| *** diazjf has joined #openstack-keystone | 01:13 | |
| *** spzala has joined #openstack-keystone | 01:23 | |
| *** spzala has quit IRC | 01:28 | |
| *** itisha has quit IRC | 01:29 | |
| *** diazjf has quit IRC | 02:57 | |
| *** diazjf has joined #openstack-keystone | 03:03 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Invalid parameter name on interface https://review.openstack.org/399870 | 03:25 |
|---|---|---|
| *** tqtran has joined #openstack-keystone | 03:25 | |
| *** tqtran has quit IRC | 03:30 | |
| *** diazjf has quit IRC | 03:46 | |
| *** dave-mccowan has joined #openstack-keystone | 03:47 | |
| *** dave-mccowan has quit IRC | 03:52 | |
| *** kiran-r has joined #openstack-keystone | 04:34 | |
| *** spzala has joined #openstack-keystone | 05:24 | |
| *** spzala has quit IRC | 05:28 | |
| *** GB21 has joined #openstack-keystone | 06:02 | |
| masber | hi | 06:17 |
| masber | how can I get the keystone token? | 06:17 |
| masber | ?? | 06:33 |
| *** richm has quit IRC | 06:41 | |
| *** maestropandy has joined #openstack-keystone | 06:54 | |
| *** maestropandy has left #openstack-keystone | 06:54 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enable CADF notification format by default https://review.openstack.org/397339 | 06:58 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: refactor notification test to work with either format https://review.openstack.org/399937 | 06:58 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Swap the notification formats in the docs https://review.openstack.org/399938 | 06:58 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: refactor notification test to work with either format https://review.openstack.org/399937 | 06:59 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enable CADF notification format by default https://review.openstack.org/397339 | 06:59 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enable CADF notification format by default https://review.openstack.org/397339 | 07:00 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Swap the notification formats in the docs https://review.openstack.org/399938 | 07:00 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Swap the notification formats in the docs https://review.openstack.org/399938 | 07:01 |
| *** maestropandy1 has joined #openstack-keystone | 07:11 | |
| *** maestropandy1 has left #openstack-keystone | 07:11 | |
| *** tqtran has joined #openstack-keystone | 07:27 | |
| *** bknudson has quit IRC | 07:31 | |
| *** tqtran has quit IRC | 07:31 | |
| openstackgerrit | Merged openstack/keystone: Use issue_v3_token instead of issue_v2_token https://review.openstack.org/386665 | 07:56 |
| openstackgerrit | Merged openstack/keystone: refactor the token controller https://review.openstack.org/386726 | 07:56 |
| *** spzala has joined #openstack-keystone | 08:24 | |
| openstackgerrit | Merged openstack/keystone: Remove issue_v2_token https://review.openstack.org/386762 | 08:25 |
| openstackgerrit | Merged openstack/keystone: Remove issue_v3_token in favor of issue_token https://review.openstack.org/386837 | 08:25 |
| *** spzala has quit IRC | 08:28 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** maestropandy has joined #openstack-keystone | 09:42 | |
| *** maestropandy has left #openstack-keystone | 09:50 | |
| *** maestropandy1 has joined #openstack-keystone | 09:58 | |
| *** maestropandy1 has left #openstack-keystone | 09:58 | |
| *** kumar has joined #openstack-keystone | 10:54 | |
| kumar | hi | 10:54 |
| kumar | I am trying to use keystone client v2 to validate user token and also to get tenant information | 10:54 |
| kumar | i am using service user to do that | 10:55 |
| kumar | If I am using client.tokens.validate(user_token) | 10:56 |
| kumar | it gives me this error | 10:56 |
| kumar | keystoneauth1.exceptions.catalog.EndpointNotFound: Endpoint for identity service | 10:56 |
| kumar | if I do client.get_raw_token_from_identity_service(auth_url=endpoint, token=user_token) I get token information but no tenant data | 10:57 |
| kumar | can I get some help here | 10:57 |
| breton | kumar: have you run keystone-manage bootstrap? | 10:58 |
| kumar | what is the best way to get tenat info | 10:58 |
| kumar | I have a devstack env which is running | 10:58 |
| kumar | I am trying to connect to that | 10:58 |
| kumar | +breton: I have a running keystone in devstack | 11:00 |
| kumar | I have not given keystone-manage bootstrap explicitly | 11:00 |
| *** richm has joined #openstack-keystone | 11:09 | |
| *** maestropandy has joined #openstack-keystone | 11:13 | |
| *** maestropandy has left #openstack-keystone | 11:13 | |
| *** maestropandy1 has joined #openstack-keystone | 11:16 | |
| *** maestropandy1 has left #openstack-keystone | 11:16 | |
| *** tqtran has joined #openstack-keystone | 11:28 | |
| *** tqtran has quit IRC | 11:33 | |
| *** kiran-r has quit IRC | 11:39 | |
| openstackgerrit | Merged openstack/keystone: Remove format_token method https://review.openstack.org/389364 | 12:05 |
| *** kumar has quit IRC | 12:11 | |
| *** david-lyle has joined #openstack-keystone | 12:12 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Enable bootstrapping keystone with identity LDAP backend https://review.openstack.org/395967 | 12:13 |
| *** david-lyle has quit IRC | 12:17 | |
| *** GB21 has quit IRC | 12:18 | |
| *** nicolasbock has joined #openstack-keystone | 12:19 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Enable bootstrapping keystone with identity LDAP backend https://review.openstack.org/395967 | 12:28 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove metadata from token provider https://review.openstack.org/389365 | 12:44 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Clarify the v2.0 validation path https://review.openstack.org/389366 | 12:44 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: refactor notification test to work with either format https://review.openstack.org/399937 | 12:46 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enable CADF notification format by default https://review.openstack.org/397339 | 12:46 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Swap the notification formats in the docs https://review.openstack.org/399938 | 12:46 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Swap the notification formats in the docs https://review.openstack.org/399938 | 12:47 |
| *** whycoin has joined #openstack-keystone | 13:02 | |
| *** whycoin has quit IRC | 13:04 | |
| *** nicolasbock has quit IRC | 13:17 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Pass allow_expired to token validate https://review.openstack.org/382099 | 13:27 |
| *** david-lyle has joined #openstack-keystone | 14:14 | |
| *** david-lyle has quit IRC | 14:18 | |
| *** maestropandy has joined #openstack-keystone | 14:19 | |
| openstackgerrit | Merged openstack/keystone-specs: Add spec for native SAML2 https://review.openstack.org/397860 | 14:25 |
| *** maestropandy has left #openstack-keystone | 14:48 | |
| openstackgerrit | Merged openstack/keystone: Remove metadata from token provider https://review.openstack.org/389365 | 15:14 |
| openstackgerrit | Merged openstack/keystone: Clarify the v2.0 validation path https://review.openstack.org/389366 | 15:14 |
| *** spzala has joined #openstack-keystone | 15:26 | |
| *** tqtran has joined #openstack-keystone | 15:30 | |
| *** tqtran has quit IRC | 15:35 | |
| *** GB21 has joined #openstack-keystone | 15:44 | |
| *** jrist has quit IRC | 16:19 | |
| *** jrist has joined #openstack-keystone | 16:20 | |
| *** diazjf has joined #openstack-keystone | 16:27 | |
| *** GB21 has quit IRC | 16:35 | |
| *** maestropandy has joined #openstack-keystone | 17:06 | |
| *** maestropandy has left #openstack-keystone | 17:07 | |
| *** stream10 has joined #openstack-keystone | 17:37 | |
| openstackgerrit | Merged openstack/keystone: Devstack plugin to federate with testshib.org https://review.openstack.org/393932 | 17:46 |
| *** diazjf has quit IRC | 17:52 | |
| *** mkoderer__ has quit IRC | 17:55 | |
| *** timss has quit IRC | 17:55 | |
| *** mkoderer__ has joined #openstack-keystone | 17:56 | |
| *** timss has joined #openstack-keystone | 17:56 | |
| *** maestropandy has joined #openstack-keystone | 17:58 | |
| *** maestropandy has left #openstack-keystone | 17:58 | |
| *** david-lyle has joined #openstack-keystone | 18:11 | |
| *** stream10 has quit IRC | 18:16 | |
| *** stream10 has joined #openstack-keystone | 18:25 | |
| *** gagehugo has quit IRC | 18:29 | |
| *** phalmos has joined #openstack-keystone | 18:32 | |
| *** hogepodge has quit IRC | 18:34 | |
| *** gagehugo has joined #openstack-keystone | 18:43 | |
| *** phalmos has quit IRC | 18:48 | |
| *** spzala has quit IRC | 18:51 | |
| *** diazjf has joined #openstack-keystone | 19:05 | |
| *** tqtran has joined #openstack-keystone | 19:32 | |
| *** tqtran has quit IRC | 19:36 | |
| *** dave-mccowan has joined #openstack-keystone | 19:42 | |
| *** dave-mccowan has quit IRC | 20:08 | |
| *** stream10 has quit IRC | 20:20 | |
| *** hogepodge has joined #openstack-keystone | 20:22 | |
| *** hogepodge has quit IRC | 20:22 | |
| *** hogepodge has joined #openstack-keystone | 20:24 | |
| *** spzala has joined #openstack-keystone | 20:40 | |
| *** dave-mccowan has joined #openstack-keystone | 20:46 | |
| *** adriant has joined #openstack-keystone | 20:55 | |
| *** d0ugal has quit IRC | 21:12 | |
| *** jamielennox|away is now known as jamielennox | 21:15 | |
| *** spzala has quit IRC | 21:22 | |
| *** d0ugal has joined #openstack-keystone | 21:28 | |
| *** g2 is now known as g2[falcs1] | 21:34 | |
| masber | hi | 21:40 |
| *** g2[falcs1] is now known as g2[sea] | 21:40 | |
| *** g2[sea] is now known as g2[Sea] | 21:40 | |
| masber | I am using rest api to get my tokens but they expire after 1 hour, is there a way to get a token without expiration date? | 21:41 |
| masber | or at least get expiration date of 5 years or something like that? | 21:42 |
| *** dave-mccowan has quit IRC | 21:59 | |
| *** spzala has joined #openstack-keystone | 22:21 | |
| breton | masber: why would you want that? | 22:43 |
| breton | masber: if you really-really want this, set keystone.conf:[token]expiration | 22:44 |
| breton | masber: bu we are trying to make the expiration shorter, not longer | 22:45 |
| adriant | masber: Are you trying to use the token as a service API token akin to the EC2 access keys? | 22:45 |
| adriant | masber: the keystone tokens are effectively a "authenticated session", so they should be short for security purposes, and because with fernet they also expire when the fernet encrypt keys change. :( | 22:46 |
| adriant | breton: Actually that's a thought, the conf setting for token expiry is effectively superseded by how often you create new fernet keys. | 22:48 |
| adriant | That's perfectly fine, just makes the conf setting less important in some ways. | 22:48 |
| masber | breton, I am trying to setup grafana to collect logs from gnocchi | 22:56 |
| masber | and I am using token for authentication | 22:56 |
| masber | but I am happy to hear about best practices | 22:58 |
| adriant | masber: the approach that all the current python libraries tend to take is that given a username and password, they will fetch a token, and do things. Once that token expires, they will automatically get a new one. | 22:59 |
| adriant | This is mostly handled in the Keystoneauth library which they all use. | 22:59 |
| adriant | If you are using the rest API directly, you'd need to handle that logic yourself. | 22:59 |
| adriant | Store username/password, get token, do stuff, token expires, catch error, get new token, do more stuff, repeat. | 23:00 |
| masber | ok, then best is to put username and password right? | 23:00 |
| adriant | That might work too, but ideally you'd only use the username/pass to fetch tokens, and only update your token when it expires. | 23:02 |
| adriant | Because otherwise the gnocchi api will authenticate you against keystone every time and create a new token for every api call. | 23:02 |
| breton | adriant: creating a new fernet token doesn't destroy the old one | 23:02 |
| breton | adriant: oh, keys | 23:03 |
| adriant | breton: I know, I mean the encrypt keys | 23:03 |
| breton | adriant: misread you, sorry | 23:03 |
| adriant | breton: ah, yeah :) | 23:03 |
| adriant | breton: new keys is basically the same as doing a table truncate for the token table when using UUID or PKI | 23:04 |
| *** catintheroof has joined #openstack-keystone | 23:08 | |
| masber | what is the difference between a token and a key? | 23:12 |
| adriant | masber: a token is an authorised session basically. It represents a set of privileges you have for a given period of time. As for a key, well if you mean the EC2 access keys, then that's really just another username/password combo really but unique to the EC2 APIs. | 23:20 |
| adriant | If that makes sense... | 23:20 |
| masber | adriant, yes that makes totally sense, thank you! | 23:20 |
| *** tqtran has joined #openstack-keystone | 23:33 | |
| *** tqtran has quit IRC | 23:37 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone-specs: User self management of TOTP credentials https://review.openstack.org/345705 | 23:42 |
| *** catintheroof has quit IRC | 23:49 | |
| *** catintheroof has joined #openstack-keystone | 23:50 | |
| *** catintheroof has quit IRC | 23:55 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: move content from configuringservices to configuration https://review.openstack.org/399787 | 23:57 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move docs from key_terms to architecture https://review.openstack.org/399760 | 23:58 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove extension and auth_token middleware docs https://review.openstack.org/399767 | 23:58 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: clean up developer docs https://review.openstack.org/399781 | 23:58 |
| *** alex_xu has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!