| *** gyee has quit IRC | 00:09 | |
| *** jmlowe has joined #openstack-keystone | 00:13 | |
| *** markguz has joined #openstack-keystone | 00:17 | |
| markguz | anyone know what this error means when syncing config to db in pike : InvalidDomainConfig: Invalid domain specific configuration: The value of group signing specified in the config should be a dictionary of options. | 00:17 |
|---|---|---|
| markguz | this is the config I;m trying to sync to db: http://paste.openstack.org/show/725379/ | 00:21 |
| *** markguz has quit IRC | 00:40 | |
| kmalloc | lbragstad: looking now | 01:04 |
| kmalloc | lbragstad: just got back from appt... | 01:04 |
| *** masuberu has quit IRC | 01:09 | |
| kmalloc | lbragstad, wxy: sorry -1, we cannot hard-code role names. The answer is (any option works): 1) Prohibit Filtering on project_id; 2) check service-token only (mostly insufficient as anyone can provide a service token; 3) use callback and make your own cred/target dict that can confirm "project_id" filter is there (pass directly to the enforcer); 4) Wait for oslo_policy and new check types (Stein release); 5) Maybe | 01:18 |
| kmalloc | doable via backflips i can add in Flask-RBAC Enforcer. | 01:18 |
| *** masber has joined #openstack-keystone | 01:29 | |
| adriant | kmalloc: given the refactor work in progress for tokens, I'm tempted to push the auth receipt stuff to Stein until the refactor is done for tokens. Then I can sync up with what we end up with so the receipt and token patterns are the same. | 01:39 |
| adriant | None of the other pieces for MFA with receipts would be ready until Stein anyway, so it's not a huge issue, and now that I have something that works with the API side mostly defined I can start the work in keystoneauth + elsewhere so it's ready once auth receipts is merged into master during Stein | 01:41 |
| kmalloc | Wfm | 01:43 |
| adriant | lbragstad: that work for you? I've started working through all your token provider refactors, and once those are close to done can sync my stuff with them. | 01:43 |
| adriant | kmalloc: seems like the most sensible solution rather than me inventing a third pattern for auth receipts when it should really match tokens. | 01:44 |
| kmalloc | ++ | 01:45 |
| *** andymccr has quit IRC | 01:57 | |
| *** andymccr has joined #openstack-keystone | 01:57 | |
| wxy | kmalloc: ++ for the policy enforcer way. I tried it in my first patch, but it doesn't work as I thought. So I really like your proposal during last weekly meeting. I want to wait for new oslo_policy, but without "project_id" filter, the "show_hierarchy" filter will be blocked as well (https://review.openstack.org/#/c/579331/8/keystone/limit/core.py@131). So I'd like choose 2) in R, and continue 4) in S. | 02:05 |
| kmalloc | Sounds good. | 02:06 |
| kmalloc | The only reason I could build the enforcer (custom) is because I've just been working heavily in the enforcer ;) | 02:07 |
| kmalloc | I might make this doable with moving to flask. | 02:08 |
| kmalloc | FYI, but need to land the bits before I move apis to flask. | 02:08 |
| wxy | kmalloc: I'll dig into your flask-enforcer patches today. | 02:08 |
| kmalloc | It's mostly ready, just needs some extra +2s | 02:09 |
| *** masuberu has joined #openstack-keystone | 02:12 | |
| *** jmlowe_ has joined #openstack-keystone | 02:13 | |
| *** spotz_ has joined #openstack-keystone | 02:14 | |
| *** tadams12083_ has joined #openstack-keystone | 02:16 | |
| *** chudly_ has joined #openstack-keystone | 02:16 | |
| *** cwright_ has joined #openstack-keystone | 02:17 | |
| *** rodrigod` has joined #openstack-keystone | 02:18 | |
| *** Neptu_ has joined #openstack-keystone | 02:19 | |
| *** rvba has quit IRC | 02:19 | |
| *** Neptu has quit IRC | 02:19 | |
| *** timss has quit IRC | 02:19 | |
| *** cloudnull has quit IRC | 02:19 | |
| *** masber has quit IRC | 02:19 | |
| *** jdennis has quit IRC | 02:19 | |
| *** vishakha has quit IRC | 02:19 | |
| *** cwright has quit IRC | 02:19 | |
| *** jdennis has joined #openstack-keystone | 02:19 | |
| *** spotz has quit IRC | 02:19 | |
| *** jmlowe has quit IRC | 02:19 | |
| *** chudly has quit IRC | 02:19 | |
| *** rodrigods has quit IRC | 02:19 | |
| *** tadams12083 has quit IRC | 02:19 | |
| *** kukacz_ has quit IRC | 02:19 | |
| *** vishakha has joined #openstack-keystone | 02:19 | |
| *** cloudnull has joined #openstack-keystone | 02:19 | |
| *** timss has joined #openstack-keystone | 02:19 | |
| *** timss has quit IRC | 02:20 | |
| *** jdennis has quit IRC | 02:20 | |
| *** rvba has joined #openstack-keystone | 02:20 | |
| *** timss has joined #openstack-keystone | 02:20 | |
| *** cloudnull is now known as Guest2974 | 02:21 | |
| *** rvba has quit IRC | 02:23 | |
| *** rvba has joined #openstack-keystone | 02:23 | |
| *** jdennis has joined #openstack-keystone | 02:25 | |
| *** kukacz_ has joined #openstack-keystone | 02:30 | |
| *** hoonetorg has quit IRC | 02:31 | |
| *** hoonetorg has joined #openstack-keystone | 02:47 | |
| *** sapd_ has joined #openstack-keystone | 03:04 | |
| *** sapd__ has quit IRC | 03:04 | |
| kmalloc | wxy: we might need a separate api for security reasons if the reason we limit project_id filter is security | 03:18 |
| kmalloc | wxy: because anyone could provide a service token, it just wont be useful for other service-only things | 03:19 |
| kmalloc | wxy: lets chat w/ lbragstad tomorrow and come to a good solution :) | 03:19 |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: Implement auth receipts spec https://review.openstack.org/572286 | 03:24 |
| wxy | kmalloc: then a new policy like "limit_limits_with_project_id: role: admin or service"?. I thought it's a little heave so I dropped this choice when coding. But I'm ok with it if we like it. | 03:25 |
| adriant | kmalloc, lbragstad: auth receipts marked as -1 workflow for now then, and I've added myself to all reviews for https://bugs.launchpad.net/keystone/+bug/1778945 so I can keep an eye on how they shape up, will at some stage start work on KeystoneAuth using the existing auth-receipts patch as the API interaction is unlikely to change. | 03:38 |
| openstack | Launchpad bug 1778945 in OpenStack Identity (keystone) "Complexity in token provider APIs" [Medium,In progress] - Assigned to Lance Bragstad (lbragstad) | 03:38 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Strict two level limit model https://review.openstack.org/557696 | 03:39 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add project_id filter for listing limit https://review.openstack.org/579330 | 03:39 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add show hierarchy filter https://review.openstack.org/579331 | 03:39 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Update project depth check https://review.openstack.org/580258 | 03:39 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add project hierarchical tree check when Keystone start https://review.openstack.org/580331 | 03:39 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Filter project_id for list limits https://review.openstack.org/581177 | 03:39 |
| kmalloc | adriant: ok | 03:39 |
| kmalloc | wxy: yeah, let's chat tomorrow. But that might be the path forward, but I want to check a couple things. | 03:40 |
| kmalloc | I have some ideas. | 03:40 |
| wxy | kmalloc: cool | 03:40 |
| *** masuberu has quit IRC | 03:43 | |
| lbragstad | adriant: ok - that sounds fine | 04:08 |
| lbragstad | to be fair - the rest of that refactor shouldn't take too long | 04:08 |
| lbragstad | it's just a bit of testing concerns and that should be about it | 04:09 |
| lbragstad | wxy: did you say you were waiting for a new version of oslo.policy? | 04:25 |
| *** jappleii__ has quit IRC | 04:25 | |
| *** threestrands has joined #openstack-keystone | 04:25 | |
| kmalloc | lbragstad: the "does element in Target dict" check I proposed n | 05:07 |
| kmalloc | Right now we can't do that at all. | 05:08 |
| lbragstad | ah | 05:12 |
| kmalloc | it could be done with a callback or custom call to enforce | 05:12 |
| kmalloc | it would be wonky/difficult | 05:13 |
| kmalloc | flask work makes it easier, but not "easy" | 05:13 |
| kmalloc | a "does element exist in target" would make a big difference | 05:13 |
| *** sonuk has joined #openstack-keystone | 05:15 | |
| *** sonuk_ has quit IRC | 05:17 | |
| *** links has joined #openstack-keystone | 05:22 | |
| *** gagehugo has quit IRC | 05:33 | |
| *** martinus__ has joined #openstack-keystone | 05:54 | |
| *** ispp has joined #openstack-keystone | 06:29 | |
| *** threestrands has quit IRC | 06:30 | |
| openstackgerrit | Vu Cong Tuan proposed openstack/python-keystoneclient master: Switch to stestr https://review.openstack.org/581213 | 06:35 |
| *** links has quit IRC | 06:38 | |
| *** links has joined #openstack-keystone | 06:53 | |
| *** aloga has joined #openstack-keystone | 07:07 | |
| *** tesseract has joined #openstack-keystone | 07:13 | |
| *** peereb has joined #openstack-keystone | 07:19 | |
| openstackgerrit | Vu Cong Tuan proposed openstack/pycadf master: Switch to stestr https://review.openstack.org/581228 | 07:23 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Strict two level limit model https://review.openstack.org/557696 | 07:32 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add project_id filter for listing limit https://review.openstack.org/579330 | 07:32 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add show hierarchy filter https://review.openstack.org/579331 | 07:32 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Update project depth check https://review.openstack.org/580258 | 07:32 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add project hierarchical tree check when Keystone start https://review.openstack.org/580331 | 07:32 |
| wxy | lbragstad: yes if oslo.policy can check the request filter in policy way like kmalloc mentioned during last weekly meeting. But we can't just wait, we should find another solution in R. | 07:37 |
| *** tosky has joined #openstack-keystone | 07:39 | |
| *** ispp has quit IRC | 07:43 | |
| *** links has quit IRC | 07:44 | |
| *** rcernin has quit IRC | 07:47 | |
| *** amoralej|off is now known as amoralej | 07:48 | |
| *** kimamisa has joined #openstack-keystone | 07:50 | |
| *** links has joined #openstack-keystone | 07:57 | |
| *** vishakha has quit IRC | 08:28 | |
| openstackgerrit | Vu Cong Tuan proposed openstack/python-keystoneclient master: Switch to stestr https://review.openstack.org/581213 | 08:37 |
| *** deepak_mourya has quit IRC | 09:26 | |
| *** itlinux has joined #openstack-keystone | 09:30 | |
| openstackgerrit | Merged openstack/keystone master: Implement enforcement model logic in Manager https://review.openstack.org/562715 | 09:34 |
| *** gagehugo has joined #openstack-keystone | 09:38 | |
| *** rcernin has joined #openstack-keystone | 09:44 | |
| *** rcernin has quit IRC | 09:47 | |
| *** itlinux has quit IRC | 09:56 | |
| *** itlinux has joined #openstack-keystone | 10:04 | |
| *** sapd_ has quit IRC | 10:11 | |
| *** sapd has joined #openstack-keystone | 10:11 | |
| openstackgerrit | Vu Cong Tuan proposed openstack/ldappool master: Switch to stestr https://review.openstack.org/581307 | 10:14 |
| *** mvk_ has quit IRC | 10:22 | |
| *** mvk_ has joined #openstack-keystone | 10:48 | |
| *** itlinux has quit IRC | 11:21 | |
| openstackgerrit | Vu Cong Tuan proposed openstack/keystone-specs master: Switch to stestr https://review.openstack.org/581326 | 11:23 |
| *** edmondsw has joined #openstack-keystone | 11:25 | |
| openstackgerrit | Vu Cong Tuan proposed openstack/keystone-specs master: Switch to stestr https://review.openstack.org/581326 | 11:36 |
| *** ispp has joined #openstack-keystone | 11:48 | |
| *** amoralej is now known as amoralej|lunch | 11:55 | |
| *** markvoelker has quit IRC | 12:18 | |
| *** markvoelker has joined #openstack-keystone | 12:21 | |
| *** raildo has joined #openstack-keystone | 12:21 | |
| openstackgerrit | Sami Makki proposed openstack/keystone master: Invalidate 'computed assignments' cache when creating or deleting project. https://review.openstack.org/581346 | 12:29 |
| *** markvoelker has quit IRC | 12:31 | |
| *** markvoelker has joined #openstack-keystone | 12:35 | |
| *** amoralej|lunch is now known as amoralej | 12:49 | |
| *** ispp has quit IRC | 13:11 | |
| *** ispp has joined #openstack-keystone | 13:23 | |
| *** itlinux has joined #openstack-keystone | 13:44 | |
| *** wxy| has joined #openstack-keystone | 13:50 | |
| *** jdennis has quit IRC | 13:59 | |
| *** jdennis has joined #openstack-keystone | 13:59 | |
| *** viks_ has quit IRC | 14:00 | |
| *** dklyle has quit IRC | 14:01 | |
| *** dklyle has joined #openstack-keystone | 14:01 | |
| *** itlinux has quit IRC | 14:04 | |
| *** yikun has quit IRC | 14:06 | |
| *** felipemonteiro has joined #openstack-keystone | 14:09 | |
| *** felipemonteiro_ has joined #openstack-keystone | 14:11 | |
| *** ispp has quit IRC | 14:11 | |
| *** wxy|_ has joined #openstack-keystone | 14:12 | |
| *** spilla has joined #openstack-keystone | 14:13 | |
| *** wxy| has quit IRC | 14:14 | |
| *** felipemonteiro has quit IRC | 14:15 | |
| *** ispp has joined #openstack-keystone | 14:17 | |
| *** Guest2974 is now known as cloudnull | 14:19 | |
| *** spilla has quit IRC | 14:21 | |
| *** spilla has joined #openstack-keystone | 14:24 | |
| *** spotz_ is now known as spotz | 14:31 | |
| *** EmilienM is now known as EvilienM | 14:42 | |
| *** peereb has quit IRC | 14:45 | |
| *** ispp has quit IRC | 14:45 | |
| *** ispp has joined #openstack-keystone | 14:54 | |
| kmalloc | wxy: interesting. | 14:56 |
| *** markguz has joined #openstack-keystone | 14:57 | |
| kmalloc | wxy: so i think the best plan is a service API that is locked to a better rule for filtering by project_id. | 14:57 |
| kmalloc | wxy: rather than a list interface. | 14:57 |
| kmalloc | wxy: that way we have a separate action that can be controlled. | 14:57 |
| kmalloc | wxy: i slept on the whole design and the "change behavior based upon filter" seems weird. | 14:57 |
| kmalloc | lbragstad: ^ cc | 14:58 |
| kmalloc | if we isolate that API to a separate URL, we have a lot more control over it. and we can do explicit checks. | 14:58 |
| kmalloc | wxy: even if we could "check if filter is present" in this case, i'd advocate for a separate API, as it's a different concern/result/set of business logic to be run (different use-case) | 14:59 |
| lbragstad | yeah... | 15:01 |
| lbragstad | i think i agree | 15:01 |
| lbragstad | looking at this while context switching though | 15:01 |
| kmalloc | i just wanted to drop that in before meeting today | 15:04 |
| wxy|_ | kmalloc: lbragstad: so maybe a url like projects/{project_id}/limits to fetch the specified project limits? | 15:24 |
| lbragstad | as in the hierarchy? | 15:25 |
| *** links has quit IRC | 15:26 | |
| kmalloc | wxy|_: that would work, we could also put it under the /limits/ URL prefix somehow. | 15:26 |
| kmalloc | but not sure how to adhere to the "rest-ish" style | 15:26 |
| lbragstad | yeah... | 15:27 |
| kmalloc | i would prefer to keep it in /limits, but seeing as i don't have a good way to do that. | 15:27 |
| kmalloc | short of /limits/by-project-id/{projet_id} | 15:27 |
| kmalloc | and i don't like that. | 15:27 |
| lbragstad | would you want to denote the project with the token scope? | 15:27 |
| kmalloc | this is the service user getting limits for a project | 15:28 |
| kmalloc | though... i guess we could use x-subject-token here? | 15:28 |
| kmalloc | as an alternative | 15:28 |
| kmalloc | get it by x-auth-token, or x-subject-token | 15:28 |
| kmalloc | but that runs afoul of the same issues with security | 15:28 |
| kmalloc | hard to limit (new check_str), but x-subject-token we could at least check for today. | 15:29 |
| kmalloc | oh.. wait. no we can't... | 15:29 |
| kmalloc | ugh | 15:29 |
| lbragstad | so - if you're an admin on a project | 15:29 |
| lbragstad | let's say you have project A, B, and C | 15:30 |
| lbragstad | and they are in a linear relationship | 15:30 |
| lbragstad | (ignore the two-level enforcement model requirement for now) | 15:30 |
| kmalloc | we have another problem | 15:30 |
| kmalloc | we have a hard-coded role name that is landed in tree | 15:31 |
| kmalloc | https://github.com/openstack/keystone/blob/master/keystone/limit/controllers.py#L105 | 15:31 |
| kmalloc | we need to fix that as well. | 15:31 |
| lbragstad | yeah | 15:31 |
| wxy|_ | kmalloc: ++ | 15:32 |
| kmalloc | we need a new API, that the services can work from. | 15:32 |
| kmalloc | we can't keep this merged together like it is. | 15:32 |
| kmalloc | list limits is locked to your current scope. | 15:32 |
| kmalloc | if you need external to your current scope (global or other wise) we need APIs that can do that so we can lock them down how we want with correct check strings. | 15:33 |
| kmalloc | user vs admin vs cloud-admin uses | 15:33 |
| wxy|_ | the original purpose for list limits API is that non-admin user in a project can only fetch the limits belong to this project. and admin can fetch all the limits | 15:34 |
| kmalloc | right. so lets make a new API for the admin interactions | 15:34 |
| kmalloc | either under /project | 15:34 |
| kmalloc | or something new under /limits | 15:34 |
| lbragstad | well - the good thing about it being experimental is that we can break the functionality that requires elevated authorization out | 15:34 |
| kmalloc | lbragstad: ++ | 15:34 |
| kmalloc | it *sounds* like we need something under /limits | 15:35 |
| lbragstad | but... we do have a project API for listing hierarchies already | 15:35 |
| kmalloc | we could add per-project limits [admin, filtered to project] under /project/{project_id}/limits | 15:35 |
| kmalloc | right. | 15:35 |
| kmalloc | that doesn't list/emit limit data | 15:35 |
| lbragstad | yeah | 15:35 |
| *** felipemonteiro_ has quit IRC | 15:35 | |
| kmalloc | there are 3 concerns here: | 15:35 |
| kmalloc | 1) User getting list for current scope ( /v3/limits <-- list) | 15:36 |
| kmalloc | 2) admin getting *all* limits (cloud-admin) | 15:36 |
| kmalloc | 2a) admin getting *all* hierarchy-limits (project/domain admin) | 15:36 |
| kmalloc | 3) project-specific "get limits" [filtered by project] | 15:36 |
| kmalloc | i am unsure how this breaks down API, 2a/3 might be one thing. | 15:37 |
| kmalloc | but 1 and 2 are clearly distinct actions. | 15:37 |
| lbragstad | is 1 expecting a hierarchy? | 15:37 |
| lbragstad | or just limits for a single project? | 15:38 |
| kmalloc | unsure. | 15:38 |
| kmalloc | wxy|_: ^? | 15:38 |
| knikolla | o/ | 15:38 |
| wxy|_ | i think just limits | 15:38 |
| kmalloc | no hierarchy, just current scope. | 15:38 |
| kmalloc | ok | 15:38 |
| kmalloc | that is fine. | 15:38 |
| wxy|_ | hierarchy information should not exposed to common users | 15:38 |
| lbragstad | so - as an end user | 15:38 |
| kmalloc | yeah, that is what it looks like from the base code impl | 15:38 |
| lbragstad | i just need to get limits for a project i'm working on | 15:38 |
| lbragstad | i shouldn't be able to query all the hierarchy information | 15:39 |
| lbragstad | pertaining to limits | 15:39 |
| kmalloc | not with that api | 15:39 |
| lbragstad | ok - so we need a separate api for domain/project administrators | 15:39 |
| kmalloc | "what is my current set of expected limits" | 15:39 |
| lbragstad | to be able to query for the limits of a tree | 15:39 |
| lbragstad | which is 2a? | 15:39 |
| kmalloc | yep, which an end-user may be granted permission to do. | 15:40 |
| kmalloc | yes. | 15:40 |
| kmalloc | that is 2a | 15:40 |
| lbragstad | so - this really sounds like https://bugs.launchpad.net/keystone/+bug/1750660 | 15:41 |
| openstack | Launchpad bug 1750660 in OpenStack Identity (keystone) "The v3 project API should account for different scopes" [High,Triaged] | 15:41 |
| lbragstad | or very similar to it | 15:41 |
| kmalloc | sortof. | 15:41 |
| wxy|_ | are 2) and 2a) the same API? their response structure is different. | 15:44 |
| kmalloc | you have "get my current scope limits" and "get me a hierarchy" ... that is not system vs project scope | 15:44 |
| lbragstad | the | 15:44 |
| lbragstad | " | 15:44 |
| lbragstad | bah... | 15:44 |
| kmalloc | get me current scope vs get me all, might be project vs system scope | 15:45 |
| lbragstad | the "get me a hierarchy" part should take scope into account (e.g. a domain/project admin asking for the hierarchy versus a system admin) | 15:45 |
| kmalloc | ah ++ | 15:45 |
| kmalloc | yes | 15:45 |
| kmalloc | so 2 and 2a *are* the same thing | 15:45 |
| lbragstad | but yeah - the other one sounds like a different API | 15:45 |
| kmalloc | just scope-specific | 15:45 |
| lbragstad | right now we have GET /v3/limits/ | 15:46 |
| lbragstad | GET /v3/limits * | 15:46 |
| lbragstad | and we don't have the hierarchical API, yet... | 15:47 |
| lbragstad | right? | 15:47 |
| lbragstad | that was something we were going to do with the query parameter? | 15:47 |
| lbragstad | query string* | 15:47 |
| wxy|_ | yeah, show_hierarchy | 15:47 |
| kmalloc | overloading via a qp and totally changing the output structure seems like the wrong choice | 15:48 |
| kmalloc | a qp should maintain the same output format | 15:48 |
| kmalloc | but apply rules to it (e.g. expired_ok, filter by x [where not a security issue]) | 15:49 |
| kmalloc | if we are emitting a totally different structure (if show hierarchy is embeded in the current structure, that is one thing) | 15:49 |
| kmalloc | it should be a different api | 15:49 |
| lbragstad | what if we added a query string to the project API that aggregated limit information? | 15:49 |
| *** jmlowe_ has quit IRC | 15:50 | |
| lbragstad | so - everything we have to build the hierarchy of projects stays in the same spot, but it just populates limit information | 15:50 |
| kmalloc | sure | 15:50 |
| kmalloc | that is fine, populate the limit data in the "get_hierarchy" data api already | 15:51 |
| lbragstad | this is an invite to poke holes :) | 15:51 |
| kmalloc | as long as it doesn't meaningfully change the output (limit data may be added in the project output, maybe we don't need a qp for that at all, just do it?) | 15:51 |
| kmalloc | s/output/output structure, e.g. no wildly different data struct | 15:52 |
| lbragstad | if we add a query parameter, we could signal that it is experimental though, couldn't we? | 15:52 |
| kmalloc | ah. opt-in sure | 15:52 |
| kmalloc | and when we move away from expirimental, just make it the default? | 15:52 |
| lbragstad | just in case we decide we don't like it | 15:52 |
| kmalloc | since we ignore un-used qps. | 15:52 |
| kmalloc | wfm. | 15:52 |
| kmalloc | so that solves the "get me the hierarchy" one. | 15:53 |
| kmalloc | we have the end-user one today | 15:53 |
| kmalloc | and the heierarchy one solves the system vs project/domain admin scope | 15:53 |
| lbragstad | sure - because that should take token scope into account | 15:53 |
| kmalloc | do we need a "filtered by project" one e.g. /projects/{project_id}/limits api? | 15:54 |
| kmalloc | is there a use for that api? | 15:54 |
| lbragstad | and GET /v3/limits should take token scope into account, too | 15:54 |
| lbragstad | but it won't return a hierarchy, right? | 15:54 |
| kmalloc | it cannot return a hierarchy unless the end user one also does (or we embed the hierarchy info somehow, don't embed it awkwardly imo) | 15:54 |
| lbragstad | i'm fine with only supporting one way to get the hierarchy | 15:55 |
| *** gyee has joined #openstack-keystone | 15:55 | |
| lbragstad | do we have a /projects/{project_id}/limits API today, or is it just GET /v3/limits ? | 15:55 |
| wxy|_ | we only have /v3/limits now. | 15:56 |
| lbragstad | ok - cool | 15:56 |
| lbragstad | so - that API should take token scope into account (eventually) | 15:56 |
| kmalloc | do we need /projects/{project_id}/limits ? | 15:56 |
| kmalloc | i don't think we do with the hierarchy bits. | 15:56 |
| lbragstad | i'm inclined to say no, but i'm willing to be convinced otherwise | 15:56 |
| lbragstad | beacuse GET /v3/limits will take the project from the token context, if present | 15:57 |
| lbragstad | and filter the response accordingly | 15:57 |
| kmalloc | wfm | 15:57 |
| wxy|_ | kmalloc: what if a cloud admin want to fetch a specified project's limits? | 15:57 |
| lbragstad | with a system scoped token? | 15:58 |
| kmalloc | wxy|_: i'm ok with adding filters for systme-scope as long as we don't change the format of the end-user get | 15:58 |
| kmalloc | which should be a list anyway | 15:58 |
| kmalloc | so end-user list: [{limit, inc. project_id}, {limit, inc. project_id}, {limit, inc. project_id}} | 15:58 |
| wxy|_ | then we don't need /projects/{project_id}/limits | 15:59 |
| kmalloc | system-scope would be [{limit, inc. project_id-1}, {limit, inc. project_id-2} ...] | 15:59 |
| kmalloc | and ?project_id=XXX would limit the returned output/filter | 15:59 |
| kmalloc | for consistency, we could allow end-users to filter and return an empty list if they filter for a project outside of their current scope | 16:00 |
| lbragstad | hmmm | 16:00 |
| lbragstad | i'm not sure i'd want to allow someone to get limits for a project without using a token scope though? | 16:01 |
| lbragstad | either way - we can pick this up after the meeting | 16:01 |
| lbragstad | or raise it in open discussion :) | 16:01 |
| kmalloc | lbragstad: i'm not advocating anything of the sort, limits would require a token scope (project, my current scope), (system, all, filterable) | 16:01 |
| lbragstad | ok - so the query string would simply be there to be consistent | 16:02 |
| kmalloc | but for consistency, filters might need to work on the project-scope as well. just if you filter for a project that isn't your current scope, the returned list is empty | 16:02 |
| kmalloc | because you said "filter for project X" and X isn't there | 16:02 |
| lbragstad | ok | 16:02 |
| kmalloc | :) | 16:02 |
| lbragstad | and if they filter by the project they are scoped to, it's a noop | 16:03 |
| kmalloc | exactly | 16:03 |
| lbragstad | ok - that seems reasonably safe | 16:03 |
| kmalloc | keep the filtering behavior VERY consistent | 16:03 |
| wxy|_ | v3/limits for end users by default, /v3/limits?project_id=xxx works for system-scope only. end user will get empty response if using project_id filter. | 16:03 |
| wxy|_ | right? | 16:04 |
| kmalloc | wxy|_: if project_id differs from the current scope, the list would be empty | 16:04 |
| ayoung | Meeting now? | 16:04 |
| kmalloc | in the non-system-scope | 16:04 |
| kmalloc | adriant: yes | 16:04 |
| kmalloc | ayoung: ^ | 16:04 |
| kmalloc | yes. | 16:04 |
| kmalloc | wxy|_: basically in the non-system scope we just do "project_id == filtered_project_id_qp or []" | 16:05 |
| kmalloc | in the system-scope we actually filter. behavior should be the same in both scopesso you can't accidently filter for project X and get project Y regardless of project vs system scope | 16:05 |
| *** jmlowe has joined #openstack-keystone | 16:08 | |
| *** jmlowe has quit IRC | 16:09 | |
| *** ispp has quit IRC | 16:13 | |
| wxy|_ | kmalloc: lbragstad: I add some note here about the filter https://etherpad.openstack.org/p/limits-filter | 16:49 |
| wxy|_ | if it works, I'll complete the patch tomorrow. | 16:49 |
| lbragstad | wxy|_: aweosme | 16:49 |
| kmalloc | wxy|_: fantastic! | 16:50 |
| *** kimamisa has quit IRC | 16:50 | |
| tosky | uh, I have a question about service_token_roles_required; recently openstack-ansible-os_nova switched the value to true for nova, and that lead to an error in Sahara tests | 16:52 |
| tosky | I put together my findings in the last comment (before recheck) of patchset 7 here: https://review.openstack.org/#/c/569886/ | 16:52 |
| kmalloc | ayoung: man, python 3.7 is going to be NICE. | 16:53 |
| tosky | but I'm not sure if how this can be fixed on the sahara side | 16:53 |
| tosky | or if it's just a deployment issue | 16:53 |
| * kmalloc is somewhat said we don't get to rely on 3.6/3.7 things | 16:53 | |
| kmalloc | lbragstad: btw, we can drop/should drop the v3-only test | 16:53 |
| kmalloc | lbragstad: since... we only have v3 now | 16:53 |
| kmalloc | or vice-versa | 16:53 |
| kmalloc | drop the non-v3-only version | 16:53 |
| lbragstad | ? | 16:54 |
| kmalloc | lbragstad: we have a gate job.. v3-only | 16:54 |
| kmalloc | or had at least | 16:54 |
| kmalloc | lbragstad: ah nvm, looks like it is gone | 16:55 |
| kmalloc | woo | 16:55 |
| lbragstad | #startmeeting keystone-office-hours | 17:00 |
| openstack | lbragstad: Error: Can't start another meeting, one is in progress. Use #endmeeting first. | 17:00 |
| kmalloc | lbragstad: did you forget to end the last office hours? | 17:01 |
| kmalloc | #endmeeting | 17:01 |
| lbragstad | #endmeeting | 17:01 |
| *** openstack changes topic to "Rocky release schedule: https://releases.openstack.org/rocky/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/wmyzbFq5/keystone-rocky-roadmap !!NOTE!! This Channel is Logged ( https://tinyurl.com/OpenStackKeystone )" | 17:01 | |
| openstack | Meeting ended Tue Jul 10 17:01:26 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 17:01 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-07-03-17.01.html | 17:01 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-07-03-17.01.txt | 17:01 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-07-03-17.01.log.html | 17:01 |
| lbragstad | #startmeeting keystone-office-hours | 17:01 |
| openstack | Meeting started Tue Jul 10 17:01:35 2018 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. | 17:01 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 17:01 |
| *** openstack changes topic to " (Meeting topic: keystone-office-hours)" | 17:01 | |
| *** ChanServ changes topic to "Rocky release schedule: https://releases.openstack.org/rocky/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/wmyzbFq5/keystone-rocky-roadmap !!NOTE!! This Channel is Logged ( https://tinyurl.com/OpenStackKeystone )" | 17:01 | |
| openstack | The meeting name has been set to 'keystone_office_hours' | 17:01 |
| kmalloc | LOL | 17:01 |
| * lbragstad shrugs | 17:01 | |
| *** amoralej is now known as amoralej|off | 17:03 | |
| *** wxy|_ has quit IRC | 17:05 | |
| *** tesseract has quit IRC | 17:07 | |
| *** jmlowe has joined #openstack-keystone | 17:09 | |
| tosky | ehm, is there some specific topic or can I (re)ask a question? | 17:09 |
| *** mvk_ has quit IRC | 17:11 | |
| *** spilla has quit IRC | 17:13 | |
| lbragstad | tosky: no - this is just office hours | 17:16 |
| lbragstad | tosky: the failure linked in the patch is just warning though - it looks like keystone isn't preventing nova from responding? | 17:18 |
| tosky | lbragstad: I may have swapped the working and the failing log | 17:20 |
| *** spilla has joined #openstack-keystone | 17:20 | |
| lbragstad | pass http://logs.openstack.org/02/579602/2/check/openstack-ansible-functional-ubuntu-xenial/a54186d/logs/openstack/openstack1/nova/nova-api-wsgi.log.txt.gz#_2018-07-03_00_14_49_783 | 17:20 |
| lbragstad | fail http://logs.openstack.org/14/573514/3/check/openstack-ansible-functional-ubuntu-xenial/88d0dd9/logs/openstack/openstack1/nova/nova-api-wsgi.log.txt.gz#_2018-06-27_06_32_09_753 | 17:20 |
| lbragstad | ? | 17:20 |
| tosky | yes, I swapped the label, sorry | 17:21 |
| lbragstad | keystonemiddleware doesn't actually throw an error there - http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token/__init__.py#n385 | 17:21 |
| lbragstad | it's just a warning i believe | 17:22 |
| tosky | the working log shows the warning, and it works | 17:22 |
| tosky | the failing log (marked incorrectly as PASS) throws a 401 on that operation which was working before | 17:22 |
| tosky | so the question is: is that an error in nova? (which apparently can pass the tempest tests)? Should sahara change something there? | 17:29 |
| lbragstad | tosky: sounds related to https://bugs.launchpad.net/keystone/+bug/1779889 | 17:33 |
| openstack | Launchpad bug 1779889 in OpenStack Identity (keystone) "Lack of documentation for validating expired tokens with service users" [Medium,Triaged] | 17:33 |
| lbragstad | can you confirm that the nova service is using a service token? | 17:34 |
| lbragstad | the irc log in that bug report goes into detail about how service tokens work | 17:34 |
| tosky | uh, I'm not sure about the nova configuraton, but I can check how it was setup | 17:35 |
| tosky | but shouldn't the bug be visible also with some other tests? | 17:36 |
| lbragstad | nova's configuration file will have a section in it for keystone_authtoken | 17:36 |
| *** felipemonteiro has joined #openstack-keystone | 17:36 | |
| lbragstad | so if a deployment tool is setting that up to use service tokens, but not setting up the service user properly, then you'll likely have a problem | 17:36 |
| tosky | apparently not: http://logs.openstack.org/86/569886/7/check/openstack-ansible-functional-centos-7/e34b95c/logs/etc/openstack/openstack1/nova/nova.conf.txt.gz | 17:39 |
| tosky | the change that introduced service_token_roles_required=true did not add anything else relevant to [keystone_authtoken]: https://review.openstack.org/#/c/578618/ | 17:40 |
| lbragstad | tosky: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L554 | 17:44 |
| lbragstad | so osa is setting https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_opts.py#L210-L215 to true | 17:45 |
| lbragstad | but https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_opts.py#L202-L209 is still the default of 'service' | 17:45 |
| lbragstad | so a "service token" is considered a token with a role named "service" in it | 17:45 |
| lbragstad | does osa have that role and does it use it with nova? | 17:45 |
| lbragstad | if not, that's probably causing the issue | 17:45 |
| *** spilla has quit IRC | 17:45 | |
| tosky | I suspect it does not, but I will raise the question (aka: a bug) | 17:46 |
| tosky | it looks like the source of the issue | 17:46 |
| tosky | oooh, thanks for askin there | 17:48 |
| tosky | asking* | 17:48 |
| lbragstad | yep | 17:48 |
| *** mvk_ has joined #openstack-keystone | 17:57 | |
| *** spilla has joined #openstack-keystone | 17:58 | |
| *** kimamisa has joined #openstack-keystone | 18:10 | |
| *** markguz has quit IRC | 18:34 | |
| *** ayoung has quit IRC | 18:35 | |
| *** kimamisa has quit IRC | 18:38 | |
| *** gyee has quit IRC | 18:38 | |
| *** rmascena has joined #openstack-keystone | 18:46 | |
| *** itlinux has joined #openstack-keystone | 18:47 | |
| *** ayoung has joined #openstack-keystone | 18:48 | |
| *** raildo has quit IRC | 18:49 | |
| *** rmascena is now known as raildo | 18:49 | |
| lbragstad | gagehugo: didn't we have a bug open for https://review.openstack.org/#/c/576640/ ? | 18:54 |
| gagehugo | lbragstad did we? | 18:54 |
| lbragstad | i'm parsing the meeting logs and i thought we said something about it? | 18:55 |
| lbragstad | maybe i'm imagining things | 18:55 |
| gagehugo | http://eavesdrop.openstack.org/meetings/keystone/2018/keystone.2018-06-19-16.00.log.html#l-175 | 18:58 |
| gagehugo | I didn't make one, I can though | 18:59 |
| lbragstad | no worries - it probably isn't necessary | 18:59 |
| lbragstad | i was just double checking | 18:59 |
| *** felipemonteiro_ has joined #openstack-keystone | 19:04 | |
| *** itlinux has quit IRC | 19:05 | |
| *** felipemonteiro has quit IRC | 19:08 | |
| *** nicodemus_ has joined #openstack-keystone | 19:18 | |
| nicodemus_ | Hello! | 19:18 |
| nicodemus_ | I've configured keystone federation, with Keystone acting as an SP with an external IdP | 19:19 |
| nicodemus_ | Login works just fine, but if I logout and then try to login again, I'm not asked for my user/pass (as if the session was never destroyed) | 19:19 |
| nicodemus_ | Has anyone seen something like that? I'm unsure where to begin looking (keystone logs don't show any error | 19:20 |
| lbragstad | i have not personally experienced that | 19:25 |
| lbragstad | kmalloc: we should revisit https://review.openstack.org/#/c/555279/ | 19:26 |
| cmurphy | nicodemus_: that's normal, your idp stores a cookie saying you are logged in and there's no way for horizon to be aware of that so logging out of horizon doesn't affect it | 19:27 |
| *** jmlowe has quit IRC | 19:27 | |
| * kmalloc looks | 19:27 | |
| cmurphy | there might be an endpoint/button you can go to on your idp to log out of it directly | 19:27 |
| lbragstad | thanks cmurphy | 19:27 |
| cmurphy | or you can clear your cookies | 19:27 |
| cmurphy | it'll also time out eventually | 19:30 |
| *** kimamisa has joined #openstack-keystone | 19:40 | |
| nicodemus_ | cmurphy: so, if I logout from horizon that doesn't trigger a logout to the IdP? | 19:44 |
| nicodemus_ | I imagined the logout endpoints from the Mellon metadata would somehow handle the logout | 19:45 |
| cmurphy | nicodemus_: you're right that should be possible but I don't think we've hooked that up between horizon and keystone and saml | 19:46 |
| *** jmlowe has joined #openstack-keystone | 19:51 | |
| nicodemus_ | cmurphy: got it. So at least for now, I cloud say that login works fine but logout needs to be done outside of horizon | 19:52 |
| cmurphy | nicodemus_: yes | 19:52 |
| nicodemus_ | thanks a lot! | 19:53 |
| *** itlinux has joined #openstack-keystone | 19:53 | |
| *** spilla has quit IRC | 19:56 | |
| kmalloc | lbragstad: yeah we should revisit that cleanup | 19:57 |
| lbragstad | http://flask.pocoo.org/docs/1.0/quickstart/#unique-urls-redirection-behavior explains some of the stuff we had to fix in our implementation | 20:02 |
| lbragstad | in case anyone else is wondering about the 418 Teapot stuff in the flaskification review | 20:03 |
| lbragstad | reviews* | 20:03 |
| kmalloc | yeah, we had some weirdness | 20:08 |
| kmalloc | the 418 teapot stuff [yes we can change the error code] | 20:08 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add docs for case-insensitivity in keystone https://review.openstack.org/576640 | 20:09 |
| kmalloc | we also had a number of cases where [even before flask] we referenced an incorrect url and got a 404 | 20:10 |
| kmalloc | we expected a 404 in our tests | 20:10 |
| kmalloc | but it was the wrong kind of 404 | 20:10 |
| kmalloc | it was "app level" 404 not "not found resource" 404 | 20:11 |
| kmalloc | lbragstad: do you want me to move from 418 to something else, like 499 or something for testing? | 20:11 |
| kmalloc | it isn't hard to change that code out... but, *shrug* i like 418, it wont be used for anything serious | 20:12 |
| *** felipemonteiro__ has joined #openstack-keystone | 20:13 | |
| *** felipemonteiro_ has quit IRC | 20:13 | |
| *** felipemonteiro__ is now known as felipemonteiro | 20:16 | |
| *** felipemonteiro_ has joined #openstack-keystone | 20:28 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add docs for case-insensitivity in keystone https://review.openstack.org/576640 | 20:29 |
| *** felipemonteiro has quit IRC | 20:32 | |
| *** raildo has quit IRC | 20:43 | |
| *** itlinux has quit IRC | 20:53 | |
| lbragstad | yeah - doesn't matter to me i don't thik | 20:56 |
| lbragstad | think* | 20:56 |
| lbragstad | i understand the reasoning for it now | 20:56 |
| *** felipemonteiro_ has quit IRC | 20:58 | |
| *** felipemonteiro_ has joined #openstack-keystone | 20:59 | |
| *** jmlowe has quit IRC | 21:10 | |
| lbragstad | #endmeeting | 21:17 |
| *** openstack changes topic to "Rocky release schedule: https://releases.openstack.org/rocky/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/wmyzbFq5/keystone-rocky-roadmap !!NOTE!! This Channel is Logged ( https://tinyurl.com/OpenStackKeystone )" | 21:17 | |
| openstack | Meeting ended Tue Jul 10 21:17:08 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 21:17 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-07-10-17.01.html | 21:17 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-07-10-17.01.txt | 21:17 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-07-10-17.01.log.html | 21:17 |
| *** jmlowe has joined #openstack-keystone | 21:18 | |
| *** jmlowe has quit IRC | 21:23 | |
| *** jmlowe has joined #openstack-keystone | 21:36 | |
| *** martinus__ has quit IRC | 21:38 | |
| *** edmondsw has quit IRC | 22:01 | |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.limit master: import zuul job settings from project-config https://review.openstack.org/581506 | 22:01 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy master: import zuul job settings from project-config https://review.openstack.org/581510 | 22:01 |
| *** felipemonteiro_ has quit IRC | 22:04 | |
| openstackgerrit | Sami Makki proposed openstack/keystone master: Invalidate 'computed assignments' cache when creating or deleting project. https://review.openstack.org/581346 | 22:14 |
| *** rcernin has joined #openstack-keystone | 22:22 | |
| *** kimamisa has quit IRC | 22:26 | |
| openstackgerrit | Merged openstack/keystone master: Only upload SP metadata to testshib.org if IDP id is testshib https://review.openstack.org/545471 | 22:44 |
| *** elibrokeit is now known as meltdown_spectre | 22:51 | |
| *** meltdown_spectre is now known as elibrokeit | 22:59 | |
| *** spilla has joined #openstack-keystone | 23:07 | |
| *** tosky has quit IRC | 23:08 | |
| *** spilla has quit IRC | 23:09 | |
| *** edmondsw has joined #openstack-keystone | 23:16 | |
| *** edmondsw has quit IRC | 23:21 | |
| *** bhagyashri_s has quit IRC | 23:27 | |
| *** bhagyashri_s has joined #openstack-keystone | 23:28 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!