| *** lamt has quit IRC | 00:02 | |
| *** catintheroof has quit IRC | 00:03 | |
| *** browne has quit IRC | 00:07 | |
| morgan | dstanek, rderose, stevemar, breton, samueldmq, lbragstad, knikolla: oops 2 more tests to fix. fixed in a moment | 00:09 |
|---|---|---|
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Code-Defined Resource-specific Options https://review.openstack.org/424334 | 00:16 |
| *** browne has joined #openstack-keystone | 00:19 | |
| *** Adobeman has joined #openstack-keystone | 00:23 | |
| Adobeman | hi, anyone uses keystone with openldap directory service here? I have issues with newton (RDO) keep getting reject when attempting to authenticate | 00:24 |
| Adobeman | if I were to just use a standard ldapsearch from the openstack system, it works perfectly fine. But keystone refuse to authenticate .. | 00:25 |
| *** portdirect is now known as portdirect_travl | 00:40 | |
| *** tovin07_ has joined #openstack-keystone | 00:49 | |
| *** dave-mcc_ has joined #openstack-keystone | 00:50 | |
| *** browne has quit IRC | 00:51 | |
| *** dave-mccowan has quit IRC | 00:53 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP extend users API to add federated object https://review.openstack.org/418624 | 00:58 |
| *** bjolo_ has joined #openstack-keystone | 01:06 | |
| *** martinus__ has quit IRC | 01:11 | |
| *** martinus__ has joined #openstack-keystone | 01:11 | |
| *** edmondsw has joined #openstack-keystone | 01:12 | |
| *** edmondsw has quit IRC | 01:17 | |
| *** dave-mccowan has joined #openstack-keystone | 01:20 | |
| *** dave-mcc_ has quit IRC | 01:22 | |
| *** phalmos_ has quit IRC | 01:22 | |
| knikolla | morgan: looking now :) | 01:23 |
| *** tqtran has quit IRC | 01:26 | |
| dstanek | Adobeman: using the same credentials for keystone and on the command line? | 01:30 |
| Adobeman | dstanek: yes | 01:42 |
| Adobeman | manager | 01:43 |
| *** catintheroof has joined #openstack-keystone | 01:44 | |
| dstanek | Adobeman: if you have debugging on you should be able to get the exact command being run so that you can double check it | 01:45 |
| Adobeman | I did.. they look the same to me :x | 01:46 |
| Adobeman | debug was set at ... 4 | 01:47 |
| Adobeman | if I remember correctly | 01:47 |
| Adobeman | one sec | 01:47 |
| dstanek | hmmm...that's not good | 01:47 |
| dstanek | i don't really use ldap :-( | 01:47 |
| dstanek | my next step would be to run that command on the same box that runs keystone under that same user that is running the service | 01:48 |
| *** catintheroof has quit IRC | 01:49 | |
| Adobeman | http://pastebin.com/pdDNXdqP | 01:49 |
| Adobeman | oh... | 01:50 |
| *** erlon has quit IRC | 01:50 | |
| dstanek | Adobeman: got something? | 01:53 |
| Adobeman | that's just output of... | 01:53 |
| Adobeman | ldapsearch, logs, keystone.conf.. | 01:53 |
| Adobeman | I'm little suprised not many people out there actually done openldap + openstack :-( | 01:54 |
| Adobeman | more people seem to be doing it with Active Directory | 01:54 |
| stevemar | dstanek: soccer? i hope it's indoor | 01:55 |
| *** dave-mcc_ has joined #openstack-keystone | 01:57 | |
| *** dave-mccowan has quit IRC | 01:59 | |
| *** thorst_ has joined #openstack-keystone | 02:01 | |
| knikolla | Adobeman: you're getting user is disabled, so my guess is that something is wrong with your user_enabled_emulation_dn | 02:03 |
| stevemar | going to rebase breton's patch on top of rderose's | 02:03 |
| dstanek | stevemar: yes, indoor :-) | 02:03 |
| Adobeman | knikolla: I dont fully understand how to 'fix that'... | 02:04 |
| *** thorst_ has quit IRC | 02:06 | |
| knikolla | Adobeman: i don't have much experience with setting up ldap. enabled_emulation is used to set users as enabled if they are part of the group in enabled_emulation_dn | 02:07 |
| Adobeman | ok, I will look into that... | 02:08 |
| Adobeman | thanks | 02:08 |
| knikolla | Adobeman: in this case, your dn doesn't really point to a group. try making a group and adding testuser to it. | 02:09 |
| Adobeman | ok | 02:10 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enable trusts for federated users https://review.openstack.org/415545 | 02:17 |
| *** jose-phillips has quit IRC | 02:44 | |
| *** thorst_ has joined #openstack-keystone | 02:50 | |
| *** thorst_ has quit IRC | 02:50 | |
| *** diazjf has joined #openstack-keystone | 02:57 | |
| *** d0ugal has quit IRC | 03:00 | |
| *** markvoelker has joined #openstack-keystone | 03:07 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Force users to change password upon first use https://review.openstack.org/425507 | 03:08 |
| *** thorst_ has joined #openstack-keystone | 03:17 | |
| *** d0ugal has joined #openstack-keystone | 03:17 | |
| *** lamt has joined #openstack-keystone | 03:17 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Add support for endpoint group filtering https://review.openstack.org/182658 | 03:18 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Force users to change password upon first use https://review.openstack.org/425507 | 03:23 |
| *** markvoelker has quit IRC | 03:23 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to change password upon first use https://review.openstack.org/425507 | 03:24 |
| *** xiongjh1 has joined #openstack-keystone | 03:28 | |
| samueldmq | stevemar: where is the list of things that need to be reviewed by the end of this week ? | 03:29 |
| samueldmq | stevemar: I remember we talking about it in the meeting but can't see in the meeting agenda | 03:29 |
| *** bjolo_ has quit IRC | 03:31 | |
| *** markvoelker has joined #openstack-keystone | 03:33 | |
| gagehugo | https://etherpad.openstack.org/p/keystone-sprint-to-ocata | 03:36 |
| gagehugo | samueldmq: couldn't find a link in the meeting, but that was in my history recently | 03:37 |
| gagehugo | so it was linked sometime recently | 03:37 |
| *** nicolasbock has quit IRC | 03:39 | |
| stevemar | gagehugo: thanks | 03:45 |
| stevemar | samueldmq: yep, what gagehugo said | 03:46 |
| stevemar | morgan: around-ish? | 04:14 |
| openstackgerrit | Tin Lam proposed openstack/keystoneauth: Fix ClientException message property not set properly https://review.openstack.org/285757 | 04:17 |
| *** spotz is now known as spotz_zzz | 04:22 | |
| *** nkinder has quit IRC | 04:31 | |
| *** dave-mcc_ has quit IRC | 04:32 | |
| *** ianw is now known as ianw_pto | 04:34 | |
| *** nkinder has joined #openstack-keystone | 04:35 | |
| morgan | stevemar:o/ | 04:47 |
| morgan | stevemar: back from food | 04:47 |
| *** spotz_zzz is now known as spotz | 04:50 | |
| morgan | rderose: comments on your patch. | 04:58 |
| *** spotz is now known as spotz_zzz | 05:00 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP get user https://review.openstack.org/425534 | 05:00 |
| *** cburgess has quit IRC | 05:01 | |
| *** Guest58531 has quit IRC | 05:04 | |
| *** spotz_zzz has quit IRC | 05:04 | |
| *** chris_hultin|AWA has quit IRC | 05:06 | |
| *** woodburn has quit IRC | 05:06 | |
| *** ayoung has quit IRC | 05:06 | |
| *** ayoung has joined #openstack-keystone | 05:07 | |
| *** ChanServ sets mode: +v ayoung | 05:07 | |
| *** woodburn has joined #openstack-keystone | 05:07 | |
| *** comstud has quit IRC | 05:07 | |
| *** dtroyer has quit IRC | 05:07 | |
| *** cburgess has joined #openstack-keystone | 05:07 | |
| *** chris_hultin|AWA has joined #openstack-keystone | 05:07 | |
| *** spotz_zzz has joined #openstack-keystone | 05:07 | |
| *** mgagne has joined #openstack-keystone | 05:07 | |
| *** mgagne is now known as Guest33539 | 05:07 | |
| *** chris_hultin|AWA is now known as chris_hultin | 05:07 | |
| *** comstud has joined #openstack-keystone | 05:08 | |
| *** dtroyer has joined #openstack-keystone | 05:08 | |
| *** antwash has joined #openstack-keystone | 05:08 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add 'options' as an explicit user schema validation https://review.openstack.org/425536 | 05:08 |
| *** adriant has quit IRC | 05:17 | |
| *** thorst_ has joined #openstack-keystone | 05:18 | |
| *** thorst_ has quit IRC | 05:23 | |
| *** browne has joined #openstack-keystone | 05:23 | |
| stevemar | breton: morgan since you guys are the evening crew... if any of https://review.openstack.org/#/c/294535/ https://review.openstack.org/#/c/423561/ https://review.openstack.org/#/c/423753/ https://review.openstack.org/#/c/409874/ or https://review.openstack.org/#/c/423708/ come back as -2 from jenkins, just recheck or rebase or reapprove | 05:25 |
| *** browne has quit IRC | 05:34 | |
| stevemar | morgan: o/ | 05:37 |
| stevemar | so it looks like get'ting a user will now add 'options' if https://review.openstack.org/#/c/424334/ merges | 05:37 |
| *** antwash_ has joined #openstack-keystone | 05:40 | |
| *** xiongjh1 has quit IRC | 05:40 | |
| stevemar | hmm, doesn't seem to | 05:43 |
| *** spotz_zzz is now known as spotz | 05:44 | |
| *** antwash_ has quit IRC | 05:45 | |
| stevemar | hmm interesting, it doesn't affect existing users until an update is called | 05:46 |
| stevemar | i suppose that is fine | 05:46 |
| *** spotz is now known as spotz_zzz | 05:54 | |
| openstackgerrit | Merged openstack/keystone: Add DB operations tracing https://review.openstack.org/294535 | 06:22 |
| openstackgerrit | Merged openstack/keystone: Add warning about using `external` with federation https://review.openstack.org/423561 | 06:22 |
| *** diazjf has quit IRC | 06:26 | |
| morgan | stevemar: all is going well. about to clock out | 06:26 |
| morgan | for the night | 06:26 |
| *** lamt has quit IRC | 06:27 | |
| *** spotz_zzz is now known as spotz | 06:38 | |
| openstackgerrit | Merged openstack/keystone: update entry points related to paste middleware https://review.openstack.org/423753 | 06:40 |
| openstackgerrit | Merged openstack/keystone: Add domain_id to the user table https://review.openstack.org/409874 | 06:40 |
| openstackgerrit | Merged openstack/keystone: Refactor shadow users tests https://review.openstack.org/423705 | 06:40 |
| *** ravelar has quit IRC | 06:42 | |
| *** Jack_V has joined #openstack-keystone | 06:42 | |
| *** spotz is now known as spotz_zzz | 06:48 | |
| *** stingaci has joined #openstack-keystone | 06:55 | |
| *** jperry has quit IRC | 06:57 | |
| *** stingaci has quit IRC | 07:00 | |
| *** tesseract has joined #openstack-keystone | 07:11 | |
| *** edmondsw has joined #openstack-keystone | 07:12 | |
| *** spotz_zzz is now known as spotz | 07:14 | |
| *** edmondsw has quit IRC | 07:16 | |
| *** rha has quit IRC | 07:17 | |
| *** frickler has quit IRC | 07:18 | |
| *** thorst_ has joined #openstack-keystone | 07:19 | |
| *** jperry has joined #openstack-keystone | 07:19 | |
| *** stingaci has joined #openstack-keystone | 07:20 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:22 | |
| *** thorst_ has quit IRC | 07:23 | |
| *** jperry has quit IRC | 07:24 | |
| *** spotz is now known as spotz_zzz | 07:24 | |
| *** jperry has joined #openstack-keystone | 07:24 | |
| *** stingaci has quit IRC | 07:25 | |
| *** jperry has quit IRC | 07:30 | |
| *** jperry has joined #openstack-keystone | 07:32 | |
| *** thorst_ has joined #openstack-keystone | 07:34 | |
| *** rha has joined #openstack-keystone | 07:36 | |
| *** rha has quit IRC | 07:37 | |
| *** rha has joined #openstack-keystone | 07:37 | |
| *** frickler has joined #openstack-keystone | 07:37 | |
| *** thorst_ has quit IRC | 07:39 | |
| *** stingaci has joined #openstack-keystone | 07:46 | |
| openstackgerrit | Merged openstack/keystone: Set the domain for federated users https://review.openstack.org/423708 | 07:47 |
| *** stingaci has quit IRC | 07:51 | |
| *** stingaci has joined #openstack-keystone | 07:52 | |
| *** tovin07_ has quit IRC | 08:05 | |
| *** spotz_zzz is now known as spotz | 08:08 | |
| *** markvoelker has quit IRC | 08:12 | |
| *** markvoelker has joined #openstack-keystone | 08:15 | |
| *** spotz is now known as spotz_zzz | 08:18 | |
| *** frickler has quit IRC | 08:23 | |
| *** rha has quit IRC | 08:23 | |
| *** frickler has joined #openstack-keystone | 08:24 | |
| *** antwash_ has joined #openstack-keystone | 08:24 | |
| *** rha has joined #openstack-keystone | 08:25 | |
| *** rha has quit IRC | 08:25 | |
| *** rha has joined #openstack-keystone | 08:25 | |
| *** antwash_ has quit IRC | 08:29 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** spotz_zzz is now known as spotz | 09:02 | |
| *** AlexeyAbashkin has quit IRC | 09:10 | |
| *** spotz is now known as spotz_zzz | 09:12 | |
| openstackgerrit | Merged openstack/keystone: Catch potential SyntaxError in federation mapping https://review.openstack.org/421616 | 09:21 |
| *** jperry has quit IRC | 09:23 | |
| *** pnavarro has joined #openstack-keystone | 09:25 | |
| *** thorst_ has joined #openstack-keystone | 09:35 | |
| *** thorst_ has quit IRC | 09:40 | |
| *** mvk has quit IRC | 09:47 | |
| *** jose-phillips has joined #openstack-keystone | 09:50 | |
| *** thorst_ has joined #openstack-keystone | 09:51 | |
| *** spotz_zzz is now known as spotz | 09:53 | |
| *** jose-phillips has quit IRC | 09:54 | |
| *** thorst_ has quit IRC | 09:56 | |
| *** spotz is now known as spotz_zzz | 10:03 | |
| robcresswell | stevemar: So, I know the keystone/horizon meetings tailed off a little towards the end of the cycle. Is they any intention on the keystone side to keep them up next cycle? I'd like us to, because I feel its been very productive. | 10:07 |
| robcresswell | lbragstad, samueldmq ^^ Might be relevant since I see you're both running for PTL for Pike | 10:07 |
| *** gema has quit IRC | 10:21 | |
| *** antwash_ has joined #openstack-keystone | 10:40 | |
| *** antwash_ has quit IRC | 10:45 | |
| *** spotz_zzz is now known as spotz | 10:48 | |
| *** edmondsw has joined #openstack-keystone | 10:48 | |
| *** edmondsw has quit IRC | 10:52 | |
| *** spotz is now known as spotz_zzz | 10:57 | |
| *** openstackgerrit has quit IRC | 11:17 | |
| *** masterjcool has quit IRC | 11:22 | |
| *** masterjcool has joined #openstack-keystone | 11:34 | |
| *** gitudaniel has joined #openstack-keystone | 11:37 | |
| *** spotz_zzz is now known as spotz | 11:42 | |
| *** nicolasbock has joined #openstack-keystone | 11:43 | |
| *** spotz is now known as spotz_zzz | 11:51 | |
| *** thorst_ has joined #openstack-keystone | 11:52 | |
| *** thorst_ has quit IRC | 11:57 | |
| dstanek | good morning all | 12:00 |
| dstanek | robcresswell: ++ i think it's a good idea to keep that going | 12:00 |
| *** stingaci has quit IRC | 12:00 | |
| *** raildo has joined #openstack-keystone | 12:09 | |
| *** mvk has joined #openstack-keystone | 12:16 | |
| *** spotz_zzz is now known as spotz | 12:18 | |
| robcresswell | dstanek: Agreed. I was going to put in my PTL email to do so, but thought I better confirm with you guys first :p | 12:20 |
| dstanek | robcresswell: i think it's a benefit to the community to have both teams working more closely | 12:21 |
| robcresswell | dstanek: ++ | 12:22 |
| *** erlon has joined #openstack-keystone | 12:27 | |
| *** catintheroof has joined #openstack-keystone | 12:27 | |
| *** spotz is now known as spotz_zzz | 12:27 | |
| *** openstackgerrit has joined #openstack-keystone | 12:28 | |
| openstackgerrit | David Stanek proposed openstack/keystoneauth: Fix ClientException message property not set properly https://review.openstack.org/285757 | 12:28 |
| dstanek | stevemar: lbragstad: rderose: ^ the 3 line change that is taking forever to get through... | 12:36 |
| *** catintheroof has quit IRC | 12:38 | |
| *** catintheroof has joined #openstack-keystone | 12:38 | |
| *** spotz_zzz is now known as spotz | 12:39 | |
| *** stingaci has joined #openstack-keystone | 12:41 | |
| *** stingaci has quit IRC | 12:45 | |
| *** thorst_ has joined #openstack-keystone | 12:47 | |
| *** lamt has joined #openstack-keystone | 12:49 | |
| *** spotz is now known as spotz_zzz | 12:49 | |
| *** lamt has quit IRC | 12:53 | |
| *** catinthe_ has joined #openstack-keystone | 12:57 | |
| *** catintheroof has quit IRC | 12:59 | |
| *** d-bark has joined #openstack-keystone | 13:02 | |
| *** edmondsw has joined #openstack-keystone | 13:14 | |
| *** markvoelker has quit IRC | 13:14 | |
| samueldmq | morning | 13:14 |
| samueldmq | robcresswell: agree with what dstanek said | 13:14 |
| robcresswell | samueldmq: Awesome | 13:18 |
| *** richm has joined #openstack-keystone | 13:18 | |
| samueldmq | morgan: rderose I might need some help understanding the in-code options purpose | 13:29 |
| samueldmq | morgan: rderose and how it relates to removing lockout_ignored_user_ids and ignore_password_expires_user_ids | 13:30 |
| dstanek | samueldmq: one benefit is that certain types of things like an "ignore list" that we currently put into the config can be stored in the database | 13:30 |
| dstanek | so no restart is required to add a service user for instance | 13:31 |
| *** nishaYadav has joined #openstack-keystone | 13:32 | |
| *** spotz_zzz is now known as spotz | 13:33 | |
| samueldmq | dstanek: gotcha, but I see that user_option table associates user_id with option_id | 13:34 |
| samueldmq | dstanek: so it's per user, rather than to "all users" | 13:34 |
| dstanek | samueldmq: it always is. take a list of user ids in the config file. that is per user | 13:34 |
| stevemar | robcresswell: i think we ticked off most items on our initial list | 13:39 |
| stevemar | robcresswell: buyt yeah, we can keep them up | 13:39 |
| *** spotz is now known as spotz_zzz | 13:51 | |
| robcresswell | stevemar: :D | 13:53 |
| samueldmq | dstanek: makehmm makes sense | 13:56 |
| samueldmq | makehmm/hmm | 13:56 |
| samueldmq | dstanek: however, users who currently have access to update their own info (name, description) | 13:58 |
| samueldmq | will then be able to set the config options to themselves | 13:59 |
| dstanek | samueldmq: the plan is to put policy around individual options | 13:59 |
| dstanek | something like that should be done before rderose's patches merge | 14:00 |
| samueldmq | dstanek: kk or just update_user_options, if we do per option the policy file will explode in size | 14:00 |
| samueldmq | identity:update_user_options | 14:00 |
| dstanek | samueldmq: can't do that since some of the options should be admin only and other controlled by the user | 14:04 |
| *** nishaYadav has quit IRC | 14:05 | |
| samueldmq | dstanek: do you have an example of one that is controlled by the user? | 14:05 |
| samueldmq | dstanek: today none of them are, because it is in the config file | 14:05 |
| *** spotz_zzz is now known as spotz | 14:06 | |
| dstanek | samueldmq: mfa | 14:07 |
| samueldmq | 1 policy entry per option is going to be crazy :( | 14:08 |
| *** richm has quit IRC | 14:09 | |
| stevemar | robcresswell: well, negotiate with whomever is ptl in 10 days :P | 14:11 |
| dstanek | samueldmq: depends on the number of options. also we can have sane defaults and not have to put anything on our policy file if we don't want to | 14:13 |
| stevemar | rderose: morgan dstanek so how would the flow go for marking users as special with 'options' like ignore this user on password expiry? | 14:13 |
| stevemar | rderose: morgan dstanek just a simple update but include options.ignore_user_password = True | 14:14 |
| stevemar | i guess the existing logic would have to look into the resource option (and the config option if it's marked) | 14:14 |
| samueldmq | dstanek: yeah, I'd say we should have identity:update_user_options that applies to all options but the ones user must update | 14:15 |
| samueldmq | identity:update_user_options + identity:update_user_mfa (or whatever) | 14:15 |
| *** jperry has joined #openstack-keystone | 14:15 | |
| *** haplo37_ has quit IRC | 14:15 | |
| dstanek | samueldmq: each one could have it's own policy in code | 14:17 |
| dstanek | you could also implement groups so identity:pci_options policy would be consulted if there was not explicit identity:pci_options:expired_exempt | 14:18 |
| dstanek | morgan: ^ thoughts? | 14:18 |
| samueldmq | also this is bad for per-url policy, which is what we agreed for to do in middleware | 14:18 |
| *** haplo37_ has joined #openstack-keystone | 14:18 | |
| dstanek | samueldmq: i never agreed to it because i think it's wrong | 14:19 |
| samueldmq | since all of them have the same url | 14:19 |
| samueldmq | okay, just would like to let the team know the decisions we're making now are not really going in the same direction of that | 14:20 |
| samueldmq | dstanek: ^ | 14:20 |
| openstackgerrit | Ken Johnston proposed openstack/keystone: Readability enhancements to architecture doc https://review.openstack.org/422375 | 14:20 |
| dstanek | if we do want options controlled by policy and policy middleware then we'd have to only allow changes using {PUT,DELETE} /user/{user_id}/options/{option_name} | 14:21 |
| samueldmq | dstanek: that's a good solution addressing both directions | 14:22 |
| samueldmq | dstanek: for me, the direction the role check is driving us is: get all the role checks in middleware, put the scope and other checks in the code. | 14:30 |
| stevemar | samueldmq dstanek: well, we should only only give the user the right to change specific options | 14:37 |
| stevemar | samueldmq dstanek: they shouldn't have the authorzation to change ignore_password_expires or PCI stuff | 14:38 |
| stevemar | just their MFA bits | 14:38 |
| samueldmq | in that case we could have : identity:update_user_options and identity:update_user_mfa_options | 14:38 |
| samueldmq | stevemar: ^ | 14:39 |
| stevemar | samueldmq: sure, just treat it the same way we did /user/user_id/passwd | 14:39 |
| samueldmq | I am not sure there will be other options the users will be able to change by themselves | 14:39 |
| samueldmq | mfa looks pretty specific | 14:39 |
| stevemar | "identity:change_password": "rule:admin_or_owner", | 14:39 |
| stevemar | "identity:change_mfa": "rule:admin_or_owner", | 14:40 |
| stevemar | doneee | 14:40 |
| *** egonzalez has joined #openstack-keystone | 14:40 | |
| stevemar | the other options, it's unlikely that we'll allow a user to change them | 14:40 |
| stevemar | anyway | 14:41 |
| samueldmq | stevemar: if users can update themselves today (name, whatever) | 14:41 |
| stevemar | samueldmq: they can't do that | 14:41 |
| samueldmq | stevemar: they will become able to update their options, all of a sudden after upgrade | 14:41 |
| egonzalez | Hi guys, i'm testing zero downtime upgrade from newton to master and facing the following error while creating users, other commands work fine http://paste.openstack.org/show/596598/ | 14:42 |
| samueldmq | stevemar: we just need to advertise that well in docs | 14:42 |
| *** spotz is now known as spotz_zzz | 14:42 | |
| stevemar | samueldmq: the only thing a user can update is their password | 14:42 |
| stevemar | unless they are admin* | 14:42 |
| samueldmq | stevemar: not in default policy, but we need advertise deployers in the case tehir custom policy allow it | 14:42 |
| stevemar | update user is admin required -> "identity:update_user": "rule:admin_required", | 14:43 |
| samueldmq | stevemar: exactly, in default policy | 14:43 |
| stevemar | yesh | 14:43 |
| samueldmq | if deployers have customized it, there need to be a way to let them know the effects of that after this upgrade | 14:44 |
| stevemar | why would it affect them? | 14:44 |
| breton | how are roles evaluated for a federated user with fernet token? | 14:44 |
| stevemar | (are you assuming mfa will be landed or something? i'm missing something here...) | 14:45 |
| stevemar | breton: hmm | 14:45 |
| lbragstad | breton we use the group assignments or the direct assignments the federated user has | 14:45 |
| breton | lbragstad: ok. Suppose i am a federated user. I authenticate in adfs and keystone says that i am in group G. After that i get a fernet token. | 14:46 |
| lbragstad | well - and/or the direct assignemnts | 14:46 |
| breton | lbragstad: after that i come to keystone with this fernet token again | 14:46 |
| lbragstad | yep | 14:46 |
| breton | lbragstad: how does keystone know that i am in group G? | 14:46 |
| lbragstad | breton this part threw me for a loop - but hopefully I can help | 14:46 |
| * lbragstad grabbing a link | 14:46 | |
| *** agrebennikov__ has joined #openstack-keystone | 14:47 | |
| stevemar | breton: lbragstad dstanek samueldmq rderose morgan -- i'll be proposing the tip of master right now (169e66ab8800148c4052a46d2cb321af33e44f77) to be ocata-3. I will mark it as WIP as long as I can until the release team shouts at me :) | 14:47 |
| lbragstad | breton https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/mapped.py#L188-L189 | 14:48 |
| stevemar | breton: lbragstad dstanek samueldmq rderose morgan if we want to squeeze anything else in (breton's fix, or morgan's options) we should get it approved in the morning | 14:48 |
| lbragstad | stevemar ack | 14:48 |
| lbragstad | breton these are the tricky bits (that I thought I understood but didn't) | 14:49 |
| lbragstad | https://github.com/openstack/keystone/blob/169e66ab8800148c4052a46d2cb321af33e44f77/keystone/auth/plugins/mapped.py#L188-L189 | 14:49 |
| samueldmq | stevemar: ack thanks | 14:49 |
| breton | lbragstad: aha. Where does `mapped_properties['group_ids']` gets populated when a user comes back with a fernet token? | 14:49 |
| stevemar | breton: lbragstad d-bark samueldmq rderose morgan we can still merge some patches next week, they'll go into the release candidate driver, we don't want too much here... | 14:49 |
| breton | lbragstad: (both links you sent are the same) | 14:49 |
| lbragstad | breton yep - i realized after I sent the first one I wasn't using a SHA | 14:50 |
| breton | ok | 14:50 |
| breton | so | 14:50 |
| lbragstad | (i try to use SHA in those so that when I go back later it doesn't change) | 14:50 |
| breton | i think that roles are not getting populated at all when a user comes back with a token. | 14:50 |
| *** d-bark has quit IRC | 14:50 | |
| breton | (if direct role assignments are not used) | 14:51 |
| lbragstad | breton let's say you go to keystone to ask for a list of projects with an unscoped token you just got as a federated user - https://github.com/openstack/keystone/blob/169e66ab8800148c4052a46d2cb321af33e44f77/keystone/auth/controllers.py#L647-L648 | 14:51 |
| stevemar | release link https://review.openstack.org/#/c/425735/1 | 14:51 |
| breton | lbragstad: stop | 14:52 |
| breton | lbragstad: ` | 14:52 |
| breton | group_ids = request.auth_context.get('group_ids')` | 14:52 |
| breton | lbragstad: where do group_ids come from? | 14:52 |
| stevemar | breton: those are from federated tokens i believe | 14:52 |
| breton | stevemar: federated token has group ids? | 14:53 |
| lbragstad | breton yeah - we get them from the mapping https://github.com/openstack/keystone/blob/169e66ab8800148c4052a46d2cb321af33e44f77/keystone/auth/plugins/mapped.py#L216 | 14:53 |
| lbragstad | (if the mapping applies and puts that user in a group based on the rules) | 14:53 |
| stevemar | breton: https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py#L109-L110 | 14:53 |
| stevemar | yes | 14:53 |
| dstanek | stevemar: i think samueldmq is saying if a cloud allows a user to update their information | 14:54 |
| breton | oooh | 14:54 |
| stevemar | https://github.com/openstack/keystone/blob/master/keystone/models/token_model.py#L262-L269 | 14:54 |
| stevemar | breton: ^ | 14:54 |
| breton | federated_info | 14:54 |
| breton | that's what i missed | 14:54 |
| breton | thank you | 14:54 |
| lbragstad | breton yeah - it's a little strange | 14:56 |
| *** jrist has quit IRC | 14:56 | |
| lbragstad | breton and we have this https://github.com/openstack/keystone/blob/169e66ab8800148c4052a46d2cb321af33e44f77/keystone/auth/controllers.py#L651-L660 which allows for group and direct role assignments to work for federated users | 14:57 |
| *** markvoelker has joined #openstack-keystone | 14:57 | |
| breton | lbragstad: cool, thank you | 14:59 |
| lbragstad | breton no problem | 15:00 |
| *** spotz_zzz is now known as spotz | 15:04 | |
| *** antwash_ has joined #openstack-keystone | 15:04 | |
| *** antwash_ has quit IRC | 15:04 | |
| *** antwash_ has joined #openstack-keystone | 15:05 | |
| *** antwash_ has quit IRC | 15:05 | |
| *** phalmos has joined #openstack-keystone | 15:08 | |
| *** jrist has joined #openstack-keystone | 15:09 | |
| *** spzala has joined #openstack-keystone | 15:11 | |
| *** lamt has joined #openstack-keystone | 15:11 | |
| knikolla | o/ morning | 15:15 |
| *** jaugustine has joined #openstack-keystone | 15:15 | |
| *** lamt has quit IRC | 15:21 | |
| rderose | morgan stevemar dstanek: we'll need to update the documentation for the new options attribute as it will now be returned in the user response object | 15:24 |
| lbragstad | rderose wasn't extras returned in the user response? | 15:28 |
| rderose | lbragstad: I don't think so: http://developer.openstack.org/api-ref/identity/v3/index.html?expanded=show-user-details-detail | 15:29 |
| rderose | lbragstad: I'm not sure we're trying to deprecate extras | 15:30 |
| rderose | *if | 15:30 |
| *** jaosorior has joined #openstack-keystone | 15:31 | |
| lbragstad | rderose testing it | 15:34 |
| dstanek | lbragstad: rderose: extras should appear in the entities returned | 15:34 |
| *** phalmos has quit IRC | 15:34 | |
| dstanek | lbragstad: rderose: you don't see an 'extras' object though | 15:35 |
| lbragstad | dstanek right - the properties are just mapped to attributes of the user | 15:36 |
| dstanek | lbragstad: yep - http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/sql/core.py#n138 | 15:36 |
| *** stevemar has quit IRC | 15:36 | |
| *** stevemar has joined #openstack-keystone | 15:37 | |
| lbragstad | dstanek rderose http://cdn.pasteraw.com/bvd09d03hljr33xornvm8376jhrhxya | 15:38 |
| lbragstad | so morgan's work should be transparent from an API perspective | 15:38 |
| lbragstad | (I didn't test morgan's change locally - that's just the behavior of extras an master) | 15:38 |
| dstanek | lbragstad: what work are you talking about? | 15:39 |
| lbragstad | dstanek the options work | 15:39 |
| dstanek | options: | 15:39 |
| lbragstad | yeah | 15:39 |
| *** catintheroof has joined #openstack-keystone | 15:39 | |
| dstanek | that will change the entities returned to have an options object embeded | 15:39 |
| lbragstad | ah - really? | 15:39 |
| dstanek | yep | 15:42 |
| *** catinthe_ has quit IRC | 15:42 | |
| lbragstad | dstanek testing locally | 15:44 |
| samueldmq | lbragstad: dstanek: I thought options would go in {user:{options:[passwd_expires_at:null]}} | 15:44 |
| samueldmq | rather than {user:{passwd_expires_at:null}} | 15:44 |
| samueldmq | lbragstad: as per your paste above | 15:44 |
| dstanek | samueldmq: yes, that's where they go | 15:45 |
| lbragstad | dstanek http://cdn.pasteraw.com/f2p02sqn6x6btu3bwn8t384v7bwdsql | 15:45 |
| stevemar | breton: so, you think theres no need for the patch? except to add the test? | 15:45 |
| lbragstad | weird - stuff didn't migrated to options | 15:45 |
| lbragstad | er... `stuff` didn't get migrated to `extras` | 15:45 |
| dstanek | lbragstad: what are you expecting to be migrated? | 15:46 |
| lbragstad | i created a user with `stuff` as an extra property | 15:46 |
| lbragstad | but when I list that user - it doesn't go into `options` | 15:47 |
| samueldmq | it shouldn't, that's not an option | 15:47 |
| samueldmq | that's just extra stuff, correct ? | 15:47 |
| *** openstackgerrit has quit IRC | 15:48 | |
| dstanek | options are new. they are predefined and validated like any part of the normal entities. extras an unstructured and unvalidated data | 15:48 |
| dstanek | you can't use an option that isn't defined | 15:48 |
| stevemar | dstanek: yep | 15:52 |
| lbragstad | dstanek ah - so we will need to document that | 15:52 |
| lbragstad | i misunderstood that | 15:53 |
| lbragstad | and options are things that we can define in cod e | 15:53 |
| dstanek | lbragstad: i think morgan was going to add docs, but i'd be happy to if he is busy. | 15:53 |
| lbragstad | in order to make them validated | 15:53 |
| lbragstad | (instead of through configuration or something like that) | 15:53 |
| lbragstad | i'd be up for reviewing it since I've played with it locally now | 15:53 |
| dstanek | i sorta started with a blog post, but i could just finish that as keystone docs instead of a post | 15:53 |
| lbragstad | dstanek a blog post on detailing the reason why we want to move towards options would be useful :) | 15:54 |
| *** spilla has joined #openstack-keystone | 15:55 | |
| dstanek | lbragstad: it would be better in the docs. detailing design decisions on third party sites isn't great | 15:55 |
| lbragstad | as an operator I see options and think "cool, yet another key value store!" | 15:55 |
| *** mvk has quit IRC | 15:55 | |
| dstanek | lbragstad: you wouldn't see that as an operator. you'd see the docs that say use xyz key to do abc operation | 15:56 |
| lbragstad | dstanek true | 15:56 |
| dstanek | no different than defining user.username as a char(64) | 15:56 |
| stevemar | dstanek: the dev guide would be a great place for them | 15:56 |
| dstanek | stevemar: yep, exactly | 15:57 |
| *** ravelar has joined #openstack-keystone | 15:57 | |
| *** ravelar has quit IRC | 15:58 | |
| breton | stevemar: there is a need to the patch, i am just trying to rewrite it | 16:00 |
| *** egonzalez has quit IRC | 16:00 | |
| breton | stevemar: rderose raised a good question about change of policy | 16:00 |
| stevemar | breton: yeah, excellent point there | 16:03 |
| *** ravelar has joined #openstack-keystone | 16:03 | |
| *** openstackgerrit has joined #openstack-keystone | 16:03 | |
| openstackgerrit | Travis Truman (automagically) proposed openstack/keystone: Deprecate the AdminTokenAuthMiddleware https://review.openstack.org/305287 | 16:03 |
| *** ChanServ sets mode: +o stevemar | 16:03 | |
| breton | i mean, maybe we can still live with that | 16:04 |
| breton | but if it can be fixed, i should probably do it | 16:04 |
| breton | ok, another question | 16:07 |
| breton | can i create a trust for project p1 with a token scoped to p2? | 16:08 |
| *** jrist has quit IRC | 16:10 | |
| breton | looks like i can. | 16:11 |
| morgan | breton: that is a big | 16:14 |
| morgan | bug* | 16:14 |
| morgan | I think. let me check. it might let you create trusts for any project you can scope to. | 16:14 |
| *** richm has joined #openstack-keystone | 16:15 | |
| morgan | lbragstad: options on are used if defined. extra data stays in extra. also you have to specify the options in user[options] based on rderose and dstanek feedback on the first patch. | 16:15 |
| morgan | impl | 16:15 |
| *** egonzalez has joined #openstack-keystone | 16:17 | |
| knikolla | breton, morgan: https://github.com/openstack/keystone/blob/master/keystone/trust/controllers.py#L167 | 16:17 |
| knikolla | you can create a trust if you have a role | 16:18 |
| knikolla | don't have to be scoped to that project | 16:18 |
| breton | yep | 16:19 |
| breton | and i don't think we can fix it. | 16:19 |
| *** jrist has joined #openstack-keystone | 16:21 | |
| lbragstad | morgan ah | 16:24 |
| lbragstad | morgan you mentioned earlier (within the last couple days) something about default_project_id | 16:25 |
| lbragstad | morgan and there was something we could do with it based on options | 16:25 |
| lbragstad | morgan what was that? | 16:25 |
| lbragstad | cc dstanek ^ | 16:26 |
| knikolla | there's a db upgrade question on the mailing list | 16:26 |
| knikolla | lbragstad, rderose ^^ | 16:27 |
| lbragstad | knikolla I just saw that | 16:27 |
| dstanek | stevemar: breton: has https://review.openstack.org/#/c/415545/3 been discussed already? | 16:33 |
| Adobeman | umm so I try to create a group in ldap call "enabled_emulation_dn", its still rejecting my login into horizon.. | 16:35 |
| Adobeman | keystone log still says my user is disabled | 16:35 |
| *** gitudaniel has quit IRC | 16:36 | |
| Adobeman | anyone here done keystone/horizon with openldap ? | 16:36 |
| Adobeman | <- pulling hair here :x | 16:36 |
| *** phalmos has joined #openstack-keystone | 16:38 | |
| dstanek | Adobeman: can you turn off user emulation to test that is works without it? | 16:39 |
| Adobeman | ok, let me try | 16:40 |
| dstanek | Adobeman: you may have to debug that code and see what data it gets right before it raises that error | 16:41 |
| Adobeman | so its now set to false | 16:41 |
| Adobeman | debug.. set to 4.. | 16:41 |
| Adobeman | wait umm | 16:42 |
| Adobeman | debug under idenity? | 16:42 |
| Adobeman | or ldap | 16:42 |
| dstanek | debug keystone | 16:43 |
| Adobeman | ok, under [DEFAULT].. I'm setting debug = true | 16:45 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Enable trusts for federated users https://review.openstack.org/415545 | 16:45 |
| dstanek | Adobeman: no i mean go into the code with a debugger to see what is happening exactly | 16:46 |
| breton | dstanek: i agree with your -2. Please raise it for the new patchset. | 16:46 |
| knikolla | breton: -2 stick with newer patchsets | 16:46 |
| breton | knikolla: yep. And that is why i am asking to remove it :) | 16:46 |
| Adobeman | dstanek: turning emulation off give me this error "You are not authorized for any projects or domains" | 16:46 |
| dstanek | Adobeman: or dramatically add more logging to get anything missing | 16:46 |
| Adobeman | actualllly I debug = true spit out a lot more crap.. | 16:47 |
| dstanek | breton: looking | 16:47 |
| Adobeman | well, not crap. but data.. I'm seeing that error all over the places | 16:47 |
| knikolla | breton: right. python has made me associate the word 'raise' with bad things. | 16:47 |
| dstanek | breton: it appears that group membership is ephemeral again in that patch. am i correct? | 16:49 |
| breton | dstanek: yes | 16:50 |
| dstanek | breton: nice. lifting the -2 | 16:50 |
| breton | hm, i think i broke it right before uploading. | 16:51 |
| *** adrian_otto has joined #openstack-keystone | 16:52 | |
| dstanek | breton: k, then i'll wait before reviewing | 16:52 |
| dstanek | breton: did you already have that change in the works or did you whip it up after my -2? | 16:53 |
| *** lamt has joined #openstack-keystone | 16:53 | |
| *** jperry has quit IRC | 16:55 | |
| *** tesseract has quit IRC | 16:55 | |
| breton | dstanek: already had in the workds | 16:56 |
| morgan | lbragstad: i was looking at default_project_id moving into options in the initial iteration | 16:56 |
| morgan | lbragstad: but with things in 'options' key, not as easy | 16:56 |
| dstanek | morgan: any reason to do that? seem like more trouble than it's worth | 16:57 |
| morgan | lbragstad: we'd need to include a little magic for it. the big next steps are: filtering/indexing on options, and options settable by users (policy check on individual options) | 16:57 |
| lbragstad | morgan was there an issue with default_project_id before? | 16:57 |
| morgan | dstanek: if it wasn't in [options] it made sense | 16:57 |
| *** spzala has quit IRC | 16:57 | |
| dstanek | https://review.openstack.org/#/c/422234/3 could use a little review love :-) | 16:58 |
| morgan | dstanek: because default_project_id really is a special user-option thing that never should have been in keystone. it was a short-cut that was leaned on and then we were stuck with it because people relied on the behavior | 16:58 |
| morgan | dstanek: but as options are not top-level now... no reason | 16:58 |
| morgan | to move default_project | 16:58 |
| morgan | lbragstad: what did you mean by the question: "where is the option key handled"? | 16:59 |
| dstanek | morgan: he was wondering if you were going to move it from extras to options | 17:00 |
| morgan | ah no. | 17:00 |
| dstanek | morgan: then we're on the same page! | 17:00 |
| *** spzala has joined #openstack-keystone | 17:01 | |
| *** MasterOfBugs has quit IRC | 17:01 | |
| *** pramodrj07 has quit IRC | 17:01 | |
| *** PramodJ has joined #openstack-keystone | 17:01 | |
| *** MasterOfBugs has joined #openstack-keystone | 17:01 | |
| lbragstad | so default_project_id will not move | 17:01 |
| *** tqtran has joined #openstack-keystone | 17:04 | |
| *** spzala has quit IRC | 17:05 | |
| morgan | lbragstad: at this point no. | 17:11 |
| morgan | lbragstad: it doesn't make sense to (also default_project is a top-level column, which is why i considered moving it) | 17:11 |
| lbragstad | morgan ok - i remember you saying something about default_project_id but I was having trouble making the connection this morning | 17:12 |
| lbragstad | morgan but moving forward - all user meta things "like" default_project_id will be considered and implemented as options, right? | 17:12 |
| openstackgerrit | Ken Johnston proposed openstack/keystone: Readability enhancements to architecture doc https://review.openstack.org/422375 | 17:14 |
| lbragstad | egonzalez o/ | 17:16 |
| lbragstad | egonzalez about http://lists.openstack.org/pipermail/openstack-dev/2017-January/111052.html - what was the process you followed again? | 17:17 |
| egonzalez | Hi guys, i'm preparing zero-downtime upgrade method for kolla, at this moment i'm stuck with the following error "Field 'domain_id' doesn't have a default value" | 17:17 |
| lbragstad | cc knikolla rderose ^ | 17:17 |
| *** diazjf has joined #openstack-keystone | 17:17 | |
| egonzalez | upgrade from Newton to master | 17:17 |
| lbragstad | egonzalez and you can confirm that each of the migration repositories are at the right version | 17:17 |
| lbragstad | (expand, migrate, contract) | 17:18 |
| egonzalez | process: stop first keystone service, -> then expand, migrate, contract -> restart service | 17:18 |
| lbragstad | egonzalez aha | 17:19 |
| egonzalez | lbragstad: how can I check migration repositories? | 17:19 |
| lbragstad | egonzalez http://cdn.pasteraw.com/tjcg94fuyoous7zrezcrvkqazxds86s | 17:19 |
| dstanek | egonzalez: you get that error during the migration step right? | 17:20 |
| lbragstad | egonzalez I want to document your process here - https://etherpad.openstack.org/p/keystone-newton-master-upgrade-issue | 17:20 |
| dstanek | or maybe during the contract? | 17:20 |
| egonzalez | http://paste.openstack.org/show/596620/ | 17:20 |
| egonzalez | no error during upgrade, after upgrade cannot create users, but other commands work | 17:21 |
| dstanek | egonzalez: so that means that the new code isn't adding the domain_id. after contract are you still running old instances? | 17:22 |
| lbragstad | egonzalez so after you run the contract - do you have newton and master code running at the same time/ | 17:22 |
| lbragstad | egonzalez before you run the contract - all code should be at master | 17:22 |
| dstanek | lbragstad: i hope not. after migration all the code much be updated before running contract | 17:22 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP create_user https://review.openstack.org/425797 | 17:23 |
| morgan | stevemar, lbragstad: we'll be gating (blocking) on v3-only in Pike right? | 17:24 |
| morgan | vs. non-vote | 17:24 |
| *** lamt has quit IRC | 17:27 | |
| egonzalez | lbragstad: found the issue, sorry for making loose your time. When replacing containers, by an error in my code old container was restarted instead of replaced with the new | 17:27 |
| lbragstad | egonzalez ahh - that would do it | 17:27 |
| lbragstad | egonzalez no worries - does that make sense? | 17:27 |
| dstanek | egonzalez: glad it was somethign easy | 17:27 |
| lbragstad | (the switch update between --migrate and --contract?) | 17:28 |
| *** lamt has joined #openstack-keystone | 17:28 | |
| egonzalez | yep, makes sense, thanks | 17:28 |
| lbragstad | egonzalez awesome - let us know if you run into anything else. | 17:29 |
| egonzalez | i'll rework what I made, thanks a lot | 17:29 |
| morgan | lbragstad: btw, we have 81,450,625 possible option_ids with only printable ascii characters per resource type, as each resource type will have it's own options/registry | 17:29 |
| morgan | lbragstad: i think that is enough variation | 17:29 |
| morgan | lbragstad: a two-character string would have been 9025 options | 17:30 |
| lbragstad | morgan was there a reason for only having it at 4 chars though? | 17:30 |
| dstanek | famous last words | 17:30 |
| morgan | lbragstad: about the same size as a stored int | 17:30 |
| lbragstad | morgan database simplicity? | 17:30 |
| lbragstad | morgan versus having a varchar64 column defined? | 17:30 |
| morgan | lbragstad: usability for devs and db simiplicity | 17:31 |
| morgan | could habve gone int(32) but i like strings being more human readable | 17:31 |
| *** kencjohnston has joined #openstack-keystone | 17:32 | |
| kencjohnston | I feel like I've asked this here before, but does Keystone natively support or plan to support 2FA/MFA authentication or is that functionality provided only by backends (AD/LDAP)? | 17:33 |
| knikolla | morgan ^^ | 17:36 |
| lbragstad | kencjohnston yeah - morgan and andriant were working on implementing that in keystone | 17:39 |
| lbragstad | kencjohnston we were going to target it for ocata, but it was pushed to pike | 17:39 |
| kencjohnston | lbragstad: Natively, but it works today when AD or LDAP enable it? | 17:39 |
| lbragstad | kencjohnston yeah - if you hook something up to keystone that does MFA you can get it today | 17:40 |
| lbragstad | kencjohnston what morgan was working on was specifically native support | 17:40 |
| kencjohnston | lbragstad: Thanks! | 17:41 |
| dstanek | you could also do a custom auth plugin if you wanted to | 17:41 |
| lbragstad | kencjohnston another option is using federation (in which case the identity provider you use could enforce MFA) | 17:41 |
| *** egonzalez has left #openstack-keystone | 17:49 | |
| morgan | lbragstad: it will be rebased on the new options stuff very soon | 17:49 |
| *** jose-phillips has joined #openstack-keystone | 17:49 | |
| morgan | lbragstad: and get the api support needed | 17:49 |
| dstanek | morgan: what are we going to do about policy for editing those attributes? for now just let the {create,update}_entity policy handle it? | 17:54 |
| morgan | dstanek: the MFA stuff is going to get it's own API because validation requirements are higher | 17:55 |
| morgan | dstanek: but most options (in Pike) will get a policy checker that we can handle via policy.json | 17:55 |
| morgan | and i am thinking we open up .update_user to be more attribute aware | 17:55 |
| morgan | vs strictly admin-only | 17:55 |
| morgan | similar with most resource-types managed by keystone | 17:55 |
| morgan | smarter policy vs simple api level RBAC | 17:56 |
| morgan | dstanek: it's why this was built with code-specific objects | 17:56 |
| morgan | so the option object can have smarts on it | 17:57 |
| morgan | also in Pike options will provide (via a schema bit) smarts to dynamically build json schema validation in the options dict | 17:57 |
| morgan | so i see each option adopting a .schema, that then is compiled into a .property that is pulled into schema.py and built for the resources under options | 17:58 |
| dstanek | morgan: and for stuff getting in for this cycle the create/update policy will just apply right? | 17:58 |
| morgan | yep | 17:58 |
| morgan | except MFA if it land, which will get it's own api since it's auth-related | 17:59 |
| morgan | you can set it via update/create | 17:59 |
| *** david-lyle has quit IRC | 17:59 | |
| morgan | but it will get an end-user api like change_password | 17:59 |
| * morgan is debating requiring when setting new rules each of the methods "secrect" value, so if setting a totp rule and you don't have one, you must specify the secret for the TOTP rule | 18:00 | |
| morgan | or ... an auth-secret (not the key) | 18:00 |
| *** lamt has quit IRC | 18:02 | |
| *** diazjf has quit IRC | 18:08 | |
| *** spzala has joined #openstack-keystone | 18:15 | |
| *** spzala has quit IRC | 18:19 | |
| *** xek_ has joined #openstack-keystone | 18:22 | |
| *** xek has quit IRC | 18:22 | |
| *** stingaci has joined #openstack-keystone | 18:32 | |
| *** rcernin has joined #openstack-keystone | 18:32 | |
| stevemar | o/ | 18:35 |
| *** v1k0d3n has quit IRC | 18:35 | |
| *** lamt has joined #openstack-keystone | 18:37 | |
| *** lamt has quit IRC | 18:37 | |
| *** mvk has joined #openstack-keystone | 18:42 | |
| *** lamt has joined #openstack-keystone | 18:43 | |
| *** v1k0d3n has joined #openstack-keystone | 18:43 | |
| ayoung | SamYaple, OK, I think I am ready to try out your containers | 18:45 |
| SamYaple | ayoung: ohboi ohboi ohboi | 18:46 |
| ayoung | SamYaple, which is the right repo again? | 18:46 |
| SamYaple | ayoung: https://github.com/yaodu/docker-keystone/ | 18:46 |
| ayoung | Its not yaodu | 18:47 |
| ayoung | ah that is the top level name | 18:47 |
| ayoung | got it | 18:47 |
| SamYaple | readme.md | 18:47 |
| ayoung | I was looking at https://github.com/SamYaple/yaodu | 18:47 |
| SamYaple | yea samyaple/yaodu is an old thing i have decommed not removed | 18:47 |
| SamYaple | ayoung: and as an added fyi, you can apparently docker build pointed at a git repo. so thats what we recommend | 18:48 |
| ayoung | ? | 18:48 |
| SamYaple | ayoung: if you have plans to build these images with a patch or similiar, you dont have to git clone github.com/yaodu/docker-keystone | 18:49 |
| ayoung | docker build https://github.com/yaodu/docker-keystone.git --file dockerfiles/Dockerfile-centos --tag yaodu/keystone:latest | 18:49 |
| SamYaple | yea | 18:49 |
| SamYaple | i wasnt aware of that. but portdirect wrote the docs and showed me that | 18:50 |
| SamYaple | thought it was cool | 18:50 |
| *** spzala has joined #openstack-keystone | 18:50 | |
| ayoung | SamYaple, running now. I need to kuberfy it after and get it to run with a MySQL server. Any notes? | 18:51 |
| SamYaple | ayoung: thats where my time has been recently. kubernetes and helm | 18:52 |
| SamYaple | the container itself is fine (we have it working in opentsack-helm), but the otehr logic... well we are working through it too | 18:52 |
| *** spzala has quit IRC | 18:55 | |
| ayoung | SamYaple, short of that, how do you suggest I run it? | 18:57 |
| *** harlowja has quit IRC | 19:02 | |
| SamYaple | ayoung: bind in the appropriate apache.conf and /etc/keystone stuff. then launch with entrypoint+command "apache2 -DFOREGROUND" | 19:04 |
| ayoung | SamYaple, you don't have an example of that do you? | 19:04 |
| SamYaple | if you are using uwsgi, then uwsgi.conf and the uwsgi start command | 19:04 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to change password upon first use https://review.openstack.org/425507 | 19:04 |
| SamYaple | ayoung: in openstack-helm, yea. but its not a docker run commadn there. no | 19:04 |
| ayoung | link? | 19:05 |
| SamYaple | https://github.com/att-comdev/openstack-helm/tree/master/keystone | 19:05 |
| ayoung | TY | 19:05 |
| SamYaple | docker run -d -t -v <host>:/etc/keystone/ -v <host>:/etc/apache2/sites-enabled/000-default.conf yaodu/keystone apache2 -DFOREGROUND | 19:06 |
| *** spzala has joined #openstack-keystone | 19:06 | |
| SamYaple | thats how ive run it before (from memory) | 19:06 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds tests showing how mapping locals are handled https://review.openstack.org/418460 | 19:06 |
| SamYaple | for debian/ubuntu you need to source /etc/apache2/envvars. for uwsgi, just bind in the appropraite config and run uwsgi command appropriately | 19:07 |
| ayoung | SamYaple, OK so you -v in stuff from the local machine. I'm not running Ubuntu so the apache2 stuff is all different | 19:07 |
| ayoung | OK | 19:07 |
| SamYaple | no virtualenv, we removed that until we can prove issues without it | 19:08 |
| *** diazjf has joined #openstack-keystone | 19:15 | |
| *** browne has joined #openstack-keystone | 19:24 | |
| ayoung | SamYaple, why do so many of the Docker Files put a shell script in place of just calling the executable? | 19:26 |
| lbragstad | morgan rderose do https://review.openstack.org/#/c/424220/ and https://review.openstack.org/#/c/423909/ still need to get rebased on top of https://review.openstack.org/#/c/424334/ (or are we just waiting until https://review.openstack.org/#/c/424334/ merges)? | 19:27 |
| rderose | lbragstad: I don't believe the deprecation patches have to merge for ocata | 19:28 |
| rderose | lbragstad: but those patches do need to be rebased on top of the new 'options' patch | 19:29 |
| morgan | lbragstad: i will be adding those as a rebase shortly | 19:29 |
| morgan | but they can wait to land. (deprecations) i'd like them to land in ocata | 19:29 |
| lbragstad | rderose morgan cool - just double checking | 19:29 |
| morgan | but i don't need them to | 19:30 |
| lbragstad | rderose morgan 2 cycle deprecation process for configuration options? | 19:30 |
| SamYaple | ayoung: set up other permissions or otherwise make it more usable | 19:30 |
| morgan | that's the plan here | 19:30 |
| morgan | for sure | 19:31 |
| lbragstad | morgan ok | 19:31 |
| morgan | at least 2 cycles | 19:31 |
| SamYaple | ayoung: rather than bake every config and permission and folder imaginable into the image, its more like a binary where yo uneed to set the configs up later | 19:31 |
| ayoung | SamYaple, OK...think I am going to use yours as a template, but run my own, using RPMs and hard coding in the HTTP setup | 19:31 |
| ayoung | SamYaple, I'll share when I get it working, and we can discuss further | 19:31 |
| SamYaple | ok | 19:31 |
| ayoung | I need to figure out the k8s stuff | 19:31 |
| ayoung | SamYaple, I'm less worried about the rest, cuz I kind of think you have it figured out.... | 19:32 |
| SamYaple | the openstack-helm is not _my_ stuff. im working with those guys while i figure out k8s as well | 19:32 |
| lbragstad | morgan rderose implementation question but when we add the ignore_password_lockout column, are we adding it to the local_user table or the options table? | 19:32 |
| rderose | lbragstad: options | 19:32 |
| lbragstad | ok | 19:32 |
| rderose | lbragstad: it won't be a new column though | 19:33 |
| lbragstad | rderose I was reading your comment here https://review.openstack.org/#/c/424220/1/keystone/common/sql/expand_repo/versions/016_expand_lockout_ignore.py | 19:33 |
| lbragstad | rderose ah - right | 19:33 |
| lbragstad | rderose it will be added as a registered option | 19:33 |
| rderose | right | 19:33 |
| lbragstad | then the migration will go through and it can pull the existing user ids from config and persist them, right? | 19:33 |
| rderose | yeah, exactly | 19:34 |
| lbragstad | aha | 19:34 |
| lbragstad | so if a deployment upgrades to ocata (if these deprecation patches land in ocata), and they are using the ignore_password_lockout stuff - they will automatically be using the options work - even if they haven't updated their configs to remove the deprecated configuration option | 19:35 |
| rderose | yep | 19:36 |
| rderose | well... | 19:36 |
| *** adrian_otto has quit IRC | 19:36 | |
| lbragstad | ok - then we change the PCI implementation to always pull the information from options and it ignores the ignore_password_lockout list of ids? | 19:36 |
| rderose | lbragstad: I'll have to look at the patch again, but I think it will check both | 19:36 |
| rderose | lbragstad: until actually removed from the config | 19:37 |
| ayoung | morgan, did I ever tell you that you were right about Signed requests and wrong to not push for it? | 19:37 |
| * lbragstad is wondering what happens when the configuration list gets out of sync with the options | 19:37 | |
| rderose | lbragstad: deprecated in ocata, so they shouldn't be adding to it | 19:37 |
| morgan | ayoung: heh | 19:37 |
| morgan | ayoung: i tried. | 19:37 |
| morgan | ayoung: i got shot down over and over and over and over | 19:37 |
| ayoung | morgan, I just couldn't see how to make it work for Horizon. I can now. | 19:38 |
| morgan | :) | 19:38 |
| morgan | we could still do it... | 19:38 |
| morgan | i have a backlog thing to split auth up somewhat... and we can control how ksm works.... | 19:38 |
| ayoung | ++ | 19:38 |
| ayoung | Be a good summer internship project | 19:39 |
| morgan | yah | 19:39 |
| morgan | once we split auth up | 19:39 |
| morgan | that is not a good internship thing | 19:39 |
| morgan | it's gonna be a PITA | 19:39 |
| morgan | the signed requests bit, for sure :) | 19:39 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP create_user https://review.openstack.org/425797 | 19:39 |
| morgan | http://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/decouple-auth-from-api-version.html | 19:39 |
| morgan | if we do that, it opens a lot of doors to make auth better | 19:40 |
| lbragstad | rderose is patch set 4 still waiting on some things here? https://review.openstack.org/#/c/425507/4 | 19:40 |
| morgan | because i never want to change how auth works in v3 (fundamentally) due to ... well ick | 19:40 |
| rderose | lbragstad: it's pretty much ready, just working on adding schema validation | 19:41 |
| morgan | ayoung: anyway ;) | 19:41 |
| lbragstad | rderose cool - i'll pick up that review next | 19:41 |
| rderose | lbragstad: for some reason, I can't get our validation tests to fail :) | 19:41 |
| morgan | ayoung: i have had a few things i was "right about" long after the fact ;). and some thing we landed I was wrong about | 19:41 |
| morgan | ugh my coffee is ... cold | 19:42 |
| lbragstad | rderose uh oh | 19:42 |
| stevemar | morgan: :( | 19:42 |
| rderose | lbragstad: http://paste.openstack.org/show/596642/ | 19:42 |
| morgan | rderose: heh | 19:42 |
| rderose | lbragstad: and this succeeds: http://paste.openstack.org/show/596643/ | 19:42 |
| morgan | rderose: hmm. | 19:43 |
| stevemar | rderose: morgan lbragstad we have 1 week left before rc is tagged | 19:43 |
| morgan | uh | 19:43 |
| morgan | rderose: don't you need to use the string value? | 19:43 |
| morgan | or is parameter_type.boolean the same as saying.. "boolean" | 19:44 |
| morgan | oh huh | 19:44 |
| morgan | options type: 'object' ? | 19:44 |
| morgan | as well needed? | 19:44 |
| rderose | morgan: if I pass boolean to the option value, I think it casts correctly | 19:44 |
| *** david-lyle has joined #openstack-keystone | 19:45 | |
| rderose | morgan: thinking I can enforce boolean at the API request | 19:45 |
| rderose | morgan: not worry about string values | 19:45 |
| morgan | well you can enforce it on the save in the option atm | 19:45 |
| morgan | with a validator func. but i would rather it all be in schema | 19:45 |
| rderose | morgan: would like to do both | 19:45 |
| morgan | ++ | 19:46 |
| morgan | i'll work on some dynamic schema reference stuff next... but probably for pike | 19:46 |
| morgan | the options are limited enough for now to do each in schema.py | 19:46 |
| morgan | oooh | 19:46 |
| morgan | i wonder. | 19:46 |
| * morgan checks something | 19:47 | |
| morgan | i wonder if json schema is doing bool('string') | 19:47 |
| morgan | to validate. | 19:47 |
| morgan | since 'whatever' is infact "true" in python | 19:47 |
| morgan | if you cast to bool | 19:48 |
| rderose | hmm... lbragstad? ^ | 19:48 |
| rderose | do you know | 19:48 |
| *** MasterOfBugs has quit IRC | 19:49 | |
| *** PramodJ has quit IRC | 19:49 | |
| lbragstad | rderose let me check - i know i've worked on those tests before | 19:52 |
| *** stingaci has quit IRC | 19:56 | |
| stevemar | morgan: rderose are either of you working on the "Deprecate `ignore_password_*` conf option" patches? | 19:56 |
| stevemar | morgan: i assume you are busy rebasing the MFA stuff? | 19:56 |
| stevemar | and rderose is still busy with PCI stuff? | 19:56 |
| *** diazjf has quit IRC | 19:56 | |
| rderose | stevemar: yeah, trying to finish up PCI | 19:57 |
| rderose | stevemar: I could help with deprecate stuff after | 19:57 |
| *** markvoelker has quit IRC | 20:00 | |
| *** Guest33539 is now known as mgagne | 20:01 | |
| *** mgagne has quit IRC | 20:01 | |
| *** mgagne has joined #openstack-keystone | 20:01 | |
| morgan | stevemar: yeah i'm going to hit those shortly | 20:08 |
| morgan | stevemar: was doing some other stuff that needed eyes immediately | 20:08 |
| *** diazjf has joined #openstack-keystone | 20:09 | |
| *** harlowja has joined #openstack-keystone | 20:09 | |
| *** diazjf has quit IRC | 20:11 | |
| *** stingaci has joined #openstack-keystone | 20:11 | |
| lbragstad | are we not having a keystone+horizon meeting today? | 20:11 |
| dstanek | morgan: i hope it's not just booling | 20:14 |
| rderose | lbragstad: looks like I just needed to set the type as object: http://paste.openstack.org/show/596644/ | 20:14 |
| *** diazjf has joined #openstack-keystone | 20:14 | |
| rderose | morgan: 'True' fails: 'options/ignore_password_expiry': 'True' is not one of [True, False] | 20:14 |
| rderose | morgan: so not casting | 20:14 |
| ayoung | SamYaple, why all the && instead of new RUN lines? | 20:15 |
| SamYaple | ayoung: new docker directives (RUN ADD COPY ENV) create new layers | 20:15 |
| ayoung | SamYaple, isn't that a good thing? | 20:15 |
| SamYaple | new layers don't "squash". so the image size bloats up up and up | 20:15 |
| SamYaple | no | 20:15 |
| SamYaple | it really isnt | 20:15 |
| *** stingaci has quit IRC | 20:16 | |
| ayoung | but changed versions build faster, because they checksum, right? | 20:16 |
| SamYaple | without the && (which is recommened way to do things by Docker) the image size would be ~700MB, not 80MB | 20:16 |
| ayoung | Ah | 20:16 |
| ayoung | minor point...but worth mentioning. | 20:17 |
| SamYaple | the docker build cache can be used. when it works properly if you dont use && | 20:17 |
| SamYaple | but the size and speed of build make it impracticle to use RUN instead of && | 20:17 |
| SamYaple | its been an ongoing fight for many years in Docker in general | 20:17 |
| dstanek | morgan: do you need any help rebasing any of that stuff? | 20:19 |
| morgan | dstanek: nah, i can hack it, it's pretty easy stuff. | 20:22 |
| morgan | dstanek: i just need to sit down and do it | 20:22 |
| dstanek | :-) | 20:26 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to change password upon first use https://review.openstack.org/425507 | 20:30 |
| stevemar | lbragstad: i think both us and horizon are swamped with ocata-3 | 20:30 |
| stevemar | rderose: so question about the force reset | 20:31 |
| rderose | yeah | 20:32 |
| stevemar | rderose: hows the workflow gonna look like... | 20:33 |
| *** pnavarro has quit IRC | 20:33 | |
| stevemar | rderose: the config option is set to false by default, and all users are opted out of resetting password | 20:34 |
| stevemar | i guess you will update users that you want to ignore, and then "flip the switch" (set the config option to true) in a maintenance window? | 20:34 |
| rderose | yeah, exactly | 20:34 |
| rderose | maintenance window because of the config change? | 20:35 |
| dstanek | rderose: yep | 20:35 |
| rderose | then yeah | 20:35 |
| dstanek | rderose: is that still in wip or is it ready for review? | 20:37 |
| rderose | ready | 20:37 |
| rderose | dstanek: I think I want to reword the config option, but I may just do that in the doc patch | 20:37 |
| rderose | got for it | 20:37 |
| dstanek | rderose: perfect, on it | 20:38 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds tests showing how mapping locals are handled https://review.openstack.org/418460 | 20:42 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP create_user https://review.openstack.org/425797 | 20:43 |
| *** diazjf has quit IRC | 20:43 | |
| rderose | stevemar re: https://bugs.launchpad.net/keystone/+bug/1291157 | 20:45 |
| openstack | Launchpad bug 1291157 in OpenStack Identity (keystone) "idp deletion should trigger token revocation" [Medium,Confirmed] - Assigned to Anthony Washington (anthony-washington) | 20:45 |
| stevemar | rderose: i have no idea about that one :D | 20:45 |
| rderose | stevemar: if the idp is deleted, the users would be deleted, so tokens would be invalid, right? | 20:45 |
| rderose | :) | 20:45 |
| stevemar | rderose: oh yeah, i guess rodrigods made that one invalid | 20:46 |
| rodrigods | good side effect :) | 20:46 |
| rderose | :) | 20:47 |
| rodrigods | about to submit around 10 patches to tempest | 20:48 |
| rodrigods | i wish we had keystoners cores there :( | 20:48 |
| stevemar | rodrigods: yowza! | 20:49 |
| rodrigods | stevemar, tests for reseller, implied roles and domain specific roles | 20:50 |
| morgan | dstanek: almost done rebasing the change on mine and rderose's patches | 20:51 |
| morgan | dstanek: you'll like how much smaller the change is (cc rderose ) | 20:51 |
| morgan | the first one (password_expiry) | 20:51 |
| dstanek | morgan: ++ | 20:52 |
| rderose | stevemar rodrigods: it's still a bug (maybe) rodrigods patch cascades based on the protocol deletion; not idp (looking...) | 20:53 |
| rodrigods | rderose, deletion of either idp or protocol should delete the user | 20:53 |
| rodrigods | due the composite key | 20:53 |
| rderose | rodrigods: ah | 20:53 |
| rderose | rodrigods: just thought protocol could be used for several IdPs | 20:54 |
| rderose | rodrigods: but I see, it's a composite fk | 20:54 |
| rderose | got it | 20:54 |
| rodrigods | yeah | 20:54 |
| morgan | hmmmmmmmm. | 20:56 |
| *** gema has joined #openstack-keystone | 20:56 | |
| *** stingaci has joined #openstack-keystone | 20:58 | |
| Adobeman | sorry... | 21:00 |
| Adobeman | went away... | 21:00 |
| Adobeman | http://pastebin.com/TDqb7qhu <- logs from keystone.. | 21:00 |
| Adobeman | looks like I donot have role..? | 21:00 |
| Adobeman | I dont know how I can modify roles when I cant even login to ostack | 21:01 |
| Adobeman | with ldap turn on | 21:01 |
| Adobeman | disable ldap (use sql) will allow me to login as admin | 21:01 |
| *** raildo has quit IRC | 21:01 | |
| *** stingaci has quit IRC | 21:02 | |
| dstanek | rderose: is your patch still allowing an authentication and now forcing a reset on first auth? | 21:02 |
| Adobeman | user testuser have no oaccess to _populate_roles | 21:03 |
| rderose | yeah, it is | 21:03 |
| rderose | as opposed to just setting it to expired for update and create | 21:03 |
| morgan | ooh found a bug in the resource options code. | 21:03 |
| rderose | morgan: oh know | 21:03 |
| morgan | rderose: ^ create isn't assigning the resource options | 21:03 |
| morgan | but update does. | 21:03 |
| morgan | *blink* i'll get it fixed. | 21:03 |
| rderose | morgan: cool | 21:04 |
| *** jperry has joined #openstack-keystone | 21:04 | |
| morgan | not looking at the schema stuff atm | 21:04 |
| morgan | rderose: was that the bug you were running into (the create one?) | 21:04 |
| rderose | morgan: no | 21:04 |
| morgan | the schema bits | 21:04 |
| morgan | though | 21:04 |
| *** spzala has quit IRC | 21:04 | |
| morgan | anything else ? | 21:04 |
| Adobeman | anyone have any input? | 21:05 |
| rderose | morgan: hmm... I'm only setting the value with update | 21:05 |
| morgan | right i'm tyring to do a test with create | 21:05 |
| morgan | and it's failing | 21:05 |
| dstanek | Adobeman: have you found out why the user is disabled? | 21:06 |
| *** diazjf has joined #openstack-keystone | 21:07 | |
| Adobeman | its not disabled | 21:07 |
| Adobeman | I dont know why keystone think its disabled | 21:07 |
| Adobeman | I can use ldap+linux ssh its fine | 21:08 |
| dstanek | Adobeman: i think you need to dig in there and see why keystone thinks that | 21:08 |
| Adobeman | well, disable only show up when I enable emualtion... | 21:09 |
| Adobeman | disable emulation just says I dont have access.. | 21:09 |
| dstanek | Adobeman: the key is to figure out why so you'll know what needs to change | 21:10 |
| morgan | rderose: oh... because you are bypassing identity_api.create_user *and* the sql driver create_user. | 21:12 |
| morgan | and the logic is needed from sql driver to work | 21:12 |
| morgan | i shall fix this | 21:12 |
| rderose | morgan: bypassing? I'm creating the user and then calling identity_api.update_user | 21:12 |
| rderose | to update the options | 21:13 |
| rderose | it's using the sql driver | 21:13 |
| lbragstad | rderose you were having issues with these bits? https://review.openstack.org/#/c/425507/5/keystone/identity/schema.py,unified | 21:13 |
| rderose | morgan: nevermind, i think i understand what you are saying | 21:14 |
| rderose | lbragstad: it's working now | 21:14 |
| rderose | missed the "type": object | 21:14 |
| lbragstad | rderose patch set 5 is working? | 21:14 |
| rderose | yeah | 21:14 |
| lbragstad | ahhh - sure | 21:14 |
| * lbragstad goes back to reviewing | 21:14 | |
| *** stingaci has joined #openstack-keystone | 21:16 | |
| *** ravelar has quit IRC | 21:18 | |
| *** edmondsw_ has joined #openstack-keystone | 21:18 | |
| *** edmondsw_ has quit IRC | 21:18 | |
| morgan | rderose: hehe :) | 21:19 |
| morgan | rderose: i think have this fixed. | 21:19 |
| rderose | morgan: cool | 21:19 |
| rderose | morgan: I'll rebase | 21:19 |
| dstanek | rderose: what are the chances of getting that patch to not allow a login with the admin generated password? | 21:20 |
| morgan | rderose: my change goes on top of your PCI-DSS thing | 21:20 |
| rderose | morgan: ah, okay | 21:20 |
| rderose | dstanek: would be an easy change | 21:20 |
| *** stingaci has quit IRC | 21:20 | |
| rderose | so basically create user with expired password? | 21:20 |
| morgan | yeah, i am fixing your test case | 21:20 |
| morgan | sec | 21:21 |
| dstanek | i think the current behavior is unexpected | 21:21 |
| morgan | https://www.irccloud.com/pastebin/4igiqvis/ | 21:21 |
| morgan | rderose: ^ | 21:21 |
| rderose | dstanek: originally, first use should allow first auth | 21:21 |
| morgan | instead of calling the specific user-add logic in _create_user | 21:21 |
| dstanek | rderose: what do you mean? | 21:22 |
| dstanek | i've not seen anything do that before | 21:22 |
| *** gema has quit IRC | 21:22 | |
| morgan | rderose: with self-service password change that doesn't require a token | 21:22 |
| morgan | it would be possible to not need a real login (token) | 21:23 |
| morgan | the first time | 21:23 |
| morgan | it could simply be "nope - change the password" | 21:23 |
| rderose | dstanek: my thought was you should be able to use the password at least once to change it | 21:23 |
| morgan | you already need the password to use self-service pw change | 21:23 |
| morgan | soooo | 21:23 |
| dstanek | rderose: like morgan said that's been fixed already | 21:23 |
| rderose | dstanek: but I see your point, especially now that this has been changed | 21:23 |
| rderose | where you don't need a token | 21:23 |
| morgan | yep | 21:24 |
| rderose | dstanek: will change this in the next patch | 21:24 |
| rderose | expired on create and update | 21:24 |
| dstanek | then you can do most of the work when setting the password | 21:24 |
| *** Jack_V has quit IRC | 21:24 | |
| rderose | dstanek: right and I'll save on having to do an extra db write | 21:24 |
| rderose | give me a few | 21:25 |
| rderose | lbragstad: another PCI patch coming :) | 21:25 |
| dstanek | rderose: i had a few other comments in there too | 21:25 |
| lbragstad | rderose i'm still reviewing ps5 :) | 21:26 |
| rderose | dstanek: okay, I'll address it | 21:26 |
| rderose | lbragstad: okay, cool | 21:26 |
| rderose | *address them :) | 21:27 |
| *** diazjf has quit IRC | 21:27 | |
| *** gema has joined #openstack-keystone | 21:29 | |
| *** adrian_otto has joined #openstack-keystone | 21:34 | |
| *** ravelar has joined #openstack-keystone | 21:38 | |
| *** spzala has joined #openstack-keystone | 21:40 | |
| *** spzala has quit IRC | 21:40 | |
| *** spzala has joined #openstack-keystone | 21:40 | |
| *** spzala has quit IRC | 21:40 | |
| *** spzala has joined #openstack-keystone | 21:41 | |
| morgan | rderose: going to wait for your next patch, but i think i'm ready to go on this | 21:43 |
| morgan | i have a change for the identity.backends.resource_options that eliminates the list | 21:45 |
| *** spzala has quit IRC | 21:45 | |
| *** spzala has joined #openstack-keystone | 21:45 | |
| morgan | that i am adding after rderose's patch for PCI things | 21:45 |
| morgan | lbragstad, dstanek: ^ | 21:45 |
| lbragstad | morgan cool | 21:46 |
| *** catintheroof has quit IRC | 21:47 | |
| morgan | dstanek, lbragstad: lets let the use of _resource_option_mapper go through here. I'll add a followup that implements a .get_resource_option on the model | 21:48 |
| morgan | so we can avoid exposing the resource_option_mapper and we can make the "access private member" issue less of an icky feeling | 21:49 |
| morgan | rderose: ^ | 21:49 |
| morgan | i just don't want people setting the resource_option_mapper directly | 21:49 |
| morgan | it could lead to weirdness | 21:49 |
| morgan | and overwriting the options not intended | 21:49 |
| *** richm has quit IRC | 21:55 | |
| *** spzala has quit IRC | 21:55 | |
| *** spzala has joined #openstack-keystone | 21:56 | |
| lbragstad | morgan ok | 21:58 |
| rderose | morgan: sounds good | 22:00 |
| rderose | morgan: one question | 22:00 |
| *** spzala has quit IRC | 22:00 | |
| morgan | sure? | 22:01 |
| *** diazjf has joined #openstack-keystone | 22:01 | |
| rderose | morgan: why is the resource_options_registry defined in the User model again? | 22:01 |
| rderose | https://review.openstack.org/#/c/424334/8/keystone/identity/backends/sql_model.py | 22:01 |
| rderose | seems strange | 22:01 |
| rderose | morgan: if you have a 1000 items in the registry, we'll load all 1000 for every user? | 22:01 |
| *** stingaci has joined #openstack-keystone | 22:02 | |
| morgan | the registry is a constant just has a name in the model so you don't have to import identity.backends.resource_options if you're just inspecting the model (circular dependency issues) with say keystone.common.resource_options | 22:03 |
| rderose | morgan: well, I guess its a copy of the registry for every user | 22:03 |
| morgan | it isn't a copy | 22:03 |
| morgan | it's a class-level attribute | 22:03 |
| morgan | shared instance across all instances of User() | 22:03 |
| morgan | just like the column definitions are shared (they use magic to load the data) | 22:04 |
| morgan | but that is SQL-Alchemy | 22:04 |
| morgan | but the value is class-level, as it is populated at import time | 22:04 |
| morgan | erm, object | 22:04 |
| morgan | not value. | 22:04 |
| rderose | ah, gotcha | 22:04 |
| rderose | okay, thx | 22:04 |
| morgan | and each model will have it's own registry | 22:04 |
| morgan | since each model has it's own options table | 22:05 |
| rderose | each model? | 22:05 |
| morgan | Group is going to have GroupOptions | 22:05 |
| rderose | oh right, this could be used for other object types | 22:05 |
| rderose | gotcha | 22:05 |
| morgan | yep | 22:05 |
| morgan | it's generic template for making Group, Project, etc have resource options | 22:06 |
| *** stingaci has quit IRC | 22:06 | |
| rderose | okay, I get it now | 22:07 |
| rderose | morgan: thanks | 22:07 |
| *** Jack_V has joined #openstack-keystone | 22:07 | |
| morgan | lbragstad: i lied, %r doesn't show type | 22:07 |
| morgan | lbragstad: it does show things like strings in "" and Booleans not. etc | 22:07 |
| morgan | and custom classes show as: | 22:07 |
| morgan | '<__main__.Test object at 0x7f1039313190>' | 22:08 |
| morgan | unless say you define __repr__ method | 22:08 |
| morgan | huh. doe authenticate cache? | 22:08 |
| morgan | does* | 22:08 |
| *** Jack_V has quit IRC | 22:11 | |
| lbragstad | morgan huh - interesting | 22:12 |
| *** ravelar has quit IRC | 22:12 | |
| lbragstad | I use %r all the time in debugging but i didn't know if it did, or didn't print the type | 22:12 |
| *** chris_hultin is now known as chris_hultin|AWA | 22:12 | |
| *** diazjf has quit IRC | 22:14 | |
| *** thorst_ has quit IRC | 22:15 | |
| morgan | hehe | 22:20 |
| morgan | https://www.irccloud.com/pastebin/UhDJSr60/ | 22:21 |
| morgan | lbragstad: ^ | 22:21 |
| *** diazjf has joined #openstack-keystone | 22:22 | |
| lbragstad | morgan huh - interesting | 22:22 |
| *** martinlopes has joined #openstack-keystone | 22:22 | |
| *** MasterOfBugs has joined #openstack-keystone | 22:23 | |
| *** edmondsw has quit IRC | 22:29 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Cleanup for resource-specific options https://review.openstack.org/425957 | 22:30 |
| morgan | rderose, lbragstad, dstanek: ^ | 22:30 |
| rderose | morgan: ack | 22:30 |
| morgan | didn't run pep8 or tox on it | 22:30 |
| morgan | but still. | 22:30 |
| morgan | that is the change(s) I recommend. | 22:31 |
| *** pramodrj07 has joined #openstack-keystone | 22:31 | |
| morgan | rderose: and i am waiting for your re-spin of the PCI patch with the updates and i'll base my changes for deprecating the option(s) on that | 22:32 |
| rderose | morgan: cool, almost done | 22:32 |
| *** adriant has joined #openstack-keystone | 22:39 | |
| *** spotz is now known as spotz_zzz | 22:41 | |
| *** spotz_zzz is now known as spotz | 22:43 | |
| rderose | dstanek: I just remember why I didn't want to do it this way (expire password on create/update) | 22:43 |
| rderose | dstanek: what about existing users? | 22:44 |
| rderose | dstanek: this would mean that existing users wouldn't be required to change their passwords | 22:44 |
| morgan | rderose: still check self_service | 22:44 |
| rderose | morgan: during auth? | 22:45 |
| rderose | so do both? | 22:45 |
| morgan | also existing users shouldn't be required to change when the option is flipped it is only for admin-set passwords | 22:45 |
| morgan | really | 22:45 |
| rderose | morgan: so only going forward | 22:45 |
| morgan | yeah | 22:45 |
| morgan | that would be how i do it | 22:45 |
| rderose | stevemar: you'll really like this :) | 22:45 |
| morgan | same as how like AD does it... you could offer an option in keystone conf "expire all pw before X" | 22:45 |
| rderose | morgan: okay, cool | 22:46 |
| morgan | or a DB value... somewhere | 22:46 |
| morgan | but i'd add that not in this patch | 22:46 |
| stevemar | rderose: oh? i'll like what? | 22:46 |
| morgan | focus on core functionality "require a password change on admin password set" | 22:46 |
| rderose | stevemar: changing PCI... to expire passwords at create/update user | 22:46 |
| rderose | stevemar: so not at auth | 22:47 |
| stevemar | rderose: ahhh | 22:47 |
| *** thorst_ has joined #openstack-keystone | 22:47 | |
| morgan | :) | 22:47 |
| rderose | stevemar: this means existing users won't be affected | 22:47 |
| rderose | stevemar: only going forward | 22:47 |
| stevemar | rderose: if the admin resets your password, then you can't use APIs, you have to call the change password one | 22:47 |
| rderose | yes | 22:47 |
| stevemar | rderose: will we even need an option for that? | 22:47 |
| stevemar | rderose: just mark the password as expired :) | 22:48 |
| rderose | stevemar: regardless :) | 22:48 |
| stevemar | if the PCI bits are enabled, then we look at the expired flag, otherwise, we don't right? | 22:48 |
| stevemar | rderose: yay for less code | 22:48 |
| rderose | stevemar: that's true, but you may want password to expire every 90 days, but not force users to change password at first user??? | 22:49 |
| rderose | hmm... | 22:49 |
| lbragstad | i gotta hit the post office before they close - but i'll be on a bit later | 22:49 |
| rderose | morgan: thoughts? | 22:49 |
| *** stingaci has joined #openstack-keystone | 22:50 | |
| morgan | rderose: we can add functionality to password setting down the line | 22:50 |
| rderose | stevemar: nah, lets make it setting, as it is a separate PCI rule | 22:50 |
| morgan | rderose: but in 90% of the environments, it's here is your password, now go change it | 22:50 |
| rderose | morgan: true | 22:50 |
| morgan | focus on one feature at a time | 22:50 |
| rderose | morgan: right | 22:50 |
| rderose | :) | 22:50 |
| morgan | this one is forced change after admin set | 22:50 |
| morgan | if we want to expand options, we can | 22:51 |
| *** spzala has joined #openstack-keystone | 22:51 | |
| rderose | that's what happens when you let stevemar into the mix | 22:51 |
| morgan | or people can not set this thing when they create users. | 22:51 |
| morgan | then they can set this .... or whatever | 22:51 |
| rderose | yep | 22:51 |
| *** thorst_ has quit IRC | 22:51 | |
| rderose | okay, back testing... | 22:51 |
| rderose | *back to testing | 22:51 |
| *** spotz is now known as spotz_zzz | 22:52 | |
| stevemar | rderose: hehe, 3rd redesign is the charm right!? | 22:53 |
| rderose | ha | 22:53 |
| rderose | :) | 22:53 |
| stevemar | rderose: i definitely like this one best | 22:53 |
| rderose | yeah, I know you'd say that :) | 22:53 |
| stevemar | rderose: this is what i was getting at when i asked earlier about the flow | 22:53 |
| stevemar | cause it still seemed weird to me | 22:54 |
| stevemar | ah well, i'll leave you alone | 22:54 |
| rderose | okay, flow is better now | 22:54 |
| stevemar | i'll rebase the other ignore user id patches tonight | 22:54 |
| rderose | will have the patch up soon | 22:54 |
| rderose | cool | 22:54 |
| stevemar | rderose: this also means we can achieve it without a maintenance window :D | 22:54 |
| rderose | oh yeah! | 22:54 |
| *** stingaci has quit IRC | 22:55 | |
| *** spzala has quit IRC | 22:55 | |
| *** diazjf has quit IRC | 22:56 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Address follow-up comments from previous patchset https://review.openstack.org/425966 | 22:58 |
| gagehugo | lbragstad: ^ that is just fixing some of the comments you left from that change_password change. Sorry about the delay, it's been a busy week | 23:01 |
| *** phalmos has quit IRC | 23:01 | |
| * morgan is happy to help contribute to the "make keystone better and require less headaches of maintenance windows". | 23:05 | |
| rderose | morgan: ++ | 23:05 |
| * morgan also avoids endorsing "no downtime upgrades" that involve schema changes to the DB. | 23:06 | |
| * morgan still feels that is a request nearing absurdity. | 23:06 | |
| rderose | :) | 23:07 |
| *** jperry has quit IRC | 23:07 | |
| *** stingaci has joined #openstack-keystone | 23:12 | |
| *** spilla has quit IRC | 23:12 | |
| *** jaugustine has quit IRC | 23:13 | |
| *** stingaci has quit IRC | 23:17 | |
| *** spotz_zzz is now known as spotz | 23:18 | |
| *** spzala has joined #openstack-keystone | 23:24 | |
| *** stingaci has joined #openstack-keystone | 23:28 | |
| *** spotz is now known as spotz_zzz | 23:28 | |
| *** stingaci has quit IRC | 23:33 | |
| *** chris_hultin|AWA is now known as chris_hultin | 23:35 | |
| *** chris_hultin is now known as chris_hultin|AWA | 23:36 | |
| *** martinlopes has quit IRC | 23:38 | |
| *** martinlopes has joined #openstack-keystone | 23:41 | |
| *** spzala has quit IRC | 23:43 | |
| *** david-lyle has quit IRC | 23:51 | |
| *** jaosorior has quit IRC | 23:53 | |
| *** david-lyle has joined #openstack-keystone | 23:54 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Force users to change password upon first use https://review.openstack.org/425507 | 23:56 |
| *** rcernin has quit IRC | 23:56 | |
| *** rcernin has joined #openstack-keystone | 23:57 | |
| *** rcernin has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!