| *** oikiki has quit IRC | 00:03 | |
| *** oikiki has joined #openstack-keystone | 00:03 | |
| *** spilla has quit IRC | 00:05 | |
| *** oikiki has quit IRC | 00:17 | |
| *** rmcall has joined #openstack-keystone | 00:20 | |
| *** rmcall has quit IRC | 00:20 | |
| *** dave-mccowan has joined #openstack-keystone | 00:54 | |
| *** r-daneel has quit IRC | 00:56 | |
| *** lbragstad has quit IRC | 01:45 | |
| *** itlinux has joined #openstack-keystone | 01:47 | |
| *** harlowja has quit IRC | 03:08 | |
| *** itlinux has quit IRC | 03:37 | |
| openstackgerrit | melissaml proposed openstack/keystone-specs master: Replace Chinese quotes to English quotes https://review.openstack.org/544773 | 03:58 |
|---|---|---|
| *** itlinux has joined #openstack-keystone | 04:00 | |
| *** agrebennikov has quit IRC | 04:13 | |
| *** gyee has quit IRC | 04:14 | |
| *** itlinux has quit IRC | 04:17 | |
| *** dave-mccowan has quit IRC | 04:25 | |
| *** masber has joined #openstack-keystone | 04:33 | |
| *** links has joined #openstack-keystone | 04:34 | |
| *** links has quit IRC | 04:42 | |
| *** links has joined #openstack-keystone | 04:45 | |
| *** r-daneel has joined #openstack-keystone | 04:57 | |
| *** threestrands_ has joined #openstack-keystone | 05:09 | |
| *** threestrands_ has quit IRC | 05:09 | |
| *** threestrands_ has joined #openstack-keystone | 05:09 | |
| *** threestrands has quit IRC | 05:09 | |
| *** threestrands_ has quit IRC | 05:10 | |
| *** threestrands_ has joined #openstack-keystone | 05:11 | |
| *** harlowja has joined #openstack-keystone | 05:15 | |
| *** threestrands has joined #openstack-keystone | 05:15 | |
| *** threestrands has quit IRC | 05:15 | |
| *** threestrands has joined #openstack-keystone | 05:15 | |
| *** threestrands_ has quit IRC | 05:18 | |
| *** threestrands has quit IRC | 05:28 | |
| *** jaosorior has quit IRC | 05:37 | |
| *** jaosorior has joined #openstack-keystone | 05:44 | |
| *** harlowja has quit IRC | 06:14 | |
| *** rcernin has quit IRC | 06:44 | |
| openstackgerrit | Merged openstack/keystone master: Add docs for application credentials https://review.openstack.org/543643 | 06:45 |
| *** martinus__ has joined #openstack-keystone | 06:52 | |
| *** hoonetorg has quit IRC | 06:56 | |
| *** hoonetorg has joined #openstack-keystone | 06:57 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/544796 | 07:08 |
| *** threestrands has joined #openstack-keystone | 07:09 | |
| *** threestrands has quit IRC | 07:09 | |
| *** threestrands has joined #openstack-keystone | 07:09 | |
| *** rcernin has joined #openstack-keystone | 07:28 | |
| *** pcaruana has joined #openstack-keystone | 07:40 | |
| *** edmondsw has joined #openstack-keystone | 07:41 | |
| *** edmondsw has quit IRC | 07:45 | |
| *** belmoreira has joined #openstack-keystone | 07:55 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:08 | |
| *** tesseract has joined #openstack-keystone | 08:17 | |
| *** links has quit IRC | 08:35 | |
| *** links has joined #openstack-keystone | 08:52 | |
| *** sambetts|afk has quit IRC | 09:03 | |
| *** sambetts_ has joined #openstack-keystone | 09:07 | |
| *** threestrands_ has joined #openstack-keystone | 09:21 | |
| *** threestrands has quit IRC | 09:21 | |
| *** edmondsw has joined #openstack-keystone | 09:29 | |
| *** edmondsw has quit IRC | 09:34 | |
| *** sambetts_ is now known as sambetts | 10:21 | |
| *** d0ugal has quit IRC | 10:30 | |
| *** d0ugal has joined #openstack-keystone | 10:33 | |
| *** jistr is now known as jistr|mtg | 11:00 | |
| *** d0ugal has quit IRC | 11:20 | |
| *** d0ugal has joined #openstack-keystone | 11:39 | |
| *** dave-mccowan has joined #openstack-keystone | 12:10 | |
| *** raildo has joined #openstack-keystone | 12:14 | |
| *** jistr|mtg is now known as jistr | 12:23 | |
| *** edmondsw has joined #openstack-keystone | 13:06 | |
| *** edmondsw has quit IRC | 13:10 | |
| *** edmondsw has joined #openstack-keystone | 13:24 | |
| *** panbalag has joined #openstack-keystone | 13:47 | |
| *** McClymontS has joined #openstack-keystone | 13:56 | |
| *** jmlowe has quit IRC | 14:09 | |
| *** jmlowe has joined #openstack-keystone | 14:20 | |
| *** ayoung has quit IRC | 14:20 | |
| *** rmcall has joined #openstack-keystone | 14:21 | |
| *** dave-mccowan has quit IRC | 14:23 | |
| *** jaosorior has quit IRC | 14:23 | |
| *** lbragstad has joined #openstack-keystone | 14:29 | |
| *** ChanServ sets mode: +o lbragstad | 14:29 | |
| *** threestrands_ has quit IRC | 14:39 | |
| *** dtruong has quit IRC | 14:40 | |
| *** dtruong has joined #openstack-keystone | 14:41 | |
| *** ayoung has joined #openstack-keystone | 14:41 | |
| *** McClymontS has quit IRC | 14:53 | |
| *** rcernin has quit IRC | 15:01 | |
| *** r-daneel has quit IRC | 15:09 | |
| lbragstad | kmalloc now that things settled down a bit https://goo.gl/k7Wxs9 should be the last of the stable reviews for RC2 | 15:12 |
| lbragstad | included the app creds documentation patch since we should be able to include that, too | 15:13 |
| cmurphy | \o/ | 15:13 |
| *** dave-mccowan has joined #openstack-keystone | 15:13 | |
| cmurphy | lbragstad: were you waiting for this translations patch too? https://review.openstack.org/#/c/544796/ | 15:14 |
| lbragstad | cmurphy to back port it? | 15:14 |
| lbragstad | i've been trying to get in touch with the backports team about backports - https://review.openstack.org/#/c/543573/ | 15:15 |
| lbragstad | based on what ian said, it sounds like don't have to backport translations? i asked for clarification ^ | 15:16 |
| cmurphy | lbragstad: okay got it | 15:17 |
| lbragstad | still waiting on a response though | 15:17 |
| *** jaosorior has joined #openstack-keystone | 15:27 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Address FIXMEs for listing revoked tokens https://review.openstack.org/545009 | 15:34 |
| *** dave-mccowan has quit IRC | 15:43 | |
| knikolla | o/ | 15:45 |
| *** spilla has joined #openstack-keystone | 15:45 | |
| gagehugo | o/ | 15:45 |
| *** agrebennikov has joined #openstack-keystone | 15:56 | |
| openstackgerrit | Merged openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/544796 | 15:56 |
| lbragstad | kmalloc are you around yet? i'm in the middle of refactoring the token provider and i have a couple ideas (probably bad ideas) about the token model | 15:57 |
| *** r-daneel has joined #openstack-keystone | 15:58 | |
| lbragstad | i think it would be beneficial to try and apply an MVC pattern | 15:58 |
| lbragstad | so - instead of generating version specific token data to generate the token model, it would work the other way around | 15:59 |
| lbragstad | you pass a bunch of things to the token model and it gives you an object you and use to reason about the token response | 15:59 |
| lbragstad | then the v3 token controller would build the token response based on the information provided in the model object | 16:00 |
| lbragstad | does that seem sane/ | 16:00 |
| lbragstad | so - that would mean the whole V3TokenDataHelper object would get moved up to the controller layer | 16:02 |
| lbragstad | or if anyone else has thought, comments, concerns? | 16:03 |
| *** pcaruana has quit IRC | 16:09 | |
| knikolla | lbragstad: how is it handled currently? | 16:16 |
| lbragstad | well - right now, we have an auth controller, a token provider (manager), a token driver (provider), and a token formatter | 16:16 |
| lbragstad | from top down, in that order | 16:17 |
| lbragstad | the token controller pull information from the request and asks the token provider Manager for a token and a token response | 16:17 |
| lbragstad | (e.g. the project id, user id, trust information, domain info, etc...)_ | 16:18 |
| lbragstad | so - that part would stay the same | 16:18 |
| lbragstad | since the controller would be responsible for pulling that information from the actual authentication request | 16:18 |
| lbragstad | but instead of *expecting* a versioned response back from the token provider Manager, it would get a token_obj | 16:18 |
| lbragstad | so - it wouldn't just pass it back through to the user... instead, the controller would get more responsibility | 16:19 |
| lbragstad | and that would be to translate the token_obj to a v3 token response | 16:20 |
| lbragstad | so - essentially all this stuff https://github.com/openstack/keystone/blob/4732c67792e7d991b1296941992353551c686d93/keystone/token/providers/common.py#L87-L532 | 16:20 |
| * lbragstad hopes he is making sense | 16:21 | |
| *** links has quit IRC | 16:22 | |
| knikolla | lbragstad: makes sense. | 16:22 |
| lbragstad | the token provider would only really care about taking some values from the controller, generating an object, getting a token id from a provider, and passing all that back to the controller | 16:23 |
| knikolla | and than the controller would call a view to render the token | 16:23 |
| knikolla | then* | 16:23 |
| lbragstad | so all version specific opinions about how a token should look in a response is isolated to the controller | 16:23 |
| knikolla | from the model object | 16:23 |
| lbragstad | yes - exactly | 16:23 |
| lbragstad | so when we go to add a new version or a different token provider | 16:23 |
| lbragstad | it's kept separate from each other | 16:23 |
| knikolla | makes sense | 16:25 |
| lbragstad | ok - cool | 16:25 |
| lbragstad | i feel better knowing if i've gone off the deep end, at least i'm not alone :) | 16:26 |
| knikolla | lbragstad: that's me usually during refactoring | 16:28 |
| *** jaosorior has quit IRC | 16:29 | |
| knikolla | lbragstad: would it make any sense at all to associate policy strings like identity:list_users to roles in keystone instead of having them in the policy.json files of projects? | 16:32 |
| knikolla | similar to what we saw on aws | 16:33 |
| lbragstad | like pulling all policies in to keystone? | 16:34 |
| knikolla | lbragstad: yeah. | 16:34 |
| lbragstad | if i remember correctly, that's what the policy api was meant for | 16:35 |
| knikolla | lbragstad: not really. as all it did was accept a blob of json. | 16:35 |
| lbragstad | right - i think it was meant for that kind of use case, but it was never really finished | 16:36 |
| lbragstad | or completed | 16:36 |
| knikolla | lbragstad: this is a one-to-many mapping between role -> action | 16:36 |
| knikolla | keystonemiddleware gets the role of the token, expands the list of actions the user can do | 16:36 |
| knikolla | and passes that to the service | 16:36 |
| knikolla | service checks if action in list of actions. | 16:37 |
| *** AlexeyAbashkin has quit IRC | 16:37 | |
| lbragstad | its the rbac in middleware appraoch | 16:39 |
| knikolla | lbragstad: rbac in middleware had enforcement in the middleware. this doesn't . | 16:39 |
| lbragstad | the enforcement would be in keystone, then? | 16:40 |
| knikolla | lbragstad: the enforcement will be in the service in the form of. keystonemiddleware expands role to list of actions; service checks if action is in list of actions provided by keystonemiddleware. | 16:41 |
| knikolla | the actions that a role can do are in keystone | 16:42 |
| knikolla | similar to oauth scopes. https://auth0.com/docs/scopes/current | 16:43 |
| lbragstad | so - keystone has to maintain the mapping of roles -> actions | 16:44 |
| knikolla | yes | 16:44 |
| lbragstad | what happens when new operations are added to the service? | 16:46 |
| lbragstad | or actions? | 16:46 |
| lbragstad | something has to update keystone, right? | 16:47 |
| knikolla | lbragstad: yes, this is also a question for the current approach when we introduce some default roles that are openstack-wide. | 16:48 |
| knikolla | we can exploit those default roles to provide sane defaults. | 16:48 |
| lbragstad | keystone would have to add those during bootstrap | 16:49 |
| lbragstad | i guess we need to work through the upgrade case, in both situations | 16:50 |
| knikolla | lbragstad: another approach exploits the current system scoping | 16:51 |
| knikolla | nova for example gets access to system:nova:policy | 16:51 |
| lbragstad | i think this would be good to run by other projects at the PTG | 16:51 |
| lbragstad | nova gets that by default? | 16:52 |
| knikolla | lbragstad: the admin would grant it on the nova service user | 16:52 |
| lbragstad | yeah - i think moving to something like that would be useful | 16:54 |
| lbragstad | it would be nice to restrict service users to only what they need to do in other services | 16:54 |
| lbragstad | knikolla adding a snippet for this in https://etherpad.openstack.org/p/baremetal-vm-rocky-ptg | 16:56 |
| knikolla | lbragstad: i'll sketch out a spec | 16:56 |
| * knikolla goes for lunch | 16:57 | |
| lbragstad | cool | 16:57 |
| lbragstad | i'll read the auth0 doc | 16:57 |
| lbragstad | sometime today | 16:57 |
| *** oikiki has joined #openstack-keystone | 17:04 | |
| *** sambetts is now known as sambetts|afk | 17:19 | |
| *** harlowja has joined #openstack-keystone | 17:19 | |
| *** pcaruana has joined #openstack-keystone | 17:20 | |
| *** belmoreira has quit IRC | 17:27 | |
| *** itlinux has joined #openstack-keystone | 17:47 | |
| *** tesseract has quit IRC | 17:52 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:01 | |
| *** AlexeyAbashkin has quit IRC | 18:06 | |
| *** kukacz has quit IRC | 18:15 | |
| *** kukacz_ has joined #openstack-keystone | 18:20 | |
| *** oikiki has quit IRC | 18:28 | |
| *** oikiki has joined #openstack-keystone | 18:29 | |
| openstackgerrit | Merged openstack/keystone-specs master: Fix typos in keystone-specs https://review.openstack.org/542010 | 18:37 |
| *** rmascena has joined #openstack-keystone | 18:43 | |
| *** panbalag has left #openstack-keystone | 18:43 | |
| *** raildo has quit IRC | 18:46 | |
| *** rmcall has quit IRC | 18:55 | |
| *** harlowja has quit IRC | 19:00 | |
| *** gyee has joined #openstack-keystone | 19:03 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystoneauth master: Add pep8 import order validation https://review.openstack.org/545094 | 19:09 |
| mordred | cmurphy: ^^ TIL | 19:12 |
| cmurphy | mordred: :D | 19:13 |
| cmurphy | was looking at another change and wondering why the hell that wasn't being caught | 19:14 |
| mordred | cmurphy: you know what would be neat? a script that would fix those ... | 19:14 |
| cmurphy | ;) | 19:15 |
| lbragstad | did flake get updated recently? | 19:16 |
| lbragstad | i'm seeing a bunch of that stuff in keystone,t oo | 19:16 |
| cmurphy | the violations i found in ksa had been there a while | 19:20 |
| lbragstad | must be the version i have locally then | 19:26 |
| *** r-daneel has quit IRC | 19:27 | |
| mordred | cmurphy, lbragstad: feel like +3ing https://review.openstack.org/#/c/505764 ? | 19:33 |
| cmurphy | yes will look | 19:34 |
| cmurphy | sorry, i keep promising to look at it and then drop it on the floor | 19:34 |
| *** harlowja has joined #openstack-keystone | 19:35 | |
| *** harlowja_ has joined #openstack-keystone | 19:37 | |
| *** harlowja has quit IRC | 19:39 | |
| openstackgerrit | Merged openstack/keystone master: Remove unused class variables from token provider https://review.openstack.org/544520 | 19:51 |
| openstackgerrit | Merged openstack/keystoneauth master: Fix a spelling error https://review.openstack.org/541949 | 19:53 |
| *** pcaruana has quit IRC | 20:03 | |
| mordred | cmurphy: no worries - I promised to write a feature for keystone last cycle and i'm pretty sure you did 100% of the work, so I don't think I get to complain :) | 20:09 |
| *** AlexeyAbashkin has joined #openstack-keystone | 20:15 | |
| *** kukacz_ has quit IRC | 20:17 | |
| *** AlexeyAbashkin has quit IRC | 20:19 | |
| cmurphy | mordred: :) | 20:19 |
| *** r-daneel has joined #openstack-keystone | 20:31 | |
| *** panbalag has joined #openstack-keystone | 20:36 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove needs_persistence property from token providers https://review.openstack.org/544515 | 20:41 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Refactor token cache invalidation callbacks https://review.openstack.org/544528 | 20:41 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Simplify token persistence callbacks https://review.openstack.org/544616 | 20:41 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Simplify federation and oauth token callbacks https://review.openstack.org/544737 | 20:41 |
| *** panbalag has left #openstack-keystone | 20:43 | |
| ayoung | Holleee crap. I might have just used Hierarchical Multi Tenancy to fix a disconnect between CloudForms and Nova.... | 20:53 |
| *** oikiki has quit IRC | 21:05 | |
| *** oikiki has joined #openstack-keystone | 21:06 | |
| *** oikiki has quit IRC | 21:10 | |
| openstackgerrit | Merged openstack/keystoneauth master: Split request logging into four different loggers https://review.openstack.org/505764 | 21:14 |
| openstackgerrit | Merged openstack/keystoneauth master: Add some comments explaining split_loggers flag logic https://review.openstack.org/541066 | 21:14 |
| openstackgerrit | Merged openstack/keystoneauth master: Remove PYTHONHASHSEED setting https://review.openstack.org/533798 | 21:23 |
| *** oikiki has joined #openstack-keystone | 21:23 | |
| *** pcaruana has joined #openstack-keystone | 21:31 | |
| gagehugo | kmalloc ah the certs part makes sense | 21:32 |
| kmalloc | gagehugo: yeah | 21:32 |
| *** rmascena has quit IRC | 21:41 | |
| *** openstack has joined #openstack-keystone | 21:44 | |
| *** ChanServ sets mode: +o openstack | 21:44 | |
| *** pcaruana has quit IRC | 21:48 | |
| *** rcernin has joined #openstack-keystone | 21:50 | |
| *** martinus__ has quit IRC | 22:05 | |
| *** neex_io has joined #openstack-keystone | 22:07 | |
| *** belmoreira has joined #openstack-keystone | 22:11 | |
| *** neex_io has quit IRC | 22:25 | |
| openstackgerrit | Merged openstack/keystoneauth master: Add pep8 import order validation https://review.openstack.org/545094 | 22:29 |
| *** threestrands has joined #openstack-keystone | 22:43 | |
| *** threestrands has quit IRC | 22:43 | |
| *** threestrands has joined #openstack-keystone | 22:43 | |
| lbragstad | stepping away for a bit, i'll be back on tonight though | 23:06 |
| *** itlinux has quit IRC | 23:09 | |
| *** spilla has quit IRC | 23:15 | |
| *** belmoreira has quit IRC | 23:17 | |
| *** r-daneel has quit IRC | 23:24 | |
| SamYaple | if i wanted to compare x509 auth to fernet tokens, speed-wise, is there any existing tooling in the project that can help with that? | 23:41 |
| *** oikiki has quit IRC | 23:42 | |
| SamYaple | or, possibly, has this been tested and i can just go view the results? | 23:42 |
| *** oikiki has joined #openstack-keystone | 23:42 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!