)]}'
{"specs/keystone/ongoing/policy-security-roadmap.rst":[{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"f2ee5381b42c87ced8ba87c140c6635c1792dd49","unresolved":false,"context_lines":[{"line_number":190,"context_line":"  an empty set of operations. Global scope should represent a set of global"},{"line_number":191,"context_line":"  operations for a role. Both of which can be different than `project-scope`"},{"line_number":192,"context_line":"  and `domain-scope`."},{"line_number":193,"context_line":"* Eventually replace the `admin` project implementation with only the ability"},{"line_number":194,"context_line":"  to get globally scoped tokens with a global role assignment."},{"line_number":195,"context_line":""},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Conclusion"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff0f0b1f_daf2fa9a","line":194,"range":{"start_line":193,"start_character":2,"end_line":194,"end_character":62},"updated":"2017-05-17 15:58:52.000000000","message":"++. This can be done in a backwards compatible way during deprecation.","commit_id":"570f78664e4cdf36d05aea8e9fe1a793135fb765"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"472b510088c3cb114063e3f5ed796de7cd7e258f","unresolved":false,"context_lines":[{"line_number":191,"context_line":"  operations for a role. Both of which can be different than `project-scope`"},{"line_number":192,"context_line":"  and `domain-scope`."},{"line_number":193,"context_line":"* Eventually replace the `admin` project implementation with only the ability"},{"line_number":194,"context_line":"  to get globally scoped tokens with a global role assignment."},{"line_number":195,"context_line":""},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Conclusion"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff0f0b1f_229f8051","line":194,"in_reply_to":"ff0f0b1f_daf2fa9a","updated":"2017-05-17 22:16:46.000000000","message":"The only hesitation I have about this bit is that we are encouraging operators to have a super-special project, then telling them to use global roles afterwords. It makes for yet another migration.\n\nIdeally, if we have a lot of time between those two things I\u0027m fine having an is_admin_project implementation for a little while. But if we\u0027re going to implement the is_admin_project stuff then implement global roles the next release, I\u0027d rather just use the global roles implementation from the get go.\n\nThis would result in less churn and communicating to operators the need for an admin_project and less communication to users to what to scope their tokens to (i.e. scope your token to a project, no wait, scope your tokens to global!).","commit_id":"570f78664e4cdf36d05aea8e9fe1a793135fb765"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"d9d304e978e513d685264175b9538aee6072e96a","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"The purpose of this document is to describe the steps necessary to close"},{"line_number":16,"context_line":"security flaws within the current design of Role Based Access Control (RBAC)"},{"line_number":17,"context_line":"within OpenStack. Roadmaps to improve delegation usecases and policy will be"},{"line_number":18,"context_line":"covered in a separate document."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_7e048e4a","line":17,"updated":"2017-06-01 17:26:48.000000000","message":"Have these already been drafted? If so, can we link them?","commit_id":"5a8db048877f2686dbf0e6267590f714c3ee0673"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"4677694cd92bc8a61e1a846b54b778f6a0c0a8be","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"The purpose of this document is to describe the steps necessary to close"},{"line_number":16,"context_line":"security flaws within the current design of Role Based Access Control (RBAC)"},{"line_number":17,"context_line":"within OpenStack. Roadmaps to improve delegation usecases and policy will be"},{"line_number":18,"context_line":"covered in a separate document."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_68c26f5b","line":17,"in_reply_to":"df140735_29d81d1c","updated":"2017-11-29 18:21:17.000000000","message":"That sounds very reasonable.","commit_id":"5a8db048877f2686dbf0e6267590f714c3ee0673"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b5d0996c14a3b55a888e5189152875675f806140","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"The purpose of this document is to describe the steps necessary to close"},{"line_number":16,"context_line":"security flaws within the current design of Role Based Access Control (RBAC)"},{"line_number":17,"context_line":"within OpenStack. Roadmaps to improve delegation usecases and policy will be"},{"line_number":18,"context_line":"covered in a separate document."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_29d81d1c","line":17,"in_reply_to":"df140735_7e048e4a","updated":"2017-06-01 18:04:30.000000000","message":"They have not - I was planning on doing those as separate documents later. My idea for this was to describe the current short comings of policy/RBAC from a security perspective and layout a high-level roadmap for how we could improve it.\n\nThe outcome of the discussions and reviews here could be used to drill down into more detail for specific goals and specs.","commit_id":"5a8db048877f2686dbf0e6267590f714c3ee0673"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"d9d304e978e513d685264175b9538aee6072e96a","unresolved":false,"context_lines":[{"line_number":44,"context_line":"the concept of scope to the implementation. This would be the ideal model for"},{"line_number":45,"context_line":"OpenStack if all operations within OpenStack aligned nicely within projects."},{"line_number":46,"context_line":"However, this is not the case. To highlight this more effectively, let\u0027s use"},{"line_number":47,"context_line":"some examples. Let\u0027s assume we would like to create an instance. We\u0027ve already"},{"line_number":48,"context_line":"established that instances should be contained within projects, so it would"},{"line_number":49,"context_line":"make sense to apply the scope of the project we want to create the instance in"},{"line_number":50,"context_line":"to the request for creating the instance (i.e. Bob wants to create an instance"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_1946cc50","line":47,"updated":"2017-06-01 17:26:48.000000000","message":"We might break the examples into a list here for readability","commit_id":"5a8db048877f2686dbf0e6267590f714c3ee0673"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b5d0996c14a3b55a888e5189152875675f806140","unresolved":false,"context_lines":[{"line_number":44,"context_line":"the concept of scope to the implementation. This would be the ideal model for"},{"line_number":45,"context_line":"OpenStack if all operations within OpenStack aligned nicely within projects."},{"line_number":46,"context_line":"However, this is not the case. To highlight this more effectively, let\u0027s use"},{"line_number":47,"context_line":"some examples. Let\u0027s assume we would like to create an instance. We\u0027ve already"},{"line_number":48,"context_line":"established that instances should be contained within projects, so it would"},{"line_number":49,"context_line":"make sense to apply the scope of the project we want to create the instance in"},{"line_number":50,"context_line":"to the request for creating the instance (i.e. Bob wants to create an instance"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_094319b1","line":47,"in_reply_to":"df140735_1946cc50","updated":"2017-06-01 18:04:30.000000000","message":"Oh - good point. This paragraph does look a little unruly.","commit_id":"5a8db048877f2686dbf0e6267590f714c3ee0673"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"d9d304e978e513d685264175b9538aee6072e96a","unresolved":false,"context_lines":[{"line_number":162,"context_line":"reworking the assignment mechanism to allow global scoping. All of this work"},{"line_number":163,"context_line":"would be to the identity projects."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"The following are assumption about the global scoping mechanism:"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"* A global scope request returns a token with `token.is_global\u003dTrue` for a"},{"line_number":168,"context_line":"  specific role."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_39cab06c","line":165,"updated":"2017-06-01 17:26:48.000000000","message":"/s/assumption/assumptions/","commit_id":"5a8db048877f2686dbf0e6267590f714c3ee0673"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b5d0996c14a3b55a888e5189152875675f806140","unresolved":false,"context_lines":[{"line_number":162,"context_line":"reworking the assignment mechanism to allow global scoping. All of this work"},{"line_number":163,"context_line":"would be to the identity projects."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"The following are assumption about the global scoping mechanism:"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"* A global scope request returns a token with `token.is_global\u003dTrue` for a"},{"line_number":168,"context_line":"  specific role."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_c9c401f8","line":165,"in_reply_to":"df140735_39cab06c","updated":"2017-06-01 18:04:30.000000000","message":"Done","commit_id":"5a8db048877f2686dbf0e6267590f714c3ee0673"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"8ebd5383b994134f572a31582253588710aa5f2c","unresolved":false,"context_lines":[{"line_number":166,"context_line":"  the policy."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"Introducing Global Scope"},{"line_number":170,"context_line":"------------------------"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"At this point we have a way to denote `global-scope` through a workaround with"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df140735_2f478b79","line":169,"range":{"start_line":169,"start_character":0,"end_line":169,"end_character":24},"updated":"2017-06-06 12:15:14.000000000","message":"this is at the same level in the document as \"Reclassifying Operation \u0026 Scope\" and \"Communicating Difference in Scope\". while those 2 are both topics of the roadmap, this one is an option for implementing/improving the latter (\"Communicating Difference in Scope\")\n\nI think it would be clearer if we take this section out and just add a reference to the global roles spec, this document would look clearer\n\nthe details below on how to migrate to scope.global from the admin project could be migrated to the global scope spec","commit_id":"49519440e865baa83fd71e85164709708fec24cc"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"a359a1644f46c23e6a0f4ff0cc10f1eaab7522cd","unresolved":false,"context_lines":[{"line_number":130,"context_line":"to denote `global-scope`, nor does the assignment mechanisms within identity"},{"line_number":131,"context_line":"allow for it."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"The first step of this item would be to advertise proper `global-scope`. This"},{"line_number":134,"context_line":"requires keystone to understand global scope. One way to do this would be to"},{"line_number":135,"context_line":"allow the use of global role assignments. Currently, role assignments must"},{"line_number":136,"context_line":"consist of a user or group on a project or a domain. This would have to change"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3f4b6375_32355e47","line":133,"range":{"start_line":133,"start_character":58,"end_line":133,"end_character":70},"updated":"2017-10-20 19:39:34.000000000","message":"s/global-scope/system-scope/","commit_id":"870617e68e178fc302d20bad7ca7d6f2b012b081"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"3849cd3d4769f0e977985647abfa64ad58a5296a","unresolved":false,"context_lines":[{"line_number":143,"context_line":"be assigned on the system, the existing scope mechanisms will need to be"},{"line_number":144,"context_line":"modified to allow users to obtain system-scoped tokens."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"The following are assumptions about the global scoping mechanism:"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"* A request for a system-scoped token returns a token with"},{"line_number":149,"context_line":"  `token.system\u003d{\u0027all\u0027\u003dTrue}` for a specific role or roles."}],"source_content_type":"text/x-rst","patch_set":12,"id":"ff82abbf_38703308","line":146,"range":{"start_line":146,"start_character":40,"end_line":146,"end_character":46},"updated":"2017-11-28 20:05:13.000000000","message":"system","commit_id":"b14e1398a5e495d7fa38aa5663b14a0452659904"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47d85ebb1e1afcd05499eb998ea1cc863b1cdfbd","unresolved":false,"context_lines":[{"line_number":143,"context_line":"be assigned on the system, the existing scope mechanisms will need to be"},{"line_number":144,"context_line":"modified to allow users to obtain system-scoped tokens."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"The following are assumptions about the global scoping mechanism:"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"* A request for a system-scoped token returns a token with"},{"line_number":149,"context_line":"  `token.system\u003d{\u0027all\u0027\u003dTrue}` for a specific role or roles."}],"source_content_type":"text/x-rst","patch_set":12,"id":"ff82abbf_6ccd9983","line":146,"range":{"start_line":146,"start_character":40,"end_line":146,"end_character":46},"in_reply_to":"ff82abbf_38703308","updated":"2017-11-28 22:40:16.000000000","message":"Done","commit_id":"b14e1398a5e495d7fa38aa5663b14a0452659904"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"13f8485b66ca9dbbbe9c7847b00197b0c0f6a465","unresolved":false,"context_lines":[{"line_number":34,"context_line":"maintaining a level of separation or multi-tenancy. A side-effect is that this"},{"line_number":35,"context_line":"introduces an additional level of complexity to OpenStack\u0027s access control"},{"line_number":36,"context_line":"model. Not only does the entire system need to be aware of identities, roles,"},{"line_number":37,"context_line":"and assignment, but it\u0027s also needs to properly account for scope of specific"},{"line_number":38,"context_line":"operations."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"As a result, OpenStack relies on a derivative of the RBAC model unofficially"}],"source_content_type":"text/x-rst","patch_set":13,"id":"ff82abbf_30cd9184","line":37,"range":{"start_line":37,"start_character":20,"end_line":37,"end_character":24},"updated":"2017-11-29 14:47:13.000000000","message":"it","commit_id":"6e3dbf3d22c5fcca85ff2ef9fc401ded80e7e684"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"4677694cd92bc8a61e1a846b54b778f6a0c0a8be","unresolved":false,"context_lines":[{"line_number":178,"context_line":"Work Items"},{"line_number":179,"context_line":"~~~~~~~~~~"},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"* Add support to `oslo.context` and `oslo.policy` for consuming system-scoped"},{"line_number":182,"context_line":"  tokens and relaying that information in generated contexts for projects to"},{"line_number":183,"context_line":"  consume."},{"line_number":184,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"ff82abbf_52b055dd","line":181,"updated":"2017-11-29 18:21:17.000000000","message":"Do we want to add references to the respective changes Lance has been working to this end?","commit_id":"6e3dbf3d22c5fcca85ff2ef9fc401ded80e7e684"}]}