| samueldmq | jamielennox, k makes sense, thanks | 00:00 |
|---|---|---|
| *** r-daneel has quit IRC | 00:01 | |
| jamielennox | samueldmq: the whole interface is an annoying left over from before these things became widespread | 00:01 |
| *** zzzeek has left #openstack-keystone | 00:02 | |
| stevemar | morganfainberg, lhcheng doing stuff atm, get back to y'all | 00:03 |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: Publicize oslo_policy.opts.register https://review.openstack.org/163163 | 00:06 |
| *** tsufiev_ has quit IRC | 00:08 | |
| *** tsufiev_ has joined #openstack-keystone | 00:14 | |
| samueldmq | jamielennox, ok so the code makes sense, but I am not familiar enough with that workflow | 00:14 |
| jamielennox | samueldmq: sure, the auth_plugin stuff? | 00:15 |
| samueldmq | jamielennox, cant review it .. sorry, I need to get more familia with keystonemiddleware | 00:15 |
| jamielennox | samueldmq: that's fine - anything you want explained? | 00:15 |
| samueldmq | jamielennox, yes, keystonemiddleware basically holds auth_plugin, right? | 00:15 |
| jamielennox | samueldmq: yes it loads a plugin that it holds on to | 00:15 |
| jamielennox | you need a valid token to authenticate another token | 00:16 |
| *** iamjarvo has quit IRC | 00:16 | |
| samueldmq | jamielennox, and then the plugin holds that token other services use to validate user's tokens? | 00:16 |
| jamielennox | samueldmq: yep, first you load an auth plugin, then you attach it to a session (or adapter) then any requests you make through the session are authenticated | 00:17 |
| *** tsufiev_ has quit IRC | 00:17 | |
| jamielennox | and it will handle things like refreshing the token if it expires | 00:17 |
| jamielennox | and service catalog etc | 00:18 |
| samueldmq | jamielennox, so services can use those sessions as tehy had tokens that never expire | 00:19 |
| samueldmq | jamielennox, makes sense, so it holds this common logic that would be replicated over services | 00:20 |
| jamielennox | services use that token, but this is the way we are trying to make all the clients work | 00:20 |
| *** dims_ has joined #openstack-keystone | 00:20 | |
| dstanek | jamielennox: i love '!!! - UNDER NO CIRCUMSTANCES COPY ANY OF THIS CODE - !!! ' | 00:20 |
| jamielennox | so instead of passing an auth_url and username/password you pass in a session and auth plugin | 00:20 |
| jamielennox | dstanek: :) it's about as strong as i could make it | 00:20 |
| jamielennox | it means all the handling around auth and token management is handled in the one place | 00:21 |
| samueldmq | jamielennox, great! I'll take a deeper look into the code/available docs | 00:21 |
| samueldmq | jamielennox, thank you sir :) | 00:21 |
| jamielennox | so next time we add a auth format we just make a new plugin | 00:21 |
| jamielennox | samueldmq: no problem | 00:21 |
| dstanek | jamielennox: so is this not a real bug? https://bugs.launchpad.net/python-keystoneclient/+bug/1411625 | 00:21 |
| openstack | Launchpad bug 1411625 in python-keystoneclient "Keystone client (command line) not throwing any exception when there is no proper OS credentails." [Undecided,In progress] - Assigned to Cyril Roelandt (cyril-roelandt) | 00:21 |
| *** dims has quit IRC | 00:22 | |
| *** dims_ has quit IRC | 00:22 | |
| jamielennox | dstanek: i swear i've reviewed so many versions of this same problem | 00:23 |
| *** dims has joined #openstack-keystone | 00:23 | |
| jamielennox | dstanek: in that case i think the best we can do is provide a meaningful error if we get back an unscoped token | 00:24 |
| *** gokrokve has quit IRC | 00:24 | |
| *** tsufiev_ has joined #openstack-keystone | 00:25 | |
| jamielennox | interesting that nova requires the argument | 00:25 |
| *** iamjarvo has joined #openstack-keystone | 00:33 | |
| *** david-lyle_afk has quit IRC | 00:34 | |
| *** iamjarvo has quit IRC | 00:38 | |
| jamielennox | stevemar: does https://review.openstack.org/#/c/153910 help with your horizon federation stuff | 00:46 |
| jamielennox | i'm hoping it does | 00:47 |
| jamielennox | lhcheng: you'll be interested in ^ too | 00:47 |
| openstackgerrit | wanghong proposed openstack/keystone: add timestamp to project and role https://review.openstack.org/154370 | 00:56 |
| openstackgerrit | wanghong proposed openstack/keystone: make credential policy check ownership of credential https://review.openstack.org/152444 | 00:57 |
| *** zzzeek has joined #openstack-keystone | 00:58 | |
| *** zzzeek has quit IRC | 00:59 | |
| *** zzzeek has joined #openstack-keystone | 01:00 | |
| openstackgerrit | wanghong proposed openstack/keystone: move region and service exist checks into manager layer https://review.openstack.org/141977 | 01:04 |
| *** _cjones_ has quit IRC | 01:11 | |
| *** ncoghlan has joined #openstack-keystone | 01:13 | |
| *** samueldmq_ has joined #openstack-keystone | 01:17 | |
| *** samueldmq has quit IRC | 01:20 | |
| stevemar | jamielennox, looking soon, i'm behind on like 10 pings | 01:20 |
| stevemar | i was apparently popular this evening | 01:20 |
| *** david-lyle_afk has joined #openstack-keystone | 01:21 | |
| jamielennox | this is what happens when you get a reputation for being a night owl | 01:21 |
| *** topol has joined #openstack-keystone | 01:22 | |
| *** ChanServ sets mode: +v topol | 01:22 | |
| *** topol has quit IRC | 01:27 | |
| *** dims has quit IRC | 01:28 | |
| *** dims has joined #openstack-keystone | 01:29 | |
| *** devlaps has joined #openstack-keystone | 01:31 | |
| *** dims has quit IRC | 01:34 | |
| dstanek | stevemar: ! | 01:34 |
| dstanek | stevemar: what do you think of this: https://review.openstack.org/#/c/163172/ ? | 01:35 |
| stevemar | dstanek, i'm here now, everyone can relax | 01:35 |
| stevemar | dstanek, :) i saw that in the irc logs, taking a look now | 01:36 |
| *** dims has joined #openstack-keystone | 01:40 | |
| stevemar | dstanek, so without looking at the test, i'd say that your mapping should result in the user's name, with groups dev and manager | 01:43 |
| stevemar | oops, negative on that, i thought it was a whitelist, its a blacklist | 01:43 |
| stevemar | so it should just be contractor | 01:44 |
| stevemar | looks like the user name got matched with 'maybe' instead of the username | 01:45 |
| stevemar | the group name is still good (that's a plus) | 01:45 |
| dstanek | stevemar: that was to highlight the append vs extend possible issues | 01:48 |
| stevemar | dstanek, yep, i see that | 01:49 |
| dstanek | in the case i hacked together is Thing is a single value then i would work, but it if's a list then boom! | 01:49 |
| stevemar | i see i see | 01:49 |
| *** samueldmq_ is now known as samueldmq | 01:50 | |
| samueldmq | dolphm, lbragstad any of you around? I'd like to have a quick discussion around Fernet tokens :) | 01:51 |
| *** devlaps has quit IRC | 01:51 | |
| *** rwsu is now known as rwsu-afk | 01:52 | |
| *** amerine has quit IRC | 01:54 | |
| *** dims_ has joined #openstack-keystone | 01:55 | |
| *** amerine has joined #openstack-keystone | 01:55 | |
| *** diegows has quit IRC | 01:55 | |
| *** dims has quit IRC | 01:58 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Split v3 authentication file into module https://review.openstack.org/163259 | 01:58 |
| *** browne has quit IRC | 02:04 | |
| *** spandhe has quit IRC | 02:06 | |
| *** harlowja_ is now known as harlowja_away | 02:09 | |
| jamielennox | marekd: let me know when you come on | 02:12 |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: Crosslink to other sites that are owned by Keystone https://review.openstack.org/163263 | 02:15 |
| *** gokrokve has joined #openstack-keystone | 02:26 | |
| *** erkules_ has joined #openstack-keystone | 02:29 | |
| *** zzzeek has quit IRC | 02:30 | |
| *** erkules has quit IRC | 02:32 | |
| openstackgerrit | Dave Chen proposed openstack/python-keystoneclient: Crosslink to other sites that are owned by Keystone https://review.openstack.org/163266 | 02:36 |
| *** david-lyle_afk has quit IRC | 02:36 | |
| openstackgerrit | Dave Chen proposed openstack/python-keystoneclient: Crosslink to other sites that are owned by Keystone https://review.openstack.org/163266 | 02:39 |
| openstackgerrit | Merged openstack/pycadf: Clean up pycadf's doc landing page https://review.openstack.org/162422 | 02:39 |
| openstackgerrit | Merged openstack/pycadf: Fix formatting error for geolocation note https://review.openstack.org/162430 | 02:40 |
| *** kaisers3 has joined #openstack-keystone | 02:42 | |
| *** kaisers has quit IRC | 02:43 | |
| DaveChen | samueldmq: hi, | 02:44 |
| samueldmq | DaveChen, hi :) | 02:44 |
| DaveChen | samueldmq: thanks for reviewing, you are really a good reviewer! | 02:44 |
| samueldmq | DaveChen, not that much, but thanks | 02:45 |
| DaveChen | samueldmq: seem I am a blind man :) | 02:45 |
| samueldmq | DaveChen, you're welcome, just trying to get things moving :) | 02:45 |
| samueldmq | DaveChen, nah, thanks for submitting this, we appreciate your help | 02:46 |
| DaveChen | samueldmq: just try to make the bug is fully addressed. | 02:47 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Extract BaseAuth out of Auth Plugin https://review.openstack.org/163270 | 02:51 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add a FederatedBase v3 plugin https://review.openstack.org/163271 | 02:51 |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: Crosslink to other sites that are owned by Keystone https://review.openstack.org/163263 | 02:51 |
| *** jdennis1 has joined #openstack-keystone | 02:57 | |
| *** jdennis has quit IRC | 02:57 | |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: Crosslink to other sites that are owned by Keystone https://review.openstack.org/163263 | 02:58 |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: Crosslink to other sites that are owned by Keystone https://review.openstack.org/163263 | 02:59 |
| stevemar | oh thx DaveChen :) | 03:01 |
| openstackgerrit | Merged openstack/pycadf: add a new set of release notes https://review.openstack.org/162427 | 03:01 |
| DaveChen | stevemar: maybe I still need resubmit your patch to follow samueldma's comments. | 03:02 |
| DaveChen | stevemar:np, sir. | 03:02 |
| *** dims_ has quit IRC | 03:02 | |
| openstackgerrit | Dave Chen proposed openstack/python-keystoneclient: Crosslink to other sites that are owned by Keystone https://review.openstack.org/163266 | 03:12 |
| *** david-lyle_afk has joined #openstack-keystone | 03:17 | |
| *** gokrokve has quit IRC | 03:18 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Crosslink to other sites that are owned by Keystone https://review.openstack.org/161490 | 03:26 |
| samueldmq | stevemar, DaveChen just to nits on https://review.openstack.org/#/c/161490/ | 03:32 |
| samueldmq | sorry about that, but just take a look to check if it makes sense | 03:32 |
| samueldmq | :-) | 03:32 |
| *** stevemar has quit IRC | 03:34 | |
| samueldmq | DaveChen, well, just look at review.openstack.org/#/c/161490 and make the docs consistent thorugh keystonemiddleware and keystoneclient | 03:39 |
| DaveChen | samueldmq: looks better, it seems like an english testing. :) | 03:40 |
| samueldmq | DaveChen, and then everything would be ok | 03:40 |
| samueldmq | DaveChen, haha yeah | 03:40 |
| samueldmq | DaveChen, I need to go sleep now, thanks for your patches | 03:40 |
| DaveChen | samueldmq: have a good sleep. | 03:40 |
| DaveChen | samueldmq: Good night | 03:40 |
| samueldmq | DaveChen, thanks, same for you | 03:41 |
| *** samueldmq is now known as samueldmq_away | 03:41 | |
| *** jdennis1 has quit IRC | 03:42 | |
| *** jdennis has joined #openstack-keystone | 03:43 | |
| *** topol has joined #openstack-keystone | 03:48 | |
| *** ChanServ sets mode: +v topol | 03:48 | |
| *** samueldmq_away has quit IRC | 03:53 | |
| *** topol has quit IRC | 03:59 | |
| *** iamjarvo has joined #openstack-keystone | 04:00 | |
| *** dims has joined #openstack-keystone | 04:03 | |
| *** spandhe has joined #openstack-keystone | 04:08 | |
| *** dims has quit IRC | 04:10 | |
| morganfainberg | jamielennox, so we have issues with keystonemiddleware and resolving juno/icehouse requirements. | 04:11 |
| jamielennox | morganfainberg: yea, it's a gate thing | 04:11 |
| morganfainberg | jamielennox, need me to chase this at all or you got it? | 04:12 |
| *** spandhe_ has joined #openstack-keystone | 04:12 | |
| jamielennox | https://bugs.launchpad.net/openstack-gate/+bug/1430592 | 04:12 |
| openstack | Launchpad bug 1430592 in devstack "testtools-1.7.0 triggering pkg_resources.VersionConflict: (unittest2 0.5.1 (/usr/lib/python2.7/dist-packages), Requirement.parse('unittest2>=1.0.0'))" [Undecided,In progress] - Assigned to Ian Wienand (iwienand) | 04:12 |
| *** spandhe has quit IRC | 04:12 | |
| *** spandhe_ is now known as spandhe | 04:12 | |
| morganfainberg | ah | 04:12 |
| morganfainberg | ok | 04:12 |
| jamielennox | someone said in the meeting earlier that the gate had been really stable recently | 04:13 |
| jamielennox | not so much from where i've been sitting | 04:13 |
| jamielennox | might just be i'm touching a lot more projects now | 04:14 |
| openstackgerrit | Merged openstack/keystone: Refactor: remove dep on trust_api / v3 token helper https://review.openstack.org/161876 | 04:38 |
| *** richm has quit IRC | 04:38 | |
| *** rushiagr_away is now known as rushiagr | 04:58 | |
| *** iamjarvo has quit IRC | 05:14 | |
| *** browne has joined #openstack-keystone | 05:16 | |
| *** jorge_munoz has quit IRC | 05:29 | |
| openstackgerrit | Dave Chen proposed openstack/python-keystoneclient: Crosslink to other sites that are owned by Keystone https://review.openstack.org/163266 | 05:29 |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: Crosslink to other sites that are owned by Keystone https://review.openstack.org/163263 | 05:37 |
| *** panbalag has quit IRC | 05:46 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/163300 | 06:08 |
| *** panbalag has joined #openstack-keystone | 06:20 | |
| lhcheng | finally got my keystone running OIDC \o/ | 06:21 |
| lhcheng | surprisingly not that bad | 06:22 |
| lhcheng | good job to everyone who worked on it! | 06:22 |
| *** henrynash has joined #openstack-keystone | 06:44 | |
| *** ChanServ sets mode: +v henrynash | 06:44 | |
| *** browne has quit IRC | 06:47 | |
| *** spandhe has quit IRC | 06:58 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Extract BaseAuth out of Auth Plugin https://review.openstack.org/163270 | 07:03 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add a FederatedBase v3 plugin https://review.openstack.org/163271 | 07:03 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Split v3 authentication file into module https://review.openstack.org/163259 | 07:03 |
| *** kaisers3 has quit IRC | 07:15 | |
| lhcheng | anyone around familiar what should be set in the remote_id in IdP? | 07:17 |
| lhcheng | is that an arbitrary string or I need to figure out what entity_id my IdP is using. | 07:18 |
| openstackgerrit | Abhishek Kekane proposed openstack/keystone: Eventlet green threads not released back to pool https://review.openstack.org/130824 | 07:28 |
| *** henrynash has quit IRC | 07:35 | |
| marekd | lhcheng: i am. | 07:42 |
| *** henrynash has joined #openstack-keystone | 07:42 | |
| *** ChanServ sets mode: +v henrynash | 07:42 | |
| marekd | lhcheng: for sure this is part of the SAML protocol, not 100% sure if also part of OIDC (though it should!) | 07:42 |
| lhcheng | good morning marekd! | 07:43 |
| marekd | lhcheng: remote_id is an identified unique for an IdP, so you know that actually the asserion is issued by a trusted IdP X, not IdP Y | 07:43 |
| marekd | lhcheng: parameter where it is stored in the assertion may vary per IdP type (implementation) and you should know this apriori | 07:44 |
| marekd | you == cloud admin. | 07:44 |
| lhcheng | hmm is the remote_id_attribute is used to look-up the remote_id from the assertion? | 07:45 |
| marekd | lhcheng: yes, remote_id_attbute specified the name of the parameter where IdP's remote_id will be conveyed. | 07:46 |
| marekd | lhcheng: if you leave it empty Keystone will simply not look for this parameter. | 07:48 |
| lhcheng | yeah, saw somewhere that for backward compatibility the remote_id can be empty | 07:48 |
| lhcheng | so right now, I am trying to setup websso http://specs.openstack.org/openstack/keystone-specs/specs/kilo/websso-portal.html | 07:49 |
| lhcheng | I bumped into the remote_id config in here | 07:49 |
| *** pnavarro has joined #openstack-keystone | 07:50 | |
| lhcheng | marekd: ugh, the remote_id setting is required for the websso | 07:51 |
| lhcheng | marekd: https://review.openstack.org/#/c/136177/25/keystone/contrib/federation/controllers.py | 07:51 |
| marekd | lhcheng: ah, websso is a different story. in fact you must have remote_ids configured for websso :/ | 07:51 |
| marekd | lhcheng: yes. | 07:51 |
| marekd | lhcheng: i suggest digging in the oidc specification or asking on the ml about that parameter. | 07:52 |
| lhcheng | marekd: okay, at least now I know I need to figure out the remote_id somewhere and it is not an arbitrary value | 07:52 |
| marekd | lhcheng: no, it is super important param for the security | 07:53 |
| lhcheng | marekd: yeah, I understand that now | 07:53 |
| lhcheng | marekd: the config docs wasn't that clear, but when I read the BP it provided me some context | 07:53 |
| marekd | and it's required for websso as we query for identity_provider object in the backend with that parameter value. | 07:53 |
| marekd | lhcheng: if the docs are not clear feel free to give me or anybody else some hints (or file a bug) and I am happy to fix it. | 07:54 |
| *** erkules_ is now known as erkules | 07:56 | |
| lhcheng | marekd: yeah, saw that in the code. the remote_id was the only way to pull-up the identifier for the IdP lookup | 07:56 |
| *** erkules has quit IRC | 07:56 | |
| *** erkules has joined #openstack-keystone | 07:56 | |
| lhcheng | marekd: yeah, will definitely do that! | 07:56 |
| lhcheng | marekd: thanks for the help! | 07:58 |
| lhcheng | marekd: will dig into the oidc spec to figure that remote_id | 07:59 |
| *** chlong has quit IRC | 08:01 | |
| jamielennox | marekd: so i liked the stuff you did in ksc-federation so much i copied the base of it back | 08:06 |
| jamielennox | https://review.openstack.org/#/c/163271/ | 08:06 |
| jamielennox | it won't make any difference over there, but it means for federation style plugins (ones that use the mapper) that aren't saml | 08:07 |
| jamielennox | we can take base like the kerberos and an x509 plugin on it | 08:07 |
| *** lhcheng has quit IRC | 08:16 | |
| marekd | jamielennox: hey, sorry, now i am available (earlier i was on a tram) | 08:40 |
| marekd | jamielennox: if we want to use it with kerberosx509 or anything that uses mapping engine we could probably rename it to something more generic. | 08:43 |
| marekd | jamielennox: uh, i will shoot you an e-mail either way. | 08:43 |
| openstackgerrit | henry-nash proposed openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 08:53 |
| openstackgerrit | henry-nash proposed openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 08:55 |
| *** henrynash has quit IRC | 08:56 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Allow loading auth plugins via overrides https://review.openstack.org/161962 | 08:57 |
| openstackgerrit | Merged openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 09:01 |
| *** afazekas_ has joined #openstack-keystone | 09:16 | |
| *** jistr has joined #openstack-keystone | 09:25 | |
| *** ncoghlan has quit IRC | 09:33 | |
| *** jistr has quit IRC | 09:50 | |
| *** jistr has joined #openstack-keystone | 09:52 | |
| *** MasterPiece has joined #openstack-keystone | 10:15 | |
| *** breton has quit IRC | 10:16 | |
| *** MasterPiece has quit IRC | 10:17 | |
| *** dims has joined #openstack-keystone | 10:18 | |
| *** MasterPiece has joined #openstack-keystone | 10:18 | |
| *** breton has joined #openstack-keystone | 10:18 | |
| *** MasterPiece has quit IRC | 10:20 | |
| *** MasterPiece has joined #openstack-keystone | 10:21 | |
| *** chlong has joined #openstack-keystone | 10:23 | |
| *** jistr has quit IRC | 10:38 | |
| *** jistr has joined #openstack-keystone | 10:39 | |
| *** krykowski has joined #openstack-keystone | 10:56 | |
| *** amakarov_away is now known as amakarov | 10:58 | |
| *** MasterPiece has quit IRC | 11:20 | |
| openstackgerrit | afazekas proposed openstack/python-keystoneclient: No special expire limit in identity/base.py https://review.openstack.org/163380 | 11:29 |
| *** topol has joined #openstack-keystone | 11:36 | |
| *** ChanServ sets mode: +v topol | 11:36 | |
| *** samueldmq has joined #openstack-keystone | 11:37 | |
| samueldmq | ayoung, ping - you around? | 11:37 |
| samueldmq | ayoung, would like to talk about policy :) shoudl be quick | 11:38 |
| *** MasterPiece has joined #openstack-keystone | 11:41 | |
| *** topol has quit IRC | 11:44 | |
| *** pnavarro is now known as pnavarro|lunch | 11:52 | |
| *** iamjarvo has joined #openstack-keystone | 12:04 | |
| *** markvoelker has joined #openstack-keystone | 12:14 | |
| *** richm has joined #openstack-keystone | 12:15 | |
| *** panbalag has left #openstack-keystone | 12:25 | |
| *** raildo_away is now known as raildo | 12:26 | |
| openstackgerrit | Merged openstack/keystone: add oauth authentication to config file https://review.openstack.org/161317 | 12:26 |
| *** dims has quit IRC | 12:33 | |
| *** dims has joined #openstack-keystone | 12:34 | |
| *** htruta has joined #openstack-keystone | 12:39 | |
| *** rushiagr is now known as rushiagr_away | 12:46 | |
| *** gordc has joined #openstack-keystone | 12:53 | |
| *** pnavarro|lunch is now known as pnavarro | 12:56 | |
| *** MasterPiece has quit IRC | 13:03 | |
| *** mattfarina has joined #openstack-keystone | 13:04 | |
| *** rushiagr_away is now known as rushiagr | 13:05 | |
| openstackgerrit | Merged openstack/keystone: Move pysaml to requirements.txt for py3 https://review.openstack.org/162363 | 13:12 |
| *** aix has joined #openstack-keystone | 13:13 | |
| *** iamjarvo has quit IRC | 13:19 | |
| *** rushiagr is now known as rushiagr_away | 13:20 | |
| *** joesavak has joined #openstack-keystone | 13:23 | |
| *** nellysmitt has joined #openstack-keystone | 13:24 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes minor spelling issue https://review.openstack.org/163430 | 13:28 |
| *** iamjarvo has joined #openstack-keystone | 13:35 | |
| *** gordc_ has joined #openstack-keystone | 13:36 | |
| *** nellysmitt has quit IRC | 13:39 | |
| *** gordc has quit IRC | 13:42 | |
| *** nellysmi_ has joined #openstack-keystone | 13:42 | |
| *** nellysmi_ has quit IRC | 13:44 | |
| dolphm | samueldmq: o/ just saw your ping about fernet from yesterday | 13:45 |
| *** iamjarvo has quit IRC | 13:46 | |
| ayoung | samueldmq, Here I am! | 13:46 |
| *** krykowski_ has joined #openstack-keystone | 13:51 | |
| *** krykowski has quit IRC | 13:55 | |
| *** r-daneel has joined #openstack-keystone | 13:55 | |
| *** gordc_ is now known as gordc | 14:00 | |
| *** tellesnobrega_ has joined #openstack-keystone | 14:00 | |
| *** zzzeek has joined #openstack-keystone | 14:03 | |
| *** krykowski_ has quit IRC | 14:04 | |
| *** rushiagr_away is now known as rushiagr | 14:06 | |
| *** gokrokve has joined #openstack-keystone | 14:13 | |
| *** ayoung is now known as ayoung_afk | 14:13 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add test to list projects by the parent_id https://review.openstack.org/158314 | 14:14 |
| *** carlosmarin has joined #openstack-keystone | 14:20 | |
| *** timcline has joined #openstack-keystone | 14:23 | |
| *** bknudson has joined #openstack-keystone | 14:24 | |
| *** ChanServ sets mode: +v bknudson | 14:24 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:27 | |
| *** timcline_ has joined #openstack-keystone | 14:31 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove redundant creation timestamp from fernet tokens https://review.openstack.org/161897 | 14:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove the expiration timestamp from Fernet tokens https://review.openstack.org/161774 | 14:31 |
| *** gokrokve_ has joined #openstack-keystone | 14:33 | |
| *** timcline has quit IRC | 14:34 | |
| *** henrynash has joined #openstack-keystone | 14:35 | |
| *** ChanServ sets mode: +v henrynash | 14:35 | |
| *** radez_g0n3 is now known as radez | 14:36 | |
| *** gokrokve has quit IRC | 14:36 | |
| *** iamjarvo has joined #openstack-keystone | 14:39 | |
| *** iamjarvo has quit IRC | 14:39 | |
| *** iamjarvo has joined #openstack-keystone | 14:40 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 14:40 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Correct utf8/innodb issues with tables https://review.openstack.org/159803 | 14:40 |
| *** jorge_munoz has joined #openstack-keystone | 14:42 | |
| rodrigods | ayoung_afk, morganfainberg, dstanek: re: blacklist and whitelist, what do you think something in the line: http://paste.openstack.org/show/191612/ | 14:42 |
| *** henrynash has quit IRC | 14:44 | |
| marekd | rodrigods: it's still wrong. | 14:44 |
| marekd | we have bigger problem with that | 14:44 |
| marekd | and it's not even bl/wh listing | 14:44 |
| rodrigods | marekd, hm... | 14:44 |
| dstanek | rodrigods: i started working on a little refactoring there. not sure if it will turn out good | 14:46 |
| dstanek | rodrigods: you have it backwards if your diff | 14:46 |
| rodrigods | dstanek, ++ thanks | 14:46 |
| rodrigods | dstanek, can you explain the bug you found? | 14:46 |
| dstanek | you would have to make direct_map_values a [[v for v ...]] and make it use extend | 14:47 |
| dstanek | things are not actually treated as positional | 14:47 |
| marekd | dstanek: i started working on that today too, and was treating everythin as list, but...how are we going to map a rule "FOO {0}" ? | 14:47 |
| dstanek | marekd: not sure exactly yet, that's what i'm trying to figure out now | 14:48 |
| marekd | dstanek: i am fearing the design is somewhat fundamentaly wrong and any change to fix that will not be backwards compatible. | 14:48 |
| marekd | string.format() should probably not be used. | 14:49 |
| marekd | for a {n} substitution. | 14:49 |
| dstanek | the original design was fine for what it was doing, but as we've added bolt ons we should have probably made some tweaks | 14:50 |
| *** htruta has quit IRC | 14:51 | |
| marekd | dstanek: i think everybody just assumend the direct maps would be single strings and this is not changed anywhere. | 14:51 |
| marekd | and the test you added yesterday would also fail on a master checkout. | 14:51 |
| dstanek | yeah, i have that test working now in what i'm doing, but i broke two others | 14:51 |
| dstanek | might take me a little while to unwind this | 14:52 |
| marekd | dstanek: may i see the code? | 14:52 |
| marekd | just curious how you fixed that. | 14:52 |
| dstanek | marekd: yeah, give me a bit to get back to a cleaner state | 14:52 |
| marekd | dstanek: sure. | 14:53 |
| openstackgerrit | Merged openstack/keystone: move region and service exist checks into manager layer https://review.openstack.org/141977 | 14:53 |
| openstackgerrit | Merged openstack/keystone: Refactor: move initiator test to cadf specific section https://review.openstack.org/162758 | 14:53 |
| *** lhcheng has joined #openstack-keystone | 14:54 | |
| rodrigods | marekd, dstanek in a meeting here, but I'm following the discussion | 14:54 |
| *** lhcheng_ has joined #openstack-keystone | 14:55 | |
| *** lhcheng has quit IRC | 14:55 | |
| *** lhcheng_ is now known as lhcheng | 14:55 | |
| *** stevemar has joined #openstack-keystone | 15:02 | |
| *** ChanServ sets mode: +v stevemar | 15:02 | |
| bknudson | if you want to use a format other than {}, then use some kind of flag to switch. | 15:02 |
| marekd | bknudson: it's still not backward compatible and basically looks like the 'mapping language' is growing (which is not bad actually) | 15:03 |
| *** topol has joined #openstack-keystone | 15:04 | |
| *** ChanServ sets mode: +v topol | 15:04 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add test to list projects by the parent_id https://review.openstack.org/158314 | 15:05 |
| marekd | dstanek: one thing we could do is: if the rule matches the regexp: "{n}" than replace with the object (list), if it's part of something like "foo {n}" apparently it meant to be a string. | 15:05 |
| marekd | so do the ";".join(v) | 15:06 |
| lhcheng | stevemar: good morning! | 15:06 |
| stevemar | lhcheng, o/ | 15:06 |
| bknudson | could have a flag "this is a list": true | 15:07 |
| stevemar | lhcheng, lets get your sso setup! | 15:07 |
| *** tellesnobrega_ has quit IRC | 15:07 | |
| dolphm | jorge_munoz: i'm updating all the patches you depend on one at a time -- still working on https://review.openstack.org/#/c/162031/ | 15:07 |
| lhcheng | stevemar: heh I was going to ask about that | 15:07 |
| dolphm | jorge_munoz: i'm getting test failures after rebasing that one, which i'm working through now | 15:07 |
| marekd | lhcheng: did you look into oidc spec? | 15:07 |
| lhcheng | marekd: didn't got the chance to look, feel asleep | 15:08 |
| lhcheng | marekd: it was 1am when we were chatting :P | 15:08 |
| stevemar | lhcheng, still stuck on the remote_entity_id part? | 15:08 |
| *** elarson has left #openstack-keystone | 15:08 | |
| lhcheng | marekd: my laziness got ahead of me, thought of just waiting for stevemar | 15:09 |
| jorge_munoz | dolphm: Last night I tried adding rebase changes and fix myself but got rejected saying a that a depend patch was closed? | 15:09 |
| lhcheng | stevemar: yeah, what value should I set it for google oidc? | 15:09 |
| lhcheng | stevemar: is it the OIDC clientId? | 15:10 |
| dolphm | jorge_munoz: i'm fixing a couple other issues along the way - transient failures and whatnot | 15:10 |
| stevemar | lhcheng, give me a few minutes to look it up | 15:11 |
| stevemar | lhcheng, gah! i really should have doc'ed it | 15:11 |
| jorge_munoz | dolphm: Let me know if I can help. | 15:11 |
| lbragstad | dolphm: did you still want to hop into -infra? | 15:12 |
| dolphm | lbragstad: let me finish this rebase (which will affect that cherry pick), and then yes, if it's still an issue | 15:12 |
| lbragstad | dolphm: sounds good | 15:13 |
| *** rodrigods has quit IRC | 15:13 | |
| *** rodrigods has joined #openstack-keystone | 15:13 | |
| dolphm | right now i'm having an issue where a bunch of unit tests are failing because /etc/keystone/keystone.conf doesn't exist... | 15:13 |
| lbragstad | marekd: thanks for the reviews on the federated formatter | 15:13 |
| lbragstad | dolphm: because it uses the Fernet Test Setup Mixin? | 15:14 |
| lbragstad | dolphm: or this https://github.com/openstack/keystone/blob/master/keystone/tests/unit/token/test_fernet_provider.py#L29 | 15:15 |
| bknudson | for some reason I get an email now from dolphm that he +2d https://review.openstack.org/#/c/162489/ , but that was 2 days ago. | 15:15 |
| lhcheng | stevemar: brb | 15:16 |
| *** lhcheng is now known as lhcheng_afk | 15:16 | |
| *** lhcheng_afk has quit IRC | 15:17 | |
| dolphm | lbragstad: no, it seems to be test_backend_ldap failing in setUp | 15:17 |
| lbragstad | ah, weird... | 15:17 |
| dolphm | oslo.config was released yesterday, i'm prepared to blame that | 15:17 |
| marekd | lbragstad: no problem :-) | 15:17 |
| stevemar | lhcheng, try setting the conf.federation.remote_id_parameter to HTTP_OIDC_ISS, and remote_id of the IdP to "accounts.google.com" | 15:18 |
| marekd | stevemar: looks logical | 15:18 |
| lbragstad | marekd: I added a bunch of things to the token in the federated case, but the only thing needed to rebuild the token_ref['user'][federation.FEDERATION] dictionary is the user_id, right? | 15:18 |
| stevemar | marekd, yeah, i think that's what i did... i'm saying this based on code (and it feels right) | 15:18 |
| dolphm | i'm afraid to ask, but does anyone else see issues with $ tox -r -e py27 keystone.tests.unit.test_backend_ldap.MultiLDAPandSQLIdentityDomainConfigsInSQL | 15:19 |
| lbragstad | dolphm: trying it quick | 15:20 |
| marekd | mee too | 15:20 |
| marekd | lbragstad: what do you mean rebuild? | 15:21 |
| marekd | lbragstad: when the token is validated and keystone wants to rebuild all the data and compare? | 15:21 |
| lbragstad | marekd: yes | 15:21 |
| dolphm | marekd: none of that stuff is stored with fernet, so it has to be recomputed from as little data as possible during token validation | 15:21 |
| marekd | lbragstad: if i understand you correctly you cannot rebuild user_id .... it must be in the token. | 15:22 |
| lbragstad | marekd: yep, it is | 15:22 |
| dolphm | marekd: user_id can be in the token, and it is. but the entire user reference is not | 15:22 |
| lbragstad | marekd: or, the entire user reference doesn't *have* to be, does it? | 15:23 |
| lbragstad | dolphm: yes, that test blew up | 15:23 |
| lbragstad | dolphm: are you running this on master? | 15:23 |
| marekd | dolphm: unless you have some magical way to always refere to auth_url (OS-FEDERATION/identity_providers/{...}/auth) we should also keep idp and protocol in token | 15:23 |
| dolphm | lbragstad: yes | 15:23 |
| dolphm | lbragstad: fun. | 15:23 |
| dolphm | henrynaaaaaaaash | 15:23 |
| lbragstad | marekd: ok, so dict(idp_id=ID_ORG,protocol='saml2',groups=group_ids) should be passed into the token as well | 15:26 |
| *** amerine has quit IRC | 15:26 | |
| marekd | lbragstad: next to the user_id, yes. | 15:27 |
| lbragstad | marekd: ++ awesome, | 15:27 |
| lbragstad | thanks | 15:27 |
| *** amerine has joined #openstack-keystone | 15:27 | |
| marekd | yw | 15:27 |
| *** gokrokve_ has quit IRC | 15:27 | |
| lbragstad | marekd: then I wouldn't need the federated domain id or name | 15:27 |
| lbragstad | dolphm: reran those tests on master and they passed. | 15:28 |
| *** lhcheng_afk has joined #openstack-keystone | 15:28 | |
| *** lhcheng_afk is now known as lhcheng | 15:28 | |
| *** hogepodge has quit IRC | 15:28 | |
| marekd | lbragstad: are you squeezeing domain in fernet tokens? | 15:28 |
| dolphm | lbragstad: uh oh | 15:28 |
| lhcheng | stevemar: back | 15:28 |
| lbragstad | dolphm: http://cdn.pasteraw.com/koqhimyicvokme3s5wc6590ek2psocm | 15:28 |
| dolphm | lbragstad: why .... | 15:28 |
| *** david-lyle_afk is now known as david-lyle | 15:28 | |
| marekd | lbragstad: if that's the pure federated token then we can assume the user is in the service domain 'federated'. | 15:29 |
| lbragstad | marekd: I was having some issues yesterday and I was adding some more things that probably didn't need to be there looking back on it in retrospective | 15:29 |
| marekd | do you pass domain info in the normal tokens? | 15:29 |
| dolphm | lbragstad: they fail for me on master | 15:29 |
| stevemar | lhcheng, read scroll back, i suggested some values :) | 15:29 |
| dolphm | lbragstad: http://cdn.pasteraw.com/bacg09ui5k7titj02t6pwz46qgxqbj7 | 15:30 |
| lbragstad | marekd: we do here for domain-scoped tokens | 15:30 |
| lbragstad | https://review.openstack.org/#/c/162031/12/keystone/token/providers/fernet/token_formatters.py | 15:30 |
| marekd | i mean for project scoped tokens - you only pass user_id, right? | 15:31 |
| marekd | if so, we will need to properly implement is_mapped_token() for fernet tokens and if that gives true always assume the domain is 'federated' | 15:31 |
| marekd | until we change this one day in one release. | 15:32 |
| lbragstad | marekd: no, project scoped tokens have the project_id passed into the token | 15:32 |
| marekd | but the user is identified by id | 15:32 |
| marekd | (which also determines his domain) | 15:33 |
| lbragstad | dolphm: I just removed all .pyc files and reran http://cdn.pasteraw.com/3ib2wq4fjvyjhfmdxrpng6semb0we38 | 15:35 |
| lbragstad | dolphm: seems to work | 15:35 |
| dolphm | lbragstad: i do that all the time | 15:35 |
| dolphm | lbragstad: it's part of git-ready :) | 15:35 |
| lbragstad | dolphm: ++ | 15:35 |
| lhcheng | stevemar: ah, that was the value I was thinking of last night. Based on what I got from the keystone docs. But got sleepy to test it out. | 15:36 |
| lbragstad | dolphm: it isn't a specific test that fails for you? | 15:36 |
| lhcheng | stevemar: if it works, good job on the keystone doc :) | 15:36 |
| dolphm | lbragstad: every test in that class fails | 15:36 |
| lbragstad | dolphm: something in setUp? Failed: 209 | 15:36 |
| marekd | dstanek: did you manage to clean it up? | 15:36 |
| dolphm | lbragstad: you know what? maybe it's because i actually have an /etc/keystone/keystone.conf on this box, but my user can't read it | 15:36 |
| lbragstad | dolphm: sounds probable | 15:37 |
| *** amerine has quit IRC | 15:37 | |
| dolphm | lbragstad: don't know why that would have suddenly popped up as an issue though... | 15:37 |
| stevemar | lhcheng, i hope it'll work :) | 15:37 |
| dolphm | yep, that was it. solution: sudo rm -rf /etc/keystone | 15:37 |
| stevemar | just patch the idp :) | 15:37 |
| dolphm | so much for our benchmark server :P | 15:38 |
| lbragstad | dolphm: good thing we have ansible | 15:38 |
| lhcheng | stevemar: cool! just heading out on a meeting, will test it when I get back. :) | 15:38 |
| lbragstad | marekd: so, how will that effect the is_mapped_token() method? | 15:39 |
| *** browne has joined #openstack-keystone | 15:40 | |
| marekd | lbragstad: hm? | 15:40 |
| marekd | stevemar: https://review.openstack.org/#/c/159803/15 -> can you please take a look ? | 15:41 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Drop Fernet token prefixes & add domain-scoped Fernet tokens https://review.openstack.org/162031 | 15:42 |
| *** afazekas_ has quit IRC | 15:42 | |
| stevemar | marekd, i'm scared of it | 15:42 |
| marekd | why | 15:42 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Convert audit_ids to bytes https://review.openstack.org/160993 | 15:44 |
| *** nellysmitt has joined #openstack-keystone | 15:45 | |
| marekd | lbragstad: i meant that if we are sure that the particular fernet token is a federated-fernet we can blindly assume the ephemeral user is in domain 'Federated' and this is probably the only think we can 'rebuild' and not keep in the token :-) | 15:46 |
| marekd | lbragstad: if, on the other hand, one day we decide that ephemeral user can be a member of any domain, basing on whatever mapping rule or so, then...well, we will need to store users domain in the token :( | 15:47 |
| lbragstad | marekd: but off the bat, we are going to assume the first case? | 15:48 |
| marekd | lbragstad: yes, because we don't support the latter case right now. | 15:48 |
| lbragstad | marekd: cool, so I'll pull that out the of the review as well. | 15:49 |
| marekd | unless you want to squeeze domain now and have less to do later on. | 15:49 |
| lbragstad | marekd: it should be a pretty easy change regardless | 15:49 |
| marekd | wouldn't it change the token structure? | 15:49 |
| *** nellysmitt has quit IRC | 15:50 | |
| dolphm | lbragstad: marekd: if it's not something we support today outside of fernet, i don't think we should try to support it in fernet. the cost is just introducing a new payload variant later on | 15:51 |
| lbragstad | marekd: does this make sense https://review.openstack.org/#/c/161380/10/keystone/token/providers/fernet/token_formatters.py ? | 15:51 |
| *** amerine has joined #openstack-keystone | 15:53 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: make Fernet token creation/validation API agnostic https://review.openstack.org/162338 | 15:54 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 15:54 |
| dolphm | lbragstad: it let me upload a clean cherry pick ^ | 15:54 |
| dolphm | lbragstad: cannot explain why. | 15:54 |
| lbragstad | dolphm: me either... and this still exists https://review.openstack.org/#/c/161380/11/keystone/tests/unit/token/test_fernet_provider.py | 15:55 |
| *** rwsu-afk is now known as rwsu | 15:55 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 15:55 |
| dolphm | jorge_munoz: same ^ | 15:56 |
| dolphm | jorge_munoz: that should include your timing fixes, but i haven't run tests yet | 15:56 |
| lbragstad | dolphm: thanks for rebasing, I'm going to go through and rip out some of the extra bloat for federated tokens | 15:56 |
| *** htruta has joined #openstack-keystone | 15:56 | |
| dolphm | lbragstad: cool, disregard the patchset i uploaded if you need to, it's just a cherry pick of the previous one (same for yours, jorge_munoz) | 15:57 |
| dolphm | lbragstad: jorge_munoz: both your patches should be based on 5a333ffc445de351b312578151541ec5e3166294 (my API agnostic refactor) though | 15:57 |
| lbragstad | dolphm: perfect | 15:57 |
| *** tellesnobrega has quit IRC | 15:58 | |
| dolphm | jorge_munoz: you need to get your _get_token_id() refactor up | 15:58 |
| *** tellesnobrega has joined #openstack-keystone | 15:59 | |
| dolphm | jorge_munoz: like, 5a333ffc445de351b312578151541ec5e3166294 <- get_token_id refactor <- your v2 support patch | 15:59 |
| dolphm | jorge_munoz: the 5 tests i see failing are missing that | 15:59 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/162350 | 16:01 |
| *** iamjarvo has quit IRC | 16:02 | |
| *** _cjones_ has joined #openstack-keystone | 16:03 | |
| *** iamjarvo has joined #openstack-keystone | 16:03 | |
| *** tqtran has joined #openstack-keystone | 16:03 | |
| *** thedodd has joined #openstack-keystone | 16:04 | |
| *** iamjarvo has quit IRC | 16:05 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/162355 | 16:08 |
| *** tqtran_ has joined #openstack-keystone | 16:11 | |
| *** browne1 has joined #openstack-keystone | 16:11 | |
| *** tqtran has quit IRC | 16:12 | |
| *** d34dh0r53 has quit IRC | 16:13 | |
| *** briancurtin has quit IRC | 16:13 | |
| *** darrenc_ has joined #openstack-keystone | 16:14 | |
| *** comstud has quit IRC | 16:14 | |
| *** lbragstad has quit IRC | 16:14 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 16:14 |
| *** browne has quit IRC | 16:14 | |
| *** Nakato has quit IRC | 16:14 | |
| *** cyeoh has quit IRC | 16:14 | |
| *** darrenc has quit IRC | 16:14 | |
| *** gus has quit IRC | 16:14 | |
| *** dolphm has quit IRC | 16:14 | |
| *** zigo_ has quit IRC | 16:14 | |
| *** zigo_ has joined #openstack-keystone | 16:14 | |
| *** d34dh0r53 has joined #openstack-keystone | 16:15 | |
| *** dolphm has joined #openstack-keystone | 16:15 | |
| *** ChanServ sets mode: +o dolphm | 16:15 | |
| *** lbragstad has joined #openstack-keystone | 16:15 | |
| *** comstud has joined #openstack-keystone | 16:15 | |
| *** cyeoh has joined #openstack-keystone | 16:16 | |
| lbragstad | dolphm: marekd cut down a lot of the cruft in the federated formatters https://review.openstack.org/#/c/161380/11 | 16:16 |
| *** Nakato has joined #openstack-keystone | 16:16 | |
| *** gus has joined #openstack-keystone | 16:16 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 16:19 |
| *** briancurtin has joined #openstack-keystone | 16:19 | |
| morganfainberg | dolphm, just realized you have an issue with not encoding expires at in the fernet token | 16:20 |
| morganfainberg | dolphm, rescoped tokens carry expires of the original tokan | 16:21 |
| morganfainberg | token* | 16:21 |
| morganfainberg | dolphm, with moving expires out of the encoded payload, rescoping the token resets the expiration to the TTL | 16:21 |
| morganfainberg | dolphm, is that something we are intending to change? cc lbragstad | 16:21 |
| morganfainberg | it also tells me we might have a gap in testing coverage | 16:23 |
| morganfainberg | if tests didn't explode with those tokens | 16:23 |
| marekd | lbragstad: yea, i think it makes some sense. | 16:24 |
| marekd | lbragstad: why did you put both domain_name and domain_id ? | 16:24 |
| lbragstad | marekd: I was hitting a bunch of unrelated validation errors yesterday, I thought it might have something to do with that, | 16:25 |
| lbragstad | marekd: but I was wrong | 16:25 |
| *** gokrokve has joined #openstack-keystone | 16:25 | |
| morganfainberg | dstanek, ^ cc [since you +2'd the remove expires from fernet] | 16:25 |
| morganfainberg | dolphm, lbragstad, dstanek, i think we can't remove expires encoding from fernet without being clearly aware of this change. and if we're making this change for fernet other token providers will need to mirror. | 16:26 |
| *** gokrokve has quit IRC | 16:27 | |
| haneef | lbragstad: Does fernet token exactly follow the spec at https://github.com/fernet/spec/blob/master/Spec.md or do we change some aspects of it? | 16:28 |
| lbragstad | haneef: I believe it does, but I'd have to defer to dolphm since he did quite a bit of the work converting from keyczar to cryptography | 16:29 |
| dolphm | haneef: we don't actually implement the Fernet spec, we use pypi/cryptography (cryptography.fernet) which already implements it | 16:29 |
| dolphm | haneef: all we do is define the message and let pypi/cryptography do the hard work | 16:30 |
| dolphm | morganfainberg: hmm... | 16:31 |
| *** gokrokve_ has joined #openstack-keystone | 16:31 | |
| haneef | thanks, I manually tried to base64 decode as per that spec , it did't work. I will check cryptography stuff | 16:32 |
| dolphm | haneef: it's url-safe base64 encoded, per the spec | 16:32 |
| dolphm | haneef: python -c "import base64; base64.urlsafe_b64decode(token)" | 16:32 |
| dolphm | haneef: if the first byte is \x08 or \x80 (can't remember which), then you've decoded it correctly | 16:33 |
| haneef | dolphm: I believe in uuid/pki we revoke the token if we add/remove roles for an user for a tenant. How does that handled in fernet? | 16:33 |
| dolphm | haneef: we depend on token revocation events, just like everything else should | 16:34 |
| dolphm | (except for uuid, events are just a perk in that case) | 16:34 |
| haneef | thanks. I will have a look at it | 16:34 |
| morganfainberg | dolphm, so i think changing the expiration behavior is outside the spec/scope for fernet at this point. I'd like to have that discussion separate from the rest of the changes if possible. i know it's a rebase of the chain, but I'm not comfortable with the expiration behavior changing as a side effect here. | 16:36 |
| dolphm | morganfainberg: i think i buy the rescoping argument | 16:37 |
| morganfainberg | it should be explicitly called out and done for all the token types [that a rescope = expiration extension] | 16:37 |
| morganfainberg | if we want it | 16:37 |
| openstackgerrit | Merged openstack/keystone: Fixes minor spelling issue https://review.openstack.org/163430 | 16:37 |
| *** joesavak has quit IRC | 16:38 | |
| dolphm | morganfainberg: i'll try to pull the expiration removal out of the chain, so we can get the rest of the stuff merging, and i'll replace the full timestamp with a ttl in seconds | 16:38 |
| morganfainberg | sounds good. | 16:38 |
| morganfainberg | dolphm, i put a -1 on https://review.openstack.org/#/c/161774/ with the same comment. | 16:40 |
| dolphm | morganfainberg: ack | 16:40 |
| morganfainberg | dolphm, so it's documented there. thanks. | 16:40 |
| *** ericksonfgds has joined #openstack-keystone | 16:40 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 16:42 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 16:42 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 16:42 |
| *** ayoung_afk is now known as ayoung | 16:44 | |
| *** openstack has joined #openstack-keystone | 16:54 | |
| *** htruta has quit IRC | 16:56 | |
| *** iamjarvo has joined #openstack-keystone | 17:03 | |
| *** radez is now known as radez_g0n3 | 17:05 | |
| *** lhcheng_ has joined #openstack-keystone | 17:06 | |
| dstanek | marekd: sorry was lunching | 17:06 |
| *** spandhe has joined #openstack-keystone | 17:07 | |
| dstanek | morganfainberg: was there a specific review to look at or should i just go over all of the Fernet ones again? | 17:07 |
| morganfainberg | dstanek, the top of the chain, the one you +2'd | 17:07 |
| morganfainberg | dstanek, i commented on it. this is the expiration one | 17:08 |
| dstanek | morganfainberg: cool, i'll just in it | 17:08 |
| morganfainberg | https://review.openstack.org/#/c/161774/ | 17:08 |
| *** joesavak has joined #openstack-keystone | 17:08 | |
| *** lhcheng has quit IRC | 17:09 | |
| morganfainberg | unless anyone has any complaints, i'm going to release KSM today to get swift happy. | 17:10 |
| *** lhcheng_ is now known as lhcheng | 17:10 | |
| morganfainberg | and i thnk someone else who had issues with the oslo_config stuff | 17:11 |
| *** harlowja_away is now known as harlowja_ | 17:14 | |
| *** mgagne_PHL is now known as mgagne | 17:14 | |
| ayoung | dstanek, so, as you rework the whitelist/blacklist patch, can you keep in mind:\ that I want to be able to say "if the group does not existing in the Keystone bakcend, ignore it?" I think that should only be the case for lists; and explictly named group in the mapping should have to exist in the keystone identituy backend...to keep the current behavior | 17:18 |
| ayoung | you don't need to work that into the refactoring, just give me a way to match that we are doing a white/black list match instead of an explicit match, | 17:19 |
| ayoung | Actually, Whitelist probably should have to exist, just "not blacklist" but so lone as I have the information at auth time I can work out the logic | 17:20 |
| *** chlong has quit IRC | 17:21 | |
| dstanek | ayoung: i wasn't trying to fix the logic much - just encapsulate the direct maps idea | 17:22 |
| ayoung | dstanek, right. | 17:22 |
| ayoung | dstanek, so if I can then use that to deduce we are in a direct map versus list expansion, I can do the logic I need | 17:23 |
| dstanek | i have a real simple change, but there is still a test that was broken | 17:23 |
| ayoung | look at the follow on patch to see what I need to do now | 17:23 |
| dstanek | so i left for lunch :-) | 17:23 |
| ayoung | https://review.openstack.org/#/c/162788/ | 17:23 |
| dstanek | ayoung: ok, i'll see how that fits in too | 17:23 |
| ayoung | thanks | 17:23 |
| ayoung | and if the answer is "it doesn't" I'll deal | 17:24 |
| dstanek | hopefully, this experiment works out | 17:24 |
| lhcheng | stevemar: the docs mentions about using "remoted_ids" instead of "remote_id" in: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-federation-ext.html#register-an-identity-provider | 17:27 |
| lhcheng | stevemar: is that the end-goal? or we need to update the doc? | 17:27 |
| stevemar | lhcheng, refer to https://review.openstack.org/#/c/152156/ for remote_id vs remote_ids | 17:29 |
| *** _cjones_ has quit IRC | 17:30 | |
| lhcheng | stevemar: ah, coming soon :) | 17:37 |
| lhcheng | stevemar: thanks! | 17:37 |
| *** _cjones_ has joined #openstack-keystone | 17:38 | |
| *** amakarov is now known as amakarov_away | 17:41 | |
| *** devlaps has joined #openstack-keystone | 17:42 | |
| *** nellysmitt has joined #openstack-keystone | 17:46 | |
| *** nellysmitt has quit IRC | 17:50 | |
| dolphm | lbragstad: diminishing returns http://cdn.pasteraw.com/q3c9y8zgyivams9g3nv7lb833s0gi0e | 17:51 |
| * dolphm Ran: 5234 tests in 68.0000 sec. | 17:51 | |
| lbragstad | dolphm: performance i/o? | 17:51 |
| dolphm | lbragstad: OnMetal I/O | 17:51 |
| * dolphm Ran: 5234 tests in 59.0000 sec. | 17:52 | |
| dolphm | broke the 1 min barrier! =D | 17:52 |
| lbragstad | that's ridiculous | 17:52 |
| openstackgerrit | Merged openstack/keystone-specs: Mark the domain-config API as experimental https://review.openstack.org/162484 | 17:53 |
| dolphm | 68s was the first run, so probably had extra overhead somewhere | 17:53 |
| openstackgerrit | Merged openstack/keystone-specs: Add domain-config group/option resource relationships https://review.openstack.org/162459 | 17:54 |
| *** ChanServ changes topic to "High Priority Reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Priority for Review should be Fernet Tokens and Domain SQL. Please prioritize reviews for K3." | 17:55 | |
| dolphm | oh, now i have the same failing tests i had on the old metal server :( | 17:55 |
| dolphm | http://cdn.pasteraw.com/ks3uoeqh14ovap1oro5tcu3qvvkzkmd | 17:55 |
| dolphm | anyone else running into: "ConfigFilesNotFoundError: Failed to find some config files: policy.json" on master? | 17:56 |
| lbragstad | dolphm: what are you using to setup these dev boxes? | 17:56 |
| dolphm | lbragstad: skill | 17:56 |
| stevemar | lhcheng, so, whats the verdict | 17:59 |
| jorge_munoz | dolphm: Thanks! I’ll fix those issues. | 17:59 |
| dolphm | all it seems to take to make it fails is $ tox -r -e py27 && tox -e py27 # always produces failures on the second run | 17:59 |
| dolphm | dstanek: ^ ? | 18:00 |
| lhcheng | stevemar: just got off from the meeting, will be able to test within the next hour | 18:00 |
| stevemar | lhcheng, that was a long meeting | 18:00 |
| dstanek | dolphm: reading | 18:00 |
| *** radez_g0n3 is now known as radez | 18:00 | |
| dstanek | dolphm: your second run always fails? | 18:01 |
| dolphm | dstanek: seems to - trying once more | 18:01 |
| dolphm | dstanek: it only seems to work with -r | 18:01 |
| dstanek | dolphm: sounds like something is caching data in the virtualenv | 18:02 |
| dstanek | dolphm: is this just on master? | 18:02 |
| dolphm | dstanek: yes | 18:02 |
| dolphm | -r succeeded again... | 18:03 |
| lhcheng | stevemar: two consecutive meeting, 2nd was with some brazil guys about adding hmt on horizon | 18:03 |
| ayoung | dolphm, revoke_api is slow | 18:03 |
| ayoung | that should not be the case | 18:04 |
| lhcheng | stevemar: they got a lot of good stuff implemented | 18:04 |
| ayoung | Would be interesting to see a profile on keystone.tests.unit.test_v3_auth.TestTokenRevokeApi.test_deleting_role_revokes_token | 18:04 |
| *** stevemar has quit IRC | 18:04 | |
| *** stevemar has joined #openstack-keystone | 18:05 | |
| *** ChanServ sets mode: +v stevemar | 18:05 | |
| *** lhcheng_ has joined #openstack-keystone | 18:05 | |
| *** henrynash has joined #openstack-keystone | 18:06 | |
| *** ChanServ sets mode: +v henrynash | 18:06 | |
| dstanek | dolphm: i'll take a look in a sec | 18:07 |
| *** lhcheng has quit IRC | 18:09 | |
| dstanek | marekd: some of the group stuff in there is confusing | 18:13 |
| *** lhcheng_ is now known as lhcheng | 18:13 | |
| dstanek | dolphm: test are running | 18:14 |
| *** gyee has joined #openstack-keystone | 18:17 | |
| *** ChanServ sets mode: +v gyee | 18:17 | |
| *** aix has quit IRC | 18:21 | |
| ayoung | dstanek, where is the database stored for sql bases unit testsnow? We are still using sqlite for the backend, right? | 18:24 |
| dstanek | ayoung: i think it's all in memory | 18:25 |
| ayoung | dstanek, we got that to work? Good..although it means I';ll have to find another way to optimize | 18:25 |
| iamjarvo | if i am using ldap to authenticate, will keystone automatically create an entry in the assignment table? henrynash | 18:27 |
| henrynash | iamjarvo:yes | 18:27 |
| *** nellysmitt has joined #openstack-keystone | 18:27 | |
| dstanek | ayoung: what are you optimizing? | 18:27 |
| henrynash | imajarvo: sorry, in the assignemnt table, no….in the mapping table yes | 18:27 |
| ayoung | dstanek, running the unit tests | 18:28 |
| ayoung | I dstanek although I want to look at the revoke_api slowness. | 18:28 |
| ayoung | just got sidetracked | 18:28 |
| henrynash | iamjarvo: in the assignemnt table, no….in the mapping table yes | 18:28 |
| ayoung | iamjarvo, absolutely not | 18:28 |
| stevemar | henrynash, iamjarvo definitely not in the assignment table | 18:29 |
| ayoung | iamjarvo, nothing creates autmatic assignments | 18:29 |
| henrynash | iamjarvo: …but the public ID mapping will be created on-the-fly | 18:30 |
| iamjarvo | henrynash ayoung stevemar awesome works as designed, thought i was missing something. What's the workflow for getting a user into there then? so i connected ldap to keystone and now an admin user does not exist. i created one in ldap | 18:30 |
| ayoung | iamjarvo, are you using LDAP as the only ideneity backend, or as a domain mounted one? | 18:30 |
| *** bknudson has quit IRC | 18:30 | |
| lhcheng | stevemar: the login page is not rendering correctly when I pulled Thai's patch | 18:31 |
| ayoung | if you have [identity] dreiver=....ldap.Identity then it is the first | 18:31 |
| iamjarvo | identity. we changed the identity driver from sql to ldap | 18:31 |
| stevemar | lhcheng, what you seeing? | 18:31 |
| ayoung | iamjarvo, OK, so you need to use the AUTH_TOKEN in the config file to prime the pump | 18:31 |
| lhcheng | stevemar: just the username/password field, signin button. The openstack logo not rendering | 18:32 |
| ayoung | iamjarvo, http://fedoraproject.org/wiki/Getting_started_with_OpenStack_on_Fedora_17#Initial_Keystone_setup is what I always follow | 18:32 |
| ayoung | Gah...no not the sample data | 18:32 |
| lhcheng | stevemar: looking into it.. | 18:33 |
| iamjarvo | ayoung so im guessing you mean i need to create stuff through the api? | 18:33 |
| ayoung | iamjarvo, basically, you need to set the ADMIN_TOKEN value in the config file, and then use the keystone client to create the role assignement for one of youir uses out of LDAP | 18:33 |
| dolphm | dstanek: do we have a way to call tox without concurrency? or do you have to call testr directly | 18:33 |
| ayoung | iamjarvo, yeah | 18:33 |
| ayoung | iamjarvo, the ADMIN_TOKEN is designed for exactly this | 18:33 |
| iamjarvo | awesome. but what about other users. say if i had a coworker in ldap, how does that person login? | 18:34 |
| ayoung | iamjarvo, as the admin, give them a role. You just need ADMIN_TOKEN to set up the first admin | 18:34 |
| dstanek | dolphm: there is an env var TEST_RUN_CONCURRENCY you can set to 0 | 18:34 |
| dstanek | dolphm: or maybe that's 1 you have to set it to | 18:34 |
| ayoung | iamjarvo, so you enable ADMIN_TOKEN, do a user list and a role slist to make sure it works | 18:34 |
| ayoung | then create a role assignment for whatever use is going to be your admin | 18:35 |
| ayoung | then wipe the OS_ vars like: | 18:35 |
| stevemar | lhcheng, enable it in settings? | 18:35 |
| ayoung | SERVICE_ENDPOINT | 18:35 |
| ayoung | and | 18:35 |
| ayoung | SERVICE_TOKEN | 18:35 |
| ayoung | as having those set at all will mess you up | 18:35 |
| ayoung | then log on using OS_USERNAME=<ldap user name> | 18:35 |
| ayoung | iamjarvo, there is an alternative | 18:36 |
| dolphm | iamjarvo: "will mess you up" == "will override all other OS_ auth variables" | 18:36 |
| ayoung | iamjarvo, what release of openstack are you running on? | 18:36 |
| iamjarvo | juno | 18:36 |
| *** joesavak has quit IRC | 18:36 | |
| *** joesavak has joined #openstack-keystone | 18:37 | |
| lhcheng | stevemar: yeah, settings are enabled | 18:37 |
| dstanek | dolphm: it didn't fail for me the second time or the third (i rebuilt the venv for the first run) | 18:39 |
| iamjarvo | ayoung im going to try using the api and will probably have some follow up questions. thanks for the quick response | 18:40 |
| dolphm | dstanek: i can repro just with tox -e py27 keystone.tests.unit.test_v2_keystoneclient | 18:42 |
| dolphm | dstanek: TEST_RUN_CONCURRENCY=0 is default (workers == vcpus) btw | 18:42 |
| dolphm | dstanek: 1 disables concurrency | 18:42 |
| dstanek | dolphm: do you think you are having a concurrency issue? | 18:43 |
| ayoung | iamjarvo, want to see the altenrative? | 18:44 |
| dolphm | dstanek: i thought maybe, but i have failures with concurrency=1 | 18:44 |
| ayoung | http://adam.younglogic.com/2014/08/getting-service-users-out-of-ldap/ | 18:44 |
| dstanek | dolphm: is it your environment or is it happening to others too? | 18:44 |
| dolphm | dstanek: two different environment. i blew away my old vm and built a new one | 18:45 |
| dolphm | dstanek: trying this with concurrency=1: | 18:45 |
| dolphm | dstanek: tox -r -e py27 keystone.tests.unit.test_v2_keystoneclient && tox -e py27 keystone.tests.unit.test_v2_keystoneclient | 18:45 |
| dstanek | dolphm: what os/python version? | 18:45 |
| dolphm | dstanek: wheezy, python 2.7 | 18:45 |
| *** jistr has quit IRC | 18:46 | |
| *** henrynash has quit IRC | 18:48 | |
| dolphm | dstanek: send me your pub key if you want | 18:48 |
| morganfainberg | dstanek: send me your private key if you want /s :P | 18:50 |
| * dolphm runs to meeting | 18:51 | |
| morganfainberg | ayoung: I'm wondering if we can make the admin token boot strapping a keystone-manage thing not needing an insecure wsgi thing | 18:51 |
| dstanek | dolphm: morganfainberg: sure | 18:51 |
| morganfainberg | ayoung: any thoughts. | 18:51 |
| morganfainberg | dstanek: :p | 18:51 |
| dstanek | morganfainberg: i'll send you both and email you the passphrase | 18:51 |
| morganfainberg | dstanek: perfect! Haha | 18:52 |
| ayoung | morganfainberg, no, I don't think so. Unless you want to put a user id in there instead, but you wouldn't be able to add a user | 18:52 |
| morganfainberg | ayoung: via keystone manage, sure you could. That can directly interact with the sql layers. | 18:52 |
| dstanek | stevemar: marekd: ok, how do i know in the local rules if something should be a list or a single value? | 18:53 |
| morganfainberg | ayoung: vs needing to do rest (it would be able to circumvent the controller / wsgi layer). But it would need access to the keystone.conf | 18:54 |
| ayoung | morganfainberg, yes. That would be fine, too | 18:54 |
| morganfainberg | ayoung: I don't like that bootstrap requires restarting keystone to remove the insecure admin_token filter. | 18:54 |
| ayoung | morganfainberg, ah...I reparsed your initial question | 18:54 |
| stevemar | dstanek, hmm the local guy is tricky | 18:54 |
| ayoung | so, yes, doing via a CLI utility would always be preferrable | 18:54 |
| ayoung | dstanek, I would like to make a "divider" value | 18:55 |
| morganfainberg | ayoung: I might take a stab at that. I would like to see moving that direction. (Stab = sometime by liberty) | 18:55 |
| ayoung | so if there i no divier, it is a single value, and the divder should be configurable | 18:55 |
| ayoung | ; versus : actaully came up in a different context | 18:55 |
| dstanek | ayoung: the problem right now is that the values are treated in two different ways | 18:56 |
| ayoung | morganfainberg, what I just proposed ^^ is the sanest way to do it, but would require an additional value on the API. Is that legal? | 18:56 |
| stevemar | dstanek, so you mean in a scenario with the substitution right? | 18:56 |
| stevemar | cause you can have user{name:{ be {0} {1} } } and a single {0} for 'groups' | 18:57 |
| morganfainberg | ayoung: the split would be something passed via the API? | 18:57 |
| dstanek | stevemar: yes, the *list patch does a literal_eval on group_ids because it things it should be a list | 18:57 |
| ayoung | morganfainberg, when you configure a value to be a list, yes, on the remote sidem, you would specific the character used to divisde the list | 18:57 |
| morganfainberg | As long as it doesn't break today's users without that configured value | 18:58 |
| dstanek | ayoung: how do you know it's a list on the remote side? | 18:58 |
| morganfainberg | But not sure how you know it's a ... What dstanek said | 18:58 |
| ayoung | dstanek, when someone defines the mapping, they know if they are going to be mapping from a single value or from a list. | 18:58 |
| morganfainberg | Ah. | 18:58 |
| ayoung | I mean, if the list only has one value, sure, there is no divider, but still treat it a s a list | 18:59 |
| *** nellysmitt has quit IRC | 18:59 | |
| *** nellysmitt has joined #openstack-keystone | 18:59 | |
| marekd | dstanek: ha! | 18:59 |
| marekd | that's the problem i encountered today too. | 18:59 |
| marekd | i think we can: either constraint that only groups can be a list | 19:00 |
| ayoung | http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-federation-ext.html#mappings | 19:00 |
| marekd | or add some string parsing | 19:00 |
| marekd | which is BAD | 19:00 |
| dstanek | marekd: hmmm...let me hack that in and see what happens | 19:00 |
| dstanek | marekd: right now i am treating everything list a list | 19:00 |
| marekd | dstanek: i was doing that too | 19:00 |
| dstanek | ayoung: is there something in the mapping that says "this field is a list"? | 19:01 |
| ayoung | marekd we already do string parsing | 19:01 |
| marekd | but what happens if the local rule is "Marek {0}" | 19:01 |
| ayoung | dstanek, no, that is what I am propsing | 19:01 |
| ayoung | dstanek, if we put in a field seperator, treat it as a list | 19:01 |
| ayoung | marekd, how does mod_saml turn the groups into a list | 19:01 |
| marekd | mod saml doesn't - it passses a ';' separated string | 19:02 |
| ayoung | if I am in groups users, admins, then i would expect to see REMOTE_GROUPS=users;admins | 19:02 |
| ayoung | so specify that the separator is a ; and know that we have a list | 19:02 |
| ayoung | ok..I rthink I am being a dunce | 19:02 |
| dstanek | ayoung: yes, so right now it's possible to be broken by the IdP | 19:03 |
| ayoung | we know that what we are getting is a list...the question is on the local side, not the remote, right? | 19:03 |
| *** samueldmq_away has joined #openstack-keystone | 19:03 | |
| ayoung | dstanek, you mean the IDP could make a group like | 19:03 |
| ayoung | users;admins | 19:03 |
| ayoung | and it should be a single value but shows up as multiple? | 19:04 |
| dstanek | ayoung: it could do that to any field and if it's not expected it'll be broken | 19:04 |
| ayoung | dstanek, meh | 19:04 |
| *** gokrokve_ has quit IRC | 19:04 | |
| * marekd is out now | 19:04 | |
| iamjarvo | ayoung i see the admin_token in keystone.conf is set but when i try to new up a client i get unauthorized. | 19:05 |
| dstanek | marekd: ok i pass all the tests now, but it still looks hacky | 19:05 |
| ayoung | iamjarvo, you use different env vars | 19:07 |
| ayoung | OS_SERVICE_TOKEN and OS_ENDPOINT | 19:07 |
| ayoung | er | 19:07 |
| ayoung | OS_SERVICE_ENDPOIINT | 19:07 |
| ayoung | keystone --help | 19:08 |
| ayoung | or openstack --help if you are using the common cli | 19:08 |
| iamjarvo | so im in python repl and doing this... client.Client(token='pass', domain_name='default', auth_url=AUTH_URL) | 19:09 |
| openstackgerrit | David Stanek proposed openstack/keystone: this is a test to prove broken behavior is possible https://review.openstack.org/163172 | 19:09 |
| openstackgerrit | David Stanek proposed openstack/keystone: Abstract the direct map concept into an object https://review.openstack.org/163569 | 19:09 |
| openstackgerrit | David Stanek proposed openstack/keystone: Implements whitelist and blacklist mapping rules https://review.openstack.org/163570 | 19:09 |
| iamjarvo | admin_token = pass is in keystone.conf | 19:09 |
| dstanek | ayoung, marekd, stevemar: that is my attempt at an object | 19:10 |
| dstanek | ^ | 19:10 |
| ayoung | dstanek, lookijng | 19:10 |
| *** rushiagr is now known as rushiagr_away | 19:10 | |
| ayoung | dstanek, I assmue the important one is https://review.openstack.org/163570 | 19:10 |
| ayoung | dstanek, did you change the commit ID? | 19:12 |
| ayoung | can you resubmit it under the origianl? | 19:12 |
| openstackgerrit | David J Hu proposed openstack/keystone: Version independent token issuance pipeline https://review.openstack.org/150629 | 19:12 |
| ayoung | I want to be able to see the difference between yours and the last proposed | 19:12 |
| ayoung | dstanek, Ah... the important one is https://review.openstack.org/#/c/163569/1/keystone/contrib/federation/utils.py,cm | 19:13 |
| *** bknudson has joined #openstack-keystone | 19:13 | |
| *** ChanServ sets mode: +v bknudson | 19:13 | |
| dstanek | ayoung: it's not fancy and doesn't fix the fundamental problem | 19:14 |
| dstanek | ayoung: yes i changed the commit id for now because i didn't want to change their original for my experiment | 19:14 |
| ayoung | dstanek, exapline the fundamental problem to me, I've jsut gotten it in pieces | 19:14 |
| dstanek | ayoung: the fundamental problem is that we treat the positions in the directmap differently for things we know is a list (like group) vs. everything else | 19:15 |
| dstanek | and the everthing else can be a list, which breaks the world | 19:15 |
| morganfainberg | dstanek: ick! | 19:16 |
| stevemar | dstanek, lemme take a look | 19:16 |
| dstanek | rodrigods: why do we need the literal_eval again? i want to find where in the code why turn things into a string | 19:16 |
| dstanek | rodrigods: oh, wait. that's the format() | 19:17 |
| rodrigods | dstanek, yes... | 19:17 |
| dstanek | so really we have to way to represent {'key': [...]} and the literal eval was a hack to get it to work? | 19:19 |
| rodrigods | dstanek, yes | 19:21 |
| ayoung | is this due to things coming through as strings from apache, with the separator? Or is it already converted by the time this code sees it? | 19:23 |
| *** diegows has joined #openstack-keystone | 19:23 | |
| dstanek | ayoung: no is that we '{0}'.format([a,b,c]) which turns into '["a", "b", "c"]' and later want that to actually be a list so we ast.literal_eval it | 19:25 |
| ayoung | What is DirectMap? That is saying that a value is explicitly listed in the assertion and should match the value in the group? | 19:27 |
| ayoung | { "user": { "name": "{0}" }} | 19:28 |
| rodrigods | ayoung, the value in the remote field passes through the local | 19:29 |
| ayoung | so order is important, otherwise we match thevalue in the ":remote" section and set the wrong value in the :"local" section? | 19:30 |
| rodrigods | ayoung, yes | 19:31 |
| rodrigods | the first value in remote is matched with the second value in local (if I remember correctly) | 19:32 |
| rodrigods | marekd, ^please correct me if I'm saying something wrong | 19:32 |
| *** radez is now known as radez_g0n3 | 19:32 | |
| dstanek | ayoung: rodrigods: yes, the bug i highlighted is that getting a list where we expect a single value blows things up | 19:33 |
| *** timcline_ has quit IRC | 19:34 | |
| bknudson | did we have a keystone rep at the operators meetup? | 19:34 |
| morganfainberg | bknudson, not that i am aware of. but i asked sdague to proxy any feedback for us | 19:34 |
| dstanek | bknudson: i wish i knew about it ahead of time since it's only a few hours drive for me | 19:34 |
| rodrigods | ayoung, the first value in remote is matched with first one in local** | 19:34 |
| morganfainberg | bknudson, as well as mordred. | 19:34 |
| bknudson | https://etherpad.openstack.org/p/PHL-ops-burning-issues -- they've got some burning issues regarding keystone (federation) | 19:35 |
| bknudson | dstanek: they didn't advertise it much... maybe on the operators list which I don't follow. | 19:35 |
| morganfainberg | bknudson, yeah i jumped into the etherpad as much as I could. | 19:36 |
| morganfainberg | bknudson, i would have gone but i just couldn't justify it with the number of HP folks already going. | 19:37 |
| bknudson | ahhh! https://github.com/SUSE-Cloud/keystone-hybrid-backend/blob/icehouse/hybrid_assignment.py | 19:37 |
| mordred | aroo? | 19:37 |
| morganfainberg | mordred, ops meetup | 19:37 |
| mordred | morganfainberg: oh, yeah. it happened | 19:38 |
| mordred | was big | 19:38 |
| mordred | lots of good people | 19:38 |
| bknudson | mordred: hard for us to defend ourselves from operators complaints. | 19:38 |
| morganfainberg | mordred, asked for some hp people to keep eyes/ears for keystone feedback/questions | 19:38 |
| mordred | it's the next big thing | 19:38 |
| mordred | morganfainberg: fwiw, you were not the main target of ire | 19:38 |
| morganfainberg | mordred, i figured as much | 19:38 |
| morganfainberg | bknudson, the complaints are relatively minor afaik [beyond the stuff we've already heard a lot of] | 19:39 |
| bknudson | https://review.openstack.org/#/c/155919/ should help shut them up. | 19:39 |
| * bknudson needs to rebase | 19:39 | |
| bknudson | we've been talking in OSSG about testing with TLS... a gate job. | 19:40 |
| morganfainberg | bknudson, there are a lot of gate jobs i want to see | 19:40 |
| *** timcline has joined #openstack-keystone | 19:42 | |
| morganfainberg | next ops meetup i'll plan to go to | 19:42 |
| stevemar | mordred, do we want to know the main target of ire? | 19:43 |
| morganfainberg | stevemar, you can take a look here: https://etherpad.openstack.org/p/PHL-ops-burning-issues | 19:43 |
| ayoung | what is a PHL? | 19:43 |
| morganfainberg | there is some telling "comments" | 19:43 |
| morganfainberg | ayoung, philly | 19:43 |
| ayoung | morganfainberg, so...did someone mention the amount of effort going in to ssl everywhere? | 19:43 |
| stevemar | bah, i should have bugged topol about this midcycle | 19:43 |
| ayoung | Ah..nkinder... | 19:43 |
| morganfainberg | ayoung, not sure. probably | 19:43 |
| nkinder | ayoung: ? | 19:44 |
| * morganfainberg wasn't there | 19:44 | |
| ayoung | line 46 | 19:44 |
| stevemar | zzzeek, i have an off-topic openstack request, mind if i email you directly? | 19:44 |
| topol | stevemar, bugged me about what | 19:44 |
| nkinder | yeah, ssl everywhere is so close... | 19:44 |
| stevemar | topol, the ops meetup? | 19:44 |
| zzzeek | stevemar: sure, mike_mp at zzzcomputing.com | 19:44 |
| stevemar | zzzeek, thanks boss :) | 19:44 |
| ayoung | They have a Keystone working group made up of 5 people I've never heard of. How wonderful | 19:44 |
| topol | you wanted to go? | 19:44 |
| morganfainberg | ayoung, you've heard of geoff | 19:44 |
| stevemar | topol, i hope we have someone there :) | 19:44 |
| morganfainberg | ayoung, he's one of the cisco guys who was supposed to be at the midcycle, has been at the summits, etc | 19:45 |
| topol | I know at least one person went | 19:45 |
| morganfainberg | ayoung, he was the one that was sick. | 19:45 |
| ayoung | looks familiar, yeah | 19:45 |
| topol | We were trying to send more but but they had some personal conflicts | 19:45 |
| morganfainberg | mike i think i've dealt with before | 19:45 |
| topol | lets make sure we get it covered for next time! | 19:45 |
| morganfainberg | the other 3 are new names, good to have them though | 19:45 |
| nkinder | morganfainberg: I have a public SAML IdP demo (running on OpenStack) that we can recommend for people to try things out (soon...) | 19:45 |
| nkinder | https://ipsilon.demo1.freeipa.org/idp | 19:45 |
| morganfainberg | nkinder, cool. | 19:46 |
| ayoung | I probably know more of them than that...but still...what does that mean, a Keystone working group? | 19:46 |
| nkinder | It's rebuilt nightly and is based off of an IPA public demo | 19:46 |
| *** nellysmitt has quit IRC | 19:46 | |
| nkinder | we're just finishing up adding ECP support | 19:46 |
| morganfainberg | ayoung, operators meant to communicate ops stuff w/ us and/or dealing with things along those lines | 19:46 |
| ayoung | nkinder, looks a lot like the FreeIPA login screen.... | 19:46 |
| morganfainberg | ayoung, so it's out line to the operator community | 19:46 |
| morganfainberg | s/out/our | 19:46 |
| ayoung | morganfainberg, very cool | 19:46 |
| morganfainberg | ayoung, yeah. glad geoff is involved with that. | 19:46 |
| nkinder | ayoung, morganfainberg: admin/Secret123 will get you in as admin so you can poke around | 19:46 |
| stevemar | nkinder, woot! | 19:47 |
| morganfainberg | nkinder, really... giving out admin creds on irc ... even if it's just testing :P | 19:47 |
| morganfainberg | nkinder, /me cringes out of habit | 19:47 |
| nkinder | morganfainberg: that's what it's designed for | 19:47 |
| nkinder | it's rebuilt from a snapshot every 24 hours | 19:47 |
| morganfainberg | nkinder, like i said... cringes out of habit! | 19:47 |
| morganfainberg | :) | 19:47 |
| stevemar | nkinder, it's not logging in :( | 19:48 |
| ayoung | took me a couple tries, too | 19:48 |
| rodrigods | dstanek, kind missed something you said before... do your change pass the test you've submitted? | 19:48 |
| nkinder | stevemar: just worked for me... | 19:48 |
| stevemar | nkinder, maybe too many requests :) | 19:48 |
| dstanek | rodrigods: yes, i'm pretty sure | 19:49 |
| nkinder | stevemar: also has kerberos login support enabled if you use the IPA demo as a KDC (http://www.freeipa.org/page/Demo) | 19:49 |
| rodrigods | dstanek, so I guess it looks like the "final" solution to me :) | 19:50 |
| stevemar | bknudson, huh https://github.com/SUSE-Cloud/keystone-hybrid-backend is baically multiple identity backends | 19:50 |
| stevemar | its sql + ldap | 19:50 |
| rodrigods | dstanek, maybe you should submit that test anyway | 19:50 |
| nkinder | stevemar: I am hopeful that we will have ECP here 2 weeks from now. | 19:50 |
| morganfainberg | nkinder, i'm thinking we might need something a little more locked down than "admin" level credentials for people to use for an official test-bed, and that is because someone could ostensibly change password and prevent others from utilizing it for testing. | 19:50 |
| dstanek | rodrigods: if people are happy with it i can put your change id back in a clean up the docs | 19:50 |
| lhcheng | nkinder: nice to have a freeipa demo, been procrastinating setting up one | 19:50 |
| nkinder | hyrid backend is failover (SQL first, then LDAP IIRC) | 19:51 |
| morganfainberg | nkinder, but something to circle back on later. | 19:51 |
| nkinder | morganfainberg: the idea is not for serious testing | 19:51 |
| nkinder | it's to see what it looks like, do some basic playing with it | 19:51 |
| nkinder | honestly, for testing I'd use a container | 19:51 |
| nkinder | morganfainberg: https://registry.hub.docker.com/u/nkinder/ipsilon/ | 19:52 |
| stevemar | nkinder, you're at the ops meetup? | 19:52 |
| nkinder | stevemar: no | 19:52 |
| rodrigods | dstanek, and add you as co-author :) | 19:54 |
| rodrigods | ayoung, did you have the chance to look that change? ^ | 19:54 |
| rodrigods | and morganfainberg | 19:54 |
| dstanek | rodrigods: i think there is a lot of redesign that can be done, but i don't think it's wise to jam it into K | 19:54 |
| rodrigods | dstanek, ayoung, morganfainberg https://review.openstack.org/#/c/163570/ | 19:54 |
| rodrigods | dstanek, ++ | 19:54 |
| stevemar | dstanek, yeah ++ for redesign | 19:54 |
| rodrigods | that patch was my first one | 19:55 |
| stevemar | dstanek, remember when we hacked it up at rax! | 19:55 |
| rodrigods | "inside" federation code | 19:55 |
| rodrigods | had the same feeling | 19:55 |
| *** gokrokve has joined #openstack-keystone | 19:55 | |
| dstanek | stevemar: not bad for an hour of work! | 19:55 |
| morganfainberg | nkinder, right. i'm thinking we should have a clear documented way for someone to setup a test SAML provider even if it's just us pointing at a recipe to standup a docker container with a running IDP for test in their environment | 19:55 |
| morganfainberg | nkinder, not a public "you can use X for testing out the IDP workflow" | 19:55 |
| nkinder | morganfainberg: +1 | 19:55 |
| stevemar | morganfainberg, that sounds all sorts of good | 19:56 |
| morganfainberg | testshib is sufficient for today, in a very limited manner afict | 19:56 |
| morganfainberg | but it's not a "good" option | 19:56 |
| nkinder | so as soon as ECP lands in ipsilon, I can update the docker image for it and we can see about getting some steps documented | 19:57 |
| morganfainberg | nkinder, awesomde | 19:57 |
| morganfainberg | nkinder, that'd be super useful for folks testing out federated identity | 19:57 |
| nkinder | yep. There's an IPA container image too, so it's pretty easy to use kerberos to auth to the IdP as well | 19:58 |
| iamjarvo | ayoung so we were able to add a role to the user. can't seem to add a project to the user though? | 20:01 |
| *** mattamizer has joined #openstack-keystone | 20:01 | |
| ayoung | iamjarvo, heh | 20:03 |
| ayoung | you don't "add a role to a user" per se. You assign a role to a user for a project | 20:03 |
| ayoung | and...you can always check you work in the database | 20:03 |
| ayoung | iamjarvo, but you should be able to list roles for the user. And it should show that the role is on the project | 20:04 |
| dstanek | rodrigods: i didn't see any complaints so i'll add your change id back in a push again | 20:11 |
| dstanek | rodrigods: i did a little experiment making a micro langauge like: http://paste.openstack.org/show/191688/ | 20:13 |
| *** radez_g0n3 is now known as radez | 20:13 | |
| iamjarvo | ayoung things seem to line up in mysql but it doesnt reflect in the horizon interface | 20:13 |
| rodrigods | dstanek, fine by me, and please add yourself as co-author :) | 20:15 |
| iamjarvo | ayoung is there a difference with default project and the user only having one project? does it assume the only project is the default project? can the keystone client set the default project? | 20:15 |
| iamjarvo | soo many questions sorry | 20:15 |
| stevemar | iamjarvo, try to get away from using the default project concept | 20:18 |
| *** joesavak has quit IRC | 20:18 | |
| stevemar | iamjarvo, default project works if there was no project specified in the auth request. if the user has roles on only one project - keystone won't assume it's the default project in v3. and ... keystoneclient can set default project for v2 | 20:19 |
| stevemar | but please don't use the default project logic, we want it to die | 20:19 |
| *** ljfisher has joined #openstack-keystone | 20:20 | |
| iamjarvo | stevemar ahh i see. i was confused about how that works. I am seeing this in the logs "Unauthorized: User 5251a786b4d90da09a5b045341e73ee12e162d3749bfe7e6d16b88710280c64a has no access to domain default (Disable debug mode to suppress these details.) (HTTP 401) | 20:21 |
| iamjarvo | Login successful for user "cloud_admin"." | 20:21 |
| ayoung | dstanek, so are you done hacking on the whitelist thing? I don't want this patch to split between the cracks. I am not yet certai if we have a dealbreaker probklem, or an edgecase that can be dealt with later | 20:22 |
| ayoung | LDAP===no default project | 20:22 |
| ayoung | no where to stick it | 20:22 |
| stevemar | no access to default domain eh | 20:23 |
| ayoung | domain scoped operation? | 20:23 |
| ayoung | list users? | 20:23 |
| iamjarvo | we are using the multi domain patch | 20:23 |
| dstanek | ayoung: i'm fixing it up now to push again | 20:23 |
| stevemar | iamjarvo, sounds like user 5251a786b4d90da09a5b045341e73ee12e162d3749bfe7e6d16b88710280c64a needs access to default domain | 20:23 |
| ayoung | dstanek, thanks | 20:23 |
| ayoung | dstanek, so much better if you code and I can review...I'm going to try and make sure I understand the scope of the problem fully | 20:24 |
| iamjarvo | stevemar i dont see domain options with the keystone client. how then can we assign a user to a domain? a token? | 20:27 |
| stevemar | iamjarvo, use a curl call with the admin token? | 20:27 |
| dstanek | ayoung: so i've changed my opinion on the fundamental problem - it's that we don't support lists in our mapping format | 20:28 |
| ayoung | marekd, stevemar, so...had a discussion with nkinder and jamielennox yesterday about the client plugins. SInce the Kerberos appaorach is going to use mapping, and it looks like X509 would need it as well, what we are thinking is to move the core of the mapping portion of the federation plugin into the keystoneclient repo, and keep each of the separate plugin repos light, with only enough code to handel the specifics of SAM | 20:28 |
| ayoung | L, OpenID, Kerberos, and so on. | 20:29 |
| ayoung | It does mean we shouldrename the federation repo to the SAML repo, as it would not make sense to put that nad openid into the same repo. | 20:29 |
| ayoung | dstanek, ok. | 20:29 |
| openstackgerrit | Merged openstack/keystone: Remove unused threads argument https://review.openstack.org/162475 | 20:31 |
| ljfisher | All, could I get some clarification on the deprecation for the v2.0 API. It is stll marked as such in the code, and I found some list discussion from last March that seems to revert the deprecation. From that, my understanding is v2.0 is not currently scheduled for removal in a release, but that it just won’t see any more updates? | 20:34 |
| *** jistr has joined #openstack-keystone | 20:35 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/163300 | 20:35 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Allow methods to be carried in Fernet tokens. https://review.openstack.org/163601 | 20:38 |
| iamjarvo | thanks | 20:43 |
| iamjarvo | stevemar silly question. i am only seeing examples with creating a user with a domain. cant seem to find one where updating a user takes a domain. can you please point me to the docs with this please | 20:50 |
| *** lifeless has joined #openstack-keystone | 20:50 | |
| *** trey has quit IRC | 20:51 | |
| bknudson | guess what... tox -epy27 crapping the bed again. :( | 20:54 |
| bknudson | oops, never mind. | 20:54 |
| bknudson | that was me crapping the bed. | 20:55 |
| *** trey has joined #openstack-keystone | 20:55 | |
| *** bernardo-silva has joined #openstack-keystone | 20:56 | |
| lbragstad | bernardo-silva: o/ | 20:57 |
| bernardo-silva | o/ :D | 20:57 |
| *** raildo has quit IRC | 20:58 | |
| *** hogepodge has joined #openstack-keystone | 20:58 | |
| bernardo-silva | dolphm: I was reviewing the fernet/spec and I strongly thing that "Timestamp" should'nt be exposed outside. It should be inside the Ciphertext | 20:58 |
| bernardo-silva | dolphm: Can you explain me why you put it outside? | 20:58 |
| dolphm | bernardo-silva: why don't you think it should be in plaintext? | 20:58 |
| lbragstad | bernardo-silva: you're talking about this, https://github.com/fernet/spec/blob/master/Spec.md#token-format | 20:59 |
| *** joesavak has joined #openstack-keystone | 21:00 | |
| bernardo-silva | Well, first you are exposing that info wich can be used to help a malice person to try to predict the HMAC keys. Imagine that I auth in a predictable timing, the same user and the same credentials a bunch of times. I can try to use the bits on the timestamp to figure it out the HMAC keys somehow, reducing the complexity of a brute force. | 21:00 |
| bernardo-silva | Second, timestamp "inside" the cyphertext helps a lot to increase the entropy of the cyphertext binary. | 21:01 |
| lifeless | bernardo-silva: timestamp is only going to be what 10 bits or something | 21:01 |
| lifeless | bernardo-silva: 20 at most | 21:02 |
| *** samueldmq_away has quit IRC | 21:03 | |
| bernardo-silva | lifeless: yes, but that can help a lot the ciphertext checksum entropy. The problem I have is: I see benefits on putting the timestamp inside the cyphertext, and I see no benefit at all to put it ouside. | 21:03 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Document mapping of policy action to operation https://review.openstack.org/155919 | 21:03 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix typo in name of variable in resource router https://review.openstack.org/162808 | 21:05 |
| *** r-daneel has quit IRC | 21:05 | |
| *** topol has quit IRC | 21:05 | |
| lbragstad | bernardo-silva: I guess in some cases it lightens the work on the Keystone side. | 21:07 |
| bernardo-silva | lbragstad: how? I think if you don't first decrypt a token (as a first thing you do with AE token) properly, any other keystone code shouldn't even be exercised. The keystone code should always have the access to the decrypted text. | 21:08 |
| bknudson | bernardo-silva: do you have general concerns about the entropy of fernet tokens in general? why isn't there enough entropy coming from elsewhere? | 21:09 |
| bknudson | you're definitely going to get a lot of tokens with the same uids in them. | 21:09 |
| lbragstad | bernardo-silva: it just pushes the validation of the token expiration into cryptography I believe | 21:09 |
| *** tellesnobrega_ has joined #openstack-keystone | 21:09 | |
| bernardo-silva | bknudson: entropy comes from the cyphertext content. the only content that I see changing is the audit id (imagine the same user, same credentials, same scope, authing over and over to try to figure it out the keys) | 21:10 |
| bknudson | bernardo-silva: I can definitely see your concern. | 21:10 |
| bknudson | we also can rotate keys. | 21:10 |
| *** jistr has quit IRC | 21:10 | |
| *** ayoung has quit IRC | 21:10 | |
| *** tellesnobrega_ has quit IRC | 21:11 | |
| bernardo-silva | bknudson: we do, but all that just to avoid adding the timestamps inside the cyphertext? why not just just put the ts there? :D | 21:11 |
| *** mattamizer has quit IRC | 21:11 | |
| bknudson | I don't think rotating keys was added just to avoid adding the timestamps. | 21:11 |
| bernardo-silva | bknudson: again: cyphertext inside == benefits, outside == still don't see any benefit at all. | 21:11 |
| dolphm | bernardo-silva: i don't see any benefit to it being inside considering we have sufficient entropy in the ciphertext from audit IDs | 21:12 |
| bernardo-silva | dolphm: what do you consider "sufficient" entropy? | 21:12 |
| stevemar | zzzeek, (i'm late but...) thanks for replying! my friend was very grateful! | 21:12 |
| dolphm | bernardo-silva: uuid4 | 21:12 |
| bernardo-silva | dolphm: on what? audit_id? | 21:13 |
| zzzeek | stevemar: hey no prob | 21:13 |
| dolphm | bernardo-silva: audit IDs are uuid4 | 21:13 |
| stevemar | dstanek, https://review.openstack.org/#/c/163569/1/keystone/contrib/federation/utils.py needs some comments :) | 21:13 |
| dolphm | bernardo-silva: they have a proprietary encoding scheme (basically compression) but it's uuid4 in terms of entropy | 21:13 |
| bernardo-silva | ok, uuid4's is 128 bit not fully random (some bits are fixed). timestamps are 64 bits (also not fully random), but adding both you have a lot more variation of bits, no? | 21:14 |
| lbragstad | bernardo-silva: https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L56-L65 | 21:14 |
| bernardo-silva | dolphm: again, what is the reason/benefit of putting the ts outside? | 21:14 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup test keeping unnecessary fixture references https://review.openstack.org/161544 | 21:15 |
| *** mattfarina is now known as mfer | 21:15 | |
| *** mfer has quit IRC | 21:16 | |
| dolphm | bernardo-silva: you could determine that a token is incredibly old without doing any crypto | 21:16 |
| bernardo-silva | OK, but, why do you want that? To avoid decrypting it? | 21:16 |
| lbragstad | which would help in service side validation | 21:16 |
| bernardo-silva | you will need to run the HMAC anyway, right? | 21:16 |
| lbragstad | to avoid the round trip | 21:16 |
| morganfainberg | dolphm, is this created or expires? | 21:16 |
| morganfainberg | lbragstad, cc& | 21:16 |
| dolphm | morganfainberg: created | 21:16 |
| morganfainberg | so.. | 21:17 |
| dolphm | bernardo-silva: if the creation date is really old, maybe you don't want to bother verifying the hmac at all | 21:17 |
| bernardo-silva | so, are you adding TTL inside the cyphertext and leave the creation time outside? | 21:17 |
| morganfainberg | i don't care if created is in ciphertext | 21:17 |
| bernardo-silva | what if the data is spoofed | 21:17 |
| bernardo-silva | and that data is changed | 21:17 |
| morganfainberg | i care that it's included in the hash value | 21:17 |
| dolphm | bernardo-silva: yes, ttl is in ciphertext because we're utilizing fernet as specified | 21:17 |
| *** haneef has quit IRC | 21:17 | |
| morganfainberg | including created in ciphertext vs outside doesn't really matter that much as long as it's strongly validated. | 21:17 |
| morganfainberg | ttl has to be in the payload (ciphertext) in this case | 21:18 |
| dolphm | morganfainberg: the creation date is included in the HMAC | 21:18 |
| morganfainberg | dolphm, that is sufficient in my view | 21:18 |
| *** haneef has joined #openstack-keystone | 21:18 | |
| bernardo-silva | dolphm: so, still bothers me that a "static" value like TTL gets chosen to go inside the text (decreasing entropy) and a variable one like TS is outside :D | 21:18 |
| dolphm | bernardo-silva: i don't see an attack vector | 21:19 |
| bernardo-silva | entropy is not based on size, it is based on variation proportion | 21:19 |
| bernardo-silva | giving X bytes, how many of those can change | 21:19 |
| bknudson | bernardo-silva: what do you think is the attack time given only audit-ID-bits of entropy? | 21:19 |
| bernardo-silva | bknudson: imagine that I can create tokens for user X | 21:20 |
| bknudson | then you have one of their tokens or their password. | 21:20 |
| bernardo-silva | and I know (based on open source specs :D) the content of my cyphertext and my token | 21:20 |
| dolphm | bernardo-silva: say, 128 bit IV + 128 bit UUID4, plus maybe 128 bit AES key + 128 bit SHA256 key if you're doing rotation faster than an attacker can brute force | 21:20 |
| bernardo-silva | so, therefore, I can keep generating tokens until I have a bunch where the timestamp difference is in a bit or two | 21:20 |
| dolphm | bernardo-silva: and then all that work is wasted when keys are rotated | 21:21 |
| bernardo-silva | therefore, I can reduce the amount of effort of a brute force to figure it out KMAC/enc keys | 21:21 |
| bknudson | then you can get the key eventually. | 21:21 |
| dolphm | bernardo-silva: and hopefully by that time, the identity team will have blocked your account ;) | 21:21 |
| bernardo-silva | you don't need many attemps | 21:21 |
| dolphm | bernardo-silva: define "not many"? | 21:21 |
| bknudson | we can only generate tokens so fast. | 21:22 |
| morganfainberg | bernardo-silva, what is the attack time [please estimate] based on your assessment of what is in the fernet ciphertext | 21:22 |
| bernardo-silva | you do some to see the response time (let's say it is very consistent on the 400ms range, which in timestamp is 0sec based. | 21:22 |
| bknudson | (it's python) | 21:22 |
| bernardo-silva | so, you do auths every 16 seconds | 21:22 |
| morganfainberg | bernardo-silva, i wont hold you to the number if you're wrong btw, just getting a feel for best guess. | 21:22 |
| bernardo-silva | so, you will have TSs that varies in just 1 bit | 21:22 |
| bknudson | you can generate as many tokens as you want given a user and password. | 21:22 |
| dolphm | morganfainberg: key_rotation_interval = attack_time - 1 | 21:22 |
| morganfainberg | dolphm, hey! stop stealing my thunder :P | 21:23 |
| dolphm | morganfainberg: lol | 21:23 |
| bernardo-silva | morganfainberg: ok: attack time: I run 2 tokens agains keystone and figure it out that it takes around 400ms to answer me. | 21:23 |
| morganfainberg | bernardo-silva, i think we use msec, so it's more than 1bit, but sure. | 21:23 |
| bernardo-silva | TS is sec based, not msec based | 21:24 |
| bknudson | bernardo-silva: but if you've got TS barely varying already then they're not giving you any entropy in the cipher either. | 21:24 |
| bknudson | you're relying on audit id | 21:24 |
| bernardo-silva | UUID v4 varies randomly just 122 bits | 21:24 |
| bknudson | timestamp barely varies at all | 21:24 |
| morganfainberg | so we move away from uuid to a system.urandom for the same number of bytes | 21:25 |
| dolphm | bernardo-silva: if you can guess the next uuid4 i produce i'll give you all the money | 21:25 |
| bernardo-silva | so, you get the whole message and adds 1 predictable bit (the TS one) to a brute force logic, so you can guess the keys | 21:25 |
| morganfainberg | dolphm, let me get my timemachine | 21:25 |
| bernardo-silva | current implemention: you rely only on audit_id. pushing TS inside the cyphertext you relly on both | 21:25 |
| dolphm | morganfainberg: uuid4 comes from sys | 21:25 |
| bernardo-silva | Also, user CANNOT see the TS of the server | 21:25 |
| morganfainberg | bernardo-silva, so ... if TTL was not ciphertext neither was TS you'd be happy? | 21:25 |
| bknudson | we need the server to randomize its timestamp | 21:26 |
| dstanek | stevemar: add added docstrings and update some existing ones - running the last set of tests now | 21:26 |
| *** darrenc_ is now known as darrenc | 21:26 | |
| * morganfainberg is not saying that is possible. | 21:26 | |
| bernardo-silva | which can be a big deal, because then is hard to predict if the tokens have a perfect TS | 21:26 |
| dolphm | bknudson: ++ entropy | 21:26 |
| morganfainberg | dolphm, lets make ttl a float, use a urandom X number of digits on the backend of the int | 21:26 |
| morganfainberg | dolphm, >.> | 21:26 |
| bernardo-silva | morganfainberg: happier* but the best scenario for me would have both on the cyphertext :D | 21:27 |
| morganfainberg | bernardo-silva, the issue is that is duplicating data for very little benefit | 21:27 |
| bknudson | we can put as much random junk on the token as we want. | 21:27 |
| bknudson | make it a config option. | 21:27 |
| morganfainberg | bernardo-silva, and we already know size of tokens is a real issue | 21:27 |
| morganfainberg | but we could just wedge random crap in the token too | 21:27 |
| bernardo-silva | morganfainberg: no! not duplicating data. I am asking to "remove" TS from the token and "moving" it to the cyphertext. | 21:27 |
| morganfainberg | make any token < 255 characters == 255 | 21:27 |
| bernardo-silva | morganfainberg: not duplicating at all | 21:27 |
| morganfainberg | bernardo-silva, that breaks fernet iirc | 21:28 |
| dolphm | bknudson: entropy_dial = 11 | 21:28 |
| morganfainberg | bernardo-silva, since we're using fernet that is there already | 21:28 |
| bknudson | dolphm: mine only goes up to 10! | 21:28 |
| iamjarvo | stevemar ahh this was hidden in logs Error getting domain scoped token. | 21:28 |
| iamjarvo | for the user | 21:28 |
| dolphm | bknudson: our entropy is better | 21:28 |
| bernardo-silva | morganfainberg: oh! so, that is the reason why it is outside (that was my first question, thanks :D) | 21:28 |
| morganfainberg | bernardo-silva, yeah we already had it there | 21:28 |
| bernardo-silva | morganfainberg: OK, that was my first question, hehehe | 21:28 |
| morganfainberg | bernardo-silva, we didn't want to duplicate it in the ciphertext as well as externally based on the format we're using. | 21:28 |
| bernardo-silva | morganfainberg: then that is the benefit / requirement for it to be outside | 21:29 |
| morganfainberg | not because "it's cool to eliminate things from ciphertext" :) | 21:29 |
| morganfainberg | bernardo-silva, aha, glad i could help unwind this a bit | 21:29 |
| * morganfainberg has been in meetings for a bit and just got back. | 21:29 | |
| morganfainberg | bernardo-silva, you need special entropy dials to go to 11 | 21:29 |
| morganfainberg | bernardo-silva, whopse | 21:30 |
| dolphm | bernardo-silva: you're looking at the fernet spec, right? | 21:30 |
| morganfainberg | bknudson ^^ | 21:30 |
| morganfainberg | dolphm, does the ciphertext use the same key as for the HMAC? | 21:31 |
| morganfainberg | dolphm, i'm spacing on the answer for this atm. | 21:31 |
| dolphm | morganfainberg: no | 21:31 |
| morganfainberg | dolphm, then i think this is a moot point | 21:31 |
| dolphm | morganfainberg: 128 bit AES key + 128 bit HMAC key | 21:31 |
| morganfainberg | yeah then i'm really not concerned | 21:31 |
| morganfainberg | bernardo-silva, ^ the HMAC key is the reaaaaaally important part, the ciphertext is convienent for us. we even explored not using the AES layer | 21:32 |
| dolphm | morganfainberg: "fernet" keys are 256 bit keys, where aes_key = fernet_key[:128]; sha256_key = fernet_key[128:]; | 21:32 |
| *** boris-42 has quit IRC | 21:32 | |
| morganfainberg | bernardo-silva, but it's a nice package all around to include both. because fernet gave it to us | 21:32 |
| bernardo-silva | morganfainberg: OK, I agree | 21:32 |
| morganfainberg | bernardo-silva, if someone cracked the AES key tbh, good on them, have at, fun times.. | 21:33 |
| openstackgerrit | David Stanek proposed openstack/keystone: Abstract the direct map concept into an object https://review.openstack.org/163569 | 21:33 |
| openstackgerrit | David Stanek proposed openstack/keystone: Implements whitelist and blacklist mapping rules https://review.openstack.org/142573 | 21:33 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds test for federation mapping list order issues https://review.openstack.org/163172 | 21:33 |
| dstanek | stevemar: ^ | 21:33 |
| dolphm | you still have to break another 128 bit key to generate your own tokens | 21:33 |
| morganfainberg | i'd be more worried if they got the HMAC key | 21:33 |
| morganfainberg | because then they could do some level of extending tokens/replay attacks. | 21:33 |
| morganfainberg | etc. | 21:33 |
| dolphm | if you break the hmac key, you can basically refresh your own token until key rotation invalidates the hmac key you discovered | 21:33 |
| morganfainberg | it would still get caught with the same audit id, but it would get weird. | 21:33 |
| dolphm | morganfainberg: ++ | 21:34 |
| morganfainberg | like i said, more worried about HMAC key than AES key. but it's a tall order to break both imo. | 21:34 |
| morganfainberg | and even if you do, rotation should help. unless key generation is weak, then we have a different issue to contend with | 21:34 |
| dolphm | i imagine another attack vector would be easier, like paying someone | 21:35 |
| dolphm | and that'd probably be cheaper | 21:35 |
| morganfainberg | bernardo-silva, so does this solve your concerns? | 21:35 |
| bknudson | dolphm: rubber hoses are cheap. | 21:35 |
| bernardo-silva | morganfainberg: yes :D | 21:35 |
| morganfainberg | dolphm, i dunno, how many GPUs do you have on those "i work for $HOSTING_COMPANY$ so i don't directly pay for bare metal servers i use for 'development'"? :P | 21:36 |
| morganfainberg | bernardo-silva, awesome :) thnx | 21:36 |
| morganfainberg | dolphm, then again... "hey install my ssh key on your keystone server, here's $1000" goes a long way. | 21:37 |
| morganfainberg | :P | 21:37 |
| dolphm | morganfainberg: i take personal checks | 21:38 |
| morganfainberg | dolphm, bitcoins? | 21:38 |
| bknudson | morganfainberg: if he had that many GPUs he might as well generate his own bitcoins. | 21:38 |
| bknudson | screw the fernet key. | 21:38 |
| dolphm | morganfainberg: no, you'd just take them back because my bit coins are on my keystone server | 21:38 |
| morganfainberg | bknudson, eh, bitcoins are so last year... i heard litecoin is where it's at... or dogecoin | 21:38 |
| morganfainberg | dolphm, damn, my clever plan is foiled again | 21:39 |
| bknudson | credentials backend for bitcoins. | 21:39 |
| morganfainberg | bknudson, barbican? | 21:39 |
| bknudson | we should have a way to accept bitcoins as tokens. | 21:39 |
| bknudson | auth_token validates the chain... | 21:39 |
| morganfainberg | bknudson, and use the blockchain for valid... aahhaha | 21:39 |
| *** radez is now known as radez_g0n3 | 21:40 | |
| bknudson | automatic metering | 21:40 |
| morganfainberg | lol | 21:40 |
| morganfainberg | but you have to be careful about the 50% attacks | 21:40 |
| morganfainberg | dolphm, ok so anything i can do to help get the fernet token chain fixed (since uh ttl has to be encoded) so we can land it this week? *hopeful* | 21:41 |
| stevemar | gordc, does commenting 'experimental' trigger an experimental gate/check? | 21:43 |
| morganfainberg | stevemar yes | 21:43 |
| stevemar | morganfainberg, neato | 21:43 |
| morganfainberg | stevemar, erm check experimental | 21:43 |
| stevemar | ih | 21:43 |
| stevemar | oh | 21:43 |
| morganfainberg | not sure if just "experimental" does | 21:43 |
| stevemar | gordc, ^ | 21:43 |
| * morganfainberg realizes it's easy to go look at the zuul config to be sure | 21:44 | |
| *** timcline has quit IRC | 21:44 | |
| gordc | yeah it's check experimental | 21:44 |
| gordc | i'm using your patch as test | 21:45 |
| gordc | and i realised it ain't fully merged yet | 21:45 |
| gordc | stevemar: ^ | 21:45 |
| stevemar | gordc, happy to be the guinea pig | 21:46 |
| gordc | your patch will be in limbo | 21:48 |
| morganfainberg | oooh | 21:51 |
| *** bernardo-silva has quit IRC | 21:52 | |
| *** spandhe has quit IRC | 21:54 | |
| jamielennox | morganfainberg: released? | 21:55 |
| morganfainberg | jamielennox, yes | 21:55 |
| *** samueldmq_away has joined #openstack-keystone | 21:55 | |
| morganfainberg | jamielennox, 1.5.0 | 21:55 |
| jamielennox | sweet! | 21:55 |
| jamielennox | i'll give it a day or two to make sure there aren't any failures and propose the g-r bump | 21:56 |
| morganfainberg | sounds good | 21:56 |
| jamielennox | though i guess i can do the devstack swift fix now | 21:57 |
| stevemar | dstanek, you are magical sir | 21:58 |
| dstanek | stevemar: thanks!? i think | 21:58 |
| *** iamjarvo has quit IRC | 21:58 | |
| *** arif-ali has quit IRC | 21:58 | |
| stevemar | dstanek, i really like that object rep of directmaps :) | 21:59 |
| stevemar | i owe you at least 2 beers for that | 21:59 |
| morganfainberg | jamielennox, don't merge the devstack swift fix until g-r is updated. | 21:59 |
| *** samueldmq has quit IRC | 21:59 | |
| *** samueldmq_away is now known as samueldmq | 21:59 | |
| jamielennox | morganfainberg: devstack always runs off the latest upstream AFAIK - it's not linked to g-r | 21:59 |
| jamielennox | just needs to be in pypi | 21:59 |
| morganfainberg | jamielennox, i'd still WIP it first | 22:00 |
| samueldmq | dolphm, the priority patch under 'keystonemiddleware' can now have an '(approved)' at the end | 22:01 |
| samueldmq | dolphm, at the list you're maintaining (https://gist.github.com/dolph/651c6a1748f69637abd0) | 22:02 |
| morganfainberg | samueldmq, refresh? | 22:02 |
| morganfainberg | i don't see anything under keystonemiddleware section | 22:02 |
| dolphm | morganfainberg: i broke it again :) | 22:02 |
| dolphm | samueldmq: this gist is maintained by a bot | 22:02 |
| morganfainberg | dolphm, i see: | 22:02 |
| morganfainberg | keystonemiddleware | 22:02 |
| morganfainberg | (this list is empty!) | 22:02 |
| samueldmq | morganfainberg, well now it became empty lol | 22:03 |
| *** _cjones_ has quit IRC | 22:03 | |
| morganfainberg | dstanek, ooh so looking at the object | 22:03 |
| dolphm | samueldmq: i broke that page this morning; it'll be late tonight before i have a chance to fix it | 22:03 |
| morganfainberg | dstanek, way easier to read and know wth is going on | 22:03 |
| *** _cjones_ has joined #openstack-keystone | 22:03 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Move unit tests into tests.unit https://review.openstack.org/162482 | 22:03 |
| stevemar | morganfainberg, ++ | 22:04 |
| samueldmq | dolphm, looks like it is working ... I think my page needed a refresh, as morgan suggested | 22:05 |
| samueldmq | dolphm, sorry to make you think it's broken again xD | 22:05 |
| dolphm | samueldmq: i guarantee it's broken because it was running on a vm that i deleted and haven't set back up | 22:05 |
| dolphm | samueldmq: you probably needed a refresh too | 22:06 |
| samueldmq | dolphm, ok, it's broken :p | 22:07 |
| *** csoukup has joined #openstack-keystone | 22:09 | |
| dolphm | samueldmq: morganfainberg: okay fixed it instead of implementing the last bit fernet TTL business, and now i have to RUN! o/ | 22:10 |
| *** arif-ali has joined #openstack-keystone | 22:10 | |
| morganfainberg | dolphm, lol need me to rebase the patchchain or anything ? | 22:10 |
| samueldmq | dolphm, k go! o/ | 22:10 |
| stevemar | o/ | 22:10 |
| *** dims has quit IRC | 22:11 | |
| *** dstanek-troubled has joined #openstack-keystone | 22:15 | |
| *** arif-ali has quit IRC | 22:15 | |
| dstanek-troubled | morganfainberg: re: token expiration; i thought we agreed that having Fernet tokens different was OK if it was documented (or at least someone agreed) | 22:16 |
| morganfainberg | dstanek-troubled, the issue is that we're now changing the expiration behavior | 22:16 |
| morganfainberg | as in, a rescoped token extends the expiration | 22:16 |
| morganfainberg | not that it's always tied to the keystone conf. | 22:17 |
| dstanek-troubled | morganfainberg: so what do you think we should be doing? | 22:17 |
| morganfainberg | dstanek-troubled, if we don't mind that a token rescope no longer times out when the original auth times out (so rescopes extend the session) - thats fine, but that wasn't intended | 22:17 |
| bknudson | mood nicks. | 22:18 |
| morganfainberg | dstanek-troubled, today uuid and pki tokens carry forward the expiration of the initial auth | 22:18 |
| morganfainberg | so when i rescope, my token still expires at the same time as the original token | 22:18 |
| *** arif-ali has joined #openstack-keystone | 22:18 | |
| samueldmq | morganfainberg, a rescoped token could have its own issued time, but the TTL would be smaller than default, calculated from the time passed since the first issuance | 22:18 |
| morganfainberg | samueldmq, except with the current proposal TTL is not in the token at all | 22:19 |
| morganfainberg | samueldmq, it's always based on CONF.token.expiration_time | 22:19 |
| morganfainberg | samueldmq, for fernet | 22:19 |
| samueldmq | morganfainberg, ok so we cant :/ | 22:19 |
| samueldmq | morganfainberg, I should be updated of the spec, sorry | 22:20 |
| samueldmq | morganfainberg, so the idea is to have only the issued_at, and being expired or not depends on comparing that with the expiration_time | 22:20 |
| morganfainberg | dstanek-troubled, so - either we should clearly make this change and commit to it, or we encode TTL. | 22:21 |
| morganfainberg | samueldmq, that was the proposed change. | 22:21 |
| morganfainberg | samueldmq, this is not clearly communicated in anyway and changes the behavior so. we need to clearly communicate this or encode TTL. | 22:21 |
| bknudson | why aren't there unit tests for this? | 22:21 |
| morganfainberg | and we've had a pretty hard line stance on rescoping doesn't change the life-span of the token for a while | 22:22 |
| bknudson | we don't have unit tests for token from token expiring at the same time? | 22:22 |
| morganfainberg | bknudson, i think there are. just none that are triggered with fernet. | 22:22 |
| dstanek-troubled | morganfainberg: we could probably encode the ttl in a byte or two | 22:22 |
| samueldmq | morganfainberg, ttl would be good | 22:22 |
| dstanek-troubled | that could be bad if you could keep extending a tokens life indefinitely | 22:23 |
| morganfainberg | dstanek-troubled, yeah, it's not a big deal to change. it's that the whole fernet tree is based on a patch that introduces this change in ttl behavior atm | 22:23 |
| samueldmq | morganfainberg, is there any 'flag' in the rescoped token to say it was rescoped ? so that one could understand why a given token has 'less time' than others | 22:23 |
| morganfainberg | samueldmq, if you have 2 audit ids, it has been rescoped | 22:23 |
| morganfainberg | samueldmq, [current_token_audit_id, original_token_in_the_chain_audit_id] | 22:24 |
| morganfainberg | or [current_token_audit_id] <-- not rescoped | 22:24 |
| samueldmq | morganfainberg, so I think it would be ok to have a reduced ttl in a given token, since there is a way to 'justify' that : rescoped | 22:24 |
| morganfainberg | samueldmq, so we just need to encode the TTL correctly | 22:24 |
| *** ayoung has joined #openstack-keystone | 22:24 | |
| *** ChanServ sets mode: +v ayoung | 22:24 | |
| *** hogepodge has quit IRC | 22:24 | |
| morganfainberg | samueldmq, not go with creation + conf.token.expiration_time | 22:25 |
| samueldmq | morganfainberg, this could even be the default behavior, you're rescoping, so the ttl should be kept, (rescoping, not getting another, by definition) | 22:25 |
| morganfainberg | samueldmq, it already is the behavior | 22:25 |
| samueldmq | morganfainberg, ok so just have ttl for fernet, and keep consistent with what we have for others | 22:25 |
| morganfainberg | samueldmq, expiration_time is kept consistent in a token rescope chain | 22:25 |
| morganfainberg | samueldmq, fernet does it today, the issue is the current "next" patch to review for fernet changes this: https://review.openstack.org/#/c/161774/ | 22:26 |
| morganfainberg | samueldmq, so that blocks up the rest of the tree | 22:26 |
| samueldmq | morganfainberg, what's the main purpose of removing this on that patch? make it still smaller? | 22:27 |
| *** jorge_munoz has quit IRC | 22:27 | |
| morganfainberg | samueldmq, that was the intent of the patch, we're reversing course on it though and encoding the TTL. | 22:27 |
| dstanek-troubled | how about we use a new constant, the OpenStack epoch, at a starting point for dates. this would shrink the size needed to hold the offset. | 22:30 |
| ayoung | dstanek-troubled, you trying to write the Y3K bug? | 22:31 |
| dstanek-troubled | lol, i don't think we should do it. was just a random thought. | 22:31 |
| samueldmq | morganfainberg, rescoping tokens is *really* used by other services? I mean, is it a common scenario or just in specific cases? | 22:31 |
| morganfainberg | samueldmq, all the time | 22:32 |
| morganfainberg | samueldmq, unscoped -> scoped, horizon changing projects, etc | 22:32 |
| morganfainberg | dstanek-troubled, i think someone would kill you :P | 22:32 |
| samueldmq | morganfainberg, k, makes sense. If it wasnt, a first token could just have no ttl, and once we rescope, we could add a sort of 'passed_time', calculated when rescoping | 22:33 |
| samueldmq | morganfainberg, and then in the most common case (not rescoped), the token was smaller, but forgot this :p | 22:34 |
| morganfainberg | samueldmq, lets not get crazy. easier to just always include the TTL | 22:34 |
| samueldmq | morganfainberg, yeah, I agree it's the best approach, let's keep it simple | 22:34 |
| samueldmq | morganfainberg, it's just a few bytes, not that worth it to make it complicated | 22:35 |
| morganfainberg | exactly | 22:35 |
| *** dstanek-troubled has quit IRC | 22:36 | |
| * samueldmq would vote for removing ttl if we had dial-up internet connection | 22:37 | |
| ayoung | Like a bridge over troubled-stanek.... | 22:37 |
| *** tellesnobrega_ has joined #openstack-keystone | 22:40 | |
| *** tellesnobrega_ has quit IRC | 22:41 | |
| *** ljfisher has quit IRC | 22:41 | |
| *** gordc has quit IRC | 22:42 | |
| morganfainberg | samueldmq, uh. | 22:42 |
| morganfainberg | samueldmq, 1200baud modem? | 22:42 |
| *** thedodd has quit IRC | 22:44 | |
| *** dims_ has joined #openstack-keystone | 22:46 | |
| *** pnavarro has quit IRC | 22:48 | |
| samueldmq | morganfainberg, nah, I think 2400 baud.. it already was quick when I born :p | 22:49 |
| *** ayoung has quit IRC | 22:50 | |
| samueldmq | morganfainberg, I take a bit to understand when you asked dolph: 'lol need me to rebase the patchchain or anything ?' | 22:50 |
| samueldmq | o/ | 22:50 |
| samueldmq | took* | 22:50 |
| *** chrisshattuck has quit IRC | 23:06 | |
| *** carlosmarin has quit IRC | 23:22 | |
| *** carlosmarin has joined #openstack-keystone | 23:27 | |
| *** topol has joined #openstack-keystone | 23:29 | |
| *** ChanServ sets mode: +v topol | 23:29 | |
| *** bknudson has quit IRC | 23:31 | |
| *** henrynash has joined #openstack-keystone | 23:39 | |
| *** ChanServ sets mode: +v henrynash | 23:39 | |
| *** chlong has joined #openstack-keystone | 23:41 | |
| *** topol has quit IRC | 23:47 | |
| *** bknudson has joined #openstack-keystone | 23:52 | |
| *** ChanServ sets mode: +v bknudson | 23:52 | |
| *** wwriverrat has joined #openstack-keystone | 23:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!