)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a5487b7f2a4f2c8dbe3c6828f9e74bd1645c6059","unresolved":false,"context_lines":[{"line_number":22,"context_line":"  have a role on the new domain, then there is nothing they can do. A"},{"line_number":23,"context_line":"  Separate patch will address this issue."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Fixes bug 1287219"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Change-Id: I9d4380ac8586b2af0d7ba945ae5e38cc0d2adbd5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"AAAAWH%2F%2F7nM%3D","line":25,"updated":"2014-03-12 22:10:12.000000000","message":"Closes-Bug: 1287219\n\nDoes this bug exist in Launchpad?","commit_id":"7a7f270f963bb2b9df48798bfdcb2a8c120fd0dc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"cb65dded325a18630cb269ad8cfa03e8498a574f","unresolved":false,"context_lines":[{"line_number":22,"context_line":"  have a role on the new domain, then there is nothing they can do. A"},{"line_number":23,"context_line":"  Separate patch will address this issue."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Fixes bug 1287219"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Change-Id: I9d4380ac8586b2af0d7ba945ae5e38cc0d2adbd5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"AAAAWH%2F%2FsMY%3D","line":25,"in_reply_to":"AAAAWH%2F%2F4O4%3D","updated":"2014-03-14 13:30:58.000000000","message":"Ah, ok so I would guess it hasn\u0027t been made public yet?","commit_id":"7a7f270f963bb2b9df48798bfdcb2a8c120fd0dc"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"0a2050cddb9471dd4020ecec4c23413a2ac4dc09","unresolved":false,"context_lines":[{"line_number":22,"context_line":"  have a role on the new domain, then there is nothing they can do. A"},{"line_number":23,"context_line":"  Separate patch will address this issue."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Fixes bug 1287219"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Change-Id: I9d4380ac8586b2af0d7ba945ae5e38cc0d2adbd5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"AAAAWH%2F%2F4O4%3D","line":25,"in_reply_to":"AAAAWH%2F%2F7nM%3D","updated":"2014-03-13 07:27:40.000000000","message":"It does……I think marked as security vulnerability...","commit_id":"7a7f270f963bb2b9df48798bfdcb2a8c120fd0dc"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5ae7fc5bce2f571efac706b266bb1b27c51ca464","unresolved":false,"context_lines":[{"line_number":22,"context_line":"  have a role on the new domain, then there is nothing they can do. A"},{"line_number":23,"context_line":"  Separate patch will address this issue."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Fixes bug 1287219"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Change-Id: I9d4380ac8586b2af0d7ba945ae5e38cc0d2adbd5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"AAAAWH%2F%2Fmhs%3D","line":25,"in_reply_to":"AAAAWH%2F%2FsMY%3D","updated":"2014-03-15 09:53:11.000000000","message":"Yes, this should be Closes-Bug: xXXX\nThere should likely be a \"related-bug: YYYY\" for the subsequent fix that is pending as outlined in the commit message.","commit_id":"7a7f270f963bb2b9df48798bfdcb2a8c120fd0dc"}],"etc/policy.v3cloudsample.json":[{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"d0045049f8a774f759dbe3da6045e94bbdc823a3","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    \"identity:update_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id\","},{"line_number":44,"context_line":"    \"identity:delete_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id\","},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    \"admin_and_matching_target_user_domain_id\": \"rule:admin_required and domain_id:%(target.user.domain_id)s\","},{"line_number":47,"context_line":"    \"admin_and_matching_user_domain_id\": \"rule:admin_required and domain_id:%(user.domain_id)s\","},{"line_number":48,"context_line":"    \"identity:get_user\": \"rule:cloud_admin or rule:admin_and_matching_target_user_domain_id\","},{"line_number":49,"context_line":"    \"identity:list_users\": \"rule:cloud_admin or rule:admin_and_matching_domain_id\","}],"source_content_type":"application/json","patch_set":3,"id":"AAAAWH%2F%2F7yk%3D","line":46,"updated":"2014-03-12 20:45:36.000000000","message":"I believe we support cross domain scope token too. (ie) DomainAdmin for Domain A get a  Domain Scoped token for Domain B if he has a role there.  Will this rule support that use case?\n\nI understand that it has nothing to do with your change","commit_id":"7a7f270f963bb2b9df48798bfdcb2a8c120fd0dc"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c753abcfb212de8be0330c62409633e7b6294e97","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    \"identity:update_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id\","},{"line_number":44,"context_line":"    \"identity:delete_project\": \"rule:cloud_admin or rule:admin_and_matching_target_project_domain_id\","},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    \"admin_and_matching_target_user_domain_id\": \"rule:admin_required and domain_id:%(target.user.domain_id)s\","},{"line_number":47,"context_line":"    \"admin_and_matching_user_domain_id\": \"rule:admin_required and domain_id:%(user.domain_id)s\","},{"line_number":48,"context_line":"    \"identity:get_user\": \"rule:cloud_admin or rule:admin_and_matching_target_user_domain_id\","},{"line_number":49,"context_line":"    \"identity:list_users\": \"rule:cloud_admin or rule:admin_and_matching_domain_id\","}],"source_content_type":"application/json","patch_set":3,"id":"AAAAWH%2F%2F4Qs%3D","line":46,"in_reply_to":"AAAAWH%2F%2F7yk%3D","updated":"2014-03-13 07:24:49.000000000","message":"Sure, that is still supported.  Whether a token is issued or not does not depend on policy….it depends on, as you say, whether the the user has a role for the scope being requested (i.e. a specific domain or project).  Policy only comes into play when you try and use that token as proof of authorisation to make an API call.","commit_id":"7a7f270f963bb2b9df48798bfdcb2a8c120fd0dc"}],"keystone/tests/test_v3_protection.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5ae7fc5bce2f571efac706b266bb1b27c51ca464","unresolved":false,"context_lines":[{"line_number":587,"context_line":""},{"line_number":588,"context_line":"        self._test_grants(\u0027domains\u0027, self.domainA[\u0027id\u0027])"},{"line_number":589,"context_line":""},{"line_number":590,"context_line":"        # Check that with such a token we cannot modify grants on a"},{"line_number":591,"context_line":"        # different domain"},{"line_number":592,"context_line":"        self._test_grants(\u0027domains\u0027, self.domainB[\u0027id\u0027],"},{"line_number":593,"context_line":"                          expected\u003dexception.ForbiddenAction.code)"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAWH%2F%2Fmho%3D","line":590,"updated":"2014-03-15 09:53:11.000000000","message":"I would have preferred this be a specific test case rather than lumped into a currently existing test.","commit_id":"7a7f270f963bb2b9df48798bfdcb2a8c120fd0dc"}]}