| *** chrisshattuck has quit IRC | 00:01 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Replace magic numbers with named symbols https://review.openstack.org/135127 | 00:02 |
|---|---|---|
| openstackgerrit | Merged openstack/python-keystoneclient: Remove middleware architecture doc https://review.openstack.org/127081 | 00:02 |
| openstackgerrit | Merged openstack/python-keystoneclient: Cleanup exception logging https://review.openstack.org/131295 | 00:02 |
| openstackgerrit | Merged openstack/python-keystoneclient: Warn that keystone CLI is pending deprecation https://review.openstack.org/127684 | 00:02 |
| openstackgerrit | Merged openstack/python-keystoneclient: Rename the client API docs https://review.openstack.org/127689 | 00:02 |
| *** russellb has joined #openstack-keystone | 00:04 | |
| *** wpf1 has quit IRC | 00:04 | |
| *** dims has quit IRC | 00:06 | |
| jamielennox | arghhh, sahara is relying on the auth_token options in config :( | 00:06 |
| *** henrynash has quit IRC | 00:09 | |
| *** henrynash has joined #openstack-keystone | 00:10 | |
| *** ChanServ sets mode: +v henrynash | 00:10 | |
| *** henrynash has quit IRC | 00:11 | |
| *** wpf1 has joined #openstack-keystone | 00:15 | |
| openstackgerrit | Will Foster proposed openstack/keystone: skip assignment rows migrate if duplicate entry exists. https://review.openstack.org/136946 | 00:16 |
| *** diegows has quit IRC | 00:17 | |
| morganfainberg | jamielennox, :( | 00:18 |
| *** oomichi has joined #openstack-keystone | 00:31 | |
| *** raildo_ has joined #openstack-keystone | 00:33 | |
| *** raildo_ has quit IRC | 00:37 | |
| *** henrynash has joined #openstack-keystone | 00:40 | |
| *** ChanServ sets mode: +v henrynash | 00:40 | |
| *** tellesnobrega__ has quit IRC | 00:47 | |
| *** dims has joined #openstack-keystone | 00:48 | |
| *** raildo_ has joined #openstack-keystone | 00:48 | |
| *** dims_ has joined #openstack-keystone | 00:50 | |
| *** nellysmitt has joined #openstack-keystone | 00:50 | |
| *** zzzeek has quit IRC | 00:52 | |
| *** topol has joined #openstack-keystone | 00:53 | |
| *** ChanServ sets mode: +v topol | 00:53 | |
| *** dims has quit IRC | 00:54 | |
| *** tellesnobrega__ has joined #openstack-keystone | 00:54 | |
| *** nellysmitt has quit IRC | 00:55 | |
| *** amcrn_ has quit IRC | 00:57 | |
| *** david-lyle is now known as david-lyle_afk | 01:03 | |
| *** jimhoagland has quit IRC | 01:03 | |
| *** htruta_ has joined #openstack-keystone | 01:10 | |
| *** _cjones_ has quit IRC | 01:12 | |
| *** dims_ has quit IRC | 01:14 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: improve error message when tenant ID does not exist https://review.openstack.org/131255 | 01:29 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 01:29 |
| *** kobtea has joined #openstack-keystone | 01:34 | |
| *** ncoghlan has joined #openstack-keystone | 01:34 | |
| ayoung | dstanek, so yeah, the ML message is roughly connected to what I was going to talk to morganfainberg about on Thursday. Bascially, I want to break apart service_v3 from our past pipeline. It really only makes sense to do that, though, if we are going to keep the paste api. I'm starting to wonder if it is time to resurrect jamielennox 's pecan/wsme effort | 01:37 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove custom string truth handling https://review.openstack.org/138220 | 01:37 |
| jamielennox | ayoung: :) | 01:37 |
| jamielennox | i would love to see that get in | 01:37 |
| jamielennox | it's harder than you think though | 01:37 |
| ayoung | jamielennox, does it remove the need for paste.ini? | 01:38 |
| openstackgerrit | Will Foster proposed openstack/keystone: skip assignment rows migrate if duplicate entry exists. https://review.openstack.org/136946 | 01:38 |
| jamielennox | ayoung: it specifically doesn't touch paste - it was supposed to be be as unobtrusive as possible | 01:38 |
| *** kobtea has quit IRC | 01:38 | |
| ayoung | jamielennox, dagnabit | 01:40 |
| ayoung | pretty sure we had this exact exchange like a year ago | 01:40 |
| jamielennox | ayoung: so paste is a wsgi layer for middleware | 01:40 |
| ayoung | its broken | 01:40 |
| jamielennox | you can put it in or pull it out transparently to the underlying app | 01:40 |
| ayoung | well, our use of paste | 01:40 |
| jamielennox | ayoung: i agree | 01:40 |
| ayoung | jamielennox, I was thinking to split out just the /auth pipeline, and...well we have all sorts of things that make that tricky | 01:41 |
| ayoung | things like json_home and the OS-FEDERATION extension adding stuff into the /auth suburl | 01:41 |
| jamielennox | ayoung: i'd like that - i'd love to see if we can put auth_token middleware in front of everything that is not /auth | 01:41 |
| *** tellesnobrega__ has quit IRC | 01:42 | |
| ayoung | ++ | 01:42 |
| ayoung | jamielennox, so one thing that is messed up is that token validation needs a token | 01:43 |
| jamielennox | that would make auth_token so much easier | 01:44 |
| ayoung | so POST and GET /auth/tokens | 01:44 |
| *** tellesnobrega__ has joined #openstack-keystone | 01:44 | |
| ayoung | the post to get a new token should not require a token...but should be able to handle it if one is passed in | 01:44 |
| ayoung | now, if we do tokenless operations for validate.... | 01:45 |
| ayoung | which we should probably support, then it works out | 01:45 |
| jamielennox | handle if one is passed to POST? | 01:45 |
| ayoung | jamielennox, token for token exchanges still go to /auth | 01:45 |
| jamielennox | token to token auth doesn't look like x-auth-token requests | 01:46 |
| ayoung | ah, right, it is in the body | 01:46 |
| openstackgerrit | Merged openstack/python-keystoneclient: Docstring cleanup for return type https://review.openstack.org/127857 | 01:46 |
| ayoung | so really it is just the validate call. | 01:46 |
| ayoung | which we could really replace with basic-auth | 01:47 |
| *** dims has joined #openstack-keystone | 01:50 | |
| *** r-daneel has quit IRC | 01:50 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: remove deprecated access log middleware https://review.openstack.org/125703 | 01:51 |
| *** andreaf has quit IRC | 01:52 | |
| *** andreaf has joined #openstack-keystone | 01:52 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove deprecated external authentication plugins https://review.openstack.org/125701 | 01:52 |
| openstackgerrit | Merged openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 01:52 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: remove XML middleware from default paste config https://review.openstack.org/130371 | 01:59 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Make tests run against original client and session https://review.openstack.org/117089 | 02:03 |
| *** marcoemorais has quit IRC | 02:03 | |
| *** gyee_ has quit IRC | 02:04 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 02:07 |
| *** tellesnobrega__ has quit IRC | 02:09 | |
| dolphm | ayoung: the other external authentication method still exist in https://review.openstack.org/#/c/125701/3/keystone/auth/plugins/external.py | 02:10 |
| dolphm | methods* | 02:10 |
| *** henrynash has quit IRC | 02:10 | |
| ayoung | dolphm, line 151...the word "unintentionally" should not be there...that is what we need | 02:10 |
| ayoung | dolphm, couldn' | 02:11 |
| ayoung | dolphm, couldn't get it to work with the other plugins | 02:11 |
| ayoung | there is supposed to be a setting for mod_auth_kerb that does a local user mapping, but it doesn't actually work right | 02:11 |
| ayoung | with the mapping stuff, we can drop this, but not quite yet | 02:12 |
| dolphm | ayoung: oh, i read your comment as if i had removed *all* the external auth methods | 02:12 |
| ayoung | leave the review up there, though | 02:12 |
| ayoung | I'll push it on through once the mapping works or I find some other workaround | 02:12 |
| *** jdennis1 has quit IRC | 02:13 | |
| *** NM has joined #openstack-keystone | 02:15 | |
| *** tellesnobrega__ has joined #openstack-keystone | 02:16 | |
| *** Dafna has quit IRC | 02:16 | |
| *** erkules_ has joined #openstack-keystone | 02:25 | |
| *** richm has quit IRC | 02:25 | |
| *** erkules has quit IRC | 02:28 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Pass all adapter parameters through to adapter https://review.openstack.org/138228 | 02:29 |
| *** jdennis has joined #openstack-keystone | 02:29 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 02:41 |
| *** dims has quit IRC | 02:42 | |
| *** nitish has joined #openstack-keystone | 02:48 | |
| *** htruta_ has quit IRC | 02:50 | |
| *** xxj has joined #openstack-keystone | 02:51 | |
| *** nellysmitt has joined #openstack-keystone | 02:51 | |
| *** dims has joined #openstack-keystone | 02:51 | |
| *** dims has quit IRC | 02:51 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 02:54 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Example Initialization scripts https://review.openstack.org/82687 | 02:55 |
| *** nellysmitt has quit IRC | 02:56 | |
| *** nitish has quit IRC | 02:56 | |
| ayoung | jamielennox, do we have an auth plugin for the service_token yet? | 02:56 |
| jamielennox | X-Service-Token? | 02:57 |
| ayoung | jamielennox, er not | 02:57 |
| ayoung | the ADMIN_TOKEN | 02:57 |
| jamielennox | oh endpoint/url? | 02:57 |
| ayoung | yeah | 02:57 |
| jamielennox | ksc.auth.token_endpoint:Token | 02:57 |
| *** jdennis has quit IRC | 02:57 | |
| ayoung | jamielennox, for a python script, should I use the entry points, or just the python path? | 02:58 |
| ayoung | cleaning up https://review.openstack.org/#/c/82687/16/examples/scripts/initialize_keystone.py,cm | 02:59 |
| jamielennox | ayoung: just use the python | 02:59 |
| ayoung | jamielennox, so endpoint_plugin = keystoneclient.auth.token_endpoint.Token( | 03:00 |
| ayoung | endpoint=OS_SERVICE_ENDPOINT, | 03:00 |
| ayoung | token=OS_SERVICE_TOKEN) | 03:00 |
| ayoung | session = ksc.session.Session() | 03:00 |
| ayoung | and client = (session=session, auth=endpoint+plugin) | 03:01 |
| ayoung | er | 03:01 |
| ayoung | and client = (session=session, auth=endpoint_plugin) | 03:01 |
| jamielennox | yea, that won't work with ksc :( | 03:01 |
| ayoung | ? | 03:02 |
| jamielennox | https://review.openstack.org/#/c/138228/ | 03:02 |
| jamielennox | need ^ for passing auth= to ksc | 03:02 |
| jamielennox | in many ways ksc is the hardest to fix | 03:02 |
| jamielennox | it's debatable if it's backwards compatible | 03:03 |
| ayoung | ssshhhh | 03:03 |
| jamielennox | because it will error out if you pass kwargs that weren't there originally | 03:03 |
| ayoung | jamielennox, "for now?" | 03:03 |
| jamielennox | i think that's an error anyway | 03:03 |
| jamielennox | just attach it to the session | 03:04 |
| jamielennox | Session(auth=endpoint_plugin) | 03:04 |
| ayoung | jamielennox, I want it to a be a teaching tool, so show session reuse | 03:05 |
| jamielennox | this is a problem for DOA as well | 03:05 |
| jamielennox | ayoung: so you need to change the auth plugin midway through? | 03:05 |
| ayoung | I can rebase on yours | 03:06 |
| ayoung | jamielennox, sort of | 03:06 |
| jamielennox | if you are always using the same plugin then attaching doesn't matter | 03:06 |
| ayoung | jamielennox, I want to test that the newly created use works | 03:06 |
| ayoung | so use the ADMIN_TOKEN to create a user, and then assign a role etc.... | 03:06 |
| ayoung | switch to the auth plugin for the new user and check that they can log in | 03:06 |
| jamielennox | ok, put a +2 on that review if it works for you | 03:07 |
| *** NM has quit IRC | 03:07 | |
| jamielennox | i want to have that review in for the next release because i need it for DOA | 03:07 |
| jamielennox | well, i want it | 03:08 |
| *** nitish has joined #openstack-keystone | 03:09 | |
| ayoung | jamielennox, we need it for the proper scoping of plug in and session, right? | 03:11 |
| ayoung | dolphm, morganfainberg can one of you (or both) look at https://review.openstack.org/#/c/138228/ | 03:12 |
| jamielennox | ayoung: it works as advertised, just missing newer features | 03:12 |
| jamielennox | ayoung: the dependant review to make ksc use adapter only got in a few hours ago | 03:12 |
| ayoung | jamielennox, but auth= is required to create a client without auth being in the session, no? | 03:12 |
| jamielennox | ayoung: correct | 03:12 |
| ayoung | jamielennox, why does the comment say "for now?" | 03:13 |
| jamielennox | i think i had this chat with dolphm as to whether we should allow the client __init__ to set service_type | 03:14 |
| jamielennox | he was pretty adament against it | 03:14 |
| ayoung | so that probably will be the long term setting...but maybe not. Got it | 03:14 |
| jamielennox | I've been of the opinion it is something we should default correctly and let user set if required | 03:15 |
| jamielennox | and that's how most of the other clients work | 03:15 |
| jamielennox | some of them actually require setting service_type from config | 03:15 |
| ayoung | I do see an argument that 'admin' should go away. | 03:15 |
| ayoung | but if we ever get there, we'll deal | 03:15 |
| jamielennox | ayoung: absolutely | 03:15 |
| jamielennox | i'd really like to set interface to public by default | 03:15 |
| jamielennox | at least for v3 | 03:16 |
| jamielennox | but that's a compatibility change | 03:16 |
| ayoung | yep | 03:16 |
| jamielennox | actually i reckon we can leave that one as a default value, people should able to override that | 03:16 |
| ayoung | nother patch | 03:16 |
| *** erkules_ is now known as erkules | 03:16 | |
| ayoung | would it be problem for someone that needed to talk to keystone but only had access to the public interface? | 03:17 |
| *** ncoghlan is now known as ncoghlan_afk | 03:20 | |
| ayoung | jamielennox, http://paste.openstack.org/show/143142/ | 03:25 |
| jamielennox | ayoung: problem? at the moment i just don't htink it would work with client | 03:26 |
| ayoung | that is rebased on your commit | 03:26 |
| jamielennox | ayoung: crap - yea that will be new | 03:26 |
| ayoung | jamielennox, I'm going to post my review so I can keep it in sync with yours | 03:27 |
| jamielennox | ayoung: where's that coming from? | 03:27 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Example Initialization scripts https://review.openstack.org/82687 | 03:29 |
| ayoung | jamielennox ^^ | 03:29 |
| jamielennox | ayoung: looks like you're passing management_url=something - ksc never accepted that argument | 03:29 |
| ayoung | jamielennox, that was working before | 03:30 |
| jamielennox | ayoung: right because **kwargs just ignored everything that wasn't known | 03:31 |
| jamielennox | it didn't do anything it just wasn't an error | 03:31 |
| *** raildo_ has quit IRC | 03:31 | |
| ayoung | well, let me write it correctly, but..is this a non-backwards compat change we need to be concerned with | 03:31 |
| jamielennox | this is what i meant by 'technically compatible' | 03:31 |
| ayoung | ? | 03:31 |
| jamielennox | <jamielennox> it's debatable if it's backwards compatible | 03:32 |
| jamielennox | <ayoung> ssshhhh | 03:32 |
| *** nitish has quit IRC | 03:33 | |
| jamielennox | ayoung: it's a lot of rearchitecting to make it work when it's a situation we should never have supported | 03:39 |
| ayoung | deal | 03:39 |
| jamielennox | why the hell would we ever have allowed unknown kwargs | 03:39 |
| *** nitish has joined #openstack-keystone | 03:45 | |
| ayoung | jamielennox, OK, got it working. Need to populate the user identity. Seems like there is not user_client.user_id or user_client.username set, even after list of projects | 03:48 |
| jamielennox | ayoung: it's not set on client. | 03:49 |
| jamielennox | that's correct | 03:49 |
| jamielennox | it should never have been | 03:49 |
| jamielennox | *grumble | 03:49 |
| ayoung | jamielennox, is there any way to populate it or a comparable value on some other object? | 03:49 |
| jamielennox | ayoung: what are you looking for ? | 03:49 |
| ayoung | current user id, if set by name | 03:50 |
| ayoung | username if set by id | 03:50 |
| jamielennox | from what plugin? | 03:50 |
| *** ncoghlan_afk is now known as ncoghlan | 03:50 | |
| ayoung | password | 03:50 |
| jamielennox | generic.password or v3.Password? | 03:50 |
| ayoung | generic | 03:50 |
| ayoung | trying to make this a shining example to the world | 03:51 |
| jamielennox | ayoung: so best would be auth_plugin.get_access(session).user_id | 03:52 |
| ayoung | jamielennox, and from the client? | 03:52 |
| ayoung | would that be | 03:52 |
| ayoung | user_client.auth_plugin.get_access(session).user_id | 03:52 |
| jamielennox | you can do auth_plugin.auth_ref.user_id however that would assume you know that auth_ref is present and valid | 03:53 |
| jamielennox | ayoung: i'd have just held on to the plugin if you need to use the plugin | 03:53 |
| ayoung | I don';t have the auth plugin available directly at this point | 03:53 |
| ayoung | there is no way to query the current user data from the client itself? | 03:54 |
| jamielennox | does make it more complicated, i'm trying to keep things of the opinion that the client shouldn't know | 03:55 |
| jamielennox | no, you can't access it via client, you need to have the plugin | 03:55 |
| ayoung | so if I have only, say the user id, what should a client consumer do | 03:55 |
| ayoung | do another get? | 03:55 |
| jamielennox | what do you mean - if you have user_id you will still need a token right? | 03:56 |
| ayoung | say I have user_id, but want the username | 03:56 |
| ayoung | or the other way around | 03:56 |
| jamielennox | there's nothing you can do, have to auth | 03:56 |
| jamielennox | well you can do user_id -> user with GET /user/{id} i think | 03:56 |
| jamielennox | i don't know if there is a username search | 03:56 |
| ayoung | user = user_client.users.list(name=OS_USERNAME, | 03:57 |
| ayoung | domain='default')[0] | 03:57 |
| ayoung | ^^ jamielennox that worked | 03:57 |
| jamielennox | cool | 03:58 |
| *** samuelms has quit IRC | 04:01 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Example Initialization scripts https://review.openstack.org/82687 | 04:05 |
| ayoung | jamielennox, checkout those scripts. Do those fit your vision of how the plugins and session should be used? If not, well, please comment. | 04:06 |
| * ayoung gonna get ready for bed | 04:06 | |
| stevemar | are we enforcing API changes in the same patch set as the spec? | 04:10 |
| stevemar | cause there are none that have them | 04:11 |
| *** _cjones_ has joined #openstack-keystone | 04:13 | |
| *** _cjones_ has quit IRC | 04:13 | |
| *** _cjones_ has joined #openstack-keystone | 04:14 | |
| *** _cjones_ has quit IRC | 04:19 | |
| *** tellesnobrega__ has quit IRC | 04:29 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use new oslo.config generator https://review.openstack.org/128440 | 04:32 |
| *** ayoung has quit IRC | 04:35 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: sync oslo https://review.openstack.org/138253 | 04:41 |
| *** nitish has quit IRC | 04:51 | |
| *** nellysmitt has joined #openstack-keystone | 04:52 | |
| *** chrisshattuck has joined #openstack-keystone | 04:57 | |
| *** nellysmitt has quit IRC | 04:57 | |
| *** sluo_laptop has quit IRC | 05:01 | |
| *** kobtea has joined #openstack-keystone | 05:11 | |
| *** lhcheng has quit IRC | 05:13 | |
| *** lhcheng has joined #openstack-keystone | 05:13 | |
| *** kobtea has quit IRC | 05:16 | |
| *** lhcheng has quit IRC | 05:18 | |
| *** ajayaa has joined #openstack-keystone | 05:25 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: sync to oslo commit b19af08 https://review.openstack.org/138253 | 05:28 |
| *** ajayaa has quit IRC | 05:35 | |
| *** chrisshattuck has quit IRC | 05:36 | |
| *** ajayaa has joined #openstack-keystone | 06:05 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:07 |
| *** topol has quit IRC | 06:09 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor the code to simplify the function invocation https://review.openstack.org/133135 | 06:11 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor the code to join multiple criteria together https://review.openstack.org/133135 | 06:14 |
| *** lhcheng has joined #openstack-keystone | 06:26 | |
| *** ukalifon1 has joined #openstack-keystone | 06:36 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: sync to oslo commit b19af08 https://review.openstack.org/138253 | 06:43 |
| *** harlowja_ is now known as harlowja_away | 06:45 | |
| *** afazekas has joined #openstack-keystone | 06:50 | |
| *** lhcheng has quit IRC | 06:51 | |
| *** lhcheng has joined #openstack-keystone | 06:52 | |
| *** nellysmitt has joined #openstack-keystone | 06:53 | |
| *** nellysmitt has quit IRC | 06:58 | |
| *** jimhoagland has joined #openstack-keystone | 07:03 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use new oslo.config generator https://review.openstack.org/128440 | 07:07 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use new oslo.config generator https://review.openstack.org/128440 | 07:14 |
| *** lhcheng has quit IRC | 07:16 | |
| *** lhcheng has joined #openstack-keystone | 07:16 | |
| *** lhcheng has quit IRC | 07:21 | |
| *** k4n0 has joined #openstack-keystone | 07:21 | |
| *** DaveChen has joined #openstack-keystone | 07:29 | |
| openstackgerrit | Abhishek Kekane proposed openstack/keystone: Eventlet green threads not released back to pool https://review.openstack.org/130824 | 07:33 |
| DaveChen | test... | 07:36 |
| breton | passed | 07:40 |
| DaveChen | the first time join in, thx. :) | 07:43 |
| *** mflobo has joined #openstack-keystone | 07:47 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: User ids that begin with 0 cannot authenticate through ldap https://review.openstack.org/137449 | 08:02 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: User ids that begin with 0 cannot authenticate through ldap https://review.openstack.org/137449 | 08:04 |
| *** ukalifon1 has quit IRC | 08:04 | |
| *** ncoghlan has quit IRC | 08:05 | |
| *** ncoghlan has joined #openstack-keystone | 08:06 | |
| *** jimhoagland has quit IRC | 08:12 | |
| *** stevemar has quit IRC | 08:23 | |
| *** ncoghlan has quit IRC | 08:30 | |
| *** yasu_ has quit IRC | 08:31 | |
| *** henrynash has joined #openstack-keystone | 08:35 | |
| *** ChanServ sets mode: +v henrynash | 08:35 | |
| *** henrynash has quit IRC | 08:39 | |
| *** ukalifon has joined #openstack-keystone | 08:42 | |
| *** nellysmitt has joined #openstack-keystone | 08:45 | |
| *** aix has quit IRC | 08:45 | |
| *** kobtea has joined #openstack-keystone | 08:48 | |
| *** kobtea has quit IRC | 08:53 | |
| *** aix has joined #openstack-keystone | 08:58 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove custom string truth handling https://review.openstack.org/138220 | 08:59 |
| *** RockKuo_Office has joined #openstack-keystone | 09:15 | |
| *** jistr has joined #openstack-keystone | 09:18 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 09:21 |
| *** aix has quit IRC | 09:27 | |
| *** svasheka_ has quit IRC | 09:40 | |
| *** aix has joined #openstack-keystone | 09:40 | |
| *** lsmola has quit IRC | 09:43 | |
| *** yasu_ has joined #openstack-keystone | 09:48 | |
| *** Dafna has joined #openstack-keystone | 09:57 | |
| *** lsmola has joined #openstack-keystone | 09:58 | |
| *** svasheka has joined #openstack-keystone | 10:01 | |
| *** yasu_ has quit IRC | 10:13 | |
| *** RockKuo_Office has quit IRC | 10:14 | |
| *** samuelms has joined #openstack-keystone | 10:20 | |
| *** samuelms has quit IRC | 10:27 | |
| *** yasu_ has joined #openstack-keystone | 10:31 | |
| *** lsmola has quit IRC | 10:34 | |
| *** tellesnobrega has joined #openstack-keystone | 10:37 | |
| *** jamielennox is now known as jamielennox|away | 10:40 | |
| *** tellesnobrega has quit IRC | 10:46 | |
| *** lsmola has joined #openstack-keystone | 10:50 | |
| *** tellesnobrega has joined #openstack-keystone | 10:53 | |
| *** yasu_ has quit IRC | 10:55 | |
| *** Qlawy has joined #openstack-keystone | 11:02 | |
| *** tellesnobrega has quit IRC | 11:03 | |
| *** NM has joined #openstack-keystone | 11:08 | |
| *** henrynash has joined #openstack-keystone | 11:14 | |
| *** ChanServ sets mode: +v henrynash | 11:14 | |
| *** NM has quit IRC | 11:17 | |
| *** NM has joined #openstack-keystone | 11:30 | |
| *** raildo_ has joined #openstack-keystone | 11:36 | |
| *** yasu_ has joined #openstack-keystone | 11:37 | |
| *** jistr is now known as jistr|training | 11:42 | |
| *** raildo_ has quit IRC | 11:43 | |
| *** tellesnobrega_ is now known as tellesnobrega | 11:47 | |
| *** diegows has joined #openstack-keystone | 11:48 | |
| openstackgerrit | Bogun Dmitriy proposed openstack/keystone: FIX multiple SQL backend usage validation https://review.openstack.org/138113 | 11:49 |
| *** kobtea has joined #openstack-keystone | 11:53 | |
| *** samuelms has joined #openstack-keystone | 11:54 | |
| *** afaranha has quit IRC | 11:56 | |
| *** kobtea has quit IRC | 11:57 | |
| samuelms | henrynash, morning | 11:59 |
| henrynash | samulems: good mrning | 11:59 |
| samuelms | henrynash, regarding the domain-roles changes .. | 11:59 |
| henrynash | samulems: yes | 11:59 |
| samuelms | henrynash, how do you plan to split tasks ? | 11:59 |
| samuelms | henrynash, can we start that or do you plan to have that after assingmnet split? | 12:00 |
| henrynash | samuelms: so I’m open to suggestions….haven’t really planned it out yet…. | 12:00 |
| henrynash | samulems: we can start now, I don’t see why not…pretty sure we are close to agreement on the spec | 12:01 |
| samuelms | henrynash, ok .. I'd to start the first points :) I think you're busy enough with the assignment split | 12:01 |
| samuelms | henrynash, perfect | 12:01 |
| henrynash | samuelms: i guess one quetsion is where does the code for domain-roles go? | 12:01 |
| samuelms | henrynash, that's why you said ' Agree API changes for domain-role CRUD', right? | 12:02 |
| henrynash | samuelms: I think I know where I think it goes, but interested in your view | 12:02 |
| samuelms | henrynash, the first bullet point | 12:02 |
| henrynash | samuelms: yes, fist thing is to propose teh new API spec | 12:02 |
| henrynash | samuelms: which I think is pretty easy (famous last words)…..it’s just a mirrot of the existing grant APIs | 12:03 |
| samuelms | henrynash, so we should have inside the same grant api, right? | 12:04 |
| henrynash | samuelms: I think so, yes | 12:04 |
| samuelms | henrynash, that should now accept both role and role-groups when granting a role | 12:04 |
| henrynash | samuelms: exactly | 12:04 |
| samuelms | s/role-groups/domain-roles | 12:04 |
| samuelms | :p | 12:04 |
| henrynash | :-) | 12:04 |
| samuelms | henrynash, great .. can I start that spec? | 12:05 |
| henrynash | samuelms: taht would be great | 12:05 |
| samuelms | henrynash, and then we can move fast to domain-roles | 12:05 |
| samuelms | henrynash, cool .. thanks | 12:05 |
| henrynash | samuems: no, thanks to you! | 12:05 |
| samuelms | henrynash, have some meetings today but I'll try to submit a first version of that | 12:05 |
| samuelms | henrynash, :-) | 12:06 |
| rodrigods | henrynash, https://review.openstack.org/#/c/138186/ :) | 12:07 |
| rodrigods | henrynash, guess the assignment split should be rebased based on it | 12:08 |
| henrynash | rodigods: excellent!! I think HM is a worth winner of the race! | 12:08 |
| rodrigods | henrynash, \o/ | 12:08 |
| rodrigods | but there is some more patches | 12:08 |
| henrynash | rodigods: a little task for me later today - just adding an sql upgrade to my split | 12:09 |
| henrynash | rodigods: should I hold of an a rebase then? | 12:09 |
| rodrigods | henrynash, in this merge we have a dependency to patch that does a sql upgrade (parent_id) | 12:10 |
| rodrigods | my only doubt is... if what is the best rebase strategy | 12:11 |
| rodrigods | rebase assignment splint with https://review.openstack.org/#/c/117787/ | 12:11 |
| rodrigods | or rebase https://review.openstack.org/#/c/117786/ against the last change of the split series | 12:11 |
| *** henrynash has quit IRC | 12:18 | |
| *** tellesnobrega_ has joined #openstack-keystone | 12:20 | |
| *** k4n0 has quit IRC | 12:28 | |
| openstackgerrit | Sergey Kraynev proposed openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 12:47 |
| *** jdennis has joined #openstack-keystone | 12:49 | |
| *** radez_afk is now known as radez | 12:52 | |
| *** pc-m has joined #openstack-keystone | 12:54 | |
| *** yasu_ has quit IRC | 13:05 | |
| openstackgerrit | Bogun Dmitriy proposed openstack/keystone: Remove irrelative comment https://review.openstack.org/138355 | 13:09 |
| *** henrynash has joined #openstack-keystone | 13:17 | |
| *** ChanServ sets mode: +v henrynash | 13:17 | |
| *** henrynash has quit IRC | 13:17 | |
| *** henrynash has joined #openstack-keystone | 13:20 | |
| *** ChanServ sets mode: +v henrynash | 13:20 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 13:24 |
| *** tellesnobrega_ has quit IRC | 13:26 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 13:30 |
| *** dims has joined #openstack-keystone | 13:32 | |
| *** palendae has quit IRC | 13:38 | |
| *** bknudson has joined #openstack-keystone | 13:40 | |
| *** ChanServ sets mode: +v bknudson | 13:40 | |
| *** tellesnobrega_ has joined #openstack-keystone | 13:40 | |
| *** bknudson1 has joined #openstack-keystone | 13:42 | |
| *** bknudson has quit IRC | 13:44 | |
| *** palendae has joined #openstack-keystone | 13:46 | |
| *** dims has quit IRC | 13:53 | |
| *** dims has joined #openstack-keystone | 13:54 | |
| *** aix has quit IRC | 13:54 | |
| samuelms | dstanek, ping .. you're working with the needed 'infra' to run functional tests on top of it, right? | 13:56 |
| dstanek | samuelms: yes | 13:56 |
| samuelms | dstanek, how close is that to be merged? do you have any code review? | 13:56 |
| dstanek | samuelms: i have code that i can push today that runs the tests | 13:57 |
| samuelms | dstanek, in fact we'd like to help .. and I'd like to find some place | 13:57 |
| samuelms | dstanek, great! | 13:57 |
| samuelms | dstanek, so with that code we can start writing functional tests for federation, right? | 13:57 |
| dstanek | samuelms: almost - there is still a little federation stuff that i didn't work out yesterday | 13:59 |
| dstanek | samuelms: and once i push the federation stuff i have to get some opinions on if i'm doing it how infra would | 14:00 |
| dstanek | samuelms: for example i am running a Python process in the background to act as an IdP, but they may prefer it controlled by the init process | 14:00 |
| *** gordc has joined #openstack-keystone | 14:00 | |
| dstanek | samuelms: actually we can work in parallel on the tests | 14:07 |
| dstanek | samuelms: you should be able to write federation tests against keystone right now and once i get my stuff in tree yours can be put on top of it | 14:07 |
| vsilva | hi dstanek | 14:08 |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: documentation for audit middleware https://review.openstack.org/130344 | 14:09 |
| vsilva | that sounds about right. we can start drafting out what we want to test and once your stuff is in we'll adapt it | 14:09 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove XML support https://review.openstack.org/125738 | 14:10 |
| samuelms | vsilva, :-) | 14:11 |
| samuelms | vsilva, looks good | 14:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add positive test case for content types https://review.openstack.org/130591 | 14:14 |
| *** richm has joined #openstack-keystone | 14:15 | |
| *** jimhoagland has joined #openstack-keystone | 14:22 | |
| dstanek | vsilva: hi | 14:24 |
| *** stevemar has joined #openstack-keystone | 14:28 | |
| *** ChanServ sets mode: +v stevemar | 14:28 | |
| *** ayoung has joined #openstack-keystone | 14:30 | |
| *** ChanServ sets mode: +v ayoung | 14:30 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update docs to no longer show XML support https://review.openstack.org/125753 | 14:31 |
| *** ayoung has quit IRC | 14:32 | |
| *** ayoung has joined #openstack-keystone | 14:38 | |
| *** ChanServ sets mode: +v ayoung | 14:38 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: sync oslo and bring in versionutils https://review.openstack.org/138381 | 14:39 |
| dstanek | stacking and unstacking takes forever | 14:43 |
| *** lhcheng has joined #openstack-keystone | 14:48 | |
| *** nellysmitt has quit IRC | 14:49 | |
| *** richm has quit IRC | 14:50 | |
| *** NM1 has joined #openstack-keystone | 14:51 | |
| *** joesavak has joined #openstack-keystone | 14:52 | |
| *** NM has quit IRC | 14:52 | |
| ayoung | dstanek, cut out all of the services but the ones you need. What are you stacking/unstacking for? | 14:54 |
| bknudson1 | I usually just run with keystone | 14:55 |
| bknudson1 | and glance is easy to start, too | 14:55 |
| ayoung | bknudson1, yep, that is the path I tend towards too, unless I need Horizon | 14:56 |
| bknudson1 | ENABLED_SERVICES=key,mysql,rabbit | 14:57 |
| dstanek | ayoung: right now i am only enabling keystone+dbs, but it still takes a few mins | 14:57 |
| bknudson1 | enable_service g-api,g-reg | 14:57 |
| *** samuelms has quit IRC | 14:57 | |
| ayoung | dstanek, why are you unstacking? Just restart keystone | 14:58 |
| ayoung | systemctl restart httpd.service | 14:58 |
| dstanek | ayoung: i'm building the scripts to setup functional testing environments | 14:58 |
| ayoung | or whatever the ebian fork you are running uses | 14:58 |
| ayoung | ah...yeah, then it is going to take some time | 14:58 |
| *** topol has joined #openstack-keystone | 14:58 | |
| *** topol is now known as Guest62847 | 14:59 | |
| ayoung | Guest62847, you are not fooling anyone topol! | 14:59 |
| *** r-daneel has joined #openstack-keystone | 15:00 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: deprecate audit middleware https://review.openstack.org/138386 | 15:00 |
| marekd | ayoung: nkdinder should be around reasonably soon or he is on some sort of holiday still? | 15:01 |
| marekd | nkinder*, sorry | 15:01 |
| ayoung | marekd, he was out sick yesterday | 15:01 |
| marekd | :( | 15:01 |
| ayoung | marekd, he's usually in by now...7AM west coast time | 15:01 |
| *** stevemar has quit IRC | 15:01 | |
| marekd | ayoung: allrighty, thanks. | 15:02 |
| ayoung | marekd, no email from him saying one way or the other, though | 15:02 |
| *** stevemar has joined #openstack-keystone | 15:02 | |
| *** ChanServ sets mode: +v stevemar | 15:02 | |
| marekd | ayoung: uhm. just wanted him to take a look at a spec. may shoot him an e-mail and he will respond whenever he can. | 15:02 |
| *** zzzeek has joined #openstack-keystone | 15:02 | |
| *** Guest62847 has quit IRC | 15:03 | |
| marekd | henrynash: so for now i simply changed that groups must pre-exist in keystone, so we can use current roles assignments API. Could you take a look then? https://review.openstack.org/#/c/138035/ | 15:04 |
| *** nellysmitt has joined #openstack-keystone | 15:04 | |
| henrynash | marekd: sure | 15:04 |
| marekd | henrynash: (the first proposal, more kickass is put into alternatives with indication that there is a huuge dependency) | 15:04 |
| marekd | henrynash: thanks. | 15:04 |
| *** richm has joined #openstack-keystone | 15:05 | |
| *** NM1 has left #openstack-keystone | 15:06 | |
| henrynash | marekd: added comments | 15:16 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Access Info https://review.openstack.org/135774 | 15:17 |
| *** jimhoagland has quit IRC | 15:17 | |
| *** aix has joined #openstack-keystone | 15:22 | |
| *** david-lyle has joined #openstack-keystone | 15:23 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor extract class for signing directory https://review.openstack.org/122281 | 15:27 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Auth token tests create temp cert directory https://review.openstack.org/122280 | 15:27 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 15:27 |
| *** aix has quit IRC | 15:28 | |
| *** aix has joined #openstack-keystone | 15:28 | |
| openstackgerrit | Marcos Fermín Lobo proposed openstack/keystone: Implement group related methods for LDAP backend https://review.openstack.org/102244 | 15:30 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 15:30 |
| *** amakarov_away is now known as amakarov | 15:30 | |
| *** chrisshattuck has joined #openstack-keystone | 15:32 | |
| *** ukalifon has left #openstack-keystone | 15:34 | |
| *** radez is now known as radez_g0n3 | 15:34 | |
| ayoung | morganfainberg, can you add me and stevemar to the approver group for pycadf? | 15:34 |
| ayoung | https://review.openstack.org/#/c/138381/1 has 2 +1s, and it will sit there until someone can approve it. | 15:35 |
| *** lhcheng has quit IRC | 15:35 | |
| *** topol has joined #openstack-keystone | 15:35 | |
| *** ChanServ sets mode: +v topol | 15:35 | |
| ayoung | marekd, actually, I see you are core | 15:36 |
| *** lhcheng has joined #openstack-keystone | 15:36 | |
| amakarov | stevemar, hi! What project the file you asked me to edit belongs to? https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-trust-ext.rst | 15:37 |
| amakarov | stevemar, I doubt forking it on github is a correct way ) | 15:37 |
| ayoung | amakarov, nah, but if you clone it, and then do a git review, it will show up on gerrit | 15:37 |
| amakarov | ayoung, magic! | 15:38 |
| ayoung | Necromancy | 15:38 |
| amakarov | sourcery )) | 15:38 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 15:40 |
| *** chrisshattuck has quit IRC | 15:40 | |
| *** lhcheng has quit IRC | 15:40 | |
| marekd | ayoung: ? | 15:40 |
| ayoung | marekd, pycadf core | 15:40 |
| *** radez_g0n3 is now known as radez | 15:41 | |
| ayoung | marekd, which I realize was not soemthing from this chat room.... | 15:41 |
| marekd | ayoung: i am not aware of core anywhere. | 15:41 |
| marekd | of being core anywhere * | 15:42 |
| ayoung | marekd, I might have messed that up...let me see | 15:42 |
| marekd | ayoung: stackalytics don't list me as pycafd core either | 15:44 |
| ayoung | ah... | 15:44 |
| stevemar | amakarov, i assume you are good :) | 15:45 |
| ayoung | stevemar, sorry to rain on your YAWebsso parade. | 15:46 |
| ayoung | I was pretty hopeful when I first read it, but I think it is fundamentally flawed | 15:46 |
| marekd | ayoung: you are going to work on your websso proposal? | 15:46 |
| marekd | ayoung: it looks like untouched for a while :( | 15:47 |
| ayoung | marekd, its one thing I need to talk to nkinder about today. I'm trying to get a sense of our priorities. We had a diversion based on some other, Rails based project, but I think that is a dead end | 15:47 |
| marekd | ayoung: understand. | 15:47 |
| ayoung | marekd, but the code is already written, right? I can just steal what you and Jose have done.... | 15:48 |
| stevemar | marekd, ayoung yeah, if we could figure it out soon that would be great :) | 15:48 |
| stevemar | ayoung, thats essentially what my spec is :) | 15:48 |
| ayoung | stevemar, OK...so if we wanted to leave the webui in Horizon, we'd need to do something like this: | 15:48 |
| stevemar | i am the best of the theives! | 15:48 |
| ayoung | stevemar, your spec is the Cern implemention? | 15:49 |
| * ayoung missing a vowel or two | 15:49 | |
| ayoung | implementation? | 15:49 |
| marekd | ayoung: the code is written and available at github.com/cernops (branch cern-patches) | 15:49 |
| stevemar | ayoung, basically, i did a GET request instead of a POST request back to horizon, but i listed a POST request as an alternative | 15:49 |
| marekd | ayoung: yet i think for the upstream we would need to add one or two features. but all in all it should be good. | 15:49 |
| *** david-lyle has quit IRC | 15:50 | |
| ayoung | stevemar, what about the dynamic url thing? | 15:50 |
| stevemar | ayoung, but yeah, its basically the cern code, what dynamic url thing? | 15:50 |
| ayoung | stevemar, one sec, I'll quote | 15:50 |
| marekd | ayoung: https://github.com/cernops/keystone/commit/66dabd94b4ad32abca171cef9192210fec289235 | 15:51 |
| stevemar | yeah, too many specs going around | 15:51 |
| ayoung | stevemar, `django_openstack_auth` will dynamically create a URL based on the | 15:51 |
| ayoung | predictable URL format of the protected federation URLs, and perform a GET, | 15:51 |
| marekd | ayoung: https://github.com/cernops/django_openstack_auth/commit/b7e5b28a83a88b259bfaddbd754c70e1bb420447 | 15:51 |
| stevemar | oh that | 15:51 |
| ayoung | stevemar, we can't be leaving state on Horizon | 15:52 |
| marekd | ayoung: what do you mean by that? | 15:52 |
| stevemar | ayoung, so basically i want 1 new function from keystone, list public idps, so it'll return {idp: google, protocol: oidc, idp: ipa, protocol: saml} - and horizon will craft the URL based on the idp and protocol values | 15:52 |
| ayoung | marekd, read https://review.openstack.org/#/c/136610/3/specs/kilo/websso.rst,cm | 15:52 |
| stevemar | thats what i mean by dynamically | 15:53 |
| ayoung | stevemar, let's get yours and mine into a single spec | 15:53 |
| ayoung | I think we are saying almost the same thing | 15:53 |
| *** joesavak has quit IRC | 15:53 | |
| stevemar | keystone-host+'os-federation'+selected_idp+protocol+id+'auth' | 15:53 |
| stevemar | i figured there was overlap | 15:53 |
| stevemar | i just really don't want to mess around with the pipeline :( | 15:54 |
| ayoung | pipeline? | 15:54 |
| stevemar | allow me to quote | 15:54 |
| stevemar | * Refactor paste file to reduce duplication of common filters.207 | 15:55 |
| stevemar | * Splite the v3 service APIs into separate pipelines.208 | 15:55 |
| stevemar | * Remove POST /v3/auth/tokens from the remainder of the auth pipeline | 15:55 |
| stevemar | https://review.openstack.org/#/c/133529/1/specs/kilo/websso-portal.rst | 15:55 |
| ayoung | stevemar, ah...that is optional I realize | 15:55 |
| ayoung | it could easily be postponed | 15:55 |
| ayoung | stevemar, I was messing with that yesterday. The issues are actually different than I list there. | 15:55 |
| stevemar | in that case they are the same spec :) | 15:56 |
| stevemar | for the most part | 15:56 |
| marekd | stevemar: did we discuss DS ? | 15:56 |
| marekd | (Discover service) | 15:56 |
| stevemar | no :( | 15:56 |
| marekd | i think we don't need dynamic url building, and we dont need public idps | 15:57 |
| ayoung | stevemar, I think that we need to be able to consume multiple routes from Apache. | 15:57 |
| ayoung | marekd, ? | 15:57 |
| stevemar | marekd, please go on | 15:57 |
| marekd | ok, normally, when you configure classic web sso you have one url, say host.com/secure. You point your browser there and you must somehow need to choose and idp of your choice. and this is called Discover Service, AFAIR it's another piece of software e.g. from shibboleth. | 15:59 |
| marekd | at cern, actually we don't build dynamic url | 15:59 |
| marekd | i made an extra route /OS-FEDERATION/websso | 15:59 |
| dstanek | uggg...new problem - has anyone seen the ArgsAlreadyParsedError error when running in Apache? | 16:00 |
| ayoung | dstanek, nope | 16:00 |
| marekd | and extended identity_providers with one parameter - entityId (unique id of the idp squeezed into every assertion) | 16:00 |
| ayoung | dstanek, make that yep | 16:00 |
| dstanek | ayoung: is it because of multi threading? | 16:01 |
| ayoung | dstanek, yes | 16:01 |
| marekd | ayoung: stevemar https://github.com/cernops/keystone/blob/cern-patches/keystone/contrib/federation/controllers.py#L270-L281 | 16:01 |
| dstanek | good times | 16:01 |
| ayoung | dstanek, it was a while ago...forgot how I triggered or got around it. | 16:01 |
| marekd | Shib-Identity-Provider is a param comming from the SAML assertion. | 16:01 |
| ayoung | dstanek, it might be that It is a difference in defaults between Fedora nad Debian...prefork versus threading | 16:02 |
| ayoung | but it shouldn't be. | 16:02 |
| marekd | stevemar: ayoung i think it should be ennough for horizon to simply always go to keystone/v3/OS-FEDERATION/websso and this url should be protected AND enriched with service discovery. | 16:03 |
| ayoung | marekd, would that be a visual page? | 16:03 |
| ayoung | "go to" meaning "redirect to" | 16:04 |
| marekd | ayoung: yes. | 16:04 |
| ayoung | marekd, and the set of IdPs in a drop down? | 16:04 |
| marekd | ayoung: go to openstack.cern.ch | 16:04 |
| marekd | https://openstack.cern.ch | 16:04 |
| marekd | you will be redirected to a DS page | 16:04 |
| marekd | you must put your cred, use a certificate but you can also use the your home idp. | 16:04 |
| ayoung | https://login.cern.ch/adfs/ls/?wa=wsignin1.0&wreply=https%3A%2F%2Fkeystone.cern.ch%2FShibboleth.sso%2FADFS&wct=2014-12-02T16%3A04%3A46Z&wtrealm=https%3A%2F%2Fkeystone.cern.ch%2FShibboleth.sso%2FADFS&wctx=cookie% | 16:05 |
| * ayoung chopped off the cookie | 16:05 | |
| marekd | once authenticated, trust me...you will se horizon and your vms. | 16:05 |
| ayoung | marekd, what about for companies that don't want to be publicly listed? | 16:06 |
| ayoung | I was thinking this: | 16:06 |
| stevemar | hmm, i just don't know enough about DS | 16:06 |
| marekd | ayoung: it'sa matter of configuration of the DS | 16:06 |
| stevemar | marekd, what are the changes needed to the apache conf file for DS? | 16:06 |
| stevemar | rather, for all of this | 16:07 |
| marekd | stevemar: for shibboleth...personally i have never cofigured it but had a guy who did some tests with that. | 16:07 |
| *** saipandi has joined #openstack-keystone | 16:07 | |
| ayoung | stevemar, so this is like you are pointing right at Keystone. Each of the methods has its own suburl | 16:07 |
| marekd | stevemar: i just think we shold try going this way first. | 16:08 |
| ayoung | stevemar, if you mouse over, you'll see how differnt they each are | 16:08 |
| stevemar | marekd, i mean the vhost file for keystone, did you do anything else to it? | 16:08 |
| marekd | it's rather a matter oh shibboleth configuration. | 16:08 |
| marekd | of* | 16:08 |
| *** chrisshattuck has joined #openstack-keystone | 16:09 | |
| *** chrisshattuck has quit IRC | 16:09 | |
| ayoung | marekd, so this page....is it running "in" keystone? | 16:09 |
| *** _cjones_ has joined #openstack-keystone | 16:09 | |
| marekd | ayoung: not at all. | 16:09 |
| *** chrisshattuck has joined #openstack-keystone | 16:09 | |
| marekd | this is IdP already | 16:09 |
| marekd | login.cern.ch | 16:09 |
| ayoung | marekd, so what is the process to get a token to Horizon from here? | 16:09 |
| ayoung | say I enter userid and password | 16:10 |
| marekd | by going to openstack.cern.ch you were redirected to protected keystone.cern.ch.v3.OS-FEDERATION/websso that redrected you to our ADFS instance which returns you said page | 16:10 |
| ayoung | it is passed through to keystone, just like Horizon would, and then this app generates javascript to post the token toe DOA? | 16:10 |
| ayoung | But for Federation...is this site "trusted" byu Keystone? | 16:11 |
| marekd | you login, get back to /websso keystone's url, tassertion is mapped, token generated and keystone returns with HTML page with JS that does a POST to openstack.cern.ch horizon webpage. this time also with a unscoped fed. token. | 16:11 |
| ayoung | is the SAML assertion parsed by this app, and then it could impersonate anyone? | 16:11 |
| marekd | ayoung: no impresionation. it/s pure saml | 16:12 |
| ayoung | say I click one of the eduGAIN links. The first thing is that I'm redirected to Keystone? | 16:12 |
| marekd | ayoung: no, you will be redirected to IdP you chose. | 16:13 |
| ayoung | then who processes the SAML assertion? it is login.cern.ch...which is not Keystone | 16:14 |
| marekd | login.cern.ch is in fact ADFS instance, an IDP | 16:14 |
| marekd | it issues the assertion | 16:14 |
| marekd | it's keystone who processes the assertion. | 16:14 |
| marekd | ayoung: let me walk you from step 1 | 16:14 |
| marekd | openstack.cern.ch is horizon. It doesnt recognize any openstck token and redirects to shibboleth protected keystone url: keystone.cern.ch/v3/OS-FEDERATION/websso | 16:15 |
| marekd | websso is shib protected and has login.cern.ch configured as a IdP | 16:16 |
| marekd | so you broweser is redirected to websso, and hence no active session it will redirect you to login.cern.ch (our IdP) | 16:16 |
| marekd | in fact ADFS does also some Discovery service, so you can now login, either with CERN creds or choose other IdPs which are federated with CERN. | 16:17 |
| marekd | ok, you are authenticated, you have your SAML assertion and get back to keystone.cern.ch/v3/OS-FEDERATION/websso | 16:17 |
| marekd | now its pretty standard, mapping, unscoped token and so on. | 16:18 |
| *** jimhoagland has joined #openstack-keystone | 16:18 | |
| marekd | but instead of returning pure unscoped token, keystone returns a HTML with JS with auto post <form> so the browser is redirected to openstack.cern.ch again, this time with unscoped token. | 16:18 |
| marekd | Since horizon recognizes a request with token it will let you through. | 16:19 |
| marekd | viola, you are done | 16:19 |
| marekd | SAML communication is only between keystone.cern.ch and login.cern.ch | 16:19 |
| marekd | there is no impersonation and no similar threats. | 16:20 |
| stevemar | marekd, what about logging in to horizon as a service user? | 16:21 |
| ayoung | marekd, OK, that is how I understood it to work. The difference is just in how we were specifying to do the webUI portion. I was saying put it in Keystone...you have it in ADFS? | 16:21 |
| marekd | ayoung: yes, otherwise each of our 12k SPs would need to have webUI, right? | 16:22 |
| ayoung | So how does Kerberos login work? | 16:22 |
| ayoung | S4U2? | 16:22 |
| marekd | what's S4U2? | 16:22 |
| marekd | stevemar: what service user? | 16:23 |
| ayoung | Nevermind...it is a Kerberos thing, but we do't need it here | 16:23 |
| marekd | ayoung: ok | 16:23 |
| marekd | ayoung: with the arch i just described horizon would not need to query keystone for public idps. | 16:24 |
| marekd | it would be handled by a DS, something that simply needs to be configured. | 16:24 |
| marekd | we don't need to maintain it ourselves and so on. | 16:24 |
| ayoung | no. but your login bridge (ADFS here) does need to know the public IdPs | 16:24 |
| marekd | but it's configured in ADFS not in Keystone. | 16:25 |
| stevemar | marekd, like the admin user | 16:25 |
| stevemar | marekd, any sql users | 16:25 |
| marekd | stevemar: you are asking for combining 'classic' and federated login ? | 16:26 |
| marekd | i don't see any problem with that. | 16:26 |
| marekd | it's a matter of using what we have today or redirecting to keystone.cern.ch/v3/OS-FEDERATION/websso | 16:26 |
| marekd | it's one extra 'if' somewhere in the code. | 16:27 |
| ayoung | marekd, do you have some code that says "and at the end, redirect back only to openstack.cern.ch, and no other sites? | 16:28 |
| marekd | unfortunately yes. it fits our use case, we have that static url well load balanced etc. it unfortunately doesn't fit general upastream use-case. | 16:29 |
| marekd | ayoung: this is what i was trying to tell stevemar. | 16:29 |
| marekd | we would need to figure out a 'original url' and keep it for a session. | 16:29 |
| marekd | so we know where to redirect back the request. | 16:30 |
| ayoung | marekd, no, that is OK for WebUI. We could put Horizon in the service catalog, and limit it to Service catalog entries for CLI base Federation | 16:30 |
| marekd | ayoung: doesn't it break todays architecture? | 16:30 |
| marekd | ayoung: today "ANY" horizon can point to a single keystone | 16:30 |
| marekd | no need to register such horizon in Keystone, right? | 16:31 |
| ayoung | marekd, we have a use case for a separate (rails based app) web ui to do the same thing... | 16:32 |
| ayoung | so we would need both horizon and cloudforms to be acceptable targets of that final post | 16:32 |
| ayoung | but no other services... | 16:32 |
| ayoung | yes, today, multiple webuis can point to a single keystone | 16:32 |
| marekd | ayoung: are we good to limit this? | 16:33 |
| ayoung | marekd, I need to think it through, but probably | 16:34 |
| marekd | stevemar: ayoung i am super happy to help with that i simply want to work on somethig that has general approval :-) | 16:36 |
| stevemar | marekd, understandable, i think ayoung and myself are just trying to get up to speed at this point :) | 16:36 |
| marekd | cool | 16:36 |
| stevemar | we all want the same thing | 16:36 |
| *** tellesnobrega_ has quit IRC | 16:36 | |
| stevemar | marekd, can you point to where in the code you would put that conditional (for the service / sql users) | 16:37 |
| *** htruta has quit IRC | 16:38 | |
| stevemar | cause i definitely don't want to break the current flow | 16:38 |
| *** samuelms has joined #openstack-keystone | 16:38 | |
| *** tellesnobrega_ has joined #openstack-keystone | 16:38 | |
| marekd | stevemar: how about adding a button to a login screen that would simply does a 302 redirect to keystone ? | 16:39 |
| marekd | like, you type: horizon.example.com | 16:39 |
| marekd | and have old login page | 16:39 |
| marekd | with a button "Federated login" or something like that. | 16:39 |
| *** htruta has joined #openstack-keystone | 16:39 | |
| marekd | makes sense? | 16:40 |
| stevemar | and that `federated login` button goes to the protected/discovery page? | 16:40 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: LDAP additional attribute mappings description https://review.openstack.org/118590 | 16:41 |
| marekd | it goes to keystone protected url, hich will automatically redirect you to the discovery page :-) | 16:41 |
| stevemar | marekd, whats in the vhost file for the /websso location? | 16:42 |
| marekd | stevemar: exactly the same configuration like for our identity_providers/*/protocols/*/auth | 16:43 |
| marekd | /websso simply lets configure horizon to always redirect there, instead of building the dynamic url. | 16:43 |
| marekd | without that horizon would need to be able to list idps and so on. | 16:44 |
| marekd | which would pointless and completely redundant, as login.cern.ch already does the DS | 16:44 |
| marekd | stevemar: ayoung https://wiki.shibboleth.net/confluence/display/SHIB2/DiscoveryService | 16:45 |
| ayoung | cool | 16:45 |
| marekd | ayoung: stevemar does all what i said past 30 minutes make sense to you? | 16:47 |
| dolphm | morganfainberg: fun news- January 19-24 is restaurant week in san antonio. getting hotel rooms might be hard | 16:47 |
| marekd | (it does to me) | 16:47 |
| *** tellesnobrega_ has quit IRC | 16:47 | |
| dolphm | morganfainberg: http://culinariasa.org/san-antonio/restaurant-week/ | 16:48 |
| *** david-lyle has joined #openstack-keystone | 16:49 | |
| *** david-lyle has quit IRC | 16:49 | |
| morganfainberg | dolphm: cool | 16:49 |
| stevemar | marekd, only a bit :) i need to do it myself | 16:50 |
| marekd | it really takes litle code changes in Keystone and django_openstck_auth. | 16:50 |
| marekd | you actually did it, didn't you? | 16:50 |
| * marekd BRB | 16:51 | |
| *** david-lyle_afk is now known as david-lyle | 16:52 | |
| rodrigods | morganfainberg, ping will rebase https://review.openstack.org/#/c/117786/ (and the other 3 follow up patches) against https://review.openstack.org/#/c/138186/ . Considering the changes from the split assignment patch, I *think* will be easier rebase the split against our patches, instead the contrary. Just checking if you are OK with this | 16:53 |
| morganfainberg | Yep | 16:54 |
| morganfainberg | Works for me | 16:54 |
| morganfainberg | Talk with henrynash and work out the detailsplease | 16:54 |
| rodrigods | morganfainberg, thanks! will do | 16:55 |
| henrynash | rodigods: hi | 16:55 |
| rodrigods | henrynash, ^ | 16:55 |
| morganfainberg | ayoung: is nkinder around? Or is he out / busy? | 16:55 |
| ayoung | morganfainberg, mayeb still sick | 16:55 |
| morganfainberg | Crud. | 16:55 |
| rodrigods | henrynash, if you are ok with this, we can help with the split assignment rebase against our stuff | 16:56 |
| henrynash | so just want to make sure I understand…you are proposing to put in all your patches, and then I should rebase mine on your last one? | 16:56 |
| bknudson1 | there was some kind of conference going on last time we were in SA | 16:56 |
| morganfainberg | Ok have backup plan will execute on it. | 16:56 |
| rodrigods | henrynash, yes, if it works for you | 16:56 |
| henrynash | rodigods: Ok, yes, I’m fine with that - HM is more important feature than the assignment split, let’s get it in asap | 16:57 |
| henrynash | then I’ll line up some coffees and go into rebase mode :-) | 16:57 |
| samuelms | henrynash, rodrigods ++ | 16:57 |
| samuelms | (-: | 16:57 |
| henrynash | rodigods: just point me at the last one I should be rebase to | 16:57 |
| samuelms | henrynash, ok we'll rebase them today and will ping you once we've it done | 16:58 |
| rodrigods | henrynash, samuelms ++ | 16:58 |
| *** packet has joined #openstack-keystone | 16:58 | |
| henrynash | samuelms: okeeedokkkeee | 16:58 |
| henrynash | (said in strange british accent) | 16:59 |
| samuelms | henrynash, haha :p | 16:59 |
| *** kobtea has joined #openstack-keystone | 17:00 | |
| *** packet has quit IRC | 17:00 | |
| marekd | review | 17:01 |
| marekd | sorry :( | 17:01 |
| dolphm | morganfainberg: i'll be completely offline monday & tuesday next week | 17:01 |
| dolphm | morganfainberg: internal workshoppy thing | 17:01 |
| *** gyee_ has joined #openstack-keystone | 17:03 | |
| *** packet has joined #openstack-keystone | 17:04 | |
| *** kobtea has quit IRC | 17:05 | |
| marekd | stevemar: speaking about mapping enhancements.In fact it could be a good idea to have two keywords: "group", and "groups". group would be single group with id and groups a list of name-identified groups. | 17:06 |
| *** packet has quit IRC | 17:07 | |
| *** nkinder has joined #openstack-keystone | 17:09 | |
| ayoung | stevemar, OK, you have my permission to hack the pipeline stuff out of the webSSO spec. marekd please feel free to update it as well | 17:11 |
| ayoung | lets make this a unified effort | 17:11 |
| ayoung | https://review.openstack.org/#/c/133529/1/specs/kilo/websso-portal.rst,cm | 17:12 |
| stevemar | ayoung, agreed | 17:12 |
| *** joesavak has joined #openstack-keystone | 17:12 | |
| marekd | ayoung: ++ | 17:12 |
| ayoung | stevemar, so the two changes to DOA are: | 17:12 |
| ayoung | 1. give it a conf url to redirect | 17:13 |
| ayoung | 2. accept a token for login | 17:13 |
| ayoung | the rest is done in the SSO portal | 17:13 |
| *** packet has joined #openstack-keystone | 17:13 | |
| ayoung | I was planning on hosting the portal inside of Keystone, but it sounds like it does not have to be | 17:13 |
| ayoung | It sounds like it should be a stand alone app | 17:14 |
| morganfainberg | dolphm: no big deal. Can skip the release thingie. | 17:14 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 17:15 |
| *** marcoemorais has joined #openstack-keystone | 17:17 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 17:19 |
| morganfainberg | ayoung: I'm moving token provider cleanup to k2. Fyi. | 17:19 |
| ayoung | morganfainberg, sounds good | 17:19 |
| *** lhcheng has joined #openstack-keystone | 17:21 | |
| ayoung | stevemar, lets just make sure you and marekd communicate so you are not overwriting each others changes. Or do you guys want to work through me for this? | 17:22 |
| stevemar | ayoung, marekd i was thinking we could put it on an etherpad first | 17:23 |
| ayoung | stevemar, wouldn' | 17:24 |
| ayoung | t it be nice if we could back etherpad to gerrit | 17:24 |
| ayoung | ? | 17:24 |
| stevemar | one day | 17:24 |
| ayoung | OK...lets do that | 17:24 |
| ayoung | stevemar, I'll create it | 17:24 |
| marekd | ayoung: stevemar ok. | 17:26 |
| ayoung | marekd, stevemar https://etherpad.openstack.org/p/websso-spec | 17:26 |
| marekd | ayoung: thank you. | 17:27 |
| *** chrissha_ has joined #openstack-keystone | 17:27 | |
| ayoung | stevemar, BTW, I started on the step Remove POST /v3/auth/tokens from the remainder of the auth pipeline | 17:28 |
| *** chrisshattuck has quit IRC | 17:28 | |
| ayoung | it turns out that it is not so bad, but I need to make some changes to the federation code since that mounts suburls under /auth | 17:28 |
| ayoung | I'll post what I have WIP | 17:28 |
| ayoung | it also means working with the JSON home code to make sure we still generate the same home data. | 17:29 |
| openstackgerrit | ayoung proposed openstack/keystone: split auth from other services in paste https://review.openstack.org/138452 | 17:30 |
| *** chrisshattuck has joined #openstack-keystone | 17:30 | |
| stevemar | thanks for the etherpad link, will start playing when i'm done lunching | 17:30 |
| ayoung | ++ | 17:31 |
| ayoung | stevemar, see that review I just posted for the pipeline split changes ,too | 17:31 |
| *** chrisshattuck has quit IRC | 17:31 | |
| *** chrisshattuck has joined #openstack-keystone | 17:32 | |
| *** chrissha_ has quit IRC | 17:33 | |
| lhcheng | hi folks, quick question. Can I use the project scoped token to get a domain scoped token? | 17:35 |
| david-lyle | follow on question, if a domain is just a project now, why do I need a special token for a domain? why not just a project scoped token? | 17:36 |
| david-lyle | excuse me, "special project" | 17:36 |
| samuelms | lhcheng, you don't need a token to get another token :p | 17:36 |
| david-lyle | samuelms: not about need, it's about working with what you have | 17:36 |
| samuelms | lhcheng, you just have to get the domain token as you have nothing :) | 17:36 |
| david-lyle | without storing a password | 17:37 |
| gyee_ | there's no restriction on token rescope afaik | 17:37 |
| samuelms | lhcheng, david-lyle yes .. you can call POST /v3/auth/tokens to change authorization scope | 17:38 |
| samuelms | in that case, you pass your previous token | 17:38 |
| samuelms | just read that from the api http://developer.openstack.org/api-ref-identity-v3.html | 17:38 |
| samuelms | gyee_ ++ | 17:38 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: LDAP additional attribute mappings description https://review.openstack.org/118590 | 17:38 |
| gyee_ | we haven't implemented the spatial project yet | 17:38 |
| gyee_ | david-lyle ^^ | 17:39 |
| david-lyle | gyee, when you do, what happens to domain scoped tokens? | 17:39 |
| gyee_ | interchangeable | 17:39 |
| *** ajayaa has quit IRC | 17:39 | |
| gyee_ | I hope :) | 17:39 |
| *** _cjones_ has quit IRC | 17:40 | |
| *** _cjones_ has joined #openstack-keystone | 17:40 | |
| david-lyle | I ask because I'm about to add a ton of convoluted logic to DOA and Horizon to support this second token type, if it's going away, I sure don't want go that way | 17:40 |
| lhcheng | #itjustworks :) | 17:40 |
| gyee_ | its NOT going away | 17:40 |
| samuelms | lhcheng, ++ | 17:40 |
| gyee_ | otherwise, we'll be in the world of shit | 17:41 |
| david-lyle | lhcheng: ™ | 17:41 |
| lhcheng | gyee_ is there already a draft specs out for the spatial project? | 17:41 |
| david-lyle | but if they are interchangeable, why not wait for that and save on logic? | 17:41 |
| david-lyle | and wasted effort and complexity | 17:41 |
| david-lyle | I want the flavor of the month, not the flavor of the week | 17:42 |
| samuelms | lhcheng, s/spatial/special | 17:42 |
| gyee_ | lhcheng, not sure, morganfainberg may know | 17:42 |
| ayoung | david-lyle, working on it | 17:42 |
| *** aix has quit IRC | 17:42 | |
| david-lyle | ayoung: on which? | 17:43 |
| ayoung | it is only an agreement that we are going to make domains into projects...not a done deed | 17:43 |
| gyee_ | ayoung, in the implementation sense | 17:43 |
| ayoung | david-lyle, I would think it would work like this: | 17:43 |
| gyee_ | on the public facing side, it still the same | 17:43 |
| ayoung | certain projects are also domains | 17:43 |
| david-lyle | ayoung: so should I wait and get identity operations on domains for free in kilo? | 17:43 |
| samuelms | ayoung, ++ | 17:44 |
| ayoung | if you get a token scoped to that domain, it should have all the roles | 17:44 |
| samuelms | david-lyle, yes so I think we'll still define the flavor of the month :p | 17:44 |
| ayoung | and you don't need to specify "domain scoped" or "proejct scoped" | 17:44 |
| ayoung | but certain roles would not make sense to have assigned to projects that were not in themselves domains | 17:44 |
| david-lyle | ayoung: that makes sense, but role assignments would be the only difference | 17:45 |
| ayoung | yeah. | 17:45 |
| david-lyle | that's much cleaner | 17:45 |
| gyee_ | its all about the scope :) | 17:45 |
| *** jistr|training has quit IRC | 17:45 | |
| ayoung | david-lyle, I don't think Horizon should have to deal with the distinction...it should be on the object you are requesting, not having to request a special type | 17:45 |
| david-lyle | ayoung: that would be a vast improvement | 17:46 |
| david-lyle | what type of timeframe are we looking at realistically though? | 17:46 |
| david-lyle | K, L, M? | 17:46 |
| ayoung | good question...matter of priorities. | 17:46 |
| david-lyle | I'm trying to figure out mine as well | 17:47 |
| ayoung | david-lyle, I think it needs to work in after the hierarchical multitenacy changes | 17:47 |
| david-lyle | so with HM, in the first pass I would still need two types of tokens? | 17:48 |
| ayoung | yeah | 17:48 |
| morganfainberg | david-lyle, ayoung ++ | 17:48 |
| morganfainberg | david-lyle, the reseller-case-support in HM will be where that change would come in. | 17:48 |
| ayoung | morganfainberg, what if we changed the enforcement in policy. someth8ing like role:admin and project:is_a(domain) | 17:49 |
| morganfainberg | ayoung, we'll need to extend the policy langauge, but sure? | 17:50 |
| ayoung | morganfainberg, or project_id == domain_id | 17:51 |
| morganfainberg | ayoung, that is probably easier. | 17:51 |
| morganfainberg | but... i am going to guess we still need to extend the policy lang | 17:51 |
| morganfainberg | iirc it only know how to match <resource> to <info in context> | 17:51 |
| morganfainberg | not <info in context> == <other info in context> | 17:52 |
| gyee_ | if we are returning both project_id and domain_id, we don't have to change policy lang | 17:52 |
| morganfainberg | or info in context == <some other thing on resource without custom code> | 17:52 |
| gyee_ | iirc | 17:52 |
| *** boris-42 has joined #openstack-keystone | 17:52 | |
| ayoung | morganfainberg, I think it is contex(project_id) = fetch_object(domain_id) | 17:53 |
| ayoung | I think we can do that in the current language | 17:53 |
| david-lyle | you can build up the credentials dict however you want | 17:53 |
| morganfainberg | ayoung, ok. | 17:53 |
| ayoung | david-lyle, it is not the credentials dict in this case...it is... | 17:53 |
| ayoung | well let me show you | 17:53 |
| ayoung | there is code that fetches an object from the backend before policy is run | 17:53 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n118 | 17:54 |
| ayoung | get_member_from_driver | 17:54 |
| ayoung | ref = self.get_member_from_driver(kwargs[key]) and then policy_dict['target'] = {self.member_name: ref} | 17:54 |
| ayoung | so somethinkg like | 17:55 |
| boris-42 | ayoung: hey there | 17:55 |
| boris-42 | ayoung: do you have a minute to discuss functional testing in keystone | 17:55 |
| boris-42 | ayoung: I didn't understand your email, what is the purpose of having separated framework for that?) | 17:55 |
| ayoung | "admin_and_matching_target_project_domain_id": "rule:admin_required and domain_id:%(target.project.domain_id)s", | 17:56 |
| ayoung | would become | 17:56 |
| ayoung | "admin_and_matching_target_project_domain_id": "rule:admin_required and project_id:%(target.project.domain_id)s", | 17:56 |
| boris-42 | ayoung: why not useing tempest-lib or rally or something already existing?) | 17:56 |
| ayoung | boris-42, no different framework, just a way to test our code | 17:56 |
| ayoung | boris-42, I was talking about using keystone as both the client and server | 17:56 |
| gyee_ | ayoung, that code is for fetch object only | 17:57 |
| ayoung | so the client part of keystone would run auth_token middleware etc, and talk to the server version | 17:57 |
| boris-42 | ayoung: so maybe I can try to sell you rally lol for that puprose? | 17:57 |
| ayoung | gyee_, right, but those are the rules david-lyle needs to access | 17:57 |
| ayoung | boris-42, I think you misunderstand | 17:57 |
| gyee_ | ayoung, not for authorization for user management | 17:57 |
| boris-42 | ayoung: I mean I can make a proposal (as a speck) | 17:57 |
| ayoung | rally would still be part of it | 17:57 |
| gyee_ | for domain/project update, yes | 17:57 |
| boris-42 | ayoung: I mean there will be soon one more feature | 17:57 |
| boris-42 | ayoung: that will allow to use 1 devstack installation to test v2/v3 and so on | 17:58 |
| boris-42 | ayoung: with ssl without ssl | 17:58 |
| ayoung | gyee_, so anything that is a domain specific rule would instead match the project_id to the domain id | 17:58 |
| boris-42 | ayoung: or it's different from what you are proposing?) | 17:58 |
| *** krish has joined #openstack-keystone | 17:58 | |
| ayoung | boris-42, different. I'll walk you thorugh it in a moment | 17:58 |
| boris-42 | ayoung: sure | 17:58 |
| *** krish is now known as Guest3516 | 17:59 | |
| gyee_ | ayoung, right, if both domain_id and project_id are in the cred dict, we don't have to change anything | 17:59 |
| *** Guest3516 has quit IRC | 17:59 | |
| boris-42 | ayoung: I am just thinking from side of operators that would like to check their clouds with one red button* =) | 17:59 |
| ayoung | rodrigods, gyee_, I think the big thing we need is to ensure that for HMT the root project that is a domain needs to have an ID that matches the domain id | 17:59 |
| *** krish1979 has joined #openstack-keystone | 17:59 | |
| ayoung | is that in our current implementation? morganfainberg do you know? | 17:59 |
| gyee_ | ayoung, right, the IDs has to be the same | 17:59 |
| gyee_ | or we have ourselves a security problem | 18:00 |
| ayoung | boris-42, we have the Keystone wekly meeting right now | 18:00 |
| ayoung | in #openstack-meeting | 18:00 |
| rodrigods | ayoung, nope | 18:00 |
| rodrigods | only in the reseller one | 18:00 |
| ayoung | rodrigods, lets make that work... | 18:00 |
| *** jamielennox|away is now known as jamielennox | 18:01 | |
| rodrigods | right now we do not mix up the project/domain concepts | 18:01 |
| ayoung | domainid must match projectid, or we are kinda screwed | 18:01 |
| rodrigods | ayoung, we left domain <-> project questions out of the table | 18:01 |
| rodrigods | we are just adding the projects hierarchy / inherited roles do projects | 18:02 |
| ayoung | rodrigods, when we do a create domain, are we creating a project for it, too? | 18:02 |
| *** kobtea has joined #openstack-keystone | 18:02 | |
| rodrigods | ayoung, no | 18:02 |
| rodrigods | AFAIK | 18:02 |
| ayoung | rodrigods, ok, lets figure this out after the weekly meeting | 18:03 |
| rodrigods | ayoung, ++ | 18:03 |
| *** kobtea has quit IRC | 18:06 | |
| *** rwsu has joined #openstack-keystone | 18:07 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Fix the way migration helpers check FK names. https://review.openstack.org/138468 | 18:14 |
| *** saipandi has quit IRC | 18:14 | |
| *** radez is now known as radez_g0n3 | 18:15 | |
| *** marg7175 has joined #openstack-keystone | 18:20 | |
| *** marg7175 has quit IRC | 18:23 | |
| *** marg7175 has joined #openstack-keystone | 18:24 | |
| *** sriram has joined #openstack-keystone | 18:26 | |
| *** tellesnobrega_ has joined #openstack-keystone | 18:26 | |
| *** saipandi has joined #openstack-keystone | 18:27 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 18:27 |
| *** harlowja_away is now known as harlowja_ | 18:31 | |
| *** rwsu has quit IRC | 18:38 | |
| *** jimhoagland has quit IRC | 18:44 | |
| *** amcrn has joined #openstack-keystone | 18:49 | |
| dolphm | morganfainberg: side note, if i can't get the $114/night group rate at valencia (it's $199 otherwise), then i have a recommendation for another nearby hotel that is $107-119 depending on how you book, without a discount | 18:51 |
| morganfainberg | dolphm, ++ | 18:51 |
| morganfainberg | sounds good. | 18:51 |
| *** browne has joined #openstack-keystone | 18:52 | |
| *** saipandi has quit IRC | 18:56 | |
| *** radez_g0n3 is now known as radez | 18:58 | |
| morganfainberg | dolphm, i'm offically going to drop OS X as a supported keystone platform... | 18:58 |
| dolphm | morganfainberg: what's broken this time? | 18:58 |
| morganfainberg | dolphm, i'm not seeing apple play nice going forward and some deep down libs are all ancient/horked/not easy to replace | 18:58 |
| morganfainberg | dolphm, all of LDAP. | 18:59 |
| dolphm | morganfainberg: i've been mostly using debian recently anyway | 18:59 |
| morganfainberg | dolphm, yeah. | 18:59 |
| morganfainberg | dolphm, ubuntu here. | 18:59 |
| *** saipandi has joined #openstack-keystone | 18:59 | |
| dolphm | morganfainberg: but because of battery life required to run tox, not because of compat | 18:59 |
| morganfainberg | dolphm, but basically ldap lib in yosemite isn't compatible with python-ldap 2.4, and replacing that is a nightmare | 19:00 |
| gyee_ | ouch! | 19:00 |
| morganfainberg | dolphm, because like openssl, apple has thier own opendirectory lib | 19:00 |
| morganfainberg | so expect that to wither to be even less usable | 19:00 |
| morganfainberg | i can fix it, but it requires manual changes to setup.cfg each tiem. | 19:01 |
| morganfainberg | for python-ldap | 19:01 |
| morganfainberg | not suitable for tox. | 19:01 |
| morganfainberg | or virtualenv | 19:01 |
| dstanek | morganfainberg: i have never been able to get all of the Keystone unit tests to pass on my Air | 19:01 |
| gyee_ | dstanek, it was working for me before the Yosemite upgrade | 19:02 |
| dolphm | morganfainberg: fair enough. shall i rip out OS X docs? | 19:02 |
| dolphm | morganfainberg: p.s. still unconfirmed but i asked for confirmation to use the same space we used last time, in which case, new hotel is just a block from our last hotel https://goo.gl/maps/Y8Tpn | 19:02 |
| jamielennox | morganfainberg: what are the midcycle dates | 19:02 |
| morganfainberg | dolphm, either you or i. i was about to do that. | 19:02 |
| dolphm | jamielennox: Jan 19-21 | 19:02 |
| morganfainberg | jamielennox, ^^ | 19:02 |
| dstanek | gyee_ i could say the same about wireless and a host of other things :-) | 19:02 |
| dolphm | morganfainberg: i wrote most of them, i'll rip em out :) | 19:03 |
| morganfainberg | dolphm, ok sounds good, i'll plan to +2 it | 19:03 |
| ayoung | morganfainberg, henrynash samuelms rodrigods : Do we want to enforce the rule that, for the root project in a domain, projectid == domainid So to test if a given project is a domain, we do if project.id == project.domain_id? | 19:03 |
| ayoung | If so, then we need to add that logic to create_domain | 19:04 |
| morganfainberg | ayoung, that is an easy work-around to making projects == domains | 19:04 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add support for domain specific roles. https://review.openstack.org/133855 | 19:04 |
| morganfainberg | henrynash, rodrigods, raildo, let me know if you need any help prioritising the order of HMT vs Split patches. but i assume you guys have a handle on it. | 19:05 |
| morganfainberg | that is to say post merge commit passing | 19:05 |
| rodrigods | morganfainberg, I guess yes, will help henrynash to rebase against https://review.openstack.org/#/c/117787/38 | 19:05 |
| henrynash | morgandainberg: I think we’re good….I’ll rebase at the end…I know enough about what HM has done to be able to work out what to do | 19:06 |
| rodrigods | morganfainberg, question: can I send the same patches to master using the same change-id? | 19:06 |
| ayoung | morganfainberg, OK...so two patches. First is for create_domain doing a create project. Second is a migration to add the project entry for all existing domains | 19:06 |
| *** mikedillion has joined #openstack-keystone | 19:07 | |
| ayoung | morganfainberg, does it need a spec? | 19:08 |
| ayoung | or is it a detail under HMT? | 19:08 |
| morganfainberg | rodrigods, sure. | 19:08 |
| morganfainberg | ayoung, this should be part of the HMT reseller case iirc. | 19:08 |
| morganfainberg | ayoung, so that can be part of that spec. | 19:08 |
| rodrigods | morganfainberg, ayoung, ++ | 19:08 |
| morganfainberg | ayoung, (the second HMT spec) not the one we're doing the master merge for now. | 19:08 |
| rodrigods | raildo is writing that spec, you let him know about this specific detail | 19:09 |
| rodrigods | or it can be part from the "hm improvements" | 19:09 |
| rodrigods | spec | 19:09 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Ignore H302 - bug 1398472 https://review.openstack.org/138491 | 19:09 |
| uvirtbot | Launchpad bug 1398472 in hacking "H302 isn't handling oslo_concurrency namespace change" [Undecided,Fix released] https://launchpad.net/bugs/1398472 | 19:09 |
| ayoung | https://review.openstack.org/#/c/135309/ morganfainberg that one? "Hierarchical Multitenancy Improvements" | 19:09 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Ignore H302 - bug 1398472 https://review.openstack.org/138491 | 19:10 |
| morganfainberg | ayoung, thats the one | 19:10 |
| ayoung | rodrigods, htruta raildo I'm going to edit that one, ok? | 19:10 |
| rodrigods | ayoung, np :) | 19:11 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Ignore H302 - bug 1398472 https://review.openstack.org/138491 | 19:11 |
| uvirtbot | Launchpad bug 1398472 in hacking "H302 isn't handling oslo_concurrency namespace change" [Undecided,Fix released] https://launchpad.net/bugs/1398472 | 19:11 |
| rodrigods | ayoung, thank you | 19:11 |
| ayoung | rodrigods, falls under my directive to "make domains work" | 19:11 |
| morganfainberg | lbragstad, ^ there ya go fixed. | 19:11 |
| stevemar | morganfainberg, oh shoot, forgot to bring this up in the meeting... | 19:12 |
| morganfainberg | stevemar, ? | 19:12 |
| stevemar | are we enforcing the need to have API changes along with the spec? | 19:12 |
| dolphm | stevemar: please | 19:12 |
| stevemar | cause theres a lot of specs being proposed, and i thought we were enforcing that API changes should be included | 19:12 |
| morganfainberg | stevemar, i think we generally said: if you can provide them this is *much much much* preferred! if not, you can add them after, but API changing code *cannot* merge until they are in the repo. | 19:13 |
| morganfainberg | stevemar, so, it would be better to have the API changes *in* the spec. | 19:13 |
| morganfainberg | but in some cases it needs to be hashed out independent of the "is this a good idea" phase | 19:13 |
| stevemar | morganfainberg, ok, send out a broadcast or something to make sure folks get the message :) | 19:13 |
| stevemar | of course | 19:13 |
| morganfainberg | stevemar, i'll add a note in the README for specs | 19:14 |
| morganfainberg | and will send something to the ML today/tomorrow | 19:14 |
| dolphm | morganfainberg: WHY DOES tox -e sample_config NOT WORK FOR ME ON DEBIAN NOW AGHH | 19:15 |
| morganfainberg | dolphm, ... i uh | 19:16 |
| morganfainberg | dunno? | 19:16 |
| ayoung | rodrigods, OK, walk me through this. Today, if I create a domain, there is no project at the root of the domain. If I create a project, it shows the domain ID , but it will have no parent_project_id? | 19:16 |
| rodrigods | ayoung, exactly | 19:16 |
| ayoung | rodrigods, OK, here is how I propose changing things | 19:16 |
| ayoung | 1. create_domain will create a project with a matching id | 19:17 |
| ayoung | 2. migration that will create a proejct for all domains with a matching id | 19:17 |
| * dolphm cries | 19:17 | |
| ayoung | 3. migration that will set initialize paretn_project_id | 19:17 |
| *** jsavak has joined #openstack-keystone | 19:18 | |
| ayoung | on step 3, if proejct-id= domain_id, do nothing | 19:18 |
| stevemar | dolphm, nuke your .tox/sample_config and try again? | 19:18 |
| ayoung | if project-id != domain_id, and parent_project_id is none, parent_project_id = domain_id | 19:18 |
| dolphm | stevemar: i just built a new one | 19:18 |
| stevemar | dolphm, then it hates you | 19:18 |
| *** amakarov is now known as amakarov_away | 19:19 | |
| rodrigods | ayoung, sounds good | 19:19 |
| morganfainberg | dolphm, i've never had issues with tox -esample_config | 19:19 |
| morganfainberg | :( | 19:19 |
| morganfainberg | wish i could explain why it doesn't work | 19:20 |
| rodrigods | ayoung, we just need to remember to add a constraint somewhere, that if project_id == domain_id, parent_id *must* be none | 19:20 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: drop developer support for OS X https://review.openstack.org/138496 | 19:21 |
| dolphm | stevemar: but you don't hate me, right? will you regenerate sample conf here and re-review? ^^ | 19:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Bump hacking to be atleast 0.9.4 https://review.openstack.org/138497 | 19:21 |
| stevemar | lol sure | 19:21 |
| *** joesavak has quit IRC | 19:21 | |
| morganfainberg | lbragstad, either my fix or yours, both work for me. | 19:21 |
| lbragstad | morganfainberg: ok | 19:21 |
| lbragstad | I was able to run with hacking 0.9.4 locally and it doesn't break on o-c | 19:22 |
| ayoung | rodrigods, I'm going to remove the policy stuff from that spec, too. | 19:22 |
| ayoung | Instead, lets get that to reference the policy specs we already have | 19:23 |
| ayoung | for example, we cant do: The policy.v3cloudsample.json should become the default policy.json for Keystone: | 19:23 |
| *** stevemar has quit IRC | 19:23 | |
| henrynash | ayoung: that’s already proposed | 19:23 |
| ayoung | rodrigods, ++ | 19:23 |
| *** stevemar has joined #openstack-keystone | 19:24 | |
| *** ChanServ sets mode: +v stevemar | 19:24 | |
| ayoung | henrynash, the data in that file should be the start of it, but it is a bigger discussion | 19:24 |
| ayoung | we need more support than just swapping that file | 19:24 |
| henrynash | ayoung: there’s a series of patches someehere that first fixes up v2cloudsample, and then 2ns makes it the default | 19:24 |
| rodrigods | henrynash, ++ https://review.openstack.org/#/c/123509/ | 19:25 |
| rodrigods | ayoung, ^ | 19:25 |
| stevemar | almost there dolphm | 19:25 |
| ayoung | henrynash, you've seen my thoughts on policy | 19:26 |
| ayoung | rodrigods, if you have not read https://adam.younglogic.com/2014/11/dynamic-policy-in-keystone/ please do so | 19:28 |
| ayoung | lets not work at cross purposes, nor make more work for ourselves | 19:28 |
| ayoung | I think we are all thinking along the same lines | 19:28 |
| rodrigods | ayoung, you are right (I've read your blog post)... It's just some two directions in the team | 19:29 |
| ayoung | I'll leave the policy sections alone for now. | 19:29 |
| ayoung | in the HMT spec | 19:29 |
| ayoung | but we should revise it | 19:29 |
| rodrigods | ok | 19:29 |
| rodrigods | ayoung, but we believe that this improvement is necessary for now (Kilo)... The dynamic policy part, seems a long term effort to us | 19:30 |
| rodrigods | for L, or late K | 19:30 |
| ayoung | rodrigods, unified policy at least should replace the cloudsample, though | 19:31 |
| *** jimhoagland has joined #openstack-keystone | 19:31 | |
| ayoung | rodrigods, we don't need the dynamic roles in order to clean up policy for HMT | 19:31 |
| ayoung | rodrigods, its ok, I think the cloudsample file is the right direction. | 19:32 |
| rodrigods | ayoung, true | 19:32 |
| ayoung | It makes a better basis for a unified policy file than the base policy.json | 19:33 |
| ayoung | so I don't actually hae any problem with the proposal | 19:33 |
| rodrigods | ayoung, great :) | 19:34 |
| *** tellesnobrega_ has quit IRC | 19:34 | |
| dolphm | stevemar: git-review | 19:37 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Pass all adapter parameters through to adapter https://review.openstack.org/138228 | 19:37 |
| bknudson1 | don't you have to fill in the admin_domain_id in the policy.v3cloudsample.json ? so how can it be the default? | 19:38 |
| *** nellysmitt has quit IRC | 19:40 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Pass all adapter parameters through to adapter https://review.openstack.org/138228 | 19:40 |
| dolphm | stevemar: tox -e sample_config && git add etc/keystone.conf.sample && GIT_EDITOR=true git commit --amend && git-review | 19:40 |
| *** afazekas has quit IRC | 19:41 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Bump hacking to be at least 0.9.4 https://review.openstack.org/138497 | 19:42 |
| sriram | hey guys, I have some questions with regards to python keystone middleware. Is this the right place to ask? | 19:43 |
| dolphm | stevemar is letting me down | 19:43 |
| dolphm | sriram: yep! | 19:43 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Hierarchical Multitenancy Improvements https://review.openstack.org/135309 | 19:43 |
| stevemar | dolphm, pypi is letting me down | 19:43 |
| ayoung | rodrigods, ^^ | 19:44 |
| dolphm | stevemar: you just had to nuke your .tox | 19:44 |
| stevemar | i did | 19:44 |
| rodrigods | ayoung, thanks! | 19:44 |
| stevemar | i was playing around with the new oslo.config generator | 19:44 |
| dolphm | someone beat stevemar to the punch! $ git-review -d 138496 && tox -e sample_config && git add etc/keystone.conf.sample && GIT_EDITOR=true git commit --amend && git-review | 19:44 |
| *** amcrn has quit IRC | 19:45 | |
| dolphm | stevemar: i was thinking about fixing brant's bug in it soon | 19:45 |
| dolphm | maybe end of next week | 19:45 |
| dolphm | and then maybe we can have it in keystone | 19:45 |
| dolphm | cause that works, otherwise | 19:45 |
| bknudson1 | dolphm: you mean the ordering of parameters? | 19:45 |
| sriram | cool, I'm just wondering if you guys have ever encountered an issue were keystone middleware intermittently flagged valid tokens. The tokens are cached in memcache. | 19:45 |
| dolphm | bknudson1: yes | 19:46 |
| bknudson1 | dolphm: I think there's a fix proposed by dhellmann | 19:46 |
| dolphm | bknudson1: ooh! | 19:46 |
| sriram | s/were/where | 19:46 |
| bknudson1 | dolphm: https://review.openstack.org/#/c/136482/ | 19:46 |
| *** nellysmitt has joined #openstack-keystone | 19:46 | |
| dolphm | bknudson1: Ben's comment is something i wanted to address too | 19:47 |
| bknudson1 | dolphm: I meant to try it sometime and see what it looks like. | 19:48 |
| dolphm | bknudson1: i'll post a result for you in a minute | 19:51 |
| stevemar | dolphm, there we go, that was weird | 19:52 |
| ayoung | sriram, are you using PKI tokens? Is this happening for every token, or just that randomly tokens are flagged as invalid that should be valid? | 19:52 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: drop developer support for OS X https://review.openstack.org/138496 | 19:52 |
| dolphm | stevemar: there's another random change in there - i assume that's in master? | 19:53 |
| sriram | ayoung: its pretty random, 5-8 requests would go through fine. and then requests will fail with 401s | 19:54 |
| stevemar | it's not in master, but probably someone changed config and didn't update | 19:54 |
| stevemar | let me check with master | 19:54 |
| ayoung | sriram, once a token is invalid, is it ever valid again? | 19:54 |
| *** jsavak has quit IRC | 19:55 | |
| sriram | ayoung: nope. | 19:55 |
| stevemar | dolphm, yeah it's appearing in master too, it's cool | 19:55 |
| ayoung | sriram, PKI or UUID tokens? | 19:55 |
| sriram | pki | 19:55 |
| stevemar | dolphm, a left over bit from oslo.db | 19:56 |
| sriram | and usually flushing memcache makes it go away for some period of time. | 19:56 |
| *** nellysmitt has quit IRC | 19:56 | |
| ayoung | sriram, hmmm. | 19:56 |
| ayoung | sriram, once you have a failure, do tokens start working again with no other changes? | 19:56 |
| sriram | yeah, after few a 401's they do start working again. | 19:57 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: update sample conf using oslo-config-generator https://review.openstack.org/138508 | 19:57 |
| sriram | it could range from a few minutes to few hours. | 19:57 |
| dolphm | bknudson1: https://review.openstack.org/#/c/138508/1/etc/keystone.conf.sample | 19:57 |
| sriram | its tough to repro, it doesnt always happen. | 19:57 |
| ayoung | strange | 19:57 |
| *** joesavak has joined #openstack-keystone | 19:58 | |
| bknudson1 | dolphm: we need to get rid of this option! #sqlite_db = oslo.sqlite | 19:58 |
| bknudson1 | ugh, it was in there before. | 19:59 |
| sriram | ayoung: this is usually what we hit: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token.py#L955 | 19:59 |
| ayoung | sriram, if the auth_token middleware cannot fetch the revocation list from the server it willl 401 | 19:59 |
| ayoung | looking | 19:59 |
| sriram | I dont think it would be a request timeout, thats the other place where it is logged. | 19:59 |
| bknudson1 | maybe we could have a separate entry point for the options so we don't have to pull some in. | 19:59 |
| ayoung | that is not a connection error | 20:00 |
| ayoung | sriram, self._LOG.debug('Token validation failure.', exc_info=True) | 20:00 |
| ayoung | but you don't have debug enabled, do you/ | 20:00 |
| sriram | nope. :| | 20:00 |
| bknudson1 | dolphm: so it looks like now it's just the oslo lib options that have changed order... and the order of the sections made no difference | 20:01 |
| sriram | we are trying to get this going in a different environment to test, with debug turned on. | 20:01 |
| ayoung | sriram, can you edit the file? Change self._LOG.debug to self._LOG.warn | 20:01 |
| *** packet has quit IRC | 20:01 | |
| sriram | ayoung: I can do it to test locally, but not in the environment for now. | 20:02 |
| ayoung | sriram, I see at least one problem with that code right now | 20:03 |
| ayoung | https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token.py#L924 would get caught by its own try/except | 20:03 |
| ayoung | sriram, need more data. Could be a handful of different things. I'd instrument that code differently to deduce where in that hughe try block things are failing | 20:04 |
| sriram | yeah, we need to an environment going to test it. | 20:05 |
| *** radez is now known as radez_g0n3 | 20:07 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 20:13 |
| *** r-daneel has quit IRC | 20:17 | |
| *** r-daneel has joined #openstack-keystone | 20:17 | |
| *** joesavak has quit IRC | 20:18 | |
| *** tellesnobrega_ has joined #openstack-keystone | 20:19 | |
| *** samuelms-away has quit IRC | 20:29 | |
| *** gabriel-bezerra has quit IRC | 20:29 | |
| *** tellesnobrega_ has quit IRC | 20:30 | |
| *** htruta has quit IRC | 20:30 | |
| *** samuelms has quit IRC | 20:30 | |
| *** tellesnobrega has quit IRC | 20:30 | |
| *** raildo has quit IRC | 20:30 | |
| *** gabriel-bezerra has joined #openstack-keystone | 20:42 | |
| *** htruta has joined #openstack-keystone | 20:42 | |
| *** samuelms-away has joined #openstack-keystone | 20:42 | |
| *** raildo has joined #openstack-keystone | 20:42 | |
| *** tellesnobrega has joined #openstack-keystone | 20:42 | |
| *** jogo has joined #openstack-keystone | 20:48 | |
| jogo | morganfainberg: https://review.openstack.org/#/c/92507/ can use another round of keystone core reviewing | 20:48 |
| morganfainberg | Jogo. On my radar post x-project meeting. | 20:52 |
| jogo | morganfainberg: excellent | 20:55 |
| *** krish1979 has quit IRC | 20:58 | |
| *** jimhoagland has quit IRC | 20:58 | |
| *** joesavak has joined #openstack-keystone | 20:58 | |
| *** marcoemorais has quit IRC | 21:03 | |
| stevemar | dolphm, ha, i also had a patch for this | 21:05 |
| stevemar | https://review.openstack.org/#/c/128440/ | 21:05 |
| *** radez_g0n3 is now known as radez | 21:12 | |
| *** henrynash has quit IRC | 21:15 | |
| *** henrynash has joined #openstack-keystone | 21:15 | |
| *** ChanServ sets mode: +v henrynash | 21:15 | |
| *** topol has quit IRC | 21:25 | |
| *** nellysmitt has joined #openstack-keystone | 21:29 | |
| *** nellysmitt has quit IRC | 21:30 | |
| *** stevemar2 has joined #openstack-keystone | 21:30 | |
| *** ChanServ sets mode: +v stevemar2 | 21:30 | |
| *** stevemar has quit IRC | 21:31 | |
| *** mikedillion has quit IRC | 21:32 | |
| stevemar2 | ayoung, can you help me expand on `proposed changes` here: https://etherpad.openstack.org/p/websso-spec | 21:33 |
| *** openstackgerrit has quit IRC | 21:34 | |
| *** openstackgerrit has joined #openstack-keystone | 21:34 | |
| *** henrynash has quit IRC | 21:36 | |
| *** henrynash has joined #openstack-keystone | 21:37 | |
| *** ChanServ sets mode: +v henrynash | 21:37 | |
| *** andreaf has quit IRC | 21:37 | |
| morganfainberg | stevemar2, shady man shady | 21:37 |
| *** andreaf has joined #openstack-keystone | 21:38 | |
| morganfainberg | jogo, i lied, i need to run an errand post meeting [time sensitive] but when i'm back... it's on the radar.. then $HP Things To Do$ | 21:38 |
| *** stevemar2 is now known as stevemar | 21:38 | |
| stevemar | morganfainberg, better? :) | 21:38 |
| ayoung | stevemar, depends on whether the discovery service is inside Keystone or not | 21:39 |
| *** stevemar2 has joined #openstack-keystone | 21:39 | |
| stevemar2 | stevemar: yes, cause now.... | 21:39 |
| *** kobtea has joined #openstack-keystone | 21:39 | |
| ayoung | stevemar, let's write the spec as if the changes are inside Keystone, and, if they end up being a separate service, we'll work on splitting them out | 21:39 |
| ayoung | stevemar2, depends on whether the discovery service is inside Keystone or not | 21:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add parent_id field to projects https://review.openstack.org/138548 | 21:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Base methods to handle hierarchical projects https://review.openstack.org/138549 | 21:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/138550 | 21:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Adds correct checks in LDAP backend tests https://review.openstack.org/138551 | 21:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Inherited role assignments to projects https://review.openstack.org/138552 | 21:40 |
| ayoung | stevemar2, let's write the spec as if the changes are inside Keystone, and, if they end up being a separate service, we'll work on splitting them out | 21:40 |
| stevemar2 | >.> | 21:40 |
| stevemar2 | <.< | 21:40 |
| rodrigods | morganfainberg, henrynash ^ | 21:40 |
| *** andreaf has quit IRC | 21:41 | |
| *** andreaf has joined #openstack-keystone | 21:41 | |
| stevemar | ayoung, that was morganfainberg playing all sorts of tricks | 21:41 |
| morganfainberg | stevemar, lies >.> | 21:42 |
| morganfainberg | <.< | 21:42 |
| stevemar2 | and deciet | 21:42 |
| *** ayoung is now known as moregainfainburp | 21:42 | |
| *** stevemar2 has quit IRC | 21:42 | |
| moregainfainburp | no I wasn't | 21:42 |
| *** moregainfainburp is now known as ayoung | 21:42 | |
| stevemar | ayoung, i ripped out a bunch from https://etherpad.openstack.org/p/websso-spec hope that's OK | 21:42 |
| ayoung | stevemar, well, I still have it in the reviewrequest, so nothing ever disappears | 21:43 |
| ayoung | stevemar, the question is what to do about the websso landing page | 21:43 |
| ayoung | I mean...it does look like we could do all that in Horizon | 21:43 |
| ayoung | except for the redirects to Keystone itself | 21:44 |
| stevemar | right, marekd was saying that it should just be a change in the vhost file to direct the user to a discoery service | 21:44 |
| *** kobtea has quit IRC | 21:44 | |
| ayoung | the discovery service could be in Horizon, Keystone, or a standalone page. It could probably be static | 21:44 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Inherited role assignments to projects https://review.openstack.org/138552 | 21:45 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/138550 | 21:45 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Adds correct checks in LDAP backend tests https://review.openstack.org/138551 | 21:45 |
| ayoung | but, since Keystone itself needs to be exposed in this case, lets plan on putting it in Keystone for simplicity | 21:45 |
| ayoung | we can split it out when/if we need | 21:45 |
| stevemar | makes sense | 21:46 |
| ayoung | at least here we'll avoid the overhead of cross project work etc | 21:46 |
| stevemar | right | 21:46 |
| ayoung | ok...I'm headed over to etherpadland | 21:46 |
| stevemar | so DOA needs an update to allow a user to select 'log me in via federation' (which goes to a log in page), so that's at least 2 work items for DOA | 21:46 |
| stevemar | ayoung, 1) a new setting, and 2) a new button | 21:47 |
| rodrigods | henrynash, so we need to rebase the assignment split with this patch https://review.openstack.org/#/c/138552/ | 21:47 |
| henrynash | rodigods: Ok, I’ll do that tonight | 21:48 |
| *** marg7175 has quit IRC | 21:49 | |
| rodrigods | morganfainberg, so I guess we can eliminate the feature branch :) | 21:50 |
| morganfainberg | if that merge commit merged to master, yes | 21:50 |
| morganfainberg | but not till then. | 21:50 |
| ayoung | stevemar, yep | 21:50 |
| ayoung | stevemar, you missed the big one | 21:51 |
| ayoung | DOA needs to not only accept a token for login, but validate it | 21:51 |
| ayoung | DOA becomes more like auth_token middleware | 21:51 |
| ayoung | and consumes more of Keystone client | 21:51 |
| stevemar | ah right | 21:51 |
| rodrigods | morganfainberg, hmm right | 21:51 |
| *** ayoung has left #openstack-keystone | 21:52 | |
| stevemar | ayoung, so totally agree that DOA needs to authN with a token now, which should be OK | 21:52 |
| stevemar | he just left :( | 21:52 |
| stevemar | what did i do? | 21:52 |
| *** ayoung has joined #openstack-keystone | 21:52 | |
| *** ChanServ sets mode: +v ayoung | 21:52 | |
| *** joesavak has quit IRC | 21:52 | |
| stevemar | ayoung, so I was under the impression that the 'discovery page' was created by the IdP? | 21:53 |
| ayoung | stevemar, use IRC for discussions, and etherpad to capture | 21:53 |
| *** rharwood has joined #openstack-keystone | 21:53 | |
| ayoung | stevemar, not really | 21:53 |
| ayoung | stevemar, assume there are multiple IdPs | 21:53 |
| *** mikedillion has joined #openstack-keystone | 21:53 | |
| *** marg7175 has joined #openstack-keystone | 21:53 | |
| ayoung | the discovery page is an organizational thing | 21:54 |
| ayoung | but the organization is the service providers org, | 21:54 |
| ayoung | where service is provided to users from many IdPs | 21:54 |
| stevemar | hmm OK | 21:55 |
| stevemar | ayoung, so keystone would have to create a discovery page? | 21:56 |
| ayoung | stevemar, I think so | 21:57 |
| ayoung | that can actually live anywhere, but Keystone does need that final response page | 21:57 |
| ayoung | which means it is simpler if everything is in Keystone | 21:57 |
| stevemar | i didn't think that's what marekd was getting at | 21:57 |
| ayoung | stevemar, so I am thinking we do this in OS-WEBSSO | 21:57 |
| stevemar | so walk me through the flow | 21:58 |
| ayoung | The WebUI does not *need* to live in Keystone | 21:58 |
| stevemar | oh | 21:58 |
| stevemar | where does it live? | 21:58 |
| ayoung | 1. go to horizon. No token or session, so get rediect to discovery page | 21:58 |
| morganfainberg | i would prefer it doesn't live in keystone... unless we have no alternative. | 21:58 |
| ayoung | morganfainberg, we put an implementation in Keystone. | 21:58 |
| ayoung | morganfainberg, live deploy does not need to use it | 21:58 |
| ayoung | morganfainberg, Keystone needs to be on the public web no matter wyhat | 21:58 |
| ayoung | what | 21:58 |
| ayoung | but we can put both in their own suburl to protect them differently | 21:59 |
| ayoung | OK, so from discovery page...lets assume saml....redirect to the appropriate saml provider (based on selection of combo box) | 21:59 |
| ayoung | with the return URL being the Keystone URL that creates a token from SAML and posts that token to Horizon | 22:00 |
| ayoung | morganfainberg, I think I'm going to propose that we put all of this stuff under /v3/websso | 22:00 |
| ayoung | that way, it is an apache config whether it gets exposed to the outside world or not | 22:01 |
| *** andreaf has quit IRC | 22:01 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Multifactor Authentication https://review.openstack.org/130376 | 22:02 |
| ayoung | https://github.com/cernops/keystone/commit/66dabd94b4ad32abca171cef9192210fec289235 | 22:02 |
| ayoung | cern is using ADFS. We'll provide a limited equivalent | 22:03 |
| *** joesavak has joined #openstack-keystone | 22:04 | |
| stevemar | ayoung, keep dumping as much info as you can into the etherpad, something isn't clicking for me | 22:05 |
| ayoung | stevemar, ok, start with what cern has | 22:06 |
| *** jimhoagland has joined #openstack-keystone | 22:07 | |
| stevemar | i'm still hung up on the discovery page, it sounds like we need to generate a whole bunch of HTML now, and create a page that can authN with different mechanisms | 22:07 |
| ayoung | lets assume that we are going to provide a baseline implementation of the discovery page | 22:07 |
| ayoung | That is going to be fairly static | 22:07 |
| ayoung | what needs to be dynamic is the list of Idps | 22:07 |
| bknudson1 | if they run in apache they can just write up their own html. | 22:08 |
| ayoung | There is nothing that says a live deployment can't use their own discovery page, or that the discovery part of Keystone that we write can't be separately deployed | 22:08 |
| ayoung | bknudson1, exactly | 22:08 |
| ayoung | what keystone needs to provide is something that lets you login via each of those mechanisms, creates a token, and then generates the appropraite javascript to post that token back to Horizon | 22:09 |
| ayoung | stevemar, look for render_html_response in https://github.com/cernops/keystone/commit/66dabd94b4ad32abca171cef9192210fec289235 | 22:10 |
| stevemar | ayoung, yep, i'm familiar with that | 22:11 |
| ayoung | stevemar, I think they have different patches for dealing with baisc auth and kerberos | 22:11 |
| ayoung | https://github.com/cernops/keystone/commit/8ea8b8d9ca2b30385d52505018cb33a284839827 maybe | 22:12 |
| ayoung | nah | 22:12 |
| ayoung | stevemar, I think that all of their options on https://login.cern.ch/ go to adfs, and are then treated like SAML | 22:13 |
| stevemar | ayoung, naw, they have google+ and facebook log ins | 22:15 |
| ayoung | stevemar, OK...I think we can split the work like this | 22:15 |
| ayoung | stevemar I think we basically need that patch | 22:16 |
| ayoung | that won't give us the iscovery service, but it will make Keystone able to handle the discovery service | 22:16 |
| ayoung | then, we could possibly use K2K and treat keystioen Identity just like any other SAML provider | 22:16 |
| joesavak | (yay) | 22:17 |
| ayoung | joesavak, have you sen the cern discovery page? | 22:17 |
| joesavak | yups | 22:18 |
| ayoung | joesavak, it would be something more like: go to keystone with userid/password via a webUI, and get a SAML assertion, which goes over to another Keystone server to get a token....everything goes via federation on the second keystone server | 22:19 |
| joesavak | saw it in paris - adfs federate to keystone demo | 22:19 |
| joesavak | (yay) | 22:19 |
| ayoung | right...so we turn the identity portion of Keystone into an ADFS clone | 22:19 |
| ayoung | and by We I mean someone | 22:19 |
| ayoung | I'm more concerned with the other side...the side that issues tokens | 22:19 |
| ayoung | that is only going to accept SAML (or other federated Identity) as it is on the public web....I think? | 22:20 |
| joesavak | yes - it could be on public web, or a shared network with the issuer | 22:22 |
| joesavak | or client rather | 22:22 |
| ayoung | joesavak, so I'm inclined to put all of the visible web stuff under one suburl, like /v3/websso | 22:23 |
| *** mikedillion has quit IRC | 22:23 | |
| joesavak | ok | 22:24 |
| stevemar | i think any web page we make is going to look like crud compared to anything else | 22:25 |
| ayoung | joesavak actually, two suburls...one for the discovery service, one for the redirect. | 22:25 |
| ayoung | stevemar, we put in a configurabnle field which is the CSS | 22:25 |
| ayoung | let people upload their own and keep the HTML dead simple | 22:25 |
| ayoung | it is not up to us to determine how it looks. But this is also just the default discovery service for people that have Identity in Keystone already | 22:26 |
| stevemar | ayoung, i'm pretty sure morganfainberg is going to have our heads on a pike if do any html/css | 22:26 |
| ayoung | stevemar, we can't avoid it, but we can minimize it | 22:27 |
| ayoung | its pretty minimal | 22:27 |
| stevemar | so the username/password flow (that's for service users) ? | 22:27 |
| morganfainberg | I'll need to read the backlog later. | 22:27 |
| stevemar | not sure why i used brackets | 22:28 |
| ayoung | stevemar, we'll keep it in a separate commit, and if we decide that we need to put it in a separate service, we can always pay the price to do that later | 22:28 |
| ayoung | stevemar, not just service users. | 22:28 |
| ayoung | stevemar, userid/password is for people in sql identiyt | 22:28 |
| stevemar | right, like horizon has today | 22:28 |
| ayoung | yes | 22:28 |
| stevemar | i dont think that should be in the discovery service | 22:28 |
| ayoung | stevemar, it starts off in Keystone. We move it if we need to | 22:29 |
| ayoung | its in its own suburl and is completely isolatable | 22:29 |
| ayoung | lets say we do it in /v3/discovery | 22:29 |
| ayoung | and then the javascript piece goes int /v3/websso | 22:30 |
| ayoung | stevemar, don't focus too much on where the discovery service lives. Its a default. For people with ADFS, or something comparable, they won't use it anyway. | 22:31 |
| ayoung | It could easily live inside Horizon, too. | 22:32 |
| stevemar | alright, this will take a few more iterations to get right | 22:34 |
| stevemar | lets let marek weigh in | 22:34 |
| ayoung | stevemar, its not really in the discovery service. A webUI that converst userid/password to SAML based on K2K would actually live in Keystone. There would be no visible web there, but the web server would process the request and handle redirects | 22:34 |
| *** marg7175 has quit IRC | 22:34 | |
| *** marg7175 has joined #openstack-keystone | 22:34 | |
| ayoung | this is what cern is doing already | 22:34 |
| ayoung | their discovery service is in adfs | 22:34 |
| stevemar | i'm all for getting this done, i need this done or topol will crush me, but i don't want to let my need for it cloud my judgement | 22:34 |
| stevemar | thats true | 22:35 |
| stevemar | i was wondering about that flow | 22:35 |
| ayoung | stevemar, so focus on getting their patch integrated | 22:35 |
| stevemar | and keystone doesn't have a login page for k2k | 22:35 |
| ayoung | stevemar, take this patch but make it work in its own suburl: https://github.com/cernops/keystone/commit/66dabd94b4ad32abca171cef9192210fec289235 | 22:35 |
| ayoung | make a websso module under contrib or next to identity. | 22:36 |
| ayoung | It could even live in the federated module, but I suspect it belongs in its own | 22:36 |
| * stevemar shrugs | 22:36 | |
| stevemar | i'm gonna get to cookin dinner | 22:36 |
| stevemar | that doesn't confused me as much as discovery services | 22:37 |
| ayoung | stevemar, I'm gonna head home myself. | 22:37 |
| stevemar | have fun | 22:37 |
| ayoung | stevemar, I'll try hacking on the discovery service | 22:37 |
| *** boris-42 has quit IRC | 22:37 | |
| ayoung | I'll do it as an extension, and we can treat it as "for testing only" | 22:38 |
| *** ayoung is now known as buhbye | 22:39 | |
| *** buhbye has quit IRC | 22:39 | |
| *** sriram has quit IRC | 22:40 | |
| *** marg7175 has quit IRC | 22:46 | |
| *** marg7175 has joined #openstack-keystone | 22:47 | |
| *** tellesnobrega_ has joined #openstack-keystone | 22:47 | |
| *** raildo_ has joined #openstack-keystone | 22:50 | |
| *** marcoemorais has joined #openstack-keystone | 22:55 | |
| *** tellesnobrega_ has quit IRC | 22:57 | |
| *** jorge_munoz has quit IRC | 22:57 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add support for domain specific roles. https://review.openstack.org/133855 | 22:57 |
| *** Dafna has quit IRC | 22:58 | |
| *** marcoemorais1 has joined #openstack-keystone | 22:58 | |
| *** diegows has quit IRC | 22:58 | |
| *** Dafna has joined #openstack-keystone | 22:59 | |
| rodrigods | henrynash, ping re: your comments here https://review.openstack.org/#/c/138550/2/keystone/assignment/core.py | 22:59 |
| henrynash | rodigdods: hu | 22:59 |
| henrynash | hi, even | 22:59 |
| rodrigods | henrynash, remember the subtree visibility discussion? | 22:59 |
| henrynash | rodigods: sure…so where is teh code taht actually does this check? | 23:00 |
| *** marcoemorais has quit IRC | 23:00 | |
| *** htruta has quit IRC | 23:00 | |
| *** tellesnobrega_ has joined #openstack-keystone | 23:01 | |
| rodrigods | henrynash, same file, in the list_projects_in_subtree() implementations | 23:01 |
| henrynash | rodigods: no, I mean, this chaneg is passing something new to thr driver…where’s teh drive code that users it? | 23:03 |
| *** marcoemorais1 has quit IRC | 23:03 | |
| rodrigods | henrynash, hmm... so if the driver doesn't use it, we don't need the user_id parameter, right? | 23:03 |
| rodrigods | just in the manager layer? | 23:04 |
| henrynash | does the driver have that method at all? | 23:04 |
| rodrigods | henrynash, it does | 23:04 |
| rodrigods | henrynash, previous patch | 23:04 |
| rodrigods | henrynash, https://review.openstack.org/#/c/117785/30/keystone/assignment/backends/sql.py | 23:05 |
| henrynash | rodigods: ah, right - so yes, you don;t need to add the paramter to the abstract method..since we are not passing the user_id to the driver | 23:05 |
| rodrigods | henrynash, great! | 23:05 |
| rodrigods | thanks for the reviews, will address your comments asap | 23:06 |
| *** marcoemorais has joined #openstack-keystone | 23:06 | |
| henrynash | rodigods: np | 23:06 |
| *** harlowja_ is now known as harlowja_away | 23:07 | |
| *** browne has quit IRC | 23:10 | |
| *** zzzeek has quit IRC | 23:10 | |
| *** htruta has joined #openstack-keystone | 23:12 | |
| *** harlowja_away is now known as harlowja_ | 23:12 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Fix the way migration helpers check FK names. https://review.openstack.org/138468 | 23:13 |
| *** joesavak has quit IRC | 23:15 | |
| raildo_ | henrynash, can you answer me, two questions about domain role and HMT? | 23:15 |
| henrynash | raildo_: maybe :-) | 23:15 |
| raildo_ | if I create a role in a sub-domain, can I grant this role to a user created in a parent domain? | 23:16 |
| henrynash | raildo_: no | 23:16 |
| raildo_ | ok | 23:16 |
| henrynash | raildo_: ah sorry…grant it on which domain? | 23:16 |
| raildo_ | if I create a user in a sub-domain, can i grant a role to a parent domain, or a other domain in other hierarchy? | 23:16 |
| raildo_ | imagine that i have a parent domain A - and a subdomain B... and I create a domain role "role_in_subdomain_b" in subdomain B. If i created a user in the domain A, can I grant a role assignment using this role_in_subdomain_b? | 23:19 |
| henrynash | raildo_: so assuming that HM allows users to be inherited down the tree, then yes | 23:20 |
| henrynash | raildo_: you can grant it do something in subdomain B | 23:21 |
| henrynash | raildo_: but you could not grant it to domain A | 23:22 |
| raildo_ | henrynash, Ok, that's what I thought. | 23:22 |
| morganfainberg | bah missed ayoung | 23:23 |
| *** gordc has quit IRC | 23:23 | |
| raildo_ | henrynash, and the second question? :P | 23:23 |
| *** zzzeek has joined #openstack-keystone | 23:23 | |
| henrynash | drum role | 23:24 |
| henrynash | can a user be granted a role on a parent domain…I don’t think so | 23:25 |
| *** kobtea has joined #openstack-keystone | 23:28 | |
| *** henrynash has quit IRC | 23:29 | |
| raildo_ | henrynash, ok. thanks! | 23:29 |
| *** nellysmitt has joined #openstack-keystone | 23:31 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Extract the Loadable interface from a plugin https://review.openstack.org/138575 | 23:32 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Make session use the Loadable interface https://review.openstack.org/138576 | 23:32 |
| *** kobtea has quit IRC | 23:33 | |
| morganfainberg | lbragstad, i'm pushing the ignore patch through since yours is still checking | 23:34 |
| morganfainberg | lbragstad, for hacking check | 23:34 |
| morganfainberg | lbragstad, once we get new hacking we can revert the tox.ini change | 23:34 |
| *** radez is now known as radez_g0n3 | 23:35 | |
| *** nellysmitt has quit IRC | 23:36 | |
| marekd | stevemar: looking at your and ayoung's convo about discovery service. PLease reflect the proposals in the etherpad, and I will try to write down all the available possibilities i can see, but by having DS I am fearing we kind of implement another part into Keystone, hence, trying to make it legitimate Service Provider, Identity Provider and so on. | 23:38 |
| marekd | stevemar: that would be great, but it's extremely easy to completely screw it up. | 23:39 |
| morganfainberg | marekd, tomorrow/thursday i want to chat w/ you about the ECP wrap crypto stuff, make sure i understadn what is going on there. | 23:39 |
| marekd | morganfainberg: sure. | 23:39 |
| morganfainberg | marekd, if you have time. | 23:39 |
| morganfainberg | marekd, cool will ping you then. | 23:39 |
| stevemar | marekd, yeah, thats what i'm worried about, i don't want to do that either | 23:39 |
| marekd | morganfainberg: of course i do. | 23:40 |
| * morganfainberg is *very* concerned about any HTML/css in keystone | 23:40 | |
| stevemar | marekd, i don't know enough about discovery service to make any helpful comments | 23:40 |
| morganfainberg | i understand it might be needed, but... *very* concerned. | 23:40 |
| marekd | morganfainberg: ecp does not have anything with html/css | 23:40 |
| morganfainberg | marekd, no was re other convo with stevemar and ayoung | 23:40 |
| morganfainberg | marekd, sorry crossed the streams. | 23:40 |
| marekd | stevemar: i confess i know it exists, but it's pretty standard thing in a classic websso. | 23:42 |
| marekd | stevemar: anyway, if you want to have it checked, just try to configure your POC and make it work with more than one IdP. | 23:42 |
| stevemar | marekd, yeah, i don't think it will unless I have the list of idps become public | 23:43 |
| marekd | if you really want to make it that way, you will then need to configure separate Locations for every IdP (in your vhost config) | 23:45 |
| marekd | and build dynamic urls | 23:45 |
| marekd | this is also possible, i admit, but for instance for our use-case that would be completely useless :-) | 23:46 |
| stevemar | yep | 23:46 |
| stevemar | because you have 100s | 23:46 |
| marekd | yes, and we have ADFS that does this job for us for free. | 23:46 |
| marekd | https://review.openstack.org/#/c/138035/ <--- can anybody please take a look at it? It already has one +2. | 23:48 |
| stevemar | looking | 23:49 |
| stevemar | i already +2'ed it! | 23:49 |
| *** chrisshattuck has quit IRC | 23:49 | |
| stevemar | marekd, so i think something like tivoli FIM has a discovery service | 23:49 |
| stevemar | but i'm wondering about connect to something like google? | 23:50 |
| marekd | stevemar: google only? | 23:50 |
| stevemar | yeah | 23:50 |
| stevemar | thats the only idp | 23:50 |
| marekd | stevemar: so you don't need DS - it's only one default idp available | 23:51 |
| marekd | there is no choice | 23:51 |
| marekd | Google or nothinf. | 23:51 |
| stevemar | so how does websso work? | 23:51 |
| marekd | look, DS i basically a bridge, that allows you to choose from list of IdPs you somehow trust. | 23:52 |
| marekd | if there is no such choice, perhaps because you only have one default IdP you simply don't configure DS. | 23:52 |
| marekd | ok, i think we can even implement two ways. | 23:53 |
| marekd | it's really not that big deal. | 23:54 |
| marekd | ok, need to go to bed. see you soon. | 23:57 |
| marekd | jamielennox: dstanek: stevemar: https://review.openstack.org/#/c/130593/ - this one should be interesting as well (sadly, no +2s yet) | 23:58 |
| *** marekd is now known as marekd|away | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!