| *** d0ugal has quit IRC | 00:05 | |
| *** d0ugal has joined #openstack-keystone | 00:06 | |
| *** hoonetorg has quit IRC | 00:08 | |
| *** hoonetorg has joined #openstack-keystone | 00:13 | |
| *** lbragstad has quit IRC | 00:30 | |
| *** harlowja has quit IRC | 00:41 | |
| *** germs has joined #openstack-keystone | 00:51 | |
| *** gyee has quit IRC | 00:55 | |
| *** panbalag has joined #openstack-keystone | 00:56 | |
| *** germs has quit IRC | 00:57 | |
| ayoung | kmalloc, https://review.openstack.org/#/c/559438/10 so desire was to have lock-password on a user-by-user basis | 01:24 |
|---|---|---|
| ayoung | are we going to modify the policy enforcement as well? | 01:25 |
| kmalloc | No, the policy is open for self service password changes | 01:25 |
| kmalloc | It has to be | 01:25 |
| *** harlowja has joined #openstack-keystone | 01:25 | |
| kmalloc | This doesn't impact admin password setting via patch | 01:25 |
| kmalloc | Only self service password changes. | 01:25 |
| kmalloc | And yes, it is meant to disallow specific users from changing their own password. | 01:26 |
| ayoung | why does the policy have to be open? Why can we not default to _member_ on a domain scoped token, as well? | 01:27 |
| ayoung | right. I get it now | 01:27 |
| ayoung | self service should be performed with an unscoped token | 01:28 |
| kmalloc | Pci-dss, password might be locked or require change. No token can be gained. | 01:28 |
| ayoung | so, more than just policy | 01:28 |
| kmalloc | Yeah. | 01:28 |
| ayoung | hmmm should policy be able to enforce stuff like this? | 01:28 |
| kmalloc | Self service password changes has a lot of extra logic and has to work sans token. | 01:29 |
| ayoung | I mean, it is far outside the set of stuff we enforce on today | 01:29 |
| ayoung | sure...but what is that logic like? | 01:29 |
| kmalloc | Policy might expand, but with @protected it was a nightmare to do with normal enforcement. | 01:29 |
| ayoung | we still have a user object, just no scoped token | 01:29 |
| ayoung | heh | 01:29 |
| ayoung | well, @controller.protected is no longer required | 01:30 |
| ayoung | we can use the functions now, they are just not the norm | 01:30 |
| ayoung | I need to figure out the next step, though. the code is still too complex | 01:30 |
| *** dangtrinhnt has joined #openstack-keystone | 01:31 | |
| kmalloc | Right. But enforcement on this one is weird. Most self service password changes are handled outside of standard rbac for these reasons, and you have flags that change behavior like lock-password, and min passowrd age, etc. You have to do authn at the same time as password change in our case. | 01:31 |
| ayoung | well, not at the same time, just prior to return from the REST call, but I get you | 01:32 |
| kmalloc | Yeah | 01:32 |
| ayoung | and we don't support basic-auth | 01:32 |
| kmalloc | Typing on a phone so. Little shorter responses. | 01:32 |
| ayoung | we really should | 01:32 |
| ayoung | NP | 01:32 |
| ayoung | basic auth, get an unscoped token. | 01:33 |
| kmalloc | Exactly. But we couldn't change that API contract anyway, it would need to be a new API with basic auth. | 01:33 |
| ayoung | put that in a session cookie | 01:33 |
| kmalloc | But we could totally do that. | 01:33 |
| ayoung | submit again for a scoped token | 01:33 |
| ayoung | yep | 01:33 |
| kmalloc | This is solving a direct bug/change from v2, where policy did work. But v3 is very different. | 01:34 |
| ayoung | its good stuff, just I missed a lot of the context and was surprised by the review | 01:34 |
| kmalloc | Since we have user-level flags, I added it that way...also found a bug in our json schema | 01:34 |
| kmalloc | Yah, that's why I jumped to explain ;). I knew you were missing g some context. | 01:34 |
| ayoung | appreciated, and didn't realize it was compliance stuff, but makes sense | 01:35 |
| ayoung | on prep info, | 01:35 |
| ayoung | the issue is that we end up with code like this: | 01:35 |
| ayoung | prep_info = { | 01:35 |
| ayoung | 'f_name': 'create_project', | 01:35 |
| ayoung | 'input_attr': { | 01:35 |
| ayoung | 'project': ref | 01:35 |
| ayoung | } | 01:35 |
| ayoung | } | 01:35 |
| ayoung | authorization.check_protection(self, request, prep_info) | 01:35 |
| ayoung | that is from https://review.openstack.org/#/c/462670/21/keystone/resource/controllers.py | 01:35 |
| kmalloc | (I have 7m before I need to run, FYI) | 01:35 |
| ayoung | NP | 01:35 |
| kmalloc | Ugh, that is kinda ugly. | 01:36 |
| kmalloc | I get why you need it that way though. | 01:36 |
| ayoung | so even if I get rid of prep info, I can | 01:36 |
| ayoung | but I next end up with | 01:36 |
| kmalloc | Still better than @protected. ;) | 01:36 |
| ayoung | authorization.check_protection(self, request, 'function_name', prep_info={ 'input_attr': {'project': ref}) | 01:36 |
| kmalloc | Yah. | 01:37 |
| ayoung | because that is what is used to enforce policy | 01:37 |
| ayoung | so I probably should go one further and build that, with | 01:37 |
| kmalloc | Can we use a @partial to make it better? | 01:37 |
| kmalloc | Not @partial, functools.partial | 01:37 |
| ayoung | authorization.check_protection(self, request, 'function_name', 'input_attr' = project, ref=ref) | 01:37 |
| ayoung | I think I just need to make a few variations on the functions to make them unsurprising | 01:38 |
| kmalloc | Sounds good. | 01:38 |
| ayoung | so instead of check_protected I need something like | 01:38 |
| kmalloc | Need to run, will look when I get home at the backlog/links you send:) | 01:38 |
| ayoung | check_function_protected or check_attribute_protected | 01:38 |
| kmalloc | Time to pick up the new puppy! | 01:38 |
| ayoung | just talking it through, I think I know what I need to do | 01:38 |
| ayoung | OH! | 01:38 |
| ayoung | WHat are you getting? | 01:39 |
| kmalloc | Shiba Inu | 01:39 |
| ayoung | Oh those are gorgeous | 01:39 |
| kmalloc | Yeah :) | 01:39 |
| kmalloc | Pictures will happen tonight/tomorrow. | 01:39 |
| ayoung | OK, I'm totes going to Vancouver by way of Shiba Inu | 01:40 |
| kmalloc | Hehe. | 01:40 |
| kmalloc | I need to book my hotel. | 01:40 |
| kmalloc | No plane this time though! Woo! | 01:40 |
| *** panbalag has left #openstack-keystone | 01:51 | |
| *** tyvhf has joined #openstack-keystone | 02:04 | |
| *** tyvhf has quit IRC | 02:04 | |
| *** pooja_jadhav has quit IRC | 02:40 | |
| *** harlowja has quit IRC | 02:49 | |
| *** edmondsw has quit IRC | 02:56 | |
| *** germs has joined #openstack-keystone | 02:58 | |
| *** germs has quit IRC | 02:58 | |
| *** germs has joined #openstack-keystone | 02:58 | |
| *** germs has quit IRC | 03:03 | |
| *** fried_rice has quit IRC | 03:27 | |
| *** fried_rice has joined #openstack-keystone | 03:27 | |
| openstackgerrit | ayoung proposed openstack/keystone master: Shift to check_policy for resource creation https://review.openstack.org/462670 | 03:52 |
| *** harlowja has joined #openstack-keystone | 04:09 | |
| *** nicolasbock has quit IRC | 04:13 | |
| *** germs has joined #openstack-keystone | 04:59 | |
| *** germs has quit IRC | 04:59 | |
| *** germs has joined #openstack-keystone | 04:59 | |
| *** harlowja has quit IRC | 05:01 | |
| *** germs has quit IRC | 05:03 | |
| *** dklyle has quit IRC | 06:04 | |
| *** dklyle has joined #openstack-keystone | 06:05 | |
| *** harlowja has joined #openstack-keystone | 06:13 | |
| *** harlowja has quit IRC | 06:28 | |
| *** gongysh has joined #openstack-keystone | 06:53 | |
| *** gongysh has quit IRC | 07:05 | |
| *** gongysh has joined #openstack-keystone | 07:17 | |
| *** gongysh has quit IRC | 07:26 | |
| *** fabian has joined #openstack-keystone | 07:49 | |
| *** fabian has quit IRC | 09:28 | |
| *** martinus__ has joined #openstack-keystone | 11:06 | |
| *** panbalag has joined #openstack-keystone | 12:02 | |
| *** panbalag has quit IRC | 12:05 | |
| *** fabian has joined #openstack-keystone | 12:32 | |
| *** panbalag has joined #openstack-keystone | 13:17 | |
| *** fabian has quit IRC | 13:35 | |
| *** panbalag has quit IRC | 13:38 | |
| *** pcichy has joined #openstack-keystone | 13:49 | |
| *** fabian has joined #openstack-keystone | 14:31 | |
| *** lbragstad has joined #openstack-keystone | 15:05 | |
| *** ChanServ sets mode: +o lbragstad | 15:05 | |
| lbragstad | jgrassler: are you going to be at the summit in Vancouver? | 15:20 |
| lbragstad | adriant: same question to you^ | 15:20 |
| lbragstad | cmurphy: what are your thoughts on having a forum session on app creds at the summit? i think we have most of the design figured out | 15:26 |
| lbragstad | so we could have one to justify socializing capability lists | 15:26 |
| lbragstad | but i'm not sure if you were going to incorporate a bit of that into your talk? | 15:28 |
| *** nicolasbock has joined #openstack-keystone | 15:40 | |
| *** lbragstad has quit IRC | 15:43 | |
| *** fried_rice is now known as efried | 16:05 | |
| *** fabian has quit IRC | 16:13 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Fix json schema nullable to add None to ENUM https://review.openstack.org/561348 | 16:41 |
| *** aojea has joined #openstack-keystone | 16:41 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Allow blocking users from self-service password change https://review.openstack.org/559438 | 16:41 |
| -openstackstatus- NOTICE: The Gerrit service at https://review.openstack.org/ will be offline for a minute while it is restarted to pick up a configuration change allowing it to start commenting on stories in StoryBoard, and will return to service momentarily | 16:51 | |
| *** aojea has quit IRC | 16:54 | |
| *** panbalag has joined #openstack-keystone | 16:55 | |
| *** jdennis has quit IRC | 17:08 | |
| *** jdennis has joined #openstack-keystone | 17:11 | |
| *** panbalag has quit IRC | 17:17 | |
| *** r-daneel has quit IRC | 17:30 | |
| *** aojea has joined #openstack-keystone | 17:37 | |
| *** aojea has quit IRC | 17:41 | |
| *** jdennis has quit IRC | 17:50 | |
| *** jdennis has joined #openstack-keystone | 17:51 | |
| *** pcichy has quit IRC | 17:54 | |
| *** r-daneel has joined #openstack-keystone | 18:17 | |
| *** r-daneel_ has joined #openstack-keystone | 18:20 | |
| *** r-daneel has quit IRC | 18:21 | |
| *** r-daneel_ is now known as r-daneel | 18:22 | |
| *** r-daneel has quit IRC | 18:47 | |
| *** r-daneel has joined #openstack-keystone | 19:00 | |
| *** itlinux has joined #openstack-keystone | 19:40 | |
| *** itlinux has quit IRC | 19:50 | |
| *** nicolasbock has quit IRC | 19:52 | |
| *** r-daneel has quit IRC | 20:08 | |
| *** r-daneel has joined #openstack-keystone | 20:09 | |
| *** r-daneel has quit IRC | 20:14 | |
| *** itlinux has joined #openstack-keystone | 20:43 | |
| *** pcaruana has quit IRC | 20:56 | |
| *** martinus__ has quit IRC | 21:10 | |
| *** aojea has joined #openstack-keystone | 21:13 | |
| *** itlinux has quit IRC | 21:16 | |
| *** aojea has quit IRC | 21:18 | |
| *** aojea has joined #openstack-keystone | 21:53 | |
| *** aojea has quit IRC | 22:31 | |
| *** aojea has joined #openstack-keystone | 23:18 | |
| *** aojea has quit IRC | 23:24 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!