| *** Lexis has quit IRC | 00:08 | |
| *** jimbaker has quit IRC | 00:14 | |
| *** jimbaker has joined #openstack-keystone | 00:18 | |
| *** jimbaker has quit IRC | 00:19 | |
| *** jimbaker has joined #openstack-keystone | 00:19 | |
| *** hdd has joined #openstack-keystone | 00:22 | |
| *** hichtakk has joined #openstack-keystone | 00:32 | |
| *** rm_work is now known as rm_work|away | 00:34 | |
| *** hdd has quit IRC | 00:36 | |
| *** diegows has joined #openstack-keystone | 00:38 | |
| *** hichtakk has quit IRC | 00:41 | |
| *** wanghong has quit IRC | 00:46 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Basic AccessInfo plugin https://review.openstack.org/143338 | 00:47 |
|---|---|---|
| *** avozza is now known as zz_avozza | 00:47 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Reference identity plugins from __init__.py https://review.openstack.org/143339 | 01:06 |
| *** jacer_huawei has joined #openstack-keystone | 01:10 | |
| *** diegows has quit IRC | 01:16 | |
| *** stevemar has joined #openstack-keystone | 01:39 | |
| *** ChanServ sets mode: +v stevemar | 01:39 | |
| jamielennox | morganfainberg: here? | 01:50 |
| *** chrisshattuck has joined #openstack-keystone | 02:04 | |
| *** chrisshattuck has quit IRC | 02:09 | |
| *** diegows has joined #openstack-keystone | 02:14 | |
| *** jacer_huawei has quit IRC | 02:15 | |
| *** jacer_huawei has joined #openstack-keystone | 02:19 | |
| *** oomichi has joined #openstack-keystone | 02:23 | |
| *** diegows has quit IRC | 02:26 | |
| *** hdd has joined #openstack-keystone | 02:36 | |
| *** hichtakk has joined #openstack-keystone | 02:42 | |
| *** erkules_ has joined #openstack-keystone | 02:49 | |
| *** erkules has quit IRC | 02:49 | |
| *** rm_work|away is now known as rm_work | 02:50 | |
| *** hichtakk has quit IRC | 02:53 | |
| *** hdd has quit IRC | 02:59 | |
| *** dims has quit IRC | 03:10 | |
| *** dims has joined #openstack-keystone | 03:13 | |
| *** raildo_ has joined #openstack-keystone | 03:22 | |
| *** dims has quit IRC | 03:41 | |
| *** rushiagr_away is now known as rushiagr | 03:43 | |
| *** hichtakk has joined #openstack-keystone | 03:54 | |
| *** hichtakk has quit IRC | 03:59 | |
| *** stevemar has quit IRC | 04:01 | |
| *** stevemar has joined #openstack-keystone | 04:02 | |
| *** ChanServ sets mode: +v stevemar | 04:02 | |
| *** hichtakk has joined #openstack-keystone | 04:07 | |
| *** eglynn-regus has quit IRC | 04:11 | |
| *** eglynn-regus has joined #openstack-keystone | 04:12 | |
| *** serverascode____ has quit IRC | 04:16 | |
| *** mitz has quit IRC | 04:16 | |
| *** mitz has joined #openstack-keystone | 04:18 | |
| *** jamiec has quit IRC | 04:18 | |
| *** serverascode____ has joined #openstack-keystone | 04:18 | |
| *** jamiec has joined #openstack-keystone | 04:20 | |
| *** stevemar has quit IRC | 04:21 | |
| *** stevemar has joined #openstack-keystone | 04:21 | |
| *** ChanServ sets mode: +v stevemar | 04:21 | |
| *** hichtakk has quit IRC | 04:30 | |
| *** hichtakk has joined #openstack-keystone | 04:30 | |
| *** hichtakk has quit IRC | 04:35 | |
| *** dims has joined #openstack-keystone | 04:41 | |
| *** rushiagr is now known as rushiagr_away | 04:44 | |
| *** dims has quit IRC | 04:47 | |
| *** crinkle has quit IRC | 05:05 | |
| *** henrynash has quit IRC | 05:05 | |
| *** dobson has quit IRC | 05:05 | |
| *** crinkle has joined #openstack-keystone | 05:05 | |
| *** xianghui has quit IRC | 05:06 | |
| *** xianghui has joined #openstack-keystone | 05:06 | |
| *** vhoward has quit IRC | 05:09 | |
| *** vhoward has joined #openstack-keystone | 05:09 | |
| *** redrobot has quit IRC | 05:09 | |
| *** notmyname_ has joined #openstack-keystone | 05:10 | |
| *** therve` has joined #openstack-keystone | 05:10 | |
| *** dobson has joined #openstack-keystone | 05:11 | |
| *** notmyname has quit IRC | 05:11 | |
| *** nonameentername has quit IRC | 05:11 | |
| *** therve has quit IRC | 05:11 | |
| *** nonameentername has joined #openstack-keystone | 05:11 | |
| *** notmyname_ is now known as notmyname | 05:11 | |
| *** redrobot has joined #openstack-keystone | 05:12 | |
| *** redrobot is now known as Guest87463 | 05:12 | |
| *** hichtakk has joined #openstack-keystone | 05:39 | |
| *** hdd has joined #openstack-keystone | 05:45 | |
| *** jamiec has quit IRC | 05:45 | |
| *** jamiec has joined #openstack-keystone | 05:45 | |
| *** rushiagr_away is now known as rushiagr | 05:46 | |
| *** linstatsdr_ has joined #openstack-keystone | 05:46 | |
| *** linstatsdr__ has joined #openstack-keystone | 05:47 | |
| *** linstatsdr__ has quit IRC | 05:48 | |
| *** LinstatSDR has quit IRC | 05:49 | |
| *** linstatsdr_ has quit IRC | 05:50 | |
| *** LinstatSDR has joined #openstack-keystone | 05:51 | |
| *** oomichi has quit IRC | 05:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:02 |
| *** stevemar has quit IRC | 06:06 | |
| *** eglynn-regus has quit IRC | 06:20 | |
| *** topol has joined #openstack-keystone | 06:22 | |
| *** ChanServ sets mode: +v topol | 06:22 | |
| *** eglynn-regus has joined #openstack-keystone | 06:52 | |
| *** hdd has quit IRC | 06:59 | |
| *** raildo_ has quit IRC | 07:04 | |
| *** k4n0 has joined #openstack-keystone | 07:30 | |
| *** hichtakk has quit IRC | 07:42 | |
| *** zz_avozza is now known as avozza | 07:48 | |
| *** LinstatSDR has quit IRC | 07:58 | |
| *** jamielennox is now known as jamielennox|away | 08:15 | |
| *** dorry has quit IRC | 08:23 | |
| *** topol has quit IRC | 08:25 | |
| *** dims has joined #openstack-keystone | 08:50 | |
| *** rm_work is now known as rm_work|away | 08:53 | |
| *** dims has quit IRC | 08:54 | |
| *** rm_work|away is now known as rm_work | 09:00 | |
| openstackgerrit | wanghong proposed openstack/keystone: fix wrong self link in the response of endpoint_groups API https://review.openstack.org/143403 | 09:10 |
| *** ChanServ sets mode: +o dolphm | 09:18 | |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: support micro version if sent https://review.openstack.org/130916 | 09:41 |
| *** rm_work is now known as rm_work|away | 09:44 | |
| *** aix has joined #openstack-keystone | 10:10 | |
| *** nellysmitt has joined #openstack-keystone | 10:12 | |
| *** Lexis has joined #openstack-keystone | 10:34 | |
| *** toddnni has quit IRC | 10:57 | |
| *** tristanC has quit IRC | 11:01 | |
| *** tristanC has joined #openstack-keystone | 11:02 | |
| *** toddnni has joined #openstack-keystone | 11:03 | |
| *** tristanC has quit IRC | 11:06 | |
| *** diegows has joined #openstack-keystone | 11:07 | |
| *** tristanC has joined #openstack-keystone | 11:07 | |
| *** dims has joined #openstack-keystone | 11:45 | |
| *** Lexis has quit IRC | 11:47 | |
| *** Lexis has joined #openstack-keystone | 11:52 | |
| *** Lexis has quit IRC | 11:52 | |
| *** dims has quit IRC | 11:58 | |
| *** avozza is now known as zz_avozza | 12:02 | |
| *** zz_avozza is now known as avozza | 12:02 | |
| *** fifieldt__ has quit IRC | 12:02 | |
| *** fifieldt has joined #openstack-keystone | 12:07 | |
| *** dims has joined #openstack-keystone | 12:18 | |
| *** Lexis has joined #openstack-keystone | 12:33 | |
| *** dims_ has joined #openstack-keystone | 12:39 | |
| *** dims has quit IRC | 12:42 | |
| *** dims_ has quit IRC | 13:13 | |
| breton | are we going to have a meeting this Tuesday? | 13:13 |
| *** dims has joined #openstack-keystone | 13:17 | |
| *** Lexis has quit IRC | 13:17 | |
| *** avozza is now known as zz_avozza | 13:18 | |
| *** henrynash has joined #openstack-keystone | 13:24 | |
| *** ChanServ sets mode: +v henrynash | 13:24 | |
| *** ayoung has joined #openstack-keystone | 13:42 | |
| *** ChanServ sets mode: +v ayoung | 13:42 | |
| *** LinstatSDR has joined #openstack-keystone | 13:50 | |
| *** topol has joined #openstack-keystone | 14:01 | |
| *** rushiagr is now known as rushiagr_away | 14:01 | |
| *** topol is now known as Guest96600 | 14:01 | |
| *** Guest96600 has quit IRC | 14:01 | |
| lbragstad | breton: I doesn't look like there is much on the schedule https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting | 14:04 |
| lbragstad | breton: but morganfainberg will have to make the call on that | 14:04 |
| breton | I have a number of topics I want to discusss about my alembic stuff | 14:18 |
| breton | and I'm not sure that I can do it here, out of the meeting | 14:18 |
| *** larsks|alt is now known as larsks | 14:18 | |
| breton | (and I have a bp that I think can be no-spec) | 14:18 |
| *** dims has quit IRC | 14:26 | |
| *** amakarov_away is now known as amakarov | 14:26 | |
| *** jungleboyj has quit IRC | 14:30 | |
| *** dims has joined #openstack-keystone | 14:31 | |
| *** zz_avozza is now known as avozza | 14:39 | |
| *** raildo_ has joined #openstack-keystone | 14:43 | |
| *** raildo has joined #openstack-keystone | 14:45 | |
| *** gordc has joined #openstack-keystone | 14:48 | |
| *** avozza is now known as zz_avozza | 14:49 | |
| *** jaosorior has joined #openstack-keystone | 14:57 | |
| *** topol has joined #openstack-keystone | 15:01 | |
| *** ChanServ sets mode: +v topol | 15:01 | |
| *** rushiagr_away is now known as rushiagr | 15:14 | |
| *** jungleboyj has joined #openstack-keystone | 15:21 | |
| *** stevemar has joined #openstack-keystone | 15:23 | |
| *** ChanServ sets mode: +v stevemar | 15:23 | |
| dstanek | morning | 15:27 |
| *** ayoung has quit IRC | 15:28 | |
| raildo | morning | 15:36 |
| *** jorge_munoz has joined #openstack-keystone | 15:38 | |
| *** henrynash has quit IRC | 15:38 | |
| *** henrynash_ has joined #openstack-keystone | 15:38 | |
| *** ChanServ sets mode: +v henrynash_ | 15:38 | |
| *** zz_avozza is now known as avozza | 15:40 | |
| *** EmilienM is now known as EmilienM|afk | 15:47 | |
| *** topol has quit IRC | 15:55 | |
| *** hdd has joined #openstack-keystone | 15:57 | |
| lbragstad | marekd: not sure if you've seen the response here or not? https://review.openstack.org/#/c/130376/19 | 15:58 |
| lbragstad | marekd: wondering if you have input | 16:00 |
| *** ayoung has joined #openstack-keystone | 16:04 | |
| *** ChanServ sets mode: +v ayoung | 16:05 | |
| openstackgerrit | Merged openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 16:07 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 16:08 |
| marekd | lbragstad: i am looking at it. | 16:09 |
| lbragstad | ok | 16:09 |
| marekd | lbragstad: he still didn't say anything how to handle information between two authN calls | 16:11 |
| marekd | lbragstad: i am curious if it's already in the library or somewhere in Keystone. | 16:12 |
| lbragstad | marekd: so the session question? | 16:13 |
| marekd | lbragstad: yes | 16:13 |
| lbragstad | hmmm | 16:14 |
| lbragstad | marekd: I think that could be done a couple ways | 16:14 |
| lbragstad | if a user who has MFA enabled tried to authenticate for a token, keystone could return a "partial" token that the user would have to provide back to Keystone with the otp-password | 16:15 |
| lbragstad | or, it could all be made in the same request. | 16:16 |
| marekd | lbragstad: yes, but I think it's important enough to mention it in the spec :-) | 16:16 |
| *** chrisshattuck has joined #openstack-keystone | 16:17 | |
| lbragstad | marekd: would you think there is anything wrong with those two solutions/ | 16:17 |
| marekd | lbragstad: not at all. | 16:18 |
| marekd | lbragstad: werner is not you, right? :p | 16:18 |
| lbragstad | lol | 16:18 |
| lbragstad | nope | 16:18 |
| marekd | :-) | 16:18 |
| lbragstad | but he is out for the holiday s | 16:19 |
| marekd | lbragstad: i think your ideas are fine, but I don't know how werner wants to accomplish it. And he wants to use some 3rd party library | 16:19 |
| marekd | and i don't know lib's interface so i don't know it its doable in a easy way. | 16:19 |
| marekd | that's why i asked him to explain what's his plan. | 16:20 |
| lbragstad | by library you mean a something to manage the sessions | 16:20 |
| lbragstad | ? | 16:20 |
| lbragstad | correct? | 16:20 |
| marekd | lbragstad: i mean anything that will handle MFA | 16:20 |
| marekd | including TOTP etc. | 16:20 |
| *** avozza is now known as zz_avozza | 16:22 | |
| marekd | lbragstad: hmm, i thought i had seen something mentioning use of external libraries. | 16:22 |
| lbragstad | marekd: I think the idea nonameentername (werner) had initially was to write a new auth plugin that would implement the TOTP implementation | 16:23 |
| marekd | lbragstad: uuu :( | 16:23 |
| marekd | lbragstad: do you think is safe? I don't know TOTP | 16:23 |
| marekd | lbragstad: but it looks like another algorithm heavily dealing with security, randomness and crypto | 16:23 |
| lbragstad | https://tools.ietf.org/html/rfc6238 | 16:24 |
| lbragstad | I know I've seen examples of it written in python, | 16:25 |
| lbragstad | trying to dig those up | 16:25 |
| *** thedodd has joined #openstack-keystone | 16:25 | |
| marekd | lbragstad: ok, so he wants to have 2 authn plugins: 'password' and 'otp-password'. 'password' would have to handle both standard authn (so, user/password only) as well first half of MFA, whereas otp-password would handle this 'possession' code, right? | 16:28 |
| lbragstad | "password" would be the existing password auth plugin | 16:28 |
| marekd | lbragstad: did you see his comment from line 205 ? | 16:29 |
| marekd | lbragstad: looks like he wants to inherint from auth.plugins.Password | 16:29 |
| lbragstad | the plugin for otp-password could enherit from password if they share similar logic | 16:30 |
| marekd | lbragstad: ok, let me try to clarify. | 16:30 |
| *** dims has quit IRC | 16:31 | |
| marekd | lbragstad: so, he wants to keep classic user/password authN workflow, right? | 16:31 |
| lbragstad | marekd: correct, this would be an opt in type of feature | 16:31 |
| *** dims has joined #openstack-keystone | 16:31 | |
| lbragstad | MFA wouldn't be something that is on by default | 16:31 |
| marekd | and have MFA only for certain domains/projcts. | 16:31 |
| marekd | lbragstad: correct. | 16:32 |
| marekd | lbragstad: so, in MFA we have 2 stages: user providers user/password, and in anoter request provides some TOTP code. | 16:32 |
| marekd | it's possible we have two separate HTTP calls (it's not mentioned in the spec so I assume this is a valid use-case) | 16:32 |
| *** chrisshattuck has quit IRC | 16:33 | |
| marekd | so, what i am saying that it maybe easier to have one plugin for 1st MFA authN stage, and call the driver otp-password (and specify this metho in the token) and second, e.g. otp-code | 16:34 |
| marekd | instead of using one authn method 'password' and tryin to combine both MFA stage 1 and classic user/pass authnetication. | 16:34 |
| marekd | because it will complicate plugin's logic. | 16:34 |
| *** chrisshattuck has joined #openstack-keystone | 16:35 | |
| lbragstad | marekd: so you'd suggest using one auth plugin for all opt related calls? | 16:36 |
| lbragstad | marekd: and leave the current password auth plugin untouched? | 16:37 |
| marekd | it'd suggest to leave auth method 'password' alone, because my understanding is that Werner wants to use this auth method to handle both user/pass authN AND 1 stage of MFA. | 16:37 |
| marekd | lbragstad: exactly. | 16:37 |
| lbragstad | makes sense, | 16:38 |
| lbragstad | I understand that. | 16:38 |
| marekd | lbragstad: unless i misunderstood something, i don't see any clear way to distinguish between classic authN and MFA. How is plugin going to know that? checking if the projcet/domain user is scoping to has some flag "MFA" set to True? | 16:39 |
| openstackgerrit | Julien Danjou proposed openstack/keystonemiddleware: Use oslo.utils to validate boolean string https://review.openstack.org/143488 | 16:39 |
| *** chrisshattuck has quit IRC | 16:39 | |
| marekd | IMHO this should be an alternative authN workflow, so let's not mix it with other authN methods. | 16:39 |
| lbragstad | marekd: I think the idea was that the user would have the flag | 16:39 |
| marekd | flag where..in the request? | 16:40 |
| lbragstad | marekd: no, on the resource | 16:41 |
| lbragstad | marekd: so an admin could enable MFA on a user, project, or domain | 16:41 |
| lbragstad | that part is in the first couple paragraphs of 'Proposed Change' | 16:41 |
| marekd | lbragstad: yes, i know that. | 16:41 |
| lbragstad | as well as the 'Work Itmes' | 16:41 |
| marekd | lbragstad: the question is if we want Password plugin to query for project and only then see if it's MFA or not? | 16:42 |
| *** zz_avozza is now known as avozza | 16:44 | |
| lbragstad | marekd: we do some calls like that in the current password plugin | 16:44 |
| lbragstad | marekd: I guess it would be similar to asserting the domain is enabled before authenticating: https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/password.py#L45 | 16:45 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Fetch policy.json from server https://review.openstack.org/134655 | 16:48 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Policy rules mangaged from a database https://review.openstack.org/133814 | 16:48 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: unified policy file https://review.openstack.org/134656 | 16:48 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Enforce policy from keystoneclient https://review.openstack.org/133480 | 16:48 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Default Policy https://review.openstack.org/134657 | 16:48 |
| marekd | lbragstad: ok, so let's say for the 1st stage we use 'password' method. some inherited plugin is fired, user/pass is checked and it looks like MFA is required for project 'X'. What next? | 16:49 |
| marekd | Another branch in the flow? | 16:49 |
| *** jell has joined #openstack-keystone | 16:49 | |
| marekd | if mfa_required: return self._mfa_1st_stage_response() | 16:49 |
| openstackgerrit | Julien Danjou proposed openstack/keystonemiddleware: Use oslo.utils to validate boolean string https://review.openstack.org/143488 | 16:50 |
| lbragstad | marekd: so that would give the user trying to authenticate a "session id" | 16:51 |
| lbragstad | marekd: something they can use to combine with their otp (hmac or time based) to finish the authentication process. | 16:52 |
| marekd | lbragstad: okay. and this session id would be stored in keystone's SQL/LDAP with expiration set to ...say 5 minutes? | 16:53 |
| ayoung | marekd, my thought is that MFA should be enforced on the endpoint, and not be based on the token | 16:53 |
| ayoung | who cares how many forms of authentication I show when I get the token if the token then gets stolen? | 16:53 |
| lbragstad | marekd: sure | 16:53 |
| marekd | ayoung: endpoint like nova? | 16:53 |
| ayoung | yes | 16:53 |
| lbragstad | marekd: I think that could be more of an implementation detail | 16:53 |
| ayoung | marekd, use the token-binding feature | 16:54 |
| ayoung | so use kerberos to get the token, then enforce endpoint binding to that same principal | 16:54 |
| marekd | ayoung: it's not my bp. but feel free to state your opinions here https://review.openstack.org/#/c/142591/ | 16:54 |
| ayoung | add in a second form of auth | 16:54 |
| marekd | ayoung: ++ | 16:54 |
| ayoung | marekd, I've been saying this all along. | 16:54 |
| marekd | ayoung: i know | 16:55 |
| ayoung | Not going to derail, as I just don't care that much | 16:55 |
| ayoung | :) | 16:55 |
| marekd | ayoung: sure :-) | 16:55 |
| marekd | ayoung: i remember our disqos from Paris - well, IMHO what you suggest is simply plans for OpenStack2 with authN/authZ model completely changed. | 16:55 |
| ayoung | marekd, but the endpoint needs to specifiy the factors required, and if they are not present in the token or context, they operation is denied. Go back to Keystone and get a new token | 16:55 |
| *** gyee has joined #openstack-keystone | 16:56 | |
| *** ChanServ sets mode: +v gyee | 16:56 | |
| marekd | lbragstad: i assume keystone would return some JSON with sesion-id and auth method set to 'password'. ksc now needs some logic again to distinguish that this is a part of MFA, so it's not a token itself. | 16:57 |
| lbragstad | right | 16:58 |
| ayoung | lbragstad, I would say that, assuming the heavy lifting with crypto is done in Apache HTTPD, the user would request a token with one form of auth, and then request a second token with the frist + the new form of auth | 16:58 |
| *** avozza is now known as zz_avozza | 16:58 | |
| ayoung | I don't know if Keystone should direct the user through this process. | 16:58 |
| marekd | lbragstad: as much as i understand that we may want to standardize the process, but i foresee some branches just because we combine few somewhat similar workflows, that are not that similar :/ | 16:58 |
| ayoung | How would a user know that they need MFA? I would assume that would be an endpoint specific policy requirements | 16:59 |
| marekd | lbragstad: that's why i asked Werned to be more specific here and there. | 16:59 |
| lbragstad | from what i understand, mfa is something that is enabled on an account | 17:00 |
| *** openstack has joined #openstack-keystone | 17:00 | |
| -sendak.freenode.net- [freenode-info] please register your nickname...don't forget to auto-identify! http://freenode.net/faq.shtml#nicksetup | 17:00 | |
| lbragstad | marekd: I think that is the case were having the otp password plugin inherit from password would be more helpful | 17:01 |
| marekd | lbragstad: there, yes. | 17:02 |
| lbragstad | since it has everything in the request to do both | 17:02 |
| lbragstad | carrying the logic specific to otp in the otp-password auth plugin | 17:02 |
| marekd | i don't mind if he inherits classes or not. I do mind if he wants to mix authentication flows :-) | 17:02 |
| marekd | lbragstad: does werner work with you ? | 17:02 |
| marekd | in RAX, TX? | 17:02 |
| *** lbragstad has quit IRC | 17:03 | |
| *** jacorob has quit IRC | 17:03 | |
| *** jacorob has joined #openstack-keystone | 17:06 | |
| *** lbragstad has joined #openstack-keystone | 17:07 | |
| marekd | lbragstad: if we are going to use only one HTTP call 'password' may be fine. | 17:07 |
| lbragstad | ok | 17:08 |
| marekd | lbragstad: but i think client will need to specify other auth plugin either way. | 17:08 |
| marekd | lbragstad: all in all, client will need to know if he needs to specify TOTP code for project X or not. | 17:08 |
| *** zzzeek has joined #openstack-keystone | 17:09 | |
| marekd | I also mention that user will be informed that MFA is required, and not only HTTP 401 is raised with vague message "Cannot authenticate". | 17:09 |
| lbragstad | marekd: yeah, i'd assume that would be done too | 17:10 |
| marekd | lbragstad: ok. | 17:10 |
| marekd | are you somehow tied to this bp? You want to start implementing it now? | 17:11 |
| openstackgerrit | ayoung proposed openstack/keystone: default policy https://review.openstack.org/140113 | 17:12 |
| marekd | lbragstad: ok, i need to go for now. | 17:13 |
| marekd | in fact i am on holiday too :-) | 17:13 |
| *** k4n0 has quit IRC | 17:13 | |
| lbragstad | marekd: no, i just told nonameentername that I'd keep an eye on it | 17:14 |
| lbragstad | marekd: figured I'd check in and see if there were an way that I could clear up your questions, not sure if i did though ;) | 17:15 |
| lbragstad | marekd: enjoy your holiday! | 17:16 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone-specs: Read/Write LDAP drivers https://review.openstack.org/140175 | 17:18 |
| *** ayoung has quit IRC | 17:19 | |
| *** gyee has quit IRC | 17:19 | |
| *** EmilienM|afk is now known as EmilienM | 17:19 | |
| *** raildo has quit IRC | 17:20 | |
| *** raildo_ has quit IRC | 17:20 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone-specs: Read/Write LDAP drivers https://review.openstack.org/140175 | 17:23 |
| amakarov | stevemar, hi! Can you please look at https://review.openstack.org/#/c/141854/ ? I really have concerns about my solution and your thoughts as an author would be most welcome. | 17:30 |
| *** gyee has joined #openstack-keystone | 17:36 | |
| *** ChanServ sets mode: +v gyee | 17:36 | |
| *** EmilienM is now known as EmilienM|afk | 17:42 | |
| *** nellysmitt has quit IRC | 17:43 | |
| *** jungleboyj has quit IRC | 17:44 | |
| *** pcaruana has quit IRC | 17:53 | |
| *** jorge_munoz has left #openstack-keystone | 17:55 | |
| *** lhcheng has joined #openstack-keystone | 17:58 | |
| morganfainberg | unless anyone has any complaints i'm release ksc 1.0.1 to include the fix bknudson rolled up late last week | 18:00 |
| morganfainberg | erm | 18:00 |
| morganfainberg | middleware 1.3.1 not ksc | 18:00 |
| *** dims has quit IRC | 18:01 | |
| *** dims has joined #openstack-keystone | 18:02 | |
| *** abhirc has joined #openstack-keystone | 18:03 | |
| morganfainberg | marekd, as a point i disagree with ayoung - making the MFA token only enforced on the endpoint simply makes for an awful UX - and it breaks *how* people use MFA today | 18:06 |
| *** dims has quit IRC | 18:06 | |
| morganfainberg | marekd, if i'm reading his suggestion, where thr token doesn't include the MFA? /me isn't clear on that | 18:06 |
| * morganfainberg admits to maybe misreading the suggestion | 18:07 | |
| *** hichtakk has joined #openstack-keystone | 18:08 | |
| amakarov | morganfainberg, greetings! I have a revocation fix we discussed last week: https://review.openstack.org/#/c/141854/, can you please review it? I'm not sure about notification logic. | 18:11 |
| morganfainberg | amakarov, i am reading it now. yeah not sure about the logic there atm, is where i'm spending time. | 18:12 |
| morganfainberg | i'll def. post what I see/think | 18:12 |
| amakarov | morganfainberg, btw if we want non-persistent AE tokens, do we need revocation rewritten? | 18:14 |
| morganfainberg | amakarov, not totally re-written, minor changes. | 18:14 |
| morganfainberg | amakarov, most of the revocation event work has been done | 18:14 |
| amakarov | morganfainberg, I'd like to see indexing there. For now revocation engine don't look well-done to me. IMHO, of course :) | 18:16 |
| morganfainberg | amakarov, the revocation events is fine - the revocation list is awful | 18:16 |
| morganfainberg | amakarov, revocation events needs some cleanup but isn't terrible (it's complex, hence the need to cleanup) | 18:17 |
| amakarov | morganfainberg, ++ I'm talking about list :) | 18:17 |
| morganfainberg | amakarov, the list for non-persistent tokens will need to be removed. | 18:17 |
| morganfainberg | not re-written | 18:17 |
| morganfainberg | we will only rely on the events in that case | 18:17 |
| amakarov | morganfainberg, I see | 18:18 |
| morganfainberg | since we wont be able to search all tokens for information in them. we don't have them stored anywhetre | 18:19 |
| morganfainberg | the whole point of revocation evnets is to replace the token revocation list | 18:19 |
| morganfainberg | with something waaaaay better | 18:19 |
| morganfainberg | and something that works in the case we don't have a canonical list of tokens to scrub through to revoke things based on "user-id" or "group-id" etc | 18:21 |
| amakarov | morganfainberg, about stored events: if we want events-based token validation, we need the way to find out quickly if there is a corresponding event stored. To do so we need some sort of indexing, and as far as I see, we have none for now. | 18:27 |
| morganfainberg | amakarov, we have that in the revocation events backend. | 18:28 |
| morganfainberg | amakarov, trust me, it's there - it is complex is what it's doing. | 18:28 |
| morganfainberg | amakarov, there is some re-writes we need to do | 18:28 |
| amakarov | morganfainberg, well, it'll always a place for wonders in this world! I'll consider it a magic :) | 18:30 |
| *** jorge_munoz has joined #openstack-keystone | 18:30 | |
| *** hichtakk has quit IRC | 18:32 | |
| morganfainberg | amakarov, it builds a tree of the events then does a iteration through the tree to find matches, if it matches - we are revoked | 18:33 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/contrib/revoke/model.py#L117 | 18:33 |
| morganfainberg | amakarov, it's way too complex. | 18:33 |
| morganfainberg | amakarov, but it does handle things fairly well | 18:33 |
| amakarov | morganfainberg, np, I have some computer science background :) | 18:34 |
| morganfainberg | amakarov, it's not the CS background that bothers me - it's that it's *very* hard to read the code and get a good understanding | 18:34 |
| morganfainberg | amakarov, the CS side helps, but it isn't very maintainable in python as is | 18:34 |
| *** jorge_munoz has quit IRC | 18:35 | |
| amakarov | morganfainberg, so the task in to simplify the code? | 18:35 |
| morganfainberg | amakarov, thats part of it. there are some edge cases it doesn't catch yet | 18:35 |
| *** thedodd has quit IRC | 18:35 | |
| morganfainberg | amakarov, we have a simplified version, we just need to dredge it up - it *might* actuially cover the edge cases we fall over with now. | 18:35 |
| amakarov | morganfainberg, is it in code-review state? Where can I look for it? | 18:36 |
| morganfainberg | amakarov, ayoung has it. he has an alternative version, and i'm sure would be happy for help to make it "ready for use" - we've discussed the simplification a lot | 18:37 |
| morganfainberg | the other issue is that with the tree we're hitting slowdown due to hashtable key lookups in the dicts | 18:38 |
| morganfainberg | so his other version should help there (some) at least | 18:38 |
| morganfainberg | amakarov, i'd be happy for you to take on the simplification work if you want. | 18:39 |
| amakarov | morganfainberg, thanks, I'll ask him about it. 1 more thing: https://review.openstack.org/#/c/140681/ - it's HA quick fix with +2 from Dolph :) | 18:39 |
| *** dims has joined #openstack-keystone | 18:40 | |
| morganfainberg | amakarov, i'm sure ayoung would be too. I just don't want to have you duplicate work if you don't need to :) [though it might be just asking ayoung and being told "oh yeah the old one isn't really uasable anymore] | 18:40 |
| amakarov | morganfainberg, ++ competition will not work here | 18:41 |
| *** stevemar has quit IRC | 18:41 | |
| morganfainberg | amakarov, :) glad you see where i'm coming from here | 18:42 |
| amakarov | morganfainberg, I saw trust redelegation spec merged - the implementation is ready and waiting :) | 18:45 |
| morganfainberg | yay! | 18:45 |
| morganfainberg | yeah i wanted to make sure the spec changes landed first | 18:46 |
| morganfainberg | before blessing/reviewing the code too much in depth. | 18:46 |
| morganfainberg | you know incase things changed | 18:46 |
| amakarov | morganfainberg, me too, but I couldn't wait and implemented it :) | 18:47 |
| morganfainberg | amakarov, and i don't blame you. it wasn't likely to change much | 18:47 |
| morganfainberg | amakarov, thanks for working on this. | 18:48 |
| *** harlowja has joined #openstack-keystone | 18:50 | |
| amakarov | morganfainberg, np - Heat guys will owe me a cake for it :) | 18:50 |
| morganfainberg | amakarov, hah nice! | 18:50 |
| morganfainberg | amakarov, enjoy an extra big slice for me while you're at it | 18:50 |
| amakarov | morganfainberg, of course I shall :) | 18:52 |
| *** thedodd has joined #openstack-keystone | 18:52 | |
| lbragstad | dstanek: around? | 18:57 |
| lbragstad | dstanek: http://pastebin.ca/2891092 | 18:57 |
| lbragstad | dstanek: that is pretty much your WIP branch, but I tried to make it so that we could use the other attributes in _keywords to generate the schema | 18:58 |
| lbragstad | dstanek: kind of? idk, metaprogramming makes my head hurt | 18:58 |
| *** rushiagr is now known as rushiagr_away | 18:59 | |
| *** amakarov is now known as amakarov_away | 19:01 | |
| *** ayoung has joined #openstack-keystone | 19:10 | |
| *** ChanServ sets mode: +v ayoung | 19:10 | |
| morganfainberg | lbragstad, makes a lot of people's heads hurt | 19:11 |
| lbragstad | morganfainberg: ++ | 19:11 |
| morganfainberg | lbragstad, you may want to look even more closely at descriptors | 19:12 |
| lbragstad | morganfainberg: it's taken me about two days to reverse engineer what dstanek did in ~80 LOC | 19:12 |
| morganfainberg | lbragstad, they may *actually* be what you're looking for | 19:12 |
| lbragstad | morganfainberg: yeah, I doubt we're done investigating | 19:12 |
| morganfainberg | ok i'm off to get coffee... FYI gate is broken. pip 6 | 19:13 |
| morganfainberg | i think i'm going to release middleware post coffee. but with gate broken i'm a little hesitent | 19:13 |
| *** hdd has quit IRC | 19:14 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: API changes for explicit unscoped https://review.openstack.org/143515 | 19:19 |
| breton | Hello, I'm again with those db migrations. | 19:21 |
| breton | As we know, Alembic doesn't have db_sync(version, ...) method, it has separate upgrade/downgrade and also a bunch of other useful stuff | 19:21 |
| breton | To change that I have a bp -- https://blueprints.launchpad.net/keystone/+spec/cli-db-commands . | 19:21 |
| breton | Do I need a spec for that? | 19:21 |
| ayoung | lbragstad, when you can context switch, want to chat about https://review.openstack.org/#/c/142847/ registry of token formats? | 19:21 |
| ayoung | breton, I started one | 19:22 |
| breton | ayoung: you started a spec for alembic | 19:22 |
| ayoung | breton, https://review.openstack.org/#/c/131531/ please take it over and run with it | 19:22 |
| ayoung | Its all yours. Really | 19:22 |
| lbragstad | ayoung: sure, trying to wrap up some jsd stuff quick | 19:23 |
| *** stevemar has joined #openstack-keystone | 19:23 | |
| *** ChanServ sets mode: +v stevemar | 19:23 | |
| breton | ayoung: and I'm talking about changing/adding cli commands | 19:23 |
| breton | ayoung: also, no spec is required for alembic, so you spec can be safely abandoned, I think | 19:24 |
| breton | *your | 19:24 |
| ayoung | breton, no spec is required for alembic" according to whom? I think you will find the Keystone core disagrees with you on that. | 19:27 |
| breton | ayoung: according to morganfainberg -- https://blueprints.launchpad.net/keystone/+spec/alembic | 19:28 |
| morganfainberg | ayoung, i think we can put it on the list to consider as an exception | 19:29 |
| morganfainberg | but we did say it doesn't *really* need a spec based on IRC meetings | 19:29 |
| morganfainberg | or at least IRC conversation(s). | 19:29 |
| breton | but I suggest to forget alembic for a second | 19:30 |
| ayoung | It needs a spec. Look at all the details in mine about how to make them work together. There should not be a separate set of CLI operations either | 19:30 |
| morganfainberg | ayoung, sure not different cli options. | 19:32 |
| breton | ayoung: I suggest not to use a separate set of cli operations, but a set of new operations, that will comply with migration_cli from oslo.db | 19:33 |
| ayoung | morganfainberg, actually, I see now what he is proposing. It should all be one spec | 19:33 |
| morganfainberg | ayoung, yes - if anything. | 19:33 |
| ayoung | breton, add that to my spec. Alembic is going to need those operations to be usable, but they don't make sense without alembic | 19:34 |
| ayoung | Gerrit and Launchpads decisions to log me out randomly raise my stress level unnecessarily | 19:34 |
| morganfainberg | ayoung, you have multiple windows open and crossing sessions | 19:35 |
| *** hichtakk has joined #openstack-keystone | 19:35 | |
| morganfainberg | ayoung, might need to close windows/tabs | 19:35 |
| ayoung | morganfainberg, no, need to change the SSO mechanism for Gerrit | 19:35 |
| ayoung | so it is somethjing that doesn't suck | 19:35 |
| morganfainberg | ayoung, it wont change with the new SSO, other SSOs do the same thing. | 19:35 |
| morganfainberg | it's not *just* the SSO system. | 19:36 |
| ayoung | I know one that doesn't.... | 19:36 |
| ayoung | :) | 19:36 |
| morganfainberg | ayoung, it is likely a gerrit-ism too | 19:36 |
| morganfainberg | and no it wont be IPA | 19:36 |
| morganfainberg | or ipsilon..or whatever :P | 19:36 |
| morganfainberg | at least to start. | 19:36 |
| ayoung | I can dream, can't I? | 19:36 |
| morganfainberg | i dunno, ;) | 19:36 |
| morganfainberg | ayoung, i think it has potential to head there eventually | 19:37 |
| ayoung | morganfainberg, did we back off on the "submit a stub of the spec first and the full thing later" approach we were shooting for, oh, 4 months ago? | 19:37 |
| morganfainberg | but they're using the PHP thing for now since it starts. | 19:37 |
| morganfainberg | and it's running | 19:37 |
| morganfainberg | i've been pushing for something else as soon as we can though. | 19:38 |
| morganfainberg | ayoung, yes we did, if you're submitting a stub of a spec and it's not in backlog it's getting marked up | 19:38 |
| morganfainberg | ayoung, putting it tagged ot a release if we're not completing the spec in full. | 19:39 |
| ayoung | Ah..backlog, that's it | 19:39 |
| morganfainberg | ayoung, :) | 19:39 |
| ayoung | should I move Alembic there, or is breton going forward with it? | 19:39 |
| morganfainberg | ayoung, dunno. | 19:40 |
| *** afaranha has joined #openstack-keystone | 19:40 | |
| morganfainberg | ayoung, i'd ask brenton | 19:41 |
| morganfainberg | ayoung, breton | 19:41 |
| morganfainberg | ayoung, if he's taking on the cli stuff, an everything else sure. if he's not, then push to backlog. | 19:41 |
| ayoung | breton, ? that is for you. If you are actively working on it, please claim the spec, otherwise imobacklogit | 19:42 |
| morganfainberg | ayoung, and i removed my comment about non-spec stuff on the bp | 19:44 |
| ayoung | ++ | 19:44 |
| breton | ok, will clai, | 19:44 |
| *** nellysmitt has joined #openstack-keystone | 19:44 | |
| breton | *will claim | 19:44 |
| ayoung | breton, thanks a bunch | 19:45 |
| ayoung | morganfainberg, I'll check with dchadwick about the SQL-Policy stuff. If that is not going to be submitted in time for this release, I'll backlog that as well | 19:45 |
| morganfainberg | ayoung, ++ | 19:46 |
| breton | err, where is the button for it? | 19:46 |
| *** nellysmitt has quit IRC | 19:49 | |
| ayoung | breton, HA! | 19:51 |
| ayoung | breton, it's git now | 19:51 |
| ayoung | got and checkout the spec using git review -d | 19:51 |
| breton | oh, ok | 19:52 |
| ayoung | breton, SQL-A to Albmic is going to be a tricky transition, and I'm more than willing to help you walk through the process | 19:52 |
| breton | ayoung: that's why I was talking about oslo.db's migration_cli | 19:53 |
| breton | helping to migrate from sa-m to Alembic is what it does | 19:53 |
| ayoung | breton, yeah, but we need to support the intermediate states of SQL-A too | 19:53 |
| breton | (or at least tries to) | 19:53 |
| ayoung | Ah | 19:53 |
| ayoung | coolness....I wonder if it will be sufficient. | 19:54 |
| ayoung | We have a few things in non-main repos. | 19:54 |
| ayoung | the extensions have their own | 19:54 |
| breton | ayoung: yep, I already coded stuff for that | 19:55 |
| breton | that's why I wanted to have migration_cli first and Alembic after it. | 19:55 |
| *** jungleboyj has joined #openstack-keystone | 19:57 | |
| *** jorge_munoz has joined #openstack-keystone | 20:02 | |
| ayoung | breton, awesome | 20:04 |
| ayoung | should simplify that spec significanty | 20:04 |
| *** hichtakk has quit IRC | 20:07 | |
| *** hichtakk has joined #openstack-keystone | 20:07 | |
| openstackgerrit | ayoung proposed openstack/keystone: Unscoped to Scoped only https://review.openstack.org/142591 | 20:10 |
| openstackgerrit | ayoung proposed openstack/keystone: Explicit Unscoped https://review.openstack.org/142521 | 20:10 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone-specs: Read/Write LDAP drivers https://review.openstack.org/140175 | 20:12 |
| *** rm_work|away is now known as rm_work | 20:13 | |
| openstackgerrit | ayoung proposed openstack/keystone: policy refactoring https://review.openstack.org/141969 | 20:14 |
| ayoung | dhellmann, care to reverse the -1 on https://review.openstack.org/#/c/142813/ as the spec has been approved? | 20:14 |
| openstackgerrit | ayoung proposed openstack/keystone: policy exception handling https://review.openstack.org/142207 | 20:16 |
| openstackgerrit | ayoung proposed openstack/keystone: policy exception handling https://review.openstack.org/142207 | 20:17 |
| *** hichtakk has quit IRC | 20:17 | |
| *** rm_work is now known as rm_work|away | 20:20 | |
| openstackgerrit | Andre Aranha proposed openstack/keystone: policy refactoring https://review.openstack.org/141969 | 20:20 |
| afaranha | ayoung, Sorry, I didn`t see your commit :P | 20:22 |
| ayoung | afaranha, no problem, it was just a rebase. I only cleaned up the formatting of the commit message | 20:22 |
| ayoung | afaranha, I'm just trying to clean up all my -1s before taking off for the week. | 20:23 |
| ayoung | afaranha, which is futile right now anyway since it looks like the gate is broken | 20:24 |
| *** hichtakk has joined #openstack-keystone | 20:25 | |
| afaranha | ayoung, I started my holidays friday, I'm just fixing the policies :) | 20:25 |
| ayoung | afaranha, one more day for me | 20:25 |
| afaranha | ayoung, do you know when the gate gonna be fixed? Today or friday? | 20:26 |
| ayoung | nope | 20:27 |
| *** EmilienM|afk is now known as EmilienM | 20:34 | |
| openstackgerrit | Steve Martinelli proposed openstack/identity-api: Include a link to keystone-specs in the README https://review.openstack.org/143530 | 20:36 |
| *** afaranha has quit IRC | 20:55 | |
| *** harlowja_ has joined #openstack-keystone | 20:58 | |
| *** raildo has joined #openstack-keystone | 21:00 | |
| *** harlowja has quit IRC | 21:00 | |
| *** raildo_ has joined #openstack-keystone | 21:00 | |
| *** LinstatSDR has quit IRC | 21:04 | |
| *** hichtakk has quit IRC | 21:11 | |
| *** hichtakk has joined #openstack-keystone | 21:11 | |
| *** jorge_munoz has quit IRC | 21:17 | |
| *** dims has quit IRC | 21:20 | |
| *** dims has joined #openstack-keystone | 21:21 | |
| *** dims has quit IRC | 21:23 | |
| *** dims has joined #openstack-keystone | 21:23 | |
| rodrigods | ayoung, oslo.policy graduation: what's next step? | 21:24 |
| rodrigods | morganfainberg, ^ | 21:24 |
| *** nellysmitt has joined #openstack-keystone | 21:45 | |
| *** nellysmitt has quit IRC | 21:50 | |
| *** hichtakk has quit IRC | 21:53 | |
| *** hichtakk has joined #openstack-keystone | 21:53 | |
| *** rm_work|away is now known as rm_work | 22:01 | |
| *** nellysmitt has joined #openstack-keystone | 22:01 | |
| *** LinstatSDR has joined #openstack-keystone | 22:03 | |
| *** rm_work is now known as rm_work|away | 22:06 | |
| *** rm_work|away is now known as rm_work | 22:07 | |
| *** nellysmitt has quit IRC | 22:08 | |
| *** harlowja_ has quit IRC | 22:21 | |
| *** jamielennox|away is now known as jamielennox | 22:22 | |
| *** raildo has quit IRC | 22:22 | |
| *** raildo_ has quit IRC | 22:23 | |
| *** diegows has quit IRC | 22:28 | |
| *** diegows has joined #openstack-keystone | 22:29 | |
| *** hdd has joined #openstack-keystone | 22:34 | |
| *** gordc has quit IRC | 22:38 | |
| *** EmilienM is now known as EmilienM|afk | 22:38 | |
| *** Guest87463 is now known as redrobot_away | 22:48 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 22:51 |
| openstackgerrit | henry-nash proposed openstack/keystone: My First ABAC: An example alternative assignments engine https://review.openstack.org/143557 | 22:51 |
| *** hichtakk has quit IRC | 23:19 | |
| *** hichtakk has joined #openstack-keystone | 23:19 | |
| openstackgerrit | henry-nash proposed openstack/keystone: My First ABAC: An example alternative assignments engine https://review.openstack.org/143557 | 23:21 |
| *** andreaf has quit IRC | 23:23 | |
| *** andreaf has joined #openstack-keystone | 23:23 | |
| *** henrynash_ has quit IRC | 23:34 | |
| *** dims has quit IRC | 23:35 | |
| *** stevemar has quit IRC | 23:45 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!