)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"fc35d04366bf7baa5e43867379141efdfacc677b","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Brant Knudson \u003cbknudson@us.ibm.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2015-03-01 19:18:36 -0600"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Fix sample policy allows user to revoke or check own token"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The sample policy file wouldn\u0027t allow a user to revoke or check"},{"line_number":10,"context_line":"their own token."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"9a80dd14_e33b56e9","line":7,"updated":"2015-03-04 19:10:55.000000000","message":"NIT: \"Fix sample policy to allow a user....\"?","commit_id":"9caad4c39f207a98cb40aa160c1872eb7e597d9c"}],"etc/policy.json":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e4bf7a373655db86df849644323d32afa9268c4e","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    \"identity:validate_token\": \"rule:service_admin_or_token_subject\","},{"line_number":94,"context_line":"    \"identity:validate_token_head\": \"rule:service_or_admin\","},{"line_number":95,"context_line":"    \"identity:revocation_list\": \"rule:service_or_admin\","},{"line_number":96,"context_line":"    \"identity:revoke_token\": \"rule:admin_or_token_subject\","},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"    \"identity:create_trust\": \"user_id:%(trust.trustor_user_id)s\","},{"line_number":99,"context_line":"    \"identity:get_trust\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_d84ee795","line":96,"updated":"2015-02-24 07:45:19.000000000","message":"don\u0027t think this is going to work, see\n\nhttps://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L450","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d66bd1994ea7ff478021e347d3f237d11a62f6bb","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    \"identity:validate_token\": \"rule:service_admin_or_token_subject\","},{"line_number":94,"context_line":"    \"identity:validate_token_head\": \"rule:service_or_admin\","},{"line_number":95,"context_line":"    \"identity:revocation_list\": \"rule:service_or_admin\","},{"line_number":96,"context_line":"    \"identity:revoke_token\": \"rule:admin_or_token_subject\","},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"    \"identity:create_trust\": \"user_id:%(trust.trustor_user_id)s\","},{"line_number":99,"context_line":"    \"identity:get_trust\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_dc9c4260","line":96,"in_reply_to":"ba7be1f8_d84ee795","updated":"2015-03-02 00:43:35.000000000","message":"gyee - this is a link to a v2 controller, so policy doesn\u0027t apply there.","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"f9c2898e7b20eae71a6f0c597b019d0c670f0ec7","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    \"identity:delete_policy\": \"rule:admin_required\","},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    \"identity:check_token\": \"rule:admin_or_token_subject\","},{"line_number":93,"context_line":"    \"identity:validate_token\": \"rule:service_admin_or_token_subject\","},{"line_number":94,"context_line":"    \"identity:validate_token_head\": \"rule:service_or_admin\","},{"line_number":95,"context_line":"    \"identity:revocation_list\": \"rule:service_or_admin\","},{"line_number":96,"context_line":"    \"identity:revoke_token\": \"rule:admin_or_token_subject\","}],"source_content_type":"application/json","patch_set":6,"id":"9a80dd14_2014a59e","line":93,"updated":"2015-03-16 16:44:56.000000000","message":"I\u0027m not sure about validation. I think it was done intentionally. If some one gets your token, by doing validation they can get more information about the user from that token. To avoid this token validation  was intentionally  restricted to  service and admin","commit_id":"5ba3b683691a523b95d3b04cee9f0be4968a4ecd"}],"etc/policy.v3cloudsample.json":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e4bf7a373655db86df849644323d32afa9268c4e","unresolved":false,"context_lines":[{"line_number":3,"context_line":"    \"cloud_admin\": \"rule:admin_required and domain_id:admin_domain_id\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","},{"line_number":7,"context_line":"    \"admin_or_owner\": \"(rule:admin_required and domain_id:%(target.token.user.domain.id)s) or rule:owner\","},{"line_number":8,"context_line":"    \"admin_or_cloud_admin\": \"rule:admin_required or rule:cloud_admin\","},{"line_number":9,"context_line":"    \"admin_and_matching_domain_id\": \"rule:admin_required and domain_id:%(domain_id)s\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_f89acb61","side":"PARENT","line":6,"updated":"2015-02-24 07:45:19.000000000","message":"why are you changing the definition of owner?","commit_id":"4a5b0fb34ed26fa52383ab87bd3856ee6ba24273"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c0091c7f3fb71f85ac49627fde56d491ddd167f3","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s\","},{"line_number":7,"context_line":"    \"admin_and_token_domain\": \"rule:admin_required and domain_id:%(target.token.user.domain.id)s\","},{"line_number":8,"context_line":"    \"admin_or_owner\": \"rule:admin_and_token_domain or rule:owner\","},{"line_number":9,"context_line":"    \"admin_or_cloud_admin\": \"rule:admin_required or rule:cloud_admin\","},{"line_number":10,"context_line":"    \"admin_and_matching_domain_id\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":11,"context_line":"    \"token_subject\": \"user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_2781a64a","line":8,"updated":"2015-02-24 04:54:36.000000000","message":"this changes the definition of the admin..  admin that have cross domain role assignment would be broken by this","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d66bd1994ea7ff478021e347d3f237d11a62f6bb","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s\","},{"line_number":7,"context_line":"    \"admin_and_token_domain\": \"rule:admin_required and domain_id:%(target.token.user.domain.id)s\","},{"line_number":8,"context_line":"    \"admin_or_owner\": \"rule:admin_and_token_domain or rule:owner\","},{"line_number":9,"context_line":"    \"admin_or_cloud_admin\": \"rule:admin_required or rule:cloud_admin\","},{"line_number":10,"context_line":"    \"admin_and_matching_domain_id\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":11,"context_line":"    \"token_subject\": \"user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_494dec71","line":8,"in_reply_to":"ba7be1f8_2781a64a","updated":"2015-03-02 00:43:35.000000000","message":"Done","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e4bf7a373655db86df849644323d32afa9268c4e","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s\","},{"line_number":7,"context_line":"    \"admin_and_token_domain\": \"rule:admin_required and domain_id:%(target.token.user.domain.id)s\","},{"line_number":8,"context_line":"    \"admin_or_owner\": \"rule:admin_and_token_domain or rule:owner\","},{"line_number":9,"context_line":"    \"admin_or_cloud_admin\": \"rule:admin_required or rule:cloud_admin\","},{"line_number":10,"context_line":"    \"admin_and_matching_domain_id\": \"rule:admin_required and domain_id:%(domain_id)s\","},{"line_number":11,"context_line":"    \"token_subject\": \"user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_78c5fb3a","line":8,"in_reply_to":"ba7be1f8_2781a64a","updated":"2015-02-24 07:45:19.000000000","message":"its the changing the definition of \u0027owner\u0027 that worries me","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e4bf7a373655db86df849644323d32afa9268c4e","unresolved":false,"context_lines":[{"line_number":103,"context_line":"    \"identity:delete_policy\": \"rule:cloud_admin\","},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    \"identity:change_password\": \"rule:owner\","},{"line_number":106,"context_line":"    \"identity:check_token\": \"rule:admin_or_token_subject\","},{"line_number":107,"context_line":"    \"identity:validate_token\": \"rule:service_admin_or_token_subject\","},{"line_number":108,"context_line":"    \"identity:validate_token_head\": \"rule:service_or_admin\","},{"line_number":109,"context_line":"    \"identity:revocation_list\": \"rule:service_or_admin\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_38dc63e4","line":106,"updated":"2015-02-24 07:45:19.000000000","message":"the original admin_or_owner should work fine. No need for this change.","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d66bd1994ea7ff478021e347d3f237d11a62f6bb","unresolved":false,"context_lines":[{"line_number":103,"context_line":"    \"identity:delete_policy\": \"rule:cloud_admin\","},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    \"identity:change_password\": \"rule:owner\","},{"line_number":106,"context_line":"    \"identity:check_token\": \"rule:admin_or_token_subject\","},{"line_number":107,"context_line":"    \"identity:validate_token\": \"rule:service_admin_or_token_subject\","},{"line_number":108,"context_line":"    \"identity:validate_token_head\": \"rule:service_or_admin\","},{"line_number":109,"context_line":"    \"identity:revocation_list\": \"rule:service_or_admin\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_6950f00a","line":106,"in_reply_to":"ba7be1f8_38dc63e4","updated":"2015-03-02 00:43:35.000000000","message":"Done","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c0091c7f3fb71f85ac49627fde56d491ddd167f3","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    \"identity:change_password\": \"rule:owner\","},{"line_number":106,"context_line":"    \"identity:check_token\": \"rule:admin_or_token_subject\","},{"line_number":107,"context_line":"    \"identity:validate_token\": \"rule:service_admin_or_token_subject\","},{"line_number":108,"context_line":"    \"identity:validate_token_head\": \"rule:service_or_admin\","},{"line_number":109,"context_line":"    \"identity:revocation_list\": \"rule:service_or_admin\","},{"line_number":110,"context_line":"    \"identity:revoke_token\": \"rule:admin_or_token_subject\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_275c4625","line":107,"updated":"2015-02-24 04:54:36.000000000","message":"Not related to your change, but do you know why is check_token more restrictive than validate_token? \n\nvalidate_token returns the catalog in the response, so I would thought this should be more restrictive. I wonder if we got the policy defined the other way around?","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e4bf7a373655db86df849644323d32afa9268c4e","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    \"identity:change_password\": \"rule:owner\","},{"line_number":106,"context_line":"    \"identity:check_token\": \"rule:admin_or_token_subject\","},{"line_number":107,"context_line":"    \"identity:validate_token\": \"rule:service_admin_or_token_subject\","},{"line_number":108,"context_line":"    \"identity:validate_token_head\": \"rule:service_or_admin\","},{"line_number":109,"context_line":"    \"identity:revocation_list\": \"rule:service_or_admin\","},{"line_number":110,"context_line":"    \"identity:revoke_token\": \"rule:admin_or_token_subject\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_f8e9eb80","line":107,"updated":"2015-02-24 07:45:19.000000000","message":"service_or_admin or owner","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d66bd1994ea7ff478021e347d3f237d11a62f6bb","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    \"identity:change_password\": \"rule:owner\","},{"line_number":106,"context_line":"    \"identity:check_token\": \"rule:admin_or_token_subject\","},{"line_number":107,"context_line":"    \"identity:validate_token\": \"rule:service_admin_or_token_subject\","},{"line_number":108,"context_line":"    \"identity:validate_token_head\": \"rule:service_or_admin\","},{"line_number":109,"context_line":"    \"identity:revocation_list\": \"rule:service_or_admin\","},{"line_number":110,"context_line":"    \"identity:revoke_token\": \"rule:admin_or_token_subject\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_8957e401","line":107,"in_reply_to":"ba7be1f8_f8e9eb80","updated":"2015-03-02 00:43:35.000000000","message":"Done","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e4bf7a373655db86df849644323d32afa9268c4e","unresolved":false,"context_lines":[{"line_number":107,"context_line":"    \"identity:validate_token\": \"rule:service_admin_or_token_subject\","},{"line_number":108,"context_line":"    \"identity:validate_token_head\": \"rule:service_or_admin\","},{"line_number":109,"context_line":"    \"identity:revocation_list\": \"rule:service_or_admin\","},{"line_number":110,"context_line":"    \"identity:revoke_token\": \"rule:admin_or_token_subject\","},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"    \"identity:create_trust\": \"user_id:%(trust.trustor_user_id)s\","},{"line_number":113,"context_line":"    \"identity:get_trust\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_78e6dbb5","line":110,"updated":"2015-02-24 07:45:19.000000000","message":"same as above","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d66bd1994ea7ff478021e347d3f237d11a62f6bb","unresolved":false,"context_lines":[{"line_number":107,"context_line":"    \"identity:validate_token\": \"rule:service_admin_or_token_subject\","},{"line_number":108,"context_line":"    \"identity:validate_token_head\": \"rule:service_or_admin\","},{"line_number":109,"context_line":"    \"identity:revocation_list\": \"rule:service_or_admin\","},{"line_number":110,"context_line":"    \"identity:revoke_token\": \"rule:admin_or_token_subject\","},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"    \"identity:create_trust\": \"user_id:%(trust.trustor_user_id)s\","},{"line_number":113,"context_line":"    \"identity:get_trust\": \"rule:admin_or_owner\","}],"source_content_type":"application/json","patch_set":2,"id":"ba7be1f8_a95ae827","line":110,"in_reply_to":"ba7be1f8_78e6dbb5","updated":"2015-03-02 00:43:35.000000000","message":"Done","commit_id":"06df65f6fce9561a92571b57216d0cb0ec1085ed"}]}