Tuesday, 2019-01-08

« Monday, 2019-01-07 Index Wednesday, 2019-01-09 »
*** eRus is now known as erus00:02
*** erus is now known as eRus00:04
*** eRus is now known as erus00:04
*** erus is now known as erus_00:13
*** erus_ has quit IRC00:29
*** erus_ has joined #openstack-keystone00:42
*** ileixe has joined #openstack-keystone00:43
*** erus_ has quit IRC00:49
*** erus1 has joined #openstack-keystone00:49
*** erus1 is now known as erus_00:49
*** erus1 has joined #openstack-keystone00:50
*** erus1 is now known as erus_00:50
*** erus_ has quit IRC01:06
*** itlinux has joined #openstack-keystone01:08
*** erus has joined #openstack-keystone01:14
*** ileixe has quit IRC02:01
*** ileixe has joined #openstack-keystone02:02
*** ileixe has quit IRC02:04
*** ileixe has joined #openstack-keystone02:04
*** ileixe has quit IRC02:58
*** mhen has quit IRC02:59
*** ileixe has joined #openstack-keystone02:59
*** mhen has joined #openstack-keystone03:02
*** whoami-rajat has joined #openstack-keystone03:16
*** spsurya has joined #openstack-keystone04:22
*** wxy-xiyuan has quit IRC04:24
*** bzhao__ has quit IRC04:26
*** dims has quit IRC04:47
*** dims has joined #openstack-keystone04:48
*** erus has quit IRC04:54
*** erus has joined #openstack-keystone04:56
*** dims has quit IRC04:56
*** dims has joined #openstack-keystone04:56
*** erus has quit IRC05:02
*** erus has joined #openstack-keystone05:08
*** spsurya has quit IRC05:10
*** spsurya has joined #openstack-keystone05:13
*** erus has quit IRC05:14
*** erus has joined #openstack-keystone05:23
*** erus has quit IRC05:29
*** shyamb has joined #openstack-keystone05:37
*** erus has joined #openstack-keystone05:38
*** shyamb has quit IRC05:43
*** erus has quit IRC05:44
*** shyamb has joined #openstack-keystone05:51
*** erus has joined #openstack-keystone05:53
*** erus has quit IRC06:00
*** erus has joined #openstack-keystone06:08
*** erus has quit IRC06:14
*** erus has joined #openstack-keystone06:23
*** gyee has quit IRC06:24
*** erus has quit IRC06:29
*** erus has joined #openstack-keystone06:38
*** erus has quit IRC06:44
*** shyamb has quit IRC06:50
*** erus has joined #openstack-keystone06:53
*** bzhao__ has joined #openstack-keystone06:58
*** rcernin has quit IRC06:58
*** erus has quit IRC06:59
*** shyamb has joined #openstack-keystone07:03
*** shyamb has quit IRC07:05
*** shyamb has joined #openstack-keystone07:06
*** erus has joined #openstack-keystone07:08
*** erus has quit IRC07:14
*** erus has joined #openstack-keystone07:23
*** shyamb has quit IRC07:25
*** erus has quit IRC07:30
*** wxy-xiyuan has joined #openstack-keystone07:32
*** shyamb has joined #openstack-keystone07:32
*** erus has joined #openstack-keystone07:38
*** pcaruana has joined #openstack-keystone07:42
*** erus has quit IRC07:44
*** shyamb has quit IRC07:46
*** sapd1_ has quit IRC07:50
*** sapd1_ has joined #openstack-keystone07:50
*** erus has joined #openstack-keystone07:53
*** erus has quit IRC07:59
*** erus has joined #openstack-keystone08:08
*** erus has quit IRC08:14
*** erus has joined #openstack-keystone08:23
*** xek has joined #openstack-keystone08:24
*** yan0s has joined #openstack-keystone08:25
*** erus has quit IRC08:30
*** erus has joined #openstack-keystone08:38
yan0sHi all, I'm having some trouble setting up federated keystone with shibboleth08:41
yan0sin keystone.log I get the following:08:41
yan0s(keystone.federation.utils): 2019-01-08 08:37:59,144 DEBUG identity_values: []08:42
yan0s(keystone.federation.utils): 2019-01-08 08:37:59,144 WARNING Could not map any federated user properties to identity values. Check debug logs or the mapping used for additional details.08:43
yan0sand in horizon GUI:08:43
yan0s{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}08:43
yan0sfor starters there should be a user in shibboleth and a corresponding user in OpenStack. Is that correct?08:44
*** erus has quit IRC08:44
yan0sand somehow mapping rules should match them08:45
*** evrardjp_ has joined #openstack-keystone08:48
*** evrardjp__ has joined #openstack-keystone08:49
*** evrardjp has quit IRC08:51
*** evrardjp_ has quit IRC08:52
*** erus has joined #openstack-keystone08:53
*** evrardjp__ has quit IRC08:53
cmurphyyan0s: there doesn't have to already be a corresponding user in openstack, it can create a special "shadow" user if there is no local user to map to08:54
cmurphyyan0s: have you already seen https://docs.openstack.org/keystone/latest/admin/federation/mapping_combinations.html#mapping-rules ?08:54
*** shyamb has joined #openstack-keystone08:56
*** erus has quit IRC09:00
yan0scmurphy: Thanks! This is my rule: https://pastebin.com/D0NjXq5Z09:00
cmurphyyan0s: is your IdP sending an attribute called "username"?09:01
yan0sI have tried with and without existing user in OpenStack and it fails09:01
yan0syes09:01
yan0salso in /etc/shibboleth/attribute-map.xml I have added this line09:02
yan0s<Attribute name="username" id="username"/>09:02
*** evrardjp has joined #openstack-keystone09:03
cmurphyyan0s: the debug logs should show the saml assertion values and several more lines about how it is rendering the mapping09:03
yan0sis that enough?09:03
cmurphyyan0s: if you're sure that the IdP is sending "username" then that should be fine09:03
cmurphyyou might need to turn on insecure_debug to get more detailed logs about the assertion and the mapping09:03
*** erus has joined #openstack-keystone09:08
yan0shere is the full logs for a failed login: https://pastebin.com/zHTN7HWi09:10
yan0sdo you know how can I read the idp attributes sent in keystone?09:11
*** erus has quit IRC09:14
cmurphyyan0s: it is not sending "username"09:17
cmurphyyan0s: you can look in /var/log/shibboleth/shibd_warn.log or shibd.log and look for messages about unmapped attributes on your SP09:18
cmurphyyou can also check the IdP documentation, if you're using simplesamlphp then it looks like these are some attributes you can use https://simplesamlphp.org/docs/stable/simplesamlphp-sp#section_509:18
openstackgerritVishakha Agarwal proposed openstack/keystone master: Optimize fernet token and receipts in cli.py  https://review.openstack.org/62736409:19
*** erus has joined #openstack-keystone09:23
*** erus has quit IRC09:29
yan0sthanks this is very helpful09:33
yan0show do you know it is not sending "username"?09:33
cmurphyyan0s: because I don't see it in the "assertion data" log09:34
openstackgerritColleen Murphy proposed openstack/keystone master: Remove duplicated TOC in configuration guide  https://review.openstack.org/62911509:37
*** erus has joined #openstack-keystone09:38
*** ileixe has left #openstack-keystone09:42
*** erus has quit IRC09:44
*** erus has joined #openstack-keystone09:53
*** erus has quit IRC10:00
*** shyamb has quit IRC10:00
*** shyamb has joined #openstack-keystone10:05
*** erus has joined #openstack-keystone10:08
*** shyamb has quit IRC10:33
*** erus has quit IRC11:23
*** erus has joined #openstack-keystone11:23
*** erus has quit IRC11:29
*** erus has joined #openstack-keystone11:36
*** shyamb has joined #openstack-keystone11:48
*** shyamb has quit IRC12:30
*** shyamb has joined #openstack-keystone12:42
openstackgerritVishakha Agarwal proposed openstack/keystone master: Update doc for token_setup and token_rotate  https://review.openstack.org/62916812:46
openstackgerritVishakha Agarwal proposed openstack/keystone master: Update doc for token_setup and token_rotate  https://review.openstack.org/62916812:47
openstackgerritVishakha Agarwal proposed openstack/keystone master: Update doc for token_setup and token_rotate  https://review.openstack.org/62916812:48
*** sayalilunkad has quit IRC12:51
*** vishakha has joined #openstack-keystone12:51
*** raildo has joined #openstack-keystone12:51
*** sayalilunkad has joined #openstack-keystone12:51
*** rcherrueau has joined #openstack-keystone12:52
*** szaher has joined #openstack-keystone13:08
*** yan0s has quit IRC13:09
*** erus has quit IRC13:13
*** erus has joined #openstack-keystone13:13
*** yan0s has joined #openstack-keystone13:24
*** erus_ has joined #openstack-keystone13:30
*** zigo has joined #openstack-keystone13:30
*** rcherrueau has quit IRC13:40
*** trident has quit IRC13:41
*** trident has joined #openstack-keystone13:42
*** jhesketh has quit IRC13:45
*** szaher has quit IRC13:47
*** jhesketh has joined #openstack-keystone13:47
*** szaher has joined #openstack-keystone13:52
*** trident has quit IRC14:03
*** trident has joined #openstack-keystone14:03
erus_hello14:07
*** yan0s has quit IRC14:09
*** yan0s has joined #openstack-keystone14:10
lbragstado/14:10
cmurphy\o14:10
erus_how are you today?14:14
erus_:D14:14
erus_here is really hot today!14:15
lbragstadi'm well :)14:16
erus_great!14:16
erus_i'm a little frustrated xD i can't figure out what's wrong with my idp configuration. Right now i have this error14:17
erus_ERROR Shibboleth.SSO.SAML2 [2]: failed to decrypt assertion: Unable to resolve any key decryption keys.14:18
erus_that is from shibboleth logs14:18
erus_and in apache logs says14:18
erus_2019-01-08 11:14:23.047400 A valid authentication statement was not found in the incoming message.14:19
erus_I ran out of ideas xD14:19
cmurphyerus_: it seems like maybe you didn't configure the IdP's metadata correctly14:20
cmurphyerus_: what do you have for MetadataProvider in shibboleth2.xml?14:20
erus_<MetadataProvider type="XML" url="https://samltest.id/saml/idp" backingFile="samltest-metadata.xml"/>14:21
cmurphyerus_: did you restart the shibd daemon after you edited shibboleth2.xml?14:22
erus_yep14:23
knikollao/14:23
erus_hello knikolla :)14:23
knikollaHi everyone, hope you had great holidays :)14:23
knikollahi erus14:23
erus_yay o/14:23
erus_how  are you doing?14:24
cmurphyerus_: did you check the logs on samltest.id to see if anything strange was happening on that side?14:24
knikollaerus_: I'm good, thank you for asking :) what about you?14:26
erus_Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST14:28
erus_I'm fine, we are in summer and it's really hot :(14:29
*** shyamb has quit IRC14:29
erus_and trying to have things working with samltest as idp :D14:30
erus_and have this one too cmurphy No SAMLBindingContext or binding URI available, error must be handled locally14:30
cmurphymaybe knikolla has an idea14:31
knikolladoes this happen during authentication?14:34
erus_yep14:35
erus_when i try to authenticate it goes to the redirecction, i enter the credentials and then it says opensaml::FatalProfileException14:36
erus_redirection*14:37
knikollaThis error is on the SP side or IdP side?14:37
erus_in shibboleth logs says: ERROR Shibboleth.SSO.SAML2 [2]: failed to decrypt assertion: Unable to resolve any key decryption keys.14:37
*** abhi89 has joined #openstack-keystone14:37
openstackgerritMerged openstack/oslo.policy master: Fix sample config value when set_defaults is used  https://review.openstack.org/62329214:39
erus_i think is on the SP side14:39
abhi89Hi All.. I am having a fernet token with me & now I want to extract username & project out of this.. even session..any leads on which methods I can choose from keystone code? or any sample code already available.. need help!14:40
lbragstadabhi89 can you call the GET /v3/auth/tokens API with that token?14:41
lbragstadthe response body should contain all that information14:41
abhi89lbragstad: thanks!14:42
erus_opensaml::FatalProfileException at (http://192.168.122.11/Shibboleth.sso/SAML2/POST)14:44
erus_A valid authentication statement was not found in the incoming message.14:44
knikollaerus_: did you register the SP metadata with samltest.id?14:44
*** erus_ has quit IRC14:49
*** wxy| has joined #openstack-keystone14:54
erusDid you mean if i uploaded it?14:59
cmurphyyes15:00
openstackgerritVishakha Agarwal proposed openstack/keystone master: Add openstack_groups to assertion  https://review.openstack.org/58821115:05
*** itlinux has quit IRC15:21
*** markvoelker has joined #openstack-keystone15:23
*** markvoelker has quit IRC15:26
*** markvoelker has joined #openstack-keystone15:27
*** markvoelker has quit IRC15:27
erusYes i uploaded it15:34
knikollaerus: can I  have a  look at it?15:34
erusYay give me a minute I'm in the subway :)15:35
openstackgerritMerged openstack/keystone master: Consolidate WebSSO guide into SP instructions  https://review.openstack.org/62797615:41
*** szaher has quit IRC16:08
*** szaher has joined #openstack-keystone16:09
*** pcaruana has quit IRC16:20
*** itlinux has joined #openstack-keystone16:20
openstackgerritVishakha Agarwal proposed openstack/keystone master: Optimize fernet token and receipts in cli.py  https://review.openstack.org/62736416:22
*** gyee has joined #openstack-keystone16:38
*** imacdonn has quit IRC16:50
*** imacdonn has joined #openstack-keystone16:51
*** wxy| has quit IRC17:00
*** yan0s has quit IRC17:20
*** erus_ has joined #openstack-keystone17:24
gyeelbragstad, cmurphy, https://bugs.launchpad.net/keystone/+bug/1810983. Looks like we'll need to make the fix directly to stable/rocky and backport to stable/queens.17:35
openstackLaunchpad bug 1810983 in OpenStack Identity (keystone) "domain admin unable to fetch domain" [Undecided,New]17:35
lbragstadgyee https://launchpad.net/bugs/179486417:39
openstackLaunchpad bug 1794864 in OpenStack Identity (keystone) "Calling GET /v3/domains/{domain_id} with a project-scoped or domain-scoped token fails" [Medium,In progress] - Assigned to Lance Bragstad (lbragstad)17:39
lbragstadlooks similar to that17:39
lbragstadhttps://review.openstack.org/#/c/605851/8 and https://review.openstack.org/#/c/605871/817:40
gyeeoh17:41
gyeelbragstad, that won't fix it in stable/rocky17:42
gyeeproblem is in stable/rocky token was never in the auth_context17:42
gyeewe add it back in there in this patch https://review.openstack.org/#/c/605539/24/keystone/common/context.py17:42
lbragstadi don't think we'll be able to pass context objects on stable branches since oslo.policy won't know how to understand them17:44
gyeeused to work in stable/pike17:45
lbragstadpassing a RequestContext object to enforce()?17:45
gyeehttps://github.com/openstack/keystone/blob/stable/pike/keystone/common/authorization.py#L6817:46
gyeewe pass the TokenModel17:46
lbragstadah... yeah17:47
lbragstadthat's a subclass of dict17:47
gyeeso we can use things like token.project.id or token.project.domain.id17:47
gyeewe switched over to oslo_context around stable/queens time frame and the TokenModel was left out of the auth_context17:48
*** erus has quit IRC17:49
lbragstadwe do put a the token in the context still https://review.openstack.org/#/c/605539/24/keystone/server/flask/request_processing/middleware/auth_context.py17:50
lbragstadhttps://review.openstack.org/#/c/605539/24/keystone/common/context.py@6517:50
gyeeyes, in master branch only17:51
gyeewe need it in stable/rocky and stable/queens also17:51
gyeemaster branch is OK, stable/rocky and queens are broken17:52
*** erus has joined #openstack-keystone17:52
lbragstadso - sometime in queens we stopped passing the tokenmodel?17:53
gyeeyes17:53
lbragstadhttps://review.openstack.org/#/c/577567/17:53
lbragstadthat was only six weeks ago though17:54
gyeein stable/pike, we pass the tokenmodel here https://github.com/openstack/keystone/blob/stable/pike/keystone/common/authorization.py#L6817:54
lbragstadso that can't be it17:54
gyeebut in stable/queens, we removed that code in favor on oslo_context.to_policy_values()17:54
lbragstadah17:54
lbragstadcan we rewrite those policies to use the to_policy_values() instead?17:54
gyeeyes, that's one solution17:55
gyeeso instead of 'token.project.domain.id:%(target.domain.id)s', we could do this 'domain_id:%(target.domain.id)s'17:56
lbragstadi think i'd rather do that instead of using the v3 token contract in the syntax of policy check strings17:56
lbragstadright - i think so17:56
gyeebut if there are any customer policies out there, people will continue to scream :-)17:56
gyeeI would've imagined there are custom policies out there17:57
lbragstadprobably17:57
gyeeso this is essentially a backward compatibility issue17:57
gyeeremember, openstack upgrades are rather slow. Not everybody is running off master branch in production :-)17:58
lbragstadright - but we also worked on deprecation tooling for this kind of thing, too17:58
gyeein the particular, I think its worth preserving backward compatibility since we've formally deprecated that syntax17:59
gyeeI mean in this particular case17:59
gyeeman I can't type and think at the same time :-)17:59
openstackgerritMerged openstack/keystone master: Remove duplicated TOC in configuration guide  https://review.openstack.org/62911518:02
lbragstadso you think the backported fix needs to incorporate token.project.domain.id back?18:03
lbragstador token.domain.id18:03
gyeeyes18:04
lbragstadok - i was going to propose marking https://bugs.launchpad.net/keystone/+bug/1810983 as a duplicate of https://bugs.launchpad.net/keystone/+bug/1794864 but if that's the solution we're going for i'd rather keep them separate18:04
openstackLaunchpad bug 1810983 in OpenStack Identity (keystone) "domain admin unable to fetch domain" [Undecided,New]18:04
openstackLaunchpad bug 1794864 in OpenStack Identity (keystone) "Calling GET /v3/domains/{domain_id} with a project-scoped or domain-scoped token fails" [Medium,In progress] - Assigned to Lance Bragstad (lbragstad)18:04
gyeeI think we just need to backport this one https://review.openstack.org/#/c/605539/24/keystone/common/context.py18:04
lbragstadjust that file though... not everything else18:05
lbragstadsince the oslo.policy versions of the stable branches won't understand context objects18:05
lbragstadgyee updated - https://bugs.launchpad.net/keystone/+bug/181098318:09
openstackLaunchpad bug 1810983 in OpenStack Identity (keystone) rocky "domain admin unable to fetch domain" [Medium,Triaged]18:09
*** whoami-rajat has quit IRC18:12
*** erus_ has quit IRC18:16
*** erus_ has joined #openstack-keystone18:17
*** erus_ has quit IRC18:18
*** erus_ has joined #openstack-keystone18:19
*** erus_ has quit IRC18:20
gyeelbragstad, sounds good, just that file should work18:21
*** erus_ has joined #openstack-keystone18:21
openstackgerritLance Bragstad proposed openstack/keystone master: Allow domain users to access the registered limits API  https://review.openstack.org/62101718:24
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for project users interacting with registered limits  https://review.openstack.org/62101818:24
openstackgerritLance Bragstad proposed openstack/keystone master: Remove registered limit policies from policy.v3cloudsample.json  https://review.openstack.org/62101918:24
openstackgerritLance Bragstad proposed openstack/keystone master: Add limit protection tests  https://review.openstack.org/62102018:24
openstackgerritLance Bragstad proposed openstack/keystone master: Add limit tests for system member role  https://review.openstack.org/62102118:24
openstackgerritLance Bragstad proposed openstack/keystone master: Update limit policies for system admin  https://review.openstack.org/62102218:24
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with limits  https://review.openstack.org/62102318:24
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for project users interacting with limits  https://review.openstack.org/62102418:24
openstackgerritLance Bragstad proposed openstack/keystone master: Remove limit policies from policy.v3cloudsample.json  https://review.openstack.org/62102518:24
*** erus_ has quit IRC18:28
*** erus_ has joined #openstack-keystone18:29
*** erus_ has quit IRC18:30
*** erus_ has joined #openstack-keystone18:33
*** erus_ has quit IRC18:34
*** erus_ has joined #openstack-keystone18:36
*** erus_ has quit IRC18:38
*** erus_ has joined #openstack-keystone18:39
*** erus_ has quit IRC18:41
*** erus_ has joined #openstack-keystone18:42
*** lbragsta_ has joined #openstack-keystone18:52
*** ChanServ sets mode: +o lbragsta_18:52
*** lbragstad has quit IRC18:52
*** lbragsta_ is now known as lbragstad18:55
*** erus_ has quit IRC19:00
*** erus_ has joined #openstack-keystone19:01
*** erus_ has quit IRC19:03
*** erus_ has joined #openstack-keystone19:06
*** erus_ has quit IRC19:10
*** erus_ has joined #openstack-keystone19:11
*** erus_ has quit IRC19:13
*** erus_ has joined #openstack-keystone19:13
*** erus_ has joined #openstack-keystone19:15
*** vishakha has quit IRC19:16
*** erus_ has quit IRC19:16
*** erus_ has joined #openstack-keystone19:18
lbragstadwxy-xiyuan http://lists.openstack.org/pipermail/openstack-discuss/2019-January/001518.html our action item from last week19:21
*** erus_ has quit IRC19:21
*** erus_ has joined #openstack-keystone19:22
*** erus_ has quit IRC19:23
*** erus_ has joined #openstack-keystone19:27
*** erus_ has quit IRC19:28
lbragstadcmurphy i assume your +2 here means you're good with the wording of https://review.openstack.org/#/c/624217/4/releasenotes/notes/bug-1805403-c003627a64768716.yaml19:28
lbragstadif that's the case, i'll start respinning the other patches to match that wording19:28
*** erus_ has joined #openstack-keystone19:29
cmurphylbragstad: yeah I think it's fine, I'm not sure how to make it less of a wall of text while still making sure people get all the information they need19:29
*** erus_ has quit IRC19:29
lbragstadright - i had the same problem19:29
lbragstadclearly19:30
*** erus_ has joined #openstack-keystone19:30
*** erus_ has quit IRC19:31
*** erus_ has joined #openstack-keystone19:31
*** erus_ has quit IRC19:33
*** erus_ has joined #openstack-keystone19:36
*** erus_ has quit IRC19:37
*** erus_ has joined #openstack-keystone19:38
*** erus_ has quit IRC19:45
*** erus_ has joined #openstack-keystone19:46
*** erus_ has quit IRC19:49
*** erus_ has joined #openstack-keystone19:49
*** erus_ has quit IRC19:50
*** erus_ has joined #openstack-keystone19:51
*** erus_ has quit IRC19:52
mnaserlbragstad: did you end up taking a decision wrt role names in openstack?19:53
mnaseri'm looking at creating a role of a user that can access swift.. and i'd like it to be reusable19:53
mnaseraka we don't have to tell everyone to change all their stuff to continue to work :)19:53
lbragstadwe did19:53
*** erus_ has joined #openstack-keystone19:53
lbragstadkeystone-manage bootstrap creates three roles for you out of the box19:53
lbragstadadmin, member, and reader19:53
mnaserlbragstad: right, but what about service-specific roles, like say i want an account that have swift access only for example19:54
mnaserso a user can create an application credential for example which has that role included19:54
lbragstadoh - gotcha19:57
lbragstadso you mean being able to grant someone a role on the swift service?19:57
*** erus_ has quit IRC19:57
*** erus_ has joined #openstack-keystone19:58
mnaseryes, lbragstad19:58
cmurphywe don't have that yet19:58
*** erus_ has quit IRC19:59
lbragstadyeah - so being able to do that doesn't exist yet, but with the work cmurphy is doing, you should be able to make app creds specific to swift APIs19:59
mnaserso skillz_dat_swiftz as a role for now to a user is really the best way to go about it?19:59
*** erus_ has joined #openstack-keystone19:59
lbragstadyeah - that would work20:00
lbragstadif your solution isn't user specific, you could leverage the application credential whitelist stuff20:00
lbragstadhttp://specs.openstack.org/openstack/keystone-specs/specs/keystone/stein/capabilities-app-creds.html20:00
cmurphywell that would be use specific20:01
cmurphyit would be up to the user creating the application credential to restrict it20:01
*** erus_ has quit IRC20:01
cmurphyuser* specific20:01
*** gary_perkins has quit IRC20:01
mnaseroh yeah that's fine20:02
mnaserthat's so neat20:02
*** erus_ has joined #openstack-keystone20:02
lbragstadyeah - i guess it depends on how much you'd trust your users20:02
lbragstadbecause they'd need the role to scope things down20:02
mnaserso for now, it would be best to just add a 'swift' role20:02
mnaserand then when we have stein20:02
mnaserwe can have them switch over to using that20:02
mnaserand then get rid of swift role20:02
mordredyeah. that facet of the appcreds is awesoe20:03
*** erus_ has quit IRC20:03
mordredawesome20:03
lbragstadwell - if your swift capabilities require the 'member' role20:03
*** abhi89 has quit IRC20:03
lbragstadand you trust that to your users20:03
lbragstadbut the 'member' role also allows them to do things you do'20:03
mnaseryeah that's what we're tryin to avoid20:03
lbragstadyou don't necessarily want them to do*20:03
lbragstadthen you'll need to be cautious20:03
mnaserwe want to restrict to only swift20:03
lbragstadsince users will need the 'member' role to access swift20:04
mnaseryeah20:04
lbragstadin order to create app cred whitelists20:04
lbragstadbut if you use a 'swift' role and implies the 'member' role, and modify the policies accordingly, you should be good20:04
mnaserlbragstad: thats the plan, for now20:04
*** erus_ has joined #openstack-keystone20:05
lbragstadok - sweet20:05
*** erus_ has quit IRC20:05
mnaseri'll be ready to break the new appcred work :)20:06
lbragstadeventually - it would be neat to be able to do ``openstack role add --user mnaser --service compute admin``20:06
mnaseroooh that would be so neat20:06
lbragstador ``openstack role add --user bob --service swift reader``20:06
*** gary_perkins has joined #openstack-keystone20:06
*** erus_ has joined #openstack-keystone20:06
mnasernot enough minerals to get that20:06
mnaser:(20:06
lbragstadinoright?20:06
*** erus_ has quit IRC20:07
mnaserman20:07
lbragstade:you_must_construct_additional_pylons20:07
mnaserimplied roles are so sweet20:07
*** erus_ has joined #openstack-keystone20:07
*** erus_ has quit IRC20:08
lbragstadin case you're not aware yet - the admin, member, and reader roles have an implied relationship20:09
lbragstadwe had to do that by default20:09
*** erus_ has joined #openstack-keystone20:09
*** erus_ has quit IRC20:10
mnaserlbragstad: that's even cooler20:10
*** erus_ has joined #openstack-keystone20:11
*** erus_ has quit IRC20:12
*** erus_ has joined #openstack-keystone20:13
lbragstadyep - grabbing lunch quick20:13
*** jmlowe has quit IRC20:30
*** jmlowe has joined #openstack-keystone20:32
lbragstadback20:34
openstackgerritLance Bragstad proposed openstack/keystone master: Update protocol policies for system reader  https://review.openstack.org/62535220:40
openstackgerritLance Bragstad proposed openstack/keystone master: Add protocol tests for system member role  https://review.openstack.org/62535320:40
openstackgerritLance Bragstad proposed openstack/keystone master: Implement system admin role in protocol API  https://review.openstack.org/62535420:40
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with protocols  https://review.openstack.org/62535520:40
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for project users interacting with protocols  https://review.openstack.org/62535620:41
openstackgerritLance Bragstad proposed openstack/keystone master: Remove protocol policies from v3cloudsample.json  https://review.openstack.org/62535720:41
*** spsurya has quit IRC20:41
openstackgerritLance Bragstad proposed openstack/keystone master: Reuse common system role definitions for roles API  https://review.openstack.org/62602320:49
openstackgerritLance Bragstad proposed openstack/keystone master: Update role policies for system admin  https://review.openstack.org/62252620:49
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with roles  https://review.openstack.org/62252720:49
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for project users interacting with roles  https://review.openstack.org/62252820:49
openstackgerritLance Bragstad proposed openstack/keystone master: Remove role policies from policy.v3cloudsample.json  https://review.openstack.org/62252920:49
openstackgerritLance Bragstad proposed openstack/keystone master: Add region protection tests for system readers  https://review.openstack.org/61908520:55
openstackgerritLance Bragstad proposed openstack/keystone master: Add region tests for system member role  https://review.openstack.org/61908620:55
openstackgerritLance Bragstad proposed openstack/keystone master: Update region policies to use system admin  https://review.openstack.org/61924120:55
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with regions  https://review.openstack.org/61924220:55
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for project users interacting with regions  https://review.openstack.org/61924320:55
openstackgerritLance Bragstad proposed openstack/keystone master: Remove region policies from policy.v3cloudsample.json  https://review.openstack.org/61924420:55
*** xek has quit IRC21:02
*** xek has joined #openstack-keystone21:02
*** raildo has quit IRC21:25
*** erus_ has quit IRC21:29
*** erus has quit IRC21:33
*** erus has joined #openstack-keystone21:35
*** aojea_ has joined #openstack-keystone21:42
*** aojea_ has quit IRC21:43
*** aojea__ has joined #openstack-keystone21:43
*** aojea__ has quit IRC21:54
*** aojea_ has joined #openstack-keystone21:56
*** erus has quit IRC22:02
openstackgerritLance Bragstad proposed openstack/keystone master: Update idp policies for system reader  https://review.openstack.org/61937122:16
openstackgerritLance Bragstad proposed openstack/keystone master: Add idp tests for system member role  https://review.openstack.org/61937222:16
openstackgerritLance Bragstad proposed openstack/keystone master: Update idp policies for system admin  https://review.openstack.org/61937322:16
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with idps  https://review.openstack.org/61937422:16
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for project users interacting with idps  https://review.openstack.org/61937522:16
openstackgerritLance Bragstad proposed openstack/keystone master: Remove idp policies from policy.v3cloudsample.json  https://review.openstack.org/61937622:16
openstackgerritLance Bragstad proposed openstack/keystone master: Update mapping policies for system reader  https://review.openstack.org/61961222:27
openstackgerritLance Bragstad proposed openstack/keystone master: Add mapping tests for system member role  https://review.openstack.org/61961322:27
openstackgerritLance Bragstad proposed openstack/keystone master: Update mapping policies for system admin  https://review.openstack.org/61961422:27
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with mappings  https://review.openstack.org/61961522:27
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for project users interacting with mappings  https://review.openstack.org/61961622:27
openstackgerritLance Bragstad proposed openstack/keystone master: Remove mapping policies from policy.v3cloudsample.json  https://review.openstack.org/61961722:27
openstackgerritLance Bragstad proposed openstack/keystone master: Update endpoint policies for system reader  https://review.openstack.org/61932922:33
openstackgerritLance Bragstad proposed openstack/keystone master: Add endpoint tests for system member role  https://review.openstack.org/61933022:33
openstackgerritLance Bragstad proposed openstack/keystone master: Update endpoint  policies for system admin  https://review.openstack.org/61933122:33
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with endpoints  https://review.openstack.org/61933222:33
openstackgerritLance Bragstad proposed openstack/keystone master: Add tests for project users interacting with endpoints  https://review.openstack.org/61928122:33
openstackgerritLance Bragstad proposed openstack/keystone master: Remove endpoint policies from policy.v3cloudsample.json  https://review.openstack.org/61933322:33
*** erus_ has joined #openstack-keystone22:41
*** itlinux has quit IRC22:48
*** rcernin has joined #openstack-keystone22:53
*** erus has joined #openstack-keystone23:13
*** aojea_ has quit IRC23:29
« Monday, 2019-01-07 Index Wednesday, 2019-01-09 »

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!