| stevemar | morgan_: i was, but i'm online now | 00:12 |
|---|---|---|
| stevemar | morgan_: in a metal tube! | 00:12 |
| morgan_ | sec. need to plug in lkaptop | 00:13 |
| *** jperry has quit IRC | 00:15 | |
| *** browne has joined #openstack-keystone | 00:17 | |
| openstackgerrit | Merged openstack/keystoneauth: Add reauthenticate to generic plugins https://review.openstack.org/400550 | 00:19 |
| *** diazjf has joined #openstack-keystone | 00:48 | |
| *** browne has quit IRC | 00:51 | |
| *** anush has quit IRC | 00:52 | |
| *** guoshan has joined #openstack-keystone | 00:52 | |
| *** guoshan has quit IRC | 00:57 | |
| *** diazjf has quit IRC | 00:58 | |
| *** agrebennikov has quit IRC | 01:00 | |
| stevemar | rodrigods: lbragstad breton last of the doc patches: https://review.openstack.org/#/c/399781/ | 01:12 |
| *** chrisplo has quit IRC | 01:17 | |
| *** guoshan has joined #openstack-keystone | 01:28 | |
| *** chrisplo has joined #openstack-keystone | 01:30 | |
| *** Alagar has joined #openstack-keystone | 01:31 | |
| *** dave-mccowan has joined #openstack-keystone | 01:34 | |
| *** chrisplo has quit IRC | 01:35 | |
| *** anush has joined #openstack-keystone | 01:41 | |
| *** ravelar has quit IRC | 01:45 | |
| *** ravelar has joined #openstack-keystone | 01:46 | |
| *** diazjf has joined #openstack-keystone | 02:01 | |
| *** zhangjl has joined #openstack-keystone | 02:08 | |
| *** anush has quit IRC | 02:09 | |
| *** dave-mcc_ has joined #openstack-keystone | 02:11 | |
| *** dave-mccowan has quit IRC | 02:12 | |
| *** anush has joined #openstack-keystone | 02:13 | |
| *** dave-mccowan has joined #openstack-keystone | 02:13 | |
| *** chrisplo has joined #openstack-keystone | 02:14 | |
| *** dave-mcc_ has quit IRC | 02:16 | |
| *** dave-mccowan has quit IRC | 02:18 | |
| *** tqtran has quit IRC | 02:21 | |
| *** jamielennox is now known as jamielennox|away | 02:30 | |
| *** dave-mccowan has joined #openstack-keystone | 02:39 | |
| *** anush has quit IRC | 02:39 | |
| *** ravelar has quit IRC | 02:43 | |
| *** asettle has joined #openstack-keystone | 02:45 | |
| *** dave-mccowan has quit IRC | 02:48 | |
| *** asettle has quit IRC | 02:50 | |
| *** Alagar has quit IRC | 02:52 | |
| *** Alagar has joined #openstack-keystone | 02:53 | |
| *** Alagar has quit IRC | 02:55 | |
| *** Alagar has joined #openstack-keystone | 02:58 | |
| *** jamielennox|away is now known as jamielennox | 02:59 | |
| *** adriant has quit IRC | 03:03 | |
| *** ravelar has joined #openstack-keystone | 03:11 | |
| *** ravelar has quit IRC | 03:11 | |
| *** anush has joined #openstack-keystone | 03:24 | |
| *** catintheroof has joined #openstack-keystone | 03:27 | |
| *** udesale has joined #openstack-keystone | 03:34 | |
| *** adriant has joined #openstack-keystone | 03:37 | |
| *** catintheroof has quit IRC | 03:40 | |
| *** links has joined #openstack-keystone | 03:42 | |
| openstackgerrit | Merged openstack/keystone: Improvements in error messages https://review.openstack.org/400715 | 03:59 |
| *** markvoelker has quit IRC | 04:02 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: clean up developer docs https://review.openstack.org/399781 | 04:07 |
| *** guoshan has quit IRC | 04:07 | |
| stevemar | thanks davechen :) | 04:09 |
| stevemar | jamielennox: please comment on the bug you and lbragstad were chatting about | 04:10 |
| *** GB21 has joined #openstack-keystone | 04:17 | |
| *** anush has quit IRC | 04:18 | |
| *** GB21 has quit IRC | 04:22 | |
| *** guoshan has joined #openstack-keystone | 04:23 | |
| *** Alagar has quit IRC | 04:24 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone: adding combined password and totp auth plugin https://review.openstack.org/343422 | 04:33 |
| *** guoshan has quit IRC | 04:34 | |
| *** GB21 has joined #openstack-keystone | 04:34 | |
| *** Alagar has joined #openstack-keystone | 04:44 | |
| *** arunkant__ has joined #openstack-keystone | 04:44 | |
| *** arunkant_ has quit IRC | 04:48 | |
| *** diazjf has quit IRC | 04:48 | |
| *** diazjf has joined #openstack-keystone | 04:48 | |
| *** diazjf has quit IRC | 04:50 | |
| openstackgerrit | Merged openstack/ldappool: Expose SERVER_DOWN if connection fails https://review.openstack.org/395013 | 04:53 |
| openstackgerrit | Merged openstack/ldappool: update README to reflect actual ldap dependency https://review.openstack.org/396908 | 04:53 |
| *** josecastroleon has joined #openstack-keystone | 04:56 | |
| *** guoshan has joined #openstack-keystone | 05:02 | |
| *** guoshan has quit IRC | 05:12 | |
| *** Alagar has quit IRC | 05:16 | |
| *** Alagar has joined #openstack-keystone | 05:20 | |
| *** Alagar has quit IRC | 05:52 | |
| *** adriant has quit IRC | 06:02 | |
| *** markvoelker has joined #openstack-keystone | 06:02 | |
| *** adu has joined #openstack-keystone | 06:06 | |
| *** guoshan has joined #openstack-keystone | 06:06 | |
| *** markvoelker has quit IRC | 06:08 | |
| *** Alagar has joined #openstack-keystone | 06:12 | |
| *** richm has quit IRC | 06:42 | |
| *** qwertyco has joined #openstack-keystone | 07:08 | |
| *** adu has quit IRC | 07:11 | |
| *** tesseract has joined #openstack-keystone | 07:12 | |
| *** Alagar has quit IRC | 07:12 | |
| *** Alagar has joined #openstack-keystone | 07:12 | |
| *** tesseract is now known as Guest59528 | 07:13 | |
| *** GB21 has quit IRC | 07:21 | |
| *** arunkant_ has joined #openstack-keystone | 07:39 | |
| *** arunkant__ has quit IRC | 07:43 | |
| *** GB21 has joined #openstack-keystone | 07:53 | |
| *** josecastroleon has quit IRC | 07:57 | |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 08:07 |
| *** jaosorior has joined #openstack-keystone | 08:29 | |
| *** jpich has joined #openstack-keystone | 08:30 | |
| *** amoralej|off is now known as amoralej | 08:43 | |
| *** josecastroleon has joined #openstack-keystone | 08:46 | |
| *** Alagar has quit IRC | 08:48 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:02 | |
| *** asettle has joined #openstack-keystone | 09:05 | |
| *** StefanPaetowJisc has joined #openstack-keystone | 09:06 | |
| *** udesale has quit IRC | 09:09 | |
| *** udesale has joined #openstack-keystone | 09:10 | |
| *** StefanPaetowJisc has quit IRC | 09:16 | |
| *** StefanPaetowJisc has joined #openstack-keystone | 09:16 | |
| *** markvoelker has joined #openstack-keystone | 09:32 | |
| *** markvoelker has quit IRC | 09:37 | |
| *** StefanPaetowJisc has quit IRC | 10:01 | |
| *** zhangjl has quit IRC | 10:11 | |
| *** jamielennox is now known as jamielennox|away | 10:21 | |
| *** guoshan has quit IRC | 10:22 | |
| *** qwertyco has quit IRC | 10:40 | |
| *** udesale has quit IRC | 10:50 | |
| *** rakhmerov has quit IRC | 11:01 | |
| *** rakhmerov has joined #openstack-keystone | 11:05 | |
| *** richm has joined #openstack-keystone | 11:13 | |
| *** GB21 has quit IRC | 11:14 | |
| *** guoshan has joined #openstack-keystone | 11:22 | |
| *** guoshan has quit IRC | 11:27 | |
| *** GB21 has joined #openstack-keystone | 11:30 | |
| openstackgerrit | Johannes Grassler proposed openstack/keystone-specs: Added spec on standalone trusts https://review.openstack.org/396634 | 11:38 |
| *** josecastroleon has quit IRC | 11:40 | |
| *** mvk has quit IRC | 11:49 | |
| *** nicolasbock has joined #openstack-keystone | 11:54 | |
| *** openstackgerrit has quit IRC | 12:03 | |
| *** openstackgerrit has joined #openstack-keystone | 12:03 | |
| *** raildo has joined #openstack-keystone | 12:05 | |
| *** GB21 has quit IRC | 12:05 | |
| *** catintheroof has joined #openstack-keystone | 12:09 | |
| *** GB21 has joined #openstack-keystone | 12:12 | |
| *** catintheroof has quit IRC | 12:15 | |
| *** GB21 has quit IRC | 12:17 | |
| *** mvk has joined #openstack-keystone | 12:19 | |
| *** catintheroof has joined #openstack-keystone | 12:20 | |
| *** guoshan has joined #openstack-keystone | 12:23 | |
| *** josecastroleon has joined #openstack-keystone | 12:24 | |
| *** guoshan has quit IRC | 12:28 | |
| *** spligak has quit IRC | 12:35 | |
| *** spligak has joined #openstack-keystone | 12:36 | |
| *** GB21 has joined #openstack-keystone | 12:43 | |
| *** catintheroof has quit IRC | 12:44 | |
| *** arunkant__ has joined #openstack-keystone | 12:49 | |
| *** arunkant_ has quit IRC | 12:52 | |
| *** links has quit IRC | 12:54 | |
| *** arunkant_ has joined #openstack-keystone | 13:01 | |
| *** arunkant__ has quit IRC | 13:05 | |
| *** GB21 has quit IRC | 13:06 | |
| *** arunkant__ has joined #openstack-keystone | 13:07 | |
| *** anush has joined #openstack-keystone | 13:09 | |
| *** arunkant_ has quit IRC | 13:11 | |
| *** rmstar has quit IRC | 13:16 | |
| *** Guest59528 has quit IRC | 13:19 | |
| *** amoralej is now known as amoralej|lunch | 13:20 | |
| *** anush has quit IRC | 13:26 | |
| *** markvoelker has joined #openstack-keystone | 13:28 | |
| *** lamt has joined #openstack-keystone | 13:39 | |
| *** arunkant_ has joined #openstack-keystone | 13:41 | |
| *** arunkant__ has quit IRC | 13:45 | |
| *** udesale has joined #openstack-keystone | 13:58 | |
| *** udesale has quit IRC | 13:58 | |
| *** udesale has joined #openstack-keystone | 13:59 | |
| *** udesale has quit IRC | 13:59 | |
| *** udesale has joined #openstack-keystone | 14:00 | |
| *** anush has joined #openstack-keystone | 14:02 | |
| *** pcaruana has quit IRC | 14:14 | |
| *** code-R has joined #openstack-keystone | 14:20 | |
| *** amoralej|lunch is now known as amoralej | 14:22 | |
| *** arunkant__ has joined #openstack-keystone | 14:25 | |
| *** arunkant_ has quit IRC | 14:28 | |
| *** tesseract has joined #openstack-keystone | 14:32 | |
| *** tesseract is now known as Guest48653 | 14:33 | |
| stevemar | o/ | 14:33 |
| * stevemar wonders if anyone is online today :) | 14:33 | |
| *** Guest48653 has quit IRC | 14:39 | |
| raildo | stevemar, I believe just the brazilian guys :P | 14:39 |
| *** tesseract- has joined #openstack-keystone | 14:39 | |
| EmilienM | stevemar: hey! | 14:39 |
| stevemar | EmilienM: hey yourself :) | 14:40 |
| EmilienM | stevemar: I was curious why Keystone itself doesn't want to deal with Fernet keys rotations (using Swift for example) | 14:40 |
| EmilienM | to me, it's bad UX for operators that run Keystone in multiple nodes, since they have to deal with fernet keys rotations themselves | 14:40 |
| dstanek | EmilienM: there are much better tools to manage rotation of secrets/certs/etc | 14:42 |
| stevemar | EmilienM: yeah, there are a lot of options you can use, rsync, redis whatever you want | 14:44 |
| stevemar | we didnt want to make anything a hard dependency | 14:44 |
| EmilienM | mhh ok. I was just curious why we don't have this thing in keystone as a tool | 14:44 |
| EmilienM | maybe using swift or something | 14:44 |
| dstanek | EmilienM: it's also best not to push our deployment biases on users | 14:46 |
| *** tesseract- has quit IRC | 14:49 | |
| *** jaosorior has quit IRC | 14:53 | |
| *** jaosorior has joined #openstack-keystone | 14:54 | |
| breton | o/ | 15:07 |
| stevemar | o\ | 15:08 |
| lbragstad | stevemar jamielennox|away was there a spec or bug for keystoneauth to use the identity entry in the service catalog instead of the one in configuration? | 15:09 |
| *** josecastroleon has quit IRC | 15:09 | |
| *** jaosorior has quit IRC | 15:09 | |
| *** jaosorior has joined #openstack-keystone | 15:10 | |
| *** josecastroleon has joined #openstack-keystone | 15:11 | |
| lbragstad | stevemar jamielennox|away i'm not seeing one, but I assume the reason behind using the identity entry in the service catalog was for discovery purposes? | 15:12 |
| *** ravelar has joined #openstack-keystone | 15:14 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:15 | |
| stevemar | lbragstad: no bug that i know of | 15:16 |
| zzzeek | heya, getting this keystone test failure related to passlib : http://paste.openstack.org/show/590221/ | 15:16 |
| lbragstad | stevemar it's simply a side effect of automatic discovery | 15:16 |
| zzzeek | is that happening anywhere else? this is in my sqlalchemy-specific suite | 15:16 |
| stevemar | sounds uunlikely we would make that backwards incompatible | 15:16 |
| stevemar | lbragstad: ^ | 15:17 |
| stevemar | zzzeek: considering passlib 170 released on 2016-11-23 ... | 15:18 |
| dstanek | zzzeek: looks like release a new vesion of passlib today | 15:18 |
| zzzeek | dstanek / stevemar yep | 15:18 |
| stevemar | we'll probably have a broken gate soon :) | 15:18 |
| zzzeek | stevemar: well, you heard it here first ! :) | 15:19 |
| dstanek | zzzeek: i'm taking a look. it should be something easy for us to merge | 15:20 |
| zzzeek | dstanek: ya | 15:20 |
| lbragstad | zzzeek dstanek working on a patch now, running tests locally | 15:20 |
| stevemar | zzzeek: file a bug>? | 15:20 |
| zzzeek | ok | 15:20 |
| *** agrebennikov has joined #openstack-keystone | 15:21 | |
| dstanek | lbragstad: nice | 15:21 |
| zzzeek | https://bugs.launchpad.net/keystone/+bug/1644263 | 15:21 |
| openstack | Launchpad bug 1644263 in OpenStack Identity (keystone) "passlib 1.7.0 deprecates sha512_crypt.encrypt() " [Undecided,New] | 15:21 |
| knikolla | ayoung: found an old paper notebook of yours in the drawer here | 15:23 |
| ayoung | knikolla, the one with all the dirty pictures in it? | 15:24 |
| ayoung | actually, don't answer that | 15:24 |
| knikolla | ayoung: if by dirty pictures you mean federation diagrams, yes | 15:25 |
| ayoung | knikolla, what does the cover look like? And, are there only a few pages filled in at the front? It might have been something I grabgbed specifically for a meeting | 15:25 |
| ayoung | not sure if it is something I'd like to have back or not | 15:25 |
| *** chlong has joined #openstack-keystone | 15:25 | |
| knikolla | ayoung: it's completely filled out. sending you a picture by email. | 15:27 |
| ayoung | knikolla, thanks | 15:27 |
| knikolla | ayoung: sent. | 15:29 |
| *** pnavarro has joined #openstack-keystone | 15:30 | |
| *** pnavarro has quit IRC | 15:30 | |
| dstanek | knikolla: federation diagrams? that's disgusting ayoung, you have a dirty mind | 15:31 |
| ayoung | dstanek, that is the light stuff. It was the "dynamic policy" stuff that got me banned in Boston | 15:31 |
| *** udesale has quit IRC | 15:32 | |
| lbragstad | dstanek lol | 15:33 |
| dstanek | ayoung: :-) | 15:34 |
| *** chlong has quit IRC | 15:34 | |
| dstanek | i heard that dynamic policy is illegal in 28 states | 15:35 |
| lbragstad | dstanek *only* 28? I hear colorado's makling a killing off taxing it | 15:35 |
| *** anush has quit IRC | 15:37 | |
| openstackgerrit | Merged openstack/keystone: clean up developer docs https://review.openstack.org/399781 | 15:40 |
| *** josecastroleon has quit IRC | 15:41 | |
| *** josecastroleon has joined #openstack-keystone | 15:42 | |
| ayoung | knikolla, Oh, I definitely want that one | 15:43 |
| ayoung | that notebook actually means something to me | 15:43 |
| ayoung | not the book itself, but the binder it is in. Grab it and I will get it from you after Thanksgiving | 15:43 |
| *** nkinder has quit IRC | 15:45 | |
| knikolla | ayoung: ok, sure. | 15:46 |
| *** spilla has joined #openstack-keystone | 15:49 | |
| *** chlong has joined #openstack-keystone | 15:49 | |
| lbragstad | reminder that the policy meeting will be starting in 5 minutes | 15:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use sha512.hash() instead of .encrypt() https://review.openstack.org/401328 | 15:56 |
| gagehugo | lbragstad what channel is the meeting in? Here again? | 15:57 |
| lbragstad | gagehugo nope it will be in #openstack-meeting-cp | 15:58 |
| gagehugo | ah ok ty | 15:58 |
| lbragstad | gagehugo official ical is here http://eavesdrop.openstack.org/#Keystone_Policy_Meeting | 15:58 |
| gagehugo | ok cool | 15:59 |
| lbragstad | ayoung policy meeting in #openstack-meeting-cp if you're interested | 16:04 |
| ayoung | lbragstad, ah, thanks. Was thinking it was here | 16:04 |
| *** code-R has quit IRC | 16:07 | |
| *** arunkant_ has joined #openstack-keystone | 16:08 | |
| *** thinrichs has joined #openstack-keystone | 16:09 | |
| *** cnf has left #openstack-keystone | 16:10 | |
| *** thinrichs has quit IRC | 16:11 | |
| *** arunkant__ has quit IRC | 16:12 | |
| openstackgerrit | Andrew Bogott proposed openstack/keystone: Send the identity.deleted.role_assignment after the deletion https://review.openstack.org/401332 | 16:12 |
| *** josecastroleon has quit IRC | 16:15 | |
| *** arunkant__ has joined #openstack-keystone | 16:15 | |
| *** josecastroleon has joined #openstack-keystone | 16:17 | |
| *** arunkant_ has quit IRC | 16:19 | |
| *** daemontool has joined #openstack-keystone | 16:32 | |
| *** josecastroleon has quit IRC | 16:51 | |
| *** josecastroleon has joined #openstack-keystone | 16:53 | |
| *** diazjf has joined #openstack-keystone | 16:57 | |
| *** ruan_06 has joined #openstack-keystone | 17:00 | |
| ayoung | ktychkova, you understand my concern? | 17:00 |
| lbragstad | policy meeting overflow! | 17:00 |
| ayoung | not on caching, but on scoping? | 17:00 |
| *** thinrichs_ has joined #openstack-keystone | 17:00 | |
| *** thinrichs1 has joined #openstack-keystone | 17:01 | |
| ayoung | ktychkova, let me ask it this way: | 17:01 |
| *** thinrichs_ has quit IRC | 17:01 | |
| ktychkova | ayoung: no projects in AF | 17:01 |
| ktychkova | the picture is like this: https://2.bp.blogspot.com/-OXBN4KtR4fw/V7l5i0RXPZI/AAAAAAAAHKc/gHjIvTEhTPE5Z3N7vv3oBDHWzv71MTm7ACLcB/s1600/fig4.png | 17:01 |
| ayoung | How do you define a role, or assign a role, in Fortress | 17:01 |
| thinrichs1 | ayoung: the blog is pretty good at showing that. | 17:01 |
| ktychkova | you have Object, Operation and a Role | 17:01 |
| thinrichs1 | A place to define user-role assignments and role-permission assignments (and role-hierarchicies if I remember right) | 17:02 |
| ruan_06 | ktychkova: do you mean that one role in AF works for all projects? | 17:02 |
| ktychkova | User have a Role do perform Operation with Object | 17:02 |
| ayoung | ok, so what Fortress calls a role in Keystone is really a role assignment: | 17:02 |
| ayoung | or a part of the role assignment: | 17:02 |
| ayoung | role is a reusable label | 17:02 |
| ayoung | but the role as Fortress defines it (and NIST RBAC) is the tuple (role, project) | 17:03 |
| ayoung | ktychkova, Do you see the disconnect? | 17:03 |
| ktychkova | Yes, I see | 17:04 |
| ruan_06 | can we make one AF per project? | 17:06 |
| ktychkova | ruan_06 - you don't need it | 17:06 |
| ayoung | ruan_06, no | 17:06 |
| thinrichs1 | It's not clear to me that Keystone's notion of roles matters here b/c all the roles/users/rights would be handled by AF. | 17:06 |
| ayoung | thinrichs1, heh | 17:06 |
| ayoung | you might be right, but it would be a disconnect with much of the API | 17:07 |
| thinrichs1 | Keystone would validate tokens (authenticate), and AF would handle access control (authorization). Or am I missing something? | 17:07 |
| ktychkova | thinrichs1: it is my point | 17:07 |
| ayoung | enumeration and operations are typically done based on the project | 17:07 |
| ayoung | It would be a parallel authentication scheme, and, I think, not very scalable | 17:08 |
| ayoung | it would provide no insulation for multi-tenancy | 17:08 |
| ruan_06 | ktychkova: yes, this is also what ayoung called baseline + external PDP | 17:08 |
| ktychkova | so, operators can have project1_admin role and project2_admin role | 17:08 |
| ayoung | ah, but then there is no scope check | 17:08 |
| thinrichs1 | parallel authentication? or authorization | 17:08 |
| ayoung | that is the problem: the scope of the resource is in the database, and needs to be passed to oslo policy explicitly | 17:09 |
| ayoung | and those rules, as hard coded as they seem, really should not be externalized from policy | 17:09 |
| ayoung | so I think we would have to leave those rules in place. | 17:09 |
| ruan_06 | ayoung: agree, the key issue is that scope and role information are not in the good place now | 17:09 |
| ayoung | oslo could pass something like: resource.project_name to apache fortress, but then fortress would need to know how to map that to the global role | 17:10 |
| thinrichs1 | So you're saying that when user 'alice' asks for 'delete' rights on server 'foo', some database knows that 'foo' belongs to project 'p' and therefore the decision needs to be based on 'alice', 'delete', 'foo', and 'p'. Correct? | 17:10 |
| ruan_06 | we can define some roles like project1_admin, project2_admin, etc | 17:10 |
| lbragstad | thinrichs1 yeah - something like that... alice shouldn't be able to delete servers in project 'bar' even though she has the role to do so | 17:11 |
| ayoung | thinrichs1, right on | 17:12 |
| lbragstad | thinrichs1 so policy in this cases consists of a role check (does this user have the required role to perform the action) and a scope check (does the user have the required role on the project that owners the resource they want to act on) | 17:12 |
| ayoung | thinrichs1, and that database varies from service to service | 17:12 |
| ayoung | one of the reason for my proposal was based on earlier feedback from a dynamic policy proposal that ran afoul of lots of these issues | 17:13 |
| thinrichs1 | Definitely not straight up RBAC then. Best I could see is ayoung's suggestion of forwarding that project that the resource belongs to to the external PDP. | 17:13 |
| ayoung | samueldmq did a proof of concept, even. Demoed it to the Keystone midcycle in Boston 1.5 years ago | 17:13 |
| ayoung | the biggest issue was that the collection of policy files was damned near impossible | 17:14 |
| samueldmq | ayoung: o/ | 17:14 |
| ayoung | samueldmq, you have a public git repo with the dynamic policy code? | 17:14 |
| thinrichs1 | ruan_06: In AF the roles are hidden from the outside, so I don't see how adding the project1_admin, project2_admin roles would help | 17:14 |
| lbragstad | ktychkova so just to summarize - AF doesn't do anything with the scope check, it essentially just does a role check, right? | 17:14 |
| samueldmq | ayoung: I don't think I have that anymore | 17:14 |
| ayoung | samueldmq, sad face | 17:14 |
| samueldmq | ayoung: I had a few patches up with the code | 17:14 |
| samueldmq | ayoung: but I've abandoned them a long time ago | 17:15 |
| samueldmq | :-( | 17:15 |
| thinrichs1 | lbragstad: talk of role-check and scope-check makes more sense to me now. | 17:15 |
| ayoung | samueldmq, so I did figure out how to deal with the "which policy do we fetch" question. But it is academic for now | 17:15 |
| *** jaosorior has quit IRC | 17:15 | |
| lbragstad | thinrichs1 good deal... it takes a while to step back and really look at everything | 17:15 |
| ktychkova | lbragstad: ih such terms: yes, no project scope | 17:15 |
| lbragstad | ktychkova but you worked around it somehow? | 17:15 |
| samueldmq | ayoung: cool. how is it ? | 17:16 |
| ayoung | samueldmq, instead of fetching by endpoint ID, we create a string and fetch by that string | 17:18 |
| ktychkova | lbragstad: by having roles like project1_admin | 17:18 |
| ayoung | the strings can be pre-positioned in the config files | 17:18 |
| ayoung | for most, it will be the service name | 17:18 |
| ayoung | but it can really be anything | 17:18 |
| ayoung | so compute by default, but trusted-compute for those with extra security | 17:18 |
| ayoung | kind of like git tags | 17:19 |
| ktychkova | could I ask all of you to write comment for my patch - so I can answer? | 17:19 |
| samueldmq | ayoung: so basically we forget about the current endpoint classification | 17:19 |
| lbragstad | ktychkova ah - got it... so you have to have to duplicate roles for each project, so that each project has their own admin role, etc... | 17:19 |
| samueldmq | ayoung: and create a new one for fetching policies | 17:19 |
| ayoung | right | 17:19 |
| ayoung | samueldmq, https://review.openstack.org/#/c/298788/ | 17:19 |
| lbragstad | ktychkova the oslo.policy patch? or the etherpad? | 17:20 |
| ktychkova | oslo.policy patch would be best place, I think | 17:20 |
| ktychkova | https://review.openstack.org/#/c/237521/ | 17:21 |
| ruan_06 | I agree in principle, but can we make it more general instead of only AF? | 17:21 |
| lbragstad | ktychkova cool | 17:22 |
| ruan_06 | in order to support other external PDP | 17:22 |
| ktychkova | + to support other external PDP, it would be great | 17:22 |
| thinrichs1 | +1 to that | 17:22 |
| *** josecastroleon has quit IRC | 17:23 | |
| thinrichs1 | Got to run. Thanks all! | 17:23 |
| ruan_06 | I think for the firsth step, some information may be dupliated in both Keystone and external PDP, we can deside later where is best place to store them | 17:23 |
| *** josecastroleon has joined #openstack-keystone | 17:24 | |
| samueldmq | ayoung: allow operators to upload policy files to keystone via keystone manage | 17:26 |
| samueldmq | ayoung: use middleware to distribute those files | 17:26 |
| samueldmq | ayoung: upon upgrade, they decide how to merge the current policy in keystone with the new policy file coming with the new version of the service | 17:27 |
| ayoung | samueldmq, yeah...but we can come back to that. I still think that splitting RBAC into two layers is the right approach | 17:27 |
| ayoung | do the RBAC check in middleware, the policy can be done later | 17:27 |
| samueldmq | ayoung: for now, only allow policies fetch per service. I think that's how people use it anyways, one per service | 17:27 |
| ayoung | and it becomes a lot less compelling | 17:27 |
| ayoung | samueldmq, that is why a TAG | 17:27 |
| ayoung | THE DEFAULT tag is the service name | 17:27 |
| samueldmq | ayoung: I see doing the check of roles in the middleware going orthogonal to distributing the policies | 17:28 |
| *** hogepodge has joined #openstack-keystone | 17:28 | |
| ayoung | samueldmq, ++ | 17:28 |
| samueldmq | ayoung: we don't need to really split the file to split the checks | 17:28 |
| samueldmq | ayoung: the role check can be done by looking at the roles in the rules and ignoring the rest of it | 17:29 |
| ruan_06 | lbragstad: conclusion for external PDP support? | 17:29 |
| lbragstad | ruan_06 what do you mean? | 17:33 |
| *** hogepodge has quit IRC | 17:33 | |
| ruan_06 | lbragstad: if most of us agree, we enable the external PDP approch throught https://review.openstack.org/#/c/237521/ | 17:34 |
| lbragstad | ruan_06 yeah - I don't see a problem with that if we have a seemless way to work that into oslo.policy. I don't think we should *require* an external PDP or PEP by default, but I think it is a good enhancement to consider for sure | 17:35 |
| ruan_06 | lbragstad: yes, as an option | 17:36 |
| *** hogepodge has joined #openstack-keystone | 17:43 | |
| *** daemontool has quit IRC | 17:46 | |
| *** thinrichs1 has quit IRC | 17:46 | |
| *** chlong has quit IRC | 17:50 | |
| *** spligak has quit IRC | 17:53 | |
| *** josecastroleon has quit IRC | 17:54 | |
| lbragstad | yo - is anyone here planning on going to the horizon+keystone meeting tomorrow? | 17:54 |
| *** josecastroleon has joined #openstack-keystone | 17:55 | |
| *** dave-mccowan has joined #openstack-keystone | 17:56 | |
| *** dave-mccowan has quit IRC | 17:57 | |
| *** thinrichs has joined #openstack-keystone | 17:58 | |
| rderose | lbragstad: is that a trick question :) | 17:58 |
| lbragstad | O.o maybe?! | 17:59 |
| rderose | lbragstad: no, I'm not planning on attending :) | 17:59 |
| *** amoralej is now known as amoralej|off | 18:02 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use sha512.hash() instead of .encrypt() https://review.openstack.org/401328 | 18:03 |
| samueldmq | lbragstad: so .encrypt is deprecated in 1.6 and the alternative is only available in 1.7 ? | 18:09 |
| samueldmq | lbragstad: sounds odd | 18:09 |
| lbragstad | samueldmq yeah - kinda | 18:09 |
| lbragstad | they suggest you to move to 1.7 but it seems like .encrypt was removed in 1.7 | 18:10 |
| lbragstad | and 1.6.5 doesn't have .using() | 18:10 |
| lbragstad | which is apparently the recommended way to use rounds | 18:10 |
| * lbragstad shrug | 18:10 | |
| lbragstad | i could be doing something wrong | 18:10 |
| samueldmq | lbragstad: maybe. I am ffine with that, just found it odd | 18:13 |
| *** martinus__ has quit IRC | 18:13 | |
| samueldmq | lbragstad: I left a comment there. we should add a test to make sure both approaches give the same result | 18:14 |
| samueldmq | lbragstad: otherwise existing encrypted passwords will become "uncheckable" | 18:14 |
| *** martinus__ has joined #openstack-keystone | 18:16 | |
| samueldmq | lbragstad: hmm, however we can't really check if the function is removed in 1.7. there should be a version with both deprecation and alternative approach | 18:17 |
| samueldmq | lbragstad the message in the bug report says: "crypt.encrypt() is deprecated as of Passlib 1.7, and will be removed in Passlib 2.0, use .hash() instead." | 18:19 |
| samueldmq | however we have 1.6 in requirements ... doesn't make sense to me | 18:19 |
| samueldmq | ah passlib>=1.6 .. nevermid | 18:20 |
| lbragstad | samueldmq we have a bunch of hash password tests here - https://github.com/openstack/keystone/blob/master/keystone/tests/unit/common/test_utils.py#L74 | 18:21 |
| samueldmq | lbragstad: yes, but they'd still pass if we hashed it in a backward incompatible way | 18:21 |
| lbragstad | samueldmq is there a way we can install two version of passlib for the same test? | 18:22 |
| samueldmq | lbragstad: no. but according to the bug report it's deprecated in 1.7 and removed only in 2.0 | 18:22 |
| *** thinrichs has left #openstack-keystone | 18:22 | |
| samueldmq | lbragstad: pinning it in 1.7 for sometime would allow us to verify the equivalency | 18:23 |
| samueldmq | if that makes sense for you | 18:23 |
| *** diazjf has quit IRC | 18:24 | |
| lbragstad | samueldmq yeah - that makes sense | 18:25 |
| *** josecastroleon has quit IRC | 18:25 | |
| lbragstad | i don't think the problem is .encrypt being removed in 1.7 | 18:25 |
| lbragstad | it's a problem of 1.6.5 not having .using() | 18:25 |
| lbragstad | let me try something else quick | 18:25 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use sha512.hash() instead of .encrypt() https://review.openstack.org/401328 | 18:26 |
| samueldmq | lbragstad: yes. I agree with you on that | 18:26 |
| *** josecastroleon has joined #openstack-keystone | 18:26 | |
| lbragstad | ah - stevemar already got it | 18:27 |
| lbragstad | nevermind | 18:27 |
| stevemar | lbragstad: :) | 18:27 |
| lbragstad | i got mixed up reading the 1.7 documentation | 18:27 |
| stevemar | samueldmq: lbragstad: i was thinking we could do a check for versions | 18:27 |
| lbragstad | i was looking at http://pythonhosted.org/passlib/lib/passlib.hash.sha256_crypt.html | 18:27 |
| stevemar | if < 1.7 then encrypt(), else hash | 18:28 |
| lbragstad | which specifies `.using()` when passing rounds | 18:28 |
| samueldmq | stevemar: yeah, but I believe we should have a test anyways | 18:28 |
| *** tqtran has joined #openstack-keystone | 18:28 | |
| samueldmq | stevemar: to make sure the new approach is backwards compatible | 18:28 |
| samueldmq | stevemar: you don't want to upgrade passlib and suddenly not being able to validate passwords anymore :-) | 18:29 |
| stevemar | a test to make sure encrypt() and hash() return the same value? | 18:29 |
| samueldmq | stevemar: yeah ^ | 18:29 |
| samueldmq | makes sense ? | 18:29 |
| stevemar | meh, at that point we're testing passlib :P | 18:30 |
| stevemar | and if they actually remove encrypt in 1.8.0 then we'll have another break | 18:30 |
| samueldmq | or at least the way we're using it | 18:30 |
| stevemar | i mean, you can add the test, more tests are never a bad thing | 18:30 |
| stevemar | but i'm not getting hung up on it | 18:30 |
| samueldmq | I'd like to at least validate somehow that we are making the right update on how we use passlib | 18:31 |
| samueldmq | maybe a test. maybe pointing to the docs that say use Y instread of X now and you will have the same result | 18:31 |
| lbragstad | http://cdn.pasteraw.com/kvyyau3b10uovf5cj3oop6pqrefh4qa | 18:32 |
| samueldmq | instead | 18:32 |
| samueldmq | lbragstad: that's a completely different result | 18:32 |
| samueldmq | we'd be breaking all local users with that :p | 18:33 |
| lbragstad | hmnm | 18:33 |
| lbragstad | so .encrypt() is deprecated... | 18:33 |
| lbragstad | and we have to move to .hash() | 18:33 |
| lbragstad | but .hash() isn't backwards compatible | 18:33 |
| samueldmq | stevemar: see lbragstad's paste ^ | 18:33 |
| *** richm has quit IRC | 18:33 | |
| samueldmq | lbragstad: we need to figure out what's the alternative which is backwards compatbile | 18:34 |
| stevemar | samueldmq: run it again :) | 18:34 |
| zzzeek | if encrypt() / hash() don't produce the same results shouldnt a bug report be made in passlib? | 18:34 |
| lbragstad | stevemar http://pythonhosted.org/passlib/narr/hash-tutorial.html#password-hash-examples | 18:34 |
| zzzeek | because it breaks all password hashes made w/ the old system | 18:34 |
| lbragstad | zzzeek yeah - i would think so | 18:35 |
| samueldmq | zzzeek: ++ agreed, that's exactly the point | 18:35 |
| * zzzeek avoids lots of these flashy "For Humans" libraries for reasons like these | 18:35 | |
| *** markvoelker has quit IRC | 18:35 | |
| stevemar | samueldmq: you'll get a different result every time you hash ;) | 18:36 |
| zzzeek | I say, take the source code of 1.6 and vendor it into oslo.passwordhash :) | 18:36 |
| samueldmq | stevemar: even better! | 18:36 |
| stevemar | samueldmq: http://paste.openstack.org/show/590245/ | 18:36 |
| zzzeek | also what happened to good old bcrypt for password hashing | 18:37 |
| samueldmq | stevemar: so how does that work ? oO | 18:37 |
| lbragstad | so a proper test would be hashing with the new way and making sure we can verify with the old way | 18:37 |
| samueldmq | stevemar: if it was always like that, we shouldn't be able to validate any password | 18:37 |
| *** caiobrentano_ has joined #openstack-keystone | 18:38 | |
| samueldmq | lbragstad: yes | 18:38 |
| samueldmq | lbragstad: no | 18:38 |
| samueldmq | lbragstad: passwords hashed in the old way can be verified in the new ay | 18:38 |
| samueldmq | :-) | 18:38 |
| lbragstad | samueldmq sure | 18:38 |
| stevemar | lbragstad: samueldmq that would be a better test, yes | 18:39 |
| caiobrentano_ | hi all... someone could give me some help troubleshooting healthcheck middleware in keystone? | 18:40 |
| rodrigods | the hash is not supposed to be equal, it has to be random somehow - otherwise we would be weak to dictionary attacks | 18:40 |
| stevemar | caiobrentano_: just ask away :) | 18:41 |
| stevemar | caiobrentano_: i think jlk uses it? | 18:41 |
| caiobrentano_ | It is properly configured following the docs... but I'm getting 404 when I hit keystone:5000/healthcheck | 18:41 |
| lbragstad | so - just because the hashes don't match doesn't mean they aren't validatable http://cdn.pasteraw.com/o0kcw673hwss6bnru92sv1s2eyll9pb | 18:41 |
| lbragstad | samueldmq stevemar ^ | 18:42 |
| rodrigods | caiobrentano_, devstack? maybe /identity/heathcheck | 18:42 |
| caiobrentano_ | rodrigods it is not devstack... it is my keystone server | 18:42 |
| lbragstad | alright - i gotta run quick. | 18:42 |
| stevemar | lbragstad: alright | 18:42 |
| stevemar | samueldmq: lbragstad thats a nice test | 18:43 |
| samueldmq | lbragstad: ok. I don't care of the magic behind it. let's just make sure it works for our usecase :_) | 18:43 |
| stevemar | samueldmq: http://cdn.pasteraw.com/o0kcw673hwss6bnru92sv1s2eyll9pb | 18:43 |
| caiobrentano_ | what I could debug is that oslo middleware is getting req.path = 'admin/healthcheck'... but it is expecting '/healthcheck' | 18:43 |
| samueldmq | stevemar: ++ | 18:43 |
| *** cnf has joined #openstack-keystone | 18:49 | |
| *** dave-mccowan has joined #openstack-keystone | 18:49 | |
| *** josecastroleon has quit IRC | 18:56 | |
| *** josecastroleon has joined #openstack-keystone | 18:57 | |
| *** dave-mcc_ has joined #openstack-keystone | 18:59 | |
| *** dave-mccowan has quit IRC | 19:02 | |
| *** stingaci has joined #openstack-keystone | 19:07 | |
| stingaci | Hello all. I have a question surrounding trusts and SAML auth. Anyone around familiar with these? | 19:11 |
| stingaci | specifically pertaining to this bug report https://bugs.launchpad.net/fuel/+bug/1626046 | 19:13 |
| openstack | Launchpad bug 1626046 in Fuel for OpenStack "federated users cannot use Murano or Sahara" [High,Confirmed] - Assigned to Oleksii Chuprykov (ochuprykov) | 19:13 |
| *** arunkant_ has joined #openstack-keystone | 19:13 | |
| *** arunkant__ has quit IRC | 19:17 | |
| *** asettle has quit IRC | 19:19 | |
| r1chardj0n3s | lbragstad: I was planning on holding the horizon+keystone meeting tomorrow - should I not? | 19:25 |
| *** catintheroof has joined #openstack-keystone | 19:27 | |
| r1chardj0n3s | stevemar: cancel the horizon+keystone meeting tomorrow yay/nay? I'm ok with cancelling since so many USians won't be around. | 19:28 |
| *** josecastroleon has quit IRC | 19:28 | |
| *** josecastroleon has joined #openstack-keystone | 19:30 | |
| zzzeek | also what happened to good old bcrypt for password hashing | 19:32 |
| zzzeek | oops | 19:32 |
| ayoung | stingaci, fix for that is happening | 19:33 |
| ayoung | bascially, the shadow user work is required in order for a federated user to have a guaranteed UserID to use for creating a trust | 19:33 |
| *** catintheroof has quit IRC | 19:34 | |
| stingaci | @ayoung Yeah, that makes sense. If shadow users are enabled, can this particular bug be circumvented? | 19:40 |
| lbragstad | r1chardj0n3s not sure if i'll be able to make the meeting tomorrow - our thanksgiving is scheduled for that time | 19:40 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use sha512.hash() instead of .encrypt() https://review.openstack.org/401328 | 19:42 |
| *** dave-mcc_ has quit IRC | 19:49 | |
| *** phalmos has joined #openstack-keystone | 19:52 | |
| *** spligak has joined #openstack-keystone | 19:53 | |
| *** josecastroleon has quit IRC | 20:02 | |
| *** phalmos has quit IRC | 20:02 | |
| *** josecastroleon has joined #openstack-keystone | 20:03 | |
| *** diazjf has joined #openstack-keystone | 20:03 | |
| *** jpich has quit IRC | 20:03 | |
| *** mvk has quit IRC | 20:15 | |
| *** jperry has joined #openstack-keystone | 20:19 | |
| stevemar | r1chardj0n3s: sure, i'm OK with that. I *may* be around | 20:20 |
| *** caiobrentano_ has quit IRC | 20:28 | |
| *** josecastroleon has quit IRC | 20:33 | |
| *** nicolasbock has quit IRC | 20:33 | |
| *** josecastroleon has joined #openstack-keystone | 20:34 | |
| *** diazjf has quit IRC | 20:37 | |
| *** diazjf has joined #openstack-keystone | 20:40 | |
| *** anush has joined #openstack-keystone | 20:42 | |
| *** flaper87 has quit IRC | 20:52 | |
| *** mvk has joined #openstack-keystone | 20:53 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP: Install shibboleth-idp with Devstack plugin https://review.openstack.org/401421 | 21:02 |
| *** josecastroleon has quit IRC | 21:04 | |
| *** anush has quit IRC | 21:05 | |
| *** josecastroleon has joined #openstack-keystone | 21:05 | |
| lbragstad | mfisch o/ | 21:06 |
| *** diazjf has quit IRC | 21:07 | |
| -openstackstatus- NOTICE: Due to a problem with the cinder volume backing the log server, jobs are failing with POST_FAILURE. Please avoid issuing 'recheck' commands until the issue is resolved. | 21:08 | |
| *** ChanServ changes topic to "Due to a problem with the cinder volume backing the log server, jobs are failing with POST_FAILURE. Please avoid issuing 'recheck' commands until the issue is resolved." | 21:08 | |
| *** catintheroof has joined #openstack-keystone | 21:08 | |
| lbragstad | mfisch have you considered how https://review.openstack.org/#/c/382098/12 is going to affect your fernet key rotation? | 21:09 |
| lbragstad | if at all? | 21:09 |
| *** anush has joined #openstack-keystone | 21:11 | |
| *** phalmos has joined #openstack-keystone | 21:19 | |
| *** jamielennox|away is now known as jamielennox | 21:22 | |
| *** diazjf has joined #openstack-keystone | 21:29 | |
| *** josecastroleon has quit IRC | 21:35 | |
| *** stingaci has quit IRC | 21:36 | |
| *** spilla has quit IRC | 21:37 | |
| *** stingaci has joined #openstack-keystone | 21:39 | |
| *** jperry has quit IRC | 21:40 | |
| *** catintheroof has quit IRC | 21:40 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use sha512.hash() instead of .encrypt() https://review.openstack.org/401328 | 21:46 |
| *** anush has quit IRC | 21:59 | |
| *** adriant has joined #openstack-keystone | 22:17 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: Add reason to notifications for PCI-DSS https://review.openstack.org/396752 | 22:18 |
| *** chlong has joined #openstack-keystone | 22:19 | |
| *** chlong has quit IRC | 22:30 | |
| *** chris_hultin is now known as chris_hultin|AWA | 22:37 | |
| *** agrebennikov has quit IRC | 22:40 | |
| *** diazjf has quit IRC | 22:46 | |
| *** catintheroof has joined #openstack-keystone | 22:48 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to CADF notifications in docs https://review.openstack.org/400882 | 22:48 |
| *** catintheroof has quit IRC | 22:52 | |
| *** ChanServ changes topic to "Meeting Agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Ocata goals: https://docs.google.com/spreadsheets/d/156q820cXcEc8Y9YWQgoc_hyOm3AZ2jtMQM3zdDhwGFU/edit?usp=sharing" | 22:52 | |
| -openstackstatus- NOTICE: The affected filesystems on the log server are repaired. Please leave 'recheck' comments on any changes which failed with POST_FAILURE. | 22:52 | |
| lbragstad | alrighty - i'm out... see everyone Monday! | 22:55 |
| *** arunkant__ has joined #openstack-keystone | 22:57 | |
| *** catintheroof has joined #openstack-keystone | 23:00 | |
| *** arunkant_ has quit IRC | 23:01 | |
| *** ravelar has quit IRC | 23:15 | |
| *** anush has joined #openstack-keystone | 23:20 | |
| *** catinthe_ has joined #openstack-keystone | 23:23 | |
| *** catintheroof has quit IRC | 23:26 | |
| stevemar | o\ lbragstad | 23:31 |
| *** anush has quit IRC | 23:37 | |
| *** lamt has quit IRC | 23:43 | |
| openstackgerrit | ayoung proposed openstack/keystone: URL pattern based RBAC Management Interface https://review.openstack.org/401808 | 23:51 |
| ayoung | lbragstad, ok, there is the management API for the new RBAC stuff | 23:51 |
| *** catinthe_ has quit IRC | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
