)]}'
{"doc/source/configuration.rst":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"31abf0de8f2c9b1e0463848219d5b9f2def236cf","unresolved":false,"context_lines":[{"line_number":934,"context_line":"The policy rules in the JSON policy file are not able to override these"},{"line_number":935,"context_line":"hard-coded authorization restrictions, though the policy rules can make these"},{"line_number":936,"context_line":"API calls more restricted. An example of this behavior is the trust extension,"},{"line_number":937,"context_line":"where most API calls have hard-coded restrictions."},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"If an API is not specified in the JSON policy file, a special default rule is"},{"line_number":940,"context_line":"applied for that API call.  For more details, see the rule statements section"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da9df570_089e6556","line":937,"updated":"2014-09-24 23:38:34.000000000","message":"maybe in this comment, it should be clear that hard-coded checks isn\u0027t a desired behaviour in most cases?","commit_id":"6d1c1319f12df66b3d638a65253e7fa6afaaaafb"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"6906c9fcb0c5aeca5a7e32b47f781b1cb0ced9bd","unresolved":false,"context_lines":[{"line_number":934,"context_line":"The policy rules in the JSON policy file are not able to override these"},{"line_number":935,"context_line":"hard-coded authorization restrictions, though the policy rules can make these"},{"line_number":936,"context_line":"API calls more restricted. An example of this behavior is the trust extension,"},{"line_number":937,"context_line":"where most API calls have hard-coded restrictions."},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"If an API is not specified in the JSON policy file, a special default rule is"},{"line_number":940,"context_line":"applied for that API call.  For more details, see the rule statements section"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da9df570_908b5267","line":937,"in_reply_to":"da9df570_088825e6","updated":"2014-09-25 12:07:08.000000000","message":"Thanks for your reply, now I understand... My only concern is about hard-coded checks that shouldn\u0027t be there and are actually bugs. This is more common at other components, though.","commit_id":"6d1c1319f12df66b3d638a65253e7fa6afaaaafb"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"0e827599f7614cac5963a9031b19a4add3b1f487","unresolved":false,"context_lines":[{"line_number":934,"context_line":"The policy rules in the JSON policy file are not able to override these"},{"line_number":935,"context_line":"hard-coded authorization restrictions, though the policy rules can make these"},{"line_number":936,"context_line":"API calls more restricted. An example of this behavior is the trust extension,"},{"line_number":937,"context_line":"where most API calls have hard-coded restrictions."},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"If an API is not specified in the JSON policy file, a special default rule is"},{"line_number":940,"context_line":"applied for that API call.  For more details, see the rule statements section"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da9df570_088825e6","line":937,"in_reply_to":"da9df570_089e6556","updated":"2014-09-24 23:49:37.000000000","message":"I initially had the same reaction, but it arguably is desired to have hard-coded restrictions in some cases.  The hard-coded restrictions prevent one from making a mistake in the policy file that opens up access to something that should never be authorized.\n\nThe way that Keystone is coded is that the policy can always make an option more strict, but it will not be allowed to relax a hard-coded policy.  This might be limiting from a usability standpoint, but it is a \"belt and suspenders\" sort of approach from a security standpoint (which is a good thing).","commit_id":"6d1c1319f12df66b3d638a65253e7fa6afaaaafb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6dcdeff60e79ce1fd73744be2651842e595d0512","unresolved":false,"context_lines":[{"line_number":1052,"context_line":""},{"line_number":1053,"context_line":"A ``\u003crule reference\u003e`` is a reference to a defined rule in the JSON policy file."},{"line_number":1054,"context_line":"A rule allows for easy reuse of a ``\u003cmatch statement\u003e`` across multiple API"},{"line_number":1055,"context_line":"calls.  A ``\u003crule reference\u003e`` takes the form of:"},{"line_number":1056,"context_line":""},{"line_number":1057,"context_line":"    rule: \u003crule name\u003e"},{"line_number":1058,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baa201ad_33d87253","line":1055,"updated":"2014-09-29 02:07:52.000000000","message":"add another : to the end here","commit_id":"f746ad53c14fdeb4eb7d172555971901e82a81d5"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"573dfff6f889cdd0a4fca44ba17d66206c2e0e2b","unresolved":false,"context_lines":[{"line_number":1052,"context_line":""},{"line_number":1053,"context_line":"A ``\u003crule reference\u003e`` is a reference to a defined rule in the JSON policy file."},{"line_number":1054,"context_line":"A rule allows for easy reuse of a ``\u003cmatch statement\u003e`` across multiple API"},{"line_number":1055,"context_line":"calls.  A ``\u003crule reference\u003e`` takes the form of:"},{"line_number":1056,"context_line":""},{"line_number":1057,"context_line":"    rule: \u003crule name\u003e"},{"line_number":1058,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da86d52c_3205d1c2","line":1055,"in_reply_to":"baa201ad_33d87253","updated":"2015-01-31 00:18:42.000000000","message":"Done","commit_id":"f746ad53c14fdeb4eb7d172555971901e82a81d5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6dcdeff60e79ce1fd73744be2651842e595d0512","unresolved":false,"context_lines":[{"line_number":1057,"context_line":"    rule: \u003crule name\u003e"},{"line_number":1058,"context_line":""},{"line_number":1059,"context_line":"A ``\u003crule name\u003e`` is the name of the ``\u003crule statement\u003e`` that is being referred to."},{"line_number":1060,"context_line":"A ``\u003crule statement\u003e`` is of the form:"},{"line_number":1061,"context_line":""},{"line_number":1062,"context_line":"    \u003crule name\u003e: \u003crule reference\u003e or \u003cmatch statement\u003e"},{"line_number":1063,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baa201ad_13d36e39","line":1060,"updated":"2014-09-29 02:07:52.000000000","message":"add another : to the end here, so you get some basic code/syntax highlighting","commit_id":"f746ad53c14fdeb4eb7d172555971901e82a81d5"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"573dfff6f889cdd0a4fca44ba17d66206c2e0e2b","unresolved":false,"context_lines":[{"line_number":1057,"context_line":"    rule: \u003crule name\u003e"},{"line_number":1058,"context_line":""},{"line_number":1059,"context_line":"A ``\u003crule name\u003e`` is the name of the ``\u003crule statement\u003e`` that is being referred to."},{"line_number":1060,"context_line":"A ``\u003crule statement\u003e`` is of the form:"},{"line_number":1061,"context_line":""},{"line_number":1062,"context_line":"    \u003crule name\u003e: \u003crule reference\u003e or \u003cmatch statement\u003e"},{"line_number":1063,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da86d52c_520a45d3","line":1060,"in_reply_to":"baa201ad_13d36e39","updated":"2015-01-31 00:18:42.000000000","message":"Done","commit_id":"f746ad53c14fdeb4eb7d172555971901e82a81d5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6dcdeff60e79ce1fd73744be2651842e595d0512","unresolved":false,"context_lines":[{"line_number":1071,"context_line":"API protection, and does not assume any particular use of domains. For"},{"line_number":1072,"context_line":"multi-domain configuration installations where, for example, a cloud"},{"line_number":1073,"context_line":"provider wishes to allow administration of the contents of a domain to"},{"line_number":1074,"context_line":"be delegated, it is recommended that the supplied policy.v3cloudsample.json"},{"line_number":1075,"context_line":"is used as a basis for creating a suitable production policy file. This"},{"line_number":1076,"context_line":"example policy file also shows the use of an admin_domain to allow a cloud"},{"line_number":1077,"context_line":"provider to enable cloud administrators to have wider access across the APIs."}],"source_content_type":"text/x-rst","patch_set":3,"id":"baa201ad_b31c6215","line":1074,"updated":"2014-09-29 02:07:52.000000000","message":"fwiw, i think it should be ``policy.v3cloudsample.json``","commit_id":"f746ad53c14fdeb4eb7d172555971901e82a81d5"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"573dfff6f889cdd0a4fca44ba17d66206c2e0e2b","unresolved":false,"context_lines":[{"line_number":1071,"context_line":"API protection, and does not assume any particular use of domains. For"},{"line_number":1072,"context_line":"multi-domain configuration installations where, for example, a cloud"},{"line_number":1073,"context_line":"provider wishes to allow administration of the contents of a domain to"},{"line_number":1074,"context_line":"be delegated, it is recommended that the supplied policy.v3cloudsample.json"},{"line_number":1075,"context_line":"is used as a basis for creating a suitable production policy file. This"},{"line_number":1076,"context_line":"example policy file also shows the use of an admin_domain to allow a cloud"},{"line_number":1077,"context_line":"provider to enable cloud administrators to have wider access across the APIs."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da86d52c_9214bdf6","line":1074,"in_reply_to":"baa201ad_b31c6215","updated":"2015-01-31 00:18:42.000000000","message":"Done","commit_id":"f746ad53c14fdeb4eb7d172555971901e82a81d5"}]}