| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Avoid using dict.get() in assertions https://review.openstack.org/607463 | 00:12 |
|---|---|---|
| *** pooja_jadhav has quit IRC | 00:17 | |
| vishakha | kmalloc : Ok. I think I should wait for the controller to be removed then. Thanks. | 00:23 |
| *** rcernin has quit IRC | 00:27 | |
| *** rcernin has joined #openstack-keystone | 00:29 | |
| *** pooja_jadhav has joined #openstack-keystone | 00:29 | |
| kmalloc | vishakha: might be easier | 00:35 |
| *** devx has quit IRC | 00:52 | |
| *** tbharath has joined #openstack-keystone | 01:03 | |
| tbharath | kmalloc, Hi | 01:03 |
| kmalloc | tbharath: hello | 01:05 |
| tbharath | am novice in ssl area. If I want to make openstack SSL based, is it enough to make keystone alone https or we have to make all services https based? | 01:05 |
| kmalloc | i recommend TLS for all services | 01:05 |
| kmalloc | the use of bearer tokens means that if someone can sniff the traffic, the could collect and use your token to perform actions on your behalf | 01:06 |
| kmalloc | SSL/TLS for everything is the best bet. | 01:06 |
| tbharath | okay ... is there a documentation to make Queens setup TLS based? | 01:07 |
| *** dave-mccowan has quit IRC | 01:16 | |
| *** tbharath has quit IRC | 01:17 | |
| *** felipemonteiro has joined #openstack-keystone | 01:20 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:23 | |
| *** felipemonteiro has quit IRC | 01:36 | |
| *** felipemonteiro has joined #openstack-keystone | 01:36 | |
| *** Dinesh_Bhor has quit IRC | 01:41 | |
| *** edmondsw has joined #openstack-keystone | 01:45 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:49 | |
| *** gyee has quit IRC | 02:01 | |
| *** itlinux has joined #openstack-keystone | 02:05 | |
| *** felipemonteiro has quit IRC | 02:17 | |
| *** devx has joined #openstack-keystone | 02:22 | |
| *** annp has joined #openstack-keystone | 03:01 | |
| *** sapd1 has quit IRC | 03:10 | |
| *** sapd1 has joined #openstack-keystone | 03:10 | |
| *** felipemonteiro has joined #openstack-keystone | 03:12 | |
| vishakha | kmalloc, cmurphy : According to the follow up comment for adding 'date' for purging flush, I have uploaded a new patch set https://review.openstack.org/#/c/607897/. | 03:15 |
| *** Dinesh_Bhor has quit IRC | 03:57 | |
| *** rcernin has quit IRC | 04:42 | |
| *** rcernin has joined #openstack-keystone | 04:46 | |
| *** kukacz has quit IRC | 04:52 | |
| *** jdennis has quit IRC | 04:52 | |
| *** openstackgerrit has quit IRC | 04:52 | |
| *** d0ugal has quit IRC | 04:52 | |
| *** shyamb has joined #openstack-keystone | 04:54 | |
| *** kukacz has joined #openstack-keystone | 04:57 | |
| *** jdennis has joined #openstack-keystone | 04:57 | |
| *** openstackgerrit has joined #openstack-keystone | 04:57 | |
| *** d0ugal has joined #openstack-keystone | 04:57 | |
| *** shyamb has quit IRC | 05:01 | |
| *** felipemonteiro has quit IRC | 05:03 | |
| *** shyamb has joined #openstack-keystone | 05:07 | |
| *** shyamb has quit IRC | 05:22 | |
| *** aojea has joined #openstack-keystone | 05:34 | |
| *** shyamb has joined #openstack-keystone | 05:35 | |
| *** shyamb has quit IRC | 05:47 | |
| *** aojea has quit IRC | 05:51 | |
| *** Emine has quit IRC | 05:56 | |
| *** shyamb has joined #openstack-keystone | 06:01 | |
| *** shyamb has quit IRC | 06:15 | |
| *** shyamb has joined #openstack-keystone | 06:15 | |
| *** markvoelker has joined #openstack-keystone | 06:40 | |
| *** aojea has joined #openstack-keystone | 06:43 | |
| *** markvoelker has quit IRC | 06:45 | |
| *** pcaruana has joined #openstack-keystone | 06:57 | |
| *** rcernin has quit IRC | 07:04 | |
| *** shyamb has quit IRC | 07:16 | |
| *** shyamb has joined #openstack-keystone | 07:28 | |
| *** shyamb has quit IRC | 08:01 | |
| *** cfriesen has quit IRC | 08:21 | |
| *** markvoelker has joined #openstack-keystone | 08:41 | |
| *** aojea has quit IRC | 08:44 | |
| *** aojea has joined #openstack-keystone | 08:50 | |
| *** shyamb has joined #openstack-keystone | 08:58 | |
| *** pjrusak has quit IRC | 09:04 | |
| *** pjrusak has joined #openstack-keystone | 09:04 | |
| *** markvoelker has quit IRC | 09:15 | |
| openstackgerrit | Merged openstack/keystone-specs master: fix tox python3 overrides https://review.openstack.org/606643 | 09:28 |
| openstackgerrit | Merged openstack/oslo.limit master: Use openstackdocstheme for documentation https://review.openstack.org/600866 | 09:31 |
| *** Emine has joined #openstack-keystone | 09:32 | |
| *** shyamb has quit IRC | 09:44 | |
| *** paiboinaritesh has joined #openstack-keystone | 09:45 | |
| paiboinaritesh | hello | 09:45 |
| paiboinaritesh | I was checking this document https://developer.openstack.org/api-ref/identity/v3/ | 09:45 |
| paiboinaritesh | There hare several sections in this page with heading "What’s New ....." | 09:46 |
| paiboinaritesh | how to know which version belongs to which openstack release , for example what is the version for keystone in Ocata release in that page | 09:47 |
| paiboinaritesh | can any please share information on this topic | 09:47 |
| paiboinaritesh | *anyone | 09:47 |
| *** shyamb has joined #openstack-keystone | 09:47 | |
| *** shyamb has quit IRC | 09:55 | |
| kmalloc | vishakha: ++ nice! | 09:59 |
| *** shyamb has joined #openstack-keystone | 10:03 | |
| cmurphy | paiboinaritesh: I don't have a great answer but those numbers correspond to the version number that will be returned when you query the version API, e.g. GET http://keystone/v3 so if you know you have ocata then you can see what API version it reports | 10:04 |
| cmurphy | kmalloc: good morning | 10:04 |
| *** sheel has joined #openstack-keystone | 10:05 | |
| paiboinaritesh | @cmurphy I am comparing API changes between openstack releases. Like what has changed b/w mitaka and newton ...b/w newton and ocata . So I was wondering what could be the best way to know that | 10:10 |
| *** markvoelker has joined #openstack-keystone | 10:12 | |
| *** Emine has quit IRC | 10:17 | |
| *** shyamb has quit IRC | 10:18 | |
| *** itlinux has quit IRC | 10:24 | |
| kmalloc | cmurphy: Allo. 3am... And I am toooooo awake. | 10:25 |
| kmalloc | cmurphy: :) | 10:25 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add release names to api-ref https://review.openstack.org/608212 | 10:36 |
| paiboinaritesh | cmurphy: Thank you | 10:37 |
| cmurphy | paiboinaritesh: yw | 10:38 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add 3.11 summary to api-ref https://review.openstack.org/608216 | 10:42 |
| *** markvoelker has quit IRC | 10:44 | |
| *** shyamb has joined #openstack-keystone | 10:51 | |
| *** annp has quit IRC | 10:53 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Respect delay_auth_decision when Keystone is unavailable https://review.openstack.org/600862 | 11:36 |
| *** markvoelker has joined #openstack-keystone | 11:41 | |
| *** felipemonteiro has joined #openstack-keystone | 12:07 | |
| openstackgerrit | Merged openstack/python-keystoneclient master: Use templates for cover and lower-constraints https://review.openstack.org/600692 | 12:12 |
| openstackgerrit | Merged openstack/python-keystoneclient master: Import legacy keystoneclient-dsvm-functional https://review.openstack.org/604868 | 12:12 |
| *** markvoelker has quit IRC | 12:15 | |
| *** aojea has quit IRC | 12:32 | |
| *** sheel has quit IRC | 12:34 | |
| *** aojea has joined #openstack-keystone | 12:36 | |
| *** paiboinaritesh has quit IRC | 12:37 | |
| *** aojea has quit IRC | 12:41 | |
| *** shyamb has quit IRC | 12:55 | |
| *** dims_ has quit IRC | 12:58 | |
| *** mchlumsky has joined #openstack-keystone | 13:03 | |
| *** dave-mccowan has joined #openstack-keystone | 13:15 | |
| *** dave-mccowan has quit IRC | 13:21 | |
| *** pjrusak has quit IRC | 13:30 | |
| *** felipemonteiro has quit IRC | 13:57 | |
| *** dansmith is now known as SteelyDan | 14:20 | |
| gagehugo | o/ | 14:55 |
| *** Emine has joined #openstack-keystone | 15:23 | |
| *** gyee has joined #openstack-keystone | 15:24 | |
| *** bnemec is now known as beekneemech | 15:27 | |
| *** pcaruana has quit IRC | 15:39 | |
| *** cwright has joined #openstack-keystone | 15:50 | |
| *** ayoung has joined #openstack-keystone | 15:52 | |
| *** mchlumsky has quit IRC | 15:57 | |
| ayoung | cmurphy, so, I realize I was using the the Hardcore definition of capabilities, as opposed to POSIX/Linux definition of Capabilites. https://en.wikipedia.org/wiki/Capability-based_security | 15:58 |
| ayoung | What we are proposing is a lot like the Posix one, so I propose we call the URLs capability and capabilities and drop the templates. | 15:59 |
| ayoung | https://specs.openstack.org/openstack/keystone-specs/specs/keystone/stein/capabilities-app-creds.html | 15:59 |
| ayoung | so instead of "capability_template": { we would have "capability": { | 15:59 |
| ayoung | and so on. We can update the spec, and simplify the impl. Work for you? | 16:00 |
| cmurphy | ayoung: the template part is because there are substitutions in the strings | 16:03 |
| cmurphy | ayoung: joining a meeting right now, might be in and out | 16:03 |
| ayoung | cmurphy, yeah. I was thinking about that, though, and I think I've come to the conclusion that the templated form is what matches the posix defintion | 16:04 |
| ayoung | like, that is what you assign...so we can drop the template from it, as that is just an implementation detail. Make sense? | 16:04 |
| ayoung | I think I originally stuck the term template in there when we were talking routes, and that was a template object | 16:05 |
| ayoung | whereas here...I think we can go simpler. | 16:05 |
| cmurphy | ayoung: my other worry is the name "capability" is a pretty overloaded word, if we change the endpoint name to /v3/capabilities then we conflict with this idea https://review.openstack.org/547162 | 16:07 |
| *** itlinux has joined #openstack-keystone | 16:13 | |
| ayoung | cmurphy, I think that is the same idea | 16:16 |
| ayoung | cmurphy, these capabilities would be from other services. Those would explicitly be the ones from keystone | 16:17 |
| ayoung | but...I see your concern. We use the good url there | 16:17 |
| ayoung | cmurphy, somehow I don't think lbrags is going to be in any state to discuss it any time soon | 16:18 |
| cmurphy | ayoung: i guess you're right it's sort of the same thing | 16:18 |
| cmurphy | ayoung: agreed on that, but would be good to be forward-thinking | 16:19 |
| cmurphy | ayoung: there's also the other type of capabilities as in what features are enabled for a service | 16:19 |
| ayoung | cmurphy, yeah. I'm not sure that we should use the terms interchangably, but if we are going to use it in the "enabled" sense, we should change it for the "permissions" sense | 16:22 |
| ayoung | security is "what am I capable of accessing" where as the other is "what is this service endpoint capable of performing" | 16:22 |
| ayoung | we could call ours mini-roles. Rolettes, if you will. | 16:23 |
| cmurphy | lol | 16:24 |
| cmurphy | ayoung: i don't have any major objection to omitting the template part, just poking holes | 16:25 |
| ayoung | cmurphy, I think that the -template part won't mitigate the confusion with the capabilities API. And, Ithink the term capabilites in the non-security meaning is going to be hard to change, so we should accept that and modify our term. | 16:31 |
| ayoung | I'll stick with routes for now | 16:31 |
| cmurphy | ok | 16:31 |
| kmalloc | cmurphy: (see pic) | 16:31 |
| kmalloc | https://usercontent.irccloud-cdn.com/file/L7yDVvBE/sad+pupper.jpg | 16:32 |
| ayoung | kmalloc, neutering time? | 16:32 |
| cmurphy | kmalloc: sad pup :'( | 16:33 |
| kmalloc | Spay | 16:33 |
| kmalloc | But yes. | 16:33 |
| * cmurphy -> friday things | 16:33 | |
| *** pcaruana has joined #openstack-keystone | 16:42 | |
| *** ayoung has quit IRC | 16:43 | |
| *** dims has joined #openstack-keystone | 16:46 | |
| *** pcaruana has quit IRC | 16:50 | |
| *** felipemonteiro has joined #openstack-keystone | 17:41 | |
| *** felipemonteiro has quit IRC | 17:49 | |
| openstackgerrit | Doug Hellmann proposed openstack/keystone master: change the dist name to 'openstack-keystone' https://review.openstack.org/608331 | 17:53 |
| *** felipemonteiro has joined #openstack-keystone | 18:06 | |
| *** ayoung has joined #openstack-keystone | 18:10 | |
| ayoung | cmurphy, I was going to propose that we call them URNs (Names) but that includes the hostname, just not the protocol | 18:10 |
| ayoung | so, maybe SubURNs, but, again, that does not include the Templatization | 18:11 |
| ayoung | routes was taken from the python API. | 18:11 |
| ayoung | kmalloc, I +2ed the auth patch. I think all of the erros we've seen thus far have been transitory. A lot of work is stacked up behind that one. | 18:21 |
| *** imacdonn has quit IRC | 18:22 | |
| *** imacdonn has joined #openstack-keystone | 18:22 | |
| kmalloc | ayoung: thanks | 18:30 |
| kmalloc | ayoung: also ++ on URN | 18:30 |
| kmalloc | ayoung: hopefully i'll get users and projects rebased, then can finish up / close the cycle on the flask stuff | 18:30 |
| ayoung | kmalloc, is it OK to abuse the term URN that way? | 18:31 |
| kmalloc | i don't see a problem with it | 18:31 |
| kmalloc | :) | 18:31 |
| ayoung | Maybe RRN for Relative Resource Name? | 18:31 |
| kmalloc | RRN is probably better | 18:31 |
| kmalloc | and i can't think of someone using RRN before, so it is def. not overloaded | 18:31 |
| ayoung | RRNT | 18:32 |
| kmalloc | or at least it is minimally used. | 18:32 |
| ayoung | Relate Resource Name Template. Pronounced like RUNT | 18:32 |
| kmalloc | wfm. | 18:32 |
| kmalloc | i really like that tbh | 18:32 |
| kmalloc | so RRN (Run) and RRNT (Runt) | 18:32 |
| kmalloc | thats good. | 18:32 |
| kmalloc | and pretty unique | 18:33 |
| * ayoung struggling not to make a Run DMC pun | 18:33 | |
| kmalloc | DO IT | 18:33 |
| kmalloc | ;) | 18:33 |
| * kmalloc runs off to take care of... a thing. | 18:34 | |
| kmalloc | be back in a few. | 18:34 |
| kmalloc | ayoung: also, looks like we can't use keycloak for Infra, it appears keycloak doesn't talk OpenID 2.0, just OIDC | 18:34 |
| kmalloc | and we need OpenID and OIDC =/ | 18:34 |
| ayoung | Rapture | 18:34 |
| kmalloc | meaning i'll be looking at writing a small python identity broker until we can see about bring keystone up to par. | 18:35 |
| kmalloc | (flask based, simple, translate identity source -> identity source for pool of SPs. | 18:35 |
| kmalloc | it all comes down to ubuntu one doesn't talk OIDC. | 18:36 |
| kmalloc | and we need to front it as well as openstackid. | 18:36 |
| kmalloc | (blah) | 18:36 |
| ayoung | so we need an OIDC library for python to do that, right? | 18:38 |
| ayoung | er | 18:38 |
| ayoung | OpenID 2.0 | 18:39 |
| kmalloc | there is one | 18:39 |
| ayoung | Oh, I figured there was | 18:40 |
| kmalloc | authlib does it afaict | 18:40 |
| kmalloc | (might be issues with the license)_ | 18:40 |
| ayoung | kmalloc, what about adding it to Ipsilon | 18:40 |
| kmalloc | but there is also some flask-specific extensions for oidc/oid | 18:40 |
| kmalloc | possible. it might simply be a single IDP broker that does OID->OIDC and then use keycloak | 18:41 |
| kmalloc | for the time being | 18:41 |
| ayoung | I bet we could enlist cheims to help | 18:41 |
| kmalloc | ipsilon was very very veryn rough around the edges last i looked. | 18:41 |
| kmalloc | like... mostly not usable | 18:41 |
| ayoung | We had it working | 18:41 |
| kmalloc | working and full featured are two different things | 18:41 |
| ayoung | jamielennox, and I did the whole Keystone integration with it via SAML back a couple year | 18:41 |
| ayoung | s | 18:41 |
| kmalloc | full featured enough for production use* | 18:42 |
| ayoung | Its Fedora Account Services | 18:42 |
| kmalloc | it looks like it might suffer from the asme issues keycloak does. | 18:43 |
| ayoung | https://pagure.io/ipsilon/blob/master/f/ipsilon/providers/openid | 18:43 |
| ayoung | how could I tell if that was 2.0? | 18:43 |
| ayoung | from openid.server.server import ProtocolError, EncodingError | 18:44 |
| kmalloc | ah it looks ok | 18:44 |
| kmalloc | yeah oid is 2.0 in like 2007 | 18:44 |
| kmalloc | so i would be shocked if it supported OID and not OID 2.0 | 18:44 |
| kmalloc | i'll poke at ipsilon it might work as a broker | 18:44 |
| kmalloc | thnx | 18:44 |
| ayoung | kmalloc, the rippowam code is old, but I bet we could resurrect, too... | 18:45 |
| ayoung | https://github.com/admiyo/rippowam/tree/master/roles/ipsilonserver | 18:45 |
| ayoung | 2015...boy time does pass doesn't it | 18:46 |
| ayoung | kmalloc, a secondary win would be if we could tie in to FAS for stuff... | 18:46 |
| *** felipemonteiro has quit IRC | 18:49 | |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone master: Follow Zuul job rename https://review.openstack.org/608337 | 18:54 |
| *** raildo has quit IRC | 18:59 | |
| *** raildo has joined #openstack-keystone | 18:59 | |
| *** felipemonteiro has joined #openstack-keystone | 19:14 | |
| *** dave-mccowan has joined #openstack-keystone | 19:24 | |
| *** felipemonteiro has quit IRC | 19:30 | |
| *** Emine has quit IRC | 19:47 | |
| *** raildo has quit IRC | 20:22 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: [WIP] Add functional testing gate https://review.openstack.org/531014 | 20:26 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: [WIP] Add functional testing gate https://review.openstack.org/531014 | 20:36 |
| *** itlinux has quit IRC | 21:50 | |
| *** aojea has joined #openstack-keystone | 22:12 | |
| *** itlinux has joined #openstack-keystone | 22:19 | |
| *** itlinux has quit IRC | 22:22 | |
| *** cfriesen has joined #openstack-keystone | 22:44 | |
| *** aojea has quit IRC | 22:45 | |
| *** jmlowe has quit IRC | 23:00 | |
| *** jmlowe has joined #openstack-keystone | 23:03 | |
| *** aojea has joined #openstack-keystone | 23:17 | |
| *** felipemonteiro has joined #openstack-keystone | 23:24 | |
| *** gyee has quit IRC | 23:31 | |
| *** aojea has quit IRC | 23:51 | |
| *** felipemonteiro has quit IRC | 23:56 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!
