| *** ngupta has quit IRC | 00:02 | |
| *** ngupta has joined #openstack-keystone | 00:03 | |
| *** ngupta has quit IRC | 00:07 | |
| *** asettle has joined #openstack-keystone | 00:08 | |
| *** asettle has quit IRC | 00:08 | |
| *** stingaci_ has quit IRC | 00:08 | |
| *** asettle has joined #openstack-keystone | 00:08 | |
| *** asettle has quit IRC | 00:09 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to immediately change their password upon first use https://review.openstack.org/403916 | 00:10 |
|---|---|---|
| *** asettle has joined #openstack-keystone | 00:19 | |
| *** asettle has quit IRC | 00:23 | |
| *** lamt has quit IRC | 00:35 | |
| stevemar | jamielennox: py35 error is legit | 00:51 |
| jamielennox | damin | 00:51 |
| *** stingaci has joined #openstack-keystone | 00:55 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Pass ?allow_expired https://review.openstack.org/382100 | 00:55 |
| jamielennox | i didn't even know log.warn was being deprecated, doesn't seem fair | 00:56 |
| *** jamielennox is now known as jamielennox|away | 00:58 | |
| *** tqtran has quit IRC | 00:58 | |
| *** Marcellin__ has quit IRC | 00:59 | |
| *** jamielennox|away is now known as jamielennox | 01:00 | |
| stevemar | jamielennox: rel note clean up, looks good otherwise | 01:02 |
| stevemar | jamielennox: also dooooooooooooooooocs | 01:02 |
| stevemar | :) | 01:02 |
| stevemar | jamielennox: but they can be done later | 01:02 |
| * jamielennox grumbles | 01:03 | |
| *** chrisplo_ has quit IRC | 01:05 | |
| *** guoshan has joined #openstack-keystone | 01:22 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Pass ?allow_expired https://review.openstack.org/382100 | 01:22 |
| jamielennox | not sure what's going on with my releasenotes job, i can't see the difference | 01:22 |
| *** guoshan has quit IRC | 01:26 | |
| *** stingaci_ has joined #openstack-keystone | 01:26 | |
| *** zhangjl has joined #openstack-keystone | 01:28 | |
| *** stingaci has quit IRC | 01:29 | |
| *** stingaci_ has quit IRC | 01:36 | |
| *** guoshan has joined #openstack-keystone | 01:36 | |
| *** liujiong has joined #openstack-keystone | 01:44 | |
| *** stingaci has joined #openstack-keystone | 01:50 | |
| *** stingaci has quit IRC | 01:51 | |
| *** stingaci has joined #openstack-keystone | 01:51 | |
| *** adrian_otto has quit IRC | 01:54 | |
| *** pleia2 has left #openstack-keystone | 01:56 | |
| *** masuberu has joined #openstack-keystone | 02:00 | |
| *** masber has quit IRC | 02:03 | |
| *** masber has joined #openstack-keystone | 02:04 | |
| *** diazjf has joined #openstack-keystone | 02:05 | |
| *** masuberu has quit IRC | 02:05 | |
| *** nicolasbock has quit IRC | 02:05 | |
| *** nicolasbock has joined #openstack-keystone | 02:06 | |
| *** diazjf has quit IRC | 02:19 | |
| *** browne has quit IRC | 02:19 | |
| *** stingaci has quit IRC | 02:21 | |
| *** stingaci has joined #openstack-keystone | 02:21 | |
| *** stingaci_ has joined #openstack-keystone | 02:22 | |
| *** Matias has quit IRC | 02:22 | |
| *** diazjf has joined #openstack-keystone | 02:25 | |
| *** Matias has joined #openstack-keystone | 02:25 | |
| *** stingaci has quit IRC | 02:25 | |
| *** stingaci_ has quit IRC | 02:27 | |
| stevemar | jamielennox: relnotes look good | 02:30 |
| stevemar | jamielennox: the dang docs job has been weird | 02:30 |
| *** ngupta has joined #openstack-keystone | 02:30 | |
| *** diazjf has quit IRC | 02:31 | |
| stevemar | jamielennox: looks recent | 02:32 |
| *** jamielennox is now known as jamielennox|away | 02:36 | |
| *** jamielennox|away is now known as jamielennox | 02:51 | |
| *** dave-mccowan has joined #openstack-keystone | 02:54 | |
| *** tqtran has joined #openstack-keystone | 02:59 | |
| *** harlowja has quit IRC | 03:03 | |
| *** tqtran has quit IRC | 03:03 | |
| *** browne has joined #openstack-keystone | 03:09 | |
| *** browne has quit IRC | 03:11 | |
| *** asettle has joined #openstack-keystone | 03:12 | |
| *** zhangjl has left #openstack-keystone | 03:13 | |
| *** chrisplo_ has joined #openstack-keystone | 03:14 | |
| *** asettle has quit IRC | 03:17 | |
| *** chrisplo_ has quit IRC | 03:18 | |
| *** Zer0Byte__ has quit IRC | 03:19 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: WIP implementation for password requirements API https://review.openstack.org/410516 | 03:32 |
| *** dave-mccowan has quit IRC | 03:34 | |
| *** r-daneel has quit IRC | 03:38 | |
| *** markvoelker has quit IRC | 03:49 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/411081 | 03:55 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/373686 | 03:55 |
| *** ngupta has quit IRC | 03:57 | |
| *** ngupta has joined #openstack-keystone | 03:57 | |
| *** adrian_otto has joined #openstack-keystone | 04:01 | |
| *** ngupta has quit IRC | 04:02 | |
| *** links has joined #openstack-keystone | 04:06 | |
| *** adrian_otto has quit IRC | 04:13 | |
| *** dikonoor has joined #openstack-keystone | 04:13 | |
| *** nicolasbock has quit IRC | 04:17 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: clean up a few doc building warnings https://review.openstack.org/411061 | 04:31 |
| stevemar | jamielennox: i have no idea whats going on with the doc build for ksm | 04:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make _option_dict() a method for domain_config_api https://review.openstack.org/411100 | 04:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove impossible case from _option_dict method https://review.openstack.org/411101 | 04:33 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: clean up a few doc building warnings https://review.openstack.org/411061 | 04:33 |
| openstackgerrit | Merged openstack/keystone: Add unit tests for doctor tokens symptoms https://review.openstack.org/410964 | 04:34 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: clean up a few doc building warnings https://review.openstack.org/411061 | 04:35 |
| *** markvoelker has joined #openstack-keystone | 04:51 | |
| *** markvoelker has quit IRC | 04:55 | |
| *** adrian_otto has joined #openstack-keystone | 04:56 | |
| *** tqtran has joined #openstack-keystone | 05:00 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement password requirements API https://review.openstack.org/410515 | 05:00 |
| *** tqtran has quit IRC | 05:04 | |
| rderose | lbragstad ^ ++ | 05:06 |
| lbragstad | rderose o/ | 05:07 |
| *** diazjf has joined #openstack-keystone | 05:07 | |
| rderose | lbragstad: nice suite of tests for this :) | 05:07 |
| lbragstad | rderose thanks! | 05:07 |
| lbragstad | 70 lines of implementation and 478 lines of tests ;) | 05:07 |
| lbragstad | that's my kinda change | 05:07 |
| rderose | lbragstad: haha, oh yeah! | 05:08 |
| stevemar | lbragstad: make sure you reference https://blueprints.launchpad.net/keystone/+spec/pci-dss-password-requirements-api ;) | 05:09 |
| *** diazjf has quit IRC | 05:09 | |
| lbragstad | stevemar didn't i? https://review.openstack.org/#/c/410515/4//COMMIT_MSG | 05:10 |
| stevemar | lbragstad: you did! my bad | 05:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement password requirements API https://review.openstack.org/410515 | 05:12 |
| stevemar | hey breton_ whats up with https://blueprints.launchpad.net/keystone/+spec/fernet-key-store -- is it happening? | 05:12 |
| lbragstad | alrighty - signing off for a bit | 05:17 |
| lbragstad | catch all you cool cats tomorrow | 05:17 |
| *** guoshan has quit IRC | 05:19 | |
| *** dhellmann has quit IRC | 05:39 | |
| *** dhellmann has joined #openstack-keystone | 05:39 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Fix a typo in comment https://review.openstack.org/411119 | 05:50 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add unit tests for doctor token_fernet symptoms https://review.openstack.org/410926 | 05:53 |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/411081 | 05:56 |
| *** udesale has joined #openstack-keystone | 06:00 | |
| *** guoshan has joined #openstack-keystone | 06:01 | |
| *** trananhkma has joined #openstack-keystone | 06:06 | |
| *** jaosorior has joined #openstack-keystone | 06:16 | |
| *** liujiong has quit IRC | 06:25 | |
| *** liujiong has joined #openstack-keystone | 06:26 | |
| *** adrian_otto has quit IRC | 06:39 | |
| *** richm has quit IRC | 06:41 | |
| *** narasimha_SV has joined #openstack-keystone | 06:41 | |
| *** adrian_otto has joined #openstack-keystone | 06:42 | |
| *** namnh has joined #openstack-keystone | 06:43 | |
| *** adriant has quit IRC | 06:50 | |
| *** markvoelker has joined #openstack-keystone | 06:51 | |
| *** markvoelker has quit IRC | 06:56 | |
| *** ngupta has joined #openstack-keystone | 06:58 | |
| *** adrian_otto has quit IRC | 06:58 | |
| *** AJaeger has joined #openstack-keystone | 07:01 | |
| *** tqtran has joined #openstack-keystone | 07:02 | |
| AJaeger | keystone cores, stevemar pointed out to me that keystonemiddleware fails to build. | 07:02 |
| AJaeger | I suggest to use constraints for it in tox.ini, see http://lists.openstack.org/pipermail/openstack-dev/2016-December/108742.html | 07:02 |
| *** ngupta has quit IRC | 07:02 | |
| *** tqtran has quit IRC | 07:06 | |
| *** rcernin has joined #openstack-keystone | 07:13 | |
| *** tobberydberg has joined #openstack-keystone | 07:15 | |
| gagehugo | stevemar: can confirm that setting docutils =! 0.13.1 fixes the issue with keystonemiddleware | 07:19 |
| openstackgerrit | Gage Hugo proposed openstack/keystonemiddleware: Add docutils contraint on 0.13.1 to fix building https://review.openstack.org/411142 | 07:22 |
| AJaeger | gagehugo: best would be to use constraints completely to avoid such situations in the future | 07:26 |
| gagehugo | AJaeger: yeah that would probably be a good idea, thanks for the link | 07:35 |
| *** liujiong_66 has joined #openstack-keystone | 07:36 | |
| AJaeger | gagehugo: keystone has constraints already enabled | 07:36 |
| *** jaosorior has quit IRC | 07:37 | |
| *** jaosorior has joined #openstack-keystone | 07:37 | |
| gagehugo | yeah it looks like the issue is exclusive to keystonemiddleware? | 07:38 |
| *** liujiong has quit IRC | 07:39 | |
| *** zhugaoxiao has quit IRC | 07:39 | |
| *** zhugaoxiao has joined #openstack-keystone | 07:39 | |
| *** gagehugo_ has joined #openstack-keystone | 07:42 | |
| openstackgerrit | Dirk Mueller proposed openstack/keystoneauth: Remove discover from test-requirements https://review.openstack.org/411153 | 07:48 |
| *** gagehugo_ has joined #openstack-keystone | 07:53 | |
| *** gagehugo_ has quit IRC | 07:53 | |
| AJaeger | gagehugo: might be exclusive to keystonemiddleware for keystone team ;) But it's more widespread, see the linked email | 07:53 |
| *** jaosorior has quit IRC | 07:55 | |
| breton_ | stevemar: hi, yes. I need to brush up https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bp/fernet-key-store (including -2 from ayoung_dadmode) | 08:02 |
| *** AJaeger has left #openstack-keystone | 08:07 | |
| *** oomichi has quit IRC | 08:23 | |
| *** oomichi has joined #openstack-keystone | 08:23 | |
| *** aloga has quit IRC | 08:25 | |
| *** aloga has joined #openstack-keystone | 08:25 | |
| *** zhangqiankun has joined #openstack-keystone | 08:26 | |
| *** jaosorior has joined #openstack-keystone | 08:30 | |
| *** pcaruana has joined #openstack-keystone | 08:37 | |
| *** GB21 has joined #openstack-keystone | 08:42 | |
| *** amoralej|off is now known as amoralej | 08:51 | |
| *** markvoelker has joined #openstack-keystone | 08:52 | |
| *** markvoelker has quit IRC | 08:58 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** tqtran has joined #openstack-keystone | 09:03 | |
| *** tqtran has quit IRC | 09:07 | |
| *** masber has quit IRC | 09:07 | |
| *** masber has joined #openstack-keystone | 09:08 | |
| *** __zouyee has joined #openstack-keystone | 09:08 | |
| *** __zouyee has quit IRC | 09:09 | |
| *** asettle has joined #openstack-keystone | 09:14 | |
| *** asettle has quit IRC | 09:19 | |
| *** masuberu has joined #openstack-keystone | 09:23 | |
| *** masber has quit IRC | 09:27 | |
| *** masber has joined #openstack-keystone | 09:33 | |
| *** masuberu has quit IRC | 09:36 | |
| *** masuberu has joined #openstack-keystone | 09:43 | |
| *** masber has quit IRC | 09:43 | |
| *** guoshan has quit IRC | 09:45 | |
| *** masber has joined #openstack-keystone | 09:46 | |
| *** masuberu has quit IRC | 09:49 | |
| *** zhugaoxiao has quit IRC | 09:50 | |
| *** zhugaoxiao has joined #openstack-keystone | 09:51 | |
| *** asettle has joined #openstack-keystone | 10:10 | |
| *** asettle has quit IRC | 10:10 | |
| *** asettle has joined #openstack-keystone | 10:11 | |
| jamielennox | gagehugo: thanks for fixing that, we had been discussing it earlier and hadnt seen that email | 10:12 |
| jamielennox | stevemar: i could probably just merge https://review.openstack.org/#/c/411142/ but i'll leave it for you tomorrow, can you recheck everything afterwards please? | 10:13 |
| *** jvarlamova has joined #openstack-keystone | 10:13 | |
| *** jvarlamova___ has quit IRC | 10:16 | |
| *** GB21 has quit IRC | 10:17 | |
| *** openstackgerrit has quit IRC | 10:18 | |
| *** liujiong_66 has quit IRC | 10:21 | |
| *** asettle__ has joined #openstack-keystone | 10:22 | |
| *** asettle has quit IRC | 10:25 | |
| *** edmondsw has joined #openstack-keystone | 10:48 | |
| *** GB21 has joined #openstack-keystone | 10:48 | |
| *** asettle__ is now known as asettle | 10:48 | |
| *** edmondsw has quit IRC | 10:52 | |
| *** markvoelker has joined #openstack-keystone | 10:54 | |
| *** zhangqiankun has quit IRC | 10:55 | |
| *** zhangqiankun has joined #openstack-keystone | 10:55 | |
| *** markvoelker has quit IRC | 10:59 | |
| *** narasimha_SV has quit IRC | 11:05 | |
| *** richm has joined #openstack-keystone | 11:09 | |
| *** mvk has quit IRC | 11:22 | |
| *** namnh has quit IRC | 11:36 | |
| *** mvk has joined #openstack-keystone | 11:50 | |
| *** nicolasbock has joined #openstack-keystone | 12:04 | |
| *** masuberu has joined #openstack-keystone | 12:05 | |
| *** masber has quit IRC | 12:05 | |
| *** david-lyle has quit IRC | 12:05 | |
| *** david-lyle has joined #openstack-keystone | 12:05 | |
| *** BlackDex has quit IRC | 12:07 | |
| *** evrardjp has quit IRC | 12:08 | |
| *** BlackDex has joined #openstack-keystone | 12:09 | |
| *** evrardjp has joined #openstack-keystone | 12:13 | |
| *** udesale has quit IRC | 12:19 | |
| stevemar | jamielennox: https://review.openstack.org/#/c/411153/1 | 12:30 |
| stevemar | jamielennox: you could have solo-approved it, but it's cool | 12:31 |
| *** GB21 has quit IRC | 12:40 | |
| *** GB21 has joined #openstack-keystone | 12:41 | |
| *** Raildo has joined #openstack-keystone | 12:47 | |
| *** Raildo_ has joined #openstack-keystone | 12:47 | |
| *** Raildo_ is now known as raildo_ | 12:48 | |
| *** chlong has joined #openstack-keystone | 12:51 | |
| *** Raildo has quit IRC | 12:53 | |
| *** markvoelker has joined #openstack-keystone | 12:55 | |
| *** catintheroof has joined #openstack-keystone | 13:00 | |
| *** markvoelker has quit IRC | 13:00 | |
| *** catintheroof has quit IRC | 13:01 | |
| *** catintheroof has joined #openstack-keystone | 13:01 | |
| *** dave-mccowan has joined #openstack-keystone | 13:07 | |
| *** amoralej is now known as amoralej|lunch | 13:10 | |
| *** GB21 has quit IRC | 13:10 | |
| *** openstackgerrit has joined #openstack-keystone | 13:11 | |
| openstackgerrit | Merged openstack/keystone: Make _option_dict() a method for domain_config_api https://review.openstack.org/411100 | 13:11 |
| openstackgerrit | Merged openstack/keystone: Remove impossible case from _option_dict method https://review.openstack.org/411101 | 13:11 |
| stevemar | samueldmq: want to check https://review.openstack.org/#/c/410926/ too? | 13:13 |
| *** edmondsw has joined #openstack-keystone | 13:15 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: clean up a few doc building warnings https://review.openstack.org/411061 | 13:17 |
| *** edmondsw has quit IRC | 13:17 | |
| *** edmondsw has joined #openstack-keystone | 13:17 | |
| *** GB21 has joined #openstack-keystone | 13:17 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix a typo in comment https://review.openstack.org/411119 | 13:19 |
| *** SamYaple has quit IRC | 13:22 | |
| *** SamYaple has joined #openstack-keystone | 13:22 | |
| *** GB21 has quit IRC | 13:23 | |
| *** guoshan has joined #openstack-keystone | 13:25 | |
| *** links has quit IRC | 13:31 | |
| *** ayoung_dadmode is now known as ayoung | 13:32 | |
| ayoung | breton_, you understand my comments there? | 13:32 |
| openstackgerrit | Merged openstack/keystonemiddleware: Add docutils contraint on 0.13.1 to fix building https://review.openstack.org/411142 | 13:38 |
| *** GB21 has joined #openstack-keystone | 13:38 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: clean up a few doc building warnings https://review.openstack.org/411061 | 13:42 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/411062 | 13:42 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Pass ?allow_expired https://review.openstack.org/382100 | 13:42 |
| breton_ | ayoung: yes, but lets talk about them a little later this week or next | 13:42 |
| breton_ | ayoung: i am not sure why it is -2 and not -1 though, because we still need the manager for keystone to read keys | 13:42 |
| ayoung | breton_, not the right abstraction. | 13:43 |
| stevemar | anyone want to look at https://review.openstack.org/#/c/382100/ it's the last patch for allowing expired tokens to validate for services | 13:43 |
| breton_ | ayoung: what would be the right abstraction then? | 13:43 |
| ayoung | breton_, you want to discuss this now? I am game. | 13:43 |
| ayoung | With fernet, we defer a lot to python-cryptography | 13:44 |
| breton_ | ayoung: i have 15 minutes, so lets try | 13:44 |
| ayoung | we don't want to be in the business of defining things like keystore etc | 13:44 |
| ayoung | these are security sensitive areas, cross cutting concernts etc | 13:44 |
| ayoung | so We could have implemented even Fernet strictly in Keystone, but chose to work with the python-cryptography team instead | 13:45 |
| ayoung | its mostly the Barbican folks | 13:45 |
| ayoung | for a Keystore, it is the same kind of issue: | 13:45 |
| ayoung | ideally, it would be stored in some form of Hardened container | 13:45 |
| ayoung | but we don;t want to be defining that in Keystone, anymore than we would be writing a database | 13:46 |
| ayoung | so, lets assume that there is a keystore abstraction in python-cryptography, and we just need to have the configuration options in Keystone to say how to fine it, what type it is etc | 13:47 |
| ayoung | and then the rest goes into python-cryptography. | 13:47 |
| ayoung | breton_, we actually are addressing this issue at the platform level in my group: | 13:47 |
| ayoung | there is a system tool called custodia that we are developing for use cases like this. And remember, we are going to be talking containers and all that , so it is a pretty tricky omne to deal with | 13:48 |
| ayoung | breton_, https://github.com/latchset/custodia | 13:48 |
| ayoung | breton_, this is more than just Fernet and Credential encryption keys. It is all all the database passwords, MessageQ password, and any other sensitive values. | 13:49 |
| *** zhangqiankun has quit IRC | 13:50 | |
| ayoung | breton_, and we have lots of people that can help us with this, we don't have to do it all ourselves. | 13:50 |
| ayoung | So, we don't need the Manager abstraction inside Keystone, although the end state will look similar to an outsider, just it will use the python-cryptography abstraction, and keystone will only hold the configuration option for it. | 13:50 |
| ayoung | breton_, one other place this came up is for multi-keystone Fernet key exchange | 13:51 |
| ayoung | the fact that we built out own actually goes against one of the workflow constraints of Tripleo/Fuel/Kolla, which is that all the provisioning happens on the configuration nodes, and then gets pushed to all of the controllers equally | 13:52 |
| ayoung | there are lots of examples of prior art for how to do key exchanges in a secure manner and all that, but again, we don't want to write that into Keystone | 13:52 |
| ayoung | breton_, OK? | 13:53 |
| dstanek | ayoung: rolling your own is the best part of being a developer :-D | 13:53 |
| breton_ | ayoung: how ready is it? | 13:53 |
| ayoung | breton_, Custodia? | 13:54 |
| breton_ | ayoung: it and and its datastores | 13:54 |
| ayoung | breton_, Good question. It has been focused on other use cases, and makes some assumptions that may not hold true for us. | 13:54 |
| ayoung | There is also the whole "it was developed by Red Hat" aspect that means it is less tested on Debian based platforms | 13:55 |
| breton_ | ayoung: i pursue only 1 use case in the patches: rotation for keystone in docker containers | 13:55 |
| breton_ | *for fernet keys in docker containers | 13:55 |
| ayoung | breton_, I hope at least 2, as we need exactly that for Credentials as well | 13:56 |
| ayoung | which is the exact same mechanism for signing | 13:56 |
| breton_ | ayoung: well, actually no. dolphm had an idea to store fernet keys in the credentials database | 13:56 |
| ayoung | "One key to bind them all..." | 13:57 |
| breton_ | i understand that it's, hm, suboptimal | 13:58 |
| breton_ | but the keys for credentials are rotated not so often | 13:58 |
| ayoung | breton_, so, before I lift any -2, do your due dilligence. Go talk with the python cryptography folks. Look into Custodia, and also how docker/Kubernetes does secrets | 13:58 |
| ayoung | Ansible, too | 13:59 |
| ayoung | If it turns out that this is absolutly the only way, I will back off | 13:59 |
| ayoung | However, I suspect that the right approach is actually using some form of Key exchange protocol and a hardened datastore for the keys | 14:00 |
| ayoung | when you call the fernet function in python-cryptography, you should be passing in keystore. | 14:01 |
| breton_ | i don't need hardened datastore and i don't do the backends for security or distributing reasons | 14:01 |
| breton_ | but i got your point | 14:03 |
| breton_ | keystone should not do this job | 14:03 |
| breton_ | i know how k8s does secrets and there was a reason why i couldn't do it, let me check | 14:05 |
| *** tqtran has joined #openstack-keystone | 14:07 | |
| *** amoralej|lunch is now known as amoralej | 14:09 | |
| *** lamt has joined #openstack-keystone | 14:10 | |
| *** tqtran has quit IRC | 14:11 | |
| *** GB21 has quit IRC | 14:14 | |
| samueldmq | morning keystone | 14:14 |
| samueldmq | stevemar: hey, done | 14:14 |
| *** stingaci has joined #openstack-keystone | 14:14 | |
| *** stingaci has quit IRC | 14:19 | |
| *** chlong has quit IRC | 14:20 | |
| kukacz | hi, I would like to ask a implementation design question - we're running Kilo OpenStack with LDAP as the only Keystone backend | 14:22 |
| dstanek | hi samueldmq | 14:22 |
| dstanek | kukacz: fire away. hopefully someone here will know the answer | 14:22 |
| kukacz | dstanek: thanks :-) | 14:22 |
| kukacz | now it seems we'll need to move to use federation only, via SAML | 14:22 |
| *** chlong has joined #openstack-keystone | 14:22 | |
| kukacz | i do know nothing about that | 14:22 |
| kukacz | do I understand it so, that SAML is not only a SSO solution for web frontends, but it can also be used by API accesses? | 14:23 |
| samueldmq | dstanek: o/ | 14:23 |
| kukacz | I mean - does Keystone take the username+password from API call and attempt to authenticate it via SAML against the IDP? | 14:23 |
| dstanek | kukacz: what is your motivation to use fedeation of LDAP auth? | 14:24 |
| dstanek | kukacz: no, keystone doesn't touch a user's password during a SAML flow | 14:24 |
| dstanek | kukacz: you could still have your service users use username/password and have your users federate | 14:24 |
| dstanek | our commandline support for federation is a bit rough | 14:25 |
| kukacz | dstanek: thanks. motivation is to integrate tenants with their own identity sources | 14:26 |
| kukacz | kukacz: I wonder, how it works with CLI or direct API calls | 14:26 |
| *** chlong has quit IRC | 14:26 | |
| dstanek | kukacz: direct API calls to keystone? | 14:27 |
| kukacz | in LDAP I understand it takes the password and username and attempts to bind | 14:27 |
| kukacz | and maybe I'm wrong but am trying to compare the process to SAML | 14:27 |
| *** chlong has joined #openstack-keystone | 14:28 | |
| kukacz | dstanek: no, I mean when user sends whatever - eg. a nova boot command | 14:28 |
| dstanek | kukacz: the short, semi-technically accurate version of the flow is that when you want to get token you hit a special URL - it tells you where you IdP is - you go there to auth - upon success it give you an assertion to give to keystone | 14:28 |
| kukacz | dstanek: in the backend, it takes the username and password from some environment variables and passess them with the request to keystone | 14:28 |
| dstanek | kukacz: nova has no idea that the user authed via fedeation. it just get a token like normal | 14:29 |
| *** ngupta has joined #openstack-keystone | 14:29 | |
| kukacz | dstanek: sure, that part about nova and keystone tokens I understand. I just wished to give real life example | 14:29 |
| kukacz | what I don't understand is if there's still some password flow from the client to keystone | 14:30 |
| dstanek | kukacz: cli or horizon? | 14:30 |
| kukacz | CLI | 14:31 |
| rderose | rodrigods: any chance you can push this one through: https://review.openstack.org/#/c/409946/ | 14:32 |
| rderose | samueldmq: you around? | 14:32 |
| samueldmq | rderose: yes | 14:32 |
| dstanek | kukacz: i think i have a working example somewhere...let me look | 14:33 |
| rderose | samueldmq: I'm not following your "user.local_user.last_auth_at" *equals to* "user.password_ref.created_at" comment | 14:33 |
| rderose | samueldmq, | 14:33 |
| kukacz | dstanek: that would be great. thank you | 14:33 |
| samueldmq | rderose: why do we do 'user.local_user.last_auth_at > user.password_ref.created_at' ? | 14:33 |
| openstackgerrit | Merged openstack/keystone: Add checks for doctor credential symptoms https://review.openstack.org/409289 | 14:33 |
| rderose | samueldmq: lets say the user last_auth_at before a password admin reset | 14:34 |
| ayoung | ECP | 14:34 |
| rderose | so we're checking if they last authenticated after the password reset (first use) | 14:34 |
| samueldmq | rderose: admin reset == not user.password_ref.self_service | 14:34 |
| samueldmq | rderose: correct? | 14:35 |
| rderose | no | 14:35 |
| ayoung | kukacz, when doing saml for command line, make sure your IdP is set up for ECP | 14:35 |
| rderose | samueldmq: sorry, yes | 14:35 |
| samueldmq | rderose: kk | 14:35 |
| samueldmq | rderose: does "admin reset" reset user.password_ref.created_at ? | 14:36 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement password requirements API https://review.openstack.org/410515 | 14:36 |
| rderose | samueldmq: yes | 14:36 |
| samueldmq | rderose: and when the user first authenticates self_service becomes true | 14:37 |
| rderose | samueldmq: no | 14:37 |
| rderose | samueldmq: becomes self service when user change_password API | 14:38 |
| kukacz | ayoung: is it a difference for the user experience, to switch from SQL/LDAP backend to the federation like SAML? | 14:38 |
| ayoung | kukacz, should not be | 14:38 |
| ayoung | kukacz, the difference is in the configuration options you use when calling keystone. I have a sample file... | 14:39 |
| samueldmq | rderose: kk. so, if password was reset by admin and this is the first auth after that, require passwd change | 14:39 |
| samueldmq | rderose: makes sense | 14:39 |
| kukacz | ayoung: just for my understanding / practically - does anything change in the typical openrc/keystonerc file? | 14:39 |
| samueldmq | rderose: and by setting user_ref.password_ref.expires_at = now , the current flow will still return a valid token, right ? | 14:40 |
| ayoung | kukacz, the proof of concept we did last year had this http://paste.openstack.org/show/592490/ | 14:40 |
| rderose | samueldmq: yes, because it happens after auth | 14:40 |
| ayoung | the auth plugin might have a differenct value | 14:40 |
| samueldmq | rderose: that's not the token's expires, but the password that is expiring after now (single validation) | 14:40 |
| rderose | samueldmq: correct | 14:40 |
| samueldmq | rderose: perfect | 14:40 |
| samueldmq | rderose: neat, I just think that needs a release note then | 14:41 |
| samueldmq | rderose: makese sense to you ? | 14:41 |
| rderose | samueldmq: cool, on it | 14:41 |
| rderose | :) | 14:41 |
| samueldmq | rderose: perfect | 14:41 |
| kukacz | ayoung: great, these examples help me lot to move out of the fog | 14:41 |
| rderose | samueldmq: thanks | 14:41 |
| dstanek | kukacz: http://paste.openstack.org/show/592491/ i think works on a new sp using testshib | 14:41 |
| *** guoshan has quit IRC | 14:41 | |
| samueldmq | rderose: anytime :) | 14:41 |
| ayoung | kukacz, the pain points seems to be getting ECP set up on the SAML side | 14:41 |
| ayoung | what server software are you running there? | 14:41 |
| kukacz | dstanek: thanks! | 14:42 |
| dstanek | kukacz: ayoung: i actually don't know if it's possible to do that in a openrc or cloud.yaml file - that would be a good experiment | 14:42 |
| kukacz | ayoung: should be Dell One | 14:42 |
| kukacz | ayoung: that should do kind of concentration of multiple tenants' IDPs if I understand it correctly | 14:43 |
| ayoung | kukacz, I am unfamiliar with it, but see if it supports ECP. | 14:43 |
| kukacz | ayoung: I'll do | 14:43 |
| *** edtubill has joined #openstack-keystone | 14:44 | |
| kukacz | ayoung: it's a multitenant environment. theoretically we could accept diferent tenants with their identity sources | 14:44 |
| kukacz | kukacz: but to me it's really a very new area I just start exploring | 14:44 |
| *** markvoelker has joined #openstack-keystone | 14:45 | |
| *** edtubill has joined #openstack-keystone | 14:45 | |
| kukacz | ^^ayoung | 14:45 |
| *** ngupta has quit IRC | 14:46 | |
| dstanek | kukacz: are you doing a private cloud implemenation where everyone uses the same IdP? | 14:46 |
| *** ngupta has joined #openstack-keystone | 14:47 | |
| kukacz | dstanek: no. it's more kind of public cloud for multiple customers. just not exposed so publicly to call it "public cloud" | 14:47 |
| dstanek | kukacz: and each customer would potentially use a separate IdP? | 14:47 |
| kukacz | dstanek: yes. usually the customers are large organizations with own IdPs | 14:48 |
| dstanek | kukacz: one issue you may have is that we don't tie users from one IdP into a domain that is separate from another IdP. that work is happening in this cycle | 14:50 |
| dstanek | but depending on your needs that may not matter anyway | 14:50 |
| kukacz | dstanek: hmm, is it then correct to think we can bind each customer to a keystone domain having their own IdP? | 14:50 |
| dstanek | kukacz: you can certainly have multiple IdPs. The users all map back to the same domain. In general I don't think this is a big deal, but I wanted to mention it so you can keep it in mind as you experiment. | 14:52 |
| kukacz | dstanek: is it wrong to think of domain=IdP pairing? | 14:54 |
| ayoung | kukacz, it is not wrong...it is what I wanted from the start | 14:55 |
| ayoung | do we allow setting the domain ID from the mapping rderose ? | 14:55 |
| ayoung | that would be the first step, I think | 14:55 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to immediately change their password upon first use https://review.openstack.org/403916 | 14:56 |
| rderose | ayoung: no, not through the mapping | 14:56 |
| rderose | ayoung: if we did through the mapping, an idp could be associated to multiple domains | 14:57 |
| *** udesale has joined #openstack-keystone | 14:57 | |
| rderose | ayoung: because idp:protocols (1:many) | 14:57 |
| ayoung | rderose, yeah, I was pretty sure we couldn't today | 14:57 |
| dstanek | ayoung: nope, domain in the mapping is ignored | 14:59 |
| kukacz | ayoung: dstanek: ok, if I assume the customers' IdPs are concentrated on that Dell tool (is that even possible in SAML?) - then I would use 1 IdP = multiple domains, is that feasible? | 15:00 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to immediately change their password upon first use https://review.openstack.org/403916 | 15:00 |
| dstanek | rderose's work to fix the model would fix this issue | 15:00 |
| dstanek | kukacz: no, all federated users are in the same domain | 15:00 |
| *** links has joined #openstack-keystone | 15:01 | |
| rderose | kukacz: but you could create multiple IdPs with different endpoints | 15:02 |
| *** chlong has quit IRC | 15:03 | |
| *** phalmos has joined #openstack-keystone | 15:03 | |
| kukacz | rderose: what endpoints you mean? | 15:03 |
| dstanek | kukacz: basically you can have multiple IdPs | 15:04 |
| openstackgerrit | Merged openstack/keystone: Add unit tests for doctor token_fernet symptoms https://review.openstack.org/410926 | 15:05 |
| rderose | kukacz: exactly and you set the idp_sso_endpoint | 15:06 |
| rderose | kukacz: not sure if that solves your use case | 15:07 |
| kukacz | well, for some customers I also have the motivation to use an extra domain - I wonder what impact it has to identity protocol options | 15:08 |
| rderose | kukacz: so yeah, if you need multiple domains, you would setup multiple idps | 15:09 |
| kukacz | if all federated customers must use same domain, does it mean I'd need to use non-federated method (LDAP?) for those? | 15:09 |
| kukacz | rderose: ahh, ok then | 15:09 |
| kukacz | if I think of Mitaka release for such implementation - can I utilize the features we're discussing? | 15:10 |
| dstanek | kukacz: idp mapped to a particular domain? | 15:11 |
| kukacz | dstanek: yes | 15:11 |
| openstackgerrit | Merged openstack/keystone: Fix a typo in comment https://review.openstack.org/411119 | 15:11 |
| dstanek | kukacz: that's in development now - will be released this cycle | 15:12 |
| kukacz | and what's available in Mitaka then - 1 IDP to 1 domain? | 15:13 |
| kukacz | ... altogether | 15:13 |
| dstanek | kukacz: all IdPs map to one domain. rderose is working on fixing this. | 15:14 |
| kukacz | ok | 15:14 |
| kukacz | by IdPs you mean just SAML backends or everything, including LDAP? | 15:15 |
| dstanek | kukacz: if you are using LDAP as an identity backend we don't consider that federation. just the SAML stuff in your case. | 15:15 |
| kukacz | ... cause now I'm thinking of using SAML for single domain, and various LDAPs for other domains, where needed | 15:16 |
| kukacz | dstanek: so should be possible to use SAML and LDAP in such setup in Mitaka ? | 15:16 |
| *** mdavidson has quit IRC | 15:18 | |
| dstanek | kukacz: i would imagine in mitaka that you could have a bunch of domains using their own LDAP backend and use federation where you can group users together in a single domain | 15:18 |
| dstanek | you'll have to experiment a little | 15:18 |
| kukacz | dstanek: perfect | 15:18 |
| kukacz | now back to the user experience: do the API library openstack clients like Ansible (shade), or those Ruby based work smoothly with the SAML setups? | 15:21 |
| kukacz | I mean if there are some constraints I should take into account | 15:22 |
| dstanek | kukacz: last i looked support was rough at best | 15:23 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to notifications for PCI-DSS https://review.openstack.org/396752 | 15:24 |
| *** jaugustine has joined #openstack-keystone | 15:24 | |
| *** jaugustine has quit IRC | 15:24 | |
| *** jaugustine_ has joined #openstack-keystone | 15:24 | |
| *** jaugustine_ is now known as jaugustine | 15:25 | |
| kukacz | dstanek: any particular library on mind? | 15:25 |
| dstanek | kukacz: all of our official stuff. it was hard to get anything working | 15:25 |
| kukacz | dstanek: that sounds like I would rather avoid SAML when the customers request interoperability (between cloud provs.) and easy integration with various PaaS framewords | 15:28 |
| kukacz | frameworks | 15:28 |
| dstanek | kukacz: so addtionally we don't have a way to create projects/assignments at auth time. so you can auth to a cloud, but all that stuff has to be setup ahead of time | 15:32 |
| kukacz | dstanek: we can perhaps afford handle this kind of setup in customer onboarding process | 15:34 |
| kukacz | dstanek: the client side support seems to be the major concern for us now | 15:35 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement password requirements API https://review.openstack.org/410515 | 15:36 |
| stevemar | someone want to push https://review.openstack.org/#/c/411061/ through? | 15:37 |
| kukacz | dstanek: ayoung: rderose: thanks for your great support! | 15:37 |
| rderose | kukacz: ++ | 15:39 |
| lbragstad | stevemar https://review.openstack.org/#/c/410515/ was failing with pep8 stuff last night (shame on me for not running it locally) | 15:40 |
| lbragstad | but - that passes everything for me locally now | 15:40 |
| lbragstad | let me know if you want it broken up a bit more? | 15:40 |
| dstanek | kukacz: yw | 15:41 |
| openstackgerrit | David Stanek proposed openstack/keystone-specs: Versioned federation mappings https://review.openstack.org/411392 | 15:41 |
| *** GB21 has joined #openstack-keystone | 15:43 | |
| *** phalmos has quit IRC | 15:44 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Pass ?allow_expired https://review.openstack.org/382100 | 15:46 |
| *** tobberyd_ has joined #openstack-keystone | 15:47 | |
| *** tobberydberg has quit IRC | 15:50 | |
| *** tobberyd_ has quit IRC | 15:51 | |
| rderose | samueldmq: you still around? | 15:52 |
| stevemar | lbragstad: let me check it today | 15:53 |
| *** chris_hultin|AWA is now known as chris_hultin | 15:58 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/411062 | 16:01 |
| *** links has quit IRC | 16:04 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add doctor checks for ldap symptoms https://review.openstack.org/409292 | 16:04 |
| *** udesale has quit IRC | 16:05 | |
| *** dikonoor has quit IRC | 16:08 | |
| *** tqtran has joined #openstack-keystone | 16:08 | |
| *** chris_hultin is now known as chris_hultin|AWA | 16:10 | |
| *** chris_hultin|AWA is now known as chris_hultin | 16:10 | |
| *** tqtran has quit IRC | 16:12 | |
| *** dave-mccowan has quit IRC | 16:13 | |
| samueldmq | rderose: yes | 16:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Pass ?allow_expired https://review.openstack.org/382100 | 16:15 |
| samueldmq | brb | 16:15 |
| *** ayoung has quit IRC | 16:17 | |
| stevemar | edmondsw: thanks ^ | 16:17 |
| rderose | samueldmq: looks like I'll need a new patch for https://review.openstack.org/#/c/399684/ | 16:17 |
| edmondsw | stevemar np... looks good now | 16:19 |
| stevemar | we need another core to look at jamielennox's patch -- any takers for https://review.openstack.org/382100 ? breton_ ? | 16:20 |
| stevemar | edmondsw: we need docs for it | 16:21 |
| *** ravelar has joined #openstack-keystone | 16:22 | |
| *** Zer0Byte__ has joined #openstack-keystone | 16:25 | |
| *** Zer0Byte__ has quit IRC | 16:26 | |
| *** adrian_otto has joined #openstack-keystone | 16:28 | |
| *** dave-mccowan has joined #openstack-keystone | 16:29 | |
| *** phalmos has joined #openstack-keystone | 16:29 | |
| *** jaosorior has quit IRC | 16:30 | |
| *** jaosorior has joined #openstack-keystone | 16:31 | |
| *** itisha has joined #openstack-keystone | 16:31 | |
| stevemar | dolphm: ^ | 16:32 |
| dolphm | lbragstad: dstanek: ^^^ | 16:32 |
| dolphm | rderose: ravelar: ^^^^^ (that's on the OSIC roadmap) | 16:32 |
| dolphm | for nova live migrations | 16:33 |
| lbragstad | dolphm stevemar i'll look - stevemar i assume we'll cut a release for ksm after that? | 16:34 |
| rderose | dolphm: ? | 16:34 |
| rderose | in standup | 16:34 |
| *** rcernin has quit IRC | 16:34 | |
| lbragstad | dstanek rderose sounds like we have a todo to review - https://review.openstack.org/#/c/382100/ | 16:34 |
| stevemar | lbragstad: yes, it'll need a ksm release | 16:34 |
| lbragstad | stevemar are we waiting for anything else after the ?allow_expired stuff is merged? | 16:35 |
| stevemar | lbragstad: nope | 16:35 |
| stevemar | lbragstad: no rush, i would like to release today, but it can wait til monday *shrugs* | 16:35 |
| lbragstad | stevemar sweet - i'll get to that today then | 16:35 |
| stevemar | no releases on friday | 16:35 |
| lbragstad | stevemar i'll review it next then, and then review dstanek's spec | 16:36 |
| openstackgerrit | Merged openstack/keystonemiddleware: clean up a few doc building warnings https://review.openstack.org/411061 | 16:36 |
| *** GB21 has quit IRC | 16:38 | |
| *** jaosorior has quit IRC | 16:39 | |
| *** jaosorior has joined #openstack-keystone | 16:40 | |
| *** edmondsw has quit IRC | 16:40 | |
| *** edmondsw has joined #openstack-keystone | 16:41 | |
| *** pcaruana has quit IRC | 16:42 | |
| *** edmondsw has quit IRC | 16:45 | |
| *** edmondsw has joined #openstack-keystone | 16:47 | |
| *** diazjf has joined #openstack-keystone | 16:49 | |
| *** GB21 has joined #openstack-keystone | 16:51 | |
| *** edmondsw has quit IRC | 16:51 | |
| *** rcernin has joined #openstack-keystone | 16:54 | |
| samueldmq | rderose: why? because of 'that_you' ? | 16:57 |
| *** edmondsw has joined #openstack-keystone | 16:59 | |
| rderose | samueldmq: during the migration, I'm auto creating a new domain for each idp; using the idp_id as the name for the domain | 17:00 |
| rderose | samueldmq: problem is the name should be unique and there is a chance (unlikely, but possible) that an admin has already created a domain with that same name (idp_id) | 17:00 |
| samueldmq | rderose: "Federated domain for Identity Provider: " + idp_id ? | 17:01 |
| rderose | samueldmq: not the description, but the domain.name | 17:01 |
| samueldmq | rderose: which is just idp_id. | 17:02 |
| rderose | samueldmq: correct, but there may already be a domain with that name | 17:02 |
| rderose | like I said, unlikely, but possible | 17:02 |
| rderose | samueldmq: so for the domain name, I'll just use the domain id | 17:03 |
| rderose | samueldmq: the domain name needs to be unique | 17:03 |
| *** edmondsw has quit IRC | 17:03 | |
| rderose | samueldmq: make sense? | 17:03 |
| samueldmq | rderose: and how will you find the idp_id when binding that domain to federated users (in the followup patch)? | 17:04 |
| rderose | samueldmq: we capture the idp when the federated user auth, so if we have the idp_id, we'll have the domain_id | 17:05 |
| *** browne has joined #openstack-keystone | 17:05 | |
| rderose | samueldmq: I won't look in the domain table for the idp, I'll have the idp and just get the domain | 17:06 |
| samueldmq | rderose: kk | 17:06 |
| samueldmq | rderose: that makes sense to me. | 17:07 |
| rderose | samueldmq: and the description will still say something like "Auto generated Federated domain for IdP: idp_id" | 17:07 |
| rderose | samueldmq: cool | 17:07 |
| samueldmq | rderose: that works for me to do id == name | 17:07 |
| rderose | alright, thx | 17:07 |
| samueldmq | rderose: yes I like auto generated | 17:07 |
| samueldmq | sure | 17:07 |
| *** raildo_ has quit IRC | 17:11 | |
| *** edmondsw has joined #openstack-keystone | 17:13 | |
| dstanek | 1/b 24 | 17:16 |
| *** GB21 has quit IRC | 17:16 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 17:17 |
| *** edmondsw has quit IRC | 17:18 | |
| *** Zer0Byte__ has joined #openstack-keystone | 17:22 | |
| *** edmondsw has joined #openstack-keystone | 17:25 | |
| *** asettle has quit IRC | 17:27 | |
| *** raildo_ has joined #openstack-keystone | 17:29 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 17:29 |
| *** edmondsw has quit IRC | 17:30 | |
| *** tqtran has joined #openstack-keystone | 17:30 | |
| lbragstad | dstanek looks good - https://review.openstack.org/#/c/411392/1 | 17:34 |
| lbragstad | dstanek i had one grammar comment, but that was really it | 17:34 |
| *** catinthe_ has joined #openstack-keystone | 17:36 | |
| *** edmondsw has joined #openstack-keystone | 17:38 | |
| *** catintheroof has quit IRC | 17:38 | |
| *** edmondsw has quit IRC | 17:42 | |
| *** jaosorior has quit IRC | 17:44 | |
| *** edmondsw has joined #openstack-keystone | 17:44 | |
| *** mvk has quit IRC | 17:45 | |
| *** asettle__ has joined #openstack-keystone | 17:49 | |
| dstanek | lbragstad: cool. wanted to make sure it was inline with what we have been talking about | 17:56 |
| *** asettle__ has quit IRC | 17:56 | |
| lbragstad | dstanek yeah - it works for me | 17:56 |
| lbragstad | dstanek well written, too | 17:56 |
| lbragstad | dstanek i don't think it should collide at all with the stuff i'm working on | 17:56 |
| dstanek | lbragstad: thx. yeah, i don't either | 17:57 |
| lbragstad | jamielennox nice work on https://review.openstack.org/#/c/382100/9 | 17:58 |
| dstanek | lbragstad: jamielennox: ++ | 17:58 |
| *** dikonoor has joined #openstack-keystone | 18:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement password requirements API https://review.openstack.org/410515 | 18:08 |
| lbragstad | dolphm looks like https://review.openstack.org/#/c/408837/4 and https://review.openstack.org/#/c/408838/5 are both passing stable/mitaka | 18:11 |
| *** ngupta has quit IRC | 18:11 | |
| *** ngupta has joined #openstack-keystone | 18:12 | |
| *** ngupta_ has joined #openstack-keystone | 18:13 | |
| *** chlong has joined #openstack-keystone | 18:14 | |
| *** ngupta has quit IRC | 18:16 | |
| *** asettle__ has joined #openstack-keystone | 18:17 | |
| *** diazjf has quit IRC | 18:23 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement password requirements API https://review.openstack.org/410515 | 18:27 |
| *** amoralej is now known as amoralej|off | 18:27 | |
| *** asettle__ has quit IRC | 18:27 | |
| *** pabelanger has joined #openstack-keystone | 18:28 | |
| pabelanger | greetings, noob question. Is keystone smart enough to start, if keystone.conf is missing? Eg: are their sane defaults that get applied? | 18:29 |
| pabelanger | there* | 18:29 |
| *** harlowja has joined #openstack-keystone | 18:31 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds role mapping to the mapping engine https://review.openstack.org/410949 | 18:32 |
| lbragstad | stevemar does the install guide not recommend using apache? | 18:33 |
| dstanek | lbragstad: rderose: i think that's working now, but i want to wait until you get further in your implementation where it's needed to work on getting it merged ^ | 18:33 |
| dstanek | pabelanger: i've never tried, but i can't imagine it will work without setting up a db or ldap connection at a minimum | 18:34 |
| rderose | dstanek: okay, cool | 18:35 |
| dstanek | rderose: you can probably build your patch on top of it to make sure it all works | 18:36 |
| *** asettle__ has joined #openstack-keystone | 18:36 | |
| lbragstad | dstanek i'll probably start by putting my stuff on there, too | 18:36 |
| lbragstad | stevemar i'm reading up on https://etherpad.openstack.org/p/community-goals and noticed your comment | 18:37 |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 18:38 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds role mapping to the mapping engine https://review.openstack.org/410949 | 18:41 |
| rderose | dstanek: reading the mapping version spec now, I see the need for this, but it makes me somewhat uncomfortable. | 18:44 |
| rderose | dstanek: I don't like the idea of having to support multiple version and I don't want to require the version in the API. | 18:44 |
| rderose | dstanek: but not sure how you make significant changes without it :) | 18:44 |
| rderose | dstanek: is it just to be backwards compatible? | 18:44 |
| rderose | the changes we're planning will break existing mapping rules? | 18:45 |
| *** stingaci has joined #openstack-keystone | 18:48 | |
| dstanek | rderose: quite possibly yes | 18:48 |
| rderose | dstanek: but if we keep this in the scope of shadow mapping, we may not break existing rules; thus, may not need this? | 18:48 |
| dstanek | why do you not like being explicit about the version? | 18:49 |
| dstanek | rderose: you don't need this. that's why it has it's own spec | 18:49 |
| dstanek | the changes i've made to support you are backward compatibe | 18:49 |
| rderose | dstanek: ah, right | 18:49 |
| rderose | dstanek: being explicit about the version, means operators need to understand the different version; makes it more complicated | 18:50 |
| rderose | having to document the multiple versions... | 18:51 |
| rderose | as opposed to having a single mapping engine design | 18:51 |
| rderose | dstanek: but understand your reasoning... | 18:51 |
| *** itisha has quit IRC | 18:52 | |
| *** harlowja has quit IRC | 18:52 | |
| dstanek | rderose: yeah, unfortunately we always have to support what we are doing for some amount of time | 18:52 |
| rderose | dstanek: true, it's just this feels little like the cart in front of the horse :) | 18:53 |
| stevemar | lbragstad: oh? which comment, i had many | 18:55 |
| lbragstad | stevemar line 29 - https://etherpad.openstack.org/p/community-goals | 18:55 |
| stevemar | lbragstad: yeah, def a change to install guide | 18:56 |
| lbragstad | http://docs.openstack.org/newton/install-guide-ubuntu/keystone-install.html#configure-the-apache-http-server ? | 18:58 |
| lbragstad | stevemar are you saying all projects need to double check that the install guide includes instructions for using apache? | 18:58 |
| lbragstad | looks like we use apache for the keystone bits (obvisouly - since we don't support eventlet) | 18:59 |
| lbragstad | stevemar also - did you happen to see line 132? https://etherpad.openstack.org/p/community-goals | 19:01 |
| dstanek | rderose: getting ready for version changes before we need them? | 19:01 |
| rderose | dstanek: I think we should only version the mapping if we are adding changes that break the existing implementation. If not, then this is not needed and not worth the overhead of having to support multiple versions and for operators to have to understand them. | 19:02 |
| lbragstad | dstanek I don't know about you, but I almost always find a way to get the cart in front of the horse ;) | 19:02 |
| rderose | :) | 19:02 |
| lbragstad | dstanek versioning won't be required, will it? | 19:02 |
| dstanek | rderose: we are not proposing a new version. just the mechanism by which we can | 19:02 |
| dstanek | lbragstad: not at all | 19:02 |
| *** catintheroof has joined #openstack-keystone | 19:02 | |
| stevemar | lbragstad: what about line 132 | 19:02 |
| lbragstad | dstanek if a mapping is created without a version, everything should just work | 19:03 |
| stevemar | we'll need to produce 2 samples with that, or finally decide on one | 19:03 |
| dstanek | lbragstad: yep, it's just version 1. with version 2 coming sometime in the future | 19:03 |
| lbragstad | stevemar what's the new style? | 19:03 |
| rderose | lbragstad dstanek: I see | 19:03 |
| lbragstad | stevemar the section doesn't really say what the difference is | 19:03 |
| lbragstad | stevemar or what the new style is and explicitly why we should move to it | 19:04 |
| rderose | dstanek lbragstad: and we may not ever get version 2 | 19:04 |
| samueldmq | dstanek: https://review.openstack.org/#/c/410949 just allows roles in the mapping | 19:04 |
| samueldmq | dstanek: there will be other patches for projects and groups | 19:04 |
| *** asettle__ has quit IRC | 19:04 | |
| samueldmq | dstanek: then followup with creating the resources | 19:04 |
| samueldmq | dstanek: is that the plan? | 19:05 |
| dstanek | rderose: that why i said in the meeting that i would be OK pushing it if people are uncomfortable for any reason. sometime in the first quarter next year i'll be looking to see what Rackspace features we need to add | 19:05 |
| rderose | dstanek: okay | 19:05 |
| lbragstad | stevemar by new style do they mean move all policy defaults into oslo.policy, following the pattern nova has established? | 19:05 |
| dstanek | samueldmq: yes. that was a real quick proof of concept | 19:05 |
| stevemar | lbragstad: they mean to follow nova's pattern, because everyone knows nova does no wrong :P | 19:06 |
| dstanek | samueldmq: i told lbragstad something was possible and when i write a test to verify i found out it wasn't | 19:06 |
| stevemar | lbragstad: nova stores the defaults in code, have you seen their code? | 19:06 |
| lbragstad | stevemar ah - the section does a great job of *not* explaining that | 19:06 |
| dstanek | samueldmq: so i "fixed the glitch" | 19:06 |
| stevemar | lbragstad: for example: https://github.com/openstack/nova/tree/master/nova/policies | 19:06 |
| lbragstad | stevemar gotcha - right | 19:06 |
| *** catinthe_ has quit IRC | 19:06 | |
| *** pabelanger has left #openstack-keystone | 19:07 | |
| samueldmq | dstanek: but we do want to merge that, right ? (tiny start, but yes, part of the solution) | 19:08 |
| stevemar | yeah, so we would have something like 'keystone/policies/users' and in there list the various user policies | 19:08 |
| lbragstad | stevemar i was having a conversation with someone (probably dstanek or edmondsw) recently about starting an effort to document policy | 19:08 |
| stevemar | lbragstad: the tricky part is doing this for the 'standard' one and v3 domain aware one | 19:08 |
| lbragstad | stevemar right - that's a monkey wrench on our part | 19:09 |
| stevemar | lbragstad: this would be one less thing for packagers to package | 19:09 |
| stevemar | and if someone wanted to do it, they simply run "tox -e genpolicy" | 19:09 |
| lbragstad | stevemar but the documentation would be detailed towards explaining how policy works, what is supports, what it doesn't, and how to set it up | 19:09 |
| lbragstad | right dstanek and edmondsw ^ | 19:09 |
| samueldmq | dstanek: hmm not really, roles should be under a project in the mapping (according to the spec) | 19:10 |
| stevemar | lbragstad: sounds good to me | 19:10 |
| lbragstad | ? | 19:10 |
| lbragstad | stevemar do you think that'd be something better suited for a x-project goal? | 19:10 |
| lbragstad | stevemar because I think the end result would be some sort of document that projects could use to compare against their existing defaults, and something for new projects to start using right away to get policy right from the get go | 19:11 |
| edmondsw | having trouble parsing some of the above... | 19:13 |
| dstanek | samueldmq: not until i know it works for what they need | 19:13 |
| samueldmq | dstanek: kk | 19:13 |
| dstanek | lbragstad: yep | 19:14 |
| lbragstad | dstanek you were in that conversation? | 19:14 |
| * lbragstad has been talking about policy so much lately it's hard to keep track of everything | 19:15 | |
| edmondsw | stevemar, I think the general consensus (from a conversation at the Austin midcycle, I believe) was that we shouldn't really have 2 policy files anyway, and should merge those | 19:15 |
| edmondsw | if we're moving the policy into code (which I think we should), that merging of the 2 policies could happen as part of that, right? | 19:15 |
| edmondsw | you'd be moving things a bit at a time, not try to do it all in one massive patch | 19:16 |
| lbragstad | edmondsw yeah - i would think we be able to combine those efforts | 19:16 |
| lbragstad | edmondsw and i'm all for doing it in bit-sized pieces. | 19:16 |
| edmondsw | ++ | 19:16 |
| lbragstad | policy currently is confusing/hard to understand, and getting people to review confusing stuff in *large* patches is impossible | 19:17 |
| lbragstad | s/impossible/impossible to do without increasing the likelihood for more mistakes/ | 19:17 |
| openstackgerrit | Merged openstack/keystonemiddleware: Pass ?allow_expired https://review.openstack.org/382100 | 19:18 |
| lbragstad | stevemar we can release! ^ | 19:18 |
| stevemar | lbragstad: propose a new release ;) | 19:18 |
| dstanek | lbragstad: we talked about it during our Hangout i think | 19:18 |
| lbragstad | dstanek ah | 19:18 |
| edmondsw | lbragstad see my latest comment in https://review.openstack.org/#/c/384148 for another example of how complicated policy stuff can get | 19:19 |
| edmondsw | and what we should be laying out guidelines for the different projects to avoid | 19:19 |
| dstanek | lbragstad: to measure up each policy impl against a "best practices" and give new projects a place to go officially instead of copy off of "project X" | 19:19 |
| *** narasimha_SV has joined #openstack-keystone | 19:20 | |
| lbragstad | stevemar 4.12.0 ? | 19:20 |
| narasimha_SV | http://paste.openstack.org/show/592535/ can anyon please explain me this code in LDAP core.py file | 19:20 |
| *** asettle has joined #openstack-keystone | 19:20 | |
| narasimha_SV | I am using oracle identity service for LDAP in which user enable attribute is a string value | 19:21 |
| narasimha_SV | I am getting issue in this funtion 258 line | 19:21 |
| *** chris_hultin is now known as chris_hultin|AWA | 19:21 | |
| edmondsw | narasimha_SV fyi, this would be an easier/better way to link that: https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap/core.py#L255-L271 | 19:22 |
| narasimha_SV | ok | 19:23 |
| * lbragstad stevemar done https://review.openstack.org/#/c/411468/ | 19:23 | |
| stevemar | ty! | 19:23 |
| lbragstad | stevemar 4.12.0 works, right? | 19:24 |
| narasimha_SV | https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap/core.py#L258 as per logic code execution is moving to this line | 19:24 |
| narasimha_SV | which cannot convert a string value to int | 19:24 |
| stevemar | lbragstad: was there a requirements change? | 19:24 |
| narasimha_SV | and my LDAP integration is failing | 19:24 |
| edmondsw | narasimha_SV I'm not sure I can answer your question off the top of my head, though | 19:24 |
| stevemar | lbragstad: https://github.com/openstack/keystonemiddleware/compare/4.11.0...master | 19:24 |
| stevemar | yep | 19:24 |
| dstanek | narasimha_SV: i would guess by looking at that line that it expects enabled to be 0 or 1. what is it in your case? | 19:25 |
| narasimha_SV | dastanek: its active | 19:25 |
| samueldmq | lbragstad: couple of comments in https://review.openstack.org/#/c/410515 | 19:26 |
| samueldmq | lbragstad: code and tests are very well written | 19:26 |
| edmondsw | narasimha_SV are you setting user_enabled_default in your conf, and if so to what value? | 19:26 |
| lbragstad | stevemar http://cdn.pasteraw.com/cmjva1lihnsm320315zsku2jr8t18bi | 19:26 |
| narasimha_SV | but if you check the code in elif block it is written for taking boolean or string value | 19:26 |
| lbragstad | samueldmq thanks@ | 19:26 |
| dstanek | narasimha_SV: the string "active"? | 19:26 |
| narasimha_SV | yes | 19:27 |
| narasimha_SV | user_enabled_default = 51 | 19:27 |
| narasimha_SV | this is the value which I kept | 19:27 |
| dstanek | narasimha_SV: i don't know how to get that to work. you may have to see if one of the ldap people in here know if there is a standard for what that value should be | 19:28 |
| *** itisha has joined #openstack-keystone | 19:28 | |
| narasimha_SV | if I bypass the code and make the enabled attribute to true LDAP integration is successful | 19:28 |
| edmondsw | narasimha_SV have you read over the descriptions of these conf settings? https://github.com/openstack/keystone/blob/master/keystone/conf/ldap.py#L202-L245 | 19:30 |
| edmondsw | and how are you setting them? | 19:30 |
| edmondsw | user_enabled_default = 51 doesn't sound right... did you mean 512? | 19:31 |
| *** gyee has joined #openstack-keystone | 19:31 | |
| openstackgerrit | David Stanek proposed openstack/keystone-specs: Versioned federation mappings https://review.openstack.org/411392 | 19:33 |
| narasimha_SV | yes i just added these confs as I see in the documentation to work with LDAP | 19:34 |
| *** phalmos_ has joined #openstack-keystone | 19:34 | |
| narasimha_SV | http://docs.openstack.org/admin-guide/identity-integrate-with-ldap.html | 19:34 |
| *** Zer0Byte__ has quit IRC | 19:36 | |
| *** asettle has quit IRC | 19:36 | |
| edmondsw | narasimha_SV: ah, I think that documentation is wrong... try 512 instead of 51 and see if that helps | 19:37 |
| narasimha_SV | ok | 19:37 |
| edmondsw | and are you using Active Directory or what type of LDAP? | 19:37 |
| *** asettle has joined #openstack-keystone | 19:37 | |
| *** phalmos has quit IRC | 19:37 | |
| edmondsw | narasimha_SV: also, the values you see in the docs there are for Active Directory, so if you're using a different type of LDAP they would probably need to be different | 19:38 |
| narasimha_SV | ok may be you are right | 19:38 |
| edmondsw | edmondsw: I've just always left those unset, so they used the defaults | 19:39 |
| edmondsw | narasimha_SV | 19:39 |
| *** asettle has quit IRC | 19:41 | |
| *** dikonoor has quit IRC | 19:43 | |
| edmondsw | stevemar, do you know which git project has the admin_guide in it? | 19:45 |
| stevemar | edmondsw: yes sir | 19:45 |
| stevemar | edmondsw: one sec | 19:45 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to notifications for PCI-DSS https://review.openstack.org/396752 | 19:46 |
| stevemar | edmondsw: https://github.com/openstack/openstack-manuals/tree/master/doc/admin-guide/source | 19:46 |
| edmondsw | stevemar, ty sir | 19:46 |
| stevemar | np! | 19:46 |
| edmondsw | they couldn't just call it docs... | 19:47 |
| stevemar | :) | 19:47 |
| stevemar | everyone's a critic! | 19:47 |
| *** hyakuhei has joined #openstack-keystone | 19:48 | |
| dstanek | edmondsw: they are wordsmiths...manuals sounds much more professional than docs | 19:49 |
| edmondsw | lol | 19:49 |
| edmondsw | narasimha_SV, see also http://docs.openstack.org/developer/keystone/configuration.html#using-an-ldap-server | 19:50 |
| edmondsw | and I'll try to throw up a quick change to fix the admin guide | 19:50 |
| *** diazjf has joined #openstack-keystone | 19:50 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement password requirements API https://review.openstack.org/410515 | 19:52 |
| lbragstad | samueldmq fixed ^ | 19:52 |
| *** Zer0Byte__ has joined #openstack-keystone | 19:52 | |
| samueldmq | lbragstad: +2 from me, thanks | 19:54 |
| r1chardj0n3s | stevemar: are you about? I'm dealing with Horizon fires this morning, could you run the cp meeting pls? | 19:55 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add doctor checks for ldap symptoms https://review.openstack.org/409292 | 19:56 |
| edmondsw | narasimha_SV: fix proposed https://review.openstack.org/#/c/411477/ | 19:57 |
| lbragstad | r1chardj0n3s i could if you need someone to | 19:58 |
| lbragstad | but - i assume stevemar is around... somewhere | 19:58 |
| r1chardj0n3s | thanks lbragstad, I can certainly kick the meeting off, but I'm quite distracted | 19:58 |
| lbragstad | r1chardj0n3s no worries | 19:59 |
| lbragstad | r1chardj0n3s you typically jsut go down https://etherpad.openstack.org/p/ocata-keystone-horizon hitting each heading, right? | 19:59 |
| narasimha_SV | after changing http://paste.openstack.org/show/592540/ these varibale to these values | 19:59 |
| narasimha_SV | code got executed as expected for me | 20:00 |
| r1chardj0n3s | lbragstad: I've slightly optimised by asking folks specifically what they want to talk about :-) | 20:00 |
| stevemar | lbragstad: i'm typically round, i mean around | 20:00 |
| r1chardj0n3s | I'm not sure it's better, but it saves a lot of dead air ;-) | 20:00 |
| lbragstad | r1chardj0n3s ++ in that case we do have stevemar! | 20:00 |
| stevemar | r1chardj0n3s: i'm great at filling dead air! | 20:01 |
| r1chardj0n3s | \o/ | 20:01 |
| *** hyakuhei has quit IRC | 20:04 | |
| *** hyakuhei has joined #openstack-keystone | 20:04 | |
| *** hyakuhei has quit IRC | 20:04 | |
| *** hyakuhei has joined #openstack-keystone | 20:04 | |
| *** adrian_otto has quit IRC | 20:05 | |
| *** navid_ has joined #openstack-keystone | 20:09 | |
| *** navid_ has quit IRC | 20:10 | |
| dstanek | stevemar: can't pay too much attention in the horizon meeting today. i have another meeting in 18 mins that i'm prepping for | 20:11 |
| lbragstad | stevemar same here | 20:15 |
| stevemar | dstanek: lbragstad kk | 20:18 |
| antwash | dolpm : ping | 20:20 |
| dstanek | antwash: looking for dolphm? | 20:21 |
| antwash | dstanek: yeah, he's busy I'm assuming lol | 20:21 |
| antwash | Just wanted to ask about the mulit node gate jobs using grenade for Keystone, was working on it, but seems like it's already in progress by another team https://blueprints.launchpad.net/keystone/+spec/rolling-upgrade-testing | 20:22 |
| *** stingaci_ has joined #openstack-keystone | 20:22 | |
| gagehugo | samueldmq: I have no idea what's going on with releasenotes, it all passes locally. I'm not sure if that elastic bug comment(s) has anything to do with it or if there is something else | 20:22 |
| *** catintheroof has quit IRC | 20:22 | |
| *** stingaci has quit IRC | 20:24 | |
| *** basilAB has quit IRC | 20:24 | |
| dolphm | antwash: julia works for mirantis, but i don't know her nick. and yes, she's got a few patches already up for keystone! | 20:25 |
| *** basilAB has joined #openstack-keystone | 20:25 | |
| antwash | dolphm : yeah, I noticed that, but I'm curious is that eveything that was expected to get done? | 20:26 |
| *** ayoung has joined #openstack-keystone | 20:27 | |
| *** ChanServ sets mode: +v ayoung | 20:27 | |
| stevemar | lbragstad: new ksm is out! | 20:27 |
| lbragstad | stevemar whew, that was exciting | 20:28 |
| *** lamt has quit IRC | 20:29 | |
| *** diazjf has quit IRC | 20:32 | |
| *** catintheroof has joined #openstack-keystone | 20:35 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add doctor checks for ldap symptoms https://review.openstack.org/409292 | 20:38 |
| stevemar | edmondsw: around? | 20:43 |
| edmondsw | stevemar in mtg | 20:43 |
| *** narasimha_SV has quit IRC | 20:44 | |
| *** diazjf has joined #openstack-keystone | 20:45 | |
| *** asettle has joined #openstack-keystone | 20:46 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 20:47 |
| *** ravelar has quit IRC | 20:51 | |
| *** diazjf has quit IRC | 20:51 | |
| stevemar | edmondsw: send me a poke when avail | 20:53 |
| *** adriant has joined #openstack-keystone | 20:57 | |
| *** diazjf has joined #openstack-keystone | 21:02 | |
| *** stingaci_ has quit IRC | 21:03 | |
| *** stingaci has joined #openstack-keystone | 21:03 | |
| edmondsw | stevemar ping | 21:08 |
| stevemar | edmondsw: hey dude | 21:08 |
| stevemar | edmondsw: i wanted your take on https://bugs.launchpad.net/oslo.policy/+bug/1547684 | 21:09 |
| openstack | Launchpad bug 1547684 in oslo.policy "Attribute error on Token object when using domain scoped token" [Undecided,New] | 21:09 |
| edmondsw | stevemar reading | 21:09 |
| stevemar | edmondsw: seems like anyone using v3 policy (the way we have it written) won't be able to actually use it | 21:09 |
| edmondsw | :) doesn't surprise me | 21:09 |
| stevemar | edmondsw: here's a script to re-create the error: https://launchpadlibrarian.net/242578504/policy_token.py | 21:09 |
| edmondsw | that v3cloud policy file has a bunch of issues, largely because it isn't used much so they're not flushed out like they are in the other file | 21:10 |
| stevemar | edmondsw: the main sticking point is: https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json#L3 | 21:10 |
| *** adrian_otto has joined #openstack-keystone | 21:10 | |
| stevemar | edmondsw: the "token.is_admin_project:True" bit in particular | 21:10 |
| edmondsw | I think I have some notes around here somewhere of some issues that I meant to fix but never have gotten around to... and that's just a few that I found, wouldn't be comprehensive | 21:10 |
| edmondsw | hmmm | 21:12 |
| edmondsw | the issues I'd seen weren't related to that | 21:12 |
| stevemar | edmondsw: is this just a matter of needing "target:" in front of that bit? | 21:12 |
| edmondsw | I think that should be "is_admin_project", not "token.is_admin_project" ? | 21:13 |
| stevemar | edmondsw: ? but that's not defined anywhere no? | 21:16 |
| stevemar | unless we dumped that into context | 21:16 |
| stevemar | i think we did | 21:16 |
| edmondsw | I think we did | 21:16 |
| edmondsw | e.g. https://review.openstack.org/#/c/384655/2/etc/policy.json | 21:17 |
| *** jaugustine has quit IRC | 21:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/411505 | 21:22 |
| edmondsw | stevemar, that help? | 21:24 |
| stevemar | edmondsw: so you're saying we've shipped a fault policy file (granted not the default one) for two releases in a row, cause of a typo? | 21:24 |
| stevemar | ffs | 21:24 |
| * stevemar throws fish at everyone | 21:24 | |
| gagehugo | :( | 21:24 |
| edmondsw | stevemar consider it an incentive to merge the policy files <ducks> | 21:24 |
| stevemar | edmondsw: i totally would be down for that | 21:24 |
| *** ravelar has joined #openstack-keystone | 21:25 | |
| edmondsw | I think everyone would be down for it... problem is finding someone to do it | 21:25 |
| * stevemar hands gagehugo a wet wipe | 21:25 | |
| edmondsw | stevemar did you try removing "token." to see if it worked? | 21:26 |
| stevemar | edmondsw: no, will try soon | 21:26 |
| stevemar | distracted by tv | 21:26 |
| stevemar | edmondsw: short term, we should add a test in keystone that actually tries to load the damn v3 policy | 21:27 |
| stevemar | and enforce things | 21:27 |
| edmondsw | "things" would be a long list, making it hard to add "short term" | 21:27 |
| edmondsw | I think dstanek says he's actually using that policy file and it's working for what he's tried | 21:28 |
| edmondsw | it just won't work for everything | 21:28 |
| edmondsw | hence why I think the best answer is to merge the policy files and look at how well we're testing policy settings in general | 21:28 |
| edmondsw | rather than just focus on testing v3cloudpolicy that we want to merge into normal policy and get rid of anyway | 21:29 |
| stevemar | i've been thinking we should merge policy files since we're the only project that has 2 | 21:29 |
| edmondsw | having 2 was an awful idea to start with | 21:29 |
| *** ravelar has quit IRC | 21:29 | |
| * edmondsw says without knowing what the reason was | 21:29 | |
| stevemar | edmondsw: whatever it is, i'm sure it's not valid any longer | 21:30 |
| stevemar | edmondsw: it predates me | 21:30 |
| edmondsw | ++ | 21:31 |
| *** ravelar has joined #openstack-keystone | 21:36 | |
| *** ravelar has quit IRC | 21:41 | |
| *** browne has quit IRC | 21:53 | |
| *** adrian_otto1 has joined #openstack-keystone | 21:54 | |
| *** adrian_otto1 has quit IRC | 21:54 | |
| *** edtubill has quit IRC | 21:55 | |
| *** adrian_otto has quit IRC | 21:55 | |
| *** adrian_otto has joined #openstack-keystone | 21:58 | |
| *** edmondsw has quit IRC | 21:59 | |
| jamielennox | stevemar, edmondsw: thanks for sticking with that allow_expired review | 22:00 |
| stevemar | jamielennox: ++ | 22:00 |
| *** edmondsw_ has joined #openstack-keystone | 22:02 | |
| *** diazjf has quit IRC | 22:03 | |
| *** browne has joined #openstack-keystone | 22:03 | |
| stevemar | edmondsw_: OK, successfully recreated the issue | 22:03 |
| stevemar | edmondsw_: sigh... yep | 22:04 |
| stevemar | that fixed it | 22:04 |
| *** asettle has quit IRC | 22:05 | |
| *** asettle has joined #openstack-keystone | 22:06 | |
| *** edmondsw_ has quit IRC | 22:06 | |
| *** ayoung has quit IRC | 22:10 | |
| *** asettle has quit IRC | 22:11 | |
| stevemar | now to make a test for it | 22:12 |
| openstackgerrit | Merged openstack/keystone: Implement password requirements API https://review.openstack.org/410515 | 22:42 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 22:46 |
| *** catintheroof has quit IRC | 22:46 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 22:51 |
| *** browne has quit IRC | 22:52 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 22:56 |
| *** phalmos_ has quit IRC | 23:00 | |
| *** mvk has joined #openstack-keystone | 23:03 | |
| *** dave-mccowan has quit IRC | 23:04 | |
| *** asettle has joined #openstack-keystone | 23:07 | |
| david-lyle | crinkle, stevemar, I added some feedback to https://review.openstack.org/389337 I think I've unfortunately increases the scope of the bug fix more than I should have. let's fix the bug first, then support multi-domain role assignments later. | 23:08 |
| david-lyle | *increased | 23:08 |
| david-lyle | I think going back to patch 4 while retaining the bug-id is probably the best way forward for right now | 23:08 |
| david-lyle | well scope wise, the fixes in patch 5 should remain | 23:10 |
| *** asettle has quit IRC | 23:11 | |
| *** markvoelker has quit IRC | 23:13 | |
| *** ngupta_ has quit IRC | 23:16 | |
| *** ngupta has joined #openstack-keystone | 23:17 | |
| *** catintheroof has joined #openstack-keystone | 23:17 | |
| *** catintheroof has quit IRC | 23:17 | |
| *** catintheroof has joined #openstack-keystone | 23:18 | |
| *** ngupta has quit IRC | 23:21 | |
| *** itisha has quit IRC | 23:22 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/411505 | 23:23 |
| *** ayoung has joined #openstack-keystone | 23:29 | |
| *** ChanServ sets mode: +v ayoung | 23:29 | |
| *** gyee has quit IRC | 23:36 | |
| *** jamielennox is now known as jamielennox|away | 23:46 | |
| *** edmondsw has joined #openstack-keystone | 23:47 | |
| *** jamielennox|away is now known as jamielennox | 23:50 | |
| *** edmondsw has quit IRC | 23:51 | |
| *** dave-mccowan has joined #openstack-keystone | 23:55 | |
| *** adrian_otto has quit IRC | 23:57 | |
| *** harlowja has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!