| *** oomichi has joined #openstack-keystone | 00:06 | |
| *** dstanek_zzz is now known as dstanek | 00:08 | |
| *** dstanek is now known as dstanek_zzz | 00:18 | |
| *** xianghui has joined #openstack-keystone | 00:19 | |
| *** diegows has joined #openstack-keystone | 00:30 | |
| *** nsquare has joined #openstack-keystone | 00:47 | |
| *** hrybacki has joined #openstack-keystone | 00:49 | |
| *** dstanek_zzz is now known as dstanek | 01:09 | |
| *** mberlin has joined #openstack-keystone | 01:14 | |
| *** mberlin1 has quit IRC | 01:17 | |
| *** diegows has quit IRC | 01:17 | |
| *** hrybacki has quit IRC | 01:18 | |
| *** dstanek is now known as dstanek_zzz | 01:19 | |
| *** xianghui has quit IRC | 01:27 | |
| ayoung | jamielennox, https://review.openstack.org/#/c/81166/ really could stand to get mergered | 01:55 |
|---|---|---|
| * morganfainberg ponders... | 01:55 | |
| morganfainberg | book flights... review/merge code | 01:55 |
| jamielennox | ayoung: yea, it's a beast - i've gotten part way through reviews a couple of times | 01:55 |
| ayoung | ++ | 01:56 |
| * morganfainberg weighs options | 01:56 | |
| morganfainberg | or dinner. | 01:56 |
| ayoung | morganfainberg, dinner, book flights, review code. | 01:56 |
| ayoung | Keep your priorities straight | 01:56 |
| morganfainberg | ayoung, well, that means i need to pick what to eat! :P | 01:56 |
| morganfainberg | >.> | 01:56 |
| morganfainberg | ooh i think i have a gift card for roys... that would be close/easy | 01:57 |
| *** zhiyan_ is now known as zhiyan | 02:00 | |
| morganfainberg | ooh $20 | 02:00 |
| morganfainberg | yeah totally doing that for dinner :P | 02:01 |
| *** dstanek_zzz is now known as dstanek | 02:09 | |
| *** zhiyan is now known as zhiyan_ | 02:18 | |
| *** dstanek is now known as dstanek_zzz | 02:19 | |
| *** praneshp_ has joined #openstack-keystone | 02:24 | |
| *** rodrigods has joined #openstack-keystone | 02:25 | |
| *** praneshp has quit IRC | 02:26 | |
| *** praneshp_ is now known as praneshp | 02:26 | |
| *** zhiyan_ is now known as zhiyan | 02:27 | |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add an example script for role_assignments module https://review.openstack.org/97600 | 02:30 |
| *** rodrigods has quit IRC | 02:35 | |
| *** lbragstad has joined #openstack-keystone | 02:53 | |
| *** dims has quit IRC | 02:57 | |
| *** ncoghlan has joined #openstack-keystone | 03:02 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Default to PKIZ tokens https://review.openstack.org/98897 | 03:06 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Allow for multiple PKI Style Providers https://review.openstack.org/98845 | 03:07 |
| *** dstanek_zzz is now known as dstanek | 03:10 | |
| *** diegows has joined #openstack-keystone | 03:20 | |
| *** dstanek is now known as dstanek_zzz | 03:20 | |
| *** diegows has quit IRC | 03:29 | |
| *** stevemar has joined #openstack-keystone | 03:47 | |
| *** nsquare has quit IRC | 03:50 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:01 | |
| *** xianghui has joined #openstack-keystone | 04:02 | |
| *** morganfainberg has quit IRC | 04:04 | |
| *** morganfainberg has joined #openstack-keystone | 04:04 | |
| *** morganfainberg has quit IRC | 04:05 | |
| *** morganfainberg has joined #openstack-keystone | 04:06 | |
| *** dstanek_zzz is now known as dstanek | 04:11 | |
| *** dstanek is now known as dstanek_zzz | 04:21 | |
| *** dims has joined #openstack-keystone | 04:26 | |
| *** xianghui has quit IRC | 04:30 | |
| *** dims has quit IRC | 04:30 | |
| *** xianghui has joined #openstack-keystone | 04:35 | |
| *** dims has joined #openstack-keystone | 04:46 | |
| *** dims has quit IRC | 04:51 | |
| *** dstanek_zzz is now known as dstanek | 05:12 | |
| *** gpocentek has joined #openstack-keystone | 05:16 | |
| *** dstanek is now known as dstanek_zzz | 05:22 | |
| *** ajayaa has joined #openstack-keystone | 05:22 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:26 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Adds a newline for pep8 compliance https://review.openstack.org/99418 | 05:28 |
| *** nsquare has joined #openstack-keystone | 05:42 | |
| *** dims has joined #openstack-keystone | 05:47 | |
| *** dims has quit IRC | 05:51 | |
| *** zhiyan is now known as zhiyan_ | 05:55 | |
| *** zhiyan_ is now known as zhiyan | 05:56 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/97005 | 06:00 |
| *** dstanek_zzz is now known as dstanek | 06:12 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Update keystoneclient code to account for hacking 0.9.2 https://review.openstack.org/100152 | 06:17 |
| *** henrynash has joined #openstack-keystone | 06:18 | |
| *** dstanek is now known as dstanek_zzz | 06:22 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update sample keystone.conf file https://review.openstack.org/100155 | 06:25 |
| *** stevemar has quit IRC | 06:37 | |
| *** dims has joined #openstack-keystone | 06:48 | |
| *** dims has quit IRC | 06:52 | |
| *** marekd|away is now known as marekd | 06:58 | |
| *** chandan_kumar has quit IRC | 07:05 | |
| *** BAKfr has joined #openstack-keystone | 07:09 | |
| *** dstanek_zzz is now known as dstanek | 07:13 | |
| *** ncoghlan has quit IRC | 07:17 | |
| *** dstanek is now known as dstanek_zzz | 07:23 | |
| *** einarf has joined #openstack-keystone | 07:24 | |
| *** nsquare has quit IRC | 07:30 | |
| *** leseb has joined #openstack-keystone | 07:37 | |
| *** leseb has quit IRC | 07:47 | |
| *** afazekas_ has joined #openstack-keystone | 07:48 | |
| *** dims has joined #openstack-keystone | 07:49 | |
| *** dims has quit IRC | 07:53 | |
| *** leseb has joined #openstack-keystone | 07:59 | |
| *** einarf has quit IRC | 08:00 | |
| *** xianghui has quit IRC | 08:05 | |
| *** xianghui has joined #openstack-keystone | 08:05 | |
| *** dstanek_zzz is now known as dstanek | 08:14 | |
| *** jaosorior has joined #openstack-keystone | 08:14 | |
| *** xianghui has quit IRC | 08:14 | |
| *** dstanek is now known as dstanek_zzz | 08:24 | |
| *** xianghui has joined #openstack-keystone | 08:28 | |
| *** mberlin1 has joined #openstack-keystone | 08:29 | |
| *** mberlin has quit IRC | 08:29 | |
| *** henrynash has quit IRC | 08:36 | |
| *** mberlin1 has quit IRC | 08:36 | |
| *** mberlin has joined #openstack-keystone | 08:38 | |
| *** mberlin has quit IRC | 08:42 | |
| *** mberlin has joined #openstack-keystone | 08:42 | |
| *** dims has joined #openstack-keystone | 08:49 | |
| *** henrynash has joined #openstack-keystone | 08:50 | |
| *** dims has quit IRC | 08:54 | |
| *** zhiyan is now known as zhiyan_ | 08:56 | |
| *** henrynash has quit IRC | 08:57 | |
| *** dstanek_zzz is now known as dstanek | 09:15 | |
| *** dstanek is now known as dstanek_zzz | 09:25 | |
| *** jamielennox is now known as jamielennox|away | 09:29 | |
| *** praneshp has quit IRC | 09:30 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/99076 | 09:48 |
| *** dims has joined #openstack-keystone | 09:50 | |
| *** luisbg has quit IRC | 09:50 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/96265 | 09:52 |
| *** dims has quit IRC | 09:54 | |
| *** rodrigods has joined #openstack-keystone | 10:03 | |
| *** leseb has quit IRC | 10:04 | |
| *** leseb has joined #openstack-keystone | 10:05 | |
| *** openstackgerrit has quit IRC | 10:06 | |
| *** openstackgerrit has joined #openstack-keystone | 10:06 | |
| *** leseb has quit IRC | 10:09 | |
| *** dstanek_zzz is now known as dstanek | 10:16 | |
| *** ajayaa has quit IRC | 10:18 | |
| *** dstanek is now known as dstanek_zzz | 10:26 | |
| *** openstackgerrit has quit IRC | 10:35 | |
| *** openstackgerrit has joined #openstack-keystone | 10:35 | |
| *** leseb has joined #openstack-keystone | 10:38 | |
| *** leseb has quit IRC | 10:44 | |
| *** dims_ has joined #openstack-keystone | 10:51 | |
| *** dims_ has quit IRC | 10:55 | |
| *** xianghui has quit IRC | 10:59 | |
| *** dstanek_zzz is now known as dstanek | 11:16 | |
| *** dims_ has joined #openstack-keystone | 11:18 | |
| *** leseb has joined #openstack-keystone | 11:23 | |
| *** dstanek is now known as dstanek_zzz | 11:26 | |
| *** rodrigods has quit IRC | 11:28 | |
| *** ajayaa has joined #openstack-keystone | 11:32 | |
| *** hrybacki has joined #openstack-keystone | 11:47 | |
| *** hrybacki has quit IRC | 11:47 | |
| *** hrybacki has joined #openstack-keystone | 11:47 | |
| *** lbragstad has quit IRC | 11:48 | |
| *** diegows has joined #openstack-keystone | 11:52 | |
| *** juanmo has joined #openstack-keystone | 11:59 | |
| *** rodrigods has joined #openstack-keystone | 12:04 | |
| *** dstanek_zzz is now known as dstanek | 12:17 | |
| *** morganfainberg has quit IRC | 12:18 | |
| *** morganfainberg has joined #openstack-keystone | 12:19 | |
| *** erecio has joined #openstack-keystone | 12:21 | |
| *** raildo has joined #openstack-keystone | 12:33 | |
| *** zhiyan_ is now known as zhiyan | 12:44 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: check revocation by events in auth_token middleware https://review.openstack.org/99751 | 12:47 |
| *** henrynash has joined #openstack-keystone | 12:48 | |
| *** mberlin has quit IRC | 12:50 | |
| *** mberlin has joined #openstack-keystone | 13:02 | |
| *** gordc has joined #openstack-keystone | 13:05 | |
| *** ajayaa has quit IRC | 13:05 | |
| *** lbragstad has joined #openstack-keystone | 13:08 | |
| *** dims_ has quit IRC | 13:10 | |
| *** dims_ has joined #openstack-keystone | 13:10 | |
| *** dims_ has quit IRC | 13:11 | |
| dstanek | ayoung: have you taken a look at https://review.openstack.org/#/c/99908/2/specs/juno/trusts-redelegation.rst yet? | 13:11 |
| *** dims has joined #openstack-keystone | 13:12 | |
| *** joesavak has joined #openstack-keystone | 13:12 | |
| *** richm has joined #openstack-keystone | 13:15 | |
| ayoung | dstanek, no, not yet | 13:19 |
| dstanek | ayoung: i think maybe a slightly different take on some of the service scoping we were talkig about at the summit | 13:20 |
| ayoung | dstanek, on the redelegation spec? | 13:21 |
| joesavak | yo Marekd! Thanks for the review. : ) | 13:22 |
| marekd | joesavak: hello! | 13:22 |
| joesavak | marekd - i'm a little confused by your mapping comment | 13:23 |
| ayoung | hrybacki, so for py33 | 13:23 |
| joesavak | are you wondering why mappings should exist for sp federation? | 13:23 |
| ayoung | run tox -e py33 and you will see the errors | 13:23 |
| joesavak | marekd: https://review.openstack.org/#/c/100023/3/specs/juno/keystone-to-keystone-federation.rst line 296 | 13:23 |
| dstanek | ayoung: the usecase if user trusts a service; then later a that trusted token has to be used by the service to talk to another serivce | 13:23 |
| ayoung | hrybacki, looking at what you have in the past review, I am not sure why the test fail, but it might be the string comparisons are no longer between objects of the same type | 13:24 |
| marekd | joesavak: no, we already have them at the SP side (starting from Icehouse), so given the fact we are now focusing on Keystone being an IdP what do you want map there? Shouldn't Keystone-IdP issue an assertion (like SAML assertion)? | 13:24 |
| hrybacki | ayoung: nods -- on it | 13:24 |
| dstanek | ayoung, hrybacki: let me know if you need a third pair of eyes for the Py3 stuff | 13:25 |
| ayoung | hrybacki, cool. drive on, and there are lots of smart pythonistas in here if you come across a roadblock; | 13:25 |
| joesavak | marekd - yes keystone should issue an assertion for the service provider federation, but having the mapping there sets us up in a better spot should the service provider not be keystone | 13:25 |
| ayoung | like dstanek | 13:25 |
| dstanek | some of our deps (new versions maybe?) seem to be broken on Py3 because they don't install - that's on my todo list for today | 13:26 |
| marekd | joesavak: ah, ok. | 13:26 |
| joesavak | for example - the ticketing use case where i'm using a vendor provided "ticketing as a service". I want to provide that ticketing api in the keystone service catalog (even though it isn't openstack). The ticketing system may require "e-mail" and "f-lname" as attrs but keystone knows that as "email" and "username" | 13:26 |
| *** nkinder has joined #openstack-keystone | 13:26 | |
| joesavak | i'd either have to place that requirement on the various service providers we will integrate with or allow that mapping to be part of keystone itself | 13:27 |
| marekd | joesavak: yes yes, makes sense now. | 13:27 |
| joesavak | marekd - excellent - I'll review the other comments too and reply via review. : ) | 13:27 |
| marekd | joesavak: do you want (in general) Keystone-IdP to issue real SAML2 assertions? | 13:29 |
| joesavak | marekd - yes. : ) Or whichever federation protocol we deem best for this use case | 13:29 |
| joesavak | as long as it's a standard protocol. A lot of integrators speak SAML2 and OpenID connect. | 13:30 |
| marekd | joesavak: I am sometimes still confused why not leave that IdPness to something that's a real IdP | 13:30 |
| marekd | i can feel how the user experience will be...get one token, go somewhere else and magicaly use that remote cloud. | 13:31 |
| joesavak | marekd - can you expand on that... IdPness meaning credential store? | 13:33 |
| hrybacki | anyone run into issues getting pycrypto on F20? | 13:34 |
| marekd | joesavak: in general, since you want Keystone to issue a SAML2 assertion (or whatever protocol), why not leave that to a dedicated software that does that - Shibboleth, M$ ADFS and so on... | 13:34 |
| marekd | joesavak: in the end we will need to play on the SAML rules (handle redirections, keep the specified format) and we will want to integrate with an external world. | 13:35 |
| joesavak | Sure - it could be like how we implemented mod_shib for accppeitng SAML assertions - as long as there's a method to do the token-to-Federation-workflow, I think we're fine | 13:36 |
| marekd | joesavak: token-to-Federation means that local token later to be used for a remote cloud, right? | 13:38 |
| joesavak | right | 13:40 |
| joesavak | wait.. | 13:40 |
| joesavak | it means a token to a remote cloud for an identity that doesn't exist locally, but it was issued from a trusted identity provider. | 13:40 |
| joesavak | so the remove cloud keysotne initiaties the federation workflow (SAML request) to the trusted identity provider | 13:41 |
| joesavak | remote* | 13:41 |
| marekd | joesavak: which doesn't need to be a Keysone. | 13:41 |
| joesavak | right | 13:42 |
| marekd | ok, so this is what's happening today, correct? | 13:42 |
| joesavak | partially | 13:42 |
| joesavak | there are pieces missing - we have the ability to accept a saml response and generate a token for it for it | 13:43 |
| marekd | correct. | 13:43 |
| joesavak | we don't have the ability for keystone to accept a non-local token, parse the trust, and intiate the federation workflow | 13:43 |
| joesavak | we also don't have the ability for that token scope to contain multiple clouds (local and remote) | 13:43 |
| marekd | joesavak: the former: correct, but I don't know if that's really necessary, latter: I am not 100% sure this is what we should do. | 13:44 |
| marekd | joesavak: why not do something like that: enrich service katalog with federated keystones, so client knows who is where. | 13:45 |
| *** gabriel-bezerra has quit IRC | 13:45 | |
| marekd | now, he needs to go to a remote keystone and use what we have already and authenticate itself via SAML/openid | 13:45 |
| joesavak | yeah - that's the problem from my standpoint - I'm putting the requirement to speak federation protocol on the client | 13:46 |
| joesavak | there's a lot of public cloud customers used to their user/pass | 13:46 |
| joesavak | and they don't have ( and don't want) a clue about federation protocols. ; ) | 13:47 |
| marekd | joesavak: okay. | 13:48 |
| joesavak | Also, they are old mom&pop shops who had a contractor setup their public cloud account. Asking them to update a client would be like speaking klingon to them. | 13:48 |
| marekd | joesavak: i am just fearing we may end up doing some wild hacks on top of federated protocols. | 13:49 |
| marekd | joesavak: haha ++ | 13:49 |
| joesavak | i'm hoping no wild hacks. We have time to do this right and the expertise too! : ) | 13:49 |
| marekd | for sure more experience | 13:50 |
| joesavak | alrighty marekd, I'll update the review today! Off to get more coffee. Later. : ) | 13:52 |
| marekd | joesavak: hehe, cheers! | 13:52 |
| marekd | joesavak: thanks! | 13:52 |
| *** radez_g0n3 is now known as radez | 13:53 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Default to PKIZ tokens https://review.openstack.org/98897 | 13:55 |
| morganfainberg | ayoung, dolphm, what are your thoughts on getting one of the tempest runs to use UUID tokens -- you know until we really remove them? there are a lot of people who continue to use them. | 14:01 |
| ayoung | morganfainberg, I think it is a step in the wrong direction, but won't block. | 14:01 |
| morganfainberg | ayoung, i agree its not the way i want to see things go, but if we're legitimately not deprecating UUID (yet) we should probably gate on it more than just our unit tests. | 14:03 |
| ayoung | morganfainberg, so lets deprecate it | 14:03 |
| morganfainberg | ayoung, lets get compressed tokens in. and get apache running clean for tempest then look to deprecating it. I think that is a reasonable target | 14:04 |
| morganfainberg | ayoung, if we can't deprecate then, we can see if we want to gate. | 14:04 |
| ayoung | morganfainberg, I'm workoing on compressed tokens now | 14:04 |
| morganfainberg | ayoung, i know you are. thats why I think we should get that in before deciding :) should be in soon | 14:05 |
| hrybacki | anyone ever seen -- ERROR: InvocationError: '/opt/stack/python-keystoneclient/.tox/py33/bin/python setup.py testr --testr-args=' -- when trying to run the Python 3 tox tests? | 14:06 |
| *** stevemar has joined #openstack-keystone | 14:10 | |
| *** dhellmann has quit IRC | 14:12 | |
| *** dhellmann has joined #openstack-keystone | 14:13 | |
| ayoung | hrybacki, tox is touchy | 14:13 |
| ayoung | you can rebuild the env with -r | 14:13 |
| ayoung | if you ran tox before, you might have one that is somehow out of date. | 14:13 |
| ayoung | -r takes a while to run, | 14:14 |
| ayoung | so plan according | 14:14 |
| ayoung | ly | 14:14 |
| *** afazekas_ has quit IRC | 14:16 | |
| morganfainberg | ayoung, +2 on the different pki provider types. just want to confirm with gyee that his comment is addressed (it looks like it has been) | 14:17 |
| ayoung | Yeah | 14:17 |
| hrybacki | ayoung: nods -- tried that too. Fails the same call to setup.py -- 'db type could not be determined' | 14:17 |
| ayoung | hrybacki, no longer stack trace? If you have one, fpaste it | 14:18 |
| *** nsquare has joined #openstack-keystone | 14:18 | |
| hrybacki | not much more -- http://fpaste.org/110164/14029283/ | 14:19 |
| hrybacki | the tox.ini file has 'commands = python setup.py testr --testr-args='{posargs}'' -- which I'm assuming is the command it failed on -- digging for the posargs stuff now | 14:20 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/identity-api: Cleanup region V3 documentation https://review.openstack.org/98520 | 14:23 |
| openstackgerrit | Dirk Mueller proposed a change to openstack/python-keystoneclient: Adjust Python 2.6 OSerror-on-EPIPE workaround https://review.openstack.org/96805 | 14:24 |
| hrybacki | ayoung: I see you ran into the same problem but, the file you talk about removing toward the bottom is nonexistant in my repo | 14:27 |
| *** ChanServ sets mode: +o morganfainberg | 14:28 | |
| *** morganfainberg changes topic to "Please review Keystone Specs: https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs,n,z" | 14:28 | |
| *** rwsu has joined #openstack-keystone | 14:29 | |
| ayoung | hrybacki, I got it, too | 14:35 |
| ayoung | but I think mine is legit...need to rebase | 14:35 |
| *** chandan_kumar has joined #openstack-keystone | 14:36 | |
| marekd | joesavak: still here? | 14:39 |
| *** mberlin has quit IRC | 14:43 | |
| dstanek | wha? https://wikis.forgerock.org/confluence/display/openam/OpenStack's+Keystone+integration+with+OpenAM | 14:51 |
| *** devlaps has joined #openstack-keystone | 14:52 | |
| dstanek | hrybacki: you may need to clean pycs, the py3 caches, etc. - i usually use 'git clean', but that will destroy anything not committed | 14:52 |
| marekd | dstanek: where did you get this link? | 14:53 |
| *** mberlin has joined #openstack-keystone | 14:54 | |
| dstanek | marekd: i was just search for some alternate implementations of token trusts | 14:54 |
| dstanek | s/search/searching/ | 14:54 |
| *** sbfox has joined #openstack-keystone | 14:57 | |
| marekd | dstanek: BTW, appreciate your eyes on that: https://review.openstack.org/#/c/92166/ and https://review.openstack.org/#/c/99704/ :-) | 14:58 |
| *** gordc1 has joined #openstack-keystone | 14:59 | |
| morganfainberg | devlaps, coffee today sometime? | 14:59 |
| *** leseb has quit IRC | 14:59 | |
| *** leseb_ has joined #openstack-keystone | 14:59 | |
| *** gordc has quit IRC | 15:00 | |
| dstanek | morganfainberg: you should have coffee everyday! | 15:01 |
| morganfainberg | dstanek, lol but devlaps is local, so i can bug him in person vs. just over IRC | 15:01 |
| *** gordc1 is now known as gordc | 15:02 | |
| devlaps | morganfainberg: coffee sounds good! | 15:02 |
| dstanek | morganfainberg: are you staying where you are or will you be moving? | 15:04 |
| dstanek | marekd: any chance in getting _AuthConstructor renamed to AuthConstructor? | 15:04 |
| morganfainberg | dstanek, as of right now? staying here. but lease is up in oct | 15:05 |
| morganfainberg | dstanek, no idea after that | 15:05 |
| marekd | dstanek: i think it's out of the scope of this patch... | 15:05 |
| marekd | i can prepare another one and make it a dependency. | 15:05 |
| marekd | _AuthConstructor sits in v3.py file. | 15:05 |
| marekd | dstanek: makes sense? | 15:05 |
| dstanek | marekd: if you do that i would put it first as a change to support building on top of it | 15:06 |
| marekd | dstanek: right, I will propose a patch. | 15:06 |
| *** Guest8031 is now known as mgagne | 15:08 | |
| *** mgagne has joined #openstack-keystone | 15:08 | |
| dstanek | marekd: in https://review.openstack.org/#/c/92166/24/keystoneclient/contrib/auth/v3/saml2.py do you plan on subclassing Saml2UnscopedToken and having the subclass not require username and password? | 15:09 |
| marekd | dstanek: i was more thinging about another plugin system that handles different authn methods against IdP. | 15:10 |
| hrybacki | ayoung, dstanek: no changes between this mornings patch and now -- I ran a git clean -f and I'm running tox -r now | 15:12 |
| dstanek | marekd: hmm...then i'm not sure why you can't use username and password as kwargs instead of pulling them out of the kwargs dict | 15:15 |
| dstanek | we over use kwargs all over the palce | 15:15 |
| dstanek | err...place | 15:15 |
| hrybacki | dstanek: still fails -- any other ideas? | 15:15 |
| dstanek | hrybacki: you're trying this on the client right? | 15:15 |
| hrybacki | yep | 15:16 |
| dstanek | anything in your pip.log? | 15:17 |
| dstanek | ah wait. it seems you can create the venv, but it's the tests that won't run | 15:18 |
| hrybacki | yeah | 15:18 |
| hrybacki | akin to this https://bugs.launchpad.net/testrepository/+bug/1229445 | 15:18 |
| uvirtbot | Launchpad bug 1229445 in testrepository "db type could not be determined (dup-of: 1212909)" [High,Triaged] | 15:18 |
| uvirtbot | Launchpad bug 1212909 in testrepository "ImportError _bsddb with deadsnakes python2.6 anydbm" [Critical,Triaged] | 15:18 |
| hrybacki | but I don't have that file | 15:18 |
| dstanek | yeah, the clean would have removed it | 15:19 |
| dstanek | do you have nose installed? | 15:19 |
| hrybacki | yeah -- I can run the py27 tests without any issue | 15:19 |
| dstanek | testr works fine when it works, but i find it impossible to debug | 15:19 |
| dstanek | nose always works great | 15:19 |
| hrybacki | hrm | 15:20 |
| dstanek | hrybacki: are you on master or a branch? | 15:20 |
| hrybacki | also -- I found that file ... ayoung -- your tox cheatsheet docs are wrong | 15:20 |
| hrybacki | I tried on both | 15:20 |
| hrybacki | rm .tox/.testrepository/time.dbm -> ../.testrepository/time.dbm | 15:21 |
| dstanek | master works fine for me | 15:21 |
| marekd | dstanek: so make function signature with username, password explicitely specified? | 15:22 |
| marekd | dstanek: I personally don't have an isue with that. What's the convention? What should be, in general, stored inside kwargs dict and what should be specified explicitely? | 15:23 |
| dstanek | marekd: yeah, and then you can document in the doc string | 15:23 |
| dstanek | marekd: actually username and password are required by your class, they are not actually optional | 15:24 |
| dstanek | marekd: nm, i thought you were popping | 15:24 |
| hrybacki | dstanek, ayoung++ got it thanks! it was the aforementioned launchpad bug. Peculiar. | 15:28 |
| dstanek | hrybacki: testr does so much magic that it's often hard to debug | 15:28 |
| hrybacki | noted -- how do you use nose with tox? | 15:29 |
| hrybacki | or do you just use nose for dev and let jenkins do the testr stuff? | 15:29 |
| morganfainberg | stevemar, ping | 15:29 |
| dstanek | once tox creates my venv i install nose into it: .tox/py27/bin/pip install nose | 15:29 |
| morganfainberg | stevemar, re the keystone-to-keystone federation | 15:29 |
| dstanek | then run nose from it .tox/py27/bin/nosetests | 15:29 |
| hrybacki | dstanek++ thanks, I'll give that a try | 15:30 |
| morganfainberg | joesavak, actually you might be able to answer the question for me | 15:30 |
| morganfainberg | joesavak, is there a reason not to just make keystone able to be a SAML provider instead of the extra mechanisms outlined in https://review.openstack.org/#/c/100023/3 ? we already support SAML (sortof), it would be relatively easy to make keystone-to-keystone federation work with it. | 15:32 |
| morganfainberg | cc marekd, ^ question i asked joesavak | 15:32 |
| dstanek | marekd: uggg... looking at the use of _method_params now :-( - everytime __init__ is called a kitten dies | 15:32 |
| dstanek | hrybacki: i usually only do that to debug when tox isn't helpful | 15:32 |
| dstanek | i try sticking to tox/testr because that is what everyone else does | 15:33 |
| stevemar | morganfainberg, you mean all the new SP apis? | 15:33 |
| morganfainberg | stevemar, well sortof | 15:33 |
| morganfainberg | stevemar, it doesn't hurt to have an "OK allow sending SAML assertions to XYZ" but it reads as if we're doing exactly what I was hoping we wouldn't do... | 15:34 |
| morganfainberg | make our own protocol up | 15:34 |
| marekd | morganfainberg: JOe wants to reuse protocols. | 15:34 |
| joesavak | back ! : ) | 15:34 |
| joesavak | right on - i want it extensible to support standard protocols | 15:35 |
| morganfainberg | joesavak, ++ ok i just didn't get that in the initial read-through | 15:35 |
| joesavak | SAML2 would be great but the spec is written from the standpoint that openID connect can be added later (or any fed protocol) | 15:35 |
| joesavak | Whoops - I'll take a look again | 15:35 |
| morganfainberg | joesavak, i think i might just not be comprehending it clearly | 15:36 |
| joesavak | Don't want to give the "we want to re-invent the wheel" impression with this | 15:36 |
| *** sbfox has quit IRC | 15:36 | |
| morganfainberg | joesavak, yeah thats my concern. | 15:36 |
| *** sbfox has joined #openstack-keystone | 15:36 | |
| marekd | dstanek: you mean because _method_params are empty? | 15:36 |
| *** daneyon has joined #openstack-keystone | 15:36 | |
| morganfainberg | joesavak, it might be the "knowledge" of endpoints and services of the trusted sps | 15:37 |
| morganfainberg | joesavak, i don't know how you could ever hope to keep that in sync. | 15:38 |
| joesavak | and it shouldn't be expected to be near-real-time-sync | 15:38 |
| joesavak | probably daily | 15:38 |
| marekd | morganfainberg: that's my concern too. Pooling of endpoints across remote clouds I guess... | 15:38 |
| morganfainberg | joesavak, i don't think that's even reasonable. | 15:38 |
| *** afazekas_ has joined #openstack-keystone | 15:38 | |
| morganfainberg | joesavak, it sounds like internal keystone is issuing a token for external cloud | 15:39 |
| joesavak | but this is the case where i want to build token scope quickly and i want to give clients the option of using a token across multiple clouds | 15:39 |
| morganfainberg | joesavak, ? | 15:39 |
| joesavak | yes - a single token for authorized access across multiple clouds | 15:39 |
| morganfainberg | joesavak, i see massive security concerns here. | 15:39 |
| morganfainberg | joesavak, and a lot of extra code to mitigate it | 15:40 |
| morganfainberg | joesavak, external cloud needs to trust what the internal cloud says then. this is a bad trust relationship. how do you know the internal cloud isn't compromised and issuing bad data. | 15:41 |
| morganfainberg | especially when it comes to scope | 15:41 |
| morganfainberg | internal cloud could issue a token for some totally unrelated project/domain and we'd need to verify that is allowed on the external front. | 15:42 |
| joesavak | External cloud (CSP) has internal cloud as a trusted identity provider. Internal cloud has external cloud as a trusted service provider | 15:42 |
| joesavak | both have mappings related to it to help limit scope of access as well | 15:42 |
| morganfainberg | the way i read that, you would auth against external cloud then. | 15:42 |
| morganfainberg | and it would use (e.g. SAML) to get the identity from internal cloud | 15:43 |
| morganfainberg | not auth against internal cloud and get a token for external cloud | 15:43 |
| joesavak | if you have a provisioned (non-ephmeral) identity on the external cloud you can auth there first, y es | 15:43 |
| morganfainberg | joesavak, i think the external cloud needs to be far more paranoid than you're allowing it to be | 15:43 |
| morganfainberg | the external cloud should be the only place that ever issues a token for the external cloud (or something under it's purveiw) | 15:44 |
| morganfainberg | internal cloud can only ever provide identity information - nothing else. | 15:44 |
| morganfainberg | authn vs authz | 15:44 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/100279 | 15:44 |
| joesavak | while the token scope includes external cloud endpoints, the external cloud keysotne will still verify token validity agianst the issuing identity provider | 15:45 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Simplified Mapping for Federated Authentication https://review.openstack.org/100280 | 15:45 |
| morganfainberg | joesavak, so external cloud gets the token, then verifies it against the internal cloud's keystone? | 15:45 |
| joesavak | Yes | 15:45 |
| morganfainberg | joesavak, so internal cloud is compromised | 15:46 |
| morganfainberg | joesavak, it blindly says token is ok | 15:46 |
| morganfainberg | external cloud is now compromised | 15:46 |
| joesavak | external cloud is compromised for that tenant scope only as defined by the mapping | 15:46 |
| morganfainberg | joesavak, and this is where it feels like a custom protocol | 15:47 |
| joesavak | just as though a user's user/pass was compromised | 15:47 |
| morganfainberg | joesavak, this isn't re-using federation technology, it's using the keystone tokens as the protocol | 15:47 |
| joesavak | it's using federation technology under the covers of keytone to keystone communication to obfuscate that complexity from the client | 15:48 |
| marekd | joesavak: but usually the client is somehow involved in the workflow :( | 15:49 |
| morganfainberg | marekd, ++ | 15:50 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/100279 | 15:50 |
| joesavak | the client is involved in the auth, yes - but most keystone clients are coded to send in user/pass or user/api-key today | 15:50 |
| morganfainberg | joesavak, alternatively keystone could provide identity information to another cloud, via SAML, OpenID, whatever | 15:51 |
| marekd | joesavak: I cimpletely understand your rationale behind that and I completely like it - scalable clouds! | 15:51 |
| morganfainberg | joesavak, and you request the token from the external keystone. | 15:51 |
| joesavak | morganfainberg - yes -t hat is what keystone-to-keysotne federation should be | 15:51 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/100279 | 15:51 |
| marekd | joesavak: but external keystone would have to impersonate a user. | 15:51 |
| *** zhiyan is now known as zhiyan_ | 15:52 | |
| joesavak | external keystone would setup an ephemeral identity just like any other federatied identity. | 15:52 |
| joesavak | no imperosnation needed | 15:52 |
| *** bearhands is now known as comstud | 15:53 | |
| marekd | joesavak: kind of, external keystone would have to initiate workflow on behalf of the user, and usually it's something what's client is doing. | 15:54 |
| marekd | well, this could be done somehow by mixing federation and some token sending/receiving. | 15:55 |
| joesavak | yes, agree - at that point it is acting on behalf of an identity using the trust defined by both clouds to authorize requested access to the external cloud | 15:55 |
| *** dstanek is now known as dstanek_zzz | 15:55 | |
| joesavak | FYI - jorgew will be online at 3:30p to talk through some of this too | 15:56 |
| morganfainberg | joesavak, 3:30p which timezone? :) | 15:56 |
| joesavak | 3:30p central. lol | 15:56 |
| morganfainberg | joesavak, because this really feels like the whole process is inverted | 15:56 |
| marekd | joesavak: did he have any comments regarding this? :-) | 15:56 |
| joesavak | marekd - i'll copy/paste and send via email | 15:56 |
| marekd | joesavak: thanks dude! | 15:56 |
| joesavak | he was running to a meeting - but didn't have much to add yet | 15:57 |
| stevemar | joesavak, send to wider email list :) | 15:57 |
| marekd | joesavak: i really love the business usecase, seriously! Just want to make it right :-) | 15:57 |
| joesavak | sure | 15:57 |
| joesavak | me too! : ) | 15:57 |
| morganfainberg | joesavak, usually user would have external keystone issue the token (authz), but via SAML or OpenID the authn part would occur. | 15:57 |
| *** dstanek_zzz is now known as dstanek | 15:57 | |
| *** sbfox has quit IRC | 15:58 | |
| *** sbfox has joined #openstack-keystone | 15:58 | |
| morganfainberg | joesavak, anyway.yeah lets get a clear picture. i really want this use case to work. but i have concerns with the current proposal | 15:59 |
| stevemar | morganfainberg, is there a library we could depend on that is py3 compatible - for issuing SAML tokens? | 15:59 |
| morganfainberg | stevemar, is pysaml2 compativle | 15:59 |
| morganfainberg | ? | 15:59 |
| joesavak | morgan - souonds good. | 15:59 |
| morganfainberg | ok i need coffee and breakfast :P | 16:00 |
| lbragstad | morganfainberg: coffee for breakfast? | 16:01 |
| morganfainberg | lbragstad, i've done that before :( | 16:01 |
| stevemar | morganfainberg, yes, go eat bfast! | 16:01 |
| marekd | lbragstad: pretty standard thing... | 16:01 |
| morganfainberg | it doesn't end well | 16:01 |
| lbragstad | morganfainberg: strong coffee on an empty stomach == getting lots done | 16:01 |
| lbragstad | :) | 16:01 |
| morganfainberg | lbragstad, lol negative. | 16:02 |
| *** leseb_ has quit IRC | 16:04 | |
| *** sbfox1 has joined #openstack-keystone | 16:04 | |
| *** afazekas_ has quit IRC | 16:06 | |
| *** sbfox has quit IRC | 16:08 | |
| *** jaosorior has quit IRC | 16:12 | |
| *** BAKfr has quit IRC | 16:18 | |
| *** marcoemorais has joined #openstack-keystone | 16:20 | |
| *** gyee has joined #openstack-keystone | 16:26 | |
| *** gordc has quit IRC | 16:29 | |
| *** gordc1 has joined #openstack-keystone | 16:29 | |
| *** gordc1 is now known as gordc | 16:29 | |
| *** Ju_ has quit IRC | 16:31 | |
| *** nsquare has quit IRC | 16:33 | |
| *** marcoemorais has quit IRC | 16:33 | |
| *** marcoemorais has joined #openstack-keystone | 16:33 | |
| *** marcoemorais has quit IRC | 16:33 | |
| *** marcoemorais has joined #openstack-keystone | 16:34 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Middleware tests now run under Python3 https://review.openstack.org/99669 | 16:35 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds a fork of python-ldap for Py3 testing https://review.openstack.org/95827 | 16:36 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Updates Python3 requirements to match Python2 https://review.openstack.org/95826 | 16:36 |
| *** praneshp has joined #openstack-keystone | 16:36 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Ignore broken endpoints in get_catalog https://review.openstack.org/81528 | 16:41 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes catalog URL formatting to never return None https://review.openstack.org/99988 | 16:41 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Updates keystone.catalog.core.format_url tests https://review.openstack.org/99987 | 16:41 |
| *** sbfox1 has quit IRC | 16:52 | |
| *** dstanek is now known as dstanek_zzz | 16:53 | |
| *** dstanek_zzz is now known as dstanek | 16:58 | |
| *** marcoemorais has quit IRC | 17:05 | |
| *** marcoemorais has joined #openstack-keystone | 17:05 | |
| *** sbfox has joined #openstack-keystone | 17:05 | |
| *** marcoemorais has quit IRC | 17:05 | |
| *** marcoemorais has joined #openstack-keystone | 17:06 | |
| *** marcoemorais has quit IRC | 17:06 | |
| *** marcoemorais has joined #openstack-keystone | 17:07 | |
| *** sbfox has quit IRC | 17:08 | |
| *** sbfox has joined #openstack-keystone | 17:08 | |
| dstanek | henrynash: you around? | 17:10 |
| *** sbfox1 has joined #openstack-keystone | 17:11 | |
| *** sbfox has quit IRC | 17:11 | |
| *** sbfox1 has quit IRC | 17:13 | |
| *** sbfox has joined #openstack-keystone | 17:13 | |
| *** sbfox1 has joined #openstack-keystone | 17:14 | |
| *** sbfox has quit IRC | 17:18 | |
| *** PritiDesai has joined #openstack-keystone | 17:18 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Service Token Composite Authorization Specification https://review.openstack.org/96315 | 17:21 |
| *** sri has joined #openstack-keystone | 17:22 | |
| *** sri is now known as Guest3142 | 17:22 | |
| henrynash | dstanek: hi | 17:23 |
| *** nsquare has joined #openstack-keystone | 17:23 | |
| openstackgerrit | A change was merged to openstack/identity-api: Cleanup region V3 documentation https://review.openstack.org/98520 | 17:27 |
| *** Guest3142 has left #openstack-keystone | 17:28 | |
| *** sbasam_ has joined #openstack-keystone | 17:30 | |
| *** nsquare has quit IRC | 17:32 | |
| *** leseb has joined #openstack-keystone | 17:33 | |
| dstanek | henrynash: have you done any more work on multi-backend patch? | 17:33 |
| *** topol has joined #openstack-keystone | 17:33 | |
| sbasam_ | Hey. I had a couple questions about the version of keystone in Icehouse. | 17:33 |
| henrynash | dstanek: am in the middle of splitting up the patch…hope to post the 1st part tomorrow | 17:33 |
| sbasam_ | Are there any docs on how to enable a SAML based IDP online? | 17:33 |
| dstanek | k, i'll wait for that then. i was going up update the existing patch to include my nit patches. | 17:34 |
| *** richm has quit IRC | 17:34 | |
| dstanek | now that we are not in a hurry to merge it i would rather they just be a part of the original commit | 17:34 |
| *** sbfox1 has quit IRC | 17:35 | |
| *** sbfox has joined #openstack-keystone | 17:35 | |
| henrynash | oh…OK… | 17:35 |
| henrynash | dstanek: I’d like that too…less work to split up! | 17:36 |
| *** nsquare has joined #openstack-keystone | 17:36 | |
| henrynash | I’ll post that maybe late tonight…and then we can see if others think it’s Ok as one big patch | 17:37 |
| dstanek | henrynash: if need by i can help in splitting it up - i started to do that so that i would understand it better | 17:39 |
| henrynash | dstanek: ok, thx! | 17:39 |
| *** ChanServ changes topic to "J1 Milestone June 12th! J2 and beyond blueprints require a formalized spec doc: https://git.openstack.org/cgit/openstack/keystone-specs | Please review the proposed specs." | 17:39 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: create python-keystonemiddleware repo https://review.openstack.org/95987 | 17:41 |
| rodrigods | what's the better approach to discuss a new feature? propose a spec and wait for reviews or send it to ml? | 17:42 |
| dstanek | rodrigods: can you give a real short summary of the feature? | 17:43 |
| morganfainberg | dstanek, i think https://review.openstack.org/#/c/95957/ is ready to go | 17:43 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Remove template from juno approved specs https://review.openstack.org/100310 | 17:44 |
| rodrigods | dstanek, yeah... the idea is to add a endpoint to keystone api, where other services could use it to do domain related auth checking | 17:45 |
| dstanek | morganfainberg: ha, i was just looking at that | 17:45 |
| *** leseb has quit IRC | 17:46 | |
| morganfainberg | dstanek, ++ awesome | 17:46 |
| *** richm has joined #openstack-keystone | 17:47 | |
| *** leseb has joined #openstack-keystone | 17:47 | |
| *** jaosorior has joined #openstack-keystone | 17:47 | |
| *** leseb has quit IRC | 17:51 | |
| rodrigods | dstanek, see if you can understand it: http://paste.openstack.org/show/84199/ =) | 17:51 |
| rodrigods | dstanek, if it makes sense =) | 17:51 |
| *** dims has quit IRC | 17:53 | |
| *** leseb has joined #openstack-keystone | 17:53 | |
| *** dims has joined #openstack-keystone | 17:54 | |
| *** browne has joined #openstack-keystone | 17:54 | |
| dstanek | rodrigods: what kind of rules do you anticipate having? | 17:55 |
| *** marcoemorais has quit IRC | 17:58 | |
| *** marcoemorais has joined #openstack-keystone | 17:58 | |
| *** marcoemorais has quit IRC | 17:58 | |
| *** marcoemorais has joined #openstack-keystone | 17:58 | |
| *** marcoemorais has quit IRC | 18:03 | |
| *** marcoemorais has joined #openstack-keystone | 18:03 | |
| *** harlowja has joined #openstack-keystone | 18:05 | |
| *** thedodd has joined #openstack-keystone | 18:11 | |
| *** einarf has joined #openstack-keystone | 18:14 | |
| *** harlowja has quit IRC | 18:19 | |
| *** harlowja has joined #openstack-keystone | 18:19 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: check revocation by events in auth_token middleware https://review.openstack.org/99751 | 18:24 |
| hrybacki | ayoung: if you could review that patch and give me a next recommended step that would be ++ | 18:25 |
| ayoung | hrybacki, ++ | 18:32 |
| *** morganfainberg changes topic to "Review Proposed Specs: https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs,n,z" | 18:32 | |
| ayoung | hrybacki, lets see if it passes jenkins | 18:32 |
| hrybacki | ayoung++ | 18:33 |
| ayoung | hrybacki, what do you think about moving the raise exception into 'is_signed_token_revoked' as it looks like everything is just raising upon false anyway | 18:36 |
| hrybacki | ayoung: I can't think of any good reason why not to | 18:38 |
| ayoung | err...make that 'raising upon true' | 18:38 |
| openstackgerrit | A change was merged to openstack/keystone: Password trunction makes password insecure https://review.openstack.org/77325 | 18:38 |
| hrybacki | I got what you meant :) | 18:39 |
| ayoung | hrybacki, OK...so, when you make that change, split this into two: one is the refactoring, without adding in the revocation events. The second adds the revocation events. And the second will be WIP until we can integrate events in with the rest of the change | 18:39 |
| morganfainberg | lbragstad, ping: https://review.openstack.org/#/c/95987/ the steps to extract the code is going to be really manual. | 18:40 |
| morganfainberg | lbragstad, there is no "canned" way to do it unless you're oslo-incubator | 18:40 |
| hrybacki | how exactly do I do that? | 18:40 |
| lbragstad | morganfainberg: gotcha, | 18:40 |
| lbragstad | makes sense | 18:40 |
| lbragstad | I wasn't sure if they followed a specific process for it or not | 18:40 |
| ayoung | hrybacki, split the patch? | 18:41 |
| *** nsquare has quit IRC | 18:41 | |
| *** tomoiaga has joined #openstack-keystone | 18:41 | |
| hrybacki | ayoung: nods | 18:41 |
| morganfainberg | lbragstad, there is a script to do it, but it's really going to be "use this method and adapt" | 18:41 |
| lbragstad | morganfainberg: ok | 18:41 |
| ayoung | hrybacki, http://adam.younglogic.com/2014/01/splitting-a-patch/ | 18:41 |
| morganfainberg | lbragstad, if we need another patch i'll fix the typo :) | 18:41 |
| lbragstad | morganfainberg: sweet, that takes care of my comments. | 18:42 |
| morganfainberg | lbragstad, cool | 18:42 |
| lbragstad | morganfainberg: thanks for the quick turnaround | 18:42 |
| morganfainberg | lbragstad, hehe, we need to get specs through and approved asap so.. watching the ones i can | 18:43 |
| morganfainberg | lbragstad, and i think yours is ready to go... so prodding people | 18:43 |
| lbragstad | :) | 18:43 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Default to PKIZ tokens https://review.openstack.org/98897 | 18:45 |
| morganfainberg | ayoung, https://review.openstack.org/#/c/98845/ approved | 18:50 |
| ayoung | dance party..Ungh Tss Ungh Tss Ungh Tss Ungh Tss Ungh Tss .. | 18:50 |
| morganfainberg | ayoung, yeah, lets agree that ^ never happened :P | 18:51 |
| * ayoung can't hear you over the techno | 18:51 | |
| morganfainberg | i need to go to a local rock gym :( | 18:53 |
| morganfainberg | it's been too long since i've been. | 18:53 |
| *** PritiDesai has quit IRC | 18:53 | |
| hrybacki | ayoung: ^^ simple as pie... | 18:53 |
| ayoung | morganfainberg, Don't think they have one in Paris, and might be a bit too cold for Fontainbleau | 18:54 |
| morganfainberg | def too cold in nov | 18:55 |
| *** nsquare has joined #openstack-keystone | 18:55 | |
| * morganfainberg gets back to running tempest, UUID under apache to verify apache works with uuid :P | 18:56 | |
| morganfainberg | we already know there are issues with pki... | 18:56 |
| ayoung | morganfainberg, what city are you in? | 18:56 |
| morganfainberg | ayoung, Pasadena CA | 18:56 |
| morganfainberg | ayoung, sitting on my balcony right now enjoying the sunshine | 18:56 |
| *** leseb has quit IRC | 18:56 | |
| morganfainberg | there is a rock gym in arcadia iirc, just need to drive there. | 18:57 |
| ayoung | morganfainberg, this is one time of year where Pasadena doesn't really have much on Boston. June here is wonderful | 18:57 |
| dstanek | rodrigods: took a quick peek - does that mean the middleware will have to come back to Keystone for every request? | 18:57 |
| morganfainberg | yeah but i'm closer to yosemite :P | 18:57 |
| morganfainberg | ayoung, >> i might be going in july. | 18:57 |
| ayoung | July in Yose is warm. We consider that Tuolumne meadows time | 18:58 |
| morganfainberg | actually anywhere in the sierras would be very nice right now. | 18:58 |
| morganfainberg | ayoung, i wouldn't go to the valley | 18:58 |
| ayoung | ++ | 18:58 |
| *** doddstack has joined #openstack-keystone | 18:58 | |
| ayoung | Ever been to Hetch Hetchy? Amazing part of the Park, and very few people | 18:58 |
| *** erecio has quit IRC | 18:59 | |
| morganfainberg | ayoung, oh wait nvm, the weekend i was gonna do yosemite i'm going to a bachelor party for a buddy instead in santa barbara | 18:59 |
| ayoung | Did a great Bachelor's party camping trip there | 18:59 |
| morganfainberg | ayoung, no haven't been there | 18:59 |
| morganfainberg | ayoung, last time i was in the sierras was to the lemark lakes | 18:59 |
| ayoung | Next time you go. | 18:59 |
| morganfainberg | years ago | 18:59 |
| *** erecio has joined #openstack-keystone | 18:59 | |
| ayoung | Next years Keystone mid-cycle will be a retreat in Bishop | 19:00 |
| *** gordc1 has joined #openstack-keystone | 19:00 | |
| ayoung | and the January one should be a retreat to Keystone, CO | 19:00 |
| *** thedodd has quit IRC | 19:00 | |
| morganfainberg | i kinda want to do the tuolumne camp, then into cathedral peak and down in a day, 2nd day camp again in tuolomne. (just as a "Get into shape" quick weekend) | 19:01 |
| morganfainberg | ayoung, lol | 19:01 |
| ayoung | Cathedral is a highway. Mad scene. | 19:01 |
| morganfainberg | i know, but it's a good in/out for getting back into shape | 19:01 |
| ayoung | I did Eichorn Pinnacle as one of my last trips up there | 19:01 |
| ayoung | heh...altitude can wreck you there | 19:01 |
| morganfainberg | true | 19:02 |
| morganfainberg | but i've done it before. if you pay attention it's doable | 19:02 |
| ayoung | the mathis crest would be on my short list, actually, | 19:02 |
| *** gordc has quit IRC | 19:02 | |
| morganfainberg | or well.. make sure you are aware if things are going south | 19:02 |
| morganfainberg | mathis crest i hear is nice. | 19:02 |
| *** nsquare has quit IRC | 19:02 | |
| morganfainberg | i used to do joshua tree more than sierras.. unfortunately, jtree in summer... ugh burn your hands on the rock hot | 19:03 |
| *** gordc1 is now known as gordc | 19:03 | |
| ayoung | Heh | 19:03 |
| ayoung | yeah, Bishop we used to say in July you chase the shade and in November you chase the sun | 19:03 |
| morganfainberg | maybe i'll do tahquitz rock this summer | 19:04 |
| *** nsquare has joined #openstack-keystone | 19:06 | |
| *** dims has quit IRC | 19:07 | |
| *** einarf has quit IRC | 19:08 | |
| hrybacki | ayoung: lots of the unittests want 401's back. Obviously I can modify the unittests to look for the exception but will this break any functionality? Not sure why it was built this way in the first place | 19:09 |
| *** elmiko has joined #openstack-keystone | 19:09 | |
| ayoung | hrybacki, they should still get the 401, no? | 19:09 |
| elmiko | hey all, i'm curious about trusts/delegation. are they available in v3 only? | 19:10 |
| hrybacki | never gets that far, the exception is raised inside of is_signed_token_revoked() | 19:10 |
| rodrigods | dstanek, sorry, was afk. Yeah, basically it would need to come back to Keystone for every action with an URL in the rule | 19:11 |
| morganfainberg | hrybacki, what are you changing away from the 401s? everything should get the same response, unless there is a very good reason to change it | 19:14 |
| *** einarf has joined #openstack-keystone | 19:16 | |
| hrybacki | morganfainberg: moving the raise from https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L904 to https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L1137 | 19:16 |
| hrybacki | but that short circuited a lot of other things | 19:17 |
| hrybacki | or at least I believe it did from the regression faults it caused | 19:17 |
| morganfainberg | hrybacki, i think that is going to be hard to solve, legitimately we rely on the 401 happening. you probably need some policy.json fixes where the 401 is required as well | 19:18 |
| *** dims has joined #openstack-keystone | 19:18 | |
| hrybacki | morganfainberg, ayoung: for another day then? | 19:18 |
| morganfainberg | hrybacki, i don't think you can just remove the raise, and changing the unit test is probably not correct to begin with (maybe with exception of unscoped actions) | 19:18 |
| morganfainberg | hrybacki, maybe the best plan is make it an option (defaults to old behavior) | 19:19 |
| morganfainberg | hrybacki, enforce_token_required=True | 19:19 |
| ayoung | morganfainberg, are we raising two different excpetions, and giving them different return codes? | 19:19 |
| morganfainberg | ayoung, are we? | 19:19 |
| ayoung | morganfainberg, should be 401 across the board for these otherwise | 19:19 |
| * hrybacki scratches head | 19:20 | |
| morganfainberg | ayoung, this is the raise 401 on no token, right hrybacki ? | 19:20 |
| morganfainberg | oh oh | 19:20 |
| hrybacki | among others yes | 19:20 |
| ayoung | hrybacki, I think youa re going to far | 19:20 |
| hrybacki | raise 401 on revoked token, revoked token 256... | 19:20 |
| morganfainberg | hrybacki, why are you looking to remove from the is_revoked check? | 19:21 |
| ayoung | hrybacki just move the raise into hrybacki | 19:21 |
| morganfainberg | if the token is revoked, 401 is correct though | 19:21 |
| ayoung | heh | 19:21 |
| ayoung | hrybacki just move the raise into is_signed_token_revoked | 19:21 |
| hrybacki | ayoung: that's whay I did | 19:21 |
| hrybacki | what* | 19:21 |
| morganfainberg | hrybacki, ah | 19:22 |
| ayoung | where else is it called, I wonder | 19:22 |
| morganfainberg | ayoung, yeah | 19:22 |
| morganfainberg | hrybacki, sorry i'm playing catchup ;) sounds like you're going the right direction | 19:22 |
| hrybacki | morganfainberg: no worries -- I'm doing the same with your codebase :P | 19:23 |
| *** stevemar has quit IRC | 19:23 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/python-keystoneclient: Do not expose Token IDs in debug output https://review.openstack.org/99432 | 19:23 |
| ayoung | hrybacki, I think you goofed | 19:23 |
| *** stevemar has joined #openstack-keystone | 19:23 | |
| hrybacki | ayoung: ? | 19:23 |
| ayoung | is_signed_token_revoked is only called from _validate_user_token | 19:23 |
| ayoung | there should be no change in logic... | 19:23 |
| ayoung | can you paste your change? | 19:24 |
| *** PritiDesai has joined #openstack-keystone | 19:24 | |
| *** vhoward has quit IRC | 19:24 | |
| *** dstanek is now known as dstanek_zzz | 19:25 | |
| *** PritiDesai has quit IRC | 19:25 | |
| hrybacki | ayoung: http://fpaste.org/110267/94673314/ | 19:25 |
| *** erecio has quit IRC | 19:25 | |
| *** erecio has joined #openstack-keystone | 19:26 | |
| marekd | dstanek_zzz: thanks for the review! | 19:26 |
| ayoung | hrybacki, hmmm | 19:26 |
| *** bobt has joined #openstack-keystone | 19:26 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Service Token Composite Authorization Specification https://review.openstack.org/96315 | 19:26 |
| *** vhoward has joined #openstack-keystone | 19:27 | |
| hrybacki | ayoung: there are two problems | 19:27 |
| ayoung | hrybacki, so, OK, a lot of the tests that do true/false now would be raise/don't raise | 19:28 |
| hrybacki | there is a test that calls the is_signed_token_revoked directly expecting True (which is correct before) | 19:28 |
| hrybacki | yes | 19:28 |
| ayoung | tests can be changed. We should also make the call private | 19:28 |
| ayoung | _is_signed_token_revoked | 19:29 |
| hrybacki | I just wanted to make sure that it wouldn't break anything else | 19:29 |
| ayoung | nope, that is acceptable | 19:29 |
| ayoung | when you said 401, I was concerned | 19:29 |
| hrybacki | well, other things broke as well | 19:29 |
| hrybacki | the second problem ;) | 19:29 |
| hrybacki | e.g. test_revoked_token_receives_401 | 19:30 |
| ayoung | _check_signed_token_revoked | 19:30 |
| ayoung | that should still get a 401 | 19:30 |
| hrybacki | where is that? | 19:31 |
| ayoung | hrybacki, that is the name to change the function to | 19:32 |
| ayoung | hrybacki, You might have a type | 19:33 |
| ayoung | typo | 19:33 |
| ayoung | remove your changes inside the if self.check_revocations_for_cached: block | 19:33 |
| ayoung | hrybacki, http://paste.fedoraproject.org/110268/40294723/ I get just the tests failing due to the exception | 19:34 |
| ayoung | hrybacki, I think you are on track | 19:36 |
| morganfainberg | bobt, welcome | 19:38 |
| hrybacki | ayoung: okay, same, now it's only failing on things wanting to see True | 19:40 |
| ayoung | hrybacki, and those tests can be changed | 19:41 |
| hrybacki | yes, to self.assertRaises(... | 19:41 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Kerberos as method name https://review.openstack.org/95989 | 19:41 |
| *** dstanek_zzz is now known as dstanek | 19:43 | |
| ayoung | henrynash, with your currently merged patch, do we have the capability of running an install with Mysql for the default domain, and then mounting the LDAP domain as a second step? | 19:44 |
| ayoung | or do we need the patch that is still up for review for that? | 19:44 |
| ayoung | https://review.openstack.org/#/c/74214/ morganfainberg you could probably answer that, too | 19:45 |
| henrynash | ayoung: you mean, adding the LDAP specific to a given domain at a later date? | 19:47 |
| ayoung | henrynash, exactly | 19:48 |
| henrynash | ayoung: sure, I think so….you can change add specifc LDAP for a given domain at any point, you wuold need to restart keystone (it only reads the configs on startup) | 19:49 |
| ayoung | henrynash, ooooh | 19:50 |
| ayoung | henrynash, and then each ldap access would end up with an entry in the shadow table? | 19:50 |
| henrynash | ayoung: hold it, which patch are you talking about... | 19:50 |
| henrynash | ayoung: I thought you were talking about the already merged patch.... | 19:51 |
| henrynash | ayoung: i.e. Havana | 19:51 |
| ayoung | henrynash, nope | 19:51 |
| ayoung | I meant the one that made it into Juno 1 | 19:51 |
| ayoung | but I see the shadow table is not in yet | 19:51 |
| *** praneshp has quit IRC | 19:52 | |
| henrynash | ayoung: it dodn’t make it into Juno1, the concensus view was to ditch the idea of two public ID generators and go for sha1 only | 19:52 |
| henrynash | and it was too late in the day to get that all fixed up to get it into J1 | 19:53 |
| henrynash | will be posting a new version of teh patch tonight or tomorrow | 19:53 |
| hrybacki | ayoung: okay, refactoring done, passing all the tox tests -- now you want me to split the patch? | 19:54 |
| *** tomoiaga has left #openstack-keystone | 19:55 | |
| ayoung | hrybacki, yep. The refactoring can be reviewed and merge on its own, and the other goes as WIP but shows people why the refactoring is necessary | 19:55 |
| ayoung | the events portion of the patch should get a new changeid | 19:55 |
| hrybacki | okay -- not going to lie, your blog confused me more than anything | 19:56 |
| ayoung | hrybacki, my work here is done | 19:59 |
| hrybacki | heh | 19:59 |
| hrybacki | I've created just enough rope... | 20:00 |
| ayoung | hrybacki, ok start by creating a new branch, so you can mess with things without losing your own changes | 20:01 |
| ayoung | makes sure everything is committed | 20:01 |
| ayoung | then git checkout -b split-auth-token | 20:01 |
| ayoung | now, it doesn't matter what changes you make, so long as you leave your old branch alone. | 20:02 |
| ayoung | git log --format=%B -n 1 HEAD > /tmp/commitmsg.txt will make sure you have your commit message saved in its own file, to include the commit it | 20:02 |
| ayoung | change id | 20:02 |
| hrybacki | git commit or --amend? | 20:02 |
| ayoung | neither | 20:03 |
| *** jsavak has joined #openstack-keystone | 20:03 | |
| ayoung | git log --format=%B -n 1 HEAD > /tmp/commitmsg.txt | 20:03 |
| hrybacki | 16:01 ayoung: makes sure everything is committed | 20:03 |
| *** devlaps has quit IRC | 20:03 | |
| ayoung | hrybacki, ah, make sure that you have everything in the one patch you are going to split | 20:03 |
| ayoung | hrybacki, you might as well post that for review | 20:03 |
| ayoung | that way we have a decent baseline | 20:03 |
| hrybacki | with the refactoring? | 20:03 |
| ayoung | hrybacki, ah...one sec | 20:03 |
| ayoung | yeah...but post it thist way | 20:04 |
| *** marcoemorais has quit IRC | 20:04 | |
| *** marcoemorais has joined #openstack-keystone | 20:04 | |
| ayoung | hrybacki, so, yeah, it would be amend | 20:04 |
| *** joesavak has quit IRC | 20:05 | |
| hrybacki | okay | 20:05 |
| ayoung | hrybacki, to make sure you don't resubmit an older version of the patch that you are on top of use this magic command git push gerrit HEAD:refs/for/master | 20:05 |
| *** einarf has quit IRC | 20:05 | |
| ayoung | https://review.openstack.org/#/c/81166/17 is ready to go, and you might not have rebased | 20:05 |
| ayoung | using the "push" version I have above only submits your changes, and does not rebase | 20:06 |
| ayoung | well, does not rebase in your repo, but it will rebase in gerrit, it just does the right thing | 20:06 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: check revocation by events in auth_token middleware https://review.openstack.org/99751 | 20:06 |
| hrybacki | I think I did rebase it with 17 in a bit | 20:07 |
| hrybacki | commit f07ba232efe7549ae3ce088170f4eabb61ab70a6 | 20:07 |
| ayoung | hrybacki, its ok. so long as it didn't trigger a resubmit of the events patch | 20:10 |
| ayoung | now... | 20:10 |
| *** dhellmann has quit IRC | 20:10 | |
| ayoung | hrybacki, to split the patch, start with checking out a new branch | 20:11 |
| *** dhellmann has joined #openstack-keystone | 20:12 | |
| ayoung | hrybacki, um, I think you lost some changes there | 20:12 |
| ayoung | https://review.openstack.org/#/c/99751/5/keystoneclient/tests/test_auth_token_middleware.py,cm | 20:12 |
| ayoung | hrybacki, I think you lost some of the PKIZ tests | 20:12 |
| *** dims has quit IRC | 20:14 | |
| *** dims has joined #openstack-keystone | 20:15 | |
| hrybacki | ayoung: hrm, how would that have even happened? | 20:24 |
| ayoung | hrybacki, maybe your version of the patch was older than code that merged, but that seems wierd | 20:24 |
| openstackgerrit | A change was merged to openstack/keystone-specs: Propose api-validation blueprint https://review.openstack.org/95957 | 20:24 |
| ayoung | hrybacki, need to figure out where those changes are from | 20:25 |
| morganfainberg | fyi, ^ merged specs, those are the ones we voted we liked last meeting. | 20:25 |
| ayoung | if they are from master than do | 20:25 |
| hrybacki | I must have deleted them somehow | 20:25 |
| ayoung | git checkout master keystoneclient/tests/test_auth_token_middleware.py | 20:26 |
| *** einarf has joined #openstack-keystone | 20:26 | |
| ayoung | that will lose your changes, but they should be relatively easy to reinstate | 20:26 |
| *** jcromer has joined #openstack-keystone | 20:26 | |
| hrybacki | it'll lose all of the revocation events changes | 20:27 |
| *** CaioBrentano has joined #openstack-keystone | 20:27 | |
| *** dstanek is now known as dstanek_zzz | 20:28 | |
| CaioBrentano | I'm getting these errors on keystone log | 20:28 |
| CaioBrentano | Could not load 'rabbit': No module named amqp | 20:28 |
| CaioBrentano | No module named amqp | 20:28 |
| CaioBrentano | Do I have to install ampq modules even if I'm not using any amqp service? | 20:29 |
| morganfainberg | CaioBrentano, which version of Keystone? How was it installed/deployed? | 20:29 |
| *** jorgew has joined #openstack-keystone | 20:29 | |
| CaioBrentano | morganfainberg: version 2014.1 | 20:29 |
| morganfainberg | CaioBrentano, thats ... icehouse right? | 20:30 |
| CaioBrentano | morganfainberg: It was deployed by pip install | 20:30 |
| CaioBrentano | morganfainberg: yep | 20:30 |
| jsavak | morganfainberg, stevemar, jorgew - ready to talk federation? | 20:30 |
| morganfainberg | jsavak, in one moment just helping CaioBrentano right now | 20:30 |
| morganfainberg | CaioBrentano that looks like an issue with perhaps kombu or one of the oslo.messaging dependencies not being installed | 20:31 |
| jsavak | ok, cool. We're free until 4 then off to another meeting (in 30 mins) | 20:31 |
| *** leseb has joined #openstack-keystone | 20:31 | |
| morganfainberg | jsavak, but we can def chat... *pokes stevemar* ;) | 20:31 |
| CaioBrentano | morganfainberg: I got this kombu module error… I've installed and started theses other errors | 20:32 |
| morganfainberg | CaioBrentano, is keystone failing to start? or are you just seeing those as messages in the log? and can you post ( paste.openstack.org ) your keystone.conf (please scrub/remove passwords/sensitive data) | 20:32 |
| ayoung | hrybacki, just the changes to the tests | 20:33 |
| CaioBrentano | morganfainberg: actually it appears to be working ok… i'm getting tokens and it's working… but i'm getting theses errors repeatedly | 20:33 |
| ayoung | hrybacki, yeah, chasing the gate. CHasing the dream | 20:33 |
| stevemar | morganfainberg, jsavak ahoy hoy | 20:33 |
| *** praneshp has joined #openstack-keystone | 20:34 | |
| *** radez is now known as radez_g0n3 | 20:34 | |
| jorgew | stevemar, jsavak, morganfainberg, hey I'm ready when you guys are | 20:34 |
| hrybacki | ayoung: hmm, I checked out test_auth_token_middleware from origin/master -- 38 fails now, lol | 20:34 |
| morganfainberg | CaioBrentano, ok that probably means it's just having a hard time loading up the messaging library, possibly just a typo in your config or in the module to use for messaging/notifications | 20:34 |
| morganfainberg | jorgew, jorgew, stevemar, i'm ready | 20:34 |
| ayoung | hrybacki, looks like you have your work cut out for you | 20:34 |
| morganfainberg | CaioBrentano, taking a look at the config is likely the easiest route to see if something looks off (sometimes an extra pair of eyes helps) | 20:35 |
| jsavak | alrighty | 20:35 |
| stevemar | morganfainberg, anything specific you wanted to chat about regarding federation fun | 20:35 |
| *** leseb has quit IRC | 20:35 | |
| jorgew | morganfainberg, jsavak mentioned you had some concerns with the SP proposal. I'd like to understand the concern. Did those comments make it to the review? | 20:35 |
| hrybacki | ayoung: how often do you rebase 81166 against origin/master? | 20:36 |
| jsavak | review is: https://review.openstack.org/#/c/100023/ | 20:36 |
| *** radez_g0n3 is now known as radez | 20:36 | |
| ayoung | hrybacki, ...every so often? | 20:36 |
| ayoung | hrybacki, if it goes stale, or gets a -1 or soemthing | 20:36 |
| jsavak | major concerns seem to be security, re-creating the wheel, and confusion about service provider vs idp, right? | 20:36 |
| hrybacki | ayoung: hmmmm. haven't rebased against it with 99751 | 20:36 |
| ayoung | hrybacki, lets see... | 20:37 |
| stevemar | jsavak, jorgew i think morganfainberg wants to know why don't we just use pysaml and make keystone issue saml assertions? | 20:37 |
| morganfainberg | jorgew, yeah. | 20:37 |
| ayoung | ok, I rebsed the events one last... | 20:37 |
| morganfainberg | stevemar, ++ also marekd had similar thoughts | 20:37 |
| morganfainberg | afaict | 20:37 |
| ayoung | jun 13 | 20:37 |
| jorgew | morganfainberg, I think we want to allow users to burst to other clouds without dealing with the idocyncraisis of the SAML protocol directly and to contiune to use the same tools. | 20:38 |
| hrybacki | should I do a rebase every day or so for any given change? | 20:38 |
| ayoung | hrybacki, I have something about to merge (I hope, probably just jinxed it) | 20:38 |
| jorgew | morganfainberg, Also there is a good use case for having the user not even know they are bursting…think resellers. | 20:38 |
| CaioBrentano | morganfainberg: thanks for your help… just to finish… do I ignore the errors for now (because its working fine) or do I install all the missing modules? | 20:38 |
| ayoung | actually, that is keystone, though | 20:38 |
| morganfainberg | jorgew, but what is being proposed is opening potential security concerns, the external cloud needs to trust the the internal cloud implictly | 20:39 |
| ayoung | nothing in the queue for keystoneclient | 20:39 |
| ayoung | hrybacki, but https://review.openstack.org/#/c/100152/ looks pretty invasive | 20:39 |
| morganfainberg | jorgew, an internal cloud issuing tokens on behalf of an external cloud is risky | 20:39 |
| ayoung | and is going to cause a rebase effort... | 20:39 |
| jsavak | morganfainberg - the trust is explicit. Must be setup within both internal and external cloud | 20:39 |
| jorgew | morganfainberg, How is that different than regular federation. If someone compromises the IDP then that person can send assertions, get tokens right? | 20:39 |
| hrybacki | okay | 20:40 |
| morganfainberg | jorgew, there is a difference between accepting an authentication from a remote source and authorization | 20:40 |
| jorgew | jsavak, right, trust should not be given lightly. | 20:40 |
| morganfainberg | jorgew, most federation is authentication only. | 20:40 |
| morganfainberg | jorgew, the service (in this case the external cloud) would still handle the authz part | 20:41 |
| morganfainberg | jorgew, this proposal puts both authn and authz on a remote, not in control of the local cloud, service | 20:41 |
| hrybacki | I'm not sure how all of that affects me in this case though. Lesson to be learned: rebase against origin/master often? Now I have to do a huge rebase with what I have against origin/master? | 20:41 |
| ayoung | hrybacki, its just part of the job | 20:42 |
| hrybacki | oh I'm not complaining, I just want to make sure I'm tracking | 20:42 |
| morganfainberg | jorgew, that is my #1 concern. I have some other concerns on this being a new "protocol" (using keystone tokens to transit data?) or if it's SAML or OpenID on the backend, how is that negotiation initiated | 20:42 |
| morganfainberg | jorgew, because those usually require user-interaction | 20:42 |
| morganfainberg | jorgew s/user/client | 20:42 |
| ayoung | hrybacki, I'll probably end up rebasing against that myself for the revoke events. Big cleanups are part of the course | 20:42 |
| jorgew | morganfainberg, The proposal is not suggesting that we do anything different in terms of federation than we are now. Only to hide some of the flow (or orchestration) for handling SAML stuff. Authz continues to work as it does now. | 20:42 |
| morganfainberg | CaioBrentano, i'll look in a moment. | 20:43 |
| morganfainberg | jorgew, that is not clear, it looks like authz is being provided by the internal cloud | 20:43 |
| morganfainberg | jorgew, not by the external cloud | 20:43 |
| morganfainberg | jorgew, which Keystone is issuing the token that is meant to be used in the external cloud? | 20:44 |
| jorgew | morganfainberg, the underling protocols remain the same. The issue is how we hook things together, maybe we need to make that more clear in the blueprint. | 20:44 |
| jorgew | morganfainberg, it depends on how you setup the relationships :-) | 20:44 |
| jorgew | morganfainberg, one keystone can act as an identity provider, that is the one that issues the token. | 20:45 |
| jorgew | morganfainberg, in otherwords the keystone that knows about the user. | 20:45 |
| morganfainberg | jorgew, ok assume the IDP is internal keystone, SP is external | 20:45 |
| jorgew | morganfainberg, k | 20:46 |
| morganfainberg | jorgew, walk me through the auth steps please. (sorry, just trying to understand the proposal here so we can make it clear) | 20:46 |
| *** vhoward has quit IRC | 20:46 | |
| jorgew | morganfainberg, no worries and to be honest we need to work this out as well…but here's how I see it… | 20:46 |
| jorgew | morganfainberg, off line there is a relationship established between IDP and SP via some magic keys are echanged and mappings are made. | 20:47 |
| morganfainberg | jorgew, ok. | 20:47 |
| jorgew | morganfainberg, when a user logs in to IDP they get a service catalog that has endpoints from SP. | 20:47 |
| morganfainberg | jorgew, so this is User authenticates with internal keystone here, and gets a token back | 20:48 |
| morganfainberg | ? | 20:48 |
| jorgew | morganfainberg, correct. The token can then be used to hit the SP endpoint. | 20:48 |
| morganfainberg | and here is where we're now insecure | 20:49 |
| jorgew | morganfainberg, the SP may introspect the token, know that it came from the IDP and know there is a trust there. | 20:49 |
| *** vhoward has joined #openstack-keystone | 20:49 | |
| *** dstanek_zzz is now known as dstanek | 20:49 | |
| morganfainberg | the way the middleware works, if the token is considered valid, it is valid and trusted | 20:49 |
| morganfainberg | so either you're then asking the external keystone on every action if it is a "valid token", or you trust it, and internal idp can issue tokens for anything in the entire external cloud | 20:50 |
| jorgew | morganfainberg, obviously, we'll have to change middleware to deal with trusts between clouds….maybe that's what we're missing in the spec | 20:50 |
| morganfainberg | jorgew, i think this is backwards | 20:50 |
| morganfainberg | jorgew, the external cloud should still issue the token | 20:50 |
| morganfainberg | just the authn and identity (user/group) bits should come from internal | 20:50 |
| *** marcoemorais has quit IRC | 20:50 | |
| *** marcoemorais has joined #openstack-keystone | 20:51 | |
| jorgew | morganfainberg, the middle ware will need to understand what certs it accepts and validate the tokens much as it does now | 20:51 |
| morganfainberg | yes, it is a better UX, but what you're proposing would be like if google+ had an agreement with FB, but instead of when you login to google+ it redirects you to FB, it would just grab all your private data from FB, never asking because you authenticated w/ Google+. | 20:52 |
| jorgew | morganfainberg, can you explain how that is more sucure than the other.? | 20:52 |
| *** leseb has joined #openstack-keystone | 20:52 | |
| morganfainberg | redirect in that scenario would be you needing to auth the request on fb's site. | 20:52 |
| *** radez is now known as radez_g0n3 | 20:52 | |
| morganfainberg | jorgew, if the internal keystone just offers the identity bits, the workflow looks like this | 20:53 |
| morganfainberg | user requests token from external cloud's keystone | 20:53 |
| morganfainberg | wait.. | 20:54 |
| morganfainberg | sorry let me start over. | 20:54 |
| morganfainberg | no i was right... | 20:54 |
| morganfainberg | ok | 20:55 |
| morganfainberg | user requests token from external cloud | 20:55 |
| morganfainberg | external cloud knows this is a federated request, and initiates the authentication | 20:55 |
| morganfainberg | authentication then requires the user to interact directly with the internal cloud to auth, in turn an assertion is issued indicating authn was correct | 20:56 |
| *** erecio has quit IRC | 20:56 | |
| morganfainberg | the assertion is then acted upon within external keystone, and issues the appropriate roles in a token | 20:56 |
| morganfainberg | that token is now valid for the external cloud | 20:56 |
| morganfainberg | -- | 20:56 |
| morganfainberg | this is more secure simply because the authz is 100% controlled by the external cloud. | 20:56 |
| openstackgerrit | A change was merged to openstack/keystone: Allow for multiple PKI Style Providers https://review.openstack.org/98845 | 20:56 |
| jorgew | morganfainberg, (okay one sec…computing…) | 20:57 |
| jsavak | the client would end up with multiple tokens, right? | 20:58 |
| jsavak | one for each cloud? | 20:58 |
| morganfainberg | jsavak, yes. | 20:58 |
| morganfainberg | jsavak, and you could indicate via the extension being proposed that X cloud (external) is a valid target - to burst to | 20:58 |
| jorgew | morganfainberg, I'm sorry I'm not following. AuthZ is always 100% controlled by the external cloud (SP). In both proposals. What do you mean by AuthZ…the assignment of roles? | 20:58 |
| morganfainberg | jsavak, no authz is not controlled by the external cloud in your model | 20:59 |
| morganfainberg | jsavak sorry, jorgew ^ | 20:59 |
| *** juanmo has quit IRC | 20:59 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Default to PKIZ tokens https://review.openstack.org/98897 | 20:59 |
| jorgew | morganfainberg, by external cloud you mean the SP or the IDP…sorry | 21:00 |
| morganfainberg | jorgew, the token itself is authorization - asking keystone every time if this token is allowed because it came from an external source is a really ugly way to handle it (external cloud would need to check the token every time) | 21:00 |
| morganfainberg | jorgew, sp | 21:00 |
| morganfainberg | jorgew, sorry | 21:00 |
| *** marcoemorais has quit IRC | 21:00 | |
| *** marcoemorais has joined #openstack-keystone | 21:00 | |
| jsavak | authorization contains policy informaiton point, policy enforcement point, policy decision point and policy admin point. By Jorge's example the PIP is both internal and external (broadcasted endpoints). The PAP is external. The PDP and PEP is external. Most of the authZ is external... | 21:00 |
| jorgew | morganfainberg, we don't nessesarly have to always go back to the external source if we keep track of trusts…much how PKI works today. | 21:00 |
| *** marcoemorais has quit IRC | 21:01 | |
| jorgew | jsavak, morganfainberg, I'm sorry guys I have to run :-( | 21:01 |
| jsavak | ok - when can you join again jorgew? | 21:01 |
| morganfainberg | jorgew, no worries. | 21:01 |
| jorgew | jsavak, morganfainberg, I'm free most of the morning tomorrow my time from 9am to noon. I feel that if we can just get the terminology right we've made progress :-) | 21:02 |
| morganfainberg | jorgew, sure. | 21:02 |
| jorgew | jsavak, morganfainberg, when can you guys meet? | 21:02 |
| morganfainberg | jorgew, i'm Pacific but usually am online starting ~7pacific each day | 21:02 |
| *** marcoemorais has joined #openstack-keystone | 21:02 | |
| *** marcoemorais has quit IRC | 21:03 | |
| *** marcoemorais has joined #openstack-keystone | 21:03 | |
| morganfainberg | CaioBrentano, can you use paste and show me an example of the logs w/ the error in it? I'm not seeing anything (openly) wrong in your config | 21:03 |
| jorgew | jsavak, morganfainberg, how about 8 am pacific, 10 am central? | 21:03 |
| *** marcoemorais has quit IRC | 21:03 | |
| morganfainberg | jorgew, works for me | 21:03 |
| jsavak | that works! Thanks jorgew | 21:04 |
| *** marcoemorais has joined #openstack-keystone | 21:04 | |
| jorgew | jsavak, morganfainberg, okay gotta run see you then | 21:04 |
| *** jorgew has left #openstack-keystone | 21:04 | |
| *** sbfox has quit IRC | 21:04 | |
| *** jcromer has quit IRC | 21:04 | |
| morganfainberg | jsavak, yeah i wasn't using the acronyms and names there, but even if you substitute that (happy to work on using a more common vocab), i think this approach is just backwards | 21:05 |
| morganfainberg | jsavak, we'll talk more tomorrow. | 21:05 |
| *** leseb has quit IRC | 21:05 | |
| jsavak | good deal. : ) | 21:05 |
| *** leseb has joined #openstack-keystone | 21:05 | |
| *** marcoemorais has quit IRC | 21:06 | |
| *** marcoemorais has joined #openstack-keystone | 21:06 | |
| *** sbfox has joined #openstack-keystone | 21:09 | |
| *** leseb has quit IRC | 21:10 | |
| *** dhellmann has quit IRC | 21:11 | |
| *** marcoemorais has quit IRC | 21:12 | |
| *** marcoemorais has joined #openstack-keystone | 21:13 | |
| *** dhellmann has joined #openstack-keystone | 21:13 | |
| *** diegows has quit IRC | 21:15 | |
| *** gordc1 has joined #openstack-keystone | 21:17 | |
| *** diegows has joined #openstack-keystone | 21:17 | |
| *** gordc has quit IRC | 21:18 | |
| *** elmiko is now known as _elmiko | 21:20 | |
| *** jaosorior has quit IRC | 21:22 | |
| *** leseb has joined #openstack-keystone | 21:22 | |
| *** diegows has quit IRC | 21:23 | |
| *** PritiDesai has joined #openstack-keystone | 21:27 | |
| *** leseb has quit IRC | 21:27 | |
| *** diegows has joined #openstack-keystone | 21:27 | |
| *** hrybacki_ has joined #openstack-keystone | 21:30 | |
| openstackgerrit | A change was merged to openstack/identity-api: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/60489 | 21:31 |
| *** gordc1 is now known as gordc | 21:33 | |
| *** hrybacki has quit IRC | 21:33 | |
| *** hrybacki_ has quit IRC | 21:35 | |
| *** leseb has joined #openstack-keystone | 21:36 | |
| *** leseb has quit IRC | 21:40 | |
| *** dstanek is now known as dstanek_zzz | 21:41 | |
| *** dstanek_zzz is now known as dstanek | 21:41 | |
| morganfainberg | nkinder, hey, if you have some time to look over and help on the federation keystone-to-keystone spec i'd appreciate it. I know marekd and stevemar are also looking at it, but more security minds are good :) [ if you don't mind puttnig on the security hat for it ] | 21:44 |
| *** diegows has quit IRC | 21:44 | |
| morganfainberg | marekd, not sure when you're around, would like you involved w/ the discussion on keystone-to-keystone federation | 21:49 |
| *** diegows has joined #openstack-keystone | 21:49 | |
| nkinder | morganfainberg: this one? https://review.openstack.org/#/c/100023/ | 21:50 |
| *** joesavak has joined #openstack-keystone | 21:50 | |
| morganfainberg | nkinder, yeah | 21:50 |
| morganfainberg | nkinder, it's... setting off alarm bells in my head when i read it, but i might be just mis-reading it. | 21:50 |
| morganfainberg | nkinder, extra eyes, smarter people you know.. the folks that know this stuff :) | 21:51 |
| *** henrynash has quit IRC | 21:51 | |
| morganfainberg | marekd, you have a great understanding of what needs to go on under the hood, and want to make sure things aren't missed :) | 21:52 |
| *** jsavak has quit IRC | 21:52 | |
| *** nkinder has quit IRC | 21:55 | |
| *** dstanek is now known as dstanek_zzz | 22:02 | |
| *** daneyon has quit IRC | 22:03 | |
| *** daneyon has joined #openstack-keystone | 22:03 | |
| *** marcoemorais has quit IRC | 22:04 | |
| *** marcoemorais has joined #openstack-keystone | 22:05 | |
| *** dstanek_zzz is now known as dstanek | 22:05 | |
| *** marcoemorais has quit IRC | 22:05 | |
| *** marcoemorais has joined #openstack-keystone | 22:05 | |
| *** marcoemorais has quit IRC | 22:07 | |
| *** marcoemorais has joined #openstack-keystone | 22:08 | |
| *** _TheDodd_ has joined #openstack-keystone | 22:20 | |
| *** doddstack has quit IRC | 22:23 | |
| *** lbragstad has quit IRC | 22:24 | |
| *** stevemar has quit IRC | 22:27 | |
| *** daneyon has quit IRC | 22:30 | |
| *** einarf has quit IRC | 22:35 | |
| *** leseb has joined #openstack-keystone | 22:36 | |
| *** leseb has quit IRC | 22:41 | |
| *** _TheDodd_ has quit IRC | 22:46 | |
| *** dstanek is now known as dstanek_zzz | 22:48 | |
| *** PritiDesai has quit IRC | 22:53 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token cached token handling https://review.openstack.org/96786 | 22:53 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token _cache_get checks token expired https://review.openstack.org/96785 | 22:53 |
| *** thedodd has joined #openstack-keystone | 22:56 | |
| *** gordc has quit IRC | 23:02 | |
| *** dstanek_zzz is now known as dstanek | 23:09 | |
| *** joesavak has quit IRC | 23:16 | |
| *** thedodd has quit IRC | 23:18 | |
| *** dstanek is now known as dstanek_zzz | 23:19 | |
| *** jamielennox|away is now known as jamielennox | 23:21 | |
| *** dstanek_zzz is now known as dstanek | 23:22 | |
| *** sbfox has quit IRC | 23:26 | |
| *** dstanek is now known as dstanek_zzz | 23:32 | |
| *** leseb has joined #openstack-keystone | 23:37 | |
| *** dims has quit IRC | 23:41 | |
| *** leseb has quit IRC | 23:42 | |
| *** topol has quit IRC | 23:47 | |
| *** dstanek_zzz is now known as dstanek | 23:47 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!