)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"94269b3cc78a09ce8b8c7bb30eb4d293a71983ee","unresolved":false,"context_lines":[{"line_number":13,"context_line":"the service user can do jobs on the requester\u0027s behalf. Restricting"},{"line_number":14,"context_line":"user_list or user_get to only admin users is making this very"},{"line_number":15,"context_line":"cumbersome even impossible."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Change-Id: I14d6bc529a1d484b7b7fa9e0a9466b99957e84a7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7a016987_1aa56203","line":16,"updated":"2015-05-27 15:23:36.000000000","message":"Is this related to a bug or a blueprint?","commit_id":"600fa2627ee848594aafbb91e1207b1fe7f1b0f9"}],"etc/policy.json":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"94269b3cc78a09ce8b8c7bb30eb4d293a71983ee","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    \"identity:delete_project\": \"rule:admin_required\","},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    \"identity:get_user\": \"rule:service_or_admin\","},{"line_number":44,"context_line":"    \"identity:list_users\": \"rule:service_or_admin\","},{"line_number":45,"context_line":"    \"identity:create_user\": \"rule:admin_required\","},{"line_number":46,"context_line":"    \"identity:update_user\": \"rule:admin_required\","},{"line_number":47,"context_line":"    \"identity:delete_user\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":1,"id":"7a016987_9a4b9259","line":44,"updated":"2015-05-27 15:23:36.000000000","message":"this should be tested.","commit_id":"600fa2627ee848594aafbb91e1207b1fe7f1b0f9"},{"author":{"_account_id":8246,"name":"Qiming Teng","email":"tengqm@outlook.com","username":"tengqm"},"change_message_id":"13411defca2a26943d2a124c116d0f203e64ec89","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    \"identity:delete_project\": \"rule:admin_required\","},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    \"identity:get_user\": \"rule:service_or_admin\","},{"line_number":44,"context_line":"    \"identity:list_users\": \"rule:service_or_admin\","},{"line_number":45,"context_line":"    \"identity:create_user\": \"rule:admin_required\","},{"line_number":46,"context_line":"    \"identity:update_user\": \"rule:admin_required\","},{"line_number":47,"context_line":"    \"identity:delete_user\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":1,"id":"7a016987_4164f8e3","line":44,"in_reply_to":"7a016987_9a4b9259","updated":"2015-05-28 02:04:19.000000000","message":"is keystone testing the policy.json file? Could you show me an example?","commit_id":"600fa2627ee848594aafbb91e1207b1fe7f1b0f9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d373d71cb0e7f17f1f1314e29bed21bc8f514aa6","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    \"identity:update_project\": \"rule:admin_required\","},{"line_number":41,"context_line":"    \"identity:delete_project\": \"rule:admin_required\","},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    \"identity:get_user\": \"rule:service_or_admin\","},{"line_number":44,"context_line":"    \"identity:list_users\": \"rule:service_or_admin\","},{"line_number":45,"context_line":"    \"identity:create_user\": \"rule:admin_required\","},{"line_number":46,"context_line":"    \"identity:update_user\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":2,"id":"7a016987_aaefd91c","line":43,"updated":"2015-05-29 00:24:24.000000000","message":"\"identity:get_user\": \"rule:admin_or_owner\",","commit_id":"00c407104c6a2a73f98b75b5212cfc6e6b8c72c5"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"b605e29b131f542a0cac8d50f52e263d20b867e5","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    \"identity:update_project\": \"rule:admin_required\","},{"line_number":41,"context_line":"    \"identity:delete_project\": \"rule:admin_required\","},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    \"identity:get_user\": \"rule:admin_or_owner\","},{"line_number":44,"context_line":"    \"identity:list_users\": \"rule:admin_required\","},{"line_number":45,"context_line":"    \"identity:create_user\": \"rule:admin_required\","},{"line_number":46,"context_line":"    \"identity:update_user\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":4,"id":"5afe65bd_111c1811","line":43,"updated":"2015-06-03 14:22:23.000000000","message":"As to the API: get_user, what we need is user_id then we can get this user\u0027s information.\n\nIf we want to get the user information based on the user_name as what it said in the commit message then we still need to update the rule of API: list_users which is not acceptable.\n\nSo, iiuc, the commit message, want to get the user information based on user name is not achievable, not sure if this is what you want.","commit_id":"44949637107bdb94094b491b955c770204008ad2"},{"author":{"_account_id":8246,"name":"Qiming Teng","email":"tengqm@outlook.com","username":"tengqm"},"change_message_id":"764391c46070784f52009cc4d37ac2e148d18550","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    \"identity:update_project\": \"rule:admin_required\","},{"line_number":41,"context_line":"    \"identity:delete_project\": \"rule:admin_required\","},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    \"identity:get_user\": \"rule:admin_or_owner\","},{"line_number":44,"context_line":"    \"identity:list_users\": \"rule:admin_required\","},{"line_number":45,"context_line":"    \"identity:create_user\": \"rule:admin_required\","},{"line_number":46,"context_line":"    \"identity:update_user\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":4,"id":"5afe65bd_fe5fee3e","line":43,"in_reply_to":"5afe65bd_111c1811","updated":"2015-06-04 02:39:42.000000000","message":"That is really sad news.","commit_id":"44949637107bdb94094b491b955c770204008ad2"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d1c2e2ab483d3c7f01f1eeb8dd99038fc0f5f367","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    \"identity:delete_project\": \"rule:admin_required\","},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    \"identity:get_user\": \"rule:admin_or_owner\","},{"line_number":44,"context_line":"    \"identity:list_users\": \"rule:admin_required\","},{"line_number":45,"context_line":"    \"identity:create_user\": \"rule:admin_required\","},{"line_number":46,"context_line":"    \"identity:update_user\": \"rule:admin_required\","},{"line_number":47,"context_line":"    \"identity:delete_user\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":4,"id":"5afe65bd_d208a32f","line":44,"updated":"2015-06-04 06:24:06.000000000","message":"I think you maybe able to something like this\n\n  \"match_domain_id_and_username\": \"target.token.user.domain.id:%(domain_id)s and target.token.user.name: %(name)s\",\n  \"identity:list_users\": \"rule_admin_required or rule:match_domain_id_and_username\",\n\nIn your request, you\u0027ll need to specify both domain_id and name in query params. i.e.\n\n  GET /v3/users?domain_id\u003did\u0026name\u003dusername","commit_id":"44949637107bdb94094b491b955c770204008ad2"},{"author":{"_account_id":8246,"name":"Qiming Teng","email":"tengqm@outlook.com","username":"tengqm"},"change_message_id":"fa6079454d8fc34e034f03b3766b1a4c8be92bb1","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    \"identity:delete_project\": \"rule:admin_required\","},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    \"identity:get_user\": \"rule:admin_or_owner\","},{"line_number":44,"context_line":"    \"identity:list_users\": \"rule:admin_required\","},{"line_number":45,"context_line":"    \"identity:create_user\": \"rule:admin_required\","},{"line_number":46,"context_line":"    \"identity:update_user\": \"rule:admin_required\","},{"line_number":47,"context_line":"    \"identity:delete_user\": \"rule:admin_required\","}],"source_content_type":"application/json","patch_set":4,"id":"3afb71cf_07209b9a","line":44,"in_reply_to":"5afe65bd_d208a32f","updated":"2015-06-05 13:09:26.000000000","message":"Thank you very much, guang-yee. I did learnt a lot from your sample. My understanding is that by specifying this kind of a rule, we are forcing the generation of a token and validate the request via the token. We\u0027ll need a domain id because the username cannot be guaranteed uniqueness ...\n\nMaybe I should go with what Dolph suggested in the original bug report -- check the token body directly, the user_id is there.","commit_id":"44949637107bdb94094b491b955c770204008ad2"}],"keystone/tests/unit/test_v3_protection.py":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"88e5451b8cb435392e1be3ab6357151417ca7e38","unresolved":false,"context_lines":[{"line_number":224,"context_line":"            user_id\u003dself.user1[\u0027id\u0027],"},{"line_number":225,"context_line":"            password\u003dself.user1[\u0027password\u0027])"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        url_by_name \u003d \u0027/users/%s\u0027 % self.user1[\u0027id\u0027]"},{"line_number":228,"context_line":"        r \u003d self.get(url_by_name, auth\u003dauth)"},{"line_number":229,"context_line":"        self.assertEqual(self.user1[\u0027id\u0027], r.result[\u0027user\u0027][\u0027id\u0027])"},{"line_number":230,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"5afe65bd_91136866","line":227,"updated":"2015-06-03 14:26:13.000000000","message":"IIUC, in this testcase, you can only pass a user id instead of user name, if you do in that way, API: list_users is called instead of get_user.","commit_id":"44949637107bdb94094b491b955c770204008ad2"},{"author":{"_account_id":8246,"name":"Qiming Teng","email":"tengqm@outlook.com","username":"tengqm"},"change_message_id":"764391c46070784f52009cc4d37ac2e148d18550","unresolved":false,"context_lines":[{"line_number":224,"context_line":"            user_id\u003dself.user1[\u0027id\u0027],"},{"line_number":225,"context_line":"            password\u003dself.user1[\u0027password\u0027])"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        url_by_name \u003d \u0027/users/%s\u0027 % self.user1[\u0027id\u0027]"},{"line_number":228,"context_line":"        r \u003d self.get(url_by_name, auth\u003dauth)"},{"line_number":229,"context_line":"        self.assertEqual(self.user1[\u0027id\u0027], r.result[\u0027user\u0027][\u0027id\u0027])"},{"line_number":230,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"5afe65bd_210d6737","line":227,"in_reply_to":"5afe65bd_91136866","updated":"2015-06-04 02:39:42.000000000","message":"Got it. Thanks.","commit_id":"44949637107bdb94094b491b955c770204008ad2"}]}