| *** aojea has quit IRC | 00:39 | |
| *** irclogbot_1 has quit IRC | 00:55 | |
| openstackgerrit | Merged openstack/keystone master: Update api-ref for set registered limits. https://review.openstack.org/616755 | 01:58 |
|---|---|---|
| *** cburgess has quit IRC | 02:22 | |
| *** trident has quit IRC | 02:25 | |
| *** cburgess has joined #openstack-keystone | 02:26 | |
| *** trident has joined #openstack-keystone | 02:30 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Remove "crypt_strength" option https://review.openstack.org/613218 | 02:38 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Drop the compatibility password column https://review.openstack.org/613513 | 02:38 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Bump sqlalchemy minimum version to 1.1.0 https://review.openstack.org/613830 | 02:52 |
| *** edmondsw has quit IRC | 02:56 | |
| *** lamt has joined #openstack-keystone | 03:02 | |
| *** jmlowe has quit IRC | 05:41 | |
| *** sheel has joined #openstack-keystone | 06:15 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Bump sqlalchemy minimum version to 1.1.0 https://review.openstack.org/613830 | 06:54 |
| *** hoonetorg has quit IRC | 07:03 | |
| openstackgerrit | lei zhang proposed openstack/keystone master: Fix the dead URL https://review.openstack.org/615760 | 07:13 |
| openstackgerrit | lei zhang proposed openstack/keystone master: Fix the dead URL https://review.openstack.org/615760 | 07:20 |
| *** hoonetorg has joined #openstack-keystone | 07:20 | |
| *** errr has quit IRC | 07:21 | |
| *** errr has joined #openstack-keystone | 07:23 | |
| vishakha | cmurphy: Hi. I had one query regarding K2K federation. The token I issued from IDP, I can directly go to SP and use? or I have to issue any another token by passing the saml response? | 08:02 |
| *** amoralej|off is now known as amoralej | 08:06 | |
| cmurphy | vishakha: you can't directly use the token from the idp on the sp, you have to go through the saml auth process with it | 08:06 |
| vishakha | cmurphy , Ok thanks | 08:08 |
| *** lbragstad has joined #openstack-keystone | 08:18 | |
| *** ChanServ sets mode: +o lbragstad | 08:18 | |
| vishakha | cmurphy: I issue the token by passing --os-service-provider, --remote-project-name and domain. After that what I have to do, I am not able to find that in document | 08:22 |
| cmurphy | vishakha: that should get you a token from the SP so you should be able to use that on the SP | 08:26 |
| *** Dinesh_Bhor has joined #openstack-keystone | 08:29 | |
| vishakha | cmurphy: Sorry But I am still confused. I want to test my k2k . I issued a token from IDP by passing the paramenters os-service-provider, --remote-project-name and then I was used that token on my SP in my curl request | 08:32 |
| *** sapd1_ has quit IRC | 08:35 | |
| *** sapd1 has joined #openstack-keystone | 08:36 | |
| *** hoonetorg has quit IRC | 08:38 | |
| *** pcaruana has quit IRC | 08:39 | |
| cmurphy | vishakha: sorry, it's confusing :) when you do that command it's actually getting two tokens, first one from the idp and one from the sp, the one it prints out is the one from the SP and that's the one you can use on the SP | 08:44 |
| vishakha | cmurphy: ok now I got it. So I doing right. Thanks a lot | 08:46 |
| cmurphy | yep :) | 08:46 |
| *** Dinesh_Bhor has quit IRC | 09:07 | |
| *** Emine has joined #openstack-keystone | 09:46 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 09:56 | |
| *** shrasool has joined #openstack-keystone | 10:05 | |
| csatari | We are working on adding a Shibboleth to the testing environment of Keystone. One option if to use a Docekrized IdP what makes the isntallation and the configuration of the IdP more easy. I started to use this one: https://github.com/Unicon/shibboleth-idp-dockerized when the container is started in "config mode" it asks some questions what I find difficult to answer. | 10:09 |
| csatari | Hostname, Attribute Scope, SAML EntityID, Backchannel PKCS12 Password and Cookie Encryption Key Password | 10:09 |
| *** Emine has quit IRC | 10:10 | |
| csatari | I also needed to generate a Browser-based TLS Certificate and a Key | 10:10 |
| csatari | Soo, the question is how to configure the parameters of Shibboleth IdP to match with the config of Keysone? | 10:10 |
| *** xek has quit IRC | 10:27 | |
| *** xek has joined #openstack-keystone | 10:27 | |
| *** Dinesh_Bhor has quit IRC | 10:36 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 10:43 | |
| *** Dinesh_Bhor has quit IRC | 11:07 | |
| *** lbragstad has quit IRC | 11:09 | |
| *** raildo has joined #openstack-keystone | 11:33 | |
| *** lbragstad has joined #openstack-keystone | 12:07 | |
| *** ChanServ sets mode: +o lbragstad | 12:07 | |
| *** shrasool has quit IRC | 12:16 | |
| csatari | An other problem on an other level what I discovered. I configured the IdP with almost random parmeters, I've changed tempest.conf's parameters to point to the IdP running on my localhost and I ran test_request_unscoped_token. What I get is a " requests.exceptions.SSLError: HTTPSConnectionPool(host='localhost', port=4443): Max retries exceeded with url: /idp/profile/SAML2/SOAP/ECP (Caused by SSLError(SSLError("bad | 12:17 |
| csatari | handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),))". Anyone has any idea what can be the reason for this? | 12:17 |
| *** shrasool has joined #openstack-keystone | 12:18 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 12:19 | |
| cmurphy | csatari: your docker container probably uses the hostname parameter to configure the ssl certificates, it needs to exactly match the hostname you use to connect to the idp and you need to add the certificate to your trusted certificate store if it's a self-signed certificate | 12:28 |
| cmurphy | csatari: you can use openssl s_client to try connecting to the service to understand why it's not valid | 12:29 |
| cmurphy | csatari: i have a seat open next to me if you want to talk about it | 12:30 |
| *** Dinesh_Bhor has quit IRC | 12:31 | |
| csatari | cmurphy: Thanks for the hints. I will visit you after all guys have a review up from my table. | 12:33 |
| *** Dinesh_Bhor has joined #openstack-keystone | 12:42 | |
| *** mvkr has quit IRC | 12:54 | |
| *** bnemec has joined #openstack-keystone | 12:57 | |
| *** bnemec has quit IRC | 13:02 | |
| *** Dinesh_Bhor has quit IRC | 13:09 | |
| *** erus has quit IRC | 13:18 | |
| *** erus has joined #openstack-keystone | 13:19 | |
| *** erus has quit IRC | 13:23 | |
| *** amoralej is now known as amoralej|lunch | 13:25 | |
| *** erus has joined #openstack-keystone | 13:27 | |
| *** erus has quit IRC | 13:30 | |
| *** aojea has joined #openstack-keystone | 13:33 | |
| *** mvkr has joined #openstack-keystone | 13:38 | |
| *** shrasool has quit IRC | 13:40 | |
| *** aojea has quit IRC | 13:48 | |
| *** aojea has joined #openstack-keystone | 13:49 | |
| gmann | lbragstad: little confuse about lockout_failure_attempts feature is diabled by default and its default value as 1 : https://github.com/openstack/keystone/blob/177c0e610180d8709f90046f5d0e6563c95742f6/keystone/conf/security_compliance.py#L37 | 13:50 |
| gmann | is it via ignore_options here - https://github.com/openstack/keystone/blob/177c0e610180d8709f90046f5d0e6563c95742f6/keystone/identity/backends/sql.py#L92 ? | 13:51 |
| gmann | but i did not find the option_value for that option | 13:51 |
| *** shrasool has joined #openstack-keystone | 13:52 | |
| *** aojea has quit IRC | 13:53 | |
| *** sheel has quit IRC | 13:55 | |
| lbragstad | gmann yeah - so that's working hand in hand with the users options stuff | 13:57 |
| lbragstad | gmann for example | 13:58 |
| lbragstad | https://docs.openstack.org/keystone/latest/admin/identity-security-compliance.html#setting-an-account-lockout-threshold | 13:58 |
| lbragstad | if a user has that attribute set on their reference, then it gets factored into that case | 13:58 |
| lbragstad | which just allows operators to explicitly say "this user shouldn't be locked out due to invalid password authentication attempts" (e.g., service users) | 13:59 |
| lbragstad | gmann the user options stuff is not documented :( | 14:00 |
| lbragstad | but we have a bug for it | 14:00 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1792026 | 14:00 |
| openstack | Launchpad bug 1792026 in OpenStack Identity (keystone) "User options are not documented in the API reference" [Medium,In progress] - Assigned to Chason Chan (chen-xing) | 14:00 |
| gmann | lbragstad: ohk, so that work with 2 control, one with overall config option and second per user. | 14:03 |
| lbragstad | yes - exactly | 14:03 |
| lbragstad | the code in the second link | 14:03 |
| lbragstad | https://github.com/openstack/keystone/blob/177c0e610180d8709f90046f5d0e6563c95742f6/keystone/identity/backends/sql.py#L92 | 14:03 |
| lbragstad | is using the resource option from the user referenc e | 14:03 |
| lbragstad | and not the configuration option | 14:03 |
| gmann | ok, we are missing that user side enable/disable info in tempest tests - https://github.com/openstack/tempest/blob/ed896859c221b144df23724f386da6eaa64bffc1/tempest/api/identity/v3/test_users.py#L135 | 14:06 |
| lbragstad | yeah - it's relatively fresh | 14:08 |
| lbragstad | the user options work was done after the initial PCI-DSS work | 14:08 |
| gmann | lbragstad: and does GET /users return this info ? | 14:08 |
| lbragstad | (we still need to document it within keystone and do some client work for it, too) | 14:08 |
| lbragstad | gmann yes - it does | 14:08 |
| *** bnemec has joined #openstack-keystone | 14:09 | |
| *** mchlumsky has joined #openstack-keystone | 14:09 | |
| lbragstad | if you set user options, it will be returned in the reference | 14:09 |
| lbragstad | well... | 14:09 |
| lbragstad | GET /v3/users/{user_id} will return it | 14:09 |
| gmann | and if it is not set, is it missing or default to True | 14:09 |
| lbragstad | it will be missing | 14:09 |
| gmann | humm. | 14:10 |
| gmann | thanks. we can use that API at least. | 14:10 |
| lbragstad | gmann here is an example request BODY if you were to set ignore_lockout_failure_attempts | 14:11 |
| lbragstad | https://docs.openstack.org/keystone/latest/admin/identity-security-compliance.html#setting-an-account-lockout-threshold | 14:11 |
| lbragstad | which would be PATCH /v3/users/{user_id} with a similar request body ({"user": {"options": {"option_name": "option_value"}}}) | 14:12 |
| *** erus has joined #openstack-keystone | 14:13 | |
| lbragstad | unofficial registry of supported user options https://github.com/openstack/keystone/blob/master/keystone/identity/backends/resource_options.py#L60-L111 | 14:19 |
| gmann | lbragstad: thanks. that will help. but if GET API would return that options always and with default value of True then, it makes user easy to use that info instead of checking attr presence in response. | 14:21 |
| lbragstad | gmann sure - that makes sense | 14:22 |
| lbragstad | we can try and run that by kmalloc | 14:22 |
| lbragstad | get his opinion on it | 14:22 |
| lbragstad | he wrote the majority of that code - but i can see how that would simplify clients | 14:22 |
| *** Dinesh_Bhor has joined #openstack-keystone | 14:28 | |
| *** mchlumsky has quit IRC | 14:33 | |
| *** mchlumsky has joined #openstack-keystone | 14:37 | |
| *** Dinesh_Bhor has quit IRC | 14:38 | |
| *** dklyle has joined #openstack-keystone | 14:38 | |
| *** erus has quit IRC | 14:39 | |
| *** bnemec has quit IRC | 14:48 | |
| *** amoralej|lunch is now known as amoralej | 14:48 | |
| *** shrasool has quit IRC | 14:58 | |
| *** shrasool has joined #openstack-keystone | 15:19 | |
| *** bnemec has joined #openstack-keystone | 15:31 | |
| *** jmlowe has joined #openstack-keystone | 15:37 | |
| *** jmlowe has quit IRC | 15:42 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add introduction section to federation docs https://review.openstack.org/615384 | 15:43 |
| *** shrasool has quit IRC | 15:54 | |
| *** shrasool has joined #openstack-keystone | 15:55 | |
| *** bnemec has quit IRC | 15:58 | |
| *** mchlumsky has quit IRC | 15:58 | |
| *** erus has joined #openstack-keystone | 15:59 | |
| *** shrasool has quit IRC | 15:59 | |
| *** bnemec has joined #openstack-keystone | 16:02 | |
| *** lbragstad has quit IRC | 16:07 | |
| *** bnemec has quit IRC | 16:19 | |
| *** mchlumsky has joined #openstack-keystone | 16:22 | |
| *** mchlumsky has quit IRC | 16:24 | |
| *** mchlumsky has joined #openstack-keystone | 16:26 | |
| *** mchlumsky has quit IRC | 16:26 | |
| *** gyee has joined #openstack-keystone | 16:40 | |
| *** lbragstad has joined #openstack-keystone | 16:58 | |
| *** ChanServ sets mode: +o lbragstad | 16:58 | |
| *** pcaruana has joined #openstack-keystone | 17:27 | |
| *** dklyle has quit IRC | 17:33 | |
| *** dklyle has joined #openstack-keystone | 17:34 | |
| *** lbragstad has quit IRC | 17:36 | |
| *** sapd1 has quit IRC | 18:15 | |
| *** sapd1_ has joined #openstack-keystone | 18:15 | |
| *** jmlowe has joined #openstack-keystone | 18:32 | |
| *** dklyle has quit IRC | 18:34 | |
| *** dklyle has joined #openstack-keystone | 18:40 | |
| *** dklyle has quit IRC | 18:47 | |
| *** dklyle has joined #openstack-keystone | 18:47 | |
| *** jmlowe has quit IRC | 18:55 | |
| *** jmlowe has joined #openstack-keystone | 18:56 | |
| *** jmlowe has quit IRC | 19:04 | |
| *** amoralej is now known as amoralej|off | 19:24 | |
| *** aojea has joined #openstack-keystone | 19:31 | |
| *** aojea has quit IRC | 19:36 | |
| *** mvkr has quit IRC | 19:53 | |
| *** shrasool has joined #openstack-keystone | 19:59 | |
| *** shrasool has quit IRC | 20:19 | |
| *** shrasool has joined #openstack-keystone | 20:20 | |
| *** hoonetorg has joined #openstack-keystone | 20:27 | |
| *** mvkr has joined #openstack-keystone | 20:28 | |
| *** shrasool has quit IRC | 21:10 | |
| *** mattoliverau has quit IRC | 21:16 | |
| *** lbragstad has joined #openstack-keystone | 21:19 | |
| *** ChanServ sets mode: +o lbragstad | 21:19 | |
| *** itlinux has joined #openstack-keystone | 21:31 | |
| *** shrasool has joined #openstack-keystone | 21:40 | |
| *** raildo has quit IRC | 21:53 | |
| *** raildo has joined #openstack-keystone | 21:54 | |
| *** itlinux has quit IRC | 22:12 | |
| *** shrasool has quit IRC | 22:15 | |
| *** aojea has joined #openstack-keystone | 22:21 | |
| *** aojea has quit IRC | 22:26 | |
| *** mattoliverau has joined #openstack-keystone | 22:26 | |
| kmalloc | lbragstad gmann: if we want to extend the user options for defaults, i'm happy to do so. | 22:31 |
| kmalloc | or well, happy to accept it | 22:31 |
| *** naptastic has joined #openstack-keystone | 22:32 | |
| naptastic | Is it possible to specify more than one keypair to put on a VM at the time I instantiate it? The UI removes one key if I try to add another. Can that behavior be changed¿ | 22:33 |
| naptastic | (wow... didn't realize I could make a ¿ by accident) | 22:33 |
| *** imacdonn_ has quit IRC | 22:40 | |
| *** imacdonn_ has joined #openstack-keystone | 22:40 | |
| *** lbragstad has quit IRC | 22:57 | |
| *** pcaruana has quit IRC | 22:58 | |
| *** spsurya has quit IRC | 23:40 | |
| cmurphy | naptastic: that's more of a #openstack-nova question, keystone isn't involved with keypairs | 23:49 |
| *** raildo has quit IRC | 23:51 | |
| *** erus has quit IRC | 23:54 | |
| naptastic | cmurphy, Thanks! Asking there. | 23:56 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!