| *** agrebennikov has quit IRC | 00:07 | |
| *** catintheroof has joined #openstack-keystone | 00:25 | |
| *** thorst has quit IRC | 00:31 | |
| *** thorst has joined #openstack-keystone | 00:31 | |
| *** thorst has quit IRC | 00:35 | |
| *** adrian_otto has joined #openstack-keystone | 00:41 | |
| *** bjornar_ has quit IRC | 00:42 | |
| *** stingaci has quit IRC | 01:00 | |
| *** stingaci has joined #openstack-keystone | 01:00 | |
| *** catintheroof has quit IRC | 01:02 | |
| *** adrian_otto has quit IRC | 01:04 | |
| *** thorst has joined #openstack-keystone | 01:07 | |
| *** thorst has quit IRC | 01:15 | |
| *** dave-mccowan has quit IRC | 01:17 | |
| *** knangia has quit IRC | 01:51 | |
| *** niteshnarayanlal has joined #openstack-keystone | 01:54 | |
| *** harlowja has quit IRC | 02:06 | |
| *** adrian_otto has joined #openstack-keystone | 02:09 | |
| *** ravelar has quit IRC | 02:10 | |
| *** thorst has joined #openstack-keystone | 02:15 | |
| *** aojea has joined #openstack-keystone | 02:21 | |
| *** adrian_otto has quit IRC | 02:23 | |
| *** aojea has quit IRC | 02:25 | |
| *** adrian_otto has joined #openstack-keystone | 02:25 | |
| *** blake has joined #openstack-keystone | 02:26 | |
| blake | Does anyone have an example of how to properly utilize the _saml2.v3.ADFSPassword driver? | 02:28 |
|---|---|---|
| *** swatson has quit IRC | 02:34 | |
| *** thorst has quit IRC | 02:35 | |
| *** Shunli has joined #openstack-keystone | 02:46 | |
| *** adrian_otto has quit IRC | 02:47 | |
| *** harlowja has joined #openstack-keystone | 02:50 | |
| *** nicolasbock has quit IRC | 02:55 | |
| *** blake has quit IRC | 03:01 | |
| *** wuyanjun has joined #openstack-keystone | 03:03 | |
| *** Elaine_wu has quit IRC | 03:06 | |
| *** links has joined #openstack-keystone | 03:08 | |
| *** Shunli has quit IRC | 03:20 | |
| *** niteshnarayanlal has quit IRC | 03:39 | |
| *** harlowja has quit IRC | 03:56 | |
| *** adrian_otto has joined #openstack-keystone | 03:56 | |
| *** harlowja has joined #openstack-keystone | 04:07 | |
| *** niteshnarayanlal has joined #openstack-keystone | 04:17 | |
| *** blake has joined #openstack-keystone | 04:23 | |
| *** thorst has joined #openstack-keystone | 04:32 | |
| *** harlowja has quit IRC | 04:33 | |
| *** thorst has quit IRC | 04:37 | |
| openstackgerrit | Sean McCully proposed openstack/keystoneauth master: KeystoneAuth should default to system CAFile. https://review.openstack.org/452585 | 04:37 |
| *** rderose_ has joined #openstack-keystone | 04:41 | |
| *** rderose has quit IRC | 04:43 | |
| *** rcernin has joined #openstack-keystone | 04:45 | |
| *** blake_ has joined #openstack-keystone | 04:51 | |
| *** blake has quit IRC | 04:52 | |
| openstackgerrit | Sean McCully proposed openstack/keystoneauth master: KeystoneAuth should default to system CAFile. https://review.openstack.org/452585 | 04:55 |
| *** adrian_otto has quit IRC | 05:00 | |
| *** stingaci has quit IRC | 05:03 | |
| *** Aurelgad1o has joined #openstack-keystone | 05:09 | |
| *** John341 has joined #openstack-keystone | 05:09 | |
| *** rcernin has quit IRC | 05:09 | |
| *** szaher_ has joined #openstack-keystone | 05:10 | |
| *** rcernin has joined #openstack-keystone | 05:11 | |
| *** harlowja has joined #openstack-keystone | 05:11 | |
| *** rodrigod` has joined #openstack-keystone | 05:12 | |
| *** evrardjp_ has joined #openstack-keystone | 05:13 | |
| *** NikitaKonovalov2 has joined #openstack-keystone | 05:13 | |
| *** szaher has quit IRC | 05:14 | |
| *** Dinesh_Bhor has quit IRC | 05:14 | |
| *** Guest74869 has quit IRC | 05:14 | |
| *** Aurelgadjo has quit IRC | 05:14 | |
| *** Krenair has quit IRC | 05:14 | |
| *** akrzos has quit IRC | 05:14 | |
| *** NikitaKonovalov has quit IRC | 05:14 | |
| *** rodrigods has quit IRC | 05:14 | |
| *** John341_ has quit IRC | 05:14 | |
| *** evrardjp has quit IRC | 05:14 | |
| *** NikitaKonovalov2 is now known as NikitaKonovalov | 05:14 | |
| *** sigmavirus has joined #openstack-keystone | 05:15 | |
| *** jamielennox is now known as jamielennox|away | 05:15 | |
| *** akrzos has joined #openstack-keystone | 05:15 | |
| *** sigmavirus is now known as Guest94155 | 05:15 | |
| *** rderose_ has quit IRC | 05:16 | |
| *** Krenair has joined #openstack-keystone | 05:17 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:21 | |
| *** thorst has joined #openstack-keystone | 05:33 | |
| *** aojea has joined #openstack-keystone | 05:34 | |
| *** jamielennox|away is now known as jamielennox | 05:37 | |
| *** thorst has quit IRC | 05:38 | |
| *** madgoat has joined #openstack-keystone | 05:41 | |
| *** aojea has quit IRC | 05:41 | |
| *** madgoat has left #openstack-keystone | 05:41 | |
| *** richm has quit IRC | 05:43 | |
| *** mtreinish has quit IRC | 05:49 | |
| *** mtreinish has joined #openstack-keystone | 05:50 | |
| *** mtreinish has quit IRC | 05:52 | |
| *** mtreinish has joined #openstack-keystone | 05:56 | |
| *** jaosorior_away is now known as jaosorior | 06:01 | |
| *** harlowja has quit IRC | 06:02 | |
| *** knangia has joined #openstack-keystone | 06:04 | |
| *** niteshnarayanlal has quit IRC | 06:17 | |
| *** voelzmo has joined #openstack-keystone | 06:19 | |
| *** blake_ has quit IRC | 06:19 | |
| *** voelzmo has quit IRC | 06:24 | |
| *** tesseract has joined #openstack-keystone | 06:26 | |
| *** voelzmo has joined #openstack-keystone | 06:27 | |
| *** thorst has joined #openstack-keystone | 06:34 | |
| *** thorst has quit IRC | 06:38 | |
| *** krypto has joined #openstack-keystone | 06:46 | |
| krypto | hi is there a way to automatically add a particular user with role "admin" to all new projects. | 06:50 |
| *** Aqsa has joined #openstack-keystone | 06:59 | |
| *** pcaruana has joined #openstack-keystone | 07:19 | |
| *** Aqsam has joined #openstack-keystone | 07:23 | |
| *** aojea has joined #openstack-keystone | 07:24 | |
| *** Aqsa has quit IRC | 07:24 | |
| *** aojea_ has joined #openstack-keystone | 07:27 | |
| *** aojea has quit IRC | 07:30 | |
| *** adriant has quit IRC | 07:32 | |
| *** thorst has joined #openstack-keystone | 07:34 | |
| *** rvba has quit IRC | 07:37 | |
| *** thorst has quit IRC | 07:39 | |
| *** rvba has joined #openstack-keystone | 07:42 | |
| *** rvba has quit IRC | 07:43 | |
| *** rvba has joined #openstack-keystone | 07:43 | |
| *** jamielennox is now known as jamielennox|away | 07:45 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** toddnni has quit IRC | 08:28 | |
| *** knangia has quit IRC | 08:31 | |
| *** toddnni has joined #openstack-keystone | 08:33 | |
| *** thorst has joined #openstack-keystone | 08:35 | |
| breton | out of the box no | 08:48 |
| breton | you can write a script to read messages from oslo_messaging and create the assignment when project creation happens | 08:50 |
| *** thorst has quit IRC | 08:55 | |
| *** haplo37_ has quit IRC | 09:04 | |
| *** haplo37_ has joined #openstack-keystone | 09:04 | |
| *** slunkad has joined #openstack-keystone | 09:05 | |
| *** edmondsw has joined #openstack-keystone | 09:14 | |
| *** edmondsw has quit IRC | 09:18 | |
| *** szaher_ has quit IRC | 09:19 | |
| *** szaher has joined #openstack-keystone | 09:19 | |
| *** mvk has quit IRC | 09:31 | |
| *** bjornar_ has joined #openstack-keystone | 09:37 | |
| *** thorst has joined #openstack-keystone | 09:52 | |
| *** thorst has quit IRC | 09:56 | |
| *** evrardjp_ has quit IRC | 09:57 | |
| *** evrardjp has joined #openstack-keystone | 09:57 | |
| *** mvk has joined #openstack-keystone | 10:00 | |
| *** richm has joined #openstack-keystone | 10:13 | |
| *** nicolasbock has joined #openstack-keystone | 10:33 | |
| *** krypto has quit IRC | 10:49 | |
| *** jamielennox|away is now known as jamielennox | 11:03 | |
| *** ayoung_dadmode is now known as ayoung | 11:15 | |
| *** dave-mccowan has joined #openstack-keystone | 11:20 | |
| *** thorst has joined #openstack-keystone | 11:30 | |
| *** bjornar_ has quit IRC | 11:46 | |
| *** voelzmo has quit IRC | 11:58 | |
| *** rodrigod` is now known as rodrigods | 12:01 | |
| *** rodrigods has joined #openstack-keystone | 12:01 | |
| *** rodrigods has quit IRC | 12:01 | |
| *** voelzmo has joined #openstack-keystone | 12:01 | |
| *** rodrigods has joined #openstack-keystone | 12:02 | |
| *** rodrigods has quit IRC | 12:03 | |
| *** rodrigods has joined #openstack-keystone | 12:03 | |
| *** catintheroof has joined #openstack-keystone | 12:05 | |
| *** edmondsw has joined #openstack-keystone | 12:06 | |
| *** chlong has joined #openstack-keystone | 12:10 | |
| *** stingaci has joined #openstack-keystone | 12:29 | |
| *** stingaci has quit IRC | 12:33 | |
| *** voelzmo has quit IRC | 12:41 | |
| *** voelzmo has joined #openstack-keystone | 12:43 | |
| *** voelzmo has quit IRC | 12:46 | |
| *** voelzmo has joined #openstack-keystone | 12:49 | |
| *** spilla has joined #openstack-keystone | 12:54 | |
| *** ravelar has joined #openstack-keystone | 12:54 | |
| *** stradling has joined #openstack-keystone | 13:00 | |
| *** links has quit IRC | 13:04 | |
| *** belmoreira has joined #openstack-keystone | 13:07 | |
| *** dikonoor has joined #openstack-keystone | 13:32 | |
| *** rderose has joined #openstack-keystone | 13:34 | |
| *** jaosorior is now known as jaosorior_away | 13:36 | |
| johnthetubaguy | lbragstad: I am going to need help understanding the problems with this one, when you have a spare moment: https://review.openstack.org/#/c/427872 | 14:00 |
| lbragstad | johnthetubaguy reading it now | 14:01 |
| lbragstad | johnthetubaguy we had a long discussion yesterday - http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2017-04-03.log.html#t2017-04-03T19:17:55 | 14:02 |
| rodrigods | lbragstad, samueldmq do we have a sequence to review these: https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bp/policy-docs ? | 14:02 |
| *** lamt has joined #openstack-keystone | 14:02 | |
| lbragstad | rodrigods not necessarily | 14:03 |
| johnthetubaguy | lbragstad: it seems we have to let any service create their own roles, as I thought that was the whole idea, but I am curious what I am missing | 14:03 |
| rodrigods | lbragstad, ok, so i'll start with the oldest ones | 14:03 |
| lbragstad | rodrigods i leave the priority to antwash | 14:03 |
| rodrigods | antwash, ^ please let me know if there is a priority :) | 14:04 |
| lbragstad | rodrigods if he tells me a certain subset of those patachs are good to go, then i review those first, and we iterate on them | 14:04 |
| lbragstad | instead of reviewing all of them and making him respin 20 patches every hour | 14:04 |
| lbragstad | johnthetubaguy I was under a similar assumption | 14:05 |
| lbragstad | johnthetubaguy where as a group, we would go through each role and determine what that means in each project | 14:05 |
| lbragstad | I would expect each project to go through this exercise in order to get better rbac support by default | 14:05 |
| rodrigods | lbragstad, ++ that's why i was asking :) | 14:06 |
| johnthetubaguy | lbragstad: I was thinking each service should eventually not allow any access to it be default, and we let the impled rolls make that less hard work. But I am not 100% sure really. | 14:08 |
| lbragstad | johnthetubaguy yeah - that would be an interesting approach to vet out | 14:08 |
| johnthetubaguy | I think thats the way I am current heading, probably the best thing is to take this to the operators at the forum | 14:09 |
| lbragstad | johnthetubaguy yeah - that would be a good idea regardless i think | 14:10 |
| *** lamt has quit IRC | 14:10 | |
| lbragstad | johnthetubaguy but i don't think this is something that is being done in a vacuum | 14:10 |
| lbragstad | I've proposed a spec to keystone that closely modeled this | 14:10 |
| johnthetubaguy | lbragstad: yeah, appreciate all the time you lovely folks have spend thinking through this with us, we are in a better spot now because of all that | 14:11 |
| lbragstad | johnthetubaguy thanks for all the guidance | 14:11 |
| johnthetubaguy | lbragstad: so the main bit is, I don't it changes the scope work, which is probably enough to keep us busy this cycle anyways! | 14:12 |
| lbragstad | johnthetubaguy maybe we need a time slot in tomorrow's policy meeting | 14:12 |
| lbragstad | johnthetubaguy because the alternative is being proposed for pike - https://review.openstack.org/#/c/452198/ | 14:13 |
| johnthetubaguy | lbragstad: something came up with adrian_otto the other day around magnum stuff, they were talking about an RBAC service because most projects don't do RBAC, so clearly there is something we are not get right here. The middleware does sound interesting for brand new projects to adopt oslo.policy | 14:13 |
| lbragstad | johnthetubaguy interesting - i'd like to visit with him about that | 14:14 |
| johnthetubaguy | lbragstad: ah, so I can add my comments on the previous merged spec | 14:14 |
| lbragstad | johnthetubaguy your comments from the perviously merged spec to the proposed one? | 14:14 |
| johnthetubaguy | oops, yeah, thats what I mean | 14:15 |
| lbragstad | johnthetubaguy ++ | 14:15 |
| johnthetubaguy | will be tomorrow I think, focusing on the Nova spec review day today | 14:16 |
| lbragstad | johnthetubaguy sounds good | 14:16 |
| lbragstad | johnthetubaguy did you have that conversation with adrian in -containers? | 14:17 |
| johnthetubaguy | lbragstad: it was in vidyo I am afraid, its more about the ideas around per VM users that get access to resources in barbican, and how you bootstrap getting them API tokens, dolphm may have better context on all that | 14:18 |
| lbragstad | johnthetubaguy ok - i can make a note to follow up | 14:18 |
| lbragstad | johnthetubaguy i'd love to get those discussions aired out before we start committing to solutions | 14:18 |
| johnthetubaguy | lbragstad: here we go: https://etherpad.openstack.org/p/WA9strlvxy | 14:19 |
| lbragstad | johnthetubaguy nice | 14:20 |
| *** bjornar_ has joined #openstack-keystone | 14:25 | |
| openstackgerrit | Samriddhi proposed openstack/keystoneauth master: Updated inconsistent value of scope parameter https://review.openstack.org/452652 | 14:26 |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Updated scope parameter description in v3 API-ref https://review.openstack.org/450038 | 14:26 |
| antwash | rodrigods : hey there, I wouldn't say there's a priority, but I like getting the ones out the way that passed the gate and have the correct commit message. Heres a link of the ones ready for review :) https://etherpad.openstack.org/p/readypolicy | 14:32 |
| antwash | Once those get merged, I'll make changes to the other policy patches and update the etherpad with the next set -- I find placing them in the etherpad the best approach for reviewing. | 14:35 |
| openstackgerrit | Sean McCully proposed openstack/keystoneauth master: KeystoneAuth should default to system CAFile. https://review.openstack.org/452585 | 14:36 |
| *** bjornar_ has quit IRC | 14:46 | |
| *** jlopezgu_ has joined #openstack-keystone | 14:47 | |
| *** erhudy has joined #openstack-keystone | 14:48 | |
| *** lamt has joined #openstack-keystone | 14:48 | |
| *** dikonoor has quit IRC | 14:48 | |
| rodrigods | thanks antwash, will take a look on them today :) | 14:54 |
| antwash | rodrigods : great, thanks! | 14:54 |
| rodrigods | antwash, take a look in my comment at https://review.openstack.org/#/c/449341/6, you can fix in a follow up patch | 14:59 |
| rodrigods | lbragstad was faster | 14:59 |
| antwash | rodrigods : gotcha | 15:00 |
| lbragstad | antwash i pulled the workflow in case you want to respin | 15:01 |
| *** lucasxu has joined #openstack-keystone | 15:04 | |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move mapping to DocumentedRuleDefault https://review.openstack.org/449341 | 15:04 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move policy policies to DocumentedRuleDefault https://review.openstack.org/449248 | 15:05 |
| lbragstad | rodrigods can't a mapping consist of multiple rules? | 15:05 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move mapping to DocumentedRuleDefault https://review.openstack.org/449341 | 15:07 |
| *** knangia has joined #openstack-keystone | 15:09 | |
| *** andymccr has joined #openstack-keystone | 15:18 | |
| *** raj_sing- has joined #openstack-keystone | 15:19 | |
| andymccr | morning all - follow up on the PTG discussion. I know odyssey4me discussed integration of OSA's upgrade tasks on keystone commits - what is needed from our side and what we can do to help. | 15:21 |
| lbragstad | andymccr o/ | 15:21 |
| lbragstad | andymccr afaik https://review.openstack.org/#/c/432449/ was the last thing needed | 15:22 |
| lbragstad | which would allow keystone to propose a gate job that could checkout the keystone patch in review and place is somewhere on the deploy host, and osa would do the rest | 15:22 |
| *** belmoreira has quit IRC | 15:24 | |
| *** agrebennikov has joined #openstack-keystone | 15:27 | |
| *** raj_sing- is now known as raj_singh | 15:27 | |
| andymccr | lbragstad: ahh sweet! thanks i'll take a look and try progress that a bit | 15:28 |
| lbragstad | andymccr awesome - i thought i remember odyssey4me saying there was something he wanted to do to that yep | 15:29 |
| lbragstad | yet* | 15:29 |
| lbragstad | andymccr but i can't remember exactly what it was | 15:29 |
| lbragstad | andymccr but once that merges, we should be good to put together a new gate job | 15:29 |
| lbragstad | antwash updated https://etherpad.openstack.org/p/readypolicy with the latest status | 15:38 |
| antwash | lbragstad: looking now | 15:39 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Move and refactor test_revoke_by_audit_chain_id https://review.openstack.org/453229 | 15:39 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move policy association to DocumentedRuleDefault https://review.openstack.org/449344 | 15:40 |
| antwash | ping samueldmq | 15:42 |
| *** lucasxu has quit IRC | 15:44 | |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move policy association to DocumentedRuleDefault https://review.openstack.org/449344 | 15:45 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Remove unused code in test_revoke https://review.openstack.org/453235 | 15:47 |
| *** aojea_ has quit IRC | 15:49 | |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move role assignment to DocumentedRuleDefault https://review.openstack.org/449253 | 15:50 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move role assignment to DocumentedRuleDefault https://review.openstack.org/449253 | 15:52 |
| *** jlvillal_pto is now known as jlvillal | 15:54 | |
| *** pcaruana has quit IRC | 16:01 | |
| *** voelzmo has quit IRC | 16:03 | |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move role assignment to DocumentedRuleDefault https://review.openstack.org/449253 | 16:05 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move mapping to DocumentedRuleDefault https://review.openstack.org/449341 | 16:07 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move credential policies to DocumentedRuleDefault https://review.openstack.org/449233 | 16:11 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move access token to DocumentedRuleDefault https://review.openstack.org/449265 | 16:12 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move protocol to DocumentedRuleDefault https://review.openstack.org/449345 | 16:12 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move region policies to DocumentedRuleDefault https://review.openstack.org/449213 | 16:14 |
| openstackgerrit | Thomas Bechtold proposed openstack/keystonemiddleware master: Remove deprecated oslo.messaging aliases parameter https://review.openstack.org/453245 | 16:14 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move region policies to DocumentedRuleDefault https://review.openstack.org/449213 | 16:14 |
| antwash | lbragstad, rodrigods -- updated etherpad with new set for review when you have time https://etherpad.openstack.org/p/readypolicy | 16:15 |
| lbragstad | antwash working on them now | 16:15 |
| lbragstad | antwash thanks! | 16:15 |
| antwash | we keep it up, we'll have them all merged by the thursday | 16:15 |
| lbragstad | antwash that's a good goal | 16:16 |
| lbragstad | FYI - https://review.openstack.org/#/c/448826/ should be the last patch needed to implement policy-in-code | 16:16 |
| knikolla | does it mean no-one when the check_str is an empty string? | 16:17 |
| antwash | lbragstad: forgot about that one, it was buried in the policy-docs patchset lol | 16:17 |
| openstackgerrit | Thomas Bechtold proposed openstack/keystonemiddleware master: Remove deprecated oslo.messaging aliases parameter https://review.openstack.org/453245 | 16:17 |
| lbragstad | knikolla example? | 16:18 |
| knikolla | lbragstad: https://github.com/openstack/keystone/blob/master/keystone/common/policies/trust.py#L21-L32 | 16:18 |
| lbragstad | knikolla it means that all that is needed is a valid token | 16:19 |
| lbragstad | knikolla the reason why the trust API has that is because the policy for it is essentially coded into the controller/manager | 16:19 |
| knikolla | lbragstad: gotcha | 16:19 |
| lbragstad | knikolla it's not really enforced using the protected method | 16:20 |
| lbragstad | knikolla a better example might be the get auth projects API, which has an empty check string | 16:20 |
| *** Aqsam has quit IRC | 16:21 | |
| lbragstad | it makes the protected method ensure the token being used is valid, then it uses that user context to build a list of role assignments | 16:21 |
| knikolla | lbragstad: thanks for the clear explanation. | 16:21 |
| lbragstad | knikolla anytime, i had to spend a bunch of time unwinding that once | 16:22 |
| knikolla | lbragstad: saved me some time hunting down controller logic. | 16:22 |
| lbragstad | knikolla yeah - there is all sorts of policy coded into https://github.com/openstack/keystone/blob/master/keystone/trust/controllers.py#L112 | 16:23 |
| lbragstad | knikolla another example - https://github.com/openstack/keystone/blob/master/keystone/trust/controllers.py#L198 | 16:24 |
| openstackgerrit | Merged openstack/keystone master: Move identity provider to DocumentedRuleDefault https://review.openstack.org/449275 | 16:24 |
| knikolla | lbragstad: right, that sounds more complicated than what the policy engine can support. | 16:27 |
| *** stingaci has joined #openstack-keystone | 16:32 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add setup to test classes and private method https://review.openstack.org/453254 | 16:37 |
| *** lucasxu has joined #openstack-keystone | 16:38 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Remove unused code in test_revoke https://review.openstack.org/453235 | 16:44 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Remove unused code in test_revoke https://review.openstack.org/453235 | 16:45 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Remove unused code in test_revoke https://review.openstack.org/453235 | 16:47 |
| *** stradling has quit IRC | 17:00 | |
| openstackgerrit | Merged openstack/keystone master: Move auth to DocumentedRuleDefault https://review.openstack.org/449336 | 17:00 |
| openstackgerrit | Merged openstack/keystone master: Move service policies to DocumentedRuleDefault https://review.openstack.org/449214 | 17:00 |
| *** stradling has joined #openstack-keystone | 17:01 | |
| *** Aqsam has joined #openstack-keystone | 17:04 | |
| *** tesseract has quit IRC | 17:04 | |
| openstackgerrit | Merged openstack/keystone master: Move policy association to DocumentedRuleDefault https://review.openstack.org/449344 | 17:07 |
| *** mvk has quit IRC | 17:15 | |
| *** ravelar1 has joined #openstack-keystone | 17:16 | |
| *** Aqsam has quit IRC | 17:20 | |
| *** Aqsa has joined #openstack-keystone | 17:25 | |
| *** voelzmo has joined #openstack-keystone | 17:30 | |
| *** lucasxu has quit IRC | 17:33 | |
| *** lucasxu has joined #openstack-keystone | 17:34 | |
| lbragstad | oomichi ping | 17:35 |
| *** voelzmo has quit IRC | 17:36 | |
| *** voelzmo has joined #openstack-keystone | 17:40 | |
| *** lucasxu has quit IRC | 17:40 | |
| *** lucasxu has joined #openstack-keystone | 17:41 | |
| *** ravelar1 has quit IRC | 17:41 | |
| *** d0ugal has quit IRC | 17:48 | |
| *** d0ugal has joined #openstack-keystone | 17:49 | |
| *** mvk has joined #openstack-keystone | 18:01 | |
| *** henrynash has joined #openstack-keystone | 18:03 | |
| oomichi | lbragstad: hi | 18:07 |
| lbragstad | oomichi o/ we're looking to have a policy discussion in today's keystone meeting (happening now in #openstack-keystone) | 18:08 |
| lbragstad | oomichi i know you had some questions/comments regarding one of our proposals, and I wanted to make sure you knew we were having conversations about | 18:08 |
| lbragstad | oomichi the agenda is here - https://etherpad.openstack.org/p/keystone-weekly-meeting | 18:08 |
| lbragstad | oomichi and we'd love to get your feedback in that discussion (RBAC from Middleware) | 18:09 |
| oomichi | lbragstad: ok, are there any review for that now? | 18:09 |
| oomichi | lbragstad: I'd like to put some comments if we have | 18:09 |
| lbragstad | oomichi https://review.openstack.org/#/c/452198/ is the spec proposing the work for pike | 18:09 |
| lbragstad | oomichi https://review.openstack.org/#/c/401808/ is the implementation | 18:10 |
| oomichi | lbragstad: is it ok to put comments on https://review.openstack.org/#/c/452198 ? That seems to just move | 18:10 |
| lbragstad | oomichi the original proposal was here - https://review.openstack.org/#/c/391624/ | 18:11 |
| lbragstad | oomichi which i know you reviewed at least once | 18:11 |
| lbragstad | but it was merged to on-going | 18:11 |
| *** mdavidson has joined #openstack-keystone | 18:11 | |
| oomichi | lbragstad: hehe, I forgot TBH. Yeah, it seems easy to get attention if putting comments on https://review.openstack.org/#/c/452198 | 18:12 |
| oomichi | lbragstad: I will do that now | 18:12 |
| lbragstad | oomichi awesome - thanks! | 18:13 |
| oomichi | lbragstad: np :) | 18:13 |
| *** rderose has quit IRC | 18:18 | |
| *** rderose has joined #openstack-keystone | 18:20 | |
| *** stradling has quit IRC | 18:20 | |
| *** stradling has joined #openstack-keystone | 18:21 | |
| dstanek | rodrigods: all he is saying is that we don't like FKs between subsystems or am i missing something? | 18:25 |
| rodrigods | dstanek, yes, there is no arguments there | 18:26 |
| rodrigods | just a "strong" opinion | 18:26 |
| rodrigods | the conversation happened in IRC | 18:26 |
| rodrigods | dstanek, guess he will respond the ML thread, anyway | 18:26 |
| dstanek | rodrigods: our subsystems are highly coupled the data layer...we just refuse to admit to it | 18:26 |
| *** Aqsa has quit IRC | 18:30 | |
| dstanek | notmorgan: rodrigods: yep, writing something up after the meeting | 18:32 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move role assignment to DocumentedRuleDefault https://review.openstack.org/449253 | 18:33 |
| dstanek | it doesn't make sense to me not to use the DB to do the work that it's good at doing | 18:33 |
| rodrigods | dstanek, true, but only if we are using the DB correctly | 18:34 |
| rodrigods | don't you find strange the relationship between fed_users and idp/protocol? | 18:34 |
| rodrigods | not the relationship itself, the way it was done | 18:34 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Move mapping to DocumentedRuleDefault https://review.openstack.org/449341 | 18:34 |
| *** rarora has quit IRC | 18:34 | |
| dstanek | rodrigods: what is strange about it | 18:35 |
| *** voelzmo has quit IRC | 18:35 | |
| rodrigods | dstanek, one FK idp_ip to idp.ID | 18:35 |
| dstanek | rodrigods: we currently have relationships between identity<->assignment and many others | 18:35 |
| dstanek | rodrigods: what's wrong with that? | 18:35 |
| rodrigods | another one from idp_id to protocol.idp_id and protocol_id to protocol.ID | 18:35 |
| dstanek | that could have been made simpler | 18:36 |
| rodrigods | dstanek, exactly | 18:36 |
| rodrigods | but... that's the issue i have with it | 18:36 |
| rodrigods | not talking about dependencies between subsystems | 18:36 |
| dstanek | rodrigods: so your issue that we shouldn't use the DB because we could do it wrong? | 18:37 |
| rodrigods | dstanek, not at all, i'm just talking about the "use the DB since it is good in doing that" argument | 18:37 |
| dstanek | rodrigods: who had that argument | 18:37 |
| dstanek | rodrigods: the argument is use the DB for what *it* is good at | 18:37 |
| antwash | rodrigods : i'm confused about the -1, the commit message says the same thing though https://review.openstack.org/#/c/449233/ | 18:37 |
| openstackgerrit | Sean Dague proposed openstack/keystone-specs master: Unified limits specification https://review.openstack.org/440815 | 18:38 |
| rodrigods | antwash, it is not a strong -1, just payed attention on how that is written now | 18:39 |
| rodrigods | dstanek, " the argument is use the DB for what *it* is good at" and what i'm saying is: for the DB do things correctly, we need to use it correctly | 18:40 |
| dstanek | rodrigods: exactly! and we are not | 18:40 |
| dstanek | rodrigods: are you arguing for or against FKs in between subsystems? | 18:40 |
| rodrigods | dstanek, heh i don't have a strong opinion either way | 18:42 |
| rodrigods | just liked to argue about the way the fed_table relationships have been designed :P | 18:42 |
| dstanek | rodrigods: we can certainly change those if we can make it better....but removing would just make it worse | 18:43 |
| rodrigods | dstanek, totally agree | 18:44 |
| rodrigods | dstanek, not with "just make it worse" part | 18:44 |
| *** rarora has joined #openstack-keystone | 18:45 | |
| rodrigods | this is something i need to read and think about different opinions so I can finally have mine :P | 18:45 |
| dstanek | rodrigods: i'll start writign this up shortly after our meeting | 18:56 |
| *** rderose has quit IRC | 19:00 | |
| ayoung | lbragstad, dstanek samueldmq lets talk about the constraints. | 19:01 |
| * knikolla lurks | 19:01 | |
| ayoung | 1. a baseline policy needs to be enforced everywhere in the system | 19:01 |
| ayoung | if that is not the case, than there is no way to add new roles that have limitations | 19:01 |
| samueldmq | ayoung: I need 5 min to get coffe. Brb | 19:01 |
| ayoung | if you create a new role, today, it is essentially the same as the Member role. | 19:02 |
| dstanek | a new role would have access to nothing, right? | 19:02 |
| ayoung | dstanek, a new role would have access to everything | 19:03 |
| ayoung | small exceptions in Keystone | 19:03 |
| ayoung | and it owuld not be able to do `admin` limited operations | 19:03 |
| ayoung | So a new role would essentially be equivalent to Member | 19:04 |
| dstanek | ayoung: why would that be? do you have an example? | 19:04 |
| *** rmascena__ has joined #openstack-keystone | 19:04 | |
| ayoung | dstanek, because the way policy is enforced today, it only checks the scope, not the role, in the vast majority of rules | 19:04 |
| ayoung | and, if you were to go in and add a role check in a specific rule, you would not do much good | 19:05 |
| ayoung | as that role check would not be executed on any other rule in the system | 19:05 |
| ayoung | and it would not be executed in other remote services | 19:05 |
| *** rmascena__ is now known as raildo | 19:06 | |
| ayoung | dstanek, see why I want it in middleware? | 19:06 |
| *** rmascena has quit IRC | 19:06 | |
| dstanek | ayoung: no, i see this in a much simplier light....maybe i don't know the problem that you are solving | 19:07 |
| dstanek | to me a baseline policy is a solution for some problem and not necessarily a constraint | 19:07 |
| ayoung | dstanek, people have been asking for a "read only" role | 19:07 |
| *** lucasxu has quit IRC | 19:07 | |
| *** rderose has joined #openstack-keystone | 19:07 | |
| ayoung | How would you implement that? | 19:07 |
| *** lucasxu has joined #openstack-keystone | 19:08 | |
| dstanek | ayoung: in today's world i would have each service update their policy...the challenge is having an agreement on roles or a way to configure them | 19:10 |
| ayoung | dstanek, right, so lets not do that | 19:10 |
| lbragstad | ayoung why not? | 19:11 |
| ayoung | instead, move the RBAC checkout of policy and provide a reasonable default that the operators can customize without breaking policy | 19:11 |
| ayoung | lbragstad, have you ever tried to get a change into every single other project in openstack? | 19:11 |
| ayoung | I have, and jamielennox has and it was not a pleasant experience | 19:11 |
| ayoung | and, it didn't work | 19:11 |
| lbragstad | ayoung yes - that's something we're currently doing with nova and cinder | 19:11 |
| ayoung | currently | 19:12 |
| ayoung | lbragstad, but not somethine we've done | 19:12 |
| ayoung | we have been unsuccessful in fixing security holes | 19:12 |
| lbragstad | ayoung the difference between then and now is that we're making progress | 19:12 |
| lbragstad | and we're having those discussions *between* projects | 19:12 |
| dstanek | right, i don't want to do something just because our inter-project communication isn't great. i want to make sure it's the right thing | 19:13 |
| ayoung | dstanek, it is, quite simply, what Keystone really exists to do | 19:14 |
| ayoung | Federation has shown we are really not supposed to own the user database | 19:14 |
| ayoung | keysteon is a layer for delegation | 19:14 |
| ayoung | I'm tired. | 19:14 |
| lbragstad | ayoung are there customers or operators that specifically asking for this approach? | 19:15 |
| ayoung | I am having a hard time gearing up to type all this in again, as I just went through it yesterday with lbragstad | 19:15 |
| ayoung | lbragstad, there are customers and operators asking for what this approach gives, that we have not been able to deliver on, for years | 19:16 |
| ayoung | longer than you have worked on keystone | 19:16 |
| ayoung | let me find the first bug on it... | 19:16 |
| lbragstad | ayoung completely agree | 19:16 |
| lbragstad | ayoung have they signed off on the management of the rbac in middleware approach? | 19:16 |
| dstanek | ayoung: so goal 1 is the ability to add a read-only role - what other goals are there? | 19:17 |
| *** voelzmo has joined #openstack-keystone | 19:17 | |
| ayoung | dstanek, the ability to tell a user what roles they need in order to perform an operation | 19:17 |
| dstanek | i don't want to talk about the specific spec right now. i want to understand just the problems | 19:17 |
| ayoung | david-lyle, asked me for that BEFORE he was Horizon PTL | 19:17 |
| ayoung | There is no way to map from policy to operation today | 19:17 |
| dstanek | ayoung: it's technically possible right? | 19:18 |
| lbragstad | ayoung so I assume that was before any capability APIs were being proposed to the various projects | 19:18 |
| *** lwanderley has joined #openstack-keystone | 19:18 | |
| dstanek | lbragstad: i forgot that those discussions have been happening | 19:18 |
| ayoung | please read the preamble to the spec https://review.openstack.org/#/c/452198/2/specs/keystone/pike/role-check-from-middleware.rst | 19:19 |
| *** voelzmo has quit IRC | 19:19 | |
| lbragstad | ayoung you mean? http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/role-check-from-middleware.html#problem-description | 19:19 |
| *** ravelar has quit IRC | 19:19 | |
| ayoung | lbragstad, yeo | 19:19 |
| ayoung | yep | 19:20 |
| lbragstad | is david-lyle's use case so that horizon can display the proper UI things for a user? | 19:22 |
| lbragstad | based on what they can do? | 19:22 |
| lbragstad | because if so - i don't see how the rbac in middleware approach helps that, because keystone is going to have to store some operation -> url pattern -> role information | 19:23 |
| ayoung | lbragstad, yes it will. if you have a users token, you can query that information | 19:24 |
| lbragstad | so even if a user is allowed to do a live migration because they have the admin role, it doesn't make any sense to advertise that if nova is configured to use a virt driver that doesn't support live migrate | 19:24 |
| ayoung | lbragstad, but that is a different use case | 19:24 |
| *** aojea has joined #openstack-keystone | 19:24 | |
| lbragstad | how is that different? | 19:24 |
| ayoung | that is not an authorization decision | 19:24 |
| *** harlowja has joined #openstack-keystone | 19:24 | |
| ayoung | its a different as having the keys to the car and knowing how to drive stick | 19:25 |
| lbragstad | right but does it change the fact that advertising live migration to a user when they can't do it is wrong? | 19:25 |
| lbragstad | i don't think it does | 19:25 |
| lbragstad | there are a ton of things in nova, neutron, and cinder that would be susceptible to that case | 19:26 |
| openstackgerrit | Merged openstack/keystone master: Move policy policies to DocumentedRuleDefault https://review.openstack.org/449248 | 19:27 |
| *** voelzmo has joined #openstack-keystone | 19:27 | |
| *** ravelar has joined #openstack-keystone | 19:27 | |
| dstanek | ayoung: is that what a user would want an authz decision? or just an absolute yes/no about the capability? | 19:28 |
| dstanek | and what if policy and rbac are at odds | 19:28 |
| lbragstad | based on the discussions i was having with robcresswell and david-lyle at the PTG, the yes/no on the capability is what they wanted | 19:28 |
| lbragstad | because they could use the capability endpoint of the service to figure out which options to gray out/enabled in the different horizon panels | 19:29 |
| dstanek | lbragstad: you'd have to check rbac, then policy, and then the service's capability to answer that question (not necessarily in that order) | 19:30 |
| lbragstad | dstanek if we put the url patterns in keystone? | 19:31 |
| ayoung | dstanek, if policy and rbac are at odds, the operator messed things up | 19:32 |
| dstanek | ayoung: that happens when there are competing ways to do the same thing | 19:32 |
| ayoung | dstanek, it defaults to "no" | 19:32 |
| dstanek | ayoung: i'm going to spend some time tonight reviewing http://csrc.nist.gov/rbac/sandhu-ferraiolo-kuhn-00.pdf | 19:32 |
| ayoung | rbac check comes first. | 19:32 |
| ayoung | if that fails, you don't get to policy | 19:32 |
| ayoung | if policy fails, still no | 19:33 |
| ayoung | so I am not proposing that we report, or provide any more information on policy | 19:33 |
| ayoung | cuz, you might recall I spent a few cycles on that and we got a solid NO there | 19:33 |
| ayoung | dstanek, ++ | 19:34 |
| ayoung | dstanek, a couple caveats when you read that | 19:36 |
| ayoung | what they call hierarchical, I called implied roles | 19:36 |
| ayoung | because we used hierarchical when talking about HMT | 19:36 |
| ayoung | but the nist definitnion of a role hierarchy is role A implies role B type stuff | 19:37 |
| ayoung | we don't really care about sepraret of duties | 19:37 |
| ayoung | and NIST rbac does not have the concept of Scope like we do | 19:37 |
| ayoung | which is really a big shortcoming, but it is due to the RBAC as implemented there assuming scope into the equasion: | 19:37 |
| ayoung | instead of a role being "governor" it would be "governor_of_illinois" | 19:38 |
| ayoung | dstanek, make sense? | 19:40 |
| dstanek | i think so. i took down your notes for reference | 19:42 |
| ayoung | thanks | 19:44 |
| *** lwanderley has quit IRC | 19:46 | |
| *** voelzmo has quit IRC | 19:46 | |
| dstanek | ayoung: no, thank you :-) | 19:49 |
| ayoung | knikolla, I'm going to turn my attention back to the implied roles patch, as we are going to want that for the RBAC stuff | 19:52 |
| ayoung | https://review.openstack.org/#/c/290253/ | 19:52 |
| knikolla | ayoung: anything you need from me? | 19:55 |
| knikolla | (besides reading back the entire conversation which i had to miss now because of meetings) | 19:55 |
| *** ediardo has quit IRC | 20:00 | |
| ayoung | knikolla, more is there anything you need from me | 20:00 |
| ayoung | we need to get the keystone client part going, and you were going to work on that | 20:01 |
| *** ediardo has joined #openstack-keystone | 20:01 | |
| ayoung | knikolla, I can help out if you need me to, but I want to get the cli piece of implied roles back on track | 20:01 |
| knikolla | ayoung: i can get the client part done this week. looks trivial. | 20:03 |
| *** dave-mccowan has quit IRC | 20:03 | |
| knikolla | i have a wip patch with the outline. i just need to fill in the methods | 20:03 |
| ayoung | knikolla, excellent. shout if you need help. the implied roles patch should be a decent starting point reference | 20:04 |
| knikolla | ayoung: once we get to the ksm part i'll definitely ask for help. right now it's just basic CRUD. | 20:05 |
| ayoung | knikolla, cool | 20:05 |
| *** voelzmo has joined #openstack-keystone | 20:18 | |
| *** voelzmo has quit IRC | 20:23 | |
| *** stradling has quit IRC | 20:30 | |
| *** thorst has quit IRC | 20:35 | |
| *** rcernin has quit IRC | 20:55 | |
| *** thorst has joined #openstack-keystone | 21:07 | |
| *** aojea has quit IRC | 21:11 | |
| *** spilla has quit IRC | 21:12 | |
| *** henrynash has quit IRC | 21:14 | |
| *** aojea has joined #openstack-keystone | 21:15 | |
| *** aojea_ has joined #openstack-keystone | 21:16 | |
| *** dave-mccowan has joined #openstack-keystone | 21:16 | |
| *** henrynash has joined #openstack-keystone | 21:16 | |
| *** aojea has quit IRC | 21:16 | |
| *** henrynash has quit IRC | 21:26 | |
| *** ravelar1 has joined #openstack-keystone | 21:27 | |
| *** edmondsw has quit IRC | 21:31 | |
| *** ravelar1 has quit IRC | 21:32 | |
| *** edmondsw has joined #openstack-keystone | 21:33 | |
| *** david-lyle has quit IRC | 21:35 | |
| *** edmondsw has quit IRC | 21:38 | |
| *** david-lyle has joined #openstack-keystone | 21:43 | |
| *** rmascena has joined #openstack-keystone | 21:51 | |
| *** raildo has quit IRC | 21:53 | |
| *** aojea_ has quit IRC | 21:57 | |
| ayoung | knikolla, what if we tried to support a jq type match for the body of a post as an additional parameter? | 21:58 |
| ayoung | like, in a addition to | 21:58 |
| ayoung | POST /url/server/<id>/action we had an additional column which was body: ".lock" | 21:59 |
| ayoung | and body was expected to be Null, only allowed to be non Null in POST/PUT/PATCH cases (I think) and is more specific than the cases where body is omitted | 22:00 |
| *** thorst has quit IRC | 22:01 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs master: Commit ot RBAC in middleware in Pike release https://review.openstack.org/452198 | 22:17 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Replace usages of SHA1 with SHA256 https://review.openstack.org/453357 | 22:18 |
| *** lucasxu has quit IRC | 22:27 | |
| *** hoonetorg has quit IRC | 22:43 | |
| *** hoonetorg has joined #openstack-keystone | 22:44 | |
| *** hoonetorg has quit IRC | 22:47 | |
| *** catintheroof has quit IRC | 22:57 | |
| *** hoonetorg has joined #openstack-keystone | 22:58 | |
| openstackgerrit | Gage Hugo proposed openstack/python-keystoneclient master: Replace usages of SHA1 with SHA256 https://review.openstack.org/453365 | 23:01 |
| *** thorst has joined #openstack-keystone | 23:01 | |
| *** thorst has quit IRC | 23:06 | |
| *** lamt has quit IRC | 23:20 | |
| samueldmq | antwash: hi, you around yet ? | 23:48 |
| *** masterjcool has quit IRC | 23:49 | |
| *** stingaci has quit IRC | 23:49 | |
| *** spilla has joined #openstack-keystone | 23:53 | |
| *** gsilvis has quit IRC | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!