)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"c00273f81d94a9f71edd0a776cd9400665560cf0","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Remove redundant rule:cloud_admin from list_role_assignment"},{"line_number":10,"context_line":"rule in sample v3 policy file."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Closes bug #1485104"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I0b65585c675c5b249d92cdce412efa7f3ac3c41b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1a4dcd0f_7971d5dd","line":12,"updated":"2015-08-15 18:28:55.000000000","message":"The correct tag for bug is:\n\nCloses-Bug: #1485104","commit_id":"5a26f31f53bb077c714bdd6e3feb7d9564d53db6"}],"etc/policy.v3cloudsample.json":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"58133c8053319455c9137aaeae63d2113839452c","unresolved":false,"context_lines":[{"line_number":89,"context_line":"    \"identity:create_grant\": \"rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants\","},{"line_number":90,"context_line":"    \"identity:revoke_grant\": \"rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants\","},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    \"admin_on_domain_filter\" : \"rule:admin_required and domain_id:%(scope.domain.id)s\","},{"line_number":93,"context_line":"    \"admin_on_project_filter\" : \"rule:admin_required and project_id:%(scope.project.id)s\","},{"line_number":94,"context_line":"    \"identity:list_role_assignments\": \"rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter\","},{"line_number":95,"context_line":""}],"source_content_type":"application/json","patch_set":3,"id":"fa1b9901_af3d742c","line":92,"updated":"2015-08-26 13:56:08.000000000","message":"This is not equivalent to the previous policy. You\u0027re dropping support for \"having the \u0027admin\u0027 role in the arbitrarily chosen \u0027admin\u0027 domain\" in favor of a domain-admin only. if you\u0027re going to remove \"rule:cloud_admin\" from this for whatever reason, then it should look like this:\n\n  rule:admin_required and (domain_id:admin_domain_id or domain_id:%(scope.domain.id)s)\n\nBut I think it\u0027s already simplified as-is, unless you\u0027re going to add a new rule.","commit_id":"85b81583955bf30ed0e82347e8159235ee839b9a"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"90211f0035dedadd116b9de19c075f459f63fc29","unresolved":false,"context_lines":[{"line_number":89,"context_line":"    \"identity:create_grant\": \"rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants\","},{"line_number":90,"context_line":"    \"identity:revoke_grant\": \"rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants\","},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    \"admin_on_domain_filter\" : \"rule:admin_required and domain_id:%(scope.domain.id)s\","},{"line_number":93,"context_line":"    \"admin_on_project_filter\" : \"rule:admin_required and project_id:%(scope.project.id)s\","},{"line_number":94,"context_line":"    \"identity:list_role_assignments\": \"rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter\","},{"line_number":95,"context_line":""}],"source_content_type":"application/json","patch_set":3,"id":"da20952f_4290e395","line":92,"in_reply_to":"da20952f_73ce2085","updated":"2015-08-26 18:04:55.000000000","message":"Ah, so I understood that admin_on_domain_filter was a policy check itself, not just a reusable rule. So, my concern then is that identity:list_role_assignments evaluates to the same policy check (unless we have a reason to have it evaluate to a different policy check... but this is supposed to be a refactor).\n\nSo, I worked out the before-and-after policy expansions by hand (apologies if anyone wants to follow this mess):\n\n  http://cdn.pasteraw.com/l71u9dyzzcju1wnswiv0xywh5xi4htk\n\nThe before and after policy checks for \"identity:list_role_assignments\" *do* match. This is a pretty simple refactor then, but that totally escaped me as I immediately stumbled on the non-equivalent change to \"admin_on_domain_filter\" alone last read-through.","commit_id":"85b81583955bf30ed0e82347e8159235ee839b9a"},{"author":{"_account_id":17043,"name":"Timothy Symanczyk","email":"tim@symanczyk.com","username":"timothy_symanczyk"},"change_message_id":"c775b0674a1f54b4ad3c967b977b456774f95ef4","unresolved":false,"context_lines":[{"line_number":89,"context_line":"    \"identity:create_grant\": \"rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants\","},{"line_number":90,"context_line":"    \"identity:revoke_grant\": \"rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants\","},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    \"admin_on_domain_filter\" : \"rule:admin_required and domain_id:%(scope.domain.id)s\","},{"line_number":93,"context_line":"    \"admin_on_project_filter\" : \"rule:admin_required and project_id:%(scope.project.id)s\","},{"line_number":94,"context_line":"    \"identity:list_role_assignments\": \"rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter\","},{"line_number":95,"context_line":""}],"source_content_type":"application/json","patch_set":3,"id":"da20952f_73ce2085","line":92,"in_reply_to":"fa1b9901_af3d742c","updated":"2015-08-26 17:29:00.000000000","message":"I agree, the new rule:admin_on_domain_filter is NOT equivalent to the previous policy. And I agree with what you\u0027re saying, the change does not eliminate any redundancy within rule:admin_on_domain_filter - indeed there never was redundancy in there. \n\nThe intention of this change is to remove the redundant appearance of rule:cloud_admin within the below rule identity:list_role_assignments. Currently rule:cloud_admin is in there twice because rule:cloud_admin is included in both of its sub-rules, admin_on_domain_filter and admin_on_project_filter. The change removes rule:cloud_admin from each of the sub-rules, and includes it once directly in the main rule.","commit_id":"85b81583955bf30ed0e82347e8159235ee839b9a"}]}