| *** lifeless_ has joined #openstack-keystone | 00:06 | |
| *** markguz has quit IRC | 00:06 | |
| *** lifeless has quit IRC | 00:06 | |
| *** r-daneel has joined #openstack-keystone | 00:08 | |
| *** _KaszpiR_ has quit IRC | 00:16 | |
| *** _KaszpiR_ has joined #openstack-keystone | 00:18 | |
| *** zzzeek has quit IRC | 00:25 | |
| *** zzzeek has joined #openstack-keystone | 00:27 | |
| *** felipemonteiro has joined #openstack-keystone | 00:30 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:31 | |
| *** DHE has joined #openstack-keystone | 00:48 | |
| DHE | if I'm using fernet tokens, that means that the keystone database is largely read-only right? I'm thinking of making a somewhat highly available/distributed keystone system with read-only satellite nodes and only one master that can tolerate its failure. | 00:52 |
|---|---|---|
| *** felipemonteiro has quit IRC | 01:04 | |
| *** gyee has quit IRC | 01:25 | |
| *** links has joined #openstack-keystone | 01:33 | |
| *** r-daneel has quit IRC | 01:48 | |
| *** brad[] has joined #openstack-keystone | 01:55 | |
| *** bhagyashris has quit IRC | 02:14 | |
| *** bhagyashris has joined #openstack-keystone | 02:15 | |
| *** lifeless_ has quit IRC | 02:26 | |
| *** itlinux has joined #openstack-keystone | 02:43 | |
| *** lifeless has joined #openstack-keystone | 02:43 | |
| *** rcernin has quit IRC | 02:52 | |
| *** sonuk has joined #openstack-keystone | 03:01 | |
| adriant | DHE, yes fernet makes the db mostly read only, but the more common way seems to be to just go for a multi-master approach at that stage because forcing write actions against the one node that can write might end up weird | 03:08 |
| *** felipemonteiro has joined #openstack-keystone | 03:09 | |
| *** rcernin has joined #openstack-keystone | 03:09 | |
| *** ykarel|away has joined #openstack-keystone | 03:49 | |
| *** rcernin has quit IRC | 03:55 | |
| *** germs has quit IRC | 04:07 | |
| *** lifeless has quit IRC | 04:08 | |
| *** rcernin has joined #openstack-keystone | 04:14 | |
| *** lifeless has joined #openstack-keystone | 04:14 | |
| *** lifeless has quit IRC | 04:20 | |
| *** lifeless has joined #openstack-keystone | 04:20 | |
| *** lifeless has quit IRC | 04:25 | |
| *** lifeless has joined #openstack-keystone | 04:26 | |
| *** homeski has quit IRC | 04:28 | |
| *** dansmith has quit IRC | 04:29 | |
| *** rm_work has quit IRC | 04:29 | |
| *** zeus has quit IRC | 04:29 | |
| *** lifeless has quit IRC | 04:30 | |
| *** lifeless has joined #openstack-keystone | 04:31 | |
| *** lifeless has quit IRC | 04:36 | |
| *** lifeless has joined #openstack-keystone | 04:37 | |
| *** lifeless has quit IRC | 04:41 | |
| *** lifeless has joined #openstack-keystone | 04:43 | |
| *** ykarel|away is now known as ykarel | 04:44 | |
| *** lifeless has quit IRC | 04:47 | |
| *** lifeless has joined #openstack-keystone | 04:48 | |
| *** lifeless has quit IRC | 04:52 | |
| *** lifeless has joined #openstack-keystone | 04:54 | |
| *** lifeless has quit IRC | 04:58 | |
| *** lifeless has joined #openstack-keystone | 04:59 | |
| *** lifeless has quit IRC | 05:04 | |
| *** lifeless has joined #openstack-keystone | 05:04 | |
| *** lifeless has quit IRC | 05:09 | |
| *** felipemonteiro has quit IRC | 05:10 | |
| *** lifeless has joined #openstack-keystone | 05:10 | |
| *** lifeless has quit IRC | 05:14 | |
| *** lifeless has joined #openstack-keystone | 05:15 | |
| *** felipemonteiro has joined #openstack-keystone | 05:17 | |
| *** felipemonteiro has quit IRC | 05:26 | |
| *** dansmith has joined #openstack-keystone | 05:31 | |
| *** bigjools has joined #openstack-keystone | 05:31 | |
| *** bigjools has joined #openstack-keystone | 05:31 | |
| *** links has quit IRC | 05:32 | |
| *** rm_work has joined #openstack-keystone | 05:32 | |
| *** rm_work has quit IRC | 05:32 | |
| *** rm_work has joined #openstack-keystone | 05:32 | |
| *** dansmith is now known as Guest88320 | 05:32 | |
| *** links has joined #openstack-keystone | 05:56 | |
| *** alex_xu has quit IRC | 05:57 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 05:58 | |
| *** nicolasbock has joined #openstack-keystone | 06:00 | |
| *** alex_xu has joined #openstack-keystone | 06:03 | |
| *** martinus__ has joined #openstack-keystone | 06:05 | |
| *** ykarel is now known as ykarel|afk | 06:23 | |
| *** ykarel|afk has quit IRC | 06:33 | |
| *** ykarel|afk has joined #openstack-keystone | 06:34 | |
| *** namnh has joined #openstack-keystone | 06:37 | |
| *** AlexeyAbashkin has quit IRC | 06:43 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 06:43 | |
| *** mvk has joined #openstack-keystone | 06:44 | |
| *** tommylikehu has quit IRC | 06:45 | |
| *** ykarel|afk is now known as ykarel | 06:46 | |
| *** tommylikehu has joined #openstack-keystone | 06:48 | |
| *** tommylikehu has quit IRC | 06:54 | |
| *** ispp has joined #openstack-keystone | 06:57 | |
| *** tommylikehu has joined #openstack-keystone | 06:59 | |
| *** dikonoor has joined #openstack-keystone | 06:59 | |
| *** tommylikehu has quit IRC | 07:06 | |
| *** tesseract has joined #openstack-keystone | 07:11 | |
| *** tommylikehu has joined #openstack-keystone | 07:12 | |
| cmurphy | adriant: I don't actually know that much about patrole, felipemonteiro is the best person to ask | 07:12 |
| *** peereb has joined #openstack-keystone | 07:15 | |
| *** dikonoo has joined #openstack-keystone | 07:16 | |
| *** dikonoor has quit IRC | 07:20 | |
| *** links has quit IRC | 07:21 | |
| *** links has joined #openstack-keystone | 07:21 | |
| *** pcaruana has joined #openstack-keystone | 07:22 | |
| *** Alexey_Abashkin has joined #openstack-keystone | 07:23 | |
| *** AlexeyAbashkin has quit IRC | 07:24 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 07:24 | |
| *** amoralej|off is now known as amoralej | 07:25 | |
| *** efried has quit IRC | 07:28 | |
| *** efried has joined #openstack-keystone | 07:28 | |
| *** tosky has joined #openstack-keystone | 07:33 | |
| *** annp has joined #openstack-keystone | 07:34 | |
| *** links has quit IRC | 07:42 | |
| *** rcernin has quit IRC | 07:47 | |
| *** belmoreira has joined #openstack-keystone | 07:48 | |
| adriant | cmurphy: thanks, will play with it first and then potentially chat to him. I was very very close to writing (had sort of starting writing something simple) that took a yaml file and used an admin account to make users/sessions and test raw API calls with tokens with only certain roles against our cloud: http://paste.openstack.org/show/724006/ | 07:50 |
| adriant | Patrole saves me a bunch of effort potentially, but at the very least gives me a way to confirm policy files make sense before even touching APIs. | 07:52 |
| adriant | hopefully, if I read the docs right. | 07:53 |
| cmurphy | yes I think so | 07:53 |
| *** links has joined #openstack-keystone | 07:55 | |
| *** ykarel is now known as ykarel|lunch | 08:02 | |
| yankcrime | ping knikolla - did you get any further with ksproj? | 08:37 |
| wxy | lbragstad: add some comments here: https://etherpad.openstack.org/p/keystone-unified-limit-migration-notepad ,L89, need your suggestion. Thanks. | 08:40 |
| *** markvoelker has quit IRC | 08:54 | |
| *** vegarl has quit IRC | 09:03 | |
| *** vegarl has joined #openstack-keystone | 09:05 | |
| *** ykarel|lunch is now known as ykarel | 09:29 | |
| *** rcernin has joined #openstack-keystone | 09:39 | |
| *** Dinesh_Bhor has quit IRC | 09:49 | |
| *** rcernin has quit IRC | 09:53 | |
| *** dikonoor has joined #openstack-keystone | 09:58 | |
| *** dikonoo has quit IRC | 10:02 | |
| *** annp has quit IRC | 10:20 | |
| *** sonuk has quit IRC | 10:41 | |
| knikolla | yankcrime: o/ | 10:42 |
| knikolla | I did. I also did some playing around with adjutant. | 10:44 |
| yankcrime | ah cool, i've been on holiday for a week so still in catch-up mode, but playing around with adjutant is also on my to-do | 10:44 |
| *** dikonoo has joined #openstack-keystone | 10:45 | |
| knikolla | I would really like a vacation. Around 60% of last week was meetings for me. | 10:45 |
| knikolla | Wanna talk about your requirements? | 10:46 |
| *** dikonoor has quit IRC | 10:49 | |
| *** martinus__ has quit IRC | 10:49 | |
| yankcrime | yeah can do, althought my thoughts are probably slightly half-baked | 10:51 |
| *** namnh has quit IRC | 10:51 | |
| yankcrime | basic requirement is user invitation and onboarding (aup awareness / acceptance etc.), i think a lot of what's there in ksproj is along the right lines | 10:54 |
| *** rcernin has joined #openstack-keystone | 10:54 | |
| knikolla | are your users going to be federated? | 10:55 |
| yankcrime | yes, that's the goal | 10:55 |
| yankcrime | originally our thinking was that users would hit a page on which they'd request access, and then an admin would approve those | 10:55 |
| knikolla | makes sense, it's pretty much the same goal that I have. With the addition that users also be able to invite/remove people from their projects. | 10:56 |
| knikolla | ksproj currently can do invites for federated users and prompt for terms of agreement on invite acceptance | 10:58 |
| knikolla | (on master) | 10:58 |
| knikolla | on dev I was working on doing some refactoring so that I could add features to remove/list users from projects | 10:58 |
| *** markvoelker has joined #openstack-keystone | 10:59 | |
| knikolla | based on my testing around adjutant I found that it also does invites, however it doesn't work with federated users | 10:59 |
| knikolla | adriant: ^^ if you're around | 11:00 |
| yankcrime | ah that'd be a showstopper for us then as it stands right now | 11:01 |
| *** dikonoor has joined #openstack-keystone | 11:02 | |
| *** dikonoo has quit IRC | 11:06 | |
| knikolla | yankcrime: I wanna spend slighly more time with it, to see if it's hard or easy to patch that in. | 11:09 |
| knikolla | I'd be happier to maintain ksproj if you're helping but also don't want to duplicate efforts by the community | 11:09 |
| yankcrime | yeah that | 11:10 |
| yankcrime | that's fair enough, i'll do some more hacking around with ksproj as i've a specific deployment in mind for it right now | 11:10 |
| yankcrime | i'll see about filling any gaps along the way and then let you know | 11:11 |
| knikolla | yankcrime: cool, you know where to find me if you have questions. Though keep in mind I'm on EST. | 11:11 |
| yankcrime | no worries, and will do - thanks again knikolla | 11:12 |
| * knikolla goes to shower and have breakfast | 11:12 | |
| *** rcernin has quit IRC | 11:19 | |
| *** markvoelker has quit IRC | 11:30 | |
| *** sonuk has joined #openstack-keystone | 11:38 | |
| *** rcernin has joined #openstack-keystone | 11:39 | |
| *** rcernin has quit IRC | 11:44 | |
| DHE | adriant: regarding my read-only keystone db, I'm mostly looking at it from the standpoint of disaster recovery but with keystone (and only keystone) high availability. if region 1 burns to the ground I'll deal with it manually to get nova, glance etc up and running | 11:48 |
| DHE | but I'm running (or will be running) swift in multiple regions which only depends on keystone and I want to ensure it continues functioning even if region 1 is offline for a fiber cut or something. | 11:49 |
| DHE | so really this is me taking the lazy way out | 11:49 |
| *** raildo has joined #openstack-keystone | 12:05 | |
| *** amoralej is now known as amoralej|lunch | 12:10 | |
| *** sonuk has quit IRC | 12:18 | |
| *** markvoelker has joined #openstack-keystone | 12:26 | |
| *** mchlumsky has joined #openstack-keystone | 12:35 | |
| *** links has quit IRC | 12:43 | |
| *** edmondsw has joined #openstack-keystone | 12:58 | |
| *** markvoelker has quit IRC | 13:00 | |
| *** felipemonteiro has joined #openstack-keystone | 13:03 | |
| hrybacki | Happy Summer (or winter) Solstice y'all | 13:07 |
| *** felipemonteiro has quit IRC | 13:24 | |
| *** markvoelker has joined #openstack-keystone | 13:30 | |
| *** josecastroleon has quit IRC | 13:32 | |
| *** josecastroleon has joined #openstack-keystone | 13:32 | |
| *** josecastroleon has quit IRC | 13:36 | |
| *** josecastroleon has joined #openstack-keystone | 13:36 | |
| openstackgerrit | zhangzhaoshan proposed openstack/oslo.limit master: Update url in HACKING.rst https://review.openstack.org/577162 | 13:39 |
| *** spilla has joined #openstack-keystone | 13:39 | |
| *** amoralej|lunch is now known as amoralej | 13:44 | |
| hrybacki | lbragstad: question -- so we can indicate that rules are deprecated now within policy -- but this isn't meant to indicate that a specific path/method is deprecated/slotted for removal, correct? | 13:48 |
| *** jistr is now known as jistr|mtg | 13:49 | |
| lbragstad | right | 13:50 |
| *** zeus has joined #openstack-keystone | 13:50 | |
| *** zeus is now known as Guest21990 | 13:50 | |
| lbragstad | hrybacki: the DeprecatedRule is only meant to indicate a specific policy name or check string has been deprecated | 13:52 |
| *** Guest21990 is now known as zeus | 13:52 | |
| *** zeus has joined #openstack-keystone | 13:52 | |
| hrybacki | ack, thanks for confirming lbragstad | 13:54 |
| hrybacki | lbragstad: I'm going to start making something similar to https://wiki.openstack.org/wiki/Barbican/Policy for Keystone today -- to assist in the API audit -- is there any additional info points you think I should capture? | 13:55 |
| lbragstad | not that i can think of | 13:56 |
| hrybacki | ++ | 13:57 |
| lbragstad | i bumped the minimum version of python-keystoneclient in osc for https://review.openstack.org/#/q/status:open+project:openstack/python-openstackclient+branch:master+topic:bp/unified-limits | 14:03 |
| lbragstad | ^ that should be working now | 14:03 |
| *** r-daneel has joined #openstack-keystone | 14:11 | |
| *** ykarel is now known as ykarel|away | 14:12 | |
| *** links has joined #openstack-keystone | 14:17 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Simplify the issue token code path https://review.openstack.org/545450 | 14:17 |
| *** dikonoo has joined #openstack-keystone | 14:21 | |
| *** links has quit IRC | 14:23 | |
| *** dikonoor has quit IRC | 14:24 | |
| *** itlinux has quit IRC | 14:31 | |
| *** r-daneel_ has joined #openstack-keystone | 14:43 | |
| *** r-daneel has quit IRC | 14:44 | |
| *** r-daneel_ is now known as r-daneel | 14:44 | |
| openstackgerrit | Merged openstack/oslo.limit master: Update url in HACKING.rst https://review.openstack.org/577162 | 14:50 |
| *** peereb has quit IRC | 14:51 | |
| *** zhongjun__ has joined #openstack-keystone | 14:55 | |
| *** pcaruana has quit IRC | 14:56 | |
| *** josecastroleon has quit IRC | 15:02 | |
| *** josecastroleon has joined #openstack-keystone | 15:02 | |
| *** josecastroleon has quit IRC | 15:04 | |
| *** josecastroleon has joined #openstack-keystone | 15:04 | |
| *** itlinux has joined #openstack-keystone | 15:19 | |
| *** felipemonteiro has joined #openstack-keystone | 15:25 | |
| gagehugo | o/ | 15:26 |
| *** jistr|mtg is now known as jistr | 15:36 | |
| *** jistr is now known as jistr|off | 15:47 | |
| *** ykarel|away has quit IRC | 15:47 | |
| *** dklyle has quit IRC | 15:48 | |
| *** ispp has quit IRC | 15:49 | |
| *** blake has joined #openstack-keystone | 15:52 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Introduce new TokenModel object https://review.openstack.org/559129 | 15:56 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Simplify the issue token code path https://review.openstack.org/545450 | 15:56 |
| *** Guest88320 is now known as dansmith | 15:59 | |
| *** dikonoor has joined #openstack-keystone | 16:00 | |
| *** dikonoo has quit IRC | 16:04 | |
| *** r-daneel_ has joined #openstack-keystone | 16:09 | |
| *** tesseract has quit IRC | 16:09 | |
| *** r-daneel has quit IRC | 16:11 | |
| *** r-daneel_ is now known as r-daneel | 16:11 | |
| *** gyee has joined #openstack-keystone | 16:12 | |
| *** fiddletwix has quit IRC | 16:14 | |
| *** dklyle has joined #openstack-keystone | 16:16 | |
| *** d0ugal has quit IRC | 16:23 | |
| *** tadams12083 has joined #openstack-keystone | 16:28 | |
| *** amoralej is now known as amoralej|off | 16:29 | |
| *** raopajay has joined #openstack-keystone | 16:37 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Remove unclear wording in parameters https://review.openstack.org/577235 | 16:47 |
| *** blake has quit IRC | 16:50 | |
| *** blake has joined #openstack-keystone | 16:50 | |
| *** blake has quit IRC | 16:55 | |
| *** blake has joined #openstack-keystone | 17:01 | |
| *** amoralej|off is now known as amoralej | 17:33 | |
| *** dikonoor has quit IRC | 17:34 | |
| *** r-daneel_ has joined #openstack-keystone | 17:38 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Simple usage docs for implied roles https://review.openstack.org/575911 | 17:39 |
| *** r-daneel has quit IRC | 17:40 | |
| *** r-daneel_ is now known as r-daneel | 17:40 | |
| *** r-daneel_ has joined #openstack-keystone | 17:50 | |
| *** jeremyfreudberg has joined #openstack-keystone | 17:52 | |
| *** r-daneel has quit IRC | 17:52 | |
| *** r-daneel_ is now known as r-daneel | 17:52 | |
| *** blake has quit IRC | 17:55 | |
| *** blake has joined #openstack-keystone | 17:55 | |
| *** blake has quit IRC | 18:00 | |
| openstackgerrit | Jeremy Freudberg proposed openstack/keystone master: Expose duplicate role names bug in trusts https://review.openstack.org/576610 | 18:03 |
| openstackgerrit | Jeremy Freudberg proposed openstack/keystone master: Fix duplicate role names in trusts bug https://review.openstack.org/576611 | 18:03 |
| *** germs has joined #openstack-keystone | 18:05 | |
| *** germs has quit IRC | 18:05 | |
| *** germs has joined #openstack-keystone | 18:05 | |
| jeremyfreudberg | ^ lbragstad, back to you... it would be great if the sahara gate became unblocked today | 18:06 |
| *** blake has joined #openstack-keystone | 18:07 | |
| *** germs has quit IRC | 18:10 | |
| *** AlexeyAbashkin has quit IRC | 18:10 | |
| *** efried is now known as efried_pto | 18:20 | |
| ildikov | knikolla: hi | 18:34 |
| knikolla | ildikov: o/ hi | 18:35 |
| knikolla | in a meeting currently. i should be back in about 30 mins. | 18:35 |
| ildikov | knikolla: I created an etherpad to work out a plan to continue the testing work and have people sign up: https://etherpad.openstack.org/p/ECG_Keystone_Testing | 18:35 |
| ildikov | knikolla: cool, plz ping me, when you're available | 18:35 |
| *** felipemonteiro_ has joined #openstack-keystone | 18:37 | |
| *** felipemonteiro has quit IRC | 18:37 | |
| *** ksavich has joined #openstack-keystone | 18:39 | |
| *** ksavich has quit IRC | 18:40 | |
| tadams12083 | When I run "openstack user list --domain <ldap enabled domain>" I get all my ldap users however when I run "openstack group contains user --group-domain <ldap enabled domain> --user-domain <ldap enabled domain> <ldap groupname> <ldap user>" against an LDAP enabled domain it comes back empty with 0 users. Is there anyone who can point me in the rigth direction for troubleshooting LDAP groups in keystone? | 18:43 |
| lbragstad | jeremyfreudberg: ack - reviewed | 18:44 |
| *** martinus__ has joined #openstack-keystone | 18:44 | |
| kmalloc | lbragstad: if you have a few moments to look at the new enforcer, i'd like to get a "yeah that looks better" or "oh god, kjust as bad or worse" before i write the tests/diving into using it | 18:47 |
| *** amoralej is now known as amoralej|off | 18:59 | |
| openstackgerrit | Jeremy Freudberg proposed openstack/keystone master: Fix duplicate role names in trusts bug https://review.openstack.org/576611 | 19:01 |
| lbragstad | kmalloc: yeah - i can pull that up quick | 19:05 |
| lbragstad | i need a break from the TokenModel refactor anyway | 19:05 |
| *** felipemonteiro__ has joined #openstack-keystone | 19:05 | |
| kmalloc | hehe, i figured you might want a change. | 19:06 |
| *** jeremyfreudberg has left #openstack-keystone | 19:07 | |
| lbragstad | is it https://review.openstack.org/#/c/576639/6 ? | 19:08 |
| *** felipemonteiro_ has quit IRC | 19:09 | |
| *** jmlowe_ has quit IRC | 19:11 | |
| lbragstad | kmalloc: hmm | 19:20 |
| lbragstad | so enforce() is getting replaced with enforce_call()? | 19:21 |
| kmalloc | .enforce_call is called in the method instead of decorating with @protected | 19:21 |
| lbragstad | but it's taking the place of enforce(), right? | 19:21 |
| kmalloc | no. taking the place of @protected/@filteredprotected | 19:22 |
| kmalloc | enforce still exists and is ultimately called down through the oslo_policy enforcer | 19:22 |
| kmalloc | enforce is the lower layer | 19:23 |
| kmalloc | today [pre-flask], we do @protected, which does "check authenticated", then calls common.authorization.check_protection, which then calls check_policy, builds policy_dict, then calls controllers(policy).enforce | 19:23 |
| kmalloc | which calls driver.enforcer, which calls policy_API | 19:24 |
| kmalloc | i think. | 19:24 |
| lbragstad | ok - yeah | 19:24 |
| lbragstad | that sounds right | 19:24 |
| kmalloc | or... the last part is it calls olos_policy.enforcer.enforce | 19:24 |
| kmalloc | it's absurd | 19:24 |
| kmalloc | and that doesn't even take into account callbacks. | 19:24 |
| kmalloc | so, instead of a very crazy call stack | 19:27 |
| kmalloc | ... we now call, in our method: .enforce_call() | 19:27 |
| kmalloc | and supply the same kind of information you'd supply for @protected/@filterprotected | 19:27 |
| kmalloc | and / or target info (which eliminates the callback) | 19:28 |
| kmalloc | since it is called mid-method | 19:28 |
| kmalloc | rather than as a decorator | 19:28 |
| ildikov | knikolla: BTW, are you on the Edge Computing mailing list too? | 19:28 |
| kmalloc | and we have a couple wrappers to throw errors *if* enforce_call isn't called and/or the method isn't explicitly exempted from enforcement | 19:29 |
| lbragstad | ok | 19:30 |
| lbragstad | from a high level view - this seems sane | 19:30 |
| lbragstad | everything seems pretty well encapsulated | 19:31 |
| kmalloc | also i tried to add docstrings up and down and up so that it's "easy" to use | 19:31 |
| lbragstad | that'll be the other big part | 19:31 |
| *** jmlowe has joined #openstack-keystone | 19:32 | |
| kmalloc | right now, good luck knowing what @protected does | 19:32 |
| kmalloc | and what each thing is | 19:32 |
| kmalloc | it took me 3 days to unwind it | 19:32 |
| kmalloc | because it supports doing insane levels of things... and we literally use none of it | 19:32 |
| lbragstad | so - from the perspective of someone looking to write a new keystone API | 19:32 |
| lbragstad | and protect it | 19:32 |
| lbragstad | my main entry point is enforce_call() | 19:33 |
| kmalloc | i even added the same "functionality" to do the "get_member_from_driver" if needed. | 19:33 |
| kmalloc | yep, and the blueprint/API base automatically wraps the "API MUST BE PROTECTED" stuff for you | 19:33 |
| knikolla | ildikov: o/ hi again. yes, i signed up for the edge computing mailing list the other day. | 19:33 |
| kmalloc | and there is a decorator to say "this is a whitelisted/non-protected api" | 19:33 |
| lbragstad | in the case of https://bugs.launchpad.net/keystone/+bug/1750660 | 19:33 |
| openstack | Launchpad bug 1750660 in OpenStack Identity (keystone) "The v3 project API should account for different scopes" [High,Triaged] | 19:33 |
| ildikov | knikolla: great | 19:34 |
| lbragstad | say i want to rework the authorization of that method to properly handle system-scope | 19:34 |
| ildikov | knikolla: two things | 19:34 |
| kmalloc | lbragstad: changing the behavior based upon scope is easy. | 19:34 |
| lbragstad | kmalloc: i call enforce_call() first | 19:35 |
| kmalloc | relatively. | 19:35 |
| lbragstad | then i still have the context available to make the distinction between project-scope, domain-scope, and system-scope? | 19:35 |
| kmalloc | that being said... that change seems like a bad idea. | 19:35 |
| ildikov | knikolla: there's a new thread on Keystone Edge architectures: http://lists.openstack.org/pipermail/edge-computing/2018-June/000294.html | 19:35 |
| kmalloc | calling /v3/projects and getting different respoinses, but then again, i guess that adheres to the "vary" header | 19:36 |
| ildikov | knikolla: talking about what options we have, like federation vs DB replication, etc. | 19:36 |
| lbragstad | kmalloc: i think we'd have to in order to fix admin-ness? | 19:36 |
| kmalloc | lbragstad: yeah. | 19:36 |
| kmalloc | lbragstad: i didn't say we had another option | 19:36 |
| kmalloc | from an api standpoint... gross | 19:36 |
| ildikov | knikolla: I think it could be beneficial to continue the Forum discussion either on the thread or on a follow up meeting | 19:36 |
| lbragstad | if i'm a system admin, i call GET /v3/projects i can get all projects | 19:36 |
| ildikov | knikolla: can you chime in to the thread from Keystone capabilities perspective? | 19:37 |
| kmalloc | lbragstad: do you always get all projects? | 19:37 |
| kmalloc | in that case | 19:37 |
| kmalloc | or [obv. filterable] | 19:37 |
| lbragstad | if i'm a project admin and i call it, i only get projects under the project i admin | 19:37 |
| kmalloc | but assuming GET /projects | 19:37 |
| kmalloc | no ?filerparam | 19:37 |
| ildikov | knikolla: the other thing is that I created an etherpad to organize our testing plans and look for volunteers: https://etherpad.openstack.org/p/ECG_Keystone_Testing | 19:37 |
| kmalloc | system scope = all projects, domain-admin = projects under my domain, project-admin = subprojects under mine? | 19:38 |
| ildikov | knikolla: if you have any further info/pointers to the content already there, plz add them to the etherpad | 19:38 |
| lbragstad | or if i'm a domain admin, and i have project B and C under domain A, if i use a token scoped to domain A, then i should get a list of B and C back (and not E, F, G, which are under a different domain) | 19:38 |
| lbragstad | kmalloc: yaeh - i think so | 19:38 |
| kmalloc | lbragstad: then it's easy, thats business logic | 19:39 |
| lbragstad | cool | 19:39 |
| kmalloc | that just introspecs scope to know what to filter / ask for | 19:39 |
| lbragstad | that's going to be good | 19:39 |
| kmalloc | has zero to do with .enforce_call | 19:39 |
| lbragstad | awesome | 19:39 |
| kmalloc | enforce_call is "can I access the API and/or resource if populated in the policy_dict" | 19:39 |
| kmalloc | because we have %(target) | 19:39 |
| kmalloc | in the DSL, which could be project_foo.id | 19:40 |
| ildikov | knikolla: those were all my topics for today :) | 19:40 |
| kmalloc | and you can check to see if user_id is allowed to <act> on project_foo via %(target) | 19:40 |
| lbragstad | the role_assignment API is another one that is going to be like that | 19:40 |
| lbragstad | e.g. we shouldn't be listing system role assignments when a project admin asks for "all" role assignments | 19:41 |
| kmalloc | yeah, think of enforce as being "are you able to do X, given <rule>" | 19:41 |
| lbragstad | sure | 19:41 |
| kmalloc | if we change what response is looking like | 19:41 |
| kmalloc | enforce has already said "yep, you can do X" | 19:41 |
| lbragstad | ^ that will still be possible right? | 19:41 |
| lbragstad | treat it as a two step thing | 19:41 |
| kmalloc | same concept as project stuff | 19:41 |
| kmalloc | "oh this isn't a system scope, filter system roles" | 19:42 |
| kmalloc | it's all business logic | 19:42 |
| lbragstad | yeah | 19:42 |
| lbragstad | cool | 19:42 |
| lbragstad | calling enforce just makes sure you're access the API with a token of the right authorization and scope | 19:42 |
| knikolla | ildikov: awesome! i'll get right to it. | 19:42 |
| kmalloc | checking user_auth.scope.id[a project id] == target.id | 19:42 |
| kmalloc | is what enforce is meant to do | 19:42 |
| lbragstad | the second step makes sure the response matches that information | 19:43 |
| ildikov | knikolla: cool, thanks much! | 19:43 |
| kmalloc | or if user_auth.scope_type == API.required_scope | 19:43 |
| kmalloc | enforce doesn't care what scope you have unless it is supposed to limit an API to a scope.id or a scope_type | 19:43 |
| lbragstad | sure | 19:44 |
| kmalloc | and enforce doesn't care about what data is being returned | 19:44 |
| lbragstad | right | 19:44 |
| kmalloc | enforce is... like the honey badger </meme>. it just doesn't <redacted for explicit words> | 19:44 |
| lbragstad | that makes sense - so long as it's easy to make that business logic in the methods calling .enforce_call() i'm happy | 19:44 |
| kmalloc | yeah, that is the goal | 19:44 |
| kmalloc | omg. i have AC, and i feel so much better | 19:45 |
| kmalloc | my office was ~10-15 degrees warmer than the rest of the house | 19:45 |
| kmalloc | not ok when that made the office ~90-95 | 19:45 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Simple usage docs for implied roles https://review.openstack.org/575911 | 19:46 |
| kmalloc | lbragstad: oh, this is an easy one: https://review.openstack.org/#/c/576660/ | 19:46 |
| kmalloc | lbragstad: if you want to get us close to dropping the old password column ;) | 19:46 |
| kmalloc | one more cycle after that lands. | 19:46 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Simple usage docs for implied roles https://review.openstack.org/575911 | 19:46 |
| knikolla | lbragstad, cmurphy, gagehugo: fixed the grammar as suggested ^^ | 19:47 |
| *** r-daneel_ has joined #openstack-keystone | 19:58 | |
| *** r-daneel has quit IRC | 19:59 | |
| *** r-daneel_ is now known as r-daneel | 19:59 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: WIP Add docs for case-insensitivity in keystone https://review.openstack.org/576640 | 20:07 |
| *** blake has quit IRC | 20:17 | |
| gagehugo | lbragstad kmalloc: so by default mySQL is case-insensitive right? https://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_backend_sql.py#n310 is a bit confusing | 20:19 |
| lbragstad | correct - i tested that with a devstack install and it failed when i replicated that test by hand | 20:20 |
| kmalloc | Yes. | 20:20 |
| kmalloc | Only for varchar, it is case preserving though. | 20:21 |
| lbragstad | is sqlite case-sensitive? | 20:21 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: WIP Add docs for case-insensitivity in keystone https://review.openstack.org/576640 | 20:22 |
| gagehugo | it looks like it's insensitive | 20:25 |
| *** blake has joined #openstack-keystone | 20:28 | |
| lbragstad | kmalloc: did you happen to see wxy's comments here - https://etherpad.openstack.org/p/keystone-unified-limit-migration-notepad ? | 20:31 |
| kmalloc | lbragstad: did not | 20:33 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: WIP Add docs for case-insensitivity in keystone https://review.openstack.org/576640 | 20:35 |
| *** r-daneel_ has joined #openstack-keystone | 20:37 | |
| *** r-daneel has quit IRC | 20:37 | |
| *** r-daneel_ is now known as r-daneel | 20:37 | |
| *** martinus__ has quit IRC | 20:41 | |
| *** aojea has joined #openstack-keystone | 20:51 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add LDAP user-backed functional testing gate https://review.openstack.org/558940 | 20:53 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add functional testing gate https://review.openstack.org/531014 | 20:54 |
| *** jmlowe has quit IRC | 20:54 | |
| *** raildo has quit IRC | 20:55 | |
| *** felipemonteiro__ is now known as felipemonteiro | 21:11 | |
| *** jmlowe has joined #openstack-keystone | 21:14 | |
| *** ayoung has joined #openstack-keystone | 21:15 | |
| *** blake has quit IRC | 21:19 | |
| *** blake has joined #openstack-keystone | 21:20 | |
| *** blake has quit IRC | 21:24 | |
| *** blake has joined #openstack-keystone | 21:29 | |
| *** blake has quit IRC | 21:30 | |
| *** jmlowe has quit IRC | 21:31 | |
| *** r-daneel has quit IRC | 21:32 | |
| *** blake has joined #openstack-keystone | 21:32 | |
| *** blake has quit IRC | 21:33 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: WIP Add docs for case-insensitivity in keystone https://review.openstack.org/576640 | 21:37 |
| *** blake has joined #openstack-keystone | 21:39 | |
| *** jmlowe has joined #openstack-keystone | 21:39 | |
| *** blake has quit IRC | 21:39 | |
| *** spilla has quit IRC | 21:40 | |
| *** d0ugal has joined #openstack-keystone | 21:42 | |
| *** d0ugal_ has joined #openstack-keystone | 21:44 | |
| *** d0ugal has quit IRC | 21:45 | |
| *** blake has joined #openstack-keystone | 21:49 | |
| *** blake has quit IRC | 21:49 | |
| *** blake has joined #openstack-keystone | 21:52 | |
| *** nicolasbock has quit IRC | 21:54 | |
| *** blake has quit IRC | 21:56 | |
| *** itlinux has quit IRC | 22:04 | |
| *** blake has joined #openstack-keystone | 22:15 | |
| *** germs has joined #openstack-keystone | 22:18 | |
| *** germs has quit IRC | 22:18 | |
| *** germs has joined #openstack-keystone | 22:18 | |
| *** felipemonteiro has quit IRC | 22:18 | |
| *** blake has quit IRC | 22:19 | |
| *** blake has joined #openstack-keystone | 22:19 | |
| *** edmondsw has quit IRC | 22:24 | |
| *** rcernin has joined #openstack-keystone | 22:26 | |
| *** edmondsw has joined #openstack-keystone | 22:26 | |
| *** germs has quit IRC | 22:31 | |
| *** edmondsw has quit IRC | 22:35 | |
| *** edmondsw has joined #openstack-keystone | 22:35 | |
| *** aojea has quit IRC | 22:39 | |
| *** edmondsw has quit IRC | 22:40 | |
| *** itlinux has joined #openstack-keystone | 23:10 | |
| *** tosky has quit IRC | 23:34 | |
| *** blake has quit IRC | 23:49 | |
| *** blake has joined #openstack-keystone | 23:49 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!