b4c","line":44,"updated":"2015-11-17 15:00:57.000000000","message":"or represent *a relevant","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"06249f73733e677f4f074b42f83b6ed59c0bf366","unresolved":false,"context_lines":[{"line_number":41,"context_line":"today (since, of course, the role model is common to all their customers)."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"For a specific customer, however, it is unlikely that whatever set of granular"},{"line_number":44,"context_line":"roles a cloud provider chooses will be meaningful or represent relevant"},{"line_number":45,"context_line":"grouping of roles that will suit their particular usage model. Ideally a domain"},{"line_number":46,"context_line":"administrator would want to create roles that are meaningful to the particular"},{"line_number":47,"context_line":"users of that domain and somehow map these onto the role model defined by the"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_c6a2694b","line":44,"in_reply_to":"ba8a016a_5a217b4c","updated":"2015-11-17 18:59:45.000000000","message":"Done","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"4785196b8fb99e21003ef22f1b77b8f16898c9e8","unresolved":false,"context_lines":[{"line_number":47,"context_line":"users of that domain and somehow map these onto the role model defined by the"},{"line_number":48,"context_line":"cloud provider. These domain-specific roles would be private to their domain"},{"line_number":49,"context_line":"and exist only in that domain\u0027s namespace, since they may make no sense to"},{"line_number":50,"context_line":"users in other domains. Further these domain-specific roles should not show up"},{"line_number":51,"context_line":"in any tokens - only the roles that map to (which are policy roles that are"},{"line_number":52,"context_line":"part of the cloud providers roles model) should appear in tokens."},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_7aca3f70","line":50,"updated":"2015-11-17 15:00:57.000000000","message":"furthermore, instead of further?","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"06249f73733e677f4f074b42f83b6ed59c0bf366","unresolved":false,"context_lines":[{"line_number":47,"context_line":"users of that domain and somehow map these onto the role model defined by the"},{"line_number":48,"context_line":"cloud provider. These domain-specific roles would be private to their domain"},{"line_number":49,"context_line":"and exist only in that domain\u0027s namespace, since they may make no sense to"},{"line_number":50,"context_line":"users in other domains. Further these domain-specific roles should not show up"},{"line_number":51,"context_line":"in any tokens - only the roles that map to (which are policy roles that are"},{"line_number":52,"context_line":"part of the cloud providers roles model) should appear in tokens."},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_06c071df","line":50,"in_reply_to":"ba8a016a_7aca3f70","updated":"2015-11-17 18:59:45.000000000","message":"Done","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"4785196b8fb99e21003ef22f1b77b8f16898c9e8","unresolved":false,"context_lines":[{"line_number":48,"context_line":"cloud provider. These domain-specific roles would be private to their domain"},{"line_number":49,"context_line":"and exist only in that domain\u0027s namespace, since they may make no sense to"},{"line_number":50,"context_line":"users in other domains. Further these domain-specific roles should not show up"},{"line_number":51,"context_line":"in any tokens - only the roles that map to (which are policy roles that are"},{"line_number":52,"context_line":"part of the cloud providers roles model) should appear in tokens."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"The Implied Roles capability provides the mapping described above, with the"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_3aa6f753","line":51,"updated":"2015-11-17 15:00:57.000000000","message":"map to ____  (I feel like there is a missing word here).  Do you think so?\n\nor, \n\n\u0027they\u0027 instead of \u0027that\u0027?","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"06249f73733e677f4f074b42f83b6ed59c0bf366","unresolved":false,"context_lines":[{"line_number":48,"context_line":"cloud provider. These domain-specific roles would be private to their domain"},{"line_number":49,"context_line":"and exist only in that domain\u0027s namespace, since they may make no sense to"},{"line_number":50,"context_line":"users in other domains. Further these domain-specific roles should not show up"},{"line_number":51,"context_line":"in any tokens - only the roles that map to (which are policy roles that are"},{"line_number":52,"context_line":"part of the cloud providers roles model) should appear in tokens."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"The Implied Roles capability provides the mapping described above, with the"}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_86ac6136","line":51,"in_reply_to":"ba8a016a_3aa6f753","updated":"2015-11-17 18:59:45.000000000","message":"Done","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"4785196b8fb99e21003ef22f1b77b8f16898c9e8","unresolved":false,"context_lines":[{"line_number":72,"context_line":"specific roles will be expanded into their policy roles, there will be"},{"line_number":73,"context_line":"no impact on services outside of Keystone (and no change to policy files). For"},{"line_number":74,"context_line":"fernet tokens (which don\u0027t contain the roles anyway), they will be expanded at"},{"line_number":75,"context_line":"token validation time. Further, domain specific roles can be used with"},{"line_number":76,"context_line":"federation, allowing any of the attested users from IdPs, that are trusted by"},{"line_number":77,"context_line":"the domain, to gain domain specific role assignments via the existing federated"},{"line_number":78,"context_line":"mapping to Keystone groups."}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_3de35135","line":75,"updated":"2015-11-17 15:00:57.000000000","message":"furthermore instead of  further?","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"06249f73733e677f4f074b42f83b6ed59c0bf366","unresolved":false,"context_lines":[{"line_number":72,"context_line":"specific roles will be expanded into their policy roles, there will be"},{"line_number":73,"context_line":"no impact on services outside of Keystone (and no change to policy files). For"},{"line_number":74,"context_line":"fernet tokens (which don\u0027t contain the roles anyway), they will be expanded at"},{"line_number":75,"context_line":"token validation time. Further, domain specific roles can be used with"},{"line_number":76,"context_line":"federation, allowing any of the attested users from IdPs, that are trusted by"},{"line_number":77,"context_line":"the domain, to gain domain specific role assignments via the existing federated"},{"line_number":78,"context_line":"mapping to Keystone groups."}],"source_content_type":"text/x-rst","patch_set":21,"id":"ba8a016a_865a214f","line":75,"in_reply_to":"ba8a016a_3de35135","updated":"2015-11-17 18:59:45.000000000","message":"Done","commit_id":"00afa0787ac27bbccba1eb6ad47c9f7856df54fa"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"141c239545008115ff1576b015a80cf8f362174e","unresolved":false,"context_lines":[{"line_number":76,"context_line":"federation, allowing any of the attested users from IdPs, that are trusted by"},{"line_number":77,"context_line":"the domain, to gain domain specific role assignments via the existing federated"},{"line_number":78,"context_line":"mapping to Keystone groups."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Alternatives"},{"line_number":81,"context_line":"------------"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"ba8a016a_a85a5628","line":79,"updated":"2015-11-18 18:04:49.000000000","message":"Please add in that, once domain ID is set on a role, it is an immuitable value.  I think this mitigates a significant security concern; assigning as a DSR, and then making it non DSR.\n\nFrom an RBAC perspective, there needs to be a non-DSR that can be used to create global roles, and a separate one to create DSRs.","commit_id":"167fd090f15df0497a34b72699bfbeba6ab11033"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4ebe83be528234f09377556e573ba823d99b1be5","unresolved":false,"context_lines":[{"line_number":76,"context_line":"federation, allowing any of the attested users from IdPs, that are trusted by"},{"line_number":77,"context_line":"the domain, to gain domain specific role assignments via the existing federated"},{"line_number":78,"context_line":"mapping to Keystone groups."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Alternatives"},{"line_number":81,"context_line":"------------"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"ba8a016a_567580f7","line":79,"in_reply_to":"ba8a016a_a85a5628","updated":"2015-11-18 21:46:28.000000000","message":"Done","commit_id":"167fd090f15df0497a34b72699bfbeba6ab11033"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8b17ac75fc91ef44daa28cddbac1b3a22a6e985c","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Implement Domain Specific Roles"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp domain-specific-roles \u003chttps://blueprints.launchpad.net/keystone/+spec/domain-specific-roles\u003e`_"}],"source_content_type":"text/x-rst","patch_set":25,"id":"ba8a016a_fbff7c63","line":8,"updated":"2015-11-19 23:14:47.000000000","message":"remove \"implement\"","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"275005881a2a2993ad2a59ebe5cd5392ab4c5432","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Implement Domain Specific Roles"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp domain-specific-roles \u003chttps://blueprints.launchpad.net/keystone/+spec/domain-specific-roles\u003e`_"}],"source_content_type":"text/x-rst","patch_set":25,"id":"9a8ffd7b_1c38d99f","line":8,"in_reply_to":"ba8a016a_fbff7c63","updated":"2015-11-25 12:38:03.000000000","message":"Done","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8b17ac75fc91ef44daa28cddbac1b3a22a6e985c","unresolved":false,"context_lines":[{"line_number":89,"context_line":"Data Model Impact"},{"line_number":90,"context_line":"-----------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"For SQL, the roles table will expanded to support domain specific roles."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"REST API Impact"},{"line_number":95,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":25,"id":"ba8a016a_9bb3d097","line":92,"updated":"2015-11-19 23:14:47.000000000","message":"will be* expanded","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"275005881a2a2993ad2a59ebe5cd5392ab4c5432","unresolved":false,"context_lines":[{"line_number":89,"context_line":"Data Model Impact"},{"line_number":90,"context_line":"-----------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"For SQL, the roles table will expanded to support domain specific roles."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"REST API Impact"},{"line_number":95,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":25,"id":"9a8ffd7b_3c86fd65","line":92,"in_reply_to":"ba8a016a_9bb3d097","updated":"2015-11-25 12:38:03.000000000","message":"Done","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8b17ac75fc91ef44daa28cddbac1b3a22a6e985c","unresolved":false,"context_lines":[{"line_number":108,"context_line":"--------------------"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Any existing notification regarding roles will be extended to include"},{"line_number":111,"context_line":"role-groups."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Other End User Impact"},{"line_number":114,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":25,"id":"ba8a016a_7ba4ec49","line":111,"updated":"2015-11-19 23:14:47.000000000","message":"role-groups?","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"275005881a2a2993ad2a59ebe5cd5392ab4c5432","unresolved":false,"context_lines":[{"line_number":108,"context_line":"--------------------"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Any existing notification regarding roles will be extended to include"},{"line_number":111,"context_line":"role-groups."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Other End User Impact"},{"line_number":114,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":25,"id":"9a8ffd7b_fc7f1564","line":111,"in_reply_to":"ba8a016a_7ba4ec49","updated":"2015-11-25 12:38:03.000000000","message":"oops, now there\u0027s a blast from the past! Nixed.","commit_id":"c431998607c1a1c67f51832c30b32db470f786ea"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"af15e41289ed6d5dbae24b9ef41f90de0c2588c9","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp domain-specific-roles \u003chttps://blueprints.launchpad.net/keystone/+spec/domain-specific-roles\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Extended the concept of Implied Roles to allow the prior role to be"},{"line_number":14,"context_line":"domain-specific, allowing a domain administrator to create roles that are"},{"line_number":15,"context_line":"meaningful to their users. These roles are just management roles, and expand"},{"line_number":16,"context_line":"out into their implied roles for token purposes."}],"source_content_type":"text/x-rst","patch_set":27,"id":"9a8ffd7b_b5ce7b81","line":13,"updated":"2015-12-01 16:22:35.000000000","message":"perhaps the \"Implied Roles\" can be changed to a link for easier lookup what it means","commit_id":"65fa2a5419580c920468ea2700eaf87bba1e2c27"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"802a3b08ac06087c1f62bbdf34ee79bd838466af","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The Implied Roles specification creates the ability where a prior role can be"},{"line_number":26,"context_line":"defined that expands out into a set of implied roles at token validation time."},{"line_number":27,"context_line":"Both the prior role and all the implied roles end up in the token - i.e. all of"},{"line_number":28,"context_line":"them are policy roles."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"`spec implied-roles \u003chttps://review.openstack.org/#/c/125704/\u003e`_"}],"source_content_type":"text/x-rst","patch_set":27,"id":"9a8ffd7b_f6cd24b8","line":27,"updated":"2015-11-30 19:34:08.000000000","message":"s/end up/will end up/","commit_id":"65fa2a5419580c920468ea2700eaf87bba1e2c27"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d791dcb0d271faa4d78cb58439a04a6a75e3a45","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The Implied Roles specification creates the ability where a prior role can be"},{"line_number":26,"context_line":"defined that expands out into a set of implied roles at token validation time."},{"line_number":27,"context_line":"Both the prior role and all the implied roles end up in the token - i.e. all of"},{"line_number":28,"context_line":"them are policy roles."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"`spec implied-roles \u003chttps://review.openstack.org/#/c/125704/\u003e`_"}],"source_content_type":"text/x-rst","patch_set":27,"id":"9a8ffd7b_702a6e92","line":27,"in_reply_to":"9a8ffd7b_f6cd24b8","updated":"2015-12-01 13:34:07.000000000","message":"that\u0027s my cockney english for ya\u0027 guv","commit_id":"65fa2a5419580c920468ea2700eaf87bba1e2c27"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"802a3b08ac06087c1f62bbdf34ee79bd838466af","unresolved":false,"context_lines":[{"line_number":65,"context_line":"role entities with a new domain_id attribute) can be used to define implied"},{"line_number":66,"context_line":"roles (i.e. by implying a set of policy roles), with the only difference being"},{"line_number":67,"context_line":"(compared to a regular prior role) that when the effective roles are calculated"},{"line_number":68,"context_line":"for the token, the domain specific prior role itself will not be included."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"A domain specific role can be used (in terms of assignment APIs) everywhere"},{"line_number":71,"context_line":"that a global role can be used today. Given that at token generation, domain"}],"source_content_type":"text/x-rst","patch_set":27,"id":"9a8ffd7b_36cbac20","line":68,"updated":"2015-11-30 19:34:08.000000000","message":"Can a domain-specifc role implies another domain-specific role in the same domain? I am guessing no? We may want to clarify that.","commit_id":"65fa2a5419580c920468ea2700eaf87bba1e2c27"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d791dcb0d271faa4d78cb58439a04a6a75e3a45","unresolved":false,"context_lines":[{"line_number":65,"context_line":"role entities with a new domain_id attribute) can be used to define implied"},{"line_number":66,"context_line":"roles (i.e. by implying a set of policy roles), with the only difference being"},{"line_number":67,"context_line":"(compared to a regular prior role) that when the effective roles are calculated"},{"line_number":68,"context_line":"for the token, the domain specific prior role itself will not be included."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"A domain specific role can be used (in terms of assignment APIs) everywhere"},{"line_number":71,"context_line":"that a global role can be used today. Given that at token generation, domain"}],"source_content_type":"text/x-rst","patch_set":27,"id":"9a8ffd7b_1031a20b","line":68,"in_reply_to":"9a8ffd7b_36cbac20","updated":"2015-12-01 13:34:07.000000000","message":"We don\u0027t prevent that...and since the implies roles allows you to do that, I think we should allow it (although I agree there\u0027s not much of use case for that)","commit_id":"65fa2a5419580c920468ea2700eaf87bba1e2c27"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"753f65bc3bcc84052aec7ade8b0b04575846bbda","unresolved":false,"context_lines":[{"line_number":71,"context_line":"that a global role can be used today. Given that at token generation, domain"},{"line_number":72,"context_line":"specific roles will be expanded into their policy roles, there will be"},{"line_number":73,"context_line":"no impact on services outside of Keystone (and no change to policy files). For"},{"line_number":74,"context_line":"fernet tokens (which don\u0027t contain the roles anyway), they will be expanded at"},{"line_number":75,"context_line":"token validation time. Furthermore, domain specific roles can be used with"},{"line_number":76,"context_line":"federation, allowing any of the attested users from IdPs, that are trusted by"},{"line_number":77,"context_line":"the domain, to gain domain specific role assignments via the existing federated"}],"source_content_type":"text/x-rst","patch_set":28,"id":"9a8ffd7b_61700641","line":74,"updated":"2015-12-02 20:21:04.000000000","message":"Very nice clarification","commit_id":"15713bf9b55a3335f54fe9e8983580b28bb1fbc2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ed65c1f50198979e9a7f1e62f36bcc3dec79b820","unresolved":false,"context_lines":[{"line_number":84,"context_line":"------------"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Provide the ability to have domain-specific policy files. This would be a very"},{"line_number":87,"context_line":"complex undertaking."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Data Model Impact"},{"line_number":90,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":28,"id":"9a8ffd7b_4822e3a4","line":87,"updated":"2015-12-02 14:34:06.000000000","message":"I actually would love to have this feature, I would think this would be useful for public cloud. Where each customer have their own domain and can map the policy rule to meet their needs.\n\nwe already have a similar system in place used for managing authorization for app services. This would be great to look at later release.","commit_id":"15713bf9b55a3335f54fe9e8983580b28bb1fbc2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"6dd64269f794808cace806268f6f522894695f3a","unresolved":false,"context_lines":[{"line_number":84,"context_line":"------------"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Provide the ability to have domain-specific policy files. This would be a very"},{"line_number":87,"context_line":"complex undertaking."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Data Model Impact"},{"line_number":90,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":28,"id":"9a8ffd7b_c50a0326","line":87,"in_reply_to":"9a8ffd7b_4822e3a4","updated":"2015-12-03 08:35:11.000000000","message":"yes, this has been discussed...and maybe in this future.....","commit_id":"15713bf9b55a3335f54fe9e8983580b28bb1fbc2"}]}