Looking at the two default policy files, i'm not sure what is causing the regression:
for liberty, the "admin_required" rule evaluates to: "admin_required": "role:admin"
liberty: "cloud_admin": "rule:admin_required and domain_id:admin_domain_id",
mitaka: "cloud_admin": "role:admin and (token.is_admin_project:True or domain_id:admin_domain_id)",
And since the extra stuff related to "token.is_admin_project:True" is in an OR, that change should be backwards compatible.
Looking at the two default policy files, i'm not sure what is causing the regression:
for liberty, the "admin_required" rule evaluates to: "admin_required": "role:admin"
liberty: "cloud_admin": "rule:admin_ required and domain_ id:admin_ domain_ id", is_admin_ project: True or domain_ id:admin_ domain_ id)",
mitaka: "cloud_admin": "role:admin and (token.
And since the extra stuff related to "token. is_admin_ project: True" is in an OR, that change should be backwards compatible.