| *** tmcm_ has joined #openstack-keystone | 00:00 | |
| *** oikiki has joined #openstack-keystone | 00:01 | |
| *** oikiki has quit IRC | 00:02 | |
| *** tmcm has quit IRC | 00:02 | |
| *** tmcm_ is now known as tmcm | 00:02 | |
| *** felipemonteiro has joined #openstack-keystone | 00:07 | |
| *** ilush has quit IRC | 00:30 | |
| *** gyankum has joined #openstack-keystone | 00:32 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:32 | |
| *** zhurong has joined #openstack-keystone | 00:32 | |
| *** blake has joined #openstack-keystone | 00:44 | |
| *** gyankum has quit IRC | 00:44 | |
| *** odyssey4me has quit IRC | 00:53 | |
| *** odyssey4me has joined #openstack-keystone | 00:53 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 01:08 | |
| *** r-daneel has quit IRC | 01:11 | |
| *** dikonoo has joined #openstack-keystone | 01:12 | |
| *** gyankum has joined #openstack-keystone | 01:12 | |
| *** blake has quit IRC | 01:12 | |
| *** AlexeyAbashkin has quit IRC | 01:13 | |
| *** dikonoo has quit IRC | 01:33 | |
| *** dikonoor has joined #openstack-keystone | 01:33 | |
| *** blake has joined #openstack-keystone | 01:36 | |
| *** zhongjun_ has joined #openstack-keystone | 01:41 | |
| *** dikonoor has quit IRC | 01:42 | |
| wxy | lbragstad: cool. I was reading it last few days as well. Seems we may have more things to discuss. | 01:46 |
|---|---|---|
| lbragstad | yeah - that's exactly what i was thinking | 01:46 |
| lbragstad | i found this, too | 01:47 |
| lbragstad | which was interesting https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid | 01:47 |
| wxy | the title is interesting. lol | 01:49 |
| lbragstad | :) | 01:49 |
| lbragstad | http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/ is another interesting one | 01:50 |
| lbragstad | both of those articles reference https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ | 01:51 |
| lbragstad | which i included in the security section of the reproposed specification | 01:51 |
| *** tmcm has quit IRC | 01:52 | |
| Dinesh_Bhor | lbragstad: Hi if you have time then could you please take a look at these two patches. Both are having one +2: https://review.openstack.org/#/c/329913/12 , https://review.openstack.org/#/c/267456/ | 02:01 |
| *** blake has quit IRC | 02:18 | |
| *** ykarel|away has joined #openstack-keystone | 02:20 | |
| *** ykarel|away has quit IRC | 02:30 | |
| *** felipemonteiro has quit IRC | 02:31 | |
| *** ykarel|away has joined #openstack-keystone | 02:32 | |
| *** cheran has joined #openstack-keystone | 02:32 | |
| *** ykarel|away has quit IRC | 02:38 | |
| *** itlinux has joined #openstack-keystone | 02:43 | |
| *** gongysh has joined #openstack-keystone | 02:45 | |
| *** daidv has quit IRC | 03:09 | |
| *** jrist has quit IRC | 03:11 | |
| *** jrist has joined #openstack-keystone | 03:12 | |
| *** links has joined #openstack-keystone | 03:12 | |
| *** harlowja has quit IRC | 03:24 | |
| *** daidv has joined #openstack-keystone | 03:24 | |
| *** cheran has quit IRC | 03:29 | |
| *** nicolasbock has quit IRC | 03:47 | |
| *** zeus has quit IRC | 03:49 | |
| *** annp has quit IRC | 03:49 | |
| *** zeus has joined #openstack-keystone | 03:51 | |
| *** zeus is now known as Guest88902 | 03:51 | |
| *** Krenair has quit IRC | 03:51 | |
| *** Krenair has joined #openstack-keystone | 03:54 | |
| *** dave-mccowan has quit IRC | 03:56 | |
| *** dave-mccowan has joined #openstack-keystone | 03:58 | |
| kmalloc | lbragstad: we are mostly stateful tokens (live check each step) and appear to be more immune to the concerns in that article than implied as a straight session management. | 03:59 |
| *** harlowja has joined #openstack-keystone | 03:59 | |
| kmalloc | That said, if we encryption not just signed (mirroring fernet) we are pretty darn safe, minus normal beaerer token issues. We are using JWT as a claim transport, not as a all encompassing session manager -- and we don't rely on js to pull the data in. | 04:00 |
| kmalloc | The link in the spec is good to have | 04:00 |
| kmalloc | I'll do more analysis when not on a phone and trying to read/irc at the same time. | 04:01 |
| kmalloc | But tl;dr of that article is "bearer tokens are bad, mmmkay, and have security concerns" esp. when coupled with using js to load data from local store. | 04:03 |
| *** germs has quit IRC | 04:04 | |
| *** germs has joined #openstack-keystone | 04:04 | |
| *** germs has quit IRC | 04:04 | |
| *** germs has joined #openstack-keystone | 04:04 | |
| *** germs has quit IRC | 04:04 | |
| *** germs has joined #openstack-keystone | 04:05 | |
| *** germs has quit IRC | 04:05 | |
| *** germs has joined #openstack-keystone | 04:05 | |
| kmalloc | re: the vuln... i think we can be smarter than the libraries and just wrap the alg bit ourselves and throw out bad tokens. | 04:06 |
| kmalloc | lbragstad: ^ not that we should have to... but i want keystone to explictly only allow algs we say we support (aka, I would violate the standard and not allow None) | 04:07 |
| *** germs has quit IRC | 04:09 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 04:09 | |
| wxy | kmalloc: ++ yeah. We can add deeper limit or function in Keystone to enhance the libraries. | 04:10 |
| kmalloc | wxy: :) | 04:10 |
| *** sticker has quit IRC | 04:12 | |
| *** AlexeyAbashkin has quit IRC | 04:14 | |
| *** dave-mcc_ has joined #openstack-keystone | 04:16 | |
| *** dave-mccowan has quit IRC | 04:16 | |
| *** ykarel|away has joined #openstack-keystone | 04:17 | |
| *** ykarel_ has joined #openstack-keystone | 04:22 | |
| *** ykarel|away has quit IRC | 04:24 | |
| *** dklyle has quit IRC | 04:26 | |
| *** daidv has quit IRC | 04:28 | |
| *** daidv has joined #openstack-keystone | 04:28 | |
| *** dave-mcc_ has quit IRC | 04:46 | |
| *** daidv has quit IRC | 04:50 | |
| *** daidv has joined #openstack-keystone | 04:50 | |
| *** rcernin_ has joined #openstack-keystone | 04:59 | |
| *** rcernin has quit IRC | 05:00 | |
| *** zhurong has quit IRC | 05:04 | |
| *** belmoreira has joined #openstack-keystone | 05:30 | |
| *** r-daneel has joined #openstack-keystone | 05:38 | |
| *** r-daneel has quit IRC | 05:42 | |
| *** dangtrinhnt has joined #openstack-keystone | 05:44 | |
| *** zhurong has joined #openstack-keystone | 05:48 | |
| *** dangtrinhnt has quit IRC | 06:00 | |
| *** germs has joined #openstack-keystone | 06:05 | |
| *** germs has quit IRC | 06:05 | |
| *** germs has joined #openstack-keystone | 06:05 | |
| *** harlowja has quit IRC | 06:06 | |
| *** germs has quit IRC | 06:10 | |
| *** rcernin_ has quit IRC | 06:14 | |
| *** rcernin has joined #openstack-keystone | 06:17 | |
| openstackgerrit | Merged openstack/oslo.policy master: add lower-constraints job https://review.openstack.org/556068 | 06:23 |
| *** dangtrinhnt has joined #openstack-keystone | 06:27 | |
| *** ykarel__ has joined #openstack-keystone | 06:34 | |
| *** ykarel_ has quit IRC | 06:36 | |
| *** martinus__ has joined #openstack-keystone | 06:38 | |
| *** d0ugal_ has joined #openstack-keystone | 06:39 | |
| *** d0ugal has quit IRC | 06:42 | |
| *** rcernin has quit IRC | 07:03 | |
| *** gyan_ has joined #openstack-keystone | 07:03 | |
| *** ykarel_ has joined #openstack-keystone | 07:03 | |
| *** blake has joined #openstack-keystone | 07:04 | |
| *** gyankum has quit IRC | 07:04 | |
| *** ykarel__ has quit IRC | 07:04 | |
| *** gyan__ has joined #openstack-keystone | 07:05 | |
| *** links has quit IRC | 07:05 | |
| *** links has joined #openstack-keystone | 07:06 | |
| *** ykarel__ has joined #openstack-keystone | 07:06 | |
| *** ykarel_ has quit IRC | 07:09 | |
| *** gyan_ has quit IRC | 07:09 | |
| *** oikiki has joined #openstack-keystone | 07:20 | |
| *** tesseract has joined #openstack-keystone | 07:22 | |
| *** jrist has quit IRC | 07:27 | |
| *** jrist has joined #openstack-keystone | 07:28 | |
| *** blake has quit IRC | 07:40 | |
| *** daidv has quit IRC | 07:46 | |
| *** ykarel__ is now known as ykarel | 07:49 | |
| *** ykarel_ has joined #openstack-keystone | 07:51 | |
| *** ykarel has quit IRC | 07:53 | |
| *** oikiki has quit IRC | 08:00 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:00 | |
| *** daidv has joined #openstack-keystone | 08:03 | |
| *** germs has joined #openstack-keystone | 08:06 | |
| *** germs has quit IRC | 08:06 | |
| *** germs has joined #openstack-keystone | 08:06 | |
| *** AlexeyAbashkin has quit IRC | 08:07 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:10 | |
| *** germs has quit IRC | 08:11 | |
| *** rcernin has joined #openstack-keystone | 08:48 | |
| *** Alexey_Abashkin has joined #openstack-keystone | 08:52 | |
| *** AlexeyAbashkin has quit IRC | 08:54 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 08:54 | |
| *** AlexeyAbashkin has quit IRC | 08:55 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:58 | |
| *** zhurong has quit IRC | 09:00 | |
| *** kukacz_ has joined #openstack-keystone | 09:10 | |
| *** dangtrinhnt has quit IRC | 09:15 | |
| *** Dinesh_Bhor has quit IRC | 09:23 | |
| *** mvk has quit IRC | 09:34 | |
| *** kukacz_ has quit IRC | 09:41 | |
| *** kukacz_ has joined #openstack-keystone | 09:42 | |
| *** ykarel_ is now known as ykarel | 09:51 | |
| *** kukacz_ is now known as kukacz | 09:52 | |
| *** dulek has left #openstack-keystone | 10:00 | |
| *** germs has joined #openstack-keystone | 10:07 | |
| *** germs has quit IRC | 10:07 | |
| *** germs has joined #openstack-keystone | 10:07 | |
| *** gyan__ has quit IRC | 10:09 | |
| *** aojea has joined #openstack-keystone | 10:09 | |
| *** germs has quit IRC | 10:12 | |
| *** raildo has joined #openstack-keystone | 10:15 | |
| *** aojea has quit IRC | 10:23 | |
| *** nicolasbock has joined #openstack-keystone | 10:32 | |
| *** abhi89 has joined #openstack-keystone | 10:42 | |
| *** AlexeyAbashkin has quit IRC | 10:53 | |
| *** voelzmo has joined #openstack-keystone | 10:55 | |
| *** ilush has joined #openstack-keystone | 11:00 | |
| *** voelzmo has quit IRC | 11:01 | |
| *** voelzmo has joined #openstack-keystone | 11:01 | |
| *** dangtrinhnt has joined #openstack-keystone | 11:03 | |
| *** aojea has joined #openstack-keystone | 11:05 | |
| *** mvk has joined #openstack-keystone | 11:05 | |
| *** deepak_ has quit IRC | 11:06 | |
| *** aojea has quit IRC | 11:10 | |
| *** dangtrinhnt has quit IRC | 11:16 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 11:18 | |
| *** deepak_ has joined #openstack-keystone | 11:19 | |
| *** abhi89 has quit IRC | 11:25 | |
| *** edmondsw has joined #openstack-keystone | 11:30 | |
| *** ilush has quit IRC | 11:30 | |
| *** aojea has joined #openstack-keystone | 11:34 | |
| *** belmoreira has quit IRC | 11:37 | |
| *** belmoreira has joined #openstack-keystone | 11:41 | |
| *** ykarel has quit IRC | 11:46 | |
| *** ykarel has joined #openstack-keystone | 11:46 | |
| *** martinus__ has quit IRC | 11:49 | |
| *** links has quit IRC | 11:49 | |
| *** ilush has joined #openstack-keystone | 11:50 | |
| *** gongysh has quit IRC | 11:53 | |
| *** links has joined #openstack-keystone | 11:54 | |
| *** nicolasbock has quit IRC | 11:54 | |
| *** rcernin has quit IRC | 12:05 | |
| *** germs has joined #openstack-keystone | 12:08 | |
| *** germs has quit IRC | 12:08 | |
| *** germs has joined #openstack-keystone | 12:08 | |
| *** germs has quit IRC | 12:12 | |
| *** ykarel is now known as ykarel|afk | 12:13 | |
| *** tmcm has joined #openstack-keystone | 12:28 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [WIP]Add hierarchical limit https://review.openstack.org/557696 | 12:32 |
| *** aojea has quit IRC | 12:32 | |
| *** aojea has joined #openstack-keystone | 12:33 | |
| *** voelzmo has quit IRC | 12:42 | |
| *** panbalag has joined #openstack-keystone | 12:44 | |
| *** panbalag has left #openstack-keystone | 12:44 | |
| *** NM has joined #openstack-keystone | 12:44 | |
| *** sapd has joined #openstack-keystone | 12:46 | |
| sapd | hi everyone. Why keystone on Queens release is listen on 5000 only instead of 5000 & 35357? thanks | 12:46 |
| *** aojea has quit IRC | 12:50 | |
| *** odyssey4me has quit IRC | 12:57 | |
| *** odyssey4me has joined #openstack-keystone | 12:57 | |
| *** edmondsw has quit IRC | 12:58 | |
| *** edmondsw has joined #openstack-keystone | 12:59 | |
| *** edmondsw has quit IRC | 13:03 | |
| *** ykarel|afk is now known as ykarel | 13:03 | |
| *** edmondsw has joined #openstack-keystone | 13:05 | |
| *** McClymontS has joined #openstack-keystone | 13:07 | |
| *** belmoreira has quit IRC | 13:13 | |
| *** aojea has joined #openstack-keystone | 13:20 | |
| *** voelzmo has joined #openstack-keystone | 13:32 | |
| knikolla | sapd: because we removed keystone v2.0. In keystone v2.0 5000 and 35357 server different functions but in keystone v3 they are the same so it is not necessary to have both anymore. | 13:34 |
| *** belmoreira has joined #openstack-keystone | 13:36 | |
| *** McClymontS has left #openstack-keystone | 13:36 | |
| *** ykarel is now known as ykarel|away | 13:37 | |
| *** ykarel|away has quit IRC | 13:42 | |
| lbragstad | kmalloc: wxy yeah, i added a section about that in the spec | 13:43 |
| lbragstad | the questions i'm thinking about now is, "do we care if we sign versus just encrypting?" | 13:43 |
| *** felipemonteiro_ has joined #openstack-keystone | 13:46 | |
| lbragstad | sapd: the v2.0 API was removed in queens | 13:46 |
| sapd | thanks knikolla and lbragstad , because I don't see any information in the docs or release note, and install guide is still using port 35357, that make me confused | 13:47 |
| lbragstad | sapd: the v2.0 was designed around the concept of two different applications, or endpoints, one for administrator functionality (port 35357) and one for end user functionality (port 5000) | 13:47 |
| sapd | lbragstad: how about security if we use same port for admin and normal user? | 13:47 |
| lbragstad | we do list it in the release notes - https://docs.openstack.org/releasenotes/keystone/queens.html | 13:48 |
| lbragstad | sapd: the v3 API processes all requests the same way | 13:48 |
| lbragstad | and it handles admin and end user functionality in the application | 13:48 |
| lbragstad | instead of using the deployment architecture to solve the problem | 13:48 |
| sapd | lbragstad: I don't see any information about remove v2.0 api in this release notes. | 13:51 |
| *** felipemonteiro_ has quit IRC | 13:51 | |
| lbragstad | sapd: https://docs.openstack.org/releasenotes/keystone/queens.html#other-notes | 13:52 |
| lbragstad | https://blueprints.launchpad.net/keystone/+spec/removed-as-of-queens | 13:52 |
| sapd | yep. lbragstad I don't go to blueprint link, So I don't understand it. Thanks again | 13:53 |
| lbragstad | yep | 13:53 |
| *** r-daneel has joined #openstack-keystone | 13:58 | |
| *** dave-mccowan has joined #openstack-keystone | 14:02 | |
| *** r-daneel_ has joined #openstack-keystone | 14:04 | |
| *** r-daneel has quit IRC | 14:04 | |
| *** r-daneel_ is now known as r-daneel | 14:04 | |
| *** ykarel|away has joined #openstack-keystone | 14:05 | |
| *** germs has joined #openstack-keystone | 14:09 | |
| *** germs has quit IRC | 14:09 | |
| *** germs has joined #openstack-keystone | 14:09 | |
| *** germs has quit IRC | 14:13 | |
| *** NM has quit IRC | 14:13 | |
| *** ykarel|away is now known as ykarel | 14:14 | |
| *** jlvillal has quit IRC | 14:15 | |
| *** itlinux has quit IRC | 14:22 | |
| *** links has quit IRC | 14:26 | |
| lbragstad | we should get https://review.openstack.org/#/c/557060/ merged soon so that it's out of the way for other specs looking to land soon (api creds) | 14:26 |
| gagehugo | lbragstad done | 14:33 |
| gagehugo | s/done/reviewed | 14:34 |
| lbragstad | gagehugo: thank you | 14:34 |
| *** david-lyle has joined #openstack-keystone | 14:45 | |
| *** aojea has quit IRC | 15:02 | |
| openstackgerrit | Merged openstack/keystone-specs master: Log queens specifications with previous releases https://review.openstack.org/557060 | 15:04 |
| *** aojea has joined #openstack-keystone | 15:05 | |
| *** ilush has quit IRC | 15:07 | |
| *** felipemonteiro_ has joined #openstack-keystone | 15:09 | |
| *** aojea has quit IRC | 15:09 | |
| *** jlvillal has joined #openstack-keystone | 15:12 | |
| *** spilla has joined #openstack-keystone | 15:14 | |
| *** itlinux has joined #openstack-keystone | 15:19 | |
| *** itlinux has quit IRC | 15:26 | |
| *** itlinux has joined #openstack-keystone | 15:37 | |
| *** aojea has joined #openstack-keystone | 15:46 | |
| *** aojea has quit IRC | 15:51 | |
| *** links has joined #openstack-keystone | 15:54 | |
| *** voelzmo has quit IRC | 15:57 | |
| *** voelzmo has joined #openstack-keystone | 15:57 | |
| *** belmoreira has quit IRC | 16:02 | |
| *** voelzmo has quit IRC | 16:02 | |
| *** itlinux has quit IRC | 16:03 | |
| *** itlinux has joined #openstack-keystone | 16:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Repropose JWT specification for Rocky https://review.openstack.org/541903 | 16:09 |
| *** germs has joined #openstack-keystone | 16:09 | |
| *** germs has quit IRC | 16:09 | |
| *** germs has joined #openstack-keystone | 16:09 | |
| *** germs has quit IRC | 16:14 | |
| lbragstad | well - it looks like we're only going to be able to implement jws if we do jwt | 16:16 |
| lbragstad | the only library available that implements jwe is GPLv3 licensed | 16:16 |
| gagehugo | hmm | 16:17 |
| lbragstad | unless we go help one of those libraries implement jwe | 16:20 |
| *** links has quit IRC | 16:22 | |
| lbragstad | looks like both python-jose and pyjwt use pyca/cryptography for signing stuff | 16:32 |
| *** spilla has quit IRC | 16:37 | |
| gagehugo | yeah | 16:40 |
| gagehugo | spec seems to look good, probably some discussion points though | 16:40 |
| lbragstad | yeah... lots to discuss | 16:43 |
| lbragstad | if i'm reading headless tokens correctly, the author is implying JWEs | 16:49 |
| *** gyee has joined #openstack-keystone | 16:49 | |
| lbragstad | "A JWT consists of a protected payload together with a plaintext "header" section." | 16:49 |
| lbragstad | well.. if protected == encrypted | 16:50 |
| lbragstad | then JWE is implied | 16:51 |
| lbragstad | otherwise, if protected == verified | 16:51 |
| lbragstad | then JWS is a possibility | 16:51 |
| lbragstad | but yeah - i suppose if we did do JWT and only used JWS, then headless would be a good option | 16:53 |
| *** AlexeyAbashkin has quit IRC | 16:53 | |
| lbragstad | because that would leave generating the head up to keystone | 16:53 |
| lbragstad | header* | 16:53 |
| lbragstad | which means specifying the algorithm and everything | 16:54 |
| *** jaosorior has quit IRC | 16:56 | |
| *** mvk has quit IRC | 16:57 | |
| *** itlinux has quit IRC | 16:57 | |
| lbragstad | as far as signing goes... i think regardess we're going to be using the same library | 17:01 |
| lbragstad | (pyca/cryptography) | 17:01 |
| lbragstad | jwt uses cryptography exclusively for signing operations | 17:02 |
| lbragstad | python-jose gives you the option to use either | 17:02 |
| lbragstad | pycrypto or cryptography | 17:02 |
| lbragstad | but we've moved away from pycrypto (for python3 support iirc) | 17:02 |
| lbragstad | and i believe the fernet implementation in pyca/cryptography uses the signing bits of the same library | 17:03 |
| lbragstad | so - if there is ever a vulnerability in the signing implementation of cryptography, all our token formats would be susceptible | 17:04 |
| lbragstad | paseto apparently uses a different signing approach | 17:10 |
| lbragstad | https://github.com/stef/pysodium | 17:11 |
| *** david-lyle has quit IRC | 17:15 | |
| *** cheran has joined #openstack-keystone | 17:15 | |
| * lbragstad breaks for lunch | 17:25 | |
| *** felipemonteiro__ has joined #openstack-keystone | 17:30 | |
| *** felipemonteiro_ has quit IRC | 17:34 | |
| *** aojea has joined #openstack-keystone | 17:35 | |
| gagehugo | the saltiest python library | 17:37 |
| *** spilla has joined #openstack-keystone | 17:37 | |
| *** aojea has quit IRC | 17:39 | |
| *** germs has joined #openstack-keystone | 17:45 | |
| *** germs has quit IRC | 17:45 | |
| *** germs has joined #openstack-keystone | 17:45 | |
| *** germs has quit IRC | 17:45 | |
| *** germs has joined #openstack-keystone | 17:46 | |
| *** germs has quit IRC | 17:46 | |
| *** germs has joined #openstack-keystone | 17:46 | |
| *** r-daneel_ has joined #openstack-keystone | 17:51 | |
| *** r-daneel has quit IRC | 17:52 | |
| *** r-daneel_ is now known as r-daneel | 17:52 | |
| *** itlinux has joined #openstack-keystone | 17:56 | |
| *** r-daneel has quit IRC | 17:56 | |
| *** r-daneel has joined #openstack-keystone | 17:57 | |
| *** oikiki has joined #openstack-keystone | 17:59 | |
| *** sapd has quit IRC | 18:01 | |
| *** harlowja has joined #openstack-keystone | 18:01 | |
| *** david-lyle has joined #openstack-keystone | 18:05 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:18 | |
| *** AlexeyAbashkin has quit IRC | 18:23 | |
| *** voelzmo has joined #openstack-keystone | 18:24 | |
| *** voelzmo_ has joined #openstack-keystone | 18:25 | |
| *** voelzmo has quit IRC | 18:28 | |
| *** mkosobucki has joined #openstack-keystone | 18:29 | |
| *** tesseract has quit IRC | 18:31 | |
| *** rmcall has joined #openstack-keystone | 18:32 | |
| *** aojea has joined #openstack-keystone | 18:33 | |
| *** oikiki has quit IRC | 18:35 | |
| *** oikiki has joined #openstack-keystone | 18:35 | |
| knikolla | lbragstad: do we have a policy option for adding a role assignment for a project? | 18:35 |
| *** oikiki has quit IRC | 18:35 | |
| knikolla | the `openstack role add --user <user> --project <project>` call | 18:36 |
| lbragstad | knikolla: yeah - i believe that is classified as a grant policy | 18:42 |
| lbragstad | knikolla: https://github.com/openstack/keystone/blob/master/keystone/common/policies/grant.py#L89-L101 | 18:43 |
| knikolla | lbragstad: thanks, forgot about the word grant | 18:43 |
| knikolla | wanted to see if we have enough granularity to say "allow people who have the project_admin role on a project to assign roles to people on that project" but that doesn't seem to be possible. | 18:44 |
| lbragstad | knikolla: right - we'd need to deprecate that create_grant policy and provide a substitute at the project, domain, and system levels | 18:51 |
| *** voelzmo_ has quit IRC | 18:59 | |
| *** oikiki has joined #openstack-keystone | 18:59 | |
| *** aojea has quit IRC | 19:01 | |
| *** voelzmo has joined #openstack-keystone | 19:05 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 19:08 | |
| *** aojea has joined #openstack-keystone | 19:09 | |
| *** AlexeyAbashkin has quit IRC | 19:13 | |
| *** r-daneel_ has joined #openstack-keystone | 19:14 | |
| *** r-daneel has quit IRC | 19:16 | |
| *** r-daneel_ is now known as r-daneel | 19:16 | |
| *** voelzmo has quit IRC | 19:21 | |
| *** mvk has joined #openstack-keystone | 19:53 | |
| gagehugo | lbragstad time to update that change | 19:57 |
| gagehugo | all hail stein | 19:57 |
| lbragstad | bah oh - really? | 19:58 |
| lbragstad | lol | 19:59 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Log warning when using token_flush https://review.openstack.org/556889 | 20:02 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Refactor list_users and related functions https://review.openstack.org/553880 | 20:03 |
| *** raildo has quit IRC | 20:05 | |
| gagehugo | lbragstad missed one :) | 20:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Log warning when using token_flush https://review.openstack.org/556889 | 20:15 |
| lbragstad | gagehugo: ah, thanks! | 20:16 |
| *** aojea has quit IRC | 20:20 | |
| *** aojea has joined #openstack-keystone | 20:23 | |
| *** panbalag has joined #openstack-keystone | 20:34 | |
| *** panbalag has left #openstack-keystone | 20:35 | |
| *** tmcm has quit IRC | 20:38 | |
| *** ykarel is now known as ykarel|away | 20:45 | |
| *** edmondsw has quit IRC | 20:47 | |
| *** edmondsw has joined #openstack-keystone | 20:47 | |
| *** oikiki has quit IRC | 20:50 | |
| *** edmondsw has quit IRC | 20:52 | |
| *** spilla has quit IRC | 21:08 | |
| *** rmcall has quit IRC | 21:12 | |
| *** spilla has joined #openstack-keystone | 21:26 | |
| *** felipemonteiro__ has quit IRC | 21:37 | |
| *** tmcm has joined #openstack-keystone | 21:49 | |
| *** itlinux has quit IRC | 21:57 | |
| *** tmcm has quit IRC | 22:14 | |
| *** spilla has quit IRC | 22:17 | |
| *** edmondsw has joined #openstack-keystone | 22:20 | |
| *** edmondsw has quit IRC | 22:25 | |
| *** ykarel|away has quit IRC | 22:39 | |
| *** ykarel|away has joined #openstack-keystone | 22:39 | |
| *** r-daneel has quit IRC | 22:52 | |
| *** aojea has quit IRC | 22:52 | |
| *** aojea has joined #openstack-keystone | 22:55 | |
| *** ykarel|away has quit IRC | 23:06 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 23:08 | |
| *** itlinux has joined #openstack-keystone | 23:10 | |
| *** AlexeyAbashkin has quit IRC | 23:12 | |
| *** aojea has quit IRC | 23:12 | |
| *** itlinux has quit IRC | 23:22 | |
| *** jroll has quit IRC | 23:37 | |
| *** marius1 has joined #openstack-keystone | 23:42 | |
| *** ediardo has joined #openstack-keystone | 23:45 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!