@@ -14618,6 +14618,7 @@

     "required": [

      "userNames",

      "groupNames",

+     "subjects",

      "roleRef"

     ],

     "properties": {

@@ -14646,6 +14647,13 @@

       },

       "description": "all the groups directly bound to the role"

      },

+     "subjects": {

+      "type": "array",

+      "items": {

+       "$ref": "v1.ObjectReference"

+      },

+      "description": "references to subjects bound to the role.  Only User, Group, SystemUser, SystemGroup, and ServiceAccount are allowed."

+     },

      "roleRef": {

       "$ref": "v1.ObjectReference",

       "description": "reference to the policy role"

@@ -16900,6 +16908,7 @@

     "required": [

      "userNames",

      "groupNames",

+     "subjects",

      "roleRef"

     ],

     "properties": {

@@ -16928,6 +16937,13 @@

       },

       "description": "all the groups directly bound to the role"

      },

+     "subjects": {

+      "type": "array",

+      "items": {

+       "$ref": "v1.ObjectReference"

+      },

+      "description": "references to subjects bound to the role.  Only User, Group, SystemUser, SystemGroup, and ServiceAccount are allowed."

+     },

      "roleRef": {

       "$ref": "v1.ObjectReference",

       "description": "a reference to a role"

@@ -181,29 +181,17 @@ func deepCopy_api_ClusterRoleBinding(in api.ClusterRoleBinding, out *api.Cluster

 	} else {

 		out.ObjectMeta = newVal.(pkgapi.ObjectMeta)

 	}

-	if in.Users != nil {

-		out.Users = make(util.StringSet)

-		for key, val := range in.Users {

-			if newVal, err := c.DeepCopy(val); err != nil {

-				return err

-			} else {

-				out.Users[key] = newVal.(util.Empty)

-			}

-		}

-	} else {

-		out.Users = nil

-	}

-	if in.Groups != nil {

-		out.Groups = make(util.StringSet)

-		for key, val := range in.Groups {

-			if newVal, err := c.DeepCopy(val); err != nil {

+	if in.Subjects != nil {

+		out.Subjects = make([]pkgapi.ObjectReference, len(in.Subjects))

+		for i := range in.Subjects {

+			if newVal, err := c.DeepCopy(in.Subjects[i]); err != nil {

 				return err

 			} else {

-				out.Groups[key] = newVal.(util.Empty)

+				out.Subjects[i] = newVal.(pkgapi.ObjectReference)

 			}

 		}

 	} else {

-		out.Groups = nil

+		out.Subjects = nil

 	}

 	if newVal, err := c.DeepCopy(in.RoleRef); err != nil {

 		return err

@@ -560,29 +548,17 @@ func deepCopy_api_RoleBinding(in api.RoleBinding, out *api.RoleBinding, c *conve

 	} else {

 		out.ObjectMeta = newVal.(pkgapi.ObjectMeta)

 	}

-	if in.Users != nil {

-		out.Users = make(util.StringSet)

-		for key, val := range in.Users {

-			if newVal, err := c.DeepCopy(val); err != nil {

-				return err

-			} else {

-				out.Users[key] = newVal.(util.Empty)

-			}

-		}

-	} else {

-		out.Users = nil

-	}

-	if in.Groups != nil {

-		out.Groups = make(util.StringSet)

-		for key, val := range in.Groups {

-			if newVal, err := c.DeepCopy(val); err != nil {

+	if in.Subjects != nil {

+		out.Subjects = make([]pkgapi.ObjectReference, len(in.Subjects))

+		for i := range in.Subjects {

+			if newVal, err := c.DeepCopy(in.Subjects[i]); err != nil {

 				return err

 			} else {

-				out.Groups[key] = newVal.(util.Empty)

+				out.Subjects[i] = newVal.(pkgapi.ObjectReference)

 			}

 		}

 	} else {

-		out.Groups = nil

+		out.Subjects = nil

 	}

 	if newVal, err := c.DeepCopy(in.RoleRef); err != nil {

 		return err

@@ -1,6 +1,7 @@

 package api_test

 import (

+	"fmt"

 	"math/rand"

 	"reflect"

 	"strings"

@@ -11,8 +12,10 @@ import (

 	"k8s.io/kubernetes/pkg/api"

 	"k8s.io/kubernetes/pkg/api/meta"

 	apitesting "k8s.io/kubernetes/pkg/api/testing"

+	"k8s.io/kubernetes/pkg/api/validation"

 	"k8s.io/kubernetes/pkg/conversion"

 	"k8s.io/kubernetes/pkg/runtime"

+	"k8s.io/kubernetes/pkg/types"

 	"k8s.io/kubernetes/pkg/util"

 	osapi "github.com/openshift/origin/pkg/api"

@@ -24,6 +27,7 @@ import (

 	deploy "github.com/openshift/origin/pkg/deploy/api"

 	image "github.com/openshift/origin/pkg/image/api"

 	template "github.com/openshift/origin/pkg/template/api"

+	uservalidation "github.com/openshift/origin/pkg/user/api/validation"

 )

 func fuzzInternalObject(t *testing.T, forVersion string, item runtime.Object, seed int64) runtime.Object {

@@ -42,6 +46,82 @@ func fuzzInternalObject(t *testing.T, forVersion string, item runtime.Object, se

 		func(j *authorizationapi.ClusterPolicyBinding, c fuzz.Continue) {

 			j.RoleBindings = make(map[string]*authorizationapi.ClusterRoleBinding)

 		},

+		func(j *authorizationapi.RoleBinding, c fuzz.Continue) {

+			c.FuzzNoCustom(j)

+			for i := range j.Subjects {

+				kinds := []string{authorizationapi.UserKind, authorizationapi.SystemUserKind, authorizationapi.GroupKind, authorizationapi.SystemGroupKind, authorizationapi.ServiceAccountKind}

+				j.Subjects[i].Kind = kinds[c.Intn(len(kinds))]

+				switch j.Subjects[i].Kind {

+				case authorizationapi.UserKind:

+					j.Subjects[i].Namespace = ""

+					if valid, _ := uservalidation.ValidateUserName(j.Subjects[i].Name, false); !valid {

+						j.Subjects[i].Name = fmt.Sprintf("validusername%d", i)

+					}

+

+				case authorizationapi.GroupKind:

+					j.Subjects[i].Namespace = ""

+					if valid, _ := uservalidation.ValidateGroupName(j.Subjects[i].Name, false); !valid {

+						j.Subjects[i].Name = fmt.Sprintf("validgroupname%d", i)

+					}

+

+				case authorizationapi.ServiceAccountKind:

+					if valid, _ := validation.ValidateNamespaceName(j.Subjects[i].Namespace, false); !valid {

+						j.Subjects[i].Namespace = fmt.Sprintf("sanamespacehere%d", i)

+					}

+					if valid, _ := validation.ValidateServiceAccountName(j.Subjects[i].Name, false); !valid {

+						j.Subjects[i].Name = fmt.Sprintf("sanamehere%d", i)

+					}

+

+				case authorizationapi.SystemUserKind, authorizationapi.SystemGroupKind:

+					j.Subjects[i].Namespace = ""

+					j.Subjects[i].Name = ":" + j.Subjects[i].Name

+

+				}

+

+				j.Subjects[i].UID = types.UID("")

+				j.Subjects[i].APIVersion = ""

+				j.Subjects[i].ResourceVersion = ""

+				j.Subjects[i].FieldPath = ""

+			}

+		},

+		func(j *authorizationapi.ClusterRoleBinding, c fuzz.Continue) {

+			c.FuzzNoCustom(j)

+			for i := range j.Subjects {

+				kinds := []string{authorizationapi.UserKind, authorizationapi.SystemUserKind, authorizationapi.GroupKind, authorizationapi.SystemGroupKind, authorizationapi.ServiceAccountKind}

+				j.Subjects[i].Kind = kinds[c.Intn(len(kinds))]

+				switch j.Subjects[i].Kind {

+				case authorizationapi.UserKind:

+					j.Subjects[i].Namespace = ""

+					if valid, _ := uservalidation.ValidateUserName(j.Subjects[i].Name, false); !valid {

+						j.Subjects[i].Name = fmt.Sprintf("validusername%d", i)

+					}

+

+				case authorizationapi.GroupKind:

+					j.Subjects[i].Namespace = ""

+					if valid, _ := uservalidation.ValidateGroupName(j.Subjects[i].Name, false); !valid {

+						j.Subjects[i].Name = fmt.Sprintf("validgroupname%d", i)

+					}

+

+				case authorizationapi.ServiceAccountKind:

+					if valid, _ := validation.ValidateNamespaceName(j.Subjects[i].Namespace, false); !valid {

+						j.Subjects[i].Namespace = fmt.Sprintf("sanamespacehere%d", i)

+					}

+					if valid, _ := validation.ValidateServiceAccountName(j.Subjects[i].Name, false); !valid {

+						j.Subjects[i].Name = fmt.Sprintf("sanamehere%d", i)

+					}

+

+				case authorizationapi.SystemUserKind, authorizationapi.SystemGroupKind:

+					j.Subjects[i].Namespace = ""

+					j.Subjects[i].Name = ":" + j.Subjects[i].Name

+

+				}

+

+				j.Subjects[i].UID = types.UID("")

+				j.Subjects[i].APIVersion = ""

+				j.Subjects[i].ResourceVersion = ""

+				j.Subjects[i].FieldPath = ""

+			}

+		},

 		func(j *template.Template, c fuzz.Continue) {

 			c.Fuzz(&j.ObjectMeta)

 			c.Fuzz(&j.Parameters)

@@ -194,6 +194,18 @@ func deepCopy_v1_ClusterRoleBinding(in v1.ClusterRoleBinding, out *v1.ClusterRol

 	} else {

 		out.GroupNames = nil

 	}

+	if in.Subjects != nil {

+		out.Subjects = make([]pkgapiv1.ObjectReference, len(in.Subjects))

+		for i := range in.Subjects {

+			if newVal, err := c.DeepCopy(in.Subjects[i]); err != nil {

+				return err

+			} else {

+				out.Subjects[i] = newVal.(pkgapiv1.ObjectReference)

+			}

+		}

+	} else {

+		out.Subjects = nil

+	}

 	if newVal, err := c.DeepCopy(in.RoleRef); err != nil {

 		return err

 	} else {

@@ -565,6 +577,18 @@ func deepCopy_v1_RoleBinding(in v1.RoleBinding, out *v1.RoleBinding, c *conversi

 	} else {

 		out.GroupNames = nil

 	}

+	if in.Subjects != nil {

+		out.Subjects = make([]pkgapiv1.ObjectReference, len(in.Subjects))

+		for i := range in.Subjects {

+			if newVal, err := c.DeepCopy(in.Subjects[i]); err != nil {

+				return err

+			} else {

+				out.Subjects[i] = newVal.(pkgapiv1.ObjectReference)

+			}

+		}

+	} else {

+		out.Subjects = nil

+	}

 	if newVal, err := c.DeepCopy(in.RoleRef); err != nil {

 		return err

 	} else {

@@ -194,6 +194,18 @@ func deepCopy_v1beta3_ClusterRoleBinding(in v1beta3.ClusterRoleBinding, out *v1b

 	} else {

 		out.GroupNames = nil

 	}

+	if in.Subjects != nil {

+		out.Subjects = make([]pkgapiv1beta3.ObjectReference, len(in.Subjects))

+		for i := range in.Subjects {

+			if newVal, err := c.DeepCopy(in.Subjects[i]); err != nil {

+				return err

+			} else {

+				out.Subjects[i] = newVal.(pkgapiv1beta3.ObjectReference)

+			}

+		}

+	} else {

+		out.Subjects = nil

+	}

 	if newVal, err := c.DeepCopy(in.RoleRef); err != nil {

 		return err

 	} else {

@@ -573,6 +585,18 @@ func deepCopy_v1beta3_RoleBinding(in v1beta3.RoleBinding, out *v1beta3.RoleBindi

 	} else {

 		out.GroupNames = nil

 	}

+	if in.Subjects != nil {

+		out.Subjects = make([]pkgapiv1beta3.ObjectReference, len(in.Subjects))

+		for i := range in.Subjects {

+			if newVal, err := c.DeepCopy(in.Subjects[i]); err != nil {

+				return err

+			} else {

+				out.Subjects[i] = newVal.(pkgapiv1beta3.ObjectReference)

+			}

+		}

+	} else {

+		out.Subjects = nil

+	}

 	if newVal, err := c.DeepCopy(in.RoleRef); err != nil {

 		return err

 	} else {

@@ -167,8 +167,7 @@ func ToRoleBinding(in *ClusterRoleBinding) *RoleBinding {

 	ret := &RoleBinding{}

 	ret.ObjectMeta = in.ObjectMeta

-	ret.Users = in.Users

-	ret.Groups = in.Groups

+	ret.Subjects = in.Subjects

 	ret.RoleRef = ToRoleRef(in.RoleRef)

 	return ret

 }

@@ -235,8 +234,7 @@ func ToClusterRoleBinding(in *RoleBinding) *ClusterRoleBinding {

 	ret := &ClusterRoleBinding{}

 	ret.ObjectMeta = in.ObjectMeta

-	ret.Users = in.Users

-	ret.Groups = in.Groups

+	ret.Subjects = in.Subjects

 	ret.RoleRef = ToClusterRoleRef(in.RoleRef)

 	return ret

@@ -5,7 +5,12 @@ import (

 	"sort"

 	"strings"

+	kapi "k8s.io/kubernetes/pkg/api"

+	"k8s.io/kubernetes/pkg/api/validation"

+	"k8s.io/kubernetes/pkg/controller/serviceaccount"

 	kutil "k8s.io/kubernetes/pkg/util"

+

+	// uservalidation "github.com/openshift/origin/pkg/user/api/validation"

 )

 func ExpandResources(rawResources kutil.StringSet) kutil.StringSet {

@@ -85,3 +90,91 @@ func GetPolicyBindingName(policyRefNamespace string) string {

 }

 var ClusterPolicyBindingName = GetPolicyBindingName("")

+

+func BuildSubjects(users, groups []string, userNameValidator, groupNameValidator validation.ValidateNameFunc) []kapi.ObjectReference {

+	subjects := []kapi.ObjectReference{}

+

+	for _, user := range users {

+		saNamespace, saName, err := serviceaccount.SplitUsername(user)

+		if err == nil {

+			subjects = append(subjects, kapi.ObjectReference{Kind: ServiceAccountKind, Namespace: saNamespace, Name: saName})

+			continue

+		}

+

+		kind := UserKind

+		if valid, _ := userNameValidator(user, false); !valid {

+			kind = SystemUserKind

+		}

+

+		subjects = append(subjects, kapi.ObjectReference{Kind: kind, Name: user})

+	}

+

+	for _, group := range groups {

+		kind := GroupKind

+		if valid, _ := groupNameValidator(group, false); !valid {

+			kind = SystemGroupKind

+		}

+

+		subjects = append(subjects, kapi.ObjectReference{Kind: kind, Name: group})

+	}

+

+	return subjects

+}

+

+// StringSubjectsFor returns users and groups for comparison against user.Info.  currentNamespace is used to

+// to create usernames for service accounts where namespace=="".

+func StringSubjectsFor(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string) {

+	users := []string{}

+	groups := []string{}

+

+	for _, subject := range subjects {

+		switch subject.Kind {

+		case ServiceAccountKind:

+			namespace := currentNamespace

+			if len(subject.Namespace) > 0 {

+				namespace = subject.Namespace

+			}

+			users = append(users, serviceaccount.MakeUsername(namespace, subject.Name))

+

+		case UserKind, SystemUserKind:

+			users = append(users, subject.Name)

+

+		case GroupKind, SystemGroupKind:

+			groups = append(groups, subject.Name)

+		}

+	}

+

+	return users, groups

+}

+

+// SubjectsStrings returns users, groups, serviceaccounts, unknown for display purposes.  currentNamespace is used to

+// hide the subject.Namespace for ServiceAccounts in the currentNamespace

+func SubjectsStrings(currentNamespace string, subjects []kapi.ObjectReference) ([]string, []string, []string, []string) {

+	users := []string{}

+	groups := []string{}

+	sas := []string{}

+	others := []string{}

+

+	for _, subject := range subjects {

+		switch subject.Kind {

+		case ServiceAccountKind:

+			if len(subject.Namespace) > 0 && currentNamespace != subject.Namespace {

+				sas = append(sas, subject.Namespace+"/"+subject.Name)

+			} else {

+				sas = append(sas, subject.Name)

+			}

+

+		case UserKind, SystemUserKind:

+			users = append(users, subject.Name)

+

+		case GroupKind, SystemGroupKind:

+			groups = append(groups, subject.Name)

+

+		default:

+			others = append(others, fmt.Sprintf("%s/%s/%s", subject.Kind, subject.Namespace, subject.Name))

+

+		}

+	}

+

+	return users, groups, sas, others

+}

@@ -19,6 +19,12 @@ const (

 	ResourceAll    = "*"

 	VerbAll        = "*"

 	NonResourceAll = "*"

+

+	UserKind           = "User"

+	GroupKind          = "Group"

+	ServiceAccountKind = "ServiceAccount"

+	SystemUserKind     = "SystemUser"

+	SystemGroupKind    = "SystemGroup"

 )

 const (

@@ -142,10 +148,8 @@ type RoleBinding struct {

 	kapi.TypeMeta

 	kapi.ObjectMeta

-	// Users holds all the usernames directly bound to the role

-	Users util.StringSet

-	// Groups holds all the groups directly bound to the role

-	Groups util.StringSet

+	// Subjects hold object references of to authorize with this rule

+	Subjects []kapi.ObjectReference

 	// RoleRef can only reference the current namespace and the global namespace

 	// If the RoleRef cannot be resolved, the Authorizer must return an error.

@@ -311,10 +315,8 @@ type ClusterRoleBinding struct {

 	kapi.TypeMeta

 	kapi.ObjectMeta

-	// Users holds all the usernames directly bound to the role

-	Users util.StringSet

-	// GroupNames holds all the groups directly bound to the role

-	Groups util.StringSet

+	// Subjects hold object references of to authorize with this rule

+	Subjects []kapi.ObjectReference

 	// RoleRef can only reference the current namespace and the global namespace

 	// If the ClusterRoleRef cannot be resolved, the Authorizer must return an error.

@@ -8,6 +8,7 @@ import (

 	"k8s.io/kubernetes/pkg/util"

 	newer "github.com/openshift/origin/pkg/authorization/api"

+	uservalidation "github.com/openshift/origin/pkg/user/api/validation"

 )

 func convert_v1_ResourceAccessReview_To_api_ResourceAccessReview(in *ResourceAccessReview, out *newer.ResourceAccessReview, s conversion.Scope) error {

@@ -181,8 +182,12 @@ func convert_v1_RoleBinding_To_api_RoleBinding(in *RoleBinding, out *newer.RoleB

 		return err

 	}

-	out.Users = util.NewStringSet(in.UserNames...)

-	out.Groups = util.NewStringSet(in.GroupNames...)

+	// if the users and groups fields are cleared, then respect only subjects.  The field was set in the DefaultConvert above

+	if in.UserNames == nil && in.GroupNames == nil {

+		return nil

+	}

+

+	out.Subjects = newer.BuildSubjects(in.UserNames, in.GroupNames, uservalidation.ValidateUserName, uservalidation.ValidateGroupName)

 	return nil

 }

@@ -192,8 +197,7 @@ func convert_api_RoleBinding_To_v1_RoleBinding(in *newer.RoleBinding, out *RoleB

 		return err

 	}

-	out.UserNames = in.Users.List()

-	out.GroupNames = in.Groups.List()

+	out.UserNames, out.GroupNames = newer.StringSubjectsFor(in.Namespace, in.Subjects)

 	return nil

 }

@@ -228,8 +232,12 @@ func convert_v1_ClusterRoleBinding_To_api_ClusterRoleBinding(in *ClusterRoleBind

 		return err

 	}

-	out.Users = util.NewStringSet(in.UserNames...)

-	out.Groups = util.NewStringSet(in.GroupNames...)

+	// if the users and groups fields are cleared, then respect only subjects.  The field was set in the DefaultConvert above

+	if in.UserNames == nil && in.GroupNames == nil {

+		return nil

+	}

+

+	out.Subjects = newer.BuildSubjects(in.UserNames, in.GroupNames, uservalidation.ValidateUserName, uservalidation.ValidateGroupName)

 	return nil

 }

@@ -239,8 +247,7 @@ func convert_api_ClusterRoleBinding_To_v1_ClusterRoleBinding(in *newer.ClusterRo

 		return err

 	}

-	out.UserNames = in.Users.List()

-	out.GroupNames = in.Groups.List()

+	out.UserNames, out.GroupNames = newer.StringSubjectsFor(in.Namespace, in.Subjects)

 	return nil

 }

@@ -55,6 +55,8 @@ type RoleBinding struct {

 	UserNames []string `json:"userNames" description:"all the usernames directly bound to the role"`

 	// GroupNames holds all the groups directly bound to the role

 	GroupNames []string `json:"groupNames" description:"all the groups directly bound to the role"`

+	// Subjects hold object references to authorize with this rule

+	Subjects []kapi.ObjectReference `json:"subjects" description:"references to subjects bound to the role.  Only User, Group, SystemUser, SystemGroup, and ServiceAccount are allowed."`

 	// RoleRef can only reference the current namespace and the global namespace

 	// If the RoleRef cannot be resolved, the Authorizer must return an error.

@@ -234,6 +236,8 @@ type ClusterRoleBinding struct {

 	UserNames []string `json:"userNames" description:"all user names directly bound to the role"`

 	// GroupNames holds all the groups directly bound to the role

 	GroupNames []string `json:"groupNames" description:"all the groups directly bound to the role"`

+	// Subjects hold object references to authorize with this rule

+	Subjects []kapi.ObjectReference `json:"subjects" description:"references to subjects bound to the role.  Only User, Group, SystemUser, SystemGroup, and ServiceAccount are allowed."`

 	// RoleRef can only reference the current namespace and the global namespace

 	// If the ClusterRoleRef cannot be resolved, the Authorizer must return an error.

@@ -8,6 +8,7 @@ import (

 	"k8s.io/kubernetes/pkg/util"

 	newer "github.com/openshift/origin/pkg/authorization/api"

+	uservalidation "github.com/openshift/origin/pkg/user/api/validation"

 )

 func convert_v1beta3_ResourceAccessReview_To_api_ResourceAccessReview(in *ResourceAccessReview, out *newer.ResourceAccessReview, s conversion.Scope) error {

@@ -182,8 +183,12 @@ func convert_v1beta3_RoleBinding_To_api_RoleBinding(in *RoleBinding, out *newer.

 		return err

 	}

-	out.Users = util.NewStringSet(in.UserNames...)

-	out.Groups = util.NewStringSet(in.GroupNames...)

+	// if the users and groups fields are cleared, then respect only subjects.  The field was set in the DefaultConvert above

+	if in.UserNames == nil && in.GroupNames == nil {

+		return nil

+	}

+

+	out.Subjects = newer.BuildSubjects(in.UserNames, in.GroupNames, uservalidation.ValidateUserName, uservalidation.ValidateGroupName)

 	return nil

 }

@@ -193,8 +198,7 @@ func convert_api_RoleBinding_To_v1beta3_RoleBinding(in *newer.RoleBinding, out *

 		return err

 	}

-	out.UserNames = in.Users.List()

-	out.GroupNames = in.Groups.List()

+	out.UserNames, out.GroupNames = newer.StringSubjectsFor(in.Namespace, in.Subjects)

 	return nil

 }

@@ -229,8 +233,12 @@ func convert_v1beta3_ClusterRoleBinding_To_api_ClusterRoleBinding(in *ClusterRol

 		return err

 	}

-	out.Users = util.NewStringSet(in.UserNames...)

-	out.Groups = util.NewStringSet(in.GroupNames...)

+	// if the users and groups fields are cleared, then respect only subjects.  The field was set in the DefaultConvert above

+	if in.UserNames == nil && in.GroupNames == nil {

+		return nil

+	}

+

+	out.Subjects = newer.BuildSubjects(in.UserNames, in.GroupNames, uservalidation.ValidateUserName, uservalidation.ValidateGroupName)

 	return nil

 }

@@ -240,8 +248,7 @@ func convert_api_ClusterRoleBinding_To_v1beta3_ClusterRoleBinding(in *newer.Clus

 		return err

 	}

-	out.UserNames = in.Users.List()

-	out.GroupNames = in.Groups.List()

+	out.UserNames, out.GroupNames = newer.StringSubjectsFor(in.Namespace, in.Subjects)

 	return nil

 }

@@ -58,6 +58,8 @@ type RoleBinding struct {

 	UserNames []string `json:"userNames"`

 	// GroupNames holds all the groups directly bound to the role

 	GroupNames []string `json:"groupNames"`

+	// Subjects hold object references to authorize with this rule

+	Subjects []kapi.ObjectReference `json:"subjects"`

 	// Since Policy is a singleton, this is sufficient knowledge to locate a role

 	// RoleRefs can only reference the current namespace and the global namespace

@@ -229,6 +231,8 @@ type ClusterRoleBinding struct {

 	UserNames []string `json:"userNames"`

 	// GroupNames holds all the groups directly bound to the role

 	GroupNames []string `json:"groupNames"`

+	// Subjects hold object references to authorize with this rule

+	Subjects []kapi.ObjectReference `json:"subjects"`

 	// Since Policy is a singleton, this is sufficient knowledge to locate a role

 	// ClusterRoleRefs can only reference the current namespace and the global namespace

@@ -1,12 +1,16 @@

 package validation

 import (

+	"fmt"

+

+	kapi "k8s.io/kubernetes/pkg/api"

 	"k8s.io/kubernetes/pkg/api/validation"

 	"k8s.io/kubernetes/pkg/util"

 	"k8s.io/kubernetes/pkg/util/fielderrors"

 	oapi "github.com/openshift/origin/pkg/api"

 	authorizationapi "github.com/openshift/origin/pkg/authorization/api"

+	uservalidation "github.com/openshift/origin/pkg/user/api/validation"

 )

 func ValidateSubjectAccessReview(review *authorizationapi.SubjectAccessReview) fielderrors.ValidationErrorList {

@@ -248,6 +252,67 @@ func ValidateRoleBinding(roleBinding *authorizationapi.RoleBinding, isNamespaced

 		}

 	}

+	for i, subject := range roleBinding.Subjects {

+		allErrs = append(allErrs, ValidateRoleBindingSubject(subject, isNamespaced).Prefix(fmt.Sprintf("subjects[%d]", i))...)

+	}

+

+	return allErrs

+}

+

+func ValidateRoleBindingSubject(subject kapi.ObjectReference, isNamespaced bool) fielderrors.ValidationErrorList {

+	allErrs := fielderrors.ValidationErrorList{}

+

+	if len(subject.Name) == 0 {

+		allErrs = append(allErrs, fielderrors.NewFieldRequired("name"))

+	}

+	if len(subject.UID) != 0 {

+		allErrs = append(allErrs, fielderrors.NewFieldForbidden("uid", subject.UID))

+	}

+	if len(subject.APIVersion) != 0 {

+		allErrs = append(allErrs, fielderrors.NewFieldForbidden("apiVersion", subject.APIVersion))

+	}

+	if len(subject.ResourceVersion) != 0 {

+		allErrs = append(allErrs, fielderrors.NewFieldForbidden("resourceVersion", subject.ResourceVersion))

+	}

+	if len(subject.FieldPath) != 0 {

+		allErrs = append(allErrs, fielderrors.NewFieldForbidden("fieldPath", subject.FieldPath))

+	}

+

+	switch subject.Kind {

+	case authorizationapi.ServiceAccountKind:

+		if valid, reason := validation.ValidateServiceAccountName(subject.Name, false); len(subject.Name) > 0 && !valid {

+			allErrs = append(allErrs, fielderrors.NewFieldInvalid("name", subject.Name, reason))

+		}

+		if !isNamespaced && len(subject.Namespace) == 0 {

+			allErrs = append(allErrs, fielderrors.NewFieldRequired("namespace"))

+		}

+

+	case authorizationapi.UserKind:

+		if valid, reason := uservalidation.ValidateUserName(subject.Name, false); len(subject.Name) > 0 && !valid {

+			allErrs = append(allErrs, fielderrors.NewFieldInvalid("name", subject.Name, reason))

+		}

+

+	case authorizationapi.GroupKind:

+		if valid, reason := uservalidation.ValidateGroupName(subject.Name, false); len(subject.Name) > 0 && !valid {

+			allErrs = append(allErrs, fielderrors.NewFieldInvalid("name", subject.Name, reason))

+		}

+

+	case authorizationapi.SystemUserKind:

+		isValidSAName, _ := validation.ValidateServiceAccountName(subject.Name, false)

+		isValidUserName, _ := uservalidation.ValidateUserName(subject.Name, false)

+		if isValidSAName || isValidUserName {

+			allErrs = append(allErrs, fielderrors.NewFieldInvalid("name", subject.Name, "conforms to User.name or ServiceAccount.name restrictions"))

+		}

+

+	case authorizationapi.SystemGroupKind:

+		if valid, _ := uservalidation.ValidateGroupName(subject.Name, false); len(subject.Name) > 0 && valid {

+			allErrs = append(allErrs, fielderrors.NewFieldInvalid("name", subject.Name, "conforms to Group.name restrictions"))

+		}

+

+	default:

+		allErrs = append(allErrs, fielderrors.NewFieldValueNotSupported("kind", subject.Kind, []string{authorizationapi.ServiceAccountKind, authorizationapi.UserKind, authorizationapi.GroupKind, authorizationapi.SystemGroupKind, authorizationapi.SystemUserKind}))

+	}

+

 	return allErrs

 }

@@ -168,6 +168,13 @@ func TestValidateRoleBinding(t *testing.T) {

 		&authorizationapi.RoleBinding{

 			ObjectMeta: kapi.ObjectMeta{Namespace: kapi.NamespaceDefault, Name: "master"},

 			RoleRef:    kapi.ObjectReference{Namespace: "master", Name: "valid"},

+			Subjects: []kapi.ObjectReference{

+				{Name: "validsaname", Kind: authorizationapi.ServiceAccountKind},

+				{Name: "valid@username", Kind: authorizationapi.UserKind},

+				{Name: "system:admin", Kind: authorizationapi.SystemUserKind},

+				{Name: "valid@groupname", Kind: authorizationapi.GroupKind},

+				{Name: "system:authenticated", Kind: authorizationapi.SystemGroupKind},

+			},

 		},

 		true,

 	)

@@ -212,6 +219,60 @@ func TestValidateRoleBinding(t *testing.T) {

 			T: fielderrors.ValidationErrorTypeRequired,

 			F: "roleRef.name",

 		},

+		"bad subject kind": {

+			A: authorizationapi.RoleBinding{

+				ObjectMeta: kapi.ObjectMeta{Namespace: kapi.NamespaceDefault, Name: "master"},

+				RoleRef:    kapi.ObjectReference{Namespace: "master", Name: "valid"},

+				Subjects:   []kapi.ObjectReference{{Name: "subject"}},

+			},

+			T: fielderrors.ValidationErrorTypeNotSupported,

+			F: "subjects[0].kind",

+		},

+		"bad subject name": {

+			A: authorizationapi.RoleBinding{

+				ObjectMeta: kapi.ObjectMeta{Namespace: kapi.NamespaceDefault, Name: "master"},

+				RoleRef:    kapi.ObjectReference{Namespace: "master", Name: "valid"},

+				Subjects:   []kapi.ObjectReference{{Name: "subject:bad", Kind: authorizationapi.ServiceAccountKind}},

+			},

+			T: fielderrors.ValidationErrorTypeInvalid,

+			F: "subjects[0].name",

+		},

+		"bad system user name": {

+			A: authorizationapi.RoleBinding{

+				ObjectMeta: kapi.ObjectMeta{Namespace: kapi.NamespaceDefault, Name: "master"},

+				RoleRef:    kapi.ObjectReference{Namespace: "master", Name: "valid"},

+				Subjects:   []kapi.ObjectReference{{Name: "user", Kind: authorizationapi.SystemUserKind}},

+			},

+			T: fielderrors.ValidationErrorTypeInvalid,

+			F: "subjects[0].name",

+		},

+		"bad system group name": {

+			A: authorizationapi.RoleBinding{

+				ObjectMeta: kapi.ObjectMeta{Namespace: kapi.NamespaceDefault, Name: "master"},

+				RoleRef:    kapi.ObjectReference{Namespace: "master", Name: "valid"},

+				Subjects:   []kapi.ObjectReference{{Name: "valid", Kind: authorizationapi.SystemGroupKind}},

+			},

+			T: fielderrors.ValidationErrorTypeInvalid,

+			F: "subjects[0].name",

+		},

+		"forbidden fields": {

+			A: authorizationapi.RoleBinding{

+				ObjectMeta: kapi.ObjectMeta{Namespace: kapi.NamespaceDefault, Name: "master"},

+				RoleRef:    kapi.ObjectReference{Namespace: "master", Name: "valid"},

+				Subjects:   []kapi.ObjectReference{{Name: "subject", Kind: authorizationapi.ServiceAccountKind, APIVersion: "foo"}},

+			},

+			T: fielderrors.ValidationErrorTypeForbidden,

+			F: "subjects[0].apiVersion",

+		},

+		"missing subject name": {

+			A: authorizationapi.RoleBinding{

+				ObjectMeta: kapi.ObjectMeta{Namespace: kapi.NamespaceDefault, Name: "master"},

+				RoleRef:    kapi.ObjectReference{Namespace: "master", Name: "valid"},

+				Subjects:   []kapi.ObjectReference{{Kind: authorizationapi.ServiceAccountKind}},

+			},

+			T: fielderrors.ValidationErrorTypeRequired,

+			F: "subjects[0].name",

+		},

 	}

 	for k, v := range errorCases {

 		errs := ValidateRoleBinding(&v.A, true)

@@ -8,6 +8,7 @@ import (

 	kapi "k8s.io/kubernetes/pkg/api"

 	"k8s.io/kubernetes/pkg/auth/user"

+	"k8s.io/kubernetes/pkg/controller/serviceaccount"

 	"k8s.io/kubernetes/pkg/util"

 	authorizationapi "github.com/openshift/origin/pkg/authorization/api"

@@ -65,6 +66,58 @@ func TestResourceNameAllow(t *testing.T) {

 	test.test(t)

 }

+func TestClusterBindingServiceAccountSubject(t *testing.T) {

+	test := &authorizeTest{

+		context: kapi.WithUser(kapi.WithNamespace(kapi.NewContext(), kapi.NamespaceNone), &user.DefaultInfo{Name: serviceaccount.MakeUsername("foo", "default")}),

+		attributes: &DefaultAuthorizationAttributes{

+			Verb:         "get",

+			Resource:     "users",

+			ResourceName: "any",

+		},

+		expectedAllowed: true,

+		expectedReason:  "allowed by cluster rule",

+	}

+	test.clusterPolicies = newDefaultClusterPolicies()

+	test.clusterBindings = newDefaultClusterPolicyBindings()

+	test.test(t)

+}

+

+func TestLocalBindingServiceAccountSubject(t *testing.T) {

+	test := &authorizeTest{

+		context: kapi.WithUser(kapi.WithNamespace(kapi.NewContext(), "adze"), &user.DefaultInfo{Name: serviceaccount.MakeUsername("adze", "second")}),

+		attributes: &DefaultAuthorizationAttributes{

+			Verb:     "get",

+			Resource: "pods",

+		},

+		expectedAllowed: true,

+		expectedReason:  "allowed by rule in adze",

+	}

+	test.clusterPolicies = newDefaultClusterPolicies()

+	test.policies = append(test.policies, newAdzePolicies()...)

+	test.clusterBindings = newDefaultClusterPolicyBindings()

+	test.bindings = append(test.bindings, newAdzeBindings()...)

+

+	test.test(t)

+}

+

+func TestLocalBindingOtherServiceAccountSubject(t *testing.T) {

+	test := &authorizeTest{

+		context: kapi.WithUser(kapi.WithNamespace(kapi.NewContext(), "adze"), &user.DefaultInfo{Name: serviceaccount.MakeUsername("other", "first")}),

+		attributes: &DefaultAuthorizationAttributes{

+			Verb:     "get",

+			Resource: "pods",

+		},

+		expectedAllowed: true,

+		expectedReason:  "allowed by rule in adze",

+	}

+	test.clusterPolicies = newDefaultClusterPolicies()

+	test.policies = append(test.policies, newAdzePolicies()...)

+	test.clusterBindings = newDefaultClusterPolicyBindings()

+	test.bindings = append(test.bindings, newAdzeBindings()...)

+

+	test.test(t)

+}

+

 func TestDeniedWithError(t *testing.T) {

 	test := &authorizeTest{

 		context: kapi.WithUser(kapi.WithNamespace(kapi.NewContext(), "adze"), &user.DefaultInfo{Name: "Anna"}),

@@ -86,7 +139,7 @@ func TestDeniedWithError(t *testing.T) {

 		RoleRef: kapi.ObjectReference{

 			Name: "not-a-real-binding",

 		},

-		Users: util.NewStringSet("Anna"),

+		Subjects: []kapi.ObjectReference{{Kind: authorizationapi.UserKind, Name: "Anna"}},

 	}

 	test.policyRetrievalError = errors.New("my special error")

@@ -114,7 +167,7 @@ func TestAllowedWithMissingBinding(t *testing.T) {

 		RoleRef: kapi.ObjectReference{

 			Name: "not-a-real-binding",

 		},

-		Users: util.NewStringSet("Anna"),

+		Subjects: []kapi.ObjectReference{{Kind: authorizationapi.UserKind, Name: "Anna"}},

 	}

 	test.test(t)

@@ -446,8 +499,7 @@ func newDefaultClusterPolicyBindings() []authorizationapi.ClusterPolicyBinding {

 				RoleRef: kapi.ObjectReference{

 					Name: "cluster-admin",

 				},