| *** gyee has quit IRC | 00:05 | |
| openstackgerrit | Merged openstack/python-keystoneclient: duplicate auth-url option returned by BaseGenericPlugin https://review.openstack.org/132652 | 00:07 |
|---|---|---|
| openstackgerrit | Merged openstack/python-keystoneclient: Add missing user-id option to generic.Password https://review.openstack.org/132626 | 00:08 |
| openstackgerrit | Merged openstack/keystonemiddleware: Use newer requests-mock syntax https://review.openstack.org/135468 | 00:16 |
| *** shakamunyi has quit IRC | 00:18 | |
| *** raildo_ has quit IRC | 00:28 | |
| *** avozza is now known as zz_avozza | 00:28 | |
| *** oomichi has joined #openstack-keystone | 00:32 | |
| *** dims has quit IRC | 00:54 | |
| *** nkinder has quit IRC | 01:04 | |
| *** _cjones_ has quit IRC | 01:10 | |
| *** dims has joined #openstack-keystone | 01:12 | |
| *** ayoung_dad_mode has quit IRC | 01:14 | |
| *** dims has quit IRC | 01:16 | |
| *** yasu_ has joined #openstack-keystone | 01:23 | |
| *** lhcheng has quit IRC | 01:32 | |
| *** r-daneel has quit IRC | 01:33 | |
| *** marcoemorais has quit IRC | 01:35 | |
| *** Tahmina has quit IRC | 01:38 | |
| *** marcoemorais has joined #openstack-keystone | 01:39 | |
| *** shakamunyi has joined #openstack-keystone | 01:43 | |
| *** ayoung has joined #openstack-keystone | 01:45 | |
| *** ChanServ sets mode: +v ayoung | 01:45 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add get_headers interface to authentication plugins https://review.openstack.org/140894 | 01:45 |
| *** marcoemorais has quit IRC | 01:46 | |
| *** afaranha__ has quit IRC | 01:48 | |
| *** r-daneel has joined #openstack-keystone | 01:49 | |
| jamielennox | bknudson or anyone: if you have any ideas on how to better handle ^ i'd be keen to hear them | 01:56 |
| *** Mario_ has quit IRC | 01:56 | |
| bknudson | jamielennox: what? | 01:56 |
| jamielennox | that review replaces get_token in auth plugins with get_headers | 01:56 |
| jamielennox | so that we can return things other than X-Auth-Token | 01:56 |
| bknudson | auth might not just be headers | 01:57 |
| bknudson | e.g., for SSL auth | 01:57 |
| jamielennox | bknudson: right, so the blueprint i tagged in that says we also need get_connect_params | 01:57 |
| bknudson | but being able to update any header makes sense. | 01:57 |
| bknudson | then you could do basic auth | 01:57 |
| jamielennox | exactly | 01:58 |
| jamielennox | i just feel like there might be a better way to do this, but i'm not sure what it is | 01:59 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add tests for enabled attribute ignored https://review.openstack.org/140895 | 01:59 |
| *** tellesnobrega_ has joined #openstack-keystone | 01:59 | |
| bknudson | test_backend_ldap is a mess. | 02:00 |
| jamielennox | all the ldap code is a mess | 02:00 |
| *** stevemar has joined #openstack-keystone | 02:05 | |
| *** ChanServ sets mode: +v stevemar | 02:05 | |
| *** diegows has quit IRC | 02:08 | |
| *** erkules_ has joined #openstack-keystone | 02:12 | |
| *** erkules has quit IRC | 02:15 | |
| *** tellesnobrega_ has quit IRC | 02:17 | |
| *** samuelms_ has joined #openstack-keystone | 02:23 | |
| ayoung | lbragstad, do you have your gist / paste around with your sample code for AE? I want to try throwing PKI at it and seeing the size differences | 02:28 |
| *** david-lyle is now known as david-lyle_afk | 02:30 | |
| ayoung | ldap sucks | 02:35 |
| *** radez is now known as radez_g0n3 | 02:46 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:58 | |
| *** shakamunyi has quit IRC | 03:12 | |
| *** zzzeek has quit IRC | 03:20 | |
| *** thedodd has joined #openstack-keystone | 03:21 | |
| *** tellesnobrega_ has quit IRC | 03:49 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Fix passing parameters to log message https://review.openstack.org/140871 | 04:05 |
| *** thedodd has quit IRC | 04:06 | |
| *** richm has quit IRC | 04:13 | |
| *** dims has joined #openstack-keystone | 04:23 | |
| *** zzzeek has joined #openstack-keystone | 04:32 | |
| *** zzzeek has quit IRC | 04:33 | |
| *** dims_ has joined #openstack-keystone | 04:37 | |
| *** nkinder has joined #openstack-keystone | 04:40 | |
| *** dims has quit IRC | 04:40 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Update requests-mock syntax https://review.openstack.org/131380 | 04:41 |
| *** junhongl_ has joined #openstack-keystone | 04:47 | |
| *** junhongl_ has quit IRC | 04:48 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add get_headers interface to authentication plugins https://review.openstack.org/140894 | 04:49 |
| *** zzzeek has joined #openstack-keystone | 05:02 | |
| *** samuelms__ has joined #openstack-keystone | 05:07 | |
| *** samuelms_ has quit IRC | 05:08 | |
| *** dims has joined #openstack-keystone | 05:34 | |
| *** harlowja is now known as harlowja_away | 05:36 | |
| *** dims__ has joined #openstack-keystone | 05:37 | |
| *** dims_ has quit IRC | 05:38 | |
| *** dims has quit IRC | 05:40 | |
| *** andreaf has quit IRC | 05:48 | |
| *** andreaf has joined #openstack-keystone | 05:48 | |
| *** lhcheng has joined #openstack-keystone | 05:51 | |
| *** rushiagr_away is now known as rushiagr | 06:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:06 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor the code to join multiple criteria together https://review.openstack.org/133135 | 06:12 |
| *** chrisshattuck has joined #openstack-keystone | 06:20 | |
| *** samuelms__ has quit IRC | 06:23 | |
| *** zzzeek has quit IRC | 06:26 | |
| *** Shohei has quit IRC | 06:31 | |
| *** ajayaa has joined #openstack-keystone | 06:33 | |
| *** Shohei_ has joined #openstack-keystone | 06:34 | |
| *** _cjones_ has joined #openstack-keystone | 06:38 | |
| *** _cjones_ has quit IRC | 06:43 | |
| *** zz_avozza is now known as avozza | 06:43 | |
| marekd | stevemar: still here? | 06:56 |
| stevemar | marekd, yep! | 06:56 |
| marekd | stevemar: thanks for the https://review.openstack.org/#/c/139013 review | 06:57 |
| stevemar | np! | 06:57 |
| marekd | well, its not meant to be wip any more. docs were just failing | 06:57 |
| stevemar | :) | 06:57 |
| marekd | maybe i should indicate that it partially implements a bp. | 06:57 |
| stevemar | i meant it's not taking black/white list into account | 06:57 |
| marekd | ah yes | 06:57 |
| marekd | cause i want it to be separate (maybe depending) patches. | 06:57 |
| marekd | https://review.openstack.org/#/c/139013/8/keystone/auth/plugins/mapped.py do you really think group names should be transformed into ids somewhere in the utils.py ? | 06:58 |
| marekd | i can change it there. | 06:58 |
| *** dims__ has quit IRC | 07:00 | |
| stevemar | marekd, unless there is a reason why it shouldn't be | 07:02 |
| *** andreaf has quit IRC | 07:04 | |
| marekd | there is no. | 07:04 |
| marekd | stevemar: hm, if i try to map name/domain into group_id and there is no such group i will not be able to raise MappingGroupNotFound as I don't know what mapping id was used | 07:09 |
| marekd | stevemar: mind that utils.validate_groups is called from mapped.py | 07:09 |
| stevemar | alright | 07:09 |
| stevemar | then let's keep it as-is :) | 07:09 |
| marekd | i can add a comment | 07:09 |
| marekd | but i think this is a good reason to keep it as it is now. | 07:10 |
| *** lhcheng has quit IRC | 07:11 | |
| *** andreaf has joined #openstack-keystone | 07:13 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/140942 | 07:14 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/140943 | 07:14 |
| stevemar | marekd, the bug timbell raised about no availability zone list in OSC is such a pain | 07:14 |
| stevemar | novaclient returns the crappiest collection of crap for that endpoint | 07:15 |
| marekd | stevemar: saw the thread. | 07:15 |
| marekd | novaclient doesnt cover this crapinnes? | 07:15 |
| marekd | (so it can be easily consumed by osc) | 07:15 |
| stevemar | marekd, this is what it returns http://paste.openstack.org/show/149203/ | 07:16 |
| marekd | ehe | 07:17 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/134794 | 07:20 |
| openstackgerrit | Yamini Sardana proposed openstack/python-keystoneclient: tenant-list updated to output Tenant Description https://review.openstack.org/140962 | 07:20 |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: remove the unused method _will_expire_soon https://review.openstack.org/140966 | 07:28 |
| *** jamielennox is now known as jamielennox|away | 07:33 | |
| marekd | stevemar: https://bugs.launchpad.net/keystone/+bug/1401057 did you manage to take a look at it? | 07:35 |
| uvirtbot | Launchpad bug 1401057 in keystone "Direct mapping in mapping rules don't work with keywords" [Undecided,New] | 07:35 |
| stevemar | marekd, not yet, i'm technically on vacation this week :) | 07:35 |
| marekd | !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! | 07:36 |
| openstack | marekd: Error: "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" is not a valid command. | 07:36 |
| stevemar | marekd, i'm not sure if thats a problem with the mapping engine, or just a bad mapping | 07:36 |
| stevemar | haha | 07:36 |
| stevemar | I got pulled into a meeting today :( | 07:36 |
| marekd | stevemar: go to bed, have some life! | 07:36 |
| marekd | got snow already? | 07:37 |
| stevemar | marekd, soon soon, i've been sleeping in | 07:37 |
| stevemar | marekd, some of the outer areas have snow, but i'm downtown, we get it the lightest | 07:37 |
| marekd | so go skiing | 07:37 |
| stevemar | it snowed hard about 2 weeks ago, but the weather got warmer and now it's all gone | 07:37 |
| marekd | or cross country skiing :-) | 07:37 |
| marekd | u :( | 07:37 |
| marekd | same here | 07:37 |
| stevemar | i'm an old man, my knees hurt | 07:38 |
| stevemar | i am organizing boxes that we kept in a closet when we first moved in, almost a year ago | 07:38 |
| marekd | moved in where? | 07:39 |
| marekd | like new house/appartment? | 07:39 |
| stevemar | condo, my gf and i bought a place a year ago, we both have stuff we never unpacked in a spare room, from almost a year ago | 07:39 |
| stevemar | so i'm finally going to go through that stuff - clearly if I haven't touched it in 1 year it's going to the trash :) | 07:40 |
| marekd | or simply useless for you stuff. | 07:40 |
| stevemar | that too | 07:41 |
| marekd | so since you live together your gf lets you work days and nights ?:-) | 07:42 |
| stevemar | marekd, yeah, but she gets annoyed - rightfully so | 07:42 |
| stevemar | marekd, there was some movement on this btw - https://groups.google.com/forum/#!topic/mod_auth_openidc/NOdYaCAkx-o if you are interested | 07:43 |
| *** mzbik has joined #openstack-keystone | 07:43 | |
| marekd | i am | 07:43 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Identify groups by name/domain in mapping rules. https://review.openstack.org/139013 | 07:44 |
| *** k4n0 has joined #openstack-keystone | 07:44 | |
| *** lhcheng has joined #openstack-keystone | 07:44 | |
| *** chrisshattuck has quit IRC | 07:45 | |
| *** lhcheng_ has joined #openstack-keystone | 07:47 | |
| *** mflobo has joined #openstack-keystone | 07:47 | |
| marekd | stevemar: hm, he doesn't seem to give you an answer how to authN with cli | 07:47 |
| *** lhcheng has quit IRC | 07:49 | |
| stevemar | marekd, not really, and i didn't understand his latest response | 07:52 |
| marekd | stevemar: he porbably meant that you need to have a cookie/token from idp (means you need to be authenticated there) to get through the protected url. | 07:52 |
| marekd | which doesn't answer a question how to get this token without a browser. | 07:53 |
| stevemar | marekd, "let the client obtain an access token at the authorization server " are all very oauth terms | 07:55 |
| marekd | stevemar: cause as afaik openid is simply modified oauth2 | 07:56 |
| stevemar | right | 07:56 |
| *** nellysmitt has joined #openstack-keystone | 08:00 | |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: remove the unused method _will_expire_soon https://review.openstack.org/140966 | 08:11 |
| *** yasu_ has quit IRC | 08:16 | |
| *** yasu_ has joined #openstack-keystone | 08:17 | |
| *** lhcheng_ has quit IRC | 08:20 | |
| *** nellysmitt has quit IRC | 08:20 | |
| *** avozza is now known as zz_avozza | 08:26 | |
| stevemar | marekd, meh, comment if you want, also, let tim know that i have a patch for listing AZs :) https://review.openstack.org/#/c/140456/ | 08:27 |
| *** stevemar has quit IRC | 08:31 | |
| *** stevemar has joined #openstack-keystone | 08:40 | |
| *** ChanServ sets mode: +v stevemar | 08:40 | |
| *** zz_avozza is now known as avozza | 08:40 | |
| *** stevemar has quit IRC | 08:45 | |
| *** darren-wang has joined #openstack-keystone | 08:50 | |
| openstackgerrit | Yamini Sardana proposed openstack/python-keystoneclient: tenant-list updated to output Tenant Description https://review.openstack.org/140962 | 08:54 |
| darren-wang | hey guys, why do we have to change v3 catalog to v2 catalog in keystonemiddleware? | 08:55 |
| *** jistr has joined #openstack-keystone | 09:06 | |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: _get_token_expiration should return isotime https://review.openstack.org/140984 | 09:10 |
| *** andreaf has quit IRC | 09:13 | |
| *** nellysmi_ has joined #openstack-keystone | 09:23 | |
| openstackgerrit | Yamini Sardana proposed openstack/python-keystoneclient: tenant-list updated to output Tenant Description https://review.openstack.org/140962 | 09:46 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Service Provider for K2K https://review.openstack.org/135604 | 10:01 |
| *** nellysmi_ is now known as nellysmitt | 10:02 | |
| *** andreaf has joined #openstack-keystone | 10:15 | |
| *** boris-42 has joined #openstack-keystone | 10:18 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:25 | |
| *** Shohei_ has quit IRC | 10:30 | |
| *** Shohei has joined #openstack-keystone | 10:31 | |
| *** jamielennox|away is now known as jamielennox | 10:32 | |
| *** Shohei_ has joined #openstack-keystone | 10:34 | |
| *** Shohei has quit IRC | 10:34 | |
| *** tellesnobrega_ has quit IRC | 10:37 | |
| *** aix has joined #openstack-keystone | 10:39 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:41 | |
| *** remix_tj has left #openstack-keystone | 10:50 | |
| *** tellesnobrega_ has quit IRC | 10:51 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:53 | |
| *** tellesnobrega_ has quit IRC | 10:54 | |
| *** wanghong has quit IRC | 10:55 | |
| *** wanghong has joined #openstack-keystone | 10:56 | |
| *** mancdaz has joined #openstack-keystone | 10:56 | |
| *** kashyap has joined #openstack-keystone | 10:58 | |
| marekd | rodrigods: hey, so i talked with morganfainberg 2 days ago and there is a general agreement | 10:58 |
| marekd | that we cannot save the world. | 10:58 |
| marekd | so, there is a reasonable effort to make Keystone work as a saml idp and similar amout would be required for other protocols. So for now morganfainberg said "lets support SAML2 only and nothing more", hence no need to add protocols and tie them with SP objects | 10:59 |
| kashyap | With current Keystone git (I'm at commit: 71c9bf5), DevStack is failing with: | 11:00 |
| kashyap | "Could not find user: admin (Disable debug mode to suppress these details.) (HTTP 401)" | 11:00 |
| * kashyap still investigating, thought I'd note here first | 11:00 | |
| marekd | for the URL in the region - i believe this should be deprecated, but i don't thnk this should be a work item in SP spec. | 11:00 |
| marekd | or maybe it should...? | 11:00 |
| *** eglynn-regus is now known as eglynn-office | 11:11 | |
| kashyap | Disregard me, cleaning up my env, and re-running it 'fixed' it magically :) | 11:12 |
| *** kashyap has left #openstack-keystone | 11:17 | |
| rodrigods | marekd, yeah, makes sense | 11:31 |
| rodrigods | marekd, can always be "upgraded" if needed | 11:31 |
| *** aix has quit IRC | 11:49 | |
| *** aix has joined #openstack-keystone | 12:02 | |
| mancdaz | this may be a stupid question, but if I am using "backend = dogpile.cache.memcached", and I have set my memcached servers under the [memcache] section, do I also need to set them via the backend_argument flag in the [cache] section? | 12:15 |
| *** amakarov_away is now known as amakarov | 12:16 | |
| *** oomichi has quit IRC | 12:23 | |
| *** sluo_afk has joined #openstack-keystone | 12:31 | |
| *** sluo_laptop has quit IRC | 12:34 | |
| marekd | rodrigods: well, it's sometimes better to make a good design from the beginning, cause later upgrading may be a mess. | 12:38 |
| *** sluo_laptop has joined #openstack-keystone | 12:39 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 12:42 |
| *** sluo_afk has quit IRC | 12:43 | |
| *** radez_g0n3 is now known as radez | 12:46 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Authenticated Encryption Tokens https://review.openstack.org/130050 | 12:55 |
| lbragstad | ayoung: https://gist.github.com/lbragstad/a0b30f15b92798df6141 | 12:56 |
| lbragstad | ayoung: AE token demo | 12:56 |
| amakarov | bknudson, good day to you! Can you please review my LDAP doc change again? https://review.openstack.org/118590 | 12:58 |
| amakarov | And there is HA bug fix, can anybody look into? :) https://review.openstack.org/140681 | 12:58 |
| marekd | vsilva: did you happen to start implementing whitelisting in mapping enhancements? :-) | 13:02 |
| *** ajaya has joined #openstack-keystone | 13:07 | |
| *** ajayaa has quit IRC | 13:08 | |
| *** diegows has joined #openstack-keystone | 13:15 | |
| samuelms | why test_v3_* has a load_sample_data() method instead of using the default_fixtures? | 13:21 |
| ayoung | lbragstad, thanks | 13:37 |
| lbragstad | ayoung: yep | 13:37 |
| *** gordc has joined #openstack-keystone | 13:38 | |
| *** bknudson has quit IRC | 13:39 | |
| lbragstad | ayoung: If you have any questions, I should be back in about 4 hours. Volunteering for the morning | 13:39 |
| ayoung | lbragstad, NAVY! | 13:40 |
| ayoung | Never Again Volunteer Yourself! | 13:40 |
| ayoung | http://sandilands.info/sgordon/public-key-encryption-and-digital-signatures-using-openssl lbragstad using that to try and get a comparison. | 13:40 |
| lbragstad | ayoung: you want to use asymmetric? | 13:41 |
| ayoung | lbragstad, if possible, yes | 13:41 |
| marekd | does tox -edocs work for anybody even on a fresh master? | 13:41 |
| lbragstad | why? | 13:41 |
| ayoung | lbragstad, it means we can avoid the roundtrip | 13:41 |
| marekd | (and Debian/Ubuntu) | 13:41 |
| ayoung | We'll talk when you get back. I'm going to do some investigations first | 13:41 |
| lbragstad | ok | 13:42 |
| ayoung | lbragstad, what are we using as our sample payload? | 13:42 |
| lbragstad | https://gist.github.com/lbragstad/5381c639a3a4e17e1124#file-gistfile1-txt-L4 | 13:43 |
| *** yasu_ has quit IRC | 13:44 | |
| ayoung | lbragstad, is msgpack_demo.py another gist? | 13:45 |
| lbragstad | ayoung: yes | 13:45 |
| lbragstad | ayoung: it builds of demo.oy | 13:45 |
| lbragstad | demo.py* | 13:45 |
| ayoung | link? | 13:45 |
| lbragstad | demo.py https://gist.github.com/lbragstad/a0b30f15b92798df6141#file-demo-py | 13:46 |
| lbragstad | msgpack_demo.py https://gist.github.com/lbragstad/a0b30f15b92798df6141#file-msgpack_demo-py | 13:46 |
| marekd | lbragstad: i am going to read your spec again (lots must have happened before I had read it last time) and will try comment as I can see you were raising some usecases I had mentioned some time ago. | 13:46 |
| lbragstad | marekd: ok | 13:47 |
| lbragstad | marekd: jamielennox had a reference to federation but wasn't clean on the exact use case | 13:47 |
| lbragstad | gotta run, back in a few hours | 13:47 |
| marekd | lbragstad: cya | 13:47 |
| *** zzzeek has joined #openstack-keystone | 13:57 | |
| *** mitz- has joined #openstack-keystone | 13:58 | |
| *** mitz_ has quit IRC | 14:00 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Identify groups by name/domain in mapping rules. https://review.openstack.org/139013 | 14:07 |
| morganfainberg | mornin | 14:09 |
| marekd | hello | 14:09 |
| *** nkinder has quit IRC | 14:16 | |
| *** richm has joined #openstack-keystone | 14:19 | |
| *** bknudson has joined #openstack-keystone | 14:23 | |
| *** ChanServ sets mode: +v bknudson | 14:23 | |
| marekd | rodrigods: one say "an specific" ??? | 14:24 |
| marekd | dear natives: ^^^^^^^^^^^^^^^^^^^^^^^^ | 14:24 |
| bknudson | a specific | 14:26 |
| bknudson | an is used for vowels | 14:26 |
| marekd | bknudson: and what's correct "a specific url" or "an specific url" ? | 14:27 |
| *** mzbik has quit IRC | 14:27 | |
| bknudson | marekd: "a specific url" | 14:27 |
| marekd | bknudson: ok, i though so too. | 14:27 |
| rodrigods | bknudson, but specific has a sound of "es" | 14:28 |
| rodrigods | the an is before words which start with sound of vowel | 14:29 |
| bknudson | rodrigods: it's not pronounced especific ... | 14:29 |
| bknudson | not here in minnesota | 14:29 |
| marekd | uh, i am not that into articles. | 14:29 |
| bknudson | just change it to "the specific url" | 14:30 |
| rodrigods | marekd, bknudson, yep, my portuguese accent makes me pronounce "espe" | 14:30 |
| rodrigods | my fault | 14:30 |
| marekd | rodrigods: no worries, i didn't event want to opose, and that's why i asked here :-) | 14:30 |
| mancdaz | this may be a stupid question, but if I am using "backend = dogpile.cache.memcached", and I have set my memcached servers under the [memcache] section, do I also need to set them via the backend_argument flag in the [cache] section? | 14:31 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Service Provider for K2K https://review.openstack.org/135604 | 14:31 |
| *** bdossant_ has joined #openstack-keystone | 14:31 | |
| marekd | rodrigods: ^^ | 14:31 |
| *** bdossant has quit IRC | 14:33 | |
| rodrigods | ayoung, ping "policies engine": so I think I understood correctly what you and morganfainberg discussed yesterday, but I guess you would be the person to update this spec right now: https://review.openstack.org/#/c/133480/ | 14:34 |
| rodrigods | marekd, great! | 14:34 |
| marekd | rodrigods: did you catch my last responses about lack of protocols i wrote you earlier here? | 14:35 |
| rodrigods | marekd, yes | 14:36 |
| rodrigods | marekd, what about regions? | 14:37 |
| rodrigods | are we going to remove the URL field? | 14:37 |
| rodrigods | also, there is GET SAML assertion step, which is done right now by specifying a region | 14:37 |
| marekd | rodrigods: my understanding is that regions would not be used anymore. | 14:38 |
| marekd | rodrigods: i think jamielennox raised a point where region should be usable with a local token which would not be a case with k2k | 14:39 |
| rodrigods | marekd, so it will still need the url field? | 14:40 |
| marekd | morganfainberg: since url in region is no longer required should we actually deprecate it as a part of the service-providers spec? | 14:40 |
| morganfainberg | marekd, please do | 14:40 |
| *** joesavak has joined #openstack-keystone | 14:40 | |
| marekd | rodrigods: well, i think use of regions was kind of unspecified, and url was added especially for k2k | 14:40 |
| rodrigods | marekd, good | 14:41 |
| morganfainberg | marekd, it probably can disappear without too much effort as it was "optional" iirc | 14:41 |
| marekd | morganfainberg: let me check. | 14:41 |
| rodrigods | marekd, there is the need to document the new way to retrieve a SAML assertion | 14:41 |
| rodrigods | marekd, list in the work items? | 14:41 |
| marekd | morganfainberg: it's not specified whether url is optional or not in the API spec :/ | 14:42 |
| morganfainberg | marekd, i think it is implicitly optional because not everything has it | 14:43 |
| marekd | morganfainberg: ack | 14:43 |
| morganfainberg | marekd, i'm ok with deprecating it for sure. | 14:43 |
| marekd | rodrigods: does it fit in itemwork "document implemented changes" ? no keystoneclient exists for k2k so we will not change anything there :-) | 14:43 |
| *** topol has joined #openstack-keystone | 14:44 | |
| *** ChanServ sets mode: +v topol | 14:44 | |
| rodrigods | marekd, yes... just concerned about forgerting something | 14:46 |
| amakarov | morganfainberg, hi! I've turned allow_redelegation from field to parameter, as we discussed, would you kindly have a look? | 14:47 |
| morganfainberg | amakarov, will do, i am travelling today | 14:47 |
| morganfainberg | so might be spotty getting time until i'm checked out of the hotel | 14:47 |
| amakarov | morganfainberg, ok, just to notify ) | 14:48 |
| morganfainberg | absolutely | 14:48 |
| morganfainberg | and thanks for working hard on this | 14:48 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Service Provider for K2K https://review.openstack.org/135604 | 14:48 |
| marekd | rodrigods: ^^ | 14:48 |
| marekd | morganfainberg: bknudson: Can i ask for reviews https://review.openstack.org/#/c/130593 ? | 14:50 |
| *** joesavak has quit IRC | 14:52 | |
| ayoung | rodrigods, yeah, let me deal with that. | 14:54 |
| *** r-daneel has quit IRC | 14:54 | |
| *** ayoung has quit IRC | 14:56 | |
| *** nkinder has joined #openstack-keystone | 14:57 | |
| *** nkinder is now known as nkinder_away | 14:57 | |
| *** nellysmitt has left #openstack-keystone | 15:00 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/140943 | 15:03 |
| *** dims has joined #openstack-keystone | 15:04 | |
| *** ayoung has joined #openstack-keystone | 15:08 | |
| *** ChanServ sets mode: +v ayoung | 15:08 | |
| *** rushiagr is now known as rushiagr_away | 15:16 | |
| *** ajaya has quit IRC | 15:20 | |
| marekd | rodrigods: thanks for the review. | 15:26 |
| *** timcline has joined #openstack-keystone | 15:26 | |
| *** timcline has quit IRC | 15:26 | |
| *** timcline has joined #openstack-keystone | 15:27 | |
| gabriel-bezerra | dstanek: Hi David. My lab mates have told me you are working on setting up keystone with PySaml2 example IdP for testing. | 15:31 |
| *** bdossant_ has quit IRC | 15:32 | |
| *** bdossant has joined #openstack-keystone | 15:32 | |
| dstanek | gabriel-bezerra: yes, that's correct | 15:32 |
| *** boris-42 has quit IRC | 15:32 | |
| gabriel-bezerra | dstanek: I've got into a problem in the very end of the shibboleth verification. It's showing: opensaml::FatalProfileException at (http://localhost:5000/Shibboleth.sso/SAML2/POST) | 15:33 |
| gabriel-bezerra | dstanek: and Unable to establish security of incoming assertion. | 15:33 |
| gabriel-bezerra | dstanek: the log messages in /var/log/shibboleth/shibd.log aren't clear about what is going wrong | 15:34 |
| gabriel-bezerra | dstanek: have you ever faced this problem? | 15:34 |
| dstanek | gabriel-bezerra: i haven't gotten that far yet; i have mod_shib's XML configured to know about the IdP, but i don't know how to tell the IdP about the SP | 15:35 |
| dstanek | gabriel-bezerra: what did you do to get them to know about each other? | 15:35 |
| gabriel-bezerra | dstanek: just to make it clear: I'm setting it up here as well for us to help with the tests | 15:35 |
| *** tellesnobrega has quit IRC | 15:35 | |
| gabriel-bezerra | dstanek: I got the metadata of the sp into a file with curl http://localhost:5000/Shibboleth.sso/Metadata > shibboleth-sp-metadata.xml | 15:36 |
| gabriel-bezerra | dstanek: then I replaced the configuration in pysaml2/example/idp2/idp_conf.py (something like that) in the line metadata.local | 15:37 |
| gabriel-bezerra | dstanek: as we won't care about that idp talking to the old sp, I didn't mind removing the configuration for the old sp | 15:38 |
| dstanek | gabriel-bezerra: let me get onto my VM and fire things back up | 15:38 |
| gabriel-bezerra | dstanek: it is now like this: | 15:38 |
| gabriel-bezerra | "metadata": { | 15:38 |
| gabriel-bezerra | #"local": [full_path("../sp-wsgi/sp.xml")], | 15:38 |
| gabriel-bezerra | "local": [full_path("../../../shibboleth-sp-metadata.xml")], | 15:38 |
| gabriel-bezerra | } | 15:39 |
| gabriel-bezerra | Y | 15:39 |
| *** bdossant has quit IRC | 15:40 | |
| *** bdossant has joined #openstack-keystone | 15:41 | |
| *** boris-42 has joined #openstack-keystone | 15:45 | |
| *** shakamunyi has joined #openstack-keystone | 15:45 | |
| gabriel-bezerra | dstanek: could you find that line in the configuration file? | 15:49 |
| dstanek | gabriel-bezerra: yes, i just scripted doing that operation - now i'm restacking | 15:50 |
| morganfainberg | marekd: that change looks good. I will score it once I'm done checking out of the hotel and taking care of car return. | 15:53 |
| dstanek | gabriel-bezerra: so that seems to be done - what did you do to cause there error you are seeing? | 15:53 |
| gabriel-bezerra | dstanek: I used the web browser to access http://localhost:5000/v3/OS-FEDERATION/identity_providers/pysaml2/protocols/saml2/auth | 15:56 |
| gabriel-bezerra | dstanek: then I used babs/howes as user/pass | 15:56 |
| gabriel-bezerra | then it redirects back to the SP and, after ~3s, that error message comes up | 15:57 |
| gabriel-bezerra | dstanek: I've just got the same error with roland/dianakra | 16:00 |
| *** topol has quit IRC | 16:01 | |
| *** topol has joined #openstack-keystone | 16:01 | |
| *** ChanServ sets mode: +v topol | 16:01 | |
| *** DWang has joined #openstack-keystone | 16:05 | |
| *** darren-wang has quit IRC | 16:06 | |
| *** bdossant has quit IRC | 16:06 | |
| *** thedodd has joined #openstack-keystone | 16:08 | |
| *** shakamunyi has quit IRC | 16:12 | |
| *** eglynn-regus has joined #openstack-keystone | 16:13 | |
| *** eglynn-office has quit IRC | 16:14 | |
| openstackgerrit | Merged openstack/keystone: Remove endpoint_substitution_whitelist config option https://review.openstack.org/131007 | 16:14 |
| *** bdossant has joined #openstack-keystone | 16:16 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/140942 | 16:16 |
| marekd | morganfainberg: thanks. | 16:16 |
| marekd | dstanek: so usuall way is to send SP's metadata file to the IDP | 16:17 |
| marekd | dstanek: where you fetch Metadata from sp.example.com:5000/Shibboleth.sso/Metadata | 16:18 |
| *** bdossant has quit IRC | 16:18 | |
| *** erkules_ is now known as erkules | 16:20 | |
| marekd | dstanek: did you manage to write scripts for auto config idps/protocols/mappings? | 16:21 |
| dstanek | marekd: yes, i just wrote up a few curl commands | 16:24 |
| marekd | ...ok | 16:24 |
| *** nkinder_away has quit IRC | 16:29 | |
| *** rushiagr_away is now known as rushiagr | 16:29 | |
| samuelms | dstanek, it looks like you have a functional environment for the federation tests, is that right? o/ | 16:33 |
| samuelms | dstanek, I saw you posted your wip changes to https://review.openstack.org/#/c/139137/ | 16:34 |
| ayoung | rodrigods, samuelms so....I am trying to get a standard approach to Policy confirming attributes about the request. We have 3 distinct pieces: One is the URL, which has the identifiers in it. Second is the object fetched by the the URL (target) which will then have a domain on it, and the third is the payload of the request itself. I think it is the third one that is most problematic | 16:36 |
| ayoung | Lets say you are adding a user to a domain | 16:36 |
| ayoung | you would post to the create URL | 16:36 |
| ayoung | POST /users | 16:37 |
| ayoung | "user": {"domain_id": "1789d1", | 16:37 |
| ayoung | and we would assume that the user has a token scoped to that domain | 16:38 |
| ayoung | but, what if the user was sneaky and added in a section like this: | 16:38 |
| ayoung | "group": { domain: "something" | 16:38 |
| ayoung | and, if the user was in domain "something" but not in domain "1789d1" | 16:39 |
| ayoung | right now, the policy v3 protects against those kinds of attacks via brute force rules listing: | 16:39 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n50 for create user references | 16:40 |
| *** chrisshattuck has joined #openstack-keystone | 16:40 | |
| ayoung | rule:admin_and_matching_user_domain_id | 16:40 |
| ayoung | "admin_and_matching_user_domain_id": "rule:admin_required and domain_id:%(user.domain_id)s", | 16:40 |
| samuelms | ayoung, domain_id:%(user.domain_id)s | 16:41 |
| samuelms | ayoung, the first domain_id is from the url? | 16:41 |
| ayoung | samuelms, I'd like to not have to write an explicit rule for each variation, though | 16:41 |
| ayoung | I'd rather have something like: | 16:41 |
| ayoung | if there ius a user section, makes sure the domain matches AND if there is a group section make sure the domain matches etc | 16:42 |
| samuelms | ayoung, instead of thinking about all the paths a domain could come from (url, body, whatever) and just request for the check | 16:43 |
| samuelms | ayoung, and no need to create brute force checks | 16:44 |
| *** nkinder_away has joined #openstack-keystone | 16:44 | |
| samuelms | ayoung, something like: 'create_user': 'role:domain_admin on scope:domain' | 16:45 |
| samuelms | ayoung, and then the engine resolves what's needed | 16:46 |
| samuelms | ayoung, is that what you're thinking? | 16:46 |
| *** david-lyle_afk is now known as david-lyle | 16:46 | |
| ayoung | samuelms, yes----ish | 16:46 |
| ayoung | samuelms, something like this: | 16:46 |
| ayoung | lets say we have a creator thingy, and we pass that a domain. | 16:47 |
| ayoung | the creator is used for creating all things, and before it creates the thing, it makes sure you have the role on the domain that pertains. | 16:47 |
| ayoung | hmmmm | 16:47 |
| ayoung | I think my logic for domain_matches is flawed, but I can't think how to fix it inside the current structure | 16:48 |
| *** andreaf is now known as andreaf_ | 16:49 | |
| ayoung | samuelms, you know how I was pulling the "member" value out and setting it in the context? Its something like that | 16:49 |
| ayoung | indicating on a specific request that the thing we care about is in a given field | 16:49 |
| ayoung | create USER is the USER field, create group is the group field, and so on | 16:50 |
| samuelms | ayoung, hmm .. an entry point in the code? | 16:50 |
| ayoung | samuelms, so, if we were stuck with the decorator, we could put a value into the decorator that says "entity=user" | 16:50 |
| ayoung | and then the rule for domain matches would be: domain_id=entity.domain_id | 16:51 |
| ayoung | or something | 16:51 |
| samuelms | ayoung, looks interesting ++ | 16:52 |
| bknudson | we're not stuck with a decorator or anything. | 16:53 |
| ayoung | bknudson, I know...just as an example | 16:53 |
| samuelms | ayoung, these days I was thinking about allowing more powerful expressions into the policy | 16:53 |
| samuelms | ayoung, something like OCL (http://en.wikipedia.org/wiki/Object_Constraint_Language) | 16:53 |
| samuelms | ayoung, so that expressions could navigate through the models to make assertions | 16:53 |
| ayoung | samuelms, I think we want less in the language, and more in the base mechanism | 16:53 |
| ayoung | I think policy should be as simple as: | 16:54 |
| ayoung | api:role | 16:54 |
| ayoung | I'm more prone to making more powerful rules inside policy.py | 16:54 |
| ayoung | I'd rather people code in Python than in a constraints language | 16:55 |
| samuelms | ayoung, for nova, for example, one could define: 'create_instance': 'role:project_manager_lvl_2 and project.avalaible_quotas > 50%' | 16:55 |
| ayoung | doesn't belong in policy | 16:56 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add tests for enabled attribute ignored https://review.openstack.org/140895 | 16:56 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix disabling entities when enabled is ignored https://review.openstack.org/141101 | 16:56 |
| ayoung | I mean, yes we should be able to do that somewhere, but not in policy | 16:56 |
| samuelms | ayoung, where? | 16:56 |
| samuelms | ayoung, is that what congress stands for? | 16:57 |
| ayoung | samuelms, lets punt on that for now | 16:57 |
| ayoung | I want to get the keystone policy cleaned up to the point that it can be the basis for the unified policy file | 16:57 |
| ayoung | which means sorting issues like these | 16:58 |
| samuelms | ayoung, ok, makes sense | 16:58 |
| *** shakamunyi has joined #openstack-keystone | 16:59 | |
| ayoung | I mean, I could make domain_match into a Python object | 16:59 |
| ayoung | same with project match | 16:59 |
| samuelms | ayoung, yep, and project_match, user_match | 16:59 |
| samuelms | ayoung, and so on | 17:00 |
| ayoung | no, just the containers ones: doamin and project I think | 17:00 |
| samuelms | ayoung, well, yes | 17:00 |
| samuelms | ayoung, was rethinking :p | 17:00 |
| ayoung | keep thinking...you are spurring me on | 17:00 |
| ayoung | don't let my saying "no" shut you up | 17:00 |
| samuelms | ayoung, so glad to see this :) | 17:01 |
| samuelms | ayoung, haha yep | 17:01 |
| ayoung | maybe a "request_matches" object | 17:01 |
| dstanek | samuelms: almost yes - actually fighting some strange config issues right now and then back to the pysaml2 fun | 17:01 |
| samuelms | dstanek, great ++ | 17:02 |
| ayoung | the thing is, which one matches should depend on the thing you are trying to create | 17:02 |
| samuelms | dstanek, please let me know if we can try to help | 17:02 |
| ayoung | others should be ignored or treated as "if this is here and it should not be, reject" | 17:02 |
| dstanek | samuelms: if you guys get the IdP to work first that would be a huge help :-) that's the last thing i am stuck on | 17:02 |
| dstanek | samuelms: the rest of the work is really cleaning up some of the scripts that i wrote and making them more robust | 17:03 |
| samuelms | dstanek, ok .. will request this to vsilva and gabriel-bezerra :-) | 17:03 |
| *** _cjones_ has joined #openstack-keystone | 17:03 | |
| samuelms | dstanek, great | 17:03 |
| ayoung | samuelms, OK, so on a create, we maybe do want a specific rule that states what part of the request is relevant | 17:05 |
| samuelms | ayoung, and then we should think on api's by involved entities to them | 17:05 |
| ayoung | but it should be as simple as specifying request_entity:user | 17:05 |
| *** marcoemorais has joined #openstack-keystone | 17:08 | |
| *** marcoemorais1 has joined #openstack-keystone | 17:10 | |
| *** gyee has joined #openstack-keystone | 17:11 | |
| *** ChanServ sets mode: +v gyee | 17:11 | |
| *** aix has quit IRC | 17:12 | |
| samuelms | ayoung, so for each api we need to define the entity that will be used to match attributes (entity.domain_id, for example) | 17:13 |
| *** marcoemorais has quit IRC | 17:13 | |
| ayoung | samuelms, I think it is only needed for the creates. For the others, it will all be determined by the objects out of the database. But with a create, there is no object from the database | 17:14 |
| ayoung | Hmmm | 17:14 |
| ayoung | So, in Keystone, we have the ability to fetch a project from the database. But In nova, they won't | 17:15 |
| ayoung | so, yeah, we need to match on object itself | 17:15 |
| ayoung | er...requested object | 17:15 |
| ayoung | bknudson, is there any support with JSON home for saying "only these fields are valid in the request, and if it is not well formed, reject it?" | 17:17 |
| bknudson | ayoung: I think you're asking about JSONSchema not JSON Home. | 17:17 |
| bknudson | JSON Home doesn't do any validation | 17:17 |
| ayoung | yes, yes I am | 17:17 |
| bknudson | ayoung: and yes, JSON Schema does support that. | 17:18 |
| ayoung | bknudson, so tell me if these rings true: | 17:18 |
| bknudson | I think we set all our schema so that they allow extra parameters. | 17:18 |
| *** henrynash has joined #openstack-keystone | 17:18 | |
| *** ChanServ sets mode: +v henrynash | 17:18 | |
| ayoung | ah | 17:18 |
| ayoung | hmmm | 17:18 |
| bknudson | it's difficult to support forwards-compat if you don't allow extra params | 17:18 |
| bknudson | typically one wants to ignore unknown params so newer clients can work with old server. | 17:19 |
| samuelms | ayoung, I think we just need to check info from assingment's scope, and not from the objects themselves | 17:19 |
| ayoung | samuelms, in this case, yes | 17:19 |
| samuelms | ayoung, assignment's scope + role + actor | 17:19 |
| samuelms | ayoung, the actor is me, trying to do something in the domain x, where I must have role y | 17:20 |
| samuelms | ayoung, :) | 17:20 |
| ayoung | samuelms, the thing is, the assignment scope is specific to the API being called, especially if we allow data into the request that we are then goin to ignore | 17:20 |
| samuelms | ayoung, so we're still discussing about the several sources where the info that need to be checked come from (url, body, etc) | 17:21 |
| samuelms | ayoung, the need to compare them with the scope is a fact | 17:22 |
| ayoung | samuelms, I think the core is that if you are driving an action primarily on data from the request, you need to have some semantic interpretation of the data before you can run policy on it | 17:24 |
| ayoung | with the other APIs, you have control on the server side. With the request from a remote user, you do not. | 17:24 |
| ayoung | However... | 17:24 |
| ayoung | I think we need a rule that says "here are a set of things to check. One of them must return a positive, and none of them can return a negative" | 17:25 |
| samuelms | ayoung, but can the user modify the token by himself? | 17:25 |
| ayoung | which is what the OR rules try to do | 17:25 |
| ayoung | but then, the rules themselves must do: | 17:25 |
| ayoung | if user exists, check that domain_id == user_id | 17:26 |
| ayoung | if it does not exist, don't treat it as either a success or failure | 17:26 |
| ayoung | I can write it in python, but not in the rules language | 17:26 |
| samuelms | ayoung, ++ | 17:27 |
| samuelms | samuelms, implement the logic evaluation in python | 17:28 |
| ayoung | for entry in entries: if entry.passes passes=True else passes = False and break; | 17:28 |
| samuelms | samuelms, like real logic: a ^b ^¬c | 17:28 |
| ayoung | samuelms, so some new rule type "at_least_one_of" | 17:28 |
| samuelms | ayoung, any(..) in python :D | 17:28 |
| ayoung | python any. exactly | 17:29 |
| samuelms | ayoung, any([False, False, True]) -> True | 17:29 |
| ayoung | Ah...not quite | 17:30 |
| samuelms | ayoung, any([None, None, True]) -> True | 17:30 |
| samuelms | ayoung, ^ | 17:30 |
| samuelms | ayoung, and we have >>> all([True, True, True]) -> True | 17:31 |
| samuelms | ayoung, if we need ands (but I dont think so) | 17:31 |
| ayoung | for entity in ['user', 'group', 'project'] : if request.get(entity) is None continue; | 17:31 |
| samuelms | ayoung, the 'ands' still lives in the .json | 17:31 |
| ayoung | the JSON needs to specify the keys, but the collection needs to be created in python | 17:32 |
| ayoung | OK...I think I can code that up. Let me give it a try | 17:32 |
| samuelms | ayoung, sure | 17:32 |
| samuelms | ayoung, if we could always restrict the operations on a target to someone that has a role on that | 17:37 |
| morganfainberg | samuelms, so following up on graduation stuff will be today when i get home | 17:38 |
| morganfainberg | hard to get everything done while at the airport / having to get on a plane. | 17:38 |
| ayoung | samuelms, you mean as a second check beyond the API level one? Yes, I think we should | 17:38 |
| samuelms | ayoung, for example, if you have a domain scope token and call list_users, that's pretty obvious you want to list users on that domain | 17:38 |
| rodrigods | morganfainberg, ^great :) | 17:39 |
| samuelms | ayoung, and on the policy you just need to: 'list_users': 'role:domain_admin' | 17:39 |
| samuelms | morganfainberg, ++ | 17:39 |
| morganfainberg | samuelms, i don't think that case is *that* obvious | 17:39 |
| morganfainberg | samuelms, honestly, if i say "list_users" do i mean i want to use say a super-power and list all users i can see? just the domain users? | 17:40 |
| morganfainberg | samuelms, i'd argue that the API shouldn't make those assumptions | 17:40 |
| samuelms | morganfainberg, yep makes sense | 17:41 |
| ayoung | morganfainberg, list users is the sore spot: | 17:41 |
| samuelms | morganfainberg, that should be configurable | 17:41 |
| morganfainberg | samuelms, the tooling around the API can be smarter about it (e.g. horizon/keystoneclient) and pass appropriate params to ensure you get the opnionated response | 17:41 |
| samuelms | morganfainberg, by the deployer (using policyc) | 17:41 |
| ayoung | really the fact that we change what we show based on the context in the token is a little suspect | 17:41 |
| morganfainberg | samuelms, except it *can't* be configurable at that level via policy | 17:41 |
| morganfainberg | ayoung, that is my point | 17:41 |
| morganfainberg | the API shouldn't try and outthink the user | 17:41 |
| morganfainberg | the tooling can be more opinionated | 17:42 |
| morganfainberg | list_users probably should show everyone the requestor can see, sans filtering | 17:42 |
| morganfainberg | but if keystoneclient/OSC (CLI) or horizon is a bit more opinionated about filtering, i think that is fine | 17:43 |
| ayoung | " everyone the requestor can see" means it is basedon the token | 17:43 |
| samuelms | ayoung, that's waht I'm thinking | 17:43 |
| ayoung | I'd rather say that the API should always return the same thing,but return 403 if the user can't see that | 17:43 |
| ayoung | so for most people list_users would 403 | 17:44 |
| ayoung | maybe for everyone | 17:44 |
| morganfainberg | ayoung, so must provide a filter to your domain if you're looking for that scope? | 17:44 |
| morganfainberg | and aren't a super-admin-special-powered-role | 17:44 |
| ayoung | yeah | 17:44 |
| * morganfainberg would be ok with that. | 17:44 | |
| morganfainberg | it really wouldn't change the current behavior | 17:44 |
| ayoung | morganfainberg, it would likely break all tooling | 17:45 |
| ayoung | that is the problem. Damn users.... | 17:45 |
| morganfainberg | nah, only if we update policy as is | 17:45 |
| samuelms | ahha | 17:45 |
| ayoung | always wanting us to not break things | 17:45 |
| morganfainberg | if we start with current policy [yes don't change the current policy at the same time you change this stuff] | 17:45 |
| ayoung | OK...time to go talk to my kid's teacher.... | 17:45 |
| morganfainberg | s/yes// | 17:45 |
| morganfainberg | that shouldn't break anything | 17:45 |
| *** ayoung is now known as ayoung-afk | 17:46 | |
| samuelms | ayoung, is he messing up the school? o/ | 17:46 |
| samuelms | haha | 17:46 |
| *** tellesnobrega has joined #openstack-keystone | 17:46 | |
| morganfainberg | samuelms, and i agree with ayoung, don't make piolicy "python" | 17:47 |
| morganfainberg | that is scary scary stuff | 17:47 |
| morganfainberg | policy should stay a DSL that we have a lot more control over. | 17:47 |
| samuelms | morganfainberg, in fact that's what he was proposing | 17:47 |
| morganfainberg | well then i mis-read | 17:48 |
| morganfainberg | the answer is that doesn't belong in the policy language | 17:48 |
| samuelms | morganfainberg, what I was thinking was to put more powerful expressions on that | 17:48 |
| samuelms | morganfainberg, like using Object constraint language (OCL) | 17:48 |
| morganfainberg | policy language doesn't need to be able to make arbitrary python calls - please no. | 17:48 |
| samuelms | morganfainberg, http://en.wikipedia.org/wiki/Object_Constraint_Language | 17:48 |
| * morganfainberg is sick of the wikipedia beg-a-thon | 17:48 | |
| morganfainberg | it screws up my web browsers all the time. | 17:49 |
| * morganfainberg considers adding an adblock rule for the begathon div | 17:49 | |
| samuelms | morganfainberg, and then one could navigate through resources like: 'create_instance':'role:project_admin_lvl2 and project.available_quotas > 50%' | 17:49 |
| morganfainberg | so that explicitly requires us to ensure the PEP is lower than at the API layer (i'm leaning towards that being the right answer) | 17:49 |
| samuelms | morganfainberg, haha | 17:50 |
| morganfainberg | i *think* that would actually be: 'create_instance':role:project_adminlvl2 and expr(%(project).available_quotas, gt(50)) | 17:50 |
| samuelms | morganfainberg, +100 | 17:51 |
| gabriel-bezerra | dstanek: sorry, I had to go for lunch and my connection has crashed before I could tell you. Did you get to make the IdP to recognize the SP with that change to the idp_conf.py file? | 17:51 |
| samuelms | morganfainberg, :-) | 17:51 |
| morganfainberg | samuelms, we might need to make it more like the SQL-partition declariation | 17:51 |
| morganfainberg | and expr(%(project).available_quotas, GREATER 50) | 17:52 |
| morganfainberg | rather than doing the functional-looking approach | 17:52 |
| morganfainberg | easier from a user-consumption perspective | 17:52 |
| samuelms | morganfainberg, agreed | 17:52 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Inherited role assignments to projects https://review.openstack.org/138552 | 17:52 |
| morganfainberg | but in either case i think that is fine - it stays a DSL (OCL type) | 17:52 |
| morganfainberg | and doesn't become "omg-run this function" | 17:53 |
| samuelms | morganfainberg, perfect | 17:53 |
| morganfainberg | and it would use context to pull %(<kwarg>) ou | 17:53 |
| morganfainberg | t | 17:53 |
| rodrigods | henrynash, ^ thanks for the comments, added a more complex testcase (check the replies to see if you are ok with them) | 17:53 |
| morganfainberg | if kwarg doesn't exist, it's a failure in the case of a required 'and' | 17:53 |
| samuelms | morganfainberg, yep | 17:53 |
| morganfainberg | in an *or* case that check is implicitly false | 17:53 |
| *** marcoemorais1 has quit IRC | 17:54 | |
| morganfainberg | i think we need to improve the lexical parser to be less about inspect the string and probably move to a known/premade tokenizer | 17:54 |
| morganfainberg | the "out own tokenizer" is likely not up to the OCL-type task | 17:55 |
| *** amakarov is now known as amakarov_away | 17:55 | |
| morganfainberg | s/out/our | 17:55 |
| *** gyee has quit IRC | 17:55 | |
| *** bknudson has quit IRC | 17:56 | |
| samuelms | morganfainberg, yep .. we need to improve it | 17:56 |
| samuelms | morganfainberg, I'll write this idea up somewhere, so we keep this | 17:57 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Inherited role assignments to projects https://review.openstack.org/138552 | 17:57 |
| *** r-daneel has joined #openstack-keystone | 17:57 | |
| *** topol has quit IRC | 17:58 | |
| openstackgerrit | Merged openstack/keystone-specs: Scope federated tokens with ``token`` auth method. https://review.openstack.org/137020 | 17:59 |
| *** jistr has quit IRC | 18:00 | |
| samuelms | morganfainberg, have you ever thought about having 'capabilities' as a first-class citizen on Keystone ? | 18:01 |
| samuelms | henrynash, hey | 18:02 |
| samuelms | henrynash, followed what I was discussing with morgan ^ | 18:03 |
| *** harlowja_away is now known as harlowja | 18:03 | |
| samuelms | henrynash, ^ | 18:03 |
| *** thedodd has quit IRC | 18:04 | |
| samuelms | henrynash, we're thinking about more powerful expressions in the policy, something related to Object Constraint Language | 18:04 |
| samuelms | henrynash, so we could have something like 'create_instance':'role:project_adminlvl2 and expr(%(project).available_quotas, GREATER 50)' | 18:04 |
| *** lhcheng has joined #openstack-keystone | 18:07 | |
| morganfainberg | samuelms, capabilities? as in nova api actions? | 18:10 |
| *** _cjones_ has quit IRC | 18:12 | |
| *** _cjones_ has joined #openstack-keystone | 18:13 | |
| samuelms | morganfainberg, each api would be a capability.. I'm writing up my complete idea right now | 18:14 |
| *** avozza is now known as zz_avozza | 18:14 | |
| samuelms | morganfainberg, will ping you in few minutes | 18:15 |
| morganfainberg | i've actually discussed this with people at the summit ;) | 18:15 |
| samuelms | morganfainberg, o/ | 18:15 |
| samuelms | morganfainberg, and? | 18:15 |
| morganfainberg | there is amajor hurdle - how do you know the capabilities for an endpoint | 18:15 |
| morganfainberg | so you can assign that capability into a role/etc | 18:15 |
| samuelms | morganfainberg, two options: i) each service would implement list_capabilities() ii) reading capabilities from policy file | 18:16 |
| samuelms | morganfainberg, that way roles could be what they really mean: group of capabilities | 18:16 |
| samuelms | morganfainberg, if we update what we have today: role -> capability ; domain-role -> role | 18:18 |
| samuelms | morganfainberg, we could have that model | 18:18 |
| morganfainberg | henrynash, ping: just commented again on the split-assignment patch, but short is i wont negatively score it - but I also wont positively score it [don't want it blocked]. If the design is correct with the extra split i'm willing to be proven wrong with the input from the -core team and non-core developers/users/reviewers. | 18:19 |
| henrynash | morganfaing: ok, will review | 18:19 |
| morganfainberg | but i haven't seen a strong voice in your favor or my favor on that front. so we're (i think) equally balanced on the design view atm :) | 18:20 |
| morganfainberg | henrynash, please prove me wrong if this split is really buying us a big win. | 18:20 |
| morganfainberg | samuelms, so you need to be running the service to know the capabilities | 18:21 |
| samuelms | morganfainberg, just for the first option | 18:21 |
| morganfainberg | samuelms, this makes defining roles hard if <service> is down. | 18:21 |
| dstanek | gabriel-bezerra: i'm looking into a mod_shib config issue | 18:21 |
| samuelms | morganfainberg, the second would be to read api's from policy | 18:21 |
| morganfainberg | yes, second - i think that might be backwards, but haven't thought too much about that | 18:21 |
| *** gyee has joined #openstack-keystone | 18:22 | |
| *** ChanServ sets mode: +v gyee | 18:22 | |
| morganfainberg | samuelms, will need to mull that one over some. | 18:22 |
| samuelms | morganfainberg, yep, I'm writing my complete vision on how the whole thing could be | 18:22 |
| gabriel-bezerra | dstanek: have you had the same issue as I had? | 18:22 |
| samuelms | morganfainberg, will ping you and let you mull it :) | 18:22 |
| gabriel-bezerra | dstanek: the same error | 18:22 |
| morganfainberg | sounds good | 18:23 |
| samuelms | morganfainberg, great | 18:23 |
| henrynash | rodigods: +2’d your patch | 18:24 |
| rodrigods | henrynash, yay :) | 18:26 |
| rodrigods | morganfainberg, henrynash we need to approve the API spec part too: https://review.openstack.org/#/c/130277/ | 18:26 |
| dstanek | gabriel-bezerra: current issue is http://paste.openstack.org/show/149516/ | 18:26 |
| samuelms | henrynash, o/ | 18:26 |
| dstanek | gabriel-bezerra: i'm trying to compare my config to marekd's to see if there is something obvious | 18:27 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller Use case https://review.openstack.org/139824 | 18:28 |
| gabriel-bezerra | dstanek: ok, I didn't have that issue | 18:28 |
| *** esp has quit IRC | 18:28 | |
| morganfainberg | if you didn't see it: http://lists.openstack.org/pipermail/openstack-dev/2014-December/052784.html | 18:29 |
| morganfainberg | next week i'm going to mass-abandon lingering reviews | 18:29 |
| gabriel-bezerra | dstanek: pysaml2-iPD? | 18:29 |
| gabriel-bezerra | dstanek: see the URL on the error | 18:29 |
| morganfainberg | dstanek, i know you have a chunk of these, as does ayoung-afk. | 18:29 |
| dstanek | gabriel-bezerra: yes | 18:30 |
| morganfainberg | dstanek, hence why i didn't want to abandon w/o warning. | 18:30 |
| dstanek | morganfainberg: i'll pull down the stuff i'm interested in keeping into local branches and then abandon | 18:30 |
| gabriel-bezerra | dstanek: did you notice the swapped P and D? | 18:30 |
| dstanek | gabriel-bezerra: haha, fixed the curl and it still doesn't work | 18:31 |
| morganfainberg | dstanek, you can just pull it all down and let me abandon | 18:32 |
| morganfainberg | dstanek, it's fine either way make it easy for you - i need to look through all of them anyway | 18:32 |
| dstanek | morganfainberg: do you know if there is anything that we'd actually want? i'd be happy to see if i can recover the reviews on top of current master | 18:33 |
| *** marcoemorais has joined #openstack-keystone | 18:33 | |
| morganfainberg | dstanek, haven't looked | 18:33 |
| morganfainberg | dstanek, i can ping you on any i see after i start abandoning | 18:33 |
| dstanek | morganfainberg: k | 18:34 |
| morganfainberg | dstanek, lets plan for that - if i see something important i'll toss it over in a gist or some such | 18:34 |
| morganfainberg | i'd rather you grab all your reviews and help w/ K1 targets than worry about abandoning right now. | 18:34 |
| dstanek | there is probably quite a few bug fixes that were more or less drive by reviews | 18:34 |
| morganfainberg | yeah | 18:35 |
| morganfainberg | exactly | 18:35 |
| morganfainberg | this is why i'm actually going to look through each one | 18:35 |
| morganfainberg | not just blindly abandon | 18:35 |
| *** marcoemorais1 has joined #openstack-keystone | 18:35 | |
| morganfainberg | also if it just was lingering / no score - i'll not abandon | 18:35 |
| morganfainberg | this is just negative score with zero updates in 60+d | 18:35 |
| morganfainberg | rebase != update | 18:36 |
| *** esp has joined #openstack-keystone | 18:36 | |
| openstackgerrit | Merged openstack/keystone: Add missing translation marker for dependency https://review.openstack.org/136824 | 18:36 |
| openstackgerrit | Thiago Paiva Brito proposed openstack/python-keystoneclient: Implementing hierarchical calls on keystoneclient v3 (python only) https://review.openstack.org/115770 | 18:36 |
| dstanek | morganfainberg: if i have time on Sunday I'll look and see if there is anything i'd like to save | 18:36 |
| morganfainberg | great | 18:36 |
| morganfainberg | much appreciated | 18:37 |
| *** marcoemorais has quit IRC | 18:38 | |
| morganfainberg | zzzeek, ping - need to ask you some questions re SQLA and at least alembic migration(s) | 18:40 |
| *** rushiagr is now known as rushiagr_away | 18:40 | |
| morganfainberg | zzzeek, specifically horizonal partitioning at the RDBMS engine level - and how that's going break things [if at all] | 18:41 |
| openstackgerrit | Merged openstack/keystone: TestAuthPlugin doesn't use test_auth_plugin.conf https://review.openstack.org/137367 | 18:42 |
| dstanek | gabriel-bezerra: i think my issue is that the shibboleth.xml configuration doesn't match my apache configuration | 18:52 |
| *** bknudson has joined #openstack-keystone | 18:55 | |
| *** ChanServ sets mode: +v bknudson | 18:55 | |
| *** harlowja has quit IRC | 19:00 | |
| *** thedodd has joined #openstack-keystone | 19:02 | |
| morganfainberg | rodrigods, ping: HMT - commented on the inherit stuff | 19:07 |
| *** nellysmitt has joined #openstack-keystone | 19:07 | |
| morganfainberg | rodrigods, one thing that needs to be addressed before I can really +3 | 19:07 |
| bknudson | PTL gets +3 now! | 19:08 |
| morganfainberg | bknudson, +3! dude +2 CR, +1 Approved | 19:09 |
| morganfainberg | that is totally a +3! | 19:09 |
| morganfainberg | :) | 19:09 |
| * morganfainberg admits to stealing that from -infra | 19:09 | |
| *** topol has joined #openstack-keystone | 19:12 | |
| *** ChanServ sets mode: +v topol | 19:12 | |
| openstackgerrit | Merged openstack/pycadf: Updated from global requirements https://review.openstack.org/139236 | 19:13 |
| rodrigods | morganfainberg, great! | 19:15 |
| dstanek | gabriel-bezerra: so i fixed (i think) my config issue and the curl is just hanging there | 19:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller Use case https://review.openstack.org/139824 | 19:17 |
| *** lhcheng_ has joined #openstack-keystone | 19:17 | |
| *** marcoemorais1 has quit IRC | 19:18 | |
| marekd | dstanek: if you have some doubts or problems, feel free to shoot me an e-mail! | 19:20 |
| marekd | maybe i have seen that in the past so why double the efforts. | 19:20 |
| dstanek | marekd: nothing i can't get past so far...just one after another | 19:20 |
| marekd | gabriel-bezerra: so you want to setup just pysaml2 or working on functional tests? | 19:20 |
| dstanek | marekd: gabriel-bezerra is setting up pysaml2 to start working on the functional tests | 19:21 |
| *** ayoung-afk is now known as ayoung | 19:21 | |
| *** lhcheng_ has left #openstack-keystone | 19:22 | |
| ayoung | morganfainberg, I have a lot of irons on the fire, and try to keep up with them. But review is a slow process, so please don't go through and mark any of mine as abandonded. I do that myself when it really is abandoned. | 19:23 |
| morganfainberg | ayoung, yours are not exempted here | 19:23 |
| ayoung | morganfainberg, so you think I'm not involved enough? :) | 19:23 |
| morganfainberg | if the review has not seen an update in 60 days and has a negative score it will be abandoned - i am going to look at them closely. | 19:23 |
| morganfainberg | no it;s not you, it's the fact that these are lingering around and need cleanup | 19:24 |
| morganfainberg | i'll document all of yours marked clearly in agist so you can bring them back as needed | 19:24 |
| morganfainberg | same w/ dstanek's | 19:24 |
| marekd | dstanek: so it's something different from your patch ? | 19:24 |
| morganfainberg | these don't "go away" just drop off the active review list. | 19:24 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: regions sample script https://review.openstack.org/91894 | 19:24 |
| morganfainberg | and i am not blocking them in the future. | 19:24 |
| marekd | gabriel-bezerra: do you have something on gerrit already? | 19:25 |
| morganfainberg | just makeing sure people who are reviewing can see what is active. | 19:25 |
| morganfainberg | ayoung, like i said, i'll build a gist / list of anything abandoned and who was the author with links. | 19:25 |
| morganfainberg | ayoung, should be easy to recover them when you have time to circle back on them. | 19:25 |
| *** thedodd has quit IRC | 19:25 | |
| morganfainberg | -specs are less likely to be abandoned as a lot are actually relevant even if they haven't been touched | 19:25 |
| morganfainberg | ayoung, but some things have really been drive-by or not going to be followed up on. | 19:26 |
| morganfainberg | ayoung, prior to the auto-abandon disable all of these would be abandoned as is - i'm giving a lot more leeway and making it easier to recover them. | 19:26 |
| morganfainberg | ayoung, my reviews are not exempt either - if it makes a difference. | 19:27 |
| ayoung | Its ok. I can rebase the ones that I care about. I'll try to cull any that are really dead. | 19:27 |
| morganfainberg | ayoung, i'm looking at the list you have almost none that meet the 60 day criteria | 19:28 |
| morganfainberg | maybe 1 | 19:28 |
| morganfainberg | at a glance | 19:28 |
| gabriel-bezerra | marekd: no, I don't. I'm trying to have it working first and logging what I'm doing. | 19:29 |
| ayoung | yeah, I've been trying to keep them fresh | 19:29 |
| zzzeek | morganfainberg: sup | 19:29 |
| gabriel-bezerra | dstanek: ^ | 19:29 |
| marekd | gabriel-bezerra: ok. | 19:29 |
| morganfainberg | ayoung, yeah and you're doing a good job. this is just a "if it really isn't worth working on we can circle back on them later" | 19:29 |
| morganfainberg | zzzeek, so if i enable horizontal partitioning at the RDBMS layer | 19:29 |
| morganfainberg | zzzeek, how bad will i break things | 19:29 |
| morganfainberg | zzzeek, going to use range-based partitioning | 19:30 |
| zzzeek | specifically what horizontal technique | 19:30 |
| gabriel-bezerra | marekd: dstanek: are you using curl to make the authentication on the IdP? | 19:30 |
| morganfainberg | zzzeek, i didn't see anything in SQLA that touched at that layer (it implements horizonal partitioning in python it looks like) | 19:30 |
| zzzeek | like postgresql inherits partitions ? | 19:30 |
| morganfainberg | zzzeek, like mysql, partition by range less than YEAR(1920) | 19:30 |
| gabriel-bezerra | marekd: dstanek: I'm trying it firts on the browser. When it work, I might try to put it into a script. | 19:31 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Inherited role assignments to projects https://review.openstack.org/138552 | 19:31 |
| zzzeek | morganfainberg: didnt know mysql had that .... | 19:31 |
| morganfainberg | zzzeek, it changes what the create table looks like. | 19:31 |
| gabriel-bezerra | s/firts/first/ | 19:31 |
| morganfainberg | zzzeek, it does. | 19:31 |
| morganfainberg | zzzeek, it's slick | 19:31 |
| rodrigods | morganfainberg, henrynash ^ thanks for the reviews | 19:31 |
| morganfainberg | zzzeek, it also lets you drop a partiton/truncate | 19:31 |
| dstanek | gabriel-bezerra: put the curl in a script? | 19:31 |
| morganfainberg | zzzeek, it looks like the impact to SQLA should be minimal. | 19:31 |
| dstanek | gabriel-bezerra: seems like that should be a part of the functional tests | 19:32 |
| gabriel-bezerra | dstanek: put the authentication in a script, probably using curl. | 19:32 |
| morganfainberg | zzzeek, http://dev.mysql.com/doc/refman/5.1/en/partitioning-management-range-list.html | 19:32 |
| morganfainberg | zzzeek, i was asking if you knew of any land mines going down this path | 19:32 |
| zzzeek | morganfainberg: OK so two areas. one is getting the DDL in there out of SQLAclhemy if you need it, i need to see waht we support in mysql at teh moment. the other is, do the MySQL drivers explode with this. b.c. they explode w/ everythign else | 19:32 |
| gabriel-bezerra | dstanek: I could make it when using testshib. Would just have to make some adaptations, hopefully. | 19:32 |
| morganfainberg | afaict mysql drivers (in python e.g. mysqldb) work with this | 19:33 |
| morganfainberg | since it's quiet | 19:33 |
| dstanek | marekd: gabriel-bezerra: oh...do i have to put a link to the metadata in shibboleth.xml as well as in the actual IdP? | 19:33 |
| zzzeek | morganfainberg: OK I see we do have Table(…., mysql_partition_by=“whatever”) | 19:33 |
| morganfainberg | i'm less worried about the DDL access just that we wont explode in SQLA | 19:33 |
| morganfainberg | i'm fine if i need to so sql.execute() to handle the alters in this case - i do *not* expect this to be db agnostic code | 19:33 |
| morganfainberg | it's crazy to try and develop this type of logic for *all* dbs without knowing it. | 19:34 |
| gabriel-bezerra | dstanek: I described what I've done: just change that metadata.local entry in the idp_conf.py to point to the metadata file I got using curl. | 19:34 |
| zzzeek | morganfainberg: there’s nothing on the SQLA side that would be impacted , except if the drivers trip over it | 19:34 |
| morganfainberg | zzzeek, great. | 19:34 |
| *** dims has quit IRC | 19:34 | |
| morganfainberg | zzzeek, and alembic? | 19:34 |
| zzzeek | morganfainberg: have never heard any reports so it is likely OK | 19:34 |
| zzzeek | morganfainberg: same thing, if the ALTER statements don’t change | 19:34 |
| morganfainberg | zzzeek, i assume alembic would trip up in similar-ish ways to sql-a-migrate | 19:34 |
| marekd | dstanek: you need to configure two-way trust | 19:34 |
| marekd | usually it can be done by exchanging peers metadata files | 19:34 |
| *** dims has joined #openstack-keystone | 19:35 | |
| morganfainberg | zzzeek, cool. i'm hoping this all just works but this is my solution to gap-lock and token table flushing | 19:35 |
| marekd | dstanek: so, yes.. | 19:35 |
| dstanek | gabriel-bezerra: i have already done that but it seems that the shibboleth XML config needs it in the ApplicationOverride | 19:35 |
| dstanek | marekd: ok...thx | 19:35 |
| gabriel-bezerra | dstanek: I don't know if that's all that's needed, as I'm facing that trouble in the end of the saml2 handshake. But, so far, that's all I have changed in that configuration. | 19:35 |
| marekd | dstanek: in case of shibboleth you can do this either by storing the file locally and adding the path or adding the url | 19:35 |
| zzzeek | morganfainberg: well OK when we partition into 1, 2, 3, is there still just one “table” from a MySQL catalog point of view? | 19:35 |
| morganfainberg | zzzeek, if we can horizontally partition and drop/truncate exprred tokens with low impact it'll make managing the cases with a lot of token issuance | 19:35 |
| marekd | to the metadata stored somewhere in the internet. | 19:35 |
| morganfainberg | zzzeek, yeah it's still a single table | 19:35 |
| zzzeek | morganfainberg: see this is actually less impactful than PG’s version in that regard | 19:36 |
| morganfainberg | zzzeek, as far as interactions with it, nothing should change except the storage itself is split up horizontally | 19:36 |
| gabriel-bezerra | dstanek: in the sp, I put a new MetadataProvider node, and changed the entityID of the SSO node. | 19:36 |
| zzzeek | morganfainberg: yeah then this shoudl have zero issues | 19:36 |
| morganfainberg | zzzeek, PG's is something i wont even take a stab at yet. | 19:36 |
| morganfainberg | zzzeek, fantastic. | 19:36 |
| zzzeek | morganfainberg: its jut a table with special options on it | 19:36 |
| zzzeek | morganfainberg: PG’s approach, there are actually multiple tables | 19:36 |
| morganfainberg | zzzeek, if i run into any i'll be making bugs/bugging you w/ my POC | 19:36 |
| morganfainberg | zzzeek, yeah it looks like SQLA sortof implements the same multiople table thing | 19:37 |
| gabriel-bezerra | dstanek: my previous shibboleth2.xml was downloaded from testshib, so it might be somewhat different from the original/example shibboleth2.xml | 19:37 |
| morganfainberg | zzzeek, in code | 19:37 |
| zzzeek | morganfainberg: yeah dont go near that :) | 19:37 |
| morganfainberg | zzzeek, i don't want anything to do with it | 19:37 |
| zzzeek | morganfainberg: it was a thought experiment only and also to get certain folks to leave me alone :) | 19:37 |
| morganfainberg | zzzeek, haha | 19:37 |
| morganfainberg | zzzeek, it scared me | 19:38 |
| zzzeek | morganfainberg: hibernate does it | 19:38 |
| morganfainberg | zzzeek, this is why i'm looking at the RDBMS layer | 19:38 |
| zzzeek | morganfainberg: so there was some pressure to do “everything hibernate does" | 19:38 |
| morganfainberg | zzzeek if it's transparent to us, it's a real win | 19:38 |
| dstanek | gabriel-bezerra: i'll give that a try when i get back to my desk | 19:38 |
| morganfainberg | zzzeek, hah. /me shakes head | 19:38 |
| morganfainberg | zzzeek, but i get it. | 19:38 |
| morganfainberg | zzzeek, thanks i'll bug you if i run into anything major | 19:38 |
| morganfainberg | zzzeek, but i *think* i wont. | 19:38 |
| morganfainberg | zzzeek, the only scary thing is going to be migrates and i think i'm just going to make them collapse the partitons before migrate. | 19:39 |
| morganfainberg | and resplit-out after | 19:39 |
| zzzeek | morganfainberg: OK why is that, alterations have issues ? | 19:39 |
| *** dims has quit IRC | 19:39 | |
| morganfainberg | zzzeek, well if an alter touched a partition column | 19:39 |
| zzzeek | morganfainberg: the new “Batch” migration thing can be used with mysql if you want | 19:39 |
| morganfainberg | erm a column for partitioning | 19:39 |
| zzzeek | morganfainberg: it can copy the data to a new table and drop the old one | 19:39 |
| morganfainberg | i'd be super worried about it. | 19:39 |
| morganfainberg | zzzeek, yeah thats too expensive when i;m talking about millions upon millions of rows | 19:40 |
| zzzeek | morganfainberg: well it is in the background | 19:40 |
| morganfainberg | seeing issues with ~45k-60k rows an hour being generated | 19:40 |
| morganfainberg | at idle | 19:40 |
| morganfainberg | so mitigating the management/cleanup part of that as a stopgap | 19:40 |
| morganfainberg | while we solve the other issues. | 19:40 |
| zzzeek | morganfainberg: sounds a little bit un-SQL like, is this like raw stats data | 19:40 |
| morganfainberg | zzzeek, it's the token table | 19:41 |
| zzzeek | morganfainberg: we should use redis for that :) | 19:41 |
| morganfainberg | zzzeek, someone doing something bad can bloat that table awfully | 19:41 |
| morganfainberg | redis has other overhead issues but yes that is one option i'm going to start pushing people at | 19:41 |
| morganfainberg | once we're 100% at revocation events redis becomes a better story | 19:41 |
| morganfainberg | zzzeek, i want to never persist a token again | 19:42 |
| *** dims has joined #openstack-keystone | 19:42 | |
| morganfainberg | zzzeek, but we have work to get there, and we need to still address the issues with token table bloat for those who can't move to persistentless tokens and use SQL as a backing store. | 19:42 |
| zzzeek | anytime there is “high speed, throwaway key-lookup only”, redis | 19:43 |
| morganfainberg | zzzeek, so - stopgap - and work on better default solutions | 19:43 |
| morganfainberg | :) | 19:43 |
| morganfainberg | zzzeek, i don't disagree. | 19:43 |
| * morganfainberg double negatives it up today | 19:43 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Fixes HEAD return code for OS-INHERIT extension https://review.openstack.org/137782 | 19:52 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API doc for Inherited Role Assignments to Projects https://review.openstack.org/130277 | 19:52 |
| *** dnalezyt has joined #openstack-keystone | 19:53 | |
| topol | morganfainberg, do I need to do anything special to get the discount room at the Hotel Valencia for the Hackathon? | 19:53 |
| morganfainberg | topol, let me give you the code / info | 19:53 |
| morganfainberg | topol, and book it ASAP. | 19:53 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Fixes HEAD return code for OS-INHERIT extension https://review.openstack.org/137782 | 19:54 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API doc for Inherited Role Assignments to Projects https://review.openstack.org/130277 | 19:54 |
| topol | morganfainberg, will book right now | 19:54 |
| morganfainberg | topol, info sent | 19:54 |
| raildo | morganfainberg, Is there some mid cycle "broadcast", for those who can not go? :) | 20:00 |
| morganfainberg | raildo, i am unsure what I'm going to be able to cobble together. i'm hopeing to do a hangout - but no guarantees | 20:01 |
| morganfainberg | jamielennox is likely not goint to be there | 20:01 |
| morganfainberg | so, it would be good to have his input - but the conference phone approach didn't work really well the first mid-cycle | 20:01 |
| morganfainberg | so i'll what i can come up with | 20:02 |
| henrynash | morganfainberg: can I use a code for the valencia as well? If so, could you send it to me? | 20:02 |
| raildo | morganfainberg, great. thank you for thinking about that! | 20:02 |
| morganfainberg | henrynash, absolutely | 20:02 |
| morganfainberg | henrynash, sending | 20:02 |
| *** richm has quit IRC | 20:04 | |
| morganfainberg | ok i'm hopping on a plane soon | 20:10 |
| morganfainberg | will probably be back online once we get to altitude | 20:10 |
| samuelms | morganfainberg, good trip :) | 20:12 |
| *** thedodd has joined #openstack-keystone | 20:21 | |
| *** ayoung has quit IRC | 20:22 | |
| *** nellysmitt has quit IRC | 20:24 | |
| topol | morganfainberg I am all booked up. I chose the champagne on ice welcome gift for the Valencia. Looking fwd to it | 20:31 |
| *** fifieldt_ has quit IRC | 20:32 | |
| morganfainberg | Lol! | 20:32 |
| topol | that option only appears available if you call direct instead of using the web site | 20:32 |
| morganfainberg | I opted to not do the welcome gifts. But - eh. That's cause $ spent there isn't worth it when I can spend it on whiskey with everyone else. | 20:32 |
| morganfainberg | God. Drank so much wine w/ the foundation. | 20:33 |
| morganfainberg | Pretty much the best food / drink I've had at a business trip yet. | 20:33 |
| topol | morganfainberg. Excellent. I will make sure to bring my wallet with me to buy folks drinks too | 20:33 |
| morganfainberg | Getting in the air. Need to jump to airplane mode for a few minutes. | 20:34 |
| *** marcoemorais has joined #openstack-keystone | 20:34 | |
| topol | safe travels | 20:34 |
| *** marcoemorais1 has joined #openstack-keystone | 20:38 | |
| *** marcoemorais has quit IRC | 20:41 | |
| topol | dstanek, you around? | 20:41 |
| dstanek | topol: yep | 20:41 |
| topol | dstanek, YOU ARE AWESOME! | 20:41 |
| dstanek | topol: ? | 20:42 |
| topol | dstanek, I looked at http://paste.openstack.org/show/129171/ | 20:42 |
| topol | dstanek, I promise to root for the browns over the bengals if you make the Keystone DI more palatable :-) | 20:43 |
| dstanek | topol: haha | 20:43 |
| topol | dstanek, RE: https://review.openstack.org/#/c/135931/5/specs/kilo/object-dependency-lifecycle.rst | 20:43 |
| *** thedodd has quit IRC | 20:44 | |
| dstanek | topol: your comment on my other review about Hoyer was dead on and made me laugh | 20:44 |
| topol | dstanek, I was hoping you would appreciate that!!! | 20:45 |
| topol | dstanek time for Johnny football! | 20:45 |
| dstanek | i'm not sure appreciate is the right word to use there | 20:45 |
| topol | dstanek, when I was new to pyhon/Keystone the way Keystone did DI it was so hard to understand the code. Looks like you have a way to do much better | 20:46 |
| topol | dtsanek, so Im excited! | 20:47 |
| *** fifieldt_ has joined #openstack-keystone | 20:48 | |
| *** harlowja has joined #openstack-keystone | 20:53 | |
| bknudson | johnny football. | 20:58 |
| raildo | maybe time for Brian Hoyer :P | 21:00 |
| dstanek | gabriel-bezerra: you still here? | 21:03 |
| dstanek | raildo: ugg | 21:03 |
| gabriel-bezerra | dstanek: yes, I am. | 21:04 |
| dstanek | it was starting to look like having season tickets was becoming worth it because we are guaranteed home playoff tickets (if we want to pay for them), but now there is no hope | 21:04 |
| dstanek | gabriel-bezerra: i did come across an issue where i was getting a 500 from the idp - is there were you were getting yours? | 21:05 |
| gabriel-bezerra | dstanek: it happens when some configuration is wrong or you use a wrong user/password | 21:05 |
| dstanek | ah, ok - i'm just starting to work on that now - i had an issue doing a GET on the IdP | 21:06 |
| dstanek | gabriel-bezerra: ^ | 21:06 |
| gabriel-bezerra | dstanek: can you see the log of the idp? | 21:07 |
| gabriel-bezerra | I could get some information from the idp when I ran: curl http://localhost:8088/metadata | 21:08 |
| dstanek | gabriel-bezerra: yeah, i'm not currently having any IdP issues | 21:08 |
| *** marekd is now known as marekd|away | 21:10 | |
| gabriel-bezerra | dstanek: so, what are you doing and what is (not) working? | 21:11 |
| *** _cjones_ has quit IRC | 21:12 | |
| dstanek | gabriel-bezerra: for me everything is ok so far. i was just wondering if you got the 500 at the same place as me | 21:12 |
| gabriel-bezerra | dstanek: I get an error from the sp, when the browser goes to something like localhost:5000/Shibboleth.sso/SAML/POST | 21:13 |
| *** _cjones_ has joined #openstack-keystone | 21:16 | |
| morganfainberg | sooooooooo slloooooooowwwwww | 21:23 |
| *** tellesnobrega_ has joined #openstack-keystone | 21:24 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Update requests-mock syntax https://review.openstack.org/131380 | 21:29 |
| bknudson | morganfainberg: using gertty? | 21:30 |
| jamielennox | gyee: https://review.openstack.org/#/c/129552/ is the last review for a middleware release, can you have a look? | 21:32 |
| gyee | jamielennox, k, one sec | 21:33 |
| jamielennox | bknudson: https://review.openstack.org/#/c/129935/ isn't a blocker for ksc release but wanghong has a patch waiting for it in middleware, so it'd be good to be in this release and the middleware one can go next release | 21:34 |
| dstanek | gabriel-bezerra: now i'm at "UnknownSystemEntity: http://localhost:5000/shibboleth" | 21:34 |
| jamielennox | you had a -1 i cleared up | 21:34 |
| gyee | jamielennox, how are the plugin opts registered? | 21:36 |
| jamielennox | gyee: auth.register_conf_options(CONF, _AUTHTOKEN_GROUP) line 356 | 21:36 |
| gyee | ah, awesome | 21:37 |
| dstanek | gabriel-bezerra: it looks like i'm stuck on the step right before that | 21:39 |
| *** EmilienM is now known as EmilienM|pto | 21:39 | |
| morganfainberg | dstanek, +2 on the DI spec | 21:41 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Fix passing parameters to log message https://review.openstack.org/140871 | 21:48 |
| jamielennox | gyee: thanks for that, can you have a quick look at https://review.openstack.org/#/c/129935/ as well? it's simple | 21:49 |
| gyee | jamielennox, looking | 21:50 |
| *** andreaf has joined #openstack-keystone | 21:50 | |
| *** gordc has quit IRC | 21:51 | |
| jamielennox | hmm, there's two more that have the bknudson +2 but they're not urgent | 21:52 |
| gyee | jamielennox, with these two, we should be able to configure v3 auth for the service users for token validation I presume | 21:54 |
| jamielennox | gyee: yep! | 21:54 |
| gyee | U | 21:54 |
| gyee | DA | 21:54 |
| gyee | MAN! | 21:54 |
| gyee | when are we cutting a release? | 21:55 |
| jamielennox | need to do some work in the plugins to allow client cert auth plugins, but that's where it'll be interesting | 21:55 |
| jamielennox | gyee: morganfainberg wanted to do it last week | 21:55 |
| dstanek | morganfainberg: excellent! | 21:55 |
| jamielennox | gyee: https://review.openstack.org/#/c/130754/ and https://review.openstack.org/#/c/131048/ are trivial if you want to clean up my review board | 21:56 |
| gyee | jamielennox, I was looking at the code, didn't seem we have the x509 binding part implemented | 21:56 |
| jamielennox | gyee: no, i've been thinking about binding again in regards to x-service-token | 21:56 |
| gyee | also, binding fingerprint is PITA as it is not conveyed by mod_ssl | 21:57 |
| jamielennox | and how we would do that in the plugins | 21:57 |
| gyee | we should bind issuer and serial number instead | 21:57 |
| jamielennox | gyee: yep, that's why it wasn't done, have to use issuer serial but i much prefer fingerprint | 21:57 |
| gyee | subject dn, issuer dn, and serial number should uniquely identify a cert | 21:57 |
| jamielennox | there's a few ways to do it | 21:57 |
| gyee | we can optionally have fingerprint, but it would be just a straight hash of the cert blob | 21:58 |
| jamielennox | gyee: yea, i guess we can have multiple options and the enforcer just does what it can | 21:59 |
| gyee | yeah, I like options | 21:59 |
| gyee | with hash, we still have a chance of collision | 22:00 |
| *** dims has quit IRC | 22:00 | |
| jamielennox | so i'm wondering if we can only enforce token bind on X-Subject-Token and ignore bind on X-Auth-Token if present? | 22:00 |
| gyee | but the possibility is so remote that it is inconsequential | 22:00 |
| *** dims has joined #openstack-keystone | 22:01 | |
| gyee | no | 22:01 |
| jamielennox | this would mean that nova->cinder for example we would only check the binding of the nova service token | 22:01 |
| gyee | subject is not globally unique | 22:01 |
| jamielennox | gyee: not cert subject, X-Subject-TOken | 22:01 |
| morganfainberg | jamielennox, i expect i'll be able to do release [my availability] either tonight or next week [i wont do it on a friday] | 22:01 |
| gyee | oh | 22:01 |
| *** Adam_ has joined #openstack-keystone | 22:01 | |
| morganfainberg | jamielennox, it can wait till next week though easily | 22:01 |
| *** Adam_ is now known as ayoung__ | 22:02 | |
| *** radez is now known as radez_g0n3 | 22:02 | |
| jamielennox | morganfainberg: sure, i need a release soon but next week is fine | 22:02 |
| ayoung__ | so...upgrading to F21...did not go smoothly. Due, I think to python dependencies messed up by devstack installs | 22:02 |
| jamielennox | morganfainberg: also it's already my friday so if i need to look at things next week is better | 22:02 |
| morganfainberg | right. let me see how things are going when i'm settled after this flight. | 22:03 |
| morganfainberg | jamielennox, fair enough, if anything we can plan post meeting tuesday | 22:03 |
| gyee | morganfainberg, ++ | 22:03 |
| gyee | I don't think we'll get the cert plugin implmenented by next week anyway | 22:03 |
| morganfainberg | jamielennox, that'll give me a chance to do the relmanagement stuff like creating the milestones and tagging stuff to it. | 22:04 |
| jamielennox | gyee: no, we need a way for the auth plugin to modify the send parameters of a request | 22:04 |
| jamielennox | i haven't got that yet | 22:05 |
| jamielennox | gyee: https://blueprints.launchpad.net/python-keystoneclient/+spec/generic-plugins | 22:05 |
| *** dims has quit IRC | 22:05 | |
| gyee | ah, i c | 22:06 |
| jamielennox | https://review.openstack.org/#/c/140894/ is the headers part - which is really the difficult bit | 22:07 |
| jamielennox | the connect params bit is just another function | 22:07 |
| jamielennox | but i need https://review.openstack.org/#/c/137864/ to go in the same release to make it work | 22:08 |
| jamielennox | actually maybe ^ needs to be in this release so that it's available before we change the interface next release | 22:08 |
| morganfainberg | jamielennox, there was a bug for nova on it passing a token to cinderclient | 22:09 |
| morganfainberg | and the token expired and there was no story to refresh the credendials | 22:09 |
| gyee | jamielennox, I suppose the security folks won't get freak out on potential "header-injection" problem :) | 22:09 |
| morganfainberg | so user -> nova -> [cinderclient] -> cinder | 22:09 |
| morganfainberg | jamielennox, i left some comments on it, but if you have any extra thoughts it would be appreciated /me digs up the bug | 22:10 |
| jamielennox | morganfainberg: link? i just saw some people complaining about it in #openstack-cinder | 22:10 |
| morganfainberg | https://bugs.launchpad.net/nova/+bug/1401437 | 22:10 |
| uvirtbot | Launchpad bug 1401437 in nova "nova passes incorrect authentication info to cinderclient" [High,Confirmed] | 22:10 |
| jamielennox | crap | 22:10 |
| bknudson | this bug has been around forever. | 22:11 |
| *** marcoemorais1 has quit IRC | 22:12 | |
| bknudson | and we tell them to use trusts or something. | 22:12 |
| jamielennox | i don't see that code called at all | 22:12 |
| *** andreaf has quit IRC | 22:13 | |
| morganfainberg | my comments are based on conversation w/ sdague | 22:14 |
| morganfainberg | about what *is* going on | 22:14 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix disabling entities when enabled is ignored https://review.openstack.org/141101 | 22:15 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add tests for enabled attribute ignored https://review.openstack.org/140895 | 22:15 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add test for update role without name https://review.openstack.org/141185 | 22:15 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix update role without name using LDAP https://review.openstack.org/141186 | 22:15 |
| bknudson | nova accepts a token and passes it to cinder. if the token expires then nova just passed a bad token to cinder. | 22:16 |
| bknudson | I assume that's the problem. | 22:16 |
| morganfainberg | sure "trusts" are an answer. | 22:16 |
| morganfainberg | bknudson, basically | 22:16 |
| bknudson | I think there was some discussion on the mailing list... | 22:16 |
| bknudson | -dev | 22:16 |
| morganfainberg | bknudson, there has been a lot of discussion on this | 22:17 |
| jamielennox | I don't understand that bug, the code he mentions is never calle | 22:17 |
| jamielennox | i got the nova->cinder code with sessions commited a week or so ago | 22:17 |
| bknudson | my suggestion was that keystone should make this easier by allowing a token expiration to be extended. | 22:17 |
| morganfainberg | bknudson, more and more i'm coming to the conclusion that is the only option that will be backwards compat | 22:18 |
| morganfainberg | bknudson, but that is a drastic departure from our previous stance(s) and I want to be very careful about allowing that kind of stuff to occur. | 22:18 |
| jamielennox | we could give some leeway that if X-Subject-Token is valid then we allow some period of expired X-Auth-Token | 22:18 |
| bknudson | we should be able to limit it to service users. | 22:18 |
| morganfainberg | jamielennox, that was my prefeered option i *think* we can do that in policy | 22:19 |
| jamielennox | but i don't know if it's just going to be an issue of continually extending that window | 22:19 |
| morganfainberg | jamielennox, and the nice thing is if someone wants to lock that out, it's an easy change - deployer option. and it would be per-api not globally | 22:19 |
| bknudson | problem is we don't know how long it's going to take. | 22:19 |
| jamielennox | bknudson: maybe we don't check it at all? | 22:19 |
| morganfainberg | bknudson, some API calls we may have a "don't check expires only revoked"? | 22:20 |
| morganfainberg | oh god that doesn't work. | 22:20 |
| bknudson | nasty | 22:20 |
| morganfainberg | i'm planning on implementing a mass-cleanup that would purge any expired tokens quickly from the db | 22:20 |
| jamielennox | bknudson: assume that the first person to add X-Subject-Token validated that the X-Auth-Token was not expired, then auth_token only enforces the X-Subject-Token expiry from then on | 22:20 |
| morganfainberg | we could make the UX even worse. an explicit extend would be better | 22:20 |
| morganfainberg | that way we can avoid "oops i purged an expired token" | 22:20 |
| morganfainberg | and a bunch of stuff fails | 22:21 |
| jamielennox | oh - true, keystone won't return a token body if it is expired | 22:21 |
| morganfainberg | and in memcached or redis that wouldn't *really* work unless PKI and not using horizon | 22:21 |
| morganfainberg | since memcached and redis would automatically drop the expired tokens | 22:21 |
| morganfainberg | fyi i might miss a couple comments here wireless in flight has been a bit flaky | 22:22 |
| morganfainberg | s/comments/irc messages | 22:22 |
| bknudson | complain to the stewardess. | 22:22 |
| morganfainberg | haha | 22:22 |
| bknudson | you'll probably get thrown off | 22:23 |
| gyee | bknudson, no, you would ground the flight like Korean Airlines :) | 22:23 |
| morganfainberg | bknudson, so what is our exposure for allowing explicit extends of the token? | 22:23 |
| morganfainberg | bknudson, if you've thought about it at all | 22:23 |
| bknudson | morganfainberg: I think we need to provide limits on it... e.g., user needs to have a role. | 22:24 |
| bknudson | then they can limit it to service users | 22:24 |
| morganfainberg | and we'd need to extend the token *early* preferably before it's actually expired - because once expired it could be purged | 22:24 |
| bknudson | and there's probably a limit on how long they can extend it. | 22:24 |
| morganfainberg | and then we're again in the same / worse state | 22:24 |
| *** nellysmitt has joined #openstack-keystone | 22:24 | |
| bknudson | nova can extend it as soon as it gets the token. | 22:25 |
| morganfainberg | bknudson, yeah that was my thought | 22:25 |
| bknudson | and also reject a token that's about to expire. | 22:25 |
| morganfainberg | this is starting to sound a lot like the service composite token workflow(s) i proposed before we added the service token concept to middleware instead | 22:25 |
| bknudson | maybe auth token could reject a token that's about to expire. | 22:25 |
| *** dims__ has joined #openstack-keystone | 22:26 | |
| bknudson | yes, maybe require service token. | 22:26 |
| bknudson | but that's in auth_token... I don't think keystone needs the concept | 22:26 |
| morganfainberg | bknudson, i want to get auth_token out of makeing those types of calls - i'd rather have services complain than auth token needing to outsmart or guess on the user's behalf | 22:26 |
| bknudson | that's the x-auth-token... x-subject-token is the one getting extended | 22:26 |
| morganfainberg | yeah. | 22:26 |
| morganfainberg | that makes sense to me | 22:26 |
| gyee | composite tokens? | 22:26 |
| morganfainberg | gyee, not really composite | 22:27 |
| morganfainberg | gyee, this would be a service user *could* ask for a token to have a longer TTL because it knows it's going to perform an operation that will need more time | 22:27 |
| morganfainberg | bknudson, this really is just getting an extended life sub-token based on the user's token | 22:27 |
| gyee | morganfainberg, right, service user can extend the token | 22:27 |
| morganfainberg | bknudson, because in PKI the token expiry would change the hash | 22:27 |
| morganfainberg | gyee, but yeah the workflow is a *lot* like the composite token workflow, just without combining the tokens | 22:28 |
| gyee | yeah, I think trust is a bit overkill as user will need to setup a ton of trusts | 22:29 |
| openstackgerrit | Merged openstack/python-keystoneclient: Expose version matching functions to the public https://review.openstack.org/129935 | 22:29 |
| morganfainberg | and this circles back again to being able to ask: To perform X task, what roles do I need? | 22:30 |
| jamielennox | morganfainberg: if we allowed keystone to return expired tokens (with some sort of flag) couldn't we have the same thing handled on the client? | 22:30 |
| *** nellysmitt has quit IRC | 22:30 | |
| jamielennox | We need to figure out what providing an X-Subject-Token means | 22:30 |
| jamielennox | X-Service-Token? | 22:30 |
| gyee | right | 22:31 |
| morganfainberg | jamielennox, yes we could. - we'd need to think about how we handle the token cleanup and adjust how expiry works in memcached and redis etc | 22:31 |
| jamielennox | because i think it changes the flow of auth more than we have it now | 22:31 |
| morganfainberg | jamielennox, this might break anyone with a custom token provider | 22:31 |
| morganfainberg | since the assumption cannot be made that a token that is expired will be returned | 22:31 |
| gyee | <---- it would break this guy :) | 22:31 |
| jamielennox | no one cares about that guy ^ | 22:32 |
| morganfainberg | and it *could* cause issues for folks who actually depend on that 404 | 22:32 |
| gyee | oh fug | 22:32 |
| *** andreaf has joined #openstack-keystone | 22:32 | |
| morganfainberg | so i think returning expired tokens ever at this point is a bad idea. | 22:32 |
| morganfainberg | i'd rather the sub-token workflow | 22:32 |
| jamielennox | morganfainberg: so from a REST api we would have to add a new flag or something | 22:32 |
| morganfainberg | jamielennox, this also is a schema change in the token table | 22:33 |
| jamielennox | you can't just change the behaviour of a 404 | 22:33 |
| morganfainberg | something i've been trying very hard to limit | 22:33 |
| jamielennox | schema change? | 22:33 |
| morganfainberg | jamielennox, right. | 22:33 |
| gyee | 404? | 22:33 |
| jamielennox | gyee: a 404 is returned if auth_token tries to validate an expired UUId token | 22:34 |
| morganfainberg | jamielennox, get_token?expired_ok=True | 22:34 |
| morganfainberg | get_token?expired_window=<seconds> | 22:34 |
| jamielennox | right - but that's not a schema change | 22:34 |
| morganfainberg | we still would need a way to prevent tokens from being purged aggressively | 22:34 |
| jamielennox | yep | 22:34 |
| morganfainberg | while they're still in use - meaning a new token issued probably is a *lot* easier. | 22:34 |
| morganfainberg | or... trusts... | 22:35 |
| morganfainberg | jamielennox, how do you prevent a token from being purged in a cleanup? | 22:36 |
| morganfainberg | jamielennox, yes it would be | 22:36 |
| *** timcline_ has joined #openstack-keystone | 22:36 | |
| jamielennox | the fact that a service can setup a trust on behalf of a user and just use that info forever always concerns me | 22:36 |
| morganfainberg | jamielennox, you'd need to have a way of preventing an in-use expired token from being purged | 22:36 |
| gyee | but how does user know expired_ok? | 22:36 |
| jamielennox | morganfainberg: wouldn't that just be a window on the purge | 22:36 |
| morganfainberg | jamielennox, actually this wont work with the token cleanup thing i'm working on, because i'm looking at doing a drop partition where the partition would be something like expires(NOW() - (ttl+fudge_factor)) | 22:37 |
| jamielennox | DELETE * WHERE expired > NOW() + hour | 22:37 |
| *** marcoemorais has joined #openstack-keystone | 22:37 | |
| morganfainberg | jamielennox, drop/truncate wont inspect the data | 22:37 |
| morganfainberg | at all | 22:37 |
| gyee | UX would suck right, if I have to add that flag every time I request a toke to talk to nova | 22:37 |
| jamielennox | gyee: no - the only thing it would afffect is auth_token middleware | 22:37 |
| morganfainberg | either trusts or sub-token (new token w/ extended life) would be the only options | 22:37 |
| *** stevemar has joined #openstack-keystone | 22:38 | |
| *** ChanServ sets mode: +v stevemar | 22:38 | |
| morganfainberg | gyee, this might be a case where the token should be locked to nova somehow? constrained to come from that service user? | 22:38 |
| morganfainberg | jamielennox, ^ | 22:38 |
| morganfainberg | bknudson, ^ | 22:39 |
| morganfainberg | if we do it that way | 22:39 |
| *** timcline has quit IRC | 22:39 | |
| gyee | morganfainberg, it may work | 22:39 |
| gyee | transparent to the user | 22:39 |
| bknudson | why? | 22:39 |
| bknudson | I don't think we should say how nova has to be implemented. | 22:39 |
| *** marcoemorais1 has joined #openstack-keystone | 22:40 | |
| gyee | bknudson, nova extend the life of the token on behave of the user | 22:40 |
| bknudson | right, it did that so it can pass the token to other services. | 22:40 |
| bknudson | the other service might want to extend it again and pass it off again. | 22:40 |
| morganfainberg | bknudson, it doesn't solve the issue(s) i was thinking - was thinking MITM - but MITM would grab anything nova has to auth itself as well (short of some krb5 type magic) | 22:40 |
| *** timcline_ has quit IRC | 22:40 | |
| morganfainberg | and tokens, even service tokens, are bearer | 22:40 |
| gyee | use x.509 then | 22:41 |
| jamielennox | bknudson: right - if we allow these extensions bound to a service then anyone receiving that token to talk to another service would need to fetch another sub-token | 22:41 |
| morganfainberg | gyee, deployer option. | 22:41 |
| bknudson | if we need to solve the MITM / bearer token issue then I think that's a separate issue | 22:41 |
| *** topol has quit IRC | 22:41 | |
| morganfainberg | bknudson, right i'm fine with ignoring that | 22:41 |
| bknudson | we seem to be just trying to make things complicated | 22:41 |
| morganfainberg | bknudson, so back to: a) trusts | 22:41 |
| *** marcoemorais has quit IRC | 22:41 | |
| bknudson | which, unfortunately, never makes things more secure | 22:41 |
| morganfainberg | b) nova can request an extended life token. | 22:42 |
| gyee | bknudson, you want secure, and usable? :) | 22:42 |
| bknudson | I have no problem with trusts but seems like overkill | 22:43 |
| jamielennox | morganfainberg: the only way i can see to do that *relatively* securely is to allow policy to specify which calls are allowed to be made with those extended | 22:43 |
| morganfainberg | bknudson, it does - but it *does* solve the issue. it just isn't very usable | 22:43 |
| jamielennox | tokens and we don't know what they will be | 22:43 |
| bknudson | things "worked" fine when we had long lived tokens (like, 2 days) | 22:43 |
| morganfainberg | bknudson, sortof but they did work better | 22:43 |
| bknudson | and I think a lot of deployments just set the token lifetime to 2 days. | 22:44 |
| gyee | its about risk management | 22:44 |
| gyee | k, y'all, gotta run, be back later | 22:45 |
| *** gyee has quit IRC | 22:45 | |
| morganfainberg | bknudson, we could set the default token TTL back to 86400 | 22:45 |
| morganfainberg | i think nothing was really broken around that point | 22:46 |
| * morganfainberg doesn't like that though. | 22:46 | |
| morganfainberg | and it does make things look questionable when we're reversing opinion on security vs usability vs <whatever we said in the past> | 22:46 |
| bknudson | the reason we went to a shorter token time is to find these issues. | 22:47 |
| morganfainberg | yeah | 22:47 |
| bknudson | once we find them we should be figuring out how to fix it | 22:47 |
| morganfainberg | i'd rather have a *clean* way to fix than just revert the TTL | 22:47 |
| morganfainberg | but it is an option. | 22:47 |
| * morganfainberg will mull on this some. | 22:48 | |
| *** dims__ has quit IRC | 22:49 | |
| *** dims__ has joined #openstack-keystone | 22:50 | |
| *** dims__ has quit IRC | 22:54 | |
| *** henrynash has quit IRC | 22:57 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix disabling entities when enabled is ignored https://review.openstack.org/141101 | 22:58 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix update role without name using LDAP https://review.openstack.org/141186 | 22:58 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add tests for enabled attribute ignored https://review.openstack.org/140895 | 22:58 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add test for update role without name https://review.openstack.org/141185 | 22:58 |
| *** stevemar has quit IRC | 23:00 | |
| *** thedodd has joined #openstack-keystone | 23:12 | |
| *** ayoung__ has quit IRC | 23:12 | |
| *** andreaf has quit IRC | 23:14 | |
| *** dnalezyt has quit IRC | 23:20 | |
| openstackgerrit | Anne Gentle proposed openstack/identity-api: Indicate repo is frozen in README https://review.openstack.org/141208 | 23:20 |
| *** tellesnobrega has quit IRC | 23:30 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone-specs: Read/Write LDAP drivers https://review.openstack.org/140175 | 23:34 |
| *** thedodd has quit IRC | 23:34 | |
| *** henrynash has joined #openstack-keystone | 23:37 | |
| *** ChanServ sets mode: +v henrynash | 23:37 | |
| *** tellesnobrega has joined #openstack-keystone | 23:42 | |
| *** dims__ has joined #openstack-keystone | 23:47 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Log the CA cert with the debug statement https://review.openstack.org/130754 | 23:49 |
| *** shakamunyi has quit IRC | 23:49 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 23:52 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Remove kwargs from Session.request https://review.openstack.org/141218 | 23:52 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!