| *** shoutm has joined #openstack-keystone | 00:01 | |
| *** ayoung has joined #openstack-keystone | 00:01 | |
| *** ChanServ sets mode: +v ayoung | 00:01 | |
| *** porunov has quit IRC | 00:02 | |
| kfox1111 | is gnocchi 2.0 compatable with data written by gnocchi 1.0 with the ceph backend? | 00:03 |
|---|---|---|
| gyee | stevemar, bknudson, https://review.openstack.org/#/c/283315/ | 00:04 |
| patchbot | gyee: patch 283315 - keystonemiddleware (stable/liberty) - Disble deprecation warning check when loading auth... | 00:04 |
| *** diazjf1 has quit IRC | 00:12 | |
| *** mylu has quit IRC | 00:13 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix project-related forbidden response messages https://review.openstack.org/283325 | 00:15 |
| *** mylu has joined #openstack-keystone | 00:20 | |
| *** mylu has quit IRC | 00:34 | |
| *** mylu has joined #openstack-keystone | 00:35 | |
| *** roxanaghe has quit IRC | 00:40 | |
| *** mylu has quit IRC | 00:40 | |
| *** gyee has quit IRC | 00:47 | |
| *** sdake_ has joined #openstack-keystone | 00:49 | |
| *** sdake_ has quit IRC | 00:49 | |
| *** sdake_ has joined #openstack-keystone | 00:49 | |
| *** sdake has quit IRC | 00:51 | |
| *** sdake_ has quit IRC | 00:56 | |
| *** edmondsw has joined #openstack-keystone | 00:56 | |
| *** tobasco has quit IRC | 00:56 | |
| *** jdennis1 has joined #openstack-keystone | 00:57 | |
| *** jdennis has quit IRC | 00:57 | |
| *** mylu has joined #openstack-keystone | 00:59 | |
| *** mylu has quit IRC | 01:00 | |
| *** tobasco has joined #openstack-keystone | 01:05 | |
| *** mylu has joined #openstack-keystone | 01:05 | |
| *** diazjf has joined #openstack-keystone | 01:07 | |
| *** EinstCrazy has joined #openstack-keystone | 01:16 | |
| *** davechen_afk is now known as spring | 01:32 | |
| *** spring is now known as Guest70063 | 01:33 | |
| *** Guest70063 is now known as grassy | 01:33 | |
| *** davechen has joined #openstack-keystone | 01:33 | |
| *** lhcheng has quit IRC | 01:35 | |
| *** clenimar has joined #openstack-keystone | 01:39 | |
| *** EinstCrazy has quit IRC | 01:40 | |
| *** spandhe has quit IRC | 01:41 | |
| *** EinstCrazy has joined #openstack-keystone | 01:42 | |
| *** clenimar has quit IRC | 01:42 | |
| *** sdake has joined #openstack-keystone | 01:57 | |
| *** edmondsw has quit IRC | 01:59 | |
| *** tobasco has quit IRC | 02:01 | |
| *** sdake has quit IRC | 02:04 | |
| *** browne has quit IRC | 02:05 | |
| *** mylu has quit IRC | 02:06 | |
| *** mylu has joined #openstack-keystone | 02:07 | |
| *** tobasco has joined #openstack-keystone | 02:07 | |
| *** sdake has joined #openstack-keystone | 02:07 | |
| *** lhcheng has joined #openstack-keystone | 02:08 | |
| *** ChanServ sets mode: +v lhcheng | 02:08 | |
| *** su_zhang has quit IRC | 02:09 | |
| *** mylu has quit IRC | 02:09 | |
| *** mylu has joined #openstack-keystone | 02:09 | |
| *** su_zhang has joined #openstack-keystone | 02:09 | |
| *** dims has quit IRC | 02:13 | |
| *** su_zhang has quit IRC | 02:14 | |
| *** mylu has quit IRC | 02:14 | |
| *** jasonsb has joined #openstack-keystone | 02:15 | |
| *** mylu has joined #openstack-keystone | 02:16 | |
| davechen | bknudson: hi, around? | 02:23 |
| *** mylu has quit IRC | 02:29 | |
| *** mylu has joined #openstack-keystone | 02:29 | |
| *** jorge_munoz has joined #openstack-keystone | 02:30 | |
| *** neophy has joined #openstack-keystone | 02:33 | |
| *** mylu has quit IRC | 02:36 | |
| *** sdake has quit IRC | 02:38 | |
| *** mylu has joined #openstack-keystone | 02:38 | |
| *** sdake has joined #openstack-keystone | 02:39 | |
| *** diazjf has quit IRC | 02:39 | |
| *** sdake has quit IRC | 02:41 | |
| *** phalmos has joined #openstack-keystone | 02:44 | |
| *** phalmos has quit IRC | 02:45 | |
| *** phalmos has joined #openstack-keystone | 02:45 | |
| *** dan_nguyen has quit IRC | 02:47 | |
| *** mylu has quit IRC | 02:47 | |
| *** mylu has joined #openstack-keystone | 02:48 | |
| *** phalmos has quit IRC | 02:50 | |
| *** mylu has quit IRC | 02:52 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:52 | |
| *** mylu has joined #openstack-keystone | 02:53 | |
| *** LZ has joined #openstack-keystone | 02:57 | |
| *** GB21 has quit IRC | 03:02 | |
| *** phalmos has joined #openstack-keystone | 03:06 | |
| *** mylu has quit IRC | 03:08 | |
| *** mylu has joined #openstack-keystone | 03:10 | |
| *** mylu has quit IRC | 03:16 | |
| *** jdennis1 has quit IRC | 03:16 | |
| *** mylu has joined #openstack-keystone | 03:16 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 03:16 |
| ayoung | GAH! I was going to do something so simple, so elegant. Just, duplicate the "main" pipeline on port 80 (soon to be 443) but I'm getting a an error trying to opmne the keystlone log | 03:17 |
| stevemar | ayoung: womp womp | 03:17 |
| stevemar | davechen: whats up? | 03:17 |
| ayoung | stevemar, is it true that two different things can't open the same log file? | 03:17 |
| ayoung | or am I trying to do it as the wrong user...but I see the wsgi app running as the keystone user | 03:17 |
| stevemar | two can probably open, maybe not write | 03:17 |
| *** mylu has quit IRC | 03:19 | |
| davechen | stevemar: just wanna ask Brant when we didn't add the domain_id to users, which change made this. | 03:20 |
| davechen | stevemar: just curious about that when i saw this patch - https://review.openstack.org/#/c/282042/2 | 03:20 |
| patchbot | davechen: patch 282042 - keystone - db_sync doesn't create default domain | 03:20 |
| ayoung | stevemar, I think we are making shadow users way too complicated. Just a quick check: do we really want to go that way? | 03:21 |
| *** jdennis has joined #openstack-keystone | 03:21 | |
| ayoung | stevemar, its just a knee jerk reaction. I know we need "something" along those lines. | 03:22 |
| ayoung | But, anyway... | 03:22 |
| openstackgerrit | Clenimar Filemon proposed openstack/keystone: Fix incorrect assumption when deleting assignments https://review.openstack.org/282696 | 03:24 |
| *** spzala has joined #openstack-keystone | 03:28 | |
| *** davechen is now known as davechen_afk | 03:31 | |
| *** ccard__ has joined #openstack-keystone | 03:32 | |
| *** jorge_munoz has quit IRC | 03:32 | |
| ayoung | stevemar, https://review.openstack.org/#/c/282017/3 is the epitome of the succinct code review. Care to push trhe button? | 03:33 |
| patchbot | ayoung: patch 282017 - python-keystoneclient - Support creation of domain specific roles | 03:33 |
| *** ccard_ has quit IRC | 03:35 | |
| morgan | ayoung: what is too complex [what part]? | 03:37 |
| stevemar | ayoung: i think shadow users is a must | 03:37 |
| morgan | ayoung: or just the whole thing? | 03:37 |
| * morgan still doesn't like the "name shadow user" | 03:37 | |
| stevemar | morgan: the bikeshed is over there *points* | 03:37 |
| ayoung | stevemar, I think the whole thing can be in one table | 03:38 |
| * morgan wishes we could just move to where everything is just a user and we can connect/link federated user to the "user" like some things | 03:38 | |
| ayoung | we need shadow users, I conceed | 03:38 |
| ayoung | concede | 03:38 |
| ayoung | conceded that point a long time back | 03:38 |
| morgan | ayoung: that much i can say i think is wrong. we probably need a couple tables not just one | 03:38 |
| morgan | <user> | <identity source> | <password, for $reasons$> makes sense | 03:38 |
| ayoung | password can be split | 03:38 |
| morgan | if you support more than one identity / authn source | 03:39 |
| morgan | you need a many-to-one table | 03:39 |
| stevemar | davechen_afk: not sure i understand your question? | 03:39 |
| ayoung | so two tables: users, paasswords, sure | 03:39 |
| *** browne has joined #openstack-keystone | 03:39 | |
| stevemar | davechen_afk: domain_id wasn't added to users | 03:39 |
| morgan | so <user> (local representation of data for the user, keystone/openstack specific), Password (yep), and then the map of IDP source/IDP ID -> user | 03:39 |
| ayoung | morgan, I don;t want to derail it. I just struck me each time I looked at it that I never liked having the id_mapping table and that we are making more of them | 03:39 |
| morgan | sure, but i think we need to future proof this | 03:40 |
| morgan | if we do it all in the user table, we get 1 and only 1 identity source | 03:40 |
| *** fawadkhaliq has quit IRC | 03:40 | |
| morgan | we could probably merge the identity mapping backend thing | 03:40 |
| ayoung | my gut says that this approach will work, but likely can be refactored to something simpler. Kindof like how I think the oauth code that stevemar wrote back in the stone age can merge with trusts | 03:40 |
| stevemar | def. stone age | 03:41 |
| morgan | sure, so the real benefit right now is this is all internal | 03:41 |
| ayoung | I still think we need to look at the relationship between Idps and domains | 03:41 |
| morgan | sure. but you also need IDP<ID> -> User | 03:41 |
| morgan | and you want more tha one IDP to be able to login to a local user. | 03:41 |
| ayoung | morgan, why not by way of domain | 03:41 |
| ayoung | idp->domain->user | 03:41 |
| ayoung | one IdP to one domain is the norm | 03:42 |
| morgan | most of the time the IDP isn't domain specific in application | 03:42 |
| morgan | s | 03:42 |
| ayoung | maybe we go one-to-many | 03:42 |
| morgan | You can map Google|Facebook|OIDC<generic> to <user> | 03:42 |
| ayoung | but users from one Idp probably should all go into one domain | 03:42 |
| ayoung | see...there is something different about those... | 03:42 |
| ayoung | the public IdPs... | 03:43 |
| ayoung | I don;'t know, sometimes I feel like I am relearning this each time we discuss it | 03:43 |
| morgan | but it's a known pattern | 03:43 |
| morgan | and it wouldn't be broken in the internal cloud/hosted cloud model | 03:43 |
| ayoung | OK...so, ayoung@redhat and admiyo@launchpad are both my accounts, but they still should be separable | 03:43 |
| morgan | but if we *needed* all google auth (for example) to go to a single domain, you might break the "public" format | 03:44 |
| ayoung | just becuase they are both me don't mean they come out of the same budget | 03:44 |
| *** fawadkhaliq has joined #openstack-keystone | 03:44 | |
| morgan | but do you agree that ayound@redhat and adimyo@launchpad *could* be two ways to login to the same user? | 03:44 |
| ayoung | aand I actually have 2 google Ids, I think, because redhat contracts with google | 03:44 |
| ayoung | so I can get google auth to confirm me as ayoung@redhat | 03:44 |
| morgan | assuming you aren't talking internal redhat cloud | 03:44 |
| *** fawadkhaliq has quit IRC | 03:44 | |
| *** fawadkhaliq has joined #openstack-keystone | 03:45 | |
| morgan | nothing says you can't make them separate, but why make it always separate and not allowed to be the same user? | 03:45 |
| * morgan is playing devils advocate | 03:45 | |
| *** fawadkhaliq has quit IRC | 03:45 | |
| * morgan really doesn't have much of a horse in this race | 03:45 | |
| ayoung | morgan, so...I sort of agree, but what if I get tossed from redhat, but have used other resources to create things using admiyo@launchpad? | 03:45 |
| morgan | the local user could be disabled. | 03:45 |
| morgan | or the grant to <redhat> domain is revoked | 03:46 |
| ayoung | there was an article I read a long time ago about medical records, and the issues with identifying people that came in to an ER | 03:46 |
| morgan | but the user may have access to another domain, and adimyo@launchpad is still valid | 03:46 |
| morgan | since billing based on <domain>|<project> | 03:46 |
| morgan | not based on <user> | 03:46 |
| ayoung | the whole : we don't know who you are, so we start a new record...3 days later you wake up and say you are "adam young" and they link your records, but then find out hey linked them with the wrong "Adam Young" | 03:47 |
| morgan | but the difference here is you have a known account | 03:47 |
| morgan | vs an unknown | 03:47 |
| ayoung | Its like we want to make sure everything is tagged by the credential used to make the resource. But then link resources to the same account? | 03:47 |
| morgan | you assert (and have credentials) for account X | 03:47 |
| morgan | so you as ayoung, link the account | 03:47 |
| morgan | vs. <nameless admin> linking without your knowledge | 03:48 |
| ayoung | right...it is that distinction... | 03:48 |
| morgan | you're asserting you can login to user anyway, so you wish to link another authn (if allowed) to use it | 03:48 |
| morgan | if you can't login, you can't link the other idp. | 03:49 |
| morgan | and by that token long term the deployer needs to restrict (policy?) the ability to link <random IDP> in | 03:49 |
| *** dims has joined #openstack-keystone | 03:49 | |
| ayoung | morgan, my point is that deactivating my redhat credential should not block me from using my launchpad account to authenticate, but it should prevent me from getting any more quota from a project paid for by redhat...unless I am contractor and explicitly added back in? | 03:50 |
| ayoung | Guh | 03:50 |
| ayoung | OK...I've made my own head hurt | 03:50 |
| morgan | right, but blocking your redhat access is likely more than blocking your user, if it's a shared cloud, it is likely revoking your grant to the redhat project | 03:50 |
| morgan | for the local user. | 03:50 |
| *** spandhe has joined #openstack-keystone | 03:50 | |
| ayoung | the use case I needed to be able to solve was a user coming in via two different auth mechanisms getting mapped to the same identity: SAML v. Kerberos\ | 03:51 |
| *** spzala has quit IRC | 03:51 | |
| ayoung | But that is just two ways of exposing the same data, just a difference in mapping | 03:51 |
| morgan | right | 03:51 |
| *** spzala has joined #openstack-keystone | 03:51 | |
| morgan | i'm aiming at the RAX case | 03:51 |
| ayoung | We do want to limit who can map *in* to a domain | 03:51 |
| morgan | your case is straightforward comparatively | 03:51 |
| morgan | and yes that is a deployer choice i think | 03:52 |
| ayoung | right now, only the domain admin can set up the mapping rules, and that does not really scale | 03:52 |
| morgan | unfortunately, we also have public clouds that you want <public IDP> to work. | 03:52 |
| ayoung | "they can't do that to our pledges!" | 03:52 |
| morgan | so. i think maybe the current design is the RAX case but it doesn't break your use case? | 03:52 |
| morgan | where if we only allowed per-domain, the RAX case wouldn't work? i think... | 03:53 |
| morgan | i *think* | 03:53 |
| morgan | if someone wants to use FB and Google and Launchpad OIDC, public clouds may want to let them all use any/all of those forms at once? i just don't know | 03:54 |
| *** spzala has quit IRC | 03:55 | |
| *** mylu has joined #openstack-keystone | 03:57 | |
| *** sdake has joined #openstack-keystone | 04:00 | |
| *** mylu has quit IRC | 04:00 | |
| *** fpatwa_ has joined #openstack-keystone | 04:01 | |
| *** links has joined #openstack-keystone | 04:03 | |
| *** shoutm_ has joined #openstack-keystone | 04:04 | |
| *** fpatwa_ has quit IRC | 04:05 | |
| *** shoutm has quit IRC | 04:05 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 04:09 |
| *** wolsen has quit IRC | 04:10 | |
| ayoung | morgan, care to https://review.openstack.org/#/c/282017/ kick that one over the edge | 04:10 |
| patchbot | ayoung: patch 282017 - python-keystoneclient - Support creation of domain specific roles | 04:10 |
| ayoung | WOOOOT | 04:14 |
| *** mylu has joined #openstack-keystone | 04:14 | |
| ayoung | stevemar, got it: And with that, I think we have a path to Keystomne running on port 443! | 04:14 |
| ayoung | http://paste.openstack.org/show/487828/ worked. | 04:15 |
| *** richm has quit IRC | 04:21 | |
| *** sdake has quit IRC | 04:28 | |
| *** GB21 has joined #openstack-keystone | 04:33 | |
| *** su_zhang has joined #openstack-keystone | 04:36 | |
| *** Nirupama has joined #openstack-keystone | 04:44 | |
| *** GB21 has quit IRC | 04:49 | |
| *** GB21 has joined #openstack-keystone | 04:49 | |
| stevemar | ayoung: i'll look at the DSR stuff in ksc soon | 05:13 |
| *** su_zhang has quit IRC | 05:27 | |
| *** su_zhang has joined #openstack-keystone | 05:28 | |
| *** browne has quit IRC | 05:30 | |
| *** diazjf has joined #openstack-keystone | 05:35 | |
| *** woodster_ has quit IRC | 05:36 | |
| *** GB21 has quit IRC | 05:41 | |
| *** GB21 has joined #openstack-keystone | 05:41 | |
| *** sdake has joined #openstack-keystone | 05:41 | |
| *** ankita_wagh has joined #openstack-keystone | 05:46 | |
| *** spandhe has quit IRC | 05:46 | |
| *** tomoiaga has joined #openstack-keystone | 05:48 | |
| *** dims has quit IRC | 05:54 | |
| *** jorge_munoz has joined #openstack-keystone | 05:54 | |
| *** GB21 has quit IRC | 05:55 | |
| *** GB21 has joined #openstack-keystone | 05:55 | |
| *** mylu has quit IRC | 05:57 | |
| *** sdake has quit IRC | 05:57 | |
| *** mylu has joined #openstack-keystone | 05:58 | |
| *** davechen_afk is now known as davechen | 06:01 | |
| *** shoutm_ has quit IRC | 06:05 | |
| *** wasmum has quit IRC | 06:08 | |
| davechen | stevemar: thanks, the commit message says domain_id wasn't added to users anymore, so i think it was added to users at one time. | 06:09 |
| *** shoutm has joined #openstack-keystone | 06:10 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 06:14 |
| stevemar | thanks jorge_munoz :) | 06:14 |
| jorge_munoz | np :) | 06:16 |
| *** jorge_munoz has quit IRC | 06:16 | |
| *** fawadkhaliq has joined #openstack-keystone | 06:18 | |
| *** shoutm has quit IRC | 06:19 | |
| *** GB21 has quit IRC | 06:21 | |
| *** fpatwa_ has joined #openstack-keystone | 06:21 | |
| *** GB21 has joined #openstack-keystone | 06:24 | |
| *** mariusv has quit IRC | 06:25 | |
| *** shoutm has joined #openstack-keystone | 06:25 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 06:28 |
| *** jorge_munoz has joined #openstack-keystone | 06:31 | |
| *** mylu has quit IRC | 06:31 | |
| *** mariusv has joined #openstack-keystone | 06:32 | |
| *** mariusv is now known as Guest98039 | 06:32 | |
| *** jaosorior has joined #openstack-keystone | 06:37 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Support creation of domain specific roles https://review.openstack.org/282017 | 06:39 |
| *** fpatwa_ has quit IRC | 06:41 | |
| *** diazjf has quit IRC | 06:43 | |
| *** GB21 has quit IRC | 06:47 | |
| *** GB21 has joined #openstack-keystone | 06:47 | |
| *** lhcheng has quit IRC | 06:48 | |
| stevemar | davechen: poke | 06:49 |
| davechen | stevemar: yes sir | 06:49 |
| *** Guest98039 has quit IRC | 06:53 | |
| *** marius- has joined #openstack-keystone | 06:53 | |
| *** marius- has quit IRC | 06:54 | |
| *** josecastroleon has joined #openstack-keystone | 07:00 | |
| *** neophy has quit IRC | 07:07 | |
| stevemar | davechen: i have a request -- can you update the cascade fix for the implied role patch? | 07:11 |
| *** fawadkhaliq has quit IRC | 07:11 | |
| stevemar | you seem to have a good handle on it, i saw your test on the abandoned patch, it looked good | 07:12 |
| davechen | stevemar: sure. | 07:12 |
| stevemar | i'll continue with it when i wake up | 07:12 |
| davechen | stevemar: will work on that. | 07:12 |
| stevemar | \o/ | 07:12 |
| stevemar | davechen: you can remove the rally and functional test code, nothing runs it :( | 07:13 |
| davechen | stevemar: and possibly split the patch into two paches. | 07:13 |
| davechen | stevemar: yep; | 07:13 |
| stevemar | good, we're of the same opinion :) | 07:13 |
| davechen | stevemar: :) | 07:14 |
| stevemar | bed time for me! | 07:14 |
| stevemar | davechen: thanks sir | 07:14 |
| davechen | stevemar: good night sir! | 07:14 |
| davechen | stevemar: np. | 07:14 |
| *** porunov has joined #openstack-keystone | 07:16 | |
| *** vinaym213 has joined #openstack-keystone | 07:32 | |
| vinaym213 | hello all | 07:33 |
| vinaym213 | morning | 07:33 |
| davechen | vinaym213: good morning. | 07:33 |
| vinaym213 | Getting an issue while deploying devstack on ubuntu 14.04 | 07:33 |
| vinaym213 | davechen , morning | 07:34 |
| vinaym213 | related to keystone | 07:34 |
| vinaym213 | http://paste.openstack.org/show/487834/ | 07:34 |
| vinaym213 | Any idea :0 | 07:34 |
| vinaym213 | :) | 07:34 |
| davechen | rm ~/.config/openstack/clouds.yaml and try again. | 07:36 |
| vinaym213 | No that file doesn't exist on my setup | 07:37 |
| *** GB21 has quit IRC | 07:38 | |
| davechen | vinaym213: maybe this thread is helpful - http://www.gossamer-threads.com/lists/openstack/dev/52507 | 07:43 |
| *** jed56 has joined #openstack-keystone | 07:44 | |
| *** jaosorior has quit IRC | 07:50 | |
| *** lhcheng has joined #openstack-keystone | 07:51 | |
| *** ChanServ sets mode: +v lhcheng | 07:51 | |
| *** boris-42 has quit IRC | 07:54 | |
| *** pcaruana has joined #openstack-keystone | 07:58 | |
| *** jaosorior has joined #openstack-keystone | 08:05 | |
| *** pcaruana is now known as pcaruana|afk| | 08:08 | |
| *** pcaruana|afk| is now known as pcaruana | 08:08 | |
| *** vinaym213 has quit IRC | 08:13 | |
| *** Oku_OS has quit IRC | 08:13 | |
| *** martinus___ has joined #openstack-keystone | 08:14 | |
| *** vinaym213 has joined #openstack-keystone | 08:14 | |
| *** mariusv has joined #openstack-keystone | 08:20 | |
| *** GB21 has joined #openstack-keystone | 08:23 | |
| *** ankita_wagh has quit IRC | 08:23 | |
| *** subscope has joined #openstack-keystone | 08:32 | |
| *** subscope has quit IRC | 08:36 | |
| *** daemontool has joined #openstack-keystone | 08:38 | |
| *** josecastroleon has quit IRC | 08:43 | |
| *** shoutm has quit IRC | 08:45 | |
| *** subscope has joined #openstack-keystone | 08:47 | |
| *** shoutm has joined #openstack-keystone | 08:48 | |
| *** rk4n has joined #openstack-keystone | 08:49 | |
| *** jistr has joined #openstack-keystone | 08:49 | |
| *** josecastroleon has joined #openstack-keystone | 08:50 | |
| *** su_zhang has quit IRC | 08:53 | |
| *** su_zhang has joined #openstack-keystone | 08:54 | |
| *** su_zhang has quit IRC | 08:58 | |
| *** fhubik has joined #openstack-keystone | 09:01 | |
| *** fhubik is now known as fhubik_brb | 09:01 | |
| *** daemontool has quit IRC | 09:05 | |
| *** henrynash has joined #openstack-keystone | 09:05 | |
| *** ChanServ sets mode: +v henrynash | 09:05 | |
| *** fhubik_brb is now known as fhubik | 09:06 | |
| *** shoutm has quit IRC | 09:17 | |
| *** subscope has quit IRC | 09:20 | |
| *** shoutm has joined #openstack-keystone | 09:23 | |
| *** mvk has quit IRC | 09:26 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 09:28 |
| *** jorge_munoz has quit IRC | 09:29 | |
| *** phalmos has quit IRC | 09:33 | |
| *** subscope has joined #openstack-keystone | 09:43 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Implied roles index with cascading update/delete https://review.openstack.org/281921 | 09:46 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Implied roles index with cascading delete https://review.openstack.org/281921 | 09:49 |
| *** mvk has joined #openstack-keystone | 09:53 | |
| *** davechen has left #openstack-keystone | 09:55 | |
| *** subscope has quit IRC | 09:57 | |
| samueldmq | morning keystoners | 10:00 |
| *** subscope has joined #openstack-keystone | 10:02 | |
| *** rk4n_ has joined #openstack-keystone | 10:03 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:03 | |
| *** rk4n has quit IRC | 10:04 | |
| *** fhubik is now known as fhubik_brb | 10:04 | |
| *** rk4n has joined #openstack-keystone | 10:04 | |
| *** fhubik_brb is now known as fhubik | 10:04 | |
| *** henrynash has quit IRC | 10:06 | |
| breton | morning | 10:06 |
| *** rk4n_ has quit IRC | 10:08 | |
| *** vinaym213 has quit IRC | 10:10 | |
| *** vinaym213 has joined #openstack-keystone | 10:10 | |
| *** fawadkhaliq has quit IRC | 10:14 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:14 | |
| *** EinstCrazy has quit IRC | 10:15 | |
| *** bdossant has joined #openstack-keystone | 10:16 | |
| *** belmoreira has joined #openstack-keystone | 10:17 | |
| *** daemontool has joined #openstack-keystone | 10:28 | |
| daemontool | all, I'm setting up keystone federated with saml2 as a protocol | 10:28 |
| daemontool | I'm adding the [saml2] group in keystone.conf but when i print the conf the saml2 group is not there :( | 10:29 |
| daemontool | anyone has any hint? | 10:29 |
| daemontool | so basically I'm adding groups in the keystone.conf but that they are not processed | 10:29 |
| *** fhubik is now known as fhubik_brb | 10:29 | |
| *** fhubik_brb is now known as fhubik | 10:30 | |
| *** jorge_munoz has joined #openstack-keystone | 10:33 | |
| odyssey4me | daemontool I'm confused - you're adding a section to keystone.conf and it isn't there? | 10:35 |
| daemontool | odyssey4me exactly | 10:35 |
| daemontool | I add [saml2] | 10:35 |
| daemontool | then I print all the keys in the CONF dict | 10:35 |
| daemontool | so [saml] is there | 10:35 |
| daemontool | while [saml2] is not | 10:35 |
| odyssey4me | daemontool ah, I see | 10:36 |
| odyssey4me | daemontool as far as I know, the section should be '[saml]' and then in the [auth] section you need 'saml2' in the 'methods' key list, and saml2 may need to be mapped like so: https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/os_keystone/templates/keystone.conf.j2#L52 | 10:37 |
| daemontool | looking | 10:37 |
| *** henrynash has joined #openstack-keystone | 10:38 | |
| *** ChanServ sets mode: +v henrynash | 10:38 | |
| *** jorge_munoz has quit IRC | 10:38 | |
| odyssey4me | I last worked with making federation work using the Kilo code-base so I'm a little rusty, but with OpenStack-Ansible we deploy it like that. The saml section starts here: https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/os_keystone/templates/keystone.conf.j2#L109 | 10:38 |
| odyssey4me | I take it that you're setting Keystone up as an IDP? | 10:39 |
| odyssey4me | If you're setting it up only as an SP, then those sections aren't required. | 10:39 |
| daemontool | odyssey4me, nope we are setting keyystone only as SP | 10:41 |
| daemontool | the IDP is openam (forgerock) | 10:41 |
| *** lhcheng has quit IRC | 10:41 | |
| odyssey4me | daemontool ah, in that case all you need is the SP related configs | 10:41 |
| odyssey4me | daemontool ie https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/os_keystone/templates/keystone.conf.j2#L157-L165 | 10:42 |
| odyssey4me | then you need to configure mod_shib / mod_mellon / <insert your saml2 provider here> | 10:42 |
| *** Nirupama has quit IRC | 10:42 | |
| odyssey4me | in OpenStack-Ansible we configure Keystone behind Apache2 and for SAML2 federation we use mod_shib | 10:43 |
| odyssey4me | mod_shib requires additional config, one is in Apache to tell it to trust mod_shib to handle auth: https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/os_keystone/templates/keystone-httpd.conf.j2#L33-L57 | 10:44 |
| daemontool | if I do not add the [saml2] group in keystone.conf from the logs it returns an error saying it cannot find the group saml2 | 10:45 |
| daemontool | yes we use mellon | 10:45 |
| daemontool | I should be almost there.... | 10:45 |
| odyssey4me | daemontool you only need that section if you have it referred to somewhere | 10:45 |
| daemontool | ok | 10:45 |
| odyssey4me | perhaps you have it referred to in your auth section's method list? | 10:46 |
| daemontool | yes | 10:47 |
| daemontool | [auth] | 10:47 |
| daemontool | methods = external,password,token,saml2 | 10:47 |
| daemontool | saml2 = keystone.auth.plugins.mapped.Mapped | 10:47 |
| *** shoutm_ has joined #openstack-keystone | 10:48 | |
| daemontool | so I need to remove the saml2 attribute there? | 10:48 |
| daemontool | If I remove it, it returns Internal server error | 10:49 |
| odyssey4me | daemontool yes, that's only used if Keystone is an IDP. You can also remove saml2 = ... as that's also for the IDP bits | 10:49 |
| daemontool | ah brilliant, let me try | 10:50 |
| *** shoutm has quit IRC | 10:50 | |
| daemontool | so removed both saml2 from auth group in keystone.conf | 10:51 |
| odyssey4me | another thing - I see that you have 'external' in the auth method list - what's that for? | 10:51 |
| odyssey4me | in our configs we only have 'password,token' for Keystone as an SP | 10:51 |
| *** spzala has joined #openstack-keystone | 10:52 | |
| *** Oku_OS has joined #openstack-keystone | 10:52 | |
| daemontool | I think it was already there by default | 10:52 |
| daemontool | trying to remove it | 10:52 |
| odyssey4me | daemontool something else worth noting, although I think the issues have been sorted out - for the Kilo code base fernet tokens didn't work so we had to revert to using UUID tokens when Federation was being used | 10:53 |
| daemontool | yes we use UUID | 10:54 |
| daemontool | I get the following error now: | 10:55 |
| daemontool | {"error": {"message": "Attempted to authenticate with an unsupported method. (Disable debug mode to suppress these details.)", "code": 401, "identity": {"methods": [password", "token"]}, "title": "Unauthorized"}} | 10:55 |
| odyssey4me | the issue I saw was fixed in Liberty: https://bugs.launchpad.net/keystone/+bug/1471289 | 10:55 |
| openstack | Launchpad bug 1471289 in OpenStack Identity (keystone) kilo "Fernet tokens and Federated Identities result in token scope failures" [High,In progress] - Assigned to Dolph Mathews (dolph) | 10:55 |
| daemontool | mmhh... | 10:55 |
| odyssey4me | hmm, unauthorised | 10:55 |
| odyssey4me | a few checks here | 10:56 |
| daemontool | unauthorized mean the authentication work but not the authorization? | 10:56 |
| daemontool | ok | 10:56 |
| *** spzala has quit IRC | 10:56 | |
| odyssey4me | the client, server and service catalogue all need to be using the same address that's configured in the IDP and the SP | 10:56 |
| daemontool | ok checking | 10:57 |
| odyssey4me | in the IDP I was testing with, SSL for any SP endpoints was required, so the public endpoint needed to be both SSL and using a DNS name to ensure that the SSL connection worked properly | 10:57 |
| *** Nirupama has joined #openstack-keystone | 10:58 | |
| odyssey4me | also, I found that Keystone would reply back through Apache with a different address to the one in the public endpoint, so I had to set the 'public_endpoint' entry in keystone.conf to make sure that Keystone always gave back the right address | 11:00 |
| odyssey4me | If you're using Horizon WebSSO then you need to also ensure that Horizon is configured to use Keystone's public endpoint because Horizon will redirect to Keystone which will then redirect to the IDP. | 11:01 |
| *** fhubik has quit IRC | 11:02 | |
| odyssey4me | oh, and of course, an essential piece of information - Federation requires Keystone v3 API endpoints to be configured and used | 11:02 |
| daemontool | odyssey4me, yes we use v3 | 11:02 |
| *** fawadkhaliq has quit IRC | 11:03 | |
| odyssey4me | daemontool keystone.conf will require the 'trusted_dashboard = <URL>' for each dashboard URL if you're using WebSSO, and the URL will be of the form: "https://{{ horizon_server_name }}/auth/websso/" | 11:04 |
| daemontool | in the endpoint list I have keystone only on admin and internal | 11:04 |
| daemontool | ok | 11:04 |
| daemontool | the strange thing I see is | 11:05 |
| daemontool | openstack --os-identity-api-version 3 identity provider show unica | 11:05 |
| daemontool | +-------------+-----------+ | 11:05 |
| daemontool | | Field | Value | | 11:05 |
| daemontool | +-------------+-----------+ | 11:05 |
| daemontool | | description | Unica Idp | | 11:05 |
| daemontool | | enabled | True | | 11:05 |
| daemontool | | id | unica | | 11:05 |
| *** martinus___ has quit IRC | 11:05 | |
| daemontool | | remote_ids | [] | | 11:05 |
| daemontool | +-------------+-----------+ | 11:05 |
| daemontool | there remote_ids is empty in the db | 11:05 |
| odyssey4me | yeah, that's not right I don't think: http://docs.openstack.org/developer/openstack-ansible/install-guide/configure-federation-use-case.html#identity-providers-on-the-service-provider | 11:07 |
| odyssey4me | we have some samples recorded there to help with troubleshooting | 11:07 |
| odyssey4me | you must have created that IDP though, so you can update the remote_id | 11:07 |
| odyssey4me | do you know the right URL for your provider's SAML2 endpoint? | 11:08 |
| daemontool | yes | 11:09 |
| daemontool | I could try to set it with | 11:09 |
| daemontool | openstack identity provider set .... | 11:09 |
| daemontool | something like that? | 11:09 |
| odyssey4me | yes, I think so - my memory is foggy, but it sounds right | 11:11 |
| daemontool | odyssey4me, yes thanks a lot trying | 11:11 |
| *** subscope has quit IRC | 11:21 | |
| *** davechen has joined #openstack-keystone | 11:23 | |
| *** rodrigods has quit IRC | 11:24 | |
| *** rodrigods has joined #openstack-keystone | 11:24 | |
| *** Nirupama has quit IRC | 11:31 | |
| *** fhubik has joined #openstack-keystone | 11:35 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Updates TOTP release note https://review.openstack.org/283520 | 11:35 |
| openstackgerrit | David Stanek proposed openstack/keystone: Renamed TOTP passcode generation function https://review.openstack.org/283521 | 11:35 |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP - Add validation for totp credentials https://review.openstack.org/283522 | 11:35 |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP - credential algorithms https://review.openstack.org/283523 | 11:35 |
| *** Nirupama has joined #openstack-keystone | 11:39 | |
| *** henrynash has quit IRC | 11:41 | |
| *** mancdaz has joined #openstack-keystone | 11:42 | |
| *** josecastroleon has quit IRC | 11:42 | |
| *** GB21 has quit IRC | 11:45 | |
| *** davechen1 has joined #openstack-keystone | 11:50 | |
| *** davechen has quit IRC | 11:52 | |
| *** EinstCrazy has joined #openstack-keystone | 11:52 | |
| *** mancdaz has quit IRC | 11:56 | |
| *** subscope has joined #openstack-keystone | 11:58 | |
| *** mancdaz has joined #openstack-keystone | 11:58 | |
| *** Nirupama has quit IRC | 12:01 | |
| *** Nirupama has joined #openstack-keystone | 12:16 | |
| *** davechen1 has left #openstack-keystone | 12:23 | |
| *** spzala has joined #openstack-keystone | 12:26 | |
| *** raildo-afk is now known as raildo | 12:26 | |
| *** lhcheng has joined #openstack-keystone | 12:30 | |
| *** ChanServ sets mode: +v lhcheng | 12:30 | |
| *** josecastroleon has joined #openstack-keystone | 12:30 | |
| *** spzala has quit IRC | 12:30 | |
| raildo | stevemar: are you around? it's about: https://review.openstack.org/#/c/243585/ | 12:31 |
| patchbot | raildo: patch 243585 - keystone - API support for project cascade update | 12:31 |
| *** fhubik is now known as fhubik_brb | 12:31 | |
| * raildo love this patchbot | 12:31 | |
| *** gordc has joined #openstack-keystone | 12:34 | |
| *** lhcheng has quit IRC | 12:34 | |
| *** jorge_munoz has joined #openstack-keystone | 12:34 | |
| *** links has quit IRC | 12:38 | |
| *** jorge_munoz has quit IRC | 12:39 | |
| *** shoutm has joined #openstack-keystone | 12:46 | |
| *** shoutm_ has quit IRC | 12:47 | |
| *** fesp has joined #openstack-keystone | 12:49 | |
| *** mvk has quit IRC | 12:49 | |
| *** mvk has joined #openstack-keystone | 12:50 | |
| *** henrynash has joined #openstack-keystone | 12:50 | |
| *** ChanServ sets mode: +v henrynash | 12:51 | |
| *** shoutm has quit IRC | 12:51 | |
| *** fesp has quit IRC | 12:51 | |
| *** fesp has joined #openstack-keystone | 12:53 | |
| *** martinus___ has joined #openstack-keystone | 12:55 | |
| *** shoutm has joined #openstack-keystone | 12:57 | |
| *** henrynash has quit IRC | 13:01 | |
| *** vinaym213 has quit IRC | 13:03 | |
| *** subscope has quit IRC | 13:05 | |
| *** fesp has quit IRC | 13:05 | |
| dstanek | dolphm: i was just looking at the shadow users patch trying to figure out why the expression is there and if it works; do you know if it does? | 13:13 |
| *** pauloewerton has joined #openstack-keystone | 13:13 | |
| dolphm | dstanek: i asked rderose that the other day -- it's part of / required for the hybrid property, but i haven't read that deeply into the docs | 13:15 |
| dolphm | dstanek: http://docs.sqlalchemy.org/en/latest/orm/extensions/hybrid.html#defining-expression-behavior-distinct-from-attribute-behavior | 13:15 |
| dolphm | dstanek: we're not doing anything special with the expression other than referencing a different attribute | 13:16 |
| dolphm | (from a different table) | 13:16 |
| Anticimex | marekd: what was the issue with lxml vs SAML2? looking at https://review.openstack.org/#/c/242512/ | 13:17 |
| patchbot | Anticimex: patch 242512 - keystoneauth - Switch saml2 from lxml to built-in xml | 13:17 |
| dstanek | dolphm: yeah, that's what concerns me. wring a test now, but my initial test is that it works just as well to return None | 13:17 |
| dolphm | dstanek: as in, sqlalchemy writes to the correct (new) table anyway? | 13:20 |
| *** fhubik_brb is now known as fhubik | 13:21 | |
| dolphm | or rather, reads | 13:21 |
| dstanek | dolphm: oh, interesting. we are not really using the expression (at least in the subset of tests i ran), but sqlalchemy turns a filter on User.name to a join. | 13:21 |
| *** subscope has joined #openstack-keystone | 13:22 | |
| dstanek | s/to/into/ | 13:22 |
| dstanek | dolphm: there's no problem with the patch other than maybe a hidden performance penalty for using those attributes | 13:23 |
| *** links has joined #openstack-keystone | 13:23 | |
| dolphm | dstanek: a performance penalty beyond joins? | 13:29 |
| dstanek | dolphm: just the join | 13:29 |
| dolphm | dstanek: i would like to have benchmark numbers between liberty and mitaka for a few user operations (including group membership crud) | 13:30 |
| dstanek | dolphm: that's a good call. i'm not worried to much about the join. it's just that it now obvious that a join is happening | 13:31 |
| *** subscope has quit IRC | 13:32 | |
| dstanek | dolphm: "session.query(User).filter_by(name='?')" joins implicitly | 13:32 |
| *** henrynash has joined #openstack-keystone | 13:32 | |
| *** ChanServ sets mode: +v henrynash | 13:32 | |
| dolphm | dstanek: to be fair, how else would you expect that to succeed? :P | 13:32 |
| *** josecastroleon has quit IRC | 13:35 | |
| dstanek | dolphm: exactly :) | 13:36 |
| *** fhubik is now known as fhubik_brb | 13:39 | |
| daemontool | odyssey4me, ping | 13:40 |
| *** henrynash has quit IRC | 13:40 | |
| *** henrynash has joined #openstack-keystone | 13:41 | |
| *** ChanServ sets mode: +v henrynash | 13:41 | |
| odyssey4me | daemontool pong | 13:41 |
| daemontool | {"error": {"message": "Unable to find valid groups while using mapping unica_map (Disable debug mode to suppress these details.)", "code": 401, "title": "Unauthorized"}} | 13:41 |
| *** josecastroleon has joined #openstack-keystone | 13:41 | |
| daemontool | I moved forward | 13:41 |
| raildo | henrynash: hey :) I'm trying to understand your suggestion on https://review.openstack.org/#/c/243585 it's something like.. "just create a new policy check for a query string it is better solution than create a new API call"? | 13:41 |
| daemontool | but I'm getting that error now | 13:41 |
| daemontool | from the browser | 13:41 |
| daemontool | after inserting creds to the idp login page | 13:41 |
| *** fhubik_brb is now known as fhubik | 13:41 | |
| odyssey4me | daemontool are you using a CLI tool, or browser to do the auth? | 13:41 |
| daemontool | browser | 13:41 |
| odyssey4me | ok, so browser | 13:41 |
| henrynash | raildo: so I just added two suggestions….(one of which is that) | 13:41 |
| odyssey4me | right, now each IDP works a little different | 13:42 |
| daemontool | we are using forgerock | 13:42 |
| odyssey4me | are you using Horizon's WebSSO capability to redirect you to the IDP auth page - or are you doing to the IDP first and it's redirecting you to Horizon? | 13:42 |
| henrynash | raildo: either you treat tree operations as somethinge “special” and they have their own plicy endpoint (even though the share the API with the non-cascade version) | 13:42 |
| raildo | henrynash: can we use something like this, right? https://github.com/openstack/keystone/blob/a9a47b62c87c7838bc06b0ce31974b7ba460353b/keystone/assignment/controllers.py#L657 | 13:42 |
| *** Nirupama has quit IRC | 13:43 | |
| odyssey4me | daemontool actually, looking at your error message it's likely a mapping issue - have you put together a map in keystone for your IDP attributes to map to your attributes coming from the IDP? | 13:44 |
| henrynash | raildo: yes, the list_assignments API gets “split” into two different policy endpints, depending on whether ther ?include_subtree query param is specified | 13:44 |
| *** fhubik is now known as fhubik_brb | 13:44 | |
| *** edmondsw has joined #openstack-keystone | 13:45 | |
| *** subscope has joined #openstack-keystone | 13:45 | |
| daemontool | odyssey4me, we are using this url http://localhost:5000/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}/auth | 13:45 |
| odyssey4me | daemontool while the specifics regading the OSA config in the first paragraph won't apply to you, the explanation of everything afterwards and the CLI examples will: http://docs.openstack.org/developer/openstack-ansible/install-guide/configure-federation-mapping.html | 13:45 |
| daemontool | from the browser | 13:46 |
| daemontool | and it redirects us to the forgerock login web ui | 13:46 |
| odyssey4me | daemontool and forgerock is on the same host? | 13:46 |
| daemontool | odyssey4me, ok I think I did that let me check | 13:46 |
| daemontool | ty | 13:46 |
| daemontool | nope | 13:46 |
| daemontool | we use the right fqdn | 13:46 |
| daemontool | it's on a dedicated node | 13:46 |
| odyssey4me | daemontool ok, but the browser needs to have the right referrer too, I would expect | 13:47 |
| odyssey4me | ie you can't use 'localhost' in your URL | 13:47 |
| *** wolsen has joined #openstack-keystone | 13:47 | |
| *** wolsen has quit IRC | 13:47 | |
| raildo | henrynash: Do you think we can have a problem if an operator use different roles in this two different policy endpoints? in other words, sounds odd a user can perform a delete operation and can't perform a cascade? (or vice versa) | 13:47 |
| daemontool | odyssey4me, yes I copied and pasted that url from the docs guide | 13:47 |
| daemontool | our url contain an fqdn | 13:48 |
| daemontool | and the uri is that one | 13:48 |
| odyssey4me | daemontool ok cool, just checking :) | 13:48 |
| daemontool | good good :) | 13:48 |
| daemontool | the referer header is there | 13:48 |
| daemontool | in the http header | 13:48 |
| daemontool | we are using saml tracker | 13:48 |
| daemontool | tracer | 13:48 |
| daemontool | to see the content | 13:49 |
| daemontool | I think the problem is on the mapping | 13:49 |
| henrynash | raildo: so it’s certainly possible of course, but that’s down to the policy writer…… | 13:49 |
| daemontool | it cannot find a valid group | 13:49 |
| daemontool | as it is written in the error | 13:49 |
| daemontool | but I'm not sure at this point | 13:49 |
| daemontool | how to map/change that | 13:49 |
| daemontool | odyssey4me, do you want me to paste the mappings here? | 13:49 |
| odyssey4me | daemontool yep, I dunno if mod_mellon has something like mod_shib does which allows you to see current sessions and their data | 13:49 |
| odyssey4me | daemontool pastebin it, then share the URL | 13:50 |
| henrynash | raildo: I guess the quetsion is whether the /cascde policy endpoint covers the top project and all its chiildren….I think it should | 13:50 |
| daemontool | odyssey4me, http://paste.openstack.org/show/487890/ | 13:55 |
| *** subscope has quit IRC | 13:55 | |
| dancn | Hello, trying to run tox -e py27 on a fresh git clone -b stable/kilo keystone I was hit by conflicting pip dependencies as detailed in https://bugs.launchpad.net/oslo.concurrency/+bug/1543425 Do you have a suggestion for a quick way to run the keystone test? Thanks in advance! | 13:58 |
| openstack | Launchpad bug 1543425 in oslo.concurrency "stable/kilo: fixtures 1.2.0 isn't compatible with testtools 2.0.0" [Undecided,New] | 13:58 |
| dolphm | dstanek: any concerns worth -1 / -2? | 13:58 |
| dolphm | dstanek: oooh, just saw your +2 | 13:59 |
| *** mvk has quit IRC | 14:00 | |
| dstanek | dolphm: no real concerns | 14:00 |
| *** mvk has joined #openstack-keystone | 14:01 | |
| dolphm | dstanek: hybrid property + expression basically just saving us from rewriting a bunch of existing code into managing explicit joins. i'm torn (that is, i don't have enough data either way) as to whether we should consider the use of hybrid properties to be tech debt or something valuable we should keep. | 14:01 |
| *** petertr7_away is now known as petertr7 | 14:02 | |
| *** pcaruana has quit IRC | 14:02 | |
| *** ninag has joined #openstack-keystone | 14:03 | |
| dstanek | dolphm: normally i would say that they should be removed because in my experience there will be a problem in the future since it's not obvious that a join will happen | 14:03 |
| dolphm | dstanek: i think we'll run into that too; or a non-optimal join of some sort | 14:03 |
| dstanek | dolphm: in this case we really hide the use of that model behind the driver interface and since that's in the same file it should be less problematic | 14:03 |
| dancn | oh, there is also an open keystone bug: https://bugs.launchpad.net/neutron/+bug/1541879 but the patch seems abandoned | 14:03 |
| openstack | Launchpad bug 1541879 in neutron "Neutron devstack gate fails to install keystone due to fresh testtools" [Critical,Confirmed] - Assigned to Ihar Hrachyshka (ihar-hrachyshka) | 14:03 |
| odyssey4me | daemontool ok, my first suggestion is to take the rule out for the group mapping - just to simplify the mapping and eliminate one variable - let's get a single user working before adding complexity | 14:04 |
| *** subscope has joined #openstack-keystone | 14:04 | |
| odyssey4me | daemontool also, 'sso_admins' != 'sso-admins' and additionally I'm not sure that the rule will do a regex or whether it requires a full match... that'll be for later once you have a single user working | 14:05 |
| raildo | henrynash: ok, thanks :) I'll follow this suggestion to create a policy check for cascade | 14:05 |
| dstanek | dancn: any reason not to update your test dependencies? | 14:05 |
| henrynash | raildo: ok | 14:05 |
| rodrigods | raildo, henrynash, this rule should be exclusive to domain admins, right? | 14:05 |
| dolphm | dancn: the patch https://review.openstack.org/#/c/276307/ looks to be abandoned because it's stable/kilo that broke, not master | 14:05 |
| patchbot | dolphm: patch 276307 - neutron - Cap version of testtools to fix gate (ABANDONED) | 14:05 |
| *** spzala has joined #openstack-keystone | 14:05 | |
| dolphm | dancn: the patch was to the wrong branch | 14:05 |
| henrynash | rodigods: I would imagine that this would be the default we would put in the policy file, yes | 14:06 |
| raildo | rodrigods: makes sense | 14:06 |
| dstanek | odyssey4me: daemontool: i'm not sure how the environment vars are created from the saml, but the ony_one_of looks strange to me | 14:06 |
| rodrigods | henrynash, raildo cool | 14:06 |
| *** jasonsb has quit IRC | 14:06 | |
| odyssey4me | dstanek any_one_of is an option according to http://docs.openstack.org/developer/keystone/mapping_combinations.html#mapping-conditions unless I'm misunderstanding what you're saying (cc daemontool ) | 14:07 |
| marekd | Anticimex: no issue | 14:08 |
| daemontool | odyssey4me, looking... | 14:08 |
| *** richm has joined #openstack-keystone | 14:08 | |
| marekd | Anticimex: lxml didn't have an issue - there was a plan to get rig of it. | 14:08 |
| marekd | Anticimex: the python'x xml didn't work for me on my adfs instance. | 14:08 |
| Anticimex | marekd: roger, thanks | 14:09 |
| odyssey4me | daemontool also note that in http://docs.openstack.org/developer/openstack-ansible/install-guide/configure-federation-mapping.html#identity-service-federation-attribute-mapping we set out a complete rule - a remote user which has a 'upn' (uid in your case) is mapped to a local user where we map out the name, group and domain group. | 14:09 |
| dstanek | odyssey4me: yes, exactly. i think what happens is we get an environment vars that we slip into a list and then any against that list. | 14:09 |
| odyssey4me | daemontool in your case a user and group are being mapped seperately, and I don't think that works | 14:10 |
| daemontool | odyssey4me, ok | 14:10 |
| marekd | Anticimex: willing to try that out? | 14:10 |
| marekd | Anticimex: have access to ADFS instances? | 14:10 |
| Anticimex | no, no ADFS | 14:10 |
| Anticimex | SAML2 | 14:10 |
| marekd | ADFS is a product | 14:11 |
| Anticimex | yeah, i realized | 14:11 |
| marekd | Active Directory Federated Services | 14:11 |
| Anticimex | but no, don't have it. using shibboleth | 14:11 |
| marekd | Anticimex: ok | 14:11 |
| Anticimex | some of our customeres-to-be may have it though, so there is interest | 14:11 |
| Anticimex | but not this week :] | 14:11 |
| *** jaosorior has quit IRC | 14:11 | |
| marekd | Anticimex: ok, current plugin works | 14:11 |
| Anticimex | cool | 14:11 |
| *** jaosorior has joined #openstack-keystone | 14:12 | |
| marekd | Anticimex: are you deploying federated access in production? | 14:13 |
| Anticimex | i'm trying to determine how much of head ache i will have based on our saml2 mapping, to use the old clients such as neutron | 14:13 |
| Anticimex | we map federated users via an admin or members group to a project, per domain | 14:13 |
| Anticimex | like a top level project | 14:13 |
| Anticimex | horizon sort of works, but now trying to understand the python clients, as not all features are in openstackclient yet | 14:14 |
| Anticimex | marekd: yeah, we met in tokyo if you may recall | 14:14 |
| dancn | dolphm: thanks, I will try to apply it stable/kilo locally and maybe propose it | 14:14 |
| dolphm | dancn: are the stable/kilo gate jobs failing though? | 14:15 |
| dolphm | dancn: make sure all your code is up to date (devstack and everything else) | 14:15 |
| dancn | dolphm: according to the bug report yes: The gate of stable/kilo is broken now like the following | 14:15 |
| dancn | dolphm: I am pretty new to keystone development, I have only a keystone checkout, I guess this should be enough for my testing pourpose | 14:17 |
| dolphm | dancn: i'm worried the bug report got fixed without being closed; i'm looking for the gate job now | 14:19 |
| daemontool | odyssey4me, another bit of information, from the keystone log, I see the following | 14:20 |
| daemontool | DEBUG keystone.contrib.federation.utils [-] mapped_properties: {'group_ids': [], 'user': {'domain': {'id': 'Federated'}, 'type': 'ephemeral'}, 'group_names': []} process /usr/lib/python2.7/site-packages/keystone/contrib/federation/utils.py:481 | 14:20 |
| daemontool | 2016-02-23 15:18:03.219 2963 WARNING keystone.common.wsgi [-] Authorization failed. Unable to find valid groups while using mapping unica_map | 14:20 |
| daemontool | but that mapped properties are different from the ones we have | 14:20 |
| daemontool | :/ | 14:20 |
| odyssey4me | daemontool yes, I think what's happening is that your user is being mapped, but the user mapping has no group in it | 14:21 |
| odyssey4me | daemontool as far as I know, the mapping is always first based on the user attribute... so your group mapping rule will never be hit | 14:21 |
| odyssey4me | daemontool I think it uses the first found rule, then ignores all subsequent rules | 14:22 |
| daemontool | ah ok | 14:22 |
| daemontool | that make sense | 14:22 |
| dolphm | dancn: well i found the job i was looking for, and have a failed log of it from 6 days ago (nothing more recent), but confused as to why there's no history in jenkins | 14:24 |
| dolphm | dancn: https://jenkins.openstack.org/job/periodic-keystone-python27-kilo/ | 14:24 |
| dolphm | dancn: build logs (look at the date column) http://logs.openstack.org/periodic-stable/periodic-keystone-python27-kilo/ | 14:25 |
| openstackgerrit | Merged openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 14:25 |
| dolphm | dancn: latest build is successful http://logs.openstack.org/periodic-stable/periodic-keystone-python27-kilo/a993507/console.html | 14:26 |
| *** esp has joined #openstack-keystone | 14:27 | |
| dancn | dolphm: thanks for investigating, also the cerry pick of the patch does not apply to stable/kiko | 14:28 |
| dstanek | stevemar: is there a list of the reseller stuff that we really want merged? the bp is listed for m3, but there are so many unmergable reviews associated with it | 14:29 |
| dancn | dolphm: I will dobule check that my tox env was not created with the master branch | 14:29 |
| *** links has quit IRC | 14:30 | |
| *** su_zhang has joined #openstack-keystone | 14:30 | |
| *** links has joined #openstack-keystone | 14:31 | |
| *** jsavak has joined #openstack-keystone | 14:31 | |
| dolphm | dancn: that's also not the devstack job, but it's the one i remember failing recently | 14:31 |
| *** esp has quit IRC | 14:32 | |
| dolphm | dancn: tox --recreate will create fresh tox environments | 14:32 |
| dancn | dolphm: unfortunately tox --recreate still fails, I noticed the cap chage Ife7b2f9894db9c9466ab4960549bbdee3bbe99bd in test-requiremenents.txt made by the bot, will investigate a bit more | 14:34 |
| dancn | dolphm: I will try to compare the py27 installed output from the gate and mine | 14:38 |
| *** jsavak has quit IRC | 14:44 | |
| *** jsavak has joined #openstack-keystone | 14:44 | |
| dolphm | dancn: tox in keystone itself? | 14:45 |
| dolphm | dancn: can you paste your tox output? | 14:45 |
| dancn | the diff are aioeventlet 0.4 vs 0.5.1 and wheel 0.24.0 cs 0.29.0 | 14:45 |
| dolphm | stevemar: bknudson: nkinder: what do we do about all these obvious & redundant security vulnerability reports that forever trickle in? they're getting sillier and sillier | 14:45 |
| dancn | dolphm: yes tox in keystone itself, will paste in few sec! | 14:46 |
| *** ayoung has quit IRC | 14:46 | |
| bknudson | dolphm: I don't have a solution. It's good that we're only getting silly vulnerability reports. | 14:46 |
| bknudson | dolphm: maybe some docs that we can point to? That would probably be more work. | 14:47 |
| bknudson | (more work than making a comment on the bug report) | 14:47 |
| dolphm | bknudson: i feel like we need to spend a summit session producing a security page in our docs that outlines our well known weaknesses and recommendations against them | 14:47 |
| dolphm | bknudson: and cite external specs / discussions / etc from there | 14:48 |
| dolphm | sort of a state-of-the-union | 14:48 |
| marekd | Anticimex: yeah, i do remember now :-) | 14:48 |
| bknudson | dolphm: That would help. At least we'd have something to point to. Can't expect security scanners that just push a button to read the docs, though. | 14:48 |
| dolphm | dancn: i'm running tox -e py27 on stable/kilo now -- i assume that's how you're seeing a failure? | 14:49 |
| *** mylu has joined #openstack-keystone | 14:49 | |
| stevemar | dolphm: i was thinking about that same topic recently in the latest bug triage | 14:49 |
| dolphm | bknudson: no, but it gives us one place to link to immediately close reports without any further undue process | 14:49 |
| *** shoutm has quit IRC | 14:49 | |
| bknudson | dolphm: y, since they're already publically disclosed it's easy to close security bugs. | 14:50 |
| dolphm | stevemar: is a summit session appropriate? i bet we could have a productive brain dump of tribal knowledge really quickly | 14:50 |
| dolphm | and then go from tribal knowledge to citations | 14:50 |
| dolphm | in code review | 14:50 |
| dancn | dolphm: yes tox -e py27 on stable/kilo! | 14:51 |
| stevemar | dstanek: i thought i cleaned that up | 14:51 |
| stevemar | dstanek: this should be the only patch for reseller left: https://review.openstack.org/#/c/231289/54 | 14:52 |
| patchbot | stevemar: patch 231289 - keystone - Projects acting as domains | 14:52 |
| *** ninag has quit IRC | 14:52 | |
| dstanek | stevemar: maybe i went to the bp and went to the last topic that was posted | 14:52 |
| stevemar | dstanek: or as it's been called -- reseller part 1 | 14:52 |
| dolphm | dancn: is this what you're seeing? http://cdn.pasteraw.com/lmvqwv78a8s96ur87a1lnvueurtj9qb | 14:52 |
| dancn | dolphm: here is my output: http://paste.openstack.org/show/487898/ | 14:52 |
| *** ninag has joined #openstack-keystone | 14:52 | |
| dstanek | stevemar: https://review.openstack.org/#/q/topic:bp/reseller+is:open | 14:52 |
| stevemar | dstanek: for https://blueprints.launchpad.net/keystone/+spec/reseller i put a little (merged) or (abandoned) next to each one that was closed | 14:53 |
| *** mylu has quit IRC | 14:53 | |
| dancn | dolphm: yes the error is the same | 14:53 |
| *** ninag has quit IRC | 14:53 | |
| *** ninag has joined #openstack-keystone | 14:53 | |
| *** slberger has joined #openstack-keystone | 14:53 | |
| dstanek | stevemar: ok, so my link is correct. just a few unmergable things | 14:54 |
| *** dims has joined #openstack-keystone | 14:54 | |
| *** sdake has joined #openstack-keystone | 14:55 | |
| stevemar | dstanek: yeah, but apparently those are not necessary for mitaka, according to the guys working on it :) | 14:55 |
| stevemar | just that last one i linked is needed | 14:55 |
| stevemar | dolphm: i'd be okay with a list of known vulnerabilities page on keystone docs | 14:55 |
| stevemar | "things we won't fix" | 14:55 |
| *** mylu has joined #openstack-keystone | 14:56 | |
| dolphm | stevemar: not necessarily things we won't fix, but things we're well aware of that you don't need to report | 14:56 |
| tristanC | or why not pointing at OpenStack Security Notes (ossn) for known issues ? | 14:56 |
| dolphm | there's a pile of specs asking for things like account lockout after repeated failed login attempts, for example. it'd give us a place to cite them all | 14:57 |
| stevemar | dolphm: yeah, thats worded more nicely | 14:57 |
| dolphm | tristanC: ++ | 14:57 |
| dolphm | tristanC: that's a good place to start | 14:57 |
| stevemar | dolphm: there are these bugs i found to be security related: https://bugs.launchpad.net/keystone/+bugs?field.tag=security | 14:57 |
| stevemar | why is "sample policies" tagged with security | 14:58 |
| dstanek | stevemar: the 'projects acting as domains' one? | 14:58 |
| stevemar | dstanek: yes | 14:58 |
| stevemar | dolphm: you tagged "sample policies" as security related :P | 14:58 |
| dolphm | stevemar: improves flexibility of RBAC? | 14:58 |
| stevemar | i guess, but that's more policy related | 14:59 |
| dstanek | htruta: are you working on an update for that? ^ | 14:59 |
| stevemar | *points to the bikeshed* | 14:59 |
| *** GB21 has joined #openstack-keystone | 15:00 | |
| stevemar | dolphm: i'm finally checking my email for the first time today, now i know why you brought up this topic :] | 15:00 |
| dolphm | stevemar: yeah... it's becoming a pet peeve | 15:01 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:01 | |
| *** jsavak has quit IRC | 15:01 | |
| dancn | dolphm: isn't strange that py27 installed list: testtools==2.0.0 when in test-requirements.txt we have testtools!=1.2.0,<2.0.0,>=0.9.36 ? Any hint? | 15:03 |
| dstanek | dancn: that was installed in your .tox/py27 venv? | 15:04 |
| *** tomoiaga1 has joined #openstack-keystone | 15:05 | |
| dancn | dstanek: yes | 15:05 |
| *** jsavak has joined #openstack-keystone | 15:05 | |
| *** dave-mcc_ has joined #openstack-keystone | 15:05 | |
| stevemar | dhellmann: think it's a good idea to bump the minimum version of cliff to the latest release? | 15:05 |
| *** ninag_ has joined #openstack-keystone | 15:05 | |
| dancn | dstanek: here is the full output: http://paste.openstack.org/show/487898/ | 15:06 |
| stevemar | dhellmann: since there was the `out of range` bug that was fixed | 15:06 |
| dstanek | dancn: what branch are you using? | 15:07 |
| *** ekarlso- has joined #openstack-keystone | 15:07 | |
| dancn | dstanek: fresh checkout of stable/kilo | 15:07 |
| *** links has quit IRC | 15:07 | |
| *** tomoiaga has quit IRC | 15:07 | |
| *** fhubik_brb has quit IRC | 15:07 | |
| *** ekarlso has quit IRC | 15:07 | |
| *** ninag has quit IRC | 15:07 | |
| *** GB21 has quit IRC | 15:07 | |
| *** dave-mccowan has quit IRC | 15:08 | |
| *** subscope has quit IRC | 15:11 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 15:12 |
| dolphm | dstanek: i reproduced it as well | 15:13 |
| dancn | dolphm, dstanek I do not know how to do a pip dependency analisys, but doing in a fresh venv pip install -r requirements.txt leads to a venv with testtools==2.0.0 | 15:14 |
| dstanek | dolphm: strange. i just did a "git co gerrit/stable/kilo" and tox -epy27 is currently running tests | 15:14 |
| dancn | pip -r req*.txt test-req*.txt find the conflict too late | 15:15 |
| dolphm | dstanek: hmm | 15:15 |
| dolphm | dstanek: with tox -r ? | 15:15 |
| dstanek | i completely deleted my .tox directory | 15:15 |
| *** shoutm has joined #openstack-keystone | 15:16 | |
| dstanek | hmmm...i did get testtools 2.0.0, but not conflict | 15:17 |
| *** pcaruana has joined #openstack-keystone | 15:18 | |
| dstanek | dolphm: dancn: the test-requirements.txt doesn't constrain to <2.0.0 | 15:19 |
| dstanek | dolphm: dancn: http://paste.openstack.org/show/487905/ | 15:19 |
| dstanek | dolphm: dancn: c4dc133 is the sha that i am using | 15:20 |
| *** pcaruana has quit IRC | 15:20 | |
| *** pcaruana has joined #openstack-keystone | 15:21 | |
| stevemar | dolphm: ohhhh dayummmm shadow merged | 15:21 |
| *** pcaruana|afk| has joined #openstack-keystone | 15:21 | |
| dancn | dstanek: I have this line in test-requirements.txt testtools!=1.2.0,<2.0.0,>=0.9.36, do you mean that it does not work? | 15:21 |
| dancn | 15:21 | |
| *** knikolla has joined #openstack-keystone | 15:22 | |
| dstanek | dolphm: i have a different value | 15:23 |
| dstanek | dancn: ^ | 15:23 |
| dstanek | dancn: what does 'git rev-parse HEAD' show? | 15:23 |
| dancn | dstanek: 47102e53aaa8c8cde1067cb900a20542a23268be | 15:23 |
| *** tomoiaga1 has quit IRC | 15:24 | |
| dstanek | dancn: very odd | 15:25 |
| *** petertr7 is now known as petertr7_away | 15:27 | |
| dstanek | dancn: how did you do the checkout and is your git up-to-date? i just confirmed that i was using the correct sha http://git.openstack.org/cgit/openstack/keystone/log/?h=stable/kilo | 15:27 |
| *** timcline has quit IRC | 15:27 | |
| *** pcaruana|afk| has quit IRC | 15:29 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Test for UWSGI (DO NOT MERGE EVER) https://review.openstack.org/283635 | 15:31 |
| dancn | IIRC git clone and then git branch stable/kilo | 15:31 |
| dancn | dstanek: ^^^ | 15:31 |
| dstanek | dancn: which repo did you clone? i want to reproduce | 15:32 |
| dancn | dstanek: originhttps://git.openstack.org/openstack/keystone | 15:32 |
| morgan | bknudson: +2/+A >.> | 15:32 |
| bknudson | morgan: now I know how to get reviews | 15:33 |
| *** jorge_munoz has joined #openstack-keystone | 15:33 | |
| morgan | bknudson: haha | 15:33 |
| bknudson | I'll make them like trolling headlines | 15:33 |
| morgan | exactly | 15:34 |
| bknudson | Obama doesn't want you to see this | 15:34 |
| morgan | hahaha | 15:34 |
| *** martinus___ has quit IRC | 15:34 | |
| dstanek | dancn: i get a different sha for the origin/stable/kilo branch. did you create a local stable/kilo? | 15:34 |
| dancn | dstanek, ah, well, now I remember better, then I tried to apply the patch referenced at: https://bugs.launchpad.net/neutron/+bug/1541879 using cherry pich | 15:36 |
| openstack | Launchpad bug 1541879 in neutron "Neutron devstack gate fails to install keystone due to fresh testtools" [Critical,Confirmed] - Assigned to Ihar Hrachyshka (ihar-hrachyshka) | 15:36 |
| *** pcaruana has quit IRC | 15:37 | |
| dancn | dstanek: it failed and I did git reset --hard (I guess) | 15:37 |
| dancn | dstanek: by the way, I just tested in a fresh venv pip install -r requirements.txt -r test-requirements.txt and it uses pip freeze shows: testtools==1.9.0 | 15:38 |
| dstanek | dancn: cool, i'm glad you have the issue resolved | 15:39 |
| *** timcline has joined #openstack-keystone | 15:41 | |
| *** porunov has quit IRC | 15:41 | |
| dancn | dstanek: well, it is not yet resolved... I am just trying to find why tox install testools=2.0.0 and pip alone seems to to the right thing. But tox, not yet! | 15:41 |
| *** petertr7_away is now known as petertr7 | 15:41 | |
| dstanek | dancn: i thought you were saying that when you updated to the right branch that it worked | 15:42 |
| *** daemontool_ has joined #openstack-keystone | 15:44 | |
| dstanek | dancn: have you gotten the correct branch yet? | 15:44 |
| dancn | dstanek: it worked for pip install -r, but I do not know why 'py27 installdeps' of tox install leads to a different result. I guess that tox does not call pip install but resove the dependencies in another way? | 15:44 |
| stevemar | bknudson: click bait review titles | 15:44 |
| htruta | dstanek: not at this exact moment. But I'll rebase them now | 15:45 |
| *** jaugustine has joined #openstack-keystone | 15:45 | |
| dancn | dstanek: to avoid confusion please give me the exact command you want me to do for getting the stable/kilo! thanks | 15:46 |
| dstanek | dancn: 'git co origin/stable/kilo' | 15:46 |
| *** daemontool has quit IRC | 15:46 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 15:47 |
| dancn | dstanek: ok, turned out to be a no-op: git reflog | 15:48 |
| dancn | 47102e5 HEAD@{0}: checkout: moving from stable/kilo to origin/stable/kilo | 15:48 |
| dancn | 47102e5 HEAD@{1}: checkout: moving from master to stable/kilo | 15:48 |
| dancn | 15:48 | |
| dstanek | dancn: 47102e5 is the correct sha | 15:48 |
| dstanek | dancn: i'm also using tox 2.1.1 on the machine that works | 15:49 |
| *** pcaruana has joined #openstack-keystone | 15:49 | |
| dstanek | dancn: then i just 'rm -rf .tox' and 'tox -e py27 --notest' | 15:49 |
| dancn | dstanek: running... | 15:50 |
| dancn | got: congratulations :) | 15:51 |
| dancn | dstanek: ^^^ | 15:51 |
| dancn | dstanek: but if I do only tox -e py27 I will see the original error: pkg_resources.ContextualVersionConflict: (fixtures 1.2.0 ... | 15:52 |
| dstanek | dancn: i don't see that. my tests just start running | 15:53 |
| dolphm | stevemar: bknudson: "Fixed bug with this one weird patch" | 15:53 |
| dancn | dstanek: dolphm was also able to reproduce: http://cdn.pasteraw.com/lmvqwv78a8s96ur87a1lnvueurtj9qb few mins ago... | 15:54 |
| stevemar | dolphm: https://twitter.com/stevebot/status/702158327804010496 | 15:54 |
| dancn | dstanek: I think the problem lies in the package dependecy resolution, but I to not know pip and tox enough to investigate it further | 15:56 |
| dstanek | dancn: if the --notest worked, i don't know how it would not work without that option | 15:57 |
| *** pushkaru has joined #openstack-keystone | 15:57 | |
| *** gokrokve has joined #openstack-keystone | 15:58 | |
| *** vinm213 has joined #openstack-keystone | 15:58 | |
| *** petertr7 is now known as petertr7_away | 15:58 | |
| *** phalmos has joined #openstack-keystone | 16:01 | |
| bknudson | why is "one" a trigger? I haven't figured that out. | 16:02 |
| bknudson | https://xkcd.com/1283/ | 16:04 |
| *** wanghua has joined #openstack-keystone | 16:04 | |
| *** mvk has quit IRC | 16:05 | |
| *** mvk has joined #openstack-keystone | 16:06 | |
| *** shoutm has quit IRC | 16:07 | |
| *** tobasco has quit IRC | 16:09 | |
| *** EinstCrazy has quit IRC | 16:13 | |
| *** jsavak has quit IRC | 16:13 | |
| *** subscope has joined #openstack-keystone | 16:14 | |
| *** jsavak has joined #openstack-keystone | 16:14 | |
| *** phalmos has quit IRC | 16:16 | |
| *** mylu has quit IRC | 16:19 | |
| *** mylu has joined #openstack-keystone | 16:20 | |
| *** clenimar has joined #openstack-keystone | 16:20 | |
| *** rderose has joined #openstack-keystone | 16:22 | |
| dancn | dstanek: could you show me the output of “.tox/py27/bin/pip freeze | egrep 'testtools|fixtures'” in your checkout? I see: fixtures==1.2.0 | 16:23 |
| dancn | testtools==2.0.0 | 16:23 |
| dancn | Thanks in advance! | 16:23 |
| dancn | 16:23 | |
| dstanek | dancn: i have the same | 16:25 |
| *** subscope has quit IRC | 16:27 | |
| *** petertr7_away is now known as petertr7 | 16:27 | |
| *** belmoreira has quit IRC | 16:27 | |
| dancn | dstanek: thanks, I was speculating that you may have had an older version of testtools because of some cache (it seems that the only available version is 2.0.0 on pypi, but this is not the case... | 16:27 |
| dancn | and to be fair pip is able to install 1.9.0 version using a cache: [...] Using cached testtools-1.9.0-py2.py3-none-any.whl but tox not... | 16:29 |
| *** dims has quit IRC | 16:37 | |
| *** gokrokve has quit IRC | 16:39 | |
| *** shoutm has joined #openstack-keystone | 16:40 | |
| stevemar | dolphm: dstanek https://review.openstack.org/#/c/283325/ all-ibm patch | 16:44 |
| patchbot | stevemar: patch 283325 - keystone - Fix project-related forbidden response messages | 16:44 |
| *** GB21 has joined #openstack-keystone | 16:44 | |
| *** subscope has joined #openstack-keystone | 16:45 | |
| *** su_zhang has quit IRC | 16:46 | |
| *** su_zhang has joined #openstack-keystone | 16:46 | |
| *** spandhe has joined #openstack-keystone | 16:48 | |
| *** bdossant has quit IRC | 16:49 | |
| *** jsavak has quit IRC | 16:49 | |
| *** su_zhang has quit IRC | 16:50 | |
| *** jistr has quit IRC | 16:51 | |
| *** jsavak has joined #openstack-keystone | 16:51 | |
| *** mylu has quit IRC | 16:54 | |
| dancn | dstanek, dolphm thanks for you help, I do not found the problem and the solution but I found a way to identify them! If I move the testtools requirements line to the top of requirements.txt tox works... so now I have to bisect the first correct position of testtools... do you think that this is worth doing it? I already started | 16:56 |
| *** mylu has joined #openstack-keystone | 16:58 | |
| dolphm | dancn: strange, it must be one of our dependencies expecting a newer version of testtools? | 16:59 |
| *** jsavak has quit IRC | 16:59 | |
| dolphm | dancn: IIRC, the gate is capable of keeping such breaking requirements out of the gate's pypi mirrors, even if they're available in pypi | 16:59 |
| *** bjornar_ has joined #openstack-keystone | 16:59 | |
| dolphm | dancn: i've never had to deal with that behavior myself | 16:59 |
| bjornar_ | I read httpd/keystone.py is deprecated as of Mitaka in favor of keystone-wsgi-admin and keystone-wsgi-public and may be removed in O .. where is keystone-wsgi-* located and why removed? | 17:00 |
| *** jsavak has joined #openstack-keystone | 17:00 | |
| dolphm | bjornar_: it's an entrypoint defined by setup.cfg | 17:00 |
| dolphm | bjornar: they're just arbitrary deployment files that can either be included in keystone itself (and easier to discovery via entry points), or you can write your own if you want to customize it; moving them to entry points prevents us from breaking deployers when we mess with them in the future (which we've done before) | 17:02 |
| bjornar_ | dolphm, ok. Another question. I am trying to run keystone with just the keystone-paste.ini file, and it seems something is trying to load /etc/keystone/keystone.conf .. but I get some complaints: | 17:03 |
| dolphm | bjornar: keystone will read it's configuration file regardless of whether or not you deploy it with paste | 17:04 |
| bjornar_ | no such option in group DEFAULT: trust | 17:05 |
| *** dan_nguyen has joined #openstack-keystone | 17:07 | |
| *** gokrokve has joined #openstack-keystone | 17:07 | |
| *** dims has joined #openstack-keystone | 17:09 | |
| bjornar_ | dolphm, any idea? | 17:09 |
| dolphm | bjornar_: do you have a configuration option named "trust" defined in your keystone.conf ? | 17:09 |
| dancn | dstanek, dolphm: well, really strange, in order to make tox run fine, the testtools line should be in requirements.txt (position independent), if I put in test-requirements.txt, even at first line, I have a failure! I do not have an explanation by I think I will open a bug. | 17:10 |
| stevemar | bjornar_: specifically in the DEFAULT section? | 17:10 |
| stevemar | bjornar_: what version of openstack are you using? | 17:10 |
| bjornar_ | its master.. | 17:10 |
| bjornar_ | uwsgi --venv /usr/src/venv_keystone/ --ini-paste keystone-paste.ini --paste-name main -s tmp | 17:11 |
| bjornar_ | dolphm, not a option, but a section | 17:11 |
| *** phalmos has joined #openstack-keystone | 17:11 | |
| *** browne has joined #openstack-keystone | 17:12 | |
| samueldmq | henrynash: hi! | 17:13 |
| *** csoukup has joined #openstack-keystone | 17:13 | |
| henrynash | samueldmq: hi | 17:13 |
| samueldmq | henrynash: so looks like we share the same view on 243585 | 17:13 |
| samueldmq | change 243585 | 17:13 |
| samueldmq | bot please ? change #243585 | 17:13 |
| *** shoutm has quit IRC | 17:14 | |
| morgan | samueldmq: patch 243585 | 17:14 |
| patchbot | morgan: https://review.openstack.org/#/c/243585/ - keystone - API support for project cascade update | 17:14 |
| samueldmq | arrgh, okay https://review.openstack.org/#/c/243585/ henrynash | 17:14 |
| patchbot | samueldmq: patch 243585 - keystone - API support for project cascade update | 17:14 |
| samueldmq | morgan: ooookay | 17:14 |
| samueldmq | :) | 17:14 |
| henrynash | samuedlmq: oj | 17:14 |
| henrynash | ok, even | 17:15 |
| samueldmq | henrynash: so, as I see it: if we want to enforce policy for each project, do it by getting a "fake" token for those projs | 17:15 |
| samueldmq | henrynash: at least for doing the enforce thing, so it's the same as you were getting a token on each subproject | 17:15 |
| *** diazjf has joined #openstack-keystone | 17:15 | |
| bjornar_ | dolphm, any idea here? | 17:15 |
| henrynash | samuedlmq: yes…and that feels a bit scary | 17:16 |
| henrynash | samuedlmq: we’ve certainly never done that before | 17:16 |
| dolphm | bjornar_: it sounds like there's a mismatch between what's in your keystone.conf and what keystone is expecting - can't comment further without seeing your keystone.conf | 17:16 |
| *** mylu has quit IRC | 17:16 | |
| *** gyee has joined #openstack-keystone | 17:16 | |
| *** ChanServ sets mode: +v gyee | 17:16 | |
| morgan | bjornar_: i am guessing [trust] lost it's '[' and ']' in the config? | 17:17 |
| samueldmq | henrynash: basically if https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L74 | 17:17 |
| bjornar_ | dolphm, its not about keystone.conf I think, since its ok when running with keystone-all | 17:17 |
| morgan | but what dolphm said. seeing the config will help (please strip passwords) | 17:17 |
| samueldmq | henrynash: _build_policy_check_credentials could get a user an a project and build the credentials from there (aside from the token_id as it does today) | 17:17 |
| henrynash | samueldmq: yep, you need to recreate that for each project you are cgecking | 17:17 |
| samueldmq | henrynash: we should be fine | 17:18 |
| morgan | or it's how uwsgi processes something? | 17:18 |
| samueldmq | henrynash: exactly, I will give it a try | 17:18 |
| samueldmq | henrynash: looks like we're on the same page | 17:18 |
| bjornar_ | morgan, I think it is not a config issue, since the same config is fine with keystone-all .. but it might be something with uwsgi or I dont really know, perhaps you know where this error could come from? | 17:18 |
| morgan | bjornar_: is trust the first section in your config file? | 17:19 |
| morgan | and you're not passing --config-file or whatever to the cli, right? | 17:19 |
| bjornar_ | morgan, no, [DEFAULT] is the first.. | 17:19 |
| morgan | sorry, after [DEFAULT] | 17:19 |
| * morgan assumed default was first. | 17:19 | |
| bjornar_ | now it is.. no change | 17:20 |
| henrynash | samueldmq: what if the domain admin wnats to restrict cacaded operations to a specist role? | 17:20 |
| bjornar_ | and not passing any option, only "uwsgi --venv /usr/src/venv_keystone/ --ini-paste keystone-paste.ini --paste-name main -s tmp" | 17:20 |
| henrynash | samuedlmq: I think we still need to preserve that option……somehow…so if we make it just like a regualr update, I;m not sure how they would do that… | 17:21 |
| morgan | bjornar_: sec. looking at something | 17:21 |
| samueldmq | henrynash: hm yes, that makes snse too, I guess it depends on how we see that operation | 17:22 |
| *** daemontool_ has quit IRC | 17:22 | |
| samueldmq | henrynash: from authz perspective, if we see it as a shortcut to a bunch of update calls, the proposed way makes sense | 17:22 |
| samueldmq | henrynash: if we see it as a new operation, maybe a new policy entry | 17:23 |
| samueldmq | henrynash: but if we do a new policy entry, how do we check one has authz on all the projects ? | 17:23 |
| morgan | bjornar_: and youre paste-ini has a uwsgi section? | 17:23 |
| morgan | bjornar_: iirc --ini-paste needs a uwsgi section | 17:23 |
| samueldmq | henrynash: we'd be at the other side of the issue | 17:23 |
| henrynash | samueldmq: I agree with your classification….and if we see it as the 2nd type, then you don’t worry about the roles on each project | 17:24 |
| morgan | oh i see you're doing --paste-name | 17:24 |
| morgan | nvm | 17:24 |
| bjornar_ | morgan, I dont know, does it? | 17:24 |
| morgan | which doesn't seem to be a uwsgi option | 17:24 |
| morgan | according to the uwsgi docs, yes | 17:24 |
| samueldmq | henrynash: in the first approach, we can also do that by combining the provided ?cascade (appears as a filter in the policy check?) | 17:24 |
| henrynash | samuedlmq: if we can do the 1st way, then that’s interesting….if we find peopel compaining that they really want a sepaate policy control, we can do that | 17:24 |
| morgan | i don't think you actually want uwsgi to manage the paste-ini for you, i think you want it to just run the wsgi file | 17:25 |
| bjornar_ | seems atleast self.group is None in NoSuchOptError | 17:25 |
| morgan | and let keystone manage the paste-ini | 17:25 |
| samueldmq | henrynash: makes sense to me | 17:25 |
| morgan | whcih is why config options aren't registered properly in all cases | 17:25 |
| *** josecastroleon has quit IRC | 17:25 | |
| samueldmq | henrynash: thinking further, may that apply to inherited assignments too ? | 17:25 |
| morgan | you need to use the keystone wsgi entry point, as it does a lot of setup | 17:25 |
| henrynash | samieldmq: if you were (in the 1st case) to but ‘cascade=True” into teh taget dict you pass the policy engine, then peopel coudl refernce it in the rule (and, fot instance, ban the use of tree opreations if they wanted) | 17:26 |
| morgan | and will consume the paste-ini in /etc/keystone (by default) | 17:26 |
| samueldmq | henrynash: like: someone in a parent has no access to me, but he can assign a role to me! | 17:26 |
| bjornar_ | morgan, ok, so I could do that in the keystone-paste.ini ? | 17:26 |
| samueldmq | henrynash: yes | 17:26 |
| morgan | ok so, you just need to use something like: (sec) | 17:27 |
| henrynash | samueldmq: or, more likely, perhaps require some higher powered role to do cascades… | 17:27 |
| *** mylu has joined #openstack-keystone | 17:27 | |
| *** sdake_ has joined #openstack-keystone | 17:28 | |
| samueldmq | henrynash: yes, so the higher powered role to do cascades | 17:28 |
| morgan | uwsgi --venv /usr/src/venv_keystone/ --py <path to the keystone wsgi entry script> -s tmp | 17:28 |
| samueldmq | henrynash: this is what we do for grating inherited role assignments | 17:28 |
| samueldmq | henrynash: because we don't check that use can assign roles in every project in the subtreee | 17:28 |
| morgan | i think | 17:28 |
| morgan | checking docs | 17:28 |
| *** ayoung has joined #openstack-keystone | 17:29 | |
| *** ChanServ sets mode: +v ayoung | 17:29 | |
| henrynash | samueldmq: for granting, no, we don;t check that….and not sure we wour want to | 17:29 |
| bjornar_ | morgan, but do I need the entry script actually? could it not be done in the paste? | 17:29 |
| *** phalmos has quit IRC | 17:30 | |
| henrynash | samueldmq: or we create a chicken and egg problem for big hierarchies | 17:30 |
| samueldmq | henrynash: would make sense not requiring that for grant and DO require that for cascade ops ? | 17:30 |
| *** sdake has quit IRC | 17:30 | |
| morgan | bjornar_: i wouldn't try it in the paste | 17:30 |
| morgan | bjornar_ well it might be doable, but honestly, never tried loading that much data into the paste | 17:31 |
| henrynash | samueldmq: so there is a difference between inherited and cascade…..inherited allie to new projects created AFTER you make teh assignment call, while cascade only operates on existing projects | 17:31 |
| morgan | bjornar_: soo.. no idea what issues you're going to run into | 17:31 |
| morgan | it might be --wsgi-file not --py btw | 17:31 |
| samueldmq | henrynash: maybe it does, so starting to check permission on every node is more restrictive | 17:31 |
| morgan | i'd need to go look at devstack to see what devstack supports/does | 17:31 |
| samueldmq | henrynash: so we start more restrictive and loosen it later if asked | 17:31 |
| samueldmq | henrynash: hmm, and that doesn't make sense to inherited roles anyway, because those roles apply to future projects too, so that would likely endup too complex | 17:32 |
| morgan | bjornar_: you likely would need to replicate the stuff done in the wsgi entry script in your paste-ini somehow, and add a uwsgi section somehow | 17:32 |
| *** sdake_ is now known as sdake | 17:33 | |
| henrynash | samuedlmq: for cascade, probably right | 17:33 |
| morgan | bjornar_: like i said, i have not spent any time on doing that kind of stuff | 17:33 |
| *** subscope has quit IRC | 17:33 | |
| samueldmq | henrynash: yes, and for role assingments, leave it as it is :) | 17:33 |
| bjornar_ | morgan, dont think I need any uwsgi section actually.. just need that the entrypoint does the required setup | 17:33 |
| henrynash | samueldmq: …and if you pass the project entity AND teh cascade option into target dict, I can see how to write a prolicy rule that is strict or relaxed | 17:33 |
| morgan | bjornar_: if you are using paste-ini under uwsgi like that with the --ini-paste option, i think you do need it. | 17:34 |
| morgan | i think | 17:34 |
| samueldmq | henrynash: I am not sure | 17:34 |
| *** mylu has quit IRC | 17:34 | |
| morgan | again, i haven't spent much time on this | 17:34 |
| samueldmq | henrynash: because the logic of iterating over all subnodes and checking policy is in the code | 17:34 |
| henrynash | samuedlmq: eg. you could write cascade(True) and domain_id(proejct.domainid) and role:x | 17:34 |
| samueldmq | henrynash: so not sure it can be more relaxed | 17:34 |
| samueldmq | henrynash: hm yes and that will be true for all projects, since they have the same parent | 17:35 |
| henrynash | samuedlmq: which would mean use a domain scoped token with role X to issue cascade ops | 17:35 |
| samueldmq | same domain | 17:35 |
| samueldmq | henrynash: ++ | 17:35 |
| *** therve has joined #openstack-keystone | 17:36 | |
| therve | Hi! | 17:36 |
| samueldmq | henrynash: btw, I submitted another patch to expose this bug in the current impl | 17:36 |
| samueldmq | henrynash: https://review.openstack.org/#/c/283168 | 17:36 |
| samueldmq | therve: hey | 17:36 |
| therve | Looks like we have a recent failure in Heat integration tests due to a recent merge | 17:36 |
| therve | It fails with "Column 'password' cannot be null" | 17:36 |
| *** GB21 has quit IRC | 17:37 | |
| therve | Presumably because of https://review.openstack.org/#/c/278570/ | 17:37 |
| patchbot | therve: patch 278570 - keystone - Shadow users - Separate user identities (MERGED) | 17:37 |
| bjornar_ | morgan, So I got it to work atleast with the keystone.py example file, but that is depricated.. how am I supposed to initialize it, what do you recommend? | 17:37 |
| morgan | bjornar_: there is a file automatically ceated via pbr | 17:37 |
| therve | rderose, ^^^ | 17:37 |
| morgan | bjornar_: that replaces the keysotne.py file | 17:37 |
| rderose | therve: yes | 17:38 |
| rderose | what's up | 17:38 |
| samueldmq | ayoung: dstanek: dolphm: you guys may have some insight related to therve's issue on heat integration ^ | 17:38 |
| samueldmq | rderose: ^ you too :) | 17:38 |
| therve | rderose, http://logs.openstack.org/97/283297/1/check/gate-heat-dsvm-functional-orig-mysql-lbaasv1/5c446f1/logs/apache/keystone.txt.gz?level=ERROR | 17:38 |
| morgan | bjornar_: https://github.com/openstack/keystone/blob/master/setup.cfg#L75-L76 | 17:38 |
| *** su_zhang has joined #openstack-keystone | 17:38 | |
| *** mylu has joined #openstack-keystone | 17:38 | |
| morgan | bjornar_: will be installed in the same place as keystone-all i think | 17:38 |
| ayoung | Yep...looks like it | 17:38 |
| therve | Looks like the enforcement to non-NULL breaks compatibility | 17:38 |
| ayoung | let's revert it for now, and try again | 17:39 |
| henrynash | samueldmq, ayoung: time, I think, t get https://review.openstack.org/#/c/231289/ in | 17:39 |
| patchbot | henrynash: patch 231289 - keystone - Projects acting as domains | 17:39 |
| dstanek | therve: so you were creating users with no passwords? | 17:39 |
| morgan | we need to make the default something like !*! or similar to a shadow file | 17:39 |
| morgan | ayoung: ^ | 17:39 |
| therve | dstanek, I think so yes, let me check | 17:39 |
| morgan | ayoung: if a user has no password | 17:39 |
| ayoung | morgan, ++ | 17:39 |
| samueldmq | henrynash: yes, I will take a look at that too | 17:39 |
| bjornar_ | morgan, but the scripts have not been written yet? | 17:39 |
| ayoung | something wonky with my IRC client...back in a flash | 17:39 |
| samueldmq | henrynash: that and cascade things are on my top priority for this week | 17:39 |
| *** ayoung has quit IRC | 17:39 | |
| morgan | might be as much/less work than a revert | 17:39 |
| morgan | bjornar_: those are written when you install keystone | 17:40 |
| henrynash | samueldmq: great | 17:40 |
| *** ayoung has joined #openstack-keystone | 17:40 | |
| *** ChanServ sets mode: +v ayoung | 17:40 | |
| morgan | ayoung: might be as much/less work than revert | 17:40 |
| samueldmq | morgan: hm, like storing a fake null value, as we did for domain roles | 17:40 |
| dolphm | samueldmq: rderose: it shouldn't be creating a password row at all, if there's no password. the password being non-nullable is not the issue | 17:40 |
| morgan | samueldmq: more like an /etc/shadow for a disabled user | 17:40 |
| ayoung | morgan, yep | 17:41 |
| dolphm | samueldmq: ... a fake null value? | 17:41 |
| dolphm | what on earth does that mean | 17:41 |
| ayoung | let me look at that review again..not sure how it passed CI | 17:41 |
| rderose | dolphm: correct | 17:41 |
| samueldmq | dolphm: a special null value should explain better | 17:41 |
| morgan | dolphm: sounds like some odd issues. | 17:41 |
| morgan | samueldmq: no, i'm wrong. | 17:41 |
| morgan | ou shouldn't need a password entry | 17:41 |
| dolphm | samueldmq: not really - what does that mean exactly? | 17:41 |
| morgan | something is trying to create one with a null value | 17:41 |
| samueldmq | dolphm: like <<<keystone.null.domain>>> | 17:41 |
| morgan | samueldmq: not needed | 17:42 |
| dolphm | samueldmq: can you link me to this tragedy? | 17:42 |
| samueldmq | dolphm: but that in the case what morgan said was correct | 17:42 |
| bjornar_ | morgan, ok.. not when I build a wheel .. | 17:42 |
| morgan | bjornar_: it might be somewhere else | 17:42 |
| morgan | i don't know. | 17:42 |
| samueldmq | dolphm: example https://review.openstack.org/#/c/264533/28/keystone/common/sql/migrate_repo/versions/089_add_root_of_all_domains.py | 17:42 |
| patchbot | samueldmq: patch 264533 - keystone - Allow project domain_id to be nullable at the mana... (MERGED) | 17:42 |
| samueldmq | dolphm: NULL_DOMAIN_ID = '<<keystone.domain.root>>' | 17:43 |
| morgan | bjornar_: it should be created with a wheel, i just don't know where it goes | 17:43 |
| morgan | samueldmq: like i said, not needed for password | 17:43 |
| bjornar_ | morgan, its nowhere in my venv | 17:43 |
| ayoung | nah, there should not be a row in the user table with a password field if there is no password... | 17:43 |
| morgan | samueldmq: that was a very specific case. | 17:43 |
| therve | dstanek, Actually, we don't, we disable an existing user | 17:43 |
| samueldmq | morgan: yep, just passing the links to dolphm | 17:43 |
| dstanek | therve: and that removes the password? | 17:43 |
| samueldmq | morgan: dolphm: and yes, that was for concurrency things | 17:43 |
| samueldmq | same as henrynash did for domain roles | 17:43 |
| therve | dstanek, That ought to be something on keystone side | 17:44 |
| morgan | dolphm: that was needed because NULL isn't part of a unique constraint in mysql | 17:44 |
| ayoung | I am going to guess that everytime we create a user, we are going to trigger a password creation the way that patch works | 17:44 |
| samueldmq | morgan: ++ | 17:44 |
| ayoung | https://review.openstack.org/#/c/278570/39/keystone/identity/backends/sql.py line 712 | 17:44 |
| patchbot | ayoung: patch 278570 - keystone - Shadow users - Separate user identities (MERGED) | 17:44 |
| ayoung | 71 | 17:44 |
| morgan | ayoung: yeah likey need to not create a password record if password is null | 17:44 |
| rderose | ayoung it shouldn't | 17:44 |
| morgan | ayoung: even esaier if that is a minor logic issue | 17:45 |
| ayoung | rderose, I think only create if Password != None | 17:45 |
| *** jorge_munoz has quit IRC | 17:45 | |
| dolphm | morgan: that's pretty awful | 17:45 |
| dstanek | ayoung: i think you are right | 17:46 |
| morgan | dolphm: so if we want unique constraints on a column, NULL is not considered, therefore you can have unlimited numbers of duplication on the non-null column | 17:46 |
| rderose | ayoung dstanek that would fix it or don't set password to None :) | 17:46 |
| morgan | dolphm: and it's a known behavior mysql supports | 17:46 |
| ayoung | rderose, I bet it is marshalling code doing it, not human effort | 17:46 |
| dstanek | rderose: if setting to a Falsy value delete the password? | 17:46 |
| *** petertr7 is now known as petertr7_away | 17:47 | |
| ayoung | rderose, 1: write a test | 17:47 |
| ayoung | test should fail | 17:47 |
| ayoung | 2: Write a check in there that shows test now passes. | 17:47 |
| ayoung | Ready, set, GO! | 17:47 |
| samueldmq | morgan: dolphm: yes, "is that since the uniqueness constraint contains a nullable value, we actually store a special value (as opposed to None) in the sql attribute so as to still use the sql uniqueness constraint to ensure we do not have race conditions in multi-process keystone configurations." | 17:48 |
| samueldmq | from https://review.openstack.org/#/c/261870/ | 17:48 |
| patchbot | samueldmq: patch 261870 - keystone - Add CRUD support for domain specific roles (MERGED) | 17:48 |
| dstanek | ayoung: rderose: two tests at least. creating with a Falsy password and updating the password to a Falsy value | 17:48 |
| dolphm | samueldmq: morgan: i understand the problem; still don't like the solution | 17:49 |
| bjornar_ | morgan, it is true that those are nowhere to be found in the whl | 17:49 |
| morgan | bjornar_: it's a pbr thing, it's created like a console script | 17:49 |
| samueldmq | dolphm: we can easily fix it if we find a better solution, since the special value is hidden and not even visible at manager level | 17:49 |
| morgan | if it isn't being created, it might be a PBR bug | 17:49 |
| rderose | ayoung dstanek should I just create small patch for this? | 17:50 |
| henrynash | stevemar: you up for an osc question? | 17:50 |
| dstanek | rderose: yep | 17:51 |
| ayoung | rderose, yes | 17:51 |
| henrynash | (or anyone else who knows osc well?) | 17:51 |
| dolphm | samueldmq: like undoing the merge of tables back to a model that accurately modeled the domain<-project relationship? | 17:51 |
| morgan | dolphm: not really different than the default domain, but we never leak this thing to the outside | 17:51 |
| dstanek | therve: did you make a bug for this? | 17:51 |
| * morgan shrugs | 17:51 | |
| morgan | i think the default domain is a trainwreck as well. | 17:51 |
| dolphm | except the default domain is not magic | 17:52 |
| morgan | but eh. | 17:52 |
| morgan | dolphm: i disagree, it is a lot of magic | 17:52 |
| morgan | dolphm: this is likewise about the same, it's a real record in the db same as the default domain. | 17:52 |
| dolphm | and this was just described as "a special null value" | 17:52 |
| morgan | it just is never leaked outside of the driver | 17:53 |
| dolphm | yet | 17:53 |
| morgan | so, it's an implementation detail in the driver. | 17:53 |
| dolphm | in the data* | 17:53 |
| morgan | at this point undoing the is_domain stuff is a ton of work, but would net the same thing. | 17:54 |
| morgan | i'd support that too. | 17:54 |
| * morgan really doesn't have a horse in this race. | 17:54 | |
| *** mvk has quit IRC | 17:56 | |
| *** su_zhang has quit IRC | 17:58 | |
| *** su_zhang has joined #openstack-keystone | 17:58 | |
| breton | meeting | 17:59 |
| stevemar | keystone meeting time | 17:59 |
| *** lhcheng has joined #openstack-keystone | 17:59 | |
| *** ChanServ sets mode: +v lhcheng | 17:59 | |
| *** pushkaru has quit IRC | 18:02 | |
| *** pushkaru has joined #openstack-keystone | 18:03 | |
| *** jsavak has quit IRC | 18:06 | |
| *** jsavak has joined #openstack-keystone | 18:07 | |
| *** pushkaru has quit IRC | 18:09 | |
| *** gokrokve has quit IRC | 18:09 | |
| *** mylu has quit IRC | 18:09 | |
| *** wanghua has quit IRC | 18:14 | |
| *** vgridnev has joined #openstack-keystone | 18:19 | |
| *** spzala has quit IRC | 18:20 | |
| *** haneef has quit IRC | 18:25 | |
| *** su_zhang has quit IRC | 18:30 | |
| *** su_zhang has joined #openstack-keystone | 18:30 | |
| *** mylu has joined #openstack-keystone | 18:31 | |
| *** jsavak has quit IRC | 18:31 | |
| *** su_zhang has quit IRC | 18:31 | |
| *** su_zhang has joined #openstack-keystone | 18:32 | |
| *** phalmos has joined #openstack-keystone | 18:32 | |
| *** mylu has quit IRC | 18:33 | |
| *** rk4n has quit IRC | 18:35 | |
| *** jsavak has joined #openstack-keystone | 18:35 | |
| *** mylu has joined #openstack-keystone | 18:36 | |
| *** vgridnev has quit IRC | 18:37 | |
| *** vgridnev has joined #openstack-keystone | 18:38 | |
| *** vinm213 has quit IRC | 18:41 | |
| *** mylu has quit IRC | 18:47 | |
| *** dave-mcc_ is now known as dave-mccowan | 18:52 | |
| *** jsavak has quit IRC | 18:55 | |
| *** jsavak has joined #openstack-keystone | 18:56 | |
| *** ninag_ has quit IRC | 18:56 | |
| *** ninag has joined #openstack-keystone | 18:56 | |
| *** subscope has joined #openstack-keystone | 18:56 | |
| *** spzala has joined #openstack-keystone | 18:58 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes a bug when setting a user's password to null https://review.openstack.org/283746 | 18:58 |
| *** jaosorior has quit IRC | 18:59 | |
| dstanek | breton: lol, ok | 18:59 |
| gyee | dstanek, you have a personal story to tell with regarding to 'mixin'? :D | 18:59 |
| ayoung | rderose, on https://review.openstack.org/#/c/283746/1/keystone/tests/unit/test_backend_sql.py did you run the test first and ssee it fail, prior to writing the code? | 18:59 |
| patchbot | ayoung: patch 283746 - keystone - Fixes a bug when setting a user's password to null | 18:59 |
| rderose | ayoung: of course :) | 19:00 |
| rderose | ayoung yes | 19:00 |
| *** spzala has quit IRC | 19:00 | |
| *** jsavak has quit IRC | 19:00 | |
| *** jsavak has joined #openstack-keystone | 19:01 | |
| *** spzala has joined #openstack-keystone | 19:01 | |
| ayoung | rderose, cool looking now | 19:01 |
| *** ninag has quit IRC | 19:02 | |
| ayoung | rderose, why this logic instead of just skipping: self.local_user and self.local_user.passwords: | 19:02 |
| ayoung | self.local_user.passwords = [] | 19:02 |
| rderose | ayoung, if local_user is null, then can't reference local_user.passwords | 19:03 |
| ayoung | rderose, so why set it equal to an empty array? I am sure there is a reason | 19:04 |
| dims | bknudson : does the yaml+oslo.policy need to land for Mitaka? https://review.openstack.org/#/q/topic:yaml | 19:04 |
| bknudson | dims: nothing depends on it. | 19:05 |
| henrynash | stevemar: got a second to answer an osc question? | 19:05 |
| bknudson | just makes things easier to use | 19:05 |
| rderose | ayoung if the user was created with a password and then updates with a null password, then remove the old password | 19:05 |
| rderose | ayoung does that make sense? | 19:05 |
| ayoung | OK it makes sense | 19:05 |
| rderose | ayoung: cool | 19:05 |
| dims | bknudson : ack, then first thing for Newton then | 19:06 |
| bknudson | waiting for newton is safer at this point | 19:06 |
| *** ninag has joined #openstack-keystone | 19:07 | |
| *** josecastroleon has joined #openstack-keystone | 19:07 | |
| openstackgerrit | Merged openstack/keystone: Avoid using `len(x)` to check if x is empty https://review.openstack.org/281374 | 19:08 |
| *** subscope has quit IRC | 19:08 | |
| *** petertr7_away is now known as petertr7 | 19:10 | |
| ayoung | rderose, +2A | 19:12 |
| rderose | ayoung: :) | 19:12 |
| rderose | ayoung: and thanks | 19:13 |
| *** rderose has quit IRC | 19:13 | |
| *** pushkaru has joined #openstack-keystone | 19:17 | |
| *** vgridnev has quit IRC | 19:19 | |
| stevemar | henrynash: back | 19:21 |
| *** clenimar has quit IRC | 19:23 | |
| *** vgridnev has joined #openstack-keystone | 19:24 | |
| ayoung | lbragstad, where are we with https://review.openstack.org/#/c/258650/ | 19:26 |
| patchbot | ayoung: patch 258650 - keystone - [WIP]Make fernet default token provider | 19:26 |
| stevemar | dims: bknudson definitely wait til N for the yaml support | 19:30 |
| henrynash | stevemar: actually I’m slinking off to dinner, so be back on later | 19:30 |
| stevemar | henrynash: alrighty | 19:30 |
| bknudson | bon apetit | 19:30 |
| henrynash | ah merci, mes amis | 19:32 |
| bjornar_ | Can I ask why you chose fernet, and not a improved version of it? | 19:34 |
| bjornar_ | I mean.. a version that for example has information about token expire time | 19:34 |
| dolphm | bjornar_: define "improved"? | 19:34 |
| bjornar_ | so one could check it early and cheeply | 19:35 |
| *** su_zhang has quit IRC | 19:35 | |
| *** su_zhang has joined #openstack-keystone | 19:36 | |
| dolphm | bjornar_: we include the expiration in the payload, but fernet's model is to use the token's creation time + a TTL determined by the client. i'd like to move to that model anyway | 19:36 |
| bjornar_ | The basic idea is ok, I guess | 19:36 |
| dolphm | the creation time is available in plain text | 19:36 |
| bjornar_ | but expiration should be in plain text | 19:36 |
| bjornar_ | ..as well | 19:36 |
| morgan | bjornar_: i disagree | 19:36 |
| bjornar_ | morgan, why? | 19:36 |
| *** josecastroleon has quit IRC | 19:37 | |
| bjornar_ | morgan, I think it is wrong that expired tokens are "expensive" | 19:37 |
| morgan | bjornar_: the token format is opaque because we change internals of the token itself as needed. the token format data [internal] should not be introspected directly | 19:37 |
| morgan | ask keystone if you need the data | 19:37 |
| bjornar_ | Yeah, I think the token format in general is fine | 19:37 |
| dolphm | bjornar_: clients can introspect the creation time, apply a TTL, and decide whether or not to validate it against keystone "cheaply" | 19:38 |
| morgan | the token payload data beyond being fernet is not a contract | 19:38 |
| bjornar_ | I just see a problem with expiration .. but true, dolphm | 19:38 |
| morgan | so HMAC(create_time, AES_ENCRYPTED_PAYLOAD) | 19:38 |
| dolphm | bjornar_: what's the problem? | 19:38 |
| dstanek | bjornar_: how short is you ttl that it's a performance problem? | 19:38 |
| bjornar_ | dolphm, but requires frontend to know about ttl | 19:39 |
| morgan | you could configure the app that needs to introspec the token to do create_time + ttl compared to now() | 19:39 |
| bjornar_ | I just say that expiration time is more important than creation time | 19:39 |
| morgan | bjornar_: then ask keystone. again, i am very much against the token payload being a contract | 19:39 |
| dolphm | bjornar_: i'd be happy to hear your reasoning | 19:39 |
| morgan | we tried this with PKI and it means we're locked in. also Fernet spec doesn't really allow it | 19:40 |
| *** su_zhang has quit IRC | 19:40 | |
| bjornar_ | I think the general fernet token is fine, and I have infact implemented a version of it myself | 19:40 |
| bjornar_ | The only thing I dislike is that you have to do "heavy" calculations to figure if a expired token is valid | 19:41 |
| morgan | bjornar_: fernet is a published spec. not something we can easily change without reimplementing the code to generate it | 19:41 |
| bjornar_ | this could be done alot cheaper with a "based-on" approach | 19:41 |
| bjornar_ | and fernet is not a RFC | 19:41 |
| morgan | it is not an RFC, it is a published spec | 19:41 |
| bjornar_ | its afaik something used inhouse | 19:41 |
| morgan | i am against re-implementing code for the sake of limited benefit | 19:42 |
| bjornar_ | im against using bad specs when we could have better ;) | 19:42 |
| bjornar_ | its not that important, really | 19:42 |
| bjornar_ | but I have a point | 19:42 |
| morgan | i disagree with your point and classification of it being a bad spec | 19:42 |
| morgan | if we're making more of a departure we should remove bearer tokens | 19:43 |
| bjornar_ | I dont mean its a _bad_ spec | 19:43 |
| morgan | we tried more data available for anyone to introspect from the token payload, and it really is a bad idea | 19:43 |
| bjornar_ | just as everything could be a bit better | 19:43 |
| *** timcline_ has joined #openstack-keystone | 19:43 | |
| morgan | it was a trainwreck. we intentionally chose to ensure that the payload was opaque so we weren't locked into someone directly looking at the payload | 19:44 |
| morgan | the data format is optimised in a way to limit the size of the token id (based on the payload) | 19:44 |
| bjornar_ | but that would still be true with Version ‖ Timestamp || TTL ‖ IV ‖ Ciphertext | 19:45 |
| morgan | and it allows us to make changes internally to the payload without breaking people | 19:45 |
| morgan | again i disagree, this means we can change the timestamp to be an int or a bytepack, or anything else | 19:45 |
| morgan | erm TTL. | 19:45 |
| bjornar_ | but thats the spec | 19:45 |
| morgan | no the spec is HMAC(create_time, AES_ENCRYPTED) | 19:46 |
| morgan | anyway. | 19:46 |
| bjornar_ | anyway | 19:46 |
| dolphm | bjornar_: so you don't value distributed systems enforcing varying TTL's? | 19:46 |
| bjornar_ | dolphm, yes.... | 19:46 |
| bjornar_ | dolphm, dont know how that relates. | 19:47 |
| bjornar_ | Only thing I say is that with a ttl in plain, it would be cheaper to calculate expired tokens, thats all | 19:47 |
| dolphm | bjornar_: that's the use case for keeping the TTL as something that can be enforced client-side: distributed systems enforcing varying TTLs | 19:47 |
| dolphm | bjornar_: you're assuming all clients should enforce the same ttl | 19:48 |
| bjornar_ | dolphm, on the same token? | 19:48 |
| dolphm | yes | 19:48 |
| morgan | bjornar_: either you trust keystone, or you don't | 19:48 |
| bjornar_ | dolphm, so you have the same token with different ttls? | 19:48 |
| morgan | if you're trusting keystone to enforce the TTL, you don't care about the TTL being different on different systems | 19:48 |
| bjornar_ | its not important tho, a minor detail anyway | 19:49 |
| morgan | i also feel like this is an over optimisation | 19:49 |
| morgan | and would force us to carry a lot more code. | 19:50 |
| *** jsavak has quit IRC | 19:50 | |
| dolphm | bjornar_: that is how fernet is designed, yes. we are not currently taking advantage of that behavior, but we could move in that direction fairly easily. | 19:50 |
| bjornar_ | I actually liked the ideas with CMS, but see that it does not scale when object grows | 19:50 |
| bjornar_ | morgan, the small nice thing is ofcorse that "everyone" could reject expired without asking ks | 19:51 |
| *** fawadkhaliq has joined #openstack-keystone | 19:52 | |
| *** jsavak has joined #openstack-keystone | 19:53 | |
| dolphm | bjornar_: almost like you can do today =) | 19:55 |
| bjornar_ | dolphm, ok? | 19:55 |
| dolphm | bjornar_: you can also opt to distribute the HMAC keys more beyond keystone as another performance optimization | 19:56 |
| morgan | you can also opt to distribute the AES keys too if you want | 19:57 |
| *** su_zhang has joined #openstack-keystone | 19:57 | |
| morgan | but we don't guarantee the payload format is a contract. | 19:58 |
| *** su_zhang has quit IRC | 19:58 | |
| morgan | outside of keystone | 19:58 |
| bjornar_ | I reported a bug a month ago with keystone-manage | 19:58 |
| *** su_zhang has joined #openstack-keystone | 19:59 | |
| bjornar_ | the help is incorrect: --bootstrap-username and so on does not work | 19:59 |
| morgan | i believe that was fixed. | 19:59 |
| bjornar_ | I believed too | 19:59 |
| morgan | also --bootstrap is very new / has not been released yet. | 19:59 |
| morgan | i mena it landed i think between m2 and m3 | 19:59 |
| openstackgerrit | Merged openstack/keystone: Updates TOTP release note https://review.openstack.org/283520 | 19:59 |
| bjornar_ | its not in master | 20:00 |
| bjornar_ | the fix I mean | 20:00 |
| morgan | fairly certain --bootstrap-username worked . | 20:00 |
| morgan | when the code was written | 20:00 |
| morgan | but anyway, there are things that will be looked at before RC. | 20:00 |
| morgan | so likely that'll get flagged. | 20:01 |
| bjornar_ | keystone-manage: error: unrecognized arguments: --boostrap-username root | 20:01 |
| morgan | boostrap? | 20:01 |
| morgan | bootstrap | 20:01 |
| bjornar_ | oh, damnit | 20:01 |
| morgan | hehe | 20:01 |
| bjornar_ | hehe.. I have written that tho whole time | 20:01 |
| morgan | no worries | 20:02 |
| *** jsavak has quit IRC | 20:02 | |
| bjornar_ | (but it was a bug once) | 20:02 |
| *** vgridnev has quit IRC | 20:02 | |
| *** su_zhang has quit IRC | 20:03 | |
| *** jsavak has joined #openstack-keystone | 20:03 | |
| stevemar | better than bookstrap | 20:04 |
| bjornar_ | or.. strapon | 20:04 |
| *** gyee has quit IRC | 20:12 | |
| *** subscope has joined #openstack-keystone | 20:16 | |
| stevemar | ayoung: question, nkinder is west coast right? | 20:16 |
| ayoung | stevemar, yeah northern Cali near Shasta | 20:16 |
| stevemar | ayoung: cool cool | 20:16 |
| ayoung | not bay area | 20:16 |
| nkinder | stevemar: yep | 20:18 |
| nkinder | not too far from the bay area | 20:19 |
| *** spzala has quit IRC | 20:21 | |
| *** spzala has joined #openstack-keystone | 20:22 | |
| *** spzala_ has joined #openstack-keystone | 20:24 | |
| *** spzala has quit IRC | 20:26 | |
| *** spzala has joined #openstack-keystone | 20:27 | |
| dstanek | stevemar: morgan: this is what i was talking about the other day: https://review.openstack.org/#/c/283522/ credential validation | 20:28 |
| patchbot | dstanek: patch 283522 - keystone - WIP - Add validation for totp credentials | 20:28 |
| *** spzala_ has quit IRC | 20:28 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone-specs: Fix cascade operations documentation https://review.openstack.org/274836 | 20:29 |
| *** su_zhang has joined #openstack-keystone | 20:29 | |
| *** spzala has quit IRC | 20:31 | |
| *** su_zhang has quit IRC | 20:34 | |
| *** mylu has joined #openstack-keystone | 20:50 | |
| *** dims has quit IRC | 21:01 | |
| *** lhcheng has quit IRC | 21:01 | |
| *** dims has joined #openstack-keystone | 21:03 | |
| henrynash | stevemar: hi….you have a few moments now, by any chance? | 21:04 |
| stevemar | henrynash: for you, anytime | 21:04 |
| henrynash | stevemar: aww, shucks | 21:04 |
| henrynash | stevemar: so, osc | 21:04 |
| *** mylu has quit IRC | 21:05 | |
| henrynash | stevemar: trying to understand how something like: os project show test | 21:05 |
| henrynash | stevemar: actually works | 21:05 |
| stevemar | henrynash: like the code path? | 21:05 |
| henrynash | stevemar: yep….so in osc/projects.py I see how we call find_resource | 21:06 |
| henrynash | stevemar: osc/project.py (sorry( | 21:06 |
| henrynash | stevemar: which (in utils.find_resource) does this kind of try client.get with some options, and if that doesn;t work try client.find | 21:07 |
| *** lhcheng has joined #openstack-keystone | 21:08 | |
| *** ChanServ sets mode: +v lhcheng | 21:08 | |
| henrynash | steevmar: so the path I can’t quiet work out, is when you do: osc project show —domain A test | 21:08 |
| henrynash | stevemar: there’s code in osc/project.py to ge tthe domain_id for A and pass it into the find_resource | 21:09 |
| stevemar | henrynash: let me look at that, i think you're talking about the common utils | 21:09 |
| henrynash | stevemar: but specifies domain_id….and if you look in keystoneclient/projects……the get method doesn’t take a domain, so I assume it falls into the list method…which wants a parameter called “domain” not “domain_id”….. | 21:10 |
| stevemar | henrynash: you talking about this: https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/v3/project.py#L82-L85 ? | 21:10 |
| stevemar | henrynash: or over here: https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/v3/project.py#L112-L114 ? | 21:11 |
| henrynash | stevemar: yes, taht’s for create…. | 21:11 |
| henrynash | stevemar: or line 323 for teh show command | 21:12 |
| stevemar | henrynash: to 323 is the find_resource function... | 21:13 |
| stevemar | henrynash: like you thought, it tries a get GET calls and falls back to a LIST call, in an attempt to find things | 21:13 |
| henrynash | stevemar: indeed…. | 21:13 |
| stevemar | the find_domain() function, is really there to be a helper function, we pass in the parsed_args and either return a valid domain object or None | 21:14 |
| henrynash | stevemar: and if you look in keystoneclient/v3/projects.py | 21:14 |
| henrynash | stevemar: then the list methods takes domain not domain_id as a named param | 21:14 |
| *** timcline_ has quit IRC | 21:15 | |
| stevemar | henrynash: line? | 21:15 |
| henrynash | 93 | 21:15 |
| *** timcline_ has joined #openstack-keystone | 21:15 | |
| henrynash | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/projects.py | 21:16 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 21:17 |
| *** rderose has joined #openstack-keystone | 21:17 | |
| henrynash | stevemar: the same is true for show users…..I don’t quite understand teh named parameter mismatch | 21:17 |
| *** boris-42 has joined #openstack-keystone | 21:18 | |
| *** timcline_ has quit IRC | 21:19 | |
| henrynash | stevemar: before looking at it, I expected to find teh keystoneclient projects.get() method to access a domain_id….but it doesn’t do thay either | 21:20 |
| henrynash | (…to accept a domain_id…) | 21:20 |
| stevemar | henrynash: hmm | 21:24 |
| *** jsavak has quit IRC | 21:24 | |
| henrynash | stevemar: for create project we DO pass it as domain (not domain_id)….but for create it isn’t a named param, so it doesn’t matter anyway | 21:26 |
| stevemar | henrynash: i think we do funky stuff here: https://github.com/openstack/python-openstackclient/blob/823ba770e0baafa707c89723c576db060b1b4742/openstackclient/identity/common.py#L93-L128 | 21:27 |
| *** mylu has joined #openstack-keystone | 21:28 | |
| henrynash | stevemar: not entirely sure what that does….other than if Forbidden makes a fake local represenation of the entity | 21:30 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Fix cascade operations documentation https://review.openstack.org/274836 | 21:31 |
| *** gyee has joined #openstack-keystone | 21:32 | |
| *** ChanServ sets mode: +v gyee | 21:32 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 21:33 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Fix cascade operations documentation https://review.openstack.org/274836 | 21:34 |
| henrynash | stevemar: …although that isn’t used to get the project (just the domain) | 21:34 |
| stevemar | henrynash: maybe we're getting lucky and just calling list with kwargs and not the actual named parameter?! | 21:36 |
| *** knikolla has quit IRC | 21:36 | |
| henrynash | stevemar: which would mean that if you have duplicate project names in mutiple domains, you’d get a list back rather than the one you were asking for? | 21:37 |
| *** sdake has quit IRC | 21:37 | |
| stevemar | henrynash: i don't think so.. i think we're luckily using the filters | 21:37 |
| *** mylu has quit IRC | 21:37 | |
| stevemar | henrynash: i think we're using the "domain_id=blah" query filter in GET /v3/projects | 21:38 |
| stevemar | instead of the actual positional arg | 21:38 |
| stevemar | that ksc exposes | 21:38 |
| henrynash | stevemar: ahh, its in kwargs so gets passe in anyway! | 21:38 |
| stevemar | henrynash: i think so | 21:38 |
| henrynash | stevemar: oh, brother | 21:39 |
| *** fawadkhaliq has quit IRC | 21:39 | |
| *** mylu has joined #openstack-keystone | 21:39 | |
| stevemar | henrynash: hey, no one has noticed so far hee | 21:39 |
| henrynash | stevemar: ok, at least I’m not losing my marbles.... | 21:40 |
| *** mylu has quit IRC | 21:40 | |
| *** su_zhang has joined #openstack-keystone | 21:40 | |
| stevemar | henrynash: not yet | 21:41 |
| *** spzala_ has joined #openstack-keystone | 21:41 | |
| henrynash | stevemar: true, plenty of time for that.... | 21:41 |
| *** tsymanczyk has quit IRC | 21:41 | |
| *** tsymancz1k has quit IRC | 21:41 | |
| henrynash | stevemar: ok, thx….I came across this for domain specifi roles (of coruse)….so now can see how to do this….I might come abck in and fix up osc for this oevrall problem | 21:42 |
| *** timcline_ has joined #openstack-keystone | 21:49 | |
| *** mylu has joined #openstack-keystone | 21:50 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 21:50 |
| *** mylu has quit IRC | 21:52 | |
| ayoung | stevemar, so I had mentally handed off Fernet-default to lbragstad but he's tied up for a while. I'm going to try and get that done | 21:55 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix project-related forbidden response messages https://review.openstack.org/283325 | 21:55 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move resource manager tests out of test_backend https://review.openstack.org/283822 | 21:55 |
| *** ninag has quit IRC | 21:56 | |
| *** ninag has joined #openstack-keystone | 21:57 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Implied roles index with cascading delete https://review.openstack.org/281921 | 21:58 |
| stevemar | ayoung: that would be wonderful | 21:58 |
| ayoung | stevemar, its close | 21:58 |
| stevemar | ayoung: i just cleaned up ^ | 21:58 |
| ayoung | stevemar, nice | 21:59 |
| stevemar | ayoung: i'm going to test it manually | 21:59 |
| stevemar | ayoung: i asked davechen to remove the rally stuff, it wasn't working anyway :( | 22:00 |
| *** ninag has quit IRC | 22:01 | |
| *** lhcheng has quit IRC | 22:02 | |
| *** dims has quit IRC | 22:02 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: db_sync doesn't create default domain https://review.openstack.org/282042 | 22:02 |
| ayoung | stevemar, looks good. +2 is conditional on manual testing of course, but I assume you won't let it go through early | 22:02 |
| *** josecastroleon has joined #openstack-keystone | 22:02 | |
| stevemar | ayoung: yep | 22:04 |
| stevemar | sigh, gotta leave, be online later | 22:04 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: db_sync doesn't create default domain https://review.openstack.org/282042 | 22:07 |
| *** su_zhang has quit IRC | 22:07 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove migration_helpers.get_default_domain https://review.openstack.org/282049 | 22:07 |
| *** su_zhang has joined #openstack-keystone | 22:08 | |
| *** edmondsw has quit IRC | 22:09 | |
| *** pauloewerton has quit IRC | 22:10 | |
| mc_nair | anyone know if there are currently Tempest tests which flex the hierarchical projects functionality (e.g. creates and deletes nested projects)? I'm having trouble finding any currently, but would be nice to confirm. | 22:12 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:13 | |
| *** jaugustine has quit IRC | 22:15 | |
| *** diazjf has quit IRC | 22:17 | |
| *** mylu has joined #openstack-keystone | 22:19 | |
| *** timcline_ has quit IRC | 22:19 | |
| *** lhcheng has joined #openstack-keystone | 22:20 | |
| *** ChanServ sets mode: +v lhcheng | 22:20 | |
| *** david8hu has quit IRC | 22:22 | |
| *** sdake has joined #openstack-keystone | 22:30 | |
| *** ninag has joined #openstack-keystone | 22:32 | |
| *** josecastroleon has quit IRC | 22:32 | |
| rderose | dolphm: wondering if we could meet re: shadowing federated users? | 22:34 |
| *** petertr7 is now known as petertr7_away | 22:34 | |
| *** ninag has quit IRC | 22:36 | |
| *** mvk has joined #openstack-keystone | 22:39 | |
| *** spzala_ has quit IRC | 22:40 | |
| *** mylu has quit IRC | 22:40 | |
| *** dims has joined #openstack-keystone | 22:40 | |
| *** mylu has joined #openstack-keystone | 22:41 | |
| dstanek | gyee: you're killing me! | 22:42 |
| dstanek | gyee: i like the idea of grouping all of the totp algorithm stuff in one place instead of three. | 22:43 |
| dstanek | gyee: others may not like it, but that's why it's currently a wip | 22:44 |
| dstanek | rderose: gate jobs have been started on your bug fix! | 22:44 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Reference config values at runtime https://review.openstack.org/283842 | 22:45 |
| *** subscope has quit IRC | 22:48 | |
| *** timcline_ has joined #openstack-keystone | 22:51 | |
| rderose | dstanek: cool | 22:51 |
| *** su_zhang has quit IRC | 22:52 | |
| *** su_zhang has joined #openstack-keystone | 22:53 | |
| *** timcline_ has quit IRC | 22:55 | |
| *** rderose has quit IRC | 22:55 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Reference config values at runtime https://review.openstack.org/283842 | 22:56 |
| gyee | dstanek, sorry, just got back | 22:57 |
| gyee | dstanek, that code belongs to the plugin itself | 22:57 |
| dstanek | gyee: all of it? | 22:57 |
| gyee | the password part | 22:58 |
| *** mancdaz has quit IRC | 22:58 | |
| *** dstanek has quit IRC | 22:58 | |
| *** dulek has quit IRC | 22:58 | |
| *** marekd has quit IRC | 22:58 | |
| *** richm has quit IRC | 22:58 | |
| *** mariusv has quit IRC | 22:58 | |
| *** sileht has quit IRC | 22:58 | |
| *** patchbot has quit IRC | 22:58 | |
| *** ngupta has quit IRC | 22:58 | |
| *** akscram has quit IRC | 22:58 | |
| *** Ephur has quit IRC | 22:58 | |
| *** hogepodge has quit IRC | 22:58 | |
| *** mvk has quit IRC | 22:58 | |
| *** spandhe has quit IRC | 22:58 | |
| *** pcaruana has quit IRC | 22:58 | |
| *** topol_ has quit IRC | 22:58 | |
| *** Daviey has quit IRC | 22:58 | |
| *** opilotte- has quit IRC | 22:58 | |
| *** dhellmann has quit IRC | 22:58 | |
| *** Dave has quit IRC | 22:58 | |
| *** dims has quit IRC | 22:58 | |
| *** lhcheng has quit IRC | 22:58 | |
| *** ayoung has quit IRC | 22:58 | |
| *** csoukup has quit IRC | 22:58 | |
| *** jed56 has quit IRC | 22:58 | |
| *** lbragstad_ has quit IRC | 22:58 | |
| *** mnaser has quit IRC | 22:58 | |
| *** markvoelker has quit IRC | 22:58 | |
| *** d34dh0r53 has quit IRC | 22:58 | |
| *** ryanpetrello has quit IRC | 22:58 | |
| *** mhu has quit IRC | 22:58 | |
| *** Guest51435 has quit IRC | 22:58 | |
| *** eglute has quit IRC | 22:58 | |
| *** BlackDex has quit IRC | 22:58 | |
| *** DuncanT has quit IRC | 22:58 | |
| *** raorn has quit IRC | 22:58 | |
| *** dtroyer has quit IRC | 22:58 | |
| *** darrenc has quit IRC | 22:58 | |
| *** bradjones has quit IRC | 22:58 | |
| *** clayton has quit IRC | 22:58 | |
| *** lifeless has quit IRC | 22:58 | |
| *** tjcocozz_ has quit IRC | 22:58 | |
| *** jidar has quit IRC | 22:58 | |
| *** boris-42 has quit IRC | 22:58 | |
| *** pushkaru has quit IRC | 22:58 | |
| *** slberger has quit IRC | 22:58 | |
| *** gordc has quit IRC | 22:58 | |
| *** jamielennox has quit IRC | 22:58 | |
| *** amakarov_away has quit IRC | 22:58 | |
| *** chlong_ has quit IRC | 22:58 | |
| *** errr has quit IRC | 22:58 | |
| *** sigmavirus24_awa has quit IRC | 22:58 | |
| *** andrewbogott has quit IRC | 22:58 | |
| *** zigo has quit IRC | 22:58 | |
| *** rvba has quit IRC | 22:58 | |
| *** martinus__ has quit IRC | 22:58 | |
| *** mtreinish has quit IRC | 22:58 | |
| *** ktychkova has quit IRC | 22:58 | |
| *** dobson has quit IRC | 22:58 | |
| *** ianw has quit IRC | 22:58 | |
| *** gyee has quit IRC | 22:58 | |
| *** phalmos has quit IRC | 22:58 | |
| *** henrynash has quit IRC | 22:58 | |
| *** ccard__ has quit IRC | 22:58 | |
| *** SpamapS has quit IRC | 22:58 | |
| *** rdo has quit IRC | 22:58 | |
| *** miguelgrinberg has quit IRC | 22:58 | |
| *** ktychkova_ has quit IRC | 22:58 | |
| *** john5223 has quit IRC | 22:58 | |
| *** david_cu has quit IRC | 22:58 | |
| *** pkarikh_ has quit IRC | 22:58 | |
| *** gsilvis has quit IRC | 22:58 | |
| *** rm_work has quit IRC | 22:58 | |
| *** jraim has quit IRC | 22:58 | |
| *** tpeoples has quit IRC | 22:58 | |
| *** agireud has quit IRC | 22:58 | |
| *** EmilienM has quit IRC | 22:58 | |
| *** adam_g has quit IRC | 22:58 | |
| *** andreaf has quit IRC | 22:58 | |
| *** gus has quit IRC | 22:58 | |
| *** cloudnull has quit IRC | 22:58 | |
| *** Anticimex has quit IRC | 22:58 | |
| *** flaper87 has quit IRC | 22:58 | |
| *** pumaranikar has quit IRC | 22:58 | |
| *** sudorandom has quit IRC | 22:58 | |
| *** dancn has quit IRC | 22:58 | |
| *** bigjools has quit IRC | 22:58 | |
| *** mjb has quit IRC | 22:58 | |
| *** mdavidson has quit IRC | 22:58 | |
| *** mfisch has quit IRC | 22:58 | |
| *** freerunner has quit IRC | 22:58 | |
| *** gerhardqux has quit IRC | 22:58 | |
| *** ramishra has quit IRC | 22:58 | |
| *** comstud has quit IRC | 22:58 | |
| *** mylu has quit IRC | 22:58 | |
| *** dan_nguyen has quit IRC | 22:58 | |
| *** toddnni has quit IRC | 22:58 | |
| *** d0ugal has quit IRC | 22:58 | |
| *** tristanC has quit IRC | 22:58 | |
| *** kevinbenton has quit IRC | 22:58 | |
| *** morgan has quit IRC | 22:58 | |
| *** yarkot has quit IRC | 22:58 | |
| *** hockeynut has quit IRC | 22:58 | |
| *** zeus has quit IRC | 22:58 | |
| *** breton has quit IRC | 22:58 | |
| *** mordred has quit IRC | 22:58 | |
| *** rha has quit IRC | 22:58 | |
| *** browne has quit IRC | 22:58 | |
| *** ekarlso- has quit IRC | 22:58 | |
| *** Oku_OS has quit IRC | 22:58 | |
| *** jdennis has quit IRC | 22:58 | |
| *** Nakato has quit IRC | 22:58 | |
| *** anteaya has quit IRC | 22:58 | |
| *** krotscheck has quit IRC | 22:58 | |
| *** bknudson has quit IRC | 22:58 | |
| *** grassy has quit IRC | 22:58 | |
| *** _fortis has quit IRC | 22:58 | |
| *** fpatwa has quit IRC | 22:58 | |
| *** iurygregory has quit IRC | 22:58 | |
| *** blogan has quit IRC | 22:58 | |
| *** sshen has quit IRC | 22:58 | |
| *** mkoderer__ has quit IRC | 22:58 | |
| *** arunkant has quit IRC | 22:58 | |
| *** BAKfr has quit IRC | 22:58 | |
| *** BrAsS_mOnKeY has quit IRC | 22:58 | |
| *** hughsaunders has quit IRC | 22:58 | |
| *** dolphm has quit IRC | 22:58 | |
| *** DinaBelova has quit IRC | 22:58 | |
| *** afazekas has quit IRC | 22:58 | |
| *** smurke has quit IRC | 22:58 | |
| *** pleia2 has quit IRC | 22:58 | |
| *** timburke has quit IRC | 22:58 | |
| *** bapalm has quit IRC | 22:58 | |
| *** Tridde has quit IRC | 22:58 | |
| *** baffle has quit IRC | 22:58 | |
| *** kfox1111 has quit IRC | 22:58 | |
| *** rmstar has quit IRC | 22:58 | |
| *** smcginnis has quit IRC | 22:58 | |
| *** navidp has quit IRC | 22:58 | |
| *** odyssey4me has quit IRC | 22:58 | |
| *** skoude has quit IRC | 22:58 | |
| *** nonameentername has quit IRC | 22:58 | |
| *** boltR has quit IRC | 22:58 | |
| *** huats_ has quit IRC | 22:58 | |
| *** zzzeek has quit IRC | 22:58 | |
| *** jasondotstar has quit IRC | 22:58 | |
| *** jgriffith has quit IRC | 22:58 | |
| *** redrobot has quit IRC | 22:58 | |
| *** lennyb_ has quit IRC | 22:58 | |
| *** crinkle has quit IRC | 22:58 | |
| *** briancurtin has quit IRC | 22:58 | |
| *** zhiyan has quit IRC | 22:58 | |
| *** ctracey has quit IRC | 22:58 | |
| *** raildo has quit IRC | 22:58 | |
| *** serverascode has quit IRC | 22:58 | |
| *** xek has quit IRC | 22:58 | |
| *** lbragstad has quit IRC | 22:58 | |
| *** charz has quit IRC | 22:58 | |
| *** johnthetubaguy has quit IRC | 22:58 | |
| *** ChanServ has quit IRC | 22:58 | |
| *** sdake is now known as jpeeler | 22:58 | |
| *** jpeeler is now known as 64MAAECDI | 23:00 | |
| *** johnthetubaguy has joined #openstack-keystone | 23:01 | |
| *** charz has joined #openstack-keystone | 23:01 | |
| *** lbragstad has joined #openstack-keystone | 23:01 | |
| *** xek has joined #openstack-keystone | 23:01 | |
| *** raildo has joined #openstack-keystone | 23:01 | |
| *** ctracey has joined #openstack-keystone | 23:01 | |
| *** serverascode has joined #openstack-keystone | 23:01 | |
| *** zhiyan has joined #openstack-keystone | 23:01 | |
| *** briancurtin has joined #openstack-keystone | 23:01 | |
| *** crinkle has joined #openstack-keystone | 23:01 | |
| *** redrobot has joined #openstack-keystone | 23:01 | |
| *** jgriffith has joined #openstack-keystone | 23:01 | |
| *** jasondotstar has joined #openstack-keystone | 23:01 | |
| *** zzzeek has joined #openstack-keystone | 23:01 | |
| *** boltR has joined #openstack-keystone | 23:01 | |
| *** huats_ has joined #openstack-keystone | 23:01 | |
| *** skoude has joined #openstack-keystone | 23:01 | |
| *** odyssey4me has joined #openstack-keystone | 23:01 | |
| *** nonameentername has joined #openstack-keystone | 23:01 | |
| *** navidp has joined #openstack-keystone | 23:01 | |
| *** smcginnis has joined #openstack-keystone | 23:01 | |
| *** rmstar has joined #openstack-keystone | 23:01 | |
| *** lennyb_ has joined #openstack-keystone | 23:01 | |
| *** Dave has joined #openstack-keystone | 23:01 | |
| *** dhellmann has joined #openstack-keystone | 23:01 | |
| *** opilotte- has joined #openstack-keystone | 23:01 | |
| *** Daviey has joined #openstack-keystone | 23:01 | |
| *** topol_ has joined #openstack-keystone | 23:01 | |
| *** pcaruana has joined #openstack-keystone | 23:01 | |
| *** spandhe has joined #openstack-keystone | 23:01 | |
| *** mvk has joined #openstack-keystone | 23:01 | |
| *** jidar has joined #openstack-keystone | 23:01 | |
| *** tjcocozz_ has joined #openstack-keystone | 23:01 | |
| *** lifeless has joined #openstack-keystone | 23:01 | |
| *** bradjones has joined #openstack-keystone | 23:01 | |
| *** clayton has joined #openstack-keystone | 23:01 | |
| *** darrenc has joined #openstack-keystone | 23:01 | |
| *** dtroyer has joined #openstack-keystone | 23:01 | |
| *** raorn has joined #openstack-keystone | 23:01 | |
| *** DuncanT has joined #openstack-keystone | 23:01 | |
| *** BlackDex has joined #openstack-keystone | 23:01 | |
| *** eglute has joined #openstack-keystone | 23:01 | |
| *** Guest51435 has joined #openstack-keystone | 23:01 | |
| *** ryanpetrello has joined #openstack-keystone | 23:01 | |
| *** mhu has joined #openstack-keystone | 23:01 | |
| *** d34dh0r53 has joined #openstack-keystone | 23:01 | |
| *** markvoelker has joined #openstack-keystone | 23:01 | |
| *** 32NAAC6RR has joined #openstack-keystone | 23:01 | |
| *** mnaser has joined #openstack-keystone | 23:01 | |
| *** jed56 has joined #openstack-keystone | 23:01 | |
| *** csoukup has joined #openstack-keystone | 23:01 | |
| *** ayoung has joined #openstack-keystone | 23:01 | |
| *** lhcheng has joined #openstack-keystone | 23:01 | |
| *** dims has joined #openstack-keystone | 23:01 | |
| *** comstud has joined #openstack-keystone | 23:01 | |
| *** ramishra has joined #openstack-keystone | 23:01 | |
| *** gerhardqux has joined #openstack-keystone | 23:01 | |
| *** freerunner has joined #openstack-keystone | 23:01 | |
| *** mfisch has joined #openstack-keystone | 23:01 | |
| *** mdavidson has joined #openstack-keystone | 23:01 | |
| *** mjb has joined #openstack-keystone | 23:01 | |
| *** bigjools has joined #openstack-keystone | 23:01 | |
| *** dancn has joined #openstack-keystone | 23:01 | |
| *** sudorandom has joined #openstack-keystone | 23:01 | |
| *** pumaranikar has joined #openstack-keystone | 23:01 | |
| *** flaper87 has joined #openstack-keystone | 23:01 | |
| *** Anticimex has joined #openstack-keystone | 23:01 | |
| *** gus has joined #openstack-keystone | 23:01 | |
| *** andreaf has joined #openstack-keystone | 23:01 | |
| *** cloudnull has joined #openstack-keystone | 23:01 | |
| *** adam_g has joined #openstack-keystone | 23:01 | |
| *** EmilienM has joined #openstack-keystone | 23:01 | |
| *** agireud has joined #openstack-keystone | 23:01 | |
| *** tpeoples has joined #openstack-keystone | 23:01 | |
| *** jraim has joined #openstack-keystone | 23:01 | |
| *** rm_work has joined #openstack-keystone | 23:01 | |
| *** asimov.freenode.net sets mode: +vv ayoung lhcheng | 23:01 | |
| *** DinaBelova has joined #openstack-keystone | 23:01 | |
| *** boris-42 has joined #openstack-keystone | 23:01 | |
| *** pushkaru has joined #openstack-keystone | 23:01 | |
| *** slberger has joined #openstack-keystone | 23:01 | |
| *** gordc has joined #openstack-keystone | 23:01 | |
| *** jamielennox has joined #openstack-keystone | 23:01 | |
| *** amakarov_away has joined #openstack-keystone | 23:01 | |
| *** chlong_ has joined #openstack-keystone | 23:01 | |
| *** errr has joined #openstack-keystone | 23:01 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 23:01 | |
| *** andrewbogott has joined #openstack-keystone | 23:01 | |
| *** zigo has joined #openstack-keystone | 23:01 | |
| *** rvba has joined #openstack-keystone | 23:01 | |
| *** martinus__ has joined #openstack-keystone | 23:01 | |
| *** mtreinish has joined #openstack-keystone | 23:01 | |
| *** ktychkova has joined #openstack-keystone | 23:01 | |
| *** dobson has joined #openstack-keystone | 23:01 | |
| *** ianw has joined #openstack-keystone | 23:01 | |
| *** asimov.freenode.net sets mode: +v jamielennox | 23:01 | |
| *** 64MAAECDI is now known as sdake | 23:01 | |
| *** mancdaz has joined #openstack-keystone | 23:01 | |
| *** dulek has joined #openstack-keystone | 23:01 | |
| *** marekd has joined #openstack-keystone | 23:01 | |
| *** dstanek has joined #openstack-keystone | 23:01 | |
| *** richm has joined #openstack-keystone | 23:02 | |
| *** mariusv has joined #openstack-keystone | 23:02 | |
| *** sileht has joined #openstack-keystone | 23:02 | |
| *** patchbot has joined #openstack-keystone | 23:02 | |
| *** ngupta has joined #openstack-keystone | 23:02 | |
| *** akscram has joined #openstack-keystone | 23:02 | |
| *** Ephur has joined #openstack-keystone | 23:02 | |
| *** hogepodge has joined #openstack-keystone | 23:02 | |
| dstanek | gyee: so i would put the three totp related functions in three separate parts of the code base? | 23:02 |
| *** browne has joined #openstack-keystone | 23:03 | |
| *** ekarlso- has joined #openstack-keystone | 23:03 | |
| *** Oku_OS has joined #openstack-keystone | 23:03 | |
| *** jdennis has joined #openstack-keystone | 23:03 | |
| *** Nakato has joined #openstack-keystone | 23:03 | |
| *** anteaya has joined #openstack-keystone | 23:03 | |
| *** krotscheck has joined #openstack-keystone | 23:03 | |
| *** bknudson has joined #openstack-keystone | 23:03 | |
| *** _fortis has joined #openstack-keystone | 23:03 | |
| *** grassy has joined #openstack-keystone | 23:03 | |
| *** fpatwa has joined #openstack-keystone | 23:03 | |
| *** iurygregory has joined #openstack-keystone | 23:03 | |
| *** blogan has joined #openstack-keystone | 23:03 | |
| *** mkoderer__ has joined #openstack-keystone | 23:03 | |
| *** sshen has joined #openstack-keystone | 23:03 | |
| *** arunkant has joined #openstack-keystone | 23:03 | |
| *** BAKfr has joined #openstack-keystone | 23:03 | |
| *** pleia2 has joined #openstack-keystone | 23:03 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 23:03 | |
| *** hughsaunders has joined #openstack-keystone | 23:03 | |
| *** dolphm has joined #openstack-keystone | 23:03 | |
| *** afazekas has joined #openstack-keystone | 23:03 | |
| *** smurke has joined #openstack-keystone | 23:03 | |
| *** timburke has joined #openstack-keystone | 23:03 | |
| *** bapalm has joined #openstack-keystone | 23:03 | |
| *** Tridde has joined #openstack-keystone | 23:03 | |
| *** baffle has joined #openstack-keystone | 23:03 | |
| *** kfox1111 has joined #openstack-keystone | 23:03 | |
| *** asimov.freenode.net sets mode: +vo bknudson dolphm | 23:03 | |
| *** toddnni has joined #openstack-keystone | 23:03 | |
| *** d0ugal has joined #openstack-keystone | 23:03 | |
| *** tristanC has joined #openstack-keystone | 23:03 | |
| *** kevinbenton has joined #openstack-keystone | 23:03 | |
| *** morgan has joined #openstack-keystone | 23:03 | |
| *** yarkot has joined #openstack-keystone | 23:03 | |
| *** hockeynut has joined #openstack-keystone | 23:03 | |
| *** zeus has joined #openstack-keystone | 23:03 | |
| *** breton has joined #openstack-keystone | 23:03 | |
| *** mordred has joined #openstack-keystone | 23:03 | |
| *** rha has joined #openstack-keystone | 23:03 | |
| *** asimov.freenode.net sets mode: +v morgan | 23:03 | |
| *** mylu has joined #openstack-keystone | 23:03 | |
| *** dan_nguyen has joined #openstack-keystone | 23:03 | |
| *** sigmavirus24_awa has quit IRC | 23:04 | |
| *** gsilvis_ has joined #openstack-keystone | 23:04 | |
| *** gyee has joined #openstack-keystone | 23:06 | |
| *** phalmos has joined #openstack-keystone | 23:06 | |
| *** henrynash has joined #openstack-keystone | 23:06 | |
| *** ccard__ has joined #openstack-keystone | 23:06 | |
| *** SpamapS has joined #openstack-keystone | 23:06 | |
| *** rdo has joined #openstack-keystone | 23:06 | |
| *** miguelgrinberg has joined #openstack-keystone | 23:06 | |
| *** ktychkova_ has joined #openstack-keystone | 23:06 | |
| *** john5223 has joined #openstack-keystone | 23:06 | |
| *** david_cu has joined #openstack-keystone | 23:06 | |
| *** pkarikh_ has joined #openstack-keystone | 23:06 | |
| *** gsilvis has joined #openstack-keystone | 23:06 | |
| *** asimov.freenode.net sets mode: +vv gyee henrynash | 23:06 | |
| dstanek | gyee: so i would put the three totp related functions in three separate parts of the code base? | 23:06 |
| *** ChanServ has joined #openstack-keystone | 23:06 | |
| *** asimov.freenode.net sets mode: +o ChanServ | 23:06 | |
| *** ChanServ sets mode: +ov morgan dstanek | 23:06 | |
| *** miguelgrinberg has quit IRC | 23:07 | |
| *** gsilvis has quit IRC | 23:07 | |
| *** david_cu has quit IRC | 23:07 | |
| *** SpamapS has quit IRC | 23:07 | |
| *** bjornar_ has quit IRC | 23:08 | |
| gyee | dstanek, the base32 check is the only code that is shared | 23:08 |
| *** miguelgrinberg has joined #openstack-keystone | 23:08 | |
| *** exploreshaifali has joined #openstack-keystone | 23:08 | |
| *** exploreshaifali has quit IRC | 23:08 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 23:08 | |
| dstanek | gyee: i know the other two are each only used in one place, but to me it's better to group the full totp concept together | 23:08 |
| *** david_cu has joined #openstack-keystone | 23:09 | |
| *** lhcheng has quit IRC | 23:09 | |
| *** SpamapS has joined #openstack-keystone | 23:09 | |
| gyee | dstanek, one may even argue that the base32 requirement will be punted to the credential provider (i.e. barbican) later on | 23:11 |
| dstanek | gyee: eventually maybe | 23:11 |
| gyee | as they are expected to be encrypted | 23:12 |
| *** phalmos has quit IRC | 23:12 | |
| dstanek | gyee: but i suspect that they won't want to understand and validate all credential type and would instead just store what they are told | 23:12 |
| *** darrenc is now known as darrenc_afk | 23:13 | |
| *** pushkaru has quit IRC | 23:13 | |
| gyee | dstanek, honestly, I suspect our credential APIs will be deprecated in the not to near future :) | 23:13 |
| *** pushkaru has joined #openstack-keystone | 23:13 | |
| gyee | we have no encryption for DAR what so ever right now | 23:13 |
| dstanek | gyee: sure, but that doesn't change the design principle | 23:14 |
| gyee | my point is TOTP is should encapsulated into the plugin itself | 23:14 |
| gyee | not spread out into multiple places | 23:14 |
| dstanek | gyee: why in the plugin? | 23:15 |
| gyee | plugins are expected to be self-contained | 23:15 |
| dstanek | gyee: you'd rather have the credentials and test import the plugin? | 23:16 |
| gyee | plugins are really an interface | 23:16 |
| dstanek | gyee: why self-contained? | 23:16 |
| gyee | dstanek, so deployers can disable/remove for whatever legal reasons | 23:16 |
| gyee | same as EC2/S3 that we are having trouble with | 23:17 |
| dstanek | gyee: you mean remove the code? | 23:17 |
| gyee | yes | 23:17 |
| gyee | not ship the plugin code | 23:17 |
| dstanek | that's crazy to support | 23:17 |
| gyee | so they have a choice | 23:17 |
| *** slberger has left #openstack-keystone | 23:17 | |
| dstanek | most of the auth plugins we have are not self-contained | 23:17 |
| *** pushkaru has quit IRC | 23:18 | |
| *** pushkaru has joined #openstack-keystone | 23:18 | |
| dstanek | they can always delete the plugin itself if they are paranoid about accidentally enabling it. | 23:18 |
| gyee | they need to be | 23:18 |
| gyee | not if they have to also delete stuff in credentials | 23:18 |
| dstanek | why would anyone need to do that? | 23:18 |
| *** pumarani__ has joined #openstack-keystone | 23:19 | |
| gyee | dstanek, take a look at the ec3/s3 patches that morgan put up | 23:19 |
| gyee | ec2 | 23:19 |
| gyee | plugins design principals are a lot like contrib | 23:19 |
| *** pumarani__ has quit IRC | 23:19 | |
| gyee | they should be optional and self-contained | 23:19 |
| *** pumarani__ has joined #openstack-keystone | 23:20 | |
| *** pushkaru has quit IRC | 23:20 | |
| dstanek | gyee: what is the business case for that? | 23:20 |
| dstanek | gyee: right now most are not self contained | 23:20 |
| gyee | dstanek, we need to make them self-contained | 23:20 |
| dstanek | gyee: so put the entirety of keystone.oauth1 into the oauth plugin? | 23:21 |
| gyee | dstanek, can you imagine changing Apache in order to get mod_xyz working? | 23:21 |
| dstanek | gyee: i don't understand that analogy. | 23:22 |
| dstanek | gyee: mod_xyz is using shared code out of apache to do some of its work | 23:22 |
| dstanek | gyee: i don't see any open ec2 patches | 23:23 |
| gyee | imagine TOTP is mod_xyz | 23:23 |
| gyee | I think Morgan may've abandoned the patches | 23:24 |
| gyee | let me dig them up | 23:24 |
| gyee | dstanek, https://review.openstack.org/#/c/274973/ | 23:26 |
| patchbot | gyee: patch 274973 - keystone - Move s3 Extension to core (ABANDONED) | 23:26 |
| *** pumarani__ has quit IRC | 23:26 | |
| gyee | dstanek, and this one https://review.openstack.org/#/c/275280/ | 23:27 |
| patchbot | gyee: patch 275280 - keystone - Move EC2 extension to core (ABANDONED) | 23:27 |
| *** lhcheng has joined #openstack-keystone | 23:28 | |
| *** ChanServ sets mode: +v lhcheng | 23:28 | |
| dstanek | gyee: what does that have to do with auth plugins? | 23:28 |
| gyee | self-contained principal | 23:29 |
| dstanek | gyee: if you, as a depoyer, want to remove totp from your system out of fear then you would have to actually delete code from cryptography as it is what actually has the algorithm | 23:29 |
| dstanek | gyee: i actually have a similar patch for some of the ec2 credentials stuff that i started last week. never finished enough to push to gerrit | 23:31 |
| *** csoukup has quit IRC | 23:31 | |
| gyee | dstanek, we introduced a bp sometime back to have a generic signature-based plugin, unfortunately, it didn't get enough support | 23:32 |
| gyee | it was based on the same principal as token pipeline | 23:33 |
| dstanek | gyee: what does 'generic signature-based' mean? | 23:33 |
| gyee | dstanek, if you take a look at EC3, S3, tempurl, formpost, etc, they all shared a common mechanism, which is HMAC signature for token | 23:34 |
| gyee | we basically need to translate protocol-specific to protocol-neutral prior to signature validation | 23:36 |
| *** mylu has quit IRC | 23:36 | |
| dstanek | gyee: why? i don't think i'm getting the full picture. do you have a link to the proposal? | 23:37 |
| gyee | let me dig, its been a while | 23:38 |
| gyee | like more than 2 years | 23:38 |
| *** gordc has quit IRC | 23:41 | |
| navidp | lbragstad, | 23:42 |
| *** mylu has joined #openstack-keystone | 23:43 | |
| gyee | dstanek, is a version https://blueprints.launchpad.net/keystone/+spec/generic-signature-validation | 23:53 |
| dstanek | gyee: ah, you just want those modules to be implemented in terms of auth plugins | 23:58 |
| *** rderose has joined #openstack-keystone | 23:59 | |
| dstanek | gyee: even keystone.contrib.ec2 isn't very self-contained | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!