)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"1e1094e131d3b865dbdb96186da50cc75b0a0557","unresolved":false,"context_lines":[{"line_number":7,"context_line":"modify cloud_admin rule so it loads properly"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"the current rule does fails to load with oslo.policy, the correct"},{"line_number":10,"context_line":"value used to determine the admin projectfor the cloud_admin should"},{"line_number":11,"context_line":"simply be: `is_admin_project:True`, since that is what is stored"},{"line_number":12,"context_line":"in oslo.context."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"1a6eadb0_37be4bff","line":10,"range":{"start_line":10,"start_character":34,"end_line":10,"end_character":45},"updated":"2016-12-16 03:17:18.000000000","message":"nit: project for","commit_id":"aad0c05dd72d32dc580f8a8c245b4ad21ae210b7"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"ab0710a064d0f471300a2a06d4801e493d861c18","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Fix cloud_admin rule and ensure only project tokens can be cloud admin"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The current rule does fails to load with oslo.policy, the correct"},{"line_number":10,"context_line":"value used to determine the admin projectfor the cloud_admin should"},{"line_number":11,"context_line":"simply be: `is_admin_project:True`, since that is what is stored"},{"line_number":12,"context_line":"in oslo.context."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"da4df55a_bebaa508","line":9,"range":{"start_line":9,"start_character":22,"end_line":9,"end_character":27},"updated":"2016-12-23 06:13:35.000000000","message":"fail","commit_id":"c93ebc652c246593aba5f001c28bd979780825c8"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"ab0710a064d0f471300a2a06d4801e493d861c18","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Fix cloud_admin rule and ensure only project tokens can be cloud admin"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The current rule does fails to load with oslo.policy, the correct"},{"line_number":10,"context_line":"value used to determine the admin projectfor the cloud_admin should"},{"line_number":11,"context_line":"simply be: `is_admin_project:True`, since that is what is stored"},{"line_number":12,"context_line":"in oslo.context."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"da4df55a_fe3a6d97","line":10,"range":{"start_line":10,"start_character":34,"end_line":10,"end_character":44},"updated":"2016-12-23 06:13:35.000000000","message":"project for","commit_id":"c93ebc652c246593aba5f001c28bd979780825c8"}],"etc/policy.v3cloudsample.json":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"fdfcd93129fe48a4a42c4deaf7a199f1a7262aaa","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and (is_admin_project:True or domain_id:admin_domain_id)\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":9,"id":"da4df55a_399ce5bf","line":3,"range":{"start_line":3,"start_character":61,"end_line":3,"end_character":86},"updated":"2016-12-25 13:08:09.000000000","message":"looks like this is just a placeholder?","commit_id":"ef48072d94f780ebaacee8c3ddf02a68193fa74d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9046fa33728d705d508cbec2da470fa6514132af","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and (is_admin_project:True or domain_id:admin_domain_id)\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":9,"id":"da4df55a_dc8587ad","line":3,"range":{"start_line":3,"start_character":61,"end_line":3,"end_character":86},"in_reply_to":"da4df55a_399ce5bf","updated":"2016-12-25 17:25:47.000000000","message":"yes, you replace \"admin_domain_id\" with the actual ID of the domain.\n\nSo in a multi-domain setup, the \"default\" domain would be the admin domain and all other domains (for LDAP and such) will be non-admin domains.","commit_id":"ef48072d94f780ebaacee8c3ddf02a68193fa74d"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"7d9d660505a92016a430623b3abf493e5bb2f8ea","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"admin_required\": \"role:admin\","},{"line_number":3,"context_line":"    \"cloud_admin\": \"role:admin and (is_admin_project:True or domain_id:admin_domain_id)\","},{"line_number":4,"context_line":"    \"service_role\": \"role:service\","},{"line_number":5,"context_line":"    \"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":6,"context_line":"    \"owner\" : \"user_id:%(user_id)s or user_id:%(target.token.user_id)s\","}],"source_content_type":"application/json","patch_set":9,"id":"ba5201f7_f729b28a","line":3,"range":{"start_line":3,"start_character":61,"end_line":3,"end_character":86},"in_reply_to":"da4df55a_dc8587ad","updated":"2017-01-03 13:59:20.000000000","message":"i.e, this requires customization. I don\u0027t think folks will necessarily understand that, and if they did then this probably wouldn\u0027t have been terribly useful to them anyway. I suggest that we should remove the right side of this or condition.","commit_id":"ef48072d94f780ebaacee8c3ddf02a68193fa74d"}],"keystone/models/token_model.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"7d9d660505a92016a430623b3abf493e5bb2f8ea","unresolved":false,"context_lines":[{"line_number":199,"context_line":"            return False"},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"        # True gets returned by default for compatibility with older versions"},{"line_number":202,"context_line":"        # TODO(henry-nash): This seems inherently dangerous, and we should"},{"line_number":203,"context_line":"        # investigate how we can default this to False."},{"line_number":204,"context_line":"        return self.get(\u0027is_admin_project\u0027, True)"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"    @property"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba5201f7_a21b6a1a","line":203,"range":{"start_line":202,"start_character":8,"end_line":203,"end_character":55},"updated":"2017-01-03 13:59:20.000000000","message":"Yes. Defaulting to True here was always supposed to be temporary, for backward compatibility. Should probably have a deprecation warning. Maybe it already does and that is somewhere else?","commit_id":"ef48072d94f780ebaacee8c3ddf02a68193fa74d"}],"keystone/tests/unit/token/test_token_model.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"3c0ec55f1938bcc0460d531e4cdad480f7ca773f","unresolved":false,"context_lines":[{"line_number":72,"context_line":"        self.assertEqual("},{"line_number":73,"context_line":"            self.v3_sample_token[\u0027token\u0027][\u0027OS-TRUST:trust\u0027][\u0027trustee_user_id\u0027],"},{"line_number":74,"context_line":"            token_data.trustee_user_id)"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"        # Project Scoped Token"},{"line_number":77,"context_line":"        self.assertRaises(exception.UnexpectedError, getattr, token_data,"},{"line_number":78,"context_line":"                          \u0027domain_id\u0027)"}],"source_content_type":"text/x-python","patch_set":6,"id":"da4df55a_02c5343b","line":75,"updated":"2016-12-22 14:24:16.000000000","message":"this new line helped readability, everything was all smushed together","commit_id":"d5170d33b20dae9a87de27292a389b1b4689f39e"}],"releasenotes/notes/bug-1547684-911aed68a0d3df17.yaml":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"fdfcd93129fe48a4a42c4deaf7a199f1a7262aaa","unresolved":false,"context_lines":[{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    [`bug 1651989 \u003chttps://bugs.launchpad.net/keystone/+bug/1651989\u003e`_]"},{"line_number":5,"context_line":"    Due to ``bug 1547684``, when using the ``policy.v3cloudsample.json``"},{"line_number":6,"context_line":"    sample file, a domain admin token was being treated as a cloud admin."},{"line_number":7,"context_line":"    Since the ``is_admin_project`` functionality only supports project-"},{"line_number":8,"context_line":"    scoped tokens, we automatically set any domain scoped token to have"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"da4df55a_d992f99e","line":5,"range":{"start_line":5,"start_character":11,"end_line":5,"end_character":26},"updated":"2016-12-25 13:08:09.000000000","message":"Do you mean the bug masked the issue explained below?","commit_id":"ef48072d94f780ebaacee8c3ddf02a68193fa74d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9046fa33728d705d508cbec2da470fa6514132af","unresolved":false,"context_lines":[{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    [`bug 1651989 \u003chttps://bugs.launchpad.net/keystone/+bug/1651989\u003e`_]"},{"line_number":5,"context_line":"    Due to ``bug 1547684``, when using the ``policy.v3cloudsample.json``"},{"line_number":6,"context_line":"    sample file, a domain admin token was being treated as a cloud admin."},{"line_number":7,"context_line":"    Since the ``is_admin_project`` functionality only supports project-"},{"line_number":8,"context_line":"    scoped tokens, we automatically set any domain scoped token to have"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"da4df55a_fc940be3","line":5,"range":{"start_line":5,"start_character":11,"end_line":5,"end_character":26},"in_reply_to":"da4df55a_d992f99e","updated":"2016-12-25 17:25:47.000000000","message":"yes, correct.","commit_id":"ef48072d94f780ebaacee8c3ddf02a68193fa74d"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"fdfcd93129fe48a4a42c4deaf7a199f1a7262aaa","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    [`bug 1651989 \u003chttps://bugs.launchpad.net/keystone/+bug/1651989\u003e`_]"},{"line_number":5,"context_line":"    Due to ``bug 1547684``, when using the ``policy.v3cloudsample.json``"},{"line_number":6,"context_line":"    sample file, a domain admin token was being treated as a cloud admin."},{"line_number":7,"context_line":"    Since the ``is_admin_project`` functionality only supports project-"},{"line_number":8,"context_line":"    scoped tokens, we automatically set any domain scoped token to have"},{"line_number":9,"context_line":"    the property ``is_admin_project`` to ``False``."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"da4df55a_b997f58e","line":6,"range":{"start_line":6,"start_character":17,"end_line":6,"end_character":73},"updated":"2016-12-25 13:08:09.000000000","message":"why not? shouldn\u0027t the below policy tell us the domain admin token could act as cloud admin?\n\n\"cloud_admin\": \"role:admin and (is_admin_project:True or domain_id:admin_domain_id)\"","commit_id":"ef48072d94f780ebaacee8c3ddf02a68193fa74d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9046fa33728d705d508cbec2da470fa6514132af","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    [`bug 1651989 \u003chttps://bugs.launchpad.net/keystone/+bug/1651989\u003e`_]"},{"line_number":5,"context_line":"    Due to ``bug 1547684``, when using the ``policy.v3cloudsample.json``"},{"line_number":6,"context_line":"    sample file, a domain admin token was being treated as a cloud admin."},{"line_number":7,"context_line":"    Since the ``is_admin_project`` functionality only supports project-"},{"line_number":8,"context_line":"    scoped tokens, we automatically set any domain scoped token to have"},{"line_number":9,"context_line":"    the property ``is_admin_project`` to ``False``."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"da4df55a_5cc0b7e0","line":6,"range":{"start_line":6,"start_character":17,"end_line":6,"end_character":73},"in_reply_to":"da4df55a_b997f58e","updated":"2016-12-25 17:25:47.000000000","message":"right, so we want to allow the \"admin\" on the admin domain to be the cloud admin.\n\nbut we don\u0027t want the \"domain admin\" to be able to be a \"cloud admin\"\n\nThe change we made to https://review.openstack.org/#/c/411563/9/keystone/models/token_model.py fixes that. Because if a \"domain admin\" requested a domain scoped token, it would automatically evaluate the \"is_admin_project:True\" to true !!\n\nThis is not necessary for domain scoped tokens","commit_id":"ef48072d94f780ebaacee8c3ddf02a68193fa74d"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"fdfcd93129fe48a4a42c4deaf7a199f1a7262aaa","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"      \"role:admin and (is_admin_project:True or domain_id:admin_domain_id)\""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    Adjust configuration tools as necessary, see the ``fixes`` section for more"},{"line_number":29,"context_line":"    details on this change."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"da4df55a_7942ed11","line":28,"range":{"start_line":28,"start_character":25,"end_line":28,"end_character":30},"updated":"2016-12-25 13:08:09.000000000","message":"better to say policy configuration file here, fine as it is.","commit_id":"ef48072d94f780ebaacee8c3ddf02a68193fa74d"}]}