| *** gyee has quit IRC | 00:04 | |
| *** robcresswell_ has joined #openstack-keystone | 00:04 | |
| *** jroll has joined #openstack-keystone | 00:05 | |
| *** jroll has quit IRC | 00:06 | |
| *** timothyb89_ has joined #openstack-keystone | 00:06 | |
| *** jroll has joined #openstack-keystone | 00:07 | |
| *** breton_ has joined #openstack-keystone | 00:07 | |
| *** obre has joined #openstack-keystone | 00:07 | |
| *** edmondsw has joined #openstack-keystone | 00:09 | |
| *** chris_hultin|AWA has joined #openstack-keystone | 00:10 | |
| *** dtroyer_zz has joined #openstack-keystone | 00:10 | |
| *** dims has joined #openstack-keystone | 00:10 | |
| *** mgagne_ has joined #openstack-keystone | 00:10 | |
| *** chrome0_ has joined #openstack-keystone | 00:10 | |
| *** dims_ has quit IRC | 00:12 | |
| *** robcresswell has quit IRC | 00:12 | |
| *** obre_ has quit IRC | 00:12 | |
| *** chris_hultin has quit IRC | 00:12 | |
| *** mgagne has quit IRC | 00:12 | |
| *** timothyb89 has quit IRC | 00:12 | |
| *** dtroyer has quit IRC | 00:12 | |
| *** breton has quit IRC | 00:12 | |
| *** chrome0 has quit IRC | 00:12 | |
| *** jlvillal has quit IRC | 00:12 | |
| *** Guest88902 has quit IRC | 00:12 | |
| *** zhongjun_ has quit IRC | 00:12 | |
| *** Anticimex has quit IRC | 00:12 | |
| *** d34dh0r53 has quit IRC | 00:12 | |
| *** wxy has quit IRC | 00:12 | |
| *** eschwartz has quit IRC | 00:12 | |
| *** knikolla has quit IRC | 00:12 | |
| *** gagehugo has quit IRC | 00:12 | |
| *** bhagyashris has quit IRC | 00:12 | |
| *** timss has quit IRC | 00:12 | |
| *** rybridges has quit IRC | 00:12 | |
| *** slunkad has quit IRC | 00:12 | |
| *** bigjools has quit IRC | 00:12 | |
| *** raginbajin has quit IRC | 00:12 | |
| *** david-lyle has quit IRC | 00:12 | |
| *** deepak_ has quit IRC | 00:12 | |
| *** eEbx has quit IRC | 00:12 | |
| *** EmilienM has quit IRC | 00:12 | |
| *** SamYaple has quit IRC | 00:12 | |
| *** hemna has quit IRC | 00:12 | |
| *** adriant has quit IRC | 00:12 | |
| *** ChanServ has quit IRC | 00:12 | |
| *** chris_hultin|AWA is now known as chris_hultin | 00:12 | |
| *** robcresswell_ is now known as robcresswell | 00:12 | |
| *** odyssey4me has quit IRC | 00:12 | |
| *** odyssey4me has joined #openstack-keystone | 00:12 | |
| *** edmondsw has quit IRC | 00:13 | |
| *** david-lyle has joined #openstack-keystone | 00:13 | |
| *** deepak_ has joined #openstack-keystone | 00:13 | |
| *** gagehugo has joined #openstack-keystone | 00:13 | |
| *** eEbx has joined #openstack-keystone | 00:13 | |
| *** EmilienM has joined #openstack-keystone | 00:13 | |
| *** bhagyashris has joined #openstack-keystone | 00:13 | |
| *** timss has joined #openstack-keystone | 00:13 | |
| *** rybridges has joined #openstack-keystone | 00:13 | |
| *** SamYaple has joined #openstack-keystone | 00:13 | |
| *** ChanServ has joined #openstack-keystone | 00:13 | |
| *** raginbajin has joined #openstack-keystone | 00:13 | |
| *** adriant has joined #openstack-keystone | 00:13 | |
| *** hemna has joined #openstack-keystone | 00:13 | |
| *** bigjools has joined #openstack-keystone | 00:13 | |
| *** slunkad has joined #openstack-keystone | 00:13 | |
| *** barjavel.freenode.net sets mode: +o ChanServ | 00:13 | |
| *** robcresswell is now known as Guest46098 | 00:16 | |
| *** jroll is now known as Guest43960 | 00:16 | |
| *** marius1 has quit IRC | 00:17 | |
| *** jmlowe_ has quit IRC | 00:18 | |
| *** zhurong has joined #openstack-keystone | 00:39 | |
| *** Guest43960 has quit IRC | 00:40 | |
| *** jmlowe has joined #openstack-keystone | 00:48 | |
| *** jroll has joined #openstack-keystone | 01:01 | |
| *** cheran has quit IRC | 01:09 | |
| *** dangtrinhnt has joined #openstack-keystone | 01:19 | |
| *** harlowja has quit IRC | 01:21 | |
| *** dangtrinhnt has quit IRC | 01:21 | |
| *** jlvillal has joined #openstack-keystone | 01:28 | |
| *** Guest88902 has joined #openstack-keystone | 01:28 | |
| *** zhongjun_ has joined #openstack-keystone | 01:28 | |
| *** Anticimex has joined #openstack-keystone | 01:28 | |
| *** d34dh0r53 has joined #openstack-keystone | 01:28 | |
| *** wxy has joined #openstack-keystone | 01:28 | |
| *** eschwartz has joined #openstack-keystone | 01:28 | |
| *** knikolla has joined #openstack-keystone | 01:28 | |
| *** itlinux has joined #openstack-keystone | 01:30 | |
| *** timburke has quit IRC | 01:30 | |
| *** timburke has joined #openstack-keystone | 01:31 | |
| *** felipemonteiro has joined #openstack-keystone | 01:50 | |
| *** gongysh has joined #openstack-keystone | 01:50 | |
| *** itlinux has quit IRC | 01:54 | |
| *** zhurong has quit IRC | 01:55 | |
| *** edmondsw has joined #openstack-keystone | 01:57 | |
| *** edmondsw has quit IRC | 02:01 | |
| *** gongysh has quit IRC | 02:05 | |
| *** gongysh has joined #openstack-keystone | 02:06 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 02:07 | |
| *** itlinux has joined #openstack-keystone | 02:09 | |
| *** AlexeyAbashkin has quit IRC | 02:11 | |
| *** felipemonteiro has quit IRC | 02:16 | |
| *** itlinux has quit IRC | 02:16 | |
| *** itlinux has joined #openstack-keystone | 02:29 | |
| *** itlinux has quit IRC | 02:30 | |
| *** daidv has quit IRC | 02:34 | |
| *** daidv has joined #openstack-keystone | 02:34 | |
| *** panbalag has joined #openstack-keystone | 02:43 | |
| *** david-lyle has quit IRC | 02:53 | |
| *** panbalag has left #openstack-keystone | 03:02 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 03:08 | |
| *** david-lyle has joined #openstack-keystone | 03:08 | |
| *** AlexeyAbashkin has quit IRC | 03:12 | |
| *** gongysh has quit IRC | 03:21 | |
| *** dave-mccowan has quit IRC | 03:23 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [WIP]Add hierarchical limit https://review.openstack.org/557696 | 03:33 |
|---|---|---|
| *** edmondsw has joined #openstack-keystone | 03:45 | |
| *** edmondsw has quit IRC | 03:50 | |
| *** harlowja has joined #openstack-keystone | 03:51 | |
| *** daidv has quit IRC | 03:51 | |
| *** daidv has joined #openstack-keystone | 03:51 | |
| *** germs has quit IRC | 04:03 | |
| *** sapd__ has quit IRC | 04:03 | |
| *** germs has joined #openstack-keystone | 04:04 | |
| *** germs has quit IRC | 04:04 | |
| *** germs has joined #openstack-keystone | 04:04 | |
| *** sapd__ has joined #openstack-keystone | 04:04 | |
| *** sapd_ has joined #openstack-keystone | 04:11 | |
| *** sapd__ has quit IRC | 04:11 | |
| *** namnh has joined #openstack-keystone | 04:13 | |
| *** germs has quit IRC | 04:30 | |
| *** ykarel|away has joined #openstack-keystone | 04:48 | |
| *** markvoelker has quit IRC | 04:52 | |
| *** daidv has quit IRC | 04:55 | |
| *** harlowja has quit IRC | 05:21 | |
| *** zzzeek has quit IRC | 05:39 | |
| *** zzzeek has joined #openstack-keystone | 05:50 | |
| *** zzzeek has quit IRC | 05:51 | |
| *** zzzeek has joined #openstack-keystone | 05:52 | |
| *** markvoelker has joined #openstack-keystone | 05:53 | |
| openstackgerrit | melissaml proposed openstack/pycadf master: Update links in README https://review.openstack.org/551695 | 06:23 |
| *** germs has joined #openstack-keystone | 06:30 | |
| *** germs has quit IRC | 06:30 | |
| *** germs has joined #openstack-keystone | 06:30 | |
| *** germs has quit IRC | 06:35 | |
| *** ykarel|away has quit IRC | 07:05 | |
| *** ykarel|away has joined #openstack-keystone | 07:05 | |
| *** voelzmo has joined #openstack-keystone | 07:11 | |
| *** voelzmo has quit IRC | 07:16 | |
| *** tesseract has joined #openstack-keystone | 07:17 | |
| *** edmondsw has joined #openstack-keystone | 07:21 | |
| *** edmondsw has quit IRC | 07:25 | |
| *** zhurong has joined #openstack-keystone | 07:28 | |
| *** namnh_ has joined #openstack-keystone | 07:32 | |
| *** namnh has quit IRC | 07:35 | |
| *** mvk has quit IRC | 07:36 | |
| *** namnh has joined #openstack-keystone | 07:36 | |
| *** namnh_ has quit IRC | 07:37 | |
| *** oikiki has joined #openstack-keystone | 07:39 | |
| *** mvk has joined #openstack-keystone | 07:41 | |
| *** ykarel|away has quit IRC | 07:49 | |
| *** ykarel|away has joined #openstack-keystone | 07:50 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:59 | |
| *** oikiki has quit IRC | 08:13 | |
| *** mvk has quit IRC | 08:13 | |
| *** namnh has quit IRC | 08:14 | |
| *** namnh has joined #openstack-keystone | 08:15 | |
| *** mvk has joined #openstack-keystone | 08:17 | |
| *** ykarel_ has joined #openstack-keystone | 08:20 | |
| *** ykarel|away has quit IRC | 08:21 | |
| *** namnh_ has joined #openstack-keystone | 08:42 | |
| *** namnh has quit IRC | 08:42 | |
| *** voelzmo has joined #openstack-keystone | 08:56 | |
| *** voelzmo has quit IRC | 08:57 | |
| *** edmondsw has joined #openstack-keystone | 09:10 | |
| *** edmondsw has quit IRC | 09:14 | |
| *** aojea has joined #openstack-keystone | 09:17 | |
| *** martinus__ has joined #openstack-keystone | 09:23 | |
| *** namnh has joined #openstack-keystone | 09:27 | |
| *** namnh_ has quit IRC | 09:29 | |
| *** marius1 has joined #openstack-keystone | 09:39 | |
| *** ykarel_ has quit IRC | 09:50 | |
| *** aojea has quit IRC | 09:58 | |
| *** voelzmo has joined #openstack-keystone | 09:58 | |
| *** voelzmo has quit IRC | 10:04 | |
| *** voelzmo has joined #openstack-keystone | 10:04 | |
| *** namnh has quit IRC | 10:10 | |
| *** aojea has joined #openstack-keystone | 10:13 | |
| *** zhurong has quit IRC | 10:30 | |
| *** AlexeyAbashkin has quit IRC | 10:30 | |
| *** aojea has quit IRC | 10:31 | |
| *** aojea has joined #openstack-keystone | 10:33 | |
| *** ykarel_ has joined #openstack-keystone | 10:38 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 10:43 | |
| *** aojea has quit IRC | 10:43 | |
| *** sapd_ has quit IRC | 10:52 | |
| *** sapd_ has joined #openstack-keystone | 10:53 | |
| *** ykarel_ is now known as ykarel | 11:23 | |
| *** voelzmo has quit IRC | 11:26 | |
| *** marius1 has quit IRC | 11:28 | |
| *** nicolasbock has joined #openstack-keystone | 11:31 | |
| openstackgerrit | melissaml proposed openstack/pycadf master: Update links in README https://review.openstack.org/551695 | 12:19 |
| *** odyssey4me has quit IRC | 12:19 | |
| *** odyssey4me has joined #openstack-keystone | 12:19 | |
| *** markvoelker has quit IRC | 12:20 | |
| *** markvoelker has joined #openstack-keystone | 12:20 | |
| *** markvoelker has quit IRC | 12:23 | |
| *** markvoelker has joined #openstack-keystone | 12:25 | |
| *** markvoelker has quit IRC | 12:29 | |
| *** gongysh has joined #openstack-keystone | 12:33 | |
| *** gongysh has quit IRC | 12:33 | |
| *** markvoelker has joined #openstack-keystone | 12:34 | |
| *** voelzmo has joined #openstack-keystone | 12:37 | |
| *** gongysh has joined #openstack-keystone | 12:37 | |
| *** edmondsw has joined #openstack-keystone | 12:41 | |
| *** voelzmo has quit IRC | 12:47 | |
| *** dave-mccowan has joined #openstack-keystone | 13:33 | |
| *** david-lyle has quit IRC | 13:34 | |
| *** pcichy has joined #openstack-keystone | 13:35 | |
| *** dave-mccowan has quit IRC | 13:37 | |
| *** jroll has quit IRC | 13:38 | |
| *** jroll has joined #openstack-keystone | 13:39 | |
| *** dave-mccowan has joined #openstack-keystone | 13:40 | |
| *** ykarel has quit IRC | 13:46 | |
| jroll | cmurphy: lbragstad: another 'JWT is bad' blog post, though focuses on people using it for sessions (sounds like you're already focusing on minimizing that?): http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/ | 13:59 |
| *** ykarel has joined #openstack-keystone | 14:07 | |
| lbragstad | yeah - we haven't worked a whole lot of that into https://review.openstack.org/#/c/541903/ , but the licensing bit is interesting | 14:08 |
| *** spilla has joined #openstack-keystone | 14:15 | |
| *** ediardo has quit IRC | 14:24 | |
| *** germs has joined #openstack-keystone | 14:42 | |
| *** germs has quit IRC | 14:42 | |
| *** germs has joined #openstack-keystone | 14:42 | |
| *** germs has quit IRC | 14:42 | |
| *** germs has joined #openstack-keystone | 14:43 | |
| *** germs has quit IRC | 14:43 | |
| *** germs has joined #openstack-keystone | 14:43 | |
| *** r-daneel has joined #openstack-keystone | 14:43 | |
| knikolla | o/ | 14:53 |
| *** tesseract has quit IRC | 14:57 | |
| *** tesseract has joined #openstack-keystone | 14:57 | |
| *** david-lyle has joined #openstack-keystone | 15:00 | |
| *** r-daneel_ has joined #openstack-keystone | 15:02 | |
| *** r-daneel has quit IRC | 15:04 | |
| *** r-daneel_ is now known as r-daneel | 15:04 | |
| *** david-lyle has quit IRC | 15:24 | |
| *** pcichy has quit IRC | 15:28 | |
| *** pcichy has joined #openstack-keystone | 15:28 | |
| *** ayoung has joined #openstack-keystone | 15:29 | |
| *** itlinux has joined #openstack-keystone | 15:40 | |
| *** felipemonteiro__ has joined #openstack-keystone | 15:43 | |
| *** ykarel is now known as ykarel|away | 15:45 | |
| *** gongysh has quit IRC | 15:47 | |
| *** tesseract has quit IRC | 16:02 | |
| *** itlinux has quit IRC | 16:03 | |
| *** david-lyle has joined #openstack-keystone | 16:05 | |
| *** pcichy has quit IRC | 16:07 | |
| *** david-lyle has quit IRC | 16:08 | |
| *** pcichy has joined #openstack-keystone | 16:21 | |
| *** AlexeyAbashkin has quit IRC | 16:31 | |
| * lbragstad goes to shovel snow | 16:36 | |
| lbragstad | biab | 16:36 |
| openstackgerrit | ayoung proposed openstack/keystone-specs master: Add capabilities to application credentials https://review.openstack.org/396331 | 16:42 |
| *** itlinux has joined #openstack-keystone | 17:06 | |
| openstackgerrit | Merged openstack/keystone master: Log warning when using token_flush https://review.openstack.org/556889 | 17:34 |
| *** r-daneel_ has joined #openstack-keystone | 17:37 | |
| *** r-daneel has quit IRC | 17:38 | |
| *** r-daneel_ is now known as r-daneel | 17:38 | |
| *** dave-mccowan has quit IRC | 17:39 | |
| *** dave-mccowan has joined #openstack-keystone | 17:40 | |
| *** itlinux has quit IRC | 17:41 | |
| *** gyee has joined #openstack-keystone | 17:49 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 17:49 | |
| *** spzala has joined #openstack-keystone | 17:50 | |
| *** AlexeyAbashkin has quit IRC | 17:53 | |
| *** EmilienM has quit IRC | 17:58 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:06 | |
| *** r-daneel_ has joined #openstack-keystone | 18:09 | |
| *** r-daneel has quit IRC | 18:10 | |
| *** r-daneel_ is now known as r-daneel | 18:10 | |
| *** AlexeyAbashkin has quit IRC | 18:10 | |
| *** felipemonteiro_ has joined #openstack-keystone | 18:19 | |
| *** fiddletw_ has joined #openstack-keystone | 18:23 | |
| *** felipemonteiro__ has quit IRC | 18:24 | |
| *** itlinux has joined #openstack-keystone | 18:31 | |
| *** ykarel|away has quit IRC | 18:42 | |
| *** felipemonteiro__ has joined #openstack-keystone | 18:46 | |
| fiddletw_ | assuming this is the right place to ask admin/user questions, I am trying to use the ldap provider for one of my domains. I've had success but I need to add a user_filter to filter by group. however, my ldap schema doesn't contain a memberOf attribute for my users. My groups are posixGroups with memberUid entries for each member of the group. Is there a way to filter users otherwise? My ldap directory has so many users that it times out | 18:47 |
| fiddletw_ | trying to find the user. In other ldap client implementations I've seen ldap filters for users along the lines of (&(objectClass=organizationalPerson)(uid=%s)) where the ldap client substitutes the user supplied username for the %s. This helps limit the search for the users and makes ldap queries return faster. | 18:47 |
| *** felipemonteiro_ has quit IRC | 18:49 | |
| lbragstad | fiddletw_: that's a good question | 18:50 |
| *** felipemonteiro__ has quit IRC | 18:50 | |
| *** felipemonteiro__ has joined #openstack-keystone | 18:51 | |
| lbragstad | ayoung: or kmalloc might have a better idea of how to do that | 18:51 |
| lbragstad | fiddletw_: how many users are in your ldap backend? | 18:51 |
| lbragstad | i'm standing up an environment now | 18:51 |
| fiddletw_ | 200k | 18:51 |
| ayoung | yeah...there is a way | 18:51 |
| * ayoung tries to dig it out of long term memory | 18:51 | |
| fiddletw_ | heh :) | 18:51 |
| ayoung | fiddletw_, you ready for this? You are going to learn far more than you want to | 18:52 |
| fiddletw_ | I've seen the horrors of ldap before. I think I'm ready...(I think) | 18:52 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap/core.py#n144 | 18:53 |
| ayoung | lets start there, as it is as a good a place as any | 18:53 |
| fiddletw_ | okie doke | 18:53 |
| ayoung | there is a function that checks if a user is in a group. How does it know? | 18:53 |
| ayoung | This is where we switch over to the LDAP specific code, which is a horror | 18:54 |
| fiddletw_ | heh, yeah, I've dealt with flask ldap integration before | 18:54 |
| ayoung | this is a real one off | 18:54 |
| ayoung | When termie rewrote keystone out of spite, I grabbed the LDAP code from the pre-write and stuck it back in | 18:55 |
| ayoung | and then we changed the default scheme... | 18:55 |
| ayoung | back to the spelunking | 18:55 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap/models.py#n55 | 18:55 |
| *** r-daneel has quit IRC | 18:55 | |
| ayoung | But really tyhe group object we care about is a GroupAPI... | 18:56 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap/core.py#n400 | 18:56 |
| ayoung | So the default way is to do the query | 18:57 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap/core.py#n424 | 18:57 |
| ayoung | now...if you8 are doing Active Directory, we have a one off | 18:58 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap/core.py#n403 | 18:58 |
| ayoung | I don't think that applies to you | 18:58 |
| fiddletw_ | sadly, not, its a custom ldap based off open directory | 18:58 |
| ayoung | so...we are going to execute query = '(%s=%s)' % (self.member_attribute, | 18:58 |
| ayoung | user_dn_esc) | 18:58 |
| ayoung | return self.get_all_filtered(hints, query) | 18:58 |
| ayoung | common used to be in a different tree, when this was shared, but now the only LDAP we have is in Identity, so that is implemented in | 19:00 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap/common.py#n1472 | 19:00 |
| ayoung | well, not quite...we want get_all_filtered....lets see | 19:01 |
| ayoung | keystone/identity/backends/ldap/core.py:324: def get_all_filtered(self, hints): | 19:01 |
| *** spzala has quit IRC | 19:01 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap/core.py#n324 | 19:02 |
| fiddletw_ | I'm catching up | 19:02 |
| ayoung | but that builds a query query = self.filter_query(hints, self.ldap_filter) | 19:02 |
| ayoung | and then filters it post get_all | 19:02 |
| *** spzala has joined #openstack-keystone | 19:03 | |
| fiddletw_ | that get_all, isn't that the get that is getting all the users from my ldap directory? | 19:03 |
| ayoung | in the user object, yeah | 19:03 |
| *** spzala has quit IRC | 19:03 | |
| *** r-daneel has joined #openstack-keystone | 19:03 | |
| ayoung | here actually what gets hit is | 19:03 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap/core.py#n466 | 19:03 |
| ayoung | I was wrong before | 19:04 |
| ayoung | it is the get_all_filtered in the GroupAPI object...not shared code | 19:04 |
| ayoung | but it is roughtly the same | 19:04 |
| ayoung | query = self.filter_query(hints, query) | 19:04 |
| fiddletw_ | right that query that does the get_all_filtered, I need it to dosomething like (uid=USER_SUPPLIED_USERNAME) | 19:05 |
| ayoung | filter_query is implemented here http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap/common.py#n1619 | 19:05 |
| fiddletw_ | and that was somewhat rhetorical on my part | 19:05 |
| ayoung | lots of knobs have been added over the years | 19:05 |
| *** spzala_ has joined #openstack-keystone | 19:06 | |
| fiddletw_ | I can see | 19:06 |
| ayoung | so lets back uop to where that is called, because we need that query string | 19:07 |
| ayoung | query = '(%s=%s)' % (self.member_attribute, | 19:07 |
| ayoung | user_dn_esc) | 19:07 |
| *** felipemonteiro_ has joined #openstack-keystone | 19:07 | |
| ayoung | so that would be an attribute of the posixGroup object | 19:08 |
| ayoung | in the config, group_memeber_attribute becomes self.member_attribute here | 19:08 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n1283 | 19:09 |
| ayoung | so you are going to want | 19:09 |
| ayoung | group_member_attribute=memberOf | 19:09 |
| ayoung | I think, right? | 19:09 |
| fiddletw_ | but I dont have memberOf | 19:09 |
| ayoung | [ldap] group_objectclass=posixGroups | 19:10 |
| fiddletw_ | in my user object, I just have my uid | 19:10 |
| fiddletw_ | but no memberOf attributes | 19:10 |
| ayoung | no, in the group object | 19:10 |
| *** spzala_ has quit IRC | 19:10 | |
| fiddletw_ | in my group objects(standard posixGroup objectclasses) I have multiple memberUid | 19:10 |
| ayoung | right...that | 19:10 |
| fiddletw_ | yeah | 19:10 |
| ayoung | group_objectclass=posixGroup | 19:11 |
| ayoung | group_member_attribute=memberUid | 19:11 |
| *** felipemonteiro__ has quit IRC | 19:11 | |
| fiddletw_ | yes, I have "group_member_attribute = memberUid" | 19:12 |
| ayoung | fiddletw_, so I assume you have a debuggable, non-production keystone that you can point at your LDAP server? | 19:12 |
| fiddletw_ | yes | 19:12 |
| ayoung | are your logs configed to dump out the LDAP queries? | 19:12 |
| fiddletw_ | I also have "user_id_attribute = uid" | 19:12 |
| ayoung | that is for the user object | 19:12 |
| fiddletw_ | yeah, I do | 19:12 |
| ayoung | so look at the query executed during a token get that lists the groups for the user | 19:13 |
| fiddletw_ | k, just a sec | 19:13 |
| ayoung | it might be that you need to tweak one of the other config options, such as the tree where the groups are stored | 19:13 |
| fiddletw_ | and also if it matters, I am running ocata | 19:14 |
| fiddletw_ | hiopefully not too out of date | 19:14 |
| fiddletw_ | a quick glance and I didn't see many changes from the current head | 19:14 |
| fiddletw_ | generating logs | 19:16 |
| *** spzala has joined #openstack-keystone | 19:16 | |
| ayoung | Nah, LDAP is pretty stable | 19:17 |
| ayoung | fiddletw_, I personally want to remove it. | 19:17 |
| ayoung | fiddletw_, you can do a lot of the LDAP stuff wit SSSD and Federation, using more secure auth mechanisms than Simple Bind | 19:17 |
| *** itlinux has quit IRC | 19:17 | |
| fiddletw_ | for us, we have a saml provider that I'd love to integrate with | 19:18 |
| fiddletw_ | ok, so let me explain something before I tell you what I am seeing | 19:21 |
| *** spzala has quit IRC | 19:21 | |
| fiddletw_ | to help make this usable, I was able to use a custom attribute my organization as a user_filter. However, this narrows the ldap query too much but enough that it made it so I could login to ldap | 19:21 |
| fiddletw_ | so I had done this "user_filter = (department=XXXXX)" its too narrow but it worked | 19:22 |
| *** spzala has joined #openstack-keystone | 19:22 | |
| fiddletw_ | I was then able to login with my user and assign the user to various domain groups, etc | 19:22 |
| fiddletw_ | I just commented out the user_filter and restarted keystone. And I was able to successfully login. This is not the behavior I saw last night when trying to login with no user_filter meant a timeout | 19:23 |
| fiddletw_ | do you follow? | 19:24 |
| fiddletw_ | the quick summary, it seems to work, but thats not what was happening last night when I had no user_filter | 19:25 |
| ayoung | user_filter ... | 19:27 |
| ayoung | that is to find the user in the first place | 19:27 |
| ayoung | I thought your problem was groups? | 19:27 |
| *** spzala has quit IRC | 19:27 | |
| ayoung | OK...I think I see the problem | 19:28 |
| ayoung | you only want a subset of the users from LDAP showing up in Keystone? | 19:28 |
| fiddletw_ | yeah, at least last night, the user search was too big | 19:28 |
| fiddletw_ | yes! | 19:28 |
| ayoung | sorry...I was being dense | 19:28 |
| *** spzala has joined #openstack-keystone | 19:28 | |
| fiddletw_ | because I have too many users in my directory | 19:28 |
| ayoung | yeah. list_users should never have been allowed | 19:29 |
| fiddletw_ | its cool. that was a good insight into how ldap is working | 19:29 |
| ayoung | usually there is a filter on the LDAP server only allowing a maximumn number of records to return | 19:29 |
| fiddletw_ | yeah, I had to remove that, page_size was it? | 19:29 |
| fiddletw_ | wait, list_limit | 19:30 |
| fiddletw_ | list_limit = 0 | 19:30 |
| fiddletw_ | is what I set it | 19:30 |
| ayoung | You might want it a little bit higher | 19:30 |
| fiddletw_ | list_limit = 0, does that not disable the limit? | 19:30 |
| ayoung | I don't think that kicks in prior to LDAP though | 19:31 |
| ayoung | pretty sure that LDAP returns the gazillion entries, and then that just chomps them | 19:31 |
| ayoung | I was talking about the LDAP server itself, outside of Keystone's control | 19:31 |
| fiddletw_ | oh, were you referring to page_size ? | 19:32 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n1183 is for doing it inside Keystone, yes | 19:32 |
| ayoung | and that might work for you as well, but looks like the posixGroup approach works for you now? | 19:33 |
| *** spzala has quit IRC | 19:33 | |
| fiddletw_ | yeah, I am verifying now | 19:33 |
| ayoung | ldapsearch -x -H ldap://ldap.corp.redhat.com -L -b 'dc=redhat,dc=com' | grep dn: | wc -l | 19:35 |
| ayoung | 42267 | 19:35 |
| fiddletw_ | and regardless, that was a great walkthrough on the ldap provider | 19:35 |
| ayoung | Looks like we don't limit | 19:35 |
| ayoung | shudder | 19:35 |
| fiddletw_ | hehe | 19:35 |
| *** felipemonteiro_ has quit IRC | 19:38 | |
| ayoung | That is a really high number...we must have a lot of entries in there for contractors and so on | 19:38 |
| *** felipemonteiro__ has joined #openstack-keystone | 19:38 | |
| ayoung | anyway, sounds like you are all set? | 19:38 |
| fiddletw_ | for now I am | 19:38 |
| ayoung | fiddletw_, I highly suggest you look in to SSSD and Federation | 19:39 |
| ayoung | are you a Kerberos shop? | 19:39 |
| fiddletw_ | SAML | 19:39 |
| ayoung | Even better | 19:39 |
| ayoung | SAML federation is well supported | 19:39 |
| fiddletw_ | yeah, we want to go down that path for sure | 19:39 |
| ayoung | make sure your IDP supports ECP if you need to use CLI for it | 19:40 |
| fiddletw_ | I'm not as familiar with SAML so not sure what that is, but I'll note it :) | 19:40 |
| fiddletw_ | we have a whole team dedicated for that, I need to engage them. It just can be organizationally "challenging" at times | 19:41 |
| ayoung | fiddletw_, good luck | 19:42 |
| fiddletw_ | thanks, if I run into other issues, I'll come back for a visit. I appreciate the LDAP tour | 19:43 |
| *** itlinux has joined #openstack-keystone | 19:55 | |
| *** david-lyle has joined #openstack-keystone | 19:56 | |
| *** r-daneel has quit IRC | 19:59 | |
| *** spzala_ has joined #openstack-keystone | 20:02 | |
| *** itlinux has quit IRC | 20:02 | |
| *** r-daneel has joined #openstack-keystone | 20:08 | |
| *** spzala_ has quit IRC | 20:09 | |
| *** edmondsw has quit IRC | 20:17 | |
| *** felipemonteiro__ has quit IRC | 20:23 | |
| *** mordred has quit IRC | 20:26 | |
| *** mordred has joined #openstack-keystone | 20:28 | |
| *** r-daneel has quit IRC | 20:43 | |
| *** r-daneel has joined #openstack-keystone | 20:45 | |
| *** mchlumsky has quit IRC | 20:45 | |
| *** felipemonteiro__ has joined #openstack-keystone | 20:56 | |
| lbragstad | in case anyone feels like double checking my work - https://review.openstack.org/#/c/557997/ | 20:58 |
| *** martinus__ has quit IRC | 21:00 | |
| *** r-daneel has quit IRC | 21:05 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 21:05 | |
| *** mvk has quit IRC | 21:07 | |
| *** r-daneel has joined #openstack-keystone | 21:09 | |
| *** AlexeyAbashkin has quit IRC | 21:09 | |
| lbragstad | ayoung: kmalloc while we were talking about ldap - https://bugs.launchpad.net/keystone/+bug/1754723 | 21:13 |
| openstack | Launchpad bug 1754723 in OpenStack Identity (keystone) "'openstack user list' is not listing userid correctly in case of LDAP" [Undecided,New] | 21:13 |
| lbragstad | ^ that is working as designed with the shadow user stuff, right? | 21:13 |
| *** edmondsw has joined #openstack-keystone | 21:14 | |
| *** fiddletw_ has quit IRC | 21:15 | |
| *** fiddletwix has joined #openstack-keystone | 21:15 | |
| *** edmondsw has quit IRC | 21:19 | |
| *** felipemonteiro__ has quit IRC | 21:24 | |
| *** itlinux has joined #openstack-keystone | 21:26 | |
| *** itlinux has quit IRC | 21:27 | |
| *** harlowja has joined #openstack-keystone | 21:28 | |
| *** sglazyrin_ has joined #openstack-keystone | 21:29 | |
| *** r-daneel has quit IRC | 21:30 | |
| *** r-daneel has joined #openstack-keystone | 21:31 | |
| sglazyrin_ | Hello guys! I need an advice about horizon plugin and keystone. I want to keep in my horizon plugin only javascript stuff but separate backend api of my plugin into separated uwsgi process and this backend api requires the same user as horizon. Is it a proper way to configure WEBSSO for horizon and my backend api app ? | 21:32 |
| *** felipemonteiro__ has joined #openstack-keystone | 21:33 | |
| *** marius1 has joined #openstack-keystone | 21:57 | |
| *** felipemonteiro__ has quit IRC | 22:03 | |
| ayoung | sglazyrin_, one moment | 22:22 |
| sglazyrin_ | The reason why I need it, our horizon backend part has a lot of python dependencies, and we may break the system, sure we can wrap whole horizon into separated virtualenv, but than we may break horizon functionality... | 22:25 |
| ayoung | sglazyrin_, I totally love the idea of the Keystone stuff being in Javascript | 22:32 |
| ayoung | I think, though, that you need good CORS support to make that happen. I did a POC of that a few years back | 22:33 |
| ayoung | not sure how to send the token to Horizon, which is a server side app and needs the token to make calls itself | 22:34 |
| ayoung | WebSSO is different | 22:35 |
| ayoung | that is still passing the SAML assertion to the backend server | 22:35 |
| sglazyrin_ | I almost managed it to work. I want to connect the handler to user_signed_in django event, then send a token (horizon token) /backend-api/auth/websso/ and I get the same session in my backend api | 22:36 |
| sglazyrin_ | what do you think ? will it break something ? so, the flow is following: 1. when user signs in into horizon, I send a request to backend-api/websso endpoint, it starts the session from token and I got the same user... | 22:37 |
| sglazyrin_ | I use openstack_auth auth backend in my api as well. | 22:38 |
| sglazyrin_ | what do you mean by this ? | 22:40 |
| sglazyrin_ | I totally love the idea of the Keystone stuff being in Javascript | 22:40 |
| *** marius1 has quit IRC | 22:49 | |
| ayoung | sglazyrin_, Itsounds cool. | 22:54 |
| ayoung | sglazyrin_, I totally love the idea of all of the Keystone access coming from the browser and the browser talking to the different OpenStack services directly | 22:55 |
| sglazyrin_ | that's great idea... | 22:56 |
| ayoung | as far as websso goes, there is a Django based way to configure that already, so not sure if you rallly want to spend the cycles on it, but it is not a crazy idea | 22:56 |
| sglazyrin_ | I'll take a look later, maybe I can help somehow and contribute to openstack stuff. | 22:56 |
| *** r-daneel has quit IRC | 23:00 | |
| *** edmondsw has joined #openstack-keystone | 23:03 | |
| sglazyrin_ | do you have an article about your POC for keystone in javascript ? Just curious ? | 23:03 |
| sglazyrin_ | maybe we can wrap it into some solution ? | 23:03 |
| *** edmondsw has quit IRC | 23:08 | |
| *** spilla has quit IRC | 23:13 | |
| *** lbragstad has quit IRC | 23:41 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!