Merge "Utilize policy.json by default (bug 1043758)"

etc/keystone.conf.sample

@@ -14,6 +14,14 @@
 # The port number which the OpenStack Compute service listens on
 # compute_port = 8774
 
+# Path to your policy definition containing identity actions
+# TODO(dolph): This config method will probably be deprecated during grizzly
+# policy_file = policy.json
+
+# Rule to check if no matching policy definition is found
+# FIXME(dolph): This should really be defined as [policy] default_rule
+# policy_default_rule = admin_required
+
 # === Logging Options ===
 # Print debugging output
 # verbose = False

keystone/config.py

@@ -130,6 +130,8 @@ register_str('public_port', default=5000)
 register_str('onready')
 register_str('auth_admin_prefix', default='')
 register_bool('standard-threads', default=False)
+register_str('policy_file', default='policy.json')
+register_str('policy_default_rule', default=None)
 
 #ssl options
 register_bool('enable', group='ssl', default=False)

keystone/policy/backends/rules.py

@@ -24,24 +24,10 @@ from keystone.common import policy as common_policy
 from keystone.common import utils
 from keystone import config
 from keystone import exception
-from keystone.openstack.common import cfg
 from keystone import policy
 
 
-policy_opts = [
-    cfg.StrOpt('policy_file',
-               default='policy.json',
-               help=_('JSON file representing policy')),
-    cfg.StrOpt('policy_default_rule',
-               default='default',
-               help=_('Rule checked when requested rule is not found')),
-]
-
-
 CONF = config.CONF
-CONF.register_opts(policy_opts)
-
-
 LOG = logging.getLogger(__name__)