| *** guoshan has joined #openstack-keystone | 00:26 | |
| *** guoshan has quit IRC | 00:31 | |
| *** guoshan has joined #openstack-keystone | 00:44 | |
| *** edmondsw has joined #openstack-keystone | 00:58 | |
| *** hoangcx has joined #openstack-keystone | 00:59 | |
| *** edmondsw has quit IRC | 01:03 | |
| *** guoshan has quit IRC | 01:03 | |
| *** tqtran has joined #openstack-keystone | 01:10 | |
| *** tqtran has quit IRC | 01:14 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: re-work inference rule manager https://review.openstack.org/412236 | 01:19 |
|---|---|---|
| *** zhangjl has joined #openstack-keystone | 01:22 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: re-work inference rule manager https://review.openstack.org/412236 | 01:22 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: re-work inference rule bindings https://review.openstack.org/412236 | 01:26 |
| *** liujiong has joined #openstack-keystone | 01:30 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: re-work inference rule bindings https://review.openstack.org/412236 | 01:32 |
| jamielennox | stevemar: why do you dredge up old horrors? | 01:35 |
| stevemar | jamielennox: because i thought i was going to fix an easy bug | 01:36 |
| stevemar | jamielennox: AFAICT only 'create' and 'list all inferences' work | 01:38 |
| *** guoshan has joined #openstack-keystone | 01:41 | |
| *** trananhkma has joined #openstack-keystone | 01:46 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: re-work inference rule bindings https://review.openstack.org/412236 | 02:08 |
| jamielennox | stevemar: -1ed it, in general i'm fine, but i expect people are using create | 02:17 |
| jamielennox | if only adam | 02:17 |
| jamielennox | it's a really easy compat though | 02:18 |
| jamielennox | put a debtcollector wrapper on the function | 02:18 |
| jamielennox | return InferenceRuleManager(self._adapter).create(prior, implied0 | 02:19 |
| jamielennox | return InferenceRuleManager(self._adapter).create(prior, implied) | 02:19 |
| jamielennox | oh, except it's creating a Role object? | 02:19 |
| jamielennox | wtf | 02:19 |
| jamielennox | yea, i don't care about that, that's just wrong | 02:20 |
| *** asettle has joined #openstack-keystone | 02:22 | |
| stevemar | jamielennox: so im having trouble interpreting your back and forth | 02:26 |
| stevemar | jamielennox: is that leave it alone, or use the debtcollector | 02:26 |
| *** asettle has quit IRC | 02:26 | |
| jamielennox | stevemar: i would redirect it to the new function and let debtcollector do the deprecation | 02:27 |
| stevemar | jamielennox: coolio | 02:27 |
| *** catintheroof has quit IRC | 02:28 | |
| *** catintheroof has joined #openstack-keystone | 02:30 | |
| stevemar | jamielennox: i'll just add it to all of them | 02:30 |
| stevemar | and make them proxy the new stuff | 02:30 |
| stevemar | the returned content might be different, Role vs RuleInference | 02:31 |
| *** catintheroof has quit IRC | 02:34 | |
| jamielennox | the resource objects are pretty dumb, that should be fine | 02:35 |
| jamielennox | up to you, the existing stuff is actually broken so there's not a compat issue, but it might be less confusing | 02:35 |
| stevemar | jamielennox: may as well proxy them all | 02:38 |
| stevemar | jamielennox: easy to test these out? | 02:39 |
| stevemar | (if debtcollector.removals actually kicked in) | 02:41 |
| jamielennox | stevemar: are you asking how to test it? | 02:55 |
| stevemar | jamielennox: incoming paste, 1 sec | 02:57 |
| stevemar | jamielennox: http://paste.openstack.org/show/592750/ | 02:57 |
| jamielennox | oh, it doesn't store there/ | 02:58 |
| stevemar | @removals.remove(message='Use %s.create instead.' % deprecation_msg, | 02:58 |
| stevemar | version='3.9.0', removal_version='4.0.0') | 02:58 |
| stevemar | def create_implied(self, prior_role, implied_role, **kwargs): | 02:58 |
| stevemar | return InferenceRuleManager(self._adapter).create(prior_role, | 02:58 |
| stevemar | implied_role) | 02:58 |
| stevemar | (sorry for the spam) | 02:58 |
| jamielennox | stevemar: use self.client | 02:58 |
| jamielennox | it's not actually the client object, it's the adapter | 03:00 |
| stevemar | jamielennox: ok, got through that, but unable to verify the returned content of the call | 03:02 |
| stevemar | the test always stops when a deprecated function is used | 03:02 |
| stevemar | I thoght adding the filterwarnings would help :) | 03:02 |
| jamielennox | stevemar: the tests fail because of the warning? | 03:03 |
| jamielennox | there is a expect deprecations function there somewhere | 03:04 |
| stevemar | if should be in test/utils :) | 03:06 |
| *** gagehugo has quit IRC | 03:07 | |
| jamielennox | i think it's a fixture, i can't remembe | 03:07 |
| *** gagehugo has joined #openstack-keystone | 03:08 | |
| stevemar | with self.deprecations.expect_deprecations_here(): | 03:08 |
| stevemar | jamielennox: ^ | 03:09 |
| *** liujiong_66 has joined #openstack-keystone | 03:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: re-work inference rule bindings https://review.openstack.org/412236 | 03:10 |
| *** Nakato has quit IRC | 03:10 | |
| *** Nakato has joined #openstack-keystone | 03:10 | |
| *** liujiong has quit IRC | 03:10 | |
| *** tqtran has joined #openstack-keystone | 03:11 | |
| stevemar | should be good now | 03:12 |
| *** tqtran has quit IRC | 03:16 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: re-work inference rule bindings https://review.openstack.org/412236 | 03:16 |
| stevemar | ok, now pep8 passes :) | 03:16 |
| *** ngupta has joined #openstack-keystone | 03:19 | |
| *** frickler_ has joined #openstack-keystone | 03:20 | |
| *** frickler has quit IRC | 03:21 | |
| *** udesale has joined #openstack-keystone | 03:22 | |
| *** ngupta has quit IRC | 03:24 | |
| *** ngupta has joined #openstack-keystone | 03:35 | |
| openstackgerrit | Shan Guo proposed openstack/keystone: [api] set `is_admin_project` on tokens for admin project https://review.openstack.org/409678 | 03:36 |
| *** zhangqiankun has quit IRC | 03:43 | |
| *** zhangqiankun has joined #openstack-keystone | 03:43 | |
| *** nkinder has quit IRC | 03:50 | |
| *** nicolasbock has joined #openstack-keystone | 03:53 | |
| *** ngupta has quit IRC | 04:12 | |
| *** tqtran has joined #openstack-keystone | 04:12 | |
| *** ngupta has joined #openstack-keystone | 04:13 | |
| *** tqtran has quit IRC | 04:17 | |
| *** ngupta has quit IRC | 04:17 | |
| *** edmondsw has joined #openstack-keystone | 04:34 | |
| *** edmondsw has quit IRC | 04:38 | |
| *** adriant has quit IRC | 04:43 | |
| *** nicolasbock has quit IRC | 04:43 | |
| *** guoshan has quit IRC | 04:55 | |
| *** guoshan has joined #openstack-keystone | 05:20 | |
| *** guoshan has quit IRC | 05:30 | |
| *** guoshan has joined #openstack-keystone | 05:49 | |
| *** jaosorior has joined #openstack-keystone | 06:06 | |
| *** tqtran has joined #openstack-keystone | 06:14 | |
| *** tqtran has quit IRC | 06:19 | |
| *** asettle has joined #openstack-keystone | 06:23 | |
| openstackgerrit | yunfeng zhou proposed openstack/keystone: fix one typo. https://review.openstack.org/412298 | 06:24 |
| *** asettle has quit IRC | 06:27 | |
| *** enginy has joined #openstack-keystone | 06:31 | |
| *** enginy has quit IRC | 06:34 | |
| *** enginy has joined #openstack-keystone | 06:35 | |
| *** enginy has quit IRC | 06:36 | |
| *** qwertyco has joined #openstack-keystone | 06:36 | |
| *** liujiong_66 is now known as liujiong | 06:53 | |
| openstackgerrit | Shan Guo proposed openstack/keystone: Fix typo in doc https://review.openstack.org/412313 | 06:55 |
| *** tesseract has joined #openstack-keystone | 07:04 | |
| *** tesseract is now known as Guest33254 | 07:05 | |
| *** tobberydberg has joined #openstack-keystone | 07:07 | |
| *** zhangqiankun has quit IRC | 07:28 | |
| *** chrisplo_ has joined #openstack-keystone | 07:31 | |
| *** pcaruana has joined #openstack-keystone | 07:33 | |
| *** zhangqiankun has joined #openstack-keystone | 07:45 | |
| *** tobberyd_ has joined #openstack-keystone | 07:56 | |
| *** jaosorior has quit IRC | 07:58 | |
| *** tobberydberg has quit IRC | 07:59 | |
| *** edmondsw has joined #openstack-keystone | 08:10 | |
| *** edmondsw has quit IRC | 08:14 | |
| *** jaosorior has joined #openstack-keystone | 08:24 | |
| *** qwertyco has quit IRC | 08:24 | |
| *** qwertyco has joined #openstack-keystone | 08:36 | |
| *** masber has joined #openstack-keystone | 08:39 | |
| *** martinus__ has joined #openstack-keystone | 08:41 | |
| *** zhangqiankun has quit IRC | 08:42 | |
| *** chrisplo_ has quit IRC | 08:43 | |
| *** zhangqiankun has joined #openstack-keystone | 08:43 | |
| *** jaosorior has quit IRC | 08:45 | |
| *** jaosorior has joined #openstack-keystone | 08:46 | |
| *** rdo has quit IRC | 08:54 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:01 | |
| *** qwertyco has quit IRC | 09:06 | |
| *** tobberyd_ has quit IRC | 09:13 | |
| *** tobberydberg has joined #openstack-keystone | 09:14 | |
| *** tqtran has joined #openstack-keystone | 09:16 | |
| *** tqtran has quit IRC | 09:21 | |
| *** asettle has joined #openstack-keystone | 09:23 | |
| *** asettle has quit IRC | 09:28 | |
| *** asettle has joined #openstack-keystone | 09:32 | |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 09:36 |
| *** rdo has joined #openstack-keystone | 09:38 | |
| *** frickler_ is now known as frickler | 09:44 | |
| *** Adri2000 has quit IRC | 09:54 | |
| *** tqtran has joined #openstack-keystone | 10:17 | |
| *** trananhkma has quit IRC | 10:20 | |
| *** tqtran has quit IRC | 10:22 | |
| *** liujiong has quit IRC | 10:22 | |
| *** guoshan has quit IRC | 10:33 | |
| *** hoangcx has quit IRC | 10:38 | |
| *** udesale has quit IRC | 10:58 | |
| *** amoralej is now known as amoralej|brb | 11:05 | |
| *** asettle has quit IRC | 11:05 | |
| *** asettle has joined #openstack-keystone | 11:09 | |
| *** asettle has quit IRC | 11:17 | |
| *** guoshan has joined #openstack-keystone | 11:23 | |
| *** dave-mccowan has joined #openstack-keystone | 11:26 | |
| *** jefrite has joined #openstack-keystone | 11:32 | |
| *** Dave has quit IRC | 11:33 | |
| *** nicolasbock has joined #openstack-keystone | 11:38 | |
| *** Dave has joined #openstack-keystone | 11:45 | |
| *** guoshan has quit IRC | 11:45 | |
| *** dave-mcc_ has joined #openstack-keystone | 11:45 | |
| *** guoshan has joined #openstack-keystone | 11:46 | |
| *** edmondsw has joined #openstack-keystone | 11:46 | |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 11:47 |
| *** guoshan has quit IRC | 11:47 | |
| *** guoshan has joined #openstack-keystone | 11:47 | |
| *** dave-mccowan has quit IRC | 11:48 | |
| *** edmondsw has quit IRC | 11:50 | |
| *** guoshan has quit IRC | 12:06 | |
| *** zhangjl has left #openstack-keystone | 12:11 | |
| *** raildo has joined #openstack-keystone | 12:13 | |
| *** amoralej|brb is now known as amoralej | 12:15 | |
| *** guoshan has joined #openstack-keystone | 12:16 | |
| *** catintheroof has joined #openstack-keystone | 12:18 | |
| *** dave-mcc_ has quit IRC | 12:18 | |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 12:18 |
| *** iurygregory has joined #openstack-keystone | 12:29 | |
| *** flaper87 has joined #openstack-keystone | 12:45 | |
| *** guoshan has quit IRC | 12:47 | |
| *** guoshan has joined #openstack-keystone | 13:01 | |
| *** lamt has quit IRC | 13:12 | |
| *** tqtran has joined #openstack-keystone | 13:19 | |
| *** asettle has joined #openstack-keystone | 13:22 | |
| *** tqtran has quit IRC | 13:24 | |
| *** guoshan has quit IRC | 13:26 | |
| *** guoshan has joined #openstack-keystone | 13:39 | |
| *** erhudy has joined #openstack-keystone | 13:45 | |
| *** clenimar has joined #openstack-keystone | 13:46 | |
| *** guoshan has quit IRC | 13:58 | |
| openstackgerrit | Merged openstack/keystone: fix one typo. https://review.openstack.org/412298 | 14:09 |
| rodrigods | hey, i have some testing patches that would be great to see landing prior holidays :) | 14:09 |
| rodrigods | https://review.openstack.org/#/c/410205/ and https://review.openstack.org/#/c/324769/ | 14:09 |
| *** amoralej is now known as amoralej|lunch | 14:10 | |
| *** lamt has joined #openstack-keystone | 14:11 | |
| *** chlong has joined #openstack-keystone | 14:14 | |
| lbragstad | rodrigods i can add those to my review queue | 14:33 |
| rodrigods | lbragstad, would be great :) | 14:37 |
| *** jamielennox is now known as jamielennox|away | 14:56 | |
| *** amoralej|lunch is now known as amoralej | 14:56 | |
| *** adrian_otto has joined #openstack-keystone | 14:58 | |
| *** adrian_otto has quit IRC | 15:03 | |
| *** mbeierl has left #openstack-keystone | 15:05 | |
| *** sshen has quit IRC | 15:19 | |
| *** jaugustine has joined #openstack-keystone | 15:22 | |
| *** amac has joined #openstack-keystone | 15:23 | |
| amac | Hi, folks -- newb question about getting Keystone (Newton) to work with LDAP/AD. Is this the right place? | 15:24 |
| lbragstad | amac yep - it should be | 15:27 |
| lbragstad | amac we have a few ldap folks in the channel (but i'm not sure if they are on vacation already) | 15:28 |
| lbragstad | crinkle mfisch ayoung dstanek just to name a few | 15:28 |
| amac | That's great! I'll stay on, and dump some information about what I'm looking for in case we're on asynchronously. | 15:29 |
| lbragstad | amac ++ | 15:30 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 15:31 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Just a test with python3 https://review.openstack.org/412500 | 15:31 |
| ayoung | There are AD specific docs out there, too | 15:32 |
| lbragstad | ayoung good point | 15:32 |
| lbragstad | here is one - https://wiki.openstack.org/wiki/HowtoIntegrateKeystonewithAD | 15:33 |
| dstanek | amac: just ask away and someone will eventually answer if they know how to help | 15:35 |
| knikolla | o/ | 15:44 |
| amac | Thanks, lbragstad -- The docs are interesting. One question -- Is the driver = keystone.identity.backends.ldap.Identity still valid? The newest git version of the docs mentions driver = ldap | 15:53 |
| amac | OK -- here's what I am trying to do and what I have done. | 15:53 |
| amac | I'm at Univ. of Virginia, trying to get the existing (and involute) AD system to talk to Keystone. | 15:54 |
| amac | I have the basic setup done and communicating -- it authenticates and binds. When I do something like "open stack user list" or "open stack token issue", however, I get the following: | 15:54 |
| amac | The request you have made requires authentication. (HTTP 401) (Request-ID: req-52cd179b-599c-4c1e-8337-59db7da88bf2) | 15:55 |
| ayoung | amac driver = ldap is the new hotness | 15:55 |
| ayoung | the other was doing a full path, now we go by entrypoints | 15:55 |
| amac | Great. Glad I'm on track. | 15:55 |
| amac | Now, we go through the basic auth OK -- I am getting LDAP communication indicated in the logs. I used wireshark to see what was actually being passed, and I get this: | 15:56 |
| amac | 9 0.100119728 172.16.239.131 -> 128.143.33.140 LDAP 237 searchRequest(7) "cn=Users,dc=eservices,dc=virginia,dc=edu" wholeSubtree | 15:56 |
| amac | 13 0.108524508 128.143.33.140 -> 172.16.239.131 LDAP 258 searchResEntry(7) "CN=ars9ac,CN=Users,DC=eservices,DC=virginia,DC=edu" | searchResDone(7) success | 15:56 |
| amac | 19 0.113703514 172.16.239.131 -> 128.143.33.140 LDAP 221 searchRequest(8) "cn=Users,dc=eservices,dc=virginia,dc=edu" wholeSubtree | 15:56 |
| amac | 26 0.118226237 128.143.33.140 -> 172.16.239.131 LDAP 258 searchResEntry(8) "CN=ars9ac,CN=Users,DC=eservices,DC=virginia,DC=edu" | searchResDone(8) success | 15:56 |
| amac | 31 0.118735800 172.16.239.131 -> 128.143.33.140 LDAP 61 unbindRequest(2) | 15:56 |
| amac | 45 0.136929751 172.16.239.131 -> 128.143.33.140 LDAP 138 bindRequest(1) "CN=ars9ac,CN=Users,DC=eservices,DC=virginia,DC=edu" simple | 15:56 |
| amac | 49 0.143571158 128.143.33.140 -> 172.16.239.131 LDAP 76 bindResponse(1) success | 15:56 |
| amac | 54 0.170426707 172.16.239.131 -> 128.143.33.140 LDAP 221 searchRequest(9) "cn=Users,dc=eservices,dc=virginia,dc=edu" wholeSubtree | 15:56 |
| amac | 60 0.175197412 128.143.33.140 -> 172.16.239.131 LDAP 258 searchResEntry(9) "CN=ars9ac,CN=Users,DC=eservices,DC=virginia,DC=edu" | searchResDone(9) success | 15:56 |
| amac | 66 0.203281605 172.16.239.131 -> 128.143.33.140 LDAP 221 searchRequest(10) "cn=Users,dc=eservices,dc=virginia,dc=edu" wholeSubtree | 15:57 |
| amac | 72 0.207949448 128.143.33.140 -> 172.16.239.131 LDAP 258 searchResEntry(10) "CN=ars9ac,CN=Users,DC=eservices,DC=virginia,DC=edu" | searchResDone(10) success | 15:57 |
| amac | 86 0.220894366 172.16.239.131 -> 128.143.33.140 LDAP 236 searchRequest(11) "OU=MyGroups,dc=eservices,dc=virginia,dc=edu" wholeSubtree | 15:57 |
| amac | 91 0.228672914 128.143.33.140 -> 172.16.239.131 LDAP 1428 searchResEntry(11) "CN=gaussian,OU=MyGroups,DC=eservices,DC=virginia,DC=edu" | searchResEntry(11) "CN=its-all-access,OU=ServiceNow,OU=MyGroups,DC=eservices,DC=virginia,DC=edu" | searchResEntry(11) "CN=SN_ITS-ITIL-Role,OU=MyGroups,DC=eservices,DC=virginia,DC=edu" | searchResEntry(11) "CN=hpc_admin,OU=MyGroups,DC=eservices,DC=virginia,DC=edu" | searchResEntry(11) "CN=hpc_vendor,OU=MyGroup | 15:57 |
| amac | s,DC=eservices,DC=virginia,DC=edu" | searchResEntry(11) "CN=ivyadmin,OU=Ivy,OU=MyGroups,DC=eservices,DC=virginia,DC=edu" | searchResEntry(11) "CN=hpc_build,OU=MyGroups,DC=eservices,DC=virginia,DC=edu" | searchResEntry(11) "CN=Orourke-lab-data,OU=MyGroups,DC=eservices,DC=virgini | 15:57 |
| amac | That last block is just a listing of the groups of which I am a member. That's good -- but has little to do with a user list or authenticating to get a token. | 15:57 |
| amac | I'm stymied at this point -- what am I missing? | 15:57 |
| amac | I can also dump some logs/configs on you, if that's useful. | 15:58 |
| *** mvk has quit IRC | 16:00 | |
| ayoung | amac, so, in the future if you have a load of log data etc to share, use paste. | 16:00 |
| ayoung | http://paste.openstack.org/ | 16:00 |
| amac | Thanks for the tip. :) | 16:00 |
| ayoung | there are a handful of queries that happen when a user authenticates | 16:00 |
| ayoung | first the keystone server users the userid and password to do a simple bind in order to authenticate the user | 16:01 |
| ayoung | this is a security disaster that I hate, and it is so common as to be pathetic | 16:01 |
| ayoung | lets move on | 16:01 |
| ayoung | the rest of the queries are performed by the configured admin user for LDAP, which can be a simple bind | 16:02 |
| ayoung | er | 16:02 |
| amac | On that -- I have a different auth account to do that initial bind | 16:02 |
| ayoung | which can be an anonymous bind I should say | 16:02 |
| amac | and then I use my user account for the rest... I think | 16:02 |
| ayoung | amac, nope | 16:02 |
| *** Guest33254 has quit IRC | 16:02 | |
| *** phalmos has joined #openstack-keystone | 16:02 | |
| ayoung | lets say there are 2 users involved here | 16:02 |
| ayoung | 1. is the human being with the username and password passed in the keystone token request | 16:03 |
| ayoung | 2. is a service account set in the keystone config file | 16:03 |
| ayoung | the initial bind is done as the human | 16:03 |
| *** hugokuo has quit IRC | 16:03 | |
| ayoung | the rest is done based on the config option here: http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n1073 | 16:04 |
| *** ravelar has joined #openstack-keystone | 16:04 | |
| *** tobberyd_ has joined #openstack-keystone | 16:04 | |
| ayoung | "CN=ars9ac,CN=Users,DC=eservices,DC=virginia,DC=edu" | 16:04 |
| ayoung | amac, so is ars9ac the human or the configured service user in your case? | 16:05 |
| ayoung | I'm guessing the human | 16:05 |
| amac | Yes. The service account is what I have set up in the keystone.conf [ldap] section under "user" | 16:05 |
| amac | It's the one that | 16:06 |
| amac | is allowed to use the private LDAP server. | 16:06 |
| amac | Now, to be sure I understand -- I'm trying to authenticate user #1 with the access afforded by #2, correct? | 16:06 |
| *** tobberydberg has quit IRC | 16:07 | |
| ayoung | not quite | 16:07 |
| *** agrebennikov has joined #openstack-keystone | 16:07 | |
| amac | I ran into the anonymous bind issue, by the way (disallowed) and set chase_referrals = 0 | 16:07 |
| *** jlopezgu has quit IRC | 16:07 | |
| *** edmondsw has joined #openstack-keystone | 16:08 | |
| ayoung | the authentication happens using a simple bind with the original users account. The rest is getting information about the user to populate the token | 16:08 |
| *** edmondsw has quit IRC | 16:08 | |
| ayoung | so the service user does a bunch of queries | 16:08 |
| *** edmondsw has joined #openstack-keystone | 16:08 | |
| ayoung | in the subtree "cn=Users,dc=eservices,dc=virginia,dc=edu" is should find the user objects that match the search criteria for your user: | 16:08 |
| ayoung | CN==ars9ac or so it appears | 16:09 |
| *** hugokuo has joined #openstack-keystone | 16:09 | |
| *** tobberyd_ has quit IRC | 16:09 | |
| ayoung | then it lists groups for that user | 16:09 |
| amac | Sounds like what I'm seeing. | 16:10 |
| ayoung | Yep | 16:10 |
| ayoung | and then based on the userid and the groups, Keystone will look up role assignments for the user | 16:10 |
| amac | And that's where the auth fails. What is it looking for? | 16:12 |
| *** edmondsw has quit IRC | 16:12 | |
| *** edmondsw has joined #openstack-keystone | 16:12 | |
| *** jlopezgu has joined #openstack-keystone | 16:12 | |
| ayoung | amac, a role assignment is a record that links a user or group to a project, annotated by a role, usually either `admin` or '_member_' | 16:14 |
| *** pcaruana has quit IRC | 16:15 | |
| *** diazjf has joined #openstack-keystone | 16:15 | |
| ayoung | with SQL, there was an option to have a default project for a user, and an authentication request would look for the value for that project to find the roles. | 16:15 |
| ayoung | But LDAP does not have a way to store that valude | 16:15 |
| ayoung | value | 16:15 |
| ayoung | so you need to request token scoped to a project explicitly when using LDAP | 16:16 |
| amac | aha. Can I use the project "default" (as still defined in SQL) or do I need to be matching a project somehow defined in AD/LDAP? | 16:16 |
| ayoung | when executing via the CLI, this is using the OS_PROJECT_ID env variable, or a combination of OS_PROJECT_DOMAIN_ID/OS_PROJECT_DOMAIN_NAME and the OS_PROJECT_NAME variables | 16:16 |
| *** phalmos has quit IRC | 16:17 | |
| ayoung | any viable project in your database is a viable target for a role assignment | 16:17 |
| *** tqtran has joined #openstack-keystone | 16:21 | |
| amac | So in doing that for all of the projects listed in mysql (for example, user list --project admin), I get similar behavior. Other tries were Default, default, service and demo, as well as some of the groups on the LDAP side. | 16:24 |
| *** browne has joined #openstack-keystone | 16:24 | |
| amac | Am I misunderstanding what a project constitutes? | 16:24 |
| *** tqtran has quit IRC | 16:26 | |
| amac | OK -- for reference, here's the log of my most recent query: http://paste.openstack.org/show/592808/ | 16:30 |
| amac | and config file (sanitized for passwords): http://paste.openstack.org/show/592807/ | 16:31 |
| *** edmondsw has quit IRC | 16:39 | |
| *** edmondsw has joined #openstack-keystone | 16:40 | |
| *** edmondsw has quit IRC | 16:41 | |
| *** edmondsw has joined #openstack-keystone | 16:42 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 16:47 |
| *** edmondsw has quit IRC | 16:47 | |
| *** jaosorior has quit IRC | 16:48 | |
| *** edmondsw has joined #openstack-keystone | 16:48 | |
| *** jaosorior has joined #openstack-keystone | 16:48 | |
| *** edmondsw has quit IRC | 16:52 | |
| *** Zer0Byte__ has joined #openstack-keystone | 17:17 | |
| *** phalmos has joined #openstack-keystone | 17:21 | |
| *** phalmos has quit IRC | 17:32 | |
| *** nicolasbock has quit IRC | 17:43 | |
| *** nicolasbock has joined #openstack-keystone | 17:48 | |
| lbragstad | I have a couple stable/mitaka reviews up for grabs if anyone is interested in reviewing them https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:stable/mitaka+topic:bug/1647800 | 17:50 |
| *** tqtran has joined #openstack-keystone | 17:53 | |
| *** chris_hultin|AWA is now known as chris_hultin | 18:01 | |
| ayoung | once a spec is approvced, where does it show up in the public web? | 18:02 |
| stevemar | ayoung: http://specs.openstack.org/openstack/keystone-specs/ | 18:04 |
| ayoung | stevemar, thanks | 18:04 |
| erhudy | amac: we ended up using LDAP for user authentication but storing projects locally rather than trying to map them into our AD schema | 18:13 |
| erhudy | there was some impedance mismatch the nature of which i no longer recall, but it ended up being easier to write a script that trawled a particular OU in AD and inserted projects into keystone | 18:14 |
| amac | Sounds like a good plan. Did you do that by using multiple domains, or can I do that with my initial single-domain setup? | 18:16 |
| amac | I may do something similar. | 18:16 |
| erhudy | when i started it was keystone v2, we've been migrating clusters to liberty and v3 but sticking to a single-domain setup for now | 18:16 |
| erhudy | so at present we operate entirely in the default domain | 18:17 |
| amac | Great. I'll be using domains eventually, but trying to keep the number of moving parts minimal during the learning process. | 18:17 |
| stevemar | amac: i wrote something up about integrating keystone and ldap a while ago, still applicable: https://developer.ibm.com/opentech/2015/08/14/configuring-keystone-with-ibms-bluepages-ldap/ | 18:17 |
| stevemar | amac: don't worry too much about the domain part :) | 18:17 |
| stevemar | i promise it's painless | 18:18 |
| amac | :) So pleased to hear it. | 18:18 |
| *** diazjf has quit IRC | 18:18 | |
| amac | I ran across this doc when I was trawling for information -- wasn't sure if it was up to date. I'm pleased to know it's still germane. | 18:18 |
| amac | stevemar I'll dig deeper and see if I can get this moving. | 18:19 |
| ayoung | You can't store projects in LDAP anymore anyway | 18:31 |
| amac | That was my impression -- that all modification had to be local. | 18:45 |
| openstackgerrit | Merged openstack/keystone: Fix typo in doc https://review.openstack.org/412313 | 19:03 |
| *** browne has quit IRC | 19:05 | |
| *** david-lyle_ has joined #openstack-keystone | 19:13 | |
| *** openstackstatus has quit IRC | 19:13 | |
| *** david-lyle has quit IRC | 19:13 | |
| *** openstack has joined #openstack-keystone | 19:13 | |
| amac | stevemar, thanks for the help with the domains thing. It's behaving at least as well as the single-domain for now. :) | 19:25 |
| *** diazjf has joined #openstack-keystone | 19:34 | |
| *** chlong has quit IRC | 19:34 | |
| *** chlong has joined #openstack-keystone | 19:36 | |
| stevemar | amac: nice | 19:51 |
| stevemar | amac: glad it can help! | 19:51 |
| *** jaosorior has quit IRC | 19:52 | |
| *** rcernin has joined #openstack-keystone | 19:56 | |
| lbragstad | gagehugo you haven't submitted a review addressing the following on comments for https://review.openstack.org/#/c/400882/6 yet - have you? | 20:00 |
| amac | So I am trying a variety of things to try and get authentication working. I'm sort of back to where I started -- the query goes and gets all of the relevant information, groups, etc. The user I am trying to authenticate (the OS_USERNAME/OS_PASSWORD) is created in the Keystone/user table in the local MySQL DB. But I hit this authentication issue. There's no LDAP 52e error (bad password). I am using a project/domain combo that are in the MySQL DB. | 20:01 |
| amac | And here's the error: keystone.common.wsgi [req-35c7c86e-c72a-4118-aaf5-174b76273e2d - - - - -] Authorization failed. The request you have made requires authentication. from ::1 | 20:01 |
| gagehugo | lbragstad: the 'a' and 'truse' typos? I have not for those | 20:01 |
| lbragstad | gagehugo ok - just checking | 20:02 |
| gagehugo | lbragstad I will make sure to fix them in another patch though if that is fine | 20:03 |
| lbragstad | gagehugo absolutely - since that patch is already gating I wouldn't propose another patch set to it | 20:03 |
| gagehugo | ok | 20:03 |
| *** breton_ is now known as breton | 20:04 | |
| lbragstad | gagehugo i wanted to make sure if there was a patch up fixing those minor comments - I'd review it right away, since its an easy +2 fast following the original patch | 20:04 |
| amac | And here are the configs as they stand. http://paste.openstack.org/show/592840/ | 20:06 |
| amac | I have made sure that I am using correct project and domain designations, and that they are present in the MySQL DB per ayoung's excellent suggestions. | 20:07 |
| *** diazjf has quit IRC | 20:07 | |
| ayoung | from ::1 You doing IPV6? Cool | 20:08 |
| ayoung | There's no LDAP 52e error (bad password) is either the simple bind failing | 20:08 |
| ayoung | or the service user | 20:08 |
| amac | Not intentionally. :) | 20:08 |
| ayoung | ah..you don't see that... | 20:08 |
| ayoung | misread | 20:08 |
| ayoung | amac, suggest you use the CLI and do a openstack token issue | 20:09 |
| ayoung | that will confirm you can get an unscoped token | 20:09 |
| amac | I can do an issue as long as LDAP is not engaged. | 20:10 |
| amac | And as long as I am using the "admin" user I created in the setup. | 20:11 |
| amac | Using ars9ac fails | 20:11 |
| *** amoralej is now known as amoralej|off | 20:17 | |
| amac | Is there a way to turn up the debugging output in the logs for keystone? The only verbose debugging flag I see is in oslo.log, and it's set to be deprecated. | 20:24 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP add query for unique_id in list_users https://review.openstack.org/412608 | 20:24 |
| amac | Is there a way to turn up the debugging output in the logs for keystone? The only verbose debugging flag I see is in oslo.log, and it's set to be deprecated. | 20:26 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP add query for unique_id in list_users https://review.openstack.org/412608 | 20:27 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Set the domain for federated users https://review.openstack.org/408332 | 20:30 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Set the domain for federated users https://review.openstack.org/408332 | 20:32 |
| *** adriant has joined #openstack-keystone | 20:36 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 20:36 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 20:37 |
| lbragstad | rderose dstanek do you guys remember that weird case we were hitting when we tried to use freezegun's `tick()` method to advance the time context by hours or days? | 20:42 |
| *** iurygregory has quit IRC | 20:42 | |
| lbragstad | rderose dstanek looks like gagehugo found an interesting work-around for that (see my comment on line 745 https://review.openstack.org/#/c/396752/34/keystone/tests/unit/common/test_notifications.py ) | 20:43 |
| rderose | lbragstad: cool, let me take a look | 20:44 |
| lbragstad | rderose i thought our work around for that was just setting really short token validation times - or password expiration times, so that advancing the clock with freezegun would actually work | 20:45 |
| rderose | lbragstad: yeah, was only able o get it to work in seconds; hours or days would hit that strange error | 20:46 |
| rderose | gagehugo: nice! | 20:47 |
| lbragstad | rderose right - i guess the test in gagehugo's patch gets around that specific situation | 20:47 |
| rderose | lbragstad: so you don't tick the time a head; just set it and stop after doing some work | 20:49 |
| rderose | looks like | 20:49 |
| gagehugo | lbragstad rderose freezegun is interesting | 20:49 |
| gagehugo | https://github.com/spulec/freezegun#moving-time-to-specify-datetime | 20:49 |
| lbragstad | rderose right - for that case just freeze time, do something, then unfreeze | 20:49 |
| gagehugo | I'm pretty sure that's the example I followed when I made that test | 20:49 |
| rderose | gagehugo: sweet! | 20:50 |
| lbragstad | gagehugo so - by unfreezing you're effectively advancing the clock | 20:50 |
| lbragstad | you could reverse the clock, too I suppose | 20:51 |
| gagehugo | lbragstad yes that is how I took it | 20:51 |
| lbragstad | it just depends on what the datetime.timedelta objects is | 20:51 |
| lbragstad | gagehugo nice - that's a cool trick | 20:52 |
| gagehugo | lbragstad I have not tried out the tick function yet though | 20:55 |
| dstanek | lbragstad: looking | 20:56 |
| *** amac has quit IRC | 20:57 | |
| *** jamielennox|away is now known as jamielennox | 21:04 | |
| *** raildo has quit IRC | 21:10 | |
| breton | ayoung: are you subscribed to cryptography-dev@python.org? | 21:31 |
| *** ravelar has quit IRC | 21:34 | |
| *** ravelar has joined #openstack-keystone | 21:36 | |
| *** amac has joined #openstack-keystone | 21:45 | |
| *** browne has joined #openstack-keystone | 21:53 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 21:57 |
| stevemar | gagehugo: nice | 22:01 |
| *** dave-mccowan has joined #openstack-keystone | 22:11 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: WIP - Allow user to change own expired password https://review.openstack.org/404022 | 22:11 |
| *** ravelar has quit IRC | 22:25 | |
| *** ravelar has joined #openstack-keystone | 22:42 | |
| *** mvk has joined #openstack-keystone | 22:51 | |
| Zer0Byte__ | hey someone alive | 22:53 |
| Zer0Byte__ | ? | 22:53 |
| Zer0Byte__ | OS_PROJECT_DOMAIN_ID is still used on Newton futher versions? | 22:54 |
| Zer0Byte__ | mitaka also | 22:54 |
| Zer0Byte__ | ? | 22:54 |
| *** ravelar has quit IRC | 23:04 | |
| *** ravelar has joined #openstack-keystone | 23:11 | |
| *** edmondsw has joined #openstack-keystone | 23:25 | |
| *** ravelar has quit IRC | 23:28 | |
| *** edmondsw has quit IRC | 23:30 | |
| *** lamt has quit IRC | 23:32 | |
| *** jaugustine has quit IRC | 23:36 | |
| *** ravelar has joined #openstack-keystone | 23:36 | |
| *** agrebennikov has quit IRC | 23:38 | |
| *** dave-mccowan has quit IRC | 23:50 | |
| *** nicolasbock has quit IRC | 23:54 | |
| stevemar | Zer0Byte__: should be usable pretty far back | 23:58 |
| Zer0Byte__ | so is not on newer versions serverascode ? | 23:58 |
| Zer0Byte__ | stevemar | 23:58 |
| Zer0Byte__ | ? | 23:58 |
| stevemar | Zer0Byte__: it should still work today too | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!