| *** asettle has joined #openstack-keystone | 00:02 | |
| *** chris_hultin is now known as chris_hultin|AWA | 00:05 | |
| *** asettle has quit IRC | 00:07 | |
| *** lamt has quit IRC | 00:14 | |
| *** ravelar has quit IRC | 00:20 | |
| *** catintheroof has quit IRC | 00:23 | |
| *** catintheroof has joined #openstack-keystone | 00:24 | |
| *** catintheroof has quit IRC | 00:28 | |
| *** nkinder has quit IRC | 00:29 | |
| *** diazjf has joined #openstack-keystone | 00:39 | |
| morgan | ayoung: yeah it hasn't changed much | 00:43 |
|---|---|---|
| morgan | just some minor rename stuff | 00:43 |
| *** chrisplo has quit IRC | 00:44 | |
| *** tovin07 has joined #openstack-keystone | 00:52 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 00:58 |
| *** asettle has joined #openstack-keystone | 01:03 | |
| *** dave-mccowan has joined #openstack-keystone | 01:04 | |
| *** jamielennox is now known as jamielennox|away | 01:07 | |
| *** asettle has quit IRC | 01:07 | |
| *** Trident has joined #openstack-keystone | 01:09 | |
| *** lamt has joined #openstack-keystone | 01:11 | |
| *** zhangjl has joined #openstack-keystone | 01:14 | |
| *** liujiong has joined #openstack-keystone | 01:21 | |
| *** jamielennox|away is now known as jamielennox | 01:21 | |
| *** guoshan has joined #openstack-keystone | 01:24 | |
| morgan | rderose: i am a fan of that change (in principle) ^ | 01:24 |
| *** zhangjl has quit IRC | 01:24 | |
| rderose | morgan: cool | 01:24 |
| rderose | morgan: it will be backwards compatible as well | 01:25 |
| morgan | hmm. | 01:25 |
| morgan | yes | 01:25 |
| morgan | absolutely looks like it | 01:25 |
| morgan | good stuff :) | 01:25 |
| * morgan needs to lazyweb ask a question... | 01:25 | |
| rderose | if you don't explicitly provide the domain_id, then the IdP will be mapped to the default 'Federated' domain | 01:26 |
| rderose | morgan ^ | 01:26 |
| morgan | rderose: nice. that is a good design | 01:31 |
| morgan | since it mirrors "today" | 01:31 |
| rderose | morgan: exactly | 01:32 |
| *** david-lyle has joined #openstack-keystone | 01:33 | |
| *** hanchao has joined #openstack-keystone | 01:34 | |
| hanchao | hello keystone experts, don't know if this is an security issue that I found in openstack. The thing that I found was once an user is nominated as an admin of a project, this user will have full admin access of everything, even out of his/her project. The more horrible thing is that he/she can even remove the real admin of the whole cloud. Are there anything wrong of my use case? Or anyone who can explain me the reason b | 01:35 |
| hanchao | A similar question has also been posted in security team. | 01:36 |
| dstanek | hanchao: sadly that's the default policy | 01:36 |
| dstanek | the cloud sample is much better for a large cloud | 01:37 |
| hanchao | However, from my understanding, an project admin should only have the full access for its own project but not over to the others. | 01:39 |
| hanchao | Otherwise, it's too dangerous... | 01:39 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 01:42 |
| dstanek | hanchao: that's all controlled in the policy files and at least in keystone there is only one level of admin by default | 01:44 |
| morgan | hanchao: that is V2, right? | 01:45 |
| morgan | dstanek: ++ | 01:45 |
| morgan | hanchao: or are you using keystone v3? | 01:45 |
| morgan | because it is not really customizable in V2 | 01:45 |
| morgan | in V3, policy is customizable | 01:45 |
| hanchao | Actually I have both versions, namely two environments. But what I have tried is based on v2. | 01:46 |
| dstanek | morgan: yeah, that's super unfortunate | 01:46 |
| dstanek | hanchao: for v3 you want to checkout http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json | 01:46 |
| dstanek | it's more robust, but you should still read through and see if it fits your needs | 01:46 |
| morgan | dstanek: thankfully... V2 is dying. | 01:47 |
| morgan | dstanek: we can really consider removing it in Q release! | 01:47 |
| dstanek | hanchao: but as morgan said if you are using v3 then you are stuck in what i've been calling "small cloud mode" | 01:47 |
| morgan | hanchao: V2* | 01:47 |
| morgan | erm dstanek V2* | 01:47 |
| morgan | or do you mean defaults in V3? | 01:48 |
| morgan | dstanek: unrelated, snow yet? | 01:48 |
| dstanek | ooops...yes meant to say v2 | 01:48 |
| dstanek | morgan: nope, hasn't really been below 32 degrees all that much | 01:49 |
| hanchao | Well, so v3 is customizable where in the policy file I can define the access for different roles in different projects? | 01:50 |
| morgan | hanchao: polciy by default (i think) is /etc/keystone/policy.json | 01:51 |
| morgan | but that can be configured in keystone.conf | 01:51 |
| morgan | the link dstanek gave you is a good starting place for a "real" policy file | 01:51 |
| hanchao | Thanks for your kindly replies, I'll firstly check the file you provided. And will post questions later if I'm still confused. :p | 01:51 |
| morgan | :) | 01:51 |
| morgan | you will need to create the extra roles | 01:51 |
| morgan | they are not created by default | 01:51 |
| morgan | (for reverse compat reasons) | 01:51 |
| dstanek | hanchao: sounds good | 01:52 |
| morgan | dstanek: do you think once v2 goes away, and with ayoung's RBAC thing we can get away from the bad default policy? | 01:52 |
| morgan | dstanek: i'm trying to think of how to do that | 01:53 |
| hanchao | sure, if a self-defined role can be created, I suppose this would be nice. | 01:53 |
| morgan | hanchao: so at the moment roles are global (should only be defined / created by the cloud admin) | 01:53 |
| hanchao | Oh, it means no project oriented role can be defined? | 01:54 |
| hanchao | What we are expecting the use case is that there has an admin user who have the full control of the entire cloud; then project admin users who have the full access of dedicated projects which the cloud admin user defined for that; and project members who have limited access for the projects where project admin authorized. | 01:58 |
| morgan | hanchao: so use v3. | 01:58 |
| dstanek | morgan: if v2 goes away we should be able to do that | 01:58 |
| morgan | hanchao: and I actually recommend disabling V2 completly if you have the option to | 01:59 |
| morgan | hanchao: (read: probably an Ocata release before you can do this) | 01:59 |
| morgan | hanchao: and you can use the is_admin flag options to restrict cloud-admin actions. | 01:59 |
| morgan | dstanek: ++ that is my hope | 01:59 |
| morgan | dstanek: i would be very very happy to make the crappy policy defaults go away | 02:00 |
| hanchao | We are currently testing on Mitaka release... A bit behind of the upstream... | 02:00 |
| morgan | hanchao: ok so, disabling V2 might be hard with Nova and Neutron (and possibly glance?) | 02:00 |
| morgan | if you move to NEwton... i think it's all fixed/working, but in Ocata we actually are doing a full suite of tests guarenteeing v2 is disabled for them. | 02:01 |
| morgan | hanchao: likely your service users will still need to be V2 based for some services. (keystonemiddleware configuration in say nova/neutron/etc) | 02:01 |
| morgan | but your end users can all be V3-only. | 02:01 |
| morgan | which should allow you to have the rich(er) policy | 02:02 |
| *** asettle has joined #openstack-keystone | 02:04 | |
| morgan | stevemar, topol: PHRASING! | 02:04 |
| hanchao | all right, I think I should check the policy firstly, and post questions later here. :p thanks for your help. @morgan & dstanek. | 02:04 |
| morgan | hanchao: happy to help! | 02:05 |
| dstanek | hanchao: no problem | 02:06 |
| stevemar | jamielennox: no excuses for missing meetings, you're de-cored now | 02:08 |
| morgan | stevemar: shush. | 02:08 |
| morgan | ;) | 02:08 |
| hanchao | :D | 02:08 |
| *** asettle has quit IRC | 02:08 | |
| morgan | stevemar: do you ski? or snowboard? | 02:08 |
| morgan | stevemar: i ask cause you live in that cold-place... | 02:09 |
| stevemar | morgan: skied when i was a kid, haven't done it in 20 years. snowboarded once and bruised/cracked a rib | 02:09 |
| stevemar | have avoided ever since (8 years ago) | 02:09 |
| dstanek | snowboard ftw! | 02:11 |
| ayoung | OK...so here is what I think will happen with RBAC and policy... | 02:11 |
| ayoung | 1. We start by ignoring the existing policy files...Treat them like code. Maybe move them into the Keystone server defaults the way Nova did | 02:12 |
| ayoung | 2. Make mnost APIs "Member" as the default role | 02:12 |
| ayoung | this is safe because it means any thing that is admin only is enforced by the policy files. Member is just the most general rule. | 02:12 |
| ayoung | 3. We invent a new role for the audit use case. Call it reader. Use implied roles to makes Member imply REader. CHange a bunch of APIs from Member to REader | 02:13 |
| ayoung | hanchao, so, that should support what you want. We also need the fix for bug 968696 to be completed | 02:13 |
| openstack | bug 968696 in OpenStack Identity (keystone) ""admin"-ness not properly scoped" [High,In progress] https://launchpad.net/bugs/968696 - Assigned to Adam Young (ayoung) | 02:13 |
| morgan | dstanek: if you 'board, you should do a trip to Whistler ;) | 02:16 |
| * morgan says this cause having another excuse to hit those slopes will be epic | 02:16 | |
| morgan | dstanek: also.. i need advice on good softgear for this season | 02:17 |
| lbragstad | ayoung for step 1 i assume you are referencing nova's work to get policy coded into oslo-policy, right? | 02:17 |
| morgan | hard gear (board/bindings/boots) is much easier. | 02:17 |
| hanchao | ayoung: exactly, the bug actually reproduces my concerns. | 02:19 |
| *** zhangjl has joined #openstack-keystone | 02:22 | |
| adriant | morgan: Whistler is north of Vancouver right? | 02:23 |
| adriant | Been there once ages ago. Mostly went to Cypress while living in Vancouver since we lived right down the hill from it. | 02:25 |
| hanchao | morgan: why not try this in northern Finland, where you can skiing, downhill and so forth. Besides, you can also have the opportunity to witness fantastic aurora and warm traditional Finnish sauna. ;) | 02:27 |
| hanchao | And glogi with vodka is super tasty and warm drink for the cold winter :D | 02:28 |
| *** guoshan has quit IRC | 02:31 | |
| *** guoshan has joined #openstack-keystone | 02:32 | |
| *** browne has quit IRC | 02:33 | |
| *** Zer0Byte__ has quit IRC | 02:36 | |
| *** hogepodge has quit IRC | 02:38 | |
| ayoung | lbragstad, yes | 02:39 |
| ayoung | sorry for the delays...putting kids to bed is NP-Hard | 02:40 |
| *** code-R has joined #openstack-keystone | 02:41 | |
| lbragstad | ayoung no worries | 02:44 |
| ayoung | lbragstad, so, yeahm, the idea is the default policy really should be focused on the scope check | 02:45 |
| ayoung | we probably want to make some of the APIs that are admin only capable of being run by Member, but default to admin in the RBAC check. But that can happen over time. | 02:45 |
| lbragstad | ayoung that sounds like loosening the policy around specific admin-only calls | 02:48 |
| lbragstad | s/calls/operations/ | 02:48 |
| *** gyee has quit IRC | 02:49 | |
| dstanek | morgan: it's been so long since i've been boarding. | 03:00 |
| dstanek | once i broke my arm...and then my ankle a few years later i toned it down | 03:00 |
| *** zhangjl has quit IRC | 03:02 | |
| *** asettle has joined #openstack-keystone | 03:04 | |
| *** guoshan has quit IRC | 03:06 | |
| *** guoshan has joined #openstack-keystone | 03:07 | |
| *** g2 has quit IRC | 03:07 | |
| *** asettle has quit IRC | 03:09 | |
| *** diazjf has quit IRC | 03:09 | |
| *** phalmos has quit IRC | 03:11 | |
| stevemar | ayoung: looks like someone fixed the bug you issued: https://review.openstack.org/#/c/407331/1 | 03:12 |
| *** phalmos has joined #openstack-keystone | 03:12 | |
| ayoung | stevemar, nice | 03:12 |
| stevemar | just verified it manually | 03:12 |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 03:13 | |
| ayoung | stevemar, can I run that multiple times, or do I need to blow away my DB? | 03:13 |
| stevemar | ayoung: you can run it a few times but you'll see conflict errors all over the place | 03:14 |
| ayoung | stevemar, yeah, since there is not test, I want to do so, too, before OKing | 03:14 |
| stevemar | but you won't see the error you reported | 03:15 |
| *** zhangjl has joined #openstack-keystone | 03:17 | |
| ayoung | stevemar, I wonder if the error I saw was due to poor reporting, and bootstrap not run with all the pre-set options | 03:18 |
| ayoung | seems to be running now | 03:19 |
| ayoung | someone just got voting rights in the next Keystone election. | 03:19 |
| *** browne has joined #openstack-keystone | 03:21 | |
| *** links has joined #openstack-keystone | 03:22 | |
| *** BrAsS_mOnKeY has quit IRC | 03:24 | |
| *** dave-mccowan has quit IRC | 03:25 | |
| *** dave-mccowan has joined #openstack-keystone | 03:27 | |
| stevemar | ayoung: woo hoo | 03:28 |
| *** GB21 has joined #openstack-keystone | 03:29 | |
| *** udesale has joined #openstack-keystone | 03:31 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 03:31 | |
| openstackgerrit | Merged openstack/keystone-specs: Extend user API to support federated attributes https://review.openstack.org/397410 | 03:33 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: WIP - Allow user to change own expired password https://review.openstack.org/404022 | 03:34 |
| *** BrAsS_mOnKeY is now known as g2 | 03:36 | |
| *** GB21 has quit IRC | 03:36 | |
| *** browne has quit IRC | 03:37 | |
| *** spzala has quit IRC | 03:42 | |
| *** spzala has joined #openstack-keystone | 03:42 | |
| *** spzala has quit IRC | 03:47 | |
| *** edmondsw has joined #openstack-keystone | 03:52 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: [WIP] Remove old method of creating a client https://review.openstack.org/359707 | 03:53 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Remove generic client https://review.openstack.org/359706 | 03:53 |
| *** edmondsw has quit IRC | 03:57 | |
| stevemar | jamielennox: i think we have to deprecate that ^ | 03:57 |
| stevemar | or does it not work? | 03:57 |
| jamielennox | stevemar: yea, we should deprecate the generic but noone uses it | 03:58 |
| stevemar | jamielennox: give it 1 cycle deprecation then | 03:58 |
| jamielennox | i was just rebasing the WIP to see what was going to break next | 03:58 |
| *** tqtran has quit IRC | 03:58 | |
| *** spzala has joined #openstack-keystone | 04:00 | |
| *** spzala has quit IRC | 04:00 | |
| jamielennox | ok i will deprecate it | 04:00 |
| *** guoshan has quit IRC | 04:03 | |
| *** asettle has joined #openstack-keystone | 04:05 | |
| *** dave-mccowan has quit IRC | 04:06 | |
| *** asettle has quit IRC | 04:10 | |
| *** links has quit IRC | 04:20 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Deprecate the generic client https://review.openstack.org/407844 | 04:22 |
| stevemar | jamielennox: add a note that we can remove it in Pike too, please. | 04:27 |
| jamielennox | stevemar: just a comment? | 04:28 |
| stevemar | jamielennox: yeah | 04:28 |
| jamielennox | i put queen in the bug. | 04:28 |
| jamielennox | aren't we about to do pike? | 04:28 |
| stevemar | eh fine | 04:29 |
| stevemar | i'm trying to help you here :P | 04:29 |
| jamielennox | i'm fine making it soon | 04:29 |
| jamielennox | but i think i'm mixing up my code names | 04:29 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Deprecate the generic client https://review.openstack.org/407844 | 04:30 |
| *** faizy_ has joined #openstack-keystone | 04:31 | |
| openstackgerrit | Merged openstack/keystone: Corrects sample-data incorrect credential call https://review.openstack.org/407331 | 04:36 |
| *** huhaoran has joined #openstack-keystone | 04:36 | |
| *** code-R has quit IRC | 04:37 | |
| *** huhaoran has quit IRC | 04:41 | |
| stevemar | jamielennox: you want to say 3.9.0.... 3.8.0 is already out | 04:52 |
| stevemar | jamielennox: also, release note | 04:53 |
| *** code-R has joined #openstack-keystone | 04:53 | |
| *** GB21 has joined #openstack-keystone | 04:55 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Deprecate the generic client https://review.openstack.org/407844 | 04:55 |
| jamielennox | stevemar: at least the review cycle is really quick | 04:55 |
| stevemar | :P | 04:55 |
| * stevemar tosses jamielennox an upvote | 04:56 | |
| *** links has joined #openstack-keystone | 04:57 | |
| *** tqtran has joined #openstack-keystone | 04:59 | |
| *** tqtran has quit IRC | 05:00 | |
| *** guoshan has joined #openstack-keystone | 05:04 | |
| *** diazjf has joined #openstack-keystone | 05:04 | |
| stevemar | okay, bed time | 05:04 |
| stevemar | o\ | 05:04 |
| *** asettle has joined #openstack-keystone | 05:06 | |
| *** nicolasbock has quit IRC | 05:07 | |
| *** guoshan has quit IRC | 05:08 | |
| *** asettle has quit IRC | 05:11 | |
| *** GB21 has quit IRC | 05:13 | |
| *** hyakuhei has quit IRC | 05:14 | |
| *** robcresswell has quit IRC | 05:14 | |
| *** pkoraca_ has joined #openstack-keystone | 05:14 | |
| *** lbragstad has quit IRC | 05:14 | |
| *** AndyWojo has quit IRC | 05:14 | |
| *** mgagne has quit IRC | 05:15 | |
| *** mjb has quit IRC | 05:15 | |
| *** samueldmq_ has joined #openstack-keystone | 05:15 | |
| *** ChanServ sets mode: +v samueldmq_ | 05:15 | |
| *** DuncanT_ has joined #openstack-keystone | 05:15 | |
| *** morgan has quit IRC | 05:15 | |
| *** wasmum has quit IRC | 05:15 | |
| *** hrybacki has quit IRC | 05:15 | |
| *** pkoraca has quit IRC | 05:15 | |
| *** DuncanT has quit IRC | 05:15 | |
| *** spligak has quit IRC | 05:16 | |
| *** pkoraca_ is now known as pkoraca | 05:16 | |
| *** DuncanT_ is now known as DuncanT | 05:16 | |
| *** jamielennox has quit IRC | 05:16 | |
| *** samueldmq has quit IRC | 05:16 | |
| *** samueldmq_ is now known as samueldmq | 05:17 | |
| *** robcresswell has joined #openstack-keystone | 05:17 | |
| *** hrybacki has joined #openstack-keystone | 05:18 | |
| *** AndyWojo has joined #openstack-keystone | 05:19 | |
| *** lbragstad has joined #openstack-keystone | 05:20 | |
| *** mjb has joined #openstack-keystone | 05:20 | |
| *** wasmum has joined #openstack-keystone | 05:20 | |
| *** morgan has joined #openstack-keystone | 05:23 | |
| *** jamielennox has joined #openstack-keystone | 05:31 | |
| *** ChanServ sets mode: +v jamielennox | 05:31 | |
| *** hyakuhei has joined #openstack-keystone | 05:31 | |
| *** GB21 has joined #openstack-keystone | 05:33 | |
| openstackgerrit | Merged openstack/keystone: Domain included for role in list_role_assignment https://review.openstack.org/373516 | 05:45 |
| *** edmondsw has joined #openstack-keystone | 05:53 | |
| *** edmondsw has quit IRC | 05:57 | |
| *** diazjf has quit IRC | 06:01 | |
| *** jaosorior has joined #openstack-keystone | 06:02 | |
| *** guoshan has joined #openstack-keystone | 06:04 | |
| *** markvoelker has quit IRC | 06:05 | |
| *** markvoelker has joined #openstack-keystone | 06:05 | |
| *** guoshan has quit IRC | 06:09 | |
| *** markvoelker has quit IRC | 06:10 | |
| *** mrsoul has quit IRC | 06:15 | |
| *** mrsoul has joined #openstack-keystone | 06:16 | |
| *** adriant has quit IRC | 06:22 | |
| *** guoshan has joined #openstack-keystone | 06:24 | |
| *** huhaoran has joined #openstack-keystone | 06:30 | |
| *** cburgess has quit IRC | 06:30 | |
| *** cburgess has joined #openstack-keystone | 06:33 | |
| *** richm has quit IRC | 06:41 | |
| *** voelzmo has joined #openstack-keystone | 06:43 | |
| *** josecastroleon has joined #openstack-keystone | 06:43 | |
| *** voelzmo has quit IRC | 06:45 | |
| *** voelzmo has joined #openstack-keystone | 06:46 | |
| *** huhaoran has quit IRC | 06:46 | |
| *** huhaoran has joined #openstack-keystone | 06:49 | |
| *** voelzmo has quit IRC | 06:50 | |
| *** masber has joined #openstack-keystone | 06:51 | |
| *** markvoelker has joined #openstack-keystone | 07:06 | |
| *** asettle has joined #openstack-keystone | 07:08 | |
| *** markvoelker has quit IRC | 07:10 | |
| *** jamielennox is now known as jamielennox|away | 07:11 | |
| *** asettle has quit IRC | 07:12 | |
| *** sileht has quit IRC | 07:13 | |
| *** spligak has joined #openstack-keystone | 07:16 | |
| *** jaosorior has quit IRC | 07:22 | |
| *** jaosorior has joined #openstack-keystone | 07:23 | |
| *** zhangjl1 has joined #openstack-keystone | 07:27 | |
| *** zhangjl has quit IRC | 07:28 | |
| *** zhangjl1 has quit IRC | 07:31 | |
| *** zhangjl has joined #openstack-keystone | 07:32 | |
| *** rcernin has joined #openstack-keystone | 07:34 | |
| *** voelzmo has joined #openstack-keystone | 07:39 | |
| *** pcaruana has joined #openstack-keystone | 07:41 | |
| *** voelzmo has quit IRC | 07:44 | |
| *** voelzmo has joined #openstack-keystone | 07:44 | |
| *** voelzmo has quit IRC | 07:45 | |
| *** voelzmo has joined #openstack-keystone | 07:46 | |
| *** voelzmo has quit IRC | 07:48 | |
| *** voelzmo has joined #openstack-keystone | 07:49 | |
| *** mvk has quit IRC | 07:51 | |
| *** code-R has quit IRC | 07:51 | |
| *** rybridges2 has quit IRC | 07:54 | |
| *** mfisch has quit IRC | 07:54 | |
| *** voelzmo has quit IRC | 07:55 | |
| *** voelzmo has joined #openstack-keystone | 07:55 | |
| *** voelzmo has quit IRC | 08:01 | |
| *** voelzmo has joined #openstack-keystone | 08:04 | |
| *** markvoelker has joined #openstack-keystone | 08:07 | |
| *** rybridges2 has joined #openstack-keystone | 08:07 | |
| *** asettle has joined #openstack-keystone | 08:08 | |
| *** markvoelker has quit IRC | 08:11 | |
| *** pnavarro has joined #openstack-keystone | 08:13 | |
| *** asettle has quit IRC | 08:13 | |
| *** xiaoyang has joined #openstack-keystone | 08:16 | |
| *** magic has quit IRC | 08:20 | |
| *** code-R has joined #openstack-keystone | 08:21 | |
| *** magic has joined #openstack-keystone | 08:23 | |
| *** mvk has joined #openstack-keystone | 08:26 | |
| *** sileht has joined #openstack-keystone | 08:26 | |
| *** xiaoyang has quit IRC | 08:26 | |
| *** amoralej|off is now known as amoralej | 08:29 | |
| *** davechen has quit IRC | 08:42 | |
| *** josecastroleon has quit IRC | 08:45 | |
| *** josecastroleon has joined #openstack-keystone | 08:57 | |
| *** daemontool_ has quit IRC | 08:59 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:01 | |
| *** code-R_ has joined #openstack-keystone | 09:01 | |
| *** mfisch has joined #openstack-keystone | 09:01 | |
| *** mfisch has quit IRC | 09:02 | |
| *** mfisch has joined #openstack-keystone | 09:02 | |
| *** code-R has quit IRC | 09:04 | |
| *** markvoelker has joined #openstack-keystone | 09:07 | |
| *** asettle has joined #openstack-keystone | 09:09 | |
| *** markvoelker has quit IRC | 09:12 | |
| *** asettle has quit IRC | 09:14 | |
| *** zhangjl1 has joined #openstack-keystone | 09:17 | |
| *** zhangjl has quit IRC | 09:20 | |
| *** eandersson has joined #openstack-keystone | 09:22 | |
| *** tobberydberg has joined #openstack-keystone | 09:26 | |
| *** eandersson has quit IRC | 09:28 | |
| *** tobberydberg has quit IRC | 09:28 | |
| *** odyssey4me_ is now known as odyssey4me | 09:30 | |
| *** tobberydberg has joined #openstack-keystone | 09:31 | |
| *** code-R_ has quit IRC | 09:52 | |
| *** asettle has joined #openstack-keystone | 09:52 | |
| *** code-R has joined #openstack-keystone | 09:52 | |
| *** mvk has quit IRC | 09:54 | |
| *** mvk has joined #openstack-keystone | 09:55 | |
| *** GB21 has quit IRC | 09:55 | |
| *** baffle_ is now known as baffle | 09:57 | |
| *** tqtran has joined #openstack-keystone | 10:01 | |
| *** code-R_ has joined #openstack-keystone | 10:03 | |
| *** tqtran has quit IRC | 10:05 | |
| *** code-R has quit IRC | 10:06 | |
| *** huhaoran has quit IRC | 10:07 | |
| *** markvoelker has joined #openstack-keystone | 10:08 | |
| *** markvoelker has quit IRC | 10:13 | |
| *** GB21 has joined #openstack-keystone | 10:19 | |
| *** liujiong has quit IRC | 10:25 | |
| *** DuncanT has quit IRC | 10:33 | |
| *** josecastroleon has quit IRC | 10:33 | |
| *** DuncanT has joined #openstack-keystone | 10:33 | |
| *** david-lyle_ has joined #openstack-keystone | 10:35 | |
| *** david-lyle has quit IRC | 10:37 | |
| *** guoshan has quit IRC | 10:42 | |
| *** jaosorior has quit IRC | 10:42 | |
| *** mgagne has joined #openstack-keystone | 10:47 | |
| *** mgagne is now known as Guest2615 | 10:47 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 10:48 |
| samueldmq | morning keystoners! | 10:55 |
| *** udesale has quit IRC | 10:59 | |
| *** erhudy has quit IRC | 11:00 | |
| *** erhudy has joined #openstack-keystone | 11:00 | |
| breton | samueldmq: o/ | 11:06 |
| samueldmq | breton: hey | 11:07 |
| *** richm has joined #openstack-keystone | 11:09 | |
| *** GB21 has quit IRC | 11:10 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Invalidate token cache after token delete https://review.openstack.org/316991 | 11:14 |
| *** zhangjl1 has quit IRC | 11:14 | |
| *** GB21 has joined #openstack-keystone | 11:24 | |
| *** kamal___ has quit IRC | 11:27 | |
| *** kamal___ has joined #openstack-keystone | 11:27 | |
| *** openstackgerrit has quit IRC | 11:32 | |
| *** guoshan has joined #openstack-keystone | 11:43 | |
| samueldmq | lbragstad: morning. do you consider your comments in https://review.openstack.org/#/c/390948 as blockers ? | 11:46 |
| *** code-R_ has quit IRC | 11:46 | |
| samueldmq | lbragstad: I like them, the tests would be much better | 11:46 |
| *** guoshan has quit IRC | 11:47 | |
| *** hyakuhei has quit IRC | 11:51 | |
| *** hyakuhei has joined #openstack-keystone | 11:51 | |
| *** hyakuhei has quit IRC | 11:51 | |
| *** hyakuhei has joined #openstack-keystone | 11:51 | |
| *** openstackgerrit has joined #openstack-keystone | 11:51 | |
| openstackgerrit | chenyingnan proposed openstack/keystone-specs: Typo fixing https://review.openstack.org/408041 | 11:51 |
| *** tobberyd_ has joined #openstack-keystone | 11:53 | |
| *** catintheroof has joined #openstack-keystone | 11:55 | |
| *** tobberydberg has quit IRC | 11:56 | |
| *** pnavarro has quit IRC | 11:58 | |
| *** code-R has joined #openstack-keystone | 12:00 | |
| *** nicolasbock has joined #openstack-keystone | 12:01 | |
| *** tqtran has joined #openstack-keystone | 12:02 | |
| *** tqtran has quit IRC | 12:07 | |
| *** dave-mccowan has joined #openstack-keystone | 12:09 | |
| *** markvoelker has joined #openstack-keystone | 12:09 | |
| *** edmondsw has joined #openstack-keystone | 12:12 | |
| *** markvoelker has quit IRC | 12:15 | |
| *** edmondsw_ has joined #openstack-keystone | 12:26 | |
| *** GB21 has quit IRC | 12:28 | |
| *** pnavarro has joined #openstack-keystone | 12:31 | |
| *** xiaoyang has joined #openstack-keystone | 12:31 | |
| *** catintheroof has quit IRC | 12:32 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Add test to expose bug 1625230 https://review.openstack.org/407558 | 12:32 |
| openstack | bug 1625230 in OpenStack Identity (keystone) "Role Assignment Incorrectly Reports Inheritance when --name is Used" [Medium,In progress] https://launchpad.net/bugs/1625230 - Assigned to Kanika Singh (kanikasingh-1490) | 12:32 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Get assignments with names honors inheritance flag https://review.openstack.org/380973 | 12:32 |
| *** jaosorior has joined #openstack-keystone | 12:32 | |
| *** catintheroof has joined #openstack-keystone | 12:32 | |
| *** magic has quit IRC | 12:33 | |
| *** magic has joined #openstack-keystone | 12:34 | |
| *** xiaoyang has quit IRC | 12:36 | |
| *** faizy_ has quit IRC | 12:36 | |
| *** catintheroof has quit IRC | 12:37 | |
| *** asettle has quit IRC | 12:37 | |
| *** asettle has joined #openstack-keystone | 12:38 | |
| *** xiaoyang has joined #openstack-keystone | 12:40 | |
| *** magic has quit IRC | 12:42 | |
| *** magic has joined #openstack-keystone | 12:43 | |
| *** guoshan has joined #openstack-keystone | 12:44 | |
| *** xiaoyang has quit IRC | 12:45 | |
| *** guoshan has quit IRC | 12:48 | |
| *** edmondsw_ has quit IRC | 12:50 | |
| *** catintheroof has joined #openstack-keystone | 12:54 | |
| stevemar | o/ | 12:54 |
| *** jaosorior has quit IRC | 12:59 | |
| *** lamt has quit IRC | 13:01 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Refactors _get_names_from_role_assignments https://review.openstack.org/408074 | 13:01 |
| *** voelzmo has quit IRC | 13:02 | |
| *** guoshan has joined #openstack-keystone | 13:04 | |
| *** amoralej is now known as amoralej|lunch | 13:08 | |
| *** jaosorior has joined #openstack-keystone | 13:10 | |
| *** markvoelker has joined #openstack-keystone | 13:12 | |
| *** code-R has quit IRC | 13:12 | |
| *** catinthe_ has joined #openstack-keystone | 13:14 | |
| *** guoshan has quit IRC | 13:15 | |
| *** catintheroof has quit IRC | 13:16 | |
| *** markvoelker has quit IRC | 13:16 | |
| *** voelzmo has joined #openstack-keystone | 13:17 | |
| *** markvoelker has joined #openstack-keystone | 13:19 | |
| *** code-R has joined #openstack-keystone | 13:19 | |
| *** faizy_ has joined #openstack-keystone | 13:21 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Get assignments with names honors inheritance flag https://review.openstack.org/380973 | 13:22 |
| *** code-R has quit IRC | 13:23 | |
| *** code-R has joined #openstack-keystone | 13:28 | |
| *** code-R has quit IRC | 13:32 | |
| *** code-R has joined #openstack-keystone | 13:35 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Get assignments with names honors inheritance flag https://review.openstack.org/380973 | 13:36 |
| *** code-R has quit IRC | 13:38 | |
| *** lamt has joined #openstack-keystone | 13:41 | |
| *** rcernin has quit IRC | 13:49 | |
| *** hanchao has quit IRC | 13:50 | |
| *** rcernin has joined #openstack-keystone | 13:51 | |
| *** tobberyd_ is now known as tobberydberg | 13:52 | |
| *** Guest2615 is now known as mgagne | 13:54 | |
| *** mgagne has quit IRC | 13:54 | |
| *** mgagne has joined #openstack-keystone | 13:54 | |
| *** links has quit IRC | 13:59 | |
| *** catintheroof has joined #openstack-keystone | 14:02 | |
| *** faizy_ has quit IRC | 14:02 | |
| *** lamt has quit IRC | 14:03 | |
| *** tqtran has joined #openstack-keystone | 14:04 | |
| *** catinthe_ has quit IRC | 14:04 | |
| *** lamt has joined #openstack-keystone | 14:06 | |
| *** amoralej|lunch is now known as amoralej | 14:07 | |
| *** tqtran has quit IRC | 14:09 | |
| lbragstad | samueldmq i think it would make the tests better, right now the tests don't really do much | 14:25 |
| samueldmq | lbragstad: agreed, would you mind to put some weight there? | 14:26 |
| lbragstad | sure i can review | 14:26 |
| *** edmondsw has quit IRC | 14:27 | |
| stevemar | o/ | 14:28 |
| *** phalmos has quit IRC | 14:36 | |
| *** edmondsw has joined #openstack-keystone | 14:41 | |
| *** jaosorior has quit IRC | 14:43 | |
| *** nkinder has joined #openstack-keystone | 14:57 | |
| *** links has joined #openstack-keystone | 15:03 | |
| *** voelzmo has quit IRC | 15:04 | |
| *** voelzmo_ has joined #openstack-keystone | 15:07 | |
| *** tobberydberg has quit IRC | 15:07 | |
| *** ravelar has joined #openstack-keystone | 15:15 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/408094 | 15:16 |
| *** nkinder has quit IRC | 15:17 | |
| *** guoshan has joined #openstack-keystone | 15:17 | |
| *** guoshan has quit IRC | 15:21 | |
| *** daemontool has joined #openstack-keystone | 15:23 | |
| *** dave-mccowan has quit IRC | 15:23 | |
| *** udesale has joined #openstack-keystone | 15:26 | |
| *** catintheroof has quit IRC | 15:26 | |
| *** catintheroof has joined #openstack-keystone | 15:26 | |
| *** nkinder has joined #openstack-keystone | 15:30 | |
| *** catintheroof has quit IRC | 15:31 | |
| *** spilla has joined #openstack-keystone | 15:37 | |
| *** dave-mccowan has joined #openstack-keystone | 15:41 | |
| *** jaugustine has joined #openstack-keystone | 15:42 | |
| *** spzala has joined #openstack-keystone | 15:46 | |
| *** hogepodge has joined #openstack-keystone | 15:50 | |
| *** phalmos has joined #openstack-keystone | 15:51 | |
| ayoung | lbragstad, we meeting in 10 minutes? | 15:51 |
| lbragstad | ayoung yeah - in #openstack-meeting-cp | 15:52 |
| ayoung | Cool. Do we have an agenda? | 15:52 |
| ayoung | https://etherpad.openstack.org/p/keystone-policy-meeting | 15:52 |
| lbragstad | we have one | 15:53 |
| lbragstad | it just wasn't dated | 15:53 |
| lbragstad | ayoung that wasn't a past agenda | 15:53 |
| *** chris_hultin|AWA is now known as chris_hultin | 15:54 | |
| ayoung | lbragstad, OK now? | 15:54 |
| lbragstad | yep | 15:54 |
| lbragstad | wfm | 15:54 |
| *** chris_hultin is now known as chris_hultin|AWA | 15:57 | |
| *** catintheroof has joined #openstack-keystone | 15:57 | |
| *** chlong has joined #openstack-keystone | 15:58 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:59 | |
| *** voelzmo_ has quit IRC | 16:03 | |
| *** adrian_otto has joined #openstack-keystone | 16:04 | |
| *** ravelar1 has joined #openstack-keystone | 16:06 | |
| *** ravelar has quit IRC | 16:07 | |
| *** links has quit IRC | 16:13 | |
| *** ravelar1 has quit IRC | 16:16 | |
| *** ravelar has joined #openstack-keystone | 16:16 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 16:17 |
| *** guoshan has joined #openstack-keystone | 16:18 | |
| *** pcaruana has quit IRC | 16:18 | |
| *** spzala has quit IRC | 16:19 | |
| *** rcernin has quit IRC | 16:19 | |
| *** udesale has quit IRC | 16:19 | |
| *** spzala has joined #openstack-keystone | 16:20 | |
| *** guoshan has quit IRC | 16:22 | |
| *** spzala has quit IRC | 16:23 | |
| *** spzala has joined #openstack-keystone | 16:31 | |
| *** mvk has quit IRC | 16:31 | |
| *** spzala has quit IRC | 16:35 | |
| *** spzala has joined #openstack-keystone | 16:37 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: API Documentation for user password expires https://review.openstack.org/405574 | 16:40 |
| *** spzala has quit IRC | 16:41 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 16:44 |
| *** spzala has joined #openstack-keystone | 16:48 | |
| *** adrian_otto has quit IRC | 16:49 | |
| *** spzala has quit IRC | 16:53 | |
| *** spzala has joined #openstack-keystone | 16:54 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add doctor check for debug mode enabled https://review.openstack.org/408218 | 16:56 |
| *** chlong has quit IRC | 16:56 | |
| *** diazjf has joined #openstack-keystone | 16:57 | |
| *** browne has joined #openstack-keystone | 16:58 | |
| *** spzala has quit IRC | 16:59 | |
| dstanek | ayoung: that's all good stuff and i want to get as much of that captured as we can | 17:00 |
| ayoung | lbragstad, is your concern management? | 17:01 |
| *** Ephur has joined #openstack-keystone | 17:01 | |
| lbragstad | well - management is *a* concern but I had another one that i commented one last night | 17:01 |
| *** kfox1111 has quit IRC | 17:01 | |
| *** Ephur has quit IRC | 17:02 | |
| lbragstad | line 245 https://review.openstack.org/#/c/391624/15/specs/keystone/ongoing/role-check-from-middleware.rst | 17:02 |
| lbragstad | and line 95 | 17:02 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: WIP - Allow user to change own expired password https://review.openstack.org/404022 | 17:04 |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: API Documentation for user password expires https://review.openstack.org/405574 | 17:05 |
| *** spzala has joined #openstack-keystone | 17:06 | |
| *** asettle has quit IRC | 17:07 | |
| edmondsw | lbragstad re: line 95, the RBAC check would have to pass... if we're trying to separate RBAC and ABAC, then RBAC checks that you MIGHT be allowed to do this depending on ABAC vs. we already know you can't even without trying ABAC, then if you got past the RBAC check you proceed to check ABAC | 17:07 |
| edmondsw | ayoung agreed? | 17:07 |
| lbragstad | edmondsw right | 17:08 |
| lbragstad | edmondsw my confusion is that if PATCH /servers/{service_id} requests admin_or_owner and I only have the Member role, but I am the resource owner, what happens? | 17:08 |
| lbragstad | s/requests/requires/ | 17:09 |
| lbragstad | we'd have to do the ownership check *before* the RBAC check, right/ | 17:09 |
| *** spzala has quit IRC | 17:11 | |
| *** rcernin has joined #openstack-keystone | 17:11 | |
| ayoung | OK..just put this in the review but... | 17:11 |
| ayoung | admin_or_owner will still pass. 3 cases ( I think) | 17:11 |
| ayoung | A. admin role on admin project | 17:11 |
| ayoung | B. admin role on resource's project | 17:11 |
| ayoung | C. member role on resource's project | 17:11 |
| ayoung | Admin -> Member means that any of these roles will pass the RBAC check in middleware. | 17:11 |
| ayoung | A. policy will enforce on is_admin/admin project as the override, and that will pass | 17:11 |
| ayoung | B & C. policy will enforce that the role is a supported role, and the project matches | 17:11 |
| *** spzala has joined #openstack-keystone | 17:12 | |
| ayoung | That is what is meant by admin_or_owner in most projects | 17:12 |
| ayoung | Keystone is different | 17:12 |
| ayoung | but the additional check is "userid on the project matches" is still performed in policy | 17:13 |
| ayoung | not in RBAC | 17:13 |
| *** chrisplo has joined #openstack-keystone | 17:14 | |
| edmondsw | ayoung what you're describing isn't RBAC... it's RBAC with a little ABAC included | 17:14 |
| ayoung | edmondsw, yes. the RBAC stuff is just the part in middleware | 17:14 |
| edmondsw | I think you've still got some ABAC in middleware... the project check | 17:14 |
| ayoung | lbragstad, if an API currently requires "no" role and we say it now requires the "Member" role, there is no change it what happens in essence | 17:15 |
| edmondsw | project is an attribute of the resource... i.e. ABAC | 17:15 |
| dstanek | ayoung: so the middleware will check to see if the user is admin or member before getting to the service policy? | 17:15 |
| ayoung | edmondsw, project check happens in policy, not not in middleware | 17:15 |
| ayoung | dstanek, right | 17:15 |
| ayoung | it is only the role check | 17:15 |
| ayoung | edmondsw, right, but that is not checked in middleware because we don't have the resource out of the database yet | 17:16 |
| edmondsw | ayoung admin_or_owner can't be checked in middleware then | 17:16 |
| lbragstad | so i'm failing to see how this works... if I *own* a resource and i go to do something on it, and the policy for the operation that i want to do is admin_or_owner, how does the whole request not fail becuase I'm not admin? | 17:16 |
| *** spzala has quit IRC | 17:16 | |
| dstanek | ayoung: and then the policy would do both RBAC-like things and ABAC-like things | 17:16 |
| dstanek | ? | 17:17 |
| ayoung | hmmm | 17:18 |
| ayoung | lbragstad, which API are you looking at? I can walk you through that | 17:18 |
| *** guoshan has joined #openstack-keystone | 17:18 | |
| dstanek | for example, the policy needs to enfore ownership only for member role and not admin role | 17:19 |
| edmondsw | remember that there is no "member" role by default (that's a devstack thing, not an openstack thing). And even if we start requiring that, it's pretty pointless for these purposes... if the check is going to be "admin or any other role" then you might as well not check at all | 17:19 |
| ayoung | dstanek, yes, you are correct. The policy does the RBAC stuff specifically for admin operations all over the place. | 17:19 |
| lbragstad | ayoung i left my comment inline at line 245 - https://review.openstack.org/#/c/391624/15/specs/keystone/ongoing/role-check-from-middleware.rst | 17:19 |
| ayoung | edmondsw, those are the defaults, but with this setup, it is going to much easier to modify those. | 17:19 |
| dstanek | ayoung: so why split some of the RBAC stuff into middleware if you have to do it in policy anyway? | 17:20 |
| ayoung | We start by saying everything is _member_ as that is the default role in policy | 17:20 |
| edmondsw | ayoung what are the defaults? | 17:20 |
| ayoung | er | 17:20 |
| edmondsw | ? | 17:20 |
| ayoung | that is the default role from config | 17:20 |
| edmondsw | I didnt' follow you | 17:20 |
| edmondsw | there is no default "member" role in config | 17:20 |
| ayoung | ok...lets vback up to v2 | 17:20 |
| knikolla | o/ | 17:20 |
| ayoung | when you add a user to a proejct using the v2 apis, it usee the default role out of the config file | 17:21 |
| edmondsw | the only default role is admin, period | 17:21 |
| ayoung | which is what just about everyone is doing | 17:21 |
| ayoung | that means that most people have _member_ as their sole role | 17:21 |
| edmondsw | screw v2... | 17:21 |
| ayoung | some might have Member as that is what Horizson was doing | 17:21 |
| ayoung | but that is the starting point. | 17:21 |
| edmondsw | I don't agree | 17:21 |
| ayoung | So we put an implied role in there which says | 17:21 |
| edmondsw | I've got 1000 customers that DON'T have a member role | 17:21 |
| ayoung | admin implies member | 17:21 |
| ayoung | edmondsw, what are the role names that you are using? | 17:22 |
| edmondsw | and even if the member role exists... it's essentially just an "everyone that's not an admin" role... admin + "everyone that's not an admin" = everyone | 17:22 |
| *** spzala has joined #openstack-keystone | 17:22 | |
| edmondsw | ayoung I've got a bunch... deployer, viewer (equiv to observer proposal), etc. | 17:22 |
| dstanek | edmondsw: you lost me with the maths | 17:23 |
| dstanek | :-P | 17:23 |
| *** guoshan has quit IRC | 17:23 | |
| ayoung | edmondsw, excellent. so, the first thing to do is to say deployer implies viewer and so on | 17:23 |
| ayoung | set up the role inference rules that make sense for your deployment | 17:23 |
| edmondsw | it's sets... you have a set of users with the admin role. you also have a set of users with member role, if that's the only other role. Add those 2 sets and you have all users with ANY role | 17:23 |
| ayoung | edmondsw, again, just a staring point.... | 17:24 |
| edmondsw | ayoung I don't see how that's even related... | 17:24 |
| ayoung | edmondsw, heh heh heh | 17:24 |
| *** mvk has joined #openstack-keystone | 17:24 | |
| ayoung | that is the power of what we are trying to do here. | 17:24 |
| edmondsw | you're not answering my questions... | 17:24 |
| ayoung | ok, lets say you need to go from my simplistic view to your more realistic one | 17:24 |
| ayoung | I'm typing as fast as I can... | 17:25 |
| ayoung | to start, I don't want to break anyone out the gate | 17:25 |
| ayoung | so...for a deployment following the general trend (we'll get to yours in a moment" | 17:26 |
| ayoung | we say that there are 2 main roles: admin and member | 17:26 |
| ayoung | admin implies member | 17:26 |
| ayoung | and we set all APIs to be RBAC checked by Member | 17:26 |
| ayoung | with some minor adjustment for service roles etc... | 17:26 |
| *** spzala has quit IRC | 17:27 | |
| *** Zer0Byte__ has joined #openstack-keystone | 17:27 | |
| ayoung | in a deployment set up like this, that then activates the RBAC check, there is no change | 17:27 |
| ayoung | everything still works as is | 17:27 |
| ayoung | now..if they want to add an observer role, they do the following | 17:27 |
| ayoung | 1. create the role observer | 17:27 |
| ayoung | 2. create a role that says that member implies observer | 17:27 |
| ayoung | 3. modify the RBAC rules for any APIs that they want to be accessable to observers | 17:28 |
| ayoung | they can do all this without breaking anything | 17:28 |
| *** spzala has joined #openstack-keystone | 17:28 | |
| ayoung | now, they can create a user with only the Role Observer, and that new user is limited to only the APIs that have the observer role | 17:29 |
| ayoung | the implied roles Admin and member can still perform these apis, and thus all normal users have no change in access | 17:29 |
| ayoung | edmondsw, now, in your case, if you did custom policy already, you can either stick with just that, or roll the custom policy back to the base policy and use RBAC in middleware to do the role check | 17:30 |
| edmondsw | ayoung won't work... they'd also have to go modify policy.json since after the middleware that is going to be checked, and you had to leave it checking ownership tied to the member role since you didn't check project in middleware | 17:30 |
| *** chlong has joined #openstack-keystone | 17:30 | |
| ayoung | edmondsw, why would they have to modify the policy.json? | 17:30 |
| edmondsw | because your policy.json still has the check for ownership tied to the member role | 17:31 |
| *** spzala has quit IRC | 17:33 | |
| edmondsw | also the implied roles stuff you're doing only makes sense if the new role is truly a subset of the old role, which often won't make sense | 17:33 |
| *** dhellmann has quit IRC | 17:33 | |
| *** daemontool has quit IRC | 17:35 | |
| edmondsw | ayoung if you didn't check ownership in the middleware, then you still have to be doing that through policy.json, right? | 17:36 |
| ayoung | edmondsw, so the scope check is already there | 17:36 |
| edmondsw | there = where? | 17:36 |
| ayoung | no one has to modify policy.json to do scope checks | 17:36 |
| ayoung | they are already in the nova code, and the policy.json files in the rest of the proejcts | 17:36 |
| edmondsw | they do if they now want it to apply to new roles... | 17:37 |
| ayoung | edmondsw, nah, that is the cool thing, the current rules don;'t check roles | 17:37 |
| edmondsw | the scope check is tied to a role | 17:37 |
| ayoung | they only check the scope | 17:37 |
| ayoung | you would think. but no | 17:37 |
| edmondsw | ?? why would you say that? | 17:37 |
| ayoung | let me get you and example | 17:37 |
| ayoung | http://git.openstack.org/cgit/openstack/neutron/tree/etc/policy.json#n4 rule admin_or_owner | 17:38 |
| ayoung | "owner": "tenant_id:%(tenant_id)s", | 17:38 |
| ayoung | no role check made | 17:38 |
| ayoung | there are some role checks in that file, but they are service roles, and those APIs will need to be excepted in the RBAC layer | 17:39 |
| edmondsw | you're forgetting... the check isn't for "owner"... it's for "admin_or_owner" | 17:39 |
| edmondsw | admin = a role | 17:39 |
| ayoung | that will pass, too | 17:39 |
| ayoung | as I said we need an implied rule that admin -> Member | 17:39 |
| ayoung | and then it passes the RBAC check | 17:39 |
| ayoung | reread the stuff I repasted from the review... that case is covered | 17:40 |
| *** spzala has joined #openstack-keystone | 17:40 | |
| *** xiaoyang has joined #openstack-keystone | 17:40 | |
| edmondsw | ok, then you have the opposite problem... where you add a role that you don't want to be scope checked | 17:40 |
| edmondsw | why do you need an impled rule that admin -> member? | 17:41 |
| *** magic has quit IRC | 17:43 | |
| *** spzala has quit IRC | 17:44 | |
| *** spzala has joined #openstack-keystone | 17:46 | |
| *** faizy has joined #openstack-keystone | 17:50 | |
| *** spzala has quit IRC | 17:50 | |
| ayoung | edmondsw, at the Access rule you specify only one role per API | 17:53 |
| ayoung | if you don't use the implied roles, you need to explicitly assign any role a user would need for any API | 17:53 |
| ayoung | so admin can do anything a member can do, but the opposite is not true | 17:54 |
| lbragstad | breaking for lunch - i'll catch the scrollback | 17:54 |
| ayoung | lbragstad, edmondsw BTW, I got the implied role functionality working in openstack CLI this morning, finally | 17:55 |
| ayoung | please take a look: | 17:55 |
| ayoung | https://review.openstack.org/#/c/290253/ | 17:55 |
| *** diazjf has quit IRC | 17:56 | |
| edmondsw | ayoung you intend to restrict that we only check one role per API? | 18:00 |
| *** dhellmann has joined #openstack-keystone | 18:00 | |
| ayoung | edmondsw, no | 18:00 |
| ayoung | edmondsw, I intent to restrict that we *specify* one role per api, then use implied roles to turn that into a set of roles | 18:00 |
| ayoung | you always will specify the lowest level of access | 18:01 |
| edmondsw | that is gonna completely break me | 18:01 |
| ayoung | so if admin->member->observer, for a read only API, specify observer | 18:01 |
| ayoung | edmondsw, nah | 18:01 |
| edmondsw | yeah, it will | 18:01 |
| ayoung | edmondsw, lay out your roles, please...we started on that earlier | 18:01 |
| edmondsw | because that only works if your roles are supersets/subsets, and mine aren't | 18:01 |
| edmondsw | telling you the names isn't going to help you | 18:02 |
| *** david-lyle_ is now known as david-lyle | 18:02 | |
| ayoung | edmondsw, ah, but you can always introduce new roles, specific to an API, to make that work | 18:02 |
| edmondsw | introducing new roles != backward compatible | 18:02 |
| ayoung | edmondsw, it is with implied roles | 18:02 |
| edmondsw | and quite a lot of work | 18:02 |
| ayoung | think of it like a graph | 18:02 |
| edmondsw | not with the case I just laid out | 18:02 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to CADF notifications in docs https://review.openstack.org/400882 | 18:02 |
| edmondsw | and adding a role per API is super ugly and unfriendly to users | 18:03 |
| ayoung | edmondsw, the feature is going to be optional, and off by default, but I am pretty confident we can make it work for your use case | 18:03 |
| edmondsw | I wish I shared your optimism | 18:03 |
| ayoung | edmondsw, so do I, but I've been working through this for a long time, and it was based on use cases much like yours | 18:04 |
| ayoung | yes, there is ugliness here | 18:04 |
| ayoung | and we might need better tools for managing role definitions as the numbers rise | 18:04 |
| ayoung | I could see there being 3 classes of roles long term: | 18:05 |
| ayoung | at the lowest level, roles that are one-to-one with an API | 18:05 |
| ayoung | at the highest level, roles that are organizational | 18:05 |
| ayoung | in the middle, workflow roles | 18:05 |
| ayoung | so your organizational roles determines what workflows you can do, and the workflows determine what APIs you can call | 18:06 |
| *** spzala has joined #openstack-keystone | 18:06 | |
| edmondsw | I don't like that idea at all | 18:08 |
| edmondsw | as I said, ugly and unfriendly to users | 18:09 |
| edmondsw | I cannot introduce more roles to my users | 18:09 |
| ayoung | edmondsw, you don't have to | 18:10 |
| edmondsw | ? | 18:10 |
| ayoung | I think what you want is to not show the intermediate level roles to them on some UI? | 18:11 |
| ayoung | edmondsw, I need more information from you. | 18:11 |
| edmondsw | not have them | 18:12 |
| *** spzala has quit IRC | 18:12 | |
| edmondsw | if they exist, they will be seen | 18:12 |
| edmondsw | it's not a UI issue... I could hide them in the UI... but I can't hide them in REST and CLI | 18:12 |
| *** Matias has joined #openstack-keystone | 18:12 | |
| *** spzala has joined #openstack-keystone | 18:12 | |
| edmondsw | and it's just ugly... that's not what roles are for | 18:12 |
| edmondsw | we're turning roles into permissions | 18:13 |
| edmondsw | maybe you need to create something called permissions | 18:13 |
| ayoung | edmondsw, I had considered that. But basically, that would mean that everything that does roles now would need to do roles and permissions | 18:14 |
| ayoung | it is a lable | 18:14 |
| ayoung | label | 18:14 |
| Matias | hi guys, I'm trying to fix a bug but I'm not sure if it should be fixed in keystoneclient or in os-client-config | 18:14 |
| edmondsw | it's more than a label | 18:14 |
| ayoung | if you are not in to the British spelling | 18:14 |
| Matias | I think it should be fixed in os-client-config, but I'd be grateful if someone could take a look and confirm that | 18:14 |
| ayoung | Matias, which one? | 18:14 |
| *** dhellmann has quit IRC | 18:15 | |
| edmondsw | I have to run... good luck Matias! | 18:15 |
| ayoung | Matias, and most of the folks here don't know what os-client-config is | 18:15 |
| ayoung | But I do | 18:15 |
| edmondsw | or stevemar | 18:15 |
| Matias | ayoung: I have initially reported to shade, but they said os-client-config was the culprit --> https://storyboard.openstack.org/#!/story/2000762 | 18:15 |
| edmondsw | there is an #openstack-sdks channel | 18:16 |
| Matias | edmondsw: thanks | 18:16 |
| ayoung | nah, this belongs here, I think... | 18:16 |
| *** spzala has quit IRC | 18:17 | |
| Matias | ayoung: https://github.com/openstack/os-client-config/blob/59a96bb72c66426db8972acd3be55601b6135be0/os_client_config/cloud_config.py#L324 | 18:17 |
| Matias | if I add 'identity' to the tuple here, it works | 18:17 |
| Matias | but I'd like to know if this is right --> https://github.com/openstack/python-keystoneclient/blob/f7c1d45a04bb2b024a985b8e30245d38f2bf8442/keystoneclient/httpclient.py#L253 | 18:17 |
| ayoung | Matias, what is that logic supposed to be doing? | 18:17 |
| Matias | ayoung: some clients receive $OS_INTERFACE as the 'interface' kwarg, others receive it as 'endpoint_type' | 18:18 |
| ayoung | constructor_kwargs[interface_key] = interface | 18:18 |
| Matias | I have the feeling receiving it as 'interface' is some legacy behaviour, but I'm not sure | 18:18 |
| Matias | currently the keystoneclient receives it as 'interface' | 18:18 |
| *** guoshan has joined #openstack-keystone | 18:19 | |
| ayoung | Matias, Do you know if that was a deliberate change at some point, or if this is one of those things that evolved separately? | 18:19 |
| *** asettle has joined #openstack-keystone | 18:21 | |
| Matias | ayoung: not really | 18:21 |
| ayoung | Matias, let me see.... | 18:21 |
| Matias | comments about glance seem to imply 'interface' is a legacy kwarg, but... | 18:22 |
| Matias | https://github.com/openstack/os-client-config/commit/9835daf9f684556c5aed4834dc086e932788f9bc | 18:22 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 18:22 |
| Matias | here they introduce the 'interface' param for the barbican client, which is relatively new | 18:22 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 18:22 |
| *** spzala has joined #openstack-keystone | 18:23 | |
| ayoung | lovely | 18:24 |
| *** guoshan has quit IRC | 18:24 | |
| *** faizy has quit IRC | 18:25 | |
| *** amoralej is now known as amoralej|off | 18:25 | |
| ayoung | Matias, so, lets assume that keystone want to keep using interface, then, and yes, change it in os-client-config | 18:26 |
| ayoung | I don;t think endpoint_type is in use anywere in keystoneclient code | 18:26 |
| ayoung | although that internal value is all over the place... | 18:27 |
| *** spzala has quit IRC | 18:27 | |
| Matias | ayoung: do you think it would be sensible to send the gerrit PR to os-client-config then? | 18:28 |
| ayoung | Matias, the person that knows this stuff code is jamielennox but he is asleep ATM | 18:29 |
| ayoung | He's in australia, so he is upside down right now | 18:29 |
| Matias | then in approx 4h he should be available | 18:30 |
| Matias | ayoung: thanks, I'll talk to him | 18:30 |
| ayoung | Matias, lets see what he put into the session code...that would be how he was thinkgin about it | 18:31 |
| ayoung | Matias, so, it is not in KeystoneAuth...let me go back to client and look... | 18:32 |
| ayoung | Matias, so internally it looks like the python code calls it endpoint_type, but the config param is interface. I'd say go ahead and submit that change to os-client-config | 18:37 |
| Matias | ayoung: thanks | 18:37 |
| *** chlong has quit IRC | 18:38 | |
| *** spzala has joined #openstack-keystone | 18:43 | |
| *** voelzmo has joined #openstack-keystone | 18:45 | |
| *** spzala_ has joined #openstack-keystone | 18:45 | |
| *** nicolasbock has quit IRC | 18:47 | |
| *** nicolasbock has joined #openstack-keystone | 18:47 | |
| *** spzala_ has quit IRC | 18:47 | |
| *** spzala_ has joined #openstack-keystone | 18:47 | |
| *** nicolasbock has quit IRC | 18:47 | |
| *** spzala has quit IRC | 18:48 | |
| *** nicolasbock has joined #openstack-keystone | 18:48 | |
| *** Nakato has quit IRC | 18:48 | |
| *** Nakato has joined #openstack-keystone | 18:48 | |
| *** pnavarro has quit IRC | 18:55 | |
| *** nicolasbock has quit IRC | 18:56 | |
| *** nicolasbock has joined #openstack-keystone | 18:56 | |
| *** chlong has joined #openstack-keystone | 18:57 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Role Check Check from Middleware https://review.openstack.org/391624 | 19:04 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Print name with duplicate error on user creation https://review.openstack.org/405104 | 19:10 |
| *** asettle has quit IRC | 19:21 | |
| *** ravelar has quit IRC | 19:22 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Role Check from Middleware https://review.openstack.org/391624 | 19:23 |
| *** tqtran has joined #openstack-keystone | 19:26 | |
| *** diazjf has joined #openstack-keystone | 19:28 | |
| *** narasimha_SV has joined #openstack-keystone | 19:33 | |
| narasimha_SV | after adding this patch I was able to integrate LDAP as backend | 19:34 |
| narasimha_SV | but when I execute any openstack command it is failing with 401 authorization failed | 19:34 |
| narasimha_SV | http://paste.openstack.org/show/591710/ | 19:34 |
| narasimha_SV | this is the log | 19:34 |
| *** chlong has quit IRC | 19:36 | |
| narasimha_SV | how to enable user in LDAP | 19:37 |
| *** spligak has quit IRC | 19:44 | |
| *** tobberydberg has joined #openstack-keystone | 19:45 | |
| *** voelzmo has quit IRC | 19:48 | |
| *** diazjf has quit IRC | 19:48 | |
| *** voelzmo has joined #openstack-keystone | 19:48 | |
| *** diazjf has joined #openstack-keystone | 19:49 | |
| *** lamt has quit IRC | 19:49 | |
| *** dhellmann_ has joined #openstack-keystone | 19:52 | |
| *** voelzmo has quit IRC | 19:53 | |
| *** voelzmo has joined #openstack-keystone | 19:54 | |
| *** raildo has left #openstack-keystone | 19:58 | |
| *** dhellmann_ is now known as dhellmann | 19:59 | |
| *** chlong has joined #openstack-keystone | 20:00 | |
| *** clenimar has quit IRC | 20:01 | |
| *** ravelar has joined #openstack-keystone | 20:08 | |
| *** Nakato has quit IRC | 20:11 | |
| *** Nakato has joined #openstack-keystone | 20:12 | |
| *** spzala_ has quit IRC | 20:16 | |
| *** spzala has joined #openstack-keystone | 20:17 | |
| *** guoshan has joined #openstack-keystone | 20:21 | |
| *** spzala has quit IRC | 20:21 | |
| *** asettle has joined #openstack-keystone | 20:25 | |
| *** guoshan has quit IRC | 20:25 | |
| *** Nakato has quit IRC | 20:28 | |
| *** Nakato has joined #openstack-keystone | 20:29 | |
| *** asettle has quit IRC | 20:30 | |
| *** voelzmo has quit IRC | 20:31 | |
| *** voelzmo has joined #openstack-keystone | 20:32 | |
| *** ravelar has quit IRC | 20:34 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Expose password requirements through API https://review.openstack.org/407036 | 20:34 |
| lbragstad | stevemar samueldmq updated ^ | 20:35 |
| lbragstad | rderose ^ | 20:35 |
| lbragstad | we still need to figure out what we are going to do with the routers there. | 20:35 |
| kamal___ | I am building a new service and would like to add role based access control using keystone. I understand the part where we need to setup users, roles, projects, services and roles. However, I am not sure what changes need to be made in the service itself to integrate keystone authentication. Any pointers? | 20:36 |
| lbragstad | anyone have any ideas? | 20:36 |
| *** voelzmo has quit IRC | 20:36 | |
| lbragstad | kamal___ are you planning on using oslo.policy or keystonemiddleware in your service? | 20:37 |
| kamal___ | lbragstad: I'm not sure. Right now, I am evaluating different approaches. I am open to using oslo.policy though | 20:38 |
| kamal___ | My impression was that all API calls will go to keystone and then it will get routed to the service. It seems like that is not the case. | 20:38 |
| lbragstad | kamal___ currently - managing policy is done in two steps | 20:39 |
| kamal___ | I added my service as an endpoint in keystone and I am able to access it without any authentication. So it means, adding to the catalogue doesnt really enforce anything. | 20:39 |
| kamal___ | lbragstad: could you elaborate | 20:40 |
| lbragstad | kamal___ sure | 20:40 |
| lbragstad | kamal___ the steps don't necessarily have to be done in an order but, first you have to ensure the role exists in keystone as an entity (i.e. using a client to create it `openstack role create <role_name>`) | 20:41 |
| *** harlowja has quit IRC | 20:41 | |
| lbragstad | the 2nd step is to make sure the role exists in the various service policy files | 20:41 |
| kamal___ | lbragstad: yes I did create users, roles, projects, services and endpoints | 20:41 |
| *** ravelar has joined #openstack-keystone | 20:42 | |
| kamal___ | you mean policy.json | 20:42 |
| lbragstad | kamal___ so when a request comes into the service, and if that service is protected using keystonemiddleware and oslo.policy, those two pieces of software will validate the token of the user doing the operation and oslo.policy will compare the attributes of the token validation against the service's policy file | 20:43 |
| lbragstad | kamal___ yeah - exactly | 20:43 |
| *** edmondsw has quit IRC | 20:43 | |
| kamal___ | again for a new service, how do I integrate the oslo.policy | 20:43 |
| lbragstad | kamal___ you'll need a way to give oslo.policy the rules your service wants to enforce around it's operations | 20:44 |
| lbragstad | kamal___ most projects do this using a policy.json file | 20:44 |
| lbragstad | https://github.com/openstack/keystone/blob/fc93521ed1fca2e8393cf2e53e0f79a61dec7222/etc/policy.json is keystone's for example | 20:44 |
| lbragstad | next - you'll need to make sure keystonemiddleware is configured in front of the service | 20:45 |
| kamal___ | yes that is policy.json file. I am using Pecan for the service. Do I need to integrate oslo.policy to get this working | 20:45 |
| *** lamt has joined #openstack-keystone | 20:46 | |
| lbragstad | kamal___ yeah - if you want to enforce policy using keystone, keystonemiddleware, and oslo.policy - http://docs.openstack.org/developer/keystone/devref/services.html#auth-token-middleware | 20:46 |
| lbragstad | kamal___ here is some additional documentation on configuring keystonemiddleware for your service http://docs.openstack.org/developer/keystonemiddleware/middlewarearchitecture.html#configuration | 20:49 |
| kamal___ | just to clarify. I've this standalone service and I added the endpoint to keystone. Now when I call my endpoint, does it go through a proxy or it goes directly to my service? | 20:50 |
| *** spzala has joined #openstack-keystone | 20:51 | |
| kamal___ | The documentation gave me the impression that it goes thru a proxy and passes some environment variables to the service | 20:51 |
| lbragstad | kamal___ well - the request will go through a paste pipeline that will enforce policy for the service | 20:51 |
| lbragstad | based on what the service tells oslo.policy to enforce | 20:52 |
| kamal___ | lbragstad: how does that happen? Should I do something in the service to make it go through the paste pipeline | 20:52 |
| lbragstad | kamal___ a good example of this is looking at how other services deploy keystonemiddleware | 20:53 |
| kamal___ | lbragstad: like neutron? | 20:53 |
| lbragstad | kamal___ yeah - like neuton, | 20:53 |
| lbragstad | or cinder, or nova for exmaple | 20:53 |
| lbragstad | example* | 20:54 |
| kamal___ | lbragstad: is there difference between using keystonemiddleware vs oslo.policy? | 20:54 |
| lbragstad | kamal___ all of those services will have a section in their respective configuration files titled [keystone_authtoken] | 20:54 |
| lbragstad | kamal___ kind of | 20:54 |
| kamal___ | ok I will check it. Thanks | 20:55 |
| *** spzala has quit IRC | 20:55 | |
| lbragstad | kamal___ think of keystonemiddleware as the thing that *talks* to keystone to get information about a specific user's token, and oslo.policy as the thing that enforces the policy | 20:55 |
| *** Nakato has quit IRC | 20:55 | |
| kamal___ | lbragstad: I guess the question how does the service know about the keystonemiddleware. Is it done through a code change in the service? | 20:56 |
| lbragstad | kamal___ nope - let me find an example | 20:56 |
| kamal___ | that will be great | 20:56 |
| *** Nakato has joined #openstack-keystone | 20:56 | |
| lbragstad | kamal___ are you familiar with paste piplines? | 20:56 |
| lbragstad | pipelines? | 20:56 |
| kamal___ | not really. | 20:57 |
| kamal___ | I am using PECAN. Would that change how paste pipeline is used? | 20:59 |
| *** tqtran is now known as tqtran-afk | 20:59 | |
| lbragstad | kamal___ so here - https://github.com/openstack/cinder/blob/master/etc/cinder/api-paste.ini#L71-L75 | 20:59 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Print name with duplicate error on user creation https://review.openstack.org/405104 | 21:00 |
| lbragstad | you can see the cinder's paste pipeline includes those two definitions | 21:00 |
| kamal___ | ok. Does that mean cinder will load those classes in different contexts | 21:01 |
| lbragstad | and if you scroll up, you can see they specify those filters in the pipeline for their application - https://github.com/openstack/cinder/blob/master/etc/cinder/api-paste.ini#L27 | 21:01 |
| *** spzala has joined #openstack-keystone | 21:01 | |
| kamal___ | should there be a corresponding code to process this file? | 21:02 |
| *** spzala has quit IRC | 21:03 | |
| lbragstad | kamal___ well - the project will typically point to is through configuration https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L2133-L2143 | 21:03 |
| *** spzala has joined #openstack-keystone | 21:03 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add doctor check for debug mode enabled https://review.openstack.org/408218 | 21:03 |
| lbragstad | kamal___ ^ that's keystone's for example | 21:03 |
| lbragstad | kamal___ which looks similar to cinder's https://github.com/openstack/keystone/blob/master/etc/keystone-paste.ini | 21:04 |
| kamal___ | ok. It kind of makes sense but I wish there was better doc on how it is done. I will poke around and see. | 21:04 |
| lbragstad | kamal___ my indepth description of the process might not be that great | 21:05 |
| lbragstad | kamal___ but the gist of it is that in order to use keystonemiddleware + oslo.policy + keystone for policy, you'll typically add keystonemiddleware to your service's paste pipeline and ensure your service's configuration has values for keystonemiddleware to be able to talk to keystone | 21:06 |
| lbragstad | and finally - make sure you have something like a policy.json file to describe your policy | 21:06 |
| kamal___ | lbragstad: ok. thanks for the info. Let me check the links you provided. | 21:07 |
| lbragstad | kamal___ the website for Paste Deploy isn't loading for me - but this might help, too http://www.ianbicking.org/what-is-paste-yet-again.html | 21:07 |
| *** spzala has quit IRC | 21:07 | |
| kamal___ | ok. thats great. Hope the site will come back soon | 21:08 |
| *** asettle has joined #openstack-keystone | 21:09 | |
| *** asettle has quit IRC | 21:09 | |
| lbragstad | kamal___ sounds good - ping if you have additional questions | 21:10 |
| *** asettle has joined #openstack-keystone | 21:10 | |
| *** asettle has quit IRC | 21:12 | |
| *** asettle has joined #openstack-keystone | 21:12 | |
| *** narasimha_SV has quit IRC | 21:13 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/408093 | 21:14 |
| openstackgerrit | Chetna proposed openstack/keystone: Fix mapping_purge failure https://review.openstack.org/408304 | 21:16 |
| *** ravelar has quit IRC | 21:16 | |
| *** Nakato has quit IRC | 21:20 | |
| *** Nakato has joined #openstack-keystone | 21:20 | |
| *** guoshan has joined #openstack-keystone | 21:21 | |
| *** tobberydberg has quit IRC | 21:25 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 21:25 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 21:26 |
| *** guoshan has quit IRC | 21:26 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 21:29 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Fixed multiple warnings in tox -edocs https://review.openstack.org/408312 | 21:36 |
| *** catintheroof has quit IRC | 21:37 | |
| *** diazjf has quit IRC | 21:38 | |
| *** catintheroof has joined #openstack-keystone | 21:38 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Fixed multiple warnings in tox -edocs https://review.openstack.org/408312 | 21:39 |
| *** harlowja has joined #openstack-keystone | 21:41 | |
| *** catintheroof has quit IRC | 21:42 | |
| *** spligak has joined #openstack-keystone | 21:44 | |
| *** adriant has joined #openstack-keystone | 21:49 | |
| *** jamielennox|away is now known as jamielennox | 21:49 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Fixed multiple warnings in tox -edocs https://review.openstack.org/408312 | 21:51 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Fixed multiple warnings in tox -edocs https://review.openstack.org/408312 | 21:53 |
| *** diazjf has joined #openstack-keystone | 21:55 | |
| stevemar | gagehugo: had a few comments you may have missed in ps2 | 21:59 |
| gagehugo | stevemar: oh yeah I did | 22:01 |
| openstackgerrit | Merged openstack/keystone-specs: Typo fixing https://review.openstack.org/408041 | 22:01 |
| stevemar | gagehugo: ;) | 22:01 |
| gagehugo | will fix in a sec | 22:02 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Fixed multiple warnings in tox -edocs https://review.openstack.org/408312 | 22:03 |
| *** kfox1111 has joined #openstack-keystone | 22:04 | |
| *** martinus- has quit IRC | 22:04 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Fixed multiple warnings in tox -edocs https://review.openstack.org/408312 | 22:05 |
| *** slunkad has quit IRC | 22:05 | |
| *** martinus__ has joined #openstack-keystone | 22:05 | |
| *** slunkad has joined #openstack-keystone | 22:06 | |
| *** itisha has joined #openstack-keystone | 22:06 | |
| gagehugo | alright, should be ok | 22:06 |
| stevemar | gagehugo: you lost the bug in transition :O | 22:06 |
| gagehugo | bah | 22:07 |
| gagehugo | today is not my day, cant wait for friday | 22:07 |
| stevemar | :) | 22:07 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Fixed multiple warnings in tox -edocs https://review.openstack.org/408312 | 22:08 |
| stevemar | gagehugo: i can't wait for feb 20th | 22:08 |
| gagehugo | stevemar: Im excited for that too | 22:08 |
| gagehugo | need to get past xmas first though | 22:09 |
| *** dave-mccowan has quit IRC | 22:09 | |
| *** ravelar has joined #openstack-keystone | 22:09 | |
| stevemar | gagehugo: hmm, whats up with line 604 here: http://paste.openstack.org/show/591727/ | 22:10 |
| *** asettle has quit IRC | 22:10 | |
| stevemar | gagehugo: commented | 22:10 |
| gagehugo | thx | 22:10 |
| stevemar | gagehugo: hmm, looking at lines 457-463 here: http://paste.openstack.org/show/591727/ | 22:12 |
| gagehugo | oh that's the wrong paste, I had to cut it down | 22:12 |
| stevemar | ohhh | 22:12 |
| stevemar | gagehugo: does it still apply? | 22:12 |
| gagehugo | can only paste 900~ lines | 22:12 |
| stevemar | (seems like it would) | 22:12 |
| *** tqtran-afk is now known as tqtran | 22:13 | |
| gagehugo | I can pull it down and check | 22:13 |
| gagehugo | oh yeah the commit message got reverted | 22:13 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Fixed multiple warnings in tox -edocs https://review.openstack.org/408312 | 22:14 |
| *** diazjf has quit IRC | 22:16 | |
| *** edmondsw has joined #openstack-keystone | 22:16 | |
| openstackgerrit | Merged openstack/keystone-specs: Expose password requirements through API https://review.openstack.org/407036 | 22:19 |
| stevemar | gagehugo: looks like it still applies :) | 22:19 |
| gagehugo | yeah its something I missed | 22:21 |
| *** edmondsw has quit IRC | 22:21 | |
| *** guoshan has joined #openstack-keystone | 22:22 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Set the domain for federated users https://review.openstack.org/408332 | 22:24 |
| *** ravelar has quit IRC | 22:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Set the domain for federated users https://review.openstack.org/408332 | 22:25 |
| *** guoshan has quit IRC | 22:27 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Fixed multiple warnings in tox -edocs https://review.openstack.org/408312 | 22:27 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Set the domain for federated users https://review.openstack.org/408332 | 22:27 |
| gagehugo | stevemar: ok | 22:28 |
| *** spzala has joined #openstack-keystone | 22:29 | |
| *** diazjf has joined #openstack-keystone | 22:30 | |
| gagehugo | I put an updated paste link too | 22:32 |
| lbragstad | adriant are we holding off of https://review.openstack.org/#/c/345705/ for now? | 22:33 |
| lbragstad | s/of/on/ | 22:33 |
| adriant | lbragstad: yes because the MFA changes morgan is introducing will affect the MFA enable workflow. So best to change that first, then figure out the best UX for management. | 22:34 |
| lbragstad | adriant ok - cool | 22:34 |
| lbragstad | adriant thanks for the update | 22:34 |
| adriant | lbragstad: no problem | 22:35 |
| *** spzala has quit IRC | 22:36 | |
| adriant | morgan: on that note, do we want to work out a implementation plan for the new spec? Just to work out who can/should do what parts. | 22:37 |
| stevemar | gagehugo: thanks! | 22:41 |
| stevemar | gagehugo: i think http://stackoverflow.com/questions/15249340/warning-document-isnt-included-in-any-toctree-for-included-file will fix some of the other warnings | 22:42 |
| stevemar | gagehugo: for the "WARNING: document isn't included in any toctree " error | 22:43 |
| stevemar | you can probably "Add :orphan: to the top of your document to get rid of the warning" | 22:43 |
| gagehugo | stevemar: interesting | 22:43 |
| stevemar | gagehugo: i think i did that to a few | 22:43 |
| stevemar | apparently not :( | 22:44 |
| stevemar | or actually stick them in a ToC | 22:44 |
| stevemar | but... meh | 22:44 |
| gagehugo | I can take a look | 22:44 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add doctor check for debug mode enabled https://review.openstack.org/408218 | 22:44 |
| *** spilla has quit IRC | 22:46 | |
| *** rcernin has quit IRC | 22:48 | |
| *** ayoung has quit IRC | 22:48 | |
| *** lamt has quit IRC | 22:48 | |
| morgan | adriant: either or. | 22:50 |
| morgan | I am flexible on that front. | 22:50 |
| *** jaugustine has quit IRC | 22:50 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Set the domain for federated users https://review.openstack.org/408332 | 22:51 |
| *** chris_hultin is now known as chris_hultin|AWA | 22:53 | |
| *** browne has quit IRC | 22:53 | |
| *** ravelar has joined #openstack-keystone | 22:56 | |
| adriant | morgan: Well I'm around most days, and respond to email as best I can. Not too fussed as to what, just would like to help if I can so you aren't stuck doing all of it. :) | 23:00 |
| *** ravelar has quit IRC | 23:00 | |
| morgan | cool I'm working on moving ATM. | 23:00 |
| adriant | morgan: plus trying to learn as much of the keystone codebase as I can | 23:01 |
| adriant | morgan: no rush. I'm in the middle of my own project right now anyway that is at the 'soooo very close to done' stage. | 23:01 |
| adriant | So that will keep me busy for the next week or so. | 23:02 |
| morgan | will have more time once this move stuff is going. just looking at places and getting ready to out a deposit on a place. | 23:05 |
| *** chlong has quit IRC | 23:06 | |
| *** nkinder has quit IRC | 23:10 | |
| *** asettle has joined #openstack-keystone | 23:11 | |
| *** diazjf has quit IRC | 23:12 | |
| *** harlowja has quit IRC | 23:16 | |
| *** asettle has quit IRC | 23:16 | |
| *** david-lyle_ has joined #openstack-keystone | 23:20 | |
| *** david-lyle_ has quit IRC | 23:20 | |
| *** guoshan has joined #openstack-keystone | 23:23 | |
| *** jamielennox is now known as jamielennox|away | 23:27 | |
| *** guoshan has quit IRC | 23:27 | |
| *** jamielennox|away is now known as jamielennox | 23:28 | |
| *** phalmos has quit IRC | 23:37 | |
| *** browne has joined #openstack-keystone | 23:41 | |
| *** martinus__ has quit IRC | 23:45 | |
| *** martinus__ has joined #openstack-keystone | 23:45 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!