| *** gokrokve_ has quit IRC | 00:01 | |
| *** zigo has quit IRC | 00:07 | |
| *** david-lyle has quit IRC | 00:12 | |
| *** zigo has joined #openstack-keystone | 00:13 | |
| *** david-lyle has joined #openstack-keystone | 00:15 | |
| *** dimsum_ has joined #openstack-keystone | 00:21 | |
| nkinder | morganfainberg, dolphm: I was just looking into the bug that bknudson referenced in https://review.openstack.org/#/c/118590/ | 00:22 |
|---|---|---|
| nkinder | morganfainberg, dolphm: I think that we implemented something that we shouldn't have in https://bugs.launchpad.net/keystone/+bug/1293698 | 00:22 |
| uvirtbot | Launchpad bug 1293698 in keystone/icehouse "Can't map user description using LDAP" [Wishlist,Fix released] | 00:22 |
| nkinder | morganfainberg, dolphm: see my reasoning in my comment in https://review.openstack.org/#/c/118590/18/keystone/tests/test_backend_ldap.py | 00:23 |
| nkinder | We need to come to an agreement on the right direction for this given that we introduced a new behavior for the additional mapping code with the bug that bknudson fixed some time back | 00:24 |
| *** drjones has quit IRC | 00:29 | |
| *** _cjones_ has joined #openstack-keystone | 00:30 | |
| *** _cjones_ has quit IRC | 00:34 | |
| stevemar | man, there a ton of unused libraries in pycadf | 00:37 |
| *** andreaf has quit IRC | 00:37 | |
| *** andreaf has joined #openstack-keystone | 00:38 | |
| rodrigods | stevemar some time to check https://review.openstack.org/#/c/129338/ again? | 00:38 |
| stevemar | rodrigods, nope :P | 00:39 |
| stevemar | rodrigods, jk +A'ed | 00:39 |
| rodrigods | stevemar, hehe =P | 00:40 |
| nkinder | amakarov_away: you should probably hold off on https://review.openstack.org/#/c/118590/ until we reach consensus on the right way forward | 00:40 |
| *** gokrokve has joined #openstack-keystone | 00:42 | |
| *** samuelms_home has joined #openstack-keystone | 00:42 | |
| *** zzzeek has quit IRC | 00:45 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Remove unused dependencies from pycadf https://review.openstack.org/129765 | 00:47 |
| *** marcoemorais has quit IRC | 00:48 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: sys.exit mock cleanup https://review.openstack.org/124240 | 00:48 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Tests raise exception if logging problem https://review.openstack.org/119946 | 00:48 |
| *** _cjones_ has joined #openstack-keystone | 00:57 | |
| *** _cjones_ has quit IRC | 01:00 | |
| *** _cjones_ has joined #openstack-keystone | 01:00 | |
| samuelms_home | dstanek, ping | 01:01 |
| *** gokrokve has quit IRC | 01:02 | |
| dstanek | samuelms_home: hi | 01:02 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 01:02 | |
| *** gokrokve has joined #openstack-keystone | 01:03 | |
| samuelms_home | dstanek, I've created that etherpad to discuss about test improvements .. | 01:03 |
| samuelms_home | dstanek, but we don't have people eyes up there :/ | 01:04 |
| samuelms_home | dstanek, is an etherpad a good place to put such ideas? or should I put in a spec? | 01:04 |
| *** _cjones_ has quit IRC | 01:04 | |
| dstanek | samuelms: the etherpad is probably good for now - i think most people are probably getting ready for the summit | 01:05 |
| samuelms_home | dstanek, hmm... yeah so we should get some review after that .. | 01:06 |
| samuelms_home | dstanek, do you plan do discuss some points about tests there? | 01:06 |
| *** gokrokve has quit IRC | 01:07 | |
| dstanek | samuelms_home: probably - my biggest thing is that i don't like that we have different tests between the different backends - it shows that the tests are too coupled to the implementation | 01:11 |
| samuelms_home | dstanek, ++ | 01:12 |
| *** gordc has joined #openstack-keystone | 01:20 | |
| *** topol has joined #openstack-keystone | 01:21 | |
| stevemar | samuelms_home, what do you want to update for tests? | 01:22 |
| samuelms_home | stevemar, I've described some ideas on an etherpad (https://etherpad.openstack.org/p/Keystone_Tests_Improvement) | 01:24 |
| *** radez_g0n3 is now known as radez | 01:24 | |
| samuelms_home | stevemar, basically better organization, stop skipping tests, better reuse | 01:24 |
| samuelms_home | stevemar, create a consistent unit tests suite :) | 01:25 |
| *** andreaf has quit IRC | 01:27 | |
| *** andreaf has joined #openstack-keystone | 01:27 | |
| *** zzzeek has joined #openstack-keystone | 01:28 | |
| stevemar | samuelms_home, ah i was hoping for more focus on functional tests | 01:29 |
| *** gokrokve has joined #openstack-keystone | 01:29 | |
| samuelms_home | stevemar, what's your point on functional tests? better coverage? organization? | 01:30 |
| *** gokrokve has quit IRC | 01:31 | |
| stevemar | samuelms_home, create any of them lol | 01:31 |
| *** gokrokve has joined #openstack-keystone | 01:31 | |
| stevemar | samuelms_home, currently we have none | 01:31 |
| stevemar | and there is a huge gap in the way we test | 01:31 |
| stevemar | 1) no real federation tests, 2) no real notification tests, 3) the tests don't run against apache just eventlet | 01:32 |
| samuelms_home | stevemar, hmm.. interesting points | 01:33 |
| samuelms_home | stevemar, where should them be placed? tempest? | 01:33 |
| *** zzzeek has quit IRC | 01:34 | |
| samuelms_home | stevemar, I'm confused on how we could set up a real federation env inside keystone tests .. :/ | 01:48 |
| stevemar | samuelms_home, well thats part of the fun of figuring it out :) | 01:48 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Improves feedback message in SSL error https://review.openstack.org/129769 | 01:48 |
| stevemar | samuelms_home, i think we should have our own functional tests, tempest is something that should work against all openstack clouds, so that might be too generic | 01:49 |
| samuelms_home | stevemar, ++ | 01:50 |
| rodrigods | stevemar, samuelms_home, a good start would be some scripts that sets up federation in devstack, right? And I think we can start the contribution from there | 01:51 |
| stevemar | rodrigods, right, devstack has the ability to enable extensions, so if you add KEYSTONE_EXTENSION=federation to localrc, it should do the changes | 01:52 |
| stevemar | sry, KEYSTONE_EXTENSIONS (with an S) | 01:52 |
| rodrigods | stevemar, didn't about that! =O | 01:53 |
| stevemar | but that is only really the SP part of the equation | 01:53 |
| samuelms_home | stevemar, rodrigods: cool | 01:53 |
| stevemar | not the idp part :P | 01:53 |
| *** richm has quit IRC | 01:53 | |
| samuelms_home | stevemar, oh wow ... so the fun don't stop there :p | 01:53 |
| *** alex_xu has joined #openstack-keystone | 01:55 | |
| stevemar | samuelms_home, correct, the hard part is setting up something that stores user ids, and spits out SAML | 01:56 |
| rodrigods | stevemar, this shouldn't be that hard... | 01:56 |
| stevemar | which tbh, i don't know what can do that, i was hoping nkinder had an idea there with his ipsilon stuff :) | 01:56 |
| *** diegows has quit IRC | 01:57 | |
| rodrigods | stevemar, btw, right now I'm trying to modify the code in keystone client that handles ECP so I can trade a SAML token for a OS token in k2k, right path? | 01:58 |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 02:00 |
| *** yasu_ has joined #openstack-keystone | 02:18 | |
| *** samuelms_home has quit IRC | 02:21 | |
| *** stevemar has quit IRC | 02:25 | |
| *** stevemar has joined #openstack-keystone | 02:25 | |
| *** alex_xu has quit IRC | 02:34 | |
| nkinder | stevemar, rodrigods: Yeah, we would still need to set up an IdP for testing. Ipsilon on top of an LDAP server could do that, but it will require packaging Ipsilon for Debian/Ubuntu. | 02:40 |
| nkinder | That's definitely possible of course | 02:40 |
| * rodrigods googling Ipsilon | 02:40 | |
| nkinder | rodrigods: I'll get you a link | 02:40 |
| nkinder | rodrigods: https://fedorahosted.org/ipsilon/ | 02:41 |
| nkinder | rodrigods: It's under pretty heavy development to merge with the FedOAuth project right now | 02:42 |
| *** david-lyle_ has joined #openstack-keystone | 02:42 | |
| nkinder | rodrigods: I know the developer who started the project, and he's pretty familiar with Keystone too. | 02:42 |
| rodrigods | nkinder, hmm looks great | 02:42 |
| nkinder | rodrigods: There's an #ipsilon channel on freenode too | 02:42 |
| rodrigods | will read though it | 02:43 |
| *** alex_xu has joined #openstack-keystone | 02:43 | |
| nkinder | rodrigods: I've set it up with Keystone's federation (using mod_auth_mellon). I need to clean up my notes and get them into our docs. | 02:43 |
| rodrigods | nkinder, Icehouse federation or k2k? | 02:44 |
| *** david-lyle has quit IRC | 02:44 | |
| nkinder | rodrigods: not k2k | 02:44 |
| nkinder | just regular federation in Juno | 02:44 |
| rodrigods | nkinder, hmm | 02:44 |
| stevemar | i like how it's referred to as regular federation | 02:44 |
| nkinder | for k2k, isn't keystone the IdM technically? | 02:44 |
| stevemar | nkinder, yep | 02:45 |
| rodrigods | yes it is | 02:45 |
| nkinder | err, IdP | 02:45 |
| rodrigods | just stuck in the SAML <-> token step | 02:45 |
| * rodrigods deploying a k2k env | 02:45 | |
| stevemar | nkinder, what are the odds we can get ipsilon packaged for debian/ubuntu? | 02:45 |
| nkinder | so Ipsilon or Shibboleth isn't even really needed for k2k | 02:45 |
| stevemar | nkinder, correct | 02:45 |
| stevemar | nkinder, what we need are 2 vms | 02:45 |
| nkinder | stevemar: should be pretty doable. I haven't looked to see if any requirements need to be packages (like lasso or cherry-py) | 02:46 |
| stevemar | shib is still required i think | 02:46 |
| nkinder | stevemar: but I know the devs would be interested in getting it packaged, and we have had an Ubuntu dev working on porting all of FreeIPA over lately | 02:46 |
| nkinder | mod_shib you mean | 02:47 |
| nkinder | but not a shibboleth IdP, right? | 02:47 |
| stevemar | nkinder, yes, it gets a little ambiguous huh :) | 02:47 |
| nkinder | One VM would be acting as a SP with mod_shib or similar, and the other VM would have Keystone acting as the IdP | 02:47 |
| rodrigods | yes | 02:48 |
| rodrigods | that's exactly what I'm trying to accomplish | 02:48 |
| nkinder | rodrigods: are any particular areas proving to be difficult? | 02:48 |
| rodrigods | nkinder, the keystone IdP generates a SAML assertion that needs to be traded for a OpenStack token | 02:49 |
| rodrigods | I have the SAML assertion | 02:49 |
| rodrigods | but not being able to figure out how to trade for a token, using ECP | 02:50 |
| rodrigods | nkinder, (off: ipsilon is how we pronounce Y in portuguese hehe =) | 02:51 |
| nkinder | rodrigods: hence the 'Y' logo | 02:52 |
| nkinder | rodrigods: the developer who wrote it is Italian, and I believe they use ipsilon for Y too | 02:52 |
| rodrigods | nkinder, ++ | 02:53 |
| rodrigods | about k2k, any suggestions? | 02:53 |
| rodrigods | right now I'm trying to modify keystone client code that handles ECP | 02:53 |
| nkinder | rodrigods: not sure since I haven't played with it (also haven't tried the ECP side of things in the client) | 02:54 |
| rodrigods | ok =( | 02:54 |
| nkinder | I think marekd might be your best bet | 02:54 |
| rodrigods | yeah, I usually ping him =) | 02:55 |
| rodrigods | thanks, anyway | 02:55 |
| rodrigods | about the IdP with ipsilon, looking forward to help with it | 02:55 |
| nkinder | rodrigods: so one of the big things ipsilon (and mod_mellon) needs is ECP support. | 02:57 |
| nkinder | rodrigods: The underlying library that does all of the real SAML work (lasso) has ECP AFAIK. | 02:57 |
| nkinder | rodrigods: So hopefully that's not a ton of work | 02:58 |
| *** dimsum_ has quit IRC | 02:58 | |
| nkinder | rodrigods: One of our devs plans to work on that to make it usable for Keystone once he wraps up some other work. | 02:58 |
| *** dimsum_ has joined #openstack-keystone | 02:59 | |
| rodrigods | nkinder, I can definitely help with it | 02:59 |
| rodrigods | my nights are becoming longer, anyway | 02:59 |
| nkinder | rodrigods: Ok, I'll point him (jdennis) your way. Maybe tomorrow we can chat on #ipsilon with Simo about it too. | 03:00 |
| rodrigods | nkinder, just need to figure out how to make k2k work, though, a couple days already in this road | 03:00 |
| nkinder | rodrigods: what timezone/utc offset are you in? | 03:00 |
| rodrigods | nkinder, utc -3 | 03:00 |
| rodrigods | midnight right now | 03:00 |
| *** radez is now known as radez_g0n3 | 03:01 | |
| nkinder | yeah, late for you. I'm utc-7 right now | 03:02 |
| *** jacer_huawei has quit IRC | 03:02 | |
| rodrigods | nkinder, you can ping me anytime | 03:02 |
| rodrigods | and If I'm not out sleeping, we can definitely chat | 03:03 |
| nkinder | rodrigods: sounds good | 03:03 |
| *** dimsum_ has quit IRC | 03:03 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 03:13 | |
| *** KanagarajM has joined #openstack-keystone | 03:14 | |
| *** jacer_huawei has joined #openstack-keystone | 03:15 | |
| *** gordc has quit IRC | 03:19 | |
| *** ayoung has quit IRC | 03:35 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 03:53 | |
| *** yasu_ has quit IRC | 03:56 | |
| *** yasu_ has joined #openstack-keystone | 03:59 | |
| openstackgerrit | A change was merged to openstack/keystone: Extract Assignment tests from IdentityTestCase https://review.openstack.org/121653 | 04:02 |
| *** gokrokve_ has joined #openstack-keystone | 04:02 | |
| openstackgerrit | A change was merged to openstack/keystone: Fixes docstrings to be more accurate. https://review.openstack.org/126730 | 04:02 |
| openstackgerrit | A change was merged to openstack/keystone: Add xmlsec1 dependency comments https://review.openstack.org/129338 | 04:03 |
| *** gokrokve has quit IRC | 04:06 | |
| *** gokrokve_ has quit IRC | 04:07 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Remove unused dependencies from pycadf https://review.openstack.org/129765 | 04:13 |
| *** lhcheng has quit IRC | 04:28 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove assignments for foreign actors when deleting domain https://review.openstack.org/127433 | 04:30 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: fix the wrong order of assertEqual args in test_v3 https://review.openstack.org/127110 | 04:32 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: use expected_length parameter to assert expected length https://review.openstack.org/128197 | 04:54 |
| *** _cjones_ has joined #openstack-keystone | 04:56 | |
| *** topol has quit IRC | 05:04 | |
| *** yasu_ has quit IRC | 05:10 | |
| *** gokrokve has joined #openstack-keystone | 05:25 | |
| *** harlowja is now known as harlowja_away | 05:30 | |
| *** gokrokve has quit IRC | 05:34 | |
| *** gokrokve has joined #openstack-keystone | 05:34 | |
| *** yasu_ has joined #openstack-keystone | 05:35 | |
| *** david-lyle_ has quit IRC | 05:48 | |
| *** k4n0 has joined #openstack-keystone | 05:50 | |
| *** navid_ has joined #openstack-keystone | 05:52 | |
| navid_ | hi | 05:53 |
| navid_ | when i use tox -epy27, i get this error | 05:54 |
| navid_ | ERROR: InvocationError: '/opt/stack/python-keystoneclient/.tox/py27/bin/python setup.py testr --testr-args=' | 05:54 |
| *** gokrokve has quit IRC | 05:57 | |
| *** gokrokve has joined #openstack-keystone | 05:58 | |
| *** andreaf has quit IRC | 05:58 | |
| *** andreaf has joined #openstack-keystone | 05:58 | |
| *** gokrokve has quit IRC | 06:02 | |
| *** alex_xu has quit IRC | 06:06 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 06:14 | |
| *** ukalifon has joined #openstack-keystone | 06:18 | |
| *** alex_xu has joined #openstack-keystone | 06:20 | |
| *** drjones has joined #openstack-keystone | 06:25 | |
| *** _cjones_ has quit IRC | 06:28 | |
| *** gokrokve has joined #openstack-keystone | 06:28 | |
| *** drjones has quit IRC | 06:29 | |
| *** hockeynut has quit IRC | 06:30 | |
| *** hockeynut has joined #openstack-keystone | 06:32 | |
| *** gokrokve has quit IRC | 06:33 | |
| *** alex_xu has quit IRC | 06:36 | |
| *** rm_work has quit IRC | 06:48 | |
| *** alex_xu has joined #openstack-keystone | 06:48 | |
| *** rm_work has joined #openstack-keystone | 06:49 | |
| *** lhcheng has joined #openstack-keystone | 07:05 | |
| marekd | navid_: try tox -repy27 | 07:11 |
| marekd | -r rebuilds virtual environment | 07:11 |
| *** lhcheng has quit IRC | 07:17 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove implemented TODO in catalog/backends/sql.py https://review.openstack.org/129830 | 07:17 |
| *** amcrn has quit IRC | 07:20 | |
| *** jamielennox has joined #openstack-keystone | 07:24 | |
| marekd | rodrigods: hello | 07:26 |
| marekd | rodrigods: i had somewhere a code which transports saml assertion to the mod shib, but seriously you will help us much more if you sniff the whole taffice and look into avoiding ecp :-) We talked about it once. | 07:28 |
| *** gokrokve has joined #openstack-keystone | 07:28 | |
| *** gokrokve has quit IRC | 07:33 | |
| jamielennox | marekd: how are the client federation plugins going? is there stuff i need to look at? | 07:36 |
| *** dimsum_ has joined #openstack-keystone | 07:37 | |
| *** afazekas has joined #openstack-keystone | 07:38 | |
| *** andreaf has quit IRC | 07:38 | |
| *** dimsum_ has quit IRC | 07:41 | |
| marekd | jamielennox: hey, the plugins are merged, osc can even use it. One thing i wanted to get merged is: https://review.openstack.org/#/c/106751/ | 07:42 |
| jamielennox | marekd: ok, cool so this is the wrapper around the unscoped and scoping process | 07:44 |
| marekd | jamielennox: exactly. it's better to handle it in keystoneclient than in openstackclient. | 07:45 |
| jamielennox | marekd: yea, absolutely | 07:45 |
| marekd | jamielennox: btw, do you have any plans for storing sessions or at least tokens so they can be used for multiple calls (separate openstackclient calls for instance)? | 07:49 |
| jamielennox | marekd: yes and no | 07:49 |
| marekd | jamielennox: ..uh | 07:49 |
| jamielennox | i have https://review.openstack.org/#/c/113163/ | 07:50 |
| jamielennox | which i put as WIP whilst i was away | 07:50 |
| *** stevemar has quit IRC | 07:50 | |
| jamielennox | it's not really "complete" because it doesn't serialize the discovery cache which i think will be important for the clients like that | 07:50 |
| jamielennox | however something like OSC could easily build upon that to provide cross instance calls | 07:51 |
| jamielennox | i just expect to provide the serialization tools and leave the how up to OSC | 07:51 |
| *** mitz has quit IRC | 07:52 | |
| jamielennox | it needs some more work and testing with CLIs, i was looking at it for serializing a plugin across RPC calls, so that like nova could send the whole plugin of to a worker | 07:52 |
| marekd | i am scanning the code - so it'd would serialize token for instance? | 07:53 |
| jamielennox | yes, it would essentially allow you to reconstruct an auth plugin with the token in it | 07:53 |
| jamielennox | it doesn't serialize the password or sensitive data though | 07:53 |
| marekd | the use case i am thinking about is caching unscoped token and using it to scope multiple times. | 07:53 |
| jamielennox | hmm | 07:54 |
| marekd | which could be useful in saml2 as we could avoid slightly expensive authentication everytime. | 07:54 |
| jamielennox | is it more useful than just serializing the scoped token? | 07:54 |
| jamielennox | one of the things missing from auth plugins in general is a good story about how to rescope a token/plugin | 07:55 |
| *** mitz has joined #openstack-keystone | 07:55 | |
| marekd | but rescope is scoped token -> scoped toke, right? | 07:56 |
| marekd | in saml2 you have unscoped token that in theory should be able to scoping multiple times. | 07:56 |
| marekd | brb | 07:56 |
| marekd | im back | 07:59 |
| *** jistr has joined #openstack-keystone | 08:02 | |
| jamielennox | marekd: rescope is most likely unscoped -> scoped | 08:07 |
| jamielennox | but there is nothing that (currently) prevents you using a scoped token to get a new scoped token | 08:08 |
| marekd | jamielennox: even for changing projects you scope to? | 08:09 |
| jamielennox | marekd: yea, it's bad and we've hated it for a while, but because of default_project_id you might not even be able to get a proper unscoped token so we have to allow scoped to scoped exchange | 08:10 |
| openstackgerrit | Andreas Jaeger proposed a change to openstack/keystonemiddleware: Improve help strings https://review.openstack.org/118048 | 08:11 |
| marekd | jamielennox: a) is rescoping procedure somewhat standard, will it work also for federated tokens? b) is it already implemented in ksc? | 08:12 |
| jamielennox | marekd: somewhat - and this is kind of what i was trying to ask you about a while ago, was there a reason that federation needed it's own scoping process and couldn't just treat an unscoped token like a non-federated unscoped token | 08:13 |
| jamielennox | i can't remember your response but there was a reason you had to subclass v3.Token rather than just use v3.Token | 08:13 |
| jamielennox | and it's possible rather than implemented well | 08:14 |
| jamielennox | so you can take an unscoped plugin and do scoped = v3.Token(auth_url, unscoped.get_token(session)) | 08:14 |
| jamielennox | scoped = v3.Token(auth_url, unscoped.get_token(session), project_id=project_id, ...) | 08:15 |
| jamielennox | but i need to find a way of doing that "nicely" | 08:15 |
| marekd | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/auth/v3/saml2.py#L865 i think i was subclassing it due to different authentication method (saml2 instead of token) | 08:15 |
| jamielennox | the pieces are there i think, it's just a bad user interface | 08:15 |
| jamielennox | marekd: yep, because something on the server side means that you have to treat federated unscoped tokens differently | 08:16 |
| jamielennox | that sounds like it | 08:16 |
| marekd | jamielennox: yes yes. | 08:16 |
| * jamielennox is trying to get my head back in the game | 08:17 | |
| marekd | jamielennox: we are listing projects/domains from groups not user. | 08:17 |
| marekd | jamielennox: hm, one thing. | 08:17 |
| jamielennox | marekd: which i am hoping i solved by GET /auth/projects | 08:17 |
| marekd | jamielennox: is your serialization plugin also storing http headers and cookies stored in session object? | 08:17 |
| marekd | jamielennox: review link? | 08:18 |
| jamielennox | marekd: for GET /auth/projects? | 08:18 |
| *** aix has joined #openstack-keystone | 08:18 | |
| marekd | btw it was super funny that we started deprecating api calls before somebody used it in prod environment | 08:18 |
| marekd | jamielennox: yes | 08:18 |
| jamielennox | marekd: so at the moment the serialization is just of the auth plugin, not the session | 08:18 |
| jamielennox | marekd: better i think | 08:19 |
| marekd | jamielennox: ok | 08:19 |
| jamielennox | um, let me look - it was merged before release | 08:19 |
| jamielennox | marekd: https://review.openstack.org/#/c/114903/ | 08:20 |
| marekd | jamielennox: so until today user listing his projects was calling something like GET /<user>/projects and now they are supposed to switch to GET /auth/projects | 08:26 |
| jamielennox | marekd: yep | 08:26 |
| *** nellysmitt has joined #openstack-keystone | 08:27 | |
| marekd | ok | 08:27 |
| jamielennox | marekd: which means that you don't need to know user_id and so the federated tokens can also call GET /auth/projects rather than OS-FEDERATED/projects or whatever it was | 08:27 |
| marekd | jamielennox: yes yes | 08:28 |
| *** gokrokve has joined #openstack-keystone | 08:28 | |
| marekd | jamielennox: and the /OS-FEDERATION/projects should stay for how long? One, two releases? | 08:28 |
| marekd | jamielennox: i guess one day you will want to remove it, also from keystoneclient. | 08:28 |
| jamielennox | marekd: i don't know, i don't think we've managed to successfully remove an API yet, just deprecate it | 08:29 |
| marekd | hm, i am wondering if this change needs any keystoeclient changes. | 08:32 |
| marekd | i think not really | 08:32 |
| *** gokrokve has quit IRC | 08:33 | |
| marekd | jamielennox: or the client side is not yet implemented? | 08:33 |
| jamielennox | client side for /auth/projects etc? | 08:33 |
| *** lsmola has quit IRC | 08:33 | |
| jamielennox | it's not really implemented | 08:33 |
| marekd | yes | 08:33 |
| *** openstackgerrit has quit IRC | 08:34 | |
| *** openstackgerrit has joined #openstack-keystone | 08:34 | |
| jamielennox | i started it, i don't know if i ever submitted it | 08:34 |
| jamielennox | there are some issues with how discovery works i think | 08:34 |
| *** Tahmina has joined #openstack-keystone | 08:35 | |
| marekd | namely? | 08:36 |
| jamielennox | um, so it requires API version 3.3 so i had a thing that if discovery doesn't report version 3.3 it should fall back to using the existing methods and something about the way it worked means i couldn't distinguish between v3.3 not being available and something else | 08:42 |
| jamielennox | it's been a little while | 08:42 |
| jamielennox | but it meant that you were always doing two requests where you should only have had to do one | 08:42 |
| jamielennox | https://review.openstack.org/#/c/118531/ | 08:43 |
| jamielennox | looking at it now i probably don't want to allow the fallback case at all because then it will fail for the federated case | 08:45 |
| jamielennox | s/fail/do the wrong thing | 08:45 |
| *** lsmola has joined #openstack-keystone | 08:46 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/126631 | 08:52 |
| *** Tahmina has quit IRC | 08:56 | |
| *** henrynash has joined #openstack-keystone | 09:05 | |
| *** lsmola has quit IRC | 09:05 | |
| *** alex_xu has quit IRC | 09:10 | |
| *** andreaf_ is now known as andreaf | 09:10 | |
| *** aix has quit IRC | 09:19 | |
| *** lsmola has joined #openstack-keystone | 09:20 | |
| *** aix has joined #openstack-keystone | 09:22 | |
| *** gokrokve has joined #openstack-keystone | 09:28 | |
| *** gokrokve has quit IRC | 09:33 | |
| *** KanagarajM has quit IRC | 09:38 | |
| marekd | jamielennox: so, do you think you will find some time for reviewing this: https://review.openstack.org/#/c/106751/12 ? | 09:39 |
| jamielennox | marekd: i'm going to have a look, again i don't really have anything i can test it with so it's just a style thing really | 10:15 |
| marekd | jamielennox: better than nothing. | 10:17 |
| *** gokrokve has joined #openstack-keystone | 10:28 | |
| *** gokrokve has quit IRC | 10:29 | |
| *** gokrokve has joined #openstack-keystone | 10:30 | |
| *** gokrokve has quit IRC | 10:35 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use connection retrying from keystoneclient https://review.openstack.org/129868 | 10:37 |
| *** jamielennox_ has joined #openstack-keystone | 11:06 | |
| *** jamielennox has quit IRC | 11:06 | |
| *** jamielennox_ is now known as jamielennox | 11:06 | |
| *** samuelms_home has joined #openstack-keystone | 11:13 | |
| *** ukalifon has quit IRC | 11:14 | |
| *** amakarov_away is now known as amakarov | 11:15 | |
| *** dimsum_ has joined #openstack-keystone | 11:21 | |
| *** miqui has quit IRC | 11:24 | |
| *** jistr is now known as jistr|english | 11:27 | |
| *** gokrokve has joined #openstack-keystone | 11:28 | |
| *** gokrokve has quit IRC | 11:32 | |
| *** afazekas has quit IRC | 11:37 | |
| *** k4n0 has quit IRC | 11:37 | |
| *** rwsu has quit IRC | 11:37 | |
| *** larsks has quit IRC | 11:37 | |
| *** larsks has joined #openstack-keystone | 11:37 | |
| *** afazekas has joined #openstack-keystone | 11:37 | |
| *** rwsu has joined #openstack-keystone | 11:37 | |
| *** k4n0 has joined #openstack-keystone | 11:38 | |
| *** diegows has joined #openstack-keystone | 11:44 | |
| *** afazekas has quit IRC | 11:46 | |
| *** afazekas has joined #openstack-keystone | 11:46 | |
| *** k4n0 has quit IRC | 11:46 | |
| *** k4n0 has joined #openstack-keystone | 11:46 | |
| *** samuelms__ has joined #openstack-keystone | 11:47 | |
| *** aix has quit IRC | 11:48 | |
| *** aix has joined #openstack-keystone | 11:49 | |
| *** samuelms_home has quit IRC | 11:50 | |
| *** vb has quit IRC | 11:52 | |
| *** vb has joined #openstack-keystone | 11:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/127765 | 12:10 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/126631 | 12:10 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/126679 | 12:15 |
| *** k4n0 has quit IRC | 12:28 | |
| *** gokrokve has joined #openstack-keystone | 12:28 | |
| *** htruta has joined #openstack-keystone | 12:30 | |
| *** gokrokve has quit IRC | 12:33 | |
| *** topol has joined #openstack-keystone | 12:35 | |
| *** diegows has quit IRC | 12:38 | |
| *** dimsum_ has quit IRC | 12:38 | |
| *** alee has quit IRC | 12:38 | |
| *** dimsum_ has joined #openstack-keystone | 12:39 | |
| *** yasu_ has quit IRC | 12:45 | |
| *** topol has quit IRC | 12:49 | |
| *** gordc has joined #openstack-keystone | 12:52 | |
| *** diegows has joined #openstack-keystone | 12:54 | |
| *** jistr|english is now known as jistr | 12:57 | |
| marekd | http://openstack-in-production.blogspot.ch/2014/10/kerberos-and-single-sign-on-with.html | 13:05 |
| * marekd http://openstack-in-production.blogspot.ch/2014/10/kerberos-and-single-sign-on-with.html | 13:05 | |
| *** richm has joined #openstack-keystone | 13:06 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:07 | |
| *** NM has joined #openstack-keystone | 13:12 | |
| *** NM has quit IRC | 13:12 | |
| *** NM has joined #openstack-keystone | 13:14 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 13:15 |
| *** flaviamissi has joined #openstack-keystone | 13:17 | |
| *** radez_g0n3 is now known as radez | 13:17 | |
| *** jistr has quit IRC | 13:20 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use connection retrying from keystoneclient https://review.openstack.org/129868 | 13:21 |
| *** jistr has joined #openstack-keystone | 13:23 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone-specs: Add a catalog to an unscoped token https://review.openstack.org/107333 | 13:25 |
| *** bknudson has joined #openstack-keystone | 13:29 | |
| *** joesavak has joined #openstack-keystone | 13:33 | |
| *** r-daneel has joined #openstack-keystone | 13:34 | |
| *** alee has joined #openstack-keystone | 13:40 | |
| *** radez is now known as radez_g0n3 | 13:41 | |
| *** topol has joined #openstack-keystone | 13:43 | |
| *** samuelms_home has joined #openstack-keystone | 13:57 | |
| *** stevemar has joined #openstack-keystone | 13:57 | |
| *** vejdmn has joined #openstack-keystone | 13:57 | |
| *** ayoung has joined #openstack-keystone | 13:59 | |
| *** gabriel-bezerra has quit IRC | 13:59 | |
| *** gokrokve has joined #openstack-keystone | 14:01 | |
| *** samuelms__ has quit IRC | 14:01 | |
| ayoung | stevemar, https://review.openstack.org/#/c/128780/ that should have been called "CADF everywhere" , not "create a spec for CADF everywhere" Go terse in your title! | 14:11 |
| stevemar | ayoung, my bad :) | 14:11 |
| ayoung | stevemar, I just went to edit the commit message, but saw it merged | 14:12 |
| stevemar | ayoung, were you OK with the changes? i think the only concern was to make it configurable? | 14:12 |
| ayoung | Not a huge deal, just a touch of polish | 14:12 |
| ayoung | I think the change itself is good | 14:12 |
| ayoung | stevemar, BTW, I think you can still submit changes to the spec even though it is approved: bknudson has some spelling and word suggestions that look like they should be adopted | 14:13 |
| ayoung | stevemar, I think that someday the 'Audit' aspect of it will be far overshadowed by the other uses of these notifications. Getting a decent format, light, and easy to work with, will have huge benefits. This is a good approach | 14:15 |
| ayoung | and it makes it easier to treat the notifications as a contract | 14:15 |
| jamielennox | i saw a thing from the opendaylight people where they were also using the "triple A" acronym, however the third A was accounting - not sure about better but maybe a bit more of a generic term | 14:18 |
| stevemar | ayoung, i'll push a new patch, just tweaking my VM a bit, just updated from 12.04 to 14.04 | 14:23 |
| bknudson | stevemar: how did the upgrade go? | 14:24 |
| bknudson | I need to do that sometime. | 14:24 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/identity-api: API documentation for Hierarchical Multitenancy https://review.openstack.org/111355 | 14:25 |
| *** gokrokve has quit IRC | 14:28 | |
| *** gokrokve has joined #openstack-keystone | 14:29 | |
| stevemar | bknudson, not bad, sladp gave me some issues | 14:30 |
| stevemar | bknudson, not bad otherwise, if you're using a VM with the unity desktop better switch to gnome | 14:31 |
| bknudson | no desktop for me... ssh | 14:31 |
| marekd | stevemar: gnome isn't unity? | 14:32 |
| marekd | stevemar: that new gnome is bleeeeh :( | 14:32 |
| bknudson | that's what kubuntu is for | 14:32 |
| marekd | kubuntu is with kde? | 14:32 |
| stevemar | marekd, nope it ain't and unity has some requirements for 2d/3d acceleration i think (from what i can tell) | 14:33 |
| *** andreaf has quit IRC | 14:33 | |
| marekd | hm, i'd be super happy with gnome2 | 14:33 |
| *** henrynash has quit IRC | 14:33 | |
| marekd | but upgrades are inevitable :( | 14:34 |
| bknudson | y kubuntu has kde | 14:34 |
| marekd | i simply need gnome-settings-daemon which will handle my multimedia, network etc. | 14:34 |
| *** samuelms_home has quit IRC | 14:34 | |
| marekd | i can manage my windows with help of other WMs | 14:34 |
| rodrigods | gnome 3 >> unity | 14:35 |
| rodrigods | =) | 14:35 |
| marekd | bknudson: so i'd rather go http://xubuntu.org/ | 14:35 |
| bknudson | I haven't tried xubuntu since I like KDE for whatever reason. | 14:35 |
| marekd | bknudson: sure | 14:36 |
| stevemar | bknudson, i would not have thought you like KDE at all | 14:36 |
| * rodrigods googling to see how KDE looks like nowadays | 14:36 | |
| bknudson | it's better than unity | 14:36 |
| stevemar | true | 14:36 |
| rodrigods | continues similar to windows | 14:37 |
| *** samuelms_home has joined #openstack-keystone | 14:38 | |
| *** _cjones_ has joined #openstack-keystone | 14:40 | |
| dstanek | rodrigods: the new KDE looks really nice, but i stick to the simple window managers | 14:40 |
| jamielennox | marekd: gnome 3 took some getting used to, but i prefered it once i did | 14:42 |
| rodrigods | dstanek, once i almost did a gsoc for gnome, so i became its advocate hehe | 14:42 |
| dstanek | my favorites were always fluxbox or ratpoison, but a friend of mine had me using awesome for quite a while | 14:43 |
| marekd | jamielennox: http://www.gambaru.de/blog/wp-content/uploads/2011/11/20111108_Gnome3_Debian_Shell.jpg this? | 14:44 |
| rodrigods | dstanek, so you like the "underdogs" | 14:45 |
| *** _cjones_ has quit IRC | 14:45 | |
| marekd | jamielennox: see, the problem is i use this: http://i3wm.org/ and i like some of gnome (like gnome-settings-daemon), but newest versions of it basically are not really working well with i3. At least after upgrades. | 14:45 |
| rodrigods | never tried them | 14:45 |
| jamielennox | marekd: pretty much | 14:45 |
| dstanek | rodrigods: i just don't value the flash and like to maximize productivity | 14:45 |
| marekd | dstanek: did you know that awesome's author works on openstack at the moment? | 14:45 |
| dstanek | i've have this mac for like 3 years and still can't make it a productive as my old linux machines | 14:46 |
| dstanek | marekd: really? i didn't know that | 14:46 |
| marekd | dstanek: https://julien.danjou.info/blog/ | 14:46 |
| marekd | dstanek: he works on ceilometer | 14:46 |
| jamielennox | ah, yea - if you're used to one of the really cut down window managers then i don't know what to offer | 14:47 |
| jamielennox | i tried them for a while dwm and awesome i think | 14:47 |
| jamielennox | i don't need them to be pretty but it just felt really clunky | 14:47 |
| rodrigods | dstanek, hmm will check awesome, at least for my workstation | 14:47 |
| ayoung | alee, So, been thinking over the Barbican Vault and IPA question. In a pure IPA driven model, what would be used today to determine if a user should be granted access to a key? | 14:47 |
| marekd | jamielennox: it's a matter of getting used to. | 14:48 |
| marekd | jamielennox: just like with vim. | 14:48 |
| dstanek | rodrigods: it's a tiled window manager so the experience is very different | 14:48 |
| alee | ayoung, well lets take the simplest case first. a secret that is for the project. | 14:48 |
| marekd | jamielennox: however i find vim quite clunky and sometimes switch to sublime | 14:48 |
| ayoung | alee, outside of Keystone and Openstack | 14:48 |
| rodrigods | marekd, will send my vim screen to you | 14:48 |
| *** ukalifon1 has joined #openstack-keystone | 14:49 | |
| marekd | rodrigods: yes, please | 14:49 |
| alee | ayoung, you mean barbican outside of openstack? | 14:49 |
| ayoung | no | 14:49 |
| ayoung | alee, I mean IPA and vault only | 14:49 |
| marekd | rodrigods: along with your vimrc | 14:49 |
| dstanek | jamielennox: yeah, awesome feels old and limited until you get used to the keyboard shortcuts | 14:49 |
| ayoung | alee, If I install freeipa from git master , I can install KRA, right? | 14:50 |
| alee | ayoung, yes you can install a KRA | 14:50 |
| rodrigods | marekd, https://www.dropbox.com/s/pn0omijznxtvs7e/vim.png?dl=0 | 14:50 |
| vsilva | I'm trying to run one single test (function) within keystone but can't get the syntax right - that is possible, isn't it? | 14:50 |
| alee | ayoung, right now , IPA communicates with KRA through a trusted agent. | 14:51 |
| rodrigods | marekd, almost sublime =P | 14:51 |
| alee | so its really what gets put in on the IPA side | 14:51 |
| vsilva | my last attempt: ./run_tests.sh keystone.tests.test_backend_ldap.BaseLDAPIdentity.test_get_and_remove_role_grant_by_group_and_domain runs 0 tests :| | 14:51 |
| alee | ie. the code that endi is writing | 14:51 |
| ayoung | alee, so for a key retrieval, if IPA says it is OK, KRA will pack up the key and return it? | 14:52 |
| alee | correct | 14:52 |
| alee | just like we do with certs | 14:52 |
| jamielennox | also there was the assumption that you wanted to customize everything, in general i want fairly stock at least until i get used to something | 14:52 |
| jamielennox | loading lua scripts for clocks and other stuff not my first concern | 14:52 |
| alee | ayoung, so its whatever policy is in place for IPA | 14:52 |
| marekd | rodrigods: does it give you variable hints? | 14:53 |
| ayoung | alee, So, I would think that Barbican should represent the IPA agent in this case: Barbican is responsible for the Role check. Since the request coming in is not expected to be Kerberized, you would need to do a transform anyway | 14:53 |
| rodrigods | marekd, https://github.com/rodrigods/dotfiles/blob/master/vimrc | 14:53 |
| marekd | rodrigods: not only from the current file? | 14:53 |
| rodrigods | marekd, it doesn't, i was learning the shortcuts for that | 14:53 |
| ayoung | alee, the request is going to be handled by Barbican, not directly by IPA, correct? | 14:54 |
| rodrigods | marekd, i know that for auto-completing from the file system you use C-x + f | 14:54 |
| alee | ayoung, sure -- you could do that -- that is - you could say "secrets stored by Barbican would need to be retrieved by Barbican" | 14:54 |
| ayoung | Yes | 14:54 |
| alee | ayoung, but then, whats the point of involving IPA vault at all? | 14:54 |
| *** david-lyle_ has joined #openstack-keystone | 14:54 | |
| *** zzzeek has joined #openstack-keystone | 14:54 | |
| alee | ayoung, right now - barbican can talk directly through its own agent to the KTA | 14:54 |
| ayoung | alee, well, I would not have done it that way. IPA and Dogtag have always been uneasy bedfellows | 14:55 |
| alee | KRA | 14:55 |
| alee | ayoung, that is precisely the point of my email :) | 14:55 |
| ayoung | but...you could try to do a reverse mappping | 14:55 |
| ayoung | right now we map groups to roles-in-projects | 14:55 |
| *** stevemar has quit IRC | 14:55 | |
| marekd | rodrigods: see, the problem is sometimes if you need to navigate and reorganize your buffers/splits | 14:55 |
| ayoung | Barbican could perform a reverse mapping: roles-in-projects to groups | 14:55 |
| *** stevemar has joined #openstack-keystone | 14:56 | |
| ayoung | its really not a reversable mapping | 14:56 |
| alee | the question is more what happens when someone tries to retrieve a secret from IPA directly | 14:57 |
| vsilva | oops, found the problem, nvm | 14:57 |
| ayoung | alee, it falls back on the IPA level permissions | 14:57 |
| ayoung | if only Barbican has access, and that some is not Barbican, it fails | 14:57 |
| ayoung | alee, I would not expect IPA to manage the identiies of the end users anyway, those are going to come from AD, and a trust arraingement is not a given | 14:58 |
| alee | yeah - but if I can't access the secret as a user from IPA directly, then I see no reason to involve vault at all. | 14:58 |
| alee | just let Barbican go to the KRA directly | 14:58 |
| ayoung | as much as we would like to require a trust set up, I think the common use case is a smallish lab, using IPA for host management, and end users comeing out of coproprate Kerboers, or maybe via SAML | 14:59 |
| ayoung | alee, I think Barbican getting access to all of Dogtag would make me very happty | 14:59 |
| ayoung | happity even | 14:59 |
| ayoung | I want user certs | 15:00 |
| *** david-lyle_ has quit IRC | 15:00 | |
| ayoung | but...IPA has a role to play here, too. | 15:00 |
| rodrigods | marekd, yeah, I think that I got used to the auto-completion style (from the same file) =) | 15:00 |
| alee | ayoung, barbican -> kra and ca already works | 15:00 |
| *** zzzeek has quit IRC | 15:01 | |
| alee | ayoung, ipa has either user/host store .. and provides dogtag | 15:01 |
| ayoung | so I would think that you would want Barbican to talk to the KRA via the IPA identity, and have all service users in IPA as a separate domain | 15:01 |
| *** stevemar has quit IRC | 15:01 | |
| ayoung | remember that Delegation in OpenStack really requires a Keystone user | 15:01 |
| *** stevemar has joined #openstack-keystone | 15:01 | |
| marekd | rodrigods: aha | 15:01 |
| alee | ayoung, ok - you've lost me. what do you mean by those last two statements? | 15:02 |
| ayoung | alee, for example, the realistic but messy case of Solum talking to Heat on behalf of an end user that needs to stick a key in the KRA so you have a doulbe delegated trust. | 15:02 |
| *** zzzeek has joined #openstack-keystone | 15:03 | |
| ayoung | alee, keystone trusts are user to user | 15:03 |
| ayoung | and they were written primarily to support heat | 15:03 |
| ayoung | Heat needs to do something on your behalf say a week from now | 15:03 |
| marekd | rodrigods: do you have working icehouse federation? | 15:03 |
| *** zzzeek has quit IRC | 15:03 | |
| ayoung | lets say that something involved fetching my Key out of the KRA | 15:03 |
| ayoung | So I create a trust that says "the heat user can get a token as me with the role needed to fetch a key" | 15:04 |
| ayoung | the heat user is in the service domain...those users could be either in FreeIPA or in SQL. THey are not going to be in corporate AD, and Corporate is not going to wnat ot treat them as real users, and is unlikely to want to createa Kerberos trust with my lab anyway | 15:05 |
| ayoung | alee, think of Keystone as being a tool that pulls together disparate Identity sources | 15:06 |
| *** david-lyle has joined #openstack-keystone | 15:06 | |
| alee | sure -- I'm following -- go on. | 15:06 |
| ayoung | and provides a common schmear of authorization over those layers. Like a bagel | 15:06 |
| ayoung | mmmm | 15:06 |
| ayoung | so the users from Keystone's perspective get commonized | 15:07 |
| ayoung | IPA is just one of those sources, but we want to use it to secure the infrastructure | 15:07 |
| ayoung | so users like Barbican, Keystone, Nova, they all become IPA users | 15:07 |
| morganfainberg | mornin | 15:07 |
| ayoung | then those service users can do Kerberos/SASL protected operations\ | 15:08 |
| ayoung | alee, it doesn't preclude having the human users in IPA | 15:08 |
| ayoung | if we want to provide an additional mechanism for the human users in IPA getting a better degree of access control from a Barbican/KRA instance, I would treat that as an upgrade | 15:09 |
| *** thedodd has joined #openstack-keystone | 15:09 | |
| ayoung | not the default approach | 15:09 |
| ayoung | alee, but you could do something like that with S4U2 | 15:09 |
| ayoung | It doesn't really make sense with the Keystone RBAC model. | 15:10 |
| ayoung | But it really is no different than going direct to LDAP with your Kerberos credentials if you backed Keystone with FreeIPA...with the same ability to bypass the Application-level constraints | 15:11 |
| *** zzzeek has joined #openstack-keystone | 15:11 | |
| *** jsavak has joined #openstack-keystone | 15:12 | |
| ayoung | alee, make sense? | 15:12 |
| alee | so right now, heat would go to keystone and get a token, and present that token to barbican | 15:13 |
| ayoung | yep | 15:14 |
| alee | barbican would decide whether or not a user is permitted to get to the secret based on the contents of the token | 15:14 |
| *** joesavak has quit IRC | 15:14 | |
| ayoung | heat would go to keystone with its own identity and a trustid, and execute that trust, to get a token where the heatuser was the trustee and the originaluser was the trustor | 15:14 |
| *** jistr has quit IRC | 15:14 | |
| alee | and if so, would instruct kra through its trusted agent to go and get it. | 15:14 |
| ayoung | barbican would look at the roles in the token | 15:15 |
| ayoung | yep | 15:15 |
| alee | so sure -- I still dont see how all this changes how things are happening now .. | 15:15 |
| alee | other than ipa having a role in storing some service users | 15:15 |
| ayoung | it doesn't. Its how things should work. | 15:15 |
| alee | and is how things work right now .. | 15:16 |
| alee | well from the barbican side of things in any case. | 15:16 |
| ayoung | cool. my worrk here is done | 15:16 |
| alee | the difficulty is when you try to inject ipa vault between barbican and kra | 15:17 |
| ayoung | cuz that expects to operate on the IPA user, not the Barbican Agent | 15:18 |
| alee | ayoung, right - we could do all this as a barbican agent -- but again - Why bother? | 15:18 |
| ayoung | you could make a fine degree of control... | 15:19 |
| ayoung | lets say that, for every project, one person owned the keys | 15:19 |
| ayoung | but that would still not be the user making the request | 15:19 |
| ayoung | alee, I suspect that you could make use of the IPA layer if you did something with s4u2 | 15:20 |
| ayoung | but you can't ignore the Keystone RBAC. | 15:20 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Expose version matching functions to the public https://review.openstack.org/129935 | 15:20 |
| alee | ayoung, my point is that any policy related to getting the secrets are enforced at the barbican layer | 15:20 |
| ayoung | Barbican should do whatever Keystone work is necessary. The protections should be additive | 15:21 |
| ayoung | you could have multiple Barbicans | 15:21 |
| ayoung | so each would have a separate IPA user | 15:21 |
| ayoung | and B1 would not have access to secrets stored by B2 | 15:21 |
| *** radez_g0n3 is now known as radez | 15:22 | |
| ayoung | Keystone would know about both endpoints, but they could be assigned via the endpoint filtering to separate projects, or even one project could know about both, but have reasons for putting things into different vaults | 15:22 |
| ayoung | maybe one is considered "read only" from the keystone side, used just for escrow | 15:23 |
| alee | so a single ipa with a single kra behind it for multiple barbicans .. | 15:25 |
| alee | you could accomplish the same with multiple barbicans each with their own trusted agent in kra | 15:25 |
| alee | and different domains in the kra | 15:26 |
| *** vb has quit IRC | 15:32 | |
| *** samuelms__ has joined #openstack-keystone | 15:34 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 15:36 |
| *** samuelms_home has quit IRC | 15:37 | |
| *** gyee has joined #openstack-keystone | 15:39 | |
| *** marcoemorais has joined #openstack-keystone | 15:40 | |
| *** jistr has joined #openstack-keystone | 15:43 | |
| amakarov | ayoung, hello! Can you please review my patch about redelegation? I've found a way to move delete logic to manager and wrote tests with chained trust. Any ideas about more test cases would be welcome! | 15:43 |
| *** nonameentername has joined #openstack-keystone | 15:45 | |
| ayoung | amakarov, looking now | 15:48 |
| amakarov | ayoung, small fix on the way :) pep8 mostly | 15:49 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 15:50 |
| amakarov | ayoung, done | 15:51 |
| *** gokrokve has quit IRC | 15:52 | |
| *** NM has quit IRC | 15:55 | |
| *** samuelms__ has quit IRC | 15:57 | |
| gyee | jamielennox, https://review.openstack.org/#/c/113735/, can you check to see if I have all your changes? | 15:58 |
| *** henrynash has joined #openstack-keystone | 15:58 | |
| jamielennox | gyee: that ones going to take a little looking into | 15:59 |
| *** lhcheng has joined #openstack-keystone | 15:59 | |
| gyee | jamielennox, I am afraid so, I can continue to work on it | 16:02 |
| *** Kieleth has joined #openstack-keystone | 16:02 | |
| gyee | but there are a bunch of tests failures so far | 16:02 |
| *** cjellick has joined #openstack-keystone | 16:02 | |
| jamielennox | i only had it working in a fairly limited way | 16:03 |
| jamielennox | and honestly there were probably some client changes that were made to get it there | 16:03 |
| amakarov | bknudson, greetings! You asked for tests in https://review.openstack.org/#/c/125923/ I've just updated existing fixture so it represent one more caveat now and tests fail without proposed fix. | 16:04 |
| bknudson | amakarov: I'm not a fan of it... maybe somebody else will think it's the right approach. | 16:04 |
| bknudson | amakarov: a test for the specific situation would make it more obvious why the code is there and also why the test failed if the problem comes back. | 16:06 |
| amakarov | bknudson, well, thank you for the point, anyway fixture was incomplete... I'll add specific test for this particular issue | 16:08 |
| jamielennox | amakarov: hmm, it's a little change but it's a big assumption | 16:08 |
| amakarov | jamielennox, we actually test installation over dosens of nodes now and it shows a couple of interesting effects :) Including the spoken issue | 16:10 |
| *** afazekas has quit IRC | 16:13 | |
| *** NM has joined #openstack-keystone | 16:14 | |
| jamielennox | amakarov: i'm not sure your fixture change is correct either | 16:14 |
| jamielennox | in the service catalog we don't group by region, but we do group by service_type | 16:14 |
| jamielennox | you would expect only one 'compute' entry in the service catalog | 16:15 |
| jamielennox | actually i would go so far as to say you must only have one entry per service_type in the catalog | 16:15 |
| jamielennox | your change to the service_catalog and to the fixture are related, but if we assume the fixture is correct then i think the service_catalog is also correct | 16:16 |
| amakarov | jamielennox, so there have to be some validation of the service_catalog structure? | 16:16 |
| ayoung | amakarov, OK, so thought experiment: I need solum to do something for me. I create a trust where trustor is ayoung, trustee is solum. Later solum redelegates this to heat. Who is the trustor, and who is the trustee in this last trust? ayoung and heat? | 16:17 |
| Kieleth | Hi keystonians, quick question: shouldn't "$ keystone tenant-get PROJECT_ID" provide information of the users members of this PROJECT_ID ? Horizon provides this info nicely, but I cannot find similar in cli. | 16:18 |
| jamielennox | amakarov: i'm not sure where that validation would happen | 16:18 |
| ayoung | amakarov, because I think that needs to be the case: | 16:18 |
| jamielennox | maybe on keystone service-create | 16:18 |
| ayoung | amakarov, tell you what, finish up with jamielennox then we can discuss | 16:18 |
| jamielennox | so that service_type is unique | 16:18 |
| amakarov | jamielennox, so it's to be decided I presume? | 16:19 |
| *** cjellick has quit IRC | 16:20 | |
| amakarov | ayoung, trustor is ayoung , trustee is heat, redelegated is trust ayoung -> solum | 16:20 |
| jamielennox | i *think* you could put a unique contraint on service_type - though i'm not sure, the project endpoint binding is per endpoitn not per service but i don't know what having multiple services in the catalog would mean | 16:21 |
| ayoung | amakarov, heh, I think you reversed my example, but you are saying that the trustor stays the same in a redelgation? | 16:21 |
| amakarov | ayoung, chain may be extracted in a single request | 16:21 |
| amakarov | ayoung, yes | 16:21 |
| jamielennox | i know it would break pretty much everything | 16:21 |
| ayoung | amakarov, OK, that should work. All that needs to be valid for the intermediate users is the trust be valid. I am not certain, however, if we are checking that the intermediate users are still enabled. | 16:22 |
| jamielennox | Kieleth: from memory getting users is keystone user-list --tenant-id PROJECT_ID | 16:23 |
| *** _cjones_ has joined #openstack-keystone | 16:23 | |
| amakarov | jamielennox, thank you, I've got the point. Let's return to it when I have a use case details, ok? :) | 16:23 |
| ayoung | jamielennox, so, the MOC folks have been working on a proposal along the lines of clarifying which endpoint you mean when you do an operation and there are multiple endpoints for the service in the catalog: | 16:23 |
| ayoung | instead of a uuid, you pass the URL. Its like RESTful and stuff | 16:23 |
| jamielennox | ayoung: i'd be really interested to see a good proposal for the service catalog | 16:23 |
| ayoung | jamielennox, its not a service catalog change. It is basically a Nova change | 16:24 |
| ayoung | since really, only Nova is responsible for working as a middleman talking to other services | 16:24 |
| ayoung | I'd expect HEAT and Solumn to follow suite, though | 16:24 |
| *** cjellick has joined #openstack-keystone | 16:25 | |
| amakarov | ayoung, thanks for the point about disabled intermediate users, I'll double-check if it's covered by tests | 16:25 |
| *** gokrokve has joined #openstack-keystone | 16:25 | |
| ayoung | it means that when you do a nova boot, instead of passing, say, the image id, you would pass the URL as returned by Glance. Then Nova would look at the image_id field and have to determine how to parse it | 16:26 |
| jamielennox | ayoung: at some point quite a lot of flexibility was built into the catalog, and then there was never really concensus on the standard way to use it | 16:26 |
| ayoung | amakarov, yeah, get_trust is on the right track, but you need an additional check. I think that the valid user chack is done only in the token provider | 16:26 |
| ayoung | jamielennox, I'm sure it makes sense to someone. | 16:27 |
| jamielennox | sure, but if it's a change to how the service catalog works across multiple projects i'd expect/hope it came through keystoneclient | 16:27 |
| ayoung | in this case, it was for a single project with ambiguous endpoints for the same service. | 16:27 |
| jamielennox | i'm not sure why that would happen - if you've got a URL then you don't need a catalog | 16:28 |
| ayoung | nova boot being the obvious starting point, but mounting from cinder a close second. And then there is a project that might need to talk to multiple neutrons | 16:28 |
| jamielennox | anything that involves parsing data out of URLs is wrong | 16:28 |
| ayoung | Corect | 16:28 |
| ayoung | if you have an URL< you don't need a catalog | 16:28 |
| ayoung | jamielennox, well, ideally, nova wouldn't parse, but would be able to make use of the URL as is: | 16:29 |
| ayoung | in the case of glance, it would be GET {image_id} | 16:29 |
| *** aix has quit IRC | 16:30 | |
| ayoung | the only reason to parse is to determine if the value was an URL or a simple identifier | 16:30 |
| ayoung | but you could also rename the attribute, and say either pass image_id or pass image_url | 16:30 |
| ayoung | and then no parsing would be required | 16:30 |
| *** thedodd has quit IRC | 16:31 | |
| *** lhcheng_ has joined #openstack-keystone | 16:31 | |
| *** Dafna has quit IRC | 16:31 | |
| Kieleth | jamielennox, bingo! thanks | 16:32 |
| ayoung | I could see a substring match for access control: if you have the image endpoint URL in the catalog, make sure that image_url.startswith(endpoint) | 16:32 |
| *** thedodd has joined #openstack-keystone | 16:32 | |
| *** lhcheng has quit IRC | 16:33 | |
| *** packet has joined #openstack-keystone | 16:34 | |
| *** packet has quit IRC | 16:34 | |
| *** packet has joined #openstack-keystone | 16:34 | |
| navid_ | hi there | 16:38 |
| navid_ | i have an error for tox -epy27 | 16:38 |
| ayoung | jamielennox, what do you think of the idea that "get_projects" should be the Horizon authenticate call? Just always make that call. | 16:38 |
| navid_ | ERROR: InvocationError: '/opt/stack/python-keystoneclient/.tox/py27/bin/python setup.py testr --testr-args=' | 16:38 |
| ayoung | navid_, did you try recreating the venv in .tox? | 16:40 |
| ayoung | it would be in .tox/py27 | 16:40 |
| jamielennox | ayoung: so you want to put a project list as part of the unscoped token? | 16:42 |
| *** dimsum_ is now known as dims | 16:45 | |
| ayoung | jamielennox, you know how you defer getting a token until the first call? Horizon always needs a project list, so do the project list right up front, and use that to force the authenticate; it will use the userid and password in the password plugin | 16:45 |
| ayoung | jamielennox, here is the current logic: http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/backend.py#n115 | 16:46 |
| ayoung | I've rewritten it to use auth plugins, but the logic is unchanged, and I have the force_reauthenticate call in there | 16:46 |
| jamielennox | oh, yea that's fine | 16:47 |
| ayoung | jamielennox, it should make it easier to throw in the "always unscoped" flag in the future | 16:47 |
| jamielennox | well it looks like even if it has a default project id you're going to fetch the list anyway so you may as well just do it there | 16:51 |
| jamielennox | ugh, auth_token is just written so differently from everything else, can't figure out how to make the plugin work | 16:54 |
| ayoung | jamielennox, dadgumit...we have no way of getting the user_id to do the project list | 16:55 |
| jamielennox | i'm re-remembering all these fun things | 16:55 |
| ayoung | jamielennox, need the semantics list_project?user=self | 16:56 |
| jamielennox | yep, that's GET /auth/project | 16:56 |
| navid_ | ayoung, no i did not, will do, thanks | 16:56 |
| ayoung | navid_, just a suggestion, not promise it will work | 16:56 |
| ayoung | navid_, you working on the revocation events? | 16:57 |
| navid_ | ayoung, ok, yes the errors i got from the patch | 16:57 |
| ayoung | navid_, so I got as far as realizeing the issue was httpretty, | 16:57 |
| ayoung | navid_, I was running individul tests like this: | 16:58 |
| ayoung | . .tox/py27/bin/activate | 16:58 |
| ayoung | then | 16:58 |
| ayoung | testr run | 16:59 |
| ayoung | and then adding additional args to bypass the test enumeration | 16:59 |
| *** cjellick has quit IRC | 16:59 | |
| ayoung | navid_, but that got me http://paste.openstack.org/show/122780/ | 17:00 |
| *** cjellick has joined #openstack-keystone | 17:00 | |
| ayoung | navid_, so do a git show b487f946cd60a907174f550e08372d5907ca319f to see the commit where we yanked out httpretty | 17:00 |
| *** lhcheng_ has quit IRC | 17:01 | |
| *** lhcheng has joined #openstack-keystone | 17:01 | |
| ayoung | mostly it is changes like | 17:01 |
| ayoung | - self.stub_url(httpretty.GET, [], | 17:01 |
| ayoung | + self.stub_url('GET', [], | 17:01 |
| ayoung | navid_, but it should be pretty straightforward replacement. \ | 17:01 |
| *** packet has quit IRC | 17:01 | |
| ayoung | navid_, however, I think I want to dump the "tree" approach to revocation checking. No one understands that code except yoriksar | 17:02 |
| ayoung | I think I want to go back to a recursive approach like I had in earlier iterations of my original server side patch | 17:02 |
| ayoung | I think that code might still live in the tests... | 17:03 |
| ayoung | navid_, here is one of the latest versions of the pre-tree approch: https://review.openstack.org/#/c/55908/60/keystone/contrib/revoke/model.py,cm | 17:04 |
| ayoung | look at the "matches" method, and I think you will agree it is somewhat more comprehensible than the current "tree" based approach | 17:05 |
| navid_ | ayoug, so what would be the future of the bugs for deleting idp | 17:05 |
| navid_ | ayoung, is in your we blog | 17:06 |
| ayoung | navid_, ah...I need to register a new spec, for linking from IdP to domains | 17:06 |
| ayoung | but...ugh, its a mess. | 17:06 |
| ayoung | morganfainberg, dagnabit, you should have listened to me about IdPs always getting a domain | 17:07 |
| ayoung | the current set up is such that we lose the origianator IdP when we create a token | 17:07 |
| morganfainberg | ayoung, :( | 17:08 |
| *** zigo has quit IRC | 17:08 | |
| ayoung | and right now, all IdPs go into the same domain. Which is the default | 17:08 |
| morganfainberg | ayoung, yeah. | 17:08 |
| morganfainberg | wait, when we rescope you mean? | 17:08 |
| morganfainberg | or whenever we create a token? | 17:08 |
| *** zigo has joined #openstack-keystone | 17:08 | |
| ayoung | morganfainberg, mapping has not way to specify domain | 17:08 |
| morganfainberg | because the latter *should* have IDP info in it | 17:08 |
| morganfainberg | oh | 17:08 |
| ayoung | so all federation has to go into the default domain | 17:08 |
| morganfainberg | right | 17:08 |
| ayoung | So if we disable an Idp...we are stuck | 17:09 |
| ayoung | cuz we can't disable the default domain | 17:09 |
| morganfainberg | uh, but dones't we have the IDP info in the token? | 17:09 |
| morganfainberg | so we revoke on IDP info | 17:09 |
| ayoung | No | 17:09 |
| morganfainberg | not domain | 17:09 |
| morganfainberg | i thought we added that | 17:09 |
| ayoung | its not part of the token format | 17:09 |
| ayoung | hmmm, is it in the federation extensioN? | 17:10 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L464-L475 | 17:10 |
| ayoung | saml2 | 17:11 |
| ayoung | morganfainberg, isn't that just for K2K? | 17:11 |
| ayoung | if 'saml2' in method_names: | 17:11 |
| morganfainberg | https://github.com/openstack/keystone/commit/986c3eb08aa019a5793074fd7bade83972135271 | 17:11 |
| ayoung | so we are ignoring all the other mechanisms? | 17:11 |
| morganfainberg | i'm going to say that is supposed to be for all federation | 17:12 |
| ayoung | Feh | 17:12 |
| ayoung | yep | 17:12 |
| morganfainberg | i still think IDPs should have had a domain each - but that ship may have sailed for the current conversation (would have made things easier) | 17:12 |
| ayoung | yes | 17:12 |
| ayoung | but if we get the IdP into the token, we can revoke on IdP id | 17:13 |
| ayoung | and since it is there for SAML, we can move support for it into the mapping plugin | 17:13 |
| morganfainberg | but we can revoke on IDP info (we really need to make revocation events work, even if they are only ever used internal to keystone, because the revocation list is icky and deletes are ... expensive since we keep having to add support for new first order columns to avoid table scans) | 17:14 |
| morganfainberg | ayoung, ++ | 17:14 |
| ayoung | morganfainberg, I could see a case where one IdP has multiple domains, and we should be able to disable them all at once | 17:14 |
| ayoung | morganfainberg, navid_ is working on that for us right now. | 17:14 |
| morganfainberg | ayoung, well in the current model there are no domain constructs for "idps" so, not relevant | 17:14 |
| morganfainberg | disabling the idp covers everything important | 17:15 |
| ayoung | morganfainberg, we could hardcode a check into the token provider for just that filed | 17:15 |
| *** harlowja_away is now known as harlowja | 17:15 | |
| ayoung | field | 17:15 |
| ayoung | if there is an Idp field in the token, look to make sure the IDP is not disabled or deleted | 17:15 |
| morganfainberg | or we could finish revocation event support and use that instead of the delete/revoke-by-id thing we have. | 17:16 |
| ayoung | <gonzo>oh sure, if you want to do things the easy way</gonzo> | 17:16 |
| morganfainberg | ;) | 17:16 |
| morganfainberg | ok, so i'm going to run and try and get breakfast. | 17:16 |
| morganfainberg | if i'm running a bit late, feel free to start the meeting w/o me, skip the Blueprint review (we can circle up next week or at the end of the meeting) [ ayoung, dolphm ] | 17:17 |
| ayoung | navid_, OK, so here's the steps: | 17:17 |
| dolphm | morganfainberg: ack | 17:17 |
| ayoung | get revocation events into the client | 17:17 |
| ayoung | make the code readable | 17:17 |
| morganfainberg | i *should* be back in time, but. you know how tings go. | 17:17 |
| ayoung | add in support for revoke by IdP as an optional field in the token | 17:18 |
| *** thedodd has quit IRC | 17:21 | |
| *** radez is now known as radez_g0n3 | 17:24 | |
| jamielennox | do we think that anyone would be purposefully forcing auth_token middleware to use v2.0 even when v3 is available? | 17:24 |
| jamielennox | via the auth_version flag | 17:25 |
| rodrigods | marekd, sorry, was afk. Yep, we have a icehouse federation deployment here | 17:25 |
| jamielennox | and can i disable support for that using auth_plugins? | 17:26 |
| *** radez_g0n3 is now known as radez | 17:26 | |
| *** amcrn has joined #openstack-keystone | 17:27 | |
| bknudson | jamielennox: if they had a problem with v3 for some reason then they'd want a way to use v2. | 17:34 |
| ekarlso | jamielennox: u around ? :) | 17:35 |
| *** thedodd has joined #openstack-keystone | 17:35 | |
| jamielennox | bknudson: yea - but from my initial guess it seems broken | 17:36 |
| jamielennox | ekarlso: yep | 17:36 |
| ekarlso | jamielennox: when using a adapter towards a experimental api version | 17:36 |
| ekarlso | it's not enough to LegacyJsonAdapter(version=(2)) ? | 17:37 |
| jamielennox | ekarlso: you are already breaking new ground i think | 17:38 |
| ekarlso | jamielennox: ? | 17:38 |
| ekarlso | this is for designate | 17:38 |
| jamielennox | ekarlso: why not? | 17:40 |
| jamielennox | so version is based on the version reported by discovery so it does GET / and looks for what API versions are available | 17:40 |
| jamielennox | if the status is marked as unstable in some way then it is ignored by default | 17:41 |
| jamielennox | there is a flag somewhere... | 17:41 |
| *** zigo has quit IRC | 17:41 | |
| *** zigo has joined #openstack-keystone | 17:41 | |
| ekarlso | jamielennox: yeah, you can specify version when creating the session | 17:42 |
| ekarlso | but you can not pass that it's unstable :( | 17:42 |
| *** vejdmn has quit IRC | 17:43 | |
| jamielennox | sorry just thinking and you might be right | 17:43 |
| jamielennox | actually i'm almost sure you are | 17:43 |
| jamielennox | so there is a couple of flags when doing discovery | 17:43 |
| *** jistr has quit IRC | 17:43 | |
| jamielennox | yea | 17:44 |
| jamielennox | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/_discover.py#L142 | 17:44 |
| jamielennox | has the flags you want | 17:44 |
| ekarlso | yah | 17:44 |
| ekarlso | but | 17:44 |
| ekarlso | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/adapter.py#L29-L32 | 17:44 |
| ekarlso | does not :D | 17:44 |
| openstackgerrit | Andreas Jaeger proposed a change to openstack/keystonemiddleware: Improve help strings https://review.openstack.org/118048 | 17:45 |
| jamielennox | you would need to pass them through here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/base.py#L212 | 17:45 |
| ekarlso | sounds a bit awkward jamielennox | 17:46 |
| jamielennox | yuk - i don't know what that does to the cache | 17:46 |
| *** vejdmn has joined #openstack-keystone | 17:47 | |
| ekarlso | jamielennox: wouldn't the best thing be if there was a thing in the version= that allowed it to be marked as unstable ? | 17:47 |
| jamielennox | yea, the best thing would be is if the discovery object had all the values in it | 17:48 |
| stevemar | can i get another +2/+A here: https://review.openstack.org/#/c/118048/ tis a simple change to help strings for our doc folks | 17:48 |
| jamielennox | then when you did a url_for you could specify unstable=True | 17:48 |
| ekarlso | uh, jamielennox url_For ? | 17:48 |
| ekarlso | I am just taking a session, wrapping in a adapter where version etc is specified | 17:49 |
| *** david-lyle has quit IRC | 17:49 | |
| ekarlso | seems to be that version=() should be able to take unstable or not ? | 17:49 |
| ekarlso | or a unstable=True to adapter | 17:49 |
| jamielennox | then we could just add those parameters to the adapter or to the auth plugin itself | 17:49 |
| jamielennox | however it doesn't work that way i think | 17:49 |
| jamielennox | ekarlso: oh - wait | 17:49 |
| *** david-lyle has joined #openstack-keystone | 17:49 | |
| jamielennox | ekarlso: yea i'm looking deeper than that to where the discovery is happening | 17:50 |
| jamielennox | if we add unstable= to the endpoint_filter will it work | 17:50 |
| jamielennox | stevemar: done | 17:51 |
| marekd | rodrigods: ok, nevermind, i solved my issue. | 17:52 |
| jamielennox | ekarlso: good news, it shouldn't be hard to do | 17:54 |
| jamielennox | but there's nothign that allows it yetr | 17:54 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 17:54 |
| jamielennox | umm, i guess it can be added fairly easily to the adapter and hence the client - that would seem to be the place that makes the most sense | 17:55 |
| jamielennox | ekarlso: so, add the allow_experimental etc flags to https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/base.py#L151 | 17:56 |
| jamielennox | pass them through here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/base.py#L222 | 17:56 |
| *** jistr has joined #openstack-keystone | 17:56 | |
| ekarlso | jamielennox: pass thoguih where ? | 17:56 |
| jamielennox | then add them to the adapter here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/adapter.py#L72 | 17:57 |
| jamielennox | to the url_for function | 17:57 |
| stevemar | jamielennox, you are up too early | 17:58 |
| stevemar | or up too late | 17:58 |
| *** bobt has joined #openstack-keystone | 17:59 | |
| jamielennox | it's the default arguments to url_for that are blocking you | 17:59 |
| *** bobt has quit IRC | 17:59 | |
| jamielennox | i'm hanging out in Brno till summit | 17:59 |
| jamielennox | so up too late, but not that bad | 17:59 |
| jamielennox | this is how i've been here all day :) | 18:00 |
| dolphm | morganfainberg: back? | 18:00 |
| marekd | jamielennox: you are in Europe? | 18:00 |
| morganfainberg | Almost start the meeting | 18:00 |
| jamielennox | yea | 18:00 |
| morganfainberg | Be at my desk in a few but I'm listening. | 18:01 |
| marekd | jamielennox: working "remotely" or still holiday? | 18:01 |
| *** marcoemorais has quit IRC | 18:01 | |
| marekd | jamielennox: i though you wanted to catch up and worked 24/24 for last few days :P | 18:01 |
| *** marcoemorais has joined #openstack-keystone | 18:01 | |
| *** marcoemorais has quit IRC | 18:02 | |
| *** marcoemorais has joined #openstack-keystone | 18:02 | |
| *** marcoemorais has quit IRC | 18:03 | |
| *** marcoemorais has joined #openstack-keystone | 18:04 | |
| *** vejdmn has quit IRC | 18:07 | |
| *** vejdmn has joined #openstack-keystone | 18:07 | |
| *** afaranha has left #openstack-keystone | 18:10 | |
| *** marcoemorais has quit IRC | 18:10 | |
| *** radez is now known as radez_g0n3 | 18:14 | |
| *** radez_g0n3 is now known as radez | 18:15 | |
| *** marcoemorais has joined #openstack-keystone | 18:18 | |
| ekarlso | jamielennox: grrr, why so hard :( | 18:21 |
| ekarlso | jamielennox: that means there's no way to use discovery towarsd unstable then in released versions of keystoneclient ? | 18:22 |
| *** thedodd has quit IRC | 18:23 | |
| morganfainberg | jamielennox, post meeing need to sync up on some client stuff with you | 18:24 |
| morganfainberg | jamielennox, if you have time | 18:24 |
| *** jamielennox_ has joined #openstack-keystone | 18:25 | |
| ekarlso | jamielennox: shouldn't all the allow_* stuff be passable all the way down ? | 18:26 |
| jamielennox_ | ekarlso: yep | 18:26 |
| jamielennox_ | there's 3 | 18:27 |
| *** jistr has quit IRC | 18:31 | |
| *** marcoemorais has quit IRC | 18:33 | |
| *** marcoemorais has joined #openstack-keystone | 18:33 | |
| alee | ayoung, can I have comments on https://review.openstack.org/#/c/127353/1/specs/kilo/add-per-secret-policy.rst,cm ? | 18:33 |
| ayoung | alee, will look right after keystone meeting | 18:33 |
| alee | ayoung, thanks | 18:34 |
| *** meker12 has joined #openstack-keystone | 18:35 | |
| *** marcoemorais has quit IRC | 18:36 | |
| *** marcoemorais has joined #openstack-keystone | 18:36 | |
| *** jamielennox has quit IRC | 18:38 | |
| jamielennox_ | ekarlso: allow_* should probably be passed through: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/generic/base.py#L143 as well | 18:41 |
| *** radez is now known as radez_g0n3 | 18:43 | |
| *** marcoemorais has quit IRC | 18:44 | |
| *** marcoemorais has joined #openstack-keystone | 18:44 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Use correct name of oslo debugger script https://review.openstack.org/130000 | 18:44 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 18:51 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:52 | |
| ekarlso | jamielennox_: has your generic changes gone in btw ? :) | 18:55 |
| jamielennox_ | ekarlso: yep | 18:55 |
| ekarlso | jamielennox_: but not released yet ? | 18:56 |
| jamielennox_ | ekarlso: yea, i think they were in the last release | 18:56 |
| jamielennox_ | 0.11 | 18:57 |
| *** thedodd has joined #openstack-keystone | 18:57 | |
| *** ks-untriaged-bot has joined #openstack-keystone | 18:58 | |
| ks-untriaged-bot | Untriaged bugs for project keystone: | 18:58 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1381961 | 18:58 |
| uvirtbot | Launchpad bug 1381961 in keystone "Keystone API GET 5000/v3 returns wrong endpoint URL in response body" [Low,Confirmed] | 18:58 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1383676 | 18:58 |
| uvirtbot | Launchpad bug 1383676 in keystone "endless loop when deleting region" [High,New] | 18:58 |
| ks-untriaged-bot | Untriaged bugs for project keystonemiddleware: | 18:58 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystonemiddleware/+bug/1383853 | 18:58 |
| uvirtbot | Launchpad bug 1383853 in keystonemiddleware "auth_token middleware hard coded to check for version 3.0" [Undecided,New] | 18:58 |
| ks-untriaged-bot | Untriaged bugs for project python-keystoneclient: | 18:58 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1377080 | 18:58 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1372710 | 18:58 |
| uvirtbot | Launchpad bug 1377080 in python-keystoneclient "Stale endpoint selection logic in keystone client" [Undecided,In progress] | 18:58 |
| uvirtbot | Launchpad bug 1372710 in python-keystoneclient "cfn-push-stats fails to authenticate" [Undecided,Incomplete] | 18:58 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1334382 | 18:58 |
| uvirtbot | Launchpad bug 1334382 in horizon "API endpoint service names are not translated" [Low,Confirmed] | 18:58 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1357567 | 18:58 |
| uvirtbot | Launchpad bug 1357567 in python-keystoneclient "auth_ref caching/retrieving is failing - user needs to provide password for every command" [Undecided,New] | 18:58 |
| *** ks-untriaged-bot has quit IRC | 18:58 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Make assignments pluggable. https://review.openstack.org/129397 | 18:59 |
| ayoung | alee, I want to make trusts less heavy handed, but I need something like this: https://review.openstack.org/#/c/123726/ | 18:59 |
| henrynash | morganfainberg: fyi, here’s hopefully a trivial bp for next time we review: https://blueprints.launchpad.net/keystone/+spec/remove-role-metadata | 19:00 |
| morganfainberg | henrynash, next week | 19:00 |
| henrynash | morganfainberg: ok | 19:00 |
| morganfainberg | henrynash, i should have everything clenaed up so we can review untargeted/new/etc | 19:00 |
| jamielennox_ | ayoung: that's essentially the policy based tokens i've been talking about - just in selective situations | 19:00 |
| ayoung | jamielennox_, yeah. I think the net effect would be very similar. Mine would essentially leave RBAC in place. I also have the inherited roles Spec that would make it possible to go more granular as well. | 19:02 |
| jamielennox_ | ayoung: it wouldn't kill RBAC, it would just change it around and make it resolved by the server rather than fetched | 19:03 |
| jamielennox_ | i was catching up on the ML and it seems a fairly similar idea to morganfainberg's | 19:05 |
| jamielennox_ | i ran something like this by him ages ago, but i still think it's doable and the right way forward - i just don't know what it does to PKI | 19:05 |
| *** jamielenz has joined #openstack-keystone | 19:07 | |
| *** jamielenz is now known as jamielennox | 19:07 | |
| ayoung | jamielennox_, well, one thing that we currently do is split up the token popultation from the policy rules. Putting it all in the token would essentially make the policy kindof irrelevant | 19:08 |
| ayoung | I'd almost see it as a two step process: check 1 can this user do this? check 2 can this token do this? | 19:09 |
| *** jistr has joined #openstack-keystone | 19:10 | |
| ayoung | if in effect It does mean that any non-enumerated operation would be denied | 19:10 |
| ayoung | so you do want to be able to say "allow any operation" but have that constrained by the service still to not mean Admin operations | 19:10 |
| *** radez_g0n3 is now known as radez | 19:14 | |
| *** _cjones_ has quit IRC | 19:15 | |
| *** ayoung has quit IRC | 19:15 | |
| *** _cjones_ has joined #openstack-keystone | 19:15 | |
| morganfainberg | jamielennox, unrelated to Keystone stuff, you convinced me, octopress + github = win | 19:16 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Deprecates catalog substitution from config files https://review.openstack.org/130013 | 19:17 |
| jamielennox_ | morganfainberg: :) - i'd look at pelican as well as my ruby is a bit rusty but yea | 19:17 |
| jamielennox_ | i like doing blogs in vim | 19:17 |
| jamielennox_ | and git | 19:17 |
| morganfainberg | jamielennox, nah, i'm a fan of the git model | 19:17 |
| morganfainberg | jamielennox, or is it jamielennox_ | 19:18 |
| morganfainberg | :P | 19:18 |
| morganfainberg | one of them is an imposter! | 19:18 |
| jamielennox_ | the bouncer i have setup is really unrealiable and laggy, not sure if it's location based or something went wrong | 19:18 |
| ekarlso | jamielennox_: why not just turn allow into a dict ? | 19:19 |
| ekarlso | instead of the 3 diff opts | 19:20 |
| *** _cjones_ has quit IRC | 19:20 | |
| jamielennox_ | ekarlso: you could, i don't know if it's better - it's already in the endpoint_filter dict so it is seperated from the normal options | 19:22 |
| ekarlso | jamielennox_: what you think is best ? | 19:22 |
| jamielennox_ | ekarlso: i'd be inclined to keep the 3 options, the setdefault flow we've got will continue to work that way and we don't need to worry about cloning input dictionaries or anything | 19:23 |
| jamielennox_ | (ie we're not supposed to modify provided dictionaries so we'd have to clone the dict before we made changes to it)( | 19:24 |
| gyee | jamielennox_, can you chime in on https://review.openstack.org/#/c/128786/ whenever you have a chance? | 19:24 |
| gyee | David's trying to add the timing functionality back to Nova since session does not support it | 19:24 |
| jamielennox_ | gyee: ah - how's that going - did he merge the CLI stuff? | 19:24 |
| jamielennox_ | it should be easy to add with a subclass, it's the keyring stuff which will be really hard | 19:25 |
| gyee | jamielennox_, not yet, still working through the nova folks | 19:25 |
| ekarlso | which cli stuff ? | 19:26 |
| *** thedodd has quit IRC | 19:27 | |
| *** thedodd has joined #openstack-keystone | 19:30 | |
| jamielennox_ | gyee: that's taking a while (largely my fault) | 19:30 |
| jamielennox_ | ekarlso: this is trying to convert the nova cli to use all the new plugins and still be compatible with all the old options | 19:31 |
| jamielennox_ | designate shouldn't be too bad there | 19:31 |
| jamielennox_ | and actually i was helping arosen with the congress client before i left - it's really quite pretty when you get to start from scratch | 19:31 |
| jamielennox_ | ^ /cc gyee | 19:32 |
| *** packet has joined #openstack-keystone | 19:33 | |
| *** packet has quit IRC | 19:35 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: PKI and PKIZ tokens unnecessary whitespace removed https://review.openstack.org/120043 | 19:36 |
| jamielennox_ | night all | 19:36 |
| *** jamielennox_ has quit IRC | 19:37 | |
| *** jamielennox has quit IRC | 19:38 | |
| *** gyee has quit IRC | 19:42 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/python-keystoneclient: Endpoint selection logic fix https://review.openstack.org/125923 | 19:42 |
| *** _cjones_ has joined #openstack-keystone | 19:45 | |
| *** amakarov is now known as amakarov_away | 19:46 | |
| *** afaranha has joined #openstack-keystone | 19:48 | |
| *** amcrn has quit IRC | 19:54 | |
| *** boris-42 has quit IRC | 19:59 | |
| *** jistr has quit IRC | 20:01 | |
| *** joesavak has joined #openstack-keystone | 20:03 | |
| *** david-lyle has quit IRC | 20:04 | |
| *** jsavak has quit IRC | 20:06 | |
| *** topol has quit IRC | 20:08 | |
| *** david-lyle has joined #openstack-keystone | 20:15 | |
| *** ayoung has joined #openstack-keystone | 20:16 | |
| *** jamielennox has joined #openstack-keystone | 20:18 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 20:20 | |
| *** meker12 has quit IRC | 20:24 | |
| *** meker12 has joined #openstack-keystone | 20:27 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Use oslo_debug_helper and remove our own version https://review.openstack.org/120104 | 20:28 |
| *** nellysmitt has quit IRC | 20:28 | |
| *** ayoung has quit IRC | 20:30 | |
| *** boris-42 has joined #openstack-keystone | 20:32 | |
| ekarlso | jamielennox: u up still ? :D | 20:34 |
| *** flaviamissi has quit IRC | 20:36 | |
| *** jamielennox has quit IRC | 20:41 | |
| *** ukalifon1 has quit IRC | 20:42 | |
| *** ayoung has joined #openstack-keystone | 20:45 | |
| *** radez is now known as radez_g0n3 | 20:46 | |
| *** ayoung has quit IRC | 20:47 | |
| *** ayoung has joined #openstack-keystone | 20:47 | |
| ekarlso | morganfainberg: you know the change about the new plugins stuff on clients ? | 20:54 |
| morganfainberg | which change? | 20:54 |
| *** gyee has joined #openstack-keystone | 20:55 | |
| *** NM has quit IRC | 20:58 | |
| ekarlso | gyee: you know what changes jamie was talking about wrt novaclient or so and the new plugins ? | 21:01 |
| gyee | ekarlso, its the nove to neutron part | 21:02 |
| gyee | ekarlso, https://review.openstack.org/#/c/113735/ | 21:03 |
| gyee | that patch still need quite a bit of work | 21:03 |
| *** packet has joined #openstack-keystone | 21:15 | |
| *** packet has quit IRC | 21:15 | |
| *** packet has joined #openstack-keystone | 21:15 | |
| *** packet has quit IRC | 21:16 | |
| *** packet has joined #openstack-keystone | 21:16 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Revert "Support service user and project in non-default domain" https://review.openstack.org/129551 | 21:17 |
| *** henrynash has quit IRC | 21:44 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Clean up the comments in CADF everywhere spec https://review.openstack.org/130043 | 21:50 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use correct name of oslo debugger script https://review.openstack.org/130045 | 21:53 |
| *** amcrn has joined #openstack-keystone | 21:54 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystonemiddleware: Use correct name of oslo debugger script https://review.openstack.org/130046 | 21:54 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone-specs: Add blueprint for Authenticated Encryption Tokens https://review.openstack.org/130050 | 22:01 |
| rodrigods | marekd, it worked!!! \o/ | 22:02 |
| rodrigods | stevemar, k2k ^ | 22:03 |
| stevemar | bknudson, question about requirements for oslotest | 22:03 |
| stevemar | rodrigods, holy crap, that's awesome | 22:03 |
| stevemar | rodrigods, give us screen shots, logs, everything! | 22:03 |
| rodrigods | stevemar, ++ blog post with a tutorial as well | 22:03 |
| *** vejdmn has quit IRC | 22:04 | |
| stevemar | bknudson, since it was a minor version change 1.1.0 -> 1.2.0 tox will automatically install 1.2.0, so there isn't really a *need* to udpate it right? | 22:04 |
| bknudson | stevemar: yes, since somebody might use 1.1.0 and it would fail | 22:05 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 22:05 |
| stevemar | bknudson, rm -rf .tox/debug and re-run :P | 22:05 |
| bknudson | stevemar: not everybody is using tox | 22:05 |
| *** gokrokve has quit IRC | 22:05 | |
| stevemar | bknudson, they should be! | 22:05 |
| stevemar | alright, i propose to requirements | 22:06 |
| stevemar | they are just so slow | 22:06 |
| bknudson | stevemar: packagers like us don't use tox. | 22:06 |
| bknudson | since we want to test with the packages that we ship | 22:06 |
| *** gordc has quit IRC | 22:08 | |
| *** bknudson has quit IRC | 22:12 | |
| *** david-lyle has quit IRC | 22:13 | |
| *** david-lyle has joined #openstack-keystone | 22:15 | |
| *** mrmoje has joined #openstack-keystone | 22:17 | |
| *** alee has quit IRC | 22:18 | |
| *** wwriverrat has joined #openstack-keystone | 22:19 | |
| *** wwriverrat2 has joined #openstack-keystone | 22:21 | |
| *** wwriverrat2 has left #openstack-keystone | 22:21 | |
| *** wwriverrat has quit IRC | 22:24 | |
| *** dims_ has joined #openstack-keystone | 22:35 | |
| *** dims_ has quit IRC | 22:36 | |
| *** dims_ has joined #openstack-keystone | 22:36 | |
| *** dims has quit IRC | 22:38 | |
| *** soren has joined #openstack-keystone | 22:45 | |
| *** thedodd has quit IRC | 22:46 | |
| soren | I'm trying to debug a permissions problem in Nova. The policy.json allows a particular operation to users who match "is_admin:True". I'm trying to understand when that might be met. | 22:47 |
| *** mrmoje has quit IRC | 22:47 | |
| soren | As far as I can tell, is_admin is only True when I've authenticated with the special admin token. Is that accurate? | 22:47 |
| *** gokrokve has joined #openstack-keystone | 22:48 | |
| stevemar | soren, i think it's also true when the user has a role of 'admin' | 22:49 |
| soren | stevemar: Is the "admin" role name special? | 22:49 |
| soren | I don't think so. | 22:50 |
| soren | Lots of policy.json rules specify things like: ./etc/policy.json: "admin_required": [["role:admin"], ["is_admin:1"]], | 22:50 |
| soren | If they were equivalent, there'd be no need to specify both? | 22:50 |
| stevemar | soren, oh yeah, you are right, it's admin required that has the role condition | 22:53 |
| stevemar | i think is_admin is only set if using the admin token | 22:53 |
| soren | That's my feeling, too. | 22:55 |
| soren | That's very confusing, though. | 22:56 |
| soren | Nova has a *lot* of operations that are restricted to is_admin:True. | 22:56 |
| stevemar | soren, it's keystone, it wouldn't be right if it wasn't confusing | 22:56 |
| stevemar | soren, sounds like a bug in Nova's default policy then | 22:56 |
| soren | Are people seriously using the admin token for anything other than backdoors to create the initial users? | 22:56 |
| soren | Good grief. | 22:57 |
| morganfainberg | well that wasn't nearly as painful as it could have been. | 22:57 |
| *** joesavak has quit IRC | 23:05 | |
| *** alee has joined #openstack-keystone | 23:07 | |
| *** huats_ has quit IRC | 23:09 | |
| *** _cjones_ has quit IRC | 23:12 | |
| *** _cjones_ has joined #openstack-keystone | 23:12 | |
| *** huats_ has joined #openstack-keystone | 23:12 | |
| *** huats_ has quit IRC | 23:12 | |
| *** huats_ has joined #openstack-keystone | 23:12 | |
| *** _cjones_ has quit IRC | 23:17 | |
| *** _cjones_ has joined #openstack-keystone | 23:22 | |
| *** david-lyle has quit IRC | 23:30 | |
| *** zzzeek has quit IRC | 23:47 | |
| *** NM has joined #openstack-keystone | 23:47 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:52 | |
| *** jamielennox has joined #openstack-keystone | 23:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
