| openstackgerrit | ayoung proposed openstack/keystone master: Add is_admin_project check to policy for non scoped operations https://review.openstack.org/257636 | 00:00 |
|---|---|---|
| openstackgerrit | ayoung proposed openstack/keystone master: Add is_admin_project check to policy for token validations https://review.openstack.org/520845 | 00:00 |
| *** itlinux has quit IRC | 00:07 | |
| *** gyee_ has quit IRC | 00:13 | |
| openstackgerrit | Merged openstack/oslo.policy master: Remove setting of version/release from releasenotes https://review.openstack.org/520775 | 00:14 |
| *** sticker has joined #openstack-keystone | 00:25 | |
| *** daidv has quit IRC | 00:30 | |
| *** daidv has joined #openstack-keystone | 00:31 | |
| *** markvoelker has quit IRC | 00:31 | |
| *** zhurong has joined #openstack-keystone | 00:34 | |
| *** markvoelker has joined #openstack-keystone | 00:43 | |
| *** gmann_afk is now known as gmann | 00:50 | |
| *** panbalag has joined #openstack-keystone | 01:14 | |
| *** daniepar has quit IRC | 01:19 | |
| *** zhurong has quit IRC | 01:34 | |
| *** annp has joined #openstack-keystone | 02:30 | |
| *** namnh has joined #openstack-keystone | 02:45 | |
| *** itlinux has joined #openstack-keystone | 02:53 | |
| *** links has joined #openstack-keystone | 03:03 | |
| *** aselius has quit IRC | 03:04 | |
| *** _ix has joined #openstack-keystone | 03:27 | |
| *** jrist has quit IRC | 03:29 | |
| *** itlinux has quit IRC | 03:36 | |
| *** itlinux has joined #openstack-keystone | 03:45 | |
| *** jrist has joined #openstack-keystone | 03:53 | |
| *** dave-mccowan has quit IRC | 04:19 | |
| *** itlinux has quit IRC | 04:24 | |
| *** itlinux has joined #openstack-keystone | 04:33 | |
| *** itlinux has quit IRC | 04:33 | |
| *** daidv has quit IRC | 04:42 | |
| openstackgerrit | Deepak Mourya proposed openstack/keystoneauth master: Remove setting of version/release from releasenotes https://review.openstack.org/520882 | 04:42 |
| *** daidv has joined #openstack-keystone | 04:42 | |
| *** sticker has quit IRC | 04:46 | |
| *** aojea has joined #openstack-keystone | 04:46 | |
| *** itlinux has joined #openstack-keystone | 04:49 | |
| *** aojea has quit IRC | 04:52 | |
| openstackgerrit | Deepak Mourya proposed openstack/keystone master: Remove setting of version/release from releasenotes https://review.openstack.org/520892 | 05:06 |
| *** jaosorior has joined #openstack-keystone | 05:12 | |
| *** itlinux has quit IRC | 05:35 | |
| *** itlinux has joined #openstack-keystone | 05:38 | |
| *** _ix has quit IRC | 05:48 | |
| *** itlinux has quit IRC | 05:51 | |
| *** aojea has joined #openstack-keystone | 05:53 | |
| *** aojea has quit IRC | 05:58 | |
| *** wes_dillingham has quit IRC | 06:04 | |
| *** zhurong has joined #openstack-keystone | 06:41 | |
| *** belmoreira has joined #openstack-keystone | 06:43 | |
| *** aojea has joined #openstack-keystone | 06:54 | |
| *** aojea has quit IRC | 06:58 | |
| *** markvoelker has quit IRC | 06:59 | |
| *** pcaruana has joined #openstack-keystone | 07:04 | |
| *** rcernin has quit IRC | 07:18 | |
| *** namnh has quit IRC | 07:27 | |
| *** zhurong has quit IRC | 07:43 | |
| *** kmalloc has quit IRC | 07:54 | |
| *** aojea has joined #openstack-keystone | 07:54 | |
| *** markvoelker has joined #openstack-keystone | 08:00 | |
| *** aojea has quit IRC | 08:00 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:01 | |
| *** jmlowe has quit IRC | 08:27 | |
| *** belmoreira has quit IRC | 08:47 | |
| *** aojea has joined #openstack-keystone | 08:56 | |
| *** aojea has quit IRC | 09:01 | |
| openstackgerrit | Andreas Jaeger proposed openstack/keystonemiddleware master: Remove setting of version/release from releasenotes https://review.openstack.org/521021 | 09:15 |
| *** aojea has joined #openstack-keystone | 09:57 | |
| *** aojea has quit IRC | 10:01 | |
| *** sapd__ has quit IRC | 10:09 | |
| *** sapd__ has joined #openstack-keystone | 10:14 | |
| *** magicboiz has quit IRC | 10:16 | |
| *** daidv has quit IRC | 10:26 | |
| *** gmann is now known as gmann_afk | 10:37 | |
| *** annp has quit IRC | 10:37 | |
| *** magicboiz has joined #openstack-keystone | 10:48 | |
| *** magicboiz has quit IRC | 10:52 | |
| *** aojea has joined #openstack-keystone | 10:58 | |
| *** magicboiz has joined #openstack-keystone | 10:59 | |
| *** aojea has quit IRC | 11:02 | |
| *** aojea has joined #openstack-keystone | 11:59 | |
| *** aojea has quit IRC | 12:03 | |
| *** raildo has joined #openstack-keystone | 12:05 | |
| *** panbalag has quit IRC | 12:23 | |
| *** clayton has quit IRC | 12:44 | |
| *** efried is now known as fried_rice | 12:55 | |
| *** aojea has joined #openstack-keystone | 12:59 | |
| *** magicboiz has quit IRC | 13:04 | |
| *** aojea has quit IRC | 13:04 | |
| *** edmondsw has joined #openstack-keystone | 13:17 | |
| *** links has quit IRC | 13:19 | |
| *** wes_dillingham has joined #openstack-keystone | 13:23 | |
| *** clayton has joined #openstack-keystone | 13:29 | |
| *** swain has joined #openstack-keystone | 13:31 | |
| *** markvoelker has quit IRC | 13:34 | |
| *** markvoelker has joined #openstack-keystone | 13:34 | |
| *** sbezverk has quit IRC | 13:35 | |
| *** sbezverk has joined #openstack-keystone | 13:36 | |
| *** clayton has quit IRC | 13:38 | |
| *** clayton has joined #openstack-keystone | 13:39 | |
| *** panbalag has joined #openstack-keystone | 13:44 | |
| *** dklyle has quit IRC | 13:48 | |
| *** aojea has joined #openstack-keystone | 14:00 | |
| *** aojea has quit IRC | 14:05 | |
| *** dave-mcc_ has joined #openstack-keystone | 14:24 | |
| *** panbalag has left #openstack-keystone | 14:29 | |
| *** aojea has joined #openstack-keystone | 15:01 | |
| *** spilla has joined #openstack-keystone | 15:02 | |
| *** aojea has quit IRC | 15:05 | |
| *** rmascena has joined #openstack-keystone | 15:16 | |
| *** raildo has quit IRC | 15:19 | |
| *** jaosorior has quit IRC | 15:19 | |
| *** david-lyle has joined #openstack-keystone | 15:24 | |
| *** itlinux has joined #openstack-keystone | 15:31 | |
| *** swain has quit IRC | 15:41 | |
| *** itlinux has quit IRC | 15:42 | |
| *** itlinux has joined #openstack-keystone | 15:44 | |
| *** panbalag has joined #openstack-keystone | 15:47 | |
| *** ayoung has quit IRC | 15:48 | |
| *** ayoung has joined #openstack-keystone | 15:49 | |
| *** phalmos has joined #openstack-keystone | 15:59 | |
| *** aojea has joined #openstack-keystone | 16:02 | |
| *** david-lyle has quit IRC | 16:02 | |
| *** david-lyle has joined #openstack-keystone | 16:03 | |
| *** phalmos has quit IRC | 16:04 | |
| *** AlexeyAbashkin has quit IRC | 16:05 | |
| *** aojea has quit IRC | 16:06 | |
| *** gyee_ has joined #openstack-keystone | 16:09 | |
| *** panbalag has quit IRC | 16:18 | |
| *** panbalag has joined #openstack-keystone | 16:20 | |
| *** f13o has joined #openstack-keystone | 16:28 | |
| *** _ix has joined #openstack-keystone | 16:34 | |
| *** catmando has joined #openstack-keystone | 16:36 | |
| *** jistr has quit IRC | 16:39 | |
| *** panbalag has left #openstack-keystone | 16:41 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Have project get domain_id from parent https://review.openstack.org/489655 | 16:42 |
| *** jistr has joined #openstack-keystone | 16:43 | |
| *** f13o has quit IRC | 17:01 | |
| *** aojea has joined #openstack-keystone | 17:03 | |
| *** fried_rice is now known as fried_rolls | 17:06 | |
| *** aojea has quit IRC | 17:07 | |
| *** _ix has quit IRC | 17:21 | |
| *** catmando has quit IRC | 17:49 | |
| *** aselius has joined #openstack-keystone | 17:58 | |
| *** aojea has joined #openstack-keystone | 18:03 | |
| *** aojea has quit IRC | 18:07 | |
| *** _ix has joined #openstack-keystone | 18:29 | |
| *** aojea has joined #openstack-keystone | 18:51 | |
| *** aojea has quit IRC | 18:51 | |
| *** aojea has joined #openstack-keystone | 18:51 | |
| *** magicboiz has joined #openstack-keystone | 18:56 | |
| *** aojea has quit IRC | 19:02 | |
| *** _ix has quit IRC | 19:12 | |
| *** fried_rolls is now known as fried_rice | 19:17 | |
| *** itlinux has quit IRC | 19:31 | |
| *** itlinux has joined #openstack-keystone | 19:33 | |
| *** magicboiz has quit IRC | 19:35 | |
| *** itlinux has quit IRC | 19:50 | |
| *** itlinux has joined #openstack-keystone | 19:54 | |
| *** _ix has joined #openstack-keystone | 20:09 | |
| *** rmascena has quit IRC | 20:11 | |
| *** magicboiz has joined #openstack-keystone | 20:23 | |
| ayoung | rodrigods, cmurphy Trying to figure out why this test is now failing:" http://logs.openstack.org/36/257636/34/check/legacy-tempest-dsvm-py35/e936c97/ | 20:33 |
| ayoung | http://logs.openstack.org/36/257636/34/check/legacy-tempest-dsvm-py35/e936c97/ara/ is new to me, but cool | 20:33 |
| ayoung | tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_domain_create_duplicate[id-e6f9e4a2-4f36-4be8-bdbc-4e199ae29427,negative] fails due to b"Details: {'title': 'Forbidden', 'message': 'You are not authorized to perform the requested action: identity:create_domain.', 'code': 403}" | 20:34 |
| ayoung | hrybacki, I'll ask you, too | 20:37 |
| ayoung | Did something change in how we are doing policy, such that my changes for is_admin_project are no longer inert by default? | 20:38 |
| ayoung | I don't see anything in Tempest that would have cause the change, so I'm guessing it is an assumption in Keystone that is no longer valid | 20:38 |
| ayoung | edmondsw, ? | 20:38 |
| rodrigods | hmm that's odd | 20:39 |
| rodrigods | can you paste the review that is failing? | 20:39 |
| hrybacki | (meeting) | 20:39 |
| ayoung | https://review.openstack.org/#/c/257636/ | 20:39 |
| ayoung | rodrigods, ^^ | 20:39 |
| rodrigods | wow, Dec 2015 | 20:40 |
| rodrigods | heh | 20:40 |
| ayoung | rodrigods, it looks like the default is_admin_project=True is not being kept | 20:41 |
| ayoung | rodrigods, yep | 20:41 |
| ayoung | rodrigods, so, here's the thing. If that change affected default behavior, then the unit tests should fail. They pass | 20:42 |
| ayoung | But Tempest fails, which means that, in a running system, the logic is no longer valid | 20:42 |
| *** itlinux has quit IRC | 20:43 | |
| rodrigods | right | 20:49 |
| *** magicboiz has quit IRC | 20:51 | |
| *** jmlowe has joined #openstack-keystone | 20:55 | |
| edmondsw | gagehugo I think I remember you breaking is_admin_project briefly, but I thought we quickly reverted that, didn't we? | 21:00 |
| gagehugo | edmondsw heh | 21:00 |
| gagehugo | yes we did | 21:00 |
| edmondsw | any other ideas on the above? | 21:00 |
| *** jmlowe has quit IRC | 21:01 | |
| *** ianw has quit IRC | 21:02 | |
| gagehugo | hmm | 21:02 |
| *** wes_dillingham has quit IRC | 21:03 | |
| gagehugo | is tempest using a domain scoped token? | 21:03 |
| gagehugo | I have no idea how those tests are done under the hood, I'd have to look | 21:04 |
| *** ianw has joined #openstack-keystone | 21:09 | |
| edmondsw | ayoung keystoneauth still assumes is_admin_project=True if the token data doesn't include is_admin_project https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/access/access.py#L606 | 21:13 |
| edmondsw | I always thought that was the wrong place to put it... I'd prefer https://review.openstack.org/#/c/311203/ so that it's the same if something isn't using keystoneauth | 21:17 |
| edmondsw | would also help avoid what may be happening here... something started setting is_admin_project other than keystoneauth? | 21:17 |
| *** AlexeyAbashkin has joined #openstack-keystone | 21:19 | |
| *** AlexeyAbashkin has quit IRC | 21:24 | |
| edmondsw | oh, ayoung, I think you have to say token.is_admin_project:True, not just is_admin_project:True | 21:38 |
| ayoung | edmondsw, I actually wrote exactly that, but jamielennox wrote the keystoneauth approach, and I let him win | 21:41 |
| ayoung | edmondsw, so I need to change my review? | 21:41 |
| edmondsw | yep | 21:41 |
| ayoung | edmondsw, cool, let me change that. Thanks | 21:42 |
| edmondsw | np | 21:42 |
| ayoung | edmondsw, ah...is this because Keystone is enforcing on token and not on the keystoneauth? | 21:43 |
| ayoung | I recall that beiung the case originally | 21:43 |
| ayoung | edmondsw, for example, there is another rule: | 21:44 |
| ayoung | RULE_TRUST_OWNER = 'user_id:%(trust.trustor_user_id)s' | 21:44 |
| ayoung | and that is not token.trust. I think that token is not part of the context (not sure why that is) and thus can't be used for enforcing policy anymore. | 21:45 |
| edmondsw | ayoung the format of the target info that's passed to oslo.policy is totally different depending on the API implementation | 21:46 |
| edmondsw | it's a mess | 21:46 |
| edmondsw | one of the things lbragstad and I have been talking about needing to fix | 21:47 |
| ayoung | edmondsw, right. But I am fairly certain that I had it the way you specified in an earlier version of the patch, and then jamielennox changed the policy enforcement in keystone to use auth. I think something else is wrong here | 21:47 |
| ayoung | let me look. | 21:47 |
| edmondsw | ayoung I know in pike and previous you had to do token.is_admin_project because that's what I've done in my policy files | 21:48 |
| ayoung | edmondsw, I wrote some of this, and jamielennox affected changes , too: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/authorization.py#n71 | 21:49 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n116 | 21:50 |
| ayoung | OK so the whole common path starts with authorization.check_protection | 21:50 |
| ayoung | that calls check_policy | 21:51 |
| ayoung | creds = _build_policy_check_credentials | 21:51 |
| ayoung | return context['environment'].get(AUTH_CONTEXT_ENV, {}) | 21:52 |
| ayoung | so I suspect that my token_to_auth_context function is dead code. Should try to remove it and see what happens. | 21:52 |
| ayoung | nope it is called in keystone/middleware/auth.py:196: | 21:53 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/authorization.py#n124 is where is_admin_project is set | 21:53 |
| ayoung | and...I was pretty sure that would work | 21:54 |
| ayoung | I guess jamielennox never got the Keystone server to use keystoneauth context for policy. SHoemakers kids and all that | 21:54 |
| edmondsw | I think that RULE_TRUST_OWNER is using trust.trustor_user_id instead of token.trustor_user_id because the former comes from the request body and the latter comes from the token used to make the request | 21:54 |
| edmondsw | (since you mentioned that above) | 21:55 |
| ayoung | Oh, that may well be true | 21:55 |
| edmondsw | pretty sure it is | 21:55 |
| edmondsw | will be much simpler when we hardcode things that nobody should ever be changing | 21:56 |
| ayoung | edmondsw, so if we do token.* in a policy rule, does that come from the environment instead? | 21:56 |
| ayoung | like this one? | 21:56 |
| edmondsw | comes from the token that was use to make the request | 21:56 |
| ayoung | well, I can always try it and see what happens | 21:56 |
| ayoung | -RULE_ADMIN_PROJECT_REQUIRED = '(rule:admin_required and is_admin_project:True)' | 21:57 |
| ayoung | +RULE_ADMIN_PROJECT_REQUIRED = '(rule:admin_required and token.is_admin_project:True)' | 21:57 |
| ayoung | edmondsw, that is what you are saying, right? | 21:57 |
| edmondsw | ayoung yes | 21:57 |
| openstackgerrit | ayoung proposed openstack/keystone master: Add is_admin_project check to policy for non scoped operations https://review.openstack.org/257636 | 21:57 |
| ayoung | Fire in the hole! | 21:57 |
| * edmondsw ducks | 21:57 | |
| ayoung | quack | 21:58 |
| ayoung | edmondsw, so...the general approach is to get this one in, and the comparable one for nova. In parallel, get Global roles written and working, and then get those into the authcontext, then modify these rules to use global role and or is_admin_propject, then deprecate. Right? | 21:59 |
| edmondsw | ayoung s/Global roles/system scope/ but otherwise... sounds about right | 22:01 |
| ayoung | edmondsw, https://review.openstack.org/#/c/257636/1/etc/policy.json that was version 1. So, yeah, what you said. | 22:01 |
| ayoung | Right, system scoped... | 22:01 |
| ayoung | patch set 4 is where I droppped the token. and I assume that was based IRC offline convos with jamielennox | 22:02 |
| edmondsw | he can't always be right :) | 22:03 |
| *** spilla has quit IRC | 22:05 | |
| ayoung | edmondsw, is https://review.openstack.org/#/c/384148/ looking right to you? | 22:05 |
| ayoung | THat is the nova one | 22:05 |
| edmondsw | the nova change is... complicated. I'll have to look at it later | 22:08 |
| edmondsw | if you think you've addressed my comment from Dec 15... | 22:08 |
| edmondsw | I've learned to assume that a new ayoung change set probably didn't address my comments from the previous change sets :) | 22:10 |
| ayoung | edmondsw, addressed, yes. Accepted.... | 22:10 |
| edmondsw | if you at least commented back... | 22:10 |
| ayoung | needs a release note. Also, need to look at where things check is_admin:True (a result of context_is_admin, which this leaves only looking for role:admin) and see if any of them also need to be checking for is_admin_project:True to block cross-project access. | 22:11 |
| ayoung | lets see... | 22:11 |
| ayoung | it has a release note | 22:11 |
| edmondsw | yep, that's the easy one | 22:11 |
| ayoung | so the APIs I tagged were only the ones that needed to be global | 22:12 |
| ayoung | it was certainly not every admin API | 22:12 |
| ayoung | I changed those to use the new rule GLOBAL_ADMIN | 22:13 |
| ayoung | other ones I left as | 22:13 |
| ayoung | 'admin_api', | 22:13 |
| ayoung | 'rule:global_admin or (is_admin:True and project_id:%(project_id)s)', | 22:13 |
| ayoung | I think that addressed what you were saying, but would not mind a second set of eyes on the individual apis to see if they are the right set. If I missed something, it would mean that a global opertation ended up being project scoped, too, and I don't think that breaks anything | 22:15 |
| edmondsw | I think what I was getting at (a year ago, so fuzzy), is that sometimes nova may get a request from a user and then, realizing that user was an admin, use its own service token instead as X-Auth-Token on an API call to another service, which would be a problem with what we're trying to fix here | 22:15 |
| edmondsw | nova has so many policy problems that it's so hard to keep things straight in your head | 22:16 |
| edmondsw | anyway, I've gotta run | 22:16 |
| ayoung | edmondsw, thanks. | 22:17 |
| edmondsw | ayoung yw and have a good weekend | 22:17 |
| *** edmondsw has quit IRC | 22:19 | |
| *** edmondsw has joined #openstack-keystone | 22:19 | |
| *** edmondsw_ has joined #openstack-keystone | 22:23 | |
| *** wes_dillingham has joined #openstack-keystone | 22:23 | |
| *** edmondsw has quit IRC | 22:24 | |
| *** edmondsw_ has quit IRC | 22:27 | |
| *** hoonetorg has quit IRC | 22:28 | |
| *** dave-mcc_ has quit IRC | 22:30 | |
| *** wes_dillingham has quit IRC | 22:32 | |
| *** spilla has joined #openstack-keystone | 22:33 | |
| *** _ix has quit IRC | 22:36 | |
| *** _ix has joined #openstack-keystone | 22:50 | |
| *** wes_dillingham has joined #openstack-keystone | 23:01 | |
| openstackgerrit | ayoung proposed openstack/keystone master: Add is_admin_project check to policy for non scoped operations https://review.openstack.org/257636 | 23:12 |
| *** ayoung has quit IRC | 23:24 | |
| *** edmondsw has joined #openstack-keystone | 23:44 | |
| *** edmondsw has quit IRC | 23:48 | |
| *** pcaruana has quit IRC | 23:54 | |
| *** wes_dillingham has quit IRC | 23:56 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!