openstackgerrit | guang-yee proposed openstack/keystone master: implement system scope for application credential https://review.opendev.org/670926 | 00:48 |
---|---|---|
*** gyee has quit IRC | 00:48 | |
*** imacdonn has quit IRC | 01:16 | |
*** imacdonn has joined #openstack-keystone | 01:16 | |
openstackgerrit | Qiu Fossen proposed openstack/oslo.policy master: Add Python 3 Train unit tests https://review.opendev.org/669658 | 01:29 |
*** jamesmcarthur has joined #openstack-keystone | 02:48 | |
*** jamesmcarthur has quit IRC | 02:48 | |
*** jamesmcarthur has joined #openstack-keystone | 02:48 | |
*** jamesmcarthur has quit IRC | 03:26 | |
*** jamesmcarthur has joined #openstack-keystone | 03:28 | |
*** jamesmcarthur has quit IRC | 03:31 | |
*** jamesmcarthur has joined #openstack-keystone | 03:32 | |
*** jamesmcarthur has quit IRC | 04:33 | |
*** shyamb has joined #openstack-keystone | 04:46 | |
*** vishakha has joined #openstack-keystone | 05:19 | |
*** vishalmanchanda has joined #openstack-keystone | 05:29 | |
*** new_student1411 has joined #openstack-keystone | 05:47 | |
*** shyamb has quit IRC | 05:59 | |
*** shyamb has joined #openstack-keystone | 06:06 | |
*** whoami-rajat has joined #openstack-keystone | 06:06 | |
*** pcaruana has joined #openstack-keystone | 06:20 | |
*** shyam89 has joined #openstack-keystone | 06:35 | |
*** shyamb has quit IRC | 06:36 | |
*** shyam89 has quit IRC | 06:44 | |
*** shyamb has joined #openstack-keystone | 06:52 | |
*** joshualyle has joined #openstack-keystone | 07:13 | |
*** shyamb has quit IRC | 07:22 | |
*** shyam89 has joined #openstack-keystone | 07:22 | |
*** dancn has joined #openstack-keystone | 07:25 | |
*** xek has joined #openstack-keystone | 07:26 | |
*** shyam89 has quit IRC | 07:32 | |
openstackgerrit | Merged openstack/keystone master: Update unified limit documentation https://review.opendev.org/664933 | 07:53 |
*** rcernin has quit IRC | 07:56 | |
*** rcernin has joined #openstack-keystone | 08:12 | |
*** shyam89 has joined #openstack-keystone | 08:29 | |
*** new_student1411 has quit IRC | 08:49 | |
*** new_student1411 has joined #openstack-keystone | 08:56 | |
*** tkajinam has quit IRC | 09:09 | |
*** new_student1411 has quit IRC | 09:18 | |
*** shyam89 has quit IRC | 09:24 | |
*** ayoung has quit IRC | 09:32 | |
*** shyamb has joined #openstack-keystone | 09:33 | |
*** new_student1411 has joined #openstack-keystone | 09:38 | |
*** ayoung has joined #openstack-keystone | 09:44 | |
ileixe | Hi keystone! Could someone please explan the purpose of mapping in federations ? | 09:51 |
ileixe | To be specific, I wonder why only 'mapped' plugin for federation has the features creating projects automatically. | 09:52 |
*** shyamb has quit IRC | 09:57 | |
*** shyamb has joined #openstack-keystone | 09:59 | |
vishakha | Hi ileixe. Mapping file is created in the keystone acting as service provider to map the remote attributes received from the keystone acting as identity provider to give that user some authorization on sp | 10:07 |
ileixe | Thanks for the answer, vishaka. I found the feature has auto-creation of project for whom external system (IdP?) manages | 10:10 |
ileixe | How do you think of other (LDAP for exmple) identity plugin has simliar logic? | 10:10 |
ileixe | I think it's quite general usecase not only for federation | 10:11 |
ileixe | Or am I missunderstanding something | 10:11 |
ileixe | *vishakha sorry | 10:11 |
vishakha | ileixe AFAIK mappings in keystone is for federation only. It does not auto-create a project. You can check more about mappings #link https://docs.openstack.org/keystone/latest/admin/federation/mapping_combinations.html | 10:18 |
vishakha | I hope this helps | 10:19 |
ileixe | Hm.. https://docs.openstack.org/keystone/latest/admin/federation/mapping_combinations.html#auto-provisioning it says it do auto creates a project. | 10:20 |
vishakha | ileixe Mappings is a json file created by the admin on SP. So if the mapping file contains the projects section and if that project does not exist , in that case the project will be created on keystone as service provider and the user existing in IDP will have roles over that project. Yes it will create the project only when projects section is mentioned in mapping file. | 10:29 |
*** new_student1411 has quit IRC | 10:40 | |
*** new_student1411 has joined #openstack-keystone | 10:41 | |
*** shyamb has quit IRC | 10:49 | |
openstackgerrit | Hervé Beraud proposed openstack/oslo.policy master: Add unit tests on the sphinxext indent function https://review.opendev.org/671241 | 10:51 |
*** xek has quit IRC | 10:55 | |
*** xek has joined #openstack-keystone | 10:58 | |
*** shyamb has joined #openstack-keystone | 11:12 | |
*** shyam89 has joined #openstack-keystone | 11:16 | |
*** shyamb has quit IRC | 11:17 | |
*** raildo has joined #openstack-keystone | 11:22 | |
*** tesseract has joined #openstack-keystone | 11:28 | |
*** shyamb has joined #openstack-keystone | 11:29 | |
*** shyam89 has quit IRC | 11:29 | |
*** rcernin has quit IRC | 11:30 | |
*** shyamb has quit IRC | 11:40 | |
*** shyamb has joined #openstack-keystone | 12:41 | |
*** kplant has joined #openstack-keystone | 12:56 | |
kplant | so i've followed https://docs.openstack.org/keystone/latest/admin/federation/configure_federation.html#keystone-as-an-identity-provider-idp and when i try to curl the idp endpoint i get: "<p>The requested URL /v3/OS-FEDERATION/saml2/idp was not found on this server.</p>" | 12:58 |
kplant | any suggestions of where i should start for troubleshooting this? | 12:58 |
*** shyamb has quit IRC | 13:00 | |
knikolla | o/ | 13:26 |
*** jamesmcarthur has joined #openstack-keystone | 13:32 | |
*** vishakha has quit IRC | 13:39 | |
*** jamesmcarthur has quit IRC | 13:54 | |
*** jamesmcarthur has joined #openstack-keystone | 13:56 | |
*** jamesmcarthur has quit IRC | 13:57 | |
*** jamesmcarthur has joined #openstack-keystone | 13:58 | |
*** altlogbot_1 has quit IRC | 14:09 | |
*** hrybacki has joined #openstack-keystone | 14:10 | |
*** irclogbot_0 has quit IRC | 14:17 | |
*** altlogbot_3 has joined #openstack-keystone | 14:17 | |
*** joshualyle has quit IRC | 14:18 | |
*** joshualyle has joined #openstack-keystone | 14:19 | |
*** altlogbot_3 has quit IRC | 14:22 | |
*** jamesmcarthur has quit IRC | 14:26 | |
*** altlogbot_1 has joined #openstack-keystone | 14:27 | |
openstackgerrit | Hervé Beraud proposed openstack/oslo.policy master: Adding tests on cache handler https://review.opendev.org/671309 | 14:30 |
*** altlogbot_1 has quit IRC | 14:32 | |
*** altlogbot_3 has joined #openstack-keystone | 14:33 | |
openstackgerrit | Hervé Beraud proposed openstack/oslo.policy master: Manage cached file not found and adding tests on cache handler https://review.opendev.org/671309 | 14:37 |
*** altlogbot_3 has quit IRC | 14:38 | |
*** altlogbot_3 has joined #openstack-keystone | 14:39 | |
*** altlogbot_3 has quit IRC | 14:44 | |
*** altlogbot_0 has joined #openstack-keystone | 14:45 | |
*** jamesmcarthur has joined #openstack-keystone | 14:49 | |
*** altlogbot_0 has quit IRC | 14:50 | |
*** altlogbot_3 has joined #openstack-keystone | 14:51 | |
*** altlogbot_3 has quit IRC | 14:56 | |
*** altlogbot_1 has joined #openstack-keystone | 14:57 | |
*** gyee has joined #openstack-keystone | 14:59 | |
*** altlogbot_1 has quit IRC | 15:02 | |
*** altlogbot_3 has joined #openstack-keystone | 15:04 | |
*** altlogbot_3 has quit IRC | 15:08 | |
*** altlogbot_3 has joined #openstack-keystone | 15:14 | |
*** altlogbot_3 has quit IRC | 15:18 | |
openstackgerrit | guang-yee proposed openstack/keystone master: update documentation for X.509 tokenless auth https://review.opendev.org/669790 | 15:18 |
*** mflynn has joined #openstack-keystone | 15:19 | |
*** altlogbot_3 has joined #openstack-keystone | 15:19 | |
*** altlogbot_3 has quit IRC | 15:24 | |
*** jamesmcarthur has quit IRC | 15:24 | |
*** joshualyle has quit IRC | 15:30 | |
*** dancn has quit IRC | 15:32 | |
*** altlogbot_1 has joined #openstack-keystone | 15:33 | |
cmurphy | ileixe: did your question get answered? projects can be auto-created for federated users through mappings so that they can already have role assignments on projects without the admin having to create their role assignments directly | 15:37 |
*** altlogbot_1 has quit IRC | 15:38 | |
*** altlogbot_3 has joined #openstack-keystone | 15:40 | |
cmurphy | kplant: the example in that document with /v3/OS-FEDERATION/saml2/idp is part of the entity ID and not part of a real URL | 15:40 |
*** altlogbot_3 has quit IRC | 15:44 | |
*** altlogbot_2 has joined #openstack-keystone | 15:45 | |
*** altlogbot_2 has quit IRC | 15:50 | |
*** altlogbot_2 has joined #openstack-keystone | 15:51 | |
*** altlogbot_2 has quit IRC | 15:58 | |
*** altlogbot_1 has joined #openstack-keystone | 16:03 | |
*** altlogbot_1 has quit IRC | 16:08 | |
*** altlogbot_3 has joined #openstack-keystone | 16:09 | |
*** irclogbot_2 has joined #openstack-keystone | 16:14 | |
*** altlogbot_3 has quit IRC | 16:14 | |
*** altlogbot_1 has joined #openstack-keystone | 16:15 | |
*** irclogbot_2 has quit IRC | 16:17 | |
*** efried is now known as efried_rollin | 16:21 | |
*** irclogbot_0 has joined #openstack-keystone | 16:23 | |
*** irclogbot_0 has quit IRC | 16:26 | |
*** irclogbot_1 has joined #openstack-keystone | 16:27 | |
*** irclogbot_1 has quit IRC | 16:30 | |
*** irclogbot_0 has joined #openstack-keystone | 16:31 | |
*** dancn has joined #openstack-keystone | 16:32 | |
*** irclogbot_0 has quit IRC | 16:34 | |
*** altlogbot_1 has quit IRC | 16:34 | |
openstackgerrit | Hervé Beraud proposed openstack/oslo.policy master: Manage cached file not found and adding tests on cache handler https://review.opendev.org/671309 | 16:34 |
*** irclogbot_1 has joined #openstack-keystone | 16:35 | |
*** vishakha has joined #openstack-keystone | 16:35 | |
*** altlogbot_0 has joined #openstack-keystone | 16:36 | |
*** irclogbot_1 has quit IRC | 16:38 | |
*** irclogbot_3 has joined #openstack-keystone | 16:39 | |
*** irclogbot_3 has quit IRC | 16:42 | |
*** irclogbot_2 has joined #openstack-keystone | 16:43 | |
*** irclogbot_2 has quit IRC | 16:46 | |
*** irclogbot_1 has joined #openstack-keystone | 16:47 | |
*** irclogbot_1 has quit IRC | 16:50 | |
*** irclogbot_1 has joined #openstack-keystone | 16:51 | |
*** irclogbot_1 has quit IRC | 16:54 | |
*** irclogbot_3 has joined #openstack-keystone | 16:55 | |
*** irclogbot_3 has quit IRC | 16:58 | |
*** irclogbot_3 has joined #openstack-keystone | 16:59 | |
*** irclogbot_3 has quit IRC | 17:02 | |
*** irclogbot_1 has joined #openstack-keystone | 17:03 | |
kplant | cmurphy: that makes sense, ty | 17:05 |
*** irclogbot_1 has quit IRC | 17:06 | |
*** irclogbot_3 has joined #openstack-keystone | 17:07 | |
kplant | cmurphy: so if i'm trying to point a keystone towards another keystone for idp what url should i use? | 17:09 |
*** irclogbot_3 has quit IRC | 17:10 | |
*** irclogbot_0 has joined #openstack-keystone | 17:11 | |
*** irclogbot_0 has quit IRC | 17:14 | |
cmurphy | kplant: by "point towards another keystone" what do you mean, which part of the documentation are you trying to follow? | 17:14 |
*** irclogbot_1 has joined #openstack-keystone | 17:15 | |
kplant | sure i'll give as much detail as i can, i'm trying to merge multiple clouds by way of k2k federation so... | 17:15 |
kplant | i have two devstack environments for testing, i'm making keystone#1 an SP and using samltest.id for idp | 17:15 |
kplant | keystone#2 i'm trying to configure as an IdP and then add keystone#2 to keystone#1 as an idp | 17:16 |
kplant | does that make sense? | 17:16 |
cmurphy | sure | 17:16 |
kplant | i've chosen to use mellon for the auth module since that's already included in the kolla containers so i don't need to modify the containers (lazy bonus) | 17:17 |
kplant | so i guess my current queston is if [saml]/idp_entity_id is not a real url for keystone#2 idp... what is? | 17:17 |
*** irclogbot_1 has quit IRC | 17:18 | |
*** irclogbot_2 has joined #openstack-keystone | 17:19 | |
openstackgerrit | Merged openstack/keystone master: Add exercises for intern applicants https://review.opendev.org/669004 | 17:19 |
*** jamesmcarthur has joined #openstack-keystone | 17:19 | |
cmurphy | keystone#2 isn't capable of acting as an idp the same way that samltest.id is, so actually the real URL doesn't matter, you actually need to point keystone#2 at keystone#1 | 17:20 |
cmurphy | the weird auth flow is explained here https://docs.openstack.org/keystone/latest/admin/federation/introduction.html#id3 | 17:21 |
openstackgerrit | Hervé Beraud proposed openstack/oslo.policy master: Remove useless strip code and add unit tests on the sphinxext indent function https://review.opendev.org/671241 | 17:21 |
cmurphy | the url of the keystone sp that you need to give to the keystone idp is here https://docs.openstack.org/keystone/latest/admin/federation/configure_federation.html#creating-a-service-provider-resource | 17:21 |
kplant | so just adding keystone#1 as an sp to keystone#2 will suffice? | 17:21 |
*** irclogbot_2 has quit IRC | 17:22 | |
cmurphy | yes it should | 17:22 |
*** irclogbot_1 has joined #openstack-keystone | 17:23 | |
kplant | alright, appreciate the answers for sure | 17:23 |
cmurphy | oh you also need to add the idp's metadata to the sp | 17:23 |
kplant | is there a url for that? or should i just grab the output from keystone-manage | 17:24 |
openstackgerrit | guang-yee proposed openstack/keystone master: implement system scope for application credential https://review.opendev.org/670926 | 17:25 |
cmurphy | it's under https://developer.openstack.org/api-ref/identity/v3-ext/#retrieve-metadata-properties or you can just scp the file that was created by keystone-manage | 17:26 |
*** irclogbot_1 has quit IRC | 17:26 | |
kplant | great, ty | 17:26 |
cmurphy | yw | 17:26 |
*** irclogbot_1 has joined #openstack-keystone | 17:27 | |
kplant | so my end goal here is to have all of the clouds using their local keystone for services but a user should be able to pop into the horizon instance in any region and switch to any other region | 17:27 |
kplant | am i going down the right path with k2k federation? | 17:27 |
cmurphy | yep that should work | 17:28 |
cmurphy | you'll have to make every keystone both an sp and idp for every other keystone | 17:28 |
kplant | would i be able to make all keystones SPs and use something like keycloak as an IdP? | 17:28 |
ayoung | kplant, what is the source of user identity? | 17:29 |
kplant | currently it's keystone, i would like to use freeipa down the line | 17:29 |
cmurphy | kplant: you wouldn't be able to switch keystones from horizion if only keycloak is the idp | 17:29 |
*** irclogbot_1 has quit IRC | 17:30 | |
ayoung | kplant, One Keystone server? | 17:30 |
kplant | today it's one keystone instance (3 in HA) | 17:31 |
*** irclogbot_3 has joined #openstack-keystone | 17:31 | |
kplant | next quarter our second region will be online | 17:31 |
ayoung | If you consolidate all of the users in a single place, then that becomes your Federated Identity Provider | 17:31 |
ayoung | Keep all users in there, add second Keystone, K2K from first to second only | 17:31 |
ayoung | Second Keystone not allowed to add users, just consume from the first | 17:31 |
ayoung | If you extract to FreeIPA, the rules are the same | 17:32 |
ayoung | Or with Keycloak | 17:32 |
kplant | yeah ideally i'd like to be using keystone -saml-> keycloak -> freeipa | 17:33 |
kplant | that way if the one keystone instance that's also the idp with all of the users dies, the other clouds aren't impacted | 17:33 |
*** irclogbot_3 has quit IRC | 17:34 | |
*** irclogbot_0 has joined #openstack-keystone | 17:35 | |
*** irclogbot_0 has quit IRC | 17:38 | |
*** irclogbot_2 has joined #openstack-keystone | 17:39 | |
*** irclogbot_2 has quit IRC | 17:42 | |
*** irclogbot_0 has joined #openstack-keystone | 17:43 | |
*** irclogbot_0 has quit IRC | 17:46 | |
*** irclogbot_0 has joined #openstack-keystone | 17:47 | |
openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add new attribute to the federation protocol API https://review.opendev.org/637305 | 17:50 |
*** irclogbot_0 has quit IRC | 17:50 | |
*** irclogbot_1 has joined #openstack-keystone | 17:51 | |
*** irclogbot_1 has quit IRC | 17:54 | |
*** irclogbot_1 has joined #openstack-keystone | 17:55 | |
*** irclogbot_1 has quit IRC | 17:58 | |
*** irclogbot_2 has joined #openstack-keystone | 17:59 | |
*** irclogbot_2 has quit IRC | 18:02 | |
*** irclogbot_0 has joined #openstack-keystone | 18:03 | |
*** irclogbot_0 has quit IRC | 18:06 | |
*** irclogbot_1 has joined #openstack-keystone | 18:07 | |
*** irclogbot_1 has quit IRC | 18:10 | |
*** irclogbot_2 has joined #openstack-keystone | 18:11 | |
*** irclogbot_2 has quit IRC | 18:14 | |
*** irclogbot_1 has joined #openstack-keystone | 18:15 | |
*** irclogbot_1 has quit IRC | 18:18 | |
*** irclogbot_3 has joined #openstack-keystone | 18:19 | |
*** irclogbot_3 has quit IRC | 18:22 | |
*** irclogbot_3 has joined #openstack-keystone | 18:23 | |
*** irclogbot_3 has quit IRC | 18:26 | |
*** irclogbot_2 has joined #openstack-keystone | 18:27 | |
*** irclogbot_2 has quit IRC | 18:30 | |
*** irclogbot_1 has joined #openstack-keystone | 18:31 | |
*** irclogbot_1 has quit IRC | 18:34 | |
*** irclogbot_0 has joined #openstack-keystone | 18:35 | |
*** irclogbot_0 has quit IRC | 18:38 | |
*** irclogbot_3 has joined #openstack-keystone | 18:39 | |
*** irclogbot_3 has quit IRC | 18:42 | |
*** irclogbot_1 has joined #openstack-keystone | 18:43 | |
*** irclogbot_1 has quit IRC | 18:46 | |
*** irclogbot_0 has joined #openstack-keystone | 18:47 | |
*** irclogbot_0 has quit IRC | 18:50 | |
*** irclogbot_2 has joined #openstack-keystone | 18:51 | |
*** irclogbot_2 has quit IRC | 18:54 | |
*** irclogbot_1 has joined #openstack-keystone | 18:55 | |
*** irclogbot_1 has quit IRC | 18:58 | |
*** irclogbot_2 has joined #openstack-keystone | 18:59 | |
*** irclogbot_2 has quit IRC | 19:02 | |
*** new_student1411 has quit IRC | 19:03 | |
*** irclogbot_0 has joined #openstack-keystone | 19:03 | |
*** irclogbot_0 has quit IRC | 19:06 | |
*** irclogbot_2 has joined #openstack-keystone | 19:07 | |
*** dancn has quit IRC | 19:09 | |
*** irclogbot_2 has quit IRC | 19:10 | |
*** irclogbot_2 has joined #openstack-keystone | 19:11 | |
*** irclogbot_2 has quit IRC | 19:14 | |
*** irclogbot_0 has joined #openstack-keystone | 19:15 | |
*** irclogbot_0 has quit IRC | 19:18 | |
*** irclogbot_2 has joined #openstack-keystone | 19:19 | |
*** irclogbot_2 has quit IRC | 19:22 | |
*** irclogbot_1 has joined #openstack-keystone | 19:23 | |
*** irclogbot_1 has quit IRC | 19:26 | |
*** irclogbot_3 has joined #openstack-keystone | 19:27 | |
*** vishakha has quit IRC | 19:27 | |
*** irclogbot_3 has quit IRC | 19:30 | |
*** irclogbot_0 has joined #openstack-keystone | 19:31 | |
*** irclogbot_0 has quit IRC | 19:34 | |
*** irclogbot_1 has joined #openstack-keystone | 19:35 | |
*** irclogbot_1 has quit IRC | 19:38 | |
*** irclogbot_1 has joined #openstack-keystone | 19:39 | |
*** irclogbot_1 has quit IRC | 19:42 | |
*** irclogbot_2 has joined #openstack-keystone | 19:43 | |
*** irclogbot_2 has quit IRC | 19:46 | |
*** irclogbot_3 has joined #openstack-keystone | 19:47 | |
*** gyee has quit IRC | 19:49 | |
*** gyee has joined #openstack-keystone | 19:50 | |
*** irclogbot_3 has quit IRC | 19:50 | |
*** irclogbot_2 has joined #openstack-keystone | 19:51 | |
*** kplant has quit IRC | 19:52 | |
*** mflynn has quit IRC | 19:54 | |
*** irclogbot_2 has quit IRC | 19:54 | |
*** irclogbot_0 has joined #openstack-keystone | 19:55 | |
*** irclogbot_0 has quit IRC | 19:58 | |
*** irclogbot_1 has joined #openstack-keystone | 19:59 | |
*** irclogbot_1 has quit IRC | 20:02 | |
*** irclogbot_0 has joined #openstack-keystone | 20:03 | |
*** irclogbot_0 has quit IRC | 20:06 | |
*** irclogbot_2 has joined #openstack-keystone | 20:07 | |
*** irclogbot_2 has quit IRC | 20:09 | |
*** bnemec has quit IRC | 20:11 | |
*** irclogbot_1 has joined #openstack-keystone | 20:11 | |
*** irclogbot_1 has quit IRC | 20:14 | |
*** bnemec has joined #openstack-keystone | 20:15 | |
*** beekneemech has joined #openstack-keystone | 20:16 | |
*** bnemec has quit IRC | 20:16 | |
*** beekneemech has quit IRC | 20:16 | |
*** bnemec has joined #openstack-keystone | 20:16 | |
*** efried_rollin is now known as efried | 20:18 | |
*** beekneemech has joined #openstack-keystone | 20:18 | |
*** joshualyle has joined #openstack-keystone | 20:21 | |
*** xek has quit IRC | 20:21 | |
*** irclogbot_1 has joined #openstack-keystone | 20:44 | |
*** irclogbot_1 has quit IRC | 20:46 | |
*** pcaruana has quit IRC | 20:48 | |
*** bnemec has quit IRC | 20:48 | |
*** jamesmcarthur has quit IRC | 20:51 | |
*** bnemec has joined #openstack-keystone | 20:51 | |
*** beekneemech has quit IRC | 20:54 | |
*** raildo has quit IRC | 21:06 | |
*** irclogbot_3 has joined #openstack-keystone | 21:23 | |
*** whoami-rajat has quit IRC | 21:36 | |
*** tesseract has quit IRC | 22:40 | |
*** rcernin has joined #openstack-keystone | 23:11 | |
*** tkajinam has joined #openstack-keystone | 23:15 | |
*** rcernin has quit IRC | 23:16 | |
*** rcernin has joined #openstack-keystone | 23:17 | |
*** jamesmcarthur has joined #openstack-keystone | 23:23 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!