)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Adam Young \u003cayoung@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-06-13 00:55:32 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"endpont policy"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I8ddf845038d8d4aac2321888d18196565678dc86"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"1ae5cdf2_e0a8c1dd","line":7,"updated":"2014-06-16 14:57:44.000000000","message":"Spec for Endpoint Policy","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"endpont policy"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I8ddf845038d8d4aac2321888d18196565678dc86"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"1ae5cdf2_20aaa9d2","line":9,"updated":"2014-06-16 14:57:44.000000000","message":"add \n\n    bp endpoint-policy","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"a0a448fcb9205163b617d394ef813f9a88575f0c","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Endpoint policy extension"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Allow associtation of a policy module to a specific endpoint(s)"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Co-Authored-By: Adam Young \u003cayoung@redhat.com\u003e"},{"line_number":12,"context_line":"Co-Authored-By: Henry Nash \u003chenryn@linux.vnet.ibm.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"baada198_d6603c37","line":9,"updated":"2014-07-26 00:39:37.000000000","message":"I would vote on leveraging a statement in the spec which describes the commit better:\n\nProvide the ability to associate a given policy file with an endpoint or set of endpoints.","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"78be4debdc9067a478c92d7a23da04b292085826","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Endpoint policy extension"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Allow associtation of a policy module to a specific endpoint(s)"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Co-Authored-By: Adam Young \u003cayoung@redhat.com\u003e"},{"line_number":12,"context_line":"Co-Authored-By: Henry Nash \u003chenryn@linux.vnet.ibm.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"baada198_99e35733","line":9,"in_reply_to":"baada198_d6603c37","updated":"2014-07-26 01:07:56.000000000","message":"Done","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"}],"specs/juno/endpoint-policy.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Example Spec - The title of your blueprint"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp example \u003chttps://blueprints.launchpad.net/keystone/+spec/endpoint-policy\u003e`_"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_00dbed7d","line":8,"updated":"2014-06-16 14:57:44.000000000","message":"Update the title.","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Example Spec - The title of your blueprint"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp example \u003chttps://blueprints.launchpad.net/keystone/+spec/endpoint-policy\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Extension OS-POLICY Provides the means to assign policy files to specific endpoint, or to all endpoints for a specific services. This extension requires v3.X of the Identity API."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_2091c99a","line":11,"updated":"2014-06-16 14:57:44.000000000","message":"add \n\n    bp endpoint-policy","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp example \u003chttps://blueprints.launchpad.net/keystone/+spec/endpoint-policy\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Extension OS-POLICY Provides the means to assign policy files to specific endpoint, or to all endpoints for a specific services. This extension requires v3.X of the Identity API."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e0f601f9","line":14,"updated":"2014-06-16 14:57:44.000000000","message":"line too long","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Allow policy to vary between endpoints.  Make it possible for an endpoint to"},{"line_number":22,"context_line":"fetch the policy relevant to itself."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_a0d3195e","line":22,"updated":"2014-06-16 14:57:44.000000000","message":"I would try and reword this to be geared towards explaining why we need endpoint policy.","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":29,"context_line":"or a service."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"The user associated with that endpoint will be able to get a token for a"},{"line_number":32,"context_line":"project, and the endpoint can fetch the policy relevant to that project. "},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_80353daa","line":32,"updated":"2014-06-16 14:57:44.000000000","message":"remove trailing whitespace, same comment for all instance in this file.","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Alternatives"},{"line_number":36,"context_line":"------------"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"None.  Canot be done today"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Data Model Impact"},{"line_number":41,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_405335e2","line":38,"updated":"2014-06-16 14:57:44.000000000","message":"Cannot*","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":40,"context_line":"Data Model Impact"},{"line_number":41,"context_line":"-----------------"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Endpoint and Services will need an extra field policy_id:  default to None"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"REST API Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_a00879da","line":43,"updated":"2014-06-16 14:57:44.000000000","message":"is this going to be done in one migration modifying both tables or one migration for each table?","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":46,"context_line":"REST API Impact"},{"line_number":47,"context_line":"---------------"},{"line_number":48,"context_line":"PROPOSAL: "},{"line_number":49,"context_line":"The API calls are:"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"API"},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e029a138","line":49,"updated":"2014-06-16 14:57:44.000000000","message":"This line is redundant with line 53","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Status: 204 No Content"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Assign a policy file to a specific endpoint for a service. If a policy file already covers a service, this specific rule takes priority."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"PUT /OS-POLICY/endpoint/{endpoint_id}/policy/{policy_id}"},{"line_number":69,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_20e2a901","line":66,"updated":"2014-06-16 14:57:44.000000000","message":"line too long?","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"GET /OS-POLICY/endpoint/{endpoint_id}"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"The response contains the content that would also be returned by GET /v3/policy/{policy_id} for the policy file associated with the endpoint. If no specific policy file has been assigned to that endpoint, the response contains the policy file assigned to the service_id for the specified endpoint."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Response:"},{"line_number":84,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e0b7e1f3","line":81,"updated":"2014-06-16 14:57:44.000000000","message":"line too long","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":87,"context_line":"(Copy from policy exmaple in V3 API)"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Check if an endpoint has a poicy file"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"HEAD /OS-POLICY/endpoint/{endpoint_id}"},{"line_number":93,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_60c3d157","line":90,"updated":"2014-06-16 14:57:44.000000000","message":"policy*","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Status: 200 OK"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Response will contain the set of policy rules that apply to that project. See policy.json in Keystone for format,"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Status: 409 Conflict If multiple policy files specify the same rule, and that rule differs, the policy for the project is invalid and cannot be downloaded. The response will provide the equivalent of a git conflict showing where two rules do not agree. "},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_808d3d2d","line":103,"updated":"2014-06-16 14:57:44.000000000","message":"end with a period. \n\nLine too long here too?","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":109,"context_line":"Security Impact"},{"line_number":110,"context_line":"---------------"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Policy will need to be better tested"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_00a12d95","line":112,"updated":"2014-06-16 14:57:44.000000000","message":"How?","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":115,"context_line":"Notifications Impact"},{"line_number":116,"context_line":"--------------------"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"All policy changes shouldbe auditable events"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Other End User Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_40ab3575","line":118,"updated":"2014-06-16 14:57:44.000000000","message":"should be*","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":121,"context_line":"Other End User Impact"},{"line_number":122,"context_line":"---------------------"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Client changes to fetch.  Auth token middleware will need to consume."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Performance Impact"},{"line_number":127,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e0b361e7","line":124,"updated":"2014-06-16 14:57:44.000000000","message":"fetch what?\n\nWhat will auth token middleware be consuming?","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":131,"context_line":"Other Deployer Impact"},{"line_number":132,"context_line":"---------------------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":" Remoted service will need to change to take advantage of this feature."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Developer Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_00cf6d58","line":134,"updated":"2014-06-16 14:57:44.000000000","message":"Remove space before \u0027Remoted\u0027\n\nHow will \u0027Remoted\u0027 services have to change? If we need cross project collaboration to accomplish this, it should be documented here I think.","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"53bc5881644d632a9888f567b486c08ca5727b4d","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Client changes required."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Policy should be enofroces by keystone client to make max use."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_003dad2c","line":142,"updated":"2014-06-16 14:57:44.000000000","message":"enforced*","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"bed942cbb04e6f9909e80adefd9721f2e92cc35e","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"References"},{"line_number":175,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":176,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_b2bf46c9","line":176,"updated":"2014-06-27 14:01:48.000000000","message":"you could put the wiki link: https://wiki.openstack.org/wiki/Keystone/EndpointPolicyAssignment","commit_id":"fe5a156084e8a718439beb7e71ea3e7e9dd2c6a6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ef1de1984fa566821006e07dc81b621afedc26da","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Allow policy to vary between endpoints.  Make it possible for an endpoint to"},{"line_number":22,"context_line":"fetch the policy relevant to itself."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab895d6_4748ac5b","line":23,"updated":"2014-06-30 06:37:44.000000000","message":"I think having a use case, and stating the motivation behind this feature would be great.","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"7d8668812a0c1341db244754a2fe88c225632606","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Allow policy to vary between endpoints.  Make it possible for an endpoint to"},{"line_number":22,"context_line":"fetch the policy relevant to itself."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_1b4b582c","line":23,"in_reply_to":"dab895d6_4748ac5b","updated":"2014-07-01 12:14:52.000000000","message":"++\n\nA clear use case for me, is for federated endpoints. Would be easier do limit federated users access without fancy rules inside the service policy file.","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"8db48500ccc9ea34e843317d070ddefec68c6456","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Allow policy to vary between endpoints.  Make it possible for an endpoint to"},{"line_number":22,"context_line":"fetch the policy relevant to itself."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_4e7845c4","line":24,"updated":"2014-07-11 16:51:44.000000000","message":"++ I agree as well. Would be good to point out how many folks want ACLs for each endpoint and this mechanism will provide this desired capability","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"456c11d1f7344374fd88527a09abbdcf48d5dd11","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Allow policy to vary between endpoints.  Make it possible for an endpoint to"},{"line_number":22,"context_line":"fetch the policy relevant to itself."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Proposed Change"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_d543f9ac","line":24,"in_reply_to":"baada198_4e7845c4","updated":"2014-07-11 19:32:27.000000000","message":"++ I see that request a lot","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"456c11d1f7344374fd88527a09abbdcf48d5dd11","unresolved":false,"context_lines":[{"line_number":28,"context_line":"After upload of policy, an admin will associate a policy file with and endpoint"},{"line_number":29,"context_line":"or a service."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"The user associated with that endpoint will be able to get a token for a"},{"line_number":32,"context_line":"project, and the endpoint can fetch the policy relevant to that project. "},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_95d981f5","line":31,"updated":"2014-07-11 19:32:27.000000000","message":"I\u0027m not sure what that means...how is a user associated with an endpoint?","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"8db48500ccc9ea34e843317d070ddefec68c6456","unresolved":false,"context_lines":[{"line_number":29,"context_line":"or a service."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"The user associated with that endpoint will be able to get a token for a"},{"line_number":32,"context_line":"project, and the endpoint can fetch the policy relevant to that project. "},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_e953d314","line":32,"updated":"2014-07-11 16:51:44.000000000","message":"de-redify","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"8db48500ccc9ea34e843317d070ddefec68c6456","unresolved":false,"context_lines":[{"line_number":36,"context_line":"------------"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"None.  Canot be done today"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Data Model Impact"},{"line_number":41,"context_line":"-----------------"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_9400aaac","line":39,"updated":"2014-07-11 16:51:44.000000000","message":"I believe there are a couple of ways to provide this function.\n\nauth_token/oslo.policy pulls policy from URL e.g. /v3/policies/abc\n\nor use GET /v3/policies?endpoint_id \u003d abc","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"8db48500ccc9ea34e843317d070ddefec68c6456","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"REST API Impact"},{"line_number":47,"context_line":"---------------"},{"line_number":48,"context_line":"PROPOSAL: "},{"line_number":49,"context_line":"The API calls are:"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"API"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_29230ba8","line":48,"updated":"2014-07-11 16:51:44.000000000","message":"de-redify","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"8db48500ccc9ea34e843317d070ddefec68c6456","unresolved":false,"context_lines":[{"line_number":103,"context_line":"Response will contain the set of policy rules that apply to that project. See policy.json in Keystone for format,"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Status: 409 Conflict If multiple policy files specify the same rule, and that rule differs, the policy for the project is invalid and cannot be downloaded. The response will provide the equivalent of a git conflict showing where two rules do not agree. "},{"line_number":106,"context_line":""},{"line_number":107,"context_line":""},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_c927efb4","line":106,"updated":"2014-07-11 16:51:44.000000000","message":"de-redify","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"a2c5ba511a9ba87976dfe3864701c912cdc9e69d","unresolved":false,"context_lines":[{"line_number":115,"context_line":"Notifications Impact"},{"line_number":116,"context_line":"--------------------"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"All policy changes shouldbe auditable events"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Other End User Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_58cd0730","line":118,"updated":"2014-07-08 04:50:09.000000000","message":"should be","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"8db48500ccc9ea34e843317d070ddefec68c6456","unresolved":false,"context_lines":[{"line_number":126,"context_line":"Performance Impact"},{"line_number":127,"context_line":"------------------"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Negligable.  Policy will be fetched infrequently.  "},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Other Deployer Impact"},{"line_number":132,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_ae29e19c","line":129,"updated":"2014-07-11 16:51:44.000000000","message":"de-redify","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"a2c5ba511a9ba87976dfe3864701c912cdc9e69d","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Client changes required."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Policy should be enofroces by keystone client to make max use."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_589b4717","line":142,"updated":"2014-07-08 04:50:09.000000000","message":"Did you mean enforced?","commit_id":"bd2ce15e4043a2b7a6e5761bca97f48e94faf90b"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f68ef128a21e5f9de00dda58b8f5a252d90c643d","unresolved":false,"context_lines":[{"line_number":38,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"This change provides the ability to associate a given policy file (stored in"},{"line_number":41,"context_line":"Keystone and represented by a policy ID) with a set of endpoints, in much"},{"line_number":42,"context_line":"the same way that endpoint filtering allows a project to to be associated with"},{"line_number":43,"context_line":"a set of endpoints."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"baada198_147170a8","line":41,"updated":"2014-07-22 16:04:17.000000000","message":"Change \"set of endpoints\" to  \"a region\"  Regions are designed for the hierarchical management of endpoints.","commit_id":"8787ff11806f544da3812efb9db6145648f5e2ac"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7de367719ed7ac90b62355af02dd73d417224ac2","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"The existing Identity policy API will be extended to allow a policy to be"},{"line_number":46,"context_line":"retrieved for a specific endpoint, where the association created for that"},{"line_number":47,"context_line":"endpoint will be used to selected the appropriate policy file."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"In this version of the extension it will only be possible to associate an"},{"line_number":50,"context_line":"endpoint with one policy file (i.e. there will be no combining of policy"}],"source_content_type":"text/x-rst","patch_set":4,"id":"baada198_fb730ee6","line":47,"updated":"2014-07-22 15:52:52.000000000","message":"s/selected/select/","commit_id":"8787ff11806f544da3812efb9db6145648f5e2ac"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"a0a448fcb9205163b617d394ef813f9a88575f0c","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"- A policy associated with a specific endpoint"},{"line_number":45,"context_line":"- A policy associated with a service in a given region"},{"line_number":46,"context_line":"- A policy associated with a service"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The existing Identity policy API will be extended to allow a policy to be"},{"line_number":49,"context_line":"retrieved for a specific endpoint, where the association created for that"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_366ed8c8","line":46,"updated":"2014-07-26 00:39:37.000000000","message":"What about a policy associated with a region - allowing you to capture all endpoints in that region. Simplifying the management of endpoints for administrators across different geographical production regions?","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"78be4debdc9067a478c92d7a23da04b292085826","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"- A policy associated with a specific endpoint"},{"line_number":45,"context_line":"- A policy associated with a service in a given region"},{"line_number":46,"context_line":"- A policy associated with a service"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The existing Identity policy API will be extended to allow a policy to be"},{"line_number":49,"context_line":"retrieved for a specific endpoint, where the association created for that"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_196bc7b9","line":46,"in_reply_to":"baada198_366ed8c8","updated":"2014-07-26 01:07:56.000000000","message":"So I\u0027m not sure whether we really want a single policy file that contains all the rules for each service (e.g. nova, keystone, glance etc.)....feels more dangerous","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"a0a448fcb9205163b617d394ef813f9a88575f0c","unresolved":false,"context_lines":[{"line_number":51,"context_line":"the above three types of association *in that order*.  The first association"},{"line_number":52,"context_line":"match found will be used - no combining of policy files due to multiple"},{"line_number":53,"context_line":"associations will be carried out. If no association is found, then an"},{"line_number":54,"context_line":"error will be returned."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Alternatives"},{"line_number":57,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_d6375cae","line":54,"updated":"2014-07-26 00:39:37.000000000","message":"Why throw an error if no association? If no association is found for a particular endpoint, we deny? What is the default behavior?","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"78be4debdc9067a478c92d7a23da04b292085826","unresolved":false,"context_lines":[{"line_number":51,"context_line":"the above three types of association *in that order*.  The first association"},{"line_number":52,"context_line":"match found will be used - no combining of policy files due to multiple"},{"line_number":53,"context_line":"associations will be carried out. If no association is found, then an"},{"line_number":54,"context_line":"error will be returned."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Alternatives"},{"line_number":57,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_d99b0fc7","line":54,"in_reply_to":"baada198_d6375cae","updated":"2014-07-26 01:07:56.000000000","message":"So this will be unto the endpoint.  It might be configured with a default local policy file if it can\u0027t get a policy from keystone, or it might just decide to fail to come up.","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"a0a448fcb9205163b617d394ef813f9a88575f0c","unresolved":false,"context_lines":[{"line_number":65,"context_line":"-----------------"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Changes to the data model will be restricted to new tables for storing the"},{"line_number":68,"context_line":"endpoint policy associations."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"REST API Impact"},{"line_number":71,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_b659082b","line":68,"updated":"2014-07-26 00:39:37.000000000","message":"I would vote on removing the Data Model Impact section.","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"78be4debdc9067a478c92d7a23da04b292085826","unresolved":false,"context_lines":[{"line_number":65,"context_line":"-----------------"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Changes to the data model will be restricted to new tables for storing the"},{"line_number":68,"context_line":"endpoint policy associations."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"REST API Impact"},{"line_number":71,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_59dd3f6f","line":68,"in_reply_to":"baada198_b659082b","updated":"2014-07-26 01:07:56.000000000","message":"I think the fact that it doesn\u0027t touch core tables is a guide to how pervasive this change would be.","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"a0a448fcb9205163b617d394ef813f9a88575f0c","unresolved":false,"context_lines":[{"line_number":71,"context_line":"---------------"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"The exact API specification will be defined as part of a review of an"},{"line_number":74,"context_line":"changes to the Identity API.  This will include:"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"- API for OS-ENDPOINT-POLICY to define policy associations"},{"line_number":77,"context_line":"- Extension to the existing Identity policy API to ask for policy"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_96b5e433","line":74,"updated":"2014-07-26 00:39:37.000000000","message":"Similarly, remove REST API Impact. And cover the required doc changes in the documentation impact section.","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"78be4debdc9067a478c92d7a23da04b292085826","unresolved":false,"context_lines":[{"line_number":71,"context_line":"---------------"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"The exact API specification will be defined as part of a review of an"},{"line_number":74,"context_line":"changes to the Identity API.  This will include:"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"- API for OS-ENDPOINT-POLICY to define policy associations"},{"line_number":77,"context_line":"- Extension to the existing Identity policy API to ask for policy"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_19f027fc","line":74,"in_reply_to":"baada198_96b5e433","updated":"2014-07-26 01:07:56.000000000","message":"I think the detail should indeed be left to the identity api review, but I think just clarifying what areas will be touched is useful","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"a0a448fcb9205163b617d394ef813f9a88575f0c","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Notifications Impact"},{"line_number":86,"context_line":"--------------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"All policy association changes will be auditable events"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Other End User Impact"},{"line_number":91,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_36b418f0","line":88,"updated":"2014-07-26 00:39:37.000000000","message":"Add full stop at end of line 88.","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"78be4debdc9067a478c92d7a23da04b292085826","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Notifications Impact"},{"line_number":86,"context_line":"--------------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"All policy association changes will be auditable events"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Other End User Impact"},{"line_number":91,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_39a5eb02","line":88,"in_reply_to":"baada198_36b418f0","updated":"2014-07-26 01:07:56.000000000","message":"Done","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"a0a448fcb9205163b617d394ef813f9a88575f0c","unresolved":false,"context_lines":[{"line_number":90,"context_line":"Other End User Impact"},{"line_number":91,"context_line":"---------------------"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Endpoints will need to call keystone to obtain their policy (rather than"},{"line_number":94,"context_line":"read it from a file) in order to take advantage of this change. Keystone"},{"line_number":95,"context_line":"middleware should provide support for this."},{"line_number":96,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_d682fc50","line":93,"updated":"2014-07-26 00:39:37.000000000","message":"s/keystone/Keystone","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"78be4debdc9067a478c92d7a23da04b292085826","unresolved":false,"context_lines":[{"line_number":90,"context_line":"Other End User Impact"},{"line_number":91,"context_line":"---------------------"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Endpoints will need to call keystone to obtain their policy (rather than"},{"line_number":94,"context_line":"read it from a file) in order to take advantage of this change. Keystone"},{"line_number":95,"context_line":"middleware should provide support for this."},{"line_number":96,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_59afffe2","line":93,"in_reply_to":"baada198_d682fc50","updated":"2014-07-26 01:07:56.000000000","message":"Done","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"a0a448fcb9205163b617d394ef813f9a88575f0c","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":"- Get agreement of API specifications"},{"line_number":128,"context_line":"- Implement the policy association code"},{"line_number":129,"context_line":"- Extend to the policy API to enable the use of any associations"},{"line_number":130,"context_line":"- Modify Keystone middleware to expose this new facility"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Separate patches/blueprints will be used to modify the policy loading of other"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_16a8f48a","line":129,"updated":"2014-07-26 00:39:37.000000000","message":"remove \"to\"","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"78be4debdc9067a478c92d7a23da04b292085826","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":"- Get agreement of API specifications"},{"line_number":128,"context_line":"- Implement the policy association code"},{"line_number":129,"context_line":"- Extend to the policy API to enable the use of any associations"},{"line_number":130,"context_line":"- Modify Keystone middleware to expose this new facility"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Separate patches/blueprints will be used to modify the policy loading of other"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_397c0b71","line":129,"in_reply_to":"baada198_16a8f48a","updated":"2014-07-26 01:07:56.000000000","message":"Done","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"a0a448fcb9205163b617d394ef813f9a88575f0c","unresolved":false,"context_lines":[{"line_number":127,"context_line":"- Get agreement of API specifications"},{"line_number":128,"context_line":"- Implement the policy association code"},{"line_number":129,"context_line":"- Extend to the policy API to enable the use of any associations"},{"line_number":130,"context_line":"- Modify Keystone middleware to expose this new facility"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Separate patches/blueprints will be used to modify the policy loading of other"},{"line_number":133,"context_line":"projects to be able to use this facility."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_36ab3889","line":130,"updated":"2014-07-26 00:39:37.000000000","message":"\"facility\" seems rather English ;) I would favor \"feature\" or \"capability\" over \"facility\" but not an issue if you disagree.","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"78be4debdc9067a478c92d7a23da04b292085826","unresolved":false,"context_lines":[{"line_number":127,"context_line":"- Get agreement of API specifications"},{"line_number":128,"context_line":"- Implement the policy association code"},{"line_number":129,"context_line":"- Extend to the policy API to enable the use of any associations"},{"line_number":130,"context_line":"- Modify Keystone middleware to expose this new facility"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Separate patches/blueprints will be used to modify the policy loading of other"},{"line_number":133,"context_line":"projects to be able to use this facility."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_f9853359","line":130,"in_reply_to":"baada198_36ab3889","updated":"2014-07-26 01:07:56.000000000","message":"Done","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"a0a448fcb9205163b617d394ef813f9a88575f0c","unresolved":false,"context_lines":[{"line_number":130,"context_line":"- Modify Keystone middleware to expose this new facility"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Separate patches/blueprints will be used to modify the policy loading of other"},{"line_number":133,"context_line":"projects to be able to use this facility."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Dependencies"},{"line_number":136,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_7677703b","line":133,"updated":"2014-07-26 00:39:37.000000000","message":"Ditto above regarding \"facility\" (for review consistency)","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"78be4debdc9067a478c92d7a23da04b292085826","unresolved":false,"context_lines":[{"line_number":130,"context_line":"- Modify Keystone middleware to expose this new facility"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Separate patches/blueprints will be used to modify the policy loading of other"},{"line_number":133,"context_line":"projects to be able to use this facility."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Dependencies"},{"line_number":136,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_59961f95","line":133,"in_reply_to":"baada198_7677703b","updated":"2014-07-26 01:07:56.000000000","message":"Done","commit_id":"d4b88d5a3984983ed9aa3acf7df1e8ac9c440cb5"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"52bd11cd63791667f324fe7531062ca3494d5f8f","unresolved":false,"context_lines":[{"line_number":23,"context_line":"which endpoints such resources can be used."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The classic use case that illustrates this problem is a cloud that is divided"},{"line_number":26,"context_line":"into collections of endpoints that represent, say, Test, QA and Production"},{"line_number":27,"context_line":"areas. In such environments, you would typically want to restrict the users who"},{"line_number":28,"context_line":"can issue API calls that affect production, from those that can access the Test"},{"line_number":29,"context_line":"environment for example. Today, the only way of achieving this is to have a"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_d9b3d64b","line":26,"updated":"2014-08-05 07:10:56.000000000","message":"Even with this proposal, we still need endpoint filtering right? Otherwise, your service catalog will contain all the endpoints.","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4577f55c63a364f41f15d3160c90045c99059a8a","unresolved":false,"context_lines":[{"line_number":23,"context_line":"which endpoints such resources can be used."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The classic use case that illustrates this problem is a cloud that is divided"},{"line_number":26,"context_line":"into collections of endpoints that represent, say, Test, QA and Production"},{"line_number":27,"context_line":"areas. In such environments, you would typically want to restrict the users who"},{"line_number":28,"context_line":"can issue API calls that affect production, from those that can access the Test"},{"line_number":29,"context_line":"environment for example. Today, the only way of achieving this is to have a"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_fe6dd968","line":26,"in_reply_to":"baada198_d9b3d64b","updated":"2014-08-05 10:12:43.000000000","message":"Yes, I see them as complementary.  Endpoint filtering is about a project owner limiting where that project can be deployed, while this proposal is about a cloud provider specify what roles you need to operate on given endpoints.","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"52bd11cd63791667f324fe7531062ca3494d5f8f","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Three types of association will be supported:"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"- A policy associated with a specific endpoint"},{"line_number":45,"context_line":"- A policy associated with a service in a given region"},{"line_number":46,"context_line":"- A policy associated with a service"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The existing Identity policy API will be extended to allow a policy to be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_9e0a2425","line":45,"updated":"2014-08-05 07:10:56.000000000","message":"region and its parent regions in ascending order?","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4577f55c63a364f41f15d3160c90045c99059a8a","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Three types of association will be supported:"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"- A policy associated with a specific endpoint"},{"line_number":45,"context_line":"- A policy associated with a service in a given region"},{"line_number":46,"context_line":"- A policy associated with a service"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The existing Identity policy API will be extended to allow a policy to be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_3e8f5124","line":45,"in_reply_to":"baada198_9e0a2425","updated":"2014-08-05 10:12:43.000000000","message":"Yes, but you\u0027re correct I should make that clear.","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"52bd11cd63791667f324fe7531062ca3494d5f8f","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"This change would allow a cloud administrator to, for example, specify a"},{"line_number":58,"context_line":"restrict set of role assignments that would be needed to undertake certain"},{"line_number":59,"context_line":"actions in a production region.  For instance, a cloud provider might define"},{"line_number":60,"context_line":"a nova policy that, for production, has rules like:"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_b91f02b7","line":59,"updated":"2014-08-05 07:10:56.000000000","message":"So with this proposal, I can have all kinds of roles assigned for a project, but may not have access to all the endpoints. But would that lead to proliferation of roles? Also, I am not sure if we can get away to role scoping as role definitions may clash.","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4577f55c63a364f41f15d3160c90045c99059a8a","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"This change would allow a cloud administrator to, for example, specify a"},{"line_number":58,"context_line":"restrict set of role assignments that would be needed to undertake certain"},{"line_number":59,"context_line":"actions in a production region.  For instance, a cloud provider might define"},{"line_number":60,"context_line":"a nova policy that, for production, has rules like:"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_9e393d43","line":59,"in_reply_to":"baada198_b91f02b7","updated":"2014-08-05 10:12:43.000000000","message":"I don\u0027t think it leads to a proliferation of roles (unless you have lots of project specific roles).  In most clouds, few people have the right to touch all endpoints, those rights become more liberal the further away from production you get.  Even in a true dev/ops environment, typically a small subset of the team actually get to push the stuff into canary testing, production or whatever.","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"52bd11cd63791667f324fe7531062ca3494d5f8f","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"By associating the two policy files with the nova service for their respective"},{"line_number":73,"context_line":"regions, the correct policy file would automatically by returned to any nova"},{"line_number":74,"context_line":"endpoint in either region if it fetched its policy by endpoint ID."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Alternatives"},{"line_number":77,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_f9bdfad1","line":74,"updated":"2014-08-05 07:10:56.000000000","message":"Can we have some flow diagrams on how this work in the big picture?\n\nWill RBAC be enforced by the (to be implemented) new Keystone middleware? How is this middleware configured? With the pre-assigned endpoint_id and time interval of how often to fetch the policy file?","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4577f55c63a364f41f15d3160c90045c99059a8a","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"By associating the two policy files with the nova service for their respective"},{"line_number":73,"context_line":"regions, the correct policy file would automatically by returned to any nova"},{"line_number":74,"context_line":"endpoint in either region if it fetched its policy by endpoint ID."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Alternatives"},{"line_number":77,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_c10af81d","line":74,"in_reply_to":"baada198_f9bdfad1","updated":"2014-08-05 10:12:43.000000000","message":"I can certainly provide some diagrams, but I believe (hope?) it\u0027s much simpler than you are thinking.  Today an endpoint starts up, loads its policy from a file specified in its config file, and loads that policy into the policy engine.  When it gets a request (which has been through auth token middleware) it takes the token data and passes that and the request data to the policy engine.  Keystone middleware doesn\u0027t enforce policy for a service, it just validates and gets all the data ready.  So, prior to this proposal, the above flow is being changed to rather than read the policy file from disc - the endpoints call keystone get_policy(policy_id) to get their policy and then the rest is as before.  All this proposal is saying is that if they use this extension, then they will call (something like) get_policy_for_endpoint(endpoint_id) instead, and that will return them the appropriate policy.  Everything else stays the same - so there is not change in flow - do you still think we need a diagram?","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"52bd11cd63791667f324fe7531062ca3494d5f8f","unresolved":false,"context_lines":[{"line_number":100,"context_line":"---------------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Above and beyond the act of allowing endpoints to get policy from Keystone"},{"line_number":103,"context_line":"(which is already supported), there is no significant security impact."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Notifications Impact"},{"line_number":106,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_195f0e76","line":103,"updated":"2014-08-05 07:10:56.000000000","message":"Who manage the endpoints? Who can fetch the endpoints, service user?","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4577f55c63a364f41f15d3160c90045c99059a8a","unresolved":false,"context_lines":[{"line_number":100,"context_line":"---------------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Above and beyond the act of allowing endpoints to get policy from Keystone"},{"line_number":103,"context_line":"(which is already supported), there is no significant security impact."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Notifications Impact"},{"line_number":106,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_e15c5c1d","line":103,"in_reply_to":"baada198_195f0e76","updated":"2014-08-05 10:12:43.000000000","message":"Not sure I quiet understand the question...could you elaborate?","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"52bd11cd63791667f324fe7531062ca3494d5f8f","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Endpoints will need to call Keystone to obtain their policy (rather than"},{"line_number":114,"context_line":"read it from a file) in order to take advantage of this change. Keystone"},{"line_number":115,"context_line":"middleware should provide support for this."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Performance Impact"},{"line_number":118,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_99879eb5","line":115,"updated":"2014-08-05 07:10:56.000000000","message":"Like allowing a configurable endpoint_id?","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4577f55c63a364f41f15d3160c90045c99059a8a","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Endpoints will need to call Keystone to obtain their policy (rather than"},{"line_number":114,"context_line":"read it from a file) in order to take advantage of this change. Keystone"},{"line_number":115,"context_line":"middleware should provide support for this."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"Performance Impact"},{"line_number":118,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_817c8073","line":115,"in_reply_to":"baada198_99879eb5","updated":"2014-08-05 10:12:43.000000000","message":"That\u0027s an interesting idea....may be tangental, but helpful to this proposal, of course.","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"52bd11cd63791667f324fe7531062ca3494d5f8f","unresolved":false,"context_lines":[{"line_number":117,"context_line":"Performance Impact"},{"line_number":118,"context_line":"------------------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Negligible - policy will be fetched infrequently."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Other Deployer Impact"},{"line_number":123,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_39f05265","line":120,"updated":"2014-08-05 07:10:56.000000000","message":"Infrequently means what? A configurable interval in which the (to be implemented) RBAC middleware to fetch the endpoint? Or do we notify the services when an endpoint policy have been updated?","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4577f55c63a364f41f15d3160c90045c99059a8a","unresolved":false,"context_lines":[{"line_number":117,"context_line":"Performance Impact"},{"line_number":118,"context_line":"------------------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Negligible - policy will be fetched infrequently."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Other Deployer Impact"},{"line_number":123,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_414d0871","line":120,"in_reply_to":"baada198_39f05265","updated":"2014-08-05 10:12:43.000000000","message":"To start, I would suggest it remains as it is today - only when the endpoint starts up","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"52bd11cd63791667f324fe7531062ca3494d5f8f","unresolved":false,"context_lines":[{"line_number":123,"context_line":"---------------------"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"Endpoints will need a configuration setting to tell them for where to obtain"},{"line_number":126,"context_line":"their policies (i.e. file or Keystone)."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Developer Impact"},{"line_number":129,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_397bf2f4","line":126,"updated":"2014-08-05 07:10:56.000000000","message":"How does Horizon handle the policy files?","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4577f55c63a364f41f15d3160c90045c99059a8a","unresolved":false,"context_lines":[{"line_number":123,"context_line":"---------------------"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"Endpoints will need a configuration setting to tell them for where to obtain"},{"line_number":126,"context_line":"their policies (i.e. file or Keystone)."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Developer Impact"},{"line_number":129,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_816e40c7","line":126,"in_reply_to":"baada198_397bf2f4","updated":"2014-08-05 10:12:43.000000000","message":"That\u0027s a good question, but again it isn\u0027t really any different that having Horizon handle policy stored in Keystone as it is today.  I\u0027ll be raising other specs/bps aimed at the consumers later","commit_id":"52df456277feff1cfd0eec91ff699bd929a2ea99"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"4e6cf4abf5cec70c07f76e9f502d38a1106c5704","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Endpoint Policy Extension"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp example \u003chttps://blueprints.launchpad.net/keystone/+spec/endpoint-policy\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Extension OS-ENDPOINT-POLICY provides the means to assign policy files to"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_abba736e","line":11,"updated":"2014-08-11 19:39:46.000000000","message":"Please fix this to not be \u0027bp example\u0027","commit_id":"985e41c776162d8717bce7c9a8dc5cdf45fb7df6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"6a301c0838a9e964e794267689cf6ee4a86c7760","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Endpoint Policy Extension"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp example \u003chttps://blueprints.launchpad.net/keystone/+spec/endpoint-policy\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Extension OS-ENDPOINT-POLICY provides the means to assign policy files to"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_919f9c64","line":11,"in_reply_to":"baada198_abba736e","updated":"2014-08-11 20:18:12.000000000","message":"Ouch!  Done.","commit_id":"985e41c776162d8717bce7c9a8dc5cdf45fb7df6"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"4e6cf4abf5cec70c07f76e9f502d38a1106c5704","unresolved":false,"context_lines":[{"line_number":72,"context_line":"By associating the two policy files with the nova service for their respective"},{"line_number":73,"context_line":"regions, the correct policy file would automatically by returned to any nova"},{"line_number":74,"context_line":"endpoint in either region if it fetched its policy by endpoint ID."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Alternatives"},{"line_number":77,"context_line":"------------"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_b63816a0","line":75,"updated":"2014-08-11 19:39:46.000000000","message":"* Is policy only looked up on startup?\n* How does the service know if the current version of policy is stale?","commit_id":"985e41c776162d8717bce7c9a8dc5cdf45fb7df6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"6a301c0838a9e964e794267689cf6ee4a86c7760","unresolved":false,"context_lines":[{"line_number":72,"context_line":"By associating the two policy files with the nova service for their respective"},{"line_number":73,"context_line":"regions, the correct policy file would automatically by returned to any nova"},{"line_number":74,"context_line":"endpoint in either region if it fetched its policy by endpoint ID."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Alternatives"},{"line_number":77,"context_line":"------------"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_31ca5046","line":75,"in_reply_to":"baada198_b63816a0","updated":"2014-08-11 20:18:12.000000000","message":"At this stage I imagine it would only be fetched at startup.  Think of the support we currently provide, where an endpoint can fetch its policy (by Policy ID) at start up instead of reading it from a file.  All we do here, is provide a call that the endpoint can first get back the policy ID of the appropriate policy...and then it can ask for it just as it (could do) now.  In the future we could issue notifications of change of policy rules that could be listened to by endpoints and the policy re-read.\n\nI\u0027ll add that to the text.","commit_id":"985e41c776162d8717bce7c9a8dc5cdf45fb7df6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"adbb4f466439bdfff8660b1707b866700b2b392b","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp endpoint-policy \u003chttps://blueprints.launchpad.net/keystone/+spec/endpoint-policy\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Extension OS-ENDPOINT-POLICY provides the means to assign policy files to"},{"line_number":15,"context_line":"specific endpoints. This extension requires v3.3 of the Identity API."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"9ab29df4_e0753833","line":14,"updated":"2014-08-13 20:40:01.000000000","message":"`` around OS-ENDPOINT-POLICY ``","commit_id":"06d39caaa59f03fe9e30462c3b4327c299da8079"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"abcd95f0f7f1f7e06f62c813607f70306b4f9d9d","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp endpoint-policy \u003chttps://blueprints.launchpad.net/keystone/+spec/endpoint-policy\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Extension OS-ENDPOINT-POLICY provides the means to assign policy files to"},{"line_number":15,"context_line":"specific endpoints. This extension requires v3.3 of the Identity API."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"9ab29df4_c61ccc16","line":14,"in_reply_to":"9ab29df4_e0753833","updated":"2014-08-13 20:51:42.000000000","message":"Done","commit_id":"06d39caaa59f03fe9e30462c3b4327c299da8079"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"adbb4f466439bdfff8660b1707b866700b2b392b","unresolved":false,"context_lines":[{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"OpenStack provides RBAC capabilities for controlling access to project-based"},{"line_number":22,"context_line":"resources.  It does not, however, provide RBAC capabilities in terms of on"},{"line_number":23,"context_line":"which endpoints such resources can be used."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The classic use case that illustrates this problem is a cloud that is divided"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9ab29df4_4b044515","line":22,"updated":"2014-08-13 20:40:01.000000000","message":"\"in terms of on which\" sounds funny","commit_id":"06d39caaa59f03fe9e30462c3b4327c299da8079"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"abcd95f0f7f1f7e06f62c813607f70306b4f9d9d","unresolved":false,"context_lines":[{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"OpenStack provides RBAC capabilities for controlling access to project-based"},{"line_number":22,"context_line":"resources.  It does not, however, provide RBAC capabilities in terms of on"},{"line_number":23,"context_line":"which endpoints such resources can be used."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The classic use case that illustrates this problem is a cloud that is divided"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9ab29df4_46d8bc53","line":22,"in_reply_to":"9ab29df4_4b044515","updated":"2014-08-13 20:51:42.000000000","message":"Done","commit_id":"06d39caaa59f03fe9e30462c3b4327c299da8079"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"adbb4f466439bdfff8660b1707b866700b2b392b","unresolved":false,"context_lines":[{"line_number":48,"context_line":"The existing Identity policy API will be extended to allow a policy to be"},{"line_number":49,"context_line":"retrieved for a specific endpoint, where the association created for that"},{"line_number":50,"context_line":"endpoint will be used to select the appropriate policy file, by checking"},{"line_number":51,"context_line":"the above three types of association *in that order*.  For regions that"},{"line_number":52,"context_line":"have parents, these will be searched in ascending order. The first"},{"line_number":53,"context_line":"association match found will be used - no combining of policy files due to"},{"line_number":54,"context_line":"multiple associations will be carried out. If no association is found, then an"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9ab29df4_a0a26098","line":51,"updated":"2014-08-13 20:40:01.000000000","message":"unnecessary double space","commit_id":"06d39caaa59f03fe9e30462c3b4327c299da8079"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"abcd95f0f7f1f7e06f62c813607f70306b4f9d9d","unresolved":false,"context_lines":[{"line_number":48,"context_line":"The existing Identity policy API will be extended to allow a policy to be"},{"line_number":49,"context_line":"retrieved for a specific endpoint, where the association created for that"},{"line_number":50,"context_line":"endpoint will be used to select the appropriate policy file, by checking"},{"line_number":51,"context_line":"the above three types of association *in that order*.  For regions that"},{"line_number":52,"context_line":"have parents, these will be searched in ascending order. The first"},{"line_number":53,"context_line":"association match found will be used - no combining of policy files due to"},{"line_number":54,"context_line":"multiple associations will be carried out. If no association is found, then an"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9ab29df4_869e5455","line":51,"in_reply_to":"9ab29df4_a0a26098","updated":"2014-08-13 20:51:42.000000000","message":"Done","commit_id":"06d39caaa59f03fe9e30462c3b4327c299da8079"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"adbb4f466439bdfff8660b1707b866700b2b392b","unresolved":false,"context_lines":[{"line_number":171,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Due to the interdependent nature of the changes of this proposal, some Tempest"},{"line_number":174,"context_line":"test will be provided."},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"Documentation Impact"},{"line_number":177,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9ab29df4_8b81fd4c","line":174,"updated":"2014-08-13 20:40:01.000000000","message":"tests*","commit_id":"06d39caaa59f03fe9e30462c3b4327c299da8079"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"abcd95f0f7f1f7e06f62c813607f70306b4f9d9d","unresolved":false,"context_lines":[{"line_number":171,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Due to the interdependent nature of the changes of this proposal, some Tempest"},{"line_number":174,"context_line":"test will be provided."},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"Documentation Impact"},{"line_number":177,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":11,"id":"9ab29df4_e6ac708f","line":174,"in_reply_to":"9ab29df4_8b81fd4c","updated":"2014-08-13 20:51:42.000000000","message":"Done","commit_id":"06d39caaa59f03fe9e30462c3b4327c299da8079"}]}