| *** IRCFrEAK has joined #openstack-keystone | 00:53 | |
| *** IRCFrEAK has left #openstack-keystone | 00:53 | |
| *** hoangcx has joined #openstack-keystone | 00:53 | |
| *** edmondsw has quit IRC | 00:54 | |
| *** martinlopes has quit IRC | 00:54 | |
| *** martinlopes has joined #openstack-keystone | 00:56 | |
| *** markvoelker_ has quit IRC | 01:05 | |
| *** chlong has joined #openstack-keystone | 01:06 | |
| *** liujiong has joined #openstack-keystone | 01:16 | |
| *** ngupta has quit IRC | 01:22 | |
| *** rdo has quit IRC | 01:22 | |
| *** rdo has joined #openstack-keystone | 01:30 | |
| *** bjolo_ has quit IRC | 01:51 | |
| *** guoshan has joined #openstack-keystone | 01:54 | |
| *** martinlopes has quit IRC | 02:06 | |
| *** thorst has joined #openstack-keystone | 02:11 | |
| *** thorst has quit IRC | 02:11 | |
| *** hoangcx has quit IRC | 02:16 | |
| *** ngupta has joined #openstack-keystone | 02:22 | |
| *** hoangcx has joined #openstack-keystone | 02:22 | |
| *** hoangcx_ has joined #openstack-keystone | 02:25 | |
| *** ngupta has quit IRC | 02:26 | |
| *** hoangcx has quit IRC | 02:28 | |
| *** tovin07 has joined #openstack-keystone | 02:35 | |
| *** tovin07 has left #openstack-keystone | 02:38 | |
| *** tovin07 has joined #openstack-keystone | 02:43 | |
| openstackgerrit | Shan Guo proposed openstack/keystone master: Fix typo in config doc https://review.openstack.org/435830 | 02:43 |
|---|---|---|
| *** edmondsw has joined #openstack-keystone | 02:54 | |
| *** edmondsw has quit IRC | 02:59 | |
| *** obedmr has quit IRC | 03:19 | |
| *** obedmr has joined #openstack-keystone | 03:20 | |
| *** edmondsw has joined #openstack-keystone | 03:30 | |
| *** edmondsw has quit IRC | 03:35 | |
| *** madgoat has joined #openstack-keystone | 03:59 | |
| *** madgoat has left #openstack-keystone | 03:59 | |
| *** guoshan has quit IRC | 04:15 | |
| *** nicolasbock has quit IRC | 04:27 | |
| *** dave-mccowan has quit IRC | 04:29 | |
| *** martinlopes has joined #openstack-keystone | 04:39 | |
| *** nkinder has joined #openstack-keystone | 04:56 | |
| *** adriant has quit IRC | 04:58 | |
| *** guoshan has joined #openstack-keystone | 05:02 | |
| *** nkinder has quit IRC | 05:09 | |
| *** ngupta has joined #openstack-keystone | 05:40 | |
| *** guoshan has quit IRC | 05:45 | |
| *** jaosorior has joined #openstack-keystone | 05:49 | |
| *** guoshan has joined #openstack-keystone | 05:58 | |
| *** thorst has joined #openstack-keystone | 06:11 | |
| *** thorst has quit IRC | 06:15 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Remove unused logging import https://review.openstack.org/435203 | 06:19 |
| openstackgerrit | Merged openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/431959 | 06:19 |
| openstackgerrit | Merged openstack/keystone master: Updated from global requirements https://review.openstack.org/431886 | 06:22 |
| openstackgerrit | Merged openstack/keystoneauth master: Fix ClientException message property not set properly https://review.openstack.org/285757 | 06:23 |
| openstackgerrit | Merged openstack/keystoneauth master: Updated from global requirements https://review.openstack.org/431958 | 06:47 |
| openstackgerrit | Merged openstack/keystoneauth master: Fixed multiple target Auth warning in docstring https://review.openstack.org/431184 | 06:48 |
| *** martinlopes has quit IRC | 07:13 | |
| *** tesseract has joined #openstack-keystone | 07:17 | |
| openstackgerrit | Merged openstack/keystone master: Fix typo in config doc https://review.openstack.org/435830 | 07:28 |
| *** edmondsw has joined #openstack-keystone | 07:32 | |
| *** edmondsw has quit IRC | 07:36 | |
| openstackgerrit | Richard Avelar proposed openstack/python-keystoneclient master: do not merge: test ksc gate https://review.openstack.org/435492 | 07:47 |
| *** pcaruana has joined #openstack-keystone | 08:28 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:01 | |
| *** xek_ is now known as xek | 09:07 | |
| *** arunkant has quit IRC | 09:16 | |
| *** thorst has joined #openstack-keystone | 09:19 | |
| *** masber has joined #openstack-keystone | 09:21 | |
| *** arunkant has joined #openstack-keystone | 09:22 | |
| *** h5t4 has joined #openstack-keystone | 09:30 | |
| *** iljal has joined #openstack-keystone | 09:31 | |
| *** thorst has quit IRC | 09:56 | |
| *** tovin07 has quit IRC | 10:10 | |
| *** guoshan has quit IRC | 10:14 | |
| *** hoangcx_ has quit IRC | 10:25 | |
| *** liujiong has quit IRC | 10:30 | |
| *** thorst has joined #openstack-keystone | 10:32 | |
| *** mvk has quit IRC | 10:34 | |
| *** hoonetorg has quit IRC | 10:37 | |
| *** hoonetorg has joined #openstack-keystone | 10:59 | |
| openstackgerrit | Merged openstack/keystone master: Rename protocol cascade delete migration file https://review.openstack.org/433644 | 11:05 |
| *** thorst has quit IRC | 11:13 | |
| *** mvk has joined #openstack-keystone | 11:22 | |
| *** thorst has joined #openstack-keystone | 11:29 | |
| *** martinus- has quit IRC | 11:30 | |
| *** martinus__ has joined #openstack-keystone | 11:30 | |
| *** edmondsw has joined #openstack-keystone | 11:33 | |
| *** thorst has quit IRC | 11:33 | |
| *** edmondsw has quit IRC | 11:37 | |
| *** iljal has quit IRC | 11:44 | |
| *** iljal has joined #openstack-keystone | 11:49 | |
| *** iljal_ has joined #openstack-keystone | 11:49 | |
| *** iljal has quit IRC | 11:53 | |
| *** nicolasbock has joined #openstack-keystone | 11:56 | |
| *** edmondsw has joined #openstack-keystone | 12:02 | |
| *** iljal_ has quit IRC | 12:11 | |
| *** catintheroof has joined #openstack-keystone | 12:39 | |
| *** catinthe_ has joined #openstack-keystone | 12:41 | |
| *** catintheroof has quit IRC | 12:45 | |
| *** nishaYadav_ has joined #openstack-keystone | 13:07 | |
| *** markvoelker has joined #openstack-keystone | 13:09 | |
| *** markvoelker_ has joined #openstack-keystone | 13:11 | |
| *** markvoelker has quit IRC | 13:14 | |
| *** dave-mccowan has joined #openstack-keystone | 13:15 | |
| *** chlong has quit IRC | 13:16 | |
| *** markvoelker has joined #openstack-keystone | 13:19 | |
| *** markvoelker_ has quit IRC | 13:21 | |
| *** markvoelker_ has joined #openstack-keystone | 13:21 | |
| *** markvoelker has quit IRC | 13:24 | |
| *** darrenc_ has joined #openstack-keystone | 13:34 | |
| *** markvoelker has joined #openstack-keystone | 13:34 | |
| *** darrenc has quit IRC | 13:35 | |
| *** jhesketh has quit IRC | 13:35 | |
| *** markvoelker_ has quit IRC | 13:35 | |
| *** raildo has joined #openstack-keystone | 13:35 | |
| *** lucasxu has joined #openstack-keystone | 13:35 | |
| *** iljal has joined #openstack-keystone | 13:35 | |
| *** v1k0d3n has joined #openstack-keystone | 13:35 | |
| *** jhesketh has joined #openstack-keystone | 13:37 | |
| *** lucasxu has quit IRC | 13:39 | |
| *** lucasxu has joined #openstack-keystone | 13:40 | |
| *** spilla has joined #openstack-keystone | 13:45 | |
| *** lucasxu has quit IRC | 13:46 | |
| *** dikonoor has joined #openstack-keystone | 13:57 | |
| *** jamielennox|away is now known as jamielennox | 14:06 | |
| dikonoor | lbragstad: hi.. | 14:07 |
| lbragstad | dikonoor | 14:07 |
| lbragstad | hello | 14:07 |
| dikonoor | lbragstad: Good Morning :) this is about https://bugs.launchpad.net/keystone/+bug/1662514, which is causing a bit of pain in the brain as group revocations are causing havoc. | 14:08 |
| openstack | Launchpad bug 1662514 in OpenStack Identity (keystone) "Revoking a non-existing role revokes token for users of same role" [Undecided,New] | 14:08 |
| *** akrzos is now known as akrzos-ptg | 14:08 | |
| dikonoor | lbragstad: You and dstanek and morgan had a discussion with praskre on this last week. | 14:09 |
| dikonoor | lbragstad: the basic problem as listed are q) revocation events getting generated if you try to remove non-existent role assignment | 14:10 |
| dikonoor | lbragstad: b) the other main problem being the revocation event generated for group revocation generates and event with only project/domain id and role | 14:11 |
| lbragstad | dikonoor yeah - that sounds accurate | 14:11 |
| dikonoor | which basically means that after that all tokens with that project/domain and role gets revoked | 14:11 |
| dikonoor | irrespective of which group they have assignment to | 14:12 |
| *** edmondsw has quit IRC | 14:12 | |
| dikonoor | SO if I have two groups - group A and B , both with admin role assignment to the same project, and if I revoke role grant from any of them..all user within both these groups + users with direct role assignment against this project/domain with the same role - all get revokes | 14:13 |
| dikonoor | mass revocation happens.. | 14:14 |
| dikonoor | One of the solutions that praskre suggested the other day was to add a new column to the revocation_event table . the new colume will be named group_id | 14:14 |
| *** edmondsw has joined #openstack-keystone | 14:16 | |
| *** thiagolib has joined #openstack-keystone | 14:16 | |
| dikonoor | lbragstad: so that the group_id also gets added into the revocation events table when group grant is removed | 14:16 |
| *** edmondsw_ has joined #openstack-keystone | 14:17 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth master: Add loading mock fixtures https://review.openstack.org/436012 | 14:17 |
| dikonoor | lbragstad : When the token check happens against the revocaton events, we then check if the user belongs to this group . | 14:19 |
| *** edmondsw_ has quit IRC | 14:19 | |
| *** edmondsw_ has joined #openstack-keystone | 14:19 | |
| *** nishaYadav_ has quit IRC | 14:19 | |
| dikonoor | lbragstad: dstanek:morgan: Do you see any challenges with this approach ? | 14:19 |
| lbragstad | I'd try solving the first problem | 14:21 |
| *** edmondsw has quit IRC | 14:21 | |
| lbragstad | which should be a matter of validating the role before creating the revocation event | 14:21 |
| lbragstad | and start with that | 14:21 |
| morgan | will need to think about it. headed to the airport ATM. | 14:21 |
| morgan | can talk when I arrive. | 14:22 |
| *** nishaYadav has joined #openstack-keystone | 14:22 | |
| dikonoor | lbragstad: you mean validate if the group has that role before creating the event..Agree..that way no event is created | 14:22 |
| nishaYadav | o/ | 14:22 |
| dikonoor | lbragstad: Now comes the second problem of mass revocation of any user/group within that domain/project with the same role.. | 14:23 |
| lbragstad | dikonoor and this is when you remove a role from a group, right? | 14:24 |
| dikonoor | yes right >> openstack role remove --group abc --project abc admin for eg. | 14:25 |
| dikonoor | lbragstad : the bug description shows the revocation event in the table for this >> https://bugs.launchpad.net/keystone/+bug/1662514 | 14:25 |
| openstack | Launchpad bug 1662514 in OpenStack Identity (keystone) "Revoking a non-existing role revokes token for users of same role" [Undecided,New] | 14:25 |
| *** lucasxu has joined #openstack-keystone | 14:28 | |
| dikonoor | lbragstad: we tries removing a role assignment with project scope | 14:28 |
| *** r1chardj0n3s has quit IRC | 14:29 | |
| *** darrenc_ has quit IRC | 14:29 | |
| *** darrenc has joined #openstack-keystone | 14:29 | |
| *** r1chardj0n3s has joined #openstack-keystone | 14:30 | |
| lbragstad | dikonoor another possible option would be to determine the list of projects a user has access to at token validation time and return a 401 if the token context has a different set of groups than what they have at time of validation | 14:32 |
| openstackgerrit | Nisha Yadav proposed openstack/keystone-specs master: Fix typos and grammatical errors https://review.openstack.org/436026 | 14:33 |
| lbragstad | that still might be too broad for revoking other tokens too though | 14:33 |
| nishaYadav | lbragstad, can you please look at the patch once, its a trivial patch ^ | 14:34 |
| lbragstad | nishaYadav yeah - i can take a look | 14:34 |
| dikonoor | lbragstad : the group_id column should take care of all cases except one. | 14:35 |
| *** tqtran has joined #openstack-keystone | 14:35 | |
| nishaYadav | lbragstad, thank you :) | 14:35 |
| lbragstad | dikonoor and what case is that? | 14:35 |
| dikonoor | well..I dont know if this is how the behavior should be.. LEts say i have a user with a direct role assignment to a project with some role say admin..The user is part of a group..I then add a group role assignment for this group with same role, same project/domain | 14:37 |
| dikonoor | So , now user has 2 role assignments - one ddirect and the other inherited | 14:38 |
| *** John341 has joined #openstack-keystone | 14:38 | |
| dikonoor | Then we remove the group role assignment, which generates the revocation evetn (and lets say we now have a group id column and that has the group_id) | 14:38 |
| dikonoor | The token corresponding to this user will be revoked | 14:39 |
| John341 | Hi all! Can anyone please clarify, when I issue a fernet token, do I use 'id' found in the body in subsequent requests as X-Auth-Token:, or do I use 'X-Subject-Token' from the header? | 14:39 |
| dikonoor | even though the direct role assignment of the user is not | 14:39 |
| John341 | The documentation here claims that the 'id' should be provided in subsequent requests, https://developer.openstack.org/api-ref/identity/v3/?expanded=password-authentication-with-unscoped-authorization-detail,token-authentication-with-scoped-authorization-detail#authentication-and-token-management | 14:40 |
| dikonoor | lbragstad: but if we do it the other way around..the behavior is different..for eg. if i revoke the user role grant, it generates a revocation event very specific to the user ..The check_token checks checking for is_revoked of the token will fail only for that specific user | 14:42 |
| lbragstad | dikonoor hmm | 14:42 |
| lbragstad | right - i would expect the token to be valid in both cases | 14:42 |
| dikonoor | lbragstad : In short ..group role revokes ensures that all users within that group are revoked (even if one or more users have direct role assignments) | 14:43 |
| dikonoor | So effectively we have 3 problems..Not sure if we need 3 LP bugs.. | 14:43 |
| *** jperry has joined #openstack-keystone | 14:43 | |
| dikonoor | I got to step out now..Will be back soon..Problem 1 and problem 2 can be fixed..I am not sure of how problem 3 can be tackled | 14:44 |
| dikonoor | Also problem 2 - group_id column is what I think would be the best option..another option is to reuse the user_id column to populate group_id | 14:44 |
| dikonoor | lbargstad: I have to step out..I will login later.. | 14:46 |
| dikonoor | lbargstad: prashkre is thinking of putting out a patch with a new group_id column.. | 14:47 |
| lbragstad | dikonoor yeah - that'd be great! | 14:47 |
| lbragstad | if anything it will help us flush out other proposals | 14:47 |
| lbragstad | if we decide to go a different route | 14:47 |
| lbragstad | dikonoor i'm going to update the bugs and split them up a bit, so we track the right problems to the right bugs | 14:48 |
| lbragstad | John341 if you're using v3, when you authenticate for a token you'll have to pull the token out of the X-Subject-Token header | 14:55 |
| *** darrenc has quit IRC | 14:55 | |
| *** chlong has joined #openstack-keystone | 14:55 | |
| *** darrenc has joined #openstack-keystone | 14:56 | |
| *** nishaYadav has quit IRC | 14:56 | |
| *** thorst has joined #openstack-keystone | 15:02 | |
| *** thorst has quit IRC | 15:05 | |
| *** thorst has joined #openstack-keystone | 15:06 | |
| *** thorst_ has joined #openstack-keystone | 15:07 | |
| *** thorst has quit IRC | 15:10 | |
| *** lucasxu has quit IRC | 15:11 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:21 | |
| *** lucasxu has joined #openstack-keystone | 15:22 | |
| *** lucasxu has quit IRC | 15:24 | |
| *** chris_hultin is now known as chris_hultin|AWA | 15:35 | |
| h5t4 | Hi, I see following problem. Project scoped, 'admin' named, role not recognized at all. And global 'admin' role allows domain_admin and project_admin delete VM's from another domain/project - included VM's from cloud_admin project. I am using keystone 'https://git.openstack.org/openstack/openstack-ansible-os_keyston' commit 'f4eabced3e96187bf5a3ffebaac4a14d15f30619' and | 15:40 |
| h5t4 | 'https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json' Is it known issue? | 15:40 |
| h5t4 | sorry <Domain> scoped, 'admin' named | 15:41 |
| *** thorst_ has quit IRC | 15:42 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth master: Add loading mock fixtures https://review.openstack.org/436012 | 15:43 |
| *** browne has joined #openstack-keystone | 15:46 | |
| *** thorst has joined #openstack-keystone | 15:49 | |
| h5t4 | For me it seems that there can be only one admin role per cloud. _member_ role seems to work fine in multi domain environment. | 15:50 |
| *** david-lyle has joined #openstack-keystone | 15:53 | |
| *** lucasxu has joined #openstack-keystone | 15:53 | |
| *** thorst has quit IRC | 15:54 | |
| *** lamt has joined #openstack-keystone | 15:54 | |
| *** thorst has joined #openstack-keystone | 15:57 | |
| *** iljal_ has joined #openstack-keystone | 15:58 | |
| *** iljal__ has joined #openstack-keystone | 15:59 | |
| *** lamt has quit IRC | 16:02 | |
| *** iljal has quit IRC | 16:02 | |
| *** iljal_ has quit IRC | 16:03 | |
| *** lamt has joined #openstack-keystone | 16:03 | |
| *** lamt has quit IRC | 16:08 | |
| *** david-lyle has quit IRC | 16:18 | |
| *** thiagolib has quit IRC | 16:21 | |
| *** iljal__ has quit IRC | 16:23 | |
| *** mvk has quit IRC | 16:27 | |
| *** iljal has joined #openstack-keystone | 16:33 | |
| dikonoor | lbragstad: Thanks for updating the bug and splitting it into two parts. | 16:35 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Policy in code https://review.openstack.org/435609 | 16:36 |
| lbragstad | dikonoor no problem | 16:36 |
| *** lucasxu has quit IRC | 16:37 | |
| dikonoor | ibragstad : prashkre will send across changes with group_id shortly. | 16:38 |
| *** h5t4 has quit IRC | 16:40 | |
| lbragstad | dikonoor good deal! | 16:43 |
| *** browne has quit IRC | 16:48 | |
| morgan | lbragstad: wait what was that about validation and 401s on group change? | 16:51 |
| lbragstad | morgan when a role assignment is removed from a group, the revocation event that is persisted is too broad | 16:52 |
| morgan | lbragstad: something sounds very wrong with that statement. | 16:52 |
| morgan | the 401 one | 16:52 |
| morgan | what is too broad about it specifically? | 16:53 |
| lbragstad | morgan https://bugs.launchpad.net/keystone/+bug/1662514 | 16:53 |
| openstack | Launchpad bug 1662514 in OpenStack Identity (keystone) "Removing group role assignments results in overly broad revocation events" [Undecided,New] | 16:53 |
| morgan | there is another fix | 16:53 |
| *** tqtran has quit IRC | 16:53 | |
| morgan | stop persisting uuid token data in the db, validate uuid tokens like fernet | 16:54 |
| *** pcaruana has quit IRC | 16:54 | |
| lbragstad | morgan we do | 16:54 |
| morgan | then we can drop that type of rev event entirely | 16:54 |
| morgan | then that type of event shouldnt be ever created. | 16:54 |
| lbragstad | morgan that's not the problem - we don't store revocation events based on group | 16:54 |
| morgan | Sec. let me switch to laptop. | 16:54 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Policy in code (part 2) https://review.openstack.org/435751 | 16:54 |
| *** tqtran has joined #openstack-keystone | 16:54 | |
| lbragstad | morgan the problem is that we store revocation events with a role id and project id, which applies to direct role assignment and group role assignments | 16:55 |
| *** thorst has quit IRC | 16:55 | |
| morgan | lbragstad: ok | 16:57 |
| morgan | lbragstad: so if we validate *all* tokens like fernet, where we re-populate roles every time on validation | 16:57 |
| lbragstad | so if i have a project 'engineering' and a group called 'engineers' and they have the 'engineer' role, but Bob *also* has the 'engineer' role, then if I remove the 'engineer' role from the 'engineers' group, Bob's tokens scoped to 'engineering' are also revoked | 16:57 |
| morgan | lbragstad: we should NEVER need to revoke on a role being removed from a group | 16:57 |
| morgan | unless there is no longer a role at all on the project | 16:58 |
| morgan | and even then... a null list of roles should net us the same effect. | 16:58 |
| lbragstad | roles can be calculated at validation time, and I completely agree with that approach | 16:58 |
| morgan | in short, if we always validate in the same manner and repopulate the token data on validation, we can drop revocation events almost entirely. | 16:58 |
| morgan | the exceptions are: user password change | 16:58 |
| morgan | group removal | 16:59 |
| morgan | and like 1-2 others | 16:59 |
| morgan | but basically, don't try and fix revocation events, fix token validation | 16:59 |
| morgan | it is a much narrower case and we can reduce reliance on revocations further | 16:59 |
| morgan | therefore making keysotne genrally more performant in more cases. revocation events are a real issue with performance at this point | 16:59 |
| morgan | sorry, had to swithc to the laptop to type that out. doing it on the phone was getting frustrating | 17:00 |
| morgan | :P | 17:00 |
| morgan | lets not lean more on revocations, which we know are painful | 17:01 |
| *** lucasxu has joined #openstack-keystone | 17:04 | |
| *** thorst has joined #openstack-keystone | 17:05 | |
| lbragstad | morgan right - i don't disagree with you there | 17:05 |
| lbragstad | morgan but i think we already calculate group assignments on the fly at validation time | 17:05 |
| morgan | so then... just stop issuing those rev. events | 17:06 |
| morgan | see what breaks | 17:06 |
| lbragstad | when we ask the assignment api for a list of role assignments based on the user and the project | 17:06 |
| morgan | uuid tokens iirc never were updated to validate like fernet tokens | 17:06 |
| *** v1k0d3n has quit IRC | 17:06 | |
| morgan | we still have two WILDLY different paths of validation | 17:06 |
| lbragstad | morgan yes there were | 17:06 |
| lbragstad | morgan not any more | 17:06 |
| lbragstad | morgan i fixed all that last release | 17:06 |
| morgan | good, we should stop storing as much data as we do in the DB for uuid, and store the same data as the fernet payload then | 17:07 |
| morgan | :P | 17:07 |
| morgan | i am surprised fwiw, i was shot down really hard when i suggested making uuid tokens validate that way | 17:07 |
| lbragstad | yeah - that would be the next steo | 17:07 |
| lbragstad | step* | 17:07 |
| morgan | everyone told me they hated the idea and it would make uuid tokens suck. | 17:07 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Policy in code (part 2) https://review.openstack.org/435751 | 17:08 |
| lbragstad | morgan https://review.openstack.org/#/q/status:merged+project:openstack/keystone+branch:master+topic:cleanup-token-provider | 17:08 |
| morgan | nice | 17:08 |
| *** markvoelker has quit IRC | 17:08 | |
| *** charz has quit IRC | 17:09 | |
| *** d0ugal has quit IRC | 17:09 | |
| *** iljal has quit IRC | 17:09 | |
| *** zzzeek has quit IRC | 17:09 | |
| *** jefrite_ has quit IRC | 17:09 | |
| *** chrome0_ has quit IRC | 17:09 | |
| *** tqtran has quit IRC | 17:09 | |
| morgan | just store the fernet payload then merge all that code into something less all over the place | 17:09 |
| *** charz_ has joined #openstack-keystone | 17:09 | |
| morgan | then #win | 17:09 |
| *** zzzeek has joined #openstack-keystone | 17:09 | |
| *** jamielennox is now known as jamielennox|away | 17:09 | |
| *** chrome0 has joined #openstack-keystone | 17:09 | |
| *** jefrite has joined #openstack-keystone | 17:09 | |
| *** h5t4 has joined #openstack-keystone | 17:09 | |
| *** thorst has quit IRC | 17:09 | |
| *** d0ugal has joined #openstack-keystone | 17:10 | |
| morgan | ok logging back off to find my plane. | 17:12 |
| lbragstad | morgan o/ | 17:12 |
| lbragstad | morgan have a safe flight | 17:12 |
| *** browne has joined #openstack-keystone | 17:14 | |
| *** browne has quit IRC | 17:14 | |
| *** edmondsw_ has quit IRC | 17:15 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Policy in code (part 3) https://review.openstack.org/435754 | 17:15 |
| *** mvk has joined #openstack-keystone | 17:17 | |
| *** edmondsw has joined #openstack-keystone | 17:18 | |
| *** edmondsw has quit IRC | 17:20 | |
| *** edmondsw has joined #openstack-keystone | 17:20 | |
| *** browne has joined #openstack-keystone | 17:25 | |
| *** edmondsw has quit IRC | 17:25 | |
| dikonoor | lbragstad: Hi.. On your latest comments - "Another possible solution to this problem would be to stop persisting | 17:29 |
| dikonoor | revocation events when removing group assignments. As of a release or | 17:29 |
| dikonoor | two ago, we refactored all the token provider logic to validate tokens | 17:29 |
| dikonoor | the same way [0]. This means that we rebuild the assignments at | 17:29 |
| dikonoor | validation time, which might mean we no longer need to persist a | 17:29 |
| dikonoor | revocation event here.".. | 17:29 |
| lbragstad | dikonoor yep | 17:30 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Policy in code https://review.openstack.org/435609 | 17:30 |
| dikonoor | lbragstad: you mean that everytime we check if the role assignment for that token is present in the assignments table.. | 17:31 |
| dikonoor | lbragstad: which wouldn't work for the cases where that specific token has been revoked, in which case it still has to be checked against the revocation table | 17:32 |
| lbragstad | dikonoor we revoke individual tokens by audit id | 17:32 |
| lbragstad | dikonoor not user-project-role relationships | 17:32 |
| dikonoor | lbradstad- yeah right..so when a token comes up for is_revoked check, there still needs to be check against the revocation table to see if that specific token was revoked by its audit_id | 17:33 |
| lbragstad | dikonoor yes | 17:34 |
| lbragstad | either way we have to check for revocations because there are some things we will only be able to accomplish by using revocation events | 17:34 |
| *** jaosorior has quit IRC | 17:35 | |
| lbragstad | for example, fernet tokens aren't persisted, so we revoke them by audit_id since it's something we can guarantee to be in the token | 17:35 |
| lbragstad | versus revoking uuid tokens, in the past we use to just remove them from the database | 17:35 |
| lbragstad | dikonoor the point that morgan was making is that we should try to rebuild all authorization context at validation time instead of relying on revocation events | 17:36 |
| dikonoor | lbragstad : let me read morgan's comments | 17:37 |
| lbragstad | because technically - if we rebuild the authorization context at validation time, that should tell us exactly what we have access to because we are check the assignments in real time | 17:37 |
| lbragstad | we shouldn't have to rely on a revocation event to tell us about group assignments | 17:37 |
| lbragstad | for example - when we build a list of assignments when we validate a token, group assignments should be included in that list | 17:38 |
| *** tesseract has quit IRC | 17:40 | |
| lbragstad | say a user has a group assignment on the 'accounting' project, if we remove that group assignment and that user validates a token scoped to that project, we should be able to determine at validation time that user doesn't have any role assignment on the 'accounting' project so we should return a 401 | 17:40 |
| lbragstad | so - because we're building the list of assignments for a user at token validation time, we're handling revocation automatically due to the design | 17:41 |
| lbragstad | (revocation events were originally developed as a way to revoke cached token) | 17:42 |
| *** lucasxu has quit IRC | 17:45 | |
| *** edmondsw has joined #openstack-keystone | 17:46 | |
| *** thorst has joined #openstack-keystone | 17:49 | |
| dikonoor | lbragstad : I agree..this approach sounds better that the group_id approach | 17:50 |
| lbragstad | dikonoor so - the alternate approach might be to just start removing https://github.com/openstack/keystone/blob/4ef175926db6785f3c48d3b2c8ff43a3466d3344/keystone/assignment/core.py#L371 and seeing what breaks | 17:50 |
| lbragstad | in the tests | 17:51 |
| *** edmondsw has quit IRC | 17:51 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Policy in code (part 4) https://review.openstack.org/435755 | 17:52 |
| *** thorst has quit IRC | 17:53 | |
| dikonoor | ok..lbragstad : I hope the project and domain revoke api calls can be cleaned up from there and replaced with to pull the current role assignments and then check against that | 17:53 |
| dikonoor | or is there a better place to do that validation ? | 17:53 |
| lbragstad | dikonoor technically - it should be done when we validate a token | 17:54 |
| dikonoor | ibragstad: oh..right.. check_token calls is_revoked and putting it somewhere in that should help..and in the above flow, if we clean up adding revocation events for groups and user role removal, that should be good | 17:56 |
| dikonoor | https://github.com/openstack/keystone/blob/master/keystone/revoke/core.py#L193 | 17:57 |
| *** thorst has joined #openstack-keystone | 17:58 | |
| *** jamielennox|away is now known as jamielennox | 17:58 | |
| *** browne has quit IRC | 17:58 | |
| dikonoor | https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L144-L150 | 17:59 |
| lbragstad | dikonoor actually - you shouldn't really need to do that anywhere | 17:59 |
| dikonoor | lbragstad : oh..you mean to say it should already be in place | 17:59 |
| lbragstad | dikonoor yeah - i think so | 18:00 |
| lbragstad | dikonoor this method gets called when we validate a token https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L250 | 18:00 |
| lbragstad | dikonoor https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L327-L340 is the result if the user has no assignments on the project or domain they are claiming to have assignments on in the token scope | 18:01 |
| lbragstad | so - ^ that is what does the role validation at token validation time | 18:02 |
| lbragstad | does that make sense? | 18:02 |
| *** edmondsw has joined #openstack-keystone | 18:02 | |
| *** thorst has quit IRC | 18:02 | |
| lbragstad | dikonoor i'm going to step away for lunch quick - but I'll be back shortly | 18:03 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Policy in code (part 5) https://review.openstack.org/435757 | 18:03 |
| *** tqtran has joined #openstack-keystone | 18:03 | |
| dikonoor | lbragstad : ok sure.. I may log out and go hit the sack .. I am working from India. | 18:04 |
| *** edmondsw has quit IRC | 18:06 | |
| dikonoor | lbragstad : So, the LOC you pointed to already has the check for role assignments and throws a 401. So, the only changes needed would be a) no revocation events for remove removals for both users and groups | 18:08 |
| dikonoor | b) is_revoked flow should be modified if needed to check for only revoked tokens | 18:09 |
| dikonoor | lbragstad: Do you agree ? | 18:09 |
| *** jose-phillips has joined #openstack-keystone | 18:10 | |
| *** chlong has quit IRC | 18:11 | |
| *** edmondsw has joined #openstack-keystone | 18:13 | |
| *** edmondsw has quit IRC | 18:13 | |
| *** edmondsw has joined #openstack-keystone | 18:13 | |
| dikonoor | lbragstad: if any other solution comes up, please update the LP bug and i will take a look. | 18:13 |
| *** markvoelker has joined #openstack-keystone | 18:23 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Policy in code https://review.openstack.org/435609 | 18:23 |
| *** browne has joined #openstack-keystone | 18:25 | |
| *** thorst has joined #openstack-keystone | 18:26 | |
| *** thorst has quit IRC | 18:26 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Policy in code (part 2) https://review.openstack.org/435751 | 18:26 |
| *** chlong has joined #openstack-keystone | 18:26 | |
| *** thorst has joined #openstack-keystone | 18:27 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Policy in code (part 3) https://review.openstack.org/435754 | 18:33 |
| *** lucasxu has joined #openstack-keystone | 18:35 | |
| *** dikonoor has quit IRC | 18:36 | |
| *** david-lyle has joined #openstack-keystone | 18:47 | |
| openstackgerrit | Nisha Yadav proposed openstack/keystone-specs master: Fix typos and grammatical errors https://review.openstack.org/436026 | 18:49 |
| *** v1k0d3n has joined #openstack-keystone | 18:51 | |
| *** brad[]` is now known as brad[] | 18:56 | |
| *** tqtran has quit IRC | 18:59 | |
| *** tqtran has joined #openstack-keystone | 19:00 | |
| *** lucasxu has quit IRC | 19:09 | |
| *** david-lyle has quit IRC | 19:15 | |
| *** jerrygb has joined #openstack-keystone | 19:15 | |
| *** lucasxu has joined #openstack-keystone | 19:23 | |
| *** david-lyle has joined #openstack-keystone | 19:27 | |
| *** lucasxu has quit IRC | 19:38 | |
| *** lamt has joined #openstack-keystone | 19:48 | |
| *** jerrygb has quit IRC | 19:49 | |
| *** david-lyle_ has joined #openstack-keystone | 19:49 | |
| *** david-lyle has quit IRC | 19:50 | |
| *** david-lyle_ has quit IRC | 19:59 | |
| *** lucasxu has joined #openstack-keystone | 20:01 | |
| *** jerrygb has joined #openstack-keystone | 20:11 | |
| *** lamt has quit IRC | 20:15 | |
| *** jerrygb has quit IRC | 20:15 | |
| *** edmondsw has quit IRC | 20:20 | |
| *** lamt has joined #openstack-keystone | 20:20 | |
| *** lucasxu has quit IRC | 20:20 | |
| *** edmondsw has joined #openstack-keystone | 20:22 | |
| *** jamielennox is now known as jamielennox|away | 20:23 | |
| *** edmondsw_ has joined #openstack-keystone | 20:25 | |
| *** lamt has quit IRC | 20:27 | |
| *** edmondsw has quit IRC | 20:27 | |
| *** lucasxu has joined #openstack-keystone | 20:28 | |
| *** lucasxu has quit IRC | 20:29 | |
| *** lamt has joined #openstack-keystone | 20:31 | |
| *** lamt has quit IRC | 20:34 | |
| *** lamt has joined #openstack-keystone | 20:36 | |
| *** lucasxu has joined #openstack-keystone | 20:40 | |
| *** david-lyle has joined #openstack-keystone | 20:43 | |
| *** lucasxu has quit IRC | 20:46 | |
| *** david-lyle has quit IRC | 20:50 | |
| *** v1k0d3n has quit IRC | 20:51 | |
| *** dtroyer has quit IRC | 20:51 | |
| *** v1k0d3n has joined #openstack-keystone | 20:58 | |
| *** lamt has quit IRC | 20:58 | |
| *** thorst has quit IRC | 21:02 | |
| *** lamt has joined #openstack-keystone | 21:03 | |
| *** david-lyle has joined #openstack-keystone | 21:03 | |
| *** lucasxu has joined #openstack-keystone | 21:11 | |
| bknudson | talking about service catalog at the PTG: https://etherpad.openstack.org/p/service-catalog-pike | 21:12 |
| * lbragstad follows along | 21:13 | |
| *** lucasxu has quit IRC | 21:14 | |
| bknudson | jamielennox|away and I are here. and a lot of nova people for some reason | 21:17 |
| lbragstad | bknudson has the session started? | 21:17 |
| lbragstad | oh - that's right, you guys are on eastern | 21:17 |
| gagehugo | yeah started about 45 mins ago | 21:18 |
| lbragstad | ok - cool | 21:18 |
| lbragstad | i was confused for a second wonder if it was about to start in 15 | 21:18 |
| lbragstad | wondering* | 21:18 |
| EmilienM | samueldmq: https://review.openstack.org/#/c/436197/ FYI | 21:18 |
| EmilienM | samueldmq: bootstraping the work that we talked about face to face | 21:19 |
| lbragstad | bknudson gagehugo am i seeing an action item for keystone to put version in the service? | 21:20 |
| *** lucasxu has joined #openstack-keystone | 21:23 | |
| bknudson | lbragstad: see https://review.openstack.org/#/c/436178/1 | 21:23 |
| bknudson | I was wondering why https://developer.openstack.org/api-ref/identity/ was messed up? it's not indenting subsections properly | 21:24 |
| *** lucasxu has quit IRC | 21:24 | |
| bknudson | seems like https://developer.openstack.org/api-ref/identity/ is what identity should be pointing at | 21:25 |
| lbragstad | bknudson yeah - that's what sdague said in his note, too | 21:25 |
| lbragstad | bknudson i assume they don't want to point to the v2 documentation? | 21:26 |
| *** edmondsw_ has quit IRC | 21:26 | |
| bknudson | I think they do want to point to the whole supported API | 21:26 |
| rodrigods | lbragstad, liked the feedback! | 21:27 |
| rodrigods | (user survey feedback) | 21:27 |
| lbragstad | rodrigods ++ | 21:27 |
| gagehugo | bknudson yeah that's what it looks like | 21:29 |
| *** tqtran has quit IRC | 21:32 | |
| *** edmondsw has joined #openstack-keystone | 21:32 | |
| lbragstad | gagehugo bknudson is STA a way to get users to use names instead of types? or are projects suppose to consume it somehow? | 21:32 |
| bknudson | the plan is to use types and not names (maybe don't even have name in the catalog) | 21:33 |
| lbragstad | bknudson ah - so STA is where that is defined, | 21:33 |
| gagehugo | yeah | 21:33 |
| gagehugo | https://github.com/openstack/service-types-authority | 21:34 |
| lbragstad | so then we start changing clients and what-not to use type instead of name | 21:34 |
| bknudson | I hope the clients are using type already! | 21:34 |
| lbragstad | bknudson me too | 21:34 |
| *** edmondsw has quit IRC | 21:40 | |
| *** browne has quit IRC | 21:45 | |
| *** dtroyer has joined #openstack-keystone | 21:51 | |
| *** lamt has quit IRC | 21:51 | |
| *** david-lyle has quit IRC | 21:55 | |
| *** markvoelker has quit IRC | 22:01 | |
| *** v1k0d3n has quit IRC | 22:03 | |
| *** thorst has joined #openstack-keystone | 22:04 | |
| *** chlong has quit IRC | 22:04 | |
| samueldmq | EmilienM: nice! | 22:06 |
| *** spilla has quit IRC | 22:08 | |
| *** thorst has quit IRC | 22:08 | |
| *** edmondsw has joined #openstack-keystone | 22:17 | |
| *** edmondsw has quit IRC | 22:18 | |
| *** edmondsw has joined #openstack-keystone | 22:19 | |
| *** edmondsw has quit IRC | 22:23 | |
| *** martinlopes has joined #openstack-keystone | 22:28 | |
| *** dave-mccowan has quit IRC | 22:32 | |
| *** jose-phillips has quit IRC | 22:38 | |
| *** martinlopes has quit IRC | 22:39 | |
| *** martinlopes has joined #openstack-keystone | 22:43 | |
| *** adriant has joined #openstack-keystone | 22:44 | |
| *** jose-phillips has joined #openstack-keystone | 22:45 | |
| *** chris_hultin|AWA is now known as chris_hultin | 22:51 | |
| *** jperry has quit IRC | 23:14 | |
| *** dave-mccowan has joined #openstack-keystone | 23:25 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!