)]}'
{"doc/source/index.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c9bf823f64ef013f4120a1205b472cf8e0324e4e","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Rocky approved specs:"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"`Rocky Roadmap \u003chttps://trello.com/b/5F0h9Hoe/keystone-rocky-roadmap\u003e`_"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":".. toctree::"},{"line_number":23,"context_line":"   :glob:"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_659cfabf","line":20,"range":{"start_line":20,"start_character":16,"end_line":20,"end_character":68},"updated":"2018-03-13 20:37:08.000000000","message":"This still points to the Queens roadmap. The Rocky roadmap is available here: \n\nhttps://trello.com/b/wmyzbFq5/keystone-rocky-roadmap","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"93365406ca3a7491b0cef3142dcf847f07e406da","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Rocky approved specs:"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"`Rocky Roadmap \u003chttps://trello.com/b/5F0h9Hoe/keystone-rocky-roadmap\u003e`_"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":".. toctree::"},{"line_number":23,"context_line":"   :glob:"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_7354b6fe","line":20,"range":{"start_line":20,"start_character":16,"end_line":20,"end_character":68},"in_reply_to":"df7087c5_659cfabf","updated":"2018-03-14 10:39:53.000000000","message":"Done","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce10787bbb21147ecffd0d3118dcb02d0f43a543","unresolved":false,"context_lines":[{"line_number":14,"context_line":"keystone"},{"line_number":15,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Rocky approved specs:"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"`Rocky Roadmap \u003chttps://trello.com/b/wmyzbFq5/keystone-rocky-roadmap\u003e`_"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_cfdacf49","line":17,"updated":"2018-03-29 14:57:40.000000000","message":"This probably won\u0027t be needed since we just landed a couple other patches that handed this:\n\nhttps://review.openstack.org/#/c/557060/\n\nEither way - hopefully you shouldn\u0027t have to deal with this bit when you rebase.","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":14,"context_line":"keystone"},{"line_number":15,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Rocky approved specs:"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"`Rocky Roadmap \u003chttps://trello.com/b/wmyzbFq5/keystone-rocky-roadmap\u003e`_"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_6689b024","line":17,"in_reply_to":"bf659307_cfdacf49","updated":"2018-04-09 16:26:52.000000000","message":"Yep. Vanished after the rebase.","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"}],"specs/keystone/ocata/trust-scope-extensions.rst":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bff378f992d4b3fe6154fc3301d2108879a6ec34","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Add Fine Grained Restrictions to Keystone Trusts"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp \u003chttps://blueprints.launchpad.net/keystone/+spec/trust-scope-extensions\u003e`_"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f9dbf25_8b0f30e0","line":8,"updated":"2018-03-03 16:39:07.000000000","message":"Let\u0027s retarget this at application credentials https://docs.openstack.org/keystone/latest/user/application_credentials.html","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f450da01341c0d120db841963684aaffbda61b66","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Add Fine Grained Restrictions to Keystone Trusts"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp \u003chttps://blueprints.launchpad.net/keystone/+spec/trust-scope-extensions\u003e`_"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff6b8bd7_b6596cff","line":8,"in_reply_to":"1f9dbf25_8b0f30e0","updated":"2018-03-06 15:37:31.000000000","message":"Done","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"da1ff2f8580761da6e050b02fd1560e1188c2f90","unresolved":false,"context_lines":[{"line_number":46,"context_line":"be used to grant full access within the trust\u0027s scope, but it cannot be used to"},{"line_number":47,"context_line":"give access limited to just one particular resource or access that only allows"},{"line_number":48,"context_line":"the creation of new resources, but not the modification/deletion of existing"},{"line_number":49,"context_line":"resources."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"With fine-grained restrictions in place, trusts can be used to perform the task"},{"line_number":52,"context_line":"service specific ACLs are currently used (and still being implemented) for, in"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba2be162_fda8ebdd","line":49,"updated":"2017-03-06 18:14:17.000000000","message":"Some of these use cases sound like they can be solved with OAuth or API keys.\n\nhttps://review.openstack.org/#/c/438761/","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bff378f992d4b3fe6154fc3301d2108879a6ec34","unresolved":false,"context_lines":[{"line_number":51,"context_line":"With fine-grained restrictions in place, trusts can be used to perform the task"},{"line_number":52,"context_line":"service specific ACLs are currently used (and still being implemented) for, in"},{"line_number":53,"context_line":"a reliable, consistent manner."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Proposed Change"},{"line_number":56,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f9dbf25_66469b24","line":54,"updated":"2018-03-03 16:39:07.000000000","message":"Might be good to mention here one of the common problems with service user roles, which are faulty because they are currently implemented in a blacklist form - by default all roles get \"member\" level access. Creating a role that has nearly all actions denied in one policy file does not block the role from performing actions on another service that has not blocked that role.","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f450da01341c0d120db841963684aaffbda61b66","unresolved":false,"context_lines":[{"line_number":51,"context_line":"With fine-grained restrictions in place, trusts can be used to perform the task"},{"line_number":52,"context_line":"service specific ACLs are currently used (and still being implemented) for, in"},{"line_number":53,"context_line":"a reliable, consistent manner."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Proposed Change"},{"line_number":56,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff6b8bd7_0554a3c9","line":54,"in_reply_to":"1f9dbf25_66469b24","updated":"2018-03-06 15:37:31.000000000","message":"Yeah, that makes the whole thing a good deal clearer. Added a paragraph about that now.","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bff378f992d4b3fe6154fc3301d2108879a6ec34","unresolved":false,"context_lines":[{"line_number":60,"context_line":"oslo.policy and keystonemiddleware as follows:"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"1) Alongside a trust, capability triples are stored. A capability triple"},{"line_number":63,"context_line":"   consists of a service (e.g. Nova) an oslo.policy target (e.g. \"compute:get\")"},{"line_number":64,"context_line":"   and a permission level. The latter can be"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"     (a) a object UUID for restriction to a specific object"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f9dbf25_8b35f048","line":63,"range":{"start_line":63,"start_character":37,"end_line":63,"end_character":79},"updated":"2018-03-03 16:39:07.000000000","message":"I believe we decided this should be a combination of request method and url path, not a policy target. It might also be good to capture the reasoning for that:\n\n1) this is a user-facing thing and policy targets are not discoverable - making them discoverable would require forcing all projects to document their policy target names, which would turn them into user-facing APIs and not just the config options they are today\n2) rejecting requests from the middleware rather than oslo.policy means a faster tail","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f450da01341c0d120db841963684aaffbda61b66","unresolved":false,"context_lines":[{"line_number":60,"context_line":"oslo.policy and keystonemiddleware as follows:"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"1) Alongside a trust, capability triples are stored. A capability triple"},{"line_number":63,"context_line":"   consists of a service (e.g. Nova) an oslo.policy target (e.g. \"compute:get\")"},{"line_number":64,"context_line":"   and a permission level. The latter can be"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"     (a) a object UUID for restriction to a specific object"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff6b8bd7_c55f8be3","line":63,"range":{"start_line":63,"start_character":37,"end_line":63,"end_character":79},"in_reply_to":"1f9dbf25_8b35f048","updated":"2018-03-06 15:37:31.000000000","message":"Done","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bff378f992d4b3fe6154fc3301d2108879a6ec34","unresolved":false,"context_lines":[{"line_number":63,"context_line":"   consists of a service (e.g. Nova) an oslo.policy target (e.g. \"compute:get\")"},{"line_number":64,"context_line":"   and a permission level. The latter can be"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"     (a) a object UUID for restriction to a specific object"},{"line_number":67,"context_line":"     (b) the keyword \u0027user\u0027 for restriction to objects owned by the trustee"},{"line_number":68,"context_line":"         user"},{"line_number":69,"context_line":"     (c) unspecified for unrestricted access to that target with the trust\u0027s"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f9dbf25_4b3fe824","line":66,"range":{"start_line":66,"start_character":5,"end_line":66,"end_character":59},"updated":"2018-03-03 16:39:07.000000000","message":"This could be part of the url path and not a specific attribute","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f450da01341c0d120db841963684aaffbda61b66","unresolved":false,"context_lines":[{"line_number":63,"context_line":"   consists of a service (e.g. Nova) an oslo.policy target (e.g. \"compute:get\")"},{"line_number":64,"context_line":"   and a permission level. The latter can be"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"     (a) a object UUID for restriction to a specific object"},{"line_number":67,"context_line":"     (b) the keyword \u0027user\u0027 for restriction to objects owned by the trustee"},{"line_number":68,"context_line":"         user"},{"line_number":69,"context_line":"     (c) unspecified for unrestricted access to that target with the trust\u0027s"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff6b8bd7_48b1528f","line":66,"range":{"start_line":66,"start_character":5,"end_line":66,"end_character":59},"in_reply_to":"1f9dbf25_4b3fe824","updated":"2018-03-06 15:37:31.000000000","message":"I rewrote that whole section now and showed the possibility of having the UUID in there through an example.","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bff378f992d4b3fe6154fc3301d2108879a6ec34","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   and a permission level. The latter can be"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"     (a) a object UUID for restriction to a specific object"},{"line_number":67,"context_line":"     (b) the keyword \u0027user\u0027 for restriction to objects owned by the trustee"},{"line_number":68,"context_line":"         user"},{"line_number":69,"context_line":"     (c) unspecified for unrestricted access to that target with the trust\u0027s"},{"line_number":70,"context_line":"         role/project scope"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"   This list is a white list, e.g. access to an unspecified target is denied by"},{"line_number":73,"context_line":"   default. Keystone does not validate the content of capability triples since"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f9dbf25_0bf48085","line":70,"range":{"start_line":67,"start_character":5,"end_line":70,"end_character":27},"updated":"2018-03-03 16:39:07.000000000","message":"These will not be necessary since an application credential already consists of a user and a project, a user cannot delegate to another user or a project that the application credential isn\u0027t for","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bff378f992d4b3fe6154fc3301d2108879a6ec34","unresolved":false,"context_lines":[{"line_number":70,"context_line":"         role/project scope"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"   This list is a white list, e.g. access to an unspecified target is denied by"},{"line_number":73,"context_line":"   default. Keystone does not validate the content of capability triples since"},{"line_number":74,"context_line":"   that would require awareness of service specific policy rules."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"   In addition to capability triples, a list of endpoints the trust is valid"},{"line_number":77,"context_line":"   for can optionally be specified. An empty list means access to any endpoint."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f9dbf25_cb1458a3","line":74,"range":{"start_line":73,"start_character":12,"end_line":74,"end_character":65},"updated":"2018-03-03 16:39:07.000000000","message":"Enforcement would live in keystonemiddleware and the whitelist would be a part of the application credential and stored in the application_credential object in the token, so keystonemiddleware can validate based entirely on information in the request context.","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f450da01341c0d120db841963684aaffbda61b66","unresolved":false,"context_lines":[{"line_number":70,"context_line":"         role/project scope"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"   This list is a white list, e.g. access to an unspecified target is denied by"},{"line_number":73,"context_line":"   default. Keystone does not validate the content of capability triples since"},{"line_number":74,"context_line":"   that would require awareness of service specific policy rules."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"   In addition to capability triples, a list of endpoints the trust is valid"},{"line_number":77,"context_line":"   for can optionally be specified. An empty list means access to any endpoint."}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff6b8bd7_08591a59","line":74,"range":{"start_line":73,"start_character":12,"end_line":74,"end_character":65},"in_reply_to":"1f9dbf25_cb1458a3","updated":"2018-03-06 15:37:31.000000000","message":"Done","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bff378f992d4b3fe6154fc3301d2108879a6ec34","unresolved":false,"context_lines":[{"line_number":79,"context_line":"2) The service receives the additional permission information stored alongside"},{"line_number":80,"context_line":"   the trust in the course of token validation. Based on the endpoint list"},{"line_number":81,"context_line":"   keystonemiddleware performs the first check: it checks the list of endpoints"},{"line_number":82,"context_line":"   against the endpoint the token is being used for. If the list is empty or"},{"line_number":83,"context_line":"   the current endpoint is in the list, it allows the request to proceed."},{"line_number":84,"context_line":"   Otherwise it denies the request."},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f9dbf25_0b224001","line":82,"range":{"start_line":82,"start_character":60,"end_line":82,"end_character":73},"updated":"2018-03-03 16:39:07.000000000","message":"If the user creates an application credential with an empty whitelist, that should mean deny all. The other option is the absence of a list, which would mean accept all and fall into this case.","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f450da01341c0d120db841963684aaffbda61b66","unresolved":false,"context_lines":[{"line_number":79,"context_line":"2) The service receives the additional permission information stored alongside"},{"line_number":80,"context_line":"   the trust in the course of token validation. Based on the endpoint list"},{"line_number":81,"context_line":"   keystonemiddleware performs the first check: it checks the list of endpoints"},{"line_number":82,"context_line":"   against the endpoint the token is being used for. If the list is empty or"},{"line_number":83,"context_line":"   the current endpoint is in the list, it allows the request to proceed."},{"line_number":84,"context_line":"   Otherwise it denies the request."},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff6b8bd7_28565e2b","line":82,"range":{"start_line":82,"start_character":60,"end_line":82,"end_character":73},"in_reply_to":"1f9dbf25_0b224001","updated":"2018-03-06 15:37:31.000000000","message":"Done","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bff378f992d4b3fe6154fc3301d2108879a6ec34","unresolved":false,"context_lines":[{"line_number":83,"context_line":"   the current endpoint is in the list, it allows the request to proceed."},{"line_number":84,"context_line":"   Otherwise it denies the request."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"3) If keystonemiddleware\u0027s endpoint check passes, oslo.policy performs the"},{"line_number":87,"context_line":"   second check: it verifies if the trust\u0027s capabilities (or rather the subset"},{"line_number":88,"context_line":"   applying to the service in question) allow the request being made. If not,"},{"line_number":89,"context_line":"   it denies the request. Only if the trust\u0027s capabilities allow the request,"},{"line_number":90,"context_line":"   oslo.policy proceeds to the regular policy checks as they exist today."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Alternatives"},{"line_number":93,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f9dbf25_cb79b8fc","line":90,"range":{"start_line":86,"start_character":2,"end_line":90,"end_character":73},"updated":"2018-03-03 16:39:07.000000000","message":"This is worth mentioning but it is not a new feature, this would just be the normal role and scope check that oslo.policy already does.","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f450da01341c0d120db841963684aaffbda61b66","unresolved":false,"context_lines":[{"line_number":83,"context_line":"   the current endpoint is in the list, it allows the request to proceed."},{"line_number":84,"context_line":"   Otherwise it denies the request."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"3) If keystonemiddleware\u0027s endpoint check passes, oslo.policy performs the"},{"line_number":87,"context_line":"   second check: it verifies if the trust\u0027s capabilities (or rather the subset"},{"line_number":88,"context_line":"   applying to the service in question) allow the request being made. If not,"},{"line_number":89,"context_line":"   it denies the request. Only if the trust\u0027s capabilities allow the request,"},{"line_number":90,"context_line":"   oslo.policy proceeds to the regular policy checks as they exist today."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Alternatives"},{"line_number":93,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff6b8bd7_8813ea66","line":90,"range":{"start_line":86,"start_character":2,"end_line":90,"end_character":73},"in_reply_to":"1f9dbf25_cb79b8fc","updated":"2018-03-06 15:37:31.000000000","message":"Agreed. I omitted that part in the current patch set and mentioned that a handover to regular `oslo.policy` scope check happens whereever it happens.","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bff378f992d4b3fe6154fc3301d2108879a6ec34","unresolved":false,"context_lines":[{"line_number":108,"context_line":"3) Consistency: with multiple sources of truth, an individual service\u0027s ACLs"},{"line_number":109,"context_line":"                may well end up overriding a cloud-wide policy permitting or"},{"line_number":110,"context_line":"                denying an operation."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Security Impact"},{"line_number":113,"context_line":"---------------"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f9dbf25_8b5c107f","line":111,"updated":"2018-03-03 16:39:07.000000000","message":"Let\u0027s capture the role check in middleware approach that was proposed in https://review.openstack.org/#/c/391624/ and describe how this is different:\n\n1) This does not require an explosion of fine-grained roles that must be managed by an administrator.\n2) This does not change how existing policy works, which puts less pressure on us to make it fully feature-complete the first time around: we can consider things like changing behavior based on the request body as needed, and this could even empower us to enforce different restrictions based on query parameters which existing policy rules do not.\n3) This feature has a different audience than the role check in middleware feature: this is intended to be used by end-users (or other services) to enable access to a very short list of actions. Roles and policy, on the other hand, is crafted by operators to create profiles that users can assume.\n4) It doesn\u0027t require keystone to be the guardian of access control rules, since all the information needed to validate access is contained in the token.","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f450da01341c0d120db841963684aaffbda61b66","unresolved":false,"context_lines":[{"line_number":108,"context_line":"3) Consistency: with multiple sources of truth, an individual service\u0027s ACLs"},{"line_number":109,"context_line":"                may well end up overriding a cloud-wide policy permitting or"},{"line_number":110,"context_line":"                denying an operation."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Security Impact"},{"line_number":113,"context_line":"---------------"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"ff6b8bd7_7e5bb086","line":111,"in_reply_to":"1f9dbf25_8b5c107f","updated":"2018-03-06 15:37:31.000000000","message":"Done","commit_id":"33c2db9b693fc958e2ee821f22f599c73bb69389"}],"specs/keystone/rocky/capabilities-app-creds.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce10787bbb21147ecffd0d3118dcb02d0f43a543","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Add Fine Grained Restrictions to Application Credentials"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp \u003chttps://blueprints.launchpad.net/keystone/+spec/whitelist-extension-for-app-creds\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Currently Keystone application credentials are mostly unrestricted."},{"line_number":14,"context_line":"Restrictions can only be imposed on creation of follow-up application"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_6fa703a9","line":11,"updated":"2018-03-29 14:57:40.000000000","message":"About the 404\u0027ing. During the specification proposal process, it is acceptable to have this 404. Once the specification is agreed upon, we go and create a dedicated blueprint for tracking the work.\n\nIt\u0027s fine that it\u0027s already created. Just explaining some of the process behind it (which might not be all that apparent).","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Add Fine Grained Restrictions to Application Credentials"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp \u003chttps://blueprints.launchpad.net/keystone/+spec/whitelist-extension-for-app-creds\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Currently Keystone application credentials are mostly unrestricted."},{"line_number":14,"context_line":"Restrictions can only be imposed on creation of follow-up application"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_668e9028","line":11,"in_reply_to":"bf659307_6fa703a9","updated":"2018-04-09 16:26:52.000000000","message":"Ah, ok. I got it a bit backwards then. Thanks for the explanation :-)","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce10787bbb21147ecffd0d3118dcb02d0f43a543","unresolved":false,"context_lines":[{"line_number":152,"context_line":"   This should not have a foreign key constraint so as not to create"},{"line_number":153,"context_line":"   dependencies from the catalog on arbitrary capabilities. If a non-existent"},{"line_number":154,"context_line":"   UUID is being referenced, keystonemiddleware will simply reject the request"},{"line_number":155,"context_line":"   since there is no match that way."},{"line_number":156,"context_line":"2) A UUID that serves as a primary key. This is used to reference the path"},{"line_number":157,"context_line":"   template to use for evaluation when creating a capability. This reference is"},{"line_number":158,"context_line":"   only used for validation upon application credential creation and not"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_ef37934c","line":155,"updated":"2018-03-29 14:57:40.000000000","message":"I presume the same will happen if I attempt to update a path template with an invalid service ID? Also, are we going to clean out various path templates if a service is deleted?","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":152,"context_line":"   This should not have a foreign key constraint so as not to create"},{"line_number":153,"context_line":"   dependencies from the catalog on arbitrary capabilities. If a non-existent"},{"line_number":154,"context_line":"   UUID is being referenced, keystonemiddleware will simply reject the request"},{"line_number":155,"context_line":"   since there is no match that way."},{"line_number":156,"context_line":"2) A UUID that serves as a primary key. This is used to reference the path"},{"line_number":157,"context_line":"   template to use for evaluation when creating a capability. This reference is"},{"line_number":158,"context_line":"   only used for validation upon application credential creation and not"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_21ff2268","line":155,"in_reply_to":"bf659307_ef37934c","updated":"2018-04-09 16:26:52.000000000","message":"\u003e I presume the same will happen if I attempt to update a path template with an invalid service ID?\n\nIf you attempt to update a path template with an invalid service UUID, the same validation that will fail upon creation will also fail upon update. I clarified that section a bit on it.\n\n\u003e Also, are we going to clean out various path templates if a service is deleted?\n\nI wasn\u0027t planning on it, since service deletion will automatically invalidate them  by virtue of no service having the deleted ID after deletion. We could do it if we wanted to, though: both capabilities and the URL templates them have a record of the service UUID in question. I\u0027d prefer leaving them around though, because \"Oh, that service ID does not exist anymore\" makes for gentler debugging than \"Why did my capabilities/URL templates vanish all of a sudden?!\".","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce10787bbb21147ecffd0d3118dcb02d0f43a543","unresolved":false,"context_lines":[{"line_number":177,"context_line":"4) A boolean `allow_chained` attribute (`False` by default). If this is `True`"},{"line_number":178,"context_line":"   for all URL templates referenced when creating an application credential,"},{"line_number":179,"context_line":"   that application credential\u0027s own `allow_chained` attribute may be set to"},{"line_number":180,"context_line":"   `True`."},{"line_number":181,"context_line":"5) A list of template keys to be provided by the user (henceforth referred to"},{"line_number":182,"context_line":"   as \"user template keys\")."},{"line_number":183,"context_line":"6) A list of template keys to be provided from token context. (henceforth"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_0f644749","line":180,"updated":"2018-03-29 14:57:40.000000000","message":"When I first read this, I was under the assumption that there was only going to be one place to flip this switch. It looks like operators have to set it on the path template and users have to specify it when they create an application credential, yeah?","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":177,"context_line":"4) A boolean `allow_chained` attribute (`False` by default). If this is `True`"},{"line_number":178,"context_line":"   for all URL templates referenced when creating an application credential,"},{"line_number":179,"context_line":"   that application credential\u0027s own `allow_chained` attribute may be set to"},{"line_number":180,"context_line":"   `True`."},{"line_number":181,"context_line":"5) A list of template keys to be provided by the user (henceforth referred to"},{"line_number":182,"context_line":"   as \"user template keys\")."},{"line_number":183,"context_line":"6) A list of template keys to be provided from token context. (henceforth"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_41481686","line":180,"in_reply_to":"bf659307_0f644749","updated":"2018-04-09 16:26:52.000000000","message":"There are two places, yes. That serves two use cases:\n\n1) The operator can decide whether chaining is allowed on a per URL template basis.\n2) The user themselves can in turn allow chaining on their capabilities, given a URL template that allows chaining. If they do not need chaining, though they are free to set `allow_chained` to `False`, thus making their capabilities more restrictive than the URL template (which may after all be of the `**` / `allow_chained\u003dTrue` variety created by an operator in \"I trust my users to be sensible\" mode).\n\nIf the only switch for this is (1), the operator forces all application credentials to allow chaining by setting `allow_chained\u003dTrue`.\n\nIf the only switch for this is (2), the user may (indirectly, through chained requests) get more access than the operator wants them to have.","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce10787bbb21147ecffd0d3118dcb02d0f43a543","unresolved":false,"context_lines":[{"line_number":218,"context_line":""},{"line_number":219,"context_line":"1) When requesting token validation, `keystonemiddleware` (or any 3rd party"},{"line_number":220,"context_line":"   application that supports capability enforcement) sets an"},{"line_number":221,"context_line":"   `Openstack-Identity-Capabilities` header with a version string as its valu."},{"line_number":222,"context_line":"   Token validation for an application credential with a capability list will"},{"line_number":223,"context_line":"   only succeed if this header is present. The version string will allow us to"},{"line_number":224,"context_line":"   safely extend this feature by invalidating tokens using the extended version"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_6fdf03d6","line":221,"range":{"start_line":221,"start_character":73,"end_line":221,"end_character":77},"updated":"2018-03-29 14:57:40.000000000","message":"nit: value*","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":218,"context_line":""},{"line_number":219,"context_line":"1) When requesting token validation, `keystonemiddleware` (or any 3rd party"},{"line_number":220,"context_line":"   application that supports capability enforcement) sets an"},{"line_number":221,"context_line":"   `Openstack-Identity-Capabilities` header with a version string as its valu."},{"line_number":222,"context_line":"   Token validation for an application credential with a capability list will"},{"line_number":223,"context_line":"   only succeed if this header is present. The version string will allow us to"},{"line_number":224,"context_line":"   safely extend this feature by invalidating tokens using the extended version"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_a1581256","line":221,"range":{"start_line":221,"start_character":73,"end_line":221,"end_character":77},"in_reply_to":"bf659307_6fdf03d6","updated":"2018-04-09 16:26:52.000000000","message":"Done","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce10787bbb21147ecffd0d3118dcb02d0f43a543","unresolved":false,"context_lines":[{"line_number":223,"context_line":"   only succeed if this header is present. The version string will allow us to"},{"line_number":224,"context_line":"   safely extend this feature by invalidating tokens using the extended version"},{"line_number":225,"context_line":"   in situations where `keystonemiddleware` only supports an older version"},{"line_number":226,"context_line":"   of this feature."},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"2) If there is no `Openstack-Identity-Whitelist-Supported` header in the token"},{"line_number":229,"context_line":"   validation request, token validation fails."}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_2f9cab0d","line":226,"updated":"2018-03-29 14:57:40.000000000","message":"What if an older keystonemiddleware attempts to validate a application credential token that doesn\u0027t have a capability list? So, it\u0027s not setting the header, but it\u0027s also not validating a token with the newer capability functionality.","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":223,"context_line":"   only succeed if this header is present. The version string will allow us to"},{"line_number":224,"context_line":"   safely extend this feature by invalidating tokens using the extended version"},{"line_number":225,"context_line":"   in situations where `keystonemiddleware` only supports an older version"},{"line_number":226,"context_line":"   of this feature."},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"2) If there is no `Openstack-Identity-Whitelist-Supported` header in the token"},{"line_number":229,"context_line":"   validation request, token validation fails."}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_ace5693a","line":226,"in_reply_to":"bf659307_2f9cab0d","updated":"2018-04-09 16:26:52.000000000","message":"In that case validation proceeds as it would have before the introduction of capabilities. The header check only takes place if the `capabilities` attribute of the application credential is not `None`. I spelled that out explicitly now.","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce10787bbb21147ecffd0d3118dcb02d0f43a543","unresolved":false,"context_lines":[{"line_number":225,"context_line":"   in situations where `keystonemiddleware` only supports an older version"},{"line_number":226,"context_line":"   of this feature."},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"2) If there is no `Openstack-Identity-Whitelist-Supported` header in the token"},{"line_number":229,"context_line":"   validation request, token validation fails."},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"This way we ensure that nobody erroneously assumes capabilities are being"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_2ff7cb61","line":228,"range":{"start_line":228,"start_character":19,"end_line":228,"end_character":57},"updated":"2018-03-29 14:57:40.000000000","message":"Isn\u0027t this suppose to be the same header as above, or are we adding two separate headers to the API?","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":225,"context_line":"   in situations where `keystonemiddleware` only supports an older version"},{"line_number":226,"context_line":"   of this feature."},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"2) If there is no `Openstack-Identity-Whitelist-Supported` header in the token"},{"line_number":229,"context_line":"   validation request, token validation fails."},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"This way we ensure that nobody erroneously assumes capabilities are being"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_8cd42549","line":228,"range":{"start_line":228,"start_character":19,"end_line":228,"end_character":57},"in_reply_to":"bf659307_2ff7cb61","updated":"2018-04-09 16:26:52.000000000","message":"Sorry, missed that one when I edited this last time. Fixed now!","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce10787bbb21147ecffd0d3118dcb02d0f43a543","unresolved":false,"context_lines":[{"line_number":242,"context_line":"URL Paths and Roles"},{"line_number":243,"context_line":"-------------------"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"URL paths will have an optional ROLE_ID value.  If this value is set, it"},{"line_number":246,"context_line":"indicates the role that the user needs to provide in the application credential"},{"line_number":247,"context_line":"in order for the call to proceed. In addition, if the role_id value is set, the"},{"line_number":248,"context_line":"user will only be able to use the URL value in a capability if the user has"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_ef6f93f9","line":245,"updated":"2018-03-29 14:57:40.000000000","message":"This needs to be set by the operator on the template, right?","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":242,"context_line":"URL Paths and Roles"},{"line_number":243,"context_line":"-------------------"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"URL paths will have an optional ROLE_ID value.  If this value is set, it"},{"line_number":246,"context_line":"indicates the role that the user needs to provide in the application credential"},{"line_number":247,"context_line":"in order for the call to proceed. In addition, if the role_id value is set, the"},{"line_number":248,"context_line":"user will only be able to use the URL value in a capability if the user has"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_ac6c899c","line":245,"in_reply_to":"bf659307_ef6f93f9","updated":"2018-04-09 16:26:52.000000000","message":"Yes - since only operators may edit URL templates (Also, I replaced \"URL path\" by \"URL path template\" in this section and the previous one for consistency now)","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce10787bbb21147ecffd0d3118dcb02d0f43a543","unresolved":false,"context_lines":[{"line_number":297,"context_line":"            \"roles\": ["},{"line_number":298,"context_line":"                {\"name\": \"monasca-agent\"}"},{"line_number":299,"context_line":"            ]"},{"line_number":300,"context_line":"            capabilities: ["},{"line_number":301,"context_line":"              {"},{"line_number":302,"context_line":"                \"path\": \"/v2.0/metrics\","},{"line_number":303,"context_line":"                \"substitutions\": {},"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_818fcb73","line":300,"updated":"2018-03-29 14:57:40.000000000","message":"This fixed pep8 for me locally: \n\nhttp://paste.openstack.org/show/717915/","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":297,"context_line":"            \"roles\": ["},{"line_number":298,"context_line":"                {\"name\": \"monasca-agent\"}"},{"line_number":299,"context_line":"            ]"},{"line_number":300,"context_line":"            capabilities: ["},{"line_number":301,"context_line":"              {"},{"line_number":302,"context_line":"                \"path\": \"/v2.0/metrics\","},{"line_number":303,"context_line":"                \"substitutions\": {},"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_ccfc5db7","line":300,"in_reply_to":"bf659307_818fcb73","updated":"2018-04-09 16:26:52.000000000","message":"Adam fixed it, in patch set 22, so looks to be the case for pep8 in CI, too :-)","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ce10787bbb21147ecffd0d3118dcb02d0f43a543","unresolved":false,"context_lines":[{"line_number":506,"context_line":"  section needs to be documented in the Keystone admin guide."},{"line_number":507,"context_line":""},{"line_number":508,"context_line":"* Documentation on capabilities needs to be added to the *Application"},{"line_number":509,"context_line":"  Credentials* section of the Keystone user documentation."},{"line_number":510,"context_line":""},{"line_number":511,"context_line":"References"},{"line_number":512,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_a1452f45","line":509,"updated":"2018-03-29 14:57:40.000000000","message":"++","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":506,"context_line":"  section needs to be documented in the Keystone admin guide."},{"line_number":507,"context_line":""},{"line_number":508,"context_line":"* Documentation on capabilities needs to be added to the *Application"},{"line_number":509,"context_line":"  Credentials* section of the Keystone user documentation."},{"line_number":510,"context_line":""},{"line_number":511,"context_line":"References"},{"line_number":512,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf659307_0c1c9511","line":509,"in_reply_to":"bf659307_a1452f45","updated":"2018-04-09 16:26:52.000000000","message":"What do you mean by that?","commit_id":"1af1ee56afdf4d8efad756e3c6af35df5f4bf0e4"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"1ea972a00f7c2cf8dc36ccfae8008b4330b4d2f3","unresolved":false,"context_lines":[{"line_number":238,"context_line":"Users can list the operator maintained URL path templates through the Keystone"},{"line_number":239,"context_line":"API. This allows them to discover the URL path templates they can use for"},{"line_number":240,"context_line":"creating capability enabled application credentials."},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"URL Paths and Roles"},{"line_number":243,"context_line":"-------------------"},{"line_number":244,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"bf659307_f6c2b952","line":241,"updated":"2018-04-03 19:18:27.000000000","message":"Defining the API request here would be good. GET /v3/capability-templates maybe?","commit_id":"a50f799ad06c5cebe9946a5aa5821fa850f69bdc"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":238,"context_line":"Users can list the operator maintained URL path templates through the Keystone"},{"line_number":239,"context_line":"API. This allows them to discover the URL path templates they can use for"},{"line_number":240,"context_line":"creating capability enabled application credentials."},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"URL Paths and Roles"},{"line_number":243,"context_line":"-------------------"},{"line_number":244,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"bf659307_3ca984dc","line":241,"in_reply_to":"bf659307_f6c2b952","updated":"2018-04-09 16:26:52.000000000","message":"Indeed. I meant to do that before Easter but forgot about it...\n\nI added it to the API examples section now.","commit_id":"a50f799ad06c5cebe9946a5aa5821fa850f69bdc"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"1ea972a00f7c2cf8dc36ccfae8008b4330b4d2f3","unresolved":false,"context_lines":[{"line_number":308,"context_line":"                \"path\": \"/v3.0/logs\","},{"line_number":309,"context_line":"                \"substitutions\": {},"},{"line_number":310,"context_line":"                \"type\": \"POST\","},{"line_number":311,"context_line":"                \"url_template\": \"c73beef3-c982-4ed8-86d5-dd362af48614\""},{"line_number":312,"context_line":"              }"},{"line_number":313,"context_line":"            ]"},{"line_number":314,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":22,"id":"bf659307_96dfbd0b","line":311,"range":{"start_line":311,"start_character":16,"end_line":311,"end_character":70},"updated":"2018-04-03 19:18:27.000000000","message":"Hmm, would we be able to let the user leave this off? If the user provided a service ID, the method, and the path, isn\u0027t that enough to match it up to the template?","commit_id":"a50f799ad06c5cebe9946a5aa5821fa850f69bdc"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"c98764070cdad332aae0c7bc406a72254a5f8497","unresolved":false,"context_lines":[{"line_number":308,"context_line":"                \"path\": \"/v3.0/logs\","},{"line_number":309,"context_line":"                \"substitutions\": {},"},{"line_number":310,"context_line":"                \"type\": \"POST\","},{"line_number":311,"context_line":"                \"url_template\": \"c73beef3-c982-4ed8-86d5-dd362af48614\""},{"line_number":312,"context_line":"              }"},{"line_number":313,"context_line":"            ]"},{"line_number":314,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":22,"id":"bf659307_391c3612","line":311,"range":{"start_line":311,"start_character":16,"end_line":311,"end_character":70},"in_reply_to":"bf659307_96dfbd0b","updated":"2018-04-09 16:26:52.000000000","message":"Unfortunately not. The path may be more restrictive than the URL path template used to validate it. In the case at hand, a URL path template with a path of \u0027**\u0027 would work just as well as one with a path of `/v3.0/logs`, assuming both exist. Which one would we pick in that case?","commit_id":"a50f799ad06c5cebe9946a5aa5821fa850f69bdc"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"1c326cff0018846d7f47793f81d97a291ed711bc","unresolved":false,"context_lines":[{"line_number":157,"context_line":"   being referenced, keystonemiddleware will reject any capabilities"},{"line_number":158,"context_line":"   referencing it since there is no service whose service UUID will match it at"},{"line_number":159,"context_line":"   that point."},{"line_number":160,"context_line":"2) A UUID that serves as a primary key. This is used to reference the path"},{"line_number":161,"context_line":"   template to use for evaluation when creating a capability. This reference is"},{"line_number":162,"context_line":"   only used for validation upon application credential creation and not"},{"line_number":163,"context_line":"   recorded as part of the application credential."}],"source_content_type":"text/x-rst","patch_set":23,"id":"bf659307_6fbae06e","line":160,"range":{"start_line":160,"start_character":26,"end_line":160,"end_character":38},"updated":"2018-04-09 17:32:09.000000000","message":"In a follow up be careful about the word \"primary key\" as that is a SQL-ism. Do NOT use uuids as primary keys in SQL. the PK in SQL should not be exposed via the Rest API - UUID is the correct resource-id.\n\nSuggest changing this phrase to reflect uuid as PK (in SQL) is not used.","commit_id":"85693f9d26c06632f7da82112c21728306104a20"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"4a07f2baf5786b58344cca62598271e262d5ad12","unresolved":false,"context_lines":[{"line_number":157,"context_line":"   being referenced, keystonemiddleware will reject any capabilities"},{"line_number":158,"context_line":"   referencing it since there is no service whose service UUID will match it at"},{"line_number":159,"context_line":"   that point."},{"line_number":160,"context_line":"2) A UUID that serves as a primary key. This is used to reference the path"},{"line_number":161,"context_line":"   template to use for evaluation when creating a capability. This reference is"},{"line_number":162,"context_line":"   only used for validation upon application credential creation and not"},{"line_number":163,"context_line":"   recorded as part of the application credential."}],"source_content_type":"text/x-rst","patch_set":23,"id":"bf659307_d1cb78a2","line":160,"range":{"start_line":160,"start_character":26,"end_line":160,"end_character":38},"in_reply_to":"bf659307_6fbae06e","updated":"2018-04-10 12:29:27.000000000","message":"Ok, done.","commit_id":"85693f9d26c06632f7da82112c21728306104a20"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6647e1b3ee41a5717da60f8735907d162dfc2521","unresolved":false,"context_lines":[{"line_number":246,"context_line":""},{"line_number":247,"context_line":"Users can list the operator maintained URL path templates through the Keystone"},{"line_number":248,"context_line":"API. This allows them to discover the URL path templates they can use for"},{"line_number":249,"context_line":"creating capability enabled application credentials."},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"URL Templates and Roles"},{"line_number":252,"context_line":"-----------------------"}],"source_content_type":"text/x-rst","patch_set":23,"id":"bf659307_68489686","line":249,"updated":"2018-04-09 19:35:46.000000000","message":"Is this going to be an open API (e.g. GET /v3) or are we going to require at least a valid X-Auth-Token header?","commit_id":"85693f9d26c06632f7da82112c21728306104a20"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"4a07f2baf5786b58344cca62598271e262d5ad12","unresolved":false,"context_lines":[{"line_number":246,"context_line":""},{"line_number":247,"context_line":"Users can list the operator maintained URL path templates through the Keystone"},{"line_number":248,"context_line":"API. This allows them to discover the URL path templates they can use for"},{"line_number":249,"context_line":"creating capability enabled application credentials."},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"URL Templates and Roles"},{"line_number":252,"context_line":"-----------------------"}],"source_content_type":"text/x-rst","patch_set":23,"id":"bf659307_b16e0494","line":249,"in_reply_to":"bf659307_68489686","updated":"2018-04-10 12:29:27.000000000","message":"Good point. I changed that to say \"any user with a valid auth token\" now. It wouldn\u0027t be security critical to make that an open API, but the information wouldn\u0027t be very useful to someone without a valid auth token either.","commit_id":"85693f9d26c06632f7da82112c21728306104a20"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"28fd0751c02ba5891c15d00da195dd939fdd7245","unresolved":false,"context_lines":[{"line_number":246,"context_line":""},{"line_number":247,"context_line":"Users can list the operator maintained URL path templates through the Keystone"},{"line_number":248,"context_line":"API. This allows them to discover the URL path templates they can use for"},{"line_number":249,"context_line":"creating capability enabled application credentials."},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"URL Templates and Roles"},{"line_number":252,"context_line":"-----------------------"}],"source_content_type":"text/x-rst","patch_set":23,"id":"bf659307_b78354a9","line":249,"in_reply_to":"bf659307_b16e0494","updated":"2018-04-10 14:06:46.000000000","message":"++  thanks for updating!","commit_id":"85693f9d26c06632f7da82112c21728306104a20"}],"specs/keystone/rocky/finegrained-restrictions-app-creds.rst":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"963ac700eceeae51ee8b3dd66b41d68e985c0eda","unresolved":false,"context_lines":[{"line_number":95,"context_line":"         creation to fail."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"     (c) A request type (e.g. `GET`)"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"   This list is a white list, e.g. access to an unspecified URL is denied by"},{"line_number":100,"context_line":"   default. Keystone itself does not validate the content of white list entries"},{"line_number":101,"context_line":"   because that would require domain knowledge of each service on Keystone\u0027s"}],"source_content_type":"text/x-rst","patch_set":20,"id":"df7087c5_8fe04e28","line":98,"updated":"2018-03-23 09:24:07.000000000","message":"An example POST request body would be good here (expanding on the API definitions we gave in the original application credential spec). I\u0027m now wondering what the property name should be if it\u0027s not \"whitelist\", maybe \"permissions\" or \"api_permissions\"?","commit_id":"5cc3a243d2ca92d2748e31daa28c5315896160ee"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"999b238a488d391e1dfc12aa53b7a8382ae7074d","unresolved":false,"context_lines":[{"line_number":95,"context_line":"         creation to fail."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"     (c) A request type (e.g. `GET`)"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"   This list is a white list, e.g. access to an unspecified URL is denied by"},{"line_number":100,"context_line":"   default. Keystone itself does not validate the content of white list entries"},{"line_number":101,"context_line":"   because that would require domain knowledge of each service on Keystone\u0027s"}],"source_content_type":"text/x-rst","patch_set":20,"id":"bf659307_c9cf48ae","line":98,"in_reply_to":"df7087c5_8fe04e28","updated":"2018-03-28 16:39:07.000000000","message":"Oh...I should have thought of that :-)\n\nI added one for creation application credential creation for now. I\u0027ll add one for URL template creation tomorrow.","commit_id":"5cc3a243d2ca92d2748e31daa28c5315896160ee"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"963ac700eceeae51ee8b3dd66b41d68e985c0eda","unresolved":false,"context_lines":[{"line_number":159,"context_line":"   template to use for evaluation when creating a white list entry. This"},{"line_number":160,"context_line":"   reference is only used for validation upon application credential creation"},{"line_number":161,"context_line":"   and not recorded as part of the application credential."},{"line_number":162,"context_line":"3) A URL template string, such as `/compute/v2.1/servers/{server_id}`. This"},{"line_number":163,"context_line":"   string must be unique. It is anchored at the beginning of a path, i.e. white"},{"line_number":164,"context_line":"   list entries must fully match this pattern and may not be preceded or"},{"line_number":165,"context_line":"   followed by extra characters. The template string may contain the following"}],"source_content_type":"text/x-rst","patch_set":20,"id":"df7087c5_2fbd82d7","line":162,"range":{"start_line":162,"start_character":35,"end_line":162,"end_character":43},"updated":"2018-03-23 09:24:07.000000000","message":"/compute isn\u0027t part of the compute API path","commit_id":"5cc3a243d2ca92d2748e31daa28c5315896160ee"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"999b238a488d391e1dfc12aa53b7a8382ae7074d","unresolved":false,"context_lines":[{"line_number":159,"context_line":"   template to use for evaluation when creating a white list entry. This"},{"line_number":160,"context_line":"   reference is only used for validation upon application credential creation"},{"line_number":161,"context_line":"   and not recorded as part of the application credential."},{"line_number":162,"context_line":"3) A URL template string, such as `/compute/v2.1/servers/{server_id}`. This"},{"line_number":163,"context_line":"   string must be unique. It is anchored at the beginning of a path, i.e. white"},{"line_number":164,"context_line":"   list entries must fully match this pattern and may not be preceded or"},{"line_number":165,"context_line":"   followed by extra characters. The template string may contain the following"}],"source_content_type":"text/x-rst","patch_set":20,"id":"bf659307_f52b01e8","line":162,"range":{"start_line":162,"start_character":35,"end_line":162,"end_character":43},"in_reply_to":"df7087c5_2fbd82d7","updated":"2018-03-28 16:39:07.000000000","message":"Sorry, I overlooked that when removing the \"compute\" bit in the other path. Fixed now.","commit_id":"5cc3a243d2ca92d2748e31daa28c5315896160ee"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"963ac700eceeae51ee8b3dd66b41d68e985c0eda","unresolved":false,"context_lines":[{"line_number":159,"context_line":"   template to use for evaluation when creating a white list entry. This"},{"line_number":160,"context_line":"   reference is only used for validation upon application credential creation"},{"line_number":161,"context_line":"   and not recorded as part of the application credential."},{"line_number":162,"context_line":"3) A URL template string, such as `/compute/v2.1/servers/{server_id}`. This"},{"line_number":163,"context_line":"   string must be unique. It is anchored at the beginning of a path, i.e. white"},{"line_number":164,"context_line":"   list entries must fully match this pattern and may not be preceded or"},{"line_number":165,"context_line":"   followed by extra characters. The template string may contain the following"},{"line_number":166,"context_line":"   special wildcard templates:"}],"source_content_type":"text/x-rst","patch_set":20,"id":"df7087c5_6f9b7a72","line":163,"range":{"start_line":162,"start_character":71,"end_line":163,"end_character":25},"updated":"2018-03-23 09:24:07.000000000","message":"Since /compute isn\u0027t part of the API path it could be possible (though unlikely and bad for many reasons) for two different services to use the same API path. I don\u0027t think the string itself needs to be unique, just the string and service ID in combination should be unique.","commit_id":"5cc3a243d2ca92d2748e31daa28c5315896160ee"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"999b238a488d391e1dfc12aa53b7a8382ae7074d","unresolved":false,"context_lines":[{"line_number":159,"context_line":"   template to use for evaluation when creating a white list entry. This"},{"line_number":160,"context_line":"   reference is only used for validation upon application credential creation"},{"line_number":161,"context_line":"   and not recorded as part of the application credential."},{"line_number":162,"context_line":"3) A URL template string, such as `/compute/v2.1/servers/{server_id}`. This"},{"line_number":163,"context_line":"   string must be unique. It is anchored at the beginning of a path, i.e. white"},{"line_number":164,"context_line":"   list entries must fully match this pattern and may not be preceded or"},{"line_number":165,"context_line":"   followed by extra characters. The template string may contain the following"},{"line_number":166,"context_line":"   special wildcard templates:"}],"source_content_type":"text/x-rst","patch_set":20,"id":"bf659307_55442db7","line":163,"range":{"start_line":162,"start_character":71,"end_line":163,"end_character":25},"in_reply_to":"df7087c5_6f9b7a72","updated":"2018-03-28 16:39:07.000000000","message":"Good point, yes. I think that\u0027s a holdover from an earlier patch set where I used the string as a primary key. Fixed now.","commit_id":"5cc3a243d2ca92d2748e31daa28c5315896160ee"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"963ac700eceeae51ee8b3dd66b41d68e985c0eda","unresolved":false,"context_lines":[{"line_number":173,"context_line":"   A user using a URL template containing wild cards for validating one of"},{"line_number":174,"context_line":"   their white list entries may substitute the wild card by any string"},{"line_number":175,"context_line":"   fulfilling the constraint imposed by the wild card. This allows the operator"},{"line_number":176,"context_line":"   to be permissive in their URL templates (to the point of only having one"},{"line_number":177,"context_line":"   \"{**}\" pattern in the most extreme case) and the user to be more restrictive"},{"line_number":178,"context_line":"   than a wild card template in their white list entries."},{"line_number":179,"context_line":"4) A boolean `allow_chained` attribute (`False` by default). If this is `True`"},{"line_number":180,"context_line":"   for all URL templates referenced when creating an application credential,"}],"source_content_type":"text/x-rst","patch_set":20,"id":"df7087c5_0fb43ed0","line":177,"range":{"start_line":176,"start_character":43,"end_line":177,"end_character":43},"updated":"2018-03-23 09:24:07.000000000","message":"Given the comment above, this would have to be one \"{**}\" per service I think","commit_id":"5cc3a243d2ca92d2748e31daa28c5315896160ee"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"999b238a488d391e1dfc12aa53b7a8382ae7074d","unresolved":false,"context_lines":[{"line_number":173,"context_line":"   A user using a URL template containing wild cards for validating one of"},{"line_number":174,"context_line":"   their white list entries may substitute the wild card by any string"},{"line_number":175,"context_line":"   fulfilling the constraint imposed by the wild card. This allows the operator"},{"line_number":176,"context_line":"   to be permissive in their URL templates (to the point of only having one"},{"line_number":177,"context_line":"   \"{**}\" pattern in the most extreme case) and the user to be more restrictive"},{"line_number":178,"context_line":"   than a wild card template in their white list entries."},{"line_number":179,"context_line":"4) A boolean `allow_chained` attribute (`False` by default). If this is `True`"},{"line_number":180,"context_line":"   for all URL templates referenced when creating an application credential,"}],"source_content_type":"text/x-rst","patch_set":20,"id":"bf659307_9523a505","line":177,"range":{"start_line":176,"start_character":43,"end_line":177,"end_character":43},"in_reply_to":"df7087c5_0fb43ed0","updated":"2018-03-28 16:39:07.000000000","message":"Indeed it would have to be. Added that now.","commit_id":"5cc3a243d2ca92d2748e31daa28c5315896160ee"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"963ac700eceeae51ee8b3dd66b41d68e985c0eda","unresolved":false,"context_lines":[{"line_number":410,"context_line":""},{"line_number":411,"context_line":"This change will introduce the following settings for Keystone:"},{"line_number":412,"context_line":""},{"line_number":413,"context_line":"* `application_credential/soft_restriction list_limit` [Default: `5`]"},{"line_number":414,"context_line":"  This setting determines the number of entries allowed in newly"},{"line_number":415,"context_line":"  created white lists globally. `-1` denotes an unlimited number of"},{"line_number":416,"context_line":"  entries. Any existing application credentials with longer white"}],"source_content_type":"text/x-rst","patch_set":20,"id":"df7087c5_6f737a17","line":413,"range":{"start_line":413,"start_character":26,"end_line":413,"end_character":53},"updated":"2018-03-23 09:24:07.000000000","message":"The space here makes it a little unclear what config option this indicates. In keystone.conf we\u0027d have\n\n [application_credential]\n soft_restriction_list_limit \u003d 5\n\nor something, which could be denoted by [application_credential]/soft_restriction_list_limit or application_credential/soft_restriction_list_limit.\n\nAlso list_limit usually indicates the limit on the number of entries returned when requesting a list of resources via GET, so I might suggest naming it something else since this is a restriction on creation not listing.","commit_id":"5cc3a243d2ca92d2748e31daa28c5315896160ee"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"999b238a488d391e1dfc12aa53b7a8382ae7074d","unresolved":false,"context_lines":[{"line_number":410,"context_line":""},{"line_number":411,"context_line":"This change will introduce the following settings for Keystone:"},{"line_number":412,"context_line":""},{"line_number":413,"context_line":"* `application_credential/soft_restriction list_limit` [Default: `5`]"},{"line_number":414,"context_line":"  This setting determines the number of entries allowed in newly"},{"line_number":415,"context_line":"  created white lists globally. `-1` denotes an unlimited number of"},{"line_number":416,"context_line":"  entries. Any existing application credentials with longer white"}],"source_content_type":"text/x-rst","patch_set":20,"id":"bf659307_958405b3","line":413,"range":{"start_line":413,"start_character":26,"end_line":413,"end_character":53},"in_reply_to":"df7087c5_6f737a17","updated":"2018-03-28 16:39:07.000000000","message":"Ok, I clarified the notation now by adding angle braces.\n\nAlso, I substituted \"limit\" by \"quota\" now since I stole the soft vs. hard bit from the semantics of disk quotas anyway.","commit_id":"5cc3a243d2ca92d2748e31daa28c5315896160ee"}],"specs/keystone/rocky/trust-scope-extensions.rst":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"abcf8645b78c6c0770c7c47667e9f454394d9aa2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"ff6b8bd7_1d35d0da","updated":"2018-03-06 21:12:56.000000000","message":"Rename this to something more specific to Application Credentials:  Suggestion:  fine-grained-access-for_app-creds","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"777395a3f69d215f74ebe8f4e1694722c1c45ea7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"df7087c5_852a05e5","in_reply_to":"ff6b8bd7_1d35d0da","updated":"2018-03-07 09:43:39.000000000","message":"++","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"0d5712479062a5fb3d12d975c01f6aee80fbbe61","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"df7087c5_050d953d","in_reply_to":"ff6b8bd7_1d35d0da","updated":"2018-03-07 10:14:19.000000000","message":"Done (I went with whitelist-extensions-for-app-creds)","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"abcf8645b78c6c0770c7c47667e9f454394d9aa2","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Add Fine Grained Restrictions to Application Credentials"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp \u003chttps://blueprints.launchpad.net/keystone/+spec/trust-scope-extensions\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Currently Keystone application credentials are mostly unrestricted."},{"line_number":14,"context_line":"Restrictions can only be imposed on creation of follow-up application"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff6b8bd7_dd4c3878","line":11,"updated":"2018-03-06 21:12:56.000000000","message":"I know it is a PITA, but please change this too.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"0d5712479062a5fb3d12d975c01f6aee80fbbe61","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Add Fine Grained Restrictions to Application Credentials"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp \u003chttps://blueprints.launchpad.net/keystone/+spec/trust-scope-extensions\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Currently Keystone application credentials are mostly unrestricted."},{"line_number":14,"context_line":"Restrictions can only be imposed on creation of follow-up application"}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_250a1926","line":11,"in_reply_to":"ff6b8bd7_dd4c3878","updated":"2018-03-07 10:14:19.000000000","message":"Done","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"777395a3f69d215f74ebe8f4e1694722c1c45ea7","unresolved":false,"context_lines":[{"line_number":51,"context_line":"metric submission which requires Keystone credentials or an application"},{"line_number":52,"context_line":"credential. This can potentially be abused for out-of-band access to other"},{"line_number":53,"context_line":"OpenStack APIs from inside any VMs running a Monasca agent."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"In summary, there is a real need for fine-grained delegation of access. The"},{"line_number":56,"context_line":"implementation of Keystone application credentials as it exists right now"},{"line_number":57,"context_line":"cannot serve this need, though: an application credential can only be used to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_e58e61cf","line":54,"updated":"2018-03-07 09:43:39.000000000","message":"These examples underemphasize a major use case, which is for end users to restrict access for their external applications. This use case is why I think going down this route, rather than overhauling the existing RBAC system, is appropriate: the end user is a different audience than the operator, who has much more visibility into the role structure and policy rules than an end user does, and so a dumbed-down whitelist approach like this is a sufficient solution for this use case and is not in conflict with fixing the general RBAC problem.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"0d5712479062a5fb3d12d975c01f6aee80fbbe61","unresolved":false,"context_lines":[{"line_number":51,"context_line":"metric submission which requires Keystone credentials or an application"},{"line_number":52,"context_line":"credential. This can potentially be abused for out-of-band access to other"},{"line_number":53,"context_line":"OpenStack APIs from inside any VMs running a Monasca agent."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"In summary, there is a real need for fine-grained delegation of access. The"},{"line_number":56,"context_line":"implementation of Keystone application credentials as it exists right now"},{"line_number":57,"context_line":"cannot serve this need, though: an application credential can only be used to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_982fccf5","line":54,"in_reply_to":"df7087c5_e58e61cf","updated":"2018-03-07 10:14:19.000000000","message":"Yes, end users and also any sort of service that puts agents that authenticate against Keystone inside VMs (e.g. Heat, Magnum or Monasca).","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"abcf8645b78c6c0770c7c47667e9f454394d9aa2","unresolved":false,"context_lines":[{"line_number":81,"context_line":"1) Alongside an application credential, a whitelist with zero or more whitelist"},{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"},{"line_number":85,"context_line":"     (b) A URL path prefix (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/0c363fdc-9399-4946-b602-2043eb9f8af1`)"},{"line_number":87,"context_line":"     (c) A request type (e.g. `GET`)"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff6b8bd7_1d6390de","line":84,"updated":"2018-03-06 21:12:56.000000000","message":"I think we actually need to make this endpoint.  It is far more likely that you get access to a service, but for only a specific endpoint. Access to all of the operations of a service is unlikely to be delegated unless we are just doing full RBAC permissions.  BUt saying \"you can only create a server\"  can be done using the URL prefix below.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"0d5712479062a5fb3d12d975c01f6aee80fbbe61","unresolved":false,"context_lines":[{"line_number":81,"context_line":"1) Alongside an application credential, a whitelist with zero or more whitelist"},{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"},{"line_number":85,"context_line":"     (b) A URL path prefix (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/0c363fdc-9399-4946-b602-2043eb9f8af1`)"},{"line_number":87,"context_line":"     (c) A request type (e.g. `GET`)"}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_98934c50","line":84,"in_reply_to":"ff6b8bd7_1d6390de","updated":"2018-03-07 10:14:19.000000000","message":"I for one am not terribly attached to this bit so I\u0027d be ok with tossing it out (fewer moving parts that way). Would anybody object to that?","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"abcf8645b78c6c0770c7c47667e9f454394d9aa2","unresolved":false,"context_lines":[{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"},{"line_number":85,"context_line":"     (b) A URL path prefix (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/0c363fdc-9399-4946-b602-2043eb9f8af1`)"},{"line_number":87,"context_line":"     (c) A request type (e.g. `GET`)"},{"line_number":88,"context_line":"     (d) A boolean `allow_append` flag that controls whether the user is allowed"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff6b8bd7_5daee8e7","line":85,"updated":"2018-03-06 21:12:56.000000000","message":"This is going to have to be a templatized URL, for things like creating and then listing, as the app won\u0027t know the full URL afterwards.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"0d5712479062a5fb3d12d975c01f6aee80fbbe61","unresolved":false,"context_lines":[{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"},{"line_number":85,"context_line":"     (b) A URL path prefix (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/0c363fdc-9399-4946-b602-2043eb9f8af1`)"},{"line_number":87,"context_line":"     (c) A request type (e.g. `GET`)"},{"line_number":88,"context_line":"     (d) A boolean `allow_append` flag that controls whether the user is allowed"}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_d850e4d7","line":85,"in_reply_to":"ff6b8bd7_5daee8e7","updated":"2018-03-07 10:14:19.000000000","message":"There\u0027d be two rules if one wanted to allow both creating and listing. Generally I\u0027d like to avoid templating entirely in the first iteration and see how far static URLs plus allow_append gets us (having a user supplied string in there that is being templated is always a risk for format string attacks). If that turns out not to be enough because some URLs have variation in the middle and similar stuff we can always introduce templating as a second step.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"abcf8645b78c6c0770c7c47667e9f454394d9aa2","unresolved":false,"context_lines":[{"line_number":85,"context_line":"     (b) A URL path prefix (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/0c363fdc-9399-4946-b602-2043eb9f8af1`)"},{"line_number":87,"context_line":"     (c) A request type (e.g. `GET`)"},{"line_number":88,"context_line":"     (d) A boolean `allow_append` flag that controls whether the user is allowed"},{"line_number":89,"context_line":"         to append arbitrary strings (such as a UUID or query strings) to the"},{"line_number":90,"context_line":"         URL path from the white list."},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff6b8bd7_3db53432","line":88,"updated":"2018-03-06 21:12:56.000000000","message":"I think that we want to split this into the template stuff abovce for the UUID case, and the query string whitelist.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"0d5712479062a5fb3d12d975c01f6aee80fbbe61","unresolved":false,"context_lines":[{"line_number":85,"context_line":"     (b) A URL path prefix (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/0c363fdc-9399-4946-b602-2043eb9f8af1`)"},{"line_number":87,"context_line":"     (c) A request type (e.g. `GET`)"},{"line_number":88,"context_line":"     (d) A boolean `allow_append` flag that controls whether the user is allowed"},{"line_number":89,"context_line":"         to append arbitrary strings (such as a UUID or query strings) to the"},{"line_number":90,"context_line":"         URL path from the white list."},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_58aff493","line":88,"in_reply_to":"ff6b8bd7_3db53432","updated":"2018-03-07 10:14:19.000000000","message":"Hmm. Before I do that I\u0027d like to take another close look at the use cases I\u0027ve got so far (Heat, Magnum, Monasca). Maybe we can get away without that much flexibility (I\u0027d rather keep the first iteration as simple as possible and add templating/extra fields if they turn out to be necessary in the future).","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"abcf8645b78c6c0770c7c47667e9f454394d9aa2","unresolved":false,"context_lines":[{"line_number":141,"context_line":"   role check in `keystonemiddleware`. There are several key differences,"},{"line_number":142,"context_line":"   though:"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"     (a) The whitelist based approach does not require a Cambrian explosion of"},{"line_number":145,"context_line":"         fine-grained roles (one for every API operation of every OpenStack"},{"line_number":146,"context_line":"         service) that must be managed by an administrator."},{"line_number":147,"context_line":"     (b) The whitelist based approach does not require any changes to existing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff6b8bd7_a07d976f","line":144,"updated":"2018-03-06 21:12:56.000000000","message":"Yes it does.  You will have the equivalent list in the whitelist, and it will be larger, and more fragile.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"0d5712479062a5fb3d12d975c01f6aee80fbbe61","unresolved":false,"context_lines":[{"line_number":141,"context_line":"   role check in `keystonemiddleware`. There are several key differences,"},{"line_number":142,"context_line":"   though:"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"     (a) The whitelist based approach does not require a Cambrian explosion of"},{"line_number":145,"context_line":"         fine-grained roles (one for every API operation of every OpenStack"},{"line_number":146,"context_line":"         service) that must be managed by an administrator."},{"line_number":147,"context_line":"     (b) The whitelist based approach does not require any changes to existing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_d84464ba","line":144,"in_reply_to":"df7087c5_255c594a","updated":"2018-03-07 10:14:19.000000000","message":"Exactly. The use case and target audience is different from keystonemiddleware RBAC.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"777395a3f69d215f74ebe8f4e1694722c1c45ea7","unresolved":false,"context_lines":[{"line_number":141,"context_line":"   role check in `keystonemiddleware`. There are several key differences,"},{"line_number":142,"context_line":"   though:"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"     (a) The whitelist based approach does not require a Cambrian explosion of"},{"line_number":145,"context_line":"         fine-grained roles (one for every API operation of every OpenStack"},{"line_number":146,"context_line":"         service) that must be managed by an administrator."},{"line_number":147,"context_line":"     (b) The whitelist based approach does not require any changes to existing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_255c594a","line":144,"in_reply_to":"ff6b8bd7_a07d976f","updated":"2018-03-07 09:43:39.000000000","message":"The whitelist doesn\u0027t have to be populated ahead of time by an operator, it can be created ad-hoc by an end user.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"abcf8645b78c6c0770c7c47667e9f454394d9aa2","unresolved":false,"context_lines":[{"line_number":145,"context_line":"         fine-grained roles (one for every API operation of every OpenStack"},{"line_number":146,"context_line":"         service) that must be managed by an administrator."},{"line_number":147,"context_line":"     (b) The whitelist based approach does not require any changes to existing"},{"line_number":148,"context_line":"         policy enforcement. Instead, it is an additional check that takes"},{"line_number":149,"context_line":"         place before policy enforcement even comes into play and rejects"},{"line_number":150,"context_line":"         requests early. Not being entangled with policy enforcement gives us"},{"line_number":151,"context_line":"         the freedom to start out with a very basic implementation and add"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff6b8bd7_00d7a34d","line":148,"updated":"2018-03-06 21:12:56.000000000","message":"It will force the exsiting policy enforcemnet to not change, which is problematic.  Assumptions about roles will be built in to the whitelists etc, and will not be allowed to change for fear of breaking \"app creds with restrictions\"\"","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"777395a3f69d215f74ebe8f4e1694722c1c45ea7","unresolved":false,"context_lines":[{"line_number":145,"context_line":"         fine-grained roles (one for every API operation of every OpenStack"},{"line_number":146,"context_line":"         service) that must be managed by an administrator."},{"line_number":147,"context_line":"     (b) The whitelist based approach does not require any changes to existing"},{"line_number":148,"context_line":"         policy enforcement. Instead, it is an additional check that takes"},{"line_number":149,"context_line":"         place before policy enforcement even comes into play and rejects"},{"line_number":150,"context_line":"         requests early. Not being entangled with policy enforcement gives us"},{"line_number":151,"context_line":"         the freedom to start out with a very basic implementation and add"}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_982cac9a","line":148,"in_reply_to":"ff6b8bd7_00d7a34d","updated":"2018-03-07 09:43:39.000000000","message":"There are already assumptions built into all of OpenStack and beyond about how keystone roles work. Any change we make to them will have to be made very carefully. I do not believe that adding a filter like this is in conflict with making changes to the current RBAC system.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"abcf8645b78c6c0770c7c47667e9f454394d9aa2","unresolved":false,"context_lines":[{"line_number":160,"context_line":"         certificates to the Magnum API for signing\"."},{"line_number":161,"context_line":"     (d) The whitelist approach does not require keystone to be the guardian of"},{"line_number":162,"context_line":"         access control rules, since all the information needed to validate"},{"line_number":163,"context_line":"         access is contained in the token."},{"line_number":164,"context_line":"     (e) Unlike a policy based check, a whitelist based check will also work"},{"line_number":165,"context_line":"         for services that do not use `oslo.policy` such as Swift."},{"line_number":166,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff6b8bd7_c0452b19","line":163,"updated":"2018-03-06 21:12:56.000000000","message":"But you have no way to generate that information.  RBAC is deployed already, and you have no way of knowing what role is required to perform an operation,  You will have essentially built a parallel, competing mechanism.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"0d5712479062a5fb3d12d975c01f6aee80fbbe61","unresolved":false,"context_lines":[{"line_number":160,"context_line":"         certificates to the Magnum API for signing\"."},{"line_number":161,"context_line":"     (d) The whitelist approach does not require keystone to be the guardian of"},{"line_number":162,"context_line":"         access control rules, since all the information needed to validate"},{"line_number":163,"context_line":"         access is contained in the token."},{"line_number":164,"context_line":"     (e) Unlike a policy based check, a whitelist based check will also work"},{"line_number":165,"context_line":"         for services that do not use `oslo.policy` such as Swift."},{"line_number":166,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_98cb4c1d","line":163,"in_reply_to":"df7087c5_b862d0d7","updated":"2018-03-07 10:14:19.000000000","message":"I would not call it parallel - it\u0027s definitely serial. Whatever the current role based access control mechanism looks like, this will only ever be a pre check that happens before RBAC, i.e. RBAC always takes place to its full extent after this pre check.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"777395a3f69d215f74ebe8f4e1694722c1c45ea7","unresolved":false,"context_lines":[{"line_number":160,"context_line":"         certificates to the Magnum API for signing\"."},{"line_number":161,"context_line":"     (d) The whitelist approach does not require keystone to be the guardian of"},{"line_number":162,"context_line":"         access control rules, since all the information needed to validate"},{"line_number":163,"context_line":"         access is contained in the token."},{"line_number":164,"context_line":"     (e) Unlike a policy based check, a whitelist based check will also work"},{"line_number":165,"context_line":"         for services that do not use `oslo.policy` such as Swift."},{"line_number":166,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_b862d0d7","line":163,"in_reply_to":"ff6b8bd7_c0452b19","updated":"2018-03-07 09:43:39.000000000","message":"It is parallel but complementary, not competing. Yes, when creating an application credential you still must assign it a role that you already have on the project.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"abcf8645b78c6c0770c7c47667e9f454394d9aa2","unresolved":false,"context_lines":[{"line_number":162,"context_line":"         access control rules, since all the information needed to validate"},{"line_number":163,"context_line":"         access is contained in the token."},{"line_number":164,"context_line":"     (e) Unlike a policy based check, a whitelist based check will also work"},{"line_number":165,"context_line":"         for services that do not use `oslo.policy` such as Swift."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"3) One implementation detail from the previous section was discussed at length"},{"line_number":168,"context_line":"   at the Rocky PTG: one could have chosen to match for `oslo.policy` targets"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff6b8bd7_40511bd8","line":165,"updated":"2018-03-06 21:12:56.000000000","message":"YOu could build that in to swift withouth touching keystone.  It requires middleware equivlant changes no matter what.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"0d5712479062a5fb3d12d975c01f6aee80fbbe61","unresolved":false,"context_lines":[{"line_number":162,"context_line":"         access control rules, since all the information needed to validate"},{"line_number":163,"context_line":"         access is contained in the token."},{"line_number":164,"context_line":"     (e) Unlike a policy based check, a whitelist based check will also work"},{"line_number":165,"context_line":"         for services that do not use `oslo.policy` such as Swift."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"3) One implementation detail from the previous section was discussed at length"},{"line_number":168,"context_line":"   at the Rocky PTG: one could have chosen to match for `oslo.policy` targets"}],"source_content_type":"text/x-rst","patch_set":7,"id":"df7087c5_58a37450","line":165,"in_reply_to":"ff6b8bd7_40511bd8","updated":"2018-03-07 10:14:19.000000000","message":"What I meant to say with that: \"this will work for all services, including Swift\".","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"abcf8645b78c6c0770c7c47667e9f454394d9aa2","unresolved":false,"context_lines":[{"line_number":176,"context_line":""},{"line_number":177,"context_line":"     (b) URL paths can be rejected in keystonemiddleware, without involving"},{"line_number":178,"context_line":"         `oslo.policy`, leading to a faster failure for unauthorized requests."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"Limitations"},{"line_number":181,"context_line":"-----------"},{"line_number":182,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff6b8bd7_6073ff81","line":179,"updated":"2018-03-06 21:12:56.000000000","message":"This was the same logic I went down for the RBAC fvrom middleware.","commit_id":"8023e5981a1d6455b4a8b4ac53e959032d17dc74"}],"specs/keystone/rocky/whitelist-extension-for-app-creds.rst":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"dc0dfb63f89d7ccd75e1ed908fb7d3a984825d6c","unresolved":false,"context_lines":[{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"},{"line_number":85,"context_line":"     (b) A URL path prefix (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/0c363fdc-9399-4946-b602-2043eb9f8af1`)"},{"line_number":87,"context_line":"     (c) A request type (e.g. `GET`)"},{"line_number":88,"context_line":"     (d) A boolean `allow_append` flag that controls whether the user is"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_2dd0b7f7","line":85,"updated":"2018-03-07 15:18:06.000000000","message":"So this is the part that needs to be reconcilied with RBAC in middleware.  We can\u0027t just let users add their own, handcrafted URLs here, as it is going to be hell to debug, and the number of URLS is going to explode.\n\nWhat we need is A) an inventory of acceptable URLs.  THos can be generated from the various API docs.\n\nRoles point to URLS.  Thus, we will know what role a user needs in order to delegate to a URL.  THis will also provide a way to generate \"what URLs can I delegate\" that this mechanism needs.\n\nFilling in the templates of the URLs should be done by providing a dictionary.  So if you want to delegate to a sepcific server id like 0c363fdc-9399-4946-b602-2043eb9f8af1  you would provide a pointer to the url pattern in the catalog og:\n\n/compute/v2.1/servers/{server_id}\n\nand the dictionary {\u0027server_id\u0027 : \u00270c363fdc-9399-4946-b602-2043eb9f8af1\u0027}\n\nThis allows a user to provide the same mechanism to talk to all servers by not providing a dictionary, an potentially providing a flag that indicates \"all\"","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"62f8791efcaffafe9e26f970d1a81a39765e4d50","unresolved":false,"context_lines":[{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"},{"line_number":85,"context_line":"     (b) A URL path prefix (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/0c363fdc-9399-4946-b602-2043eb9f8af1`)"},{"line_number":87,"context_line":"     (c) A request type (e.g. `GET`)"},{"line_number":88,"context_line":"     (d) A boolean `allow_append` flag that controls whether the user is"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_012b3c94","line":85,"in_reply_to":"df7087c5_2dd0b7f7","updated":"2018-03-07 17:31:58.000000000","message":"Adam,\n\nI am going to respectfully disagree and say that the reason this is not part of the spec (endpoint specific locking) is because it is the wrong direction for this bit of code to start.\n\nThis is because we do not support knowing what the URLs (or even endpoints themselves in middleware) at this point. Making this a requirement for the API is problematic. You missed the PTG where this was discussed in depth and we agreed we *may* add this type of functionality down the road, but it would not land in the initial implementation. \n\nThe addition would be additive and impact the API zero in actual use case.\n\nPlease remove the -2 consideration based upon this specifically. This is an acceptable request to add once we have mirrored our current implementation(s) and my -2 concern is lifted. \n\nThe core for my disagreement with what you propose as a requirement (endpoint specific restriction) is that we\u0027ve pushed back on it for years (and you did too) AND it adds effectively dead API functionality (aka,  we should not communicate this is part of the API until such time as we implement the supporting parts).\n\nI want to see middleware understand the optional \"hey is this my endpoint\" in a sane way before we add this to the public facing API in Keystone Server. We can make the spec that updates middleware and adds this into the same thing (and I wont block it).\n\nTL;DR: This is unreasonable as a blocking requirement as the supporting bits aren\u0027t there and the API shouldn\u0027t have \"maybe this will work in the future\" parts.","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"dc0dfb63f89d7ccd75e1ed908fb7d3a984825d6c","unresolved":false,"context_lines":[{"line_number":120,"context_line":"         to `oslo.policy` right away."},{"line_number":121,"context_line":"     (b) If an empty white list is provided (i.e. `[]`), all requests are"},{"line_number":122,"context_line":"         rejected (even if the request would otherwise pass the test in (c)."},{"line_number":123,"context_line":"     (c) If the application credential\u0027s `allow_recursive` attribute is `True`"},{"line_number":124,"context_line":"         and there is a valid service token in the request,"},{"line_number":125,"context_line":"         `keystonemiddleware` passes the request to `oslo.policy` right away."},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_6d0d4f8f","line":123,"updated":"2018-03-07 15:18:06.000000000","message":"This is dangerous.  We want to make it so that a user can mount/remount only a specific partition. We don\u0027t want them to be able to craft a request that has access to other partitions accidentally....but maybe this is ok as is?","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"2c868cbb92773d2b88ad07df711e504bfccef2b1","unresolved":false,"context_lines":[{"line_number":120,"context_line":"         to `oslo.policy` right away."},{"line_number":121,"context_line":"     (b) If an empty white list is provided (i.e. `[]`), all requests are"},{"line_number":122,"context_line":"         rejected (even if the request would otherwise pass the test in (c)."},{"line_number":123,"context_line":"     (c) If the application credential\u0027s `allow_recursive` attribute is `True`"},{"line_number":124,"context_line":"         and there is a valid service token in the request,"},{"line_number":125,"context_line":"         `keystonemiddleware` passes the request to `oslo.policy` right away."},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_5ef9007e","line":123,"in_reply_to":"df7087c5_53aee9e7","updated":"2018-03-09 14:29:31.000000000","message":"I\u0027m pretty ambiguous about this myself. I\u0027d be very happy to omit this for now and add it in a follow up spec (and if it remains part of this I\u0027m all for submitting it as a patch of its own). We can add this any time we chose at a later stage.","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"62f8791efcaffafe9e26f970d1a81a39765e4d50","unresolved":false,"context_lines":[{"line_number":120,"context_line":"         to `oslo.policy` right away."},{"line_number":121,"context_line":"     (b) If an empty white list is provided (i.e. `[]`), all requests are"},{"line_number":122,"context_line":"         rejected (even if the request would otherwise pass the test in (c)."},{"line_number":123,"context_line":"     (c) If the application credential\u0027s `allow_recursive` attribute is `True`"},{"line_number":124,"context_line":"         and there is a valid service token in the request,"},{"line_number":125,"context_line":"         `keystonemiddleware` passes the request to `oslo.policy` right away."},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_9c4c9377","line":123,"in_reply_to":"df7087c5_6d0d4f8f","updated":"2018-03-07 17:31:58.000000000","message":"I think this is ok as is; but it is a valid concern. If someone is granted service token permissions or has a service account creds, they have a lot of extra power already. We should clarify this is a security gap and have extra eyes on it - we could write the recursive bit as a followup (implementation) patch to ensure we examine the security parts independent of the rest of the spec.\n\nI am happy as long as we cover the bases on what a service token means in this context and how it is important that the service accounts are secure when leaning on it. \n\nMy opinion, make it a followup patch when implementing so we can have eyes on it.","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"bf3f475a7aea438a609dbcea7cde36603f4c3075","unresolved":false,"context_lines":[{"line_number":120,"context_line":"         to `oslo.policy` right away."},{"line_number":121,"context_line":"     (b) If an empty white list is provided (i.e. `[]`), all requests are"},{"line_number":122,"context_line":"         rejected (even if the request would otherwise pass the test in (c)."},{"line_number":123,"context_line":"     (c) If the application credential\u0027s `allow_recursive` attribute is `True`"},{"line_number":124,"context_line":"         and there is a valid service token in the request,"},{"line_number":125,"context_line":"         `keystonemiddleware` passes the request to `oslo.policy` right away."},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_53aee9e7","line":123,"in_reply_to":"df7087c5_9c4c9377","updated":"2018-03-07 19:03:18.000000000","message":"So, this is not my reason for the -2, just something I would like to see addressed in the spec.  It can be future work.","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"dc0dfb63f89d7ccd75e1ed908fb7d3a984825d6c","unresolved":false,"context_lines":[{"line_number":124,"context_line":"         and there is a valid service token in the request,"},{"line_number":125,"context_line":"         `keystonemiddleware` passes the request to `oslo.policy` right away."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Recursive API Calls"},{"line_number":128,"context_line":"-------------------"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"One thing the white list makes rather tough is recursive API calls: if an API"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_2d943744","line":127,"updated":"2018-03-07 15:18:06.000000000","message":"I like this, but the term is not \"recursive.\" That means a  function calling itself.\n\nWhat you are looking for is a term that means \"redelegated\"  where user calls server A, service A calls service B.  I tjhink something like \"enable_additional_services\"  would be clearer.","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"62f8791efcaffafe9e26f970d1a81a39765e4d50","unresolved":false,"context_lines":[{"line_number":124,"context_line":"         and there is a valid service token in the request,"},{"line_number":125,"context_line":"         `keystonemiddleware` passes the request to `oslo.policy` right away."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Recursive API Calls"},{"line_number":128,"context_line":"-------------------"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"One thing the white list makes rather tough is recursive API calls: if an API"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_dc49ab60","line":127,"in_reply_to":"df7087c5_2d943744","updated":"2018-03-07 17:31:58.000000000","message":"++ This is the wrong term. The APIS are not \"recursive\" or even \"Re-entrant\". Lets use a better name that is more accurate.","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"2c868cbb92773d2b88ad07df711e504bfccef2b1","unresolved":false,"context_lines":[{"line_number":124,"context_line":"         and there is a valid service token in the request,"},{"line_number":125,"context_line":"         `keystonemiddleware` passes the request to `oslo.policy` right away."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Recursive API Calls"},{"line_number":128,"context_line":"-------------------"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"One thing the white list makes rather tough is recursive API calls: if an API"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_5e3ee029","line":127,"in_reply_to":"df7087c5_dc49ab60","updated":"2018-03-09 14:29:31.000000000","message":"I was thinking of \"recursive DNS lookups\" when picking the term, which arguably is the same kind of incorrect. Changed it to \"chained\" now :-)","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"dc0dfb63f89d7ccd75e1ed908fb7d3a984825d6c","unresolved":false,"context_lines":[{"line_number":127,"context_line":"Recursive API Calls"},{"line_number":128,"context_line":"-------------------"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"One thing the white list makes rather tough is recursive API calls: if an API"},{"line_number":131,"context_line":"call is whitelisted, but the service uses the same whitelist restricted token"},{"line_number":132,"context_line":"to call other services\u0027 APIs, these will fail. While it would be possible to"},{"line_number":133,"context_line":"circumvent this problem with additional whitelist entries to cover the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_0d1e13ba","line":130,"updated":"2018-03-07 15:18:06.000000000","message":"I think the term \"chained\" is clearer than recursive.","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"62f8791efcaffafe9e26f970d1a81a39765e4d50","unresolved":false,"context_lines":[{"line_number":127,"context_line":"Recursive API Calls"},{"line_number":128,"context_line":"-------------------"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"One thing the white list makes rather tough is recursive API calls: if an API"},{"line_number":131,"context_line":"call is whitelisted, but the service uses the same whitelist restricted token"},{"line_number":132,"context_line":"to call other services\u0027 APIs, these will fail. While it would be possible to"},{"line_number":133,"context_line":"circumvent this problem with additional whitelist entries to cover the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_7c741f9a","line":130,"in_reply_to":"df7087c5_0d1e13ba","updated":"2018-03-07 17:31:58.000000000","message":"Chained is acceptable and a good choice, I would be open to that unless someone has a better idea.","commit_id":"aeda567eddbf00403e5fb9cd05a3f0e4ed45b36c"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"1c0c1f666e8687fc769515ad0babf95168b1f2fb","unresolved":false,"context_lines":[{"line_number":78,"context_line":"credentials is two-pronged. Permission data is stored in Keystone and enforced"},{"line_number":79,"context_line":"by keystonemiddleware as follows:"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"1) Alongside an application credential, a whitelist with zero or more whitelist"},{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df7087c5_72289085","line":81,"updated":"2018-03-10 04:16:01.000000000","message":"So, the first half of this entity should be managed by an operator, the second half by an end user.  Thus, the white list is really the end users dictionary, and a pointer to an url pattern + Verb.","commit_id":"2cb6b0b00812288443b92dc7b11de26cae4248fe"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"9cae04f67ee177ba79c8448e452cfb4384eab44a","unresolved":false,"context_lines":[{"line_number":78,"context_line":"credentials is two-pronged. Permission data is stored in Keystone and enforced"},{"line_number":79,"context_line":"by keystonemiddleware as follows:"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"1) Alongside an application credential, a whitelist with zero or more whitelist"},{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df7087c5_96306fea","line":81,"in_reply_to":"df7087c5_72289085","updated":"2018-03-13 16:53:04.000000000","message":"Clarified that one now.","commit_id":"2cb6b0b00812288443b92dc7b11de26cae4248fe"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"1c0c1f666e8687fc769515ad0babf95168b1f2fb","unresolved":false,"context_lines":[{"line_number":81,"context_line":"1) Alongside an application credential, a whitelist with zero or more whitelist"},{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"},{"line_number":85,"context_line":"     (b) A URL path template (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/{server_id}`)"},{"line_number":87,"context_line":"     (c) A dictionary whose keys need to exactly match the placeholders in the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df7087c5_f2126058","line":84,"updated":"2018-03-10 04:16:01.000000000","message":"...that matches one of the service types in the service catalog.","commit_id":"2cb6b0b00812288443b92dc7b11de26cae4248fe"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"9cae04f67ee177ba79c8448e452cfb4384eab44a","unresolved":false,"context_lines":[{"line_number":81,"context_line":"1) Alongside an application credential, a whitelist with zero or more whitelist"},{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"},{"line_number":85,"context_line":"     (b) A URL path template (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/{server_id}`)"},{"line_number":87,"context_line":"     (c) A dictionary whose keys need to exactly match the placeholders in the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df7087c5_16445f1a","line":84,"in_reply_to":"df7087c5_f2126058","updated":"2018-03-13 16:53:04.000000000","message":"Fixed. I also moved it to the \"Permissible Path Templates\" section (it doesn\u0027t really make sense to have this user defined when the URL path is operator controlled anyway).","commit_id":"2cb6b0b00812288443b92dc7b11de26cae4248fe"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"1c0c1f666e8687fc769515ad0babf95168b1f2fb","unresolved":false,"context_lines":[{"line_number":81,"context_line":"1) Alongside an application credential, a whitelist with zero or more whitelist"},{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (a) A service type (e.g. `compute`)"},{"line_number":85,"context_line":"     (b) A URL path template (e.g.  `/compute/v2.1/servers` or"},{"line_number":86,"context_line":"         `/compute/v2.1/servers/{server_id}`)"},{"line_number":87,"context_line":"     (c) A dictionary whose keys need to exactly match the placeholders in the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_a3c5783e","line":84,"updated":"2018-03-10 04:16:01.000000000","message":"Split this into two parts.\n\nA white list should point to the URL pattern, but they should be managed separately.  URL Pattern/Verb should be separate from the whitelist.  Whitelist is part of the app cred, pattern/verb is managed by operator.","commit_id":"5fbe098f5a6a0c52e78253d751f054dfb08daf8c"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"1c0c1f666e8687fc769515ad0babf95168b1f2fb","unresolved":false,"context_lines":[{"line_number":167,"context_line":"   list."},{"line_number":168,"context_line":"2) All placeholders from the context template keys list are replaced by the"},{"line_number":169,"context_line":"   corresponding values from token context."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Preventing Regressions"},{"line_number":172,"context_line":"----------------------"},{"line_number":173,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_c3c0ac2d","line":170,"updated":"2018-03-10 04:16:01.000000000","message":"Any non templated values will be considered wild cards and will be accepted if the rest of the url pattern matches.","commit_id":"5fbe098f5a6a0c52e78253d751f054dfb08daf8c"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"9cae04f67ee177ba79c8448e452cfb4384eab44a","unresolved":false,"context_lines":[{"line_number":167,"context_line":"   list."},{"line_number":168,"context_line":"2) All placeholders from the context template keys list are replaced by the"},{"line_number":169,"context_line":"   corresponding values from token context."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Preventing Regressions"},{"line_number":172,"context_line":"----------------------"},{"line_number":173,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_798fcc74","line":170,"in_reply_to":"df7087c5_c3c0ac2d","updated":"2018-03-13 16:53:04.000000000","message":"Done. I introduced a special wild card placeholder for this. That way auditing for wild cards is easier than with the \"any non templated placeholder is a wild card\" approach.","commit_id":"5fbe098f5a6a0c52e78253d751f054dfb08daf8c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c9bf823f64ef013f4120a1205b472cf8e0324e4e","unresolved":false,"context_lines":[{"line_number":190,"context_line":""},{"line_number":191,"context_line":"1) When requesting token validation, `keystonemiddleware` (or any 3rd party"},{"line_number":192,"context_line":"   application that supports white list enforcement) sets an"},{"line_number":193,"context_line":"   `X-Keystone-Whitelist-Supported` header. Token validation for a an"},{"line_number":194,"context_line":"   application credential with a white list will only succeed if this header is"},{"line_number":195,"context_line":"   present."},{"line_number":196,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_851a6ec9","line":193,"range":{"start_line":193,"start_character":65,"end_line":193,"end_character":66},"updated":"2018-03-13 20:37:08.000000000","message":"s/a//","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c9bf823f64ef013f4120a1205b472cf8e0324e4e","unresolved":false,"context_lines":[{"line_number":195,"context_line":"   present."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"2) If there is no `X-Keystone-Whitelist-Supported` header in the token"},{"line_number":198,"context_line":"   validation request, token validation fails."},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"This way we ensure that nobody erroneously assumes white lists are being"},{"line_number":201,"context_line":"enforced in environments where outdated `keystonemiddleware` (or its"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_85cd8e32","line":198,"updated":"2018-03-13 20:37:08.000000000","message":"Just to make sure I\u0027m understanding this properly. This would result in a 401 if the version of keystonemiddleware predates the implementation of white-lists. Does this mean the token validation API needs to expect a new header when validating application credential tokens?","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"93365406ca3a7491b0cef3142dcf847f07e406da","unresolved":false,"context_lines":[{"line_number":195,"context_line":"   present."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"2) If there is no `X-Keystone-Whitelist-Supported` header in the token"},{"line_number":198,"context_line":"   validation request, token validation fails."},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"This way we ensure that nobody erroneously assumes white lists are being"},{"line_number":201,"context_line":"enforced in environments where outdated `keystonemiddleware` (or its"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_73da764b","line":198,"in_reply_to":"df7087c5_85cd8e32","updated":"2018-03-14 10:39:53.000000000","message":"Yes, to both. There\u0027s a 401 if `keystonemiddleware` does not signal whitelist capability and the signalization mechanism for that is the presence (or absence, which leads to a 401) of a \"X-Keystone-Whitelist-Supported\"  header.","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c9bf823f64ef013f4120a1205b472cf8e0324e4e","unresolved":false,"context_lines":[{"line_number":226,"context_line":""},{"line_number":227,"context_line":"To make it easier on users and services, the `allow_chained` attribute gives"},{"line_number":228,"context_line":"services blanket permission to perform chained API calls with the token"},{"line_number":229,"context_line":"resulting from the API credential. This is implemented as follows:"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"1) If `keystonemiddleware` receives a whitelisted request with a token that has"},{"line_number":232,"context_line":"   the `allow_chained` attribute set, it requests a service token and adds it"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_e5db2aea","line":229,"range":{"start_line":229,"start_character":19,"end_line":229,"end_character":22},"updated":"2018-03-13 20:37:08.000000000","message":"application*?","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"93365406ca3a7491b0cef3142dcf847f07e406da","unresolved":false,"context_lines":[{"line_number":226,"context_line":""},{"line_number":227,"context_line":"To make it easier on users and services, the `allow_chained` attribute gives"},{"line_number":228,"context_line":"services blanket permission to perform chained API calls with the token"},{"line_number":229,"context_line":"resulting from the API credential. This is implemented as follows:"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"1) If `keystonemiddleware` receives a whitelisted request with a token that has"},{"line_number":232,"context_line":"   the `allow_chained` attribute set, it requests a service token and adds it"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_33e87ee0","line":229,"range":{"start_line":229,"start_character":19,"end_line":229,"end_character":22},"in_reply_to":"df7087c5_e5db2aea","updated":"2018-03-14 10:39:53.000000000","message":"Sorry, asleep at the wheel there...fixed.","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c9bf823f64ef013f4120a1205b472cf8e0324e4e","unresolved":false,"context_lines":[{"line_number":241,"context_line":""},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"Discoverability"},{"line_number":244,"context_line":"---------------"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"Alternatives"},{"line_number":247,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_e5048a4c","line":244,"updated":"2018-03-13 20:37:08.000000000","message":"Is there supposed to be something in this section? Or is it supposed to be a parent section to Alternatives?","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"93365406ca3a7491b0cef3142dcf847f07e406da","unresolved":false,"context_lines":[{"line_number":241,"context_line":""},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"Discoverability"},{"line_number":244,"context_line":"---------------"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"Alternatives"},{"line_number":247,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_73a8368b","line":244,"in_reply_to":"df7087c5_e5048a4c","updated":"2018-03-14 10:39:53.000000000","message":"There is. I wonder why it didn\u0027t show up in patch set 11 actually (I\u0027ve got comitted content in there locally). I also fleshed that out a bit more in the current patch set. Let\u0027s hope it actually shows up now...","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c9bf823f64ef013f4120a1205b472cf8e0324e4e","unresolved":false,"context_lines":[{"line_number":264,"context_line":"                      ACLs may well end up overriding a cloud-wide policy"},{"line_number":265,"context_line":"                      permitting or denying an operation."},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"2) https://review.openstack.org/#/c/391624/ proposes a superficially similar"},{"line_number":268,"context_line":"   role check in `keystonemiddleware`. There are several key differences,"},{"line_number":269,"context_line":"   though:"},{"line_number":270,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_45169657","line":267,"range":{"start_line":267,"start_character":3,"end_line":267,"end_character":43},"updated":"2018-03-13 20:37:08.000000000","message":"nit: we could format this as a link in RST for better rendering.","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"93365406ca3a7491b0cef3142dcf847f07e406da","unresolved":false,"context_lines":[{"line_number":264,"context_line":"                      ACLs may well end up overriding a cloud-wide policy"},{"line_number":265,"context_line":"                      permitting or denying an operation."},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"2) https://review.openstack.org/#/c/391624/ proposes a superficially similar"},{"line_number":268,"context_line":"   role check in `keystonemiddleware`. There are several key differences,"},{"line_number":269,"context_line":"   though:"},{"line_number":270,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_b3b9eecc","line":267,"range":{"start_line":267,"start_character":3,"end_line":267,"end_character":43},"in_reply_to":"df7087c5_45169657","updated":"2018-03-14 10:39:53.000000000","message":"Done","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c9bf823f64ef013f4120a1205b472cf8e0324e4e","unresolved":false,"context_lines":[{"line_number":384,"context_line":"    (1) The white list in the data base remains unchanged."},{"line_number":385,"context_line":"    (2) The white list sent to `keystonemiddleware` upon token validation is"},{"line_number":386,"context_line":"        truncated to the configured length (i.e. only the first"},{"line_number":387,"context_line":"        `max_whitelist_entries` entries are sent)."},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"Developer Impact"},{"line_number":390,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_c5286698","line":387,"updated":"2018-03-13 20:37:08.000000000","message":"We\u0027re going to have to provide some decent logging around this for operators so that they can remedy the issue. Otherwise truncated whitelists are going to be problematic to use.\n\nThis is an implementation detail though, just wanted to mention it so that I don\u0027t forget.","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"93365406ca3a7491b0cef3142dcf847f07e406da","unresolved":false,"context_lines":[{"line_number":384,"context_line":"    (1) The white list in the data base remains unchanged."},{"line_number":385,"context_line":"    (2) The white list sent to `keystonemiddleware` upon token validation is"},{"line_number":386,"context_line":"        truncated to the configured length (i.e. only the first"},{"line_number":387,"context_line":"        `max_whitelist_entries` entries are sent)."},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"Developer Impact"},{"line_number":390,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_9385cad1","line":387,"in_reply_to":"df7087c5_c5286698","updated":"2018-03-14 10:39:53.000000000","message":"I added it to the spec just to be sure (easier to spot there than in the lengthy comment thread on this review :-)).","commit_id":"7a1708c8123c6ffdbfe7fa8c1516a5621584e674"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f185bcc4cd160e6cb724b4b331680567e997d9b4","unresolved":false,"context_lines":[{"line_number":81,"context_line":"1) Alongside an application credential, a whitelist with zero or more whitelist"},{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (b) A URL path template (e.g.  `/compute/v2.1/servers` or"},{"line_number":85,"context_line":"         `/compute/v2.1/servers/{server_id}`). This template is a reference to"},{"line_number":86,"context_line":"         a URL path template which must exist in the operator managed table of"},{"line_number":87,"context_line":"         URL path templates (see `Permissible Path Templates`_ below)."}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_476b8df0","line":84,"range":{"start_line":84,"start_character":37,"end_line":84,"end_character":45},"updated":"2018-03-18 15:45:48.000000000","message":"Technically this is not part of the compute API. A path alias like this is an implementation detail of the HTTPD or proxy configuration the operator has chosen, and nova\u0027s API starts with /v2.1. This part of the path would be processed and removed before reaching the middleware, so the path provided by the user and operator should start with /v2.1 for nova.","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"5c00042629f0b3a091163691913c65b2e09c1b17","unresolved":false,"context_lines":[{"line_number":81,"context_line":"1) Alongside an application credential, a whitelist with zero or more whitelist"},{"line_number":82,"context_line":"   entries can be stored. A whitelist entry consists of"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"     (b) A URL path template (e.g.  `/compute/v2.1/servers` or"},{"line_number":85,"context_line":"         `/compute/v2.1/servers/{server_id}`). This template is a reference to"},{"line_number":86,"context_line":"         a URL path template which must exist in the operator managed table of"},{"line_number":87,"context_line":"         URL path templates (see `Permissible Path Templates`_ below)."}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_86e8bd7c","line":84,"range":{"start_line":84,"start_character":37,"end_line":84,"end_character":45},"in_reply_to":"df7087c5_476b8df0","updated":"2018-03-19 11:19:46.000000000","message":"Oh, I missed that, thanks! Fixed now.","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f185bcc4cd160e6cb724b4b331680567e997d9b4","unresolved":false,"context_lines":[{"line_number":100,"context_line":"2) A boolean `allow_chained` attribute of the application credential controls"},{"line_number":101,"context_line":"   whether chained API calls, i.e. calls issued by a service as a result of a"},{"line_number":102,"context_line":"   whitelisted operation, are permitted. See the `Chained API Calls`_ section"},{"line_number":103,"context_line":"   below for details."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"3) `keystonemiddleware` on the service\u0027s side receives the white list during"},{"line_number":106,"context_line":"   token validation. It then performs templating on all entries and checks"}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_677011de","line":103,"updated":"2018-03-18 15:45:48.000000000","message":"What is the default?","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"5c00042629f0b3a091163691913c65b2e09c1b17","unresolved":false,"context_lines":[{"line_number":100,"context_line":"2) A boolean `allow_chained` attribute of the application credential controls"},{"line_number":101,"context_line":"   whether chained API calls, i.e. calls issued by a service as a result of a"},{"line_number":102,"context_line":"   whitelisted operation, are permitted. See the `Chained API Calls`_ section"},{"line_number":103,"context_line":"   below for details."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"3) `keystonemiddleware` on the service\u0027s side receives the white list during"},{"line_number":106,"context_line":"   token validation. It then performs templating on all entries and checks"}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_26a77152","line":103,"in_reply_to":"df7087c5_677011de","updated":"2018-03-19 11:19:46.000000000","message":"The default is `False`. I added that now.\n\nAlso, I refined the `allow_chained` thing a bit: I added a companion `allow_chained` flag for the URL templates since the the person who defines the URL template (whether that\u0027s a user or operator) should have the final say over where chaining is permissible","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f185bcc4cd160e6cb724b4b331680567e997d9b4","unresolved":false,"context_lines":[{"line_number":133,"context_line":"URL paths may contain template placeholders to be filled in either from a"},{"line_number":134,"context_line":"dictionary provided by the user or token context. Only template paths"},{"line_number":135,"context_line":"explicitly approved by the operator may be used. This section describes how"},{"line_number":136,"context_line":"an operator defines such URL path templates and how they are used by Keystone."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"The permissible URL templates are operator configured through the Keystone API"},{"line_number":139,"context_line":"and stored in a dedicated table in the Keystone database. Keystone will"}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_c77ebdae","line":136,"updated":"2018-03-18 15:45:48.000000000","message":"I would like this to be opt-in, and for it to be clear that there is an all-permissive setting so that an operator can allow the user free-form access to any API.","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"5c00042629f0b3a091163691913c65b2e09c1b17","unresolved":false,"context_lines":[{"line_number":133,"context_line":"URL paths may contain template placeholders to be filled in either from a"},{"line_number":134,"context_line":"dictionary provided by the user or token context. Only template paths"},{"line_number":135,"context_line":"explicitly approved by the operator may be used. This section describes how"},{"line_number":136,"context_line":"an operator defines such URL path templates and how they are used by Keystone."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"The permissible URL templates are operator configured through the Keystone API"},{"line_number":139,"context_line":"and stored in a dedicated table in the Keystone database. Keystone will"}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_44ca9d4f","line":136,"in_reply_to":"df7087c5_c77ebdae","updated":"2018-03-19 11:19:46.000000000","message":"I turned this into a configuration setting (`user_whitelist_templates`) now. I hope that\u0027s ok. It\u0027s a bit coarse but the other alternative I considered is less than attractive: I gave some thought to implementing this through a special, operator defined, allow-everything URL template and that would get pretty messy (complex implementation, and causes either referential integrity issues upon deletion or prevents deletion of such a special URL template).","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f185bcc4cd160e6cb724b4b331680567e997d9b4","unresolved":false,"context_lines":[{"line_number":376,"context_line":"  white lists for application credentials globally. If it is changed to"},{"line_number":377,"context_line":"  `False`, Keystone will not allow new application credentials with white lists"},{"line_number":378,"context_line":"  to be created and it will send a white list of `None` in response to every"},{"line_number":379,"context_line":"  token validation request. For existing application credentials with white"},{"line_number":380,"context_line":"  lists, white list information is still visible when requesting the"},{"line_number":381,"context_line":"  application credential\u0027s metadata from the Keystone API. This setting gives"},{"line_number":382,"context_line":"  operators the ability to disable white lists in cases where they cause"},{"line_number":383,"context_line":"  performance problems or are unwanted for other reasons."},{"line_number":384,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_872f65a6","line":381,"range":{"start_line":379,"start_character":28,"end_line":381,"end_character":57},"updated":"2018-03-18 15:45:48.000000000","message":"What about enforced?","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"479f81582ba05b83117a9d5549f7ad6725493f5c","unresolved":false,"context_lines":[{"line_number":376,"context_line":"  white lists for application credentials globally. If it is changed to"},{"line_number":377,"context_line":"  `False`, Keystone will not allow new application credentials with white lists"},{"line_number":378,"context_line":"  to be created and it will send a white list of `None` in response to every"},{"line_number":379,"context_line":"  token validation request. For existing application credentials with white"},{"line_number":380,"context_line":"  lists, white list information is still visible when requesting the"},{"line_number":381,"context_line":"  application credential\u0027s metadata from the Keystone API. This setting gives"},{"line_number":382,"context_line":"  operators the ability to disable white lists in cases where they cause"},{"line_number":383,"context_line":"  performance problems or are unwanted for other reasons."},{"line_number":384,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_952541ae","line":381,"range":{"start_line":379,"start_character":28,"end_line":381,"end_character":57},"in_reply_to":"df7087c5_3fad34ea","updated":"2018-03-19 13:01:57.000000000","message":"Oh. That\u0027s a huge gap indeed, I should have seen that...\nAnd changing this behaviour to returning an empty white list or invalidating the token entirely is not really better either...","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"52873723ef8d37d4d9f0c03e1e63cad890491293","unresolved":false,"context_lines":[{"line_number":376,"context_line":"  white lists for application credentials globally. If it is changed to"},{"line_number":377,"context_line":"  `False`, Keystone will not allow new application credentials with white lists"},{"line_number":378,"context_line":"  to be created and it will send a white list of `None` in response to every"},{"line_number":379,"context_line":"  token validation request. For existing application credentials with white"},{"line_number":380,"context_line":"  lists, white list information is still visible when requesting the"},{"line_number":381,"context_line":"  application credential\u0027s metadata from the Keystone API. This setting gives"},{"line_number":382,"context_line":"  operators the ability to disable white lists in cases where they cause"},{"line_number":383,"context_line":"  performance problems or are unwanted for other reasons."},{"line_number":384,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_3fad34ea","line":381,"range":{"start_line":379,"start_character":28,"end_line":381,"end_character":57},"in_reply_to":"df7087c5_443dbd2a","updated":"2018-03-19 11:30:33.000000000","message":"That seems like a huge gap. If I\u0027ve created an application credential with a whitelist and the operator turns it off behind my back, then it suddenly has free reign and I have no say in that. I don\u0027t even have a way to know that has happened.","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"5c00042629f0b3a091163691913c65b2e09c1b17","unresolved":false,"context_lines":[{"line_number":376,"context_line":"  white lists for application credentials globally. If it is changed to"},{"line_number":377,"context_line":"  `False`, Keystone will not allow new application credentials with white lists"},{"line_number":378,"context_line":"  to be created and it will send a white list of `None` in response to every"},{"line_number":379,"context_line":"  token validation request. For existing application credentials with white"},{"line_number":380,"context_line":"  lists, white list information is still visible when requesting the"},{"line_number":381,"context_line":"  application credential\u0027s metadata from the Keystone API. This setting gives"},{"line_number":382,"context_line":"  operators the ability to disable white lists in cases where they cause"},{"line_number":383,"context_line":"  performance problems or are unwanted for other reasons."},{"line_number":384,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_443dbd2a","line":381,"range":{"start_line":379,"start_character":28,"end_line":381,"end_character":57},"in_reply_to":"df7087c5_872f65a6","updated":"2018-03-19 11:19:46.000000000","message":"See previous sentence, a white list of `None` causes no white list enforcement to take place (I mentioned this explicitly now).","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f185bcc4cd160e6cb724b4b331680567e997d9b4","unresolved":false,"context_lines":[{"line_number":380,"context_line":"  lists, white list information is still visible when requesting the"},{"line_number":381,"context_line":"  application credential\u0027s metadata from the Keystone API. This setting gives"},{"line_number":382,"context_line":"  operators the ability to disable white lists in cases where they cause"},{"line_number":383,"context_line":"  performance problems or are unwanted for other reasons."},{"line_number":384,"context_line":""},{"line_number":385,"context_line":"* `application_credential/max_whitelist_entries` [Default: `-1`] This setting"},{"line_number":386,"context_line":"  determines the number of entries allowed in newly created white lists"}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_47394df0","line":383,"updated":"2018-03-18 15:45:48.000000000","message":"Soft -1 on making this configurable, it causes interop problems.","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"479f81582ba05b83117a9d5549f7ad6725493f5c","unresolved":false,"context_lines":[{"line_number":380,"context_line":"  lists, white list information is still visible when requesting the"},{"line_number":381,"context_line":"  application credential\u0027s metadata from the Keystone API. This setting gives"},{"line_number":382,"context_line":"  operators the ability to disable white lists in cases where they cause"},{"line_number":383,"context_line":"  performance problems or are unwanted for other reasons."},{"line_number":384,"context_line":""},{"line_number":385,"context_line":"* `application_credential/max_whitelist_entries` [Default: `-1`] This setting"},{"line_number":386,"context_line":"  determines the number of entries allowed in newly created white lists"}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_d52bb97f","line":383,"in_reply_to":"df7087c5_3f20d449","updated":"2018-03-19 13:01:57.000000000","message":"...because we\u0027ll break expectations as you outlined here.","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"5c00042629f0b3a091163691913c65b2e09c1b17","unresolved":false,"context_lines":[{"line_number":380,"context_line":"  lists, white list information is still visible when requesting the"},{"line_number":381,"context_line":"  application credential\u0027s metadata from the Keystone API. This setting gives"},{"line_number":382,"context_line":"  operators the ability to disable white lists in cases where they cause"},{"line_number":383,"context_line":"  performance problems or are unwanted for other reasons."},{"line_number":384,"context_line":""},{"line_number":385,"context_line":"* `application_credential/max_whitelist_entries` [Default: `-1`] This setting"},{"line_number":386,"context_line":"  determines the number of entries allowed in newly created white lists"}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_e465f146","line":383,"in_reply_to":"df7087c5_47394df0","updated":"2018-03-19 11:19:46.000000000","message":"Interop problems with services that rely on this feature you mean?\n\nFrankly I\u0027d be happier if it was always on myself, but not everyone may agree so I made it configurable (it being a new feature not everyone may want and all that...).","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"52873723ef8d37d4d9f0c03e1e63cad890491293","unresolved":false,"context_lines":[{"line_number":380,"context_line":"  lists, white list information is still visible when requesting the"},{"line_number":381,"context_line":"  application credential\u0027s metadata from the Keystone API. This setting gives"},{"line_number":382,"context_line":"  operators the ability to disable white lists in cases where they cause"},{"line_number":383,"context_line":"  performance problems or are unwanted for other reasons."},{"line_number":384,"context_line":""},{"line_number":385,"context_line":"* `application_credential/max_whitelist_entries` [Default: `-1`] This setting"},{"line_number":386,"context_line":"  determines the number of entries allowed in newly created white lists"}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_3f20d449","line":383,"in_reply_to":"df7087c5_e465f146","updated":"2018-03-19 11:30:33.000000000","message":"Interop problems in the sense that I should be able to expect the same features in every cloud I interact with or at least be able to discover the differences. If I try to call POST /v3/users/{}/application_credential with a whitelist on two clouds and one gives me a 201 and the other gives me a 404 that\u0027s a bad user experience. If that\u0027s because the clouds are two different versions that I can discover via GET /v3 that\u0027s one thing, but if it\u0027s just because the operator turned it off then it\u0027s basically an API break. Also see above about what happens if the operator turns it off after a user has already created one.","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f185bcc4cd160e6cb724b4b331680567e997d9b4","unresolved":false,"context_lines":[{"line_number":438,"context_line":""},{"line_number":439,"context_line":"4. Implement the endpoint list check in keystonemiddleware."},{"line_number":440,"context_line":""},{"line_number":441,"context_line":"5. Implement the capability check in oslo.policy."},{"line_number":442,"context_line":""},{"line_number":443,"context_line":"Dependencies"},{"line_number":444,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_8718c584","line":441,"range":{"start_line":441,"start_character":0,"end_line":441,"end_character":49},"updated":"2018-03-18 15:45:48.000000000","message":"This isn\u0027t needed anymore right?","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"5c00042629f0b3a091163691913c65b2e09c1b17","unresolved":false,"context_lines":[{"line_number":438,"context_line":""},{"line_number":439,"context_line":"4. Implement the endpoint list check in keystonemiddleware."},{"line_number":440,"context_line":""},{"line_number":441,"context_line":"5. Implement the capability check in oslo.policy."},{"line_number":442,"context_line":""},{"line_number":443,"context_line":"Dependencies"},{"line_number":444,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":13,"id":"df7087c5_c4c54d0c","line":441,"range":{"start_line":441,"start_character":0,"end_line":441,"end_character":49},"in_reply_to":"df7087c5_8718c584","updated":"2018-03-19 11:19:46.000000000","message":"Yes, this is a holdover from the previous iteration. Thanks for spotting! Removed now.","commit_id":"0ef304098e8b2b1c859d866f299eee0221247f41"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"fa885178ddd88a94ef63b6ccfdde103e9ad33ddf","unresolved":false,"context_lines":[{"line_number":141,"context_line":""},{"line_number":142,"context_line":"The permissible URL templates are operator configured through the Keystone API"},{"line_number":143,"context_line":"and stored in a dedicated table in the Keystone database. Keystone will"},{"line_number":144,"context_line":"document a curated list of URL templates for core services\u0027 APIs that the"},{"line_number":145,"context_line":"operator can then use as-is in the simplest case, or modify for their local"},{"line_number":146,"context_line":"setup as they chose. For every URL template the following information is"},{"line_number":147,"context_line":"stored:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"df7087c5_02455917","line":144,"range":{"start_line":144,"start_character":45,"end_line":144,"end_character":58},"updated":"2018-03-20 09:26:45.000000000","message":"This is politically nebulous. OpenStack does not have \"core services\" by any official definition and I do not like the idea of the keystone team blessing any particular projects (ask the QA team how well that\u0027s working out for them). I\u0027d be happier if we could either leave out having to curate any kind of list, or phrase it in a way that shows this is just a starting point and that either more projects will be added later or we\u0027ll find a way to distribute this maintenance across projects.","commit_id":"76d032c9054bb24e7f2e30278e6494933718b2cb"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f3f3791ef500912854ce65ba040dfbc7797ff4ef","unresolved":false,"context_lines":[{"line_number":141,"context_line":""},{"line_number":142,"context_line":"The permissible URL templates are operator configured through the Keystone API"},{"line_number":143,"context_line":"and stored in a dedicated table in the Keystone database. Keystone will"},{"line_number":144,"context_line":"document a curated list of URL templates for core services\u0027 APIs that the"},{"line_number":145,"context_line":"operator can then use as-is in the simplest case, or modify for their local"},{"line_number":146,"context_line":"setup as they chose. For every URL template the following information is"},{"line_number":147,"context_line":"stored:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"df7087c5_b0bb8ee3","line":144,"range":{"start_line":144,"start_character":45,"end_line":144,"end_character":58},"in_reply_to":"df7087c5_02455917","updated":"2018-03-20 16:01:33.000000000","message":"Ok, changed to \"services where we can generate this\" now.","commit_id":"76d032c9054bb24e7f2e30278e6494933718b2cb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"577aaa62c91045be2368b73f315738f9f246595c","unresolved":false,"context_lines":[{"line_number":394,"context_line":""},{"line_number":395,"context_line":"* `application_credential/max_whitelist_entries` [Default: `-1`] This setting"},{"line_number":396,"context_line":"  determines the number of entries allowed in newly created white lists"},{"line_number":397,"context_line":"  globally. `-1` denotes an unlimited number of entries. Existing white lists"},{"line_number":398,"context_line":"  that are longer are treated as follows:"},{"line_number":399,"context_line":""},{"line_number":400,"context_line":"    (1) The white list in the data base remains unchanged."}],"source_content_type":"text/x-rst","patch_set":15,"id":"df7087c5_8f3a05cb","line":397,"range":{"start_line":397,"start_character":12,"end_line":397,"end_character":16},"updated":"2018-03-19 16:45:17.000000000","message":"Soft -1 on this, the limit should be set to something reasonable to start. Do not allow for tokens to explode in size (body), it could cause serious issues.\n\nRecommend starting with 5 or 10. Be restrictive in the max by default, we can increase the default, reducing the default will break future cloud behaviors [in upgrade].\n\nIf an operator wants to be more (or less) restrictive, allow them to be explicitly so.","commit_id":"76d032c9054bb24e7f2e30278e6494933718b2cb"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f3f3791ef500912854ce65ba040dfbc7797ff4ef","unresolved":false,"context_lines":[{"line_number":394,"context_line":""},{"line_number":395,"context_line":"* `application_credential/max_whitelist_entries` [Default: `-1`] This setting"},{"line_number":396,"context_line":"  determines the number of entries allowed in newly created white lists"},{"line_number":397,"context_line":"  globally. `-1` denotes an unlimited number of entries. Existing white lists"},{"line_number":398,"context_line":"  that are longer are treated as follows:"},{"line_number":399,"context_line":""},{"line_number":400,"context_line":"    (1) The white list in the data base remains unchanged."}],"source_content_type":"text/x-rst","patch_set":15,"id":"df7087c5_f06ca69d","line":397,"range":{"start_line":397,"start_character":12,"end_line":397,"end_character":16},"in_reply_to":"df7087c5_8f3a05cb","updated":"2018-03-20 16:01:33.000000000","message":"Ok, I did that now. On a related note...","commit_id":"76d032c9054bb24e7f2e30278e6494933718b2cb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"577aaa62c91045be2368b73f315738f9f246595c","unresolved":false,"context_lines":[{"line_number":398,"context_line":"  that are longer are treated as follows:"},{"line_number":399,"context_line":""},{"line_number":400,"context_line":"    (1) The white list in the data base remains unchanged."},{"line_number":401,"context_line":"    (2) The white list sent to `keystonemiddleware` upon token validation is"},{"line_number":402,"context_line":"        truncated to the configured length (i.e. only the first"},{"line_number":403,"context_line":"        `max_whitelist_entries` entries are sent). This is indicated through"},{"line_number":404,"context_line":"        a boolean `truncated` flag sent along with the whitelist to"},{"line_number":405,"context_line":"        make `keystonemiddleware` aware it is dealing with a truncated white"},{"line_number":406,"context_line":"        list. Both `keystone` and `keystonemiddleware` should log warnings when"},{"line_number":407,"context_line":"        they send or receive truncated whitelists. `keystonemiddleware` should"},{"line_number":408,"context_line":"        log an additional warning when a token with a truncated white list"},{"line_number":409,"context_line":"        results in a request being rejected."},{"line_number":410,"context_line":""},{"line_number":411,"context_line":"Developer Impact"},{"line_number":412,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":15,"id":"df7087c5_6f469152","line":409,"range":{"start_line":401,"start_character":4,"end_line":409,"end_character":44},"updated":"2018-03-19 16:45:17.000000000","message":"Hard -1 on this. If an app cred was created with a whitelist do not ever truncate it. Future whitelists may be more restrictive in length, but do not break how the token is built -- invalidate the app cred if you must, but don\u0027t change behavior based upon the configuration of the operator.","commit_id":"76d032c9054bb24e7f2e30278e6494933718b2cb"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"f3f3791ef500912854ce65ba040dfbc7797ff4ef","unresolved":false,"context_lines":[{"line_number":398,"context_line":"  that are longer are treated as follows:"},{"line_number":399,"context_line":""},{"line_number":400,"context_line":"    (1) The white list in the data base remains unchanged."},{"line_number":401,"context_line":"    (2) The white list sent to `keystonemiddleware` upon token validation is"},{"line_number":402,"context_line":"        truncated to the configured length (i.e. only the first"},{"line_number":403,"context_line":"        `max_whitelist_entries` entries are sent). This is indicated through"},{"line_number":404,"context_line":"        a boolean `truncated` flag sent along with the whitelist to"},{"line_number":405,"context_line":"        make `keystonemiddleware` aware it is dealing with a truncated white"},{"line_number":406,"context_line":"        list. Both `keystone` and `keystonemiddleware` should log warnings when"},{"line_number":407,"context_line":"        they send or receive truncated whitelists. `keystonemiddleware` should"},{"line_number":408,"context_line":"        log an additional warning when a token with a truncated white list"},{"line_number":409,"context_line":"        results in a request being rejected."},{"line_number":410,"context_line":""},{"line_number":411,"context_line":"Developer Impact"},{"line_number":412,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":15,"id":"df7087c5_90df6a39","line":409,"range":{"start_line":401,"start_character":4,"end_line":409,"end_character":44},"in_reply_to":"df7087c5_6f469152","updated":"2018-03-20 16:01:33.000000000","message":"...I split this setting into a soft and a hard limit now. The soft limit allows existing application credentials with longer white lists but prevents new ones from being created. The hard limit invalidates the application credential for these. That way the operators can chose which behaviour they want to have.","commit_id":"76d032c9054bb24e7f2e30278e6494933718b2cb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1485b3a0473087a61b92c6f8b5bcc184f44b19fd","unresolved":false,"context_lines":[{"line_number":146,"context_line":"simplest case, or modify it for their local setup as they chose. For every URL"},{"line_number":147,"context_line":"template the following information is stored:"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"1) A service type (e.g. `compute`) that matches one of the service types"},{"line_number":150,"context_line":"   in the Keystone catalog."},{"line_number":151,"context_line":"2) A UUID that serves as a primary key for referencing from application"},{"line_number":152,"context_line":"   credentials\u0027 white list entries."}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_2638883b","line":149,"updated":"2018-03-21 15:05:39.000000000","message":"I agree type would be better for usability, but it will be too ambiguous since we can create two services with the same name and type :(\n\nhttp://paste.openstack.org/show/707617/\n\nWe might consider using ID here instead.","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"aac1a04c8619f7576760aacdb19f282fbd813c90","unresolved":false,"context_lines":[{"line_number":146,"context_line":"simplest case, or modify it for their local setup as they chose. For every URL"},{"line_number":147,"context_line":"template the following information is stored:"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"1) A service type (e.g. `compute`) that matches one of the service types"},{"line_number":150,"context_line":"   in the Keystone catalog."},{"line_number":151,"context_line":"2) A UUID that serves as a primary key for referencing from application"},{"line_number":152,"context_line":"   credentials\u0027 white list entries."}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_4f7ed119","line":149,"in_reply_to":"df7087c5_09a2304c","updated":"2018-03-23 12:28:57.000000000","message":"Ok, I changed this to using the ID and explicitly mentioned that there shouldn\u0027t be a foreign key constraint.","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0065d1c7867284bdd82d35d2aa6d13576c2d088b","unresolved":false,"context_lines":[{"line_number":146,"context_line":"simplest case, or modify it for their local setup as they chose. For every URL"},{"line_number":147,"context_line":"template the following information is stored:"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"1) A service type (e.g. `compute`) that matches one of the service types"},{"line_number":150,"context_line":"   in the Keystone catalog."},{"line_number":151,"context_line":"2) A UUID that serves as a primary key for referencing from application"},{"line_number":152,"context_line":"   credentials\u0027 white list entries."}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_09a2304c","line":149,"in_reply_to":"df7087c5_2638883b","updated":"2018-03-21 17:54:47.000000000","message":"Agreed. And make sure it is not a FK constraint.  In the future, we can add an Endpoint ID field in the Whitelist, too, to restrict it to a specific instance.","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"7108a9f7563ecd953fda9b5b226eabb1c3c544d3","unresolved":false,"context_lines":[{"line_number":150,"context_line":"   in the Keystone catalog."},{"line_number":151,"context_line":"2) A UUID that serves as a primary key for referencing from application"},{"line_number":152,"context_line":"   credentials\u0027 white list entries."},{"line_number":153,"context_line":"3) A boolean `user_template` flag which is `True` for templates created by"},{"line_number":154,"context_line":"   non-privileged users and `False` for operator created templates. An operator"},{"line_number":155,"context_line":"   may explicitly specify a `user_template` value of `True` if they want to"},{"line_number":156,"context_line":"   create user templates. Non-privileged users can not specify a value for this"},{"line_number":157,"context_line":"   attribute. Non-privileged users may only create templates if the"},{"line_number":158,"context_line":"   `user_whitelist_templates` setting (see `Other Deployer Impact`_)"},{"line_number":159,"context_line":"   configuration setting is `True`."},{"line_number":160,"context_line":"4) A URL template string, such as `/compute/v2.1/servers/{server_id}`. This"},{"line_number":161,"context_line":"   string must be unique. The template string may contain the special wildcard"},{"line_number":162,"context_line":"   template `{*}` which allows arbitrary strings (excluding the `/` character)"}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_e39db9bb","line":159,"range":{"start_line":153,"start_character":3,"end_line":159,"end_character":35},"updated":"2018-03-20 19:30:42.000000000","message":"Users should not be creating their own templates. This is an operator deal. Please remove the user templates (we can consider later for future additions if needed).\n\nThis was discussed in office hours but most importantly, we should not have config flags that change API behaviors.\n\nSecond, the operator is already defining (or not defining) templates, the user templates in that case would have to be simply more restrictive than the operator templates.\n\nFinally, removal of this feature will simplify the base functionality of the app-cred white list. We should be very careful in adding in APIs that are not 100% what we want as we will need to maintain this.\n\nApplication credentials should store the URLs that it is allowed to work against. This may be more restrictive than the operator provided template/patterns. The template/patterns are meant to simply be used to confirm the user-supplied white-list data is valid.\n\nIt is not meant to be exclusively the canonical list of white-listable entities. Please store the user-supplied data in the app-cred, not as relational data.  This will simplify the whole process and make it a \"match\" not maintaining relational data to the operator supplied list.\n\nAs stated in the original discussions, changing the allowed white-lists *may* force a re-evaluation (and invalidation) of app-creds, but is not a requirement (in my view) for the spec.","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0065d1c7867284bdd82d35d2aa6d13576c2d088b","unresolved":false,"context_lines":[{"line_number":150,"context_line":"   in the Keystone catalog."},{"line_number":151,"context_line":"2) A UUID that serves as a primary key for referencing from application"},{"line_number":152,"context_line":"   credentials\u0027 white list entries."},{"line_number":153,"context_line":"3) A boolean `user_template` flag which is `True` for templates created by"},{"line_number":154,"context_line":"   non-privileged users and `False` for operator created templates. An operator"},{"line_number":155,"context_line":"   may explicitly specify a `user_template` value of `True` if they want to"},{"line_number":156,"context_line":"   create user templates. Non-privileged users can not specify a value for this"},{"line_number":157,"context_line":"   attribute. Non-privileged users may only create templates if the"},{"line_number":158,"context_line":"   `user_whitelist_templates` setting (see `Other Deployer Impact`_)"},{"line_number":159,"context_line":"   configuration setting is `True`."},{"line_number":160,"context_line":"4) A URL template string, such as `/compute/v2.1/servers/{server_id}`. This"},{"line_number":161,"context_line":"   string must be unique. The template string may contain the special wildcard"},{"line_number":162,"context_line":"   template `{*}` which allows arbitrary strings (excluding the `/` character)"}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_49c108e4","line":159,"range":{"start_line":153,"start_character":3,"end_line":159,"end_character":35},"in_reply_to":"df7087c5_e39db9bb","updated":"2018-03-21 17:54:47.000000000","message":"Agreed.  This was something I totally waffled on, not trying to lock things down for the end users, in the case where the URL pattern does not already exist in the backend.  But we need to make sure that users can make full use of the wildcards.  I was thinking that a fullw matche d URL for a wildcard value should go inplace of the values dictionary.","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1485b3a0473087a61b92c6f8b5bcc184f44b19fd","unresolved":false,"context_lines":[{"line_number":290,"context_line":"   key differences, though:"},{"line_number":291,"context_line":""},{"line_number":292,"context_line":"     (a) The whitelist based approach does not require a `Cambrian"},{"line_number":293,"context_line":"         explosion \u003chttps://en.wikipedia.org/wiki/Cambrian_explosion/\u003e`_ of"},{"line_number":294,"context_line":"         fine-grained roles (one for every API operation of every OpenStack"},{"line_number":295,"context_line":"         service) that must be managed by an administrator."},{"line_number":296,"context_line":"     (b) The whitelist based approach does not require any changes to existing"}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_f1924c9f","line":293,"range":{"start_line":293,"start_character":68,"end_line":293,"end_character":69},"updated":"2018-03-21 15:05:39.000000000","message":"This forward slash is breaking the link:\n\n  https://en.wikipedia.org/wiki/Cambrian_explosion\n\nShould work.","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1485b3a0473087a61b92c6f8b5bcc184f44b19fd","unresolved":false,"context_lines":[{"line_number":316,"context_line":"3) One implementation detail from the previous section was discussed at length"},{"line_number":317,"context_line":"   at the Rocky PTG: one could have chosen to match for `oslo.policy` targets"},{"line_number":318,"context_line":"   rather than URL paths in the white list, which would have been easier in"},{"line_number":319,"context_line":"   some ways. In the end we opted for url paths for the following reasons:"},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"     (a) This is user facing and unlike API paths, policy targets are not"},{"line_number":322,"context_line":"         easily discoverable by the user since there is no documentation on"}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_d14aa825","line":319,"updated":"2018-03-21 15:05:39.000000000","message":"Nice - thanks for summarizing this.","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1485b3a0473087a61b92c6f8b5bcc184f44b19fd","unresolved":false,"context_lines":[{"line_number":329,"context_line":"Limitations"},{"line_number":330,"context_line":"-----------"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"This proposal does not restrict the body of requests in any sort of way."},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"Security Impact"},{"line_number":335,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_916d109a","line":332,"updated":"2018-03-21 15:05:39.000000000","message":"Meaning this application credential whitelists won\u0027t be usable for things like nova\u0027s actions API.","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"aac1a04c8619f7576760aacdb19f282fbd813c90","unresolved":false,"context_lines":[{"line_number":329,"context_line":"Limitations"},{"line_number":330,"context_line":"-----------"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"This proposal does not restrict the body of requests in any sort of way."},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"Security Impact"},{"line_number":335,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_2fa6fdac","line":332,"in_reply_to":"df7087c5_916d109a","updated":"2018-03-23 12:28:57.000000000","message":"Exactly. We can add this in a follow-up, but I\u0027d rather leave it out in the first iteration since it adds more complexity.","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1485b3a0473087a61b92c6f8b5bcc184f44b19fd","unresolved":false,"context_lines":[{"line_number":428,"context_line":""},{"line_number":429,"context_line":"Other contributors:"},{"line_number":430,"context_line":"  Colleen Murphy \u003ccolleen@gazlene.net\u003e cmurphy"},{"line_number":431,"context_line":"  Adam Young \u003cayoung@redhat.com\u003e ayoung"},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"Work Items"},{"line_number":434,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_6631a0a2","line":431,"updated":"2018-03-21 15:05:39.000000000","message":"nit: these aren\u0027t rendering in a list. Maybe consider:\n\n  Other Contributors:\n  \n  * name\n  * name","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"aac1a04c8619f7576760aacdb19f282fbd813c90","unresolved":false,"context_lines":[{"line_number":428,"context_line":""},{"line_number":429,"context_line":"Other contributors:"},{"line_number":430,"context_line":"  Colleen Murphy \u003ccolleen@gazlene.net\u003e cmurphy"},{"line_number":431,"context_line":"  Adam Young \u003cayoung@redhat.com\u003e ayoung"},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"Work Items"},{"line_number":434,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_2fbfddaa","line":431,"in_reply_to":"df7087c5_6631a0a2","updated":"2018-03-23 12:28:57.000000000","message":"Done","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1485b3a0473087a61b92c6f8b5bcc184f44b19fd","unresolved":false,"context_lines":[{"line_number":452,"context_line":"Documentation Impact"},{"line_number":453,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":454,"context_line":""},{"line_number":455,"context_line":"* The of whitelist related settings for application credentials need to be"},{"line_number":456,"context_line":"  documented in the release notes and the admin guide."},{"line_number":457,"context_line":""},{"line_number":458,"context_line":"* The whitelist \"language\" outlined in the *Proposed Change* section needs"}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_d194e846","line":455,"range":{"start_line":455,"start_character":6,"end_line":455,"end_character":8},"updated":"2018-03-21 15:05:39.000000000","message":"?","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"aac1a04c8619f7576760aacdb19f282fbd813c90","unresolved":false,"context_lines":[{"line_number":452,"context_line":"Documentation Impact"},{"line_number":453,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":454,"context_line":""},{"line_number":455,"context_line":"* The of whitelist related settings for application credentials need to be"},{"line_number":456,"context_line":"  documented in the release notes and the admin guide."},{"line_number":457,"context_line":""},{"line_number":458,"context_line":"* The whitelist \"language\" outlined in the *Proposed Change* section needs"}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_6ff7158d","line":455,"range":{"start_line":455,"start_character":6,"end_line":455,"end_character":8},"in_reply_to":"df7087c5_d194e846","updated":"2018-03-23 12:28:57.000000000","message":"Mismatch between mental window focus and actual window focus :-)\n\nFixed.","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1485b3a0473087a61b92c6f8b5bcc184f44b19fd","unresolved":false,"context_lines":[{"line_number":457,"context_line":""},{"line_number":458,"context_line":"* The whitelist \"language\" outlined in the *Proposed Change* section needs"},{"line_number":459,"context_line":"  to be documented in the admin guide."},{"line_number":460,"context_line":""},{"line_number":461,"context_line":"References"},{"line_number":462,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":463,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_718ddc2f","line":460,"updated":"2018-03-21 15:05:39.000000000","message":"Since we expect end users to consume these, we\u0027ll need to add documentation to https://docs.openstack.org/keystone/latest/user/application_credentials.html","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":12542,"name":"Johannes Grassler","email":"jgr-launchpad@btw23.de","username":"jgrassler"},"change_message_id":"aac1a04c8619f7576760aacdb19f282fbd813c90","unresolved":false,"context_lines":[{"line_number":457,"context_line":""},{"line_number":458,"context_line":"* The whitelist \"language\" outlined in the *Proposed Change* section needs"},{"line_number":459,"context_line":"  to be documented in the admin guide."},{"line_number":460,"context_line":""},{"line_number":461,"context_line":"References"},{"line_number":462,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":463,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"df7087c5_2f703d08","line":460,"in_reply_to":"df7087c5_718ddc2f","updated":"2018-03-23 12:28:57.000000000","message":"Done","commit_id":"2971d462ba18837d9627b9ee270c60bb51a7c0ca"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1d9a6fb88ee79f872089e83b9df1d01d167c102","unresolved":false,"context_lines":[{"line_number":159,"context_line":""},{"line_number":160,"context_line":"   * `{*}`: allows arbitrary strings (excluding the `/` character) in whitelist"},{"line_number":161,"context_line":"            enforcement."},{"line_number":162,"context_line":"   * `{**}`: allows arbitrary strings (including the `/` character) in"},{"line_number":163,"context_line":"             whitelist enforcement."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"   A user using a URL template containing wild cards for validating one of"},{"line_number":166,"context_line":"   their white list entries may substitute the wild card by any string"}],"source_content_type":"text/x-rst","patch_set":19,"id":"df7087c5_860e0b39","line":163,"range":{"start_line":162,"start_character":3,"end_line":163,"end_character":35},"updated":"2018-03-22 19:22:19.000000000","message":"I like this!","commit_id":"166bcfc41254fb9c88253a59c1e289237e1b7a8a"}]}