| *** thorst_ has joined #openstack-keystone | 00:00 | |
| *** thorst_ has quit IRC | 00:04 | |
| *** spotz_zzz is now known as spotz | 00:08 | |
| *** thorst_ has joined #openstack-keystone | 00:13 | |
| *** spotz is now known as spotz_zzz | 00:18 | |
| *** martinlopes has quit IRC | 00:50 | |
| *** martinlopes has joined #openstack-keystone | 00:52 | |
| *** martinlopes has quit IRC | 01:37 | |
| *** martinlopes has joined #openstack-keystone | 01:40 | |
| *** martinlopes has quit IRC | 01:43 | |
| *** thorst_ has joined #openstack-keystone | 01:44 | |
| *** thorst_ has quit IRC | 01:49 | |
| *** v1k0d3n has quit IRC | 02:00 | |
| *** v1k0d3n has joined #openstack-keystone | 02:02 | |
| *** thorst_ has joined #openstack-keystone | 02:09 | |
| *** spotz_zzz is now known as spotz | 02:09 | |
| *** thorst_ has quit IRC | 02:12 | |
| *** spotz is now known as spotz_zzz | 02:20 | |
| *** thorst_ has joined #openstack-keystone | 02:57 | |
| *** thorst_ has quit IRC | 02:57 | |
| *** thorst_ has joined #openstack-keystone | 03:07 | |
| *** thorst_ has quit IRC | 03:07 | |
| *** rcernin has joined #openstack-keystone | 03:11 | |
| *** rcernin has quit IRC | 03:13 | |
| *** rcernin has joined #openstack-keystone | 03:14 | |
| *** martinlopes has joined #openstack-keystone | 03:22 | |
| *** rcernin has quit IRC | 03:25 | |
| *** martinlopes has quit IRC | 03:29 | |
| *** martinlopes has joined #openstack-keystone | 03:31 | |
| *** nicolasbock has quit IRC | 03:34 | |
| *** links has joined #openstack-keystone | 03:56 | |
| morgan | yeah that would be the wya to do it adriant | 03:57 |
|---|---|---|
| *** links has quit IRC | 03:57 | |
| morgan | adriant: FYI, v2 auth is not affected by the MFA rules | 04:01 |
| morgan | sooooo if you want to enforce use of MFA, you have to force the use of V3 auth | 04:01 |
| adriant | morgan: yep, although... you can hack the V2 code if you want. Which is what I'm doing for our deployment unless we can phase out v2. | 04:04 |
| adriant | but yes, v3 is needed for MFA | 04:04 |
| adriant | I'm simply disabling users with MFA like features if they try to use V2 | 04:04 |
| adriant | well, failing their auth and telling them to use V3 | 04:04 |
| adriant | So to whatever docs you write, I would loudly specify that V2 has to be disabled for MFA to actually make sense. | 04:06 |
| morgan | right. | 04:09 |
| morgan | that is the plan | 04:09 |
| morgan | the main reason i'm not touching v2 is because of the long-standing policy of providing zero updates to v2 unless it is a security flaw (CVE/OSSA level) not intentional design like this | 04:10 |
| morgan | it's the main carrot to get people to V3 and to disable v2 auth | 04:10 |
| *** spotz_zzz is now known as spotz | 04:12 | |
| *** lamt has joined #openstack-keystone | 04:16 | |
| *** spotz is now known as spotz_zzz | 04:21 | |
| stevemar | morgan: code looks good | 04:22 |
| *** maestropandy has joined #openstack-keystone | 04:31 | |
| morgan | stevemar: test patch incoming shortly | 04:31 |
| morgan | oopse... heh, i found a bug already :P | 04:32 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: WIP Fix multiple uuid warnings with pycadf https://review.openstack.org/426411 | 04:37 |
| *** lamt has quit IRC | 04:38 | |
| *** adrian_otto has joined #openstack-keystone | 04:41 | |
| *** lamt has joined #openstack-keystone | 04:41 | |
| gagehugo | morgan knikolla ^ I will be out (probably all day) tomorrow but I am slowly working on that | 04:42 |
| gagehugo | if there is anything that you want to do with that, go ahead, otherwise I will resume when I get back | 04:43 |
| *** adrian_otto has quit IRC | 04:51 | |
| *** dikonoo has joined #openstack-keystone | 04:51 | |
| *** martinlopes has quit IRC | 04:53 | |
| morgan | stevemar: gonna need to rebase in a few the two cleanups... but should be relatively easy | 04:53 |
| *** lamt has quit IRC | 05:00 | |
| *** martinlopes has joined #openstack-keystone | 05:02 | |
| *** lamt has joined #openstack-keystone | 05:03 | |
| *** dikonoor has joined #openstack-keystone | 05:05 | |
| *** dikonoo has quit IRC | 05:05 | |
| *** spotz_zzz is now known as spotz | 05:12 | |
| *** spotz is now known as spotz_zzz | 05:22 | |
| *** dikonoor has quit IRC | 05:27 | |
| *** maestropandy has left #openstack-keystone | 05:33 | |
| *** dikonoor has joined #openstack-keystone | 05:38 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:47 | |
| *** thorst_ has joined #openstack-keystone | 05:49 | |
| *** adriant has quit IRC | 05:54 | |
| *** thorst_ has quit IRC | 05:55 | |
| *** jvarlamova_ has joined #openstack-keystone | 06:01 | |
| *** Jack_I has joined #openstack-keystone | 06:02 | |
| *** spotz_zzz is now known as spotz | 06:13 | |
| *** lamt has quit IRC | 06:15 | |
| *** adrian_otto has joined #openstack-keystone | 06:17 | |
| *** martinlopes_ has joined #openstack-keystone | 06:23 | |
| *** spotz is now known as spotz_zzz | 06:23 | |
| *** martinlopes has quit IRC | 06:26 | |
| *** adrian_otto has quit IRC | 06:45 | |
| *** rcernin has joined #openstack-keystone | 07:11 | |
| *** rcernin has quit IRC | 07:12 | |
| *** rcernin has joined #openstack-keystone | 07:12 | |
| *** spotz_zzz is now known as spotz | 07:14 | |
| *** spotz is now known as spotz_zzz | 07:24 | |
| *** tesseract has joined #openstack-keystone | 07:50 | |
| *** thorst_ has joined #openstack-keystone | 07:51 | |
| *** thorst_ has quit IRC | 07:56 | |
| *** spotz_zzz is now known as spotz | 08:15 | |
| *** pcaruana has joined #openstack-keystone | 08:15 | |
| *** spotz is now known as spotz_zzz | 08:25 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** rcernin has quit IRC | 09:31 | |
| *** rcernin has joined #openstack-keystone | 09:33 | |
| *** jistr has quit IRC | 09:49 | |
| *** jistr has joined #openstack-keystone | 09:51 | |
| *** thorst_ has joined #openstack-keystone | 09:52 | |
| *** maestropandy has joined #openstack-keystone | 09:56 | |
| *** thorst_ has quit IRC | 09:57 | |
| *** maestropandy has quit IRC | 10:00 | |
| *** gitudaniel has joined #openstack-keystone | 10:02 | |
| gitudaniel | o/ | 10:02 |
| *** maestropandy has joined #openstack-keystone | 10:05 | |
| *** maestropandy has left #openstack-keystone | 10:05 | |
| *** thiagolib has joined #openstack-keystone | 10:07 | |
| *** spotz_zzz is now known as spotz | 10:16 | |
| *** dikonoor has quit IRC | 10:18 | |
| *** spotz is now known as spotz_zzz | 10:26 | |
| *** mvk has quit IRC | 10:28 | |
| *** dikonoor has joined #openstack-keystone | 10:33 | |
| *** gitudaniel has quit IRC | 10:40 | |
| *** mvk has joined #openstack-keystone | 10:57 | |
| *** gitudaniel has joined #openstack-keystone | 10:59 | |
| *** dikonoor has quit IRC | 11:08 | |
| gitudaniel | on setting up the fernet using keystone-manage fernet_setup I get the error keystone.common.fernet_utils [-] Either [fernet_tokens] key_repository does not exist or kystone does not have sufficient permission to access it: /etc/keystone/fernet-keys/ while looking into it I came to the conclusion that since the development environment is being configured in a virtual environment it has no | 11:17 |
| gitudaniel | access to the host system so I tried sudo keystone-manage fernet_setup and got ImportError: No module named oslo_config. At this point I had noticed the etc folder within the repo that contains the keystone.conf file and I assumed that I could point to the config file using the --config-file PATH command. I ran the command keystone-manage --config-file | 11:17 |
| gitudaniel | PATH~/openstack/keystone/etc/keystone.conf and got keystone-manage: error: too few arguments. I then tried to specify the directory in which the .conf file is located by running keystone-manage --config-dir DIR~/openstack/keystone/etc it returns oslo_config.cfg.ConfigDirNotFoundError: Failed to read config file directory: DIR~/openstack/keystone/etc/ where did I go wrong? | 11:17 |
| *** spotz_zzz is now known as spotz | 11:17 | |
| *** richm has joined #openstack-keystone | 11:18 | |
| *** lamt has joined #openstack-keystone | 11:18 | |
| *** lamt has quit IRC | 11:19 | |
| *** dikonoor has joined #openstack-keystone | 11:21 | |
| *** dims has joined #openstack-keystone | 11:26 | |
| *** spotz is now known as spotz_zzz | 11:27 | |
| *** richm has quit IRC | 11:27 | |
| *** richm has joined #openstack-keystone | 11:27 | |
| *** richm has quit IRC | 11:35 | |
| *** richm has joined #openstack-keystone | 11:37 | |
| *** nicolasbock has joined #openstack-keystone | 11:52 | |
| *** thorst_ has joined #openstack-keystone | 11:53 | |
| *** thorst_ has quit IRC | 11:57 | |
| *** spotz_zzz is now known as spotz | 12:18 | |
| *** richm has quit IRC | 12:20 | |
| *** richm has joined #openstack-keystone | 12:22 | |
| *** catintheroof has joined #openstack-keystone | 12:25 | |
| *** spotz is now known as spotz_zzz | 12:28 | |
| *** raildo has joined #openstack-keystone | 12:28 | |
| *** thorst_ has joined #openstack-keystone | 12:41 | |
| *** jaugustine has joined #openstack-keystone | 13:00 | |
| *** dave-mccowan has joined #openstack-keystone | 13:00 | |
| *** raildo has quit IRC | 13:01 | |
| *** wasmum has quit IRC | 13:03 | |
| *** edmondsw has joined #openstack-keystone | 13:07 | |
| *** gitudaniel has quit IRC | 13:19 | |
| *** spotz_zzz is now known as spotz | 13:19 | |
| *** spotz is now known as spotz_zzz | 13:29 | |
| *** gitudaniel has joined #openstack-keystone | 13:54 | |
| *** clenimar has quit IRC | 14:12 | |
| *** gitudaniel has quit IRC | 14:13 | |
| *** clenimar has joined #openstack-keystone | 14:16 | |
| *** dikonoor has quit IRC | 14:17 | |
| *** gitudaniel has joined #openstack-keystone | 14:20 | |
| *** lamt has joined #openstack-keystone | 14:25 | |
| *** jperry has joined #openstack-keystone | 14:26 | |
| openstackgerrit | Ken Johnston proposed openstack/keystone: Readability enhancements to architecture doc https://review.openstack.org/422375 | 14:30 |
| *** agrebennikov__ has joined #openstack-keystone | 14:31 | |
| *** jperry has quit IRC | 14:36 | |
| *** lamt has quit IRC | 14:36 | |
| samueldmq | morning keystone | 14:37 |
| *** jperry has joined #openstack-keystone | 14:38 | |
| lbragstad | o/ | 14:38 |
| *** edtubill has joined #openstack-keystone | 14:38 | |
| samueldmq | lbragstad: howdy | 14:38 |
| dstanek | morning samueldmq | 14:40 |
| samueldmq | dstanek: o/ | 14:40 |
| lbragstad | dstanek morgan are we allowed to add new strings during StringFreeze? | 14:45 |
| dstanek | lbragstad: i don't think we're supposed to add or change any | 14:46 |
| lbragstad | dstanek morgan or does that only apply to changing strings? | 14:46 |
| *** rcernin has quit IRC | 14:48 | |
| dstanek | lbragstad: in the soft string freeze they can be added and not changed | 14:51 |
| lbragstad | dstanek aha - ok that makes sense | 14:51 |
| dstanek | http://docs.openstack.org/project-team-guide/release-management.html | 14:52 |
| lbragstad | dstanek yeah - i was just reading that, too | 14:52 |
| *** lamt has joined #openstack-keystone | 14:57 | |
| *** rcernin has joined #openstack-keystone | 15:00 | |
| knikolla | o/ morning | 15:01 |
| *** mvk has quit IRC | 15:02 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:06 | |
| *** spotz_zzz is now known as spotz | 15:10 | |
| kencjohnston | o/ good morning keystone team. | 15:12 |
| kencjohnston | Can someone help me resolve a bit of confusion in this review - https://review.openstack.org/#/c/422375 | 15:12 |
| kencjohnston | ? | 15:12 |
| dstanek | kencjohnston: good morning | 15:12 |
| kencjohnston | The original sentence I was trying to clarify was - "While the general data model allows a many-to-many relationship between users | 15:13 |
| kencjohnston | and groups to projects and domains; the actual backend ..." | 15:13 |
| kencjohnston | I'm starting to wonder if the first part of that sentence isn't correct, there is no many-to-many relationship between users and groups to projects. | 15:13 |
| dstanek | i'm not sure what rodrigods is saying there | 15:14 |
| *** adrian_otto has joined #openstack-keystone | 15:14 | |
| Adobeman | uhm... so I was digging around a bit more, there is a possiblity that keystone will not talk to ldap properly without TLS enable. Is this true? | 15:15 |
| dstanek | kencjohnston: it's not really clear to me what the original test was trying to say. was is talking about assignment as the association? | 15:15 |
| dstanek | Adobeman: why do you say that? (i have no idea, but TSL is generally the way to go) | 15:16 |
| lbragstad | dstanek kencjohnston i think what rodrigods meant was that he didn't want to make it sound like projects owns users and groups | 15:16 |
| Adobeman | was reading some blog about it.. matt fisher.. | 15:16 |
| *** nkinder has joined #openstack-keystone | 15:16 | |
| lbragstad | dstanek kencjohnston right now - we create users and groups within a domain | 15:16 |
| kencjohnston | dstanek: I took the original text to mean that there could be the relationships stated, but that often times backends might limit it. | 15:16 |
| dstanek | lbragstad: to me that whole thing (the older version too) sounds like ownership and that isn't true | 15:17 |
| lbragstad | Adobeman he is usually hanging around here | 15:17 |
| Adobeman | I didnt think it was a big deal not to have TLS enable, but I may be mistaken about not enable TLS. Yes, I didnt enable TLS out of the box cuz this is still in staging | 15:17 |
| lbragstad | mfisch ^ | 15:17 |
| kencjohnston | lbragstad: dstanek - So perhaps take out the word "Projects" and just leave it as users and groups to domains? | 15:17 |
| Adobeman | hrm? he is?? | 15:17 |
| Adobeman | not sure I ever seem him talk...? | 15:18 |
| *** mvk has joined #openstack-keystone | 15:18 | |
| Adobeman | now he's going to run away haha | 15:18 |
| lbragstad | kencjohnston dstanek well - domains technically *own* projects, users, and groups but users and groups can also have assignments to both projects and domains | 15:18 |
| knikolla | kencjohnston: I think the entire paragraph should be rephrased. | 15:19 |
| dstanek | a user can only be in 1 domain, but have assignments across domains. the original test reads to me like users can be in multiple domains | 15:19 |
| kencjohnston | knikolla: I'm fishing for suggestions :) | 15:19 |
| dstanek | maybe is the word associated that's somewhat ambiguous | 15:19 |
| lbragstad | kencjohnston dstanek would it make more sense to clarify that users and groups must reside within a domain, but they have multiple role assignments across domains (this is where the many to many relationship comes in) | 15:19 |
| knikolla | there is no many to many relation between user and domain like dstanek said | 15:19 |
| kencjohnston | I read the whole point of that paragraph to just be a warning, essentially - "What we said is true, but your mileage may vary depending on backend." | 15:20 |
| *** adrian_otto has quit IRC | 15:20 | |
| kencjohnston | If we aren't happy with the definition of | 15:20 |
| kencjohnston | "what we said is true" that is in the bulleted list above. | 15:21 |
| knikolla | kencjohnston: actually i'm not sure the mileage may vary is even true | 15:21 |
| dstanek | kencjohnston: if that's the point of that paragraph, then i'd just change it to be a softer version of that and leave out the g/u & p/d details | 15:21 |
| knikolla | i think every backend supports that stuff? | 15:21 |
| kencjohnston | knikolla: dstanek - So just delete it? | 15:22 |
| knikolla | dstanek lbragstad correct me if i'm wrong | 15:22 |
| lbragstad | knikolla not every backend might support assignments across domains though, right? | 15:22 |
| dstanek | knikolla: the ones we supply do i believe, but others may not | 15:22 |
| knikolla | then we say: | 15:22 |
| *** jaosorior has joined #openstack-keystone | 15:23 | |
| knikolla | "In this model, users and groups are contained within domains and have a many to many relationship to projects. While most backends allow this relation to be in different domain, some may not." | 15:24 |
| *** adrian_otto has joined #openstack-keystone | 15:25 | |
| *** gitudaniel has quit IRC | 15:25 | |
| kencjohnston | knikolla: Cool, new patch coming. Thanks! | 15:25 |
| dstanek | that data model section seems wrong in general | 15:26 |
| knikolla | dstanek: yes | 15:26 |
| knikolla | **User**: has account credentials, is associated with one or more projects or domains | 15:26 |
| dstanek | Extras should be deleted | 15:26 |
| knikolla | ^^ domain part is wrong | 15:26 |
| knikolla | one domain only | 15:26 |
| dstanek | knikolla: it depends on is associated mean asssigned or owned | 15:26 |
| dstanek | s/is/if/ | 15:26 |
| dstanek | it's very imprecise language | 15:27 |
| knikolla | dstanek: i don't agree on describing the data model with ambiguous terms | 15:27 |
| dstanek | Projects don't contain users | 15:27 |
| *** jaosorior has quit IRC | 15:27 | |
| dstanek | this is why i hate reading docs. i feel compelled to fix them | 15:28 |
| openstackgerrit | Ken Johnston proposed openstack/keystone: Readability enhancements to architecture doc https://review.openstack.org/422375 | 15:28 |
| dstanek | i think i'm going to finish up my mapping doc changes right now actually | 15:28 |
| knikolla | dstanek: i'd be happy to review | 15:29 |
| *** jaosorior has joined #openstack-keystone | 15:32 | |
| *** lucas_ has joined #openstack-keystone | 15:35 | |
| *** adrian_otto has quit IRC | 15:37 | |
| *** adrian_otto has joined #openstack-keystone | 15:39 | |
| *** mvk has quit IRC | 15:40 | |
| *** spzala has joined #openstack-keystone | 15:51 | |
| *** mvk has joined #openstack-keystone | 15:53 | |
| *** jperry has quit IRC | 15:56 | |
| *** richm has quit IRC | 16:02 | |
| *** richm has joined #openstack-keystone | 16:08 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Update PCI documenation https://review.openstack.org/426823 | 16:09 |
| *** ravelar has joined #openstack-keystone | 16:10 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Update PCI documenation https://review.openstack.org/426823 | 16:13 |
| *** ayoung has quit IRC | 16:23 | |
| *** rcernin has quit IRC | 16:24 | |
| lbragstad | dstanek jamielennox curious if either of you have a follow up on this? https://review.openstack.org/#/c/285757/21 | 16:25 |
| *** ayoung has joined #openstack-keystone | 16:33 | |
| *** ChanServ sets mode: +v ayoung | 16:33 | |
| *** nkinder has quit IRC | 16:34 | |
| *** spzala has quit IRC | 16:34 | |
| dstanek | lbragstad: i didn't +2 because i fixed and pushed a patchset. i think stevemar wanted jamielennox to take a final look | 16:34 |
| lbragstad | dstanek sounds good | 16:35 |
| *** spzala has joined #openstack-keystone | 16:35 | |
| *** spzala has quit IRC | 16:40 | |
| morgan | adding strings is not the end of the world | 16:51 |
| morgan | changing strings is | 16:51 |
| stevemar | morgan: dstanek lbragstad sure, do it up | 16:51 |
| morgan | At the same time as Feature Freeze, is Soft String Freeze. Translators start to translate the strings after $SERIES-3. To aid their work, it is important to avoid changing existing strings, as this will invalidate some of their translation work. New strings are allowed for things like new log messages, as in many cases leaving those strings untranslated is | 16:51 |
| morgan | better than not having any message at all. | 16:51 |
| morgan | (from the guidelines) | 16:52 |
| lbragstad | yeah - i read that | 16:52 |
| morgan | stevemar, dstanek, lbragstad: i'm still debugging an issue with the tests for MFA | 16:52 |
| morgan | i can't figure out how password is always sneaking in even when i only sent totp | 16:52 |
| *** adrian_otto has quit IRC | 16:53 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Process and validate auth methods against MFA rules https://review.openstack.org/423548 | 16:53 |
| morgan | ^ | 16:53 |
| morgan | with tests | 16:53 |
| morgan | it should fail. | 16:53 |
| morgan | at least one | 16:53 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Cleanup TODO about auth.controller code moved to core https://review.openstack.org/426607 | 16:53 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Cleanup TODO, AuthContext and AuthInfo to auth.core https://review.openstack.org/426608 | 16:53 |
| morgan | User 574b10a0291a4ca99b8157994a2ec73e auth methods set([u'password']) did not match a MFA rule in [[u'password', u'totp']]. | 16:55 |
| morgan | Insufficient auth methods received for 574b10a0291a4ca99b8157994a2ec73e. Auth Methods Provided: [u'password']. | 16:55 |
| morgan | 16:55 | |
| morgan | is what i'm getting | 16:55 |
| morgan | i sent password + totp | 16:55 |
| morgan | so i know where the issue is. | 16:55 |
| morgan | i'll dig through in a moment | 16:55 |
| *** tesseract has quit IRC | 16:58 | |
| *** slberger has joined #openstack-keystone | 17:00 | |
| *** adrian_otto has joined #openstack-keystone | 17:01 | |
| *** nkinder has joined #openstack-keystone | 17:07 | |
| morgan | ahahaha it's a bug in the test suite... | 17:14 |
| morgan | doh | 17:14 |
| *** nkinder has quit IRC | 17:17 | |
| *** jose-phillips has joined #openstack-keystone | 17:19 | |
| knikolla | #success openstackclient supports k2k | 17:21 |
| openstackstatus | knikolla: Added success to Success page | 17:21 |
| *** jsavak has joined #openstack-keystone | 17:22 | |
| *** mvk has quit IRC | 17:24 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Process and validate auth methods against MFA rules https://review.openstack.org/423548 | 17:29 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Process and validate auth methods against MFA rules https://review.openstack.org/423548 | 17:30 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Cleanup TODO about auth.controller code moved to core https://review.openstack.org/426607 | 17:30 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Cleanup TODO, AuthContext and AuthInfo to auth.core https://review.openstack.org/426608 | 17:30 |
| morgan | stevemar, dstanek, lbragstad, knikolla, rderose: ^ whole stack for MFA ready for review. | 17:30 |
| morgan | tests included. | 17:31 |
| morgan | needs docs but i'll work on that once the code is looking right | 17:31 |
| lbragstad | morgan sweet | 17:32 |
| Jack_I | Hi Folks! any workarounds https://bugs.launchpad.net/heat/+bug/1660395 ? | 17:34 |
| openstack | Launchpad bug 1660395 in heat "You are not authorized to perform the requested action: identity:list_endpoints" [Undecided,New] | 17:34 |
| morgan | lbragstad: i def want to get your feedback today on that code if you don't mind. looking to get the view on landing it (since the user options code) landed already | 17:35 |
| morgan | lbragstad: :) | 17:35 |
| morgan | s/)landed already/landed already) | 17:35 |
| lbragstad | morgan yep - i'll review it today for sure | 17:36 |
| morgan | lbragstad: the lockout option stuff should be easy to +2/+A. the MFA stuff needs the more in depth eyes. | 17:36 |
| stevemar | morgan: rderose already approved that | 17:37 |
| morgan | stevemar: ah nice | 17:39 |
| morgan | stevemar: i updated my comment on the config validator | 17:39 |
| morgan | said i'd rescind my -2 if it was installed like keystone-manage is | 17:40 |
| morgan | *and* has unit tests | 17:40 |
| morgan | but it def. does not belong in /tools | 17:40 |
| morgan | and a helper script makes sense since the command is beastly | 17:40 |
| morgan | stevemar: but the patch the lockout depends on hasn't been approved yet | 17:42 |
| *** adrian_otto has quit IRC | 17:42 | |
| morgan | stevemar: sooooo :P statement stands, prob easy to +2/+A. | 17:42 |
| morgan | lbragstad: also replied to the comment about the TypeError "list of lists of strings" | 17:44 |
| morgan | lbragstad: in short, dev error (suspenders and a belt) in the case that someone is submitting things not validated by jsonschema | 17:44 |
| morgan | lbragstad: jsonschema does validate the MFA Rules to be a list of lists of strings | 17:45 |
| lbragstad | morgan ok - chceking | 17:45 |
| morgan | knikolla: yay MFA things are all done and proposed. | 17:52 |
| rodrigods | anyone already at -qa channel? we are discussing something really strange there (related to keystone) | 17:52 |
| morgan | lbragstad, stevemar, dstanek: NOTE- MFA rules are only processed on V3 auth | 17:52 |
| morgan | rderose: ^ | 17:52 |
| *** jsavak has quit IRC | 17:57 | |
| *** adrian_otto has joined #openstack-keystone | 17:59 | |
| *** adrian_otto has quit IRC | 18:02 | |
| *** harlowja has joined #openstack-keystone | 18:02 | |
| *** mvk has joined #openstack-keystone | 18:07 | |
| dstanek | morgan: cool, i'll start looking at those today then | 18:09 |
| *** raildo has joined #openstack-keystone | 18:22 | |
| *** htruta` is now known as htruta | 18:23 | |
| *** spzala has joined #openstack-keystone | 18:24 | |
| * morgan is about to be very irritated at a lot of code that landed that custom constructs responses without a call to wsgi.render_response | 18:26 | |
| morgan | basically we've broken HTTP spec | 18:26 |
| morgan | again | 18:26 |
| morgan | and we circumvented the tests to prevent us from doing it | 18:27 |
| morgan | and now it is an API incompatible change to fix | 18:27 |
| * morgan is very annoyed | 18:27 | |
| * morgan goes to cook bagels for an hour before coming back and trying to be less annoyed | 18:28 | |
| morgan | rodrigods: ^ cc | 18:28 |
| * rodrigods has nothing to do with it :) | 18:28 | |
| rodrigods | kidding | 18:29 |
| *** tqtran has joined #openstack-keystone | 18:29 | |
| Adobeman | ok, at least the tls stuff was confirmed working.. finally got that sorted out, except openstack is still throwing a fit at me about peer certificate issuer has been marked as not trusted by user.. | 18:37 |
| stevemar | rodrigods morgan whats up now? more head/get 204/200 trouble? | 18:38 |
| rodrigods | stevemar, yeah, basically | 18:38 |
| stevemar | which API calls? | 18:38 |
| morgan | stevemar: yep | 18:38 |
| rodrigods | stevemar, the discussion started because keystone returns 200 in ubuntu trusty and 204 in xenial for the same API | 18:39 |
| morgan | looks like a fair amount of them | 18:39 |
| morgan | sanything that doesn't call render_response in wsgi | 18:39 |
| morgan | is probably "wrong" | 18:39 |
| morgan | also anything that mucks with response codes for HEAD and says 204 is just flat wrong | 18:40 |
| dstanek | rodrigods: whoa, really? | 18:51 |
| rodrigods | dstanek, yep heh | 18:52 |
| rodrigods | dstanek, https://review.openstack.org/#/c/426882/ | 18:52 |
| rodrigods | wait for jenkins | 18:52 |
| dstanek | rodrigods: why is it different? | 18:53 |
| rodrigods | dstanek, we didn't dig in too much, but the guess is some lib fault | 18:53 |
| *** browne has joined #openstack-keystone | 18:54 | |
| Adobeman | so.. | 18:55 |
| Adobeman | is keystone going to have a fit with self signed cert..? | 18:55 |
| Adobeman | or is it not a keystone issue... | 18:56 |
| dstanek | Adobeman: i'm guessing that it's a library question. i would home that we are as strict as possible by default though | 18:58 |
| rodrigods | lbragstad, samueldmq, ayoung any of you want to +A https://review.openstack.org/#/c/422819/ ? | 19:00 |
| dstanek | rodrigods: well, i don't :-P | 19:01 |
| Adobeman | ok, all these keystone/ldap/tls are really fun, I am just really at a point I had enough of it... :P I just like it to all play nice and work :P | 19:01 |
| dstanek | Adobeman: are you still having issues? | 19:02 |
| Adobeman | Peer's certificate issuer has been marked as not trusted by the user.", 'desc': "Can't contact LDAP server"} | 19:02 |
| Adobeman | yes, different issue | 19:02 |
| Adobeman | I read up matt's blog that TLS absolutely needs to work for ldap to work.. | 19:03 |
| Adobeman | so I tested my ldap server, make sure tls is working. tested via ldapsearch even ssh... | 19:03 |
| Adobeman | now keystone is throwing a fit at me about cert | 19:03 |
| dstanek | Adobeman: does ldapsearch work over TLS? | 19:04 |
| Adobeman | yes | 19:04 |
| Adobeman | STARTTLS all work properly | 19:04 |
| Adobeman | openssl direct query also works, it just says its self signed cert | 19:05 |
| dstanek | Adobeman: not sure then. when i had that same error message is happened for both the cli and keystone on that box | 19:05 |
| dstanek | it was because i was not trusting the cA | 19:05 |
| Adobeman | right.. so I actually use system's CQ-Bundle.. | 19:05 |
| Adobeman | CA*-Bundle.crt | 19:05 |
| Adobeman | which what keystone is pointing at | 19:06 |
| dstanek | Adobeman: but you're not getting signed by a proper CA right? | 19:06 |
| Adobeman | what is this..? LDAPTLS_CACERT | 19:06 |
| Adobeman | I thought was TLS_CACERT | 19:07 |
| Adobeman | (i'm still reading stuff..) | 19:07 |
| * Adobeman falls over | 19:09 | |
| Adobeman | keystone.common.wsgi AssertionError: Invalid TLS / LDAPS combination | 19:09 |
| Adobeman | ok.. what did I take out lol | 19:09 |
| dstanek | Adobeman: i thought with self signed certs you can use specify the CA file as an option (although i'm not sure that you can do that in keystone directly) | 19:10 |
| morgan | Adobeman: the ldap python modules kindof suck in this regard | 19:10 |
| morgan | and for that, i'm sorry. | 19:10 |
| Adobeman | I'm specifying it now, I have taken it off it didnt appear to make a difference | 19:11 |
| Adobeman | morgan that's so over my head I'm not following | 19:11 |
| Adobeman | :( | 19:11 |
| dstanek | Adobeman: what did you take off? | 19:11 |
| lbragstad | morgan we had existing tests in place for https://review.openstack.org/#/c/426431/3 ? | 19:12 |
| Adobeman | TLS_CACERT | 19:12 |
| Adobeman | in keystone.conf | 19:12 |
| Adobeman | hoping it will take system default and go with it | 19:12 |
| dstanek | Adobeman: oh, weird. looking at that i would think it would work. and you are getting that error message in your log after restarting? | 19:13 |
| Adobeman | yep | 19:13 |
| Adobeman | ERROR keystone.common.wsgi BackendError: {'info': "TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.", 'desc': 'Connect error'} | 19:13 |
| Adobeman | no real difference with that line enable or not | 19:14 |
| dstanek | Adobeman: you're using the tls_cacertfile option in the config? | 19:15 |
| Adobeman | you mean this ? TLS_CACERT = /etc/pki/tls/certs/ca-bundle.crt | 19:15 |
| Adobeman | yes | 19:15 |
| morgan | lbragstad: what do you mean? existing tests? | 19:15 |
| dstanek | i'm not sure what that is | 19:15 |
| morgan | lbragstad: some of that is just hooking into json-schema and is tested by the schema validator tests | 19:16 |
| morgan | lbragstad: so ... yes? | 19:16 |
| Adobeman | that's the only TLS_cacertfile config parameter I'm aware of in keystone.conf? am I wrong? | 19:16 |
| lbragstad | morgan that patch doesn't have any tests for adding the jsonschema attributes - but it is tested in the schema validator | 19:16 |
| lbragstad | er - keystone/tests/unit/test_validation.py | 19:16 |
| dstanek | Adobeman: i've never seen that before - http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n1412 | 19:16 |
| morgan | lbragstad: correct | 19:17 |
| morgan | lbragstad: no new tests for the schema properties, but it is tested by the validator test(s) | 19:17 |
| Adobeman | dstanek: :O | 19:17 |
| lbragstad | morgan don't we have to deprecate configuration options/ | 19:17 |
| morgan | lbragstad: if it built bad schemas the validator tests already exist(s) | 19:17 |
| morgan | lbragstad: stevemar says no, that option was added in ocata | 19:17 |
| morgan | lbragstad: the password_expiry one was deprecated because it was added in newton | 19:18 |
| Adobeman | I think you're right ... | 19:18 |
| Adobeman | where the heck did I get this.. | 19:18 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Update PCI documenation https://review.openstack.org/426823 | 19:18 |
| Adobeman | http://www.mattfischer.com/blog/?p=545 | 19:18 |
| Adobeman | oh.. there.. | 19:18 |
| Adobeman | config file is tls_cacertfile | 19:18 |
| Adobeman | BLAAAAAAAAAAAAH | 19:18 |
| Adobeman | pull it from wrong file | 19:18 |
| Adobeman | )#&%)#!&%)#!&%! | 19:19 |
| Adobeman | thanks for pointing that out.. | 19:20 |
| lbragstad | morgan ah - right | 19:20 |
| lbragstad | morgan looks like it was introduced in https://review.openstack.org/#/c/398571/ | 19:20 |
| lbragstad | morgan which merged 10 days ago | 19:20 |
| lbragstad | morgan s/days/weeks/ | 19:20 |
| * Adobeman falls over | 19:20 | |
| *** richm has quit IRC | 19:21 | |
| stevemar | lbragstad: yeah, only went into ocata | 19:21 |
| lbragstad | stevemar ok - cool | 19:21 |
| morgan | lbragstad: yep | 19:22 |
| *** richm has joined #openstack-keystone | 19:22 | |
| Adobeman | I swapped out that line with tls_cacertfile, still didnt change the outcome when I do a "openstack user list" | 19:23 |
| *** jaosorior is now known as jaosorior_lunch | 19:28 | |
| Adobeman | so I'm guessing it was ignoring the entry | 19:28 |
| *** richm has quit IRC | 19:30 | |
| *** richm has joined #openstack-keystone | 19:31 | |
| *** richm has quit IRC | 19:31 | |
| dstanek | Adobeman: you may have to debug it and make sure the option is being set properly | 19:31 |
| Adobeman | lets see | 19:32 |
| Adobeman | openstack user list is a valid way of testing, right? | 19:32 |
| Adobeman | instead of doing it over the web | 19:32 |
| *** diazjf has joined #openstack-keystone | 19:35 | |
| *** stingaci has joined #openstack-keystone | 19:36 | |
| dstanek | Adobeman: yeah, that would be fine. i'm surprised that you are still getting that error in your keystone log | 19:37 |
| *** ravelar has quit IRC | 19:37 | |
| *** spzala has quit IRC | 19:37 | |
| Adobeman | well, I was not using ldap-tls last week | 19:39 |
| Adobeman | I still havent get to that point after I try to enable tls | 19:40 |
| dstanek | Adobeman: gotten to what point? | 19:40 |
| Adobeman | the point ldap is telling me user is disabled | 19:41 |
| Adobeman | ok, now let me confirm another thing... | 19:49 |
| Adobeman | putting keystone in debug is by doing this.. under [ldap] debug_level = 4095 | 19:50 |
| Adobeman | that's what you meant, right? | 19:50 |
| ayoung | rodrigods, -2. I mean +2A | 19:51 |
| *** MasterOfBugs has joined #openstack-keystone | 19:52 | |
| dstanek | Adobeman: no i mean actually debug the code either using PDB or extra logging | 20:01 |
| stevemar | lbragstad: around? | 20:03 |
| lbragstad | stevemar i think so (in a meeting too) | 20:04 |
| stevemar | lbragstad: wanted to talk about https://review.openstack.org/#/c/418166/ | 20:05 |
| stevemar | lbragstad: i think its safe to merge, even if we don't land the other bits of MFA we just have extra user attributes, meh | 20:05 |
| lbragstad | stevemar sure - but they won't really be doing anything even if they are set, right? | 20:06 |
| stevemar | lbragstad: righto | 20:06 |
| lbragstad | (if that's the case and what ends up in ocata - we'll have to be explicit about saying that *loudly*) | 20:06 |
| stevemar | eh | 20:08 |
| stevemar | its underlying implementation anyway | 20:08 |
| stevemar | but lets look at the whole chain | 20:08 |
| lbragstad | stevemar agreed - I'm still reviewing that chain | 20:10 |
| *** ravelar has joined #openstack-keystone | 20:19 | |
| morgan | lbragstad: i will get some docs generated, but i wanted to be sure the code was up to snuff first. and stevemar is going to write docs for the resource options (dev docs) | 20:19 |
| lbragstad | morgan sweet | 20:20 |
| morgan | because docs are much easier to land than code | 20:20 |
| stevemar | morgan: and they can land in master :) | 20:22 |
| stevemar | or after we tag rc1 | 20:22 |
| morgan | yah | 20:23 |
| morgan | stevemar: and we're going to land the minus-kvs patch once RC opens | 20:23 |
| *** jose-phillips has quit IRC | 20:23 | |
| stevemar | yup | 20:24 |
| stevemar | once we cut stable/ocat | 20:24 |
| stevemar | a | 20:24 |
| morgan | cause woot minus over 2000 lines | 20:24 |
| morgan | stevemar: well an RC branch if we do that | 20:24 |
| morgan | whatever the actuall "no more master code goes here" time | 20:24 |
| *** ravelar1 has joined #openstack-keystone | 20:26 | |
| stevemar | morgan: as soon as we tag rc1 we create stable/ocata at the same time now :) the release team is awesome :) | 20:26 |
| stevemar | morgan: so theres less of a need to go around -2'ing everything these days | 20:27 |
| morgan | haha | 20:27 |
| morgan | stevemar: but... i wanted to -2 all the things | 20:27 |
| morgan | :P | 20:27 |
| *** jose-phillips has joined #openstack-keystone | 20:29 | |
| *** diazjf has left #openstack-keystone | 20:35 | |
| stevemar | morgan: it is fun to do | 20:36 |
| Adobeman | dstanek: 4095 is ... as high as I can go..? | 20:36 |
| dstanek | Adobeman: no idea, the only ldap i've done is with devstack | 20:37 |
| *** ravelar1 has quit IRC | 20:38 | |
| Adobeman | oh I'm not using anything fancier compares to you | 20:38 |
| Adobeman | this is rdo openstack :P | 20:38 |
| Adobeman | everything in single box | 20:38 |
| dstanek | Adobeman: yeah, i don't use ldap at all on a regular basis | 20:38 |
| Adobeman | apart from.. fischer, I currently do not know anyone uses ldap with openstack. | 20:40 |
| Adobeman | not devstack, not rdo openstack, not standard full openstack deployment.. | 20:41 |
| Adobeman | in fact, I dont know of anyone using newton with openldap.. | 20:41 |
| *** adriant has joined #openstack-keystone | 20:43 | |
| morgan | Adobeman: Cern does (Active Directory), mostly federation, but they extensively used LDAP connector as well | 20:44 |
| morgan | Adobeman: i know a few other orgs do, but tehy aren't super vocal about it. HPE used to (dunno if Suse is doing so/ HPE still does or not) | 20:45 |
| morgan | Adobeman: IBM has deployments that use LDAP | 20:45 |
| morgan | Adobeman: like i said, they're just not super vocal about it | 20:45 |
| Adobeman | oh yes, that's why I'm having hard time finding information.. | 20:47 |
| Adobeman | I was reading some IBM documentation other day.. | 20:47 |
| Adobeman | majority of people just goes with AD since they already exist | 20:47 |
| Adobeman | I dont have an AD to tight this into it, almost tempting to set one up at this point.. | 20:47 |
| morgan | stevemar: *poke* maybe henry-nash has info for Adobeman if we can chase down henry | 20:48 |
| morgan | Adobeman: ayoung (if you can catch him) is a great resource for openldap stuff. | 20:48 |
| ayoung | lies | 20:48 |
| stevemar | morgan: henry is a hard man to find these days :( | 20:48 |
| morgan | Adobeman: are you just looking for "what the scheema" should be? | 20:48 |
| Adobeman | I'm currently not even at the point I can even ask that question | 20:48 |
| morgan | Adobeman: because the default schema in FreeIPA is pretty darn good once you map the attributes | 20:48 |
| ayoung | ++ | 20:48 |
| Adobeman | I heard about FreeIPA.. | 20:49 |
| ayoung | Go FreeIPA | 20:49 |
| morgan | and FreeIPA makes it a lot easier (you just need to configure some minor things in keystone to point at the right place and use the smarter "enabled" flag) | 20:49 |
| Adobeman | I have an cert issue right now.. | 20:49 |
| stevemar | Adobeman: i blogged about it ealier ... | 20:49 |
| stevemar | but never ended up using certs | 20:49 |
| morgan | ah, TLSstuff. | 20:49 |
| Adobeman | yes | 20:49 |
| morgan | it should work with self-signed certs fwiw | 20:49 |
| morgan | but it probably requires a single file with the whole chain in it | 20:50 |
| Adobeman | mfisch supposedly have cert stuff working, he blogged about it. | 20:50 |
| morgan | i can't remember the best format off the top of my head. | 20:50 |
| Adobeman | according to him, TLS is an requiremment for this to work properly.. | 20:50 |
| morgan | TLS is a requirement for this work with any level of security | 20:50 |
| Adobeman | it just flat out break .. only if I can get this cert issue out of the way.. | 20:50 |
| morgan | which i take as "not usable otherwise" | 20:50 |
| Adobeman | of course, not disagreeing | 20:50 |
| morgan | iirc i think you need the whole chain in the supplied Cert file and specify the proper CA-Cert as well | 20:51 |
| morgan | it has been a while since I did a FreeIPA keystone deploy | 20:51 |
| morgan | i assume you're not trying to use LDAP as the main identity backend, but as a specific domain backend | 20:51 |
| morgan | if you're trying to do the whole idnetity backend as LDAP, you're going to be in for a rough ride as a lot of features will not work correctly within keystone | 20:52 |
| morgan | LDAP is really (at this point) designed to back specific domains for identity information | 20:52 |
| morgan | so we can lean on the more flexible SQL stuff for things like service users (or even so service users can be isolated to a separate DN in LDAP trees) | 20:52 |
| morgan | but in short, FreeIPA is damn good and makes the whole "getting LDAP stood up right" a lot easier | 20:53 |
| morgan | also nkinder is a good resource if he's ever online. | 20:53 |
| Adobeman | morgan: I am trying to use it as main idenity backend... | 20:53 |
| Adobeman | I have not drift off to multiple domain setup yet | 20:53 |
| morgan | ah, that is going to be a lot more rough to setup | 20:54 |
| Adobeman | okay | 20:54 |
| morgan | IMO it is much much better to setup a keystone running SQL backend, setup a new domain and back it with LDAP | 20:54 |
| Adobeman | I thought it would be easier..? | 20:54 |
| morgan | it used to be | 20:54 |
| ayoung | FreeIPA is a CA | 20:54 |
| ayoung | use it to sign your certs | 20:54 |
| morgan | but with all the more advanced features it is much easier to drop in LDAP behind a specific domain | 20:55 |
| Adobeman | so I can stop staring at this error? Peer's certificate issuer has been marked as not trusted by the user | 20:55 |
| morgan | it does mean you have to use V3 keystone | 20:55 |
| Adobeman | I am using v3.. | 20:55 |
| Adobeman | well, I see some v2 fly by.. | 20:55 |
| morgan | Adobeman: that is likely to be an issue you'll still see, that tells me that either the chain or the ca cert files is wrong | 20:55 |
| morgan | and i think OpenLDAP needs to have the same CA cert in it's config | 20:56 |
| morgan | so it can know the issuer is sane | 20:56 |
| morgan | you *might* be able to get it to work by adding the CA to the system CA | 20:57 |
| morgan | CA trust | 20:57 |
| Adobeman | the bundle file I have got at least..167 certs | 20:57 |
| Adobeman | came with the system .. | 20:57 |
| morgan | likely the issue is OpenLDAP not trusting the CA then. | 20:57 |
| ayoung | Use FreeIPA please and make this all go away | 20:58 |
| morgan | i *think* again... i haven't done this in a looong time | 20:58 |
| morgan | FreeIPA likely will make this much easier | 20:58 |
| dstanek | morgan: the tls_cacertfile should have fixed the issue though | 20:58 |
| morgan | dstanek: maybe. | 20:58 |
| morgan | sadly, we don't test this stuff | 20:58 |
| morgan | sooooo it might be broken | 20:58 |
| morgan | s/might/has a higher than average chance/ | 20:58 |
| morgan | if we can drop in a FreeIPA on a devstack... we could make this work. | 20:59 |
| morgan | and be tested | 20:59 |
| ayoung | can't | 21:00 |
| ayoung | IPA needs a stand alone machine | 21:00 |
| ayoung | does not play nice with others | 21:00 |
| *** lucas_ has quit IRC | 21:01 | |
| morgan | it needs a standalone ip/vhost | 21:01 |
| ayoung | maybe if we did a container based deploy AKA Kolla | 21:01 |
| morgan | it doesn't need a standalone machine. | 21:01 |
| dstanek | ayoung: same machine with a difference container? | 21:01 |
| morgan | container would work too | 21:01 |
| morgan | we also have multi- node gating possible now | 21:01 |
| ayoung | I was able to get container based to work | 21:01 |
| morgan | it wouldn't be impossible to setup IPA | 21:01 |
| morgan | on the multi-node | 21:01 |
| ayoung | do multi-nodes get a known resolvable hostname and IP addres? | 21:01 |
| morgan | should | 21:02 |
| morgan | wel hostnames... probably not | 21:02 |
| morgan | ip's yes. | 21:02 |
| morgan | you need to be able to reference the IPs from another host | 21:02 |
| ayoung | IP should be enough | 21:02 |
| morgan | aka, compute on host A, rest of openstack on B | 21:02 |
| ayoung | getting the initial nameserver resolution set up tends to be the pain point | 21:02 |
| ayoung | I usually just hack /etc/hosts | 21:02 |
| ayoung | https://adam.younglogic.com/2015/06/install-freeipa-ansible/ | 21:03 |
| Adobeman | this question is most likely beyond this channel... getting open openldap to be same CA? | 21:04 |
| ayoung | Adobeman, do you have an openldap setup already? | 21:04 |
| Adobeman | yes | 21:04 |
| Adobeman | opendlap is up and running, authenticate user ssh/linux setup.. | 21:05 |
| Adobeman | talk tls too, tested that's working.. | 21:05 |
| ayoung | Adobeman, what are you using for a CA? | 21:05 |
| Adobeman | whatever came with the OS.. | 21:06 |
| Adobeman | I just generated self sign cert and go with it | 21:06 |
| Adobeman | I threw cert files into ldap directory already | 21:07 |
| *** lucas_ has joined #openstack-keystone | 21:08 | |
| Adobeman | generated this morning :P | 21:08 |
| Adobeman | -rw-r--r-- 1 ldap ldap 1363 Jan 30 06:42 /etc/openldap/certs/server.crt | 21:08 |
| Adobeman | /etc/openldap/certs/ca-bundle.crt /etc/openldap/certs/server.key ..etc | 21:09 |
| Adobeman | they are all defined in olcTLSCACertificateFile olcTLSCertificateFile olcTLSCertificateKeyFile | 21:09 |
| *** raildo has quit IRC | 21:11 | |
| ayoung | Adobeman, yeah...if this is going to be any form of production run, you'll want a real CA | 21:18 |
| ayoung | Adobeman, just IPA it...unless you are solidly vested in the OpenLDAP approach, it is not worth the effort to set all the things you need up manually | 21:19 |
| *** jaosorior_lunch is now known as jaosorior | 21:21 | |
| *** ravelar has quit IRC | 21:22 | |
| morgan | ayoung: thanks for jumping in here | 21:24 |
| ayoung | morgan, just don't let it happen again | 21:24 |
| morgan | ayoung: appreciate the added commentary (helps me because i'ts been a while sine i pokedd at this stuff) | 21:24 |
| Adobeman | ok, let me look into IPA | 21:25 |
| * morgan makes note ayoung is the person who'll respond for all LDAP questions >.> | 21:25 | |
| morgan | <.< | 21:25 |
| morgan | ^_^ | 21:25 |
| ayoung | morgan, I lie | 21:25 |
| lbragstad | morgan looking at https://review.openstack.org/#/c/418166/14/keystone/identity/backends/resource_options.py | 21:28 |
| morgan | lbragstad: yep. | 21:28 |
| lbragstad | we have a json schema definition at line 75 - but we also have the _mfa_rules_validator_list_of_lists_of_strings_no_duplicates method | 21:29 |
| morgan | yes. this validator is used when storing data to the db | 21:29 |
| morgan | before being written to the option. | 21:29 |
| morgan | the json-schema is used at the edge | 21:29 |
| lbragstad | morgan you mean at the controller/api layer | 21:29 |
| Adobeman | morgan: haha... | 21:29 |
| morgan | yeah schema is at the controller level | 21:29 |
| lbragstad | right | 21:30 |
| morgan | and this is used to protect against code that manipulates options | 21:30 |
| morgan | it is suspenders and a belt | 21:30 |
| lbragstad | if we validate things there - whats the purpose of having the homegrown method/ | 21:30 |
| morgan | if code (not API calls) touch mfa options | 21:30 |
| stevemar | lbragstad: validation is for stuff we can't check with json schema | 21:30 |
| morgan | we want it to be proper form | 21:30 |
| lbragstad | oh | 21:31 |
| morgan | if the MFA Rules are not list-of-lists comprised of strings (aka [["thing", "thing"], ["other", "thing2"]] | 21:31 |
| lbragstad | so something in one of the managers | 21:31 |
| morgan | we throw out the rules (possibly all of them) to ensure auth is possible | 21:31 |
| morgan | auth > MFA rules. period | 21:31 |
| lbragstad | or if there was business logic somewhere that did stuff with the mfa options | 21:31 |
| morgan | right we add business logic that changed the user option(s) | 21:32 |
| morgan | we want to ensure the values are sane | 21:32 |
| morgan | this is in the .from_dict bits | 21:32 |
| morgan | on the model | 21:32 |
| lbragstad | right | 21:32 |
| stevemar | lbragstad: something like this: https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L662 | 21:32 |
| lbragstad | ok | 21:32 |
| morgan | before we build the _resource_options dict that the SQL driver writes to the attribute_mapper | 21:32 |
| morgan | we run the validator over the data | 21:32 |
| morgan | the key is the validator always allows None, no matter how much you try and code around it | 21:33 |
| morgan | since we don't run the validator on None values | 21:33 |
| morgan | otherwise the validator runs and raises an exception all the way back out | 21:33 |
| morgan | if an end user sees that exception, it's a programming error | 21:33 |
| morgan | json-schema should prevent API users from ever seeing a type error/value error from that method | 21:33 |
| morgan | but json schema can't protect us (e.g.) in all of our unit tests or new business logic down the line | 21:34 |
| lbragstad | yeah - i see it now | 21:34 |
| lbragstad | hmm | 21:34 |
| morgan | aka if we actually do totp-secret generation and more directed APIs to ensure the auth methods pass before setting MFA rules | 21:34 |
| morgan | also, the validator was written before the json schema bits were | 21:35 |
| morgan | json schema was an addon to make end user API requests better/more consistent | 21:35 |
| morgan | separation of concerns. data to the data-store vs validation of RESTful request | 21:35 |
| morgan | body | 21:35 |
| morgan | lbragstad: also, that is changed slightly when i added the test(s) | 21:36 |
| morgan | lbragstad: https://review.openstack.org/#/c/423548/11/keystone/identity/backends/resource_options.py | 21:36 |
| morgan | test showed a few bugs. | 21:36 |
| morgan | didn't ratchet the fixes down the stack because if we're not landing 423548, we shouldn't land 418166 | 21:37 |
| lbragstad | morgan so all the tests here actually just test the api validation at the controller layer https://review.openstack.org/#/c/418166/14/keystone/tests/unit/test_validation.py,unified | 21:37 |
| morgan | correct | 21:37 |
| *** ravelar has joined #openstack-keystone | 21:37 | |
| morgan | that JUSTvalidates the json-schema bits | 21:37 |
| morgan | 423548 implements full data flow logic tests | 21:38 |
| lbragstad | do we have anything that tests _mfa_rules_validator_list_of_lists_of_strings_no_duplicates does the same thing as the jsonschema bits? | 21:38 |
| morgan | no, but should be easy to do so. | 21:38 |
| morgan | we could add a test in a followup. | 21:38 |
| lbragstad | (because they should be enforcing the same contract if I'm understanding that correctly) | 21:38 |
| morgan | yes they should | 21:38 |
| lbragstad | ok - cool | 21:38 |
| morgan | would be easy to just run the _mfa..........too-long-function-name validator | 21:39 |
| morgan | against the same mfa_rules data the validator is run against | 21:39 |
| *** catintheroof has quit IRC | 21:40 | |
| lbragstad | yeah - that would work | 21:40 |
| *** jose-phillips has quit IRC | 21:41 | |
| lbragstad | i'd hate for either of those validation approaches to get out of sync with each other | 21:41 |
| *** catintheroof has joined #openstack-keystone | 21:42 | |
| morgan | i'll spin up another patch for that | 21:42 |
| morgan | at the end of the chain | 21:42 |
| lbragstad | morgan works for me | 21:42 |
| morgan | lbragstad: responded to your comment on the patch as well | 21:45 |
| *** ravelar has quit IRC | 21:45 | |
| lbragstad | morgan sweet | 21:45 |
| *** jose-phillips has joined #openstack-keystone | 21:48 | |
| lbragstad | morgan are we expecting folks who maintain their own auth plugins to return a `base.AuthHandlerResponse()` object? | 21:51 |
| morgan | lbragstad: yep | 21:51 |
| lbragstad | ok | 21:51 |
| morgan | if they don't, it wont work now ;) | 21:51 |
| *** catinthe_ has joined #openstack-keystone | 21:52 | |
| *** catintheroof has quit IRC | 21:53 | |
| stevemar | crinkle: does the federated auth problem only happen if you have v2 enabled in horizon? | 21:54 |
| stevemar | crinkle: or is it always happening? | 21:54 |
| stevemar | crinkle: lbragstad https://bugs.launchpad.net/keystoneauth/+bug/1660436 | 21:55 |
| openstack | Launchpad bug 1660436 in python-novaclient "Federated users cannot log into horizon" [Undecided,New] | 21:55 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Use https for docs.openstack.org references https://review.openstack.org/426944 | 21:55 |
| crinkle | stevemar: I don't think I have v2 enabled in horizon, I have OPENSTACK_API_VERSIONS={"identity":3} and OPENSTACK_KEYSTONE_URL="http://192.168.122.105/identity/v3" | 21:57 |
| stevemar | crinkle: gah! | 21:58 |
| stevemar | crinkle: using master right? | 21:59 |
| lbragstad | morgan whats the difference between response_body and response_data? | 21:59 |
| crinkle | stevemar: yep | 21:59 |
| lbragstad | morgan i see that response_data holds stuff formally in auth_context | 21:59 |
| lbragstad | morgan so far I don't think I see response_body set or used anywhere(?) | 22:00 |
| stevemar | crinkle: shouldn't the federated user have domain information now? that stuff merged a few days ago | 22:00 |
| *** catintheroof has joined #openstack-keystone | 22:04 | |
| *** jaugustine has quit IRC | 22:04 | |
| jamielennox | so ideally horizon should never be hitting that section of novaclient | 22:04 |
| jamielennox | horizon would create the session having already done auth with domain information and then just pass that on through to novaclient | 22:04 |
| jamielennox | anything that hits that code is doing (at least one) additional round trip to keystone that shouldn't be necessary | 22:05 |
| crinkle | stevemar: I think if we'd continued on patchset 5 of https://review.openstack.org/#/c/389337 it might have the domain info but that was too big of a scope, so the final result only partially implemented it and i think that only gets us as far as the the user being able to log in, and this problem happens after that when novaclient is trying to reauthenticate | 22:05 |
| crinkle | jamielennox: right | 22:05 |
| jamielennox | passing token in with project_X information is asking for a rescope | 22:05 |
| *** catinthe_ has quit IRC | 22:07 | |
| morgan | lbragstad: it is used when a challnege response like pliugin is done | 22:10 |
| morgan | lbragstad: it's mostly just for purposes of compat with previous behavior... we never implemented something that worked like that outside of tests | 22:10 |
| robcresswell | stevemar, crinkle: Assigned myself to that bug | 22:12 |
| crinkle | thanks robcresswell | 22:13 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add validation for mfa rule validator (storage) https://review.openstack.org/426955 | 22:17 |
| morgan | lbragstad: ^ | 22:17 |
| lbragstad | morgan sweet - thanks | 22:17 |
| *** jose-phillips has quit IRC | 22:17 | |
| morgan | gonna have a pep8 issue | 22:17 |
| morgan | gotta fix | 22:17 |
| *** catinthe_ has joined #openstack-keystone | 22:17 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add validation for mfa rule validator (storage) https://review.openstack.org/426955 | 22:18 |
| morgan | lbragstad: there ^ | 22:18 |
| *** catinth__ has joined #openstack-keystone | 22:18 | |
| *** catintheroof has quit IRC | 22:18 | |
| *** jose-phillips has joined #openstack-keystone | 22:19 | |
| stevemar | crinkle: jamielennox robcresswell won't this possible happen with other clients, like glance or cinder? | 22:19 |
| jamielennox | stevemar: what exactly? | 22:20 |
| jamielennox | the rescope? | 22:20 |
| stevemar | yeah | 22:20 |
| morgan | lbragstad: just thought of another test i need to add for MFA | 22:21 |
| robcresswell | I'm gonna crash for the night, I'll catch up tomorrow | 22:21 |
| jamielennox | stevemar: gah, probably - it's super hard to say exactly what behaviour you get with the clients when you pass through that information directly | 22:21 |
| jamielennox | but yea, most likely it'll rescope | 22:21 |
| *** catinthe_ has quit IRC | 22:22 | |
| morgan | lbragstad: dealing with rescope and ensuring a token maintains the methods and passes MFA | 22:22 |
| morgan | lbragstad: without explicitly needing to specify token | 22:23 |
| stevemar | jamielennox: yeah, we probably can assume clients will do silly things | 22:23 |
| jamielennox | i know i once looked at fixing all this for horizon, but they have a fairly complex login process and there is a seperation between DOA and horizon itself that I'm not sure how to bridge | 22:28 |
| jamielennox | i'm sure it could be figured out | 22:28 |
| *** catinth__ has quit IRC | 22:29 | |
| *** Jack_I has quit IRC | 22:30 | |
| *** stingaci has quit IRC | 22:31 | |
| *** edmondsw has quit IRC | 22:34 | |
| *** thorst_ has quit IRC | 22:36 | |
| stevemar | jamielennox: i'll mull it over, do the same. not really sure where the fix for this should go | 22:40 |
| jamielennox | stevemar: i came into this quite late so i'm not aware of all the details, but really we should teach DOA/horizon to start using sessions | 22:40 |
| stevemar | jamielennox: i found out about it when i wrote stuff in irc :) | 22:40 |
| morgan | lbragstad: huh. something is wonky again | 22:41 |
| morgan | i can't seem to validate a token when trying to re-scope here. | 22:41 |
| jamielennox | in theory it's an easy switch over, in practice there is a lot of support stuff there that horizon has done in the past they would need to remove | 22:41 |
| morgan | lbragstad: let me post this and you can take a look. | 22:41 |
| lbragstad | morgan ok | 22:41 |
| david-lyle | requests to horizon are not even guaranteed to hit the same server, how big is the keystone session objecT? | 22:44 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add validation that token method isn't needed in MFARules https://review.openstack.org/426959 | 22:44 |
| morgan | lbragstad: ^ that should add the test | 22:45 |
| lbragstad | morgan is that going to fail? | 22:45 |
| morgan | dstanek: the token_id, and some metadata. | 22:45 |
| morgan | lbragstad: it should fail | 22:45 |
| morgan | lbragstad: i can't get the second auth_req to work | 22:45 |
| morgan | the token rescope says "failed to validate token" | 22:45 |
| morgan | will dig further. | 22:45 |
| morgan | but.... | 22:45 |
| morgan | aroooo? | 22:45 |
| morgan | lbragstad: it's an addon test only patch to make sure the rest of the chain can land. | 22:46 |
| morgan | lbragstad: :) and easy to review comparitive to lumping it in the big changes | 22:46 |
| *** adrian_otto has joined #openstack-keystone | 22:47 | |
| *** pramodrj07 has joined #openstack-keystone | 22:49 | |
| jamielennox | david-lyle: it's not so much that it's big as that it's not serializable | 22:50 |
| jamielennox | and actually thinking about it that might be why i failed last time | 22:50 |
| lbragstad | morgan i'm having a hard time not mixing rule_lists with methods | 22:50 |
| david-lyle | that would be problematic | 22:51 |
| jamielennox | since then there is an inbuilt way to serialize most plugins, but i'm assuming horizon would want more control than that | 22:51 |
| *** MasterOfBugs has quit IRC | 22:51 | |
| david-lyle | jamielennox: the issue for Horizon is we don't maintain session state for users on the Horizon server, we pass the information with the request, or it's stored in a user session backend | 22:52 |
| jamielennox | i think we could mostly get around that but we would need to make a horizon specific auth plugin that is serializable in a way they can control | 22:52 |
| jamielennox | yea | 22:52 |
| morgan | lbragstad: explain? | 22:52 |
| david-lyle | agree | 22:52 |
| jamielennox | so session can be shared, i think you could have a single object for all of horizon, and then just reconstitute the auth plugin from session backend on every request | 22:53 |
| david-lyle | not sure I follow about single object for all of horizon. All users share the same object?? | 22:56 |
| jamielennox | so session without auth is basically just pass through support for connection pooling and such | 23:00 |
| jamielennox | without auth it basically just provides a few tweaks on requests.Session | 23:00 |
| jamielennox | auth state is maintained in the plugin and you can pass Client(session, auth) to most clients instead of Session(auth) | 23:01 |
| *** edtubill has quit IRC | 23:01 | |
| *** thorst_ has joined #openstack-keystone | 23:06 | |
| lbragstad | morgan i just automatically associate lists like ['password', 'totp'] or ['password', 'token'] to be method lists, | 23:06 |
| *** slberger has left #openstack-keystone | 23:09 | |
| *** thorst_ has quit IRC | 23:10 | |
| morgan | lbragstad: haha okie | 23:12 |
| *** adrian_otto has quit IRC | 23:13 | |
| morgan | topol: ... no love ... no love at all | 23:13 |
| *** jrist has quit IRC | 23:13 | |
| topol | morgan, bahahaha. I have high standards on bagels :-) | 23:14 |
| morgan | topol: so do i... it's why i'm trying to make my own vs the doughy-gross west-coast things | 23:17 |
| morgan | topol: to be fair, i know what went wrong and mostly it was the dough being too sticky, so was hard to make nice and round | 23:17 |
| topol | morgan, with a little time Im sure yours will be incredible, I would expect nothing less from you | 23:18 |
| morgan | topol: but the taste was almost perfectly spot on for nice east-coast style | 23:18 |
| *** martinlopes_ has quit IRC | 23:19 | |
| morgan | lbragstad: i can't figure out why that token isn't validating correctly | 23:19 |
| morgan | lbragstad: getting a 404 tokennotfound =/ | 23:19 |
| lbragstad | morgan nothing is jumping out at me either | 23:19 |
| topol | morgan, NICE! | 23:20 |
| morgan | lbragstad: gAAAAABYj8BmZiQeG-Au1gPbqDBGFgBH9YZwZJHs15ljq0yF6fiQTQt3D-WWOnVT8yV_awWTHx1hUw9sgQ6BlmI9rmpIa0pCQFYoy26Nxk1IF6Kql4kpQxzx2BM1C74ZcPJuDfAGHrCTiYF9YAHRc39zlz9OF6Y31g looks correct | 23:20 |
| lbragstad | morgan i gotta run quick - but I'm going to poke at it tonight | 23:20 |
| morgan | lbragstad: anyway, the rest of the stuff should still be good to land. and clearly we didn't break token rescoping, just that specific mechanism of testing rescope seems off somehow | 23:20 |
| lbragstad | morgan yeah - i was going to check to make sure https://github.com/openstack/keystone/blob/781db8e67a08674ad27310be2aa21d73868f8a3b/keystone/auth/plugins/core.py#L44-L58 wasn't doing anything strange - but that's a wild guess | 23:21 |
| morgan | i was digging into the provider now | 23:27 |
| morgan | the plugin seems sane | 23:27 |
| morgan | something is weird. | 23:27 |
| *** jrist has joined #openstack-keystone | 23:29 | |
| *** martinlopes has joined #openstack-keystone | 23:34 | |
| *** lucas_ has quit IRC | 23:35 | |
| *** sileht has quit IRC | 23:37 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Extend User API to support federated attributes https://review.openstack.org/426449 | 23:38 |
| *** martinlopes has quit IRC | 23:39 | |
| *** sileht has joined #openstack-keystone | 23:41 | |
| *** martinlopes has joined #openstack-keystone | 23:45 | |
| *** catintheroof has joined #openstack-keystone | 23:50 | |
| *** jamielennox is now known as jamielennox|away | 23:58 | |
| *** jamielennox|away is now known as jamielennox | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!