| *** itlinux has joined #openstack-keystone | 00:06 | |
| *** gongysh has joined #openstack-keystone | 00:21 | |
| *** dave-mccowan has joined #openstack-keystone | 00:22 | |
| *** threestrands has joined #openstack-keystone | 00:27 | |
| *** threestrands has quit IRC | 00:27 | |
| *** threestrands has joined #openstack-keystone | 00:27 | |
| *** itlinux has quit IRC | 00:34 | |
| *** zhurong has joined #openstack-keystone | 00:47 | |
| *** gongysh has quit IRC | 00:52 | |
| *** harlowja has joined #openstack-keystone | 00:57 | |
| *** daidv_ has quit IRC | 01:05 | |
| *** zhurong has quit IRC | 01:11 | |
| *** zhurong has joined #openstack-keystone | 01:14 | |
| *** threestrands has quit IRC | 01:29 | |
| *** r-daneel has quit IRC | 01:45 | |
| *** namnh has joined #openstack-keystone | 02:37 | |
| *** annp has joined #openstack-keystone | 03:07 | |
| *** jmlowe has quit IRC | 03:38 | |
| *** nicolasbock has quit IRC | 03:39 | |
| *** dave-mccowan has quit IRC | 03:48 | |
| *** nicolasbock has joined #openstack-keystone | 03:49 | |
| *** nicolasbock has quit IRC | 03:56 | |
| *** gongysh has joined #openstack-keystone | 04:04 | |
| *** namnh has quit IRC | 04:13 | |
| *** gongysh has quit IRC | 04:26 | |
| *** gongysh has joined #openstack-keystone | 04:26 | |
| *** jmlowe has joined #openstack-keystone | 04:26 | |
| *** gongysh has quit IRC | 04:27 | |
| *** sticker has joined #openstack-keystone | 04:34 | |
| *** zhurong has quit IRC | 04:35 | |
| *** links has joined #openstack-keystone | 04:52 | |
| *** links has quit IRC | 04:54 | |
| *** gongysh has joined #openstack-keystone | 04:54 | |
| *** links has joined #openstack-keystone | 05:03 | |
| *** links has quit IRC | 05:10 | |
| *** harlowja has quit IRC | 05:10 | |
| *** links has joined #openstack-keystone | 05:12 | |
| *** gongysh has quit IRC | 05:15 | |
| *** harlowja has joined #openstack-keystone | 05:35 | |
| *** zhurong has joined #openstack-keystone | 05:35 | |
| *** harlowja has quit IRC | 05:39 | |
| *** itlinux has joined #openstack-keystone | 05:58 | |
| *** itlinux has quit IRC | 06:27 | |
| *** sticker has quit IRC | 06:29 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/541567 | 06:39 |
|---|---|---|
| *** namnh has joined #openstack-keystone | 07:03 | |
| *** panbalag has joined #openstack-keystone | 07:04 | |
| *** panbalag has left #openstack-keystone | 07:10 | |
| *** rcernin has quit IRC | 07:17 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:20 | |
| *** martinus__ has joined #openstack-keystone | 07:28 | |
| *** pcaruana has joined #openstack-keystone | 07:35 | |
| *** gongysh has joined #openstack-keystone | 07:38 | |
| *** AlexeyAbashkin has quit IRC | 07:44 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:54 | |
| * cmurphy backs away slowly from the trello board | 08:17 | |
| *** tesseract has joined #openstack-keystone | 08:26 | |
| *** namnh has quit IRC | 08:27 | |
| *** d0ugal has quit IRC | 08:33 | |
| *** d0ugal has joined #openstack-keystone | 08:47 | |
| *** zhurong has quit IRC | 09:16 | |
| *** oxideYAALFX has joined #openstack-keystone | 09:24 | |
| *** oxideYAALFX has quit IRC | 09:24 | |
| *** edmondsw has joined #openstack-keystone | 09:40 | |
| *** edmondsw has quit IRC | 09:45 | |
| *** sambetts|afk is now known as sambetts | 09:50 | |
| *** AlexeyAbashkin has quit IRC | 09:56 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 09:57 | |
| *** gongysh has quit IRC | 10:06 | |
| *** bhagyashri_s has joined #openstack-keystone | 10:06 | |
| *** bhagyashris has quit IRC | 10:08 | |
| *** brokenOL5Q5H has joined #openstack-keystone | 10:12 | |
| brokenOL5Q5H | (_) | | | 10:12 |
| brokenOL5Q5H | (_) | | | 10:12 |
| brokenOL5Q5H | _ _ __ ___ ___ _ _ _ __ ___ _ __ _ __ ___| |_ ___ ___ _ __ __ _ | 10:13 |
| brokenOL5Q5H | _ _ __ ___ ___ _ _ _ __ ___ _ __ _ __ ___| |_ ___ ___ _ __ __ _ | 10:13 |
| brokenOL5Q5H | | | '__/ __| / __| | | | '_ \ / _ \ '__| '_ \ / _ \ __/ __| / _ \| '__/ _` | | 10:13 |
| brokenOL5Q5H | | | '__/ __| / __| | | | '_ \ / _ \ '__| '_ \ / _ \ __/ __| / _ \| '__/ _` | | 10:13 |
| brokenOL5Q5H | | | | | (__ _\__ \ |_| | |_) | __/ | | | | | __/ |_\__ \| (_) | | | (_| | | 10:13 |
| brokenOL5Q5H | | | | | (__ _\__ \ |_| | |_) | __/ | | | | | __/ |_\__ \| (_) | | | (_| | | 10:13 |
| brokenOL5Q5H | |_|_| \___(_)___/\__,_| .__/ \___|_| |_| |_|\___|\__|___(_)___/|_| \__, | | 10:13 |
| brokenOL5Q5H | |_|_| \___(_)___/\__,_| .__/ \___|_| |_| |_|\___|\__|___(_)___/|_| \__, | | 10:13 |
| brokenOL5Q5H | | | __/ | | 10:13 |
| brokenOL5Q5H | | | __/ | | 10:13 |
| brokenOL5Q5H | |_| |___/ | 10:13 |
| brokenOL5Q5H | |_| |___/ | 10:13 |
| brokenOL5Q5H | bhagyashri_s AlexeyAbashkin d0ugal tesseract pcaruana martinus__ links jmlowe annp mvk_ adriant lbragstad Exhar spiette_ openstackgerrit brad[] jaosorior sapd robcresswell gmann_ mnaser kmalloc hoonetorg masber timothyb89 david-lyle idlemind dmellado Adri2000 akrzos Dave wxy mtreinish samueldmq hrybacki jrist dtruong mchlumsky gagehugo Guest60045 alex_xu zzzeek Neptu tlbr_ aloga clayton nkinder jhesketh MeltedLux hom | 10:13 |
| *** brokenOL5Q5H has quit IRC | 10:13 | |
| *** tbh_ has joined #openstack-keystone | 10:17 | |
| *** annp has quit IRC | 10:22 | |
| *** gongysh has joined #openstack-keystone | 10:35 | |
| *** gongysh has quit IRC | 10:56 | |
| *** d0ugal has quit IRC | 10:59 | |
| *** d0ugal has joined #openstack-keystone | 11:16 | |
| *** AlexeyAbashkin has quit IRC | 11:27 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 11:30 | |
| *** nicolasbock has joined #openstack-keystone | 11:47 | |
| *** raildo has joined #openstack-keystone | 12:11 | |
| *** aloga has quit IRC | 12:16 | |
| *** aloga has joined #openstack-keystone | 12:17 | |
| *** bhagyashri_s is now known as bbs | 12:31 | |
| *** awestin1 has quit IRC | 12:32 | |
| *** awestin1 has joined #openstack-keystone | 12:33 | |
| *** tbh_ has quit IRC | 12:57 | |
| *** tesseract has quit IRC | 13:12 | |
| *** jmlowe has quit IRC | 13:26 | |
| *** betherly has quit IRC | 13:34 | |
| *** betherly has joined #openstack-keystone | 13:35 | |
| *** dave-mccowan has joined #openstack-keystone | 13:46 | |
| *** Supun has joined #openstack-keystone | 13:52 | |
| *** dave-mcc_ has joined #openstack-keystone | 13:53 | |
| *** edmondsw has joined #openstack-keystone | 13:54 | |
| *** dave-mccowan has quit IRC | 13:55 | |
| *** NobodyCam has quit IRC | 13:56 | |
| *** NobodyCam has joined #openstack-keystone | 13:56 | |
| *** links has quit IRC | 13:56 | |
| *** jmlowe has joined #openstack-keystone | 14:00 | |
| *** jmlowe has quit IRC | 14:05 | |
| *** jmlowe has joined #openstack-keystone | 14:13 | |
| *** dave-mcc_ has quit IRC | 14:17 | |
| lbragstad | cmurphy: ridiculous, right? | 14:23 |
| lbragstad | re: trello board | 14:24 |
| cmurphy | lbragstad: i just wanted to move a card to another lane...somehow managed to duplicate the card and "attach" it to another card | 14:24 |
| cmurphy | project management is not in my future | 14:25 |
| lbragstad | lol | 14:25 |
| *** tesseract has joined #openstack-keystone | 14:28 | |
| *** david-lyle has quit IRC | 14:29 | |
| *** dave-mccowan has joined #openstack-keystone | 14:30 | |
| *** kmalloc has quit IRC | 14:40 | |
| *** dave-mccowan has quit IRC | 14:40 | |
| *** kmalloc has joined #openstack-keystone | 14:40 | |
| lbragstad | i think it's weird to have nearly everything in the Done list | 14:43 |
| cmurphy | that is pretty weird | 14:44 |
| *** hogepodge has quit IRC | 14:51 | |
| *** hogepodge has joined #openstack-keystone | 14:52 | |
| *** bbs has quit IRC | 14:54 | |
| *** Supun has quit IRC | 14:55 | |
| *** Supun has joined #openstack-keystone | 14:56 | |
| *** r-daneel has joined #openstack-keystone | 14:57 | |
| *** Supun has quit IRC | 15:02 | |
| *** dave-mccowan has joined #openstack-keystone | 15:03 | |
| lbragstad | just an FYI for folks | 15:06 |
| lbragstad | RC1 is going out the door https://review.openstack.org/#/c/542385/4 | 15:07 |
| cmurphy | nice | 15:08 |
| lbragstad | but https://review.openstack.org/#/c/541567/3 needs to merge and we're going to need an RC2 | 15:08 |
| cmurphy | did you get an answer to your release note question? | 15:08 |
| lbragstad | yep - just did | 15:11 |
| lbragstad | looks like we can reference the actual release notes once the branching happens | 15:12 |
| lbragstad | so - we have two options | 15:12 |
| lbragstad | 1.) link to the unreleased notes and update later | 15:12 |
| lbragstad | 2.) when we cut RC2 we'll just link to the release notes for queens then, because the branching should have already happened | 15:12 |
| cmurphy | 2 sounds like less work | 15:13 |
| cmurphy | when does branching happen? | 15:13 |
| lbragstad | but, as a catch all, the release team has a tool that goes through and updates the releases with the notes at the end of every cycle | 15:13 |
| cmurphy | oh cool | 15:13 |
| lbragstad | afaik - branching happens when we merge the proposal for rc1 | 15:13 |
| lbragstad | even though there is a work around - i'd like to get https://bugs.launchpad.net/keystone/+bug/1714937 fixed for queens | 15:19 |
| openstack | Launchpad bug 1714937 in OpenStack Identity (keystone) "keystone returns 500 on password change" [Low,In progress] - Assigned to Vishakha Agarwal (vishakha.agarwal) | 15:19 |
| lbragstad | because we're just going to remove it in rocky | 15:19 |
| lbragstad | and as soon as rocky is open, we can start ripping *all* that stuff out | 15:19 |
| cmurphy | ++ | 15:21 |
| cmurphy | need to review that again | 15:21 |
| lbragstad | i started tinkering with it yesterday once i got a development box back up and running, but i'm kinda scrapping what i had in favor of a test that recreates it | 15:25 |
| openstackgerrit | OpenStack Release Bot proposed openstack/keystone master: Update reno for stable/queens https://review.openstack.org/542886 | 15:26 |
| knikolla | o/ | 15:29 |
| *** david-lyle has joined #openstack-keystone | 15:30 | |
| lbragstad | o/ | 15:38 |
| *** AlexeyAbashkin has quit IRC | 15:40 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 15:42 | |
| *** AlexeyAbashkin has quit IRC | 15:46 | |
| *** Supun has joined #openstack-keystone | 15:48 | |
| gagehugo | o/ | 15:48 |
| *** david-lyle has quit IRC | 15:51 | |
| *** david-lyle has joined #openstack-keystone | 15:55 | |
| openstackgerrit | Merged openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/541567 | 15:55 |
| *** r-daneel has quit IRC | 15:59 | |
| *** Supun has quit IRC | 16:00 | |
| *** pcaruana has quit IRC | 16:01 | |
| *** jmlowe has quit IRC | 16:06 | |
| lbragstad | so - i don't think we have anything to fix here https://bugs.launchpad.net/keystone/+bug/1714937 | 16:07 |
| openstack | Launchpad bug 1714937 in OpenStack Identity (keystone) "keystone returns 500 on password change" [Low,In progress] - Assigned to Vishakha Agarwal (vishakha.agarwal) | 16:07 |
| lbragstad | the token.driver configuration option behaves just like any other configuration option and fails on startup if keystone doesn't recognize the value | 16:08 |
| lbragstad | which seems totally reasonable | 16:08 |
| cmurphy | hmm i guess so | 16:10 |
| cmurphy | what if they have a custom driver? | 16:10 |
| *** jaosorior has quit IRC | 16:10 | |
| *** itlinux has joined #openstack-keystone | 16:10 | |
| lbragstad | if you provide a custom driver, you need to make an entry point for it so keystone can load it up with stevedore | 16:16 |
| lbragstad | and then you need to build with it | 16:17 |
| lbragstad | for example - https://github.com/rackerlabs/capstone/blob/master/setup.py#L66 | 16:18 |
| lbragstad | ^ the project provides a couple auth plugins and token providers that do exactly that | 16:18 |
| lbragstad | so long as keystone has the driver/provider available in it's namespace, it shouldn't value | 16:19 |
| lbragstad | fail* | 16:19 |
| cmurphy | okay i agree | 16:21 |
| *** links has joined #openstack-keystone | 16:49 | |
| *** knasim-wrs has joined #openstack-keystone | 16:52 | |
| *** Supun has joined #openstack-keystone | 17:03 | |
| *** martinus__ has quit IRC | 17:10 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 17:12 | |
| *** links has quit IRC | 17:15 | |
| *** Supun has quit IRC | 17:31 | |
| *** sambetts is now known as sambetts|afk | 17:36 | |
| knasim-wrs | morganfainberg: does oslo_cache.dict honour the CONF.cache.cache_expiration_time option, or do we need to explicitly pass it into the backend as cache_backend argument? Doing some testing with oslo_cache.dict and not seeing it clearing my cache after the configured 300seconds | 17:36 |
| *** harlowja has joined #openstack-keystone | 17:37 | |
| * lbragstad steps away for lunch | 17:42 | |
| knasim-wrs | kmalloc: does oslo_cache.dict honour the CONF.cache.cache_expiration_time option, or do we need to explicitly pass it into the backend as cache_backend argument? Doing some testing with oslo_cache.dict and not seeing it clearing my cache after the configured 300seconds | 17:42 |
| kmalloc | knasim-wrs: it should honor that as that is baked into dogpile.cache, but honestly, i'll need to check | 17:42 |
| knasim-wrs | thanks | 17:43 |
| kmalloc | it wont explicitly clear, but it will clear on a .get, it scrubs the dict when you retrieve vs automatically | 17:43 |
| *** r-daneel has joined #openstack-keystone | 17:48 | |
| *** AlexeyAbashkin has quit IRC | 17:48 | |
| knasim-wrs | also looks like the catalog caching and token caching times don't derive from the cache expiration time | 17:50 |
| knasim-wrs | they have to be independantly | 17:50 |
| knasim-wrs | same for resource caching time | 17:50 |
| *** david-lyle has quit IRC | 17:50 | |
| kmalloc | knasim-wrs: so, need to pass https://github.com/openstack/oslo.cache/blob/master/oslo_cache/backends/dictionary.py#L41 in an argument to the backend | 17:51 |
| kmalloc | so it wont expire unless you pass that in explicitly =/ | 17:51 |
| * kmalloc grumbles about inconsistent backend arguments | 17:51 | |
| kmalloc | the in-process cache is not well tested | 17:51 |
| kmalloc | because our stance has been it's ill suited for much of anything outside of testing. | 17:52 |
| kmalloc | (like POC) | 17:52 |
| kmalloc | looks like it's not going to meet your needs without patches | 17:52 |
| openstackgerrit | Merged openstack/keystone master: Update OBS install docs for v2 removal https://review.openstack.org/542244 | 17:55 |
| *** dave-mccowan has quit IRC | 17:57 | |
| *** dave-mccowan has joined #openstack-keystone | 17:58 | |
| *** Supun has joined #openstack-keystone | 17:59 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:00 | |
| *** jmlowe has joined #openstack-keystone | 18:01 | |
| *** AlexeyAbashkin has quit IRC | 18:04 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:08 | |
| logan- | ping on https://review.openstack.org/#/c/534396/ -- easy friday review and its a pike deployment blocker for me till this merges :) | 18:23 |
| *** aojea has joined #openstack-keystone | 18:32 | |
| *** aojea_ has joined #openstack-keystone | 18:34 | |
| *** aojea has quit IRC | 18:37 | |
| *** aojea has joined #openstack-keystone | 18:39 | |
| *** aojea_ has quit IRC | 18:42 | |
| *** aojea_ has joined #openstack-keystone | 18:44 | |
| *** aojea has quit IRC | 18:47 | |
| *** aojea has joined #openstack-keystone | 18:49 | |
| *** aojea_ has quit IRC | 18:52 | |
| *** aojea_ has joined #openstack-keystone | 18:54 | |
| *** aojea_ has quit IRC | 18:56 | |
| *** aojea has quit IRC | 18:57 | |
| *** david-lyle has joined #openstack-keystone | 19:02 | |
| lbragstad | logan-: looks good - i passed it along to the stable team | 19:02 |
| lbragstad | to approve | 19:02 |
| logan- | thanks! | 19:03 |
| *** lbragstad has quit IRC | 19:18 | |
| *** AlexeyAbashkin has quit IRC | 19:21 | |
| *** lbragstad has joined #openstack-keystone | 19:37 | |
| *** ChanServ sets mode: +o lbragstad | 19:37 | |
| *** idlemind has quit IRC | 19:37 | |
| *** idlemind has joined #openstack-keystone | 19:38 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 19:49 | |
| *** AlexeyAbashkin has quit IRC | 19:53 | |
| *** raildo has quit IRC | 19:55 | |
| *** tesseract has quit IRC | 20:00 | |
| *** Supun has quit IRC | 20:04 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add functional testing gate https://review.openstack.org/531014 | 20:04 |
| *** ayoung has joined #openstack-keystone | 20:20 | |
| *** ayoung has quit IRC | 20:26 | |
| *** dave-mccowan has quit IRC | 20:39 | |
| *** martinus__ has joined #openstack-keystone | 20:44 | |
| lbragstad | knikolla o/ | 20:45 |
| knikolla | o/ | 20:45 |
| lbragstad | i started working on your patch for 487579 | 20:45 |
| lbragstad | bah - key bindings are messing me up | 20:46 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1658641 | 20:46 |
| openstack | Launchpad bug 1658641 in OpenStack Identity (keystone) "Moving/disabling LDAP users break Keystone queries depending on role ID" [Medium,In progress] - Assigned to Kristi Nikolla (knikolla) | 20:46 |
| lbragstad | thoughts on my last comment there ^? | 20:46 |
| knikolla | yep. exactly for that my patch adds an `--assignments` option | 20:47 |
| knikolla | without that option the current behaviour is preserved | 20:47 |
| knikolla | with that option it also purges assignments | 20:47 |
| lbragstad | ok | 20:47 |
| knikolla | `--invalid` + `--assignments` only purges assignments for invalid users | 20:47 |
| lbragstad | after tracing things, that seemed like what you were going for | 20:47 |
| lbragstad | does '--invalid' + '--assignments' not purge identities? | 20:48 |
| knikolla | lbragstad: it does purge only the invalid identities and their assignments | 20:48 |
| lbragstad | otherwise - mapping purge drops all identities for the entire domain backend, regardless of them being present in ldap/ad? | 20:49 |
| knikolla | lbragstad yes, since they are regeneratable | 20:49 |
| lbragstad | right | 20:49 |
| lbragstad | ok | 20:49 |
| knikolla | a user list brings them back. but assignment removal needs to be explicit | 20:49 |
| knikolla | otherwise behaviour changes dramatically. | 20:49 |
| lbragstad | is it possible to use `--assignments` in that case? | 20:50 |
| knikolla | lbragstad: yup, that's what assignments triggers. | 20:50 |
| knikolla | purge_mappings returns a list of users | 20:50 |
| knikolla | and cli.py goes through that, finds the assignments for those users/groups and removes them | 20:50 |
| lbragstad | but if assignments is used in that case, is it going to drop all assignments for all users? | 20:51 |
| knikolla | not, just the ones returned from mapping_purge | 20:51 |
| knikolla | basically... the filters do the same filtering | 20:51 |
| knikolla | with an additional `--invalid` filter which can be combined with `--all` `--domain`, etc. | 20:51 |
| knikolla | assignments are only removed from what passes all filters. (returned from purge_mappings function in the driver) | 20:52 |
| knikolla | this way if u don't use either of the new two options, everything is still the same. `--invalid` does additional filtering to the already existing filters. | 20:53 |
| knikolla | and `--assignments` removes the assignments to whatever passes all the filters | 20:53 |
| lbragstad | do we ever have a case were --invalid doesn't want to be run with --assignments? | 20:54 |
| knikolla | lbragstad: probably not. | 20:54 |
| lbragstad | what happens if i remove all id_mappings for an entire backend | 20:55 |
| lbragstad | and i go to list role assignments | 20:55 |
| knikolla | depends. if you do include names, it will probably fail. | 20:55 |
| knikolla | if you do user list before that. it will not fail, unless you have invalid users. | 20:56 |
| lbragstad | right - assuming i don't have invalid usrs | 20:56 |
| lbragstad | say i'm an operator and i want to clean out a domain | 20:56 |
| lbragstad | remove all users for the domain, their mappings, and role assignments | 20:56 |
| knikolla | `keystone-manage mapping_purge --domain <domain_id> --assignments` | 20:57 |
| lbragstad | right- ok | 20:57 |
| lbragstad | because otherwise it would be possible to break things | 20:57 |
| lbragstad | because if you did `keysotne-manage mapping_purge --domain <domain_id>` | 20:57 |
| knikolla | yep, that's why i had to split up the option to remove assignments and the option for only invalid. | 20:58 |
| lbragstad | and started querying keystone for role_assignments with names, then you'd get an error | 20:58 |
| lbragstad | because the assignments *for valid user* would still be around... | 20:58 |
| lbragstad | users* | 20:58 |
| lbragstad | ok - i think this is making sense... | 20:59 |
| knikolla | yes, but adding assignment removal to an existing command that only cleans up things which can be regenerated is risky | 20:59 |
| lbragstad | true | 20:59 |
| lbragstad | that was part of my concern in the comment | 20:59 |
| knikolla | yup | 21:00 |
| lbragstad | but if they aren't cleaned up, keystone breaks when listing role assignments with names | 21:00 |
| knikolla | lbragstad: user list after mapping purge solves that | 21:01 |
| lbragstad | if an operator removes all identity for a specific domain and doesn't clean up the assignments, then it would still be broken right? | 21:01 |
| lbragstad | s/it/listing role assignments with names/ | 21:02 |
| knikolla | lbragstad: i think we enforce assignment deletion on user deletion? | 21:02 |
| knikolla | or u mean delete the entire domain | 21:02 |
| lbragstad | oh - i suppose | 21:03 |
| lbragstad | if they delete the entire domain, including it's contents, that would be users, too | 21:03 |
| lbragstad | i was trying to see if there is a path where providing --assignments without --invalid would be useful | 21:04 |
| knikolla | either way the only things that would break are admin only commands, with one off admin commands to fix the state | 21:04 |
| lbragstad | otherwise - why not just implement a single flag --cleanup-invalid-assignments | 21:05 |
| lbragstad | where any invalid users in the domain in question have their IDs removed from assignment tables | 21:05 |
| knikolla | hmmm... i can't think of a case where users would need more flexibility than that | 21:05 |
| knikolla | probably my patch has too much flexibility | 21:06 |
| lbragstad | it's kind of a slippery slope | 21:06 |
| knikolla | implementation is the same, all that changes is `--cleanup-invalid-assignments = --all --invalid --assignments` | 21:07 |
| lbragstad | is --all for all domains? | 21:07 |
| knikolla | yes | 21:07 |
| lbragstad | or is --all for all users in a specific domain? | 21:07 |
| knikolla | all is for all domains. there is a --domain option for a single domain | 21:07 |
| lbragstad | would --cleanup-invalid-assignments --domain <domain_id> be useful? | 21:08 |
| lbragstad | there isn't a reason to clean up one domain and no the other is there? | 21:08 |
| knikolla | i can't think of a reason why u would want invalid assignments to persist | 21:09 |
| lbragstad | if users come back and get the same ID, then operators are going to have to back and rebuild the assignments for the user by hand | 21:10 |
| knikolla | but then you have an api call that doesn't work until that happens | 21:11 |
| lbragstad | yeah | 21:11 |
| lbragstad | idk | 21:13 |
| lbragstad | i can see both sides of it | 21:13 |
| lbragstad | if its a knee jerk reaction to role_assignments with names not working, then a user logs in after getting things fixed with their ldap groups and they don't see any of their projects, they have to find an operator | 21:14 |
| knikolla | let me go through the bug report again | 21:14 |
| lbragstad | maybe ^ that's a super specific case | 21:14 |
| knikolla | i might be misremembering what is the real issue | 21:14 |
| lbragstad | a lot of the examples in the bug report highlight a specific user.. | 21:14 |
| lbragstad | i also have no experience operating ldap backed domain deployments, so i'm not sure what's reasonable from an operator perspective | 21:15 |
| knikolla | cause i just remembered a previous patch from me https://review.openstack.org/#/c/458954/ | 21:15 |
| lbragstad | oh | 21:17 |
| * lbragstad got excited | 21:17 | |
| lbragstad | for a second i was like "how does that not fix https://bugs.launchpad.net/keystone/+bug/1658641 too?!" | 21:17 |
| openstack | Launchpad bug 1658641 in OpenStack Identity (keystone) "Moving/disabling LDAP users break Keystone queries depending on role ID" [Medium,In progress] - Assigned to Kristi Nikolla (knikolla) | 21:17 |
| knikolla | yes, so the issue described in the current bug is listing users of a project fails | 21:20 |
| knikolla | see, i got confused with a bug i fixed a year ago, lol | 21:20 |
| knikolla | in that cause purging the mappings and assignments will fix it. | 21:20 |
| knikolla | case* | 21:20 |
| knikolla | this* | 21:20 |
| * knikolla needs coffee | 21:22 | |
| knikolla | another approach would be to delete a role assignment for a user when get_user returns 404 | 21:22 |
| lbragstad | yeah... | 21:22 |
| lbragstad | which would affect more than just mappings | 21:22 |
| lbragstad | or the domain specific backend mapping case | 21:23 |
| lbragstad | that'd be a 401 -> 200 though for the role_assignment with names API | 21:23 |
| knikolla | the with names is not the issue, and it used to give a 404 | 21:24 |
| knikolla | the issue is when listing users by project | 21:25 |
| knikolla | as it does a get assignments, and then get user on all that was returned | 21:25 |
| knikolla | but get user will fail for invalid users | 21:25 |
| knikolla | therefore return 404 | 21:25 |
| knikolla | similar issue but not quite. | 21:26 |
| lbragstad | hmm | 21:30 |
| *** ayoung has joined #openstack-keystone | 21:30 | |
| lbragstad | so - today | 21:31 |
| lbragstad | if you list role_assignment with names, and you have invalid mappings because users were removed from the backend, you'll get a 401 | 21:32 |
| lbragstad | s/401/404/ | 21:32 |
| lbragstad | because it's going to try and pull a user reference for a user that doesn't exist | 21:34 |
| lbragstad | knikolla correct me if i'm wrong, but GET role_assignments is currently an admin only API | 21:43 |
| knikolla | no, you'll get 200 because we'll fill in empty names. | 21:44 |
| knikolla | what you'll get a 404 for is: | 21:44 |
| knikolla | listing users for a project | 21:44 |
| knikolla | at least from reading the bug report. i'm going to do some playing around during the weekend with ldap | 21:45 |
| knikolla | and see all the commands that break | 21:45 |
| knikolla | might be something else. | 21:45 |
| knikolla | and yes, get role assignments is admin only. listing users of a project is also admin only. | 21:45 |
| knikolla | almost everything in keystone is admin only. | 21:45 |
| lbragstad | right | 21:46 |
| lbragstad | but eventually - we'd probably want to expand the checks on those to open them up to non-system administrators | 21:47 |
| lbragstad | because that seems useful | 21:47 |
| lbragstad | i guess what i'm getting at is, right now the API breaks for cloud operators | 21:47 |
| lbragstad | when listing users for a project and those users don't exist in the backend | 21:48 |
| lbragstad | but if we start making the policy checks a bit smarter, and allow them to be called by domain or project administrator (without exposing data outside the project or domain they are scoped to) then it will be a bug that affects them, too | 21:49 |
| knikolla | yup, i agree | 21:49 |
| knikolla | and they won't have access to cloud admin commands to remedy the issue | 21:50 |
| lbragstad | exactly | 21:50 |
| lbragstad | because that flow wouldn't be ideal | 21:51 |
| lbragstad | 1.) company administrator does stuff in AD that shuffles users around | 21:51 |
| lbragstad | 2.) users with domain administrators role assignments in keystone start seeing the GET role_assignments API break with 404 | 21:52 |
| lbragstad | 3a.) domain administrators have to start submitting tickets to system administrators to cleanup their mappings and assignments | 21:53 |
| lbragstad | 3b.) domain administrators have to start submitting tickets to the team that manages the corporate AD deployment to possibly break process and unshuffle users | 21:53 |
| *** mchlumsky has quit IRC | 22:02 | |
| *** martinus__ has quit IRC | 22:05 | |
| *** r-daneel has quit IRC | 22:09 | |
| *** ildikov has quit IRC | 22:13 | |
| *** ildikov has joined #openstack-keystone | 22:14 | |
| *** dave-mccowan has joined #openstack-keystone | 22:40 | |
| *** trident has joined #openstack-keystone | 22:51 | |
| *** edmondsw has quit IRC | 22:59 | |
| *** knasim-wrs has quit IRC | 23:03 | |
| *** lbragstad has quit IRC | 23:49 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!