| *** germs has quit IRC | 00:04 | |
| *** felipemonteiro has joined #openstack-keystone | 00:07 | |
| *** openstack has joined #openstack-keystone | 00:14 | |
| *** ChanServ sets mode: +o openstack | 00:14 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:21 | |
| *** dave-mccowan has joined #openstack-keystone | 00:21 | |
| *** spilla has joined #openstack-keystone | 00:30 | |
| *** spilla has quit IRC | 00:30 | |
| *** gyee has quit IRC | 00:33 | |
| *** felipemonteiro has quit IRC | 00:42 | |
| *** odyssey4me has quit IRC | 00:53 | |
| *** odyssey4me has joined #openstack-keystone | 00:53 | |
| *** itlinux has joined #openstack-keystone | 01:07 | |
| *** gyankum has joined #openstack-keystone | 01:12 | |
| *** itlinux has quit IRC | 01:15 | |
| *** gongysh has joined #openstack-keystone | 01:16 | |
| *** oikiki has quit IRC | 01:35 | |
| *** gongysh has quit IRC | 01:38 | |
| *** germs has joined #openstack-keystone | 02:00 | |
| *** germs has quit IRC | 02:00 | |
| *** germs has joined #openstack-keystone | 02:00 | |
| *** ykarel|away has joined #openstack-keystone | 02:02 | |
| *** germs has quit IRC | 02:04 | |
| *** tmcm has quit IRC | 02:06 | |
| *** dikonoo has joined #openstack-keystone | 02:09 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 02:12 | |
| *** ykarel|away has quit IRC | 02:14 | |
| *** ykarel|away has joined #openstack-keystone | 02:16 | |
| *** AlexeyAbashkin has quit IRC | 02:16 | |
| *** zhurong has joined #openstack-keystone | 02:33 | |
| *** ykarel|away has quit IRC | 02:34 | |
| *** gongysh has joined #openstack-keystone | 02:35 | |
| *** oikiki has joined #openstack-keystone | 02:52 | |
| *** itlinux has joined #openstack-keystone | 03:18 | |
| *** oikiki has quit IRC | 03:44 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-specs master: Hierarchical Unified Limits https://review.openstack.org/540803 | 03:52 |
|---|---|---|
| *** dave-mccowan has quit IRC | 03:55 | |
| *** jaosorior has joined #openstack-keystone | 03:56 | |
| *** germs has joined #openstack-keystone | 04:01 | |
| *** germs has quit IRC | 04:01 | |
| *** germs has joined #openstack-keystone | 04:01 | |
| *** germs has quit IRC | 04:06 | |
| *** ykarel|away has joined #openstack-keystone | 04:15 | |
| *** gongysh has quit IRC | 04:19 | |
| *** namnh has joined #openstack-keystone | 04:27 | |
| *** links has joined #openstack-keystone | 04:46 | |
| *** oikiki has joined #openstack-keystone | 04:51 | |
| *** Dinesh_Bhor has quit IRC | 05:00 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:06 | |
| *** oikiki has quit IRC | 05:07 | |
| *** belmoreira has joined #openstack-keystone | 05:55 | |
| *** oikiki has joined #openstack-keystone | 05:57 | |
| *** germs has joined #openstack-keystone | 06:02 | |
| *** germs has quit IRC | 06:02 | |
| *** germs has joined #openstack-keystone | 06:02 | |
| *** gongysh has joined #openstack-keystone | 06:02 | |
| *** germs has quit IRC | 06:06 | |
| *** oikiki has quit IRC | 06:18 | |
| *** voelzmo has joined #openstack-keystone | 06:18 | |
| *** oikiki has joined #openstack-keystone | 06:20 | |
| *** jaosorior has quit IRC | 06:29 | |
| *** ykarel_ has joined #openstack-keystone | 06:30 | |
| *** ykarel|away has quit IRC | 06:32 | |
| *** pcaruana has joined #openstack-keystone | 06:38 | |
| *** martinus__ has joined #openstack-keystone | 06:53 | |
| *** voelzmo has quit IRC | 06:55 | |
| *** voelzmo has joined #openstack-keystone | 06:55 | |
| *** ykarel__ has joined #openstack-keystone | 07:03 | |
| *** gongysh has quit IRC | 07:04 | |
| *** ykarel_ has quit IRC | 07:06 | |
| *** zhurong has quit IRC | 07:08 | |
| *** voelzmo has quit IRC | 07:08 | |
| *** jaosorior has joined #openstack-keystone | 07:10 | |
| *** gongysh has joined #openstack-keystone | 07:10 | |
| *** voelzmo has joined #openstack-keystone | 07:10 | |
| *** voelzmo has quit IRC | 07:11 | |
| *** ykarel__ is now known as ykarel | 07:13 | |
| *** rcernin has quit IRC | 07:15 | |
| *** voelzmo has joined #openstack-keystone | 07:15 | |
| openstackgerrit | Merged openstack/keystone master: Remove admin interface in sample Apache file https://review.openstack.org/556022 | 07:20 |
| openstackgerrit | Merged openstack/keystone master: Update RDO install guide for v3 https://review.openstack.org/556023 | 07:20 |
| *** tesseract has joined #openstack-keystone | 07:25 | |
| *** pcichy has joined #openstack-keystone | 07:30 | |
| *** voelzmo has quit IRC | 07:36 | |
| *** oikiki has quit IRC | 07:40 | |
| *** belmoreira has quit IRC | 07:49 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:00 | |
| *** germs has joined #openstack-keystone | 08:03 | |
| *** germs has quit IRC | 08:03 | |
| *** germs has joined #openstack-keystone | 08:03 | |
| *** voelzmo has joined #openstack-keystone | 08:04 | |
| *** belmoreira has joined #openstack-keystone | 08:05 | |
| *** germs has quit IRC | 08:08 | |
| *** ilush has joined #openstack-keystone | 08:11 | |
| *** voelzmo has quit IRC | 08:22 | |
| *** pcichy has quit IRC | 08:22 | |
| *** voelzmo has joined #openstack-keystone | 08:22 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Delete project limits when deleting project https://review.openstack.org/538371 | 08:23 |
| *** voelzmo has quit IRC | 08:23 | |
| *** gongysh has quit IRC | 08:23 | |
| *** voelzmo has joined #openstack-keystone | 08:23 | |
| *** voelzmo has quit IRC | 08:24 | |
| *** voelzmo has joined #openstack-keystone | 08:24 | |
| *** rcernin has joined #openstack-keystone | 08:24 | |
| *** voelzmo has quit IRC | 08:24 | |
| *** voelzmo has joined #openstack-keystone | 08:25 | |
| *** voelzmo has quit IRC | 08:25 | |
| *** voelzmo has joined #openstack-keystone | 08:25 | |
| *** voelzmo has quit IRC | 08:26 | |
| *** ilush has quit IRC | 08:30 | |
| openstackgerrit | wanghui proposed openstack/keystonemiddleware master: Update links in README https://review.openstack.org/557189 | 08:32 |
| *** rcernin has quit IRC | 08:42 | |
| *** ilush has joined #openstack-keystone | 08:55 | |
| *** itlinux has quit IRC | 09:36 | |
| *** Dinesh_Bhor has quit IRC | 09:36 | |
| *** ykarel is now known as ykarel|afk | 09:53 | |
| *** germs has joined #openstack-keystone | 10:03 | |
| *** namnh has quit IRC | 10:03 | |
| *** germs has quit IRC | 10:08 | |
| *** ykarel|afk is now known as ykarel | 10:09 | |
| *** ilush has quit IRC | 10:23 | |
| *** tmcm has joined #openstack-keystone | 10:30 | |
| *** tmcm has quit IRC | 10:43 | |
| openstackgerrit | Merged openstack/keystone master: Fix user email in federated shadow users https://review.openstack.org/549723 | 10:47 |
| *** zhurong has joined #openstack-keystone | 10:55 | |
| *** gyankum has quit IRC | 10:56 | |
| *** ykarel_ has joined #openstack-keystone | 11:03 | |
| *** ykarel has quit IRC | 11:04 | |
| *** links has quit IRC | 11:04 | |
| *** links has joined #openstack-keystone | 11:05 | |
| *** ykarel__ has joined #openstack-keystone | 11:05 | |
| *** ykarel_ has quit IRC | 11:08 | |
| *** dave-mccowan has joined #openstack-keystone | 11:09 | |
| *** ilush has joined #openstack-keystone | 11:10 | |
| *** ilush has quit IRC | 11:14 | |
| *** tmcm has joined #openstack-keystone | 11:34 | |
| *** mvk has quit IRC | 11:35 | |
| *** dangtrinhnt has quit IRC | 11:46 | |
| *** ykarel__ is now known as ykarel | 11:49 | |
| *** raildo has joined #openstack-keystone | 11:51 | |
| *** germs has joined #openstack-keystone | 12:04 | |
| *** germs has quit IRC | 12:04 | |
| *** germs has joined #openstack-keystone | 12:04 | |
| *** ilush has joined #openstack-keystone | 12:04 | |
| *** edmondsw has joined #openstack-keystone | 12:06 | |
| *** sapd__ has joined #openstack-keystone | 12:06 | |
| *** germs has quit IRC | 12:08 | |
| *** sapd_ has quit IRC | 12:09 | |
| *** sapd__ has quit IRC | 12:17 | |
| *** sapd_ has joined #openstack-keystone | 12:17 | |
| *** odyssey4me has quit IRC | 12:22 | |
| *** odyssey4me has joined #openstack-keystone | 12:22 | |
| *** sapd_ has quit IRC | 12:27 | |
| *** sapd_ has joined #openstack-keystone | 12:27 | |
| *** sapd_ has quit IRC | 12:32 | |
| *** sapd_ has joined #openstack-keystone | 12:32 | |
| *** zhurong has quit IRC | 12:34 | |
| *** NM has joined #openstack-keystone | 12:35 | |
| *** ilush has quit IRC | 12:44 | |
| *** ilush has joined #openstack-keystone | 12:44 | |
| *** MarkMielke has joined #openstack-keystone | 12:48 | |
| *** sapd__ has joined #openstack-keystone | 12:52 | |
| *** sapd_ has quit IRC | 12:52 | |
| *** mvk has joined #openstack-keystone | 12:58 | |
| *** panbalag has joined #openstack-keystone | 12:59 | |
| gagehugo | o/ | 13:02 |
| *** lbragstad has joined #openstack-keystone | 13:04 | |
| *** ChanServ sets mode: +o lbragstad | 13:04 | |
| *** ykarel_ has joined #openstack-keystone | 13:12 | |
| *** ykarel has quit IRC | 13:12 | |
| *** ykarel__ has joined #openstack-keystone | 13:14 | |
| *** ykarel_ has quit IRC | 13:17 | |
| *** spilla has joined #openstack-keystone | 13:30 | |
| *** ykarel__ is now known as ykarel | 13:31 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Delete project limits when deleting project https://review.openstack.org/538371 | 13:35 |
| *** NM has quit IRC | 13:36 | |
| *** NM has joined #openstack-keystone | 13:38 | |
| *** NM has quit IRC | 13:43 | |
| *** NM has joined #openstack-keystone | 13:45 | |
| *** tmcm has quit IRC | 13:53 | |
| *** tmcm has joined #openstack-keystone | 13:58 | |
| *** germs has joined #openstack-keystone | 14:05 | |
| *** germs has quit IRC | 14:05 | |
| *** germs has joined #openstack-keystone | 14:05 | |
| *** dklyle has joined #openstack-keystone | 14:05 | |
| *** david-lyle has quit IRC | 14:05 | |
| *** jrist has quit IRC | 14:07 | |
| *** dklyle has quit IRC | 14:07 | |
| *** dklyle has joined #openstack-keystone | 14:07 | |
| *** germs has quit IRC | 14:09 | |
| knikolla | o/ | 14:13 |
| *** mchlumsky has joined #openstack-keystone | 14:17 | |
| *** ykarel has quit IRC | 14:20 | |
| *** r-daneel has joined #openstack-keystone | 14:28 | |
| *** NM has quit IRC | 14:31 | |
| *** r-daneel has quit IRC | 14:32 | |
| *** NM has joined #openstack-keystone | 14:32 | |
| *** r-daneel has joined #openstack-keystone | 14:33 | |
| *** felipemonteiro has joined #openstack-keystone | 14:33 | |
| *** jrist has joined #openstack-keystone | 14:33 | |
| *** jrist has quit IRC | 14:33 | |
| *** jrist has joined #openstack-keystone | 14:33 | |
| *** NM has quit IRC | 14:34 | |
| *** NM has joined #openstack-keystone | 14:35 | |
| *** sapd__ has quit IRC | 14:37 | |
| *** sapd__ has joined #openstack-keystone | 14:38 | |
| *** sapd__ has quit IRC | 14:40 | |
| *** sapd__ has joined #openstack-keystone | 14:41 | |
| *** sapd__ has quit IRC | 14:41 | |
| *** sapd__ has joined #openstack-keystone | 14:41 | |
| *** sapd__ has quit IRC | 14:41 | |
| *** sapd__ has joined #openstack-keystone | 14:42 | |
| *** pcichy has joined #openstack-keystone | 14:43 | |
| *** ykarel has joined #openstack-keystone | 14:46 | |
| *** NM has quit IRC | 14:51 | |
| *** NM has joined #openstack-keystone | 14:51 | |
| *** NM has quit IRC | 14:52 | |
| *** kevinbenton has quit IRC | 14:58 | |
| *** NM has joined #openstack-keystone | 14:58 | |
| *** r-daneel has quit IRC | 15:00 | |
| *** links has quit IRC | 15:03 | |
| *** tmcm has quit IRC | 15:03 | |
| lbragstad | huh - with jwt we can actually get around the whole subsecond validation thing | 15:04 |
| *** felipemonteiro_ has joined #openstack-keystone | 15:04 | |
| lbragstad | it's kinda nice that rfc7519 reserves public claims, but doesn't attempt to fill some of them out for you | 15:05 |
| lbragstad | jwt reserves an "iat" claim for issued at times, but doesn't actually populate it I don't think | 15:05 |
| *** devx has joined #openstack-keystone | 15:06 | |
| *** kevinbenton has joined #openstack-keystone | 15:06 | |
| lbragstad | well, maybe that is dependent on the library | 15:06 |
| *** r-daneel has joined #openstack-keystone | 15:07 | |
| lbragstad | it'd be cool if we could just pass values into a library as public claims though | 15:07 |
| *** devx is now known as DevX | 15:07 | |
| *** felipemonteiro has quit IRC | 15:07 | |
| *** lbragstad changes topic to "Rocky release schedule: https://releases.openstack.org/rocky/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/wmyzbFq5/keystone-rocky-roadmap" | 15:07 | |
| knikolla | lbragstad: yeah, it'd be pretty cool. | 15:08 |
| knikolla | lbragstad: a part of me wants to see keystone be a full openid connect | 15:08 |
| knikolla | server | 15:08 |
| *** pcaruana has quit IRC | 15:09 | |
| lbragstad | this is probably a bad idea... but you could do some interesting stuff with nested jwt | 15:10 |
| knikolla | lbragstad: why would you need nested jwt? | 15:11 |
| lbragstad | i was thinking of the federation case again | 15:11 |
| lbragstad | it's probably not needed | 15:11 |
| * lbragstad comes back to earth | 15:11 | |
| *** gyankum has joined #openstack-keystone | 15:11 | |
| knikolla | lbragstad: iss would denote the issuer. if the other keystone has the cert it can verify the signature from that issuer. | 15:12 |
| knikolla | federation made easy. | 15:13 |
| lbragstad | would iss be the issuing keystone or the user? | 15:13 |
| knikolla | yes | 15:13 |
| knikolla | keystone | 15:13 |
| knikolla | technicaly. it doesn't have to be keystone. | 15:13 |
| lbragstad | right | 15:13 |
| lbragstad | so then "sub" would be the user | 15:14 |
| knikolla | yes | 15:14 |
| lbragstad | then you'd have the other things we'd need for various scopes as private claims | 15:14 |
| lbragstad | but we could reuse "iat" and "exp" | 15:14 |
| knikolla | yes. public ones are enough for most things, like iss, sub, iat, exp | 15:15 |
| knikolla | for scope we need some private claims. | 15:15 |
| lbragstad | right | 15:16 |
| lbragstad | how would you relaying information about keystone in "iss" | 15:16 |
| knikolla | like the entityID in saml. | 15:16 |
| lbragstad | would that be the keystone domain name? | 15:17 |
| knikolla | unique identifier for each keystone. | 15:17 |
| knikolla | https://tools.ietf.org/html/rfc7519#section-4.1.1 | 15:18 |
| lbragstad | yep | 15:19 |
| lbragstad | reminder that the policy meeting is going to be next week | 15:21 |
| lbragstad | not today | 15:21 |
| lbragstad | (going to bi-weekly scheduling per discussions prior to the PTG) | 15:22 |
| *** pcichy has quit IRC | 15:22 | |
| knikolla | we could theoretically make keystone a generic openid connect server. | 15:22 |
| knikolla | with minor modifications after introducing jwt | 15:22 |
| lbragstad | i need to read up on oidc | 15:25 |
| knikolla | lbragstad: it's built on top of oauth 2.0 so you might need to start readind up on that. | 15:28 |
| lbragstad | yeah - i've read up on that a few times | 15:29 |
| knikolla | at a minimum we just need two new api endpoints. /authorize and /token | 15:30 |
| knikolla | for issuing jwt access and id tokens, and validating them | 15:31 |
| knikolla | similar to the endpoint for creating ecp saml assertions for k2k | 15:32 |
| lbragstad | right.. | 15:49 |
| lbragstad | that'd be interesting | 15:49 |
| *** itlinux has joined #openstack-keystone | 15:54 | |
| *** belmoreira has quit IRC | 15:57 | |
| *** felipemonteiro_ has quit IRC | 16:00 | |
| *** gyee has joined #openstack-keystone | 16:06 | |
| *** ilush has quit IRC | 16:14 | |
| openstackgerrit | Johannes Grassler proposed openstack/keystone-specs master: Add capabilities to application credentials https://review.openstack.org/396331 | 16:39 |
| gyee | kmalloc, lbragstad: how do people normally reconcile their custom policy.json file with the newly generated policy.json from policy-in-code? | 16:40 |
| lbragstad | gyee: i think that's totally up to them | 16:40 |
| gyee | is there a magic CLI? | 16:40 |
| kmalloc | Yep, what lbragstad said | 16:40 |
| lbragstad | there is a munger | 16:40 |
| lbragstad | but it's provided by oslo.policy | 16:41 |
| lbragstad | oslopolicy-policy-generator | 16:41 |
| *** NM has quit IRC | 16:41 | |
| gyee | does it work like a git rebase | 16:42 |
| gyee | like generate-policy -reconsile customer-file | 16:42 |
| gyee | something like that? | 16:42 |
| lbragstad | it accepts an existing policy file and spits out a complete policy files with the overrides you've provided | 16:42 |
| gyee | nice! | 16:42 |
| lbragstad | it treats anything in the provided policy file as an override | 16:42 |
| lbragstad | and just fills in the holes | 16:42 |
| lbragstad | ideally - this is something you'd only use for horizon | 16:42 |
| lbragstad | (since it requires a copy of policy files in order to provider better ux) | 16:43 |
| gyee | yes, that's for horizon :-) | 16:43 |
| *** germs has joined #openstack-keystone | 16:43 | |
| *** germs has quit IRC | 16:43 | |
| *** germs has joined #openstack-keystone | 16:43 | |
| lbragstad | otherwise, the only thing you need in your policy file are the policies that you've chosen to override for you deployment | 16:43 |
| gyee | thanks for the info guys! let me give it a try | 16:43 |
| *** germs has quit IRC | 16:43 | |
| lbragstad | oslopolicy-checker will actually tell you if you're maintaining redundant policies | 16:43 |
| lbragstad | (e.g. specifying a policy and it's default value in your policy file) | 16:44 |
| *** germs has joined #openstack-keystone | 16:44 | |
| *** germs has quit IRC | 16:44 | |
| *** germs has joined #openstack-keystone | 16:44 | |
| lbragstad | so - a way to see where you can trim fat | 16:44 |
| *** NM has joined #openstack-keystone | 16:44 | |
| gyee | nice | 16:45 |
| *** oikiki has joined #openstack-keystone | 16:53 | |
| *** mvk has quit IRC | 16:56 | |
| *** prometheanfire has joined #openstack-keystone | 16:57 | |
| openstackgerrit | Matthew Thode proposed openstack/keystone master: test pysaml2-4.5.0 https://review.openstack.org/557440 | 16:57 |
| prometheanfire | finally getting around to it | 16:58 |
| *** r-daneel_ has joined #openstack-keystone | 16:59 | |
| *** r-daneel has quit IRC | 17:01 | |
| *** r-daneel_ is now known as r-daneel | 17:01 | |
| *** tmcm has joined #openstack-keystone | 17:03 | |
| *** Mujahid_ has joined #openstack-keystone | 17:08 | |
| *** AlexeyAbashkin has quit IRC | 17:08 | |
| Mujahid_ | cmurphy: Thanks for the quick reply. I have verified that openstack_keystone_url is having /identity only and I have given protocol name as oidc only. When I checked the keystone logs, I got the error message: Error: There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. /opt/stack/keystone/keystone/middleware/auth.py:203}} INFO keystone.common.wsgi mGET http://test-federationhos | 17:09 |
| Mujahid_ | t.com/identity/v3/auth/OS-FEDERATION/websso/oidc?origin=http://ip-of-host/dashboard/auth/websso | 17:09 |
| *** oikiki has quit IRC | 17:19 | |
| *** mvk has joined #openstack-keystone | 17:28 | |
| *** tesseract has quit IRC | 17:35 | |
| *** oikiki has joined #openstack-keystone | 17:36 | |
| *** panbalag has quit IRC | 17:42 | |
| *** felipemonteiro has joined #openstack-keystone | 17:43 | |
| *** felipemonteiro_ has joined #openstack-keystone | 17:43 | |
| *** ilush has joined #openstack-keystone | 17:45 | |
| *** panbalag has joined #openstack-keystone | 17:45 | |
| *** panbalag has left #openstack-keystone | 17:45 | |
| *** felipemonteiro has quit IRC | 17:47 | |
| *** r-daneel_ has joined #openstack-keystone | 17:51 | |
| lbragstad | bahah! | 17:53 |
| lbragstad | https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid | 17:53 |
| *** r-daneel has quit IRC | 17:53 | |
| *** r-daneel_ is now known as r-daneel | 17:53 | |
| lbragstad | see if you catch it | 17:53 |
| cmurphy | found it :) | 17:58 |
| *** jmccrory has quit IRC | 17:59 | |
| *** itlinux has quit IRC | 18:00 | |
| lbragstad | my dog looked at me funny when i laughed out loud in an empty room | 18:03 |
| cmurphy | lol | 18:05 |
| *** jmccrory has joined #openstack-keystone | 18:06 | |
| lbragstad | i'm curious about this paseto thing... | 18:07 |
| lbragstad | it looks like there might be a python library for it | 18:07 |
| cmurphy | Mujahid_: the "there is either no auth token in the request" message is a normal message just meaning a token is being requested, is there anything else in the log? | 18:08 |
| cmurphy | Mujahid_: are the OIDCRedirectURIs correct? pointing to the right identity_provider and protocols? | 18:12 |
| kmalloc | lbragstad: question for you (cc gyee, cmurphy) any insight into the realistic minimum requirements to run a local openstack box? | 18:14 |
| cmurphy | local openstack box? | 18:14 |
| kmalloc | running into serious frustration(s) with virsh directly. [this is for home-lab setups] | 18:14 |
| kmalloc | AIO or even multi-system, but ... need something far more functional that devstack | 18:14 |
| kmalloc | virsh is such a PITA. | 18:14 |
| cmurphy | oh i just virsh with devstack | 18:15 |
| cmurphy | i wrote some helper scripts to make it less painful though https://github.com/cmurphy/gimme-computer | 18:15 |
| *** itlinux has joined #openstack-keystone | 18:15 | |
| lbragstad | +1 to the repo name | 18:15 |
| kmalloc | i mean, i have a Xeon-D 1518, but only 32GB of ram and limited storage. was considering speccing out a new system and a nas box at the same time. | 18:15 |
| lbragstad | kmalloc: what are you using this for? | 18:16 |
| lbragstad | just devstack | 18:16 |
| lbragstad | ? | 18:16 |
| cmurphy | you can have an openstack for < 8G of ram | 18:16 |
| kmalloc | cmurphy: but i also need 16GB of RAM for my firewall, and another gig for Pi-Hole, and another couple gigs for network controller | 18:16 |
| kmalloc | cmurphy: i could jump and toss 64-128GB of ECC in the little box, but i think the proc is going to be overloaded then | 18:17 |
| kmalloc | lbragstad: testing, local "stay current on tech" home-lab things, openstack instances, "play with new software in a VM" stuff. | 18:17 |
| kmalloc | lbragstad: etc. | 18:18 |
| cmurphy | i do most of my upstream work on my 16gb laptop | 18:18 |
| lbragstad | ^ | 18:18 |
| kmalloc | ugh, a fan in my desktop is about to die | 18:18 |
| lbragstad | that's pretty much what i did until recently | 18:18 |
| kmalloc | =/ | 18:18 |
| kmalloc | the grinding sound... uggggh | 18:19 |
| gyee | 8G won't get you much | 18:25 |
| kmalloc | gyee: yeah. i only have about 8G of free (non-allocated) | 18:26 |
| gyee | but it all depends on what services you are running and how many VMs | 18:26 |
| gyee | if you enable Magnum, for example, you 8G box is going to work like a snail :-) | 18:26 |
| kmalloc | LOL assume basic services only | 18:27 |
| kmalloc | KS, Nova, Cinder, Neutron (...), Glance, MySQL | 18:27 |
| gyee | yeah, for just Keystone and Nova, 8G should be fine | 18:27 |
| kmalloc | if i could get away w/ neutron id do that too, but unlikely | 18:27 |
| kmalloc | thankfully i can just dump everything onto an isolate vlan. | 18:28 |
| kmalloc | i wish i could run more systems but also space constrained, have about 3U to work with | 18:28 |
| kmalloc | (or isolated vlan[s]) | 18:28 |
| gyee | make sure to cap the number of processes for the API services too | 18:29 |
| gyee | some API service will spawn off like 20 processes by default :-) | 18:29 |
| kmalloc | meh, i guess i can just keep doing virsh for the moment. | 18:29 |
| kmalloc | it's a little frustraing, i need a new nas regardless. | 18:30 |
| kmalloc | so maybe i'll just spec out a 2u nas and wait until i move for something more powerful for the virt boxes | 18:30 |
| knikolla | lbragstad: just asked, and i can get a 16gb baremetal node long term for the performance testing. that should be enough? | 18:32 |
| *** voelzmo has joined #openstack-keystone | 18:33 | |
| *** gyankum has quit IRC | 18:36 | |
| lbragstad | knikolla: nice! | 18:38 |
| lbragstad | i'll be something - and from the discussions in dublin, consistency was the biggest thing | 18:38 |
| lbragstad | curious what other people think of http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/ | 18:38 |
| Mujahid_ | cmurphy: have a look at my vhost: OIDCRedirectURI http://test-federationhost.com/identity/v3/OS-FEDERATION/identity_providers/myidp/protocols/oidc/auth | 18:39 |
| Mujahid_ | OIDCRedirectURI http://test-federationhost.com/identity/v3/auth/OS-FEDERATION/websso | 18:39 |
| Mujahid_ | OIDCRedirectURI http://test-federationhost.com/identity/v3/auth/OS-FEDERATION/identity_providers/myidp/protocols/oidc/websso | 18:39 |
| openstackgerrit | Merged openstack/keystoneauth master: Be more helpful when version discovery fails https://review.openstack.org/554044 | 18:39 |
| Mujahid_ | apart from keystone.log where else I can find the logs ?? | 18:40 |
| *** gyankum has joined #openstack-keystone | 18:40 | |
| knikolla | Mujahid_: so the goes to horizon, is redirected to keystone, then redirected to the idp, logs in there, comes back to keystone, and that's where it fails? | 18:41 |
| knikolla | lbragstad: i'll read up on that later today, sounds interesting. | 18:41 |
| Mujahid_ | is it Authorized redirect URIs | 18:43 |
| Mujahid_ | for google | 18:43 |
| Mujahid_ | http://test-federationhost.com/identity/v3/auth/OS-FEDERATION/websso/oidc causing issue ?? | 18:43 |
| *** gyankum has quit IRC | 18:48 | |
| *** voelzmo has quit IRC | 18:48 | |
| knikolla | Mujahid_: did you install and enable mod_auth_openidc? | 18:49 |
| Mujahid_ | knikolla: yes. apt-get install libapache2-mod-auth-openidc # a2enmod auth_openidc | 18:50 |
| knikolla | Mujahid_: did you update the apache configuration for keystone to protect the /identity/v3/auth/OS-FEDERATION/websso path with it? | 18:51 |
| Mujahid_ | knikolla: <LocationMatch /identity/v3/OS-FEDERATION/identity_providers/.*?/protocols/oidc/auth> | 18:52 |
| Mujahid_ | AuthType openid-connect | 18:52 |
| Mujahid_ | Require valid-user | 18:52 |
| Mujahid_ | LogLevel debug | 18:52 |
| Mujahid_ | </LocationMatch> | 18:52 |
| Mujahid_ | <Location ~ "/identity/v3/auth/OS-FEDERATION/websso/oidc"> | 18:52 |
| Mujahid_ | AuthType openid-connect | 18:52 |
| Mujahid_ | Require valid-user | 18:52 |
| Mujahid_ | LogLevel debug | 18:52 |
| Mujahid_ | </Location> | 18:52 |
| Mujahid_ | # For horizon | 18:52 |
| Mujahid_ | <Location ~ "/identity/v3/auth/OS-FEDERATION/identity_providers/myidp/protocols/oidc/websso"> | 18:52 |
| Mujahid_ | AuthType openid-connect | 18:53 |
| Mujahid_ | Require valid-user | 18:53 |
| Mujahid_ | LogLevel debug | 18:53 |
| Mujahid_ | </Location> | 18:53 |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:54 | |
| knikolla | Mujahid_: does opening any of those paths in the browser redirect you to google or whatever you idp is? | 18:55 |
| knikolla | open in a private browser window to make sure you're not logged in. | 18:55 |
| Mujahid_ | knikolla: I am getting this error {"error": {"message": "Missing entity ID from environment (Disable insecure_debug mode to suppress these details.)", "code": 401, "title": "Unauthorized"}} for the /identity/v3/auth/OS-FEDERATION/websso/oidc | 18:58 |
| *** AlexeyAbashkin has quit IRC | 18:59 | |
| Mujahid_ | knikolla: it's not at all redirecting me to google login | 18:59 |
| knikolla | Mujahid_: can you paste your apache configuration for keystone in paste.openstack.org? be careful to remove client ids and secrets. | 19:00 |
| Mujahid_ | sure | 19:01 |
| gagehugo | knikolla nice | 19:04 |
| Mujahid_ | knikolla: http://paste.openstack.org/show/716370/ | 19:05 |
| cmurphy | Mujahid_: what is your [auth]/method setting in keystone.conf? it needs to contain the auth protocol name but 'oidc' isn't technically valid | 19:08 |
| knikolla | Mujahid_: that file looks pretty weird. you have uwsgi and wsgi. | 19:09 |
| knikolla | uwsgi on /identity, and wsgi on 5000/35357 | 19:09 |
| knikolla | and you're protecting on 5000. so your redirect uri should be :5000/v3/auth... etc | 19:09 |
| cmurphy | ^ yep | 19:10 |
| knikolla | Mujahid_: what are you advertising as your auth_url? :5000/v3 or /identity/v3? | 19:11 |
| Mujahid_ | identity/v3 | 19:12 |
| Mujahid_ | [auth] | 19:13 |
| Mujahid_ | methods = external,password,token,oauth1,oidc,mapped,openid | 19:13 |
| Mujahid_ | oidc = keystone.auth.plugins.mapped.Mapped | 19:13 |
| knikolla | Mujahid_: why are you running keystone both with uwsgi and through mod_wsgi? | 19:14 |
| knikolla | Mujahid_: anyhow, take all the lines after CustomLog and put them outside of <VirtualHost:5000> | 19:16 |
| Mujahid_ | knikolla: I am very new on apache2 config. so, just googled :) | 19:17 |
| knikolla | Mujahid_: is this devstack? | 19:17 |
| Mujahid_ | yes | 19:18 |
| knikolla | Mujahid_: http://paste.openstack.org/show/716396/ | 19:19 |
| *** dikonoo has quit IRC | 19:19 | |
| knikolla | give this a try ^^ | 19:20 |
| knikolla | also redirect uris need to be valid urls | 19:20 |
| knikolla | also you'll most likely need to register them with your idp. | 19:23 |
| Mujahid_ | sure | 19:23 |
| Mujahid_ | will retry and let you | 19:23 |
| Mujahid_ | knikolla: cmurphy: thank you very much for your help. | 19:24 |
| lbragstad | re: jwt discussion https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ is a pretty good writeup | 19:33 |
| *** MarkMielke has quit IRC | 19:37 | |
| *** felipemonteiro_ has quit IRC | 19:40 | |
| *** felipemonteiro_ has joined #openstack-keystone | 19:40 | |
| knikolla | lbragstad: that was really interesting. | 19:44 |
| lbragstad | right | 19:44 |
| knikolla | alg: none... here no need to validate me. | 19:44 |
| lbragstad | the part i found interesting was that the usability bits of the specification led to ambiguity in the implementations | 19:45 |
| lbragstad | because the header contains the algorithm to be used to verify the token | 19:46 |
| lbragstad | but "alg" can specify an asymmetric verification method or a symmetric on | 19:46 |
| lbragstad | one* | 19:46 |
| lbragstad | so if you know the public key, you can build your own tokens if the application, or library implementing jwt, doesn't actual perform a check | 19:47 |
| lbragstad | or if the applications supports using asymmetric and symmetric encryption for issuing a jwt | 19:48 |
| knikolla | libraries now allow you to specify the algorithm when validating | 19:48 |
| knikolla | pyjwt does at least, cause i've played around with it. | 19:48 |
| lbragstad | yeah.. | 19:48 |
| gagehugo | hmm | 19:48 |
| lbragstad | that post specifically called out pyjwt i think | 19:48 |
| knikolla | https://pyjwt.readthedocs.io/en/latest/usage.html | 19:49 |
| lbragstad | "tl;dr If you are using node-jsonwebtoken, pyjwt, namshi/jose, php-jwt or jsjwt with asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512) please update to the latest version. See jwt.io for more information on the vulnerable libraries. (Updated 2015-04-20)" | 19:49 |
| knikolla | decoded = jwt.decode(encoded, public_key, algorithms='RS256') | 19:49 |
| knikolla | yeah, they got updated to mitigate this issue | 19:49 |
| lbragstad | the paseto stuff is interesting because it implies very specific encryption requirements to a version | 19:51 |
| lbragstad | (kinda like fernet in a way) | 19:51 |
| lbragstad | https://github.com/paragonie/paseto | 19:51 |
| lbragstad | but it also includes the concept of "local" and "public" | 19:52 |
| knikolla | i'm really curious to see if it takes off | 19:53 |
| knikolla | fernet didn't. | 19:53 |
| *** felipemonteiro__ has joined #openstack-keystone | 19:53 | |
| lbragstad | yeah... it's interesting because ParagonIE apparently recommends fernet over jwt,jws,jwe even though it's apparently unmaintained (at least looking from the outside in) | 19:54 |
| knikolla | i think the main point was, there's less rope to hang yourself with fernet. | 19:55 |
| lbragstad | yeah | 19:56 |
| knikolla | the jwt standard is overly broad, and if you want to comply fully with it you need a lot of rope. | 19:56 |
| knikolla | which arguably you don't need to comply with fully. just pick an algorithm and only use that. | 19:56 |
| lbragstad | the specification for jwt describes more ways to achieving the same thing - but attempts to do that with multiple encryption/signing approaches | 19:57 |
| *** tmcm has quit IRC | 19:57 | |
| *** ykarel is now known as ykarel|away | 19:57 | |
| lbragstad | for fernet - if you want a token, it's going to be encrypted with a 128 bit AES encryption key and a 128 bit SHA 256 HMAC signing key | 19:58 |
| *** felipemonteiro_ has quit IRC | 19:58 | |
| lbragstad | *signed with a 128 bit SHA 256 HMAC key | 19:58 |
| *** spilla has quit IRC | 19:59 | |
| knikolla | yes, it leaves no room for choice. | 20:00 |
| lbragstad | right | 20:00 |
| lbragstad | there is one choice and it's verified with the HMAC | 20:00 |
| lbragstad | so - i guess if we were to implement jwt | 20:02 |
| lbragstad | we'd need to make sure that type checking happens | 20:03 |
| knikolla | lbragstad: with the current spec, aren't we prescribing a very specific choice of algorithms? | 20:05 |
| *** ykarel|away has quit IRC | 20:06 | |
| lbragstad | i don't think we did | 20:08 |
| lbragstad | the back logged specification says we plan to use nested jwt | 20:09 |
| lbragstad | so token = jws(jwe(token_payload)) | 20:09 |
| knikolla | hmmm... true. | 20:10 |
| lbragstad | if we agreed on using "alg": "HS256" for example, we'd pretty much hard code that when working with the library | 20:12 |
| prometheanfire | lbragstad: lol, guess the new pysaml2 has some method renames http://logs.openstack.org/34/557434/1/check/cross-keystone-py27/4afebd9/testr_results.html.gz | 20:18 |
| lbragstad | those look like version errors? | 20:19 |
| prometheanfire | ya | 20:21 |
| prometheanfire | oh ya, the real test is in https://review.openstack.org/557440 | 20:22 |
| prometheanfire | lbragstad: so looks like we can just uncap reqs, when keystone merges that change we can then move UC to it | 20:22 |
| prometheanfire | and probably bump the min version required to 4.5.0 as well | 20:23 |
| Mujahid_ | knikolla: cmrphy: Thanks for your help and time. I am logged in now with google. :) | 20:25 |
| lbragstad | prometheanfire: sounds good | 20:27 |
| *** sapd__ has quit IRC | 20:30 | |
| *** sapd__ has joined #openstack-keystone | 20:31 | |
| *** r-daneel_ has joined #openstack-keystone | 20:32 | |
| *** r-daneel has quit IRC | 20:33 | |
| *** r-daneel_ is now known as r-daneel | 20:33 | |
| lbragstad | cmurphy: do you happen to remember the reasoning behind the nested jwt bits in the specification? | 20:34 |
| *** Mujahid_ has quit IRC | 20:38 | |
| *** nicolasbock has joined #openstack-keystone | 20:39 | |
| lbragstad | do we want to kick this through quick? https://review.openstack.org/#/c/557060/ | 20:44 |
| lbragstad | now that the MFA specification has merged | 20:44 |
| *** raildo has quit IRC | 20:51 | |
| *** martinus__ has quit IRC | 20:52 | |
| cmurphy | lbragstad: for encryption | 20:55 |
| cmurphy | it's part of the RFC | 20:55 |
| lbragstad | 7516? | 20:56 |
| cmurphy | 7519 i think | 20:57 |
| lbragstad | oh | 20:57 |
| lbragstad | https://tools.ietf.org/html/rfc7519#appendix-A.2 | 20:58 |
| *** r-daneel_ has joined #openstack-keystone | 21:01 | |
| *** r-daneel has quit IRC | 21:03 | |
| *** r-daneel_ is now known as r-daneel | 21:03 | |
| *** itlinux has quit IRC | 21:14 | |
| *** oikiki has quit IRC | 21:27 | |
| *** oikiki has joined #openstack-keystone | 21:28 | |
| *** panbalag has joined #openstack-keystone | 21:29 | |
| *** NM has quit IRC | 21:30 | |
| *** panbalag has left #openstack-keystone | 21:32 | |
| *** sticker has joined #openstack-keystone | 21:40 | |
| *** edmondsw has quit IRC | 21:43 | |
| -openstackstatus- NOTICE: the zuul web dashboard will experience a short downtime as we roll out some changes - no job execution should be affected | 21:52 | |
| *** harlowja has joined #openstack-keystone | 21:53 | |
| *** aojea has joined #openstack-keystone | 22:23 | |
| *** rcernin has joined #openstack-keystone | 22:28 | |
| *** oikiki has quit IRC | 22:37 | |
| *** oikiki has joined #openstack-keystone | 22:37 | |
| *** oikiki has quit IRC | 22:38 | |
| *** felipemonteiro__ has quit IRC | 22:43 | |
| *** oikiki has joined #openstack-keystone | 22:53 | |
| *** oikiki has quit IRC | 22:55 | |
| *** oikiki has joined #openstack-keystone | 22:56 | |
| *** prometheanfire has left #openstack-keystone | 22:56 | |
| *** oikiki has quit IRC | 22:56 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Repropose JWT specification for Rocky https://review.openstack.org/541903 | 23:02 |
| lbragstad | wxy: i pretty much spent all day reading jwt specs.. i planned on getting a bit farther than ^ | 23:02 |
| lbragstad | but i documented a few things we'll have to watch out for in the implementation | 23:02 |
| lbragstad | i should be back online in a couple hours | 23:03 |
| *** gyee has quit IRC | 23:32 | |
| *** aojea has quit IRC | 23:33 | |
| *** tmcm has joined #openstack-keystone | 23:58 | |
| -openstackstatus- NOTICE: Zuul has been restarted to update to the latest code; existing changes have been re-enqueued, you may need to recheck changes uploaded in the past 10 minutes | 23:58 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!