)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":4992,"name":"malini-k-bhandaru","email":"malini.k.bhandaru@intel.com","username":"malini-k-bhandaru"},"change_message_id":"215f162d8586741b656a9ec7c736c038a2894841","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Creating a policy sample"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Creating a policy sample containing cloud_admin,"},{"line_number":10,"context_line":"project_admin, project_admin and project_member roles."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"blueprint policy-sample"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"da9df570_bdc5738f","line":10,"updated":"2014-09-26 08:44:38.000000000","message":"nit: duplicate \"project_admin\"","commit_id":"449127dfe50f16c7301c2d3813c4d9b4b72b73b8"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"1f0da22d9370659f5f2b7940b975881c63369c54","unresolved":false,"context_lines":[{"line_number":10,"context_line":"domain_admin, project_admin and project_member roles."},{"line_number":11,"context_line":"And maintaining compatibility with the old role: admin."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"blueprint modify-policy"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Co-Authored-By: Rodrigo Duarte \u003crodrigods@lsd.ufcg.edu.br\u003e"},{"line_number":16,"context_line":"Co-Authored-By: Raildo Mascena de Sousa Filho \u003craildo@lsd.ufcg.edu.br\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"5a890539_87155a4b","line":13,"updated":"2014-11-26 18:42:31.000000000","message":"The bp link shoud be below the Co-Authored.","commit_id":"3fd64237b2e05a9fb771eafe04b974d145dd5051"}],"etc/policy.cloudsample.json":[{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"75f17175c20ebf8af85ac52c0c4ae428e77dc53a","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"cloud_admin\": \"(role:cloud_admin or is_admin:1)\","},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","}],"source_content_type":"application/json","patch_set":1,"id":"da9df570_5ca69c54","line":1,"updated":"2014-09-23 18:31:54.000000000","message":"for cloud_admin, use the role \"admin\" instead of \"cloud_admin\".  This will enable us to support backward compatibility.  All the current deployment use the role \"admin\" which is same as \"cloud_admin\"","commit_id":"9bd6bf1c44298270929a1aefda1a0ab1000c475b"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"53c79d9a4ce54962b3540b18780fbb7a258b5c5f","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"cloud_admin\": \"(role:cloud_admin or is_admin:1)\","},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","}],"source_content_type":"application/json","patch_set":1,"id":"da9df570_5aa69b11","line":1,"in_reply_to":"da9df570_5ca69c54","updated":"2014-09-23 20:13:44.000000000","message":"Done","commit_id":"9bd6bf1c44298270929a1aefda1a0ab1000c475b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"f0ec4affe299aa8b039863102264a29015700ff5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"cloud_admin\": \"(role:cloud_admin or is_admin:1)\","},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_cloud_admin\": \"rule:cloud_admin or rule:service_role\","}],"source_content_type":"application/json","patch_set":1,"id":"da9df570_6fb71287","line":2,"updated":"2014-09-24 08:10:55.000000000","message":"I\u0027m not sure this check is good enough.  What stops a domain admin assigning one of his users (or himself) the cloud_admin role?","commit_id":"9bd6bf1c44298270929a1aefda1a0ab1000c475b"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"4f2a53bff5ebbb2389004a2231b7821befb976d0","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"cloud_admin\": \"(role:cloud_admin or is_admin:1)\","},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_cloud_admin\": \"rule:cloud_admin or rule:service_role\","}],"source_content_type":"application/json","patch_set":1,"id":"da9df570_3dcff6b1","line":2,"in_reply_to":"da9df570_6fb71287","updated":"2014-09-24 17:24:56.000000000","message":"You\u0027re right, this is a security issue. We are working on this right now","commit_id":"9bd6bf1c44298270929a1aefda1a0ab1000c475b"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"75f17175c20ebf8af85ac52c0c4ae428e77dc53a","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    \"identity:create_project\": \"rule:cloud_admin\","},{"line_number":53,"context_line":"    \"identity:update_project\": \"rule:cloud_admin or rule:project_admin\","},{"line_number":54,"context_line":"    \"identity:delete_project\": \"rule:cloud_admin or rule:project_admin\","},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    \"identity:get_user\": \"rule:cloud_admin_or_owner or rule:domain_admin\","},{"line_number":57,"context_line":"    \"identity:list_users\": \"rule:cloud_admin  or rule:project_admin or rule:domain_admin\","},{"line_number":58,"context_line":"    \"identity:create_user\": \"rule:cloud_admin or rule:domain_admin\","}],"source_content_type":"application/json","patch_set":1,"id":"da9df570_d70d0739","line":55,"updated":"2014-09-23 18:31:54.000000000","message":"Do yo expect domain_admin should not be able to handle his domains_project?\nI thought project_admin is going to be subset of domain_admin.","commit_id":"9bd6bf1c44298270929a1aefda1a0ab1000c475b"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"a188f9db670de4af5dc2ca775ea3c746970a9fc7","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    \"identity:create_project\": \"rule:cloud_admin\","},{"line_number":53,"context_line":"    \"identity:update_project\": \"rule:cloud_admin or rule:project_admin\","},{"line_number":54,"context_line":"    \"identity:delete_project\": \"rule:cloud_admin or rule:project_admin\","},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    \"identity:get_user\": \"rule:cloud_admin_or_owner or rule:domain_admin\","},{"line_number":57,"context_line":"    \"identity:list_users\": \"rule:cloud_admin  or rule:project_admin or rule:domain_admin\","},{"line_number":58,"context_line":"    \"identity:create_user\": \"rule:cloud_admin or rule:domain_admin\","}],"source_content_type":"application/json","patch_set":1,"id":"da9df570_f72a0a8f","line":55,"in_reply_to":"da9df570_d70d0739","updated":"2014-09-23 19:28:52.000000000","message":"Our thought is that domain_admin is responsible for control users. Who controls projects is the cloud_admin and the project_admin of the our project. This is wrong?","commit_id":"9bd6bf1c44298270929a1aefda1a0ab1000c475b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"f0ec4affe299aa8b039863102264a29015700ff5","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    \"identity:get_user\": \"rule:cloud_admin_or_owner or rule:domain_admin\","},{"line_number":57,"context_line":"    \"identity:list_users\": \"rule:cloud_admin  or rule:project_admin or rule:domain_admin\","},{"line_number":58,"context_line":"    \"identity:create_user\": \"rule:cloud_admin or rule:domain_admin\","},{"line_number":59,"context_line":"    \"identity:update_user\": \"rule:cloud_admin_or_owner or rule:domain_admin\","},{"line_number":60,"context_line":"    \"identity:delete_user\": \"rule:cloud_admin or rule:domain_admin\","},{"line_number":61,"context_line":"    \"identity:change_password\": \"rule:cloud_admin_or_owner or rule:domain_admin\","}],"source_content_type":"application/json","patch_set":1,"id":"da9df570_af773ad3","line":58,"updated":"2014-09-24 08:10:55.000000000","message":"There is a reason the existing v3policy sample doesn\u0027t simplify the rules this way for all these APIs - that is to ensure we are testing the exact place for (in this case domain).  For instance, you don\u0027t want to be checking for whether domain is specified in a filter when doing create...it opens up routes for security exploitation","commit_id":"9bd6bf1c44298270929a1aefda1a0ab1000c475b"}],"etc/policy.json":[{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"1f0da22d9370659f5f2b7940b975881c63369c54","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"cloud_admin\": \"role:cloud_admin or role:admin or is_admin:1\","},{"line_number":3,"context_line":"    \"admin_required\": \"rule:cloud_admin\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_cloud_admin\": \"rule:cloud_admin or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":16,"id":"5a890539_2293b401","line":3,"updated":"2014-11-26 18:42:31.000000000","message":"I think that this \"admin_required\" rule is not necessary because you are not use this rule in the policy.","commit_id":"3fd64237b2e05a9fb771eafe04b974d145dd5051"}],"etc/policy.v3cloudsample.json":[{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"1f15690e146d9ae83b9e57579527ff901fc56a55","unresolved":false,"context_lines":[{"line_number":140,"context_line":"    \"identity:list_projects_associated_with_endpoint_group\": \"rule:admin_required\","},{"line_number":141,"context_line":"    \"identity:list_endpoints_associated_with_endpoint_group\": \"rule:admin_required\","},{"line_number":142,"context_line":"    \"identity:list_endpoint_groups_for_project\": \"rule:admin_required\","},{"line_number":143,"context_line":"    \"identity:add_endpoint_group_to_project\": \"rule:admin_required\","},{"line_number":144,"context_line":"    \"identity:remove_endpoint_group_from_project\": \"rule:admin_required\","},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"    \"identity:create_identity_provider\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":5,"id":"baa201ad_baa947df","side":"PARENT","line":143,"updated":"2014-10-13 14:32:29.000000000","message":"Why are you omitting some operations?","commit_id":"80d0ebd93d784bb1ec4cf7e8ddd2ff151401692f"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"9968091ddc22cb9f9daa1e60bd3af87cae918b17","unresolved":false,"context_lines":[{"line_number":140,"context_line":"    \"identity:list_projects_associated_with_endpoint_group\": \"rule:admin_required\","},{"line_number":141,"context_line":"    \"identity:list_endpoints_associated_with_endpoint_group\": \"rule:admin_required\","},{"line_number":142,"context_line":"    \"identity:list_endpoint_groups_for_project\": \"rule:admin_required\","},{"line_number":143,"context_line":"    \"identity:add_endpoint_group_to_project\": \"rule:admin_required\","},{"line_number":144,"context_line":"    \"identity:remove_endpoint_group_from_project\": \"rule:admin_required\","},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"    \"identity:create_identity_provider\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":5,"id":"baa201ad_9ae64315","side":"PARENT","line":143,"in_reply_to":"baa201ad_baa947df","updated":"2014-10-13 14:39:57.000000000","message":"It got outdated, I\u0027m gonna fix it, thanks.","commit_id":"80d0ebd93d784bb1ec4cf7e8ddd2ff151401692f"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"1f15690e146d9ae83b9e57579527ff901fc56a55","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"    \"identity:get_auth_catalog\": \"\","},{"line_number":165,"context_line":"    \"identity:get_auth_projects\": \"\","},{"line_number":166,"context_line":"    \"identity:get_auth_domains\": \"\","},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"    \"identity:list_projects_for_groups\": \"\","},{"line_number":169,"context_line":"    \"identity:list_domains_for_groups\": \"\","}],"source_content_type":"application/json","patch_set":5,"id":"baa201ad_3a9e37b9","side":"PARENT","line":166,"updated":"2014-10-13 14:32:29.000000000","message":"Same here.","commit_id":"80d0ebd93d784bb1ec4cf7e8ddd2ff151401692f"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"1f15690e146d9ae83b9e57579527ff901fc56a55","unresolved":false,"context_lines":[{"line_number":180,"context_line":"    \"identity:check_policy_association_for_region_and_service\": \"rule:cloud_admin\","},{"line_number":181,"context_line":"    \"identity:delete_policy_association_for_region_and_service\": \"rule:cloud_admin\","},{"line_number":182,"context_line":"    \"identity:get_policy_for_endpoint\": \"rule:cloud_admin\","},{"line_number":183,"context_line":"    \"identity:list_endpoints_for_policy\": \"rule:cloud_admin\""},{"line_number":184,"context_line":"}"}],"source_content_type":"application/json","patch_set":5,"id":"baa201ad_7aa8bfdb","side":"PARENT","line":183,"updated":"2014-10-13 14:32:29.000000000","message":"And here...","commit_id":"80d0ebd93d784bb1ec4cf7e8ddd2ff151401692f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"6a725f9ffd3700d16e32222c6f0636f74c27c85e","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"cloud_admin\": \"(role:cloud_admin or is_admin:1) and domain_id:cloud_admin_domain_id\","},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_cloud_admin\": \"rule:cloud_admin or rule:service_role\","}],"source_content_type":"application/json","patch_set":6,"id":"baa201ad_a3b0ed8b","line":2,"updated":"2014-10-15 23:03:33.000000000","message":"I think this is correct...but the implication of this is that you must use a domain scoped token for anything that uses rule:cloud_admin","commit_id":"3e753db685fd8043bc5d0b4f9cfd03390c9d9413"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"6bbb91b81a707b49149b97b9a36454c825168411","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"cloud_admin\": \"(role:cloud_admin or is_admin:1) and domain_id:cloud_admin_domain_id\","},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_cloud_admin\": \"rule:cloud_admin or rule:service_role\","}],"source_content_type":"application/json","patch_set":6,"id":"baa201ad_3c533a18","line":2,"in_reply_to":"baa201ad_a3b0ed8b","updated":"2014-10-16 00:59:25.000000000","message":"the same case of the previously defined cloud_admin, or I\u0027m missing something?","commit_id":"3e753db685fd8043bc5d0b4f9cfd03390c9d9413"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"64062a8c43e9ab21d3f2aef8df592c463d1680ce","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    \"identity:update_user\": \"rule:cloud_admin or rule:domain_admin_and_matching_target_user_domain_id\","},{"line_number":70,"context_line":"    \"identity:delete_user\": \"rule:cloud_admin or rule:domain_admin_and_matching_target_user_domain_id\","},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    \"admin_and_matching_target_group_domain_id\": \"domain_id:%(target.group.domain_id)s\","},{"line_number":73,"context_line":"    \"admin_and_matching_group_domain_id\": \"domain_id:%(group.domain_id)s\","},{"line_number":74,"context_line":"    \"domain_admin_and_matching_target_group_domain_id\": \"role:domain_admin and rule:matching_target_group_domain_id\","},{"line_number":75,"context_line":"    \"domain_admin_and_matching_group_domain_id\": \"role:domain_admin and rule:matching_group_domain_id\","}],"source_content_type":"application/json","patch_set":7,"id":"7a8c0949_ead12b58","line":72,"updated":"2014-11-05 20:20:57.000000000","message":"The policy file doesn\u0027t have definitions for \n\n \"matching_group_domain_id\":\"domain_id:%(group.domain_id)s\",\n \"matching_taget_group_domain_id\":\"domain_id:%(target.group.domain_id)s\",","commit_id":"d73f07c6e3c6463537a2c4f10cb7e80048b749af"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"76d7b43d332d28bb0f3a4e821e549d84352cb86c","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    \"identity:add_user_to_group\": \"rule:cloud_admin or rule:domain_admin_and_matching_target_group_domain_id\","},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    \"identity:get_credential\": \"rule:cloud_admin_or_owner\","},{"line_number":88,"context_line":"    \"identity:list_credentials\": \"rule:cloud_admin_or_owner\","},{"line_number":89,"context_line":"    \"identity:create_credential\": \"rule:cloud_admin_or_owner\","},{"line_number":90,"context_line":"    \"identity:update_credential\": \"rule:cloud_admin_or_owner\","},{"line_number":91,"context_line":"    \"identity:delete_credential\": \"rule:cloud_admin_or_owner\","}],"source_content_type":"application/json","patch_set":7,"id":"7a8c0949_0502eb0a","line":88,"updated":"2014-11-05 18:06:42.000000000","message":"list_credential should be only for cloud_admin","commit_id":"d73f07c6e3c6463537a2c4f10cb7e80048b749af"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"76d7b43d332d28bb0f3a4e821e549d84352cb86c","unresolved":false,"context_lines":[{"line_number":91,"context_line":"    \"identity:delete_credential\": \"rule:cloud_admin_or_owner\","},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    \"identity:ec2_get_credential\": \"rule:cloud_admin or rule:owner\","},{"line_number":94,"context_line":"    \"identity:ec2_list_credentials\": \"rule:cloud_admin or rule:owner\","},{"line_number":95,"context_line":"    \"identity:ec2_create_credential\": \"rule:cloud_admin or rule:owner\","},{"line_number":96,"context_line":"    \"identity:ec2_delete_credential\": \"(rule:cloud_admin or rule:owner) or (rule:owner and user_id:%(target.credential.user_id)s)\","},{"line_number":97,"context_line":""}],"source_content_type":"application/json","patch_set":7,"id":"7a8c0949_600abd22","line":94,"updated":"2014-11-05 18:06:42.000000000","message":"same as above, unless we are filtering the list by owner_id","commit_id":"d73f07c6e3c6463537a2c4f10cb7e80048b749af"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"8165dd3b0fe5dc0f67a5875276e09d6604fdbed2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"rule:cloud_admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:cloud_admin and domain_id:cloud_admin_domain_id\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_cloud_admin\": \"rule:cloud_admin or rule:service_role\","}],"source_content_type":"application/json","patch_set":8,"id":"7a8c0949_6de8f5e2","line":2,"updated":"2014-11-06 00:31:15.000000000","message":"For readability purpose, it seems that the cloud_admin rule should be defined before the admin_required rule.","commit_id":"4f3f0d809e9fe237e84de9e03f0733efed67ca06"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"21952db21d7348181ecacee9fe8eb085a6933ff8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"rule:cloud_admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:cloud_admin and domain_id:cloud_admin_domain_id\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_cloud_admin\": \"rule:cloud_admin or rule:service_role\","}],"source_content_type":"application/json","patch_set":8,"id":"7a8c0949_2528b933","line":2,"in_reply_to":"7a8c0949_6de8f5e2","updated":"2014-11-06 13:57:24.000000000","message":"Sure","commit_id":"4f3f0d809e9fe237e84de9e03f0733efed67ca06"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"1d0b3b50541c2eb0c8d68c41628c3177b3c48e0a","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    \"service_or_cloud_admin\": \"rule:cloud_admin or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","},{"line_number":7,"context_line":"    \"cloud_admin_or_owner\": \"rule:cloud_admin or rule:owner\","},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"    \"matching_target_user_project_id\":\"project_id:%(target.user.default_project_id)s\","},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"    \"domain_admin\": \"role:domain_admin and rule:matching_target_project_domain_id\","}],"source_content_type":"application/json","patch_set":9,"id":"7a8c0949_21bb4673","line":8,"updated":"2014-11-06 18:36:35.000000000","message":"Why are we using default_project_id. I believe it has to project_id","commit_id":"7f72c029da18dd6561fdd545ab8f27ec61d6fa7f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"1d0b3b50541c2eb0c8d68c41628c3177b3c48e0a","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    \"matching_target_user_project_id\":\"project_id:%(target.user.default_project_id)s\","},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"    \"domain_admin\": \"role:domain_admin and rule:matching_target_project_domain_id\","},{"line_number":12,"context_line":"    \"project_admin\": \"role:project_admin and (rule:matching_target_project_id or rule:matching_target_user_project_id)\","},{"line_number":13,"context_line":"    \"project_member\": \"role:project_member and (rule:matching_target_project_id or rule:matching_target_user_project_id)\","},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"    \"any_valid\": \"rule:cloud_admin or rule:project_admin or rule:project_member or rule:domain_admin\","}],"source_content_type":"application/json","patch_set":9,"id":"7a8c0949_8194fae2","line":12,"updated":"2014-11-06 18:36:35.000000000","message":"domain_admin\": \"role:domain_admin and rule:matching_target_project_domain_id\",\n\nIs this correct?  shouldn\u0027t it be matching_target_doman_domain_id?","commit_id":"7f72c029da18dd6561fdd545ab8f27ec61d6fa7f"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"e5c008a257df8e8ec7a871043c0ba23ea5280cb9","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    \"matching_target_user_project_id\":\"project_id:%(target.user.default_project_id)s\","},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"    \"domain_admin\": \"role:domain_admin and rule:matching_target_project_domain_id\","},{"line_number":12,"context_line":"    \"project_admin\": \"role:project_admin and (rule:matching_target_project_id or rule:matching_target_user_project_id)\","},{"line_number":13,"context_line":"    \"project_member\": \"role:project_member and (rule:matching_target_project_id or rule:matching_target_user_project_id)\","},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"    \"any_valid\": \"rule:cloud_admin or rule:project_admin or rule:project_member or rule:domain_admin\","}],"source_content_type":"application/json","patch_set":9,"id":"7a8c0949_9e844d5f","line":12,"in_reply_to":"7a8c0949_8194fae2","updated":"2014-11-07 13:28:32.000000000","message":"I\u0027ll check that","commit_id":"7f72c029da18dd6561fdd545ab8f27ec61d6fa7f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"b33fdc8fb36aa56d51a019ef4e352d863990e5ee","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    \"identity:delete_region\": \"rule:cloud_admin\","},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"    \"identity:get_service\": \"rule:any_valid\","},{"line_number":25,"context_line":"    \"identity:list_services\": \"rule:any_valid\","},{"line_number":26,"context_line":"    \"identity:create_service\": \"rule:cloud_admin\","},{"line_number":27,"context_line":"    \"identity:update_service\": \"rule:cloud_admin\","},{"line_number":28,"context_line":"    \"identity:delete_service\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":9,"id":"7a8c0949_a14ad6a9","line":25,"updated":"2014-11-06 18:24:50.000000000","message":"Can you please add test caes for list_services , list_endpoints? They don\u0027t work","commit_id":"7f72c029da18dd6561fdd545ab8f27ec61d6fa7f"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"e5c008a257df8e8ec7a871043c0ba23ea5280cb9","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    \"identity:delete_region\": \"rule:cloud_admin\","},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"    \"identity:get_service\": \"rule:any_valid\","},{"line_number":25,"context_line":"    \"identity:list_services\": \"rule:any_valid\","},{"line_number":26,"context_line":"    \"identity:create_service\": \"rule:cloud_admin\","},{"line_number":27,"context_line":"    \"identity:update_service\": \"rule:cloud_admin\","},{"line_number":28,"context_line":"    \"identity:delete_service\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":9,"id":"7a8c0949_e48781d5","line":25,"in_reply_to":"7a8c0949_a14ad6a9","updated":"2014-11-07 13:28:32.000000000","message":"This is not in the scope of this patch, although it\u0027s a desired patch.\nIt\u0027s better to submit tests in another patch than in this one","commit_id":"7f72c029da18dd6561fdd545ab8f27ec61d6fa7f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"242740a0147f8c4ac3ef58935b7dfc85e5370ce2","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    \"identity:delete_domain\": \"rule:cloud_admin\","},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    \"matching_target_project_id\":\"project_id:%(target.project.id)s\","},{"line_number":46,"context_line":"    \"matching_target_project_domain_id\":\"domain_id:%(target.project.domain_id)s\","},{"line_number":47,"context_line":"    \"domain_admin_and_matching_target_project_domain_id\": \"role:domain_admin and rule:matching_target_project_domain_id\","},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    \"domain_admin_and_matching_project_domain_id\": \"role:domain_admin and rule:matching_project_domain_id\","}],"source_content_type":"application/json","patch_set":9,"id":"7a8c0949_ac4e4d6d","line":46,"updated":"2014-11-06 19:00:24.000000000","message":"Also for readability purpose can you move all those \"matching rule\" to the top.\n\n-- Basically \n\nAll rule and role definitions\n\npolicy using those roles and rules","commit_id":"7f72c029da18dd6561fdd545ab8f27ec61d6fa7f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"0a09acbba9e74b1aada1823232d44985110d07f4","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    \"identity:delete_domain\": \"rule:cloud_admin\","},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    \"matching_target_project_id\":\"project_id:%(target.project.id)s\","},{"line_number":46,"context_line":"    \"matching_target_project_domain_id\":\"domain_id:%(target.project.domain_id)s\","},{"line_number":47,"context_line":"    \"domain_admin_and_matching_target_project_domain_id\": \"role:domain_admin and rule:matching_target_project_domain_id\","},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    \"domain_admin_and_matching_project_domain_id\": \"role:domain_admin and rule:matching_project_domain_id\","}],"source_content_type":"application/json","patch_set":9,"id":"7a8c0949_878c0a81","line":46,"updated":"2014-11-06 22:02:59.000000000","message":"I tend to disagree with you.\n\nCheck the line no 46 which defines matching_target_project_domain_id , but it is used at line 10.","commit_id":"7f72c029da18dd6561fdd545ab8f27ec61d6fa7f"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"e5c008a257df8e8ec7a871043c0ba23ea5280cb9","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    \"identity:delete_domain\": \"rule:cloud_admin\","},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    \"matching_target_project_id\":\"project_id:%(target.project.id)s\","},{"line_number":46,"context_line":"    \"matching_target_project_domain_id\":\"domain_id:%(target.project.domain_id)s\","},{"line_number":47,"context_line":"    \"domain_admin_and_matching_target_project_domain_id\": \"role:domain_admin and rule:matching_target_project_domain_id\","},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    \"domain_admin_and_matching_project_domain_id\": \"role:domain_admin and rule:matching_project_domain_id\","}],"source_content_type":"application/json","patch_set":9,"id":"7a8c0949_046e4d2f","line":46,"in_reply_to":"7a8c0949_4994f0e1","updated":"2014-11-07 13:28:32.000000000","message":"Sure, I\u0027ll fix that.","commit_id":"7f72c029da18dd6561fdd545ab8f27ec61d6fa7f"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"1b36536aff8c86b96605b6c0a9f3bab4c0518a0c","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    \"identity:delete_domain\": \"rule:cloud_admin\","},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    \"matching_target_project_id\":\"project_id:%(target.project.id)s\","},{"line_number":46,"context_line":"    \"matching_target_project_domain_id\":\"domain_id:%(target.project.domain_id)s\","},{"line_number":47,"context_line":"    \"domain_admin_and_matching_target_project_domain_id\": \"role:domain_admin and rule:matching_target_project_domain_id\","},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    \"domain_admin_and_matching_project_domain_id\": \"role:domain_admin and rule:matching_project_domain_id\","}],"source_content_type":"application/json","patch_set":9,"id":"7a8c0949_4994f0e1","line":46,"in_reply_to":"7a8c0949_878c0a81","updated":"2014-11-07 12:36:52.000000000","message":"For this case makes total sense, the rules should be right on the top where they are first used.","commit_id":"7f72c029da18dd6561fdd545ab8f27ec61d6fa7f"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"4359a41ec2f17bcdbed25656792b64bc03d21401","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    \"identity:delete_domain\": \"rule:cloud_admin\","},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    \"matching_target_project_id\":\"project_id:%(target.project.id)s\","},{"line_number":46,"context_line":"    \"matching_target_project_domain_id\":\"domain_id:%(target.project.domain_id)s\","},{"line_number":47,"context_line":"    \"domain_admin_and_matching_target_project_domain_id\": \"role:domain_admin and rule:matching_target_project_domain_id\","},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    \"domain_admin_and_matching_project_domain_id\": \"role:domain_admin and rule:matching_project_domain_id\","}],"source_content_type":"application/json","patch_set":9,"id":"7a8c0949_ec6f75c3","line":46,"in_reply_to":"7a8c0949_ac4e4d6d","updated":"2014-11-06 19:04:05.000000000","message":"I disagree here, think that having the mathing rules above the context it is being used helps when you try to look for it.","commit_id":"7f72c029da18dd6561fdd545ab8f27ec61d6fa7f"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"bfe310ee57d2450ee0571ae99a100ed7562ada75","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin\": \"role:admin or is_admin:1\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:cloud_admin\","},{"line_number":4,"context_line":"    \"cloud_admin_or_admin\": \"rule:cloud_admin or rule:admin\","},{"line_number":5,"context_line":"    \"service_role\": \"role:service\","}],"source_content_type":"application/json","patch_set":18,"id":"3a961159_8b78c690","line":2,"updated":"2014-12-09 14:43:32.000000000","message":"This needs to be reverted to the previous revision.   This rolls back to anyone with the admin role one anything has full power, which is not what you want.","commit_id":"61f715859c9dd069034b27d27218c82d07bd5f54"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"9c29f3721df86102ac8e21f411b63e01f56708b9","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"    \"domain_admin\": \"role:domain_admin and rule:matching_target_domain_id\","},{"line_number":16,"context_line":"    \"project_admin\": \"role:project_admin and (rule:matching_target_project_id or rule:matching_target_user_project_id)\","},{"line_number":17,"context_line":"    \"project_member\": \"role:project_member and (rule:matching_target_project_id or rule:matching_target_user_project_id)\","},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"    \"any_valid\": \"rule:cloud_admin_or_admin or rule:project_admin or rule:project_member or rule:domain_admin\","},{"line_number":20,"context_line":"    \"default\": \"rule:cloud_admin_or_admin\","}],"source_content_type":"application/json","patch_set":18,"id":"5a890539_4445eb41","line":17,"updated":"2014-11-30 19:01:46.000000000","message":"you can\u0027t define these rules using more than one matching like this. You should use the \"matching\" rules only in the needed context.","commit_id":"61f715859c9dd069034b27d27218c82d07bd5f54"},{"author":{"_account_id":10697,"name":"Thiago Paiva Brito","email":"thiagop@lsd.ufcg.edu.br","username":"thiagop","inactive":true},"change_message_id":"7d38c25d61a0a9fc97afe2655733804de4decfd4","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    \"identity:update_endpoint\": \"rule:cloud_admin_or_admin\","},{"line_number":38,"context_line":"    \"identity:delete_endpoint\": \"rule:cloud_admin_or_admin\","},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    \"domain_admin_and_matching_target_domain_id\": \"role:domain_admin and rule:matching_target_domain_id\","},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"    \"identity:get_domain\": \"rule:cloud_admin_or_admin or rule:domain_admin_and_matching_target_domain_id\","},{"line_number":43,"context_line":"    \"identity:list_domains\": \"rule:cloud_admin_or_admin\","}],"source_content_type":"application/json","patch_set":18,"id":"5a890539_0b3b029d","line":40,"updated":"2014-11-28 16:08:12.000000000","message":"Is it the same condition of line 15? If it is, I\u0027d prefer the shorter reference.","commit_id":"61f715859c9dd069034b27d27218c82d07bd5f54"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"95b4213e1b1808369b539171b9f5d4e8cd685629","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"domain_scoped\":\"scope:domain\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and domain_id:admin_domain_id and rule:domain_scoped\","},{"line_number":4,"context_line":"    \"role_service\": \"role:admin or role:service\","},{"line_number":5,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","},{"line_number":6,"context_line":""}],"source_content_type":"application/json","patch_set":21,"id":"3a961159_8244eeb7","line":3,"updated":"2014-12-10 22:38:34.000000000","message":"Actually we don\u0027t need to verify the domain_id anymore.\nOn the grant rule we can restrict that the user who gives cloud_admin role is a cloud_admin. We can do rules like this:\n\u0027cloud_admin\u0027:%(target.role.name)s\nso we can create rules that deny other user except cloud_admin to grant cloud_admin role","commit_id":"b032ca49307f32f2c58e8358a0b7a6697f392110"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"95b4213e1b1808369b539171b9f5d4e8cd685629","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    \"role_service\": \"role:admin or role:service\","},{"line_number":5,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"    \"project_scoped\":\"scope:domain\","},{"line_number":8,"context_line":"    \"domain_matches\":\"domain_id:%(domain_id)s\","},{"line_number":9,"context_line":"    \"domain_admin\": \"(role:admin and rule:domain_matches and rule:domain_scoped)\","},{"line_number":10,"context_line":"    \"admin_or_owner\": \"(role:admin and domain_id:%(target.token.user.domain.id)s) or rule:owner\","}],"source_content_type":"application/json","patch_set":21,"id":"3a961159_a233aa12","line":7,"updated":"2014-12-10 22:38:34.000000000","message":"scope:project","commit_id":"b032ca49307f32f2c58e8358a0b7a6697f392110"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"32eaaac68680c369fcf0d256e45729502f6482dc","unresolved":false,"context_lines":[{"line_number":6,"context_line":"    \"request_domain_matches\" : \"domain_id:%(project.domain_id)s or rule:identity_domain_matches\","},{"line_number":7,"context_line":"    \"target_domain_matches\":   \"domain_id:%(target.member.domain_id)s\","},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"    \"domain_matches\": \"domain_id:%(domain_id)s or (rule:target_domain_matches  or rule:request_domain_matches) \","},{"line_number":10,"context_line":"    \"project_matches\": \"project_id:%(project_id)s or project_id:%(target.member.project_id)s \","},{"line_number":11,"context_line":" "},{"line_number":12,"context_line":"    \"domain_admin\"                               : \"(role:admin and rule:domain_matches and scope:domain) or rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":25,"id":"3a961159_7e3624b6","line":9,"updated":"2014-12-16 11:17:07.000000000","message":"As per henry-nash\u0027s comment in the first patchset:\n\n\"There is a reason the existing v3policy sample doesn\u0027t simplify the rules this way for all these APIs - that is to ensure we are testing the exact place for (in this case domain). For instance, you don\u0027t want to be checking for whether domain is specified in a filter when doing create...it opens up routes for security exploitation\"\n\nIsn\u0027t these types of rules the same case?","commit_id":"85ab4802eaf2870872d956a9116ee38997b2ee63"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"73fa5e8b52a7104e240137ca4be601e3fe35aa59","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    \"service_or_admin\": \"\","},{"line_number":23,"context_line":"    \"admin_or_owner\": \"\","},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"    \"domain_matches\": \"rule:user_domain_matches or rule:group_domain_matches or rule:project_domain_matches or rule:scope_domain_matches or rule:target_domain_matches or rule:domain_id_matches or rule:target_user_domain_matches\","},{"line_number":26,"context_line":"    \"project_matches\": \"rule:target_project_matches or rule:scope_project_matches or rule:project_id_matches\","},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    \"domain_admin\": \"(rule:role_admin and rule:domain_matches and scope:domain) or rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":29,"id":"1a930d6b_78db911b","line":25,"updated":"2015-01-21 16:49:22.000000000","message":"see my main comment on the review for this line...","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d7ef99106ffa8c31e2bdd810390293f16f039b53","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    \"service_or_admin\": \"\","},{"line_number":23,"context_line":"    \"admin_or_owner\": \"\","},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"    \"domain_matches\": \"rule:user_domain_matches or rule:group_domain_matches or rule:project_domain_matches or rule:scope_domain_matches or rule:target_domain_matches or rule:domain_id_matches or rule:target_user_domain_matches\","},{"line_number":26,"context_line":"    \"project_matches\": \"rule:target_project_matches or rule:scope_project_matches or rule:project_id_matches\","},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    \"domain_admin\": \"(rule:role_admin and rule:domain_matches and scope:domain) or rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":29,"id":"1a930d6b_f80ce196","line":25,"in_reply_to":"1a930d6b_78db911b","updated":"2015-01-21 16:50:56.000000000","message":"this was something that I\u0027ve cited several times in previous patchsets (after your comments in some review that were doing the same)","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"cad7547a6e0abfd6e345417b85de482f796533a7","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    \"service_or_admin\": \"\","},{"line_number":23,"context_line":"    \"admin_or_owner\": \"\","},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"    \"domain_matches\": \"rule:user_domain_matches or rule:group_domain_matches or rule:project_domain_matches or rule:scope_domain_matches or rule:target_domain_matches or rule:domain_id_matches or rule:target_user_domain_matches\","},{"line_number":26,"context_line":"    \"project_matches\": \"rule:target_project_matches or rule:scope_project_matches or rule:project_id_matches\","},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    \"domain_admin\": \"(rule:role_admin and rule:domain_matches and scope:domain) or rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":29,"id":"1a930d6b_a17113e2","line":25,"in_reply_to":"1a930d6b_f80ce196","updated":"2015-01-22 22:04:54.000000000","message":"Had a discussion with Henry.  We are going to do an extension to the policy mechanism that allows for rules of this type:  all of the enumerated values must either match or be Missing in order for the rule to pass.  Will then use that mechanism here.","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"f29aa3a883fd4eaed72ab208f6e7e1f2aa6694bd","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    \"domain_matches\": \"rule:user_domain_matches or rule:group_domain_matches or rule:project_domain_matches or rule:scope_domain_matches or rule:target_domain_matches or rule:domain_id_matches or rule:target_user_domain_matches\","},{"line_number":26,"context_line":"    \"project_matches\": \"rule:target_project_matches or rule:scope_project_matches or rule:project_id_matches\","},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    \"domain_admin\": \"(rule:role_admin and rule:domain_matches and scope:domain) or rule:cloud_admin\","},{"line_number":29,"context_line":"    \"owner\": \"( user_id:%(user_id)s or user_id:%(target.token.user_id)s ) or rule:domain_admin\","},{"line_number":30,"context_line":"    \"project_admin\": \"(rule:role_admin and rule:project_matches) or rule:domain_admin\","},{"line_number":31,"context_line":""}],"source_content_type":"application/json","patch_set":29,"id":"3a961159_478c4d2f","line":28,"updated":"2015-01-09 21:12:58.000000000","message":"Bit misleading. It is really domain_admin or cloud_admin  Can we make this explicit?","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"77658a8a955c3fc32248f53fa17b2c5508c3e9cc","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    \"domain_matches\": \"rule:user_domain_matches or rule:group_domain_matches or rule:project_domain_matches or rule:scope_domain_matches or rule:target_domain_matches or rule:domain_id_matches or rule:target_user_domain_matches\","},{"line_number":26,"context_line":"    \"project_matches\": \"rule:target_project_matches or rule:scope_project_matches or rule:project_id_matches\","},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    \"domain_admin\": \"(rule:role_admin and rule:domain_matches and scope:domain) or rule:cloud_admin\","},{"line_number":29,"context_line":"    \"owner\": \"( user_id:%(user_id)s or user_id:%(target.token.user_id)s ) or rule:domain_admin\","},{"line_number":30,"context_line":"    \"project_admin\": \"(rule:role_admin and rule:project_matches) or rule:domain_admin\","},{"line_number":31,"context_line":""}],"source_content_type":"application/json","patch_set":29,"id":"1a930d6b_957e48ad","line":28,"updated":"2015-01-21 16:35:05.000000000","message":"is scope:\u003cx\u003e a new capability in our policy engine (or maybe it was always there and I never knew it!)?","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"cad7547a6e0abfd6e345417b85de482f796533a7","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    \"domain_matches\": \"rule:user_domain_matches or rule:group_domain_matches or rule:project_domain_matches or rule:scope_domain_matches or rule:target_domain_matches or rule:domain_id_matches or rule:target_user_domain_matches\","},{"line_number":26,"context_line":"    \"project_matches\": \"rule:target_project_matches or rule:scope_project_matches or rule:project_id_matches\","},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    \"domain_admin\": \"(rule:role_admin and rule:domain_matches and scope:domain) or rule:cloud_admin\","},{"line_number":29,"context_line":"    \"owner\": \"( user_id:%(user_id)s or user_id:%(target.token.user_id)s ) or rule:domain_admin\","},{"line_number":30,"context_line":"    \"project_admin\": \"(rule:role_admin and rule:project_matches) or rule:domain_admin\","},{"line_number":31,"context_line":""}],"source_content_type":"application/json","patch_set":29,"id":"1a930d6b_a1483388","line":28,"in_reply_to":"1a930d6b_957e48ad","updated":"2015-01-22 22:04:54.000000000","message":"I think I might have added it in a dropped patch.  Again, I\u0027ll make sure it gets into the policy engine if it is not there yet.","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"84d684e33cba61272c45c0cb43d5efcd28098d99","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    \"domain_matches\": \"rule:user_domain_matches or rule:group_domain_matches or rule:project_domain_matches or rule:scope_domain_matches or rule:target_domain_matches or rule:domain_id_matches or rule:target_user_domain_matches\","},{"line_number":26,"context_line":"    \"project_matches\": \"rule:target_project_matches or rule:scope_project_matches or rule:project_id_matches\","},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    \"domain_admin\": \"(rule:role_admin and rule:domain_matches and scope:domain) or rule:cloud_admin\","},{"line_number":29,"context_line":"    \"owner\": \"( user_id:%(user_id)s or user_id:%(target.token.user_id)s ) or rule:domain_admin\","},{"line_number":30,"context_line":"    \"project_admin\": \"(rule:role_admin and rule:project_matches) or rule:domain_admin\","},{"line_number":31,"context_line":""}],"source_content_type":"application/json","patch_set":29,"id":"3a961159_2de882b2","line":28,"in_reply_to":"3a961159_478c4d2f","updated":"2015-01-14 19:42:19.000000000","message":"The idea is that roles are collected upwards.  So cloud_admin is going to get the power to do things over domains.  We can work harder to split these out WRT to the reseller use case as we understand it better.","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"f29aa3a883fd4eaed72ab208f6e7e1f2aa6694bd","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    \"identity:get_project\": \"rule:domain_admin\","},{"line_number":60,"context_line":"    \"identity:list_projects\": \"rule:domain_admin\","},{"line_number":61,"context_line":"    \"identity:list_user_projects\": \"rule:owner\","},{"line_number":62,"context_line":"    \"identity:create_project\": \"rule:domain_admin\","},{"line_number":63,"context_line":"    \"identity:update_project\": \"rule:domain_admin\","},{"line_number":64,"context_line":"    \"identity:delete_project\": \"rule:domain_admin\","}],"source_content_type":"application/json","patch_set":29,"id":"3a961159_47b36dec","line":61,"updated":"2015-01-09 21:12:58.000000000","message":"IMO It should be owner or domain_admin or cloud_admin","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"84d684e33cba61272c45c0cb43d5efcd28098d99","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    \"identity:get_project\": \"rule:domain_admin\","},{"line_number":60,"context_line":"    \"identity:list_projects\": \"rule:domain_admin\","},{"line_number":61,"context_line":"    \"identity:list_user_projects\": \"rule:owner\","},{"line_number":62,"context_line":"    \"identity:create_project\": \"rule:domain_admin\","},{"line_number":63,"context_line":"    \"identity:update_project\": \"rule:domain_admin\","},{"line_number":64,"context_line":"    \"identity:delete_project\": \"rule:domain_admin\","}],"source_content_type":"application/json","patch_set":29,"id":"3a961159_4d3eae2a","line":61,"in_reply_to":"3a961159_47b36dec","updated":"2015-01-14 19:42:19.000000000","message":"The idea is that we specify the lowest level, and then let the roles inherit. upwards.  We should not be managing that fine-tuned on individual API calls, but rather working at the role level.\n\nThe explicit names as codifications of the logic is not a good pattern.  Better to make the individual lines simple to maintain, and then work on refining the reusable rules.","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"f29aa3a883fd4eaed72ab208f6e7e1f2aa6694bd","unresolved":false,"context_lines":[{"line_number":102,"context_line":"    \"identity:create_grant\": \"rule:project_admin\","},{"line_number":103,"context_line":"    \"identity:revoke_grant\": \"rule:project_admin\","},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    \"identity:list_role_assignments\": \"rule:domain_admin or rule:project_admin\","},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    \"identity:get_policy\"   : \"rule:cloud_admin\","},{"line_number":108,"context_line":"    \"identity:list_policies\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":29,"id":"3a961159_e7f1b997","line":105,"updated":"2015-01-09 21:12:58.000000000","message":"By looking at the rule it reads as if cloud_admin can\u0027t do list_role_assignments.   So my earlier comment is valid here, remove cloud_admin rule from domain_admin and create one more rule clodu_admin_or_domain_admin","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"84d684e33cba61272c45c0cb43d5efcd28098d99","unresolved":false,"context_lines":[{"line_number":102,"context_line":"    \"identity:create_grant\": \"rule:project_admin\","},{"line_number":103,"context_line":"    \"identity:revoke_grant\": \"rule:project_admin\","},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    \"identity:list_role_assignments\": \"rule:domain_admin or rule:project_admin\","},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    \"identity:get_policy\"   : \"rule:cloud_admin\","},{"line_number":108,"context_line":"    \"identity:list_policies\": \"rule:cloud_admin\","}],"source_content_type":"application/json","patch_set":29,"id":"3a961159_4d25ce08","line":105,"in_reply_to":"3a961159_e7f1b997","updated":"2015-01-14 19:42:19.000000000","message":"We don\u0027t wan\u0027t the Or in the rule names.  That makes them 1-to-1 with the logic.  rather to have the rule name site the intention, and then fine tune the intention.","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"f29aa3a883fd4eaed72ab208f6e7e1f2aa6694bd","unresolved":false,"context_lines":[{"line_number":115,"context_line":"    \"identity:validate_token\": \"rule:role_service\","},{"line_number":116,"context_line":"    \"identity:validate_token_head\": \"rule:role_service\","},{"line_number":117,"context_line":"    \"identity:revocation_list\": \"rule:role_service\","},{"line_number":118,"context_line":"    \"identity:revoke_token\": \"rule:owner\","},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    \"identity:create_trust\": \"user_id:%(trust.trustor_user_id)s\","},{"line_number":121,"context_line":"    \"identity:get_trust\": \"rule:owner\","}],"source_content_type":"application/json","patch_set":29,"id":"3a961159_0746c5c0","line":118,"updated":"2015-01-09 21:12:58.000000000","message":"Admin should be able to revoke the token","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"84d684e33cba61272c45c0cb43d5efcd28098d99","unresolved":false,"context_lines":[{"line_number":115,"context_line":"    \"identity:validate_token\": \"rule:role_service\","},{"line_number":116,"context_line":"    \"identity:validate_token_head\": \"rule:role_service\","},{"line_number":117,"context_line":"    \"identity:revocation_list\": \"rule:role_service\","},{"line_number":118,"context_line":"    \"identity:revoke_token\": \"rule:owner\","},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    \"identity:create_trust\": \"user_id:%(trust.trustor_user_id)s\","},{"line_number":121,"context_line":"    \"identity:get_trust\": \"rule:owner\","}],"source_content_type":"application/json","patch_set":29,"id":"3a961159_0d7f46e0","line":118,"in_reply_to":"3a961159_0746c5c0","updated":"2015-01-14 19:42:19.000000000","message":"the term \"admin\" is so overloaded as to be useless.  In general, a rule should state the lowest level of who can perform something,  not all of the variations.","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"f29aa3a883fd4eaed72ab208f6e7e1f2aa6694bd","unresolved":false,"context_lines":[{"line_number":125,"context_line":"    \"identity:get_role_for_trust\": \"\","},{"line_number":126,"context_line":"    \"identity:delete_trust\": \"\","},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"    \"identity:create_consumer\": \"rule:role_admin\","},{"line_number":129,"context_line":"    \"identity:get_consumer\": \"rule:role_admin\","},{"line_number":130,"context_line":"    \"identity:list_consumers\": \"rule:role_admin\","},{"line_number":131,"context_line":"    \"identity:delete_consumer\": \"rule:role_admin\","}],"source_content_type":"application/json","patch_set":29,"id":"3a961159_677b09f5","line":128,"updated":"2015-01-09 21:12:58.000000000","message":"Why do we  use just rule instead of domain_admin or cloud_admin? Is it  to allow both project and domain scoped token?","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"84d684e33cba61272c45c0cb43d5efcd28098d99","unresolved":false,"context_lines":[{"line_number":125,"context_line":"    \"identity:get_role_for_trust\": \"\","},{"line_number":126,"context_line":"    \"identity:delete_trust\": \"\","},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"    \"identity:create_consumer\": \"rule:role_admin\","},{"line_number":129,"context_line":"    \"identity:get_consumer\": \"rule:role_admin\","},{"line_number":130,"context_line":"    \"identity:list_consumers\": \"rule:role_admin\","},{"line_number":131,"context_line":"    \"identity:delete_consumer\": \"rule:role_admin\","}],"source_content_type":"application/json","patch_set":29,"id":"3a961159_ed64ba4a","line":128,"in_reply_to":"3a961159_677b09f5","updated":"2015-01-14 19:42:19.000000000","message":"preparing for hierarchical roles","commit_id":"9ea405040f201cc11e1f97bb1739a75fdaf813e8"}],"keystone/openstack/common/policy.py":[{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"95b4213e1b1808369b539171b9f5d4e8cd685629","unresolved":false,"context_lines":[{"line_number":460,"context_line":""},{"line_number":461,"context_line":"        Requires that all rules accept in order to return True."},{"line_number":462,"context_line":"        \"\"\""},{"line_number":463,"context_line":"        import pdb; pdb.set_trace()"},{"line_number":464,"context_line":"        try:"},{"line_number":465,"context_line":"            for rule in self.rules:"},{"line_number":466,"context_line":"                if not rule(target, cred, enforcer):"}],"source_content_type":"text/x-python","patch_set":21,"id":"3a961159_85187876","line":463,"updated":"2014-12-10 22:38:34.000000000","message":"delete","commit_id":"b032ca49307f32f2c58e8358a0b7a6697f392110"}],"keystone/tests/test_policy.py":[{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"8165dd3b0fe5dc0f67a5875276e09d6604fdbed2","unresolved":false,"context_lines":[{"line_number":215,"context_line":""},{"line_number":216,"context_line":"        diffs \u003d set(policy_keys).difference(set(cloud_policy_keys))"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"        # Since v3 sample policy are supossed to work with 3 levels of admins:"},{"line_number":219,"context_line":"        # Cloud admin, Domain admin and Project admin, some rules needed to be"},{"line_number":220,"context_line":"        # chenged."},{"line_number":221,"context_line":"        # service_or_admin is now service_or_cloud_admin"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_adae5d83","line":218,"updated":"2014-11-06 00:31:15.000000000","message":"s/supossed/supposed","commit_id":"4f3f0d809e9fe237e84de9e03f0733efed67ca06"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"21952db21d7348181ecacee9fe8eb085a6933ff8","unresolved":false,"context_lines":[{"line_number":215,"context_line":""},{"line_number":216,"context_line":"        diffs \u003d set(policy_keys).difference(set(cloud_policy_keys))"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"        # Since v3 sample policy are supossed to work with 3 levels of admins:"},{"line_number":219,"context_line":"        # Cloud admin, Domain admin and Project admin, some rules needed to be"},{"line_number":220,"context_line":"        # chenged."},{"line_number":221,"context_line":"        # service_or_admin is now service_or_cloud_admin"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_146f75fe","line":218,"in_reply_to":"7a8c0949_adae5d83","updated":"2014-11-06 13:57:24.000000000","message":"Done","commit_id":"4f3f0d809e9fe237e84de9e03f0733efed67ca06"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"8165dd3b0fe5dc0f67a5875276e09d6604fdbed2","unresolved":false,"context_lines":[{"line_number":217,"context_line":""},{"line_number":218,"context_line":"        # Since v3 sample policy are supossed to work with 3 levels of admins:"},{"line_number":219,"context_line":"        # Cloud admin, Domain admin and Project admin, some rules needed to be"},{"line_number":220,"context_line":"        # chenged."},{"line_number":221,"context_line":"        # service_or_admin is now service_or_cloud_admin"},{"line_number":222,"context_line":"        # admin_or_owner is now cloud_admin_or_owner"},{"line_number":223,"context_line":"        chenged_rules \u003d set([u\u0027service_or_admin\u0027, u\u0027admin_or_owner\u0027])"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_0dbbf1c4","line":220,"updated":"2014-11-06 00:31:15.000000000","message":"s/chenged/changed","commit_id":"4f3f0d809e9fe237e84de9e03f0733efed67ca06"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"21952db21d7348181ecacee9fe8eb085a6933ff8","unresolved":false,"context_lines":[{"line_number":217,"context_line":""},{"line_number":218,"context_line":"        # Since v3 sample policy are supossed to work with 3 levels of admins:"},{"line_number":219,"context_line":"        # Cloud admin, Domain admin and Project admin, some rules needed to be"},{"line_number":220,"context_line":"        # chenged."},{"line_number":221,"context_line":"        # service_or_admin is now service_or_cloud_admin"},{"line_number":222,"context_line":"        # admin_or_owner is now cloud_admin_or_owner"},{"line_number":223,"context_line":"        chenged_rules \u003d set([u\u0027service_or_admin\u0027, u\u0027admin_or_owner\u0027])"}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_f4674923","line":220,"in_reply_to":"7a8c0949_0dbbf1c4","updated":"2014-11-06 13:57:24.000000000","message":"Done","commit_id":"4f3f0d809e9fe237e84de9e03f0733efed67ca06"}],"keystone/tests/test_v3.py":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"0858436cf8fa82d06c7b8924e1789ff65c93846b","unresolved":false,"context_lines":[{"line_number":207,"context_line":""},{"line_number":208,"context_line":"        return self.assignment_api.create_role(role[\u0027id\u0027], role)"},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"    def create_project(self, domain_id\u003dNone):"},{"line_number":211,"context_line":"        project \u003d self.new_project_ref(domain_id\u003ddomain_id)"},{"line_number":212,"context_line":"        return self.assignment_api.create_project(project[\u0027id\u0027], project)"},{"line_number":213,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_34cf11b2","line":210,"updated":"2014-11-06 11:42:20.000000000","message":"This, and other several changes are not related to this patch.","commit_id":"4f3f0d809e9fe237e84de9e03f0733efed67ca06"},{"author":{"_account_id":10765,"name":"Andre Aranha","email":"afaranha@lsd.ufcg.edu.br","username":"afaranha"},"change_message_id":"21952db21d7348181ecacee9fe8eb085a6933ff8","unresolved":false,"context_lines":[{"line_number":207,"context_line":""},{"line_number":208,"context_line":"        return self.assignment_api.create_role(role[\u0027id\u0027], role)"},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"    def create_project(self, domain_id\u003dNone):"},{"line_number":211,"context_line":"        project \u003d self.new_project_ref(domain_id\u003ddomain_id)"},{"line_number":212,"context_line":"        return self.assignment_api.create_project(project[\u0027id\u0027], project)"},{"line_number":213,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"7a8c0949_e52dd147","line":210,"in_reply_to":"7a8c0949_34cf11b2","updated":"2014-11-06 13:57:24.000000000","message":"Done","commit_id":"4f3f0d809e9fe237e84de9e03f0733efed67ca06"}]}