Monday, 2015-01-26

« Sunday, 2015-01-25 Index Tuesday, 2015-01-27 »
*** kebray has quit IRC00:31
*** kebray has joined #openstack-barbican00:32
*** woodster_ has joined #openstack-barbican02:06
*** zz_dimtruck is now known as dimtruck02:27
*** lisaclark2 has joined #openstack-barbican02:31
*** lisaclark1 has quit IRC02:34
*** lisaclark2 has quit IRC02:34
*** lisaclark1 has joined #openstack-barbican02:40
*** lisaclark1 has quit IRC03:11
*** elmiko_ is now known as elmiko03:26
*** dimtruck is now known as zz_dimtruck05:10
*** zz_dimtruck is now known as dimtruck05:11
*** dimtruck is now known as zz_dimtruck05:20
*** jaosorior has joined #openstack-barbican06:03
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Remove version from endpoints in catalog  https://review.openstack.org/12786506:29
*** woodster_ has quit IRC07:13
*** kebray has quit IRC08:31
*** Guest66252 is now known as d0ugal09:22
*** d0ugal has quit IRC09:23
*** d0ugal has joined #openstack-barbican09:23
openstackgerritOpenStack Proposal Bot proposed openstack/python-barbicanclient: Updated from global requirements  https://review.openstack.org/14948210:33
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Inherit tests instead of explictly calling them  https://review.openstack.org/14999811:19
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Inherit tests instead of explictly calling them  https://review.openstack.org/14999811:24
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Remove commented test cases  https://review.openstack.org/15000211:30
*** alpha_ori has quit IRC12:51
*** redrobot has quit IRC12:51
*** redrobot has joined #openstack-barbican12:53
*** redrobot is now known as Guest3647312:53
*** alpha_ori has joined #openstack-barbican12:55
*** reaperhulk_ is now known as reaperhulk13:25
*** woodster_ has joined #openstack-barbican13:26
*** darrenmoffat has quit IRC13:40
*** darrenmoffat has joined #openstack-barbican13:41
*** jraim has quit IRC14:15
*** jraim has joined #openstack-barbican14:15
*** ametts has joined #openstack-barbican14:47
*** lisaclark1 has joined #openstack-barbican14:56
*** lisaclark1 has quit IRC15:09
*** lisaclark1 has joined #openstack-barbican15:12
*** kebray has joined #openstack-barbican15:12
*** sigmavirus24_awa is now known as sigmavirus2415:12
*** kebray has quit IRC15:14
*** SheenaG1 has joined #openstack-barbican15:15
*** kebray has joined #openstack-barbican15:16
*** zz_dimtruck is now known as dimtruck15:22
*** kebray has quit IRC15:27
*** SheenaG1 has quit IRC15:29
*** lisaclark1 has quit IRC15:40
*** lisaclark1 has joined #openstack-barbican15:40
openstackgerritAde Lee proposed openstack/barbican: Added new model classes for CAs  https://review.openstack.org/14732315:43
openstackgerritAde Lee proposed openstack/barbican: Added new repository classes and controller classes for CAs  https://review.openstack.org/14798115:44
openstackgerritAde Lee proposed openstack/barbican: Add code to populate CA tables and select plugin based on ca_id  https://review.openstack.org/15007015:44
openstackgerritMerged openstack/barbican: Remove commented test cases  https://review.openstack.org/15000215:44
openstackgerritMerged openstack/python-barbicanclient: Updated from global requirements  https://review.openstack.org/14948215:46
*** kebray has joined #openstack-barbican15:46
*** kebray has quit IRC15:49
*** kebray has joined #openstack-barbican15:49
*** SheenaG1 has joined #openstack-barbican15:56
*** kgriffs|afk is now known as kgriffs15:58
*** rellerreller has joined #openstack-barbican16:00
*** nkinder has joined #openstack-barbican16:03
*** Guest36473 is now known as redrobot16:06
openstackgerritMerged openstack/barbican: Refactor order validation  https://review.openstack.org/14890016:07
*** kebray has quit IRC16:13
aleerm_work, ping16:16
rm_workalee: pong16:16
aleerm_work, so, you gotten ok to work on per-secret stuff?16:19
*** lisaclark1 has quit IRC16:19
*** lisaclark2 has joined #openstack-barbican16:19
aleerm_work, just checking - because if you have, I'll prioritze getting a new version of the spec out first16:19
rm_workalee: yes I think so, but *next* sprint16:19
aleerm_work, which starts when?16:20
rm_workthis sprint I am needed on internal stuff, and only had time to squeeze in Castellan since that should be super quick16:20
rm_workalee: uhh, two weeks16:20
aleerm_work, ok cool16:20
rm_workalee: if we're in a time crunch, i could maybe take a look over weekends :P16:20
rm_workbut that would definitely cut into my shooting people in the face in videogames time16:21
*** lisaclark1 has joined #openstack-barbican16:21
aleerm_work, :)  while I think it  would help your overall outlook to life being less bloodthirsty in your pursuits, I don't think we're in a crunch yet16:22
*** lisaclark2 has quit IRC16:22
rm_workhehe16:22
rm_workyeah just let me know16:23
rm_workI am still reviewing as much as I can, so let me know when the new spec is up16:23
aleerm_work, will do - thanks16:23
openstackgerritMerged openstack/barbican: Inherit tests instead of explictly calling them  https://review.openstack.org/14999816:24
*** kebray has joined #openstack-barbican16:26
*** kebray has quit IRC16:33
*** david-ly_ is now known as david-lyle16:33
*** kebray has joined #openstack-barbican16:39
*** rellerreller has quit IRC16:42
openstackgerritAde Lee proposed openstack/barbican: Added new model classes for CAs  https://review.openstack.org/14732316:50
openstackgerritAde Lee proposed openstack/barbican: Add code to populate CA tables and select plugin based on ca_id  https://review.openstack.org/15007016:50
openstackgerritAde Lee proposed openstack/barbican: Added new repository classes and controller classes for CAs  https://review.openstack.org/14798116:50
*** lisaclark1 has quit IRC16:56
*** rellerreller has joined #openstack-barbican16:57
*** lisaclark1 has joined #openstack-barbican16:58
*** ayoung is now known as adminyoung17:20
*** codekobe has quit IRC17:34
*** codekobe has joined #openstack-barbican17:35
*** kebray has quit IRC17:35
*** lisaclark1 has quit IRC17:45
*** gyee has joined #openstack-barbican18:04
*** adminyoung is now known as ayoung18:09
*** lisaclark1 has joined #openstack-barbican18:26
*** kebray has joined #openstack-barbican18:28
*** atiwari has joined #openstack-barbican18:39
tdinkjaosorior woodster_ when working with barbican python client should objects return the dates as a string or a datetime object18:42
jaosoriorverifyiing18:47
jaosoriorit will be what oslo.utils.timeutils.parse_isotime returns18:47
jaosoriorthat's what I'm verifying18:47
jaosoriorshould be datetime objects18:49
jaosoriortdink18:49
jaosoriorwoodster_: Have you heard anything from the Digicert guys? This CR (https://review.openstack.org/#/c/138199/6)has been there a loooong time and they haven't replied :/18:57
jaosoriorhttps://review.openstack.org/#/c/138199/618:57
woodster_jaosorior: ha SheenaG1 and I talked about that this morning, so I added a question to the CR after yours, I also emailed Jeff as well19:01
jaosorioryeah, I had asked a while ago and got no response. On the other hand, it's almost been 2 months ever since his last contact19:02
jaosoriorweird :/19:02
woodster_jaosorior: well his email didn't bounce yet so if he's still working there... :)19:05
jaosorioralright, seems legit19:06
jaosoriorwoodster_: What about this CR https://review.openstack.org/#/c/125798/ ?19:07
jaosorioryou haven't replied in a while :O19:07
woodster_jaosorior: oh yeah forgot about that19:10
*** atiwari has quit IRC19:11
jaosoriorKinda wanna get that merged :P19:11
jaosoriorI could even work on it myself, if it's OK with you19:12
*** david-lyle is now known as david-lyle_afk19:15
jaosoriorredrobot: ping19:19
redrobotjaosorior pong19:20
jaosoriorhey dude, I know this has been asked before (but I forgot), was there a hotel deal or something for the meetup? gonna book stuff tomorrow19:20
*** kebray has quit IRC19:22
openstackgerritTim Kelsey proposed openstack/barbican-specs: Adding spec for Barbican MKEK Model.  https://review.openstack.org/14894819:23
redrobotjaosorior no deals, unfortunately.  Most of us are staying at the Omni, which I think is either the same building or next-door to Capital Factory http://www.omnihotels.com/hotels/austin-downtown19:23
jaosorioralright, will keep it in mind, thanks dude19:23
jaosoriorYou guys know Austin well? We gotta go to some good taco places :P19:24
redrobotlol, Torchy's is supposed to be one of the best taco places19:25
redrobotbut I think San Anto has a better taco game19:25
jaosorioroho19:26
jaosorior...hungry19:27
redrobotstart your own taco stand in helsinki19:27
redrobotI bet you could make a killing out there19:28
jaosoriorhahaha I've thought about it19:28
*** kebray has joined #openstack-barbican19:28
jaosoriorshould I leave my life as a dev for tacos? decisions, decisions19:29
*** jkf has joined #openstack-barbican19:38
* greghaynes makes shameless plug for one more +2 on https://review.openstack.org/#/c/140575/19:40
jaosoriorgreghaynes: Well... there is a -1 there19:41
greghaynesYea, read my reply :)19:41
jaosoriorah, nevermind19:41
jaosoriorjust read it19:41
jaosorioryeah19:41
jaosoriorlets take a look19:41
greghayneswoo!19:42
jaosoriorbefore scoring19:48
jaosoriorwoodster_, jvrbanac: are you around?19:48
*** tkelsey has joined #openstack-barbican19:52
*** tkelsey has quit IRC19:53
*** tkelsey has joined #openstack-barbican19:53
*** dave-mccowan has joined #openstack-barbican19:54
redrobotBarbican weekly meeting starts in 5 minutes in #openstack-meeting-alt19:54
rm_workthx19:55
rm_workalways forget >_<19:55
*** lisaclark2 has joined #openstack-barbican19:55
jaosoriorgreghaynes: no +2, sorry dude :/19:58
*** lisaclark1 has quit IRC19:58
*** kfarr has joined #openstack-barbican19:59
greghayneshah, well -1's are also welcome19:59
jaosoriorgreghaynes: I would actually like jvrbanac to comment on that. Might have some relevant input on the test side.20:01
*** kebray has quit IRC20:06
jvrbanacjaosorior, which one?20:07
jaosoriorjvrbanac: https://review.openstack.org/#/c/140575/20:08
jvrbanacjaosorior, also hockeynut is the test guy ;)20:08
jaosoriorjvrbanac: true dat!20:08
jaosorior...summoning hockeynut...20:08
jvrbanacjaosorior, I'll take a look at it this afternoon though20:09
*** kebray has joined #openstack-barbican20:11
*** atiwari has joined #openstack-barbican20:41
*** dave-mccowan has quit IRC20:59
*** lisaclark2 has quit IRC21:05
*** lisaclark1 has joined #openstack-barbican21:06
woodster_ha, sorry I missed the tail end of irc meeting21:07
*** kfarr has quit IRC21:07
*** lisaclark1 has quit IRC21:07
*** lisaclark1 has joined #openstack-barbican21:08
*** tkelsey has quit IRC21:14
*** kebray has quit IRC21:17
*** crc32 has joined #openstack-barbican21:17
rm_workwoodster_: i think redrobot found the (what should have been obvious) solution21:17
rm_workwe need a new role, that is still attached to your project, but is specifically for viewing things that other people share21:18
rm_worknot sure about the name yet21:18
hockeynuthockeynut is here jaosorior21:35
*** lisaclark1 has quit IRC21:38
*** lisaclark1 has joined #openstack-barbican21:38
hockeynutI will take a look at that review...21:39
*** david-lyle_afk is now known as david-lyle21:40
*** lisaclark1 has quit IRC21:41
*** lisaclark1 has joined #openstack-barbican21:44
*** kebray has joined #openstack-barbican21:47
*** atiwari has quit IRC21:55
*** atiwari has joined #openstack-barbican21:56
woodster_rm_work, I saw a bit of that discussion but not sure about it yet. So this would be a role that (say) LBaaS user would have to then access a secret in barbican that it was whitelisted for?22:01
rm_workyes22:02
rm_workthe thing i had a problem with was not your end-goal, but the hacky method you were proposing to do it :P22:02
rm_work(tying it to something unrelated)22:03
woodster_rm_work, I'm still not clear. What user/project assoc would this role be placed on?22:04
rm_workit would be placed on user -> user's project22:04
rm_workbut it'd be a distinct role that is clearly for viewing shared things22:05
woodster_rm_work, I'm trying to be more specific...which 'user' here, Alice or Bob?22:05
rm_workso we'd change the metaphor to like … viewing lockers inside a mens club22:05
rm_workyou need a membership to get into the mens club, but once you're in, you can look in other people's lockers if they shared the key with you22:05
SheenaG1What is a mens club, rm_work?22:06
rm_workwoodster_: Bob has a role on Bob's project that says "Can View Other People's Shared Things"22:06
SheenaG1Like a gym?22:06
woodster_rm_work, I'm trying to put this into the user/project/role context that tokens are cut for22:06
SheenaG1But for mens?22:06
rm_workSheenaG1: you wouldn't understand, it's for men22:06
SheenaG1rm_work: I've heard of things referred to as "mens clubs" before, but they were not gyms22:06
rm_workheh22:06
rm_workyes, like a gym22:06
rm_worknot the men's clubs you are thinking of :P22:07
woodster_SheenaG1, yeah, men only, no gurls allowed22:07
rm_worksuper-high-end gyms22:07
woodster_SheenaG1, gymnastics more like22:07
rm_workheh22:07
rm_workbecause security in traditional gyms is O_o22:07
woodster_role, not pole22:07
SheenaG1Hahahahahahaha22:07
SheenaG1+100 points to woodster_22:08
woodster_rm_work, I'm not sure if this metaphor brought us to nirvana yet22:08
rm_workyeah let me work on it22:08
woodster_SheenaG1: ha!22:08
woodster_rm_work, if I come at this from user/project/role perspective I have this:22:08
woodster_Alice is a user with on projectA with role of barbican:creator, and creates a secret UUIDa22:09
woodster_Alice adds user Bob to the whitelist of UUIDa22:09
rm_workwith you so far22:10
woodster_Bob is a user on projectB with no barbican roles assigned to them22:10
woodster_So you would say that Bob should be able to decrypt/GET secret UUIDa then?22:11
rm_workno22:11
woodster_or you are saying Bob must have role new-role-thinggy on projectA to get secret UUIDa?22:11
rm_workhe'd need the role barbican:can_view_shared_resources on ProjectB22:11
rm_workstill his own project22:11
rm_workbut the role is no longer the same one he uses for viewing his own stuff22:11
woodster_ok then....how is that different than what I was asking for?22:11
rm_workit's distinct and clearly indicates its purpose22:12
rm_workand not everyone has it immediately by default22:12
rm_workOR, they do but it can be revoked separately22:12
rm_workand it serves an entirely different purpose than barbican:admin / barbican:read / etc22:12
woodster_so you are saying current barbican roles should only apply if the *project* for the secret I want matches my user's auth-ed project?22:12
rm_workyes22:13
rm_workbecause those are YOURS22:13
rm_workthe issue was mixing up the concept of viewing your own secrets and viewing others22:14
rm_workseparating the concerns solves the problem (not sure why i didn't think of this immediately)22:14
*** sigmavirus24 has left #openstack-barbican22:16
woodster_rm_work so the real question is what 'yours' means then. I've been thinking that concept gets blurred once you have a whitelist in place, but keeping 'yours' to mean the project a secret/container was created with makes sense (we are doing that for GET lists anyway it seems).22:16
woodster_rm_work my concern though is that you don't have fine grained access anymore, unless you break out the four roles into 'can_viewed_shared_resources' type roles22:17
woodster_rm_work so just to revisit the flow then...if we keep the current four roles then I am saying that Bob would need to have a barbican role not barbican:observer on Project B to access UUIDa. What is the issue with that access pattern though?22:20
woodster_rm_work are you thinking that is giving Bob more access than they should have?22:20
rm_workwoodster_: well, sharing only works for reading22:22
rm_workthere's no "write-sharing"22:22
rm_workand without those roles it makes it impossible to allow for scenarios like "can read others' secrets ONLY"22:23
woodster_rm_work, so do you mean restricting things such at Bob can only read secrets from barbican, and not be able to store/read his own secrets under Project B?22:24
rm_workyeah22:25
rm_workdon't know if that'll come up, but it's the *right way* to do it22:25
woodster_rm_work I guess I'm trying to understand why Bob being able to write secrets to his project is a bad thing?22:25
rm_workdoing it the way you wanted to do it was overloading the original role22:26
woodster_rm_work, where Bob could be LBaaS in this case22:26
woodster_you mean Alice's 'original' role?22:26
redrobotThe reason I proposed a new role is that it seemed that woodster_'s concern was about cutting off access to Barbican if Bob had no barbican roles22:26
redrobotadding a new role is better because it specifically allows/denies the ability to read a shared secret22:27
redrobotthis is better than just picking any role22:27
rm_work^^22:27
woodster_I believe Bob should have to have a barbican role to be able to access a secret in Barbican. An admin should be able to cut Bob off by taking away his roles if needed.22:29
redrobotwoodster_ yes, and by creating a role that specifically allows for shared secrets enables a cloud admin to still let someone audit secrets, but not be able to read shared secrets22:29
redrobotin fact, an admin could cut off access to shared secrets only, by removing the barbican:read_shared_secrets role22:30
rm_workyes22:31
rm_work^^ that is possibly the more realistic concern22:31
redrobotthis way Bob can still access their own secrets22:31
woodster_ok, so the shared-secrets role would restrict access to things on the whitelist, and if that's the only role they have, then they can't even access their own secrets...where 'own' is defined as secrets under Project B for Bob above22:32
redrobotwoodster_ correct, if the only barbican role they have is barbican:read_shared_secrets, then they can't store their own stuff, but if someone happens to share something with them, then they could only read that one shared secret.22:33
*** dimtruck is now known as zz_dimtruck22:34
woodster_conversely, if Bob did not have the shared-secrets role, then they could only access Project B's secrets and not any secrets that Bob might be whitelisted on?22:35
woodster_they -> Bob22:35
*** rtom has joined #openstack-barbican22:36
rm_workyes22:37
woodster_would the expectation be that a GET list of secrets by Bob with only the read_shared role would give them a list of secrets they are whitelisted for only?22:38
rm_workI would assume they would get no secrets listed still (per our previous conversations)22:38
redrobotrm_work +122:38
woodster_I would agree, but this new role would beg that question/feature a bit more in my mind. Security wise though, still good to only allow this for GETs on a specific secret for both meta and decrypted modes.22:41
*** jamielennox|away is now known as jamielennox22:41
woodster_alee, can you review the last 40 mins of conversation please? :)22:41
woodster_alee...so you see, it's like a membership to a men's club...22:42
rm_workheh22:42
rm_workI should have said "mens athletic club"22:43
rm_workto be more clear22:43
rm_workalso, I'm not 100% on that metaphor yet, still working on it22:43
woodster_rm_work, I'm just glad roles are in there someplace :) I agree that whittles down the access control granularity even more. The policy stuff will be fun. I bet alee is regretting writing that bp!22:45
woodster_rm_work did you want to feed this back to alee to add to the blueprint then? I'm thinking 'read_shared' for the role name would be fine, to access secrets or containers.22:52
rm_workthat should probably be fine22:54
rm_workI think alee was there and liked the idea when we talked about it in the meeting, so I am guessing he's already on it22:54
woodster_rm_work, sounds good, thanks again23:14
*** jaosorior has quit IRC23:14
*** kebray has quit IRC23:17
*** kebray has joined #openstack-barbican23:18
*** mjg59 has joined #openstack-barbican23:18
*** bdpayne has joined #openstack-barbican23:19
*** zz_dimtruck is now known as dimtruck23:25
*** kgriffs is now known as kgriffs|afk23:26
*** kgriffs|afk is now known as kgriffs23:26
*** SheenaG1 has quit IRC23:26
*** lisaclark1 has quit IRC23:31
*** david-lyle is now known as david-lyle_afk23:31
*** rtom has quit IRC23:39
*** chlong has joined #openstack-barbican23:55
« Sunday, 2015-01-25 Index Tuesday, 2015-01-27 »

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!