)]}'
{"specs/keystone/backlog/complete-rbac.rst":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"643a22f1be846faf2311f6d17ef35e1bb598348c","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Proposed Change"},{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"- Add an endpoint in the keystone application that can be used in services"},{"line_number":34,"context_line":"policy.json files in http_check-style rules."},{"line_number":35,"context_line":"- Provide policy RESTful API that will allow manipulate policies dynamically."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_e61ec96e","line":32,"updated":"2016-06-08 11:15:04.000000000","message":"So you leap into details changes here, I\u0027d suggest we start with a high level description of your change. I *think* what you are proposing is to remove role assignment \u0026 scope from the token and instead allow a service to obtain this by passing to (a new component of keystone) some kind of token identifier? Or maybe just a user identifier and the scope it is being used in?","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"d0c4be6fc386050f4f80309355ce08570ca55641","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Proposed Change"},{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"- Add an endpoint in the keystone application that can be used in services"},{"line_number":34,"context_line":"policy.json files in http_check-style rules."},{"line_number":35,"context_line":"- Provide policy RESTful API that will allow manipulate policies dynamically."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a9d85d2_c8bb6571","line":32,"in_reply_to":"7aa08908_e61ec96e","updated":"2016-06-20 18:48:17.000000000","message":"Done","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"78a8649d5f8f5d8352ce6e5b5882be7b062d8c22","unresolved":false,"context_lines":[{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"- Add an endpoint in the keystone application that can be used in services"},{"line_number":34,"context_line":"policy.json files in http_check-style rules."},{"line_number":35,"context_line":"- Provide policy RESTful API that will allow manipulate policies dynamically."},{"line_number":36,"context_line":"- Add policy enforcement engine capable of using different policy storage"},{"line_number":37,"context_line":"backends: either static policy files, or database structure, or even"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_e0ff5132","line":34,"updated":"2016-06-06 15:17:36.000000000","message":"I think this needs to be indented to line up with \u0027Add\u0027.","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"d0c4be6fc386050f4f80309355ce08570ca55641","unresolved":false,"context_lines":[{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"- Add an endpoint in the keystone application that can be used in services"},{"line_number":34,"context_line":"policy.json files in http_check-style rules."},{"line_number":35,"context_line":"- Provide policy RESTful API that will allow manipulate policies dynamically."},{"line_number":36,"context_line":"- Add policy enforcement engine capable of using different policy storage"},{"line_number":37,"context_line":"backends: either static policy files, or database structure, or even"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a9d85d2_bfd615c3","line":34,"in_reply_to":"7aa08908_e0ff5132","updated":"2016-06-20 18:48:17.000000000","message":"Done","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"78a8649d5f8f5d8352ce6e5b5882be7b062d8c22","unresolved":false,"context_lines":[{"line_number":34,"context_line":"policy.json files in http_check-style rules."},{"line_number":35,"context_line":"- Provide policy RESTful API that will allow manipulate policies dynamically."},{"line_number":36,"context_line":"- Add policy enforcement engine capable of using different policy storage"},{"line_number":37,"context_line":"backends: either static policy files, or database structure, or even"},{"line_number":38,"context_line":"a third-party service."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_8095ade5","line":37,"updated":"2016-06-06 15:17:36.000000000","message":"Same comment applies to this line and line 38","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"d0c4be6fc386050f4f80309355ce08570ca55641","unresolved":false,"context_lines":[{"line_number":34,"context_line":"policy.json files in http_check-style rules."},{"line_number":35,"context_line":"- Provide policy RESTful API that will allow manipulate policies dynamically."},{"line_number":36,"context_line":"- Add policy enforcement engine capable of using different policy storage"},{"line_number":37,"context_line":"backends: either static policy files, or database structure, or even"},{"line_number":38,"context_line":"a third-party service."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a9d85d2_1fdc89e3","line":37,"in_reply_to":"7aa08908_8095ade5","updated":"2016-06-20 18:48:17.000000000","message":"Done","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"78a8649d5f8f5d8352ce6e5b5882be7b062d8c22","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"What other ways could we do this thing? Why aren\u0027t we using those? This doesn\u0027t"},{"line_number":44,"context_line":"have to be a full literature review, but it should demonstrate that thought has"},{"line_number":45,"context_line":"been put into why the proposed solution is an appropriate one."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Security Impact"},{"line_number":48,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_a07269e3","line":45,"updated":"2016-06-06 15:17:36.000000000","message":"For proposing against the backlog - we should replace these sections with: \n\n    None\n\nJust until someone decides to pick this up, re-propose it to a release and run with it. During the reproposal, we can flesh out these details.","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"d0c4be6fc386050f4f80309355ce08570ca55641","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"What other ways could we do this thing? Why aren\u0027t we using those? This doesn\u0027t"},{"line_number":44,"context_line":"have to be a full literature review, but it should demonstrate that thought has"},{"line_number":45,"context_line":"been put into why the proposed solution is an appropriate one."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Security Impact"},{"line_number":48,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a9d85d2_08ae0d2e","line":45,"in_reply_to":"7aa08908_a07269e3","updated":"2016-06-20 18:48:17.000000000","message":"Done","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"643a22f1be846faf2311f6d17ef35e1bb598348c","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Performance Impact"},{"line_number":92,"context_line":"------------------"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Describe any potential performance impact on the system, for example"},{"line_number":95,"context_line":"how often will new code be called, and is there a major change to the calling"},{"line_number":96,"context_line":"pattern of existing code."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_2171dba8","line":93,"updated":"2016-06-08 11:15:04.000000000","message":"it\u0027s not clear if you are proposing replacing token validation with whatever this new things is, so I\u0027m unsure if you are proposing a 2nd keystone bottleneckkk","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"e68b7294ba2ca092380522c69b6c86d13d40386b","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Performance Impact"},{"line_number":92,"context_line":"------------------"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Describe any potential performance impact on the system, for example"},{"line_number":95,"context_line":"how often will new code be called, and is there a major change to the calling"},{"line_number":96,"context_line":"pattern of existing code."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_49ab22d7","line":93,"in_reply_to":"7aa08908_2171dba8","updated":"2016-06-09 13:17:00.000000000","message":"Agreed. IIUC this is proposing to make policy checks in keystone, for every API call in every service. Yes, this is going to create a bottleneck. This section is going to be super important if you want to keep proposing this idea.\n\nIn addition, keystone would need to own all service\u0027s policies, which is a 2nd issue","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"d0c4be6fc386050f4f80309355ce08570ca55641","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Performance Impact"},{"line_number":92,"context_line":"------------------"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Describe any potential performance impact on the system, for example"},{"line_number":95,"context_line":"how often will new code be called, and is there a major change to the calling"},{"line_number":96,"context_line":"pattern of existing code."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a9d85d2_68ab511e","line":93,"in_reply_to":"7aa08908_49ab22d7","updated":"2016-06-20 18:48:17.000000000","message":"It\u0027s a subject to research: some of the existing load-generation functionality will be removed in the result, though I expect performance will not improve very much.","commit_id":"d60e23fb31f85638f82f6c5118b73bd3826f412e"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d6095407616260dd0f58cf1a2bc0d655587e779a","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Proposed Change"},{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Introduce an interface for remote policy enforcement to be used by services,"},{"line_number":34,"context_line":"so that services will require unscoped token and operation to be served for"},{"line_number":35,"context_line":"access control check."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"- Add an endpoint to the keystone application that can be used in services"},{"line_number":38,"context_line":"  policy.json files in http_check-style rules."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a9d85d2_f8f521cb","line":35,"range":{"start_line":33,"start_character":0,"end_line":35,"end_character":21},"updated":"2016-06-21 15:17:53.000000000","message":"With this, besides going to keystone to issue/validate token, every operation will need to hit keystone again for every API call in order to enforce policy. This is going to create a bottleneck in OpenStack that will affect the performance of the whole cloud.","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"93d4e064c2cdd71214366b41976d1ec013ba48e3","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Proposed Change"},{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Introduce an interface for remote policy enforcement to be used by services,"},{"line_number":34,"context_line":"so that services will require unscoped token and operation to be served for"},{"line_number":35,"context_line":"access control check."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"- Add an endpoint to the keystone application that can be used in services"},{"line_number":38,"context_line":"  policy.json files in http_check-style rules."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_15a01690","line":35,"range":{"start_line":33,"start_character":0,"end_line":35,"end_character":21},"in_reply_to":"5a9d85d2_f8f521cb","updated":"2016-06-21 17:08:12.000000000","message":"Ultimately this will allow just ask \"Can I do this?\" without token issue/validation. For example, using x.509 authN.","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d6095407616260dd0f58cf1a2bc0d655587e779a","unresolved":false,"context_lines":[{"line_number":44,"context_line":"Alternatives"},{"line_number":45,"context_line":"------------"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"What other ways could we do this thing? Why aren\u0027t we using those? This doesn\u0027t"},{"line_number":48,"context_line":"have to be a full literature review, but it should demonstrate that thought has"},{"line_number":49,"context_line":"been put into why the proposed solution is an appropriate one."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Security Impact"},{"line_number":52,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a9d85d2_1822ad52","line":49,"range":{"start_line":47,"start_character":0,"end_line":49,"end_character":62},"updated":"2016-06-21 15:17:53.000000000","message":"This needs to be expanded.\n\nIf you really want to tokens to become unscoped only, why not simply make middleware fetch the needed data (that is not present in the token), rather than making keystone do everything (including enforcement) ?","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"93d4e064c2cdd71214366b41976d1ec013ba48e3","unresolved":false,"context_lines":[{"line_number":44,"context_line":"Alternatives"},{"line_number":45,"context_line":"------------"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"What other ways could we do this thing? Why aren\u0027t we using those? This doesn\u0027t"},{"line_number":48,"context_line":"have to be a full literature review, but it should demonstrate that thought has"},{"line_number":49,"context_line":"been put into why the proposed solution is an appropriate one."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Security Impact"},{"line_number":52,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_15cbf673","line":49,"range":{"start_line":47,"start_character":0,"end_line":49,"end_character":62},"in_reply_to":"5a9d85d2_1822ad52","updated":"2016-06-21 17:08:12.000000000","message":"The goal is not to expose data, so validation/encryption/other protection is not needed.","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d6095407616260dd0f58cf1a2bc0d655587e779a","unresolved":false,"context_lines":[{"line_number":70,"context_line":"Authorization will become redundant, client side authentication will be enough"},{"line_number":71,"context_line":"to do all the operations."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Token validation as it is now passes away, so keystonemiddleware component"},{"line_number":74,"context_line":"may become unnecessary."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Several pieces of middleware used in keystone application to handle auth data"},{"line_number":77,"context_line":"may be removed."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a9d85d2_d8b5c5ee","line":74,"range":{"start_line":73,"start_character":0,"end_line":74,"end_character":23},"updated":"2016-06-21 15:17:53.000000000","message":"How do we check tokens are valid ?","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"1a7fb6787ca27e5421ccd5cee6e9ce1e0d2acb74","unresolved":false,"context_lines":[{"line_number":70,"context_line":"Authorization will become redundant, client side authentication will be enough"},{"line_number":71,"context_line":"to do all the operations."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Token validation as it is now passes away, so keystonemiddleware component"},{"line_number":74,"context_line":"may become unnecessary."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Several pieces of middleware used in keystone application to handle auth data"},{"line_number":77,"context_line":"may be removed."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_a6e11ad3","line":74,"range":{"start_line":73,"start_character":0,"end_line":74,"end_character":23},"in_reply_to":"3aaa91ec_55c1fe2d","updated":"2016-06-21 18:02:18.000000000","message":"There will still be unscoped tokens right ? Those still need to be validated","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"93d4e064c2cdd71214366b41976d1ec013ba48e3","unresolved":false,"context_lines":[{"line_number":70,"context_line":"Authorization will become redundant, client side authentication will be enough"},{"line_number":71,"context_line":"to do all the operations."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Token validation as it is now passes away, so keystonemiddleware component"},{"line_number":74,"context_line":"may become unnecessary."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Several pieces of middleware used in keystone application to handle auth data"},{"line_number":77,"context_line":"may be removed."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_55c1fe2d","line":74,"range":{"start_line":73,"start_character":0,"end_line":74,"end_character":23},"in_reply_to":"5a9d85d2_d8b5c5ee","updated":"2016-06-21 17:08:12.000000000","message":"Which tokens? :)","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d6095407616260dd0f58cf1a2bc0d655587e779a","unresolved":false,"context_lines":[{"line_number":79,"context_line":"Performance Impact"},{"line_number":80,"context_line":"------------------"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Every policy enforcement turns into a call to keystone service that will"},{"line_number":83,"context_line":"make this API entry the most loaded call in keystone, so caching will be"},{"line_number":84,"context_line":"required."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Token validation becomes mere identity check as identity access rights checking"},{"line_number":87,"context_line":"becomes internal for keystone."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a9d85d2_389cc968","line":84,"range":{"start_line":82,"start_character":0,"end_line":84,"end_character":9},"updated":"2016-06-21 15:17:53.000000000","message":"caching authorization ?","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"93d4e064c2cdd71214366b41976d1ec013ba48e3","unresolved":false,"context_lines":[{"line_number":79,"context_line":"Performance Impact"},{"line_number":80,"context_line":"------------------"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Every policy enforcement turns into a call to keystone service that will"},{"line_number":83,"context_line":"make this API entry the most loaded call in keystone, so caching will be"},{"line_number":84,"context_line":"required."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Token validation becomes mere identity check as identity access rights checking"},{"line_number":87,"context_line":"becomes internal for keystone."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_1523f606","line":84,"range":{"start_line":82,"start_character":0,"end_line":84,"end_character":9},"in_reply_to":"5a9d85d2_389cc968","updated":"2016-06-21 17:08:12.000000000","message":"for example","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d6095407616260dd0f58cf1a2bc0d655587e779a","unresolved":false,"context_lines":[{"line_number":89,"context_line":"Other Deployer Impact"},{"line_number":90,"context_line":"---------------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"None"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Developer Impact"},{"line_number":95,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a9d85d2_f83b6136","line":92,"range":{"start_line":92,"start_character":0,"end_line":92,"end_character":4},"updated":"2016-06-21 15:17:53.000000000","message":"Don\u0027t they need to configure anything at all?","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"93d4e064c2cdd71214366b41976d1ec013ba48e3","unresolved":false,"context_lines":[{"line_number":89,"context_line":"Other Deployer Impact"},{"line_number":90,"context_line":"---------------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"None"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Developer Impact"},{"line_number":95,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_f5590a90","line":92,"range":{"start_line":92,"start_character":0,"end_line":92,"end_character":4},"in_reply_to":"5a9d85d2_f83b6136","updated":"2016-06-21 17:08:12.000000000","message":"Right. Enumerating it.","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d6095407616260dd0f58cf1a2bc0d655587e779a","unresolved":false,"context_lines":[{"line_number":102,"context_line":"Assignee(s)"},{"line_number":103,"context_line":"-----------"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Who is leading the writing of the code? Or is this a blueprint where you\u0027re"},{"line_number":106,"context_line":"throwing it out there to see who picks it up?"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"If more than one person is working on the implementation, please designate the"},{"line_number":109,"context_line":"primary author and contact."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Primary assignee:"},{"line_number":112,"context_line":"  amakarov"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a9d85d2_d80dc591","line":109,"range":{"start_line":105,"start_character":0,"end_line":109,"end_character":27},"updated":"2016-06-21 15:17:53.000000000","message":"remove this","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"93d4e064c2cdd71214366b41976d1ec013ba48e3","unresolved":false,"context_lines":[{"line_number":102,"context_line":"Assignee(s)"},{"line_number":103,"context_line":"-----------"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Who is leading the writing of the code? Or is this a blueprint where you\u0027re"},{"line_number":106,"context_line":"throwing it out there to see who picks it up?"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"If more than one person is working on the implementation, please designate the"},{"line_number":109,"context_line":"primary author and contact."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Primary assignee:"},{"line_number":112,"context_line":"  amakarov"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_554bbeb0","line":109,"range":{"start_line":105,"start_character":0,"end_line":109,"end_character":27},"in_reply_to":"5a9d85d2_d80dc591","updated":"2016-06-21 17:08:12.000000000","message":"Done","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d6095407616260dd0f58cf1a2bc0d655587e779a","unresolved":false,"context_lines":[{"line_number":117,"context_line":"Work Items"},{"line_number":118,"context_line":"----------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"- PoC that policy enforcement can use external calls"},{"line_number":121,"context_line":"- Policy enforcement endpoint"},{"line_number":122,"context_line":"- Policy database structure to manage and enforce policies effectively"},{"line_number":123,"context_line":"- Policy enforcement engine"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a9d85d2_f8224100","line":120,"range":{"start_line":120,"start_character":2,"end_line":120,"end_character":52},"updated":"2016-06-21 15:17:53.000000000","message":"It already does today, oslo policy support calling URLs","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"93d4e064c2cdd71214366b41976d1ec013ba48e3","unresolved":false,"context_lines":[{"line_number":117,"context_line":"Work Items"},{"line_number":118,"context_line":"----------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"- PoC that policy enforcement can use external calls"},{"line_number":121,"context_line":"- Policy enforcement endpoint"},{"line_number":122,"context_line":"- Policy database structure to manage and enforce policies effectively"},{"line_number":123,"context_line":"- Policy enforcement engine"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_754ebac2","line":120,"range":{"start_line":120,"start_character":2,"end_line":120,"end_character":52},"in_reply_to":"5a9d85d2_f8224100","updated":"2016-06-21 17:08:12.000000000","message":"Done","commit_id":"88122626de8a852195b6b5879349ebdb5f493c12"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"9d0ab7bcc8c4634dca208984603a4dc80d0afdcc","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Problem Description"},{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"The current architecture (with role assignment control and policy enforcement"},{"line_number":25,"context_line":"separated) forces us to use bearer tokens to provide external service"},{"line_number":26,"context_line":"the information required for policy enforcement."},{"line_number":27,"context_line":"This information is called \"token scope\". Token scope exposes information about"},{"line_number":28,"context_line":"role assignment used to issue the token."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Proposed Change"},{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3aaa91ec_a8d09d54","line":28,"range":{"start_line":24,"start_character":0,"end_line":28,"end_character":40},"updated":"2016-06-22 10:56:17.000000000","message":"Where is the problem here ? Please be clear what the problem is","commit_id":"b4d2336e80e7177979a019619963e67695a44b7d"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"9d0ab7bcc8c4634dca208984603a4dc80d0afdcc","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Proposed Change"},{"line_number":31,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Introduce an interface for remote policy enforcement to be used by services,"},{"line_number":34,"context_line":"so that services will require identity information (from the token) and"},{"line_number":35,"context_line":"operation to be served (from the request) for access control check."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"- Add an endpoint to the keystone application that can be used in services"},{"line_number":38,"context_line":"  policy.json files in http_check-style rules."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3aaa91ec_284cad41","line":35,"range":{"start_line":33,"start_character":0,"end_line":35,"end_character":67},"updated":"2016-06-22 10:56:17.000000000","message":"What\u0027s the advantage of this proposal ? How does it solve the problem (that should be) stated above ? Why is it better than what we have today?","commit_id":"b4d2336e80e7177979a019619963e67695a44b7d"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"e54e2e181f96c7cfcbc54ced142d376d5b4d3f82","unresolved":false,"context_lines":[{"line_number":25,"context_line":"separated) forces us to use bearer tokens to provide external service"},{"line_number":26,"context_line":"the information required for policy enforcement - this information is called"},{"line_number":27,"context_line":"\"token scope\"."},{"line_number":28,"context_line":"Token scope exposes information about role assignment used to issue the token"},{"line_number":29,"context_line":"and requires validation."},{"line_number":30,"context_line":"Also current approach requires auth information (usually gathered by"},{"line_number":31,"context_line":"keystonemiddleware) to be used in policy enforcement."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3aaa91ec_f791999a","line":29,"range":{"start_line":28,"start_character":0,"end_line":29,"end_character":24},"updated":"2016-06-23 13:13:29.000000000","message":"Ok, but what is wrong with exposing role assignments ?","commit_id":"0d49f4cdf591513577bfe17d03441cfaf00a49f6"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"e54e2e181f96c7cfcbc54ced142d376d5b4d3f82","unresolved":false,"context_lines":[{"line_number":27,"context_line":"\"token scope\"."},{"line_number":28,"context_line":"Token scope exposes information about role assignment used to issue the token"},{"line_number":29,"context_line":"and requires validation."},{"line_number":30,"context_line":"Also current approach requires auth information (usually gathered by"},{"line_number":31,"context_line":"keystonemiddleware) to be used in policy enforcement."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Proposed Change"},{"line_number":34,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3aaa91ec_17ed4525","line":31,"range":{"start_line":30,"start_character":0,"end_line":31,"end_character":53},"updated":"2016-06-23 13:13:29.000000000","message":"What\u0027s wrong with this ?","commit_id":"0d49f4cdf591513577bfe17d03441cfaf00a49f6"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"43b29ffa27601a314660e5a3682cf3abee7d9b94","unresolved":false,"context_lines":[{"line_number":24,"context_line":"The current architecture (with role assignment control and policy enforcement"},{"line_number":25,"context_line":"separated) forces us to use bearer tokens to provide external service"},{"line_number":26,"context_line":"the information required for policy enforcement - this information is called"},{"line_number":27,"context_line":"\"token scope\". The exposure of token scope is a potential security risk. Token"},{"line_number":28,"context_line":"scope exposes information about role assignment used to issue the token and"},{"line_number":29,"context_line":"requires validation. Token issuance and validation generate the main load for"},{"line_number":30,"context_line":"keystone service."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_5847e04a","line":27,"updated":"2016-06-23 21:46:36.000000000","message":"It would be extremely helpful if you gave an of the token scope information and showed how services use that information in the current implementation and then an example of the new design that shows how the token scope information is contained and not exposed but yet everything still works.  That would really help in being able to evaluate this spec and its changes","commit_id":"6bee7c319a0ea6c36485db6ceb1211f8e7ace695"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"f00c3308bbfc193ef48294ceb12abe0e83f41045","unresolved":false,"context_lines":[{"line_number":24,"context_line":"The current architecture (with role assignment control and policy enforcement"},{"line_number":25,"context_line":"separated) forces us to use bearer tokens to provide external service"},{"line_number":26,"context_line":"the information required for policy enforcement - this information is called"},{"line_number":27,"context_line":"\"token scope\". The exposure of token scope is a potential security risk. Token"},{"line_number":28,"context_line":"scope exposes information about role assignment used to issue the token and"},{"line_number":29,"context_line":"requires validation. Token issuance and validation generate the main load for"},{"line_number":30,"context_line":"keystone service."}],"source_content_type":"text/x-rst","patch_set":6,"id":"3aaa91ec_4c1cdfc1","line":27,"in_reply_to":"3aaa91ec_5847e04a","updated":"2016-06-27 12:05:48.000000000","message":"I\u0027ve added some diagrams comparing workflows in the next commit.","commit_id":"6bee7c319a0ea6c36485db6ceb1211f8e7ace695"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"57253ef1a16a34b6a4fe94d9ce9ce0c4a92304ba","unresolved":false,"context_lines":[{"line_number":304,"context_line":"------------------"},{"line_number":305,"context_line":""},{"line_number":306,"context_line":"Every policy enforcement turns into a call to keystone service that will"},{"line_number":307,"context_line":"make this API entry the most loaded call in keystone, so internal caching will"},{"line_number":308,"context_line":"be required."},{"line_number":309,"context_line":""},{"line_number":310,"context_line":"Token validation becomes mere identity check as identity access rights checking"},{"line_number":311,"context_line":"becomes internal for keystone, so load generated by token issue/validation"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3aaa91ec_200fd22f","line":308,"range":{"start_line":307,"start_character":55,"end_line":308,"end_character":11},"updated":"2016-06-27 12:58:54.000000000","message":"while internal (to keystone) caching is good....don\u0027t we really want this cached in the service nodes (to avoid having to incur a keystone network call each time?","commit_id":"6950bd71b9a18b93f22b0f49de602b5e43c01bf4"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"3d5fca4d2b44d9e1aeb34d5d9bb5f162a56a3b6c","unresolved":false,"context_lines":[{"line_number":304,"context_line":"------------------"},{"line_number":305,"context_line":""},{"line_number":306,"context_line":"Every policy enforcement turns into a call to keystone service that will"},{"line_number":307,"context_line":"make this API entry the most loaded call in keystone, so internal caching will"},{"line_number":308,"context_line":"be required."},{"line_number":309,"context_line":""},{"line_number":310,"context_line":"Token validation becomes mere identity check as identity access rights checking"},{"line_number":311,"context_line":"becomes internal for keystone, so load generated by token issue/validation"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3aaa91ec_1e5dcb79","line":308,"range":{"start_line":307,"start_character":55,"end_line":308,"end_character":11},"in_reply_to":"3aaa91ec_200fd22f","updated":"2016-07-01 19:05:29.000000000","message":"I can\u0027t see this being at all desirable for other services to use unless there\u0027s a local cache so that a network call is not needed for each check.","commit_id":"6950bd71b9a18b93f22b0f49de602b5e43c01bf4"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"57253ef1a16a34b6a4fe94d9ce9ce0c4a92304ba","unresolved":false,"context_lines":[{"line_number":321,"context_line":"Developer Impact"},{"line_number":322,"context_line":"----------------"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"None"},{"line_number":325,"context_line":""},{"line_number":326,"context_line":"Implementation"},{"line_number":327,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3aaa91ec_f56bcaef","line":324,"range":{"start_line":324,"start_character":0,"end_line":324,"end_character":4},"updated":"2016-06-27 12:58:54.000000000","message":"So isn\u0027t this the big thing? We need all the services to agree that it is OK for keystone to store (somehow) all their policy rules/files? When we had the discussions before, they balked at this. We couldn\u0027t even get them to store the policies as a blob in keystone (i.e. nobody, afaik, uses the /policy API). How do we propose getting round this issue?","commit_id":"6950bd71b9a18b93f22b0f49de602b5e43c01bf4"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"3d5fca4d2b44d9e1aeb34d5d9bb5f162a56a3b6c","unresolved":false,"context_lines":[{"line_number":321,"context_line":"Developer Impact"},{"line_number":322,"context_line":"----------------"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"None"},{"line_number":325,"context_line":""},{"line_number":326,"context_line":"Implementation"},{"line_number":327,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3aaa91ec_613c32c0","line":324,"range":{"start_line":324,"start_character":0,"end_line":324,"end_character":4},"in_reply_to":"3aaa91ec_c19250fc","updated":"2016-07-01 19:05:29.000000000","message":"I\u0027m struggling to see the value that this provides for other projects. But I fully admit that I don\u0027t really understand the issue about token scope described above.\n\nHowever I think that the review linked above represents a subtle shift in how policy is handled which makes this proposal even more difficult for me to see as desirable. Projects can now define a default set of policies in code, as Nova has done. What that means is that in general Nova does not need to consult an outside resource(including a policy file) for a policy check since it\u0027s not likely that any particular policy has been changed from that default. So if 99% percent of the time the policy that Keystone would check is going to match what Nova could just check locally that\u0027s a lot of extra overhead. What benefit is provided for incurring that overhead?","commit_id":"6950bd71b9a18b93f22b0f49de602b5e43c01bf4"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3acfabcf7bdb9dbd8dd4625381534fea40ac67c4","unresolved":false,"context_lines":[{"line_number":321,"context_line":"Developer Impact"},{"line_number":322,"context_line":"----------------"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"None"},{"line_number":325,"context_line":""},{"line_number":326,"context_line":"Implementation"},{"line_number":327,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3aaa91ec_ac15789c","line":324,"range":{"start_line":324,"start_character":0,"end_line":324,"end_character":4},"in_reply_to":"3aaa91ec_f56bcaef","updated":"2016-06-27 14:49:06.000000000","message":"Agreed, this completely changes how things work today. If we get some agreement internally, I believe this should go to a cross-project discussion. I suggest this to be a meeting topic","commit_id":"6950bd71b9a18b93f22b0f49de602b5e43c01bf4"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"436673bb793484c10699071a55fb472cbfdda304","unresolved":false,"context_lines":[{"line_number":321,"context_line":"Developer Impact"},{"line_number":322,"context_line":"----------------"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"None"},{"line_number":325,"context_line":""},{"line_number":326,"context_line":"Implementation"},{"line_number":327,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3aaa91ec_c19250fc","line":324,"range":{"start_line":324,"start_character":0,"end_line":324,"end_character":4},"in_reply_to":"3aaa91ec_f56bcaef","updated":"2016-07-01 15:21:46.000000000","message":"Henry, I agree with your concern, asked around a bit, and was given this link: https://review.openstack.org/#/c/329122/. People are quite unhappy with current status quo around policy files, and I think it is time for us to act, because keystone will be just thrown out otherwise.\n\nSamuel, I\u0027m pretty sure we can do this backwards compatible.","commit_id":"6950bd71b9a18b93f22b0f49de602b5e43c01bf4"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"d22d980de239c9e2bb452fdaa19d517fdc8f51ed","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This spec proposes to perform all needed access control checks in keystone"},{"line_number":14,"context_line":"rather than separate the process into:"},{"line_number":15,"context_line":"- policy enforcement performed by every service using oslo.policy"},{"line_number":16,"context_line":"- delegation(assignment) management done by keystone"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":".. _query: https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs+message:apiimpact,n,z"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1aa78d24_5f02f6b4","line":15,"range":{"start_line":15,"start_character":1,"end_line":15,"end_character":65},"updated":"2016-07-12 20:34:51.000000000","message":"This phrase it\u0027s not clear, since we already do the policy enforcement on Keystone. If you want to make sure that every services are doing this enforce, I suggest create a cross-project spec to implement this point.","commit_id":"da66287d160241a93861c3710cd96696e7c389ed"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2efc1fd9209cabd3abf98720f1d40c90b10935ec","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This spec proposes to perform all needed access control checks in keystone"},{"line_number":14,"context_line":"rather than separate the process into:"},{"line_number":15,"context_line":"- policy enforcement performed by every service using oslo.policy"},{"line_number":16,"context_line":"- delegation(assignment) management done by keystone"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":".. _query: https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs+message:apiimpact,n,z"}],"source_content_type":"text/x-rst","patch_set":9,"id":"7a77a97e_8124ddaf","line":15,"in_reply_to":"1aa78d24_5f02f6b4","updated":"2016-11-21 22:23:17.000000000","message":"This sounds like we\u0027re moving the policy enforcement point and the policy decision point into keystone, compared to being enforced at the service. If that is true - it would most definitely affect other projects and would need to be a cross project specification.","commit_id":"da66287d160241a93861c3710cd96696e7c389ed"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"6cf4095a5b673ff1d775ccc0ebe7f2610db44e78","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This spec proposes to perform all needed access control checks in keystone"},{"line_number":14,"context_line":"rather than separate the process into:"},{"line_number":15,"context_line":"- policy enforcement performed by every service using oslo.policy"},{"line_number":16,"context_line":"- delegation(assignment) management done by keystone"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":".. _query: https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs+message:apiimpact,n,z"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5ff73747_b51a787a","line":15,"in_reply_to":"7a77a97e_8124ddaf","updated":"2017-04-25 11:36:48.000000000","message":"Yes, and this looks to be in the opposite direction of where cross-project is going right now, which is making the current distributed approach better.","commit_id":"da66287d160241a93861c3710cd96696e7c389ed"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"03010e06ad0bb9e94852cd8d9d1376420bd26ea9","unresolved":false,"context_lines":[{"line_number":146,"context_line":"so that services will require identity information (from the token) and"},{"line_number":147,"context_line":"operation to be served (from the request) for access control check."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"- Add an endpoint to the keystone application that can be used in services"},{"line_number":150,"context_line":"  policy.json files in http_check-style rules."},{"line_number":151,"context_line":"- Provide policy RESTful API that will allow manipulate policies dynamically."},{"line_number":152,"context_line":"- Add policy enforcement engine capable of using different policy storage"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1aa78d24_0f8553ac","line":149,"updated":"2016-07-05 09:19:06.000000000","message":"Alexander, please add more details here.","commit_id":"da66287d160241a93861c3710cd96696e7c389ed"},{"author":{"_account_id":17862,"name":"Kseniya Tychkova","email":"kseniya.tychkova@gmail.com","username":"ktychkova"},"change_message_id":"03010e06ad0bb9e94852cd8d9d1376420bd26ea9","unresolved":false,"context_lines":[{"line_number":149,"context_line":"- Add an endpoint to the keystone application that can be used in services"},{"line_number":150,"context_line":"  policy.json files in http_check-style rules."},{"line_number":151,"context_line":"- Provide policy RESTful API that will allow manipulate policies dynamically."},{"line_number":152,"context_line":"- Add policy enforcement engine capable of using different policy storage"},{"line_number":153,"context_line":"  backends: either static policy files, or database structure, or even"},{"line_number":154,"context_line":"  a third-party service."},{"line_number":155,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1aa78d24_8fe023ce","line":152,"updated":"2016-07-05 09:19:06.000000000","message":"+1 for this\nBut I think it makes sense to create a separate spec for this because it should be implemented in oslo.policy project and it is a huge feature itself.","commit_id":"da66287d160241a93861c3710cd96696e7c389ed"}]}