| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 00:04 |
|---|---|---|
| *** thorst has joined #openstack-keystone | 00:07 | |
| *** thorst has quit IRC | 00:08 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 00:12 |
| *** itlinux has quit IRC | 00:15 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 00:23 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 00:30 |
| *** Shunli has joined #openstack-keystone | 00:37 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 00:38 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 00:46 |
| *** dave-mccowan has joined #openstack-keystone | 00:47 | |
| *** zhurong has joined #openstack-keystone | 00:47 | |
| SamYaple | not having much luck figuring out why this is happening http://paste.openstack.org/show/622098/ | 00:51 |
| SamYaple | it could be a redherring for the issue im having though | 00:53 |
| *** thorst has joined #openstack-keystone | 01:09 | |
| *** panbalag has joined #openstack-keystone | 01:18 | |
| *** thorst has quit IRC | 01:23 | |
| *** thorst has joined #openstack-keystone | 01:23 | |
| *** thorst has quit IRC | 01:26 | |
| *** edmondsw has joined #openstack-keystone | 01:28 | |
| *** edmondsw has quit IRC | 01:32 | |
| *** panbalag has left #openstack-keystone | 01:36 | |
| *** dave-mccowan has quit IRC | 01:41 | |
| *** dave-mccowan has joined #openstack-keystone | 01:45 | |
| *** itlinux has joined #openstack-keystone | 01:51 | |
| *** tonytan4ever_brb has joined #openstack-keystone | 02:02 | |
| *** tonytan4ever has quit IRC | 02:02 | |
| *** dave-mcc_ has joined #openstack-keystone | 02:05 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 02:05 |
| *** dave-mccowan has quit IRC | 02:07 | |
| *** itlinux has quit IRC | 02:07 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 02:13 |
| *** itlinux has joined #openstack-keystone | 02:14 | |
| *** itlinux has quit IRC | 02:15 | |
| *** thorst has joined #openstack-keystone | 02:26 | |
| *** itlinux has joined #openstack-keystone | 02:33 | |
| *** dave-mcc_ has quit IRC | 02:38 | |
| *** itlinux has quit IRC | 02:52 | |
| lbragstad | SamYaple: what's the situation look like? | 02:56 |
| lbragstad | are you just seeing that for token validation? | 02:56 |
| SamYaple | lbragstad: `openstack server list --all` is hanging. I am getting that in the logs. it is from ksa_exceptions.NotFound | 02:57 |
| SamYaple | it doesnt happen always | 02:57 |
| SamYaple | and i can't reproduce it outside of the nova logs | 02:57 |
| lbragstad | huh - weird | 02:58 |
| SamYaple | im suspecting a timeout issue... is it possible it presents that way? | 02:58 |
| lbragstad | i assume you can get a token as that user and validate it? | 02:58 |
| SamYaple | indeed | 02:58 |
| lbragstad | i'm not aware of timeouts coming through as 404s from ksa | 02:58 |
| SamYaple | if nova is failing to lookup, say, endpoints would it throw a NotFound? (i dont really understand when NotFound would be thrown) | 02:59 |
| lbragstad | cc mordred efried kmalloc ^ | 02:59 |
| lbragstad | the error message seems totally specific to token validation | 02:59 |
| SamYaple | right, but https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/exceptions/http.py#L146 | 03:00 |
| SamYaple | what "resource" is it refering too? | 03:00 |
| lbragstad | that might be something general | 03:01 |
| lbragstad | as in any keystone resource... | 03:01 |
| lbragstad | let me check something | 03:01 |
| lbragstad | that error string doesn't actually appear in the ksa source from what i can tell | 03:04 |
| SamYaple | its in keystonemiddleware | 03:04 |
| lbragstad | do the keystone logs emit a 404? | 03:04 |
| lbragstad | oh | 03:04 |
| SamYaple | its just catching the exception NotFound from keystoneauth | 03:05 |
| lbragstad | aha | 03:06 |
| lbragstad | yeah | 03:06 |
| lbragstad | i wonder if the discovery bits are tripping somewhere? | 03:06 |
| SamYaple | well thats just it, it doesnt happen always | 03:06 |
| SamYaple | as i said, *I* can't reproduce it, and it only exists in nova logs | 03:07 |
| SamYaple | `openstack server list` returns fine, `openstack server list --all` breaks most of the time, and sometimes I get that error | 03:07 |
| *** jamesbenson has joined #openstack-keystone | 03:12 | |
| lbragstad | that's strange - this is the first i've heard of something like this with ksa+ksm | 03:12 |
| lbragstad | what version of ksa are you using? | 03:12 |
| SamYaple | 3.2.0, but i did revert 2.18 or so (stable/ocata upper-constraints) because i know 3.2.0 had that fun discovery stuff | 03:14 |
| SamYaple | same behaviour with both | 03:14 |
| SamYaple | (i need 3.2.0 for the latest version of shade which im using, but again, i tested without it) | 03:14 |
| lbragstad | hmm | 03:16 |
| *** edmondsw has joined #openstack-keystone | 03:16 | |
| SamYaple | i dont think keystone is broken to be honest. i did a few hours ago, but after walking through the code i think this is something else and this is a symptom | 03:16 |
| *** jamesbenson has quit IRC | 03:16 | |
| SamYaple | the fact youve never heard or seen this kinda confirms that to me | 03:17 |
| *** edmondsw has quit IRC | 03:21 | |
| SamYaple | thanks for your insight. im going to call it for the night. ping me if you think of anything else lbragstad | 03:21 |
| lbragstad | SamYaple: will do - thanks for bringing it up | 03:21 |
| lbragstad | SamYaple: i'll sync with mordred tomorrow and see if he has any ideas | 03:22 |
| mordred | lbragstad, SamYaple: I'm not really here - but will help look at it tomorrow | 03:27 |
| *** MeltedLux has quit IRC | 03:32 | |
| *** MeltedLux has joined #openstack-keystone | 03:39 | |
| *** tonytan4ever_brb has quit IRC | 03:40 | |
| *** tonytan4ever has joined #openstack-keystone | 03:40 | |
| *** links has joined #openstack-keystone | 03:44 | |
| *** tonytan4ever has quit IRC | 03:45 | |
| *** cfriesen_ has quit IRC | 03:50 | |
| *** rha has quit IRC | 03:52 | |
| *** rha has joined #openstack-keystone | 03:59 | |
| *** zhurong has quit IRC | 04:07 | |
| *** kornicameister has quit IRC | 04:24 | |
| *** itlinux has joined #openstack-keystone | 04:28 | |
| *** mani_ has joined #openstack-keystone | 04:37 | |
| mani_ | hi anyone can help | 04:38 |
| mani_ | http://paste.openstack.org/show/622103/ | 04:39 |
| mani_ | Run Cmd: openstack endpoint list | 04:39 |
| *** itlinux has quit IRC | 04:48 | |
| *** edmondsw has joined #openstack-keystone | 05:04 | |
| *** edmondsw has quit IRC | 05:09 | |
| *** aojea has joined #openstack-keystone | 05:33 | |
| *** dgonzalez has joined #openstack-keystone | 05:50 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 05:52 |
| *** cfriesen_ has joined #openstack-keystone | 05:55 | |
| *** cfriesen_ has quit IRC | 06:00 | |
| *** cfriesen__ has joined #openstack-keystone | 06:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 06:03 |
| *** josecastroleon has joined #openstack-keystone | 06:11 | |
| *** erlon has quit IRC | 06:14 | |
| *** gagehugo has quit IRC | 06:14 | |
| *** pcaruana has joined #openstack-keystone | 06:19 | |
| *** markvoelker has quit IRC | 06:30 | |
| *** cfriesen__ has quit IRC | 06:37 | |
| *** zhurong has joined #openstack-keystone | 06:38 | |
| *** jamesbenson has joined #openstack-keystone | 06:48 | |
| *** gagehugo has joined #openstack-keystone | 06:49 | |
| *** jamesbenson has quit IRC | 06:52 | |
| *** edmondsw has joined #openstack-keystone | 06:52 | |
| *** edmondsw has quit IRC | 06:57 | |
| *** rcernin has joined #openstack-keystone | 07:00 | |
| *** andymccr has quit IRC | 07:07 | |
| *** asettle has quit IRC | 07:08 | |
| *** zsli_ has joined #openstack-keystone | 07:09 | |
| *** andymccr has joined #openstack-keystone | 07:09 | |
| *** asettle has joined #openstack-keystone | 07:10 | |
| *** asettle is now known as Guest3828 | 07:10 | |
| *** Shunli has quit IRC | 07:12 | |
| *** ioggstream has joined #openstack-keystone | 07:13 | |
| *** tonytan4ever has joined #openstack-keystone | 07:24 | |
| *** eglute has quit IRC | 08:14 | |
| *** eglute has joined #openstack-keystone | 08:14 | |
| *** markvoelker has joined #openstack-keystone | 08:31 | |
| *** Guest3828 is now known as asettle | 08:39 | |
| *** edmondsw has joined #openstack-keystone | 08:41 | |
| *** edmondsw has quit IRC | 08:45 | |
| *** markvoelker has quit IRC | 09:05 | |
| *** zsli_ has quit IRC | 09:27 | |
| *** tonytan4ever has quit IRC | 09:33 | |
| *** jamesbenson has joined #openstack-keystone | 09:56 | |
| *** jamesbenson has quit IRC | 10:00 | |
| *** markvoelker has joined #openstack-keystone | 10:02 | |
| *** masber has quit IRC | 10:06 | |
| *** masber has joined #openstack-keystone | 10:07 | |
| *** jmlowe has quit IRC | 10:10 | |
| *** zhurong has quit IRC | 10:27 | |
| *** edmondsw has joined #openstack-keystone | 10:29 | |
| *** edmondsw has quit IRC | 10:33 | |
| *** tonytan4ever has joined #openstack-keystone | 10:33 | |
| *** obre has quit IRC | 10:34 | |
| *** obre has joined #openstack-keystone | 10:34 | |
| *** markvoelker has quit IRC | 10:35 | |
| *** tonytan4ever has quit IRC | 10:38 | |
| *** raildo has joined #openstack-keystone | 10:47 | |
| *** Suramya has joined #openstack-keystone | 10:48 | |
| *** Suramya has quit IRC | 11:16 | |
| *** thorst has quit IRC | 11:16 | |
| *** markvoelker has joined #openstack-keystone | 11:32 | |
| *** mani_ has quit IRC | 11:39 | |
| *** jaosorior_sick is now known as jaosorior | 11:41 | |
| *** thorst has joined #openstack-keystone | 12:03 | |
| *** markvoelker has quit IRC | 12:06 | |
| *** markvoelker has joined #openstack-keystone | 12:18 | |
| *** mvk has quit IRC | 12:20 | |
| *** ioggstream has quit IRC | 12:21 | |
| *** ioggstream has joined #openstack-keystone | 12:24 | |
| *** jmlowe has joined #openstack-keystone | 12:28 | |
| efried | SamYaple lbragstad I took a quick look at that NotFound thing. | 12:29 |
| efried | I don't believe it's ksa's NotFound exception. | 12:29 |
| efried | I believe it's keystone's TokenNotFound exception. | 12:29 |
| *** pcaruana has quit IRC | 12:31 | |
| *** edmondsw has joined #openstack-keystone | 12:31 | |
| efried | Are we perchance using TokenlessAuth and providing an unversioned auth_url? | 12:33 |
| efried | Mm, I take back the thing about ksa's NotFound. That guy is involved. | 12:37 |
| *** slunkad has quit IRC | 12:37 | |
| *** slunkad has joined #openstack-keystone | 12:42 | |
| *** rmascena has joined #openstack-keystone | 12:53 | |
| *** erlon has joined #openstack-keystone | 12:53 | |
| *** panbalag has joined #openstack-keystone | 12:54 | |
| *** dave-mccowan has joined #openstack-keystone | 12:54 | |
| *** raildo has quit IRC | 12:55 | |
| *** panbalag has left #openstack-keystone | 12:55 | |
| *** slunkad has quit IRC | 12:57 | |
| *** pcaruana has joined #openstack-keystone | 13:00 | |
| *** belmoreira has joined #openstack-keystone | 13:01 | |
| *** raildo has joined #openstack-keystone | 13:01 | |
| *** rmascena has quit IRC | 13:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 13:02 |
| *** belmoreira has quit IRC | 13:06 | |
| *** belmorei_ has joined #openstack-keystone | 13:06 | |
| *** belmorei_ has quit IRC | 13:07 | |
| *** belmoreira has joined #openstack-keystone | 13:07 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 13:10 |
| *** chlong has quit IRC | 13:14 | |
| *** catintheroof has joined #openstack-keystone | 13:15 | |
| *** tonytan4ever has joined #openstack-keystone | 13:25 | |
| *** panbalag has joined #openstack-keystone | 13:31 | |
| *** jrist has quit IRC | 13:31 | |
| *** jaosorior has quit IRC | 13:34 | |
| *** jrist has joined #openstack-keystone | 13:35 | |
| kmARC | Hey guys, I'm still being driven crazy with cli auth for OpenID | 13:40 |
| kmARC | anyone has expertise in this? | 13:41 |
| kmARC | or an easy alternative (like, a user could get an access token from horizon, after logged in securely with openID) | 13:41 |
| lbragstad | kmARC: do you have a list of steps to recreate? | 13:44 |
| kmARC | - Installed Keycloak IDP. Configured, works well with Horizon. | 13:45 |
| kmARC | - Trying to use cli. No idea how to configure. | 13:45 |
| kmARC | That's it basically :-) | 13:45 |
| kmARC | right now my problem is that the v3oidcpassword plugin somehow tries to POST login data to one of the keycloak endpoints, however keycloak reports that HEAD, GET, OPTIONS are the only allowed operations | 13:46 |
| kmARC | I can see that the auth part works - a token is generated. If I screw up the password, I would get an authn error | 13:47 |
| kmARC | *authn part works | 13:47 |
| kmARC | also it works flawlessly through horizon so far. | 13:53 |
| *** alex_xu has quit IRC | 13:54 | |
| kmARC | If my users had any means of getting a client_secret/token/whatever through horizon with which they could configure their openrc, that'd be also fine | 13:54 |
| *** alex_xu has joined #openstack-keystone | 13:54 | |
| *** zhouyaguo has joined #openstack-keystone | 13:55 | |
| *** belmoreira has quit IRC | 13:57 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 14:00 |
| *** alex_xu has quit IRC | 14:02 | |
| *** links has quit IRC | 14:02 | |
| lbragstad | kmARC: you're not following a writeup of some kind, are you? | 14:02 |
| kmARC | now I tried to follow the Nash-Topol-Martinelli book, the error is the same | 14:03 |
| *** belmoreira has joined #openstack-keystone | 14:03 | |
| kmARC | https://books.google.ch/books?id=MZcpCwAAQBAJ&pg=PA91&lpg=PA91&dq=5.5.3+testing+it+all+out&source=bl&ots=bhqVpsW3tw&sig=FROSoOn_RcydyvG6114j25QECtY&hl=en&sa=X&ved=0ahUKEwiwqJX_hcjWAhXmDZoKHQwjDPoQ6AEIKDAA#v=onepage&q=5.5.3%20testing%20it%20all%20out&f=false | 14:03 |
| *** spzala has joined #openstack-keystone | 14:03 | |
| kmARC | Section 5.5.3 Testing it all out | 14:04 |
| kmARC | it lists a short python snippet to try to authenticate with the v3 oidc password plugin | 14:04 |
| kmARC | lbragstad do you have a recommendation on what writeup to follow? | 14:05 |
| lbragstad | kmARC: not really - that's why i was curious if you were following a specific one | 14:05 |
| lbragstad | stevemar: ^ | 14:05 |
| lbragstad | i think knikolla uses keycloak at BU? | 14:06 |
| *** slunkad has joined #openstack-keystone | 14:06 | |
| knikolla | lbragstad: not yet, but just did a POC for that. | 14:07 |
| kmARC | keep in mind, it works beautifully through horizon | 14:08 |
| *** jaosorior has joined #openstack-keystone | 14:08 | |
| knikolla | didn't get time to test the cli yet. | 14:08 |
| knikolla | only the horizon flow for now. | 14:08 |
| kmARC | right now I'm at a point where I'd rather implement a small service that gives my users a long lived token/clien_secret and configure keystone to accept that. | 14:08 |
| kmARC | knikolla: what kind of solution do you provide to your users with cli on the system where you have the horizon flow in place? | 14:10 |
| *** shewless has quit IRC | 14:12 | |
| knikolla | kmARC: am not going to roll it out to users until I solve the CLI use case. so i'll keep playing around with it when i get more time. | 14:12 |
| knikolla | kmARC: this is until app credentials get implemented, then there'll be a great story for that :) | 14:13 |
| kmARC | You're my gest for a beer in Sydney if you solve it somehow :-D | 14:13 |
| kmARC | app creds - if they are what I think they are - also works | 14:13 |
| lbragstad | yeah - that sounds like a great fit for app credentials | 14:13 |
| knikolla | kmARC: that's the correct motivation for an engineer. | 14:13 |
| lbragstad | we've got action items to update the specification and start the implementation this release | 14:14 |
| kmARC | :-S that's a bit too late for me :-) | 14:16 |
| kmARC | anyhow | 14:17 |
| *** jrist has quit IRC | 14:17 | |
| kmARC | now I'm gitblameing the v3oidcpassword folks and hunt them down for more info :-) | 14:17 |
| kmARC | So I haven't dug deep into horizon's code. But is my assumption correct that the horizon flow does _not_ use v3oidc{password,credentials} but it's all dispatched to apache2 mod_oidc? | 14:20 |
| *** zhouyaguo has quit IRC | 14:24 | |
| *** zhouyaguo has joined #openstack-keystone | 14:24 | |
| *** cfriesen__ has joined #openstack-keystone | 14:31 | |
| kmARC | stevemar: maybe? | 14:37 |
| *** dave-mccowan has quit IRC | 14:39 | |
| *** chlong has joined #openstack-keystone | 14:39 | |
| *** spotz_ is now known as spotz | 14:40 | |
| -openstackstatus- NOTICE: The infra team is now taking Zuul v2 offline and bringing Zuul v3 online. Please see https://docs.openstack.org/infra/manual/zuulv3.html for more information, and ask us in #openstack-infra if you have any questions. | 14:42 | |
| *** dave-mccowan has joined #openstack-keystone | 14:44 | |
| *** slunkad has quit IRC | 14:47 | |
| *** slunkad has joined #openstack-keystone | 14:51 | |
| knikolla | kmARC: that is correct. it uses the apache mod | 14:56 |
| *** slunkad has quit IRC | 14:56 | |
| kmARC | Ah okay, obviously the difference between the horizon flow and the cli flow is that the cli sends the username/password itself to IDP, while with horizon it's the user who enters it. | 14:56 |
| knikolla | yep | 14:56 |
| *** gyee has joined #openstack-keystone | 14:58 | |
| *** jrist has joined #openstack-keystone | 14:59 | |
| *** belmorei_ has joined #openstack-keystone | 14:59 | |
| *** belmoreira has quit IRC | 15:00 | |
| kmARC | This is what happens: | 15:05 |
| kmARC | - REQ: curl -g -i -X POST https://keycloak/auth/realms/<REALM>/protocol/openid-connect/token | 15:05 |
| kmARC | - an access_token is generated. this is how one talks to keycloak APIs (I've done it many times), with a Authorization: Bearer <token> header. | 15:05 |
| kmARC | - this means that the authentication works. | 15:05 |
| kmARC | - REQ: curl -g -i -X POST http://openstack-keystone/v3/OS-FEDERATION/identity_providers/<IDP>/protocols/openid/auth | 15:05 |
| kmARC | - this is then gives back the apache mod_oidc response, which includes the IDP authentication endpoint. In my case this is gonna be: | 15:05 |
| kmARC | Location: https://keycloak/auth/realms/<REALM>/protocol/openid-connect/auth?response_type=code& | 15:05 |
| kmARC | scope=openid%20email%20profile&client_id=<CLIENT_ID>&state=gWTSWn1C9mPJFaOiQRvy2WYiiXI&redirect_uri=http%3A%2F%2Fopenstack-keystone%2Fv3%2FOS-FEDERATION%2Fidentity_providers%2F<IDP>%2Fprotocols%2Fopenid%2Fauth%2Fredirect&nonce=kH3H6X2n66Y83ca72hP_ZO5N5w_lK1onitb8SOQIPJk | 15:05 |
| kmARC | - then openstackclient issues a POST request to this location. keycloak gives back an error: | 15:05 |
| kmARC | RESP: [405] ... WildFly/10 Allow: HEAD, GET, OPTIONS X-Powered-By: Undertow/1 ... | 15:05 |
| kmARC | so this last step is supposed to be a form post. | 15:06 |
| kmARC | which is - I guess - up to the idp how they implement it, isn't it? | 15:06 |
| *** dave-mcc_ has joined #openstack-keystone | 15:07 | |
| kmARC | Or is there any specification how it is supposed to be implemented in an ID provider? That would be strange, I mean what if an identity provider doesn't even let username/password auth but let's say face recogniton or such | 15:07 |
| *** jamesbenson has joined #openstack-keystone | 15:07 | |
| *** dave-mccowan has quit IRC | 15:09 | |
| *** jaosorior has quit IRC | 15:12 | |
| *** spzala has quit IRC | 15:14 | |
| *** lamt has joined #openstack-keystone | 15:16 | |
| kmARC | According to the RFC, | 15:19 |
| kmARC | "The authorization endpoint is used to interact with the resource | 15:19 |
| kmARC | owner and obtain an authorization grant. The authorization server | 15:19 |
| kmARC | MUST first verify the identity of the resource owner. The way in | 15:19 |
| kmARC | which the authorization server authenticates the resource owner | 15:19 |
| kmARC | (e.g., username and password login, session cookies) is beyond the | 15:19 |
| kmARC | scope of this specification." | 15:19 |
| kmARC | ... | 15:19 |
| kmARC | " The authorization server MUST support the use of the HTTP "GET" | 15:19 |
| kmARC | method [RFC2616] for the authorization endpoint and MAY support the | 15:19 |
| kmARC | use of the "POST" method as well." | 15:19 |
| kmARC | Source: https://tools.ietf.org/html/rfc6749 | 15:19 |
| kmARC | So it seems the implementation is bugous in the sense that it expects the auth endpoint to accept POST, however, according to the RFC, it's not required :-\ | 15:20 |
| *** zhouyaguo has quit IRC | 15:27 | |
| knikolla | jdennis is the keycloak expert | 15:33 |
| *** jrist has quit IRC | 15:36 | |
| kmARC | jdennis: helpme :-) | 15:42 |
| *** cfriesen__ is now known as cfriesen | 15:42 | |
| jdennis | kmARC: sorry I can't be of immediate assistance, I know keycloak well with SAML but hardly at all with openidc | 15:43 |
| *** spzala has joined #openstack-keystone | 15:44 | |
| kmARC | :-( | 15:45 |
| *** edmondsw has quit IRC | 15:46 | |
| *** rcernin has quit IRC | 15:46 | |
| *** tonytan4ever_brb has joined #openstack-keystone | 15:47 | |
| jdennis | kmARC: I suggest you try the keycloak user list: https://lists.jboss.org/mailman/listinfo/keycloak-user | 15:47 |
| *** tonytan4ever has quit IRC | 15:47 | |
| kmalloc | kmARC, jdennis: this might be something osc/keystoneauth is assuming | 15:47 |
| kmalloc | keycloak might be doing the right (ish) thing here | 15:47 |
| *** spzala has quit IRC | 15:48 | |
| kmalloc | we may only support (currently) the use of IDPs that support post. | 15:49 |
| kmalloc | and that is fine, it's not a bogus implementation, it's a narrow implementation that doesn't cover the whole spec. | 15:49 |
| kmalloc | OIDC via CLI tools has always been very difficult | 15:50 |
| kmalloc | since OIDC (like most SSO tech) assumes a web browser | 15:50 |
| jdennis | kmalloc: so this is a command line issue and not browser? | 15:51 |
| *** belmorei_ has quit IRC | 15:51 | |
| kmalloc | jdennis: if i'm reading it right, yes | 15:52 |
| kmalloc | jdennis: looks like OSC is trying to POST to keycloak and keycloak says "hah, no, get or head" | 15:53 |
| kmalloc | jdennis: i don't think this is a keycloak issue. | 15:54 |
| kmalloc | (well keycloak *could* support posts, but in this case doesn't seem to) | 15:54 |
| kmalloc | it might be a config issue on keystone's side/mod_oidc | 15:55 |
| jdennis | kmalloc: I'd have to look at the code, the spec and review some recent posts on how KC handles tokens for command line access, but I can't jump into this atm | 15:55 |
| kmalloc | jdennis: yeah i figured, just wanted to let you know it doesn't look like it's fundamentally a keycloak issue. it looks more on the Openstack side/config sided | 15:57 |
| jdennis | ok | 15:58 |
| kmARC | kmalloc pls read my findings above. The RFC says IDP MAY support POST, however keycloak does not. It MUST support GET tho, therefore the correct implementation should use GET. | 15:58 |
| jdennis | kmalloc, kmARC: if someone wants to open a bug and assign it to me I'll try to look at it when I get the chance | 15:59 |
| kmARC | jdennis, sounds good, thanks. | 15:59 |
| kmARC | will do tomorrow, for today I'm braindead. | 15:59 |
| kmalloc | kmARC: right like i said, it very well might be on the keystoneauth/osc side, we may have implemented a narrow form of supported oidc idps, we can expand, but it is likely that change is not going to be backportable directly and will become usable in queens (we can evaluate backports, but I can't commit to them at this point) | 16:01 |
| *** sbezverk has quit IRC | 16:01 | |
| kmARC | this looks like a client issue, therefore I'm expecting the proposed bugfix to work backward-compatible with the Mitaka server - after all, the browser flow works. So I'm looking forward to the fix. I know python unfortunately well enough to volunteer to help with coding :-) | 16:03 |
| *** itlinux has joined #openstack-keystone | 16:04 | |
| kmalloc | kmARC: the issue is the way things are implement in openstackclient and keystoneauth | 16:04 |
| kmalloc | those are also locked to specific releases [sometimes] | 16:04 |
| kmalloc | and distributions tend to bundle the releases | 16:05 |
| kmalloc | it may require a much newer client and that could be incompatible if you're running on a system with other openstack-related-things (non-venv, etc) | 16:05 |
| kmalloc | just wanted to give you an FYI | 16:05 |
| kmARC | jdennis: I'm much more looking forward to a solution that works without the shady form post. like v3oidcauthcode or v3oidcaccesstoken. Let me know if you know how to configure keycloak to enable users to create `API tokens`, `API secrets` or something like that, with which they'd be able to issue a secret key that authenticates them into various service providers - if at all this is possible | 16:05 |
| kmARC | kmalloc, regarding versions, it's not a problem I think, if I document the means of accessing openstack APIs for my users, and it involves virtualenv, then it is what it is, they're still gonna be happy. | 16:06 |
| kmalloc | wfm :) | 16:06 |
| *** jrist has joined #openstack-keystone | 16:10 | |
| *** itlinux has quit IRC | 16:15 | |
| *** aselius has joined #openstack-keystone | 16:15 | |
| *** itlinux has joined #openstack-keystone | 16:29 | |
| SamYaple | efried: its fernet tokens, and there should be no tokenless auth goign on | 16:30 |
| kmARC | jdennis: wait a sec. The `openstack` doesn't list any SAML related auth types... O.o | 16:30 |
| *** slunkad has joined #openstack-keystone | 16:40 | |
| *** spzala has joined #openstack-keystone | 17:12 | |
| *** itlinux has quit IRC | 17:51 | |
| *** panbalag has quit IRC | 17:52 | |
| *** itlinux has joined #openstack-keystone | 17:53 | |
| *** edmondsw has joined #openstack-keystone | 18:01 | |
| *** edmondsw has quit IRC | 18:04 | |
| *** edmondsw has joined #openstack-keystone | 18:04 | |
| lbragstad | gagehugo: o/ | 18:08 |
| lbragstad | did you have anything specific in mind for the last session here? https://etherpad.openstack.org/p/SYD-keystone-forum-sessions | 18:08 |
| gagehugo | lbragstad other than what's on there not really | 18:09 |
| gagehugo | was just an idea in case we were lacking them | 18:09 |
| lbragstad | gagehugo: think we should propose a session specific to jwt? | 18:10 |
| gagehugo | hmm | 18:11 |
| gagehugo | dunno if that would fill an entire session? | 18:11 |
| gagehugo | it might be a good idea | 18:11 |
| lbragstad | probably not? | 18:12 |
| lbragstad | that might be something we can do solely in a specification | 18:12 |
| lbragstad | gagehugo: https://trello.com/c/25sBHXcM/14-write-up-a-specification-for-json-web-tokens | 18:12 |
| gagehugo | yeah | 18:12 |
| *** aojea has quit IRC | 18:12 | |
| gagehugo | maybe jwt as part of operator feedback? | 18:12 |
| *** aojea has joined #openstack-keystone | 18:13 | |
| *** aojea has quit IRC | 18:17 | |
| *** aojea has joined #openstack-keystone | 18:18 | |
| *** itlinux has quit IRC | 18:20 | |
| *** itlinux has joined #openstack-keystone | 18:36 | |
| *** aojea has quit IRC | 18:37 | |
| *** aojea has joined #openstack-keystone | 18:38 | |
| *** ioggstream has quit IRC | 18:41 | |
| *** aojea has quit IRC | 18:42 | |
| *** aruna has joined #openstack-keystone | 18:52 | |
| aruna | Hi , created a new domain , user, project , role in devstack .But get this error while trying to do "openstack user list " | 18:53 |
| aruna | User has no access to project _populate_roles /opt/stack/keystone/keystone/token/providers/common.py:339 | 18:53 |
| aruna | any help ? | 18:53 |
| *** mvk has joined #openstack-keystone | 18:59 | |
| *** itlinux has quit IRC | 19:02 | |
| *** spzala has quit IRC | 19:10 | |
| *** spzala has joined #openstack-keystone | 19:15 | |
| *** spzala_ has joined #openstack-keystone | 19:17 | |
| *** aojea has joined #openstack-keystone | 19:17 | |
| *** spzala__ has joined #openstack-keystone | 19:18 | |
| *** spzala has quit IRC | 19:20 | |
| *** spzala__ has quit IRC | 19:21 | |
| *** spzala_ has quit IRC | 19:22 | |
| *** itlinux has joined #openstack-keystone | 19:25 | |
| *** spzala_ has joined #openstack-keystone | 19:25 | |
| *** spzala has joined #openstack-keystone | 19:27 | |
| *** spzala_ has quit IRC | 19:30 | |
| *** pcaruana has quit IRC | 19:31 | |
| lbragstad | aruna: that users needs a role on a project in order to do that | 19:34 |
| lbragstad | do you have an admin user available? devstack will provide one for you | 19:34 |
| lbragstad | (you see the credentials listed when devstack exits) | 19:34 |
| *** spzala has quit IRC | 19:36 | |
| aruna | @lbragstad : got it thanks | 19:37 |
| lbragstad | this would be a good backport to get merged - https://review.openstack.org/#/c/504084/1 | 19:45 |
| *** aruna has quit IRC | 19:51 | |
| *** chlong has quit IRC | 20:03 | |
| gagehugo | lbragstad is https://review.openstack.org/#/c/491574/13/keystone/common/utils.py ok for a comment? | 20:05 |
| lbragstad | gagehugo: oh - yes, that will work | 20:07 |
| lbragstad | thanks! | 20:07 |
| gagehugo | I'll fix the tags # after that merges | 20:07 |
| lbragstad | gagehugo: is there a unified stance on implementing HEAD for tag APIs? | 20:07 |
| lbragstad | we have the whole "all GET methods should also support HEAD" | 20:07 |
| lbragstad | but - we don't have those documented in the spec or policy | 20:08 |
| lbragstad | for project tags, | 20:08 |
| lbragstad | i'm wondering if that will result in a bug asking for it to be added later? | 20:08 |
| gagehugo | could be, the controller/router has get_or_head | 20:08 |
| *** catintheroof has quit IRC | 20:09 | |
| lbragstad | oh - nice | 20:09 |
| lbragstad | so it's implemented already | 20:09 |
| gagehugo | yeah I think this was brought up earlier | 20:11 |
| gagehugo | I don't think the api-ref says explicitly that you can do HEAD | 20:11 |
| gagehugo | but it's implemented | 20:12 |
| lbragstad | gagehugo: does the API ref for project tags have something against doing HEAD? | 20:12 |
| lbragstad | or implementing HEAD? | 20:12 |
| gagehugo | http://docs-draft.openstack.org/96/472396/18/check/gate-keystone-api-ref/b38e869//api-ref/build/html/v3/index.html#project-tags | 20:13 |
| lbragstad | ah - we should modify that patch so that it documents head, too | 20:15 |
| gagehugo | sure | 20:15 |
| lbragstad | 1.) because all keystone v3 GET methods should also support HEAD | 20:15 |
| lbragstad | 2.) the work is already done ;) | 20:15 |
| *** spzala has joined #openstack-keystone | 20:19 | |
| *** thorst has quit IRC | 20:26 | |
| *** itlinux has quit IRC | 20:30 | |
| *** itlinux has joined #openstack-keystone | 20:33 | |
| *** jamesbenson has quit IRC | 20:35 | |
| *** raildo has quit IRC | 20:42 | |
| *** rcernin has joined #openstack-keystone | 20:42 | |
| *** thorst has joined #openstack-keystone | 20:43 | |
| *** thorst has quit IRC | 21:00 | |
| *** thorst has joined #openstack-keystone | 21:00 | |
| *** spzala has quit IRC | 21:05 | |
| gagehugo | lbragstad thanks for the reviews! | 21:07 |
| lbragstad | gagehugo: yep! stuff looks real good | 21:08 |
| lbragstad | gagehugo: most of my comments are style things | 21:08 |
| lbragstad | otherwise the code looks really clean, good work | 21:08 |
| lbragstad | cc lamt ^ | 21:09 |
| lbragstad | and the rest of the AT&T team | 21:09 |
| *** thorst has quit IRC | 21:11 | |
| gagehugo | will do | 21:11 |
| gagehugo | I like that removing the v2 stuff makes this easier | 21:11 |
| gagehugo | spent more time than I liked getting the v2 tests to pass :( | 21:12 |
| lbragstad | gagehugo: yeah... sorry about that =/ | 21:15 |
| lbragstad | i spent an entire flight getting v2 auth ripped out and refactoring tests, i feel your pain | 21:16 |
| gagehugo | heh | 21:16 |
| *** itlinux has quit IRC | 21:26 | |
| *** thorst has joined #openstack-keystone | 21:32 | |
| *** itlinux has joined #openstack-keystone | 21:35 | |
| *** thorst has quit IRC | 21:36 | |
| *** itlinux has quit IRC | 21:37 | |
| *** chlong has joined #openstack-keystone | 21:41 | |
| *** aojea has quit IRC | 21:45 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add JSON schema validation for project tags https://review.openstack.org/484483 | 22:05 |
| gagehugo | I think there's some zuul funny business | 22:06 |
| gagehugo | lbragstad I'm gonna put some depends on for these patches instead of rebasing them all on each other | 22:06 |
| *** thorst has joined #openstack-keystone | 22:13 | |
| *** thorst has quit IRC | 22:17 | |
| *** r-daneel has joined #openstack-keystone | 22:18 | |
| *** thorst has joined #openstack-keystone | 22:23 | |
| *** catintheroof has joined #openstack-keystone | 22:24 | |
| *** r-daneel has quit IRC | 22:29 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs master: Update project-tags spec https://review.openstack.org/508339 | 22:29 |
| *** thorst has quit IRC | 22:35 | |
| *** thorst has joined #openstack-keystone | 22:36 | |
| *** lbragstad has quit IRC | 22:37 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add policy for project tags https://review.openstack.org/486757 | 22:41 |
| *** thorst has quit IRC | 22:42 | |
| *** thorst has joined #openstack-keystone | 22:45 | |
| *** thorst has quit IRC | 22:58 | |
| *** thorst has joined #openstack-keystone | 22:58 | |
| *** masber has quit IRC | 23:02 | |
| *** jmlowe has quit IRC | 23:19 | |
| *** itlinux has joined #openstack-keystone | 23:25 | |
| *** itlinux has quit IRC | 23:31 | |
| *** thorst has quit IRC | 23:31 | |
| *** markvoelker has quit IRC | 23:37 | |
| *** thorst has joined #openstack-keystone | 23:39 | |
| *** jmlowe has joined #openstack-keystone | 23:42 | |
| *** thorst has quit IRC | 23:54 | |
| *** thorst has joined #openstack-keystone | 23:55 | |
| *** stevelle001 has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!