| *** ducttape_ has joined #openstack-keystone | 00:01 | |
| *** aojea has quit IRC | 00:02 | |
| *** ducttape_ has quit IRC | 00:05 | |
| *** edmondsw has joined #openstack-keystone | 00:10 | |
| *** edmondsw has quit IRC | 00:15 | |
| *** ducttape_ has joined #openstack-keystone | 00:30 | |
| *** thorst has joined #openstack-keystone | 01:14 | |
| *** thorst has quit IRC | 01:19 | |
| *** nicolasbock has joined #openstack-keystone | 01:26 | |
| *** thorst has joined #openstack-keystone | 01:33 | |
| *** thorst has quit IRC | 01:41 | |
| *** ducttape_ has quit IRC | 01:51 | |
| *** ducttape_ has joined #openstack-keystone | 01:56 | |
| *** edmondsw has joined #openstack-keystone | 01:58 | |
| *** aojea has joined #openstack-keystone | 01:58 | |
| *** ducttape_ has quit IRC | 02:01 | |
| *** edmondsw has quit IRC | 02:03 | |
| *** aojea has quit IRC | 02:04 | |
| *** ducttape_ has joined #openstack-keystone | 02:16 | |
| *** ducttape_ has quit IRC | 02:31 | |
| *** thorst has joined #openstack-keystone | 02:38 | |
| *** thorst has quit IRC | 02:56 | |
| *** ducttape_ has joined #openstack-keystone | 03:03 | |
| *** ducttape_ has quit IRC | 03:21 | |
| *** dave-mccowan has quit IRC | 03:22 | |
| *** masber has quit IRC | 03:29 | |
| *** nicolasbock has quit IRC | 03:31 | |
| *** aojea has joined #openstack-keystone | 03:35 | |
| *** aojea has quit IRC | 03:40 | |
| *** aojea has joined #openstack-keystone | 03:45 | |
| *** aojea has quit IRC | 03:46 | |
| *** edmondsw has joined #openstack-keystone | 03:46 | |
| *** aojea has joined #openstack-keystone | 03:46 | |
| *** gagehugo has quit IRC | 03:50 | |
| *** edmondsw has quit IRC | 03:51 | |
| *** aojea has quit IRC | 03:51 | |
| *** thorst has joined #openstack-keystone | 03:53 | |
| *** thorst has quit IRC | 03:58 | |
| *** links has joined #openstack-keystone | 04:12 | |
| *** ducttape_ has joined #openstack-keystone | 04:22 | |
| *** ducttape_ has quit IRC | 04:26 | |
| *** lamt has quit IRC | 04:26 | |
| *** afred312 has quit IRC | 04:40 | |
| *** afred312 has joined #openstack-keystone | 04:41 | |
| *** thorst has joined #openstack-keystone | 04:54 | |
| *** thorst has quit IRC | 04:58 | |
| *** lamt has joined #openstack-keystone | 05:40 | |
| *** richm has quit IRC | 05:43 | |
| *** aojea has joined #openstack-keystone | 05:47 | |
| *** aojea has quit IRC | 05:52 | |
| *** thorst has joined #openstack-keystone | 05:54 | |
| *** thorst has quit IRC | 05:59 | |
| *** adriant has quit IRC | 06:08 | |
| *** aojea has joined #openstack-keystone | 06:19 | |
| *** ducttape_ has joined #openstack-keystone | 06:44 | |
| *** ducttape_ has quit IRC | 06:49 | |
| *** thorst has joined #openstack-keystone | 06:55 | |
| *** thorst has quit IRC | 07:00 | |
| *** tesseract has joined #openstack-keystone | 07:06 | |
| *** rcernin has joined #openstack-keystone | 07:12 | |
| *** edmondsw has joined #openstack-keystone | 07:22 | |
| *** edmondsw has quit IRC | 07:27 | |
| *** rcernin has quit IRC | 07:32 | |
| *** masber has joined #openstack-keystone | 07:46 | |
| *** thorst has joined #openstack-keystone | 07:56 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** d0ugal has quit IRC | 08:07 | |
| *** d0ugal has joined #openstack-keystone | 08:08 | |
| *** thorst has quit IRC | 08:15 | |
| *** aojea has quit IRC | 08:50 | |
| *** aojea has joined #openstack-keystone | 08:50 | |
| *** voelzmo has joined #openstack-keystone | 08:53 | |
| *** aojea has quit IRC | 08:54 | |
| *** thorst has joined #openstack-keystone | 09:12 | |
| *** thorst has quit IRC | 09:16 | |
| *** voelzmo has quit IRC | 09:30 | |
| *** voelzmo has joined #openstack-keystone | 09:31 | |
| *** aojea has joined #openstack-keystone | 09:32 | |
| *** dkushwaha has joined #openstack-keystone | 09:44 | |
| *** voelzmo has quit IRC | 09:45 | |
| dkushwaha | Hi all, I am from Tacker team. I have deployed new setup today. While executing some test in Tacker service, I am getting this error: keystoneauth1.exceptions.connection.ConnectFailure: Unable to establish connection to http://127.0.0.1:5000/v3/auth/tokens: HTTPConnectionPool(host='127.0.0.1', port=5000): Max retries exceeded with url: /v3/auth/tokens (Caused by NewConnectionError('<requests.packages.urllib3.connection.HTTPConnection obje | 09:51 |
|---|---|---|
| dkushwaha | ct at 0x7f5ed3dfc750>: Failed to establish a new connection: [Errno 111] Connection refused',)) | 09:51 |
| dkushwaha | any clue on this? | 09:51 |
| *** nicolasbock has joined #openstack-keystone | 10:04 | |
| *** richm has joined #openstack-keystone | 10:14 | |
| *** ayoung has joined #openstack-keystone | 10:32 | |
| *** edmondsw has joined #openstack-keystone | 10:58 | |
| *** edmondsw has quit IRC | 11:03 | |
| *** chlong has joined #openstack-keystone | 11:07 | |
| *** thorst has joined #openstack-keystone | 11:14 | |
| *** thorst has quit IRC | 11:18 | |
| *** dave-mccowan has joined #openstack-keystone | 11:22 | |
| ayoung | "We can't allow Domain scoped tokens to have is_admin_project set!" "But we can keep using them as admin tokens in the default policy?" "Oh yeah, sure that is fine." | 11:30 |
| ayoung | For fucks sake people. | 11:30 |
| ayoung | It really feels like people are actively working to make it hard to fix things. | 11:35 |
| *** mvk has quit IRC | 11:46 | |
| *** thorst has joined #openstack-keystone | 11:49 | |
| *** mvk has joined #openstack-keystone | 12:04 | |
| *** lamt has quit IRC | 12:07 | |
| *** edmondsw has joined #openstack-keystone | 12:15 | |
| *** spilla has joined #openstack-keystone | 12:44 | |
| *** edmondsw_ has joined #openstack-keystone | 12:45 | |
| *** edmondsw_ has quit IRC | 12:45 | |
| *** dklyle has joined #openstack-keystone | 12:57 | |
| *** david-lyle has quit IRC | 12:57 | |
| *** lamt has joined #openstack-keystone | 12:58 | |
| *** hoonetorg has quit IRC | 13:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/455927 | 13:19 |
| *** hoonetorg has joined #openstack-keystone | 13:20 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient master: Updated from global requirements https://review.openstack.org/455995 | 13:27 |
| *** links has quit IRC | 13:29 | |
| *** lbragstad_ is now known as lbragstad | 13:37 | |
| *** ChanServ sets mode: +o lbragstad | 13:37 | |
| *** gagehugo has joined #openstack-keystone | 13:39 | |
| *** lucasxu has joined #openstack-keystone | 14:04 | |
| *** phalmos has quit IRC | 14:05 | |
| *** lucasxu has quit IRC | 14:15 | |
| *** lucasxu has joined #openstack-keystone | 14:16 | |
| *** catintheroof has joined #openstack-keystone | 14:30 | |
| *** ducttape_ has joined #openstack-keystone | 14:34 | |
| *** catintheroof has quit IRC | 14:36 | |
| *** catintheroof has joined #openstack-keystone | 14:40 | |
| *** catintheroof has quit IRC | 14:42 | |
| *** phalmos has joined #openstack-keystone | 14:50 | |
| *** markvoelker has joined #openstack-keystone | 14:54 | |
| *** prajeesh-wrs has quit IRC | 15:04 | |
| *** aojea has quit IRC | 15:11 | |
| *** links has joined #openstack-keystone | 15:14 | |
| *** links has quit IRC | 15:17 | |
| *** ducttape_ has quit IRC | 15:17 | |
| *** ducttape_ has joined #openstack-keystone | 15:18 | |
| *** gagehugo has quit IRC | 15:22 | |
| *** gagehugo has joined #openstack-keystone | 15:26 | |
| *** gagehugo has quit IRC | 15:27 | |
| *** prashkre has joined #openstack-keystone | 15:27 | |
| *** gagehugo has joined #openstack-keystone | 15:30 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Outline policy goals https://review.openstack.org/460344 | 15:32 |
| *** voelzmo has joined #openstack-keystone | 15:33 | |
| *** dklyle has quit IRC | 16:00 | |
| *** dklyle has joined #openstack-keystone | 16:00 | |
| *** gyee has joined #openstack-keystone | 16:00 | |
| *** aojea has joined #openstack-keystone | 16:11 | |
| *** gagehugo has quit IRC | 16:11 | |
| *** gagehugo has joined #openstack-keystone | 16:12 | |
| *** aojea has quit IRC | 16:16 | |
| *** dklyle is now known as david-lyle | 16:24 | |
| *** prashkre has quit IRC | 16:26 | |
| *** tesseract has quit IRC | 16:29 | |
| *** rderose has joined #openstack-keystone | 16:30 | |
| *** openstack has joined #openstack-keystone | 16:58 | |
| *** openstack has joined #openstack-keystone | 17:08 | |
| *** openstack has joined #openstack-keystone | 17:11 | |
| *** openstack has joined #openstack-keystone | 17:13 | |
| *** openstack has joined #openstack-keystone | 17:14 | |
| *** openstack has joined #openstack-keystone | 17:21 | |
| *** lucasxu has joined #openstack-keystone | 17:41 | |
| *** faiyaz has joined #openstack-keystone | 17:47 | |
| faiyaz | i have issue wth keystone | 17:47 |
| faiyaz | its not allowing me to create domain default | 17:48 |
| edmondsw | faiyaz you'll need to give more details than that :) | 17:49 |
| faiyaz | sure ill | 17:50 |
| faiyaz | ERROR keystone.common.wsgi OperationalError: (pymysql.err.OperationalError) (1045, u"Access denied for user 'keystone'@'controller' (using password: YES)") | 17:50 |
| faiyaz | when i using the below command to create dafault domain | 17:51 |
| faiyaz | openstack project create --domain default --description "Service Project" service | 17:51 |
| faiyaz | edmondsw are you there? | 17:55 |
| *** ducttap__ has joined #openstack-keystone | 17:58 | |
| dstanek | faiyaz: it sounds like you mysql credentials are incorrect or that use has not been granted access to the tables | 17:59 |
| *** ducttape_ has quit IRC | 18:00 | |
| *** voelzmo has joined #openstack-keystone | 18:00 | |
| *** voelzmo has quit IRC | 18:01 | |
| *** voelzmo has joined #openstack-keystone | 18:02 | |
| *** brad[] has joined #openstack-keystone | 18:07 | |
| edmondsw | dstanek faiyaz wait, if this is the default domain you're trying to create, have you previously bootstrapped keystone with some other domain? | 18:08 |
| edmondsw | if not, that's probably your issue... check out keystone-manage | 18:08 |
| edmondsw | the command you tried is to create a project in the default domain, not the default domain itself. But of course you need to have boostrapped before you can do that | 18:11 |
| edmondsw | e.g. keystone-manage bootstrap --bootstrap-password ADMIN_PASS --bootstrap-admin-url http://controller:35357/v3/ --bootstrap-internal-url http://controller:35357/v3/ --bootstrap-public-url http://controller:5000/v3/ --bootstrap-region-id RegionOne | 18:12 |
| *** voelzmo has quit IRC | 18:12 | |
| cmurphy | faiyaz: make sure you've created the mysql grants properly as described in https://docs.openstack.org/ocata/install-guide-ubuntu/keystone-install.html#prerequisites and set up the database connection string with the right password in keystone.conf | 18:13 |
| *** aojea has joined #openstack-keystone | 18:13 | |
| *** openstackstatus has joined #openstack-keystone | 18:14 | |
| *** ChanServ sets mode: +v openstackstatus | 18:14 | |
| edmondsw | oh, no, dstanek is right... I read that too fast | 18:14 |
| dstanek | edmondsw: :-P | 18:18 |
| *** aojea has quit IRC | 18:18 | |
| dstanek | cmurphy: getting all professional with the nick? | 18:18 |
| edmondsw | dstanek, yeah, I stuck my tongue out at myself too :P | 18:19 |
| cmurphy | dstanek: ya, was time to retire crinkle | 18:19 |
| faiyaz | what about admin token, is it required or we can leave it as optional | 18:19 |
| cmurphy | faiyaz: what documentation are you following? the admin token should not be used any more | 18:22 |
| faiyaz | https://docs.openstack.org/ocata/install-guide-rdo/keystone-install.html this one | 18:22 |
| faiyaz | ocate release on centos 7 | 18:23 |
| cmurphy | faiyaz: you should use `keystone-manage bootstrap` as described in that document and not use the admin token | 18:24 |
| dstanek | faiyaz: admin token was an evil hack that isn't needed anymore | 18:24 |
| faiyaz | i have generated it at the time of starting the setup | 18:25 |
| faiyaz | only generated thats it | 18:26 |
| faiyaz | that it wont give any problem right | 18:26 |
| edmondsw | lbragstad see question in https://bugs.launchpad.net/keystone/+bug/1662762 ... I'm not sure how to answer that. I don't know that we have further releases on stable...? | 18:27 |
| openstack | Launchpad bug 1662762 in OpenStack Identity (keystone) ocata "Authentication for LDAP user fails at MFA rule check" [High,Fix committed] - Assigned to Matthew Edmonds (edmondsw) | 18:27 |
| lbragstad | edmondsw afaict that's up to packages | 18:28 |
| lbragstad | packagers rather | 18:28 |
| lbragstad | we've merge the change, but it's up to the distribution to roll a new release with the fix | 18:29 |
| edmondsw | lbragstad right... and they wouldn't mark bugs like this as released if/when they do that, would they? | 18:30 |
| lbragstad | edmondsw they usually do, i'm not sure i've seen a recent example with a stable branch though | 18:31 |
| *** rderose has quit IRC | 18:41 | |
| *** ducttap__ has quit IRC | 18:41 | |
| *** ducttape_ has joined #openstack-keystone | 18:42 | |
| dstanek | faiyaz: no. i would suggest that you don't use it and that you remove the middleware from your pipeline if it is in there | 18:45 |
| *** ducttape_ has quit IRC | 18:46 | |
| *** ducttape_ has joined #openstack-keystone | 18:58 | |
| faiyaz | middelware in the sence configuration file right | 18:59 |
| *** voelzmo has joined #openstack-keystone | 19:01 | |
| *** aojea has joined #openstack-keystone | 19:04 | |
| *** ducttap__ has joined #openstack-keystone | 19:11 | |
| *** ducttape_ has quit IRC | 19:12 | |
| *** ducttape_ has joined #openstack-keystone | 19:12 | |
| *** ducttap__ has quit IRC | 19:13 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Update dead API spec links https://review.openstack.org/461485 | 19:16 |
| *** david-lyle is now known as dklyle | 19:17 | |
| *** dklyle is now known as david-lyle | 19:17 | |
| ayoung | edmondsw, question for you. What was the part of the review that you thought was an Ugly Hack? Was it the blanket requirement for `is_admin_project` to all the existing calls? | 19:19 |
| edmondsw | ayoung yes... that line I said "Abolutely not" and then something about how that was a terrible hack | 19:20 |
| ayoung | edmondsw, OK, so I do agree with you that this is not the end state. | 19:20 |
| ayoung | edmondsw, I was trying to think what an appropriate alternative would be | 19:20 |
| edmondsw | it shouldn't be any step in the process | 19:20 |
| ayoung | edmondsw, so, here are the things I tripped on, and I think they point the way forward | 19:21 |
| ayoung | 1. there are tempest tests that do domain listing with a domain scoped token | 19:21 |
| edmondsw | you'd go add the is_admin_project:True check to those keystone/common/policies/*.py rules that make sense, and not to those that don't | 19:21 |
| ayoung | 2. there are projects scoped admin calls to create users, but no scope check done in policy | 19:21 |
| ayoung | and same for users | 19:22 |
| ayoung | edmondsw, the problem is that without the scope checks, that is actually just as bad | 19:22 |
| edmondsw | ? | 19:22 |
| ayoung | edmondsw, yeah... | 19:22 |
| edmondsw | ? | 19:22 |
| ayoung | edmondsw, say I did what you said | 19:22 |
| edmondsw | I'm not following you | 19:22 |
| ayoung | and then people enable is_admin project as per suggestion | 19:22 |
| ayoung | they think things are locked down | 19:23 |
| ayoung | but it turns out anyone on any project can do admin-level admin operations | 19:23 |
| ayoung | project operations | 19:23 |
| ayoung | my way, you make things way to draconian, then you loosen them up | 19:23 |
| edmondsw | what do you mean by "admin-level admin operations"? | 19:23 |
| edmondsw | sounds kinda redundant... | 19:23 |
| ayoung | edmondsw, well, in the Keystone case, it should be only assigning a role to a user in a proejct, but probably also creating a nested project? | 19:24 |
| ayoung | we need both | 19:24 |
| ayoung | but the scope checks are much harder | 19:24 |
| ayoung | look at how complicated the cloudsample file has become | 19:24 |
| edmondsw | and I hope you mean any *admin* on any project can do *some* admin operations (those scoped to that project) | 19:24 |
| ayoung | edmondsw, yes, that is what I mean | 19:24 |
| ayoung | not the is_admin_project limited operations | 19:25 |
| edmondsw | the cloudsample file is such a mess *because* scope checks aren't done in code where they a) belong and b) would be simpler | 19:25 |
| ayoung | edmondsw, ++++ | 19:25 |
| ayoung | and then some | 19:25 |
| ayoung | see, that is what I thought we were doing first | 19:25 |
| ayoung | so...we should probably identify per-resource what we scope should allow | 19:26 |
| edmondsw | ++ | 19:26 |
| ayoung | the one funky one is create-project | 19:26 |
| edmondsw | and that's very solvable | 19:26 |
| ayoung | that should be 1. Domain scoped for top level and 2. project-scoped for nested, right? | 19:26 |
| edmondsw | yes | 19:26 |
| ayoung | edmondsw, I think so. Worried a little about backwards compat issues, but should be... | 19:27 |
| ayoung | user and group operations should be domain scoped | 19:27 |
| edmondsw | yes | 19:27 |
| ayoung | role assignements domain or project scoped, but need to match the scope of the assignement provided | 19:27 |
| edmondsw | well, mostly | 19:27 |
| edmondsw | showing the current user should be possible with project-scoped token | 19:28 |
| ayoung | is: I should be admin on the project if I am assigning an admin role, or admin on the domain if I am assigning a domain role | 19:28 |
| edmondsw | just not showing other users | 19:28 |
| edmondsw | as an example | 19:28 |
| ayoung | I think that if we start with the change-of-state operations we'll get the worst offenders | 19:28 |
| ayoung | the reads are going to be trickier to get right, though, as there are enough different options... | 19:28 |
| ayoung | edmondsw, so, I think that my patch is still the right interim step. | 19:32 |
| ayoung | edmondsw, lock it down, tight, and then open it up one API at a time | 19:32 |
| ayoung | I don't want to have to get it right in a Big Bang. | 19:33 |
| edmondsw | ayoung but you're not just locking it down, you're closing off things that need to be open, i.e. breaking some cases | 19:33 |
| ayoung | edmondsw, I can start submitting follow on patches for the better RBAC | 19:33 |
| ayoung | edmondsw, let me walk you through it | 19:34 |
| ayoung | assuming we push this patch as is, nothing changes | 19:34 |
| ayoung | people with admin on any project still have admin on everything | 19:35 |
| edmondsw | "nothing changes" <- false | 19:35 |
| ayoung | nah, hold on | 19:35 |
| edmondsw | not if they're setting is_admin_project, as I am | 19:35 |
| ayoung | edmondsw, you are using default policy, too? | 19:35 |
| edmondsw | no | 19:35 |
| ayoung | Yeah, so that is going to be a strange combination | 19:35 |
| ayoung | default policy. but setting is_admin_project... | 19:36 |
| edmondsw | that's not what I said | 19:36 |
| edmondsw | I said I'm NOT using default policy | 19:36 |
| ayoung | edmondsw, I know, and I am only changing it for default policy | 19:36 |
| ayoung | if you have custom policy, yours will take precedence | 19:36 |
| edmondsw | ayoung that's what is so nasty about your hack... the way you coded it, mine *won't* take precedence | 19:37 |
| ayoung | the only people my patch would break things for would be people setting is_admin_project, but using default policy, and not putting all their admins in the admin project | 19:37 |
| edmondsw | wrong | 19:37 |
| edmondsw | as I remember it... let me go back and take another look | 19:38 |
| ayoung | edmondsw, do you not have a specific rule for admin_required? | 19:38 |
| ayoung | Heh | 19:38 |
| ayoung | So easy to fool yourself on this stuff. | 19:39 |
| *** hemna has joined #openstack-keystone | 19:42 | |
| hemna | hey guys, I'm trying to install keystone from source from the stable/ocata branch and I'm running into pbr conflicts with oslo packages | 19:43 |
| hemna | for example, keystone's requirements.txt in stable/ocata says it wants pbr<2.0.0,>=1.8 # Apache-2.0 | 19:44 |
| hemna | and also oslo.db>=4.15.0 # Apache-2.0 | 19:44 |
| hemna | that installs pbr 1.10.0 | 19:44 |
| ayoung | hemna, where does that conflict? | 19:45 |
| hemna | and oslo.db 4.21.0, but that wants pbr !=2.1.0>,>=2.0.0 | 19:45 |
| hemna | other oslo packages do the same | 19:46 |
| ayoung | need older oslo | 19:46 |
| hemna | sure, but installing via pip install . gets me oslo.db >= 4.1.5.0 (in keystone/requirements.txt) | 19:46 |
| hemna | err 4.15.0 | 19:47 |
| hemna | sorry | 19:47 |
| *** ducttape_ has quit IRC | 19:47 | |
| edmondsw | ayoung so your change isn't as bad as I thought... I can still override what you've set | 19:47 |
| *** ducttape_ has joined #openstack-keystone | 19:47 | |
| hemna | since there is no upper constraint, the conflict is bound to happen. | 19:47 |
| ayoung | :) | 19:47 |
| ayoung | edmondsw, Heh...and now I understand your worry | 19:48 |
| edmondsw | ayoung but I think it breaks some cases when someone is using default policy if they setup admin_project | 19:48 |
| ayoung | edmondsw, yes, it would. But either they need better policy, or they need to put their admin users in the admin_project until then | 19:48 |
| edmondsw | e.g. why should I have to be is_admin_project:True to list roles? | 19:48 |
| edmondsw | an admin on any project should be able to list roles, so that they can see what their options are for assigning roles to the users in their project | 19:49 |
| edmondsw | yet with your change, per https://github.com/openstack/keystone/blob/b53640f5ccfc6d55f121a69fc230fb2a3ea96aba/keystone/common/policies/role.py#L23 using the rule you hacked... | 19:49 |
| ayoung | edmondsw, agreed. But try not to scope creep me too bad on a patch that was supposed to merge 6 months ago? | 19:50 |
| ayoung | edmondsw, instead, lets get a follow on patch written with appropriate policy, and have people review that specificially | 19:50 |
| ayoung | of course, I still need to deal with the damn tempest change... | 19:50 |
| gagehugo | hemna pip install oslo.db==4.15.0 should fix the problem, might have to do install older pbr too if 4.21 oslo.db updated it | 19:51 |
| ayoung | edmondsw, this stuff is hard, and I don't have sign off to work on it any more...I'm working on borrowed time as it is | 19:51 |
| edmondsw | ayoung or... we update this patch to add that is_admin_project:True only where it's needed instead of to all places using RULE_ADMIN_REQUIRED | 19:51 |
| ayoung | edmondsw, ewww | 19:51 |
| ayoung | please no | 19:51 |
| edmondsw | ayoung I hear that... I don't have enough time for this either | 19:51 |
| ayoung | I mean...I kindof already did that | 19:51 |
| edmondsw | you did? | 19:51 |
| ayoung | its the scope check that bothers me | 19:51 |
| ayoung | yeah, I faked it on two calls just to get unit tests to pass | 19:52 |
| ayoung | see the last revision | 19:52 |
| ayoung | https://review.openstack.org/#/c/257636/23/keystone/common/policies/user.py | 19:52 |
| ayoung | and | 19:52 |
| edmondsw | ayoung I was just looking at the last revision, and still see RULE_ADMIN_REQUIRED including is_admin_project | 19:52 |
| ayoung | https://review.openstack.org/#/c/257636/23/keystone/common/policies/project.py | 19:52 |
| edmondsw | oh, you are doing essentially the opposite of what I was saying | 19:53 |
| ayoung | edmondsw, that seems to be my norm! | 19:53 |
| edmondsw | changing 2 places to not use RULE_ADMIN_REQUIRED instead of changing all other places that use it to also check is_admin_project | 19:53 |
| ayoung | most places want the is_admin_check in keystone | 19:54 |
| ayoung | only a small subset are actually supposed to be scoped | 19:54 |
| edmondsw | ayoung right... so most places should have a change in this changeset | 19:54 |
| ayoung | I want the damn role check out of the code, too | 19:54 |
| edmondsw | ayoung it's impossible to review as-is... I have to separately go find all the places that use that rule and see if they should be checking is_admin_project:True or not | 19:54 |
| ayoung | only the scope check should be in the code... | 19:54 |
| edmondsw | and then point out things like list roles that shouldn't, and so are wrong in this patch | 19:55 |
| ayoung | edmondsw, I think you are starting from the wrong assumption | 19:55 |
| edmondsw | and I think you are :) | 19:55 |
| ayoung | you are assuming that people with admin on a non-admin project shouild have the ability to do things seamlessly | 19:55 |
| ayoung | I dont' think it works like that | 19:55 |
| ayoung | they are going to be confused when this hits no matter what | 19:56 |
| edmondsw | define "do things seamlessly"? | 19:56 |
| ayoung | there are things they can do now that they won't be able to do once it hits, like edit endpoints | 19:56 |
| ayoung | etc... | 19:56 |
| *** prashkre has quit IRC | 19:56 | |
| edmondsw | unless you're advocating that we force people to customize policy to get things working again... | 19:56 |
| ayoung | getting this change in allows us to get the appropriate changes in to Tempest, and the other projects | 19:56 |
| ayoung | edmondsw, I'm assuming that default policy + is_admin_project is not the norm | 19:57 |
| edmondsw | if one of us spent the time we are spending talking about this instead just fixing the patch to do it properly, we'd be done by now | 19:57 |
| ayoung | I am assuming that people won't sit on changes for a year, either | 19:57 |
| ayoung | which has proven to be a bad assumption | 19:57 |
| ayoung | I am assuming that people actual want to make progess on this, and not live with it broken | 19:58 |
| edmondsw | default policy + is_admin_project isn't the norm today... it will be, though | 19:58 |
| ayoung | but instead, people have ignored instead of actively worked on it | 19:58 |
| ayoung | edmondsw, there are steps we need to go through to get there | 19:58 |
| ayoung | we need a comparable change to this one into Nova, Glance, etc | 19:59 |
| ayoung | and then into Tempest | 19:59 |
| ayoung | and then, we can write new policy | 19:59 |
| ayoung | so, please, instead of holding this up, help me move it forward | 19:59 |
| ayoung | edmondsw, we've had people committing "fixes" that keep making it hard to fix this | 20:00 |
| ayoung | anyone touching is_admin_project based code right now probably does not understand the scope of the problem | 20:01 |
| ayoung | only a handful of people did, probably: you, me and Jamie. | 20:01 |
| *** ducttap__ has joined #openstack-keystone | 20:04 | |
| *** ducttape_ has quit IRC | 20:04 | |
| edmondsw | ayoung let me pull down your patch and try to make a couple changes hopefully we can both agree on | 20:09 |
| ayoung | edmondsw, I would love that | 20:09 |
| ayoung | edmondsw, think we need to loosen up list_domains in order for tempest to pass, but that should actually be OK | 20:10 |
| ayoung | no reason a domain admin can't list domains, right.... | 20:10 |
| ayoung | Headdesk... | 20:11 |
| faiyaz | edmondsw still i am getting error https://pastebin.com/xLBga6T0 | 20:11 |
| lbragstad | edmondsw not sure you were around when i originally proposed this - https://review.openstack.org/#/c/460344/4 | 20:15 |
| edmondsw | lbragstad just saw it today, added it to my list | 20:15 |
| edmondsw | faiyaz sorry, but I don't use mysql so I'm probably not the best person to help you fix that | 20:16 |
| faiyaz | how to remove the admin token from middleware | 20:17 |
| dstanek | faiyaz: that means that your database credentials are incorrect | 20:17 |
| faiyaz | i have give correct database password its not accepting i guess | 20:19 |
| dstanek | faiyaz: can you login from the command line with it? | 20:19 |
| faiyaz | i am trying in command line it self | 20:20 |
| ayoung | lbragstad, there is probably a point we should make, maybe in that document, that also addresses a point dstanek brought up a few times: | 20:20 |
| ayoung | we tend to think of roles like "Member" and "Admin" and policy rules as compute:create_server | 20:20 |
| dstanek | faiyaz: make sure you try from the controller host | 20:21 |
| faiyaz | yes i am trying from controller host | 20:21 |
| dstanek | faiyaz: i would guess that you granted access to 'keystone'@'localhost' instead of 'keystone'@'controller' | 20:21 |
| ayoung | and when people ask "why can'twe manage on compute:create_server instead of the URL" the reason is the mapping you discuss in that doc: | 20:21 |
| ayoung | The mapping of policies to operations should be easy to maintain. | 20:22 |
| faiyaz | yes | 20:22 |
| faiyaz | localhost i have given | 20:22 |
| ayoung | lbragstad, I'm, pretty sure that is what you mean, but people are going to keep asking it until we find a way to make it clear: if we have a URL, we need a way to automate mapping that to the policy in effect | 20:23 |
| lbragstad | ayoung it is - my goal for that document is to use it as we review proposed solutions | 20:24 |
| lbragstad | ayoung we always get hung up trying to explain this stuff, and people don't really have any sort of reference for what we want to do long-term | 20:24 |
| ayoung | lbragstad, we should also probably have a big caveat in that document about not breaking things, specifically the scope check | 20:25 |
| lbragstad | ayoung i think that fits/is covered with point #2 https://review.openstack.org/#/c/460344/4/specs/keystone/ongoing/policy-goals.rst | 20:25 |
| dstanek | faiyaz: since you are connecting from controller you have to grant access to 'keystone'@'controller' | 20:25 |
| faiyaz | ok ill do that now | 20:26 |
| ayoung | lbragstad, Heh. What is clear to you and me is not clear to people coming to this for the first time. "easy to maintain" implies "don't break it" but I don't think people realize how easy it is to break it. | 20:26 |
| lbragstad | ayoung agree - but i also want this document to be something like a "5 minute read" | 20:27 |
| *** voelzmo has quit IRC | 20:27 | |
| lbragstad | like - this is what we want our policy story to look like | 20:27 |
| lbragstad | ayoung I should elaborate on something else though, too | 20:28 |
| lbragstad | ayoung ideally - we should be able to break each goal into specs/solutions | 20:28 |
| lbragstad | and i imagine that is where we're going to get more detail defined | 20:28 |
| dstanek | lbragstad: we need an "identity on the toilet" series | 20:29 |
| lbragstad | dstanek right - i agree | 20:29 |
| lbragstad | dstanek something that gets the point across without losing people in the details | 20:29 |
| faiyaz | no luck..!! same error | 20:31 |
| faiyaz | An unexpected error prevented the server from fulfilling your request. (HTTP 500) (Request-ID: req-e88ebf11-b1a0-44d3-b3b0-3fadac96a88c) | 20:31 |
| dstanek | faiyaz: what's the actual error now? same perms issue? | 20:34 |
| dstanek | faiyaz: what do your grant statements look like? | 20:34 |
| faiyaz | MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'controller' \ -> IDENTIFIED BY 'keystonedb'; Query OK, 0 rows affected (0.01 sec) | 20:35 |
| faiyaz | ERROR keystone.common.wsgi ProgrammingError: (pymys ql.err.ProgrammingError) (1146, u"Table 'keystone.project' doesn't exist") [SQL: u'SELECT project.id AS project_id, project.name AS project_name, project.domain _id AS project_domain_id, project.description AS project_description, project.en abled AS project_enabled, project.extra AS project_extra, project.parent_id AS p roject_parent_id, project.is_domain AS project_i | 20:40 |
| *** ducttap__ has quit IRC | 20:45 | |
| *** ducttape_ has joined #openstack-keystone | 20:45 | |
| *** ducttap__ has joined #openstack-keystone | 20:48 | |
| *** ducttape_ has quit IRC | 20:48 | |
| openstackgerrit | ayoung proposed openstack/keystone master: Add is_admin_project check to policy https://review.openstack.org/257636 | 20:50 |
| *** thorst has quit IRC | 20:56 | |
| dstanek | faiyaz: did you sync the db? | 20:59 |
| faiyaz | yes.. | 21:00 |
| faiyaz | my error code got changed | 21:05 |
| faiyaz | The request you have made requires authentication. (HTTP 401) (Request-ID: req-c776a2b5-baf7-42bd-93e4-e2be54413626) | 21:05 |
| faiyaz | not it is http 401 | 21:05 |
| *** markvoelker has quit IRC | 21:06 | |
| faiyaz | do i need to get auth url as https or http | 21:08 |
| *** thorst has joined #openstack-keystone | 21:15 | |
| *** aojea has quit IRC | 21:18 | |
| *** spilla has quit IRC | 21:19 | |
| *** thorst has quit IRC | 21:20 | |
| *** edmondsw has quit IRC | 21:24 | |
| *** adriant has joined #openstack-keystone | 21:37 | |
| *** faiyaz has quit IRC | 21:38 | |
| *** ducttap__ has quit IRC | 21:40 | |
| *** ducttape_ has joined #openstack-keystone | 21:41 | |
| *** lucasxu has quit IRC | 21:42 | |
| *** catintheroof has joined #openstack-keystone | 21:50 | |
| *** markvoelker has joined #openstack-keystone | 21:57 | |
| *** rderose has joined #openstack-keystone | 22:11 | |
| *** thorst has joined #openstack-keystone | 22:11 | |
| *** thorst has quit IRC | 22:16 | |
| openstackgerrit | Eric Fried proposed openstack/keystoneauth master: Introduce keystoneauth1.loading.adapter https://review.openstack.org/460337 | 22:21 |
| efried | jamielennox mordred ^^ | 22:21 |
| efried | UT done. | 22:21 |
| *** browne has joined #openstack-keystone | 22:32 | |
| *** catintheroof has quit IRC | 22:39 | |
| *** lamt has quit IRC | 22:39 | |
| *** browne has quit IRC | 22:43 | |
| *** thorst has joined #openstack-keystone | 22:46 | |
| *** browne has joined #openstack-keystone | 22:54 | |
| *** thorst has quit IRC | 22:59 | |
| *** thorst has joined #openstack-keystone | 22:59 | |
| *** edmondsw has joined #openstack-keystone | 23:02 | |
| *** ducttape_ has quit IRC | 23:23 | |
| *** ducttape_ has joined #openstack-keystone | 23:24 | |
| *** phalmos has quit IRC | 23:28 | |
| *** rderose has quit IRC | 23:32 | |
| mordred | efried: ++ | 23:48 |
| *** jamielennox is now known as jamielennox|away | 23:56 | |
| *** edmondsw has quit IRC | 23:56 | |
| *** jamielennox|away is now known as jamielennox | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!