| *** thedodd has quit IRC | 00:02 | |
| *** erkules_ is now known as erkules | 00:06 | |
| *** nellysmitt has joined #openstack-keystone | 00:09 | |
| *** nellysmitt has quit IRC | 00:13 | |
| *** dims has joined #openstack-keystone | 00:22 | |
| *** dims has quit IRC | 00:23 | |
| *** dims has joined #openstack-keystone | 00:28 | |
| *** dims has quit IRC | 00:36 | |
| *** zzzeek has quit IRC | 00:37 | |
| *** rm_work is now known as rm_work|away | 00:43 | |
| *** hichtakk has quit IRC | 00:47 | |
| *** hichtakk has joined #openstack-keystone | 00:48 | |
| *** hichtakk has quit IRC | 00:58 | |
| *** hichtakk has joined #openstack-keystone | 00:58 | |
| *** harlowja has joined #openstack-keystone | 01:01 | |
| *** gyee has quit IRC | 01:12 | |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: support micro version if sent https://review.openstack.org/130916 | 01:17 |
|---|---|---|
| *** hichtakk has quit IRC | 01:18 | |
| *** hichtakk has joined #openstack-keystone | 01:18 | |
| *** jacer_huawei is now known as wanghong | 01:20 | |
| *** dims has joined #openstack-keystone | 01:28 | |
| *** afaranha has joined #openstack-keystone | 01:33 | |
| *** dims has quit IRC | 01:34 | |
| *** raildo_ has joined #openstack-keystone | 01:40 | |
| *** raildo has joined #openstack-keystone | 01:40 | |
| *** diegows has quit IRC | 01:47 | |
| *** mitz_ has quit IRC | 01:48 | |
| *** raildo has quit IRC | 01:48 | |
| *** raildo_ has quit IRC | 01:49 | |
| *** mitz_ has joined #openstack-keystone | 01:49 | |
| *** afaranha has quit IRC | 01:53 | |
| *** harlowja has quit IRC | 01:54 | |
| *** raildo_ has joined #openstack-keystone | 01:59 | |
| ayoung | rodrigods, the graduation package needs to be reviewed | 02:00 |
| *** lhcheng has quit IRC | 02:01 | |
| *** raildo_ has quit IRC | 02:04 | |
| *** stevemar has joined #openstack-keystone | 02:04 | |
| openstackgerrit | Merged openstack/identity-api: Include a link to keystone-specs in the README https://review.openstack.org/143530 | 02:05 |
| *** ChanServ sets mode: +v stevemar | 02:05 | |
| *** nellysmitt has joined #openstack-keystone | 02:10 | |
| *** afaranha has joined #openstack-keystone | 02:10 | |
| *** nellysmitt has quit IRC | 02:14 | |
| *** dims has joined #openstack-keystone | 02:34 | |
| *** dims has quit IRC | 02:39 | |
| *** henrynash has joined #openstack-keystone | 02:43 | |
| *** ChanServ sets mode: +v henrynash | 02:43 | |
| *** hdd has quit IRC | 02:48 | |
| *** erkules_ has joined #openstack-keystone | 02:50 | |
| *** erkules has quit IRC | 02:50 | |
| *** aix has quit IRC | 02:56 | |
| *** afaranha has quit IRC | 02:58 | |
| *** boris-42 has quit IRC | 03:13 | |
| *** LinstatSDR has quit IRC | 03:15 | |
| *** chrisshattuck has joined #openstack-keystone | 03:15 | |
| *** ayoung has quit IRC | 03:23 | |
| *** rm_work|away is now known as rm_work | 03:24 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: multiple signing certificate https://review.openstack.org/123782 | 03:26 |
| *** raildo_ has joined #openstack-keystone | 03:26 | |
| *** lhcheng has joined #openstack-keystone | 03:26 | |
| *** LinstatSDR has joined #openstack-keystone | 03:30 | |
| *** hichtakk has quit IRC | 03:33 | |
| *** hichtakk has joined #openstack-keystone | 03:33 | |
| *** rushiagr_away is now known as rushiagr | 03:41 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow fetching user_id/project_id from auth https://review.openstack.org/118520 | 03:42 |
| *** lhcheng_ has joined #openstack-keystone | 03:43 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Surface the user_id and project_id beyond the plugin https://review.openstack.org/132030 | 03:44 |
| *** lhcheng has quit IRC | 03:45 | |
| *** lhcheng has joined #openstack-keystone | 04:00 | |
| *** lhcheng_ has quit IRC | 04:00 | |
| *** nellysmitt has joined #openstack-keystone | 04:11 | |
| *** nellysmitt has quit IRC | 04:15 | |
| *** hdd has joined #openstack-keystone | 04:27 | |
| *** stevemar has quit IRC | 04:40 | |
| *** stevemar has joined #openstack-keystone | 04:41 | |
| *** ChanServ sets mode: +v stevemar | 04:41 | |
| *** jaosorior has quit IRC | 04:43 | |
| *** hichtakk has quit IRC | 04:51 | |
| *** ajayaa has joined #openstack-keystone | 04:56 | |
| *** hichtakk has joined #openstack-keystone | 05:00 | |
| *** rushiagr is now known as rushiagr_away | 05:02 | |
| *** hichtakk has quit IRC | 05:03 | |
| *** henrynash has quit IRC | 05:17 | |
| *** henrynash has joined #openstack-keystone | 05:17 | |
| *** ChanServ sets mode: +v henrynash | 05:17 | |
| *** rushiagr_away is now known as rushiagr | 05:30 | |
| *** chrisshattuck has quit IRC | 05:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:03 |
| *** chrisshattuck has joined #openstack-keystone | 06:05 | |
| *** chrisshattuck has quit IRC | 06:07 | |
| *** nellysmitt has joined #openstack-keystone | 06:11 | |
| *** raildo_ has quit IRC | 06:15 | |
| *** hichtakk has joined #openstack-keystone | 06:15 | |
| *** nellysmitt has quit IRC | 06:16 | |
| *** stevemar has quit IRC | 06:20 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Auth plugin serialization https://review.openstack.org/113163 | 06:35 |
| *** hdd has quit IRC | 06:36 | |
| *** hdd has joined #openstack-keystone | 06:36 | |
| *** hdd has quit IRC | 06:58 | |
| *** k4n0 has joined #openstack-keystone | 07:07 | |
| *** ajayaa has quit IRC | 07:18 | |
| *** mitz has quit IRC | 07:22 | |
| *** LinstatSDR has quit IRC | 07:24 | |
| *** jamielennox is now known as jamielennox|away | 07:24 | |
| *** jorge_munoz has joined #openstack-keystone | 07:30 | |
| *** ajayaa has joined #openstack-keystone | 07:31 | |
| *** jorge_munoz has quit IRC | 07:34 | |
| *** hichtakk has quit IRC | 07:41 | |
| *** nellysmitt has joined #openstack-keystone | 07:49 | |
| *** EmilienM|afk is now known as EmilienM | 08:02 | |
| *** hichtakk has joined #openstack-keystone | 08:02 | |
| *** hichtakk has quit IRC | 08:23 | |
| *** hichtakk has joined #openstack-keystone | 08:46 | |
| *** abhirc has quit IRC | 08:57 | |
| *** lhcheng has quit IRC | 08:59 | |
| *** hichtakk has quit IRC | 09:17 | |
| *** EmilienM is now known as EmilienM|afk | 10:22 | |
| *** aix has joined #openstack-keystone | 10:32 | |
| *** EmilienM|afk is now known as EmilienM | 11:07 | |
| *** rm_work is now known as rm_work|away | 11:07 | |
| *** diegows has joined #openstack-keystone | 11:18 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone-specs: Alembic for SQL migrations https://review.openstack.org/131531 | 11:43 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone-specs: Alembic for SQL migrations https://review.openstack.org/131531 | 11:50 |
| *** dims has joined #openstack-keystone | 11:56 | |
| *** andreaf has quit IRC | 12:00 | |
| *** andreaf has joined #openstack-keystone | 12:00 | |
| *** henrynash has quit IRC | 12:24 | |
| *** dims has quit IRC | 12:24 | |
| *** jungleboyj has quit IRC | 12:24 | |
| *** jamiec has quit IRC | 12:24 | |
| *** vhoward has quit IRC | 12:24 | |
| *** x58 has quit IRC | 12:24 | |
| *** zhiyan has quit IRC | 12:24 | |
| *** gus has quit IRC | 12:24 | |
| *** quack_quack_ has quit IRC | 12:24 | |
| *** vishy has quit IRC | 12:24 | |
| *** dougwig has quit IRC | 12:24 | |
| *** larsks has quit IRC | 12:24 | |
| *** zigo has quit IRC | 12:24 | |
| *** jamielennox|away has quit IRC | 12:24 | |
| *** rm_work|away has quit IRC | 12:24 | |
| *** toddnni has quit IRC | 12:24 | |
| *** notmyname has quit IRC | 12:24 | |
| *** xianghui has quit IRC | 12:24 | |
| *** gothicmindfood has quit IRC | 12:24 | |
| *** lvh has quit IRC | 12:24 | |
| *** gabriel-bezerra has quit IRC | 12:24 | |
| *** jraim has quit IRC | 12:24 | |
| *** rdo_ has quit IRC | 12:24 | |
| *** andreaf_ has quit IRC | 12:24 | |
| *** samuelms has quit IRC | 12:24 | |
| *** redrobot_away has quit IRC | 12:24 | |
| *** dobson has quit IRC | 12:24 | |
| *** henrynash has joined #openstack-keystone | 12:25 | |
| *** sendak.freenode.net sets mode: +v henrynash | 12:25 | |
| *** dims has joined #openstack-keystone | 12:26 | |
| *** jungleboyj has joined #openstack-keystone | 12:26 | |
| *** jamiec has joined #openstack-keystone | 12:26 | |
| *** vhoward has joined #openstack-keystone | 12:26 | |
| *** x58 has joined #openstack-keystone | 12:26 | |
| *** zhiyan has joined #openstack-keystone | 12:26 | |
| *** gus has joined #openstack-keystone | 12:26 | |
| *** quack_quack_ has joined #openstack-keystone | 12:26 | |
| *** vishy has joined #openstack-keystone | 12:26 | |
| *** dougwig has joined #openstack-keystone | 12:26 | |
| *** larsks has joined #openstack-keystone | 12:26 | |
| *** zigo has joined #openstack-keystone | 12:26 | |
| *** jamielennox|away has joined #openstack-keystone | 12:26 | |
| *** rm_work|away has joined #openstack-keystone | 12:26 | |
| *** sendak.freenode.net sets mode: +v jamielennox|away | 12:26 | |
| *** toddnni has joined #openstack-keystone | 12:26 | |
| *** notmyname has joined #openstack-keystone | 12:26 | |
| *** xianghui has joined #openstack-keystone | 12:26 | |
| *** gothicmindfood has joined #openstack-keystone | 12:26 | |
| *** lvh has joined #openstack-keystone | 12:26 | |
| *** gabriel-bezerra has joined #openstack-keystone | 12:26 | |
| *** jraim has joined #openstack-keystone | 12:26 | |
| *** rdo_ has joined #openstack-keystone | 12:26 | |
| *** andreaf_ has joined #openstack-keystone | 12:26 | |
| *** samuelms has joined #openstack-keystone | 12:26 | |
| *** dims has quit IRC | 12:28 | |
| *** redrobot_away has joined #openstack-keystone | 12:28 | |
| *** dobson has joined #openstack-keystone | 12:28 | |
| *** andreaf has quit IRC | 12:33 | |
| *** andreaf has joined #openstack-keystone | 12:34 | |
| marekd | morganfainberg: i think ayoung was referring to completely authN/authZ model he would like to have in OpenStack. But to me it looks like complete transformation and deservers at least major number of Keystone (if not all services), like Keystone2 :-) | 12:39 |
| marekd | morganfainberg: speaking of the MFA bp I am also not clear on everything Werner wants to accomplish, that's why I had some issues/questions/comments. | 12:40 |
| marekd | morganfainberg: i am not sure if we really want to mix auth plugin 'password' to handle both classic user/pass authentication with 1st stage of MFA ? | 12:41 |
| *** dims has joined #openstack-keystone | 12:51 | |
| *** ayoung has joined #openstack-keystone | 13:41 | |
| *** ChanServ sets mode: +v ayoung | 13:41 | |
| *** amakarov_away is now known as amakarov | 13:47 | |
| amakarov | ayoung, hi! I saw redelegation spec merged, can you please look at the implementation? https://review.openstack.org/#/c/126897/ | 14:10 |
| ayoung | amakarov, was aout 1/5 of the way through it | 14:17 |
| amakarov | ayoung, cool! Tomorrow morganfainberg told me, you have ideas about revocation events rework, may I help somehow? I have an issue with revocation, and it looks weird to me | 14:20 |
| amakarov | ayoung, s/Tomorrow/Yesterday/ | 14:21 |
| amakarov | :) | 14:21 |
| ayoung | amakarov, he lied | 14:21 |
| ayoung | I had considered it, but I like the existing code approachj | 14:21 |
| ayoung | approach | 14:21 |
| ayoung | I have a client patch that needs review | 14:21 |
| ayoung | https://review.openstack.org/#/c/81166/ | 14:22 |
| *** gordc has joined #openstack-keystone | 14:22 | |
| amakarov | ayoung, so speed of tree traversal is enough? | 14:26 |
| ayoung | I think so | 14:26 |
| ayoung | we can look at optimizing it further if we get real performance numbers | 14:26 |
| amakarov | ayoung, I'm worried about AE tokens actually - AFAIK, we'll have to do more calculations and keep an eye on potential bottlenecks :) | 14:29 |
| ayoung | ++ | 14:29 |
| *** jungleboyj has quit IRC | 14:31 | |
| ayoung | amakarov, are you specifically concerend about AE tokens and revocation events? Why? | 14:31 |
| amakarov | ayoung, we have to use UUID until now, because PKI needs certificate sync across nodes in a cluster, and AE gives opportunity to get rid of it along with full catalog in a token | 14:33 |
| amakarov | ayoung, looks very promising | 14:34 |
| *** rushiagr is now known as rushiagr_away | 14:40 | |
| *** radez_g0n3 is now known as radez | 14:44 | |
| rodrigods | where is the AE tokens spec? | 14:46 |
| amakarov | https://review.openstack.org/#/c/130050/ | 14:48 |
| rodrigods | amakarov, thx | 14:49 |
| *** zzzeek has joined #openstack-keystone | 15:08 | |
| *** k4n0 has quit IRC | 15:25 | |
| *** hdd has joined #openstack-keystone | 15:26 | |
| *** nellysmitt has quit IRC | 15:28 | |
| *** dims has quit IRC | 15:30 | |
| *** rushiagr_away is now known as rushiagr | 15:35 | |
| *** ajayaa has quit IRC | 15:38 | |
| *** chrisshattuck has joined #openstack-keystone | 15:39 | |
| *** ajayaa has joined #openstack-keystone | 15:39 | |
| *** henrynash has quit IRC | 15:40 | |
| *** henrynash has joined #openstack-keystone | 15:41 | |
| *** ChanServ sets mode: +v henrynash | 15:41 | |
| *** nellysmitt has joined #openstack-keystone | 15:42 | |
| ayoung | morganfainberg, we meeting today? | 15:56 |
| *** lhcheng has joined #openstack-keystone | 15:58 | |
| openstackgerrit | Merged openstack/keystone: Memcache connection pool excess check https://review.openstack.org/140681 | 16:03 |
| *** lhcheng has quit IRC | 16:03 | |
| *** chrisshattuck has quit IRC | 16:04 | |
| *** chrisshattuck has joined #openstack-keystone | 16:10 | |
| *** jorge_munoz has joined #openstack-keystone | 16:24 | |
| *** dims has joined #openstack-keystone | 16:31 | |
| *** dims has quit IRC | 16:35 | |
| morganfainberg | ayoung: was planning on it | 16:40 |
| morganfainberg | ayoung: but I expect it to be light | 16:40 |
| *** dims has joined #openstack-keystone | 16:41 | |
| *** hdd has quit IRC | 16:46 | |
| morganfainberg | marekd: I was just reading the back scroll, and 2 things - re: Werner and MFA, asking questions is good. I think we're in a weird place for the MFA stuff in general. | 16:49 |
| *** boris-42 has joined #openstack-keystone | 16:50 | |
| morganfainberg | marekd: I'd like to hear more on your concerns about the policy rework. I can say confidently that this cycle we can focus on the centralization first. Anything beyond that is probably unlikely to land in Kilo. But this is also why we have multiple specs for it instead of a "mega spec". | 16:51 |
| *** ajayaa has quit IRC | 16:52 | |
| morganfainberg | Marekd: It means we can ensure the scope of changes is clear - and we can build on it. At the very least regardless of what ayoung is proposing we *cant* break the current model of policy / access / authz / authn. | 16:52 |
| dstanek | chadwick seems to always be so counter productive | 16:52 |
| morganfainberg | Even if a new and better system is made. A Keystone2 is not on the table not is an openstack2 at this time. | 16:53 |
| *** nellysmitt has quit IRC | 16:54 | |
| morganfainberg | marekd: so, let's make sure things are broken up in clear ways and we get the obvious stuff / big win stuff (with less breaking everyone) clearly defined. We can then look at the wilder changes (even next cycle and beyond) and see if they are warranted / needed / the right direction. | 16:54 |
| morganfainberg | dstanek: academia, it often looks that way from the outside in my experience. | 16:55 |
| dstanek | morganfainberg: did you see his ML post? | 16:55 |
| morganfainberg | Not yet. Have a whopping headache so far and just woke up. | 16:56 |
| morganfainberg | dstanek: going to take a look now. | 16:56 |
| dstanek | morganfainberg: i just find it odd that he can't figure out how to get stuff done with people he doesn't control | 16:57 |
| morganfainberg | dstanek: I agree. | 16:57 |
| morganfainberg | Wow. That is a "bug"? | 16:58 |
| morganfainberg | Hmm. I could see it as a bug from a security perspective. Misconfiguration results in valid authn. Hmm | 16:59 |
| *** andreaf has quit IRC | 17:00 | |
| *** andreaf has joined #openstack-keystone | 17:00 | |
| *** jungleboyj has joined #openstack-keystone | 17:01 | |
| ayoung | morganfainberg, I'm working on "every project is a domain" as part of the policy work...wondering if that needs its own spec now, too | 17:05 |
| morganfainberg | Test. | 17:06 |
| morganfainberg | ayoung: what changes from a policy perspective there? | 17:07 |
| ayoung | a couple things | 17:08 |
| ayoung | morganfainberg, the goal is to let horizon get a project scoped token for domain work | 17:08 |
| *** hugokuo has quit IRC | 17:08 | |
| ayoung | so adding a project upon domain create that has the same id as the domain | 17:08 |
| ayoung | no parent, and the domain is the domain for the new "root" project | 17:08 |
| ayoung | it will need a migration | 17:09 |
| ayoung | and then, the fun stuff | 17:09 |
| morganfainberg | ayoung: I thought we were getting rid of the domain table. | 17:09 |
| marekd | morganfainberg: why would you think we are in a strange place for MFA at the moment? | 17:09 |
| marekd | morganfainberg: if we make it an optional change it's good in general (imho). | 17:09 |
| marekd | morganfainberg: i just want to make sure it's done right :-) | 17:09 |
| ayoung | making policy rules for domain operations work on token that is requested based on domain id, but that also has the project data in it | 17:10 |
| ayoung | I think that those tokens would just have both a domain {} section and a project {} section | 17:10 |
| morganfainberg | marekd: not from a technology standpoint from the enforcement standpoint. We are odd because we have a different enforcement model - than most "apps" have. | 17:10 |
| morganfainberg | ayoung: that's what we decided at the summit and seemed like the smallest hurdle | 17:11 |
| marekd | morganfainberg: ok | 17:11 |
| morganfainberg | marekd: I agree it should be optional. My push was for it to be an optional replacement password plugin - that has the logic to handle MFA for MFA enabled cases. | 17:11 |
| ayoung | morganfainberg, I think this is a more reasonable interim step, but we can get rid of the domain table, too | 17:11 |
| openstackgerrit | henry-nash proposed openstack/keystone: My First ABAC: An example alternative assignments engine https://review.openstack.org/143557 | 17:11 |
| ayoung | I don't think that invalidates anything I've said | 17:12 |
| morganfainberg | ayoung: nope. Just was commenting that was the direction I understood us going towards. | 17:12 |
| marekd | morganfainberg: ok | 17:12 |
| morganfainberg | And interim is fine. | 17:12 |
| *** nellysmitt has joined #openstack-keystone | 17:12 | |
| ayoung | morganfainberg, does it need a spec? | 17:12 |
| ayoung | it is is starting maybe to feel like it does | 17:12 |
| morganfainberg | Well 2 things: it could be part of the hmt next steps spec, or does it go into another spec we have proposed? | 17:13 |
| morganfainberg | If anything I think it goes into | 17:13 |
| morganfainberg | Hmt "next steps" (as a gut feeling) | 17:13 |
| marekd | morganfainberg: for the policy rework you wanted me to weigh in. I am guessing you are talking keystone-specs, especially the full dependency chain starting from: https://review.openstack.org/#/c/134657/ ? | 17:14 |
| ayoung | morganfainberg, it certainly is part of the HMT work | 17:14 |
| morganfainberg | marekd: absolutely. The whole chain if you want or you can pick/choose which ones. But if you see a major concern, or minor, I fed want your feedback on it. | 17:15 |
| ayoung | https://review.openstack.org/#/c/135309/ is probably sufficient, then | 17:15 |
| marekd | morganfainberg: sure, i am adding myself as a reviewer. | 17:15 |
| *** hugokuo has joined #openstack-keystone | 17:15 | |
| morganfainberg | ayoung: yeah. I would say they even have it in the commit message there. | 17:15 |
| ayoung | I'll work on updating that | 17:15 |
| morganfainberg | ;) | 17:15 |
| marekd | morganfainberg: i am on holiday now, so not spending days at work, but I will try to take a look at it. | 17:16 |
| morganfainberg | marekd: thanks! Absolutely. Like I said those are still up in the air, the ideas are probably sound. And sure don't work on holiday! | 17:16 |
| ayoung | morganfainberg, was there anything specifically you were worried I was headed towards breaking when you said "At the very least regardless of what ayoung is proposing we *cant* break the current model of policy / access / authz / authn" above? | 17:17 |
| morganfainberg | It can wait until next year - I think we're close enough and I don't see those specs landing yet. | 17:17 |
| morganfainberg | ayoung: nothing in specific. But as a point that the current model can't break. | 17:17 |
| morganfainberg | ayoung: hence why keystone2 and openstack2 was not on the table | 17:18 |
| ayoung | morganfainberg, I've tried to be very careful to provide a step-by-step approach that we can validate at each step. We should not break anything | 17:18 |
| morganfainberg | ayoung: also that we are likely to bridge this work over 2+ cycles | 17:18 |
| ayoung | Oh yeah | 17:18 |
| morganfainberg | ayoung: and you have been good about it. This was a affirmation that we can't and won't break what we have today. | 17:19 |
| morganfainberg | Nothing specific I was worried about. :) | 17:19 |
| ayoung | morganfainberg, I have a request out to David about the Database work for policy. My guess is that he's solving a slighly different problem, so that whole piece will, I suspect be next release, not Kilo | 17:19 |
| ayoung | did we name the L release yet? | 17:19 |
| * ayoung calls it Lima | 17:19 | |
| morganfainberg | Haven't heard about a poll for it yet. | 17:19 |
| morganfainberg | Yeah I saw your email to him. | 17:19 |
| marekd | morganfainberg: also, thanks for adding me to te ADFS CI mail-loop. I am responding now. | 17:20 |
| morganfainberg | Is nkinder out for holidays yet? | 17:20 |
| ayoung | Langley | 17:20 |
| ayoung | He seems to be | 17:20 |
| morganfainberg | Ah | 17:20 |
| ayoung | Nah, Langley is my guess | 17:20 |
| ayoung | https://www.google.com/maps/place/Vancouver,+BC,+Canada/@49.2505911,-123.0288036,10z/data=!4m2!3m1!1s0x548673f143a94fb3:0xbb9196ea9b81f38b | 17:20 |
| morganfainberg | marekd: of course! | 17:20 |
| openstackgerrit | henry-nash proposed openstack/keystone: My First ABAC: An example alternative assignment engine https://review.openstack.org/143557 | 17:21 |
| morganfainberg | ayoung: so, re: Chadwick's latest email - in your opinion is that a bug? | 17:21 |
| ayoung | haven't finished reading it | 17:21 |
| ayoung | loooking | 17:21 |
| ayoung | looks like it, yes | 17:22 |
| morganfainberg | But is there anything we can do about it. Since we don't control the Apache modules? | 17:22 |
| ayoung | morganfainberg, all we should trust from HTTPD is that the authentication is valid, not that it maps to anything in Keystone. We need to confirm that | 17:22 |
| morganfainberg | It's just a bag of attributes passed down. | 17:23 |
| ayoung | I think it should be a Keystone issue, not an HTTPD issue | 17:23 |
| ayoung | we can trust the attributes themselves | 17:23 |
| morganfainberg | Hm. Right but how do we know it's mod_shib or mod\abfab | 17:23 |
| ayoung | we need the protocol to be set. Is it not? | 17:23 |
| morganfainberg | That is the next thing I'm going to look into, I hope it is - but you know how things are in Apache sometimes ;) | 17:24 |
| ayoung | "need the Apache plugins to pass the name of the IDP and the protocol | 17:24 |
| ayoung | being used as environmental parameters to Keystone, and then Keystone | 17:24 |
| ayoung | can check that the ones that it has been configured to trust, are | 17:24 |
| ayoung | actually being used by Apache. | 17:24 |
| ayoung | " | 17:24 |
| ayoung | pretty sure that data is there, but it does depend on the module what gets set | 17:24 |
| morganfainberg | And I was coming to the same conclusion that it is a bug, but maaaay be in some cases hard to fix w/o patches to Apache mods. | 17:25 |
| ayoung | I suspect that we could also do more work at the Apache layer to distinguish between two different Auth Urls and put additional env vars | 17:25 |
| *** nellysmitt has quit IRC | 17:25 | |
| morganfainberg | Yeah. Probably. | 17:25 |
| morganfainberg | Maybe just an env-set at least? | 17:25 |
| ayoung | morganfainberg, yes | 17:25 |
| morganfainberg | This might just be a doc bug "hey do this too" | 17:26 |
| ayoung | morganfainberg, this was one reason I was looking to split off "/auth" as I would like to be able to custmize the plugin used for different auth urls | 17:26 |
| morganfainberg | And then make keystone expect that. Doesn't fix if a module is bad, but it is one extra layer to prevent cross-vhost/auth-url leaking / miss authn | 17:26 |
| ayoung | I havea todo item to loop back around on Federation, but right now we have two other people on our team looking at it from slightly different angles. I was hoping to get some feedback from them before my next foray | 17:27 |
| morganfainberg | Sounds good. | 17:27 |
| ayoung | one is going Shib, the other Ipsilon. | 17:27 |
| ayoung | jdennis is doing the Shib work. He might know how to deal with that issue | 17:28 |
| morganfainberg | Great. | 17:29 |
| *** thedodd has joined #openstack-keystone | 17:29 | |
| ayoung | I'll reply to the list | 17:29 |
| morganfainberg | Ok, I was planning on replying pre-meeting today as well. | 17:29 |
| *** dnalezyt has joined #openstack-keystone | 17:30 | |
| *** dnalezyt has quit IRC | 17:30 | |
| *** dnalezyt has joined #openstack-keystone | 17:31 | |
| morganfainberg | Gonna go get coffee and then meeting time. Like I said I expect this to be a short meeting. | 17:31 |
| morganfainberg | I also expect to cancel next weeks .. For obvious reasons. | 17:31 |
| *** dnalezyt has quit IRC | 17:33 | |
| *** dnalezyt has joined #openstack-keystone | 17:33 | |
| *** openstackgerrit has quit IRC | 17:34 | |
| *** openstackgerrit has joined #openstack-keystone | 17:34 | |
| *** jungleboyj has quit IRC | 17:37 | |
| *** lhcheng has joined #openstack-keystone | 17:40 | |
| *** hichtakk has joined #openstack-keystone | 17:41 | |
| *** jorge_munoz has quit IRC | 17:41 | |
| *** jorge_munoz has joined #openstack-keystone | 17:43 | |
| *** LinstatSDR has joined #openstack-keystone | 17:47 | |
| *** stevemar has joined #openstack-keystone | 17:47 | |
| *** ChanServ sets mode: +v stevemar | 17:47 | |
| *** jorge_munoz has quit IRC | 17:51 | |
| *** zzzeek has quit IRC | 17:56 | |
| *** zzzeek has joined #openstack-keystone | 17:56 | |
| morganfainberg | henrynash: are your items on the meeting agenda new for this week? I thought I cleared it but they look similar - so just checking. | 17:56 |
| *** jorge_munoz has joined #openstack-keystone | 17:58 | |
| *** raildo has joined #openstack-keystone | 17:58 | |
| *** raildo_ has joined #openstack-keystone | 17:58 | |
| morganfainberg | henrynash: meeting? | 18:04 |
| ayoung | henrynash, come to the meeting! | 18:04 |
| ayoung | we miss you! | 18:04 |
| *** henrynash has quit IRC | 18:21 | |
| *** henrynash has joined #openstack-keystone | 18:26 | |
| *** ChanServ sets mode: +v henrynash | 18:26 | |
| ayoung | Oooh, across the Puget from Vancouver is the town of Ladysmith. That is a better L name than Langley | 18:29 |
| *** harlowja has joined #openstack-keystone | 18:35 | |
| *** henrynash has quit IRC | 18:36 | |
| *** andreaf has quit IRC | 18:36 | |
| *** andreaf has joined #openstack-keystone | 18:37 | |
| *** henrynash has joined #openstack-keystone | 18:38 | |
| *** ChanServ sets mode: +v henrynash | 18:38 | |
| *** jungleboyj has joined #openstack-keystone | 18:49 | |
| *** jorge_munoz has quit IRC | 18:59 | |
| ayoung | henrynash, I'm, provided we do it as the two pieces. Does that work for you? DSR is the name, and the role-group is a reusable concept? | 18:59 |
| henrynash | ayoung: so I’m not sure I understand what makes them separate…. | 19:00 |
| henrynash | ayoung: in my domain I need to great a <thingy> which is a set of roles or other <thingys> and I want to call it “myadmin” | 19:01 |
| henrynash | …actually, I want to call it “admin” | 19:01 |
| *** rushiagr is now known as rushiagr_away | 19:02 | |
| amakarov | henrynash, How it's called when an actor plays only one kind of roles? | 19:03 |
| ayoung | henrynash, typecast | 19:03 |
| amakarov | Like Willis always saving the world | 19:03 |
| ayoung | amakarov, typecast | 19:03 |
| amakarov | ayoung, thanks, meybe consider it? | 19:03 |
| ayoung | typecast means something different in software. | 19:04 |
| *** hdd has joined #openstack-keystone | 19:04 | |
| amakarov | ayoung, unfortunately :( | 19:04 |
| *** chrisshattuck has quit IRC | 19:05 | |
| morganfainberg | I like "thingy" and "whoozawutzit" as constructs. | 19:05 |
| amakarov | so, maybe call it "actor" ? | 19:06 |
| amakarov | Actor can have many roles | 19:06 |
| morganfainberg | amakarov: already use that in grant tables. | 19:06 |
| morganfainberg | Not exposed via api, but it's there. | 19:06 |
| amakarov | trouper? ) | 19:07 |
| amakarov | Google says: an actor or other entertainer, typically one with long experience | 19:08 |
| morganfainberg | amakarov, i don't think we can do an odd name like that - it'll be bad UX for those consuming the API | 19:21 |
| ayoung | actor has a role on a target | 19:22 |
| ayoung | and via that role they get a set of permissions | 19:22 |
| amakarov | ok, let's put it this way: an employee receives his access to one room or another according to his: role, position... what else? | 19:24 |
| amakarov | status? | 19:25 |
| amakarov | no, status doesn't go | 19:25 |
| *** nellysmitt has joined #openstack-keystone | 19:26 | |
| *** nellysmitt has quit IRC | 19:30 | |
| amakarov | morganfainberg, "powers" | 19:32 |
| morganfainberg | hm. | 19:41 |
| morganfainberg | dstanek, ayoung, reading david's response. i am inclined to believe that the choice to trust apache is the same as the choice to trust a specific IDP in this case. | 19:42 |
| morganfainberg | dstanek, ayoung, we *could* make it possible to do end-to-end like he's advocating, but that takes a lot of the offload work out of apache (all if it?) | 19:42 |
| morganfainberg | marekd, ^ cc | 19:43 |
| ayoung | morganfainberg, "if Keystone is given the original | 19:44 |
| ayoung | signed SAML assertion " means Keystone then needs to handle each and every protocol. I think we're shooting at the wrong target with that | 19:44 |
| morganfainberg | ayoung, exactly | 19:44 |
| morganfainberg | ayoung, like i said we could. i don't like it | 19:44 |
| ayoung | "mal-configured Apache " | 19:44 |
| * morganfainberg is going to respond. | 19:44 | |
| ayoung | question is how to confirm that we have the right system | 19:44 |
| ayoung | I think, though, that we should be getting more info than he has in that mail | 19:45 |
| morganfainberg | ayoung, yeah that i'll ask - but honestly i think in this case we *cant* know if apache isn't passing that info down. | 19:45 |
| morganfainberg | i would think we should get more info from the SAML assertion down in the env though, right? | 19:45 |
| ayoung | morganfainberg, absence of the variable is also actionable | 19:45 |
| morganfainberg | ayoung, haha, i'm just slow at typing. | 19:45 |
| morganfainberg | ayoung, but yes you and i are on the same page here. | 19:46 |
| ayoung | "SAML implies SHIB which means we need the Shib specific variable" | 19:46 |
| *** amakarov is now known as amakarov_away | 19:46 | |
| ayoung | morganfainberg, OK, I'll come clean....I've been working at becoming a court reporter and am using a chorded keyboard | 19:46 |
| ayoung | :) | 19:46 |
| morganfainberg | LOL | 19:47 |
| ayoung | morganfainberg, actually, my Brother-in-law is going this route. He's up to something like 150 WPM | 19:47 |
| morganfainberg | ideally apache should be passing more information down (unique information about the external IDP, etc) | 19:47 |
| morganfainberg | ayoung, thats crazy! | 19:47 |
| * morganfainberg needs to swap back to the cherry-brown based keyboard, the cherry blue is slowing typing down a lot | 19:48 | |
| ayoung | morganfainberg, mod_mellon does something different than mod_shib, and there was some reason we were favoring it...its been 1+ yeasr since I looked at it, though | 19:48 |
| morganfainberg | ayoung, i think mod_shib was either more modern or more friendly. | 19:48 |
| morganfainberg | though marekd could probably shed specific light on it | 19:48 |
| ayoung | I thought mod_shib was doing something shib specific. I really don't recall the rationale | 19:52 |
| ayoung | morganfainberg, adding domain-is-a-project breaks 27 tests | 19:53 |
| ayoung | well, 30, but I already fixed 3 I think | 19:53 |
| ayoung | they are all of the form MismatchError: 4 != 6 | 19:53 |
| morganfainberg | not bad actually | 19:54 |
| morganfainberg | 4 != 6 just means we're getting the expected differential of projects / domain listings | 19:54 |
| *** raildo has quit IRC | 19:56 | |
| *** raildo_ has quit IRC | 20:01 | |
| *** fifieldt has quit IRC | 20:03 | |
| *** fifieldt has joined #openstack-keystone | 20:16 | |
| ayoung | morganfainberg, I would like to get that somehow reflected in the fixtures, though. I think we are doing project-creates based on the values in there, and we can't add the root project into those lists without making it be explicitly added | 20:19 |
| *** abhirc has joined #openstack-keystone | 20:21 | |
| ayoung | morganfainberg, would it make sense to add the automatically created project to the projects listed in default_fixtures at the end of the load_fixtures call? | 20:25 |
| morganfainberg | hm | 20:26 |
| morganfainberg | probably | 20:26 |
| ayoung | morganfainberg, or...better to copy them to "self" and reference them via self.default_fixtures | 20:26 |
| *** harlowja has quit IRC | 20:44 | |
| *** harlowja has joined #openstack-keystone | 20:48 | |
| *** jorge_munoz has joined #openstack-keystone | 20:49 | |
| *** jorge_munoz has quit IRC | 20:54 | |
| *** jorge_munoz has joined #openstack-keystone | 20:57 | |
| *** EmilienM is now known as EmilienM|afk | 21:04 | |
| *** rm_work|away is now known as rm_work | 21:08 | |
| *** jorge_munoz has quit IRC | 21:09 | |
| *** dnalezyt has quit IRC | 21:16 | |
| *** rm_work is now known as rm_work|away | 21:17 | |
| *** gordc has quit IRC | 21:19 | |
| *** rm_work|away is now known as rm_work | 21:20 | |
| *** thedodd has quit IRC | 21:23 | |
| *** nellysmitt has joined #openstack-keystone | 21:27 | |
| *** nellysmitt has quit IRC | 21:32 | |
| *** flwang1 has joined #openstack-keystone | 21:33 | |
| flwang1 | greetings, i'm trying to add a new role and change the policy.json so that the user can add new user, but i still run into the 403 error, anybody can help? Cheers | 21:33 |
| ayoung | flwang1, write the rule first so that both the old role and new role will work | 21:35 |
| flwang1 | ayoung: sorry, what did you mean "write the role first" ? | 21:37 |
| ayoung | flwang1, I didn't say that | 21:37 |
| ayoung | I said write the "rule" first | 21:38 |
| ayoung | meaning the policy rule | 21:38 |
| flwang1 | ayoung: sorry, typo :) | 21:38 |
| ayoung | you working with the default policy file? | 21:38 |
| flwang1 | yes | 21:38 |
| ayoung | OK ... let me link | 21:38 |
| flwang1 | ayoung: firstly, I created a new role named 'manager' under tenant | 21:39 |
| ayoung | flwang1, http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json#n43 this is the rule you are trying to update, right? | 21:39 |
| ayoung | flwang1, heh, no you didn | 21:39 |
| ayoung | 't | 21:39 |
| ayoung | roles are not under tenants | 21:39 |
| ayoung | roles are global names | 21:39 |
| ayoung | what I think you meant is | 21:39 |
| flwang1 | yep | 21:39 |
| ayoung | you created a new role and assigned that to a user in the corresponding project (tenant) | 21:39 |
| flwang1 | sorry for the confution | 21:39 |
| flwang1 | yes | 21:40 |
| ayoung | No problem, I'm just being precise | 21:40 |
| flwang1 | "identity:create_user": "rule:admin_or_manager", | 21:40 |
| flwang1 | and i updated the rule like above | 21:40 |
| ayoung | don't take it personally, its only meant to keep clear what I am telling you to do | 21:40 |
| ayoung | or what does "rule:admin_or_manager", look like? | 21:40 |
| flwang1 | restart the the apache2 service | 21:40 |
| flwang1 | listening... | 21:41 |
| ayoung | flwang1, what does "rule:admin_or_manager", look like? | 21:42 |
| flwang1 | "admin_or_manager": "rule: admin_required or role:manager", | 21:42 |
| ayoung | yeah, that is bad | 21:43 |
| flwang1 | cool, what's the problem? | 21:43 |
| ayoung | that means that if you have the role manager anywhere | 21:43 |
| ayoung | you can add to any project | 21:43 |
| ayoung | which, I'm guessing is not what you want | 21:43 |
| ayoung | flwang1, you need to ensure the project id matches | 21:44 |
| flwang1 | yep, I hope the user with manager role can only add new user to the tenant which the manager belongs | 21:44 |
| flwang1 | does that make sense? | 21:44 |
| flwang1 | but even i set the OS_TENANT in env, i still got the 403 error | 21:45 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n85 | 21:45 |
| ayoung | flwang1, I think you want something that looks like this rule | 21:45 |
| flwang1 | i agree, but seems it's the next step, right? | 21:46 |
| ayoung | but...you want an OR between the admin_required and the portion specific | 21:46 |
| ayoung | so | 21:46 |
| flwang1 | for now, even for the same tenant, I still failed | 21:46 |
| ayoung | say you have a rule project_manager | 21:46 |
| ayoung | it would be | 21:46 |
| ayoung | "project_manager": "role:manager and project_id:%(project_id)s", | 21:47 |
| ayoung | then you could do | 21:47 |
| ayoung | "admin_or_manager": "rule: admin_required or rule:project_manager", | 21:47 |
| flwang1 | is that only supported by v3? | 21:47 |
| ayoung | nope | 21:47 |
| ayoung | that should work v2 | 21:47 |
| flwang1 | awesome | 21:47 |
| flwang1 | adding... but did you notice my above concern? | 21:47 |
| flwang1 | or you believe this can fix my above concern? | 21:48 |
| ayoung | Oh, one other thing | 21:48 |
| ayoung | create_user is not what you want | 21:48 |
| ayoung | that creates a new user record | 21:48 |
| ayoung | those are not under projects/tenants | 21:48 |
| *** EmilienM|afk is now known as EmilienM | 21:48 | |
| ayoung | all you can do at the project level is assign a role to that user | 21:48 |
| ayoung | does this completely mess you up? | 21:49 |
| flwang1 | ayoung: but you understand what I want to do, right? | 21:49 |
| ayoung | not 100% no | 21:49 |
| ayoung | flwang1, if you want to create a new user, that is different from adding a user to a project | 21:49 |
| ayoung | which do you want to do? | 21:49 |
| flwang1 | ayoung: as a public cloud provider, i just create a tennat for my customer | 21:49 |
| ayoung | OK | 21:50 |
| flwang1 | and one user for their admin/manager | 21:50 |
| ayoung | go on | 21:50 |
| flwang1 | and then we would like to see the admin/manager can add more user by themselves instead of calling us :) | 21:50 |
| *** dims has quit IRC | 21:51 | |
| flwang1 | BTW, i'm really happy to see the HMT landed in | 21:51 |
| flwang1 | that's another requirement from our customer | 21:51 |
| flwang1 | back to the adding user question now | 21:52 |
| flwang1 | so i'm thinking if we can workaround something so that the admin/manager of the tenant can get the permission to do that | 21:52 |
| flwang1 | i'm making it more clear or mess? :) | 21:53 |
| ayoung | flwang1, adding a user is a global operation, not per tenant | 21:56 |
| *** dims has joined #openstack-keystone | 21:56 | |
| ayoung | so if you want to just create a new role for that, then you want | 21:56 |
| flwang1 | ayoung: yep, i understand | 21:56 |
| ayoung | "admin_or_manager": "rule: admin_required or role:manager" like you have. If that is not working ,then it is a debugging problem | 21:56 |
| flwang1 | ayoung: so you mean my way should be workable, is it? | 21:57 |
| flwang1 | and after that, I may need assign the user to the specific tenant, right? | 21:57 |
| ayoung | flwang1, just creating a new role for create users? Yes, what you have should do that | 21:57 |
| flwang1 | ayoung: so maybe there is a bug for the policy, is it? | 21:58 |
| ayoung | flwang1, I'd suspect your set up first | 21:58 |
| flwang1 | or it would be nice if you can help recreate it to confirm | 21:58 |
| flwang1 | ;( | 21:58 |
| flwang1 | it's a fresh devstack | 21:59 |
| ayoung | my guess is that you have something wrong. Either policy file or user is not what you think it is | 21:59 |
| ayoung | my guess would be that the user token doesn't have theright role in it | 21:59 |
| flwang1 | ayoung: okay | 22:00 |
| flwang1 | ayoung: FWIW, the way I'm trying is correct, is it? | 22:00 |
| ayoung | flwang1, looks like it is to me | 22:00 |
| flwang1 | ayoung: thanks a lot and merry Xmas | 22:01 |
| flwang1 | ayoung: i will debug it and bug you after the holiday :) | 22:01 |
| ayoung | Joy to the World. | 22:01 |
| *** harlowja_ has joined #openstack-keystone | 22:01 | |
| *** LinstatSDR has quit IRC | 22:02 | |
| *** erkules_ is now known as erkules | 22:02 | |
| *** harlowja has quit IRC | 22:02 | |
| *** jamielennox|away is now known as jamielennox | 22:03 | |
| dstanek | morganfainberg: ayoung: i agree with your earlier conversation - we chose architecturally to trust the Apache plugin | 22:07 |
| *** dims has quit IRC | 22:11 | |
| *** esmute has quit IRC | 22:17 | |
| *** gothicmindfood has quit IRC | 22:18 | |
| ayoung | dstanek, if I automatically create a project (with same id as the domain) when I create a domain, should I automatically delete it when I delete the domain and prevent a deliberate deletion of that project? | 22:21 |
| ayoung | actually...deleting the domain should already delete the project...hmmm | 22:23 |
| *** harlowja_ has quit IRC | 22:31 | |
| *** harlowja has joined #openstack-keystone | 22:31 | |
| *** flwang1 has quit IRC | 22:35 | |
| *** samuelms_ has joined #openstack-keystone | 22:41 | |
| samuelms_ | henrynash, ping | 22:41 |
| *** diegows has quit IRC | 22:42 | |
| *** hdd has quit IRC | 22:43 | |
| *** esmute has joined #openstack-keystone | 22:46 | |
| *** gothicmindfood has joined #openstack-keystone | 22:47 | |
| *** dims has joined #openstack-keystone | 23:12 | |
| *** hichtakk has quit IRC | 23:12 | |
| *** harlowja has quit IRC | 23:12 | |
| *** hichtakk has joined #openstack-keystone | 23:12 | |
| *** radez is now known as radez_g0n3 | 23:13 | |
| *** rm_work is now known as rm_work|away | 23:16 | |
| *** dims has quit IRC | 23:16 | |
| *** harlowja has joined #openstack-keystone | 23:20 | |
| *** jamielennox is now known as jamielennox|away | 23:24 | |
| *** nellysmitt has joined #openstack-keystone | 23:28 | |
| *** nellysmitt has quit IRC | 23:32 | |
| *** LinstatSDR has joined #openstack-keystone | 23:35 | |
| *** hichtakk has quit IRC | 23:47 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!