| *** felipemonteiro has joined #openstack-keystone | 00:02 | |
| *** gyee has quit IRC | 00:17 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:28 | |
| *** itlinux has quit IRC | 00:34 | |
| adriant | knikolla: No Adjutant doesn't do federated invites, but I'm curious how you're doing that in ksproj. Keytstone can't create a user in an external source, so I was going to add support for a pluggable user store which would talk to an external source for users/roles/groups, and handle the keystone parts in keystone. | 00:42 |
|---|---|---|
| knikolla | adriant: I don't do anything to the external source. We are part of a federation of academic institutions, and allow login from any of their identity providers. | 00:45 |
| knikolla | But when a user logs in, they won't have any projects. So invites just assign the logged in federated user to the invited project. | 00:46 |
| adriant | hmmm, in theory then if a shadow user already exists in keystone, Adjutant can potentially 'invite' it and assign a role. | 00:47 |
| knikolla | yep. when someone click on the invite link with the token, they log in, ksproj figures out which user they are based on the token they received from keystone and assigns them. | 00:47 |
| knikolla | so the identity of the token is what defines who is the invited user, rather than their username/email. | 00:48 |
| adriant | oh ok, so until they login, they don't exist in keystone, but once they do, then ksproj can act | 00:50 |
| adriant | so we'd potentially need a similar variant of the invite process in Adjutant that handles a case like that. | 00:51 |
| * adriant needs to play with federation | 00:51 | |
| knikolla | adriant: yep, ksproj -> keystone -> external idp -> keystone (create shadow user) -> ksproj with unscoped token and no roles -> ksproj assign role based on the invite link | 00:53 |
| adriant | knikolla: yeah, I think we can probably do something very similar in Adjutant, and potentially have it dynamic based on what the domain is configured for. | 00:55 |
| adriant | e.g if sql backend, then invite/create user as per normal, if external source, require login and shadow user creation before invite | 00:55 |
| adriant | the Task/action workflow can figure that out, set the token to require certain fields which the gui will interpret in Horizon, and handle that part differently. | 00:56 |
| adriant | or just have two variants of the invite process which you can turn on. | 00:57 |
| knikolla | adriant: i'd be for the latter. We're moving away entirely from SQL users, so we'd want to disable that. | 00:57 |
| knikolla | and enable the federated invite only. | 00:58 |
| adriant | Cool. Yeah, there would be a bunch of work to make it play nice, but I don't think it'd be that painful. And a lot of the code would be the same for both invite processes | 00:59 |
| adriant | and yeah, the way Adjutant's APIs and such are configured you'd effectively have the same API as two different pluggable variants you can turn on. | 00:59 |
| adriant | knikolla: there will hopefully be a lot of work later this year as I refactor a lot of the Adjutant internals, but if you're interested in helping me with features like that, I won't turn you away ;) | 01:02 |
| knikolla | adriant: cool. I'd be happy to help if that avoids me having to maintain another tool. | 01:02 |
| knikolla | but i'd have to finish this up in the coming month or so. | 01:02 |
| adriant | knikolla: no rush, Adjutant should be nicer to work with when I get done with the refactors I have planned anyway, and trying for feature parity with what you end up with in ksproj as the first step you do would be a sensible plan | 01:05 |
| *** blake has quit IRC | 02:00 | |
| *** blake has joined #openstack-keystone | 02:01 | |
| *** blake has quit IRC | 02:05 | |
| *** felipemonteiro has quit IRC | 02:09 | |
| *** felipemonteiro has joined #openstack-keystone | 02:19 | |
| *** felipemonteiro has quit IRC | 02:21 | |
| *** annp has joined #openstack-keystone | 02:23 | |
| *** namnh has joined #openstack-keystone | 02:26 | |
| *** dikonoor has joined #openstack-keystone | 02:30 | |
| *** dikonoor has quit IRC | 02:44 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [WIP]Add auto increase primary key for unified limit https://review.openstack.org/576025 | 02:46 |
| *** sonuk has joined #openstack-keystone | 02:58 | |
| *** ykarel|away has joined #openstack-keystone | 03:35 | |
| *** ykarel|away is now known as ykarel | 04:02 | |
| *** itlinux has joined #openstack-keystone | 04:22 | |
| *** sonuk_ has joined #openstack-keystone | 04:25 | |
| *** sonuk has quit IRC | 04:29 | |
| *** felipemonteiro has joined #openstack-keystone | 05:17 | |
| *** itlinux has quit IRC | 05:23 | |
| *** blake has joined #openstack-keystone | 05:41 | |
| openstackgerrit | Merged openstack/keystone master: Expose duplicate role names bug in trusts https://review.openstack.org/576610 | 05:41 |
| *** blake has quit IRC | 05:43 | |
| *** blake has joined #openstack-keystone | 05:44 | |
| *** nicolasbock has joined #openstack-keystone | 05:53 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 05:54 | |
| *** masber has joined #openstack-keystone | 05:57 | |
| *** felipemonteiro has quit IRC | 05:59 | |
| *** ispp has joined #openstack-keystone | 06:08 | |
| *** AlexeyAbashkin has quit IRC | 06:13 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Added check to avoid keyerror "user['name']" https://review.openstack.org/576433 | 06:24 |
| *** samueldmq has quit IRC | 06:28 | |
| *** samueldmq has joined #openstack-keystone | 06:28 | |
| *** pcaruana has joined #openstack-keystone | 06:30 | |
| *** ykarel_ has joined #openstack-keystone | 06:34 | |
| *** ykarel has quit IRC | 06:36 | |
| *** ykarel_ is now known as ykarel | 06:38 | |
| *** martinus__ has joined #openstack-keystone | 06:43 | |
| *** sonuk_ has quit IRC | 06:52 | |
| *** rcernin has quit IRC | 07:08 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:10 | |
| *** tesseract has joined #openstack-keystone | 07:11 | |
| *** tosky has joined #openstack-keystone | 07:18 | |
| *** blake has quit IRC | 07:21 | |
| *** jistr|off is now known as jistr | 07:34 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add auto increase primary key for unified limit https://review.openstack.org/576025 | 07:35 |
| *** amoralej|off is now known as amoralej | 07:39 | |
| *** d0ugal_ has quit IRC | 08:03 | |
| *** d0ugal has joined #openstack-keystone | 08:04 | |
| *** peereb has joined #openstack-keystone | 08:05 | |
| *** rcernin has joined #openstack-keystone | 08:05 | |
| *** namnh has quit IRC | 08:09 | |
| *** ispp has quit IRC | 08:13 | |
| *** ykarel is now known as ykarel|lunch | 08:23 | |
| *** ispp has joined #openstack-keystone | 08:25 | |
| openstackgerrit | lvxianguo proposed openstack/python-keystoneclient master: fix misspelling of 'default' https://review.openstack.org/577368 | 08:25 |
| *** AlexeyAbashkin has quit IRC | 08:29 | |
| *** josecastroleon has quit IRC | 08:30 | |
| *** rcernin has quit IRC | 08:41 | |
| *** Dinesh__Bhor has joined #openstack-keystone | 09:04 | |
| *** josecastroleon has joined #openstack-keystone | 09:05 | |
| *** Dinesh_Bhor has quit IRC | 09:05 | |
| *** ykarel|lunch is now known as ykarel | 09:07 | |
| *** ykarel has quit IRC | 09:14 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 09:36 | |
| *** Dinesh__Bhor has quit IRC | 09:48 | |
| *** d0ugal has quit IRC | 09:55 | |
| *** d0ugal has joined #openstack-keystone | 09:56 | |
| *** s10 has joined #openstack-keystone | 10:14 | |
| *** ispp has quit IRC | 10:15 | |
| *** bigdogstl has joined #openstack-keystone | 10:17 | |
| *** bigdogstl has quit IRC | 10:17 | |
| *** ispp has joined #openstack-keystone | 10:21 | |
| openstackgerrit | yanpuqing proposed openstack/python-keystoneclient master: Delete keystoneclient.client.HTTPClient and request https://review.openstack.org/577387 | 10:22 |
| *** s10 has quit IRC | 10:23 | |
| openstackgerrit | yanpuqing proposed openstack/python-keystoneclient master: Delete keystoneclient.client.HTTPClient and request https://review.openstack.org/577387 | 10:26 |
| *** annp has quit IRC | 10:30 | |
| *** sapd_ has quit IRC | 11:16 | |
| *** ygl has joined #openstack-keystone | 11:17 | |
| ygl | hi all | 11:20 |
| ygl | can someone guide me to a good link on how to configure keystone-to-keystone federation in openstack ? | 11:20 |
| cmurphy | ygl: did you see https://docs.openstack.org/keystone/latest/advanced-topics/federation/federated_identity.html#keystone-as-an-identity-provider-idp already? | 11:25 |
| ygl | cmurphy: thanks a lot. I will check it | 11:26 |
| cmurphy | ygl: i have a blog post too that might be helpful http://www.gazlene.net/demystifying-keystone-federation.html | 11:28 |
| ygl | cmurphy: thanks | 11:30 |
| *** raildo has joined #openstack-keystone | 11:45 | |
| openstackgerrit | Merged openstack/keystone master: Fix duplicate role names in trusts bug https://review.openstack.org/576611 | 11:48 |
| *** ygl has quit IRC | 11:56 | |
| *** AlexeyAbashkin has quit IRC | 11:57 | |
| *** ygl has joined #openstack-keystone | 11:59 | |
| ygl | cmurphy: can a LDAP be considered as an IdP ? | 12:00 |
| ygl | cmurphy: if that is the case then , can we say a keystone with an LDAP backend as a federated keystone ? | 12:01 |
| cmurphy | ygl: only if you're using Active Directory ADFS which provides a SAML endpoint | 12:02 |
| cmurphy | ygl: LDAP can be used as a regular identity backend for keystone but we wouldn't really call it federated | 12:02 |
| cmurphy | it's more like a drop in replacement for the sql database | 12:02 |
| *** amoralej is now known as amoralej|lunch | 12:07 | |
| ygl | cmurphy: so in the regular AD as identity backend for keystone case. is keystone involved to some extent in managing the authentication ? | 12:08 |
| *** sapd has joined #openstack-keystone | 12:10 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 12:11 | |
| cmurphy | ygl: yes, keystone has to accept credentials and pass them on to AD to do the authentication | 12:12 |
| ygl | cmurphy: ahh ! in that sense it is not a true federation. got it now :) thanks a lot | 12:12 |
| cmurphy | no problem :) | 12:13 |
| *** ygl has quit IRC | 12:15 | |
| *** zhongjun__ has quit IRC | 12:52 | |
| knikolla | o/ | 13:18 |
| *** jistr is now known as jistr|mtg | 13:20 | |
| *** amoralej|lunch is now known as amoralej | 13:22 | |
| *** efried_pto is now known as fried_rice | 13:27 | |
| *** felipemonteiro has joined #openstack-keystone | 13:27 | |
| *** jistr|mtg is now known as jistr | 13:37 | |
| *** jistr is now known as jistr|mtg | 13:43 | |
| *** r-daneel has joined #openstack-keystone | 13:48 | |
| *** r-daneel has quit IRC | 13:48 | |
| *** r-daneel has joined #openstack-keystone | 13:52 | |
| *** lbragstad is now known as elbragstad | 13:52 | |
| *** ispp has quit IRC | 13:57 | |
| *** ispp has joined #openstack-keystone | 13:59 | |
| *** ispp has quit IRC | 14:00 | |
| *** belmorei_ has joined #openstack-keystone | 14:00 | |
| *** ispp has joined #openstack-keystone | 14:00 | |
| *** ispp has quit IRC | 14:01 | |
| *** ispp has joined #openstack-keystone | 14:01 | |
| *** belmoreira has quit IRC | 14:01 | |
| *** josecastroleon has quit IRC | 14:01 | |
| *** josecastroleon has joined #openstack-keystone | 14:02 | |
| *** brad[] has quit IRC | 14:02 | |
| *** spilla has joined #openstack-keystone | 14:03 | |
| *** jistr|mtg is now known as jistr | 14:09 | |
| *** peereb has quit IRC | 14:10 | |
| hrybacki | o/ | 14:27 |
| hrybacki | lbragstad[m]: okay first draft is up (https://docs.google.com/spreadsheets/d/1Bu9KIRDn63XGKhJb4vpc2LiXoTSOHcjRbqWHY--5iMQ/edit#gid=0) but I need to double check things and make some 'cosmetic changes' that I implemented half way through the audit | 14:33 |
| elbragstad | sounds good | 14:34 |
| hrybacki | if there is anything obvious missing please let me know | 14:34 |
| hrybacki | but we can use ^^ to map out (tentatively) all of our APIs to role/scope(s) and I'll start making changes to our policy accordingly | 14:34 |
| elbragstad | cool - i should be able to talk a look a little later today | 14:35 |
| hrybacki | great -- I'll try to get all of my updates in this morning | 14:36 |
| *** felipemonteiro_ has joined #openstack-keystone | 14:40 | |
| *** felipemonteiro has quit IRC | 14:44 | |
| *** afazekas has quit IRC | 15:00 | |
| *** afazekas has joined #openstack-keystone | 15:00 | |
| *** felipemonteiro_ has quit IRC | 15:00 | |
| *** felipemonteiro_ has joined #openstack-keystone | 15:01 | |
| *** r-daneel has quit IRC | 15:02 | |
| gagehugo | o/ | 15:03 |
| *** spilla has quit IRC | 15:06 | |
| *** itlinux has joined #openstack-keystone | 15:11 | |
| *** spilla has joined #openstack-keystone | 15:12 | |
| *** jistr is now known as jistr|afk | 15:30 | |
| *** jistr|afk is now known as jistr | 15:32 | |
| *** belmorei_ has quit IRC | 15:32 | |
| *** ispp has quit IRC | 15:33 | |
| *** gyee has joined #openstack-keystone | 15:41 | |
| elbragstad | kmalloc: what should we do with bind? | 15:50 |
| *** jistr is now known as jistr|off | 15:50 | |
| kmalloc | elbragstad: ? | 15:55 |
| *** larsks has quit IRC | 15:55 | |
| kmalloc | Reading up. | 15:55 |
| *** josecastroleon has quit IRC | 15:56 | |
| *** r-daneel has joined #openstack-keystone | 15:56 | |
| kmalloc | elbragstad: not seeing reference to bind? | 15:59 |
| *** tesseract has quit IRC | 16:02 | |
| *** ispp has joined #openstack-keystone | 16:03 | |
| *** pcaruana has quit IRC | 16:04 | |
| *** nicolasbock has quit IRC | 16:06 | |
| elbragstad | the fernet token provider doesn't support bind | 16:08 |
| elbragstad | and it's the only token provider | 16:08 |
| elbragstad | i'm checking to see what impact that has on x509 | 16:10 |
| kmalloc | bind is, iirc, mostly for krb5 stuff. | 16:10 |
| kmalloc | it sounds like we need to just drop all the bind functionality | 16:11 |
| kmalloc | since we have nothing but fernet | 16:11 |
| elbragstad | https://review.openstack.org/#/c/428388/ | 16:11 |
| kmalloc | non-api impacting. | 16:11 |
| kmalloc | yep | 16:11 |
| kmalloc | lets just drop token-bind code | 16:11 |
| kmalloc | i can roll a patch shortly | 16:12 |
| kmalloc | if you want | 16:12 |
| elbragstad | https://docs.openstack.org/keystone/latest/advanced-topics/configure_tokenless_x509.html | 16:12 |
| elbragstad | strange... | 16:12 |
| *** spilla has quit IRC | 16:12 | |
| elbragstad | so - removing bind won't impact ^ | 16:13 |
| elbragstad | configuring service accounts to authenticate via x509? | 16:13 |
| *** spilla has joined #openstack-keystone | 16:13 | |
| kmalloc | should have zero effect | 16:13 |
| kmalloc | bind was "did the token auth with form X and maintained it" | 16:13 |
| elbragstad | so we supported x509 via token bind and another patch for authentication via x509 that was unreleated | 16:14 |
| kmalloc | right, bind was added enforcement to the token on top of auth | 16:14 |
| elbragstad | ah | 16:14 |
| elbragstad | so we can drop bind code? | 16:14 |
| kmalloc | writing a patch to do so right now | 16:15 |
| kmalloc | :) | 16:15 |
| kmalloc | unless you want to do it | 16:15 |
| kmalloc | we should totally be able to drop the bind code | 16:15 |
| elbragstad | i'm in the middle of ripping everything apart | 16:15 |
| elbragstad | i should be able to work it into my patch | 16:15 |
| elbragstad | and pull it out later | 16:15 |
| kmalloc | [the fact that we use fernet only now means we can't even test the bind code] | 16:15 |
| elbragstad | yeah... | 16:15 |
| kmalloc | and with most everyone moving to fernet, clearly no one is using it | 16:15 |
| elbragstad | that would include removing https://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_token_bind.py then | 16:16 |
| elbragstad | how we want to track that removal? bug or removed blueprint? | 16:17 |
| elbragstad | technically it was never deprecated directly | 16:17 |
| elbragstad | it was deprecated indirectly via UUID token deprecation/removal | 16:17 |
| kmalloc | removed-as-of-rocky | 16:17 |
| elbragstad | ok | 16:18 |
| kmalloc | the code is unused [it's a unit test, totally synthetic] | 16:18 |
| kmalloc | the uuid deprecation explictly called bind out. | 16:18 |
| kmalloc | it fakes the token and checks against the faked-token | 16:18 |
| elbragstad | ok - i'm going to lump the removal into the abomination of a patch i have going, then propose it | 16:19 |
| elbragstad | against master as it's own isolated patch | 16:20 |
| kmalloc | ok | 16:20 |
| *** fried_rice is now known as fried_rolls | 16:31 | |
| kmalloc | elbragstad: annnnd now the slow part, writing these tests: | 16:35 |
| kmalloc | https://www.irccloud.com/pastebin/DClGdon8/ | 16:35 |
| elbragstad | that's usually the most refreshing part | 16:35 |
| kmalloc | it's a lot of tests and a lot of mechanical work to set them up | 16:36 |
| kmalloc | because enforce is such a blackbox | 16:36 |
| *** ispp has quit IRC | 16:38 | |
| *** felipemonteiro__ has joined #openstack-keystone | 16:51 | |
| *** felipemonteiro_ has quit IRC | 16:55 | |
| *** jmlowe has quit IRC | 17:21 | |
| *** amoralej is now known as amoralej|off | 17:33 | |
| *** felipemonteiro__ has quit IRC | 17:58 | |
| *** felipemonteiro__ has joined #openstack-keystone | 17:59 | |
| *** r-daneel has quit IRC | 18:02 | |
| *** jmlowe has joined #openstack-keystone | 18:13 | |
| *** itlinux has quit IRC | 18:23 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add functional testing gate https://review.openstack.org/531014 | 18:34 |
| tadams12083 | Does anyone know why my ocata openstack install will import ldap users and groups but the groups don't have the member information. From the little I can find online my keystone ldap group config looks correct and it is showing up in keystone. | 18:41 |
| *** AlexeyAbashkin has quit IRC | 18:44 | |
| *** ckonstanski has joined #openstack-keystone | 18:55 | |
| *** fried_rolls is now known as efried_pto | 18:56 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Introduce new TokenModel object https://review.openstack.org/559129 | 18:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: Simplify the issue token code path https://review.openstack.org/545450 | 18:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Cleanup keystone.token.providers.common https://review.openstack.org/577507 | 18:58 |
| * elbragstad hits the "Save Game" buttom | 18:59 | |
| elbragstad | kmalloc: it'll need more polish.. but it works | 19:05 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add functional testing gate https://review.openstack.org/531014 | 19:08 |
| *** fiddletwix has joined #openstack-keystone | 19:13 | |
| *** DevX has quit IRC | 19:27 | |
| *** devx has joined #openstack-keystone | 19:28 | |
| *** cmurphy is now known as cmurphy_vacation | 19:31 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove token bind capabilities https://review.openstack.org/577524 | 19:32 |
| elbragstad | kmalloc: ^ | 19:32 |
| gagehugo | +6 -423, nice | 19:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove token bind capabilities https://review.openstack.org/577524 | 19:33 |
| elbragstad | yep | 19:33 |
| kmalloc | elbragstad: thnx | 19:36 |
| kmalloc | elbragstad: i should have tests for @protected replacement | 19:36 |
| kmalloc | today | 19:36 |
| elbragstad | sweet | 19:36 |
| kmalloc | then i can fianlly start moving apis. | 19:36 |
| elbragstad | that's exciting | 19:36 |
| kmalloc | this one has been painful. | 19:36 |
| elbragstad | i swear... "Rocky - the release of painful refactors" | 19:37 |
| *** fiddletwix has quit IRC | 19:37 | |
| kmalloc | we can talk about the massive code shuffle: ->keystone.subsystem | 19:37 |
| kmalloc | for the stuff that isn't .api | 19:37 |
| *** fiddletwix has joined #openstack-keystone | 19:38 | |
| *** DHE has left #openstack-keystone | 19:47 | |
| kmalloc | elbragstad: want to see something awesome | 19:49 |
| * elbragstad pushes his glasses up | 19:50 | |
| kmalloc | http://flask.pocoo.org/docs/1.0/testing/#testing-json-apis | 19:50 |
| kmalloc | now i just need to go figure out why were hard locked on sub 1.0 flask in openstack | 19:51 |
| kmalloc | because THAT right there is badass. | 19:51 |
| elbragstad | huh - nice | 19:52 |
| elbragstad | i bet that'd help with the plugin stuff we have | 19:52 |
| kmalloc | yep | 19:53 |
| kmalloc | elbragstad: https://review.openstack.org/#/c/577534/ | 20:06 |
| kmalloc | turns out flask has been < 1.0 for ~3 years in our g-r | 20:07 |
| kmalloc | so, before u-c/l-c work | 20:07 |
| elbragstad | huh - nice | 20:07 |
| kmalloc | elbragstad: hopefully we can get that landed and i can lean on the new testing bits, just so nice to be able to context manager for a client | 20:07 |
| kmalloc | rather than the wonky stuff we currently do | 20:07 |
| kmalloc | with self.app.client() as c: do X | 20:08 |
| kmalloc | gee whiz, that would make our test cases a LOT simpler | 20:08 |
| kmalloc | no more ".admin_request" things. | 20:08 |
| *** itlinux has joined #openstack-keystone | 20:08 | |
| kmalloc | [well maybe, depending on if .client goes through the whole middleware stack] | 20:09 |
| *** jmlowe has quit IRC | 20:24 | |
| *** spilla has quit IRC | 20:41 | |
| *** raildo has quit IRC | 20:52 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 21:02 | |
| *** AlexeyAbashkin has quit IRC | 21:11 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: [WIP] Add functional testing gate https://review.openstack.org/531014 | 21:11 |
| *** ayoung has quit IRC | 21:31 | |
| *** felipemonteiro__ has quit IRC | 21:37 | |
| *** ayoung has joined #openstack-keystone | 21:44 | |
| *** martinus__ has quit IRC | 21:45 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: Remove KeystoneToken object https://review.openstack.org/577567 | 22:04 |
| elbragstad | kmalloc: ok - that one is really messed up ^ | 22:04 |
| elbragstad | i think i have a bunch more unwinding to do :( | 22:04 |
| kmalloc | heh | 22:05 |
| kmalloc | =/ | 22:05 |
| elbragstad | somehow oslo.policy is failing because we changed from using KeystoneToken to TokenModel | 22:06 |
| elbragstad | which is in an internal only object | 22:06 |
| elbragstad | but it gets set on the request context in keystonemiddleare, which we override | 22:06 |
| kmalloc | elbragstad: @protected is weird. | 22:07 |
| kmalloc | show me a traceback, i bet i can show you why it's failing | 22:08 |
| kmalloc | :P | 22:08 |
| kmalloc | [if you have one that isn't just a 401] | 22:08 |
| kmalloc | though my guess is that you're not extracting a sane bit of info about the subject-token. | 22:08 |
| kmalloc | and booom splody | 22:08 |
| elbragstad | http://paste.openstack.org/show/724160/ | 22:09 |
| *** edmondsw has joined #openstack-keystone | 22:09 | |
| elbragstad | line 195 of that trace | 22:09 |
| elbragstad | the credentials dictionary contains a 'token' key | 22:09 |
| kmalloc | yep | 22:09 |
| elbragstad | which is an instance of KeystoneToken, which inherits from dict | 22:10 |
| kmalloc | but... | 22:10 |
| kmalloc | don't look *there* | 22:10 |
| kmalloc | the policy_dict has a non-type that is unexpected | 22:10 |
| elbragstad | mm | 22:11 |
| elbragstad | i didn't think i added anything that would put that in the credentials dict via middleware? https://review.openstack.org/#/c/577567/1/keystone/middleware/auth.py | 22:12 |
| *** edmondsw has quit IRC | 22:13 | |
| kmalloc | no, but the credentials dict comes from auth context | 22:13 |
| kmalloc | automagically | 22:14 |
| elbragstad | yeah... | 22:14 |
| elbragstad | hmmm | 22:14 |
| elbragstad | i'll dig into this a bit more... i need to through through everything anyway and reorganize bits of it, it's all a mess still | 22:15 |
| kmalloc | i'm not sure if it will be easier to do after @protected is gone, but somehow i think it will be | 22:16 |
| elbragstad | possibly | 22:16 |
| kmalloc | just because you have more knowledge of what the dict is going to end up looking like | 22:16 |
| elbragstad | yeah... | 22:17 |
| elbragstad | it's all pretty opaque | 22:17 |
| kmalloc | though, just for your benefit you may want to add in a debug in the call to policy controller.enforce | 22:17 |
| kmalloc | and print the creds/policy_dict/etc | 22:17 |
| elbragstad | yeah | 22:18 |
| kmalloc | and see what changes between pre-patch/post patch | 22:18 |
| kmalloc | i can only comment on the amount of time it's taken me to write a comparable bit of code that isn't full of suck | 22:18 |
| kmalloc | at least a week or two, and this time we have usable docstrings. | 22:19 |
| kmalloc | but... | 22:19 |
| kmalloc | it's still super opaque | 22:19 |
| kmalloc | just less "fog" and more "black box" | 22:19 |
| elbragstad | http://paste.openstack.org/show/724161/ | 22:20 |
| elbragstad | ^ before and after | 22:20 |
| * kmalloc waits for paste to load | 22:20 | |
| elbragstad | uhoh | 22:20 |
| kmalloc | whelp. | 22:20 |
| elbragstad | project_id is None... | 22:20 |
| elbragstad | wtf | 22:21 |
| elbragstad | so, something must not be grabbing that from TokenModel property? | 22:21 |
| elbragstad | properly? | 22:21 |
| kmalloc | that is my guess. | 22:21 |
| kmalloc | it helps that i've been digging around in that code for the last week | 22:23 |
| kmalloc | :P | 22:23 |
| kmalloc | so, you need to look at what is setting things in the policy_dict. | 22:23 |
| elbragstad | ack - good call | 22:23 |
| kmalloc | i *think* domains are magical callback related things. | 22:23 |
| elbragstad | thanks kmalloc | 22:23 |
| kmalloc | so, it may not even be hitting @protected in the normal way | 22:23 |
| elbragstad | ++ | 22:24 |
| elbragstad | that helps | 22:24 |
| * kmalloc is going to be sad when your fix lands before enforcer does and the rebase hell | 22:24 | |
| kmalloc | :P | 22:24 |
| elbragstad | we'll see | 22:24 |
| kmalloc | hehe. | 22:24 |
| elbragstad | there is a lot of cleanup left | 22:24 |
| elbragstad | i wanted to get to the oslo.limit stuff this week | 22:24 |
| kmalloc | yeah. we're on colliding paths. | 22:24 |
| kmalloc | just because flask touches everything . | 22:24 |
| elbragstad | yeah | 22:24 |
| elbragstad | so does KeystoneToken apparently | 22:25 |
| elbragstad | and refactoring the entire token provider api | 22:25 |
| kmalloc | eyah, sorry i wrote a ton of KeystoneToken code | 22:25 |
| kmalloc | :P | 22:25 |
| kmalloc | my bad. | 22:25 |
| elbragstad | meh - that's not the bad parts | 22:25 |
| kmalloc | oh | 22:25 |
| kmalloc | HAH i bet i know what is going on | 22:25 |
| kmalloc | lol | 22:25 |
| kmalloc | the policy_dict has an explicit flatten | 22:26 |
| kmalloc | you're passing a non-dict item in | 22:26 |
| elbragstad | yeah - it's in utils | 22:26 |
| kmalloc | *OF_COURSE* oslo_policy is exploding | 22:26 |
| elbragstad | i was *just* lookinga t that | 22:26 |
| kmalloc | it's not using the token key, it just can't figure out wtf to do with it | 22:26 |
| kmalloc | you need to make that flatten code do a token render into the policy dict | 22:27 |
| elbragstad | which is why the creds dict looks odd | 22:27 |
| kmalloc | and you should be fine | 22:27 |
| kmalloc | look in common.authorization | 22:27 |
| elbragstad | yep | 22:27 |
| elbragstad | nice | 22:27 |
| kmalloc | it might be set somewhere in there. | 22:27 |
| elbragstad | line 76 | 22:27 |
| elbragstad | i'll go chase that in a day or two | 22:28 |
| kmalloc | i have a serious appreciation for the insantiy of a RBAC enforcment model we built | 22:28 |
| kmalloc | if i could totally re-write it, i would | 22:29 |
| kmalloc | but... i don't think i get that luxury | 22:29 |
| kmalloc | mostly because of how "our published policy" works. | 22:29 |
| elbragstad | thanks again for the help kmalloc | 22:32 |
| elbragstad | i'm going afk for a bit | 22:32 |
| *** ayoung has quit IRC | 22:33 | |
| *** tosky has quit IRC | 23:41 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!