)]}'
{"keystone/common/policies/role.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"4d6898bfdb99e1f108f517c2b2dab07130d72628","unresolved":false,"context_lines":[{"line_number":76,"context_line":"        deprecated_since\u003dversionutils.deprecated.STEIN),"},{"line_number":77,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":78,"context_line":"        name\u003dbase.IDENTITY % \u0027create_role\u0027,"},{"line_number":79,"context_line":"        check_str\u003d\u0027role:admin\u0027,"},{"line_number":80,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":81,"context_line":"        description\u003d\u0027Create role.\u0027,"},{"line_number":82,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/roles\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_9d3403ad","line":79,"updated":"2018-12-06 20:42:58.000000000","message":"Why are you changing this? It\u0027s nearly the same as what we have currently but drops the is_admin:1 part of the rule.","commit_id":"56ae9854874f951a1cc1710af729b45bf503b77b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c6959dc4c900e8d16515781b1fd5da7b423a51c2","unresolved":false,"context_lines":[{"line_number":76,"context_line":"        deprecated_since\u003dversionutils.deprecated.STEIN),"},{"line_number":77,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":78,"context_line":"        name\u003dbase.IDENTITY % \u0027create_role\u0027,"},{"line_number":79,"context_line":"        check_str\u003d\u0027role:admin\u0027,"},{"line_number":80,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":81,"context_line":"        description\u003d\u0027Create role.\u0027,"},{"line_number":82,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/roles\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_b4878a0a","line":79,"in_reply_to":"3f79a3b5_143a05ee","updated":"2018-12-07 14:41:32.000000000","message":"Yeah - I think now is a good time to do that and have those conversations. IMO, it makes sense to clean all this stuff up while we\u0027re in here doing the rest of the default roles + scope work anyway.\n\nIf keystone doesn\u0027t have anything that consumes is_admin anymore (via policy), I\u0027d think it would be safe to remove enforcer code that uses it then, right? So long as we have yet another release note for anyone building custom policy checks that might be using it?","commit_id":"56ae9854874f951a1cc1710af729b45bf503b77b"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"3c6e065eafc0be81e71bb12fa77e401a176da7bd","unresolved":false,"context_lines":[{"line_number":76,"context_line":"        deprecated_since\u003dversionutils.deprecated.STEIN),"},{"line_number":77,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":78,"context_line":"        name\u003dbase.IDENTITY % \u0027create_role\u0027,"},{"line_number":79,"context_line":"        check_str\u003d\u0027role:admin\u0027,"},{"line_number":80,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":81,"context_line":"        description\u003d\u0027Create role.\u0027,"},{"line_number":82,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/roles\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_143a05ee","line":79,"in_reply_to":"3f79a3b5_8fce0a57","updated":"2018-12-07 08:16:20.000000000","message":"Okay makes sense.\n\nWe still use the is_admin token elsewhere in keystone, e.g. http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/rbac_enforcer/enforcer.py#n236 should we talk about removing those bits?","commit_id":"56ae9854874f951a1cc1710af729b45bf503b77b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8b97d6a42a59e49426a0ab10a1adc0320688e1e3","unresolved":false,"context_lines":[{"line_number":76,"context_line":"        deprecated_since\u003dversionutils.deprecated.STEIN),"},{"line_number":77,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":78,"context_line":"        name\u003dbase.IDENTITY % \u0027create_role\u0027,"},{"line_number":79,"context_line":"        check_str\u003d\u0027role:admin\u0027,"},{"line_number":80,"context_line":"        scope_types\u003d[\u0027system\u0027],"},{"line_number":81,"context_line":"        description\u003d\u0027Create role.\u0027,"},{"line_number":82,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/roles\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_8fce0a57","line":79,"in_reply_to":"3f79a3b5_9d3403ad","updated":"2018-12-06 21:55:39.000000000","message":"Just to simplify things and be explicit about not using \"is_admin\" terminology when we have different perspectives with scopes (e.g., system admin, domain admin, project admin).","commit_id":"56ae9854874f951a1cc1710af729b45bf503b77b"}],"releasenotes/notes/bug-1805402-75d0d93f31af620f.yaml":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"4d6898bfdb99e1f108f517c2b2dab07130d72628","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    [`bug 1805402 \u003chttps://bugs.launchpad.net/keystone/+bug/1805402\u003e`_]"},{"line_number":17,"context_line":"    Several policies used to protect the role API have been deprecated"},{"line_number":18,"context_line":"    in favor of more clear and concise defaults. Please consider these"},{"line_number":19,"context_line":"    new default if your deployment overrides role policies."},{"line_number":20,"context_line":"security:"},{"line_number":21,"context_line":"  - |"},{"line_number":22,"context_line":"    [`bug 1805402 \u003chttps://bugs.launchpad.net/keystone/+bug/1805402\u003e`_]"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3f79a3b5_1dd23360","line":19,"updated":"2018-12-06 20:42:58.000000000","message":"I would list all the changes here so it\u0027s easier to check what changed, looking through logs for deprecation warnings after you\u0027ve already upgraded is a hassle","commit_id":"56ae9854874f951a1cc1710af729b45bf503b77b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8b97d6a42a59e49426a0ab10a1adc0320688e1e3","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    [`bug 1805402 \u003chttps://bugs.launchpad.net/keystone/+bug/1805402\u003e`_]"},{"line_number":17,"context_line":"    Several policies used to protect the role API have been deprecated"},{"line_number":18,"context_line":"    in favor of more clear and concise defaults. Please consider these"},{"line_number":19,"context_line":"    new default if your deployment overrides role policies."},{"line_number":20,"context_line":"security:"},{"line_number":21,"context_line":"  - |"},{"line_number":22,"context_line":"    [`bug 1805402 \u003chttps://bugs.launchpad.net/keystone/+bug/1805402\u003e`_]"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3f79a3b5_4f231213","line":19,"in_reply_to":"3f79a3b5_1dd23360","updated":"2018-12-06 21:55:39.000000000","message":"So something to the effect of:\n\n  The ``identity:get_role``, ``identity:create_role``, ``identity:list_roles``,\n  ``identity:update_role``, ``identity:delete_role`` policies have been\n  updated ....\n\n?","commit_id":"56ae9854874f951a1cc1710af729b45bf503b77b"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"3c6e065eafc0be81e71bb12fa77e401a176da7bd","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    [`bug 1805402 \u003chttps://bugs.launchpad.net/keystone/+bug/1805402\u003e`_]"},{"line_number":17,"context_line":"    Several policies used to protect the role API have been deprecated"},{"line_number":18,"context_line":"    in favor of more clear and concise defaults. Please consider these"},{"line_number":19,"context_line":"    new default if your deployment overrides role policies."},{"line_number":20,"context_line":"security:"},{"line_number":21,"context_line":"  - |"},{"line_number":22,"context_line":"    [`bug 1805402 \u003chttps://bugs.launchpad.net/keystone/+bug/1805402\u003e`_]"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3f79a3b5_7460190d","line":19,"in_reply_to":"3f79a3b5_4f231213","updated":"2018-12-07 08:16:20.000000000","message":"Maybe even with bullet points? I know it seems verbose but how else can an operator see exactly what\u0027s been changed in order to know how to adjust their custom policies for it?","commit_id":"56ae9854874f951a1cc1710af729b45bf503b77b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a6a4ed06cf1187baf40f39c51acd66d6defd2ea4","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    [`bug 1805402 \u003chttps://bugs.launchpad.net/keystone/+bug/1805402\u003e`_]"},{"line_number":17,"context_line":"    Several policies used to protect the role API have been deprecated"},{"line_number":18,"context_line":"    in favor of more clear and concise defaults. Please consider these"},{"line_number":19,"context_line":"    new default if your deployment overrides role policies."},{"line_number":20,"context_line":"security:"},{"line_number":21,"context_line":"  - |"},{"line_number":22,"context_line":"    [`bug 1805402 \u003chttps://bugs.launchpad.net/keystone/+bug/1805402\u003e`_]"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3f79a3b5_a1bf4b77","line":19,"in_reply_to":"3f79a3b5_7460190d","updated":"2018-12-07 15:55:54.000000000","message":"Done","commit_id":"56ae9854874f951a1cc1710af729b45bf503b77b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d7a98db6426fbe4a6aea1c032ea796cbef404e9f","unresolved":false,"context_lines":[{"line_number":17,"context_line":"    The following role policy check strings have been deprecated in"},{"line_number":18,"context_line":"    favor of more clear and concise defaults:"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    * ``identity:get_role``"},{"line_number":21,"context_line":"    * ``identity:list_roles``"},{"line_number":22,"context_line":"    * ``identity:create_role``"},{"line_number":23,"context_line":"    * ``identity:update_role``"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"dfd5e7cf_04d1f6cd","line":20,"updated":"2019-01-08 19:33:17.000000000","message":"Update these to explain what the new policies are.","commit_id":"666dc203686d9d6899f6a1c163c5dd534948b02e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d27c0ee077be3c8b378152b4dbb863a07a458af1","unresolved":false,"context_lines":[{"line_number":17,"context_line":"    The following role policy check strings have been deprecated in"},{"line_number":18,"context_line":"    favor of more clear and concise defaults:"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    * ``identity:get_role``"},{"line_number":21,"context_line":"    * ``identity:list_roles``"},{"line_number":22,"context_line":"    * ``identity:create_role``"},{"line_number":23,"context_line":"    * ``identity:update_role``"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"dfd5e7cf_ea0ef9e3","line":20,"in_reply_to":"dfd5e7cf_04d1f6cd","updated":"2019-01-08 20:48:40.000000000","message":"Done","commit_id":"666dc203686d9d6899f6a1c163c5dd534948b02e"}]}