<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Policy is supposed to allow access control to work across multiple
services and endpoints. However, each service has specified policy
differently. <br>
<br>
Here are some of the basic working assumptions for policy
enforcement we can use to work towards consistent enforcement.<br>
<br>
1) A policy rule should specify:<br>
Where do I find the scope in this request?<br>
What role does the token need to contain in order to access
this the API?<br>
<br>
Roles are not global. Roles are always scoped to something. Just
because someone has "admin" on one project or domain does not mean
they should have it everywhere. However, we have found a need to
have a global override. This is a way a cloud admin that can go
into any API anywhere and fix things.Even if we keep the mechanism,
I assume it will take a few iterations to phase out having this
specified on each rule.<br>
<br>
<br>
2) Policy rules should be namespaced by API type.<br>
<br>
for example, All of the Keystone policy rule targets start with:<br>
"identity:"<br>
<br>
such as<br>
<br>
<font face="sans-serif"><code><font face="sans-serif">
"identity:ec2_get_credential": "rule:admin_required or
(rule:owner and user_id:%(target.credential.user_id)s)"</font></code></font><br>
<br>
This means that Glance, Neutron, Nova, and Keystone should be able
to share a policy file.<br>
<br>
</body>
</html>