| *** stewie925 has joined #openstack-keystone | 00:21 | |
| stewie925 | hey guys i have a question/ issue about keystone roles and tenants | 00:22 |
|---|---|---|
| *** felipemonteiro has joined #openstack-keystone | 00:24 | |
| *** mbeierl has quit IRC | 00:29 | |
| lbragstad | stewie925 what's up? | 00:39 |
| stewie925 | hi lbragstad | 00:42 |
| stewie925 | let me post it in pastern and share the link - very strange | 00:42 |
| stewie925 | lbragstad: here it is : paste.openstack.org/show/730910 | 00:44 |
| lbragstad | and this is just a basic devstack installation? | 00:46 |
| stewie925 | um yeah | 00:46 |
| lbragstad | what's the outcome you're expecting? | 00:46 |
| stewie925 | Im expecting that the policy would see the role:admin under tenant admin | 00:47 |
| stewie925 | lines 3 and 4 of the log shows Checking against policy role:admin - role check result: True | 00:48 |
| stewie925 | but 5 and 6 says Checking tenant:admin - Tenant check result: False. | 00:49 |
| lbragstad | ok | 00:49 |
| lbragstad | so you have a custom policy that you're testing this against? | 00:49 |
| stewie925 | yes I do | 00:49 |
| stewie925 | let me get it | 00:50 |
| stewie925 | lbragstad: here it is : paste.openstack.org/show/730912 | 00:53 |
| lbragstad | and this with master/ | 00:54 |
| stewie925 | master? | 00:55 |
| lbragstad | what version of keystone are you using? | 00:55 |
| stewie925 | version 3 | 00:55 |
| lbragstad | ok - cool | 00:55 |
| lbragstad | what release? | 00:55 |
| stewie925 | here is my openstack role assignment list results - paste.openstack.org/show/730913 | 00:56 |
| stewie925 | sorry how do i check the release | 00:56 |
| stewie925 | I ran pip freeze and grepped keystone - it shows: keystoneauth1==2.18.0 | 00:57 |
| *** felipemonteiro has quit IRC | 00:57 | |
| lbragstad | no worries | 00:57 |
| lbragstad | you might want to try referencing project instead of tenant | 00:57 |
| stewie925 | its strange cause my other teammate ran and he passed the policy check | 00:58 |
| stewie925 | we compared notes and we did the same :( | 00:58 |
| lbragstad | strange | 00:59 |
| lbragstad | we renamed tenant -> project along time ago | 00:59 |
| stewie925 | ahhh | 00:59 |
| lbragstad | but we do have some documentation in oslo.policy that goes through how some of this works nge cause m | 00:59 |
| lbragstad | bag... bad paste | 00:59 |
| lbragstad | https://docs.openstack.org/oslo.policy/latest/admin/policy-yaml-file.html | 01:00 |
| *** mbeierl has joined #openstack-keystone | 01:01 | |
| stewie925 | lbragstad: thank you - let me check | 01:04 |
| *** wxy-xiyuan has joined #openstack-keystone | 01:05 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:23 | |
| lbragstad | #endmeeting | 01:36 |
| *** openstack changes topic to "Stein release schedule: https://releases.openstack.org/stein/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/rj0ECz2c/keystone-stein-roadmap !!NOTE!! This Channel is Logged ( https://tinyurl.com/OpenStackKeystone )" | 01:36 | |
| openstack | Meeting ended Wed Sep 26 01:36:47 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 01:36 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-09-25-17.03.html | 01:36 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-09-25-17.03.txt | 01:36 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2018/keystone_office_hours.2018-09-25-17.03.log.html | 01:36 |
| *** stewie925 has quit IRC | 01:40 | |
| *** Dinesh_Bhor has quit IRC | 02:02 | |
| *** adriant has quit IRC | 02:05 | |
| ayoung | kmalloc, how do I provider? | 02:08 |
| ayoung | I want to have the shadow_users backend call the id_generator provider | 02:08 |
| ayoung | and not hard code it | 02:08 |
| kmalloc | sec, | 02:11 |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:11 | |
| kmalloc | ayoung: you can reference the id generator at keystone.common.provider_apis.ProviderAPIs | 02:12 |
| kmalloc | see https://github.com/openstack/keystone/blob/master/keystone/identity/generator.py#L33 | 02:12 |
| kmalloc | it automatically registers the manager as a provider here with the manager code | 02:13 |
| kmalloc | https://github.com/openstack/keystone/blob/master/keystone/server/backends.py#L53 | 02:13 |
| kmalloc | so you can just call it the same as you do from the other places that use it | 02:14 |
| *** adriant has joined #openstack-keystone | 02:14 | |
| kmalloc | ayoung: it's designed to be as centralized and automatic as reasonably possible | 02:14 |
| *** adriant has quit IRC | 02:15 | |
| ayoung | kmalloc, like this | 02:15 |
| ayoung | PROVIDERS = provider_api.ProviderAPIs | 02:15 |
| ayoung | and then | 02:15 |
| ayoung | public_id = PROVIDERS.id_mapping_api.get_public_id(local_entity) | 02:16 |
| kmalloc | yep | 02:17 |
| kmalloc | that is it | 02:17 |
| ayoung | tests fail like this | 02:17 |
| *** adriant has joined #openstack-keystone | 02:17 | |
| ayoung | holdon type | 02:17 |
| ayoung | typo | 02:17 |
| ayoung | I think I need some sort of setup in the tests | 02:19 |
| kmalloc | the restful testcase should stand up the providers | 02:19 |
| kmalloc | but if you're doing it in isolation, yes you'll need to do the backends.setup | 02:19 |
| kmalloc | etc | 02:19 |
| kmalloc | keystone.server.backends bit | 02:19 |
| kmalloc | (and cleanup) | 02:19 |
| ayoung | kmalloc, is this the norm? https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_shadow_users.py#L51 | 02:22 |
| kmalloc | i... i think that is the norm | 02:23 |
| ayoung | so I am running tox -e py35 -- keystone.tests.unit.test_shadow_users | 02:23 |
| ayoung | and that looks like it should be setting up the providers | 02:23 |
| kmalloc | it looks like it should | 02:24 |
| kmalloc | what is the issue you're seeing? | 02:24 |
| ayoung | no userid generated | 02:24 |
| ayoung | I think it is getting a None or something like that | 02:24 |
| kmalloc | i'll bet we're doing something stupid in the id generator | 02:24 |
| kmalloc | sec | 02:24 |
| ayoung | b"sqlalchemy.exc.SAWarning: Column 'user.id' is marked as a member of the primary key for table 'user', but has no Python-side or server-side default generator indicated, nor does it indicate 'autoincrement=True' or 'nullable=True', and no explicit value is passed. Primary key columns typically may not store NULL." | 02:25 |
| kmalloc | like... 99% sure we are | 02:25 |
| kmalloc | yep | 02:26 |
| kmalloc | https://github.com/openstack/keystone/blob/master/keystone/identity/mapping_backends/sql.py#L55 | 02:26 |
| kmalloc | so basically you're getting a None because nothing was created | 02:26 |
| kmalloc | or well... nothing was created that a "get" works on | 02:27 |
| kmalloc | ayoung: oh wait | 02:27 |
| kmalloc | ayoung: are you using .get_public_id? | 02:27 |
| kmalloc | ayoung: because... creation is explicit and create will return the id if it exists | 02:28 |
| ayoung | yes | 02:28 |
| kmalloc | the simplest solution is to always call create, unless you *know* you need to do a get | 02:28 |
| kmalloc | so a get doesn't create the record | 02:28 |
| kmalloc | ah | 02:28 |
| kmalloc | and you are doing a generate explicitly. | 02:29 |
| kmalloc | i think? | 02:29 |
| kmalloc | is the code posted / in a paste so i can see? | 02:29 |
| ayoung | public_id = PROVIDERS.id_generator_api.generate_public_ID(local_entity) | 02:30 |
| ayoung | That worked | 02:30 |
| kmalloc | right | 02:30 |
| kmalloc | and it should | 02:30 |
| ayoung | yeah, I was calling the wrong provider | 02:30 |
| kmalloc | aha | 02:31 |
| kmalloc | :) | 02:31 |
| ayoung | we don't want the mapped backend | 02:31 |
| kmalloc | well then. | 02:31 |
| *** adriant has quit IRC | 02:31 | |
| kmalloc | yeah that'll do it | 02:31 |
| ayoung | that seems like, well, a lot of code there | 02:31 |
| kmalloc | yes. and it should be ... minimized/cleaned up | 02:31 |
| kmalloc | i think we can ultimately remove that pivot point and eliminate the "mapped" bit | 02:31 |
| kmalloc | and just use a known hashing mechanism | 02:31 |
| ayoung | well, there is the likelihood that someone is still running the LDAP backend, and not SQL | 02:31 |
| ayoung | and thus need that code to munge their user data if they do go to sql, right? | 02:32 |
| kmalloc | yes and a "id alias" mechanism | 02:32 |
| kmalloc | so old ldap DN (bad) ids work still | 02:32 |
| ayoung | like, that whole "old style userids" from LDAP-does-cname dumbness that I wrote | 02:32 |
| kmalloc | yeh | 02:32 |
| kmalloc | but doable | 02:32 |
| kmalloc | wouldn't be too terrible | 02:33 |
| kmalloc | we can revisit that cleanup soon(ish)( | 02:33 |
| ayoung | OK, I'll have an updated patch here shortly | 02:35 |
| ayoung | running the tests, but Zuul seems to be stuck | 02:35 |
| openstackgerrit | ayoung proposed openstack/keystone master: Replace UUID with id_generator for Federated users https://review.openstack.org/605169 | 02:41 |
| ayoung | that should look a little better | 02:42 |
| kmalloc | =/ | 02:42 |
| openstackgerrit | Vishakha Agarwal proposed openstack/python-keystoneclient master: create() call in v3.regions.py is wrong https://review.openstack.org/594921 | 02:42 |
| kmalloc | for the stuck zuul | 02:42 |
| kmalloc | ayoung: looks good, needs a release note, and an in-line comment that would be nice to have a TODO/comment regarding the "this is an exception to the 'don't call providers from drivers'" general rule. | 02:47 |
| kmalloc | ayoung: but as long as things aren't broken test wise, this is a good direction forward. | 02:48 |
| *** imacdonn has quit IRC | 02:50 | |
| *** imacdonn has joined #openstack-keystone | 02:50 | |
| *** felipemonteiro has joined #openstack-keystone | 03:02 | |
| *** adriant has joined #openstack-keystone | 03:07 | |
| ayoung | kmalloc, Thanks. | 03:09 |
| *** felipemonteiro has quit IRC | 03:19 | |
| *** dave-mccowan has joined #openstack-keystone | 03:46 | |
| *** itlinux has joined #openstack-keystone | 03:56 | |
| *** felipemonteiro has joined #openstack-keystone | 04:06 | |
| *** pcaruana has joined #openstack-keystone | 04:14 | |
| *** shyamb has joined #openstack-keystone | 04:26 | |
| *** shyamb has quit IRC | 04:31 | |
| *** shyamb has joined #openstack-keystone | 04:34 | |
| *** pcaruana has quit IRC | 04:38 | |
| *** Dinesh_Bhor has quit IRC | 04:47 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:54 | |
| vishakha | wxy-xiyuan: HI, For Patch https://review.openstack.org/#/c/603539/ | 04:59 |
| vishakha | wxy-xiyuan: Facing some error with python3. http://logs.openstack.org/39/603539/5/check/openstack-tox-py36/e81c9fc/testr_results.html.gz | 05:00 |
| *** shyamb has quit IRC | 05:28 | |
| *** shyamb has joined #openstack-keystone | 05:36 | |
| *** dave-mccowan has quit IRC | 05:39 | |
| *** mbeierl has quit IRC | 05:43 | |
| *** pcaruana has joined #openstack-keystone | 05:43 | |
| *** felipemonteiro has quit IRC | 05:50 | |
| *** jistr has quit IRC | 05:55 | |
| *** jistr has joined #openstack-keystone | 05:56 | |
| *** blake has joined #openstack-keystone | 06:08 | |
| *** shyamb has quit IRC | 06:09 | |
| *** shyamb has joined #openstack-keystone | 06:11 | |
| wxy-xiyuan | vishakha: looking. | 06:35 |
| *** shyamb has quit IRC | 06:38 | |
| *** blake has quit IRC | 06:39 | |
| *** blake has joined #openstack-keystone | 06:40 | |
| *** qinglin has joined #openstack-keystone | 06:43 | |
| *** blake has quit IRC | 06:45 | |
| *** shyamb has joined #openstack-keystone | 06:58 | |
| *** rcernin has quit IRC | 07:02 | |
| *** qinglin has quit IRC | 07:03 | |
| *** Dinesh_Bhor has quit IRC | 07:15 | |
| wxy-xiyuan | vishakha: "open" is different between py2 and py3. jsonutils.load can't work with "open" in py3 by default. https://github.com/openstack/keystone/blob/master/keystone/cmd/cli.py#L1022 | 07:24 |
| wxy-xiyuan | change this line to: with open(path, "rb") as file: | 07:25 |
| *** shyamb has quit IRC | 07:29 | |
| *** shyamb has joined #openstack-keystone | 07:35 | |
| *** shyamb has quit IRC | 07:45 | |
| *** rcernin has joined #openstack-keystone | 07:56 | |
| vishakha | wxy-xiyuan:ok. thanks | 07:58 |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:58 | |
| *** Emine has joined #openstack-keystone | 08:17 | |
| *** shyamb has joined #openstack-keystone | 08:26 | |
| *** jistr has quit IRC | 08:30 | |
| *** jistr has joined #openstack-keystone | 08:31 | |
| *** Dinesh_Bhor has quit IRC | 09:03 | |
| *** rcernin has quit IRC | 09:16 | |
| *** a-pugachev has joined #openstack-keystone | 09:18 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 09:28 | |
| *** shyamb has quit IRC | 09:51 | |
| *** shyamb has joined #openstack-keystone | 10:04 | |
| *** Dinesh_Bhor has quit IRC | 10:10 | |
| *** shyamb has quit IRC | 10:16 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 10:16 | |
| *** Dinesh_Bhor has quit IRC | 10:18 | |
| *** felipemonteiro has joined #openstack-keystone | 10:49 | |
| *** shyamb has joined #openstack-keystone | 10:55 | |
| *** felipemonteiro has quit IRC | 10:56 | |
| *** pcaruana has quit IRC | 11:15 | |
| *** pooja-jadhav is now known as pooja_jadhav | 11:33 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add python3 functional test job https://review.openstack.org/605403 | 11:39 |
| *** raildo has joined #openstack-keystone | 11:51 | |
| *** shyamb has quit IRC | 11:55 | |
| *** shyamb has joined #openstack-keystone | 12:00 | |
| *** aojea_ has joined #openstack-keystone | 12:29 | |
| *** blake has joined #openstack-keystone | 12:42 | |
| *** blake has quit IRC | 12:47 | |
| *** shyamb has quit IRC | 12:49 | |
| *** mbeierl has joined #openstack-keystone | 13:09 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Adding test case for MappingEngineTester https://review.openstack.org/603539 | 13:20 |
| ayoung | vishakha, when submitting a patch, it helps to add reviewers | 13:36 |
| ayoung | you can always add me | 13:36 |
| vishakha | ayoung: Thanks. I will take care of this from next time. | 13:37 |
| ayoung | vishakha, why did you need to change the code-under-test as well as adding the test? | 13:37 |
| vishakha | ayoung: also added you. | 13:37 |
| vishakha | ayoung: this class mappingtestengine was not having any unit test cases. Thus added those. | 13:38 |
| ayoung | I like what you have so far. I think we need to talk about what we should actually be checking. This test is good, in that it ensures the code runs without raising an exception, but we also should be looking at correctness | 13:38 |
| ayoung | I think I filed that bug... | 13:39 |
| ayoung | https://bugs.launchpad.net/keystone/+bug/1782197 :) | 13:39 |
| openstack | Launchpad bug 1782197 in OpenStack Identity (keystone) "Mapping Engine Tester is untested" [Medium,In progress] - Assigned to Vishakha Agarwal (vishakha.agarwal) | 13:39 |
| ayoung | And thank you for taking it | 13:39 |
| vishakha | ayoung: thanks for the appreciation | 13:39 |
| ayoung | vishakha, I assume you needed to change the CLI code to make it testable. Is that right? | 13:40 |
| ayoung | with open(path, "rb") | 13:40 |
| ayoung | and | 13:40 |
| ayoung | assertion = self.assertion.splitlines() | 13:40 |
| vishakha | ayoung: It wasn't compatible with pythonn3. | 13:41 |
| ayoung | vishakha, excellent. Can you add that to the commit message? It is a big point | 13:41 |
| vishakha | ayoung: yes sure. I will update commit message | 13:41 |
| ayoung | vishakha, what is with the file writing in the test itself? Was that just for debugging? | 13:43 |
| ayoung | file = os.path.join(temp_dir.path, 'sample1.txt') | 13:43 |
| ayoung | with open(file, 'w') as f: | 13:43 |
| ayoung | f.write("\n") | 13:43 |
| ayoung | f.write("UserName: me\n") | 13:43 |
| ayoung | f.write("Email: me@example.com;you@example.com\n") | 13:43 |
| vishakha | ayoung: yes just the sample file input | 13:43 |
| vishakha | ayoung: to ensue mapping is happening | 13:44 |
| vishakha | *ensure | 13:44 |
| ayoung | vishakha, in the future, you can use pdb instead | 13:44 |
| ayoung | or rpdb if necessary | 13:44 |
| ayoung | Oh, wait | 13:45 |
| *** lbragstad has quit IRC | 13:45 | |
| ayoung | so, no, that is not just for debugging. The CLI needs to read an actual file... | 13:45 |
| vishakha | ayoung: yes cli reads an actal file | 13:46 |
| *** lbragstad has joined #openstack-keystone | 13:50 | |
| *** ChanServ sets mode: +o lbragstad | 13:50 | |
| ayoung | vishakha, good start. Let me know if you have questions on my review comments. | 13:50 |
| vishakha | ayoung: sure. Let me check the comments. | 13:50 |
| vishakha | ayoung: I understood the comments. will get back to you after a patch update | 13:52 |
| vishakha | ayoung: thanks | 13:53 |
| ayoung | vishakha, thank you. I think you are going to be a very valuable contributor moving forward. Glad to have you aboard. | 13:53 |
| cmurphy | +1 | 13:53 |
| vishakha | ayoung, cmurphy Glad too :) | 13:54 |
| lbragstad | ++ | 13:57 |
| ayoung | lbragstad, I'm going open bugs for the features I am working on. It will give us something to track, but lighter than specs | 13:59 |
| ayoung | feel free to tag them as wishlist | 14:00 |
| ayoung | or I will | 14:00 |
| openstackgerrit | ayoung proposed openstack/keystone master: Replace UUID with id_generator for Federated users https://review.openstack.org/605169 | 14:09 |
| openstackgerrit | ayoung proposed openstack/keystone master: Allow an explicit_domain_id parameter when creating a domain https://review.openstack.org/605235 | 14:15 |
| openstackgerrit | ayoung proposed openstack/keystone master: Replace UUID with id_generator for Federated users https://review.openstack.org/605169 | 14:18 |
| ayoung | cmurphy, thanks for the catch. I updated the bug references | 14:20 |
| cmurphy | ayoung: np | 14:20 |
| cmurphy | i happened to be scanning the bug list this afternoon and noticed that was familiar | 14:21 |
| ayoung | I added Steve Martinelli to the review just for nostalgia. | 14:22 |
| cmurphy | haha :'( | 14:22 |
| lbragstad | https://twitter.com/CorinBragstad/status/1040406889845145600 | 14:30 |
| lbragstad | make it so - please make it so | 14:31 |
| ayoung | lbragstad, "Dad in a month" was posted about 2 weeks ago. You in the "any day now" mode? | 14:36 |
| lbragstad | i'm on pins and needles... | 14:37 |
| lbragstad | if that's what you're asking :) | 14:37 |
| ayoung | lbragstad, best of luck. It is a magical time. You do the best code reviews when sleep deprived. | 14:37 |
| lbragstad | apparently, our doctor said that she wouldn't be surprise if we went this week | 14:38 |
| * lbragstad has been shopping for coffee subscriptions | 14:38 | |
| lbragstad | hrybacki do you use apple music? | 14:45 |
| hrybacki | lbragstad: no -- I'm a 'Google Play' kinda guy | 14:46 |
| lbragstad | ahh | 14:46 |
| cmurphy | google play ftw | 14:48 |
| cmurphy | https://review.openstack.org/602452 is ready to go, i checked it's running the right tests | 14:54 |
| cmurphy | gagehugo: ^ | 14:57 |
| *** pcaruana has joined #openstack-keystone | 15:01 | |
| ayoung | kmalloc, you awake yet? | 15:17 |
| ayoung | hrybacki, https://bugs.launchpad.net/keystone/+bug/1794552 thanks | 15:23 |
| openstack | Launchpad bug 1794552 in OpenStack Identity (keystone) "Flaskification broke ECP" [Undecided,New] - Assigned to Morgan Fainberg (mdrnstm) | 15:23 |
| lbragstad | ayoung i think kmalloc's schedule is going to be hit or miss this week | 15:23 |
| ayoung | knikolla, I think your federation integration tests just showed a real error. ^^ | 15:23 |
| hrybacki | thanks ayoung -- and thanks knikolla :) | 15:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement scope_type checking for credentials https://review.openstack.org/594547 | 15:29 |
| ayoung | hrybacki, it is probably a Python 3 specific issue. I wonder if we could trigger that from a unit test | 15:35 |
| kmalloc | ayoung: I am, but doctor appointment | 15:35 |
| ayoung | Good luck | 15:35 |
| kmalloc | I'll be around later today | 15:36 |
| kmalloc | And I will be out most of Friday | 15:36 |
| kmalloc | Tomorrow is pretty much down time. This week has been really busy. | 15:36 |
| aning | cmurphy: A very detailed question, in my ECP SP setup, I do an openstack --debug ... image list, it works. But in the screen log show a GET request that seems to return a unscoped token. Is this correct? | 15:37 |
| aning | cmurphy: http://devstack-sp2.wrs.com:80 "GET /identity/v3/OS-FEDERATION/identity_providers/testidp/protocols/saml2/auth HTTP/1.1" 201 442 | 15:37 |
| aning | RESP: [201] Connection: close Content-Length: 442 Content-Type: application/json Date: Wed, 26 Sep 2018 15:22:40 GMT Server: Apache/2.4.18 (Ubuntu) Vary: X-Auth-Token X-Subject-Token: {SHA1}c0d3d8be1a0d9286e454ab556e44f8b4867c4eb6 x-openstack-request-id: req-67f0792b-5d37-46b5-ba3f-f2fd81dd85cf | 15:37 |
| aning | RESP BODY: {"token": {"issued_at": "2018-09-26T15:22:40.000000Z", "audit_ids": ["HkfdmqGtRzulbbaEzsMchw"], "methods": ["saml2"], "expires_at": "2018-09-26T16:22:40.000000Z", "user": {"OS-FEDERATION": {"identity_provider": {"id": "testidp"}, "protocol": {"id": "saml2"}, "groups": [{"id": "b50d76b5767646f18ad1bb8b9fec293c"}]}, "domain": {"id": "Federated", "name": "Federated"}, "id": "bc7be976bb8e4d8a986f67bb711fa372", "name": "myself@testshib.org" | 15:37 |
| aning | }}} | 15:37 |
| aning | GET call to http://devstack-sp2.wrs.com/identity/v3/OS-FEDERATION/identity_providers/testidp/protocols/saml2/auth used request id req-67f0792b-5d37-46b5-ba3f-f2fd81dd85cf | 15:37 |
| kmalloc | ayoung: I've been battling federation stuff in flask because a) the test is somewhat flakey, and b) not voting. | 15:37 |
| ayoung | kmalloc, does that bug report help? | 15:38 |
| kmalloc | Sure. Mostly I'll be looking at our integration tests as well | 15:38 |
| ayoung | {"self": "http://149.202.181.254/identity/v3/OS-FEDERATION/identity_providers/<string:idp_id>/protocols/mapped", | 15:38 |
| kmalloc | Unit tests are hard for this. | 15:38 |
| cmurphy | aning: best to use http://paste.openstack.org/ to paste debug output | 15:38 |
| kmalloc | If it is just a link issue | 15:38 |
| kmalloc | Links are a Trainwreck in keystone. | 15:39 |
| kmalloc | That is easy to fix. | 15:39 |
| ayoung | aning, yes a federated token probably should be unscoped, and then converted to a scoped token | 15:39 |
| cmurphy | aning: i think that's correct, authing with federation is slightly roundabout because you have to request an unscoped token to auth and then use that to request a scoped token to authz | 15:39 |
| kmalloc | ayoung: I'll get on that bug once I am home. | 15:40 |
| aning | I've never know we could use a GET to request a token ... We always get a token (unscoped or scoped) with POST ... | 15:41 |
| cmurphy | aning: it works because that auth endpoint is protected by the apache sp mod, apache will require you to go through the auth process before it lets you through to keystone | 15:43 |
| aning | cmurphy: I've pasted the log snapshot of the first few steps in the request at http://paste.openstack.org/show/730951/ | 15:44 |
| *** dklyle has joined #openstack-keystone | 15:45 | |
| aning | So it's a GET->POST->POST->GET, the last GET returns a unscoped token. | 15:45 |
| aning | cmurphy: do you see anything that is incorrect there? | 15:47 |
| cmurphy | aning: sorry i'm in another meeting, let me look in a few minutes | 15:48 |
| aning | cmurphy: oh sorry for that ... | 15:48 |
| cmurphy | aning: but if it works i wouldn't be too suspicious of it ;) | 15:48 |
| aning | cmurphy: yeah, I just cruious of the messaging flow ... | 15:49 |
| *** aojea_ has quit IRC | 15:55 | |
| *** eglute has joined #openstack-keystone | 15:56 | |
| *** aojea has joined #openstack-keystone | 15:56 | |
| *** dave-mccowan has joined #openstack-keystone | 16:00 | |
| cmurphy | aning: that looks right to me, it has to try to GET the auth endpoint to initiate the process, then goes to the idp to auth, then comes back to the sp with the saml response and then finally gets a token | 16:07 |
| *** blake has joined #openstack-keystone | 16:09 | |
| aning | cmurphy: Thanks! | 16:10 |
| *** Emine has quit IRC | 16:16 | |
| *** a-pugachev has quit IRC | 16:23 | |
| *** blake has quit IRC | 16:28 | |
| *** blake has joined #openstack-keystone | 16:28 | |
| *** blake has quit IRC | 16:29 | |
| *** dave-mccowan has quit IRC | 16:49 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system reader role in domains API https://review.openstack.org/605485 | 16:49 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Make policy file support in fixture optional https://review.openstack.org/595279 | 17:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move loadapp to a generic place https://review.openstack.org/595371 | 17:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add test case for expanding implied roles in system tokens https://review.openstack.org/596356 | 17:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Expand implied roles in system-scoped tokens https://review.openstack.org/596357 | 17:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Loosen the assertion for logging scope type warnings https://review.openstack.org/597186 | 17:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement scope_type checking for credentials https://review.openstack.org/594547 | 17:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove obsolete credential policies https://review.openstack.org/597187 | 17:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system reader role in domains API https://review.openstack.org/605485 | 17:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update auto-provisioning example to use reader https://review.openstack.org/605496 | 17:57 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Convert legacy functional jobs to Zuul-v3-native https://review.openstack.org/602452 | 18:10 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add python3 functional test job https://review.openstack.org/605403 | 18:10 |
| *** pcaruana has quit IRC | 18:24 | |
| *** lbragstad has quit IRC | 18:24 | |
| *** lbragstad has joined #openstack-keystone | 18:25 | |
| *** ChanServ sets mode: +o lbragstad | 18:25 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Enable Foreign keys for sql backend unit test https://review.openstack.org/558029 | 18:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Enable foreign keys for unit test https://review.openstack.org/558193 | 18:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Make policy file support in fixture optional https://review.openstack.org/595279 | 18:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move loadapp to a generic place https://review.openstack.org/595371 | 18:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add test case for expanding implied roles in system tokens https://review.openstack.org/596356 | 18:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Expand implied roles in system-scoped tokens https://review.openstack.org/596357 | 18:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Loosen the assertion for logging scope type warnings https://review.openstack.org/597186 | 18:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement scope_type checking for credentials https://review.openstack.org/594547 | 18:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove obsolete credential policies https://review.openstack.org/597187 | 18:34 |
| hrybacki | dang lbragstad | 18:58 |
| hrybacki | you have like 60 fingers or something? | 18:59 |
| openstackgerrit | Jim Rollenhagen proposed openstack/keystone master: Fix command to verify role removal in docs https://review.openstack.org/605509 | 19:03 |
| jroll | ^ super easy one :) | 19:03 |
| *** dave-mccowan has joined #openstack-keystone | 19:05 | |
| lbragstad | i only need ~5 to type `git review -x` | 19:07 |
| hrybacki | lol | 19:09 |
| openstackgerrit | ayoung proposed openstack/keystone-specs master: Federated Query APIs https://review.openstack.org/313604 | 19:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system reader role in domains API https://review.openstack.org/605485 | 19:18 |
| *** Emine has joined #openstack-keystone | 19:26 | |
| *** jdennis has quit IRC | 19:41 | |
| cmurphy | https://cloudblog.switch.ch/2018/09/26/enable-keystone-federated-users-to-use-cli-tools-with-application-credentials/ | 19:54 |
| openstackgerrit | ayoung proposed openstack/keystone-specs master: Federated Query APIs https://review.openstack.org/313604 | 19:54 |
| ayoung | cmurphy, thanks for posting that | 19:55 |
| lbragstad | cmurphy nice! | 19:56 |
| kmalloc | ayoung: app-creds should work in KSM as long as we tell KSM to use the app-cred auth plugin | 19:58 |
| kmalloc | ayoung: so, looks like the change is simply needed in triple-o | 19:59 |
| kmalloc | yay for KSM being not terrible. | 19:59 |
| *** bnemec has quit IRC | 20:10 | |
| *** evrardjp has joined #openstack-keystone | 20:11 | |
| *** jdennis has joined #openstack-keystone | 20:13 | |
| *** bnemec has joined #openstack-keystone | 20:15 | |
| *** raildo has quit IRC | 20:36 | |
| *** aojea has quit IRC | 21:01 | |
| kmalloc | ayoung: i should (shortly) have a fix for that fed bug | 21:27 |
| *** blake has joined #openstack-keystone | 21:29 | |
| ayoung | kmalloc, excellent. If we get those tests green, we should consider making them voting | 21:31 |
| openstackgerrit | ayoung proposed openstack/keystone master: Added keystone identity provider installation to Devstack plugin https://review.openstack.org/484121 | 21:34 |
| ayoung | kmalloc, can we do openstackid for openidc Federation testing? | 21:35 |
| kmalloc | well not really | 21:38 |
| kmalloc | anything we do needs to not be external. | 21:38 |
| kmalloc | basically we need to standup a provider for the test case and use that | 21:38 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system reader role in domains API https://review.openstack.org/605485 | 21:38 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Pass context objects to policy enforcement https://review.openstack.org/605539 | 21:38 |
| kmalloc | if it is an external service we run the risk of breaking the tests because external service is down | 21:38 |
| lbragstad | ^ kmalloc curious if you have thoughts on using oslo.context directly there | 21:40 |
| *** dklyle has quit IRC | 22:02 | |
| kmalloc | hmm | 22:05 |
| lbragstad | that patch is going to fail tests | 22:19 |
| lbragstad | but | 22:19 |
| lbragstad | the idea would be to try and set a precedence for how we can do enforcement uniformly across projects | 22:19 |
| lbragstad | 1. use requests objects to build an instance of RequestContext 2.) pass that to oslo.policy for enforcement | 22:20 |
| kmalloc | i'm fine with that change | 22:21 |
| kmalloc | i'd do it as a two step | 22:21 |
| kmalloc | 1) enhance oslo.policy to allow for context to be passed (optionally) instead of creds. | 22:21 |
| kmalloc | 2) fix RBACEnforcer to do so | 22:22 |
| lbragstad | https://review.openstack.org/#/c/578995/ | 22:22 |
| kmalloc | now that is the auth context not just the oslo-context. | 22:22 |
| kmalloc | so, you're going to have to do some hoop jumping in keystone to have a common place for auth context data to live | 22:23 |
| kmalloc | right now it's something we've implemented on top of everything else | 22:23 |
| lbragstad | https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L804-L806 | 22:23 |
| lbragstad | yeah - we also do this weird thing where we put the entire token reference in the creds dictionary | 22:23 |
| kmalloc | yep. | 22:24 |
| kmalloc | which is broken | 22:24 |
| kmalloc | we also do wonky things with the subject token | 22:24 |
| kmalloc | *sigh* Synergy doesn't work with Wayland =/ | 22:25 |
| kmalloc | that makes my workflow less "fun" | 22:25 |
| lbragstad | you mean the app that lets you use the same peripheral devices across computers on the same network? | 22:25 |
| kmalloc | yep | 22:25 |
| lbragstad | nice | 22:26 |
| kmalloc | i was going to run it for my workstation. but workstation uses Wayland | 22:26 |
| kmalloc | so synergy is... broken. | 22:26 |
| kmalloc | the mouse pointer doesn't actually render moved | 22:27 |
| kmalloc | but the pointer location does move | 22:27 |
| kmalloc | and they moved to a pay-for-software model :( | 22:27 |
| kmalloc | it's annoying | 22:27 |
| lbragstad | wayland did? | 22:27 |
| kmalloc | no synergy | 22:27 |
| kmalloc | wayland replaces xorg | 22:27 |
| lbragstad | oh | 22:30 |
| * lbragstad just read the wayland faq | 22:30 | |
| kmalloc | it's the new tech | 22:30 |
| kmalloc | hehe | 22:30 |
| kmalloc | yeah | 22:30 |
| kmalloc | wayland is good stuff | 22:30 |
| lbragstad | interesting | 22:30 |
| lbragstad | so - i wonder if we can rewrite policies that rely on tokens for comparisons | 22:31 |
| lbragstad | or rely on them in the check strings, specifically | 22:31 |
| kmalloc | sooooooo | 22:31 |
| kmalloc | this is where our policy DSL is... not so great | 22:31 |
| kmalloc | because remember everything before the : is a direct lookup in the creds dict | 22:32 |
| lbragstad | which : | 22:32 |
| kmalloc | example: "user_id:%(user_id)s | 22:32 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/common/policies/base.py#L23 | 22:32 |
| lbragstad | oh - sure | 22:33 |
| lbragstad | ok | 22:33 |
| kmalloc | that means compare creds['user_id'] with '%(user_id)s' % target_dict | 22:33 |
| kmalloc | the reason for the whole token ref living in creds is because of silly things we used to do | 22:33 |
| lbragstad | yeah - so token.project.domain.id it ultimately a check string that has been hardcoded to the api contract for v3 tokens | 22:34 |
| kmalloc | yep | 22:34 |
| lbragstad | when - correct me if i'm wrong | 22:34 |
| lbragstad | we really should have just made that a hardcoded check as business logic? | 22:34 |
| kmalloc | maybe | 22:34 |
| lbragstad | or - i suppose we could do | 22:35 |
| kmalloc | more likely, that should have been 'project.domain_id' and the creds should represent that if it exists | 22:35 |
| lbragstad | ^ that | 22:35 |
| kmalloc | the token values should be exploded out | 22:35 |
| lbragstad | yes | 22:35 |
| kmalloc | *also* we should be able to take action on the target dict without needing a representation in creds | 22:35 |
| *** rcernin has joined #openstack-keystone | 22:35 | |
| kmalloc | aka a way to say execute function instead of lookup creds() | 22:35 |
| kmalloc | creds[XXX]* | 22:35 |
| kmalloc | right now there is never a way to act on data in the target dict without having a mirrored representation in the creds dict | 22:36 |
| lbragstad | these usecases are going to make it harder to use context objects in policy enforcement | 22:37 |
| kmalloc | now, i could be clever and build a creds dict | 22:37 |
| kmalloc | with extra data | 22:37 |
| kmalloc | but ... thats painful | 22:37 |
| lbragstad | yeah - and every service has to do it | 22:37 |
| kmalloc | being able to say something like 'exists():%{query_param_name)s | 22:38 |
| kmalloc | could be usefil | 22:38 |
| kmalloc | useful | 22:38 |
| kmalloc | aka, require a filteron an api for a specific user | 22:38 |
| kmalloc | no "listing all projects" | 22:38 |
| lbragstad | the whole idea behind making policy understand context objects was to make it easier for services to offload building creds dictionaries (and possibly making mistakes with the information they provide) | 22:38 |
| kmalloc | exactly | 22:38 |
| kmalloc | i think the real answer is to extract out the RBACEnforcer into it's own lib or to oslo.policy | 22:39 |
| kmalloc | and allow for an override of where to pull creds data | 22:39 |
| kmalloc | so keystone uses flask | 22:39 |
| lbragstad | hmmm | 22:39 |
| kmalloc | nova might pull from oslo_context[known_location] | 22:39 |
| kmalloc | we'll need to firm up some of the contract assumptions i made about flask to more generic | 22:40 |
| kmalloc | but ultimately doable | 22:40 |
| lbragstad | so - oslo.policy just calls the to_policy_values() method on context objects if it gets one | 22:41 |
| kmalloc | because ultimately, services want to do "EnforceCall(action_name, creds, target) | 22:41 |
| kmalloc | and that is the extent | 22:41 |
| kmalloc | pretty much. | 22:42 |
| lbragstad | if we supply additional things on context objects, we'll need to make oslo.policy smarter about handling that? | 22:42 |
| kmalloc | make a helper method that the RBACEnforcer can lean on | 22:42 |
| kmalloc | basically "pull things from here" or "do something totally wacky" | 22:42 |
| kmalloc | it could be as simple as lambda x: flask.request.args[x] | 22:43 |
| kmalloc | it might be complex like "build a creds dict that pulls from all over the place" | 22:43 |
| kmalloc | but bake the default case down to very simple: get oslo_context and to_policy_values (naive data extraction) | 22:44 |
| lbragstad | or... | 22:45 |
| lbragstad | we subclass oslo.context | 22:45 |
| lbragstad | specifically the RequestContext object | 22:45 |
| lbragstad | we *could* override to_policy_values to be smarter about keystone specific things | 22:45 |
| kmalloc | just as long as we're careful that it's not Webob specific | 22:45 |
| kmalloc | some things are very webob specific | 22:46 |
| kmalloc | requestcontext might be safe | 22:46 |
| lbragstad | using the subclassing in oslo.context is safe you mean? | 22:46 |
| kmalloc | yeah it probably isn't a webob specific thing | 22:46 |
| lbragstad | yeah - it might make it so we don't have to make changes to oslo.policy | 22:46 |
| lbragstad | it just calls context_obj.to_policy_values() | 22:47 |
| lbragstad | and if its an instance of keystone.common.context.RequestContext, it'll get populated with things we need it to for policy enforcement | 22:47 |
| lbragstad | if oslo.policy just gets a plain old oslo_context.context.RequestContext, it calls the same method and gets generic policy values | 22:48 |
| ayoung | Whew | 22:53 |
| ayoung | I just caught up on that | 22:53 |
| *** rcernin has quit IRC | 22:53 | |
| lbragstad | :) | 22:54 |
| *** rcernin has joined #openstack-keystone | 22:55 | |
| lbragstad | it's interesting, i'll play with it in https://review.openstack.org/#/c/605539/1 and see if i can make it work | 22:55 |
| * lbragstad steps away for a bit | 22:55 | |
| ayoung | I thinkg exists() should be implied. If you do a test, and the variable does not exist, it fails | 22:56 |
| ayoung | and not in a Raise an exception sort of way | 22:56 |
| ayoung | so if you need an alternative, you do an "or" | 22:56 |
| kmalloc | that would the requirement | 22:56 |
| kmalloc | it would fail enforcement, 403 | 22:56 |
| kmalloc | explicitly exists means it *must* exist and must have a value | 22:57 |
| kmalloc | though the policy DSL would be easy to screw up | 22:57 |
| kmalloc | since the value after the colon in the DSL is literal | 22:57 |
| kmalloc | so `exists():Blah` would be success | 22:57 |
| kmalloc | but `exists():%(user_id)s` may fail | 22:58 |
| kmalloc | so i think there needs to be a re-thinking | 22:58 |
| *** blake_ has joined #openstack-keystone | 23:02 | |
| kmalloc | or allow the value before the colon to also (in some cases) reference the target dict | 23:03 |
| kmalloc | target_lookup(xxx):<value> | 23:03 |
| kmalloc | and the second half would be exists() or notexists() | 23:03 |
| kmalloc | etc | 23:03 |
| *** blake has quit IRC | 23:05 | |
| jamielennox | to_policy_values was always designed to be overriden with service specific variables | 23:07 |
| jamielennox | what was in the common was just what made sense everywhere - and in a lot of cases there wasn't anything else to check | 23:07 |
| jamielennox | but yea, ideally name it something rather than just drop a webob object in there, those policy values are a stable interface | 23:08 |
| *** mbeierl has quit IRC | 23:08 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add build_target arguement to enforcer https://review.openstack.org/601881 | 23:11 |
| jamielennox | eh - i read up for more context - you've got all this | 23:12 |
| kmalloc | hehe | 23:20 |
| *** jlvillal has joined #openstack-keystone | 23:24 | |
| *** dklyle has joined #openstack-keystone | 23:26 | |
| *** blake_ has quit IRC | 23:26 | |
| *** rcernin_ has joined #openstack-keystone | 23:41 | |
| *** blake has joined #openstack-keystone | 23:41 | |
| *** rcernin has quit IRC | 23:43 | |
| *** blake has quit IRC | 23:45 | |
| *** openstackgerrit has quit IRC | 23:49 | |
| *** blake has joined #openstack-keystone | 23:55 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!