)]}'
{"specs/queens/include-scope-in-policy.rst":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"0398e7c4b02c6ad885bdd525f97e7daeacc0f76a","unresolved":false,"context_lines":[{"line_number":27,"context_line":"projects or domains. When dealing with operations above project scope (e.g."},{"line_number":28,"context_line":"modifying endpoints, performing a live migration, or listing all instances in a"},{"line_number":29,"context_line":"deployment), it gets harder to repurpose project or even domain scope for these"},{"line_number":30,"context_line":"actions. This often times leads to end-user and deployer confusion. As a"},{"line_number":31,"context_line":"result, there is work to introduce elevated scopes in OpenStack that make the"},{"line_number":32,"context_line":"solution a little easier to understand. For more information on the actual"},{"line_number":33,"context_line":"approach, please see the related Identity specifications:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f2577a7_ce9a24c4","line":30,"range":{"start_line":30,"start_character":57,"end_line":30,"end_character":66},"updated":"2017-09-11 05:38:20.000000000","message":"it\u0027s more than just confusion we\u0027re solving here. See bug 968696. You mentioned it below, but I think it\u0027s important to mention it up here in the problem description.","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"119a7cee6d8a09b7a9476fc99f947f084c2d86e2","unresolved":false,"context_lines":[{"line_number":27,"context_line":"projects or domains. When dealing with operations above project scope (e.g."},{"line_number":28,"context_line":"modifying endpoints, performing a live migration, or listing all instances in a"},{"line_number":29,"context_line":"deployment), it gets harder to repurpose project or even domain scope for these"},{"line_number":30,"context_line":"actions. This often times leads to end-user and deployer confusion. As a"},{"line_number":31,"context_line":"result, there is work to introduce elevated scopes in OpenStack that make the"},{"line_number":32,"context_line":"solution a little easier to understand. For more information on the actual"},{"line_number":33,"context_line":"approach, please see the related Identity specifications:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7f515b1d_1bc13a2f","line":30,"range":{"start_line":30,"start_character":57,"end_line":30,"end_character":66},"in_reply_to":"5f2577a7_ce9a24c4","updated":"2017-09-26 21:53:25.000000000","message":"Done","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"0398e7c4b02c6ad885bdd525f97e7daeacc0f76a","unresolved":false,"context_lines":[{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Both rules are descriptive in what they do, but they don\u0027t include the scope at"},{"line_number":87,"context_line":"which they are intended to operate. Instances must belong to a project and user"},{"line_number":88,"context_line":"can exist globally or within a specific domain. They could modified to::"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    from oslo_policy import policy"},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f2577a7_8ef2dc05","line":88,"range":{"start_line":88,"start_character":53,"end_line":88,"end_character":58},"updated":"2017-09-11 05:38:20.000000000","message":"nit: could be*","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"119a7cee6d8a09b7a9476fc99f947f084c2d86e2","unresolved":false,"context_lines":[{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Both rules are descriptive in what they do, but they don\u0027t include the scope at"},{"line_number":87,"context_line":"which they are intended to operate. Instances must belong to a project and user"},{"line_number":88,"context_line":"can exist globally or within a specific domain. They could modified to::"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    from oslo_policy import policy"},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7f515b1d_db096295","line":88,"range":{"start_line":88,"start_character":53,"end_line":88,"end_character":58},"in_reply_to":"5f2577a7_8ef2dc05","updated":"2017-09-26 21:53:25.000000000","message":"Done","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9c00dc4666e13c51a734af8a84eab00a12af3489","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":95,"context_line":"        name\u003dSERVERS % \u0027create\u0027,"},{"line_number":96,"context_line":"        scope\u003d(\u0027project\u0027),"},{"line_number":97,"context_line":"        check_str\u003dRULE_ADMIN_OR_OWNER,"},{"line_number":98,"context_line":"        description\u003d\u0027Create a server.\u0027,"},{"line_number":99,"context_line":"        operations\u003d["}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f2577a7_707665db","line":96,"updated":"2017-09-11 19:39:15.000000000","message":"morgan: What if we could make this more explicit instead of an opaque tuple?","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"119a7cee6d8a09b7a9476fc99f947f084c2d86e2","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":95,"context_line":"        name\u003dSERVERS % \u0027create\u0027,"},{"line_number":96,"context_line":"        scope\u003d(\u0027project\u0027),"},{"line_number":97,"context_line":"        check_str\u003dRULE_ADMIN_OR_OWNER,"},{"line_number":98,"context_line":"        description\u003d\u0027Create a server.\u0027,"},{"line_number":99,"context_line":"        operations\u003d["}],"source_content_type":"text/x-rst","patch_set":1,"id":"7f515b1d_db2e02f9","line":96,"in_reply_to":"5f2577a7_707665db","updated":"2017-09-26 21:53:25.000000000","message":"We discussed this at the PTG and leaving it as a tuple allows us the ability to extend the functionality in the future.","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"0398e7c4b02c6ad885bdd525f97e7daeacc0f76a","unresolved":false,"context_lines":[{"line_number":107,"context_line":""},{"line_number":108,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":109,"context_line":"        name\u003dbase.IDENTITY % \u0027create_user\u0027,"},{"line_number":110,"context_line":"        scope\u003d(\u0027domain\u0027, \u0027global\u0027),"},{"line_number":111,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":112,"context_line":"        description\u003d\u0027Create a user.\u0027,"},{"line_number":113,"context_line":"        operations\u003d["}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f2577a7_2ed9a882","line":110,"range":{"start_line":110,"start_character":26,"end_line":110,"end_character":32},"updated":"2017-09-11 05:38:20.000000000","message":"What does it mean in general to have two scopes defined here? And global users?!?","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"119a7cee6d8a09b7a9476fc99f947f084c2d86e2","unresolved":false,"context_lines":[{"line_number":107,"context_line":""},{"line_number":108,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":109,"context_line":"        name\u003dbase.IDENTITY % \u0027create_user\u0027,"},{"line_number":110,"context_line":"        scope\u003d(\u0027domain\u0027, \u0027global\u0027),"},{"line_number":111,"context_line":"        check_str\u003dbase.RULE_ADMIN_REQUIRED,"},{"line_number":112,"context_line":"        description\u003d\u0027Create a user.\u0027,"},{"line_number":113,"context_line":"        operations\u003d["}],"source_content_type":"text/x-rst","patch_set":1,"id":"7f515b1d_7b282ee1","line":110,"range":{"start_line":110,"start_character":26,"end_line":110,"end_character":32},"in_reply_to":"5f2577a7_2ed9a882","updated":"2017-09-26 21:53:25.000000000","message":"Correct. A domain administrator could create users specifically in their domain, or an operator can create a user that isn\u0027t constrained to a specific domain namespace.","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"0398e7c4b02c6ad885bdd525f97e7daeacc0f76a","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The ``scope`` attribute of policy can then be generated in sample policy files"},{"line_number":120,"context_line":"with the existing ``description`` making it even more helpful for deployers"},{"line_number":121,"context_line":"that need to understand policy. It can also be available during the policy"},{"line_number":122,"context_line":"enforcement of an operation at runtime. This makes it easier for projects to"},{"line_number":123,"context_line":"compare the operation being performed with the authorization context of the"},{"line_number":124,"context_line":"token used to perform the operation. For example, comparing the ``scope`` of"},{"line_number":125,"context_line":"the policy operation against the role on the token\u0027s scope should help solve"},{"line_number":126,"context_line":"`admin-ness issues \u003chttps://bugs.launchpad.net/keystone/+bug/968696\u003e`_ across"},{"line_number":127,"context_line":"OpenStack."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f2577a7_2ec2c886","line":124,"range":{"start_line":121,"start_character":32,"end_line":124,"end_character":36},"updated":"2017-09-11 05:38:20.000000000","message":"Could we even have oslo.policy doing those scope checks instead of doing them in the project\u0027s code? That might help us get uniform enforcement.","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"119a7cee6d8a09b7a9476fc99f947f084c2d86e2","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The ``scope`` attribute of policy can then be generated in sample policy files"},{"line_number":120,"context_line":"with the existing ``description`` making it even more helpful for deployers"},{"line_number":121,"context_line":"that need to understand policy. It can also be available during the policy"},{"line_number":122,"context_line":"enforcement of an operation at runtime. This makes it easier for projects to"},{"line_number":123,"context_line":"compare the operation being performed with the authorization context of the"},{"line_number":124,"context_line":"token used to perform the operation. For example, comparing the ``scope`` of"},{"line_number":125,"context_line":"the policy operation against the role on the token\u0027s scope should help solve"},{"line_number":126,"context_line":"`admin-ness issues \u003chttps://bugs.launchpad.net/keystone/+bug/968696\u003e`_ across"},{"line_number":127,"context_line":"OpenStack."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7f515b1d_5b68d21f","line":124,"range":{"start_line":121,"start_character":32,"end_line":124,"end_character":36},"in_reply_to":"5f2577a7_2ec2c886","updated":"2017-09-26 21:53:25.000000000","message":"Yeah - I think that\u0027s a little more clear now that we discussed this at the PTG. Done.","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"9baf9c80579c0a1a695bf54b69b66c558b705d8b","unresolved":false,"context_lines":[{"line_number":125,"context_line":"the policy operation against the role on the token\u0027s scope should help solve"},{"line_number":126,"context_line":"`admin-ness issues \u003chttps://bugs.launchpad.net/keystone/+bug/968696\u003e`_ across"},{"line_number":127,"context_line":"OpenStack."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Alternatives"},{"line_number":130,"context_line":"------------"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7f287b81_4439153d","line":128,"updated":"2017-09-06 16:40:40.000000000","message":"Please add in the following sample RULE and indicate that each of the services should implement them in a consistant manner:\n\nSERVICE_ADMIN_READ: role: admin\nPROJECT_ADMIN_READ: role: admin\nMEMBER_READ:  role: admin or project_id: target.project_id\nSERVICE_ADMIN_WRITE: role: admin\nPROJECT_ADMIN_WRITE: role: admin\nMEMBER_WRITE:  role: admin or project_id: target.project_id\n\nAn operator could then override just these rules in order to implement a fix for bug 968696 or implement a read-only role.","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"0398e7c4b02c6ad885bdd525f97e7daeacc0f76a","unresolved":false,"context_lines":[{"line_number":125,"context_line":"the policy operation against the role on the token\u0027s scope should help solve"},{"line_number":126,"context_line":"`admin-ness issues \u003chttps://bugs.launchpad.net/keystone/+bug/968696\u003e`_ across"},{"line_number":127,"context_line":"OpenStack."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Alternatives"},{"line_number":130,"context_line":"------------"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f2577a7_eec5e05c","line":128,"in_reply_to":"7f287b81_4439153d","updated":"2017-09-11 05:38:20.000000000","message":"What is the distinction between \"SERVICE_ADMIN\" and \"PROJECT_ADMIN\"? We only have one type of admin today.\n\nWe shouldn\u0027t have project_id in policy. Scope checks should be hard-coded.\n\nI think you\u0027re saying that these rules should be used as the values for other rules, e.g.: \"server:create\": \"rule: PROJECT_ADMIN_WRITE or rule:MEMBER_WRITE\"... is that correct?\n\nFixing bug 968696 and implementing a read-only role are things we should be doing so an operator doesn\u0027t need to...\n\nThese rules are essentially roles. They might help an operator that wants to use a slightly different name for their role, but only if the role is otherwise identical (i.e. in what it is allowed to do). I\u0027m not seeing value here...","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"0398e7c4b02c6ad885bdd525f97e7daeacc0f76a","unresolved":false,"context_lines":[{"line_number":135,"context_line":"Impact on Existing APIs"},{"line_number":136,"context_line":"-----------------------"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"This will make the ``DocumentedRuleDefault`` object more useful in documenting"},{"line_number":139,"context_line":"and evaluating policy. The changes described here are additive only and should"},{"line_number":140,"context_line":"not impact existing functionality of the object."},{"line_number":141,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f2577a7_6e457017","line":138,"range":{"start_line":138,"start_character":21,"end_line":138,"end_character":42},"updated":"2017-09-11 05:38:20.000000000","message":"We created DocumentedRuleDefault because we were adding things that we wanted to be required, but didn\u0027t want to break projects still using RuleDefault. We probably need to do the same thing here... call it ScopedRuleDefault, subclassing DocumentedRuleDefault?","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"119a7cee6d8a09b7a9476fc99f947f084c2d86e2","unresolved":false,"context_lines":[{"line_number":135,"context_line":"Impact on Existing APIs"},{"line_number":136,"context_line":"-----------------------"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"This will make the ``DocumentedRuleDefault`` object more useful in documenting"},{"line_number":139,"context_line":"and evaluating policy. The changes described here are additive only and should"},{"line_number":140,"context_line":"not impact existing functionality of the object."},{"line_number":141,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7f515b1d_fbf09e69","line":138,"range":{"start_line":138,"start_character":21,"end_line":138,"end_character":42},"in_reply_to":"5f2577a7_6e457017","updated":"2017-09-26 21:53:25.000000000","message":"We discussed this a bit at the PTG and decided enforcing this through a community goal is probably best. It also reduces the amount of new objects in oslo.policy, which can be confusing for project developers to keep up with.","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"0398e7c4b02c6ad885bdd525f97e7daeacc0f76a","unresolved":false,"context_lines":[{"line_number":186,"context_line":""},{"line_number":187,"context_line":"Target Milestone for completion: queens-1"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"Making this available early in the Queens release will allow projects to supply"},{"line_number":190,"context_line":"scope documentation through automated docs."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Work Items"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f2577a7_aea598b7","line":189,"updated":"2017-09-11 05:38:20.000000000","message":"worth noting that they can\u0027t/shouldn\u0027t really use this until they have their code doing scope checks the way they want them. E.g. if live migrate should really be a global action, then you\u0027d need to stop letting a project admin do that before marking it as such.","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"119a7cee6d8a09b7a9476fc99f947f084c2d86e2","unresolved":false,"context_lines":[{"line_number":186,"context_line":""},{"line_number":187,"context_line":"Target Milestone for completion: queens-1"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"Making this available early in the Queens release will allow projects to supply"},{"line_number":190,"context_line":"scope documentation through automated docs."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Work Items"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7f515b1d_bbb8e675","line":189,"in_reply_to":"5f2577a7_aea598b7","updated":"2017-09-26 21:53:25.000000000","message":"That\u0027s also contingent on keystone providing a way for a user to get system-level scope in a token.","commit_id":"081ee6b69724acd70cf0d19cc855c8f067210870"}]}