| notmorgan | bknudson_: hhee | 00:02 |
|---|---|---|
| jamielennox | notmorgan: hey - thoughts on https://review.openstack.org/#/c/335423/ ? | 00:03 |
| patchbot | jamielennox: patch 335423 - keystone - Implement Views and convert credentials | 00:04 |
| *** fangxu has quit IRC | 00:04 | |
| jamielennox | i got annoyed refactoring that query_string thing and came up with that, still need to write it up | 00:04 |
| notmorgan | looking | 00:04 |
| *** ddieterly has joined #openstack-keystone | 00:05 | |
| jamielennox | if it's not going to succeed i'm not going to waste a bunch of time writing it up | 00:06 |
| *** timcline has quit IRC | 00:09 | |
| *** rderose has quit IRC | 00:19 | |
| *** ravelar159 has joined #openstack-keystone | 00:21 | |
| dstanek | jamielennox: that's interesting. i wonder how it would play with my flask work? | 00:22 |
| jamielennox | dstanek: i had a look at flask views - they're not exactly the same but i can only think it would help | 00:22 |
| jamielennox | dstanek: flask seems to assume you'll want to render_template which it's fairly unlikely we'd do | 00:23 |
| jamielennox | but i think anything that takes some responsibility away from that controller is going to help switch there | 00:23 |
| jamielennox | ideally i think i'd like to return the webob.Response from the view instead of a dict | 00:24 |
| *** samueldmq has quit IRC | 00:31 | |
| dstanek | jamielennox: yes, that's the direction i am heading. response objects | 00:32 |
| jamielennox | dstanek: henrynash_ has a review up for handling the request as part of the response as well for microversion stuff which i think can be better handled this way | 00:33 |
| jamielennox | because you isolate the microversion into the view layer | 00:33 |
| jamielennox | though as per normal the whole 'extras' thing is painful here | 00:33 |
| *** ravelar159 has quit IRC | 00:40 | |
| *** gyee has quit IRC | 00:50 | |
| *** julim has quit IRC | 00:52 | |
| *** ddieterly has quit IRC | 00:54 | |
| *** rderose has joined #openstack-keystone | 00:57 | |
| *** links has joined #openstack-keystone | 00:57 | |
| *** julim has joined #openstack-keystone | 00:58 | |
| *** woodster_ has quit IRC | 00:59 | |
| *** tqtran has quit IRC | 00:59 | |
| *** spandhe has quit IRC | 01:03 | |
| *** code-R has quit IRC | 01:22 | |
| *** rderose has quit IRC | 01:33 | |
| *** wangqun has joined #openstack-keystone | 01:34 | |
| *** browne has quit IRC | 01:39 | |
| *** julim has quit IRC | 01:41 | |
| *** EinstCrazy has joined #openstack-keystone | 01:41 | |
| *** julim has joined #openstack-keystone | 01:41 | |
| *** sdake has joined #openstack-keystone | 01:54 | |
| *** code-R has joined #openstack-keystone | 01:59 | |
| *** code-R has quit IRC | 01:59 | |
| *** sdake has quit IRC | 02:04 | |
| *** markvoelker has quit IRC | 02:06 | |
| *** spandhe has joined #openstack-keystone | 02:09 | |
| *** diazjf has joined #openstack-keystone | 02:18 | |
| *** jraju has joined #openstack-keystone | 02:34 | |
| *** links has quit IRC | 02:36 | |
| *** julim has quit IRC | 02:37 | |
| *** spzala has quit IRC | 02:39 | |
| *** spzala has joined #openstack-keystone | 02:40 | |
| *** dan_nguyen has joined #openstack-keystone | 02:41 | |
| *** dan_nguyen has quit IRC | 02:42 | |
| *** spzala has quit IRC | 02:44 | |
| *** jorge_munoz has quit IRC | 02:45 | |
| *** jorge_munoz has joined #openstack-keystone | 02:48 | |
| *** browne has joined #openstack-keystone | 02:48 | |
| *** lamt has quit IRC | 02:51 | |
| jlk | Any of you ever seen a situation where an admin can create services and SOME end points, but not a compute end point? I'm getting a 400 on creating endpoints for the compute service... | 02:56 |
| jlk | this is bizarre. I can create an endpoint url for the image service, but not the compute one. | 02:59 |
| jlk | openstack --debug endpoint create 63ec05a8d2eb40959d6b7125ee570d7e public "https://openstack.example.com:8774/v2/%(project_id)s" gives me a 400 | 02:59 |
| jlk | but openstack --debug endpoint create a0f044ffa0d84a8abc5f7a1d2da55b20 internal "https://openstack.example.com:9292" is 200. | 03:00 |
| jlk | well, 201 | 03:00 |
| *** spzala has joined #openstack-keystone | 03:00 | |
| *** diazjf has quit IRC | 03:01 | |
| *** jraju has quit IRC | 03:03 | |
| *** spzala has quit IRC | 03:05 | |
| *** markvoelker has joined #openstack-keystone | 03:06 | |
| jlk | holy crap | 03:09 |
| jlk | I found it, I was sending "project_id" in the URL instead of "tenant_id", and something was refusing it on the backend. | 03:10 |
| *** markvoelker has quit IRC | 03:11 | |
| jlk | that's... weird. | 03:12 |
| jlk | (Liberty) | 03:12 |
| *** spandhe has quit IRC | 03:15 | |
| *** sheel has joined #openstack-keystone | 03:28 | |
| *** iurygregory_ has quit IRC | 03:36 | |
| openstackgerrit | Andrew Liu proposed openstack/keystone: Added cache for id mapping manager https://review.openstack.org/328820 | 03:42 |
| *** dan_nguyen has joined #openstack-keystone | 03:44 | |
| *** TxGVNN has joined #openstack-keystone | 03:46 | |
| *** raddaoui has quit IRC | 03:47 | |
| *** darosale has joined #openstack-keystone | 03:56 | |
| *** tqtran has joined #openstack-keystone | 03:56 | |
| *** chrisshattuck has joined #openstack-keystone | 03:59 | |
| *** code-R has joined #openstack-keystone | 03:59 | |
| *** tqtran has quit IRC | 04:00 | |
| *** spzala has joined #openstack-keystone | 04:01 | |
| *** spzala has quit IRC | 04:07 | |
| *** richm has quit IRC | 04:07 | |
| *** markvoelker has joined #openstack-keystone | 04:07 | |
| *** dan_nguyen has quit IRC | 04:10 | |
| *** darosale has quit IRC | 04:11 | |
| *** markvoelker has quit IRC | 04:12 | |
| *** adu has joined #openstack-keystone | 04:22 | |
| *** ayoung has quit IRC | 04:29 | |
| *** chrisshattuck has quit IRC | 04:34 | |
| *** chrisshattuck has joined #openstack-keystone | 04:35 | |
| *** spandhe has joined #openstack-keystone | 04:39 | |
| *** chrisshattuck has quit IRC | 04:42 | |
| *** sdake has joined #openstack-keystone | 04:49 | |
| *** sdake_ has joined #openstack-keystone | 04:51 | |
| *** sdake_ has quit IRC | 04:53 | |
| *** sdake has quit IRC | 04:54 | |
| jamielennox | stevemar: here? | 05:03 |
| *** GB21 has joined #openstack-keystone | 05:06 | |
| *** jorge_munoz has quit IRC | 05:06 | |
| *** sdake has joined #openstack-keystone | 05:24 | |
| *** rcernin has joined #openstack-keystone | 05:27 | |
| *** code-R has quit IRC | 05:32 | |
| *** code-R has joined #openstack-keystone | 05:32 | |
| *** rcernin has quit IRC | 05:34 | |
| *** sdake_ has joined #openstack-keystone | 05:36 | |
| *** henrynash has joined #openstack-keystone | 05:37 | |
| *** ChanServ sets mode: +v henrynash | 05:37 | |
| *** sdake has quit IRC | 05:37 | |
| *** adu has quit IRC | 05:38 | |
| *** code-R_ has joined #openstack-keystone | 05:39 | |
| *** nkinder has joined #openstack-keystone | 05:39 | |
| *** roxanaghe has joined #openstack-keystone | 05:40 | |
| *** code-R has quit IRC | 05:42 | |
| *** tqtran has joined #openstack-keystone | 05:46 | |
| *** roxanaghe has quit IRC | 05:49 | |
| *** tqtran has quit IRC | 05:50 | |
| *** code-R has joined #openstack-keystone | 05:53 | |
| *** code-R_ has quit IRC | 05:54 | |
| *** spandhe has quit IRC | 05:55 | |
| *** code-R_ has joined #openstack-keystone | 05:56 | |
| *** code-R has quit IRC | 05:59 | |
| *** markvoelker has joined #openstack-keystone | 06:09 | |
| *** rcernin has joined #openstack-keystone | 06:09 | |
| *** markvoelker has quit IRC | 06:13 | |
| notmorgan | jamielennox: odd | 06:16 |
| notmorgan | erm | 06:16 |
| notmorgan | jlk: odd | 06:16 |
| notmorgan | jlk: well i mean, v2... IS well v2 :P | 06:16 |
| notmorgan | and uses " | 06:16 |
| jamielennox | thought that was an accusation there for a second | 06:16 |
| notmorgan | Tenantid instead of projects.... | 06:16 |
| notmorgan | jamielennox: no tab-complete fail | 06:17 |
| notmorgan | jamielennox: since i'm somewhere in the depths of "docker | 06:17 |
| notmorgan | " + dpkg insanity | 06:17 |
| jamielennox | yey, fun | 06:17 |
| notmorgan | but docker-compose is ... badass | 06:17 |
| *** nkinder has quit IRC | 06:26 | |
| *** sdake_ has quit IRC | 06:30 | |
| *** pcaruana has joined #openstack-keystone | 06:37 | |
| *** belmoreira has joined #openstack-keystone | 06:40 | |
| *** amoralej|off is now known as amoralej | 06:55 | |
| *** spzala has joined #openstack-keystone | 06:56 | |
| *** spzala has quit IRC | 07:00 | |
| notmorgan | boo, a ruby thing I was trying to use doesn't work on Xenial ... | 07:03 |
| notmorgan | cause git-buildpackage is now "gbp buildpackage" | 07:03 |
| * notmorgan looks at sending a quick fix. | 07:03 | |
| *** aloga has quit IRC | 07:06 | |
| *** aloga has joined #openstack-keystone | 07:06 | |
| *** markvoelker has joined #openstack-keystone | 07:10 | |
| *** markvoelker has quit IRC | 07:14 | |
| *** tesseract- has joined #openstack-keystone | 07:15 | |
| *** GB21 has quit IRC | 07:25 | |
| *** danpawlik has joined #openstack-keystone | 07:42 | |
| *** jpena|off is now known as jpena | 07:43 | |
| janonymous | @dstanek: Thanks! | 07:44 |
| *** GB21 has joined #openstack-keystone | 07:46 | |
| *** tqtran has joined #openstack-keystone | 07:48 | |
| *** code-R has joined #openstack-keystone | 07:52 | |
| *** code-R_ has quit IRC | 07:52 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Use min to avoid checking < 1 max fernet keys https://review.openstack.org/335840 | 07:52 |
| *** tqtran has quit IRC | 07:53 | |
| *** spzala has joined #openstack-keystone | 07:56 | |
| *** browne has quit IRC | 07:58 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** spzala has quit IRC | 08:03 | |
| *** pnavarro has joined #openstack-keystone | 08:07 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** markvoelker has joined #openstack-keystone | 08:11 | |
| *** markvoelker has quit IRC | 08:15 | |
| *** jamielennox is now known as jamielennox|away | 08:16 | |
| *** reedip has joined #openstack-keystone | 08:29 | |
| reedip | hi, on trying to install RDO using packstack , keystone-manage --bootstrap is giving return value of 1 | 08:30 |
| reedip | is there any logs to see the same? | 08:30 |
| notmorgan | reedip: hmm. that seems weird. | 08:32 |
| openstackgerrit | Andrew Liu proposed openstack/keystone: Added cache for id mapping manager https://review.openstack.org/328820 | 08:33 |
| notmorgan | i'm guessing an argument is somehow off or there is a conflict happening behind the scenes, unfortunately i'm not super familiar with the RDO packages atm | 08:33 |
| notmorgan | reedip: depending when you're around i can point you at ayoung (he has done RDO and packstack stuff) or possibly rodrigods. | 08:34 |
| notmorgan | reedip: i wish i was more up to speed on RDO and packstack so i could help | 08:34 |
| reedip | notmorgan: thanks for the suggestions and help | 08:34 |
| reedip | I am generally around at this time ( IST , +5:30 hrs from UTC) | 08:34 |
| notmorgan | ayoung is around East coast (-5ish UTC ) | 08:35 |
| notmorgan | and i think rodrigods is in brazil so similar timezone. | 08:35 |
| notmorgan | i should be asleep, since i'm UTC -8, and it's late here :P | 08:35 |
| notmorgan | or is it -7 with DST... whatever :P | 08:35 |
| reedip | notmorgan: I think you should :) | 08:36 |
| reedip | notmorgan: I am looking up the /var/log/keystone/keystone.log . so let me try to push some stuff around. If that doesnt work , I will let everyone here know :) | 08:36 |
| * notmorgan nods | 08:37 | |
| notmorgan | i would expect either STDOUT/STDERR or keystonelog | 08:37 |
| notmorgan | from bootstrap | 08:37 |
| notmorgan | though tbh, i haven't looked at it recently :P | 08:37 |
| notmorgan | it's grown a bit since i originally wrote it :P | 08:37 |
| *** sheel has quit IRC | 08:45 | |
| *** imcsk8_ has joined #openstack-keystone | 08:57 | |
| *** bapalm has quit IRC | 08:57 | |
| *** bapalm has joined #openstack-keystone | 09:00 | |
| *** kfox1111 has joined #openstack-keystone | 09:00 | |
| *** NikitaKonovalov2 has joined #openstack-keystone | 09:01 | |
| *** aloga has quit IRC | 09:04 | |
| *** aloga has joined #openstack-keystone | 09:04 | |
| *** Dave_ has joined #openstack-keystone | 09:04 | |
| *** auggy_ has joined #openstack-keystone | 09:05 | |
| *** alex_xu_ has joined #openstack-keystone | 09:06 | |
| *** bj0rnar- has joined #openstack-keystone | 09:06 | |
| *** X-Istence has joined #openstack-keystone | 09:06 | |
| *** afazekas_ has joined #openstack-keystone | 09:07 | |
| *** kmARC has joined #openstack-keystone | 09:08 | |
| *** imcsk8 has quit IRC | 09:08 | |
| *** bj0rnar has quit IRC | 09:08 | |
| *** iurygregory has quit IRC | 09:08 | |
| *** ericksonsantos has quit IRC | 09:08 | |
| *** alex_xu has quit IRC | 09:08 | |
| *** afazekas has quit IRC | 09:08 | |
| *** kfox1111_ has quit IRC | 09:08 | |
| *** lmiccini has quit IRC | 09:08 | |
| *** Dave has quit IRC | 09:08 | |
| *** mordred has quit IRC | 09:08 | |
| *** NikitaKonovalov has quit IRC | 09:08 | |
| *** x58 has quit IRC | 09:08 | |
| *** auggy has quit IRC | 09:08 | |
| *** dolphm has quit IRC | 09:08 | |
| *** NikitaKonovalov2 is now known as NikitaKonovalov | 09:08 | |
| *** dolphm has joined #openstack-keystone | 09:08 | |
| *** ChanServ sets mode: +o dolphm | 09:08 | |
| *** auggy_ is now known as auggy | 09:10 | |
| *** mordred has joined #openstack-keystone | 09:12 | |
| *** lmiccini has joined #openstack-keystone | 09:13 | |
| *** raddaoui has joined #openstack-keystone | 09:14 | |
| *** ericksonsantos has joined #openstack-keystone | 09:14 | |
| *** iurygregory has joined #openstack-keystone | 09:15 | |
| *** mrsoul has joined #openstack-keystone | 09:21 | |
| *** Dave_ is now known as Dave | 09:28 | |
| *** GB21 has quit IRC | 09:29 | |
| kmARC | hi all, I'm trying to set up federated keystone with saml idprovider. The link to the official docs (http://docs.openstack.org/security-guide/identity/federated-keystone.html) is kind of confusing. Somewhere it uses examples with httpd (redhat terminology), other places it is apt-get install (debian/ubuntu), and points to directories and files which are not existent | 09:49 |
| kmARC | Especially this: | 09:49 |
| kmARC | "Create the directory /var/www/cgi-bin/keystone/. Then link the files main and admin to the keystone.py file in this directory." | 09:50 |
| kmARC | It creates an empty directory and then wants to link to files in it..? | 09:50 |
| kmARC | Is there a more up-to-date documentation regarding this? | 09:51 |
| *** breton has quit IRC | 09:52 | |
| kmARC | I'm using Ubuntu Trusty with Mitaka Keystone installed from Canonical cloud-archive | 09:56 |
| *** GB21 has joined #openstack-keystone | 09:58 | |
| *** henrynash has quit IRC | 09:59 | |
| *** spzala has joined #openstack-keystone | 10:00 | |
| *** spzala has quit IRC | 10:05 | |
| *** wangqun has quit IRC | 10:06 | |
| *** david-lyle has quit IRC | 10:09 | |
| *** david-lyle_ has joined #openstack-keystone | 10:09 | |
| *** breton has joined #openstack-keystone | 10:19 | |
| *** nisha_ has joined #openstack-keystone | 10:24 | |
| nisha_ | hey all o/ | 10:24 |
| *** jefrite has joined #openstack-keystone | 10:28 | |
| *** mdavidson has quit IRC | 10:33 | |
| *** shauavik has quit IRC | 10:41 | |
| *** frickler has quit IRC | 10:43 | |
| *** shewless has quit IRC | 10:43 | |
| *** _fortis has quit IRC | 10:43 | |
| *** frickler has joined #openstack-keystone | 10:45 | |
| *** _fortis has joined #openstack-keystone | 10:57 | |
| *** spzala has joined #openstack-keystone | 11:01 | |
| *** spzala has quit IRC | 11:06 | |
| *** EinstCrazy has quit IRC | 11:13 | |
| *** jpena is now known as jpena|lunch | 11:16 | |
| *** ddieterly has joined #openstack-keystone | 11:17 | |
| *** mvk has quit IRC | 11:29 | |
| *** ericksonsantos has quit IRC | 11:38 | |
| *** jed56 has quit IRC | 11:45 | |
| *** tqtran has joined #openstack-keystone | 11:45 | |
| *** GB21 has quit IRC | 11:47 | |
| *** tqtran has quit IRC | 11:48 | |
| *** links has joined #openstack-keystone | 11:48 | |
| *** links has quit IRC | 11:48 | |
| *** GB21 has joined #openstack-keystone | 11:54 | |
| *** sdake has joined #openstack-keystone | 11:55 | |
| *** sdake_ has joined #openstack-keystone | 11:57 | |
| *** mvk has joined #openstack-keystone | 11:57 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 roles https://review.openstack.org/334546 | 11:57 |
| *** ddieterly has quit IRC | 12:00 | |
| *** sdake has quit IRC | 12:01 | |
| *** spzala has joined #openstack-keystone | 12:02 | |
| *** spzala has quit IRC | 12:07 | |
| TxGVNN | hello everyone. | 12:10 |
| TxGVNN | i have configured two server. | 12:10 |
| TxGVNN | one for keystone service as Identity Provider | 12:10 |
| TxGVNN | one for keystone service as Service Provider | 12:10 |
| TxGVNN | Call fedaration cloud or K2K=D | 12:11 |
| TxGVNN | And i have tested success | 12:11 |
| TxGVNN | But, i have a large question | 12:11 |
| TxGVNN | What do keystone work? | 12:12 |
| TxGVNN | I will show for you. | 12:13 |
| *** raildo-afk is now known as raildo | 12:13 | |
| *** henrynash has joined #openstack-keystone | 12:13 | |
| *** ChanServ sets mode: +v henrynash | 12:13 | |
| *** markvoelker has joined #openstack-keystone | 12:13 | |
| TxGVNN | As we see from https://cloudcomputinghust.github.io/2016/04/mo-hinh-hoat-dong-federation.html | 12:14 |
| *** daemontool has joined #openstack-keystone | 12:14 | |
| *** markvoelker has quit IRC | 12:14 | |
| TxGVNN | client interact to IdP, then interact to SP | 12:14 |
| *** markvoelker has joined #openstack-keystone | 12:15 | |
| TxGVNN | i don't see interact between about IdP and SP | 12:15 |
| henrynash_ | TxGVNN: so what’s your goal here? To you already have an IdP you want to use with keystone? | 12:16 |
| henrynash_ | (Do you already…) | 12:16 |
| TxGVNN | I want to understand about interact between IdP and SP | 12:17 |
| TxGVNN | I have tested by https://github.com/openstack/openstack-ansible/blob/master/scripts/federated-login.sh | 12:18 |
| TxGVNN | use user from IdP to access resource from SP | 12:18 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add role functional tests https://review.openstack.org/335118 | 12:19 |
| *** henrynash has quit IRC | 12:22 | |
| dstanek | kmARC: did you get your questions anwered? | 12:22 |
| *** ericksonsantos has joined #openstack-keystone | 12:23 | |
| *** nisha__ has joined #openstack-keystone | 12:23 | |
| dstanek | TxGVNN: i don't think there has to be a direct interaction between the IdP and the SP | 12:24 |
| dstanek | unless you set the IdP/SP to poll for metadata from the other | 12:24 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add role functional tests https://review.openstack.org/335118 | 12:24 |
| *** edmondsw has joined #openstack-keystone | 12:25 | |
| *** ericksonsantos has quit IRC | 12:26 | |
| *** nisha_ has quit IRC | 12:26 | |
| TxGVNN | dstanek: Why Sir? https://wiki.shibboleth.net/confluence/display/CONCEPT/Home#Home-BasicInteraction | 12:26 |
| TxGVNN | You can see from link. diagram about SP and IdP | 12:27 |
| *** jamie_h has joined #openstack-keystone | 12:27 | |
| TxGVNN | I think it's a standard | 12:27 |
| dstanek | TxGVNN: but the user is in the middle. for example, in keystone we generate a SAML request and have that to the user in the form of a URL to redirect to | 12:28 |
| henrynash_ | TxGVNN: so linke “2” in the diagram is the web redirect to the IdP from the SP (i.e. part of SSO). This isn’t a direct “call”, rather exactly that, typically a web redirect | 12:28 |
| dstanek | TxGVNN: http://nsl.symc.io/SSO%20SAML%202.0_files/SSO_SAML_sequenceDiagram.jpg <- much better technical diagram | 12:29 |
| dstanek | the browser is basically a broken/intermediary in the transaction | 12:30 |
| dstanek | good morning henrynash_! | 12:30 |
| dstanek | or afternoon? | 12:30 |
| henrynash_ | dstanek: afternoon (just) | 12:30 |
| *** lamt has joined #openstack-keystone | 12:31 | |
| henrynash_ | TxGVNN: here some other documentation on setting of Horizon to act as that intermediary to achieve SSO: http://docs.openstack.org/developer/keystone/federation/websso.html | 12:32 |
| *** ddieterly has joined #openstack-keystone | 12:35 | |
| *** aloga has quit IRC | 12:36 | |
| *** aloga has joined #openstack-keystone | 12:36 | |
| *** ericksonsantos has joined #openstack-keystone | 12:37 | |
| TxGVNN | dstanek: henrynash_: Thank two Sir, i got it =D | 12:37 |
| TxGVNN | Thank you very much | 12:37 |
| *** gordc has joined #openstack-keystone | 12:39 | |
| dstanek | TxGVNN: no problem | 12:40 |
| stevemar | o/ | 12:40 |
| *** GB21 has quit IRC | 12:44 | |
| dstanek | stevemar: howdy | 12:44 |
| *** jpena|lunch is now known as jpena | 12:46 | |
| *** mdavidson has joined #openstack-keystone | 12:49 | |
| *** ddieterly has quit IRC | 12:55 | |
| *** amoralej is now known as amoralej|lunch | 12:56 | |
| *** pauloewerton has joined #openstack-keystone | 12:57 | |
| *** rodrigods has quit IRC | 12:58 | |
| *** rodrigods has joined #openstack-keystone | 12:58 | |
| *** jed56 has joined #openstack-keystone | 12:59 | |
| *** henrynash has joined #openstack-keystone | 13:02 | |
| *** ChanServ sets mode: +v henrynash | 13:02 | |
| *** spzala has joined #openstack-keystone | 13:04 | |
| *** code-R_ has joined #openstack-keystone | 13:06 | |
| *** spzala has quit IRC | 13:08 | |
| *** code-R_ has quit IRC | 13:09 | |
| *** code-R_ has joined #openstack-keystone | 13:09 | |
| *** code-R has quit IRC | 13:09 | |
| breton | guyses | 13:09 |
| breton | have you seen https://review.openstack.org/#/c/329122/7 ? | 13:09 |
| patchbot | breton: patch 329122 - nova - Policy-in-code servers rules (MERGED) | 13:09 |
| raildo | breton: I saw it yesterday | 13:10 |
| *** spzala has joined #openstack-keystone | 13:10 | |
| *** sdake has joined #openstack-keystone | 13:10 | |
| *** spzala has quit IRC | 13:10 | |
| *** spzala has joined #openstack-keystone | 13:10 | |
| raildo | breton: it was something used as base idea to propose this https://review.openstack.org/#/c/314704/2 on tempest | 13:10 |
| patchbot | raildo: patch 314704 - qa-specs - Policy testing APIs | 13:10 |
| *** sdake_ has quit IRC | 13:13 | |
| *** spzala has quit IRC | 13:14 | |
| *** woodster_ has joined #openstack-keystone | 13:19 | |
| *** ametts has joined #openstack-keystone | 13:21 | |
| *** jsavak has joined #openstack-keystone | 13:24 | |
| *** pnavarro has quit IRC | 13:34 | |
| *** nisha__ has quit IRC | 13:35 | |
| *** ddieterly has joined #openstack-keystone | 13:37 | |
| breton | where is rderose | 13:38 |
| dstanek | breton: i have not seen the code, but i was at the summit discussion | 13:39 |
| *** amoralej|lunch is now known as amoralej | 13:40 | |
| dstanek | breton: if ron's in San Antonio this week it's only 8:30 there, if he's at home I think it's 7:30 there | 13:40 |
| *** rderose has joined #openstack-keystone | 13:41 | |
| *** henrynash has quit IRC | 13:41 | |
| *** code-R has joined #openstack-keystone | 13:42 | |
| *** sheel has joined #openstack-keystone | 13:44 | |
| breton | dstanek: good, thank you | 13:44 |
| *** edmondsw has quit IRC | 13:44 | |
| *** code-R_ has quit IRC | 13:45 | |
| *** ayoung has joined #openstack-keystone | 13:48 | |
| *** ChanServ sets mode: +v ayoung | 13:48 | |
| kmARC | dstanek, sorry i was afk. no, I didn't get an answer yet | 13:49 |
| dstanek | kmARC: you are having trouble setting up keystone under apache? | 13:50 |
| kmARC | no, that's fine, standard keystone installation (with all sql backend) is fine | 13:51 |
| dstanek | what trouble are you having? | 13:51 |
| kmARC | what I'm mising here a guide that has up-to-date info about how to enable keystone as an SP only with let's say Shibboleth. | 13:52 |
| dstanek | kmARC: i think the docs you linked to would work | 13:52 |
| kmARC | what I saw in the linked docs is that those files are not existent that it refers to and also the quoted sentence does not make sense | 13:52 |
| dstanek | kmARC: that is for setting up keystone under apache. if you skip that and start setting up shib you should be fine | 13:53 |
| dstanek | kmARC: our developer guide is also pretty good. http://docs.openstack.org/developer/keystone/configure_federation.html | 13:53 |
| dstanek | we skip the apache bits since they are documented elsewhere | 13:53 |
| kmARC | this is not the one I linked | 13:54 |
| kmARC | it says ubuntu 12.04, you sure it works with 14.04 too? | 13:54 |
| dstanek | kmARC: it should be fine even with 16.04 | 13:56 |
| dstanek | the only think OS specific is the packages to install (which hasn't changed) and the locations of the files (which also hasn't changed) | 13:57 |
| kmARC | okay | 13:57 |
| kmARC | then let me try it using the developer docs | 13:57 |
| kmARC | altho | 13:58 |
| kmARC | the shibboleth related page (http://docs.openstack.org/developer/keystone/federation/shibboleth.html) has this: | 13:58 |
| kmARC | Add WSGIScriptAlias directive to your vhost configuration: | 13:58 |
| kmARC | WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/.*?/protocols/.*?/auth)$ /var/www/keystone/main/$1 | 13:58 |
| kmARC | I do not have /var/www/keystone/main/$1 | 13:58 |
| kmARC | - $1 | 13:58 |
| kmARC | I followed mitaka keystone install guide | 13:59 |
| dstanek | kmARC: what do you have instead? | 14:00 |
| kmARC | can you point me somewhere that describes how and when /var/www/keystone gets populated? | 14:00 |
| kmARC | well, /var/www/html/index.html :) | 14:00 |
| *** itisha has joined #openstack-keystone | 14:01 | |
| dstanek | kmARC: /var/www/keystone/main/$1 is the keystone applicaiton. an html file won't work. | 14:01 |
| kmARC | I know | 14:01 |
| dstanek | do you have keystone working behind apache? | 14:01 |
| kmARC | but I have no /var/www/keystone | 14:01 |
| kmARC | yes, keystone runs in apache as wsgi | 14:01 |
| kmARC | I followed the official install guide | 14:02 |
| dstanek | kmARC: /var/www/keystone/main is the wsgi script. you may be calling yours something different | 14:02 |
| dstanek | just use that instead | 14:02 |
| kmARC | http://docs.openstack.org/mitaka/install-guide-ubuntu/keystone-install.html | 14:02 |
| kmARC | I can't find main, that's the problem | 14:02 |
| dstanek | you may have to change the values a little bit | 14:02 |
| kmARC | there is a standalone script in /usr/bin/ | 14:02 |
| dstanek | kmARC: what is in your keystoe apache config? | 14:02 |
| kmARC | the same what http://docs.openstack.org/mitaka/install-guide-ubuntu/keystone-install.html suggests | 14:03 |
| *** richm has joined #openstack-keystone | 14:03 | |
| kmARC | ( WSGIScriptAlias / /usr/bin/keystone-wsgi-public ) | 14:03 |
| dstanek | kmARC: use that value instead then | 14:03 |
| *** adu has joined #openstack-keystone | 14:05 | |
| kmARC | so you say instead of WSGIScriptAliasMatch-ing /var/www/keystone/$1 (which is a regexp replacement) I should write /usr/bin/keystone-wsgi-public without substituting the value coming from the regexp...? | 14:05 |
| kmARC | that sounds weird | 14:05 |
| *** sdake_ has joined #openstack-keystone | 14:07 | |
| kmARC | dstanek: Anyway, the biggest problem here I think is that we have the official install guide, and an official security guide, and if one follows the steps in the install guide, then he can't go through the security guide with enabling keystone federeation, because files are missing, etc. there. This is something what we should fix (I am happy to contribute once I understand how this thing works) | 14:09 |
| *** EinstCrazy has joined #openstack-keystone | 14:09 | |
| kmARC | other problem is that now I need to leave for my flight :-) Irssi runs in tmux so you can pm me if you want :-) | 14:10 |
| kmARC | thanks for the help so far, I appreciate it | 14:10 |
| dstanek | kmARC: i actually don't think that path matters at all. in my SP is use the /var/www one, but i dont' have any files there | 14:10 |
| dstanek | kmARC: you can probably just follow the guide and see if it works | 14:10 |
| *** sdake has quit IRC | 14:11 | |
| *** aloga_ has joined #openstack-keystone | 14:11 | |
| *** nkinder has joined #openstack-keystone | 14:13 | |
| *** gagehugo has joined #openstack-keystone | 14:13 | |
| *** GB21 has joined #openstack-keystone | 14:13 | |
| *** rcernin has quit IRC | 14:14 | |
| *** sdake_ is now known as sdake | 14:20 | |
| *** ravelar159 has joined #openstack-keystone | 14:25 | |
| *** edmondsw has joined #openstack-keystone | 14:26 | |
| *** aloga_ has quit IRC | 14:28 | |
| *** belmoreira has quit IRC | 14:28 | |
| *** pnavarro has joined #openstack-keystone | 14:29 | |
| *** rcernin has joined #openstack-keystone | 14:29 | |
| *** jistr is now known as jistr|mtg | 14:31 | |
| *** adu has quit IRC | 14:33 | |
| *** spzala has joined #openstack-keystone | 14:34 | |
| breton | knikolla: i've been thinking about the mapping | 14:35 |
| breton | knikolla: and experimenting | 14:35 |
| *** slberger has joined #openstack-keystone | 14:35 | |
| breton | knikolla: lets not do mapping at all in the plugin | 14:36 |
| breton | knikolla: and leave it to the test writers | 14:37 |
| breton | knikolla: but we need it for creating a protocol... | 14:42 |
| *** charz has quit IRC | 14:43 | |
| *** tonytan4ever has joined #openstack-keystone | 14:45 | |
| *** charz has joined #openstack-keystone | 14:46 | |
| *** rcernin has quit IRC | 14:46 | |
| openstackgerrit | Merged openstack/keystone: Improve keystone.conf [credential] documentation https://review.openstack.org/334702 | 14:46 |
| *** slberger1 has joined #openstack-keystone | 14:46 | |
| *** pcaruana has quit IRC | 14:46 | |
| *** slberger has quit IRC | 14:47 | |
| openstackgerrit | Merged openstack/keystone: Improve keystone.conf [eventlet_server] documentation https://review.openstack.org/335642 | 14:47 |
| openstackgerrit | Merged openstack/keystone: Improve keystone.conf [domain_config] documentation https://review.openstack.org/335545 | 14:47 |
| openstackgerrit | Merged openstack/keystone: Improve keystone.conf [endpoint_policy] documentation https://review.openstack.org/335638 | 14:47 |
| *** pushkaru has joined #openstack-keystone | 14:47 | |
| openstackgerrit | Merged openstack/keystone: Improve keystone.conf [identity_mapping] documentation https://review.openstack.org/335681 | 14:47 |
| *** nkinder has quit IRC | 14:48 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Add failed auth attempts logic to meet PCI-DSS https://review.openstack.org/324029 | 14:50 |
| *** amakarov_away is now known as amakarov | 14:50 | |
| *** ravelar159 has quit IRC | 14:51 | |
| *** david-lyle_ is now known as david-lyle | 14:51 | |
| *** jaugustine has joined #openstack-keystone | 14:52 | |
| *** sdake_ has joined #openstack-keystone | 14:56 | |
| *** sdake has quit IRC | 14:59 | |
| *** rcernin has joined #openstack-keystone | 14:59 | |
| *** slberger1 has quit IRC | 14:59 | |
| *** darosale has joined #openstack-keystone | 14:59 | |
| openstackgerrit | Merged openstack/keystone: Improve keystone.conf [federation] documentation https://review.openstack.org/335661 | 15:00 |
| openstackgerrit | Merged openstack/keystone: Reduce domain specific config setup duplication https://review.openstack.org/334062 | 15:00 |
| *** KevinE has joined #openstack-keystone | 15:00 | |
| *** KevinE has quit IRC | 15:01 | |
| *** KevinE has joined #openstack-keystone | 15:01 | |
| *** slberger has joined #openstack-keystone | 15:03 | |
| *** BjoernT has joined #openstack-keystone | 15:03 | |
| *** ravelar159 has joined #openstack-keystone | 15:04 | |
| *** code-R has quit IRC | 15:07 | |
| *** sdake has joined #openstack-keystone | 15:10 | |
| *** sdake_ has quit IRC | 15:13 | |
| *** KevinE has quit IRC | 15:13 | |
| dolphm | nonameentername: around? | 15:13 |
| nonameentername | dolphm: yeah, I'm here | 15:13 |
| dolphm | nonameentername: we're waiting for you to discuss credential encryption | 15:14 |
| nonameentername | are you waiting here? | 15:14 |
| nonameentername | where is the discussion? | 15:15 |
| dolphm | nonameentername: vidyo | 15:15 |
| *** jsavak has quit IRC | 15:17 | |
| *** jsavak has joined #openstack-keystone | 15:19 | |
| *** rcernin has quit IRC | 15:19 | |
| nonameentername | join #osic | 15:23 |
| *** jistr|mtg is now known as jistr | 15:23 | |
| *** gb21_ has joined #openstack-keystone | 15:24 | |
| *** GB21 has quit IRC | 15:25 | |
| *** gb21_ is now known as GB21 | 15:25 | |
| *** browne has joined #openstack-keystone | 15:25 | |
| *** gagehugo has quit IRC | 15:25 | |
| *** spandhe has joined #openstack-keystone | 15:26 | |
| *** tesseract- has quit IRC | 15:27 | |
| *** spandhe_ has joined #openstack-keystone | 15:29 | |
| *** spandhe has quit IRC | 15:30 | |
| *** spandhe_ is now known as spandhe | 15:30 | |
| *** code-R_ has joined #openstack-keystone | 15:31 | |
| *** dan_nguyen has joined #openstack-keystone | 15:33 | |
| *** chrisshattuck has joined #openstack-keystone | 15:39 | |
| *** pushkaru has quit IRC | 15:39 | |
| *** jaugustine has quit IRC | 15:41 | |
| *** KevinE has joined #openstack-keystone | 15:44 | |
| *** KevinE_ has joined #openstack-keystone | 15:45 | |
| *** dan_nguyen has quit IRC | 15:46 | |
| *** KevinE has quit IRC | 15:49 | |
| *** jaugsutine has joined #openstack-keystone | 15:53 | |
| *** gagehugo has joined #openstack-keystone | 15:53 | |
| *** EinstCrazy has quit IRC | 15:55 | |
| *** dims has quit IRC | 16:00 | |
| *** bjornar_ has joined #openstack-keystone | 16:01 | |
| *** tonytan4ever has quit IRC | 16:06 | |
| *** dims has joined #openstack-keystone | 16:06 | |
| *** nkinder has joined #openstack-keystone | 16:07 | |
| *** shewless has joined #openstack-keystone | 16:10 | |
| *** KevinE_ has quit IRC | 16:10 | |
| shewless | kmARC: I just setup federation using 16.04 so I can try and answer basic questions | 16:11 |
| shewless | kmARC: I used http://docs.openstack.org/developer/keystone/configure_federation.html | 16:12 |
| shewless | dstanek: did you have a chance to look up how to use the openstack CLI as a federated user? I wasn't able to find it in the IRC archives | 16:12 |
| *** roxanaghe has joined #openstack-keystone | 16:13 | |
| *** mwheckmann has joined #openstack-keystone | 16:15 | |
| *** sdake_ has joined #openstack-keystone | 16:15 | |
| *** browne has quit IRC | 16:17 | |
| *** sdake has quit IRC | 16:18 | |
| *** aloga_ has joined #openstack-keystone | 16:20 | |
| *** sdake_ is now known as sdake | 16:23 | |
| stevemar | shewless: you may have to install the master branch level of osc to try that out | 16:23 |
| *** nkinder has quit IRC | 16:24 | |
| *** nisha_ has joined #openstack-keystone | 16:34 | |
| *** gyee has joined #openstack-keystone | 16:36 | |
| *** ChanServ sets mode: +v gyee | 16:36 | |
| *** bjornar_ has quit IRC | 16:41 | |
| *** zqfan has joined #openstack-keystone | 16:41 | |
| *** ddieterly is now known as ddieterly[away] | 16:42 | |
| *** nkinder has joined #openstack-keystone | 16:43 | |
| *** aloga_ has quit IRC | 16:45 | |
| *** ddieterly[away] is now known as ddieterly | 16:45 | |
| jlk | notmorgan: yeah this is weird though. I wouldn't have expected Keystone to be doing any sort of validation of the URL provided. Nor that it would send a 400 error if the URL wasn't "right" | 16:46 |
| *** dan_nguyen has joined #openstack-keystone | 16:52 | |
| *** julim has joined #openstack-keystone | 16:52 | |
| *** fangxu has joined #openstack-keystone | 16:54 | |
| *** KevinE has joined #openstack-keystone | 16:55 | |
| *** KevinE_ has joined #openstack-keystone | 16:57 | |
| *** thumpba has joined #openstack-keystone | 16:59 | |
| *** nkinder has quit IRC | 16:59 | |
| *** KevinE has quit IRC | 17:00 | |
| *** daemontool_ has joined #openstack-keystone | 17:01 | |
| thumpba | does keystone always expose the horizon endpoint url when viewing source? | 17:02 |
| *** browne has joined #openstack-keystone | 17:03 | |
| *** spandhe has quit IRC | 17:04 | |
| *** daemontool has quit IRC | 17:04 | |
| *** dan_nguyen has quit IRC | 17:05 | |
| *** mvk has quit IRC | 17:06 | |
| *** jpena is now known as jpena|off | 17:08 | |
| shewless | stevemar: do I just pull that from here: https://github.com/openstack/python-openstackclient | 17:15 |
| shewless | stevemar: or do I need to pip install it or something? | 17:15 |
| stevemar | shewless: yeah, create virtualenv with $ virtualenv <some_name>, then cd into that dir, and run $ pip install -e . | 17:15 |
| stevemar | oops wait, source the virtualenv | 17:16 |
| shewless | stevemar: does ocs use python2.7 or 3? | 17:16 |
| stevemar | shewless: http://paste.openstack.org/show/524308/ | 17:16 |
| stevemar | shewless: py27 | 17:16 |
| shewless | stevemar: cool so I download the python-openstackclient and then cd into it and run the command you pasted? | 17:18 |
| shewless | stevemar: and then once I do that how do auth as a federated user? | 17:18 |
| stevemar | shewless: you should see new flags in openstack --help | 17:19 |
| *** lucas__ has joined #openstack-keystone | 17:19 | |
| *** lucas__ has quit IRC | 17:20 | |
| *** ddieterly is now known as ddieterly[away] | 17:20 | |
| *** julim has quit IRC | 17:21 | |
| thumpba | does keystone always expose the horizon endpoint url in the horizon dashboard when viewing source? | 17:24 |
| *** X-Istence is now known as x58 | 17:24 | |
| shewless | stevemar: thanks.. I"m trying now. I just need to install x86_64-linux-gnu-gcc .. apparently it's needed to install the openstack client | 17:25 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Include doc directory in pep8 checks https://review.openstack.org/335710 | 17:25 |
| david-lyle | thumpba, your question is confusing. keystone doesn't know about horizon, so can't expose the horizon endpoint to anything | 17:26 |
| *** roxanaghe_ has joined #openstack-keystone | 17:29 | |
| *** spandhe has joined #openstack-keystone | 17:30 | |
| *** imcsk8_ is now known as imcsk8|doctor | 17:30 | |
| *** tonytan4ever has joined #openstack-keystone | 17:31 | |
| *** roxanaghe has quit IRC | 17:32 | |
| shewless | stevemar: I don't see any additional help with the keyword "federat".. maybe you can give me a hint at what I'd be looking for in the help? | 17:35 |
| stevemar | shewless: oh you probably want to change your OS_IDENTITY_API_VERSION to 3 and your OS_AUTH_URL to end in v3 | 17:38 |
| *** spandhe_ has joined #openstack-keystone | 17:38 | |
| *** spandhe has quit IRC | 17:39 | |
| *** spandhe_ is now known as spandhe | 17:39 | |
| shewless | stevemar: I think I missed a step. Are you expecting me to have an rc file sourced? | 17:39 |
| nisha_ | rodrigods, hi | 17:39 |
| rodrigods | hi nisha_ | 17:40 |
| *** tonytan4ever has quit IRC | 17:41 | |
| thumpba | david-lyle: so when i view source on my horizon dashboard and i see <input id="id_region" name="region" type="hidden" value="http://172.16.108.2:5000/v2.0" />, you can see the comparison here http://pastebin.com/yHC8eT8g | 17:41 |
| *** tonytan4ever has joined #openstack-keystone | 17:41 | |
| *** fangxu has quit IRC | 17:42 | |
| *** fangxu has joined #openstack-keystone | 17:42 | |
| nisha_ | rodrigods, I saw your comment on the patch Add role functional tests regarding missing cleanUp | 17:43 |
| nisha_ | rodrigods, the same thing happened in the project functional tests | 17:43 |
| shewless | stevemar: my identity is set to v3. and not sure about the auth rul though | 17:43 |
| rodrigods | nisha_, it was just a guess since the implied roles test has failed | 17:43 |
| nisha_ | rodrigods, but I have used fixtures at most places | 17:43 |
| rodrigods | nisha_, so the failure is in the project's functional tests | 17:44 |
| rodrigods | let me check there | 17:44 |
| nisha_ | rodrigods, can there be anything else I can check, to make sure what can cause this | 17:44 |
| nisha_ | rodrigods, thanks | 17:44 |
| *** sdake has quit IRC | 17:45 | |
| *** gyee has quit IRC | 17:48 | |
| dstanek | shewless: i haven't looked, but i can look now | 17:48 |
| rodrigods | nisha_, need some prints, looks like the implied roles test is not being able to create one role | 17:49 |
| dstanek | thumpba: that's horizon knowing about keystone, right? | 17:50 |
| dstanek | thumpba: what's the question? | 17:50 |
| nisha_ | rodrigods, hmm, but I haven't used test_implied_roles.py anywhere | 17:51 |
| shewless | dstanek, stevemar: I think I need to specify the --os-auth-type. Trying this: openstack project list --os-auth-type v3oidcpassword | 17:51 |
| thumpba | dstanek: my question is should that be visable from horizon login? | 17:51 |
| shewless | dstanek, stevemar: then I tried adding the --os-auth-url "https://mycloud.foo.com" and my user name..but it says Auth plugin requires parameters which were not given: identity_provider, protocol | 17:51 |
| rodrigods | nisha_, yeah... let's dig into it to find out what's going on | 17:52 |
| shewless | not sure how to specify those parameters | 17:52 |
| dstanek | thumpba: so should horizon expose the keystone endpoint? i shouldn't hurt | 17:52 |
| dstanek | s/i/it/ | 17:52 |
| thumpba | okay, just curious | 17:52 |
| dstanek | i actually don't currently hurt | 17:52 |
| nisha_ | rodrigods, sure, le'me know if I need to check anything or some other work I can help in | 17:52 |
| dstanek | thumpba: david-lyle would know if that's intentional, but the user needs to know that anyway for command line usage | 17:52 |
| rodrigods | nisha_, i'm going to execute your patch locally and add prints to test_implied_roles | 17:53 |
| nisha_ | rodrigods, alright | 17:53 |
| thumpba | dstanek: true, but if an unintended party was able to see that, it could give them a point of attack | 17:53 |
| dstanek | thumpba: the keystone url isn't a secret | 17:53 |
| dstanek | thumpba: does it show that before you are authenticated? | 17:54 |
| thumpba | dstanek: maybe the better question is, can i hide that from the login | 17:54 |
| dstanek | thumpba: also most clouds publish the auth url publicly anyway | 17:55 |
| thumpba | dstanek: you can only see it if you view source on the login page | 17:55 |
| dstanek | thumpba: it may be hard to hide that because if you allow federated authentication then it has to be exposed | 17:55 |
| shewless | thumpba: you can make the keystone url use SSL if that would help :) | 17:56 |
| *** roxanaghe__ has joined #openstack-keystone | 17:57 | |
| thumpba | shewless: good point | 17:58 |
| *** roxanaghe_ has quit IRC | 18:00 | |
| dstanek | if you are creating a non-development cloud then it should be SSL | 18:02 |
| thumpba | shewless: but it is the internal url not the public that "publicly" viewable | 18:02 |
| shewless | IE: NOT port 5000? | 18:03 |
| thumpba | shewless: no its port 5000 but "| internalurl | http://172.16.108.2:5000/v2.0 | " | 18:03 |
| thumpba | as opposed to "| publicurl | http://172.16.107.226:5000/v2.0 | " | 18:04 |
| shewless | dstanek, stevemar: would really appreciate some help getting the osc working with federated user. I have the osc from the master branch but I have no idea what I'm doing | 18:04 |
| dstanek | shewless: looking for my example now | 18:04 |
| shewless | thumpba: hmm. mine is one and the same (only public) and using SSL | 18:05 |
| rodrigods | nisha_, 'keystoneclient-functional-140b1e1d6d5542f0b7cab8d7e04cbc06' appears in test_implied_roles | 18:05 |
| rodrigods | nisha_, it is the role fixture, right? | 18:05 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 18:05 |
| dstanek | thumpba: i don't think horizon is getting that from the catalog. i would guess it's configured to use that url | 18:05 |
| *** ravelar159 has quit IRC | 18:06 | |
| dstanek | thumpba: does horizon have their own channel? you might have more luck finding somebody there that knows how it works | 18:06 |
| nisha_ | rodrigods, I don't know. I haven't wrote test_implied_roles files. But I have added code in client_fixture.py to for role | 18:07 |
| thumpba | dstanek: will do. i wasn't sure if that was something that keystone was putting out there. thanks | 18:07 |
| dstanek | thumpba: unless you are talking directly through keystone it horizon thing. they have complete control over what is displayed. | 18:08 |
| rodrigods | nisha_, i'm not saying you wrote test_implied_roles, i'm saying the fixture used in test_projects is appearing in test_implied_roles | 18:09 |
| dstanek | shewless: http://paste.openstack.org/show/524316/ | 18:09 |
| *** mvk has joined #openstack-keystone | 18:09 | |
| nisha_ | rodrigods, hmm okay | 18:10 |
| *** chrisshattuck has quit IRC | 18:11 | |
| *** ddieterly[away] is now known as ddieterly | 18:12 | |
| nisha_ | rodrigods, I don't understand why test_projects is interfering with test_implied_roles? Anything I can do to fix this up | 18:12 |
| rodrigods | nisha_, think it is related with the order the stuff is erased in the test | 18:12 |
| rodrigods | nisha_, in test_get_hierarchy_as_list | 18:12 |
| dstanek | shewless: that is based on a working test script that i use | 18:14 |
| rodrigods | nisha_, keystone only allows the deletion of project without children, it might be the case where the test is trying to delete a project that has children so the cleanup fails | 18:14 |
| rodrigods | nisha_, it is just a guess, because removing that test, everything works fine | 18:14 |
| nisha_ | rodrigods, ohh | 18:15 |
| dolphm | rderose: i've been poking at https://review.openstack.org/#/c/328339/ and i'm not sure you're keeping & discarding the correct passwords in all cases | 18:15 |
| patchbot | dolphm: patch 328339 - keystone - PCI-DSS Password history requirements | 18:15 |
| nisha_ | rodrigods, Also, why some tests, run successfully once, but after sometime they fail when I do recheck | 18:16 |
| rderose | dolphm: really? passwords are added at the end of the list and discarded from the beginning | 18:16 |
| rodrigods | nisha_, might be the order they are ran | 18:16 |
| nisha_ | rodrigods, thanks for help | 18:17 |
| dolphm | rderose: maybe you can walk me through it a bit | 18:17 |
| dolphm | rderose: the complexity and importance of _truncate_passwords is still raising red flags for me | 18:17 |
| dolphm | rderose: when it's called, the *new* password has not been added to the list, yet, correct? | 18:17 |
| rderose | dolphm: correct | 18:18 |
| rodrigods | nisha_, np, please let us know of your findings :) you can debug this by creating an internal add_cleanup() method that prints the entity it is trying to erase before calling addCleanup | 18:18 |
| *** thumpba has quit IRC | 18:18 | |
| *** roxanaghe__ has quit IRC | 18:18 | |
| nisha_ | rodrigods, sure :) | 18:19 |
| nisha_ | rodrigods, le me try | 18:19 |
| dolphm | rderose: i can definitely make your tests pass when i intentionally break _truncate_passwords(), because the tests don't seem to care about *which* passwords were removed | 18:19 |
| dolphm | rderose: just that the right number of passwords remain | 18:19 |
| rderose | dolphm: and the passwords list is sorted in the sql model | 18:20 |
| shewless | dstanek: thanks. so I can't use the openstack client directly? | 18:20 |
| *** RichardRaseley has joined #openstack-keystone | 18:20 | |
| rderose | dolphm: the right number and the right passwords should remain because they are sorted | 18:20 |
| shewless | dstanek: what is sp_id and idp_id? | 18:21 |
| rderose | dolphm: how do you intentionally break _truncate...? | 18:21 |
| dolphm | rderose: i'm saying i can arbitrarily remove passwords and the tests pass | 18:21 |
| dolphm | as long as the number of passwords is correct | 18:21 |
| dolphm | rderose: by rewriting it | 18:21 |
| rderose | dolphm: hmm... | 18:22 |
| dolphm | rderose: i'm trying to understand it in the process | 18:22 |
| RichardRaseley | Can anyone direct me towards a detailed explanation of how Keystone interacts with memcache? I am generally aware that it employs two different caching strategies, one for tokens and one for more general request caching (if that is correct?). | 18:22 |
| rderose | dolphm: process is 1) update password 2) get previous passwords 3) validate against previous passwords | 18:23 |
| dstanek | shewless: i don't think the cli client has support for that yet | 18:23 |
| dstanek | shewless: those should be _ip | 18:23 |
| rderose | dolphm: you wouldn't be removing passwords as part of an update | 18:23 |
| *** amoralej is now known as amoralej|off | 18:24 | |
| dstanek | RichardRaseley: yes, sorta. the token cache is actually a driver and not an actual cache (you should not use that). otherwise keystone uses oslo.cache to cache other things. | 18:25 |
| dstanek | RichardRaseley: are you looking for something specific? | 18:25 |
| dolphm | rderose: and when there's no max password count configured, you always truncate to just 1 password, right? | 18:26 |
| dstanek | RichardRaseley: http://docs.openstack.org/developer/keystone/configuration.html#caching-layer | 18:27 |
| RichardRaseley | dstanek: Well, we are having some really weird behaviors with authenticating, services logging that they couldn't validate tokens and such. I started looking through my Keystone configuration, just to validate things and then realized I didn't really understand how the two were different. | 18:27 |
| RichardRaseley | dstanek: When you say above "you should not use that", what was the 'that' you were referring to? | 18:27 |
| dstanek | RichardRaseley: the memcached token backend | 18:28 |
| shewless | dstanek: okay. stevemar was saying that the master branch of ocs works.. I guess not? | 18:28 |
| rderose | dolphm: right, unless you don't have any previous passwords n > 0 in _truncate... | 18:28 |
| RichardRaseley | dstanek: Oh? I thought that was recommended in Kilo. | 18:28 |
| dstanek | RichardRaseley: so you are seeing log entries from auth_token saying it could not authenticate? | 18:28 |
| *** nisha_ has quit IRC | 18:29 | |
| rderose | dolphm: if no previous passwords, then the passwords are not truncated | 18:29 |
| *** thumpba has joined #openstack-keystone | 18:29 | |
| dstanek | RichardRaseley: it has too many pitfalls and corner cases. for example, memcached may remove token from the cache when it wants to. they would make tokens not work and you'd have to auth to get a new one. | 18:30 |
| *** nisha_ has joined #openstack-keystone | 18:30 | |
| *** TxGVNN has quit IRC | 18:30 | |
| dstanek | if memcached is down completely you might not be able to auth at all (i'd have to check the code) | 18:30 |
| RichardRaseley | dstanek: I feel like we might have a couple issues here, which makes it a little hard to know where one starts and the other ends. I am seeing a few different things. In keystone logs I se a lot of 'WARNING keystone.common.wsgi [-] Could not find token: c07cf093cab14558a97884d4af44b220' | 18:30 |
| rderose | dolphm: otherwise correct, always truncate to 1 password | 18:30 |
| RichardRaseley | With different tokens, over and over. | 18:30 |
| shewless | dstanek: so I tried putting your paste into a file and executing it.. that didn't work. ImportError: No module named keystoneauth1 | 18:30 |
| dstanek | shewless: you are missing dependencies in your environment | 18:31 |
| shewless | dstanek: I guess in the end I'm trying to deploy openstack to a bunch of users.. so OSC would need to work | 18:31 |
| dolphm | rderose: the "unless" and "otherwise" imply to my ears that there is room for simplification | 18:31 |
| RichardRaseley | I am seeing the corresponding errors in Neutron that say token cannot be found, authorization failed. | 18:31 |
| dstanek | shewless: stevemar may be right. it was in development when i was doing my work. he would know better about the state of that project | 18:31 |
| shewless | dstanek: okay thanks. Do you know how I would use the OCS if it would support federation? | 18:32 |
| dolphm | rderose: so, if we change the default value from None to 1, that fits the business case of "if i don't want this feature, i only expect there to ever be 1 password in the history table", right? | 18:32 |
| rderose | dolphm: okay, I'm open to suggestions :) | 18:32 |
| dstanek | RichardRaseley: are you using the memcached token backend? | 18:32 |
| shewless | dstanek: I'm missing a lot of things in my environment.. I don't even have an environment! | 18:32 |
| dstanek | shewless: nope, you'll have to look at the docs | 18:32 |
| RichardRaseley | dstanek: But, just to confirm my understanding, we have the following 3 sections we have to configure for memcache in keystone: [cache], [memcache], and [token] | 18:33 |
| RichardRaseley | dstanek: Yes, we are. | 18:33 |
| rderose | dolphm: min value is 2 | 18:33 |
| RichardRaseley | We were considering switching to the SQL backend | 18:33 |
| dolphm | rderose: so the min becomes 1 | 18:33 |
| shewless | dstanek: which docs? I want to look at them but I don't know where they are | 18:33 |
| *** GB21 has quit IRC | 18:33 | |
| dolphm | rderose: 1 means there's no "history" | 18:33 |
| dolphm | rderose: 2 means you have 1 password in history, etc | 18:33 |
| rderose | dolphm: but we don't allow 1 | 18:33 |
| dolphm | rderose: this is just a thought experiment | 18:33 |
| rderose | dolphm: okay | 18:34 |
| dolphm | rderose: what if we changed the default to 1, then changed the min to 1 | 18:34 |
| *** jsavak has quit IRC | 18:34 | |
| *** thumpba has quit IRC | 18:34 | |
| dolphm | rderose: then you'd never be checking to see if max_cnt is zero | 18:34 |
| *** roxanaghe has joined #openstack-keystone | 18:34 | |
| *** jsavak has joined #openstack-keystone | 18:34 | |
| dolphm | rderose: in fact, the ternary around gathering a value for that config option entirely goes away | 18:34 |
| RichardRaseley | dstanek: Are you suggesting we switch to SQL? | 18:34 |
| dolphm | rderose: because you have something >= 1 | 18:34 |
| RichardRaseley | We have a 3-node HA cluster. | 18:34 |
| dstanek | shewless: http://docs.openstack.org/developer/python-openstackclient/ | 18:34 |
| dolphm | rderose: so then _truncate_passwords never has to worry about max_cnt == 0 | 18:35 |
| *** thumpba has joined #openstack-keystone | 18:35 | |
| dolphm | rderose: and _validate_password_history() always gets a non-zero max_cnt to work with, so the conditional is ALWAYS met | 18:35 |
| dstanek | RichardRaseley: that is a bigger operational discussion for you to have, but i wouldn't use the memcached backend for a variety of reasons | 18:35 |
| shewless | dstanek: should I use --os-auth-type v3oidcpassword? | 18:35 |
| *** thumpba has quit IRC | 18:35 | |
| dstanek | RichardRaseley: is memcached up and is it getting data saved to it | 18:35 |
| *** thumpba has joined #openstack-keystone | 18:36 | |
| dolphm | rderose: so, that basically leaves _truncate_passwords with a one-liner | 18:36 |
| dstanek | shewless: no idea | 18:36 |
| RichardRaseley | dstanek: Fair enough. So if were to go that route (SQL backend) we would configure that in the 'token' configuration section, but preserve the memcache and cache configuration for the other caching Keystone is doing? | 18:37 |
| dolphm | rderose: and if you use a slice instead of del, you can safely perform the operation unconditionally | 18:37 |
| RichardRaseley | dstanek: Yes, it is up and data is being written to it. | 18:37 |
| dolphm | rderose: http://cdn.pasteraw.com/ozdho47ylalklsm6preyq251oxl5l63 | 18:37 |
| *** pnavarro has quit IRC | 18:38 | |
| *** henrynash has joined #openstack-keystone | 18:38 | |
| *** ChanServ sets mode: +v henrynash | 18:38 | |
| dstanek | RichardRaseley: i'd have to look at the code or example config, but i think the memcached section is just for the token cache | 18:38 |
| RichardRaseley | OK | 18:39 |
| dstanek | RichardRaseley: have you looked at what token is being used against the service and see if keystone knows about it? | 18:39 |
| rderose | dolphm: looks sound :) let me play with it and I'll update the patch | 18:40 |
| *** henrynash has quit IRC | 18:41 | |
| RichardRaseley | dstanek: You're asking if I've seen a failed request, looked at the auth token, then done a token validate on it? | 18:41 |
| rderose | dolphm: and thanks, that definitely simplifies the logic | 18:42 |
| dstanek | RichardRaseley: yes | 18:42 |
| dolphm | rderose: i'm paranoid that i did something wrong because i had to revise the tests | 18:42 |
| rderose | dolphm: I know coding that, certainly made my head hurt | 18:43 |
| dstanek | RichardRaseley: the first step is to get a token from keystone and then validate it to know that keystone is generally working. | 18:43 |
| dstanek | RichardRaseley: then i'd try to take a token that should work, but doesn't according to the logs and if it works | 18:43 |
| RichardRaseley | dstanek: Sorry I wasn't more clear. This is an otherwise functioning cloud that is just exhibiting these symptoms intermittantly. | 18:43 |
| dstanek | RichardRaseley: then i could check a token that should work, but doesn't. | 18:44 |
| rderose | dolphm: if there was 1 previous password and max count is 1, you'll truncate before the check, right? | 18:44 |
| dstanek | RichardRaseley: is your memcache showing evictions | 18:44 |
| RichardRaseley | I can launch instances, attach IPs, do work, whatever, but about 2-3% of the time I get an auth error in web-ui or cli and auth errors in log. Was working on the memcache evicting tokens theory, started digging through config, realize I didn't udnerstand the difference between some of the options and asked in channel. | 18:45 |
| RichardRaseley | </story of my life. | 18:45 |
| rderose | dolphm: so then there wouldn't be a password to check against | 18:45 |
| dstanek | RichardRaseley: did you check memcache to see if it's evicting? | 18:45 |
| dolphm | rderose: uhh, it should still be there to check against | 18:45 |
| rderose | dolphm: :) | 18:45 |
| RichardRaseley | dstanek: I have not checked that specifically. I am going to have to review the docs for the way to go about that. | 18:46 |
| dolphm | rderose: >>> [0][-1:] | 18:46 |
| dolphm | rderose: [0] | 18:46 |
| rderose | dolphm: ah, okay | 18:46 |
| dstanek | RichardRaseley: if you run the stats command against memcache it'll how you the evictions | 18:47 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password expires validation https://review.openstack.org/333360 | 18:52 |
| *** dan_nguyen has joined #openstack-keystone | 18:54 | |
| *** samueldmq has joined #openstack-keystone | 18:57 | |
| shewless | stevemar: I guess if you get back and you could help me with the master branch of the osc it would be appreciated. | 18:57 |
| *** bjornar_ has joined #openstack-keystone | 18:58 | |
| *** samueldmq has quit IRC | 19:00 | |
| *** setuid has left #openstack-keystone | 19:01 | |
| *** chrisshattuck has joined #openstack-keystone | 19:01 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [memcache] documentation https://review.openstack.org/336259 | 19:01 |
| *** chrisshattuck has quit IRC | 19:07 | |
| *** gordc has quit IRC | 19:07 | |
| *** jsavak has quit IRC | 19:07 | |
| *** jsavak has joined #openstack-keystone | 19:08 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 19:09 |
| *** jed56 has quit IRC | 19:15 | |
| notmorgan | dstanek: man i just wrote a novel on https://bugs.launchpad.net/horizon/+bug/1597864 | 19:15 |
| openstack | Launchpad bug 1597864 in OpenStack Security Advisory "Horizon exposes keystone endpoint url when viewing login source code" [Undecided,Incomplete] | 19:15 |
| notmorgan | dstanek: :P | 19:15 |
| notmorgan | dolphm: how did the encrypted creds talk go? | 19:15 |
| *** chrisshattuck has joined #openstack-keystone | 19:16 | |
| notmorgan | dolphm: i only ask because -- i didn't see any update here. :) | 19:16 |
| dstanek | notmorgan: about how we do key rotation? | 19:17 |
| notmorgan | dstanek: yeah and other such things. that nonameentername and dolphm were disucssing earliuer today | 19:17 |
| dstanek | notmorgan: we're going to do it more like we do fernet rotation so that it's easier on operators and avoid the staging key corner cases | 19:17 |
| notmorgan | dstanek: cool. | 19:18 |
| dstanek | notmorgan: in the middle of your novel :-) | 19:18 |
| notmorgan | hehe | 19:18 |
| notmorgan | i warned you, it is a novel | 19:18 |
| dstanek | i can't disagree with you (on the content that is) | 19:19 |
| *** jsavak has quit IRC | 19:19 | |
| *** chrisshattuck has quit IRC | 19:21 | |
| *** ravelar159 has joined #openstack-keystone | 19:21 | |
| notmorgan | dstanek: i just felt like a lot more information was needed on why this isn't a bug. we could make this better/different, but it's not really worth it until we change how service->service works. | 19:21 |
| notmorgan | but i'm going to still argue catalog isn't really priv. info | 19:22 |
| notmorgan | dstanek: hmmm... so i had fun, learned how to build .debs in docker containers for isolated builds [ with relatively simple tools, docker-compose is damn cool ] | 19:23 |
| dstanek | never had to use it. i've mostly stayed away from docker in favor of lxd/lxc | 19:24 |
| *** fangxu has quit IRC | 19:25 | |
| *** ravelar159 has quit IRC | 19:25 | |
| *** darosale has quit IRC | 19:25 | |
| notmorgan | dstanek: you can do it directly with lxd/lxc, but docker-compose is kindof awesome, i built a simple dockerfile, and a .yaml, said docker-compose build, and it built the environment for me (scripted), then docker-compose run and it builds the packages and drops them on the FS locally for me. | 19:25 |
| notmorgan | dstanek: had to do some hacking to make it work with Xenial, but i'd have had to do the same things with lxc/lxd | 19:26 |
| * notmorgan even used ... *gasp* ruby. | 19:26 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [oauth1] documentation https://review.openstack.org/336266 | 19:28 |
| *** jsavak has joined #openstack-keystone | 19:30 | |
| notmorgan | uh... why do we have config options defined out of keystone.common.config? I thought we didn't do that because if we *do* we end up with configs that are initialized befor the server is. | 19:30 |
| notmorgan | dolphm, stevemar: ^ see dolph's patch (not the patch, but that there is an option in the file] | 19:31 |
| notmorgan | or are we moving how all these things work? | 19:31 |
| dstanek | notmorgan: moving how they work | 19:31 |
| dstanek | this is following the nova lead so we don't have that initialization problem | 19:32 |
| notmorgan | oh dear god. | 19:32 |
| notmorgan | this looks awful. | 19:32 |
| dolphm | notmorgan: keystone.conf? | 19:32 |
| dstanek | how so? i like the organization better | 19:32 |
| notmorgan | i dislike it being quite so flat. | 19:32 |
| dolphm | notmorgan: i deleted keystone.common.conf altogether, but there are a few stragglers defined randomly | 19:33 |
| dstanek | "flat is better than nested" | 19:33 |
| notmorgan | eh, sortof? | 19:33 |
| bknudson_ | I was going to check to see if the initialization happens on import | 19:33 |
| notmorgan | bknudson_: iirc it does. | 19:34 |
| *** darosale has joined #openstack-keystone | 19:34 | |
| notmorgan | which is why we locked it in a method we called. | 19:34 |
| notmorgan | but i also might be totally mis-remembering | 19:34 |
| bknudson_ | I'm not a fan of things happening on import in general | 19:34 |
| notmorgan | oh maybe it's tied to "register" | 19:35 |
| notmorgan | ? | 19:35 |
| dolphm | bknudson_: notmorgan: they're registered once on import, assuming you're reading options from keystone.conf and not from oslo_config.cfg.CONF https://github.com/openstack/keystone/blob/master/keystone/conf/__init__.py#L91-L93 | 19:35 |
| notmorgan | dolphm: then don't do that. | 19:35 |
| notmorgan | dolphm: it should still be gated via an explciit register_opts() | 19:35 |
| *** sheel has quit IRC | 19:35 | |
| notmorgan | the reason we changed this is so that you can't access an option and default vaule before the config is loaded | 19:36 |
| bknudson_ | I'd prefer we didn't do that... easy enough to make that a function and call it where necessary | 19:36 |
| notmorgan | we had a lot of issues. | 19:36 |
| dolphm | notmorgan: that is still true | 19:36 |
| notmorgan | dolphm: not based on what you said | 19:36 |
| bknudson_ | issues that were impossible to test | 19:36 |
| dolphm | notmorgan: in fact, is more true now, because you can't accidentally register things twice | 19:36 |
| notmorgan | you said it's handled in __init__ | 19:36 |
| notmorgan | on import | 19:36 |
| notmorgan | before we did import, then .configure() to register | 19:37 |
| dolphm | oops, i did mistype... "they're registered once on import, assuming you're ***NOT*** reading options from keystone.conf and not from oslo_config.cfg.CONF" | 19:37 |
| notmorgan | which is the pattern i would like to keep. | 19:37 |
| dolphm | wait, dammit | 19:37 |
| *** tonytan4ever has quit IRC | 19:37 | |
| dolphm | i had it right hte first time, nevermind | 19:37 |
| notmorgan | dolphm: yeah see :P | 19:37 |
| dolphm | options are registered once, period | 19:37 |
| notmorgan | right, so... | 19:37 |
| notmorgan | i'm 100% ok with that. | 19:37 |
| dolphm | you can't re-register them, and there's no explicit work to do other than try to read from keystone.conf | 19:38 |
| notmorgan | i remember nightmares of import registering, and something accessing config BEFORE keystone.conf is loaded | 19:38 |
| notmorgan | so, i don't want to go back to that hell | 19:38 |
| notmorgan | hence the ask for a simple .run_register() | 19:38 |
| dolphm | notmorgan: i don't see how we can go back to that hell if it's done automatically on import | 19:38 |
| notmorgan | type function that is explicitly called once we know everything is loaded | 19:38 |
| bknudson_ | there were references to config option in, for example, default arguments | 19:38 |
| *** chrisshattuck has joined #openstack-keystone | 19:39 | |
| notmorgan | dolphm: because otherthings can reference the config object now and get the defaults on import | 19:39 |
| dolphm | notmorgan: the other constraint is that options should not be registered outside of keystone.conf | 19:39 |
| notmorgan | it's not registering it's code referencing the config object and the options | 19:39 |
| bknudson_ | or there may be references to config options in module-level variables, too. | 19:39 |
| dstanek | notmorgan: code using the config on import would be terrible either way | 19:39 |
| *** aloga_ has joined #openstack-keystone | 19:39 | |
| notmorgan | dstanek: that is why we explicitly blocked it before | 19:39 |
| *** tqtran has joined #openstack-keystone | 19:39 | |
| notmorgan | so it *cant* happen | 19:40 |
| notmorgan | it would explode | 19:40 |
| notmorgan | this makes it so it is possible again. | 19:40 |
| dolphm | notmorgan: ah, we're talking about slightly different problems then | 19:40 |
| notmorgan | since the options are registered on import | 19:40 |
| notmorgan | dolphm: yah, i don't mind the change i want to keep the pattern we had were we have an explicit "register_all_the_options" method we call | 19:40 |
| notmorgan | for making sure no one sneaks in broken code by accident | 19:40 |
| *** hoonetorg has quit IRC | 19:40 | |
| bknudson_ | look at this!: https://review.openstack.org/#/c/334673/1/keystone/common/validation/parameter_types.py | 19:41 |
| patchbot | bknudson_: patch 334673 - keystone - Allow id string validation to be configurable | 19:41 |
| dstanek | in my mind *nothing* should import the config directly and instead should be passed an object in the constructor - just the very top level would import config | 19:41 |
| bknudson_ | this is exactly the problem. | 19:41 |
| *** nisha_ has quit IRC | 19:41 | |
| notmorgan | dolphm: so prior to this flattening, that would have exploded vs. passing | 19:42 |
| notmorgan | bknudson_: ++ | 19:42 |
| notmorgan | bknudson_: good find so quickly btw. | 19:42 |
| bknudson_ | I'd seen it passing by and wondered how it was implemented now. | 19:43 |
| dolphm | so, what caused the explosion, exactly? | 19:43 |
| bknudson_ | the options weren't registered, so some kind of reference error | 19:43 |
| dolphm | so, now they're registered but not initialized, right? | 19:44 |
| notmorgan | dolphm: oslo config would say "NO SUCH OPTION" | 19:44 |
| dolphm | with values from config files, etc | 19:44 |
| dolphm | so, why don't we also initialize before keystone.conf is finished importing | 19:44 |
| bknudson_ | it's registered but the config hasn't been read yet. | 19:44 |
| notmorgan | dolphm: right, so you'll in that case never get the value from keystone.conf | 19:44 |
| notmorgan | dolphm: since you've bound "pattern" to the default value | 19:44 |
| dolphm | then we don't have to have wsgi code initializing config, and keystone-manage code initializing config, and unit tests initializing config... | 19:45 |
| bknudson_ | not sure how the configuration could happen on import, it would need the parameters | 19:45 |
| notmorgan | dolphm: we can't read the config on import really? needs to be at runtime. | 19:45 |
| bknudson_ | although we've gotten rid of keystone-all so maybe not a problem anymore. | 19:45 |
| notmorgan | bknudson_: eh, this will still be an issue. | 19:45 |
| notmorgan | i think. | 19:46 |
| dolphm | notmorgan: how is nova solving (or not solving) this problem? | 19:46 |
| notmorgan | ignoring it | 19:46 |
| notmorgan | and banking that bugs/reviewers will catch it. | 19:46 |
| notmorgan | afaik | 19:46 |
| *** daemontool_ has quit IRC | 19:46 | |
| bknudson_ | might want to do a quick check of nova code to see if there are references to unconfigured options | 19:47 |
| *** jaugustine has joined #openstack-keystone | 19:47 | |
| shewless | does anyone know if using the top example here should give me an unscoped token: http://docs.openstack.org/developer/keystone/api_curl_examples.html | 19:47 |
| shewless | I get a 401 when I try that | 19:47 |
| notmorgan | i'm guessing they do a config load early in the wsgi process, but... it still begs the question, why not make it hard to pass through, since we have had this issue before | 19:47 |
| notmorgan | and it caused all sorts of odd behavior | 19:48 |
| *** aloga_ has quit IRC | 19:48 | |
| dolphm | johnthetubaguy: ping, wondering if nova has the possibility for races between things utilizing registered but still-unconfigured configuration options with the new nova.conf package | 19:48 |
| notmorgan | dolphm: iirc it's always had that possibility. | 19:48 |
| notmorgan | even before this new package. | 19:48 |
| notmorgan | but they may also only ever reference config values in methods/functions which is safe. | 19:49 |
| notmorgan | just ... easy for an import reference to sneak through. | 19:49 |
| *** tonytan4ever has joined #openstack-keystone | 19:50 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [policy] documentation https://review.openstack.org/336267 | 19:51 |
| *** hoonetorg has joined #openstack-keystone | 19:52 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Do not register options on import https://review.openstack.org/336268 | 19:53 |
| dolphm | notmorgan: untested ^ | 19:53 |
| *** ddieterly is now known as ddieterly[away] | 19:53 | |
| notmorgan | dolphm: yeah you're probably going to need a hook somewhere to do that for you now. | 19:53 |
| notmorgan | but everything should explode. | 19:54 |
| dolphm | notmorgan: see L139 and L140 | 19:54 |
| notmorgan | we used to call keystone.common.config.configure() | 19:54 |
| dolphm | notmorgan: that basically didn't change from keystone.common.config | 19:54 |
| notmorgan | ah | 19:54 |
| notmorgan | so, i think you need to move your code down into that, and make .configure() only runable once? | 19:55 |
| notmorgan | since i think no opts are going to be registered now | 19:55 |
| dolphm | notmorgan: nothing prevented it from being called twice before | 19:55 |
| *** roxanaghe has quit IRC | 19:55 | |
| notmorgan | dolphm: except it would explode after keystone.conf was loaded | 19:55 |
| notmorgan | i guess that is fine. | 19:55 |
| notmorgan | re-registering opts is safe as long as keystone.conf hasn't been loaded | 19:56 |
| notmorgan | it doesn't impact anything. | 19:56 |
| notmorgan | oslo.config is safe in that regard. | 19:56 |
| dolphm | notmorgan: the code in keystone.common.config before i touched it https://github.com/openstack/keystone/blob/3f78996cfa163291cadecb72fb3c102e578bec0d/keystone/common/config.py#L1177-L1201 | 19:56 |
| notmorgan | dolphm: and now https://github.com/openstack/keystone/blob/3f78996cfa163291cadecb72fb3c102e578bec0d/keystone/common/config.py#L1191-L1196 is missing | 19:57 |
| notmorgan | so you're not actually registering the options from keystone.conf | 19:57 |
| notmorgan | in the new code | 19:57 |
| dolphm | notmorgan: the single for loop replaces it | 19:57 |
| notmorgan | oh i'm just blind | 19:58 |
| notmorgan | i can't see the for loop | 19:58 |
| notmorgan | it's hiding under the register_cli_opt | 19:58 |
| notmorgan | in plain sight | 19:58 |
| notmorgan | dolphm: so, yeah that should do it as long as we haven't grown magical dependencies on config options on import somewhere in the mean time :) | 19:59 |
| notmorgan | dolphm: maybe i need more coffee... | 19:59 |
| notmorgan | or ... any coffee? | 19:59 |
| dolphm | notmorgan: i left a handful of other notes here https://review.openstack.org/#/c/325604/8/keystone/common/config.py | 19:59 |
| patchbot | dolphm: patch 325604 - keystone - Replace keystone.common.config with keystone.conf ... (MERGED) | 19:59 |
| dolphm | notmorgan: and then here as well https://review.openstack.org/#/c/325604/8/keystone/conf/__init__.py | 19:59 |
| patchbot | dolphm: patch 325604 - keystone - Replace keystone.common.config with keystone.conf ... (MERGED) | 19:59 |
| dstanek | can't olso.config just throw an error if the config hasn't been read and someone is trying to use it | 20:02 |
| *** ddieterly[away] is now known as ddieterly | 20:02 | |
| notmorgan | dstanek: possibly, but i mean, maybe there is no config file to read? so in either case we need to do .load_config_if_needed_and_mark_conf_initialzed or something | 20:03 |
| notmorgan | dstanek: i think it's a feature request for oslol.config for better UX from a dev standpoint, but for now we have a path forward. | 20:04 |
| dolphm | notmorgan: py27 tests pass with that change | 20:05 |
| notmorgan | dolphm: cool | 20:05 |
| notmorgan | WFM. | 20:05 |
| *** tonytan4ever has quit IRC | 20:05 | |
| bknudson_ | dstanek: that would be a nice feature! | 20:06 |
| *** tonytan4ever has joined #openstack-keystone | 20:06 | |
| dstanek | notmorgan: i'm not sure i'm parsing tristan's comment properly | 20:07 |
| *** dan_nguyen has quit IRC | 20:09 | |
| notmorgan | he;s just commenting that this is a MOS bug or Openstack Ansible or whatever is configuring it | 20:09 |
| *** tqtran has quit IRC | 20:09 | |
| notmorgan | or it's that MOS/Ansibvle/WHatever explciitly sets the horizon config value to "internal" | 20:09 |
| notmorgan | and he was pointing to the documentation explaining how to pick the right endpoint | 20:10 |
| *** tqtran has joined #openstack-keystone | 20:10 | |
| dstanek | notmorgan: gotcha. so i was parsing correctly-ish, thx | 20:10 |
| notmorgan | and that horizon was set that way explicitly. | 20:10 |
| notmorgan | based on the doc. | 20:10 |
| dstanek | sounds like maybe that bug needs to be on some of the CM tools then | 20:11 |
| *** mwheckmann has quit IRC | 20:11 | |
| notmorgan | well... sure? | 20:11 |
| *** tonytan4ever has quit IRC | 20:12 | |
| dstanek | not necessarily because it's a security thing, but for horizon to actually work when the internat endpoints are locked down | 20:12 |
| notmorgan | depends on if django is doing the request or the browser | 20:12 |
| *** jaugustine has quit IRC | 20:12 | |
| *** tonytan4ever has joined #openstack-keystone | 20:13 | |
| *** tqtran has quit IRC | 20:15 | |
| dstanek | stevemar: re:https://review.openstack.org/#/c/333490 is the actual message not returned/shown to the user? | 20:15 |
| *** tqtran has joined #openstack-keystone | 20:15 | |
| dstanek | notmorgan: for federated login i think the user is redirected to keystone and from there back to horizon. although that interaction could happen in django | 20:16 |
| notmorgan | dstanek: yeah | 20:17 |
| *** tonytan4ever has quit IRC | 20:17 | |
| *** tonytan4ever has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password expires validation https://review.openstack.org/333360 | 20:18 |
| *** fangxu has joined #openstack-keystone | 20:23 | |
| *** spzala has quit IRC | 20:25 | |
| *** gyee has joined #openstack-keystone | 20:26 | |
| *** ChanServ sets mode: +v gyee | 20:26 | |
| *** ddieterly is now known as ddieterly[away] | 20:26 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password expires validation https://review.openstack.org/333360 | 20:31 |
| *** jaugustine has joined #openstack-keystone | 20:35 | |
| *** aloga_ has joined #openstack-keystone | 20:36 | |
| *** imcsk8|doctor is now known as imcsk8 | 20:39 | |
| *** toddnni has quit IRC | 20:39 | |
| *** thumpba has quit IRC | 20:40 | |
| *** rcernin has joined #openstack-keystone | 20:41 | |
| *** toddnni has joined #openstack-keystone | 20:44 | |
| stevemar | dstanek: o/ | 20:45 |
| dstanek | stevemar: howdy | 20:45 |
| stevemar | dstanek: looking at https://review.openstack.org/#/c/333490/2/ | 20:46 |
| patchbot | stevemar: patch 333490 - keystone - Additional logging when authenticating | 20:46 |
| stevemar | what actual message are you talking abut? | 20:46 |
| dstanek | stevemar: line 185 for example on https://review.openstack.org/#/c/333490/2/keystone/auth/controllers.py | 20:47 |
| patchbot | dstanek: patch 333490 - keystone - Additional logging when authenticating | 20:47 |
| *** ddieterly[away] is now known as ddieterly | 20:48 | |
| dstanek | or any of them really | 20:48 |
| dstanek | the reason for this patch is that users won't know what is wrong when they can't auth and they'll need to call the cloud admin who can find it in the log | 20:49 |
| stevemar | dstanek: it'll still raise an exception | 20:51 |
| stevemar | with the same message as before | 20:51 |
| stevemar | dstanek: i don't see how its any different than before, aside from more logging | 20:52 |
| stevemar | dstanek: or are you saying the fix is not sufficient? | 20:53 |
| *** jaugustine has quit IRC | 20:54 | |
| *** raildo is now known as raildo-afk | 21:02 | |
| *** henrynash has joined #openstack-keystone | 21:03 | |
| *** ChanServ sets mode: +v henrynash | 21:03 | |
| *** henrynash has quit IRC | 21:04 | |
| browne | Hi all. I'm running into an issue in Mitaka (after upgrade from Kilo) where a user isn't authorized to a role on a project even though I just assigned it. It seems caching related and does disappear after turning off caching of roles. Any known issues around this? In flight patch? | 21:08 |
| *** gagehugo has quit IRC | 21:10 | |
| *** jaugustine has joined #openstack-keystone | 21:11 | |
| *** pauloewerton has quit IRC | 21:11 | |
| dstanek | stevemar: i don't care if we add extra logging. i just don't see it as a fix to anything. the user should be getting an error message that would let them know what they are doing wrong. | 21:12 |
| *** jaugustine has quit IRC | 21:13 | |
| *** ametts has quit IRC | 21:13 | |
| *** jaugsutine has quit IRC | 21:13 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password expires validation https://review.openstack.org/333360 | 21:14 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Include doc directory in pep8 checks https://review.openstack.org/335710 | 21:14 |
| *** roxanaghe has joined #openstack-keystone | 21:18 | |
| *** ddieterly is now known as ddieterly[away] | 21:18 | |
| *** ddieterly[away] is now known as ddieterly | 21:20 | |
| *** tonytan4ever has quit IRC | 21:21 | |
| *** edmondsw has quit IRC | 21:24 | |
| *** notmyname has quit IRC | 21:28 | |
| *** notmyname_ has joined #openstack-keystone | 21:28 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 21:29 |
| *** notmyname_ is now known as notmyname | 21:29 | |
| *** ayoung has quit IRC | 21:34 | |
| *** jefrite has quit IRC | 21:34 | |
| *** jefrite_ has joined #openstack-keystone | 21:36 | |
| *** hoonetorg has quit IRC | 21:45 | |
| *** KevinE_ has quit IRC | 21:45 | |
| *** BjoernT has quit IRC | 21:45 | |
| *** iurygregory has quit IRC | 21:45 | |
| *** mordred has quit IRC | 21:45 | |
| *** mkoderer__ has quit IRC | 21:45 | |
| *** ianw has quit IRC | 21:45 | |
| *** hogepodge has quit IRC | 21:45 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 21:46 |
| *** jamie_h has quit IRC | 21:47 | |
| *** RichardRaseley has quit IRC | 21:48 | |
| *** roxanaghe has quit IRC | 21:49 | |
| *** sdake_ has joined #openstack-keystone | 21:53 | |
| *** sdake_ has quit IRC | 21:53 | |
| *** sdake_ has joined #openstack-keystone | 21:53 | |
| *** rvba has quit IRC | 21:55 | |
| *** iurygregory has joined #openstack-keystone | 22:01 | |
| *** catintheroof has joined #openstack-keystone | 22:03 | |
| *** ddieterly is now known as ddieterly[away] | 22:05 | |
| *** slberger has left #openstack-keystone | 22:15 | |
| *** julim has joined #openstack-keystone | 22:16 | |
| notmorgan | stevemar: this sounds like a case where we should include error codes | 22:17 |
| notmorgan | something that can clearly communicate things like "bad domain data" where it still needs to say unauthorized | 22:17 |
| notmorgan | or erm not bad domain data, invalid domain name - may not contain special characters | 22:18 |
| notmorgan | or whatever | 22:18 |
| notmorgan | but we don't want to expose all the debug info in our exceptions... | 22:18 |
| notmorgan | so maybe a consistent error code included with the HTTP status? | 22:18 |
| notmorgan | and we can publish what they are? or we could just include debug_msg and non-debug in things like unauthorized | 22:19 |
| notmorgan | for where we need to communicate things like "this request included an invalid-format for domain name" | 22:19 |
| *** henrynash has joined #openstack-keystone | 22:21 | |
| *** ChanServ sets mode: +v henrynash | 22:21 | |
| *** mordred has joined #openstack-keystone | 22:22 | |
| *** ntpttr has quit IRC | 22:31 | |
| *** ntpttr has joined #openstack-keystone | 22:31 | |
| *** sdake_ has quit IRC | 22:33 | |
| *** ddieterly[away] is now known as ddieterly | 22:36 | |
| *** jamielennox|away is now known as jamielennox | 22:37 | |
| *** roxanaghe has joined #openstack-keystone | 22:38 | |
| *** rderose has quit IRC | 22:44 | |
| *** aloga_ has quit IRC | 22:49 | |
| *** dan_nguyen has joined #openstack-keystone | 22:53 | |
| *** tqtran has quit IRC | 22:59 | |
| *** KevinE has joined #openstack-keystone | 23:00 | |
| *** ddieterly is now known as ddieterly[away] | 23:02 | |
| *** ddieterly[away] has quit IRC | 23:02 | |
| *** tqtran has joined #openstack-keystone | 23:03 | |
| *** darosale has quit IRC | 23:05 | |
| *** tqtran_ has joined #openstack-keystone | 23:07 | |
| *** tqtran has quit IRC | 23:07 | |
| *** ayoung has joined #openstack-keystone | 23:09 | |
| *** ChanServ sets mode: +v ayoung | 23:09 | |
| *** KevinE has quit IRC | 23:10 | |
| *** sdake has joined #openstack-keystone | 23:11 | |
| *** sdake has quit IRC | 23:11 | |
| *** catintheroof has quit IRC | 23:18 | |
| *** jbell8 has joined #openstack-keystone | 23:20 | |
| *** jsavak has quit IRC | 23:21 | |
| *** markvoelker has quit IRC | 23:21 | |
| *** tqtran has joined #openstack-keystone | 23:22 | |
| *** tqtran_ has quit IRC | 23:24 | |
| *** tqtran_ has joined #openstack-keystone | 23:27 | |
| *** EinstCrazy has joined #openstack-keystone | 23:28 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Adds password_expires_at to API docs https://review.openstack.org/336318 | 23:29 |
| *** tqtran has quit IRC | 23:29 | |
| *** fangxu has quit IRC | 23:29 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password expires validation https://review.openstack.org/333360 | 23:31 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Adds password_expires_at to API docs https://review.openstack.org/336318 | 23:31 |
| *** rderose has joined #openstack-keystone | 23:33 | |
| *** EinstCrazy has quit IRC | 23:33 | |
| *** jbell8 has quit IRC | 23:35 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add create_plugin to loader https://review.openstack.org/333119 | 23:37 |
| *** rderose has quit IRC | 23:42 | |
| *** BjoernT has joined #openstack-keystone | 23:44 | |
| *** bjornar_ has quit IRC | 23:49 | |
| *** BjoernT has quit IRC | 23:50 | |
| *** spandhe has quit IRC | 23:57 | |
| *** hogepodge has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
