)]}'
{"specs/keystone/pike/role-check-from-middleware.rst":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":20,"context_line":"The goals:"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":" * Allow operator assignment of the roles to operations"},{"line_number":23,"context_line":" * Provide a means to report what role is required for an operation"},{"line_number":24,"context_line":" * Allow users to delegation subsets of their roles, potentially"},{"line_number":25,"context_line":"   allowing them to delegate the ability to perform individual"},{"line_number":26,"context_line":"   operations"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_07c4f68f","line":23,"range":{"start_line":23,"start_character":3,"end_line":23,"end_character":67},"updated":"2017-04-05 10:11:11.000000000","message":"This may be the main cause of our disagreement here.\n\nI don\u0027t believe policy should be end user facing. I see it as a purely operator concern. I think capability should be the end user concept here.\n\nI guess the next line is the bit I also see differently I guess, I see users giving particular uses delegated access to a specific capability, sometimes for a specific object in the system.\n\nClearly other system have other ideas, but I am still not convinced:\nhttps://docs.microsoft.com/en-us/azure/active-directory/role-based-access-control-configure\nhttp://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html\nhttps://cloud.google.com/docs/permissions-overview\n\nBut when you look at them, they have well defined names for actions and sets of actions that you can delegate for a specific resource. That makes sense, but it isn\u0027t the approach we seem to be going for here.\n\nHonestly, I think the first step before lots of this is ensuring instances can get an identity in the system, so there are some obvious \"users\" we can delegate things to. We have service users, but a lot of whats needed there can be done with course roles and small nested projects.\n\nThere seems to be too much going on here at once honestly. I am not seeing how this spec really helps us work towards all these goals.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":20,"context_line":"The goals:"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":" * Allow operator assignment of the roles to operations"},{"line_number":23,"context_line":" * Provide a means to report what role is required for an operation"},{"line_number":24,"context_line":" * Allow users to delegation subsets of their roles, potentially"},{"line_number":25,"context_line":"   allowing them to delegate the ability to perform individual"},{"line_number":26,"context_line":"   operations"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_0e3a4935","line":23,"range":{"start_line":23,"start_character":3,"end_line":23,"end_character":67},"in_reply_to":"dfeb2761_07c4f68f","updated":"2017-04-06 12:51:40.000000000","message":"It has to be end user facing.  To not do so is a security liability.  If the end user does not know the Role required to perform an action, the only way for them to find out is trial and error, and that leads to them over committing;  they have to submit all the roles they have on every token in order to get access to any api.  That is what we have now, and it should never have been put into production.\n\nIdentity for other systems is important, but that can be done today via existing mechanisms.  The two issues are not mutually exclusive, and there is no required ordering between implementing them.\n\nIt is not Keystone\u0027s fault that Nova\u0027s API is not as well structured as some of the others there, but that does not mean that we should not provide proper RBAC support.  While it is harder to support Nova\u0027s approach, it is not impossible ; see the follow on work added to a later version of this document for one proposal how.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"f6123e5f9b47191aff360962c102d0df2b93cb45","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp Role Check from Keystonemiddleware"},{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/role-check-from-middleware\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Role Based Access Control (RBAC) requires administration of both the"},{"line_number":15,"context_line":"roles assigned to users and the rules that determine what role can"},{"line_number":16,"context_line":"perform what action. To date, OpenStack has made role assignment"},{"line_number":17,"context_line":"fairly easy to use, but modification of policy files has been manual,"},{"line_number":18,"context_line":"decentralized, and inconsistent."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"The goals:"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":" * Allow operator assignment of the roles to operations"},{"line_number":23,"context_line":" * Provide a means to report what role is required for an operation"},{"line_number":24,"context_line":" * Allow users to delegation subsets of their roles, potentially"},{"line_number":25,"context_line":"   allowing them to delegate the ability to perform individual"},{"line_number":26,"context_line":"   operations"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_3f083990","line":26,"range":{"start_line":14,"start_character":0,"end_line":26,"end_character":13},"updated":"2017-04-04 19:28:00.000000000","message":"Nice description, I much agree with this direction.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":46,"context_line":"and even discouraged in the official documentation."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"There are numerous challenges to updating the current policy"},{"line_number":49,"context_line":"files. Changing policy now requires redeploying configuration files"},{"line_number":50,"context_line":"for each node in the service. Applying changes to a role requires"},{"line_number":51,"context_line":"coordination between keystone and the service configuration. Certain"},{"line_number":52,"context_line":"operations require other operations in order to be successful, so if"},{"line_number":53,"context_line":"the policy fails on a downstream operation the whole operation"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_bc7a01b7","line":50,"range":{"start_line":49,"start_character":36,"end_line":50,"end_character":28},"updated":"2017-04-05 10:11:11.000000000","message":"You have to do that for configuration anyways, and its a solved problem for most users. My strong belief is that config should be treat in the same way.\n\nMany deployers want to validate a particular package and its configuration, run that though test environments, and then deploy the exact same thing to production, cutting over to the new config on service restart.\n\nI don\u0027t think we ever want to loose this nice controlled deploy mechanism for (security critical) configuration.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":46,"context_line":"and even discouraged in the official documentation."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"There are numerous challenges to updating the current policy"},{"line_number":49,"context_line":"files. Changing policy now requires redeploying configuration files"},{"line_number":50,"context_line":"for each node in the service. Applying changes to a role requires"},{"line_number":51,"context_line":"coordination between keystone and the service configuration. Certain"},{"line_number":52,"context_line":"operations require other operations in order to be successful, so if"},{"line_number":53,"context_line":"the policy fails on a downstream operation the whole operation"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_0e1369b7","line":50,"range":{"start_line":49,"start_character":36,"end_line":50,"end_character":28},"in_reply_to":"dfeb2761_bc7a01b7","updated":"2017-04-06 12:51:40.000000000","message":"Configuration files are not queryable by end users.  That is a deal breaker.  You need a way to communicate to users that they change has been made.  Once you have that, you have an API.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":48,"context_line":"There are numerous challenges to updating the current policy"},{"line_number":49,"context_line":"files. Changing policy now requires redeploying configuration files"},{"line_number":50,"context_line":"for each node in the service. Applying changes to a role requires"},{"line_number":51,"context_line":"coordination between keystone and the service configuration. Certain"},{"line_number":52,"context_line":"operations require other operations in order to be successful, so if"},{"line_number":53,"context_line":"the policy fails on a downstream operation the whole operation"},{"line_number":54,"context_line":"fails. This is too high a risk for most deployment."}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_bc532139","line":51,"updated":"2017-04-05 10:11:11.000000000","message":"You seem to created more tightly coupled co-ordination here. At least its clear today you apply roles in keystone, they are checked by the service.\n\nThis certainly introduces a whole of new problems. Nova ads a new API, it wants all users to get access to that on upgrade. How do we co-ordinate all that keystone? Before we could be upgraded without needing any access to the identity system at the same time as the upgrade.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"8cb5d1d7cd118024964778c02f38bbd511a40a4b","unresolved":false,"context_lines":[{"line_number":48,"context_line":"There are numerous challenges to updating the current policy"},{"line_number":49,"context_line":"files. Changing policy now requires redeploying configuration files"},{"line_number":50,"context_line":"for each node in the service. Applying changes to a role requires"},{"line_number":51,"context_line":"coordination between keystone and the service configuration. Certain"},{"line_number":52,"context_line":"operations require other operations in order to be successful, so if"},{"line_number":53,"context_line":"the policy fails on a downstream operation the whole operation"},{"line_number":54,"context_line":"fails. This is too high a risk for most deployment."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7ffa3b31_d3c2e5e9","line":51,"in_reply_to":"bff0334d_2626decf","updated":"2017-04-14 20:36:13.000000000","message":"I don\u0027t think so.  Member is, essentially, the highest level of \"average user\" roles.  It is the least restrictive.  It Means that new Operations will be usable by the widest set of people, but will still be restricted from users with more specific roles.\n\nI am working on the assumption that admin-only operations will continue to be enforced at the policy level for the time being.  Once this mechanism is in place, we can challenge that assumption.\n\nIf, in the future, the default rule should require \"admin\", everything will continue to work as today, it just means that explicit rules will be required for every existing \"Member\" scoped API function.  Since generating a catalog of functions from the published list is trivial,  as is automating the route generations from that list, we can make a pretty simple default rule template.  Merging in explicit overrides to that is also not hard tooling  to write if we want it.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2e0b9a7d5ff0f7a24f5b36e15336ce198b983ee0","unresolved":false,"context_lines":[{"line_number":48,"context_line":"There are numerous challenges to updating the current policy"},{"line_number":49,"context_line":"files. Changing policy now requires redeploying configuration files"},{"line_number":50,"context_line":"for each node in the service. Applying changes to a role requires"},{"line_number":51,"context_line":"coordination between keystone and the service configuration. Certain"},{"line_number":52,"context_line":"operations require other operations in order to be successful, so if"},{"line_number":53,"context_line":"the policy fails on a downstream operation the whole operation"},{"line_number":54,"context_line":"fails. This is too high a risk for most deployment."}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_2626decf","line":51,"in_reply_to":"bff0334d_2ed18dce","updated":"2017-04-10 19:57:32.000000000","message":"This isn\u0027t entirely true. What if the default role nova picks is something other than Member? This limits flexibility by requiring a default to be something specific in order for the upgrade to work, which seems counterproductive.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":48,"context_line":"There are numerous challenges to updating the current policy"},{"line_number":49,"context_line":"files. Changing policy now requires redeploying configuration files"},{"line_number":50,"context_line":"for each node in the service. Applying changes to a role requires"},{"line_number":51,"context_line":"coordination between keystone and the service configuration. Certain"},{"line_number":52,"context_line":"operations require other operations in order to be successful, so if"},{"line_number":53,"context_line":"the policy fails on a downstream operation the whole operation"},{"line_number":54,"context_line":"fails. This is too high a risk for most deployment."}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_2ed18dce","line":51,"in_reply_to":"dfeb2761_bc532139","updated":"2017-04-06 12:51:40.000000000","message":"The default Role will cover the majority of  operations.  Assuming the default role is Member  like we have today, new APIs will be added in without explicit checks, and will be executable by Member.\n\nAlternatively, if operators want a more strict policy, they can make the catch all rule use a more stringent Role (Admin or Manager) but then explicitly create rules for \"Member\" users to do standard operations.\n\nThis is an issue no matter what the implementation.  The defaults will cover unknown, and the known have to be explicitly enumerated in order to vary from the defaults.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":53,"context_line":"the policy fails on a downstream operation the whole operation"},{"line_number":54,"context_line":"fails. This is too high a risk for most deployment."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Implementing a dynamic RBAC policy mechanism inside OpenStack has to"},{"line_number":57,"context_line":"work within the restrictions of a distributed development model. Any"},{"line_number":58,"context_line":"approach which requires changes to every project has little to no"},{"line_number":59,"context_line":"chance of succeeding. Thus, RBAC enforcement needs to be encapsulated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_7c37d900","line":56,"range":{"start_line":56,"start_character":15,"end_line":56,"end_character":44},"updated":"2017-04-05 10:11:11.000000000","message":"I missed something here. Why is there a need for dynamic policy?","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2e0b9a7d5ff0f7a24f5b36e15336ce198b983ee0","unresolved":false,"context_lines":[{"line_number":53,"context_line":"the policy fails on a downstream operation the whole operation"},{"line_number":54,"context_line":"fails. This is too high a risk for most deployment."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Implementing a dynamic RBAC policy mechanism inside OpenStack has to"},{"line_number":57,"context_line":"work within the restrictions of a distributed development model. Any"},{"line_number":58,"context_line":"approach which requires changes to every project has little to no"},{"line_number":59,"context_line":"chance of succeeding. Thus, RBAC enforcement needs to be encapsulated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_e604761a","line":56,"in_reply_to":"bff0334d_b4072a1d","updated":"2017-04-10 19:57:32.000000000","message":"But this isn\u0027t really dynamic policy at all. If I\u0027m a deployer and I want to change the default I have to:\n\n 1.) make a request to keystone to associate the role to the operation\n 2.) update the service for my policy\n 3.) roll a new policy file out to my service\n\nOtherwise what\u0027s in keystone will be out of sync with what\u0027s at the service. If that is the case, what happens?","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":53,"context_line":"the policy fails on a downstream operation the whole operation"},{"line_number":54,"context_line":"fails. This is too high a risk for most deployment."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Implementing a dynamic RBAC policy mechanism inside OpenStack has to"},{"line_number":57,"context_line":"work within the restrictions of a distributed development model. Any"},{"line_number":58,"context_line":"approach which requires changes to every project has little to no"},{"line_number":59,"context_line":"chance of succeeding. Thus, RBAC enforcement needs to be encapsulated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_b4072a1d","line":56,"range":{"start_line":56,"start_character":15,"end_line":56,"end_character":44},"in_reply_to":"dfeb2761_7c37d900","updated":"2017-04-06 12:51:40.000000000","message":"Because Operators want to be able to modify it.  Configuration files are one way to do dynamic policy. They just are very restrictive.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":54,"context_line":"fails. This is too high a risk for most deployment."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Implementing a dynamic RBAC policy mechanism inside OpenStack has to"},{"line_number":57,"context_line":"work within the restrictions of a distributed development model. Any"},{"line_number":58,"context_line":"approach which requires changes to every project has little to no"},{"line_number":59,"context_line":"chance of succeeding. Thus, RBAC enforcement needs to be encapsulated"},{"line_number":60,"context_line":"with Keystone and Keystonemiddleware. However, the full policy check"},{"line_number":61,"context_line":"as performed by policy.json and oslo-policy is embedded deep within"},{"line_number":62,"context_line":"the code of each project, due primarily to the need to fetch a record"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_dc2b8592","line":59,"range":{"start_line":57,"start_character":65,"end_line":59,"end_character":21},"updated":"2017-04-05 10:11:11.000000000","message":"I don\u0027t agree with that assumption. There are many things we all do in the same way today, rather successfully. But maybe I am an optimist.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":54,"context_line":"fails. This is too high a risk for most deployment."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Implementing a dynamic RBAC policy mechanism inside OpenStack has to"},{"line_number":57,"context_line":"work within the restrictions of a distributed development model. Any"},{"line_number":58,"context_line":"approach which requires changes to every project has little to no"},{"line_number":59,"context_line":"chance of succeeding. Thus, RBAC enforcement needs to be encapsulated"},{"line_number":60,"context_line":"with Keystone and Keystonemiddleware. However, the full policy check"},{"line_number":61,"context_line":"as performed by policy.json and oslo-policy is embedded deep within"},{"line_number":62,"context_line":"the code of each project, due primarily to the need to fetch a record"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_ce00e137","line":59,"range":{"start_line":57,"start_character":65,"end_line":59,"end_character":21},"in_reply_to":"dfeb2761_dc2b8592","updated":"2017-04-06 12:51:40.000000000","message":"That has not been my experience.  Bug 968696 is still open, despite years of effort.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":60,"context_line":"with Keystone and Keystonemiddleware. However, the full policy check"},{"line_number":61,"context_line":"as performed by policy.json and oslo-policy is embedded deep within"},{"line_number":62,"context_line":"the code of each project, due primarily to the need to fetch a record"},{"line_number":63,"context_line":"from a database to check attributes."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"When looking at most of the policy files, they either check that the"},{"line_number":66,"context_line":"user has the admin role, or that the user has any role on the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_67e742ae","line":63,"updated":"2017-04-05 10:11:11.000000000","message":"I guess I see the current approach differently.\n\nI see this as the code that checks permissions for each operation is next to the code that implements the operation. All that is defined by that check is the happing of a known key to an API operation. It is close also to the scope check in the code, ensuring the token is of the correct scope for the requested resource (that one totally needs the DB check).\n\nWith those two things together, the service can make the correct call on how best to allow access, following standard patterns across all the different services.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":60,"context_line":"with Keystone and Keystonemiddleware. However, the full policy check"},{"line_number":61,"context_line":"as performed by policy.json and oslo-policy is embedded deep within"},{"line_number":62,"context_line":"the code of each project, due primarily to the need to fetch a record"},{"line_number":63,"context_line":"from a database to check attributes."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"When looking at most of the policy files, they either check that the"},{"line_number":66,"context_line":"user has the admin role, or that the user has any role on the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_0e4b6984","line":63,"in_reply_to":"dfeb2761_67e742ae","updated":"2017-04-06 12:51:40.000000000","message":"Scope check is a decision for the Service (Nova, Glance) engineers to make.  The role to assign for that check is soemthi8ng the operators need to be able to configure.  The two mechanisms need to be split regardless.\n\nBut until you provide a way to map from the policy check deep in the code to the URL or something else the end user is aware of, you have a security problem.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":66,"context_line":"user has the admin role, or that the user has any role on the"},{"line_number":67,"context_line":"project. The matching logic in the policy.json rules are very specific"},{"line_number":68,"context_line":"to each of the projects. There is little reason to modify this part"},{"line_number":69,"context_line":"of the policy. In fact, doing so might break deployments upon update."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"It would be possible to have an additional call to oslo-policy"},{"line_number":72,"context_line":"from keystonemiddleware to check only the roles. However, that leaves"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_676aa2ed","line":69,"updated":"2017-04-05 10:11:11.000000000","message":"It seems way more confusing to have several layers of policy checks and scope checking. How do we hope to describe how that works to operators?\n\nYou don\u0027t fix the problem that admin role gives people global access in many projects. People want to give out admin per project, and this doesn\u0027t fix that.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":66,"context_line":"user has the admin role, or that the user has any role on the"},{"line_number":67,"context_line":"project. The matching logic in the policy.json rules are very specific"},{"line_number":68,"context_line":"to each of the projects. There is little reason to modify this part"},{"line_number":69,"context_line":"of the policy. In fact, doing so might break deployments upon update."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"It would be possible to have an additional call to oslo-policy"},{"line_number":72,"context_line":"from keystonemiddleware to check only the roles. However, that leaves"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_2e14ed4d","line":69,"in_reply_to":"dfeb2761_676aa2ed","updated":"2017-04-06 12:51:40.000000000","message":"That is because we lump everything into Policy.  Stop using that term, and thing instead of RBAC versus Scope and it becomes clearer.  Role check is in middleware, scope check is in code.  Policy is an already overloaded term.  Just ask the Congress team about that.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  * The requested URL, to include the understanding of which service"},{"line_number":83,"context_line":"    or endpoint the URL implements."},{"line_number":84,"context_line":"  * The Data returned from the Token"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Proposed Change"},{"line_number":87,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_c22f1c86","line":84,"updated":"2017-04-05 10:11:11.000000000","message":"There are many role checks used to filter the properties returned in a particular URL, like including information on the specific host name of the hypervisor a server is running on.\n\nWhat do we do for per microversion specific policy rules? They can change meaning between microversions.\n\nThese would be forced to be done differently to all the other policy checks in the middleware?\n\nI see the middleware as a super useful way to add fine grained policy into projects that have not adopted oslo.policy yet, and have a fairly standard REST API. But if you want to go beyond the basics, it seems like lots of confusion with various layers of different checks. Ideally they would both use the same config model of a policy file, and its a service option on which one to adopt, but the admins get the same experience either way.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"8cb5d1d7cd118024964778c02f38bbd511a40a4b","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  * The requested URL, to include the understanding of which service"},{"line_number":83,"context_line":"    or endpoint the URL implements."},{"line_number":84,"context_line":"  * The Data returned from the Token"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Proposed Change"},{"line_number":87,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7ffa3b31_96ee8b86","line":84,"in_reply_to":"dfeb2761_c22f1c86","updated":"2017-04-14 20:36:13.000000000","message":"If the different micro versions have different URLs, then using a different role for each will be done using the API.  If not, I don\u0027t know how they will be distinguished in code, and need more information before answering.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":82,"context_line":"  * The requested URL, to include the understanding of which service"},{"line_number":83,"context_line":"    or endpoint the URL implements."},{"line_number":84,"context_line":"  * The Data returned from the Token"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Proposed Change"},{"line_number":87,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":88,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_36c96dab","line":85,"updated":"2017-04-05 10:11:11.000000000","message":"Honestly, I am not fully understanding what operator or user problems this is fixing.\n\nI see lots of developer advantages and auditor advantages here, and they are not to be discounted.\n\nIts just I see lots of problems for operators, and things that look like steps backwards from what we have today, and little immediate gain.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":82,"context_line":"  * The requested URL, to include the understanding of which service"},{"line_number":83,"context_line":"    or endpoint the URL implements."},{"line_number":84,"context_line":"  * The Data returned from the Token"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Proposed Change"},{"line_number":87,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":88,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_714d3471","line":85,"in_reply_to":"dfeb2761_36c96dab","updated":"2017-04-06 12:51:40.000000000","message":"As an end user, I want to know what Roles an API requires.\n\nAs an operator, I want to implement a limited-permission role (e.g. Read only) across multiple services.\n\nThis is for the end user and the operator, not the developer.  If there are benefits for the developer, wonderful, but that is not what is driving it.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":98,"context_line":"the service specific code. Leave the current oslo-policy based access"},{"line_number":99,"context_line":"checks in place, using the existing policy.json files. This leads to a"},{"line_number":100,"context_line":"separation of concerns: Middleware enforces the role check, source"},{"line_number":101,"context_line":"code enforces the scope check."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The following changes are required to enable the RBAC check:"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_8231145d","line":101,"updated":"2017-04-05 10:11:11.000000000","message":"Except when it has to filter return parameters, or filter what is allowed based on query string params or payload body.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b67649bfe9d6de6ce32d6f4271eed4e7d5751a00","unresolved":false,"context_lines":[{"line_number":98,"context_line":"the service specific code. Leave the current oslo-policy based access"},{"line_number":99,"context_line":"checks in place, using the existing policy.json files. This leads to a"},{"line_number":100,"context_line":"separation of concerns: Middleware enforces the role check, source"},{"line_number":101,"context_line":"code enforces the scope check."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The following changes are required to enable the RBAC check:"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_e24a6153","line":101,"in_reply_to":"7ffa3b31_36fd773a","updated":"2017-05-31 19:23:40.000000000","message":"I was missing that bit before. For some reason I interpreted a side effect of this spec as leaving the policy.json file in place for some period of time while moving the role to operation mapping into keystone under this new API.\n\nNow I understand how this is suppose to work. There will still need to be a transition period though where the policy.json file and the operation to role mapping keystone exists at the same time.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"8cb5d1d7cd118024964778c02f38bbd511a40a4b","unresolved":false,"context_lines":[{"line_number":98,"context_line":"the service specific code. Leave the current oslo-policy based access"},{"line_number":99,"context_line":"checks in place, using the existing policy.json files. This leads to a"},{"line_number":100,"context_line":"separation of concerns: Middleware enforces the role check, source"},{"line_number":101,"context_line":"code enforces the scope check."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The following changes are required to enable the RBAC check:"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7ffa3b31_36fd773a","line":101,"in_reply_to":"bff0334d_21fa48bc","updated":"2017-04-14 20:36:13.000000000","message":"It keeps them from having to edit policy, but they can affect RBAC using only API changes from here on forward.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2e0b9a7d5ff0f7a24f5b36e15336ce198b983ee0","unresolved":false,"context_lines":[{"line_number":98,"context_line":"the service specific code. Leave the current oslo-policy based access"},{"line_number":99,"context_line":"checks in place, using the existing policy.json files. This leads to a"},{"line_number":100,"context_line":"separation of concerns: Middleware enforces the role check, source"},{"line_number":101,"context_line":"code enforces the scope check."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The following changes are required to enable the RBAC check:"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_21fa48bc","line":101,"in_reply_to":"bff0334d_31a56c05","updated":"2017-04-10 19:57:32.000000000","message":"I would consider the solution proposed here to further prevent operators from not wanting to edit policy. They don\u0027t edit policy because it is hard, so they live with the security issues of it. This proposal makes managing policy even harder by duplicating the effort from configuration to an API.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":98,"context_line":"the service specific code. Leave the current oslo-policy based access"},{"line_number":99,"context_line":"checks in place, using the existing policy.json files. This leads to a"},{"line_number":100,"context_line":"separation of concerns: Middleware enforces the role check, source"},{"line_number":101,"context_line":"code enforces the scope check."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The following changes are required to enable the RBAC check:"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_31a56c05","line":101,"in_reply_to":"dfeb2761_8231145d","updated":"2017-04-06 12:51:40.000000000","message":"We can always add to the mechanism.  What you are suggesting here is not currently done in any policy, even in Nova, at least not by default.  And, when surveyed, the vast majority of operators are not customizing policy at all.  So,  we can handle it in the future, but not in the first round.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"f6123e5f9b47191aff360962c102d0df2b93cb45","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"    - the URL pattern"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"    - a minimum of a single required role"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  * Create an API for upload and modification of these entities, to"},{"line_number":116,"context_line":"    include bulk upload per service."}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_65df50d6","line":113,"updated":"2017-04-04 19:28:00.000000000","message":"As my comment on the original spec, it would be great if the above list contains a request body also.\nBecause Nova has different type of APIs on the same URL, HTTP method like action APIs.\n\nhttps://developer.openstack.org/api-ref/compute/#servers-run-an-action-servers-action\n\nThe above api-ref contains many APIs on the same URL(/servers/{server_id}/action) and method(POST). \n\nIn addition, the following APIs are also the same URL and method for *admin users*.\n\nhttps://developer.openstack.org/api-ref/compute/#servers-run-an-administrative-action-servers-action\n\nI feel the above APIs are mess and it also is enough to cover most cases except these APIs and Nova covers these complex APIs by itself.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"ee559346b6ca578260db1cdc7c23b274403ad7fb","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"    - the URL pattern"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"    - a minimum of a single required role"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  * Create an API for upload and modification of these entities, to"},{"line_number":116,"context_line":"    include bulk upload per service."}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_b4234856","line":113,"in_reply_to":"dfeb2761_391cd176","updated":"2017-04-04 22:13:44.000000000","message":"Yeah, I agree with that thing could be out of scope from Pike.\n\nBasically the root problem is Nova API design itself, I think.\nSo it is not mandatory to cover all thing with this framework part, and it is enough to cover common/standard APIs as the first step.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"1de165f427cecd1863d5196134dfc21d3372fef2","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"    - the URL pattern"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"    - a minimum of a single required role"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  * Create an API for upload and modification of these entities, to"},{"line_number":116,"context_line":"    include bulk upload per service."}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_391cd176","line":113,"in_reply_to":"dfeb2761_65df50d6","updated":"2017-04-04 21:57:17.000000000","message":"I think that will be a follow on patch.  It is a large increase in scope.  I will start writing that up, but I don\u0027t think we can commit to it in Pike.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    - a minimum of a single required role"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  * Create an API for upload and modification of these entities, to"},{"line_number":116,"context_line":"    include bulk upload per service."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  * Deduce the values from the Documented APIs to Create instances via"},{"line_number":119,"context_line":"    the above APIs."}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_2257e85a","line":116,"updated":"2017-04-05 10:11:11.000000000","message":"How does the operator:\n\n* work out what the defaults are and what they have changed\n* on upgrade how does the operator work out what needs to be updated given new rules and APIs the services has, vs previous overrides they have made\n* whats the new process to stage the exact same configuration in both staging and production to test all this\n* on upgrade, can this happen while the old code is still executing, or might that break the existing running code? I presume this is per endpoint (and region, etc), as they may all upgrade at different times. Need to configure keystone middleware with the matching endpoint uuid or similar?\n* some operators have a fully custom policy file already, how do they transition to the new system? do we just leave the old parallel system in place for ever? does that separate our operator community into two?\n* how does the operator get documentation on all the different policy rules, and what they mean? how do we generate that?","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    - a minimum of a single required role"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  * Create an API for upload and modification of these entities, to"},{"line_number":116,"context_line":"    include bulk upload per service."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  * Deduce the values from the Documented APIs to Create instances via"},{"line_number":119,"context_line":"    the above APIs."}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_3141ec0c","line":116,"in_reply_to":"dfeb2761_2257e85a","updated":"2017-04-06 12:51:40.000000000","message":"Default is per service as documented here.  So, for compute:\n\nService:COMPUTE verb:* url:* role:Member would make the default that a user with the Member role can execute all operations.  Note that the current \"Admin\" checks in policy are still in effect, so this does not open up anything, only makes it more restrictive.\n\nOn an Upgrade, the default rule is applied to any non-explicit covered URLs.\n\nIt is not configuration, it is Data, so API calls must be made to any server in order to affect change on the system.  Drop all rules (per service like Compute) and add in the rules you want to the two systems to have them in sync.\n\nRules can be uploaded to a system prior to upgrade.  They will lay dormant until the actual APIs are called upon.\n\nIf operators have custom policy that is at odds with the RBAC in middleware approach, they can chose not to enable it, or only enable it for some systems.  It is explicitly a no-op until enabled.  To transition, they can add rules that mirror there underlying policy and remove the custom policy until they are once again running with the default policy for there services, or a stripped down policy that does not attempt to solve RBAC.  It is the operators choice.\n\nIf two services have two different versions of the API running, the RBAC rules should be based on the later one.  Explicit rules for new APIs can be added without affecting older systems that do not have those APIs.\n\nIf the goal is to role to a more restrictive RBAC over time, the changes should not be made at the same time as an upgrade, but instead should be a deliberate operation.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":116,"context_line":"    include bulk upload per service."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  * Deduce the values from the Documented APIs to Create instances via"},{"line_number":119,"context_line":"    the above APIs."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"  * Perform a Role check in keystonemiddleware after the token validation"},{"line_number":122,"context_line":"    that uses the role to URL Pattern mappings to ensure that the user"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_c2015c08","line":119,"updated":"2017-04-05 10:11:11.000000000","message":"I am not sure what this means. Deduce the roles to set? the permissions to set? What APIs to call?","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2e0b9a7d5ff0f7a24f5b36e15336ce198b983ee0","unresolved":false,"context_lines":[{"line_number":116,"context_line":"    include bulk upload per service."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  * Deduce the values from the Documented APIs to Create instances via"},{"line_number":119,"context_line":"    the above APIs."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"  * Perform a Role check in keystonemiddleware after the token validation"},{"line_number":122,"context_line":"    that uses the role to URL Pattern mappings to ensure that the user"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_a18bf81c","line":119,"in_reply_to":"bff0334d_71e9b418","updated":"2017-04-10 19:57:32.000000000","message":"The nova default rule?","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"8cb5d1d7cd118024964778c02f38bbd511a40a4b","unresolved":false,"context_lines":[{"line_number":116,"context_line":"    include bulk upload per service."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  * Deduce the values from the Documented APIs to Create instances via"},{"line_number":119,"context_line":"    the above APIs."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"  * Perform a Role check in keystonemiddleware after the token validation"},{"line_number":122,"context_line":"    that uses the role to URL Pattern mappings to ensure that the user"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7ffa3b31_d699b31f","line":119,"in_reply_to":"bff0334d_a18bf81c","updated":"2017-04-14 20:36:13.000000000","message":"Yes, there will be one default rule per service.  It will be Compute, not Nova, but yes.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":116,"context_line":"    include bulk upload per service."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  * Deduce the values from the Documented APIs to Create instances via"},{"line_number":119,"context_line":"    the above APIs."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"  * Perform a Role check in keystonemiddleware after the token validation"},{"line_number":122,"context_line":"    that uses the role to URL Pattern mappings to ensure that the user"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_71e9b418","line":119,"in_reply_to":"dfeb2761_c2015c08","updated":"2017-04-06 12:51:40.000000000","message":"Deduce the values for the VERBs, URLs, and Roles for the APIs.  They are documented E.g. here: https://developer.openstack.org/api-ref/compute/  \n\nThese are only required for APIs that will vary from the default rule.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"While some policy files currently make checks for specific roles,"},{"line_number":127,"context_line":"most notably the \u0027admin\u0027 role, these apis are specifically"},{"line_number":128,"context_line":"identitfied as requiring that role. Those checks will remain in place."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"RBAC Check Flow"},{"line_number":131,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_9616f948","line":128,"updated":"2017-04-05 10:11:11.000000000","message":"How does the admin give access to people who don\u0027t have the admin role to those APIs? Like giving operators access to live-migration. Seems they end up having to modify two sets of policy.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"While some policy files currently make checks for specific roles,"},{"line_number":127,"context_line":"most notably the \u0027admin\u0027 role, these apis are specifically"},{"line_number":128,"context_line":"identitfied as requiring that role. Those checks will remain in place."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"RBAC Check Flow"},{"line_number":131,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_d13be035","line":128,"in_reply_to":"dfeb2761_9616f948","updated":"2017-04-06 12:51:40.000000000","message":"They can\u0027t without changing policy.  That is the same restriction as exists today. \n\nKeystone does not, and will not, directly affect what is in the other services policy files.  It may, over time, help guide them to have a more global view of the proper defaults.\n\nAdmin only policy should, over time, be reduced to those APIs that should not be scoped to a project.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":137,"context_line":""},{"line_number":138,"context_line":"   curl -H \"X-Auth-Token: adb5c708a55f\" \\"},{"line_number":139,"context_line":"     -H \"Content-type: application/json\" \\"},{"line_number":140,"context_line":"     PUT https://nova1:8774/v2.1/2497f6/servers/83cbdc \\"},{"line_number":141,"context_line":"     -d @new_values.json"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"With the body of the request inside the @new_values.json file."}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_5653d117","line":140,"range":{"start_line":140,"start_character":33,"end_line":140,"end_character":39},"updated":"2017-04-05 10:11:11.000000000","message":"This shouldn\u0027t be here any more really.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":137,"context_line":""},{"line_number":138,"context_line":"   curl -H \"X-Auth-Token: adb5c708a55f\" \\"},{"line_number":139,"context_line":"     -H \"Content-type: application/json\" \\"},{"line_number":140,"context_line":"     PUT https://nova1:8774/v2.1/2497f6/servers/83cbdc \\"},{"line_number":141,"context_line":"     -d @new_values.json"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"With the body of the request inside the @new_values.json file."}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_f16ca437","line":140,"range":{"start_line":140,"start_character":33,"end_line":140,"end_character":39},"in_reply_to":"dfeb2761_5653d117","updated":"2017-04-06 12:51:40.000000000","message":"There seems to be enough confusion as to how this is executed that I want to use as complex an example as possible.  Since it is possible that people are even now using these old APIs, I want to show it is possible to cover them. Nova may not be doing this, but there is no guarantee that other services, including non-openstack services, are doing this.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":162,"context_line":"   auth_type\u003dpassword"},{"line_number":163,"context_line":"   auth_url\u003dhttp://192.0.2.3:35357"},{"line_number":164,"context_line":"   password\u003d7c48bc8f2668001d81582506f7c83d242f62502e"},{"line_number":165,"context_line":"   service\u003dcompute"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"Fetch RBAC Data"},{"line_number":168,"context_line":"~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_768b751e","line":165,"updated":"2017-04-05 10:11:11.000000000","message":"Ah, so its global across all regions and endpoints. Really not sure how upgrade or A/B testing works here, all sounds very tricky and probably user visible.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":162,"context_line":"   auth_type\u003dpassword"},{"line_number":163,"context_line":"   auth_url\u003dhttp://192.0.2.3:35357"},{"line_number":164,"context_line":"   password\u003d7c48bc8f2668001d81582506f7c83d242f62502e"},{"line_number":165,"context_line":"   service\u003dcompute"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"Fetch RBAC Data"},{"line_number":168,"context_line":"~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_d1008037","line":165,"in_reply_to":"dfeb2761_768b751e","updated":"2017-04-06 12:51:40.000000000","message":"This is the per service API files.  The \u0027service\u0027 field can be modified, if you really want, to be some mangled service/region thing, but I would not recommend that.\n\nIf per-region policy is really required, we will do that as a follow on patch. I do not want to scope creep this one any more.  For most deployments, policy is identical across regions (that is the default now) and we can make a smart decision how to handle multi-region RBAC once we have some feedback from the field on how well this works as is.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":192,"context_line":"         {"},{"line_number":193,"context_line":"             verbs\u003d[\"POST\"],"},{"line_number":194,"context_line":"             pattern\u003d\"/os-cells\","},{"line_number":195,"context_line":"             roles\u003d[\"admin\"],"},{"line_number":196,"context_line":"         },"},{"line_number":197,"context_line":"         {"},{"line_number":198,"context_line":"             verbs\u003d[\"GET\", \"PUT\"],"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_f656655c","line":195,"updated":"2017-04-05 10:11:11.000000000","message":"I thought you said the admin role is defined in policy.json? So you can put anything here, but if you don\u0027t have the admin role you are getting a 403 anyways.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":192,"context_line":"         {"},{"line_number":193,"context_line":"             verbs\u003d[\"POST\"],"},{"line_number":194,"context_line":"             pattern\u003d\"/os-cells\","},{"line_number":195,"context_line":"             roles\u003d[\"admin\"],"},{"line_number":196,"context_line":"         },"},{"line_number":197,"context_line":"         {"},{"line_number":198,"context_line":"             verbs\u003d[\"GET\", \"PUT\"],"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_31b8cc74","line":195,"in_reply_to":"dfeb2761_f656655c","updated":"2017-04-06 12:51:40.000000000","message":"Yep.  You might decide that soemthing that is not Admin in policy should be Axdmin only via RBAC, and that is supported.\n\nI can make different examples if you feel strongly that it will make things clearer.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":196,"context_line":"         },"},{"line_number":197,"context_line":"         {"},{"line_number":198,"context_line":"             verbs\u003d[\"GET\", \"PUT\"],"},{"line_number":199,"context_line":"             pattern\u003d\"/v2.{subversion}/{tenant_id}/servers/{server_id}\""},{"line_number":200,"context_line":"             roles\u003d[\"Member\", \"admin\"],"},{"line_number":201,"context_line":"         }"},{"line_number":202,"context_line":"      ],"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_423d4cdb","line":199,"range":{"start_line":199,"start_character":22,"end_line":199,"end_character":38},"updated":"2017-04-05 10:11:11.000000000","message":"What is in the service catalog the root or the versioned endpoint? We need to decide that first I guess.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":196,"context_line":"         },"},{"line_number":197,"context_line":"         {"},{"line_number":198,"context_line":"             verbs\u003d[\"GET\", \"PUT\"],"},{"line_number":199,"context_line":"             pattern\u003d\"/v2.{subversion}/{tenant_id}/servers/{server_id}\""},{"line_number":200,"context_line":"             roles\u003d[\"Member\", \"admin\"],"},{"line_number":201,"context_line":"         }"},{"line_number":202,"context_line":"      ],"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_62b5f07d","line":199,"range":{"start_line":199,"start_character":38,"end_line":199,"end_character":50},"updated":"2017-04-05 10:11:11.000000000","message":"this bit is optional, will probably need that for all policy rules that apply to urls that had that.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":196,"context_line":"         },"},{"line_number":197,"context_line":"         {"},{"line_number":198,"context_line":"             verbs\u003d[\"GET\", \"PUT\"],"},{"line_number":199,"context_line":"             pattern\u003d\"/v2.{subversion}/{tenant_id}/servers/{server_id}\""},{"line_number":200,"context_line":"             roles\u003d[\"Member\", \"admin\"],"},{"line_number":201,"context_line":"         }"},{"line_number":202,"context_line":"      ],"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_7163f41b","line":199,"range":{"start_line":199,"start_character":22,"end_line":199,"end_character":38},"in_reply_to":"dfeb2761_423d4cdb","updated":"2017-04-06 12:51:40.000000000","message":"Good question, and I will take input on that.  I suspect that it needs to be the versioned URL for specific rules, but the catch-all can be unversioned, so we should (and do) support both.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":199,"context_line":"             pattern\u003d\"/v2.{subversion}/{tenant_id}/servers/{server_id}\""},{"line_number":200,"context_line":"             roles\u003d[\"Member\", \"admin\"],"},{"line_number":201,"context_line":"         }"},{"line_number":202,"context_line":"      ],"},{"line_number":203,"context_line":"      \u0027default\u0027: {"},{"line_number":204,"context_line":"          roles\u003d[\"Member\", \"admin\"],"},{"line_number":205,"context_line":"      },"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_19a1fa46","line":202,"updated":"2017-04-05 10:11:11.000000000","message":"How do I work out what operations each role is allowed and not allowed to do here? It seems non-obvious how to enumerate those all, to check I am not handing out control to something I don\u0027t want to.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":199,"context_line":"             pattern\u003d\"/v2.{subversion}/{tenant_id}/servers/{server_id}\""},{"line_number":200,"context_line":"             roles\u003d[\"Member\", \"admin\"],"},{"line_number":201,"context_line":"         }"},{"line_number":202,"context_line":"      ],"},{"line_number":203,"context_line":"      \u0027default\u0027: {"},{"line_number":204,"context_line":"          roles\u003d[\"Member\", \"admin\"],"},{"line_number":205,"context_line":"      },"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_51511036","line":202,"in_reply_to":"dfeb2761_19a1fa46","updated":"2017-04-06 12:51:40.000000000","message":"Probably best to have tooling to figure that out.  If you have a list of URLs from, say https://developer.openstack.org/api-ref/compute/  you could enumerate each and see what matches.  The need for wildcards makes it hard to do without a complete enumeration.  And no service provides that enumeration yet.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":200,"context_line":"             roles\u003d[\"Member\", \"admin\"],"},{"line_number":201,"context_line":"         }"},{"line_number":202,"context_line":"      ],"},{"line_number":203,"context_line":"      \u0027default\u0027: {"},{"line_number":204,"context_line":"          roles\u003d[\"Member\", \"admin\"],"},{"line_number":205,"context_line":"      },"},{"line_number":206,"context_line":"  }"},{"line_number":207,"context_line":""},{"line_number":208,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_4c533e18","line":205,"range":{"start_line":203,"start_character":0,"end_line":205,"end_character":8},"updated":"2017-04-05 10:11:11.000000000","message":"I am actually pro adding this bit into keystone middleware, via config maybe. Just a simple check that says you must have one of these N roles to get access to this endpoint. Ideally that configuration is read from the existing oslo.polcy file, and the default defined in the project\u0027s code in the usual way. If its not there, the middleware keeps defaulting to \"open\".","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":200,"context_line":"             roles\u003d[\"Member\", \"admin\"],"},{"line_number":201,"context_line":"         }"},{"line_number":202,"context_line":"      ],"},{"line_number":203,"context_line":"      \u0027default\u0027: {"},{"line_number":204,"context_line":"          roles\u003d[\"Member\", \"admin\"],"},{"line_number":205,"context_line":"      },"},{"line_number":206,"context_line":"  }"},{"line_number":207,"context_line":""},{"line_number":208,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_7131b40b","line":205,"range":{"start_line":203,"start_character":0,"end_line":205,"end_character":8},"in_reply_to":"dfeb2761_4c533e18","updated":"2017-04-06 12:51:40.000000000","message":"If this effort fails, go for it.  It will actually get in the way of this effort to implement, so please keep it as a last resort.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":205,"context_line":"      },"},{"line_number":206,"context_line":"  }"},{"line_number":207,"context_line":""},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Role check"},{"line_number":210,"context_line":"~~~~~~~~~~"},{"line_number":211,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_f62545c3","line":208,"updated":"2017-04-05 10:11:11.000000000","message":"If that above is the default we register in keystone, all users that don\u0027t have the Member or admin role no longer have access to the API right?\n\nSo on upgrade we would have to have a way to workout what the bulk request looks like, and modify that to meet my needs, updating the role names, then set it against keystone?","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":205,"context_line":"      },"},{"line_number":206,"context_line":"  }"},{"line_number":207,"context_line":""},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Role check"},{"line_number":210,"context_line":"~~~~~~~~~~"},{"line_number":211,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_94042619","line":208,"in_reply_to":"dfeb2761_f62545c3","updated":"2017-04-06 12:51:40.000000000","message":"Correct:  if your token does not contain a role that matches the rule, you are denied access.\n\nOn upgrade, the only issue would be adding APIs that should be more restrictive than Member.  If the norm is to make them admin as enforced by oslo-policy, then then there is no reduction in security.\n\nUpgrade can always add new rules to Keystone first, and then upgrade the remote systems.  That prevents the new code from being executed with old policy.  But now you are getting into the upgrade path, and that is Tripleo, Fuel, and Kolla territory, not Nova/Keystone.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":222,"context_line":"Hostname and port. The remainder of the URL may start"},{"line_number":223,"context_line":"with the version information in the pattern /v[0-9.]*/."},{"line_number":224,"context_line":"In our example, this leaves: `/v2.1/2497f6/servers/83cbdc`."},{"line_number":225,"context_line":"The pattern matching will be run against this sub-url."},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"keystonemiddleware will iterate through the set of api_roles,"},{"line_number":228,"context_line":"attempting a match against each one. The URL remainder above will"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_16ec298d","line":225,"updated":"2017-04-05 10:11:11.000000000","message":"So any alias of URLs that is done in the service code, isn\u0027t hidden from the policy system?","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":222,"context_line":"Hostname and port. The remainder of the URL may start"},{"line_number":223,"context_line":"with the version information in the pattern /v[0-9.]*/."},{"line_number":224,"context_line":"In our example, this leaves: `/v2.1/2497f6/servers/83cbdc`."},{"line_number":225,"context_line":"The pattern matching will be run against this sub-url."},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"keystonemiddleware will iterate through the set of api_roles,"},{"line_number":228,"context_line":"attempting a match against each one. The URL remainder above will"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_d4abced3","line":225,"in_reply_to":"dfeb2761_16ec298d","updated":"2017-04-06 12:51:40.000000000","message":"Correct.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":228,"context_line":"attempting a match against each one. The URL remainder above will"},{"line_number":229,"context_line":"match the pattern"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"GET /v2.1/{tenant_id}/servers/{server_id}"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"Since the token response will have the role \"Member\" which matches the"},{"line_number":234,"context_line":"set of roles: `roles\u003d[\"Member\", \"admin\"]` the validation will succeed."}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_16bae96c","line":231,"range":{"start_line":231,"start_character":9,"end_line":231,"end_character":21},"updated":"2017-04-05 10:11:11.000000000","message":"This bit is optional, just saying that adds to the complexity here.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":228,"context_line":"attempting a match against each one. The URL remainder above will"},{"line_number":229,"context_line":"match the pattern"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"GET /v2.1/{tenant_id}/servers/{server_id}"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"Since the token response will have the role \"Member\" which matches the"},{"line_number":234,"context_line":"set of roles: `roles\u003d[\"Member\", \"admin\"]` the validation will succeed."}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_14837655","line":231,"range":{"start_line":231,"start_character":9,"end_line":231,"end_character":21},"in_reply_to":"dfeb2761_16bae96c","updated":"2017-04-06 12:51:40.000000000","message":"Yeah, but some APIs still require it, so we need to support it.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":243,"context_line":"middleware pipeline continues, eventually calling into the Nova server"},{"line_number":244,"context_line":"specific code. Inside this code, Nova will call the oslo-policy"},{"line_number":245,"context_line":"library to enforce policy as specified by either the Nova annotations"},{"line_number":246,"context_line":"or the overloads provided in the policy.json or policy.yaml files."},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"Object Schema"},{"line_number":249,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_f93c16c9","line":246,"updated":"2017-04-05 10:11:11.000000000","message":"... and my operator brain explodes trying to work out how to loosen the restriction on some admin API.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":243,"context_line":"middleware pipeline continues, eventually calling into the Nova server"},{"line_number":244,"context_line":"specific code. Inside this code, Nova will call the oslo-policy"},{"line_number":245,"context_line":"library to enforce policy as specified by either the Nova annotations"},{"line_number":246,"context_line":"or the overloads provided in the policy.json or policy.yaml files."},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"Object Schema"},{"line_number":249,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_743762b2","line":246,"in_reply_to":"dfeb2761_f93c16c9","updated":"2017-04-06 12:51:40.000000000","message":"If policy is enforced by oslo-policy, there is no choice but to change olso-policy.  I can\u0027t change that.  But modifyihng olso-policy should not be the norm.\n\nPerhaps we can work out a default oslo-policy approach for not-enforcing admin for scoped APIs via tooling change?","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":385,"context_line":"and determine they need to delegate the `auditor` role. Assuming the role"},{"line_number":386,"context_line":"inference rule that states `Member` implies `auditor`, a user with the"},{"line_number":387,"context_line":"`Member` role can then create a trust with the implied `auditor` rule"},{"line_number":388,"context_line":"for the remote service."},{"line_number":389,"context_line":""},{"line_number":390,"context_line":"For a Web UI like Horizon, this method could be used to customize the"},{"line_number":391,"context_line":"User interface, to determine if a class of resources should be shown,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_995d0a17","line":388,"updated":"2017-04-05 10:11:11.000000000","message":"But don\u0027t they really only want to give access to the specific API operation, an that doesn\u0027t do that?","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":385,"context_line":"and determine they need to delegate the `auditor` role. Assuming the role"},{"line_number":386,"context_line":"inference rule that states `Member` implies `auditor`, a user with the"},{"line_number":387,"context_line":"`Member` role can then create a trust with the implied `auditor` rule"},{"line_number":388,"context_line":"for the remote service."},{"line_number":389,"context_line":""},{"line_number":390,"context_line":"For a Web UI like Horizon, this method could be used to customize the"},{"line_number":391,"context_line":"User interface, to determine if a class of resources should be shown,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_74064289","line":388,"in_reply_to":"dfeb2761_995d0a17","updated":"2017-04-06 12:51:40.000000000","message":"Access to an individual API is the trivial case;  one-to-one roles to APIs.  We toyed wtih the idea of having APIs as a top level entity in the Keystone role assignment side instead, and using implied roles all the way down.  Its a more complex mechanism for what is likely to be a limited use case.  As soon as that role needs access to more that one API, you need to do a re-assignment for everyone with that role, and that voids the usefulness of the roles as an abstraction layer.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":398,"context_line":""},{"line_number":399,"context_line":"Many of the earlier proposals have attempted to work with the existing"},{"line_number":400,"context_line":"policy structure. Several proof-of-concepts have been written that"},{"line_number":401,"context_line":"dynamically fetch the oslo-policy, or remotely execute a comparable"},{"line_number":402,"context_line":"check."},{"line_number":403,"context_line":""},{"line_number":404,"context_line":"The main reason for not pursuing this approach is that it is very hard"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_59c2e25a","line":401,"range":{"start_line":401,"start_character":0,"end_line":401,"end_character":33},"updated":"2017-04-05 10:11:11.000000000","message":"I still don\u0027t understand what the need is for dymanic fetch of policy.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":398,"context_line":""},{"line_number":399,"context_line":"Many of the earlier proposals have attempted to work with the existing"},{"line_number":400,"context_line":"policy structure. Several proof-of-concepts have been written that"},{"line_number":401,"context_line":"dynamically fetch the oslo-policy, or remotely execute a comparable"},{"line_number":402,"context_line":"check."},{"line_number":403,"context_line":""},{"line_number":404,"context_line":"The main reason for not pursuing this approach is that it is very hard"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_340e7a8d","line":401,"range":{"start_line":401,"start_character":0,"end_line":401,"end_character":33},"in_reply_to":"dfeb2761_59c2e25a","updated":"2017-04-06 12:51:40.000000000","message":"Go see my presentation from years gone by.  Essentially, to modify access without bringing down your entire cluster.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":408,"context_line":"Server data from the database at middleware time. Also, the amount of"},{"line_number":409,"context_line":"administration, especially the definition of attributes, meant that"},{"line_number":410,"context_line":"the domain structure from Nova was duplicated in the Keystone"},{"line_number":411,"context_line":"Database."},{"line_number":412,"context_line":""},{"line_number":413,"context_line":"The current approach to scoping policy can be described as \"all"},{"line_number":414,"context_line":"resources of the same type withing a project have the same access"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_99e06a28","line":411,"updated":"2017-04-05 10:11:11.000000000","message":"Now we have the API URL structure in the keystone db? Not sure I like either of those.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":408,"context_line":"Server data from the database at middleware time. Also, the amount of"},{"line_number":409,"context_line":"administration, especially the definition of attributes, meant that"},{"line_number":410,"context_line":"the domain structure from Nova was duplicated in the Keystone"},{"line_number":411,"context_line":"Database."},{"line_number":412,"context_line":""},{"line_number":413,"context_line":"The current approach to scoping policy can be described as \"all"},{"line_number":414,"context_line":"resources of the same type withing a project have the same access"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_941e66b8","line":411,"in_reply_to":"dfeb2761_99e06a28","updated":"2017-04-06 12:51:40.000000000","message":"Best of the worst options?  You need, somewhere, to have the set of URLs enumerated.  I suspect that, with proper tooling, we could generate these direct from code.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":419,"context_line":"cloud scale. Any delegations created that attempt to use those"},{"line_number":420,"context_line":"objects must now use impersonation, which is dangerous. To clean up"},{"line_number":421,"context_line":"these resources, should that user not be present is to escalate it to"},{"line_number":422,"context_line":"an administrator."},{"line_number":423,"context_line":""},{"line_number":424,"context_line":"The RBAC approach described here does not prescribe"},{"line_number":425,"context_line":"such an approach, it just takes a more pragmatic and scalable approach"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_79d48620","line":422,"updated":"2017-04-05 10:11:11.000000000","message":"To be clear, nested projects is suggested as the current way forward. Create a new nested project to keep a set of delegated resources, that can be clean up by the user that created the nested project.\n\nNow quotas is largely stopping us doing that today, I believe. But maybe there are other things stopping us?","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":419,"context_line":"cloud scale. Any delegations created that attempt to use those"},{"line_number":420,"context_line":"objects must now use impersonation, which is dangerous. To clean up"},{"line_number":421,"context_line":"these resources, should that user not be present is to escalate it to"},{"line_number":422,"context_line":"an administrator."},{"line_number":423,"context_line":""},{"line_number":424,"context_line":"The RBAC approach described here does not prescribe"},{"line_number":425,"context_line":"such an approach, it just takes a more pragmatic and scalable approach"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_d452ae67","line":422,"in_reply_to":"dfeb2761_79d48620","updated":"2017-04-06 12:51:40.000000000","message":"I am in full support of using nested projects. We are in the \"alternatives\" section here, where I point out that I have considered the alternatives, and here is why not to chose them.  So, yeah, I agree with you.  But we still need proper RBAC to let users clean up things that, today, need admin. So it is a step to getting to more scalable management.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":423,"context_line":""},{"line_number":424,"context_line":"The RBAC approach described here does not prescribe"},{"line_number":425,"context_line":"such an approach, it just takes a more pragmatic and scalable approach"},{"line_number":426,"context_line":"first. This approach better matches the OpenStack design."},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"Other specs that have addressed this are listed in references."},{"line_number":429,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_d96a7218","line":426,"range":{"start_line":426,"start_character":6,"end_line":426,"end_character":57},"updated":"2017-04-05 10:11:11.000000000","message":"I see delegation of policy enforcement to each end point as a key tenant of the OpenStack design. This seems to remove most of that.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":423,"context_line":""},{"line_number":424,"context_line":"The RBAC approach described here does not prescribe"},{"line_number":425,"context_line":"such an approach, it just takes a more pragmatic and scalable approach"},{"line_number":426,"context_line":"first. This approach better matches the OpenStack design."},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"Other specs that have addressed this are listed in references."},{"line_number":429,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_f45ff23e","line":426,"range":{"start_line":426,"start_character":6,"end_line":426,"end_character":57},"in_reply_to":"dfeb2761_d96a7218","updated":"2017-04-06 12:51:40.000000000","message":"They cannot work in isolation for something that is designed to span multiple systems. Otherwise, we have \"least common denomuiator\" which holds everyone back. By making a common RBAC mechanism, it lets the different services move forward without having to synchronize a big thing outside their control: the set of roles a deployment has defined.\n\nAlso, UI and interface in general needs to be discoverable.  The current set of services are not discoverable this way, and if any one of them attempts to implement it in a way different from the others, it makes life very difficult for the client.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d5f9dc817b08a72c6807c222022149e4b88bfe42","unresolved":false,"context_lines":[{"line_number":442,"context_line":"it misbehaves, the administrator could create a role called"},{"line_number":443,"context_line":"`compute_delete_server` specific to the API `DELETE"},{"line_number":444,"context_line":"/v2.1/{tenant_id}/servers/{server_id}` as well as a role inference"},{"line_number":445,"context_line":"rule."},{"line_number":446,"context_line":""},{"line_number":447,"context_line":""},{"line_number":448,"context_line":"Here is an example"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dfeb2761_99498ab8","line":445,"updated":"2017-04-05 10:11:11.000000000","message":"That can be done with the policy file today. This doesn\u0027t seem to change that too much.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0debfc2826f3b5d36fb1e8d8d102e7e1b844cbe1","unresolved":false,"context_lines":[{"line_number":442,"context_line":"it misbehaves, the administrator could create a role called"},{"line_number":443,"context_line":"`compute_delete_server` specific to the API `DELETE"},{"line_number":444,"context_line":"/v2.1/{tenant_id}/servers/{server_id}` as well as a role inference"},{"line_number":445,"context_line":"rule."},{"line_number":446,"context_line":""},{"line_number":447,"context_line":""},{"line_number":448,"context_line":"Here is an example"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bff0334d_14193684","line":445,"in_reply_to":"dfeb2761_99498ab8","updated":"2017-04-06 12:51:40.000000000","message":"Excpet they also need to modify all of the other policy files in the system for the other services and all of the existing rules for this service.  Not practical.","commit_id":"7eaa152b845f63906ccfb3fc6bac10a05b1e56df"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"da33e31be0d3cb4c27c5f111f4568beb5be8978f","unresolved":false,"context_lines":[{"line_number":323,"context_line":"      \u0027roles\u0027: [\u0027member\u0027]"},{"line_number":324,"context_line":"      },"},{"line_number":325,"context_line":"      {"},{"line_number":326,"context_line":"      \u0027pattern\u0027\u003d\u0027/v2/metadefs/namespaces/{namespace_name}/objects\u0027"},{"line_number":327,"context_line":"      \u0027verbs\u0027\u003d[\u0027POST\u0027],"},{"line_number":328,"context_line":"      \u0027roles\u0027\u003d[\u0027admin\u0027]"},{"line_number":329,"context_line":"      },"}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfeb2761_14c554f1","line":326,"range":{"start_line":326,"start_character":15,"end_line":326,"end_character":16},"updated":"2017-04-04 22:31:31.000000000","message":"Here should be \": \", not \u003d for dict as the above..\n\nAll following also seem needed to be changed.","commit_id":"bcd31907246132aa0a156a7fd6b0576dc6d9965e"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"da33e31be0d3cb4c27c5f111f4568beb5be8978f","unresolved":false,"context_lines":[{"line_number":431,"context_line":"essential to the Role check inside the body of a post statement.  For"},{"line_number":432,"context_line":"those cases, merely, looking at the URL is insufficient.  In a follow"},{"line_number":433,"context_line":"on patch, the above API can be extended to provide a path query inside"},{"line_number":434,"context_line":"the body.  This assumes the body will by JSON or a comparable"},{"line_number":435,"context_line":"language."},{"line_number":436,"context_line":""},{"line_number":437,"context_line":"For example, the Nova API /servers/{server_id}/action  required the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfeb2761_94d964f4","line":434,"range":{"start_line":434,"start_character":33,"end_line":434,"end_character":40},"updated":"2017-04-04 22:31:31.000000000","message":"nit: will be by","commit_id":"bcd31907246132aa0a156a7fd6b0576dc6d9965e"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"da33e31be0d3cb4c27c5f111f4568beb5be8978f","unresolved":false,"context_lines":[{"line_number":437,"context_line":"For example, the Nova API /servers/{server_id}/action  required the"},{"line_number":438,"context_line":"parsing of the POST body to see the action requested.  A JQ style path"},{"line_number":439,"context_line":"such as .addFloatingIp would be required to manage RBAC access to the"},{"line_number":440,"context_line":"action  \"addFloatingIp.\""},{"line_number":441,"context_line":""},{"line_number":442,"context_line":"This could be done by adding an additional, optional field named `path.`"},{"line_number":443,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfeb2761_74fb8046","line":440,"range":{"start_line":440,"start_character":8,"end_line":440,"end_character":24},"updated":"2017-04-04 22:31:31.000000000","message":"nit: \"addFloatingIp\".","commit_id":"bcd31907246132aa0a156a7fd6b0576dc6d9965e"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"da33e31be0d3cb4c27c5f111f4568beb5be8978f","unresolved":false,"context_lines":[{"line_number":439,"context_line":"such as .addFloatingIp would be required to manage RBAC access to the"},{"line_number":440,"context_line":"action  \"addFloatingIp.\""},{"line_number":441,"context_line":""},{"line_number":442,"context_line":"This could be done by adding an additional, optional field named `path.`"},{"line_number":443,"context_line":""},{"line_number":444,"context_line":""},{"line_number":445,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfeb2761_149c340d","line":442,"range":{"start_line":442,"start_character":65,"end_line":442,"end_character":72},"updated":"2017-04-04 22:31:31.000000000","message":"nit: `path`.","commit_id":"bcd31907246132aa0a156a7fd6b0576dc6d9965e"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"041f7c5b8170185f76bdaaeb677b9e1796fb0416","unresolved":false,"context_lines":[{"line_number":96,"context_line":""},{"line_number":97,"context_line":"The RBAC check happens before keystonemiddleware passes control to"},{"line_number":98,"context_line":"the service specific code. Leave the current oslo-policy based access"},{"line_number":99,"context_line":"checks in place, using the existing policy.json files. This leads to a"},{"line_number":100,"context_line":"separation of concerns: Middleware enforces the role check, source"},{"line_number":101,"context_line":"code enforces the scope check."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The following changes are required to enable the RBAC check:"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_7ea7c30c","line":101,"range":{"start_line":99,"start_character":55,"end_line":101,"end_character":30},"updated":"2017-04-05 12:44:23.000000000","message":"This is the key point for me.\n\nI am fine with this idea, I agree with the benefits you enumerated in this spec.\n\nWhat I would like to see is:\n\n1) A cross-project agreement that this will be the only place where the roles will be checked in the future. Roles in the middleware, scope in the projects\u0027 code.\n\n2) For that agreement, everybody needs to understand that by separating role from scope check, the downside is that we lose the power to do more complex checks, where the combination of (scope OR anything from db) AND role make the authorization.\n\n3) After all that agreement, we need a plan on how this will match with the current ongoing effort on policies being defined into the code. For me it seems like this is going at one end, and that in the other. If we want both efforts going in the same time, we need to make sure there is a rendezvous point, otherwise the efforts won\u0027t make sense separately.","commit_id":"0dda0a35d0c97d270dde3953b14488881fc6a577"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"df140735_24250eac","side":"PARENT","line":128,"updated":"2017-05-31 19:47:54.000000000","message":"identified*","commit_id":"c71305efab6dc864007ff2c3dd9389db715f8fb5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"df140735_44f3620b","side":"PARENT","line":156,"updated":"2017-05-31 19:47:54.000000000","message":"For this to render properly, we need another newline here.","commit_id":"c71305efab6dc864007ff2c3dd9389db715f8fb5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"df140735_e464b6e7","side":"PARENT","line":157,"updated":"2017-05-31 19:47:54.000000000","message":"This isn\u0027t rendering as code. Might need to remove the `ini` bit?","commit_id":"c71305efab6dc864007ff2c3dd9389db715f8fb5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"df140735_0498cabd","side":"PARENT","line":173,"updated":"2017-05-31 19:47:54.000000000","message":"the result will be cached in keystonemiddleware *","commit_id":"c71305efab6dc864007ff2c3dd9389db715f8fb5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"df140735_a4fd9eb2","side":"PARENT","line":232,"updated":"2017-05-31 19:47:54.000000000","message":"s/auth-data/token/","commit_id":"c71305efab6dc864007ff2c3dd9389db715f8fb5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"df140735_44280233","side":"PARENT","line":234,"updated":"2017-05-31 19:47:54.000000000","message":"For clarification, the failure here results in a 401, or a 403?","commit_id":"c71305efab6dc864007ff2c3dd9389db715f8fb5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"df140735_989e7eb6","side":"PARENT","line":369,"updated":"2017-05-31 19:47:54.000000000","message":"If we end up doing this, I really don\u0027t think this is something we should expose to end users. I see the value of exposing it to service users, but not end users. If a user wants to know what role is required for an operation, they should be getting that information from a capabilities API implemented in the service. \n\nWe could lock this down to only be something a service user can get, then the service can compose the answer based on capabilities of the service, too. It\u0027s going to be confusing for users to seeing that they have the ability to do X when the deployment or service doesn\u0027t actually support it.","commit_id":"c71305efab6dc864007ff2c3dd9389db715f8fb5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"b0c2242f904ffbe717196785baf2b05473c96bcd","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"7f231b9d_b37befbc","side":"PARENT","line":369,"in_reply_to":"df140735_989e7eb6","updated":"2017-06-20 00:55:32.000000000","message":"If you hide it from end users you break their ability to determine what to delegate to other users.\n\nDon\u0027t hide this.  Hiding makes security worse, not better.\n\nCapabilities should be exposed to the user too.\n\nIf a site disables a capability, they can remove the rule from RBAC to avoid confusing users.\n\nPlease don\u0027t break this spec.","commit_id":"c71305efab6dc864007ff2c3dd9389db715f8fb5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"df140735_983afe95","side":"PARENT","line":457,"updated":"2017-05-31 19:47:54.000000000","message":"I think the ini here needs to be removed in order for the following lines to be rendered properly.","commit_id":"c71305efab6dc864007ff2c3dd9389db715f8fb5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"df140735_785a8af3","side":"PARENT","line":490,"updated":"2017-05-31 19:47:54.000000000","message":"roles*","commit_id":"c71305efab6dc864007ff2c3dd9389db715f8fb5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[{"line_number":250,"context_line":"The new entity stored in the database would have the following layout."},{"line_number":251,"context_line":""},{"line_number":252,"context_line":"route"},{"line_number":253,"context_line":"~~~~~"},{"line_number":254,"context_line":"ID: Autogenerated UUID"},{"line_number":255,"context_line":"Service: Indexable String, matches the values from the service catalog"},{"line_number":256,"context_line":"Path: Long String (\u003e255 chars) that contains the paths."}],"source_content_type":"text/x-rst","patch_set":8,"id":"df140735_04d0ca1e","line":253,"updated":"2017-05-31 19:47:54.000000000","message":"This needs a newline and probably a : with - to get these items to render as a list.","commit_id":"93f8ebbc8d9a88cbf31d6d3ee3986534420ba82d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6a47987bfccf14ae3d091cca799fb26b4a2af8f3","unresolved":false,"context_lines":[{"line_number":553,"context_line":"  { \"service\": \"identity\", \"path\": \"*\", \"verb\": \"*\", \"role\": \"admin\"}"},{"line_number":554,"context_line":""},{"line_number":555,"context_line":""},{"line_number":556,"context_line":"which will require that all Member level APIS need an  explicit"},{"line_number":557,"context_line":"route. This will allow them to stop hard coding Role checks in the"},{"line_number":558,"context_line":"policy.json file and start performing them in middleware.  Any new"},{"line_number":559,"context_line":"APIs will then be Admin only until an explicit route is added with a"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df140735_3822d253","line":556,"updated":"2017-05-31 19:47:54.000000000","message":"APIs","commit_id":"93f8ebbc8d9a88cbf31d6d3ee3986534420ba82d"}]}