| *** ryanpetrello has quit IRC | 00:13 | |
| *** woodster_ has quit IRC | 01:30 | |
| *** woodster_ has joined #openstack-barbican | 01:44 | |
| *** ryanpetrello has joined #openstack-barbican | 02:17 | |
| *** kebray has joined #openstack-barbican | 02:32 | |
| *** kebray has quit IRC | 02:41 | |
| *** ryanpetrello has quit IRC | 04:28 | |
| *** gnuoy has quit IRC | 05:00 | |
| *** usimha has joined #openstack-barbican | 05:43 | |
| *** usimha has quit IRC | 06:56 | |
| *** jamielennox is now known as jamielennox|away | 06:59 | |
| *** usimha has joined #openstack-barbican | 07:14 | |
| *** woodster_ has quit IRC | 09:00 | |
| *** openstackgerrit has quit IRC | 09:50 | |
| *** openstackgerrit has joined #openstack-barbican | 09:50 | |
| *** nkinder has quit IRC | 10:21 | |
| *** usimha has quit IRC | 11:40 | |
| *** usimha has joined #openstack-barbican | 11:40 | |
| *** ryanpetrello has joined #openstack-barbican | 12:40 | |
| *** ayoung has joined #openstack-barbican | 12:59 | |
| *** woodster_ has joined #openstack-barbican | 13:28 | |
| *** usimha has quit IRC | 13:38 | |
| *** usimha has joined #openstack-barbican | 13:47 | |
| *** jaosorior has joined #openstack-barbican | 14:12 | |
| *** alee has joined #openstack-barbican | 14:27 | |
| *** ametts has joined #openstack-barbican | 14:38 | |
| *** dave-mccowan has joined #openstack-barbican | 14:49 | |
| *** SheenaG1 has joined #openstack-barbican | 14:57 | |
| *** ryanpetrello has quit IRC | 15:02 | |
| openstackgerrit | Thomas Dinkjian proposed openstack/barbican: Added smoke tests for consumers https://review.openstack.org/136859 | 15:12 |
|---|---|---|
| *** ryanpetrello has joined #openstack-barbican | 15:15 | |
| openstackgerrit | Thomas Dinkjian proposed openstack/barbican: Add functional tests for order https://review.openstack.org/136155 | 15:24 |
| *** kgriffs|afk is now known as kgriffs | 15:36 | |
| *** woodster_ has quit IRC | 15:40 | |
| *** zz_dimtruck is now known as dimtruck | 15:41 | |
| *** jorge_munoz has joined #openstack-barbican | 15:45 | |
| *** rtom has joined #openstack-barbican | 15:51 | |
| *** paul_glass has joined #openstack-barbican | 15:51 | |
| *** JeffF has joined #openstack-barbican | 15:57 | |
| redrobot | usimha hi, did you ever get your questions answered? | 15:57 |
| *** atiwari has joined #openstack-barbican | 16:01 | |
| usimha | redrobot: Yes, it did :) | 16:25 |
| reaperhulk | dstufft you awake? standup time | 16:33 |
| *** usimha has quit IRC | 16:35 | |
| *** usimha has joined #openstack-barbican | 16:35 | |
| *** ryanpetrello_ has joined #openstack-barbican | 16:41 | |
| *** woodster_ has joined #openstack-barbican | 16:42 | |
| *** ryanpetrello has quit IRC | 16:43 | |
| *** ryanpetrello_ is now known as ryanpetrello | 16:43 | |
| *** atiwari has quit IRC | 16:43 | |
| openstackgerrit | Merged openstack/barbican-specs: Add Version Responses Consistent with Openstack https://review.openstack.org/125805 | 16:50 |
| *** bubbva has joined #openstack-barbican | 17:35 | |
| *** codekobe_ is now known as codekobe | 17:41 | |
| *** jaosorior has quit IRC | 17:53 | |
| *** dave-mccowan has quit IRC | 17:58 | |
| *** rellerreller has joined #openstack-barbican | 18:14 | |
| *** gyee_ has joined #openstack-barbican | 18:17 | |
| *** bdpayne has joined #openstack-barbican | 18:18 | |
| *** tkelsey has joined #openstack-barbican | 18:25 | |
| *** dave-mccowan has joined #openstack-barbican | 18:27 | |
| *** gyee_ has quit IRC | 18:39 | |
| *** paul_glass has quit IRC | 18:42 | |
| *** gyee_ has joined #openstack-barbican | 18:42 | |
| *** tkelsey has quit IRC | 18:45 | |
| *** tkelsey has joined #openstack-barbican | 18:55 | |
| *** tkelsey has quit IRC | 19:00 | |
| *** kebray has joined #openstack-barbican | 19:09 | |
| *** paul_glass has joined #openstack-barbican | 19:11 | |
| *** tkelsey has joined #openstack-barbican | 19:15 | |
| *** atiwari has joined #openstack-barbican | 19:17 | |
| *** atiwari has quit IRC | 19:18 | |
| *** SheenaG1 has quit IRC | 19:21 | |
| *** rtom has quit IRC | 19:30 | |
| *** atiwari has joined #openstack-barbican | 19:36 | |
| *** SheenaG1 has joined #openstack-barbican | 19:48 | |
| *** SheenaG1 has quit IRC | 19:54 | |
| redrobot | Weekly meeting starts in 5 minutes on #openstack-meeting-alt | 19:55 |
| *** SheenaG1 has joined #openstack-barbican | 19:57 | |
| *** jaosorior has joined #openstack-barbican | 19:59 | |
| jaosorior | is the meeting now or in an hour? | 19:59 |
| redrobot | jaosorior now | 19:59 |
| jaosorior | thanks | 20:00 |
| redrobot | jaosorior I can send you an Outlook invite with the UTC time if it'll help :) | 20:00 |
| *** rtom has joined #openstack-barbican | 20:02 | |
| *** hyakuhei has joined #openstack-barbican | 20:03 | |
| *** darrenmoffat has quit IRC | 20:08 | |
| *** kebray has quit IRC | 20:09 | |
| *** darrenmoffat has joined #openstack-barbican | 20:09 | |
| *** kebray has joined #openstack-barbican | 20:09 | |
| *** SheenaG1 has quit IRC | 20:31 | |
| *** SheenaG1 has joined #openstack-barbican | 20:32 | |
| *** SheenaG11 has joined #openstack-barbican | 20:34 | |
| *** kebray has quit IRC | 20:35 | |
| openstackgerrit | Thomas Dinkjian proposed openstack/barbican: Add functional tests for order https://review.openstack.org/136155 | 20:36 |
| *** SheenaG1 has quit IRC | 20:36 | |
| *** usimha has quit IRC | 20:37 | |
| hyakuhei | alee, reaperhulk - you guys around? | 20:53 |
| *** kaitlin-farr has joined #openstack-barbican | 20:53 | |
| alee | hyakuhei, yup | 20:53 |
| hyakuhei | Wanted to borrow some of your smarts for a minute | 20:53 |
| hyakuhei | It's anchor related, can I discuss that here or should we bounce to #openstack-security ? | 20:54 |
| hyakuhei | Actually, it's kinda relevant to Barbican too, regarding certificate orders | 20:54 |
| rm_work | oo | 20:54 |
| hyakuhei | We built anchor so that X.509v3 extensions come through in the CSR | 20:55 |
| hyakuhei | rather than say, out of bound | 20:55 |
| hyakuhei | which is what spawned our requirement to patch m2crypto | 20:55 |
| hyakuhei | I know that _most_ other PKI systems don't do this. You provide the basic CSR and either ask for a specific 'profile' or provide extensions separately in the request (as with ADCS) | 20:56 |
| reaperhulk | I'm here | 20:56 |
| hyakuhei | I'm not sure which mode of operation we should support for this in Anchor moving forward. I like have everything in the CSR but I can see advantages in going the other way | 20:56 |
| hyakuhei | If for no other reason that various certificate requesting *things* might be more likely to support that | 20:57 |
| jaosorior | redrobot: sure | 20:57 |
| hyakuhei | Hey reaperhulk: Basically, we _can_ put v3 extensions in CSR but should we? | 20:57 |
| reaperhulk | If you're capable of trusting the CSR not to have something malicious (or you whitelist the set of acceptable extensions) that's an acceptable model IMO | 20:57 |
| hyakuhei | It's where we've gone thus far | 20:58 |
| reaperhulk | Historically the reason CAs stopped accepting extensions in the CSR was they got caught with their pants down blindly copying basicConstraints=CA:TRUE | 20:58 |
| hyakuhei | Yeah an extension whitelist makes sense | 20:58 |
| hyakuhei | We have some explicit rules to check things | 20:58 |
| hyakuhei | We should be able to do per-group/domain rules too | 20:58 |
| *** atiwari has quit IRC | 20:59 | |
| hyakuhei | Not sure if certificate orders would be affected by this, have you discussed how extensions will be handled? | 20:59 |
| reaperhulk | I guess the question after that is, does the added flexibility of "per CSR extensions" really buy you much? Could you just define a set of profiles and just apply the rules against those? If so you simplify your code paths at the cost of needing some small structure to the request | 20:59 |
| hyakuhei | In our system it's useful because the client doesn't really have a 'conversation' with the CA | 21:00 |
| hyakuhei | ie to query whats available etc | 21:00 |
| hyakuhei | So we like just firing a CSR at it | 21:00 |
| alee | hyakuhei, I had put together a proposed BP for the interface .. https://review.openstack.org/#/c/135490/ | 21:01 |
| hyakuhei | I suppose more widely, Barbican is kinda bound by what CA's are doing and needs to take the extensions in metadata | 21:01 |
| reaperhulk | hyakuhei: I don't believe we've discussed handling extensions explicitly, but in barbican you'd select your CA so that plugin could do whatever it wants to do :) | 21:01 |
| alee | hyakuhei, and was thinking that the extensions would be in the csr. | 21:02 |
| reaperhulk | hyakuhei: Yes, although the actual APIs for that are under active discussion right now and alee is far more knowledgeable about that than I am | 21:02 |
| hyakuhei | Yeah but you kinda need to be able to tell your client _how_ it should be providing the bits you want | 21:02 |
| alee | (or as part of the cmc request) | 21:02 |
| hyakuhei | I presume all CA plugins will have the same client facing contract | 21:02 |
| *** crc32 has joined #openstack-barbican | 21:03 | |
| alee | hyakuhei, right | 21:03 |
| hyakuhei | I'm ok with however it works in Barbican, just keeping a mind that I want Anchor to slot in behind Barbican easily | 21:03 |
| hyakuhei | As I think it could work nicely as the testing/snakeoil CA | 21:03 |
| alee | hyakuhei, in the proposed BP, the client would interface wth barbican using cmc | 21:03 |
| reaperhulk | and CMC's base case is PKCS10 :) | 21:03 |
| alee | yup | 21:03 |
| reaperhulk | so a CSR with embedded extensions is perfect for that | 21:04 |
| rm_work | hyakuhei: yeah, that is exactly what we need | 21:04 |
| hyakuhei | alee: know any clients that talk CMC ? | 21:04 |
| rm_work | well, something halfway between "snakeoil" and "fully authed" | 21:04 |
| hyakuhei | rm_work: sure | 21:04 |
| hyakuhei | I was being breif | 21:04 |
| rm_work | yeah :P | 21:04 |
| rm_work | I assume it would serve that purpose well | 21:04 |
| alee | hyakuhei, well -- we'll have the barbican-client :) | 21:04 |
| alee | once we write it | 21:04 |
| hyakuhei | pfft | 21:05 |
| hyakuhei | vaporware :P | 21:05 |
| alee | and of course, the base case in pkcs10 | 21:05 |
| hyakuhei | I'll go poke CertMonger | 21:05 |
| alee | hyakuhei, its not there yet --- but if we decide to go this way - it will be. | 21:05 |
| hyakuhei | Interesting | 21:06 |
| alee | hyakuhei, my goal is to make things easy to interfce with barbican using certmonger | 21:06 |
| hyakuhei | So we have Certmonger working with Anchor today through some extension work that someone else wrote | 21:06 |
| hyakuhei | Which we could easily turn into a CA plugin for Barbican | 21:06 |
| hyakuhei | s/could/would/ | 21:07 |
| alee | sounds interesting | 21:07 |
| hyakuhei | Yeah I think I'm happiest with that. | 21:07 |
| hyakuhei | I was pondering having Anchor use the same API but I don't think there's any benefit. If someone is using Barbican client I'd rather they route their requests to Anchor via Barbican anyway | 21:08 |
| alee | hyakuhei, I think the idea in general would be certmonger -> barbican -> dogtag/anchor | 21:09 |
| hyakuhei | Well that's just peachy | 21:09 |
| alee | or barbican-client -> barbican -> dogtag/anchor | 21:09 |
| rm_work | yeah, we'd want the latter | 21:11 |
| *** kebray has joined #openstack-barbican | 21:13 | |
| hyakuhei | I wonder how hard CertMonger->Barbican-Client-->Barbican-->DogTag/Anchor would be | 21:14 |
| * hyakuhei just thinking out loud | 21:14 | |
| *** dave-mccowan_ has joined #openstack-barbican | 21:20 | |
| alee | hyakuhei, yeah - thought about that -- not sure I see the point though .. | 21:20 |
| rm_work | lol | 21:20 |
| hyakuhei | well, Certmonger does nice lifecycle management stuff | 21:22 |
| hyakuhei | 'oh your certificate is about to expire, let me fix that for you' | 21:22 |
| hyakuhei | Oh I see | 21:22 |
| rm_work | yeah we do not want that :P | 21:23 |
| rm_work | our certificates will have no lifecycle | 21:23 |
| hyakuhei | so yeah, I can see why if there's a CMC API it's possible that Certmonger->Barbican and BarbicanClient->Barbican could happily both exist | 21:23 |
| *** atiwari has joined #openstack-barbican | 21:26 | |
| *** dave-mccowan has quit IRC | 21:35 | |
| *** russellb has quit IRC | 21:35 | |
| *** tdink has quit IRC | 21:35 | |
| *** dave-mccowan_ is now known as dave-mccowan | 21:35 | |
| *** atiwari has quit IRC | 21:37 | |
| *** tkelsey has quit IRC | 21:40 | |
| *** kebray has quit IRC | 22:07 | |
| *** kebray has joined #openstack-barbican | 22:16 | |
| *** tdink has joined #openstack-barbican | 22:29 | |
| *** jamielennox|away is now known as jamielennox | 22:32 | |
| *** ryanpetrello has quit IRC | 22:36 | |
| *** ryanpetrello has joined #openstack-barbican | 22:36 | |
| *** ryanpetrello has quit IRC | 22:42 | |
| openstackgerrit | Jeff Fischer proposed openstack/barbican: initial commit for DigiCert Barbican plugin. https://review.openstack.org/138199 | 22:43 |
| *** paul_glass has quit IRC | 22:48 | |
| *** rm_you| has quit IRC | 22:48 | |
| *** rm_you| has joined #openstack-barbican | 22:49 | |
| *** rellerreller has quit IRC | 22:50 | |
| *** ryanpetrello has joined #openstack-barbican | 22:57 | |
| *** ryanpetrello_ has joined #openstack-barbican | 23:02 | |
| *** dimtruck is now known as zz_dimtruck | 23:03 | |
| *** ryanpetrello has quit IRC | 23:04 | |
| *** ryanpetrello_ is now known as ryanpetrello | 23:04 | |
| *** jaosorior has quit IRC | 23:13 | |
| *** rtom has quit IRC | 23:34 | |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican-specs: Introduce the concept of an Active SecretStore https://review.openstack.org/135779 | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!