ayoung | external predated federation. I don't think we ever deprecated it. We should | 00:01 |
---|---|---|
gyee | ayoung, amen, brother! | 00:02 |
*** jamesmcarthur has joined #openstack-keystone | 00:03 | |
*** jamesmcarthur has quit IRC | 00:07 | |
gyee | cmurphy, lbragstad, kmalloc, https://bugs.launchpad.net/keystone/+bug/1813336 so we can directly get a scoped federated token now? | 00:16 |
openstack | Launchpad bug 1813336 in OpenStack Identity (keystone) "Requesting a scoped token when using x509 authentication is redundant" [Medium,Triaged] | 00:16 |
gyee | I thought with federation, we always start with an unscoped token, then use that to exchange for a scoped token | 00:16 |
cmurphy | gyee: that example is with external not federation | 00:19 |
cmurphy | it's going through the regular /v3/auth/tokens endpoint which should allow a scope | 00:20 |
cmurphy | federated auth always goes through an idp-specific or protocol-specific endpoint | 00:20 |
*** jamesmcarthur has joined #openstack-keystone | 00:21 | |
gyee | cmurphy, then I don't understand that bug | 00:22 |
gyee | are we mixing up password auth with x.509 certificate auth? | 00:22 |
*** altlogbot_0 has joined #openstack-keystone | 00:28 | |
cmurphy | gyee: i think it has to do with this part of the tokenless docs https://docs.openstack.org/keystone/latest/admin/configure_tokenless_x509.html#test-it-out-with-curl | 00:36 |
cmurphy | it's a confusing example because it's validating a token | 00:36 |
cmurphy | but with external auth you would expect not to need the X-Project-Id header at all and regular scoped auth would work | 00:36 |
cmurphy | but for some reason it's requiring the header | 00:37 |
gyee | cmurphy, yes, understood, I've taken that part out | 00:37 |
*** altlogbot_0 has quit IRC | 00:37 | |
*** jamesmcarthur has quit IRC | 00:38 | |
gyee | tokenless auth is designed for middleware to keystone interaction to validate user tokens | 00:39 |
*** jamesmcarthur has joined #openstack-keystone | 00:47 | |
*** jamesmcarthur has quit IRC | 00:52 | |
*** jamesmcarthur has joined #openstack-keystone | 00:55 | |
*** altlogbot_3 has joined #openstack-keystone | 01:06 | |
*** jamesmcarthur has quit IRC | 01:09 | |
*** imacdonn has quit IRC | 01:13 | |
*** imacdonn has joined #openstack-keystone | 01:14 | |
*** jamesmcarthur has joined #openstack-keystone | 01:14 | |
*** altlogbot_3 has quit IRC | 01:15 | |
*** jamesmcarthur has quit IRC | 01:19 | |
*** jamesmcarthur_ has joined #openstack-keystone | 01:21 | |
openstackgerrit | guang-yee proposed openstack/keystone master: discourage using X.509 with external auth https://review.opendev.org/669959 | 01:21 |
*** gyee has quit IRC | 01:22 | |
*** jamesmcarthur_ has quit IRC | 01:23 | |
*** jamesmcarthur has joined #openstack-keystone | 01:27 | |
*** jamesmcarthur has quit IRC | 01:32 | |
*** jamesmcarthur has joined #openstack-keystone | 01:36 | |
*** jamesmcarthur has quit IRC | 01:41 | |
*** jamesmcarthur has joined #openstack-keystone | 01:43 | |
*** jamesmcarthur has quit IRC | 01:45 | |
*** jamesmcarthur has joined #openstack-keystone | 01:50 | |
*** jamesmcarthur has quit IRC | 01:54 | |
*** lbragstad has quit IRC | 01:57 | |
*** jamesmcarthur has joined #openstack-keystone | 02:07 | |
*** jamesmcarthur has quit IRC | 02:09 | |
*** jamesmcarthur has joined #openstack-keystone | 02:09 | |
*** jamesmcarthur has quit IRC | 02:14 | |
*** altlogbot_2 has joined #openstack-keystone | 02:18 | |
*** irclogbot_2 has joined #openstack-keystone | 02:18 | |
*** jamesmcarthur_ has joined #openstack-keystone | 02:22 | |
*** altlogbot_2 has quit IRC | 02:25 | |
*** irclogbot_2 has quit IRC | 02:26 | |
*** jamesmcarthur_ has quit IRC | 02:26 | |
*** tkajinam has quit IRC | 02:29 | |
*** tkajinam has joined #openstack-keystone | 02:29 | |
*** awalende has joined #openstack-keystone | 02:36 | |
*** awalende has quit IRC | 02:41 | |
*** jamesmcarthur has joined #openstack-keystone | 02:56 | |
*** dklyle has quit IRC | 03:19 | |
*** jamesmcarthur has quit IRC | 03:19 | |
*** jamesmcarthur has joined #openstack-keystone | 03:20 | |
*** vishakha has joined #openstack-keystone | 03:45 | |
*** njohnston has quit IRC | 03:53 | |
*** irclogbot_1 has joined #openstack-keystone | 04:07 | |
*** shyamb has joined #openstack-keystone | 04:11 | |
*** irclogbot_1 has quit IRC | 04:12 | |
*** altlogbot_3 has joined #openstack-keystone | 04:13 | |
*** altlogbot_3 has quit IRC | 04:17 | |
*** shyamb has quit IRC | 04:20 | |
*** shyamb has joined #openstack-keystone | 04:20 | |
*** jamesmcarthur has quit IRC | 04:32 | |
*** shyamb has quit IRC | 04:37 | |
*** jamesmcarthur has joined #openstack-keystone | 04:46 | |
*** whoami-rajat has joined #openstack-keystone | 04:52 | |
*** altlogbot_1 has joined #openstack-keystone | 05:02 | |
*** irclogbot_0 has joined #openstack-keystone | 05:07 | |
*** altlogbot_1 has quit IRC | 05:21 | |
*** irclogbot_0 has quit IRC | 05:22 | |
*** pcaruana has joined #openstack-keystone | 05:37 | |
*** shyamb has joined #openstack-keystone | 05:45 | |
openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: [WIP] Generate PDF documentation https://review.opendev.org/669982 | 05:45 |
*** jamesmcarthur has quit IRC | 05:50 | |
*** shyamb has quit IRC | 06:02 | |
*** shyamb has joined #openstack-keystone | 06:02 | |
*** shyamb has quit IRC | 06:06 | |
*** rcernin has quit IRC | 06:10 | |
*** rcernin has joined #openstack-keystone | 06:11 | |
*** shyamb has joined #openstack-keystone | 06:14 | |
*** pcaruana has quit IRC | 06:20 | |
*** shyamb has quit IRC | 06:35 | |
*** new_student1411 has joined #openstack-keystone | 06:37 | |
*** xek has joined #openstack-keystone | 06:48 | |
*** dancn has joined #openstack-keystone | 06:57 | |
*** ivve has joined #openstack-keystone | 07:02 | |
*** altlogbot_3 has joined #openstack-keystone | 07:03 | |
*** altlogbot_3 has quit IRC | 07:08 | |
*** shyamb has joined #openstack-keystone | 07:10 | |
*** awalende has joined #openstack-keystone | 07:10 | |
*** starborn has joined #openstack-keystone | 07:12 | |
*** new_student1411 has quit IRC | 07:25 | |
*** irclogbot_2 has joined #openstack-keystone | 07:39 | |
*** irclogbot_2 has quit IRC | 07:43 | |
*** pcaruana has joined #openstack-keystone | 07:54 | |
*** shyamb has quit IRC | 07:57 | |
*** shyamb has joined #openstack-keystone | 08:05 | |
*** tkajinam has quit IRC | 08:14 | |
*** shyamb has quit IRC | 08:54 | |
*** irclogbot_0 has joined #openstack-keystone | 08:57 | |
*** irclogbot_0 has quit IRC | 09:02 | |
*** altlogbot_1 has joined #openstack-keystone | 09:11 | |
*** shyamb has joined #openstack-keystone | 09:13 | |
*** altlogbot_1 has quit IRC | 09:14 | |
*** rcernin has quit IRC | 09:17 | |
*** altlogbot_2 has joined #openstack-keystone | 09:25 | |
*** altlogbot_2 has quit IRC | 09:28 | |
*** altlogbot_0 has joined #openstack-keystone | 09:29 | |
*** new_student1411 has joined #openstack-keystone | 09:33 | |
*** altlogbot_0 has quit IRC | 09:34 | |
*** irclogbot_1 has joined #openstack-keystone | 09:37 | |
*** irclogbot_1 has quit IRC | 09:40 | |
*** altlogbot_2 has joined #openstack-keystone | 09:45 | |
*** altlogbot_2 has quit IRC | 09:50 | |
*** new_student1411 has quit IRC | 09:59 | |
*** shyamb has quit IRC | 10:22 | |
*** irclogbot_1 has joined #openstack-keystone | 10:23 | |
*** irclogbot_1 has quit IRC | 10:26 | |
*** shyamb has joined #openstack-keystone | 10:45 | |
*** new_student1411 has joined #openstack-keystone | 10:56 | |
*** shyam89 has joined #openstack-keystone | 11:03 | |
*** shyamb has quit IRC | 11:04 | |
*** tesseract has joined #openstack-keystone | 11:08 | |
*** raildo has joined #openstack-keystone | 11:40 | |
*** shyamb has joined #openstack-keystone | 12:05 | |
*** shyam89 has quit IRC | 12:08 | |
*** mchlumsky has joined #openstack-keystone | 12:33 | |
*** mchlumsky has quit IRC | 12:47 | |
*** mchlumsky has joined #openstack-keystone | 12:49 | |
*** irclogbot_1 has joined #openstack-keystone | 13:06 | |
*** irclogbot_1 has quit IRC | 13:08 | |
*** altlogbot_3 has joined #openstack-keystone | 13:11 | |
*** lbragstad has joined #openstack-keystone | 13:16 | |
*** altlogbot_3 has quit IRC | 13:16 | |
*** shyamb has quit IRC | 13:17 | |
*** irclogbot_1 has joined #openstack-keystone | 13:17 | |
*** irclogbot_1 has quit IRC | 13:22 | |
*** shyamb has joined #openstack-keystone | 13:27 | |
*** vishakha has quit IRC | 13:36 | |
*** altlogbot_2 has joined #openstack-keystone | 13:36 | |
*** altlogbot_2 has quit IRC | 13:36 | |
openstackgerrit | Jose Castro Leon proposed openstack/keystone master: Allow to filter endpoint groups by name https://review.opendev.org/658359 | 13:51 |
*** whoami-rajat has quit IRC | 13:54 | |
*** whoami-rajat has joined #openstack-keystone | 13:54 | |
*** dklyle has joined #openstack-keystone | 14:04 | |
*** jamesmcarthur has joined #openstack-keystone | 14:04 | |
*** jamesmcarthur has quit IRC | 14:05 | |
*** jamesmcarthur has joined #openstack-keystone | 14:05 | |
lbragstad | cmurphy bnemec https://review.opendev.org/#/c/669914/ is passing now | 14:07 |
*** shyam89 has joined #openstack-keystone | 14:12 | |
*** shyamb has quit IRC | 14:16 | |
*** awalende has quit IRC | 14:19 | |
*** awalende has joined #openstack-keystone | 14:20 | |
*** awalende has quit IRC | 14:24 | |
*** dklyle has quit IRC | 14:30 | |
*** starborn has quit IRC | 14:34 | |
*** dklyle has joined #openstack-keystone | 14:38 | |
*** altlogbot_3 has joined #openstack-keystone | 14:39 | |
*** altlogbot_3 has quit IRC | 14:42 | |
*** shyam89 has quit IRC | 14:44 | |
openstackgerrit | Lance Bragstad proposed openstack/oslo.limit master: Add devstack job to .zuul.conf https://review.opendev.org/670079 | 14:44 |
lbragstad | cmurphy i might need a sanity check on some of the .zuul.conf stuff | 14:45 |
lbragstad | i have an idea for another approach, too | 14:45 |
cmurphy | lbragstad: zuul already commented | 14:46 |
cmurphy | lbragstad: is this job supposed to do anything other than just run devstack? | 14:47 |
lbragstad | yeah - so i'm wondering if we need this? | 14:47 |
cmurphy | you don't need to defined a new project that inherits from devstack if it doesn't do anything beyond what the parent job does | 14:47 |
lbragstad | right | 14:47 |
cmurphy | do you would just need to add a new bullet point to check: and gate: in the jobs section | 14:48 |
cmurphy | jobs section of project: | 14:48 |
lbragstad | i was going to follow that up with another patch that filled in the blanks and added the limits specific functional setup | 14:48 |
cmurphy | ah | 14:48 |
cmurphy | well i would just keep it in the same patch | 14:48 |
lbragstad | but... now i'm thinking | 14:48 |
cmurphy | on its own this patch doesn't do anything | 14:48 |
*** awalende has joined #openstack-keystone | 14:48 | |
lbragstad | right | 14:49 |
lbragstad | what if we just add oslo.limit functional tests to tempest? | 14:49 |
lbragstad | and use devstack-tempest in oslo.limits's .zuul.conf? | 14:49 |
cmurphy | tempest is just for API testing | 14:49 |
cmurphy | it has its own REST client for that | 14:50 |
cmurphy | i think more likely you'd want to look at what openstacksdk is doing for functional tests and copy that | 14:50 |
lbragstad | ah | 14:50 |
lbragstad | https://opendev.org/openstack/openstacksdk/src/branch/master/openstack/tests/functional | 14:51 |
*** altlogbot_3 has joined #openstack-keystone | 14:51 | |
lbragstad | so - https://opendev.org/openstack/openstacksdk/src/branch/master/.zuul.yaml#L100-L118 looks like an example functional definition | 14:53 |
*** awalende has quit IRC | 14:53 | |
cmurphy | ++ | 14:54 |
bnemec | ^What she said | 14:55 |
*** altlogbot_3 has quit IRC | 14:56 | |
lbragstad | we could do something similar to https://opendev.org/openstack/openstacksdk/src/branch/master/openstack/tests/functional/base.py#L46 | 14:57 |
lbragstad | i guess at that point we don't really need anything outside of keystone (from devstack) | 14:57 |
lbragstad | whenever nova adds support for consuming unified limits, should those tests live in nova's functional tests then? | 14:58 |
lbragstad | cc johnthetubaguy ^ | 14:58 |
johnthetubaguy | in my head I was leaving it to unit tests + tempest ones, but that does miss the idea of us hammering the edge cases | 15:01 |
cmurphy | nova should probably have tempest tests for whatever quota API it exposes to users | 15:01 |
cmurphy | and yeah maybe some functionl tests for the edge cases | 15:01 |
johnthetubaguy | cmurphy: +1 | 15:02 |
johnthetubaguy | in my head its like limit someone to two instance, boot three and make sure only two work, etc | 15:03 |
*** altlogbot_2 has joined #openstack-keystone | 15:07 | |
lbragstad | ++ | 15:07 |
lbragstad | since oslo.limit isn't really the thing implementing half of that code (the stuff in nova), i'm wonder if/where that should live? | 15:08 |
*** dklyle has quit IRC | 15:09 | |
*** altlogbot_2 has quit IRC | 15:12 | |
*** irclogbot_0 has joined #openstack-keystone | 15:19 | |
*** irclogbot_0 has quit IRC | 15:22 | |
*** altlogbot_2 has joined #openstack-keystone | 15:31 | |
*** altlogbot_2 has quit IRC | 15:34 | |
*** ivve has quit IRC | 15:34 | |
*** dancn has quit IRC | 15:38 | |
*** irclogbot_2 has joined #openstack-keystone | 15:39 | |
*** irclogbot_2 has quit IRC | 15:42 | |
*** altlogbot_1 has joined #openstack-keystone | 15:45 | |
kmalloc | ok. so today is maybe coffee shop, they didn't finish construction until well past 6pm last night | 15:46 |
* kmalloc grumps about this for the next 2-3 months. | 15:47 | |
*** altlogbot_1 has quit IRC | 15:48 | |
*** altlogbot_0 has joined #openstack-keystone | 15:55 | |
*** viks___ has quit IRC | 15:55 | |
*** altlogbot_0 has quit IRC | 15:58 | |
*** gyee has joined #openstack-keystone | 16:16 | |
*** altlogbot_0 has joined #openstack-keystone | 16:49 | |
cmurphy | can I plead for reviews on https://review.opendev.org/636786 - we need to release that in order to get the ball rolling on https://review.opendev.org/633369 which is then needed for the access rules stack in keystone | 16:54 |
*** altlogbot_0 has quit IRC | 16:54 | |
cmurphy | and in general reviews of ksc/ksa/ksm would be good so we can get a release out | 16:55 |
lbragstad | damn | 17:01 |
cmurphy | lol | 17:01 |
openstackgerrit | Lance Bragstad proposed openstack/oslo.limit master: Add devstack job to .zuul.conf https://review.opendev.org/670079 | 17:24 |
*** new_student1411 has quit IRC | 17:47 | |
*** irclogbot_2 has joined #openstack-keystone | 18:05 | |
*** irclogbot_2 has quit IRC | 18:08 | |
openstackgerrit | Merged openstack/oslo.policy master: Add Python 3 Train unit tests https://review.opendev.org/610122 | 18:22 |
*** xek has quit IRC | 18:35 | |
*** xek has joined #openstack-keystone | 18:36 | |
*** dancn has joined #openstack-keystone | 18:37 | |
*** jamesmcarthur has quit IRC | 18:57 | |
*** altlogbot_1 has joined #openstack-keystone | 19:01 | |
*** altlogbot_1 has quit IRC | 19:04 | |
*** tesseract has quit IRC | 19:16 | |
*** dancn has quit IRC | 19:17 | |
*** ivve has joined #openstack-keystone | 19:18 | |
*** irclogbot_3 has joined #openstack-keystone | 19:19 | |
*** irclogbot_3 has quit IRC | 19:22 | |
*** whoami-rajat has quit IRC | 19:24 | |
cmurphy | kmalloc: could you review this backport to unbreak stable/stein https://review.opendev.org/667105 | 19:31 |
kmalloc | cmurphy: looking | 19:31 |
kmalloc | done | 19:32 |
cmurphy | ty | 19:33 |
bnemec | Hey, if anyone gets a chance, could you take a quick look at https://review.opendev.org/#/c/662830 ? | 19:42 |
bnemec | It looks reasonable to me, but I'm not a keystone auth expert so it would be nice if someone who is could sanity check what they're doing. | 19:42 |
*** openstackgerrit has quit IRC | 19:49 | |
*** ivve has quit IRC | 20:14 | |
*** openstackgerrit has joined #openstack-keystone | 20:15 | |
openstackgerrit | Merged openstack/python-keystoneclient master: Add support for app cred access rules header https://review.opendev.org/636786 | 20:15 |
*** altlogbot_3 has joined #openstack-keystone | 20:27 | |
*** jamesmcarthur has joined #openstack-keystone | 20:29 | |
*** altlogbot_3 has quit IRC | 20:32 | |
openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add exercises for intern applicants https://review.opendev.org/669004 | 20:42 |
*** pcaruana has quit IRC | 20:48 | |
*** xek_ has joined #openstack-keystone | 20:51 | |
*** xek has quit IRC | 20:52 | |
*** dklyle has joined #openstack-keystone | 20:55 | |
*** cloudnull has quit IRC | 21:01 | |
*** cloudnull has joined #openstack-keystone | 21:02 | |
*** altlogbot_0 has joined #openstack-keystone | 21:03 | |
*** altlogbot_0 has quit IRC | 21:08 | |
openstackgerrit | Merged openstack/python-keystoneclient master: Update the constraints url https://review.opendev.org/668796 | 21:10 |
*** xek_ has quit IRC | 21:11 | |
*** altlogbot_0 has joined #openstack-keystone | 21:17 | |
*** altlogbot_0 has quit IRC | 21:22 | |
cmurphy | kmalloc: knikolla reviewing https://review.opendev.org/669886 which is a duplicate of ps1 of https://review.opendev.org/655166 i think we need to revisit jose's original work, or i need another refresher on why it's not acceptable | 21:26 |
cmurphy | group membership for federated users is still ephemeral and entirely depends on the mapping driver | 21:26 |
kmalloc | Oh gah, making my brain work today | 21:27 |
kmalloc | :P | 21:27 |
cmurphy | but federated users first of all can't create application credentials at all because the application credential manager uses the list_role_assignments function which goes through the sql driver | 21:27 |
cmurphy | and therefore doesn't pick up that group membership | 21:27 |
cmurphy | (that's why we need renewable) | 21:27 |
kmalloc | Sec, need to type not on mobile. | 21:27 |
cmurphy | and so then even calling list_role_assignments in the token model wouldn't get those ephemeral group memberships | 21:28 |
kmalloc | ok | 21:28 |
cmurphy | kmalloc: no problem i just needed to get that out | 21:28 |
kmalloc | right, so the reason for the fix was to allow for group permissions to create app creds. however, as i recall, fixing group permission of app-cred creation opened the door to federated users in general being able to, if thye use a group-granted-permission | 21:29 |
*** dklyle has quit IRC | 21:29 | |
cmurphy | kmalloc: i have been playing with it and federated users with group-only permissions can't create app creds | 21:30 |
kmalloc | right, today no one with group perms can | 21:30 |
cmurphy | incorrect | 21:30 |
cmurphy | regular users can create them | 21:30 |
cmurphy | they just are unable to use them | 21:30 |
kmalloc | hmm. | 21:30 |
kmalloc | ah | 21:30 |
kmalloc | that was the weird bit. | 21:31 |
cmurphy | that's what people keep trying to fix | 21:31 |
cmurphy | but even with that fix in the token model, that doesn't let federated users create them | 21:31 |
cmurphy | because the group membership is ephemeral | 21:31 |
kmalloc | part of CERN's iteration was federated user support as well | 21:31 |
kmalloc | i think one of the patchsets or some code we looked at was to address that. | 21:32 |
cmurphy | i'm sure they also want that but https://review.opendev.org/#/c/655166/1/keystone/models/token_model.py doesn't do that | 21:32 |
kmalloc | and opened doors that couldn't be done until we have the expiration | 21:32 |
kmalloc | hm. there was something else. | 21:33 |
kmalloc | shrug | 21:33 |
kmalloc | we can land it, i certainly can't remember now. i know there was some reason we couldn't do it, but maybe that was other code | 21:34 |
kmalloc | as long as we are certain we aren't getting federated user app creds, we're good...until expiration | 21:35 |
cmurphy | okay i'm gonna repropose ps1 of 655166 and we can continue the discussion there | 21:35 |
kmalloc | sure. | 21:35 |
* kmalloc gets back to code shuffling | 21:35 | |
kmalloc | the code shuffle is real for trying to get these resource options centralized | 21:35 |
kmalloc | =/ | 21:35 |
kmalloc | the migrations were remarkably easy | 21:36 |
kmalloc | it's ... the rest of the code that isn't | 21:36 |
cmurphy | :) | 21:36 |
openstackgerrit | Colleen Murphy proposed openstack/keystone master: Allows to use application credentials through group membership https://review.opendev.org/655166 | 21:47 |
*** irclogbot_2 has joined #openstack-keystone | 21:47 | |
*** irclogbot_2 has quit IRC | 21:52 | |
*** mchlumsky has quit IRC | 22:10 | |
*** raildo has quit IRC | 22:14 | |
cmurphy | ptg attendance show of hands http://lists.openstack.org/pipermail/openstack-discuss/2019-July/007639.html | 22:16 |
* kmalloc hides | 22:27 | |
*** rcernin has joined #openstack-keystone | 22:48 | |
*** altlogbot_3 has joined #openstack-keystone | 23:03 | |
*** tkajinam has joined #openstack-keystone | 23:06 | |
*** altlogbot_3 has quit IRC | 23:08 | |
*** altlogbot_3 has joined #openstack-keystone | 23:13 | |
*** jamesmcarthur has quit IRC | 23:16 | |
*** altlogbot_3 has quit IRC | 23:18 | |
*** jamesmcarthur has joined #openstack-keystone | 23:19 | |
*** altlogbot_1 has joined #openstack-keystone | 23:19 | |
*** jamesmcarthur has quit IRC | 23:24 | |
*** altlogbot_1 has quit IRC | 23:24 | |
*** jamesmcarthur has joined #openstack-keystone | 23:25 | |
*** altlogbot_1 has joined #openstack-keystone | 23:25 | |
*** altlogbot_1 has quit IRC | 23:30 | |
*** hoonetorg has quit IRC | 23:38 | |
*** hoonetorg has joined #openstack-keystone | 23:40 | |
*** jamesmcarthur has quit IRC | 23:43 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!