| morganfainberg | dstanek, and i'm seeing changes in the API doc. | 00:00 |
|---|---|---|
| morganfainberg | lbragstad, ping, cc ^ | 00:00 |
| morganfainberg | https://review.openstack.org/#/c/138552/14 still has API Doc open: https://review.openstack.org/#/c/130277/ | 00:01 |
| morganfainberg | totally my mistake here. | 00:01 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Revert "Inherited role assignments to projects" https://review.openstack.org/141674 | 00:05 |
| morganfainberg | dstanek, lbragstad, rodrigods, ^ see my comment on the review. | 00:08 |
| morganfainberg | jamielennox, did michael still get ahold of you? | 00:08 |
| jamielennox | morganfainberg: yea, he reached out - had to turn him down though | 00:08 |
| morganfainberg | jamielennox, boo. | 00:09 |
| jamielennox | shame - could have been fun | 00:09 |
| morganfainberg | yeah | 00:09 |
| rodrigods | morganfainberg, ok... so I'll work to make it ready to ship ASAP. Tomorrow morning will address the current comments and ping you later. But until now, we haven't any suggestions to change the "format" of the API | 00:16 |
| morganfainberg | rodrigods, yeah just a heads up that if it can't get in by say tuesday i'm going to want to do the revert for k1 | 00:17 |
| morganfainberg | rodrigods, sorry that was totally my fault. | 00:17 |
| morganfainberg | i should have seen the API doc. | 00:17 |
| rodrigods | morganfainberg, no problem, we absolutely want it to ship until k-1, so it will be my number 1 priority | 00:18 |
| morganfainberg | rodrigods, great. thanks - i know i want it in K1 as well | 00:18 |
| morganfainberg | but w/o the API-Doc i'm worried we ship something that doesn't match the specification | 00:19 |
| morganfainberg | if the aPI doc changes between k1 and such | 00:19 |
| rodrigods | morganfainberg, yes, you are right | 00:20 |
| rodrigods | morganfainberg, btw (my other priority), any news about the policy lib graduation? | 00:21 |
| morganfainberg | rodrigods, i'm actually on an airplane as we speak, but it is on my list for this week. | 00:22 |
| rodrigods | morganfainberg, ah, ok... thanks | 00:22 |
| rodrigods | morganfainberg, have a good flight | 00:22 |
| morganfainberg | trying to :) | 00:22 |
| morganfainberg | somewhere over ohio at the moment i think. | 00:22 |
| rodrigods | heh :) | 00:23 |
| *** zz_avozza is now known as avozza | 00:23 | |
| *** avozza is now known as zz_avozza | 00:33 | |
| jamielennox | morganfainberg: was anyone stepping up to handle that? | 00:35 |
| morganfainberg | jamielennox, the talk? | 00:35 |
| morganfainberg | not sure | 00:35 |
| jamielennox | the talk sure - but i meant the policy lib | 00:35 |
| jamielennox | last i heard it needed to be done but noone had been tasked | 00:37 |
| jamielennox | morganfainberg: or did oslo agree to take it? | 00:37 |
| morganfainberg | oh policy? | 00:38 |
| morganfainberg | we're leaving it in oslo | 00:38 |
| morganfainberg | but i'm still going to take on the lead for the library core team | 00:38 |
| morganfainberg | and mostly keystone folks will (likely) join in. | 00:38 |
| jamielennox | morganfainberg: cool - that makes sense, will review when it's available | 00:39 |
| *** dimsum__ has joined #openstack-keystone | 00:46 | |
| *** oomichi_ has joined #openstack-keystone | 00:46 | |
| morganfainberg | jamielennox, i think it's all ready just needs some blessings of "this is actually good" | 00:51 |
| jamielennox | morganfainberg: i want it to work directly with a new interface i've done | 00:51 |
| jamielennox | which is really not hard | 00:51 |
| jamielennox | and can just be a new function | 00:52 |
| morganfainberg | well policy is graduating *as is* to start. | 00:52 |
| morganfainberg | then we can add what is needed | 00:52 |
| morganfainberg | hm. | 00:52 |
| morganfainberg | what time is it in the UK /me checks | 00:52 |
| jamielennox | morganfainberg: it's just the engine so that's fine | 00:52 |
| jamielennox | morganfainberg: late | 00:52 |
| morganfainberg | way late | 00:53 |
| morganfainberg | like... midnight + | 00:53 |
| morganfainberg | i need to bug henrynash about https://bugs.launchpad.net/keystone/+bug/1398347 | 00:53 |
| uvirtbot | Launchpad bug 1398347 in keystone "LDAP backend should do filtered query instead of getting all data and then filtering" [Undecided,New] | 00:53 |
| morganfainberg | jamielennox, oh i could use your eyes on a tripleo change | 00:53 |
| jamielennox | morganfainberg: shoot | 00:53 |
| morganfainberg | jamielennox, i keep feeling like this change is wrong somehow...but plane + stuff is making it hard to say where | 00:53 |
| morganfainberg | jamielennox, https://review.openstack.org/#/c/138246/ | 00:54 |
| *** tylerdurden has quit IRC | 00:54 | |
| morganfainberg | i feel like this type of "work around" shouldn't be needed. | 00:55 |
| *** shakamunyi has joined #openstack-keystone | 00:55 | |
| jamielennox | morganfainberg: ugh, i hate this issue | 00:57 |
| morganfainberg | yeah | 00:57 |
| jamielennox | so it's largely solved | 00:57 |
| jamielennox | and actually there it shouldn't matter | 00:57 |
| morganfainberg | it is clearly mattering some, else they wouldn't have aimed to "fix" it | 00:57 |
| jamielennox | Discover() will just give you back the urls that you get from GET :5000 / | 00:57 |
| jamielennox | discover doesn't handle any hacking around v2/v3 it's not the right place | 00:58 |
| jamielennox | morganfainberg: it looks like what is happening is they are passing an auth_url with a /v2.0 suffix, discovery is failing to find a /v3 endpoint (because it's at /v2.0) so they just arbitrarily replace /v2.0 with /v3 | 00:59 |
| morganfainberg | right. | 00:59 |
| jamielennox | morganfainberg: would be solved by using plugins/session | 01:00 |
| morganfainberg | sure, so - need to get them there. | 01:00 |
| morganfainberg | unfortunately, i think this is the stopgap :( | 01:00 |
| jamielennox | morganfainberg: ah - so they're caching the auth_ref, this is the problem that plugins don't handle well yet | 01:01 |
| morganfainberg | yeah | 01:01 |
| jamielennox | it's easy to fix from that client perspective | 01:01 |
| jamielennox | but i don't know how to handle it well from client | 01:01 |
| jamielennox | morganfainberg: is this monty's configuration library/ | 01:03 |
| morganfainberg | this is triple-o related i think | 01:03 |
| jamielennox | unifying CLI options by file | 01:03 |
| morganfainberg | but it might be that | 01:03 |
| morganfainberg | jamielennox, https://github.com/openstack/os-collect-config | 01:04 |
| morganfainberg | ahhh | 01:05 |
| morganfainberg | it's meant to run for heat: https://wiki.openstack.org/wiki/OsCollectConfig | 01:05 |
| jamielennox | morganfainberg: commented | 01:06 |
| morganfainberg | thanks | 01:07 |
| jamielennox | I need a "it works with sessions" hotkey | 01:07 |
| *** rushiagr_away is now known as rushiagr | 01:09 | |
| *** Shohei has joined #openstack-keystone | 01:09 | |
| *** Shohei has quit IRC | 01:10 | |
| *** Shohei has joined #openstack-keystone | 01:10 | |
| *** boris-42 has quit IRC | 01:13 | |
| *** samuelms_ has joined #openstack-keystone | 01:15 | |
| *** jacer_huawei has quit IRC | 01:20 | |
| *** stevemar has joined #openstack-keystone | 01:20 | |
| *** ChanServ sets mode: +v stevemar | 01:20 | |
| *** zz_avozza is now known as avozza | 01:27 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add generic auth plugin documentation https://review.openstack.org/141680 | 01:27 |
| *** ncoghlan has joined #openstack-keystone | 01:29 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add auth plugin params to doc https://review.openstack.org/141681 | 01:30 |
| *** jacer_huawei has joined #openstack-keystone | 01:32 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Document the auth plugins that are loadable by name https://review.openstack.org/141683 | 01:32 |
| *** samuelms_ has quit IRC | 01:47 | |
| *** samuelms_ has joined #openstack-keystone | 01:48 | |
| *** samuelms_ has quit IRC | 02:05 | |
| *** erkules_ has joined #openstack-keystone | 02:07 | |
| *** erkules has quit IRC | 02:09 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Fix up types within API documentation https://review.openstack.org/141693 | 02:18 |
| *** diegows has quit IRC | 02:34 | |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: _get_token_expiration should return isotime https://review.openstack.org/140984 | 02:35 |
| *** chrisshattuck has joined #openstack-keystone | 02:48 | |
| *** KanagarajM has joined #openstack-keystone | 02:49 | |
| *** nellysmitt has joined #openstack-keystone | 03:34 | |
| openstackgerrit | Merged openstack/keystone: Remove database setup duplication https://review.openstack.org/126734 | 03:39 |
| *** nellysmitt has quit IRC | 03:39 | |
| *** oomichi_ has quit IRC | 03:50 | |
| *** rushiagr is now known as rushiagr_away | 03:51 | |
| *** ayoung has quit IRC | 03:52 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes a type check to make it work in Python 3 https://review.openstack.org/125410 | 03:58 |
| openstackgerrit | David Stanek proposed openstack/keystone: Updates Python3 requirements https://review.openstack.org/130579 | 03:58 |
| openstackgerrit | David Stanek proposed openstack/keystone: Mocks out the memcache library for tests https://review.openstack.org/125409 | 03:58 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a fork of python-ldap for Py3 testing https://review.openstack.org/95827 | 03:58 |
| *** Shohei has joined #openstack-keystone | 04:00 | |
| *** lhcheng has joined #openstack-keystone | 04:02 | |
| *** chrisshattuck has quit IRC | 04:05 | |
| *** rushiagr_away is now known as rushiagr | 04:23 | |
| *** lhcheng has quit IRC | 04:24 | |
| *** lhcheng has joined #openstack-keystone | 04:24 | |
| *** dimsum__ has quit IRC | 04:25 | |
| *** lhcheng has quit IRC | 04:29 | |
| openstackgerrit | David Stanek proposed openstack/keystone: WiP: Script to sync oslo https://review.openstack.org/114305 | 04:43 |
| *** rm_work is now known as rm_work|away | 04:54 | |
| *** boris-42 has joined #openstack-keystone | 05:01 | |
| *** avozza is now known as zz_avozza | 05:03 | |
| *** stevemar has quit IRC | 05:16 | |
| *** lhcheng has joined #openstack-keystone | 05:25 | |
| *** lhcheng has quit IRC | 05:30 | |
| *** nellysmitt has joined #openstack-keystone | 05:36 | |
| *** nellysmitt has quit IRC | 05:40 | |
| *** jasondotstar has quit IRC | 05:54 | |
| *** KanagarajM has quit IRC | 06:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:05 |
| *** jacer_huawei is now known as wanghong | 06:06 | |
| *** ajayaa has joined #openstack-keystone | 06:08 | |
| *** jraim has quit IRC | 06:26 | |
| *** jraim_ has joined #openstack-keystone | 06:26 | |
| *** lhcheng has joined #openstack-keystone | 06:36 | |
| *** ncoghlan has quit IRC | 06:48 | |
| morganfainberg | jamielennox, have something to talk to you about for KSC tomorrow. | 07:04 |
| morganfainberg | from the ux perspective | 07:05 |
| morganfainberg | will ping ya tomorrow on it | 07:05 |
| *** nellysmitt has joined #openstack-keystone | 07:36 | |
| *** nellysmitt has quit IRC | 07:41 | |
| *** erkules_ is now known as erkules | 07:55 | |
| *** k4n0 has joined #openstack-keystone | 08:25 | |
| *** nellysmitt has joined #openstack-keystone | 08:37 | |
| *** zz_avozza is now known as avozza | 08:44 | |
| openstackgerrit | wanghong proposed openstack/keystone: don't allow user to operate role on disabled proj or domain https://review.openstack.org/141746 | 08:51 |
| *** i159 has joined #openstack-keystone | 09:19 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Fix the way migration helpers check FK names. https://review.openstack.org/138468 | 09:22 |
| *** dimsum__ has joined #openstack-keystone | 09:29 | |
| *** bjornar has joined #openstack-keystone | 09:31 | |
| *** dimsum__ has quit IRC | 09:34 | |
| openstackgerrit | Merged openstack/pycadf: sync oslo https://review.openstack.org/138381 | 09:44 |
| *** lhcheng has quit IRC | 09:50 | |
| *** lhcheng has joined #openstack-keystone | 09:51 | |
| *** bdossant has joined #openstack-keystone | 09:51 | |
| *** aix has joined #openstack-keystone | 09:52 | |
| *** bdossant has quit IRC | 09:55 | |
| *** bdossant has joined #openstack-keystone | 09:55 | |
| *** samuelms_ has joined #openstack-keystone | 10:00 | |
| *** andreaf has joined #openstack-keystone | 10:07 | |
| marekd | samuelms_: hey | 10:14 |
| *** avozza is now known as zz_avozza | 10:15 | |
| *** zz_avozza is now known as avozza | 10:16 | |
| *** avozza is now known as zz_avozza | 10:17 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: unified policy file https://review.openstack.org/134656 | 10:19 |
| samuelms_ | marekd, morning | 10:20 |
| marekd | samuelms_: hey | 10:20 |
| marekd | i have a couple of questions about https://review.openstack.org/#/c/133855/9/specs/kilo/domain-roles.rst | 10:21 |
| samuelms_ | marekd, sure | 10:21 |
| marekd | and you are one of contributors, according to the spec, right? | 10:21 |
| samuelms_ | marekd, yep | 10:21 |
| marekd | samuelms_: great. so long story short the purpose of the spec is to make a domain roles that can act as a 'bags' (being a superset) of other classic roles we have today, right? | 10:22 |
| samuelms_ | marekd, they'll be a group of the global roles (classic as you said) and will be able to contain other domain roles as well | 10:23 |
| samuelms_ | marekd, further, they are owned by domains | 10:23 |
| samuelms_ | marekd, meaning domain-admins can define their own set of roles | 10:23 |
| samuelms_ | marekd, that are meaningful to them | 10:23 |
| marekd | samuelms_: ok, so. | 10:23 |
| marekd | so, today, roles can be created only by global, cloud admins | 10:24 |
| marekd | and they are globally scoped | 10:24 |
| marekd | right? | 10:24 |
| samuelms_ | yep | 10:24 |
| marekd | samuelms_: waht about role assignments? | 10:24 |
| samuelms_ | marekd, we'll be able to assign domain-roles as well | 10:25 |
| marekd | samuelms_: no, i am asking about current capabilities. | 10:25 |
| samuelms_ | marekd, but when issuing a token, we convert those domain-roles into global roles | 10:25 |
| samuelms_ | marekd, about current capabilities? about what we can do with role assignments? | 10:26 |
| samuelms_ | marekd, not sure I understood your question | 10:26 |
| marekd | let's forget about the spec for now | 10:27 |
| samuelms_ | ok | 10:28 |
| samuelms_ | marekd, so that the current role assignments are for global roles | 10:28 |
| marekd | samuelms_: so, roles can be added by modyfiung policy.json file and only by a cloud admin, not domain admins. What about role assignments - can *domain* admins add some role assignments to any users within their domains? | 10:28 |
| samuelms_ | marekd, in fact we dont add roles into the policy, we add them via api | 10:29 |
| marekd | sorry, rules | 10:29 |
| samuelms_ | marekd, but they'll be just names so far right? | 10:29 |
| samuelms_ | marekd, in the policy we define *what* a role can do | 10:29 |
| samuelms_ | marekd, I think that's what you mean | 10:29 |
| marekd | samuelms_: yes, my mistake. | 10:29 |
| samuelms_ | marekd, but how the domain admin sets what his own role can do? (his domain-role)? | 10:30 |
| samuelms_ | marekd, it depends on the other roles it contains | 10:30 |
| marekd | samuelms_: what can i do with my domain-scoped role at the moment? | 10:30 |
| marekd | can i create a project withing this domain ? | 10:31 |
| marekd | remove it? | 10:31 |
| samuelms_ | marekd, well, I think so.. you can do whatever you want with a role by configuring your own policy file | 10:31 |
| marekd | no, but lets say i am domain-admin only | 10:31 |
| marekd | and i cannot edit policy.json | 10:32 |
| marekd | cause i am not cloud-admin | 10:32 |
| samuelms_ | marekd, yep | 10:33 |
| marekd | so, what can i do with my domain-admin role | 10:33 |
| samuelms_ | marekd, but if cloud admin had create one global role per api operatioN, | 10:33 |
| samuelms_ | ? | 10:33 |
| samuelms_ | marekd, so that cloud admins could define their own set of domain-roles with whatever they want | 10:33 |
| samuelms_ | marekd, so a domain admin would be able to do: 'my-own-role':['identity:create_domain','nova:boot_instance',etc] | 10:34 |
| samuelms_ | marekd, those global roles I'd call capabilities | 10:34 |
| marekd | but he would need to ask cloud admin to add it to policy.json, right? | 10:35 |
| samuelms_ | marekd, no | 10:35 |
| samuelms_ | marekd, in policy, we would have: | 10:35 |
| samuelms_ | marekd, 'identity:create_domain': 'role:create_domain' | 10:35 |
| samuelms_ | marekd, we could have one role per api | 10:36 |
| samuelms_ | marekd, well, I'm writing an etherpad with all those ideas | 10:36 |
| samuelms_ | marekd, I'll finish it today and then I'll ping you :) | 10:37 |
| samuelms_ | marekd, the idea is simple but amazing | 10:37 |
| samuelms_ | marekd, need to go to lab now | 10:37 |
| samuelms_ | marekd, back in few minutes | 10:37 |
| marekd | samuelms_: ok | 10:37 |
| *** samuelms_ has quit IRC | 10:42 | |
| samuelms | marekd, well, I'm back :) | 10:42 |
| marekd | samuelms: i wish i could go that quick to work ;/ | 10:42 |
| marekd | samuelms: | 10:42 |
| marekd | anyway | 10:42 |
| marekd | as i said, roles are global today. | 10:43 |
| marekd | now, you can add roles to domains | 10:43 |
| marekd | user marekd has a domain_admin role on domain CERN | 10:43 |
| marekd | now i login with Keystone, ask for a token scoped for domain CERN, i will get it | 10:44 |
| marekd | and what next? | 10:44 |
| marekd | what can i do by default (and without domain-roles spec implemented) with it? | 10:44 |
| samuelms | marekd, :) | 10:45 |
| marekd | :( | 10:46 |
| samuelms | marekd, well, you can do everything where there is an entry in the policy like : 'identity:do_something': '<other_rules> or role:domain_admin' | 10:47 |
| marekd | samuelms: that's a helpful answer. | 10:47 |
| samuelms | marekd, glad to see that | 10:48 |
| marekd | and role:domain_admin will constrain my actions to my domain, of course | 10:48 |
| samuelms | marekd, not by itself | 10:48 |
| samuelms | marekd, you need to check that the domain you're trying to do something on is the same of the one you have a token for | 10:48 |
| marekd | samuelms: ah, yes, of course | 10:48 |
| samuelms | marekd, by doing something like : 'domain_id:%(scope.domain_id)s' | 10:49 |
| marekd | i need to have token scoped to a domain. | 10:49 |
| samuelms | marekd, :) | 10:49 |
| marekd | i thought there was something more magical. | 10:49 |
| samuelms | marekd, no magics :p | 10:49 |
| marekd | ok, and now, you spec (domain-roles) is all about being able to say: so, let's create a role vm-manager and whoever has this role on a domain CERN will automatically get roles 'vm-create, 'vm-delete', 'vm-update', right? And nothing more. | 10:50 |
| marekd | that was question no.1 | 10:53 |
| marekd | samuelms: i also have a question no.2: How would policy.json file need to looks like if i had a vm-create domain scoped role, and actually wanted to be able to boot a vm withing one of projects from that role? it looks like OS-INHERIT is also needed, here, right? | 10:54 |
| samuelms | marekd, yep for your question n1 | 10:56 |
| samuelms | marekd, notice that roles vm-create, 'vm-delete', 'vm-update' would be global and defined by the cloud admin | 10:56 |
| samuelms | marekd, they define capabilities | 10:56 |
| marekd | yes, but you still need role assignments | 10:58 |
| marekd | to be able to use this role/capability on a resource (like project) | 10:58 |
| samuelms | marekd, yep | 10:58 |
| samuelms | marekd, os-inherit is related to the how far role assignments are applied | 10:59 |
| samuelms | marekd, if you want to have a role assignment on all projects of a domain, put an inherited role on that domain | 10:59 |
| samuelms | marekd, now with hierarchical projects, if you want to put a role on every project inside a subtree, instead of adding a role assignment to each one of them | 11:00 |
| samuelms | marekd, add a inherited role asisngment to the root of that subtree | 11:00 |
| samuelms | marekd, that's what role assignment inheritance stands for | 11:01 |
| marekd | samuelms: but that not domain-roles spec | 11:01 |
| marekd | or it is? | 11:01 |
| samuelms | marekd, no | 11:02 |
| samuelms | marekd, domain-roles are just group of roles | 11:02 |
| samuelms | marekd, and they belong to a domain, so that domain-admin put names on them | 11:03 |
| samuelms | marekd, but what you can do with a role is exactly the same what you can do with a domain-roles | 11:03 |
| samuelms | marekd, i.e., grating assignments, etc | 11:03 |
| samuelms | s/grating/granting | 11:03 |
| marekd | hm, vm-create make me think that admin will be able to boot a VM in every project within a domain | 11:04 |
| marekd | which turns out to not be true, as this is operation per project | 11:05 |
| marekd | not per domain | 11:05 |
| marekd | samuelms: you know what i mean? | 11:06 |
| samuelms | marekd, yes | 11:07 |
| marekd | samuelms: and am i right? :P | 11:07 |
| samuelms | marekd, you need a project scoped token to create a vm on it | 11:07 |
| samuelms | marekd, yes you are | 11:07 |
| marekd | hm | 11:14 |
| marekd | samuelms: so let's talk the example | 11:14 |
| marekd | domain cern | 11:14 |
| marekd | projects cms and atlas | 11:14 |
| marekd | there is a vm-create, vm-delete role | 11:14 |
| marekd | and user has role vm-create on project atlas | 11:15 |
| marekd | let's say it's user A | 11:15 |
| marekd | makes sense so far? | 11:15 |
| marekd | i think it does. | 11:15 |
| marekd | now, we create role vm-manager and make it consist of roles [vm-create, vm-delete] | 11:16 |
| samuelms | oops, sorry I was doing a review | 11:16 |
| samuelms | yep, makes sense | 11:16 |
| samuelms | marekd, great, go on | 11:16 |
| marekd | now, if user B can scope to a domain cern, and has a role vm-manager | 11:16 |
| samuelms | marekd, wait | 11:17 |
| marekd | this means.....actually what? he still needs to scope later to project atlas to be able to boot a machine | 11:17 |
| *** zz_avozza is now known as avozza | 11:17 | |
| marekd | and he has no affiliation, no role assignment with that so far. | 11:17 |
| samuelms | marekd, first, domain-admin puts vm-manager domain-role to user B on project atlas, right? | 11:17 |
| samuelms | marekd, you cannot get a token if you have no assingment on that project/domain | 11:18 |
| marekd | ah, this is what i was missing : i though domain-role means you can bind it with domain only. | 11:18 |
| samuelms | marekd, no! they belong to domains, as users do :) | 11:19 |
| samuelms | marekd, but they can be used everywhere inside that domain | 11:19 |
| marekd | ok, so role assignment ties domain-role vm-manager with that particular project. | 11:20 |
| marekd | right? | 11:20 |
| samuelms | marekd, role assingment is composed by: *role/domain-role* for a *user/group* on a *project/domain* | 11:20 |
| *** lhcheng has quit IRC | 11:22 | |
| samuelms | marekd, role assingments are the link between identity (users/groups) and resources (projects/domain) | 11:22 |
| samuelms | marekd, using roles :) | 11:22 |
| marekd | samuelms: yeah, i get it | 11:22 |
| *** lhcheng has joined #openstack-keystone | 11:22 | |
| marekd | so, when you assign a domain-for for a user B on a project ATLAS | 11:23 |
| marekd | this will mean that user automatically has roles vm-create vm-delete without making expliict asignments of those roles to this user on this project? | 11:23 |
| marekd | samuelms: if you are going to put something more in the etherpad, go ahead and i will read it and digest it again | 11:25 |
| marekd | i can understand concept of domains, domain admins and the fact that they now have some flexibility within their domains (create/delete users, add/remove role assignments), but have problems with understanding domain-roles. Maybe the name is somewhat misleading. | 11:26 |
| samuelms | marekd, yes, exactly | 11:26 |
| samuelms | marekd, yes maybe.. we can talk a little bit more later :) | 11:26 |
| samuelms | marekd, need to do something now | 11:27 |
| marekd | OK | 11:27 |
| *** lhcheng has quit IRC | 11:27 | |
| *** avozza is now known as zz_avozza | 11:27 | |
| *** aix has quit IRC | 11:28 | |
| samuelms | marekd, thanks for your review on 'Add support for domain specific roles.' | 11:34 |
| marekd | samuelms: api is required i think now... | 11:34 |
| rodrigods | marekd, samuelms, yes. the API is the strongest point of discussion | 11:35 |
| samuelms | marekd, rodrigods we have a patch taht proposes the api changes | 11:36 |
| rodrigods | samuelms, for both specs? | 11:36 |
| samuelms | https://review.openstack.org/#/c/139531/ | 11:37 |
| samuelms | rodrigods, I don't see two specs | 11:37 |
| samuelms | rodrigods, we were talking about domain roles | 11:37 |
| rodrigods | samuelms, just remembered your working point weren't a spec | 11:37 |
| rodrigods | just an API spec | 11:38 |
| samuelms | rodrigods, yes. domain-role API changes for domain-roles spec | 11:38 |
| rodrigods | samuelms, it should have at least a dependency | 11:38 |
| samuelms | rodrigods, agreed, I think we need to reference that in the spec | 11:39 |
| rodrigods | the commit message is wrong as well, since does not point to the bp | 11:39 |
| samuelms | rodrigods, will do now, thanks | 11:39 |
| samuelms | rodrigods, will ask henrynash to put a reference soon | 11:39 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Add domain roles APIs https://review.openstack.org/139531 | 11:40 |
| samuelms | rodrigods, ^ | 11:40 |
| *** zz_avozza is now known as avozza | 11:48 | |
| *** aix has joined #openstack-keystone | 11:56 | |
| *** raildo has joined #openstack-keystone | 11:59 | |
| *** avozza is now known as zz_avozza | 12:00 | |
| *** nellysmitt has quit IRC | 12:02 | |
| *** diegows has joined #openstack-keystone | 12:07 | |
| *** nellysmitt has joined #openstack-keystone | 12:07 | |
| *** afaranha has quit IRC | 12:09 | |
| *** diegows has quit IRC | 12:19 | |
| *** bjornar is now known as tziom | 12:19 | |
| *** amakarov_away is now known as amakarov | 12:23 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API doc for Inherited Role Assignments to Projects https://review.openstack.org/130277 | 12:29 |
| *** dimsum__ has joined #openstack-keystone | 12:32 | |
| *** diegows has joined #openstack-keystone | 12:35 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Assignment sql backend create_grant refactoring https://review.openstack.org/141352 | 12:36 |
| *** nellysmitt has quit IRC | 12:36 | |
| *** dimsum__ has quit IRC | 12:37 | |
| *** EmilienM is now known as EmilienM|afk | 12:37 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Assignment sql backend create_grant refactoring https://review.openstack.org/141352 | 12:40 |
| marekd | rodrigods: samuelms so i think this https://review.openstack.org/#/c/139531/ should be merged with bp spec. | 12:42 |
| *** zz_avozza is now known as avozza | 12:47 | |
| *** dimsum__ has joined #openstack-keystone | 12:52 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Role revocation invalidates too many tokens https://review.openstack.org/141397 | 12:53 |
| *** afaranha has joined #openstack-keystone | 12:59 | |
| *** andreaf has quit IRC | 13:02 | |
| *** nellysmitt has joined #openstack-keystone | 13:10 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Role revocation invalidates too many tokens https://review.openstack.org/141397 | 13:12 |
| *** EmilienM|afk is now known as EmilienM | 13:17 | |
| *** jistr has joined #openstack-keystone | 13:28 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes HTTP status code when creating/updating endpoints https://review.openstack.org/117341 | 13:30 |
| samuelms | dstanek, morning | 13:31 |
| samuelms | dstanek, could you please take a look at bu #1402339 | 13:31 |
| samuelms | dstanek, bug #1402339 | 13:32 |
| uvirtbot | Launchpad bug 1402339 in keystone "Status code from HEAD requests must be consistent" [Undecided,New] https://launchpad.net/bugs/1402339 | 13:32 |
| samuelms | dstanek, :) | 13:32 |
| morganfainberg | morning | 13:34 |
| *** nellysmitt has quit IRC | 13:35 | |
| *** jistr has quit IRC | 13:36 | |
| samuelms | morning | 13:36 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API doc for Inherited Role Assignments to Projects https://review.openstack.org/130277 | 13:40 |
| rodrigods | morganfainberg, ^ | 13:40 |
| rodrigods | morganfainberg, addressed previews comments, can you review it whenever you have a moment? (will have my full attention for immediate fixes) | 13:41 |
| *** avozza is now known as zz_avozza | 13:41 | |
| *** andreaf has joined #openstack-keystone | 13:42 | |
| dstanek | samuelms: sure | 13:44 |
| dstanek | morganfainberg: morganfainberg | 13:44 |
| dstanek | morganfainberg: did you get your revert commit through? | 13:45 |
| morganfainberg | dstanek, it's holding | 13:45 |
| morganfainberg | https://review.openstack.org/#/c/141674/ | 13:45 |
| morganfainberg | so if the API changes go through and the functionality doesn't change i'll abandon the revert | 13:46 |
| dstanek | ayoung_: thoughts on https://review.openstack.org/#/c/111312/1 ? /cc anyone else that uses Fedora | 13:46 |
| dstanek | morganfainberg: i start at the API change then | 13:47 |
| morganfainberg | ++ | 13:47 |
| dstanek | morganfainberg: i took care of most of my older reviews last night, but went to sleep before finishing the last 1 (maybe 2) | 13:47 |
| morganfainberg | cool | 13:47 |
| morganfainberg | thanks | 13:47 |
| * morganfainberg has to get moving today and get some coffee. | 13:48 | |
| *** gordc has joined #openstack-keystone | 13:48 | |
| dstanek | morganfainberg: that API makes me want a real REST API badly | 13:49 |
| rodrigods | dstanek, available to immediately address your comments in the API :) | 13:55 |
| dstanek | rodrigods: was this also added to identity-api yet? | 13:58 |
| rodrigods | dstanek, the hierarchical projects bits, yes | 13:58 |
| rodrigods | dstanek, already merged | 13:59 |
| dstanek | morganfainberg: rodrigods: if that's the case then we can just approve the spec right? no need to go over the API too much since it should have been done in that review | 13:59 |
| rodrigods | dstanek, I think in the identity-api we do not point changes from extensions | 14:00 |
| morganfainberg | dstanek, i think we didn't have much of the api to review previously in this case on the OS-INHERIT side | 14:01 |
| morganfainberg | dstanek, so we do need to review the API being added, but it should be less work because os-inherit already exists | 14:01 |
| rodrigods | morganfainberg, ++ it is following the same pattern as the domains part | 14:02 |
| *** dimsum__ is now known as dims | 14:02 | |
| dstanek | rodrigods: sure we do http://git.openstack.org/cgit/openstack/identity-api/tree/v3/src/markdown/identity-api-v3-os-inherit-ext.md | 14:04 |
| rodrigods | dstanek, sorry, didn't know about it | 14:04 |
| rodrigods | dstanek, ah no... | 14:05 |
| rodrigods | dstanek, thought you were talking about this one http://git.openstack.org/cgit/openstack/identity-api/tree/v3/src/markdown/identity-api-v3.md | 14:05 |
| dstanek | morganfainberg: seems like we need to wait for the API change too then | 14:06 |
| rodrigods | dstanek, the API spec change is up here ^ | 14:06 |
| rodrigods | https://review.openstack.org/130277 | 14:06 |
| *** wanghong has quit IRC | 14:07 | |
| *** rushiagr is now known as rushiagr_away | 14:08 | |
| dstanek | rodrigods: is there an API change for this already? | 14:09 |
| rodrigods | dstanek, are you reviewing it? already addressed henrynash's comment | 14:09 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API doc for Inherited Role Assignments to Projects https://review.openstack.org/130277 | 14:09 |
| rodrigods | dstanek, ^ | 14:09 |
| dstanek | rodrigods: that's the spec, not the API | 14:10 |
| rodrigods | dstanek, all the API weren't moved to the keystone-specs repo? | 14:10 |
| *** richm1 has joined #openstack-keystone | 14:10 | |
| dstanek | rodrigods: oh, wait...nm | 14:11 |
| dstanek | i have to update my tooling | 14:11 |
| *** lhcheng has joined #openstack-keystone | 14:12 | |
| dstanek | i still have markdown format checks and other things :-( | 14:12 |
| rodrigods | dstanek, heh :( | 14:12 |
| *** lhcheng has quit IRC | 14:16 | |
| dstanek | rodrigods: but yes once i'm done with what i'm working on i'll review the API | 14:22 |
| *** wanghong has joined #openstack-keystone | 14:23 | |
| rodrigods | dstanek, thank you, in a sprint here to make it land before we need to revert the code change :) | 14:23 |
| dstanek | i don't see why we wouldn't be able to approve the API today | 14:24 |
| rodrigods | ++ | 14:24 |
| *** zz_avozza is now known as avozza | 14:25 | |
| samuelms | morganfainberg, remember the 'capabilities' thing we were discussing about last Tuesday? | 14:26 |
| raildo | marekd, samuelms I answers your comments in the Reseller spec: https://review.openstack.org/#/c/139824/ I'll send a new patch :) | 14:33 |
| *** bdossant_ has joined #openstack-keystone | 14:33 | |
| marekd | raildo: thanks. | 14:34 |
| *** bdossant has quit IRC | 14:34 | |
| raildo | marekd, If you can look at the comment about the dual token, I think we can discuss better about it :) | 14:35 |
| marekd | raildo: probably some more explanation about dual scoped tokens could be useful, as it may have a huge impact on everything? | 14:41 |
| marekd | unless, there is already something like that...but i doubt | 14:41 |
| *** nellysmitt has joined #openstack-keystone | 14:42 | |
| raildo | marekd, I think that is not a huge impact, since the domains will be a project with some more functionalities. So the idea is when a request a token with the domain scope, the keystone will send a token with the domain and project scope, so you can use the same token in Keystone (as a domain or project scoped) and in other services (as a project scoped token) | 14:45 |
| marekd | raildo: but you want to have two "scope" entries in a token? | 14:46 |
| raildo | marekd, IMO yes | 14:47 |
| marekd | raildo: maybe some example of a token or reference read ? | 14:47 |
| raildo | marekd, Ok, I will put a example about that | 14:47 |
| raildo | marekd, thanks :) | 14:48 |
| marekd | raildo: cause i think this may ring some bells to some reviewers... | 14:48 |
| marekd | raildo: no problem :-) | 14:48 |
| *** bdossant has joined #openstack-keystone | 14:49 | |
| raildo | marekd, and I'm really waiting for this reviewers hahahaha | 14:50 |
| marekd | ..... | 14:51 |
| dstanek | rodrigods: completed a first pass | 14:51 |
| lbragstad | morganfainberg: thanks for the heads up on the XML patch Jenkins failures. I was struggling with that one | 14:52 |
| rodrigods | dstanek, thanks, will address them | 14:52 |
| marekd | raildo: you are concerned about lack of reviewers of the fact that they will for sure be okay with that multi scoped tokens ? | 14:53 |
| dstanek | marekd: hi | 14:53 |
| *** bdossant_ has quit IRC | 14:53 | |
| dstanek | rodrigods: let me know if you have question. some of my comments were just questions | 14:53 |
| marekd | dstanek: hi | 14:54 |
| raildo | marekd, this idea about the dual tokens was discuss in the summit, (I just don't remember now who suggested this idea) | 14:54 |
| rodrigods | dstanek, thanks | 14:54 |
| dstanek | marekd: just wanted to let you know that i got to the point in my identity federation that the SP was trying to verify something signed my the idp - i just have metadata incorrect or something | 14:55 |
| raildo | marekd, I just think that this spec will be much discussed | 14:55 |
| marekd | raildo: ++ | 14:55 |
| marekd | dstanek: what are the symptomps? | 14:56 |
| marekd | errors etc. | 14:56 |
| *** stevemar has joined #openstack-keystone | 14:56 | |
| *** ChanServ sets mode: +v stevemar | 14:56 | |
| dstanek | marekd: jas - i'll log into that vm | 14:56 |
| raildo | marekd, I know that the reseller will be a huge impact in keystone, so we need to discuss a lot about this :) | 14:56 |
| dstanek | marekd: it just says that it can't verify the message | 14:57 |
| samuelms | raildo, ok thanks, waiting the new patch :) | 14:58 |
| marekd | dstanek: yeah, gabriel-bezerra and myself got into same issue last week | 14:59 |
| marekd | i am thinking there might be something wrong with pysaml2 ;/ | 14:59 |
| marekd | i will ping author | 14:59 |
| marekd | for that | 14:59 |
| dstanek | marekd: cool, i'm going to start debugging the pysaml2 idp code to see what is happening | 14:59 |
| marekd | dstanek: i had another idea | 15:00 |
| marekd | maybe i will start working on that before i leave today. | 15:00 |
| marekd | i know testshib or other idps worked | 15:00 |
| marekd | so that would be better to compare how assertion from idp that work and pysaml look like. | 15:00 |
| *** avozza is now known as zz_avozza | 15:02 | |
| rodrigods | dstanek, regarding the PUT operation (create a role_assignment), do you think we need to make clear it doesn't have a body? | 15:04 |
| *** rushiagr_away is now known as rushiagr | 15:05 | |
| *** nellysmitt has quit IRC | 15:05 | |
| bknudson | rodrigods: say that the body is ignored | 15:09 |
| bknudson | if that's what happens. | 15:09 |
| rodrigods | bknudson, ++ | 15:10 |
| dstanek | bknudson: ++ | 15:11 |
| *** bknudson has quit IRC | 15:11 | |
| dstanek | rodrigods: what is the usecase for getting the inherited roles | 15:12 |
| dstanek | ? | 15:12 |
| rodrigods | dstanek, the effective, or direct ones? | 15:14 |
| *** bknudson has joined #openstack-keystone | 15:18 | |
| *** ChanServ sets mode: +v bknudson | 15:18 | |
| *** samuelms_ has joined #openstack-keystone | 15:20 | |
| *** samuelms_ has quit IRC | 15:26 | |
| *** jaosorior has joined #openstack-keystone | 15:28 | |
| *** timcline has joined #openstack-keystone | 15:30 | |
| *** timcline has quit IRC | 15:31 | |
| morganfainberg | lbragstad, it should be working now w/ a recheck | 15:31 |
| *** timcline has joined #openstack-keystone | 15:31 | |
| lbragstad | morganfainberg: yep, stevemar issued a recheck on it and it passed | 15:32 |
| morganfainberg | dstanek, checking in with you on the SQL test bp. | 15:32 |
| stevemar | ah the xml stuff | 15:33 |
| dstanek | morganfainberg: howdy | 15:33 |
| morganfainberg | dstanek, this whole east coast time thing is throwing me for a bit of a loop :P | 15:34 |
| morganfainberg | but the bagels here are awesome. | 15:34 |
| *** nkinder_away has joined #openstack-keystone | 15:36 | |
| *** topol has joined #openstack-keystone | 15:39 | |
| *** ChanServ sets mode: +v topol | 15:39 | |
| *** samuelms_ has joined #openstack-keystone | 15:40 | |
| *** bdossant has quit IRC | 15:41 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Assignment sql backend create_grant refactoring https://review.openstack.org/141352 | 15:43 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API doc for Inherited Role Assignments to Projects https://review.openstack.org/130277 | 15:44 |
| dstanek | morganfainberg: you're here on the east coast? | 15:46 |
| rodrigods | dstanek, sent another patchset, but if you think some of your comments the replies weren't enough please let me know | 15:46 |
| morganfainberg | dstanek, in manhattan until thursday | 15:46 |
| morganfainberg | dstanek, and will probably come back in january. | 15:47 |
| dstanek | morganfainberg: nice | 15:47 |
| dstanek | rodrigods: thx, i'll take a look | 15:47 |
| bknudson | maybe we'll have a summit there someday | 15:48 |
| morganfainberg | bknudson, hehe i'd dig having the summit in NYC | 15:48 |
| bknudson | bloomberg would be all over it. | 15:49 |
| *** nellysmitt has joined #openstack-keystone | 15:50 | |
| *** richm1 has quit IRC | 15:50 | |
| *** radez_g0n3 is now known as radez | 15:51 | |
| rodrigods | morganfainberg, ^ API spec with a +2 from henrynash \o/ | 15:55 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 15:55 |
| morganfainberg | rodrigods, nice. | 15:55 |
| *** nkinder_away is now known as nkinder | 15:55 | |
| morganfainberg | dstanek, is https://review.openstack.org/#/c/126030/ a realistic target for k1? should i bump the BP to k2? | 15:58 |
| dstanek | morganfainberg: k2 - the patch that i was waiting on just merged yesterday and there is still a bit more work to be done | 15:59 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Service Provider for K2K https://review.openstack.org/135604 | 15:59 |
| morganfainberg | dstanek, done. | 15:59 |
| morganfainberg | stevemar, https://review.openstack.org/#/c/125753/9/doc/source/setup.rst are we getting an update for K1 on this? (cc lbragstad ) | 15:59 |
| *** bdossant has joined #openstack-keystone | 16:00 | |
| lbragstad | morganfainberg: stevemar I can rebase that if you want | 16:00 |
| marekd | gabriel-bezerra: did you make mod_Shib w/ pysaml2 work? | 16:00 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 16:00 |
| stevemar | morganfainberg, lbragstad yeah i'll do it now | 16:01 |
| lbragstad | stevemar: or if you just hit the 'rebase' button it should work, now that the XML removal patch is passing | 16:01 |
| *** nellysmitt has quit IRC | 16:01 | |
| morganfainberg | lbragstad, yeah we just need to fix the outstanding comment[s] as needed - though lxml might still be needed? for federation | 16:01 |
| bknudson | hasta la vista xml. | 16:01 |
| marekd | morganfainberg: for k2k | 16:01 |
| morganfainberg | marekd, right. | 16:01 |
| marekd | otherwise it's heavily used in keystoneclient, but i think you are not talking about it. | 16:02 |
| morganfainberg | marekd, less worried on the keystoneclient front | 16:02 |
| morganfainberg | marekd, this is just keystone server | 16:02 |
| *** ajayaa has quit IRC | 16:02 | |
| stevemar | morganfainberg, lbragstad i'll wait til the patch is actually merged, i don't want to mess anything up | 16:02 |
| marekd | morganfainberg: that's what i was thinking. | 16:02 |
| lbragstad | cool | 16:02 |
| morganfainberg | stevemar, rebase button wont mess anything up | 16:02 |
| * lbragstad salutes the Keystone XML codebase | 16:02 | |
| stevemar | morganfainberg, it is rebased? AFAICT | 16:02 |
| morganfainberg | stevemar, rebase locally and push to gerrit is a bit more dicy at times. | 16:03 |
| morganfainberg | stevemar, so if we do need lxml for k2k we might want to leave that in there | 16:03 |
| bknudson | why rebase? if it's not in merge conflict? | 16:03 |
| morganfainberg | i think thats the only comment atm | 16:03 |
| morganfainberg | bknudson, steve said rebase in his comment reply | 16:03 |
| morganfainberg | bknudson, thats all | 16:03 |
| stevemar | morganfainberg, oh that was cause of the suse steps | 16:03 |
| morganfainberg | could use some eyes on these bugs: https://bugs.launchpad.net/keystone/+bug/1400362 | 16:05 |
| uvirtbot | Launchpad bug 1400362 in keystone "check and delete policy_association_for_region_and_service performs create" [High,In progress] | 16:05 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1398470 | 16:05 |
| uvirtbot | Launchpad bug 1398470 in keystone "sql migration helpers incorrectly inspect for FKs" [High,In progress] | 16:05 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1383676 | 16:05 |
| uvirtbot | Launchpad bug 1383676 in keystone "endless loop when deleting region" [High,In progress] | 16:05 |
| morganfainberg | and associated reviews | 16:05 |
| *** ayoung has joined #openstack-keystone | 16:05 | |
| *** ChanServ sets mode: +v ayoung | 16:05 | |
| *** bdossant has quit IRC | 16:10 | |
| *** bdossant has joined #openstack-keystone | 16:11 | |
| *** wanghong has quit IRC | 16:13 | |
| *** chrisshattuck has joined #openstack-keystone | 16:14 | |
| *** wanghong has joined #openstack-keystone | 16:14 | |
| *** richm1 has joined #openstack-keystone | 16:15 | |
| bknudson | we need more of https://blueprints.launchpad.net/keystone/+spec/removed-as-of-kilo . | 16:17 |
| amakarov | morganfainberg, good day! I have a question about group role revocation: is it by design, that if user is in group, which role is being revoked on some project, then this user's tokens are ALL invalid ? | 16:17 |
| morganfainberg | amakarov, there is something along those lines that was a limitation of how we store the data | 16:20 |
| morganfainberg | bknudson, hehe | 16:20 |
| morganfainberg | bknudson, i retargeted it to k2 since some stuff is outstanding still...so we can get more in there. | 16:20 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 16:21 |
| morganfainberg | dstanek, last question: https://review.openstack.org/#/c/131516/ is that still k1? or should i bump that as well to k2 | 16:22 |
| raildo | marekd, ^ | 16:22 |
| morganfainberg | dstanek, i'm thinking k2 just so there isn't any craziness at the last minute to get it in for k1 | 16:22 |
| dstanek | morganfainberg: i'm planning on addressing the comments today, but k2 would be fine | 16:22 |
| morganfainberg | dstanek, great | 16:22 |
| dstanek | morganfainberg: the hardest part is getting all of these reviews through | 16:22 |
| morganfainberg | dstanek, right. we're pretty close on a lot of them | 16:23 |
| morganfainberg | dstanek, but getting them done *today* is unlikely | 16:23 |
| marekd | raildo: thanks. | 16:23 |
| dstanek | morganfainberg: ++ and ++ | 16:23 |
| amakarov | morganfainberg, I've run into issue https://bugs.launchpad.net/keystone/+bug/1401926 and don't know whether it's a bug or a feature :) | 16:24 |
| uvirtbot | Launchpad bug 1401926 in keystone "Role revocation invalidates tokens on all user projects" [Undecided,In progress] | 16:24 |
| morganfainberg | ok so we're down to the three bugs i linked above ^^ and the HMT API change | 16:24 |
| marekd | raildo: how can i distinguish if roles from the token are for project or domain? | 16:24 |
| bknudson | morganfainberg: are they in https://gist.github.com/dolph/651c6a1748f69637abd0 ? | 16:24 |
| morganfainberg | bknudson, yeah, i'm making sure they are | 16:25 |
| rodrigods | marekd, good point, guess they will be able to perform both types of operations? | 16:25 |
| dstanek | rodrigods: i was referring to the list APIs in that document - was the existing list roles changed to get inherited roles? | 16:26 |
| marekd | rodrigods: raildo: is it by definition of the spec? Otherwise what if such user should have roleA on a project this token is scoped to and roleB on domain only. | 16:26 |
| morganfainberg | bknudson, they should be now | 16:27 |
| bknudson | thanks | 16:28 |
| rodrigods | dstanek, ahh ok, yes | 16:28 |
| rodrigods | dstanek, it gets the effective roles depending on the query | 16:29 |
| morganfainberg | amakarov, that looks like actually 2 bugs - 1 a bug in revocation events (i need to dig further on it) and that we are somewhat limited on groups or at least we used ot be | 16:29 |
| raildo | marekd, that a good question :P | 16:29 |
| marekd | raildo: do you have an answer? :-) | 16:29 |
| raildo | I think that we need to change the role in the token, to explain the target (domain/project) | 16:30 |
| amakarov | morganfainberg, what can I do? | 16:30 |
| morganfainberg | amakarov, well revocation events is harder to debug | 16:30 |
| raildo | marekd, like... admin (in projetct)... member ( in domain) | 16:31 |
| raildo | marekd, what do you think? | 16:31 |
| marekd | raildo: that's why i asked for some example, as I was hoping such things would be resolved (and the description would be ommited). And that's why said that this may have some impact on other services for instance. | 16:31 |
| amakarov | morganfainberg, may I propose changes here, or it need your investigation first? | 16:31 |
| *** packet has joined #openstack-keystone | 16:31 | |
| morganfainberg | amakarov, feel free to propose changes | 16:31 |
| marekd | raildo: spliting and moving roles would be fine | 16:31 |
| morganfainberg | amakarov, you *never* need to wait for my investigation | 16:31 |
| morganfainberg | to propose a change/fix/etc | 16:32 |
| marekd | raildo: but i cannot say it it will be backwards comatible. | 16:32 |
| marekd | raildo: rodrigods let's ask the boss here | 16:32 |
| marekd | morganfainberg: o/ | 16:32 |
| rodrigods | marekd, ++ | 16:32 |
| dstanek | rodrigods: ok it inherited roles are included when some what asks 'what roles does this user have on this project' i''m less concerned | 16:32 |
| raildo | marekd, I'll put this point in the Keystone meeting, tomorrow, so we can discuss this with the keystone core | 16:32 |
| morganfainberg | marekd, oh hai | 16:32 |
| marekd | raildo: ++ | 16:32 |
| marekd | https://review.openstack.org/#/c/139824/6/specs/kilo/reseller.rst look at line 177 | 16:33 |
| *** samuelms_ has quit IRC | 16:33 | |
| marekd | so raildo , rodrigods and the rest want to have tokens scoped to two entities, say project and domain at the same time. However it's hard do see what roles applies to what resource | 16:33 |
| morganfainberg | well, i think we talked about this from a concept of merging projects and domains | 16:34 |
| *** david-lyle_afk is now known as david-lyle | 16:34 | |
| amakarov | bknudson, can you please review my change (I hope I satisfied your concern there)? https://review.openstack.org/#/c/118590/ | 16:34 |
| morganfainberg | which case, you'd *only* have that for the domain itself | 16:34 |
| morganfainberg | everything else would be just project | 16:34 |
| morganfainberg | and it wouldn't matter which role is scoped to where. | 16:34 |
| morganfainberg | since it's the same entity | 16:34 |
| dstanek | rodrigods: so basically in my mind those APIs are just crud and not really application APIs | 16:35 |
| marekd | morganfainberg: hm, if i have a token scoped to two resources | 16:35 |
| marekd | i may have different roles on resourceA and different on resourceB | 16:35 |
| dstanek | rodrigods: should we have a note in the list user roles call that says if doesn't include all inherited roles the user has? | 16:35 |
| rodrigods | dstanek, they are | 16:35 |
| morganfainberg | marekd, the only time that should occur is when that resource is just known as project or domain | 16:35 |
| morganfainberg | marekd, you should never have a token scoped to two different resources | 16:36 |
| dstanek | rodrigods: they are? | 16:36 |
| rodrigods | dstanek, wait | 16:36 |
| morganfainberg | marekd, domain roles are not ever used on a project | 16:36 |
| rodrigods | dstanek, can you paste here the HTTP call? | 16:36 |
| dstanek | rodrigods: the list one i'm talking about? | 16:36 |
| rodrigods | dstanek, yes | 16:36 |
| marekd | morganfainberg: so, this double scoping would be in just one particular, well known case | 16:36 |
| morganfainberg | marekd, thats the way i see it | 16:37 |
| marekd | morganfainberg: ok | 16:37 |
| marekd | raildo: maybe such explanation could be added? | 16:37 |
| morganfainberg | marekd, it's to get around the case where domain == project and prevents us from breaking things. | 16:37 |
| dstanek | rodrigods: /OS-INHERIT/projects/{project_id}/users/{user_id}/roles/inherited_to_projects | 16:37 |
| marekd | morganfainberg: ok | 16:37 |
| marekd | morganfainberg: thanks. | 16:37 |
| morganfainberg | marekd, now... if that *isn't* what they're proposing here, i don't like it ;) | 16:37 |
| raildo | marekd, sure. I'll add the morganfainberg comment in the spec :) | 16:37 |
| morganfainberg | marekd, i'm reading the change and i *think* thats what is being proposed here | 16:38 |
| marekd | raildo: is it what you are proposing ? :-) | 16:38 |
| marekd | morganfainberg: ok | 16:38 |
| morganfainberg | raildo, but if i'm wrong please correct me ;) | 16:38 |
| marekd | so you can -2 it :P | 16:38 |
| raildo | morganfainberg, no, you're right :) | 16:38 |
| rodrigods | dstanek, ok, now I understand... The semantics of this call is to retrieve the roles in a role assignment with such <project_id>, <user_id> and with the inherited_to_projects flag active | 16:38 |
| raildo | hahahah | 16:38 |
| morganfainberg | marekd, eh probably -1 in that case :P | 16:38 |
| rodrigods | dstanek, without the group ones | 16:38 |
| morganfainberg | marekd, we're not at "OMG WHAT THE HECK IS THAT" | 16:39 |
| morganfainberg | ;) | 16:39 |
| bknudson | can we deprecate r/w ldap? Probably requires making sure docs describe how Keystone uses LDAP. | 16:39 |
| marekd | morganfainberg: ok :) | 16:39 |
| rodrigods | dstanek, this role assignment isn't even effective | 16:39 |
| bknudson | deprecate writing to ldap | 16:39 |
| morganfainberg | bknudson, so no. | 16:39 |
| morganfainberg | bknudson, people *actually* use it :( | 16:39 |
| bknudson | people use XML | 16:39 |
| morganfainberg | that being said... RAX is proposing a proper R/W ldap w/ schema | 16:39 |
| dstanek | rodrigods: right just the direct crud stuff - seeing the URL and reading the doc doesn't seem to say that | 16:39 |
| morganfainberg | bknudson, no people don't really use XML :P | 16:39 |
| morganfainberg | bknudson, they use java and turn XML into tracebacks | 16:40 |
| morganfainberg | great api for that | 16:40 |
| rodrigods | dstanek, ok... do you have any suggestions to improve the description? | 16:40 |
| marekd | morganfainberg: i have also a question. why in policy.json there is only one rule concerning role_assignments? | 16:40 |
| morganfainberg | bknudson, if RAX is willing to build the read/write LDAP and schema - and migration scripts (yep, they said they want this), i'd be willing to deprecate the current r/w ldap for that. but there are real deployments that make use of r/w/ ldap | 16:41 |
| morganfainberg | bknudson, as it is today | 16:41 |
| samuelms | marekd, because we only have listing there | 16:41 |
| marekd | samuelms: how do you add RAs then ? | 16:41 |
| samuelms | marekd, using the grant api | 16:41 |
| bknudson | I'd think they'd be happier having their own scripts to update the LDAP directory. | 16:41 |
| samuelms | marekd, granting roles to someone | 16:42 |
| marekd | samuelms: which is a role assignment to me... | 16:42 |
| rodrigods | dstanek, maybe "Lists all roles assigned to a user on a given project with the inherited_to_projects flag active." | 16:42 |
| samuelms | marekd, that's the same | 16:42 |
| marekd | samuelms: ah, naming | 16:42 |
| marekd | that's all | 16:42 |
| dstanek | rodrigods: i would call our that it doesn't get all of the effective roles - is the difference between effective roles and <direct DB records?> called out anywhere? | 16:42 |
| bknudson | a migration script from LDAP to LDAP seems pretty crazy | 16:42 |
| marekd | samuelms: makes sense, thanks. | 16:42 |
| samuelms | marekd, I dont know the reason why role assingments are separated from grants (some historical discussion there) maybe morganfainberg may remember | 16:42 |
| samuelms | marekd, np | 16:42 |
| rodrigods | dstanek, list role assignments with effective flag and list_projects_for_user | 16:43 |
| dstanek | rodrigods: that's a false statement because i doesn't actually return all of the roles right? | 16:43 |
| rodrigods | dstanek, all the roles where this conditions are true? | 16:43 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 16:43 |
| *** KanagarajM has joined #openstack-keystone | 16:44 | |
| dstanek | rodrigods: this is a hard one because that reads to be like i can use it to get a list of all inherited roles for a user and roles that they inherit via a group will not be included | 16:44 |
| rodrigods | dstanek, ahh ok... so I think the note suggestion can be used | 16:45 |
| amakarov | morganfainberg, 1 more thing: there is trust redelegation still waiting :) https://review.openstack.org/#/c/131541/ and https://review.openstack.org/#/c/126897/ I've turned allow_redelegation to parameter as we discussed - it's stored no more. | 16:45 |
| morganfainberg | amakarov, i know. | 16:46 |
| morganfainberg | amakarov, thanks | 16:46 |
| rodrigods | dstanek, copying from the domains part "The list only contains those role assignments to the project that were specified as being inherited to projects within that project." | 16:48 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 16:51 |
| dstanek | rodrigods: that's probably good | 16:53 |
| rodrigods | dstanek, great, will update with that description | 16:54 |
| dstanek | rodrigods: thanks | 16:55 |
| openstackgerrit | gordon chung proposed openstack/pycadf: deprecate audit middleware https://review.openstack.org/138386 | 16:55 |
| *** KanagarajM has quit IRC | 16:56 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API doc for Inherited Role Assignments to Projects https://review.openstack.org/130277 | 16:56 |
| dstanek | marekd: gabriel-bezerra: fyi...this is what i was using to test http://paste.openstack.org/show/151299/ | 16:57 |
| rodrigods | dstanek, ^ | 16:57 |
| dstanek | marekd: gabriel-bezerra: it requires lxml since i am parsing the form and i didn't was to keep using the browser for testing | 16:57 |
| *** k4n0 has quit IRC | 16:59 | |
| *** rm_work|away is now known as rm_work | 16:59 | |
| *** nellysmitt has joined #openstack-keystone | 17:00 | |
| *** shakamunyi has quit IRC | 17:03 | |
| openstackgerrit | Haneef Ali proposed openstack/keystone: Fix wrong log message in token flush https://review.openstack.org/140790 | 17:06 |
| *** gyee has joined #openstack-keystone | 17:06 | |
| *** ChanServ sets mode: +v gyee | 17:06 | |
| *** bdossant has quit IRC | 17:07 | |
| *** zz_avozza is now known as avozza | 17:09 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Role revocation invalidates too many tokens https://review.openstack.org/141397 | 17:10 |
| morganfainberg | amakarov, I think that is not going to revoke pki tokens properly | 17:15 |
| morganfainberg | amakarov, the token wont end up in the revocation list | 17:16 |
| amakarov | morganfainberg, hmm, I see your point... I filed a bug for group revocation problem, so I think I just mark it WIP | 17:18 |
| amakarov | morganfainberg, maybe even abandon it later | 17:18 |
| morganfainberg | This is a hard one. | 17:19 |
| morganfainberg | Not an invalid bug. | 17:19 |
| morganfainberg | But def a bit weird. | 17:19 |
| afaranha | ayoung, hey, are you there? | 17:19 |
| amakarov | I want to add "group_id" to revocation tree | 17:19 |
| amakarov | morganfainberg, I'm digging for revocation architecture now - it looks strange, really :) | 17:20 |
| amakarov | but makes sense. The task it solves isn't trivial too | 17:21 |
| *** henrynash has joined #openstack-keystone | 17:24 | |
| *** ChanServ sets mode: +v henrynash | 17:24 | |
| henrynash | rodigods: ping | 17:24 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Group role revocation invalidates all user tokens https://review.openstack.org/141397 | 17:24 |
| *** lhcheng has joined #openstack-keystone | 17:25 | |
| rodrigods | henrynash, hey | 17:25 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Group role revocation invalidates all user tokens https://review.openstack.org/141854 | 17:26 |
| *** i159 has quit IRC | 17:26 | |
| henrynash | rodigods: hi…not sure I understood your last respone to my comment | 17:27 |
| morganfainberg | henrynash: I moved the split to k2. Fyi. | 17:27 |
| henrynash | rodigods: I agree it is the same as the GET /role_assignment statement you gave…but insn’t that what my text says? Or do you interpret it differently? | 17:27 |
| henrynash | morganfainberg: when’s teh cut off? | 17:28 |
| ayoung | afaranha, yeah | 17:28 |
| *** avozza is now known as zz_avozza | 17:28 | |
| *** zz_avozza is now known as avozza | 17:29 | |
| rodrigods | henrynash, I interpret it differently... "The list only contains those role assignments anchored to this project that were specified as being inherited to its subtree." is weird because: role assignments (it returns roles) and the last part about the subtree | 17:29 |
| morganfainberg | henrynash: k1 cut off is tomorrow I think. It releases on thurs. | 17:29 |
| morganfainberg | Afaik. | 17:29 |
| * morganfainberg 2x checks. | 17:29 | |
| henrynash | morganfainberg: ok, makes sense | 17:29 |
| lbragstad | I like how the whisky question on the Hackathon survey is required. | 17:30 |
| rodrigods | henrynash, do you agree with my last suggestion? | 17:30 |
| henrynash | rodigods: isn’r “projects within that project” the subtree? | 17:30 |
| rodrigods | henrynash, yes... you are right, just worried about the first sentence with "role assignments" | 17:31 |
| rodrigods | henrynash, need to change to something like "roles assigned" | 17:31 |
| henrynash | rodigods: ok…fine on that part, “roles assigned to the project” is better | 17:32 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Role revocation invalidates too many tokens https://review.openstack.org/141397 | 17:32 |
| rodrigods | henrynash, "The list only contains those roles assigned to this project that were specified as being inherited to its subtree." | 17:32 |
| rodrigods | dstanek, "The list only contains those roles assigned to this project that were specified as being inherited to its subtree." | 17:32 |
| rodrigods | dstanek, your feedback too :) | 17:32 |
| henrynash | rodigods: works for me | 17:34 |
| rodrigods | henrynash, great! | 17:34 |
| rodrigods | thanks for the reviews henrynash, since our first HM patch :) | 17:35 |
| henrynash | rodigods: yw | 17:35 |
| afaranha | ayoung, hey, could you send the current implementation of the policies? | 17:35 |
| ayoung | no | 17:35 |
| afaranha | any news? I will work on that now, I read the discussion that you had with samuelms , I'll continue the work on that | 17:36 |
| ayoung | afaranha, I'm breaking things left and right | 17:36 |
| ayoung | afaranha, right now I am trying to figure out what to do the get_member_from_driver thing | 17:36 |
| ayoung | I know I kindof want it as lambda | 17:36 |
| dstanek | rodrigods: henrynash: does that still read as getting effective roles? | 17:37 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API doc for Inherited Role Assignments to Projects https://review.openstack.org/130277 | 17:37 |
| ayoung | afaranha, It is kindof morphing into the cleanup of the keystone policy enforcement code that I have wanted to do for a whjile | 17:38 |
| ayoung | afaranha, let be try the lambda thing, and then I'll post a new WIP, ok? | 17:38 |
| afaranha | Wha do do you mean by get_member_from_driver? | 17:39 |
| henrynash | dstanek: i don’t think so….but if you interpret it differently then it’s not good enough! | 17:39 |
| afaranha | ayoung, Sure. | 17:39 |
| ayoung | afaranha, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n120 | 17:39 |
| ayoung | that ties us to the Keystone controller class hierarchy, but it is an artificial tie | 17:40 |
| ayoung | if we instead had an optional lambda in the decorator definition we would have the same thing | 17:40 |
| ayoung | something like | 17:40 |
| *** eglynn is now known as eglynn-officeafk | 17:40 | |
| ayoung | lambda: member: self.identity_api.get_user | 17:41 |
| ayoung | but that is not quite the right thing, either, because we need to parse the arguments. I want a single, reusable callback function that can be specified on the function definition | 17:41 |
| rodrigods | henrynash, dstanek, still missing the "groups" part? Making clear we do not list effective roles inherited from groups? | 17:42 |
| ayoung | maybe it should be something more like: | 17:42 |
| afaranha | ayoung, this member is for users, domains, projects and groups right? | 17:42 |
| ayoung | member_accessor=None or member_accessor=self | 17:42 |
| ayoung | yeah | 17:42 |
| ayoung | afaranha, look in the identity/controllers.py file | 17:42 |
| *** nellysmitt has quit IRC | 17:43 | |
| *** nellysmitt has joined #openstack-keystone | 17:44 | |
| ayoung | afaranha, so what we want is a function that is called to get the member from the api. we want everything prepped so that, once we have the request, we can make a single call | 17:44 |
| dstanek | rodrigods: henrynash: i'm looking at it from an outsider's point of view; what would you expect back from The list only contains those roles assigned to this project that were specified as being inherited to its subtree."? | 17:44 |
| ayoung | if each API object only managed a single type of entity, and took a primary key in the get_member function we would have excatly what we needed by specifying just the API object | 17:45 |
| henrynash | (back on later) | 17:46 |
| *** henrynash has quit IRC | 17:46 | |
| dstanek | rodrigods: henrynash: is that the same as saying "you get back all roles a user has for a project" or "you get back only roles assigned to a user id, but this user may have more roles based on the groups they are in" | 17:47 |
| rodrigods | dstanek, the second | 17:47 |
| rodrigods | I mean, should be the second | 17:47 |
| dstanek | rodrigods: what says that the list is limited or that it only include a subset of the overall roles? | 17:48 |
| afaranha | ayoung, just to get me in context, this work is to be able to use a rule like this, right? 'create_user': 'role:domain_admin on scope:domain' | 17:49 |
| afaranha | we need to get the domain_id from the user, but the user is not an object yet | 17:50 |
| rodrigods | dstanek, "only contains those roles assigned to this project" and "specified as being inherited to its subtree" | 17:50 |
| rodrigods | dstanek, I might be missing something | 17:50 |
| dstanek | rodrigods: so all roles a user has on the project or only those mapped directly to a user id? | 17:51 |
| rodrigods | dstanek, only those mapped directly to a user id | 17:52 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 17:52 |
| *** wanghong has quit IRC | 17:52 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 17:53 |
| dstanek | morganfainberg: you own the oldest Keystone review! | 17:53 |
| *** wanghong has joined #openstack-keystone | 17:53 | |
| dstanek | open review that is | 17:53 |
| *** nellysmitt has quit IRC | 17:56 | |
| morganfainberg | dstanek, lol nice | 18:01 |
| morganfainberg | dstanek, haven't done the abandon sweep yet | 18:01 |
| *** ajayaa has joined #openstack-keystone | 18:01 | |
| *** marcoemorais has joined #openstack-keystone | 18:02 | |
| *** marcoemorais has quit IRC | 18:02 | |
| *** marcoemorais has joined #openstack-keystone | 18:02 | |
| *** rustlebee is now known as russellb | 18:09 | |
| bknudson | I usually go with this : http://russellbryant.net/openstack-stats/keystone-openreviews.html | 18:17 |
| bknudson | to look for old reviews | 18:17 |
| samuelms | dolphm, thanks for marking bug #1402339 as triaged ... will start working on that | 18:19 |
| uvirtbot | Launchpad bug 1402339 in keystone "Status code from HEAD requests must be consistent" [Low,Triaged] https://launchpad.net/bugs/1402339 | 18:19 |
| samuelms | morganfainberg, ^ that's related to a patch you submitted regarding HEAD apis | 18:19 |
| morganfainberg | yeah | 18:19 |
| morganfainberg | dang it... forgot to ask henrynash about something again | 18:19 |
| morganfainberg | ... | 18:19 |
| samuelms | gyee, ping .. would be glad to have your review here https://review.openstack.org/#/c/139531/2/api/v3/identity-api-v3.rst | 18:23 |
| samuelms | gyee, that's regarding domaiin-role api | 18:23 |
| topol | dstanek, you there | 18:26 |
| dstanek | topol: lunching,but sorta. What's up? | 18:28 |
| topol | dstanek, I had a question on your DI spec but I can wait till you are done with lunch. Just ping me | 18:28 |
| morganfainberg | dstanek, it *is* kindof lunchtime isn't it | 18:29 |
| * morganfainberg feels like he's been up since 4am... oh wait I have ... based on Pacific time | 18:30 | |
| *** harlowja has joined #openstack-keystone | 18:33 | |
| dstanek | morganfainberg: yep | 18:33 |
| topol | morganfainberg I had lamb kabobs for lunch. They were quite tasty | 18:34 |
| morganfainberg | topol, nice | 18:34 |
| morganfainberg | topol, i had ... haven't had lunch yet | 18:34 |
| topol | morganfainberg, clock out and eat. you need to keep your strength up | 18:35 |
| morganfainberg | lol | 18:35 |
| morganfainberg | topol, i will, just haven't decided *what* I want to eat yet | 18:35 |
| morganfainberg | thats the problem with being out here... too much good stuff | 18:35 |
| topol | morganfainberg, everything is in walking distance or you have to take your bike? | 18:36 |
| morganfainberg | topol, in manhattan... i'd say it's all walking - just depends on how much subway is involved for the further distances | 18:36 |
| topol | morganfainberg, I always goto the Carnegie Deli when Im there | 18:37 |
| gyee | samuelms, k, looking | 18:41 |
| *** gyee_ has joined #openstack-keystone | 18:42 | |
| gabriel-bezerra | marekd, dstanek: I'm trying to get it working with the browser before trying to automate it in a script. Could not move forward yet. Did you make any progress? Are you all stuck in the same place as I am: "Unable to establish security of incoming assertion"? | 18:42 |
| *** gyee_ has quit IRC | 18:43 | |
| dstanek | gabriel-bezerra: just prior to going to lunch I started to debug pysaml | 18:43 |
| gabriel-bezerra | dstanek: from the documentation, it seems like they invested much more in the SP side. It makes it less surprising if they didn't work to have the IdP side working properly. | 18:46 |
| *** rushiagr is now known as rushiagr_away | 18:46 | |
| *** ayoung has quit IRC | 18:46 | |
| *** ayoung_ has quit IRC | 18:46 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Avoid multiple instances for a provider https://review.openstack.org/124599 | 18:47 |
| *** ayoung has joined #openstack-keystone | 19:00 | |
| *** ChanServ sets mode: +v ayoung | 19:00 | |
| *** marcoemorais has quit IRC | 19:04 | |
| *** aix has quit IRC | 19:04 | |
| bknudson | morganfainberg: you've got a +2 on https://review.openstack.org/#/c/130474/ but not on the parent review | 19:04 |
| *** marcoemorais has joined #openstack-keystone | 19:05 | |
| gyee | samuelms, commented on the spec, I don't think its necessary to create a new resource for domain-owned role definitions | 19:10 |
| gyee | this is essentially the same argument for merging domains with projects | 19:10 |
| gyee | lets try to keep the paradigm consistent | 19:10 |
| gyee | I made the same argument to henrynash's spec awhile back | 19:11 |
| *** amakarov is now known as amakarov_away | 19:12 | |
| samuelms | gyee, well.. not sure I agree | 19:13 |
| samuelms | gyee, I will mull it | 19:13 |
| samuelms | gyee, also, let's see what henry thinks | 19:13 |
| gyee | samuelms, they are essentially "role definitions" | 19:15 |
| *** ajayaa has quit IRC | 19:17 | |
| *** dims has quit IRC | 19:17 | |
| *** dims has joined #openstack-keystone | 19:17 | |
| samuelms | gyee, well, they're like users and groups I think | 19:18 |
| samuelms | gyee, domain-roles are groups of roles, and they're namespaced | 19:18 |
| samuelms | gyee, the only difference between roles/domain-roles and users/groups is that groups cannot contain other groups, but domain-roles can | 19:19 |
| gyee | well, domain are project groups :) | 19:20 |
| stevemar | rodrigods, gyee, marekd do we have a bug for the k2k signing bug that rodrigods found? | 19:21 |
| gyee | stevemar, I think marekd filed a bug already | 19:21 |
| *** dims has quit IRC | 19:21 | |
| samuelms | gyee, but at some point users/groups are different from projects/domains | 19:22 |
| samuelms | gyee, groups have the concept of membership | 19:22 |
| samuelms | gyee, we think that approach fits better with roles/domain-roles: member roles ... | 19:23 |
| gyee | samuelms, how's that different from domain-project relationship? | 19:23 |
| samuelms | gyee, just the way we treat them when managing users on groups | 19:23 |
| samuelms | gyee, if they really would be the same, we should then put a flag on user's table ? so say that user is in fact a group? | 19:24 |
| gyee | samuelms, that's a different argument | 19:25 |
| samuelms | gyee, well .. we have two approaches: one does like we have domain/projects, and other does like groups/users | 19:25 |
| samuelms | gyee, just to make clear, we're still talking about CRUD of entities (still not discussing about grant api) | 19:26 |
| gyee | by creating a new resource, we are adding more complexity to the grant APIs for sure | 19:28 |
| topol | dstanek, you still eating lunch or are you watching a repeat of yesterdays Browns-Bengals game on ESPN Classic? | 19:29 |
| *** marcoemorais has quit IRC | 19:29 | |
| gyee | my understanding is that domain-owned roles are NOT necessary role definition groups | 19:29 |
| * topol topol ducks | 19:29 | |
| *** marcoemorais has joined #openstack-keystone | 19:29 | |
| gyee | it may have that restriction initially, but that's not all that they are designed to do | 19:30 |
| samuelms | gyee, yes I agree. we would then be able to handle user/group on domain/project with role/domain-role | 19:30 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: sync to oslo commit b19af08 https://review.openstack.org/138253 | 19:30 |
| samuelms | gyee, hmm. but they are groups of roles .. if they weren't (i.e just domain-scope roles) I'd agree with you | 19:30 |
| gyee | topol, don't remind me of the Browns | 19:30 |
| bknudson | johnny football! | 19:31 |
| samuelms | gyee, but they contain other roles, they hae membership, as users/groups | 19:31 |
| * gyee fleshes the money sign | 19:31 | |
| bknudson | maybe it was a different football -- soccer or australian rules. | 19:31 |
| topol | gyee, I can only assume you lost money betting on them... | 19:32 |
| gyee | samuelms, they don't contain other roles, they contains the "tags" for the policy APIs | 19:32 |
| samuelms | gyee, they contain global roles (as you call tags for the policy, but they're roles as we call today) and may also contain other domain-roles | 19:33 |
| gyee | topol, hell no! | 19:33 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: sync to oslo commit 1cf2c6 https://review.openstack.org/138253 | 19:33 |
| topol | gyee, you a browns fan? | 19:34 |
| gyee | topol, since 1987 | 19:34 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: sync to oslo commit 1cf2c6 https://review.openstack.org/138253 | 19:34 |
| topol | gyee, wow. you and dstanek can commiserate | 19:34 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: sync to oslo commit 1cf2c6 https://review.openstack.org/138253 | 19:34 |
| gyee | topol, for the record, I didn't piss on Modell's grave | 19:34 |
| topol | gyee, thanks for the visual. Im a Steelers fan | 19:35 |
| gyee | yeah, they won a few since | 19:36 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 19:36 |
| *** dims has joined #openstack-keystone | 19:37 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: update sample conf using oslo-config-generator https://review.openstack.org/138508 | 19:39 |
| gyee | samuelms, no, role to API (in policy.json) is not one to one right now | 19:39 |
| *** david-lyle is now known as david-lyle_lunch | 19:39 | |
| gyee | samuelms, aren't we going to create a distinct role/tag/whatever for each API in policy.json? | 19:40 |
| *** zzzeek has joined #openstack-keystone | 19:41 | |
| dstanek | topol: back | 19:41 |
| stevemar | requesting folks to look at https://review.openstack.org/#/c/138253 *and the other 'needed by' changes* to start using oslo.config instead of the old sample generator cc dstanek morganfainberg bknudson | 19:41 |
| dstanek | gabriel-bezerra: it was faster to write the script than to go through the browser a few times :-) | 19:42 |
| gyee | dstanek, I bet Bonnie Kosar still QB for the Browns :) | 19:42 |
| gyee | s/still/can still/ | 19:42 |
| topol | dstanek, did you see my comments on https://review.openstack.org/#/c/135931/5/specs/kilo/object-dependency-lifecycle.rst | 19:43 |
| dstanek | gyee: i've let the browns know on twitter several times that i'm available | 19:43 |
| topol | dstanek, I seem to be the sole "jerk" that -1 you :-). So maybe Im missing something in what you described | 19:44 |
| dstanek | topol: ++ | 19:44 |
| rodrigods | stevemar, gyee marekd regarding the credentials part or mappings using {0}? | 19:45 |
| *** rwsu has joined #openstack-keystone | 19:45 | |
| samuelms | gyee, I'd like to have one role per api, and call that capability | 19:45 |
| topol | dstanek, was everyone so sick of the DI magic that they are willing to give up on auto wiring? And just enjoy much more readable code (with manual wiring necessary)? | 19:45 |
| samuelms | gyee, but that's another story | 19:45 |
| topol | dstanek, I thought you were going to bring to the table a best practices DI structure that had readability and auto-wiring. But it seemed like the nirvana state was a future and it you were just proposing we go back to a Java like approach with no DI autowiring magic | 19:47 |
| bknudson | java has frameworks for di | 19:48 |
| gyee | samuelms, well, UX is going to suck with you have one role per API, imagine what 'GET /roles' is going to return | 19:48 |
| dstanek | topol: commented on the review | 19:48 |
| dstanek | topol: well, yes and no | 19:49 |
| dstanek | topol: it's not that it's the java way, that's the IoC pattern in general | 19:49 |
| gyee | samuelms, all I saying is that it doesn't matter what we call them, but think about consistency and usability | 19:50 |
| dstanek | one of the problems that led me to write the spec is that i couldn't find what dependencies were actually being constructed | 19:50 |
| topol | dstanek. so what part of what you propose makes you happy? That the code becomes more readable with out the DI? | 19:50 |
| dstanek | they happen because of the import | 19:50 |
| samuelms | gyee, ok | 19:50 |
| dstanek | topol: more readable, more configurable and more predictable | 19:51 |
| topol | dstanek, I agree. and when you need to add a new one you add it in manually and it looks like the others in the init | 19:51 |
| gyee | rodrigods, good question, I thought stevemar was referring to the signature validation bug | 19:51 |
| stevemar | gyee, yes that one | 19:51 |
| *** nellysmitt has joined #openstack-keystone | 19:51 | |
| bknudson | dstanek: for extensions the registration happens on import... not for the core drivers. | 19:52 |
| dstanek | topol: yes at least for now | 19:52 |
| bknudson | but then we've got a spec to get rid of extensions. | 19:52 |
| topol | dstanek huge +! on more readable and more configurable. Any idea why Keystone put the DI magic in to begin with? Theymust have thought they were improving something beyond making the code brutally hard for newbies to understand | 19:52 |
| *** david-lyle_lunch is now known as david-lyle | 19:53 | |
| *** david-lyle is now known as david-lyle_t | 19:53 | |
| *** david-lyle_t is now known as david-lyle | 19:53 | |
| bknudson | topol: https://review.openstack.org/#/c/18395/ | 19:53 |
| dstanek | topol: not sure, but morganfainberg or dolphm would probably know | 19:53 |
| topol | dstanek, what could the future look like. (when you say at least for now) | 19:54 |
| dolphm | dstanek: topol: ? | 19:54 |
| dolphm | topol: oh DI backstory ... don't mind me. | 19:54 |
| rodrigods | gyee, stevemar think the signature validation one still need to be reported | 19:54 |
| bknudson | maybe we can just revert https://review.openstack.org/#/c/18395/ | 19:55 |
| dolphm | topol: i only wrote DI to win an argument | 19:55 |
| topol | dolphm, Im all ears. DI backstory plz... | 19:55 |
| bknudson | so we passed all the drivers to the controllers | 19:55 |
| topol | dolphm, so you added the DI magic and obfuscated the code to win a bet? Are you living out the plot to the movie Trading Places??? | 19:56 |
| dolphm | topol: it was better than the alternative | 19:56 |
| dolphm | topol: i didn't want to let the alternative land | 19:56 |
| topol | dolphm who gave you a dollar to ruin our lives ? :-) | 19:56 |
| * topol topol forgets dolphm too young for the movie reference | 19:57 | |
| *** jorge_munoz has joined #openstack-keystone | 19:57 | |
| topol | dolphm, what was the alternative just curiously? | 19:57 |
| dolphm | topol: yes, the alternative was too young | 19:57 |
| gyee | so DIY instead of DI :) | 19:59 |
| topol | dstanek, I appreciate the explanation. You have a +1 from me. Im really looking fwd to this change and the magic going away | 20:02 |
| topol | dstanek was it you in the crowd that pushed the bengals player down when he tried to jump in the stands? | 20:02 |
| bknudson | dstanek: does the DI spec require henrynash's no extensions spec? https://review.openstack.org/#/c/133809/ | 20:03 |
| *** zzzeek has quit IRC | 20:08 | |
| dstanek | gabriel-bezerra: it their IdP really isn't up to the task what is the easiest IdP is install/configure/use for this? | 20:12 |
| *** nellysmitt has quit IRC | 20:16 | |
| *** avozza is now known as zz_avozza | 20:27 | |
| *** zz_avozza is now known as avozza | 20:28 | |
| *** DavidHu has quit IRC | 20:30 | |
| *** redrobot has quit IRC | 20:30 | |
| *** vhoward has quit IRC | 20:30 | |
| *** crinkle has quit IRC | 20:30 | |
| *** grantbow has quit IRC | 20:30 | |
| *** telemonster has quit IRC | 20:30 | |
| *** avozza is now known as zz_avozza | 20:30 | |
| *** zz_avozza is now known as avozza | 20:31 | |
| *** DavidHu has joined #openstack-keystone | 20:31 | |
| *** vhoward has joined #openstack-keystone | 20:31 | |
| *** redrobot has joined #openstack-keystone | 20:31 | |
| *** telemonster has joined #openstack-keystone | 20:31 | |
| *** crinkle has joined #openstack-keystone | 20:31 | |
| *** grantbow has joined #openstack-keystone | 20:31 | |
| gabriel-bezerra | dstanek: I have no idea. All I've used is testshib and this example idp. | 20:32 |
| dstanek | gabriel-bezerra: testshib is a remote service right? nothing to install locally? | 20:32 |
| gabriel-bezerra | dstanek: I've never installed an IdP before | 20:32 |
| gabriel-bezerra | dstanek: right | 20:32 |
| gabriel-bezerra | dstanek: I've even written an script to automate using testshib | 20:33 |
| dstanek | automate in what way? | 20:33 |
| gabriel-bezerra | dstanek: it would register the sp in their idp and another part would also do the authentication | 20:33 |
| gabriel-bezerra | dstanek: but I'm not sure they would like to have our jenkins registering themselves and running automated tests tens of times a day | 20:34 |
| dstanek | yeah, i would doubt it | 20:35 |
| *** amcrn has joined #openstack-keystone | 20:41 | |
| *** marcoemorais has quit IRC | 20:45 | |
| openstackgerrit | David Stanek proposed openstack/keystone-specs: Adds a spec for fixing Keystone's DI https://review.openstack.org/135931 | 20:45 |
| *** marcoemorais has joined #openstack-keystone | 20:46 | |
| *** zzzeek has joined #openstack-keystone | 20:50 | |
| lbragstad | stevemar: ++ on the rechecking_into_submission tag | 20:51 |
| *** henrynash has joined #openstack-keystone | 20:52 | |
| *** ChanServ sets mode: +v henrynash | 20:52 | |
| stevemar | i try | 20:53 |
| *** raildo has quit IRC | 20:56 | |
| *** Shohei_ has joined #openstack-keystone | 21:00 | |
| *** zzzeek_ has joined #openstack-keystone | 21:00 | |
| *** david-ly_ has joined #openstack-keystone | 21:00 | |
| *** Shohei has quit IRC | 21:01 | |
| *** zzzeek has quit IRC | 21:02 | |
| *** topol has quit IRC | 21:02 | |
| *** diegows has quit IRC | 21:02 | |
| *** ekarlso- has quit IRC | 21:02 | |
| *** zzzeek_ is now known as zzzeek | 21:02 | |
| *** david-lyle has quit IRC | 21:02 | |
| *** davechen_ has quit IRC | 21:02 | |
| *** lvh has quit IRC | 21:02 | |
| *** lvh has joined #openstack-keystone | 21:03 | |
| *** davechen_ has joined #openstack-keystone | 21:04 | |
| *** amcrn has quit IRC | 21:13 | |
| *** ekarlso- has joined #openstack-keystone | 21:15 | |
| *** diegows has joined #openstack-keystone | 21:15 | |
| *** topol has joined #openstack-keystone | 21:16 | |
| *** ChanServ sets mode: +v topol | 21:16 | |
| *** thiagop has joined #openstack-keystone | 21:22 | |
| *** diegows has quit IRC | 21:39 | |
| rodrigods | morganfainberg, ayoung, ok... we need a final +2 so we don't need to revert the change from inherited role assignments to projects: https://review.openstack.org/#/c/130277/ | 21:42 |
| morganfainberg | rodrigods, as long as we've addressed dstanek's issues [reading it over now] i don't see why that'll be hard to do | 21:43 |
| *** topol has quit IRC | 21:43 | |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: documentation for audit middleware https://review.openstack.org/130344 | 21:44 |
| *** lihkin has joined #openstack-keystone | 21:46 | |
| *** marcoemorais has quit IRC | 21:46 | |
| *** marcoemorais has joined #openstack-keystone | 21:47 | |
| morganfainberg | rodrigods, it looks like no functional/code changes | 21:47 |
| morganfainberg | rodrigods, will be needed. | 21:47 |
| rodrigods | morganfainberg, yes, we kept the same URLs and so on | 21:47 |
| rodrigods | thanks morganfainberg and sorry we've forgot about the API spec being a requirement of the code itself | 21:49 |
| openstackgerrit | Merged openstack/keystone-specs: API doc for Inherited Role Assignments to Projects https://review.openstack.org/130277 | 21:49 |
| *** openstackgerrit has quit IRC | 21:50 | |
| *** openstackgerrit has joined #openstack-keystone | 21:50 | |
| samuelms | henrynash, ping | 21:59 |
| *** diegows has joined #openstack-keystone | 22:02 | |
| samuelms | henrynash, I wrote an etherpad describing some ideas on policy/rbac/domain-roles/capabilities | 22:02 |
| samuelms | henrynash, please take a look and give me your review | 22:03 |
| samuelms | henrynash, https://etherpad.openstack.org/p/keystone-policy-rbac | 22:03 |
| stevemar | rodrigods, ping | 22:06 |
| rodrigods | stevemar, hey | 22:07 |
| stevemar | rodrigods, did you ever run into a '"WARN Shibboleth.SSO.SAML2 [2]: detected a problem with assertion: Message was signed, but signature could not be verified."' error when doing k2k? | 22:08 |
| rodrigods | stevemar, yes | 22:08 |
| rodrigods | stevemar, are you in the mail thread with gyee and marekd ? | 22:09 |
| rodrigods | I think I described how further I got in that issue | 22:09 |
| stevemar | rodrigods, yep, but this is different from that nullsecurity issue isn't it? | 22:09 |
| rodrigods | stevemar, I think is the same issue | 22:10 |
| rodrigods | stevemar, the NullSecurity policy was how I got through it | 22:10 |
| *** david-ly_ is now known as david-lyle | 22:11 | |
| rodrigods | stevemar, also... I think the issue dstanek, marekd and gabriel-bezerra are having to set up pysaml2 as IdP is the same | 22:11 |
| *** DavidHu has quit IRC | 22:13 | |
| *** DavidHu has joined #openstack-keystone | 22:13 | |
| *** marcoemorais has quit IRC | 22:14 | |
| gyee | rodrigods, I have had a chance to debug it further yet, I'll dive back into it later today | 22:15 |
| *** marcoemorais has joined #openstack-keystone | 22:15 | |
| gyee | s/have/have not/ | 22:15 |
| rodrigods | gyee, great! did you plan any next steps? | 22:16 |
| gyee | yeah, I'll generate a cert chain, and run it with strace to see where they are loading | 22:16 |
| rodrigods | gyee, hmm | 22:19 |
| rodrigods | cool, please let us know the outcome :) | 22:19 |
| gyee | sure | 22:20 |
| dstanek | rodrigods: stevemar: there error i get in HTML is 'Unable to establish security of incoming assertion' | 22:20 |
| rodrigods | dstanek, have you tried to use the NullSecurityPolicy? | 22:21 |
| rodrigods | dstanek, last note here http://rodrigods.com/playing-with-keystone-to-keystone-federation/ | 22:21 |
| stevemar | dstanek, rodrigods, is there a separate mail thread for this stuff or just the one we're currently on | 22:24 |
| rodrigods | stevemar, dstanek I'm in just one thread | 22:24 |
| dstanek | rodrigods: replace this (http://paste.openstack.org/show/151435/) with that? | 22:24 |
| dstanek | stevemar: is there an email thread? | 22:24 |
| stevemar | dstanek, yes, i'll add you in! | 22:25 |
| rodrigods | dstanek, no... the file itself | 22:25 |
| dstanek | rodrigods: ah ok, let me try | 22:26 |
| rodrigods | dstanek, /etc/shibboleth/security-policy.xml | 22:26 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Correct incorrect rst in docstrings https://review.openstack.org/141924 | 22:28 |
| dstanek | rodrigods: that looks very not secure, but seems to work for me | 22:29 |
| rodrigods | dstanek, yes, it helps to not being blocked in a step for too much time | 22:30 |
| rodrigods | stevemar, it's confirmed, is the same issue | 22:30 |
| dstanek | rodrigods: i'm getting a 401 now, but probably means that keystone is not configured properly | 22:30 |
| rodrigods | dstanek, ++ | 22:30 |
| *** hdd has joined #openstack-keystone | 22:31 | |
| dstanek | rodrigods: so after i POST to http://localhost:5000/Shibboleth.sso/SAML2/POST i get redirected back to http://localhost:5000/v3/OS-FEDERATION/identity_providers/pysaml2-idp/protocols/saml2/auth where i get a 401 | 22:33 |
| rodrigods | dstanek, looks like a problem with the mapping/assertion attributes | 22:33 |
| dstanek | rodrigods: looks like i may be getting an AuthMethodNotSupported so maybe federation isn't wired in | 22:34 |
| rodrigods | dstanek, hmm yeah | 22:35 |
| *** ncoghlan has joined #openstack-keystone | 22:35 | |
| stevemar | rodrigods, if I do: curl -i -X POST -d <saml_assertion> "http://keystone.sp/Shibboleth.sso/SAML2/ECP" -H "Content-Type: application/vnd.paos+xml" it should work right - i shouldn't need to wrap it in all the ECP stuff? | 22:37 |
| rodrigods | stevemar, it should refuse anything that isn't SOAP in that step | 22:38 |
| *** htruta_ has joined #openstack-keystone | 22:39 | |
| *** topol has joined #openstack-keystone | 22:44 | |
| *** ChanServ sets mode: +v topol | 22:44 | |
| *** cretz has joined #openstack-keystone | 22:49 | |
| *** henrynash has quit IRC | 22:50 | |
| cretz | using the identity v3 API, what's the recommended way to get all users for a project? I can limit it by role if necessary | 22:50 |
| rodrigods | cretz, one way is GET v3/role_assignments/project_id=X | 22:51 |
| rodrigods | but it will return groups as well | 22:51 |
| cretz | ah, I should have clarified, I was wanting usernames, not just the user ID's | 22:51 |
| rodrigods | cretz, one way is GET v3/role_assignments?project_id=X | 22:51 |
| samuelms | ? | 22:51 |
| samuelms | rodrigods, yep.. with ? for query_params :) | 22:51 |
| cretz | I can make many calls to /users/ID to get the usernames for each ID | 22:51 |
| cretz | I don't see a way, like with the neutron API, where I can provide column selection or ask for /users w/ the filter by a collection of user ID's | 22:52 |
| cretz | I was wanting to avoid N calls, one per user | 22:53 |
| *** jaosorior has quit IRC | 22:53 | |
| *** gordc has quit IRC | 22:53 | |
| samuelms | cretz, I think the wont be a better way. In Keystone users dont belong to projects | 22:53 |
| samuelms | cretz, so you can't list users of a project | 22:54 |
| cretz | I suppose the question is more of a general "how can I get a collection of users if I have a collection of user ID's from another call, be it group, role, project, etc" | 22:54 |
| samuelms | cretz, you can list users that have any ROLE on a project, i.e a role assingment | 22:54 |
| cretz | right, I have done that successfully...I am afraid I phrased my question wrong...it's more about obtaining collections of user details | 22:55 |
| *** lihkin has quit IRC | 22:55 | |
| samuelms | cretz, if you have a collection of ids, and you want to get a collection of refs (dicts with name, etc) you need to query each on separately | 22:55 |
| cretz | k, thanks | 22:55 |
| samuelms | cretz, np | 22:55 |
| samuelms | morganfainberg, could that be useful ? ^ | 22:56 |
| samuelms | morganfainberg, besides retrieving an entity from its id | 22:57 |
| samuelms | morganfainberg, to retrieve a set of entities from a set of ids | 22:57 |
| samuelms | ? | 22:57 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone-specs: Fix RST formatting issues https://review.openstack.org/141930 | 22:57 |
| *** dims has quit IRC | 22:58 | |
| cretz | samuelms, I believe it could be, an IN clause to the database is better than O(n) HTTP roundtrips IMO | 22:58 |
| *** packet has quit IRC | 22:59 | |
| samuelms | cretz, yes .. that is. but we need to have a concrete use case to implement that | 23:01 |
| dstanek | ah, no i have to figure out what my federation prefix should be | 23:03 |
| *** andreaf has quit IRC | 23:03 | |
| samuelms | dolphm, what about adding automate spell and rst format checks to our keystone-specs ? | 23:03 |
| *** dims has joined #openstack-keystone | 23:03 | |
| dstanek | samuelms: the format should be checked during rendering | 23:04 |
| dstanek | samuelms: spelling would be great to add | 23:04 |
| samuelms | dstanek, yep :) I see a lot of comments on reviews regarding typo | 23:05 |
| samuelms | dstanek, I always comment like : s/wrong/corrent :p | 23:05 |
| morganfainberg | dolphm, wow that is a big changeset. | 23:05 |
| samuelms | s/corrent/correct | 23:05 |
| *** charz has quit IRC | 23:06 | |
| richm1 | dtroyer: stevemar: ping - can you guys throw some weight behind https://bugs.launchpad.net/ubuntu/+source/python-openstackclient/+bug/1393873 ? | 23:07 |
| uvirtbot | Launchpad bug 1393873 in python-openstackclient "MUCH MUCH NEWER NEEDED" [Undecided,New] | 23:07 |
| richm1 | This one of the main blockers for getting python-openstackclient support (and Keystone v3 support) into puppet-openstacklib et. al. | 23:08 |
| *** charz has joined #openstack-keystone | 23:09 | |
| *** topol has quit IRC | 23:11 | |
| *** henrynash has joined #openstack-keystone | 23:12 | |
| *** ChanServ sets mode: +v henrynash | 23:12 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add fetch revocations for v2.0 https://review.openstack.org/141935 | 23:19 |
| jamielennox | morning all | 23:19 |
| samuelms | morning lol | 23:19 |
| *** timcline_ has joined #openstack-keystone | 23:19 | |
| samuelms | jamielennox, just remembered you're based in Australia :-) 10 20 am | 23:20 |
| jamielennox | samuelms: brisbane time, so 9:20 | 23:21 |
| *** timcline has quit IRC | 23:23 | |
| *** timcline_ has quit IRC | 23:24 | |
| morganfainberg | morning jamielennox | 23:24 |
| jamielennox | morganfainberg: i'm just seeing the abandoning rampage | 23:25 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add support for domain specific roles. https://review.openstack.org/133855 | 23:25 |
| *** dims has quit IRC | 23:25 | |
| samuelms | jamielennox, cool :-) | 23:29 |
| dstanek | marekd: gabriel-bezerra: i'm super close now - i just don't see anything coming back to map against | 23:31 |
| samuelms | dstanek, o/ | 23:32 |
| samuelms | dstanek, dont know exactly where you are .. but I like the super clode :-) | 23:33 |
| samuelms | close | 23:33 |
| dstanek | samuelms: hi | 23:33 |
| jamielennox | morganfainberg: i had a pop up saying you wanted to talk about something ksc, but i can't find it in scrollback. what's up? | 23:35 |
| morganfainberg | jamielennox, i need to remember | 23:38 |
| morganfainberg | jamielennox, doh! | 23:38 |
| morganfainberg | jamielennox, i didn't abandon in -specs | 23:39 |
| morganfainberg | but hit the other repos | 23:39 |
| morganfainberg | jamielennox, you had a bunch, but feel free to re-instate them | 23:39 |
| samuelms | dstanek, hi .. so finally you're getting pysaml2 to talk to keystone sp properly? | 23:40 |
| jamielennox | morganfainberg: yea - that's fine, a lot i feel like we'll need eventually but just aren't pressing enough to push through atm | 23:40 |
| dstanek | samuelms: mostly, what i don't know is how to tell it to include some attributes in the assertion | 23:43 |
| samuelms | dstanek, nice! I pinged Gabriel, will ask him to take this point with you :) think he can help | 23:45 |
| samuelms | dstanek, gotta to go home now, will be back in few hours | 23:45 |
| dstanek | samuelms: sounds good | 23:45 |
| *** samuelms is now known as samuelms-away | 23:45 | |
| dstanek | maybe this is a mod_shib problem - what do i have to do with attribute-map.xml? | 23:48 |
| dstanek | stevemar: marekd: ^ | 23:48 |
| *** henrynash has quit IRC | 23:50 | |
| gyee | dstanek, just add these | 23:52 |
| gyee | <Attribute name="openstack_user" id="openstack_user"/> | 23:52 |
| gyee | <Attribute name="openstack_roles" id="openstack_roles"/> | 23:52 |
| gyee | <Attribute name="openstack_project" id="openstack_project"/> | 23:52 |
| dstanek | gyee: won't i need something in the data called openstack_* for those to match against? | 23:53 |
| *** marcoemorais1 has joined #openstack-keystone | 23:53 | |
| gyee | no | 23:54 |
| *** marcoemorais has quit IRC | 23:54 | |
| gyee | idp.py look for them | 23:54 |
| gyee | see keystone/contrib/federation/idp.py | 23:54 |
| dstanek | gyee: where doe shib get the data to fill in? | 23:56 |
| gyee | from the asssertion | 23:57 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add validate token for v2.0 https://review.openstack.org/141944 | 23:58 |
| gyee | dstanek, IdP Keystone stuff the token data into those attributes | 23:58 |
| *** avozza is now known as zz_avozza | 23:59 | |
| dstanek | gyee: ah, i'm not doing k2k federation - i have a pysaml2 idp setup | 23:59 |
| gyee | oh | 23:59 |
| gyee | you are testing with ADFS? | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!