| openstackgerrit | Merged openstack/keystone master: Update idp policies for system reader https://review.openstack.org/619371 | 00:04 |
|---|---|---|
| *** efried has joined #openstack-keystone | 00:05 | |
| openstackgerrit | Merged openstack/keystone master: Add limit protection tests https://review.openstack.org/621020 | 00:12 |
| kmalloc | efried: https://docs.openstack.org/nova/latest/configuration/config.html#placement.auth_type is, i think, what you're mapping of the plugin to be is. | 00:15 |
| *** dklyle has joined #openstack-keystone | 00:21 | |
| openstackgerrit | Merged openstack/keystone master: Add limit tests for system member role https://review.openstack.org/621021 | 00:22 |
| *** spsurya has quit IRC | 00:26 | |
| *** david-lyle has joined #openstack-keystone | 00:27 | |
| *** dklyle has quit IRC | 00:30 | |
| *** ileixe has joined #openstack-keystone | 00:50 | |
| *** ileixe has quit IRC | 00:52 | |
| *** ileixe has joined #openstack-keystone | 00:53 | |
| openstackgerrit | Merged openstack/oslo.policy master: Add policy-upgrade tool https://review.openstack.org/613906 | 01:02 |
| *** david-lyle has quit IRC | 01:14 | |
| *** lbragstad has quit IRC | 01:52 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:55 | |
| *** Dinesh_Bhor has quit IRC | 02:00 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:03 | |
| *** erus_ has quit IRC | 02:24 | |
| *** lbragstad has joined #openstack-keystone | 02:33 | |
| *** ChanServ sets mode: +o lbragstad | 02:33 | |
| *** Dinesh_Bhor has quit IRC | 03:04 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 03:07 | |
| *** tkajinam_ has joined #openstack-keystone | 03:13 | |
| *** tkajinam has quit IRC | 03:16 | |
| *** vishwanathj has joined #openstack-keystone | 03:20 | |
| *** awalende has joined #openstack-keystone | 03:41 | |
| *** awalende has quit IRC | 03:45 | |
| *** Dinesh_Bhor has quit IRC | 03:58 | |
| *** imacdonn_ has quit IRC | 04:12 | |
| *** ileixe has quit IRC | 04:22 | |
| *** whoami-rajat has joined #openstack-keystone | 04:35 | |
| *** ileixe has joined #openstack-keystone | 04:55 | |
| *** tkajinam_ is now known as tkajinam | 04:57 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:58 | |
| *** shyamb has joined #openstack-keystone | 05:00 | |
| openstackgerrit | Sergey Vilgelm proposed openstack/keystone master: Fix list projects for user https://review.openstack.org/632565 | 05:02 |
| *** shyamb has quit IRC | 05:09 | |
| openstackgerrit | Sergey Vilgelm proposed openstack/keystone master: Fix list projects for user https://review.openstack.org/632565 | 05:16 |
| *** shyamb has joined #openstack-keystone | 05:19 | |
| *** dave-mccowan has quit IRC | 05:22 | |
| *** spsurya has joined #openstack-keystone | 06:08 | |
| *** shyamb has quit IRC | 06:19 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/python-keystoneclient master: Make default interface 'internal' instead of 'admin' https://review.openstack.org/632520 | 06:40 |
| *** shyamb has joined #openstack-keystone | 06:50 | |
| *** aojea has joined #openstack-keystone | 07:03 | |
| *** lbragstad has quit IRC | 07:06 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/python-keystoneclient master: Make default interface 'internal' instead of 'admin' https://review.openstack.org/632520 | 07:10 |
| openstackgerrit | Merged openstack/keystone master: bump Keystone version for Stein https://review.openstack.org/631369 | 07:14 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Ensure change is addressed for unified limit table https://review.openstack.org/621497 | 07:24 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain_id column for limit https://review.openstack.org/620202 | 07:24 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain level limit support - Manager https://review.openstack.org/621468 | 07:24 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain level limit support - API https://review.openstack.org/622773 | 07:24 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain level support for strict-two-level-model https://review.openstack.org/623153 | 07:24 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Update project depth check https://review.openstack.org/623984 | 07:24 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Release note for domain level limit https://review.openstack.org/624019 | 07:24 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [api-ref] add domain level limit support https://review.openstack.org/624562 | 07:24 |
| *** vishwanathj has quit IRC | 07:28 | |
| *** aojea has quit IRC | 07:28 | |
| *** aojea has joined #openstack-keystone | 07:29 | |
| *** aojea has quit IRC | 07:31 | |
| *** shyamb has quit IRC | 07:53 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/python-keystoneclient master: Make default interface 'internal' instead of 'admin' https://review.openstack.org/632520 | 08:00 |
| *** awalende has joined #openstack-keystone | 08:00 | |
| *** rcernin has quit IRC | 08:04 | |
| *** tkajinam has quit IRC | 08:10 | |
| *** Dinesh_Bhor has quit IRC | 08:31 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 08:34 | |
| *** markvoelker has joined #openstack-keystone | 08:47 | |
| *** markvoelker has quit IRC | 08:53 | |
| *** xek_ has joined #openstack-keystone | 08:54 | |
| *** shyamb has joined #openstack-keystone | 09:03 | |
| *** jaosorior has quit IRC | 09:05 | |
| *** jaosorior has joined #openstack-keystone | 09:08 | |
| *** awalende has quit IRC | 09:26 | |
| *** awalende has joined #openstack-keystone | 09:29 | |
| *** awalende has quit IRC | 09:33 | |
| *** awalende has joined #openstack-keystone | 09:35 | |
| *** shyamb has quit IRC | 09:36 | |
| *** shyamb has joined #openstack-keystone | 09:37 | |
| *** markvoelker has joined #openstack-keystone | 09:49 | |
| *** awalende has quit IRC | 09:54 | |
| *** awalende has joined #openstack-keystone | 09:55 | |
| *** awalende has quit IRC | 09:57 | |
| *** awalende has joined #openstack-keystone | 09:57 | |
| *** awalende has quit IRC | 10:00 | |
| *** awalende has joined #openstack-keystone | 10:01 | |
| *** awalende has quit IRC | 10:06 | |
| *** Dinesh_Bhor has quit IRC | 10:15 | |
| *** shyamb has quit IRC | 10:16 | |
| *** shyamb has joined #openstack-keystone | 10:19 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 10:20 | |
| *** Dinesh_Bhor has quit IRC | 10:21 | |
| *** markvoelker has quit IRC | 10:22 | |
| *** awalende has joined #openstack-keystone | 10:23 | |
| *** awalende has quit IRC | 10:27 | |
| *** awalende has joined #openstack-keystone | 10:27 | |
| *** awalende_ has joined #openstack-keystone | 10:29 | |
| *** shyamb has quit IRC | 10:32 | |
| *** awalende has quit IRC | 10:32 | |
| *** pcaruana has joined #openstack-keystone | 10:37 | |
| *** andreaf has quit IRC | 10:54 | |
| *** andreaf has joined #openstack-keystone | 10:56 | |
| *** ileixe has quit IRC | 10:59 | |
| *** shyamb has joined #openstack-keystone | 11:10 | |
| *** yan0s has joined #openstack-keystone | 11:15 | |
| *** markvoelker has joined #openstack-keystone | 11:20 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 11:35 | |
| *** Dinesh_Bhor has quit IRC | 11:40 | |
| *** markvoelker has quit IRC | 11:52 | |
| openstackgerrit | Merged openstack/keystone master: Add region protection tests for system readers https://review.openstack.org/619085 | 12:10 |
| openstackgerrit | Merged openstack/keystone master: Fix wrong urls https://review.openstack.org/631779 | 12:10 |
| *** erus_ has joined #openstack-keystone | 12:37 | |
| *** shyam89 has joined #openstack-keystone | 12:41 | |
| *** shyamb has quit IRC | 12:45 | |
| *** markvoelker has joined #openstack-keystone | 12:49 | |
| *** erus_ has quit IRC | 12:49 | |
| *** erus_ has joined #openstack-keystone | 12:50 | |
| *** shyamb has joined #openstack-keystone | 13:00 | |
| *** shyam89 has quit IRC | 13:02 | |
| *** shyamb has quit IRC | 13:20 | |
| *** erus_ has quit IRC | 13:20 | |
| *** erus_ has joined #openstack-keystone | 13:21 | |
| *** markvoelker has quit IRC | 13:22 | |
| *** markvoelker has joined #openstack-keystone | 13:23 | |
| *** markvoelker has quit IRC | 13:30 | |
| knikolla | o/ | 13:35 |
| erus_ | \o | 13:42 |
| *** dave-mccowan has joined #openstack-keystone | 13:43 | |
| cmurphy | o/ | 13:56 |
| *** lbragstad has joined #openstack-keystone | 14:19 | |
| *** ChanServ sets mode: +o lbragstad | 14:19 | |
| *** xek_ is now known as xek | 14:58 | |
| *** efried has quit IRC | 15:08 | |
| *** aojea_ has joined #openstack-keystone | 15:12 | |
| *** dklyle has joined #openstack-keystone | 15:17 | |
| *** awalende_ has quit IRC | 15:25 | |
| *** awalende has joined #openstack-keystone | 15:25 | |
| *** awalende has quit IRC | 15:30 | |
| *** efried has joined #openstack-keystone | 15:30 | |
| *** aojea_ has quit IRC | 15:31 | |
| *** mchlumsky has joined #openstack-keystone | 15:37 | |
| *** mchlumsky has quit IRC | 15:41 | |
| *** mchlumsky has joined #openstack-keystone | 15:42 | |
| jaosorior | ayoung: regarding https://review.openstack.org/#/c/632520/ . the other option is to use the public endpoint. | 15:45 |
| jaosorior | what do you think? | 15:45 |
| ayoung | jaosorior, why does it matter? We should publish all three endpoints pointing at the same URL and not break anyone | 15:46 |
| *** efried has left #openstack-keystone | 15:47 | |
| *** erus_ has quit IRC | 15:47 | |
| jaosorior | I'm still dubious about doing that. I'm pretty sure that's gonna break folks. That's why I'm trying to do this in a phased manner | 15:47 |
| *** erus_ has joined #openstack-keystone | 15:47 | |
| ayoung | jaosorior, break TripleO? | 15:48 |
| jaosorior | no, but folks integrating with it | 15:49 |
| jaosorior | like NFVis (pretty sure I've seen some instances of hardcoded 35357) | 15:49 |
| ayoung | Sucks to be them | 15:51 |
| ayoung | They are not getting that out of the service catalog anyway, so if they do that, there is nothing we can do about it\ | 15:51 |
| ayoung | and we can claim we've told people not to do that for years now | 15:52 |
| *** jmlowe has joined #openstack-keystone | 15:59 | |
| *** erus_ has quit IRC | 15:59 | |
| openstackgerrit | Merged openstack/keystone master: Allow project users to retrieve domains https://review.openstack.org/605871 | 15:59 |
| *** jmlowe has quit IRC | 16:00 | |
| *** erus_ has joined #openstack-keystone | 16:00 | |
| *** dklyle has quit IRC | 16:02 | |
| *** jmlowe has joined #openstack-keystone | 16:06 | |
| *** erus_ has quit IRC | 16:06 | |
| *** erus_ has joined #openstack-keystone | 16:06 | |
| *** gyee has joined #openstack-keystone | 16:23 | |
| *** dklyle has joined #openstack-keystone | 16:24 | |
| *** erus_ has quit IRC | 16:24 | |
| *** erus_ has joined #openstack-keystone | 16:25 | |
| *** ayoung has quit IRC | 16:38 | |
| *** dklyle has quit IRC | 16:55 | |
| *** erus_ has quit IRC | 16:55 | |
| *** dklyle has joined #openstack-keystone | 16:56 | |
| *** erus_ has joined #openstack-keystone | 16:56 | |
| *** dklyle has quit IRC | 17:01 | |
| *** dklyle has joined #openstack-keystone | 17:01 | |
| *** dklyle has quit IRC | 17:13 | |
| kmalloc | jaosorior: i contradict ayoung saying "it sucks to be them". realisistically we need to communicate to those folks "hard coded ports / urls are not the correct way to do it... here is the correct fix" | 17:16 |
| kmalloc | jaosorior: but... we are moving towards port 80/443 in general. downstream (e.g. triple-o and things based on triple-o) should likewise push hard to not use the high-ports. | 17:16 |
| lbragstad | we do have some documentation around this - specifically for external developers, but it might be applicable elsewhere, too | 17:19 |
| lbragstad | https://docs.openstack.org/keystone/latest/contributor/service-catalog.html | 17:19 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs master: Renewable Application Credentials https://review.openstack.org/604201 | 17:22 |
| kmalloc | cmurphy: ^ corrected the nits and i agree, lgtm | 17:22 |
| kmalloc | cmurphy: +2 on the spec. | 17:22 |
| kmalloc | knikolla: ^ | 17:23 |
| kmalloc | lbragstad: ^ | 17:23 |
| *** awalende has joined #openstack-keystone | 17:26 | |
| *** awalende has quit IRC | 17:31 | |
| lbragstad | cool | 17:39 |
| lbragstad | cmurphy did you follow these steps verbatim https://docs.openstack.org/keystone/latest/admin/configure_tokenless_x509.html#create-an-identity-provider-idp ? | 17:39 |
| lbragstad | specifically to hash the id for the identity provider? | 17:39 |
| *** dklyle has joined #openstack-keystone | 17:39 | |
| lbragstad | i've created the private key, csr, and used them to create a certificate | 17:40 |
| lbragstad | i went through the steps to hash the id for the identity provider | 17:40 |
| lbragstad | but when i make the request to keystone, i get an HTTP 404 saying the identity provider can't be found (so i feel like i hashed something wrong) | 17:41 |
| lbragstad | trace back - https://pasted.tech/pastes/b7ca33afa541c2a5808e0cdc4fd38bc46b0c79a4.raw | 17:41 |
| lbragstad | code i'm using to hash the id - https://gist.github.com/lbragstad/5338e8bfdcc1158ceaedffd4036e671e | 17:42 |
| lbragstad | resulting hash - https://pasted.tech/pastes/db251e70dc4af45f3a085b9f9f589bd1251993e8.raw | 17:43 |
| lbragstad | fwiw - i wrote that script based on the format in the docs | 17:44 |
| lbragstad | (e.g., no spaces and using a specific ordering) | 17:44 |
| *** dklyle has quit IRC | 17:48 | |
| *** yan0s has quit IRC | 17:51 | |
| *** jmlowe has quit IRC | 17:58 | |
| *** jmlowe has joined #openstack-keystone | 18:00 | |
| lbragstad | bah - nevermind... | 18:10 |
| lbragstad | keystone is hashing CONF.tokenless_auth.trusted_issuer | 18:11 |
| lbragstad | i'm not sure if that's clear from the documentation though | 18:11 |
| * lbragstad steps away for a minute | 18:13 | |
| *** dklyle has joined #openstack-keystone | 18:24 | |
| *** aojea has joined #openstack-keystone | 18:27 | |
| *** aojea has quit IRC | 18:29 | |
| *** dklyle has quit IRC | 18:29 | |
| *** aojea has joined #openstack-keystone | 18:30 | |
| cmurphy | lbragstad: i created the hash using the devstack root ca not the client cert info | 18:33 |
| *** erus_ has quit IRC | 18:33 | |
| *** erus_ has joined #openstack-keystone | 18:34 | |
| cmurphy | oh yeah trusted_issuer also needed | 18:34 |
| cmurphy | docs are super confusing on this | 18:34 |
| *** dklyle has joined #openstack-keystone | 18:48 | |
| jrosser | kmalloc: before Christmas we chatted about radosgw s3 auth caching, here is our PR against ceph to implement that https://github.com/ceph/ceph/pull/26095 | 18:52 |
| *** erus_ has quit IRC | 18:52 | |
| *** erus_ has joined #openstack-keystone | 18:53 | |
| jrosser | kmalloc: thanks for the pointer to the swift s3 midddleware, that was really helpful figuring this out | 18:53 |
| *** dklyle has quit IRC | 18:54 | |
| *** mugsie has quit IRC | 18:55 | |
| *** mugsie has joined #openstack-keystone | 18:57 | |
| lbragstad | cmurphy very... | 19:12 |
| lbragstad | i kinda wanted to not read the code so that i could get a real perspective on how operators would interpret all this | 19:12 |
| lbragstad | but i eventually had to crack the lid | 19:13 |
| kmalloc | jrosser: :) cool! | 19:17 |
| kmalloc | jrosser: glad it helped! | 19:17 |
| lbragstad | cmurphy also - the way the docs are written make it seem like trust_issuer should be every user in the deployment? | 19:25 |
| lbragstad | gyee's name is on the spec, too | 19:26 |
| lbragstad | i wonder if he knows | 19:26 |
| gyee | lbragstad, trusted issuer is per IdP | 19:41 |
| lbragstad | ok - so you setup on one trusted issuer based on some CA | 19:42 |
| lbragstad | because you trust the CA | 19:42 |
| gyee | correct | 19:42 |
| lbragstad | ok | 19:42 |
| lbragstad | cool | 19:42 |
| lbragstad | i was reading the examples and it looked like it was per user | 19:42 |
| lbragstad | which blew my mind | 19:42 |
| gyee | CA = trusted issuer = IdP | 19:43 |
| lbragstad | got it - that's what i was hoping for | 19:43 |
| lbragstad | but looking at "trusted_issuer = emailAddress=john@openstack.com,CN=john,OU=keystone,O=openstack,L=Sunnyvale,ST=California,C=US" in the docs | 19:43 |
| lbragstad | https://docs.openstack.org/keystone/latest/admin/configure_tokenless_x509.html#create-an-identity-provider-idp | 19:43 |
| lbragstad | i got confused | 19:43 |
| lbragstad | because that also appears to be the subject of a certificate | 19:44 |
| lbragstad | in those examples | 19:44 |
| gyee | I had the whole thing setup in a vagrant VM awhile back, let me see if I can update it and push it to github or something | 19:44 |
| gyee | pretty sure its outdated | 19:44 |
| lbragstad | i wouldn't be opposed to breaking that doc up a bit | 19:45 |
| lbragstad | some of it is related to how administrators should configure this | 19:45 |
| lbragstad | and other bits would be useful in the user guide | 19:45 |
| gyee | oh yeah, I see what you're saying | 19:45 |
| gyee | I think that example is bad | 19:45 |
| lbragstad | (e.g., you have a private key given to you from a trust issuers, how do you use it) | 19:45 |
| lbragstad | trusted* | 19:45 |
| gyee | we need to update the doc with a more intuitive example | 19:45 |
| lbragstad | ++ | 19:45 |
| gyee | let me do that | 19:46 |
| lbragstad | i'm going to open a bug, too | 19:46 |
| gyee | assign it to me :-) | 19:46 |
| gyee | I'll take care of it | 19:46 |
| *** xek has quit IRC | 19:50 | |
| *** dklyle has joined #openstack-keystone | 19:50 | |
| *** xek has joined #openstack-keystone | 19:50 | |
| lbragstad | gyee just opened it - https://bugs.launchpad.net/keystone/+bug/1813057 | 19:51 |
| openstack | Launchpad bug 1813057 in OpenStack Identity (keystone) "The tokenless authentication documentation is opaque" [Medium,Triaged] | 19:51 |
| lbragstad | it's a little sparse, but i include a couple things that would be useful to address with it | 19:52 |
| lbragstad | thanks gyee ! | 19:52 |
| *** dklyle has quit IRC | 19:53 | |
| gyee | lbragstad, got it | 19:54 |
| *** spsurya has quit IRC | 19:55 | |
| *** aojea has quit IRC | 20:03 | |
| *** aojea has joined #openstack-keystone | 20:04 | |
| *** dklyle has joined #openstack-keystone | 20:20 | |
| *** dklyle has quit IRC | 20:29 | |
| *** jmlowe has quit IRC | 20:31 | |
| *** jmlowe has joined #openstack-keystone | 20:34 | |
| *** dklyle has joined #openstack-keystone | 20:49 | |
| lbragstad | gyee i'm not sure if there are better ways to do this with ssl but this what i have scripted | 20:58 |
| lbragstad | https://gist.github.com/lbragstad/5338e8bfdcc1158ceaedffd4036e671e | 20:58 |
| lbragstad | one is for figuring out the hash and the other is for re-ordering the issuer's dn so that you can put it into config | 20:59 |
| lbragstad | when you use openssl to verify a certificate, you get the issuer information, but when it comes through keystone via mod_ssl (i assume?) it appears to be in a different order | 21:00 |
| *** dklyle has quit IRC | 21:10 | |
| *** timothyb89 has joined #openstack-keystone | 21:12 | |
| *** awalende has joined #openstack-keystone | 21:22 | |
| *** dklyle has joined #openstack-keystone | 21:22 | |
| *** awalende has quit IRC | 21:26 | |
| *** aojea_ has joined #openstack-keystone | 21:27 | |
| *** aojea has quit IRC | 21:28 | |
| *** dklyle has quit IRC | 21:28 | |
| lbragstad | gyee also - i'm not sure i can get a scoped token using tokenless auth? | 21:32 |
| *** erus_ has quit IRC | 21:32 | |
| lbragstad | i can authenticate - but only for unscoped tokens, regardless of what i put in the X-Project-Id header | 21:32 |
| *** erus_ has joined #openstack-keystone | 21:33 | |
| lbragstad | for example https://pasted.tech/pastes/be93bfd4b23e1f7bfd2fac96d4c7f078cd8ac5a5.raw | 21:34 |
| *** xek has quit IRC | 21:35 | |
| gyee | lbragstad, you should be able to get a scoped token | 21:35 |
| lbragstad | role assignments https://pasted.tech/pastes/86fb28c62daad36b1fdd77eabdbc02d3363d0e3e.raw | 21:36 |
| lbragstad | afaict john has a role assignment on the demo project | 21:36 |
| *** gagehugo has quit IRC | 21:38 | |
| *** erus_ has quit IRC | 21:38 | |
| gyee | sorry I mean it follows the federation spec | 21:38 |
| gyee | if mapping allows scoped token, the it should work | 21:39 |
| *** erus_ has joined #openstack-keystone | 21:39 | |
| lbragstad | oh - so tokenless authentication doesn't honor direct role assignments? | 21:40 |
| gyee | though I haven't tested it lately so its possible that something is broken | 21:40 |
| gyee | if mapping allows it, then in theory it should work | 21:40 |
| lbragstad | fwiw - this is what i'm using for a mapping https://pasted.tech/pastes/9ffb6d16e6eeb6913614d85583bbd08574108e1c.raw | 21:41 |
| gyee | its basically whenever token that the mapping yield | 21:41 |
| gyee | that's mapping for an unscoped token | 21:41 |
| lbragstad | ah | 21:42 |
| gyee | can you trying adding group or project mapping to see if it works? | 21:42 |
| lbragstad | yep | 21:42 |
| lbragstad | lemme try that quick | 21:42 |
| *** dklyle has joined #openstack-keystone | 21:42 | |
| *** whoami-rajat has quit IRC | 21:45 | |
| *** erus_ has quit IRC | 21:45 | |
| *** erus_ has joined #openstack-keystone | 21:45 | |
| lbragstad | strange | 21:48 |
| gyee | lbragstad, so there are two separate things with x.509 certs. 1) certificate authenticate (i.e. cert for token); and 2) tokenless (cert directly authorized to perform keystone operations) | 21:49 |
| lbragstad | the keystone logs appear to be building role assignments | 21:49 |
| lbragstad | right now - i'm trying to do #1 | 21:49 |
| gyee | what you are testing is the former | 21:49 |
| gyee | right, so that's strictly federation | 21:50 |
| gyee | so if mapping allows it, then it should yield a federated token | 21:50 |
| *** dklyle has quit IRC | 22:01 | |
| *** rcernin has joined #openstack-keystone | 22:03 | |
| *** gagehugo has joined #openstack-keystone | 22:09 | |
| lbragstad | gyee trying again with the autoprovisioned mapping stuff | 22:16 |
| *** erus_ has quit IRC | 22:16 | |
| lbragstad | the mapping validation keeps failing with the examples we have in docs, we should probably fix that, too | 22:16 |
| *** erus_ has joined #openstack-keystone | 22:17 | |
| gyee | yeah I figure, things has changed quite a bit since I last touched that feature | 22:18 |
| gyee | I'll spend some quality time on it | 22:18 |
| lbragstad | https://etherpad.openstack.org/p/keystone-tokenless-auth-documentation-overhaul | 22:21 |
| lbragstad | Trying to take some notes here | 22:21 |
| *** jmlowe has quit IRC | 22:21 | |
| *** jmlowe has joined #openstack-keystone | 22:24 | |
| gyee | lbragstad, slides from the talk back in the days https://docs.google.com/presentation/d/1cBgiKb0ZgdKaBRfj77N7vEu4OwSma0FK57nKg4u5D-k/edit#slide=id.p11 | 22:24 |
| lbragstad | oh - sweet | 22:25 |
| gyee | that's basically answers the why and how | 22:25 |
| *** dave-mccowan has quit IRC | 22:25 | |
| lbragstad | slide 8 is helpful | 22:26 |
| lbragstad | er - slide 5 | 22:27 |
| gyee | I want to update those slides and give another talk in Denver but haven't managed to find the time | 22:29 |
| *** erus_ has quit IRC | 22:29 | |
| *** erus_ has joined #openstack-keystone | 22:29 | |
| lbragstad | james would have found this useful | 22:30 |
| rodrigods | just submitted a couple of talks to the summit | 22:37 |
| rodrigods | hopefully i will be there :fingers_crossed: (too much slack these days) | 22:37 |
| gyee | that's your golden ticket :-) | 22:39 |
| rodrigods | lol | 22:40 |
| *** tkajinam has joined #openstack-keystone | 22:59 | |
| *** mchlumsky has quit IRC | 23:04 | |
| *** aojea_ has quit IRC | 23:13 | |
| lbragstad | gyee if a users authenticates with x509 certs and uses their private key for ssl | 23:15 |
| lbragstad | would it be possible for them to sign their requests with the same private key? | 23:15 |
| gyee | sure, if the key usage allows them to | 23:17 |
| lbragstad | so | 23:18 |
| lbragstad | let me know if i'm talking crazy here | 23:18 |
| lbragstad | but - if that's the case, could users authenticate for tokens with their x509 certificate, then issue signed requests to any openstack service to get around the bearer token problem? | 23:19 |
| *** erus_ has quit IRC | 23:19 | |
| gyee | in theory, yes | 23:19 |
| *** erus_ has joined #openstack-keystone | 23:19 | |
| *** jmlowe has quit IRC | 23:19 | |
| lbragstad | huh... sweet | 23:19 |
| gyee | in fact, I remember at one point, we were talking about that design | 23:20 |
| gyee | where Keystone doesn't have to issue tokens, just store the authorization templates | 23:20 |
| lbragstad | what would be an example of an authorization template? | 23:20 |
| gyee | mapping | 23:21 |
| lbragstad | oh - got it | 23:21 |
| gyee | service just fetch the mapping from keystone and mapping the cert to auth context | 23:21 |
| lbragstad | right | 23:21 |
| lbragstad | even if you did still have to deal with tokens | 23:22 |
| lbragstad | if requests are signed and a bad actor tries to reuse your token, the signature isn't going to match | 23:22 |
| gyee | exactly, you could just sign the token with the private key for the extra protection | 23:23 |
| lbragstad | oh, interesting... | 23:24 |
| lbragstad | i suppose you could do it both ways | 23:24 |
| lbragstad | either 1.) sign the entire request or 2.) just sign the token | 23:24 |
| lbragstad | if OpenStack-Token-Signature is populated, then you'd have to find the users public key to validate the token with it in middleware somehow | 23:25 |
| *** erus_ has quit IRC | 23:25 | |
| gyee | signing the entire request is a bit tough, depending on the API | 23:26 |
| *** erus_ has joined #openstack-keystone | 23:26 | |
| gyee | you'll need to figure out how to assemble the content for signing, like canonicalize the data | 23:27 |
| lbragstad | yeah - i suppose it'll have to be serialized the same on both sides | 23:28 |
| gyee | exactly | 23:28 |
| lbragstad | you'd still have to find a way to get a user's public key in middleware | 23:29 |
| gyee | public key is with the cert | 23:31 |
| *** vishakha has quit IRC | 23:31 | |
| lbragstad | in keystonemiddleware? | 23:31 |
| gyee | that you can either store in Keystone or LDAP | 23:31 |
| lbragstad | e.g., if we wanted to verify the token signature + token presented to nova in keystonemiddleware | 23:32 |
| gyee | with two way SSL, the cert is sent to the peer | 23:32 |
| lbragstad | ahhh | 23:33 |
| *** dklyle has joined #openstack-keystone | 23:34 | |
| gyee | https://httpd.apache.org/docs/2.4/mod/mod_ssl.html | 23:36 |
| gyee | with Apache mod_ssl, for example, you can find it in SSL_CENT_CERT env var | 23:36 |
| lbragstad | nice | 23:38 |
| *** dklyle has quit IRC | 23:40 | |
| gyee | I was going to do a prototype with FreeIPA, end to end, but that project got scraped | 23:41 |
| gyee | maybe its time to restart that thing again :-) | 23:42 |
| lbragstad | :) | 23:43 |
| lbragstad | it would be cool to see | 23:44 |
| *** dklyle has joined #openstack-keystone | 23:54 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!