| *** Nikkau has quit IRC | 00:00 | |
| *** hemna is now known as hemnafkj | 00:09 | |
| *** geoffarnold has quit IRC | 00:19 | |
| *** samleon has quit IRC | 00:19 | |
| *** gyee has quit IRC | 00:23 | |
| *** jaypipes has quit IRC | 00:27 | |
| *** iamjarvo has joined #openstack-keystone | 00:28 | |
| *** iamjarvo has quit IRC | 00:28 | |
| *** iamjarvo has joined #openstack-keystone | 00:29 | |
| *** iamjarvo has quit IRC | 00:29 | |
| *** iamjarvo has joined #openstack-keystone | 00:29 | |
| *** iamjarvo has quit IRC | 00:30 | |
| *** iamjarvo has joined #openstack-keystone | 00:31 | |
| *** iamjarvo has quit IRC | 00:31 | |
| *** iamjarvo has joined #openstack-keystone | 00:32 | |
| *** roxanaghe has quit IRC | 00:36 | |
| *** gordc has joined #openstack-keystone | 00:43 | |
| *** bknudson has joined #openstack-keystone | 00:43 | |
| *** ChanServ sets mode: +v bknudson | 00:43 | |
| *** dsirrine has quit IRC | 00:48 | |
| *** SaintAardvark has quit IRC | 00:49 | |
| *** blewis has quit IRC | 00:55 | |
| *** dsirrine has joined #openstack-keystone | 01:03 | |
| *** zzzeek has quit IRC | 01:04 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove setUp for RevokeTests https://review.openstack.org/179259 | 01:05 |
|---|---|---|
| samueldmq | jamielennox, hi, you around ? | 01:13 |
| samueldmq | jamielennox, I saw a message from you telling you got devstack + v3 working | 01:13 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Common base class for unit tests https://review.openstack.org/187770 | 01:15 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Unit tests catch deprecated function usage https://review.openstack.org/187775 | 01:15 |
| *** openstack has joined #openstack-keystone | 01:21 | |
| *** roxanaghe has joined #openstack-keystone | 01:22 | |
| *** dan_ has joined #openstack-keystone | 01:22 | |
| *** henriquetruta has joined #openstack-keystone | 01:22 | |
| *** roxanaghe has quit IRC | 01:22 | |
| *** roxanaghe has joined #openstack-keystone | 01:22 | |
| *** dan_ is now known as Guest32428 | 01:22 | |
| *** Kennan has joined #openstack-keystone | 01:22 | |
| *** diabloneo has joined #openstack-keystone | 01:26 | |
| *** openstack has joined #openstack-keystone | 01:36 | |
| *** dan| has joined #openstack-keystone | 01:36 | |
| *** _cjones_ has quit IRC | 01:40 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Let `region` field be effective both in the testcase and API https://review.openstack.org/167534 | 01:41 |
| *** iamjarvo has quit IRC | 01:42 | |
| jamielennox | samueldmq: i am here | 01:44 |
| jamielennox | samueldmq: i found a way to get the devstack run to complete with v3 only | 01:45 |
| jamielennox | that's not the same as having tempest and everything done | 01:45 |
| samueldmq | jamielennox, oh really ? great !! | 01:45 |
| jamielennox | but it means we can at least start testing | 01:45 |
| samueldmq | jamielennox, how is that ? | 01:45 |
| jamielennox | umm, it needs a new version of OSC which they are just waiting for a g-r bump before releasing | 01:45 |
| jamielennox | after that you do: https://review.openstack.org/#/q/status:open+project:openstack-dev/devstack+branch:master+topic:keystonev3,n,z | 01:46 |
| jamielennox | and one or two other little fixes i haven't worked into patches yet | 01:46 |
| samueldmq | jamielennox, great, I will be looking at those ^ on devstack tomorrow | 01:47 |
| samueldmq | jamielennox, I am happy you're making a good progress, good job :) | 01:47 |
| jamielennox | samueldmq: cheers, thanks for the help | 01:47 |
| *** boris-42 has quit IRC | 01:48 | |
| samueldmq | jamielennox, np; glad to have helped | 01:48 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Move bandit requirement to test-requirements.txt https://review.openstack.org/188227 | 01:49 |
| samueldmq | jamielennox, hopefully I will have some time to help on the project specific fixes .. but I have been very busy on the policy stuff | 01:49 |
| *** fangzhou has quit IRC | 01:49 | |
| *** openstack has quit IRC | 01:52 | |
| *** openstack has joined #openstack-keystone | 01:53 | |
| jamielennox | samueldmq: np, once we get to the project specific stuff we can split it up more easily | 01:54 |
| samueldmq | jamielennox, ++ sure | 01:54 |
| *** davidchep has quit IRC | 01:54 | |
| *** spandhe has quit IRC | 01:54 | |
| samueldmq | ayoung, jamielennox https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L1132-L1135 | 01:56 |
| samueldmq | ayoung, jamielennox is this the entry point in the ksmiddleware, right ? | 01:56 |
| jamielennox | samueldmq: no, filter_factory above it | 01:57 |
| jamielennox | app_factory is terminal so it acts like an application, filter_factory makes it middlewarew | 01:57 |
| samueldmq | jamielennox, nice .. I wonder if for the policy fetch thing | 01:57 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: tox env for Bandit https://review.openstack.org/182912 | 01:57 |
| samueldmq | jamielennox, it shouldnt be something similar | 01:58 |
| samueldmq | jamielennox, and then it should return auth_filter, policy_filter (or something that represents both) | 01:58 |
| jamielennox | samueldmq: that is where ayoung is thinking, i don't know | 01:58 |
| *** iamjarvo has joined #openstack-keystone | 02:00 | |
| samueldmq | jamielennox, for each request, if the policy cache has reach the timeout, invalidate and fetch it again | 02:00 |
| *** iamjarvo has quit IRC | 02:00 | |
| samueldmq | jamielennox, or is there a mechanism to get notified from the os when a given timeout is reached ? | 02:00 |
| *** iamjarvo has joined #openstack-keystone | 02:00 | |
| *** iamjarvo has quit IRC | 02:00 | |
| ayoung | ideally it would be based on the HTTP headers timeout | 02:00 |
| samueldmq | ayoung, yes, it keeps the last time it has updated it | 02:01 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: tox env for Bandit https://review.openstack.org/182912 | 02:01 |
| *** packet has quit IRC | 02:01 | |
| *** iamjarvo has joined #openstack-keystone | 02:01 | |
| samueldmq | ayoung, and based on the timeout the http header is telling it | 02:01 |
| ayoung | we do stuff like this with the revocation list | 02:01 |
| samueldmq | ayoung, it should decide if fetch or wait | 02:01 |
| ayoung | samueldmq, jamielennox so gyee had the suggestion that we put a hash of the policy file into the token data. I kindof like that idea | 02:02 |
| samueldmq | ayoung, makes sense ? ^ (I thing it's what you said) | 02:02 |
| samueldmq | ayoung, do you have an entry point to that code? | 02:02 |
| jamielennox | samueldmq: there are some issues there, like if you have a bunch of different worker processes the timeout will be different for each | 02:02 |
| ayoung | jamielennox, stampeding herd? | 02:02 |
| jamielennox | ayoung: yea, we've discussed that one before, we had the same discusssion around revocation events | 02:03 |
| samueldmq | jamielennox, from getting from the os ? | 02:03 |
| ayoung | or not worried about that? | 02:03 |
| ayoung | yeah | 02:03 |
| ayoung | jamielennox, can you think of any reason not to put the hash of the policy file in the token? | 02:03 |
| *** radez is now known as radez_g0n3 | 02:04 | |
| samueldmq | ayoung, it depends whether the policies will be stored on keystone or not | 02:04 |
| samueldmq | ayoung, keystone needing to query other service each time it needs to issue a token shoudn't be desired | 02:05 |
| ayoung | samueldmq, if we put the (id) hash of the policy in the token, it will be stored in Keystone | 02:05 |
| ayoung | keystone will still be the service of record for policy, or we will have some way of finding it | 02:05 |
| *** packet has joined #openstack-keystone | 02:05 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Don't query db if criteria longer than col length https://review.openstack.org/163949 | 02:05 |
| samueldmq | ayoung, makes sense, but this shouldn't be the decision criteria on keeping/splitting policy management/storage in keystone | 02:06 |
| samueldmq | ayoung, but I support this is a great idea to be considered | 02:06 |
| samueldmq | ayoung, I liked it | 02:06 |
| ayoung | samueldmq, it gives us a really powerful tool to provide more fine grained policies in the future | 02:06 |
| jamielennox | ayoung: assuming that you won't update policy much the only thing i can see is you have to be careful about caching | 02:07 |
| ayoung | people were requesting project specific policies etc. | 02:07 |
| diabloneo | Hi, everyone, I notice that Jenkins gate-keystone-python27 failed in my changes, failed on many unit testcases. Any one know why? | 02:07 |
| ayoung | jamielennox, the reason I want it as a hash is so we know if it has changed...a given policy should be immutable | 02:07 |
| *** diabloneo is now known as Chenhong | 02:07 | |
| ayoung | Chenhong, look in the logs | 02:07 |
| samueldmq | ayoung, so that bings the policy with any resource you want to ? | 02:07 |
| ayoung | Chenhong, if you oprovide a link, I can show you where to look | 02:08 |
| ayoung | bings? | 02:08 |
| ayoung | binds or brings? | 02:08 |
| samueldmq | ayoung, if a new policy hash arrives and I don't have it, fetch that | 02:08 |
| samueldmq | ayoung, bind | 02:08 |
| ayoung | samueldmq, exactly | 02:08 |
| jamielennox | ayoung: right - but you don't get an ordering from a hash, i just mean you wouldn't know about policy changes for tokens you fetch from cache | 02:08 |
| samueldmq | sorry | 02:08 |
| Chenhong | https://review.openstack.org/#/c/187511/ | 02:08 |
| samueldmq | ayoung, oh | 02:08 |
| ayoung | jamielennox, right | 02:08 |
| Chenhong | Thanks, I am reading the log | 02:08 |
| jamielennox | and you have a bit of an issue for PKI because if we embed it in the token there's no way to know which one is newer | 02:09 |
| samueldmq | ayoung, that definitely makes a lot of sense | 02:09 |
| ayoung | jamielennox, but...if new tokens come in with new policies hashes, we could use that as an excuse to invalidate the cache and revalidate the tokens....or we accept that the will always be the potential for delay when making policy changes | 02:09 |
| ayoung | jamielennox, true | 02:09 |
| samueldmq | ayoung, after we will need to think about policies subsets .. to expose only what make sense to domain admins (per domain policy) or project admins, for example | 02:10 |
| samueldmq | ayoung, they don't need to see POST /endpoint, for example | 02:10 |
| ayoung | samueldmq, you mean domain admins don't need to be able to create new endpoints...depends on who you talk to, but by default, sure. | 02:11 |
| openstackgerrit | Merged openstack/keystone: Rename driver to backend and fix the inaccurate docstring https://review.openstack.org/172329 | 02:11 |
| samueldmq | ayoung, cloud admin should define what domain admins can see | 02:12 |
| samueldmq | ayoung, and domain admins what project admins see | 02:12 |
| samueldmq | ayoung, something like that | 02:12 |
| ayoung | samueldmq, yep something like that | 02:12 |
| samueldmq | :) | 02:12 |
| samueldmq | ayoung, I will start looking at filter thing in the middleware | 02:13 |
| ayoung | samueldmq, I'll write up the "policy id in the token" spec | 02:13 |
| samueldmq | ayoung, to create a policy_filter, is that the correct approach, tight ? | 02:13 |
| samueldmq | ayoung, policy id ? isn't that hash ? | 02:14 |
| ayoung | jamielennox, cache issues with pki aside, do you think it is a good approach? | 02:14 |
| samueldmq | ayoung, https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L1122-L1129 | 02:14 |
| jamielennox | ayoung: i certainly think it's the easiest way to signal middleware | 02:14 |
| jamielennox | as you say we may have like thundering herd issues | 02:14 |
| ayoung | jamielennox, it does mean that one policy file will have to be able to handle two or more endpoints at once. WIth Chadwicks code, that should be easy. | 02:15 |
| jamielennox | multiple endpoints? | 02:15 |
| ayoung | And, just because we don't put a specific endpoint in the service catalog doesn;'t mean its policy rules can't be in the policy file... | 02:15 |
| jamielennox | oh - it means we will have trouble with domain specific policies | 02:16 |
| jamielennox | but i'm not convinced we want to do that anyway | 02:16 |
| ayoung | jamielennox, I was thinking of the case where we create a token with only, say one of the endpoints specified, but the policy file would cover all of the endpoints in the service catalog. With the "fetch by endpoint URL" approach, we know what service we are serving for | 02:16 |
| jamielennox | (ditto domain specific roles) | 02:16 |
| ayoung | I mean more that we need to resolve the issues with sdague on unified policy file | 02:16 |
| ayoung | domain and project specific can come later. They can use the same mechanism, if we go with policy id in the token, but not if we cache by time | 02:17 |
| ayoung | Chenhong, there is nothing wrong with asking here, as opposed to a Private message | 02:17 |
| ayoung | Chenhong, looking at http://logs.openstack.org/11/187511/2/check/gate-keystone-python27/ed282ef/console.html | 02:17 |
| ayoung | Chenhong, you can't compare the numeric code that comes back from a web request with an exception | 02:19 |
| ayoung | ah...but you are not... | 02:19 |
| ayoung | doesn;'t look like it was your change at fault...hmmmm | 02:20 |
| ayoung | Chenhong, I assume tox passed when you ran it on your system? | 02:22 |
| Chenhong | Yes, tox was passed | 02:22 |
| ayoung | Chenhong, The change looks like something is treating a Deprecation warning as an error, I wonder if that is spurious...almost tempted to to a recheck just to be sure | 02:22 |
| ayoung | but before we do... | 02:22 |
| ayoung | seems to be failijng consistantly. | 02:23 |
| Chenhong | ayoung, It was rechecked, but still failed as you can see it in the comment. That's what confuse me. | 02:25 |
| ayoung | Chenhong, yeah. and the thing that is breaking is not AFAICT due to your code | 02:25 |
| *** nkinder_ has quit IRC | 02:27 | |
| Chenhong | I noticed some other change encouter the same problem, like this one http://logs.openstack.org/31/188131/1/check/gate-keystone-python27/c0f6593/console.html | 02:30 |
| *** geoffarnold has joined #openstack-keystone | 02:30 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Drop py2.6 support for keystone middleware https://review.openstack.org/187015 | 02:31 |
| openstackgerrit | Merged openstack/keystonemiddleware: Removes discover from test-reqs https://review.openstack.org/171516 | 02:32 |
| *** geoffarnold_ has joined #openstack-keystone | 02:32 | |
| openstackgerrit | Merged openstack/keystone: Run WSGI with group=keystone https://review.openstack.org/187800 | 02:32 |
| *** iamjarvo_ has joined #openstack-keystone | 02:37 | |
| *** iamjarvo_ has quit IRC | 02:37 | |
| *** iamjarvo_ has joined #openstack-keystone | 02:37 | |
| *** nkinder_ has joined #openstack-keystone | 02:39 | |
| *** tqtran has quit IRC | 02:39 | |
| *** bknudson has quit IRC | 02:39 | |
| *** iamjarvo has quit IRC | 02:40 | |
| ayoung | Chenhong, I don't get it either. Something else must have changed | 02:40 |
| ayoung | Chenhong, that being said, I don't think I agree with your reason for the patch. The error codes are the HTTP standards, and I thin we want to check for those values exactly, not hte constants we define. Usually, I would agree with you that we should favor a symbollic constant over a magic number, but these numbers actually means something | 02:42 |
| *** richm has quit IRC | 02:43 | |
| *** iamjarvo_ has quit IRC | 02:46 | |
| Chenhong | ayoung, I know what you mean. 403 or Forbidden.code can both work, I just pick up a more readable way. I also noticeed that, there are so many codes write '200 OK' directly. Is it good to use a symbolic constant instead? | 02:47 |
| ayoung | Chenhong, yes 200 OK should be generated from a symbollic constant | 02:48 |
| ayoung | Chenhong, I think there is something different about generating them than checking the values in tests | 02:48 |
| *** lihkin has joined #openstack-keystone | 02:49 | |
| Chenhong | ayoung, Does that mean keystone prefer to use explicitly status code 403 in tests than symbolic constant, and prefer to use symbolic constant about status code in non-tests code? | 02:55 |
| ayoung | Chenhong, that sounds right | 02:55 |
| *** henriquetruta has quit IRC | 02:56 | |
| Chenhong | ayount, thanks, I understood. | 02:56 |
| samueldmq | ayoung, does it sounds correct to you that I start on the filter thing in the ksmiddleware? | 02:56 |
| ayoung | samueldmq, yes | 02:56 |
| samueldmq | ayoung, https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L1122-L1129 | 02:56 |
| ayoung | Chenhong, your welcome, and thanks for contributing. Hope this was not too big a demotivator | 02:56 |
| samueldmq | ayoung, great I will start a patch tomorrow, I need to sleep now | 02:57 |
| samueldmq | good night for you all :) | 02:57 |
| ayoung | samueldmq, does not *need* to be in there, but something like that...it might make sense to have it there, just make it a one liner we can move around as we get better understanding | 02:57 |
| Chenhong | ayoung, it's find, I just new to openstack and keystone, and I still trying to find out some convention. Thanks for your help. | 02:58 |
| samueldmq | ayoung, ok .. as per my current understanding, that should be another filter (policy_filter) | 02:58 |
| Chenhong | fine | 02:58 |
| *** stevemar has joined #openstack-keystone | 02:58 | |
| *** ChanServ sets mode: +v stevemar | 02:58 | |
| samueldmq | ayoung, then that method register both, or something that include both | 02:58 |
| ayoung | samueldmq, no, not a filter for Policy. it is a registration of a stevedore component that will be used later inside the oslo.policy library | 02:59 |
| ayoung | and the registration can happen from ATM, I think | 02:59 |
| samueldmq | ayoung, ok I will take a look tomorrow, since we are good with the /policies?endpoint_url thing | 03:01 |
| samueldmq | ayoung, we can discuss tomorrow then | 03:01 |
| samueldmq | ayoung, but wait ... oslo policy is doing enforcement ... so what you want is to, before enforcing a given rule, check for policy and update if necessary | 03:03 |
| ayoung | samueldmq, lets talk tomorrow | 03:04 |
| samueldmq | ayoung, yes, I need to sleep | 03:04 |
| samueldmq | see you | 03:04 |
| *** alanf-mc has quit IRC | 03:04 | |
| *** samueldmq has quit IRC | 03:04 | |
| *** spandhe has joined #openstack-keystone | 03:04 | |
| *** spandhe has quit IRC | 03:07 | |
| *** dims_ has quit IRC | 03:07 | |
| *** geoffarn_ has joined #openstack-keystone | 03:07 | |
| *** lhcheng has quit IRC | 03:08 | |
| *** geoffarn_ has quit IRC | 03:08 | |
| openstackgerrit | ayoung proposed openstack/keystone: IAM Models https://review.openstack.org/184651 | 03:10 |
| *** markvoelker has quit IRC | 03:23 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove deprecated external authentication plugins https://review.openstack.org/125701 | 03:24 |
| *** spandhe has joined #openstack-keystone | 03:25 | |
| *** _cjones_ has joined #openstack-keystone | 03:28 | |
| *** dsirrine has quit IRC | 03:29 | |
| *** _cjones_ has quit IRC | 03:29 | |
| *** _cjones_ has joined #openstack-keystone | 03:30 | |
| openstackgerrit | Merged openstack/keystone: Remove the deprecated ec2 token middleware https://review.openstack.org/185509 | 03:32 |
| *** lhcheng has joined #openstack-keystone | 03:32 | |
| *** ChanServ sets mode: +v lhcheng | 03:32 | |
| openstackgerrit | Merged openstack/keystone: Fix the wrong order of parameters when using assertEqual https://review.openstack.org/187869 | 03:32 |
| *** alanf-mc has joined #openstack-keystone | 03:34 | |
| *** davechen_afk is now known as davechen | 03:44 | |
| *** tobe has joined #openstack-keystone | 03:51 | |
| *** EmilienM|off has quit IRC | 03:55 | |
| *** EmilienM has joined #openstack-keystone | 04:00 | |
| *** gordc has quit IRC | 04:03 | |
| *** dims_ has joined #openstack-keystone | 04:07 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Add testcases of list_role_assignments of v3 domains https://review.openstack.org/187899 | 04:09 |
| *** dims_ has quit IRC | 04:13 | |
| *** krotscheck has quit IRC | 04:19 | |
| *** mordred has quit IRC | 04:21 | |
| *** markvoelker has joined #openstack-keystone | 04:23 | |
| *** mordred has joined #openstack-keystone | 04:25 | |
| *** krotscheck has joined #openstack-keystone | 04:25 | |
| *** markvoelker has quit IRC | 04:28 | |
| *** Chenhong has quit IRC | 04:40 | |
| *** rushiagr_away is now known as rushiagr | 04:42 | |
| *** csoukup has joined #openstack-keystone | 04:48 | |
| *** Chenhong has joined #openstack-keystone | 04:56 | |
| *** csoukup has quit IRC | 04:58 | |
| *** roxanaghe has quit IRC | 04:59 | |
| *** kiran-r has joined #openstack-keystone | 05:00 | |
| *** stevemar has quit IRC | 05:04 | |
| *** csoukup has joined #openstack-keystone | 05:14 | |
| *** csoukup has quit IRC | 05:19 | |
| *** alanf-mc has quit IRC | 05:19 | |
| *** alanf-mc has joined #openstack-keystone | 05:20 | |
| *** tobe has quit IRC | 05:22 | |
| *** fangzhou has joined #openstack-keystone | 05:22 | |
| *** tobe has joined #openstack-keystone | 05:40 | |
| *** henrynash has joined #openstack-keystone | 05:40 | |
| *** ChanServ sets mode: +v henrynash | 05:40 | |
| *** ajayaa has joined #openstack-keystone | 05:47 | |
| ajayaa | Hi guys. Is there an api in v3 using which I can verify s3 credential? | 05:47 |
| ajayaa | marekd, jamielennox ^^ | 05:47 |
| jamielennox | ajayaa: not afaik | 05:48 |
| jamielennox | well there is the s3 middleware but i think it's only v2 api | 05:49 |
| ajayaa | So the alternative is to use v2.0/s3tokens, right? | 05:49 |
| jamielennox | but i don't really know how s3 works in that anyway | 05:49 |
| ajayaa | The middleware just takes the access and secret to Keystone and Keystone replies with the usual info, afaik. | 05:50 |
| *** Chenhong has quit IRC | 05:50 | |
| ajayaa | Can it be added to Keystone, so that dependency on v2.0 is completely removed? | 05:51 |
| ajayaa | If I propose a spec or bug and work on it! | 05:51 |
| jamielennox | ajayaa: i assume it's doable. personally i would like to hear from the swift team that they want it | 05:51 |
| *** alanf-mc has quit IRC | 05:51 | |
| jamielennox | afaik no-one was using it | 05:51 |
| ajayaa | jamielennox, I am working on integrating ceph with Keystone. | 05:52 |
| *** spandhe_ has joined #openstack-keystone | 05:52 | |
| ajayaa | So, we need an api in v3 which can verify s3 tokens. | 05:52 |
| *** spandhe has quit IRC | 05:52 | |
| *** spandhe_ is now known as spandhe | 05:52 | |
| jamielennox | ajayaa: why s3 tokens? why wouldn't you use keystone tokens? | 05:52 |
| ajayaa | ceph provides both s3 apis and swift apis. | 05:53 |
| ajayaa | s3 apis work with amazon credentials. | 05:53 |
| ajayaa | jamielennox ^^ | 05:53 |
| ajayaa | Swift apis work with Keystone tokens, so that's not a problem anyway. | 05:53 |
| jamielennox | ajayaa: but you want to be able to mix and match those things? | 05:53 |
| *** fangzhou has quit IRC | 05:53 | |
| ajayaa | jamielennox, sort of. We need both swift and s3 apis in our cloud. | 05:54 |
| jamielennox | are you trying to use keystone as a s3 credential store or are you trying to sign swift requests with s3 tokens | 05:54 |
| jamielennox | (or both) | 05:55 |
| ajayaa | the first one for sure. Not sure if I understand the second point. | 05:56 |
| *** belmoreira has joined #openstack-keystone | 05:56 | |
| *** lhcheng has quit IRC | 05:56 | |
| jamielennox | the second part is being able to use s3 credentials for swift calls | 05:57 |
| *** _cjones_ has quit IRC | 05:57 | |
| jamielennox | anyway, i think i might be getting confused | 05:57 |
| ajayaa | jamielennox, nope. | 05:57 |
| *** josecastroleon has joined #openstack-keystone | 05:57 | |
| ajayaa | There are two kinds of apis in ceph. The first is s3 api calls and second is swift api calls. | 05:58 |
| jamielennox | ok | 05:58 |
| ajayaa | s3 apis use amazon credentials and swift apis use vanila Keystone tokens. | 05:58 |
| ajayaa | So swift apis are not a problem with Keystone v3 because v3 provides a way to validate a vanilla token. | 05:59 |
| ajayaa | But Keystone v3 does not provide a way to validate amazon credentials. | 05:59 |
| ajayaa | So for this single thing, we are still persisting with v2.0 api in Keystone. | 06:00 |
| ajayaa | What I want is to completely remove v2.0 api from our Keystone deployment. | 06:00 |
| jamielennox | so it provides a v3 way of authenticating ec2 tokens (which i'm not sure how they differ) | 06:00 |
| ajayaa | jamielennox ^^ | 06:00 |
| ajayaa | Who provides? | 06:00 |
| ajayaa | Keystone? afaik, it does not and there is no documentation regarding it. | 06:01 |
| ajayaa | https://github.com/openstack-attic/identity-api/blob/master/v3/src/markdown/identity-api-v3.md | 06:01 |
| jamielennox | ajayaa: well i don't like the fact that it provides it at all and it's poorly done | 06:01 |
| *** _cjones_ has joined #openstack-keystone | 06:01 | |
| jamielennox | but https://github.com/openstack/keystone/blob/master/keystone/contrib/ec2/routers.py#L64 is in v3 by default | 06:02 |
| ajayaa | Let me check | 06:02 |
| jamielennox | oh joy https://github.com/openstack/keystone/blob/master/etc/keystone-paste.ini#L82 | 06:02 |
| *** Chenhong has joined #openstack-keystone | 06:02 | |
| jamielennox | s3 is in there as well | 06:02 |
| jamielennox | ajayaa: that's good for you and makes me a little sad | 06:02 |
| jamielennox | https://github.com/openstack/keystone/blob/master/keystone/contrib/s3/core.py#L54 | 06:03 |
| ajayaa | jamielennox, maybe you can give me some idea on why you think it's poorly done. | 06:03 |
| ajayaa | I will fix it and make it right. :) | 06:04 |
| jamielennox | so it looks like /v3/s3tokens will exist in a default keystone install | 06:04 |
| jamielennox | ajayaa: i went through this with ec2 recently | 06:04 |
| jamielennox | there is no attempt to make it better or really test it from v2 | 06:04 |
| jamielennox | for example the parameters are all called tenant_id in v3 | 06:04 |
| jamielennox | something we otherwise absolutely banished | 06:04 |
| ajayaa | we need that to be project_id or something like that. | 06:05 |
| jamielennox | at least | 06:05 |
| jamielennox | otherwise i guess i just don't like that keystone is trying to emulate those other formats | 06:05 |
| jamielennox | ajayaa: so it looks like you've got the server side already, you just need to update https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/s3_token.py to make it work with v3 | 06:07 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/186279 | 06:07 |
| ajayaa | jamielennox, But if Openstack needs compatibility with amazon then we would need to map other formats to Keystone token format. | 06:07 |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Fix SCRIPT_NAME computation. https://review.openstack.org/188269 | 06:07 |
| jamielennox | ajayaa: that is a philosophical question - i would argue why does openstack want to be compatible with amazon | 06:08 |
| *** Nikkau has joined #openstack-keystone | 06:08 | |
| jamielennox | there was a phase there where nova tried to be, and swift did for a bit, but as far as i'm aware that idea has died | 06:08 |
| ajayaa | jamielennox, The nova thing got forked into a different project altogether and they are using Keystone for auth. | 06:10 |
| ajayaa | So it needs to be there. | 06:10 |
| ajayaa | Again there are other projects in wild such as ceph which are integrated with Openstack. | 06:11 |
| ajayaa | For the sake of these projects I would argue the s3 token stuff needs to be there. | 06:11 |
| *** merlin_ has joined #openstack-keystone | 06:11 | |
| jamielennox | ok - well so the server side is already available, you would just have to update the middleware because it looks like it hasn't been updated in a long time | 06:11 |
| ajayaa | jamielennox, cool! Thanks for the pointer. | 06:12 |
| jamielennox | ajayaa: no | 06:12 |
| jamielennox | np | 06:12 |
| *** markvoelker has joined #openstack-keystone | 06:13 | |
| *** mabrams has joined #openstack-keystone | 06:13 | |
| jamielennox | let me know how you go with that because you will need to update all the auth credentials to match what we've done in auth_token middleware, and that can be a little confusing | 06:13 |
| *** kwills has quit IRC | 06:13 | |
| ajayaa | sure. First I will try the server side thing and make sure it works and then dive into the middleware. | 06:14 |
| ajayaa | I will let you know if I come across confusing things. | 06:14 |
| ajayaa | :) | 06:14 |
| yogeshwars1 | Hi Guys, I am confused about what the Keystone v3 policy API is intended for. | 06:16 |
| yogeshwars1 | Are these APIs related to the policy.json files we use in all components? Or am I way off the mark? | 06:17 |
| *** markvoelker has quit IRC | 06:18 | |
| *** tobe has quit IRC | 06:18 | |
| yogeshwars1 | jamielennox: ^^ | 06:26 |
| jamielennox | yogeshwars1: sorry, missed that | 06:26 |
| jamielennox | umm | 06:26 |
| jamielennox | the CRUD policy API? | 06:26 |
| jamielennox | at the moment we really don't use it for anything | 06:27 |
| jamielennox | we are in the process of trying to make it more dynamic but really it's not currently used | 06:27 |
| yogeshwars1 | jamielennox: yes, the CRUD policy API. | 06:27 |
| *** ajayaa has quit IRC | 06:28 | |
| yogeshwars1 | jamielennox: ok got it. Is the intent for these API calls to replace policy.json files? | 06:29 |
| jamielennox | yogeshwars1: eventually, yes | 06:29 |
| yogeshwars1 | jamielennox: thanks. could you please point me to a spec or something that talks about making it more dynamic? | 06:32 |
| jamielennox | yogeshwars1: it's very curent and we are calling it dynamic policy, there is a whole subgroup meeting and such, i think they are still working out the details for how it will work | 06:33 |
| jamielennox | yogeshwars1: ask ayoung or samueldmq during US time, they would know most i think | 06:33 |
| *** ajayaa has joined #openstack-keystone | 06:34 | |
| yogeshwars1 | jamielennox: ok, thank you. | 06:34 |
| *** spandhe has quit IRC | 06:35 | |
| *** Nikkau has quit IRC | 06:42 | |
| *** _cjones_ has quit IRC | 06:44 | |
| *** fhubik has joined #openstack-keystone | 06:50 | |
| *** fhubik is now known as fhubik_afk | 06:50 | |
| *** _cjones_ has joined #openstack-keystone | 06:56 | |
| *** tobe has joined #openstack-keystone | 06:57 | |
| *** lufix has joined #openstack-keystone | 07:00 | |
| *** woodster_ has quit IRC | 07:00 | |
| *** _cjones_ has quit IRC | 07:01 | |
| *** geoffarnold_ has quit IRC | 07:08 | |
| *** markvoelker has joined #openstack-keystone | 07:13 | |
| *** markvoelker has quit IRC | 07:18 | |
| *** Nikkau has joined #openstack-keystone | 07:32 | |
| evrardjp | good morning everyone | 07:33 |
| *** Nikkau has quit IRC | 07:41 | |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Fix req.environ[SCRIPT_NAME] value. https://review.openstack.org/188269 | 07:43 |
| *** dims_ has joined #openstack-keystone | 07:44 | |
| *** chlong has quit IRC | 07:44 | |
| *** dims_ has quit IRC | 07:49 | |
| *** dguerri`away is now known as dguerri | 07:49 | |
| *** henrynash has quit IRC | 07:49 | |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Fix req.environ[SCRIPT_NAME] value. https://review.openstack.org/188269 | 07:49 |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Fix req.environ[SCRIPT_NAME] value. https://review.openstack.org/188269 | 07:50 |
| *** jistr has joined #openstack-keystone | 07:50 | |
| *** Nikkau has joined #openstack-keystone | 07:50 | |
| *** jistr is now known as jistr|mt | 07:54 | |
| *** jistr|mt is now known as jistr|mtg | 07:54 | |
| *** Nikkau has quit IRC | 07:56 | |
| *** _cjones_ has joined #openstack-keystone | 07:57 | |
| *** afazekas has joined #openstack-keystone | 08:01 | |
| *** henrynash has joined #openstack-keystone | 08:01 | |
| *** ChanServ sets mode: +v henrynash | 08:01 | |
| *** henrynash has quit IRC | 08:02 | |
| *** _cjones_ has quit IRC | 08:02 | |
| *** aix has joined #openstack-keystone | 08:03 | |
| openstackgerrit | Merged openstack/keystone: Don't query db if criteria longer than col length https://review.openstack.org/163949 | 08:09 |
| openstackgerrit | Merged openstack/keystone: Don't query db if criteria longer than col length https://review.openstack.org/163949 | 08:09 |
| *** lhcheng has joined #openstack-keystone | 08:31 | |
| *** ChanServ sets mode: +v lhcheng | 08:31 | |
| *** pnavarro has joined #openstack-keystone | 08:32 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: MappingEngineTester https://review.openstack.org/188302 | 08:35 |
| *** tobe has quit IRC | 08:39 | |
| *** tobe has joined #openstack-keystone | 08:39 | |
| *** markvoelker has joined #openstack-keystone | 09:02 | |
| *** markvoelker has quit IRC | 09:07 | |
| *** bdossant has joined #openstack-keystone | 09:07 | |
| openstackgerrit | liusheng proposed openstack/keystone: Add Validity check of 'expires_at' in trust creation https://review.openstack.org/188315 | 09:15 |
| openstackgerrit | liusheng proposed openstack/keystone: Add validity check of 'expires_at' in trust creation https://review.openstack.org/188315 | 09:17 |
| *** jistr|mtg is now known as jistr | 09:19 | |
| *** davechen is now known as davechen_afk | 09:33 | |
| *** tobe has quit IRC | 09:33 | |
| *** ajayaa has quit IRC | 09:40 | |
| *** e0ne has joined #openstack-keystone | 09:44 | |
| *** afazekas is now known as afazekas_mtg | 09:44 | |
| *** jaosorior has joined #openstack-keystone | 09:45 | |
| *** lhcheng has quit IRC | 09:45 | |
| *** dims_ has joined #openstack-keystone | 09:45 | |
| *** dims_ has quit IRC | 09:51 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient-kerberos: Disable optional authentication for plugin https://review.openstack.org/188329 | 09:51 |
| *** tobe has joined #openstack-keystone | 09:53 | |
| *** ajayaa has joined #openstack-keystone | 09:57 | |
| *** _cjones_ has joined #openstack-keystone | 10:00 | |
| *** dims_ has joined #openstack-keystone | 10:03 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient-kerberos: Federated Kerberos plugin https://review.openstack.org/173558 | 10:04 |
| *** _cjones_ has quit IRC | 10:05 | |
| *** markvoelker has joined #openstack-keystone | 10:18 | |
| *** Kennan2 has joined #openstack-keystone | 10:20 | |
| *** Kennan has quit IRC | 10:20 | |
| *** Kennan2 is now known as Kennan | 10:21 | |
| *** markvoelker has quit IRC | 10:22 | |
| *** boris-42 has joined #openstack-keystone | 10:33 | |
| *** markvoelker has joined #openstack-keystone | 10:46 | |
| *** marzif_ has joined #openstack-keystone | 10:47 | |
| *** marzif_ has quit IRC | 10:50 | |
| *** marzif_ has joined #openstack-keystone | 10:50 | |
| *** Chenhong has quit IRC | 10:52 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow searching a catalog on service or endpoint id https://review.openstack.org/174669 | 10:57 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Remove service_type requirement from catalog searching https://review.openstack.org/174670 | 10:57 |
| *** woodster_ has joined #openstack-keystone | 11:00 | |
| *** _cjones_ has joined #openstack-keystone | 11:01 | |
| *** _cjones_ has quit IRC | 11:06 | |
| *** Chenhong has joined #openstack-keystone | 11:11 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add flag to append project_id to catalog URL https://review.openstack.org/148166 | 11:17 |
| *** pnavarro_ has joined #openstack-keystone | 11:21 | |
| *** pnavarro has quit IRC | 11:22 | |
| openstackgerrit | Merged openstack/keystoneauth: Cleanup needless variable binding https://review.openstack.org/187080 | 11:26 |
| openstackgerrit | Merged openstack/python-keystoneclient: Cleanup fixture imports https://review.openstack.org/187060 | 11:27 |
| *** pnavarro_ has quit IRC | 11:27 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow saving and caching the plugin auth state https://review.openstack.org/149175 | 11:28 |
| *** aix has quit IRC | 11:30 | |
| openstackgerrit | Alexander Maretskiy proposed openstack/keystone: Improvements for rally jobs. https://review.openstack.org/188352 | 11:37 |
| *** e0ne is now known as e0ne_ | 11:39 | |
| *** pnavarro_ has joined #openstack-keystone | 11:39 | |
| *** samueldmq has joined #openstack-keystone | 11:41 | |
| *** merlin_ has quit IRC | 11:42 | |
| *** tellesnobrega has joined #openstack-keystone | 11:47 | |
| *** e0ne_ has quit IRC | 11:49 | |
| *** kiran-r has quit IRC | 11:49 | |
| samueldmq | morning | 11:51 |
| marekd | hi | 11:51 |
| openstackgerrit | liusheng proposed openstack/keystone: Add validity check of 'expires_at' in trust creation https://review.openstack.org/188315 | 11:52 |
| *** afazekas_mtg has quit IRC | 11:53 | |
| openstackgerrit | Alexander Maretskiy proposed openstack/keystone: Improvements for rally jobs. https://review.openstack.org/188352 | 11:53 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Revocation engine refactoring https://review.openstack.org/188131 | 11:57 |
| *** _cjones_ has joined #openstack-keystone | 12:02 | |
| *** amaretskiy has joined #openstack-keystone | 12:03 | |
| amaretskiy | morganfainberg hi | 12:04 |
| amaretskiy | morganfainberg I've just submitted https://review.openstack.org/#/c/188352/ | 12:05 |
| amaretskiy | morganfainberg this patch improves rally jobs - there are a lot of scenarios added, should be much more interesting | 12:05 |
| *** pnavarro_ has quit IRC | 12:06 | |
| *** tobe has quit IRC | 12:06 | |
| *** _cjones_ has quit IRC | 12:07 | |
| *** bdossant_ has joined #openstack-keystone | 12:07 | |
| *** bdossant has quit IRC | 12:10 | |
| *** e0ne has joined #openstack-keystone | 12:13 | |
| *** fhubik_afk is now known as fhubik | 12:15 | |
| *** chlong has joined #openstack-keystone | 12:20 | |
| *** lihkin has quit IRC | 12:23 | |
| *** lihkin has joined #openstack-keystone | 12:23 | |
| *** lihkin has quit IRC | 12:23 | |
| *** liusheng has quit IRC | 12:26 | |
| *** ajayaa has quit IRC | 12:29 | |
| *** aix has joined #openstack-keystone | 12:30 | |
| *** gordc has joined #openstack-keystone | 12:32 | |
| *** mabrams has quit IRC | 12:32 | |
| *** mabrams has joined #openstack-keystone | 12:33 | |
| *** jsavak has joined #openstack-keystone | 12:33 | |
| *** henrynash has joined #openstack-keystone | 12:33 | |
| *** ChanServ sets mode: +v henrynash | 12:33 | |
| *** rushiagr is now known as rushiagr_away | 12:36 | |
| *** rwsu has joined #openstack-keystone | 12:36 | |
| *** stevemar has joined #openstack-keystone | 12:41 | |
| *** ChanServ sets mode: +v stevemar | 12:41 | |
| *** zzzeek has joined #openstack-keystone | 12:42 | |
| *** bknudson has joined #openstack-keystone | 12:43 | |
| *** ChanServ sets mode: +v bknudson | 12:43 | |
| *** marzif_ has quit IRC | 12:44 | |
| *** afazekas_mtg has joined #openstack-keystone | 12:45 | |
| *** henrynash has quit IRC | 12:46 | |
| *** henrynash has joined #openstack-keystone | 12:52 | |
| *** ChanServ sets mode: +v henrynash | 12:52 | |
| *** kiran-r has joined #openstack-keystone | 12:58 | |
| *** amakarov_away is now known as amakarov | 13:00 | |
| *** Chenhong has quit IRC | 13:01 | |
| *** e0ne is now known as e0ne_ | 13:01 | |
| *** pnavarro_ has joined #openstack-keystone | 13:03 | |
| *** afazekas_mtg has quit IRC | 13:04 | |
| *** e0ne_ is now known as e0ne | 13:04 | |
| *** topol has joined #openstack-keystone | 13:05 | |
| *** ChanServ sets mode: +v topol | 13:05 | |
| *** iamjarvo has joined #openstack-keystone | 13:08 | |
| *** Chenhong has joined #openstack-keystone | 13:12 | |
| *** sbasam has joined #openstack-keystone | 13:15 | |
| *** henrynash has quit IRC | 13:21 | |
| *** timcline has joined #openstack-keystone | 13:24 | |
| *** bdossant_ has quit IRC | 13:26 | |
| *** iamjarvo has quit IRC | 13:27 | |
| *** timcline has quit IRC | 13:27 | |
| *** richm has joined #openstack-keystone | 13:28 | |
| *** rushiagr_away is now known as rushiagr | 13:28 | |
| *** iamjarvo has joined #openstack-keystone | 13:32 | |
| *** ajayaa has joined #openstack-keystone | 13:38 | |
| *** fhubik is now known as fhubik_afk | 13:38 | |
| *** henrynash has joined #openstack-keystone | 13:40 | |
| *** ChanServ sets mode: +v henrynash | 13:40 | |
| *** kiran-r has quit IRC | 13:41 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 13:48 |
| samueldmq | ayoung, hi, I have some dynamic polciies thoughts in mind that want to be shared with you | 13:48 |
| *** dsirrine has joined #openstack-keystone | 13:49 | |
| *** lihkin has joined #openstack-keystone | 13:49 | |
| *** lihkin has quit IRC | 13:49 | |
| *** csoukup has joined #openstack-keystone | 13:49 | |
| *** lihkin has joined #openstack-keystone | 13:51 | |
| *** timcline has joined #openstack-keystone | 13:52 | |
| *** mabrams has quit IRC | 13:55 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:55 | |
| *** henrynash has quit IRC | 13:56 | |
| *** fhubik_afk is now known as fhubik | 13:57 | |
| *** e0ne is now known as e0ne_ | 13:59 | |
| *** _cjones_ has joined #openstack-keystone | 14:04 | |
| *** e0ne_ has quit IRC | 14:04 | |
| *** e0ne has joined #openstack-keystone | 14:06 | |
| *** henrynash has joined #openstack-keystone | 14:06 | |
| *** ChanServ sets mode: +v henrynash | 14:06 | |
| *** HT_sergio has joined #openstack-keystone | 14:07 | |
| *** fangzhou has joined #openstack-keystone | 14:07 | |
| *** dsirrine has quit IRC | 14:08 | |
| *** iamjarvo has quit IRC | 14:08 | |
| *** _cjones_ has quit IRC | 14:08 | |
| *** radez_g0n3 is now known as radez | 14:09 | |
| *** iamjarvo has joined #openstack-keystone | 14:13 | |
| *** merlin_ has joined #openstack-keystone | 14:14 | |
| samueldmq | ayoung, see http://paste.openstack.org/show/262978/ | 14:14 |
| samueldmq | ayoung, I think what is in that diagram fits what we discussed yesterday + nova needs and is still aligned with the goals of dynamic policy | 14:15 |
| ayoung | Unauthorized and "Not enough privilegies" are the same thing samueldmq | 14:15 |
| ayoung | I don't want /policy | 14:16 |
| samueldmq | ayoung, yes, I meant authentication failure | 14:16 |
| ayoung | right | 14:16 |
| samueldmq | ayoung, ok that's part of the unified policy discussion | 14:16 |
| samueldmq | ayoung, but point iii) in ksmiddleware | 14:16 |
| samueldmq | ayoung, is that what you want/was trying to explain me yesterday | 14:17 |
| samueldmq | ? | 14:17 |
| ayoung | samueldmq, we can't enforce all policy from middleware | 14:17 |
| ayoung | many of the calls need to fetch an object from the DB first | 14:17 |
| ayoung | so, we are going to leave the calls from nova into oslo.policy in place, but inject a "fetch" mechanism into oslo.policy | 14:18 |
| samueldmq | ayoung, hmm ... so the fetch mechanism is inside oslo.policy | 14:18 |
| samueldmq | ayoung, how does oslo.policy knows the endpoint url ? | 14:18 |
| samueldmq | ayoung, middleware will tell him ? I think it is much more middlewaer job itself | 14:18 |
| ayoung | samueldmq, if people wrote sane URLs, where resources were scoped by projects, then, yes, we could do it in middleware | 14:19 |
| ayoung | but since we need to let them fetch objects from the DB first, we need to just have middleware setup the "fetcher:" | 14:20 |
| samueldmq | ayoung, at this point we should be able to fetch the policy | 14:20 |
| samueldmq | ayoung, https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L542 | 14:20 |
| ayoung | and, it does not need to be "middleware" per se, it needs to be registered at app startup time | 14:20 |
| ayoung | we need to check the cache and refetch | 14:20 |
| *** iamjarvo has quit IRC | 14:20 | |
| samueldmq | ayoung, yes, and could be done by ksmiddleware | 14:21 |
| ayoung | samueldmq, actually...we could do the fetching and caching from middleware, just not the actual policy check | 14:21 |
| samueldmq | ayoung, oslo.policy would own the engine, as it does today | 14:21 |
| ayoung | so long as the directory is writable, it really does not make a difference. | 14:21 |
| samueldmq | ayoung, yes that's exactly what I am thinking | 14:21 |
| samueldmq | ayoung, to make that from middleware, which cache/refresh/fetch/whatever | 14:21 |
| samueldmq | ayoung, since it knows the diretory + file to write, and the endpoint ot ask keystone for the policy | 14:22 |
| ayoung | ok, lets start by writing it as a separate middleware. I know that the answer is going to come back "make it part of ATM and enable it via a config option." | 14:22 |
| ayoung | But that is a different story | 14:22 |
| samueldmq | ayoung, ok so other middleware means another filter, besides auth_filter | 14:23 |
| ayoung | Do we already have the directory available in the config section? I was a little afraidf that each of the services would manage it their own way. | 14:23 |
| ayoung | yeah...let's make it like this: | 14:23 |
| ayoung | create a stand alone policy cache management filter | 14:24 |
| samueldmq | ayoung, I will chekc for the availability | 14:24 |
| samueldmq | ayoung, ++ | 14:24 |
| ayoung | but...make it trivial to call it from ATM, so that if we end up merging it in, we can do either with just one or two lines of code changed | 14:24 |
| samueldmq | ayoung, ATM ? at the moment ? | 14:25 |
| ayoung | Auth token middleware | 14:25 |
| samueldmq | ayoung, great I can plug it in the auth_token __call__ as well | 14:26 |
| samueldmq | ayoung, yeah this will be easier | 14:26 |
| ayoung | maybe...we'll see | 14:26 |
| samueldmq | ayoung, ok I think we now agreed on this point, I can start coding :) | 14:26 |
| samueldmq | ayoung, regarding the directories/policy file | 14:30 |
| samueldmq | ayoung, https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L1507-L1529 | 14:30 |
| samueldmq | ayoung, we should be able to get that info if services already use oslo_policy | 14:31 |
| ayoung | cool | 14:31 |
| samueldmq | ayoung, nice, I am going afk for a bit now, and the fun starts this afternoon :) | 14:32 |
| samueldmq | ayoung, thanks | 14:32 |
| samueldmq | ayoung, for taking the time and making things clear | 14:32 |
| *** fangzhou has quit IRC | 14:35 | |
| *** afazekas_mtg has joined #openstack-keystone | 14:35 | |
| *** iamjarvo has joined #openstack-keystone | 14:40 | |
| *** afazekas_mtg has quit IRC | 14:43 | |
| *** chlong has quit IRC | 14:47 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Add Service Providers handling to AccessInfo https://review.openstack.org/188426 | 14:51 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 14:51 |
| ayoung | I just saw a lab keystone token of length 93265 | 14:53 |
| ayoung | with the error ....' exceeded the limit of column id(CHAR(64)). (HTTP 400) | 14:53 |
| gsilvis | ayoung: did morganfainberg ever talk to you about his concerns with mix & match federation? | 15:00 |
| ayoung | gsilvis, slightly | 15:00 |
| *** lihkin has quit IRC | 15:01 | |
| *** lihkin has joined #openstack-keystone | 15:01 | |
| *** belmoreira has quit IRC | 15:05 | |
| *** _cjones_ has joined #openstack-keystone | 15:05 | |
| *** hemnafkj is now known as hemna | 15:06 | |
| *** fhubik is now known as fhubik_afk | 15:08 | |
| *** _cjones_ has quit IRC | 15:10 | |
| dstanek | bknudson, morganfainberg: any thoughts on this https://review.openstack.org/#/c/183698/2/guidelines/http.rst ? | 15:14 |
| bknudson | there's a 405 error for method not allowed. | 15:18 |
| bknudson | I'd be ok with a 400 error for not implemented | 15:18 |
| bknudson | wouldn't be backwards compatible | 15:18 |
| bknudson | we'd need to at least offer some way for the client to avoid the error, e.g., discovery of what's implemented and what's not | 15:19 |
| dstanek | isn't that what 501 gives you over 400? | 15:19 |
| bknudson | http://tools.ietf.org/html/rfc7231#section-6.6.2 | 15:19 |
| dstanek | i also think raising 5xx from code is reasonable | 15:19 |
| bknudson | the way I interpret the RFC I don't think we're using 501 incorrectly | 15:20 |
| dstanek | i think that they are reading it as "only used when the server doesn't recognize the method" | 15:20 |
| dstanek | i read it as a concrete example and not the only one | 15:20 |
| bknudson | that's the only example they give | 15:20 |
| bknudson | but I read it as an example not the only time to use it | 15:21 |
| bknudson | it's the server that doesn't implement it, so a 5xx makes sense to me. | 15:21 |
| *** arunkant_ has joined #openstack-keystone | 15:22 | |
| dstanek | both of those reviews feel like they are reaching to me | 15:24 |
| *** timcline has quit IRC | 15:26 | |
| *** timcline has joined #openstack-keystone | 15:27 | |
| openstackgerrit | Dan Nguyen proposed openstack/python-keystoneclient: Add include_subtree to role_list_assignments call https://review.openstack.org/188184 | 15:27 |
| *** fhubik_afk is now known as fhubik | 15:29 | |
| *** gyee has joined #openstack-keystone | 15:33 | |
| *** ChanServ sets mode: +v gyee | 15:33 | |
| *** _cjones_ has joined #openstack-keystone | 15:38 | |
| *** fhubik is now known as fhubik_afk | 15:43 | |
| *** dims_ has quit IRC | 15:43 | |
| *** fhubik_afk is now known as fhubik | 15:44 | |
| *** lufix has quit IRC | 15:47 | |
| *** Chenhong has quit IRC | 15:50 | |
| openstackgerrit | Alexander Maretskiy proposed openstack/keystone: Rename directory with rally jobs files. https://review.openstack.org/188352 | 15:57 |
| openstackgerrit | Alexander Maretskiy proposed openstack/keystone: Add more Rally scenarios https://review.openstack.org/188457 | 15:59 |
| *** jistr has quit IRC | 16:01 | |
| *** mattfarina has joined #openstack-keystone | 16:04 | |
| *** iamjarvo has quit IRC | 16:05 | |
| openstackgerrit | Alexander Maretskiy proposed openstack/keystone: Rename directory with rally jobs files. https://review.openstack.org/188352 | 16:07 |
| *** pnavarro__ has joined #openstack-keystone | 16:14 | |
| *** pnavarro_ has quit IRC | 16:15 | |
| openstackgerrit | Alexander Maretskiy proposed openstack/keystone: Add more Rally scenarios https://review.openstack.org/188457 | 16:16 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/188476 | 16:18 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/188477 | 16:18 |
| *** pnavarro__ has quit IRC | 16:20 | |
| openstackgerrit | Alexander Maretskiy proposed openstack/keystone: Improvements for rally jobs files. https://review.openstack.org/188479 | 16:20 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/188496 | 16:24 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-saml2: Updated from global requirements https://review.openstack.org/188497 | 16:24 |
| *** iamjarvo has joined #openstack-keystone | 16:31 | |
| gyee | ayoung, I am trying to understand your comment here https://review.openstack.org/#/c/177661/ | 16:31 |
| *** iamjarvo has quit IRC | 16:31 | |
| *** pnavarro__ has joined #openstack-keystone | 16:31 | |
| gyee | ayoung, default rule is an oslo policy behavior, I merely making sure it works | 16:31 |
| ayoung | gyee, you don't want the default rule | 16:32 |
| ayoung | gyee, so, the default rule is what will be executed when the api level policy is enforced | 16:32 |
| ayoung | but, endpoint level should not use that...it means we enforce the same rule twice | 16:32 |
| gyee | ayoung, right, but we are sharing policy.json | 16:32 |
| *** lufix has joined #openstack-keystone | 16:32 | |
| ayoung | gyee, and we might have no choice. But really ,we should not be using the default for endpoint binding | 16:33 |
| gyee | ayoung, two separate tests, one with the global rule defined and one without | 16:33 |
| *** aix has quit IRC | 16:33 | |
| ayoung | if we enable endpoint binding/globval polci, we should execute only the explicit rule | 16:33 |
| ayoung | the default...should be namespaced | 16:33 |
| ayoung | we shouodl have like compute::default and so on | 16:33 |
| gyee | ayoung, I agree | 16:34 |
| ayoung | and then you would use global::default if there was one...but it would be kindof strange to define that | 16:34 |
| ayoung | gyee, ,so, the short answer is, I guess it really does not matter, | 16:34 |
| gyee | but that's something that oslo policy will have to implement | 16:34 |
| ayoung | gyee, yeah...something like enforce_no_defaults() | 16:34 |
| gyee | ayoung, right, we can enhance oslo.policy to restrict default enforcement | 16:35 |
| ayoung | but...I guess it really does not matter for your patch, I can remove the negative comment. | 16:35 |
| gyee | ayoung, cool, thanks | 16:35 |
| *** pnavarro__ has quit IRC | 16:36 | |
| * gyee is reading up on the dynamic policy thread, its getting long | 16:36 | |
| ayoung | gyee, trying to balance practical with incur-technical-debt... | 16:36 |
| *** marzif_ has joined #openstack-keystone | 16:37 | |
| gyee | ayoung, I am not in favor of code decorative (hardcoded) defaults | 16:38 |
| ayoung | gyee, I am not sure that sdague thought through the mechanism to implement what he is proposing | 16:38 |
| gyee | I've heard many times that model sucks (i.e. Spring Acegi) | 16:39 |
| ayoung | if you put it in the code, you need to crawl the code, or you have the potential for things to get out of sync | 16:39 |
| *** dims_ has joined #openstack-keystone | 16:39 | |
| gyee | security model is defined by deployers/customers per their security/compliance requirement | 16:39 |
| gyee | it has to be flexible | 16:40 |
| gyee | hence "dynamic" | 16:40 |
| gyee | I hope we don't hardcode "admin" all over the place | 16:41 |
| *** iamjarvo has joined #openstack-keystone | 16:41 | |
| *** iamjarvo has quit IRC | 16:41 | |
| *** iamjarvo has joined #openstack-keystone | 16:41 | |
| *** lufix has quit IRC | 16:42 | |
| *** lihkin1 has joined #openstack-keystone | 16:45 | |
| *** iamjarvo has quit IRC | 16:49 | |
| *** lihkin has quit IRC | 16:49 | |
| *** amaretskiy has quit IRC | 16:57 | |
| *** fangzhou has joined #openstack-keystone | 16:57 | |
| *** alanf-mc has joined #openstack-keystone | 16:59 | |
| *** marzif_ has quit IRC | 17:00 | |
| openstackgerrit | Brian Tully proposed openstack/python-keystoneclient: Add include_subtree to role_list_assignments call https://review.openstack.org/188184 | 17:01 |
| *** lihkin1 has quit IRC | 17:01 | |
| *** fhubik has quit IRC | 17:02 | |
| *** csoukup has quit IRC | 17:05 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Encapsulate Service Providers in AccessInfo https://review.openstack.org/188426 | 17:08 |
| *** alanf-mc has quit IRC | 17:10 | |
| *** marzif_ has joined #openstack-keystone | 17:11 | |
| *** csoukup has joined #openstack-keystone | 17:11 | |
| *** alanf-mc has joined #openstack-keystone | 17:12 | |
| *** dsirrine has joined #openstack-keystone | 17:15 | |
| *** Kennan2 has joined #openstack-keystone | 17:18 | |
| *** bradjones is now known as bradjones_away | 17:19 | |
| *** csoukup has quit IRC | 17:19 | |
| *** Kennan has quit IRC | 17:20 | |
| *** csoukup has joined #openstack-keystone | 17:20 | |
| *** e0ne has quit IRC | 17:22 | |
| *** dan has quit IRC | 17:23 | |
| *** dan| is now known as dan | 17:23 | |
| *** dguerri is now known as dguerri`away | 17:24 | |
| *** dguerri`away is now known as dguerri | 17:24 | |
| *** dguerri is now known as dguerri`away | 17:24 | |
| *** Viswanath has joined #openstack-keystone | 17:25 | |
| *** timcline has quit IRC | 17:27 | |
| *** josecastroleon has quit IRC | 17:28 | |
| *** Viswanath has quit IRC | 17:30 | |
| *** spandhe has joined #openstack-keystone | 17:31 | |
| *** timcline has joined #openstack-keystone | 17:39 | |
| *** dims_ has quit IRC | 17:40 | |
| *** dsirrine has quit IRC | 17:42 | |
| *** dontalton has joined #openstack-keystone | 17:47 | |
| *** gyee has quit IRC | 17:49 | |
| *** lhcheng has joined #openstack-keystone | 17:50 | |
| *** ChanServ sets mode: +v lhcheng | 17:50 | |
| *** lhcheng_ has joined #openstack-keystone | 17:51 | |
| *** lhcheng has quit IRC | 17:55 | |
| *** marzif_ has quit IRC | 17:55 | |
| *** marzif_ has joined #openstack-keystone | 17:56 | |
| *** rushiagr is now known as rushiagr_away | 17:57 | |
| *** Viswanath has joined #openstack-keystone | 18:01 | |
| *** Viswanath has quit IRC | 18:04 | |
| *** tellesnobrega_ has joined #openstack-keystone | 18:06 | |
| *** lhcheng has joined #openstack-keystone | 18:07 | |
| *** ChanServ sets mode: +v lhcheng | 18:07 | |
| *** lhcheng_ has quit IRC | 18:07 | |
| *** dsirrine has joined #openstack-keystone | 18:07 | |
| *** dims_ has joined #openstack-keystone | 18:08 | |
| *** amakarov is now known as amakarov_away | 18:11 | |
| *** packet has quit IRC | 18:15 | |
| samueldmq | what would be a good default for policy_cache_time in ksmiddleware ? | 18:15 |
| samueldmq | ayoung, ^ | 18:15 |
| *** iamjarvo has joined #openstack-keystone | 18:15 | |
| ayoung | samueldmq, either 1 minute or 5 minutes | 18:15 |
| ayoung | lets go with 5 | 18:15 |
| samueldmq | ayoung, ++ | 18:16 |
| *** dguerri`away is now known as dguerri | 18:17 | |
| *** lhcheng_ has joined #openstack-keystone | 18:20 | |
| *** iamjarvo has quit IRC | 18:21 | |
| ayoung | morganfainberg, so...I wrote it up like I said I would. | 18:22 |
| ayoung | https://www.mail-archive.com/openstack-dev@lists.openstack.org/msg54645.html | 18:22 |
| *** lhcheng has quit IRC | 18:23 | |
| *** iamjarvo has joined #openstack-keystone | 18:25 | |
| *** lhcheng_ has quit IRC | 18:27 | |
| *** bradjones_away is now known as bradjones | 18:29 | |
| *** tellesnobrega_ has quit IRC | 18:29 | |
| *** tellesnobrega_ has joined #openstack-keystone | 18:29 | |
| *** tellesnobrega_ has quit IRC | 18:29 | |
| *** tellesnobrega_ has joined #openstack-keystone | 18:32 | |
| *** tellesnobrega_ has quit IRC | 18:32 | |
| *** iamjarvo has quit IRC | 18:32 | |
| *** openstackstatus has joined #openstack-keystone | 18:39 | |
| *** ChanServ sets mode: +v openstackstatus | 18:39 | |
| *** bradjones is now known as bradjones_away | 18:40 | |
| *** tellesnobrega_ has joined #openstack-keystone | 18:41 | |
| -openstackstatus- NOTICE: Gerrit has been restarted to clear an issue with its event stream. Any change events between 17:25 and 18:38 UTC should be rechecked or have their approvals reapplied to initiate testing. | 18:42 | |
| *** tellesnobrega_ has quit IRC | 18:43 | |
| *** ajayaa has quit IRC | 18:45 | |
| *** tellesnobrega_ has joined #openstack-keystone | 18:45 | |
| *** marzif_ has quit IRC | 18:47 | |
| *** packet has joined #openstack-keystone | 18:50 | |
| *** packet has quit IRC | 18:51 | |
| *** dguerri is now known as dguerri`away | 18:51 | |
| *** lhcheng has joined #openstack-keystone | 19:04 | |
| *** ChanServ sets mode: +v lhcheng | 19:04 | |
| *** marzif_ has joined #openstack-keystone | 19:04 | |
| *** timcline has quit IRC | 19:10 | |
| *** timcline has joined #openstack-keystone | 19:12 | |
| *** HT_sergio has quit IRC | 19:17 | |
| *** Viswanath has joined #openstack-keystone | 19:18 | |
| *** Viswanath has quit IRC | 19:21 | |
| *** alanf-mc has quit IRC | 19:24 | |
| *** dsirrine has quit IRC | 19:30 | |
| *** dsirrine has joined #openstack-keystone | 19:31 | |
| *** iamjarvo has joined #openstack-keystone | 19:37 | |
| *** spandhe has quit IRC | 19:38 | |
| *** dsirrine has quit IRC | 19:40 | |
| *** elmiko has joined #openstack-keystone | 19:44 | |
| *** HT_sergio has joined #openstack-keystone | 19:44 | |
| elmiko | jamielennox: hey, might i bug for a few minutes about Sessions? | 19:44 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystonemiddleware: WIP - Fetch Policy File by Service Endpoint https://review.openstack.org/188561 | 19:48 |
| samueldmq | ayoung, ^ | 19:49 |
| samueldmq | ayoung, still wip ... I have set up the main code skeleton | 19:49 |
| ayoung | samueldmq, cool | 19:50 |
| samueldmq | ayoung, still some todo's etc, but can give the direction I am taking | 19:50 |
| samueldmq | ayoung, I am going afk for a bit, feel free to add preliminar comments there if you have :) | 19:50 |
| ayoung | samueldmq, very good. | 19:51 |
| samueldmq | ayoung, thanks :) | 19:51 |
| stevemar | morganfainberg, did you have a keystone release plan btw? | 19:53 |
| *** samueldmq has quit IRC | 19:54 | |
| *** e0ne has joined #openstack-keystone | 19:55 | |
| *** Viswanath has joined #openstack-keystone | 19:55 | |
| *** iamjarvo has quit IRC | 19:59 | |
| *** Viswanath has quit IRC | 20:00 | |
| *** marzif_ has quit IRC | 20:00 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone-specs: User groups in token bodies https://review.openstack.org/188564 | 20:01 |
| *** iamjarvo has joined #openstack-keystone | 20:04 | |
| *** iamjarvo has quit IRC | 20:04 | |
| *** iamjarvo has joined #openstack-keystone | 20:05 | |
| *** iamjarvo has quit IRC | 20:05 | |
| *** iamjarvo has joined #openstack-keystone | 20:05 | |
| *** radez is now known as radez_g0n3 | 20:06 | |
| *** Viswanath has joined #openstack-keystone | 20:07 | |
| *** radez_g0n3 is now known as radez | 20:09 | |
| *** Viswanath has quit IRC | 20:10 | |
| morganfainberg | stevemar: hmm? | 20:10 |
| morganfainberg | Like the nova and ironic threads? | 20:10 |
| morganfainberg | stevemar: if that is the question, right now I think it is better for us to not change. | 20:11 |
| morganfainberg | stevemar: where keystone sits, we don't want to shake things up too much. We can follow and make sure we see how this impacts the projects making the changes. | 20:11 |
| morganfainberg | stevemar: if you meant something else... Please elaborate. | 20:13 |
| *** timcline_ has joined #openstack-keystone | 20:15 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone-specs: User groups in token bodies https://review.openstack.org/188564 | 20:16 |
| *** Viswanath has joined #openstack-keystone | 20:16 | |
| *** alanf-mc has joined #openstack-keystone | 20:17 | |
| *** stevemar has quit IRC | 20:18 | |
| *** timcline has quit IRC | 20:18 | |
| *** Viswanath has quit IRC | 20:20 | |
| *** dguerri`away is now known as dguerri | 20:26 | |
| *** bradjones_away has quit IRC | 20:26 | |
| *** dguerri is now known as dguerri` | 20:29 | |
| *** bradjones has joined #openstack-keystone | 20:32 | |
| bigjools | hey morganfainberg, do you know a shibboleth expert? | 20:38 |
| *** markvoelker has quit IRC | 20:41 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Add SAML2 fixtures https://review.openstack.org/188580 | 20:41 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Add Keystone2KeystoneAuthPlugin for K2K federation https://review.openstack.org/188581 | 20:41 |
| rodrigods | dolphm, added you as reviewer in https://review.openstack.org/#/c/188426/ (as you requested to be part of k2k reviews :) ) | 20:44 |
| *** spandhe has joined #openstack-keystone | 20:44 | |
| *** Viswanath has joined #openstack-keystone | 20:44 | |
| dolphm | rodrigods: thank you! i'm planning to dedicate my entire day tomorrow to federation things | 20:45 |
| rodrigods | dolphm, ++ thanks for that | 20:45 |
| *** Viswanath has quit IRC | 20:47 | |
| bigjools | rodrigods: I may take a look at that too | 20:47 |
| dolphm | dstanek: this is a nasty regression if the report is accurate - have time to look into it? https://bugs.launchpad.net/keystone/+bug/1461095 | 20:49 |
| openstack | Launchpad bug 1461095 in Keystone "Token is not revoked when removing a user from project in Horizon" [High,Triaged] | 20:49 |
| dstanek | dolphm: yes, i can take a look in a little bit | 20:51 |
| *** timcline_ has quit IRC | 20:52 | |
| *** HT_sergio has quit IRC | 20:52 | |
| *** timcline has joined #openstack-keystone | 20:52 | |
| dstanek | dolphm: looks like fun | 20:58 |
| dolphm | dstanek: ++ | 20:58 |
| dolphm | dstanek: i'm hoping it's some operation with an unscoped token that's legitimately not being revoked which is succeeding | 20:59 |
| dolphm | dstanek: i'd try to repro in horizon first, and see if you can do something real in that tenant, like create a vm | 20:59 |
| *** iamjarvo has quit IRC | 21:01 | |
| *** raildo has quit IRC | 21:01 | |
| *** operator99 is now known as gyee | 21:02 | |
| dstanek | yeah, i'll verify and experiment in horizon first and then write some broken tests based on what i find | 21:02 |
| *** e0ne has quit IRC | 21:05 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Base use webob https://review.openstack.org/174200 | 21:06 |
| openstackgerrit | Merged openstack/keystonemiddleware: Remove the _msg_format function https://review.openstack.org/174201 | 21:07 |
| openstackgerrit | Merged openstack/keystonemiddleware: Fetch user token from request rather than env https://review.openstack.org/174202 | 21:07 |
| bknudson | it could be caching | 21:07 |
| *** elmiko has quit IRC | 21:11 | |
| *** Kennan has joined #openstack-keystone | 21:18 | |
| *** Kennan2 has quit IRC | 21:19 | |
| *** tellesnobrega_ has quit IRC | 21:21 | |
| *** timcline has quit IRC | 21:25 | |
| *** ayoung has quit IRC | 21:26 | |
| *** Raildo has joined #openstack-keystone | 21:27 | |
| *** Raildo_ has joined #openstack-keystone | 21:29 | |
| *** Raildo__ has joined #openstack-keystone | 21:29 | |
| *** Raildo__ has quit IRC | 21:30 | |
| *** Raildo has quit IRC | 21:33 | |
| *** Raildo_ has quit IRC | 21:34 | |
| *** mattfarina has quit IRC | 21:37 | |
| *** mattfarina has joined #openstack-keystone | 21:38 | |
| *** henrynash has quit IRC | 21:41 | |
| *** markvoelker has joined #openstack-keystone | 21:41 | |
| *** markvoelker has quit IRC | 21:46 | |
| morganfainberg | bknudson: my guess is it's endpoint caching | 21:54 |
| *** mattfarina has quit IRC | 21:54 | |
| morganfainberg | bknudson: validation at the endpoint is holding the valid token longer than expected (~5min+) | 21:54 |
| morganfainberg | at a glance that is | 21:54 |
| morganfainberg | bigjools: marekd and gyee are great shib resources | 21:54 |
| marekd | bigjools: what's up? | 21:55 |
| morganfainberg | dolphm, dstanek, ^^ see what bknudson and I said. | 21:55 |
| bigjools | hey guys | 21:55 |
| marekd | bigjools: hey. | 21:56 |
| bigjools | marekd: I'm trying to get SPs to accept an existing session from another SP | 21:56 |
| marekd | bigjools: i know i had promised you something ;) | 21:56 |
| bigjools | yeah :) | 21:56 |
| marekd | bigjools: i will get there soon, needed to work on some internal stuff most of this week :( | 21:57 |
| bigjools | so basically I'm trying to get cross site federation working in a way that doesn't require you to sign in again | 21:57 |
| bigjools | marekd: no worries | 21:57 |
| *** iamjarvo has joined #openstack-keystone | 21:58 | |
| *** iamjarvo has quit IRC | 21:58 | |
| bigjools | marekd: so if you know how to configure that in Shib I'd be extremely grateful | 21:58 |
| marekd | bigjools: so, when you got logged in while accessing your payments website, you don't want to repeat it when accessing holiday website? | 21:58 |
| *** iamjarvo has joined #openstack-keystone | 21:58 | |
| bigjools | exactly | 21:58 |
| *** iamjarvo has quit IRC | 21:58 | |
| bigjools | we assume they trust each other | 21:58 |
| marekd | bigjools: sure... | 21:59 |
| marekd | bigjools: we have that at cern, however I think it's IdP configuration | 21:59 |
| *** iamjarvo has joined #openstack-keystone | 21:59 | |
| marekd | what idp are you using? | 21:59 |
| bigjools | that's fine. I'm using simplesamlphp | 21:59 |
| bigjools | but not attached to it | 21:59 |
| bigjools | (it was packaged for Ubuntu whereas shib-idp was not) | 22:00 |
| marekd | shib-idp is much harder to configure, not matter how hard simplesamlphp is :-) | 22:00 |
| nkinder_ | bigjools: you should have a session with your IdP, so when you go to the second SP, the IdP won't ask you to login again | 22:00 |
| bigjools | heh :) | 22:00 |
| nkinder_ | it should just issue an assertion | 22:00 |
| marekd | nkinder_: exactly | 22:00 |
| nkinder_ | that's what we do in Ipsilon | 22:00 |
| bigjools | nkinder_, marekd: they have different IdPs | 22:00 |
| bigjools | I want to make those two IdPs trust each other | 22:01 |
| nkinder_ | ok, so you need IdP chaining | 22:01 |
| marekd | bigjools: nkinder_ is right | 22:01 |
| nkinder_ | one IdP would need to be an SP of the other (and SAML is an auth method for that other IdP | 22:01 |
| bigjools | is that an IdP config or SP confug? | 22:01 |
| marekd | rather idp | 22:01 |
| nkinder_ | You'd have an IdP that is an SP of another IdP | 22:01 |
| nkinder_ | are your eyes crossed yet? ;) | 22:01 |
| bigjools | haha | 22:02 |
| bigjools | yeah this is making my brain ache for sure | 22:02 |
| marekd | bigjools: why two idps btw? | 22:02 |
| marekd | bigjools: if you are thinking about getting some production idp i think i'd consider switching to at least idp-shib. | 22:02 |
| bigjools | marekd: separate installations of openstack but all for same users | 22:03 |
| marekd | so why not using one idp :-) | 22:03 |
| bigjools | because $reasons :) | 22:03 |
| bigjools | I have no objection to using idp-shib at all. | 22:04 |
| bigjools | The concept I was missing was to make one IdP an SP for the other IdP | 22:04 |
| marekd | i don't understand how having two (more?) opensource project deployments instead of one can bring $ problems | 22:04 |
| bigjools | different availability zones | 22:04 |
| * morganfainberg glares at LaunchPad | 22:04 | |
| bigjools | poor Launchpad | 22:05 |
| morganfainberg | timeout... timeout... timeout | 22:05 |
| *** stevemar has joined #openstack-keystone | 22:05 | |
| *** ChanServ sets mode: +v stevemar | 22:05 | |
| marekd | bigjools: i still don't get it, but you probably know what you are doing | 22:05 |
| morganfainberg | yeah wonderful. | 22:05 |
| bigjools | marekd: it's ok, honest :) We do | 22:06 |
| bigjools | argh | 22:06 |
| bigjools | we don't want a single IdP in the same way that multiple organisations don't want only one when they federate | 22:07 |
| bigjools | marekd: so once I make an IdP an SP of another IdP, does the SP need multiple IdP <SSO> blocks in the shib-sp config? | 22:09 |
| bigjools | or is that transparent to the SP? | 22:09 |
| marekd | tbh i don't know, nkinder_ may help here. | 22:09 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:13 | |
| nkinder_ | bigjools: I'm not familiar with shib config on the SP side. | 22:14 |
| bigjools | sadly I am intimately familiar | 22:14 |
| gyee | bigjools, if you an SP to trust multiple IdPs, you can try chaining them | 22:14 |
| nkinder_ | bigjools: I'm not sure I get the reason for multiple IdPs here either (unless you have different groups of users for different IdPs) | 22:14 |
| gyee | https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider | 22:14 |
| bigjools | nkinder_: can you reference a doc that explains the shib IdP config? | 22:15 |
| bigjools | nkinder_: the multiple IdPs is a rollout constraint that I have | 22:15 |
| *** spandhe has quit IRC | 22:16 | |
| bigjools | gyee: I *think* I did that already - at least when I defined multiple MetadataProvider blocks it auto-chained them | 22:16 |
| gyee | multiple blocks won't work | 22:17 |
| gyee | we ended up chaining them | 22:17 |
| gyee | then in the mapping, make sure you look for the particular idp | 22:17 |
| *** iamjarvo has quit IRC | 22:18 | |
| bigjools | how does this work with the browser session, since the new SP won't know about it | 22:18 |
| gyee | I haven't tried the browser side yet, only K2K | 22:18 |
| bigjools | ah ok | 22:19 |
| bigjools | the shib session cookie that gets sent to the new SP won't hold a valid session | 22:19 |
| bigjools | K2K works differently IIRC | 22:20 |
| *** ayoung has joined #openstack-keystone | 22:20 | |
| *** ChanServ sets mode: +v ayoung | 22:20 | |
| bigjools | gyee: so when you talk about chaining, do you mean making use of the ChainingMetadataProvider? | 22:21 |
| bigjools | as per https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider#IdPMetadataProvider-ChainingMetadataProvider | 22:21 |
| gyee | bigjools, yes, that's in the situation where need to trust multiple IdPs | 22:23 |
| marekd | gyee: you sure idp chaining will get what bigjools wants? AFAIK it's usually a matter of idp created cookie that makes IDP to issue assertion again instead of asking for authentication again... | 22:23 |
| bigjools | yeah I think marekd is right | 22:23 |
| marekd | http cookie to be more specific. | 22:23 |
| gyee | not sure it will work with cookies | 22:24 |
| gyee | that only deals with assertions | 22:24 |
| marekd | gyee: a cookie is just a way to hold a session, so it's not an ultimate goal of this excercise :-) | 22:24 |
| bigjools | but that session cookie effectively needs to work with the new SP | 22:25 |
| bigjools | without requiring re-authn | 22:25 |
| marekd | bigjools: there are two cookies - idp cookie and sp cookie | 22:25 |
| *** spandhe has joined #openstack-keystone | 22:25 | |
| bigjools | not according to my browser there isn't : | 22:25 |
| bigjools | :) | 22:25 |
| marekd | ok, maybe it's different per implementation. | 22:26 |
| *** radez has quit IRC | 22:26 | |
| bigjools | I've got a _shibsession_fooxxxx cookie | 22:26 |
| bigjools | and one for Horizon | 22:27 |
| bigjools | oh actually you are right, I'm sorry. | 22:27 |
| *** bknudson has quit IRC | 22:28 | |
| *** sbasam has quit IRC | 22:28 | |
| marekd | i think it's nor defined per protocol specs, it's rather a matter of good practices and nicer ux implemented by idp devs. | 22:28 |
| marekd | s/nor/not/ | 22:28 |
| *** btully has joined #openstack-keystone | 22:29 | |
| marekd | anyways, i don't know how to make easily what you want to make. As long as you have a cookie you are somehow 'tied' with a session to your IdP. | 22:29 |
| btully | hi there. i’m having a hard time getting devstack master running and wondering if there was a known issue with keystone | 22:29 |
| bigjools | marekd: I will look into making the IdPs SPs of each other | 22:30 |
| *** radez has joined #openstack-keystone | 22:30 | |
| bigjools | thanks again for your help everyone | 22:30 |
| marekd | bigjools: ok, i'd look into using one idp instead of two :-) | 22:30 |
| *** rwsu has quit IRC | 22:30 | |
| marekd | seriously, where is the problem? | 22:31 |
| bigjools | marekd: I would like to do that :) But can't ( | 22:31 |
| btully | i’m seeing the following error in the log whenever i try to authenticate either through the keystone cli or through horizon | 22:31 |
| btully | http://paste.openstack.org/show/264126/ | 22:31 |
| *** c_soukup has joined #openstack-keystone | 22:31 | |
| gyee | marekd, currency exchange :) | 22:31 |
| marekd | gyee: I never know when you are making fun of me :-) | 22:32 |
| bigjools | marekd: the plan is to move to k2k when it can handle websso | 22:32 |
| bigjools | and there are effectively multiple IdPs there... :) | 22:32 |
| marekd | bigjools: yeah, but k2k is not a fully fledged IdP | 22:32 |
| bigjools | understood | 22:32 |
| marekd | and i don't think anybody will be trying to support all those nice features.... | 22:33 |
| bigjools | when I chatted with morganfainberg he said that we need to get it doing ECP assertions | 22:33 |
| bigjools | IIRC | 22:33 |
| marekd | bigjools: and it does ecp assertions | 22:33 |
| morganfainberg | wasn't ecp | 22:33 |
| morganfainberg | keystone doesn't do the redirects | 22:33 |
| bigjools | oh, my bad memory then | 22:33 |
| morganfainberg | bigjools: no worries :) | 22:34 |
| morganfainberg | we use ecp now for scripts etc. | 22:34 |
| bigjools | still learning lots of stuff :) | 22:34 |
| marekd | morganfainberg: keystone-idp you mean. | 22:34 |
| morganfainberg | marekd: yes | 22:34 |
| *** csd has quit IRC | 22:34 | |
| *** csoukup has quit IRC | 22:34 | |
| morganfainberg | marekd: since we rely on idp-initated | 22:34 |
| *** dontalton has quit IRC | 22:35 | |
| morganfainberg | if they wanted SP-initiated for K2K the redirect would need to be implemented | 22:35 |
| morganfainberg | bigjools: it's not easy. | 22:35 |
| *** csd has joined #openstack-keystone | 22:35 | |
| btully | mod_wsgi (pid=2850): Target WSGI script '/var/www/keystone/main' cannot be loaded as Python module | 22:35 |
| marekd | morganfainberg: yeah. redirects is easy, we don't even understand <saml2:Request> messages from SP, we cannot validate such things and lot's of other stuff we *don't* support. | 22:35 |
| morganfainberg | lots of things to think about when doing federation, heck i always 2x check before i write up how it works | 22:35 |
| morganfainberg | marekd: yeah there are other things we need too. | 22:35 |
| morganfainberg | but i said we were hesitent to make keystone a full IdP. not that is was off the table | 22:36 |
| jamielennox | A keystone species is a species that has a disproportionately large effect on its environment relative to its abundance.[1] Such species are described as playing a critical role in maintaining the structure of an ecological community, affecting many other organisms in an ecosystem and helping to determine the types and numbers of various other species in the community. | 22:36 |
| morganfainberg | but it was something we hadn't descided if we wanted at this juncture | 22:36 |
| bigjools | morganfainberg: I thought that we talked about doing an ECP assertion internally to get a token from the other IdP before passing control to its dashboard | 22:36 |
| stevemar | oh jamielennox is around | 22:36 |
| morganfainberg | stevemar: so uh | 22:36 |
| jamielennox | that's my morning wisdom | 22:36 |
| morganfainberg | stevemar: did you see my question? | 22:36 |
| stevemar | morganfainberg, about release schedule? | 22:36 |
| morganfainberg | jamielennox: going to be sending a email re that today | 22:36 |
| morganfainberg | stevemar: yes | 22:36 |
| jamielennox | and what happens when you mistype keystone-specs into search and instead get wikipedia | 22:37 |
| stevemar | morganfainberg, i meant do we have a cut off day for specs and code and such? | 22:37 |
| morganfainberg | stevemar: yes. it was announced that spec-proposal-freeze was Liberty-1 | 22:37 |
| morganfainberg | api impacting changes liberty-2 | 22:37 |
| morganfainberg | with the ability to do exceptions | 22:37 |
| *** iamjarvo has joined #openstack-keystone | 22:37 | |
| *** iamjarvo has quit IRC | 22:38 | |
| stevemar | gotcha | 22:38 |
| stevemar | just wanted it all official | 22:38 |
| morganfainberg | stevemar: but lets avoid exceptions if we can :) | 22:38 |
| *** iamjarvo has joined #openstack-keystone | 22:38 | |
| morganfainberg | bigjools: i think we discussed that you could get an assertion desitined for the original deployment (in K2K) if both were k2k targets | 22:39 |
| morganfainberg | for each other | 22:39 |
| bigjools | morganfainberg: right, that's what I mean. | 22:39 |
| jamielennox | what's the API to list users in a project? do you have to do via role assignments or something/ | 22:39 |
| morganfainberg | bigjools: and you can use the direct mapping (map to an existing user) to ensure it lands on the correct user on both sides | 22:39 |
| *** c_soukup has quit IRC | 22:39 | |
| morganfainberg | since you have direct LDAP access to supply the base identity information (ldap identity driver) | 22:40 |
| morganfainberg | marekd: cc ^^ for what they are doing | 22:40 |
| bigjools | morganfainberg: we're also looking at not using K2K and federating IdPs in each zone | 22:41 |
| jamielennox | whatever it is horizon is doing it wrong | 22:41 |
| david-lyle | wow | 22:41 |
| *** sbasam has joined #openstack-keystone | 22:41 | |
| david-lyle | that's probably true, but what are we doing wrong | 22:42 |
| marekd | bigjools: but even if you do 'federation' you will not get what you are looking at today. | 22:42 |
| jamielennox | david-lyle: i'm still looking at that, trying to track a bug report | 22:42 |
| bigjools | marekd: in what way? | 22:42 |
| *** markvoelker has joined #openstack-keystone | 22:42 | |
| david-lyle | jamielennox: ok | 22:42 |
| marekd | bigjools: this session replication. | 22:42 |
| morganfainberg | marekd: uhm. | 22:43 |
| morganfainberg | marekd: is that what they are asking for? | 22:43 |
| gyee | jamielennox, GET /v3/role_assignments?scope.project.id=id&effective | 22:43 |
| jamielennox | gyee: yuk | 22:44 |
| morganfainberg | marekd: i might be missing the new data, but the architecure i tlaked to them about was | 22:44 |
| marekd | morganfainberg: what 'them'? | 22:44 |
| morganfainberg | marekd: AD LDap in each side, and k2k between each side. use direct mapping rules to allow crossing the clouds w/o re-auth (username/password) | 22:44 |
| gyee | btully, that's the latest devstack? | 22:44 |
| btully | yes, origin/master | 22:44 |
| morganfainberg | marekd: so you could do normal K2K workflow to move between each site w/o re-auth, but not a session replication | 22:45 |
| gyee | looks like its having trouble loading a driver | 22:45 |
| gyee | not sure if the keystone.conf you have is correct | 22:45 |
| morganfainberg | btully: hm. what permissions are on /var/www/keystone/main | 22:46 |
| marekd | morganfainberg: yeah, | 22:46 |
| morganfainberg | marekd: so that should be fine. if there are things outside of that i don't know if the disucssion has moved. | 22:46 |
| *** iamjarvo has quit IRC | 22:47 | |
| morganfainberg | bigjools: ^ are we adding extra layering in? | 22:47 |
| jamielennox | david-lyle: ok so https://github.com/openstack/horizon/blob/master/openstack_dashboard/api/keystone.py#L302 calls https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/users.py#L78 which does a mistake and translates the project= param to default_project_id | 22:47 |
| btully | i wiped it and am rebuilding devstack, but will check once it boots up | 22:47 |
| marekd | morganfainberg: bigjools started asking about some setup with his idp being phpsimplesaml | 22:47 |
| *** markvoelker has quit IRC | 22:47 | |
| *** iamjarvo has joined #openstack-keystone | 22:47 | |
| morganfainberg | marekd: ah | 22:47 |
| bigjools | morganfainberg: Chet talked about looking at using multiple IdPs instead of k2k using keystone as idp | 22:47 |
| jamielennox | david-lyle: but that doesn't matter because neither project= or default_project_id= is in the list_users controller or spec, https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst#list-users or https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L219 | 22:47 |
| bigjools | my simplesamlphp is just in my test rig | 22:47 |
| morganfainberg | bigjools: ah. oh so [site1, [keystone], [idp]] <-------> [Site2, [kestone][idp]] | 22:48 |
| bigjools | morganfainberg: so anyway I'm just looking at this as a solution as well, but k2k is the ultimate goal. | 22:48 |
| morganfainberg | and just jumping across w/ just the normal federation | 22:48 |
| bigjools | morganfainberg: exactly. | 22:48 |
| bigjools | just using separate idp instead of keystone's | 22:48 |
| morganfainberg | e.g. i can login with the non-keystone IDP from each side. | 22:48 |
| morganfainberg | ahhhhhhh | 22:48 |
| morganfainberg | uhm | 22:48 |
| morganfainberg | probably wont be as smooth, you likely want the IDP to not be tied to the site then. | 22:49 |
| morganfainberg | and have both sides just use the same IDP [external] | 22:49 |
| bigjools | Chet was adamant it would work :) | 22:49 |
| jamielennox | david-lyle: so i'm trying to find anywhere in horizon where you do a user_list based on project | 22:49 |
| morganfainberg | it would work.. but it would require an explicit re-auth in a number of cases | 22:49 |
| marekd | morganfainberg: and this is what he wanted to avoid... | 22:49 |
| bigjools | oh really? do you know which cases offhand? | 22:50 |
| morganfainberg | bigjools: when you jump between sites | 22:50 |
| morganfainberg | since each IDP is considered to own the session | 22:50 |
| morganfainberg | marekd: yeah | 22:50 |
| marekd | morganfainberg: exactly | 22:50 |
| david-lyle | jamielennox: is this domain admin related? | 22:50 |
| gyee | jamlelennox, david-lyle, watch out for assignment inheritance and hierarchical stuff :) | 22:50 |
| david-lyle | not sure where the bug came from | 22:50 |
| bigjools | right - but apparently you can make each IdP an SP of the other IdPs to avoid the re-authn | 22:50 |
| morganfainberg | marekd: i see what is being asked for now | 22:50 |
| *** zzzeek has quit IRC | 22:50 | |
| marekd | :-) | 22:50 |
| morganfainberg | bigjools: oh god. uh........... | 22:50 |
| morganfainberg | i'm going to duck out of that | 22:51 |
| jamielennox | david-lyle: hmm, my repo is out of date and the reference i had seems to be gone | 22:51 |
| bigjools | which, thinking about it, is kinda what you're doing with k2k | 22:51 |
| *** gordc has quit IRC | 22:51 | |
| gyee | jamielennox, which bug? | 22:51 |
| jamielennox | gyee: not sure yet | 22:51 |
| morganfainberg | bigjools: i don't know of people doing that as much | 22:51 |
| bigjools | morganfainberg: me neither :) | 22:51 |
| morganfainberg | so, it might be "supported" in some cases or cause weird effects in others | 22:51 |
| bigjools | if it's going to be a nightmare then that's fine, I'm just looking at the option | 22:52 |
| morganfainberg | i'd say it might be a nightmare | 22:52 |
| david-lyle | jamielennox: without knowing what you're trying to solve, horizon direction is difficult | 22:52 |
| morganfainberg | it may also be a misunderstanding of how the prootocl handles sub-idps | 22:52 |
| morganfainberg | i haven't looked at that type of config tbh | 22:52 |
| marekd | me neither | 22:52 |
| morganfainberg | i've tried to keep it simple-ish | 22:52 |
| bigjools | I'll see if I can find out more and let you know | 22:52 |
| morganfainberg | because simple tends to have less ways for things to get bound up and less edge cases | 22:52 |
| bigjools | +1 | 22:52 |
| morganfainberg | bigjools: it is likely you can do things like that. | 22:53 |
| morganfainberg | but it is going to get complex fast | 22:53 |
| morganfainberg | very complex | 22:53 |
| morganfainberg | and federated identity is already complex | 22:53 |
| bigjools | tbh that's what I was thinking when I saw the k2k :) | 22:53 |
| morganfainberg | this is like sq(complex) | 22:53 |
| gyee | morganfainberg's inventing a new acronym KISI | 22:53 |
| bigjools | heh | 22:53 |
| morganfainberg | gyee: shus | 22:53 |
| morganfainberg | h | 22:53 |
| morganfainberg | :P | 22:53 |
| marekd | KISI? | 22:53 |
| jamielennox | david-lyle, gyee: so at least part of what i was seeing was fixed with: bug 1278920 | 22:53 |
| openstack | bug 1278920 in OpenStack Dashboard (Horizon) "Bad performance when editing project members" [Medium,Fix released] https://launchpad.net/bugs/1278920 - Assigned to Rodrigo Duarte (rodrigodsousa) | 22:53 |
| morganfainberg | marekd: i think he means KSDO | 22:54 |
| morganfainberg | KSDI* | 22:54 |
| *** ayoung has quit IRC | 22:54 | |
| gyee | KISI - Keep It Simple-Ish | 22:54 |
| marekd | ok, need to go to bed. good night. | 22:54 |
| morganfainberg | marekd: g'night dude | 22:55 |
| morganfainberg | gyee: uh no. | 22:55 |
| bigjools | nn marekd and thanks | 22:55 |
| morganfainberg | gyee: no just no :P | 22:55 |
| morganfainberg | we arleady have too many acronyms and initialisms | 22:55 |
| gyee | heh | 22:55 |
| bigjools | TMA | 22:55 |
| morganfainberg | notice i am trying to type out keystonemiddleware and keystoneclient everytime now | 22:55 |
| morganfainberg | bigjools: that is a TLA | 22:55 |
| bigjools | a specific kind of A | 22:55 |
| *** csoukup has joined #openstack-keystone | 22:56 | |
| gyee | jamielennox, yes, I can believe it | 22:56 |
| gyee | jamielennox, we need to better filtering on GET /role_assignments | 22:56 |
| jamielennox | gyee, david-lyle: as part of that fix they moved to testing for role assignments on projects and not looking for users in a project | 22:57 |
| jamielennox | cause that doesn't make sense in v3 | 22:57 |
| jamielennox | but that was marked juno.. | 22:57 |
| gyee | jamielennox, I am fine with GET /v3/projects/id/users | 22:57 |
| gyee | new API | 22:58 |
| gyee | but with assignment inheritance and hierarchical projects, I am afraid we may have to make schema changes | 22:58 |
| gyee | otherwise, perf may suck at the service side | 22:58 |
| dstanek | morganfainberg: caching is a good call - i'll check for that | 23:01 |
| *** csoukup has quit IRC | 23:01 | |
| morganfainberg | dstanek: yeah. this *sounds* like the endpoint is caching the token | 23:01 |
| morganfainberg | dstanek: it is similar thing as bug 1434034 | 23:02 |
| *** packet has joined #openstack-keystone | 23:02 | |
| jamielennox | david-lyle: ok, it appears it is at least fixed upstream and the person who reported it told me the wrong info | 23:02 |
| jamielennox | david-lyle: sorry to bug you | 23:03 |
| *** gordc has joined #openstack-keystone | 23:15 | |
| *** arunkant_ has quit IRC | 23:17 | |
| *** packet has quit IRC | 23:19 | |
| *** chlong has joined #openstack-keystone | 23:27 | |
| *** lhcheng has quit IRC | 23:32 | |
| *** lhcheng has joined #openstack-keystone | 23:36 | |
| *** ChanServ sets mode: +v lhcheng | 23:36 | |
| *** bradjones has quit IRC | 23:36 | |
| *** bradjones has joined #openstack-keystone | 23:39 | |
| *** davechen_afk has quit IRC | 23:39 | |
| *** hemna is now known as hemnafk | 23:43 | |
| *** ayoung has joined #openstack-keystone | 23:48 | |
| *** ChanServ sets mode: +v ayoung | 23:48 | |
| *** fangzhou has quit IRC | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!