move default rule to policy section in keystone.conf

[Steve Martinelli]

The following is currently in the keystone.conf file:

# Rule to check if no matching policy definition is found
# FIXME(dolph): This should really be defined as [policy] default_rule
# policy_default_rule = admin_required

As the comment suggest, we should move the config option to the policy section.
This will also impact oslo and we should ensure the old option is still supported for backwards compatibility.

[Dolph Mathews (dolph)]

https://review.openstack.org/#/c/70526/

[Adam Young (ayoung)]

Not certain I agree. This splits the policy file, so that defaults are not honored if policy is fetched from a remote server. Granted, the Keystone policy will use its local one, but the rules should be the same for all, especially with the unified policyfile approach.

[Steve Martinelli (stevemar)]

these are two disjoint entities. One is for oslo_policy (the default rule), the other is for keystone's policy database (largely unused).

with the release of oslo.policy as it's own project, this relationship had been made more clear, and no longer needs to be grouped together as the initial bug report suggests.