| *** jamielennox|away is now known as jamielennox | 00:01 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Extracting get group roles for project logic to drivers. https://review.openstack.org/86025 | 00:09 |
|---|---|---|
| morganfainberg | dstanek, this looks like it's heat | 00:11 |
| morganfainberg | dstanek, doing a delete stack | 00:11 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session loading from conf https://review.openstack.org/95015 | 00:15 |
| *** dstanek is now known as dstanek_zzz | 00:24 | |
| *** stevemar has joined #openstack-keystone | 00:38 | |
| stevemar | wchrisj, did you get an answer? | 00:44 |
| wchrisj | stevemar - yes, I did, thanks! | 00:44 |
| stevemar | wchrisj, lovely! | 00:44 |
| wchrisj | Not sure why, but you cant login with a username/pwd against the v3 API | 00:45 |
| wchrisj | Keystone requires the domain | 00:45 |
| jamielennox | wchrisj: ... that doesn't seem right | 00:45 |
| *** dstanek_zzz is now known as dstanek | 00:45 | |
| jamielennox | wchrisj: oh - yea usernames are only unique per domain, that is right | 00:45 |
| wchrisj | but you CAN login with the User ID and Pwd - who remembers their user id?!?!? sheesh | 00:45 |
| wchrisj | ahhh, but user Ids are unique globally... | 00:46 |
| wchrisj | makes sense, actually | 00:46 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not log 14+ INFO lines on a broken pipe error (eventlet) https://review.openstack.org/102680 | 00:48 |
| morganfainberg | nkinder, ^ | 00:50 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 00:53 |
| *** dstanek is now known as dstanek_zzz | 00:55 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not log 14+ INFO lines on a broken pipe error (eventlet) https://review.openstack.org/102680 | 00:56 |
| *** rodrigods_ has quit IRC | 01:00 | |
| *** rodrigods_ has joined #openstack-keystone | 01:01 | |
| *** lbragstad has joined #openstack-keystone | 01:11 | |
| *** browne has quit IRC | 01:11 | |
| openstackgerrit | Clayton O'Neill proposed a change to openstack/keystone: WIP: Add batch flush for MySQL https://review.openstack.org/101726 | 01:12 |
| *** wchrisj has quit IRC | 01:12 | |
| *** gokrokve has quit IRC | 01:14 | |
| *** gokrokve has joined #openstack-keystone | 01:14 | |
| *** rodrigods_ has quit IRC | 01:17 | |
| *** geekinutah has joined #openstack-keystone | 01:18 | |
| *** gokrokve has quit IRC | 01:19 | |
| geekinutah | question about the v3 domain concept | 01:19 |
| geekinutah | I've heard rumors on the wind that this is being removed? | 01:19 |
| morganfainberg | geekinutah, not really removed. we can't (it's part of the spec) | 01:31 |
| morganfainberg | geekinutah, it will be changed some to support the hiearchy logic | 01:31 |
| *** richm has left #openstack-keystone | 01:32 | |
| *** marcoemorais has quit IRC | 01:35 | |
| *** mberlin1 has joined #openstack-keystone | 01:39 | |
| *** mberlin has quit IRC | 01:41 | |
| dvorak | seems like this has to be an environment problem, but anyone else seen the error 'ImportError: cannot import name Full' when running tox? | 01:42 |
| nkinder | morganfainberg: I just added a small nit to the broken pipe patch | 01:43 |
| morganfainberg | nkinder, sure :) | 01:43 |
| nkinder | just thinking errno.EPIPE would be nicer than 32 | 01:43 |
| morganfainberg | nkinder, ah probably | 01:44 |
| *** dstanek_zzz is now known as dstanek | 01:46 | |
| dstanek | morganfainberg: if its always heat, maybe there is something wrong in that client | 01:49 |
| morganfainberg | dstanek, dunno if it's always heat | 01:49 |
| morganfainberg | dstanek the case i was given was heat | 01:49 |
| dstanek | morganfainberg: your patch is much smaller than i would have guessed | 01:53 |
| ayoung | morganfainberg, so did we decide not to purse stripping the catalog out of the token? | 01:53 |
| morganfainberg | ayoung, we should still do that | 01:54 |
| morganfainberg | ayoung, but this appears to really be something else. | 01:54 |
| *** ncoghlan has joined #openstack-keystone | 01:57 | |
| *** stevemar has quit IRC | 02:02 | |
| *** stevemar has joined #openstack-keystone | 02:02 | |
| dstanek | morganfainberg: i added a few comments to your review | 02:04 |
| *** stevemar has quit IRC | 02:04 | |
| morganfainberg | dstanek, ++ | 02:04 |
| morganfainberg | not sure if we want to log at all | 02:04 |
| *** stevemar has joined #openstack-keystone | 02:05 | |
| *** packet has quit IRC | 02:05 | |
| *** otwieracz has quit IRC | 02:08 | |
| navid | ayoung: hi I am working on a bug fix regarding revoke events, how can you make revoke event with the idp-id, can you give some links to read about it. | 02:11 |
| *** otwieracz has joined #openstack-keystone | 02:15 | |
| *** geekinutah has quit IRC | 02:18 | |
| *** gokrokve has joined #openstack-keystone | 02:20 | |
| *** nsquare has quit IRC | 02:21 | |
| ayoung | navid, it would probably be easier for me to fix myself than to explain. | 02:22 |
| ayoung | navid, what do you mean by " with the idp-id" | 02:23 |
| morganfainberg | dstanek, you were right can't super an old-style class >.< | 02:24 |
| ayoung | morganfainberg, OK, so I guess the real question is if anything uses the body of the token | 02:24 |
| ayoung | when auth token unpacks, it sticks the data into env vars, so if there isn't even one for catalog, we're clear | 02:24 |
| ayoung | lets see | 02:24 |
| *** gokrokve has quit IRC | 02:24 | |
| ayoung | HTTP_X_SERVICE_CATALOG | 02:25 |
| ayoung | json encoded keystone service catalog (optional). | 02:25 |
| ayoung | For compatibility reasons this catalog will always be in the V2 catalog | 02:25 |
| ayoung | format even if it is a v3 token. | 02:25 |
| ayoung | hmmm, that smells like we need the catalog | 02:25 |
| ayoung | http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token.py#n109 | 02:25 |
| nkinder | ayoung: we still need to pursue stripping the catalog from the token, but it's not the cause of the immediate problem morganfainberg is looking at | 02:25 |
| ayoung | http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token.py#n109 | 02:25 |
| ayoung | nkinder, I don't think we can | 02:26 |
| ayoung | nkinder, I put it there in the first place. | 02:26 |
| nkinder | ayoung: sure we can... :) | 02:26 |
| ayoung | nkinder, and it was because the call to validate a token returned the catalog | 02:26 |
| nkinder | maybe not easily | 02:26 |
| ayoung | so in order to have the same behavior, we need to have some catalog available | 02:26 |
| ayoung | so if its not the one from the token, we have to fetch and cache | 02:26 |
| nkinder | ayoung: it definitely has to be available, just not in the token itself | 02:26 |
| ayoung | nkinder, I suspect that, deep down, no one really uses it | 02:27 |
| navid | so when you delete idp the users associated with the idp's tokens should make a revoke event for that. I am looking to see if it can be done by adding idp_id as optional attribute for revocation event like user_id | 02:27 |
| navid | ayoung: so when you delete idp the users associated with the idp's tokens should make a revoke event for that. I am looking to see if it can be done by adding idp_id as optional attribute for revocation event like user_id | 02:27 |
| ayoung | navid, yes, you can do that | 02:28 |
| ayoung | navid, start with auth_token middleware | 02:28 |
| ayoung | er | 02:28 |
| ayoung | with keystoneclient | 02:28 |
| ayoung | the model.py file has all of the logic | 02:28 |
| * ayoung has to remove the corresponding code from keystone | 02:29 | |
| navid | ayoung: so how about the contrib/revoke/model.py | 02:29 |
| ayoung | in keystone? That is dead code | 02:29 |
| navid | yes | 02:29 |
| ayoung | if you want to start by removing it, please do | 02:29 |
| ayoung | it moved to keystoneclient | 02:30 |
| navid | ah thanks for letting me know | 02:30 |
| ayoung | navid, I'm going to open a bug to remove that code and assign to you | 02:30 |
| ayoung | that's the thanks you get for asking me questions | 02:31 |
| navid | haha ok | 02:31 |
| navid | so no more questions | 02:31 |
| ayoung | navid, what is your launchpad id | 02:32 |
| ayoung | just navid? | 02:32 |
| morganfainberg | dstanek, i am not sure the impact of not re-raising, i'm going to guess minimal, but ... questions to be dug into. | 02:32 |
| ayoung | navid, https://bugs.launchpad.net/keystone/+bug/1334480 there you go | 02:33 |
| uvirtbot | Launchpad bug 1334480 in keystone "remove revocation model" [Undecided,New] | 02:33 |
| ayoung | navid, that is just to get you started | 02:33 |
| ayoung | next step | 02:33 |
| navid | ayoung, next step | 02:34 |
| navid | ayoung, will do what is the next step? | 02:35 |
| ayoung | navid, I figure out where I put the code | 02:35 |
| *** praneshp has quit IRC | 02:37 | |
| ayoung | navid, I lied | 02:38 |
| ayoung | this patch needs to land first | 02:38 |
| ayoung | https://review.openstack.org/#/c/81166/18 | 02:38 |
| ayoung | I had fooled myself into thinking it was already in | 02:38 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 02:39 |
| ayoung | morganfainberg, can I make a deal with you and jamielennox that I submit a new patch for the revocation events that just moves the code over from keystone server as is, and then do a second one on top of it, and you gusy only beat me up about the second patch? | 02:40 |
| jamielennox | ayoung: this is the one that i changed to AccessInfo? | 02:41 |
| ayoung | jamielennox, I haven't even looked | 02:41 |
| ayoung | I just got wrapped up in other tasks and left that one to wither on the vine | 02:41 |
| ayoung | jamielennox, I'm going to submit a new patch which is just the model.py file added to contrib | 02:41 |
| ayoung | andthen I'll rebase the latest on top of it | 02:42 |
| ayoung | no tests, no nothing else | 02:42 |
| jamielennox | ayoung: i don't want to support that dict format in client, i just want accessinfo - how does that work for the server? | 02:42 |
| ayoung | jamielennox, we can clean that up, too. I like what you are saying | 02:43 |
| jamielennox | that was my main problem with the initial patch - i agree it belongs in client and middleware should probably consume it | 02:43 |
| ayoung | and, I think that the AccessInfo structure, if I understand what you are talking about, is the right way to go | 02:43 |
| ayoung | I just think most people are put off by the size of the patch | 02:43 |
| jamielennox | i was | 02:44 |
| ayoung | OK, so then I'll rebase yours on top of just the straight move of the code | 02:44 |
| *** gokrokve has joined #openstack-keystone | 02:44 | |
| jamielennox | fine by me, i'm a passenger in morganfainberg's split | 02:47 |
| *** ncoghlan is now known as ncoghlan_afk | 02:47 | |
| morganfainberg | jamielennox huh? my split? | 02:49 |
| morganfainberg | wha? | 02:49 |
| *** ncoghlan_afk is now known as ncoghlan | 02:49 | |
| jamielennox | morganfainberg: middleware from keysteonclient | 02:49 |
| morganfainberg | oh | 02:49 |
| *** Camisa has joined #openstack-keystone | 02:49 | |
| *** Camisa has joined #openstack-keystone | 02:49 | |
| morganfainberg | sure | 02:49 |
| ayoung | this needs to be in client | 02:49 |
| ayoung | middleware can consume it, but any client should be able to validate a token | 02:50 |
| morganfainberg | *shrug* | 02:50 |
| morganfainberg | sorry digging in eventlet :( | 02:50 |
| morganfainberg | have i mentioned i dislike eventlet | 02:50 |
| openstackgerrit | wanghong proposed a change to openstack/python-keystoneclient: expose the revoke token for V3 https://review.openstack.org/102701 | 02:51 |
| jamielennox | morganfainberg: i think everyone has | 02:51 |
| ayoung | jamielennox, out of curiousity what do you get if you run nslookup ipa.younglogic.net | 02:55 |
| jamielennox | Server:10.64.63.6 | 02:55 |
| jamielennox | Address:10.64.63.6#53 | 02:55 |
| jamielennox | Non-authoritative answer: | 02:55 |
| jamielennox | Name:ipa.younglogic.net | 02:55 |
| jamielennox | Address: 173.236.248.45 | 02:55 |
| ayoung | interesting, so yours is updated | 02:55 |
| ayoung | jamielennox, does the webui resolve in a web browser? | 02:56 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 02:56 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Direct move of the model code from keystone server https://review.openstack.org/102702 | 02:56 |
| ayoung | jamielennox, OK, here is what the diff looks like now https://review.openstack.org/#/c/81166/20/keystoneclient/contrib/revoke/model.py,cm | 02:57 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Direct move of the revoke model from keystone server https://review.openstack.org/102702 | 03:01 |
| *** ayoung is now known as ayoung_ZZZzz | 03:01 | |
| morganfainberg | dstanek, ok found what i really need to "fix" in eventlet. this ... uh this is gonna be ugly | 03:04 |
| *** mhu has quit IRC | 03:05 | |
| *** mhu has joined #openstack-keystone | 03:10 | |
| *** praneshp has joined #openstack-keystone | 03:17 | |
| dstanek | morganfainberg: :-) good luck sir | 03:25 |
| dstanek | morganfainberg: i just found a py3 issue in http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_exception.py#n88 | 03:26 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not log 14+ INFO lines on a broken pipe error (eventlet) https://review.openstack.org/102680 | 03:32 |
| morganfainberg | dstanek, ^ | 03:32 |
| morganfainberg | dstanek, i haven't run tests, but... i need to get dinner :( | 03:33 |
| morganfainberg | dstanek, figured i'd upload it | 03:33 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not log 14+ INFO lines on a broken pipe error (eventlet) https://review.openstack.org/102680 | 03:33 |
| morganfainberg | dstanek, the logging of the traceback is inside a function defined within a method within a nested try block | 03:34 |
| morganfainberg | dstanek, easier to just filter the log messages >.< | 03:34 |
| dstanek | morganfainberg: yeah, i figured. otherwise it looked like you would have to do lots of copy/paste | 03:36 |
| morganfainberg | dstanek, yep. :( | 03:36 |
| morganfainberg | dstanek, dunno if i can make that any better thna that, short of squashing all tracebacks | 03:36 |
| morganfainberg | or massive copy/pasta | 03:36 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Moving delete_user and delete_group calls to IdentityManager https://review.openstack.org/80368 | 03:38 |
| *** lbragstad has quit IRC | 03:38 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Use callback/notification framework for deletes https://review.openstack.org/80368 | 03:42 |
| *** andreaf_ has joined #openstack-keystone | 03:44 | |
| *** gokrokve_ has joined #openstack-keystone | 03:44 | |
| *** gokrokve has quit IRC | 03:48 | |
| *** zhiyan_ is now known as zhiyan | 03:55 | |
| *** topol has joined #openstack-keystone | 04:05 | |
| *** dstanek is now known as dstanek_zzz | 04:07 | |
| *** cuddyt has joined #openstack-keystone | 04:07 | |
| *** gokrokve_ has quit IRC | 04:11 | |
| *** praneshp has quit IRC | 04:11 | |
| *** gokrokve has joined #openstack-keystone | 04:11 | |
| *** cuddyt has quit IRC | 04:12 | |
| *** gokrokve has quit IRC | 04:16 | |
| *** Camisa is now known as Chicago | 04:20 | |
| *** topol has quit IRC | 04:31 | |
| *** praneshp has joined #openstack-keystone | 04:32 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 04:41 |
| *** gokrokve has joined #openstack-keystone | 04:43 | |
| *** praneshp_ has joined #openstack-keystone | 04:47 | |
| *** praneshp has quit IRC | 04:50 | |
| *** praneshp_ is now known as praneshp | 04:50 | |
| *** dstanek_zzz is now known as dstanek | 04:58 | |
| *** ajc_ has joined #openstack-keystone | 04:59 | |
| *** gyee has quit IRC | 05:22 | |
| *** ukalifon1 has joined #openstack-keystone | 05:32 | |
| *** dims__ has quit IRC | 05:40 | |
| *** harlowja is now known as harlowja_away | 05:49 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes a Python3 syntax error https://review.openstack.org/102734 | 05:55 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds several more test modules that pass on Py3 https://review.openstack.org/102735 | 05:55 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes test_wsgi for Python3 https://review.openstack.org/102736 | 05:55 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes test_exceptions.py for Python3 https://review.openstack.org/102737 | 05:55 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/97005 | 06:01 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fix the order of assertEqual arguments(pemutils, v3_catalog, etc) https://review.openstack.org/77514 | 06:09 |
| *** jimbaker has quit IRC | 06:11 | |
| *** zhiyan is now known as zhiyan_ | 06:13 | |
| *** zhiyan_ is now known as zhiyan | 06:14 | |
| *** dstanek is now known as dstanek_zzz | 06:18 | |
| *** rwsu has quit IRC | 06:26 | |
| *** stevemar has quit IRC | 06:36 | |
| *** dims__ has joined #openstack-keystone | 06:36 | |
| *** dims__ has quit IRC | 06:41 | |
| *** jaosorior has joined #openstack-keystone | 06:42 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add identity mapping capability https://review.openstack.org/102430 | 06:44 |
| *** navid_ has joined #openstack-keystone | 06:46 | |
| *** navid_ has quit IRC | 06:47 | |
| *** chandan_kumar has joined #openstack-keystone | 06:47 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add identity mapping capability https://review.openstack.org/102430 | 06:48 |
| *** BAKfr has joined #openstack-keystone | 07:02 | |
| *** openstackgerrit has quit IRC | 07:07 | |
| *** andreaf_ has quit IRC | 07:18 | |
| *** mrda is now known as manslaughter | 07:20 | |
| *** manslaughter is now known as mrda | 07:22 | |
| *** oomichi has quit IRC | 07:23 | |
| *** rushiagr has left #openstack-keystone | 07:28 | |
| *** openstackgerrit has joined #openstack-keystone | 07:29 | |
| *** dims__ has joined #openstack-keystone | 07:30 | |
| *** dims__ has quit IRC | 07:35 | |
| *** praneshp has quit IRC | 07:38 | |
| *** tomoiaga has joined #openstack-keystone | 07:42 | |
| *** nsquare has joined #openstack-keystone | 07:55 | |
| *** nsquare_ has joined #openstack-keystone | 08:01 | |
| *** nsquare has quit IRC | 08:04 | |
| *** mrda is now known as mrda-away | 08:08 | |
| *** dims__ has joined #openstack-keystone | 08:31 | |
| *** dims__ has quit IRC | 08:36 | |
| *** andreaf_ has joined #openstack-keystone | 08:37 | |
| *** jamielennox is now known as jamielennox|away | 08:39 | |
| *** xianghui^ has quit IRC | 09:19 | |
| *** dims__ has joined #openstack-keystone | 09:32 | |
| *** xianghui^ has joined #openstack-keystone | 09:32 | |
| *** ncoghlan has quit IRC | 09:36 | |
| baffle | Hm, is there any way to fix issues with authtoken getting bigger than 8K due to catalog size yet? As a workaround I've had to remove some endpoints from the catalog. :-/ | 09:36 |
| *** dims__ has quit IRC | 09:37 | |
| baffle | And I'm having issues with haproxy returning a 400-error if the length of one HTTP header is > 8K. I have allocated lots of memory for buffers, but the 8K pr. header seems to be stuck.. So all requests with huge authtokens just get dropped.. | 09:37 |
| baffle | I'd really like to get Ceilometer API up and running. :) | 09:37 |
| *** afazekas is now known as __afazekas | 09:58 | |
| *** dims__ has joined #openstack-keystone | 10:40 | |
| *** chandan_kumar is now known as chkumar246 | 10:51 | |
| *** chkumar246 is now known as chandan_kumar | 10:53 | |
| *** chandan_kumar has quit IRC | 10:54 | |
| *** chandan_kumar has joined #openstack-keystone | 10:54 | |
| *** henrynash has joined #openstack-keystone | 10:58 | |
| *** nsquare_ has quit IRC | 11:14 | |
| *** nsquare has joined #openstack-keystone | 11:17 | |
| *** nsquare has quit IRC | 11:22 | |
| *** joesavak has quit IRC | 11:31 | |
| *** lbragstad has joined #openstack-keystone | 11:52 | |
| marekd | morganfainberg: I left some comments on websso bp: https://review.openstack.org/#/c/96867/10/specs/juno/saml-web-authn.rst Let me know when you are available, I'd like to discuss some details. | 11:54 |
| marekd | morganfainberg: dstanek_zzz ayoung_ZZZzz: Appreciate your eyes on k2k bp, added some proposals to general user workflow and potential impact on the whole solution. Around line 191 in https://review.openstack.org/#/c/100023/ | 11:56 |
| *** lbragstad has quit IRC | 11:56 | |
| marekd | dolphm: you too ^^ | 11:56 |
| *** afazekas_ has joined #openstack-keystone | 11:59 | |
| *** diegows has joined #openstack-keystone | 12:04 | |
| *** erecio has joined #openstack-keystone | 12:13 | |
| *** openstackgerrit has joined #openstack-keystone | 12:27 | |
| *** stevemar has joined #openstack-keystone | 12:31 | |
| *** radez_g0n3 is now known as radez | 12:33 | |
| *** dstanek_zzz is now known as dstanek | 12:39 | |
| *** gordc has joined #openstack-keystone | 12:47 | |
| *** gokrokve_ has joined #openstack-keystone | 12:50 | |
| *** gokrokve_ has quit IRC | 12:50 | |
| *** gokrokve_ has joined #openstack-keystone | 12:51 | |
| *** gokrokv__ has joined #openstack-keystone | 12:52 | |
| *** rodrigods_ has joined #openstack-keystone | 12:52 | |
| *** gokrokve has quit IRC | 12:53 | |
| *** gokrokve_ has quit IRC | 12:55 | |
| *** ajc_ has quit IRC | 13:00 | |
| *** lbragstad has joined #openstack-keystone | 13:02 | |
| *** dstanek is now known as dstanek_zzz | 13:02 | |
| *** dstanek_zzz is now known as dstanek | 13:04 | |
| *** stevemar has quit IRC | 13:08 | |
| *** nkinder has quit IRC | 13:08 | |
| *** miqui has joined #openstack-keystone | 13:12 | |
| *** _elmiko is now known as elmiko | 13:13 | |
| *** dstanek is now known as dstanek_zzz | 13:14 | |
| openstackgerrit | Juan Manuel Ollé proposed a change to openstack/keystone: Adding Role for an unexisting user should fail. https://review.openstack.org/93982 | 13:14 |
| *** kwss has joined #openstack-keystone | 13:24 | |
| *** richm has joined #openstack-keystone | 13:26 | |
| *** dstanek_zzz is now known as dstanek | 13:34 | |
| jaosorior | dolphm, ping | 13:44 |
| *** hrybacki has joined #openstack-keystone | 13:49 | |
| marekd | mhu: hey | 13:50 |
| marekd | mhu: I am curious why would you rather see HTTP POST call initiated by Keystone rather than a JS code. | 13:52 |
| marekd | mhu: I am not biased to JS, I just want to gather others opinions :-) | 13:52 |
| *** tomoiaga has quit IRC | 13:59 | |
| *** nkinder has joined #openstack-keystone | 14:00 | |
| henrynash | morganfainberg, dstanek, dolphm, ayoung: 2nd or 3 patches now up on the path to cross-backend uuids…this one adds the mapping fucntionality without actually wiring it in: https://review.openstack.org/#/c/102430/ | 14:01 |
| *** stevemar has joined #openstack-keystone | 14:02 | |
| stevemar | marekd, thanks for the reviews :) | 14:02 |
| dstanek | henrynash: great, i'll start taking a look | 14:02 |
| dstanek | seems to have been a flurry of k2k activity | 14:03 |
| marekd | stevemar: happy to help. | 14:03 |
| marekd | stevemar: i wanted to clean it up (tabs) but didn't know if you are not working on sth locally. | 14:04 |
| marekd | stevemar: i am really curious what you and others thing about my poem regarding user workflow and all the impact i had written in the morning :-) | 14:04 |
| stevemar | marekd, i havent taken a deep look at it all yet, but saw a ton of comments | 14:05 |
| marekd | stevemar: i'd sleep much better if we have agreement on that :-) | 14:05 |
| stevemar | marekd, ;) | 14:05 |
| stevemar | marekd, i hope i can upload a new version before lunch | 14:05 |
| marekd | stevemar: i should be online today so maybe you, dstanek and morganfainberg can discuss it together? | 14:05 |
| marekd | stevemar: and myself :P | 14:06 |
| marekd | between 2-3pm your time | 14:06 |
| stevemar | marekd, that would be awesome | 14:06 |
| marekd | before it gets *really* late here. | 14:06 |
| marekd | dstanek: what do you think? | 14:07 |
| dstanek | i think 2 - 3 EST works for me :-) what will we be discussing? | 14:07 |
| marekd | dstanek: k2k | 14:07 |
| dstanek | ah, sure | 14:07 |
| marekd | dstanek: i made some proposals to user workflow | 14:07 |
| stevemar | i do like the fact that it's become k2k now | 14:07 |
| marekd | stevemar: federation thing? | 14:07 |
| stevemar | marekd, yep | 14:08 |
| stevemar | marekd, alright, 47 comments to go through! lets do this! | 14:08 |
| marekd | stevemar: good luck with that :-) | 14:08 |
| * stevemar closes all other tabs in chrome to reduce distraction levels | 14:08 | |
| dstanek | haha, i wish it were more like federation; the remote Keystone treating the local Keystone like any old IdP | 14:09 |
| marekd | dstanek: ++100 | 14:09 |
| marekd | dstanek: i also want to keep the trust somehow limited... | 14:09 |
| marekd | dstanek: your use case and one provider being compromised is a simple, yet ingenius example. I did say that in one of my comments in the bp. | 14:10 |
| dstanek | marekd: thanks. the more i think about it the more i see bad things. | 14:10 |
| marekd | dstanek: well, i couldnt see a good reason why this impersonation was really bad. | 14:11 |
| marekd | now i do. | 14:11 |
| marekd | well ok...i am fine with impersonation but *limited* impersonation. | 14:11 |
| dstanek | it's interesting because if the local keystone creates the token i think it is doing a part of the authz and that scares me | 14:12 |
| marekd | dstanek: anyway, please take a look at my comments in k2k bp. | 14:12 |
| dstanek | marekd: will do | 14:12 |
| marekd | dstanek: i tried to bring together all my thoughts... | 14:12 |
| marekd | EST is canadian tz? | 14:12 |
| *** hrybacki has quit IRC | 14:16 | |
| *** hrybacki has joined #openstack-keystone | 14:17 | |
| marekd | dstanek: what's your local time now? ~10:12 | 14:18 |
| mhu | marekd: first, I am not very fond of JS :) second, less dispersion in code to maintain | 14:20 |
| mhu | marekd, but it's just an opinion, I am open to discussion if you think JS would work better | 14:20 |
| dstanek | marekd: yes, 10:20 - i think 2PM EST is 6PM UTC | 14:21 |
| marekd | dstanek: haha, it's weird that you guys live in the same country and have specify timezones when you set up the mettings (not talking about stevemar who is canadian) :-) | 14:22 |
| dstanek | marekd: i think stevemar is in EST too and for morganfainberg it'll be 11AM | 14:22 |
| marekd | dstanek: yes, EST is 6h behind me, and UTC 2h behind me. | 14:22 |
| marekd | yeah. | 14:22 |
| marekd | \ | 14:22 |
| stevemar | marekd, canada has like 6 tz's it's crazy | 14:23 |
| marekd | lol | 14:23 |
| *** bknudson has quit IRC | 14:27 | |
| *** mhu has quit IRC | 14:27 | |
| *** david-lyle has joined #openstack-keystone | 14:27 | |
| *** mhu has joined #openstack-keystone | 14:28 | |
| *** rodrigods_ has quit IRC | 14:28 | |
| *** ayoung_ZZZzz is now known as ayoung | 14:34 | |
| ayoung | dolphm, in addition to deprecating the LDAP options for Tenant, perhaps it is time to deprecate the hack that says "use the LDAP assignment driver if the LDAP identity driver is specified and there is no assignment driver specified." | 14:35 |
| openstackgerrit | Marco Fargetta proposed a change to openstack/keystone-specs: Web Authentication for SAML federated Keystone https://review.openstack.org/96867 | 14:38 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 14:46 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone-specs: Web Authentication for SAML federated Keystone https://review.openstack.org/96867 | 14:47 |
| marekd | stevemar: thanks for adding me as Co-Author! :-) | 14:50 |
| *** ukalifon3 has joined #openstack-keystone | 14:50 | |
| *** ukalifon1 has quit IRC | 14:51 | |
| stevemar | marekd, thats just incentive for you to implement more code :P | 14:53 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 14:53 |
| marekd | stevemar: does it work backwards with code reviews? :P I have some patches stalled :P | 14:54 |
| stevemar | hehe, I think I know which ones :) | 14:54 |
| *** dstanek is now known as dstanek_zzz | 14:55 | |
| *** cuddyt has joined #openstack-keystone | 14:58 | |
| *** raildo has joined #openstack-keystone | 15:01 | |
| marekd | stevemar: btw did you test my client with TFIM? | 15:03 |
| stevemar | marekd, no, i wanted to get the ball rolling on k2k | 15:04 |
| marekd | stevemar: ok | 15:04 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 15:05 |
| *** daneyon has joined #openstack-keystone | 15:06 | |
| morganfainberg | raildo, woo saw the new spec, will read it over today. | 15:06 |
| morganfainberg | raildo :) | 15:06 |
| raildo | morganfainberg: great =] | 15:07 |
| raildo | thanks | 15:07 |
| *** bobt has joined #openstack-keystone | 15:09 | |
| *** gokrokv__ has quit IRC | 15:11 | |
| *** gokrokve has joined #openstack-keystone | 15:12 | |
| *** erecio has quit IRC | 15:14 | |
| *** andreaf_ has quit IRC | 15:15 | |
| openstackgerrit | Juan Manuel Ollé proposed a change to openstack/keystone: Adding Role for an unexisting user should fail https://review.openstack.org/93982 | 15:17 |
| *** dims__ has quit IRC | 15:21 | |
| *** dims__ has joined #openstack-keystone | 15:22 | |
| *** Chicago has quit IRC | 15:22 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: Add optional parameters to EndpointManger create() https://review.openstack.org/102602 | 15:22 |
| *** rodrigods_ has joined #openstack-keystone | 15:26 | |
| *** dstanek_zzz is now known as dstanek | 15:28 | |
| *** Chicago has joined #openstack-keystone | 15:34 | |
| *** Chicago has joined #openstack-keystone | 15:34 | |
| *** ukalifon3 has quit IRC | 15:35 | |
| *** rodrigods_ has quit IRC | 15:37 | |
| *** jgriffith is now known as jfiffith | 15:38 | |
| *** jfiffith is now known as jgriffith | 15:39 | |
| *** erecio has joined #openstack-keystone | 15:42 | |
| *** morganfainberg changes topic to "Please Review and/or Update Proposed Specs" | 15:43 | |
| *** ChanServ changes topic to "Please Review and/or Update Proposed Specs | Hackathon July 9-11: http://dolphm.com/openstack-keystone-hackathon-for-juno/" | 15:45 | |
| *** geekinutah has joined #openstack-keystone | 15:47 | |
| *** henrynash has quit IRC | 15:49 | |
| *** geekinutah has left #openstack-keystone | 15:50 | |
| hrybacki | ayoung: We've got the glance meeting at 16:00 but I'm supposed to be at a RH volunteer event until 17:00. I'm gonna try and dip out at 15:45 though. | 15:51 |
| *** dstanek is now known as dstanek_zzz | 15:52 | |
| morganfainberg | ayoung, dolphm, stevemar, when we have an exception (conflict) raised from SQLAlchemy (sql.py backends) do we want to log the exception at error level? | 15:55 |
| morganfainberg | ayoung, dolphm, stevemar, or is the exception info? debug? warning? | 15:55 |
| morganfainberg | respinning my take on the leaking of sql queries via HTTP 409 | 15:56 |
| *** rwsu has joined #openstack-keystone | 15:59 | |
| *** bvandenh has joined #openstack-keystone | 15:59 | |
| *** chandan_kumar has quit IRC | 16:02 | |
| *** jaosorior has quit IRC | 16:02 | |
| *** arun_kant has joined #openstack-keystone | 16:03 | |
| *** bvandenh has quit IRC | 16:04 | |
| *** __afazekas is now known as afazekas | 16:04 | |
| *** gordc has quit IRC | 16:05 | |
| *** bknudson has joined #openstack-keystone | 16:05 | |
| *** gyee has joined #openstack-keystone | 16:05 | |
| arun_kant | all..finally jenkins build is happy, now looking for review comments on https://review.openstack.org/#/c/95300/ | 16:08 |
| *** henrynash has joined #openstack-keystone | 16:08 | |
| dolphm | morganfainberg: some exceptions are expected - are you referring to *all* exceptions? | 16:09 |
| morganfainberg | dolphm, the @handle conflict ones | 16:09 |
| dolphm | morganfainberg: can i ask why you're asking? | 16:09 |
| morganfainberg | dolphm, in theory, we shouldn't ever get to the point where we raise a conflict if we did our jobs right? | 16:09 |
| morganfainberg | dolphm, respln on this patch https://review.openstack.org/#/c/98302/7 | 16:09 |
| morganfainberg | just removing the leaking SQL from the exceptions | 16:10 |
| morganfainberg | instead of re-working the entire exception scheme (much simpler) | 16:10 |
| morganfainberg | I can make it debug if it really doesn't matter to an operator | 16:10 |
| * morganfainberg might just be low on coffee this morning | 16:11 | |
| *** gyee has quit IRC | 16:11 | |
| morganfainberg | dolphm, as i type this out. it sounds more and more 'debug' log | 16:11 |
| *** bobt has quit IRC | 16:11 | |
| dolphm | morganfainberg: if you're going to log, i think debug is fine. i don't see too much point to a higher level log unless someone is asking for it with good reason? | 16:12 |
| morganfainberg | nah | 16:13 |
| morganfainberg | like i said, as i was typing it out, i came to the same conclusion. | 16:13 |
| * morganfainberg needs to get coffee and breakfast | 16:13 | |
| *** hrybacki has quit IRC | 16:15 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not leak SQL queries in HTTP 409 (conflict) https://review.openstack.org/98302 | 16:16 |
| morganfainberg | ^ much simpler change. | 16:17 |
| morganfainberg | solves the same issue. | 16:17 |
| dolphm | morganfainberg: looking... | 16:17 |
| dolphm | morganfainberg: typo in L405 | 16:18 |
| *** kwss has quit IRC | 16:18 | |
| morganfainberg | DOH | 16:18 |
| morganfainberg | :) | 16:18 |
| dolphm | morganfainberg: explain "Internal Error" on DBError's? | 16:19 |
| morganfainberg | It's a integrity error, e.g. foreign key issue? | 16:19 |
| *** gyee has joined #openstack-keystone | 16:20 | |
| morganfainberg | or uh, a number of cases where the DB isn't duplicating an entry, but can't store | 16:20 |
| *** erecio has quit IRC | 16:20 | |
| morganfainberg | maybe that one needs to be a warning? | 16:20 |
| *** marekd is now known as marekd|bbl | 16:22 | |
| *** diegows has quit IRC | 16:22 | |
| dolphm | morganfainberg: is it ever the user's fault? | 16:22 |
| dolphm | morganfainberg: if so "internal error" seems like a misleading message | 16:23 |
| dolphm | morganfainberg: if not, then ++ | 16:23 |
| morganfainberg | hm. i think the user _could_ be doing something bad here. | 16:23 |
| morganfainberg | but. it could probably also be an UnexpectedError (500 ISE) | 16:23 |
| morganfainberg | ISE might actually be better. | 16:24 |
| *** gordc has joined #openstack-keystone | 16:24 | |
| dolphm | morganfainberg: if it's the user's fault, then it shouldn't be 5xx | 16:24 |
| morganfainberg | i don't see how this is going to be the user's fault | 16:24 |
| dolphm | morganfainberg: if it's the user's fault, then 4xx, but "internal error" isn't super helpful for the user to resolve it | 16:25 |
| morganfainberg | this is a case where maybe they slipped through and tried to create a project when a domain was deleted (Race) | 16:25 |
| morganfainberg | out check of if domain exists passed, and the SQL driver on the backend goes to write and gets a FK error | 16:25 |
| morganfainberg | because the domain is gone | 16:25 |
| dolphm | morganfainberg: that sounds like a 404 domain not found | 16:26 |
| morganfainberg | except we're passed the part where we know what foriegn key could be missing | 16:26 |
| morganfainberg | this would be if the SQL failed because of a FK constraint failed | 16:26 |
| dolphm | morganfainberg: alright, 500 then | 16:27 |
| morganfainberg | *nod* fixing now | 16:27 |
| *** erecio has joined #openstack-keystone | 16:27 | |
| morganfainberg | should this be a higher than debug log for the operator? or still debug only (leaning towards debug. | 16:28 |
| *** BAKfr has quit IRC | 16:30 | |
| *** zhiyan is now known as zhiyan_ | 16:32 | |
| dolphm | morganfainberg: i vote debug | 16:33 |
| morganfainberg | debug it is | 16:33 |
| openstackgerrit | A change was merged to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/97005 | 16:35 |
| *** jimbaker has joined #openstack-keystone | 16:37 | |
| *** joesavak has joined #openstack-keystone | 16:37 | |
| *** gokrokve has quit IRC | 16:38 | |
| *** gokrokve has joined #openstack-keystone | 16:38 | |
| *** diegows has joined #openstack-keystone | 16:39 | |
| dolphm | morganfainberg: should i just pile on another +2 on https://review.openstack.org/#/c/96315/ or +2/+A? (why isn't there a +A already?) | 16:40 |
| morganfainberg | dolphm, probably because people are hesitent to +A a spec | 16:41 |
| dolphm | morganfainberg: fair enough | 16:41 |
| dolphm | morganfainberg: going to have a patch on https://review.openstack.org/#/c/98302/ in the next couple minutes? i'm about to run to lunch | 16:42 |
| morganfainberg | dolphm, yes | 16:42 |
| morganfainberg | just making sure it passed p27/pep8 | 16:42 |
| morganfainberg | almost done | 16:42 |
| *** gokrokve has quit IRC | 16:42 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not leak SQL queries in HTTP 409 (conflict) https://review.openstack.org/98302 | 16:43 |
| *** hrybacki has joined #openstack-keystone | 16:44 | |
| dolphm | morganfainberg: +2! | 16:44 |
| morganfainberg | woo | 16:44 |
| morganfainberg | :) | 16:44 |
| *** Chicago has quit IRC | 16:45 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Service Token Composite Authorization Specification https://review.openstack.org/96315 | 16:47 |
| *** jaosorior has joined #openstack-keystone | 16:48 | |
| *** dstanek_zzz is now known as dstanek | 16:57 | |
| *** jsavak has joined #openstack-keystone | 17:00 | |
| *** packet has joined #openstack-keystone | 17:01 | |
| *** david-lyle has quit IRC | 17:01 | |
| *** david-lyle has joined #openstack-keystone | 17:02 | |
| *** rodrigods_ has joined #openstack-keystone | 17:02 | |
| *** joesavak has quit IRC | 17:03 | |
| *** david-lyle has quit IRC | 17:03 | |
| *** david-lyle has joined #openstack-keystone | 17:04 | |
| *** praneshp has joined #openstack-keystone | 17:04 | |
| *** harlowja_away is now known as harlowja | 17:10 | |
| openstackgerrit | Amandeep Chhabra proposed a change to openstack/keystone: Fixes Bug1334739 https://review.openstack.org/102890 | 17:13 |
| *** dstanek is now known as dstanek_zzz | 17:25 | |
| *** jsavak has quit IRC | 17:34 | |
| stevemar | dstanek_zzz, are we meeting to talk about federation at 2 or 3 est... ? I might be a tad late :( | 17:37 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Extracting get group roles for project logic to drivers. https://review.openstack.org/86025 | 17:40 |
| *** chandan_kumar has joined #openstack-keystone | 17:41 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Extracting get group roles for project logic to drivers. https://review.openstack.org/86025 | 17:42 |
| *** nsquare has joined #openstack-keystone | 17:42 | |
| *** gordc has quit IRC | 17:42 | |
| *** marekd|bbl is now known as marekd | 17:46 | |
| marekd | stevemar: dstanek_zzz i am back | 17:46 |
| marekd | maybe morganfainberg wants to weigh in? | 17:46 |
| marekd | morganfainberg: k2k bp | 17:46 |
| morganfainberg | on? | 17:47 |
| *** stevemar has quit IRC | 17:47 | |
| morganfainberg | marekd, new patch since last night? | 17:47 |
| * morganfainberg commented a bunch on it last night. | 17:47 | |
| marekd | morganfainberg: new patch, some comments. | 17:47 |
| morganfainberg | marekd, i can't at the moment. need to get food and coffee | 17:49 |
| morganfainberg | but i can look at ti a bit later | 17:49 |
| marekd | morganfainberg: appreciate! | 17:49 |
| marekd | morganfainberg: bon app! | 17:49 |
| morganfainberg | marekd, thanks! | 17:50 |
| *** rodrigods_ has quit IRC | 17:55 | |
| *** zzzeek has joined #openstack-keystone | 17:57 | |
| zzzeek | morganfainberg: hi! | 17:58 |
| morganfainberg | zzzeek, hey! | 17:58 |
| morganfainberg | zzzeek, caught me right before i was headed out. | 17:58 |
| *** vishy has joined #openstack-keystone | 17:58 | |
| zzzeek | ah ok | 17:58 |
| morganfainberg | zzzeek, i guess this means you're looking at the lock_mode thing? | 17:58 |
| zzzeek | was just looking at https://review.openstack.org/#/c/97059/7/keystone/trust/backends/sql.py yes | 17:58 |
| vishy | so is it a known issue that the region table doesn’t properly set utf8? | 17:58 |
| zzzeek | just curious what does the lock actually block on ? | 17:58 |
| morganfainberg | zzzeek, ooh uh... good question :P it might not block | 17:59 |
| morganfainberg | vishy, it isn't? | 17:59 |
| vishy | nope | 17:59 |
| morganfainberg | vishy, *grumble* we should fix that | 17:59 |
| zzzeek | morganfainberg: OK, i thought that update, if that row is locked somehow, woudl be the only way for it to block, but i dont really think it does that, i never know for sure unless i can try it on the specific DB + isolation level... | 18:00 |
| morganfainberg | zzzeek, see this is why i ask super smart people to look at these things. | 18:00 |
| zzzeek | morganfainberg: it might block but then again that’s waht SELECT..FOR UPDATE is for... | 18:00 |
| vishy | morganfainberg: so if you don’t have utf8 set in your default db config then the icehouse db_sync bombs out | 18:00 |
| morganfainberg | zzzeek and we can't select for update due to galera + mysql doing bad things | 18:00 |
| zzzeek | morganfainberg: yes i know that part | 18:00 |
| *** david-lyle has quit IRC | 18:00 | |
| zzzeek | morganfainberg: if galera doesnt like to lock things then i dont know that the DB can be reliued upon to lock | 18:00 |
| morganfainberg | vishy, yeah lets fix that ASAP, toss up a bug for me and i'll get something rolled up today. | 18:01 |
| zzzeek | morganfainberg: does this code run in a single process at least? or is it distributed ? | 18:01 |
| morganfainberg | zzzeek, if it runs under apache it could be distributed | 18:01 |
| *** david-lyle has joined #openstack-keystone | 18:01 | |
| zzzeek | morganfainberg: hooray! then locking is a total PITA :) | 18:01 |
| morganfainberg | zzzeek or even run under multiple physical servers running keystone | 18:01 |
| morganfainberg | zzzeek yeah. it's why we did the with_lockmode thing | 18:01 |
| zzzeek | morganfainberg: i think we should figure out, if we dont know alredy, what locking primitives galera supports | 18:01 |
| zzzeek | morganfainberg: something silly that will just work | 18:02 |
| morganfainberg | zzzeek, i think the answer was "it doesn't do locking very well anywhere" | 18:02 |
| morganfainberg | zzzeek it might do table locks | 18:02 |
| zzzeek | morganfainberg: so this code could in theory just block in that method | 18:02 |
| zzzeek | morganfainberg: e.g. just loop aroudn w/ a timeout and all that | 18:03 |
| morganfainberg | zzzeek, might cause issues with eventlet | 18:03 |
| zzzeek | morganfainberg: ah! | 18:03 |
| zzzeek | morganfainberg: why yes it woudl do that | 18:03 |
| morganfainberg | zzzeek, maybe the better answer is add a row to a "trust consumption" table | 18:03 |
| zzzeek | morganfainberg: unless you can yield out to eventlet ? | 18:03 |
| vishy | morganfainberg: https://bugs.launchpad.net/keystone/+bug/1334779 | 18:04 |
| uvirtbot | Launchpad bug 1334779 in keystone "db_sync breaks in non-utf8 databases on region table" [Undecided,New] | 18:04 |
| morganfainberg | zzzeek, well a sleep should yeild. but i am always leery | 18:04 |
| vishy | I’m thinking it might be best to just fix that one inline | 18:04 |
| vishy | and backport it | 18:04 |
| morganfainberg | vishy, probably | 18:04 |
| *** david-lyle has quit IRC | 18:04 | |
| vishy | since anyone running into it will not be able to get past that migration anyway | 18:04 |
| *** david-ly_ has joined #openstack-keystone | 18:04 | |
| vishy | so i don’t think we need a separate migration | 18:04 |
| morganfainberg | vishy, i'll get something proposed today/this afternoon | 18:04 |
| zzzeek | morganfainberg: right…..OK im going to get lunch as you were just going out….i want to see if we can make consume_use() look a little simpler also… | 18:05 |
| vishy | morganfainberg: awesome | 18:05 |
| vishy | mark it for stable/icehouse also | 18:05 |
| morganfainberg | vishy, we actually probably will need a migration, but nbd | 18:05 |
| morganfainberg | vishy, please (if you can) if not just tag it as potential | 18:05 |
| vishy | morganfainberg: as i said i don’t think so | 18:05 |
| morganfainberg | erm icehouse-backport-potential tag | 18:05 |
| morganfainberg | vishy, i'll look at it, will be easy in either case. | 18:06 |
| vishy | because the migration would assume that someone could get passed that migration without being in utf8 | 18:06 |
| vishy | and they can't | 18:06 |
| morganfainberg | vishy, no i mean we fix it in the migration in icehouse | 18:06 |
| vishy | so the additional migration will be a no-op in every case | 18:06 |
| vishy | ah yes but not add a new migration | 18:06 |
| morganfainberg | and we fix it in a later migration in case someone missed it | 18:06 |
| vishy | morganfainberg: again you can’t miss it | 18:06 |
| vishy | the migration will fail if you are not utf8 | 18:07 |
| morganfainberg | vishy, ah, sorry carrying on two conversations and mssing coffee :P | 18:07 |
| morganfainberg | vishy, ++ see it now. | 18:07 |
| vishy | so you either have utf8 in which case the new migration woud do nothing | 18:07 |
| vishy | or you don’t and you are stuck pre region migration | 18:07 |
| morganfainberg | yeah, totally easy fix. | 18:07 |
| vishy | morganfainberg: ah crap | 18:08 |
| vishy | i may be wrong | 18:08 |
| vishy | it depends on when the sanity check runs | 18:08 |
| morganfainberg | vishy, i'll poke at it | 18:08 |
| morganfainberg | if we need to fix it in 2 placed, we'll fix it in two places | 18:08 |
| vishy | actually the sanity check must run after the migration | 18:08 |
| vishy | so we do need another migration | 18:08 |
| morganfainberg | :) | 18:08 |
| morganfainberg | an extra migration wont be awful in the worst case | 18:08 |
| vishy | it needs to be fixed in the migration directly after the migration table though | 18:09 |
| vishy | * region table | 18:09 |
| morganfainberg | yeah | 18:09 |
| vishy | this could be a little tricky | 18:09 |
| vishy | we may just have to have people manually fix it if they happen to have hit the bug once | 18:09 |
| vishy | because they will be on the version that adds the table, so the new patched version won’t re-run | 18:10 |
| *** bobt has joined #openstack-keystone | 18:10 | |
| morganfainberg | vishy, i could also muck with the sanity check | 18:10 |
| vishy | yeah but that is in common | 18:10 |
| vishy | anyway let me know what you figure out | 18:10 |
| morganfainberg | vishy, sure thing. i'll work on it post lunch | 18:10 |
| *** dstanek_zzz is now known as dstanek | 18:14 | |
| dstanek | marekd: sorry, was distracted | 18:15 |
| marekd | dstanek: np. | 18:15 |
| *** openstackgerrit has quit IRC | 18:20 | |
| dstanek | marekd: it's looking much more complete | 18:21 |
| *** nkinder has quit IRC | 18:22 | |
| *** nkinder has joined #openstack-keystone | 18:25 | |
| marekd | dstanek: what exactly? | 18:28 |
| marekd | dstanek: user workflow? | 18:29 |
| *** marcoemorais has joined #openstack-keystone | 18:30 | |
| dstanek | marekd: yes, use cases feel more polished too | 18:31 |
| dstanek | marekd: what is meant by burst in use case 4? | 18:32 |
| marekd | dstanek: did you also have a chance to read this https://www.evernote.com/shard/s107/sh/5a98433b-3e19-4f09-b70a-122472a2a363/194513837bd0162af4fcfb56a3f15357 (pasted as one big comment)? | 18:32 |
| marekd | dstanek: i don't know. | 18:33 |
| *** erecio has quit IRC | 18:34 | |
| marekd | dstanek: i don't see 'burst' in use-case 4 description.. | 18:35 |
| *** praneshp_ has joined #openstack-keystone | 18:37 | |
| dstanek | marekd: jobs from A can be burst to C via B | 18:37 |
| marekd | ah, this. | 18:38 |
| marekd | dstanek: probably something: A federates with B and B federates with C => A can use C's resources. | 18:38 |
| marekd | i don't think we are going tackle this...i wouldn't | 18:39 |
| marekd | we already have enough problems. | 18:39 |
| *** praneshp has quit IRC | 18:39 | |
| *** praneshp_ is now known as praneshp | 18:39 | |
| marekd | at least not in this release. | 18:39 |
| *** xianghui^ has quit IRC | 18:39 | |
| marekd | which ver. pf patch are you reading now? | 18:39 |
| marekd | s/pf/of/ | 18:40 |
| dolphm | dstanek: morganfainberg's fix to remove excess logs for -infra's sake https://review.openstack.org/#/c/102680/ | 18:40 |
| *** openstackgerrit has joined #openstack-keystone | 18:40 | |
| *** stevemar has joined #openstack-keystone | 18:42 | |
| stevemar | marekd, o/ | 18:42 |
| *** openstackstatus has joined #openstack-keystone | 18:42 | |
| *** ChanServ sets mode: +v openstackstatus | 18:42 | |
| marekd | stevemar: \o/ | 18:42 |
| dstanek | dolphm: ha, i just reviewed that | 18:42 |
| stevemar | marekd, did we start yet? | 18:42 |
| marekd | stevemar: i don't think so :-) | 18:43 |
| dstanek | oh, you gave it a +2 too | 18:43 |
| dolphm | dstanek: +A'd :) | 18:43 |
| dstanek | stevemar: not really - i asked a few questions | 18:43 |
| * marekd wishes one day his patches were +2/+A'd out of the box (just like morganfainberg's) :-) | 18:44 | |
| stevemar | marekd, something we all aspire towards | 18:44 |
| dstanek | marekd: i'll looking at 11 | 18:44 |
| marekd | dstanek: OK | 18:45 |
| dstanek | marekd: just get -infra to complain about whatever it is you are fixing :-) | 18:45 |
| *** nsquare has quit IRC | 18:46 | |
| *** mberlin1 has quit IRC | 18:46 | |
| *** jamielennox|away has quit IRC | 18:46 | |
| *** ekarlso has quit IRC | 18:46 | |
| *** praneshp has quit IRC | 18:46 | |
| *** david-ly_ has quit IRC | 18:46 | |
| *** chandan_kumar has quit IRC | 18:46 | |
| *** diegows has quit IRC | 18:46 | |
| *** bknudson has quit IRC | 18:46 | |
| *** zzzeek has quit IRC | 18:46 | |
| *** richm has quit IRC | 18:46 | |
| *** miqui has quit IRC | 18:46 | |
| *** afazekas_ has quit IRC | 18:46 | |
| *** htruta has quit IRC | 18:46 | |
| *** mitz has quit IRC | 18:46 | |
| *** ByteSore has quit IRC | 18:46 | |
| *** zhiyan_ has quit IRC | 18:46 | |
| *** jdennis has quit IRC | 18:46 | |
| *** openstackgerrit has quit IRC | 18:46 | |
| *** marcoemorais has quit IRC | 18:46 | |
| *** hrybacki has quit IRC | 18:46 | |
| *** mhu has quit IRC | 18:46 | |
| *** comstud has quit IRC | 18:46 | |
| *** mrda-away has quit IRC | 18:46 | |
| *** mgagne has quit IRC | 18:46 | |
| *** dolphm has quit IRC | 18:46 | |
| *** vishy has quit IRC | 18:46 | |
| *** zigo has quit IRC | 18:46 | |
| *** jgriffith has quit IRC | 18:46 | |
| *** Ephur has quit IRC | 18:46 | |
| *** shufflebot has quit IRC | 18:46 | |
| *** uvirtbot has quit IRC | 18:46 | |
| stevemar | global notice eh | 18:46 |
| *** openstackgerrit has joined #openstack-keystone | 18:46 | |
| *** praneshp has joined #openstack-keystone | 18:46 | |
| *** marcoemorais has joined #openstack-keystone | 18:46 | |
| *** david-ly_ has joined #openstack-keystone | 18:46 | |
| *** vishy has joined #openstack-keystone | 18:46 | |
| *** zzzeek has joined #openstack-keystone | 18:46 | |
| *** nsquare has joined #openstack-keystone | 18:46 | |
| *** chandan_kumar has joined #openstack-keystone | 18:46 | |
| *** hrybacki has joined #openstack-keystone | 18:46 | |
| *** diegows has joined #openstack-keystone | 18:46 | |
| *** bknudson has joined #openstack-keystone | 18:46 | |
| *** mhu has joined #openstack-keystone | 18:46 | |
| *** richm has joined #openstack-keystone | 18:46 | |
| *** miqui has joined #openstack-keystone | 18:46 | |
| *** afazekas_ has joined #openstack-keystone | 18:46 | |
| *** mberlin1 has joined #openstack-keystone | 18:46 | |
| *** htruta has joined #openstack-keystone | 18:46 | |
| *** mrda-away has joined #openstack-keystone | 18:46 | |
| *** mitz has joined #openstack-keystone | 18:46 | |
| *** jamielennox|away has joined #openstack-keystone | 18:46 | |
| *** comstud has joined #openstack-keystone | 18:46 | |
| *** ByteSore has joined #openstack-keystone | 18:46 | |
| *** zhiyan_ has joined #openstack-keystone | 18:46 | |
| *** jgriffith has joined #openstack-keystone | 18:46 | |
| *** ekarlso has joined #openstack-keystone | 18:46 | |
| *** Ephur has joined #openstack-keystone | 18:46 | |
| *** mgagne has joined #openstack-keystone | 18:46 | |
| *** jdennis has joined #openstack-keystone | 18:46 | |
| *** dolphm has joined #openstack-keystone | 18:46 | |
| *** uvirtbot has joined #openstack-keystone | 18:46 | |
| *** shufflebot has joined #openstack-keystone | 18:46 | |
| *** zigo has joined #openstack-keystone | 18:46 | |
| *** dickson.freenode.net sets mode: +o dolphm | 18:46 | |
| *** mitz has quit IRC | 18:46 | |
| dstanek | looks like a split! | 18:46 |
| *** mitz- has joined #openstack-keystone | 18:47 | |
| *** david-ly_ has quit IRC | 18:47 | |
| marekd | stevemar: dstanek anyways, getting back to business. I think there is too bug generalisation in the user workflow, and I tried to bring together some ideas I have about user-flow along with their pros and cons. | 18:47 |
| marekd | stevemar: dstanek of course i might have missed someting, so i wanted to hear your coments. | 18:47 |
| dstanek | what is the difference between the new trusted service provider concept and the concept we built for our current federation implementation? | 18:47 |
| marekd | comments | 18:47 |
| *** david-lyle has joined #openstack-keystone | 18:47 | |
| dstanek | marekd: i've reading your evernote now | 18:48 |
| marekd | dstanek: answering your question - the goal is to have better transparency, which idealy would implicate better ser experience. | 18:48 |
| *** david-lyle has quit IRC | 18:49 | |
| marekd | user* | 18:49 |
| stevemar | dstanek, in the current impl, keystone is always the SP with an idp being tivoli or something else. In order to have keystone acting as an IdP, we need to have a way to store service providers | 18:50 |
| *** david-lyle has joined #openstack-keystone | 18:50 | |
| marekd | stevemar: i think the right question to answer is : "Why do we wan to Keystone become IdP with all the saml/oidc stuff" | 18:51 |
| *** openstackgerrit has quit IRC | 18:51 | |
| dstanek | ah ok, so this is the other side of the equation | 18:51 |
| *** openstackgerrit has joined #openstack-keystone | 18:52 | |
| stevemar | dstanek, correcto | 18:55 |
| stevemar | marekd, yes, thats part of the issue | 18:55 |
| *** nsquare has quit IRC | 18:56 | |
| *** mberlin1 has quit IRC | 18:56 | |
| *** jamielennox|away has quit IRC | 18:56 | |
| *** ekarlso has quit IRC | 18:56 | |
| marekd | stevemar: if we want keystone to become IdP just to provide extended Service Catalog then in my opinion it's completely pointless :-) if we, however, want to make use of the first token, which will prbably happen then maybe we will win something. | 18:57 |
| marekd | stevemar: do you think one token for all federated clouds will work? | 18:57 |
| *** cuddyt has quit IRC | 18:57 | |
| marekd | stevemar: like projected at the very beginning? | 18:58 |
| stevemar | marekd, upon the first auth request? | 18:58 |
| *** ayoung is now known as ayoung_afk | 18:58 | |
| marekd | stevemar: yes, get a token from CERN, and use exactly this token against IBM. | 18:58 |
| stevemar | marekd, okay, and assume you get the extended catalog, and IBMs endpoints in your auth request ? | 18:59 |
| marekd | stevemar: heh, exactly. problem number one - extremly big service catalog | 18:59 |
| marekd | stevemar: (note i am not a fan of this solution - one token across many clouds) | 19:00 |
| stevemar | marekd, not if you did /auth/token&IBM then you just get IBM service catalog, not your own, or other SPs | 19:00 |
| marekd | ok, so i need to know all federated clouds a priori? | 19:01 |
| marekd | then I'd say - use old Icehouse federation. | 19:01 |
| stevemar | marekd, go back a few steps | 19:02 |
| stevemar | marekd, if you don't like one token across multiple services, then how do you propose to do it in 1 trip? | 19:02 |
| marekd | what do you meant in 1 trip? | 19:03 |
| marekd | stevemar: very likely every cloud will issue it's own token, scoped to project that is local to that cloud. | 19:04 |
| stevemar | marekd, walk me through the flow you are thinking of :) | 19:04 |
| marekd | stevemar: https://www.evernote.com/shard/s107/sh/5a98433b-3e19-4f09-b70a-122472a2a363/194513837bd0162af4fcfb56a3f15357 | 19:05 |
| marekd | stevemar: but..wait. | 19:05 |
| marekd | we can get back to page one. | 19:05 |
| stevemar | i like page one | 19:06 |
| marekd | stevemar: let's suppose we want CERN issue a token | 19:06 |
| marekd | which will work across multiple federated clouds. | 19:06 |
| marekd | no new tokens. | 19:06 |
| *** rwsu has quit IRC | 19:06 | |
| marekd | stevemar: who and how should scope this token? | 19:07 |
| marekd | do you want CERN's keystone to be aware what projects have Rackspace? | 19:07 |
| marekd | how do i list accessible projects? All in all we want me to talk only with CERN's Keystone. | 19:07 |
| *** erecio has joined #openstack-keystone | 19:08 | |
| marekd | besides I think...it is Rackspace who should be in power to decide who and how can access their resources (in other words, they should do the mapping, assign groups and later roles) | 19:08 |
| *** gordc has joined #openstack-keystone | 19:08 | |
| marekd | stevemar: next thing: as dstanek pointed out not so long ago - what if send my token to Rackspace, who gets compromised. Now, hackers who own RAX Keystone can intercept this token and access poor IBM. | 19:09 |
| marekd | and all in all it will be CERN who gets billed for all this. | 19:10 |
| *** rodrigods_ has joined #openstack-keystone | 19:12 | |
| stevemar | marekd, agree that is should be RAX who decides | 19:14 |
| marekd | stevemar: ++ | 19:14 |
| stevemar | marekd, so you think it would be a bad idea for you (a CERN user) to talk to RAX? | 19:15 |
| marekd | stevemar: hm? why? | 19:15 |
| stevemar | marekd, you wrote "All in all we want me to talk only with CERN's Keystone." | 19:16 |
| marekd | stevemar: ah, no i meant 'let's assume I will get the token only once, from my CERN's Keystone and later use it across remote services like they were my local ones" | 19:17 |
| *** rwsu has joined #openstack-keystone | 19:17 | |
| stevemar | ah okay | 19:17 |
| marekd | stevemar: and then i think we have problems with scoping, and hacking external clouds. | 19:17 |
| *** marcoemorais has quit IRC | 19:18 | |
| *** marcoemorais has joined #openstack-keystone | 19:18 | |
| *** nsquare has joined #openstack-keystone | 19:19 | |
| *** mberlin1 has joined #openstack-keystone | 19:19 | |
| *** jamielennox|away has joined #openstack-keystone | 19:19 | |
| *** ekarlso has joined #openstack-keystone | 19:19 | |
| *** marcoemorais has joined #openstack-keystone | 19:19 | |
| marekd | stevemar: i just think 'federation' should also mean limited trust. Keystone-SP will trust that Keystone-IdP says 'i confirm this is Marek' | 19:19 |
| marekd | stevemar: but KSP should not trust KIdP saying 'let this user access project TOP-SECRET-RAX-TENANT' | 19:19 |
| stevemar | right, | 19:19 |
| stevemar | marekd, but thats all in the mapping., isnt it? | 19:20 |
| marekd | stevemar: right, but where is place for the mapping? Can we do it without RAX Keystone issuing new token? | 19:21 |
| marekd | stevemar: if you have any idea then fire away. | 19:21 |
| marekd | stevemar: maybe i am becoming blind to some simple solutions...:( | 19:21 |
| marekd | stevemar: in the initial concept you have your token and doesn't want to have more interaction with IdPs, you simply want to use your token across all those 10 clouds which happen to be federating themselves. | 19:22 |
| *** rodrigods_ has quit IRC | 19:23 | |
| *** harlowja is now known as harlowja_away | 19:24 | |
| *** topol has joined #openstack-keystone | 19:24 | |
| stevemar | but that token won't have any knowledge about anything other than endpoints | 19:26 |
| marekd | stevemar: but if you want to use it across many clouds all those cloud must validate | 19:27 |
| marekd | the token is right | 19:27 |
| marekd | and you is you. | 19:27 |
| marekd | and token itself is your virtual identificator, right? | 19:28 |
| marekd | token == you and later your bill and real $$$ | 19:28 |
| marekd | stevemar: did I cause you a heart attack? :( | 19:30 |
| stevemar | marekd, no heart attack :) | 19:37 |
| marekd | stevemar: ufff :-) | 19:37 |
| marekd | hopefully only coffee break :-) | 19:38 |
| stevemar | marekd, you know it | 19:38 |
| stevemar | marekd, so what about passing that token to the OS-FED url? | 19:38 |
| *** david-lyle has quit IRC | 19:38 | |
| stevemar | right, then you have yet another token... | 19:39 |
| marekd | stevemar: yes. | 19:39 |
| marekd | you cannot even pass your token to OS-FED url just as is. | 19:39 |
| marekd | how do you get the assertion? | 19:39 |
| marekd | there must be some extra steps | 19:40 |
| marekd | unless you pass assertion in your token :P | 19:40 |
| stevemar | marekd, the token contains *some* data | 19:40 |
| stevemar | i was hoping that between the token data, and mapping, we might get something | 19:41 |
| marekd | stevemar: what token data? | 19:41 |
| *** erecio has quit IRC | 19:42 | |
| marekd | stevemar: okay, maybe you want me to walk through the workflow. | 19:44 |
| *** david-lyle has joined #openstack-keystone | 19:47 | |
| stevemar | marekd, user auth /v3/auth/token&sp=RAX | 19:47 |
| stevemar | and lets scope it to a project | 19:48 |
| stevemar | i should get back a catalog with RAX endpoints and project / user / role data right? | 19:48 |
| marekd | stevemar: /v3/auth/token&sp=RAX -> at CERN's Keystone? | 19:49 |
| stevemar | yep | 19:49 |
| marekd | how CERN's Keystone knows what projcts I can access? | 19:49 |
| marekd | at RAX ofc | 19:49 |
| stevemar | marekd, scope to whatever project you are working on at CERN, the one that needs more resources | 19:50 |
| stevemar | marekd, then use that token in the OS-FED request at RAX | 19:50 |
| stevemar | RAX will validate the token is coming from a trusted resource, and will using a mapping to go from project A at CERN to project X at RAX ? | 19:51 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: Make adminurl and internalurl parameters to EndpointManager create() optional https://review.openstack.org/102602 | 19:51 |
| stevemar | marekd, that's what I was thinking anyway | 19:51 |
| stevemar | marekd, i could be off the mark | 19:51 |
| marekd | stevemar: hmmmmmm | 19:52 |
| marekd | stevemar: do you want to use assertion somewhere? | 19:52 |
| marekd | or just map projects into projects? | 19:52 |
| stevemar | marekd, the token is an assertion, it's showing you the user data and what he has authority to access | 19:52 |
| stevemar | marekd, it's just not a SAML assertion | 19:53 |
| marekd | stevemar: ok, in that case we abandon saml, openidc and all those protocols. | 19:53 |
| stevemar | marekd, think it through though! | 19:53 |
| stevemar | marekd, maybe i'm crazy | 19:53 |
| marekd | stevemar: i don't mind :-) | 19:53 |
| marekd | stevemar: but... | 19:53 |
| marekd | we are getting back to dstanek's question. | 19:54 |
| dstanek | marekd: yay! | 19:54 |
| marekd | ok, i send my token | 19:54 |
| stevemar | lol | 19:54 |
| marekd | to RAX | 19:54 |
| morganfainberg | zzzeek, let me know when you're back, i want to run something by you. for limited use trusts | 19:54 |
| marekd | RAX is compromised | 19:54 |
| stevemar | dstanek has been waiting patiently this whole time | 19:54 |
| marekd | intercepts my token | 19:54 |
| hrybacki | ayoung_afk: ping | 19:54 |
| * morganfainberg is also listening now to this convo | 19:54 | |
| *** david-lyle has quit IRC | 19:54 | |
| zzzeek | morganfainberg: was just going out for a coffee….15 min? | 19:55 |
| marekd | and now bad people can impersonate myself at IBM | 19:55 |
| stevemar | marekd, i dont have an answer for that, but realistically if someone is able to see your token at this level, he can catch it at another level | 19:55 |
| morganfainberg | zzzeek, great! I wouldn't dream of getting between someone and their coffee | 19:55 |
| morganfainberg | zzzeek, also might owe ya a coffee in Paris for the summit ;) | 19:55 |
| stevemar | marekd, either way, i think this problem will always exist, no matter the implementation | 19:56 |
| marekd | dstanek: morganfainberg do you agree with stevemar ? | 19:56 |
| dstanek | stevemar: i've been watching on/off, and reading | 19:56 |
| zzzeek | i likely have to miss paris b.c. my wifes due date is nov 6 :( :) | 19:56 |
| morganfainberg | zzzeek, thats a damn good reason to miss the summit though ;) gratz! | 19:56 |
| stevemar | zzzeek, that is a very good reason :) | 19:57 |
| morganfainberg | marekd, hm. this is a tough one. | 19:57 |
| marekd | stevemar: if the client handles a token per cloud we could avoid this... | 19:57 |
| stevemar | marekd, do i watch ALG-RUS or KOR-BEL? | 19:57 |
| morganfainberg | marekd, this is exactly why i always was concerned about cloud X issuing a token for Cloud Y | 19:57 |
| *** david-lyle has joined #openstack-keystone | 19:58 | |
| morganfainberg | marekd, with the initial proposal that is | 19:58 |
| stevemar | morganfainberg, that is old news now! | 19:58 |
| morganfainberg | or well using a token that could be used in either. | 19:58 |
| morganfainberg | stevemar, bah, i'm still catching up | 19:58 |
| morganfainberg | stevemar, Kor-Bel | 19:58 |
| morganfainberg | stevemar, No question | 19:58 |
| morganfainberg | I have high hopes for Belgium | 19:59 |
| morganfainberg | though Korea isn't likely to make it to knock-out | 19:59 |
| stevemar | morganfainberg, thanks for the suggestion :) | 20:00 |
| morganfainberg | *likely = not possible? | 20:00 |
| *** lbragstad has left #openstack-keystone | 20:00 | |
| marekd | stevemar: did you ask for suggestions or wanted us to guess? :P | 20:00 |
| stevemar | morganfainberg, the whole mathematics thing is a downer huh | 20:00 |
| stevemar | marekd, suggestions :) | 20:00 |
| morganfainberg | stevemar, lol | 20:00 |
| marekd | yeah, watch BEL :P | 20:00 |
| marekd | maybe i should watch it too... | 20:01 |
| morganfainberg | stevemar, ALG vs RUS might be a more even game, but i'd totally watch BEL | 20:01 |
| marekd | bah, i need to pack my stuff for the weekend. | 20:01 |
| morganfainberg | marekd, where you headed? | 20:01 |
| marekd | gonna see if i manage to climb 4000m above the sea level... | 20:02 |
| morganfainberg | marekd, like hike? or mountaineering? or rock climbing? | 20:02 |
| marekd | hike. | 20:02 |
| morganfainberg | marekd, awesome! | 20:02 |
| marekd | we will see :-) | 20:03 |
| morganfainberg | marekd, I need to go up to visit my brother go for a bike ride this weekend | 20:03 |
| *** erecio has joined #openstack-keystone | 20:03 | |
| morganfainberg | maybe i'll go for a ride at 6000ft ;) | 20:03 |
| *** bobt has quit IRC | 20:03 | |
| marekd | (need to convert into meters :P) | 20:03 |
| morganfainberg | marekd, you've inspired me to go to elevation this weekend and be active | 20:03 |
| morganfainberg | hey, 6000ft is what... 2km ? | 20:04 |
| morganfainberg | ish | 20:04 |
| marekd | 6000ft ~ 1800m | 20:04 |
| marekd | yeah | 20:04 |
| morganfainberg | iyeah it's not as high as you're headed | 20:04 |
| morganfainberg | but still! | 20:04 |
| *** vhoward has left #openstack-keystone | 20:04 | |
| marekd | but you are biking.... | 20:04 |
| marekd | that's different. | 20:04 |
| marekd | eh, last year i went that high and it wasn't the best experience i've ever had | 20:05 |
| morganfainberg | marekd, i could go even to 2500m easily, but ugh, always hurts | 20:05 |
| morganfainberg | marekd, i'm hoping next year to climb (hike?) mt. whitney (4,421 m) | 20:05 |
| marekd | good for ya :-) | 20:05 |
| marekd | ever been that high? | 20:05 |
| morganfainberg | marekd, reminds me to put in for the permit this year | 20:05 |
| morganfainberg | never been over 3700m | 20:06 |
| marekd | morganfainberg: ah, you need permits for that... | 20:06 |
| morganfainberg | but used to hike up in the sierras when i was younger. (yosemite) | 20:06 |
| marekd | 3700 is high enough to suffer from heigh. | 20:06 |
| morganfainberg | and the back country | 20:06 |
| morganfainberg | yeah one of the times i wasn't happy till almost a week into being at elevation | 20:06 |
| morganfainberg | then it was time to head home >.< | 20:06 |
| marekd | last year at 4000m i was completely destryed.... | 20:07 |
| marekd | destroyed | 20:07 |
| morganfainberg | marekd, well this year will be better! | 20:07 |
| morganfainberg | :) | 20:07 |
| * morganfainberg is positive about these things. | 20:07 | |
| marekd | morganfainberg: let's see ;-) | 20:07 |
| marekd | morganfainberg: so you are watching the game ? | 20:07 |
| marekd | or hanging around here? | 20:07 |
| morganfainberg | nah, gotta write code | 20:07 |
| morganfainberg | have a nasty bug to fix | 20:07 |
| morganfainberg | then gotta hit the gym, and see if i can make it to OpenStack LA meetup | 20:08 |
| morganfainberg | after | 20:08 |
| marekd | pity, I was hoping you want to share your opinions on k2k :P | 20:08 |
| morganfainberg | marekd, oh i can chat about that now. | 20:08 |
| morganfainberg | :) | 20:08 |
| morganfainberg | also need to sync up w/ mike about the trust thing | 20:08 |
| morganfainberg | so waiting on coffee returns | 20:09 |
| morganfainberg | marekd, unrelated can i visit cern? ;) | 20:09 |
| marekd | morganfainberg: whenever you want. | 20:09 |
| morganfainberg | awesome! I totally want to visit ;) | 20:09 |
| marekd | morganfainberg: i will make sure you join some underground visits | 20:09 |
| morganfainberg | woo | 20:10 |
| marekd | before/afer paris? | 20:10 |
| morganfainberg | after, wont be before. | 20:10 |
| zzzeek | morganfainberg: back | 20:10 |
| morganfainberg | zzzeek, welcome back! | 20:10 |
| marekd | morganfainberg: sure! | 20:10 |
| stevemar | morganfainberg, so, what do you think about using the token you received from IdP-keystone, and pass that token to OS-FEDERATION url at SP-Keystone. And using the token data as an assertion and put those values through the mapping engin? | 20:10 |
| stevemar | (after the token has been validated as coming from a trusted IdP) | 20:11 |
| morganfainberg | stevemar, let me read that one more time ... brain is just now kicking in post coffee | 20:11 |
| stevemar | morganfainberg, cool | 20:11 |
| marekd | morganfainberg: ++ | 20:11 |
| morganfainberg | zzzeek, so i'm thinking we just create a table that we inject a row in for each trust issued (limited use trusts), if a trust is completely expired (hit the limit) we can mark it expired explicitly and cleanup the limited use rows. | 20:12 |
| morganfainberg | zzzeek, it doesn't solve race conditions, but at the very least it means we have a clean audit of how many were issued. | 20:12 |
| zzzeek | morganfainberg: OK, at the moment I dont actually know waht kind of concept we are representing, only that you were locking a row. i guess you are saying, instead of doing UPDATE just keep INSERTing new rows and clean out old ones | 20:13 |
| morganfainberg | zzzeek, rather than a question as to "well we tried, and we make a best effort to not issue too many but we can't tell you more" | 20:13 |
| morganfainberg | zzzeek yep. | 20:13 |
| zzzeek | i would say that that can be very performant, becuase INSERTs are easy | 20:13 |
| morganfainberg | zzzeek, what we're representing is a decrementing counter. when it hits 0, no more trusts can be issued | 20:13 |
| zzzeek | but what do you do with the rows in these tables? ah | 20:13 |
| morganfainberg | zzzeek, trust is a delegation of auth via a keystone token | 20:13 |
| zzzeek | so you need to query it how, that theres a count() of trusts ? | 20:14 |
| morganfainberg | zzzeek, well no, more of a count() of tokens issued for trust X | 20:14 |
| zzzeek | right, so counting tokens | 20:14 |
| zzzeek | do these tokens have unique identifiers ? | 20:14 |
| morganfainberg | zzzeek, they do, but we're moving away from storing the tokens. | 20:14 |
| zzzeek | ah | 20:14 |
| morganfainberg | zzzeek, token ids can be > 8k | 20:15 |
| morganfainberg | PKI signed data issue | 20:15 |
| zzzeek | well if you are storing row-per-token here you might as well put it in …ah . hm no simple GUID for it? | 20:15 |
| morganfainberg | zzzeek, well, we can use the short-hash. | 20:15 |
| zzzeek | OK | 20:15 |
| marekd | stevemar: do you want a RAX cloud to return a token in return? | 20:16 |
| morganfainberg | zzzeek, but long story short, i was using select for update to lock the row and prevent extras from being issued. i'm ok if we make a "best effort" on issuance. | 20:16 |
| zzzeek | OK | 20:16 |
| morganfainberg | zzzeek, but if we make a best effort i want to know how many were issued | 20:16 |
| morganfainberg | zzzeek, audit trail | 20:16 |
| marekd | stevemar: blah... | 20:16 |
| marekd | stevemar: user uses CERN-token and hits RAX | 20:17 |
| * morganfainberg hates having to work around something silly like a deployment choice (read: best practice) for a certain RDBMS | 20:17 | |
| marekd | stevemar: RAX Keystone maps projects and things basing on data from CERN-token. | 20:17 |
| morganfainberg | marekd, i'll share thoughts once i'm done w/ convo w/ zzzeek. | 20:17 |
| marekd | stevemar: what is returned? | 20:18 |
| marekd | morganfainberg: okay. | 20:18 |
| stevemar | marekd, RAX would return a RAX token, scoped to a project (result of the mappin) | 20:18 |
| morganfainberg | stevemar, keystone token as and assertion equivalent? | 20:18 |
| morganfainberg | stevemar, not a bad idea... | 20:18 |
| marekd | stevemar: ha! so if I now wanted to use IBM i would have to get another token, IBM-token | 20:19 |
| stevemar | it's got the user, roles and project info already | 20:19 |
| marekd | and later juggle with both of them? | 20:19 |
| stevemar | marekd, hmm, yeah... | 20:19 |
| stevemar | marekd, i guess thats not optimal | 20:19 |
| marekd | stevemar: hmmm...so we don't have one token to be used accross multiple clouds... | 20:20 |
| stevemar | that would help with dstaneks vulnerability situation | 20:20 |
| *** david-lyle has quit IRC | 20:20 | |
| marekd | stevemar: and this is what i was basically saying :-) | 20:20 |
| marekd | stevemar: i don't think this would really help... | 20:20 |
| marekd | stevemar: you send your token to RAX. | 20:21 |
| *** david-lyle has joined #openstack-keystone | 20:21 | |
| marekd | stevemar: you send your identity to a stranger | 20:21 |
| morganfainberg | zzzeek, unless we can use a transaction to limit issuance? | 20:21 |
| marekd | and have no control what happens with that after that. | 20:21 |
| zzzeek | morganfainberg: how exactly | 20:21 |
| morganfainberg | update trust where id=<trust_id> and count=<expected count> ? | 20:21 |
| marekd | stevemar: how about sending to RAX not a CERN-token, but token which is prepared only for RAX? | 20:22 |
| marekd | stevemar: we have agreed client must handle multiple tokens already.... | 20:22 |
| morganfainberg | so query, get the expected count, compare if we've hit the limit, if not try an update. if update fails we try again [unless 100% consumed] | 20:22 |
| *** harlowja_away is now known as harlowja | 20:23 | |
| zzzeek | morganfainberg: OK these are tokens as they are issued, what deos the update mean | 20:23 |
| *** andreaf_ has joined #openstack-keystone | 20:23 | |
| marekd | stevemar: then, whatever RAX receives, it cannot use with IBM | 20:23 |
| morganfainberg | the update is on the trust record row, decrementing the counter | 20:23 |
| *** andreaf_ has quit IRC | 20:23 | |
| zzzeek | morganfainberg: OK is this again one row per trust type? counting number of issuances ? | 20:24 |
| morganfainberg | zzzeek, so the workflow is supposed to be: check to see if trust can issue tokens, decrement counter, issue token | 20:24 |
| zzzeek | morganfainberg: sure, so what was the SELECT FOR UPDTE for, because you did a separate SELECT ? | 20:24 |
| marekd | stevemar: one more thing... | 20:24 |
| zzzeek | morganfainberg: yeah if you can UPDATE in one go then you’re doing it atomically, sure | 20:24 |
| *** david-lyle has quit IRC | 20:25 | |
| morganfainberg | zzzeek, and if we explicitly make the update require the count to be what we queried, we should be safe from races | 20:25 |
| marekd | stevemar: we are here creating another protocol...somehow. do we want to do this? I think at some point morganfainberg was not happy with that. we can use saml/oidc by adding some extra steps in the middle. | 20:25 |
| zzzeek | morganfainberg: well yes you can do that, it’s kind of like using a version id. that is, you incerment the “Version” of the row each time you do somethign with it and make sure that’s the version you’d loaded | 20:25 |
| morganfainberg | zzzeek, yep. | 20:26 |
| zzzeek | morganfainberg: but this is optimistic locking. if the version isn’t what you expect, what do you want to do ? | 20:26 |
| morganfainberg | zzzeek, i don't like it (select for update is just so much ... cleaner) | 20:26 |
| marekd | stevemar: morganfainberg: https://www.evernote.com/shard/s107/sh/5a98433b-3e19-4f09-b70a-122472a2a363/194513837bd0162af4fcfb56a3f15357 - some possible flows, including something similar to what just stevemar proposed (last one) | 20:26 |
| zzzeek | morganfainberg: ive been assuming pessmistic locking was a req here. i always use an optimsitic approach | 20:26 |
| morganfainberg | zzzeek, try again, keep trying until either we run out of tokens to issue, or the update is successful | 20:26 |
| marekd | stevemar: morganfainberg i will be back in 20-30 minutes. | 20:26 |
| morganfainberg | zzzeek, ++ | 20:26 |
| stevemar | marekd, same | 20:27 |
| zzzeek | morganfainberg: OK if you think contention is low, then you can go with that | 20:27 |
| zzzeek | morganfainberg: i dont know how often this change occurs (100s per second, a few per hour) so that matters | 20:27 |
| morganfainberg | zzzeek, shouldn't be 100s per second, at most it should be a couple per second with window in between | 20:27 |
| morganfainberg | probably closer to a few a minute at the high high high end | 20:28 |
| zzzeek | morganfainberg: you can do it like this: “UPDATE table SET <whatever> WHERE id=<the id> AND counter_thing_we_expect=<the count we expect>”, then count the rows matched. it should be one | 20:28 |
| morganfainberg | zzzeek, ++ that was the plan. | 20:29 |
| zzzeek | great | 20:29 |
| morganfainberg | zzzeek, i'll respin this code to work like that. | 20:29 |
| morganfainberg | thanks! :) | 20:29 |
| zzzeek | morganfainberg: i see that as cleaner b.c. i see locking as putting a big broken clamp on the database | 20:29 |
| *** vhoward has joined #openstack-keystone | 20:30 | |
| morganfainberg | zzzeek, yeah. there are a lot of concerns i have with races in keystone when we run under apache or with multiple workers | 20:30 |
| morganfainberg | zzzeek, but this one is related to a authorization limit, so i was being a bit more picky about it. | 20:30 |
| *** erecio has quit IRC | 20:30 | |
| morganfainberg | zzzeek, i'll circle up with you as we start working on the other race concerns in keystone, maybe we can cleanly solve more of them with optimistic locking :) | 20:31 |
| morganfainberg | stevemar, marekd, let me know when you're back | 20:31 |
| zzzeek | morganfainberg: OK :) | 20:33 |
| *** diegows has quit IRC | 20:34 | |
| *** marcoemorais has quit IRC | 20:34 | |
| *** marcoemorais has joined #openstack-keystone | 20:34 | |
| *** marcoemorais has quit IRC | 20:35 | |
| *** marcoemorais has joined #openstack-keystone | 20:35 | |
| *** marcoemorais has quit IRC | 20:35 | |
| *** marcoemorais has joined #openstack-keystone | 20:35 | |
| morganfainberg | vishy, ping - re region table | 20:43 |
| vishy | sup? | 20:44 |
| morganfainberg | vishy, all i have to say is "ick" :( | 20:44 |
| vishy | yeah | 20:44 |
| vishy | :( | 20:44 |
| vishy | i wish my first thought was correct | 20:44 |
| vishy | because it would have been way easier | 20:44 |
| *** david-lyle has joined #openstack-keystone | 20:44 | |
| morganfainberg | vishy, yeah. the sanity check is ... i think sort of broken | 20:44 |
| morganfainberg | because a bad migration can wedge you | 20:44 |
| morganfainberg | there is no recovery | 20:45 |
| morganfainberg | i think i'm going to add a --skip-sanity check options to keystone manage, and restrict it to a single version jump if set | 20:45 |
| morganfainberg | vishy, alternatively i could just hack this to run a magic migration to fix the table in this one-off case | 20:46 |
| *** radez is now known as radez_g0n3 | 20:47 | |
| *** dstanek is now known as dstanek_zzz | 20:47 | |
| vishy | morganfainberg: i think we are just going to fix the migration in place which solves our problem | 20:48 |
| vishy | but the general upstream case is a huge mess for sure | 20:48 |
| morganfainberg | vishy, for you it's less of an issue, i'm thinking from the upstream case | 20:48 |
| morganfainberg | i'm wondering if anyone has really gotten wedged with this besides you. | 20:49 |
| vishy | there was one on the ml | 20:49 |
| morganfainberg | darn | 20:49 |
| *** dims_ has joined #openstack-keystone | 20:49 | |
| *** bobt has joined #openstack-keystone | 20:49 | |
| vishy | morganfainberg: http://www.gossamer-threads.com/lists/openstack/dev/38889 | 20:50 |
| morganfainberg | ok. let me fix the migration. i think i'll add a magic hook for this one off in to go aroudn the migration tools to fix it if wedged | 20:50 |
| vishy | fair enough | 20:50 |
| morganfainberg | basically if sanity_check fails, and version == <broken version>, go fix table | 20:50 |
| morganfainberg | and try again | 20:51 |
| morganfainberg | i'll tag you on the master review and once we get that in, i'll get it backported to I | 20:51 |
| * morganfainberg wonders how to craft a test case for this one. | 20:52 | |
| *** jaosorior has quit IRC | 20:52 | |
| *** dims__ has quit IRC | 20:52 | |
| *** andreaf_ has joined #openstack-keystone | 20:56 | |
| *** david-lyle has quit IRC | 20:57 | |
| *** david-lyle has joined #openstack-keystone | 20:57 | |
| *** david-lyle has quit IRC | 20:58 | |
| *** david-lyle has joined #openstack-keystone | 20:58 | |
| marekd | morganfainberg: ok, let's say i am back. | 21:02 |
| morganfainberg | marekd, hehe | 21:03 |
| morganfainberg | marekd, so you're thinking if you need to talk to <SP Cloud, e.g. RAX> you should have a token explicitly scoped to talk to RAX and only RAX [can't be used elsewhere for anything else] | 21:04 |
| marekd | morganfainberg: yes. | 21:04 |
| morganfainberg | marekd, this seems to play nicely with the session token spec, you know | 21:05 |
| marekd | morganfainberg: stevemar already agreed there is no way to have *only* one token | 21:05 |
| marekd | morganfainberg: since remote cloud (RAX) needs to do some mapping etc. | 21:05 |
| morganfainberg | now, out of curiosity, could keystone issue a non-token assertion that could be used for that purpose? | 21:05 |
| morganfainberg | this feels an awful lot like we're creating a new protocol | 21:05 |
| marekd | morganfainberg: we are. | 21:06 |
| openstackgerrit | A change was merged to openstack/keystone: Convert explicit session get/begin to transaction context https://review.openstack.org/97058 | 21:06 |
| morganfainberg | (not saying we shouldn't if it is the best course of action) | 21:06 |
| morganfainberg | but if we could use a protocol that already exists, might be better, no? | 21:06 |
| marekd | morganfainberg: i think we can try to reuse OpenID Connect/SAML but this could mean extra steps in between. | 21:06 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Update setup.cfg to remove keystoneclient ref https://review.openstack.org/102360 | 21:06 |
| morganfainberg | marekd and the proposers explicitly don't want extra steps | 21:06 |
| * morganfainberg grumbles a little. | 21:07 | |
| marekd | morganfainberg: they want to always use one token... | 21:07 |
| marekd | morganfainberg: they don't want to change the client...we already will need to change the client. | 21:07 |
| marekd | morganfainberg: i was thinking that | 21:07 |
| marekd | we might want to hide saml authentication a little bit. | 21:08 |
| morganfainberg | marekd, yeah thats fine | 21:08 |
| morganfainberg | marekd, i just want to make sure we're not doing a "not invented here" approach | 21:08 |
| marekd | morganfainberg: a) local user authN with CERN | 21:08 |
| morganfainberg | but more doing a "this is the best approach, regardless of where it was invented" | 21:08 |
| *** dstanek_zzz is now known as dstanek | 21:09 | |
| marekd | morganfainberg: we can try making the CERN-token just a 'key' for authentication with Keystone-IdP | 21:10 |
| marekd | and the federation flow is kept. | 21:10 |
| *** hrybacki has quit IRC | 21:11 | |
| morganfainberg | marekd, i'm ok with using the full mapping system. just making sure we don't ignore something that exists that meets our needs | 21:11 |
| *** hrybacki has joined #openstack-keystone | 21:11 | |
| morganfainberg | and if SAML or other such protocol doesn't fit/meet the needs/can't be made to meet our needs, that is fine | 21:11 |
| marekd | morganfainberg: i think making our own protocol seems to be easy, but might get harder to make it right.. | 21:12 |
| marekd | dstanek: did you read that evernote ? | 21:12 |
| morganfainberg | marekd, ++ and this would be predicated on documenting the protocol and not deviating from it for convienence | 21:12 |
| morganfainberg | i would expect this protocol to work across versions of keystone. | 21:12 |
| morganfainberg | (in fact, it would need to) | 21:13 |
| morganfainberg | marekd, which is why i want to be 100% sure something that is well defined can't fit the bill :) | 21:13 |
| morganfainberg | e.g. SAML, openid, <something else> | 21:13 |
| marekd | morganfainberg: sure. | 21:13 |
| marekd | morganfainberg: i think we can reuse existing protocols | 21:14 |
| marekd | maybe somehow break the workflow | 21:14 |
| morganfainberg | marekd, yeah. | 21:14 |
| morganfainberg | marekd, i like everything said so far, i think we're on the right path. I think there is value here | 21:15 |
| marekd | morganfainberg: hm, look. | 21:15 |
| morganfainberg | i just am concerned about the implementation being "right" | 21:15 |
| marekd | morganfainberg: me too. and at some point we need to decide "SAML", or "OIDC", or "let's implement something new" | 21:15 |
| morganfainberg | yep | 21:16 |
| marekd | morganfainberg: ok, lets discuss such scenario. | 21:16 |
| morganfainberg | marekd, right-o :) | 21:16 |
| marekd | morganfainberg: CERN - local Keystone, RAX, remote. | 21:16 |
| * morganfainberg listens. | 21:17 | |
| *** dstanek is now known as dstanek_zzz | 21:19 | |
| marekd | morganfainberg: user logins with CERN, gets token. He now goes to RAX's OS-FED URL and initiates federated authN. RAX Keystone issues SAML/OIDC request authn and sends it directly to keystone-IdP (CERN). It uses user's token as a key to authenticate the user. Keystone-IdP returns SAML assertion, there is mapping and things we do in Icehouse now. | 21:19 |
| marekd | user is not aware there was some communication between keystones | 21:19 |
| marekd | RAX returns token to be used with RAX only. | 21:19 |
| *** hrybacki has quit IRC | 21:20 | |
| *** andreaf_ has quit IRC | 21:20 | |
| marekd | but we cannot rely on apache modules :( and need to implement SAML-specific logic into keystone. | 21:20 |
| morganfainberg | marekd, something like pysaml, yes | 21:20 |
| marekd | morganfainberg: yes, and some hacks on top of it | 21:20 |
| morganfainberg | would RAX ever see the CERN token in this case? | 21:20 |
| marekd | morganfainberg: yes. | 21:20 |
| morganfainberg | would the CERN token be scoped in a way to make it only usable by RAX? | 21:21 |
| marekd | but i can imagine client somehow makes this token usable with RAX only. | 21:21 |
| morganfainberg | or is it a "normal" token | 21:21 |
| marekd | morganfainberg: i'd say usable with RAX only, otherwise we are facing impersonation problem again. | 21:21 |
| morganfainberg | yeah, security thoughts MITM + scraping the token and then using with CERN would be bad | 21:21 |
| morganfainberg | ++ | 21:21 |
| *** tellesnobrega has quit IRC | 21:22 | |
| marekd | we can also put some burden on a client. | 21:22 |
| morganfainberg | ok so, good from resuse tech, bad from implementing SAML logic directly and hakcing it up [our own protocl that sorta looks like SAML for transport] | 21:22 |
| marekd | so keystone RAX is not breaking the federation workflow, but it all happens with a client involved. | 21:22 |
| morganfainberg | and CERN's workflow would be issuing an assertion, so it would look normal-ish | 21:23 |
| morganfainberg | it's just very client specific. | 21:23 |
| marekd | client goes to RAX OS-FED url, he gets authN saml request, client agains passes this request to Keystone-IdP and gets assertion, and again returns to Keystone RAX with an assertion. | 21:23 |
| morganfainberg | hm. | 21:24 |
| marekd | yes, very client specific, but...in federation clients are always involved. | 21:24 |
| morganfainberg | right | 21:24 |
| marekd | prons here are: we can reuse Icehouse federation alsmost entirely | 21:24 |
| marekd | RAX doesn't see CERN's token. | 21:24 |
| *** tellesnobrega has joined #openstack-keystone | 21:24 | |
| marekd | cons: big impact on the client. | 21:24 |
| morganfainberg | marekd, heck it looks like icehouse's federation might even work (as a consumer, e.g. RAX) | 21:24 |
| * morganfainberg nods. | 21:25 | |
| *** marcoemorais has quit IRC | 21:25 | |
| marekd | morganfainberg: yes | 21:25 |
| stevemar | marekd, morganfainberg catching up | 21:25 |
| marekd | morganfainberg: on the other hand..what's the added value with all that? :-) | 21:25 |
| *** marcoemorais has joined #openstack-keystone | 21:25 | |
| marekd | morganfainberg: why not leave old federation? :-) | 21:25 |
| marekd | morganfainberg: we are now talking about implementing LDAP into Keystone... | 21:26 |
| marekd | morganfainberg: to make it fully functional IdP. | 21:26 |
| morganfainberg | marekd, it means that the public clouds or external SPs can lag behind a little | 21:26 |
| morganfainberg | marekd, true. | 21:26 |
| *** david-lyle has quit IRC | 21:26 | |
| morganfainberg | oidc would be about the same (benefits/flaws) | 21:27 |
| morganfainberg | at quick glance | 21:27 |
| *** david-lyle has joined #openstack-keystone | 21:27 | |
| marekd | the designed workflow is pretty much the same. | 21:27 |
| marekd | i was thinking oAuth | 21:27 |
| marekd | *somehow* but didn't find anything brilliant enough :/ | 21:27 |
| *** henrynash has quit IRC | 21:27 | |
| *** david-lyle has quit IRC | 21:28 | |
| morganfainberg | marekd, so oAuth doesn't fit the bill either | 21:28 |
| morganfainberg | ? | 21:28 |
| *** david-lyle has joined #openstack-keystone | 21:28 | |
| marekd | oauth is generally rather authZ not authN, I think... | 21:28 |
| morganfainberg | ah | 21:28 |
| morganfainberg | yeah | 21:28 |
| marekd | well, basically i didn't find a good use for oAuth. | 21:29 |
| marekd | i think that even if we reuse SAML/OIDS we will be doing some small hacks. | 21:29 |
| marekd | OIDC | 21:29 |
| *** henrynash has joined #openstack-keystone | 21:29 | |
| *** henrynash has quit IRC | 21:31 | |
| morganfainberg | nod | 21:31 |
| stevemar | marekd, yeah oauth is authZ only, not authN | 21:32 |
| morganfainberg | marekd, ok lets explore "implement our own protocol" | 21:32 |
| marekd | morganfainberg: ++ | 21:32 |
| marekd | (also keep in mind joe savak initially wanted to use existing protocols...) | 21:33 |
| morganfainberg | since we know oAuth isn't going to work, and SAML/OIDC has weird hackyness (not right out, but still not a perfect fit) | 21:33 |
| marekd | morganfainberg: ofirst of all: we are not compilant with the rest of the world :-) | 21:34 |
| morganfainberg | marekd, which bugs me some. | 21:34 |
| morganfainberg | but even if we used SAML we're only "sort-of" compliant | 21:34 |
| marekd | morganfainberg: yeah. | 21:34 |
| marekd | unless we fully align with saml workflow...which we are desperately trying to avoid :-) | 21:35 |
| morganfainberg | lol, it was my original thought that we would head more that direction than avoid it | 21:35 |
| morganfainberg | but the spec outlines some usecases that makes that a hard(er) sell | 21:35 |
| marekd | morganfainberg: if we align saml design than again - we are reusing icehouse federation | 21:36 |
| morganfainberg | marekd, yep. just making keystone more of a first-class IDP (regardless of what the backend is, a lot more support) | 21:37 |
| marekd | morganfainberg: and we can at maximum define IdP authN method...for instance with a token issued by a local Keystone. | 21:37 |
| morganfainberg | it would almost say we should make keystone-idp it's own process. | 21:37 |
| marekd | morganfainberg: right. | 21:37 |
| morganfainberg | and keystone only ever consumes (via federation) the IDP data | 21:37 |
| morganfainberg | ok so lets set that aside, and see what it'sgoing to take to implement something custom | 21:38 |
| morganfainberg | so i see us needing a couple of things | 21:38 |
| morganfainberg | secure way to validate/trasnmit data (x509 certs between the keystones?) | 21:39 |
| *** mrda-away is now known as mrda | 21:39 | |
| marekd | morganfainberg: some public/private key enryption. | 21:39 |
| morganfainberg | a definition of what the inter-keystone data looks like. very well defined, validated, and versioned | 21:39 |
| marekd | does x509 also covers signing ? | 21:40 |
| morganfainberg | versioning = forward thinking not needed out the gate | 21:40 |
| morganfainberg | yah x509 can do signing, we use it for PKI tokens | 21:40 |
| morganfainberg | we do s/mime, | 21:40 |
| morganfainberg | keystone already has to understand CMS (S/MIME) so we can just re-use that | 21:41 |
| morganfainberg | so what data would need to be transmitted to make the mapping engine reusable in this new protocol. - we want to keep the data sets reasonably small. | 21:42 |
| marekd | morganfainberg: ok | 21:42 |
| marekd | morganfainberg: stevemar had a nice idea about mapping projects | 21:42 |
| marekd | morganfainberg: e.g. i authN with my CERN keystone, scope to my CERN's project | 21:43 |
| marekd | becuause it's running out of resources | 21:43 |
| marekd | and later, RAX Keystone maps projectA -> projectX (at RAX) | 21:44 |
| morganfainberg | sure. | 21:44 |
| morganfainberg | that kind of flexibility would be great | 21:44 |
| marekd | however i don know if that's enough | 21:44 |
| marekd | and will cover all the usecases. | 21:44 |
| marekd | and in fact will be flexible enough. | 21:44 |
| marekd | but should keep tokens small. | 21:45 |
| marekd | we cannot scope the token to more than one project, can we? | 21:45 |
| marekd | morganfainberg: hmmm, and how about dynamic mapping? | 21:45 |
| marekd | morganfainberg: ah no, forget. | 21:46 |
| morganfainberg | marekd, hehe | 21:46 |
| morganfainberg | marekd, no can't scope tokens to more than one project atm (and there are arguments as to if we should ever allow that) | 21:46 |
| marekd | morganfainberg: RAX keystone should issue new token, signed with its key, so RAX-nova doesn't need play with mappings and all that stuff. | 21:46 |
| marekd | all in all we end with multiple tokens ;/ | 21:47 |
| stevemar | one per SP | 21:47 |
| marekd | stevemar: yes. | 21:47 |
| morganfainberg | marekd, yep. | 21:47 |
| marekd | stevemar: but i think we cannot skip that. | 21:48 |
| marekd | hmmm, this could even work and be relatively simple in its design. | 21:49 |
| marekd | (if its simple by design this will probably end up hard in implementation :P) | 21:49 |
| stevemar | marekd, wouldn't be that hard IMO | 21:50 |
| stevemar | SP CRUD (has to happen no matter what path we go down) | 21:50 |
| marekd | let's walk through the workflow | 21:50 |
| stevemar | and enhance the mapping | 21:50 |
| marekd | stevemar: and signing, validating, en/decrypting tokens. | 21:50 |
| stevemar | marekd, yep, beat me to typing that.... that part would be tricky | 21:51 |
| marekd | and possibly error prone. | 21:51 |
| stevemar | i'll do the first two items if you do that part :P | 21:51 |
| stevemar | marekd, what would the client process look like? | 21:52 |
| stevemar | client flow | 21:52 |
| marekd | stevemar: let me try with that | 21:52 |
| marekd | a) client logins with CERN Keystone, asks for extended SC, and says he will want to use RAX remote cloud | 21:53 |
| marekd | b) Keystone CERN issues a token and makes it usable with RAX only (maybe just a single attribute in the token?) | 21:53 |
| marekd | c) client scopes the token to CERN's local project/domain | 21:54 |
| marekd | d) client goes to RAX Keystone (url from Service catalog) | 21:54 |
| *** rodrigods_ has joined #openstack-keystone | 21:54 | |
| marekd | e) RAX validates the token, sees it was issued by CERN who is tursted and maps CERN's project into project configured at RAX | 21:54 |
| marekd | f) returns valid token scoped to project_RAX to the user. | 21:54 |
| morganfainberg | marekd, that seems reasonable. | 21:56 |
| marekd | in case RAX is compromised the token from CERN is not usable with IBM, because CERN's Keystone sets flag e.g. 'USABLE_WITH' to 'RAX' | 21:56 |
| marekd | morganfainberg: hm, i'd split b) into b1 and b2. | 21:57 |
| morganfainberg | sure. | 21:57 |
| marekd | otherwise we force user to know federated clouds apriori. | 21:57 |
| morganfainberg | right. | 21:57 |
| marekd | so | 21:58 |
| marekd | a) user logins to CERN and asks for extended SC. He gets a token with list of all remote Keystones (SPs) | 21:58 |
| marekd | b) he now scopes to the project/domain and says he wants to use now RAX | 21:58 |
| marekd | Keystone returns token scoped to a project with, usable with RAX only. | 21:59 |
| marekd | makes sense? | 21:59 |
| morganfainberg | brb | 21:59 |
| *** daneyon has quit IRC | 22:01 | |
| morganfainberg | marekd, yeah that makes sense | 22:01 |
| *** elmiko is now known as _elmiko | 22:01 | |
| * marekd yay! | 22:01 | |
| marekd | how hard will it be for keystoneclient to handle >1 tokens at once? | 22:03 |
| morganfainberg | marekd, that becomes a question for the session object | 22:03 |
| morganfainberg | also... | 22:03 |
| morganfainberg | https://review.openstack.org/#/c/96648/ i think plays _very_ nicely into this | 22:04 |
| morganfainberg | regardless of the method we use | 22:04 |
| marekd | morganfainberg: session.Session ? | 22:04 |
| morganfainberg | marekd, yeah keystoneclient session.Session would need to be able to do this work | 22:04 |
| morganfainberg | marekd, but if that object can do it, then all the clients would get a lot of this by aassociation | 22:04 |
| morganfainberg | since jamielennox|away is trying to get all clients to use it for auth/etc | 22:04 |
| marekd | morganfainberg: i know nothing about ayoung_afk's bp. I will read it tomorrow. | 22:05 |
| marekd | morganfainberg: that's cool. | 22:05 |
| morganfainberg | session tokens would be unscoped tokens. | 22:05 |
| openstackgerrit | A change was merged to openstack/keystone: Do not log 14+ INFO lines on a broken pipe error (eventlet) https://review.openstack.org/102680 | 22:05 |
| morganfainberg | and you would use that as your "Keystone session" | 22:05 |
| morganfainberg | scoped toekns would no longer be re-scopeable | 22:05 |
| morganfainberg | so you can never go Project scoped token to project2 scoped token, to project3 scoped token | 22:06 |
| morganfainberg | you'd always use the 'session' token for that | 22:06 |
| morganfainberg | seems like a useful construct for the k2k stuff as well. | 22:06 |
| morganfainberg | e.g. session -> scoped token is the part b (wanting rax token) so you get the appropriate scoped data blob to talk to rax | 22:07 |
| morganfainberg | which.. could be an unscoped token that rax will honor | 22:07 |
| morganfainberg | s/unscoped/session | 22:07 |
| marekd | morganfainberg: and where in the session token can i find info about my local project | 22:09 |
| marekd | morganfainberg: in our case ofc. | 22:09 |
| morganfainberg | marekd, well session token doesn't have a project, it is explicitly unscoped | 22:11 |
| morganfainberg | marekd, you'd need to ask keystone for your projects. in the k2k case, that might be done automatically for you | 22:11 |
| marekd | morganfainberg: uhm, so any idea basing on what info can RAX do the mapping? | 22:12 |
| morganfainberg | marekd, ah oh i see, it's project specific on this side to project specific on that side | 22:12 |
| marekd | morganfainberg: yes | 22:12 |
| * morganfainberg grubmles | 22:12 | |
| morganfainberg | eh, still session token -> RAX scope + project. | 22:13 |
| morganfainberg | but anyway | 22:13 |
| morganfainberg | i still think we need a very clear definition of what data goes into the inter-keystone token-thing | 22:13 |
| * marekd agrees | 22:14 | |
| morganfainberg | marekd, it sounds like custom protocol is winning because it matches the usecase, unless we can convince people "no just do SAML" | 22:14 |
| marekd | morganfainberg: yes. | 22:14 |
| marekd | i am glad we are finally getting some consensus. | 22:15 |
| *** rodrigods_ has quit IRC | 22:17 | |
| marekd | morganfainberg: i will add this topic to the tuesday's agenda. | 22:17 |
| marekd | k2k in general. | 22:17 |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: add audit middleware https://review.openstack.org/102958 | 22:17 |
| stevemar | marekd, morganfainberg i'm just glad this is starting to make sense | 22:18 |
| marekd | stevemar: ++ | 22:18 |
| stevemar | morganfainberg, marekd I'm going to do another update to the spec then... i'll try to be specific for what goes into the inter-keystone token | 22:19 |
| stevemar | update the flow diagrams and wording too | 22:19 |
| stevemar | marekd, you will have reading material for tomorrow morning | 22:20 |
| marekd | stevemar: thanks for keeping me busy at work :-) | 22:20 |
| marekd | ok, i am going to bed. stevemar , morganfainberg thanks for that discussion. It was great and very productive! | 22:21 |
| marekd | good night | 22:22 |
| *** marekd is now known as marekd|away | 22:22 | |
| stevemar | marekd|away, gn | 22:23 |
| *** rodrigods_ has joined #openstack-keystone | 22:23 | |
| *** chandan_kumar has quit IRC | 22:24 | |
| *** oomichi has joined #openstack-keystone | 22:24 | |
| *** david-lyle has quit IRC | 22:27 | |
| *** david-lyle has joined #openstack-keystone | 22:28 | |
| *** henrynash has joined #openstack-keystone | 22:30 | |
| *** hrybacki has joined #openstack-keystone | 22:31 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Correct the region table to be InnoDB and UTF8 https://review.openstack.org/102964 | 22:31 |
| morganfainberg | vishy, ^ | 22:32 |
| *** david-lyle has quit IRC | 22:32 | |
| morganfainberg | vishy, that might solve the issue for you - shouldn't be hard to port to Icehouse | 22:32 |
| vishy | cool looks pretty good | 22:34 |
| morganfainberg | vishy, minor bug actually | 22:35 |
| morganfainberg | new patchset coming in a moment | 22:35 |
| morganfainberg | i also don't know how to test this except a local env - unit tests aren't going be easy here | 22:35 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Correct the region table to be InnoDB and UTF8 https://review.openstack.org/102964 | 22:36 |
| *** dstanek_zzz is now known as dstanek | 22:40 | |
| *** topol has quit IRC | 22:41 | |
| *** nkinder has quit IRC | 22:47 | |
| *** kevinbenton has left #openstack-keystone | 22:51 | |
| *** dims_ has quit IRC | 23:01 | |
| *** bobt has quit IRC | 23:01 | |
| *** david-lyle has joined #openstack-keystone | 23:02 | |
| *** bknudson has quit IRC | 23:02 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: Make parameters in EndpointManager optional https://review.openstack.org/102602 | 23:05 |
| *** david-lyle has quit IRC | 23:13 | |
| *** jamielennox|away is now known as jamielennox | 23:25 | |
| *** dims_ has joined #openstack-keystone | 23:26 | |
| *** henrynash has quit IRC | 23:37 | |
| *** arun_kant has quit IRC | 23:40 | |
| *** xianghui has joined #openstack-keystone | 23:47 | |
| *** navid has left #openstack-keystone | 23:49 | |
| *** gordc has left #openstack-keystone | 23:51 | |
| *** nkinder has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!