| *** iamjarvo has quit IRC | 00:02 | |
| *** chrisshattuck has quit IRC | 00:05 | |
| *** chrisshattuck has joined #openstack-keystone | 00:07 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Refactor code supporting status in JSON Home https://review.openstack.org/165075 | 00:10 |
|---|---|---|
| openstackgerrit | Merged openstack/keystone: remove expected backtrace from logs https://review.openstack.org/165212 | 00:11 |
| *** markvoelker has quit IRC | 00:15 | |
| *** chrisshattuck has quit IRC | 00:31 | |
| *** markvoelker has joined #openstack-keystone | 00:32 | |
| *** henrynash has quit IRC | 00:37 | |
| *** diegows has quit IRC | 00:41 | |
| *** diegows has joined #openstack-keystone | 00:42 | |
| *** _cjones_ has quit IRC | 00:43 | |
| lbragstad | morganfainberg: possible suspect of the token issues with auth_token https://bugs.launchpad.net/keystonemiddleware/+bug/1433372 | 00:44 |
| openstack | Launchpad bug 1433372 in keystonemiddleware "safe_quote doesn't work for Fernet/PKI/PKIz tokens" [Undecided,New] | 00:44 |
| morganfainberg | lbragstad: looking. | 00:45 |
| morganfainberg | Oh fun. | 00:45 |
| lbragstad | morganfainberg: it looks like the safe_quote method is modifying the token string before passing it to keystone | 00:46 |
| morganfainberg | Fun. | 00:46 |
| *** chrisshattuck has joined #openstack-keystone | 00:49 | |
| *** browne has quit IRC | 00:52 | |
| lbragstad | jamielennox: around? | 00:53 |
| lbragstad | jamielennox: ^ question about the safe_quote method() | 00:53 |
| *** samueldmq has joined #openstack-keystone | 00:53 | |
| lbragstad | s/safe_quote method()/safe_quote() method/ | 00:54 |
| *** chrisshattuck has quit IRC | 00:55 | |
| lbragstad | jamielennox: what cases do we expect the token string to not be url safe in the verify_token path? | 00:55 |
| lbragstad | morganfainberg: fyi fernet tokens are passing with existing AuthToken test cases: https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bp/klw-tokens,n,z | 00:56 |
| lbragstad | jamielennox: it seems to be done unconditionally, regardless of the token type, but UUID tokens shouldn't ever not be URL safe? | 00:57 |
| jamielennox | lbragstad: i'll need to look back through it | 00:58 |
| jamielennox | i don't remember what it's even for | 00:59 |
| lbragstad | jamielennox: gotcha, we seem to call it regardless | 00:59 |
| lbragstad | at least on _identity.verify_token() | 00:59 |
| jamielennox | it's very likely it was just copied out of the client | 00:59 |
| lbragstad | which might explain why the tests dolphm was running failed for everything except uuid? | 01:00 |
| jamielennox | because there are really only a couple of requests that auth_token will every make | 01:00 |
| lbragstad | jamielennox: ok | 01:00 |
| jamielennox | lbragstad: we don't unquote on the keystone side? | 01:00 |
| lbragstad | jamielennox: apparently not | 01:01 |
| jamielennox | the safe_quote output looks like what i would want | 01:01 |
| lbragstad | jamielennox: or else it wouldn't be failing | 01:01 |
| lbragstad | jamielennox: it passes for uuid, but that's because it doesn't change | 01:01 |
| jamielennox | so this is v2 right? just looking where it's called | 01:02 |
| lbragstad | jamielennox: this was happening on v3-only | 01:02 |
| jamielennox | https://github.com/openstack/keystonemiddleware/blob/d436ec737a4ecfe653d934c6f4a71f411b7f9cc2/keystonemiddleware/auth_token/_identity.py#L166 | 01:03 |
| jamielennox | yea, that looks wrong | 01:03 |
| lbragstad | jamielennox: yeah, it does it regardless | 01:03 |
| jamielennox | so on v2 calls the verify call is GET /v2/tokens/{uuid} and in which case it should be safe_quoted | 01:03 |
| lbragstad | jamielennox: git is telling me that you refactored it ~27 days ago | 01:03 |
| jamielennox | on v3 you pass it via X-Subject-Token and AFAIK you don't need to urlencode headers | 01:04 |
| lbragstad | jamielennox: but even before the refactor it was still calling that method regardless | 01:04 |
| lbragstad | jamielennox: sweet | 01:04 |
| jamielennox | check on the urlencoding of headers, but i think you're right | 01:05 |
| lbragstad | https://github.com/openstack/keystonemiddleware/commit/1272e7ca045657cd9526e63b8a30fd577a6e6d34 | 01:05 |
| jamielennox | lbragstad: i'd be surprised if that change happened in the keystonemiddleware directory at all | 01:05 |
| lbragstad | before, safe_quote() just lived in auth_token | 01:05 |
| lbragstad | but the refactor moved it to _utils() but that shouldn't matter | 01:06 |
| lbragstad | it was still doing the same behavior | 01:06 |
| jamielennox | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L1127 so here they are purposefully encoding the header | 01:06 |
| lbragstad | jamielennox: ah | 01:06 |
| lbragstad | jamielennox: so it breaks Fernet there too | 01:07 |
| jamielennox | which stems from introducing v3 tokens to auth_token https://github.com/openstack/python-keystoneclient/commit/d782a998474d92d4299b4404b69442f0288efc3b | 01:07 |
| jamielennox | so long ago... | 01:07 |
| lbragstad | jamielennox: so, given your much more familiar, do you have a recommendation for a fix? | 01:08 |
| lbragstad | s/your/you're/ | 01:08 |
| dstanek | lbragstad: how's it going? | 01:09 |
| lbragstad | dstanek: https://bugs.launchpad.net/keystonemiddleware/+bug/1433372 | 01:09 |
| openstack | Launchpad bug 1433372 in keystonemiddleware "safe_quote doesn't work for Fernet/PKI/PKIz tokens" [Undecided,New] | 01:09 |
| jamielennox | lbragstad: i think it's fine to remove safe_encode from v3, do v2 only | 01:09 |
| jamielennox | so move it into one of the strategy bits | 01:09 |
| jamielennox | dstanek: what's the allowed character range for http headers? | 01:10 |
| jamielennox | ASCII should be safe right? | 01:10 |
| dstanek | jamielennox: i think ascii | 01:10 |
| dstanek | yes, all ascii should be fine | 01:10 |
| jamielennox | fernet is base64 encoded so it's just the extra chars anyway | 01:11 |
| lbragstad | ok, so what about Fernet tokens in the v2.0 path with auth_token? | 01:11 |
| jamielennox | lbragstad: ideally for this stuff there is a base64.urlsafe_base64 or something | 01:11 |
| lbragstad | jamielennox: the Fernet tokens are base46 encoded | 01:11 |
| jamielennox | typo? or did you just decide on a new standard | 01:12 |
| jamielennox | :p | 01:12 |
| jamielennox | lbragstad: move safe_encode to https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_identity.py#L46 | 01:13 |
| jamielennox | safe_quote | 01:13 |
| lbragstad | and remove from https://github.com/openstack/python-keystoneclient/blob/fc1f5a7963adb3c39f48131af5117bfafa3b07e7/keystoneclient/middleware/auth_token.py#L1127 | 01:13 |
| lbragstad | ? | 01:13 |
| dstanek | header names can be ascii and values any 8bit character | 01:13 |
| dstanek | http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 | 01:13 |
| dstanek | http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2 | 01:13 |
| jamielennox | lbragstad: don't touch the keystoneclient one, it's not a security issue | 01:14 |
| *** chrisshattuck has joined #openstack-keystone | 01:14 | |
| lbragstad | jamielennox: got it, but then remove https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_identity.py#L166 | 01:15 |
| lbragstad | ? | 01:15 |
| dstanek | lbragstad: is this possibly because of the hardcoded double equals? | 01:15 |
| lbragstad | dstanek: I'm not sure | 01:15 |
| jamielennox | lbragstad: yes | 01:15 |
| dstanek | lbragstad: this function 'random_urlsafe_str_to_bytes' is just plain wrong | 01:16 |
| dstanek | lbragstad: do you have a small test case that i can run to see the breakage? | 01:16 |
| *** chrisshattuck has quit IRC | 01:19 | |
| jamielennox | dstanek: i don't think the problem is the urlsafe bit, it's that it was url encoding it and then putting it into a header | 01:19 |
| *** chrisshattuck has joined #openstack-keystone | 01:19 | |
| lbragstad | dstanek: I posted a recreated portion of it in the bug | 01:20 |
| lbragstad | dstanek: with pasteraw | 01:20 |
| dstanek | jamielennox: that should be OK though right? | 01:20 |
| lbragstad | dstanek: http://cdn.pasteraw.com/jt7zlnanjmcwqyu5gt9k4vcspy1pj9p | 01:20 |
| lbragstad | dstanek: token is what we get back from Keystone | 01:21 |
| jamielennox | dstanek: the keystone side doesn't unencode the header, so the base64 decode will fail | 01:21 |
| jamielennox | lbragstad: or i assume that's what you would be seeing | 01:21 |
| lbragstad | yeah, | 01:22 |
| lbragstad | so the token is different from what we expect when we pass to decrypt it, | 01:22 |
| dstanek | lbragstad: why is safe_quote checking to see if it is already quoted? | 01:22 |
| lbragstad | which is where cryptography was blowing up | 01:22 |
| lbragstad | dstanek: no sure | 01:22 |
| lbragstad | not* | 01:22 |
| openstackgerrit | Lance Bragstad proposed openstack/keystonemiddleware: Don't safe_quote for V3 in auth_token. https://review.openstack.org/165269 | 01:27 |
| lbragstad | dstanek: jamielennox thought it was code that was copied over from the client | 01:27 |
| jamielennox | lbragstad: always going to require tests | 01:31 |
| lbragstad | jamielennox: yep, running them now, | 01:31 |
| lbragstad | jamielennox: but that's the right track, right? | 01:32 |
| jamielennox | lbragstad: it would seem fine to me | 01:32 |
| lbragstad | jamielennox: cool, thanks for your help! | 01:32 |
| jamielennox | np | 01:32 |
| dstanek | lbragstad: how did Fernet tokens break the middleware? | 01:33 |
| lbragstad | dstanek: the user sends something like 'gAAAAABVCEAvKfH3QI8ogwfLYOPjh3QRMfF7VDKmvrNedNu-wUT8rKW98ABcEWJQ-n8TboYi0Y_NlcM0GP9iUeDjniV39JYQnKzzeHbidqmswpeXUpRETdY8LtSOLkKEElootWRh7wiW4rV4fEAj-Pso-ocLHz3YLRiQlWYQ9Jfn1BKoafnr68Y=' to the middleware as a token | 01:34 |
| lbragstad | and the middleware turns it into 'gAAAAABVCEAvKfH3QI8ogwfLYOPjh3QRMfF7VDKmvrNedNu-wUT8rKW98ABcEWJQ-n8TboYi0Y_NlcM0GP9iUeDjniV39JYQnKzzeHbidqmswpeXUpRETdY8LtSOLkKEElootWRh7wiW4rV4fEAj-Pso-ocLHz3YLRiQlWYQ9Jfn1BKoafnr68Y%3D' before sending it to Keystone to be validated | 01:35 |
| lbragstad | which fails because it's not the same token string | 01:36 |
| *** chrisshattuck has quit IRC | 01:38 | |
| dstanek | lbragstad: that's very odd - did that change? | 01:39 |
| lbragstad | dstanek: it looks like it's been in middleware for a while | 01:40 |
| lbragstad | dstanek: but we would never see this on a uuid token | 01:40 |
| lbragstad | dstanek: but it does give probable cause as to why dolphm was seeing the same issues with pki and pkiz tokens | 01:40 |
| dolphm | lbragstad: dstanek: o/ | 01:41 |
| jamielennox | there was a patch a little while ago that did fallback (if you couldn't cert validate then try to do it online) that should probably have caught it | 01:41 |
| dstanek | lbragstad: that's very strange | 01:41 |
| lbragstad | dstanek: yep | 01:41 |
| lbragstad | dolphm: welcome to the party | 01:41 |
| *** rdo has quit IRC | 01:41 | |
| dstanek | i would have expected this to pop up in a bug report | 01:42 |
| dolphm | dstanek: yes, random_urlsafe_str_to_bytes is unsavory, but it's pre-existing behavior that is just better documented post-fernet. i think it's new for kilo? so we still have time to change it | 01:42 |
| *** nellysmitt has joined #openstack-keystone | 01:43 | |
| dolphm | lbragstad: does an unscoped token just happen to not have any trailing padding at the end? trying to figure out why those validate correctly, but the others don't | 01:44 |
| dstanek | dolphm: if it's not causing a bug now i think there is a good chance it'll cause one in the future since it assumes the only thing it can decode is uuids | 01:44 |
| lbragstad | dolphm: yes, exactly | 01:44 |
| lbragstad | dolphm: unscoped tokens don't have the padding | 01:44 |
| dolphm | lbragstad: did you confirm that? | 01:44 |
| lbragstad | I have a trace somewhere | 01:45 |
| dstanek | lbragstad: dolphm: it's not unscoped vs. scoped generally it's just the size of you test data | 01:46 |
| dolphm | lbragstad: i'm going to try running keystone-deploy with your patch | 01:46 |
| *** chrisshattuck has joined #openstack-keystone | 01:46 | |
| dolphm | dstanek: all tokens of the same payload type are the exact same size in bytes, within a few variables | 01:46 |
| dolphm | dstanek: like, has the token been rescoped or not? (== is it carrying a second audit id?) | 01:47 |
| *** nellysmitt has quit IRC | 01:47 | |
| lbragstad | dolphm: http://cdn.pasteraw.com/naljxh72wrcmfosq9guf201lx1knf0y | 01:47 |
| dolphm | dstanek: assuming all UUIDs are the same length, etc | 01:47 |
| *** stevemar has joined #openstack-keystone | 01:47 | |
| *** ChanServ sets mode: +v stevemar | 01:47 | |
| dolphm | lbragstad: ha. | 01:48 |
| dstanek | dolphm: that's not true for pki though | 01:48 |
| dolphm | lbragstad: YOUR PATCH WORKS FOR FERNET! | 01:49 |
| * lbragstad cracks many beers | 01:49 | |
| dolphm | lbragstad: all i'm left with is a single failure: AuthorizationFailure: Authorization failed: token must be bytes. (HTTP 400) | 01:49 |
| dolphm | lbragstad: so, yay? | 01:50 |
| dolphm | lbragstad: but seriously, YAY! | 01:50 |
| dolphm | lbragstad: let me test it with PKI, PKIZ, and UUID and i'll +2 | 01:50 |
| *** chrisshattuck has quit IRC | 01:51 | |
| lbragstad | dolphm: where are you getting the token must be in bytes error? | 01:51 |
| dolphm | lbragstad: my new test_token_rescoping | 01:52 |
| lbragstad | hmmmm | 01:52 |
| dolphm | lbragstad: i think when it rescopes for the first time | 01:53 |
| dstanek | i wish we could get that figured out. i have a bad feeling that something awful is going on there | 01:53 |
| dolphm | lbragstad: that appears to be a problem in the client, because i've verified that i'm passing in a str | 01:53 |
| dolphm | dstanek: ^ | 01:53 |
| lbragstad | hm so does the client cast it to something other? | 01:54 |
| dolphm | lbragstad: i have to assume so | 01:55 |
| dstanek | dolphm: where in the flow are you? you - (str) -> client - (unicode) -> keystone? | 01:55 |
| dolphm | lbragstad: have not walked through the code | 01:55 |
| dolphm | dstanek: here https://github.com/dolph/keystone-deploy/blob/master/test_exercises.py#L150 | 01:56 |
| dolphm | dstanek: unscoped.auth_token is of type() str | 01:56 |
| dolphm | dstanek: and i get a 400 there from keystone | 01:56 |
| dolphm | dstanek: on L149 | 01:56 |
| dstanek | dolphm: maybe keystone gets a unicode when it grabs it out of the header | 01:57 |
| dolphm | dstanek: i don't actually know that it's choking on unicode for sure -- i have no idea what type it's really seeing (could be NoneType!) | 01:58 |
| dstanek | dolphm: :-( | 01:58 |
| *** dims has quit IRC | 01:59 | |
| dolphm | lbragstad: so, i've confirmed twice that your patch fixes fernet, but pki is *still* broken | 02:00 |
| jamielennox | nova -> neutron communication with an auth plugin! 6 months later | 02:00 |
| * jamielennox happy dance | 02:00 | |
| *** lhcheng has quit IRC | 02:00 | |
| lbragstad | dolphm: :-/ | 02:00 |
| dolphm | dstanek: http://cdn.pasteraw.com/iqpm8li0ehyffrtdpxn7ash1we6rh6f | 02:02 |
| dolphm | jamielennox: /highfive | 02:02 |
| dstanek | dolphm: i'm super intrigued now - going to setup keystone-deploy | 02:04 |
| dolphm | dstanek: i target ubuntu 12.04 LTS, since that's what travis uses | 02:05 |
| dolphm | dstanek: as a deploy target | 02:05 |
| *** samueldmq has quit IRC | 02:05 | |
| dolphm | dstanek: on the ansible host, run the first two steps from the travis install: https://github.com/dolph/keystone-deploy/blob/master/.travis.yml | 02:06 |
| *** harlowja_ is now known as harlowja_away | 02:06 | |
| dolphm | dstanek: and then i deploy & test with $ ansible-playbook -i "$IP," -u root deploy.yaml && HOST=$IP python -m unittest discover | 02:07 |
| dstanek | dolphm: looks like i have to make this a rackspace vm | 02:08 |
| dolphm | dstanek: don't *have* to, i think lbragstad uses vagrant? | 02:08 |
| lbragstad | dstanek: yeah, I use vagrant | 02:08 |
| morganfainberg | lbragstad: nice. | 02:09 |
| lbragstad | dstanek: because I haven't had the time to get my rax dept account setup | 02:09 |
| dstanek | lbragstad: pulling down the machine over the hotel network :-) say 1 hour 42 mins left | 02:09 |
| lbragstad | dstanek: use rax :) | 02:09 |
| *** samueldmq has joined #openstack-keystone | 02:11 | |
| dolphm | lbragstad: testing your patch with PKIZ tokens... | 02:11 |
| lbragstad | sweet | 02:11 |
| morganfainberg | lbragstad: I have some other infra changes to propose so I'll be looking to setup one of the runs with fernet. | 02:11 |
| lbragstad | morganfainberg: ++ | 02:11 |
| dolphm | morganfainberg: \p | 02:12 |
| dolphm | \o/ * | 02:12 |
| dolphm | lbragstad: no effect on PKIZ either | 02:13 |
| morganfainberg | Also that ksm issue with safe quote. I'm ready to release asap if it is solved by a easy fix/quick to land. | 02:13 |
| lbragstad | :( | 02:13 |
| morganfainberg | I take it not fixed by the :( | 02:13 |
| dolphm | morganfainberg: fixed for Fernet, but i see the same issue with PKI and PKIZ too | 02:13 |
| lbragstad | morganfainberg: its doesn't fix PKI or PKIz issues | 02:13 |
| morganfainberg | Dolph what was the code fix? Let me take a quick look. | 02:14 |
| dolphm | morganfainberg: https://review.openstack.org/#/c/165269/ | 02:14 |
| openstackgerrit | Dave Chen proposed openstack/keystone: envlist option defaults to the list of all environments https://review.openstack.org/161705 | 02:14 |
| morganfainberg | Pki and pkiz might already be safe strings? | 02:15 |
| dolphm | lbragstad: tokens should already *always* *always* *always* *always* be URL safe | 02:15 |
| dolphm | lbragstad: no client should ever have to manipulate them, ever | 02:15 |
| morganfainberg | dolphm: why do we need to safe quote them then? | 02:15 |
| lbragstad | dolphm: yeah, before they leave keystone on auth you mean? | 02:15 |
| dolphm | morganfainberg: i have zero clue | 02:15 |
| morganfainberg | History? | 02:15 |
| dolphm | morganfainberg: we should not have to, ever | 02:15 |
| lbragstad | morganfainberg: dolphm jamielennox thought it was code that was copied over from client -> middleware? | 02:16 |
| * lbragstad == proxy | 02:16 | |
| dolphm | morganfainberg: the only manipulation we have a half-ass excuse for is hashing them because they're too big | 02:16 |
| morganfainberg | You know, let's just check to see if they are safe strings and not quote them if they aren't | 02:16 |
| dolphm | morganfainberg: or raise exceptions if they're not | 02:16 |
| stevemar | morganfainberg, quit being reasonable | 02:16 |
| morganfainberg | And throw a warn or something asking for a bug report if it ever is hot. | 02:16 |
| dolphm | morganfainberg: because then something else is broken | 02:16 |
| morganfainberg | Hit* | 02:17 |
| morganfainberg | or exception. Yes. | 02:17 |
| bknudson | hot tokens! | 02:17 |
| jamielennox | dolphm: history: https://github.com/openstack/python-keystoneclient/commit/d782a998474d92d4299b4404b69442f0288efc3b#diff-bd6505432da8629a1e85b25349a8d5d0R987 | 02:17 |
| morganfainberg | Though I'd like to really put a change like that through its paces before we make it. | 02:17 |
| *** raildo has quit IRC | 02:17 | |
| morganfainberg | Is the safe quote in ksc middleware? | 02:17 |
| lbragstad | morganfainberg: yep | 02:18 |
| lbragstad | morganfainberg: dolphm https://github.com/openstack/python-keystoneclient/blob/fc1f5a7963adb3c39f48131af5117bfafa3b07e7/keystoneclient/middleware/auth_token.py#L1127 | 02:18 |
| dolphm | and THAT'S IN A HEADER! | 02:20 |
| morganfainberg | dolphm: insane right? | 02:20 |
| dolphm | ugh https://bugs.launchpad.net/keystone/+bug/974319 | 02:21 |
| openstack | Launchpad bug 974319 in python-keystoneclient "auth_token does not quote token to validate" [Low,Fix released] - Assigned to Dolph Mathews (dolph) | 02:21 |
| *** erkules_ has joined #openstack-keystone | 02:21 | |
| dolphm | morganfainberg: let's raise an exception if token != quoted(token) | 02:21 |
| lbragstad | dolphm: that would break Fernet again | 02:23 |
| *** erkules has quit IRC | 02:23 | |
| dolphm | lbragstad: why? | 02:23 |
| *** davechen has quit IRC | 02:24 | |
| *** davechen has joined #openstack-keystone | 02:24 | |
| lbragstad | token will come in as something like 'somethingsomethingsometing==' and the quoted version of that would change it to be 'somethingsomethingsomething%3D' | 02:24 |
| morganfainberg | If fernet tokens aren't url safe we should make them | 02:24 |
| dolphm | oh because urllib.quote('=') != '=' | 02:25 |
| lbragstad | yes | 02:25 |
| morganfainberg | Keystone should not issue non-url-safe tokens. | 02:25 |
| morganfainberg | So fix it in keystone. | 02:25 |
| dolphm | morganfainberg: i think the question is why '=' is not a default safe char in https://docs.python.org/2/library/urllib.html#urllib.quote | 02:26 |
| morganfainberg | dolphm: ?thing=thing | 02:26 |
| dolphm | morganfainberg: the documentation specifically says it's for url safety in a path, not in a query string | 02:26 |
| lbragstad | and '?' will never be in a Fernet token, correct? | 02:27 |
| *** ayoung has quit IRC | 02:27 | |
| dolphm | lbragstad: correct | 02:27 |
| morganfainberg | dolphm: because = isn't urlsafe by the standard iirc | 02:27 |
| dolphm | morganfainberg: i think base64.urlsafe_b64encode() output is correct, and URL safe for use in paths (GET /v2.0/tokens/{fernet_token}) | 02:28 |
| *** telemons1er is now known as telmnstr | 02:28 | |
| *** telmnstr is now known as telemonster | 02:28 | |
| dolphm | morganfainberg: that's the only place we care about safety anyway | 02:28 |
| dolphm | we're certainly not putting them in query strings, and don't ever want to put them in paths again | 02:28 |
| morganfainberg | dolphm: '=' is reserved as a delim: https://tools.ietf.org/html/rfc3986#section-2.2 | 02:28 |
| morganfainberg | It is not urlsafe by the spec. | 02:29 |
| morganfainberg | It can be used as an alternative delimiter. | 02:30 |
| morganfainberg | So. If it's in urlsafe b64, the b64 encoder is wrong. | 02:30 |
| dolphm | morganfainberg: i think you're misreading the spec | 02:30 |
| *** diegows has quit IRC | 02:30 | |
| dolphm | morganfainberg: look at where the subdelim definition is applied | 02:30 |
| morganfainberg | dolphm: they are called out as reserved explicitly. | 02:32 |
| morganfainberg | Even if they are stated separately as sub-delims | 02:32 |
| *** browne has joined #openstack-keystone | 02:34 | |
| dolphm | morganfainberg: "For example, the semicolon (";") and equals ("=") reserved characters are often used to delimit parameters and parameter values applicable to that segment." | 02:34 |
| dstanek | morganfainberg: i do read that as '=' can be used to delimit the path | 02:34 |
| dolphm | morganfainberg: so, you can use both in path segments | 02:34 |
| dstanek | morganfainberg: dolphm: but the original rfc i think they are illegal http://www.ietf.org/rfc/rfc1738.txt | 02:34 |
| morganfainberg | dstanek: that is how I read it | 02:34 |
| morganfainberg | Meaning /thing=thing/otherthing | 02:35 |
| dolphm | GET google.com/api;v=1.1/search?query=foobar would be valid | 02:35 |
| *** zzzeek has joined #openstack-keystone | 02:35 | |
| morganfainberg | So use without it as a delim is not allowed. Where it is "safe" if you say "encode this for me" it wouldn't be allowed. | 02:36 |
| morganfainberg | So it's a difference in "make this string urlsafe" and "construct a url with a sub-delim" | 02:37 |
| morganfainberg | We are in the former category here. As I read the rfc | 02:37 |
| dolphm | http://en.wikipedia.org/wiki/Base64#Decoding_Base64_with_padding | 02:39 |
| dolphm | bad link, http://en.wikipedia.org/wiki/Base64#Implementations_and_history | 02:39 |
| morganfainberg | Yeah was reading that one | 02:40 |
| morganfainberg | Rfcs are dense reading. | 02:42 |
| dstanek | rfc reading is what sigmavirus24_awa is for | 02:43 |
| dolphm | dstanek: yeah but he's occupied | 02:43 |
| morganfainberg | dstanek: lol | 02:43 |
| * dolphm is testing a patch for keystone | 02:44 | |
| dstanek | dolphm: 3ds i think ;-) | 02:44 |
| dolphm | dstanek: lol i thought he went downtown? | 02:44 |
| morganfainberg | dolphm: so all the references point to = needing to be % encoded in urls. But I admit I'm reading on a phone. | 02:44 |
| dstanek | dolphm: no nolan, claco, ian and a few others went to logan's | 02:45 |
| dstanek | that's why i'm back at the hotel | 02:45 |
| morganfainberg | Oh so I'm in Austin this week. Wish me luck :(. Sxsw :( | 02:46 |
| lbragstad | dstanek: fyi, if you need a ride, the hotel is on my way to work | 02:46 |
| morganfainberg | (Well tomorrow through Friday) | 02:46 |
| dolphm | dstanek: ah | 02:46 |
| lbragstad | me shakes fist as morganfainberg! | 02:46 |
| * lbragstad fail | 02:46 | |
| dolphm | morganfainberg: grr | 02:46 |
| lbragstad | tix were so damn expensive when I checked | 02:46 |
| morganfainberg | Not going to sxsw. Ick. | 02:46 |
| morganfainberg | Have a meeting for summit stuff. | 02:47 |
| lbragstad | oh | 02:47 |
| * lbragstad unshakes fist | 02:47 | |
| morganfainberg | The :( was cause sxsw is happening. | 02:47 |
| morganfainberg | And I have to deal with it. | 02:47 |
| morganfainberg | And the crowds in town. | 02:47 |
| dstanek | morganfainberg: i bet | 02:48 |
| dstanek | lbragstad: thx, i'll let you know - what time do you normally go to work? | 02:48 |
| lbragstad | dstanek: I can be there whenever, typically by 8 | 02:48 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 02:57 |
| *** _cjones_ has joined #openstack-keystone | 02:57 | |
| dolphm | morganfainberg: i imagine this patch to keystone should work? http://cdn.pasteraw.com/1pzoiucqc76jrztscto57oq9w4rmjpm | 02:58 |
| lbragstad | jorge_munoz: nice, I was just working on addressing those | 02:58 |
| samueldmq | lbragstad, there are only remaining 2 remaining fernet patches ? | 02:59 |
| lbragstad | samueldmq: yeah | 02:59 |
| samueldmq | lbragstad, 159229 and 164348 | 02:59 |
| lbragstad | dolphm: any ideas on this comment? | 02:59 |
| lbragstad | https://review.openstack.org/#/c/164348/4/keystone/auth/plugins/core.py | 02:59 |
| dolphm | samueldmq: and a bug fix, somewhere, possibly | 02:59 |
| samueldmq | dolphm, what's the issue? | 02:59 |
| lbragstad | dolphm: that patch looks good to me | 03:00 |
| dolphm | lbragstad: bitwise makes that easier? | 03:00 |
| dolphm | samueldmq: the issue that this is trying to address https://review.openstack.org/#/c/165269/1 | 03:00 |
| dolphm | samueldmq: which this branch is reproducing https://github.com/dolph/keystone-deploy/tree/fernet-tokens | 03:00 |
| lbragstad | dolphm: the deployer methods part? | 03:00 |
| *** Hilomomo has joined #openstack-keystone | 03:01 | |
| samueldmq | dolphm, k, I will have a look | 03:01 |
| dolphm | samueldmq: test failures look like this https://travis-ci.org/dolph/keystone-deploy/builds/54734386 | 03:01 |
| *** zzzeek has quit IRC | 03:01 | |
| dolphm | samueldmq: you can follow the travis-ci setup if you want to run keystone-deploy | 03:01 |
| dolphm | lbragstad: yeah... | 03:02 |
| dolphm | lbragstad: otherwise, i don't really have an answer? it depends on the deployers requirements | 03:02 |
| dolphm | lbragstad: (how many methods they need, etc) | 03:02 |
| lbragstad | yeah | 03:02 |
| dolphm | lbragstad: maybe we should read methods out of CONF? | 03:03 |
| lbragstad | dolphm: and build the method map according to that? | 03:03 |
| dolphm | lbragstad: exactly | 03:03 |
| *** Hilomomo has left #openstack-keystone | 03:03 | |
| dolphm | lbragstad: that way it's flexible, but comes with the caveat that two deployments might differ | 03:03 |
| lbragstad | so, | 03:03 |
| dolphm | lbragstad: and adding a method anywhere but the end will cause issues with existing tokens? | 03:04 |
| lbragstad | just read in whatever, and set them to 1, 2, 4, 8, etc | 03:04 |
| dolphm | lbragstad: i think, yeah. | 03:04 |
| dolphm | bknudson: ^ | 03:04 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: URL quote fernet tokens https://review.openstack.org/165279 | 03:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use existing token test for Fernet tokens. https://review.openstack.org/164348 | 03:11 |
| *** gyee has quit IRC | 03:15 | |
| *** davechen has left #openstack-keystone | 03:16 | |
| *** davechen has joined #openstack-keystone | 03:16 | |
| *** lhcheng has joined #openstack-keystone | 03:17 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: URL quote fernet tokens https://review.openstack.org/165279 | 03:19 |
| samueldmq | dolphm, just a dumb question .... | 03:19 |
| dolphm | morganfainberg: ^ fix | 03:19 |
| dolphm | lbragstad: dstanek: ^ | 03:19 |
| samueldmq | dolphm, don't you need X-Subject-Token here (https://github.com/dolph/keystone-deploy/blob/fernet-tokens/test_exercises.py#L119-L121) | 03:19 |
| *** ajayaa has joined #openstack-keystone | 03:19 | |
| dolphm | samueldmq: i was actually *just* thinking that the method name there is poorly chosen... | 03:20 |
| *** richm has quit IRC | 03:20 | |
| dolphm | samueldmq: the answer to your question is "no" because it's not actually hitting keystone (it's not using GET /v3/auth/tokens) | 03:20 |
| dolphm | samueldmq: instead, ECHO_ENDPOINT is a service like nova, which is protected by the auth_token middleware | 03:20 |
| dolphm | samueldmq: so the test is validating the token by requesting a protected URL, and auth_token is actually calling GET /v3/auth/tokens + X-Subject-Token before the protected URL is returned | 03:21 |
| dolphm | samueldmq: any suggestions for a better method name? | 03:23 |
| dolphm | samueldmq: you can see auth_token wrapping the ECHO_ENDPOINT (and the echo application itself) here: https://github.com/dolph/keystone-deploy/blob/fernet-tokens/playbooks/roles/http/templates/echo.py | 03:24 |
| samueldmq | dolphm, dunno about a better name ... maybe get_resource, or get_keystone_protected_resource :p | 03:25 |
| samueldmq | dolphm, a comment explaining what is actually happening | 03:26 |
| samueldmq | dolphm, I got what is being done behind that, thanks for the explanation | 03:26 |
| * samueldmq is looking at the echo.py now.. he wants to see the magic there | 03:27 | |
| samueldmq | dolphm, k so how far you are now when debugging? | 03:31 |
| samueldmq | dolphm, any logs from keystonemiddleware/keystone? | 03:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: URL quote fernet tokens https://review.openstack.org/165279 | 03:32 |
| dolphm | samueldmq: i think that's the fix for the first issue i'm seeing ^ | 03:32 |
| dolphm | samueldmq: but of course there's a second issue :) | 03:33 |
| samueldmq | dolphm, and this one (https://review.openstack.org/#/c/165269) ? | 03:33 |
| *** csoukup has joined #openstack-keystone | 03:33 | |
| dolphm | samueldmq: that "fixes" the issue, but we determined in the conversation above that making the tokens URL safe in the first place was the more reliable approach | 03:34 |
| samueldmq | dolphm, k so let's not remove the safe_quote thing | 03:36 |
| * samueldmq reads the above conversation | 03:36 | |
| dolphm | samueldmq: so with the url-safety fix on the keystone side, i still get a failing test: http://cdn.pasteraw.com/iqpm8li0ehyffrtdpxn7ash1we6rh6f | 03:36 |
| dolphm | (which is a different issue) | 03:36 |
| *** nellysmitt has joined #openstack-keystone | 03:44 | |
| *** csoukup has quit IRC | 03:48 | |
| samueldmq | dolphm, did you modify test_exercises.py locally? (the upstream one hasnt even the line 192) | 03:48 |
| samueldmq | based on the pastraw above .. | 03:48 |
| *** _cjones_ has quit IRC | 03:48 | |
| *** nellysmitt has quit IRC | 03:48 | |
| dolphm | samueldmq: ah, yes | 03:49 |
| dolphm | samueldmq: i thought this would help narrow the cause of the failure, but it did not http://cdn.pasteraw.com/l9hqpyloyd34lirdapsoay0dskj89aj | 03:49 |
| dolphm | samueldmq: hence i didn't commit | 03:49 |
| samueldmq | dolphm, ok, so it fails in the first rescope | 03:53 |
| dolphm | samueldmq: ++ | 03:53 |
| dolphm | samueldmq: my current guess is that only on rescoping does a token pass through json.loads(), which i think turns everything into unicode | 03:54 |
| dolphm | samueldmq: but fernet tokens can't be unicode (even though they're ascii strings?) | 03:54 |
| dolphm | samueldmq: python -c "from cryptography.fernet import Fernet; f = Fernet(Fernet.generate_key()).decrypt(u'asdf')" | 03:55 |
| samueldmq | dolphm, pki/pkiz still works, right? | 03:55 |
| dolphm | samueldmq: i'm having some other issue with those two :( | 03:56 |
| samueldmq | dolphm, ah, so we've introduced a bug .. | 03:57 |
| openstackgerrit | Merged openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 03:59 |
| dolphm | samueldmq: https://bugs.launchpad.net/keystone/+bug/1431669 | 03:59 |
| openstack | Launchpad bug 1431669 in Keystone "Create saml assertion doesn't work with fernet token" [High,Triaged] - Assigned to Dolph Mathews (dolph) | 03:59 |
| *** ajayaa has quit IRC | 04:01 | |
| *** csoukup has joined #openstack-keystone | 04:04 | |
| samueldmq | dolphm, I'm trying to deploy that with ansible by myself ... | 04:05 |
| samueldmq | dolphm, then I'll be able to debug | 04:05 |
| samueldmq | dolphm, if I can't debug, I can't help, for sure :) | 04:06 |
| dolphm | samueldmq: let me know if you need a hand | 04:06 |
| dolphm | samueldmq: i need to write new docs for keystone-deploy! | 04:06 |
| samueldmq | dolphm, k, tbh I am not so familiar with ansible :) | 04:06 |
| samueldmq | dolphm, once I downloaded your code, i) cp sample_inventory inventory ii) ansible-playbook -i inventory --sudo deploy.yaml | 04:07 |
| dolphm | samueldmq: the part that's especially hard to document is how ansible should authenticate with your deployment node | 04:07 |
| dolphm | samueldmq: open up .travis.yml in the root dir | 04:07 |
| samueldmq | yes ... | 04:08 |
| dolphm | samueldmq: you'll also need to run the "ansible-galaxy install ..." command like travis does | 04:08 |
| dolphm | samueldmq: and then you have a bunch of options for actually running the playbook | 04:08 |
| dolphm | samueldmq: (in terms of auth) | 04:08 |
| *** csoukup has quit IRC | 04:09 | |
| dolphm | samueldmq: can you "ssh root@$VM_IP" for example ? | 04:09 |
| dolphm | samueldmq: where $VM_IP is wherever you want to deploy keystone to? | 04:09 |
| samueldmq | dolphm, wait .. do I need to have a keystone running? or will this playbook install one for me? | 04:10 |
| dolphm | samueldmq: this will install keystone | 04:14 |
| dolphm | samueldmq: behind apache w/ mysql, using UUID | 04:15 |
| dolphm | samueldmq: it'll also install the echo app in the same apache server | 04:15 |
| samueldmq | dolphm, all this on 192.168.111.222 (the vagrant vm), right? | 04:16 |
| dolphm | samueldmq: yep | 04:16 |
| dolphm | samueldmq: didn't realize you were using vagrant | 04:16 |
| samueldmq | dolphm, I dont want to | 04:16 |
| dolphm | samueldmq: you don't have to! | 04:16 |
| samueldmq | dolphm, that's why you were telling me about 'can you "ssh root@$VM_IP" for example ?' | 04:17 |
| dolphm | samueldmq: i've only tested with Ubuntu 12.04 recently though | 04:17 |
| samueldmq | dolphm, where do I set my vm_ip/credentials? | 04:17 |
| dolphm | samueldmq: yes, i'm running both my ansible host and keystone on vms in rackspace public cloud | 04:17 |
| dolphm | samueldmq: that's all through the ansible-playbook command | 04:17 |
| samueldmq | ansible-playbook --connection=local --inventory-file='localhost,' --sudo deploy.yaml | 04:18 |
| dolphm | samueldmq: for vagrant, i think it would just be -i "192.168.111.222," --user=vagrant --sudo | 04:18 |
| dolphm | samueldmq: don't use --connection=local! | 04:18 |
| dolphm | that will run the playbook against your laptop or whatever | 04:18 |
| samueldmq | yes, I replace it with my vm's ip | 04:18 |
| samueldmq | lol | 04:19 |
| dolphm | you don't need to specify a --connection | 04:19 |
| samueldmq | my poor laptop, I guess I would disconnect lol | 04:19 |
| dolphm | ansible uses ssh by default | 04:19 |
| samueldmq | k then .. so 'ansible-playbook --inventory-file='MY_VM_IP,' --user=myuser --sudo deploy.yaml' | 04:20 |
| samueldmq | --password? | 04:20 |
| dolphm | samueldmq: that's up to you. i use ssh keys, so i don't specify anything | 04:20 |
| samueldmq | yes, was about to ask that ... | 04:20 |
| dolphm | samueldmq: --ask-pass will prompt for ssh password | 04:21 |
| samueldmq | user ubuntu then ... since I'll be using ubuntu-14-cloudimg | 04:21 |
| dolphm | (i hope 14.04 works!) | 04:21 |
| samueldmq | dolphm, k, just need to get a vm on our cloud and run it :) | 04:21 |
| samueldmq | dolphm, would recommend 12 ? or should I try 14? | 04:21 |
| dolphm | samueldmq: i only recommend 12 because that's what travis uses (no choice), so that's what i've tested with | 04:22 |
| samueldmq | dolphm, k | 04:22 |
| dolphm | ooh, $ cp sample_inventory inventory | 04:22 |
| dolphm | and edit that with your server's IP | 04:22 |
| dolphm | and then use "-i inventory" instead of -i / --inventory-file | 04:23 |
| samueldmq | dolphm, nice | 04:24 |
| samueldmq | dolphm, update the server's ip and the user, right? (on inventory) | 04:25 |
| dolphm | samueldmq: yes | 04:25 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: URL quote Fernet tokens https://review.openstack.org/165279 | 04:26 |
| dolphm | i *think* that's a complete fix for fernet ^ | 04:27 |
| *** tqtran has quit IRC | 04:27 | |
| samueldmq | dolphm, running the tasks ... | 04:27 |
| samueldmq | :) | 04:27 |
| dolphm | samueldmq: yay! | 04:27 |
| samueldmq | dolphm, ansible looks to be amazing :) I need to play with it | 04:28 |
| dolphm | samueldmq: have you ever used python's Fabric? | 04:29 |
| samueldmq | dolphm, no :/ | 04:29 |
| dolphm | samueldmq: don't bother now :P | 04:29 |
| dolphm | samueldmq: it long predates ansible, but it's in the same spirit. simple ssh-based remote config management | 04:30 |
| samueldmq | dolphm, yep :p | 04:30 |
| samueldmq | dolphm, http://cdn.pasteraw.com/6rbznq783nhyypcetk943e1w04vjo0p | 04:30 |
| samueldmq | dolphm, got an error | 04:30 |
| lbragstad | dolphm: so, | 04:30 |
| stevemar | dolphm, how much of a PITA is it to deploy keystone under https? | 04:31 |
| lbragstad | I figured out a way to convert methods to an integer and back to a list of method dynamically based on the config | 04:31 |
| stevemar | and do the ports change? i am assuming they don't | 04:31 |
| dolphm | samueldmq: weird. login and $ ssh-keyscan -H raw.github.com > ~/.ssh/known_hosts | 04:31 |
| dolphm | stevemar: using apache or eventlet? | 04:32 |
| stevemar | dolphm, apache | 04:32 |
| *** ncoghlan has joined #openstack-keystone | 04:32 | |
| samueldmq | dolphm, done ... retrying now | 04:32 |
| dolphm | stevemar: pretty straight forward if you have certs ready to go http://httpd.apache.org/docs/2.2/ssl/ssl_howto.html | 04:32 |
| dolphm | lbragstad: review! | 04:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use existing token test for Fernet tokens. https://review.openstack.org/164348 | 04:33 |
| samueldmq | dolphm, same issue :/ | 04:33 |
| lbragstad | dolphm: ^ | 04:33 |
| dolphm | lbragstad: just tested fernet-tokens and all six tests pass with https://review.openstack.org/165279 | 04:33 |
| lbragstad | dolphm: nice | 04:33 |
| lbragstad | dolphm: check out that method -> int, int -> method list fix :) | 04:34 |
| dolphm | samueldmq: OH, SSL certs... | 04:34 |
| dolphm | samueldmq: uhh that's super weird, would your vm be behind a firewall or something? | 04:35 |
| dolphm | samueldmq: anything that's intercepting requests? | 04:35 |
| dolphm | samueldmq: can you $ curl https://github.com/ | 04:35 |
| dolphm | or $ curl https://raw.github.com/ | 04:35 |
| samueldmq | dolphm, from my vm? yes I can | 04:35 |
| stevemar | dolphm, that's about as straight forward as a nascar track | 04:36 |
| dolphm | samueldmq: yeah, hmm | 04:36 |
| dolphm | stevemar: ? | 04:36 |
| dolphm | stevemar: oh lol | 04:36 |
| *** ajayaa has joined #openstack-keystone | 04:37 | |
| *** rushiagr_away is now known as rushiagr | 04:37 | |
| stevemar | dolphm, i'm guessing just any old cert won't work? | 04:37 |
| stevemar | requires a Global ID server certificate, signed by a special CA certificate from Verisign | 04:38 |
| dolphm | lbragstad: https://docs.python.org/2/library/functions.html#enumerate | 04:38 |
| dolphm | lbragstad: oh nvm | 04:39 |
| dolphm | lbragstad: well, don't you need to pow(method_index, 2) ? | 04:39 |
| lbragstad | dolphm: yeah, that would work | 04:40 |
| dolphm | lbragstad: your way works! | 04:41 |
| dolphm | i was misreading it | 04:41 |
| * lbragstad cracks moar beers! | 04:43 | |
| lbragstad | dolphm: so that *should* work with whatever is put into config | 04:43 |
| lbragstad | cc bknudson ^ | 04:43 |
| samueldmq | dolphm, I could set 'validate_certs=no' to skip that ... but I dont know exactly where I set this option | 04:45 |
| dolphm | lbragstad: i had to stop at specs on the way home | 04:45 |
| dolphm | samueldmq: based on the error (and i really don't understand why you're getting that error) you'd actually do validate_certs=no in the role you installed from ansible-galaxy | 04:46 |
| dolphm | samueldmq: you should be able to find the failing task in playbooks/roles/something.pip/tasks | 04:47 |
| dolphm | something = author's name | 04:47 |
| *** ajayaa has quit IRC | 04:47 | |
| *** boris-42 has joined #openstack-keystone | 04:47 | |
| samueldmq | bobbyrenwick.pip | 04:47 |
| dolphm | yes | 04:47 |
| dolphm | samueldmq: i assume the validate_certs it's referring to is from get_url http://docs.ansible.com/get_url_module.html | 04:48 |
| lbragstad | dolphm: ++ | 04:48 |
| dolphm | lbragstad: are the methods alphabetical, or order of appearance in keystone.conf? | 04:51 |
| *** dims has joined #openstack-keystone | 04:52 | |
| morganfainberg | hm. | 04:52 |
| lbragstad | dolphm: not sure, checking | 04:53 |
| samueldmq | dolphm, passed that task .. but still running others | 04:54 |
| samueldmq | :-) | 04:54 |
| dolphm | morganfainberg: samueldmq is getting setup to verify, but https://review.openstack.org/#/c/165279/ seems to resolve both issues i was seeing with fernet | 04:54 |
| morganfainberg | nice | 04:54 |
| morganfainberg | and how broken are PKI tokens if at all? | 04:55 |
| dolphm | morganfainberg: i get the same behavior with PKI -- 401's instead of 200s' | 04:56 |
| dolphm | PKI(Z) | 04:56 |
| *** dims has quit IRC | 04:57 | |
| morganfainberg | dolphm, ack | 04:57 |
| morganfainberg | yay for "urlsafe" being only sortof urlsafe | 04:58 |
| *** stevemar has quit IRC | 04:58 | |
| *** stevemar has joined #openstack-keystone | 04:59 | |
| *** ChanServ sets mode: +v stevemar | 04:59 | |
| morganfainberg | dolphm, i'd like to see a test for this as well that goes into the basic token test the whole string != quoted string [if possible] | 04:59 |
| morganfainberg | esp. so we can show pki(z) broken in a similar fashion | 05:00 |
| openstackgerrit | Ian Wienand proposed openstack/keystone: Use default value for sha512_crypt rounds https://review.openstack.org/165295 | 05:01 |
| samueldmq | dolphm, ubuntu@10.3.2.174 : ok=29 changed=22 unreachable=0 failed=0 | 05:01 |
| samueldmq | dolphm, :) | 05:01 |
| dolphm | morganfainberg: the only logging i get for PKI/Z is from keystonemiddleware: eystonemiddleware.auth_token:Authorization failed for token | 05:02 |
| dolphm | samueldmq: sweet! | 05:02 |
| dolphm | samueldmq: so now you've got keystone installed via python setup.py install | 05:02 |
| dolphm | samueldmq: and keystonemiddleware and python-keystoneclient installed via pip | 05:02 |
| morganfainberg | dolphm, yeah. i commented on your review re: tests, but i'm not too worried about this atm. it's clearly been semi-b0rken for a bit and we can make sure we fix it right for pki(z) as well | 05:03 |
| morganfainberg | fernet wont work w/o this. | 05:03 |
| dolphm | samueldmq: so, you can go into /opt/keystone and make changes, and run python setup.py install && service apache2 restart for your changes to take effect | 05:03 |
| samueldmq | dolphm, hmm.. so I need to go in pip dist-packages to update any code in keystonemiddleware | 05:03 |
| dolphm | samueldmq: if you want - but https://review.openstack.org/#/c/165279/ is just a fix to keystone itself | 05:03 |
| samueldmq | dolphm, ah sure ... the keystonemiddleware one was an old fix ... sorry | 05:04 |
| dolphm | morganfainberg: ++ just wanted to get the fix up for tonight | 05:04 |
| dolphm | samueldmq: you can HTTPS + cherry pick that review into /opt/keystone | 05:04 |
| * dolphm is going to sleep | 05:08 | |
| samueldmq | dolphm, ack | 05:08 |
| lbragstad | yeah, I'm out... | 05:08 |
| dolphm | lbragstad: o/ | 05:08 |
| lbragstad | dolphm: I'll +2 your change in the morning if it's not approved by then, | 05:09 |
| morganfainberg | dolphm, so "cities: skylines" - everything sim city should have been. | 05:11 |
| morganfainberg | dolphm, so good. | 05:11 |
| *** stevemar has quit IRC | 05:11 | |
| *** stevemar has joined #openstack-keystone | 05:12 | |
| *** ChanServ sets mode: +v stevemar | 05:12 | |
| samueldmq | dolphm, tests take a long time to run here ... | 05:13 |
| openstackgerrit | Ian Wienand proposed openstack/keystone: Use default value for sha512_crypt rounds https://review.openstack.org/165295 | 05:14 |
| *** jorge_munoz1 has left #openstack-keystone | 05:17 | |
| *** markvoelker has quit IRC | 05:33 | |
| *** rushiagr is now known as rushiagr_away | 05:36 | |
| *** nellysmitt has joined #openstack-keystone | 05:44 | |
| *** nellysmitt has quit IRC | 05:49 | |
| *** __afazekas is now known as afazekas | 05:52 | |
| *** afazekas is now known as __afazekas | 05:53 | |
| *** ajayaa has joined #openstack-keystone | 06:01 | |
| *** rushiagr_away is now known as rushiagr | 06:03 | |
| *** henrynash has joined #openstack-keystone | 06:24 | |
| *** ChanServ sets mode: +v henrynash | 06:24 | |
| *** nellysmitt has joined #openstack-keystone | 06:32 | |
| *** markvoelker has joined #openstack-keystone | 06:33 | |
| *** henrynash has quit IRC | 06:34 | |
| *** ishant has joined #openstack-keystone | 06:35 | |
| *** henrynash has joined #openstack-keystone | 06:36 | |
| *** ChanServ sets mode: +v henrynash | 06:36 | |
| *** markvoelker has quit IRC | 06:38 | |
| samueldmq | henrynash, ping - you around? | 06:45 |
| henrynash | samueldmq: hi | 06:46 |
| samueldmq | samueldmq, I need help to run keystone-manage :) | 06:46 |
| samueldmq | ops, henrynash ^ | 06:46 |
| henrynash | ok :-) | 06:46 |
| samueldmq | keystone-manage pki_setup is basically what I want | 06:46 |
| samueldmq | but it ask me to provide --keystone-user and --keystone-group | 06:46 |
| henrynash | ok ( never tried that option)…but let’s comtinue! | 06:47 |
| samueldmq | I provided a valid user name and a valid group name | 06:47 |
| *** afazekas has joined #openstack-keystone | 06:47 | |
| samueldmq | and I get errors | 06:47 |
| samueldmq | Unknown user 'administrator' in --keystone-user | 06:47 |
| samueldmq | (it's just a setup for tests) | 06:48 |
| henrynash | samueldmq: so it will check that that user is avalid linux user…. | 06:49 |
| henrynash | I assume itis? | 06:49 |
| *** _cjones_ has joined #openstack-keystone | 06:49 | |
| samueldmq | henrynash, ah.. a user in the system .... | 06:49 |
| samueldmq | henrynash, not in keystone | 06:49 |
| henrynash | yep | 06:49 |
| henrynash | since it’s going to run oppenssl on your system | 06:50 |
| samueldmq | henrynash, it worked, thanks! | 06:51 |
| henrynash | np | 06:51 |
| samueldmq | henrynash, I think I need to sleep :p | 06:52 |
| *** _cjones_ has quit IRC | 06:54 | |
| henrynash | :-) | 06:54 |
| *** browne has quit IRC | 06:55 | |
| *** mestery has quit IRC | 06:58 | |
| stevemar | who needs sleep | 07:01 |
| stevemar | it's over-rated | 07:01 |
| samueldmq | stevemar, sorry :/ | 07:03 |
| stevemar | samueldmq, for what? | 07:03 |
| samueldmq | stevemar, I said I needed to sleep :p | 07:03 |
| stevemar | i suppose it's important | 07:04 |
| samueldmq | yes, after getting things working :) | 07:04 |
| *** Trozz has joined #openstack-keystone | 07:05 | |
| samueldmq | stevemar, when my setup uses pki ... I ran keystone-manage pki_setup on server side | 07:06 |
| samueldmq | stevemar, what do I need to do in the client side (who has keystoneclient)? | 07:07 |
| samueldmq | henrynash, ^ | 07:07 |
| stevemar | samueldmq, why would you have to do anything different? | 07:08 |
| stevemar | just authenticate the usual way | 07:08 |
| samueldmq | stevemar, keystonemiddleware is on the clientside, right? | 07:09 |
| henrynash | don’t you need to tell the middleware where the certs are etc.? | 07:09 |
| lifeless | no | 07:09 |
| samueldmq | stevemar, doesn't it need to know the certificates? | 07:09 |
| stevemar | middleware is for interacting between services | 07:09 |
| lifeless | the middleware usually refers to wsgi layers that run in other non-keystone OpenStack API servers | 07:09 |
| henrynash | lifelss: not in this case….samueldmq means keystoneclient middleware | 07:10 |
| stevemar | henrynash now you're combining the two | 07:10 |
| henrynash | oh. maybe I’m misunderstanding samueldmq’s question, then | 07:11 |
| samueldmq | I think lifeless is right .. | 07:11 |
| samueldmq | but in this case, how keystoniddleware knows the certificates? | 07:11 |
| samueldmq | I think I am missing something ... | 07:11 |
| stevemar | samueldmq, through config options: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L276-L277 | 07:13 |
| samueldmq | stevemar, yes, I think that's it ... :) will try thanks | 07:14 |
| samueldmq | lifeless, thanks | 07:14 |
| henrynash | stevemar: but are u saying that the keystonemiddleware is not client side? | 07:15 |
| henrynash | (agree it is via conf otpions to set up…) | 07:15 |
| stevemar | henrynash, it's not exactly an end-user tool, it's for inter-service chatter | 07:15 |
| *** hogepodge has quit IRC | 07:16 | |
| henrynash | stevemar: oh, ok, sure…yes it’s definitely not an end-user tool….just checking that we had not changed it’s intended use when we split it out into it’s own repo | 07:16 |
| stevemar | henrynash, all the examples in the middleware docs are adding it to nova and suc | 07:16 |
| stevemar | yeah, i guess i was being picky about the term client side | 07:17 |
| henrynash | stevemar: ok, yes, I was not precise in my statement - mean non-keystone-server-side | 07:17 |
| samueldmq | stevemar, where keystonemiddleware configs live? | 07:17 |
| *** markvoelker has joined #openstack-keystone | 07:17 | |
| stevemar | samueldmq, http://docs.openstack.org/developer/keystonemiddleware/middlewarearchitecture.html#configuration | 07:18 |
| stevemar | samueldmq, so in a paste pipeline for nova or some service, you add a new keystone_authtoken section, and add it to the pipeline | 07:19 |
| samueldmq | stevemar, k makes sense | 07:19 |
| *** aix has quit IRC | 07:20 | |
| *** nellysmi_ has joined #openstack-keystone | 07:21 | |
| *** markvoelker has quit IRC | 07:21 | |
| *** nellysmitt has quit IRC | 07:22 | |
| *** nellysmi_ has quit IRC | 07:26 | |
| *** nellysmitt has joined #openstack-keystone | 07:28 | |
| *** lhcheng is now known as lhcheng_afk | 07:36 | |
| *** samueldmq has quit IRC | 07:40 | |
| *** stevemar has quit IRC | 07:50 | |
| *** ishant has quit IRC | 07:50 | |
| *** ishant has joined #openstack-keystone | 07:51 | |
| *** Bsony has joined #openstack-keystone | 07:58 | |
| *** rushiagr is now known as rushiagr_away | 08:05 | |
| *** rushiagr_away is now known as rushiagr | 08:11 | |
| *** markvoelker has joined #openstack-keystone | 08:18 | |
| *** jistr has joined #openstack-keystone | 08:22 | |
| *** markvoelker has quit IRC | 08:23 | |
| *** lsmola has joined #openstack-keystone | 08:25 | |
| *** Trozz is now known as zzTrozz | 08:28 | |
| *** zzTrozz is now known as Trozz | 08:28 | |
| *** uschreiber_ has joined #openstack-keystone | 08:32 | |
| *** uschreiber_ has quit IRC | 08:33 | |
| *** lhcheng_afk has quit IRC | 08:36 | |
| *** uschreiber_ has joined #openstack-keystone | 08:38 | |
| *** uschreiber_ has quit IRC | 08:39 | |
| *** uschreiber_ has joined #openstack-keystone | 08:41 | |
| *** uschreiber_ has quit IRC | 08:42 | |
| *** uschreiber_ has joined #openstack-keystone | 08:42 | |
| *** uschreiber_ has quit IRC | 08:42 | |
| *** erkules_ is now known as erkules | 09:07 | |
| *** erkules has joined #openstack-keystone | 09:07 | |
| *** boris-42 has quit IRC | 09:12 | |
| *** markvoelker has joined #openstack-keystone | 09:19 | |
| *** hogepodge has joined #openstack-keystone | 09:22 | |
| *** markvoelker has quit IRC | 09:23 | |
| *** ncoghlan has quit IRC | 09:28 | |
| *** afazekas_ has joined #openstack-keystone | 09:31 | |
| *** lhcheng_afk has joined #openstack-keystone | 09:37 | |
| *** lhcheng_afk has quit IRC | 09:41 | |
| *** dims_ has joined #openstack-keystone | 09:43 | |
| *** afazekas_ has quit IRC | 09:45 | |
| *** davechen has left #openstack-keystone | 09:51 | |
| *** nellysmitt has quit IRC | 10:13 | |
| *** markvoelker has joined #openstack-keystone | 10:19 | |
| *** samueldmq has joined #openstack-keystone | 10:22 | |
| samueldmq | morninig | 10:22 |
| marekd | samueldmq: hey | 10:22 |
| *** markvoelker has quit IRC | 10:24 | |
| samueldmq | marekd, hello! o/ | 10:24 |
| samueldmq | henrynash, morning - nice job on the 'supporting status in JSON Home' :) | 10:25 |
| henrynash | samuedmq: thx | 10:26 |
| * samueldmq feels he needs to try JSON Home by himself, as he was one of the services querying keystone's resources | 10:26 | |
| *** mestery has joined #openstack-keystone | 10:26 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Remove SELinux section from httpd config https://review.openstack.org/164515 | 10:32 |
| *** nellysmitt has joined #openstack-keystone | 10:35 | |
| *** nellysmitt has quit IRC | 10:37 | |
| *** lhcheng_afk has joined #openstack-keystone | 10:38 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 10:39 |
| *** fmarco76 has joined #openstack-keystone | 10:42 | |
| *** lhcheng_afk has quit IRC | 10:43 | |
| samueldmq | dolphm, lbragstad ping - I need a hand to set up Fernet tokens on dolph's keystone-deploy | 10:43 |
| *** boris-42 has joined #openstack-keystone | 10:51 | |
| *** henrynash has quit IRC | 10:51 | |
| *** Bsony_ has joined #openstack-keystone | 10:54 | |
| *** amakarov_away is now known as amakarov | 10:54 | |
| *** nellysmitt has joined #openstack-keystone | 10:55 | |
| *** ajayaa has quit IRC | 10:56 | |
| *** Bsony has quit IRC | 10:57 | |
| *** rushiagr is now known as rushiagr_away | 11:01 | |
| *** nellysmitt has quit IRC | 11:08 | |
| *** fmarco76 has quit IRC | 11:09 | |
| *** tqtran has joined #openstack-keystone | 11:18 | |
| *** markvoelker has joined #openstack-keystone | 11:20 | |
| *** krykowski has joined #openstack-keystone | 11:23 | |
| *** tqtran has quit IRC | 11:23 | |
| *** markvoelker has quit IRC | 11:25 | |
| *** nellysmitt has joined #openstack-keystone | 11:33 | |
| *** ParsectiX has joined #openstack-keystone | 11:35 | |
| *** nellysmitt has quit IRC | 11:43 | |
| *** ajayaa has joined #openstack-keystone | 11:48 | |
| *** rushiagr_away is now known as rushiagr | 11:51 | |
| samueldmq | dolphm I set up Fernet tokens, but your patch does not solve all the issues here ... | 11:57 |
| *** david-lyle_afk is now known as david-lyle | 12:00 | |
| *** markvoelker has joined #openstack-keystone | 12:02 | |
| *** mattfarina has joined #openstack-keystone | 12:05 | |
| *** mattfarina has quit IRC | 12:08 | |
| *** mattfarina has joined #openstack-keystone | 12:09 | |
| *** mattfarina has quit IRC | 12:11 | |
| *** tqtran has joined #openstack-keystone | 12:11 | |
| *** mattfarina has joined #openstack-keystone | 12:12 | |
| *** dims_ has quit IRC | 12:22 | |
| *** dims_ has joined #openstack-keystone | 12:22 | |
| *** henrynash has joined #openstack-keystone | 12:25 | |
| *** ChanServ sets mode: +v henrynash | 12:25 | |
| *** raildo_away is now known as raildo | 12:28 | |
| openstackgerrit | Merged openstack/keystone: Remove RestfulTestCase.admin_request https://review.openstack.org/164516 | 12:29 |
| *** jaosorior has joined #openstack-keystone | 12:38 | |
| *** jistr is now known as jistr|biab | 12:39 | |
| *** henrynash has quit IRC | 12:41 | |
| *** topol has joined #openstack-keystone | 12:46 | |
| *** ChanServ sets mode: +v topol | 12:46 | |
| *** henrynash has joined #openstack-keystone | 12:46 | |
| *** ChanServ sets mode: +v henrynash | 12:46 | |
| *** rushiagr is now known as rushiagr_away | 12:49 | |
| *** henrynash has quit IRC | 12:56 | |
| *** gordc has joined #openstack-keystone | 12:59 | |
| *** boris-42 has quit IRC | 13:02 | |
| *** gordc has quit IRC | 13:02 | |
| *** Ephur has joined #openstack-keystone | 13:03 | |
| *** gordc has joined #openstack-keystone | 13:04 | |
| *** mattfarina has quit IRC | 13:05 | |
| *** bknudson has quit IRC | 13:06 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Distinguish between unset and empty black and white lists https://review.openstack.org/164798 | 13:12 |
| *** mattfarina has joined #openstack-keystone | 13:14 | |
| *** diegows has joined #openstack-keystone | 13:14 | |
| *** tqtran has quit IRC | 13:18 | |
| *** rushiagr_away is now known as rushiagr | 13:20 | |
| openstackgerrit | Merged openstack/keystone: Wrap apache-httpd.rst https://review.openstack.org/164505 | 13:24 |
| openstackgerrit | Merged openstack/keystone: Remove SSL configuration instructions from HTTPd docs https://review.openstack.org/164507 | 13:24 |
| *** richm1 has joined #openstack-keystone | 13:24 | |
| *** richm1 is now known as richm | 13:25 | |
| *** diegows has quit IRC | 13:25 | |
| *** bknudson has joined #openstack-keystone | 13:27 | |
| *** ChanServ sets mode: +v bknudson | 13:27 | |
| *** zzzeek has joined #openstack-keystone | 13:34 | |
| *** jistr|biab is now known as jistr | 13:39 | |
| *** boris-42 has joined #openstack-keystone | 13:41 | |
| *** krykowski has quit IRC | 13:43 | |
| *** csoukup has joined #openstack-keystone | 13:48 | |
| *** ishant has quit IRC | 13:48 | |
| *** fifieldt has quit IRC | 13:51 | |
| *** zzzeek has quit IRC | 13:52 | |
| *** iamjarvo has joined #openstack-keystone | 13:55 | |
| *** samueldmq is now known as samueldmq-away | 13:55 | |
| dolphm | samueldmq-away: git checkout fernet-tokens and run ansible again | 14:02 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:08 | |
| *** samueldmq has joined #openstack-keystone | 14:11 | |
| *** angular_mike has joined #openstack-keystone | 14:13 | |
| *** nellysmitt has joined #openstack-keystone | 14:15 | |
| *** lhcheng_afk has joined #openstack-keystone | 14:16 | |
| *** iamjarvo has quit IRC | 14:18 | |
| *** iamjarvo has joined #openstack-keystone | 14:19 | |
| *** lhcheng_afk has quit IRC | 14:20 | |
| *** timcline has joined #openstack-keystone | 14:24 | |
| *** mestery has quit IRC | 14:27 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: URL quote Fernet tokens https://review.openstack.org/165279 | 14:36 |
| openstackgerrit | Merged openstack/pycadf: update README.rst to include additional links https://review.openstack.org/165232 | 14:38 |
| openstackgerrit | Merged openstack/pycadf: update README.rst to include additional links https://review.openstack.org/165232 | 14:38 |
| dims_ | howdy folks - i see curl statements from keystoneclient.session in a whole bunch of server side logs - example http://paste.openstack.org/show/193133/ | 14:49 |
| morganfainberg | dims_, saw the question in -nova was about to answer there | 14:49 |
| dims_ | all sorts of goodies (tokens!) :) | 14:49 |
| morganfainberg | {SHA1}<thing> is a scrubbed token | 14:49 |
| morganfainberg | it's a sha1 of a token, you can't actually use it. | 14:50 |
| morganfainberg | we went through... a bunch of discussions on the best way to represent that | 14:50 |
| dims_ | whew ok | 14:50 |
| morganfainberg | yeah | 14:50 |
| morganfainberg | we had the options of --Token-Redacted-- | 14:50 |
| morganfainberg | etc | 14:50 |
| morganfainberg | etc | 14:50 |
| *** browne has joined #openstack-keystone | 14:50 | |
| dims_ | guess the other side of the question was, is it worth logging curl statements server-side | 14:50 |
| morganfainberg | but we needed a clear way to correlate the request to token use | 14:51 |
| morganfainberg | e.g. token x was used for requests x, y, z | 14:51 |
| *** tsufiev_ has left #openstack-keystone | 14:51 | |
| dims_ | k gotcha | 14:51 |
| morganfainberg | dims_, I'd say yes it is worth logging, as that is what is occuring. n-cpu is calling cinderclient: http://logs.openstack.org/74/163974/7/check/check-tempest-dsvm-full/b3b48d2/logs/screen-n-cpu.txt.gz#_2015-03-17_17_10_24_571 | 14:52 |
| morganfainberg | i'd prefer to drop the "CURL" notation though tbh | 14:52 |
| morganfainberg | that is more of a legacy debug hold-over | 14:52 |
| dims_ | fair enough :) | 14:52 |
| dims_ | +1 | 14:52 |
| morganfainberg | dims_, the nice thing is if you don't want to see it, you just need to exclude keystoneclient.session from logging at debug :) | 14:53 |
| morganfainberg | and it applies the same anywhere session is used | 14:53 |
| morganfainberg | rather than needing to guess what <insert client> chose to do. | 14:53 |
| morganfainberg | dims_, come to our meeting next week and ask / remind me about dropping curl notation? | 14:54 |
| *** stevemar has joined #openstack-keystone | 14:54 | |
| *** ChanServ sets mode: +v stevemar | 14:54 | |
| morganfainberg | dims_, https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting feel free to add yourself to our agenda too. | 14:54 |
| morganfainberg | dims_, alternative: mailing list. | 14:54 |
| morganfainberg | dims_, /me is about to hop on a plane in a few hours so.... | 14:55 |
| dims_ | morganfainberg: will drop in, adding my nick to attendee list | 14:55 |
| morganfainberg | dims_, awesome. thanks. | 14:55 |
| dims_ | safe travels morganfainberg! | 14:55 |
| morganfainberg | dims_, ty! | 14:55 |
| *** Bsony has joined #openstack-keystone | 14:55 | |
| *** Bsony_ has quit IRC | 14:57 | |
| morganfainberg | stevemar, going to circle back up once i'm at the airport/on a plane... | 14:57 |
| *** vhoward has joined #openstack-keystone | 14:58 | |
| morganfainberg | stevemar, but... going to ask ya to review https://review.openstack.org/#/c/159229/ and the test followup early today. | 14:58 |
| morganfainberg | stevemar, we need to press go today if it's landing | 14:58 |
| *** pnavarro has joined #openstack-keystone | 14:59 | |
| stevemar | morganfainberg, on it | 14:59 |
| morganfainberg | stevemar, tyvm | 14:59 |
| marekd | stevemar: what are you talking about (link?) | 14:59 |
| stevemar | marekd, ? | 15:00 |
| marekd | stevemar: you and morganfainberg :-) | 15:00 |
| marekd | if i may ask ofc | 15:00 |
| morganfainberg | marekd, https://review.openstack.org/#/c/159229/ | 15:00 |
| stevemar | marekd, just to review https://review.openstack.org/#/c/159229/ | 15:00 |
| morganfainberg | marekd, fernet | 15:00 |
| marekd | aaaaa, yeah, sorry, i think i going blind | 15:00 |
| marekd | sorry | 15:00 |
| morganfainberg | marekd, or ... more coffee needed :P | 15:01 |
| marekd | already had 450ml today ;/ | 15:01 |
| marekd | which makes two big cups of strong coffee. | 15:01 |
| morganfainberg | marekd, clearly a sign you must need more (to be fair, I always want more...) | 15:02 |
| marekd | heh | 15:02 |
| *** ParsectiX has quit IRC | 15:10 | |
| *** Trozz has quit IRC | 15:10 | |
| stevemar | marekd, why are the sp tests not being cleaned up here: https://review.openstack.org/#/c/164605/ | 15:10 |
| *** Trozz has joined #openstack-keystone | 15:11 | |
| *** pnavarro has quit IRC | 15:13 | |
| *** pcaruana has joined #openstack-keystone | 15:19 | |
| *** pnavarro has joined #openstack-keystone | 15:24 | |
| *** browne has quit IRC | 15:30 | |
| *** nellysmitt has quit IRC | 15:32 | |
| *** _cjones_ has joined #openstack-keystone | 15:36 | |
| rodrigods | stevemar, ping... re: https://review.openstack.org/#/c/165079/ | 15:39 |
| *** pnavarro has quit IRC | 15:39 | |
| *** henrynash has joined #openstack-keystone | 15:40 | |
| *** ChanServ sets mode: +v henrynash | 15:40 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Clean arguments in test_federation.*.test_create() https://review.openstack.org/164605 | 15:40 |
| rodrigods | stevemar, do you think this change isn't necessary even with the possibility of having blank values? | 15:40 |
| rodrigods | henrynash, ping... did you our reseller FFE email? I think would be nice if you could respond it saying that you are going to sponsor its :) | 15:41 |
| henrynash | rodigods: sure, will do | 15:41 |
| rodrigods | henrynash, thanks! | 15:41 |
| *** ajayaa has quit IRC | 15:41 | |
| *** packet has joined #openstack-keystone | 15:41 | |
| stevemar | rodrigods, yes, when would the user be able to put in blank values now? | 15:42 |
| lbragstad | dolphm: jorge_munoz bknudson it looks like the v2 token doesn't include the methods in the token response. V2 Unscoped: http://cdn.pasteraw.com/hgve20t5vutrkn71w7s2kqm60n2tmpk V2 Scoped: http://cdn.pasteraw.com/qe0u4988jrgdk8epbuw95g2f8ucon4o | 15:42 |
| stevemar | rodrigods, i agree that the sp migration is necessary (lost the link for that one) | 15:42 |
| bknudson | lbragstad: the methods are removed in v3 to v2 conversion? | 15:43 |
| lbragstad | bknudson: they can't | 15:43 |
| lbragstad | bknudson: a v2 Fernet token would need to have those in order to validate it | 15:43 |
| lbragstad | bknudson: oh, wait... misread your question. Yes they are removed | 15:43 |
| bknudson | lbragstad: can't what? | 15:43 |
| rodrigods | stevemar, its a previous patch in the chain | 15:44 |
| rodrigods | stevemar, nope, the user would not be able to create with blank values | 15:44 |
| lbragstad | bknudson: the 'methods' aren't included in the token_ref when we get it in the provider | 15:44 |
| rodrigods | stevemar, we should consider that no one is using it between releases? | 15:44 |
| rodrigods | stevemar, if so, that change isn't necessary | 15:45 |
| bknudson | lbragstad: the methods get added here: https://review.openstack.org/#/c/159229/39/keystone/token/providers/fernet/core.py | 15:45 |
| bknudson | and then it must just get removed again. | 15:45 |
| lbragstad | bknudson: we need the methods to pass to the token formatters | 15:45 |
| bknudson | what if you validate a v2 token using v3? | 15:46 |
| lbragstad | bknudson: that's why we need the methods in the v2 token | 15:46 |
| bknudson | do you get methods back? | 15:46 |
| lbragstad | bknudson: yes | 15:46 |
| bknudson | so keystone lies? | 15:46 |
| lbragstad | bknudson: it doesn't look like keystone cares about methods with v2 but it does for v3 | 15:46 |
| bknudson | right, so what happens if I get a v2 token, and then validate it using v3? | 15:47 |
| bknudson | does the validation response have methods? | 15:47 |
| openstackgerrit | henry-nash proposed openstack/keystone: Move backend LDAP role testing to the new backend testing module https://review.openstack.org/156830 | 15:48 |
| lbragstad | bknudson: yes, they are unpacked from the v2 token and populated on the way out of the v3 token validate response. | 15:48 |
| bknudson | why is https://review.openstack.org/#/c/159229/39/keystone/token/providers/fernet/core.py doing "method_names.append('token')" when the methods don't matter? | 15:48 |
| lbragstad | bknudson: let me grab a trace | 15:48 |
| bknudson | lbragstad: you just said the v2 token doesn't have methods. | 15:49 |
| lbragstad | bknudson: when you validate a v2 token using v2 validate, methods aren't included in the response | 15:49 |
| bknudson | lbragstad: what if you validate a v2 token using v3? | 15:49 |
| lbragstad | bknudson: doing that now to get a trace | 15:50 |
| dolphm | bknudson: v2 token *validation responses* don't have methods - it's not part of the v2 api | 15:52 |
| *** mestery has joined #openstack-keystone | 15:52 | |
| bknudson | dolphm: what is v3 token *validation response* supposed to have if it's given a v2 token? | 15:53 |
| lbragstad | bknudson: here is a token response from V2 http://cdn.pasteraw.com/32ghfqjvvyhn4juytatpfanht2eo1y5 | 15:53 |
| dolphm | bknudson: open question? i think we should be able to support methods in the v3 response ("password" and "token" are appilcable to v2) | 15:54 |
| bknudson | dolphm: but keystone doesn't know what method was used? | 15:54 |
| dolphm | bknudson: as long as the v2 controllers indicate to the token provider what auth method was used, it can be encoded in the token | 15:54 |
| dolphm | bknudson: this would be new behavior for fernet though, i suspect a v2 token auth'd on v3 wouldn't have any auth methods? | 15:54 |
| lbragstad | bknudson: here is a response from V3 when validating said token above: http://paste.openstack.org/show/193157/ | 15:54 |
| dolphm | any *other* v2 token | 15:54 |
| lbragstad | dolphm: I just recreated that scenario | 15:55 |
| bknudson | I don't think this is new for fernet... uuid tokens have methods. | 15:55 |
| dolphm | lbragstad: and it's getting password, cool | 15:55 |
| bknudson | ohh, wait, if you got a uuid token from keystone it could have stored the methods anyways. | 15:55 |
| dolphm | lbragstad: try rescoping that token with v2, and validating the rescoped token on v3 | 15:55 |
| dolphm | bknudson: in v3 | 15:55 |
| dolphm | bknudson: right | 15:55 |
| * dolphm (does anything even care about auth methods?) | 15:56 | |
| bknudson | I don't know if anyone cares about auth methods. | 15:57 |
| stevemar | rodrigods, we code for users upgrading between releases, not users who pick up kilo1 and want to switch to kilo3 | 15:57 |
| bknudson | maybe gyee? | 15:57 |
| stevemar | rodrigods, since SPs weren't in Juno, the only way we supports SPs is if you migrate to the latest federation db migration, which would force not-nullable urls | 15:58 |
| *** thedodd has joined #openstack-keystone | 15:59 | |
| *** Akshik has joined #openstack-keystone | 16:02 | |
| *** samueldmq has quit IRC | 16:02 | |
| rodrigods | stevemar, ok, so I'll abandon that change | 16:03 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix nullable constraints in service provider table https://review.openstack.org/164189 | 16:04 |
| *** ayoung has joined #openstack-keystone | 16:04 | |
| *** ChanServ sets mode: +v ayoung | 16:04 | |
| rodrigods | stevemar, ^ | 16:04 |
| lbragstad | dolphm: bknudson here is an unscoped token from v2 http://cdn.pasteraw.com/c20zzfr5v41uoe46353k4vn06f9jv4s | 16:05 |
| lbragstad | dolphm: bknudson here is the same token, rescoped using v2 http://paste.openstack.org/show/193158/ | 16:05 |
| bknudson | lbragstad: what if you validate that token using v3? | 16:05 |
| stevemar | rodrigods, ty | 16:05 |
| lbragstad | dolphm: bknudson and then validated with v3 http://paste.openstack.org/show/193159/ | 16:05 |
| bknudson | "methods": [ "token", "password" ], | 16:06 |
| lbragstad | bknudson: dolphm boom | 16:06 |
| bknudson | I assume you didn't actually use both token and password? | 16:06 |
| bknudson | so keystone lied. | 16:06 |
| lbragstad | bknudson: that's because it was rescoped | 16:06 |
| bknudson | oh, right. | 16:06 |
| bknudson | so it's correct. | 16:06 |
| marekd | stevemar: i could defend myself that saying that it was not mentioned in the commit message, but the truth is I forgot about it. | 16:10 |
| Akshik | need help in fixing shibboleth+keystone+testshib looping issue | 16:10 |
| Akshik | my shibboleth2.xml is http://chunk.io/f/d58c54aae5d34170b8b8d5b471e9613b | 16:10 |
| Akshik | http://chunk.io/f/eed2697b6aec46b5a7ed116a50773326 is my shibd.log | 16:10 |
| lbragstad | bknudson: yep | 16:10 |
| Akshik | and my apache config http://chunk.io/f/1503d8d820ee4b3d8d9ff98fd10890d2 http://chunk.io/f/043e37fa840a4ef79ec09582e65d0aea | 16:10 |
| Akshik | kindly guide me | 16:10 |
| marekd | Akshik: so, let's decompose your problem into smaller steps | 16:11 |
| marekd | Akshik: setup a federation without any Keystone/OpenStack involved | 16:11 |
| *** browne has joined #openstack-keystone | 16:12 | |
| marekd | Akshik: 2015-03-18 13:53:22 DEBUG XMLTooling.CredentialCriteria [1]: key algorithm didn't match ('AES' != 'RSA') | 16:12 |
| stevemar | marekd, it's okay | 16:12 |
| Akshik | marekd, yes i think the issue is with apache+sso, i dont see any request to keystone | 16:13 |
| stevemar | marekd, can you answer my q about the remote_ids work? | 16:13 |
| *** Bsony has quit IRC | 16:13 | |
| marekd | stevemar: marco just did | 16:13 |
| marekd | i don't know if you had a chance to read it. | 16:13 |
| stevemar | \o/ | 16:13 |
| stevemar | i did not | 16:13 |
| *** iamjarvo has quit IRC | 16:13 | |
| dolphm | lbragstad: awesome! | 16:13 |
| dolphm | lbragstad: is that with fernet? | 16:14 |
| lbragstad | dolphm: yeah | 16:14 |
| dolphm | woo | 16:14 |
| lbragstad | dolphm: using the new dynamically build format map | 16:14 |
| lbragstad | :) | 16:14 |
| marekd | is testshib generating shibboleth2.xml file with where adfs.so is loaded? | 16:14 |
| dolphm | i should have guessed fernet from 56.000000Z | 16:14 |
| marekd | Akshik: ^^ | 16:14 |
| dolphm | lbragstad: response looks perfect to me | 16:15 |
| lbragstad | dolphm: I'll have to tip my hat to jorge_munoz for the v3 -> v2 token response conversion | 16:15 |
| dolphm | jorge_munoz: \o/ | 16:15 |
| marekd | Akshik: ?? | 16:17 |
| Akshik | marekd,im not sure about that | 16:19 |
| stevemar | marekd, one request for remote_ids, a simple one! | 16:19 |
| marekd | stevemar: let me look at the patch. | 16:19 |
| Akshik | marekd, is it required, | 16:20 |
| marekd | Akshik: no. | 16:20 |
| marekd | Akshik: did you use shibboleth2.xml file generated by testshib? | 16:20 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 16:20 |
| * marekd World/IRC doesn't seem so lonely anymore when U.S is awake | 16:21 | |
| Akshik | marekd, no i used the one thats present and have customised like the one mentioned in the openstack docs | 16:22 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 16:23 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add inline comment and docstrings fixes for Fernet https://review.openstack.org/165489 | 16:23 |
| lbragstad | bknudson: address your last few comments in a follow on patch ^ | 16:23 |
| marekd | Akshik: so, i suggest for the first time using what testshib generates for you, and customizing that one. | 16:23 |
| Akshik | marekd, the one generated by testshib will not have override, if thats not there im not sure on how do we call that from the browser | 16:25 |
| marekd | Akshik: sorry, i didn't understand. | 16:25 |
| marekd | Akshik: the default one is for browsers | 16:26 |
| Akshik | 115.112.68.53:5000/v3/OS-FEDERATION/identity_providers/testshib/protocols/saml2/auth is how i call it from browser | 16:26 |
| marekd | Akshik: yes. | 16:26 |
| Akshik | where testshib is the applicationoverride id | 16:26 |
| Akshik | marekd, let me try the default shibbloth2.xml from testshib and update the result | 16:27 |
| marekd | Akshik: good idea, i think most of us tried it and essentually it worked. | 16:27 |
| marekd | then we can carry on with more advanced configuration. | 16:28 |
| Akshik | marekd, sure let me do that first | 16:28 |
| *** ajayaa has joined #openstack-keystone | 16:32 | |
| dolphm | lbragstad: jorge_munoz: so you should actually be able to validate v3 tokens on v2, to an extent | 16:32 |
| lbragstad | dolphm: are we going to support that? | 16:33 |
| dolphm | lbragstad: jorge_munoz: as long as the user involved is in the default domain, the project involved is in the default domain, and it's not a domain scoped token | 16:33 |
| dolphm | if any of those checks should fail, you have to raise 401 because a v2 client wouldn't be able to safely handle the response, because it wouldn't understand naming conflicts that might occur as the result of higher levels of scope | 16:34 |
| dolphm | lbragstad: that's literally the only purpose of the default domain :) to provide a single boundary in v3 that v2 can safely operate on | 16:35 |
| *** mattfarina has quit IRC | 16:36 | |
| *** zzzeek has joined #openstack-keystone | 16:38 | |
| *** mattfarina has joined #openstack-keystone | 16:38 | |
| ayoung | henrynash, what is the definition of a "sensitive substitution?" | 16:41 |
| *** Bsony has joined #openstack-keystone | 16:42 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:42 | |
| henrynash | ayoung: as per the spec, it’s when you want to include one of the sensitve options (e.g. password) in an option that is not, in and of itself, sensitive (e.g. url) | 16:42 |
| henrynash | ayoung: we never return the subsutituted result via REST, we just use it internally to pass to, say, the ldap driver | 16:43 |
| ayoung | henrynash, the reason I ask is we have a wider request to remove passwords from config files across the board...is this the start of that effort? | 16:43 |
| *** gyee has joined #openstack-keystone | 16:43 | |
| *** ChanServ sets mode: +v gyee | 16:43 | |
| ayoung | LIke, the whole Keystone conf has to be hidden because it has the mysql password in it | 16:43 |
| henrynash | ayoung: yes, it can be used to do that…the current admin password for ldap wou;n’t ahve to be in the config file | 16:44 |
| ayoung | henrynash, but we are still stuck on the mysql one, right? | 16:44 |
| henrynash | ayoung: right now, yes….well…thinking about it.... | 16:45 |
| ayoung | cool...btw, patch looks good | 16:45 |
| ayoung | henrynash, also, learn the chord changes to Layla. | 16:45 |
| ayoung | makes a great blues jam | 16:45 |
| henrynash | ayoung: right now we don’t allow the sql options to be supported…but we could….but of course it can’t be on a domain by domain basis (since we only can have one sql driver at the moment) | 16:45 |
| henrynash | ayoung: ok…:-) | 16:46 |
| ayoung | henrynash, keep it in mind...it would have to be something for oslo config eventully | 16:46 |
| henrynash | ayoung: yes, agreed | 16:46 |
| Akshik | marekd, Unable to map non-default applicationId to an ApplicationOverride, check configuration. | 16:47 |
| ayoung | henrynash, the origianl thought was that we needed to be able to encrypt values in files, but that leads to the question of where do we put the decryption key | 16:47 |
| Akshik | is the error i get while using the default xml provided by test shib | 16:47 |
| henrynash | ayoung: yeah, chicken and egg, within an egg, within an… | 16:48 |
| ayoung | Turtles | 16:48 |
| ayoung | Turtles all the way down | 16:48 |
| ayoung | henrynash, +2A | 16:49 |
| henrynash | ayoung: thx | 16:49 |
| henrynash | ayoung: yep, Feynman had it right (well, his heckler did) | 16:50 |
| ayoung | henrynash, I've held off on writing the spec until I had a good grasp on what it should look like | 16:51 |
| ayoung | henrynash, I know that you can do something where you need human interaction to start the service, and you can do some other hacky things where a key kept in an external directory | 16:55 |
| ayoung | seems like something should be from systemd: fetch ther key from secure store outside of /etc/httpd and pass it in at start up | 16:55 |
| henrynash | ayoung: it’s that balance…you want separte stores (or you’re not incresing security by moving the key)…but need to beware of least commonly secure link in teh chain | 16:57 |
| *** jproulx1 has joined #openstack-keystone | 16:58 | |
| morganfainberg | Mornin-ish | 16:58 |
| *** openstackgerrit has quit IRC | 16:59 | |
| *** openstackgerrit has joined #openstack-keystone | 16:59 | |
| jproulx1 | hate to ask here but no luck on mail list or ask.openstack | 17:01 |
| jproulx1 | trying to use v3 python binding per example at http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html#authenticating-using-sessions but getting 'EndpointNotFound | 17:01 |
| jproulx1 | anyone have a couple minutes to look at https://ask.openstack.org/en/question/63180/endpointnotfound-errors-with-keystone-v3-python-api/ and see what I'm screwing up? | 17:01 |
| ayoung | jproulx1, Endpoint Not Found ... | 17:01 |
| ayoung | jproulx1, two things come to mind | 17:02 |
| jproulx1 | (note v3 is working with openstack cli and horizon for me) | 17:02 |
| ayoung | one is that the authentication is messed up if you still have OS-SERVICE_ENDPOINT set | 17:02 |
| ayoung | it might be that you are accidentally doing admin topken | 17:02 |
| ayoung | token | 17:02 |
| ayoung | nah... | 17:02 |
| ayoung | reading now | 17:03 |
| jproulx1 | ayoung many thanks for looking | 17:03 |
| ayoung | jproulx1, what is your endpoint set to? | 17:03 |
| ayoung | jproulx1, the keystone endpoint, that is | 17:03 |
| *** iamjarvo has joined #openstack-keystone | 17:04 | |
| jproulx1 | in the catalog it's set to https://<host>:<port>/v2 | 17:04 |
| ayoung | jproulx1, "catalog endpoint is v2 " | 17:05 |
| *** iamjarvo has quit IRC | 17:05 | |
| ayoung | right...so the client is supposed to do discovery | 17:05 |
| *** _cjones_ has quit IRC | 17:05 | |
| ayoung | it should be able to deal with this | 17:05 |
| ayoung | jproulx1, can you modify the server, or is this a production machine? | 17:05 |
| *** iamjarvo has joined #openstack-keystone | 17:05 | |
| jproulx1 | I also created an identityv3 endpoint and tried setting endpoint_filter to find it but couldn't find the right place | 17:05 |
| jproulx1 | it's a production setup so I can't (well fear) just swithcing the identity endpoint :) | 17:06 |
| stevemar | jproulx1, is it https://<host>:<port>/v2 or https://<host>:<port>/v2.0 ? | 17:06 |
| jproulx1 | oh sorry v2.0 | 17:06 |
| stevemar | jproulx1, i saw your email on the ML but didn't have the time to reply back | 17:07 |
| stevemar | good call coming on irc | 17:07 |
| *** jistr has quit IRC | 17:08 | |
| ayoung | jproulx1, so, it looks like discovery is failing here. You know how to debug in python? YOu could potentially confirm that by putting a breakpoint in the client code | 17:08 |
| ayoung | jproulx1, I assume all client code etc is up to date? | 17:09 |
| ayoung | relatively speaking... | 17:09 |
| *** lhcheng_afk has joined #openstack-keystone | 17:09 | |
| ayoung | no Cactus or Essex era code here | 17:09 |
| jproulx1 | relative to juno release | 17:09 |
| ayoung | discovery should be good there | 17:10 |
| *** _cjones_ has joined #openstack-keystone | 17:10 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 17:10 | |
| stevemar | jproulx1, might be worth printing the contents of the client.Client() instance to see whats going on | 17:10 |
| jproulx1 | ayoung my python-fu is weak | 17:10 |
| *** topol has quit IRC | 17:11 | |
| ayoung | jproulx1, http://adam.younglogic.com/2015/02/debugging-openstack-with-rpdb/ | 17:11 |
| ayoung | although you could probably get away with just | 17:12 |
| jproulx1 | how do I dump that <keystoneclient.v3.client.Client object at 0x7f5ed4959690> isn't very helpful | 17:12 |
| ayoung | import pdb; pdb.set_trace() if you are running from the command line | 17:12 |
| jproulx1 | ayoung thanks for the link will read, & I am in command line. | 17:12 |
| ayoung | dir(object) shows the variabels | 17:12 |
| ayoung | yeah, ropdb is more for debuggin server | 17:13 |
| ayoung | it sets up a socket for telnet, but it is pdb under the covers | 17:13 |
| * ayoung can't type | 17:13 | |
| ayoung | I'd put the breakpoint right before keystone.users.list() | 17:13 |
| ayoung | and then step through...although you can probably get closer to the right point... | 17:14 |
| ayoung | its going to be at the endpoint lookup of the service catalog.... | 17:14 |
| ayoung | link in a sec | 17:14 |
| jproulx1 | http://pastebin.com/MFW9zGSL maybe my object is empty looks like keys no values? | 17:14 |
| *** samueldmq-away is now known as samueldmq | 17:15 | |
| ayoung | jproulx1, those are the variable names, so | 17:16 |
| samueldmq | dolphm, you around? I found something when running those tests from keystone-deploy | 17:16 |
| ayoung | keystone.service_catalog etc | 17:16 |
| dolphm | samueldmq: what's up | 17:16 |
| ayoung | jproulx1, I'm sure there is a better way to dujmp the object state without modifying the object | 17:16 |
| ayoung | just that is a sure thing...basic python | 17:17 |
| ayoung | jproulx1, the person who knows this code cold is jamielennox , but he is in Australia and won't bu until around 4pm Eastern | 17:17 |
| samueldmq | dolphm, i) I deployed the server with 'sudo python setup.py install && sudo service apache2 restart' | 17:17 |
| samueldmq | dolphm, ii) I ran only the test test_token_rescoping, it passes | 17:18 |
| dolphm | samueldmq: with which branch, btw? | 17:18 |
| jproulx1 | will dig around a bit with pointers given and come back around Aussie AM if I can't sort it out by then | 17:18 |
| samueldmq | dolphm, if I re-run it, it won't pass anymore ... I always get : | 17:18 |
| samueldmq | [Wed Mar 18 12:22:10 2015] [error] 2015-03-18 12:22:10.863 23791 WARNING keystone.common.wsgi [-] Could not find project: 06277831609f42d1ab4c3184d42ee474 | 17:18 |
| jproulx1 | Thanks all | 17:18 |
| samueldmq | dolphm, where this id is the id from the project created when I ran the first time | 17:19 |
| samueldmq | dolphm, I downloaded your code from review '165279' | 17:19 |
| dolphm | samueldmq: i mean which branch of keystone-deploy? | 17:19 |
| ayoung | jproulx1, it feels like it is a bug in discovery, as the clinet code should be smart enough to hack off the v2.0, but maybe it is just trying to get /v2.0/v3 | 17:20 |
| ayoung | I think there is some way to crank up logging, or you could look on the wire, and see what it is actually requesting | 17:20 |
| samueldmq | dolphm, I think I had master .. oh .. but I set up Fernet tokens by myself (running keystone manage) | 17:21 |
| ayoung | jproulx1, but..endpoint niot found looks like it is loking for a match in your service catalog, and the Keystone server is not defined. Are you using the endpoint filtering extension on the keystone server:? | 17:21 |
| ayoung | Are you sure you have an idenityt endpoint coming back? | 17:21 |
| ayoung | jproulx1, you can do something like this: http://docs.openstack.org/developer/keystone/api_curl_examples.html | 17:22 |
| ayoung | and, if the output is too hard to read... pipe it to pythom -mjson.tool | 17:22 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Cleanup Fernet testcases and add comments. https://review.openstack.org/165520 | 17:22 |
| ayoung | I think... | 17:22 |
| ayoung | I tend to use jq for json parsing | 17:22 |
| *** amakarov is now known as amakarov_away | 17:23 | |
| samueldmq | dolphm, yes, I am on master of keystone-deploy, and I ran keystone-manage by myself, in order to set up Fernet tokens | 17:24 |
| dolphm | samueldmq: the branches are almost the same, but "git diff master fernet-tokens" shows what you need to do to switch to deploy | 17:25 |
| dolphm | samueldmq: which test failed with project not found? | 17:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Cleanup Fernet testcases and add comments. https://review.openstack.org/165520 | 17:27 |
| jproulx1 | ayoung no endoint filtering on the server, if I pass an endpoint_filter to the session object 'sess' and do sess.get('/users', endpoint_filter=<stuff>) I cna get a user list | 17:27 |
| *** harlowja_away is now known as harlowja_ | 17:27 | |
| samueldmq | dolphm, in few words, what I am having is: I can't get an unscoped token after getting a project scoped token, because it says ProjectNotFound (for the project I got a scoped token before --and deleted after that--) | 17:27 |
| dolphm | samueldmq: lbragstad: also just added some v2 test coverage to keystone-deploy | 17:28 |
| ayoung | jproulx1, but you are explicitly asking for the v3 endpoint you added right? | 17:28 |
| jproulx1 | ayoung yes | 17:28 |
| ayoung | identityv3 | 17:28 |
| samueldmq | dolphm, ok then, please re-deploy your keystone server with 'sudo python setup.py install && sudo service apache2 restart' | 17:28 |
| samueldmq | dolphm, and run only test_token_rescoping | 17:28 |
| ayoung | jproulx1, let me test against my server... | 17:28 |
| *** lhcheng_afk is now known as lhcheng | 17:29 | |
| samueldmq | dolphm, and try to run it again after that | 17:29 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add inline comment and docstrings fixes for Fernet https://review.openstack.org/165489 | 17:29 |
| samueldmq | dolphm, maybe it's jsut my configuration (I hope) | 17:29 |
| dolphm | samueldmq: i replaced that test with some more granular rescoping scenarios | 17:29 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Cleanup Fernet testcases and add comments. https://review.openstack.org/165520 | 17:29 |
| lbragstad | dolphm: sweet | 17:29 |
| dolphm | samueldmq: lbragstad: i'm applying a few patches from gerrit to my deploy, and i'll test it all at once (v2, auth methods, my bug fixes) | 17:29 |
| ayoung | jproulx1, OK...I've got devstack running... | 17:30 |
| ayoung | lets see | 17:30 |
| lbragstad | dolphm: nice! | 17:30 |
| ayoung | jproulx1, wjhat is your auth_url? | 17:30 |
| ayoung | ends with /V2.0 as well? | 17:30 |
| jproulx1 | ends with /v3 | 17:31 |
| ayoung | jproulx1, ok, try this | 17:31 |
| ayoung | openstack --os-identity-api-version=3 user list | 17:32 |
| samueldmq | dolphm, nice.. I'll be able to try something later as well | 17:32 |
| jproulx1 | ayoung that works fine and has right along | 17:32 |
| ayoung | so it is just a problem with doing it programmatically? | 17:32 |
| * ayoung a little slow | 17:32 | |
| jproulx1 | yes, it seems very much me | 17:32 |
| ayoung | OK...let me try your code | 17:33 |
| dolphm | lbragstad: samueldmq: i'm getting several 401's instead of 200's | 17:33 |
| dolphm | samueldmq: no ProjectNotFounds though | 17:33 |
| lbragstad | dolphm: for v2? | 17:34 |
| dolphm | lbragstad: both v2 and v3 | 17:34 |
| dolphm | lbragstad: with my patch and the entire other sequence applied, starting with v2 support | 17:34 |
| ayoung | jproulx1, BTW, I have some env var code you might want to use | 17:34 |
| ayoung | https://review.openstack.org/#/c/82687/20/examples/scripts/initialize_keystone.py,cm | 17:34 |
| lbragstad | dolphm: check that its not blowing up on the token? | 17:35 |
| ayoung | ah, but you source a file... | 17:35 |
| dolphm | lbragstad: ++ i'm debugging | 17:35 |
| jproulx1 | ayoung, I have some I scraped off the internet to munge shell variable files to python but will check that too | 17:36 |
| ayoung | where is that 'source' call defined? | 17:36 |
| jproulx1 | lemme post the whole thing... | 17:36 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Improve feedback message in SSL error https://review.openstack.org/129769 | 17:36 |
| samueldmq | dolphm, k .. I got 401 on subsequent calls (the first one works) | 17:36 |
| samueldmq | dolphm, I see ProjectNotFound on keystone error log | 17:37 |
| dolphm | samueldmq: is the first one an unscoped token request? | 17:37 |
| dolphm | samueldmq: i see that too - i sent you a diff last night that i thought didn't do anything, but that might be the trick, let me find it | 17:37 |
| samueldmq | dolphm, that test had several calls inside it: the first one is unscoped, the others are scoped | 17:38 |
| samueldmq | dolphm, let me put a public ip on my machine, and then I will have you access, so that you can check quicker, ok? | 17:38 |
| *** rdo has joined #openstack-keystone | 17:38 | |
| jproulx1 | ayoung here's an actual paste of everything I'm running http://pastebin.com/Bc56SP2j | 17:38 |
| dolphm | samueldmq: will you try applying this to keystone-deploy? $ curl http://cdn.pasteraw.com/l9hqpyloyd34lirdapsoay0dskj89aj | git apply | 17:38 |
| samueldmq | dolphm, will do now | 17:39 |
| dolphm | samueldmq: it'll unfortunately leave your database with extra endpoints that are never cleaned up, but it also preserves the account that auth_token is using to validate tokens for the duration of the test run | 17:40 |
| ayoung | jproulx1, got a different error, but similar | 17:40 |
| ayoung | jproulx1, I wonder if we need that env var to be passed in as well | 17:41 |
| samueldmq | dolphm, well.. verified ! : ) | 17:42 |
| dolphm | samueldmq: it passed? | 17:42 |
| samueldmq | dolphm, it just works o/ | 17:42 |
| dolphm | samueldmq: awesome, so my test suite is broken :) | 17:42 |
| samueldmq | dolphm, yep .. I don't know exactly why ... but it is | 17:43 |
| dolphm | samueldmq: i'll pretty-up the patch you just applied and get it in | 17:43 |
| samueldmq | dolphm, ++ | 17:43 |
| jproulx1 | ayoung tried grepping around for a place to specify IDENTITY_API_VERSION in code but couldn't find it, guessed that the fact I was calling v3 directly meant I didn't need it | 17:43 |
| ayoung | jproulx1, it is parsed in the keystone client code | 17:43 |
| *** nellysmitt has joined #openstack-keystone | 17:44 | |
| ayoung | jproulx1, http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/shell.py#n145 | 17:45 |
| ayoung | somet hing like that...although that is deprecated code | 17:45 |
| jproulx1 | ayoung, so even in pythoncode I need the shell environment to have that? sounds icky | 17:47 |
| ayoung | no | 17:47 |
| ayoung | jproulx1, I'm seeing where it gets passed. | 17:47 |
| ayoung | I think it goes to the client constructor | 17:47 |
| *** tqtran has joined #openstack-keystone | 17:48 | |
| ayoung | jproulx1, ok ... I think we need version='v3' or something | 17:48 |
| jproulx1 | Hmm, just source the shell bits so the env was right for the cli & still same endpoint error with python code | 17:48 |
| jproulx1 | export OS_IDENTITY_API_VERSION=3 works with cli | 17:49 |
| ayoung | jproulx1, just like the other env vars, it needs to be explicitly passed on | 17:50 |
| ayoung | I'm seeing a different error, but try | 17:50 |
| ayoung | keystone = client.Client(version=os_auth[`OS_IDENTITY_API_VERSION`] , session=sess) | 17:51 |
| jproulx1 | Ah, ok I'd been trying to fit it in the session somehow (and failing) | 17:53 |
| jproulx1 | lemme try | 17:53 |
| ayoung | yeah...its not a session thing, because it is not common across all clients. You are trying explicitly to make a keystone call here | 17:53 |
| ayoung | it just wokred for me. | 17:54 |
| *** ayoung is now known as ayoung-afk | 18:02 | |
| jproulx1 | ayoung I'm still not getting it: | 18:02 |
| jproulx1 | keystone = client.Client(session=sess,version='3') | 18:02 |
| jproulx1 | still same error | 18:02 |
| *** ajayaa has quit IRC | 18:11 | |
| dolphm | samueldmq: just pushed new tests to all branches | 18:14 |
| dolphm | lbragstad: fernet, with all patches currently in review passes everything including v2 support and rescoping in all directions | 18:15 |
| dolphm | lbragstad: i'm only validating v2 tokens on v3 though - not doing anything in the other direction | 18:16 |
| * dolphm lunch | 18:18 | |
| lbragstad | dolphm: nice! | 18:23 |
| jproulx1 | ayoung-afk fwiw firing up my test cluster and switching identity enpoint to be explicitly /v3 does work, still no luck with various things passed as version=[3,'3','v3'] to client.Client ... | 18:29 |
| *** ayoung-afk is now known as ayoung | 18:30 | |
| *** afazekas has quit IRC | 18:31 | |
| ayoung | $ echo $OS_IDENTITY_API_VERSION | 18:31 |
| ayoung | v3 | 18:31 |
| ayoung | jproulx1, ^^ | 18:31 |
| ayoung | keystone = client.Client(version='v3', session=sess) | 18:32 |
| *** _cjones_ has quit IRC | 18:32 | |
| *** _cjones_ has joined #openstack-keystone | 18:32 | |
| ayoung | but it works for me even if I don't pass that | 18:32 |
| ayoung | jproulx1, in mysql, what do you get from this query | 18:35 |
| ayoung | select url from endpoint where service_id = (select id from service where type = 'identity'); | 18:35 |
| ayoung | jproulx1, try it with the latest version of the keystone client. Maybe what you have is old and missing the essential code | 18:38 |
| jproulx1 | +------------------------+ | 18:38 |
| jproulx1 | | url | | 18:38 |
| jproulx1 | +------------------------+ | 18:38 |
| jproulx1 | | http://host:5000/v2.0 | | 18:38 |
| jproulx1 | | http://host:5000/v2.0 | | 18:38 |
| jproulx1 | | http://host:35357/v2.0 | | 18:38 |
| jproulx1 | +------------------------+ | 18:38 |
| jproulx1 | on test cluster now I'll pull latest keystone there & see if it fixes... | 18:39 |
| samueldmq | dolphm, ack, will take a look later, thanks | 18:41 |
| samueldmq | :-) | 18:41 |
| *** rushiagr is now known as rushiagr_away | 18:46 | |
| *** jaosorior has quit IRC | 18:52 | |
| *** stevemar has quit IRC | 18:53 | |
| *** stevemar has joined #openstack-keystone | 18:53 | |
| *** ChanServ sets mode: +v stevemar | 18:53 | |
| *** diegows has joined #openstack-keystone | 19:09 | |
| *** cburgess has quit IRC | 19:10 | |
| *** cburgess has joined #openstack-keystone | 19:11 | |
| *** nellysmitt has quit IRC | 19:12 | |
| *** _cjones_ has quit IRC | 19:16 | |
| *** _cjones_ has joined #openstack-keystone | 19:16 | |
| dolphm | ayoung: is pki / pkiz being tested in the integrated gate anywhere? | 19:19 |
| jproulx1 | ayoung thanks for all your time, looks like crufty code, spun up a clean VM pip installed python-keystoneclient & it just works... | 19:19 |
| openstackgerrit | Merged openstack/python-keystoneclient: Clean arguments in test_federation.*.test_create() https://review.openstack.org/164605 | 19:19 |
| *** Akshik has quit IRC | 19:21 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update Apache httpd config docs for token persistence https://review.openstack.org/164508 | 19:33 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample httpd config file https://review.openstack.org/164510 | 19:33 |
| *** boris-42 has quit IRC | 19:37 | |
| ayoung | dolphm, it was the default. Now that it is not, I suspect it is not tested | 19:39 |
| ayoung | jproulx1, good to hear | 19:39 |
| *** krtaylor has quit IRC | 19:39 | |
| *** comstud has quit IRC | 19:39 | |
| *** cyeoh has quit IRC | 19:39 | |
| *** lbragstad has quit IRC | 19:39 | |
| *** lbragstad has joined #openstack-keystone | 19:40 | |
| *** cyeoh has joined #openstack-keystone | 19:41 | |
| *** comstud has joined #openstack-keystone | 19:41 | |
| *** krtaylor has joined #openstack-keystone | 19:41 | |
| *** gyee has quit IRC | 19:41 | |
| *** boris-42 has joined #openstack-keystone | 19:42 | |
| *** timcline has quit IRC | 19:44 | |
| *** chrisshattuck has joined #openstack-keystone | 19:44 | |
| *** diegows has quit IRC | 19:44 | |
| *** diegows has joined #openstack-keystone | 19:45 | |
| *** timcline has joined #openstack-keystone | 19:45 | |
| *** diegows_ has joined #openstack-keystone | 19:50 | |
| *** diegows has quit IRC | 19:53 | |
| lbragstad | morganfainberg: since k-3 is coming up, here is a list of all open bugs in keystone since November 6th of last year: http://keystone-weekly-bug-report.tempusfrangit.org/weekly-bug-reports/keystone-open-bugs-since-2014-11-6.html | 19:54 |
| *** chrisshattuck has quit IRC | 19:54 | |
| stevemar | lbragstad, change your nick name to capt.buzzkill | 19:54 |
| lbragstad | stevemar: :) | 19:55 |
| *** devlaps has joined #openstack-keystone | 19:55 | |
| *** zigo__ has joined #openstack-keystone | 19:56 | |
| *** zigo has quit IRC | 19:56 | |
| dolphm | stevemar: on the bright side, those are only the bugs that are still open | 19:57 |
| dstanek | lbragstad: that's quite a bit | 19:57 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:57 | |
| lbragstad | stevemar: gotta tag the bugs with milestones! | 19:58 |
| lbragstad | dstanek: yeah, | 19:58 |
| dstanek | lbragstad: feels like a good weekend project | 19:59 |
| lbragstad | dstanek: ++ | 19:59 |
| lbragstad | dstanek: just parsing the individual bugs, and trying to give a first pass at triaging | 19:59 |
| dstanek | training is over and now i feel trained | 20:00 |
| lbragstad | dstanek: I'm happy your officially trained in OpenStack :) | 20:00 |
| dstanek | lbragstad: did you go through the training? | 20:01 |
| bknudson | dstanek: what was the training? | 20:01 |
| lbragstad | dstanek: no, I'll have to check if I can, I would like to | 20:01 |
| bknudson | lbragstad: apparently you have to be there a couple years first. | 20:01 |
| dstanek | bknudson: it was an introduction to openstack - we basically setup and configured the services by hand | 20:01 |
| bknudson | dstanek: and filed lots of bugs... | 20:02 |
| bknudson | why is this so hard? | 20:02 |
| bknudson | dstanek: including neutron? | 20:02 |
| dstanek | bknudson: yes | 20:02 |
| bknudson | dstanek: cinder with different backends? | 20:03 |
| lbragstad | dstanek: did the class offer ibuprofen for that section? | 20:03 |
| bknudson | dstanek: TLS ? | 20:03 |
| morganfainberg | ayoung, i expect to solve the PKI(z) and Fernet testing next week | 20:03 |
| dstanek | bknudson: only a single backend and no TLS | 20:03 |
| bknudson | dstanek: keystone in apache? | 20:03 |
| ayoung | sounds good | 20:03 |
| morganfainberg | in gate jobs | 20:03 |
| morganfainberg | that is | 20:03 |
| morganfainberg | not just unit | 20:03 |
| openstackgerrit | Merged openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 20:09 |
| morganfainberg | lbragstad, dolphm, jorge_munoz, just pressed the go button on the last of the fernet patchsets | 20:11 |
| dolphm | morganfainberg: oh cool! | 20:11 |
| lbragstad | morganfainberg: ++ | 20:11 |
| morganfainberg | this does not address the urlsafe issue, the v2.0 and subequent test update(s) | 20:12 |
| dolphm | morganfainberg: ? | 20:12 |
| morganfainberg | looks like adam +2'd the urlsafe thing | 20:12 |
| morganfainberg | https://review.openstack.org/#/c/165279/5/keystone/token/providers/fernet/token_formatters.py | 20:13 |
| morganfainberg | that is gating ayoung +2A'd it | 20:13 |
| morganfainberg | i was commenting i hadn't circled up on that one yet | 20:13 |
| morganfainberg | turns out i don't need to | 20:13 |
| dolphm | morganfainberg: i'm happy to write more code if necessary :P | 20:13 |
| dolphm | i'd actually still like to do some more refactoring on the payloads... | 20:14 |
| morganfainberg | dolphm, cleanup on payloads and merging the test classes together should be just cleanup work that can happen post k3 | 20:14 |
| *** openstackgerrit has quit IRC | 20:14 | |
| *** openstackgerrit has joined #openstack-keystone | 20:15 | |
| dolphm | morganfainberg: i'll be AFK next week, and on/off the week after though, so now is my chance to get that stuff into review | 20:16 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 20:16 |
| stevemar | dolphm, does cody bunch lurk on irc? | 20:17 |
| dstanek | bknudson: yes, we were using Apache | 20:17 |
| dstanek | nice, according to the release-blocking reviews page that lots has been +Ad! | 20:19 |
| *** diegows_ has quit IRC | 20:19 | |
| dolphm | stevemar: i'd assume yes, but i do not know his handle | 20:19 |
| stevemar | darn | 20:20 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 20:22 | |
| morganfainberg | bknudson, https://pythonhosted.org/setuptools/setuptools.html#declaring-extras-optional-features-with-their-own-dependencies | 20:23 |
| bknudson | morganfainberg: is that something new? | 20:23 |
| bknudson | and, does it work with our requirements.txt ? | 20:23 |
| dstanek | bknudson: not new and it's an alternative to requirements.txt (at least for the optional ones) | 20:24 |
| dstanek | morganfainberg: can pip deal with that? | 20:24 |
| morganfainberg | bknudson, i don't think we populate it | 20:25 |
| morganfainberg | but its in setuptools. | 20:25 |
| morganfainberg | not sure when it was added | 20:25 |
| bknudson | how is it going to be checked against global-requirements, and updated automatically? | 20:26 |
| morganfainberg | bknudson, i'm digging into some other requirement related things, but i ran across that | 20:26 |
| morganfainberg | thought it was interesting | 20:26 |
| dstanek | bknudson: couldn't we do it the same way using a different script? | 20:26 |
| morganfainberg | dstanek, i don't think pip knows anything about it. | 20:26 |
| dstanek | morganfainberg: that's what i thought - maybe it would be a good patch :-) | 20:27 |
| morganfainberg | ++ | 20:28 |
| morganfainberg | interesting | 20:32 |
| morganfainberg | pbr has some things that could be made to tweak this into working i think. | 20:32 |
| bknudson | enough pbr makes everything look easy. | 20:33 |
| dstanek | ayoung: so do you have an opinion and what do do about the revoke-by-grant for federation tokens? | 20:34 |
| *** Bsony has quit IRC | 20:34 | |
| lbragstad | dolphm: morganfainberg https://etherpad.openstack.org/p/keystone-kilo-bug-list | 20:35 |
| morganfainberg | ehterpad is particularly painful to load on a plane :( | 20:36 |
| lbragstad | dolphm: morganfainberg I'll attempt to chip away at this | 20:36 |
| lbragstad | in my free cycles | 20:36 |
| dolphm | morganfainberg: you need my fork of etherpad then ;P | 20:37 |
| morganfainberg | dolphm, lol | 20:37 |
| *** Bsony has joined #openstack-keystone | 20:38 | |
| ayoung | dstanek, ignore it? | 20:43 |
| dstanek | ayoung: it doesn't actually cause a security issue right? | 20:43 |
| ayoung | dstanek, all federation tokens have the groups in them, so in theory we could build a revoke by group mechanism, but I don't have the time to do it right now | 20:43 |
| ayoung | and everyone else is deathly afraid of the revoke tree | 20:44 |
| ayoung | dstanek, do you think it is a security issue? It probably means that there is at least a surprising behavior in the Federation code base | 20:51 |
| ayoung | This is broken now, so nothing new, but yeah, a group that loses an assignment will not cause the user tokens to be invalidated. | 20:52 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 20:56 |
| henrynash | ayoung, lbragstad: fixed pep8 issues with https://review.openstack.org/160364 - if you’re OK to re-apply +2/A that would be great | 20:58 |
| henrynash | ayoung, lbragstad: no other chanegs | 20:58 |
| henrynash | lbragstad: thx | 20:59 |
| lbragstad | henrynash: yep! | 20:59 |
| ayoung | henrynash, done | 21:01 |
| henrynash | ayoung: thx | 21:02 |
| *** Bsony has quit IRC | 21:06 | |
| *** mattfarina has quit IRC | 21:07 | |
| *** samueldmq is now known as samueldmq-away | 21:09 | |
| lbragstad | henrynash: this is targeted for k-3 https://bugs.launchpad.net/keystone/+bug/1415268 | 21:13 |
| openstack | Launchpad bug 1415268 in Keystone "Testing of backend list_role_assignments needs to be improved" [Medium,In progress] - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 21:13 |
| lbragstad | henrynash: do the reviews associated with that need to be added to https://gist.github.com/dolph/651c6a1748f69637abd0 | 21:13 |
| lbragstad | cc morganfainberg ^ | 21:14 |
| *** edmondsw has joined #openstack-keystone | 21:14 | |
| *** iamjarvo has quit IRC | 21:16 | |
| edmondsw | dolphm... can't figure out your rejection of bug 1431015. There aren't separate policy actions associated with requests that include vs. lack the domain_id query param | 21:19 |
| openstack | bug 1431015 in Keystone "v3/users or groups calls not working without domain_id" [Undecided,Invalid] https://launchpad.net/bugs/1431015 - Assigned to lilly (lilly-spandanabarukula) | 21:19 |
| *** angular_mike is now known as new | 21:20 | |
| edmondsw | dolphm... can you explain? | 21:20 |
| dolphm | edmondsw: the call is intended to be used with a domain scope or fail, right? cc- henrynash | 21:21 |
| *** samueldmq has joined #openstack-keystone | 21:22 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Remove SELinux section from httpd config https://review.openstack.org/164515 | 21:22 |
| dolphm | edmondsw: also forgot an important word! https://bugs.launchpad.net/keystone/+bug/1431015/comments/5 | 21:22 |
| openstack | Launchpad bug 1431015 in Keystone "v3/users or groups calls not working without domain_id" [Undecided,Invalid] - Assigned to lilly (lilly-spandanabarukula) | 21:22 |
| stevemar | edmondsw, now i know your irc handle too | 21:24 |
| stevemar | edmondsw, i kept getting side tracked with other things, verifying ksm audit middleware now | 21:24 |
| edmondsw | dolphm, the user is presenting domain authorization here... | 21:24 |
| dolphm | lbragstad: morganfainberg: whoops, i've been removing bugs from the etherpad, per the original instructions, as i triage them | 21:24 |
| edmondsw | stevemar, tx | 21:25 |
| lbragstad | dolphm: no worries | 21:25 |
| dolphm | edmondsw: it's a project scoped token in the bug reoprt | 21:25 |
| lbragstad | dolphm: I'm marking as triaged just so my work can be double-checked | 21:25 |
| edmondsw | dolphm, the project is within a domain... | 21:25 |
| lbragstad | dolphm: I'm fine if you or morganfainberg validate and remove from the list | 21:26 |
| dolphm | edmondsw: right, just to provide namespacing to the project. you can also have a token which expresses domain-level authorization (there's no project involved) | 21:26 |
| lbragstad | morganfainberg: dolphm Ideally we should have a list of bugs we need to talk about by the end of the list, at which point I can tag with meeting or something. | 21:26 |
| edmondsw | dolphm... sure you can... but you shouldn't have to. And don't... the same auth token works if I make the same request but specify the domain_id query param | 21:27 |
| *** __TheDodd__ has joined #openstack-keystone | 21:27 | |
| dolphm | lbragstad: target all the ones that should be discussed / investigated to rc1 to be safe? | 21:27 |
| lbragstad | dolphm: ++ | 21:27 |
| lbragstad | dolphm: we can remove it later if needed | 21:27 |
| dolphm | lbragstad: worse case, they get untargetted without fixing them, but they're guaranteed not to get lost that way | 21:27 |
| edmondsw | dolphm, so the token is authorized to make the request for this domain... no vulnerability here, just a usability issue | 21:28 |
| *** thedodd has quit IRC | 21:28 | |
| dstanek | morganfainberg: what to do about https://review.openstack.org/#/c/141267 ? | 21:28 |
| dolphm | edmondsw: does it work with the alternative policy file? | 21:28 |
| edmondsw | dolphm, what do you mean? | 21:29 |
| lbragstad | the v3 specific policy file? | 21:29 |
| lbragstad | https://github.com/openstack/keystone/blob/25d742ada803d8501e7c004242a625efd07fcaf6/etc/policy.v3cloudsample.json | 21:29 |
| dolphm | lbragstad: they're both basically v3-specific | 21:29 |
| dolphm | lbragstad: that one you linked to just utilizes of the authorization flexibility afforded by v3 | 21:30 |
| dolphm | more of the* | 21:30 |
| lbragstad | ah, gotcha | 21:30 |
| dolphm | edmondsw: if there's really not a security concern, then the usability issue boils down to: both your project-scope and user account have domain scopes, so what should keystone do if those are both different domains? | 21:30 |
| stevemar | dolphm, you making my ecp bug a wishlist item! | 21:31 |
| dolphm | stevemar: the one to add a convenience API? | 21:31 |
| *** jamielennox is now known as jamielennox|away | 21:31 | |
| edmondsw | dolphm, is it possible to have a user in domain x accessing a project in domain y? Seems like that would be a vulnerability... | 21:32 |
| dolphm | edmondsw: yes, if they're granted explicit authorization to do so | 21:32 |
| edmondsw | dolphm, so what would be allowed today, if I specified the domain_id query parameter? Only work for the user's domain, only work for the porject's domain, or work for both, or only work if both are the same? | 21:35 |
| openstackgerrit | Merged openstack/python-keystoneclient: Allow passing logger object to request https://review.openstack.org/157647 | 21:35 |
| edmondsw | dolphm, I was assuming the projects domain would be the one that we'd use here... if the user is in a different domain, so be it, but their token is scoped to the project and thus to the domain in which that project resides | 21:36 |
| dolphm | edmondsw: "and thus to the domain" <-- that's not true at all | 21:37 |
| dolphm | edmondsw: the original use case, IIRC: a domain-scoped token requesting the list of users in a domain: the query paramater should match the token's domain scope, and policy.json can enforce that | 21:38 |
| edmondsw | dolphm, if you were saying that this token shouldn't be usable to query things at the domain level, I could understand that. | 21:38 |
| edmondsw | dolphm, but it is currently usable to do just that... all you have to do is specify the domain_id query param | 21:38 |
| edmondsw | dolphm, so if the user isn't validated for the domain, that's a security vulnerability | 21:38 |
| dolphm | edmondsw: correct, with the policy file linked above you'll see rules like, "identity:list_users": "rule:cloud_admin or rule:admin_and_matching_domain_id", | 21:38 |
| dolphm | edmondsw: that depends on your policy.json | 21:39 |
| edmondsw | dolphm, ok, let me study this policy.json | 21:39 |
| *** browne has quit IRC | 21:39 | |
| *** browne has joined #openstack-keystone | 21:40 | |
| *** henrynash has quit IRC | 21:41 | |
| *** henrynash has joined #openstack-keystone | 21:41 | |
| *** ChanServ sets mode: +v henrynash | 21:41 | |
| *** samueldmq has quit IRC | 21:41 | |
| edmondsw | dolphm, so let's say we have a rule that explicitly checks for the domain on the token like that... then that check should happen and fail if the token isn't domain scoped, I agree | 21:42 |
| *** devlaps has quit IRC | 21:43 | |
| edmondsw | dolphm, but can we not do the policy check and then add the domain_id afterward if that passed and the user didn't specify the domain? | 21:46 |
| edmondsw | dolphm, so if someone wants to setup their policy to require the domain in the token, they can do that... but for those that don't, the domain can be inferred | 21:47 |
| edmondsw | dolphm, I want to move from a single domain to having 1 domain for end-users and a separate domain for service users, so they can use different identity backends | 21:48 |
| edmondsw | dolphm, and I don't want users to have to deal with asking for tokens differently now | 21:48 |
| *** tqtran is now known as tqtran_afk | 21:48 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove parent_id in v2 tenant response https://review.openstack.org/164367 | 21:48 |
| bknudson | dolphm: henrynash: edmondsw: I think part of the issue is that when you enable multi-domains now you can't list all users with /v3/users anymore. | 21:49 |
| bknudson | /v3/users works without multi-domains, but as soon as it's enabled /v3/users breaks. | 21:49 |
| edmondsw | exactly, bknudson | 21:51 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:51 | |
| nkinder | edmondsw: for that to work, your user domain would have to be set as the "default_domain" | 21:54 |
| nkinder | edmondsw: which means services need to know how to auth using v3 (and specifying a domain) | 21:55 |
| nkinder | edmondsw: that's not 100% possible right now | 21:55 |
| edmondsw | nkinder, or we fix this bug... it's the fact that that's no possible right now which turned me this direction | 21:55 |
| nkinder | edmondsw: your users would then have to use v2 to get a token too | 21:55 |
| edmondsw | nkinder, that's not going to happen... users will be on v3 | 21:56 |
| edmondsw | already are, and I'm not sending them back to v2 | 21:56 |
| nkinder | edmondsw: are you referring to bug 1431015? | 21:56 |
| openstack | bug 1431015 in Keystone "v3/users or groups calls not working without domain_id" [Undecided,Invalid] https://launchpad.net/bugs/1431015 - Assigned to lilly (lilly-spandanabarukula) | 21:56 |
| edmondsw | nkinder, yes | 21:56 |
| nkinder | edmondsw: so yes - the behavior is annoying | 21:58 |
| nkinder | ...but, dolphm is right about the security implications | 21:58 |
| *** csoukup has quit IRC | 21:59 | |
| nkinder | To do a user list, we need to ensure that your user has the right role on the domain itself | 21:59 |
| nkinder | you cant do that without a domain scoped token unless Keystone internally looks it up | 21:59 |
| nkinder | for it to work, you would present a project-scoped (or unscoped) token, then Keystone would have to pull the domain out of it, fetch the roles you have on that domain, then attempt to perform the user list | 22:00 |
| edmondsw | nkinder, yes... why can't we do that? | 22:00 |
| nkinder | ...and, that effectively means you are taking a project scoped token and elevating it to be able to perform domain operations | 22:00 |
| edmondsw | nkinder, no it doesn't | 22:01 |
| nkinder | so someone intercepting your project scoped token can now escalate to perform domain-restricted operations | 22:01 |
| nkinder | edmondsw: how so? | 22:01 |
| edmondsw | nkinder, the token is already allowed to do this, as shown by just adding the domain_id query param... works fine | 22:01 |
| nkinder | no, it's not | 22:01 |
| nkinder | that domain_id is serving a different purpose | 22:01 |
| nkinder | it serves to disambiguate your user name | 22:02 |
| *** boris-42 has quit IRC | 22:02 | |
| nkinder | edmondsw: ah, well that depends on your policy.json | 22:02 |
| nkinder | what is the policy for your user list operation in the policy that you are using? | 22:02 |
| edmondsw | nkinder, ? the domain information for the user in the token should disambiguate the user name | 22:02 |
| edmondsw | role:admin or is_admin:1 | 22:03 |
| nkinder | ok, so you are using policy that isn't really using domains (like policy.v3cloudsample) | 22:04 |
| nkinder | so that policy is saying that anyone with the admin role on anything (any project) is the cloud admin | 22:04 |
| edmondsw | yes | 22:04 |
| nkinder | ...not really ideal | 22:04 |
| edmondsw | that depends | 22:04 |
| nkinder | but you are right that your user is allowed to perform the operation | 22:04 |
| nkinder | with a project scoped token where they are the admin of the project. | 22:05 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup tests don't keep engine https://review.openstack.org/164340 | 22:05 |
| nkinder | So the problem with that policy in a multi-domain environment is this... | 22:05 |
| nkinder | a project admin of a project in "domainA" can list users in "domainB" | 22:05 |
| nkinder | ...which is why the policy.v3cloudsample has admin_and_matching_domain_id | 22:06 |
| *** bknudson has quit IRC | 22:09 | |
| nkinder | edmondsw: so, I suppose it would be OK to pull the domain_id out of the "user" section of the token if the query param was not provided | 22:09 |
| nkinder | edmondsw: it would leave the decision up to policy | 22:09 |
| nkinder | edmondsw: if you were using policy.v3cloudsample, you would be denied unless you had a domain-scoped token | 22:09 |
| nkinder | edmondsw: for your case, "admin" of anything would be allowed to list users in any domain though | 22:09 |
| nkinder | ...but that is ultimately a policy decision | 22:10 |
| nkinder | dolphm: what do you think? ^^^ | 22:11 |
| nkinder | dolphm: it's not really circumventing policy | 22:11 |
| dolphm | (i stepped away, still catching up) | 22:11 |
| nkinder | k | 22:11 |
| *** jamielennox|away is now known as jamielennox | 22:12 | |
| *** Bsony has joined #openstack-keystone | 22:13 | |
| dolphm | edmondsw: apologies for stepping away | 22:13 |
| dolphm | nkinder: agree 99% with what you said above, except i'm not sure what you mean by "your users would then have to use v2 to get a token too" (users can create tokens on the default domain in v3 - it's just like any other domain there) | 22:14 |
| dolphm | nkinder: edmondsw: and i think if keystone is going to have a fallback behavior, the only sane one i can think of is if your user.domain_id == project.domain_id then assume that domain_id | 22:14 |
| nkinder | dolphm: I meant that if they don't want to specify their domain when requesting a token, then they need to use v2 | 22:14 |
| nkinder | dolphm: I mistakenly thought that was one of edmondsw's goals | 22:14 |
| henrynash | lbragstad: so on https://bugs.launchpad.net/keystone/+bug/1415268, we only need these if https://review.openstack.org/#/c/137202/32 is going to merge for Kilo | 22:15 |
| openstack | Launchpad bug 1415268 in Keystone "Testing of backend list_role_assignments needs to be improved" [Medium,In progress] - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 22:15 |
| dolphm | nkinder: oh, i think clients should assume that if you're authenticating with v3 and you don't specify a domain, then the client should just assume domain_id='default' for everything | 22:15 |
| *** stevemar has quit IRC | 22:15 | |
| dolphm | the assumption is that either all/most regular users are in the default domain, or it's just a single domain deployment, so it's a safe bet | 22:16 |
| nkinder | dolphm: ...except there is a problem with that | 22:16 |
| dolphm | and if it fails, then we just need decent error messages to say "hey, i couldn't find that project in this domain. maybe specify a different domain?" | 22:16 |
| nkinder | many people want service users in one domain, and "normal" users in another domain | 22:16 |
| dolphm | nkinder: right, the service users can be in the non-default domain | 22:16 |
| nkinder | if you want to allow v2 to still work for normal users, your normal user domain has to be the default | 22:16 |
| dolphm | agree | 22:17 |
| nkinder | yes, which means the services need to know how to use v3 properly (they don't) | 22:17 |
| nkinder | jamielennox has been working towards that, but some services don't use v3 well still AFAIK | 22:17 |
| dolphm | that's an easier problem to solve though than teaching a bunch of users about the authorization complexity we support | 22:17 |
| nkinder | totally | 22:17 |
| nkinder | it's just not 100% solved yet | 22:18 |
| *** Bsony has quit IRC | 22:18 | |
| dolphm | nkinder: would you happen to have a recent pulse on which services don't support v3, etc? cc- jamielennox | 22:18 |
| nkinder | jamielennox has it all written down somewhere (and has a bunch of patches out) | 22:18 |
| jamielennox | Dolph pretty much anything that talks to swift or glance | 22:19 |
| dolphm | nkinder: that's actually what i'm planning on spending most of tomorrow on... i'd like to be able to deploy devstack without identity v2 deployed at all :) | 22:19 |
| *** packet has quit IRC | 22:19 | |
| dolphm | jamielennox: do you actually have a doc up somewhere? | 22:19 |
| jamielennox | I have a trello board with some notes | 22:20 |
| jamielennox | I'm currently in fedora boot hell and typing this on my phone though | 22:20 |
| *** henrynash has quit IRC | 22:20 | |
| dolphm | jamielennox: is it shareable? | 22:21 |
| jamielennox | https://trello.com/b/5qivasNp/keystone-v3. | 22:21 |
| jamielennox | I'm not sure if it's public, if you can't see it I'll change some settings | 22:22 |
| dolphm | jamielennox: i can see it, thanks! | 22:24 |
| dolphm | jamielennox: nova<->neutron is a big win :) | 22:24 |
| jamielennox | dolphm: please add things you find aren't v3 aware | 22:25 |
| dolphm | jamielennox: will do | 22:25 |
| nkinder | dolphm: yeah, glad to hear you're going to be trying to get this working too! | 22:25 |
| nkinder | it will really help to make domains more usable | 22:25 |
| dolphm | jamielennox: i'll probably focus on nova/glance | 22:25 |
| nkinder | dolphm: I agree on your "user.domain_id == project.domain_id" statement above | 22:26 |
| dolphm | edmondsw: ^ | 22:26 |
| jamielennox | dolphm: I had been working on glanceclient to support session stuff, but it's very different to other clients and nobody is reviewing my stuff | 22:26 |
| nkinder | dolphm: in fact, I would find using the project_domain_id confusing as a fallback | 22:26 |
| nkinder | I would expect a user is trying to list other users in their own domain if they didn't specify a domain | 22:27 |
| dolphm | jamielennox: send me a list of reviews | 22:27 |
| nkinder | dolphm: I think they are in the trello cards | 22:27 |
| nkinder | oh, not the glanceclient ones | 22:28 |
| dolphm | nkinder: i was about to say, maybe i just can't see comments or something | 22:29 |
| nkinder | jamielennox: I didn't notice nova->neutron merged yesterday! | 22:29 |
| nkinder | dolphm: yeah, sorry about that | 22:29 |
| dolphm | no worries | 22:29 |
| jamielennox | I've only been trying trello for a week or so, so not everything is in there | 22:31 |
| *** diegows_ has joined #openstack-keystone | 22:33 | |
| *** amerine has quit IRC | 22:35 | |
| *** timcline has quit IRC | 22:36 | |
| *** tqtran_afk is now known as tqtran | 22:37 | |
| dolphm | jamielennox: i was going to look through your open reviews to look for relevant changes -- would there be relevant reviews anywhere else? other authors, etc | 22:44 |
| *** ccard__ has quit IRC | 22:46 | |
| *** ccard_ has joined #openstack-keystone | 22:47 | |
| jamielennox | Someone else has had a go at ironic, which is good cause it was a bit of a mess | 22:47 |
| *** gyee has joined #openstack-keystone | 22:48 | |
| *** ChanServ sets mode: +v gyee | 22:48 | |
| *** amerine has joined #openstack-keystone | 22:48 | |
| jamielennox | Probably the easiest thing to do is grep through projects looking for use of the keystone_authtoken admin_user. Anyone using that will be v2 only and needs to move off. | 22:49 |
| *** ccard_ has quit IRC | 22:52 | |
| *** ccard_ has joined #openstack-keystone | 22:54 | |
| *** gordc has quit IRC | 22:58 | |
| openstackgerrit | Merged openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 22:58 |
| dolphm | \o/ lbragstad morganfainberg | 22:59 |
| openstackgerrit | Merged openstack/keystone: Use existing token test for Fernet tokens. https://review.openstack.org/164348 | 22:59 |
| dolphm | jorge_munoz: thank you, sir! | 22:59 |
| openstackgerrit | Merged openstack/keystone: URL quote Fernet tokens https://review.openstack.org/165279 | 22:59 |
| *** zzzeek has quit IRC | 22:59 | |
| *** henrynash has joined #openstack-keystone | 23:09 | |
| *** ChanServ sets mode: +v henrynash | 23:09 | |
| *** dims__ has joined #openstack-keystone | 23:29 | |
| *** boris-42 has joined #openstack-keystone | 23:30 | |
| *** dims_ has quit IRC | 23:33 | |
| *** diegows_ has quit IRC | 23:36 | |
| openstackgerrit | Merged openstack/keystone: Log when no external auth plugin registered https://review.openstack.org/164439 | 23:43 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove parent_id in v2 token response https://review.openstack.org/156867 | 23:53 |
| *** new has quit IRC | 23:53 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove parent_id in v2 token response https://review.openstack.org/156867 | 23:55 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove parent_id in v2 tenant response https://review.openstack.org/164367 | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!