| dstanek | bknudson: can we do that now or is there work to be done? | 00:04 |
|---|---|---|
| *** sbfox has quit IRC | 00:05 | |
| bknudson | dstanek: We could do it today... run keystone in apache | 00:05 |
| bknudson | or it could be handled by any wsgi container | 00:06 |
| dstanek | bknudson: don't we need two different server ports? one for each pipeline? | 00:07 |
| bknudson | they could be on different paths... e.g., https://localhost/identity/admin/v2.0 https://localhost/identity/public/v2.0 https://localhost/identity/v3 | 00:08 |
| bknudson | a deployer might want to have an internal pipeline for v3 and a public one I suppose... if they wanted to provide different extensions? | 00:09 |
| bknudson | also, I wouldn't expect different ports for internal vs public. Would expect to be listening on different interfaces | 00:11 |
| dstanek | i think i just need to hack up my devstack...trying to get a load test running | 00:12 |
| *** browne has quit IRC | 00:23 | |
| *** bobt_ has joined #openstack-keystone | 00:26 | |
| gyee | dstanek, after we split out identity into a separate service, you'll have 4 ports to deal with :D | 00:28 |
| *** richm has quit IRC | 00:32 | |
| *** browne has joined #openstack-keystone | 00:34 | |
| ayoung | gyee, no, just 443 | 00:34 |
| ayoung | everything will run in Apache using standard policy | 00:34 |
| *** dstanek is now known as dstanek_zzz | 00:37 | |
| *** praneshp has quit IRC | 00:38 | |
| *** browne has quit IRC | 00:44 | |
| *** rodrigods has quit IRC | 00:48 | |
| gyee | ayoung, when can we get apache into the gates | 00:48 |
| *** ayoung has quit IRC | 00:51 | |
| *** bobt has quit IRC | 00:57 | |
| *** bobt_ has quit IRC | 00:57 | |
| *** stevemar has joined #openstack-keystone | 01:03 | |
| *** daneyon has joined #openstack-keystone | 01:09 | |
| *** amcrn_ has quit IRC | 01:20 | |
| *** ChanServ sets mode: +o morganfainberg | 01:21 | |
| *** dstanek_zzz is now known as dstanek | 01:23 | |
| *** amcrn has joined #openstack-keystone | 01:27 | |
| *** ayoung has joined #openstack-keystone | 01:28 | |
| nkinder | gyee: morganfainberg is working on httpd in the gates | 01:32 |
| *** dstanek is now known as dstanek_zzz | 01:33 | |
| stevemar | is keystone-specs available yet? | 01:38 |
| *** ayoung has quit IRC | 01:39 | |
| morganfainberg | stevemar, https://review.openstack.org/#/c/94119/ | 01:39 |
| stevemar | i see | 01:39 |
| stevemar | morganfainberg, cool | 01:39 |
| *** nkinder has quit IRC | 01:45 | |
| *** shakamunyi has quit IRC | 01:45 | |
| *** dstanek_zzz is now known as dstanek | 01:47 | |
| *** thedodd has joined #openstack-keystone | 01:48 | |
| *** rodrigods has joined #openstack-keystone | 01:50 | |
| *** rodrigods has joined #openstack-keystone | 01:50 | |
| *** thedodd has quit IRC | 01:50 | |
| *** dstanek is now known as dstanek_zzz | 01:57 | |
| *** shakamunyi has joined #openstack-keystone | 01:59 | |
| *** xianghui has joined #openstack-keystone | 02:01 | |
| *** shakamunyi has quit IRC | 02:05 | |
| *** daneyon has quit IRC | 02:07 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Adds function to compare DNs https://review.openstack.org/94513 | 02:08 |
| *** daneyon has joined #openstack-keystone | 02:08 | |
| *** ayoung has joined #openstack-keystone | 02:12 | |
| *** lbragstad has joined #openstack-keystone | 02:14 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Adds function to compare DNs https://review.openstack.org/94513 | 02:18 |
| *** bknudson has quit IRC | 02:24 | |
| *** amcrn has quit IRC | 02:35 | |
| *** gyee has quit IRC | 02:36 | |
| *** dstanek_zzz is now known as dstanek | 02:38 | |
| *** praneshp has joined #openstack-keystone | 02:38 | |
| *** rwsu has quit IRC | 02:44 | |
| *** nkinder has joined #openstack-keystone | 02:45 | |
| *** mberlin has quit IRC | 02:45 | |
| *** thedodd has joined #openstack-keystone | 02:48 | |
| *** radez is now known as radez_g0n3 | 02:56 | |
| *** hipster has quit IRC | 02:56 | |
| *** thedodd has quit IRC | 02:56 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Mapping engine does not handle regex properly https://review.openstack.org/94518 | 03:00 |
| *** mberlin has joined #openstack-keystone | 03:01 | |
| *** dims_ has joined #openstack-keystone | 03:03 | |
| *** harlowja is now known as harlowja_away | 03:05 | |
| rodrigods | anyone has time for a code review? =) https://review.openstack.org/#/c/91578/ | 03:17 |
| ayoung | morganfainberg, requests-kerberos v0.5 is on PyPI | 03:33 |
| ayoung | nkinder, ^^ | 03:33 |
| ayoung | rodrigods, always time for a -2...hehehe | 03:34 |
| ayoung | rodrigods, its on my radar, but I want to actually try running it...so tomorrow. | 03:34 |
| rodrigods | ayoung, great! | 03:35 |
| rodrigods | ayoung, but there is always hope for a +2 | 03:36 |
| rodrigods | =) | 03:36 |
| ayoung | rodrigods, it looks pretty straight forward. | 03:36 |
| ayoung | rodrigods, I've got a bunch of client scripts that will be in lkeystoneclient/examples/scripts. I'll write one using your code as a way to learn it. | 03:37 |
| rodrigods | ayoung, yeah! and it's interesting how i ended up submitting this patch. it all began with a horizon performance issue | 03:37 |
| ayoung | rodrigods, for example https://review.openstack.org/#/c/82687/ | 03:37 |
| rodrigods | ayoung, really useful! right now i'm writing policies tests using keystone client | 03:38 |
| ayoung | rodrigods, submit them! | 03:38 |
| rodrigods | they a more to find bugs caused by hard coded policies checks inside the code | 03:40 |
| rodrigods | like: what if my 'admin' role would be called 'master'? | 03:40 |
| rodrigods | and, is it possible to define a new role that would be like a project admin? | 03:40 |
| rodrigods | domain admin, etc | 03:41 |
| ayoung | rodrigods, you are a Horizon person? Got an idea to float by you: | 03:45 |
| ayoung | Run Keystone as part of Horizon. Just the "main" or AUTH_URL part, and stick the token sha in a session cookie, and pass the token to Horizion via memcached. | 03:45 |
| rodrigods | ayoung, i just started working with openstack, and this Horizon bug was assigned to me hehehe | 03:47 |
| rodrigods | ayoung, i think you met some of my colleagues in the summit? telles and raildo | 03:48 |
| ayoung | Heh. I am working on Kerberos for Horizon, and its kindof making me wonder if we can simplify | 03:48 |
| ayoung | yeah, good guys | 03:48 |
| rodrigods | i'm new in the team here, just ended my first month | 03:49 |
| ayoung | Keep up the good work | 03:49 |
| rodrigods | thanks | 03:49 |
| rodrigods | ayoung, your Kerberos work on Horizon has a patch already? | 03:51 |
| ayoung | No | 03:51 |
| rodrigods | ah, ok | 03:51 |
| ayoung | rodrigods, the problem is that Kerberos to Horizon doesn't give us a way to request a token from Keystone without another step | 03:52 |
| ayoung | its called Service for User to Rpoxy, or S4U2Proxy for short | 03:52 |
| ayoung | and I'm trying to find a way to avoid it | 03:52 |
| ayoung | Rpoxy -> Proxy | 03:53 |
| ayoung | If I had a Keystone that issued tokens in Session cookies instead of special headers I'd be all set | 03:53 |
| ayoung | I think | 03:54 |
| ayoung | anyway, I'm headed to bed...I want to think this through some more. I'll look at your patch in the morning | 03:55 |
| rodrigods | you mean, store the token in localStorage, for example? | 03:55 |
| *** ayoung is now known as ayoung_zzzz | 03:55 | |
| morganfainberg | ayoung, are we blocked on the token compression on a new release of ksc? | 03:55 |
| ayoung_zzzz | morganfainberg, that merged | 03:55 |
| ayoung_zzzz | ah...yes | 03:55 |
| *** ayoung_zzzz is now known as ayoung | 03:55 | |
| ayoung | morganfainberg, we need a new release of the client | 03:55 |
| morganfainberg | ayoung_zzzz, hm. ok lets coordinate w/ dolph on that and see what the timeline of the next release will be. | 03:56 |
| morganfainberg | ayoung, catch ya tomorrow | 03:56 |
| morganfainberg | ayoung, (i'll be around late at best, have an appt in the morning here) | 03:56 |
| ayoung | morganfainberg, although, getting Kerberos in there would be killer | 03:56 |
| ayoung | did you see my note before? | 03:56 |
| morganfainberg | ayoung, which note? | 03:56 |
| ayoung | morganfainberg, they release a new version of request-kerberos | 03:56 |
| morganfainberg | ayoung, i've been doing cleanup code port for internal stuff before the end of the week | 03:56 |
| *** lbragstad has quit IRC | 03:57 | |
| ayoung | morganfainberg, https://github.com/requests/requests-kerberos/issues/30#issuecomment-43703724 | 03:57 |
| morganfainberg | ayoung, next week should start opening up time for me to be back to full focus on code/reviews/etc | 03:57 |
| morganfainberg | ah | 03:57 |
| morganfainberg | cool. | 03:57 |
| morganfainberg | anyway,. catch ya tomrrow | 03:57 |
| morganfainberg | gotta get going myself here shortly. | 03:57 |
| ayoung | gnight | 03:57 |
| *** ayoung is now known as ayoung-zzzzz | 03:57 | |
| morganfainberg | rodrigods, if i can, i'll poke at that tomorrow afternoon pacific (if no one else catches it) | 03:58 |
| rodrigods | morganfainberg, great! | 03:58 |
| ayoung-zzzzz | morganfainberg, I want Horizon to issue unscoped tokens. | 04:15 |
| *** ayoung-zzzzz is now known as ayoung | 04:15 | |
| morganfainberg | ayoung, so, TGT style for solving the session issues? | 04:16 |
| ayoung | If Horizon is Kerberized, or has access to the Federation data, it can do a lot of things | 04:16 |
| morganfainberg | ayoung, aye. | 04:16 |
| ayoung | Its unscoped tokens can only be handed to the real Keystone endpoint for scoped tokens | 04:17 |
| ayoung | Only Keystone would have a signing cert for Horizon, and so only Keystone would ever accept its tokens | 04:17 |
| morganfainberg | so the unscoped is effectively the krb TGT equiv? [perhaps reduced feature set] | 04:18 |
| ayoung | It would work for the Federated cases too | 04:18 |
| ayoung | horizon/auth does the redirects etc, and uses the mapping data to create an unscoped token | 04:18 |
| morganfainberg | ayoung, if we allow those token to live longer than the standard token lifespan, it makes the horizon sessioning problem go away. | 04:18 |
| ayoung | yeha, unscoped is TGT | 04:18 |
| ayoung | nah, Horizon issues then when it needs them | 04:18 |
| ayoung | E-PHEM-ER_AL | 04:19 |
| morganfainberg | ayoung, oh oh, horizon issues the token directly | 04:19 |
| ayoung | only the unscoped | 04:19 |
| morganfainberg | ayoung, hmmm. not opposed to that, want to mull it over before i 100% agree | 04:19 |
| ayoung | morganfainberg, an unscoped token means "User has authenticate to Horizon" | 04:19 |
| ayoung | and only that | 04:19 |
| ayoung | authenticated | 04:20 |
| morganfainberg | ayoung, but it seems reasonable | 04:20 |
| ayoung | morganfainberg, it gives real weight to the identity/assignment split | 04:20 |
| morganfainberg | that makes sense, a specific role that allows use of horizon as well. | 04:20 |
| morganfainberg | means you could make it so a API-only service user could exist (no web interface) | 04:21 |
| morganfainberg | well, something to gate on the horizon service at least. | 04:21 |
| ayoung | In theory, you could authenticate to Nova with Kerberos, and then Nova could make a call to Keystone GET /role_assignments/user/project | 04:22 |
| ayoung | OK, I think I can sleep now. | 04:24 |
| morganfainberg | night | 04:24 |
| *** ayoung is now known as ayoung_ZZZzzz | 04:24 | |
| *** dims_ has quit IRC | 04:29 | |
| *** Abhijeet has joined #openstack-keystone | 04:39 | |
| *** morganfainberg is now known as morganfainberg_Z | 04:42 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert auth_token to use session https://review.openstack.org/74908 | 04:45 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Auth Plugin invalidation https://review.openstack.org/94529 | 04:45 |
| *** ctracey has quit IRC | 04:48 | |
| *** ctracey has joined #openstack-keystone | 04:51 | |
| *** rodrigods has quit IRC | 04:55 | |
| *** sbfox has joined #openstack-keystone | 05:00 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add openID Connect auth plugin for federation https://review.openstack.org/61662 | 05:01 |
| *** marcoemorais has joined #openstack-keystone | 05:03 | |
| *** marcoemorais1 has joined #openstack-keystone | 05:04 | |
| *** marcoemorais has quit IRC | 05:07 | |
| *** dstanek is now known as dstanek_zzz | 05:23 | |
| *** stevemar has quit IRC | 05:23 | |
| *** daneyon has quit IRC | 05:25 | |
| *** stevemar has joined #openstack-keystone | 05:29 | |
| *** sbfox has quit IRC | 05:43 | |
| *** dstanek_zzz is now known as dstanek | 05:44 | |
| *** sbfox has joined #openstack-keystone | 05:48 | |
| *** dstanek is now known as dstanek_zzz | 05:54 | |
| *** sbfox1 has joined #openstack-keystone | 05:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/90288 | 06:01 |
| *** sbfox has quit IRC | 06:01 | |
| *** kashifatsalaar has joined #openstack-keystone | 06:06 | |
| *** leseb has joined #openstack-keystone | 06:12 | |
| *** sbfox1 has quit IRC | 06:27 | |
| *** sbfox has joined #openstack-keystone | 06:27 | |
| *** sbfox has quit IRC | 06:31 | |
| *** stevemar has quit IRC | 06:39 | |
| *** dstanek_zzz is now known as dstanek | 06:45 | |
| openstackgerrit | Andreas Jaeger proposed a change to openstack/keystone: Remove all mostly untranslated PO files https://review.openstack.org/94541 | 06:54 |
| *** dstanek is now known as dstanek_zzz | 06:55 | |
| *** kashifatsalaar has quit IRC | 07:02 | |
| *** harlowja_away has quit IRC | 07:10 | |
| *** marcoemorais1 has quit IRC | 07:11 | |
| *** BAKfr has joined #openstack-keystone | 07:13 | |
| *** Ju has joined #openstack-keystone | 07:17 | |
| *** Abhijeet has quit IRC | 07:33 | |
| *** henrynash has quit IRC | 07:43 | |
| *** dstanek_zzz is now known as dstanek | 07:46 | |
| *** jaosorior has joined #openstack-keystone | 07:54 | |
| *** praneshp has quit IRC | 07:55 | |
| BAKfr | Hi, I try to do a Keystone extension but i don't find out how to set config parameters. | 08:15 |
| BAKfr | I've a separate repository with my 3rd-party extension, and I would add my own config options. | 08:16 |
| BAKfr | But It seems to me that all config options must be set in keystone/config.py | 08:16 |
| BAKfr | Anyone know how to set them in my 3rd party extension ? | 08:18 |
| *** dstanek is now known as dstanek_zzz | 08:38 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Code which gets and deletes elements of tree was moved to one method https://review.openstack.org/86578 | 08:57 |
| *** henrynash has joined #openstack-keystone | 09:01 | |
| *** andreaf has joined #openstack-keystone | 09:07 | |
| *** Abhi__ has joined #openstack-keystone | 09:11 | |
| *** henrynash has quit IRC | 09:23 | |
| *** AJaeger has joined #openstack-keystone | 09:42 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Fixed wrong behavior when updating tenant with LDAP backends https://review.openstack.org/93386 | 09:50 |
| *** mberlin has quit IRC | 10:10 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Cleanup of ldap assignment backend https://review.openstack.org/94569 | 10:10 |
| *** xianghui has quit IRC | 10:13 | |
| *** xianghui has joined #openstack-keystone | 10:24 | |
| *** hipster has joined #openstack-keystone | 10:41 | |
| *** hipster has quit IRC | 10:49 | |
| *** Abhi__ has quit IRC | 11:36 | |
| *** lbragstad has joined #openstack-keystone | 11:39 | |
| *** lbragstad has left #openstack-keystone | 11:40 | |
| *** lbragstad has joined #openstack-keystone | 11:46 | |
| *** saju_m has joined #openstack-keystone | 11:47 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Refactor driver_hints https://review.openstack.org/93992 | 11:55 |
| *** bvandenh has joined #openstack-keystone | 11:59 | |
| *** radez_g0n3 is now known as radez | 12:01 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Check that the user is dumb moved to the common method https://review.openstack.org/94600 | 12:13 |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Check that the user is dumb moved to the common method https://review.openstack.org/88517 | 12:16 |
| *** xianghui has quit IRC | 12:26 | |
| *** Camisa has quit IRC | 12:26 | |
| *** diegows has joined #openstack-keystone | 12:26 | |
| *** Camisa has joined #openstack-keystone | 12:39 | |
| *** Camisa has quit IRC | 12:39 | |
| *** Camisa has joined #openstack-keystone | 12:39 | |
| *** rodrigods has joined #openstack-keystone | 12:46 | |
| *** jaosorior has quit IRC | 12:51 | |
| *** daneyon has joined #openstack-keystone | 12:53 | |
| *** afazekas has joined #openstack-keystone | 12:53 | |
| *** joesavak has joined #openstack-keystone | 13:19 | |
| *** afaranha has joined #openstack-keystone | 13:27 | |
| *** bknudson has joined #openstack-keystone | 13:31 | |
| *** dhellmann_ is now known as dhellmann | 13:35 | |
| *** stevemar has joined #openstack-keystone | 13:42 | |
| *** hipster has joined #openstack-keystone | 13:49 | |
| *** erecio_2 has quit IRC | 13:58 | |
| *** saju_m has quit IRC | 13:59 | |
| *** erecio has joined #openstack-keystone | 14:02 | |
| *** erecio has quit IRC | 14:07 | |
| *** vhoward has joined #openstack-keystone | 14:07 | |
| AJaeger | could I get a review of this patch, please? https://review.openstack.org/#/c/94541/ - since translations come in every day, this patch will reduce what gets submitted significantly... | 14:09 |
| *** thedodd has joined #openstack-keystone | 14:14 | |
| *** rwsu has joined #openstack-keystone | 14:15 | |
| BAKfr | Hi, I try to do a 3rd-party keystone extension, but I can't find out the proper way to add custom config options | 14:25 |
| BAKfr | It seems that option must be defined in keystone/config.py, otherwise they are not available | 14:27 |
| *** mattinator has joined #openstack-keystone | 14:28 | |
| BAKfr | So, is it possible to define config options in my 3rd-party extension ? | 14:28 |
| *** gokrokve has joined #openstack-keystone | 14:29 | |
| mattinator | I'm trying to configure a middleware proxy (repose) to authenticate against keystone. It seems the default behavior of repose is to authenticate without defining a tenant. It seems I need to define a role to a user, but I don't see how to do that in a "global" way (i.e. regardless of tenant). Does anyone know how I might accomplish this? | 14:30 |
| *** shakamunyi has joined #openstack-keystone | 14:31 | |
| *** erecio has joined #openstack-keystone | 14:33 | |
| *** david-lyle has joined #openstack-keystone | 14:37 | |
| *** xianghui has joined #openstack-keystone | 14:41 | |
| *** andreaf has quit IRC | 14:52 | |
| *** gordc has joined #openstack-keystone | 15:02 | |
| *** mberlin has joined #openstack-keystone | 15:03 | |
| *** gokrokve has quit IRC | 15:04 | |
| *** gokrokve has joined #openstack-keystone | 15:04 | |
| *** gokrokve has quit IRC | 15:04 | |
| *** jsavak has joined #openstack-keystone | 15:05 | |
| *** joesavak has quit IRC | 15:08 | |
| *** gokrokve has joined #openstack-keystone | 15:12 | |
| *** joesavak has joined #openstack-keystone | 15:14 | |
| openstackgerrit | Florent Flament proposed a change to openstack/python-keystoneclient: Allow keystone_authtoken middleware to use v3 API https://review.openstack.org/88620 | 15:15 |
| tristanC | Hello folks, what is the status of #1309228 ? Are https://review.openstack.org/#/c/94470/ and 94396 good to be approved ? | 15:15 |
| *** jsavak has quit IRC | 15:16 | |
| *** dstanek_zzz is now known as dstanek | 15:16 | |
| *** jsavak has joined #openstack-keystone | 15:16 | |
| *** joesavak has quit IRC | 15:19 | |
| *** bvandenh has quit IRC | 15:25 | |
| *** joesavak has joined #openstack-keystone | 15:29 | |
| *** jsavak has quit IRC | 15:31 | |
| *** jsavak has joined #openstack-keystone | 15:33 | |
| *** joesavak has quit IRC | 15:37 | |
| *** gyee has joined #openstack-keystone | 15:50 | |
| *** sbfox has joined #openstack-keystone | 15:54 | |
| nkinder | tristanC: I believe that the LDAP one needs some rework | 15:55 |
| tristanC | nkinder: I see, is it still about the "if assignment_dn_norm.endswith(user_tree_dn_norm)" check that does not cover every case ? | 16:00 |
| *** joesavak has joined #openstack-keystone | 16:01 | |
| *** BAKfr has quit IRC | 16:02 | |
| *** jsavak has quit IRC | 16:03 | |
| dolphm | tristanC: just +A's the SQL patch on master | 16:03 |
| *** jsavak has joined #openstack-keystone | 16:04 | |
| dolphm | nkinder: what needs to be done to the LDAP patch on master? | 16:04 |
| *** ayoung_ZZZzzz is now known as ayoung | 16:04 | |
| tristanC | dolphm: thanks! | 16:05 |
| ayoung | dolphm, the LDAP patch tests the subtrees | 16:05 |
| ayoung | but it needs to really test the objectclasses | 16:05 |
| ayoung | and that is a non trivial operation | 16:05 |
| *** joesavak has quit IRC | 16:05 | |
| nkinder | yes, users and groups might be in the same subtree | 16:05 |
| ayoung | dolphm, we discussed a handful of potential approaches last night, but they were all leaning toward Directory Server specific implementations | 16:06 |
| dolphm | ayoung: nkinder: is someone working on an new patchset that can be backported to icehouse? | 16:07 |
| *** xianghui has quit IRC | 16:08 | |
| nkinder | dolphm: give me a few minutes to wrap up a meeting, then we can hash out the way forward on this one | 16:08 |
| bknudson | I don't see how testing the objectclass is going to do it either. an entry could have both user and group objectclasses | 16:09 |
| *** richm has joined #openstack-keystone | 16:09 | |
| ayoung | bknudson, then that is fine | 16:09 |
| ayoung | you assign the role to the user, and the user is the group, you assing the role to all members of the group | 16:09 |
| ayoung | that is likely only the case for user-private groups anyway | 16:10 |
| ayoung | bknudson, conversely, if you assign it to the group, you probably mean to assign it to the user that links to the user-private group. | 16:10 |
| *** gokrokve has quit IRC | 16:11 | |
| bknudson | both the group and the user would get the role | 16:11 |
| bknudson | since keystone doesn't know if it's a group or user assignment | 16:12 |
| ayoung | bknudson, so it looks like jdennis is not going to have his DN patch ready any time soon. I'm going to have him send you a link to it, and we can discuss whether you want to port it, or pursue your exisitng approach for comparing DNs. I suspect you will like his code better. | 16:12 |
| ayoung | bknudson, I think that is fine. | 16:12 |
| *** gokrokve has joined #openstack-keystone | 16:12 | |
| bknudson | what's the license on the code? | 16:12 |
| ayoung | bknudson, its FreeIPA, so GPL I think | 16:13 |
| bknudson | ok... can we use that in openstack code? | 16:13 |
| ayoung | https://git.fedorahosted.org/cgit/freeipa.git/tree/COPYING | 16:13 |
| lbragstad | http://www.apache.org/licenses/GPL-compatibility.html | 16:14 |
| ayoung | yes. If there is any issue, Red Hat owns copyright and can re-issue | 16:14 |
| bknudson | "GPLv3 software cannot be included in Apache projects." | 16:14 |
| lbragstad | We avoid GPLv3 software because merely linking to it is considered by the GPLv3 authors to create a derivative work. | 16:15 |
| ayoung | hmmm. I suspect that is not really an issue, as it would be a rewrite for OpenStack, and John wrote the original | 16:16 |
| ayoung | But I can have him submit it as WIP so it is not copied from FreeIPA if that helps | 16:16 |
| *** gokrokve has quit IRC | 16:17 | |
| nkinder | ayoung, bknudson: let's not gate this on the DN compare stuff | 16:17 |
| *** marcoemorais has joined #openstack-keystone | 16:17 | |
| ayoung | nkinder, nah, separate patch | 16:18 |
| *** marcoemorais has quit IRC | 16:18 | |
| *** marcoemorais has joined #openstack-keystone | 16:18 | |
| ayoung | nkinder, brant submitted a general DN compare patch, but I though John was reworking his DN approach here. | 16:18 |
| bknudson | the LDAP fix using braindead DN compare is https://review.openstack.org/#/c/94470/ | 16:19 |
| ayoung | nkinder, so, is the LDAP problem even really a problem? I mean, if I have a user named ayoung and a group named ayoung, it means that anyone in the ayoung group gets my roles, but in practice, is that wrong? | 16:20 |
| nkinder | ayoung: yes, if the user is not in the group, they shouldn't get the group roles | 16:21 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/91225 | 16:22 |
| nkinder | it's the other way around, not how you described it | 16:22 |
| dolphm | do we have a bug documenting the fact that the sql driver dumps queries into JSON error messages somewhere? | 16:22 |
| ayoung | nkinder, so we need to test the objectclass | 16:22 |
| ayoung | and since DN is not a real attribute, we have to query them one at a time | 16:23 |
| *** jdennis has joined #openstack-keystone | 16:23 | |
| ayoung | dolphm, nkinder BTW some good news https://review.openstack.org/#/c/84740/ Kerberos requests is on its way | 16:23 |
| *** sbfox has quit IRC | 16:24 | |
| dolphm | ayoung: no bp link? | 16:24 |
| nkinder | dolphm, ayoung: I'm curious to get your input on this - https://blog-nkinder.rhcloud.com/?p=101 | 16:24 |
| nkinder | dolphm, ayoung: if it seems like a correct approach, I'll work up a spec | 16:24 |
| ayoung | nkinder, is that "request a token with fewer roles?" | 16:25 |
| nkinder | ayoung: that's part of it | 16:25 |
| ayoung | nkinder, we need a changeto how Horizon uses tokens | 16:25 |
| nkinder | but also adding restrictions to using a token to get a new token | 16:25 |
| *** praneshp has joined #openstack-keystone | 16:25 | |
| nkinder | ayoung: yes, I cover that | 16:25 |
| ayoung | nkinder, more than that | 16:26 |
| ayoung | we need , basically, a session | 16:26 |
| nkinder | ayoung: yes, with an unscoped token tied to the session | 16:26 |
| nkinder | ayoung: I cover that in my write-up | 16:26 |
| ayoung | the one hour time out means we are going to kick people out randomly in the middle of work, but a session scoped token should be refreshable. What if Horizon itself could issue this token? | 16:26 |
| ayoung | If Horizon had a signing cert, we would know that the token came from Horizon. If only Keystone honored the cert, the token would only be usable on Keystone | 16:27 |
| nkinder | why automatically refresh? Isn't a timeout a good thing? | 16:27 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/91240 | 16:28 |
| ayoung | nkinder, the general web approach is extend the session if the user is active | 16:28 |
| ayoung | so if a user leaves for 10 minutes , they need to log back in | 16:28 |
| ayoung | but if they keep actively doing work, keep refreshing | 16:29 |
| ayoung | If we split the Identity and assignment sides of Keystone, Horizon would be confined to only working with the Identity side until it needed to do work somewhere else | 16:29 |
| nkinder | ayoung: I think that's a second step. | 16:30 |
| ayoung | jdennis, can you submit your DN patch as a WIP to Gerrit? There is some concern from bknudson (IBM) that we should not be copying GPL code into an Apache license project, but since you/we are the copyright holder, we can just submite it directly | 16:30 |
| ayoung | nkinder, I was thinking about this last night in the context of Kerberos. We could skip the S4U2Proxy if Instead Horizon could sign a token and deliver it to keystone | 16:31 |
| ayoung | it would make SAML etc work with a visual web tool without a need for the CLI extensions | 16:32 |
| nkinder | ayoung: let's defer that discussion. I want to get the LDAP assignment thing hammered out | 16:32 |
| nkinder | ayoung: I'm not sure that the extra suffix/objectclass check is needed | 16:33 |
| ayoung | nkinder, OK...back to LDAP....why not? | 16:33 |
| jdennis | ayoung: yes I can submit it, but not until it's fixed and I have to get ready for a design discussion tommorow | 16:33 |
| nkinder | ayoung: at line 98, the patch does this... | 16:33 |
| nkinder | assignment_id = self.user._dn_to_id(assignment.user_dn) | 16:34 |
| ayoung | No, submit it as a draft or WIP, broken, so you can hand off to Brant | 16:34 |
| nkinder | so we know that the assignment is referring to a user and not a group since it's using 'assignment.user_dn' | 16:34 |
| nkinder | ayoung: this means assignment_id will only be the id of a user | 16:35 |
| ayoung | nkinder, and the gordian knot is cut | 16:35 |
| nkinder | ayoung: we then compare that with the passed in user_id like so... | 16:35 |
| nkinder | if assignment_id != user_id | 16:35 |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: test_user_mixed_case_attribute fails - mail, not email https://review.openstack.org/94668 | 16:36 |
| ayoung | nkinder, I'm kindof mad. I was so close to that last night....dagnabit for stealing my save | 16:36 |
| nkinder | ayoung: so I don't think there is a change that it's a group | 16:36 |
| nkinder | ayoung: ...but it would be nice to prove this with a test give that this is an OSSA issue | 16:37 |
| nkinder | s/give/given/ | 16:37 |
| nkinder | I don't want to make assumptions just based off of reading the code | 16:37 |
| ayoung | nkinder, I'm not 100% certain | 16:38 |
| ayoung | nkinder, so the internal object calls it that, but I am not certain if just setting the member_of field is sufficient for the association to distinguish when doing a query | 16:39 |
| *** arborism has joined #openstack-keystone | 16:40 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/assignment/backends/ldap.py#n543 | 16:40 |
| *** gokrokve has joined #openstack-keystone | 16:42 | |
| ayoung | dolphm, how should I link a Keystone blueprint on a global requirements fix? By the whole Url? | 16:43 |
| ayoung | https://blueprints.launchpad.net/keystone/+spec/kerberos-authentication | 16:43 |
| nkinder | ayoung: I'm setting up devstack with LDAP to see if this is even a problem | 16:44 |
| *** browne has joined #openstack-keystone | 16:44 | |
| *** gokrokve has quit IRC | 16:47 | |
| *** afazekas has quit IRC | 16:53 | |
| *** BAKfr has joined #openstack-keystone | 16:53 | |
| *** saju_m has joined #openstack-keystone | 16:55 | |
| *** jsavak has quit IRC | 16:56 | |
| *** jamielennox is now known as jamielennox|away | 17:00 | |
| *** dstanek is now known as dstanek_zzz | 17:01 | |
| *** dstanek_zzz is now known as dstanek | 17:05 | |
| *** harlowja has joined #openstack-keystone | 17:06 | |
| radez | ayoung: until so I threw together a temp fix for TryStack to get rid of the side database with the extra passwords in it. | 17:18 |
| radez | ayoung: I installed this custom middleware into keystone in the admin_api pipeline https://github.com/trystack/python-django-horizon-facebook/blob/master/horizon/facebook/middleware.py | 17:18 |
| radez | ayoung: then make a call using httplib directly to the api to get a token on behalf of the user as the adminstrator | 17:19 |
| radez | https://github.com/trystack/python-django-horizon-facebook/blob/master/horizon/facebook/backend.py#L154 | 17:19 |
| ayoung | radez, we have that with the external auth plugin | 17:20 |
| radez | this requires the admin_token from keystone to be passed and for the call to be made on the admin port | 17:20 |
| openstackgerrit | Ryan Bak proposed a change to openstack/keystone: LDAP: Added documentation for debug_level option https://review.openstack.org/94679 | 17:20 |
| radez | ayoung: I had to make the call from inside django so I couldn't use the remote_user stuff directly | 17:20 |
| ayoung | ah | 17:20 |
| radez | but the external handler and the service token code are basically mashed together to make it work | 17:21 |
| ayoung | radez, can't that be hacked? | 17:21 |
| ayoung | body = json.loads(request.body) | 17:21 |
| ayoung | username = body['auth']['passwordCredentials']['username'] | 17:21 |
| ayoung | or do you have a check that makes sure... | 17:22 |
| ayoung | wha> | 17:22 |
| radez | you would have to have the serivce token | 17:22 |
| * radez looks at it again to make sure I'm not missing something | 17:23 | |
| ayoung | radez, what is to keep someone from crafting their own message body and bypassing security? | 17:23 |
| radez | ayoung: ha, I get the token and took out the line that checks that it's the right token... crap. | 17:24 |
| radez | good catch | 17:24 |
| * radez fixes | 17:24 | |
| ayoung | minor point, hardly worth mentioning | 17:25 |
| radez | ayoung: yea maybe I'll just skip it... I'll be fine | 17:27 |
| radez | ayoung: refresh that middleware.py | 17:27 |
| radez | glad I circled back for a peer review :) | 17:27 |
| ayoung | radez, went from 10 lines to about 160 | 17:28 |
| ayoung | 184 | 17:28 |
| radez | hu? | 17:28 |
| ayoung | wrong link | 17:28 |
| ayoung | 35 | 17:29 |
| radez | lol | 17:29 |
| radez | that's it | 17:29 |
| ayoung | um, don't do that | 17:29 |
| radez | no? | 17:29 |
| ayoung | admin token is for setting up the system and should be disabled after that | 17:29 |
| ayoung | but... nkinder and I were just discussing an offshoot of your problem radez | 17:30 |
| radez | ayoung: should I just establish a new shared secret for keystone and horizon for this purpose? | 17:30 |
| ayoung | I want to make Horizon sign tokens | 17:30 |
| radez | oh that's a idea | 17:31 |
| ayoung | so, yeah, should be a shared secret between Horizon and Keystone, probably an X509 for a real deployment. Or kerberos. | 17:32 |
| ayoung | If Horizon is trusted, it can throw away the password | 17:32 |
| ayoung | radez, does trystack allow direct access to nova and keystone, or is it all through horizon? | 17:33 |
| radez | ayoung: direct | 17:33 |
| *** daneyon has quit IRC | 17:33 | |
| ayoung | radez, how does the end user talk direct to Keystone? Do you hand them back a password? | 17:35 |
| radez | ayoung: yea, they first login with facebook, then there's a horizon plugin I built that generates a password displays it once and sets it in keystone for them | 17:37 |
| ayoung | radez, good for how long? | 17:39 |
| radez | ayoung: until they reset it, but they can only see it once so if they forget it they have to generate a new one | 17:40 |
| radez | can keystone enforce an EOL on a password? | 17:40 |
| ayoung | radez, as good a solution as any. | 17:40 |
| ayoung | radez, nope | 17:40 |
| ayoung | but you can always disable a user | 17:41 |
| radez | yea so if I get rid of my side db then I have no way to know how long they've had the pw | 17:41 |
| radez | yes, I also clear out the users when I upgrade so about every 6 months the use db gets cleaned | 17:41 |
| ayoung | true. but it doesn't know if they've been active or not anyway | 17:41 |
| radez | sooner if I have troubleshooting problem and ecide to rebuild the db | 17:41 |
| radez | right | 17:42 |
| ayoung | they keep using it against keystone without going through the web portal | 17:42 |
| *** gokrokve has joined #openstack-keystone | 17:43 | |
| bknudson | nkinder: replied to your comment on https://review.openstack.org/#/c/94470/ -- hopefully it's clear | 17:43 |
| ayoung | radez, how's the Facebook group approval proces work? Do you do it by hand? | 17:44 |
| *** bobt has joined #openstack-keystone | 17:46 | |
| *** gokrokve has quit IRC | 17:47 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Initial kerberos plugin implementation. https://review.openstack.org/74974 | 17:48 |
| openstackgerrit | A change was merged to openstack/keystone: SQL fix for get_roles_for_user_and_project user=group ID https://review.openstack.org/94396 | 17:48 |
| openstackgerrit | A change was merged to openstack/keystone: Remove all mostly untranslated PO files https://review.openstack.org/94541 | 17:48 |
| radez | ayoung: yup, I see you want in | 17:50 |
| * radez thinks long and hard about this | 17:50 | |
| radez | ayoung: btw the api password function has to be updated, I probably broke it putting in the updates to the authenticaiton | 17:50 |
| nkinder | bknudson: yeah, I just reproduced it and was seeing the same thing in pdb | 17:52 |
| bknudson | nkinder: the field is incorrectly named. | 17:54 |
| bknudson | in the original code http://git.openstack.org/cgit/openstack/keystone/tree/keystone/assignment/backends/ldap.py#n109 | 17:54 |
| bknudson | it does a.user_dn.upper() == group_dn.upper()] ?! | 17:54 |
| bknudson | in _get_roles_for_group_and_project | 17:54 |
| radez | ayoung: huh, we I just was able to get an api password. see if you can get one | 17:55 |
| bknudson | I think it makes sense to try to move the determining of user or group down to role.get_role_assignments ... would be willing to try it. | 17:55 |
| ayoung | radez, well, I'm in on Horizon, but where is the password? | 17:56 |
| *** arborism is now known as amcrn | 17:57 | |
| nkinder | bknudson: ok, so I see one gap in the patch | 18:01 |
| nkinder | bknudson: that would be the case where users and groups are in the same subtree | 18:01 |
| nkinder | bknudson: this is a corner case, but it still has a security problem | 18:01 |
| *** browne1 has joined #openstack-keystone | 18:02 | |
| bknudson | nkinder: right... this is where the only way to be "more sure" is to check the objectclass | 18:02 |
| bknudson | although even then the code could be confused by an entry that was both person and group | 18:02 |
| nkinder | bknudson: but in that case, the assignment is ambiguous | 18:03 |
| bknudson | right, we just don't have enough info in that case | 18:03 |
| nkinder | bknudson: the assignment is to a DN, and if it's a user and a group you are assigning to both in effect | 18:03 |
| *** browne has quit IRC | 18:04 | |
| ayoung | nkinder, yeah, that is my view, too | 18:07 |
| ayoung | nkinder, but it seems like this should be a manageable issue. Like, maybe we overreport on roles, but before we enumerate users for a group, make sure that it really is a group we are looking at. | 18:08 |
| ayoung | we should only have to check for a single user, never for the whole group | 18:09 |
| ayoung | OK...we arebeing dumb here. We have the whole DN from the assignments collection | 18:11 |
| ayoung | we need to compare the actual DN from self.role.get_role_assignments with the users actual DN | 18:12 |
| ayoung | and not be doing id to dn and back again | 18:12 |
| nkinder | ayoung: we need to go from id->dn then | 18:13 |
| nkinder | ayoung: not a big deal | 18:14 |
| ayoung | yep | 18:15 |
| ayoung | I'm on it | 18:15 |
| ayoung | bknudson, http://paste.fedoraproject.org/103899/06962281 nkinder | 18:17 |
| ayoung | the group one is already OK | 18:17 |
| *** browne1 has quit IRC | 18:18 | |
| nkinder | ayoung: I just tested a patch with that approach, and it works | 18:20 |
| ayoung | nkinder, I'm about to resubmit | 18:20 |
| *** joesavak has joined #openstack-keystone | 18:20 | |
| nkinder | ayoung: I would combine the upper() calls on the same line | 18:20 |
| nkinder | ...as we will want to replace that with a call to the DN compare function when it lands | 18:20 |
| nkinder | ayoung: I like bknudson's code cleanup as well though. Much more readable IMHO | 18:22 |
| ayoung | nkinder, so call upper every time? gross, but I see how it is clearer | 18:22 |
| nkinder | ayoung: eh, I see the point about calling upper() once | 18:22 |
| ayoung | nkinder, I'll keep it the same as the group one for now | 18:22 |
| nkinder | ayoung: let me submit the patch, as I'm testing it with a real setup | 18:23 |
| dolphm | anyone understand what's being fixed here? :-/ (refactors db setup for sql testing...) https://review.openstack.org/#/c/93556/ | 18:23 |
| ayoung | nkinder, but I came up with the solution.... | 18:23 |
| ayoung | but whatever... | 18:23 |
| ayoung | coauthors all | 18:24 |
| *** bobt_ has joined #openstack-keystone | 18:24 | |
| bknudson | dolphm: I'd taken a quick look and am not sure what it fixes... also there's a follow on patch that removes it all anyways. | 18:24 |
| nkinder | ayoung: ok, go ahead and submit then if you like | 18:24 |
| ayoung | nkinder, and...here is where I pay for working on stable branch...recreating tox. I need git stash for my tox envs | 18:27 |
| *** browne has joined #openstack-keystone | 18:29 | |
| *** matsuhas_ has joined #openstack-keystone | 18:29 | |
| dstanek | dolphm: i have no idea what they are doing there | 18:31 |
| dstanek | dolphm: maybe the result of the migrations is different from the declared models... | 18:33 |
| ayoung | dstanek, I'm going to take that commit message and run it through google translate back to the origianl romanian and then back. | 18:34 |
| stevemar | all - could i get eyes on https://review.openstack.org/#/c/93496/2 and the patch it's needed by? | 18:35 |
| ayoung | stevemar, looks good on 96/2 | 18:36 |
| ayoung | and on... | 18:36 |
| ayoung | stevemar, what is the other review? https://review.openstack.org/#/c/81981/12 ? | 18:37 |
| stevemar | ayoung, yes, 81981 | 18:37 |
| dolphm | bknudson: dstanek: functional tests would be way faster this way... mirantis put up another patch to ensure models matched the schema- did that merge? | 18:38 |
| dolphm | models matched migrations* | 18:38 |
| ayoung | stevemar, what did 81981 change beside moving to contrib? | 18:39 |
| bknudson | dolphm: btw - I tried running the follow on patch tests and there was no result on performance. | 18:39 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: LDAP fix for get_roles_for_user_and_project user=group ID https://review.openstack.org/94470 | 18:40 |
| stevemar | ayoung, i'm confused 81981 isn't in yet, it's the auth plugin for oauth | 18:40 |
| ayoung | stevemar, I know, and I am reviewing it | 18:41 |
| ayoung | but I see jamielennox|away asked you to move the code to the contrib/oauth subdir, which I agree with | 18:41 |
| ayoung | what else is different? It looks the same to my eye | 18:41 |
| stevemar | ayoung, oh, i made it fail gracefully if oauthlib isn't installed | 18:41 |
| stevemar | ayoung, so as to not break the upgrades/gate jobs | 18:42 |
| ayoung | stevemar, ++ | 18:42 |
| dstanek | so if we only have the ids in the token the client will need to call back to keystone to get the actual catalog info? | 18:43 |
| *** gokrokve has joined #openstack-keystone | 18:43 | |
| ayoung | dstanek, yes. Once and cache | 18:43 |
| dstanek | dolphm: i'm not sure - they proposed a big chain of patches | 18:44 |
| dstanek | ayoung: they why have any catalog info in the token? | 18:44 |
| ayoung | dstanek, token binding to endpoint, of course | 18:44 |
| * ayoung ducks | 18:44 | |
| stevemar | dstanek, question about https://review.openstack.org/#/c/81981/12/keystoneclient/tests/v3/test_oauth1.py | 18:45 |
| ayoung | dstanek, I think compressed tokens deals well enough with it. | 18:45 |
| stevemar | if I extend TestCase, won't I lose the functionality to unload the library? | 18:45 |
| *** gokrokve has quit IRC | 18:47 | |
| dstanek | stevemar: ? | 18:48 |
| dstanek | stevemar: is that actually running as a test? | 18:48 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/91225 | 18:48 |
| tristanC | bknudson: ayoung: dolphm: Looks like you found middle ground to fix our OSSA bug! Stable/icehouse grenade test will still fail because of https://bugs.launchpad.net/keystone/+bug/1320670, though we are ok to reference stable/icehouse reviews and send the OSSA even if jenkins put -1 because of this | 18:51 |
| uvirtbot | Launchpad bug 1320670 in grenade "404 on GET /v3/OS-SIMPLE-CERT/ca at grenade" [Undecided,In progress] | 18:51 |
| bknudson | tristanC: I can re-do the stable/icehouse change. | 18:52 |
| tristanC | so if you can submit backport fix I'll proceed to OSSA. Thanks in advance :) | 18:52 |
| tristanC | bknudson: that would be perfect, thanks! | 18:52 |
| ayoung | grenade fix went in, I thought | 18:53 |
| tristanC | ayoung: sadly the fixing review is still in progress: https://review.openstack.org/#/c/94627/ | 18:53 |
| *** matsuhas_ has quit IRC | 18:54 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Make sure all the auth plugins agree on the shared identity attributes. https://review.openstack.org/84945 | 18:55 |
| *** shakamunyi has quit IRC | 18:57 | |
| *** jamielenz has joined #openstack-keystone | 18:57 | |
| stevemar | dstanek, gorram reavers | 18:57 |
| *** jamielennox|away has quit IRC | 19:00 | |
| *** cds has quit IRC | 19:00 | |
| dstanek | stevemar: wha? | 19:00 |
| *** jamielennox|away has joined #openstack-keystone | 19:00 | |
| stevemar | dstanek, you were right - it wasn't being run | 19:00 |
| *** jamielenz has quit IRC | 19:02 | |
| nkinder | dolphm: the LDAP assignment issue has been ironed out. Want to give it a review so we can wrap it up? | 19:02 |
| nkinder | dolphm: https://review.openstack.org/#/c/94470/ | 19:02 |
| stevemar | dstanek, during the test, the library is successfully disabled, but when I try to create the oauth plugin object - it actually works | 19:04 |
| *** harlowja is now known as harlowja_away | 19:04 | |
| dolphm | nkinder: thanks! | 19:04 |
| dolphm | bknudson: +A when jenkins +1's | 19:06 |
| dolphm | tristanC: second part of that patch is getting ready to enter the gate ^ | 19:07 |
| stevemar | dstanek, i think i can use reload? | 19:07 |
| bknudson | tristanC: dolphm: ayoung: here's the icehouse fix: https://review.openstack.org/#/c/94397/ | 19:08 |
| bknudson | I can fix up the commit message online | 19:08 |
| bknudson | fixed, added the coauthors! | 19:09 |
| tristanC | dolphm: bknudson: wonderful, thanks! I'll prepare the OSSA announce, could you check the backport is in good shape ? | 19:09 |
| *** dims has joined #openstack-keystone | 19:09 | |
| dolphm | bknudson: clean backport still? | 19:10 |
| bknudson | dolphm: yep | 19:10 |
| *** browne has quit IRC | 19:10 | |
| dolphm | bknudson: the tests are different, and there's a comment the docstr of https://review.openstack.org/#/c/94396/2/keystone/tests/test_backend_ldap.py that can be removed | 19:12 |
| dolphm | bknudson: oh i'm comparing the wrong file | 19:13 |
| bknudson | dolphm: the icehouse backport doesn't have the test_backend_ldap test. It was added because it didn't include the LDAP fix | 19:13 |
| dolphm | bknudson: yeah, i clicked the wrong thing :P | 19:14 |
| dolphm | bknudson: +2 on backport | 19:14 |
| ayoung | nkinder, now that we've dealt with LDAP...back to Horizon? | 19:15 |
| nkinder | ayoung: jumping into a meeting in 15, but sure... | 19:16 |
| ayoung | nkinder, OK, so the question is, do we trust Horizon? | 19:16 |
| ayoung | right now, a user is willing to give it his password | 19:16 |
| nkinder | yes, which is a lot of trust... | 19:17 |
| *** marcoemorais has quit IRC | 19:17 | |
| ayoung | So if a user authenticates to Horizon, whatever the means...how far do we trust it in the future? | 19:18 |
| ayoung | nkinder, in a kerberized world, with S4U2, the Horizon admin that hits the Credentials cache can do pretty much anything that Keystone gives access too | 19:19 |
| ayoung | to | 19:19 |
| dolphm | ayoung: nkinder: bknudson: thanks again for the ldap effort :) | 19:20 |
| ayoung | So, why not let Horizon sign unscoped tokens? The difference would be service ticket signout versus...whenever we identified a Horizon server was compromised | 19:20 |
| bknudson | dolphm: someday all this code will be gone! | 19:21 |
| nkinder | bknudson: ++! | 19:21 |
| ayoung | bknudson, you are such an optimist | 19:22 |
| nkinder | ayoung: ok, so you are saying that horizon will issue an unscoped token and sign it (acting like Keystone itself minus roles/projects/domains) | 19:23 |
| ayoung | nkinder, yes, but. that token would only be valid to Keystone | 19:23 |
| nkinder | ayoung: and I assume that Keystone will trust this token | 19:23 |
| ayoung | and only Keystone | 19:23 |
| nkinder | ayoung: so this token contains the user and basically says "trust me, the user authenticated to horizon" | 19:24 |
| ayoung | It would be valid for 10 minutes. It could be used to trade up to a scoped token with a default duration | 19:24 |
| nkinder | ayoung: how does this get away from trusting horizon? | 19:25 |
| nkinder | ayoung: it seems to me like horizon would be able to spoof any user | 19:25 |
| ayoung | nkinder, it doesn't | 19:25 |
| ayoung | correct. but that is the case now, too | 19:25 |
| nkinder | ayoung: how? | 19:25 |
| ayoung | S4U2 would then be a hardening beyond that | 19:25 |
| nkinder | ayoung: can it spoof a user who never authenticated? | 19:25 |
| ayoung | nkinder, because the user submits their password | 19:26 |
| ayoung | ah, true | 19:26 |
| ayoung | it can only spoof users that have submitted passwords | 19:26 |
| nkinder | ayoung: we're making horizon as powerful as keystone itself | 19:26 |
| ayoung | isn't lready, though? | 19:26 |
| ayoung | so, how do we limit it | 19:26 |
| ayoung | S4U2 is a Kerberos specific method, won't work for, say, SAML | 19:27 |
| *** harlowja_away is now known as harlowja | 19:27 | |
| *** saju_m has quit IRC | 19:27 | |
| nkinder | right now, horizon can't authenticate as a user who never gave horizon it's password. It's powerful, but not all powerful. | 19:27 |
| ayoung | The only alternative for SAML/OpenID connect is to go direct to Keystone, get a token, and hand that to Horizon via a header | 19:27 |
| nkinder | ayoung: or the kerberos approach, where horizon only has power until the kerberos ticket expires | 19:28 |
| nkinder | ayoung: for password, there's not much that can be done if horizon keeps the password | 19:29 |
| nkinder | ayoung: gotta jump into a meeting now... last one of the day if things go as planned | 19:29 |
| *** schofield has joined #openstack-keystone | 19:30 | |
| ayoung | stevemar, what is your plan for oauth? Anything regarding Horizon? | 19:35 |
| *** browne has joined #openstack-keystone | 19:35 | |
| stevemar | ayoung, no plans on the horizon (pun intended) | 19:35 |
| ayoung | stevemar, I'm trying to figure out how Federation and Horizon are going to interoperate | 19:36 |
| ayoung | For Kerberos, I can use a delegation mechanism specific to Kerberos | 19:36 |
| stevemar | ayoung, yeah. thats a huge hurdle | 19:36 |
| ayoung | stevemar, the best I can think is that we put a web UI on a subset of Keystone functionality | 19:37 |
| ayoung | stevemar, for example, if we allowed a user to go via any auth mechanism to a webUI and get an unscoped token, it could pass that token to Horizon. Either via CORS or something with OAuth, or via memcached and a session cookie | 19:38 |
| stevemar | ayoung, also, the matter of where would the code live | 19:39 |
| ayoung | stevemar, you mean in Horizon or in Keystone? | 19:39 |
| stevemar | ayoung, yep | 19:39 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Move DisableModuleFixture to utils https://review.openstack.org/93496 | 19:40 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Authenticate via oauth https://review.openstack.org/81981 | 19:40 |
| *** henrynash has joined #openstack-keystone | 19:42 | |
| *** marcoemorais has joined #openstack-keystone | 19:43 | |
| *** gokrokve has joined #openstack-keystone | 19:43 | |
| ayoung | dolphm, have you given any thought to Federation and Horizon? Short of the user going direct to Keystone, I'm stumped. Only Kerberos provides a delegation mechanism. | 19:45 |
| *** gokrokve_ has joined #openstack-keystone | 19:45 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Adds function to compare DNs https://review.openstack.org/94513 | 19:45 |
| *** gokrokve has quit IRC | 19:48 | |
| *** gokrokve_ has quit IRC | 19:50 | |
| ayoung | bknudson, just read the commit message https://git.fedorahosted.org/cgit/freeipa.git/commit/?h=ipa-1-2&id=94d457e83c172320707fbf13f7a1587dad128ece | 19:51 |
| bknudson | ayoung: that would be nice to have in keystone | 19:52 |
| bknudson | would be a change from what we're doing now | 19:52 |
| bknudson | some people seem to like working with strings for some reason | 19:52 |
| ayoung | bknudson, jdennis is working on it, but he just got pulled into some OpenDaylight work. And he's like a coding Orson Welles: he will post no code...before its time. | 19:53 |
| *** marcoemorais has quit IRC | 19:54 | |
| bknudson | I've found that posting code early gets you good feedback. | 19:54 |
| *** marcoemorais has joined #openstack-keystone | 19:54 | |
| bknudson | we could learn from http://www.neary-consulting.com/index.php/2010/12/08/curing-shy-developer-syndrome/ | 19:54 |
| ayoung | it also increases the likelihood it will make it in before deadlines | 19:54 |
| ayoung | yeah...that ain't me | 19:55 |
| ayoung | bknudson, so...lets make a pact to just keep his IRC client jumping until he posts it. | 19:56 |
| * ayoung actually has his home number, but he also has mine | 19:56 | |
| tristanC | Thank you all for your time on that LDAP issue. | 19:59 |
| *** marcoemorais has quit IRC | 20:01 | |
| *** marcoemorais has joined #openstack-keystone | 20:01 | |
| *** marcoemorais has quit IRC | 20:01 | |
| *** marcoemorais has joined #openstack-keystone | 20:02 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: LDAP fix for get_roles_for_user_and_project user=group ID https://review.openstack.org/94470 | 20:02 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Adds function to compare DNs https://review.openstack.org/94513 | 20:02 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Use DN comparison function https://review.openstack.org/94714 | 20:02 |
| ayoung | radez, what is the OS_AUTH_URL for Trystack? | 20:03 |
| ayoung | got it | 20:05 |
| ayoung | OS_AUTH_URL=http://x86.trystack.org:5000/v2.0 | 20:05 |
| *** marcoemorais has quit IRC | 20:07 | |
| *** marcoemorais has joined #openstack-keystone | 20:08 | |
| dolphm | bknudson: just ran the test suite in < 10 minutes with the patch to rip migrations out of test setup | 20:14 |
| radez | ayoung: I think it's a duplicate config value that points to the keystone endpoint | 20:14 |
| radez | ayoung: oh... ha you found it... | 20:14 |
| bknudson | dolphm: it takes 10 mins to run the tests?? | 20:14 |
| ayoung | radez, yeah...just launching an instance... | 20:14 |
| bknudson | not running in parallel? | 20:14 |
| radez | ayoung: ayoung lol, not tomention I totally misinterprated what you were asking me | 20:15 |
| ayoung | radez, still working out a kink with the networking...I assume I need to set up a network, and route internal to external? | 20:15 |
| radez | ayoung: did you get an api passwod ok? | 20:15 |
| ayoung | radez, yep | 20:16 |
| ayoung | radez, I thought Horizon had an option to let you download an RC file | 20:16 |
| radez | ayoung: yup external is provided, setup an internal and a router and stringthem all together | 20:16 |
| radez | ayoung: not that I know of, I've always gotten mine from trystack | 20:16 |
| ayoung | radez, this is very well done... | 20:16 |
| radez | er, packstack | 20:16 |
| radez | ayoung: thx man, it's what I've been working on for the past year :) | 20:17 |
| ayoung | radez, need a way to make it possible for people to share, add them to their own projects etc | 20:18 |
| ayoung | General Keystone problem | 20:18 |
| ayoung | radez, this is Icehouse, or still Havana? | 20:19 |
| ayoung | I know the announcement on FB said Ice, but the trystack page says Havana | 20:19 |
| radez | ayoung: icehouse, since U3 | 20:19 |
| ayoung | http://trystack.org/ next to the button... | 20:20 |
| radez | ayoung: oh I should get them to update that. I don't maintain that page | 20:20 |
| * radez sends email | 20:20 | |
| dolphm | bknudson: umm, is that fast or slow? | 20:20 |
| ayoung | anyway, the reason I ask is on the security page it should give the option for the admin password. See our internal Horizon... | 20:20 |
| ayoung | Launch Instance->access and security | 20:21 |
| *** marcoemorais has quit IRC | 20:21 | |
| *** marcoemorais has joined #openstack-keystone | 20:22 | |
| nkinder | ayoung: so back to tokens, horizon, etc... | 20:23 |
| nkinder | ayoung: the horizon case seems really tough outside of kerberos | 20:24 |
| dolphm | bknudson: so it turns out the db patch actually slows my test run down... and it's been awhile since i've run the whole suite locally | 20:24 |
| radez | ayoung: It was in havana but didn't ever seem to work. It disappeared when I upgraded to icehouse | 20:24 |
| ayoung | nkinder, yep | 20:24 |
| nkinder | ayoung: horizon is simply going to have a lot of power | 20:24 |
| *** marcoemorais has quit IRC | 20:24 | |
| ayoung | radez, I was having DHCP issues with a Centos Image. Just trying a Fedora one.... | 20:24 |
| *** marcoemorais has joined #openstack-keystone | 20:24 | |
| nkinder | ayoung: did my writeup make sense with regards to how I think tokens should work? | 20:24 |
| ayoung | nkinder, I should have written that long ago | 20:24 |
| ayoung | yes, it makes sense | 20:25 |
| dolphm | ayoung: regarding horizon & federation, i assume a JS client would talk directly to keystone | 20:25 |
| radez | ayoung: story of my life... dhcp issues on trystack | 20:25 |
| *** daneyon has joined #openstack-keystone | 20:25 | |
| nkinder | ayoung: will breakin ghte ability to change projects be a problem for anything other than horizon? | 20:25 |
| ayoung | nkinder, one thing is, right now, with a trust, you can create a token with a subset of roles, but not via direct token request | 20:25 |
| dolphm | ayoung: and no, i haven't thought about it too much. there's someone around here that is going to work on that in juno though | 20:25 |
| nkinder | ayoung: but a trust token can't be used to auth and get a different token | 20:25 |
| nkinder | ayoung: the code already prevents that | 20:25 |
| ayoung | and...should we make people define a separate role for each API funcion, or just let them delegate accessto a specific set of APIs? | 20:25 |
| dolphm | bknudson: so, you were right about performance. | 20:26 |
| ayoung | nkinder, If I wanted to create a token that only had one role on it, the only way I could do it is create a trust where I was both trustor and trustee | 20:26 |
| nkinder | ayoung: yes, that's sort of the next step... figuring out how to set up roles and policy so you know what roles are needed ahead of time | 20:26 |
| ayoung | then execute that trust | 20:26 |
| *** amerine_ has joined #openstack-keystone | 20:27 | |
| ayoung | I kindof think I'd rather delegate the rule name in the policy file. | 20:27 |
| ayoung | Heh | 20:27 |
| ayoung | So I need to create a token with the role, plus I add an addition restriction : can only be used against rules identity:create_user | 20:27 |
| *** amerine has quit IRC | 20:28 | |
| ayoung | but...that is not what we really need. | 20:28 |
| ayoung | I mean, we do, but we also need: | 20:28 |
| ayoung | I want radez to create a project for me, and then give you access to it | 20:28 |
| ayoung | that should be "I" give you acccess to it | 20:28 |
| bknudson | dolphm: yea, I didn't see any diff... | 20:29 |
| ayoung | I should be able to create a role: project_admin, and then if a user has that role, they should be able to assign users the _member_ rule on a project in which they have that role assigned | 20:29 |
| bknudson | dolphm: although the patch says we won't be able to test with sqlite anymore when we move to alembic | 20:29 |
| bknudson | so maybe it's a lot faster when we run our tests with mysql (or db2?) | 20:30 |
| bknudson | that might take more than 10 mins | 20:30 |
| *** stevemar has quit IRC | 20:32 | |
| ayoung | nkinder, but back to Keystone, So if we don't trust Horizon, the next best thing we can do is trust a Keystone proxy | 20:32 |
| ayoung | I mean, right now, a user can't go to Keystone, get a token, and hand that to Horizon. But they really should be able to | 20:33 |
| ayoung | and, if it could be done manually, it could be automated | 20:33 |
| ayoung | nkinder, If I were really paranoid, I would insist on creating the whole workflow from my machine, and sign it with a private key. | 20:35 |
| ayoung | So we've already made a leap of faith in trusting Nova to talk to the other services on our behalf | 20:35 |
| *** r-daneel has joined #openstack-keystone | 20:38 | |
| ayoung | radez, do I still need to explicitly open port 22? The default security zone looks the same as our internal | 20:41 |
| amerine_ | "we don't trust horizon"? Who's "we"? | 20:42 |
| ayoung | amerine_, me and you | 20:43 |
| *** amerine_ is now known as amerine | 20:43 | |
| *** gokrokve has joined #openstack-keystone | 20:43 | |
| ayoung | amerine, so, what I was really saying was "how much risk are we willing to accept if Horizon gets hacked in a certain deployment" | 20:43 |
| ayoung | or "exposure" instead of "risk" is probably more correct | 20:44 |
| radez | ayoung: yup | 20:44 |
| ayoung | radez, yup as in...I need to add 22? | 20:44 |
| ayoung | radez, I'm still not sure my problems aren't network related. After that neutron issue you helped me with I'm very suspicious of networking | 20:45 |
| radez | ayoung: it porbably is networking related... it's not been super solid | 20:46 |
| ayoung | radez, also, should this page list port 80 or 443? http://docs.openstack.org/grizzly/openstack-compute/admin/content/part-ii-getting-virtual-machines.html | 20:47 |
| ayoung | down at the openpub security group def? | 20:47 |
| nkinder | ayoung: I don't think we shoudl stress over horizon just yet. Kerberos auth helps there. We should focus on restricting what services can do with tokens in the other services (nova, etc.) | 20:47 |
| *** afazekas has joined #openstack-keystone | 20:47 | |
| ayoung | nkinder, it ties in with how I tackle the Kerberizing of Horizon | 20:48 |
| *** gokrokve has quit IRC | 20:48 | |
| ayoung | if Kerberos is going to be completely different from any other protocol, so be it. But I'd like to at least consider the alternative | 20:48 |
| ayoung | and I don't want to work at cross purposes with the Federation BP | 20:48 |
| *** afazekas is now known as afazekas_wfp | 20:50 | |
| nkinder | ayoung: horizon is going to need an unscoped token to switch between projects (I don't see a way around that) | 20:51 |
| nkinder | ayoung: so it's all in how you get that unscoped token. If you provide a credential that does not expire, horizon can reuse that over and over to get a new unscoped token until it forgets that credential (or it is changed) | 20:52 |
| nkinder | ayoung: the only way I see around that is if the user uses a credential that expires to authenticate to horizon | 20:53 |
| erecio | sdf | 20:55 |
| *** erecio has quit IRC | 20:59 | |
| *** afazekas_wfp has quit IRC | 20:59 | |
| *** clu_ has joined #openstack-keystone | 21:00 | |
| *** rodrigods has quit IRC | 21:02 | |
| *** gokrokve has joined #openstack-keystone | 21:04 | |
| *** jsavak has joined #openstack-keystone | 21:06 | |
| mfisch | I saw I got a +2 today but am waiting on workflow. Are all the steps of +1, +2, workflow, gate, smoke etc documented? It's not in the Gerrit Workflow wiki page | 21:08 |
| *** joesavak has quit IRC | 21:10 | |
| *** amcrn_ has joined #openstack-keystone | 21:10 | |
| *** bknudson has quit IRC | 21:11 | |
| *** amcrn has quit IRC | 21:13 | |
| radez | ayoung: yea that page should probably include a web port | 21:14 |
| radez | ayoung: seems that dhcp has bombed again... I'm considering switching over to vxlan | 21:14 |
| *** marcoemorais has quit IRC | 21:34 | |
| *** marcoemorais has joined #openstack-keystone | 21:35 | |
| *** marcoemorais has quit IRC | 21:35 | |
| *** marcoemorais has joined #openstack-keystone | 21:35 | |
| *** andreaf has joined #openstack-keystone | 21:41 | |
| *** leseb has quit IRC | 21:47 | |
| *** dstanek is now known as dstanek_zzz | 21:47 | |
| *** marcoemorais has quit IRC | 21:47 | |
| *** bknudson has joined #openstack-keystone | 21:48 | |
| nkinder | ayoung: that LDAP patch doesn't work when we have ',' characters in the user_id attribute :( | 21:48 |
| bknudson | did that work before? | 21:49 |
| nkinder | ayoung: if we have 'cn=last, first', the assignment has a dn with 'cn=last\\2C first' and the user_dn has 'cn=last\, first' | 21:50 |
| nkinder | bknudson: well, we weren't doing a DN comparison there | 21:50 |
| bknudson | we need more tests | 21:50 |
| nkinder | bknudson: I suspect it worked, as I can't get a token as a user with a ',' in their user_id (which is something you fixed recently) | 21:50 |
| nkinder | bknudson: You fixed a problem where we got a 500 error, but now we get a 401 | 21:51 |
| nkinder | bknudson: this is where a real DN comparison function would help :) | 21:51 |
| bknudson | nkinder: does it work with https://review.openstack.org/#/c/94714/ ? | 21:51 |
| nkinder | bknudson: let me try it... | 21:52 |
| bknudson | hopefully str2dn handles the escaping, because I didn't add any code to do it. | 21:54 |
| *** hipster has quit IRC | 21:55 | |
| *** daneyon has quit IRC | 21:58 | |
| nkinder | bknudson: success! | 21:59 |
| bknudson | that code works better than I thought it would | 22:00 |
| bknudson | I should add a testcase for it. | 22:00 |
| *** browne has quit IRC | 22:00 | |
| nkinder | bknudson: you might have covered this with the testcase you added for the other 500 error issue | 22:00 |
| bknudson | that only fixed the group query -- https://review.openstack.org/#/c/85402/2 | 22:01 |
| nkinder | bknudson: ok, I'll add a comment with the test I used | 22:03 |
| nkinder | bknudson: which review do you think it belongs with? The one that adds the DN comparison methods, or the one that uses it in the assignments driver? | 22:03 |
| nkinder | I'm leaning towards the assignments driver one since that's where it needs the fix | 22:04 |
| nkinder | let me rephrase. '...since that is the patch that fixes this issue' | 22:04 |
| bknudson | well, are we going to reject the current version of "LDAP fix for get_roles_for_user_and_project user=group ID" since it causes a regression? | 22:05 |
| nkinder | bknudson: yes, we should if it hasn't merged yet IMHO | 22:06 |
| *** joesavak has joined #openstack-keystone | 22:06 | |
| bknudson | nkinder: https://review.openstack.org/#/c/94470/ hasn't merged yet. | 22:06 |
| nkinder | ok, I'll reject it and provide my test that highlights the regression | 22:07 |
| bknudson | y, I'd like to write a unit test for it. | 22:07 |
| *** dstanek_zzz is now known as dstanek | 22:08 | |
| bknudson | we've got test_user_id_comma in test_backend_ldap but it just does self.identity_api.list_groups_for_user | 22:08 |
| *** browne has joined #openstack-keystone | 22:09 | |
| *** jsavak has quit IRC | 22:09 | |
| *** henrynash has quit IRC | 22:10 | |
| bknudson | I'm not sure how well our fakeldap will handle it anyways | 22:10 |
| *** gokrokve has quit IRC | 22:12 | |
| *** gordc has quit IRC | 22:13 | |
| nkinder | bknudson: see my comment in https://review.openstack.org/#/c/94470/ | 22:13 |
| nkinder | bknudson: you should probably add a -2 to block it | 22:13 |
| nkinder | dolphm, tristanC: ^^^ sorry, one more problem uncovered with the LDAP patch | 22:14 |
| bknudson | I'll make it wip | 22:14 |
| tristanC | nkinder: do you know if it also impact stable/icehouse ? | 22:15 |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: test_user_mixed_case_attribute fails - mail, not email https://review.openstack.org/94668 | 22:15 |
| harlowja | any keystone folks around mind looking/checking/commenting on https://review.openstack.org/#/c/88419/ | 22:17 |
| harlowja | just a question there on domains | 22:17 |
| nkinder | tristanC: the previous fix introduces a regression that I'm fairly certain will impact any of the stable releases if we merge it there | 22:17 |
| bknudson | this is only backported to icehouse | 22:18 |
| *** dims has quit IRC | 22:18 | |
| bknudson | although I didn't look into the LDAP issue on older releases. | 22:18 |
| *** dstanek is now known as dstanek_zzz | 22:18 | |
| nkinder | bknudson: me either | 22:18 |
| *** marcoemorais has joined #openstack-keystone | 22:21 | |
| *** dstanek_zzz is now known as dstanek | 22:27 | |
| bknudson | nkinder: wrote a unit test but it didn't fail... probably due to fakeldap not working like real ldap. | 22:28 |
| bknudson | http://paste.openstack.org/show/81106/ | 22:28 |
| nkinder | bknudson: yes, I was using real LDAP | 22:29 |
| nkinder | bknudson: I expect that it is returning the DN in a search escaped differently (\2C vs \,) | 22:29 |
| *** electrichead has joined #openstack-keystone | 22:29 | |
| nkinder | bknudson: let me test with ldapadd/ldapsearch... | 22:29 |
| bknudson | I was also running with master and not the patch. Let me try switching to the patch. | 22:30 |
| *** electrichead is now known as Guest92477 | 22:30 | |
| nkinder | bknudson: in the meantime, I added a few minor comments to https://review.openstack.org/#/c/94513 | 22:30 |
| *** Mikalv has quit IRC | 22:31 | |
| *** Mikalv has joined #openstack-keystone | 22:32 | |
| nkinder | bknudson: OpenLDAP returns the DN with \2C even if you add an entry with the \, style escaping | 22:32 |
| nkinder | bknudson: that explains why your test with fakeldap didn't see the problem | 22:32 |
| bknudson | I can change fakeldap to do that | 22:32 |
| nkinder | bknudson: you could mock the search result in a test to force it | 22:32 |
| nkinder | ...or tweak fakeldap to mimic OL | 22:33 |
| *** toddnni_ has joined #openstack-keystone | 22:34 | |
| *** gabrielbezerra has joined #openstack-keystone | 22:36 | |
| *** amcrn_ has quit IRC | 22:36 | |
| *** redrobot has quit IRC | 22:38 | |
| *** anteaya has quit IRC | 22:38 | |
| *** toddnni has quit IRC | 22:38 | |
| *** gabriel-bezerra has quit IRC | 22:38 | |
| *** r-daneel has quit IRC | 22:41 | |
| *** gokrokve has joined #openstack-keystone | 22:43 | |
| *** jamielennox|away is now known as jamielennox | 22:43 | |
| *** gokrokve has quit IRC | 22:47 | |
| *** bobt has quit IRC | 22:49 | |
| *** richm has quit IRC | 22:49 | |
| *** rwsu has quit IRC | 22:49 | |
| *** joesavak has quit IRC | 22:51 | |
| bknudson | So I'm getting [u'CN=Doe\\, John,OU=Users,CN=example,CN=com', u'CN=two,OU=Users,CN=example,CN=com', u'CN=badguy,OU=Users,CN=example,CN=com'] | 22:55 |
| bknudson | but for openldap it turns to CN=Doe\\2C John,OU=Users,CN=example,CN=com | 22:55 |
| bknudson | ldapadd with "member: cn=Doe\, John,ou=Users,dc=openstack,dc=org", then do ldapsearch and you get back "cn=Doe\2C John,ou=Users,dc=openstack,dc=org" instead! | 22:55 |
| bknudson | ldap is one crazy bitch of a protocol | 22:55 |
| lbragstad | lol | 22:56 |
| *** anteaya has joined #openstack-keystone | 22:57 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add a test for getting grant for a user with a , in ID https://review.openstack.org/94740 | 23:01 |
| dstanek | anyone know off-hand what the most common operation is in keystone? getting tokens? | 23:01 |
| lbragstad | that would be my guess | 23:01 |
| bknudson | nkinder: https://review.openstack.org/94740 is the test | 23:02 |
| bknudson | works without https://review.openstack.org/#/c/94470/ but fails with it. | 23:02 |
| bknudson | and using the new DN compare function it passes again. | 23:06 |
| bknudson | so let me fix up the DN compare functions based on nkinder comments. | 23:06 |
| nkinder | bknudson: the test looks good. Just +1'd it. | 23:07 |
| nkinder | fun times with LDAP... :) | 23:08 |
| nkinder | dstanek: I would think that is correct, but I don't have any real data to back it up with | 23:09 |
| bknudson | dstanek: probably depends on the setting for cache times... auth_token used to fetch the revocation list every second. | 23:09 |
| nkinder | dstanek: with UUID tokens, it was probably validating tokens | 23:09 |
| bknudson | if you set the token cache time really short it would be validating tokens | 23:09 |
| nkinder | bknudson: yeah, that might have hammered keystone... | 23:10 |
| *** richm has joined #openstack-keystone | 23:11 | |
| *** rwsu has joined #openstack-keystone | 23:12 | |
| *** bobt has joined #openstack-keystone | 23:13 | |
| *** thedodd has quit IRC | 23:16 | |
| ayoung | nkinder, in Dad mode at the moment. You have things covered? | 23:17 |
| nkinder | ayoung: yup | 23:17 |
| ayoung | bknudson, what are we defaulting to in the new client for token hashing? sha256 or sha1? | 23:21 |
| nkinder | ayoung: md5 IIRC | 23:22 |
| ayoung | nkinder, nah, in the replacement | 23:22 |
| ayoung | its md5 now | 23:22 |
| bknudson | current client only has md5 | 23:22 |
| *** andreaf has quit IRC | 23:22 | |
| nkinder | ayoung: I thought it couldn't be changed without affecting backwards compatibility | 23:22 |
| bknudson | md5 isn't going to change | 23:22 |
| ayoung | I know, new client will have support for configurable | 23:22 |
| bknudson | the default isn't going to change | 23:22 |
| nkinder | ayoung: it's 'hardcoded md5' now | 23:22 |
| nkinder | new == configurable with md5 as the default | 23:22 |
| bknudson | hopefully we'll be able to deprecate md5 | 23:23 |
| ayoung | bknudson, and move to sha256? | 23:23 |
| bknudson | right, the default would be sha256 | 23:23 |
| bknudson | I think people still like "crypto" protocols to be configurable | 23:23 |
| nkinder | bknudson: +1 | 23:23 |
| bknudson | in case someone finds a way to break sha256 | 23:23 |
| dstanek | lbragstad, nkinder, bknudson: thanks - i made a bunch of experimental changes that make authing about 25% faster in my test env | 23:24 |
| lbragstad | ++ | 23:24 |
| lbragstad | nice! | 23:24 |
| dstanek | does anyone have access to anonymized Keystone Apache logs? | 23:25 |
| bknudson | dstanek: we've got the rally job so we should be able to see the results | 23:25 |
| dstanek | i'd love to see in a real deployment what the most frequent method/urls are | 23:25 |
| *** jogo has joined #openstack-keystone | 23:25 | |
| jdennis | nkinder, bknudson: sorry for jumping in late, but OpenLDAP and 389DS escape differently, both legit, that's why you have to compare in a normalized canonical form, even in tests | 23:25 |
| jogo | it looks like https://bugs.launchpad.net/cinder/+bug/1285833 is back | 23:26 |
| uvirtbot | Launchpad bug 1285833 in cinder "Keystone client racing on certificate lookups causing 401 Unauthorized on API calls" [High,Confirmed] | 23:26 |
| *** rodrigods has joined #openstack-keystone | 23:26 | |
| dstanek | bknudson: i'll start breaking this stuff up into logical commits | 23:26 |
| *** david-lyle has quit IRC | 23:26 | |
| dstanek | everything right now is in my working dir - gevent conversion/uswgi/speed enhancements/much, much more! | 23:26 |
| nkinder | jdennis: yep, there's no one 'right way' to express a DN | 23:27 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Use DN comparison function https://review.openstack.org/94714 | 23:27 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Adds function to compare DNs https://review.openstack.org/94513 | 23:27 |
| nkinder | bknudson: I'm on it... | 23:27 |
| bknudson | nkinder: ^ fixed it up based on your comments | 23:27 |
| ayoung | nkinder, I was responding to the Swift question about the size of PKI tokens, and wanted to give precise info. I rewrote that email at least three times. | 23:28 |
| jdennis | nkinder, bknudson: I'll post my DN module (actually it's a DN class), I had been holding off because I know one significant behavior is specific to Python2 and won't work in a Python3 environment | 23:29 |
| bknudson | so I think what I'd do is, put 94740 (grant test with ,) first, then 94513 (DN compare functions), then 94470 squashed with 94714 (LDAP fix + use DN compare in LDAP fix) | 23:29 |
| nkinder | bknudson: ok, I think I reviewed them all | 23:30 |
| bknudson | for the backport to stable/icehouse it would be SQL + LDAP fix + 94740 + 94513 + 94714 all squashed. | 23:31 |
| *** xianghui has joined #openstack-keystone | 23:33 | |
| *** harlowja has quit IRC | 23:33 | |
| *** harlowja_ has joined #openstack-keystone | 23:33 | |
| nkinder | bknudson: that looks like the right order to me too | 23:34 |
| nkinder | bknudson: I've +1'd 94740 and 94513. When 94470 and 94714 are squashed, I'll review that too. | 23:35 |
| bknudson | so I just want to make sure that everyone's ok with the DN compare functions as is... | 23:36 |
| jdennis | My dog was quilled by a porcupine a little bit ago, I have to take him to the vet | 23:36 |
| bknudson | we could wait for a more baked solution from jdennis | 23:36 |
| nkinder | jdennis: ouch... good luck. | 23:36 |
| bknudson | or switch to the jdennis approach when that's in | 23:37 |
| nkinder | bknudson: we shouldn't. There's an OSSA tied to this. | 23:37 |
| lbragstad | jdennis: I've had that happen to mine before, good luck | 23:37 |
| nkinder | jdennis: hopefully not his face | 23:37 |
| bknudson | take the dog or the porcupine to the vet? | 23:38 |
| nkinder | bknudson: I think the DN methods are a good step forward. We can improve it further in master, but what you have now should only improve the situation. | 23:39 |
| bknudson | alright, I'm ok with it so I'll get about doing the squashing. I'm going to eat dinner and let jenkins run | 23:39 |
| nkinder | bknudson: sounds good. I'm off to open house for my kids in a bit, so I'll check back and review them this evening. | 23:41 |
| nkinder | bknudson: good work sorting this out! | 23:41 |
| *** jogo has left #openstack-keystone | 23:41 | |
| *** browne has quit IRC | 23:42 | |
| *** morganfainberg_Z is now known as morganfainberg | 23:42 | |
| *** gokrokve has joined #openstack-keystone | 23:44 | |
| *** bobt_ has quit IRC | 23:46 | |
| *** bobt has quit IRC | 23:47 | |
| *** gokrokve has quit IRC | 23:49 | |
| *** openstackgerrit has quit IRC | 23:49 | |
| *** openstackgerrit has joined #openstack-keystone | 23:50 | |
| *** dstanek is now known as dstanek_zzz | 23:52 | |
| *** clu__ has joined #openstack-keystone | 23:53 | |
| *** dstanek_zzz is now known as dstanek | 23:54 | |
| *** clu_ has quit IRC | 23:55 | |
| *** clu__ is now known as clu_ | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!