| *** mvkr has quit IRC | 00:00 | |
| *** gyee has quit IRC | 00:18 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:22 | |
| *** dklyle has joined #openstack-keystone | 00:30 | |
| joshualyle | well no matter what I do I just get "SvcErr: DSID-03100754, problem 5012 (DIR_ERROR)". It is maybe authenticating since I get "Unable to retrieve authorized projects." but I'm still unable to login. Any ideas? | 00:39 |
|---|---|---|
| *** jamesmcarthur has quit IRC | 00:46 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:47 | |
| *** jamesmcarthur has quit IRC | 00:52 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:11 | |
| *** rcernin has quit IRC | 01:16 | |
| *** rcernin has joined #openstack-keystone | 01:17 | |
| *** rcernin has quit IRC | 01:18 | |
| *** rcernin has joined #openstack-keystone | 01:19 | |
| *** whoami-rajat has joined #openstack-keystone | 01:34 | |
| *** jamesmcarthur has quit IRC | 02:14 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:32 | |
| *** tkajinam has quit IRC | 02:55 | |
| *** tkajinam has joined #openstack-keystone | 02:56 | |
| *** jamesmcarthur has quit IRC | 03:40 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:58 | |
| *** jamesmcarthur has quit IRC | 04:03 | |
| *** mvkr has joined #openstack-keystone | 04:37 | |
| *** shyamb has joined #openstack-keystone | 05:14 | |
| *** vishakha has joined #openstack-keystone | 05:24 | |
| *** vishalmanchanda has joined #openstack-keystone | 05:43 | |
| *** spsurya has joined #openstack-keystone | 05:49 | |
| *** shyamb has quit IRC | 05:57 | |
| *** shyamb has joined #openstack-keystone | 05:58 | |
| *** awalende has joined #openstack-keystone | 06:04 | |
| *** awalende has quit IRC | 06:08 | |
| *** jaosorior has quit IRC | 06:42 | |
| *** mvkr has quit IRC | 06:43 | |
| *** josecastroleon has joined #openstack-keystone | 06:48 | |
| *** jaosorior has joined #openstack-keystone | 06:51 | |
| *** awalende has joined #openstack-keystone | 07:01 | |
| *** starborn has joined #openstack-keystone | 07:01 | |
| *** awalende_ has joined #openstack-keystone | 07:04 | |
| *** awalende has quit IRC | 07:05 | |
| *** shyamb has quit IRC | 07:11 | |
| *** tesseract has joined #openstack-keystone | 07:13 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Pep8 environment to run on delta code only https://review.opendev.org/659225 | 07:14 |
| *** awalende_ has quit IRC | 07:17 | |
| *** awalende has joined #openstack-keystone | 07:17 | |
| *** awalende_ has joined #openstack-keystone | 07:20 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Pep8 environment to run on delta code only https://review.opendev.org/659225 | 07:20 |
| *** awalende has quit IRC | 07:22 | |
| *** awalende_ has quit IRC | 07:22 | |
| *** awalende has joined #openstack-keystone | 07:25 | |
| *** rcernin has quit IRC | 07:25 | |
| *** shyamb has joined #openstack-keystone | 07:26 | |
| *** zigo has quit IRC | 07:28 | |
| *** tkajinam has quit IRC | 08:08 | |
| *** awalende has quit IRC | 08:11 | |
| *** awalende has joined #openstack-keystone | 08:11 | |
| *** awalende has quit IRC | 08:16 | |
| *** shyamb has quit IRC | 08:17 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Drop limit columns https://review.opendev.org/657187 | 08:21 |
| *** awalende has joined #openstack-keystone | 08:24 | |
| *** shyamb has joined #openstack-keystone | 08:45 | |
| *** pcaruana has joined #openstack-keystone | 08:51 | |
| *** shyamb has quit IRC | 09:09 | |
| *** shyamb has joined #openstack-keystone | 09:21 | |
| *** zigo has joined #openstack-keystone | 09:33 | |
| *** josecastroleon has quit IRC | 09:53 | |
| *** faizy98 has joined #openstack-keystone | 10:07 | |
| *** tesseract has quit IRC | 10:12 | |
| *** tesseract has joined #openstack-keystone | 10:12 | |
| *** shyamb has quit IRC | 10:23 | |
| *** zigo has quit IRC | 10:30 | |
| *** zigo has joined #openstack-keystone | 10:41 | |
| *** raildo has joined #openstack-keystone | 11:05 | |
| *** shyamb has joined #openstack-keystone | 11:10 | |
| *** awalende has quit IRC | 11:50 | |
| *** awalende has joined #openstack-keystone | 11:51 | |
| *** raildo has quit IRC | 11:51 | |
| *** awalende_ has joined #openstack-keystone | 11:54 | |
| *** awalende has quit IRC | 11:55 | |
| *** spsurya has quit IRC | 12:08 | |
| openstackgerrit | Jose Castro Leon proposed openstack/keystone master: Adds caching of credentials https://review.opendev.org/636645 | 12:14 |
| *** shyamb has quit IRC | 12:18 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:19 | |
| *** jamesmcarthur has quit IRC | 12:29 | |
| *** raildo has joined #openstack-keystone | 12:37 | |
| *** awalende_ has quit IRC | 12:40 | |
| *** awalende has joined #openstack-keystone | 12:47 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:50 | |
| *** awalende has quit IRC | 12:51 | |
| *** raildo has quit IRC | 12:53 | |
| *** awalende has joined #openstack-keystone | 12:53 | |
| *** Nelson has joined #openstack-keystone | 12:59 | |
| *** raildo has joined #openstack-keystone | 13:00 | |
| *** lbragstad has joined #openstack-keystone | 13:18 | |
| redrobot | Hi Keystone friends! I'm trying to get a keystone instance running in podman, and I'm having some trouble getting the fernet tokens created. | 13:18 |
| redrobot | Things seem to work fine, unless I mount a volume to /etc/keystone/fernet-keys | 13:19 |
| redrobot | If I try the fernet_setup with a mounted volume I get a permissions issue. :( | 13:19 |
| lbragstad | what are the permissions of the volume? | 13:19 |
| redrobot | Perms error: http://paste.openstack.org/show/751421/ | 13:20 |
| lbragstad | it looks like the user your running `keystone-manage fernet_setup` as doesn't have permissions to write to that directory | 13:21 |
| redrobot | lbragstad, inside container: http://paste.openstack.org/show/751422/ | 13:21 |
| lbragstad | are you running that command directly or as the user running keystone (e.g., apache)? | 13:22 |
| redrobot | lbragstad, I'm running keystone-manage fernet_setup as root. | 13:22 |
| redrobot | well, root inside the container | 13:22 |
| redrobot | which is weird because it only fails when the fernet-keys dir is a volume. If I don't mount anything the keys get generated just fine. | 13:22 |
| lbragstad | hmmm | 13:24 |
| lbragstad | i'm not sure we've had anyone report something like this, but i'm not sure why that wouldn't work | 13:25 |
| redrobot | On a related note, keystone-manage doesn't give any feedback when it fails | 13:26 |
| redrobot | I've had to run 'echo $?' after running keystone-manage every single time. | 13:27 |
| lbragstad | and the logs you pulled came from keystone.log? | 13:27 |
| redrobot | yeah | 13:27 |
| lbragstad | that's not really helpful | 13:27 |
| redrobot | hehe, yeah. It would be awesome if keystone-manage would print something to stderr on failure. | 13:28 |
| lbragstad | would you want to open a bug for the volume issue? | 13:29 |
| *** raildo_ has joined #openstack-keystone | 13:32 | |
| *** awalende has quit IRC | 13:33 | |
| *** awalende has joined #openstack-keystone | 13:34 | |
| *** raildo has quit IRC | 13:34 | |
| *** Nelson has quit IRC | 13:36 | |
| *** awalende_ has joined #openstack-keystone | 13:37 | |
| *** awalende has quit IRC | 13:38 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update the meaning of low-hanging-fruit https://review.opendev.org/659141 | 13:40 |
| *** awalende_ has quit IRC | 13:42 | |
| redrobot | lbragstad, sure, y'all use launchpad or storyboard? | 13:46 |
| lbragstad | we still use LP | 13:46 |
| *** vishalmanchanda has quit IRC | 13:48 | |
| *** NM has joined #openstack-keystone | 13:49 | |
| *** vishakha has quit IRC | 13:56 | |
| *** awalende has joined #openstack-keystone | 14:04 | |
| *** awalende has quit IRC | 14:08 | |
| *** jdwidari has joined #openstack-keystone | 14:14 | |
| knikolla | o/ | 14:21 |
| *** jamesmcarthur has quit IRC | 14:25 | |
| *** NM has quit IRC | 14:37 | |
| gagehugo | o/ | 14:45 |
| cmurphy | o/ | 14:56 |
| *** NM has joined #openstack-keystone | 15:01 | |
| *** vishalmanchanda has joined #openstack-keystone | 15:01 | |
| redrobot | lbragstad, I think I figured out the permissions thing. Seems keystone-manage creates the keys as the keystone user regardless of what user you run the command as | 15:02 |
| redrobot | lbragstad, not sure why the install guide says that it needs to be run as root. | 15:03 |
| cmurphy | joshualyle: did you figure out an answer to your question? i don't know the specific answer to your question but you should be able to play with user_tree_dn, user_filter and user_objectclass in your [ldap] config to get the search right | 15:07 |
| cmurphy | "Unable to retrieve authorized projects" comes from horizon i think so i would try with the cli first | 15:08 |
| *** starborn has quit IRC | 15:30 | |
| *** tesseract has quit IRC | 15:35 | |
| *** shyamb has joined #openstack-keystone | 15:36 | |
| *** NM has quit IRC | 15:38 | |
| ayoung | redrobot, because it does a chown, I believe | 15:55 |
| *** jdwidari has quit IRC | 15:56 | |
| *** shyamb has quit IRC | 15:57 | |
| lbragstad | redrobot huh - we should correct that then? | 15:58 |
| lbragstad | redrobot i know keystone-manage supports parameters to pass in the keystone user and group | 15:59 |
| ayoung | lbragstad, it works correctly | 16:07 |
| ayoung | it uses the keystone user to manage the keys. But the assumption is that keystone-manage is not run as the keystone user | 16:08 |
| ayoung | keystone is the unit user that runs the wsgi app | 16:08 |
| ayoung | Unix | 16:11 |
| *** xek has quit IRC | 16:14 | |
| joshualyle | cmurphy: I worked on it for a few more hours after post that. I followed it through the source and set some debug prints and saw that the first call to search_s found my ldap user but then there was another call that involved the group_tree_dn that messed up the search. It seems that group_tree_dn was set to some LDAP default that didn't match anything in the LDAP server and I had to set group_tree_dn to the same thing as u | 16:19 |
| joshualyle | ser_tree_dn and it seems to auth successfully. Now I'm stuck with the message "You are not authorized for any projects or domains." I'm not sure how to set the default role or project to assign an LDAP user to after they have authenticated | 16:19 |
| ayoung | joshualyle, there is none | 16:23 |
| ayoung | defaults are a sql thing | 16:23 |
| *** tesseract has joined #openstack-keystone | 16:24 | |
| joshualyle | there is an ldap setting called user_default_project_id_attribute in the docs that I tried setting to a project_id with no success | 16:24 |
| ayoung | Oh that...hmmm | 16:24 |
| ayoung | do you actually have an attribute in LDAP that you can use to set to a project ID? Usually LDAP is not writable | 16:26 |
| cmurphy | joshualyle: you can use keystone-manage mapping_populate to generate IDs for ldap users in the keystone database and then create direct role assignments with that, or create role assignments for the ldap group | 16:26 |
| ayoung | What she said | 16:27 |
| joshualyle | cmurphy: so the keystone has to pull LDAP users into the traditional DB so that they can be assigned a role/project? | 16:29 |
| cmurphy | joshualyle: basically yes, because the role and project only exists in sql | 16:29 |
| *** NM has joined #openstack-keystone | 16:29 | |
| *** dklyle has quit IRC | 16:31 | |
| joshualyle | cmurphy: interesting. I'll give it a try. So does that mean that any new users created in ldap after the initial mapping_populate run will not be available until after running mapping_populate again? | 16:32 |
| cmurphy | joshualyle: they can log in with an unscoped token which would create an entry for them in the database but you'd still need to create the role assignment, or if they have a role assignment via a group membership then things should just work | 16:34 |
| *** dklyle has joined #openstack-keystone | 16:37 | |
| *** gyee has joined #openstack-keystone | 16:38 | |
| joshualyle | cmurphy: thanks for all of your help. I don't want to have to keep bugging you. Are there docs on how to set role by group membership? | 16:40 |
| cmurphy | joshualyle: not sure if we have a good document on it in keystone but the openstack cli covers it https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/role.html | 16:45 |
| *** mvkr has joined #openstack-keystone | 16:52 | |
| *** mvkr has quit IRC | 16:55 | |
| *** dklyle has quit IRC | 17:29 | |
| *** dklyle has joined #openstack-keystone | 17:49 | |
| *** dklyle has quit IRC | 17:56 | |
| *** NM has quit IRC | 18:00 | |
| *** tesseract has quit IRC | 18:01 | |
| *** NM has joined #openstack-keystone | 18:10 | |
| ayoung | cmurphy, lbragstad hrybacki here is my write up on Sync https://adam.younglogic.com/2019/05/sync-keystones-api/ | 18:15 |
| joshualyle | cmurphy: well I managed to get a single login working from ldap so that progress. Can you explain the process a little more about role assignment via group membership works? Is there an implicit group that LDAP members belong to? Or is this a setting in the domain/domain.conf file that sets the group based on an ldap attribute? | 18:17 |
| *** dklyle has joined #openstack-keystone | 18:20 | |
| cmurphy | joshualyle: the group would come from ldap, so if the user is a member of a group in ldap and keystone can find it with group_tree_dn etc then the group would get shadowed in keystone and you could assign roles to it | 18:25 |
| redrobot | Hello again Keystone friends! | 18:27 |
| redrobot | What's the difference between fernet_setup and credential_setup? | 18:27 |
| redrobot | Looking at Step 4 in https://docs.openstack.org/keystone/stein/install/keystone-install-rdo.html#install-and-configure-components | 18:28 |
| redrobot | Mostly I'm wondering if I need another volume in my container in addition to /etc/keystone/fernet-keys ? | 18:28 |
| cmurphy | redrobot: fernet_setup is to set up the symmetric key repository for fernet tokens, credential_setup does the same but for the /v3/credentials API | 18:29 |
| cmurphy | they are in different directories by default | 18:29 |
| redrobot | cmurphy, what's the location of the keys that get generated by credential_setup ? | 18:29 |
| cmurphy | /etc/keystone/credential-keys/ | 18:30 |
| redrobot | and do I need to run both if I'm using fernet tokens? | 18:30 |
| cmurphy | not to be able to use fernet tokens, only to use the credentials API (which is not related to tokens even though it sounds like it would be) | 18:31 |
| cmurphy | you only need fernet_setup for tokens to work | 18:31 |
| redrobot | cool, thanks cmurphy! 😁 | 18:32 |
| cmurphy | yw | 18:32 |
| *** ab-a has quit IRC | 18:40 | |
| *** vishalmanchanda has quit IRC | 19:01 | |
| *** dklyle has quit IRC | 19:01 | |
| *** pcaruana has quit IRC | 20:14 | |
| *** whoami-rajat has quit IRC | 20:24 | |
| openstackgerrit | Gage Hugo proposed openstack/keystonemiddleware master: Remove PKI/PKIZ support https://review.opendev.org/613675 | 20:34 |
| gagehugo | kmalloc: ^ fixed the merge conflict | 20:36 |
| joshualyle | cmurphy: finally got everything working! The big crux of the groups not showing up was that default group_objectclass did not match our default attribute that defined groups so it didn't match any groups. After defining that and setting the id,name,and desc attributes to something that made sense in our ldap as well as making the group_tree_dn an OU closer to the root (so that it encompasses all possible group objects), the | 20:38 |
| joshualyle | groups were recognized and imported correctly with keystone-manage mapping_populate. Thanks for all of your help! | 20:38 |
| *** dklyle has joined #openstack-keystone | 20:39 | |
| cmurphy | joshualyle: great! | 20:40 |
| joshualyle | I'm not sure if our ldap is setup with a bunch of non-standard values but I ended up having to define nearly every ldap variable in the keystone.conf. | 20:41 |
| *** raildo_ has quit IRC | 20:59 | |
| dtruong | I have a question on keystoneauth1 loading session. Is there a reason why the names of the cert parameters are different in the load_from_options function (https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/loading/session.py#L51) from the equivalent config options (https://github.com/openstack/keystoneauth/blob/master/keystoneaut | 21:12 |
| dtruong | h1/loading/session.py#L170)? | 21:12 |
| dtruong | E.g. cacert vs cafile | 21:12 |
| dtruong | This becomes a problem in the ironic client when it tries to filter out what to pass into the load_from_options call like this: https://github.com/openstack/python-ironicclient/blob/master/ironicclient/client.py#L99 | 21:14 |
| *** dklyle has quit IRC | 21:14 | |
| redrobot | lbragstad, https://bugs.launchpad.net/keystone/+bug/1829296 | 21:21 |
| openstack | Launchpad bug 1829296 in OpenStack Identity (keystone) "keystone-manage fails silently" [Undecided,New] | 21:21 |
| *** NM has quit IRC | 21:22 | |
| lbragstad | thanks redrobot | 21:22 |
| *** dklyle has joined #openstack-keystone | 21:29 | |
| *** dklyle has quit IRC | 22:00 | |
| *** xek has joined #openstack-keystone | 22:07 | |
| *** tkajinam has joined #openstack-keystone | 23:05 | |
| *** rcernin has joined #openstack-keystone | 23:14 | |
| *** NM has joined #openstack-keystone | 23:25 | |
| *** NM has quit IRC | 23:34 | |
| *** d34dh0r53 has joined #openstack-keystone | 23:43 | |
| *** d34dh0r53 has quit IRC | 23:58 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!