| *** obedmr has quit IRC | 00:14 | |
| lhcheng | lbragstad: how does keytonemiddleware validate the fernet token? Looking for the commit where that is added. | 00:21 |
|---|---|---|
| jamielennox | lhcheng: fernet tokens are validated just the same as a UUID token | 00:21 |
| bknudson | there's nothing in auth_token middleware for fernet tokens... | 00:23 |
| bknudson | luckily they don't start with MII | 00:23 |
| morganfainberg | there shouldnt be anything specific in auth_token for fernet (except if we add revocation event support) | 00:24 |
| bknudson | how would auth_token even know it was a fernet token? | 00:24 |
| lhcheng | jamielennox: UUID token is looked up in the DB while fernet should not, wondering how would middleware validate the fernet token | 00:24 |
| morganfainberg | bknudson, wouldn't matter, revocation event support is universal benegit | 00:24 |
| morganfainberg | benefit* | 00:24 |
| bknudson | lhcheng: auth_token doesn't do lookup in the DB. | 00:25 |
| morganfainberg | that could be considered something for fernet tokens that we finished for them. | 00:25 |
| jamielennox | lhcheng: that's a server side problem, as far as auth_token is concerned it can't validate it locally and it just asks keystone to do it | 00:25 |
| morganfainberg | lhcheng, keystone rebuilds the token when it validates a fernet token | 00:25 |
| morganfainberg | lhcheng, vs. where uuid does the lookup | 00:25 |
| morganfainberg | lhcheng, to the DB. middleware doesn't care if it's uuid or fernet or anything (except PKI) | 00:26 |
| lhcheng | bknudson: oops I mean middleware have to make a keystone call to validate if the UUID is in the DB | 00:26 |
| bknudson | middleware make a keystone call to validate fernet tokens, too. | 00:26 |
| lhcheng | bknudson: ah! | 00:27 |
| lhcheng | that's what I am missing | 00:27 |
| bknudson | there's no new code in auth_token since that's the default behavior. | 00:28 |
| bknudson | any token that doesn't start with MII gets sent to the server. | 00:28 |
| lhcheng | bknudson: cool, I get the big picture now | 00:28 |
| lhcheng | during the initial fernet spec, I thought the non-persistent token validation would be done in middleware | 00:30 |
| lhcheng | but I guess the user info still needs to be fetch from the db | 00:30 |
| *** htruta has joined #openstack-keystone | 00:31 | |
| bknudson | I thought there might be something that could be done in middleware, too. | 00:31 |
| jamielennox | fernet tokens are essentially the same as a signed cookie in the web world, still need to get back to the server for unpacking | 00:32 |
| bknudson | y, but if you can tell it's wrong just by looking at it then no need to bother the server. | 00:33 |
| lhcheng | can't it be unpacked/validated on the middleware? that would reduce the load on keystone | 00:34 |
| morganfainberg | lhcheng, there isn't enough data in the token to know all the token body info | 00:34 |
| morganfainberg | lhcheng, PKI can, but PKI tokens are HUGE | 00:34 |
| bknudson | you could validate something if you had the key. | 00:34 |
| jamielennox | that would be signed & hashed, but you would get into key distribution | 00:35 |
| lhcheng | jamielennox: so it is more of key distribution the reason why we don't want to validate in the middleware? | 00:35 |
| jamielennox | lhcheng: what you're asking for with middleware validation is PKI tokens, even if we unpacked a fernet token on the middleware all we could validate would be the expiry time | 00:36 |
| jamielennox | you would still need to ask keystone for everything else | 00:36 |
| lhcheng | morganfainberg: yeah, I understand that after unpacking it still need to fetch some data in the backend. we really can't get away not going back to keystone. but just thinking the middleware can do some pre-filtering of valid tokens | 00:37 |
| morganfainberg | lhcheng, well you can't know if the token is valid unless you validate the HMAC signature | 00:38 |
| morganfainberg | lhcheng, we don't trust an endpoint with the fernet key (this is symmetrical crypto) | 00:38 |
| morganfainberg | lhcheng, because then the endpoint could issue tokens. keystone doesn't want that to happen | 00:39 |
| morganfainberg | lhcheng, so the only option is: ask keystone if it's valid | 00:39 |
| jamielennox | lhcheng: the security issues that come with validating enough to read the expiry issue don't make it worth it to only check expiry, the cache will remember expiry for future so it'll only be one call | 00:39 |
| jamielennox | morganfainberg: i haven't actually looked at the implementation is it GCM or some sort of hmac as well? | 00:39 |
| morganfainberg | jamielennox, HMAC(Creation_time, AES(Payload)) | 00:39 |
| morganfainberg | jamielennox, afaik | 00:40 |
| morganfainberg | and the fernet-key is 2 keys, one for signing, one for AES | 00:40 |
| lhcheng | morganfainberg: good point. yeah, we don't want the keys on the endpoint. security won't be happy. | 00:40 |
| lhcheng | jamielennox: I see, we don't really get much improvement then. | 00:41 |
| morganfainberg | lhcheng, not storing the token in SQL/Memcache/Redis > performance of end-point validation | 00:41 |
| morganfainberg | lhcheng, we can crank caches up to avoid issues with heavy DB calls. we can't really deal with ~1MM-100MM tokens in active storage. | 00:42 |
| morganfainberg | lhcheng, or more. | 00:42 |
| lhcheng | morganfainberg: when I generated the fernet key in fernet-keys directory, there is a 0 and 1 file | 00:42 |
| lhcheng | which one is used for signing and encrypyting? | 00:42 |
| morganfainberg | lhcheng, i think 0 is staging and 1 is active. 2 would be rotated but not removed | 00:43 |
| morganfainberg | lhcheng, i *think* | 00:43 |
| morganfainberg | lhcheng, i'd need to go re-look at the implementation for that | 00:43 |
| bknudson | the key is split into 2 parts. | 00:43 |
| lhcheng | bknudson: so one file actually contain two keys? | 00:43 |
| morganfainberg | lhcheng, yes. | 00:44 |
| morganfainberg | lhcheng, one for the HMAC signing, one for the AES encryption of the payload | 00:44 |
| bknudson | it's 1 long string that's 2 parts. | 00:44 |
| *** diegows has joined #openstack-keystone | 00:44 | |
| bknudson | this is documented in the fernet spec. | 00:44 |
| lhcheng | ah, have to re-read the spec again | 00:46 |
| lhcheng | bknudson: thanks | 00:46 |
| lhcheng | I think I got all my questions answered. thanks morganfainberg bknudson jamielennox ! | 00:48 |
| lhcheng | will test it out more in a bit | 00:50 |
| *** devlaps has joined #openstack-keystone | 00:50 | |
| *** lhcheng is now known as lhcheng_afk | 00:50 | |
| dstanek | bknudson: is it possible to get an attribute error on https://review.openstack.org/#/c/163322/10/keystone/identity/core.py ? | 00:54 |
| bknudson | dstanek: could get a KeyError since it's a dict. | 00:55 |
| bknudson | that codepath isn't tested. | 00:56 |
| dstanek | yeah, that's what i put in a review comment | 00:57 |
| dstanek | not about the testing, but about the exception type | 00:57 |
| dstanek | i'm assuming that we want to fix that before merging | 00:58 |
| bknudson | might as well | 00:58 |
| bknudson | this approach seems to have bigger problems. | 00:58 |
| dstanek | bknudson: like what? | 01:02 |
| dstanek | i haven't thought through all of the boolean logic yet | 01:03 |
| morganfainberg | dstanek, cached configs + reload across processes for 1 | 01:03 |
| bknudson | dstanek: if there's an update in 1 thread and a read in another thread they'll pick up random values | 01:03 |
| bknudson | each config option is written in a separate transaction | 01:03 |
| morganfainberg | bknudson, we should be able to figure a way to bundle config updates together. | 01:04 |
| bknudson | y, it would actually be easier. | 01:04 |
| bknudson | for some reason the code was written to be as complicated as possible. | 01:04 |
| dstanek | job security | 01:07 |
| bknudson | dstanek: don't even joke about that ... I've seen it work | 01:08 |
| dstanek | would differences across processes be a big deal? seem no different than multiple keystone instance | 01:08 |
| morganfainberg | dstanek, it could | 01:08 |
| morganfainberg | esp. if values such as "password" and "connect string" changed independently | 01:08 |
| bknudson | I just don't like random behavior | 01:09 |
| morganfainberg | dstanek, it should be possible to bundle the update into a single transaction that guarantees atomicity for a bigger update than a single element | 01:09 |
| dstanek | if we got inconsistent reads within greenlets because only half the data is loaded...well there would be some unreproducible and undebuggable bug reports | 01:09 |
| morganfainberg | dstanek, yes. | 01:09 |
| bknudson | I like unreproducable. | 01:09 |
| bknudson | close it. | 01:09 |
| morganfainberg | bknudson, lol | 01:09 |
| dstanek | lol | 01:09 |
| morganfainberg | dstanek, i think the right answer is also to force a cache reload on a fixed window for this type of stuff. Aka "cache for X seconds on a mod 30" or something like that, so any/all processes would pickup the change at the same time | 01:10 |
| morganfainberg | dstanek, rather than typical "Cache for X seconds" where X starts at "whenever" x was first read | 01:10 |
| dstanek | one problem i ran into at my previous employer was when we have config values and depended on each other. we would reload a config and if you hit the wrong time you would get inconsistent results. | 01:12 |
| morganfainberg | dstanek, yeah. thats exactly this problem | 01:12 |
| dstanek | that was not fun to figure out | 01:12 |
| bknudson | dstanek: how did you fix it? | 01:12 |
| morganfainberg | i think we can solve it by allowing the config to be uploaded and/or all options to be updated in a single transaction. | 01:13 |
| openstackgerrit | Merged openstack/oslo.policy: Avoid reloading policy files in policy.d for every call https://review.openstack.org/169535 | 01:13 |
| morganfainberg | if someone changes each option individually, we can't stop them from breaking things | 01:13 |
| bknudson | the database provides a distributed lock. | 01:13 |
| morganfainberg | but we can make it so that the options are sane. | 01:13 |
| *** harlowja is now known as harlowja_away | 01:14 | |
| bknudson | I'm going to use mongodb for my configs. | 01:14 |
| morganfainberg | and then for caching we just do some math to ensure all options are reloaded on the same window for all processes/threads/greenlets/whatever | 01:14 |
| bknudson | webscale | 01:14 |
| dstanek | does this review need to get in for K? | 01:14 |
| dstanek | bknudson: yup | 01:14 |
| morganfainberg | bknudson, i... i'll give you a pass cause it's april 1 and you've been dealing with clippy | 01:14 |
| morganfainberg | bknudson, :) | 01:14 |
| morganfainberg | dstanek, we can bounce this out. the API is already experimental. | 01:14 |
| morganfainberg | dstanek, it means a keystone restart is still needed to pickup changes, but that at least is a known quantity | 01:15 |
| morganfainberg | dstanek, vs. random behavior | 01:15 |
| bknudson | the whole feature is experimental | 01:15 |
| morganfainberg | bknudson, yes | 01:15 |
| bknudson | so I'm not going to get too hung up on it | 01:16 |
| bknudson | as long as users know what they're getting in to | 01:16 |
| morganfainberg | this will need some cleanup in L | 01:16 |
| morganfainberg | actually probably a lot of cleanup. | 01:16 |
| *** stevemar has joined #openstack-keystone | 01:16 | |
| *** ChanServ sets mode: +v stevemar | 01:16 | |
| dstanek | we actually decided that controlled restarts where better anyway - we made sure the config could vary across nodes and just bounced them | 01:16 |
| bknudson | hopefully we can get some functional tests for it. | 01:16 |
| dstanek | take X at a time out of the LB and restart. easy peasy | 01:17 |
| dstanek | also yesterday i decided to take thurs and fri off to take the kids on a road trip to NC so i won't be around much during the day | 01:19 |
| bknudson | spring break! | 01:19 |
| *** mattfarina has joined #openstack-keystone | 01:19 | |
| bknudson | you can see topol | 01:20 |
| *** edmondsw has quit IRC | 01:20 | |
| morganfainberg | dstanek, i think it might be sanest to not do automatic reloads of this feature to start. | 01:20 |
| morganfainberg | we can poke henrynash about that - it at least keeps behavior consistent vs. wildly inconsistent | 01:21 |
| *** _cjones_ has quit IRC | 01:21 | |
| morganfainberg | but i'm not going to get too crazy since we know it has issues we have said it's experimental and we can fix in L | 01:21 |
| morganfainberg | or work on fixing in L | 01:21 |
| morganfainberg | bknudson, actually even now we might end up with wierd issues.. since mod_wsgi will startup new workers at random times.. it might mean a worker is broken for it's lifespan | 01:22 |
| morganfainberg | bknudson, ick :( | 01:22 |
| bknudson | it would have to be a short lifespan... what's the cache timeout? | 01:24 |
| morganfainberg | looks ocnfigurable, but checking | 01:25 |
| bknudson | I assume caching is turned off by default. | 01:26 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L1244 | 01:26 |
| morganfainberg | uses the @memoize decorator mechanism | 01:26 |
| morganfainberg | so yeah | 01:26 |
| morganfainberg | it'll be off by default meaning we reload *every* request. | 01:27 |
| bknudson | needs a big warning. | 01:27 |
| stevemar | dstanek, and topol hanging out in NC | 01:30 |
| bknudson | what's NC famous for... basketball? they'll play bball. | 01:31 |
| *** mattfarina has quit IRC | 01:31 | |
| bknudson | and eat bbq | 01:31 |
| bknudson | we could have the mid-cycle there sometime. | 01:32 |
| openstackgerrit | Merged openstack/python-keystoneclient: Add support to create SAML assertion based on a token https://review.openstack.org/159022 | 01:32 |
| bknudson | I hear they're going to have the nova midcycle here in rochester | 01:32 |
| bknudson | a little angry bird told me. | 01:32 |
| *** tqtran is now known as tqtran_afk | 01:35 | |
| dstanek | bknudson: that would be a nice little road trip for me. i'd love to see how they do it | 01:40 |
| openstackgerrit | Merged openstack/python-keystoneclient: Add support to create ECP assertion based on a token https://review.openstack.org/168678 | 01:44 |
| *** erkules has quit IRC | 01:49 | |
| *** erkules_ has joined #openstack-keystone | 01:50 | |
| *** dims_ has joined #openstack-keystone | 01:52 | |
| ayoung | https://review.openstack.org/#/c/163322/10/keystone/identity/core.py,cm morganfainberg shouldn;t we say that we only support LDAP, as opposed to saying we don;'t support LDAP? We really don;t want a dogpile based driver there either, do we? | 01:56 |
| morganfainberg | ayoung, a dogpile based driver should be fine if someone wanted it | 01:57 |
| morganfainberg | ayoung, the issue with SQL is shared connection strings etc | 01:57 |
| morganfainberg | ayoung, iirc | 01:57 |
| ayoung | "should be" is one thing, but shouldn't we minimize scope on this | 01:57 |
| ayoung | do we need it for anything other than LDAP? | 01:57 |
| openstackgerrit | Merged openstack/python-keystoneclient: Don't autodoc the test suite https://review.openstack.org/162525 | 01:58 |
| morganfainberg | ayoung, i am fine with it being LDAP only to start. | 01:59 |
| ayoung | I would like to revisit the "externalize SQL configs" at the L summit. | 01:59 |
| ayoung | Especailly since they have passwords in them | 01:59 |
| morganfainberg | sure | 02:03 |
| *** dims_ has quit IRC | 02:03 | |
| *** dims_ has joined #openstack-keystone | 02:04 | |
| *** dims_ has quit IRC | 02:08 | |
| ayoung | morganfainberg, I think, though, that I am going to stay out of that review unless there is something seriously wrong. It looks good at a first approx. | 02:09 |
| ayoung | jamielennox, I wonder if there is a hack to make Apache HTTPD respond on a domain socket? | 02:19 |
| jamielennox | httpd on a socket? why | 02:20 |
| ayoung | jamielennox, your proxy idea...for an all in one deployment | 02:20 |
| ayoung | Nova talks to Keystone via domain socket | 02:20 |
| jamielennox | why would we put that on apache? | 02:20 |
| ayoung | Cuz we still need to expose Keystone as an API | 02:20 |
| jamielennox | wait you want to talk to the PEP or you want to talk to keystone over the socket | 02:21 |
| ayoung | jamielennox, any of the nova calls that would have to go to Keystone such as local token validations, fetching policy ,etc | 02:21 |
| *** lhcheng_afk has quit IRC | 02:22 | |
| ayoung | bascially, the degenerate case: all in one, make the code the same as it would be for a remote TCP based call | 02:22 |
| jamielennox | ayoung: i wasn't thinking of this as a generic proxy object, i was thinking you'd configure auth token with these | 02:22 |
| jamielennox | i don't think there's much point in putting HTTP between these points | 02:23 |
| ayoung | jamielennox, you should know by now that you have tobe careful when you set me off thinking | 02:23 |
| jamielennox | there are only some things i think it is worth proxying and i think that the way you query it would be different | 02:24 |
| openstackgerrit | Merged openstack/keystone: Remove unnecessary .driver. references in assignment manager https://review.openstack.org/169186 | 02:24 |
| openstackgerrit | Merged openstack/keystone: Fix for migration 062 on MySQL https://review.openstack.org/168003 | 02:24 |
| jamielennox | for example policy, you'd ask a yes or no question | 02:24 |
| openstackgerrit | Merged openstack/keystone: More content in the guide for core components' migration https://review.openstack.org/164188 | 02:24 |
| jamielennox | the advantage of http/httpd in general here is some marshalling and auth, and i don't think you should need to auth to the PEP | 02:25 |
| openstackgerrit | Merged openstack/keystone: Correcting the name of directory holding dev docs https://review.openstack.org/169601 | 02:26 |
| lbragstad | bknudson: dolphm was working on a keyless fernet thing to determine if a fernet token was valid or not without decrypting it | 02:35 |
| ayoung | jamielennox, I'm not disagreeing...lets take the policy examples. If We set it up to do from an all in one...we'd need the same interface for a non-all in one, HTTP or not. In the Not HTTP case, we can skip all of the auth stacges. I suspect that we could talk wsgi direct to the python code, and skip all the HTTPD setup, and probably a good chunk of the middleware | 02:41 |
| *** darrenc is now known as darrenc_afk | 02:42 | |
| jamielennox | ayoung: it sounds like you're talking about starting with the existing keystone code and replacing backends | 02:44 |
| morganfainberg | ayoung, docker | 02:45 |
| morganfainberg | ayoung, >.> | 02:45 |
| morganfainberg | ayoung, isolate keystone and other competing services in the "all-in-one" case. | 02:46 |
| morganfainberg | make it look like production-like | 02:46 |
| ayoung | jamielennox, nah, I want to start with the routers | 02:46 |
| ayoung | morganfainberg, explain? | 02:46 |
| morganfainberg | ayoung, containers, give ips to the containers, keystone, ipa, etc all talk TCP, single "real" host, but virtualized | 02:47 |
| morganfainberg | i wouldn't try and make things talk on domain sockets for the all-in-one | 02:47 |
| ayoung | morganfainberg, kindof the opposite of what I was thinking | 02:47 |
| morganfainberg | ayoung, i know. | 02:48 |
| ayoung | for the all in once case, we can put everytjhing in one HTTPD server ,just trying to lighten the touch for things that need to be served from Keystone | 02:48 |
| ayoung | and make the non-all-in-one case just have performance for thos calls...and then look at a proxy on the remote server to deal with performance | 02:49 |
| jamielennox | ayoung: i don't think we want to replicate anything like the full keystone routers space | 02:50 |
| * morganfainberg glares at corporate travel website. | 02:50 | |
| ayoung | jamielennox, but it wouldn;'t be replcated...I think. What if we could talk WSGI directy to the opython code from Keystone client....call it local mode | 02:51 |
| jamielennox | i was thinking like dbus for communication to the PEP | 02:51 |
| ayoung | dbus is still text | 02:51 |
| jamielennox | yep | 02:51 |
| ayoung | so, put the json on dbus | 02:52 |
| *** rushiagr_away is now known as rushiagr | 02:52 | |
| ayoung | you'd still want to hit the router. | 02:52 |
| jamielennox | do you have a dependency on glib for dbus? | 02:52 |
| ayoung | I don't know... | 02:53 |
| ayoung | Its a socket, so, lets assume we can work around it if we do | 02:53 |
| ayoung | jamielennox, sssd-dbus does not depend on glib | 02:55 |
| jamielennox | anyway, doesn't matter, i just mean i don't think for speed reasons you would want to have accesscontrol between the pep and auth_token | 02:55 |
| ayoung | dbus python does require glib | 02:55 |
| ayoung | jamielennox, these kind of use cases are what we have Message Queueing for | 02:56 |
| ayoung | so maybe that is the answer? | 02:56 |
| jamielennox | ayoung: i don't want this stuff on an rpc bus either | 02:56 |
| jamielennox | also the point is local | 02:56 |
| ayoung | Any service that needs to query Keystone has to go via AMQP, but that can be a local socket | 02:57 |
| jamielennox | we could speed things up today if we were able to talk to keystone over rpc | 02:57 |
| ayoung | I still think policy should be enforced by the process in the webserver, not by asking keystone about it. That is just one case, though. And we'd still need a way to query policiy, cache it, and ask for updates, as well as get notified of updates. | 02:59 |
| *** darrenc_afk is now known as darrenc | 02:59 | |
| jamielennox | ayoung: the rejection needs to happen in the web server obviously, it's about somewhere that can be on the bus and store all the state and handle queries | 03:04 |
| morganfainberg | hmm | 03:06 |
| morganfainberg | looks like to get to DC i need to fly through MSP | 03:06 |
| *** htruta has quit IRC | 03:12 | |
| *** spandhe has quit IRC | 03:12 | |
| *** spandhe has joined #openstack-keystone | 03:12 | |
| *** spandhe has quit IRC | 03:13 | |
| *** rushiagr is now known as rushiagr_away | 03:13 | |
| *** htruta has joined #openstack-keystone | 03:15 | |
| morganfainberg | bknudson, how is MSP as a layover airport? | 03:15 |
| *** htruta has quit IRC | 03:24 | |
| *** lhcheng_afk has joined #openstack-keystone | 03:30 | |
| *** rm_work|away is now known as rm_work | 03:31 | |
| *** h_m has quit IRC | 03:31 | |
| *** samueldmq has quit IRC | 03:36 | |
| morganfainberg | ayoung, mod_openstack_auth? | 03:37 |
| ayoung | morganfainberg, welll, no. Not the way I was suggesting it. But...as a standalone thing, it has some promise... | 03:38 |
| ayoung | I could see the argument for taking most of auth_token middleware and doing it in C as a module for performance and deployment reasons, and also that it would work for other languages | 03:39 |
| ayoung | stack it behind Mod mellon, then have the mod_o_a do all of the local authorization work aftert that: fetch the mapping, policy check... | 03:40 |
| ayoung | morganfainberg, if the APIs had the project_id in the request, we could do policy without fetch objects, and then have a later check that just ensured the objects project_id matched the one sent in the request | 03:40 |
| ayoung | hmmmm | 03:41 |
| ayoung | maybe we should split that up... | 03:41 |
| *** h_m has joined #openstack-keystone | 03:43 | |
| *** jamielennox is now known as jamielennox|away | 03:51 | |
| lhcheng_afk | morganfainberg: fernet tokens have some issue with horizon, the problem is on the django_openstack_auth side | 03:52 |
| *** lhcheng_afk is now known as lhcheng | 03:52 | |
| lhcheng | morganfainberg: due to the token hashing done in : https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/user.py#L82 | 03:52 |
| morganfainberg | lhcheng, makes sense | 03:52 |
| morganfainberg | the hashing is naive | 03:52 |
| morganfainberg | we need to fix it | 03:53 |
| lhcheng | morganfainberg: yeah, the hash so happens matches the id in the cache. so it just works by chance :( | 03:53 |
| morganfainberg | well no | 03:53 |
| lhcheng | morganfainberg: yeah, I'll look at that in L | 03:53 |
| morganfainberg | the hash is looking for PKI tokens and knows how to hash those | 03:54 |
| morganfainberg | to the unique/short_id | 03:54 |
| morganfainberg | fernet doesn't need that | 03:54 |
| morganfainberg | DOA just needs to be more specific about PKI(Z) hashing | 03:54 |
| lhcheng | morganfainberg: I thought it works because the id is in the middleware cache, so it just assumes its okay? | 03:54 |
| morganfainberg | nope | 03:54 |
| morganfainberg | because you can hash pki_id -> short/uuid-looking-id | 03:54 |
| morganfainberg | and we do that inside keystone for the index | 03:54 |
| lhcheng | hmm but this works for ans1 too | 03:55 |
| morganfainberg | and you can reference either pki-id or short-hash-of-pki-id when validating a token | 03:55 |
| morganfainberg | PKI(Z) is ASN1 | 03:55 |
| morganfainberg | uuid you don't need to hash | 03:55 |
| morganfainberg | since it's already a short-token | 03:55 |
| lhcheng | morganfainberg: horizon can't really tell what token format it is looking at | 03:57 |
| lhcheng | morganfainberg: what do you think the long term solution would be? | 03:57 |
| morganfainberg | you can know if it starts with MII or PKI(Z) you should hash it | 03:57 |
| morganfainberg | else just use the token | 03:57 |
| morganfainberg | or MIJ orwhatever the other *really big* token prefix ends up being | 03:57 |
| morganfainberg | PKIZ_ and MII is how we do the magic in auth_token middleware | 03:57 |
| morganfainberg | it's fine to use the same "is this a PKI token" logic | 03:58 |
| lhcheng | okay, sounds reasonable | 03:59 |
| lhcheng | perhaps I should include the fix now, release it with the websso stuff | 03:59 |
| morganfainberg | yes | 03:59 |
| morganfainberg | we should | 03:59 |
| lhcheng | cool, will do that. | 04:00 |
| lhcheng | what's the default token format in devstack now? | 04:00 |
| lhcheng | iirc it was switch to pki at some point | 04:01 |
| morganfainberg | uuid | 04:02 |
| morganfainberg | it was pki last release | 04:02 |
| morganfainberg | but PKI has issues | 04:02 |
| lhcheng | we had to put together that ugly hack due PKI being the default and the horizon cookie backend could not handle it. | 04:02 |
| *** spandhe has joined #openstack-keystone | 04:03 | |
| lhcheng | since it is back to UUI, should be fine to fix DOA then and we won't hit the session overflow. | 04:03 |
| lhcheng | *UUID | 04:03 |
| lhcheng | morganfainberg: btw, the websso patches were merged today \o/ | 04:04 |
| morganfainberg | yay | 04:04 |
| morganfainberg | lhcheng, you still need to hash if MII/PKIZ | 04:04 |
| morganfainberg | you can't break that | 04:04 |
| morganfainberg | you just need to make the choice to hash more specific | 04:05 |
| lhcheng | morganfainberg: yup, I'll look at the magic check in the middleware | 04:05 |
| morganfainberg | just use smarter "do i hash" logic :) | 04:05 |
| lhcheng | to make the check consistent | 04:05 |
| lhcheng | ayoung: one thing to note about the websso, the user have to explicitly install 1.2.0 version of DOA to use it. That version of DOA won't make the cut in Kilo g-r. | 04:07 |
| lhcheng | morganfainberg: cool, sounds good. I'll add you as reviewer for that when its ready, just to make sure there is nothing stupid happening. :) | 04:08 |
| morganfainberg | please do! | 04:08 |
| *** links has joined #openstack-keystone | 04:11 | |
| *** Bsony has joined #openstack-keystone | 04:13 | |
| *** devlaps has quit IRC | 04:25 | |
| *** devlaps has joined #openstack-keystone | 04:26 | |
| *** rm_work is now known as rm_work|away | 04:32 | |
| *** rushiagr_away is now known as rushiagr | 04:32 | |
| stevemar | lhcheng, morganfainberg no way we can bump up the DOA version in g-r? | 04:36 |
| lhcheng | stevemar: g-r is freezed, probably have to get a *super FFE. (shrug) | 04:37 |
| morganfainberg | lhcheng, fernet tokens are new, we can add a doc saying "make sure you have DOA XXX" | 04:45 |
| morganfainberg | that is fine | 04:45 |
| morganfainberg | don't worry about the g-r update | 04:46 |
| morganfainberg | fernet aren't the default and wont be really used until liberty in the gate | 04:46 |
| morganfainberg | so we're fine :) | 04:46 |
| *** _cjones_ has joined #openstack-keystone | 04:47 | |
| lhcheng | morganfainberg: stevemar's concern is for the websso , but yeah it is a new feature too :) | 04:48 |
| lhcheng | morganfainberg: here's the DOA patch to address the token hashing check: https://review.openstack.org/#/c/169994/ | 04:49 |
| *** _cjones_ has quit IRC | 04:50 | |
| *** _cjones_ has joined #openstack-keystone | 04:50 | |
| *** davechen has joined #openstack-keystone | 05:04 | |
| *** Bsony has quit IRC | 05:11 | |
| *** lhcheng_ has joined #openstack-keystone | 05:23 | |
| *** lhcheng has quit IRC | 05:25 | |
| *** lhcheng_ is now known as lhcheng | 05:25 | |
| *** _cjones_ has quit IRC | 05:29 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the typo and problematic logic on ec2 signature https://review.openstack.org/143772 | 05:30 |
| *** _cjones_ has joined #openstack-keystone | 05:56 | |
| *** lhcheng is now known as lhcheng_afk | 05:58 | |
| *** dims_ has joined #openstack-keystone | 06:00 | |
| *** dims_ has quit IRC | 06:06 | |
| *** rushiagr is now known as rushiagr_away | 06:07 | |
| *** rushiagr_away is now known as rushiagr | 06:10 | |
| *** ishant has joined #openstack-keystone | 06:13 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Document websso setup https://review.openstack.org/164012 | 06:20 |
| *** lhcheng_afk has quit IRC | 06:23 | |
| *** henrynash has joined #openstack-keystone | 06:28 | |
| *** ChanServ sets mode: +v henrynash | 06:28 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 06:29 |
| *** rm_work|away is now known as rm_work | 06:51 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Expose multiple SQL backend usage validation error https://review.openstack.org/138113 | 06:51 |
| *** afazekas has joined #openstack-keystone | 06:54 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Fix multiple SQL backend usage validation error https://review.openstack.org/170022 | 06:55 |
| *** chlong has quit IRC | 06:55 | |
| *** mhu has quit IRC | 06:58 | |
| *** ParsectiX has joined #openstack-keystone | 07:00 | |
| *** ParsectiX has quit IRC | 07:06 | |
| *** ParsectiX has joined #openstack-keystone | 07:07 | |
| *** Bsony has joined #openstack-keystone | 07:10 | |
| *** jistr has joined #openstack-keystone | 07:13 | |
| *** boris-42 has quit IRC | 07:18 | |
| *** stevemar has quit IRC | 07:30 | |
| *** mhu has joined #openstack-keystone | 07:35 | |
| *** _cjones_ has quit IRC | 07:37 | |
| *** _cjones_ has joined #openstack-keystone | 07:37 | |
| *** tqtran_afk has quit IRC | 07:46 | |
| *** Bsony has quit IRC | 07:58 | |
| *** henrynash has quit IRC | 08:08 | |
| *** krykowski has joined #openstack-keystone | 08:11 | |
| *** erkules_ is now known as erkules | 08:12 | |
| *** erkules has quit IRC | 08:12 | |
| *** erkules has joined #openstack-keystone | 08:12 | |
| *** bdossant has joined #openstack-keystone | 08:14 | |
| *** devlaps has quit IRC | 08:15 | |
| *** markvoelker has quit IRC | 08:18 | |
| *** ParsectiX has quit IRC | 08:24 | |
| *** krykowski has quit IRC | 08:36 | |
| *** davidckennedy has joined #openstack-keystone | 08:36 | |
| *** krykowski has joined #openstack-keystone | 08:39 | |
| *** mhu has quit IRC | 08:40 | |
| *** markvoelker has joined #openstack-keystone | 08:49 | |
| *** dims_ has joined #openstack-keystone | 08:50 | |
| *** jacer_huawei has quit IRC | 08:51 | |
| *** henrynash has joined #openstack-keystone | 08:52 | |
| *** ChanServ sets mode: +v henrynash | 08:52 | |
| *** markvoelker has quit IRC | 08:55 | |
| *** dims_ has quit IRC | 08:55 | |
| *** davechen has left #openstack-keystone | 08:57 | |
| *** Bsony has joined #openstack-keystone | 08:58 | |
| *** mhu has joined #openstack-keystone | 09:00 | |
| *** Bsony has quit IRC | 09:03 | |
| *** _cjones_ has quit IRC | 09:04 | |
| *** krykowski has quit IRC | 09:12 | |
| *** krykowski has joined #openstack-keystone | 09:13 | |
| *** jistr has quit IRC | 09:26 | |
| *** jistr has joined #openstack-keystone | 09:44 | |
| *** dims_ has joined #openstack-keystone | 09:52 | |
| *** dims_ has quit IRC | 09:52 | |
| *** dims__ has joined #openstack-keystone | 09:56 | |
| *** dims__ has quit IRC | 10:03 | |
| *** ptoohill has quit IRC | 10:03 | |
| *** ptoohill has joined #openstack-keystone | 10:04 | |
| viktors | hi folks! Con somebody +2A a simple patch https://review.openstack.org/#/c/137637 (Fix index name the assignment.actor_id table) ? This blocked already approved patch in chain. Thanks! | 10:07 |
| *** dims has joined #openstack-keystone | 10:09 | |
| *** jaosorior has joined #openstack-keystone | 10:19 | |
| *** ishant has quit IRC | 10:28 | |
| *** ishant has joined #openstack-keystone | 10:29 | |
| *** markvoelker has joined #openstack-keystone | 10:52 | |
| *** davidckennedy has quit IRC | 10:55 | |
| *** samueldmq has joined #openstack-keystone | 10:56 | |
| *** henrynash has quit IRC | 10:56 | |
| *** markvoelker has quit IRC | 10:57 | |
| samueldmq | morning | 10:59 |
| *** henrynash has joined #openstack-keystone | 10:59 | |
| *** ChanServ sets mode: +v henrynash | 10:59 | |
| *** henrynash has quit IRC | 11:13 | |
| *** ParsectiX has joined #openstack-keystone | 11:37 | |
| *** markvoelker has joined #openstack-keystone | 11:53 | |
| mflobo | question about keystoneclient | 11:56 |
| mflobo | we already have implemented endpoint_filter https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/contrib/endpoint_filter.py | 11:56 |
| mflobo | but, is it available in the CLI? | 11:56 |
| *** markvoelker has quit IRC | 11:58 | |
| *** boris-42 has joined #openstack-keystone | 12:00 | |
| *** _cjones_ has joined #openstack-keystone | 12:05 | |
| *** _cjones_ has quit IRC | 12:09 | |
| *** ParsectiX has quit IRC | 12:10 | |
| *** dims has quit IRC | 12:25 | |
| *** dims has joined #openstack-keystone | 12:26 | |
| *** markvoelker has joined #openstack-keystone | 12:29 | |
| *** spandhe has quit IRC | 12:31 | |
| *** bknudson has quit IRC | 12:32 | |
| *** gordc has joined #openstack-keystone | 12:33 | |
| ayoung | mflobo, you know how to find out? | 12:36 |
| ayoung | The CLI is the common cli now, not keystone...so look in python-openstackclient | 12:37 |
| mflobo | ok, i'll take a look to the common CLI | 12:39 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Add subjectAltName to generated ssl cert https://review.openstack.org/154074 | 12:41 |
| viktors | ayoung: hi! Con you please look at patch https://review.openstack.org/#/c/137637 (Fix index name the assignment.actor_id table) ? Thanks! | 12:52 |
| ayoung | viktors, sure | 12:52 |
| *** ParsectiX has joined #openstack-keystone | 13:00 | |
| *** amakarov_away is now known as amakarov | 13:00 | |
| *** chlong has joined #openstack-keystone | 13:01 | |
| ayoung | viktors, what is the basic problem with the name in https://review.openstack.org/#/c/137637/15 ? | 13:03 |
| ayoung | Where does it mess things up? | 13:03 |
| * viktors trying to remember | 13:04 | |
| *** ParsectiX has quit IRC | 13:04 | |
| *** rushiagr is now known as rushiagr_away | 13:11 | |
| *** bknudson has joined #openstack-keystone | 13:13 | |
| *** ChanServ sets mode: +v bknudson | 13:13 | |
| viktors | ayoung: it seems to be, that I forget something, because my answer is `fixes bug`. Let me run some tests for this to get more details | 13:13 |
| ayoung | viktors, add the real problem to the bug report, please. | 13:13 |
| ayoung | The patch looks good, just don't want to approve without understanding | 13:13 |
| *** joesavak has joined #openstack-keystone | 13:15 | |
| viktors | ayoung: firstly this patch was uploaded in November by Ilya Pekelny so I can miss original issue. Or maybe this issue was gone since that time :) | 13:15 |
| ayoung | viktors, can you find out? I'd hate to drop it if we had a real problem | 13:16 |
| viktors | ayoung: ok, I'll try | 13:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 13:23 |
| *** davechen has joined #openstack-keystone | 13:31 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/144860 | 13:31 |
| *** mattfarina has joined #openstack-keystone | 13:34 | |
| *** henrynash has joined #openstack-keystone | 13:35 | |
| *** ChanServ sets mode: +v henrynash | 13:35 | |
| ayoung | henrynash, I suspect this is where we should be headed. Or at least thinking about it. https://securityblog.redhat.com/2015/04/01/jose-json-object-signing-and-encryption/ | 13:35 |
| henrynash | ayoung: looking | 13:36 |
| ayoung | Standard for the messages we send around; use the JWT format for Keystone tokens, use the signing mechanism for messages on the Bus | 13:37 |
| *** zigo has quit IRC | 13:38 | |
| henrynash | ayoung: yes, makese sense to me | 13:40 |
| *** zigo_ is now known as zigo | 13:41 | |
| ayoung | henrynash, I thought he laid it out pretty clearly | 13:41 |
| ayoung | seems to fit in with the rest of the OpenStack approach | 13:41 |
| henrynash | ayoung: agreed, good article | 13:41 |
| *** chlong has quit IRC | 13:47 | |
| *** gordc has quit IRC | 13:48 | |
| *** diegows has quit IRC | 13:52 | |
| *** rushiagr_away is now known as rushiagr | 13:56 | |
| henrynash | bknudosn, dstanek: if you haev time, I think https://review.openstack.org/#/c/163322/ is ready to go in (bknduson, you +2’d the previous version)…only chnage was to trap KeyError, rather than AttributeError | 14:00 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:01 | |
| *** Bsony has joined #openstack-keystone | 14:04 | |
| *** gordc has joined #openstack-keystone | 14:04 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 14:05 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 14:05 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change domain_id FK in project table https://review.openstack.org/166354 | 14:05 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 14:05 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 14:05 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Stop calling domain drivers https://review.openstack.org/165936 | 14:05 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 14:05 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 14:06 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Creating domain and filtering by parent_id https://review.openstack.org/161378 | 14:06 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 14:06 |
| viktors | ayoung: it seems to be, that this was made to sync DB state of table assignment to it's SQLA model - see a difference without this patch - http://paste.openstack.org/show/197916/ | 14:07 |
| ayoung | PostgreSQL | 14:08 |
| ayoung | viktors, was that test skipped? | 14:08 |
| davechen | henrynash, hi | 14:09 |
| henrynash | davechen: hi | 14:09 |
| viktors | ayoung: no, this test is only going to be implemented in https://review.openstack.org/#/c/80630/ | 14:09 |
| ayoung | ah | 14:09 |
| davechen | henrynash: how about say it "ignore the URL which intends to replace 'tenant_id' with None" in the comments? | 14:10 |
| *** iamjarvo has joined #openstack-keystone | 14:10 | |
| *** iamjarvo has quit IRC | 14:10 | |
| *** iamjarvo has joined #openstack-keystone | 14:11 | |
| *** iamjarvo has quit IRC | 14:11 | |
| *** Bsony has quit IRC | 14:11 | |
| ayoung | henrynash, what happens if someone specifies that the domain-specific-driver is memcached? | 14:11 |
| henrynash | ayoungL hold on | 14:12 |
| ayoung | henrynash, no rush | 14:12 |
| *** iamjarvo has joined #openstack-keystone | 14:12 | |
| *** davidckennedy has joined #openstack-keystone | 14:12 | |
| *** iamjarvo has quit IRC | 14:12 | |
| henrynash | davechen: how about simply: "ignore the URL when there is no 'tenant_id' to substitute”? | 14:12 |
| *** iamjarvo has joined #openstack-keystone | 14:13 | |
| *** iamjarvo has quit IRC | 14:13 | |
| henrynash | ayoung: we don’t have a memcahced identity backend, do we? | 14:13 |
| ayoung | I thought we did. We used to | 14:13 |
| davechen | henrynash: I am not native english speaker, I think both is okay, but I decide to adopt your proposal, just mins :) | 14:13 |
| ayoung | henrynash, I +2aed it anyway | 14:14 |
| *** iamjarvo has joined #openstack-keystone | 14:14 | |
| henrynash | ayoung: you mean a kvs one? | 14:14 |
| *** iamjarvo has quit IRC | 14:14 | |
| henrynash | ayoung: I think we nixed them all | 14:14 |
| henrynash | ayoung: (thanks) | 14:14 |
| ayoung | Ah,...its gone | 14:14 |
| ayoung | only sql and ldap no0w | 14:14 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends | 14:14 |
| henrynash | ayoung: yeo | 14:14 |
| *** iamjarvo has joined #openstack-keystone | 14:14 | |
| henrynash | ayoung: yep | 14:14 |
| henrynash | davechen: ok, sounds good, no worries | 14:15 |
| henrynash | davechen: can be difficult I know, you’re doing great | 14:15 |
| *** aix has joined #openstack-keystone | 14:18 | |
| *** edmondsw has joined #openstack-keystone | 14:18 | |
| *** aix has quit IRC | 14:19 | |
| *** aix has joined #openstack-keystone | 14:20 | |
| *** jorge_munoz has quit IRC | 14:23 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/144860 | 14:24 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 14:25 |
| *** links has quit IRC | 14:26 | |
| *** stevemar has joined #openstack-keystone | 14:26 | |
| *** ChanServ sets mode: +v stevemar | 14:26 | |
| *** krykowski has left #openstack-keystone | 14:26 | |
| raildo | henrynash, ^ last rebase removed the last change, I fixed in the version :) | 14:27 |
| davechen | henrynash: Done, your help is really matter, pls check it at your convenience. | 14:27 |
| henrynash | ok, will look | 14:27 |
| henrynash | davechen: will do | 14:27 |
| *** Bsony has joined #openstack-keystone | 14:30 | |
| *** topol has joined #openstack-keystone | 14:32 | |
| *** ChanServ sets mode: +v topol | 14:32 | |
| viktors | stevemar: around? | 14:34 |
| stevemar | viktors, sort of? | 14:35 |
| stevemar | viktors, doing a few things at once | 14:36 |
| viktors | stevemar: I want to ask you about the patch https://review.openstack.org/#/c/168947/ (Add server_default to relay_state_prefix in service_provider model). Please ping me, when you'll have a time | 14:37 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/144860 | 14:41 |
| *** ishant has quit IRC | 14:43 | |
| *** raildo has quit IRC | 14:45 | |
| *** zzzeek has joined #openstack-keystone | 14:48 | |
| *** devlaps has joined #openstack-keystone | 14:49 | |
| stevemar | viktors, k, why did you write you hate oslo.config :) | 14:53 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix errors in ec2 signature logic checking https://review.openstack.org/143772 | 14:54 |
| *** Bsony has quit IRC | 14:55 | |
| *** Bsony has joined #openstack-keystone | 14:57 | |
| viktors | stevemar: it always brings issues. At that patch it causes `docs` test failure ( | 14:59 |
| rhagarty_ | hello - I'm new to keystone. Was wondering if there is a way to simply store and retrieve a user/pwd from the keystone service? | 15:00 |
| *** obedmr has joined #openstack-keystone | 15:01 | |
| *** bdossant has quit IRC | 15:02 | |
| *** davechen has left #openstack-keystone | 15:03 | |
| *** davechen has joined #openstack-keystone | 15:05 | |
| *** davechen has left #openstack-keystone | 15:05 | |
| stevemar | viktors, maybe try setting CONF = cfg.CONF after the imports | 15:06 |
| stevemar | and call CONF when trying to get the default | 15:06 |
| boris-42 | ayoung: ping | 15:06 |
| openstackgerrit | Merged openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 15:06 |
| viktors | stevemar: I have a doubts, that this will work, but I'll try | 15:06 |
| ayoung | boris-42, fire away | 15:07 |
| boris-42 | ayoung: so recently I made one more tool for making python apps/libs better | 15:07 |
| boris-42 | ayoung: https://github.com/boris-42/profimp | 15:08 |
| boris-42 | ayoung: it allows you to trace imports and optimize them | 15:08 |
| ayoung | interesteing | 15:08 |
| boris-42 | ayoung: so we can tune "import keystoneclient" with it | 15:08 |
| ayoung | OK | 15:08 |
| boris-42 | ayoung: it doesn't require any changes in kyestoneclient (like osprofiler) so it can be easily used | 15:08 |
| viktors | stevemar: still the same error ( | 15:09 |
| ayoung | but this is just for imports, right, not an overall profilier? | 15:09 |
| stevemar | viktors, :( | 15:09 |
| boris-42 | ayoung: yep | 15:09 |
| boris-42 | ayoung: it measures how long it takes to run "import .." and where time is consumed | 15:09 |
| ayoung | neat | 15:10 |
| ayoung | boris-42, any insights? | 15:10 |
| boris-42 | ayoung: so what I think is that I will finish HTML report that will simplify work with long long traces | 15:11 |
| boris-42 | ayoung: after that we can think about tuning imports of keystoneclient | 15:11 |
| boris-42 | ayoung: so put some of them into lazy mode | 15:11 |
| ayoung | sounds good boris-42 | 15:12 |
| *** Bsony has quit IRC | 15:13 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update sample config file https://review.openstack.org/170165 | 15:17 |
| lbragstad | quick python 3 question for the channel, what seems like a realistic date for keystone to be running on python 3? | 15:22 |
| stevemar | lbragstad, HAHAHA | 15:22 |
| *** thedodd has joined #openstack-keystone | 15:24 | |
| bknudson | lbragstad: dropping eventlet should help. | 15:26 |
| lbragstad | just curious | 15:26 |
| viktors | bknudson: eventlet already announced py3 support | 15:27 |
| bknudson | ok... then I don't know what's stopping us. | 15:27 |
| bknudson | python-ldap? | 15:28 |
| viktors | bknudson: by the way, can you please make a quick look at https://review.openstack.org/#/c/168987/1/keystone/contrib/federation/migrate_repo/versions/007_add_remote_id_table.py - I've answered to your note there | 15:32 |
| bknudson | viktors: it's on my list. | 15:32 |
| viktors | bknudson: got it, thanks | 15:33 |
| *** h_m has quit IRC | 15:34 | |
| *** henrynash has quit IRC | 15:38 | |
| *** arunkant_ has joined #openstack-keystone | 15:42 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Add subjectAltName to generated ssl cert https://review.openstack.org/154074 | 15:47 |
| *** packet has joined #openstack-keystone | 15:52 | |
| davidckennedy | lbragstad henrynash bug/1410543 is it really a blocker for kilo-rc1? - I have no idea. I'm just trying to fix it :D | 15:54 |
| *** iamjarvo has quit IRC | 15:59 | |
| *** davidckennedy has quit IRC | 16:00 | |
| *** _cjones_ has joined #openstack-keystone | 16:03 | |
| *** aix has quit IRC | 16:07 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Add server_default to relay_state_prefix in service_provider model https://review.openstack.org/168947 | 16:07 |
| *** afazekas has quit IRC | 16:16 | |
| *** iamjarvo has joined #openstack-keystone | 16:16 | |
| *** Bsony has joined #openstack-keystone | 16:19 | |
| *** jistr has quit IRC | 16:23 | |
| *** Bsony has quit IRC | 16:24 | |
| *** spandhe has joined #openstack-keystone | 16:32 | |
| *** lhcheng_afk has joined #openstack-keystone | 16:34 | |
| *** lhcheng_afk is now known as lhcheng | 16:34 | |
| *** Bsony has joined #openstack-keystone | 16:41 | |
| *** harlowja_away is now known as harlowja | 16:42 | |
| *** tqtran_afk has joined #openstack-keystone | 16:56 | |
| *** EmilienM is now known as EmilienM|afk | 17:01 | |
| *** devlaps1 has joined #openstack-keystone | 17:02 | |
| *** devlaps has quit IRC | 17:03 | |
| *** iamjarvo has quit IRC | 17:10 | |
| *** tqtran_afk is now known as tqtran | 17:11 | |
| *** iamjarvo has joined #openstack-keystone | 17:11 | |
| *** iamjarvo has quit IRC | 17:11 | |
| *** iamjarvo has joined #openstack-keystone | 17:12 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystonemiddleware: Validate tokens against revocation events https://review.openstack.org/169438 | 17:18 |
| openstackgerrit | Alexander Makarov proposed openstack/keystonemiddleware: Validate tokens against revocation events https://review.openstack.org/169438 | 17:20 |
| *** obedmr has quit IRC | 17:22 | |
| *** obedmr has joined #openstack-keystone | 17:24 | |
| *** iamjarvo has quit IRC | 17:29 | |
| *** spandhe has quit IRC | 17:30 | |
| *** spandhe has joined #openstack-keystone | 17:32 | |
| *** henrynash has joined #openstack-keystone | 17:36 | |
| *** ChanServ sets mode: +v henrynash | 17:36 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 17:42 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 17:50 |
| *** jaosorior has quit IRC | 17:52 | |
| morganfainberg | ayoung: https://bugs.launchpad.net/keystone/+bug/1401926 | 17:54 |
| openstack | Launchpad bug 1401926 in Keystone "Role revocation invalidates tokens on all user projects" [Medium,In progress] - Assigned to Adam Young (ayoung) | 17:54 |
| morganfainberg | ayoung: https://bugs.launchpad.net/keystone/+bug/1430951 | 17:55 |
| openstack | Launchpad bug 1430951 in Keystone "Revocation causes duplicate (and overly broad?) events in revocation table" [High,Triaged] - Assigned to Adam Young (ayoung) | 17:55 |
| morganfainberg | Are these kilo targets or liberty now? | 17:55 |
| *** obedmr has quit IRC | 17:55 | |
| ayoung | morganfainberg, second one is liberty | 17:55 |
| morganfainberg | Ok | 17:55 |
| ayoung | morganfainberg, get feedback from the people consuming revocation events if we need to up the priority | 17:56 |
| ayoung | I think the fix is going to be invasive | 17:56 |
| morganfainberg | Booted it to l1 | 17:56 |
| *** obedmr has joined #openstack-keystone | 17:56 | |
| ayoung | check with dolphm if that is cool | 17:57 |
| ayoung | I can up the priority if they really need it | 17:57 |
| morganfainberg | dolphm: is out. | 17:57 |
| ayoung | until when? | 17:57 |
| morganfainberg | Next week? Week after? | 17:57 |
| ayoung | ah... | 17:57 |
| morganfainberg | We can backport to kilo if it is needed | 17:57 |
| ayoung | I was thinking that, but if the change is as invasive as I suspect, we won't want to | 17:58 |
| ayoung | but... | 17:58 |
| morganfainberg | We may also cherry-pick the best parts to soften the impact. | 17:58 |
| morganfainberg | Anyway, L1. It has been broken for a while now. | 17:58 |
| ayoung | problem is that we deliberate call the notifications twice | 17:58 |
| ayoung | one of them has to go | 17:58 |
| ayoung | so, if we leave the old call, we have to make it look like the new one. | 17:59 |
| ayoung | or carry the same information | 17:59 |
| morganfainberg | Yep. | 17:59 |
| ayoung | I'll take another look later on today, after I finish up some federation things | 18:00 |
| ayoung | if I can yabnk the explicit revoke_api calls, and move everything into the origianl notify, it should be OK | 18:00 |
| ayoung | yank | 18:00 |
| morganfainberg | It can be moved back to rc1 if you change your mind. Remember though we are cutting rc next week | 18:00 |
| ayoung | "origianl" meaning the one you added after everythign else, of course | 18:00 |
| morganfainberg | So we need to get the last of these bugs closed out quickly here. | 18:01 |
| morganfainberg | I have a couple more bugs I can boot to l1, but would rather have the better ux they bring to the table. | 18:01 |
| *** rdo has quit IRC | 18:03 | |
| henrynash | morgainfainberg: could you make sure https://review.openstack.org/#/c/170022/ is “starred” for rc1, it’s the fix for https://review.openstack.org/#/c/138113/8 (which is already starred) | 18:04 |
| *** rdo has joined #openstack-keystone | 18:04 | |
| *** henrynash has quit IRC | 18:05 | |
| *** thedodd has quit IRC | 18:15 | |
| *** iamjarvo has joined #openstack-keystone | 18:16 | |
| *** joesavak has quit IRC | 18:17 | |
| *** iamjarvo has quit IRC | 18:17 | |
| *** iamjarvo has joined #openstack-keystone | 18:18 | |
| iamjarvo | so it seems that when i find a user using the keystone client it has an id but it is not the public_id from the id_mapping table | 18:22 |
| iamjarvo | this is causing things to be mismatched when doing role_assignments | 18:22 |
| ayoung | iamjarvo, Federated user? | 18:24 |
| ayoung | or multidomain backedn | 18:25 |
| iamjarvo | ldap with multidomain | 18:25 |
| iamjarvo | using the patch | 18:26 |
| ayoung | and the userid is the value out of LDAP instead of the mapped value? | 18:26 |
| iamjarvo | so to my understanding when you use ldap the user is stored in an id_mapping table and the column public_id is a sha of somethings from ldap | 18:27 |
| ayoung | yes... | 18:27 |
| *** joesavak has joined #openstack-keystone | 18:27 | |
| iamjarvo | so the public_id and user.id is not matching | 18:27 |
| iamjarvo | keystone.users.find(domain_id="default", name=user_name) | 18:27 |
| ayoung | are you getting the value from ldap instead | 18:27 |
| iamjarvo | let me open the ldap manager | 18:28 |
| ayoung | you can;'t tell/ | 18:28 |
| ayoung | I use the uid as the user_id field | 18:28 |
| ayoung | you can't tell just by looking? | 18:28 |
| *** larsks has left #openstack-keystone | 18:28 | |
| ayoung | it should be a human readable string instead of a sha256 | 18:28 |
| ayoung | what value comes through for user_id | 18:29 |
| iamjarvo | "id=afb8f9e54352898fad14199fffffd2991aa38c9b25449c68a78a00c0e3d82133" | 18:29 |
| iamjarvo | so a sha and i can see the uid in ldap | 18:30 |
| *** EmilienM|afk is now known as EmilienM | 18:30 | |
| ayoung | iamjarvo, OK, that looks like a sha256, but it doesn't match what you get in the mapping table? | 18:31 |
| ayoung | the value in id_+mapping is the sha256 of the value from ldap and the domain id: | 18:31 |
| iamjarvo | ayoung i think i know what's wrong. there are two entries for this user in id_mapping and it's scoping to the wrong one :( | 18:37 |
| ayoung | interesting | 18:37 |
| iamjarvo | due to the code always scoping to default | 18:38 |
| *** alexsyip has joined #openstack-keystone | 18:51 | |
| alexsyip | Hi all, I have a question about using keystone client. | 18:51 |
| ayoung | stevemar, when I do a mapping with REMOTE_USER_GROUPS set to multipl cvalues, I end up with | 18:56 |
| ayoung | (Pdb) print group | 18:56 |
| ayoung | {u'domain': {u'name': u'Default'}, u'name': u"['admins', 'ipausers', 'wheel']"} | 18:56 |
| ayoung | which is not right | 18:57 |
| ayoung | I suspect I am doing somethjing wrong in the mapping | 18:57 |
| *** amakarov is now known as amakarov_away | 18:57 | |
| ayoung | here is my mapping | 18:57 |
| ayoung | http://paste.openstack.org/show/197972/ | 18:57 |
| stevemar | what are you expecting it to be? | 18:58 |
| stevemar | updating sample config (for what should be the last time) needs another core https://review.openstack.org/#/c/170165/1 | 19:00 |
| ayoung | ah I found it | 19:00 |
| ayoung | groups not goup | 19:00 |
| ayoung | group | 19:01 |
| stevemar | ++ | 19:01 |
| stevemar | ayoung, that would have taken me a while to find, glad you found it instead | 19:01 |
| ayoung | stevemar, I was actually comparing to the known good one in the test | 19:02 |
| stevemar | ayoung, yeah, i need to create a bunch of example and put them up on docs.o.org/keystone | 19:03 |
| ayoung | stevemar, I'll have something pretty cool to show here shortly, I think. | 19:05 |
| ayoung | stevemar, um | 19:06 |
| ayoung | {"error": {"message": "An unexpected error prevented the server from fulfilling your request: (ProgrammingError) (1064, 'You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near \\': \"\\'[\\\\\\\\\\'admins\\\\\\\\\\', \\\\\\\\\\'ipausers\\\\\\\\\\', \\\\\\\\\\'wheel\\\\\\\\\\']\\'\"} AND `group`.domain_id = \\'defa\\' at line 3') 'SELECT `group`. | 19:06 |
| ayoung | id AS group_id, `group`.name AS group_name, `group`.domain_id AS group_domain_id, `group`.description AS group_description, `group`.extra AS group_extra \\nFROM `group` \\nWHERE `group`.name = %s AND `group`.domain_id = %s' ({u'name': u\"['admins', 'ipausers', 'wheel']\"}, 'default') (Disable debug mode to suppress these details.)", "code": 500, "title": "Internal Server Error"}} | 19:06 |
| ayoung | something didn't split the group names properly | 19:06 |
| ayoung | print assertion['REMOTE_USER_GROUPS'] | 19:09 |
| ayoung | admins;ipausers;wheel | 19:09 |
| ayoung | stevemar, is there something I can set in the mapping to tell it to split on ; instead of whatever else it splits on? | 19:10 |
| *** kr4zy has joined #openstack-keystone | 19:11 | |
| stevemar | ayoung, there is a setting in most apache plugins to pick a delimiter | 19:11 |
| ayoung | stevemar, yeah, yeah | 19:11 |
| kr4zy | I am currently using keystone icehouse on CentOS with assignment using mysql and ldap for user and password. I want to know if it is possible to enable caching for ldap. | 19:11 |
| ayoung | kr4zy, no | 19:12 |
| ayoung | there is no LDAP caching in any of Keystone | 19:12 |
| kr4zy | ayoung: any future plans? | 19:12 |
| ayoung | kr4zy, yes. get rid of LDAP, use SSSD, and let that cache for you | 19:12 |
| ayoung | http://adam.younglogic.com/2015/03/key-fed-lookup-redux/ | 19:13 |
| ayoung | stevemar, what do we expect the separator to be? a colon : ? | 19:13 |
| stevemar | ayoung, i thought it was a semi-colon | 19:15 |
| kr4zy | ayoung: thanks for the pointers. but when you said "yes", you mean there are plans for caching ldaps in future keystone release or people will be using SSSD? | 19:15 |
| ayoung | stevemar, that is what I had the first time, and : gave a different error. hmmm | 19:15 |
| morganfainberg | kr4zy, we cache certain things in keystone, but it is unlikely we will do anything that is specific to ldap | 19:15 |
| morganfainberg | kr4zy, if it is caching for the generic case, it would affect LDAP as well. | 19:16 |
| morganfainberg | kr4zy, just like we don't do specific SQL caching | 19:16 |
| *** thedodd has joined #openstack-keystone | 19:16 | |
| ayoung | stevemar, checkit! | 19:19 |
| ayoung | $ curl --negotiate -u: horizon.cloudlab.freeipa.org:5000/v3/OS-FEDERATION/identity_providers/sssd/protocols/kerberos/auth | 19:19 |
| ayoung | {"token": {"methods": ["kerberos"], "expires_at": "2015-04-02T20:19:20.223906Z", "extras": {}, "user": {"OS-FEDERATION": {"identity_provider": {"id": "sssd"}, "protocol": {"id": "kerberos"}, "groups": [{"id": "482eb4e6a0c64348845773b506d1db77"}, {"id": "6da803796a4540d48a0aff3b3185edad"}, {"id": "f0bf681ae2e84d1580a7ff54ea49bf27"}]}, "domain": {"id": "Federated", "name": "Federated"}, "id": "ayoung", "name": "ayoung"}, "audi | 19:19 |
| ayoung | t_ids": ["eFvsNvBRQPO3L51nhYlLdw"], "issued_at": "2015-04-02T19:19:20.223941Z"}}[cloud-user@horizon keystone]$ | 19:19 |
| *** __TheDodd__ has joined #openstack-keystone | 19:19 | |
| stevemar | ayoung, thats actually pretty neat | 19:20 |
| stevemar | what did you have to change? | 19:20 |
| morganfainberg | stevemar, ping | 19:20 |
| stevemar | morganfainberg, pong, in -meeting | 19:20 |
| morganfainberg | stevemar, i want to confirm, the new domain-sql thing, the default behavior is to use file-backed configs right? | 19:20 |
| stevemar | morganfainberg, henry's stuff? | 19:21 |
| morganfainberg | stevemar, yeah | 19:21 |
| *** thedodd has quit IRC | 19:21 | |
| stevemar | i thought the default is to use the REST apis now? | 19:21 |
| morganfainberg | whelp we now have a new RC bug | 19:21 |
| morganfainberg | we can't do that | 19:21 |
| stevemar | ah no | 19:21 |
| stevemar | i am wrong | 19:21 |
| morganfainberg | we will break anyone currently using per-domain configs. | 19:21 |
| stevemar | domain_configurations_from_database = false | 19:21 |
| morganfainberg | ah phew | 19:21 |
| *** joesavak has quit IRC | 19:22 | |
| morganfainberg | stevemar, i was digging but wanted to be sure. | 19:22 |
| morganfainberg | figured you read it more recently than I did | 19:22 |
| ayoung | stevemar, once I got the mapping right? Nothing | 19:22 |
| stevemar | oh, what was the deal with the mapping? | 19:22 |
| stevemar | paste your final mapping :P | 19:22 |
| ayoung | stevemar, I'm working on a write up, but I think I can use the Federation code to get a Kerberized token without SAML | 19:22 |
| ayoung | stevemar, http://paste.openstack.org/show/197976/ | 19:23 |
| ayoung | stevemar, OK, we havea Feederated domain now, right? And, without explicit mapping, users should go in there? I wonder how that is going to work for Groups. The admin can't create that domain etc... | 19:25 |
| stevemar | ayoung, yeah, admins create create or update a domain named 'federated' | 19:26 |
| kr4zy | morganfainberg: my ldap query is very slow that's why I asked whether it is possible to cache it to speed it up. | 19:26 |
| stevemar | and yes, any user that doesn't exist in the backend is "assigned" that domain. the domain isn't actually created | 19:27 |
| kr4zy | morganfainberg: I see the openstack guide said caching is only available for token, resource, and role. Is this updated? | 19:27 |
| ayoung | stevemar, what if the Admin creates that domain? Can we then put groups in there? | 19:28 |
| ayoung | And it will map correctly? Nothing actually stops the admin from creating that domain, right? | 19:28 |
| kr4zy | morganfainberg: I am using the dogpile.cache.memcached module. Looking through the source code. seems like only token import the cache module. | 19:28 |
| stevemar | ayoung, the admin is prevented from creating that domain | 19:28 |
| ayoung | Even though the help string in the config implies that theuy do | 19:28 |
| ayoung | stevemar, so...no groups? | 19:28 |
| ayoung | that sux | 19:28 |
| stevemar | groups can be in any domain you want | 19:29 |
| stevemar | oh, you wanted users and groups to both be in the same spot | 19:29 |
| morganfainberg | kr4zy, which release are you running? | 19:29 |
| kr4zy | icehouse | 19:29 |
| stevemar | it doesn't really matter though, the users don't exist, they'll inherit roles from the group (in whatever domain the group is in) | 19:29 |
| morganfainberg | kr4zy, i think we don't cache users/group queries in icehouse. i know juno and later we have added more caching | 19:30 |
| ayoung | stevemar, I'm wondering how useful this Federated really going to be without putting groups in there, but, meh, we can always explicitly map the domain, so no big deal | 19:30 |
| *** packet has quit IRC | 19:30 | |
| morganfainberg | kr4zy, for example in master: https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L749 | 19:30 |
| morganfainberg | kr4zy, assuming you're using LDAP for identity | 19:31 |
| ayoung | OK...so I do I need to hack the KC kerberos plugin to behave like a federated plugin? I'm thinking no. | 19:31 |
| *** joesavak has joined #openstack-keystone | 19:31 | |
| *** Bsony has quit IRC | 19:31 | |
| morganfainberg | kr4zy, the list_* functions do not memoize because they can have filters applied to them. we can't cache every variation on the filters. | 19:31 |
| ayoung | stevemar, say I was doing ECP. How would I get a federated token->scoped token from the CLI? | 19:31 |
| *** topol has quit IRC | 19:33 | |
| *** edmondsw has quit IRC | 19:33 | |
| stevemar | thats a matter of using OSC and KSC | 19:35 |
| stevemar | gah, where is marek when i need him | 19:35 |
| morganfainberg | dstanek, can we move our hacking from keystone.hacking to keystone.tests.hacking? | 19:35 |
| stevemar | ayoung, look at the options for the KSC saml plugin | 19:35 |
| morganfainberg | dstanek, or is there a reason we shouldn't? | 19:35 |
| *** obedmr has quit IRC | 19:36 | |
| ayoung | stevemar, I think I need to do something similar here: I want to use the Kerberos plugin to get the --negotiate option, but the rest should be the federated work flow | 19:37 |
| morganfainberg | dstanek, and i think we need to shuffle around "policy" to be "the policy backend that serves out json blobs via REST" and "RBAC enforcement" | 19:37 |
| *** obedmr has joined #openstack-keystone | 19:38 | |
| ayoung | morganfainberg, um..the Keystone policy code actually enforce policy for us, too | 19:39 |
| ayoung | its...wierd | 19:39 |
| morganfainberg | ayoung, thats why it should be split up | 19:40 |
| morganfainberg | keystone's "enforcement" | 19:40 |
| ayoung | IN L | 19:40 |
| morganfainberg | and the REST API thing | 19:41 |
| morganfainberg | yes. in L :) | 19:41 |
| morganfainberg | dstanek, could i trouble you to jump on https://bugs.launchpad.net/keystone/+bug/1435174 | 19:41 |
| openstack | Launchpad bug 1435174 in Keystone "SSLTestCase errors when building Debian package" [Medium,Triaged] | 19:41 |
| ayoung | morganfainberg, so, one goal is to get policy enforcement into a library, or better yet, a middleware compoente. and...I think we can do it, if we just drop the part where policy checks that project matches | 19:42 |
| morganfainberg | there might be a weird dep we need to figure out what debian jessie is doing; zigo can probably help | 19:42 |
| ayoung | the problem is that the policy has to be customized for each object | 19:42 |
| morganfainberg | ayoung, it's like the i18n stuff | 19:42 |
| morganfainberg | ayoung, provide a framework, let them customize specifics | 19:42 |
| ayoung | ? | 19:42 |
| ayoung | so...yeah, sort of | 19:42 |
| ayoung | I was thinking like this: | 19:43 |
| morganfainberg | ayoung, oslo.i18n provides basic _(), we wrap it to keystone namespace | 19:43 |
| morganfainberg | just a rough example | 19:43 |
| ayoung | policy checks that the role matches, and then the code itself will check that the project matches... | 19:43 |
| ayoung | either on the request, or on the object iself | 19:43 |
| morganfainberg | anyway something to work on for L | 19:43 |
| ayoung | for create and list, proejct is in the request | 19:43 |
| morganfainberg | we have RC stuff today to deal with :) | 19:43 |
| ayoung | for delete and change, have to fetch the obejct out of the database | 19:44 |
| *** packet has joined #openstack-keystone | 19:44 | |
| ayoung | so...if we give a shim that says "check the project of your object against this value" | 19:44 |
| ayoung | we can strip policy down to the essentials | 19:44 |
| *** rushiagr is now known as rushiagr_away | 19:51 | |
| *** rushiagr_away is now known as rushiagr | 19:53 | |
| *** SlickNik has joined #openstack-keystone | 19:55 | |
| openstackgerrit | Merged openstack/keystone: Deprecate eventlet config options https://review.openstack.org/168752 | 19:55 |
| SlickNik | I had a quick question that someone here might be able to help with. | 19:56 |
| SlickNik | For keystone v3, how do I specify that the default domain for a user in a tenant is "default", so that I don't have to explicitly specify the domain when authenticating that user / tenant pair? | 19:56 |
| ayoung | stevemar, so...to do websso, I need to set the remote_id right? | 19:57 |
| stevemar | ayoung, correct-a-mundo | 20:00 |
| stevemar | ayoung, you can review my websso doc patch and follow the steps if you are setting up websso :P | 20:00 |
| ayoung | stevemar, I think nkinder was curling that in before. We have openstack cli support on the way, right? | 20:00 |
| ayoung | ah..yes | 20:00 |
| nkinder | ayoung: https://review.openstack.org/#/c/161302/ | 20:01 |
| stevemar | ayoung if you'd be so kind: https://review.openstack.org/#/c/164012/ | 20:01 |
| nkinder | the OSC support merged | 20:01 |
| ayoung | openstack-config --set /etc/keystone/keystone.conf federation remote_id_attribute MELLON_IDP | 20:01 |
| stevemar | yep, it did | 20:01 |
| stevemar | the SP support isn't there yet :( | 20:01 |
| ayoung | no longer needed then? | 20:01 |
| nkinder | ayoung: you shouldn't need curl | 20:01 |
| nkinder | I need to update my scripts for the remote_ids changes too | 20:02 |
| ayoung | nkinder, we set the value in the config file, and it is global, right? | 20:02 |
| ayoung | and now we can do it useing openstacl cli | 20:02 |
| nkinder | ayoung: you can set it per protocol | 20:02 |
| ayoung | I need an updated openstackcli | 20:02 |
| nkinder | ayoung: you are asking about remote_id_attribute, right? | 20:02 |
| ayoung | yeah | 20:02 |
| stevemar | ayoung, remote_id_attribute can be per-protocol or global. the remote_ids can be set with OSC (you need to use master) | 20:03 |
| ayoung | stevemar, I'm using devstack, so I have master for all the serfgices | 20:03 |
| ayoung | I need an updarte openstack client, as that is pip installed | 20:03 |
| ayoung | I'm guessing.. | 20:03 |
| *** jorge_munoz has joined #openstack-keystone | 20:03 | |
| ayoung | and KC? | 20:03 |
| ayoung | can't hurt to have tip of tree for those, too | 20:04 |
| nkinder | I don't think any KC changes were needed | 20:04 |
| stevemar | ayoung, if you're using devstack, be sure to set: LIBS_FROM_GIT=python-keystoneclient,python-openstackclient | 20:05 |
| stevemar | that ensure you are getting master, and not pip | 20:05 |
| ayoung | ah | 20:05 |
| ayoung | nkinder, stevemar I still need to set the value in the conf file? | 20:10 |
| ayoung | I don't see where else the attribute name could get set | 20:10 |
| stevemar | ayoung, yep | 20:11 |
| ayoung | stevemar, OPK, limitation we are going to have to move beyond in the future. Needs to be set at the Protocol level in L | 20:11 |
| stevemar | ayoung, still need to set it, either in the [federation] section or [oidc] or [saml2] | 20:11 |
| stevemar | ayoung, it's already there! :) | 20:12 |
| ayoung | stevemar, where? | 20:12 |
| ayoung | It is not in the tables? | 20:12 |
| stevemar | the trouble is, protocols are user defined ids, so we can't list them all | 20:12 |
| ayoung | ]> select * from federation_protocol; | 20:13 |
| ayoung | +---------------+--------+------------------+ | 20:13 |
| ayoung | | id | idp_id | mapping_id | | 20:13 |
| ayoung | +---------------+--------+------------------+ | 20:13 |
| ayoung | | kerberos | sssd | kerberos_mapping | | 20:13 |
| ayoung | | sssd_kerberos | sssd | kerberos_mapping | | 20:13 |
| ayoung | +---------------+--------+------------------+ | 20:13 |
| stevemar | if you create a new section [kerberos] and set remote_id_attribute it'll try that first, and default to the one under [federation] as a last resort | 20:14 |
| ayoung | interesting...I'll try that | 20:14 |
| *** kr4zy has quit IRC | 20:14 | |
| stevemar | i think we should probably restrict the protocol IDs to a set, so it's just [oidc, saml2, kerberos, ... ] | 20:15 |
| stevemar | but... meh | 20:15 |
| ayoung | stevemar, ok...so how do I test this out? | 20:16 |
| ayoung | curl --negotiate -u: horizon.cloudlab.freeipa.org:5000/v3/OS-FEDERATION/websso/kerberos | 20:17 |
| ayoung | 404 | 20:17 |
| stevemar | ayoung, almost. | 20:20 |
| stevemar | horizon.cloudlab.freeipa.org:5000/v3/auth/OS-FEDERATION/websso/kerberos | 20:20 |
| ayoung | /auth...I knew it | 20:20 |
| stevemar | this is my guess, everything 404's for me :) you and your intranet | 20:21 |
| ayoung | this is all internal | 20:21 |
| ayoung | just a hostname I've co-opted | 20:21 |
| ayoung | I'll get it working on dreamhost before the summit | 20:22 |
| stevemar | i expect no less | 20:22 |
| *** rushiagr is now known as rushiagr_away | 20:23 | |
| morganfainberg | stevemar, ayoung, annnnn sent: http://lists.openstack.org/pipermail/openstack-dev/2015-April/060537.html | 20:33 |
| stevemar | whammy | 20:34 |
| *** ChanServ changes topic to "High Priority Reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Review RC Blocking Reviews. | RC Milestone: https://launchpad.net/keystone/+milestone/kilo-rc1 | PTL Election Season - Send candidacy email if you intend to run!" | 20:35 | |
| morganfainberg | wow gmail ate the formatting there :( | 20:35 |
| * morganfainberg is sad. | 20:35 | |
| ayoung | morganfainberg, you sure you wanna do this? | 20:36 |
| morganfainberg | too late now ;) | 20:36 |
| morganfainberg | ayoung, yeah. | 20:36 |
| morganfainberg | ayoung, unless you want to. | 20:36 |
| ayoung | Glutton | 20:36 |
| morganfainberg | ayoung, run if you want! :P | 20:36 |
| mtreinish | morganfainberg: it looks ok on my mail client. Just a lot of white space :) | 20:36 |
| morganfainberg | mtreinish, yeah the extra whitespace is what happened | 20:36 |
| morganfainberg | mtreinish, it didn't look like that when i wrote it. | 20:36 |
| mtreinish | oh and the stupid unicode ' that all the mac people use by default | 20:37 |
| morganfainberg | mtreinish, HAH | 20:37 |
| mtreinish | which I still haven't figured out why it isn't rendered correctly on my laptop | 20:37 |
| morganfainberg | mtreinish, i keep disabling that then it keeps getting re-enabled | 20:37 |
| morganfainberg | mtreinish, it's annoying | 20:37 |
| *** Bsony has joined #openstack-keystone | 20:37 | |
| ayoung | morganfainberg, I started up a campaign speech. I started something like "Why do I want to be the PTL? I don't." | 20:37 |
| morganfainberg | ayoung, LOL | 20:37 |
| morganfainberg | mtreinish, yeah it doubled all the new-lines somehow | 20:38 |
| morganfainberg | mtreinish, *shrug* oh well | 20:38 |
| mtreinish | ayoung: heh, that reminds me when I ran for school treasurer in high school on a platform of "I can count" :) | 20:39 |
| mtreinish | morganfainberg: yeah I think it's fine, who even reads them :) | 20:40 |
| morganfainberg | mtreinish, depends on if we hafve more than one person running | 20:40 |
| morganfainberg | :P | 20:40 |
| morganfainberg | ayoung, my campaign speech for the M-cycle is likely going to be "I am letting someone else steer this ship" | 20:44 |
| ayoung | We'll plan accordingly | 20:44 |
| morganfainberg | ayoung, yeah i don't want to burn out | 20:44 |
| morganfainberg | i think i can do 2 cycles | 20:44 |
| morganfainberg | but 3 might be too much | 20:44 |
| *** atiwari1 has joined #openstack-keystone | 20:55 | |
| *** atiwari2 has quit IRC | 20:57 | |
| *** packet has quit IRC | 20:58 | |
| *** packet has joined #openstack-keystone | 21:04 | |
| ayoung | stevemar, "Missing entity ID from environment" | 21:04 |
| ayoung | calling this way | 21:04 |
| ayoung | curl --negotiate -u: horizon.cloudlab.freeipa.org:5000/v3/auth/OS-FEDERATION/websso/kerberos?origin=http://horizon.cloudlab.freeipa.org/auth/websso/ | 21:05 |
| stevemar | ayoung, apparently it can't fine your remote_id_attribute in the env | 21:05 |
| stevemar | find* | 21:06 |
| ayoung | OK, so it is that | 21:06 |
| ayoung | I have | 21:06 |
| stevemar | jeez i can't type today | 21:06 |
| ayoung | remote_id_attribute = IDP_ID | 21:06 |
| ayoung | and in the httpd conf | 21:06 |
| ayoung | ^^ was under federation, although I have the same thing in [kerberos] | 21:06 |
| *** packet has quit IRC | 21:07 | |
| ayoung | Ah. | 21:07 |
| stevemar | remote_id_attribute should be something like X-Shib-IdP or MOD_MELLON_IDP one of the env. vars | 21:07 |
| ayoung | stevemar, so, I would need to set that value for the whole Horizon server, not just the kerberized ur; | 21:07 |
| stevemar | you're losing me now | 21:07 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix for notifications for v2 role grant/delete https://review.openstack.org/166934 | 21:10 |
| *** joesavak has quit IRC | 21:10 | |
| *** atiwari2 has joined #openstack-keystone | 21:10 | |
| ayoung | stevemar, I set the value in the apache conf, but in the wrong place | 21:10 |
| ayoung | I ended up putting in in the :5000 section, but outside ther kerberos stanze | 21:10 |
| ayoung | <VirtualHost *:5000> | 21:11 |
| *** _cjones_ has quit IRC | 21:11 | |
| *** henrynash has joined #openstack-keystone | 21:11 | |
| *** ChanServ sets mode: +v henrynash | 21:11 | |
| ayoung | SetEnv IDP_ID SSSD | 21:11 |
| *** _cjones_ has joined #openstack-keystone | 21:11 | |
| *** atiwari1 has quit IRC | 21:13 | |
| stevemar | ayoung, wow, i had no idea you could just do that :( | 21:13 |
| stevemar | TIL... | 21:13 |
| ayoung | stevemar, this blog post should have all the steps in it once I'm done | 21:13 |
| stevemar | ayoung, awesome. I was going to do one, maybe i still will /me shrugs | 21:14 |
| stevemar | ayoung, have you been using the patch i proposed as a guide? | 21:14 |
| ayoung | stevemar, heh, let me get this one done first, and you can write one that is actually legible | 21:14 |
| ayoung | nah | 21:14 |
| ayoung | I was using nkinder's script | 21:14 |
| stevemar | d'oh! | 21:15 |
| ayoung | but only this little bit overlaps | 21:15 |
| ayoung | most of it has been the SSSD and Kerberos setup | 21:15 |
| ayoung | which is different from what you posted | 21:15 |
| ayoung | only now am I getting close, but it is still specific to the federation method. | 21:15 |
| stevemar | hehe, that's fair, if you can double check your write up with what's covered in this patch: https://review.openstack.org/#/c/164012/ that would be awesome-o | 21:15 |
| ayoung | stevemar, I knew to set trusted_dashboard | 21:17 |
| stevemar | \o/ | 21:17 |
| ayoung | and I will probably use your doc as a checklist once I get to Horizon itself | 21:18 |
| ayoung | right now I get | 21:18 |
| *** henrynash has quit IRC | 21:18 | |
| ayoung | http://paste.openstack.org/show/197990/ stevemar | 21:18 |
| ayoung | let me make sure the other stuff still works...I bet I need that url under kerberos as well | 21:19 |
| ayoung | and...yuck, I don't think I can do it in one config block in apachje | 21:19 |
| ayoung | stevemar, tell, me,. would the controller at /v3/auth/OS-FEDERATION/websso/kerberos expect to have the saml assertion? | 21:20 |
| ayoung | if it were saml? | 21:20 |
| morganfainberg | is lance on vacation? | 21:20 |
| * morganfainberg just noticed he wasn't here. | 21:20 | |
| *** Bsony has quit IRC | 21:21 | |
| ayoung | it would, cuz the user would go to that url, and mod_mellon would redirect them, and then ipsilon would direct it back | 21:21 |
| * morganfainberg goes and gets food and coffee. | 21:21 | |
| *** henrynash has joined #openstack-keystone | 21:21 | |
| *** ChanServ sets mode: +v henrynash | 21:21 | |
| morganfainberg | stevemar, going to bug you so we can hammer out the bugs for RC later today/this evening | 21:21 |
| ayoung | stevemar, can we move (or duplicate) the /auth to under OS-FEDERATION? | 21:21 |
| morganfainberg | ayoung, ^ you too if you're not in dad-mode by then. | 21:22 |
| ayoung | morganfainberg, get food and coffee>? OK I can do that | 21:22 |
| morganfainberg | ayoung, haha yes. but the rc-bug dogpile too | 21:22 |
| ayoung | morganfainberg, I'll try. | 21:22 |
| morganfainberg | ayoung, if not anything lingering we can hit tomorrow morning | 21:23 |
| morganfainberg | ayoung, if you're around i'll bug ya, if not, no big deal | 21:23 |
| ayoung | nkinder, do you know how to write an apache path expression that will match both /v3/OS-FEDERATION/identity_providers/sssd/protocols/kerberos/auth and /v3/auth/OS-FEDERATION/websso/kerberos | 21:23 |
| stevemar | ayoung, sorry, got up for a sec | 21:23 |
| stevemar | morganfainberg, yeah, that fine, bug away | 21:23 |
| stevemar | ayoung, should be possible to write that | 21:24 |
| *** SlickNik has left #openstack-keystone | 21:24 | |
| ayoung | stevemar, yeah, I'm RTFM ATM | 21:25 |
| ayoung | Regular expressions can also be used, with the addition of the ~ character. For example: | 21:25 |
| *** SlickNik has joined #openstack-keystone | 21:25 | |
| *** iamjarvo has quit IRC | 21:26 | |
| *** ayoung has quit IRC | 21:30 | |
| *** topol has joined #openstack-keystone | 21:30 | |
| *** ChanServ sets mode: +v topol | 21:30 | |
| *** mgagne has quit IRC | 21:33 | |
| *** adam_g has quit IRC | 21:34 | |
| *** tqtran_ has joined #openstack-keystone | 21:34 | |
| *** g2` has quit IRC | 21:34 | |
| *** dougwig has quit IRC | 21:35 | |
| *** cyeoh has quit IRC | 21:35 | |
| *** hockeynut has quit IRC | 21:35 | |
| *** crinkle_ has joined #openstack-keystone | 21:36 | |
| *** morganfainberg has quit IRC | 21:37 | |
| *** rm_work has quit IRC | 21:37 | |
| *** morganfainberg has joined #openstack-keystone | 21:37 | |
| *** ChanServ sets mode: +v morganfainberg | 21:37 | |
| *** crinkle has quit IRC | 21:38 | |
| *** crinkle_ is now known as crinkle | 21:38 | |
| *** krtaylor has quit IRC | 21:38 | |
| *** lbragstad has quit IRC | 21:38 | |
| *** comstud has quit IRC | 21:38 | |
| *** tqtran has quit IRC | 21:38 | |
| *** jasondotstar has quit IRC | 21:38 | |
| *** amaurymedeiros has quit IRC | 21:38 | |
| *** gus has quit IRC | 21:38 | |
| *** amauryme` has joined #openstack-keystone | 21:38 | |
| *** henrynash has quit IRC | 21:39 | |
| *** gus has joined #openstack-keystone | 21:39 | |
| *** jasondotstar has joined #openstack-keystone | 21:39 | |
| *** comstud has joined #openstack-keystone | 21:39 | |
| *** lbragstad has joined #openstack-keystone | 21:39 | |
| *** g2` has joined #openstack-keystone | 21:39 | |
| *** hockeynut has joined #openstack-keystone | 21:39 | |
| *** adam_g has joined #openstack-keystone | 21:40 | |
| *** adam_g has quit IRC | 21:40 | |
| *** adam_g has joined #openstack-keystone | 21:40 | |
| *** mgagne has joined #openstack-keystone | 21:40 | |
| *** cyeoh has joined #openstack-keystone | 21:40 | |
| *** atiwari1 has joined #openstack-keystone | 21:40 | |
| *** rm_work has joined #openstack-keystone | 21:41 | |
| *** rm_work has quit IRC | 21:41 | |
| *** rm_work has joined #openstack-keystone | 21:41 | |
| *** krtaylor has joined #openstack-keystone | 21:41 | |
| *** atiwari2 has quit IRC | 21:42 | |
| *** atiwari2 has joined #openstack-keystone | 21:43 | |
| *** henrynash has joined #openstack-keystone | 21:44 | |
| *** ChanServ sets mode: +v henrynash | 21:44 | |
| *** dougwig has joined #openstack-keystone | 21:45 | |
| *** atiwari1 has quit IRC | 21:46 | |
| *** spandhe has quit IRC | 21:51 | |
| *** gordc has quit IRC | 21:53 | |
| *** henrynash has quit IRC | 21:54 | |
| *** spandhe has joined #openstack-keystone | 21:54 | |
| *** gordc has joined #openstack-keystone | 21:54 | |
| *** zzzeek has quit IRC | 21:59 | |
| *** gordc has quit IRC | 22:04 | |
| *** packet has joined #openstack-keystone | 22:12 | |
| *** __TheDodd__ has quit IRC | 22:19 | |
| *** bknudson has quit IRC | 22:22 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:27 | |
| *** packet has quit IRC | 22:33 | |
| *** obedmr has quit IRC | 23:16 | |
| *** ayoung has joined #openstack-keystone | 23:32 | |
| *** ChanServ sets mode: +v ayoung | 23:32 | |
| *** _cjones_ has quit IRC | 23:34 | |
| openstackgerrit | Merged openstack/keystone: Drop sql.transaction() usage in migration https://review.openstack.org/168987 | 23:43 |
| *** arunkant_ has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!