)]}'
{"doc/config-reference/app_policy_json.xml":[{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":14,"context_line":"    which way, and are defined in the service’s \u003cfilename\u003epolicy.json\u003c/filename\u003e"},{"line_number":15,"context_line":"    file.\u003c/para\u003e"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"    \u003cpara\u003eWhenever an API call to an OpenStack service is made, the service’s policy"},{"line_number":18,"context_line":"    engine uses the appropriate policy definitions to determine if the call can be"},{"line_number":19,"context_line":"    accepted. Any changes to \u003cfilename\u003epolicy.json\u003c/filename\u003e are effective immediately,"},{"line_number":20,"context_line":"    which allows"}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_0b45116f","line":17,"updated":"2015-05-01 03:16:24.000000000","message":"Sorry about the driveby, but you can please change the smart apostrophe in \"service\u0027s\" to a straight one?","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    \u003cpara\u003eAs the name implies, \u003cfilename\u003epolicy.json\u003c/filename\u003e files are in JSON (Javascript"},{"line_number":24,"context_line":"    Object Notation) format. A policy is defined by a statement of the general form"},{"line_number":25,"context_line":"    \u003ccode\u003e\"\u0026lt;target\u0026gt;\" : \"\u0026lt;rule\u0026gt;\"\u003c/code\u003e.\u003c/para\u003e"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"    \u003cpara\u003e"},{"line_number":28,"context_line":"    The policy target, also named \"action\", represents an API call like \"start an instance\" or"}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_2b4e8d96","line":25,"updated":"2015-05-01 03:16:24.000000000","message":"I would reword this as follows:\n\n\"Policies are defined by statements in the \u003cfilename\u003epolicy.json\u003c/filename\u003e file. Statements should be in the form \u003ccode\u003e\"\u0026lt;target\u0026gt;\" : \"\u0026lt;rule\u0026gt;\"\u003c/code\u003e.\"","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    \u003cpara\u003e"},{"line_number":28,"context_line":"    The policy target, also named \"action\", represents an API call like \"start an instance\" or"},{"line_number":29,"context_line":"    \"attach a volume\"."},{"line_number":30,"context_line":"    \u003c?sbr?\u003eAction names are usually qualified."},{"line_number":31,"context_line":"    Example: OpenStack Compute features API calls to list instances,"},{"line_number":32,"context_line":"    volumes and networks. In \u003cfilename\u003e/etc/nova/policy.json\u003c/filename\u003e, these APIs are"},{"line_number":33,"context_line":"    represented by \u003ccode\u003ecompute:get_all\u003c/code\u003e, \u003ccode\u003evolume:get_all\u003c/code\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_6b548520","line":30,"updated":"2015-05-01 03:16:24.000000000","message":"What\u0027s the \u003c?sbr?\u003e mean here (and in lines 36, 123, 126, \u0026 128)?","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bc98aa45c09e013bdcca9063a3a0aa34ae0a7bc3","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    volumes and networks. In \u003cfilename\u003e/etc/nova/policy.json\u003c/filename\u003e, these APIs are"},{"line_number":33,"context_line":"    represented by \u003ccode\u003ecompute:get_all\u003c/code\u003e, \u003ccode\u003evolume:get_all\u003c/code\u003e"},{"line_number":34,"context_line":"    and \u003ccode\u003enetwork:get_all\u003c/code\u003e, respectively."},{"line_number":35,"context_line":"    networks and images."},{"line_number":36,"context_line":"    \u003c?sbr?\u003eThe mapping between API calls and actions is not generally documented.\u003c/para\u003e"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    \u003cpara\u003eThe policy rule determines under which circumstances the API call"}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_c99f3a5e","line":35,"updated":"2015-04-30 13:55:52.000000000","message":"is this an error? doesn\u0027t seem like a full sentence","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    volumes and networks. In \u003cfilename\u003e/etc/nova/policy.json\u003c/filename\u003e, these APIs are"},{"line_number":33,"context_line":"    represented by \u003ccode\u003ecompute:get_all\u003c/code\u003e, \u003ccode\u003evolume:get_all\u003c/code\u003e"},{"line_number":34,"context_line":"    and \u003ccode\u003enetwork:get_all\u003c/code\u003e, respectively."},{"line_number":35,"context_line":"    networks and images."},{"line_number":36,"context_line":"    \u003c?sbr?\u003eThe mapping between API calls and actions is not generally documented.\u003c/para\u003e"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    \u003cpara\u003eThe policy rule determines under which circumstances the API call"}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_4b32e911","line":35,"in_reply_to":"3acd31a7_c99f3a5e","updated":"2015-05-01 03:16:24.000000000","message":"+1","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    \u003cpara\u003eThe policy rule determines under which circumstances the API call"},{"line_number":39,"context_line":"    is permitted. Usually this involves the user who makes the"},{"line_number":40,"context_line":"    call, thereafter named the \"API user\" for simplicity, and often the object on which the"},{"line_number":41,"context_line":"    API call operates. A typical rule checks if the API user is the object\u0027s owner.\u003c/para\u003e"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    \u003ccaution\u003e\u003ctitle\u003eTweaking the policy\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_eb3e55d9","line":40,"updated":"2015-05-01 03:16:24.000000000","message":"I\u0027d move the parenthetical statement to parentheses, make it \u0027hereafter\u0027 (as it\u0027s referring to something that\u0027s happening here in this document) and remove the \"for simplicity\", like so:\n\n\"... makes the call (hereafter named the \"API user\") and often the object ...\"","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    call, thereafter named the \"API user\" for simplicity, and often the object on which the"},{"line_number":41,"context_line":"    API call operates. A typical rule checks if the API user is the object\u0027s owner.\u003c/para\u003e"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    \u003ccaution\u003e\u003ctitle\u003eTweaking the policy\u003c/title\u003e"},{"line_number":44,"context_line":"    \u003cpara\u003e"},{"line_number":45,"context_line":"    While recipes for modifying \u003cfilename\u003epolicy.json\u003c/filename\u003e files"},{"line_number":46,"context_line":"    are found on blogs, changing the policy can have unexpected side effects and is"}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_cb26f9cd","line":43,"updated":"2015-05-01 03:16:24.000000000","message":"\"Tweaking\" might not translate well. Can we change this to \"adjusting\" or \"modifying\"?","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    of the Compute service. The rule is an empty string meaning \"always\". This policy"},{"line_number":60,"context_line":"    allows anybody to list instances.\u003c/para\u003e"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    \u003cpara\u003eThis is how you would decline permission to use an API:"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    \u003cprogramlisting language\u003d\"json\"\u003e\"compute:shelve\": \"!\"\u003c/programlisting\u003e"},{"line_number":65,"context_line":""}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_4b19c987","line":62,"updated":"2015-05-01 03:16:24.000000000","message":"I liked the original better.","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":116,"context_line":"\"identity:change_password\": \"rule:admin_or_owner\"\u003c/programlisting\u003e"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"    The first line defines an alias for \"user is an admin user\"."},{"line_number":119,"context_line":"    \u003ccode\u003eis_admin\u003c/code\u003e is a flag that is only used when setting"},{"line_number":120,"context_line":"    up the Identity service for the first time. It indicates that the user"},{"line_number":121,"context_line":"    has admin privileges thanks to the service token (\u003ccode\u003e--os-token\u003c/code\u003e"},{"line_number":122,"context_line":"    parameter of the \u003ccode\u003ekeystone\u003c/code\u003e command line client)."}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_eb153549","line":119,"updated":"2015-05-01 03:16:24.000000000","message":"\"The \u003ccode\u003eis_admin\u003c/code\u003e flag is only used when ...\"","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":118,"context_line":"    The first line defines an alias for \"user is an admin user\"."},{"line_number":119,"context_line":"    \u003ccode\u003eis_admin\u003c/code\u003e is a flag that is only used when setting"},{"line_number":120,"context_line":"    up the Identity service for the first time. It indicates that the user"},{"line_number":121,"context_line":"    has admin privileges thanks to the service token (\u003ccode\u003e--os-token\u003c/code\u003e"},{"line_number":122,"context_line":"    parameter of the \u003ccode\u003ekeystone\u003c/code\u003e command line client)."},{"line_number":123,"context_line":"    \u003c?sbr?\u003eThe second line creates an alias for \"user owns the object\" by comparing"},{"line_number":124,"context_line":"    the API\u0027s user ID with the object\u0027s user ID."}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_cb0dd93f","line":121,"updated":"2015-05-01 03:16:24.000000000","message":"\"... admin privileges granted by the service token ...\"","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    \u003c?sbr?\u003eLine 3 defines a third alias \u003ccode\u003eadmin_or_owner\u003c/code\u003e, combining"},{"line_number":127,"context_line":"    the two first aliases with the Boolean operator \u003ccode\u003eor\u003c/code\u003e."},{"line_number":128,"context_line":"    \u003c?sbr?\u003eLine 4, then, sets up the policy that"},{"line_number":129,"context_line":"    a password can only be modified by its owner or an admin user.\u003c/para\u003e"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"    \u003cpara\u003eAs a final example, let\u0027s examine a more complex rule:"}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_56004c01","line":128,"updated":"2015-05-01 03:16:24.000000000","message":"Remove \"then\" and surrounding commas.","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"3b661fbe9b1b460237ebcfa036b8a5af8f5bb7fa","unresolved":false,"context_lines":[{"line_number":134,"context_line":"             (rule:owner and user_id:%(target.credential.user_id)s)\""},{"line_number":135,"context_line":"    \u003c/programlisting\u003e"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"    It determines who can use the Identity API \"delete EC2 credential\"."},{"line_number":138,"context_line":"    Here, boolean operators and parentheses combine three simpler rules."},{"line_number":139,"context_line":"    \u003ccode\u003eadmin_required\u003c/code\u003e and \u003ccode\u003eowner\u003c/code\u003e are the same aliases as in the"},{"line_number":140,"context_line":"    previous example. \u003ccode\u003euser_id:%(target.credential.user_id)s\u003c/code\u003e compares the"}],"source_content_type":"application/xml","patch_set":3,"id":"3acd31a7_160ad421","line":137,"updated":"2015-05-01 03:16:24.000000000","message":"s/It/This rule (or similar).","commit_id":"da05c003855e6e1c203eb598fb7c1ac8e866d52c"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"efe5bb7f031abe903904e2da3ef940cb0c50c15b","unresolved":false,"context_lines":[{"line_number":118,"context_line":"\"identity:change_password\": \"rule:admin_or_owner\"\u003c/programlisting\u003e"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    The first line defines an alias for \"user is an admin user\"."},{"line_number":121,"context_line":"    The \u003ccode\u003eis_admin\u003c/code\u003e flag is only used when setting"},{"line_number":122,"context_line":"    up the Identity service for the first time. It indicates that the user"},{"line_number":123,"context_line":"    has admin privileges granted by the service token (\u003ccode\u003e--os-token\u003c/code\u003e"},{"line_number":124,"context_line":"    parameter of the \u003ccode\u003ekeystone\u003c/code\u003e command line client)."}],"source_content_type":"application/xml","patch_set":5,"id":"3acd31a7_719d6b58","line":121,"updated":"2015-05-04 10:33:45.000000000","message":"I think \u003cliteral\u003e...\u003c/literal\u003e should be used instead of \u003ccode\u003e...\u003c/code\u003e all over this file.","commit_id":"e7906aaf51d541dd90af7e913bf74c5b3b15b569"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"efe5bb7f031abe903904e2da3ef940cb0c50c15b","unresolved":false,"context_lines":[{"line_number":120,"context_line":"    The first line defines an alias for \"user is an admin user\"."},{"line_number":121,"context_line":"    The \u003ccode\u003eis_admin\u003c/code\u003e flag is only used when setting"},{"line_number":122,"context_line":"    up the Identity service for the first time. It indicates that the user"},{"line_number":123,"context_line":"    has admin privileges granted by the service token (\u003ccode\u003e--os-token\u003c/code\u003e"},{"line_number":124,"context_line":"    parameter of the \u003ccode\u003ekeystone\u003c/code\u003e command line client)."},{"line_number":125,"context_line":"    \u003c/para\u003e"},{"line_number":126,"context_line":""}],"source_content_type":"application/xml","patch_set":5,"id":"3acd31a7_f1729b48","line":123,"updated":"2015-05-04 10:33:45.000000000","message":"\u003cparameter\u003e...\u003c/parameter\u003e instead of \u003ccode\u003e...\u003c/code\u003e.","commit_id":"e7906aaf51d541dd90af7e913bf74c5b3b15b569"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"efe5bb7f031abe903904e2da3ef940cb0c50c15b","unresolved":false,"context_lines":[{"line_number":121,"context_line":"    The \u003ccode\u003eis_admin\u003c/code\u003e flag is only used when setting"},{"line_number":122,"context_line":"    up the Identity service for the first time. It indicates that the user"},{"line_number":123,"context_line":"    has admin privileges granted by the service token (\u003ccode\u003e--os-token\u003c/code\u003e"},{"line_number":124,"context_line":"    parameter of the \u003ccode\u003ekeystone\u003c/code\u003e command line client)."},{"line_number":125,"context_line":"    \u003c/para\u003e"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"    \u003cpara\u003eThe second line creates an alias for \"user owns the object\" by comparing"}],"source_content_type":"application/xml","patch_set":5,"id":"3acd31a7_31a01390","line":124,"updated":"2015-05-04 10:33:45.000000000","message":"\u003ccommand\u003e...\u003c/command\u003e instead of \u003ccode\u003e...\u003c/code\u003e.","commit_id":"e7906aaf51d541dd90af7e913bf74c5b3b15b569"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"efe5bb7f031abe903904e2da3ef940cb0c50c15b","unresolved":false,"context_lines":[{"line_number":144,"context_line":"             (rule:owner and user_id:%(target.credential.user_id)s)\""},{"line_number":145,"context_line":"    \u003c/programlisting\u003e"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"    This rule determines who can use the Identity API \"delete EC2 credential."},{"line_number":148,"context_line":"    Here, boolean operators and parentheses combine three simpler rules."},{"line_number":149,"context_line":"    \u003ccode\u003eadmin_required\u003c/code\u003e and \u003ccode\u003eowner\u003c/code\u003e are the same aliases as in the"},{"line_number":150,"context_line":"    previous example. \u003ccode\u003euser_id:%(target.credential.user_id)s\u003c/code\u003e compares the"}],"source_content_type":"application/xml","patch_set":5,"id":"3acd31a7_11f3d7d7","line":147,"updated":"2015-05-04 10:33:45.000000000","message":"Missing \" after credential.","commit_id":"e7906aaf51d541dd90af7e913bf74c5b3b15b569"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"efe5bb7f031abe903904e2da3ef940cb0c50c15b","unresolved":false,"context_lines":[{"line_number":168,"context_line":"       \"target 2\" : \"rule 2\","},{"line_number":169,"context_line":"       ...."},{"line_number":170,"context_line":"}"},{"line_number":171,"context_line":"    \u003c/programlisting\u003e"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"    \u003c/para\u003e"},{"line_number":174,"context_line":""}],"source_content_type":"application/xml","patch_set":5,"id":"3acd31a7_71b44bd0","line":171,"updated":"2015-05-04 10:33:45.000000000","message":"Directly after \u0027}\u0027 in line 170.","commit_id":"e7906aaf51d541dd90af7e913bf74c5b3b15b569"}]}