| *** agrebennikov has quit IRC | 00:03 | |
| *** henrynash has quit IRC | 00:34 | |
| *** henrynash has joined #openstack-keystone | 00:35 | |
| *** browne has quit IRC | 00:37 | |
| adriant | From memory, Keystone supports some sort of filtering on the API beyond the basic stuff. Is all of this documented somewhere? | 00:42 |
|---|---|---|
| adriant | What I'm hoping to do is call keystone project list with a filter like: "project_id in [...]" | 00:43 |
| adriant | because otherwise I have to do one API call be item in that list to project GET which is silly | 00:43 |
| adriant | call per* item | 00:44 |
| adriant | I have a feeling this isn't supported, but I remember some spec somewhere for filters on some APIs so I thought I'd ask. | 00:44 |
| *** henrynash has quit IRC | 00:45 | |
| *** Shunli has joined #openstack-keystone | 00:45 | |
| *** henrynash has joined #openstack-keystone | 00:46 | |
| *** rderose has quit IRC | 00:46 | |
| *** rdo_ has quit IRC | 00:49 | |
| *** henrynash has quit IRC | 00:56 | |
| *** edmondsw has joined #openstack-keystone | 00:56 | |
| *** rdo has joined #openstack-keystone | 00:57 | |
| *** jamielennox is now known as jamielennox|away | 00:58 | |
| notmorgan | adriant: the filtering is weird and only sortof really supported | 01:11 |
| notmorgan | adriant: also note all the project data is available in the list call, so you could list and consume the data directly | 01:12 |
| notmorgan | the keystoneclient list, then get, is silly | 01:12 |
| adriant | yeah... but I'd prefer not to list ALL projects :P | 01:12 |
| *** jamielennox|away is now known as jamielennox | 01:12 | |
| adriant | I want to list, but filter for only the projects I care about | 01:13 |
| notmorgan | project_id in [...], asfaik wouldn't work even if filtering was well supported | 01:13 |
| adriant | why? That seems like a very normal list filter | 01:13 |
| notmorgan | because we never implemented a filter like that | 01:13 |
| notmorgan | the filter is very very limited. | 01:14 |
| adriant | yeah, I can do list where name="..." | 01:14 |
| adriant | and such | 01:14 |
| notmorgan | also, it would have to be done in a URL-safe manner, which is wonky to represent short of | 01:14 |
| notmorgan | it is a VERY limited filter. | 01:14 |
| notmorgan | ?name=<thing> | 01:14 |
| adriant | yeah :( | 01:14 |
| notmorgan | but you can't do regexes really | 01:15 |
| notmorgan | nor can you do a list of names | 01:15 |
| adriant | although I could avoid the need for this if I can get subtree_as_list to work | 01:15 |
| adriant | which for some reason it doesn't for me | 01:15 |
| adriant | am rebuilding my devstack to try again | 01:15 |
| notmorgan | i have no idea if that ever worked. fwiw, i've never tested it | 01:15 |
| notmorgan | and i don't know if we actually fully test it | 01:16 |
| adriant | subtree_as_ids works | 01:16 |
| notmorgan | same comment ^ | 01:16 |
| adriant | but then.. I just have ids | 01:16 |
| notmorgan | ;) | 01:16 |
| adriant | ugh, all these half baked features :P | 01:16 |
| adriant | I feel like I'm going to be throwing in a lot of bug reports at this rate | 01:16 |
| *** browne has joined #openstack-keystone | 01:18 | |
| *** browne has quit IRC | 01:18 | |
| *** Shunli has quit IRC | 01:19 | |
| *** Shunli has joined #openstack-keystone | 01:20 | |
| adriant | notmorgan, although on url safe way to do filters is actually: ?'project_id__in=e9a2ff8c49824bee9406c2e31321cb86&project_id__in=556d8f4a9b654982b1d33068fe3653ea' | 01:22 |
| adriant | wait... no | 01:22 |
| adriant | ugh that didn't format right | 01:22 |
| adriant | sec | 01:22 |
| adriant | although... | 01:22 |
| openstackgerrit | Anthony Washington proposed openstack/oslo.policy master: Add additional param to policy.RuleDefault https://review.openstack.org/439070 | 01:23 |
| adriant | actually that would work in a way | 01:23 |
| *** guoshan has joined #openstack-keystone | 01:28 | |
| adriant | notmorgan, ugh that's right. | 01:29 |
| adriant | '/project?filters=%7B%22project_id__in%22%3A+%5B%22e9a2ff8c49824bee9406c2e31321cb86%22%2C+%22556d8f4a9b654982b1d33068fe3653ea%22%5D%7D' | 01:29 |
| adriant | you can kind of do it if dump the filter in as a json string | 01:29 |
| adriant | which is a touch ugly | 01:29 |
| adriant | that's how I got around the problem for something I was doing | 01:30 |
| *** zhurong has joined #openstack-keystone | 01:32 | |
| *** namnh has joined #openstack-keystone | 01:37 | |
| *** tovin07 has joined #openstack-keystone | 01:42 | |
| notmorgan | i would say don't do that... at all. | 01:43 |
| notmorgan | but but then again i think our filtering is particularly bad | 01:44 |
| notmorgan | since it's very partially implemented | 01:44 |
| *** liujiong has joined #openstack-keystone | 01:48 | |
| *** knangia has quit IRC | 01:51 | |
| *** davechen has quit IRC | 01:51 | |
| *** davechen has joined #openstack-keystone | 01:52 | |
| *** wangqun has joined #openstack-keystone | 02:09 | |
| adriant | notmorgan, yeah... I know. It's ugly, but in my case I wanted filtering which I could convert to django orm filters, and since no one in their right mind would touch the API url directly, encoding the json string was easy. | 02:27 |
| adriant | although i do believe django-rest-framework implemented some sort of filtering... | 02:28 |
| adriant | https://github.com/miki725/django-url-filter | 02:30 |
| adriant | notmorgan, that's not a terrible approach ^ | 02:30 |
| adriant | I should really switch my service to use that filtering style | 02:30 |
| *** zzzeek has quit IRC | 02:30 | |
| *** zzzeek has joined #openstack-keystone | 02:31 | |
| adriant | "example.com/listview/?id__in=1,2,3" | 02:31 |
| adriant | or "example.com/users/?email__contains!=gmail" | 02:32 |
| adriant | ugh, used the wrong channel | 02:44 |
| adriant | notmorgan, yeah, subtree_as_list does not appear to actually work... :( | 02:44 |
| *** prashkre has joined #openstack-keystone | 02:48 | |
| *** masber has quit IRC | 02:51 | |
| adriant | notmorgan, no... it's a feature: https://review.openstack.org/#/c/167231/ | 02:51 |
| *** masber has joined #openstack-keystone | 02:51 | |
| *** MasterOfBugs has quit IRC | 02:54 | |
| *** dnalezyty has quit IRC | 02:59 | |
| *** namnh_ has joined #openstack-keystone | 02:59 | |
| *** namnh has quit IRC | 03:03 | |
| *** namnh_ has quit IRC | 03:07 | |
| *** nicolasbock has quit IRC | 03:13 | |
| *** aojea has joined #openstack-keystone | 03:31 | |
| *** aojea has quit IRC | 03:35 | |
| *** wxy has quit IRC | 03:38 | |
| *** namnh has joined #openstack-keystone | 03:40 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 03:55 | |
| *** zsli_ has joined #openstack-keystone | 03:56 | |
| *** edmondsw has quit IRC | 03:58 | |
| *** Shunli has quit IRC | 03:59 | |
| *** prashkre has quit IRC | 03:59 | |
| *** guoshan has quit IRC | 04:05 | |
| *** prashkre has joined #openstack-keystone | 04:08 | |
| *** zsli__ has joined #openstack-keystone | 04:15 | |
| *** zsli__ has quit IRC | 04:18 | |
| *** zsli_ has quit IRC | 04:18 | |
| *** zsli__ has joined #openstack-keystone | 04:18 | |
| *** prashkre has quit IRC | 04:29 | |
| *** zsli_ has joined #openstack-keystone | 04:34 | |
| *** links has joined #openstack-keystone | 04:35 | |
| *** zsli__ has quit IRC | 04:36 | |
| *** MasterOfBugs has joined #openstack-keystone | 04:47 | |
| *** edmondsw has joined #openstack-keystone | 04:53 | |
| *** zsli_ has quit IRC | 04:55 | |
| *** edmondsw has quit IRC | 04:57 | |
| *** knangia has joined #openstack-keystone | 04:59 | |
| *** zsli_ has joined #openstack-keystone | 05:00 | |
| *** zsli_ has quit IRC | 05:00 | |
| *** richm has quit IRC | 05:43 | |
| *** dikonoor has joined #openstack-keystone | 05:57 | |
| *** h5t4_ has quit IRC | 06:11 | |
| *** adriant has quit IRC | 06:11 | |
| *** david-lyle has quit IRC | 06:27 | |
| *** belmoreira has joined #openstack-keystone | 06:29 | |
| *** Shunli has joined #openstack-keystone | 06:34 | |
| *** aojea has joined #openstack-keystone | 06:38 | |
| *** edmondsw has joined #openstack-keystone | 06:41 | |
| *** gyee has joined #openstack-keystone | 06:45 | |
| *** edmondsw has quit IRC | 06:46 | |
| *** gyee has quit IRC | 06:46 | |
| *** zsli_ has joined #openstack-keystone | 06:49 | |
| *** gyee has joined #openstack-keystone | 06:49 | |
| *** gyee has quit IRC | 06:50 | |
| *** Shunli has quit IRC | 06:51 | |
| *** zsli_ has quit IRC | 06:59 | |
| *** zsli_ has joined #openstack-keystone | 06:59 | |
| *** zsli__ has joined #openstack-keystone | 07:01 | |
| *** zsli_ has quit IRC | 07:04 | |
| *** h5t4 has joined #openstack-keystone | 07:08 | |
| *** tesseract has joined #openstack-keystone | 07:20 | |
| *** knangia has quit IRC | 07:21 | |
| *** zsli__ has quit IRC | 07:33 | |
| *** MasterOfBugs has quit IRC | 07:48 | |
| *** pcaruana has joined #openstack-keystone | 07:50 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** h5t4 has quit IRC | 08:10 | |
| *** jaosorior has joined #openstack-keystone | 08:24 | |
| *** edmondsw has joined #openstack-keystone | 08:29 | |
| *** edmondsw has quit IRC | 08:34 | |
| *** guoshan has joined #openstack-keystone | 08:40 | |
| *** guoshan has quit IRC | 08:52 | |
| *** henrynash has joined #openstack-keystone | 09:04 | |
| *** Shunli has joined #openstack-keystone | 09:08 | |
| *** Shunli has quit IRC | 09:09 | |
| *** Shunli has joined #openstack-keystone | 09:09 | |
| *** guoshan has joined #openstack-keystone | 09:18 | |
| openstackgerrit | Jose Castro Leon proposed openstack/keystone master: Skip multifactor when using LDAP identity backend https://review.openstack.org/444949 | 09:23 |
| *** Shunli has quit IRC | 09:37 | |
| *** wangqun has quit IRC | 09:49 | |
| *** zhurong has quit IRC | 09:54 | |
| *** aojea has quit IRC | 10:00 | |
| *** nicolasbock has joined #openstack-keystone | 10:04 | |
| *** namnh has quit IRC | 10:09 | |
| *** richm has joined #openstack-keystone | 10:13 | |
| *** edmondsw has joined #openstack-keystone | 10:17 | |
| *** aojea has joined #openstack-keystone | 10:21 | |
| *** liujiong has quit IRC | 10:21 | |
| *** edmondsw has quit IRC | 10:22 | |
| *** aojea has quit IRC | 10:26 | |
| dr_gogeta86 | hi guys | 10:29 |
| dr_gogeta86 | any saml master here ... again :-D | 10:29 |
| *** Raildo has joined #openstack-keystone | 10:31 | |
| *** nicolasbock has quit IRC | 10:46 | |
| *** nicolasbock has joined #openstack-keystone | 10:48 | |
| *** henrynash has quit IRC | 11:07 | |
| *** Raildo is now known as raildo | 11:13 | |
| *** guoshan has quit IRC | 11:21 | |
| *** aasthad has quit IRC | 11:32 | |
| *** links has quit IRC | 11:36 | |
| *** namnh has joined #openstack-keystone | 11:38 | |
| *** namnh has quit IRC | 11:43 | |
| *** namnh has joined #openstack-keystone | 11:43 | |
| *** links has joined #openstack-keystone | 11:48 | |
| *** namnh has quit IRC | 11:52 | |
| *** dave-mccowan has joined #openstack-keystone | 12:00 | |
| *** yuval has joined #openstack-keystone | 12:04 | |
| *** yuval has quit IRC | 12:06 | |
| *** yuval has joined #openstack-keystone | 12:07 | |
| *** rvba` has quit IRC | 12:11 | |
| *** rvba has joined #openstack-keystone | 12:16 | |
| *** rvba has quit IRC | 12:17 | |
| *** rvba has joined #openstack-keystone | 12:17 | |
| *** edmondsw has joined #openstack-keystone | 12:22 | |
| *** edmondsw_ has joined #openstack-keystone | 12:26 | |
| *** edmondsw has quit IRC | 12:27 | |
| *** yuval has quit IRC | 12:31 | |
| *** yuval has joined #openstack-keystone | 12:31 | |
| *** aojea has joined #openstack-keystone | 12:45 | |
| *** links has quit IRC | 12:52 | |
| *** links has joined #openstack-keystone | 12:53 | |
| *** spilla has joined #openstack-keystone | 12:57 | |
| *** catintheroof has joined #openstack-keystone | 12:58 | |
| *** catintheroof has quit IRC | 12:59 | |
| *** catintheroof has joined #openstack-keystone | 12:59 | |
| rodrigods | lbragstad, notmorgan, what we discussed yesterday: https://bugs.launchpad.net/keystone/+bug/1672713 | 13:02 |
| openstack | Launchpad bug 1672713 in OpenStack Identity (keystone) "Dependency between subsystems at the DB layer" [Undecided,New] | 13:02 |
| *** lamt has joined #openstack-keystone | 13:03 | |
| *** chlong has joined #openstack-keystone | 13:05 | |
| *** markvoelker has quit IRC | 13:11 | |
| *** lamt has quit IRC | 13:12 | |
| *** aojea has quit IRC | 13:15 | |
| *** markvoelker has joined #openstack-keystone | 13:16 | |
| *** josecastroleon has joined #openstack-keystone | 13:21 | |
| EmilienM | is it required to restart keystone when doing fernet keys rotation? | 13:32 |
| lbragstad | EmilienM nope - keystone will read the keys from disk without needing a restart | 13:32 |
| EmilienM | that's an excellent news | 13:32 |
| EmilienM | thanks! | 13:32 |
| *** henrynash has joined #openstack-keystone | 13:35 | |
| josecastroleon | hi | 13:36 |
| josecastroleon | we are getting a very nice exception while authenticating in keystone with LDAP backend | 13:36 |
| josecastroleon | https://bugs.launchpad.net/keystone/+bug/1672425 | 13:37 |
| openstack | Launchpad bug 1672425 in OpenStack Identity (keystone) "No 'options' attribute in user_ref when using LDAP identity backend" [Undecided,In progress] - Assigned to Jose Castro Leon (jose-castro-leon) | 13:37 |
| lbragstad | EmilienM this is the bit of code the keystone uses to decrypt and encrypt tokens - https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/token_formatters.py#L45-L69 | 13:38 |
| -openstackstatus- NOTICE: Gerrit is going to be restarted due to performance problems | 13:39 | |
| *** ChanServ changes topic to "Gerrit is going to be restarted due to performance problems" | 13:39 | |
| lbragstad | EmilienM this is the line that makes sure we read new keys from the repository on every request https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/token_formatters.py#L63 | 13:39 |
| EmilienM | lbragstad: excellent | 13:39 |
| EmilienM | lbragstad: i'm currently writting a spec for TripleO, where we discuss about fernet key rotations, I'll let you know the link when it's pushed | 13:40 |
| lbragstad | EmilienM awesome - i'd be happy to review | 13:40 |
| EmilienM | lbragstad: thanks. And maybe move some workflow somewhere else, so others can re-use it | 13:40 |
| *** catinthe_ has joined #openstack-keystone | 13:41 | |
| lbragstad | EmilienM ++ | 13:41 |
| *** catintheroof has quit IRC | 13:41 | |
| lbragstad | EmilienM that sounds like something the openstack-ansible folks might be interested in | 13:42 |
| EmilienM | lbragstad: yes | 13:42 |
| *** knangia has joined #openstack-keystone | 13:44 | |
| *** catintheroof has joined #openstack-keystone | 13:45 | |
| -openstackstatus- NOTICE: Gerrit has been successfully restarted | 13:45 | |
| *** ChanServ changes topic to "Gerrit has been successfully restarted" | 13:45 | |
| *** catinthe_ has quit IRC | 13:45 | |
| *** ChanServ changes topic to "Meeting Agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h" | 13:52 | |
| -openstackstatus- NOTICE: Gerrit has been successfully restarted | 13:52 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone master: Drop federated_user table foreign keys https://review.openstack.org/445505 | 13:56 |
| *** links has quit IRC | 13:57 | |
| *** jaugustine has joined #openstack-keystone | 14:01 | |
| *** agrebennikov has joined #openstack-keystone | 14:09 | |
| *** lucasxu has joined #openstack-keystone | 14:11 | |
| *** chris_hultin|AWA is now known as chris_hultin | 14:16 | |
| *** dave-mccowan has quit IRC | 14:36 | |
| *** lamt has joined #openstack-keystone | 14:37 | |
| *** edmondsw has joined #openstack-keystone | 14:40 | |
| *** dikonoor has quit IRC | 14:45 | |
| *** dave-mccowan has joined #openstack-keystone | 14:51 | |
| *** edmondsw has quit IRC | 14:53 | |
| jaosorior | hey folks, we're trying to deploy OpenStack with versionless endpoints, and this required some changes to how some services instantiate keystoneclient/keystoneauth. It turns out, some folks are having issues with discovery due to the way they set up keystone behind a loadbalancer that terminates SSL connections in their deployments. So, it comes back to the issue where getting the hrefs from | 14:57 |
| jaosorior | keystone's json home returns some URLs with http instead of https. Now, I know the recommended approach is to use the public_endpoint configuration option for older deployments, and to use oslo.middleware's http_proxy_to_wsgi in newer ones. However, I was wondering if it would be acceptable to work around this in keystoneclient. It could remember the initial protocol specified in the auth_url, | 14:57 |
| jaosorior | and try if the protocol given by the resulting href from the json-home fails. What do you think? | 14:57 |
| jaosorior | rodrigods, lbragstad ^^ | 14:57 |
| *** henrynash has quit IRC | 15:00 | |
| *** henrynash has joined #openstack-keystone | 15:00 | |
| lbragstad | notmorgan didn't we have a bug similar to this opened after the resource options work? https://bugs.launchpad.net/keystone/+bug/1672425 | 15:01 |
| openstack | Launchpad bug 1672425 in OpenStack Identity (keystone) "No 'options' attribute in user_ref when using LDAP identity backend" [Undecided,In progress] - Assigned to Jose Castro Leon (jose-castro-leon) | 15:01 |
| rodrigods | jaosorior, good question :) | 15:03 |
| * rodrigods doesn't have good knowledge about this | 15:03 | |
| *** lucasxu has quit IRC | 15:04 | |
| *** aasthad has joined #openstack-keystone | 15:06 | |
| *** brad[] has quit IRC | 15:07 | |
| *** jaugustine has quit IRC | 15:13 | |
| *** adrian_otto has joined #openstack-keystone | 15:15 | |
| *** jaugustine has joined #openstack-keystone | 15:15 | |
| *** lucasxu has joined #openstack-keystone | 15:17 | |
| *** brad[] has joined #openstack-keystone | 15:19 | |
| *** nishaYadav has joined #openstack-keystone | 15:21 | |
| *** nishaYadav is now known as Guest58363 | 15:22 | |
| *** Guest58363 has quit IRC | 15:22 | |
| *** nishaYadav_ has joined #openstack-keystone | 15:22 | |
| nishaYadav_ | hey all o/ | 15:23 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add reno conventions to developer documentation https://review.openstack.org/444955 | 15:23 |
| gagehugo | nishaYadav_ o/ | 15:23 |
| nishaYadav_ | gagehugo, hey! | 15:24 |
| *** rderose has joined #openstack-keystone | 15:40 | |
| dr_gogeta86 | anyone configured saml with mod_auth_mellon ? | 15:49 |
| cmurphy | dr_gogeta86: I have, I don't know if I'd be able to help but it's a good idea to ask your question and someone can probably help | 15:50 |
| dr_gogeta86 | cmurphy, did you configured keystone as mapped or saml2 ? | 15:50 |
| cmurphy | dr_gogeta86: use 'mapped' | 15:51 |
| dr_gogeta86 | with wich idp ? | 15:52 |
| cmurphy | as long as you only have one idp, mapped should work for shibboleth or mellon or oidc | 15:53 |
| *** markvoelker has quit IRC | 15:56 | |
| *** markvoelker has joined #openstack-keystone | 15:58 | |
| dr_gogeta86 | in future can I have many | 16:03 |
| *** jaugustine has quit IRC | 16:03 | |
| cmurphy | there is some weirdness with setting remote_id_attribute in keystone.conf if you have different types of idps https://docs.openstack.org/developer/keystone/federation/websso.html#keystone-changes | 16:11 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/python-keystoneclient master: Workaround for unmatching scheme in discovery https://review.openstack.org/445559 | 16:12 |
| jaosorior | lbragstad, rodrigods: Here's a WIP patch regarding what I mentioned before: https://review.openstack.org/445559 | 16:12 |
| lbragstad | jaosorior nice | 16:13 |
| lbragstad | cc jamielennox ^ | 16:13 |
| dr_gogeta86 | cmurphy, is possible to don't find mapped onto mitaka | 16:14 |
| dr_gogeta86 | ? | 16:14 |
| openstackgerrit | Ron De Rose proposed openstack/keystone master: Policy in code (part 4) https://review.openstack.org/435755 | 16:15 |
| bknudson_ | jaosorior: keystoneclient isn't using json-home as far as I know | 16:15 |
| jaosorior | bknudson_: thought the root was json-home (not entirely compliant but yeah). And that's used by discovery. Unless I'm confusing concepts. | 16:16 |
| jaosorior | bknudson_: either way, that doesn't change the fact that the hrefs returned have the wrong scheme | 16:16 |
| jaosorior | bknudson_: in the case described in the commit message.... and in the long text I posted above. | 16:16 |
| bknudson_ | you can override the URLs in the version responses using public_endpoint and admin_endpoint: http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n19 | 16:17 |
| bknudson_ | also, there's this setting http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n93 (which is deprecated) | 16:18 |
| jaosorior | bknudson_: so, we have that issue solved in our deployments. However, when someone uses somebody else's cloud, they can't really control how their provider configures keystone | 16:20 |
| cmurphy | dr_gogeta86: I don't see mapped as an entrypoint for mitaka in http://git.openstack.org/cgit/openstack/keystone/tree/setup.cfg?h=stable/mitaka so it probably won't work | 16:20 |
| dr_gogeta86 | so ? | 16:20 |
| cmurphy | dr_gogeta86: so use 'saml2' as the name of the federation protocol | 16:21 |
| jaosorior | bknudson_: this is what motivates that patch. To try to make user's life easier | 16:21 |
| jaosorior | bknudson_: even though, yes, the deployer could address that as well. | 16:21 |
| jaosorior | bknudson_: but basically this is a blocker for more folks to use discovery: "the version of the client without discovery worked... and starting to use discovery broke me" | 16:22 |
| cmurphy | dr_gogeta86: I've got to go but there are lots of knowledeable people here so keep asking questions | 16:22 |
| bknudson_ | jaosorior: the problem is we've put workarounds into the client libraries before and we get complaints because it's masking deployment problems. | 16:26 |
| bknudson_ | see http://lists.openstack.org/pipermail/openstack-dev/2017-March/113210.html | 16:27 |
| bknudson_ | actually, it was feb: http://lists.openstack.org/pipermail/openstack-dev/2017-February/112943.html | 16:27 |
| jaosorior | I see | 16:28 |
| jaosorior | bknudson_: so, this is currently blocking me from getting glance deployed over swift to use versionless endpoints... So, is this that nasty of a workaround that it should be blocked? | 16:29 |
| bknudson_ | jaosorior: looks like what's blocking you is that keystone isn't configured correctly to work with the proxy. | 16:31 |
| jaosorior | bknudson_: it's not just one case | 16:31 |
| *** Dinesh_Bhor has quit IRC | 16:37 | |
| *** lucasxu has quit IRC | 16:38 | |
| lbragstad | just a reminder that due to DST the keystone meeting will be one hour later today | 16:39 |
| *** belmoreira has quit IRC | 16:39 | |
| *** david-lyle has joined #openstack-keystone | 16:42 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 16:48 | |
| *** henrynash has quit IRC | 16:50 | |
| *** adrian_otto has quit IRC | 16:52 | |
| *** d0ugal has quit IRC | 16:55 | |
| *** nishaYadav has joined #openstack-keystone | 17:00 | |
| *** nishaYadav_ has quit IRC | 17:02 | |
| *** david-lyle_ has joined #openstack-keystone | 17:13 | |
| *** david-lyle has quit IRC | 17:13 | |
| *** henrynash has joined #openstack-keystone | 17:14 | |
| *** henrynash has quit IRC | 17:20 | |
| notmorgan | lbragstad: QUICK CHANGE THE MEETING TO BE EARLIER! ;) | 17:27 |
| EmilienM | lbragstad: https://review.openstack.org/#/c/445592/1 | 17:29 |
| *** nishaYadav has quit IRC | 17:33 | |
| jaosorior | stevemar: what do you think of https://review.openstack.org/#/c/445559/ ? | 17:33 |
| EmilienM | stevemar: hey sir, can you look ^ when you got time? :) | 17:34 |
| *** agrebennikov has quit IRC | 17:35 | |
| *** luzC has joined #openstack-keystone | 17:37 | |
| *** jaosorior has quit IRC | 17:45 | |
| *** agrebennikov has joined #openstack-keystone | 17:47 | |
| *** tesseract has quit IRC | 17:49 | |
| lbragstad | EmilienM awesome - i just saw your note | 17:52 |
| lbragstad | thanks! | 17:52 |
| EmilienM | lbragstad: it's really a draft | 17:52 |
| EmilienM | be nice with me | 17:52 |
| *** lucasxu has joined #openstack-keystone | 17:52 | |
| *** browne has joined #openstack-keystone | 17:55 | |
| lbragstad | EmilienM it's nice to at least have it documented somewhere - i think it's a smart effort | 17:57 |
| *** agrebennikov has quit IRC | 17:57 | |
| *** agrebennikov has joined #openstack-keystone | 17:58 | |
| *** d0ugal has joined #openstack-keystone | 17:58 | |
| EmilienM | lbragstad: and again, the idea is to find a solution that would work outside tripleo | 17:59 |
| EmilienM | lbragstad: wdyt about the etcd (or something else, like tooz) backend to store the fernet keys? | 17:59 |
| EmilienM | lbragstad: and keystone would directly find them | 17:59 |
| EmilienM | lbragstad: a bit like therve is doing with https://etherpad.openstack.org/p/oslo.config_etcd_backend | 18:00 |
| *** henrynash has joined #openstack-keystone | 18:00 | |
| EmilienM | keystone could talk to etcd to get the keys and also have a periodic task that does rotation | 18:00 |
| EmilienM | it would be scalable and natively multi-node | 18:00 |
| *** aojea has joined #openstack-keystone | 18:02 | |
| lbragstad | ping agrebennikov, amakarov, annakoppad, antwash, ayoung, bknudson, breton, browne, chrisplo, cmurphy, davechen, dolphm, dstanek, edmondsw, edtubill, gagehugo, henrynash, hrybacki, jamielennox, jaugustine, jgrassler, knikolla, lamt, lbragstad, kbaikov, ktychkova, morgan, nishaYadav, nkinder, notmorgan, portdirect raildo, ravelar, rderose, rodrigods, roxanaghe, samueldmq, SamYaple, shaleh, spilla, srwilkers, | 18:02 |
| lbragstad | StefanPaetowJisc, stevemar, topol, shardy, ricolin | 18:02 |
| lbragstad | meeting in keystone for those who are interested | 18:02 |
| lbragstad | s/keystone/#opesntack-meeting/ | 18:02 |
| *** pcaruana has quit IRC | 18:03 | |
| *** d0ugal has quit IRC | 18:04 | |
| *** mgagne_ is now known as mgagne | 18:05 | |
| *** henrynash has quit IRC | 18:05 | |
| *** henrynash has joined #openstack-keystone | 18:07 | |
| *** henrynash has quit IRC | 18:13 | |
| *** henrynash has joined #openstack-keystone | 18:18 | |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Add policy sample generation https://review.openstack.org/443344 | 18:26 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Add policy sample generation https://review.openstack.org/443344 | 18:29 |
| *** spotz is now known as spotz_zzz | 18:32 | |
| *** spotz_zzz is now known as spotz | 18:33 | |
| lbragstad | rderose notmorgan o/ | 19:00 |
| rderose | o/ | 19:00 |
| notmorgan | if we are making application-specific-passwords, please don't make it work differently than passwords. | 19:01 |
| notmorgan | it becomes a VERY confusing ux then | 19:01 |
| notmorgan | *very* | 19:01 |
| rderose | notmorgan: okay, what do you mean by work differently? | 19:02 |
| rderose | notmorgan: http://paste.openstack.org/show/602739/ | 19:02 |
| lbragstad | i assume that means if we do api-keys don't make it so users have to exchange them for a token | 19:03 |
| rderose | oh | 19:03 |
| rderose | :) | 19:03 |
| lbragstad | but i'll let notmorgan elaborate | 19:03 |
| lbragstad | because that was my WAG | 19:03 |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: Policy in code (part 4) https://review.openstack.org/435755 | 19:04 |
| rderose | I think part of the use case was that typical users didn't have permissions to create users or trusts | 19:05 |
| rderose | but had a need for something like access keys | 19:05 |
| notmorgan | what lbragstad said | 19:08 |
| notmorgan | if we create password, and app-password | 19:08 |
| bknudson_ | what we need is to have openstack work like every other web application out there and accept access keys. | 19:08 |
| notmorgan | as an example | 19:08 |
| notmorgan | why should it result in different responses.. we already have trusts when you're doing password-like-operations | 19:09 |
| notmorgan | bknudson_: ++ | 19:09 |
| *** henrynash has quit IRC | 19:09 | |
| bknudson_ | https://github.com/blog/1270-easier-builds-and-deployments-using-git-over-https-and-oauth | 19:09 |
| bknudson_ | https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line/ | 19:09 |
| openstackgerrit | Ron De Rose proposed openstack/keystone master: Policy in code (part 2) https://review.openstack.org/435751 | 19:12 |
| openstackgerrit | Ron De Rose proposed openstack/keystone master: Policy in code https://review.openstack.org/435609 | 19:12 |
| openstackgerrit | Ron De Rose proposed openstack/keystone master: Policy in code (part 3) https://review.openstack.org/435754 | 19:12 |
| openstackgerrit | Ron De Rose proposed openstack/keystone master: Policy in code (part 4) https://review.openstack.org/435755 | 19:12 |
| *** henrynash has joined #openstack-keystone | 19:13 | |
| *** henrynash has quit IRC | 19:13 | |
| *** henrynash has joined #openstack-keystone | 19:14 | |
| *** henrynash has quit IRC | 19:15 | |
| *** henrynash has joined #openstack-keystone | 19:16 | |
| *** henrynash has quit IRC | 19:20 | |
| *** raildo_ has joined #openstack-keystone | 19:23 | |
| lbragstad | rderose whoa - nice! | 19:24 |
| *** henrynash has joined #openstack-keystone | 19:25 | |
| rderose | lbragstad: just trying help antwash fix the merge conflicts :) | 19:25 |
| antwash | rderose : conflicts re putting up a fight | 19:26 |
| antwash | *are | 19:26 |
| *** dave-mccowan has quit IRC | 19:26 | |
| rderose | ha | 19:26 |
| *** raildo has quit IRC | 19:27 | |
| *** raildo_ has quit IRC | 19:27 | |
| *** raildo has joined #openstack-keystone | 19:28 | |
| *** raildo has quit IRC | 19:29 | |
| *** raildo has joined #openstack-keystone | 19:35 | |
| *** henrynash has quit IRC | 19:38 | |
| lbragstad | breton i'd be curious to hear what you think about https://review.openstack.org/#/c/445592/1/specs/pike/keystone_fernet_rotation.rst | 19:55 |
| lbragstad | cc EmilienM ^ | 19:55 |
| lbragstad | EmilienM re: using etcd | 19:55 |
| EmilienM | thanks | 19:56 |
| lbragstad | EmilienM you started pinging on the use of etcd and we just started the keystone meeting (sorry for the delayed response) | 19:56 |
| EmilienM | no worries | 19:56 |
| EmilienM | now we have TC meeting :D | 19:56 |
| EmilienM | in 4 min | 19:56 |
| lbragstad | EmilienM breton was looking into writing something that would allow pluggable backend for fernet keys | 19:56 |
| lbragstad | EmilienM ah - you're right | 19:56 |
| EmilienM | lbragstad: awesome, it would be cool to let keystone talk to etcd or another backend directly instead of file | 19:57 |
| lbragstad | EmilienM yeah - having that kind of flexibility would be nice (several people have asked for it, it just a matter of settling on the implementation ) | 19:59 |
| EmilienM | right | 20:00 |
| lbragstad | EmilienM we had a spec for it - but we removed it from our backlog until we had a better direction - https://review.openstack.org/#/c/439194/ | 20:00 |
| EmilienM | like usual :D | 20:00 |
| EmilienM | ok I'll read it | 20:00 |
| lbragstad | EmilienM there is a link to the meeting topic in the commit message | 20:00 |
| * lbragstad heads to the TC meeting | 20:00 | |
| *** david-lyle_ is now known as david-lyle | 20:12 | |
| *** r-daneel has joined #openstack-keystone | 20:18 | |
| *** henrynash has joined #openstack-keystone | 20:29 | |
| *** henrynash has quit IRC | 20:33 | |
| openstackgerrit | Anthony Washington proposed openstack/oslo.policy master: Add additional param to policy.RuleDefault https://review.openstack.org/439070 | 20:39 |
| breton | EmilienM: lbragstad: some folks told me that etcd is not secure enough for fernet keys | 20:40 |
| EmilienM | breton: what isn't secure? | 20:40 |
| EmilienM | I mean | 20:40 |
| EmilienM | a file is secure? lol | 20:40 |
| EmilienM | IMHO a key/value store that support TLS & auth is much more secure than a file on a filesystem | 20:40 |
| breton | EmilienM: they told there is now authentication and anybody can access it. File is protected by ssh :) | 20:41 |
| EmilienM | no auth? | 20:41 |
| breton | i didn't check | 20:41 |
| EmilienM | https://coreos.com/etcd/docs/latest/v2/authentication.html | 20:41 |
| EmilienM | they probably run an old version | 20:41 |
| breton | maybe :) | 20:42 |
| EmilienM | etcd sounds secure to me and i've seen a lot of use cases in actual deployments, I would be surprised if it would not be secure | 20:42 |
| EmilienM | it's worth a try anyway | 20:42 |
| *** MasterOfBugs has joined #openstack-keystone | 20:43 | |
| breton | there is a chain of patches | 20:45 |
| breton | https://review.openstack.org/#/q/owner:mnikolaenko%40protonmail.com+status:open | 20:45 |
| breton | but neither author nor i can work on them any longer | 20:46 |
| *** lucasxu has quit IRC | 21:04 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs master: Add Project tags https://review.openstack.org/431785 | 21:04 |
| *** lucasxu has joined #openstack-keystone | 21:05 | |
| *** raildo has quit IRC | 21:15 | |
| *** spilla has quit IRC | 21:26 | |
| *** catintheroof has quit IRC | 21:46 | |
| *** edmondsw_ has quit IRC | 21:52 | |
| *** edmondsw has joined #openstack-keystone | 21:55 | |
| *** edmondsw has quit IRC | 21:59 | |
| *** chris_hultin is now known as chris_hultin|AWA | 22:13 | |
| *** edmondsw has joined #openstack-keystone | 22:18 | |
| *** erhudy has quit IRC | 22:20 | |
| *** edmondsw has quit IRC | 22:22 | |
| *** lamt has quit IRC | 22:25 | |
| *** aojea has quit IRC | 22:41 | |
| *** aojea has joined #openstack-keystone | 22:42 | |
| *** aojea has quit IRC | 22:46 | |
| *** chris_hultin|AWA is now known as chris_hultin | 23:06 | |
| *** chris_hultin is now known as chris_hultin|AWA | 23:07 | |
| *** henrynash has joined #openstack-keystone | 23:21 | |
| *** henrynash has quit IRC | 23:26 | |
| *** henrynash has joined #openstack-keystone | 23:27 | |
| *** henrynash has quit IRC | 23:32 | |
| *** adriant has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!