| *** lifeless has quit IRC | 00:38 | |
| *** lifeless has joined #openstack-keystone | 00:45 | |
| *** pcichy has quit IRC | 00:45 | |
| *** pcichy has joined #openstack-keystone | 00:46 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:49 | |
| *** pcichy has quit IRC | 00:50 | |
| *** pcichy has joined #openstack-keystone | 00:50 | |
| *** blake has joined #openstack-keystone | 00:51 | |
| *** blake has quit IRC | 00:55 | |
| *** pcichy has quit IRC | 01:05 | |
| *** pcichy has joined #openstack-keystone | 01:11 | |
| *** pcichy has quit IRC | 01:20 | |
| *** larsks has joined #openstack-keystone | 01:30 | |
| *** gongysh has joined #openstack-keystone | 01:32 | |
| lbragstad | kmalloc: yeah - where in the world the self.test_client get setup? | 01:38 |
|---|---|---|
| kmalloc | Part of flask, and in core I use our custom client that does the expected response check | 01:39 |
| kmalloc | It's a feature of flask 1.0+ | 01:39 |
| *** pcichy has joined #openstack-keystone | 01:50 | |
| *** gyee has quit IRC | 01:51 | |
| *** pcichy_ has joined #openstack-keystone | 02:01 | |
| *** pcichy has quit IRC | 02:04 | |
| *** pcichy has joined #openstack-keystone | 02:05 | |
| *** pcichy_ has quit IRC | 02:08 | |
| *** jmlowe_ has joined #openstack-keystone | 02:09 | |
| lbragstad | nice - that's awesome | 02:09 |
| *** pcichy has quit IRC | 02:09 | |
| *** jmlowe has quit IRC | 02:10 | |
| *** gongysh has quit IRC | 02:16 | |
| *** gongysh has joined #openstack-keystone | 02:35 | |
| *** sapd has quit IRC | 02:36 | |
| *** sapd has joined #openstack-keystone | 02:39 | |
| *** itlinux has joined #openstack-keystone | 02:44 | |
| *** annp has joined #openstack-keystone | 02:50 | |
| *** blake has joined #openstack-keystone | 02:51 | |
| openstackgerrit | Merged openstack/keystone master: Override oauthlib docstrings that fail with Sphinx 1.7.5 https://review.openstack.org/578121 | 02:55 |
| *** blake has quit IRC | 02:56 | |
| *** dklyle has quit IRC | 03:32 | |
| *** bhagyashris has joined #openstack-keystone | 03:43 | |
| *** gongysh has quit IRC | 04:06 | |
| *** dklyle has joined #openstack-keystone | 04:11 | |
| *** gongysh has joined #openstack-keystone | 04:15 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 04:20 | |
| *** viks_ has joined #openstack-keystone | 04:27 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers https://review.openstack.org/577807 | 04:47 |
| *** AlexeyAbashkin has quit IRC | 04:49 | |
| *** dklyle has quit IRC | 04:52 | |
| *** dklyle has joined #openstack-keystone | 04:57 | |
| *** gongysh has quit IRC | 04:59 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers https://review.openstack.org/577807 | 05:15 |
| *** rha has quit IRC | 05:17 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers https://review.openstack.org/577807 | 05:27 |
| *** gongysh has joined #openstack-keystone | 05:36 | |
| *** blake has joined #openstack-keystone | 05:51 | |
| *** martinus__ has joined #openstack-keystone | 06:14 | |
| *** threestrands has quit IRC | 06:19 | |
| *** namnh has joined #openstack-keystone | 06:28 | |
| *** issp has joined #openstack-keystone | 06:28 | |
| *** dmellado has joined #openstack-keystone | 06:29 | |
| *** blake has quit IRC | 06:31 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 06:35 | |
| *** AlexeyAbashkin has quit IRC | 06:37 | |
| *** chrome0 has quit IRC | 06:39 | |
| *** nicolasbock has joined #openstack-keystone | 06:40 | |
| *** chrome0 has joined #openstack-keystone | 06:41 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers https://review.openstack.org/577807 | 06:42 |
| *** pcaruana has joined #openstack-keystone | 06:44 | |
| *** pcaruana has quit IRC | 07:02 | |
| *** peereb has joined #openstack-keystone | 07:03 | |
| *** peereb has quit IRC | 07:04 | |
| *** peereb has joined #openstack-keystone | 07:04 | |
| *** peereb has quit IRC | 07:05 | |
| *** peereb has joined #openstack-keystone | 07:06 | |
| *** tesseract has joined #openstack-keystone | 07:07 | |
| openstackgerrit | Neha Alhat proposed openstack/keystonemiddleware master: Register session conf options from keystoneauth https://review.openstack.org/578008 | 07:21 |
| *** jaosorior has quit IRC | 07:23 | |
| *** tosky has joined #openstack-keystone | 07:40 | |
| *** amoralej|off is now known as amoralej | 07:42 | |
| *** issp has quit IRC | 07:42 | |
| *** rcernin has quit IRC | 07:51 | |
| *** rcernin has joined #openstack-keystone | 07:52 | |
| *** pcaruana has joined #openstack-keystone | 07:57 | |
| *** issp has joined #openstack-keystone | 08:11 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Strict two level limit model https://review.openstack.org/557696 | 08:42 |
| *** rcernin has quit IRC | 08:47 | |
| *** d0ugal has quit IRC | 08:54 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers https://review.openstack.org/577807 | 09:09 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers https://review.openstack.org/577807 | 09:10 |
| *** BlackDex has quit IRC | 09:13 | |
| *** Dinesh_Bhor has quit IRC | 09:14 | |
| *** BlackDex has joined #openstack-keystone | 09:26 | |
| *** parthiban has joined #openstack-keystone | 09:34 | |
| *** threestrands has joined #openstack-keystone | 09:45 | |
| *** threestrands has quit IRC | 09:45 | |
| *** threestrands has joined #openstack-keystone | 09:45 | |
| *** threestrands has quit IRC | 09:46 | |
| *** threestrands has joined #openstack-keystone | 09:47 | |
| parthiban | Hello all, I would like to know if the guideline (key revocation system to quickly deactivate potentially compromised keys in OpenStack - https://wiki.openstack.org/wiki/Security/Guidelines#key_revocation) is already fixed or is in roadmap? | 09:56 |
| parthiban | Can someone help me on this? | 09:56 |
| *** jaosorior has joined #openstack-keystone | 10:18 | |
| *** pcaruana has quit IRC | 10:31 | |
| *** namnh has quit IRC | 10:40 | |
| *** tellesnobrega has left #openstack-keystone | 11:15 | |
| *** amoralej is now known as amoralej|lunch | 11:37 | |
| *** raildo has joined #openstack-keystone | 11:55 | |
| *** mvk has quit IRC | 12:07 | |
| *** ispp has quit IRC | 12:20 | |
| *** mvk has joined #openstack-keystone | 12:37 | |
| *** gongysh has quit IRC | 12:37 | |
| *** edmondsw has joined #openstack-keystone | 12:57 | |
| *** edmondsw has quit IRC | 12:57 | |
| *** edmondsw has joined #openstack-keystone | 12:57 | |
| *** amoralej|lunch is now known as amoralej | 13:18 | |
| *** vegarl has quit IRC | 13:24 | |
| *** vegarl has joined #openstack-keystone | 13:26 | |
| *** itlinux has quit IRC | 13:35 | |
| lbragstad | parthiban: i'm not sure i understand what that is supposed to be doing. that looks like something someone on the security team might be able to answer though | 13:45 |
| *** s10 has joined #openstack-keystone | 14:11 | |
| *** spilla has joined #openstack-keystone | 14:22 | |
| *** itlinux has joined #openstack-keystone | 14:22 | |
| *** threestrands has quit IRC | 14:30 | |
| *** felipemonteiro has joined #openstack-keystone | 14:33 | |
| *** felipemonteiro_ has joined #openstack-keystone | 14:34 | |
| *** felipemonteiro_ has quit IRC | 14:37 | |
| *** felipemonteiro_ has joined #openstack-keystone | 14:37 | |
| *** felipemonteiro has quit IRC | 14:38 | |
| *** evrardjp has quit IRC | 14:45 | |
| *** evrardjp has joined #openstack-keystone | 14:45 | |
| gagehugo | o/ | 14:54 |
| *** tonytan4ever has joined #openstack-keystone | 15:00 | |
| *** evrardjp has quit IRC | 15:02 | |
| *** evrardjp has joined #openstack-keystone | 15:03 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove token bind capabilities https://review.openstack.org/577524 | 15:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Introduce new TokenModel object https://review.openstack.org/559129 | 15:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Simplify the token provider API https://review.openstack.org/545450 | 15:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Cleanup keystone.token.providers.common https://review.openstack.org/577507 | 15:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove KeystoneToken object https://review.openstack.org/577567 | 15:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add serialization for TokenModel object https://review.openstack.org/578434 | 15:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove remnants of token bind https://review.openstack.org/578435 | 15:10 |
| kmalloc | lbragstad: going to spin a change to address the comments for the Enforcer | 15:15 |
| kmalloc | lbragstad: anything else needed for your comments at this point? | 15:15 |
| kmalloc | lbragstad: i think the rest were just addressed in-line | 15:16 |
| kmalloc | lbragstad: and do you want me to merge the flask bump with restful add? | 15:17 |
| kmalloc | lbragstad: i'd prefer not to touch the bottom of that stack, but you have a -1 on the flask req bump | 15:17 |
| kmalloc | lbragstad: do you have an example of the deprecated action[s] i don't think we have one in keystone | 15:19 |
| lbragstad | yep - i included a bunch of examples in the oslo.policy docs - https://docs.openstack.org/oslo.policy/queens/reference/api/oslo_policy.policy.html#oslo_policy.policy.DeprecatedRule | 15:21 |
| kmalloc | ah | 15:22 |
| kmalloc | so just a single deprecated rule | 15:22 |
| kmalloc | not a list of deprecated rules | 15:22 |
| kmalloc | ok that is easy. | 15:22 |
| *** mvk has quit IRC | 15:23 | |
| *** jmlowe_ has quit IRC | 15:23 | |
| kmalloc | lbragstad: but bah, it isn't as elegant as a simple list comprehension | 15:26 |
| lbragstad | no - it's not | 15:26 |
| kmalloc | i mean, i could do it in a really ugly nested list comp with itertools.chain | 15:31 |
| kmalloc | (lets not) | 15:31 |
| *** edmondsw has quit IRC | 15:33 | |
| *** peereb has quit IRC | 15:35 | |
| *** gyee has joined #openstack-keystone | 15:42 | |
| kmalloc | gyee: psst. | 15:43 |
| kmalloc | gyee: i want your eyes on some code. | 15:43 |
| kmalloc | gyee: because i know you're one of the few people who *ever* understood @protected. | 15:44 |
| gyee | kmalloc, sure, which review? | 15:44 |
| kmalloc | gyee: sec | 15:46 |
| kmalloc | gyee: trying to post an updated one | 15:46 |
| kmalloc | lbragstad: uh. i think your oslo.policy example(S) look weird. | 15:46 |
| kmalloc | lbragstad: oh nvm | 15:47 |
| kmalloc | i mis-read that | 15:47 |
| kmalloc | or... wait i don't understand this... | 15:48 |
| kmalloc | lbragstad: oh.. ok, so explain to me why deprecated_reason and deprecated_since are on the undeprecated rule? | 15:49 |
| kmalloc | lbragstad: that makes absolutely no sense. | 15:49 |
| kmalloc | it seems like values that should be on the deprecatedRule object | 15:49 |
| kmalloc | lbragstad: it *looks* like the ruledefault is deprecated | 15:50 |
| kmalloc | with the way it's setup now. | 15:50 |
| lbragstad | the deprecated rule is just an object that holds the name and check string of the deprecated thing | 15:50 |
| lbragstad | mmm | 15:51 |
| kmalloc | lbragstad: right. | 15:51 |
| kmalloc | lbragstad: and i should still be able to use the deprecated rule, right? | 15:51 |
| lbragstad | we do some aliasing, yes | 15:52 |
| lbragstad | there is kind of something similar here https://docs.openstack.org/oslo.config/latest/reference/cfg.html#option-deprecation | 15:52 |
| kmalloc | hmm. i'm getting some bugs | 15:52 |
| kmalloc | like my main ruledefault is now failing once i add a deprecated rule | 15:52 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: [WIP] Add functional testing gate https://review.openstack.org/531014 | 15:53 |
| lbragstad | can you paste a diff? | 15:53 |
| kmalloc | oh. | 15:53 |
| kmalloc | oh wow, DeprecatedRule just adds a logical OR? | 15:53 |
| lbragstad | yeah | 15:53 |
| kmalloc | so you can't deprecate an open-enforcement rule | 15:54 |
| kmalloc | or a closed enforcement rule | 15:54 |
| lbragstad | what do you mean? | 15:54 |
| kmalloc | check_str='' | 15:54 |
| kmalloc | is open enforcement | 15:54 |
| kmalloc | same with True | 15:54 |
| kmalloc | closed enforcement false or false:false | 15:54 |
| kmalloc | they will always succeed or always fail | 15:54 |
| lbragstad | do you want to deprecate it for removal? | 15:54 |
| lbragstad | or rename it? | 15:54 |
| kmalloc | for removal, right? | 15:55 |
| lbragstad | yes - that's supported | 15:55 |
| lbragstad | you just need to set deprecated_for_removal=True | 15:55 |
| lbragstad | and don't worry about supplying a deprecated rule object | 15:55 |
| kmalloc | ugh oh wow | 15:56 |
| kmalloc | uhm, can i say that this interface is hard to work with | 15:56 |
| lbragstad | yeah - sorry | 15:56 |
| kmalloc | =/ | 15:56 |
| lbragstad | the permutations for deprecating policies was non-trivial i found | 15:56 |
| kmalloc | ok i don't care about deprecated for removal... i need to explicitly NOT add those to the possible actions | 15:56 |
| kmalloc | well no, the interface should have been, imo, deprecatedRule(for_removal/not_for_removal/name/check_str/reason/since) | 15:57 |
| kmalloc | and RuleDefault(deprecated_rules=[...]) | 15:57 |
| kmalloc | so the deprecation is all contained in the deprecatedRule object | 15:58 |
| kmalloc | and you could support a rename and supersede of different rules, or even collapsing multiple rules in | 15:58 |
| kmalloc | lbragstad: so anyway.. let me confirm | 15:58 |
| kmalloc | lbragstad: -- Deprecated For Removal = Can no longer be used. | 15:59 |
| kmalloc | lbragstad: Deprecated - Both Action names work? and it's a logical or? | 15:59 |
| lbragstad | i believe so | 15:59 |
| lbragstad | i'd need to pull up the code | 15:59 |
| kmalloc | trying to figure out what to put in the "possible actions" set | 16:00 |
| kmalloc | rule.name and rule.deprecated_rule.name if not rule.deprecated_for_removal ? | 16:00 |
| kmalloc | and if rule.deprecateD_rule | 16:00 |
| lbragstad | would you want it in all cases? | 16:00 |
| *** mvenesio has joined #openstack-keystone | 16:01 | |
| lbragstad | because it's a name that we could be referencing somewhere in keystone | 16:01 |
| kmalloc | hold on here is the diff. | 16:01 |
| mvenesio | Hi guys, i'm trying to configure keystone federation using the mellon auth module in REDHAT, and i'm having some issues, is there anyone that can help me with this ? | 16:02 |
| *** parthiban has quit IRC | 16:02 | |
| lbragstad | kmalloc: if you want to open a bug against oslo.policy (eventually) for adding the deprecated options to the deprecatedrule object, i can clean that up | 16:03 |
| kmalloc | lbragstad: http://paste.openstack.org/show/724419/ | 16:03 |
| kmalloc | lbragstad: ignore the minor nit fixes | 16:03 |
| lbragstad | we'll need to support both ways of doing it, but... at least we can offer a better path | 16:03 |
| kmalloc | look at test_rbac_enforcer changes | 16:03 |
| kmalloc | and i'm getting http://paste.openstack.org/show/724420/ | 16:04 |
| kmalloc | I have also tried without deprece for removal | 16:05 |
| lbragstad | are you wanting to deprecate example:subject_token for removal or replace it? | 16:06 |
| kmalloc | I want to deprecate example: deprecated | 16:06 |
| kmalloc | See how the interface doesn't make sense? | 16:06 |
| lbragstad | yeah - i see it | 16:06 |
| lbragstad | but what you're saying is that example:subject_token is deprecated for removal | 16:07 |
| kmalloc | That is going by your Oslo policy docs | 16:07 |
| kmalloc | Afaict | 16:07 |
| lbragstad | i don't think it is because there isn't an example that uses a deprecated rule object and deprecated_for_removal | 16:08 |
| lbragstad | which is probably something i should fix by adding another example | 16:08 |
| kmalloc | I tried without for removal in many permutations didn't work. | 16:09 |
| kmalloc | I was looking at the role:bang example | 16:09 |
| *** edmondsw has joined #openstack-keystone | 16:09 | |
| kmalloc | So, fwiw, I just don't know what actions should be valid with this deprecation and... If I need to do something to load the rule properly to the enforcer | 16:10 |
| lbragstad | so - what does the enforce need to know? | 16:10 |
| lbragstad | enforcer* | 16:10 |
| lbragstad | all the possible policy names, right? | 16:11 |
| kmalloc | One thing: policy names | 16:11 |
| lbragstad | ok | 16:11 |
| kmalloc | But.. I want to make sure if we have a deprecated action name that should still work, enforxe_call can be used with it. | 16:11 |
| *** s10 has quit IRC | 16:11 | |
| kmalloc | So, the test needs to standup a reasonable example. | 16:11 |
| lbragstad | http://paste.openstack.org/show/724421/ should work - but it sounds like you've tried that | 16:14 |
| kmalloc | ok so i have 2 examples i need to cover | 16:14 |
| kmalloc | 1) deprecated rule, simple rename | 16:14 |
| kmalloc | 2) deprecated rule, new check_str default | 16:14 |
| kmalloc | and ignore "deprecated_for_removal" | 16:14 |
| *** issp has quit IRC | 16:15 | |
| lbragstad | ok - so | 16:15 |
| kmalloc | with a rename, same check_str, i just copy the check_str? | 16:15 |
| kmalloc | or can both of those be covered in the same test. | 16:15 |
| lbragstad | http://paste.openstack.org/show/724422/ | 16:17 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1778945 | 16:20 |
| openstack | Launchpad bug 1778945 in OpenStack Identity (keystone) "Complexity in token provider APIs" [Medium,Triaged] | 16:20 |
| kmalloc | hmm. | 16:21 |
| kmalloc | lbragstad: ok i got the parsing error solved | 16:22 |
| kmalloc | lbragstad: it looks like deprecatedRule doesn't get loaded inot the enforcer (oslo_policy) object | 16:22 |
| kmalloc | https://www.irccloud.com/pastebin/tAXkpzXy/ | 16:22 |
| kmalloc | lbragstad: do i need to add the deprecated rule to the rule_list as well? | 16:23 |
| lbragstad | no - it should be picked up by oslo.policy if it's passed into a rule as .deprecated_rule | 16:24 |
| kmalloc | https://www.irccloud.com/pastebin/jSe4rXSK/ | 16:25 |
| kmalloc | right? | 16:25 |
| kmalloc | and i tried example:deprecated and the action check succeeds now | 16:25 |
| kmalloc | but i get Rule [example:deprecated] does not exist | 16:25 |
| lbragstad | what's asking for example:deprecated? | 16:26 |
| kmalloc | i'm doing an explicit enforce.enforce_call(action='example:deprecated') | 16:26 |
| kmalloc | to test that the action is in-fact valid | 16:26 |
| lbragstad | oh | 16:27 |
| lbragstad | https://bugs.launchpad.net/oslo.policy/+bug/1778949 | 16:27 |
| openstack | Launchpad bug 1778949 in oslo.policy "Deprecated rule is confusing" [Undecided,New] | 16:27 |
| kmalloc | that is a good bug report | 16:28 |
| kmalloc | and yes, that will help avoid confusion | 16:28 |
| kmalloc | but right now i'm worried you can't reference the old action | 16:28 |
| lbragstad | ok so | 16:28 |
| kmalloc | *or* is it just that we logical or and load from policy.json? | 16:29 |
| lbragstad | let's say we have example:foo | 16:29 |
| *** tosky has quit IRC | 16:29 | |
| lbragstad | and we use that to enforce some method create_foo | 16:29 |
| kmalloc | right. | 16:29 |
| lbragstad | but we decide we want to change it to example:create_foo instead | 16:29 |
| *** tosky has joined #openstack-keystone | 16:29 | |
| kmalloc | yep. | 16:30 |
| kmalloc | with you so far. | 16:30 |
| * lbragstad is getting a paste | 16:30 | |
| * kmalloc is getting the impression that nothing needed to change in the test_rbac_enforcer file to support deprecated actions. | 16:30 | |
| kmalloc | that it's just to load from policy.json | 16:31 |
| lbragstad | this is the policy we have | 16:31 |
| lbragstad | http://paste.openstack.org/show/724423/ | 16:31 |
| lbragstad | but this is what we change to | 16:32 |
| lbragstad | http://paste.openstack.org/show/724424/ | 16:32 |
| lbragstad | when we make ^ change | 16:32 |
| lbragstad | code in keystone starts enforcing on example:create_foo right? | 16:32 |
| kmalloc | and keystone never uses the action "example:foo" | 16:33 |
| lbragstad | yeah | 16:33 |
| kmalloc | but we load it from policy.json | 16:33 |
| lbragstad | and we pull the check_str | 16:33 |
| kmalloc | ok, then enforcer and potential actions didn't need to change | 16:33 |
| lbragstad | in that case - maybe not | 16:34 |
| kmalloc | since enforcer is only caring about what keystone [internally] calls the action | 16:34 |
| kmalloc | we would always call it example:create_foo | 16:34 |
| kmalloc | and the rest is just leaning on oslo_policy | 16:34 |
| kmalloc | cool. | 16:34 |
| *** tesseract has quit IRC | 16:34 | |
| lbragstad | ok - is there any other place where that isn't true? | 16:34 |
| lbragstad | if we deprecate a policy for removal | 16:35 |
| lbragstad | we should be enforcing on it's replacement, right? | 16:35 |
| kmalloc | right | 16:36 |
| lbragstad | ok | 16:36 |
| kmalloc | basically once a policy is deprecated we never should reference it in keystone | 16:36 |
| lbragstad | sorry for the wild goose chase :( | 16:36 |
| *** felipemonteiro__ has joined #openstack-keystone | 16:36 | |
| kmalloc | *BUT* deprecated_for_removal is still added to the action names | 16:36 |
| kmalloc | i can filter those | 16:37 |
| kmalloc | let me do that. | 16:37 |
| kmalloc | ok, so i am now filtering out any rule that is .deprecated_for_removal | 16:38 |
| *** jmlowe has joined #openstack-keystone | 16:38 | |
| kmalloc | it wont be a valid action to call | 16:38 |
| kmalloc | lbragstad: that sound correct? | 16:38 |
| *** jmlowe has quit IRC | 16:39 | |
| lbragstad | i think so - if it's been deprecated for removal, we shouldn't be protecting APIs with it IMO | 16:39 |
| kmalloc | odne | 16:39 |
| kmalloc | done* | 16:39 |
| lbragstad | so if we have identity:foo | 16:39 |
| kmalloc | let me run pep8 and test_rbac_enforcer again | 16:39 |
| kmalloc | then will post. | 16:39 |
| *** jmlowe has joined #openstack-keystone | 16:39 | |
| lbragstad | and we deprecate it for removal because we no longer support the foo API | 16:40 |
| kmalloc | there is no reason to refer to the action | 16:40 |
| * kmalloc nods. | 16:40 | |
| lbragstad | right | 16:40 |
| *** felipemonteiro_ has quit IRC | 16:40 | |
| lbragstad | that's kind of a weird example, but... | 16:40 |
| lbragstad | seems rare | 16:40 |
| kmalloc | hey, whatever. | 16:40 |
| kmalloc | we need to fix oslo.policy to emit [in logs] the paths | 16:41 |
| kmalloc | not just the action:name | 16:41 |
| lbragstad | why the paths? | 16:42 |
| kmalloc | because action:name is wonky | 16:42 |
| kmalloc | should i emit the path in our enforcer? | 16:42 |
| kmalloc | i mean, i can do it... | 16:42 |
| lbragstad | those are only there in instances of DocumentedRuleDefaults | 16:42 |
| kmalloc | right. sorry in our enforcer | 16:42 |
| kmalloc | i could emit the request path in the debug log | 16:42 |
| kmalloc | (easily) | 16:42 |
| * kmalloc will revisit that thought later. | 16:43 | |
| lbragstad | also - let me know if you have additional things to add to https://bugs.launchpad.net/keystone/+bug/1778945 or if it makes sense | 16:43 |
| openstack | Launchpad bug 1778945 in OpenStack Identity (keystone) "Complexity in token provider APIs" [Medium,Triaged] | 16:43 |
| *** edmondsw has quit IRC | 16:43 | |
| * kmalloc nods. | 16:43 | |
| kmalloc | will look shortly | 16:43 |
| kmalloc | as soon as i post this and make gyee review it | 16:44 |
| kmalloc | ;) | 16:44 |
| lbragstad | wfm | 16:44 |
| *** edmondsw has joined #openstack-keystone | 16:44 | |
| kmalloc | oh goodie here it goes :) | 16:44 |
| *** edmondsw has quit IRC | 16:44 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Implement base for new RBAC Enforcer https://review.openstack.org/576639 | 16:44 |
| kmalloc | gyee: ^ that | 16:44 |
| kmalloc | gyee: new enforcer to break apart @protected to something usable | 16:45 |
| kmalloc | yes it is Flask-only, but we're moving APIs to flask. | 16:45 |
| kmalloc | lbragstad: ok let me rebase a couple changes and then look at that bug. | 16:45 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add support for enforce_call to set value on flask.g https://review.openstack.org/578189 | 16:47 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Update Scaffolding (flask) for json home documents https://review.openstack.org/578190 | 16:47 |
| kmalloc | lbragstad: that bug looks 100% accurate and complete | 16:49 |
| lbragstad | cool | 16:49 |
| *** spilla has quit IRC | 16:49 | |
| kmalloc | well it looks like i'm merging the requirements update[s] | 16:50 |
| kmalloc | because requirements check is complaining =/ | 16:50 |
| lbragstad | sounds good | 16:53 |
| lbragstad | i'm going to step away to get a run in over lunch, but i'll rebase the token provider refactor and associate it to https://bugs.launchpad.net/keystone/+bug/1778945 once i get back | 16:54 |
| openstack | Launchpad bug 1778945 in OpenStack Identity (keystone) "Complexity in token provider APIs" [Medium,Triaged] | 16:54 |
| lbragstad | i need a release note for it anyway | 16:54 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add Flask-RESTful and update flask minimum(s) https://review.openstack.org/574414 | 16:55 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Implement scaffolding for Flask-RESTful use https://review.openstack.org/574415 | 16:55 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Keystone adheres to public_endpoint opt only https://review.openstack.org/574502 | 16:55 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert json_home and version discovery to Flask https://review.openstack.org/574736 | 16:55 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add support for before and after request functions https://review.openstack.org/576637 | 16:56 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Don't replace the whole app just the wsgi_app backing https://review.openstack.org/577587 | 16:56 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Make it easy to identify a 404 from Flask https://review.openstack.org/577627 | 16:56 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Address minor comments to 404 error detection https://review.openstack.org/578216 | 16:56 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Implement base for new RBAC Enforcer https://review.openstack.org/576639 | 16:56 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add support for enforce_call to set value on flask.g https://review.openstack.org/578189 | 16:56 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Update Scaffolding (flask) for json home documents https://review.openstack.org/578190 | 16:56 |
| kmalloc | lbragstad: ^ AND rebased. | 16:57 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add Flask-RESTful and update flask minimum(s) https://review.openstack.org/574414 | 16:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Implement scaffolding for Flask-RESTful use https://review.openstack.org/574415 | 16:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Keystone adheres to public_endpoint opt only https://review.openstack.org/574502 | 16:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert json_home and version discovery to Flask https://review.openstack.org/574736 | 16:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add support for before and after request functions https://review.openstack.org/576637 | 16:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Don't replace the whole app just the wsgi_app backing https://review.openstack.org/577587 | 16:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Make it easy to identify a 404 from Flask https://review.openstack.org/577627 | 16:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Implement base for new RBAC Enforcer https://review.openstack.org/576639 | 16:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add support for enforce_call to set value on flask.g https://review.openstack.org/578189 | 16:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Update Scaffolding (flask) for json home documents https://review.openstack.org/578190 | 16:58 |
| *** spilla has joined #openstack-keystone | 16:59 | |
| * kmalloc grumps about working in a review-set 11 reviews deep | 17:00 | |
| kmalloc | gyee: let me know if you have questions, but def. would like your input :) | 17:01 |
| *** felipemonteiro__ has quit IRC | 17:16 | |
| *** felipemonteiro_ has joined #openstack-keystone | 17:16 | |
| *** amoralej is now known as amoralej|off | 17:29 | |
| *** vishakha has quit IRC | 17:50 | |
| lbragstad | nice | 17:52 |
| *** edmondsw has joined #openstack-keystone | 18:01 | |
| *** vishakha has joined #openstack-keystone | 18:03 | |
| *** edmondsw has quit IRC | 18:06 | |
| gyee | kmalloc, just got back to my desk. I'll take a look. | 18:09 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Refactor trust roles check https://review.openstack.org/578509 | 18:17 |
| *** TheJulia has joined #openstack-keystone | 18:25 | |
| TheJulia | o/ curious.... are there any known issues where keystone is sporadically not responding in CI jobs? | 18:26 |
| mvenesio | Hi guys, i'm trying to configure keystone federation using the mellon auth module in REDHAT, and i'm having some issues, is there anyone that can help me with this ? | 18:31 |
| larsks | mvenesio: have you seen the docs on that topic? https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html-single/federate_with_identity_service/#add_the_rh_sso_fqdn_to_each_controller | 18:34 |
| larsks | mvenesio: fwiw, I've spent the last couple of weeks improving the state of openid federation support in tripleo. Similarly improving the experience with mellon is next on my list. | 18:35 |
| lbragstad | mvenesio: jdennis is really knowledgeable on that topic, too | 18:39 |
| lbragstad | TheJulia: do you have a link? | 18:39 |
| lbragstad | to a failure? | 18:40 |
| TheJulia | lbragstad: http://logs.openstack.org/06/575206/7/check/ipa-tempest-dsvm-wholedisk-bios-ipmi-iscsi-coreos-src/208599f/logs/screen-ir-cond.txt.gz?level=WARNING#_Jun_27_14_17_19_336000 | 18:41 |
| TheJulia | nothing in the keystone lines up time wise, it is like the request disappeared into the ether | 18:41 |
| mvenesio | larsks: yes i've saw it, but the document assumes that you're using a RH-SSO server, and we are authenticating through an Apareo CAS | 18:42 |
| TheJulia | I've seen a couple different variations like that over the last day or two | 18:42 |
| lbragstad | hmm | 18:43 |
| lbragstad | these are the only errors i'm seeing in the keystone logs http://logs.openstack.org/06/575206/7/check/ipa-tempest-dsvm-wholedisk-bios-ipmi-iscsi-coreos-src/208599f/logs/screen-keystone.txt.gz?level=ERROR | 18:43 |
| mvenesio | larsks: nevertheless, we are connecting with the CAS from horizon, but once we put the user and password then the CAS redirects to an horizon URL that fails with a bad reuest | 18:44 |
| lbragstad | which don't actually emit an error response via the API | 18:44 |
| lbragstad | they're warning specifically for operators about how they have roles setup | 18:44 |
| mvenesio | larsks: this is te error we are getting from keystone : https://pastebin.com/BKX2S4dF | 18:45 |
| mvenesio | larsks: and this is the response we are getting from CAS once we doing the authentication: https://pastebin.com/SeJKnBjV | 18:46 |
| jdennis | mvenesio: We have a very detailed knowledge base article on setting up federation with mellon, do you have access to the customer portal? If so I'll send you a link, otherwise I can point you to a preliminary version on my public page. | 18:46 |
| *** felipemonteiro_ has quit IRC | 18:46 | |
| mvenesio | jdennis: i have access please send me the link | 18:46 |
| jdennis | mvenesio: Also you should know there is currently work going on to add support for configuring federation in tripleo | 18:47 |
| mvenesio | larsks: seems like :5000/v3/OS-FEDERATION/identity_providers/CAS/protocols/mapped/auth/mellon/postResponse its not accepted by horizon and returns a BAD Request | 18:47 |
| jdennis | and work being done to support mod_auth_openidc | 18:47 |
| mvenesio | jdennis: in this case only mellon its supported regarding the REDHAT support, so if you have a link with a better explanation | 18:48 |
| mvenesio | jdennis: it will be great | 18:48 |
| *** felipemonteiro_ has joined #openstack-keystone | 18:49 | |
| jdennis | mvenesio: https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/federate_with_identity_service/ | 18:50 |
| lbragstad | TheJulia: it looks like ironic is hitting keystone around that time frame http://logs.openstack.org/06/575206/7/check/ipa-tempest-dsvm-wholedisk-bios-ipmi-iscsi-coreos-src/208599f/logs/screen-keystone.txt.gz#_Jun_27_14_02_53_466321 | 18:51 |
| lbragstad | but that also look normal? | 18:51 |
| jdennis | mvenesio: fwiw, the doc was written for customers using tripleo to deploy, if you | 18:52 |
| mvenesio | jdennis: but that guide is public, i'm configuring it manually, not with director | 18:52 |
| jdennis | 're not using tripleo you'll have to factor some of the Puppet specific information, but it should be obvious | 18:52 |
| lbragstad | TheJulia: GET /identity/v3/auth/tokens => generated 3097 bytes in 31 msecs (HTTP/1.1 200) | 18:52 |
| *** mvk has joined #openstack-keystone | 18:53 | |
| jdennis | mvenesio: if you're doing it manually the guide contains a lot of useful information | 18:53 |
| mvenesio | jdennis: yes but some other info seems missing | 18:54 |
| lbragstad | TheJulia: i can't seem to find a matching request ID from the ironic log in keystones, though... | 18:54 |
| TheJulia | lbragstad: yeah, 15 minutes before the timeout :\ | 18:54 |
| lbragstad | that's so strange... | 18:55 |
| lbragstad | req-d334e67b-79dc-4601-976c-1625fe9ecc68 doesn't appear in keystone logs either... | 18:55 |
| jdennis | mvenesio: you might also want to check out the Mellon User Guide I wrote, it's now upstream at Mellon, here is the link: https://github.com/UNINETT/mod_auth_mellon/blob/master/doc/user_guide/mellon_user_guide.adoc | 18:56 |
| jdennis | mvenesio: I accidentally nuked the last few minutes of chat in my irc client, what did you say about not enough information? | 18:57 |
| mvenesio | jdennis: We've saw that guide, but the document assumes that you're using a RH-SSO server, and we are authenticating through an Apareo CAS, and seems that some info to do a manual configuration is missing | 18:59 |
| mvenesio | jdennis: horizon have to be using SSL to be integrated ? is that a mandatory requirement ? | 19:01 |
| jdennis | mvenesio: right, in theory SAML is a standard protocol things ought to be pretty close no matter which IdP you use, of course the process of adding an SP to your IdP will be IdP dependent, can't help you with an IdP I'm not familiar with | 19:01 |
| mvenesio | jdennis: horizon have to be using SSL to be integrated ? is that a mandatory requirement ? | 19:02 |
| TheJulia | lbragstad: I'm wodnering if something transient is going on, the dstat cpu utilization numebers don't make sense | 19:03 |
| jdennis | mvenesio: only if you care about security :-) I can't remember which components enforce the use of SSL/TLS so I'm not sure if something will error out if you don't use TLS, but it would be a really really bad idea not to use TLS | 19:05 |
| mvenesio | jdennis: yes i know we are just in a lab | 19:06 |
| lbragstad | TheJulia: hmm | 19:07 |
| jdennis | mvenesio: I'm pretty sure the SAML spec says you have to use some form of transport layer security, otherwise your assertions and identity data are in the open | 19:07 |
| lbragstad | TheJulia: like - the host is maxed out? | 19:07 |
| TheJulia | lbragstad: my gut feeling is heavily throttled from the hypervisor | 19:07 |
| lbragstad | huh - i wonder what's caused that recently... | 19:08 |
| TheJulia | I've only looked at one dstat log, but it just seems really weird around the timeout failure | 19:08 |
| TheJulia | and I've seen similar things when hypervisors are super busy | 19:09 |
| mvenesio | jdennis: understood, i think our issue now is that the AssertionConsumerServiceURL seems to be wrong and we don't know very well which to use | 19:09 |
| jdennis | mvenesio: the Mellon User Guide covers that in a fair amount of detail, make sure your SP metadata is correct and loaded into the IdP, also see the troubleshooting sections of the User Guide | 19:11 |
| mvenesio | jdennis: i'll do thanks | 19:12 |
| kmalloc | TheJulia, lbragstad: there have been a LOT of timeouts in py* tests as well | 19:17 |
| kmalloc | at least in kyestone, like 40-50m runtimes which seems like busy hypervisors | 19:17 |
| kmalloc | it wouldn't surprise me to see stuff like that outside of py* testing | 19:17 |
| lbragstad | things have felt pretty slow lately wrt to the check and gate queues | 19:18 |
| kmalloc | yeah. | 19:19 |
| kmalloc | and the test runtimes tend to be "ok" when they don't timeout | 19:19 |
| lbragstad | not sure if those things are related, but it is suspicious | 19:19 |
| kmalloc | the timeouts i've seen could be related to what TheJulia is seeing, just not a test-run timeout (whole job) but one test is hit particularly hard. | 19:20 |
| lbragstad | kmalloc: do we have any documentation outside of https://docs.openstack.org/keystone/latest/advanced-topics/external-auth.html for using bind? | 19:21 |
| TheJulia | kmalloc: interesting... | 19:21 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add __all__ for keystone modules https://review.openstack.org/578536 | 19:22 |
| kmalloc | lbragstad: ^ i can debug/run tests in pycharm with that change :) | 19:22 |
| kmalloc | [yay!] | 19:22 |
| TheJulia | kmalloc: Also interesting is that I've not seen any change in the amount of time the ironic unit tests take | 19:24 |
| kmalloc | It is clearly VM based, since it is intermittent. The whole VM slows down. | 19:25 |
| TheJulia | yeah | 19:26 |
| *** jmlowe has quit IRC | 19:42 | |
| larsks | knikolla: https://bugs.launchpad.net/keystone/+bug/1778989 | 19:43 |
| openstack | Launchpad bug 1778989 in OpenStack Identity (keystone) "Keystone client is unable to correctly look up names of federated users" [Undecided,New] | 19:43 |
| knikolla | larsks: cool, can you paste the debug logs showing the /v3/users?domain=<domain>&name=<name> failing for a federated user | 19:45 |
| larsks | knikolla: the whole thing, or just the final request? | 19:45 |
| knikolla | just the final request | 19:46 |
| knikolla | i'll work later today on a unit test to expose it and then work on a fix | 19:46 |
| larsks | knikolla: posted. | 19:48 |
| knikolla | larsks: awesome, thanks! | 19:48 |
| *** edmondsw has joined #openstack-keystone | 19:50 | |
| kmalloc | TheJulia: when everyting is happy, we clearly do not have any real increase in test runtime (actually the opposite, our tests are trending faster since we're doing less "standup" for each run as I move us closer to flask) | 19:52 |
| *** edmondsw has quit IRC | 19:54 | |
| TheJulia | kmalloc: by chance, has a happier time of the day been identified? | 19:55 |
| *** ayoung has joined #openstack-keystone | 19:59 | |
| ayoung | knikolla, about https://bugs.launchpad.net/keystone/+bug/1778989 (Federated user show) can you reproduce? | 20:00 |
| openstack | Launchpad bug 1778989 in OpenStack Identity (keystone) "Keystone client is unable to correctly look up names of federated users" [Medium,Confirmed] | 20:00 |
| knikolla | ayoung: yes | 20:00 |
| knikolla | i was with larsks when we found it | 20:01 |
| ayoung | knikolla, you know how to debug using rpdb? | 20:01 |
| ayoung | I'd like to figure out where things are breaking down. | 20:01 |
| ayoung | I suspect it is somewhere between the user and the shadow user abstractions | 20:01 |
| *** AlexeyAbashkin has joined #openstack-keystone | 20:02 | |
| knikolla | i suspects in how we translate it into a sql query | 20:02 |
| ayoung | ah | 20:03 |
| knikolla | as searching by name in a domain does work for sql users and ldap users | 20:03 |
| knikolla | but doesn't for federated users | 20:03 |
| knikolla | and the name of a federated user is is federated_user table under display_name | 20:03 |
| knikolla | in* | 20:04 |
| kmalloc | TheJulia: not that i've seen, well late late at night it tends to be "better" | 20:04 |
| TheJulia | That is my feeling as well. *sigh* | 20:04 |
| kmalloc | ayoung: if you have bandwidth to review RBACEnforcer, it would be appreciated. you are on the short list of folks who understand policy at all | 20:04 |
| ayoung | kmalloc, link, please? | 20:05 |
| kmalloc | s/at all/in depth/ | 20:05 |
| kmalloc | https://review.openstack.org/#/c/576639/ | 20:05 |
| kmalloc | ayoung: it is flask-only APIs, but it allows us to just do "enforcer.call_enforce(<args>)" | 20:05 |
| kmalloc | rather than trying to make @protected bend to our will | 20:05 |
| kmalloc | call_enforce has a fairly rich interface | 20:06 |
| kmalloc | and the following patch form that one has some assurances that an API can't be developed without calling enforcer.call_enforce at some point | 20:06 |
| larsks | knikolla: it's here, right? https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql.py#L191 | 20:06 |
| kmalloc | ayoung: https://review.openstack.org/#/c/578189/4 [the following one] | 20:06 |
| larsks | Where we never even join in the federated_users table... | 20:06 |
| ayoung | larsks, that is a pretty simple query, so I am guessing we've already messed it up by that point | 20:07 |
| knikolla | larsks: yup, looks like it. | 20:07 |
| ayoung | I think the Federated users don't go in that table | 20:07 |
| larsks | ayoung: that was my point. | 20:07 |
| larsks | There is a seperate table for federated users, and it's not part of that query. | 20:08 |
| kmalloc | correct | 20:08 |
| ayoung | larsks, and now you reopen all my old wounds | 20:08 |
| ayoung | I want the ability to pre-populate users from Federated sources for reasons just like this | 20:08 |
| kmalloc | ayoung: this is the whole "shadow table has not been fully implemented" | 20:08 |
| kmalloc | ayoung: knikolla is working on real federated testing, it's so delayed, but its on the not-far-off work | 20:09 |
| ayoung | OK...so how *should* this work? | 20:09 |
| ayoung | TOday, not in my dream world | 20:09 |
| kmalloc | i can't answer the "today question" right now, knikolla probably can. | 20:09 |
| ayoung | once a user has authenticated via Fed, and been mapped in, we get an entry in the shadow table | 20:09 |
| kmalloc | my brain is off in another land and pivoting is probably not going to work. | 20:10 |
| ayoung | do they have a username? | 20:10 |
| ayoung | kmalloc, ok, step out, I'll take this | 20:10 |
| kmalloc | thanks! | 20:10 |
| ayoung | since I stated the convo. | 20:10 |
| knikolla | ayoung: i want to do so much but i'm burning cycles helping people and training interns who never really amount to any help | 20:10 |
| ayoung | but I will review your RBAC stuff, it looks OK so far | 20:10 |
| kmalloc | summon me if you really need my brain, i'll work to context switch then | 20:10 |
| ayoung | do Federated users have usernames? | 20:11 |
| *** blake has joined #openstack-keystone | 20:11 | |
| lbragstad | ayoung: quick question before you leave, do we have any documentation on using bind with keystone outside of https://docs.openstack.org/keystone/latest/advanced-topics/external-auth.html ? | 20:11 |
| knikolla | ayoung: display names | 20:11 |
| larsks | ayoung: they have a display_name in the federated_user table. | 20:11 |
| ayoung | guarenteed? | 20:12 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/identity/shadow_backends/sql.py#L32 | 20:12 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/identity/shadow_backends/sql.py#L143 | 20:13 |
| larsks | ayoung: I don't think that matters, right? If they *have* a display_name, it's what we're showing e.g. the user list, we used it as the name attribute in https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql_model.py#L72, and it should work for queries. | 20:13 |
| ayoung | new_nonlocal_user_dict = { | 20:13 |
| ayoung | 'name': user_dict['name'] | 20:13 |
| ayoung | } | 20:13 |
| ayoung | a Federated user gets a nonlocal_user entry based on the user_dict | 20:14 |
| ayoung | right? | 20:14 |
| * ayoung wanted to use the same table as LDAP...grrrr | 20:14 | |
| * ayoung back to "Keystone sux burn it to the ground" mode again | 20:15 | |
| knikolla | lol | 20:15 |
| ayoung | OK...so hack to solve this would be: if nothing in the user table, fall back to shadow table. Convince me why that is bad. | 20:16 |
| ayoung | what if...we looks at the domain_id and switch which query to do based on that? Is there someway to know that it is a "Federated" domain? | 20:17 |
| knikolla | no | 20:17 |
| knikolla | even if an idp is assigned that domain, i don't think there is restriction on what it can have | 20:18 |
| ayoung | we could put a "Federated" flag on it then | 20:20 |
| ayoung | https://www.google.com/imgres?imgurl=https://upload.wikimedia.org/wikipedia/commons/thumb/e/e4/Flag_of_the_Federated_States_of_Micronesia.svg/2000px-Flag_of_the_Federated_States_of_Micronesia.svg.png&imgrefurl=https://en.wikipedia.org/wiki/Flag_of_the_Federated_States_of_Micronesia&h=1053&w=2000&tbnid=ewFNDXLcpDLh4M:&q=Federated+Flag&tbnh=160&tbnw=304&usg=__4xkg6Uu_GJSsOVIwsxFqU3GOh3s%3D&vet=10ahUKEwjl7vO-1fTbAhUSvlMKHTz | 20:20 |
| ayoung | IBqwQ9QEILTAA..i&docid=dy1Hgl4juJ7XEM&client=firefox-b-ab&sa=X&ved=0ahUKEwjl7vO-1fTbAhUSvlMKHTzIBqwQ9QEILTAA | 20:20 |
| ayoung | https://upload.wikimedia.org/wikipedia/commons/thumb/e/e4/Flag_of_the_Federated_States_of_Micronesia.svg/2000px-Flag_of_the_Federated_States_of_Micronesia.svg.png | 20:20 |
| ayoung | If a domain is a Federated domain, don't allow local users, only look in the shadow puppet table | 20:21 |
| knikolla | that seems like a breaking change | 20:22 |
| ayoung | Yeah, so what | 20:22 |
| ayoung | see previous veiws on the matter | 20:22 |
| knikolla | what's wrong with joining the local user table with the federated user table in user list for sql? | 20:22 |
| ayoung | well, that is also a breaking change | 20:22 |
| ayoung | break break breaky break break | 20:23 |
| ayoung | unless it stops things | 20:23 |
| knikolla | yes, but but doesn't break existing deployments who have local users in a federated domain | 20:23 |
| ayoung | then it is a braking change | 20:23 |
| ayoung | is that a likelihood? | 20:23 |
| ayoung | what is the default with Federation? We were putting them in the "Federated" domain at one point | 20:24 |
| knikolla | when u create an idp you have to specify a domain | 20:24 |
| knikolla | if u don't, a new domain is created | 20:24 |
| knikolla | for each idp | 20:24 |
| knikolla | and apparently `openstack identity provider create test --domain default` works | 20:25 |
| *** jmlowe has joined #openstack-keystone | 20:29 | |
| *** AlexeyAbashkin has quit IRC | 20:45 | |
| ayoung | knikolla, sorry, had to run and pick up kids...summer time camp pickups are earlier | 20:54 |
| ayoung | just got back....so do we have a way to link the idp to the domain after it is created, or just via the mapping table? | 20:55 |
| *** spilla has quit IRC | 20:57 | |
| knikolla | ayoung: all users from an idp go to the domain of that idp | 20:58 |
| knikolla | specified on idp creation | 20:58 |
| knikolla | there's nothing enforcing anything that that domain is exclusive, and can be shared, or can even be the default domain | 20:59 |
| knikolla | given that the domain driver will still be sql, i feel that making the identity driver for sql also query the federated_user table makes sense. | 20:59 |
| *** AlexeyAbashkin has joined #openstack-keystone | 21:01 | |
| *** AlexeyAbashkin has quit IRC | 21:12 | |
| *** martinus__ has quit IRC | 21:13 | |
| *** mvenesio has quit IRC | 21:18 | |
| *** mvenesio has joined #openstack-keystone | 21:19 | |
| ayoung | kmalloc, RBAC looks fine. Pretty straight port from the old code, plus some decent new testing. Minor nits in comments, fix those and I'll +2 | 21:23 |
| *** mvenesio has quit IRC | 21:24 | |
| * lbragstad hands ayoung some popcorn | 21:26 | |
| lbragstad | wait for it... | 21:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove token bind capabilities https://review.openstack.org/577524 | 21:38 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Introduce new TokenModel object https://review.openstack.org/559129 | 21:38 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add serialization for TokenModel object https://review.openstack.org/578434 | 21:38 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Simplify the token provider API https://review.openstack.org/545450 | 21:38 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove remnants of token bind https://review.openstack.org/578435 | 21:38 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Cleanup keystone.token.providers.common https://review.openstack.org/577507 | 21:38 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove KeystoneToken object https://review.openstack.org/577567 | 21:38 |
| *** felipemonteiro_ has quit IRC | 21:38 | |
| *** edmondsw has joined #openstack-keystone | 21:38 | |
| *** edmondsw has quit IRC | 21:43 | |
| *** tonytan4ever_brb has joined #openstack-keystone | 21:45 | |
| *** tonytan4ever has quit IRC | 21:45 | |
| *** itlinux has quit IRC | 21:50 | |
| *** rcernin has joined #openstack-keystone | 21:50 | |
| *** jmlowe has quit IRC | 21:56 | |
| *** blake has quit IRC | 22:18 | |
| *** jmlowe has joined #openstack-keystone | 22:28 | |
| *** nicolasbock has quit IRC | 22:29 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Implement base for new RBAC Enforcer https://review.openstack.org/576639 | 22:38 |
| kmalloc | ayoung: fixed | 22:44 |
| *** blake has joined #openstack-keystone | 22:44 | |
| *** blake has quit IRC | 22:45 | |
| *** tonytan4ever_brb has quit IRC | 23:14 | |
| *** tonytan4ever has joined #openstack-keystone | 23:14 | |
| *** edmondsw has joined #openstack-keystone | 23:27 | |
| *** edmondsw has quit IRC | 23:32 | |
| *** tosky has quit IRC | 23:35 | |
| *** alex_xu has quit IRC | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!
