)]}'
{"specs/tempest/rbac-policy-testing.rst":[{"author":{"_account_id":20411,"name":"Julian","email":"julian.sy@att.com","username":"syjulian"},"change_message_id":"78679ffcbc4eab8ee3d5e60112a50dd423a35942","unresolved":false,"context_lines":[{"line_number":11,"context_line":"https://blueprints.launchpad.net/tempest/+spec/rbac-policy-testing"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack deployments have standard RBAC (Role-based Access Control)"},{"line_number":14,"context_line":"policies that are customized in different  way by users of OpenStack.  "},{"line_number":15,"context_line":"These policies need to be enforced and verified to ensure secure "},{"line_number":16,"context_line":"opperation of an Openstack Deployment."},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a95cdbc_a336f94f","line":14,"updated":"2016-10-06 12:36:14.000000000","message":"nit: remove these trailing whitespaces marked read throughout the spec","commit_id":"f816d9725a8917aa3c47882603c750f3678a0c57"},{"author":{"_account_id":5196,"name":"Matthew Treinish","email":"mtreinish@kortar.org","username":"treinish"},"change_message_id":"015b21af4ae07be58d314944caba3e5d6178e6d4","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"   Compute:"},{"line_number":56,"context_line":"     compute_extension:services:"},{"line_number":57,"context_line":"       - role:admin"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool "},{"line_number":60,"context_line":"to make sure that the user in question, according to the configuration, "}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a95cdbc_f096b8ee","line":57,"updated":"2016-10-07 19:51:47.000000000","message":"What does this provide you over just parsing the the policy files? You\u0027re basically asking someone who uses this to map out all the policy rules for all the apis that ere being tested by hand. I understand doing this is always basically gonna be a requirement for doing this type of testing because the policy is fully customizable, but I wonder if we can make this easier for end users. The point at which you have 500 tests for 500 different custom policy rules this gonna be quite the pain to write.","commit_id":"f816d9725a8917aa3c47882603c750f3678a0c57"},{"author":{"_account_id":7350,"name":"Jordan Pittier","email":"jordan.pittier@gmail.com","username":"JordanP"},"change_message_id":"e6e778e31837eb43c29e7af949077ef76578e30c","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"   Compute:"},{"line_number":56,"context_line":"     compute_extension:services:"},{"line_number":57,"context_line":"       - role:admin"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool "},{"line_number":60,"context_line":"to make sure that the user in question, according to the configuration, "}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a95cdbc_da868d12","line":57,"updated":"2016-10-06 09:58:26.000000000","message":"role are very cloud dependent. It depends on the config of each cloud. How many different roles do you envision ?","commit_id":"f816d9725a8917aa3c47882603c750f3678a0c57"},{"author":{"_account_id":17887,"name":"Doug Schveninger","email":"ds6901@att.com","username":"Doug.Schveninger"},"change_message_id":"733da13694cd56209d0c081eca1ab9a316b68266","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"   Compute:"},{"line_number":56,"context_line":"     compute_extension:services:"},{"line_number":57,"context_line":"       - role:admin"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool "},{"line_number":60,"context_line":"to make sure that the user in question, according to the configuration, "}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a95cdbc_63e144d0","line":57,"in_reply_to":"1a95cdbc_da868d12","updated":"2016-10-06 15:42:45.000000000","message":"The standard rbac_roles.yaml would be the roles that are used in the standard OpenStack service policy.json which are admin and member.  \n\nEach user of the framework would customize the rbac_roles.yaml file and currently we have 5 different roles and moving to 8 roles.","commit_id":"f816d9725a8917aa3c47882603c750f3678a0c57"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"5b6371233b0bc3d0ea60e48d3352a9e41a7d8a94","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Advantages: Utilizing the cinnamon-role plugin enables RBAC functionality"},{"line_number":78,"context_line":"to be wrapped around existing tests with minimal extra effort."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Disadvanatages:  Using a plugin instead of internal to Tempest adds an uncessary layer "},{"line_number":81,"context_line":"between the RBAC testing and the Tempest tests.  Additionally, it doesn\u0027t allow for testing"},{"line_number":82,"context_line":"of individual API endpoints by switching role mid-test."},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a95cdbc_c6694127","line":80,"range":{"start_line":80,"start_character":0,"end_line":80,"end_character":14},"updated":"2016-10-07 18:58:27.000000000","message":"s/Disadvanatages/Disadvantages/","commit_id":"f816d9725a8917aa3c47882603c750f3678a0c57"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"5b6371233b0bc3d0ea60e48d3352a9e41a7d8a94","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Advantages: Utilizing the cinnamon-role plugin enables RBAC functionality"},{"line_number":78,"context_line":"to be wrapped around existing tests with minimal extra effort."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Disadvanatages:  Using a plugin instead of internal to Tempest adds an uncessary layer "},{"line_number":81,"context_line":"between the RBAC testing and the Tempest tests.  Additionally, it doesn\u0027t allow for testing"},{"line_number":82,"context_line":"of individual API endpoints by switching role mid-test."},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a95cdbc_46645148","line":80,"range":{"start_line":80,"start_character":71,"end_line":80,"end_character":80},"updated":"2016-10-07 18:58:27.000000000","message":"s/uncessary/unnecessary/ (?)","commit_id":"f816d9725a8917aa3c47882603c750f3678a0c57"},{"author":{"_account_id":5196,"name":"Matthew Treinish","email":"mtreinish@kortar.org","username":"treinish"},"change_message_id":"015b21af4ae07be58d314944caba3e5d6178e6d4","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Disadvanatages:  Using a plugin instead of internal to Tempest adds an uncessary layer "},{"line_number":81,"context_line":"between the RBAC testing and the Tempest tests.  Additionally, it doesn\u0027t allow for testing"},{"line_number":82,"context_line":"of individual API endpoints by switching role mid-test."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Projects"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a95cdbc_109c040e","line":82,"updated":"2016-10-07 19:51:47.000000000","message":"So this isn\u0027t actually a disadvantage, cinnamon-role did this on purpose because RBAC testing is outside the scope of tempest. It\u0027s not something we ever want tempest to be in the business of owning. Outside of the basic checking it does right now for hard coded rules, or some sane common rbac defaults.\n\nThis is mostly because it\u0027s way too deployment specific to be a good fit for tempest. I\u0027m fine with adding a decorator to tempest.lib to facilitate doing rbac checks or maybe an additional util method to tempest lib to allocate role specific creds, but outside of that tempest is not the place to do this.","commit_id":"f816d9725a8917aa3c47882603c750f3678a0c57"},{"author":{"_account_id":5196,"name":"Matthew Treinish","email":"mtreinish@kortar.org","username":"treinish"},"change_message_id":"015b21af4ae07be58d314944caba3e5d6178e6d4","unresolved":false,"context_lines":[{"line_number":100,"context_line":"Milestones"},{"line_number":101,"context_line":"----------"},{"line_number":102,"context_line":"Target Milestone for completion:"},{"line_number":103,"context_line":"  Ocata"},{"line_number":104,"context_line":"  "},{"line_number":105,"context_line":"Work Items"},{"line_number":106,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a95cdbc_309d800a","line":103,"updated":"2016-10-07 19:51:47.000000000","message":"Normally this would be a specific milestone goal like ocata-2 for milestone 2 during the ocata cycle. Just saying it will be targetted for the next 6 months is kinda broad.","commit_id":"f816d9725a8917aa3c47882603c750f3678a0c57"},{"author":{"_account_id":5196,"name":"Matthew Treinish","email":"mtreinish@kortar.org","username":"treinish"},"change_message_id":"015b21af4ae07be58d314944caba3e5d6178e6d4","unresolved":false,"context_lines":[{"line_number":105,"context_line":"Work Items"},{"line_number":106,"context_line":"----------"},{"line_number":107,"context_line":"* add decorator and supporting code to lib/rbac"},{"line_number":108,"context_line":"* unit tests for decorator"},{"line_number":109,"context_line":"* add initial group of tests"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a95cdbc_50a20c4c","line":108,"updated":"2016-10-07 19:51:47.000000000","message":"This is a req for adding anything to lib :)","commit_id":"f816d9725a8917aa3c47882603c750f3678a0c57"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"c0de323c4de637ea682b4b436d4ff93a90096d32","unresolved":false,"context_lines":[{"line_number":65,"context_line":"This effort involves creating the framework for new tests that verify correct"},{"line_number":66,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"},{"line_number":67,"context_line":"not intended to provide full testing coverage of all policies and APIs"},{"line_number":68,"context_line":"The core code will exist in tempest/lib/rbac, while individual tests will"},{"line_number":69,"context_line":"be written in any location that can access common. Placing these"},{"line_number":70,"context_line":"utilities and decorator in tempest lib will also support the Tempest"},{"line_number":71,"context_line":"Plug-in architecture so all services using RBAC can use the framework."}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_96120f08","line":68,"range":{"start_line":68,"start_character":28,"end_line":68,"end_character":44},"updated":"2016-10-19 22:31:47.000000000","message":"Basically, I guess this rbac testing will be implemented as the separated repo from Tempest. And the testing will re-use tempest code via tempest.lib. However, rbac specific code will exist in the rbac repo, not Tempest repo.","commit_id":"5df2303b400ba491e424be7cfc40eb2863e8cab0"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"ee19b7b0a1311b842008c53e9c2b9501a70972fc","unresolved":false,"context_lines":[{"line_number":65,"context_line":"This effort involves creating the framework for new tests that verify correct"},{"line_number":66,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"},{"line_number":67,"context_line":"not intended to provide full testing coverage of all policies and APIs"},{"line_number":68,"context_line":"The core code will exist in tempest/lib/rbac, while individual tests will"},{"line_number":69,"context_line":"be written in any location that can access common. Placing these"},{"line_number":70,"context_line":"utilities and decorator in tempest lib will also support the Tempest"},{"line_number":71,"context_line":"Plug-in architecture so all services using RBAC can use the framework."}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba5da102_c76c339f","line":68,"range":{"start_line":68,"start_character":28,"end_line":68,"end_character":44},"in_reply_to":"ba5da102_c403540e","updated":"2016-10-27 05:33:55.000000000","message":"There are several merits of separated repo actually.\n\n 1. Make Tempest scope simple and clear (Most important)\n 2. Create a new core team for concentrating on this specific testing\n 3. Easy to implement it in fast progress at early stage\n\nI am not sure what is overhead to maintain something by separate repo TBH.","commit_id":"5df2303b400ba491e424be7cfc40eb2863e8cab0"},{"author":{"_account_id":18199,"name":"Randeep Jalli","email":"jallirs@gmail.com","username":"jallirs"},"change_message_id":"8e4bb6eca7ab034ca813254b86bdfe7210ba75c5","unresolved":false,"context_lines":[{"line_number":65,"context_line":"This effort involves creating the framework for new tests that verify correct"},{"line_number":66,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"},{"line_number":67,"context_line":"not intended to provide full testing coverage of all policies and APIs"},{"line_number":68,"context_line":"The core code will exist in tempest/lib/rbac, while individual tests will"},{"line_number":69,"context_line":"be written in any location that can access common. Placing these"},{"line_number":70,"context_line":"utilities and decorator in tempest lib will also support the Tempest"},{"line_number":71,"context_line":"Plug-in architecture so all services using RBAC can use the framework."}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba5da102_c403540e","line":68,"range":{"start_line":68,"start_character":28,"end_line":68,"end_character":44},"in_reply_to":"fa6399be_96120f08","updated":"2016-10-26 22:34:59.000000000","message":"Although we could do it this way, I don\u0027t see much benefit to having it in a seperate repo. It increases the overhead to maintain something like this. If every feature we add to tempest had to have it\u0027s own repo, this would be unmanageable.","commit_id":"5df2303b400ba491e424be7cfc40eb2863e8cab0"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"c0de323c4de637ea682b4b436d4ff93a90096d32","unresolved":false,"context_lines":[{"line_number":78,"context_line":"to be wrapped around existing tests with minimal extra effort."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Disadvantages:  Using a plugin instead of internal to Tempest adds an unncessary layer"},{"line_number":81,"context_line":"between the RBAC testing and the Tempest tests.  Additionally, it doesn\u0027t allow for testing"},{"line_number":82,"context_line":"of individual API endpoints by switching role mid-test."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Projects"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_76b49bf1","line":82,"range":{"start_line":81,"start_character":63,"end_line":82,"end_character":55},"updated":"2016-10-19 22:31:47.000000000","message":"I am not sure what here means..\n\nWhy can\u0027t we switch role for testing if separating the repo from Tempest?","commit_id":"5df2303b400ba491e424be7cfc40eb2863e8cab0"},{"author":{"_account_id":18199,"name":"Randeep Jalli","email":"jallirs@gmail.com","username":"jallirs"},"change_message_id":"8e4bb6eca7ab034ca813254b86bdfe7210ba75c5","unresolved":false,"context_lines":[{"line_number":78,"context_line":"to be wrapped around existing tests with minimal extra effort."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Disadvantages:  Using a plugin instead of internal to Tempest adds an unncessary layer"},{"line_number":81,"context_line":"between the RBAC testing and the Tempest tests.  Additionally, it doesn\u0027t allow for testing"},{"line_number":82,"context_line":"of individual API endpoints by switching role mid-test."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Projects"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba5da102_3f0ed934","line":82,"range":{"start_line":81,"start_character":63,"end_line":82,"end_character":55},"in_reply_to":"fa6399be_76b49bf1","updated":"2016-10-26 22:34:59.000000000","message":"I believe this comment above is specific to cinnamon role project. Because the tempest tests are written as a class and cinnamon role uses/employ\u0027s a decorator, just by simply using a single decorator on a single method, you can\u0027t change the behavior of every single method in a class. \n\nFor example, with a single decorator, you maybe able to change the behavior of the method that actually runs the test, but not the methods that perform setup.","commit_id":"5df2303b400ba491e424be7cfc40eb2863e8cab0"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"e4d9467e6c9cfb1028eabb8840c1564ff4627abd","unresolved":false,"context_lines":[{"line_number":26,"context_line":"The proposed solution involves creating a plugin that enables RBAC tests to be"},{"line_number":27,"context_line":"written in such a way that they can verify that an individual policy was"},{"line_number":28,"context_line":"correctly enforced on the specified rbac_role. Tests should primarily be written"},{"line_number":29,"context_line":"as an extension of an existing Tempest test that is wrapped in the plugin\u0027s "},{"line_number":30,"context_line":"functionality.  The plugin determines what roles should have access to a given "},{"line_number":31,"context_line":"API based on a rbac_rules yaml file, which is itself based on the policy "},{"line_number":32,"context_line":"actions for the various OpenStack services."}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5da102_419253f7","line":29,"range":{"start_line":29,"start_character":75,"end_line":29,"end_character":76},"updated":"2016-11-01 22:49:47.000000000","message":"nit: need to remove a space at the end of line.","commit_id":"f5be955098c2b2e2f19d66c7311dc2ebd5500702"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"e4d9467e6c9cfb1028eabb8840c1564ff4627abd","unresolved":false,"context_lines":[{"line_number":27,"context_line":"written in such a way that they can verify that an individual policy was"},{"line_number":28,"context_line":"correctly enforced on the specified rbac_role. Tests should primarily be written"},{"line_number":29,"context_line":"as an extension of an existing Tempest test that is wrapped in the plugin\u0027s "},{"line_number":30,"context_line":"functionality.  The plugin determines what roles should have access to a given "},{"line_number":31,"context_line":"API based on a rbac_rules yaml file, which is itself based on the policy "},{"line_number":32,"context_line":"actions for the various OpenStack services."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5da102_618f57cc","line":30,"range":{"start_line":30,"start_character":78,"end_line":30,"end_character":79},"updated":"2016-11-01 22:49:47.000000000","message":"ditto","commit_id":"f5be955098c2b2e2f19d66c7311dc2ebd5500702"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"e4d9467e6c9cfb1028eabb8840c1564ff4627abd","unresolved":false,"context_lines":[{"line_number":28,"context_line":"correctly enforced on the specified rbac_role. Tests should primarily be written"},{"line_number":29,"context_line":"as an extension of an existing Tempest test that is wrapped in the plugin\u0027s "},{"line_number":30,"context_line":"functionality.  The plugin determines what roles should have access to a given "},{"line_number":31,"context_line":"API based on a rbac_rules yaml file, which is itself based on the policy "},{"line_number":32,"context_line":"actions for the various OpenStack services."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"For example, a test can be written that only tests the policies for"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5da102_a1c32fec","line":31,"range":{"start_line":31,"start_character":72,"end_line":31,"end_character":73},"updated":"2016-11-01 22:49:47.000000000","message":"ditto","commit_id":"f5be955098c2b2e2f19d66c7311dc2ebd5500702"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"e4d9467e6c9cfb1028eabb8840c1564ff4627abd","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Using a yaml that looks like:"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":".. code-block:: yaml"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"   Compute:"},{"line_number":57,"context_line":"     compute_extension:services:"},{"line_number":58,"context_line":"       - role:admin"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":61,"context_line":"to make sure that the user in question, according to the configuration,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5da102_017a1bbd","line":58,"range":{"start_line":54,"start_character":0,"end_line":58,"end_character":19},"updated":"2016-11-01 22:49:47.000000000","message":"How to get this yaml file from production envs?\n\nWhy don\u0027t we use policy.json directly?","commit_id":"f5be955098c2b2e2f19d66c7311dc2ebd5500702"},{"author":{"_account_id":23184,"name":"DavidPurcell","email":"d.purcell222@gmail.com","username":"DavidPurcell"},"change_message_id":"a4910b8c520b5b641f6a652b012205a995254177","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Using a yaml that looks like:"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":".. code-block:: yaml"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"   Compute:"},{"line_number":57,"context_line":"     compute_extension:services:"},{"line_number":58,"context_line":"       - role:admin"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":61,"context_line":"to make sure that the user in question, according to the configuration,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5da102_369c9f5c","line":58,"range":{"start_line":54,"start_character":0,"end_line":58,"end_character":19},"in_reply_to":"ba5da102_017a1bbd","updated":"2016-11-02 17:13:21.000000000","message":"When creating these tests it is important that an operator be able to concretely verify that for each role certain actions are restricted or allowed. The policy.json files alone do not provide this as they are too complicated or too time-consuming to be read and verified against. The rbac_roles.yaml file would provide a clear and human-readable file that should be used by the operators to confirm that actions are restricted. In addition, an easily readable rbac_roles.yaml file will enable devops personnel to more easily debug the source of test failures.","commit_id":"f5be955098c2b2e2f19d66c7311dc2ebd5500702"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"f83dc33d60aa192791bfdfb0f6b07c415a7ca4e5","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Using a yaml that looks like:"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":".. code-block:: yaml"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"   Compute:"},{"line_number":57,"context_line":"     compute_extension:services:"},{"line_number":58,"context_line":"       - role:admin"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":61,"context_line":"to make sure that the user in question, according to the configuration,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5da102_6cc9ea58","line":58,"range":{"start_line":54,"start_character":0,"end_line":58,"end_character":19},"in_reply_to":"ba5da102_369c9f5c","updated":"2016-11-02 17:55:08.000000000","message":"Humm, I don\u0027t think it is worth to create a new format for representing the policies at this time. The readability is different from different viewpoints and it is terrible if the converting tool contains bugs.\n\nIn addition, the default policies are hard-coded in Nova since Newton by the blueprint https://specs.openstack.org/openstack/nova-specs/specs/newton/implemented/policy-in-code.html\n\nSo policy.json becomes readable I think.","commit_id":"f5be955098c2b2e2f19d66c7311dc2ebd5500702"},{"author":{"_account_id":18199,"name":"Randeep Jalli","email":"jallirs@gmail.com","username":"jallirs"},"change_message_id":"68724c8362c84e16bade779dfcbc0ba37069e907","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Using a yaml that looks like:"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":".. code-block:: yaml"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"   Compute:"},{"line_number":57,"context_line":"     compute_extension:services:"},{"line_number":58,"context_line":"       - role:admin"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":61,"context_line":"to make sure that the user in question, according to the configuration,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5da102_b9b89b76","line":58,"range":{"start_line":54,"start_character":0,"end_line":58,"end_character":19},"in_reply_to":"ba5da102_6cc9ea58","updated":"2016-11-02 20:46:08.000000000","message":"I agree it\u0027s not ideal to have yaml as an intermediary format. But with just the policy.json\u0027s it becomes very difficult to debug, so we generate the yaml files from the policy.jsons as an intermediary format to ease in this process. If you want in a future iteration we can always remove the intermediary step and possibly make the debug messages a little more verbose. But, if it\u0027s not hurting anything and generated independently and makes things easier to debug, why not leave it?\n\nAs far as the defaults for policy.json\u0027s being stored in the openstack project code themselves, that may perhaps be yet another reason why the yaml file should exist to allow for testing of rbac independent of what\u0027s in the codebase itself.","commit_id":"f5be955098c2b2e2f19d66c7311dc2ebd5500702"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"ad1ac4ec9ce3f63fddd53d0bff3e21439311c7bf","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Using a yaml that looks like:"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":".. code-block:: yaml"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"   Compute:"},{"line_number":57,"context_line":"     compute_extension:services:"},{"line_number":58,"context_line":"       - role:admin"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":61,"context_line":"to make sure that the user in question, according to the configuration,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5da102_0a5da746","line":58,"range":{"start_line":54,"start_character":0,"end_line":58,"end_character":19},"in_reply_to":"ba5da102_b9b89b76","updated":"2016-11-02 22:25:36.000000000","message":"Randeep,\n\n \u003e policy.json\u0027s it becomes very difficult to debug, so we\n \u003e generate the yaml files from the policy.jsons as an\n \u003e intermediary format to ease in this process.\n\nI don\u0027t think current yaml format seems super readable by comparing policy.json. policy.json contains a single API policy in an each single line and that seems simple.\nThis yaml could be very huge by comparing policy.json. Is that really worth to define a new format which is different/original from the other OpenStack projects ?\n\n \u003e If you want in a future iteration we can always remove the\n \u003e intermediary step and possibly make the debug messages a\n \u003e little more verbose. But, if it\u0027s not hurting anything and\n \u003e generated independently and makes things easier to debug,\n \u003e why not leave it?\n\nNo, this can hurt users after defining a new format. This is one of input for testing and it is necessary to pay attention for backwards compatibility. It is not easy to just remove the format after defining.","commit_id":"f5be955098c2b2e2f19d66c7311dc2ebd5500702"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"e4d9467e6c9cfb1028eabb8840c1564ff4627abd","unresolved":false,"context_lines":[{"line_number":66,"context_line":"This effort involves creating the plugin for new tests that verify correct"},{"line_number":67,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"},{"line_number":68,"context_line":"not intended to provide full testing coverage of all policies and APIs"},{"line_number":69,"context_line":"The core code will exist in an external repository and plugin, while "},{"line_number":70,"context_line":"individual tests will be written within the plugin or anywhere that can access it."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5da102_61a67754","line":69,"range":{"start_line":69,"start_character":68,"end_line":69,"end_character":69},"updated":"2016-11-01 22:49:47.000000000","message":"ditto","commit_id":"f5be955098c2b2e2f19d66c7311dc2ebd5500702"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"e4d9467e6c9cfb1028eabb8840c1564ff4627abd","unresolved":false,"context_lines":[{"line_number":114,"context_line":"* create plugin for role testing"},{"line_number":115,"context_line":"* add necessary supporting code to lib/rbac"},{"line_number":116,"context_line":"* add initial group of tests"},{"line_number":117,"context_line":"* create a tool for automatically converting policy files into rbac_roles.yaml"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Dependencies"},{"line_number":120,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba5da102_814c6b9f","line":117,"range":{"start_line":117,"start_character":2,"end_line":117,"end_character":78},"updated":"2016-11-01 22:49:47.000000000","message":"ditto: Why don\u0027t we use policy.json files directly?","commit_id":"f5be955098c2b2e2f19d66c7311dc2ebd5500702"},{"author":{"_account_id":21522,"name":"Yosef Hoffman","email":"yh128t@att.com","username":"yohoffman"},"change_message_id":"9a4e252958fdce034dd9a1f15dade96878e3d951","unresolved":false,"context_lines":[{"line_number":13,"context_line":"OpenStack deployments have standard RBAC (Role-based Access Control)"},{"line_number":14,"context_line":"policies that are customized in different way by users of OpenStack."},{"line_number":15,"context_line":"These policies need to be enforced and verified to ensure secure"},{"line_number":16,"context_line":"opperation of an Openstack Deployment."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a77a97e_d7c0097f","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":10},"updated":"2016-11-16 21:06:56.000000000","message":"operation","commit_id":"9aa7e7ef7eaaf039ccbde74f8c301114dfa8242e"},{"author":{"_account_id":21522,"name":"Yosef Hoffman","email":"yh128t@att.com","username":"yohoffman"},"change_message_id":"9a4e252958fdce034dd9a1f15dade96878e3d951","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":52,"context_line":"to make sure that the user in question, according to the configuration,"},{"line_number":53,"context_line":"only have the roles you are testing.  The switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":54,"context_line":"return the user to the role necessary to do setup and teardown of the"},{"line_number":55,"context_line":"test case."},{"line_number":56,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a77a97e_d7cac96d","line":53,"range":{"start_line":53,"start_character":5,"end_line":53,"end_character":9},"updated":"2016-11-16 21:06:56.000000000","message":"has","commit_id":"9aa7e7ef7eaaf039ccbde74f8c301114dfa8242e"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"b1f2ca6601b6491e411d479430091804c7b5ce67","unresolved":false,"context_lines":[{"line_number":48,"context_line":"        finally:"},{"line_number":49,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":52,"context_line":"to make sure that the user in question, according to the configuration,"},{"line_number":53,"context_line":"only have the roles you are testing.  The switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":54,"context_line":"return the user to the role necessary to do setup and teardown of the"},{"line_number":55,"context_line":"test case."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"This effort involves creating the plugin for new tests that verify correct"},{"line_number":58,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a629dbe_913d6791","line":55,"range":{"start_line":51,"start_character":0,"end_line":55,"end_character":10},"updated":"2016-11-11 00:43:29.000000000","message":"I am guessing all tests should do this and it seems redundant to write this pattern in all test code, I feel.\nIt would be nice to implement such code as the base part.\nBut it is fine to go forward with current spec because we can change this kind of code after implementing without backwards incompatible changes.","commit_id":"9aa7e7ef7eaaf039ccbde74f8c301114dfa8242e"},{"author":{"_account_id":21522,"name":"Yosef Hoffman","email":"yh128t@att.com","username":"yohoffman"},"change_message_id":"9a4e252958fdce034dd9a1f15dade96878e3d951","unresolved":false,"context_lines":[{"line_number":71,"context_line":"Disadvantages:  Cinnamon-role doesn\u0027t allow for testing"},{"line_number":72,"context_line":"of individual API endpoints by switching role mid-test."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Another alternative is to add the RBAC test framwork into Tempest\u0027s core functionality."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Advantages: Easier deployment, don\u0027t need extra addons."},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a77a97e_7783b504","line":74,"range":{"start_line":74,"start_character":44,"end_line":74,"end_character":52},"updated":"2016-11-16 21:06:56.000000000","message":"framework","commit_id":"9aa7e7ef7eaaf039ccbde74f8c301114dfa8242e"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"3693d8a533b7b72ac9256ffa5f2a972147d37148","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":".. code-block:: python"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    @test.attr(type\u003d\u0027rbac\u0027)"},{"line_number":39,"context_line":"    @test.requires_ext(extension\u003d\u0027os-services\u0027, service\u003d\u0027compute\u0027)"},{"line_number":40,"context_line":"    @rbac_rule_validation.action("},{"line_number":41,"context_line":"        component\u003d\"Compute\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_73daa5e9","line":38,"range":{"start_line":38,"start_character":0,"end_line":38,"end_character":27},"updated":"2016-11-18 02:50:49.000000000","message":"This might not be needed as rbac tests going as separate plugin. all tests can be run or detected with regex like\n\n - tempest run --regex rbac_test(or something like that as per plugin name)","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":23184,"name":"DavidPurcell","email":"d.purcell222@gmail.com","username":"DavidPurcell"},"change_message_id":"b26de4bd23f0f0794ddd6277ef03391ccee2987a","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":".. code-block:: python"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    @test.attr(type\u003d\u0027rbac\u0027)"},{"line_number":39,"context_line":"    @test.requires_ext(extension\u003d\u0027os-services\u0027, service\u003d\u0027compute\u0027)"},{"line_number":40,"context_line":"    @rbac_rule_validation.action("},{"line_number":41,"context_line":"        component\u003d\"Compute\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_468b091f","line":38,"range":{"start_line":38,"start_character":0,"end_line":38,"end_character":27},"in_reply_to":"7a77a97e_73daa5e9","updated":"2016-11-18 19:35:55.000000000","message":"Agreed, we should remove this.","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"3693d8a533b7b72ac9256ffa5f2a972147d37148","unresolved":false,"context_lines":[{"line_number":42,"context_line":"        rule\u003d\"compute_extension:services\")"},{"line_number":43,"context_line":"    @test.idempotent_id(\u0027ec55d455-bab2-4c36-b282-ae3af0efe287\u0027)"},{"line_number":44,"context_line":"    def test_services_ext(self):"},{"line_number":45,"context_line":"        try:"},{"line_number":46,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dTrue)"},{"line_number":47,"context_line":"            self.client.list_services()"},{"line_number":48,"context_line":"        finally:"},{"line_number":49,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":52,"context_line":"to make sure that the user in question, according to the configuration,"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_7301c537","line":49,"range":{"start_line":45,"start_character":0,"end_line":49,"end_character":64},"updated":"2016-11-18 02:50:49.000000000","message":"even i prefer to use fixture here which automatically set/reset the user role once tests is done.","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"941f656fff2d1632a53b5732a9c14f30a6ee2705","unresolved":false,"context_lines":[{"line_number":42,"context_line":"        rule\u003d\"compute_extension:services\")"},{"line_number":43,"context_line":"    @test.idempotent_id(\u0027ec55d455-bab2-4c36-b282-ae3af0efe287\u0027)"},{"line_number":44,"context_line":"    def test_services_ext(self):"},{"line_number":45,"context_line":"        try:"},{"line_number":46,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dTrue)"},{"line_number":47,"context_line":"            self.client.list_services()"},{"line_number":48,"context_line":"        finally:"},{"line_number":49,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":52,"context_line":"to make sure that the user in question, according to the configuration,"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_269b5467","line":49,"range":{"start_line":45,"start_character":0,"end_line":49,"end_character":64},"in_reply_to":"7a77a97e_282ed6fa","updated":"2016-11-20 04:19:28.000000000","message":"I see. anyways we can take such decision during coding. so m ok with this.","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":23184,"name":"DavidPurcell","email":"d.purcell222@gmail.com","username":"DavidPurcell"},"change_message_id":"b26de4bd23f0f0794ddd6277ef03391ccee2987a","unresolved":false,"context_lines":[{"line_number":42,"context_line":"        rule\u003d\"compute_extension:services\")"},{"line_number":43,"context_line":"    @test.idempotent_id(\u0027ec55d455-bab2-4c36-b282-ae3af0efe287\u0027)"},{"line_number":44,"context_line":"    def test_services_ext(self):"},{"line_number":45,"context_line":"        try:"},{"line_number":46,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dTrue)"},{"line_number":47,"context_line":"            self.client.list_services()"},{"line_number":48,"context_line":"        finally:"},{"line_number":49,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":52,"context_line":"to make sure that the user in question, according to the configuration,"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_282ed6fa","line":49,"range":{"start_line":45,"start_character":0,"end_line":49,"end_character":64},"in_reply_to":"7a77a97e_7301c537","updated":"2016-11-18 19:35:55.000000000","message":"We left this in a finally block because some test cases require additional actions be performed after switching back into the admin role.","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"3693d8a533b7b72ac9256ffa5f2a972147d37148","unresolved":false,"context_lines":[{"line_number":36,"context_line":".. code-block:: python"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    @test.attr(type\u003d\u0027rbac\u0027)"},{"line_number":39,"context_line":"    @test.requires_ext(extension\u003d\u0027os-services\u0027, service\u003d\u0027compute\u0027)"},{"line_number":40,"context_line":"    @rbac_rule_validation.action("},{"line_number":41,"context_line":"        component\u003d\"Compute\","},{"line_number":42,"context_line":"        rule\u003d\"compute_extension:services\")"},{"line_number":43,"context_line":"    @test.idempotent_id(\u0027ec55d455-bab2-4c36-b282-ae3af0efe287\u0027)"},{"line_number":44,"context_line":"    def test_services_ext(self):"},{"line_number":45,"context_line":"        try:"},{"line_number":46,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dTrue)"},{"line_number":47,"context_line":"            self.client.list_services()"},{"line_number":48,"context_line":"        finally:"},{"line_number":49,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":52,"context_line":"to make sure that the user in question, according to the configuration,"},{"line_number":53,"context_line":"only has the roles you are testing.  The switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":54,"context_line":"return the user to the role necessary to do setup and teardown of the"},{"line_number":55,"context_line":"test case."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_93e3c1a3","line":52,"range":{"start_line":39,"start_character":0,"end_line":52,"end_character":71},"updated":"2016-11-18 02:50:49.000000000","message":"can you please show this in more details.\n\n- How pilicy,json(rbac_roles.yaml) will looks like and user needs to change with their cloud configuration\n- How framework and decorator will switch roles for tests\n- Where all those decorator/utils function can be defined and used.\n\nActually those info will help to find a optimized way of setting up the framework.\n\nSome are more implementation way but at least usage and framework part details needed.","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":23184,"name":"DavidPurcell","email":"d.purcell222@gmail.com","username":"DavidPurcell"},"change_message_id":"b26de4bd23f0f0794ddd6277ef03391ccee2987a","unresolved":false,"context_lines":[{"line_number":36,"context_line":".. code-block:: python"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    @test.attr(type\u003d\u0027rbac\u0027)"},{"line_number":39,"context_line":"    @test.requires_ext(extension\u003d\u0027os-services\u0027, service\u003d\u0027compute\u0027)"},{"line_number":40,"context_line":"    @rbac_rule_validation.action("},{"line_number":41,"context_line":"        component\u003d\"Compute\","},{"line_number":42,"context_line":"        rule\u003d\"compute_extension:services\")"},{"line_number":43,"context_line":"    @test.idempotent_id(\u0027ec55d455-bab2-4c36-b282-ae3af0efe287\u0027)"},{"line_number":44,"context_line":"    def test_services_ext(self):"},{"line_number":45,"context_line":"        try:"},{"line_number":46,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dTrue)"},{"line_number":47,"context_line":"            self.client.list_services()"},{"line_number":48,"context_line":"        finally:"},{"line_number":49,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":52,"context_line":"to make sure that the user in question, according to the configuration,"},{"line_number":53,"context_line":"only has the roles you are testing.  The switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":54,"context_line":"return the user to the role necessary to do setup and teardown of the"},{"line_number":55,"context_line":"test case."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_998586d0","line":52,"range":{"start_line":39,"start_character":0,"end_line":52,"end_character":71},"in_reply_to":"7a77a97e_93e3c1a3","updated":"2016-11-18 19:35:55.000000000","message":"Per Oomichi\u0027s request we are not using the rbac_roles.yaml.  We are currently designing the plugin to work with any policy.json settings that a user might have.\n\nrbac_utils.switch_role either switches between the role you are testing against (switchToRbacRole\u003dtrue) and admin (switchToRbacRole\u003dfalse) using the identity endpoints.  I will update the spec to include that.  Do you want me to include the code for that as well?\n\nWe are currently defining the decorators and util functions in rbac_rule_validation and rbac_utils within the plugin.  They could be migrated to tempest/lib, but I don\u0027t see a reason to as they are very RBAC testing specific.","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"941f656fff2d1632a53b5732a9c14f30a6ee2705","unresolved":false,"context_lines":[{"line_number":36,"context_line":".. code-block:: python"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"    @test.attr(type\u003d\u0027rbac\u0027)"},{"line_number":39,"context_line":"    @test.requires_ext(extension\u003d\u0027os-services\u0027, service\u003d\u0027compute\u0027)"},{"line_number":40,"context_line":"    @rbac_rule_validation.action("},{"line_number":41,"context_line":"        component\u003d\"Compute\","},{"line_number":42,"context_line":"        rule\u003d\"compute_extension:services\")"},{"line_number":43,"context_line":"    @test.idempotent_id(\u0027ec55d455-bab2-4c36-b282-ae3af0efe287\u0027)"},{"line_number":44,"context_line":"    def test_services_ext(self):"},{"line_number":45,"context_line":"        try:"},{"line_number":46,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dTrue)"},{"line_number":47,"context_line":"            self.client.list_services()"},{"line_number":48,"context_line":"        finally:"},{"line_number":49,"context_line":"            rbac_utils.switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The switch_role(self, switchToRbacRole\u003dTrue) utility method is a tool"},{"line_number":52,"context_line":"to make sure that the user in question, according to the configuration,"},{"line_number":53,"context_line":"only has the roles you are testing.  The switch_role(self, switchToRbacRole\u003dFalse)"},{"line_number":54,"context_line":"return the user to the role necessary to do setup and teardown of the"},{"line_number":55,"context_line":"test case."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_c691c048","line":52,"range":{"start_line":39,"start_character":0,"end_line":52,"end_character":71},"in_reply_to":"7a77a97e_998586d0","updated":"2016-11-20 04:19:28.000000000","message":"Yea it will be good to include more details about those utils and how switching role you are planning. (Code is not needed actually).\n\nYea, we can later decide about lib migration.","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"3693d8a533b7b72ac9256ffa5f2a972147d37148","unresolved":false,"context_lines":[{"line_number":57,"context_line":"This effort involves creating the plugin for new tests that verify correct"},{"line_number":58,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"},{"line_number":59,"context_line":"not intended to provide full testing coverage of all policies and APIs"},{"line_number":60,"context_line":"The core code will exist in an external repository and plugin, while"},{"line_number":61,"context_line":"individual tests will be written within the plugin or anywhere that can access it."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatives"},{"line_number":64,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_33ebcd79","line":61,"range":{"start_line":60,"start_character":0,"end_line":61,"end_character":80},"updated":"2016-11-18 02:50:49.000000000","message":"I think we discussed that core code/framework can be added in tempest/lib if needed (as mentioned in work item).\nwe should make it more clear like-\n\n- Common framework/code can be implemented in tempest/lib/rbac \n    - I will suggest to implement this in plugin first and when we make sure all working fine with tests then move it to lib. Because we need to keep backward compatibility in tempest/lib/ so there might not be much clarity on interfaces of framework without its actual usage in tests\n     - if that looks fine then please mention this plan in spec.\n- rbac tests will live in separate tempest pluging.","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"941f656fff2d1632a53b5732a9c14f30a6ee2705","unresolved":false,"context_lines":[{"line_number":57,"context_line":"This effort involves creating the plugin for new tests that verify correct"},{"line_number":58,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"},{"line_number":59,"context_line":"not intended to provide full testing coverage of all policies and APIs"},{"line_number":60,"context_line":"The core code will exist in an external repository and plugin, while"},{"line_number":61,"context_line":"individual tests will be written within the plugin or anywhere that can access it."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatives"},{"line_number":64,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_e694fc37","line":61,"range":{"start_line":60,"start_character":0,"end_line":61,"end_character":80},"in_reply_to":"7a77a97e_26b9ad15","updated":"2016-11-20 04:19:28.000000000","message":"I see, Sounds good. I will be nice to mention the same in spec which will be helpful in future when migrating any of the code.","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":23184,"name":"DavidPurcell","email":"d.purcell222@gmail.com","username":"DavidPurcell"},"change_message_id":"b26de4bd23f0f0794ddd6277ef03391ccee2987a","unresolved":false,"context_lines":[{"line_number":57,"context_line":"This effort involves creating the plugin for new tests that verify correct"},{"line_number":58,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"},{"line_number":59,"context_line":"not intended to provide full testing coverage of all policies and APIs"},{"line_number":60,"context_line":"The core code will exist in an external repository and plugin, while"},{"line_number":61,"context_line":"individual tests will be written within the plugin or anywhere that can access it."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatives"},{"line_number":64,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a77a97e_26b9ad15","line":61,"range":{"start_line":60,"start_character":0,"end_line":61,"end_character":80},"in_reply_to":"7a77a97e_33ebcd79","updated":"2016-11-18 19:35:55.000000000","message":"The current implementation I\u0027ve been working on hasn\u0027t required the addition of any functionality to Tempest/lib.  We are more than willing to move it in the future.","commit_id":"b8a18a355476c33ece7509cd8212b42ad3db65a7"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/tempest/+spec/rbac-policy-testing"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack deployments have standard RBAC (Role-based Access Control)"},{"line_number":14,"context_line":"policies that are customized in different way by users of OpenStack."},{"line_number":15,"context_line":"These policies need to be enforced and verified to ensure secure"},{"line_number":16,"context_line":"operation of an Openstack Deployment."}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_9596d792","line":13,"range":{"start_line":13,"start_character":47,"end_line":13,"end_character":48},"updated":"2016-12-01 20:22:22.000000000","message":"s/b/B/","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":11,"context_line":"https://blueprints.launchpad.net/tempest/+spec/rbac-policy-testing"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack deployments have standard RBAC (Role-based Access Control)"},{"line_number":14,"context_line":"policies that are customized in different way by users of OpenStack."},{"line_number":15,"context_line":"These policies need to be enforced and verified to ensure secure"},{"line_number":16,"context_line":"operation of an Openstack Deployment."},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_55a51f02","line":14,"range":{"start_line":14,"start_character":42,"end_line":14,"end_character":45},"updated":"2016-12-01 20:22:22.000000000","message":"s/way/ways/","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack deployments have standard RBAC (Role-based Access Control)"},{"line_number":14,"context_line":"policies that are customized in different way by users of OpenStack."},{"line_number":15,"context_line":"These policies need to be enforced and verified to ensure secure"},{"line_number":16,"context_line":"operation of an Openstack Deployment."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_f569cb8c","line":15,"updated":"2016-12-01 20:22:22.000000000","message":"might add \"the\" after secure","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":15,"context_line":"These policies need to be enforced and verified to ensure secure"},{"line_number":16,"context_line":"operation of an Openstack Deployment."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":"Currently there is no unified way to test RBAC"},{"line_number":21,"context_line":"policies are correctly enforced.  This is important because these policies"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_f5aaab6f","line":18,"range":{"start_line":18,"start_character":8,"end_line":18,"end_character":9},"updated":"2016-12-01 20:22:22.000000000","message":"s/d/D/","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":"Currently there is no unified way to test RBAC"},{"line_number":21,"context_line":"policies are correctly enforced.  This is important because these policies"},{"line_number":22,"context_line":"define how potentially sensitive information and functionality are accessed."},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_f5ee2beb","line":20,"range":{"start_line":20,"start_character":37,"end_line":20,"end_character":46},"updated":"2016-12-01 20:22:22.000000000","message":"change to \"test that RBAC\"","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":"Currently there is no unified way to test RBAC"},{"line_number":21,"context_line":"policies are correctly enforced.  This is important because these policies"},{"line_number":22,"context_line":"define how potentially sensitive information and functionality are accessed."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_15a1e7a9","line":21,"range":{"start_line":21,"start_character":33,"end_line":21,"end_character":34},"updated":"2016-12-01 20:22:22.000000000","message":"Extra whitespace","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":21,"context_line":"policies are correctly enforced.  This is important because these policies"},{"line_number":22,"context_line":"define how potentially sensitive information and functionality are accessed."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Proposed change"},{"line_number":25,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":26,"context_line":"The proposed solution involves creating a plugin that enables RBAC tests to be"},{"line_number":27,"context_line":"written in such a way that they can verify that an individual policy was"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_55b0bfdd","line":24,"range":{"start_line":24,"start_character":9,"end_line":24,"end_character":10},"updated":"2016-12-01 20:22:22.000000000","message":"s/c/C/","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":27,"context_line":"written in such a way that they can verify that an individual policy was"},{"line_number":28,"context_line":"correctly enforced on the specified rbac_role. Tests should primarily be written"},{"line_number":29,"context_line":"as an extension of an existing Tempest test that is wrapped in the plugin\u0027s"},{"line_number":30,"context_line":"functionality.  The plugin determines what roles should have access to a given"},{"line_number":31,"context_line":"API based on the policy.json file for that service."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"For example, a test can be written that only tests the policies for"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_9595f741","line":30,"range":{"start_line":30,"start_character":15,"end_line":30,"end_character":16},"updated":"2016-12-01 20:22:22.000000000","message":"extra whitespace","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":50,"context_line":"A key aspect of these tests is that they are testing only a single policy, even"},{"line_number":51,"context_line":"though a normal flow might require the usage of actions covered by multiple policies."},{"line_number":52,"context_line":"To enable this, the role used for the tests will alternate between \"admin\" and"},{"line_number":53,"context_line":"the \"rbac_role\" specified in the config options.  This is done so that there is no"},{"line_number":54,"context_line":"chance of other policies besides the one being tested changing the outcome of the test."},{"line_number":55,"context_line":"To switch roles, the switch_role method of rbac_utils is called.  Calling the method with"},{"line_number":56,"context_line":"switchToRbacRole\u003dTrue tells Keystone to set the current role to the \"rbac_role\" while"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_b53cb330","line":53,"range":{"start_line":53,"start_character":49,"end_line":53,"end_character":50},"updated":"2016-12-01 20:22:22.000000000","message":"extra whitespace","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":52,"context_line":"To enable this, the role used for the tests will alternate between \"admin\" and"},{"line_number":53,"context_line":"the \"rbac_role\" specified in the config options.  This is done so that there is no"},{"line_number":54,"context_line":"chance of other policies besides the one being tested changing the outcome of the test."},{"line_number":55,"context_line":"To switch roles, the switch_role method of rbac_utils is called.  Calling the method with"},{"line_number":56,"context_line":"switchToRbacRole\u003dTrue tells Keystone to set the current role to the \"rbac_role\" while"},{"line_number":57,"context_line":"switchToRbacRole\u003dFalse tells Keystone to set the current role to \"admin\"."},{"line_number":58,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_3517c3a4","line":55,"range":{"start_line":55,"start_character":65,"end_line":55,"end_character":66},"updated":"2016-12-01 20:22:22.000000000","message":"extra whitespace","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":57,"context_line":"switchToRbacRole\u003dFalse tells Keystone to set the current role to \"admin\"."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"This effort involves creating the plugin for new tests that verify correct"},{"line_number":60,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"},{"line_number":61,"context_line":"not intended to provide full testing coverage of all policies and APIs"},{"line_number":62,"context_line":"The core code will exist in an external repository containing a plugin, while"},{"line_number":63,"context_line":"individual tests will be written within the plugin.  There is not currently"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_b523d304","line":60,"range":{"start_line":60,"start_character":25,"end_line":60,"end_character":26},"updated":"2016-12-01 20:22:22.000000000","message":"extra whitespace","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"This effort involves creating the plugin for new tests that verify correct"},{"line_number":60,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"},{"line_number":61,"context_line":"not intended to provide full testing coverage of all policies and APIs"},{"line_number":62,"context_line":"The core code will exist in an external repository containing a plugin, while"},{"line_number":63,"context_line":"individual tests will be written within the plugin.  There is not currently"},{"line_number":64,"context_line":"any functionality that needs to be added to tempest/lib, but that may change as more"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_15ee478b","line":61,"updated":"2016-12-01 20:22:22.000000000","message":"Need a \u0027.\u0027 here","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":60,"context_line":"RBAC policy enforcement.  This effort will include sample tests but is"},{"line_number":61,"context_line":"not intended to provide full testing coverage of all policies and APIs"},{"line_number":62,"context_line":"The core code will exist in an external repository containing a plugin, while"},{"line_number":63,"context_line":"individual tests will be written within the plugin.  There is not currently"},{"line_number":64,"context_line":"any functionality that needs to be added to tempest/lib, but that may change as more"},{"line_number":65,"context_line":"tests are written."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_357ee3e4","line":63,"range":{"start_line":63,"start_character":52,"end_line":63,"end_character":53},"updated":"2016-12-01 20:22:22.000000000","message":"extra whitespace","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Advantages: Utilizing the cinnamon-role plugin enables RBAC functionality"},{"line_number":73,"context_line":"to be wrapped around existing tests with minimal extra effort."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Disadvantages:  Cinnamon-role doesn\u0027t allow for testing"},{"line_number":76,"context_line":"of individual API endpoints by switching role mid-test."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Another alternative is to add the RBAC test framework into Tempest\u0027s core functionality."}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_956df734","line":75,"range":{"start_line":75,"start_character":15,"end_line":75,"end_character":16},"updated":"2016-12-01 20:22:22.000000000","message":"extra whitespace","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Advantages: Easier deployment, don\u0027t need extra addons."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Disadvantages:  Rbac testing is not something that is considered part of Tempest\u0027s"},{"line_number":83,"context_line":"core functionality."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_f590ebee","line":82,"range":{"start_line":82,"start_character":15,"end_line":82,"end_character":16},"updated":"2016-12-01 20:22:22.000000000","message":"extra whitespace","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"c72b7d5204d8e13d599bc502572f9da9356c09cf","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Implementation"},{"line_number":92,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":93,"context_line":"Assignee(s)"},{"line_number":94,"context_line":"-----------"},{"line_number":95,"context_line":"Primary assignees:"},{"line_number":96,"context_line":"  david-purcell [david.purcell@att.com]"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a71b18c_3568a3f5","line":93,"updated":"2016-12-01 20:22:22.000000000","message":"Might need a newline here, rst might take this though, not sure.","commit_id":"b60d3441aaab2bbddc6f11707b33259b0d18447d"},{"author":{"_account_id":23276,"name":"Nicholas Jones","email":"nj762h@att.com","username":"nj762h"},"change_message_id":"7c227cadaa6b9b425874b89f44efb273b2bd410c","unresolved":false,"context_lines":[{"line_number":13,"context_line":"OpenStack deployments have standard RBAC (Role-Based Access Control)"},{"line_number":14,"context_line":"policies that are customized in different ways by users of OpenStack."},{"line_number":15,"context_line":"These policies need to be enforced and verified to ensure secure"},{"line_number":16,"context_line":"operation of an Openstack Deployment."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem Description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a71b18c_aa281e9b","line":16,"range":{"start_line":16,"start_character":16,"end_line":16,"end_character":25},"updated":"2016-12-06 19:26:08.000000000","message":"nit: Openstack -\u003e OpenStack","commit_id":"9967577dc5e8c227bfcd4b8dfd832237b488d129"}]}