| *** Nel1x has joined #openstack-keystone | 00:57 | |
| *** rcernin has quit IRC | 01:24 | |
| *** rcernin has joined #openstack-keystone | 01:24 | |
| *** bzhao__ has joined #openstack-keystone | 01:26 | |
| *** dave-mccowan has quit IRC | 02:13 | |
| *** Nel1x has quit IRC | 03:14 | |
| *** ykarel has joined #openstack-keystone | 03:24 | |
| deepak_mourya_ | cmurphy: Hi, just a reminder that I have updated the patchset, you can review the same https://review.openstack.org/#/c/484348/ | 03:25 |
|---|---|---|
| openstackgerrit | Merged openstack/keystone master: Incorrect use of translation _() https://review.openstack.org/596683 | 03:28 |
| openstackgerrit | Merged openstack/keystone master: Update RDO install guide for v3 https://review.openstack.org/599318 | 03:28 |
| *** jrist has joined #openstack-keystone | 03:31 | |
| *** r-daneel has joined #openstack-keystone | 03:34 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-specs master: Add domain level limit support https://review.openstack.org/599491 | 03:35 |
| *** ykarel has quit IRC | 03:37 | |
| *** ykarel has joined #openstack-keystone | 03:51 | |
| *** ykarel has quit IRC | 04:08 | |
| *** ykarel has joined #openstack-keystone | 04:37 | |
| *** shyamb has joined #openstack-keystone | 04:59 | |
| ykarel | wxy-xiyuan, hi | 04:59 |
| ykarel | wxy-xiyuan, any chance u were able to reproduce keystonemiddleware + oslo.config issue: https://bugs.launchpad.net/glance/+bug/1789351 | 05:00 |
| openstack | Launchpad bug 1789351 in oslo.config "Glance deployment with python3 + "keystone" paste_deploy flavor Fails" [Undecided,New] | 05:00 |
| ykarel | dhellmann, has a possible fix there ^^, can u check, | 05:01 |
| *** shyamb has quit IRC | 05:08 | |
| *** shyamb has joined #openstack-keystone | 05:08 | |
| *** shyamb has quit IRC | 05:23 | |
| *** shyamb has joined #openstack-keystone | 05:42 | |
| *** vishakha has quit IRC | 05:48 | |
| *** pas-ha has quit IRC | 05:48 | |
| *** pas-ha has joined #openstack-keystone | 05:48 | |
| *** mugsie has quit IRC | 05:49 | |
| *** zigo has quit IRC | 05:49 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-specs master: Add domain level limit support https://review.openstack.org/599491 | 06:23 |
| *** hoonetorg has joined #openstack-keystone | 06:24 | |
| *** shyamb has quit IRC | 06:25 | |
| *** shyamb has joined #openstack-keystone | 06:25 | |
| *** shyam89 has joined #openstack-keystone | 06:30 | |
| *** rcernin has quit IRC | 06:33 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement Trust Flush via keystone-manage. https://review.openstack.org/589378 | 06:33 |
| *** shyamb has quit IRC | 06:34 | |
| *** vishakha has joined #openstack-keystone | 06:35 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-specs master: Add domain level limit support https://review.openstack.org/599491 | 06:37 |
| wxy-xiyuan | ykarel: I can't reproduce even re-install devstack with your patch. It's weird. | 06:40 |
| wxy-xiyuan | ykarel: does dhellmann's fix works for you? | 06:40 |
| ykarel | wxy-xiyuan, yes abhishek tried that and it worked, let me try to reproduce again | 06:41 |
| wxy-xiyuan | ykarel: cool. I'm not the blocker for the fix. Feel free to do it. I just can't reproduce and don't know how and why the problem happened :) | 06:43 |
| ykarel | wxy-xiyuan, let me try again to see why it's not reproducable to u | 06:44 |
| wxy-xiyuan | ykarel: I guess it's my problem since CI already told that it's a bug indeed. | 06:45 |
| ykarel | wxy-xiyuan, hmm probably | 06:51 |
| *** ykarel is now known as ykarel|lunch | 07:40 | |
| *** shyam89 has quit IRC | 07:55 | |
| *** Emine has joined #openstack-keystone | 08:05 | |
| *** shyam89 has joined #openstack-keystone | 08:37 | |
| *** d0ugal has quit IRC | 08:43 | |
| *** ykarel|lunch is now known as ykarel | 08:45 | |
| *** josecastroleon has joined #openstack-keystone | 09:02 | |
| *** d0ugal has joined #openstack-keystone | 09:03 | |
| ykarel | wxy-xiyuan, hi, i have the reproducer, would u like to see | 09:24 |
| wxy-xiyuan | ykarel: sure | 09:24 |
| ykarel | wxy-xiyuan, see pm | 09:25 |
| *** shyam89 has quit IRC | 09:29 | |
| *** sayalilunkad has joined #openstack-keystone | 09:32 | |
| *** shyam89 has joined #openstack-keystone | 09:47 | |
| *** jaosorior has joined #openstack-keystone | 09:47 | |
| *** shyam89 has quit IRC | 09:55 | |
| openstackgerrit | Merged openstack/python-keystoneclient master: add lib-forward-testing-python3 test job https://review.openstack.org/597674 | 10:16 |
| *** dave-mccowan has joined #openstack-keystone | 10:41 | |
| *** mugsie has joined #openstack-keystone | 10:46 | |
| *** takamatsu has joined #openstack-keystone | 11:00 | |
| *** shyam89 has joined #openstack-keystone | 11:04 | |
| *** andreaf has joined #openstack-keystone | 11:05 | |
| *** shyam89 has quit IRC | 11:41 | |
| *** dims has joined #openstack-keystone | 11:56 | |
| *** shyam89 has joined #openstack-keystone | 12:04 | |
| *** josecastroleon has quit IRC | 12:13 | |
| *** raildo has joined #openstack-keystone | 12:16 | |
| *** ykarel is now known as ykarel|away | 12:34 | |
| *** jrist has quit IRC | 12:39 | |
| *** jrist has joined #openstack-keystone | 12:40 | |
| *** ykarel|away has quit IRC | 12:42 | |
| *** shyam89 has quit IRC | 12:58 | |
| *** lbragstad has joined #openstack-keystone | 13:19 | |
| *** ChanServ sets mode: +o lbragstad | 13:19 | |
| openstackgerrit | Merged openstack/keystone master: Update the minimimum required version of oslo.log https://review.openstack.org/599446 | 13:48 |
| kmalloc | lbragstad: probably will miss meeting today, doctor appt. again. | 14:04 |
| lbragstad | kmalloc thanks for the heads up | 14:05 |
| kmalloc | Have groups respun, I was right the first time, we should be leaking data somewhat here, I'll provide an in depth note in the commit msg. | 14:05 |
| lbragstad | nice - that'd be good | 14:06 |
| lbragstad | i'll review it today | 14:06 |
| *** r-daneel has quit IRC | 14:07 | |
| *** jdennis has joined #openstack-keystone | 14:07 | |
| * cmurphy will also miss the meeting | 14:07 | |
| lbragstad | ack | 14:08 |
| *** itlinux has quit IRC | 14:15 | |
| kmalloc | PS not posted | 14:19 |
| kmalloc | Figure that will be later today. | 14:19 |
| *** mchlumsky has joined #openstack-keystone | 14:38 | |
| kmalloc | lbragstad: ^ | 14:38 |
| *** r-daneel has joined #openstack-keystone | 14:39 | |
| lbragstad | kmalloc sounds good | 14:42 |
| lbragstad | i have a few other things i can wrap up before then | 14:43 |
| gagehugo | o/ | 14:45 |
| *** dklyle has joined #openstack-keystone | 14:58 | |
| knikolla | o/ | 15:00 |
| knikolla | fyi: i have a medical appt and will be missing the meeting | 15:01 |
| *** itlinux has joined #openstack-keystone | 15:09 | |
| *** dklyle has quit IRC | 15:13 | |
| *** dklyle has joined #openstack-keystone | 15:14 | |
| *** lamt has joined #openstack-keystone | 15:18 | |
| *** wxy| has joined #openstack-keystone | 15:19 | |
| *** openstackgerrit has quit IRC | 15:20 | |
| *** Emine has quit IRC | 15:31 | |
| hrybacki | o/ | 15:55 |
| hrybacki | I have to drop 30 mins early myself today | 15:55 |
| *** jlvilla-viva is now known as jlvillal | 15:58 | |
| *** prometheanfire has left #openstack-keystone | 16:00 | |
| *** wxy| has quit IRC | 16:22 | |
| *** gyee has joined #openstack-keystone | 16:24 | |
| *** ayoung has joined #openstack-keystone | 16:24 | |
| kmalloc | o/ | 16:53 |
| *** hwoarang_ has joined #openstack-keystone | 16:57 | |
| *** hwoarang__ has joined #openstack-keystone | 16:58 | |
| *** hwoarang has quit IRC | 17:01 | |
| *** hwoarang_ has quit IRC | 17:02 | |
| *** ykarel has joined #openstack-keystone | 17:03 | |
| *** hwoarang has joined #openstack-keystone | 17:03 | |
| *** hwoarang__ has quit IRC | 17:08 | |
| lbragstad | #startmeeting keystone-office-hours | 17:10 |
| openstack | Meeting started Tue Sep 4 17:10:32 2018 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. | 17:10 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 17:10 |
| *** openstack changes topic to " (Meeting topic: keystone-office-hours)" | 17:10 | |
| *** ChanServ changes topic to "Rocky release schedule: https://releases.openstack.org/rocky/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/wmyzbFq5/keystone-rocky-roadmap !!NOTE!! This Channel is Logged ( https://tinyurl.com/OpenStackKeystone )" | 17:10 | |
| openstack | The meeting name has been set to 'keystone_office_hours' | 17:10 |
| kmalloc | lbragstad: ok | 17:39 |
| kmalloc | lbragstad: so, the reason we need to leak details on if a group exists or not, is communication to the user | 17:39 |
| kmalloc | lbragstad: i think i'm going to add an explicit .get check before enforcement. | 17:40 |
| kmalloc | wonder if i can craft the target in a better way | 17:40 |
| *** r-daneel has quit IRC | 18:06 | |
| *** r-daneel has joined #openstack-keystone | 18:07 | |
| *** ykarel is now known as ykarel|away | 18:13 | |
| lbragstad | kmalloc but don't we want to keep that from the user? | 18:19 |
| lbragstad | they're unauthorized | 18:19 |
| kmalloc | so here is the case | 18:19 |
| kmalloc | i am trying to do "domain role X on group Y" | 18:19 |
| kmalloc | if the group doesn't exist, what is the expecation | 18:20 |
| kmalloc | a 403? "forbidden" or a "404, group not found" | 18:20 |
| kmalloc | [specifically the case of group not existing] | 18:20 |
| lbragstad | is the user authorized? | 18:20 |
| kmalloc | user it authenticated and is allowed to assign the role | 18:20 |
| lbragstad | then it should be a 404 | 18:20 |
| lbragstad | IMO | 18:20 |
| kmalloc | then group patch [mostly] as is, will be fine | 18:21 |
| kmalloc | needs a quick pass then and a note. | 18:21 |
| kmalloc | however, just fyi, this does allow a bad actor to determine group existence. | 18:21 |
| kmalloc | as long as they can create a domain role and assign it | 18:22 |
| kmalloc | *shrug* not a huge leak | 18:22 |
| kmalloc | but it is. | 18:22 |
| lbragstad | if a user calls GET -H "X-Auth-Token: garbage-token" /v3/domains/{domain_id}/groups/{group_id}/roles/{role_id} then i don't think we should leak that the domain doesn't exist | 18:22 |
| lbragstad | if $domain_id doesn't exist, then we should expose that information i don't think | 18:22 |
| lbragstad | and return a 403 | 18:23 |
| kmalloc | hm. | 18:23 |
| kmalloc | yeah see how this is nuanced and weird. | 18:23 |
| lbragstad | if the user is authenticated AND $domain_id doesn't exist, then we should return a 404 | 18:23 |
| lbragstad | right? | 18:23 |
| kmalloc | hm. | 18:23 |
| kmalloc | yeh. | 18:23 |
| *** itlinux has quit IRC | 18:58 | |
| *** r-daneel_ has joined #openstack-keystone | 20:38 | |
| *** r-daneel has quit IRC | 20:38 | |
| *** r-daneel_ is now known as r-daneel | 20:38 | |
| *** itlinux has joined #openstack-keystone | 20:41 | |
| *** raildo has quit IRC | 20:51 | |
| *** imacdonn has quit IRC | 21:02 | |
| *** imacdonn has joined #openstack-keystone | 21:02 | |
| *** itlinux is now known as itlinux-away | 21:30 | |
| *** itlinux-away is now known as itlinux | 21:30 | |
| *** itlinux is now known as itlinux-away | 21:30 | |
| *** itlinux-away is now known as itlinux | 21:34 | |
| *** itlinux is now known as itlinux-away | 21:35 | |
| *** itlinux-away is now known as itlinux | 21:35 | |
| *** itlinux is now known as itlinux-away | 21:35 | |
| *** itlinux-away is now known as itlinux | 22:01 | |
| *** itlinux has quit IRC | 22:02 | |
| *** r-daneel has quit IRC | 22:08 | |
| lbragstad | #endmeeting | 22:10 |
| *** openstack changes topic to "Rocky release schedule: https://releases.openstack.org/rocky/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/wmyzbFq5/keystone-rocky-roadmap !!NOTE!! This Channel is Logged ( https://tinyurl.com/OpenStackKeystone )" | 22:10 | |
| openstack | Meeting ended Tue Sep 4 22:10:37 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 22:10 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-09-04-17.10.html | 22:10 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-09-04-17.10.txt | 22:10 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-09-04-17.10.log.html | 22:10 |
| *** mchlumsky has quit IRC | 22:22 | |
| *** spartakos has joined #openstack-keystone | 22:48 | |
| *** rcernin has joined #openstack-keystone | 22:55 | |
| *** itlinux has joined #openstack-keystone | 23:04 | |
| *** itlinux is now known as itlinux-away | 23:34 | |
| *** itlinux-away is now known as itlinux | 23:50 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!