| *** ayoung has quit IRC | 00:02 | |
| *** catintheroof has joined #openstack-keystone | 00:11 | |
| *** chris_hultin is now known as chris_hultin|AWA | 00:15 | |
| *** guoshan has joined #openstack-keystone | 00:22 | |
| *** guoshan has quit IRC | 00:26 | |
| *** ravelar has joined #openstack-keystone | 00:34 | |
| *** ravelar has quit IRC | 00:35 | |
| *** spzala has quit IRC | 00:39 | |
| openstackgerrit | Merged openstack/keystoneauth: Using assertIsNotNone() instead of assertNotEqual(None) https://review.openstack.org/397521 | 00:39 |
|---|---|---|
| *** cheran has joined #openstack-keystone | 00:41 | |
| *** Zer0Byte__ has quit IRC | 00:43 | |
| *** ayoung has joined #openstack-keystone | 00:49 | |
| *** ChanServ sets mode: +v ayoung | 00:49 | |
| *** gyee has quit IRC | 00:53 | |
| *** diazjf has quit IRC | 00:54 | |
| *** hoangcx has joined #openstack-keystone | 00:54 | |
| *** catintheroof has quit IRC | 00:54 | |
| *** ayoung has quit IRC | 01:06 | |
| *** chlong has quit IRC | 01:11 | |
| *** phalmos has quit IRC | 01:18 | |
| *** guoshan has joined #openstack-keystone | 01:25 | |
| *** chrisplo has quit IRC | 01:27 | |
| *** zhangjl has joined #openstack-keystone | 01:32 | |
| *** zhugaoxiao has quit IRC | 01:47 | |
| *** browne has quit IRC | 01:54 | |
| lbragstad | stevemar yo | 01:59 |
| stevemar | lbragstad: oy | 01:59 |
| lbragstad | stevemar quick question - how is https://review.openstack.org/#/c/397410/ an alternate to enhancing the mapping engine? | 01:59 |
| lbragstad | stevemar i saw that as a note in here - https://docs.google.com/spreadsheets/d/156q820cXcEc8Y9YWQgoc_hyOm3AZ2jtMQM3zdDhwGFU/edit?ts=582b4268#gid=0 | 02:00 |
| stevemar | lbragstad: i guess in my mind it was | 02:10 |
| stevemar | lbragstad: but you can disregard my comment | 02:12 |
| lbragstad | stevemar no worries - i was just parsing the document and read that... | 02:12 |
| lbragstad | and it made me curious | 02:13 |
| rderose | lbragstad: that's what I tend to do when comes to stevemar | 02:13 |
| lbragstad | lol | 02:13 |
| rderose | :) | 02:13 |
| stevemar | sometimes i write things down a bit too fast | 02:14 |
| stevemar | i only glanced at the title and thought it was an alternative | 02:14 |
| stevemar | i probably shouldn't have broadcasted it | 02:14 |
| rderose | stevemar I've taken a couple shots at you today and no response, what's up | 02:15 |
| *** markvoelker has quit IRC | 02:18 | |
| *** adrian_otto has quit IRC | 02:19 | |
| *** guoshan has quit IRC | 02:20 | |
| *** guoshan has joined #openstack-keystone | 02:24 | |
| *** spzala has joined #openstack-keystone | 02:39 | |
| *** spzala has quit IRC | 02:44 | |
| *** dave-mccowan has joined #openstack-keystone | 02:47 | |
| *** chrisplo has joined #openstack-keystone | 02:47 | |
| *** browne has joined #openstack-keystone | 02:48 | |
| *** browne has quit IRC | 02:49 | |
| openstackgerrit | howard lee proposed openstack/python-keystoneclient: Replace 'assertFalse(a in b)' with 'assertNotIn(a, b)' https://review.openstack.org/399350 | 02:58 |
| *** tqtran has quit IRC | 03:07 | |
| adriant | lbragstad: re https://review.openstack.org/345705, I'm proposing a set of new API endpoints, so the lack of blob being returned is no a backward compatibility issue. | 03:13 |
| adriant | not* a | 03:14 |
| lbragstad | adriant ah - so we'll have two apis for credentials? | 03:14 |
| adriant | we already do, see EC2 | 03:14 |
| lbragstad | so - we'll have thre e | 03:14 |
| adriant | yes, the other solution would be to have one, and allow functional logic and validation on a per type basis | 03:15 |
| adriant | which is... a refactor and a lot of work on the credential code :/ | 03:15 |
| adriant | and change the policy stuff. | 03:15 |
| lbragstad | adriant hmm from a maintainence perspective, i almost lean towards that | 03:16 |
| lbragstad | adriant do you use the ec2 controller today/ | 03:16 |
| adriant | Yeah, we've had clients who have done things via the EC2 APIs with their ec2 creds | 03:17 |
| *** guoshan has quit IRC | 03:17 | |
| adriant | lbragstad: I agree, the best long term solution is to merge the EC2 functionality into an expanded set of credentials controllers, with maybe plugins for each credential type. | 03:18 |
| adriant | but that's a hell of a lot of work | 03:18 |
| *** markvoelker has joined #openstack-keystone | 03:19 | |
| adriant | Worthwhile, but still huge. All while maintaining backward compatibility! | 03:19 |
| *** dikonoor has joined #openstack-keystone | 03:19 | |
| *** guoshan has joined #openstack-keystone | 03:19 | |
| lbragstad | adriant wouldn't it be a large refactor? | 03:20 |
| lbragstad | adriant do you expect maintain backwards compat with that refactor to be a problem? | 03:20 |
| lbragstad | (i'm not all that familiar with the ec2 api so i apologize) | 03:21 |
| adriant | lbragstad: not sure. | 03:21 |
| adriant | the EC2 api and controller is reasonably simple, but it has EC2 specific logic, which doesn't make sense in the core credential code. | 03:21 |
| lbragstad | adriant true, how is the ec2 controller invoked? | 03:22 |
| adriant | currently the credentials endpoints don't care about type validation, or anything. They are pretty much a glorified key:value store it seems. | 03:22 |
| lbragstad | it has it's own endpoints, right? | 03:22 |
| adriant | yep | 03:22 |
| lbragstad | huh | 03:22 |
| lbragstad | ok | 03:22 |
| adriant | hence this spec suggestion. | 03:23 |
| adriant | to do something like the EC2 stuff, but for TOTP | 03:23 |
| adriant | and then we can do totp specific policy on those new endpoints | 03:23 |
| adriant | as well as totp specific logic and validation | 03:23 |
| lbragstad | totp specific logic and validation? | 03:23 |
| lbragstad | have an example? | 03:23 |
| adriant | server side generation of a TOTP secret | 03:24 |
| adriant | or when uploading your own some sort of strength/length requirements | 03:24 |
| adriant | the second part being configurable | 03:24 |
| lbragstad | sure | 03:24 |
| *** markvoelker has quit IRC | 03:25 | |
| adriant | although I believe the secret also has to be a specific encoding... so that needs validation | 03:25 |
| lbragstad | right - a TOTP secret is specific to TOTP, right? | 03:26 |
| adriant | yeah pretty much | 03:26 |
| lbragstad | becuase it has to be plugged into an algorithm in order to be effective | 03:26 |
| adriant | yep | 03:26 |
| lbragstad | how do you validate a TOTP secret? | 03:26 |
| lbragstad | without using it? | 03:27 |
| adriant | no clue, I've never had to, but I'm basically thinking, does it match a format we can use for the algorithm | 03:27 |
| adriant | plus does it meet the min strength requirement | 03:28 |
| lbragstad | hmm - we might have to do some digging into the TOTP spect | 03:28 |
| lbragstad | spec* | 03:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add developer docs for keystone-manage doctor https://review.openstack.org/399163 | 03:30 |
| adriant | lbragstad: mainly the check would need to be, is the secret base32, and does it meet the min length (google authenticator requires 16chars min) | 03:31 |
| lbragstad | stevemar gagehugo ^ addressed the latest comments - thanks for the reviews | 03:31 |
| lbragstad | adriant i assume GA implements a spec, right? | 03:32 |
| adriant | yes, I can find that... sec | 03:32 |
| lbragstad | so validation on our side wouldn't have to change depending on what type of validator the user is using? | 03:32 |
| adriant | https://github.com/google/google-authenticator/wiki/Key-Uri-Format | 03:33 |
| adriant | although I don't see a min length listed there, just base32. I only know it's 16 chars because I checked manually a while ago. | 03:34 |
| *** diazjf has joined #openstack-keystone | 03:35 | |
| lbragstad | yeah - same here ... | 03:35 |
| lbragstad | https://tools.ietf.org/html/rfc3548 | 03:35 |
| adriant | We can have the base32 check for everything, and then the min length as a configurable value (with 16+ as default) | 03:36 |
| adriant | lbragstad: At least this give you some idea of why that spec is there. I wanted to add self management for TOTP for MFA, and between the options of a large refactor and a set of simple second APIs, the extra APIs seemed safer. :( | 03:38 |
| adriant | I may want to add train of thought to the spec itself. | 03:39 |
| lbragstad | adriant yeah - that would be helpful | 03:39 |
| lbragstad | or at least include the alternatives | 03:40 |
| adriant | yeah, adding it to alternatives is a good idea | 03:40 |
| lbragstad | I think including the refactor as an alternative would be good | 03:40 |
| lbragstad | i think the most significant part of that spec is that fact we're adding yet another credential api to keystone | 03:43 |
| adriant | lbragstad: As for the admin enabled TOTP, that's a hard one. Although the only solution is to include a value in the 'extra' json on the credential type and have the logic check for that. Which is messy. | 03:43 |
| lbragstad | adriant right - historically, we've had a lot of tension around extras | 03:44 |
| lbragstad | which makes me nervous to rely on it for an API | 03:44 |
| adriant | So best would be just ignore that edge case and assume TOTP is entirely self managed. | 03:44 |
| *** chrisplo has quit IRC | 03:45 | |
| lbragstad | adriant wouldn't that allow users the ability to disable totp credentials put in place by an administrator? | 03:45 |
| lbragstad | adriant what about making self-managed a first class attribute of credentials? | 03:46 |
| adriant | That could work. | 03:46 |
| adriant | And if 'false' a user can't remove, only replace. | 03:46 |
| lbragstad | yeah - a migration would be needed to ensure everything defaults to false | 03:47 |
| adriant | The problem there though is also that if an admin imposes a TOTP credential on you, they had to get that secret to you. | 03:47 |
| lbragstad | which would maintain the existing behavior | 03:47 |
| adriant | So there is a security risk if that secret isn't transmitted safely | 03:48 |
| lbragstad | sur e | 03:48 |
| adriant | and enforcing: "this user has no roles until they setup totp" is too big to do easily. | 03:48 |
| *** diazjf has quit IRC | 03:49 | |
| adriant | it's all a giant can of worms. So I'm trying for low hanging fruit and getting the easy but still very useful stuff done. | 03:49 |
| lbragstad | adriant that would be something that we'd probably have to include in the user, right? | 03:49 |
| adriant | lbragstad: yes, and probably changes in the policy code... and auth code...etc | 03:50 |
| lbragstad | yeah auth code would have to check an attribute of the user in order to determine if MFA or TOTP is require for that user :/ | 03:51 |
| adriant | yeah | 03:51 |
| lbragstad | hmm | 03:51 |
| adriant | but would still give them access to setup MFA | 03:51 |
| adriant | it's a mess | 03:51 |
| adriant | dynamic policies could work for something like this, but that's something Keystone has been discussing for ages. | 03:52 |
| adriant | and then it would depend on implementation if it works for this case too | 03:52 |
| lbragstad | so - are there other systems that setup totp for a user and transmit the secret to them? | 03:52 |
| *** chrisplo has joined #openstack-keystone | 03:52 | |
| adriant | Well, for our deployment, yes. We've built a proxy service that does a lot of keystone related stuff on behalf of the user. | 03:53 |
| lbragstad | right - i wouldn't want to wait on that in order to accomplish this - instead i would start by making whatever the admin does the law of the land and rework it once dynamic policy is addressed | 03:53 |
| adriant | Our users don't really touch keystone apart from for auth and listing their own projects. | 03:53 |
| *** dave-mccowan has quit IRC | 03:56 | |
| *** guoshan has quit IRC | 03:57 | |
| adriant | lbragstad: so in our deployment, what I'm doing is this service of mine will start a MFA setup task, which generates a secret and sends it to the user. The user then has to confirm they have the secret to the service by sending a passcode, after which the service places the totp secret in keystone, and the user now has MFA enabled. | 03:57 |
| adriant | So I can enforce "you can't remove MFA" through this as well. But basically all of this is work around limitations in Keystone. | 03:58 |
| lbragstad | so does this service have an administrator account on keystone? | 03:58 |
| adriant | yes | 03:58 |
| lbragstad | got it | 03:58 |
| adriant | the source is on github, although it needs to be updated... and I intend to move it to the openstack gerrit after the current release. | 03:59 |
| adriant | The more i can do in keystone the better, but at least in my case I've got alternative ways to do things as long as the core functionality is there. | 04:00 |
| lbragstad | sure | 04:00 |
| adriant | including password reset emails :) | 04:01 |
| lbragstad | but you want the user management of totp credentials | 04:01 |
| adriant | Once my password+totp plugin is merged it would be useful to have that in upstream yes | 04:01 |
| adriant | even if we won't use it ourselves. | 04:01 |
| adriant | otherwise there is no point having MFA support in keystone if only admins can manage it | 04:02 |
| lbragstad | use what specifically? user management of credentials? | 04:02 |
| lbragstad | since you have a service that does it? | 04:02 |
| adriant | yes, specifically user management of credentials. Because we want the challenge/confirm step. | 04:03 |
| adriant | and I'm not sure how/if we can do that challenge/confirm step in raw keystone. | 04:03 |
| lbragstad | the challenge confirm step is currently done by your service | 04:04 |
| adriant | Not yet, we've backlogged MFA until the upstream support is mostly merged. | 04:04 |
| lbragstad | ah | 04:04 |
| adriant | plus we're only just on liberty keystone, so I tend to backport the auth plugin anyway. | 04:05 |
| adriant | intend* | 04:05 |
| lbragstad | got it | 04:05 |
| *** cheran has quit IRC | 04:08 | |
| adriant | I need to fix the tests, but here is the totp auth plugin for the spec that was recently merged: https://review.openstack.org/#/c/343422/ | 04:09 |
| lbragstad | ah - nice | 04:09 |
| adriant | The user self management spec is meant to be a follow up to this | 04:10 |
| *** nicolasbock has quit IRC | 04:32 | |
| *** adrian_otto has joined #openstack-keystone | 04:34 | |
| *** chrisplo_ has joined #openstack-keystone | 04:36 | |
| *** chrisplo has quit IRC | 04:39 | |
| *** ayoung has joined #openstack-keystone | 04:43 | |
| *** ChanServ sets mode: +v ayoung | 04:43 | |
| *** namnh has joined #openstack-keystone | 04:44 | |
| *** guoshan has joined #openstack-keystone | 04:58 | |
| *** zhangjl has quit IRC | 05:01 | |
| *** guoshan has quit IRC | 05:03 | |
| *** GB21 has joined #openstack-keystone | 05:06 | |
| *** zhangjl has joined #openstack-keystone | 05:09 | |
| *** udesale has joined #openstack-keystone | 05:18 | |
| *** markvoelker has joined #openstack-keystone | 05:20 | |
| *** markvoelker has quit IRC | 05:25 | |
| *** phalmos has joined #openstack-keystone | 05:25 | |
| *** spzala has joined #openstack-keystone | 05:40 | |
| *** spzala has quit IRC | 05:44 | |
| *** phalmos has quit IRC | 05:46 | |
| *** akscram has quit IRC | 05:46 | |
| *** akscram has joined #openstack-keystone | 05:47 | |
| *** haplo37 has quit IRC | 05:52 | |
| *** guoshan has joined #openstack-keystone | 05:59 | |
| *** guoshan has quit IRC | 06:03 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Allow fetching an expired token https://review.openstack.org/382098 | 06:17 |
| *** mgagne has quit IRC | 06:18 | |
| *** adrian_otto has quit IRC | 06:18 | |
| *** timburke has quit IRC | 06:20 | |
| *** mgagne has joined #openstack-keystone | 06:21 | |
| *** mgagne is now known as Guest52285 | 06:21 | |
| *** timburke has joined #openstack-keystone | 06:23 | |
| *** guoshan has joined #openstack-keystone | 06:30 | |
| *** jamielennox is now known as jamielennox|away | 06:36 | |
| *** richm has quit IRC | 06:41 | |
| *** haplo37_ has joined #openstack-keystone | 07:05 | |
| *** tesseract has joined #openstack-keystone | 07:18 | |
| *** tesseract is now known as Guest90313 | 07:18 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Replace 'assertFalse(a in b)' with 'assertNotIn(a, b)' https://review.openstack.org/399350 | 07:21 |
| *** jaosorior has joined #openstack-keystone | 07:39 | |
| *** pcaruana has joined #openstack-keystone | 07:45 | |
| *** GB21 has quit IRC | 07:51 | |
| *** belmoreira has joined #openstack-keystone | 07:51 | |
| *** adriant has quit IRC | 07:55 | |
| *** henrynash has quit IRC | 07:55 | |
| *** GB21 has joined #openstack-keystone | 07:56 | |
| *** jamielennox|away is now known as jamielennox | 08:03 | |
| *** openstackgerrit has quit IRC | 08:03 | |
| *** openstackgerrit has joined #openstack-keystone | 08:03 | |
| *** amoralej|off is now known as amoralej | 08:12 | |
| *** hogepodge has quit IRC | 08:15 | |
| *** GB21 has quit IRC | 08:40 | |
| *** lifeless has quit IRC | 08:45 | |
| *** GB21 has joined #openstack-keystone | 08:45 | |
| *** lifeless has joined #openstack-keystone | 08:47 | |
| *** jpich has joined #openstack-keystone | 08:55 | |
| openstackgerrit | melissaml proposed openstack/keystone-specs: Fix a typo in identity-api-v3.rst https://review.openstack.org/399449 | 08:57 |
| *** hoangcx has quit IRC | 08:59 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** namnh has quit IRC | 09:00 | |
| *** belmoreira has quit IRC | 09:03 | |
| openstackgerrit | henry-nash proposed openstack/keystone: [api] add changelog from 3.0 -> 3.7 https://review.openstack.org/399301 | 09:09 |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 09:34 |
| *** spzala has joined #openstack-keystone | 09:40 | |
| *** spzala has quit IRC | 09:45 | |
| *** denezhkin has joined #openstack-keystone | 09:47 | |
| *** denezhkin is now known as pikwick | 09:48 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 09:53 | |
| pikwick | Hello! I have issius with python installation. I cloned sources from git, but then i do pip install -r requirements.txt I receive error: error: command 'gcc' failed with exit status 1 | 09:53 |
| pikwick | How to fix such issues. | 09:54 |
| pikwick | ? | 09:54 |
| *** AlexeyAbashkin has quit IRC | 10:16 | |
| *** GB21 has quit IRC | 10:16 | |
| *** belmoreira has joined #openstack-keystone | 10:17 | |
| amoralej | hi, i'm hitting an issue with keystoneauth1 when using admin_token, https://bugs.launchpad.net/keystoneauth/+bug/1642897 | 10:17 |
| openstack | Launchpad bug 1642897 in os-client-config "osc commands fail when using os-client-config >= 1.23.0" [Undecided,New] | 10:17 |
| *** guoshan has quit IRC | 10:32 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: WIP - Bootstrapping keystone for identity ldap backend. https://review.openstack.org/395967 | 10:37 |
| *** zhangjl has left #openstack-keystone | 10:38 | |
| *** udesale has quit IRC | 10:50 | |
| *** jvarlamova has joined #openstack-keystone | 10:57 | |
| *** jperry has joined #openstack-keystone | 11:04 | |
| *** jaosorior is now known as jaosorior_lunch | 11:04 | |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 11:08 |
| *** richm has joined #openstack-keystone | 11:10 | |
| *** guoshan has joined #openstack-keystone | 11:12 | |
| *** guoshan has quit IRC | 11:16 | |
| *** nicolasbock has joined #openstack-keystone | 11:21 | |
| *** khamtamtun has joined #openstack-keystone | 11:35 | |
| *** jaosorior_lunch is now known as jaosorior | 11:44 | |
| openstackgerrit | Merged openstack/keystone-specs: Fix a typo in identity-api-v3.rst https://review.openstack.org/399449 | 11:45 |
| openstackgerrit | Merged openstack/keystone: [api] add changelog from 3.0 -> 3.7 https://review.openstack.org/399301 | 11:47 |
| *** Adri2000 has joined #openstack-keystone | 12:05 | |
| Adri2000 | hello | 12:05 |
| Adri2000 | how may I debug a keystone instance that takes literally 4 minutes to respond to an http call (like "token issue") ? | 12:06 |
| Adri2000 | logs don't help, even with verbose+debug. indeed, nothing crashes or errors. it just takes a *lot* of time | 12:07 |
| *** GB21 has joined #openstack-keystone | 12:07 | |
| Adri2000 | that mitaka's version, SQL backend, fernet tokens... | 12:07 |
| *** khamtamtun has quit IRC | 12:12 | |
| *** guoshan has joined #openstack-keystone | 12:13 | |
| *** guoshan has quit IRC | 12:15 | |
| *** asettle has joined #openstack-keystone | 12:17 | |
| *** asettle has quit IRC | 12:18 | |
| *** raildo has joined #openstack-keystone | 12:20 | |
| openstackgerrit | Johannes Grassler proposed openstack/keystone-specs: Added spec on standalone trusts https://review.openstack.org/396634 | 12:30 |
| *** hogepodge has joined #openstack-keystone | 12:31 | |
| *** spzala has joined #openstack-keystone | 12:40 | |
| *** spzala has quit IRC | 12:44 | |
| breton | Adri2000: try to add more debug prints and find out where the slow parts are | 12:52 |
| Adri2000 | breton: you mean in the code? | 12:53 |
| breton | Adri2000: yes | 12:53 |
| *** GB21 has quit IRC | 12:56 | |
| breton | amoralej: hey | 13:04 |
| amoralej | hi breton | 13:05 |
| breton | amoralej: i reported https://bugs.launchpad.net/python-openstackclient/+bug/1642301 earlier | 13:05 |
| openstack | Launchpad bug 1642301 in python-openstackclient "__init__() got an unexpected keyword argument 'project_domain_id'" [Undecided,In progress] - Assigned to Boris Bobrov (bbobrov) | 13:05 |
| breton | amoralej: with the same error as you have | 13:05 |
| amoralej | ok, let me see | 13:06 |
| amoralej | so fix is in openstackclient | 13:07 |
| breton | amoralej: i am wondering whether this is the correct fix | 13:07 |
| *** tqtran has joined #openstack-keystone | 13:08 | |
| breton | i am also getting reports that mitaka is affected | 13:08 |
| amoralej | i'm not sure, breton, i'm only hitting it in master | 13:08 |
| amoralej | after os-client-config update to 1.23.0 | 13:09 |
| amoralej | stevemar, i guess you have already seen the "__init__() got an unexpected keyword argument 'project_domain_id'" issue, right? | 13:11 |
| *** tqtran has quit IRC | 13:12 | |
| *** jperry has quit IRC | 13:13 | |
| *** lamt has joined #openstack-keystone | 13:15 | |
| *** edmondsw has joined #openstack-keystone | 13:16 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add developer docs for keystone-manage doctor https://review.openstack.org/399163 | 13:17 |
| *** dave-mccowan has joined #openstack-keystone | 13:18 | |
| breton | i feel that also the correct fix would be in openstackclient, it will not be enough | 13:21 |
| breton | and that we need to either fix os-client-config, or cap os-client-config in newton and mitaka | 13:22 |
| breton | stevemar: what | 13:22 |
| breton | stevemar: *what's your opinion? | 13:22 |
| stevemar | o_O | 13:22 |
| stevemar | catching up | 13:22 |
| breton | *although the correct fix would be in openstackclient | 13:22 |
| breton | what's the channel for osc? | 13:23 |
| stevemar | breton: -sdks | 13:23 |
| *** asettle has joined #openstack-keystone | 13:24 | |
| stevemar | breton: amoralej is os-client-config introduced the change, then it should be reverted? | 13:24 |
| amoralej | stevemar, os-client-config may have only uncover it, i'm not sure | 13:26 |
| amoralej | as, even with previous versions of os-client-config, it failed if --os-auth-type admin_token was used instead of token_endpoint | 13:27 |
| amoralej | but, puppet uses token_endpoint, that's why it was not discovered before | 13:28 |
| *** asettle has quit IRC | 13:28 | |
| openstackgerrit | Jose Castro Leon proposed openstack/keystone: Adds support for array in the values of the endpoint group definition https://review.openstack.org/399590 | 13:29 |
| stevemar | amoralej: ah okay | 13:30 |
| stevemar | breton: i suppose your fix looks fine | 13:30 |
| amoralej | i'm testing it in my env | 13:30 |
| amoralej | worked like a charm breton | 13:35 |
| breton | stevemar: mitaka is broken too | 13:37 |
| breton | and probably newton | 13:37 |
| *** spzala has joined #openstack-keystone | 13:41 | |
| stevemar | breton: can you beef up the commit message with more reasoning | 13:42 |
| *** jaosorior has quit IRC | 13:42 | |
| *** amoralej is now known as amoralej|lunch | 13:42 | |
| breton | stevemar: will do | 13:43 |
| stevemar | breton: i have no idea why adding that line fixes the problem, or what it has to do with proejct_domain_id | 13:45 |
| openstackgerrit | Jose Castro Leon proposed openstack/keystone: Avoid encoding of project id in fernet tokens https://review.openstack.org/399596 | 13:49 |
| *** markvoelker has joined #openstack-keystone | 13:49 | |
| *** dmellado is now known as dmellado|lunch | 13:50 | |
| *** baffle has quit IRC | 13:51 | |
| *** baffle has joined #openstack-keystone | 13:52 | |
| *** dave-mcc_ has joined #openstack-keystone | 13:54 | |
| *** dave-mccowan has quit IRC | 13:55 | |
| stevemar | i wish people who filed blueprints would be online :( | 14:00 |
| *** phalmos has joined #openstack-keystone | 14:10 | |
| *** dmellado|lunch is now known as dmellado | 14:12 | |
| *** daemontool has joined #openstack-keystone | 14:13 | |
| *** phalmos has quit IRC | 14:13 | |
| *** jperry has joined #openstack-keystone | 14:20 | |
| *** daemontool has quit IRC | 14:21 | |
| *** daemontool has joined #openstack-keystone | 14:21 | |
| *** amoralej|lunch is now known as amoralej | 14:42 | |
| *** tqtran has joined #openstack-keystone | 14:42 | |
| *** spzala has quit IRC | 14:42 | |
| *** spzala has joined #openstack-keystone | 14:43 | |
| *** GB21 has joined #openstack-keystone | 14:44 | |
| *** lamt has quit IRC | 14:46 | |
| *** spzala has quit IRC | 14:48 | |
| *** pikwick has quit IRC | 14:51 | |
| *** lamt has joined #openstack-keystone | 14:51 | |
| *** dikonoor has quit IRC | 14:52 | |
| lbragstad | stevemar looking at any in particular? | 14:52 |
| *** chlong has joined #openstack-keystone | 14:53 | |
| *** asettle has joined #openstack-keystone | 14:54 | |
| *** adrian_otto has joined #openstack-keystone | 14:57 | |
| *** asettle has quit IRC | 14:58 | |
| stevemar | lbragstad: these two new ones: https://blueprints.launchpad.net/~jose-castro-leon | 15:04 |
| *** chris_hultin|AWA is now known as chris_hultin | 15:06 | |
| lbragstad | stevemar i'll leave some comments on the uuid id one... | 15:08 |
| stevemar | ty | 15:08 |
| *** edtubill has joined #openstack-keystone | 15:11 | |
| *** ravelar has joined #openstack-keystone | 15:26 | |
| *** adrian_otto has quit IRC | 15:27 | |
| *** chrisplo has joined #openstack-keystone | 15:28 | |
| *** chrisplo_ has quit IRC | 15:31 | |
| openstackgerrit | Jose Castro Leon proposed openstack/keystone: Adds support for array in the values of the endpoint group definition https://review.openstack.org/399638 | 15:31 |
| *** diazjf has joined #openstack-keystone | 15:33 | |
| *** josecastroleon has joined #openstack-keystone | 15:35 | |
| stevemar | yayyy jury duty is over | 15:36 |
| stevemar | i can go home | 15:36 |
| lbragstad | stevemar nice | 15:36 |
| lbragstad | stevemar that took a while | 15:36 |
| josecastroleon | stevemar: what do you think about the bugs I sent? | 15:36 |
| stevemar | josecastroleon: you didn't need to abandon the patches, just file bugs instead of blueprints | 15:38 |
| stevemar | josecastroleon: i can't believe someone is using endpoint grouping | 15:38 |
| josecastroleon | i filed them | 15:38 |
| stevemar | josecastroleon: and the uuid one, i suppose that one is fine | 15:38 |
| josecastroleon | yes | 15:38 |
| josecastroleon | us | 15:38 |
| stevemar | :) | 15:38 |
| *** diazjf has quit IRC | 15:38 | |
| lbragstad | josecastroleon do you have links to the bugs? | 15:38 |
| stevemar | josecastroleon: just add a few tests to the patch and they should be OK to merge | 15:38 |
| josecastroleon | they are just WIP | 15:39 |
| josecastroleon | we use them here but it could make sense for everyone | 15:39 |
| josecastroleon | https://review.openstack.org/#/c/399638/ | 15:41 |
| *** asettle has joined #openstack-keystone | 15:41 | |
| openstackgerrit | Merged openstack/keystone: Add developer docs for keystone-manage doctor https://review.openstack.org/399163 | 15:42 |
| stevemar | josecastroleon: will you ensure the patches get merged? or are you just leaving them here and are going to maintain your own fork? | 15:43 |
| *** GB21 has quit IRC | 15:44 | |
| stevemar | back in 20 minutes, walking home | 15:44 |
| josecastroleon | stevemar: I'd rather prefer to have them merged | 15:45 |
| stevemar | ravelar: i appreciate the gusto, but don't go assigning yourself 10 different bugs :) | 15:46 |
| knikolla | o/ | 15:46 |
| *** jdennis1 has joined #openstack-keystone | 15:46 | |
| stevemar | ravelar: you're only human! lets all share the pain and break things together | 15:47 |
| ravelar | stevemar, just 4 to keep me busy :) but i can un assign a couple lol | 15:47 |
| *** spzala has joined #openstack-keystone | 15:47 | |
| *** edtubill has quit IRC | 15:48 | |
| *** jdennis has quit IRC | 15:48 | |
| openstackgerrit | Jose Castro Leon proposed openstack/keystone: Avoid encoding of project id in fernet tokens https://review.openstack.org/399652 | 15:49 |
| josecastroleon | that's the second one | 15:49 |
| *** pcaruana has quit IRC | 15:50 | |
| *** ruan_04 has quit IRC | 15:50 | |
| *** HenryG has quit IRC | 15:50 | |
| *** HenryG has joined #openstack-keystone | 15:51 | |
| *** adrian_otto has joined #openstack-keystone | 15:55 | |
| *** tqtran has quit IRC | 15:55 | |
| dtroyer | ayoung: (since I don't see you in -sdks this morning) quick revisit on https://review.openstack.org/#/c/398917/ (the project_domain_id bug): we've already done the wrong thing for user_domain_id, plus the plugin has not been instantiated yet so we can't query it here. I agree this is wrong, but two wrongs of the same next to each other are not much worse than one… | 15:56 |
| ayoung | dtroyer, so long as you don't mind breaking people and locking us into long term mistakes | 15:57 |
| dtroyer | we already have done that | 15:57 |
| ayoung | I know. Its called Keystone | 15:57 |
| * dtroyer checks which room this is | 15:57 | |
| dtroyer | :) | 15:57 |
| *** belmoreira has quit IRC | 15:57 | |
| dtroyer | This should get removed in the upcoming merge of this sort of login into os-client-config. there are many bad hacks yet that will be taken care of | 15:58 |
| dtroyer | I can live with this new one for now | 15:58 |
| *** GB21 has joined #openstack-keystone | 15:58 | |
| ayoung | dtroyer, I'd prefer to have jamielennox chime in first | 15:58 |
| ayoung | if he can be convinced, I'd accept it | 15:58 |
| breton | i have one more question | 15:58 |
| breton | what do we do with older clients? | 15:58 |
| *** nkinder has joined #openstack-keystone | 15:58 | |
| dtroyer | ok. I +2 it, but not +A | 15:58 |
| ayoung | my concern is that we are going to force people to use password. Then again, we elected Trump, so maybe bad is the new good. | 15:59 |
| *** anush has joined #openstack-keystone | 15:59 | |
| *** phalmos has joined #openstack-keystone | 15:59 | |
| ayoung | dtroyer, but I'd rather blacklist the plugins we know it breaks than whitelist a subset | 16:00 |
| dtroyer | of course, the plugins might choose to just ignore things they do not expect… we only look at them here to do educated guesses at what the users intend | 16:02 |
| lbragstad | josecastroleon what's the rational behind https://bugs.launchpad.net/keystone/+bug/1642988 ? | 16:03 |
| openstack | Launchpad bug 1642988 in OpenStack Identity (keystone) "Avoid encoding of project id in fernet tokens" [Undecided,In progress] - Assigned to Jose Castro Leon (jose-castro-leon) | 16:03 |
| lbragstad | josecastroleon we opted to encode the uuid, if possible, because it saves space in the overall payload | 16:03 |
| lbragstad | making the entire token smaller | 16:03 |
| lbragstad | josecastroleon are you guys unpacking the tokens somewhere and inspecting the payload? | 16:04 |
| *** phalmos has quit IRC | 16:04 | |
| *** daemontool has quit IRC | 16:05 | |
| *** Guest90313 has quit IRC | 16:09 | |
| *** anush has quit IRC | 16:10 | |
| *** anush has joined #openstack-keystone | 16:12 | |
| ayoung | blast from the past....have not heard from josecastroleon for a while | 16:12 |
| *** anush has quit IRC | 16:12 | |
| *** anush has joined #openstack-keystone | 16:13 | |
| *** anush has quit IRC | 16:13 | |
| *** anush has joined #openstack-keystone | 16:14 | |
| *** anush has quit IRC | 16:14 | |
| *** anush has joined #openstack-keystone | 16:16 | |
| *** anush has quit IRC | 16:21 | |
| stevemar | dtroyer: o/ | 16:24 |
| stevemar | breton: cap o-c-c for older versions? | 16:24 |
| breton | тфрб ш дшув | 16:24 |
| breton | :( | 16:24 |
| breton | nah, i lied | 16:24 |
| stevemar | dtroyer: i +A'ed | 16:24 |
| breton | old clients are not broken | 16:24 |
| stevemar | breton: i'm very confused :) | 16:25 |
| breton | there is some other error. That looks similiar. But not the same. | 16:25 |
| breton | stevemar: that was russian crypto, you were supposed to get confused | 16:25 |
| *** diazjf has joined #openstack-keystone | 16:26 | |
| *** adrian_otto has quit IRC | 16:26 | |
| breton | 'Execution of '/usr/bin/openstack role list --quiet --format csv' returned 1: __init__() got an unexpected keyword argument 'read_timeout' (HTTP 400) (Request-ID: req-5692b819-eb8c-446c-b09b-4d7d44e19b2d)'. Retrying for 165 more seconds | 16:26 |
| * breton sighs | 16:26 | |
| stevemar | dtroyer: did you want to propose a point release ? | 16:29 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 16:42 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 16:47 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 16:48 |
| *** dikonoor has joined #openstack-keystone | 16:49 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Require domain_id when registering Identity Providers https://review.openstack.org/399157 | 16:50 |
| *** tqtran has joined #openstack-keystone | 16:52 | |
| *** agrebennikov has joined #openstack-keystone | 16:54 | |
| *** tqtran has quit IRC | 16:56 | |
| stevemar | rderose: so how do you plan on solving the issue if an existing idp and domain name match? | 16:59 |
| stevemar | rderose: i imagine you are going through the idp list and creating domain entries for all of those? as part of a migration? | 16:59 |
| rderose | for existing IdPs, I'll pull the domain from the mapping; if it doesn't exist, I'll create a new domain | 17:00 |
| rderose | yes, as part of the migration | 17:00 |
| stevemar | rderose: and if it conflicts with an existing domain? | 17:00 |
| rderose | conflicts? the new domain that I create? | 17:00 |
| stevemar | yeah | 17:00 |
| stevemar | i had domainA name "test" and an idp named "test" | 17:01 |
| rderose | oh, I will give a unique name based on the IdP id (I think) | 17:01 |
| rderose | idp doesn't have a name | 17:02 |
| stevemar | hmm, ok, the idp_id won't be used as the domain name? | 17:02 |
| rderose | only id and description | 17:02 |
| rderose | stevemar: was thinking like idp_id_123456789 as the domain name | 17:02 |
| rderose | but hopefully, most idps will have a domain in the mapping | 17:02 |
| stevemar | rderose: i wouldn't bank on that :( | 17:03 |
| rderose | :) | 17:03 |
| *** adrian_otto has joined #openstack-keystone | 17:04 | |
| rderose | stevemar: still playing with this idea. I know it's a better design to have the domain_id as part of the IdP | 17:04 |
| rderose | but implementation could be complicated (working thru it now) | 17:04 |
| *** Zer0Byte__ has joined #openstack-keystone | 17:25 | |
| *** Guest52285 is now known as mgagne | 17:33 | |
| *** mgagne has quit IRC | 17:33 | |
| *** mgagne has joined #openstack-keystone | 17:33 | |
| *** ravelar has quit IRC | 17:48 | |
| *** jpich has quit IRC | 17:53 | |
| *** tqtran has joined #openstack-keystone | 17:53 | |
| *** diazjf has quit IRC | 17:54 | |
| *** jperry has quit IRC | 17:57 | |
| *** tqtran has quit IRC | 17:58 | |
| *** adrian_otto has quit IRC | 17:58 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 18:00 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Require domain_id when registering Identity Providers https://review.openstack.org/399157 | 18:01 |
| *** asettle has quit IRC | 18:06 | |
| *** ravelar has joined #openstack-keystone | 18:09 | |
| *** adrian_otto has joined #openstack-keystone | 18:12 | |
| *** ravelar has quit IRC | 18:13 | |
| *** ravelar has joined #openstack-keystone | 18:14 | |
| stevemar | lbragstad: about to propose a patch that touches a lot of configuring.rst | 18:27 |
| stevemar | don't bike shed lol | 18:27 |
| lbragstad | stevemar sounds good | 18:28 |
| *** Zer0Byte__ has quit IRC | 18:28 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Don't invalidate all user tokens of roleless group https://review.openstack.org/399728 | 18:32 |
| *** GB21 has quit IRC | 18:35 | |
| lbragstad | mfisch are you around? | 18:40 |
| mfisch | yes | 18:41 |
| lbragstad | mfisch have you had a chance to dig into https://review.openstack.org/#/c/383333/9 ? | 18:41 |
| lbragstad | I might have a diff for you if you haven't | 18:41 |
| mfisch | no, breton is | 18:41 |
| mfisch | but I did some perf measurements | 18:42 |
| lbragstad | ah | 18:42 |
| lbragstad | mfisch what were the results? | 18:42 |
| mfisch | its a small improvement and possibly in the range of error/std deviation | 18:42 |
| mfisch | 2-6% | 18:42 |
| lbragstad | cool | 18:42 |
| mfisch | and I've had no issues with it | 18:42 |
| mfisch | so it might be a test problem | 18:42 |
| mfisch | but I'm not going to enable it until I see this pass ;) | 18:42 |
| mfisch | gonna push newton to staging after the thanksgiving break | 18:42 |
| mfisch | lbragstad: I will be in Texas actually | 18:43 |
| lbragstad | mfisch cool - newton went fine I heard? | 18:43 |
| mfisch | yeah actually no blip even | 18:43 |
| mfisch | not so many breaking db changes | 18:43 |
| lbragstad | well - that's good ! | 18:44 |
| *** chris_hultin is now known as chris_hultin|AWA | 18:45 | |
| lbragstad | mfisch it seems that http://cdn.pasteraw.com/3471azuhs7wj5o4gy1hk9lze0jh82gu on your patch fixes the failing tests... | 18:45 |
| lbragstad | cc breton ^ | 18:45 |
| lbragstad | still running tests locally though | 18:45 |
| mfisch | what does if self._needs_persistence: do | 18:46 |
| lbragstad | mfisch it check if the configured token provider requires a persistent backend for the tokens | 18:46 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update configuration.rst documentation https://review.openstack.org/399730 | 18:46 |
| lbragstad | mfisch for example - https://github.com/openstack/keystone/blob/b6871c16a6e61c8a3d95f3383a56531e748b725e/keystone/token/providers/uuid.py#L37 | 18:47 |
| stevemar | lbragstad: https://review.openstack.org/#/c/399730/ | 18:47 |
| lbragstad | mfisch or https://github.com/openstack/keystone/blob/b6871c16a6e61c8a3d95f3383a56531e748b725e/keystone/token/providers/fernet/core.py#L49 | 18:47 |
| *** chris_hultin|AWA is now known as chris_hultin | 18:47 | |
| stevemar | mfisch: oh i assumed it was a test problem | 18:48 |
| *** arunkant has joined #openstack-keystone | 18:51 | |
| mfisch | lbragstad: so thats why I dont see it then | 18:51 |
| mfisch | this affects uuid | 18:51 |
| *** dikonoor has quit IRC | 18:51 | |
| lbragstad | mfisch yeah - it looks like it fails a lot of uuid tests. | 18:52 |
| mfisch | so its a legit bug | 18:52 |
| lbragstad | it looks like the uuid format of a newly issued token is missing some sort of information | 18:52 |
| lbragstad | because it fails on a KeyError | 18:53 |
| mfisch | this is a great way to force people to stop using UUID! | 18:53 |
| lbragstad | which is kind of mind blowing | 18:53 |
| lbragstad | "we broke this, on purpose, you're welcome"\ | 18:53 |
| mfisch | #ToldYouSo | 18:53 |
| * mfisch for PTL | 18:53 | |
| lbragstad | lol | 18:53 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update configuration.rst documentation https://review.openstack.org/399730 | 18:54 |
| *** chris_hultin is now known as chris_hultin|AWA | 18:57 | |
| *** lamt has quit IRC | 18:58 | |
| lbragstad | breaking to get lunch | 19:02 |
| *** asettle has joined #openstack-keystone | 19:08 | |
| mfisch | lbragstad: let me know what else you find out, I'm done for the week in a few hours | 19:08 |
| nicolasbock | Hi! Is it possible to change the keystone {admin,public,internal} urls _after_ I have run bootstrap already? | 19:08 |
| nicolasbock | Say I want to switch from http to https | 19:08 |
| mfisch | you can delete and recreate them pretty easily | 19:09 |
| nicolasbock | mfisch, do I need to do that directly in the database? | 19:09 |
| mfisch | openstack endpoint delete openstack endpoint cerate | 19:10 |
| mfisch | cerate | 19:10 |
| nicolasbock | so I would do that first, reconfigure keystones wsgi mod and then restart apache? | 19:10 |
| nicolasbock | in that order? | 19:10 |
| mfisch | you dont need to restart apache to change an endpoint | 19:11 |
| mfisch | wait you mean in the catalog? | 19:11 |
| nicolasbock | What's that exactly? | 19:11 |
| mfisch | the keystone catalog | 19:11 |
| mfisch | where all the endpoints are? | 19:11 |
| *** josecastroleon1 has joined #openstack-keystone | 19:12 | |
| mfisch | bottom line is I'm not exactly sure what you are asking but you can change endpoints after bootstrap yes | 19:12 |
| nicolasbock | I don't know. Let's say I install keystone and run keystone-manage bootstrap --bootstrap-admin-url http://.... | 19:12 |
| nicolasbock | Everything is running, then I decide to switch keystone to use https | 19:12 |
| josecastroleon1 | ayoung: hi | 19:13 |
| mfisch | openstack endpoint delete .... openstack endpoint create | 19:13 |
| mfisch | play with it locally | 19:13 |
| mfisch | https would also require more config or ssl offload | 19:13 |
| stevemar | breton: we'll release osc 3.4.1 on monday morning | 19:13 |
| nicolasbock | mfisch, ok, I will | 19:13 |
| nicolasbock | mfisch, thanks! | 19:13 |
| mfisch | stevemar: can you get rid of that horrible warning | 19:13 |
| mfisch | its so annoying | 19:13 |
| mfisch | and not useful for end users | 19:13 |
| stevemar | mfisch: what warning? | 19:13 |
| *** ravelar has quit IRC | 19:14 | |
| *** josecastroleon1 is now known as josecastroleon_ | 19:14 | |
| mfisch | WARNING: openstackclient.common.utils is deprecated and will be removed after Jun 2017. Please use osc_lib.utils. This warning is caused by an out-of-date import in /usr/local/lib/python2.7/site-packages/designateclient/osc/plugin.py | 19:14 |
| mfisch | everytime I run a ^&%^& command | 19:14 |
| mfisch | oh hmm | 19:14 |
| mfisch | maybe thats my fault | 19:14 |
| stevemar | mfisch: "/usr/local/lib/python2.7/site-packages/designateclient/osc/plugin.py" | 19:14 |
| mfisch | yeah dang it | 19:14 |
| stevemar | update your designateclient homie | 19:14 |
| mfisch | our designate is like from 1996 | 19:14 |
| stevemar | i bet it's seen space jam | 19:15 |
| mfisch | I think I installed a special version at one point I will go clean up | 19:15 |
| *** josecastroleon_ has left #openstack-keystone | 19:15 | |
| stevemar | looks like the fix is in the latest: https://github.com/openstack/python-designateclient/commit/e5a76f63f46bca2b81a02cfd07d96c93c624b73d | 19:16 |
| lbragstad | mfisch I'll keep poking at it | 19:17 |
| mfisch | thx | 19:17 |
| * mfisch heads to lunch | 19:17 | |
| stevemar | same | 19:17 |
| stevemar | lbragstad: take a look at my doc patch :D | 19:17 |
| stevemar | i think you'll like it | 19:17 |
| lbragstad | stevemar you changed 500 lines in configuration.rst | 19:18 |
| stevemar | lbragstad: yeah... most of it is moving things or removing things | 19:18 |
| *** chris_hultin|AWA is now known as chris_hultin | 19:19 | |
| stevemar | lbragstad: if i undo the moves, it'll be <200 | 19:19 |
| stevemar | want that? | 19:19 |
| lbragstad | stevemar naw - i'll get through it | 19:20 |
| stevemar | lbragstad: i'll add comments in the review | 19:20 |
| *** Zer0Byte__ has joined #openstack-keystone | 19:20 | |
| lbragstad | stevemar cool - that will help | 19:20 |
| morgan_ | stevemar: omg reviews! | 19:28 |
| *** edtubill has joined #openstack-keystone | 19:29 | |
| stevemar | lbragstad: added notes | 19:29 |
| *** tqtran has joined #openstack-keystone | 19:29 | |
| lbragstad | stevemar sweet | 19:30 |
| lbragstad | stevemar thoughts on this? https://bugs.launchpad.net/keystone/+bug/1642988 | 19:30 |
| openstack | Launchpad bug 1642988 in OpenStack Identity (keystone) "Avoid encoding of project id in fernet tokens" [Undecided,In progress] - Assigned to Jose Castro Leon (jose-castro-leon) | 19:30 |
| lbragstad | specifically the 4th comment | 19:30 |
| stevemar | lbragstad: if their patch works for them, they can carry it | 19:33 |
| stevemar | id rather not have a weird option for a project id format we don't support | 19:33 |
| lbragstad | stevemar random question - does OS_AUTH_TYPE need to be set in order to do federated authentication? | 19:39 |
| stevemar | lbragstad: it's been so long i coulnd't answer you confidently, | 19:39 |
| stevemar | lbragstad: put it definitely would help, it'll look for that plugin specifically | 19:39 |
| stevemar | instead of trying to guess | 19:39 |
| ayoung | josecastroleon, did my suggestion make sense? | 19:39 |
| lbragstad | josecastroleon you could essentially get that behavior by making your own token formatting and all you'd have to change is this - http://cdn.pasteraw.com/htn79m729bk6wuikvgkwaj96phsozsi | 19:42 |
| lbragstad | s/formatting/formatter/ | 19:42 |
| lbragstad | not all formats would need to change - the only one that would need to change would be the base formatter since that is what is supplying the conversion methods for all the other formatters to use | 19:43 |
| lbragstad | then you don't need a configuration option either | 19:44 |
| lbragstad | if you always know that your IDs will be using the dashed representation | 19:44 |
| *** chris_hultin is now known as chris_hultin|AWA | 19:47 | |
| *** chris_hultin|AWA is now known as chris_hultin | 19:49 | |
| *** amoralej is now known as amoralej|off | 19:51 | |
| *** diazjf has joined #openstack-keystone | 19:52 | |
| *** edtubill has quit IRC | 20:01 | |
| breton | stevemar: yey! But also lets discuss ksc on Tuesday | 20:03 |
| stevemar | breton: yep | 20:05 |
| lbragstad | breton o/ | 20:06 |
| lbragstad | do you know if or what you have to set OS_AUTH_TYPE to when using federation? | 20:06 |
| lbragstad | (SAML specifically)? | 20:06 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Token Verify Role Check https://review.openstack.org/391624 | 20:09 |
| ayoung | lbragstad, I'm going for a new record. Longest Spec. | 20:09 |
| lbragstad | ayoung thats probably going to be a tough one to beat | 20:09 |
| ayoung | lbragstad, keep up the good questions. I'm working on an implementation in parallel, and it is raising lots of questions. | 20:10 |
| ayoung | Here is the big one right now: I kindof want to make it one role per URL-Pattern | 20:10 |
| lbragstad | ayoung but what about the action being taken on the url? | 20:11 |
| ayoung | link, if you need to have 2 roles for the same operation , use implied roles to link them somehow | 20:11 |
| lbragstad | i would think that needs to be taken into consideration | 20:11 |
| ayoung | lbragstad, the URL pattern entity is : id, Service, Verb, pattern | 20:11 |
| ayoung | I have a second table right now which is role_to_url_pattern that I think I want to remove | 20:11 |
| ayoung | and instead make url pattern: | 20:12 |
| ayoung | id, Service, Verb, pattern,role_id | 20:12 |
| ayoung | perhaps url_pattern is not a good name, either | 20:12 |
| ayoung | but I don't have a better one, so I used it so I could make progress | 20:12 |
| ayoung | lbragstad, if you wanted, say, 5 different roles that all implied one operation, you could either have one role that the other 4 imply, or create an operation specific role and have all 5 imply that one. | 20:15 |
| ayoung | I think it makes it easier for deployers if there is only ever one role specified per operation | 20:15 |
| lbragstad | i'm going to ask you for an example... | 20:16 |
| lbragstad | like - make it more dumber so i can understand it :) | 20:16 |
| ayoung | lbragstad, just phrasing it that way makes me think that I am right to go for the simpler solution...OK, let me see if I can come up with one | 20:17 |
| lbragstad | why would a single operation need five roles? | 20:17 |
| ayoung | lbragstad, that is an extreme example, but let me see if I can come up with something more realistic | 20:17 |
| lbragstad | ayoung are you saying that in order to boot an instance a user needs to have the 'observer' role, the 'creator' role, etc... ? | 20:17 |
| ayoung | lbragstad, not "and" | 20:18 |
| ayoung | in order to boot an instance they can have either 'booter' or 'rebooter' or 'creator' or 'admin' or 'member' | 20:18 |
| ayoung | lbragstad, so, lets say that it starts off with the following set up: | 20:19 |
| ayoung | we have a system where admin implies member | 20:19 |
| ayoung | shorthand is admin->member | 20:19 |
| ayoung | so we say that the operation POST /compute/boot requires the member role | 20:20 |
| ayoung | now someone comes up with a new role, say a process that is just supposed to create VMs automatically, but nothing else | 20:20 |
| ayoung | call this the booter role | 20:20 |
| ayoung | we could do two things: | 20:20 |
| ayoung | 1. say that member->booter and then POST /compute/boot requires the booter role | 20:21 |
| ayoung | or, create a role called compute_boot, say member->compute_boot booter->compute_boot and POST /compute/boot requires compute_boot | 20:21 |
| ayoung | that example would be clearer if instead of 'booter' I made it 'helper' | 20:22 |
| ayoung | lets say we create a helper role that can do that and, say, one other thing, like upload a snapshot | 20:22 |
| ayoung | either member->helper, helper->compute_boot, helper->image_upload or we do member->compute_boot, member->image_upload, helper->compute_boot, helper->image_upload | 20:24 |
| ayoung | but in all cases, the operation itself only requires a single role | 20:24 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move docs from key_terms to architecture https://review.openstack.org/399760 | 20:24 |
| ayoung | the alternative is that we make an operation directly allow multiple roles, but that makes it harder to do specified delegation | 20:25 |
| ayoung | lbragstad, I realize this is a little esoteric, but getting it right is important to making the API usable | 20:25 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move docs from key_terms to architecture https://review.openstack.org/399760 | 20:26 |
| lbragstad | ayoung hmmm | 20:27 |
| lbragstad | ayoung but an operation can require a member role | 20:30 |
| lbragstad | which requires like 3 other things | 20:30 |
| ayoung | lbragstad, so the starting point, pre customization, will be that all operations require only the member rol | 20:30 |
| ayoung | role | 20:30 |
| *** raildo has quit IRC | 20:35 | |
| lbragstad | alright - actually breaking for lunch this time... for real... | 20:35 |
| *** asettle has quit IRC | 20:45 | |
| *** edtubill has joined #openstack-keystone | 20:46 | |
| stevemar | crinkle: yay +1 from you | 20:47 |
| stevemar | lbragstad: :) | 20:47 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove extension doc https://review.openstack.org/399767 | 20:48 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove extension doc https://review.openstack.org/399767 | 20:48 |
| *** chlong has quit IRC | 20:53 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove extension and auth_token middleware docs https://review.openstack.org/399767 | 20:54 |
| *** clenimar has quit IRC | 20:56 | |
| crinkle | stevemar: yay docs | 20:58 |
| stevemar | crinkle: trying to figure out how to get rid of services.html | 20:58 |
| stevemar | crinkle: http://docs.openstack.org/developer/keystone/services.html it overlaps with https://review.openstack.org/399760 | 20:58 |
| crinkle | stevemar: does it need to go away? are all the other services okay with v3 now? | 21:04 |
| stevemar | i think mostly, but it's nice to have history there | 21:08 |
| stevemar | crinkle: i guess just the 'glossary' bugs me :) | 21:08 |
| *** dave-mcc_ has quit IRC | 21:18 | |
| stevemar | crinkle: any doc suggestions we want to pass along? :) | 21:24 |
| *** adrian_otto has quit IRC | 21:24 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move docs from key_terms to architecture https://review.openstack.org/399760 | 21:27 |
| *** anush has joined #openstack-keystone | 21:28 | |
| *** catintheroof has joined #openstack-keystone | 21:31 | |
| *** edtubill has quit IRC | 21:31 | |
| crinkle | ¯\_(ツ)_/¯ | 21:37 |
| *** edmondsw has quit IRC | 21:43 | |
| *** diazjf has quit IRC | 21:44 | |
| ayoung | I'm want to rip out the json_home tests. They are horrible | 21:55 |
| *** dave-mcc_ has joined #openstack-keystone | 21:56 | |
| *** dave-mcc_ has quit IRC | 21:59 | |
| *** asettle has joined #openstack-keystone | 22:03 | |
| *** diazjf has joined #openstack-keystone | 22:08 | |
| breton | lbragstad: v3samlpassword | 22:13 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: clean up developer docs https://review.openstack.org/399781 | 22:13 |
| stevemar | lbragstad: crinkle if you want another https://review.openstack.org/#/c/399781/1 | 22:13 |
| stevemar | ayoung: they are not the worst | 22:14 |
| ayoung | no but they are useless | 22:15 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update configuration.rst documentation https://review.openstack.org/399730 | 22:19 |
| *** chris_hultin is now known as chris_hultin|AWA | 22:26 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: move content from configuringservices to configuration https://review.openstack.org/399787 | 22:29 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update configuration.rst documentation https://review.openstack.org/399730 | 22:30 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: move content from configuringservices to configuration https://review.openstack.org/399787 | 22:30 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move docs from key_terms to architecture https://review.openstack.org/399760 | 22:30 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove extension and auth_token middleware docs https://review.openstack.org/399767 | 22:32 |
| *** spzala has quit IRC | 22:32 | |
| *** adrian_otto has joined #openstack-keystone | 22:33 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: clean up developer docs https://review.openstack.org/399781 | 22:35 |
| stevemar | okay i am done for today | 22:35 |
| stevemar | i am finally happy with our docs | 22:35 |
| stevemar | look at the last patch https://review.openstack.org/#/c/399781/ if you want to see what it looks like | 22:35 |
| lbragstad | stevemar cool thanks - still reviewing | 22:36 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Lockout ignore user list https://review.openstack.org/398571 | 22:37 |
| *** rakhmerov has quit IRC | 23:04 | |
| *** anush has quit IRC | 23:07 | |
| *** rakhmerov has joined #openstack-keystone | 23:08 | |
| *** anush has joined #openstack-keystone | 23:09 | |
| *** anush has quit IRC | 23:12 | |
| *** diazjf has quit IRC | 23:19 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!