| *** zzzeek has quit IRC | 00:11 | |
| *** iamjarvo has joined #openstack-keystone | 00:16 | |
| *** iamjarvo has quit IRC | 00:24 | |
| *** bknudson has quit IRC | 00:31 | |
| *** david-lyle has quit IRC | 00:32 | |
| *** browne has quit IRC | 00:33 | |
| *** lhcheng_ is now known as lhcheng | 00:48 | |
| *** ChanServ sets mode: +v lhcheng | 00:48 | |
| *** edmondsw has quit IRC | 00:49 | |
| *** alexsyip has quit IRC | 00:56 | |
| *** lhcheng has quit IRC | 01:06 | |
| *** drjones has quit IRC | 01:07 | |
| *** lhcheng has joined #openstack-keystone | 01:08 | |
| *** ChanServ sets mode: +v lhcheng | 01:08 | |
| *** lhcheng has quit IRC | 01:13 | |
| *** david-lyle has joined #openstack-keystone | 01:20 | |
| *** markvoelker has quit IRC | 01:36 | |
| *** samueldmq has joined #openstack-keystone | 01:42 | |
| *** erkules_ has joined #openstack-keystone | 01:50 | |
| *** erkules has quit IRC | 01:50 | |
| *** dims_ is now known as dims | 01:52 | |
| *** darrenc is now known as darrenc_afk | 01:57 | |
| *** browne has joined #openstack-keystone | 02:00 | |
| *** harlowja is now known as harlowja_away | 02:03 | |
| openstackgerrit | Merged openstack/keystone: Allow wsgiref to reconstruct URIs per the WSGI spec https://review.openstack.org/177427 | 02:08 |
|---|---|---|
| *** darrenc_afk is now known as darrenc | 02:14 | |
| *** nkinder has joined #openstack-keystone | 02:22 | |
| *** david-lyle has quit IRC | 02:30 | |
| *** david-lyle has joined #openstack-keystone | 02:31 | |
| *** ayoung has joined #openstack-keystone | 02:36 | |
| *** ChanServ sets mode: +v ayoung | 02:36 | |
| *** david-lyle has quit IRC | 02:36 | |
| *** markvoelker has joined #openstack-keystone | 02:41 | |
| *** richm has quit IRC | 02:44 | |
| *** davechen has joined #openstack-keystone | 02:51 | |
| *** gyee has quit IRC | 02:53 | |
| *** wchrisj has joined #openstack-keystone | 03:25 | |
| *** david-lyle has joined #openstack-keystone | 03:32 | |
| openstackgerrit | Kun Huang proposed openstack/python-keystoneclient: Use "RegionOne" as default region https://review.openstack.org/173165 | 03:42 |
| *** rm_work is now known as rm_work|away | 04:00 | |
| *** lhcheng has joined #openstack-keystone | 04:05 | |
| *** ChanServ sets mode: +v lhcheng | 04:05 | |
| *** kiran-r has joined #openstack-keystone | 04:13 | |
| *** rm_work|away is now known as rm_work | 04:13 | |
| *** stevemar has joined #openstack-keystone | 04:19 | |
| *** ChanServ sets mode: +v stevemar | 04:19 | |
| *** rushiagr_away is now known as rushiagr | 04:21 | |
| *** kiran-r has quit IRC | 04:22 | |
| *** itlinux has quit IRC | 04:40 | |
| *** rushiagr is now known as rushiagr_away | 04:45 | |
| breton | wow, no one chatted since meeting | 05:08 |
| breton | good morning. | 05:08 |
| *** kiran-r has joined #openstack-keystone | 05:35 | |
| *** ajayaa has joined #openstack-keystone | 05:38 | |
| *** josecastroleon has joined #openstack-keystone | 05:40 | |
| *** mabrams has joined #openstack-keystone | 05:52 | |
| *** stevemar has quit IRC | 05:54 | |
| *** lhcheng has quit IRC | 06:03 | |
| *** henrynash has joined #openstack-keystone | 06:03 | |
| *** ChanServ sets mode: +v henrynash | 06:03 | |
| *** pcaruana has joined #openstack-keystone | 06:09 | |
| *** abhijeetm has joined #openstack-keystone | 06:12 | |
| *** abhijeetm has left #openstack-keystone | 06:12 | |
| *** bboese has quit IRC | 06:14 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor: Join multiple criteria together https://review.openstack.org/133135 | 06:16 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor: Join multiple criteria together https://review.openstack.org/133135 | 06:20 |
| *** bboese has joined #openstack-keystone | 06:20 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor: Join multiple criteria together https://review.openstack.org/133135 | 06:24 |
| *** pnavarro has joined #openstack-keystone | 06:32 | |
| *** browne has quit IRC | 07:09 | |
| *** dguerri is now known as _dguerri | 07:44 | |
| *** _dguerri is now known as dguerri | 07:52 | |
| *** jistr has joined #openstack-keystone | 07:58 | |
| *** jaosorior has joined #openstack-keystone | 07:59 | |
| *** davechen has left #openstack-keystone | 08:05 | |
| *** dims has quit IRC | 08:10 | |
| *** davidckennedy has joined #openstack-keystone | 08:20 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 09:03 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Service with no endpoints should not be in catalog https://review.openstack.org/176383 | 09:03 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Service with no endpoints should not be in catalog https://review.openstack.org/176383 | 09:04 |
| *** e0ne has joined #openstack-keystone | 09:06 | |
| *** e0ne is now known as e0ne_ | 09:06 | |
| *** fhubik has joined #openstack-keystone | 09:10 | |
| *** e0ne_ is now known as e0ne | 09:14 | |
| *** rlt_ has joined #openstack-keystone | 09:28 | |
| *** afazekas has quit IRC | 09:32 | |
| *** afazekas has joined #openstack-keystone | 09:32 | |
| *** josecastroleon has quit IRC | 09:33 | |
| *** fhubik is now known as fhubik_afk | 09:34 | |
| rlt_ | hello. If i deploy two openstack in kilo (two keystone) in multi-region with one common ldap. If i want that an user will could switch region without re-authentication. Is that the only solution is the keystone federation (K2K) ? | 09:35 |
| *** krykowski has joined #openstack-keystone | 09:35 | |
| marekd | rlt_: hi. K2K rather for two separate clouds. | 09:35 |
| *** fhubik_afk is now known as fhubik | 09:35 | |
| marekd | rlt_: i think you should be able to use your token for every region in your cloud. You may need to rescope it, but not likely re-auth | 09:36 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Deprecate auth.identity.v3.federated module https://review.openstack.org/177704 | 09:39 |
| rlt_ | marekd, Ok so it is possible to use a token provided by a keystone for another region that its own keystone? (without database shared) | 09:41 |
| marekd | rlt_: what is own keystone? | 09:42 |
| rlt_ | marekd : i rephrase : If a keystone A in Region A provided a token X. How this token X could be works in a Region B (with keystone B) ? | 09:45 |
| marekd | rlt_: they share db, right? | 09:46 |
| rlt_ | No without share db | 09:46 |
| marekd | rlt_: i haven't checked myself, but i'd say it should work as is. | 09:46 |
| rlt_ | marekd : No without share db | 09:46 |
| marekd | rlt_: ah, you said they shared db. ok, so you need re-auth. but keep in mind that regions were used in k2k solution, but they no longer do that. | 09:47 |
| rlt_ | marekd : Ok so if i want that user no need re-auth. I must implement the k2k solution. It's right ? | 09:49 |
| marekd | if you have completely separate clouds you will likely want to use federation, k2k in particular. | 09:49 |
| marekd | but also mind that rightnow (in kilo for instance) you will not configure regions for that. | 09:50 |
| marekd | rather objects called service providers. | 09:50 |
| marekd | https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#service-providers | 09:51 |
| *** dims has joined #openstack-keystone | 09:51 | |
| *** ajayaa has quit IRC | 09:57 | |
| rlt_ | marekd : Curently i have an openstack platform in an countrie in eastern europe. And i want create a second openstack platform in an new datacenter in France. I would like that user on the primary platform could be use the second platform in France without re-authentication. | 10:02 |
| *** e0ne is now known as e0ne_ | 10:03 | |
| rlt_ | marekd: So for me, it's a completely seperate clouds. no ? | 10:03 |
| *** e0ne_ is now known as e0ne | 10:05 | |
| rlt_ | marekd : And i need configure region for that. But maybe i'm wrong | 10:05 |
| *** mtreinish has quit IRC | 10:07 | |
| *** ajayaa has joined #openstack-keystone | 10:10 | |
| *** samueldmq has quit IRC | 10:11 | |
| ajayaa | marekd, Hi I see few new tables in Keystone which were recently added in Keystone. For e.g. consumer, access_token, request_token. Which spec do they correspond to? | 10:14 |
| ajayaa | Were they added in Kilo? | 10:14 |
| marekd | rlt_: So if you want to have multiple DCs as one cloud you can install openstack in France now, but replicate/use single keystone DB | 10:17 |
| marekd | and only add one region pointing to France | 10:18 |
| openstackgerrit | liusheng proposed openstack/python-keystoneclient: Use openstack common util method to find name-or-id resource https://review.openstack.org/178594 | 10:18 |
| marekd | then you will not need to re-auth once you change the region, however you will be obliged to specify in what region you want to spin a VM or sth. | 10:19 |
| marekd | rlt_: for the Keystone DB you can either point to one DB or replicate them somehow. | 10:19 |
| marekd | onceyou have it you may try different token types, like PKI, or Fernet that would allow you to skip those long RTTs | 10:20 |
| *** arif-ali has quit IRC | 10:20 | |
| marekd | Federation is rather for setups between the clouds under different jurisdition, say, my private cloud and some public cloud where i am bursting into. | 10:20 |
| marekd | ajayaa: which versions are you comparing/ | 10:21 |
| rlt_ | marekd : Yes but i can't use single or replication keystone DB about the response time between the two different datacenters | 10:22 |
| ajayaa | marekd, I am talking about master. | 10:22 |
| ajayaa | I am just trying to figure out which table came in which release. | 10:23 |
| marekd | rlt_: because of the RTT, right? | 10:23 |
| rlt_ | yes | 10:23 |
| marekd | ajayaa: i don't have all the impl details in my mind, if you really need to do so (may i ask why?) i suggest going through keystone code where corresponding models are added and looking for commits that added it. Commit messages should also have bp's that implement this. | 10:25 |
| marekd | rlt_: that's what we do at cern in fact.... | 10:26 |
| marekd | rlt_: but we have dedicated link between DCs | 10:26 |
| marekd | rlt_: anyway, your problem is probably replication of tokens/authentications - then you may wantto use some tokens like PKI/Fernet | 10:26 |
| marekd | where you don't necesarilly have to always ask Keystone on token validity | 10:27 |
| rlt_ | marekd : Ok so if i understood i need to use tokens like PKI/Fernet in environnment with replication or share keystone DB inevitably ? | 10:33 |
| marekd | rlt_: i think so. And you can also ask some operators how they deal with such problems. | 10:34 |
| *** samueldmq has joined #openstack-keystone | 10:36 | |
| samueldmq | morninig | 10:36 |
| marekd | hey | 10:36 |
| samueldmq | marekd, hey what's up :) | 10:36 |
| samueldmq | henrynash, hi you also around ? | 10:36 |
| marekd | samueldmq: not bad. | 10:36 |
| samueldmq | ) | 10:37 |
| samueldmq | marekd, btw, I have a question for you | 10:37 |
| marekd | fire away (as ayoung always says) | 10:37 |
| samueldmq | marekd, one of the bps in kilo-1 was https://blueprints.launchpad.net/keystone/+spec/openid-connect | 10:37 |
| marekd | yep | 10:38 |
| samueldmq | marekd, I need to put this in the release notes, how do you describe this ? | 10:38 |
| samueldmq | marekd, Keystone now supports OpenID protocol for the Federation extension ... | 10:38 |
| samueldmq | something like ? | 10:38 |
| marekd | samueldmq: yes. | 10:39 |
| marekd | samueldmq: in fact this was more a matter of configuration/testing rather some coding, but yes this work was needed either way, so we should announce that. | 10:39 |
| samueldmq | marekd, you have a link to a relevant doc ? | 10:40 |
| samueldmq | marekd, I am bugging you on this to make it faster :p | 10:40 |
| marekd | samueldmq: you can bug me on everything. | 10:40 |
| marekd | samueldmq: but what link are you expecting? | 10:40 |
| marekd | https://review.openstack.org/#/c/132706/ maybe this? | 10:41 |
| samueldmq | marekd, official doc ? | 10:41 |
| marekd | https://review.openstack.org/#/c/132706/6/doc/source/extensions/openidc.rst | 10:41 |
| samueldmq | marekd, in this case http://docs.openstack.org/developer/keystone/extensions/openidc.html | 10:42 |
| samueldmq | ; ) | 10:42 |
| rlt_ | marekd : But why K2K federation could not response to my problem ? Because i could considere that i have two cloud (two datacenter in differents countries). So with K2K a token provided by one keystone in one cloud could be used on the another cloud, no ? | 10:42 |
| marekd | samueldmq: whatever works for you :-) | 10:43 |
| ajayaa | marekd, I was looking for a shortcut. I think I will have to do it the hard way. Thanks anyway. | 10:43 |
| ajayaa | shortcut to know about these new tables and their roles. | 10:44 |
| marekd | rlt_: no. there is a rule "one token per cloud" | 10:44 |
| marekd | rlt_: so you'd need to re-auth, and treat it as a separate clouds | 10:44 |
| samueldmq | marekd, you look to be the single core always up early in the morning | 10:44 |
| marekd | samueldmq: henry is also here very often. | 10:44 |
| samueldmq | marekd, so you are the bugging entrypoint :p | 10:44 |
| marekd | samueldmq: i feel very lonely here | 10:45 |
| marekd | samueldmq: it's because i live in europe, so it's my lunch time now. | 10:45 |
| marekd | samueldmq: and TBH i don't like that most of the stuff missess me because its evening. | 10:45 |
| marekd | or middle of the night. | 10:45 |
| samueldmq | marekd, yes he is, but I think he must be doing some extraordinary coding :p | 10:45 |
| samueldmq | henrynash, ^ :p | 10:45 |
| samueldmq | marekd, ahah it's 7 46 am here | 10:46 |
| marekd | i know that. | 10:46 |
| marekd | usually ppl ping me when i ma just about to hibernate my comuter | 10:47 |
| rlt_ | marekd : ok thanks, i'll maybe annoy you with more questions this afternoon still :-) | 10:48 |
| marekd | rlt_: sure. | 10:48 |
| marekd | :-) | 10:48 |
| samueldmq | marekd, we support openid 2.0 ? http://openid.net/specs/openid-authentication-2_0.html | 10:49 |
| samueldmq | marekd, is it this one ? | 10:49 |
| samueldmq | marekd, found this link in the bp, just want to make sure | 10:49 |
| marekd | samueldmq: we support whateer apache module supports | 10:50 |
| marekd | samueldmq: i think you can leave 'OpenID' protocol | 10:50 |
| samueldmq | marekd, ++ | 10:50 |
| marekd | without detailed versions. | 10:50 |
| samueldmq | marekd, btw, it's here https://etherpad.openstack.org/p/keystone-kilo-release-notes | 10:50 |
| samueldmq | marekd, feel free to validate/add something if you want | 10:50 |
| marekd | samueldmq: ok, after the lunch :-) | 10:51 |
| marekd | bbl | 10:51 |
| samueldmq | marekd, bon apetit | 10:52 |
| *** amakarov_away is now known as amakarov | 11:01 | |
| *** krykowski has quit IRC | 11:03 | |
| *** krykowski_ has joined #openstack-keystone | 11:04 | |
| samueldmq | where do the docs at keystone-specs api/v3/ are published ? | 11:07 |
| *** dims has quit IRC | 11:18 | |
| *** fhubik is now known as fhubik_afk | 11:19 | |
| *** e0ne is now known as e0ne_ | 11:30 | |
| *** ajayaa has quit IRC | 11:30 | |
| *** aix has joined #openstack-keystone | 11:35 | |
| *** krykowski_ has quit IRC | 11:38 | |
| *** arif-ali has joined #openstack-keystone | 11:40 | |
| *** ajayaa has joined #openstack-keystone | 11:42 | |
| *** krykowski has joined #openstack-keystone | 11:45 | |
| ajayaa | Hi guys. I am trying out HMT feature in Keystone and I created projects in a tree structure. But when I call /projects/<id>?subtree_as_list on the root project, I see nothing except the root project. | 11:51 |
| ajayaa | I am using latest master using devstack. | 11:52 |
| *** kiran-r has quit IRC | 11:53 | |
| ajayaa | Any idea on what I am doing wrong? | 11:53 |
| *** fhubik_afk is now known as fhubik | 11:56 | |
| *** dims has joined #openstack-keystone | 11:56 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 11:56 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Service with no endpoints should not be in catalog https://review.openstack.org/176383 | 11:58 |
| *** krykowski has quit IRC | 12:03 | |
| *** krykowski has joined #openstack-keystone | 12:03 | |
| *** raildo has joined #openstack-keystone | 12:03 | |
| *** openstackgerrit has quit IRC | 12:07 | |
| *** openstackgerrit has joined #openstack-keystone | 12:07 | |
| *** krykowski has quit IRC | 12:08 | |
| morganfainberg | jamielennox: Keystoneauth is in gerrit | 12:13 |
| morganfainberg | samueldmq: specs.openstack.org | 12:13 |
| samueldmq | ayoung, hi, need to talk about how we solve admin global bug with the new dynamic policy approach | 12:13 |
| samueldmq | ayoung, need to clarify on the specs | 12:14 |
| samueldmq | morganfainberg, great, I thought there was a link on docs.openstack.org | 12:14 |
| amakarov | morganfainberg, hi! We have a problen in requirements for stable/kilo: stevedore>=1.1.0 in KSC and stevedore>=1.3.0,<1.4.0 in global requirements | 12:14 |
| samueldmq | morganfainberg, https://etherpad.openstack.org/p/keystone-kilo-release-notes | 12:14 |
| amakarov | s/problen/problem/ | 12:14 |
| samueldmq | morganfainberg, the etherpad for release notes me and dolphm are working on | 12:15 |
| amakarov | Should I file a patch for kilo? | 12:15 |
| morganfainberg | amakarov: please speak with the release mgmnt team about that. The g-r update was held up intentionally. dhellmann might bring insight to it. There will be a subsequent release of ksc and ksm, but I don't know the details on requirements for it | 12:16 |
| amakarov | morganfainberg, thanks! | 12:16 |
| morganfainberg | samueldmq: I'm about to go offline for the day. Thanks for working on the release notes with Dolph. | 12:16 |
| morganfainberg | I will look over the release nots when I hit la tonight. | 12:17 |
| samueldmq | morganfainberg, np, have a nice trip | 12:18 |
| *** Ephur has joined #openstack-keystone | 12:20 | |
| ajayaa | Hi guys. I am trying out HMT feature in Keystone and I created projects in a tree structure. But when I call /projects/<id>?subtree_as_list on the root project, I see nothing except the root project. | 12:23 |
| ajayaa | Is there something which I am missing? | 12:23 |
| rodrigods | ajayaa, the user performing the call needs to have access for the bottom project as well | 12:23 |
| rodrigods | ie, have a role assignment in this project | 12:24 |
| ajayaa | rodrigods, on all the children nodes? | 12:24 |
| rodrigods | ajayaa, for every project in the subtree, keystone will only return the ones the user performing the call has access to | 12:24 |
| rodrigods | ajayaa, if you want a complete list, despite access privileges but only with "ids" | 12:25 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Add docstrings for ``protocol`` parameter https://review.openstack.org/177303 | 12:25 |
| rodrigods | you may call ?subtree_as_ids | 12:25 |
| marekd | rodrigods: look at my comment here and see if i am right: https://review.openstack.org/#/c/172647/6/keystone/contrib/federation/idp.py | 12:25 |
| rodrigods | marekd, yes you are | 12:26 |
| ajayaa | rodrigods, I thought if I have a role x on a project y and then I should get role x on all children of project y. | 12:26 |
| rodrigods | marekd, already working to address your review, thanks for that btw | 12:26 |
| *** e0ne_ is now known as e0ne | 12:26 | |
| marekd | rodrigods: no problem. | 12:26 |
| raildo | ajayaa, for this, you can use inherited role assignments. | 12:26 |
| rodrigods | ajayaa, we have two different types of roles: a role that is inherited to the subtree or not | 12:27 |
| rodrigods | raildo, ++ | 12:27 |
| ajayaa | ohh...Do I have to create an inherited role? | 12:27 |
| rodrigods | ajayaa, yes | 12:27 |
| rodrigods | ajayaa, but we have a bug where you can't have the same role assignment being inherited or not in the same target | 12:28 |
| rodrigods | samueldmq is working on a fix for it | 12:28 |
| ajayaa | rodrigods, I am following https://github.com/openstack-attic/identity-api/blob/master/v3/src/markdown/identity-api-v3.md | 12:29 |
| samueldmq | rodrigods, ++ | 12:29 |
| samueldmq | ajayaa, https://review.openstack.org/#/c/142472/ | 12:29 |
| samueldmq | btw, we need reviews on this | 12:29 |
| samueldmq | henrynash, marekd ^ | 12:29 |
| ajayaa | rodrigods, How do I create an inherited role? | 12:29 |
| raildo | ajayaa, you can do this: https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-inherit-ext.rst#assign-role-to-user-on-projects-in-a-subtree | 12:30 |
| marekd | samueldmq: ok, i will once i am done with stuff here. | 12:30 |
| rodrigods | ajayaa, you need to activate the extension as well | 12:30 |
| ajayaa | okay. | 12:30 |
| raildo | ajayaa, it's a normal role... you just inherit the assignment. | 12:31 |
| ajayaa | Is the extension going to be merged into main API in future? | 12:31 |
| raildo | ajayaa, probably... this is what we want to do. :) | 12:31 |
| ajayaa | I was under the impression that Keystone was doing away with extensions. | 12:31 |
| ajayaa | raildo, That would be nice. | 12:32 |
| ajayaa | Thanks for all the help. :) | 12:32 |
| *** henrynash has quit IRC | 12:32 | |
| raildo | ajayaa, any other question about HMT or inherited role assignment, you can ask us :) | 12:32 |
| ajayaa | raildo, Thanks, will do | 12:33 |
| ajayaa | ! | 12:33 |
| *** gordc has joined #openstack-keystone | 12:33 | |
| ayoung | mabrams, actaully, better to discuss the hierarchical thing here. | 12:41 |
| *** EmilienM is now known as EmilienM|afk | 12:41 | |
| *** ajayaa has quit IRC | 12:41 | |
| *** lifeless has quit IRC | 12:43 | |
| *** chlong has joined #openstack-keystone | 12:44 | |
| *** fhubik has quit IRC | 12:44 | |
| *** krykowski has joined #openstack-keystone | 12:45 | |
| ayoung | mabrams, was that auth required error only on the hierarchical one? Was it right after creating the parent project? | 12:45 |
| ayoung | Let me try the same commands... | 12:46 |
| mabrams | ayoung: yes | 12:46 |
| *** wchrisj has quit IRC | 12:46 | |
| ayoung | mabrams, let me see if there is some pre-req we need to setup before the hierarchical stuff works. It should be in the docs dir... | 12:47 |
| ayoung | mabrams, http://git.openstack.org/cgit/openstack/keystone/tree/doc/source/extensions.rst#n111 | 12:48 |
| ayoung | mabrams, usually an extension needs to be enabled. Let's see | 12:49 |
| ayoung | http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-inherit-ext.html | 12:49 |
| ayoung | ah disregard...wrong inherit | 12:49 |
| ayoung | raildo, does HMT need to be specifically enabled? | 12:50 |
| *** krykowski has quit IRC | 12:52 | |
| ayoung | mabrams, I'm guessing that the problem is inheritance of roles. You have permission from the domain to create the parent project, but because you create the child within that project, you need a token scoped to that project to create the child? Something like that. I'm going to try it myself | 12:54 |
| *** e0ne is now known as e0ne_ | 12:54 | |
| ayoung | samueldmq, we don't have support for HMT in the common client yet, right? | 12:55 |
| rodrigods | ayoung, https://review.openstack.org/#/c/166373/ | 12:59 |
| rodrigods | and | 12:59 |
| rodrigods | https://review.openstack.org/#/c/123539/ | 13:00 |
| ayoung | rodrigods, so you are saying I should review that... | 13:00 |
| ayoung | heh thanks | 13:00 |
| rodrigods | ayoung, and HMT is not an extension, it is supported by default | 13:01 |
| *** ir2ivps8_ has quit IRC | 13:01 | |
| ayoung | rodrigods, right, I got confused with the role inheritance | 13:01 |
| ayoung | which is an extension, but probably needs to be core. I think that it is the solution the global admin issue | 13:02 |
| rodrigods | ayoung, ++ | 13:02 |
| rodrigods | ayoung, related to HMT and inherited roles: https://review.openstack.org/#/c/142472/ | 13:04 |
| ayoung | rodrigods, I remember that one...I had some questions about the impl...lets hold off on that for a moment | 13:04 |
| rodrigods | ok... | 13:04 |
| *** edmondsw has joined #openstack-keystone | 13:04 | |
| samueldmq | ayoung, yeah role inheritance will probably be core when start dropping extensions in favor of in-tree, et c .. | 13:05 |
| samueldmq | ayoung, I need to understand how the dynamic policy thing will solve/help to solve the long-standing bug in the admin-ness scope | 13:06 |
| *** krykowski has joined #openstack-keystone | 13:06 | |
| *** e0ne_ is now known as e0ne | 13:06 | |
| *** bknudson has joined #openstack-keystone | 13:06 | |
| *** ChanServ sets mode: +v bknudson | 13:06 | |
| ayoung | samueldmq, I want people to get tokens scoped to the project for which they are operating | 13:06 |
| ayoung | so if you are a global admin, you need a way to get a role for all subordinate projects | 13:07 |
| ayoung | and then when you perform and action there, instead of using your global token, you use one you get via inheritance | 13:07 |
| *** richm has joined #openstack-keystone | 13:11 | |
| samueldmq | ayoung, subordinate projects are projects in the subtree (hierarhcical projects) ? | 13:12 |
| *** nkinder has quit IRC | 13:12 | |
| ayoung | samueldmq, yes | 13:13 |
| samueldmq | ayoung, wait .. but the bug today occurs even if there is no relationship between projects | 13:14 |
| samueldmq | ayoung, they may be in different subtrees | 13:14 |
| ayoung | samueldmq, projects are always under a domain | 13:14 |
| ayoung | mabrams, still working to reproduce. | 13:15 |
| samueldmq | ayoung, yes, but projects with different domains can also be affected by that bug | 13:15 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 13:15 |
| ayoung | samueldmq, we need one big hierarchy. Then there is a root domain, and admin on the root domain is admin all the way down...until reseller hits. | 13:16 |
| mabrams | ayoung: thx a lot; i gotta hop in a few; i'll have the history. | 13:16 |
| ayoung | mabrams, I'll have it as a bash script, which is why it is taking slightly longer | 13:16 |
| samueldmq | ayoung, yes, so you want a way to easily allow the global admin if people want it | 13:16 |
| mabrams | ayoung: gotcha; just lemme know where i can pik it up | 13:16 |
| ayoung | samueldmq, ++ | 13:16 |
| samueldmq | ayoung, but this doesn't solve the bug | 13:17 |
| samueldmq | ayoung, I like the idea, it would be clearer, but the bug .. | 13:17 |
| ayoung | samueldmq, we won't be closing out this bug in Kilo, but maybe in Liberty | 13:17 |
| samueldmq | ayoung, this approach we discussed above doesn't solve the bug | 13:18 |
| samueldmq | ayoung, what solves it is to check scope in each api endpoint | 13:18 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 13:19 |
| samueldmq | ayoung, this way you block the global admin | 13:19 |
| samueldmq | ayoung, the approahc you described allows the global admin ina fashion, I like that | 13:19 |
| samueldmq | ayoung, but it's a separate thing | 13:19 |
| ayoung | nope | 13:20 |
| ayoung | we need dynamic policy as well | 13:20 |
| ayoung | because we can't break people, but we can provide them a way to unbreak themselves | 13:20 |
| ayoung | if we dismiss the admin, they will have no way to perform an essential use case. We need the inherited roles to give them back that way | 13:20 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 13:22 |
| *** mattfarina has joined #openstack-keystone | 13:23 | |
| samueldmq | ayoung, so how people using the global admin now would be able to migrate to local admins | 13:24 |
| samueldmq | ? | 13:24 |
| *** mattfarina has quit IRC | 13:24 | |
| samueldmq | ayoung, one way to do so is by adding scope checks on their policies themselves, right ? | 13:24 |
| ayoung | samueldmq, yes | 13:24 |
| samueldmq | ayoung, another would be using your approach, how should that work ? | 13:24 |
| ayoung | samueldmq, that is baseline | 13:24 |
| ayoung | samueldmq, my approach is based on all policy being scoped | 13:25 |
| samueldmq | ayoung, I want to migrate to it, so I activate an extension/switch whatever to make everything scoped? | 13:25 |
| samueldmq | ayoung, and then create new inherited role assignents to make global admins ? | 13:26 |
| ayoung | samueldmq, I think the process to migrate will need to be laid out. I think setp by step, it would be: get everything under one root domain, enable inheritfed roles, assing admin to someone on root, then update the policy roles to have scope on each. | 13:27 |
| ayoung | make sense? | 13:27 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Dual Scoped Token https://review.openstack.org/176054 | 13:27 |
| ayoung | samueldmq, you could avoid the global admin role by explicitly giving one (or a set) of users admin on each domains | 13:27 |
| ayoung | but then you have to make sure you always add a new role assignment when you create a new domain | 13:28 |
| samueldmq | ayoung, yes we can create a group of global_admins and then make admin inherited on every domain | 13:28 |
| ayoung | ++ | 13:28 |
| ayoung | samueldmq, we can give people a range of options, without forcing them to break things | 13:28 |
| samueldmq | ayoung, and add the scope checks on every api entry in the policies | 13:28 |
| ayoung | yep | 13:29 |
| samueldmq | ayoung, so actually it can be solved today, right ? | 13:29 |
| ayoung | and having the policy served out of Keystone, and having a tool that checks the result of policy changes both make this a safer process | 13:29 |
| ayoung | samueldmq, I thin the rewriting of the policy rules needs to be more controlled than it is today. So, in theory, yes....in practice, not so much | 13:30 |
| samueldmq | ayoung, what's that tool ? you already said that in the sepcs ? | 13:30 |
| * samueldmq is interviewing ayoung to get info to detail as much as we can the specs :-) | 13:30 | |
| ayoung | samueldmq, I posted a review for the start of the tool | 13:31 |
| samueldmq | ayoung, k will take a look | 13:31 |
| samueldmq | ayoung, I understood the process above, and I agree with you | 13:31 |
| ayoung | https://review.openstack.org/#/c/170978/ | 13:31 |
| samueldmq | ayoung, but I dont see the clue in inherited roles (I see inherited assignment) | 13:31 |
| *** ir2ivps8_ has joined #openstack-keystone | 13:32 | |
| ayoung | samueldmq, raildo rodrigods please make sure you add me to any reviews you actually want me to see...I'm so far behind, that I am going to prioritize those I am already a reviewer on, and doubt I will get through that list | 13:32 |
| raildo | ayoung, sure. thanks! | 13:33 |
| samueldmq | ayoung, ack | 13:33 |
| *** ajayaa has joined #openstack-keystone | 13:34 | |
| ayoung | samueldmq, so...if you were using that tool, what you would see is that a global token (admin on the default domain say) would stop working, but a token scoped to the project would then start working, and the user could confirm that they could get a token for that project | 13:34 |
| samueldmq | ayoung, yes, and this is inherited role assignments | 13:34 |
| samueldmq | ayoung, not inehrited roles | 13:34 |
| ayoung | inherited roles will show up in the policy file | 13:35 |
| ayoung | ...lets chose a better name | 13:35 |
| ayoung | so there is no conflict. I liked implied roles... | 13:35 |
| ayoung | but you get the general flow? | 13:35 |
| samueldmq | ayoung, yeah they will give more power, but are not essential to solve the issue with the approach we are discussing so far | 13:35 |
| samueldmq | ayoung, you agree? | 13:35 |
| ayoung | implied? Not essential, but the rules will quickly become unmanageable without. I think they are required | 13:36 |
| ayoung | I'd not want to try to fix it without implied roles, at least hard coded into the policy file | 13:36 |
| samueldmq | ayoung, yes they are essential, I am not against this .... | 13:36 |
| ayoung | ++ | 13:37 |
| samueldmq | ayoung, I am just trying to separate the essential vs the core | 13:37 |
| ayoung | ok...let me try to create a hierarchical projectn ow | 13:37 |
| *** EmilienM|afk is now known as EmilienM | 13:37 | |
| samueldmq | ops the vcore vs whishlist | 13:37 |
| samueldmq | ayoung, the essential flow is around inehrited role assignments, dynamically modifying the policy and having a tool to check the changes | 13:37 |
| samueldmq | ayoung, nice I will be checking everything we discussed against the specs | 13:37 |
| samueldmq | ayoung, thanks | 13:38 |
| *** e0ne is now known as e0ne_ | 13:38 | |
| *** lifeless has joined #openstack-keystone | 13:38 | |
| *** e0ne_ is now known as e0ne | 13:39 | |
| *** josecastroleon has joined #openstack-keystone | 13:39 | |
| *** joesavak has joined #openstack-keystone | 13:48 | |
| *** csoukup has joined #openstack-keystone | 13:49 | |
| dstanek | we have all of these policy ideas written up as specs right? | 13:52 |
| *** jsavak has joined #openstack-keystone | 13:53 | |
| samueldmq | dstanek, I am not sure :p | 13:54 |
| *** mtreinish has joined #openstack-keystone | 13:54 | |
| samueldmq | dstanek, that's what I am doing now | 13:54 |
| samueldmq | dstanek, ensuring things are clearly described in the specs | 13:55 |
| samueldmq | dstanek, what are the problems we are trying to solve with each step, etc | 13:55 |
| *** iamjarvo has joined #openstack-keystone | 13:55 | |
| *** iamjarvo has quit IRC | 13:56 | |
| *** nkinder has joined #openstack-keystone | 13:56 | |
| *** joesavak has quit IRC | 13:56 | |
| *** iamjarvo has joined #openstack-keystone | 13:57 | |
| *** iamjarvo has quit IRC | 13:57 | |
| samueldmq | dstanek, sorry need to go afk for abit, get the kid at school :) | 13:57 |
| *** iamjarvo has joined #openstack-keystone | 13:57 | |
| *** iamjarvo has quit IRC | 13:58 | |
| dstanek | samueldmq: np, forward me any specs you find interesting - i'm starting my pre-summit reading | 13:58 |
| samueldmq | dstanek, great will do | 13:58 |
| *** iamjarvo has joined #openstack-keystone | 13:58 | |
| *** iamjarvo has quit IRC | 13:58 | |
| *** iamjarvo has joined #openstack-keystone | 13:59 | |
| *** iamjarvo has quit IRC | 13:59 | |
| *** iamjarvo has joined #openstack-keystone | 14:00 | |
| *** rushiagr_away has quit IRC | 14:05 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 14:05 |
| *** mtreinish has quit IRC | 14:05 | |
| -openstackstatus- NOTICE: gerrit has been restarted to clear a stuck events queue. any change events between 13:29-14:05 utc should be rechecked or have their approval votes reapplied to trigger jobs | 14:05 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 14:06 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 14:08 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:09 | |
| *** rushiagr_away has joined #openstack-keystone | 14:16 | |
| marekd | is it okay to reference keystone patches to bps from different project (congress in this particular case) ? | 14:25 |
| marekd | https://blueprints.launchpad.net/openstack/?searchtext=api-validation | 14:25 |
| marekd | lbragstad: ^^ | 14:25 |
| lbragstad | marekd: responded | 14:37 |
| *** itlinux has joined #openstack-keystone | 14:37 | |
| bknudson | maybe we need a new blueprint for the work that continues in L. | 14:39 |
| *** dims has quit IRC | 14:42 | |
| *** dims has joined #openstack-keystone | 14:42 | |
| *** mtreinish has joined #openstack-keystone | 14:45 | |
| *** mtreinish has quit IRC | 14:49 | |
| *** ajayaa has quit IRC | 14:52 | |
| *** davidckennedy has quit IRC | 14:53 | |
| marekd | lbragstad: thanks. | 14:56 |
| marekd | lbragstad: me too | 14:56 |
| *** samueldmq_ has joined #openstack-keystone | 14:56 | |
| *** samueldmq_ has quit IRC | 14:56 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Ignore cover directory https://review.openstack.org/178707 | 14:57 |
| *** sirushti has left #openstack-keystone | 14:58 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 15:00 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 15:00 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 15:00 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 15:00 |
| *** packet has joined #openstack-keystone | 15:02 | |
| *** browne has joined #openstack-keystone | 15:02 | |
| *** ajayaa has joined #openstack-keystone | 15:05 | |
| *** erkules_ is now known as erkules | 15:08 | |
| *** erkules has joined #openstack-keystone | 15:08 | |
| *** erkules has left #openstack-keystone | 15:13 | |
| *** itlinux has quit IRC | 15:15 | |
| bknudson | is https://review.openstack.org/#/c/153803/ re-proposing fernet tokens? | 15:16 |
| *** itlinux has joined #openstack-keystone | 15:28 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Drop use of 'oslo' namespace package https://review.openstack.org/178360 | 15:35 |
| openstackgerrit | Merged openstack/keystonemiddleware: Remove superfluous / spammy log line https://review.openstack.org/178292 | 15:35 |
| *** iamjarvo has quit IRC | 15:36 | |
| *** kiran-r has joined #openstack-keystone | 15:39 | |
| *** stevemar has joined #openstack-keystone | 15:42 | |
| *** ChanServ sets mode: +v stevemar | 15:42 | |
| *** rushiagr_away is now known as rushiagr | 15:46 | |
| *** browne has quit IRC | 15:46 | |
| stevemar | which channel do requirements folks hang out? | 15:47 |
| openstackgerrit | Merged openstack/keystone: Update sample config https://review.openstack.org/177544 | 15:48 |
| *** samleon has quit IRC | 15:50 | |
| *** samleon has joined #openstack-keystone | 15:52 | |
| *** _cjones_ has joined #openstack-keystone | 15:52 | |
| *** rm_work is now known as rm_work|away | 15:53 | |
| *** jsavak has quit IRC | 16:03 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Document non-standard encoding of the PKI token. https://review.openstack.org/176230 | 16:04 |
| ayoung | bknudson, morganfainberg https://github.com/simo5/jwcrypto | 16:05 |
| ayoung | mabrams, http://adam.younglogic.com/2015/04/creating-hierarchical-projects-in-keystone/ | 16:06 |
| bknudson | forget SAML! | 16:07 |
| bknudson | and the PKI tokens! | 16:08 |
| openstackgerrit | Merged openstack/keystonemiddleware: Remove unused iso8601 dependency https://review.openstack.org/177831 | 16:08 |
| bknudson | looks like JWT is the new SAML | 16:09 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 16:10 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 16:10 |
| stevemar | bknudson, jwt is pretty nice | 16:10 |
| bknudson | stevemar: does anything support it? | 16:10 |
| *** jistr has quit IRC | 16:11 | |
| *** alexsyip has joined #openstack-keystone | 16:12 | |
| bknudson | this is neat: http://jwt.io/ | 16:12 |
| bknudson | it says there's already a pyjwt | 16:13 |
| bknudson | https://pypi.python.org/pypi/PyJWT/1.1.0 | 16:15 |
| ayoung | bknudson, yeah, but simo uses Python-cryptography | 16:15 |
| bknudson | https://github.com/jpadilla/pyjwt use python-cryptography as far as I can tell | 16:15 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 16:15 |
| stevemar | bknudson, jwt is nice cause it's all json | 16:15 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 16:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 16:16 |
| bknudson | JSON with XML in it? | 16:16 |
| bknudson | { "xml": "<XML> </XML>"} | 16:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 16:16 |
| stevemar | bknudson, you just made me cringe | 16:17 |
| *** josecastroleon has quit IRC | 16:17 | |
| bknudson | it meets all the requirements. | 16:18 |
| *** chlong has quit IRC | 16:19 | |
| stevemar | bknudson, identity v4 - jwt | 16:19 |
| stevemar | bit of trivia, it's pronounced "jot" | 16:20 |
| *** pcaruana has quit IRC | 16:22 | |
| *** gyee has joined #openstack-keystone | 16:25 | |
| *** ChanServ sets mode: +v gyee | 16:25 | |
| ayoung | bknudson, why'd you think he was using python-cryoptography? I dont see a requirements.txt, and none of his python files seem to import from it. He only uses hmac and hashlib AFAICT | 16:26 |
| bknudson | ayoung: RSA and ECDSA signatures depend on the recommended cryptography package (0.8+). | 16:27 |
| bknudson | https://github.com/jpadilla/pyjwt | 16:27 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Update README.rst and remove ancient reference https://review.openstack.org/178759 | 16:29 |
| *** mattfarina has joined #openstack-keystone | 16:34 | |
| *** mattfarina has quit IRC | 16:34 | |
| *** zzzeek has joined #openstack-keystone | 16:44 | |
| marekd | ayoung: wasn't jwt described on rh security blog some time ago? | 16:47 |
| *** itlinux has quit IRC | 16:48 | |
| ayoung | bknudson, marekd yeah | 16:48 |
| marekd | i am wondering if jwt as a transport layer only can fully replace saml | 16:48 |
| ayoung | marekd, on ECP, why do we assume we should do IdP instigated ? | 16:48 |
| marekd | hmm? | 16:49 |
| ayoung | shouldn't we only take that shortcut if necessary | 16:49 |
| marekd | a shortcut instead of what? sp->idp->sp ? | 16:49 |
| ayoung | marekd, from jdennis " it doesn't look like they are doing full ECP, rather it appears they are doing IdP initiated responses and only doing 1 step of the ECP process, returning a PAOS response." | 16:50 |
| ayoung | yeah, it needs to be sp initiated (with a nonce) in order to not be a bearer token. I can't see why we would want to even make that optional, but it should certainly be the norm | 16:51 |
| marekd | ayoung: i emailed him on Monday, i don't know what he meant exactly. In fact ECP code in KSC hits SP first | 16:56 |
| ayoung | marekd, he's still out, unfortunately | 16:57 |
| rodrigods | ayoung, marekd, there is some steps in ECP that K2K doesn't perform (is that what you are talking about?) | 16:58 |
| ayoung | rodrigods, not K2K | 16:59 |
| ayoung | rodrigods, the federation auth plugin | 16:59 |
| marekd | i need to step away for a while | 17:00 |
| *** joesavak has joined #openstack-keystone | 17:08 | |
| samueldmq | just to make sure, we can use v2 api with v3 tokens, cant we ? | 17:08 |
| marekd | rodrigods: ubuntu@devstack:~/devstack/accrc/demo$ OS_IDENTITY_API_VERSION=3 OS_AUTH_URL=http://128.142.132.173:5000/v2.0 openstack server list | 17:09 |
| marekd | WARNING: openstackclient.shell Possible error authenticating: Could not determine a suitable URL for the plugin | 17:09 |
| marekd | ERROR: openstack Could not determine a suitable URL for the plugin | 17:10 |
| marekd | samueldmq: ^^ | 17:10 |
| stevemar | nope | 17:10 |
| *** aix has quit IRC | 17:10 | |
| stevemar | samueldmq, the v2 API wouldn't know how to handle v3 tokens | 17:10 |
| stevemar | the v3 API can handle v2 tokens (i think...) | 17:11 |
| marekd | stevemar: i think not.... | 17:11 |
| marekd | it expect domains for instance. | 17:11 |
| *** browne has joined #openstack-keystone | 17:12 | |
| *** tellesnobrega_ has joined #openstack-keystone | 17:16 | |
| gyee | stevemar, how far are you from Ottawa? | 17:17 |
| *** dguerri is now known as _dguerri | 17:18 | |
| *** _dguerri is now known as dguerri | 17:18 | |
| samueldmq | stevemar, marekd nice, I thought we could, since v3 auth != v3 api | 17:18 |
| samueldmq | thanks | 17:18 |
| gyee | for default domain, v2 and v3 token should be interchangeable | 17:18 |
| samueldmq | bknudson, dstanek I thought we had discussed this last week ^ | 17:18 |
| samueldmq | bknudson, dstanek I thought we could use v2 api with v3 auth :/ | 17:19 |
| samueldmq | hmm, gyee yes, that's what I think | 17:19 |
| gyee | trust me, it works :) | 17:20 |
| gyee | money back guarantee | 17:20 |
| samueldmq | gyee, hehe o/ | 17:21 |
| *** tellesnobrega_ has quit IRC | 17:21 | |
| stevemar | gyee, about a 4 hr drive | 17:28 |
| stevemar | gyee, you visiting? | 17:28 |
| gyee | stevemar, yeah, I'll be in Ottawa next week for a customer visit | 17:29 |
| gyee | any "must visit" places? | 17:29 |
| stevemar | gyee, was there last week, to see a hockey game | 17:29 |
| gyee | Rediau Canel | 17:29 |
| stevemar | gyee, go see parliament | 17:30 |
| *** samleon has quit IRC | 17:30 | |
| gyee | Rideau | 17:30 |
| *** iamjarvo has joined #openstack-keystone | 17:30 | |
| *** samleon has joined #openstack-keystone | 17:30 | |
| *** iamjarvo has quit IRC | 17:30 | |
| *** iamjarvo has joined #openstack-keystone | 17:31 | |
| *** iamjarvo has quit IRC | 17:31 | |
| stevemar | https://www.google.ca/maps/place/Parliament+Hill/@45.423624,-75.699298,3a,75y,304.25h,87.64t/data=!3m5!1e1!3m3!1sA-1ux82EoMIAAAQWtOCdGg!2e0!3e11!4m2!3m1!1s0x4cce04ff4fe494ef:0x26bb54f60c29f6e | 17:31 |
| gyee | wow nice | 17:31 |
| *** iamjarvo has joined #openstack-keystone | 17:31 | |
| *** iamjarvo has quit IRC | 17:32 | |
| *** lhcheng has joined #openstack-keystone | 17:32 | |
| *** ChanServ sets mode: +v lhcheng | 17:32 | |
| *** iamjarvo has joined #openstack-keystone | 17:32 | |
| stevemar | gyee, kind of a small town | 17:32 |
| stevemar | err small city | 17:33 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 17:33 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 17:33 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 17:33 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 17:33 |
| gyee | stevemar, good, I love walking around | 17:33 |
| stevemar | gyee, go hang with your coworker: https://twitter.com/somerville32 | 17:33 |
| gyee | oh I didn't know Cody lives there | 17:34 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 17:37 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 17:39 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 17:39 |
| *** itlinux has joined #openstack-keystone | 17:41 | |
| *** iamjarvo has quit IRC | 17:48 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 17:48 |
| *** iamjarvo has joined #openstack-keystone | 17:55 | |
| *** iamjarvo has quit IRC | 17:55 | |
| *** iamjarvo has joined #openstack-keystone | 17:56 | |
| *** e0ne has quit IRC | 17:57 | |
| *** harlowja_away is now known as harlowja | 18:00 | |
| *** krykowski has quit IRC | 18:04 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 18:05 |
| *** dhellmann has quit IRC | 18:05 | |
| *** mtreinish has joined #openstack-keystone | 18:06 | |
| *** rm_work|away is now known as rm_work | 18:07 | |
| gyee | jamielennox, for the keystoneclient.fixture, when we generate the sample service catalog, we don't put the endpoint or service IDs in there | 18:09 |
| *** topol has joined #openstack-keystone | 18:11 | |
| *** ChanServ sets mode: +v topol | 18:11 | |
| bknudson | if you're using the templated backend there aren't IDs available. | 18:12 |
| gyee | bkundson, oh | 18:13 |
| gyee | anybody really using the template backend in production? | 18:14 |
| *** harlowja has quit IRC | 18:16 | |
| *** harlowja has joined #openstack-keystone | 18:16 | |
| *** harlowja has quit IRC | 18:17 | |
| *** harlowja has joined #openstack-keystone | 18:20 | |
| *** henrynash has joined #openstack-keystone | 18:21 | |
| *** ChanServ sets mode: +v henrynash | 18:21 | |
| *** markvoelker has quit IRC | 18:28 | |
| *** harlowja has quit IRC | 18:29 | |
| *** harlowja has joined #openstack-keystone | 18:29 | |
| *** dguerri is now known as _dguerri | 18:30 | |
| *** e0ne has joined #openstack-keystone | 18:31 | |
| *** e0ne is now known as e0ne_ | 18:31 | |
| *** e0ne_ is now known as e0ne | 18:32 | |
| *** e0ne is now known as e0ne_ | 18:32 | |
| *** e0ne_ is now known as e0ne | 18:32 | |
| *** e0ne has quit IRC | 18:32 | |
| *** _dguerri is now known as dguerri | 18:34 | |
| htruta | bknudson: do you have a few minutes to take a look at https://review.openstack.org/#/c/167613/ ? | 18:37 |
| *** dguerri has quit IRC | 18:42 | |
| *** e0ne has joined #openstack-keystone | 18:48 | |
| *** nkinder has quit IRC | 18:50 | |
| *** dhellmann has joined #openstack-keystone | 19:06 | |
| *** rushiagr is now known as rushiagr_away | 19:15 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/178414 | 19:17 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/178415 | 19:17 |
| *** henrynash has quit IRC | 19:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/178426 | 19:23 |
| *** ajayaa has quit IRC | 19:23 | |
| *** _cjones_ has quit IRC | 19:25 | |
| *** amakarov is now known as amakarov_away | 19:27 | |
| *** _cjones_ has joined #openstack-keystone | 19:41 | |
| *** david-lyle has quit IRC | 19:44 | |
| samueldmq | stevemar, all the keystone notifications are now in cadf format ? | 19:44 |
| *** david-lyle has joined #openstack-keystone | 19:44 | |
| lhcheng | gyee, I recall one company used it for global keystone setup, and keystone in each region filters the endpoints using templated backend | 19:45 |
| *** ajayaa has joined #openstack-keystone | 19:48 | |
| gyee | with endpont constraint feature, we don't have to do it that way | 19:48 |
| gyee | just add a constraint for region | 19:49 |
| stevemar | samueldmq, theres a config option that enables it to be cadf format | 19:53 |
| *** arif-ali has quit IRC | 19:56 | |
| samueldmq | stevemar, ack, the release notes contain a bunch of federation things, I would appreciate any help there :) | 19:56 |
| samueldmq | stevemar, https://etherpad.openstack.org/p/keystone-kilo-release-notes | 19:56 |
| stevemar | samueldmq, real release notes: https://wiki.openstack.org/wiki/ReleaseNotes/Kilo#OpenStack_Identity_.28Keystone.29 ? | 19:58 |
| *** itlinux has quit IRC | 19:58 | |
| stevemar | but yeah, i'll be updating the wiki soon | 19:58 |
| *** Rockyg has joined #openstack-keystone | 20:08 | |
| gyee | lhcheng, this dual scope concept scares me | 20:11 |
| lhcheng | gyee: me too, and reseller :) | 20:11 |
| gyee | we are already dealing with service admin bleed over | 20:11 |
| gyee | now we are going to have to deal with domain admin bleed over | 20:11 |
| gyee | right now there's a clear distinction between domain admin and project admin | 20:11 |
| rodrigods | gyee, can you give examples of problems you see? | 20:12 |
| gyee | rodrigods, right now if you have admin role on a project, you are admin for nova, swift, glance, etc | 20:14 |
| gyee | but if you only have admin role on a domain, you can't do squat with the services | 20:14 |
| lhcheng | gyee: about the use of templated catalog, heard it about 2 summits ago. maybe they were still in v2. But yet, the endpoint feature will do the trick. | 20:14 |
| lhcheng | yet -> yeah | 20:14 |
| gyee | lhcheng, endpoint will place a significant role going forward, endpoint policies, endpoint constraint, etc | 20:16 |
| rodrigods | gyee, but if you are a domain admin today, you could create a project and give admin to yourself | 20:16 |
| gyee | s/place/play/ | 20:16 |
| gyee | rodrigods, only if policies allows it | 20:17 |
| gyee | but yes, you can do that with the default policies | 20:17 |
| morganfainberg | stevemar: samueldmq dolphm do I need to update the release notes wiki when I get home or are one of you going to? (Just checking so I can plan for it) | 20:18 |
| *** dguerri has joined #openstack-keystone | 20:18 | |
| morganfainberg | gyee: also we need to not call it "dual scope" please ;) | 20:18 |
| *** samleon has quit IRC | 20:18 | |
| dolphm | morganfainberg: samueldmq knocked out about half of the to-do list yesterday, and i'm planning on finish the rest today | 20:19 |
| *** kiran-r has quit IRC | 20:19 | |
| gyee | morganfainberg, project admin is "multi-scope" today :) | 20:19 |
| morganfainberg | dolphm: ok. | 20:19 |
| stevemar | morganfainberg, i'll actually do some today | 20:19 |
| morganfainberg | gyee: "dual scope" has a bad name implication that you're scoped to multiple projects. | 20:19 |
| gyee | yeah I know | 20:19 |
| gyee | magic scope | 20:19 |
| morganfainberg | dolphm: sure. Just checking if I'll need to sync from the ether pad to wiki. I'll check in when I land and see where we are. | 20:20 |
| *** pnavarro has quit IRC | 20:25 | |
| *** e0ne has quit IRC | 20:26 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Handles Python3 builtin changes https://review.openstack.org/177411 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: pycadf now supports Python3 https://review.openstack.org/177407 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes use of dict methods for Python3 https://review.openstack.org/177410 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: eventlet now supports Python3 https://review.openstack.org/177406 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Updates the *py3 requirements files https://review.openstack.org/177409 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes mocking of oslo messaging for Python3 https://review.openstack.org/177408 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes deprecations test for Python3 https://review.openstack.org/177415 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Add mocking for ldappool for Python3 tests https://review.openstack.org/177414 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes a whitespace issue https://review.openstack.org/177413 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Handles modules that moved in Python3 https://review.openstack.org/177412 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: basestring no longer exists in Python3 https://review.openstack.org/177418 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Add mocking for memcache for Python3 tests https://review.openstack.org/177417 | 20:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactor deprecations tests https://review.openstack.org/177416 | 20:28 |
| dstanek | sorry! | 20:28 |
| *** pnavarro has joined #openstack-keystone | 20:29 | |
| morganfainberg | dstanek: haha | 20:30 |
| lhcheng | gyee: we're really not doing dual scope, but merging domain and project role assignment | 20:31 |
| lhcheng | gyee: if the user grant a project role on a "domain" project, they really get the domain role too. | 20:32 |
| gyee | lhcheng, that's a problem isn't it | 20:33 |
| lhcheng | gyee: it could cause confusion and accidental granting privilege to some user | 20:33 |
| lhcheng | gyee: yeah, it is :) | 20:33 |
| gyee | right now domain admin can't do anything with services like nova | 20:33 |
| lhcheng | gyee: that's also my concern abot it | 20:33 |
| gyee | with this change, domain admin is the same as project | 20:33 |
| lhcheng | *about | 20:33 |
| lhcheng | gyee: brb, heading to lunch before cafeteria closes. | 20:35 |
| raildo | I think that we dont have a clear difference between a domain_admin and project_admin in policy. | 20:36 |
| gyee | for v3 policy we do | 20:36 |
| raildo | gyee, ++ | 20:36 |
| *** e0ne has joined #openstack-keystone | 20:36 | |
| raildo | and this is way merge this two assignment for the same entity is not a problem (when we use the policy in the correct way, like in v3 policy) | 20:37 |
| *** itlinux has joined #openstack-keystone | 20:37 | |
| raildo | s/way/why | 20:38 |
| gyee | raildo, if we are returning both project_id and domain_id in the scope, it will be problematic | 20:38 |
| samueldmq | dolphm, morganfainberg hi, sorry was afk | 20:39 |
| samueldmq | yes I am starting on that list again now :) | 20:39 |
| morganfainberg | Cool | 20:39 |
| raildo | but it's the same id. I can see only one "problem" that we have with this, handle with a previous domain as a project. | 20:39 |
| samueldmq | but I will need you to check the info I put there | 20:39 |
| morganfainberg | About to get in the air. | 20:39 |
| morganfainberg | I'll be back in la at like 10pm pacific | 20:40 |
| morganfainberg | So I'll go through all the notes when I am home before going to bed. | 20:40 |
| morganfainberg | Feel free to sync them to the wiki page (if you have access) | 20:40 |
| samueldmq | morganfainberg, k, so about ~11pm or so I guess | 20:40 |
| morganfainberg | Else I'll do it tonight. | 20:40 |
| morganfainberg | Yah. | 20:40 |
| *** rlt_ has quit IRC | 20:40 | |
| morganfainberg | Ok see ya later. | 20:40 |
| samueldmq | morganfainberg, Ok will do, I will sync up with dolphm thanks | 20:40 |
| samueldmq | morganfainberg, see you :) | 20:41 |
| * morganfainberg goes afk for ~6hrs | 20:41 | |
| samueldmq | dolphm, I put N/A for things I think it is not worth it do put in the release ntoes | 20:41 |
| gyee | raildo, there's my issue, I get a "dual-scoped" token from keystone and I hit Swift with it | 20:42 |
| samueldmq | dolphm, and a small explanation on why I think so | 20:42 |
| gyee | Swift see a project-scoped token and happily provision the account for me | 20:42 |
| gyee | but I don't ever intend to do anything with that account as it is meant for identity management | 20:42 |
| samueldmq | stevemar, yeah, release notes on that link, me and dolphm started that etherpad to iterate faster | 20:42 |
| gyee | right now if I hit Swift with a domain-scoped token, Swift will tell me to f off | 20:44 |
| raildo | gyee, I can't to this, if my role don't enforce this actions, even I have a token. if a domain_admin can't create instances, for example, even I have a token for Nova, I can't do this action. | 20:44 |
| *** e0ne has quit IRC | 20:44 | |
| *** mtreinish_ has joined #openstack-keystone | 20:45 | |
| gyee | domain admin is not suppose to do anything with the services | 20:45 |
| raildo | gyee, what I want to say is can be a problem for bad use for policies, this is just the consequence. | 20:46 |
| gyee | raildo, its not really about policies, its how services are treating the scope right now | 20:47 |
| gyee | project scope = owner or admin | 20:47 |
| gyee | domain scope = access denied | 20:47 |
| gyee | raildo, food time, be back in a few | 20:48 |
| raildo | gyee, np, we can talk later about this :) | 20:48 |
| *** mtreinish has quit IRC | 20:51 | |
| *** mtreinish_ is now known as mtreinish | 20:51 | |
| *** joesavak has quit IRC | 20:53 | |
| ayoung | bknudson, I talked with Simo. He's implementing a lot more of the standard than the pyjwt project does so far...key exchange and so forth, not just message signing. I think there is a real potential for working together. | 20:54 |
| bknudson | ayoung: nice. | 20:54 |
| bknudson | the jwt page showed that the pyjwt didn't implement everything. | 20:55 |
| stevemar | did my part for the release notes | 20:56 |
| stevemar | \o/ | 20:56 |
| dstanek | stevemar: ! | 20:57 |
| *** raildo has quit IRC | 20:58 | |
| *** iamjarvo has quit IRC | 20:58 | |
| stevemar | dstanek, ahoy | 21:01 |
| dstanek | stevemar: looks like your rocking it again! | 21:01 |
| stevemar | i am? | 21:01 |
| dstanek | stevemar: everytime i get to a review it looks like you were already there | 21:02 |
| *** csoukup has quit IRC | 21:02 | |
| stevemar | the trick is to do the easy ones | 21:02 |
| *** iamjarvo has joined #openstack-keystone | 21:06 | |
| *** iamjarvo has quit IRC | 21:06 | |
| *** iamjarvo has joined #openstack-keystone | 21:07 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/178415 | 21:11 |
| samueldmq | stevemar, is it worth it to put this on the release note s? (https://bugs.launchpad.net/keystone/+bug/1426128) | 21:11 |
| openstack | Launchpad bug 1426128 in Keystone "Add ECP related bits to saml generation code" [Wishlist,Fix released] - Assigned to Steve Martinelli (stevemar) | 21:11 |
| samueldmq | stevemar, Add ECP related bits to saml generation code | 21:11 |
| samueldmq | stevemar, does it impact deployers / end users ? | 21:11 |
| stevemar | samueldmq, probably not worth it | 21:12 |
| samueldmq | stevemar, k got it | 21:13 |
| *** ajayaa has quit IRC | 21:13 | |
| samueldmq | stevemar, it only ease the job for the client | 21:13 |
| *** iamjarvo has quit IRC | 21:14 | |
| samueldmq | stevemar, by creating the ecp wrapped saml assertion | 21:14 |
| *** itlinux has quit IRC | 21:14 | |
| samueldmq | stevemar, right ? otherwise it would be done by the client .. | 21:14 |
| samueldmq | stevemar, what does not impact the user, looks as a refactoring | 21:15 |
| samueldmq | dolphm, almost done for that list | 21:17 |
| samueldmq | dolphm, it remains only 11 bps on kilo-3 and 2 bps in kilo-rc1 | 21:17 |
| samueldmq | dolphm, wishlist bugs are done | 21:18 |
| samueldmq | dolphm, I need to go afk for a bit | 21:18 |
| dolphm | samueldmq: holy crap, nicely done | 21:18 |
| *** arif-ali has joined #openstack-keystone | 21:19 | |
| samueldmq | dolphm, thanks, just trying to help things moving :-) | 21:21 |
| samueldmq | will be back in about 2-3 hours | 21:21 |
| *** samueldmq has quit IRC | 21:21 | |
| *** pnavarro has quit IRC | 21:28 | |
| *** Rockyg has quit IRC | 21:30 | |
| *** nkinder has joined #openstack-keystone | 21:33 | |
| *** stevemar has quit IRC | 21:36 | |
| *** harlowja is now known as harlowja_away | 21:36 | |
| *** harlowja_away is now known as harlowja | 21:37 | |
| *** mattfarina has joined #openstack-keystone | 21:40 | |
| *** mattfarina has quit IRC | 21:40 | |
| *** csoukup has joined #openstack-keystone | 21:59 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change auth_token to use keystoneclient https://review.openstack.org/144248 | 22:05 |
| *** dguerri is now known as _dguerri | 22:18 | |
| *** itlinux has joined #openstack-keystone | 22:22 | |
| *** itlinux has left #openstack-keystone | 22:24 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Adapter expects a tuple https://review.openstack.org/178866 | 22:38 |
| *** c_soukup has joined #openstack-keystone | 22:38 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Adapter version is a tuple https://review.openstack.org/178866 | 22:38 |
| *** csoukup has quit IRC | 22:42 | |
| *** bknudson has quit IRC | 22:46 | |
| *** gordc has quit IRC | 22:46 | |
| *** josecastroleon has joined #openstack-keystone | 22:46 | |
| *** josecastroleon has quit IRC | 22:48 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Adapter version is a tuple https://review.openstack.org/178866 | 22:49 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/178414 | 22:49 |
| openstackgerrit | Merged openstack/keystone: Refactor assignment driver internal clean-up method names https://review.openstack.org/169169 | 22:54 |
| *** Raildo has joined #openstack-keystone | 22:57 | |
| *** rm_work is now known as rm_work|away | 22:58 | |
| *** Raildo is now known as raildo | 23:00 | |
| raildo | dstanek, can you review this patch later? :) https://review.openstack.org/158720 | 23:04 |
| jamielennox | gyee: https://review.openstack.org/#/c/174668/ | 23:05 |
| jamielennox | i think one of my goals for summit is to force at least 2 cores to sit down while i go through all my client patches | 23:06 |
| *** tqtran_ has joined #openstack-keystone | 23:07 | |
| *** tqtran_ is now known as tqtran | 23:07 | |
| jamielennox | morganfainberg: nice! can we have a feature branch for ksc that has a dep on ksa? | 23:10 |
| openstackgerrit | Merged openstack/keystone: eventlet now supports Python3 https://review.openstack.org/177406 | 23:11 |
| *** c_soukup has quit IRC | 23:19 | |
| gyee | jamielennox, thank you!!!!!!!!!!!!!!!!!!!!!!!!! | 23:20 |
| jamielennox | gyee: i think that was a week or two ago | 23:20 |
| *** Rockyg has joined #openstack-keystone | 23:20 | |
| jamielennox | gyee: i did a whole branch there so you can filter the catalog based on endpoint_id or service_id | 23:20 |
| gyee | damn, I need to keep up with the reviews | 23:21 |
| jamielennox | i feel kind of bad about picking through david's review so much, as when the global-requirements catch up we can replace all his good auth_token endpoint_id filtering work with | 23:21 |
| *** Raildo_ has joined #openstack-keystone | 23:21 | |
| jamielennox | if auth_ref.service_catalog.filter(endpoint_id=self._endpoint_id, service_id=self._service_id) | 23:21 |
| jamielennox | or url_for i think it's called | 23:22 |
| gyee | jamielennox, I am working on a patch to use oslo policy to enforce endpoint constraint, I feel like that functionality should be part of endpoint filter | 23:22 |
| gyee | what do ya think? | 23:22 |
| jamielennox | constraint like service_id or endpoint_id? | 23:23 |
| gyee | so we can do endpoint filter based on a rule | 23:23 |
| gyee | right | 23:23 |
| jamielennox | hmm, i don't know how you put that in policy | 23:23 |
| gyee | like, "service_id:12345 or region:abc" | 23:23 |
| jamielennox | you'd need to submit the whole service catalog | 23:23 |
| gyee | jamielennox, https://review.openstack.org/#/c/177661/ | 23:24 |
| gyee | this patch basically enforces endpoint constraint based on a given rule | 23:24 |
| gyee | I am trying to do the unit tests using the keystoneclient fixture | 23:25 |
| *** raildo has quit IRC | 23:25 | |
| gyee | right now I am adding the endpoint_id and service_id after I created the catalog | 23:25 |
| gyee | I can remove that code after your patches are landed | 23:25 |
| *** packet has quit IRC | 23:25 | |
| jamielennox | how does this relate to the existing review? | 23:26 |
| gyee | because I need to 'id' in the fixture so I can test the enforcement | 23:26 |
| *** Raildo_ has quit IRC | 23:27 | |
| jamielennox | and i guess do you have a need for the more complicated matching | 23:27 |
| jamielennox | like region based, because region in the catalog is kind of funny | 23:27 |
| gyee | yes, with rule, we can match anything in the endpoint | 23:28 |
| gyee | interface, url, etc | 23:29 |
| openstackgerrit | Merged openstack/keystone: pycadf now supports Python3 https://review.openstack.org/177407 | 23:45 |
| *** dims has quit IRC | 23:50 | |
| *** chlong has joined #openstack-keystone | 23:50 | |
| openstackgerrit | Merged openstack/keystone: Fixes mocking of oslo messaging for Python3 https://review.openstack.org/177408 | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!