)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"4fcc2ed136b288672f23bca14ae9e76581c41ab3","unresolved":false,"context_lines":[{"line_number":10,"context_line":"enforcement logic allow to check policy via http requests. New enforcer handle"},{"line_number":11,"context_line":"that requests and send response with \u0027True\u0027 of \u0027False\u0027 value depending on the"},{"line_number":12,"context_line":"credentials, action and target that comes with request."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I6ea7891511896ecb264f7bbe6b614c2dc599f49d"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"9abb7d3a_23d55de7","line":13,"updated":"2016-06-01 11:46:58.000000000","message":"Is there any blueprint related to this?","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"}],"specs/keystone/backlog/policy-enforcement.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3bcf1fbb3204e0e370442c5433e42ddf3e3976e","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Add policy enforcer to provide alternative policy enforcement logic. Current"},{"line_number":8,"context_line":"enforcement logic allow to check policy via http requests. New enforcer handle"},{"line_number":9,"context_line":"that requests and send response with \u0027True\u0027 of \u0027False\u0027 value depending on the"},{"line_number":10,"context_line":"credentials, action and target that comes with request."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Problem description"},{"line_number":13,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_06013506","line":10,"updated":"2016-06-01 16:16:56.000000000","message":"This sounds like it\u0027s just centralizing policy behind an endpoint. That endpoint/API will still need to collect the policies to compare against.\n\nSome of that centralization of policy is already being done on the Nova side with oslo.policy and registering policy rules like we do configuration options.\n\nhttps://etherpad.openstack.org/p/newton-oslo-policy-default-embedded","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"4fcc2ed136b288672f23bca14ae9e76581c41ab3","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Currently policies are loaded statically from policy.json. Alternative policy"},{"line_number":16,"context_line":"enforcer allow to write URL in policy.json as rule for policy action and"},{"line_number":17,"context_line":"handle requests directed by this URL. It allow to implement dynamic policies."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Proposed change"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_03d019f5","line":17,"updated":"2016-06-01 11:46:58.000000000","message":"Can you add more details why this is a problem? This sounds like a description of the current solution but not a real problem.","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"e16d45ef9df5795face1334e2149707ebecf6a2c","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Currently policies are loaded statically from policy.json. Alternative policy"},{"line_number":16,"context_line":"enforcer allow to write URL in policy.json as rule for policy action and"},{"line_number":17,"context_line":"handle requests directed by this URL. It allow to implement dynamic policies."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Proposed change"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_799b9218","line":17,"range":{"start_line":17,"start_character":38,"end_line":17,"end_character":77},"updated":"2016-06-01 12:30:56.000000000","message":"How ? What is \u0027dynamic policies\u0027 you\u0027re talking about here ?","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"e16d45ef9df5795face1334e2149707ebecf6a2c","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Problem description"},{"line_number":13,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Currently policies are loaded statically from policy.json. Alternative policy"},{"line_number":16,"context_line":"enforcer allow to write URL in policy.json as rule for policy action and"},{"line_number":17,"context_line":"handle requests directed by this URL. It allow to implement dynamic policies."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Proposed change"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_3953ca3a","line":17,"range":{"start_line":15,"start_character":59,"end_line":17,"end_character":37},"updated":"2016-06-01 12:30:56.000000000","message":"It is possible to write URLs in the policy already, see https://github.com/openstack/oslo.policy/blob/bb11272/oslo_policy/policy.py#L47","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"4fcc2ed136b288672f23bca14ae9e76581c41ab3","unresolved":false,"context_lines":[{"line_number":23,"context_line":"-------------------"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Alternative enforcement assume the existence of URL of policy enforcement"},{"line_number":26,"context_line":"controller in the rule field in plicy.json. For example:"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"+--------------------------------------------------------------------------+"},{"line_number":29,"context_line":"|identity:action | http://localhost:5000/policy_enforcement/identity:action|"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_63dbe51b","line":26,"updated":"2016-06-01 11:46:58.000000000","message":"nit: policy.json","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"e16d45ef9df5795face1334e2149707ebecf6a2c","unresolved":false,"context_lines":[{"line_number":26,"context_line":"controller in the rule field in plicy.json. For example:"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"+--------------------------------------------------------------------------+"},{"line_number":29,"context_line":"|identity:action | http://localhost:5000/policy_enforcement/identity:action|"},{"line_number":30,"context_line":"+--------------------------------------------------------------------------+"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Information about credentials, target and action sends to the driver."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_19108656","line":29,"range":{"start_line":29,"start_character":0,"end_line":29,"end_character":76},"updated":"2016-06-01 12:30:56.000000000","message":"How is this different from https://github.com/openstack/oslo.policy/blob/bb11272/oslo_policy/policy.py#L47","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"4fcc2ed136b288672f23bca14ae9e76581c41ab3","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"+--------------------------------------------------------------------------+"},{"line_number":29,"context_line":"|identity:action | http://localhost:5000/policy_enforcement/identity:action|"},{"line_number":30,"context_line":"+--------------------------------------------------------------------------+"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Information about credentials, target and action sends to the driver."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_43d6a1f1","line":30,"updated":"2016-06-01 11:46:58.000000000","message":"So, how will be this change for the other services? Do you intend to create the same API calls for every service? or this will only works on this way on Keystone?","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"e16d45ef9df5795face1334e2149707ebecf6a2c","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Changes"},{"line_number":35,"context_line":"-------"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"1. Class EnforcerV3 in keystone/policy/controllers."},{"line_number":38,"context_line":"   "},{"line_number":39,"context_line":"   a) EnforcerV3 is controller for policy enforcement."},{"line_number":40,"context_line":"   b) policy_check method process POST requests."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_d459a536","line":37,"range":{"start_line":37,"start_character":23,"end_line":37,"end_character":50},"updated":"2016-06-01 12:30:56.000000000","message":"The logic for policy enforcement is in oslo.policy, not in keystone itself","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"e16d45ef9df5795face1334e2149707ebecf6a2c","unresolved":false,"context_lines":[{"line_number":35,"context_line":"-------"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"1. Class EnforcerV3 in keystone/policy/controllers."},{"line_number":38,"context_line":"   "},{"line_number":39,"context_line":"   a) EnforcerV3 is controller for policy enforcement."},{"line_number":40,"context_line":"   b) policy_check method process POST requests."},{"line_number":41,"context_line":"   b) Takes policy action and context as arguments, parse credential and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_d40b6522","line":38,"range":{"start_line":38,"start_character":0,"end_line":38,"end_character":3},"updated":"2016-06-01 12:30:56.000000000","message":"trailing spaces","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"4fcc2ed136b288672f23bca14ae9e76581c41ab3","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Work Items"},{"line_number":73,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"1. Implement policy enforcer for dynamic policies."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9abb7d3a_a3078d80","line":75,"updated":"2016-06-01 11:46:58.000000000","message":"I believe we can split this effort in a couple of more work items :)","commit_id":"52a6516196c75d9eddb4b812d39c933690314e53"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"8ad83c2e6e97d06da5a9f4e37afde7ba348ea513","unresolved":false,"context_lines":[{"line_number":14,"context_line":"With alternative enforcer in keystone it will be possible to process policy"},{"line_number":15,"context_line":"check requests directed by this link. Alternative enforcer allow to move policy"},{"line_number":16,"context_line":"enforcement logic from rules in policy.json to driver managed by alternative"},{"line_number":17,"context_line":"enforcer."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Proposed change"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_383a1635","line":17,"updated":"2016-06-03 13:45:20.000000000","message":"The only part of access control that is currently separated from keystone\nin OpenStack is policy enforcement. If policies are enforces in keystone\nit opens an opportunity to perform all access checks in place using\ninternally stored delegation and policy data.","commit_id":"660b6eba4e2aa58ab06e88e0bdfa8002c6ac3cfe"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7f4651c122769659edfcb3396eeb21fde3eb31dc","unresolved":false,"context_lines":[{"line_number":15,"context_line":"check requests directed by this link. Alternative enforcer allow to move policy"},{"line_number":16,"context_line":"enforcement logic from rules in policy.json to driver managed by alternative"},{"line_number":17,"context_line":"enforcer."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Proposed change"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_c19d7767","line":18,"updated":"2016-06-08 11:22:15.000000000","message":"So my concern about this is that we give keystone another bottleneck task, i.e. would would now:\n\n- every server API call, calls keystonemiddleware to validate the token\n- every server API call, then (via policy) does an http request to keystone to check the policy rule.\n\nThis seems against the ethos of Openstack design. We already tried (the easier approach) of having keystone hold the policy files and hand them out to the services to process - but even that had push back by the other service teams (as an aside, I still support this model).","commit_id":"660b6eba4e2aa58ab06e88e0bdfa8002c6ac3cfe"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"b8b5df9fa75c9c3b76d9c4978dd32081677cb9be","unresolved":false,"context_lines":[{"line_number":15,"context_line":"check requests directed by this link. Alternative enforcer allow to move policy"},{"line_number":16,"context_line":"enforcement logic from rules in policy.json to driver managed by alternative"},{"line_number":17,"context_line":"enforcer."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Proposed change"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_79927b4d","line":18,"in_reply_to":"7aa08908_c19d7767","updated":"2016-06-08 12:05:36.000000000","message":"Yes, and all the policy rules in an OpenStack cloud should be in keystone. In addition, this spec does not buy us more than enforcing by doing a HTTP request to keystone. What would be the long term benefits of this ? Just change the way we do it ?","commit_id":"660b6eba4e2aa58ab06e88e0bdfa8002c6ac3cfe"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"b8b5df9fa75c9c3b76d9c4978dd32081677cb9be","unresolved":false,"context_lines":[{"line_number":29,"context_line":"|identity:action | http://localhost:5000/policy_enforcement/identity:action|"},{"line_number":30,"context_line":"+--------------------------------------------------------------------------+"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Keystone uses oslo.policy to check policies. oslo.policy have HttpCheck class,"},{"line_number":33,"context_line":"which check policy if URL passed as rule in policy.json. HttpCheck sends POST"},{"line_number":34,"context_line":"request with information about credentials, action and target and wait for"},{"line_number":35,"context_line":"response (\u0027True\u0027 or \u0027False). Alternative enforcer in keystone handle this"},{"line_number":36,"context_line":"request."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Changes"},{"line_number":39,"context_line":"-------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7aa08908_59d69f4f","line":36,"range":{"start_line":32,"start_character":0,"end_line":36,"end_character":8},"updated":"2016-06-08 12:05:36.000000000","message":"Completely agreed with Henry Nash\u0027s comment above, this is creating another bottleneck task.","commit_id":"660b6eba4e2aa58ab06e88e0bdfa8002c6ac3cfe"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d2c4804b0e44755a0ffdec7655d80d9a2ea9115a","unresolved":false,"context_lines":[{"line_number":19,"context_line":"With alternative enforcer in keystone it will be possible to process policy"},{"line_number":20,"context_line":"check requests directed by this link. Alternative enforcer allow to move policy"},{"line_number":21,"context_line":"enforcement logic from rules in policy.json to driver managed by alternative"},{"line_number":22,"context_line":"enforcer."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Proposed change"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba2be162_dd240762","line":22,"updated":"2017-03-06 18:20:48.000000000","message":"I assume this enforcer is determined by the link? This work is highly specific to oslo.policy, and most of the changes would be done there [0].\n\nI would suggest reworking this spec and propose it to oslo instead of keystone. From what I can tell, keystone would be using a different policy syntax in order to take advantage of the functionality, but it would be up to oslo.policy to understand the new policy syntax.\n\n[0] http://git.openstack.org/cgit/openstack/oslo.policy/","commit_id":"22f3cb4b0e6a18ec1eee21ccafb8d91071da11f4"}]}