| *** joshualyle has joined #openstack-keystone | 00:06 | |
| *** mvkr has quit IRC | 00:41 | |
| *** mvkr has joined #openstack-keystone | 01:06 | |
| *** gyee has quit IRC | 01:10 | |
| *** lbragstad_ has joined #openstack-keystone | 01:34 | |
| *** lbragstad has quit IRC | 01:36 | |
| *** tkajinam has quit IRC | 01:49 | |
| *** tkajinam has joined #openstack-keystone | 01:50 | |
| *** openstackgerrit has joined #openstack-keystone | 01:58 | |
| openstackgerrit | Merged openstack/keystone master: Ignore SQLAlchemy RemovedIn20Warning https://review.opendev.org/711084 | 01:58 |
|---|---|---|
| *** spatel has joined #openstack-keystone | 03:04 | |
| *** lbragstad_ has quit IRC | 03:09 | |
| *** joshualyle has quit IRC | 03:34 | |
| *** cp- has quit IRC | 04:01 | |
| *** cp- has joined #openstack-keystone | 04:03 | |
| *** spatel has quit IRC | 04:05 | |
| *** cp- has quit IRC | 04:06 | |
| *** spatel has joined #openstack-keystone | 04:06 | |
| *** cp- has joined #openstack-keystone | 04:07 | |
| *** cp- has quit IRC | 04:07 | |
| *** cp- has joined #openstack-keystone | 04:08 | |
| *** cwright_ has quit IRC | 05:26 | |
| *** cwright has joined #openstack-keystone | 05:26 | |
| *** evrardjp has quit IRC | 05:35 | |
| *** evrardjp has joined #openstack-keystone | 05:35 | |
| *** spatel has quit IRC | 06:07 | |
| *** joshualyle has joined #openstack-keystone | 06:35 | |
| *** threestrands has quit IRC | 06:48 | |
| *** abdysn has joined #openstack-keystone | 07:10 | |
| *** abdysn has quit IRC | 07:50 | |
| *** abdysn has joined #openstack-keystone | 07:51 | |
| *** tesseract has joined #openstack-keystone | 07:52 | |
| *** dancn has joined #openstack-keystone | 08:10 | |
| *** tkajinam has quit IRC | 08:16 | |
| *** joshualyle has quit IRC | 08:35 | |
| *** gagehugo has quit IRC | 09:07 | |
| *** irclogbot_2 has quit IRC | 09:08 | |
| *** gagehugo has joined #openstack-keystone | 09:43 | |
| *** irclogbot_2 has joined #openstack-keystone | 09:43 | |
| *** openstackstatus has quit IRC | 09:45 | |
| *** gshippey has joined #openstack-keystone | 10:24 | |
| *** spatel has joined #openstack-keystone | 10:28 | |
| *** spatel has quit IRC | 10:33 | |
| *** tesseract-RH has joined #openstack-keystone | 11:40 | |
| *** tesseract has quit IRC | 11:43 | |
| *** joshualyle has joined #openstack-keystone | 11:56 | |
| *** raildo has joined #openstack-keystone | 12:08 | |
| *** kplant has joined #openstack-keystone | 12:21 | |
| *** joshualyle has quit IRC | 13:04 | |
| *** dave-mccowan has joined #openstack-keystone | 13:10 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:20 | |
| *** takamatsu has joined #openstack-keystone | 13:22 | |
| *** jamesmcarthur has quit IRC | 13:38 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:40 | |
| *** jamesmcarthur has quit IRC | 13:45 | |
| *** jamesmcarthur has joined #openstack-keystone | 14:09 | |
| *** lbragstad has joined #openstack-keystone | 14:13 | |
| *** jamesmcarthur has quit IRC | 14:15 | |
| *** spatel has joined #openstack-keystone | 14:21 | |
| *** spatel has quit IRC | 14:26 | |
| *** jamesmcarthur has joined #openstack-keystone | 14:35 | |
| *** jamesmcarthur has quit IRC | 14:41 | |
| *** jamesmcarthur has joined #openstack-keystone | 14:42 | |
| *** spatel has joined #openstack-keystone | 14:54 | |
| *** abdysn has quit IRC | 14:57 | |
| *** jamesmcarthur has quit IRC | 14:58 | |
| *** jamesmcarthur has joined #openstack-keystone | 14:58 | |
| *** dancn has quit IRC | 15:09 | |
| *** jaosorior has quit IRC | 15:20 | |
| *** jamesmcarthur has quit IRC | 15:23 | |
| *** jamesmcarthur has joined #openstack-keystone | 15:27 | |
| *** jamesmcarthur has quit IRC | 15:36 | |
| knikolla | kplant: not sure if it helps, but this is why it needs to be authtype auth-openidc | 15:39 |
| knikolla | https://github.com/zmartzone/mod_auth_openidc/wiki/Single-Page-Applications#allowing-both-oauth-20-and-openid-connect | 15:39 |
| knikolla | you can't do openid connect over the CLI/API, so it need to fall back to oauth 2.0 | 15:39 |
| knikolla | hence you need to allow oauth 2.0 over that endpoint | 15:40 |
| knikolla | either via authtype oauth20, or auth-openidc | 15:40 |
| *** jamesmcarthur has joined #openstack-keystone | 15:45 | |
| *** jamesmcarthur has quit IRC | 15:45 | |
| *** jamesmcarthur has joined #openstack-keystone | 15:45 | |
| kplant | knikolla: that makes sense to me since openid-connect expects a full blown browser | 15:50 |
| kplant | i'm just at the point now where oauth20 comes back as 401 and auth-openidc returns a 500 | 15:51 |
| *** spatel has quit IRC | 15:52 | |
| *** spatel has joined #openstack-keystone | 15:54 | |
| *** spatel has quit IRC | 15:59 | |
| *** gyee has joined #openstack-keystone | 16:18 | |
| *** rcernin has quit IRC | 16:55 | |
| *** tesseract-RH has quit IRC | 17:01 | |
| *** dancn has joined #openstack-keystone | 17:17 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 17:21 | |
| *** jamesmcarthur has quit IRC | 17:24 | |
| *** evrardjp has quit IRC | 17:35 | |
| *** evrardjp has joined #openstack-keystone | 17:35 | |
| *** jamesmcarthur_ has quit IRC | 18:10 | |
| knikolla | kplant: can i see your apache config? | 18:28 |
| kplant | sure, one second | 18:29 |
| kplant | knikolla: http://paste.openstack.org/show/790355/ | 18:31 |
| kplant | i'm running keystone in a kolla container, it's using wsgi | 18:31 |
| knikolla | kplant: if it helps, this is what we're currently running | 18:35 |
| knikolla | https://github.com/CCI-MOC/rhosp-director-config/blob/5078e4b17a5a3077ca8cacf5bd39ff1a1075d0fb/playbooks/roles/deploy-config/templates/controller_extraconfig.j2.yaml#L35-L74 | 18:35 |
| knikolla | are you depending on some claims on the mapping that may not be present in an oauth access token? | 18:38 |
| kplant | oooo | 18:39 |
| kplant | let me check my mapping real fast | 18:39 |
| kplant | and yes that config definitely helps as ooo uses the same kolla container for keystone | 18:39 |
| kplant | *same-ish | 18:39 |
| kplant | yeah i'm grabbing OIDC-preferred_username, OIDC-email and OIDC-groups | 18:40 |
| kplant | so what i do is map a keycloak role, which shows in the OIDC-groups list, to a group in keystone | 18:40 |
| kplant | would the OIDC-* information not be present in an oauth token? | 18:41 |
| knikolla | kplant: we're only using OIDC-preferred_username, and that seems to work fine | 18:53 |
| knikolla | but according to https://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/oidc-improved-support.html | 18:53 |
| knikolla | group membership may not be there. | 18:53 |
| kplant | makes sense since i had to also add jwt to the scope | 18:54 |
| knikolla | i haven't tested it myself. i suggest you fetch a token and hit the introspection endpoint manually and see what comes out. | 18:54 |
| kplant | well maybe what i'm doing is stupid, the reason i'm importing groups (keycloak roles) is to be able to define what projects a user belongs to in keycloak | 18:55 |
| kplant | is there a better way to do that? | 18:55 |
| *** gshippey has quit IRC | 18:55 | |
| knikolla | kplant: i guess it depends on your use case and requirements. groups work well in the browser, but you can't create things like application_credentials for now. | 18:56 |
| kplant | yeah i noticed that, johnthetubaguy recommended application_credentials and they seem fantastic | 18:56 |
| kplant | but since i'm using groups they don't work for me, as you said | 18:57 |
| knikolla | in our case, we store the project membership in keystone, and only use keycloak for authentication. so we have different requirements. | 18:57 |
| knikolla | i'm working on enabling application_credentials support for groups that a user is mapped to, but that will be in the next release, ussuri. | 18:59 |
| kplant | i might need to do the same, that would totally explain the 401s with the oauth endpoint | 18:59 |
| knikolla | until then you might have to store the assignments into keystone. | 18:59 |
| kplant | yeah, just stinks since we have more than one keystone | 19:00 |
| kplant | was hoping to federate those relatonships as well | 19:00 |
| *** dancn has quit IRC | 19:03 | |
| *** jaosorior has joined #openstack-keystone | 19:08 | |
| kplant | knikolla: thanks a lot for your help these last few days. i'm going to play around with the mapping | 19:10 |
| kplant | i think you're right, that makes too much sense | 19:10 |
| knikolla | kplant: np :) | 19:10 |
| kplant | thanks for your config as well - i'm totally going to rip that off | 19:11 |
| *** stingrayza has quit IRC | 20:18 | |
| *** stingrayza has joined #openstack-keystone | 20:19 | |
| kplant | knikolla: stupid question, how did you add users from the keycloak idp into keystone projects? my keycloak users appear to be imported into a different domain | 20:22 |
| knikolla | kplant: not a stupid question at all. i use adjutant to have users apply for projects and manage users in them. | 20:23 |
| kplant | this looks excellent | 20:24 |
| kplant | thank you! | 20:24 |
| kplant | but my question was a little different, i think | 20:25 |
| kplant | i have a "Default" domain | 20:25 |
| kplant | and the keycloak users appear to be federated in another domain | 20:25 |
| knikolla | kplant: domain doesn't really matter. you can have people assigned to roles on projects in a different domain. | 20:25 |
| kplant | that's what i thought, the dashboard doesn't seem to happy with that. unless i just need to enable multi-domain in local_settings | 20:25 |
| kplant | too* | 20:26 |
| knikolla | yeah, horizon is a bit weird with that. | 20:26 |
| knikolla | give multi-domain a shot | 20:27 |
| kplant | i'm still getting 401s but i'm not actually believing the user was added | 20:27 |
| kplant | i'm going to remove the keycloak role and see if the dashboard still works | 20:27 |
| knikolla | does the user appear via command-line? | 20:27 |
| knikolla | i don't think they'll show up in horizon when you list users | 20:27 |
| kplant | yeah that's the behavior i see as well | 20:28 |
| kplant | yes to cli, no to dashboard | 20:28 |
| knikolla | what release are you running? | 20:28 |
| kplant | train | 20:28 |
| knikolla | can't help you there. most of the management we do is from CLI, so that hasn't impacted us much. | 20:29 |
| knikolla | would have thought this to be fixed in horizon by now, but /shrug | 20:30 |
| kplant | i don't mind the dashboard being incomplete in this instance - just thought it may have represented the user not actually being added | 20:30 |
| kplant | but it's definitely there, dashboard login for the user still works... but getting 401s on the cli | 20:30 |
| *** vishalmanchanda has quit IRC | 20:31 | |
| kplant | was there any configuration you needed to do on the keycloak side? | 20:33 |
| *** trident has quit IRC | 20:37 | |
| knikolla | just the standard new client fare | 20:38 |
| kplant | found something interesting | 20:41 |
| kplant | oidc_cache_shm_set: could not store value since key size is too large | 20:41 |
| kplant | and: -4005-91fc-9f6dcee242ac - - - - -] Could not map any federated user properties to identity values. Check debug logs or the mapping used for additional details.: AuthMethodNotSupported: Attempted to authenticate with an unsupported method. | 20:42 |
| kplant | getting closer, i think | 20:42 |
| kplant | i'll play with this more tomorrow | 20:45 |
| kplant | knikolla: thanks again for all your help | 20:45 |
| *** trident has joined #openstack-keystone | 20:47 | |
| *** kplant has quit IRC | 20:49 | |
| *** rcernin has joined #openstack-keystone | 20:53 | |
| *** jamesmcarthur has joined #openstack-keystone | 20:59 | |
| *** xek_ has quit IRC | 21:07 | |
| *** jamesmcarthur has quit IRC | 21:16 | |
| *** jamesmcarthur has joined #openstack-keystone | 21:18 | |
| *** rcernin has quit IRC | 21:18 | |
| *** stingrayza has quit IRC | 21:31 | |
| *** stingrayza has joined #openstack-keystone | 21:31 | |
| *** raildo has quit IRC | 21:47 | |
| *** tkajinam has joined #openstack-keystone | 22:45 | |
| *** jamesmcarthur has quit IRC | 23:14 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:20 | |
| *** spatel has joined #openstack-keystone | 23:30 | |
| *** jamesmcarthur has quit IRC | 23:32 | |
| *** vishalmanchanda has joined #openstack-keystone | 23:34 | |
| *** spatel has quit IRC | 23:35 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!