| *** dklyle has quit IRC | 00:03 | |
| *** _ix has joined #openstack-keystone | 00:17 | |
| *** zzzeek has quit IRC | 00:31 | |
| *** zzzeek has joined #openstack-keystone | 00:31 | |
| *** lbragstad has joined #openstack-keystone | 01:02 | |
| *** ChanServ sets mode: +o lbragstad | 01:02 | |
| *** imacdonn has quit IRC | 01:04 | |
| openstackgerrit | lvxianguo proposed openstack/python-keystoneclient master: fix misspelling of 'default' https://review.openstack.org/577368 | 01:04 |
|---|---|---|
| *** dave-mccowan has joined #openstack-keystone | 01:06 | |
| *** r-daneel has joined #openstack-keystone | 01:13 | |
| *** zzzeek has quit IRC | 01:14 | |
| *** zzzeek has joined #openstack-keystone | 01:16 | |
| *** imacdonn has joined #openstack-keystone | 01:16 | |
| *** r-daneel has quit IRC | 01:29 | |
| lbragstad | kmalloc: thoughts on https://review.openstack.org/#/c/589950/5 ? | 01:41 |
| *** _ix has quit IRC | 01:53 | |
| *** shyamb has joined #openstack-keystone | 03:40 | |
| *** shyamb has quit IRC | 03:52 | |
| *** dave-mccowan has quit IRC | 04:04 | |
| *** shyamb has joined #openstack-keystone | 04:20 | |
| kmalloc | It is all deprecated | 04:29 |
| kmalloc | We missed some | 04:29 |
| kmalloc | lbragstad: ^cc | 04:29 |
| kmalloc | Keystone is a bad distribution point for policy files, and those APIs are hard UX to be useful. | 04:30 |
| kmalloc | That said ep.policy is checked by tempest. I tried making it disabled by default a whilr ago. | 04:31 |
| lbragstad | hmm | 05:10 |
| lbragstad | ok | 05:10 |
| lbragstad | so we should formally deprecate the OS-ENDPOINT-POLICY API? | 05:11 |
| lbragstad | because according to the code it was just before i moved it to flask | 05:11 |
| *** pcaruana has quit IRC | 05:26 | |
| *** shyamb has quit IRC | 05:43 | |
| *** shyamb has joined #openstack-keystone | 05:46 | |
| *** shyamb has quit IRC | 06:01 | |
| *** hoonetorg has quit IRC | 06:45 | |
| *** pcaruana has joined #openstack-keystone | 06:48 | |
| *** hoonetorg has joined #openstack-keystone | 06:57 | |
| *** ispp has joined #openstack-keystone | 06:59 | |
| *** rha has joined #openstack-keystone | 07:04 | |
| *** rcernin has quit IRC | 07:20 | |
| *** ispp has quit IRC | 07:22 | |
| *** sayalilunkad has joined #openstack-keystone | 07:51 | |
| *** knikolla[m] has quit IRC | 08:11 | |
| openstackgerrit | Merged openstack/python-keystoneclient master: fix misspelling of 'default' https://review.openstack.org/577368 | 08:16 |
| *** rha has quit IRC | 08:52 | |
| *** mbuil has joined #openstack-keystone | 08:54 | |
| *** shyamb has joined #openstack-keystone | 08:55 | |
| *** josecastroleon has quit IRC | 09:01 | |
| *** josecastroleon has joined #openstack-keystone | 09:01 | |
| *** redrobot has quit IRC | 09:08 | |
| *** jaosorior has quit IRC | 09:10 | |
| *** redrobot has joined #openstack-keystone | 09:11 | |
| *** d0ugal has quit IRC | 09:14 | |
| *** d0ugal has joined #openstack-keystone | 09:18 | |
| openstackgerrit | Merged openstack/keystoneauth master: Update reno for stable/rocky https://review.openstack.org/586083 | 09:20 |
| openstackgerrit | Merged openstack/keystonemiddleware master: Update reno for stable/rocky https://review.openstack.org/586086 | 09:23 |
| mbuil | cmurphy, lbragstad: in the K2K deployment, when the SP receives the "Assertion", this one contains the auth-url ==> http://mysp.example.com:5000/v3/OS-FEDERATION/identity_providers/myidp/protocols/saml2/auth, right? So I guess the SP fetches that when verifying the "ECP SAML Response" from the User Agent, right? | 09:29 |
| mbuil | cmurphy, lbragstad: wait, that is a bit strange because the auth-url points to the SP itself... I am trying to understand how IdP and SP exchange the metadata to create the trust | 09:31 |
| cmurphy | mbuil: in the k2k case trust only goes in one direction, only the SP needs to trust the IdP, and with shibboleth that's done by setting the MetadataProvider in /etc/shibboleth/shibboleth2.xml to either a remote URL or a local file where it can find the IdP's metadata which contains its public key | 09:34 |
| *** josecastroleon has quit IRC | 09:38 | |
| mbuil | cmurphy: aaaah I see. An Shibboleth at the SP side fetches the metadata when it gets the assertion from the User Agent? | 09:39 |
| cmurphy | mbuil: I think it fetches it when the shibd daemon is started but not 100% sure | 09:41 |
| mbuil | cmurphy: thanks | 09:42 |
| mbuil | cmurphy: if I want to list the images that I have in my sp, this command should work right ==> openstack --os-service-provider mysp --os-remote-project-name federated_project --os-remote-project-domain-name federated_domain image list | 09:47 |
| *** josecastroleon has joined #openstack-keystone | 09:51 | |
| cmurphy | mbuil: i think so | 09:53 |
| mbuil | cmurphy: I am getting a Unauthorized (HTTP 401), even though token issue works | 09:54 |
| cmurphy | mbuil: hmm :/ | 09:55 |
| *** shyambiradar has joined #openstack-keystone | 09:57 | |
| cmurphy | mbuil: is it coming from the IdP or the SP? | 09:58 |
| cmurphy | mbuil: you can turn on insecure_debug in keystone.conf in both keystones and see if it gives you a reason | 09:58 |
| mbuil | I am looking at /var/log/keystone.log in the SP but I see nothing wrong. I can see the federation stuff going on and I see exactly the same when I do "token issue" instead | 09:59 |
| mbuil | cmurphy: ok, let me try that | 09:59 |
| *** shyamb has quit IRC | 10:00 | |
| mbuil | cmurphy: I see a message in the IdP keystone.log saying: "This is not a recognized Fernet token" | 10:01 |
| mbuil | so probably the token is created and fetched but the IdP does not recognize it (even though the request is targeting the sp) | 10:02 |
| *** d0ugal has quit IRC | 10:07 | |
| cmurphy | mbuil: yeah something is pointing it back to the wrong keystone, not sure why though :/ | 10:08 |
| *** rha has joined #openstack-keystone | 10:12 | |
| *** d0ugal has joined #openstack-keystone | 10:13 | |
| mbuil | cmurphy: in the IdP I have the service provider 'mysp' registered correctly pointing to the correct Auth URL | 10:14 |
| mbuil | cmurphy: there must be somewhere in the code a "switch" that tries the remote endpoint instead of the "local" one, right? Any idea where that code is? | 10:15 |
| *** s10 has joined #openstack-keystone | 10:15 | |
| cmurphy | mbuil: it's either in the client or in keystonemiddleware | 10:25 |
| *** lbragstad has quit IRC | 10:25 | |
| cmurphy | mbuil: I think it's a client issue actually, since you have OS_AUTH_URL pointing to the IdP | 10:26 |
| cmurphy | mbuil: I would try retrieving the token and then just using the token directly with OS_TOKEN and OS_URL pointing to the SP instead of the IdP | 10:27 |
| *** jaosorior has joined #openstack-keystone | 10:28 | |
| mbuil | cmurphy: right. That's what is happening. Can I force that behaviour with just modifying stuff in my openrc? | 10:28 |
| mbuil | you mean: 1 - fetch a token with "token issue". 2 - export OS_TOKEN=token_id 3 - export OS_URL=AUTH_SP ? Should I remove OS_AUTH_URL from my env? | 10:29 |
| cmurphy | mbuil: yes to all, in fact clean all OS_* variables from your env after step 1 before step 2 just to be safe | 10:31 |
| mbuil | cmurphy | 10:31 |
| mbuil | cmurphy ok! | 10:31 |
| *** shyambiradar has quit IRC | 10:35 | |
| *** shyambiradar has joined #openstack-keystone | 10:35 | |
| mbuil | cmurphy: for OS_URL, I wrote exactly what I had in OS_AUTH_URL but changing the ip (http://10.10.100.29:5000/v3/). I guess this is wrong because when doing 'image list' it tries to fetch something from the URL ==> http://10.10.100.29:5000/v3/v2/images | 10:50 |
| *** shyambiradar has quit IRC | 10:51 | |
| cmurphy | mbuil: oh it's trying to use it as the glance URL, I might be wrong about how that command works | 10:54 |
| *** mvkr has quit IRC | 10:54 | |
| cmurphy | let me try to reproduce | 10:55 |
| *** shyambiradar has joined #openstack-keystone | 11:02 | |
| *** ravirjn has joined #openstack-keystone | 11:09 | |
| mbuil | cmurphy: reading the code I can see that what I get makes sense. When using tokens, auth_ref is None because of this ==> https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/token_endpoint.py#L69-L76 | 11:09 |
| mbuil | cmurphy: as a consequence, the endpoint is taken from OS_URL ==> https://github.com/openstack/osc-lib/blob/stable/queens/osc_lib/clientmanager.py#L294-L297 | 11:10 |
| ravirjn | Hi Everyone, I am unable to allocate floating IP using admin user, it seems some permission issue with keystone... can anyone please help me.. here is log http://paste.openstack.org/show/728181/ | 11:12 |
| *** dave-mccowan has joined #openstack-keystone | 11:16 | |
| *** shyambiradar has quit IRC | 11:17 | |
| *** shyambiradar has joined #openstack-keystone | 11:23 | |
| *** mvkr has joined #openstack-keystone | 11:25 | |
| *** josecastroleon has quit IRC | 11:28 | |
| *** josecastroleon has joined #openstack-keystone | 11:28 | |
| cmurphy | mbuil: still not sure exactly what the issue is but I think this is a better test and works for me: `curl -H "x-auth-token: $OS_TOKEN" <glance endpoint>/images` | 11:28 |
| *** josecastroleon has quit IRC | 11:31 | |
| *** josecastroleon has joined #openstack-keystone | 11:31 | |
| cmurphy | ravirjn: that doesn't look like anything to do with keystone to me, that looks like an issue between horizon and neutron | 11:32 |
| cmurphy | mbuil: hmm well now going through the client with OS_URL=<glance endpoint> works for me, not sure what i changed | 11:41 |
| *** aloga has joined #openstack-keystone | 11:42 | |
| cmurphy | mbuil: I was using a token obtained from the IdP not the SP, maybe that's what you were doing too | 11:48 |
| *** aloga has quit IRC | 11:49 | |
| *** aloga has joined #openstack-keystone | 11:50 | |
| mbuil | cmurphy: using OS_URL=<glance endpoint> works for me too. Therefore, when a remote service must be used, the OS_URL needs to be change for each service | 12:00 |
| mbuil | I wonder why it does not use the catalog when doing the token authentication... | 12:01 |
| cmurphy | i guess it's just cutting out that round trip to keystone | 12:01 |
| mbuil | cmurphy: the code says "# token plugin does not have an auth ref, because it's a "static" authentication using a pre-existing token.... not sure what static means here :/ | 12:06 |
| cmurphy | mbuil: i guess in a dynamic authentication you would go to keystone first and exchange your credentials for a token which in the process also gives you a catalog, maybe by "static" they mean you don't get the chance to refresh your catalog since you're not going to keystone first | 12:09 |
| mbuil | cmurphy: ok. Time to switch to other things. Thanks a lot for the help! Tomorrow more :) | 12:11 |
| cmurphy | mbuil: cool :) | 12:13 |
| *** jaosorior has quit IRC | 12:25 | |
| *** jaosorior has joined #openstack-keystone | 12:25 | |
| *** raildo has joined #openstack-keystone | 12:30 | |
| *** josecastroleon has quit IRC | 12:34 | |
| *** josecastroleon has joined #openstack-keystone | 12:37 | |
| *** rha has quit IRC | 12:42 | |
| *** shyambiradar has quit IRC | 13:08 | |
| *** jaosorior has quit IRC | 13:14 | |
| *** jaosorior has joined #openstack-keystone | 13:15 | |
| *** jaosorior has quit IRC | 13:20 | |
| *** imacdonn has quit IRC | 13:29 | |
| *** nicolasbock has joined #openstack-keystone | 13:32 | |
| *** imacdonn has joined #openstack-keystone | 13:42 | |
| *** mvkr has quit IRC | 14:02 | |
| *** josecastroleon has quit IRC | 14:02 | |
| *** josecastroleon has joined #openstack-keystone | 14:06 | |
| *** josecastroleon has quit IRC | 14:10 | |
| *** josecastroleon has joined #openstack-keystone | 14:18 | |
| *** ayoung has joined #openstack-keystone | 14:21 | |
| ayoung | kmalloc, I realize that Git blame is going to make the entire Keystone code base look like it was written by you. | 14:22 |
| cmurphy | i already plan on blaming kmalloc for all keystone bugs | 14:26 |
| knikolla | o/ | 14:27 |
| knikolla | lol | 14:27 |
| kmalloc | cmurphy: <3 | 14:30 |
| kmalloc | ayoung: yep, I knew that going into the huge refactor. | 14:30 |
| ayoung | kmalloc, that is why I wanted to move the files first, or in a stand alone git commit | 14:31 |
| ayoung | Its too late now | 14:32 |
| ayoung | but I would prefer it if we could maintain history, especially on some of the more chaotice files, like auth and such | 14:32 |
| *** jaosorior has joined #openstack-keystone | 14:32 | |
| ayoung | I usually just want to look to see if I was at fault for a certain commit, like the LDAP pool locking people out. | 14:33 |
| kmalloc | Except, history would still show me mostly doing all the work. Since the files change too much | 14:33 |
| kmalloc | You're going to have to run back a few commits in either case :( | 14:33 |
| *** mvkr has joined #openstack-keystone | 14:33 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Do not log token string https://review.openstack.org/592505 | 14:36 |
| *** d0ugal has quit IRC | 14:39 | |
| kmalloc | ayoung: thankfully, most all of the code here is controller code, most of the logic is all further down... With exception of auth and discovery. | 14:39 |
| ayoung | kmalloc, yeah, for most of the files it should be OK. It was the trust code that was most controlled embedded. | 14:40 |
| ayoung | auth is also a bit of spaghetti | 14:40 |
| kmalloc | The next move will be just file moving (moving bits from top level to keystone.subsystem) | 14:41 |
| kmalloc | So it will be keystone.subsystem.trusts. | 14:41 |
| *** d0ugal has joined #openstack-keystone | 14:41 | |
| kmalloc | Long term the goal will be keystone top level is common code, API is controller/view code,and keystone.subsystem will be manager /driver bits. | 14:42 |
| kmalloc | But that is really just moving files, no additional refactoring. | 14:42 |
| ayoung | kmalloc, you knikolla and I need to sit down and plan the Edge talk. | 14:47 |
| knikolla | ayoung: are you comind to devconf? | 14:48 |
| knikolla | coming* | 14:48 |
| ayoung | knikolla, I was not planning on it | 14:49 |
| ayoung | knikolla, I probably should, though | 14:49 |
| *** mvkr has quit IRC | 15:06 | |
| *** r-daneel has joined #openstack-keystone | 15:07 | |
| *** dave-mccowan has quit IRC | 15:26 | |
| kmalloc | ayoung: i can chat about the talk today | 15:46 |
| *** d0ugal has quit IRC | 15:47 | |
| ayoung | kmalloc, knikolla 2-3PM Eastern today OK to discuss? | 15:48 |
| knikolla | ayoung: works for me | 15:48 |
| *** dave-mccowan has joined #openstack-keystone | 15:49 | |
| *** gyee has joined #openstack-keystone | 15:53 | |
| kmalloc | Sure | 15:56 |
| *** d0ugal has joined #openstack-keystone | 16:00 | |
| *** fiddletwix has joined #openstack-keystone | 16:02 | |
| *** itlinux has joined #openstack-keystone | 16:11 | |
| *** fiddletwix has quit IRC | 16:15 | |
| *** fiddletwix has joined #openstack-keystone | 16:17 | |
| *** s10 has quit IRC | 16:32 | |
| *** pcaruana has quit IRC | 16:34 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert role_assignments API to flask native dispatching https://review.openstack.org/590518 | 16:44 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert system (role) api to flask native dispatching https://review.openstack.org/590588 | 16:44 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Move json_home "extension" rel functions https://review.openstack.org/591025 | 16:44 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert OS-FEDERATION to flask native dispatching https://review.openstack.org/591082 | 16:45 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Refactor ProviderAPIs object to better design pattern https://review.openstack.org/571955 | 16:45 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Refactor ProviderAPIs object to better design pattern https://review.openstack.org/571955 | 16:45 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Fix RBACEnforcer get_member_from_driver mechanism https://review.openstack.org/591146 | 16:45 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert groups API to flask native dispatching https://review.openstack.org/591147 | 16:45 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Fix a translation of log https://review.openstack.org/591164 | 16:46 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert OS-INHERIT API to flask native dispatching https://review.openstack.org/591165 | 16:46 |
| kmalloc | ayoung: ^ the queryparam "is true" part was wrong, this is a fix of that and a rebase of the stack | 16:46 |
| ayoung | kmalloc, I thought that was fairly standard for boolean values | 16:46 |
| kmalloc | it is | 16:48 |
| kmalloc | i had the code wrong | 16:48 |
| kmalloc | i had url?param = false | 16:48 |
| *** openstackgerrit has quit IRC | 16:49 | |
| kmalloc | the only cases that are false are: url | 16:49 |
| kmalloc | and url?param=0 | 16:49 |
| kmalloc | or should be* | 16:49 |
| kmalloc | so existence of the param, without value == true | 16:49 |
| kmalloc | (now) | 16:49 |
| kmalloc | no change in behavior from original code. it was a mistake I made when porting it. | 16:49 |
| *** openstackgerrit has joined #openstack-keystone | 16:59 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add safety to the inferred target extraction during enforcement https://review.openstack.org/591203 | 16:59 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert role_assignments API to flask native dispatching https://review.openstack.org/590518 | 17:00 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert system (role) api to flask native dispatching https://review.openstack.org/590588 | 17:00 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Move json_home "extension" rel functions https://review.openstack.org/591025 | 17:00 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert OS-FEDERATION to flask native dispatching https://review.openstack.org/591082 | 17:00 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Refactor ProviderAPIs object to better design pattern https://review.openstack.org/571955 | 17:01 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Fix RBACEnforcer get_member_from_driver mechanism https://review.openstack.org/591146 | 17:02 |
| gyee | kmalloc, Keystone doesn't use these functionality right? https://github.com/flask-restful/flask-restful/blob/master/flask_restful/utils/crypto.py | 17:13 |
| kmalloc | gyee: not explicitly/implicitly there might be cases it would. | 17:15 |
| gyee | I am not seeing them being used anywhere. | 17:16 |
| gyee | https://github.com/flask-restful/flask-restful/blob/master/setup.py#L9 | 17:16 |
| gyee | I am trying to resolve a package dependency on pycrypto | 17:17 |
| hrybacki | cmurphy: o/ -- there isn't a config option to enable app creds right? | 17:28 |
| cmurphy | hrybacki: not to enable the API but you have to have application_credential in [auth]/methods (which is there by default) in order to auth with them | 17:30 |
| hrybacki | no issue creating them, but ran into issues authenticating with one. Watched (and followed along in Horizon) your Vancouver talk. Hit the same issue with the clouds.yaml so figured I'd raise it with you. "Error authenticating with application credential: Application credentials cannot request a scope. (HTTP 401)" | 17:30 |
| hrybacki | lemme look there and make sure we didn't do anything weird in osp bits | 17:30 |
| hrybacki | nope, definitely using the defaults. cmurphy have you seen that response before? Perhaps I mucked something else up ^^ | 17:31 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Do not log token string https://review.openstack.org/592505 | 17:32 |
| cmurphy | hrybacki: you shouldn't have a scope object in the request | 17:33 |
| cmurphy | it takes the scope from the application credential itself | 17:34 |
| cmurphy | example https://developer.openstack.org/api-ref/identity/v3/index.html#id94 | 17:34 |
| hrybacki | cmurphy: weird -- I'm simply invoking a `openstack token issue` | 17:35 |
| hrybacki | I'll dig into it deeper and get back. Thanks for the nudge :) | 17:35 |
| cmurphy | hrybacki: are you setting a project in your openrc/clouds.yaml? | 17:36 |
| hrybacki | cmurphy: nope -- https://paste.fedoraproject.org/paste/cXr4WXccF9V3zJXOgs6TJA | 17:37 |
| cmurphy | hmm | 17:38 |
| *** dave-mccowan has quit IRC | 17:39 | |
| hrybacki | yeah, I'm scratching my head over here haha | 17:40 |
| * hrybacki fetches coffeeeeee | 17:40 | |
| knikolla | can you do an `openstack token issue --debug`? | 17:42 |
| cmurphy | good idea | 17:42 |
| kmalloc | gyee: i don't see where pycrypto is coming from | 17:57 |
| kmalloc | gyee: my tox environment, fwiw, doesn't have pycrypto | 17:57 |
| openstackgerrit | Merged openstack/keystone master: Convert Roles API to flask native dispatching https://review.openstack.org/590494 | 17:58 |
| openstackgerrit | Merged openstack/keystone master: Convert role_inferences API to flask native dispatching https://review.openstack.org/590502 | 17:58 |
| gyee | kmalloc, its the python-Flask-Restful package in openSuSE build server. For some reason it include pycrypto as a dependent. I am fixing it now. Thanks for verifying. | 18:01 |
| hrybacki | I can (just getting sucked back into meetings :() | 18:02 |
| kmalloc | np | 18:03 |
| hrybacki | I figured it out kmalloc cmurphy.. polluted environment variables from an early sourcing of an rc file -_- | 18:06 |
| hrybacki | the project scope was enough of a tip off -- so thanks :) | 18:07 |
| cmurphy | cool :) | 18:07 |
| kmalloc | hrybacki: doh! hate it when that happens | 18:07 |
| *** r-daneel has quit IRC | 18:20 | |
| kmalloc | cmurphy: | 18:24 |
| kmalloc | https://usercontent.irccloud-cdn.com/file/dJmnBEOP/IMG_20180816_112347.jpg | 18:24 |
| cmurphy | squeeee | 18:24 |
| cmurphy | comfy pup is comfy | 18:24 |
| kmalloc | yesssss | 18:25 |
| openstackgerrit | Merged openstack/keystone master: Add callback action back in https://review.openstack.org/590590 | 18:48 |
| *** harlowja has joined #openstack-keystone | 18:51 | |
| *** r-daneel has joined #openstack-keystone | 18:56 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert role_assignments API to flask native dispatching https://review.openstack.org/590518 | 18:58 |
| mnaser | so what would be the difference between applications credentials and trusts? | 18:59 |
| mnaser | i don't really see that much of a difference somehow | 19:00 |
| kmalloc | trusts use normal auth mechanisms "username/password" claiming delegation in the trust | 19:03 |
| kmalloc | app creds supplant the standard username/password | 19:03 |
| cmurphy | mnaser: a normal end user can't create a user to delegate a trust to | 19:03 |
| kmalloc | cmurphy: ++ that too | 19:03 |
| *** itlinux has quit IRC | 19:04 | |
| cmurphy | application credentials are entirely self service | 19:04 |
| mnaser | cmurphy, kmalloc: ok cool, so the idea is a user can grant application credentials without needing to create a new user? | 19:06 |
| kmalloc | mnaser: yep, and limit the roles/project access | 19:06 |
| mnaser | my use case is a customer who needs to give access to different users to the same project, but because of the admin-ness bug and my not-wanting-to-modify-default-policy, they're unable to maintain their own users | 19:07 |
| mnaser | so my idea was: create application credentials and use those to authenticate (and hopefully openstackclient supports that part, or we might have to do some work to get it to) | 19:07 |
| kmalloc | cmurphy: would you be opposed if i wrapped the hashing of the app-cred into the SQL model like I did for passwords? rather than needing to explicitly call "hash" it's done on Model.secret = XXX | 19:07 |
| kmalloc | mnaser: that fits exactly what app creds are meant to solve (or one case) | 19:07 |
| mnaser | kmalloc: cool! glad we're running queens then :D | 19:08 |
| kmalloc | :) | 19:08 |
| mnaser | on a seperate note where i should check this but it's easier to ask | 19:08 |
| mnaser | will keystone forward the original user id in requests or the 'application credentials' one to services | 19:08 |
| cmurphy | kmalloc: i vaguely remember using the user model as an example so i'm surprised it's not already the same | 19:08 |
| mnaser | i.e.: reboot a server will come from original_user_id or application_credential_user_id ? | 19:08 |
| kmalloc | it generates a token for the user | 19:08 |
| kmalloc | explicitly scoped with roles assigned | 19:09 |
| kmalloc | so the token is for the issuing user_id | 19:09 |
| mnaser | ah so all requests will be identified as that user, so there won't really be the ability to know who-did-what | 19:09 |
| mnaser | damrn | 19:09 |
| kmalloc | yes. | 19:09 |
| mnaser | darn* | 19:09 |
| kmalloc | well you know the token was generated with the app_cred | 19:09 |
| kmalloc | (or should) and you know the token was used | 19:09 |
| mnaser | yeah but for example things like instance action logs log user_id and project_id but not token | 19:10 |
| kmalloc | so it should be doable to correlate, but that is getting into audit trails | 19:10 |
| kmalloc | yeah. | 19:10 |
| kmalloc | i would offer the other option is to allow the user to use an external LDAP or similar for user management | 19:11 |
| kmalloc | domain-specific-config. | 19:11 |
| mnaser | kmalloc: that was exactly my idea | 19:11 |
| mnaser | so good to have it validated | 19:11 |
| kmalloc | :) | 19:11 |
| mnaser | domain specific external ldap, my only concern is how roles are assigned | 19:11 |
| mnaser | i.e. i dont want them to give a role 'admin' to one of their users :-) | 19:11 |
| knikolla | in that case trusts? | 19:11 |
| mnaser | trusts implies that the another user already exists | 19:12 |
| knikolla | from the ldap store, yeah | 19:12 |
| mnaser | but the user cant create another user, because they don't have the ability to do that (no admin rights) | 19:12 |
| kmalloc | if you're using v3, grant them domain_admin and add a check in polcy that ensures they have the role before they can assign it | 19:12 |
| kmalloc | i think i can help you come up with the check_str for policy.json for that | 19:12 |
| mnaser | i think the issue was having domain_admin could let you assign any roles to anyone so that was the concern at the time | 19:13 |
| kmalloc | nah, we could craft a special check_string to help with that | 19:13 |
| kmalloc | i've been deep in policy code lately, so give me a moment to see if we can do that easily | 19:13 |
| mnaser | that'd be pretty sweet if that was the case, i can imagine this being something a lot of people needing | 19:14 |
| kmalloc | it might already be part of our v3_cloud policy | 19:14 |
| kmalloc | mnaser: ah, we lean on domain-specific roles for this | 19:16 |
| mnaser | kmalloc: im thinking out loud -- ldap for identity, sql for assignment, give `foo` group _member_ role to project, and let them add users to said group without giving them access to assign roles | 19:16 |
| kmalloc | it'd be roles created with a domain=XXX | 19:16 |
| kmalloc | mnaser: that would be pretty straightforward as well | 19:17 |
| kmalloc | mnaser: it might actually be *easier* to manage. | 19:17 |
| kmalloc | because it doesn't involve creating domain-specific roles. | 19:17 |
| mnaser | yeah, they just have to add users to a certain group and voila | 19:17 |
| mnaser | the only thing is they are kinda part of the existing default domain | 19:17 |
| kmalloc | you could even simply make one group per role [if more than one role] | 19:17 |
| mnaser | so im not sure if how easy it would be to handle that | 19:18 |
| kmalloc | well, as long as they are using v3 api, conversion is straightforward | 19:18 |
| kmalloc | add stuff to new domain, tell them to use new domain stuff / migrate and they can manage users. | 19:19 |
| mnaser | can a group in domain `foo` be given access to a project in domain `bar` ? | 19:19 |
| kmalloc | should be doable | 19:19 |
| kmalloc | i can't be 100% sure right this second though. | 19:19 |
| mnaser | so question is can role assignments span across domains? | 19:20 |
| kmalloc | they should be able to | 19:21 |
| kmalloc | i'm looking at the code now | 19:21 |
| kmalloc | but, the whole concept that a user is in domain X, and owned by Domain X, doesn't mean all projects user works on should be required to be in Domain X | 19:21 |
| kmalloc | i think the only case is for domain-specific roles | 19:22 |
| kmalloc | where those roles can only be added to projects within that domain. | 19:22 |
| kmalloc | but not limited to users owned by that domain | 19:22 |
| kmalloc | mnaser: looking at the code, i see no reason a grant cannot connect USER/GROUP from DOMAIN X to project in DOMAIN Y | 19:23 |
| mnaser | kmalloc: https://bugs.launchpad.net/keystone/+bug/1474284/comments/4 from 2015 seems to match | 19:24 |
| openstack | Launchpad bug 1474284 in OpenStack Identity (keystone) "Adding users from different domain to a group" [Medium,Invalid] | 19:24 |
| kmalloc | ++ | 19:25 |
| kmalloc | knikolla: i had to buy a smaller CPU cooler :( the one I had blocked PCIE-1, so i couldn't install the RADEON PRO GPU | 19:27 |
| kmalloc | knikolla: aparantly 140MM is just too large if I want to use all the PCIE slots =/ | 19:28 |
| kmalloc | (stupid "not workstation" motherboard) | 19:28 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Do not log token string https://review.openstack.org/592505 | 19:29 |
| *** jrist has quit IRC | 19:40 | |
| *** HW_Peter has joined #openstack-keystone | 20:04 | |
| *** HW-Peter has quit IRC | 20:07 | |
| *** pcaruana has joined #openstack-keystone | 20:13 | |
| *** r-daneel has quit IRC | 20:36 | |
| *** jrist has joined #openstack-keystone | 20:39 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert system (role) api to flask native dispatching https://review.openstack.org/590588 | 20:48 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Move json_home "extension" rel functions https://review.openstack.org/591025 | 20:49 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert OS-FEDERATION to flask native dispatching https://review.openstack.org/591082 | 20:49 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Refactor ProviderAPIs object to better design pattern https://review.openstack.org/571955 | 20:49 |
| *** r-daneel has joined #openstack-keystone | 20:53 | |
| *** pcaruana has quit IRC | 20:53 | |
| *** ayoung has quit IRC | 21:09 | |
| *** mchlumsky has quit IRC | 21:11 | |
| *** mvkr has joined #openstack-keystone | 21:29 | |
| *** rcernin has joined #openstack-keystone | 21:49 | |
| *** itlinux has joined #openstack-keystone | 21:54 | |
| *** jrist has quit IRC | 21:55 | |
| *** harlowja has quit IRC | 22:14 | |
| *** edmondsw has quit IRC | 22:20 | |
| *** edmondsw has joined #openstack-keystone | 22:25 | |
| *** dklyle has joined #openstack-keystone | 22:33 | |
| *** raildo_ has joined #openstack-keystone | 22:53 | |
| *** raildo has quit IRC | 22:53 | |
| *** jrist has joined #openstack-keystone | 23:01 | |
| *** raildo_ has quit IRC | 23:01 | |
| *** gyee has quit IRC | 23:53 | |
| *** itlinux has quit IRC | 23:57 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!
