| *** browne has quit IRC | 00:01 | |
| *** shoutm has joined #openstack-keystone | 00:01 | |
| *** browne has joined #openstack-keystone | 00:02 | |
| *** jamielennox|away is now known as jamielennox | 00:02 | |
| *** jrist has quit IRC | 00:09 | |
| *** Guest80711 is now known as med_ | 00:15 | |
| *** med_ has quit IRC | 00:15 | |
| *** med_ has joined #openstack-keystone | 00:15 | |
| *** fpatwa has joined #openstack-keystone | 00:31 | |
| *** spzala has quit IRC | 00:32 | |
| *** spzala has joined #openstack-keystone | 00:32 | |
| *** jed56 has quit IRC | 00:33 | |
| *** shoutm has quit IRC | 00:35 | |
| *** spzala has quit IRC | 00:36 | |
| *** shoutm has joined #openstack-keystone | 00:37 | |
| *** jamielennox is now known as jamielennox|away | 00:38 | |
| *** jamielennox|away is now known as jamielennox | 00:39 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use positional instead of keystoneclient version https://review.openstack.org/275455 | 00:46 |
|---|---|---|
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Make WebSSO trusted_dashboard hostname case-insensitive https://review.openstack.org/273394 | 00:47 |
| *** EinstCrazy has joined #openstack-keystone | 00:50 | |
| *** fpatwa has quit IRC | 00:54 | |
| *** EinstCrazy has quit IRC | 00:55 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Deprecate adapter https://review.openstack.org/258742 | 01:09 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Deprecate auth plugins from keystoneclient https://review.openstack.org/258693 | 01:09 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Deprecate Session https://review.openstack.org/258692 | 01:09 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Make AuthContext depend on auth_token middleware https://review.openstack.org/255686 | 01:11 |
| *** ninag has quit IRC | 01:12 | |
| openstackgerrit | Dina Belova proposed openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 01:21 |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Make WebSSO trusted_dashboard hostname case-insensitive https://review.openstack.org/273394 | 01:22 |
| *** davechen has joined #openstack-keystone | 01:24 | |
| *** spzala has joined #openstack-keystone | 01:26 | |
| *** jamielennox is now known as jamielennox|away | 01:30 | |
| notmorgan | jamielennox|away: http://codesearch.openstack.org/?q=from%20keystoneclient%20import%20session&i=nope&files=&repos= not a ton to cleanup | 01:32 |
| notmorgan | jamielennox|away: looks like it's almost all clinets now | 01:32 |
| notmorgan | jamielennox|away: i'm goin to hit swift and nova with a bat on this. | 01:32 |
| notmorgan | jamielennox|away: then i think we can deprecate session | 01:32 |
| *** jsavak has joined #openstack-keystone | 01:40 | |
| notmorgan | jamielennox|away: not that swiftclient uses ksc.session | 01:42 |
| *** jsavak has quit IRC | 01:45 | |
| *** jsavak has joined #openstack-keystone | 01:45 | |
| *** su_zhang has quit IRC | 01:48 | |
| *** csoukup_ has joined #openstack-keystone | 01:55 | |
| *** _cjones_ has quit IRC | 02:01 | |
| *** EinstCrazy has joined #openstack-keystone | 02:17 | |
| *** browne has quit IRC | 02:18 | |
| *** jsavak has quit IRC | 02:24 | |
| *** jsavak has joined #openstack-keystone | 02:24 | |
| *** jamielennox|away is now known as jamielennox | 02:31 | |
| *** woodster_ has joined #openstack-keystone | 02:37 | |
| *** miyagishi_t has joined #openstack-keystone | 02:37 | |
| *** jsavak has quit IRC | 02:38 | |
| *** dims_ has quit IRC | 02:40 | |
| *** bill_az has quit IRC | 02:55 | |
| *** shoutm has quit IRC | 02:57 | |
| *** shoutm has joined #openstack-keystone | 03:00 | |
| *** links has joined #openstack-keystone | 03:06 | |
| *** browne has joined #openstack-keystone | 03:10 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Use positional instead of keystoneclient version https://review.openstack.org/275455 | 03:24 |
| *** gyee has quit IRC | 03:28 | |
| *** amakarov has quit IRC | 03:30 | |
| openstackgerrit | Merged openstack/keystone: Allow '_' character in mapping_id value https://review.openstack.org/264937 | 03:30 |
| *** doug-fish has quit IRC | 03:34 | |
| *** doug-fish has joined #openstack-keystone | 03:35 | |
| *** doug-fish has quit IRC | 03:36 | |
| ayoung | SCORE ! https://review.openstack.org/#/c/213175/ Triple Keystone HTTPD Passed CI. For HA. By By Keystone Eventlet! | 03:37 |
| ayoung | notmorgan, now please get Implied roles moving? https://review.openstack.org/#/c/213175/ | 03:37 |
| *** gyee has joined #openstack-keystone | 03:38 | |
| *** ChanServ sets mode: +v gyee | 03:38 | |
| *** jrist has joined #openstack-keystone | 03:39 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/272790 | 03:39 |
| stevemar | ayoung: maybe use a #success | 03:41 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/272825 | 03:43 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 03:46 |
| *** esp_ has joined #openstack-keystone | 03:47 | |
| *** Nirupama has joined #openstack-keystone | 03:48 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Make WebSSO trusted_dashboard hostname case-insensitive https://review.openstack.org/273394 | 03:50 |
| notmorgan | ayoung: I warn you I am hitting implied roles from a strict security perspective if I review it. I won't +2 without another core +2. But if I don't see flaws I will +1 until there are other eyes on it. | 03:50 |
| notmorgan | ayoung: but it also has to wait till I pack/start laundry for my trip tomorrow. | 03:51 |
| *** esp_ has quit IRC | 03:51 | |
| *** diazjf has quit IRC | 04:01 | |
| openstackgerrit | guang-yee proposed openstack/keystone: wsgi: fix base_url finding https://review.openstack.org/226464 | 04:06 |
| *** gyee has quit IRC | 04:07 | |
| *** jamielennox is now known as jamielennox|away | 04:09 | |
| *** su_zhang has joined #openstack-keystone | 04:13 | |
| *** spzala has quit IRC | 04:14 | |
| *** spzala has joined #openstack-keystone | 04:15 | |
| *** su_zhang has quit IRC | 04:15 | |
| *** su_zhang has joined #openstack-keystone | 04:16 | |
| notmorgan | lbragstad: https://review.openstack.org/#/c/275497/ | 04:17 |
| lbragstad | notmorgan nice - just saw that | 04:18 |
| lbragstad | notmorgan thanks! | 04:18 |
| notmorgan | :) | 04:18 |
| *** spzala has quit IRC | 04:19 | |
| notmorgan | lbragstad: https://media.giphy.com/media/l2JI9xpp6lbqi7984/giphy.gif | 04:20 |
| notmorgan | lbragstad: super important link! | 04:20 |
| lbragstad | bookmarked | 04:20 |
| *** su_zhang_ has joined #openstack-keystone | 04:26 | |
| *** su_zhang has quit IRC | 04:27 | |
| *** diazjf has joined #openstack-keystone | 04:32 | |
| *** diazjf has quit IRC | 04:33 | |
| *** diazjf has joined #openstack-keystone | 04:35 | |
| stevemar | hummm https://blueprints.launchpad.net/keystone/+spec/access-key-authentication | 04:42 |
| lhcheng | stevemar: ebay also have a similar thing like that - access keys | 04:43 |
| stevemar | interesting | 04:43 |
| stevemar | just looking at old blueprints | 04:43 |
| stevemar | like this one https://blueprints.launchpad.net/keystone/+spec/endpoint-cert | 04:43 |
| lhcheng | stevemar: tokenless auth using x509, that's available | 04:44 |
| stevemar | yeah, i was wondering if we could mark it as superceded | 04:44 |
| lhcheng | and the base code for tokenless auth should allow for other types, like access key. | 04:45 |
| stevemar | ayoung: ^ your bp, what do you say | 04:45 |
| lhcheng | since we already have the capability for access key to be plugged-in, I think that should be enough from keystone. we don't need to implement access key. | 04:45 |
| lhcheng | the tokenless auth allows plugging-in for different protocol, from our side, I think its done. | 04:46 |
| stevemar | lhcheng: what aobut https://blueprints.launchpad.net/keystone/+spec/session-extendable-tokens | 04:51 |
| *** EinstCrazy has quit IRC | 04:53 | |
| *** jasonsb has joined #openstack-keystone | 04:53 | |
| lhcheng | stevemar: might be useful, its not a deal breaker for horizon. they won't likely spend an hour using horizon. if the token expires, we'll just redirect them to the login page. | 04:55 |
| lhcheng | this could help the issue with long running operations that some projects hits into | 04:55 |
| stevemar | mmm alright | 04:55 |
| openstackgerrit | Merged openstack/keystone: Revert "Unit test for checking cross-version migrations compatibility" https://review.openstack.org/274079 | 05:04 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 05:06 |
| *** Nirupama has quit IRC | 05:07 | |
| *** jrist has quit IRC | 05:08 | |
| *** jrist has joined #openstack-keystone | 05:08 | |
| *** shoutm_ has joined #openstack-keystone | 05:14 | |
| *** spzala has joined #openstack-keystone | 05:15 | |
| *** shoutm has quit IRC | 05:16 | |
| *** spzala has quit IRC | 05:21 | |
| *** jasonsb has quit IRC | 05:21 | |
| *** Nirupama has joined #openstack-keystone | 05:22 | |
| *** roxanagh_ has joined #openstack-keystone | 05:26 | |
| *** vgridnev has joined #openstack-keystone | 05:44 | |
| *** diazjf has quit IRC | 05:47 | |
| stevemar | ayoung: i'm pretty sure you create one blueprint per week | 05:48 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/272790 | 05:51 |
| *** roxanagh_ has quit IRC | 05:55 | |
| *** shoutm has joined #openstack-keystone | 06:00 | |
| *** jasonsb has joined #openstack-keystone | 06:04 | |
| *** shoutm_ has quit IRC | 06:04 | |
| stevemar | jamielennox|away: around | 06:16 |
| stevemar | i guess not :( | 06:16 |
| *** woodster_ has quit IRC | 06:16 | |
| *** spzala has joined #openstack-keystone | 06:18 | |
| *** spzala has quit IRC | 06:23 | |
| stevemar | notmorgan: got blueprints down to 69! | 06:26 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/275517 | 06:35 |
| *** jbell8 has joined #openstack-keystone | 06:40 | |
| *** oomichi has joined #openstack-keystone | 06:47 | |
| *** henrynash has quit IRC | 06:51 | |
| *** henrynash has joined #openstack-keystone | 06:51 | |
| *** ChanServ sets mode: +v henrynash | 06:51 | |
| henrynash | stevemar: you still up? | 06:51 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: clean up spec repo https://review.openstack.org/275526 | 06:53 |
| stevemar | henrynash: yep | 06:53 |
| stevemar | henrynash: whats up senōr | 06:57 |
| openstackgerrit | Merged openstack/keystone-specs: clean up spec repo https://review.openstack.org/275526 | 07:00 |
| henrynash | stevemar: imlied roles API….I think (despite the suggestions about alternatives) is something we should merge (the backend changes are already merged). We have two +2s, and it is an agreed spec and marked as experimental. Fujitsu ScanSnap iX500 | 07:02 |
| henrynash | oops | 07:02 |
| henrynash | stevemar: https://review.openstack.org/#/c/242614/73 | 07:02 |
| henrynash | stevemar: ignore the Fujitsu scanner quote! | 07:02 |
| stevemar | henrynash: i'm looking at it now, my alarms were raised when you and guang both +2'ed | 07:02 |
| stevemar | henrynash: but now i want that fujitsu scanner | 07:02 |
| stevemar | henrynash: so, release notes? | 07:03 |
| henrynash | stevemar: :-) I’ll tell you if it’s any good! | 07:03 |
| henrynash | stevemar: fair comment, we do need an rn | 07:03 |
| stevemar | henrynash: is it sufficiently documented? or just via specs/api? | 07:04 |
| henrynash | stevemar: I think it is just the specs/api….we an certainly add more, if required (a rn for sure)... | 07:05 |
| stevemar | henrynash: root_role eh | 07:06 |
| *** browne has quit IRC | 07:06 | |
| *** gildub has quit IRC | 07:08 | |
| *** lbragstad has quit IRC | 07:16 | |
| henrynash | stevemar: happy to work with Adam on follow-up release notes, if that’s the only issue | 07:18 |
| *** lbragstad has joined #openstack-keystone | 07:21 | |
| openstackgerrit | Merged openstack/keystone: Make WebSSO trusted_dashboard hostname case-insensitive https://review.openstack.org/273394 | 07:23 |
| stevemar | henrynash: +W | 07:23 |
| henrynash | stevemar: thx | 07:24 |
| openstackgerrit | lokesh s proposed openstack/pycadf: Adding ironic api specific audit map configuration https://review.openstack.org/275538 | 07:27 |
| openstackgerrit | lokesh s proposed openstack/pycadf: Adding ironic api specific audit map configuration https://review.openstack.org/275538 | 07:29 |
| *** shoutm has quit IRC | 07:30 | |
| *** shoutm has joined #openstack-keystone | 07:31 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: test_credential.py work with python34 https://review.openstack.org/271965 | 07:37 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Consolidate `test_contrib_ec2.py` into `test_credential.py` https://review.openstack.org/271886 | 07:37 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Initialize the policy engine where it is needed https://review.openstack.org/275541 | 07:37 |
| *** shoutm has quit IRC | 07:44 | |
| *** shoutm has joined #openstack-keystone | 07:45 | |
| *** wanghua has joined #openstack-keystone | 07:45 | |
| *** belmoreira has joined #openstack-keystone | 07:47 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 07:47 |
| *** richm has joined #openstack-keystone | 07:49 | |
| *** jbell8 has quit IRC | 07:52 | |
| *** mvk_ has quit IRC | 07:56 | |
| openstackgerrit | venkatamahesh proposed openstack/keystone: Fix some word spellings https://review.openstack.org/275548 | 08:04 |
| *** jistr has joined #openstack-keystone | 08:14 | |
| *** boris-42 has joined #openstack-keystone | 08:18 | |
| *** spzala has joined #openstack-keystone | 08:20 | |
| *** jistr is now known as jistr|mtg | 08:22 | |
| *** sinese has joined #openstack-keystone | 08:25 | |
| *** spzala has quit IRC | 08:25 | |
| *** davechen has left #openstack-keystone | 08:27 | |
| *** mvk_ has joined #openstack-keystone | 08:27 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 08:29 |
| *** lars2 has left #openstack-keystone | 08:30 | |
| *** miyagishi_t has quit IRC | 08:31 | |
| *** vgridnev has quit IRC | 08:32 | |
| *** su_zhang_ has quit IRC | 08:33 | |
| *** fhubik has joined #openstack-keystone | 08:36 | |
| *** oomichi is now known as oomichi_away | 08:38 | |
| *** shoutm has quit IRC | 08:39 | |
| *** jaosorior has joined #openstack-keystone | 08:39 | |
| *** Nirupama has quit IRC | 08:58 | |
| *** EinstCrazy has joined #openstack-keystone | 09:01 | |
| openstackgerrit | lokesh s proposed openstack/pycadf: Adding ironic api specific audit map configuration https://review.openstack.org/275538 | 09:04 |
| *** Nirupama has joined #openstack-keystone | 09:14 | |
| *** chlong has quit IRC | 09:20 | |
| *** lhcheng has quit IRC | 09:27 | |
| *** EinstCrazy has quit IRC | 09:29 | |
| *** EinstCrazy has joined #openstack-keystone | 09:29 | |
| *** esp_ has joined #openstack-keystone | 09:32 | |
| *** esp_ has quit IRC | 09:39 | |
| *** e0ne has joined #openstack-keystone | 09:45 | |
| *** vgridnev has joined #openstack-keystone | 09:51 | |
| *** jaosorior has quit IRC | 09:53 | |
| *** jaosorior has joined #openstack-keystone | 09:54 | |
| *** gildub has joined #openstack-keystone | 09:58 | |
| *** vivekd has joined #openstack-keystone | 10:00 | |
| *** e0ne has quit IRC | 10:05 | |
| *** jaosorior has quit IRC | 10:09 | |
| *** vgridnev_ has joined #openstack-keystone | 10:14 | |
| *** vgridnev has quit IRC | 10:14 | |
| *** jaosorior has joined #openstack-keystone | 10:16 | |
| *** spzala has joined #openstack-keystone | 10:22 | |
| *** spzala has quit IRC | 10:27 | |
| *** fhubik is now known as fhubik_brb | 10:29 | |
| *** fhubik_brb is now known as fhubik | 10:29 | |
| *** d0ugal has quit IRC | 10:42 | |
| *** d0ugal has joined #openstack-keystone | 10:42 | |
| *** fhubik is now known as fhubik_brb | 10:46 | |
| *** fhubik_brb is now known as fhubik | 10:47 | |
| *** fhubik is now known as fhubik_brb | 10:47 | |
| *** fhubik has joined #openstack-keystone | 10:50 | |
| *** fhubik_brb has quit IRC | 10:50 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 10:51 |
| *** e0ne has joined #openstack-keystone | 10:51 | |
| *** vgridnev_ has quit IRC | 10:52 | |
| *** vgridnev_ has joined #openstack-keystone | 10:54 | |
| *** jaosorior has quit IRC | 10:58 | |
| *** jaosorior has joined #openstack-keystone | 10:59 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 11:03 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 11:03 |
| openstackgerrit | Chris Dent proposed openstack/keystonemiddleware: Remove clobbering of passed oslo_config_config https://review.openstack.org/274396 | 11:09 |
| *** mhickey has joined #openstack-keystone | 11:12 | |
| *** cdent has joined #openstack-keystone | 11:12 | |
| cdent | bknudson_, jamielennox|away : I've updated https://review.openstack.org/#/c/274396/ to make it a bit less crufty | 11:13 |
| *** tyagiprince has joined #openstack-keystone | 11:16 | |
| tyagiprince | Hi everyone.. I want to know if groups can be created in keystone kilo version.. | 11:17 |
| tyagiprince | I found the code to create a group in keystoneclient directory. There exists a group.py file in v3 folder. I want to know if there is any command which can help me create a group. | 11:20 |
| *** jaosorior has quit IRC | 11:21 | |
| *** jistr|mtg has quit IRC | 11:27 | |
| *** clenimar has joined #openstack-keystone | 11:28 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service providers groups associations https://review.openstack.org/275636 | 11:29 |
| *** topol has quit IRC | 11:36 | |
| *** topol_ has joined #openstack-keystone | 11:37 | |
| *** boris-42 has quit IRC | 11:43 | |
| *** pnavarro has joined #openstack-keystone | 11:44 | |
| *** vivekd_ has joined #openstack-keystone | 11:44 | |
| *** vivekd has quit IRC | 11:45 | |
| *** vivekd_ is now known as vivekd | 11:45 | |
| *** samueldmq has joined #openstack-keystone | 11:46 | |
| *** samueldmq has left #openstack-keystone | 11:47 | |
| *** samueldmq has joined #openstack-keystone | 11:47 | |
| samueldmq | ayoung: about https://review.openstack.org/#/c/275335/ | 11:47 |
| samueldmq | btw, morning all | 11:48 |
| samueldmq | ayoung: I remember you mentioned yesterday that some services needed admin role, and that was related to log-running operations | 11:48 |
| samueldmq | ayoung: I wanted to understand that better | 11:48 |
| *** topol_ has quit IRC | 11:50 | |
| *** topol_ has joined #openstack-keystone | 11:54 | |
| samueldmq | henrynash: hi, about policies yesterday's discussion in the meeting :) | 11:56 |
| *** vivekd_ has joined #openstack-keystone | 12:00 | |
| *** vivekd has quit IRC | 12:04 | |
| *** vivekd_ is now known as vivekd | 12:04 | |
| *** rodrigods has quit IRC | 12:11 | |
| *** rodrigods has joined #openstack-keystone | 12:11 | |
| *** links has quit IRC | 12:11 | |
| *** fhubik is now known as fhubik_brb | 12:17 | |
| *** raildo-afk is now known as raildo | 12:17 | |
| *** spzala has joined #openstack-keystone | 12:24 | |
| *** gildub has quit IRC | 12:25 | |
| dstanek | dammit stevemar, you got to the specs before i had a chance | 12:26 |
| *** spzala has quit IRC | 12:30 | |
| *** mhickey_ has joined #openstack-keystone | 12:32 | |
| *** dims has joined #openstack-keystone | 12:32 | |
| samueldmq | dstanek: stevemar: yeah, nice cleanup | 12:33 |
| samueldmq | BTW, do we have a policy for abandoning old changes ? | 12:33 |
| samueldmq | like: negative score and no updates in the last X days ? | 12:33 |
| *** clenimar has quit IRC | 12:34 | |
| *** mhickey has quit IRC | 12:34 | |
| *** clenimar has joined #openstack-keystone | 12:34 | |
| dstanek | samueldmq: i don't know about official, but i've seen people do it after 60 days. if it's a bugfix i try to take it over rather than lose it | 12:35 |
| samueldmq | dstanek: nice, sounds a very good approach | 12:35 |
| -openstackstatus- NOTICE: Infra running with lower capacity now, due to a temporary problem affecting one of our nodepool providers. Please expect some delays in your jobs. Apologies for any inconvenience caused. | 12:40 | |
| samueldmq | openstackstatus: :( | 12:41 |
| *** pauloewerton has joined #openstack-keystone | 12:43 | |
| *** ChanServ sets mode: +v topol_ | 12:48 | |
| *** topol_ is now known as topol | 12:48 | |
| *** henrynash has quit IRC | 12:50 | |
| *** daemontool has joined #openstack-keystone | 12:52 | |
| *** sinese has quit IRC | 12:56 | |
| *** jaosorior has joined #openstack-keystone | 12:57 | |
| *** sinese has joined #openstack-keystone | 12:57 | |
| *** samueldmq has quit IRC | 12:59 | |
| *** bill_az has joined #openstack-keystone | 13:00 | |
| *** sinese_ has joined #openstack-keystone | 13:01 | |
| *** openstackgerrit has quit IRC | 13:02 | |
| *** openstackgerrit has joined #openstack-keystone | 13:02 | |
| *** sinese has quit IRC | 13:04 | |
| *** fhubik_brb is now known as fhubik | 13:05 | |
| *** gildub has joined #openstack-keystone | 13:06 | |
| *** tyagiprince has quit IRC | 13:11 | |
| *** jistr|mtg has joined #openstack-keystone | 13:12 | |
| *** jsavak has joined #openstack-keystone | 13:26 | |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Added CORS support to Keystone https://review.openstack.org/241317 | 13:27 |
| *** gordc has joined #openstack-keystone | 13:29 | |
| *** erlarese has joined #openstack-keystone | 13:30 | |
| *** tyagiprince has joined #openstack-keystone | 13:34 | |
| dims | folks, i see a release request, any cores agree/disagree? https://review.openstack.org/#/c/275685/ | 13:35 |
| *** sinese_ has quit IRC | 13:36 | |
| *** edmondsw has joined #openstack-keystone | 13:38 | |
| *** daemontool has quit IRC | 13:39 | |
| *** sinese_ has joined #openstack-keystone | 13:39 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move region configuration to a critical section https://review.openstack.org/222173 | 13:40 |
| *** vivekd has quit IRC | 13:46 | |
| openstackgerrit | Clenimar Filemon Sousa proposed openstack/keystone: Allow deleting specific project assignment type https://review.openstack.org/275706 | 13:51 |
| *** fhubik is now known as fhubik_brb | 13:51 | |
| *** fhubik_brb is now known as fhubik | 13:56 | |
| *** spzala has joined #openstack-keystone | 13:58 | |
| *** spzala has quit IRC | 13:58 | |
| *** spzala has joined #openstack-keystone | 13:58 | |
| *** petertr7_away is now known as petertr7 | 14:01 | |
| *** Nirupama has quit IRC | 14:05 | |
| *** henrynash has joined #openstack-keystone | 14:06 | |
| *** ChanServ sets mode: +v henrynash | 14:06 | |
| *** ninag has joined #openstack-keystone | 14:06 | |
| *** daemontool has joined #openstack-keystone | 14:10 | |
| *** csoukup_ has quit IRC | 14:12 | |
| henrynash | samuedlmq: hi | 14:14 |
| *** jistr|mtg is now known as jistr | 14:20 | |
| *** su_zhang has joined #openstack-keystone | 14:23 | |
| *** vgridnev_ has quit IRC | 14:27 | |
| *** vgridnev_ has joined #openstack-keystone | 14:27 | |
| *** daemontool has quit IRC | 14:27 | |
| *** fhubik is now known as fhubik_brb | 14:43 | |
| *** fhubik_brb is now known as fhubik | 14:43 | |
| *** fhubik is now known as fhubik_brb | 14:49 | |
| *** fhubik_brb is now known as fhubik | 14:49 | |
| *** anteaya has quit IRC | 14:49 | |
| *** samueldmq has joined #openstack-keystone | 14:51 | |
| *** tyagiprince has quit IRC | 14:52 | |
| ayoung | what is the thing for adding release notes again? | 14:54 |
| *** anteaya has joined #openstack-keystone | 14:54 | |
| bknudson_ | ayoung: reno | 14:54 |
| *** pushkaru has joined #openstack-keystone | 14:54 | |
| *** jsavak has quit IRC | 14:55 | |
| ayoung | bknudson_, going to be really confusintg when we chose that as the name of the R release in OpenStack | 14:55 |
| *** slberger has joined #openstack-keystone | 14:55 | |
| *** jsavak has joined #openstack-keystone | 14:56 | |
| *** fhubik is now known as fhubik_brb | 14:57 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: WIP Deprecate Saml2 auth plugin https://review.openstack.org/275438 | 15:01 |
| *** fhubik_brb is now known as fhubik | 15:02 | |
| *** fhubik is now known as fhubik_brb | 15:07 | |
| *** henrynash has quit IRC | 15:08 | |
| *** csoukup_ has joined #openstack-keystone | 15:10 | |
| *** jed56 has joined #openstack-keystone | 15:13 | |
| *** ajayaa has joined #openstack-keystone | 15:14 | |
| *** ajayaa has quit IRC | 15:14 | |
| *** ajayaa has joined #openstack-keystone | 15:15 | |
| *** boris-42 has joined #openstack-keystone | 15:16 | |
| *** timcline has joined #openstack-keystone | 15:19 | |
| *** jsavak has quit IRC | 15:22 | |
| *** jsavak has joined #openstack-keystone | 15:23 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:24 | |
| *** jbell8 has joined #openstack-keystone | 15:25 | |
| *** fhubik_brb is now known as fhubik | 15:26 | |
| *** samueldmq has quit IRC | 15:30 | |
| *** doug-fish has joined #openstack-keystone | 15:39 | |
| *** iurygregory has quit IRC | 15:53 | |
| *** jgriffith_away is now known as jgriffith | 16:00 | |
| *** gildub has quit IRC | 16:02 | |
| *** vgridnev_ has quit IRC | 16:02 | |
| *** diazjf has joined #openstack-keystone | 16:03 | |
| *** roxanagh_ has joined #openstack-keystone | 16:03 | |
| *** woodster_ has joined #openstack-keystone | 16:05 | |
| *** jorge_munoz1 has joined #openstack-keystone | 16:13 | |
| *** jorge_munoz1 has left #openstack-keystone | 16:13 | |
| *** jorge_munoz1 has joined #openstack-keystone | 16:13 | |
| *** spzala has quit IRC | 16:17 | |
| *** spzala has joined #openstack-keystone | 16:18 | |
| *** diazjf has quit IRC | 16:21 | |
| *** diazjf has joined #openstack-keystone | 16:22 | |
| *** spzala has quit IRC | 16:22 | |
| *** spzala has joined #openstack-keystone | 16:24 | |
| *** belmoreira has quit IRC | 16:28 | |
| *** iurygregory has joined #openstack-keystone | 16:38 | |
| *** mgarza_ has joined #openstack-keystone | 16:39 | |
| *** cdent has quit IRC | 16:41 | |
| *** iurygregory has quit IRC | 16:45 | |
| *** iurygregory has joined #openstack-keystone | 16:46 | |
| *** ktychkova_ has quit IRC | 16:47 | |
| *** ktychkova has joined #openstack-keystone | 16:48 | |
| *** su_zhang has quit IRC | 16:53 | |
| *** spandhe has joined #openstack-keystone | 16:56 | |
| *** EinstCrazy has quit IRC | 16:56 | |
| *** henrynash has joined #openstack-keystone | 16:57 | |
| *** ChanServ sets mode: +v henrynash | 16:57 | |
| *** jistr has quit IRC | 16:57 | |
| *** belmoreira has joined #openstack-keystone | 16:57 | |
| *** _cjones_ has joined #openstack-keystone | 16:58 | |
| *** _cjones_ has quit IRC | 16:58 | |
| *** _cjones_ has joined #openstack-keystone | 16:58 | |
| *** _cjones_ has quit IRC | 16:58 | |
| *** e0ne has quit IRC | 16:59 | |
| *** _cjones_ has joined #openstack-keystone | 16:59 | |
| *** phalmos has joined #openstack-keystone | 17:00 | |
| *** rderose has joined #openstack-keystone | 17:00 | |
| *** gyee has joined #openstack-keystone | 17:01 | |
| *** ChanServ sets mode: +v gyee | 17:01 | |
| *** itlinux has quit IRC | 17:02 | |
| *** fhubik is now known as fhubik_brb | 17:02 | |
| *** phalmos has quit IRC | 17:03 | |
| *** dims has quit IRC | 17:04 | |
| *** dims has joined #openstack-keystone | 17:06 | |
| *** fhubik_brb is now known as fhubik | 17:09 | |
| *** fhubik has quit IRC | 17:11 | |
| *** dims has quit IRC | 17:12 | |
| *** sinese_ has quit IRC | 17:13 | |
| ninag | hi..worked for me..am in | 17:14 |
| *** drjones has joined #openstack-keystone | 17:16 | |
| *** _cjones_ has quit IRC | 17:16 | |
| *** mvk_ has quit IRC | 17:16 | |
| *** dims has joined #openstack-keystone | 17:18 | |
| stevemar | dstanek: it felt good to clean out all those specs and blueprints :) | 17:18 |
| *** drjones has quit IRC | 17:20 | |
| *** _cjones_ has joined #openstack-keystone | 17:21 | |
| *** samueldmq has joined #openstack-keystone | 17:21 | |
| *** mhickey_ has quit IRC | 17:21 | |
| dstanek | stevemar: we should declare bug and bp bankruptcy and delete them all. it's usually better to start over anyway. | 17:23 |
| *** _cjones_ has quit IRC | 17:23 | |
| *** _cjones_ has joined #openstack-keystone | 17:24 | |
| *** jgriffith is now known as jgriffith_away | 17:25 | |
| notmorgan | dstanek: hehe | 17:28 |
| openstackgerrit | Clenimar Filemon Sousa proposed openstack/keystone: Allow deleting specific project assignment type https://review.openstack.org/275706 | 17:32 |
| *** jgriffith_away is now known as jgriffith | 17:39 | |
| *** belmoreira has quit IRC | 17:45 | |
| *** rderose has quit IRC | 17:45 | |
| *** jaosorior has quit IRC | 17:46 | |
| *** richm has quit IRC | 17:48 | |
| *** pnavarro has quit IRC | 17:49 | |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Adding ironic api specific audit map configuration https://review.openstack.org/275538 | 17:49 |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Adding ironic api specific audit map configuration https://review.openstack.org/275538 | 17:51 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: WIP Deprecate Saml2 auth plugin https://review.openstack.org/275438 | 17:52 |
| samueldmq | henrynash: hi | 17:55 |
| henrynash | samueldmq: hi | 17:55 |
| samueldmq | henrynash: just saw your comment on https://review.openstack.org/#/c/275706/ | 17:55 |
| samueldmq | henrynash: males sense, was going to argue the same in that case | 17:56 |
| samueldmq | henrynash: BTW, I'd to discuss with you about the policy changes ... | 17:56 |
| henrynash | samueldmq: Ok…:-0 | 17:56 |
| samueldmq | henrynash: hehe | 17:58 |
| samueldmq | henrynash: so, what kind of admins do we want ? | 17:58 |
| samueldmq | henrynash: for our cloudsample policy | 17:59 |
| *** jorge_munoz has quit IRC | 17:59 | |
| samueldmq | henrynash: cloud admin (or global admin); domain admin and project admin | 17:59 |
| samueldmq | right ? | 17:59 |
| *** jorge_munoz1 has quit IRC | 17:59 | |
| henrynash | I would say so | 17:59 |
| *** su_zhang has joined #openstack-keystone | 17:59 | |
| *** richm has joined #openstack-keystone | 17:59 | |
| samueldmq | henrynash: so, domain admin and project admin always need a scope check | 18:00 |
| henrynash | samueldmq: indeed | 18:00 |
| samueldmq | henrynash: i.e, the domain admin must be acting on his domain; same for project admin | 18:00 |
| samueldmq | henrynash: ok, so if we put the scope check in the code, that behavior is kept for them | 18:00 |
| henrynash | samueledmq: but what if the target can be either global or domain specific | 18:01 |
| *** su_zhang has quit IRC | 18:01 | |
| samueldmq | henrynash: didn't get it | 18:02 |
| henrynash | how do you say teh domain scope can be ignored if the target is global, but must be enforced if domain specific? | 18:02 |
| samueldmq | henrynash: what is a global target ? | 18:02 |
| henrynash | like a role | 18:02 |
| *** su_zhang has joined #openstack-keystone | 18:02 | |
| samueldmq | only cloud admin should be able to touch global things | 18:03 |
| henrynash | can be global or domain speciific - and different rules aply depending on which it is | 18:03 |
| henrynash | not true! | 18:03 |
| samueldmq | if roles are domain specific, check for domain scope | 18:03 |
| samueldmq | if roles are global, check for cloud admin (global scope) | 18:03 |
| henrynash | a domain admin and a rpoject admin can see, list global roels…but can only see/list domain specific ones if they are fro tehir own daomin | 18:03 |
| samueldmq | doesn't that make sense ? | 18:03 |
| *** richm has quit IRC | 18:04 | |
| *** diazjf has quit IRC | 18:04 | |
| samueldmq | yes, and we can skip scope check for operations that make sense | 18:04 |
| samueldmq | such as list roles (global) | 18:04 |
| *** sinese has joined #openstack-keystone | 18:04 | |
| samueldmq | henrynash: the rationale is that people don't need to customize the role check, we put defaults in the code that make sense | 18:05 |
| samueldmq | henrynash: they will only customize ROLES | 18:05 |
| *** su_zhang has quit IRC | 18:07 | |
| *** su_zhang_ has joined #openstack-keystone | 18:07 | |
| *** petertr7 is now known as petertr7_away | 18:07 | |
| henrynash | samueldmq: so I get that we don’t want they rule writer to have to know where to find teh project/domain ID for a type of call (e.g. its a get, so its a paramater, its a list so its a filter, its a delete its in the target)... | 18:07 |
| henrynash | samuedlmq: putting that in code makes a lot of sense to me.... | 18:08 |
| *** jasonsb has quit IRC | 18:08 | |
| samueldmq | henrynash: that's another benefit | 18:08 |
| henrynash | samueldmq: I’m just concerned we are somehow opionating the rest of the check…and I am very uneasy about that | 18:08 |
| samueldmq | henrynash: and changing scope checks isn't easy; just changing roles is safe | 18:09 |
| samueldmq | henrynash: nova, for example, check project matches for all its calls | 18:09 |
| samueldmq | henrynash: keystone is a bit different, because not all resources are tied to projects | 18:10 |
| samueldmq | henrynash: so the idea is: check for project for resources that are under projects; same logic applies for domains | 18:10 |
| samueldmq | henrynash: and admin_project (global admin / cloud admin) doesn't have any scope check | 18:11 |
| henrynash | samueldmq: and how do you override the standard checks (form the policy file)? | 18:11 |
| samueldmq | henrynash: how the new policy would look like ? | 18:12 |
| henrynash | samuedlmq: say I don’t want the checks in teh code and I want my policy rule to win, how do I do that | 18:12 |
| *** jorge_munoz has joined #openstack-keystone | 18:12 | |
| samueldmq | henrynash: your policy is the source of truth for RBAC (role checks) | 18:13 |
| samueldmq | henrynash: sorry you can't change scope checks | 18:13 |
| henrynash | samueldmq: hmmm | 18:13 |
| henrynash | samueldmq: that troubles me | 18:14 |
| samueldmq | henrynash: if you need to change scope checks, you're probably opening security holes in your cloud ? | 18:14 |
| henrynash | samueldmq: Not sure I accept that, you mean keytsone v3cloudsample is insecure? | 18:14 |
| henrynash | how so? | 18:14 |
| samueldmq | henrynash: not that it is insecure, but hard to write and we'll want the same level of security | 18:15 |
| samueldmq | henrynash: and also the default policy would become secure (with scope checks) all of a sudden | 18:15 |
| samueldmq | henrynash: and btw how scope checks should make sense would be information to be extract from our current v3cloudsample | 18:16 |
| henrynash | as it would if we made v3cloudsample the default (whcih I thought was the plan) | 18:16 |
| henrynash | I remain very very skecptical | 18:17 |
| henrynash | for keystone especially | 18:17 |
| henrynash | I can imagine many different version fo v3cloudsample that deployes might want….I don’t see how we code for them all | 18:17 |
| *** lhcheng has joined #openstack-keystone | 18:18 | |
| *** ChanServ sets mode: +v lhcheng | 18:18 | |
| notmorgan | ayoung: i remain unconvinced endless deep implied roles vs a flat level of implied roles buys us anything except massive complexity i am not blocking your api, just like you don't belive we need SQL enhancements, i'm skeptical that the implied roles of implied roles of implied roles adds any real value | 18:18 |
| henrynash | (i remain a very bad speller too) | 18:18 |
| samueldmq | henrynash: if you want to do something in a project; you MUST have a token scoped to it | 18:18 |
| samueldmq | same is valid for domain | 18:18 |
| samueldmq | if you have superpowers (global admin) forgot the two sentences above | 18:18 |
| henrynash | samueldmq: that’s our view of it | 18:18 |
| *** lhcheng_ has joined #openstack-keystone | 18:18 | |
| samueldmq | henrynash: should that differ for other views ? | 18:19 |
| notmorgan | ayoung: this is following up on the review i promised even though it was already approved. so far there appears to be a few minor followups needed. but nothing that would have justified a -1 | 18:19 |
| henrynash | samueldmq: it should be up to teh deployer | 18:19 |
| *** jbell8 has quit IRC | 18:19 | |
| henrynash | samueldmq: maybe he wants to give domain admin super powers to everything in that domain and is teh same as project admin, except for apis 1, 2 and 3 | 18:20 |
| samueldmq | henrynash: so we allow the deployer to define whether its authz implements scope isolation or not | 18:20 |
| *** jsavak has quit IRC | 18:20 | |
| henrynash | samueldmq: we do today | 18:20 |
| samueldmq | henrynash: so I guess other projects don't | 18:20 |
| *** iurygregory has quit IRC | 18:20 | |
| *** timcline has quit IRC | 18:20 | |
| samueldmq | henrynash: why are we special ? | 18:20 |
| henrynash | samueldmq: (well they do, but by mistake :-) ) | 18:20 |
| notmorgan | ayoung: also ftr, i don't really like the config that only one role can't be an implied role, before mitaka rolls out i would like that to be a list opt | 18:21 |
| notmorgan | if we are using that pattern | 18:21 |
| samueldmq | henrynash: so would it make sense for nova to allow one with a project scoped token to touch any project ?? | 18:21 |
| *** timcline has joined #openstack-keystone | 18:21 | |
| henrynash | samueldmq: ok, I gotta run, sadly, I’ll mull on it some more…just feels to we are taking away flexibility | 18:22 |
| *** lhcheng has quit IRC | 18:22 | |
| samueldmq | henrynash: sure, talk to you later | 18:22 |
| notmorgan | ayoung: https://bugs.launchpad.net/keystone/+bug/1541540 | 18:24 |
| openstack | Launchpad bug 1541540 in OpenStack Identity (keystone) "Implied role "root_role" config needs to be expanded" [High,Triaged] - Assigned to Adam Young (ayoung) | 18:24 |
| notmorgan | ayoung: also what is the correct pattern if someone changes that value and restarts keystone? | 18:24 |
| *** e0ne has joined #openstack-keystone | 18:24 | |
| notmorgan | ayoung: i think this needs to be not a config-time option. | 18:25 |
| notmorgan | ayoung: but possibly some element of the role itself | 18:25 |
| notmorgan | ayoung: and if you make it non-imply-able the system needs to strip it out of implied roles. | 18:25 |
| *** jsavak has joined #openstack-keystone | 18:26 | |
| notmorgan | henrynash: we are too flexible for our own good. fwiw the volume of "we are everything to everyone" is a detriment to openstack as a whole. | 18:28 |
| notmorgan | henrynash: we do a lot of stuff poorly and nothing very very well | 18:28 |
| notmorgan | some things are "ok-ish" | 18:28 |
| * notmorgan is a fan of dropping flexability for consistency | 18:28 | |
| notmorgan | stevemar: fwiw https://bugs.launchpad.net/keystone/+bug/1541540 the config option is a bad pattern. | 18:29 |
| openstack | Launchpad bug 1541540 in OpenStack Identity (keystone) "Implied role "root_role" config needs to be expanded" [High,Triaged] - Assigned to Adam Young (ayoung) | 18:29 |
| *** vgridnev has joined #openstack-keystone | 18:31 | |
| stevemar | notmorgan: list is good | 18:33 |
| ayoung | notmorgan, I suspect the right degree of abstraction will be about 3 deep. | 18:33 |
| ayoung | at the lowest level is the operation | 18:33 |
| ayoung | at the top level is the role assigne to the user | 18:33 |
| ayoung | in the middle is the workflows | 18:33 |
| samueldmq | notmorgan: yes; I agree with you, but as we already are too flexible at this point, I am planning an intermediate solution | 18:34 |
| notmorgan | ayoung: right i might want to see us add a limit option in. but i want to talk that over before we decide the exact limit if so | 18:34 |
| ayoung | notmorgan, I'm OK with saying more than one role is excluded. I think I went back and forth on that 2-3 times before opting for the simpler one, but that was due to test burden, not design | 18:34 |
| stevemar | yowza, check queue is at 382 | 18:35 |
| notmorgan | ayoung: right. i would rather not have the option in config at all and add the limit into the api next cycle fwiw | 18:35 |
| samueldmq | notmorgan: split the policy file into 2 (scope and role checks); ask in the ML if anyone is customizing the scope checks; be sure no one is; then remove the file | 18:35 |
| samueldmq | notmorgan: should have the same result | 18:35 |
| notmorgan | ayoung: the config file option makes my skin crawl. | 18:35 |
| ayoung | notmorgan, As a property of the role itself? Sure! | 18:35 |
| notmorgan | ayoung: absolutely! on the role itself as the way i'd go for it | 18:35 |
| notmorgan | ayoung: :) | 18:35 |
| notmorgan | ayoung: that way it's not crossing CMS vs API | 18:36 |
| notmorgan | ayoung: specifically that is the issue i have with the config option, the "it needs to be one and only one" is a side effect we could solve if making it a role property is too hard | 18:36 |
| ayoung | notmorgan, let's work up the API spec change. If we can all agree on what it should look like, I think it would bea safe addition for Mitaka, and not too hard to implement. If not...we have something that will cover the delta for now | 18:37 |
| notmorgan | ayoung: ++ | 18:37 |
| notmorgan | ayoung: i filed this as a bug since it felt like it was the right approach, feel free to punt it out of m-3 if we can't agree. | 18:38 |
| notmorgan | ayoung: i think going with the simplest option is "attribute on the role" | 18:38 |
| *** jbell8 has joined #openstack-keystone | 18:38 | |
| ayoung | notmorgan, I think I can get behind it, just might need to get someone else to implement so I can approve! | 18:38 |
| notmorgan | thankfully it really is a simple set of changes and a new "optional" attribute | 18:39 |
| ayoung | notmorgan, did I mention Keystone HTTPD for Tripleo passed CI, to include HA | 18:39 |
| *** su_zhang_ has quit IRC | 18:39 | |
| notmorgan | ayoung: you did | 18:39 |
| ayoung | notmorgan, it makes me happy | 18:39 |
| notmorgan | ayoung: i was half asleep and couldn't be excited when you said it originally | 18:40 |
| *** su_zhang has joined #openstack-keystone | 18:40 | |
| *** jsavak has quit IRC | 18:40 | |
| notmorgan | ayoung: also https://review.openstack.org/#/c/275443/ i just need to fix a grenade issue | 18:40 |
| notmorgan | ayoung: admin_token_auth should be ready to die officially :) | 18:40 |
| *** jsavak has joined #openstack-keystone | 18:40 | |
| ayoung | notmorgan, so one thing bothering me is how to enfore that admin_project_id gets set before we start pushing it into the policy files for all the other services | 18:41 |
| *** mvk_ has joined #openstack-keystone | 18:41 | |
| ayoung | is that something we could use bootstrap to do? | 18:41 |
| ayoung | I don't want to have to make the change in Keystone, and then devstack, then the puppet modulse, and then tripleo.... | 18:42 |
| notmorgan | ayoung: yep | 18:42 |
| notmorgan | we can make bootstrap do things like that | 18:42 |
| ayoung | notmorgan, are we planning on using bootstrap to update config on upgrade, too? | 18:43 |
| notmorgan | it is in-fact exactly what bootstrap should do. get the basic things in place for setting up your cloud | 18:43 |
| notmorgan | ayoung: keystone.conf? no. | 18:43 |
| notmorgan | oh wait.. | 18:44 |
| notmorgan | hmm | 18:44 |
| notmorgan | no sorry, bootstrap can't do that | 18:44 |
| notmorgan | bootstrap is only able to do API/manager interactions | 18:44 |
| *** clenimar has quit IRC | 18:44 | |
| notmorgan | maybe we should bootstrap in an "admin" [like default domain] id'd project as the admin_project_id default? | 18:45 |
| *** doug-fish has quit IRC | 18:45 | |
| *** jsavak has quit IRC | 18:46 | |
| notmorgan | so it would have a non-uuid id, like _OpenStack_Admin_Project_ | 18:46 |
| * notmorgan is unsure on that front. | 18:46 | |
| *** jsavak has joined #openstack-keystone | 18:46 | |
| stevemar | notmorgan: what exactly is being removed in the O release here? https://review.openstack.org/#/c/274489/1/keystone/contrib/admin_crud/core.py | 18:47 |
| *** csoukup_ has quit IRC | 18:47 | |
| notmorgan | stevemar: admin_token_auth, the stubs for all the former contribs | 18:48 |
| notmorgan | stevemar: doubling down on bootstrap and "use real users" | 18:49 |
| *** diazjf has joined #openstack-keystone | 18:49 | |
| notmorgan | stevemar: i expect to also have authcontext, url_normalize, and json_body be rolled in baseline [so stubs for those removed too] | 18:49 |
| *** esp_ has joined #openstack-keystone | 18:51 | |
| *** browne has joined #openstack-keystone | 18:52 | |
| *** jgriffith is now known as jgriffith_away | 18:53 | |
| *** mc_nair_ has joined #openstack-keystone | 18:55 | |
| *** mc_nair_ is now known as mc_nair | 18:56 | |
| *** jgriffith_away is now known as jgriffith | 18:57 | |
| stevemar | notmorgan: we really need to publish the compat APIs better | 18:58 |
| stevemar | in our specs repo | 18:58 |
| *** esp_ has quit IRC | 18:58 | |
| ayoung | notmorgan, this is the problem with out policy stuff in general. We can build all the required features, but then have no way to distribute them, and get a catch 22 trying to do so. | 19:01 |
| notmorgan | stevemar: you mean EC2 and S3? | 19:03 |
| notmorgan | stevemar: and yes. we need to doc them better | 19:03 |
| stevemar | notmorgan: yes | 19:03 |
| notmorgan | stevemar: inc. in specs repo | 19:03 |
| stevemar | notmorgan: is there a spot where the APIs were doc'ed before? | 19:03 |
| notmorgan | stevemar: unlikely | 19:03 |
| *** browne has quit IRC | 19:03 | |
| stevemar | notmorgan: same with simple cert | 19:03 |
| notmorgan | stevemar: ignore simple_cert... it's dying :P | 19:04 |
| notmorgan | but before this cycle, i'd agree | 19:04 |
| stevemar | true | 19:04 |
| *** samueldmq has quit IRC | 19:05 | |
| notmorgan | ayoung: so.. if we made "admin project" or "domain" not wedged in the config file... | 19:05 |
| notmorgan | ayoung: [not really advocating this, but thinking outloud] | 19:05 |
| stevemar | notmorgan: left one comment on ec2 to get it passing grenade | 19:05 |
| notmorgan | stevemar: yeah hadn't circled up on that yet, was on my short list | 19:05 |
| ayoung | notmorgan, yep... | 19:05 |
| *** browne has joined #openstack-keystone | 19:05 | |
| notmorgan | ayoung: it makes it boot-strapable, and we can do a keystone-manage upgrade | 19:06 |
| *** mylu has joined #openstack-keystone | 19:06 | |
| ayoung | notmorgan, then it becomes something we can change at run time, but we still would not know, on an existing ddeployment, which one to indicate is the admin domain/proejct | 19:06 |
| notmorgan | ayoung: no, but we wouldn't need to encode it in <X> id | 19:07 |
| notmorgan | just <does auth_context have "admin_flag"> | 19:07 |
| *** csoukup_ has joined #openstack-keystone | 19:07 | |
| notmorgan | ayoung: but we could make it easier to handle | 19:07 |
| *** diazjf has quit IRC | 19:08 | |
| notmorgan | ayoung: and we could make keystone-manage upgrade handle the db_sync [make db_sync say "nope, do upgrade instead"] | 19:09 |
| notmorgan | ayoung: which then it would verify a project/domain was specified for "admin" | 19:09 |
| notmorgan | ayoung: it's a lot of moving bits. but it could be done. | 19:10 |
| notmorgan | ayoung: and it squashes another CMS vs API config boundry cross. | 19:10 |
| notmorgan | ayoung: not sure if this is even remotely a good idea though | 19:10 |
| notmorgan | ayoung: and KSM can populate the _is_admin_context_ from the token directly as a top-level attr/header | 19:11 |
| notmorgan | ayoung: at least that is what my gut says when i think about how to approach that | 19:11 |
| *** jbell8 has quit IRC | 19:12 | |
| *** jbell8 has joined #openstack-keystone | 19:12 | |
| *** petertr7_away is now known as petertr7 | 19:14 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Move EC2 extension to core https://review.openstack.org/275280 | 19:17 |
| *** esp_ has joined #openstack-keystone | 19:17 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Deprecate admin_token_auth https://review.openstack.org/275443 | 19:17 |
| *** jgriffith is now known as jgriffith_away | 19:18 | |
| *** weshay_xchat has joined #openstack-keystone | 19:19 | |
| weshay_xchat | ayoung, ping.. looking for the setting to change the keystone auth version in openstack rc file.. is there such a env variable.. e.g. like export COMPUTE_API_VERSION=1.1 | 19:20 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Deprecate admin_token_auth https://review.openstack.org/275443 | 19:21 |
| *** esp_ has quit IRC | 19:21 | |
| openstackgerrit | Merged openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 19:22 |
| notmorgan | stevemar: ^ all corrected. | 19:23 |
| *** roxanagh_ has quit IRC | 19:29 | |
| *** jgriffith_away is now known as jgriffith | 19:29 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:30 |
| *** su_zhang has quit IRC | 19:32 | |
| *** su_zhang has joined #openstack-keystone | 19:33 | |
| *** su_zhang has quit IRC | 19:33 | |
| *** su_zhang has joined #openstack-keystone | 19:34 | |
| *** e0ne has quit IRC | 19:35 | |
| stevemar | \o/ | 19:36 |
| *** daemontool has joined #openstack-keystone | 19:38 | |
| ayoung | weshay_xchat, IDENTITY_API_VERSION | 19:39 |
| weshay_xchat | perfect. thanks! | 19:39 |
| ayoung | notmorgan, I'm reading up now...got called in to a meeting | 19:40 |
| *** su_zhang has quit IRC | 19:40 | |
| notmorgan | ayoung: no worries | 19:42 |
| notmorgan | ayoung: i was doing laundry and packing | 19:43 |
| ayoung | keystone-manage upgrade | 19:43 |
| ayoung | yeah, I think that is what I want | 19:43 |
| *** vgridnev has quit IRC | 19:43 | |
| notmorgan | but not something that touches .conf, it would have the same requirement as bootstrap | 19:43 |
| *** boris-42 has quit IRC | 19:43 | |
| ayoung | notmorgan, its always questionable with config options, of course. We have a puppet based install process, and that overwrites config changes | 19:43 |
| notmorgan | can act on managers/db/etc | 19:43 |
| notmorgan | though to be fair, upgrade would need to know state of things, so it would need something like Alembic | 19:44 |
| notmorgan | or sql-a-migrate to know what upgrade steps have occured | 19:44 |
| notmorgan | just in concept for ordering, so upgrades aren't re-run, unless the upgrade will always be idempotent | 19:45 |
| notmorgan | and can verify that things are "sane" | 19:45 |
| *** su_zhang has joined #openstack-keystone | 19:46 | |
| *** mgarza__ has joined #openstack-keystone | 19:50 | |
| *** daemontool has quit IRC | 19:51 | |
| *** daemontool has joined #openstack-keystone | 19:53 | |
| *** mgarza_ has quit IRC | 19:53 | |
| ayoung | DB upgrade is Idempotent. It should be soemthing comparable I think | 19:55 |
| *** samueldmq has joined #openstack-keystone | 19:55 | |
| ayoung | I need to layout the use cases/ | 19:55 |
| ayoung | 1. new install, devstack | 19:55 |
| ayoung | 2. New install, Tripleo | 19:55 |
| ayoung | 3. Upgrade Tripleo | 19:55 |
| ayoung | I think if I can get an answer for those three, I'll be solid | 19:56 |
| *** jsavak has quit IRC | 19:58 | |
| *** jsavak has joined #openstack-keystone | 19:58 | |
| *** vgridnev has joined #openstack-keystone | 20:02 | |
| ayoung | IMplied Roles merged. W00t! | 20:05 |
| samueldmq | ayoung: manager + API ? | 20:07 |
| ayoung | https://review.openstack.org/#/c/242614/ | 20:08 |
| ayoung | samueldmq, ^^ yep | 20:08 |
| *** diazjf has joined #openstack-keystone | 20:08 | |
| *** timcline has quit IRC | 20:09 | |
| samueldmq | ayoung: nice, congrats :D | 20:09 |
| *** diazjf has quit IRC | 20:09 | |
| *** timcline has joined #openstack-keystone | 20:09 | |
| ayoung | samueldmq, productive day | 20:10 |
| samueldmq | ayoung: ++ | 20:10 |
| *** jsavak has quit IRC | 20:16 | |
| tjcocozz | bknudson_, do you have time to meet to walk through the keystoneclient? | 20:17 |
| *** jsavak has joined #openstack-keystone | 20:17 | |
| ayoung | samueldmq, now I need to stop and think through the backlog of stuff that is possible with the tools we've gotten into this release, and figure out how to use them | 20:18 |
| *** diazjf has joined #openstack-keystone | 20:18 | |
| *** mgarza__ has quit IRC | 20:19 | |
| samueldmq | ayoung: perfect | 20:20 |
| samueldmq | ayoung: and we need to figure out what tools make sense to come together in a single cycle | 20:21 |
| samueldmq | ayoung: in policy, for example, it should be nice to get add of scope checks that allow for global admin | 20:21 |
| samueldmq | ayoung: in addition to the admin_project thing, that ensures back compat in the case anyone still want global admin | 20:22 |
| notmorgan | samueldmq: don't rush it. don't hesistate to land basic functionality and build on it. | 20:22 |
| notmorgan | trying to land "everything in a single cycle" nets broken | 20:22 |
| notmorgan | in almost every case | 20:22 |
| notmorgan | so focus on basic needs with real use-case | 20:22 |
| notmorgan | and clearly think hard as an end user "does this make using openstack better or worse" | 20:23 |
| *** mylu has quit IRC | 20:23 | |
| ayoung | samueldmq, I do need to loop back around on "request a token with a specific role" | 20:23 |
| notmorgan | because if it's rough for deployers but easy for users, deployers can work around it. | 20:23 |
| samueldmq | notmorgan: yes, so what ayoung said really makes sense | 20:23 |
| ayoung | and make sure that works with implied roles | 20:23 |
| samueldmq | notmorgan: look at the tools and pland the backlog carefully | 20:23 |
| notmorgan | if it's terrible for end users and great for deployers, no one will want to use it | 20:23 |
| ayoung | and that is depdendant on getting Fernet stable | 20:24 |
| notmorgan | ayoung: i would fix service->service first too | 20:24 |
| notmorgan | because right now having a token with role "X" is suspect | 20:24 |
| notmorgan | because knowhing the depth of what role X is is very hard | 20:24 |
| ayoung | notmorgan, service to service meaning Nova to Glance etc for boot, long running tasks, token expiry, that whole mess? | 20:25 |
| samueldmq | notmorgan: what's that ? communication between services should need a token ? | 20:25 |
| notmorgan | ayoung: yep | 20:25 |
| samueldmq | ++ | 20:25 |
| notmorgan | samueldmq: bascially no token for service to service | 20:25 |
| samueldmq | how's that supposed to be fixed ? certs ? | 20:25 |
| notmorgan | stop using the user's authz for nova to glance | 20:25 |
| notmorgan | well first, certs, but second, the "can i do this?!" check every step of the way is pointless | 20:25 |
| ayoung | notmorgan, so, no token, but instead a role assignment ID that can be verified. Unified delegation was my take on that | 20:26 |
| notmorgan | check to see if the user can boot an instance, if so, the rest is authorized | 20:26 |
| ayoung | if I call Nova with a "Member" token | 20:26 |
| *** mylu has joined #openstack-keystone | 20:26 | |
| notmorgan | ayoung: unified delegation doesn't really solve it, that solves the end user UX side, which i'm fine with | 20:26 |
| ayoung | when Nova calls glance, it would pass allong "userid=ayoung, role_assignment=<uiuiod htat means member on project> | 20:26 |
| notmorgan | i don't want to need to "delegate" to nova the whole stack | 20:26 |
| notmorgan | or even need to construct magic to make it work | 20:26 |
| ayoung | nah, it is just a shorthand way of saying "adam hs role r on proejct p" | 20:27 |
| ayoung | but we could pass those on separately and it would still work | 20:27 |
| notmorgan | i actually want glance to not ask keystone | 20:27 |
| notmorgan | period | 20:27 |
| ayoung | so pass on a tuple "userid, project, role" | 20:27 |
| notmorgan | for the user authz [as an extreme take] | 20:27 |
| ayoung | nah, you have to | 20:27 |
| notmorgan | no | 20:27 |
| notmorgan | you don't | 20:27 |
| stevemar | tjcocozz: did bknudson_ walk you through? | 20:27 |
| notmorgan | you need to know nova is allowed to make this request | 20:27 |
| stevemar | tjcocozz: there's a lot of cruft that's being removed there | 20:28 |
| notmorgan | you don't need to ask keystone every step of the way if this was allowed. | 20:28 |
| ayoung | notmorgan, it fails on multi-jump calls | 20:28 |
| bknudson_ | stevemar: tjcocozz is here right now | 20:28 |
| ayoung | nova knows what it is going to call on glance, but does not know that glance is going to call wift | 20:28 |
| notmorgan | ayoung: that is the part i want to focus on, having to still ask keystone every step is stupid. | 20:28 |
| ayoung | swift | 20:28 |
| notmorgan | right | 20:28 |
| bknudson_ | keystone CLI has some wacky code that looks up every method that starts with "do_" | 20:28 |
| notmorgan | it doesn't matter | 20:28 |
| notmorgan | you gate on the user->service call | 20:28 |
| notmorgan | the rest has to be allowed | 20:28 |
| samueldmq | notmorgan: ayoung: actually the token could be passed in, just for getting info from it (such as scope and roles), but glance wouldn't need to validate it if nova already did | 20:28 |
| stevemar | bknudson_: it sure does! | 20:28 |
| samueldmq | right ? | 20:28 |
| notmorgan | you auth "boot instance" | 20:28 |
| bknudson_ | I guess everybody loves the keystone CLI and doesn't want to use openstack CLI | 20:29 |
| notmorgan | not "boot instance", "glance" "swift" etc. | 20:29 |
| bknudson_ | also they don't want to use identity v3. | 20:29 |
| ayoung | notmorgan, ok...lets play this out | 20:29 |
| ayoung | I think it will work: | 20:29 |
| stevemar | bknudson_: they also don't want domains or groups | 20:29 |
| notmorgan | ayoung: now, quickly - i am saying we need to have a way to know for sure it was service->service not user->service [that is still to know if the path works] | 20:29 |
| notmorgan | and if we need to ask keystone :) | 20:29 |
| notmorgan | ayoung: ok lets wargame it | 20:29 |
| ayoung | nova records the roles in the token that it has validated, and passes on the validated token body when it calls glance, along with "I can do this, I am Nova" cert | 20:30 |
| stevemar | tjcocozz: in https://github.com/openstack/python-keystoneclient/tree/master/keystoneclient the only bits you have to be concerned with are v2_0 and v3, you can ignore the rest :) | 20:30 |
| ayoung | we drop service catalog for size | 20:30 |
| stevemar | and i guess fixture :P | 20:30 |
| * tjcocozz is looking now | 20:30 | |
| notmorgan | yes, catalog is dropped glance keeps it's own copy of it if it's needed | 20:30 |
| ayoung | and we pass roles in ID-only form to keep it from getting too huge | 20:30 |
| ayoung | so now all glance has to do is the policy check with the data that it was passed | 20:30 |
| notmorgan | and glance verifies nova has passed this on. | 20:30 |
| notmorgan | yep | 20:30 |
| *** timcline_ has joined #openstack-keystone | 20:30 | |
| notmorgan | and glance can take the same bundle of data, and pass it on to swift with the "hey i am glance" | 20:30 |
| notmorgan | if needed | 20:31 |
| ayoung | OK...taht should work. How do we separate the Nova user from the human users? Safely? | 20:31 |
| samueldmq | notmorgan: ayoung: how does glance know the request came from service and not user ? | 20:31 |
| samueldmq | just checking it the call was using service certs ? | 20:31 |
| notmorgan | ayoung: ideally i'd use the x509 with hard cert validation on the CA [client certs] | 20:31 |
| notmorgan | ayoung: as the default mode. but at the least we could so service token | 20:31 |
| *** jsavak has quit IRC | 20:31 | |
| tjcocozz | stevemar, what got me was it was reading in the command from the cli and str replacing '-' with '_' and starting it with 'do_'. made it very hard to walk through the code. | 20:32 |
| notmorgan | ayoung: and encode in a safe way this is a service user. | 20:32 |
| notmorgan | ayoung: ideally client certs solves it all 100% | 20:32 |
| notmorgan | but not everyone will relish the thought of client certs =/ | 20:32 |
| notmorgan | and i concede that we need a non-x509 story. | 20:33 |
| *** timcline has quit IRC | 20:33 | |
| stevemar | tjcocozz: like i said just worry about v2_0 and v3 :P | 20:33 |
| stevemar | the rest of the directories are being removed (aside from fixtures and tests) | 20:33 |
| *** jsavak has joined #openstack-keystone | 20:33 | |
| notmorgan | ayoung: the next step after that setup becomes "what is nova allowed to do on glance" which we can start determining and turning those screws down rather than "nova is allowed to call glance" | 20:34 |
| notmorgan | but the first step is getting it so we can either skip keystone or only need 1 keystone "request" vs 2 for svc->svc | 20:34 |
| tjcocozz | stevemar, I will have to put my blinders on when i am working with the client :p | 20:34 |
| notmorgan | samueldmq: ^ | 20:34 |
| samueldmq | notmorgan: looks like we miss something to define workflow in openstack | 20:34 |
| notmorgan | samueldmq: not really, | 20:34 |
| samueldmq | notmorgan: like, for running an instance, you need compute:create, glance:read_image, etc ..; | 20:35 |
| notmorgan | samueldmq: you only will ever need to check nova->glance | 20:35 |
| notmorgan | not nova->glance->swift if i get my way | 20:35 |
| notmorgan | since then you are chekcing glance->swift in isolation | 20:35 |
| notmorgan | for example | 20:35 |
| notmorgan | samueldmq: the "workflow" thing can be a series of warn/fails via policy checks | 20:36 |
| *** phalmos has joined #openstack-keystone | 20:36 | |
| notmorgan | doesn't need to be more complex than that to start. eventually we'll be able to track request_ids too. | 20:36 |
| samueldmq | notmorgan: and even a tool to check against policy files (like cli tool) | 20:36 |
| notmorgan | but first step: svc -> svc only checking the service data is valid, not passing the user's authz on | 20:36 |
| samueldmq | notmorgan: warning if you are able to compute:create but you can't even read an image | 20:37 |
| samueldmq | notmorgan: ++ | 20:37 |
| notmorgan | getting clients and services on KeystoneAuth and having KSM drop the data in oslo.context will make this all super easy | 20:37 |
| samueldmq | notmorgan: how should we do it ? making keystonemiddleware instance trust each other ? | 20:37 |
| notmorgan | basically | 20:38 |
| samueldmq | given that each service has a ksmiddleware on it ? | 20:38 |
| samueldmq | nice | 20:38 |
| notmorgan | so, get the clients on keystoneauth and using OCC | 20:38 |
| notmorgan | that way i can work "around" needing to change nova's code to prove it/test it | 20:38 |
| samueldmq | occ == oslo context ? | 20:38 |
| notmorgan | os-client-config | 20:38 |
| stevemar | tjcocozz: yeah, the auth directory is now keystoneauth | 20:38 |
| samueldmq | got it | 20:38 |
| ayoung | notmorgan, OK...let's think about "what is nova allowed to do on glance" | 20:39 |
| stevemar | tjcocozz: generic is just more keystone CLI | 20:39 |
| notmorgan | samueldmq: step 2: finish jamielennox|away 's work to have KSM drop auth context data sanely in oslo.context's thread.local | 20:39 |
| ayoung | we have the Service token that would go separate from the user auth data | 20:39 |
| notmorgan | samueldmq: step 3, new auth plugin that shows this all works. and then step 4, limit what Service A can do to Service B so it's not just "wide open" | 20:39 |
| ayoung | so, again, if we split policy, we are talking about stuff that can be encapsulated in middleware | 20:40 |
| notmorgan | ayoung: X-Service-Token i think. | 20:40 |
| *** cdcasey has joined #openstack-keystone | 20:40 | |
| notmorgan | ayoung: aye. | 20:40 |
| *** su_zhang has quit IRC | 20:40 | |
| samueldmq | ayoung: yep | 20:40 |
| ayoung | role check only, does not need the actual resource from the DB | 20:40 |
| notmorgan | ayoung: and this is just "can i call", not "can i act on resource" | 20:40 |
| ayoung | what if we use dynamic policyh just for that | 20:40 |
| samueldmq | notmorgan: nice, I need to know more about oslo.context | 20:40 |
| ayoung | say that we have a policy file for RBAC only | 20:40 |
| tjcocozz | stevemar, why are they split when in the end they are both talking to keystone? | 20:40 |
| samueldmq | notmorgan: what a service will be passing to other service will be that oslo.context (encrypted) ? | 20:41 |
| ayoung | fertched from Keysteon, based on Endpoint URL | 20:41 |
| notmorgan | ayoung: i'm not super concerned if it's dynamic policy or just basic policy | 20:41 |
| stevemar | tjcocozz: why was what split? | 20:41 |
| notmorgan | i'd like both to work | 20:41 |
| notmorgan | to be honest | 20:41 |
| tjcocozz | stevemar, yes | 20:41 |
| stevemar | =\ | 20:41 |
| notmorgan | there is no reason this can't work both ways. | 20:41 |
| ayoung | notmorgan, right...anything dynamic can be done statically, except for all the issues on upgrade... | 20:41 |
| samueldmq | notmorgan: I agree this service -> service is a more important issue now | 20:41 |
| tjcocozz | stevemar, lol keystoneauth and keystoneclient | 20:41 |
| ayoung | so, we have a service-policy.json | 20:42 |
| notmorgan | ayoung: aye | 20:42 |
| ayoung | really it would just be an enumeration of the calls that a service user is allowed to make | 20:42 |
| notmorgan | yep. | 20:42 |
| stevemar | tjcocozz: in most cases the other openstack services, like nova and cinder, etc... just want to auth with keystone, not perform any CRUD operations | 20:42 |
| stevemar | tjcocozz: auth is a heavy enough library that it should stand on it's own | 20:43 |
| ayoung | we could get that data back when validating the service users token | 20:43 |
| samueldmq | notmorgan: should I write a spec for that ? | 20:43 |
| notmorgan | could be done with a stacked policy (static) where you get a logical or between the columns, and the service user isn't given any allowance in the normal roles | 20:43 |
| stevemar | tjcocozz: if someone wants CRUD support for our APIs, they can use keystoneclient | 20:43 |
| bknudson_ | keystoneclient should be pretty lean once we take out the cli | 20:43 |
| stevemar | tjcocozz: projects like openstackclient and horizon would still use keystoneclient | 20:43 |
| notmorgan | bknudson_: +++++++ | 20:44 |
| stevemar | bknudson_: zomg, so lean | 20:44 |
| stevemar | bknudson_: i have 2 patches queued up for removing cruft from ksc | 20:44 |
| bknudson_ | even now it's pretty lean | 20:44 |
| notmorgan | ayoung: it's pretty straight forward i think to break user->svc and svc->svc | 20:44 |
| tjcocozz | stevemar, oh cool. that makes sense. I think i need some more practice with using the keystoneauth and client from the other projects point of view | 20:44 |
| stevemar | bknudson_: https://review.openstack.org/#/c/258181/ and https://review.openstack.org/#/c/257127/ | 20:45 |
| bknudson_ | we only have stevedore because of apiclient? | 20:45 |
| notmorgan | the hard part is getting everyone on ksa and clients on ksa/occ | 20:45 |
| notmorgan | most services are already on ksa iirc | 20:45 |
| stevemar | bknudson_: and jamielennox posted this whole chain too https://review.openstack.org/#/c/258742/4 | 20:45 |
| bknudson_ | stevemar: on https://review.openstack.org/#/c/257127/ you should be able to remove stevedore from requirements.txt | 20:45 |
| notmorgan | heat is not on KSA, but heat is special. | 20:46 |
| *** gordc has quit IRC | 20:46 | |
| ayoung | OK...so lets say anything that comes in with an X-Service-Token goes into a different policy check | 20:46 |
| ayoung | and it looks like this: | 20:46 |
| ayoung | default: Deny | 20:46 |
| ayoung | compute_blah: role:service | 20:46 |
| notmorgan | ayoung: as phase 2, yes. | 20:46 |
| ayoung | nah, as phase one | 20:46 |
| notmorgan | no, phase 1 is scaffolding | 20:46 |
| ayoung | that path can be done from middleware | 20:47 |
| notmorgan | need ksm to populate userdata | 20:47 |
| notmorgan | and we need everyone on ksa/occ | 20:47 |
| notmorgan | without that it's going to be hard to be consistent workable | 20:47 |
| stevemar | bknudson_: probably, i haven't gotten around to looking at cleaning up reqs | 20:47 |
| notmorgan | phase 2 is def. separate policy for svc user | 20:47 |
| ayoung | notmorgan, OK, we call that phase 1, service token policy stage 2 | 20:47 |
| notmorgan | yep | 20:47 |
| stevemar | bknudson_: looks like it's still used here: https://github.com/openstack/python-keystoneclient/blob/5dea3b22fcc672f3e3405f5abec471929c501c0a/keystoneclient/tests/unit/auth/test_conf.py#L18 | 20:48 |
| ayoung | notmorgan, we could fetch the service token policy from Keystone | 20:48 |
| notmorgan | because with stage 1, we can duplicate 100% of today easily and skip a bunch of overhead. | 20:48 |
| stevemar | bknudson_: you can comment on all those if you want :] | 20:48 |
| bknudson_ | stevemar: then move it into test-requirements.txt | 20:48 |
| stevemar | tru tru | 20:48 |
| notmorgan | ayoung: i'm fine with both modes. i just want to be sure this doesn't require dynamic policy | 20:48 |
| ayoung | let's say we create a special policy file with an id of _service_token_only.json | 20:48 |
| *** su_zhang has joined #openstack-keystone | 20:48 | |
| ayoung | notmorgan, right, this is just to jumpstart deployment | 20:48 |
| ayoung | we can do it manually, too | 20:49 |
| stevemar | it should just be six/keystoneauth/debtcollector/positional/requests/oslo stuff | 20:49 |
| *** mylu has quit IRC | 20:49 | |
| notmorgan | ayoung: yep. so lets talk what the enforcement looks like vs. "getting the policy to the endpoint" | 20:49 |
| *** mylu has joined #openstack-keystone | 20:49 | |
| bknudson_ | remember when it had all sorts of middleware reqs? | 20:49 |
| bknudson_ | that's what everyone really complained about | 20:49 |
| notmorgan | so we have a new policy, _svc_token_only | 20:50 |
| stevemar | we should probably drop oslo.serialization for regular 'import json', no sense is carrying that around if we're just using it for json | 20:50 |
| notmorgan | .json | 20:50 |
| notmorgan | stevemar: oslo json serializer is more intelligent | 20:50 |
| ayoung | samueldmq, can you refresh your dynamic policy patches? | 20:50 |
| notmorgan | but it comes with msgpack overhead | 20:50 |
| ayoung | I think...we can use that approach | 20:50 |
| stevemar | notmorgan: yes it is, yes it does | 20:50 |
| ayoung | samueldmq, that was the policy check for Nova, but what if we modified it to fetch the policy external to the one from Nova...leave Nova alone, but add an additional fetch and check? | 20:51 |
| stevemar | notmorgan: bknudson_ we're using it for trivial json loads/dumps... | 20:51 |
| notmorgan | ayoung: so, with this new policy file, wherever it comes from, the enforcement is Deny? | 20:51 |
| notmorgan | ayoung: and it's just an enumerate calls allowed by <identifier> [role_or_user] | 20:52 |
| ayoung | notmorgan, yeah. It is an additional Deny step on top of what the services ship themselves | 20:52 |
| notmorgan | ayoung: ok i think we might want to add a flat deny rule and flat accept [explicit] in oslo.policy DSL | 20:52 |
| notmorgan | ayoung: so we can say like iptables: Default DENY | 20:52 |
| ayoung | the services then are OK to just focus on "does this project id match " and "is the user have any role" | 20:53 |
| notmorgan | ayoung: exactly. | 20:53 |
| stevemar | bknudson_: jamie has patches for deprecating plugins and adapter, they are in the same chain as deprecating session | 20:53 |
| notmorgan | ayoung: i need to think on the x509 story, cause we don't ask keystone there | 20:53 |
| ayoung | and we can put in a more complex "admin override" for henrynash 's use cases, too | 20:53 |
| notmorgan | ayoung: but we support x509 svc->svc iirc | 20:53 |
| *** jbell8 has quit IRC | 20:53 | |
| ayoung | X509 we support for calls from service to keystone only | 20:54 |
| bknudson_ | stevemar: I know he does, but notmorgan -1d the chain. | 20:54 |
| ayoung | not nova to neutron | 20:54 |
| stevemar | bknudson_: damn notmorgan! | 20:54 |
| notmorgan | bknudson_: only until we are closer on the ksa conversion | 20:54 |
| notmorgan | i don't want to emit DEPRECATED OMG | 20:54 |
| notmorgan | on everything in the release | 20:54 |
| stevemar | notmorgan: we've got nova and neutron moved over :P | 20:54 |
| notmorgan | http://codesearch.openstack.org/?q=from%20keystoneclient%20import%20session&i=nope&files=&repos= | 20:54 |
| bknudson_ | might have to wait for N. | 20:55 |
| notmorgan | heat, novaclient, barbicanclient, sahara, saraha-client, cinder, ec2-api (meh, they can fight for themselves) | 20:55 |
| notmorgan | we can get the core projects and clients over this cycle | 20:55 |
| notmorgan | and then i'm ok with it | 20:55 |
| notmorgan | but if cinder, glance, and barbican are emitting deprecation warnings | 20:55 |
| bknudson_ | projects just got on keystoneclient session and now they have to start over again. | 20:55 |
| notmorgan | we need to wait | 20:55 |
| stevemar | bknudson_: yeah =\ | 20:55 |
| *** dims has quit IRC | 20:56 | |
| bknudson_ | this is why everyone hates us. | 20:56 |
| notmorgan | bknudson_: for the most part it's s/from keystoneclient import session/from keystoneauth1 import session/ | 20:56 |
| notmorgan | bknudson_: it's also why we ( mordred and I ) have been pushing the changes directly | 20:56 |
| bknudson_ | he he : keystoneclient/client.py -- we can't even keep up! | 20:56 |
| notmorgan | instead of assuming the project would do it themselves | 20:56 |
| ayoung | Not true. People hate me for many more reasons than just this. | 20:56 |
| notmorgan | really... http://git.openstack.org/cgit/openstack/neutron/tree/neutron/services/externaldns/drivers/designate/driver.py#n22 WE JUST FIXED NEUTRON | 20:57 |
| notmorgan | i want to break some fingers for that. | 20:57 |
| notmorgan | i know we removed ksc from neutron when we did it | 20:57 |
| notmorgan | this means someone added it back in. | 20:58 |
| notmorgan | i think we need a hacking check | 20:58 |
| bknudson_ | new broken code is being added faster than we can remove it. | 20:58 |
| stevemar | notmorgan: lol | 20:59 |
| stevemar | thats awesome | 20:59 |
| bknudson_ | probably because there's no docs for keystoneauth -- http://docs.openstack.org/developer/language-bindings.html | 20:59 |
| bknudson_ | and the keystoneclient docs say to use keystoneclient session -- http://docs.openstack.org/developer/python-keystoneclient/using-sessions.html | 21:00 |
| samueldmq | ayoung: so nova would need to fetch and apply neutron policy ? | 21:00 |
| notmorgan | bknudson_: that ... i think is fixed. | 21:00 |
| notmorgan | bknudson_: now. | 21:00 |
| notmorgan | or should be in a soon-release(tm) | 21:00 |
| ayoung | samueldmq, nah, | 21:00 |
| ayoung | if nova calls neutron, it calls it with the service token and the roles/userid from the user token that called it | 21:01 |
| ayoung | neutron fetches neutron policy for RBAC and executes it | 21:01 |
| samueldmq | ayoung: or just executes the static policy as it is today | 21:01 |
| ayoung | samueldmq, not "or" | 21:01 |
| samueldmq | ayoung: this is separate from dynamic policy right ? | 21:01 |
| ayoung | "and it also executes static policy" | 21:02 |
| samueldmq | I think this was how to enforce policy, and not how do we get policy | 21:02 |
| ayoung | samueldmq, dynamic policy is a layer on top of static policy. Both need to pass for an operation to execute | 21:02 |
| *** diazjf has quit IRC | 21:02 | |
| samueldmq | ayoung: yes I know, but this whole mechanism we were talking with notmorgan about svc -> svc doesn't require anything from dynamic policy | 21:03 |
| samueldmq | it can be done with our current policies today, right ? | 21:03 |
| *** phalmos has quit IRC | 21:03 | |
| ayoung | samueldmq, 2 stages | 21:03 |
| ayoung | today, we can;t say "this is what you can do with a service token" | 21:03 |
| ayoung | but we could modifuy ATM to allow a service token in, and trust that the authdata(roles) passed from the calling services are all valid | 21:04 |
| ayoung | so dynamic policy is an additional check for services, and can be an additional check for RBAC, too. | 21:04 |
| samueldmq | why do we need service tokens at all ? this makes me think services need to get a token in keystone | 21:05 |
| samueldmq | couldn't we just make services trust each other ? | 21:05 |
| *** su_zhang has quit IRC | 21:05 | |
| *** dims has joined #openstack-keystone | 21:05 | |
| notmorgan | dynamic policy can mix in | 21:06 |
| notmorgan | but it's not needed | 21:06 |
| notmorgan | samueldmq: there was a request to limit actions svc->svc | 21:06 |
| notmorgan | which is fair | 21:06 |
| notmorgan | but i punt that to a stage 2 | 21:06 |
| notmorgan | because we need scaffolding first to support it and be consistent | 21:07 |
| samueldmq | notmorgan: that's how I see, dp is not a requirement for this at all | 21:07 |
| *** mylu has quit IRC | 21:07 | |
| *** mylu has joined #openstack-keystone | 21:07 | |
| samueldmq | notmorgan: btw svc -> svc policy isn't something we want deployers to customize at all right ? | 21:07 |
| notmorgan | samueldmq: ideally no. | 21:08 |
| samueldmq | ++ | 21:08 |
| notmorgan | samueldmq: but i don't want to jump down that path until we have the stage one things on the way | 21:08 |
| notmorgan | stevemar: going to add a warning on import of ksc.session | 21:08 |
| notmorgan | stevemar: so we can use logstash | 21:08 |
| samueldmq | notmorgan: okay, all this should be written somewhere | 21:09 |
| stevemar | notmorgan: why not use jamie's patch? | 21:09 |
| samueldmq | notmorgan: a spec ? under keystone ? cross-proj ? | 21:09 |
| *** jbell8 has joined #openstack-keystone | 21:09 | |
| notmorgan | stevemar: we don't want to emit a warning on session, just on import until at least the core projects are converted | 21:09 |
| notmorgan | on session obj. itself it's scarier | 21:09 |
| *** pauloewerton has quit IRC | 21:10 | |
| notmorgan | stevemar: i mean. we can just deprecate as long as the message is emitted once | 21:10 |
| notmorgan | but on import of ksc.session might be easier. | 21:10 |
| notmorgan | right now it would warn on every session init | 21:10 |
| notmorgan | could be a lot of warnings | 21:11 |
| *** raildo is now known as raildo-afk | 21:11 | |
| notmorgan | samueldmq: stage 1 is things people will take [projects] because ksa is the right way | 21:11 |
| notmorgan | samueldmq: and impacting keystonemiddleware | 21:11 |
| notmorgan | samueldmq: stage 2 is likely x-project stuff | 21:12 |
| ayoung | notmorgan, ok, so stage one is the ability to create a session using service token, and to add user auth data to a specific call, or would it be a session per user-auth-data? | 21:12 |
| *** jbell8 has quit IRC | 21:13 | |
| notmorgan | ayoung: stage 1 is everyone using ksa, ksm depositing the auth-data in oslo.context (so we can access it anytime), ksm accepting service-token and userdata, and an auth-plugin to override behavior for svc->svc communication bundling up the user data instead of sending the raw token | 21:13 |
| notmorgan | ayoung: auth-plugin for ksa that is | 21:14 |
| notmorgan | ayoung: so nova config could just use it and get the behavior without needing to write special nova code. | 21:14 |
| notmorgan | when talking to glance. | 21:14 |
| *** clayton has quit IRC | 21:14 | |
| ayoung | notmorgan, so for each call from Nova to Glance, Nova is going to have to swap the auth plugin, based on the user that called? | 21:14 |
| stevemar | bknudson_: can't get rid of stevedore as a req >.< | 21:14 |
| notmorgan | nope | 21:14 |
| *** ajayaa has quit IRC | 21:14 | |
| stevemar | it's used in ksc.auth.base | 21:14 |
| notmorgan | it's in the config. | 21:14 |
| *** boris-42 has joined #openstack-keystone | 21:14 | |
| *** ajayaa has joined #openstack-keystone | 21:15 | |
| notmorgan | nova -> glance has a user/passowrd/whatever + auth_type in nova.conf | 21:15 |
| *** ajayaa has quit IRC | 21:15 | |
| notmorgan | so it would construct a session using the "svc-to-svc' plugin | 21:15 |
| notmorgan | which would grab the oslo.context data ksm dropped in from thread.local | 21:15 |
| notmorgan | then talk to glance w/ the service token and that data | 21:15 |
| notmorgan | so the data passed on would change, but the auth_type would be servce-to-service | 21:16 |
| samueldmq | hmm | 21:16 |
| *** esp_ has joined #openstack-keystone | 21:16 | |
| notmorgan | which does the magic [long term we can update nova's code, but this also means we're 100% reverse compat] | 21:16 |
| samueldmq | so user token arrives in nova, nova uses its own token with added info to talk to others | 21:17 |
| *** ajayaa has joined #openstack-keystone | 21:17 | |
| notmorgan | yep. | 21:17 |
| samueldmq | where added info is going to be user info (roles, whatever) | 21:17 |
| samueldmq | nice | 21:17 |
| *** ajayaa has quit IRC | 21:17 | |
| *** su_zhang has joined #openstack-keystone | 21:17 | |
| *** jbell8 has joined #openstack-keystone | 21:17 | |
| bknudson_ | stevemar: ok... should be able to get rid of that in favor of keystoneauth | 21:17 |
| notmorgan | and since we control ksa and keystonemiddleware, it's easy for us to make these changes w/o needing to update every project everywhere they do it. | 21:17 |
| notmorgan | we just need them on ksa w/ proper config values. | 21:18 |
| *** drjones has joined #openstack-keystone | 21:18 | |
| notmorgan | and we can move the system the direction we need in a straightforward manner | 21:18 |
| notmorgan | and be reverse compat if someone wants to keep doing silly old-style-user-authz-passed-around | 21:18 |
| *** vgridnev has quit IRC | 21:18 | |
| *** _cjones_ has quit IRC | 21:19 | |
| notmorgan | ok i need to pack up and drive to seattle | 21:19 |
| stevemar | bknudson_: yeah, looking at that now | 21:20 |
| *** gordc has joined #openstack-keystone | 21:20 | |
| *** esp_ has quit IRC | 21:21 | |
| stevemar | notmorgan: ayoung easy one: https://review.openstack.org/#/c/274436/1 | 21:21 |
| samueldmq | notmorgan: safe trips | 21:22 |
| stevemar | notmorgan: samueldmq! https://review.openstack.org/#/c/274435/ | 21:22 |
| notmorgan | stevemar: 2.6 too! make sure 2.6 workarounds are gone | 21:22 |
| stevemar | notmorgan: i think they are | 21:22 |
| notmorgan | stevemar: delete keyring! | 21:22 |
| notmorgan | delete keyring! | 21:22 |
| notmorgan | :P | 21:22 |
| stevemar | there are actually very few open patches in ksc :O | 21:23 |
| stevemar | https://review.openstack.org/#/q/status:open+project:openstack/python-keystoneclient | 21:23 |
| samueldmq | oh first one got double +A :-) | 21:23 |
| notmorgan | stevemar: ksc isn't seeing a lot of work because not a lot in keystone has moved until recently | 21:24 |
| *** _cjones_ has joined #openstack-keystone | 21:24 | |
| notmorgan | oh and client .. haha client... | 21:24 |
| stevemar | samueldmq: double A is okay :) | 21:24 |
| *** daemontool_ has joined #openstack-keystone | 21:25 | |
| notmorgan | stevemar: triple +A it! | 21:25 |
| bknudson_ | half the patches to keystoneclient are making changes the cli | 21:25 |
| notmorgan | bknudson_: which is nice to be able to say "nope" to most of the time | 21:25 |
| *** drjones has quit IRC | 21:25 | |
| samueldmq | brb | 21:26 |
| *** daemontool has quit IRC | 21:27 | |
| *** _cjones_ has quit IRC | 21:28 | |
| *** _cjones_ has joined #openstack-keystone | 21:29 | |
| *** timcline_ has quit IRC | 21:29 | |
| bknudson_ | keystoneclient 3.0! | 21:29 |
| *** samueldmq has quit IRC | 21:29 | |
| bknudson_ | https://review.openstack.org/#/c/257127/ | 21:30 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests for role management with v3policy file https://review.openstack.org/261846 | 21:30 |
| stevemar | bknudson_: numbers are cheap :P | 21:30 |
| stevemar | bknudson_: bug? it's removing dead code *sheepish grin* | 21:31 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add CRUD support for domain specific roles https://review.openstack.org/261870 | 21:31 |
| *** rderose has joined #openstack-keystone | 21:31 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 21:31 |
| bknudson_ | releasenotes should be easily searchable, so bugs/blueprints aren't as necessary anymore. | 21:31 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 21:32 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 21:32 |
| *** jsavak has quit IRC | 21:32 | |
| bknudson_ | stevemar: so are we removing the CLI or not? https://review.openstack.org/#/c/258181/ | 21:33 |
| *** jsavak has joined #openstack-keystone | 21:33 | |
| stevemar | bknudson_: i'm not sure about the ramifications of that | 21:34 |
| ayoung | KILL THE CLI! | 21:34 |
| bknudson_ | stevemar: it'll break everybody and everybody will hate us even more. | 21:34 |
| ayoung | they can't hate me more than they already do | 21:34 |
| ayoung | henrynash, I guess I better get on reviewing those, eh? | 21:34 |
| bknudson_ | might have to wear bullet-proof vests in austin. | 21:34 |
| henrynash | ayoung: :-) | 21:35 |
| bknudson_ | although that would be a good idea anyways | 21:35 |
| ayoung | henrynash, it starts with the testsonly one | 21:35 |
| ayoung | right? | 21:35 |
| ayoung | https://review.openstack.org/#/c/261846/21/keystone/tests/unit/test_v3_protection.py | 21:35 |
| henrynash | ayoung: yep | 21:35 |
| stevemar | bknudson_: ayoung we should send an email to the ops and dev mailing list first | 21:35 |
| tjcocozz | stevemar, if they are using the cli wouldn't they just need to cap the version? | 21:36 |
| *** drjones has joined #openstack-keystone | 21:36 | |
| *** _cjones_ has quit IRC | 21:36 | |
| ayoung | henrynash, ok, that one looks reall good | 21:36 |
| stevemar | tjcocozz: | 21:36 |
| stevemar | tjcocozz: yep | 21:36 |
| stevemar | tjcocozz: and we've been emitting deprecations for a loooong time now | 21:36 |
| henrynash | ayoung: I’d be worried that was contentious! | 21:36 |
| ayoung | henrynash, and that was just a rebase, right? | 21:36 |
| henrynash | ayoung: last patch, yep | 21:37 |
| ayoung | +2A | 21:37 |
| henrynash | ayoung: cool | 21:37 |
| stevemar | bknudson_: OTOH - we can easily wait til beginning of N at this point | 21:37 |
| stevemar | and claim it's been a whole extra release :O | 21:37 |
| bknudson_ | stevemar: waiting to N would be nice of us. | 21:38 |
| tjcocozz | stevemar, I don't know much... but i know it should go :) | 21:38 |
| bknudson_ | but as soon as N is open it's done! | 21:38 |
| stevemar | bknudson_: agreed | 21:38 |
| stevemar | bknudson_: and the old incubator dir | 21:38 |
| bknudson_ | what about the old incubator dir? | 21:39 |
| *** rderose has quit IRC | 21:39 | |
| *** daemontool_ has quit IRC | 21:39 | |
| stevemar | bknudson_: there were about 5 projects importing it | 21:39 |
| *** daemontool_ has joined #openstack-keystone | 21:40 | |
| stevemar | i fixed them up, but they are unreleased | 21:40 |
| bknudson_ | stevemar: so don't merge https://review.openstack.org/#/c/257127/ ? | 21:40 |
| *** weshay_xchat has quit IRC | 21:40 | |
| stevemar | bknudson_: already -W'ed it | 21:40 |
| stevemar | bknudson_: you can +2 the remove CLI patch :P | 21:40 |
| stevemar | i think folks are finally starting to warm up to osc, let's give them til N before we wipe keystoneCLI | 21:41 |
| *** su_zhang has quit IRC | 21:41 | |
| bknudson_ | once you go osc you'll never go back. | 21:41 |
| bknudson_ | you can put that on the web site. | 21:42 |
| stevemar | "once you go osc you'll never go back" | 21:42 |
| stevemar | "cause keystone cli is missing a good chunk of stuff!" | 21:42 |
| bknudson_ | better than the new gerrit motto which is -- you'll wish you were using the old gerrit | 21:43 |
| *** clayton has joined #openstack-keystone | 21:43 | |
| *** drjones has quit IRC | 21:43 | |
| stevemar | lol | 21:45 |
| *** timcline has joined #openstack-keystone | 21:45 | |
| *** cdcasey has quit IRC | 21:46 | |
| *** _cjones_ has joined #openstack-keystone | 21:46 | |
| *** jistr has joined #openstack-keystone | 21:46 | |
| *** jistr has quit IRC | 21:47 | |
| *** drjones has joined #openstack-keystone | 21:49 | |
| *** _cjones_ has quit IRC | 21:50 | |
| stevemar | notmorgan: can you comment on https://review.openstack.org/#/c/243322/ | 21:51 |
| *** Ephur has joined #openstack-keystone | 21:51 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add is_domain filter to v3 list_projects https://review.openstack.org/158398 | 21:51 |
| *** mylu has quit IRC | 21:52 | |
| *** mylu has joined #openstack-keystone | 21:53 | |
| *** shoutm has joined #openstack-keystone | 21:54 | |
| *** _cjones_ has joined #openstack-keystone | 21:54 | |
| *** drjones has quit IRC | 21:54 | |
| *** jsavak has quit IRC | 21:55 | |
| openstackgerrit | Dina Belova proposed openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 21:55 |
| *** mylu has quit IRC | 21:56 | |
| *** mylu has joined #openstack-keystone | 21:56 | |
| *** mylu has quit IRC | 21:56 | |
| *** DinaBelova has joined #openstack-keystone | 21:56 | |
| *** drjones has joined #openstack-keystone | 21:56 | |
| *** _cjones_ has quit IRC | 21:57 | |
| DinaBelova | Keystone reviewers, o/ I'm kindly asking you to review osprofiler Oslo lib related changes: https://review.openstack.org/#/c/103368/ - to keystone itself and https://review.openstack.org/#/c/255861/ - to openstackclient (as functional changes should not be added anymore to keystoneclient, i did needed change in openstack client) | 21:58 |
| ayoung | henrynash, if domain_id is set when calling list roles, are we supposed to see global roles, or only domains specific roles for the specified domain? | 22:01 |
| *** cdcasey_ has joined #openstack-keystone | 22:01 | |
| breton | stevemar: have a look at https://review.openstack.org/#/c/275685/ please | 22:03 |
| stevemar | breton: hmm, i thought dhellmann wanted that chained up with his other patches | 22:03 |
| stevemar | i just realized i never commented on it | 22:03 |
| breton | oh | 22:04 |
| breton | he overwrote some of my changes with his rebasing | 22:04 |
| *** su_zhang has joined #openstack-keystone | 22:04 | |
| breton | indeed. I will rebase the patch on top of his patches | 22:05 |
| cdcasey_ | rebasing kills | 22:05 |
| stevemar | breton: ++ | 22:05 |
| *** PsionTheory has joined #openstack-keystone | 22:05 | |
| stevemar | cdcasey_: rebase all the things | 22:06 |
| *** petertr7 is now known as petertr7_away | 22:06 | |
| *** erlarese has quit IRC | 22:07 | |
| stevemar | thanks breton | 22:07 |
| openstackgerrit | Merged openstack/keystone: Store config in drivers and use it to get list_limit https://review.openstack.org/255408 | 22:09 |
| *** cdcasey_ has quit IRC | 22:09 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 22:09 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 22:09 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove validate_v2_token from Fernet provider https://review.openstack.org/274852 | 22:09 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 22:09 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove support for trusts in v2.0 https://review.openstack.org/274850 | 22:09 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 22:09 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v2_token() https://review.openstack.org/274851 | 22:09 |
| stevemar | henrynash: dolphm are domain specific roles and changing the policy.json different approaches to the same problem? | 22:12 |
| bknudson_ | does keystoneauth belong on http://docs.openstack.org/developer/language-bindings.html or http://docs.openstack.org/developer/openstack-projects.html ? | 22:13 |
| *** cdcasey has joined #openstack-keystone | 22:14 | |
| bknudson_ | I'm leaning towards http://docs.openstack.org/developer/openstack-projects.html | 22:14 |
| bknudson_ | there should be lots of links from http://docs.openstack.org/developer/keystone/ to keystoneauth anyways. | 22:14 |
| dolphm | stevemar: the billion roles approach tackles at a significant part of the same use cases as domain specific roles (many of the roles you *might* need in a domain *might* already be defined), and role policy dynamic stuff except for the queryability, since policy is static and not exposed to the API (but it gives you conventions you might not have to query about) | 22:14 |
| bknudson_ | correction - there should be lots of links from http://docs.openstack.org/developer/python-keystoneclient/ to keystoneauth | 22:15 |
| *** henrynash has quit IRC | 22:16 | |
| *** gordc has quit IRC | 22:16 | |
| stevemar | dolphm: we'll need to hash this all out | 22:16 |
| stevemar | dolphm: i don't want henry working on dsr if we can avoid it | 22:17 |
| *** dims_ has joined #openstack-keystone | 22:17 | |
| *** su_zhang has quit IRC | 22:17 | |
| stevemar | bknudson_: dolphm can one of you comment on https://review.openstack.org/#/c/243322/ ? i'm about to head out | 22:17 |
| *** mylu has joined #openstack-keystone | 22:18 | |
| stevemar | dolphm: tonight and tomorrow i'm all shadow users | 22:18 |
| *** sinese has quit IRC | 22:18 | |
| dolphm | stevemar: sweet! | 22:19 |
| dolphm | stevemar: is that barbican/nova change totally missing the point? | 22:20 |
| *** dims has quit IRC | 22:21 | |
| *** diazjf has joined #openstack-keystone | 22:21 | |
| *** spzala has quit IRC | 22:22 | |
| *** spzala has joined #openstack-keystone | 22:23 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 22:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove validate_v2_token from Fernet provider https://review.openstack.org/274852 | 22:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 22:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove support for trusts in v2.0 https://review.openstack.org/274850 | 22:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v2_token() https://review.openstack.org/274851 | 22:24 |
| ayoung | lbragstad, we need all of those to get the default to work? | 22:26 |
| lbragstad | ayoung yep | 22:26 |
| ayoung | lbragstad, awesome. reviewing now | 22:26 |
| *** pushkaru has quit IRC | 22:26 | |
| lbragstad | ayoung start here https://review.openstack.org/#/c/196877/34 | 22:26 |
| ayoung | lbragstad, nope | 22:26 |
| *** jsavak has joined #openstack-keystone | 22:26 | |
| ayoung | that is 34, you pushed 35... | 22:26 |
| * ayoung already on it. smarmy git | 22:27 | |
| lbragstad | ayoung start here - https://review.openstack.org/#/c/196877 | 22:27 |
| *** dims_ has quit IRC | 22:27 | |
| *** gildub has joined #openstack-keystone | 22:28 | |
| *** spzala has quit IRC | 22:28 | |
| *** jsavak has quit IRC | 22:31 | |
| *** jsavak has joined #openstack-keystone | 22:31 | |
| *** drjones has quit IRC | 22:33 | |
| *** _cjones_ has joined #openstack-keystone | 22:34 | |
| *** timcline has quit IRC | 22:48 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 22:50 |
| *** su_zhang has joined #openstack-keystone | 22:52 | |
| *** mylu has quit IRC | 22:53 | |
| *** diazjf has quit IRC | 22:54 | |
| *** mylu has joined #openstack-keystone | 22:54 | |
| *** jsavak has quit IRC | 22:55 | |
| *** topol has quit IRC | 23:00 | |
| *** spzala_ has joined #openstack-keystone | 23:01 | |
| *** topol_ has joined #openstack-keystone | 23:02 | |
| *** jbell8 has quit IRC | 23:02 | |
| *** roxanagh_ has joined #openstack-keystone | 23:04 | |
| openstackgerrit | Merged openstack/keystone: Expose method list inconsistency in federation api https://review.openstack.org/229125 | 23:04 |
| *** spzala_ has quit IRC | 23:06 | |
| *** ninag has quit IRC | 23:07 | |
| *** csoukup_ has quit IRC | 23:07 | |
| *** ninag has joined #openstack-keystone | 23:07 | |
| *** ninag has quit IRC | 23:12 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 23:17 |
| *** ninag has joined #openstack-keystone | 23:18 | |
| *** mylu has quit IRC | 23:21 | |
| *** jimbaker has joined #openstack-keystone | 23:22 | |
| *** e0ne has joined #openstack-keystone | 23:24 | |
| *** slberger has left #openstack-keystone | 23:25 | |
| *** mylu has joined #openstack-keystone | 23:25 | |
| *** mylu has quit IRC | 23:26 | |
| andrewbogott | I’m in the process of migrating from ldap assignment to keystone assignment. I’ve changed my keystone config to remove the ldap lines about roles, and now I’m trying to create an initial keystone tenant to bootstrap migration. | 23:28 |
| andrewbogott | That’s failing, which makes me think I’m not understanding how my config should look. Here’s what I have: https://dpaste.de/TRAm | 23:28 |
| andrewbogott | (Users will still be in ldap) | 23:28 |
| andrewbogott | I’m using kilo, with the 2.0 api | 23:30 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:30 | |
| *** csoukup_ has joined #openstack-keystone | 23:31 | |
| *** e0ne has quit IRC | 23:33 | |
| andrewbogott | https://www.irccloud.com/pastebin/q4iHHYxq/ | 23:35 |
| *** mylu has joined #openstack-keystone | 23:44 | |
| andrewbogott | Ah, the answer seems to be | 23:47 |
| andrewbogott | [assignment] | 23:47 |
| andrewbogott | driver = keystone.assignment.backends.sql.Assignment | 23:47 |
| *** jamielennox|away is now known as jamielennox | 23:47 | |
| *** mylu has quit IRC | 23:48 | |
| *** mylu has joined #openstack-keystone | 23:48 | |
| *** edmondsw has quit IRC | 23:49 | |
| *** crinkle has quit IRC | 23:55 | |
| *** crinkle has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
