| *** jorge_munoz has left #openstack-keystone | 00:00 | |
| *** vishy has quit IRC | 00:02 | |
| *** r-daneel has quit IRC | 00:03 | |
| *** r-daneel has joined #openstack-keystone | 00:04 | |
| *** hockeynut has quit IRC | 00:04 | |
| *** vishy has joined #openstack-keystone | 00:05 | |
| *** hockeynut has joined #openstack-keystone | 00:05 | |
| *** tim_r has joined #openstack-keystone | 00:09 | |
| *** therve has joined #openstack-keystone | 00:11 | |
| *** ekarlso- has joined #openstack-keystone | 00:11 | |
| *** cypriotme has quit IRC | 00:12 | |
| *** ekarlso has quit IRC | 00:12 | |
| *** therve` has quit IRC | 00:12 | |
| *** dhellmann_ has quit IRC | 00:12 | |
| *** timmer has quit IRC | 00:12 | |
| *** esmute has quit IRC | 00:12 | |
| *** esmute has joined #openstack-keystone | 00:12 | |
| *** dhellmann has joined #openstack-keystone | 00:12 | |
| *** packet has quit IRC | 00:18 | |
| *** dims has joined #openstack-keystone | 00:21 | |
| *** gokrokve has joined #openstack-keystone | 00:24 | |
| *** dims_ has joined #openstack-keystone | 00:24 | |
| *** dims has quit IRC | 00:27 | |
| *** r-daneel has quit IRC | 00:43 | |
| *** gokrokve_ has joined #openstack-keystone | 00:43 | |
| *** gokrokve has quit IRC | 00:43 | |
| *** marcoemorais has quit IRC | 00:43 | |
| *** esmute has quit IRC | 00:50 | |
| *** esmute has joined #openstack-keystone | 00:50 | |
| *** gokrokve_ has quit IRC | 00:50 | |
| *** cjellick has quit IRC | 00:52 | |
| *** cjellick has joined #openstack-keystone | 00:53 | |
| *** cjellick has quit IRC | 00:57 | |
| *** amerine_ has quit IRC | 00:59 | |
| *** gokrokve has joined #openstack-keystone | 01:00 | |
| *** amerine has joined #openstack-keystone | 01:25 | |
| *** amerine has quit IRC | 01:29 | |
| *** diegows has joined #openstack-keystone | 01:33 | |
| *** anvilmutant has joined #openstack-keystone | 01:44 | |
| *** anvilmutant has quit IRC | 01:45 | |
| *** HenryG has quit IRC | 01:51 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow fetching user_id/project_id from auth https://review.openstack.org/118520 | 02:03 |
|---|---|---|
| *** rkofman has quit IRC | 02:08 | |
| *** openstackgerrit_ has joined #openstack-keystone | 02:16 | |
| *** amerine has joined #openstack-keystone | 02:26 | |
| *** diegows has quit IRC | 02:28 | |
| *** amerine has quit IRC | 02:30 | |
| *** HenryG has joined #openstack-keystone | 02:40 | |
| *** ayoung has quit IRC | 02:43 | |
| *** ncoghlan__ has joined #openstack-keystone | 02:45 | |
| *** ncoghlan__ is now known as ncoghlan_afk | 02:45 | |
| *** ncoghlan has joined #openstack-keystone | 02:46 | |
| *** rkofman has joined #openstack-keystone | 02:47 | |
| *** ncoghlan_ has quit IRC | 02:49 | |
| *** ncoghlan_afk has quit IRC | 02:50 | |
| *** KanagarajM has joined #openstack-keystone | 02:58 | |
| *** david-lyle has joined #openstack-keystone | 02:59 | |
| *** richm has quit IRC | 03:15 | |
| openstackgerrit | A change was merged to openstack/keystone: Test cleanup: do not leak FDs during test runs https://review.openstack.org/117692 | 03:25 |
| *** stevemar has joined #openstack-keystone | 03:27 | |
| *** amcrn_ has quit IRC | 03:36 | |
| *** rushiagr_away is now known as rushiagr | 03:42 | |
| *** david-lyle has quit IRC | 03:44 | |
| *** rushiagr is now known as rushiagr_away | 04:07 | |
| *** vhoward has joined #openstack-keystone | 04:12 | |
| *** vhoward has left #openstack-keystone | 04:13 | |
| *** dims_ has quit IRC | 04:21 | |
| *** dims has joined #openstack-keystone | 04:21 | |
| *** dims has quit IRC | 04:26 | |
| *** morganfainberg_Z is now known as morganfainberg | 04:29 | |
| morganfainberg | ugh that took a lot longer than expected today | 04:32 |
| *** Lordanat3 has quit IRC | 04:50 | |
| *** rushiagr_away is now known as rushiagr | 04:51 | |
| *** amirosh has joined #openstack-keystone | 04:55 | |
| *** KanagarajM has quit IRC | 05:06 | |
| openstackgerrit | A change was merged to openstack/keystone: Cleanup superfluous string comprehension and coersion https://review.openstack.org/117552 | 05:11 |
| *** ajayaa has joined #openstack-keystone | 05:20 | |
| openstackgerrit | A change was merged to openstack/identity-api: JSON Home relationships for auth resources https://review.openstack.org/117992 | 05:29 |
| *** Lordanat1 has joined #openstack-keystone | 05:38 | |
| *** KanagarajM has joined #openstack-keystone | 05:40 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the revocation configuration docs https://review.openstack.org/118536 | 05:46 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the docs that list sections in keystone.conf https://review.openstack.org/118550 | 05:47 |
| *** harlowja is now known as harlowja_away | 05:50 | |
| *** afazekas has joined #openstack-keystone | 05:51 | |
| *** ukalifon1 has joined #openstack-keystone | 06:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:08 |
| *** zzzeek has quit IRC | 06:31 | |
| *** stevemar has quit IRC | 06:31 | |
| *** bvandenh has joined #openstack-keystone | 06:33 | |
| *** jaosorior has joined #openstack-keystone | 06:35 | |
| *** KanagarajM has quit IRC | 06:48 | |
| *** mflobo has joined #openstack-keystone | 06:50 | |
| *** ajayaa has quit IRC | 07:00 | |
| *** sunrenjie6 has joined #openstack-keystone | 07:01 | |
| *** lbragstad has quit IRC | 07:03 | |
| *** adam_g has quit IRC | 07:04 | |
| *** dguitarbite has quit IRC | 07:04 | |
| *** lbragstad has joined #openstack-keystone | 07:05 | |
| *** sunrenjie6 has quit IRC | 07:05 | |
| *** adam_g has joined #openstack-keystone | 07:06 | |
| *** adam_g has quit IRC | 07:06 | |
| *** adam_g has joined #openstack-keystone | 07:06 | |
| *** sunrenjie6 has joined #openstack-keystone | 07:07 | |
| *** sunrenjie6 has quit IRC | 07:11 | |
| *** sunrenjie6 has joined #openstack-keystone | 07:14 | |
| *** ajayaa has joined #openstack-keystone | 07:16 | |
| *** sunrenjie6 has quit IRC | 07:19 | |
| *** KanagarajM has joined #openstack-keystone | 07:20 | |
| *** KanagarajM has quit IRC | 07:23 | |
| *** sunrenjie6 has joined #openstack-keystone | 07:32 | |
| *** sunrenjie6 has quit IRC | 07:36 | |
| *** henrynash has joined #openstack-keystone | 07:40 | |
| *** dguitarbite has joined #openstack-keystone | 07:50 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove default check keys in assertValidEntity https://review.openstack.org/112573 | 07:58 |
| *** wanghong has quit IRC | 08:01 | |
| *** wanghong has joined #openstack-keystone | 08:13 | |
| openstackgerrit | A change was merged to openstack/keystone: Lower log level for notification registration https://review.openstack.org/118053 | 08:18 |
| ekarlso- | jamielennox: around ? | 08:29 |
| *** gokrokve_ has joined #openstack-keystone | 09:04 | |
| *** gokrokve has quit IRC | 09:07 | |
| *** gokrokve_ has quit IRC | 09:08 | |
| *** andreaf has joined #openstack-keystone | 09:22 | |
| *** henrynash has quit IRC | 09:30 | |
| *** gokrokve has joined #openstack-keystone | 09:46 | |
| *** gokrokve has quit IRC | 09:52 | |
| *** yasukun has quit IRC | 10:03 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings validation https://review.openstack.org/118590 | 10:17 |
| *** Ugallu has joined #openstack-keystone | 10:18 | |
| *** Ugallu has quit IRC | 10:22 | |
| *** ajayaa has quit IRC | 10:23 | |
| *** rushiagr is now known as rushiagr_away | 10:28 | |
| *** k4n0_ has quit IRC | 10:33 | |
| *** k4n0 has joined #openstack-keystone | 10:35 | |
| *** Ugallu has joined #openstack-keystone | 10:38 | |
| *** aix has joined #openstack-keystone | 10:42 | |
| *** gokrokve has joined #openstack-keystone | 10:46 | |
| *** gokrokve has quit IRC | 10:51 | |
| *** ajayaa has joined #openstack-keystone | 10:54 | |
| *** dims has joined #openstack-keystone | 11:04 | |
| *** rushiagr_away is now known as rushiagr | 11:18 | |
| *** dims has quit IRC | 11:19 | |
| *** dims has joined #openstack-keystone | 11:19 | |
| *** dims_ has joined #openstack-keystone | 11:21 | |
| *** dims has quit IRC | 11:24 | |
| *** dims_ has quit IRC | 11:26 | |
| *** dims has joined #openstack-keystone | 11:27 | |
| *** dims_ has joined #openstack-keystone | 11:30 | |
| *** dims has quit IRC | 11:31 | |
| *** dims_ has quit IRC | 11:42 | |
| *** dims has joined #openstack-keystone | 11:43 | |
| *** dims_ has joined #openstack-keystone | 11:45 | |
| *** gokrokve has joined #openstack-keystone | 11:46 | |
| *** dims has quit IRC | 11:47 | |
| *** jamielenz has joined #openstack-keystone | 11:50 | |
| *** _d34dh0r53_ has joined #openstack-keystone | 11:50 | |
| *** dtroyer_zz has joined #openstack-keystone | 11:50 | |
| *** xianghui has quit IRC | 11:51 | |
| *** d34dh0r53 has quit IRC | 11:51 | |
| *** dtroyer has quit IRC | 11:51 | |
| *** jamielennox has quit IRC | 11:51 | |
| *** pabelanger has quit IRC | 11:51 | |
| *** jamielenz is now known as jamielennox | 11:51 | |
| *** pabelanger_ has joined #openstack-keystone | 11:51 | |
| *** gokrokve has quit IRC | 11:51 | |
| *** xianghui has joined #openstack-keystone | 11:51 | |
| *** diegows has joined #openstack-keystone | 11:57 | |
| *** dims_ has quit IRC | 12:05 | |
| *** dims has joined #openstack-keystone | 12:06 | |
| *** gordc has joined #openstack-keystone | 12:10 | |
| *** xianghui has quit IRC | 12:32 | |
| *** xianghui has joined #openstack-keystone | 12:45 | |
| *** gokrokve has joined #openstack-keystone | 12:46 | |
| *** gokrokve has quit IRC | 12:51 | |
| *** miqui has joined #openstack-keystone | 12:56 | |
| *** radez_g0n3 is now known as radez | 13:02 | |
| *** zzzeek has joined #openstack-keystone | 13:09 | |
| *** zzzeek has quit IRC | 13:09 | |
| *** richm has joined #openstack-keystone | 13:10 | |
| *** k4n0 has quit IRC | 13:12 | |
| *** nkinder has quit IRC | 13:12 | |
| *** bvandenh has quit IRC | 13:23 | |
| *** vhoward has joined #openstack-keystone | 13:23 | |
| *** bvandenh has joined #openstack-keystone | 13:23 | |
| *** topol has joined #openstack-keystone | 13:26 | |
| *** joesavak has joined #openstack-keystone | 13:27 | |
| *** bknudson has joined #openstack-keystone | 13:35 | |
| *** ukalifon2 has joined #openstack-keystone | 13:40 | |
| *** ukalifon1 has quit IRC | 13:41 | |
| *** gokrokve has joined #openstack-keystone | 13:46 | |
| *** wanghong has quit IRC | 13:47 | |
| *** gokrokve has quit IRC | 13:51 | |
| *** portante has quit IRC | 13:52 | |
| *** r-daneel has joined #openstack-keystone | 13:53 | |
| *** nkinder has joined #openstack-keystone | 13:57 | |
| *** radez is now known as radez_g0n3 | 14:00 | |
| ekarlso- | jamielennox: how is one supposed to use the adapter with api discovery ? | 14:01 |
| *** wanghong has joined #openstack-keystone | 14:03 | |
| *** jorge_munoz has joined #openstack-keystone | 14:05 | |
| *** topol_ has joined #openstack-keystone | 14:06 | |
| *** ncoghlan_ has joined #openstack-keystone | 14:08 | |
| *** ncoghlan_ is now known as ncoghlan_afk | 14:08 | |
| *** rkofman has left #openstack-keystone | 14:14 | |
| *** wanghong has quit IRC | 14:17 | |
| *** topol has quit IRC | 14:17 | |
| *** diegows has quit IRC | 14:17 | |
| *** ajayaa has quit IRC | 14:17 | |
| *** Ugallu has quit IRC | 14:17 | |
| *** ncoghlan has quit IRC | 14:17 | |
| *** ekarlso- has quit IRC | 14:17 | |
| *** lsmola has quit IRC | 14:17 | |
| *** harlowja_away has quit IRC | 14:17 | |
| *** grantbow has quit IRC | 14:17 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:20 | |
| *** wanghong has joined #openstack-keystone | 14:21 | |
| *** diegows has joined #openstack-keystone | 14:21 | |
| *** ajayaa has joined #openstack-keystone | 14:21 | |
| *** ekarlso- has joined #openstack-keystone | 14:23 | |
| *** portante has joined #openstack-keystone | 14:23 | |
| *** lsmola has joined #openstack-keystone | 14:25 | |
| bknudson | dolphm: is there some new trick with workflow-1 workflow+1? | 14:26 |
| *** andreaf has quit IRC | 14:28 | |
| dolphm | bknudson: it's not new, but it's effectively a recheck without a recheck :-/ | 14:28 |
| *** andreaf has joined #openstack-keystone | 14:28 | |
| dolphm | bknudson: sends another +A to get picked up by zuul | 14:28 |
| *** andreaf is now known as andreaf_ | 14:28 | |
| dolphm | bknudson: which seems to lose events otherwise, sometimes | 14:28 |
| bknudson | does it skip the "check" step? | 14:29 |
| dolphm | bknudson: no | 14:29 |
| dolphm | bknudson: i use it when there's no a failed build blocking things, but there's no job in the gate (and there should be) | 14:29 |
| bknudson | the gate queue didn't go down much since yesterday. | 14:30 |
| dolphm | bknudson: it's almost half the size that it was yesterday morning | 14:31 |
| bknudson | it was at 140? I thought it was 100 | 14:31 |
| *** david-lyle has joined #openstack-keystone | 14:31 | |
| dolphm | bknudson: it hit like 127 as far as i saw | 14:32 |
| dolphm | bknudson: last 72 hours http://graphite.openstack.org/render/?from=-3days&width=1920&height=160&margin=0&hideLegend=true&hideAxes=false&hideGrid=true&target=color(stats.gauges.zuul.pipeline.gate.current_changes,%20%27000000%27)&bgcolor=ffffff&1409841063711 | 14:32 |
| *** gokrokve has joined #openstack-keystone | 14:32 | |
| dolphm | bknudson: maybe 130 by that graph? hard to tell | 14:32 |
| *** lsmola is now known as 18VAAT2X4 | 14:33 | |
| bknudson | now there's a horizon change at the front that doesn't pass its unit tests. | 14:33 |
| dolphm | bknudson: seriously? | 14:33 |
| *** topol has joined #openstack-keystone | 14:33 | |
| *** 17SAA4J9Y has joined #openstack-keystone | 14:33 | |
| *** Ugallu has joined #openstack-keystone | 14:33 | |
| *** ncoghlan has joined #openstack-keystone | 14:33 | |
| *** 17SAA4BEV has joined #openstack-keystone | 14:33 | |
| *** lsmola has joined #openstack-keystone | 14:33 | |
| *** grantbow has joined #openstack-keystone | 14:33 | |
| *** 17SAA4BEV has quit IRC | 14:33 | |
| *** 17SAA4J9Y has quit IRC | 14:33 | |
| *** grantbow has quit IRC | 14:33 | |
| *** grantbow has joined #openstack-keystone | 14:33 | |
| *** topol has quit IRC | 14:33 | |
| bknudson | I'm serious. | 14:33 |
| dolphm | bknudson: legit fails or transient? | 14:33 |
| *** ncoghlan has quit IRC | 14:33 | |
| *** lsmola has quit IRC | 14:34 | |
| dolphm | bknudson: both jobs are failing the same way... | 14:34 |
| bknudson | looks legit to me since it's the test result and not a dns or pip failure | 14:34 |
| dolphm | bknudson: that patch had a clean build 2 days ago | 14:34 |
| *** stevemar has joined #openstack-keystone | 14:35 | |
| bknudson | maybe something else merged that broke it. | 14:35 |
| dolphm | bknudson: at least it won't merge, i suppose (if it is a transient) | 14:35 |
| dolphm | jamielennox: see the /topic regarding https://review.openstack.org/#/c/118894/ | 14:36 |
| dolphm | jamielennox: and https://etherpad.openstack.org/p/token2saml | 14:36 |
| *** ayoung has joined #openstack-keystone | 14:39 | |
| *** radez_g0n3 is now known as radez | 14:40 | |
| dolphm | jamielennox: i think there are a couple misconceptions in there ^ we could clear up with stevemar / marekd. like what appears in the service catalog regarding foreign clouds | 14:40 |
| stevemar | dolphm, o/ | 14:42 |
| dolphm | lbragstad: at castle? | 15:03 |
| lbragstad | dolphm: yep | 15:03 |
| dolphm | lbragstad: i'm in the bookstore | 15:03 |
| lbragstad | lol | 15:03 |
| dolphm | lbragstad: technically we have a meeting that i just realized you're not on | 15:04 |
| stevemar | dolphm, i think we safe on the mox / oslotest transition | 15:05 |
| ayoung | dolphm, regarding the PKI->uuid transition, is this how you see it playing out: we leave UUIDs as the default (for a long while) and continue to build up the PKI infrastructure until it is deployment ready and then tell people "for this set of features you only get them if you run PKI tokens?" | 15:05 |
| dolphm | ayoung: what features would be PKI only? | 15:05 |
| ayoung | dolphm, distributes signing | 15:06 |
| ayoung | ephemeral tokens | 15:06 |
| dolphm | ayoung: oh sure, yeah | 15:06 |
| ayoung | I think PKI is for scale | 15:06 |
| dolphm | ayoung: i don't see those as features so much as competitive advantages of one over the other | 15:06 |
| ayoung | it was always meant to be | 15:06 |
| dolphm | ayoung: UUID will always be simpler to configure, etc | 15:06 |
| ayoung | and if the low end doesn't need them, that is ok | 15:06 |
| ayoung | yeah, agreed | 15:06 |
| ayoung | dolphm, TBH, the SAML approach for K2K kindof replaces one of the main use cases too | 15:07 |
| ayoung | I originally envisioned a case where a company ran their own Keystone server to talk to a remote cloud, or multiple clouds. Those remote systems would limit tokens signed by that Keystone server to a specific subset of domains | 15:08 |
| ayoung | K2K is not quite that, but close enough that I wouldn't push for it | 15:08 |
| ayoung | dolphm, also, there is the point rharwood had on the code review. With PKI tokens, anyone should be able to validate a token, not just "admin" which means that they could be used in a wider array of applications. | 15:10 |
| ayoung | I'm thinking, though, that we want to drop revocation events for that. I never really wanted to do revocation anyway. | 15:10 |
| ayoung | I'd rather just have short lived tokens. | 15:11 |
| ayoung | And so saying "PKI tokens should have a lifespan of roughly 5 minutes" would work better. | 15:11 |
| *** cjellick has joined #openstack-keystone | 15:12 | |
| ekarlso- | will keystone have more workers anytime soon ? | 15:12 |
| ayoung | I think that better aligns with the "once a token is in Memcached in the endpoint it is valid" approach that UUID tokens were doing when I started on PKI. | 15:12 |
| ayoung | ekarlso-, eventlet? | 15:12 |
| ajayaa | ayoung, how was revocation event going to help with pki token invalidation? | 15:13 |
| *** ayoung is now known as ayoung-MEETING | 15:13 | |
| ajayaa | sorry, if I interrupted you. | 15:13 |
| *** ajayaa has quit IRC | 15:15 | |
| *** zzzeek has joined #openstack-keystone | 15:22 | |
| morganfainberg | ekarlso-, keystone can have multiple eventlet workers now (it's a config option), but you'll have better luck with apache+mod_wsgi most likely (especially if running Juno+) | 15:23 |
| *** wanghong has quit IRC | 15:25 | |
| *** wanghong has joined #openstack-keystone | 15:25 | |
| *** ChanServ sets mode: -o morganfainberg | 15:29 | |
| *** jsavak has joined #openstack-keystone | 15:30 | |
| *** joesavak has quit IRC | 15:32 | |
| ekarlso- | morganfainberg: why so vs workers ? | 15:33 |
| ekarlso- | i'm on IH atm | 15:33 |
| *** jimbaker has quit IRC | 15:34 | |
| *** jimbaker has joined #openstack-keystone | 15:34 | |
| *** jimbaker has quit IRC | 15:34 | |
| *** jimbaker has joined #openstack-keystone | 15:34 | |
| dolphm | dstanek: ping | 15:36 |
| *** ukalifon2 has quit IRC | 15:39 | |
| *** amirosh has quit IRC | 15:44 | |
| *** jimbaker has quit IRC | 15:45 | |
| *** amirosh has joined #openstack-keystone | 15:45 | |
| morganfainberg | ekarlso-, let me check on that multi worker thing might have landed in Juno | 15:47 |
| morganfainberg | ekarlso-, but in short, we gate on apache + mod_wsgi, we do not gate on multiple workers, eventlet has odd side effects and can cause weird edge cases in general. | 15:48 |
| *** dev-lock has joined #openstack-keystone | 15:48 | |
| morganfainberg | ekarlso-, eventually i'd like to drop evetlet support (but I don't forsee that being possible anytime soon) | 15:48 |
| *** amirosh has quit IRC | 15:49 | |
| morganfainberg | ekarlso-, yeah that multi-eventlet worker patch landed in Juno | 15:50 |
| ekarlso- | morganfainberg: is that faster then standard standalone keystone ? | 15:51 |
| ekarlso- | running in mod wsgi | 15:51 |
| morganfainberg | ekarlso-, https://github.com/openstack/keystone/commit/3580c2af1bd8a8c6574cf4cb7b63bd75b8effad7 | 15:51 |
| *** ajayaa has joined #openstack-keystone | 15:51 | |
| morganfainberg | ekarlso-, it provides better throughput because you can handle multiple requests at once. This doesn't mean you don't have locking / serialization when writing to the db. Generally speaking though, it does make keystone more responsive, | 15:52 |
| ekarlso- | morganfainberg: any docs or guide on howto set that up ? :) | 15:52 |
| morganfainberg | ekarlso- in short, yes apache + mod_wsgi will be more responsive | 15:52 |
| *** jimbaker has joined #openstack-keystone | 15:52 | |
| *** jimbaker has quit IRC | 15:52 | |
| *** jimbaker has joined #openstack-keystone | 15:52 | |
| *** packet has joined #openstack-keystone | 15:53 | |
| morganfainberg | ekarlso-, in fact, we have a doc just for that! | 15:53 |
| morganfainberg | ekarlso-, https://github.com/openstack/keystone/blob/stable/icehouse/doc/source/apache-httpd.rst (that is the icehouse version if you look at the URL) | 15:53 |
| bknudson | multiple workers is in juno | 15:53 |
| ekarlso- | will try the wsgi stuff :D | 15:53 |
| bknudson | also you can run multiple keystones behind a load balancer | 15:53 |
| morganfainberg | bknudson, ++ | 15:53 |
| bknudson | we enabled it for our internal ci | 15:54 |
| morganfainberg | the multi workers? | 15:54 |
| bknudson | and we had someone here interested in multiple workers so they tested it pretty thoroughly | 15:54 |
| ekarlso- | bknudson: k ? | 15:54 |
| bknudson | morganfainberg: yes, multi-workers. | 15:55 |
| mfisch | the "UTF8" all the things in the LDAP code has really broken my keystone | 15:55 |
| morganfainberg | bknudson, we might want to bump the default to more than one worker in our config for J. or at least get the gate that runs eventlet to set that option | 15:55 |
| mfisch | I'm annoyed that it was backported | 15:55 |
| bknudson | morganfainberg: y, that's a good idea. | 15:55 |
| morganfainberg | bknudson, i'll look at that post gate-hell | 15:56 |
| bknudson | morganfainberg: the tests are configured with it for some reason, but that doesn't do anything. | 15:56 |
| morganfainberg | mfisch, what's broken, and how. | 15:56 |
| ekarlso- | gate is still stuck ? :|1 | 15:56 |
| morganfainberg | ekarlso-, it's milestone time, i don't want to add extra load to it. | 15:56 |
| mfisch | morganfainberg: I wish I knew what was broken but in Keystone Icehouse 1.2 I get UTF8 decode errors that breaks LDAP auth | 15:56 |
| morganfainberg | ekarlso-, means lots of changes pending | 15:56 |
| mfisch | which worked fine in Icehouse.1 | 15:57 |
| ekarlso- | :P | 15:57 |
| morganfainberg | mfisch, mind tossing up some paste's w/ the tracebacks? | 15:57 |
| bknudson | mfisch: the change can be reverted | 15:57 |
| mfisch | This is all the traceback I get now | 15:57 |
| mfisch | 'utf8' codec can't decode byte 0x80 in position 3: invalid start byte | 15:57 |
| mfisch | 2014-09-04 15:19:49.835 9270 WARNING keystone.common.wsgi [-] Authorization failed. The request you have made requires authentication. from 1.2.3.4 | 15:57 |
| morganfainberg | mfisch, i assume you're getting some in the keystone log. if it's nothing fixable we should revert it. | 15:57 |
| bknudson | mfisch: the goal of the change was to fix a problem and not to create new ones. | 15:57 |
| morganfainberg | bknudson, ++ | 15:58 |
| *** ncoghlan_afk is now known as ncoghlan_ | 15:58 | |
| * morganfainberg plans to get an LDAP gate job together by K1. | 15:58 | |
| morganfainberg | we kind of need a real one i think. | 15:58 |
| mfisch | +1 | 15:58 |
| bknudson | morganfainberg: that might be difficult since there's a lot of things that LDAP doesn't even support | 15:59 |
| morganfainberg | bknudson, i was thinking of it from the functional in-tree test perspective | 15:59 |
| bknudson | tempest will probably need to know that it's LDAP | 15:59 |
| bknudson | oh, our live unit tests? | 15:59 |
| *** amerine has joined #openstack-keystone | 16:00 | |
| morganfainberg | bknudson, yeah. | 16:00 |
| bknudson | y, those keep breaking | 16:00 |
| morganfainberg | bknudson, and we can use LDAP live as the first real conversion to the in-tree functional | 16:00 |
| mfisch | do you have a live LDAP server to run tests like that against? | 16:00 |
| morganfainberg | mfisch, each time i want to run them i need to stand up a specific devstack with LDAP configured. so no. | 16:00 |
| bknudson | devstack will set up a local openldap | 16:00 |
| morganfainberg | mfisch, it's just a devstack-ism | 16:01 |
| morganfainberg | not a "real"/"live" ldap. | 16:01 |
| mfisch | ah yeah, I forgot brad added that feature | 16:01 |
| mfisch | I wonder if my error means that my LDAP server is returning something that the decoder doesn't like? | 16:02 |
| morganfainberg | mfisch, possibly | 16:02 |
| *** wwriverrat has joined #openstack-keystone | 16:03 | |
| mfisch | it would be difficult to check for stuff like that with a devstack test | 16:03 |
| morganfainberg | mfisch, aye. but if we can figure out *what* is being passed back that the decoder doesn't like we can build a test that ensures we don't regress on it once we fix it | 16:05 |
| mfisch | I had some arguments with PDB about letting me break in that area yesterday, I'll see what I can do today | 16:06 |
| morganfainberg | mfisch, *nod* I'm definitely open to reverting that fix if it isn't something we can fix, but ideally i'd rather fix the issue (might also exist in master, so more info is important) | 16:06 |
| *** marcoemorais has joined #openstack-keystone | 16:07 | |
| mfisch | even if reverted is already packaged and out there, so fixing it for real would be better | 16:07 |
| morganfainberg | mfisch, ++ exactly | 16:07 |
| *** ncoghlan_ is now known as ncoghlan_afk | 16:08 | |
| morganfainberg | bknudson, so python packaging is dark voodoo :( i tried to make the sample config generated when you run setup.py (either via pip or directly) | 16:08 |
| mfisch | morganfainberg: its similar to this issue: https://bugs.launchpad.net/keystone/+bug/1364521 | 16:08 |
| uvirtbot | Launchpad bug 1364521 in keystone "LDAP integration with Active Directory backend can throw: UnicodeDecodeError" [Undecided,In progress] | 16:08 |
| morganfainberg | bknudson, it's so inconsistent on how it works. | 16:08 |
| *** rushiagr is now known as rushiagr_away | 16:09 | |
| morganfainberg | oh ick we use codecs. | 16:12 |
| *** pabelanger_ is now known as pabelanger | 16:13 | |
| *** pabelanger has quit IRC | 16:13 | |
| *** pabelanger has joined #openstack-keystone | 16:13 | |
| *** afazekas has quit IRC | 16:13 | |
| *** jimbaker has quit IRC | 16:13 | |
| stevemar | dolphm, morganfainberg if you guys don't mind: https://review.openstack.org/#/c/117028/3 | 16:13 |
| *** stevelle_ has joined #openstack-keystone | 16:15 | |
| *** jimbaker has joined #openstack-keystone | 16:16 | |
| *** jimbaker has quit IRC | 16:16 | |
| *** jimbaker has joined #openstack-keystone | 16:16 | |
| *** _d34dh0r53_ is now known as d34dh0r53 | 16:16 | |
| ajayaa | morganfainberg, In the trust caching while caching get_trust request, a keyword argument is passed which is not accepted by dogpile's default key generator. | 16:17 |
| morganfainberg | ajayaa, yes kwargs are just about impossible to do memoization on (invalidation is the issue) | 16:18 |
| morganfainberg | ajayaa, it's partly why we didn't have more caching intitally there has been a lot of cleanup work to be done to fix that (slowly trickeled in over time) | 16:18 |
| ajayaa | on a related note please review, https://review.openstack.org/#/c/110575/ | 16:19 |
| ajayaa | identity caching. | 16:19 |
| morganfainberg | stevemar, looks like general cleanup mostly, right? | 16:20 |
| stevemar | yeah | 16:20 |
| stevemar | morganfainberg, yeah, cleanup + add 'whats new' + brief description | 16:21 |
| *** jaosorior has quit IRC | 16:22 | |
| morganfainberg | stevemar, LGTM | 16:23 |
| *** stevelle_ has quit IRC | 16:23 | |
| *** gyee has joined #openstack-keystone | 16:25 | |
| *** joesavak has joined #openstack-keystone | 16:28 | |
| stevemar | morganfainberg, are you ready for the most useless patch ever? | 16:28 |
| dev-lock | how does the python keystone client know to use v2 vs v3. Using the OS_IDENTITY_API_VERSION env does not work. | 16:28 |
| morganfainberg | stevemar, oh sure | 16:28 |
| *** r1chardj0n3s has joined #openstack-keystone | 16:29 | |
| r1chardj0n3s | hi ayoung-MEETING, could you please ping me when not in meeting? | 16:29 |
| *** jsavak has quit IRC | 16:29 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Capitalize all instances of Keystone in the docs https://review.openstack.org/119122 | 16:30 |
| stevemar | morganfainberg, ^ | 16:30 |
| morganfainberg | stevemar, you're just trying to boost commit stats now aren't you :P | 16:30 |
| stevemar | morganfainberg, trying to clean things uP! | 16:30 |
| morganfainberg | stevemar, s/uP/Up | 16:31 |
| stevemar | morganfainberg, i need my free pass to the conf | 16:31 |
| morganfainberg | lol | 16:31 |
| stevemar | morganfainberg, i was initially looking at example of keystone client being used, so i searched for `keystone ` | 16:32 |
| morganfainberg | haha | 16:32 |
| stevemar | I saw a few instances, let it go... then i saw another 20 | 16:32 |
| gyee | stevemar, -1, need to break up your commits | 16:33 |
| *** radez is now known as radez_g0n3 | 16:34 | |
| * gyee is trying to help out stevemar's commit stats | 16:34 | |
| stevemar | gyee, oh now you're just pulling my leg | 16:34 |
| *** amcrn has joined #openstack-keystone | 16:34 | |
| *** arunkant_work has joined #openstack-keystone | 16:35 | |
| *** radez_g0n3 is now known as radez | 16:38 | |
| stevemar | morganfainberg, finally found the video you were referencing | 16:38 |
| morganfainberg | ? | 16:38 |
| *** jaosorior has joined #openstack-keystone | 16:40 | |
| *** amirosh has joined #openstack-keystone | 16:42 | |
| *** amirosh has quit IRC | 16:45 | |
| *** amirosh has joined #openstack-keystone | 16:45 | |
| stevemar | morganfainberg, pm'ing | 16:46 |
| *** jimbaker has quit IRC | 16:47 | |
| *** amirosh has quit IRC | 16:50 | |
| *** rkofman1 has quit IRC | 16:58 | |
| *** rkofman1 has joined #openstack-keystone | 16:59 | |
| *** jimbaker has joined #openstack-keystone | 16:59 | |
| *** jimbaker has quit IRC | 16:59 | |
| *** jimbaker has joined #openstack-keystone | 16:59 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:59 | |
| *** ayoung-MEETING is now known as ayoung | 17:01 | |
| ayoung | r1chardj0n3s, i'M HERE | 17:03 |
| *** bvandenh has quit IRC | 17:10 | |
| *** aix has quit IRC | 17:19 | |
| *** harlowja has joined #openstack-keystone | 17:20 | |
| *** gokrokve has quit IRC | 17:26 | |
| dstanek | dolphm: pong - didn't see you there | 17:29 |
| *** gokrokve has joined #openstack-keystone | 17:38 | |
| *** rushiagr_away is now known as rushiagr | 17:40 | |
| *** packet has quit IRC | 17:45 | |
| *** packet has joined #openstack-keystone | 17:46 | |
| morganfainberg | ajayaa, yes it is on my list to review, though at this point I'm not 100% sure we can land it in Juno. | 17:46 |
| *** amirosh has joined #openstack-keystone | 17:46 | |
| ajayaa | morganfainberg, np. I am fine as long as it is not abandoned. :) | 17:47 |
| morganfainberg | ajayaa, nah we (the cores) don't abandon code that is actively being worked on. and auto-abandon was turned off across the board eariler this dev cycle | 17:48 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 17:49 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/119142 | 17:49 |
| *** wwriverrat has left #openstack-keystone | 17:50 | |
| ajayaa | morganfainberg, How would revocation event help PKI tokens to become non-persistent? | 17:50 |
| ajayaa | Who would receive the revocation event? keystonemiddleware? | 17:50 |
| bknudson | ajayaa: with revocation events the keystone server doesn't need to know the token ID | 17:50 |
| *** amirosh has quit IRC | 17:51 | |
| bknudson | (doesn't have to know the ID of all the tokens) | 17:51 |
| morganfainberg | ajayaa, the middleware would consume/use the events. | 17:51 |
| morganfainberg | bknudson, actually we could move revocation list over to audit_ids now and make revocation list non-priv as well. but ...... | 17:51 |
| bknudson | anybody could use the events to verify that a token is still valid. | 17:51 |
| bknudson | morganfainberg: even with the change to audit_ids, the keystone server still needs to know all the tokens to revoke them. | 17:52 |
| morganfainberg | bknudson, true, i was thinking from a priv vs. non-priv API call | 17:52 |
| morganfainberg | but that also might not be backwards compat because people expect the ids in that list | 17:53 |
| ajayaa | I will use an example. Let's say user A has a token which got revoked and middleware receives a revocation event. When user tries to authenticate with this token, how does middleware token verifies that this token has expired? Does it store the list of tokens revoked so far or something like that? | 17:54 |
| morganfainberg | ajayaa, the revocation event has information (e.g. the user id in it) | 17:54 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/116255 | 17:55 |
| morganfainberg | ajayaa, so we revoke tokens based on information in the token, not the token's id | 17:55 |
| morganfainberg | ajayaa, it allows us to be more efficient in revocations as well, for example, on a password change instead of needing to enumerate each token that is revoked for that user, one event revokes all tokens for that user | 17:55 |
| bknudson | morganfainberg: it could be a different API or a request option | 17:56 |
| morganfainberg | bknudson, different API i think. | 17:56 |
| morganfainberg | bknudson, request option might get wonky with priv vs non-priv enforcement | 17:56 |
| ajayaa | The information which is used to determine revoked tokens has to be stored somewhere, right? | 17:56 |
| morganfainberg | ajayaa, in this case with PKI you pass the PKI token to keystone, keystone has all the information about the token then rather than needing to look up the data from a persistent store from the token id. | 17:57 |
| morganfainberg | ajayaa, for uuid tokens we will continue to need persistence | 17:57 |
| morganfainberg | ajayaa, so no keystone wont need to store the token data, if you're revoking the specific token you have the information, if you're revoking a class of tokens (e.g. all tokens for user_id X, you don't need to know the token_id). | 17:58 |
| morganfainberg | ajayaa, this only works with PKI tokens because the middelware decodes the token directly instead of asking keystone for the information | 17:59 |
| ajayaa | Are the notifications sent through oslo.messaging to which keystone middleware subscribes? | 18:00 |
| morganfainberg | ajayaa, right now, no. the middleware still polls keystone for a list of events | 18:01 |
| morganfainberg | ajayaa, eventually the plan is to also send via the message bus. | 18:01 |
| ajayaa | morganfainberg. So instead of polling for revoked tokens(current model) we will be polling for revocation events for efficiency sake. | 18:04 |
| morganfainberg | yes, and also revocation events do not need priviledged access because the token ids are not in the event | 18:05 |
| *** zzzeek has quit IRC | 18:05 | |
| ajayaa | morganfainberg, Thanks, There is still possibility of a revoked token being used successfully in between the polling interval. | 18:06 |
| r1chardj0n3s | ayoung: sorry, I was away too :) back now | 18:06 |
| morganfainberg | ajayaa, there is. | 18:06 |
| openstackgerrit | A change was merged to openstack/identity-api: Clean up endpoint grouping API https://review.openstack.org/117028 | 18:06 |
| r1chardj0n3s | ayoung: I understand you're mulling over some thoughts about client-side keystone token management | 18:07 |
| morganfainberg | ajayaa, but that is an issue with any implementation that doesn't use live validation (a call to keystone to check token validity) | 18:07 |
| morganfainberg | ajayaa, SSL Cert revocation lists have similar issues. | 18:07 |
| r1chardj0n3s | ayoung: I'm toying with a prototype dashboard implementation in almost-entirely javascript, with all state in the browser | 18:08 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:08 | |
| morganfainberg | if you cache the CRL you wont know until the next time you update hte local cache | 18:08 |
| *** ericpeterson has joined #openstack-keystone | 18:08 | |
| morganfainberg | ajayaa, and most implementations will cache for efficiency | 18:08 |
| ajayaa | morganfainberg, ++ | 18:08 |
| ajayaa | Thank you for your time. | 18:08 |
| *** ericpeterson has left #openstack-keystone | 18:09 | |
| ayoung | r1chardj0n3s, so am I | 18:11 |
| r1chardj0n3s | oh! | 18:11 |
| r1chardj0n3s | we should talk ;) | 18:11 |
| ayoung | https://github.com/admiyo/keystone-cops | 18:11 |
| r1chardj0n3s | unfortunately I'm in a meeting *right now* but I should be free in an hour-ish | 18:11 |
| ayoung | that was JQuery, but I've been told the Horizon team has aligned behind AngularJS | 18:11 |
| ayoung | The solutions look pretty similar | 18:11 |
| r1chardj0n3s | ayoung: my prototype is angularjs, quite a different approach to horizon - a much, much thinner support "api proxy" than horizon | 18:12 |
| *** vhoward has left #openstack-keystone | 18:13 | |
| ayoung | r1chardj0n3s, let me get my repo with the angular thing clena (I broke something) and I'll post | 18:14 |
| r1chardj0n3s | ayoung: ok cool | 18:14 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Make the extension docs a top level entry in the landing page https://review.openstack.org/119159 | 18:20 |
| stevemar | topol_, as requested ^ | 18:21 |
| *** topol_ is now known as topol | 18:22 | |
| topol | stevemar, you mean my -1 was worthy of some form of mitigation action??? Aww. Thanks for making me feel valuable. You are back on the free dinner list!!! :-) | 18:25 |
| *** amcrn has quit IRC | 18:25 | |
| dstanek | topol: but you are valuable! | 18:26 |
| morganfainberg | dstanek, hey! stop trying to get free dinners (unless you make sure i'm invited as well) | 18:27 |
| topol | dstanek is back on the free dinner list too :-) | 18:27 |
| dstanek | topol: morganfainberg thinks you are great too! | 18:27 |
| topol | drinks only for morganfainberg | 18:28 |
| morganfainberg | ok topol, lets go with a round of Louis XIII de Remy | 18:30 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Add delete notification to endpoint grouping https://review.openstack.org/117723 | 18:31 |
| topol | morganfainberg has just lost free drink privileges | 18:31 |
| morganfainberg | topol, you weren't specific! | 18:32 |
| topol | morganfainberg, sorry man. Judge Wapner has spoken. Perhaps claco still has free slots | 18:35 |
| morganfainberg | lol | 18:35 |
| topol | Paris will be fun. Im already excited | 18:35 |
| topol | morganfainberg, instead of giving out LGTM pins can you get dolphm a recheck pin? He deserves one | 18:37 |
| dstanek | i think in general there should be an "i survived OpenStack" pin or shirt | 18:41 |
| stevemar | 'I survived Juno' | 18:41 |
| ayoung | r1chardj0n3s, OK, leet at the angular branch on my github accound | 18:44 |
| ayoung | account | 18:44 |
| r1chardj0n3s | hey ayoung our meeting just finished. I'll take a look :) | 18:45 |
| ayoung | https://github.com/admiyo/keystone-cops/tree/angular | 18:45 |
| topol | stevemar, thanks for https://review.openstack.org/#/c/119159/. I looks good | 18:45 |
| ayoung | r1chardj0n3s, let me make sure Its the right code.... | 18:45 |
| r1chardj0n3s | doesn't look too angular | 18:45 |
| r1chardj0n3s | I will post up my WIP when I get a moment | 18:46 |
| topol | stevemar, dstanek 'I survived the new keystone spec repo' :-) | 18:46 |
| ayoung | r1chardj0n3s, wait. that one is broken | 18:46 |
| *** ericpeterson has joined #openstack-keystone | 18:46 | |
| ayoung | r1chardj0n3s, OK, I did something one should never do: I completely changed a public git branch | 18:47 |
| r1chardj0n3s | sorry ayoung looks like there's another meeting in 15 :/ | 18:47 |
| r1chardj0n3s | oops :) | 18:47 |
| ayoung | r1chardj0n3s, ignore it | 18:47 |
| topol | stevemar, dstanek, 'I fought the keystone spec repo, and the spec repo won' | 18:47 |
| ayoung | this is more important | 18:47 |
| ayoung | r1chardj0n3s, if they fire you, I'll get you another job | 18:47 |
| r1chardj0n3s | ok, I should have something I can push up to the gits in about an hour - I vendored a bunch of stuff I shouldn't have and don't want to commit to the repos ;) | 18:47 |
| ayoung | r1chardj0n3s, in my repo look at alt.html and alt.js | 18:48 |
| stevemar | topol, it definitely had it's growing pains | 18:48 |
| ayoung | https://github.com/admiyo/keystone-cops/blob/angular/alt.js r1chardj0n3s | 18:48 |
| r1chardj0n3s | k | 18:48 |
| topol | stevemar, Im just having fun. I like having everything so well documented in it | 18:48 |
| ayoung | https://github.com/admiyo/keystone-cops/blob/angular/alt.js#L69 is where I get a token | 18:48 |
| ayoung | and yes, I made it work with Kerberos first | 18:49 |
| stevemar | ayoung, what are you cookin up!? | 18:49 |
| r1chardj0n3s | ayoung: you crazy ;) | 18:49 |
| r1chardj0n3s | ayoung: oh yeah that's the easy bit ;) | 18:50 |
| ayoung | r1chardj0n3s, easy but essential | 18:50 |
| r1chardj0n3s | ayoung: but I assume you're running that on the same host:port as keystone API to avoid CORS? | 18:50 |
| ayoung | you cut to the chase | 18:51 |
| ayoung | so how are we going to do CORS? | 18:51 |
| ayoung | I think its the service catalog | 18:51 |
| r1chardj0n3s | ayoung: I am avoiding the issue using a trivial API proxy | 18:51 |
| ayoung | r1chardj0n3s, nah, lets solve it | 18:51 |
| r1chardj0n3s | OK, sorry, I really have to go to this all-hands thing | 18:51 |
| ayoung | r1chardj0n3s, blow it off | 18:51 |
| openstackgerrit | Brent Roskos proposed a change to openstack/keystone: Error trapping for ldap2py https://review.openstack.org/118430 | 18:51 |
| ayoung | r1chardj0n3s, they will thank you later | 18:51 |
| ayoung | we will all thank you later | 18:51 |
| r1chardj0n3s | I should be able to IRC in the meet, but I will be AFK for a few minutes while I transit there | 18:52 |
| r1chardj0n3s | then I'll show you mine :) | 18:52 |
| ayoung | NPO | 18:52 |
| ayoung | I'll be here | 18:52 |
| ayoung | stevemar, the answer is this: | 18:52 |
| ayoung | we are going to make Horizon use AJAX to get a keystone token | 18:52 |
| stevemar | ayoung, as opposed to ksc? | 18:53 |
| ayoung | stevemar, this solves both the Federation use case and Kerberos | 18:53 |
| ayoung | stevemar, yes as opposed | 18:53 |
| stevemar | nb nb | 18:53 |
| ayoung | the users browser will make the call direct to keystone | 18:53 |
| stevemar | looks neat so far | 18:53 |
| r1chardj0n3s | ayoung: problem with "solving" the CORS issue is that every API needs CORS support built into it and then configured and yuck | 18:53 |
| r1chardj0n3s | ayoung: horizon (and my solution) avoid that | 18:53 |
| ayoung | r1chardj0n3s, we can do that for you | 18:53 |
| ayoung | its called keystonemiddleware | 18:54 |
| r1chardj0n3s | so it proxies to the other APIs? | 18:54 |
| ayoung | Nope | 18:54 |
| ayoung | it runs inside other APIs | 18:54 |
| ayoung | r1chardj0n3s, here is what we need for CORS if I understand it correctly | 18:54 |
| r1chardj0n3s | ah, so surely that should be part of oslo? (disclaimer: I'm relatively new to OpenStack ;) | 18:54 |
| ayoung | Nope | 18:54 |
| ayoung | its part of Keystone | 18:54 |
| ayoung | and you are already soaking in it | 18:55 |
| topol | ayoung, are you pushing up horizon patches? | 18:55 |
| ayoung | topol, I will be soon | 18:55 |
| ayoung | topol, right now Django Openstack Auth | 18:55 |
| ayoung | but I need to make a tweak to Horizon proper... | 18:55 |
| ayoung | hold that thought | 18:55 |
| topol | ayoung, I have a very strong horizon contributor who can either help or at least review/sanity check | 18:55 |
| ayoung | topol, look at these 3 WIP patches then | 18:55 |
| ayoung | https://review.openstack.org/#/c/115460/ | 18:56 |
| ayoung | topol, ^^ is probably the most important | 18:56 |
| ayoung | and it dpends on some of jamies work to work correctly | 18:56 |
| *** tqtran has joined #openstack-keystone | 18:56 | |
| ayoung | topol, lets talk in a bit, but I want to finish with r1chardj0n3s | 18:56 |
| topol | ayoung, meet tqtran | 18:57 |
| ayoung | r1chardj0n3s, OK, so when a user needs a token | 18:57 |
| ayoung | they go to "Horizon" | 18:57 |
| ayoung | regardless of wht it looks like, we'll call it Horizon | 18:57 |
| ayoung | the web ui | 18:57 |
| ayoung | and then it triggers an AJAX call to $AUTH_URL/.... | 18:58 |
| *** palendae has joined #openstack-keystone | 18:58 | |
| topol | tqtran, please take a look at https://review.openstack.org/#/c/115460/ and keep in mind as you do your work with stevemar on fed identity support in horizon | 18:58 |
| ayoung | in my case it varies based on Kerberos vs Password auth | 18:58 |
| r1chardj0n3s | ["Horizon" carries baggage of proxying (cumbersomely) the entire API set] | 18:58 |
| r1chardj0n3s | yep | 18:58 |
| ayoung | r1chardj0n3s, I know | 18:58 |
| ayoung | r1chardj0n3s, I need to put a plan in place top support both Horizon and what you are doing | 18:58 |
| ayoung | I think this will work...bear with me | 18:58 |
| r1chardj0n3s | yep | 18:59 |
| ayoung | OK, so the request is a POST, and is legal | 18:59 |
| *** stevelle_ has joined #openstack-keystone | 18:59 | |
| ayoung | the token comes back in a custom header, and the browser enforces a "no read that" policy | 18:59 |
| ayoung | we need the Keystone server to respond with a CORS specific header | 18:59 |
| ayoung | Machine at horizon.yourholst.org is allowed to read averything from my response | 19:00 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:00 | |
| ayoung | Now, this means that Keystone needs to know about Horizon | 19:00 |
| ayoung | I think we do that by registering Horizon as a service and the actual Horizon server as an endpoint of that service | 19:00 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 19:00 | |
| ekarlso- | whats keystone cop ? | 19:00 |
| ayoung | ekarlso-, COPS | 19:00 |
| ayoung | commong openstack portal system | 19:01 |
| ekarlso- | what's that ? | 19:01 |
| ekarlso- | :P | 19:01 |
| ayoung | :) | 19:01 |
| ekarlso- | :/ | 19:01 |
| ekarlso- | horizon ? | 19:01 |
| ayoung | ekarlso-, its a prototype | 19:01 |
| ekarlso- | of + | 19:01 |
| ayoung | talking to keystone via javascript and AJAX, as r1chardj0n3s and I are just now discussing | 19:01 |
| ayoung | I had a public demo of it, but the LDAP server is not running | 19:01 |
| ekarlso- | oh | 19:01 |
| ayoung | once I fix the LDAP server, I'll let you guys play with it | 19:01 |
| * ayoung was running a beta of the next version LDAP server | 19:02 | |
| ayoung | r1chardj0n3s, OK, so thatt looks like... | 19:02 |
| david-lyle | I can attest, it was running | 19:02 |
| r1chardj0n3s | ayoung: I really have to move at the moment, I will be back online in about 5-10 mintues and I'll be able to describe what I am doing, which I think is easier than all that, since no CORS | 19:02 |
| r1chardj0n3s | brb | 19:02 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 19:02 | |
| ayoung | ekarlso-, let me see if I can fix the server and I'll show you | 19:02 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 19:06 | |
| r1chardj0n3s | back | 19:06 |
| r1chardj0n3s | ayoung: my code is not in a repos, because I need to clean up those vendored things, but to give you an idea... | 19:07 |
| ayoung | r1chardj0n3s, ok, so back tothe CORS headers | 19:08 |
| r1chardj0n3s | ok, I let you finish :) | 19:08 |
| ayoung | Lets wave hands and say that Keystone knows about Horizon | 19:08 |
| ayoung | it gets the request with an origin header | 19:08 |
| ayoung | Origin: http://www.example-social-network.com is the example from http://en.wikipedia.org/wiki/Cross-origin_resource_sharing | 19:08 |
| ayoung | so lets make that | 19:09 |
| dstanek | do we need to get the requirements updated today? https://review.openstack.org/#/c/111620/33 /cc dolphm | 19:09 |
| ayoung | Origin: https://horizon.example.com | 19:09 |
| ayoung | then keystone adds a header | 19:09 |
| ayoung | Access-Control-Allow-Origin: https://horizon.example.com | 19:09 |
| r1chardj0n3s | so keystone has been configured to know about *that* horizon host | 19:09 |
| ayoung | right | 19:09 |
| r1chardj0n3s | ok | 19:09 |
| ayoung | r1chardj0n3s, keystone already knows about all the other hosts too | 19:10 |
| ayoung | its called the service catalog | 19:10 |
| r1chardj0n3s | the api hosts, yes | 19:10 |
| ayoung | but I don't know if they really need cors support | 19:10 |
| ayoung | now that I think about it, I don't think they do | 19:10 |
| r1chardj0n3s | the angular frontend is going to be speaking directly to them, so CORS is an issue | 19:10 |
| r1chardj0n3s | *unless* if goes through a trivial proxy like I'm proposing ;) | 19:11 |
| ayoung | if the Horizon base Javascript makes a POST to https://nova.example.com it needs to set a custom header | 19:11 |
| r1chardj0n3s | (or Horizon) | 19:11 |
| ayoung | I think it is allowed to do that | 19:11 |
| ayoung | it just can't read them without a CORS header | 19:11 |
| ayoung | r1chardj0n3s, if it is an issue, we can add the CORS header to keystonemiddleware/auth_token on the process_response stage | 19:12 |
| ayoung | I don't think we do anything there right now | 19:12 |
| * ayoung looks | 19:12 | |
| r1chardj0n3s | is that in all the APIs? | 19:12 |
| ayoung | r1chardj0n3s, I'll post a link | 19:12 |
| ayoung | http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token.py is the code that runs in Nova etc | 19:13 |
| r1chardj0n3s | ok. but even if that middleware is in each of the API WSGIs we will still need to configure each of the API instances individually to tell them the allowed origins | 19:13 |
| r1chardj0n3s | ayoung: ok, cool | 19:13 |
| ayoung | http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token.py#n461 AuthProtocol is the class. its a wsgi middleware component | 19:13 |
| r1chardj0n3s | ... unless keystone has some way of telling the keystonemiddleware what the allowed origins are | 19:13 |
| ayoung | r1chardj0n3s, and it does | 19:13 |
| ayoung | the service catalog is in the token | 19:14 |
| r1chardj0n3s | awesome, so single point of config. sounds do-able to me | 19:14 |
| ayoung | ain't It wikked smaht? | 19:14 |
| r1chardj0n3s | means I don't need my crappy proxy ;) | 19:14 |
| r1chardj0n3s | I can go back to the awesome angular parts :) | 19:14 |
| ayoung | r1chardj0n3s, if you take this and run with it and make it work you will make the whole world happy...for limited values of the whole world | 19:15 |
| r1chardj0n3s | just so you're aware: I'm in the US for another day and then I fly home, so I have another day of productivity then two days of AFK. I'd be happy to write up that stuff as a patch, but if you're willing to do it I'll be happy to review :) | 19:15 |
| r1chardj0n3s | but it'll be three days before I can get to it :) | 19:15 |
| ayoung | r1chardj0n3s, I'm core. If you write the patch, I can review | 19:16 |
| r1chardj0n3s | kewl, will do! | 19:16 |
| ayoung | r1chardj0n3s, it will be longer than that for me | 19:16 |
| ayoung | r1chardj0n3s, it needs a blueprint | 19:16 |
| ayoung | we can start by writing that | 19:16 |
| stevemar | ayoung, s/blueprint/spec | 19:16 |
| stevemar | :) | 19:17 |
| ayoung | r1chardj0n3s, let me point you at the spec repo | 19:17 |
| r1chardj0n3s | ooh, my first blueprint | 19:17 |
| r1chardj0n3s | s/blueprint/spec ;) | 19:17 |
| ayoung | ++ | 19:17 |
| ayoung | https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs,n,z | 19:17 |
| ayoung | r1chardj0n3s, there is a subdir in there for client specs... | 19:18 |
| r1chardj0n3s | ok, I will focus on writing the spec for this thing | 19:18 |
| ayoung | r1chardj0n3s, awesome | 19:18 |
| ayoung | r1chardj0n3s, are you sure the remote services even need CORS support? | 19:19 |
| ayoung | can I post from Origin: horizon to Nova and set a custom header? I think so | 19:19 |
| r1chardj0n3s | they're all going to be poked at directly by the browser | 19:19 |
| ayoung | I just can't read them, and I don't think I need to | 19:19 |
| r1chardj0n3s | it's not just headers | 19:19 |
| ayoung | what else? | 19:20 |
| r1chardj0n3s | pretty much any HTTP operation when invoked from Javascript | 19:20 |
| ayoung | r1chardj0n3s, So two Blueprints | 19:21 |
| r1chardj0n3s | I do hope OPTIONS is supported... | 19:21 |
| ayoung | one is for Keystone server | 19:21 |
| ayoung | the second is for keystonemiddleware in | 19:21 |
| ayoung | Just to set expectations, it is too late for Juno for Keystone server, but we can have the patch ready to go and merge into Kilo the day the repo opens | 19:22 |
| r1chardj0n3s | oh, absolutely | 19:22 |
| r1chardj0n3s | also, I have security concerns about exposing the entire API suite to browsers, where currently those are "protected" by Horizon | 19:22 |
| ayoung | realistically, that is going to be mid November, after the summit, but that is just for upstream consumption. If we do this cleanly, it should be its own middleware component and something that can be built out of tree to start | 19:23 |
| r1chardj0n3s | in this approach, there's no way of restricting access to the APIs | 19:23 |
| ayoung | r1chardj0n3s, that is what RBAC is for, but I hear ya | 19:23 |
| r1chardj0n3s | ayoung: I've already discussed the larger Horizon/angularjs thing with david-lyle, and the plan is present something in Paris to see what people think | 19:24 |
| ayoung | r1chardj0n3s, however, the OpenStack APIs are designed to be hit from the outside world, with Horizon being one, very limited use case | 19:24 |
| ayoung | r1chardj0n3s, I've discussed this with him too | 19:24 |
| *** jasondotstar is now known as jasondotstar|afk | 19:24 | |
| ayoung | and walked him through my demo back when I had it working... | 19:24 |
| r1chardj0n3s | ayoung: ok, cool (as I mentioned, I'm new ;) | 19:24 |
| r1chardj0n3s | nice | 19:24 |
| *** packet has quit IRC | 19:24 | |
| david-lyle | and I've been reading along :) | 19:24 |
| ayoung | r1chardj0n3s, thrilled to have you aboard | 19:24 |
| ayoung | I love offloading work | 19:24 |
| r1chardj0n3s | happy to be here :) | 19:24 |
| r1chardj0n3s | \o/ | 19:24 |
| david-lyle | thought you two might hit it off | 19:25 |
| ayoung | david-lyle, you saw that I rewrote my prototype using angular? | 19:25 |
| david-lyle | I did, haven't looked at the repo yet though | 19:25 |
| david-lyle | but that helps | 19:25 |
| ayoung | david-lyle, I was having real issues with angular/bootstrap | 19:25 |
| ayoung | I had a version with tabs and everything, but...it borked | 19:25 |
| ayoung | so the angular demo is just "get a token" stuff but it works with Kerberos | 19:26 |
| r1chardj0n3s | I have "get a token" working but with username/password, so between us we WIN :) | 19:26 |
| ayoung | my objections to Angular are moot. It works right out of the repo | 19:26 |
| dolphm | dstanek: yes we should probably sync | 19:26 |
| dolphm | dstanek: why do we have test failures? | 19:26 |
| r1chardj0n3s | ayoung: I have considerable angularjs experience :) | 19:27 |
| ayoung | r1chardj0n3s, david-lyle, btw, let me show you one hack that makes development easier | 19:27 |
| dstanek | dolphm: what failures? | 19:27 |
| dolphm | dstanek: no rush today though, we've already cut j3 :-/ | 19:27 |
| dolphm | dstanek: that proposal bot job has unit test failures in keystone | 19:27 |
| r1chardj0n3s | also, I am happy that the node.js programming language remains out of scope :) | 19:28 |
| ayoung | r1chardj0n3s, https://github.com/admiyo/keystone-cops/blob/angular/alt.js#L55 I looks to see if the doc url starts with file:. If it does, I am planning on using static, pre canned responses | 19:28 |
| ayoung | that way, it is pure UI work, and does not need a live server | 19:28 |
| *** dev-lock has quit IRC | 19:28 | |
| ayoung | there is a checkbox on the page that allows you to force that... | 19:29 |
| r1chardj0n3s | ayoung: yes, I was planning something very similar, good to see we're on the same page :) | 19:29 |
| dstanek | dolphm: how do you see the links for old jenkins build? the used to be added as comments | 19:29 |
| dolphm | dstanek: Toggle CI ? | 19:29 |
| dolphm | dstanek: bottom of page | 19:29 |
| ayoung | r1chardj0n3s, so the idea is that we need a naming convention for the responses...some thin like | 19:29 |
| dolphm | dstanek: patchset 11 was the last to pass | 19:29 |
| dstanek | hmmm...i don't see that button...jas | 19:29 |
| ayoung | POST keystone/v3/users becomes GET sampledata/v3/users.post | 19:29 |
| dstanek | dolphm: ok, my tampermonkey script removed that button :-( | 19:30 |
| ayoung | r1chardj0n3s, ideally, even more fine grained than that, so you can distinguish between POSTs to the same url but with different params..ruminate on that a while and we can brainstorm in Paris | 19:30 |
| r1chardj0n3s | yep | 19:31 |
| dstanek | dolphm: test failures look interesting...i'll get fixed | 19:31 |
| *** cjellick has quit IRC | 19:31 | |
| dolphm | dstanek: i'm opening a bug for you against rc1 :) | 19:32 |
| dstanek | k | 19:32 |
| *** cjellick has joined #openstack-keystone | 19:32 | |
| dolphm | dstanek: lots of LDAP noise in the logs... but is it an ldap failure? | 19:33 |
| r1chardj0n3s | I gotta AFK again for a bit | 19:33 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 19:33 | |
| topol | ayoung, when you get serious about trying to get something into horizon you may want to consult tqtran | 19:33 |
| dolphm | dstanek: https://bugs.launchpad.net/keystone/+bug/1365678 | 19:34 |
| uvirtbot | Launchpad bug 1365678 in keystone "Sync with openstack/requirements" [Medium,New] | 19:34 |
| *** cjellick has quit IRC | 19:37 | |
| ayoung | topol, yeah. So here's the deal | 19:37 |
| ayoung | topol, we need Kerberos support, and there are two paths there | 19:38 |
| ayoung | the first is S4U2Proxy | 19:38 |
| ayoung | and...I have a prototype of that working | 19:38 |
| ayoung | the second is the Javascript approach | 19:38 |
| ayoung | basically, use AJAX to get a token from keystone, and only Kerberos protect Keystone | 19:38 |
| ayoung | you *can* kerberos protect Horizon, mind you, you just don't have to | 19:38 |
| *** rushiagr is now known as rushiagr_away | 19:39 | |
| ayoung | I prefer the second approach, but I think it is longer term | 19:39 |
| ayoung | and I think we can support the two together | 19:39 |
| david-lyle | ayoung, the js approach is in the right direction for Horizon in general | 19:39 |
| ayoung | david-lyle, yeah | 19:39 |
| ayoung | david-lyle, it also supports Federation and other mechanisms | 19:39 |
| ayoung | which is why I like it | 19:39 |
| ayoung | david-lyle, but its more work | 19:39 |
| ayoung | david-lyle, and we need something sooner, I think | 19:40 |
| topol | ayoung, david-lyle, tqtran, I want to see what works best for horzion. I have tqtran to handle the "more work" | 19:40 |
| ayoung | topol, OK, first off, we need to be able to (regardless of how we get it) pass a token to Horizon to authenticate | 19:40 |
| ayoung | this means that Horizon needs to validate tokens | 19:40 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 19:41 | |
| ayoung | now, since Horizon only reallty likes UUID tokens, I guess we sauy "lets just do onoline validation" | 19:41 |
| ayoung | forget the PKI token validation to start | 19:41 |
| topol | ayoung, stevemar we have middleware piece for that correct? | 19:41 |
| ayoung | topol, for horizon? not really | 19:41 |
| ayoung | its called Django Openstack auth | 19:41 |
| ayoung | and it only does password right now | 19:41 |
| topol | ayoung, agreed online only. | 19:41 |
| ayoung | D-O-A talks to Keystone client | 19:41 |
| ayoung | topol, so...look at that patch I linked above... | 19:42 |
| topol | ayoung, K, well stevemar can help there | 19:42 |
| topol | ayoung I did look | 19:42 |
| ayoung | https://review.openstack.org/#/c/115460/ | 19:42 |
| topol | ayoung looked like 60 lines of auth code | 19:42 |
| ayoung | yeah...I mean, let me use it as an example... | 19:42 |
| ayoung | the current code, even in that patch still just does password auth | 19:42 |
| ayoung | for the S4U2Proxy approach, what I could do is this: | 19:43 |
| ayoung | 1. make a config option in Horionz that says "here is the auth method to use" | 19:43 |
| * ayoung just had an idea... | 19:43 | |
| ayoung | hmmm | 19:43 |
| ayoung | topol, OK, let me finish waht I was saying, but I might have some new ideas... | 19:44 |
| ayoung | 2. Django OpenStack auth needs to read that config option and select the appropriate form to show the user. | 19:44 |
| ayoung | in the case of Kerberos, there is no need for a form | 19:44 |
| topol | ayoung, thats fine. Im coo with brainstorming tqtran stevmar fyi: | 19:45 |
| ayoung | yep...Ive been needing to discuss this for a while...there is some thing I don't like | 19:45 |
| topol | stevemar ^ | 19:45 |
| ayoung | OK, in the Kerberos case, I can actually detect if Kerberos is in use becasue REMOTE_USER would be set | 19:45 |
| ayoung | if REMOTE_USER is set, (and other Kerberosy type things) I need to do stuff that I have in a follow on patch... | 19:46 |
| *** hrybacki has joined #openstack-keystone | 19:46 | |
| ayoung | OK, this is pur Proof Of Concept, not really ready for submit but | 19:46 |
| ayoung | https://review.openstack.org/#/c/115463/1/openstack_auth/backend.py | 19:46 |
| ayoung | so I could check for request.META['KRB5CCNAME'] and use that to say "oh, we are doing Kerberos" | 19:47 |
| ayoung | and then I don't need the config option in Horizon... | 19:47 |
| ayoung | so, david-lyle and topol and anyone else that is not familiar with S4U2Proxy and Kerberos... | 19:47 |
| ayoung | S4U2Proxy means that Horizon takes your Kerberos ticket when you log in, and uses it and some other magic to get a keystone token | 19:48 |
| ayoung | if you don't have S4U2Proxy, you are stuck | 19:48 |
| topol | ayoung, makjes sense, but I dont see the part you have done that can be reused for fed identity | 19:48 |
| ayoung | even though you've cryptographically proven your identity to Horizon, Horizon can't get atoken | 19:49 |
| ayoung | topol, that is the Javascript approach, not S4U2. | 19:49 |
| ayoung | And I prefer the Javascript, but S4U2 is much closer | 19:49 |
| ayoung | I'm trying to see if I should even bother submitting S4U2 upstream. nkinder and I were discussing it, and we both feel it is much closer to "ready to go" | 19:50 |
| ayoung | and Kerberos is important to a subset of the upstream community, I want to make sure we have a clean path forward | 19:50 |
| dstanek | this obviously doesn't break hacking, but is it acceptable? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/controllers.py#n29 | 19:50 |
| ayoung | dstanek, Ithought one import per line | 19:50 |
| ayoung | from keystone.i18n import _, _LI should be | 19:51 |
| bknudson | dstanek: I prefer it. | 19:51 |
| dstanek | ayoung: that's why i thought too | 19:51 |
| ayoung | from keystone.i18n import _, | 19:51 |
| ayoung | from keystone.i18n import _LI | 19:51 |
| dstanek | bknudson: prefer the single line? | 19:51 |
| bknudson | dstanek: yes. | 19:51 |
| ayoung | I really don't care, but I thought it was in our coding standards already | 19:51 |
| dstanek | the benefit to a single line is that i won't be adding 4 or 5 import lines per file - be i think based on the rules it should be multiple lines | 19:52 |
| bknudson | dstanek: just for the _ imports from i18n, not for everything. | 19:52 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 19:53 | |
| bknudson | dstanek: we also have a rule to import modules and this breaks that rule too | 19:53 |
| bknudson | should be `from keystone import i18n` and _, _LI = (i18n._, i18n._LI) | 19:54 |
| *** stevelle_ has quit IRC | 19:54 | |
| bknudson | we could go back to adding _, _LI to globals | 19:55 |
| ayoung | nkinder, for the S4U2 Proxy approach, are we going to say "Kerberos only" for horizon, or do we need to provide a fallback to userid and password login? | 19:57 |
| dstanek | bknudson: i'd rather not | 19:58 |
| david-lyle | # noqa is your friend | 20:00 |
| nkinder | ayoung: the latter is good to be able to support, but I would expect that a private cloud with Kerberos in the environment would want to only allow Kerberos | 20:00 |
| nkinder | ayoung: I think Kerberos only as an option is a good first step (I'm guessing that's easier than the password fallback approach) | 20:01 |
| nkinder | ayoung: longer term, I see more of a case for mixing things like Kerberos and SAML (but not passwords) | 20:02 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 20:02 | |
| *** topol has quit IRC | 20:03 | |
| nkinder | ayoung: though a kerberized IdP like Ipsilon would eliminate the need for that and just allow you to do 100% SAML in Horizon | 20:03 |
| *** marcoemorais has quit IRC | 20:06 | |
| *** bklei has joined #openstack-keystone | 20:06 | |
| *** marcoemorais has joined #openstack-keystone | 20:06 | |
| *** marcoemorais has quit IRC | 20:07 | |
| *** marcoemorais has joined #openstack-keystone | 20:07 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 20:07 | |
| *** marcoemorais has quit IRC | 20:07 | |
| ayoung | nkinder, OK...so I might be able to drop the need for the config option in Horizon | 20:07 |
| ayoung | I can look at the request that comes in and see if it has... | 20:08 |
| *** marcoemorais has joined #openstack-keystone | 20:08 | |
| ayoung | KRB5CCNAME in the variables | 20:08 |
| ayoung | if it does, we can assume we are doing Kerberos. | 20:08 |
| ayoung | If not, we do password auth | 20:08 |
| ayoung | nkinder, it will be either or, as a Kerberized Horizon will not get that far: | 20:09 |
| nkinder | ayoung: ok, and that is there if mod_auth_kerb sets it, right? | 20:09 |
| ayoung | it will doe a 401 instead | 20:09 |
| ayoung | right | 20:09 |
| ayoung | nkinder, there is another config option Require valid-user | 20:10 |
| nkinder | ayoung: so if someone doesn't have a kerberos ticket and they access a kerberized Horizon, they get a 401? | 20:10 |
| ayoung | that is in the HTTPD config, I wonder what happens if we set that false | 20:10 |
| ayoung | nkinder, yes | 20:10 |
| ayoung | nkinder, its ugly, too, | 20:10 |
| nkinder | ayoung: worth a try... it might just go through without KRB5CCNAME and the other stuff | 20:10 |
| ayoung | the 401 is from apache, so no Django rendering of the 401 page | 20:11 |
| ayoung | which means youreally should have the Apache static page for that configured | 20:11 |
| ayoung | nkinder, I am pretty sure I tried disabling Require valid-user and it still givea 401. Ith might be that mod_auth_kerb does not check that field. | 20:12 |
| ayoung | nkinder, so the other thing I need to solve to merge D-O-A 's password and Kerberos stuff is figuring how to avoid showing the userid/password field if it is kerberized. As you recall from the demo, I just had you click login without entering anything, and you wanted it to be automatic | 20:14 |
| ayoung | I kindof agree, although "logout means revoke my token" is not a bad idea, either | 20:14 |
| nkinder | ayoung: if you look at FreeIPA, there is still a logout (just no login) | 20:15 |
| ayoung | nkinder, yeah, but that is not constrained by the Django architecture | 20:16 |
| nkinder | ayoung: but tokens are fairly short-lived too (though revoking them isn't bad) | 20:16 |
| *** bklei has quit IRC | 20:16 | |
| ayoung | nkinder, I'd love 5 minute tokens. Right now, they are one hour. If we had 5 minute tokens, I'd say "never revoke" | 20:16 |
| nkinder | ayoung: so it would be nice to have a static page instead of the 401. Someone like Rob might know about that. | 20:17 |
| ayoung | nkinder, that is pretty easy to do. its standard apache. Yeah, FreeIPA has it already | 20:17 |
| ayoung | its a httpd.conf option | 20:17 |
| nkinder | ayoung: ok, so we would just need to drop the page somewhere and configure httpd.conf | 20:18 |
| *** ocho has joined #openstack-keystone | 20:18 | |
| ayoung | yes | 20:18 |
| ayoung | http://httpd.apache.org/docs/current/custom-error.html | 20:18 |
| ocho | ping openstack-keystone - having an issue with AD identity and horizon login with icehouse | 20:18 |
| nkinder | ayoung: having to click on "login" isn't the end of the world | 20:18 |
| nkinder | ayoung: but there should be no fields to fill in if that's the case | 20:19 |
| ocho | for some reason, logins are being denied due to invalid user/pass | 20:19 |
| ayoung | nkinder, no, but if we are doing Kerberos, I don't want to have the password fields on there. Not sure UI have that fine grained control in the Django world, though | 20:19 |
| ocho | anyone around to help me do a bit of troubleshooting? | 20:19 |
| ayoung | ocho, does keystone token-get work? | 20:19 |
| nkinder | ocho: can you ldapsearch against AD as those users? | 20:19 |
| nkinder | ocho: I'd check that the bind op is working first | 20:19 |
| ocho | ldapsearch, yes | 20:19 |
| ocho | keystone user-list works | 20:19 |
| ocho | so the bind is good | 20:19 |
| ocho | all my service users are seen | 20:20 |
| ayoung | ocho, user-list might be using an admin token | 20:20 |
| nkinder | ocho: yeah, but as the user who fails to auth | 20:20 |
| ayoung | does it work using openstack credentials from AD? | 20:20 |
| ocho | i mean, it's pulling from ldap at least | 20:20 |
| nkinder | user-list binds as the "user" and "password" in the [ldap] section of keystone.conf | 20:20 |
| ayoung | ocho, but Keystone might be talking to AD anonymously | 20:20 |
| nkinder | when you attempt to authenticate (get a token) as a user, it performs an LDAP bind against AD as that user | 20:20 |
| ayoung | ocho do a keystone token-get | 20:20 |
| ocho | ok, let me check | 20:20 |
| ocho | i have a tcpdump as well...no tls | 20:21 |
| ocho | might help out | 20:21 |
| ocho | 'NoneType' object has no attribute 'has_service_catalog' | 20:22 |
| ayoung | ocho, unset SERVICE_TOKEN | 20:22 |
| *** david-lyle is now known as david-lyle_afk | 20:22 | |
| ayoung | or OS_SERVICE_TOKEN | 20:22 |
| * ayoung checks | 20:23 | |
| *** david-lyle_afk has quit IRC | 20:23 | |
| ayoung | OS_SERVICE_TOKEN | 20:23 |
| ayoung | ocho, you want to set the following env vars (do this in a file and source it) | 20:23 |
| ocho | got it | 20:24 |
| ayoung | ocho, http://fpaste.org/131110/62259140/ | 20:24 |
| ocho | looks like invalid user/pass on the token-get | 20:24 |
| ocho | which i imagine is due to the packstack creating a random password and my AD system not having the same password? | 20:25 |
| ocho | where can i change the admin password? | 20:25 |
| ayoung | ocho, you are talking to AD, right? | 20:26 |
| ocho | yeh 2008r2 | 20:26 |
| ayoung | you need a user out of AD | 20:26 |
| dstanek | dolphm: ping | 20:26 |
| ayoung | here's the general steps: | 20:26 |
| dolphm | dstanek: o/ | 20:26 |
| ayoung | actually.... | 20:26 |
| ocho | i have the admin user in AD | 20:26 |
| dstanek | dolphm: the fix for the bug is stupid simple | 20:26 |
| dolphm | dstanek: yay! | 20:27 |
| dstanek | dolphm: patches are now automatically undone via http://git.openstack.org/cgit/openstack/oslotest/tree/oslotest/base.py#n80 | 20:27 |
| ayoung | ocho ok, that admin user should be able to get a token. If they can't its probably becasue they don't have a role on a project | 20:27 |
| ayoung | ocho, to fix the admin user, use that same OS_SERVICE_TOKEN we were discussing before | 20:28 |
| *** david-lyle_afk has joined #openstack-keystone | 20:28 | |
| dstanek | so i can either move the setUp to the top and keep the explicit patcher.stop or i can remove the cleanup and let the base testcase do it for us | 20:28 |
| dstanek | dolphm: thoughts? i like explicit, but that may be against the grain | 20:28 |
| ayoung | ocho, using the OS_SERVICE_TOKEN list the roles for the admin user | 20:28 |
| ocho | ayoung, ok | 20:28 |
| dolphm | dstanek: so the problem is that we're calling stopall twice? or out of order? | 20:28 |
| ayoung | ocho, I liked it back when we were doing all this by hand instead of packstack etc. The notes from that time are | 20:29 |
| ayoung | http://fedoraproject.org/wiki/Getting_started_with_OpenStack_on_Fedora_17#Initial_Keystone_setup | 20:29 |
| dolphm | dstanek: or the problem is in oslo in that they shouldn't be calling stopall for us? | 20:29 |
| ocho | ayoung, i used packstack to get a quick env up | 20:29 |
| ocho | ayoung, went swimmingly in osp4 for me | 20:29 |
| ayoung | ocho, and then you switched the backend to LDAP? | 20:29 |
| ocho | did a little sql editing after switching to the ldap backend | 20:29 |
| ocho | but it worked fine | 20:29 |
| nkinder | ocho: I'm in a similar boat right now | 20:29 |
| *** david-lyle_afk has quit IRC | 20:29 | |
| nkinder | ocho: but I get a 401 trying to list users | 20:30 |
| ayoung | ocho, OK, so the admin user needs a role. And the admin user from sql had a different id than the admin user from LDAP | 20:30 |
| *** david-lyle_afk has joined #openstack-keystone | 20:30 | |
| nkinder | yeah, you need to fix the assignment table to refer to the names instead of uuids | 20:30 |
| *** david-lyle_afk has quit IRC | 20:30 | |
| *** david-lyle_afk has joined #openstack-keystone | 20:30 | |
| ayoung | nkinder, the thing is, there should be no default project set via LDAP, so if you remote that env var, you should be able to get an unscoped token | 20:31 |
| ocho | ayoung, nkinder - one sec, sorry...need to list the roles. i actually had found that if you just re-assign after roles after switching to ldap, there was no need to edit the db directly | 20:31 |
| dstanek | dolphm: it's that oslo's stopall gets registered as a cleanup before ours based on our currect setUp | 20:31 |
| *** amerine has quit IRC | 20:31 | |
| ocho | reassign roles after* | 20:31 |
| ayoung | the thing is, to list projects, you need a scoped token. Its a catch 22 | 20:31 |
| dstanek | dolphm: if ours got registered first we wouldn't have an issue | 20:32 |
| ocho | right, i had to use the service_token | 20:32 |
| dolphm | dstanek: oooh | 20:32 |
| nkinder | ocho: I have a full automation setup that is nearly complete that configures all of this (after creating VMs that set up AD and OS) | 20:32 |
| ayoung | ocho, that is correct | 20:32 |
| *** david-lyle has joined #openstack-keystone | 20:32 | |
| *** david-lyle_afk has quit IRC | 20:32 | |
| dstanek | dolphm: we have an explicit reference to stop and stopall just stops everything - then after that we try to stop ours | 20:32 |
| ayoung | ocho, you will just have some garbage in your database from the SQL users that are no longer present | 20:32 |
| ocho | nkinder, what kind of env? kvm? | 20:32 |
| nkinder | ocho: kvm, setting up osp4 and AD right now | 20:32 |
| dolphm | dstanek: explicitly register in keystone first with an inline comment? | 20:33 |
| ocho | very cool | 20:33 |
| dstanek | dolphm: done | 20:33 |
| nkinder | ocho: uses virt install and does the complete configuration from OS install, AD setup, packstack run, and migrating users into AD | 20:33 |
| dstanek | running all of the tests locally now and will push if they pass | 20:33 |
| ocho | nkinder, is it based on snapshots? if not, what are you using to provision and configure AD? | 20:33 |
| nkinder | ocho: ...but.... my user-list is failing still | 20:33 |
| ocho | nkinder, i have a PXE env of 2k8r2..but it was a pita to setup | 20:33 |
| nkinder | ocho: nope, uses the cloud-image downloads | 20:33 |
| ocho | neato | 20:33 |
| nkinder | ocho: for AD, it uses the MSFT eval images (and will even download them for you) | 20:34 |
| ayoung | nkinder, even with the updated role assignment? | 20:34 |
| nkinder | ayoung: yeah, so my role assignment looks good. Let me pastebin it... | 20:34 |
| dstanek | dolphm: hmmm actually this isn't that easy :-( the cleanups are stored as a set so we are not guaranteed an order anyway | 20:35 |
| dstanek | dolphm: based on oslotest we should probably just remove our cleanup | 20:35 |
| nkinder | ayoung, ocho: http://paste.openstack.org/show/106028/ | 20:35 |
| dolphm | dstanek: boo, alright | 20:36 |
| nkinder | ocho: not trying to hijack your problem, but it seems like we're in almost the same situation here | 20:36 |
| ocho | nkinder, by all means | 20:36 |
| ocho | the more heads the merrier | 20:36 |
| ocho | my roles are busted | 20:36 |
| ayoung | nkinder, wrong table | 20:36 |
| ocho | they look like the basic packstack ones | 20:36 |
| ayoung | user_project_metadata;' should be assignemtns now | 20:36 |
| ayoung | er... | 20:36 |
| ocho | ah, i did notice that that table was no more | 20:36 |
| ocho | noted. | 20:36 |
| ayoung | assignemtn | 20:37 |
| r1chardj0n3s_afk | ayoung: big CORS sticking point is OPTIONS support: keystone doesn't support it and I'm fairly sure none of the other APIs would support it either | 20:37 |
| ayoung | nkinder, I forget exactly when that change was made. osp4 == icehouse or Havana? | 20:37 |
| ocho | ayoung, nkinder - http://paste.openstack.org/show/106029/ | 20:38 |
| r1chardj0n3s_afk | (OPTIONS is the first step in a CORS-enabled POST) | 20:38 |
| ayoung | r1chardj0n3s_afk let me look | 20:38 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 20:38 | |
| ocho | osp4 == havana | 20:38 |
| ocho | 5 is icehouse | 20:38 |
| r1chardj0n3s | we *might* be able to intercept OPTIONS in the keystonemiddleware... | 20:38 |
| nkinder | ayoung: this is RHOS4 | 20:39 |
| nkinder | ayoung: the table changed in icehouse | 20:39 |
| ocho | mine is osp5 | 20:39 |
| nkinder | the contents changed too | 20:39 |
| ayoung | ocho, OK, you need to change yours in assignments. | 20:39 |
| nkinder | ocho: I have a shell script to fix up the icehouse roles | 20:39 |
| ayoung | r1chardj0n3s, what would an OPTIONS request look like? | 20:39 |
| ocho | im trying to figure out why my modifications, when using the service token didn't take care of that for me | 20:39 |
| ocho | and, like you said, leave the old garbage in the db | 20:40 |
| ocho | but at least get the ldap users working | 20:40 |
| ayoung | ocho, Oh, I didn;'t realize that was its own verb...interesting | 20:40 |
| ayoung | hmmm | 20:40 |
| *** samuelmz_ has joined #openstack-keystone | 20:41 | |
| r1chardj0n3s | it's just a bunch of headers and specifically includes something like "Access-Control-Request-Headers:accept, content-type" and "Access-Control-Request-Method:POST" and the response would include the Allowed-Origin header allowing the browser to then POST | 20:41 |
| nkinder | ocho: http://paste.openstack.org/show/106030/ | 20:41 |
| ayoung | r1chardj0n3s, http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.2 | 20:41 |
| ayoung | nkinder, for OSP4, what you have looks right, but did you do that by hand in the SQL, or using the Keystone API? | 20:42 |
| nkinder | ayoung: mysql | 20:42 |
| r1chardj0n3s | yeah, it's theoretically possible that OPTIONS might be used for something else (though that's not actually supported by the current APIs) | 20:42 |
| ayoung | nkinder, OK, try using the API and the OS_SERVICE_TOKEN approach | 20:42 |
| ocho | nkinder, just `script <ad_user>` | 20:42 |
| ayoung | r1chardj0n3s, does the browser barf on CORS if it is not supported? | 20:43 |
| r1chardj0n3s | ayoung: the browser won't attempt the POST if the OPTIONS doesn't get a good response (ie a 404 or an Allowed-Origin that doesn't allow it) | 20:43 |
| nkinder | ocho: you would need to set m_host, m_port, m_user, m_pass for your mysql connection details | 20:43 |
| ocho | oh ok | 20:43 |
| nkinder | ocho: then you can just add to the bottom of the script to fall the function for each username | 20:44 |
| nkinder | ocho: I extracted it from a larger script | 20:44 |
| ayoung | r1chardj0n3s, So maybe the right solution is an OPTIONS middleware that handles all OPTIONS requiests and lets all the others pass | 20:44 |
| dolphm | bknudson: wishlist? https://bugs.launchpad.net/keystone/+bug/1362343 | 20:44 |
| uvirtbot | Launchpad bug 1362343 in python-keystoneclient "weak digest algorithm for PKI" [Undecided,In progress] | 20:44 |
| ayoung | a simplistic one does | 20:44 |
| *** cjellick has joined #openstack-keystone | 20:45 | |
| ayoung | Access-Control-Allow-Origin: * | 20:45 |
| r1chardj0n3s | yep | 20:45 |
| r1chardj0n3s | but it could do the actual thing using the keystone config | 20:45 |
| ayoung | r1chardj0n3s, yep | 20:45 |
| ayoung | r1chardj0n3s, I knew this was going to be one of the key problems to solve. The solution might be non-trivial, but we'll keep it as simple as possible | 20:46 |
| bknudson | dolphm: bug/1362343 is kind of a feature, so wishlist makes sense | 20:46 |
| r1chardj0n3s | and I think we could just get OPTIONS handling (for relevant CORS cases) into the keystonemiddleware | 20:46 |
| ayoung | ++ | 20:46 |
| dolphm | bknudson: thanks | 20:46 |
| r1chardj0n3s | I'm poking around keystonemiddleware right now ;) | 20:46 |
| ocho | nkinder, set m_dbname to keystone? | 20:47 |
| ayoung | r1chardj0n3s, cool. Know that the code moved there recently from python-keystoneclient repo, and some older code bases won't have keystonemiddleware | 20:47 |
| ayoung | r1chardj0n3s, but we've moved over the upstream to use the keystonemiddleware repo, and treating the keystone-client/middleware/auth_token.py as "security fix only" | 20:48 |
| nkinder | ayoung: I can list my users from AD using OS_SERVICE_TOKEN | 20:49 |
| nkinder | ayoung: so, my role assignments must be hosed | 20:49 |
| nkinder | ocho: yes | 20:49 |
| openstackgerrit | David J Hu proposed a change to openstack/python-keystoneclient: Proper handling of catalog err cond w/os-token and os-endpoint https://review.openstack.org/118682 | 20:49 |
| ayoung | nkinder, just create a new role assignemtn with admin user for admin project, and see if the database table reflects it | 20:49 |
| dolphm | dstanek: did you fix this in master too? https://bugs.launchpad.net/keystone/+bug/1347862 | 20:50 |
| uvirtbot | Launchpad bug 1347862 in keystone/icehouse "keystone will not auth users if there is a bad endpoint " [Medium,In progress] | 20:50 |
| r1chardj0n3s | ayoung: ok, cool | 20:50 |
| ocho | nkinder, just ran it...let me see how it did | 20:51 |
| nkinder | ayoung: it says they already have the role... | 20:51 |
| *** cdent has joined #openstack-keystone | 20:51 | |
| ayoung | nkinder, is OS_TENANT_NAME set? | 20:52 |
| dolphm | dstanek: oh you fixed the same thing in 1230279 | 20:52 |
| nkinder | ayoung: yes, to admin I believe | 20:52 |
| ocho | ayoung, nkinder - is there a quick way to change the keystone admin password? | 20:52 |
| ayoung | nkinder, ocho you mean for the admin user? | 20:52 |
| cdent | Hi, I'm curious about some weirdness that I'm seeing in the way devstack is configured by default, the result being that it is looking for /v2.0/ on port 35357, where it can't be found: http://paste.openstack.org/show/106025/ | 20:52 |
| nkinder | ocho: well, the admin user is in ldap now, right? | 20:52 |
| ocho | right, but it was previously established by packstack | 20:53 |
| ayoung | _TOKENor OS_SERVICE | 20:53 |
| nkinder | ocho: so ldappasswd (or AD's user management GUI) | 20:53 |
| ayoung | cdent, known issue | 20:53 |
| dstanek | dolphm: many moons ago - https://review.openstack.org/#/c/81527/ | 20:53 |
| ayoung | cdent, patch is posted | 20:53 |
| cdent | figured as much, ayoung, but couldn't find it | 20:53 |
| dolphm | dstanek: ++ closed the more recent one | 20:53 |
| nkinder | ocho: so keystonerc_admin will have the old password in it | 20:53 |
| ocho | my token-get is still failing and im thinking that's the reason | 20:53 |
| cdent | you got a ref ayoung ? | 20:53 |
| nkinder | ocho: not sure what else would have it | 20:53 |
| ayoung | cdent, I'll link | 20:53 |
| cdent | thanks! | 20:53 |
| ocho | nkinder, i changed it there | 20:53 |
| ocho | to the ldap admin users password | 20:54 |
| nkinder | ocho: the larger concern is that all of your service users have passwords from packstack that you need to put into LDAP | 20:54 |
| ocho | right, but they don't meet the ad complexity requirements :( | 20:54 |
| ocho | so i wanted to change them on the openstack side | 20:54 |
| ocho | shrug, i should have just made my own answer file | 20:55 |
| ayoung | nkinder, OK, I think I have the flow for D-O-A down. I'm going to write it up. The solution should solve password vs Kerberos as phase 1, and then "login with token" as phase 2. The login with token should replace the S4U2 proxy kerberos approach in the Kilo time frame, and also suport federation | 20:55 |
| ayoung | I'll send it out to -dev | 20:55 |
| nkinder | ayoung: +1 | 20:56 |
| *** jasondotstar|afk is now known as jasondotstar | 20:56 | |
| nkinder | ocho: Yeah, that's what I did in my script. All passwords are the same and meet the complexity requirement, then I pass them via the answerfile and use them when creating the LDAP users | 20:56 |
| nkinder | ocho: if I can figure out my role issue, I can get the scripts to you | 20:57 |
| *** marcoemorais has quit IRC | 20:57 | |
| ocho | nkinder, that would be great | 20:57 |
| ocho | i suppose i'll turn off local and domain level complexity requirements on my AD for now | 20:58 |
| ocho | and put the proper passwords in | 20:58 |
| *** david-lyle has quit IRC | 20:58 | |
| ocho | which will take me some googling...been a while :P | 20:58 |
| *** david-lyle has joined #openstack-keystone | 20:58 | |
| ayoung | nkinder, the sticking point is, I think shown by this WIP patch https://review.openstack.org/#/c/115464/1/openstack_auth/forms.py which I will rewrite to only optionally remove those fields if we are doing kerberos. As a phase 2, I will add in a token_id field there. I think I can make it a hidden field,and prioritize the processing such that if token_id is set, skip the password stuff. | 20:59 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/keystone: Add test for getting a token with inherited role https://review.openstack.org/119206 | 20:59 |
| ayoung | That should allow it to all co-exist in the same code base | 20:59 |
| ayoung | I'll write it up clearer in an email | 20:59 |
| *** gokrokve has quit IRC | 21:00 | |
| *** gokrokve has joined #openstack-keystone | 21:01 | |
| *** marcoemorais has joined #openstack-keystone | 21:01 | |
| *** marcoemorais has quit IRC | 21:01 | |
| *** marcoemorais has joined #openstack-keystone | 21:02 | |
| *** marcoemorais has quit IRC | 21:02 | |
| *** amerine has joined #openstack-keystone | 21:02 | |
| *** marcoemorais has joined #openstack-keystone | 21:02 | |
| *** gokrokve has quit IRC | 21:04 | |
| *** gokrokve has joined #openstack-keystone | 21:04 | |
| *** gokrokve has quit IRC | 21:04 | |
| *** gokrokve has joined #openstack-keystone | 21:05 | |
| *** mfainberg_phone has joined #openstack-keystone | 21:06 | |
| mfainberg_phone | Dolphm, ping | 21:06 |
| *** amirosh has joined #openstack-keystone | 21:07 | |
| cdent | ayoung, did you find that port in devstack issue link? sorry to pester but I'm trying to park myself on a slope for the end of the day. | 21:07 |
| *** samuelmz__ has joined #openstack-keystone | 21:07 | |
| ayoung | cdent, had a browser freeze, restarting it | 21:07 |
| ayoung | cdent, https://review.openstack.org/#/c/118757/ | 21:08 |
| cdent | I've noticed that my browser is not very happy when presented with huge gate logs | 21:08 |
| dolphm | dstanek: still want to pursue this? https://bugs.launchpad.net/keystone/+bug/1362309 | 21:08 |
| uvirtbot | Launchpad bug 1362309 in keystone "Creating an endpoint with an invalid service_id returns the wrong error code" [Undecided,In progress] | 21:08 |
| dolphm | mfainberg_phone: o/ | 21:08 |
| cdent | thank you very much ayoung | 21:08 |
| ayoung | cdent, I see its picked up another +2. I'll +A that now | 21:08 |
| mfainberg_phone | Dolphm, responded to the memcache bug. Should be easy to fix and contribute to dogpile long term | 21:09 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add rst code-blocks to a bunch of missing examples https://review.openstack.org/119210 | 21:10 |
| *** samuelmz_ has quit IRC | 21:10 | |
| mfainberg_phone | But we should fix in tree first so older packaging (icehouse specific release) benefits from the fix. Once it's in dogpile we should be good w/o it. | 21:10 |
| *** amirosh has quit IRC | 21:11 | |
| mfainberg_phone | I think it's a reasonable Juno target (bug fix) | 21:11 |
| cdent | awesome ayoung that should fix this: https://bugs.launchpad.net/ceilometer/+bug/1350533 | 21:12 |
| uvirtbot | Launchpad bug 1350533 in ceilometer "CommandError: Unable to determine the Keystone version to authenticate with using the given auth_url: http://127.0.0.1:35357/v2.0 (dup-of: 1351841)" [High,Confirmed] | 21:12 |
| uvirtbot | Launchpad bug 1351841 in python-ceilometerclient "python-ceilometerclient does not works without v3 keystone endpoint" [High,Triaged] | 21:12 |
| ayoung | cdent, I tripped over this back in April. I could have sworn I submitted a fix for it back then, but I don't see it. | 21:12 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add rst code-blocks to a bunch of missing examples https://review.openstack.org/119210 | 21:15 |
| dstanek | dolphm: yes, i have a few fixes in the queue for that | 21:16 |
| dstanek | dolphm: as long as you thinks it's the right thing to do | 21:16 |
| *** cdent has quit IRC | 21:16 | |
| *** gordc has quit IRC | 21:16 | |
| *** samuelmz_ has joined #openstack-keystone | 21:17 | |
| *** samuelmz__ has quit IRC | 21:19 | |
| * mfainberg_phone needs to run off to an appt. be back in a bit. | 21:20 | |
| dolphm | mfainberg_phone: thanks! | 21:20 |
| *** gokrokve has quit IRC | 21:21 | |
| *** jaosorior has quit IRC | 21:22 | |
| ocho | ayoung, nkinder - http://paste.openstack.org/show/106039/ | 21:22 |
| ocho | stumped. | 21:22 |
| ocho | all passwords line up now | 21:22 |
| ocho | maybe i should run your script again | 21:22 |
| ayoung | ocho, are you able to do a simple bind against that AD server? | 21:23 |
| ocho | yes | 21:23 |
| ocho | in the log output, it looks to be doing an initial bind with the user in keystone.conf...and working | 21:23 |
| ayoung | ocho, is anything set in OS_TENANT_NAME | 21:23 |
| ayoung | er, that env var? | 21:23 |
| ocho | let's see | 21:23 |
| nkinder | ocho, ayoung: got it working for user-list | 21:24 |
| ocho | ayoung, admin | 21:24 |
| ocho | nice nkinder | 21:24 |
| ayoung | ocho, the admin user might not have a role in the admin project yet | 21:24 |
| ocho | let me see | 21:24 |
| nkinder | I was missing the "suffix" setting in keystone.conf | 21:24 |
| ayoung | if so, it will fail that way (I think) | 21:24 |
| nkinder | not sure why that is required since I have the user suffix set | 21:24 |
| ayoung | nkinder, that seems wrong | 21:24 |
| nkinder | ayoung: yes indeed | 21:25 |
| ayoung | nkinder, which suffix? | 21:25 |
| ayoung | what is the whole value? | 21:25 |
| nkinder | [ldap] section, "suffix" | 21:25 |
| nkinder | my suffix is "dc=rhosdom,dc=test" | 21:25 |
| ocho | spam. | 21:25 |
| ocho | [root@osp5 ~(keystone_token)]# keystone user-role-add --user-id admin --tenant admin --role admin | 21:25 |
| ocho | WARNING: Bypassing authentication using a token & endpoint (authentication credentials are being ignored). | 21:25 |
| ocho | Conflict occurred attempting to store role grant. User OpenStack Administrator already has role 26975dfe6f92430c8b47c1cb0a47f973 in tenant 12868dd555de4b4c97762461447baa13 (HTTP 409) | 21:25 |
| nkinder | ayoung: bug I also have user_tree_dn = cn=users,dc=rhosdom,dc=test | 21:26 |
| ocho | no go on that | 21:26 |
| ocho | looks like it's there | 21:26 |
| nkinder | ayoung: it must be searching for something else (I have a packet capture I'm looking at) | 21:26 |
| nkinder | ocho: yeah, your role is fine then | 21:26 |
| nkinder | ocho: so your user-list works at this point (with username and password), or not? | 21:27 |
| ayoung | ocho, trying unsetting OS_TENANT_NAME and doing keystone token-get again | 21:27 |
| ayoung | lets see if an unscoped token works | 21:27 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/keystone: Add test for getting a token with inherited role https://review.openstack.org/119206 | 21:27 |
| *** mfainberg_phone has quit IRC | 21:27 | |
| *** andreaf has joined #openstack-keystone | 21:28 | |
| stevemar | dolphm, will our stuff finally land today?!? | 21:29 |
| ocho | ayoung, same error after unsetting | 21:31 |
| nkinder | ocho: it could be time to resort to 'sudo tshark -i eth0 -O ldap tcp port 389' | 21:31 |
| ocho | nkinder, no, does not work :( | 21:31 |
| nkinder | ocho: so now that my token-get is working, lets see if we can get you up and running. | 21:31 |
| ocho | all admin passwords are in alignment | 21:32 |
| nkinder | ocho: ok, so user-list is failing using --os-username and --os-password? | 21:32 |
| ocho | i'll need to disable tls | 21:32 |
| ocho | i imagine, yes? | 21:32 |
| ocho | so we are in the clear? | 21:32 |
| ocho | or will that matter | 21:32 |
| nkinder | ocho: but it works if you are using OS_SERVICE_TOKEN? | 21:32 |
| ocho | it does | 21:32 |
| ocho | all my AD users show up | 21:32 |
| nkinder | ocho: ok, but not with --os-username and --os-password? | 21:32 |
| ocho | right, if i source my keystone_adminrc file, i get invalid creds | 21:33 |
| ocho | i have two tabs open | 21:33 |
| *** david-lyle has quit IRC | 21:34 | |
| ocho | so i can try things both as admin and with the service token | 21:34 |
| ocho | nkinder, http://paste.openstack.org/show/106041/ | 21:34 |
| nkinder | ocho: ok, so LDAP lookup is good but not LDAP authentication of users | 21:36 |
| nkinder | ocho: and the user/pass approach without OS_SERVICE_TOKEN? | 21:36 |
| ocho | no go with admin | 21:36 |
| nkinder | ocho: follow it up with a pastebin of your [ldap] section of keystone.conf | 21:36 |
| nkinder | ocho: 401 error? | 21:36 |
| ocho | yes | 21:36 |
| nkinder | ocho: ok, so let's see keystone.conf | 21:37 |
| ocho | nkinder, http://paste.openstack.org/show/106043/ | 21:37 |
| ocho | nothing fancy | 21:39 |
| nkinder | ocho: what's up with this? user_filter=(memberOf=CN=openstack_users,CN=Users,DC=example,DC=com) | 21:39 |
| ocho | im filtering users | 21:39 |
| nkinder | ocho: did you create a group? | 21:39 |
| ocho | of course | 21:39 |
| ocho | this is the same AD box and ldap configuration i used on OSP4...and it worked like a champ | 21:39 |
| *** marcoemorais has quit IRC | 21:39 | |
| *** david-lyle has joined #openstack-keystone | 21:40 | |
| ocho | nkinder, seems to be working due to the users coming back from user-list when using the service_token | 21:41 |
| ocho | i just don't know why im failing to auth | 21:41 |
| ocho | well..as a user | 21:41 |
| *** ncoghlan_afk is now known as ncoghlan_ | 21:42 | |
| nkinder | ocho: yeah, it's likely fine | 21:42 |
| nkinder | ocho: you shouldn't need to set user_pass_attribute in keystone.conf | 21:43 |
| ocho | just comment it out? | 21:43 |
| nkinder | ocho: but I doubt that's causing the problem | 21:43 |
| ocho | would it matter? | 21:43 |
| nkinder | ocho: yes | 21:43 |
| ocho | i'll give it a shot | 21:43 |
| nkinder | yes you should comment it, no, I'm not sure it matters | 21:43 |
| *** marcoemorais has joined #openstack-keystone | 21:43 | |
| *** marcoemorais has quit IRC | 21:44 | |
| nkinder | ocho: I'd see what tshark shows at this point. Nothing is glaringly obvious. | 21:44 |
| ocho | nkinder, kill tls? | 21:44 |
| ocho | prior? | 21:44 |
| nkinder | ocho: I'll try my automation with icehouse and see if I encounter something similar | 21:44 |
| *** marcoemorais has joined #openstack-keystone | 21:44 | |
| nkinder | ocho: yes, disable tls | 21:44 |
| ocho | nkinder, ok cool, thanks for the help | 21:45 |
| nkinder | ocho: sure. We'll get it sorted. | 21:45 |
| nkinder | ocho: I'm going to do one more clean run with my rhos4 based automation, then I'll send it to you and give osp5 a shot | 21:45 |
| *** marcoemorais has quit IRC | 21:46 | |
| *** marcoemorais has joined #openstack-keystone | 21:46 | |
| ayoung | ocho, the fpaste you sent makes it look like a bad password | 21:47 |
| ayoung | ocho, that could be one of two things | 21:47 |
| ayoung | one is the simple bind as the user is failing | 21:47 |
| ayoung | two is that you are not doing anonymous for the rest of the LDAP work and that password is bad | 21:48 |
| nkinder | ocho: el6 or el7? | 21:48 |
| ayoung | the fact that OS_SERVICE_TOKEN works implies that "two" is not the case | 21:48 |
| ocho | i can ldapsearch using that password and imagine it'll work | 21:48 |
| ocho | ayoung, ^ | 21:48 |
| ocho | osp5 on rhel7 nkinder | 21:48 |
| nkinder | ocho: k, going to head home and I'll give that a try too | 21:49 |
| ayoung | ocho, so either the password is bad, or simple bind is rejected | 21:49 |
| ocho | nkinder, sounds good, thanks! | 21:49 |
| ocho | ayoung, let me ldapsearch real quick using that password and a simple bind | 21:49 |
| *** ajayaa has quit IRC | 21:50 | |
| ocho | ayoung, seems to be ok: http://paste.openstack.org/show/106055/ | 21:51 |
| *** dims_ has joined #openstack-keystone | 21:51 | |
| ayoung | ocho, I assume that there is a paste glitch in there: sAMAccountName=admindn: CN=OpenStack | 21:52 |
| *** ncoghlan_ is now known as ncoghlan_afk | 21:52 | |
| ayoung | and that should be sAMAccountName=admin dn: CN=OpenStack | 21:52 |
| *** hrybacki has quit IRC | 21:52 | |
| ocho | ayoung, lol yes | 21:52 |
| ocho | sorry | 21:52 |
| ocho | just a glitch | 21:52 |
| ayoung | ocho, OK, there was a bug around sAMAccountName | 21:52 |
| ocho | ayoung, i remember that | 21:53 |
| ayoung | I bet you are hitting that | 21:53 |
| ocho | but it was just case | 21:53 |
| ocho | samaccountname vs. sAMAccountName | 21:53 |
| ocho | i have the correct case in my keystone.conf | 21:53 |
| ocho | unless there is another related bug | 21:53 |
| ocho | ayoung, ^ | 21:53 |
| ayoung | nope, that was the bug | 21:53 |
| ocho | wish it was that easy! | 21:53 |
| ocho | :) | 21:54 |
| *** dims has quit IRC | 21:54 | |
| *** topol has joined #openstack-keystone | 21:54 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes a mock cleanup issue caused by oslotest https://review.openstack.org/119224 | 21:57 |
| *** dims_ has quit IRC | 22:00 | |
| *** dims has joined #openstack-keystone | 22:01 | |
| *** nkinder has quit IRC | 22:01 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Add delete notification to endpoint grouping https://review.openstack.org/117723 | 22:03 |
| *** gokrokve has joined #openstack-keystone | 22:04 | |
| *** dims has quit IRC | 22:05 | |
| *** marcoemorais has quit IRC | 22:06 | |
| *** marcoemorais has joined #openstack-keystone | 22:06 | |
| *** marcoemorais has quit IRC | 22:07 | |
| *** marcoemorais has joined #openstack-keystone | 22:08 | |
| *** zzzeek has joined #openstack-keystone | 22:09 | |
| *** dims has joined #openstack-keystone | 22:14 | |
| *** arborism has joined #openstack-keystone | 22:14 | |
| *** gokrokve has quit IRC | 22:19 | |
| *** gokrokve has joined #openstack-keystone | 22:19 | |
| *** gokrokve has quit IRC | 22:23 | |
| *** david-lyle has quit IRC | 22:27 | |
| dstanek | dolphm: had a chat with dhellmann today about the testing bug - he's proposed a fix in olsotest | 22:29 |
| *** andreaf has quit IRC | 22:29 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:31 | |
| zzzeek | heya morganfainberg | 22:33 |
| zzzeek | woop he’s gone home! time to drink | 22:34 |
| *** arborism is now known as amcrn | 22:35 | |
| *** gokrokve has joined #openstack-keystone | 22:37 | |
| *** samuelmz_ has quit IRC | 22:38 | |
| *** gokrokve has quit IRC | 22:38 | |
| *** gokrokve has joined #openstack-keystone | 22:39 | |
| *** dirtyob has joined #openstack-keystone | 22:39 | |
| *** dguitarbite has quit IRC | 22:42 | |
| *** ericpeterson has quit IRC | 22:45 | |
| *** dims has quit IRC | 22:49 | |
| *** stevemar has quit IRC | 22:50 | |
| *** dims has joined #openstack-keystone | 22:50 | |
| *** nkinder has joined #openstack-keystone | 22:51 | |
| *** dirtyob has quit IRC | 22:54 | |
| *** dims has quit IRC | 22:54 | |
| *** valiantfirkin has joined #openstack-keystone | 22:56 | |
| *** valiantfirkin has quit IRC | 23:01 | |
| *** r-daneel has quit IRC | 23:07 | |
| dolphm | dstanek: sweet - if you have a link, send it my way | 23:08 |
| *** arunkant_work has quit IRC | 23:14 | |
| *** topol has quit IRC | 23:19 | |
| dolphm | ayoung: you approved a review that actually depends on this https://review.openstack.org/#/c/118902/ | 23:25 |
| ayoung | looking | 23:26 |
| jamielennox | dolphm: https://etherpad.openstack.org/p/token2saml ? | 23:27 |
| dolphm | jamielennox: o/ | 23:27 |
| jamielennox | oh o | 23:27 |
| dolphm | marekd: around? | 23:27 |
| jamielennox | spotted | 23:27 |
| dolphm | stevemar is gone | 23:27 |
| *** amerine has quit IRC | 23:27 | |
| ayoung | dolphm, looks good +A. Didn't realize there was a dependant review. Anything else I missed | 23:28 |
| dolphm | ayoung: i just noticed that one. i was looking at high priority reviews for https://launchpad.net/keystone/+milestone/juno-rc1 | 23:28 |
| dolphm | ayoung: the other High is an LDAP one if you want to tackle that | 23:29 |
| dolphm | ayoung: https://review.openstack.org/#/c/117658/ | 23:29 |
| dolphm | jamielennox: i'll just reply inline, and then stevemar / marekd can correct me where i'm wrong :) | 23:29 |
| ayoung | dolphm, yuck | 23:30 |
| jamielennox | dolphm: that's fine - i'm just concerned about it flying through FF | 23:30 |
| ayoung | dolphm, something smells in that patch. I might be jumping to conclusions, but the added id=self._dn_to_id(res[0]) is suspect | 23:30 |
| dolphm | jamielennox: that why i wanted them to comment on it :( i *think* some of your statements/assumptions are based on outdated design, but i'd like to double check with them | 23:30 |
| *** ncoghlan_afk is now known as ncoghlan_ | 23:31 | |
| ayoung | nkinder, am I over reacting to https://review.openstack.org/#/c/117658/5/keystone/common/ldap/core.py,cm ? It looks, well, gross | 23:32 |
| ayoung | dolphm, let me talk that one over with gyee . I don't like it as is, and I need to understand why he wrote it that way | 23:33 |
| dolphm | ayoung: ack | 23:35 |
| ayoung | dolphm, it looks like two fixes in one. I think the attribute map portion of it (the actual bug) is OK. Its the part where he looks up the id from the ldap server which is wrong. I think we have that value somewhere already, we just might have to be creative with how we extract it. | 23:36 |
| ayoung | dstanek, dolphm how is logging supposed to work? Sepcifically, I need to turn on logging for debugging and LDAP problem in the identity code. I would think I would add to default_log_levels | 23:39 |
| ayoung | like this | 23:39 |
| ayoung | default_log_levels=amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN,keystone.common=DEBUG,keystone.identity.backends.ldap=DEBUG | 23:39 |
| ayoung | but there has to be a better way, right? | 23:39 |
| dolphm | ayoung: there's a bug about logging levels in LDAP. they're being overridden somewhere screwy | 23:40 |
| ayoung | dolphm, yeah, that too | 23:40 |
| ayoung | but that is more, I think, that it is logging when it shouldn't | 23:40 |
| ayoung | for example, I see keystone.common.ldap log messages all the time | 23:40 |
| ayoung | 2014-09-04 19:40:36.366 102003 DEBUG keystone.common.ldap.core | 23:41 |
| *** oomichi has joined #openstack-keystone | 23:41 | |
| ayoung | dolphm, how do I turn on logging for just one package? | 23:41 |
| dolphm | ayoung: it's easy with pure python logging... with oslo logging i have no clue. grep? | 23:42 |
| ayoung | hmmm | 23:42 |
| * dolphm afk | 23:43 | |
| bknudson | what does this comment mean? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/assignment/backends/ldap.py#n289 | 23:48 |
| bknudson | hmm... I think it means that sql identity backend calls delete_group, but ldap identity backend doesn't have to. | 23:51 |
| *** marcoemorais has quit IRC | 23:51 | |
| gyee | ayoung, there's no extra lookup, lookup wasn't return the proper id attribute | 23:51 |
| *** marcoemorais has joined #openstack-keystone | 23:51 | |
| gyee | without that, my fix won't work because we need the id attribute to return from LDAP | 23:52 |
| *** marcoemorais has quit IRC | 23:52 | |
| *** marcoemorais has joined #openstack-keystone | 23:52 | |
| *** marcoemorais has quit IRC | 23:52 | |
| ayoung | gyee, id to DN will do a lookup | 23:53 |
| *** marcoemorais has joined #openstack-keystone | 23:53 | |
| ayoung | er, dn_to_id | 23:53 |
| ayoung | Oh, wait, I had it backwards | 23:53 |
| ayoung | OK | 23:53 |
| gyee | ayoung, for read-only LDAP, we are asking a list of attribute for LDAP to return, the user_id_attribute wasn't on that list | 23:53 |
| *** marcoemorais has quit IRC | 23:53 | |
| ayoung | gyee, dn_to_id might be wrong for "sub" | 23:53 |
| *** marcoemorais has joined #openstack-keystone | 23:53 | |
| gyee | its all in a single lookup | 23:53 |
| gyee | ayoung, I left dn_to_id as is for writable LDAP | 23:54 |
| *** joesavak has quit IRC | 23:54 | |
| gyee | I understand the thinking behind that one | 23:54 |
| ayoung | gyee, in sub tree searches the dn does not contain the id field | 23:54 |
| ayoung | it is in a distinct attribute | 23:54 |
| gyee | id is an attribute of the objectclass, we shouldn't be getting it from the DN | 23:55 |
| ayoung | it depends on "sub" | 23:55 |
| gyee | but I understand why it was designed that way | 23:55 |
| gyee | because of groups and roles | 23:55 |
| ayoung | hey, I fully accept that it sucks and I should be ashamed of that decision | 23:56 |
| gyee | but for read-only LDAP, I don't care about them | 23:56 |
| gyee | I didn't say it sucks :) | 23:56 |
| ayoung | Heh | 23:56 |
| ayoung | why don't you care about it for read only cases? | 23:56 |
| gyee | I understand the thinking went into the design after I gone through the code | 23:56 |
| gyee | for read-only LDAP, its all about the mappings | 23:57 |
| gyee | since we can't force customer to change their LDAP | 23:57 |
| ayoung | well, read write can be a custome schema, too, but that is less likely to be the case | 23:58 |
| gyee | for writable LDAP, I don't want to touch the dn_to_id map, otherwise, I'll open up a whole new can of worms | 23:58 |
| ayoung | my point is that the difference is not readonly vs read-write. It is one vs sub | 23:59 |
| gyee | writable LDAP make certain assumptions, which is OK as we have control over how the stuff is stored | 23:59 |
| gyee | one vs sub gives you the same thing | 23:59 |
| ayoung | gyee, I think you want code like this | 23:59 |
| gyee | DN doesn't change | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!