| *** aloga has quit IRC | 00:12 | |
| *** aloga has joined #openstack-keystone | 00:25 | |
| *** dklyle has quit IRC | 00:42 | |
| *** ileixe has joined #openstack-keystone | 00:53 | |
| *** erus_ has quit IRC | 01:22 | |
| eandersson | lbragstad, do you know the state of s3/ec3 tokens with keystone/rocky? | 01:25 |
|---|---|---|
| eandersson | We are unable to get it working in Rocky. | 01:26 |
| *** whoami-rajat has joined #openstack-keystone | 01:53 | |
| lbragstad | eandersson what kind of issues are you seeing? | 02:03 |
| lbragstad | i'm not aware of anything, but iirc the testing isn't that great for those | 02:03 |
| eandersson | Still pretty early in the investigation, but we basically had Keystone Mitaka with Swift Rocky and it worked fine. | 02:04 |
| eandersson | After upgrading Keystone to Rocky, we can still create / list s3/ec2 credentials | 02:04 |
| eandersson | but Swift fails to authenticate | 02:04 |
| eandersson | Setting up a lab env now so we can get more logs | 02:05 |
| lbragstad | hmm | 02:05 |
| lbragstad | does swift have middleware that changed? | 02:05 |
| eandersson | So that was my first instict as they recently merged swift3 | 02:06 |
| lbragstad | we used to maintain s3 middleware in keystone for swift, but after some time i thought it was pulled under their repos | 02:06 |
| eandersson | but confirmed the swift config is correct | 02:06 |
| lbragstad | huh | 02:06 |
| eandersson | and the only thing that changed was keystone | 02:06 |
| lbragstad | but you're still able to get s3 tokens? | 02:06 |
| lbragstad | using keystone/rocky? | 02:06 |
| eandersson | Yea | 02:06 |
| lbragstad | did the responses change at all (they shouldn't have)? | 02:07 |
| lbragstad | between stable/mitaka and stable/rockY? | 02:07 |
| eandersson | not that we can see, but far from an expert | 02:07 |
| eandersson | I am trying to figure out how to use a s3/ec2 token manually against keystone | 02:07 |
| eandersson | was looking for a tempest test or similar to use as a reference | 02:07 |
| lbragstad | afaik there isn't any s3 tempest testing | 02:08 |
| lbragstad | but i could be wrong | 02:08 |
| eandersson | Yea wasn't able to find one :p | 02:08 |
| lbragstad | i'm not all that familiar with the s3 middlware swift maintains, but isn't not doing anything crazy outside of validating the token against keystone is ti? | 02:09 |
| eandersson | not that I am aware | 02:09 |
| eandersson | https://github.com/openstack/swift/tree/master/swift/common/middleware/s3api | 02:09 |
| lbragstad | dumb question: you're using v3, right? | 02:10 |
| eandersson | Yea | 02:11 |
| eandersson | We disabled v2 before the upgrade | 02:11 |
| lbragstad | ok | 02:11 |
| lbragstad | i was just looking at https://github.com/openstack/swift3/blob/master/swift3/s3_token_middleware.py | 02:11 |
| lbragstad | is swift3 just used in front of swift or is the in-tree version used? | 02:14 |
| eandersson | swift3 is legacy, in-tree version is used now | 02:14 |
| lbragstad | ah | 02:14 |
| lbragstad | are you seeing a 401? | 02:14 |
| lbragstad | or something else? | 02:15 |
| eandersson | 401 | 02:15 |
| lbragstad | interesting | 02:16 |
| lbragstad | nothing is jumping out at me off the top of my head | 02:18 |
| lbragstad | i'd be curious to know if you get more logs | 02:18 |
| eandersson | We are gonna re-create it in the lab tomorrow | 02:18 |
| eandersson | I can probably provide some logs from that | 02:18 |
| lbragstad | sounds good | 02:24 |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:27 | |
| eandersson | > Keystone reply error: status=404 reason=Not Found | 02:49 |
| eandersson | > Received error, rejecting request with error: 401 Unauthorized | 02:49 |
| eandersson | nvm lab specific | 02:50 |
| openstackgerrit | Merged openstack/keystone master: Update endpoint policies for system reader https://review.openstack.org/619329 | 02:51 |
| eandersson | > Keystone reply error: status=401 reason=Unauthorized | 02:51 |
| eandersson | On the keystone side | 02:53 |
| eandersson | > Authorization failed for None. Credential signature mismatch | 02:53 |
| lbragstad | hmm | 02:55 |
| eandersson | http://eavesdrop.openstack.org/irclogs/%23openstack-swift/%23openstack-swift.2018-11-09.log.html | 02:56 |
| eandersson | sounds like the same issue | 02:56 |
| lbragstad | yeah - it does | 02:59 |
| lbragstad | otherwise - we did land a migration in newton to encrypt credentials at rest | 03:00 |
| lbragstad | (using symmetric encryption) | 03:00 |
| lbragstad | https://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/sql/data_migration_repo/versions/003_migrate_unencrypted_credentials.py?h=newton-eol | 03:01 |
| lbragstad | that only caught my eye because you're coming from mitaka | 03:01 |
| lbragstad | but - we wrote logic in that migration and the credential api for that migration to be pretty graceful | 03:02 |
| eandersson | nvm we figured it out | 03:02 |
| lbragstad | oh? | 03:03 |
| eandersson | > authtoken s3api | 03:03 |
| eandersson | apparently order in the swift config is important | 03:03 |
| eandersson | was > s3api authtoken | 03:03 |
| eandersson | makes no sense why it works against old keystone | 03:03 |
| lbragstad | strange... | 03:03 |
| lbragstad | something with how the pipeline processes the request? | 03:03 |
| eandersson | Yea probably | 03:04 |
| lbragstad | interesting | 03:04 |
| lbragstad | well - glad y'all were able to figure it out | 03:07 |
| *** dklyle has joined #openstack-keystone | 03:07 | |
| *** Dinesh_Bhor has quit IRC | 03:11 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 03:20 | |
| *** dklyle has quit IRC | 03:21 | |
| *** awalende has joined #openstack-keystone | 03:23 | |
| *** awalende has quit IRC | 03:31 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Ensure change is addressed for unified limit table https://review.openstack.org/621497 | 03:35 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain_id column for limit https://review.openstack.org/620202 | 03:35 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain level limit support - Manager https://review.openstack.org/621468 | 03:35 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain level limit support - API https://review.openstack.org/622773 | 03:35 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain level support for strict-two-level-model https://review.openstack.org/623153 | 03:35 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Update project depth check https://review.openstack.org/623984 | 03:35 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Release note for domain level limit https://review.openstack.org/624019 | 03:35 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [api-ref] add domain level limit support https://review.openstack.org/624562 | 03:35 |
| eandersson | lbragstad, https://bugs.launchpad.net/keystone/+bug/1566416 | 03:40 |
| openstack | Launchpad bug 1566416 in OpenStack Security Advisory "Keystone does not validate that s3tokens requests came from s3_token middleware" [Undecided,Incomplete] | 03:40 |
| eandersson | That is where we found the solution btw | 03:40 |
| eandersson | (the last comments) | 03:41 |
| lbragstad | awesome | 03:47 |
| *** Dinesh_Bhor has quit IRC | 04:06 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:07 | |
| *** dklyle has joined #openstack-keystone | 04:20 | |
| *** ileixe has quit IRC | 04:33 | |
| *** spsurya has joined #openstack-keystone | 04:33 | |
| *** irclogbot_1 has quit IRC | 04:35 | |
| *** Dinesh_Bhor has quit IRC | 04:41 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:42 | |
| *** lbragstad has quit IRC | 04:57 | |
| *** gyee has quit IRC | 05:01 | |
| *** ileixe has joined #openstack-keystone | 05:02 | |
| *** tkajinam has quit IRC | 05:02 | |
| *** tkajinam has joined #openstack-keystone | 05:07 | |
| *** tkajinam has quit IRC | 05:18 | |
| *** tkajinam has joined #openstack-keystone | 05:18 | |
| *** vishakha has joined #openstack-keystone | 05:21 | |
| *** Dinesh_Bhor has quit IRC | 05:30 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:31 | |
| *** shyamb has joined #openstack-keystone | 05:36 | |
| *** imacdonn has joined #openstack-keystone | 05:54 | |
| *** shyamb has quit IRC | 06:07 | |
| *** shyamb has joined #openstack-keystone | 06:11 | |
| *** markvoelker has joined #openstack-keystone | 06:16 | |
| *** markvoelker has quit IRC | 06:45 | |
| *** shyamb has quit IRC | 07:12 | |
| *** shyamb has joined #openstack-keystone | 07:13 | |
| *** markvoelker has joined #openstack-keystone | 07:42 | |
| *** shyamb has quit IRC | 07:48 | |
| *** shyamb has joined #openstack-keystone | 07:49 | |
| *** shyamb has quit IRC | 07:59 | |
| *** tkajinam_ has joined #openstack-keystone | 08:04 | |
| *** tkajinam has quit IRC | 08:06 | |
| *** awalende has joined #openstack-keystone | 08:09 | |
| *** markvoelker has quit IRC | 08:15 | |
| *** xek has joined #openstack-keystone | 08:17 | |
| *** rcernin has quit IRC | 08:29 | |
| *** tkajinam_ has quit IRC | 08:31 | |
| *** shyamb has joined #openstack-keystone | 08:52 | |
| *** Dinesh_Bhor has quit IRC | 09:29 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 09:36 | |
| *** markvoelker has joined #openstack-keystone | 10:12 | |
| *** shyamb has quit IRC | 10:15 | |
| *** markvoelker has quit IRC | 10:46 | |
| *** Dinesh_Bhor has quit IRC | 11:07 | |
| *** markvoelker has joined #openstack-keystone | 11:43 | |
| *** shyamb has joined #openstack-keystone | 11:57 | |
| *** markvoelker has quit IRC | 12:16 | |
| *** takamatsu has joined #openstack-keystone | 12:31 | |
| *** pcaruana has quit IRC | 12:40 | |
| *** shyamb has quit IRC | 12:44 | |
| *** shyamb has joined #openstack-keystone | 12:51 | |
| *** yan0s has joined #openstack-keystone | 13:08 | |
| *** markvoelker has joined #openstack-keystone | 13:13 | |
| *** pcaruana has joined #openstack-keystone | 13:20 | |
| *** jrosser has quit IRC | 13:20 | |
| *** shyamb has quit IRC | 13:23 | |
| *** markvoelker has quit IRC | 13:23 | |
| *** shyamb has joined #openstack-keystone | 13:23 | |
| *** markvoelker has joined #openstack-keystone | 13:23 | |
| *** jrosser has joined #openstack-keystone | 13:24 | |
| *** shyamb has quit IRC | 13:36 | |
| *** GregWaines has joined #openstack-keystone | 13:43 | |
| *** shyamb has joined #openstack-keystone | 13:43 | |
| *** shyamb has quit IRC | 13:46 | |
| *** shyamb has joined #openstack-keystone | 13:47 | |
| *** vishakha has quit IRC | 13:49 | |
| *** ileixe has quit IRC | 14:04 | |
| *** lbragstad has joined #openstack-keystone | 14:20 | |
| *** ChanServ sets mode: +o lbragstad | 14:20 | |
| knikolla | o/ | 14:20 |
| knikolla | looks like my visa was approved, so i won't have any work interruptions. | 14:21 |
| lbragstad | nice! | 14:22 |
| lbragstad | cmurphy so - i was finally able to confirm https://bugs.launchpad.net/keystone/+bug/1811605 - at least to some extent, but i noticed a couple of other things too | 14:26 |
| openstack | Launchpad bug 1811605 in OpenStack Identity (keystone) "Tokenless authentication is broken" [High,Triaged] | 14:26 |
| lbragstad | i started putting some of my thoughts for how we might improve the documentation in etherpad https://etherpad.openstack.org/p/keystone-tokenless-auth-documentation-overhaul | 14:28 |
| lbragstad | which gyee might use in fixing https://bugs.launchpad.net/keystone/+bug/1813057 | 14:28 |
| openstack | Launchpad bug 1813057 in OpenStack Identity (keystone) "The tokenless authentication documentation is opaque" [Medium,Triaged] | 14:28 |
| lbragstad | but - i'm not sure if i'm doing something wrong or if things are still broken, but i can't seem to use x509 certificates with a auto-provisioned mapping | 14:29 |
| lbragstad | (oauth's ultimate autoprovisioning case) | 14:29 |
| cmurphy | lbragstad: did it work for group membership mapping? | 14:34 |
| cmurphy | I admit I don't think I actually tried autoprovisioning, just assumed it worked | 14:34 |
| lbragstad | cmurphy not that i know of | 14:35 |
| lbragstad | i tried a mapping with a group, but i only got back unscoped tokens | 14:35 |
| cmurphy | hmm strange | 14:35 |
| cmurphy | i don't think i have that environment still around or i would check it out | 14:36 |
| *** shyamb has quit IRC | 14:36 | |
| lbragstad | no worries | 14:37 |
| lbragstad | i didn't open a bug for the auto-provisioning stuff, yet | 14:38 |
| lbragstad | but i also wasn't able to get a scoped token authenticating with a certificate | 14:38 |
| lbragstad | which i didn't open up a bug for either | 14:38 |
| lbragstad | mostly out of my own ignorance around mappings | 14:38 |
| cmurphy | I remember I tried to set it up with keystonemiddleware and it didn't work at all because the project scope headers weren't being passed properly | 14:39 |
| cmurphy | I thought it worked with just curling keystone directly but it's more than possible I just assumed it worked and didn't check the scope | 14:40 |
| lbragstad | yeah - i didn't get to the ksm part | 14:41 |
| lbragstad | i suppose i can open placeholder bugs for now - and we can close them as invalid if they actually do work | 14:41 |
| lbragstad | i assumed i was being dense though | 14:42 |
| *** takamatsu has quit IRC | 15:00 | |
| *** awalende has quit IRC | 15:13 | |
| *** awalende has joined #openstack-keystone | 15:13 | |
| *** awalende has quit IRC | 15:17 | |
| *** kukacz_ has quit IRC | 15:20 | |
| *** kukacz has joined #openstack-keystone | 15:31 | |
| *** pcaruana has quit IRC | 15:35 | |
| *** dklyle has quit IRC | 15:41 | |
| *** kukacz has quit IRC | 15:42 | |
| *** kukacz has joined #openstack-keystone | 15:46 | |
| gagehugo | o/ | 15:48 |
| lbragstad | cmurphy https://bugs.launchpad.net/keystone/+bug/1813183 is what I did to try and recreate the auto-provisioning bug with certs | 15:51 |
| openstack | Launchpad bug 1813183 in OpenStack Identity (keystone) "Tokenless authentication doesn't work with auto-provisioning" [Undecided,New] | 15:51 |
| lbragstad | i eluded to the scoping issue as well in that report, but i could pull that into another bug report | 15:51 |
| cmurphy | lbragstad: do you need to s/tokenless/x.509/ ? | 15:53 |
| cmurphy | tokenless means not using X-Auth-Token to do something | 15:54 |
| *** yan0s has quit IRC | 15:54 | |
| cmurphy | you're actually trying to get a token which is not tokenless | 15:54 |
| lbragstad | oh - you're right | 15:54 |
| *** pcaruana has joined #openstack-keystone | 15:55 | |
| lbragstad | fixed | 15:55 |
| cmurphy | I'm having a slightly crazy week but I'll try to verify this weekend possibly | 15:56 |
| lbragstad | no rush - i'm just try to at least document the gaps | 15:56 |
| cmurphy | good idea | 15:57 |
| *** jmlowe has joined #openstack-keystone | 15:57 | |
| lbragstad | if we can get everything in bug reports like the one you opened, i'd like to send a note to the -discuss and -edge mailing lists | 15:57 |
| lbragstad | the whole x509 authentication + auto-provisioning thing pretty much does exactly what oath wants | 15:58 |
| cmurphy | yep | 15:58 |
| *** kukacz has quit IRC | 15:58 | |
| lbragstad | gyee and i had an interesting discussion on what you could do to solve the bearer token problem with this approach, too | 15:59 |
| cmurphy | tokenless does solve the bearer token problem, or it would if it was fully implemented | 15:59 |
| cmurphy | i just don't think it solves the edge problem | 15:59 |
| * cmurphy -> meeting | 15:59 | |
| *** kukacz has joined #openstack-keystone | 16:00 | |
| lbragstad | sounds good - i'm super curious about your opinion on the edge bits | 16:00 |
| lbragstad | but - lemme know if/when you have time and i'll try and write things down | 16:00 |
| *** dave-mccowan has joined #openstack-keystone | 16:03 | |
| *** dklyle has joined #openstack-keystone | 16:04 | |
| *** gyee has joined #openstack-keystone | 16:06 | |
| lbragstad | bnemec kmalloc curious if either of you have thoughts on dhellmann's comments here - https://review.openstack.org/#/c/614817/1 | 16:09 |
| lbragstad | i believe it is indirectly holding up https://review.openstack.org/#/c/630354/ | 16:09 |
| *** dave-mccowan has quit IRC | 16:09 | |
| *** takamatsu has joined #openstack-keystone | 16:12 | |
| *** gyee has quit IRC | 16:14 | |
| bnemec | http://codesearch.openstack.org/?q=pycadf.generate_uuid&i=nope&files=&repos= | 16:15 |
| bnemec | Nothing for you, Dawg. | 16:15 |
| bnemec | Seems odd. _Something_ should be calling that, right? | 16:15 |
| kmalloc | bnemec: not in pycadf | 16:20 |
| kmalloc | Or well nothing yet* | 16:20 |
| lbragstad | ok | 16:21 |
| kmalloc | lbragstad: I don't think audit_ns needs to exit the API anywhere | 16:21 |
| bnemec | kmalloc: So changing the hash method shouldn't affect anyone? | 16:21 |
| lbragstad | i don't think doug wants to release that without at least a release note | 16:21 |
| kmalloc | We should protect that anyway. | 16:21 |
| lbragstad | or that's at least how i interpreted his comment | 16:22 |
| kmalloc | bnemec: it might, but we should really be ok overall. | 16:22 |
| kmalloc | A clear release note indicating the change should be sufficient for non-openstack consumers (not many if any) | 16:22 |
| lbragstad | right | 16:23 |
| kmalloc | It won't impact us. | 16:23 |
| bnemec | The only problem would be if people are expecting to call that and get the same value back every time. | 16:23 |
| *** kukacz has quit IRC | 16:24 | |
| *** gyee has joined #openstack-keystone | 16:25 | |
| *** kukacz has joined #openstack-keystone | 16:26 | |
| lbragstad | gyee o/ | 16:26 |
| lbragstad | so - i updated https://bugs.launchpad.net/keystone/+bug/1811605 and opened https://bugs.launchpad.net/keystone/+bug/1813183 per what we talked about yesterdat | 16:27 |
| openstack | Launchpad bug 1811605 in OpenStack Identity (keystone) "Tokenless authentication is broken" [High,Triaged] | 16:27 |
| openstack | Launchpad bug 1813183 in OpenStack Identity (keystone) "x509 authentication doesn't work with auto-provisioning" [Undecided,New] | 16:27 |
| lbragstad | yesterday* | 16:27 |
| *** ayoung has joined #openstack-keystone | 16:33 | |
| gyee | lbragstad, hey | 16:34 |
| gyee | I'll work on them. I was working on a ec2-api-metadata service bug yesterday. Took me all day to figure out what was going on. Did had time to working on Keystone stuff. | 16:35 |
| lbragstad | no worries - i'm not trying to rush you :) | 16:35 |
| lbragstad | i think the most important thing is at least filing the bugs and correcting the documentation | 16:36 |
| lbragstad | then we can at least focus on fixing them for Stein (maybe after stein-3) | 16:36 |
| gyee | sounds good | 16:37 |
| bnemec | lbragstad: kmalloc: So what's our conclusion for https://review.openstack.org/#/c/614817 ? Add a reno and release? | 16:38 |
| lbragstad | bnemec i think that's a good idea | 16:38 |
| kmalloc | Yep | 16:40 |
| bnemec | Okay, I'll write something up quick. | 16:43 |
| lbragstad | thank you sir | 16:45 |
| lbragstad | i can review it | 16:45 |
| *** pcaruana has quit IRC | 16:48 | |
| bnemec | Oh wow, I fail at using codesearch. | 16:49 |
| bnemec | http://codesearch.openstack.org/?q=identifier.generate_uuid&i=nope&files=&repos= | 16:49 |
| bnemec | It helps if you search for the right module name. | 16:49 |
| *** takamatsu has quit IRC | 16:54 | |
| openstackgerrit | Ben Nemec proposed openstack/pycadf master: Add release note for MD5 hash removal https://review.openstack.org/633037 | 16:59 |
| bnemec | lbragstad: kmalloc: ^ | 17:00 |
| * bnemec finally realized that the results from that function call are supposed to be random | 17:01 | |
| kmalloc | yes | 17:17 |
| ayoung | lbragstad, I'm, looking at your JSW code. It looks pretty OK. Question: can I dump the contents of a token? | 17:20 |
| lbragstad | ayoung if i understand you correctly, yeah | 17:24 |
| ayoung | What are the steps? | 17:24 |
| lbragstad | ayoung install the code locally, generate some keys (keystone-manage jwt_setup) | 17:25 |
| lbragstad | and grab a token | 17:25 |
| ayoung | all done | 17:25 |
| ayoung | I have a running Keystone with JWT token provider | 17:25 |
| lbragstad | https://jwt.io/ | 17:25 |
| lbragstad | put your token in there | 17:25 |
| lbragstad | and select the ES256 algorithm to verify it | 17:25 |
| lbragstad | it should give you an "unverified" payload | 17:25 |
| lbragstad | if you cat your our public key in /etc/keystone/jws-keys/ and put that in the public key input form, it'll validate the token signature against it | 17:26 |
| lbragstad | if you cat out your public key* | 17:26 |
| ayoung | signature verified | 17:27 |
| lbragstad | sweet | 17:27 |
| ayoung | lbragstad, so this is the data | 17:27 |
| lbragstad | correct - the payload | 17:27 |
| ayoung | { | 17:27 |
| ayoung | "sub": "69e0bf160b464b52a668ead15a0a7b7e", | 17:27 |
| ayoung | "iat": 1548350418, | 17:27 |
| ayoung | "exp": 1548354018, | 17:27 |
| ayoung | "openstack_methods": [ | 17:27 |
| ayoung | "password" | 17:27 |
| ayoung | ], | 17:27 |
| ayoung | "openstack_audit_ids": [ | 17:27 |
| ayoung | "A9amiF_FQkSBCsXe3mrXzg" | 17:27 |
| ayoung | ], | 17:27 |
| ayoung | "openstack_project_id": "697b4a4675a04b42b563207e9cafefeb" | 17:27 |
| ayoung | } | 17:27 |
| ayoung | no roles? | 17:27 |
| lbragstad | the roles are generated online when we validate the token | 17:27 |
| lbragstad | since it's an unbound resource | 17:28 |
| lbragstad | we take the same stance as with fernet tokens | 17:28 |
| ayoung | But we are so close to not having to do online validation | 17:28 |
| lbragstad | (sub is the user id, per the specification) | 17:28 |
| ayoung | and for edge that would be a very big deal | 17:28 |
| ayoung | can we add roles in optionally? | 17:28 |
| lbragstad | i think we'd need to do that as a separate spec | 17:29 |
| ayoung | even if it is just ID, we can look up and cache them | 17:29 |
| lbragstad | since it's a pretty big change from what we do today | 17:29 |
| ayoung | methods is technically an array. I wonder if we could somehow collapse that | 17:30 |
| lbragstad | we can | 17:30 |
| ayoung | I think we are stuck with audit IDs as an array, but that is OK | 17:31 |
| lbragstad | i didn't since there are other things we don't really compress already in the payload | 17:31 |
| lbragstad | the fernet provider reduces a list of unique methods to an integer and reinflates it | 17:31 |
| lbragstad | on validation | 17:31 |
| ayoung | So, is the issue with roles that they are a list, and we want to bound the tokens? | 17:31 |
| lbragstad | well - we just don't want to have token sizes explode if someone has 100 roles | 17:32 |
| lbragstad | (which is a thing, from what i've seen in the wild) | 17:32 |
| ayoung | ok...so, what about role sets? A unique ID for a set of roles, based on a hash so they are predictable>? | 17:32 |
| lbragstad | how are you going to figure that out on the other side? | 17:33 |
| lbragstad | you'd have to still call keystone | 17:33 |
| ayoung | only for the first one | 17:33 |
| ayoung | call and cache | 17:33 |
| lbragstad | so you still have to call keystone, rigth? | 17:33 |
| *** imacdonn has quit IRC | 17:34 | |
| ayoung | You need to anyway. | 17:34 |
| ayoung | Hmmm, the data in the token is not enough to expand the headers | 17:34 |
| ayoung | we need project naame and user name etc | 17:34 |
| lbragstad | right | 17:34 |
| lbragstad | most of that is for policy, too | 17:35 |
| ayoung | OK...this would be a sepate token then | 17:35 |
| ayoung | I'll ponder...good work thus far | 17:35 |
| *** aojea has joined #openstack-keystone | 17:36 | |
| lbragstad | thanks | 17:36 |
| * lbragstad steps into a meeting | 17:36 | |
| *** dklyle has quit IRC | 17:40 | |
| *** whoami-rajat has quit IRC | 17:43 | |
| *** dims has quit IRC | 17:43 | |
| *** dims has joined #openstack-keystone | 17:48 | |
| *** dklyle has joined #openstack-keystone | 17:50 | |
| ayoung | lbragstad, I think I am going to propose we add an additional token format... Something like JWSExpanded. It won't have the service catalog, but it will have the token's auth data in full. The goal is to support edge use cases. Its going to get us back into all of the PKI token issues. We can take it slowly, and do it right this time. | 17:50 |
| ayoung | No revocations, smarter key exchange, all that. | 17:51 |
| *** erus_ has joined #openstack-keystone | 17:53 | |
| *** dims has quit IRC | 17:54 | |
| *** dims has joined #openstack-keystone | 17:55 | |
| kmalloc | ayoung: sorry got roped into some house stuff before i could respond to that email earlier | 18:13 |
| kmalloc | trying to get back into the groove of code/state of the world. you know how a long break makes you lose context :) | 18:13 |
| ayoung | Yes I do | 18:14 |
| *** takamatsu has joined #openstack-keystone | 18:15 | |
| kmalloc | ayoung: audit ids are always an array, but a max length of 2 | 18:15 |
| kmalloc | fyi. it's not unbounded | 18:15 |
| ayoung | yeah, that is fine | 18:15 |
| kmalloc | and i agree with lbragstad we should consider embedding role information as a followup | 18:15 |
| lbragstad | ayoung that worries me, but i need to work through the revocation cases and the like | 18:15 |
| ayoung | kmalloc, I was trying to get the online tool to show me the size of a JWS with some other data | 18:15 |
| ayoung | yeah...I think a separate token format? | 18:16 |
| kmalloc | ah ++ yeah | 18:16 |
| kmalloc | ayoung: yes a different formatter. | 18:16 |
| lbragstad | fwiw - i was pleasantly surprised that the formatter in JWS was way simpler to implement than with fernet because we don't have to serialize anything | 18:16 |
| lbragstad | (at the expense of longer tokens, though) | 18:16 |
| ayoung | however, we could use the same format and, if a system wanted to do inline validation, could either reject tokens with insufficient set of fields, or could query all the data that it needs: | 18:17 |
| kmalloc | yeah, but we accepted that. | 18:17 |
| ayoung | length is not too bad: | 18:17 |
| kmalloc | ayoung: the fundamental bits are the same in the format with JWS expanded | 18:17 |
| lbragstad | is bad == 8k? ;) | 18:17 |
| ayoung | | id | eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJzdWIiOiI2OWUwYmYxNjBiNDY0YjUyYTY2OGVhZDE1YTBhN2I3ZSIsImlhdCI6MTU0ODM1MDQxOCwiZXhwIjoxNTQ4MzU0MDE4LCJvcGVuc3RhY2tfbWV0aG9kcyI6WyJwYXNzd29yZCJdLCJvcGVuc3RhY2tfYXVkaXRfaWRzIjpbIkE5YW1pRl9GUWtTQkNzWGUzbXJYemciXSwib3BlbnN0YWNrX3Byb2plY3RfaWQiOiI2OTdiNGE0Njc1YTA0YjQyYjU2MzIwN2U5Y2FmZWZlYiJ9.933v7cwqbfFzyR7iV4umBpoK-PjPpEiO-H_qcZYJzS8TEhFilhBb0ooM-_dq-tb9xlZK0dOYvFLvvTv9fCJCLA | | 18:17 |
| kmalloc | but it should be configured separately (at least for now) as a formatter in keystone | 18:17 |
| kmalloc | lbragstad: 4k is bad, 8k is break the internet bad | 18:18 |
| kmalloc | lbragstad: really we should be aiming for sub 1k if possible in most cases. | 18:18 |
| lbragstad | so 4k is bad and 8k is *real* bad? | 18:18 |
| kmalloc | yeah | 18:18 |
| kmalloc | 4k is the place some web servers tip over in headers | 18:18 |
| lbragstad | i'd like to keep it sub 500 | 18:18 |
| kmalloc | 8k is the hard-coded cap for others (can't be configured above) | 18:18 |
| lbragstad | for copy/paste reasons | 18:19 |
| kmalloc | i'm ok with pushing to 1k or less, but the goal should be to stay as close to sub 500 as possible | 18:19 |
| kmalloc | but we know that some cases the format will be longer (e.g. expanded roles) | 18:19 |
| ayoung | 413 | 18:19 |
| kmalloc | and some other variations | 18:19 |
| lbragstad | fernet falls into a sweet spot with uuid copy/pasteability | 18:19 |
| ayoung | openstack token issue -f json | jq -r '.id' | wc -c | 18:19 |
| kmalloc | really JWS is a good format | 18:19 |
| kmalloc | as long as we are careful how deep into the JWT/JWE/JWS/JOSE rabbithole of a spec we support | 18:20 |
| ayoung | can I expand that with command line tools? | 18:20 |
| *** whoami-rajat has joined #openstack-keystone | 18:20 | |
| kmalloc | ayoung: a token get should expand the details | 18:20 |
| kmalloc | (validate) | 18:20 |
| kmalloc | and you *should* be able to self-validate your token | 18:20 |
| ayoung | I mean the payload itself | 18:21 |
| kmalloc | with JWS you can, i am unsure the exact invocation (not openstack cli) | 18:21 |
| kmalloc | if we go to JWE at any point, no, you can't expand it. | 18:21 |
| kmalloc | it's opaque like fernet | 18:21 |
| lbragstad | right | 18:22 |
| kmalloc | also, we should not encourage folks to expand directly unless we have an explicit contracted format (not the default JWS) | 18:22 |
| kmalloc | i want to start with "treat this like fernet" | 18:22 |
| kmalloc | and expand from there | 18:22 |
| kmalloc | there might be reasons we want to adjust the payload format. | 18:22 |
| ayoung | https://tools.ietf.org/html/rfc7515#page-7 | 18:23 |
| kmalloc | e.g. maybe we don't want audit_ids to be an array. | 18:23 |
| ayoung | We doing the compact serialization? | 18:23 |
| kmalloc | so start is "this is a drop-in fernet compat, just different wire-format" | 18:23 |
| kmalloc | then we start adjusting things as we need (and expand / define the wire format/payload we want) | 18:23 |
| ayoung | kmalloc, I'm with you on "start like fernet." I'm thinking about edge cases, tho, where Keystone is not accessable for periods of time | 18:23 |
| kmalloc | right | 18:24 |
| kmalloc | i absolutely want to get there | 18:24 |
| kmalloc | however, please note that we want to push towards at least a regional keystone (nothing-directly-shared) | 18:24 |
| kmalloc | the oath model, we can lean on further network segmentation/partition | 18:24 |
| kmalloc | but tokens still have a limited expiry. | 18:25 |
| ayoung | Yep | 18:25 |
| kmalloc | the regional keystone will have app cred capabilities, and that will be the extension beyond the wire-ttl of the token itself. | 18:25 |
| kmalloc | i think we're on the same page | 18:25 |
| ayoung | We should do a presentation on this. | 18:25 |
| ayoung | :) | 18:25 |
| kmalloc | you have ... a day ? to submit a CFP for denver:P | 18:26 |
| ayoung | kmalloc, I think we did one last summit.... | 18:26 |
| kmalloc | an hour. | 18:26 |
| ayoung | lbragstad, you presenting on JWT? | 18:26 |
| kmalloc | ayoung: Jan 24 at 7:59 am UTC). if you want to present the JSE/JOSE/JWT edge case as a followup from last summit, we can do it. | 18:27 |
| kmalloc | i'm happy to help again w/ that. | 18:27 |
| kmalloc | and we can prob rope lbragstad into it too if we need a 3rd | 18:27 |
| ayoung | I'm on it | 18:27 |
| kmalloc | so you have ~1hr to submit the CFP :P | 18:28 |
| lbragstad | lol | 18:31 |
| kmalloc | lbragstad: starting the run through the JWT stuff. | 18:33 |
| ayoung | https://www.openstack.org/summit/denver-2019/call-for-presentations/manage/23585/summary lbragstad kmalloc | 18:38 |
| ayoung | its in | 18:38 |
| kmalloc | cool | 18:41 |
| erus_ | o/ | 18:47 |
| * lbragstad steps away | 18:49 | |
| lbragstad | shoveling snow, back in a bit | 18:49 |
| kmalloc | lbragstad: not jealous of the shoveling bit. jealous of the snow bit | 18:53 |
| bnemec | Shoot, I didn't realize lbragstad isn't core on pycadf. | 18:55 |
| bnemec | Should've had him submit the release note then. | 18:55 |
| * bnemec thought pycadf was an Oslo/Keystone joint custody project | 18:55 | |
| kmalloc | bnemec: we should add him. | 18:58 |
| kmalloc | pycadf really is like oslo.policy. | 18:58 |
| kmalloc | it should be keystone + oslo. (or oslo + keystone, more appropriately) | 18:58 |
| bnemec | kmalloc: Yeah, that's what I was thinking. Let me see if I can add keystone-core. | 18:59 |
| kmalloc | i am sure i can. | 19:00 |
| kmalloc | any core should be able to :P | 19:00 |
| bnemec | Yeah, I added keystone-core and keystone-release to the pycadf-release group. | 19:01 |
| bnemec | Which is where oslo-core was getting pulled in too. | 19:01 |
| kmalloc | keystone-release isn't important afaik | 19:01 |
| kmalloc | that is mostly a legacy group pre-dating the release repo | 19:01 |
| bnemec | Neither is oslo-release, but it keeps my OCD happy to have them match. ;-) | 19:01 |
| kmalloc | hahaha | 19:01 |
| kmalloc | i'd go the other way | 19:01 |
| kmalloc | add oslo-core explicitly and drop -release | 19:01 |
| kmalloc | and i would have added it ot pycadf-core vs ... release? *shrug* | 19:02 |
| bnemec | Yeah, there's no one in oslo-release that isn't also in -core. | 19:02 |
| kmalloc | it doesn't matter. | 19:02 |
| kmalloc | really :) | 19:02 |
| bnemec | Yeah, I just put it where oslo-core was. | 19:03 |
| kmalloc | wfm. | 19:03 |
| bnemec | I did remove the -release groups so nobody thinks they're still relevant. | 19:06 |
| * bnemec biab | 19:07 | |
| kmalloc | :) | 19:07 |
| bnemec | Paypal is buying most of my lunch today because apparently they really want you to use Paypal at Subway. :-) | 19:07 |
| kmalloc | hahahaa | 19:07 |
| kmalloc | nice. | 19:08 |
| bnemec | As long as they keep giving me $5 free I'm going to keep taking it. | 19:08 |
| *** takamatsu has quit IRC | 19:09 | |
| *** jmlowe has quit IRC | 19:12 | |
| *** dklyle has quit IRC | 19:37 | |
| *** jdennis has quit IRC | 19:58 | |
| *** jdennis has joined #openstack-keystone | 20:12 | |
| *** dklyle has joined #openstack-keystone | 20:15 | |
| *** xek has quit IRC | 20:43 | |
| *** whoami-rajat has quit IRC | 20:43 | |
| *** xek has joined #openstack-keystone | 20:43 | |
| lbragstad | gyee you were saying yesterday that using SSL sends the public key in the request? | 20:46 |
| lbragstad | with the certificate? | 20:46 |
| lbragstad | ah - nevermind, i answered my own question | 20:50 |
| *** erus_ has quit IRC | 20:58 | |
| *** jmlowe has joined #openstack-keystone | 21:02 | |
| *** rcernin has joined #openstack-keystone | 21:02 | |
| *** awalende has joined #openstack-keystone | 21:14 | |
| *** GregWaines has quit IRC | 21:17 | |
| *** awalende has quit IRC | 21:18 | |
| *** itlinux has joined #openstack-keystone | 21:19 | |
| gyee | lbragstad, yeah :-) | 21:46 |
| gyee | if the handshake is successful, the peer should have each other's cert | 21:47 |
| lbragstad | i should have googled before asking | 21:59 |
| *** rcernin has quit IRC | 22:11 | |
| *** rcernin has joined #openstack-keystone | 22:12 | |
| *** jmlowe has quit IRC | 22:20 | |
| *** itlinux has quit IRC | 22:38 | |
| *** erus_ has joined #openstack-keystone | 22:40 | |
| *** jmlowe has joined #openstack-keystone | 22:41 | |
| *** jmlowe has quit IRC | 22:41 | |
| *** jmlowe has joined #openstack-keystone | 22:41 | |
| *** erus_ has quit IRC | 22:48 | |
| *** jmlowe has quit IRC | 22:51 | |
| *** dklyle has quit IRC | 22:52 | |
| *** jmlowe has joined #openstack-keystone | 22:52 | |
| *** tkajinam has joined #openstack-keystone | 22:57 | |
| *** spsurya has quit IRC | 23:04 | |
| tobias-urdin | just got amazed by the new MFA rules feature, read the whole pending docs that was in review, one question though; how is/will it be implemented in keystoneclient/openstackclient when using MFA rules? | 23:10 |
| tobias-urdin | if one for example uses password and totp auth with the auth receipts | 23:10 |
| *** dklyle has joined #openstack-keystone | 23:11 | |
| tobias-urdin | would like to investigate the possibility of horizon integration with MFA rules for requiring just password + totp | 23:11 |
| adriant | tobias-urdin: that's a complicated one | 23:13 |
| adriant | and mostly amounts to me finding time to do it, but is all planned | 23:13 |
| adriant | first we need to make keystoneauth throw a new error that catches auth receipts, and supply a way to provide receipts with new auth methods. We also want to make a true multi-method way to auth with keystoneauth. | 23:15 |
| adriant | then once that is there, openstackclient and most likely the keystoneauth loaders need a way to ask for the missing auth method data when a receipt error is thrown | 23:15 |
| adriant | with Horizon, much the same, except views for each auth method option | 23:16 |
| adriant | tobias-urdin: the auth rules feature has actually been in Keystone since Ocata. | 23:17 |
| adriant | the missing bit was auth-receipts to make the likes of Horizon to be able to use it. | 23:18 |
| adriant | yeah, ocata: https://docs.openstack.org/releasenotes/keystone/ocata.html | 23:18 |
| kmalloc | adriant: o/ | 23:18 |
| adriant | kmalloc: hey! | 23:19 |
| adriant | I'm alive! Mostly | 23:19 |
| *** dklyle has quit IRC | 23:19 | |
| tobias-urdin | adriant: thanks! that's really cool | 23:20 |
| tobias-urdin | and work with resource options to get to this RFE that im very interested about https://bugs.launchpad.net/keystone/+bug/1804042 | 23:21 |
| openstack | Launchpad bug 1804042 in OpenStack Identity (keystone) "RFE: Add ability to restrict auth by forwarded IP" [Wishlist,Triaged] | 23:21 |
| *** erus_ has joined #openstack-keystone | 23:21 | |
| adriant | hah | 23:21 |
| kmalloc | tobias-urdin: yeah def. want to get that stuff landed | 23:21 |
| adriant | tobias-urdin: yes that's one of my other side projects | 23:21 |
| tobias-urdin | i'm actually really happy right now, i'm going to bed with a smile on my face :) | 23:21 |
| kmalloc | tobias-urdin: https://review.openstack.org/#/c/624162/ is the spec | 23:22 |
| kmalloc | will be a train target | 23:22 |
| kmalloc | but should enable by forwarded ip stuff | 23:22 |
| adriant | although i'm not sure resource-options is the best way to do that one | 23:22 |
| adriant | because I'd personally like to be able to do it with auth rules | 23:22 |
| kmalloc | adriant: by forwarded ip? the request was to do it for an entire project or domain | 23:22 |
| adriant | e.g.: [['password', 'ip'], ['password', 'totp']] | 23:22 |
| kmalloc | in that case it would need to be in an RO. | 23:23 |
| kmalloc | it might be the auth-rules RO | 23:23 |
| kmalloc | but it would be needed not just on user. | 23:23 |
| adriant | I mostly wanted it for service accounts, which can't totp | 23:23 |
| adriant | that was my original design for it | 23:23 |
| kmalloc | would be easy to add an IP auth plugin that just extracts the data from the request | 23:24 |
| kmalloc | would still need to be passed as an auth-type explicitlyo. | 23:24 |
| kmalloc | in the current state of keystone | 23:24 |
| adriant | yeah, but that's easy | 23:24 |
| kmalloc | but doable. | 23:24 |
| adriant | or we make an auth plugin which can auto-promote itself if in auth-rules | 23:24 |
| adriant | those were my two ideas on how to do it, but explicitly including it is easy enough | 23:24 |
| adriant | and works with existing methods | 23:25 |
| * tobias-urdin goes to bed -- with a smile | 23:26 | |
| kmalloc | yeah, just make it so an authplugin is auto-processed | 23:27 |
| adriant | tobias-urdin: see ya! | 23:27 |
| adriant | kmalloc: yeah, and the IP can be stored in an 'credential' of type CIDR | 23:27 |
| adriant | so you can do /24 s and such | 23:27 |
| kmalloc | sure. | 23:27 |
| kmalloc | but realistically that requires RO expansion, i don't want to add more to just user. | 23:28 |
| kmalloc | especially when we already have requests for expanding the current ones. | 23:28 |
| adriant | yep | 23:28 |
| *** erus_ has quit IRC | 23:28 | |
| adriant | My worry about something like this at the project level is that Horizon breaks the IP case | 23:28 |
| adriant | that's why [['password', 'ip'], ['password', 'totp']] works | 23:29 |
| adriant | because when you auth from Horizon it doesn't forward the IP I don't believe (it can't really). | 23:29 |
| adriant | plus you can't trust a forwarded IP from horizon | 23:30 |
| adriant | but... how about | 23:30 |
| *** erus_ has joined #openstack-keystone | 23:30 | |
| adriant | we make projects also have auth rules? a user can't scope to them unless their token matched a given set of rule options? | 23:31 |
| adriant | the rules are still mostly on the user, but the project level scoping is built on top of that same layer | 23:31 |
| *** dave-mccowan has joined #openstack-keystone | 23:32 | |
| adriant | anyway, lunch. I'll add some notes to that blueprint later to capture my original thoughts on the idea. | 23:32 |
| *** jmlowe has quit IRC | 23:36 | |
| *** erus_ has quit IRC | 23:46 | |
| *** dklyle has joined #openstack-keystone | 23:51 | |
| *** dave-mccowan has quit IRC | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!