| *** http_GK1wmSU has joined #openstack-keystone | 00:03 | |
| *** http_GK1wmSU has left #openstack-keystone | 00:05 | |
| *** kbaegis has quit IRC | 00:07 | |
| *** kaisers2 has joined #openstack-keystone | 00:09 | |
| *** kaisers1 has quit IRC | 00:10 | |
| openstackgerrit | Merged openstack/keystone master: Clarify documentation on whitelists and blacklists https://review.openstack.org/487583 | 00:18 |
|---|---|---|
| openstackgerrit | Merged openstack/keystone master: Handle auto-generated domains when creating IdPs https://review.openstack.org/462408 | 00:19 |
| openstackgerrit | Merged openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/489513 | 00:24 |
| *** aselius has quit IRC | 00:26 | |
| *** dstepanenko has joined #openstack-keystone | 00:37 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 00:39 |
| *** Shunli has joined #openstack-keystone | 00:40 | |
| *** dstepanenko has quit IRC | 00:42 | |
| *** zhurong has joined #openstack-keystone | 00:46 | |
| *** Adri2000 has quit IRC | 00:56 | |
| *** Adri2000 has joined #openstack-keystone | 00:57 | |
| *** mjax has quit IRC | 01:00 | |
| *** mjax has joined #openstack-keystone | 01:06 | |
| *** mjax has quit IRC | 01:07 | |
| *** mjax has joined #openstack-keystone | 01:07 | |
| *** lucasxu has joined #openstack-keystone | 01:09 | |
| *** lucasxu has quit IRC | 01:10 | |
| *** henrynash has quit IRC | 01:24 | |
| *** ducttape_ has joined #openstack-keystone | 01:25 | |
| *** namnh has joined #openstack-keystone | 01:31 | |
| *** aselius has joined #openstack-keystone | 01:31 | |
| *** thorst_afk has quit IRC | 01:37 | |
| *** ducttape_ has quit IRC | 01:38 | |
| *** otleimat has quit IRC | 02:06 | |
| *** rajalokan has joined #openstack-keystone | 02:06 | |
| *** jrist has joined #openstack-keystone | 02:11 | |
| openstackgerrit | Merged openstack/keystone master: Remove duplicate configuration sections https://review.openstack.org/484167 | 02:15 |
| *** mjax has quit IRC | 02:16 | |
| *** mjax has joined #openstack-keystone | 02:18 | |
| *** dstepanenko has joined #openstack-keystone | 02:25 | |
| *** dstepanenko has quit IRC | 02:30 | |
| *** mjax has quit IRC | 02:31 | |
| *** rajalokan has quit IRC | 02:43 | |
| *** dikonoor has joined #openstack-keystone | 02:54 | |
| *** nicolasbock__ has joined #openstack-keystone | 03:14 | |
| *** kbaegis has joined #openstack-keystone | 03:15 | |
| *** masuberu has joined #openstack-keystone | 03:18 | |
| *** dstepanenko has joined #openstack-keystone | 03:20 | |
| *** masber has quit IRC | 03:22 | |
| *** dstepanenko has quit IRC | 03:24 | |
| *** dikonoo has joined #openstack-keystone | 03:24 | |
| *** kbaegis has quit IRC | 03:27 | |
| *** dikonoor has quit IRC | 03:28 | |
| *** thorst_afk has joined #openstack-keystone | 03:38 | |
| *** aselius has quit IRC | 03:41 | |
| *** thorst_afk has quit IRC | 03:52 | |
| *** links has joined #openstack-keystone | 03:54 | |
| *** dstepanenko has joined #openstack-keystone | 04:25 | |
| *** dikonoo has quit IRC | 04:57 | |
| *** mjax has joined #openstack-keystone | 05:04 | |
| *** mjax has quit IRC | 05:05 | |
| *** prashkre has joined #openstack-keystone | 05:07 | |
| *** dikonoo has joined #openstack-keystone | 05:12 | |
| *** aojea has joined #openstack-keystone | 05:33 | |
| *** aojea has quit IRC | 05:33 | |
| *** aojea has joined #openstack-keystone | 05:33 | |
| *** robcresswell has quit IRC | 05:41 | |
| *** aojea_ has joined #openstack-keystone | 05:46 | |
| *** aojea has quit IRC | 05:48 | |
| *** thorst_afk has joined #openstack-keystone | 05:49 | |
| *** dims has quit IRC | 05:52 | |
| *** thorst_afk has quit IRC | 05:53 | |
| *** ayoung has quit IRC | 05:54 | |
| *** dims has joined #openstack-keystone | 05:54 | |
| *** tobberydberg has joined #openstack-keystone | 06:00 | |
| *** dikonoo has quit IRC | 06:02 | |
| *** aojea_ has quit IRC | 06:03 | |
| *** aojea has joined #openstack-keystone | 06:03 | |
| *** ayoung has joined #openstack-keystone | 06:04 | |
| *** josecastroleon has joined #openstack-keystone | 06:08 | |
| *** phalmos has quit IRC | 06:10 | |
| *** hoonetorg has quit IRC | 06:12 | |
| *** dikonoor has joined #openstack-keystone | 06:14 | |
| *** rcernin has joined #openstack-keystone | 06:19 | |
| *** dstepanenko has quit IRC | 06:20 | |
| *** hoonetorg has joined #openstack-keystone | 06:25 | |
| *** pcaruana has joined #openstack-keystone | 06:48 | |
| *** aojea_ has joined #openstack-keystone | 06:57 | |
| *** dstepanenko has joined #openstack-keystone | 06:59 | |
| *** aojea has quit IRC | 06:59 | |
| *** aojea has joined #openstack-keystone | 07:02 | |
| *** aojea_ has quit IRC | 07:04 | |
| *** aojea_ has joined #openstack-keystone | 07:07 | |
| *** amrith has quit IRC | 07:09 | |
| *** Dinesh_Bhor has quit IRC | 07:10 | |
| *** aojea has quit IRC | 07:10 | |
| *** amrith has joined #openstack-keystone | 07:16 | |
| *** amrith is now known as Guest46292 | 07:16 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:16 | |
| *** tesseract has joined #openstack-keystone | 07:17 | |
| *** thorst_afk has joined #openstack-keystone | 07:22 | |
| *** thorst_afk has quit IRC | 07:27 | |
| *** robcresswell has joined #openstack-keystone | 07:41 | |
| *** dstepanenko has quit IRC | 08:12 | |
| *** openstackgerrit has quit IRC | 08:18 | |
| *** ioggstream has joined #openstack-keystone | 08:26 | |
| *** dstepanenko has joined #openstack-keystone | 08:28 | |
| *** henrynash has joined #openstack-keystone | 08:38 | |
| *** markvoelker has quit IRC | 08:39 | |
| *** ducttape_ has joined #openstack-keystone | 08:40 | |
| *** ducttape_ has quit IRC | 08:44 | |
| asettle | lbragstad: I have not been keeping up with the service catalog spec | 08:56 |
| asettle | I'll review today | 08:57 |
| *** kbaegis has joined #openstack-keystone | 09:01 | |
| *** dims has quit IRC | 09:04 | |
| *** dims has joined #openstack-keystone | 09:08 | |
| rcernin | ping keystone, ayoung nkinder jdennis we can see one service spamming the logs with "Authorization failed for token" yet its for particular user and it's repeating, since the user never authenticate successfuly we will never see the request the user is sending. Is there a way for us to either *)disable this logging for authorization failed for this user(nobody complains) *)find out the problem why | 09:16 |
| rcernin | the token is deleted in the db in the time the user requested it? *)is this common behaviour? | 09:16 |
| rcernin | BZ for the same https://bugzilla.redhat.com/show_bug.cgi?id=1477930 | 09:20 |
| openstack | bugzilla.redhat.com bug 1477930 in openstack-keystone "OpenStack user repeatedly reports "Authorization failed for token ..." in neutron/server.log" [Unspecified,New] - Assigned to jdennis | 09:20 |
| *** edmondsw has joined #openstack-keystone | 09:22 | |
| *** thorst_afk has joined #openstack-keystone | 09:23 | |
| *** dstepanenko has quit IRC | 09:23 | |
| *** dikonoor has quit IRC | 09:25 | |
| *** Shunli has quit IRC | 09:27 | |
| *** thorst_afk has quit IRC | 09:28 | |
| *** henrynash has quit IRC | 09:43 | |
| *** henrynash has joined #openstack-keystone | 09:44 | |
| *** henrynash has quit IRC | 09:46 | |
| *** dikonoor has joined #openstack-keystone | 09:52 | |
| *** dstepanenko has joined #openstack-keystone | 09:56 | |
| *** dstepanenko has quit IRC | 10:00 | |
| *** aditipuntambekar has joined #openstack-keystone | 10:07 | |
| *** dikonoor has quit IRC | 10:25 | |
| *** dstepanenko has joined #openstack-keystone | 10:26 | |
| *** zhurong has quit IRC | 10:38 | |
| *** markvoelker has joined #openstack-keystone | 10:40 | |
| *** nicolasbock__ has quit IRC | 10:54 | |
| *** dikonoor has joined #openstack-keystone | 10:55 | |
| *** raildo has joined #openstack-keystone | 11:03 | |
| *** maestropandy has joined #openstack-keystone | 11:06 | |
| maestropandy | Please vote (+3) for our presentation submitted for openstack sydney 2017. Today last day for voting, requesting all to vote. OpenStack cloud storage - Advanced performance tuning & operational best practices with Ceph https://www.openstack.org/summit/sydney-2017/vote-for-speakers/#/19056 ##### Docker Networking over OpenStack Cloud – Challenges, Solutions & Road-map >> https://www.openstack.org/summit/sydney-2017/vote-for-speakers | 11:08 |
| *** markvoelker has quit IRC | 11:13 | |
| *** maestropandy has left #openstack-keystone | 11:14 | |
| *** kbaegis has quit IRC | 11:17 | |
| *** lwanderley has joined #openstack-keystone | 11:27 | |
| *** maestropandy has joined #openstack-keystone | 11:28 | |
| *** dstepanenko has quit IRC | 11:44 | |
| *** maestropandy has quit IRC | 11:46 | |
| *** maestropandy has joined #openstack-keystone | 11:47 | |
| *** maestropandy has left #openstack-keystone | 11:47 | |
| *** dstepanenko has joined #openstack-keystone | 11:49 | |
| *** dstepanenko has quit IRC | 11:51 | |
| *** prashkre has quit IRC | 11:52 | |
| *** prashkre has joined #openstack-keystone | 11:52 | |
| *** dikonoor has quit IRC | 11:53 | |
| *** dstepanenko has joined #openstack-keystone | 11:54 | |
| *** namnh has quit IRC | 12:01 | |
| *** thorst_afk has joined #openstack-keystone | 12:03 | |
| *** david-lyle has quit IRC | 12:07 | |
| *** markvoelker has joined #openstack-keystone | 12:10 | |
| bhagyashris | Hi, All I need some guidance regarding how to use /etc/cinder/logging_sample.conf to set some config options related to the logger and how to access in the project so depending on that I want to log the message. In short usecase of logging_sample.conf. | 12:13 |
| bhagyashris | I want to make the user define logger as configurable | 12:13 |
| *** markvoelker has quit IRC | 12:33 | |
| *** markvoelker has joined #openstack-keystone | 12:33 | |
| *** catintheroof has joined #openstack-keystone | 12:36 | |
| *** ducttape_ has joined #openstack-keystone | 12:40 | |
| *** maestropandy has joined #openstack-keystone | 12:42 | |
| *** maestropandy has left #openstack-keystone | 12:43 | |
| *** ducttape_ has quit IRC | 12:45 | |
| *** lwanderley has quit IRC | 12:45 | |
| ayoung | rcernin, nope. There is not enough information on the Keystone side to see what the request was for, but there should be in the log of the calling service....which is either Nova or Heat, I'm guessing. | 12:46 |
| *** lwanderley has joined #openstack-keystone | 12:46 | |
| ayoung | or...looking at the BZ, it is Neutron | 12:46 |
| *** zhurong has joined #openstack-keystone | 12:46 | |
| ayoung | jdennis' analysis in the BZ looks correct. | 12:48 |
| *** dstepanenko has quit IRC | 13:00 | |
| *** links has quit IRC | 13:06 | |
| *** josecastroleon has quit IRC | 13:08 | |
| *** josecastroleon has joined #openstack-keystone | 13:08 | |
| *** lucasxu has joined #openstack-keystone | 13:11 | |
| *** prashkre has quit IRC | 13:12 | |
| rcernin | ayoung: yes but client never reaches with request the neutron or does it when the keystone does not validate its request. | 13:14 |
| rcernin | jdennis: ayoung: that DB connection comment is correct, on the otherside this was just one example, sorry for not including the others, they dont contain the lost connection to MySQL and yet the Authorization is failed. Thank you for taking look. | 13:17 |
| *** aditipuntambekar has quit IRC | 13:19 | |
| *** dikonoor has joined #openstack-keystone | 13:22 | |
| *** dstepanenko has joined #openstack-keystone | 13:29 | |
| *** dikonoor has quit IRC | 13:34 | |
| *** dikonoor has joined #openstack-keystone | 13:35 | |
| *** dstepanenko has quit IRC | 13:43 | |
| *** dstepanenko has joined #openstack-keystone | 13:46 | |
| *** prashkre has joined #openstack-keystone | 13:48 | |
| *** ducttape_ has joined #openstack-keystone | 13:54 | |
| *** spzala has joined #openstack-keystone | 13:56 | |
| *** efried has joined #openstack-keystone | 13:58 | |
| *** openstackgerrit has joined #openstack-keystone | 13:58 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: use the show-policy directive to show policy settings https://review.openstack.org/488508 | 13:58 |
| *** dikonoor has quit IRC | 14:03 | |
| *** sjain has joined #openstack-keystone | 14:06 | |
| *** aojea_ has quit IRC | 14:07 | |
| morgan | lbragstad: can we add to the topic: please do not advertise your summit talks individually (or something similar) | 14:10 |
| rcernin | people should know this, it was already posted in ML wasn't it? | 14:12 |
| *** josecastroleon has quit IRC | 14:15 | |
| *** zhurong has quit IRC | 14:17 | |
| *** josecastroleon has joined #openstack-keystone | 14:18 | |
| *** aselius has joined #openstack-keystone | 14:19 | |
| knikolla | o/ | 14:19 |
| *** lucasxu has quit IRC | 14:22 | |
| *** sjain has quit IRC | 14:27 | |
| *** mjax has joined #openstack-keystone | 14:29 | |
| *** mjax has quit IRC | 14:30 | |
| *** thorst_afk has quit IRC | 14:30 | |
| *** sjain has joined #openstack-keystone | 14:31 | |
| *** thorst_afk has joined #openstack-keystone | 14:32 | |
| *** thorst_afk has quit IRC | 14:37 | |
| *** sjain has quit IRC | 14:37 | |
| *** thorst_afk has joined #openstack-keystone | 14:42 | |
| *** lwanderley has quit IRC | 14:45 | |
| *** kbaegis has joined #openstack-keystone | 14:49 | |
| *** dstepanenko has quit IRC | 14:52 | |
| *** prashkre has quit IRC | 14:53 | |
| openstackgerrit | huanzhangzhao proposed openstack/keystone master: fix bug 1087674 https://review.openstack.org/490506 | 14:56 |
| openstack | bug 1087674 in OpenStack Identity (keystone) "A bug for test(ignore it)" [Undecided,Invalid] https://launchpad.net/bugs/1087674 - Assigned to huanzhangzhao (yujiamayi) | 14:56 |
| breton | what is going on in that bug | 15:00 |
| *** thorst_afk has quit IRC | 15:00 | |
| *** thorst_afk has joined #openstack-keystone | 15:01 | |
| cmurphy | clearly important work | 15:06 |
| *** kbaegis has quit IRC | 15:07 | |
| *** otleimat has joined #openstack-keystone | 15:10 | |
| *** prashkre has joined #openstack-keystone | 15:10 | |
| gagehugo | lbragstad do we want to bump https://review.openstack.org/#/c/447139/ to Pike? | 15:10 |
| lbragstad | gagehugo: pike? or queens? | 15:11 |
| gagehugo | If it's by release, then Pike? | 15:11 |
| lbragstad | gagehugo: sure - that sounds good | 15:12 |
| lbragstad | gagehugo: what came out of the security meeting? | 15:12 |
| lbragstad | i'm reading luke's comment | 15:12 |
| gagehugo | luke offered to take a look at it, I'm going to attend the meeting @ 12 CST and ask more | 15:12 |
| lbragstad | oh - cool | 15:13 |
| lbragstad | i'll try and linger | 15:13 |
| jdennis | is there a way to have paste log each request and where it's dispatching to? | 15:16 |
| *** tobberyd_ has joined #openstack-keystone | 15:16 | |
| *** tobberydberg has quit IRC | 15:20 | |
| *** tobberyd_ has quit IRC | 15:22 | |
| *** dstepanenko has joined #openstack-keystone | 15:25 | |
| *** dstepanenko has quit IRC | 15:30 | |
| breton | 71111 | 15:30 |
| morgan | breton: nice token ;) | 15:30 |
| *** rmascena has joined #openstack-keystone | 15:41 | |
| breton | i have no idea how i typed that | 15:41 |
| morgan | yubikey? | 15:42 |
| morgan | or similar | 15:42 |
| breton | nope | 15:42 |
| morgan | cat | 15:42 |
| morgan | ;) | 15:42 |
| breton | probably i was just trying to switch windows in irssi on a semi-dead ssh | 15:42 |
| morgan | hehe | 15:42 |
| morgan | ... | 15:42 |
| morgan | weird lag today on irccloud :( | 15:42 |
| *** raildo has quit IRC | 15:43 | |
| prashkre | lbragstad: Hi. I have a query on https://bugs.launchpad.net/keystone/+bug/1696308. As per implementation of /v3/auth/tokens/OS-PKI/revoked API, it is returning signed response of revoked tokens for PKI/UUID because they are persisted in keystone.token table. | 15:49 |
| openstack | Launchpad bug 1696308 in OpenStack Identity (keystone) "list revoked tokens API returns 500 when pki_setup is not run" [Wishlist,Triaged] - Assigned to Nisha Yadav (ynisha11) | 15:49 |
| prashkre | lbragstad: But why does the same API doesn't take care of non-persistent Fernet tokens whose information about revocations are persisted in keystone.revocation_event table? | 15:49 |
| prashkre | Here is the flow of API, if you want to take a look at it. | 15:51 |
| prashkre | https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L228 | 15:51 |
| prashkre | https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L280 | 15:51 |
| breton | prashkre: i think because nobody cares about that part | 15:51 |
| prashkre | https://github.com/openstack/keystone/blob/master/keystone/token/persistence/core.py#L90 | 15:51 |
| prashkre | https://github.com/openstack/keystone/blob/master/keystone/token/persistence/backends/sql.py#L231 | 15:51 |
| lbragstad | prashkre: the OS-PKI/revoked API is suppose to return a list of token IDs that are considered revoked | 15:52 |
| breton | prashkre: fernet tokens are always checked at keystone by keystonemiddleware | 15:52 |
| lbragstad | it's impossible for keystone to return that list when it doesn't store the tokens | 15:52 |
| breton | well, that too. | 15:53 |
| lbragstad | in order for fernet to comply with that api like PKI or UUID, keystone would have to write a non-persistent token to a backend somewhere | 15:53 |
| lbragstad | which kind of defeats the purpose | 15:53 |
| breton | lbragstad: pki were written to backend :p | 15:53 |
| lbragstad | breton: is that a question? | 15:53 |
| breton | lbragstad: no | 15:53 |
| lbragstad | oh - yes | 15:53 |
| lbragstad | "massive" pki tokens were written to backends | 15:54 |
| breton | it was fun.\ | 15:54 |
| lbragstad | that's one way to put it | 15:54 |
| lbragstad | also - when you think about the situation from a middleware perspective | 15:54 |
| lbragstad | middleware makes a call to keystone to fetch a list of revoked tokens, right? | 15:55 |
| *** ducttape_ has quit IRC | 15:55 | |
| lbragstad | then is iterates over that list to compare the current PKI token against the entire list and if it finds a match, it fails the request | 15:55 |
| lbragstad | (makes sense) | 15:55 |
| lbragstad | with fernet, that isn't really possible for the reasons stated above ^ | 15:55 |
| lbragstad | instead - the middleware just puts the token on the wire and validates it against keystone using GET /v3/auth/tokens | 15:56 |
| *** spzala has quit IRC | 15:56 | |
| lbragstad | either way - a request to keystone happens | 15:56 |
| prashkre | lbragstad: how does a user rely on his token got revoked?. I guess there should be an API, to get atleast some information about the token like audit_ids which are being persisted in revocation_event table for fernet tokens. | 15:56 |
| lbragstad | so the "performance" argument of offline validation isn't as appealing as it seems | 15:56 |
| lbragstad | prashkre: sorry - are you asking how a user gets their token revoked? or why? | 15:57 |
| prashkre | lbragstad: yes. | 15:57 |
| lbragstad | both? | 15:57 |
| prashkre | how? | 15:58 |
| lbragstad | how - got it | 15:58 |
| lbragstad | that's a good question | 15:58 |
| lbragstad | keystone has a revocation backend, right? | 15:58 |
| lbragstad | and to the rest of keystone, it's considered the self.revoke_api | 15:58 |
| lbragstad | there are certain places in keystone where the revocation api is invoked to persist a revocation event about "something" | 15:59 |
| lbragstad | that something could be a password change, for example | 15:59 |
| lbragstad | when a user changes their password, the identity API will call the revocation API and say "hey, persist a revocation event that invalidates all tokens from this user before this timestamp" | 16:00 |
| lbragstad | any cases in keystone where we have business logic that relies on, or should, invalidate tokens, the revocation API is used in that way | 16:00 |
| lbragstad | then - during the token validation process, authentication context is compared to the existing revocation events stored by keystone to see if there is a match | 16:01 |
| lbragstad | if there is - then the token being validated is considered revoked or invalid | 16:01 |
| *** ducttape_ has joined #openstack-keystone | 16:01 | |
| *** ducttape_ has quit IRC | 16:01 | |
| lbragstad | if not - then the validation continues processing | 16:01 |
| *** ducttape_ has joined #openstack-keystone | 16:02 | |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L184 | 16:04 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L209 | 16:04 |
| lbragstad | ^ that's the code that handles those checks in the validate token API | 16:04 |
| *** tobberydberg has joined #openstack-keystone | 16:04 | |
| *** david-lyle has joined #openstack-keystone | 16:07 | |
| *** thorst_afk has quit IRC | 16:08 | |
| *** tobberydberg has quit IRC | 16:09 | |
| prashkre | lbragstad: yeah got it. thanks for explaining on this. But from the user/client perspective, how does he will get to know that token is revoked because when revoked token is used for with any API, they get the generic message "Unauthorized or requires authentication", | 16:09 |
| lbragstad | right - a user has to ask keystone if the token is revoked | 16:10 |
| lbragstad | there isn't really a way to have keystone tell a user how a token is revoked - some that might be considered a security vulnerability | 16:10 |
| prashkre | ok. do we API to check that token is revoked? | 16:10 |
| prashkre | ok got it. | 16:11 |
| *** rcernin has quit IRC | 16:12 | |
| *** dave-mccowan has joined #openstack-keystone | 16:14 | |
| *** thorst_afk has joined #openstack-keystone | 16:15 | |
| prashkre | lbragstad: can we have keystone API to tell that your token is revoked or not to user, instead of how a token is revoked?.. because there is no way for user to ask keystone. | 16:15 |
| lbragstad | prashkre: we don't really expose the revocation API to end users | 16:16 |
| lbragstad | prashkre: instead - the revocation API is used internally to keystone | 16:16 |
| *** jmlowe has quit IRC | 16:20 | |
| *** tobberydberg has joined #openstack-keystone | 16:22 | |
| prashkre | lbragstad: sorry too many questions from my side. but curious to know. why the revocation_list API for PKI is exposed to end users? | 16:22 |
| *** tobberydberg has quit IRC | 16:25 | |
| *** tobberydberg has joined #openstack-keystone | 16:26 | |
| edmondsw | prashkre because there's no distinction between end users and services, and the other services have to call that to handle revocations | 16:27 |
| edmondsw | now, if we had a service role... | 16:27 |
| edmondsw | oh, reading back, maybe you're talking about a different API than I am... | 16:29 |
| edmondsw | or different than lbragstad... | 16:30 |
| lbragstad | prashkre: that api was exposed to services - explicitly middleware | 16:30 |
| edmondsw | lbragstad I think we're talking about https://developer.openstack.org/api-ref/identity/v3/#list-revoked-tokens | 16:31 |
| lbragstad | but it was never officially protected | 16:31 |
| lbragstad | it was exposed so that service could check if a PKI to was invalid or not | 16:31 |
| lbragstad | instead of having to pass the token back to keystone to validate it | 16:31 |
| lbragstad | well - it was never explicitly protected such that only service users could access it | 16:32 |
| lbragstad | ( I don't think) | 16:32 |
| morgan | revocation list or rev-event? | 16:32 |
| morgan | revocation list (PKI tokens, uuid, old-shool) was always protected | 16:32 |
| lbragstad | there's the man with all the context ^ | 16:33 |
| morgan | revocation events was not protected, and then had to be for a $security_bug$ | 16:33 |
| lbragstad | morgan: did we ever make it so that *only* service users could call it though? | 16:33 |
| morgan | no, anyone who was admin could call it | 16:33 |
| lbragstad | ah - ok, so we're on the same page | 16:33 |
| edmondsw | morgan I think we broke revocation, at least the way it used to work | 16:33 |
| morgan | it was admin/policy(v3) protected, usually services | 16:33 |
| lbragstad | even thought he intended use case behind that api was to have service call it | 16:33 |
| morgan | revocation list is dead now | 16:34 |
| morgan | revocation events are used internally, public api is not really usable | 16:34 |
| morgan | never was leveraged by middleware/etc | 16:34 |
| morgan | in short, best bet: validate the token with keystone | 16:34 |
| morgan | that is how you know if it has been revoked or not (allowing for the ?allow_expired QS to ignore expiry only) | 16:35 |
| edmondsw | clients (via keystonemiddleware I believe) cache tokens that they've already validated, and you can configure them to, when someone tries to use a token that's in the cache, first check it against the revocation list | 16:35 |
| edmondsw | how does that work with revocation events? | 16:35 |
| edmondsw | I don't think it is, today | 16:35 |
| morgan | edmondsw: no and it only sort-of worked with the revocation-list | 16:35 |
| edmondsw | at least not with the same conf options | 16:35 |
| morgan | the revocation list had all the same issues as a CRL | 16:35 |
| morgan | and then some, plus it was largely cached as well | 16:35 |
| morgan | soooooo | 16:35 |
| morgan | not really a win. | 16:35 |
| edmondsw | so we're just calling that dead? were those conf options removed? | 16:36 |
| morgan | basically, we state (and it is assumed) if you cache in the middleware you have exposure of $cache_time$ for a token to be valid even if revoked | 16:36 |
| morgan | no conf options are not removed, the revocation-list is not populated with fernet tokens | 16:36 |
| morgan | can't be | 16:36 |
| morgan | and we don't do PKI tokens and uuid tokens we should stop populating that list | 16:37 |
| edmondsw | how are folks supposed to know that the conf options no longer work? | 16:37 |
| lbragstad | yeah - that'd be the same as persisting a non-persistent token | 16:37 |
| morgan | read the release notes and docs? | 16:37 |
| morgan | i mean... it *is* documented | 16:37 |
| edmondsw | why wouldn't we remove the conf options, at least deprecate them, if they're now meaningless? | 16:37 |
| prashkre | edmondsw: morgan: so when a token is revoked, the specific token is being invalidated in the cache at https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L253 | 16:37 |
| morgan | if we are trying to solve willfully not looking at docs, we're doing something wrong | 16:37 |
| prashkre | but i think so it is now working. | 16:38 |
| edmondsw | if we're not using deprecation warnings, we're doing something wrong | 16:38 |
| morgan | edmondsw: because we are slow to remove things. | 16:38 |
| morgan | edmondsw: in middleware we can just drop the options | 16:38 |
| morgan | with no warnings | 16:38 |
| morgan | in keystone we can't change anything because apis cannot be removed **(v2 is a special case) | 16:38 |
| morgan | prashkre: cache for keystone is different than cache for keystonemiddleware | 16:39 |
| morgan | the cache's do not share a cache namespace/keyspace | 16:39 |
| morgan | even if the memcache servers are shared | 16:39 |
| prashkre | ok. | 16:40 |
| edmondsw | right, I'm not talking about keystone | 16:40 |
| edmondsw | let me go find those options, maybe they even were removed | 16:40 |
| morgan | the PKI options were removed | 16:41 |
| morgan | iirc | 16:41 |
| morgan | the rest of the options regarding keystone that materially impact the APIs working cannot be removed | 16:41 |
| morgan | and the revocation list never worked without PKI options | 16:41 |
| edmondsw | you mean the revocation list options, which worked for UUID as well as PKI (despite some comments saying otherwise)? | 16:41 |
| morgan | fwiw | 16:41 |
| *** oomichi has quit IRC | 16:41 | |
| *** jmlowe has joined #openstack-keystone | 16:41 | |
| morgan | they never worked unless you put the PKI options in place | 16:42 |
| morgan | because it had to be signed | 16:42 |
| morgan | (code wise) | 16:42 |
| morgan | so it would 500 error | 16:42 |
| edmondsw | they never worked unless you setup signing certs... i.e. signing certs weren't really PKI-specific | 16:42 |
| morgan | they were used for 2 things | 16:42 |
| edmondsw | but if you setup signing certs, it worked fine | 16:42 |
| morgan | 1) rev list | 16:42 |
| edmondsw | with uuid | 16:42 |
| morgan | 2) pki token signing | 16:42 |
| edmondsw | yep | 16:42 |
| morgan | the rev list was implemented with PKI | 16:42 |
| edmondsw | rev list also worked for uuid | 16:42 |
| morgan | the rev list was never meant to be used with uuid | 16:42 |
| morgan | ever | 16:42 |
| morgan | the only reason the rev list was implemented was PKI off-line validation | 16:43 |
| edmondsw | that's not what I was told, and we used it with uuid for several releases | 16:43 |
| edmondsw | worked just fine | 16:43 |
| prashkre | morgan: could you please point me the caching of tokens in keystonemiddleware. | 16:43 |
| morgan | the intention was explicitly for you to validate with keystone for uuid | 16:43 |
| morgan | prashkre: sec. | 16:43 |
| morgan | edmondsw: then you were told wrong and/or made assumptions | 16:43 |
| morgan | it may have worked | 16:44 |
| morgan | if was unintentional | 16:44 |
| morgan | the rev list now should always be empty | 16:44 |
| *** oomichi has joined #openstack-keystone | 16:44 | |
| morgan | which does not break the API contract | 16:44 |
| edmondsw | yep... alrighty then | 16:44 |
| morgan | if it isn't always empty... we have an issue (uuid tokens should also be deprecated imo) | 16:44 |
| morgan | and the signed bits for the rev list... well, we can only do so much there. i don't know how to solve it if it wasn't "fixed" (probably breaking API contract) | 16:45 |
| morgan | keystone should never do actual ASYM key signing | 16:45 |
| morgan | it's bad news for keystone in it's architecture | 16:45 |
| morgan | sym encryption is ok as long as it is very narrowly used (aka fernet, credential store) | 16:46 |
| morgan | even then, i would prefer that to be handled async from the main keystone process (would require massive overhaul, not worth it] | 16:46 |
| morgan | prashkre: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_opts.py if you look here | 16:47 |
| morgan | prashkre: anyone who uses keystonemiddleware can use https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_opts.py#L87 and set memcache servers | 16:47 |
| edmondsw | I can't find check_revocations_for_cached and revocation_cache_time anymore, so it looks like those were cleaned up properly | 16:47 |
| morgan | edmondsw: cool. good to know | 16:47 |
| morgan | prashkre: if those are set in the config group for keystone middleware (keystone_authtoken?), it will cache the token validation for https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_opts.py#L92 | 16:48 |
| morgan | cache time | 16:48 |
| morgan | which is in seconds. | 16:48 |
| *** ioggstream has quit IRC | 16:49 | |
| morgan | there is also a memcache pool set of options | 16:49 |
| *** tobberydberg has quit IRC | 16:49 | |
| prashkre | morgan: thanks. will explore on your pointers. | 16:49 |
| morgan | https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html#deployment-strategy | 16:50 |
| morgan | that is your actual ksm deployment docs | 16:50 |
| *** tobberydberg has joined #openstack-keystone | 16:51 | |
| edmondsw | morgan I lied... check_revocations_for_cached and revocation_cache_time are still in keystonemiddleware, but marked deprecated | 16:53 |
| edmondsw | lbragstad we should remove these | 16:54 |
| morgan | edmondsw: ah yeah looking now, they are deprecated | 16:54 |
| edmondsw | at least for queens | 16:54 |
| *** pcaruana has quit IRC | 16:54 | |
| edmondsw | probably too late for pike | 16:54 |
| morgan | eh, if they are "deprecated_for_removal" they shouldn't show up in samples | 16:54 |
| morgan | and can be removed or not. | 16:54 |
| edmondsw | if they don't work, I'd rather they just didn't exist, at least in queens when it will have been 2 releases of deprecation | 16:55 |
| morgan | if they aren't deprecated for removal | 16:55 |
| morgan | we could just drop them or move them to deprecated for removal | 16:55 |
| morgan | *shrug* | 16:55 |
| morgan | all the same really. | 16:55 |
| edmondsw | deprecation to me means "still works, but don't use it"... and that's not the case here | 16:55 |
| edmondsw | deprecated_for_remove=True | 16:55 |
| morgan | then, they shouldn't even be in samples | 16:56 |
| *** tobberydberg has quit IRC | 16:56 | |
| morgan | and could be dropped | 16:56 |
| morgan | related, i have no idea if the memcache protect stuff even remotely works anymore | 16:56 |
| morgan | pycrypto is ... dead last i heard | 16:56 |
| *** tobberydberg has joined #openstack-keystone | 16:56 | |
| *** spzala has joined #openstack-keystone | 16:56 | |
| *** spzala has quit IRC | 17:01 | |
| *** efried has quit IRC | 17:01 | |
| *** rcernin has joined #openstack-keystone | 17:02 | |
| edmondsw | morgan what "memcache protect stuff"? | 17:03 |
| *** tobberydberg has quit IRC | 17:05 | |
| morgan | edmondsw: encrypt/hmac the data stored in memcache | 17:07 |
| morgan | because, in theory, that is privledged information and people were worried about memcache being accessed by non-openstack services | 17:07 |
| *** lwanderley has joined #openstack-keystone | 17:08 | |
| *** mjax has joined #openstack-keystone | 17:08 | |
| *** spzala has joined #openstack-keystone | 17:09 | |
| edmondsw | morgan didn't realize we were doing that | 17:14 |
| *** tobberydberg has joined #openstack-keystone | 17:14 | |
| edmondsw | not finding any references to Crypto in the code... | 17:14 |
| lbragstad | we swapped pycrypto with pyca/cryptography i think | 17:14 |
| morgan | ah we did | 17:15 |
| morgan | https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_memcache_crypt.py | 17:15 |
| lbragstad | lamt: did that work | 17:15 |
| *** tobberydberg has quit IRC | 17:16 | |
| edmondsw | https://github.com/openstack/keystonemiddleware/blob/e1cd9a47e1db354668319dd4258b031e6577c6dc/releasenotes/notes/bug-1677308-a2fa7de67f21cd84.yaml | 17:16 |
| *** ducttape_ has quit IRC | 17:17 | |
| *** rmascena has quit IRC | 17:20 | |
| *** ducttape_ has joined #openstack-keystone | 17:22 | |
| morgan | lbragstad: https://etherpad.openstack.org/p/keystone-queens-ptg thats not very many people making it to the PTG =/ | 17:23 |
| *** lwanderley has quit IRC | 17:23 | |
| lbragstad | yeah... | 17:24 |
| lbragstad | hrybacki: you're going to be attending, right ? | 17:24 |
| *** tobberydberg has joined #openstack-keystone | 17:26 | |
| *** tobberydberg has quit IRC | 17:26 | |
| *** lwanderley has joined #openstack-keystone | 17:26 | |
| *** ducttape_ has quit IRC | 17:26 | |
| *** tobberydberg has joined #openstack-keystone | 17:26 | |
| *** ducttape_ has joined #openstack-keystone | 17:29 | |
| *** tobberydberg has quit IRC | 17:31 | |
| *** lwanderley has quit IRC | 17:32 | |
| *** ducttap__ has joined #openstack-keystone | 17:32 | |
| *** ducttape_ has quit IRC | 17:33 | |
| *** tesseract has quit IRC | 17:49 | |
| lbragstad | easy review that closes a bug - https://review.openstack.org/#/c/488508/4 | 17:49 |
| lbragstad | and makes documentation easier to render | 17:49 |
| * hrybacki reads | 17:50 | |
| hrybacki | I am! (On holiday and being bad about checking things lbragstad ) | 17:50 |
| lbragstad | hrybacki: awesome - holiday are made for not checking work | 17:51 |
| lbragstad | hrybacki: I'll add you to the etherpad so that we have an accurate count | 17:51 |
| hrybacki | lbragstad: thanks! | 17:53 |
| * hrybacki slides back into the abyss | 17:54 | |
| *** rmascena has joined #openstack-keystone | 17:55 | |
| lbragstad | morgan: edmondsw fwiw - this https://bugs.launchpad.net/keystone/+bug/1696308 has some overlap with what we were all just talking about | 17:58 |
| openstack | Launchpad bug 1696308 in OpenStack Identity (keystone) "list revoked tokens API returns 500 when pki_setup is not run" [Wishlist,Triaged] - Assigned to Nisha Yadav (ynisha11) | 17:58 |
| edmondsw | lbragstad yup, that's the one I pinged you about the other day | 18:01 |
| *** tobberydberg has joined #openstack-keystone | 18:02 | |
| *** spzala has quit IRC | 18:05 | |
| *** tobberyd_ has joined #openstack-keystone | 18:07 | |
| *** tobberydberg has quit IRC | 18:08 | |
| *** kbaegis has joined #openstack-keystone | 18:13 | |
| *** kbaegis has quit IRC | 18:13 | |
| *** tobberyd_ has quit IRC | 18:15 | |
| *** vint_bra1 has joined #openstack-keystone | 18:20 | |
| *** vint_bra has quit IRC | 18:21 | |
| *** masber has joined #openstack-keystone | 18:57 | |
| *** masuberu has quit IRC | 18:59 | |
| *** vint_bra1 has quit IRC | 19:17 | |
| *** vint_bra has joined #openstack-keystone | 19:18 | |
| morgan | i guess we can just make that return an empty list and unsigned | 19:22 |
| morgan | oh gah. this is terrible | 19:25 |
| openstackgerrit | Merged openstack/keystone master: use the show-policy directive to show policy settings https://review.openstack.org/488508 | 19:25 |
| morgan | in v2, i think we just need to break this (sadly) | 19:25 |
| *** spzala has joined #openstack-keystone | 19:27 | |
| *** spzala has quit IRC | 19:27 | |
| *** spzala has joined #openstack-keystone | 19:27 | |
| prashkre | lbragstad: could you please take a look at edmondsw comment on https://review.openstack.org/#/c/490138/. | 19:27 |
| *** spzala has quit IRC | 19:27 | |
| *** prashkre has quit IRC | 19:28 | |
| morgan | oooh thats rough | 19:28 |
| *** gyee has joined #openstack-keystone | 19:29 | |
| *** tobberydberg has joined #openstack-keystone | 19:31 | |
| *** prashkre has joined #openstack-keystone | 19:31 | |
| *** spzala has joined #openstack-keystone | 19:35 | |
| *** prashkre has quit IRC | 19:35 | |
| *** prashkre has joined #openstack-keystone | 19:36 | |
| *** sjain has joined #openstack-keystone | 19:44 | |
| *** efried has joined #openstack-keystone | 19:48 | |
| *** harlowja has quit IRC | 19:57 | |
| *** ducttap__ has quit IRC | 20:01 | |
| *** ducttape_ has joined #openstack-keystone | 20:02 | |
| *** ducttap__ has joined #openstack-keystone | 20:09 | |
| *** ducttape_ has quit IRC | 20:09 | |
| *** ducttap__ has quit IRC | 20:12 | |
| *** prashkre has quit IRC | 20:14 | |
| *** prashkre_ has joined #openstack-keystone | 20:14 | |
| *** ducttape_ has joined #openstack-keystone | 20:15 | |
| *** kbaegis has joined #openstack-keystone | 20:15 | |
| *** lwanderley has joined #openstack-keystone | 20:19 | |
| *** lwanderley has quit IRC | 20:22 | |
| *** lwanderley has joined #openstack-keystone | 20:27 | |
| openstackgerrit | Merged openstack/keystone-specs master: Bump support for federated attributes to backlog https://review.openstack.org/487534 | 20:29 |
| openstackgerrit | Merged openstack/keystone-specs master: Bump application credentials to backlog https://review.openstack.org/487533 | 20:34 |
| *** kbaegis has quit IRC | 20:35 | |
| *** ducttape_ has quit IRC | 20:50 | |
| *** dstepanenko has joined #openstack-keystone | 20:50 | |
| *** ducttape_ has joined #openstack-keystone | 20:51 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Updated URLs in docs https://review.openstack.org/490649 | 20:53 |
| *** dstepanenko has quit IRC | 20:55 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Updated URLs in docs https://review.openstack.org/490649 | 21:03 |
| *** lwanderley has quit IRC | 21:03 | |
| *** lwanderley has joined #openstack-keystone | 21:05 | |
| *** thorst_afk has quit IRC | 21:10 | |
| *** thorst_afk has joined #openstack-keystone | 21:12 | |
| *** sjain has quit IRC | 21:15 | |
| *** harlowja has joined #openstack-keystone | 21:15 | |
| *** lwanderley has quit IRC | 21:16 | |
| *** thorst_afk has quit IRC | 21:17 | |
| *** aojea has joined #openstack-keystone | 21:17 | |
| *** tobberydberg has quit IRC | 21:18 | |
| *** jmlowe has quit IRC | 21:18 | |
| *** lwanderley has joined #openstack-keystone | 21:18 | |
| *** tobberydberg has joined #openstack-keystone | 21:19 | |
| *** rmascena has quit IRC | 21:19 | |
| *** tobberydberg has quit IRC | 21:23 | |
| *** aojea_ has joined #openstack-keystone | 21:23 | |
| *** aojea has quit IRC | 21:24 | |
| *** aojea has joined #openstack-keystone | 21:28 | |
| *** aojea_ has quit IRC | 21:30 | |
| *** thorst_afk has joined #openstack-keystone | 21:30 | |
| *** aojea_ has joined #openstack-keystone | 21:32 | |
| *** thorst_afk has quit IRC | 21:34 | |
| *** aojea has quit IRC | 21:35 | |
| *** aojea has joined #openstack-keystone | 21:37 | |
| *** gyee has quit IRC | 21:38 | |
| mjax | lbragstad: hey, mind if I ask you a couple of questions today as well? I'm looking at the issue_token method in base.py, and putting together some information about how it works based on the implementation in common.py in the keystone/token/providers folder, and wanted to get some clarifications | 21:38 |
| lbragstad | mjax: sure thing | 21:38 |
| lbragstad | i can try to help | 21:38 |
| mjax | thanks! | 21:38 |
| *** aojea_ has quit IRC | 21:40 | |
| mjax | I noticed that the method in common.py constructs the token in a json format and sends that as the token_data | 21:40 |
| mjax | is this required? Or can I define my token as just a string and pass that around | 21:40 |
| lbragstad | mjax: which part are you referencing specifically? | 21:42 |
| *** aojea_ has joined #openstack-keystone | 21:42 | |
| lbragstad | we use token_data *a lot* in that module | 21:43 |
| *** lwanderley has quit IRC | 21:43 | |
| *** aojea has quit IRC | 21:45 | |
| mjax | hmm it might be better if I start with asking about token_data itself | 21:45 |
| lbragstad | mjax: well - the tl;dr is that token data is kind of a mess | 21:46 |
| lbragstad | it's a big dictionary that essentially turns into the token response | 21:46 |
| lbragstad | (represented in the response body from the server to the client) | 21:46 |
| lbragstad | mjax: this is the manager or the top level api - https://github.com/openstack/keystone/blob/fffc84db79fabb2bb35367387dd4b19e9dafb6d1/keystone/token/provider.py#L55 | 21:47 |
| *** aojea has joined #openstack-keystone | 21:47 | |
| lbragstad | which is defined in keystone/token/provider.py | 21:47 |
| lbragstad | that ^ class is going to be calling into your token provider implementation at these points: https://github.com/openstack/keystone/blob/fffc84db79fabb2bb35367387dd4b19e9dafb6d1/keystone/token/provider.py#L182 | 21:48 |
| lbragstad | for example ^ | 21:48 |
| mjax | I see, so that should help me with understanding how the token_data flows around in openstack? | 21:48 |
| lbragstad | mjax: what path are you going to work on first? | 21:49 |
| lbragstad | authenticate or validate? | 21:49 |
| lbragstad | authenticate is handled by athenz, right? | 21:49 |
| mjax | yea | 21:49 |
| lbragstad | ok - wanna walk through the token validate flow then? | 21:49 |
| mjax | that would be a big help | 21:49 |
| *** aojea_ has quit IRC | 21:50 | |
| lbragstad | here is essentially where we start | 21:50 |
| lbragstad | https://github.com/openstack/keystone/blob/fffc84db79fabb2bb35367387dd4b19e9dafb6d1/keystone/token/routers.py | 21:50 |
| lbragstad | the basic flow goes routers.py -> controllers.py -> core.py/provider.py -> backend.py | 21:50 |
| *** thorst_afk has joined #openstack-keystone | 21:50 | |
| lbragstad | the v3 routers for auth are in /keystone/auth/routers but the v3 path eventually ends up in keystone/token/controllers.py | 21:51 |
| lbragstad | (first confusing bit and an antipattern compared to how the rest of keystone is structured ^) | 21:51 |
| lbragstad | https://github.com/openstack/keystone/blob/fffc84db79fabb2bb35367387dd4b19e9dafb6d1/keystone/auth/routers.py#L28 | 21:52 |
| mjax | so what does routers.py do | 21:52 |
| lbragstad | routers is responsible for mapping the path and request to the proper controller method | 21:52 |
| lbragstad | it simply routes traffic | 21:52 |
| lbragstad | the controller is responsible for some validation and "web-like" things | 21:53 |
| lbragstad | the provider.py and core.py layers are responsible for business logic | 21:53 |
| mjax | ok | 21:53 |
| lbragstad | and the backends are responsible for backend things | 21:53 |
| lbragstad | it's a pretty straightforward tiered application | 21:53 |
| lbragstad | at https://github.com/openstack/keystone/blob/fffc84db79fabb2bb35367387dd4b19e9dafb6d1/keystone/auth/routers.py#L28 we get a couple pieces of info | 21:53 |
| lbragstad | and we're routing stuff to the auth controller - https://github.com/openstack/keystone/blob/fffc84db79fabb2bb35367387dd4b19e9dafb6d1/keystone/auth/routers.py#L23 | 21:54 |
| lbragstad | and for GET /v3/auth/tokens we're routing to https://github.com/openstack/keystone/blob/fffc84db79fabb2bb35367387dd4b19e9dafb6d1/keystone/auth/controllers.py#L315-L324 | 21:54 |
| *** sjain has joined #openstack-keystone | 21:54 | |
| lbragstad | which passes the token_id to the actual subsystem that understands tokens here - https://github.com/openstack/keystone/blob/fffc84db79fabb2bb35367387dd4b19e9dafb6d1/keystone/auth/controllers.py#L320 | 21:54 |
| *** thorst_afk has quit IRC | 21:55 | |
| lbragstad | once we're in the token provider API we start having to deal with authentication context and the token itself | 21:56 |
| lbragstad | https://github.com/openstack/keystone/blob/fffc84db79fabb2bb35367387dd4b19e9dafb6d1/keystone/token/provider.py#L159 | 21:56 |
| *** aojea has quit IRC | 21:56 | |
| lbragstad | this calls https://github.com/openstack/keystone/blob/fffc84db79fabb2bb35367387dd4b19e9dafb6d1/keystone/token/provider.py#L173 which goes down into the driver (e.g. your token provider) and validates the token | 21:56 |
| mjax | for the validate token in keystone, when is that used? | 21:57 |
| mjax | as in, is it when the middleware makes a call to keystone to validate the user? | 21:57 |
| lbragstad | keystonemiddleware will make a GET /v3/auth/tokens call to the identity service | 21:58 |
| *** aojea has joined #openstack-keystone | 21:58 | |
| lbragstad | that's when the ^ above path runs | 21:58 |
| mjax | is that the only time that we need validate_token in keystone? | 21:58 |
| lbragstad | depends on how you plan to use keystone - if you're exposing it externally then users might want to validate tokens against the identity endpoint (or something like that) | 21:59 |
| *** prashkre_ has quit IRC | 21:59 | |
| lbragstad | in typical openstack deployment (the authenticate and validate APIs are the most used APIs in the deployment) | 21:59 |
| mjax | I'm curious about your previous pki implementation, since the keystone middleware didn't need to make any call to keystone for validation | 22:00 |
| lbragstad | pki had it's issues | 22:00 |
| mjax | what did you use validate_token in keystone for that implementation? | 22:00 |
| lbragstad | but the gist of the idea was to have a token format that leverage asymmetric signing to be able to distribute the public keys to each service so the service could validate the token | 22:00 |
| *** phalmos has joined #openstack-keystone | 22:01 | |
| lbragstad | but - PKI tokens were also validateable against the identity service | 22:01 |
| lbragstad | there was a configuration option in keystonemiddleware to either validate the token online (against the identity service) or to attempt to validate it offline by checking the signature of the token | 22:01 |
| *** phalmos has quit IRC | 22:02 | |
| mjax | so in my use case, with the athens token, validating the token is technically unnecessary in keystone and I could just do a pass for now in that method? | 22:02 |
| lbragstad | mjax: if you're not going to have keystonemiddleware make the request - then you don't need to modify keystone | 22:03 |
| lbragstad | you only have to teach keystone about athens tokens if you expect it to validate them | 22:03 |
| *** aojea_ has joined #openstack-keystone | 22:03 | |
| mjax | I see, but where do I add code in order to do that? | 22:04 |
| mjax | I thought that I needed to write a token provider but is that not the case? | 22:04 |
| lbragstad | mjax: that would be in keystonemiddleware which is in a separate project | 22:04 |
| lbragstad | https://github.com/openstack/keystonemiddleware | 22:04 |
| lbragstad | keystonemiddleware is suppose to run in front of the openstack service | 22:04 |
| mjax | I guess i'm having some trouble understanding how the overall flow should work | 22:06 |
| mjax | lets say that a user makes a call to nova boot | 22:06 |
| *** aojea has quit IRC | 22:06 | |
| lbragstad | yep | 22:07 |
| mjax | normally, the user has to be authenticated by keystone is that right? | 22:07 |
| lbragstad | mjax: so - a user needs a token to do anything in nova, right? | 22:07 |
| lbragstad | in normal flows - they get that token from keystone | 22:08 |
| *** aojea has joined #openstack-keystone | 22:08 | |
| lbragstad | and then build their request to nova and pass that token in the request | 22:08 |
| lbragstad | this is true for all services that want to be protected by keystonemiddleware | 22:08 |
| lbragstad | nova (or the service) is configured via Paste to run middleware that validates that token | 22:09 |
| lbragstad | (this helps reduce duplication and having each service roll their own token validation mechanism) | 22:09 |
| lbragstad | https://github.com/openstack/nova/blob/master/etc/nova/api-paste.ini | 22:09 |
| lbragstad | so - as the request comes in to nova it will get processed by keystonemiddleware https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py | 22:10 |
| lbragstad | which will pull the token off the request and do one of two things | 22:10 |
| lbragstad | 1.) it will validate it against the keystone *server* | 22:10 |
| *** aojea_ has quit IRC | 22:10 | |
| lbragstad | 2.) validate it offline depending on the token type (this isn't really used anymore since PKI tokens were the only upstream token format that relied on this) | 22:11 |
| mjax | so what do you think about keystone being the one to request an athens token, and then pass that token in the request to nova? | 22:11 |
| lbragstad | wouldn't the user already have asked athens for a token? | 22:12 |
| mjax | possibly, but I think we still want to incorporate keystone in our flow. From what it sounds like though, if we externally get the token, we can bypass keystone completely, and only need to modify keystone middleware? | 22:13 |
| *** spzala has quit IRC | 22:13 | |
| *** aojea_ has joined #openstack-keystone | 22:13 | |
| lbragstad | mjax: yes - depending on what the goal of your deployment is | 22:14 |
| lbragstad | mjax: this might help you understand the role of keystonemiddleware | 22:14 |
| lbragstad | https://docs.openstack.org/keystonemiddleware/latest/ | 22:15 |
| lbragstad | specifically - https://docs.openstack.org/keystonemiddleware/latest/middlewarearchitecture.html | 22:15 |
| lbragstad | mjax: i gotta run for a bit - but ping me if you have additional questions or if something doesn't make sense | 22:16 |
| mjax | I'll definitely take a look at that | 22:16 |
| *** aojea has quit IRC | 22:16 | |
| mjax | lbragstad: thanks for your help all the time! I'll definitely need to ask more later. Really thankful for how responsive you are | 22:17 |
| *** aojea has joined #openstack-keystone | 22:18 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Fill in content in User Documentation https://review.openstack.org/490667 | 22:19 |
| lbragstad | mjax: anytime - that's what we're here for | 22:21 |
| *** aojea_ has quit IRC | 22:21 | |
| *** edmondsw has quit IRC | 22:23 | |
| *** aojea has quit IRC | 22:26 | |
| *** edmondsw has joined #openstack-keystone | 22:26 | |
| *** phalmos has joined #openstack-keystone | 22:29 | |
| *** edmondsw has quit IRC | 22:31 | |
| *** henrynash has joined #openstack-keystone | 22:33 | |
| *** phalmos has quit IRC | 22:33 | |
| *** vint_bra has quit IRC | 22:37 | |
| *** dstepanenko has joined #openstack-keystone | 22:38 | |
| *** ducttape_ has quit IRC | 22:40 | |
| *** dstepanenko has quit IRC | 22:42 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Fill in content in CLI Documentation https://review.openstack.org/490669 | 22:44 |
| *** ducttape_ has joined #openstack-keystone | 22:46 | |
| *** efried is now known as efried_zzz | 22:50 | |
| *** ducttape_ has quit IRC | 22:51 | |
| *** dave-mccowan has quit IRC | 22:51 | |
| mjax | lbragstad: I think the reason why we want to use keystone in order to issue tokens is because it means that we don't have to configure each openstack component in our deployment | 22:51 |
| mjax | even if we assume that the user already has an athens token ready, it would mean modifying nova, glance, etc separately to look for it, which isn't as maintainable | 22:52 |
| *** sjain has quit IRC | 22:57 | |
| *** rcernin has quit IRC | 22:58 | |
| *** spzala has joined #openstack-keystone | 23:13 | |
| *** spzala has quit IRC | 23:17 | |
| *** ducttape_ has joined #openstack-keystone | 23:22 | |
| *** thorst_afk has joined #openstack-keystone | 23:26 | |
| *** jmlowe has joined #openstack-keystone | 23:27 | |
| *** ducttape_ has quit IRC | 23:27 | |
| *** thorst_afk has quit IRC | 23:32 | |
| *** ducttape_ has joined #openstack-keystone | 23:34 | |
| *** ducttape_ has quit IRC | 23:39 | |
| *** edmondsw has joined #openstack-keystone | 23:54 | |
| *** edmondsw has quit IRC | 23:58 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!