Comment 8 for bug 1703369

Revision history for this message
Boris Bobrov (bbobrov) wrote :

> Unless someone manually overrode policy to specify identity:get_identity_provider (singular), the result would be that the default rule was actually used for that check instead of identity:get_identity_providers.

Changing policy.json and default rules is a normal operation for the cloud. We were going to change it in our public cloud, for example.

> We could go back and fix the default policy.json for past releases, but the default actually has the same value as identity:get_identity_providers, and if nobody has complained it's probably safer to just leave it. It is, after all, just defaults there and anyone can override by specifying the correct value.

Or we could rename the controller to get_identity_providers. But i think the risk here would be bigger than if we just ignore it.

We probably will not backport it to prior releases.