)]}'
{"doc/source/contributor/services.rst":[{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"e1a4db6ba189c3a3310302395e35814473a8becd","unresolved":false,"context_lines":[{"line_number":225,"context_line":"How to I incorporate authorization scopes into a service?"},{"line_number":226,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"* start by testing the API ruthlessly with protection tests"},{"line_number":229,"context_line":"* audit the API, which APIs in the service are project-scoped, domain-scoped,"},{"line_number":230,"context_line":"  or system-scoped? Are some a mix? If the answers to these questions do not"},{"line_number":231,"context_line":"  reflect reality, you should document it somewhere. Keystone went through this"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9fdfeff1_425a6d83","line":228,"updated":"2019-02-22 01:49:41.000000000","message":"Link to examples of protection tests would be useful","commit_id":"21d81f46f88aa4cc1f42bd6b026af81c9c8af7e2"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d5925f973ed58f4e3bfcb288e2a724b60dd7f094","unresolved":false,"context_lines":[{"line_number":225,"context_line":"How to I incorporate authorization scopes into a service?"},{"line_number":226,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"* start by testing the API ruthlessly with protection tests"},{"line_number":229,"context_line":"* audit the API, which APIs in the service are project-scoped, domain-scoped,"},{"line_number":230,"context_line":"  or system-scoped? Are some a mix? If the answers to these questions do not"},{"line_number":231,"context_line":"  reflect reality, you should document it somewhere. Keystone went through this"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9fdfeff1_cd52d812","line":228,"in_reply_to":"9fdfeff1_425a6d83","updated":"2019-02-25 20:26:10.000000000","message":"Done","commit_id":"21d81f46f88aa4cc1f42bd6b026af81c9c8af7e2"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"e1a4db6ba189c3a3310302395e35814473a8becd","unresolved":false,"context_lines":[{"line_number":230,"context_line":"  or system-scoped? Are some a mix? If the answers to these questions do not"},{"line_number":231,"context_line":"  reflect reality, you should document it somewhere. Keystone went through this"},{"line_number":232,"context_line":"  exercise and we opened bugs to make sure we captured the behavior we desired"},{"line_number":233,"context_line":"  against the behavior we have"},{"line_number":234,"context_line":"* setting the scope_types variable and rewriting check strings"},{"line_number":235,"context_line":"* communicate, communicate, communicate"},{"line_number":236,"context_line":"* removing deprecated check strings"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9fdfeff1_224f29bf","line":233,"updated":"2019-02-22 01:49:41.000000000","message":"Link to examples of document/bugs would be useful","commit_id":"21d81f46f88aa4cc1f42bd6b026af81c9c8af7e2"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d5925f973ed58f4e3bfcb288e2a724b60dd7f094","unresolved":false,"context_lines":[{"line_number":230,"context_line":"  or system-scoped? Are some a mix? If the answers to these questions do not"},{"line_number":231,"context_line":"  reflect reality, you should document it somewhere. Keystone went through this"},{"line_number":232,"context_line":"  exercise and we opened bugs to make sure we captured the behavior we desired"},{"line_number":233,"context_line":"  against the behavior we have"},{"line_number":234,"context_line":"* setting the scope_types variable and rewriting check strings"},{"line_number":235,"context_line":"* communicate, communicate, communicate"},{"line_number":236,"context_line":"* removing deprecated check strings"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9fdfeff1_ed579c00","line":233,"in_reply_to":"9fdfeff1_224f29bf","updated":"2019-02-25 20:26:10.000000000","message":"Done","commit_id":"21d81f46f88aa4cc1f42bd6b026af81c9c8af7e2"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"e1a4db6ba189c3a3310302395e35814473a8becd","unresolved":false,"context_lines":[{"line_number":231,"context_line":"  reflect reality, you should document it somewhere. Keystone went through this"},{"line_number":232,"context_line":"  exercise and we opened bugs to make sure we captured the behavior we desired"},{"line_number":233,"context_line":"  against the behavior we have"},{"line_number":234,"context_line":"* setting the scope_types variable and rewriting check strings"},{"line_number":235,"context_line":"* communicate, communicate, communicate"},{"line_number":236,"context_line":"* removing deprecated check strings"},{"line_number":237,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9fdfeff1_e24841b4","line":234,"updated":"2019-02-22 01:49:41.000000000","message":"An example would be helpful, showing a before/after of the check string","commit_id":"21d81f46f88aa4cc1f42bd6b026af81c9c8af7e2"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d5925f973ed58f4e3bfcb288e2a724b60dd7f094","unresolved":false,"context_lines":[{"line_number":231,"context_line":"  reflect reality, you should document it somewhere. Keystone went through this"},{"line_number":232,"context_line":"  exercise and we opened bugs to make sure we captured the behavior we desired"},{"line_number":233,"context_line":"  against the behavior we have"},{"line_number":234,"context_line":"* setting the scope_types variable and rewriting check strings"},{"line_number":235,"context_line":"* communicate, communicate, communicate"},{"line_number":236,"context_line":"* removing deprecated check strings"},{"line_number":237,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9fdfeff1_cd6bb8b6","line":234,"in_reply_to":"9fdfeff1_e24841b4","updated":"2019-02-25 20:26:10.000000000","message":"I added links to some patches where we\u0027ve changed check strings. If those aren\u0027t clear though, I can add some here.","commit_id":"21d81f46f88aa4cc1f42bd6b026af81c9c8af7e2"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"e1a4db6ba189c3a3310302395e35814473a8becd","unresolved":false,"context_lines":[{"line_number":232,"context_line":"  exercise and we opened bugs to make sure we captured the behavior we desired"},{"line_number":233,"context_line":"  against the behavior we have"},{"line_number":234,"context_line":"* setting the scope_types variable and rewriting check strings"},{"line_number":235,"context_line":"* communicate, communicate, communicate"},{"line_number":236,"context_line":"* removing deprecated check strings"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"Auth Token middleware"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9fdfeff1_02d9c5f2","line":235,"updated":"2019-02-22 01:49:41.000000000","message":"It might just be me, but I\u0027d need it spelled out more that use of authorization scopes is a fundamental shift from the legacy way of doing things. That is, instead of an API that adjusts its behavior based on a fine-grained/complex custom policy.json configured by an operator, we have an API that adjusts its behavior based on the token scope it was called with and simpler or non-existent custom policy.json.\n\nAnd that end users need to be educated about how to set up roles with scopes and request different token scopes in Keystone before calling our API.","commit_id":"21d81f46f88aa4cc1f42bd6b026af81c9c8af7e2"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d5925f973ed58f4e3bfcb288e2a724b60dd7f094","unresolved":false,"context_lines":[{"line_number":232,"context_line":"  exercise and we opened bugs to make sure we captured the behavior we desired"},{"line_number":233,"context_line":"  against the behavior we have"},{"line_number":234,"context_line":"* setting the scope_types variable and rewriting check strings"},{"line_number":235,"context_line":"* communicate, communicate, communicate"},{"line_number":236,"context_line":"* removing deprecated check strings"},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"Auth Token middleware"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9fdfeff1_ad3d14bc","line":235,"in_reply_to":"9fdfeff1_02d9c5f2","updated":"2019-02-25 20:26:10.000000000","message":"Attempted to address this in the latest patch set. Let me know if you still have concerns, though.","commit_id":"21d81f46f88aa4cc1f42bd6b026af81c9c8af7e2"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3b477bdb13caf0294a14cca356b4cc3b1b9873c8","unresolved":false,"context_lines":[{"line_number":296,"context_line":"deeper into the service. Differences and intricacies between services make"},{"line_number":297,"context_line":"testing imperative to adopt a uniform, consistent approach. Positive and"},{"line_number":298,"context_line":"negative protection testing helps us assert users with specific roles can, or"},{"line_number":299,"context_line":"cannot, access APIs. A protection test is similar to an API, or functional"},{"line_number":300,"context_line":"test, but purely focused on the authoritative outcome. In other words,"},{"line_number":301,"context_line":"protection testing is sufficient when we can assert that a user is or isn\u0027t"},{"line_number":302,"context_line":"allowed to do or see something. For example, a user with a role assignment on"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9fdfeff1_cdc73898","line":299,"range":{"start_line":299,"start_character":64,"end_line":299,"end_character":74},"updated":"2019-02-25 20:56:45.000000000","message":"nit: function,","commit_id":"183c11ba62088d726496fa3d57a10bd6681f9eb3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3b477bdb13caf0294a14cca356b4cc3b1b9873c8","unresolved":false,"context_lines":[{"line_number":297,"context_line":"testing imperative to adopt a uniform, consistent approach. Positive and"},{"line_number":298,"context_line":"negative protection testing helps us assert users with specific roles can, or"},{"line_number":299,"context_line":"cannot, access APIs. A protection test is similar to an API, or functional"},{"line_number":300,"context_line":"test, but purely focused on the authoritative outcome. In other words,"},{"line_number":301,"context_line":"protection testing is sufficient when we can assert that a user is or isn\u0027t"},{"line_number":302,"context_line":"allowed to do or see something. For example, a user with a role assignment on"},{"line_number":303,"context_line":"project `foo` shouldn\u0027t be able to list volumes in project `bar`. A user with a"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9fdfeff1_edcc7cbc","line":300,"range":{"start_line":300,"start_character":0,"end_line":300,"end_character":4},"updated":"2019-02-25 20:56:45.000000000","message":"remove ,","commit_id":"183c11ba62088d726496fa3d57a10bd6681f9eb3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3b477bdb13caf0294a14cca356b4cc3b1b9873c8","unresolved":false,"context_lines":[{"line_number":374,"context_line":"step is to start using oslo.policy for scope checking, which reduces complexity"},{"line_number":375,"context_line":"in your service by having a library do some lifting for you. For example, if"},{"line_number":376,"context_line":"you have an API that requires a project-scoped token, you can set the scope of"},{"line_number":377,"context_line":"the policy protecting that API accordingly. If a ``RuleDefault`` instance has"},{"line_number":378,"context_line":"scope associate to it, oslo.policy checks that it matches the scope of the"},{"line_number":379,"context_line":"token used to make the request. Note that this behavior is configurable,"},{"line_number":380,"context_line":"allowing operators to turn it on once all policies have a scope type and once"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9fdfeff1_2d94c436","line":377,"range":{"start_line":377,"start_character":48,"end_line":377,"end_character":49},"updated":"2019-02-25 20:56:45.000000000","message":"an instance of RuleDefault*","commit_id":"183c11ba62088d726496fa3d57a10bd6681f9eb3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3b477bdb13caf0294a14cca356b4cc3b1b9873c8","unresolved":false,"context_lines":[{"line_number":375,"context_line":"in your service by having a library do some lifting for you. For example, if"},{"line_number":376,"context_line":"you have an API that requires a project-scoped token, you can set the scope of"},{"line_number":377,"context_line":"the policy protecting that API accordingly. If a ``RuleDefault`` instance has"},{"line_number":378,"context_line":"scope associate to it, oslo.policy checks that it matches the scope of the"},{"line_number":379,"context_line":"token used to make the request. Note that this behavior is configurable,"},{"line_number":380,"context_line":"allowing operators to turn it on once all policies have a scope type and once"},{"line_number":381,"context_line":"operators have audited their assignments and educated their users on how to get"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9fdfeff1_6d708c41","line":378,"range":{"start_line":378,"start_character":6,"end_line":378,"end_character":15},"updated":"2019-02-25 20:56:45.000000000","message":"associated","commit_id":"183c11ba62088d726496fa3d57a10bd6681f9eb3"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":174,"context_line":"`baz`. Let\u0027s also assume both projects contain instances running a workload. If"},{"line_number":175,"context_line":"Alice is a domain administrator for `Foo`, she should be able to pass her"},{"line_number":176,"context_line":"domain-scoped token to nova and ask for a list of instances. If nova supports"},{"line_number":177,"context_line":"domain-scoped token, the response would contain all instances in projects `bar`"},{"line_number":178,"context_line":"and `baz`."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"Another example of using a domain-scoped token would be if Alice wanted to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_1c3be29b","line":177,"range":{"start_line":177,"start_character":14,"end_line":177,"end_character":19},"updated":"2019-02-28 16:23:15.000000000","message":"(nit) tokens","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":174,"context_line":"`baz`. Let\u0027s also assume both projects contain instances running a workload. If"},{"line_number":175,"context_line":"Alice is a domain administrator for `Foo`, she should be able to pass her"},{"line_number":176,"context_line":"domain-scoped token to nova and ask for a list of instances. If nova supports"},{"line_number":177,"context_line":"domain-scoped token, the response would contain all instances in projects `bar`"},{"line_number":178,"context_line":"and `baz`."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"Another example of using a domain-scoped token would be if Alice wanted to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_195bef21","line":177,"range":{"start_line":177,"start_character":14,"end_line":177,"end_character":19},"in_reply_to":"9fdfeff1_1c3be29b","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":178,"context_line":"and `baz`."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"Another example of using a domain-scoped token would be if Alice wanted to"},{"line_number":181,"context_line":"create a new project in domain `Foo`. When Alice sends a create project request"},{"line_number":182,"context_line":"to keystone, keystone should ensure the new project is created within the `Foo`"},{"line_number":183,"context_line":"domain, since that\u0027s the authorization associated to Alice\u0027s token."},{"line_number":184,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_bc5656cd","line":181,"range":{"start_line":181,"start_character":57,"end_line":181,"end_character":71},"updated":"2019-02-28 16:23:15.000000000","message":"wonder if this should be quoted or backticked somehow?","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":178,"context_line":"and `baz`."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"Another example of using a domain-scoped token would be if Alice wanted to"},{"line_number":181,"context_line":"create a new project in domain `Foo`. When Alice sends a create project request"},{"line_number":182,"context_line":"to keystone, keystone should ensure the new project is created within the `Foo`"},{"line_number":183,"context_line":"domain, since that\u0027s the authorization associated to Alice\u0027s token."},{"line_number":184,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_d987a760","line":181,"range":{"start_line":181,"start_character":57,"end_line":181,"end_character":71},"in_reply_to":"9fdfeff1_bc5656cd","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":247,"context_line":"difficult because users with that role on a project shouldn\u0027t see data about"},{"line_number":248,"context_line":"hypervisors, which would violate tenancy. Operators could create a new role"},{"line_number":249,"context_line":"called `operator` or `system-reader`, but then those users would still need to"},{"line_number":250,"context_line":"have that role assigned on a project to access deployment-level APIs. The"},{"line_number":251,"context_line":"concept of getting project-scoped tokens to access deployment-level resources"},{"line_number":252,"context_line":"raises the cognitive bar for users. Furthermore, this requires deployers to"},{"line_number":253,"context_line":"maintain all of this in policy files. You can quickly see how only using"},{"line_number":254,"context_line":"project-scope limits our ability to protect APIs without convoluted or"},{"line_number":255,"context_line":"expensive-to-maintain solutions."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_dcd0faca","line":252,"range":{"start_line":250,"start_character":29,"end_line":252,"end_character":34},"updated":"2019-02-28 16:23:15.000000000","message":"maybe also hammer in the point by saying something like \"which makes no sense for abstractions like hypervisors that cannot belong to any project\"","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":247,"context_line":"difficult because users with that role on a project shouldn\u0027t see data about"},{"line_number":248,"context_line":"hypervisors, which would violate tenancy. Operators could create a new role"},{"line_number":249,"context_line":"called `operator` or `system-reader`, but then those users would still need to"},{"line_number":250,"context_line":"have that role assigned on a project to access deployment-level APIs. The"},{"line_number":251,"context_line":"concept of getting project-scoped tokens to access deployment-level resources"},{"line_number":252,"context_line":"raises the cognitive bar for users. Furthermore, this requires deployers to"},{"line_number":253,"context_line":"maintain all of this in policy files. You can quickly see how only using"},{"line_number":254,"context_line":"project-scope limits our ability to protect APIs without convoluted or"},{"line_number":255,"context_line":"expensive-to-maintain solutions."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_9c5b4d84","line":252,"range":{"start_line":250,"start_character":29,"end_line":252,"end_character":34},"in_reply_to":"9fdfeff1_dcd0faca","updated":"2019-03-01 16:39:32.000000000","message":"Stolen, thanks!","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":273,"context_line":"scope? Would these checks be configurable in policy or hardcoded in your"},{"line_number":274,"context_line":"service?"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"Chances are your solution might differ than that of another service. Having"},{"line_number":277,"context_line":"different scopes at your disposal, through keystone tokens, let\u0027s you build on"},{"line_number":278,"context_line":"a standard solution that other projects also consume, reducing the likelihood"},{"line_number":279,"context_line":"of accidentally developing inconsistencies between services. This commonality"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_5ca3aa43","line":276,"range":{"start_line":276,"start_character":39,"end_line":276,"end_character":43},"updated":"2019-02-28 16:23:15.000000000","message":"*from","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":273,"context_line":"scope? Would these checks be configurable in policy or hardcoded in your"},{"line_number":274,"context_line":"service?"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"Chances are your solution might differ than that of another service. Having"},{"line_number":277,"context_line":"different scopes at your disposal, through keystone tokens, let\u0027s you build on"},{"line_number":278,"context_line":"a standard solution that other projects also consume, reducing the likelihood"},{"line_number":279,"context_line":"of accidentally developing inconsistencies between services. This commonality"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_376041cf","line":276,"range":{"start_line":276,"start_character":12,"end_line":276,"end_character":25},"updated":"2019-02-28 16:23:15.000000000","message":"maybe instead of this sentence, \"Chances are, different services will come up with different, inconsistent solutions for the same problem\" to make the point that being different is bad and not necessary.","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":273,"context_line":"scope? Would these checks be configurable in policy or hardcoded in your"},{"line_number":274,"context_line":"service?"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"Chances are your solution might differ than that of another service. Having"},{"line_number":277,"context_line":"different scopes at your disposal, through keystone tokens, let\u0027s you build on"},{"line_number":278,"context_line":"a standard solution that other projects also consume, reducing the likelihood"},{"line_number":279,"context_line":"of accidentally developing inconsistencies between services. This commonality"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_7c9b0916","line":276,"range":{"start_line":276,"start_character":12,"end_line":276,"end_character":25},"in_reply_to":"9fdfeff1_376041cf","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":273,"context_line":"scope? Would these checks be configurable in policy or hardcoded in your"},{"line_number":274,"context_line":"service?"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"Chances are your solution might differ than that of another service. Having"},{"line_number":277,"context_line":"different scopes at your disposal, through keystone tokens, let\u0027s you build on"},{"line_number":278,"context_line":"a standard solution that other projects also consume, reducing the likelihood"},{"line_number":279,"context_line":"of accidentally developing inconsistencies between services. This commonality"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_822bd17f","line":276,"range":{"start_line":276,"start_character":39,"end_line":276,"end_character":43},"in_reply_to":"9fdfeff1_5ca3aa43","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"7cb47a05d820576866e82d81d76c1658f889e08e","unresolved":false,"context_lines":[{"line_number":274,"context_line":"service?"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"Chances are your solution might differ than that of another service. Having"},{"line_number":277,"context_line":"different scopes at your disposal, through keystone tokens, let\u0027s you build on"},{"line_number":278,"context_line":"a standard solution that other projects also consume, reducing the likelihood"},{"line_number":279,"context_line":"of accidentally developing inconsistencies between services. This commonality"},{"line_number":280,"context_line":"also gives us a similar set of terms we can use when we communicate with each"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_5690664e","line":277,"range":{"start_line":277,"start_character":60,"end_line":277,"end_character":65},"updated":"2019-02-28 16:56:37.000000000","message":"lets","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":274,"context_line":"service?"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"Chances are your solution might differ than that of another service. Having"},{"line_number":277,"context_line":"different scopes at your disposal, through keystone tokens, let\u0027s you build on"},{"line_number":278,"context_line":"a standard solution that other projects also consume, reducing the likelihood"},{"line_number":279,"context_line":"of accidentally developing inconsistencies between services. This commonality"},{"line_number":280,"context_line":"also gives us a similar set of terms we can use when we communicate with each"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_9c9eed03","line":277,"range":{"start_line":277,"start_character":60,"end_line":277,"end_character":65},"in_reply_to":"9fdfeff1_5690664e","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":314,"context_line":"allowing us to see the surface of the API a user has access to with a given"},{"line_number":315,"context_line":"assignment. This information helps audit the API to make sure the user has all"},{"line_number":316,"context_line":"the authorization to do what they `need"},{"line_number":317,"context_line":"\u003chttps://en.wikipedia.org/wiki/Principle_of_least_privilege\u003e`_, but nothing"},{"line_number":318,"context_line":"more. We should note inconsistencies here as feedback that we should fix,"},{"line_number":319,"context_line":"especially since operators are probably attempting to fix these inconsistencies"},{"line_number":320,"context_line":"through customized policy today."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_d7e695e7","line":317,"updated":"2019-02-28 16:23:15.000000000","message":"For readability of the raw RST maybe split the URLs out to the end of the section instead of doing this embedded-style","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":314,"context_line":"allowing us to see the surface of the API a user has access to with a given"},{"line_number":315,"context_line":"assignment. This information helps audit the API to make sure the user has all"},{"line_number":316,"context_line":"the authorization to do what they `need"},{"line_number":317,"context_line":"\u003chttps://en.wikipedia.org/wiki/Principle_of_least_privilege\u003e`_, but nothing"},{"line_number":318,"context_line":"more. We should note inconsistencies here as feedback that we should fix,"},{"line_number":319,"context_line":"especially since operators are probably attempting to fix these inconsistencies"},{"line_number":320,"context_line":"through customized policy today."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_240b15d5","line":317,"in_reply_to":"9fdfeff1_d7e695e7","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"7cb47a05d820576866e82d81d76c1658f889e08e","unresolved":false,"context_lines":[{"line_number":331,"context_line":"allowing us to be proactive and not reactive in our authoritative business"},{"line_number":332,"context_line":"logic."},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"To get started, refer to the oslo.policy documentation that describes"},{"line_number":335,"context_line":"techniques for writing useful protection tests. This document also describes"},{"line_number":336,"context_line":"some historical context you might recognize in your service and how you should"},{"line_number":337,"context_line":"deal with it. You can also look at protection tests examples in other services,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_16bdfeaf","line":334,"range":{"start_line":334,"start_character":29,"end_line":334,"end_character":54},"updated":"2019-02-28 16:56:37.000000000","message":"link?","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":331,"context_line":"allowing us to be proactive and not reactive in our authoritative business"},{"line_number":332,"context_line":"logic."},{"line_number":333,"context_line":""},{"line_number":334,"context_line":"To get started, refer to the oslo.policy documentation that describes"},{"line_number":335,"context_line":"techniques for writing useful protection tests. This document also describes"},{"line_number":336,"context_line":"some historical context you might recognize in your service and how you should"},{"line_number":337,"context_line":"deal with it. You can also look at protection tests examples in other services,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_84d68126","line":334,"range":{"start_line":334,"start_character":29,"end_line":334,"end_character":54},"in_reply_to":"9fdfeff1_16bdfeaf","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":336,"context_line":"some historical context you might recognize in your service and how you should"},{"line_number":337,"context_line":"deal with it. You can also look at protection tests examples in other services,"},{"line_number":338,"context_line":"like `keystone"},{"line_number":339,"context_line":"\u003chttps://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/protection/v3?id\u003d77e50e49c5af37780b8b4cfe8721ba28e8a58183\u003e`_"},{"line_number":340,"context_line":"or `cinder \u003chttps://review.openstack.org/#/c/602489/\u003e`_. Note that these"},{"line_number":341,"context_line":"examples test the three default roles provided from keystone (reader, member,"},{"line_number":342,"context_line":"and admin) against the three scopes keystone offers, allowing for nine"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_7756c95e","line":339,"updated":"2019-02-28 16:23:15.000000000","message":"This makes me think we should pull out everything we added to keystone/tests/unit/protection into a testing library so that everyone can benefit from that pattern","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":336,"context_line":"some historical context you might recognize in your service and how you should"},{"line_number":337,"context_line":"deal with it. You can also look at protection tests examples in other services,"},{"line_number":338,"context_line":"like `keystone"},{"line_number":339,"context_line":"\u003chttps://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/protection/v3?id\u003d77e50e49c5af37780b8b4cfe8721ba28e8a58183\u003e`_"},{"line_number":340,"context_line":"or `cinder \u003chttps://review.openstack.org/#/c/602489/\u003e`_. Note that these"},{"line_number":341,"context_line":"examples test the three default roles provided from keystone (reader, member,"},{"line_number":342,"context_line":"and admin) against the three scopes keystone offers, allowing for nine"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_c4a3299a","line":339,"in_reply_to":"9fdfeff1_7756c95e","updated":"2019-03-01 16:39:32.000000000","message":"Yeah - I agree, but I\u0027ve come up short with ideas on how to do that.\n\nIf people follow the template we use in keystone, they\u0027ll be writing integration tests since the APIs are called with a token. We have the luxury of using tokens in protection tests without requiring another service.\n\nWe talked about this a little bit with Patrole in Denver, but we never really came to a conclusion on how we can re-use things sanely.\n\nI\u0027m hoping that people are more familiar with the tests now that we\u0027re merging more of the patches (not only in keystone, but in other services, too). Maybe it\u0027s time to revisit this and see if we can find a better solution for re-use than developer documentation in oslo.policy.","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":361,"context_line":"idea of how each API is or isn\u0027t exposed to end users. You might also have a"},{"line_number":362,"context_line":"list of areas where policies could be improved. For example, maybe you noticed"},{"line_number":363,"context_line":"an API in your service that consumes project-scoped tokens to protect a"},{"line_number":364,"context_line":"system-level resource. If your service has a bug tracker, you can use it to"},{"line_number":365,"context_line":"document these gaps. The following are some `bug reports"},{"line_number":366,"context_line":"\u003chttp://tinyurl.com/y5jc4bmo\u003e`_ from when keystone audited its own API. For"},{"line_number":367,"context_line":"example, if your service has APIs for listing or getting resources, you could"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_7777a9d5","line":364,"updated":"2019-02-28 16:23:15.000000000","message":"or an API that only requires read-level access - and it would be good to mention somewhere in here how admin implies member implies reader so that people understand it\u0027s okay to have a policy use the reader role","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0dcad8408af40ccbd62fe3165b122897e831dad0","unresolved":false,"context_lines":[{"line_number":361,"context_line":"idea of how each API is or isn\u0027t exposed to end users. You might also have a"},{"line_number":362,"context_line":"list of areas where policies could be improved. For example, maybe you noticed"},{"line_number":363,"context_line":"an API in your service that consumes project-scoped tokens to protect a"},{"line_number":364,"context_line":"system-level resource. If your service has a bug tracker, you can use it to"},{"line_number":365,"context_line":"document these gaps. The following are some `bug reports"},{"line_number":366,"context_line":"\u003chttp://tinyurl.com/y5jc4bmo\u003e`_ from when keystone audited its own API. For"},{"line_number":367,"context_line":"example, if your service has APIs for listing or getting resources, you could"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_f56290d9","line":364,"in_reply_to":"9fdfeff1_44ff3965","updated":"2019-03-01 21:19:28.000000000","message":"+1 lgtm","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":361,"context_line":"idea of how each API is or isn\u0027t exposed to end users. You might also have a"},{"line_number":362,"context_line":"list of areas where policies could be improved. For example, maybe you noticed"},{"line_number":363,"context_line":"an API in your service that consumes project-scoped tokens to protect a"},{"line_number":364,"context_line":"system-level resource. If your service has a bug tracker, you can use it to"},{"line_number":365,"context_line":"document these gaps. The following are some `bug reports"},{"line_number":366,"context_line":"\u003chttp://tinyurl.com/y5jc4bmo\u003e`_ from when keystone audited its own API. For"},{"line_number":367,"context_line":"example, if your service has APIs for listing or getting resources, you could"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_44ff3965","line":364,"in_reply_to":"9fdfeff1_7777a9d5","updated":"2019-03-01 16:39:32.000000000","message":"++\n\nI completely glossed over that detail but it\u0027s totally relevant. I attempted to give this its own section of the guide above, explaining why the relationship between those three roles are beneficial and how it helps us write more concise policies.\n\nLet me know if it contains the detail you\u0027re looking for.","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":362,"context_line":"list of areas where policies could be improved. For example, maybe you noticed"},{"line_number":363,"context_line":"an API in your service that consumes project-scoped tokens to protect a"},{"line_number":364,"context_line":"system-level resource. If your service has a bug tracker, you can use it to"},{"line_number":365,"context_line":"document these gaps. The following are some `bug reports"},{"line_number":366,"context_line":"\u003chttp://tinyurl.com/y5jc4bmo\u003e`_ from when keystone audited its own API. For"},{"line_number":367,"context_line":"example, if your service has APIs for listing or getting resources, you could"},{"line_number":368,"context_line":"implement the reader role on that API."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_57a38543","line":365,"range":{"start_line":365,"start_character":21,"end_line":365,"end_character":43},"updated":"2019-02-28 16:23:15.000000000","message":"Doesn\u0027t make sense to say \"the following\" and then a link to an external reference in the same sentence, \"the following\" implies there\u0027s going to be a list spelled out in the next line or paragraph","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":362,"context_line":"list of areas where policies could be improved. For example, maybe you noticed"},{"line_number":363,"context_line":"an API in your service that consumes project-scoped tokens to protect a"},{"line_number":364,"context_line":"system-level resource. If your service has a bug tracker, you can use it to"},{"line_number":365,"context_line":"document these gaps. The following are some `bug reports"},{"line_number":366,"context_line":"\u003chttp://tinyurl.com/y5jc4bmo\u003e`_ from when keystone audited its own API. For"},{"line_number":367,"context_line":"example, if your service has APIs for listing or getting resources, you could"},{"line_number":368,"context_line":"implement the reader role on that API."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_045b7153","line":365,"range":{"start_line":365,"start_character":21,"end_line":365,"end_character":43},"in_reply_to":"9fdfeff1_57a38543","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":363,"context_line":"an API in your service that consumes project-scoped tokens to protect a"},{"line_number":364,"context_line":"system-level resource. If your service has a bug tracker, you can use it to"},{"line_number":365,"context_line":"document these gaps. The following are some `bug reports"},{"line_number":366,"context_line":"\u003chttp://tinyurl.com/y5jc4bmo\u003e`_ from when keystone audited its own API. For"},{"line_number":367,"context_line":"example, if your service has APIs for listing or getting resources, you could"},{"line_number":368,"context_line":"implement the reader role on that API."},{"line_number":369,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_17997d1d","line":366,"updated":"2019-02-28 16:23:15.000000000","message":"maybe just https://bugs.launchpad.net/keystone/?field.tag\u003dsystem-scope","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":363,"context_line":"an API in your service that consumes project-scoped tokens to protect a"},{"line_number":364,"context_line":"system-level resource. If your service has a bug tracker, you can use it to"},{"line_number":365,"context_line":"document these gaps. The following are some `bug reports"},{"line_number":366,"context_line":"\u003chttp://tinyurl.com/y5jc4bmo\u003e`_ from when keystone audited its own API. For"},{"line_number":367,"context_line":"example, if your service has APIs for listing or getting resources, you could"},{"line_number":368,"context_line":"implement the reader role on that API."},{"line_number":369,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_a48e25ce","line":366,"in_reply_to":"9fdfeff1_17997d1d","updated":"2019-03-01 16:39:32.000000000","message":"That was my original thought, but that query defaults to only returns bugs that are \"open\" and excludes bugs with fixes committed or released. In the event we fix everything in keystone, I\u0027d like the query to return the same examples, so people can reference those bug reports in the future.","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"7cb47a05d820576866e82d81d76c1658f889e08e","unresolved":false,"context_lines":[{"line_number":376,"context_line":"you have an API that requires a project-scoped token, you can set the scope of"},{"line_number":377,"context_line":"the policy protecting that API accordingly. If an instance of ``RuleDefault``"},{"line_number":378,"context_line":"has scope associated to it, oslo.policy checks that it matches the scope of the"},{"line_number":379,"context_line":"token used to make the request. This behavior is configurable, allowing"},{"line_number":380,"context_line":"operators to turn it on once all policies have a scope type and once operators"},{"line_number":381,"context_line":"have audited their assignments and educated their users on how to get the scope"},{"line_number":382,"context_line":"necessary to access an API. Once that happens, an operator can configure"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_f6d63af2","line":379,"range":{"start_line":379,"start_character":32,"end_line":379,"end_character":61},"updated":"2019-02-28 16:56:37.000000000","message":"maybe a link to the oslo.policy doc that talks about it?","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":376,"context_line":"you have an API that requires a project-scoped token, you can set the scope of"},{"line_number":377,"context_line":"the policy protecting that API accordingly. If an instance of ``RuleDefault``"},{"line_number":378,"context_line":"has scope associated to it, oslo.policy checks that it matches the scope of the"},{"line_number":379,"context_line":"token used to make the request. This behavior is configurable, allowing"},{"line_number":380,"context_line":"operators to turn it on once all policies have a scope type and once operators"},{"line_number":381,"context_line":"have audited their assignments and educated their users on how to get the scope"},{"line_number":382,"context_line":"necessary to access an API. Once that happens, an operator can configure"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_c7648bb5","line":379,"range":{"start_line":379,"start_character":32,"end_line":379,"end_character":61},"in_reply_to":"9fdfeff1_f6d63af2","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":394,"context_line":"thinking about the intended user. Are they an operator managing the deployment?"},{"line_number":395,"context_line":"Then you might choose `system`. Are they an end user meant to operate only"},{"line_number":396,"context_line":"within a given project? Then `project` scope is likely what you need. Scopes"},{"line_number":397,"context_line":"aren\u0027t mutually exclusive. You may have APIs that require both. Keystone\u0027s user"},{"line_number":398,"context_line":"and project APIs are good examples of resources that need different scopes. If"},{"line_number":399,"context_line":"you still can\u0027t seem to find a solution, don\u0027t hesitate to send a note to the"},{"line_number":400,"context_line":"OpenStack Discuss mailing list tagged with [keystone] or ask in"},{"line_number":401,"context_line":"#openstack-keystone on IRC."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_7356dcd0","line":398,"range":{"start_line":397,"start_character":27,"end_line":398,"end_character":75},"updated":"2019-02-28 16:23:15.000000000","message":"Maybe recommend what they need to do in order to accomodate a policy rule that has two scopes - since it won\u0027t be handled automatically by oslo.policy, the different behaviors need to be handled in the API code.","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":394,"context_line":"thinking about the intended user. Are they an operator managing the deployment?"},{"line_number":395,"context_line":"Then you might choose `system`. Are they an end user meant to operate only"},{"line_number":396,"context_line":"within a given project? Then `project` scope is likely what you need. Scopes"},{"line_number":397,"context_line":"aren\u0027t mutually exclusive. You may have APIs that require both. Keystone\u0027s user"},{"line_number":398,"context_line":"and project APIs are good examples of resources that need different scopes. If"},{"line_number":399,"context_line":"you still can\u0027t seem to find a solution, don\u0027t hesitate to send a note to the"},{"line_number":400,"context_line":"OpenStack Discuss mailing list tagged with [keystone] or ask in"},{"line_number":401,"context_line":"#openstack-keystone on IRC."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_020e0131","line":398,"range":{"start_line":397,"start_character":27,"end_line":398,"end_character":75},"in_reply_to":"9fdfeff1_7356dcd0","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":397,"context_line":"aren\u0027t mutually exclusive. You may have APIs that require both. Keystone\u0027s user"},{"line_number":398,"context_line":"and project APIs are good examples of resources that need different scopes. If"},{"line_number":399,"context_line":"you still can\u0027t seem to find a solution, don\u0027t hesitate to send a note to the"},{"line_number":400,"context_line":"OpenStack Discuss mailing list tagged with [keystone] or ask in"},{"line_number":401,"context_line":"#openstack-keystone on IRC."},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"Rewriting check string"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_f3696c8b","line":400,"range":{"start_line":400,"start_character":0,"end_line":400,"end_character":30},"updated":"2019-02-28 16:23:15.000000000","message":"add a link","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":397,"context_line":"aren\u0027t mutually exclusive. You may have APIs that require both. Keystone\u0027s user"},{"line_number":398,"context_line":"and project APIs are good examples of resources that need different scopes. If"},{"line_number":399,"context_line":"you still can\u0027t seem to find a solution, don\u0027t hesitate to send a note to the"},{"line_number":400,"context_line":"OpenStack Discuss mailing list tagged with [keystone] or ask in"},{"line_number":401,"context_line":"#openstack-keystone on IRC."},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"Rewriting check string"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_8708c3d8","line":400,"range":{"start_line":400,"start_character":0,"end_line":400,"end_character":30},"in_reply_to":"9fdfeff1_f3696c8b","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":406,"context_line":"With oslo.policy able to check scope, you can start refactoring check strings"},{"line_number":407,"context_line":"where-ever necessary. For example, adding support for default roles or removing"},{"line_number":408,"context_line":"hardcoded ``is_admin: True`` checks. Remember that oslo.policy provides"},{"line_number":409,"context_line":"deprecation tooling that makes upgrades easier for operators. We encourage you"},{"line_number":410,"context_line":"to use the deprecation tooling when you change check strings. The following are"},{"line_number":411,"context_line":"a couple of `examples"},{"line_number":412,"context_line":"\u003chttps://review.openstack.org/#/q/(status:open+OR+status:merged)+project:openstack/keystone+branch:master+topic:implement-default-roles\u003e`_"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_d331c8a3","line":409,"range":{"start_line":409,"start_character":0,"end_line":409,"end_character":60},"updated":"2019-02-28 16:23:15.000000000","message":"make it clear how it works - it\u0027s an OR operation and so it causes policies to be more permissive","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":406,"context_line":"With oslo.policy able to check scope, you can start refactoring check strings"},{"line_number":407,"context_line":"where-ever necessary. For example, adding support for default roles or removing"},{"line_number":408,"context_line":"hardcoded ``is_admin: True`` checks. Remember that oslo.policy provides"},{"line_number":409,"context_line":"deprecation tooling that makes upgrades easier for operators. We encourage you"},{"line_number":410,"context_line":"to use the deprecation tooling when you change check strings. The following are"},{"line_number":411,"context_line":"a couple of `examples"},{"line_number":412,"context_line":"\u003chttps://review.openstack.org/#/q/(status:open+OR+status:merged)+project:openstack/keystone+branch:master+topic:implement-default-roles\u003e`_"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_47b5fbeb","line":409,"range":{"start_line":409,"start_character":0,"end_line":409,"end_character":60},"in_reply_to":"9fdfeff1_d331c8a3","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"427bd55c57026277a0018fd15c19badf01fb1632","unresolved":false,"context_lines":[{"line_number":407,"context_line":"where-ever necessary. For example, adding support for default roles or removing"},{"line_number":408,"context_line":"hardcoded ``is_admin: True`` checks. Remember that oslo.policy provides"},{"line_number":409,"context_line":"deprecation tooling that makes upgrades easier for operators. We encourage you"},{"line_number":410,"context_line":"to use the deprecation tooling when you change check strings. The following are"},{"line_number":411,"context_line":"a couple of `examples"},{"line_number":412,"context_line":"\u003chttps://review.openstack.org/#/q/(status:open+OR+status:merged)+project:openstack/keystone+branch:master+topic:implement-default-roles\u003e`_"},{"line_number":413,"context_line":"that show how to build descriptive rule objects using all the default roles"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_1313d002","line":410,"range":{"start_line":410,"start_character":62,"end_line":410,"end_character":75},"updated":"2019-02-28 16:23:15.000000000","message":"again weird use of \"the following\"","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ad404673b68a6bf5c821fe331b338d920523696","unresolved":false,"context_lines":[{"line_number":407,"context_line":"where-ever necessary. For example, adding support for default roles or removing"},{"line_number":408,"context_line":"hardcoded ``is_admin: True`` checks. Remember that oslo.policy provides"},{"line_number":409,"context_line":"deprecation tooling that makes upgrades easier for operators. We encourage you"},{"line_number":410,"context_line":"to use the deprecation tooling when you change check strings. The following are"},{"line_number":411,"context_line":"a couple of `examples"},{"line_number":412,"context_line":"\u003chttps://review.openstack.org/#/q/(status:open+OR+status:merged)+project:openstack/keystone+branch:master+topic:implement-default-roles\u003e`_"},{"line_number":413,"context_line":"that show how to build descriptive rule objects using all the default roles"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9fdfeff1_071db30d","line":410,"range":{"start_line":410,"start_character":62,"end_line":410,"end_character":75},"in_reply_to":"9fdfeff1_1313d002","updated":"2019-03-01 16:39:32.000000000","message":"Done","commit_id":"cc44258f8a67c4fe8c0e8c2a710a9ec7c01f255e"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0dcad8408af40ccbd62fe3165b122897e831dad0","unresolved":false,"context_lines":[{"line_number":245,"context_line":"called `operator` or `system-reader`, but then those users would still need to"},{"line_number":246,"context_line":"have that role assigned on a project to access deployment-level APIs. The"},{"line_number":247,"context_line":"concept of getting project-scoped tokens to access deployment-level resources"},{"line_number":248,"context_line":"raises the cognitive bar for users, which makes no sense for abstractions like"},{"line_number":249,"context_line":"hypervisors that cannot belong to a single project. Furthermore, this requires"},{"line_number":250,"context_line":"deployers to maintain all of this in policy files. You can quickly see how only"},{"line_number":251,"context_line":"using project-scope limits our ability to protect APIs without convoluted or"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9fdfeff1_5216125b","line":248,"range":{"start_line":248,"start_character":36,"end_line":248,"end_character":41},"updated":"2019-03-01 21:19:28.000000000","message":"This ended up not being very smooth, it sounds like the \"which makes no sense\" applies to the \"cognitive bar\", when it should apply to the \"those users would still need to have that role assigned on a project\"","commit_id":"4abcdc3ccc0ea40e8d644d52b98cb67df48f68a1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8a242f074583efbb39170e661cd91d48038a1995","unresolved":false,"context_lines":[{"line_number":245,"context_line":"called `operator` or `system-reader`, but then those users would still need to"},{"line_number":246,"context_line":"have that role assigned on a project to access deployment-level APIs. The"},{"line_number":247,"context_line":"concept of getting project-scoped tokens to access deployment-level resources"},{"line_number":248,"context_line":"raises the cognitive bar for users, which makes no sense for abstractions like"},{"line_number":249,"context_line":"hypervisors that cannot belong to a single project. Furthermore, this requires"},{"line_number":250,"context_line":"deployers to maintain all of this in policy files. You can quickly see how only"},{"line_number":251,"context_line":"using project-scope limits our ability to protect APIs without convoluted or"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9fdfeff1_83774ea0","line":248,"range":{"start_line":248,"start_character":36,"end_line":248,"end_character":41},"in_reply_to":"9fdfeff1_5216125b","updated":"2019-03-01 22:40:40.000000000","message":"Good call, reworded a bit.","commit_id":"4abcdc3ccc0ea40e8d644d52b98cb67df48f68a1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0dcad8408af40ccbd62fe3165b122897e831dad0","unresolved":false,"context_lines":[{"line_number":421,"context_line":"improved. For example, maybe you noticed an API in your service that consumes"},{"line_number":422,"context_line":"project-scoped tokens to protect a system-level resource. If your service has a"},{"line_number":423,"context_line":"bug tracker, you can use it to document these gaps. The keystone team went"},{"line_number":424,"context_line":"through this exercise and used bugs_. Feel free to use these bugs reports as a"},{"line_number":425,"context_line":"template for describing gaps in policy enforcement. For example, if your"},{"line_number":426,"context_line":"service has APIs for listing or getting resources, you could implement the"},{"line_number":427,"context_line":"reader role on that API."}],"source_content_type":"text/x-rst","patch_set":7,"id":"9fdfeff1_15a154f8","line":424,"range":{"start_line":424,"start_character":61,"end_line":424,"end_character":65},"updated":"2019-03-01 21:19:28.000000000","message":"*bug","commit_id":"4abcdc3ccc0ea40e8d644d52b98cb67df48f68a1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8a242f074583efbb39170e661cd91d48038a1995","unresolved":false,"context_lines":[{"line_number":421,"context_line":"improved. For example, maybe you noticed an API in your service that consumes"},{"line_number":422,"context_line":"project-scoped tokens to protect a system-level resource. If your service has a"},{"line_number":423,"context_line":"bug tracker, you can use it to document these gaps. The keystone team went"},{"line_number":424,"context_line":"through this exercise and used bugs_. Feel free to use these bugs reports as a"},{"line_number":425,"context_line":"template for describing gaps in policy enforcement. For example, if your"},{"line_number":426,"context_line":"service has APIs for listing or getting resources, you could implement the"},{"line_number":427,"context_line":"reader role on that API."}],"source_content_type":"text/x-rst","patch_set":7,"id":"9fdfeff1_23530219","line":424,"range":{"start_line":424,"start_character":61,"end_line":424,"end_character":65},"in_reply_to":"9fdfeff1_15a154f8","updated":"2019-03-01 22:40:40.000000000","message":"Done","commit_id":"4abcdc3ccc0ea40e8d644d52b98cb67df48f68a1"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"3545645cf3e1201f09ec92bac5b12f0b4dcee584","unresolved":false,"context_lines":[{"line_number":165,"context_line":"following is an example of how a domain-scoped token could be used against a"},{"line_number":166,"context_line":"service."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Assume a domain exists called `Foo`, and it contains projects call `bar` and"},{"line_number":169,"context_line":"`baz`. Let\u0027s also assume both projects contain instances running a workload. If"},{"line_number":170,"context_line":"Alice is a domain administrator for `Foo`, she should be able to pass her"},{"line_number":171,"context_line":"domain-scoped token to nova and ask for a list of instances. If nova supports"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5fc1f717_b875c29a","line":168,"range":{"start_line":168,"start_character":62,"end_line":168,"end_character":66},"updated":"2019-03-06 17:06:00.000000000","message":"nit: called","commit_id":"4eff6816bb4c3e8ec116d7438dce469e24e12c20"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6303f8f80956eda7f7a96a3d7d44433595647be0","unresolved":false,"context_lines":[{"line_number":165,"context_line":"following is an example of how a domain-scoped token could be used against a"},{"line_number":166,"context_line":"service."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Assume a domain exists called `Foo`, and it contains projects call `bar` and"},{"line_number":169,"context_line":"`baz`. Let\u0027s also assume both projects contain instances running a workload. If"},{"line_number":170,"context_line":"Alice is a domain administrator for `Foo`, she should be able to pass her"},{"line_number":171,"context_line":"domain-scoped token to nova and ask for a list of instances. If nova supports"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5fc1f717_71e69419","line":168,"range":{"start_line":168,"start_character":62,"end_line":168,"end_character":66},"in_reply_to":"5fc1f717_b875c29a","updated":"2019-03-06 19:33:28.000000000","message":"Done","commit_id":"4eff6816bb4c3e8ec116d7438dce469e24e12c20"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"3545645cf3e1201f09ec92bac5b12f0b4dcee584","unresolved":false,"context_lines":[{"line_number":301,"context_line":""},{"line_number":302,"context_line":"Keep in mind, the examples above are only meant to describe the need for other"},{"line_number":303,"context_line":"roles besides `admin` in a deployment. Service developers should be able to"},{"line_number":304,"context_line":"reuse these definitions for similar APIs and assume those roles exist. As a"},{"line_number":305,"context_line":"result, keystone implemented support for ensuring the `admin`, `member`, and"},{"line_number":306,"context_line":"`reader` roles are present during the installation process, specifically when"},{"line_number":307,"context_line":"running ``keystone-manage bootstrap``. Additionally, keystone creates a"},{"line_number":308,"context_line":"relationship among these roles that make them easier for service developers to"},{"line_number":309,"context_line":"use. During creation, keystone implies that the `admin` role is a superset of"},{"line_number":310,"context_line":"the `member` role, and the `member` role is a superset of the `reader` role."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5fc1f717_b85f02e4","line":307,"range":{"start_line":304,"start_character":71,"end_line":307,"end_character":38},"updated":"2019-03-06 17:06:00.000000000","message":"nit: While keystone does create the reader role, not many services support it. This may lead to confusion among cloud administrator expecting the reader to be fully functional out of the box. Might be worth clarifying that this is pending individual service support, or the cloud administrator manually changing the policy files to support that. This is the contributor guide, so this is not the right place for this comment, which targets operators.","commit_id":"4eff6816bb4c3e8ec116d7438dce469e24e12c20"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6303f8f80956eda7f7a96a3d7d44433595647be0","unresolved":false,"context_lines":[{"line_number":301,"context_line":""},{"line_number":302,"context_line":"Keep in mind, the examples above are only meant to describe the need for other"},{"line_number":303,"context_line":"roles besides `admin` in a deployment. Service developers should be able to"},{"line_number":304,"context_line":"reuse these definitions for similar APIs and assume those roles exist. As a"},{"line_number":305,"context_line":"result, keystone implemented support for ensuring the `admin`, `member`, and"},{"line_number":306,"context_line":"`reader` roles are present during the installation process, specifically when"},{"line_number":307,"context_line":"running ``keystone-manage bootstrap``. Additionally, keystone creates a"},{"line_number":308,"context_line":"relationship among these roles that make them easier for service developers to"},{"line_number":309,"context_line":"use. During creation, keystone implies that the `admin` role is a superset of"},{"line_number":310,"context_line":"the `member` role, and the `member` role is a superset of the `reader` role."}],"source_content_type":"text/x-rst","patch_set":8,"id":"5fc1f717_113390ad","line":307,"range":{"start_line":304,"start_character":71,"end_line":307,"end_character":38},"in_reply_to":"5fc1f717_b85f02e4","updated":"2019-03-06 19:33:28.000000000","message":"Yeah - we describe some of that in the spec [0].\n\nAre you thinking it needs another callout? Release note or something?\n\n[0] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/rocky/define-default-roles.html#proposed-change","commit_id":"4eff6816bb4c3e8ec116d7438dce469e24e12c20"},{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"3ea3e105697acdd55882233cbeb342b31c4610ba","unresolved":false,"context_lines":[{"line_number":321,"context_line":""},{"line_number":322,"context_line":"   \"service:foobar:get\": \"role:admin OR role:member OR role:reader\""},{"line_number":323,"context_line":"   \"service:foobar:list\": \"role:admin OR role:member OR role:reader\""},{"line_number":324,"context_line":"   \"service:foobar:create\": \"role:admin OR role:member\""},{"line_number":325,"context_line":"   \"service:foobar:update\": \"role:admin OR role:member\""},{"line_number":326,"context_line":"   \"service:foobar:delete\": \"role:admin\""},{"line_number":327,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9fdfeff1_8318801e","line":324,"range":{"start_line":324,"start_character":0,"end_line":324,"end_character":55},"updated":"2019-03-05 10:44:12.000000000","message":"Could you please tell me the API which can create with member role? I might have missed the API\u0027s for which member can create.","commit_id":"4eff6816bb4c3e8ec116d7438dce469e24e12c20"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2960de5c0ad0cd040dfc12a3345461bf84641066","unresolved":false,"context_lines":[{"line_number":321,"context_line":""},{"line_number":322,"context_line":"   \"service:foobar:get\": \"role:admin OR role:member OR role:reader\""},{"line_number":323,"context_line":"   \"service:foobar:list\": \"role:admin OR role:member OR role:reader\""},{"line_number":324,"context_line":"   \"service:foobar:create\": \"role:admin OR role:member\""},{"line_number":325,"context_line":"   \"service:foobar:update\": \"role:admin OR role:member\""},{"line_number":326,"context_line":"   \"service:foobar:delete\": \"role:admin\""},{"line_number":327,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9fdfeff1_86440949","line":324,"range":{"start_line":324,"start_character":0,"end_line":324,"end_character":55},"in_reply_to":"9fdfeff1_8318801e","updated":"2019-03-05 14:57:04.000000000","message":"Keystone is in an interesting place with the member role. There aren\u0027t many APIs in keystone that justify the member role.\n\nFor most purposes in keystone, the member role is effectively the `reader` role. We included the `member` role during the bootstrap process so that other projects have a little more flexibility.\n\nThe policies here are hypothetical, just to show an example of how a developer could write policies for another service.","commit_id":"4eff6816bb4c3e8ec116d7438dce469e24e12c20"},{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"e2b3394233b90cdd6ee77214a6e8d6238e5ac8ec","unresolved":false,"context_lines":[{"line_number":321,"context_line":""},{"line_number":322,"context_line":"   \"service:foobar:get\": \"role:admin OR role:member OR role:reader\""},{"line_number":323,"context_line":"   \"service:foobar:list\": \"role:admin OR role:member OR role:reader\""},{"line_number":324,"context_line":"   \"service:foobar:create\": \"role:admin OR role:member\""},{"line_number":325,"context_line":"   \"service:foobar:update\": \"role:admin OR role:member\""},{"line_number":326,"context_line":"   \"service:foobar:delete\": \"role:admin\""},{"line_number":327,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9fdfeff1_a90a3e24","line":324,"range":{"start_line":324,"start_character":0,"end_line":324,"end_character":55},"in_reply_to":"9fdfeff1_86440949","updated":"2019-03-05 15:57:32.000000000","message":"Got it. Thanks Lance.","commit_id":"4eff6816bb4c3e8ec116d7438dce469e24e12c20"}]}