lib/conjur/policy/resolver.rb in conjur-asset-policy-0.8.1 vs lib/conjur/policy/resolver.rb in conjur-asset-policy-0.8.2

@@ -82,10 +82,14 @@
             raise "#{record.class.simple_name} has no id" unless namespace
             id = namespace
           elsif id[0] == '/'
             id = id[1..-1]
           else
-            id = [ namespace, id ].compact.join('/')
+            if record.respond_to?(:resource_kind) && record.resource_kind == "user"
+              id = [ id, namespace ].compact.join('@')
+            else
+              id = [ namespace, id ].compact.join('/')
+            end
           end
 
           substitute! id
           
           record.id = id