)]}'
{"keystone/common/policies/user.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bd4162ce0a6dddd49382e3ebd4a809216a1be567","unresolved":false,"context_lines":[{"line_number":53,"context_line":"        # that is best enforced in code, which makes sense because all you need"},{"line_number":54,"context_line":"        # to use this API is a valid token and it can be either system-scoped"},{"line_number":55,"context_line":"        # or project-scoped."},{"line_number":56,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":57,"context_line":"        description\u003d(\u0027List all projects a user has access to via role \u0027"},{"line_number":58,"context_line":"                     \u0027assignments.\u0027),"},{"line_number":59,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027 /v3/auth/projects\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_25cbed72","line":56,"updated":"2018-01-19 13:04:30.000000000","message":"This is actually an explicitly unscoped operation. You only perform this operation with an unscoped token. Same for /v3/auth/domains below.\n\nHow do we want to handle that? I\u0027m kind of surprised we have a policy for it at all.","commit_id":"849e21959c9372baeb62b23216e681ef6333c388"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a4db6a48899d4dd04b8151afbd220fab40030db1","unresolved":false,"context_lines":[{"line_number":53,"context_line":"        # that is best enforced in code, which makes sense because all you need"},{"line_number":54,"context_line":"        # to use this API is a valid token and it can be either system-scoped"},{"line_number":55,"context_line":"        # or project-scoped."},{"line_number":56,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":57,"context_line":"        description\u003d(\u0027List all projects a user has access to via role \u0027"},{"line_number":58,"context_line":"                     \u0027assignments.\u0027),"},{"line_number":59,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027 /v3/auth/projects\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_d3d0c556","line":56,"in_reply_to":"7f96bb07_25cbed72","updated":"2018-01-19 22:55:54.000000000","message":"Right - maybe I\u0027ll just leave the scope_types off for this since it doesn\u0027t really make sense. I will leave a comment explaining the justification.","commit_id":"849e21959c9372baeb62b23216e681ef6333c388"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bd4162ce0a6dddd49382e3ebd4a809216a1be567","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        name\u003dbase.IDENTITY % \u0027create_user\u0027,"},{"line_number":79,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":80,"context_line":"        # This can be considered either a system-level policy or a"},{"line_number":81,"context_line":"        # project-level policy. If this API is called with a system-scoped"},{"line_number":82,"context_line":"        # token, then the user is owned by the system as a system-level"},{"line_number":83,"context_line":"        # resource under whatever domain was specified in the request. If the"},{"line_number":84,"context_line":"        # API is called with a project-scoped token by a project administrator,"},{"line_number":85,"context_line":"        # the user should be created with the domain of the project"},{"line_number":86,"context_line":"        # administrator. The second case is likely going to require a coded"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_c5aa4970","line":83,"range":{"start_line":81,"start_character":31,"end_line":83,"end_character":70},"updated":"2018-01-19 13:04:30.000000000","message":"Right now, users are always owned by domains. So I\u0027m confused about what \"owned by the system\" will mean here.","commit_id":"849e21959c9372baeb62b23216e681ef6333c388"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a4db6a48899d4dd04b8151afbd220fab40030db1","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        name\u003dbase.IDENTITY % \u0027create_user\u0027,"},{"line_number":79,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":80,"context_line":"        # This can be considered either a system-level policy or a"},{"line_number":81,"context_line":"        # project-level policy. If this API is called with a system-scoped"},{"line_number":82,"context_line":"        # token, then the user is owned by the system as a system-level"},{"line_number":83,"context_line":"        # resource under whatever domain was specified in the request. If the"},{"line_number":84,"context_line":"        # API is called with a project-scoped token by a project administrator,"},{"line_number":85,"context_line":"        # the user should be created with the domain of the project"},{"line_number":86,"context_line":"        # administrator. The second case is likely going to require a coded"}],"source_content_type":"text/x-python","patch_set":3,"id":"7f96bb07_136ced9a","line":83,"range":{"start_line":81,"start_character":31,"end_line":83,"end_character":70},"in_reply_to":"7f96bb07_c5aa4970","updated":"2018-01-19 22:55:54.000000000","message":"Yeah, that\u0027s true.. but it\u0027s also confusing since a user can belong to domain-A but they can have assignments in other domains. How should we describe this? Should we add \u0027domain\u0027 as a scope and teach that to oslo.policy?\n\nThoughts?","commit_id":"849e21959c9372baeb62b23216e681ef6333c388"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"aba34020e8796d7e72bedccead2c58c99ac4d440","unresolved":false,"context_lines":[{"line_number":26,"context_line":"        # require keystone to be smarter about enforcing policy checks in code,"},{"line_number":27,"context_line":"        # specifically for the last two cases. Once that is fixed, we can"},{"line_number":28,"context_line":"        # uncomment the following line."},{"line_number":29,"context_line":"        # scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":30,"context_line":"        description\u003d\u0027Show user details.\u0027,"},{"line_number":31,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/users/{user_id}\u0027,"},{"line_number":32,"context_line":"                     \u0027method\u0027: \u0027GET\u0027},"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f96bb07_6b18cd74","line":29,"updated":"2018-01-21 11:29:02.000000000","message":"The situation right now is that an \u0027admin\u0027 (effectively a system admin because of 968698) can do these operations, so does it make sense to lock this down to \u0027system\u0027 for now and add future scope types when we can?","commit_id":"23d0ee5edd9dc3c82ceb3f62d918784e448425bc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e503349864b8e3b016940c3e20f1b47712b70dd1","unresolved":false,"context_lines":[{"line_number":26,"context_line":"        # require keystone to be smarter about enforcing policy checks in code,"},{"line_number":27,"context_line":"        # specifically for the last two cases. Once that is fixed, we can"},{"line_number":28,"context_line":"        # uncomment the following line."},{"line_number":29,"context_line":"        # scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":30,"context_line":"        description\u003d\u0027Show user details.\u0027,"},{"line_number":31,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/users/{user_id}\u0027,"},{"line_number":32,"context_line":"                     \u0027method\u0027: \u0027GET\u0027},"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f96bb07_43bed865","line":29,"in_reply_to":"7f96bb07_1d160cf3","updated":"2018-01-23 15:12:50.000000000","message":"We could probably open those up to be just \u0027system\u0027 for now.","commit_id":"23d0ee5edd9dc3c82ceb3f62d918784e448425bc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9111385607264ab9e0acdc8fc0f44888649d1dab","unresolved":false,"context_lines":[{"line_number":26,"context_line":"        # require keystone to be smarter about enforcing policy checks in code,"},{"line_number":27,"context_line":"        # specifically for the last two cases. Once that is fixed, we can"},{"line_number":28,"context_line":"        # uncomment the following line."},{"line_number":29,"context_line":"        # scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":30,"context_line":"        description\u003d\u0027Show user details.\u0027,"},{"line_number":31,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/users/{user_id}\u0027,"},{"line_number":32,"context_line":"                     \u0027method\u0027: \u0027GET\u0027},"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f93b717_8177e8d4","line":29,"in_reply_to":"7f96bb07_43bed865","updated":"2018-01-29 17:23:16.000000000","message":"Done","commit_id":"23d0ee5edd9dc3c82ceb3f62d918784e448425bc"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9fd96739ba08732f3f5d0b792dba47b5aa45e2a3","unresolved":false,"context_lines":[{"line_number":26,"context_line":"        # require keystone to be smarter about enforcing policy checks in code,"},{"line_number":27,"context_line":"        # specifically for the last two cases. Once that is fixed, we can"},{"line_number":28,"context_line":"        # uncomment the following line."},{"line_number":29,"context_line":"        # scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":30,"context_line":"        description\u003d\u0027Show user details.\u0027,"},{"line_number":31,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/users/{user_id}\u0027,"},{"line_number":32,"context_line":"                     \u0027method\u0027: \u0027GET\u0027},"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f96bb07_1d160cf3","line":29,"in_reply_to":"7f96bb07_4b2ff8f5","updated":"2018-01-22 22:28:27.000000000","message":"Oh, right, but what about the ones below this that are just RULE_ADMIN_REQUIRED ?","commit_id":"23d0ee5edd9dc3c82ceb3f62d918784e448425bc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9851f9eabd4af6187bebbec98281a3ad218c3237","unresolved":false,"context_lines":[{"line_number":26,"context_line":"        # require keystone to be smarter about enforcing policy checks in code,"},{"line_number":27,"context_line":"        # specifically for the last two cases. Once that is fixed, we can"},{"line_number":28,"context_line":"        # uncomment the following line."},{"line_number":29,"context_line":"        # scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":30,"context_line":"        description\u003d\u0027Show user details.\u0027,"},{"line_number":31,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/users/{user_id}\u0027,"},{"line_number":32,"context_line":"                     \u0027method\u0027: \u0027GET\u0027},"}],"source_content_type":"text/x-python","patch_set":4,"id":"7f96bb07_4b2ff8f5","line":29,"in_reply_to":"7f96bb07_6b18cd74","updated":"2018-01-22 15:55:18.000000000","message":"Good question, but I don\u0027t think we can be the current check is RULE_ADMIN_OR_OWNER.. which compares the user making the request to the resource in the request. I think this is the bit that makes it so users who aren\u0027t cloud administrator can get references for their own user.\n\nIdeally, we\u0027ll have to break that enforcement out of a policy check string and into code. If we set scope_types to \u0027system\u0027 before handling that case in code, we might break people who aren\u0027t system administrators from getting references to themselves.","commit_id":"23d0ee5edd9dc3c82ceb3f62d918784e448425bc"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6cd7c521265e2114169d99841caceeacf7b9f86c","unresolved":false,"context_lines":[{"line_number":20,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":21,"context_line":"        # FIXME(lbragstad): First, a system administrator should be able to get"},{"line_number":22,"context_line":"        # a user reference for anyone in the system. Second, a project"},{"line_number":23,"context_line":"        # administrator should be able to get references for users within the"},{"line_number":24,"context_line":"        # project their token is scoped to or their domain. Third, a user"},{"line_number":25,"context_line":"        # should be able to get a reference for themselves. This is going to"},{"line_number":26,"context_line":"        # require keystone to be smarter about enforcing policy checks in code,"},{"line_number":27,"context_line":"        # specifically for the last two cases. Once that is fixed, we can"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f93b717_dff488f3","line":24,"range":{"start_line":23,"start_character":57,"end_line":24,"end_character":58},"updated":"2018-02-01 17:32:10.000000000","message":"Sort of a nit but I think there are two separate meanings to this and they should be treated differently. A domain admin should be able to get (and create and delete and update) users who are contained (as in, namespaced) in that domain. Should a project admin have the same rights to do that for users with *role assignments* on the project? I don\u0027t think so, but whatever we decide we should be careful to make the distinction.","commit_id":"d1e751bdcaadba8c1e1e5d5ad53b4ad43dfa5fa1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"754473ff352f03f0192fcbaa16c29b5491ef6105","unresolved":false,"context_lines":[{"line_number":20,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":21,"context_line":"        # FIXME(lbragstad): First, a system administrator should be able to get"},{"line_number":22,"context_line":"        # a user reference for anyone in the system. Second, a project"},{"line_number":23,"context_line":"        # administrator should be able to get references for users within the"},{"line_number":24,"context_line":"        # project their token is scoped to or their domain. Third, a user"},{"line_number":25,"context_line":"        # should be able to get a reference for themselves. This is going to"},{"line_number":26,"context_line":"        # require keystone to be smarter about enforcing policy checks in code,"},{"line_number":27,"context_line":"        # specifically for the last two cases. Once that is fixed, we can"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f93b717_2b476abe","line":24,"range":{"start_line":23,"start_character":57,"end_line":24,"end_character":58},"in_reply_to":"5f93b717_50014705","updated":"2018-02-01 20:29:25.000000000","message":"I don\u0027t have strong feelings on it either way right now, I\u0027d have to think on it. Might be a good PTG topic.","commit_id":"d1e751bdcaadba8c1e1e5d5ad53b4ad43dfa5fa1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8f23ad3820c0d04524c44566f013f2c47a0bb6c","unresolved":false,"context_lines":[{"line_number":20,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":21,"context_line":"        # FIXME(lbragstad): First, a system administrator should be able to get"},{"line_number":22,"context_line":"        # a user reference for anyone in the system. Second, a project"},{"line_number":23,"context_line":"        # administrator should be able to get references for users within the"},{"line_number":24,"context_line":"        # project their token is scoped to or their domain. Third, a user"},{"line_number":25,"context_line":"        # should be able to get a reference for themselves. This is going to"},{"line_number":26,"context_line":"        # require keystone to be smarter about enforcing policy checks in code,"},{"line_number":27,"context_line":"        # specifically for the last two cases. Once that is fixed, we can"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f93b717_50014705","line":24,"range":{"start_line":23,"start_character":57,"end_line":24,"end_character":58},"in_reply_to":"5f93b717_50de27da","updated":"2018-02-01 19:57:55.000000000","message":"So - just to make sure we\u0027re on the same page, you don\u0027t think we should expand the if/else in oslo.policy to be smart enough to handle domain scope, correct?\n\nhttps://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L834-L842","commit_id":"d1e751bdcaadba8c1e1e5d5ad53b4ad43dfa5fa1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"40f341703e57419983a05b4643798a5afb09207c","unresolved":false,"context_lines":[{"line_number":20,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":21,"context_line":"        # FIXME(lbragstad): First, a system administrator should be able to get"},{"line_number":22,"context_line":"        # a user reference for anyone in the system. Second, a project"},{"line_number":23,"context_line":"        # administrator should be able to get references for users within the"},{"line_number":24,"context_line":"        # project their token is scoped to or their domain. Third, a user"},{"line_number":25,"context_line":"        # should be able to get a reference for themselves. This is going to"},{"line_number":26,"context_line":"        # require keystone to be smarter about enforcing policy checks in code,"},{"line_number":27,"context_line":"        # specifically for the last two cases. Once that is fixed, we can"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f93b717_50de27da","line":24,"range":{"start_line":23,"start_character":57,"end_line":24,"end_character":58},"in_reply_to":"5f93b717_903eefb5","updated":"2018-02-01 19:47:49.000000000","message":"I think I\u0027ve been assuming the latter, which would have to happen in keystone, not oslo.policy.","commit_id":"d1e751bdcaadba8c1e1e5d5ad53b4ad43dfa5fa1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3cee45c994a335434b743238cb77f383c46027d0","unresolved":false,"context_lines":[{"line_number":20,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":21,"context_line":"        # FIXME(lbragstad): First, a system administrator should be able to get"},{"line_number":22,"context_line":"        # a user reference for anyone in the system. Second, a project"},{"line_number":23,"context_line":"        # administrator should be able to get references for users within the"},{"line_number":24,"context_line":"        # project their token is scoped to or their domain. Third, a user"},{"line_number":25,"context_line":"        # should be able to get a reference for themselves. This is going to"},{"line_number":26,"context_line":"        # require keystone to be smarter about enforcing policy checks in code,"},{"line_number":27,"context_line":"        # specifically for the last two cases. Once that is fixed, we can"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f93b717_903eefb5","line":24,"range":{"start_line":23,"start_character":57,"end_line":24,"end_character":58},"in_reply_to":"5f93b717_dff488f3","updated":"2018-02-01 19:18:37.000000000","message":"Good point - should this just be a domain and we forget project? That might require reteaching oslo.policy about domain-scoped tokens, since we very will could be doing:\n\n  scope_types\u003d[\u0027system\u0027, \u0027domain\u0027]\n\nOr we overload the \u0027project\u0027 meaning here and make sure the token is scoped to a project acting as a domain \u003d/","commit_id":"d1e751bdcaadba8c1e1e5d5ad53b4ad43dfa5fa1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6cd7c521265e2114169d99841caceeacf7b9f86c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"        # administrator should be able to list all users in the deployment,"},{"line_number":41,"context_line":"        # which is what\u0027s supported today. Project and domain administrators"},{"line_number":42,"context_line":"        # should also be able to list users, but they should only see users"},{"line_number":43,"context_line":"        # within their project or domain. Otherwise it would be possible for"},{"line_number":44,"context_line":"        # project and domain administrators to see users unrelated to their"},{"line_number":45,"context_line":"        # project or domain, which would be a security issue. Once we have that"},{"line_number":46,"context_line":"        # support in place, we should update scope_types to include \u0027project\u0027."}],"source_content_type":"text/x-python","patch_set":5,"id":"5f93b717_5f4e3838","line":43,"range":{"start_line":43,"start_character":10,"end_line":43,"end_character":16},"updated":"2018-02-01 17:32:10.000000000","message":"Again, this could mean two things and that\u0027s not clear here.","commit_id":"d1e751bdcaadba8c1e1e5d5ad53b4ad43dfa5fa1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6cd7c521265e2114169d99841caceeacf7b9f86c","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":80,"context_line":"        # FIXME(lbragstad): This can be considered either a system-level policy"},{"line_number":81,"context_line":"        # or a project-level policy. System administrator should have the"},{"line_number":82,"context_line":"        # ability to create users in any domain. Domain (or project)"},{"line_number":83,"context_line":"        # administrators should have the ability to create users in the domain"},{"line_number":84,"context_line":"        # they administer. The second case is going to require a policy check"},{"line_number":85,"context_line":"        # in code. Until that happens, we will leave this as a system-level"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f93b717_3f01ecaf","line":82,"range":{"start_line":82,"start_character":56,"end_line":82,"end_character":68},"updated":"2018-02-01 17:32:10.000000000","message":"I think we only really want to support domain administrators doing this (I know projects are domains but you know what I mean)","commit_id":"d1e751bdcaadba8c1e1e5d5ad53b4ad43dfa5fa1"}]}