| *** xek__ has joined #openstack-keystone | 00:00 | |
| openstackgerrit | guang-yee proposed openstack/keystone master: discourage using X.509 with external auth https://review.opendev.org/669959 | 00:01 |
|---|---|---|
| *** xek_ has quit IRC | 00:02 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:03 | |
| *** jamesmcarthur has quit IRC | 00:06 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:06 | |
| *** gyee has quit IRC | 00:19 | |
| *** raildo has quit IRC | 01:10 | |
| *** jamesmcarthur has quit IRC | 01:30 | |
| *** whoami-rajat has joined #openstack-keystone | 02:26 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:59 | |
| *** joshualyle has joined #openstack-keystone | 04:20 | |
| *** viks___ has joined #openstack-keystone | 04:26 | |
| *** jamesmcarthur has quit IRC | 04:32 | |
| *** jaosorior has joined #openstack-keystone | 05:21 | |
| *** etp has joined #openstack-keystone | 05:27 | |
| *** jamesmcarthur has joined #openstack-keystone | 05:45 | |
| *** rcernin has quit IRC | 06:08 | |
| *** jamesmcarthur has quit IRC | 06:33 | |
| *** etp has quit IRC | 07:02 | |
| *** tesseract has joined #openstack-keystone | 07:03 | |
| *** awalende has joined #openstack-keystone | 07:19 | |
| *** pcaruana has joined #openstack-keystone | 07:44 | |
| *** ivve has joined #openstack-keystone | 08:37 | |
| *** dancn has joined #openstack-keystone | 09:04 | |
| *** joshualyle has quit IRC | 09:23 | |
| openstackgerrit | Dmitry Tantsur proposed openstack/keystoneauth master: Allow requesting fixed retry delay instead of exponential https://review.opendev.org/672930 | 09:39 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone master: doc: Fix broken links https://review.opendev.org/672947 | 10:32 |
| *** brtknr has quit IRC | 10:36 | |
| *** brtknr has joined #openstack-keystone | 10:37 | |
| *** brtknr has quit IRC | 11:02 | |
| *** brtknr has joined #openstack-keystone | 11:02 | |
| *** brtknr has quit IRC | 11:02 | |
| *** brtknr has joined #openstack-keystone | 11:03 | |
| *** brtknr has quit IRC | 11:06 | |
| *** brtknr has joined #openstack-keystone | 11:10 | |
| *** kplant has joined #openstack-keystone | 11:11 | |
| *** jaosorior has quit IRC | 11:15 | |
| *** mvkr has joined #openstack-keystone | 11:16 | |
| *** irclogbot_3 has quit IRC | 11:53 | |
| *** irclogbot_0 has joined #openstack-keystone | 11:54 | |
| openstackgerrit | Chason Chan proposed openstack/keystone master: Deprecate keystone.conf.memcache socket_timeout https://review.opendev.org/672629 | 11:57 |
| *** raildo has joined #openstack-keystone | 12:13 | |
| *** awalende has quit IRC | 12:31 | |
| *** waverider has joined #openstack-keystone | 12:34 | |
| kplant | cmurphy: i may have found the problem from yesterday "User has disabled cookies, or has lost the cookie before returning from the SAML2 login server." <-- that's coming from apache running keystone | 12:59 |
| kplant | that may explain the 400 coming back from keycloak to keystone | 13:00 |
| *** xek__ has quit IRC | 13:01 | |
| *** brtknr has quit IRC | 13:01 | |
| *** xek__ has joined #openstack-keystone | 13:02 | |
| *** brtknr has joined #openstack-keystone | 13:03 | |
| *** brtknr has quit IRC | 13:05 | |
| *** brtknr has joined #openstack-keystone | 13:05 | |
| *** brtknr has quit IRC | 13:05 | |
| *** brtknr has joined #openstack-keystone | 13:06 | |
| *** brtknr has quit IRC | 13:06 | |
| *** brtknr has joined #openstack-keystone | 13:06 | |
| *** jawad_axd has joined #openstack-keystone | 13:24 | |
| *** mchlumsky has joined #openstack-keystone | 13:26 | |
| *** stingrayza_ has joined #openstack-keystone | 13:28 | |
| *** stingrayza has quit IRC | 13:28 | |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone master: Remove broken api-ref link https://review.opendev.org/672979 | 13:31 |
| *** jawad_axd has quit IRC | 13:37 | |
| *** waverider has quit IRC | 13:39 | |
| *** xek__ has quit IRC | 13:46 | |
| *** xek__ has joined #openstack-keystone | 13:47 | |
| *** FlorianFa has quit IRC | 13:58 | |
| *** mchlumsky_ has joined #openstack-keystone | 13:59 | |
| *** mchlumsky has quit IRC | 14:00 | |
| kplant | also fwiw i have the same exact behavior with samltest.id as the idp | 14:13 |
| *** jmlowe has quit IRC | 14:17 | |
| *** bnemec is now known as beekneemech | 14:26 | |
| *** xek__ has quit IRC | 14:28 | |
| *** xek__ has joined #openstack-keystone | 14:29 | |
| *** jmlowe has joined #openstack-keystone | 14:29 | |
| *** jamesmcarthur has joined #openstack-keystone | 14:43 | |
| gagehugo | o/ | 14:45 |
| *** dancn has quit IRC | 14:47 | |
| gagehugo | cmurphy: Do you know if the info in the federation section of the security guide still relevant? https://docs.openstack.org/security-guide/identity/federated-keystone.html#future | 14:51 |
| *** openstackgerrit has quit IRC | 14:51 | |
| *** jmlowe has quit IRC | 15:07 | |
| cmurphy | gagehugo: the security guide is wildly out of date, i tried to bring it up as a bug report a long time ago and as shot down | 15:11 |
| cmurphy | gagehugo: i wish the security team wouldn't maintain its own copy of the keystone docs | 15:12 |
| cmurphy | kplant: is that because you disabled cookies? or something else is wrong? | 15:13 |
| gagehugo | cmurphy: we have someone in the security sig who is working on updating the guide, we could simply link to the keystone docs and get rid of that page entirely | 15:13 |
| kplant | hah. i wish it were that simple. my browser allows cookies and i even tried a few others as well | 15:13 |
| cmurphy | gagehugo: that would be fantastic | 15:13 |
| *** Ben78 has joined #openstack-keystone | 15:16 | |
| *** jamesmcarthur has quit IRC | 15:17 | |
| *** jamesmcarthur has joined #openstack-keystone | 15:21 | |
| *** cmurphy is now known as cmorpheus | 15:25 | |
| *** jmlowe has joined #openstack-keystone | 15:29 | |
| *** xek__ has quit IRC | 15:51 | |
| *** xek__ has joined #openstack-keystone | 15:51 | |
| *** joshualyle has joined #openstack-keystone | 15:52 | |
| *** joshualyle has quit IRC | 15:57 | |
| *** gyee has joined #openstack-keystone | 15:59 | |
| *** jamesmcarthur has quit IRC | 16:15 | |
| *** jamesmcarthur has joined #openstack-keystone | 16:16 | |
| *** jamesmcarthur has quit IRC | 16:21 | |
| *** vishwanathj has quit IRC | 16:22 | |
| *** AJaeger has joined #openstack-keystone | 16:24 | |
| *** vishwanathj has joined #openstack-keystone | 16:24 | |
| AJaeger | I've noticed a couple of broken links in the keystone docs when building our site index - and those come from broken usage of RST in a few cases. Fixed by https://review.opendev.org/672947 (broken RST) and a tiny one at https://review.opendev.org/672979 . | 16:25 |
| cmorpheus | thanks AJaeger | 16:30 |
| *** jamesmcarthur has joined #openstack-keystone | 16:31 | |
| AJaeger | you're welcome, cmorpheus | 16:33 |
| *** jamesmcarthur has quit IRC | 16:36 | |
| *** jamesmcarthur has joined #openstack-keystone | 16:36 | |
| *** vishwanathj has quit IRC | 16:44 | |
| *** vishwanathj has joined #openstack-keystone | 16:46 | |
| *** AJaeger has left #openstack-keystone | 16:46 | |
| *** joshualyle has joined #openstack-keystone | 16:55 | |
| *** joshualyle has quit IRC | 16:55 | |
| *** vishwanathj has quit IRC | 17:00 | |
| *** jamesmcarthur has quit IRC | 17:08 | |
| *** vishwanathj has joined #openstack-keystone | 17:09 | |
| *** Ben78 has quit IRC | 17:28 | |
| *** vishwanathj has quit IRC | 17:28 | |
| mnaser | o/ i asked this a little bit earlier but it was late so i will try again: is it possible to run keystonemiddleware without admin credentials? | 17:33 |
| mnaser | i.e. using the token provided to go to keystone and look it up there? | 17:33 |
| *** tesseract has quit IRC | 17:54 | |
| *** chason has quit IRC | 17:56 | |
| *** Ben78 has joined #openstack-keystone | 17:57 | |
| gyee | mnaser, I don't think so. But it doesn't have to be admin cred, just any cred that has user token validation permission. | 18:02 |
| *** openstackgerrit has joined #openstack-keystone | 18:02 | |
| openstackgerrit | Merged openstack/keystone master: doc: Fix broken links https://review.opendev.org/672947 | 18:02 |
| openstackgerrit | Merged openstack/keystone master: Remove broken api-ref link https://review.opendev.org/672979 | 18:02 |
| *** joshualyle has joined #openstack-keystone | 18:09 | |
| *** cwright has quit IRC | 18:11 | |
| *** joshualyle has quit IRC | 18:12 | |
| cmorpheus | mnaser: you can use any auth method supported by keystoneauth | 18:23 |
| cmorpheus | mnaser: can you explain a little more what you're trying to do? | 18:24 |
| mnaser | cmorpheus: in this case, writing a service that authenticates against keystone (but without necessarily being the deployer/owner of said cloud) | 18:24 |
| kmalloc | cmorpheus: ^ we just talked about pretty much that scenario | 18:28 |
| kmalloc | :) | 18:28 |
| cmorpheus | kmalloc: lol | 18:29 |
| cmorpheus | mnaser: yeah i don't think ksm is equipped to handle something like that, it relies pretty strongly on having a service user do things on behalf of the user | 18:29 |
| mnaser | aha, aww, alright | 18:30 |
| openstackgerrit | Merged openstack/keystone master: Remove [signing] config https://review.opendev.org/659434 | 18:41 |
| *** jmlowe has quit IRC | 18:43 | |
| kplant | cmorpheus: sorry to keep singling you out but... do you have any other recommendations? i tried a samltrace and everything looks kosher there as well | 18:58 |
| cmorpheus | kplant: okay let's backtrack | 19:03 |
| cmorpheus | https://docs.openstack.org/keystone/latest/admin/federation/introduction.html#websso-with-keystone-and-horizon | 19:03 |
| cmorpheus | it's failing at the part after you've auth'd with the idp and it's trying to POST to a mellon endpoint? | 19:03 |
| kplant | correct | 19:04 |
| *** vishalmanchanda has quit IRC | 19:05 | |
| cmorpheus | but you see a log in keystone saying "expected content-type application/json" at that moment? | 19:05 |
| kplant | no that was when i intially was using /v3/mellon as the mellon endpoint | 19:06 |
| kplant | i changed it to: /v3/OS-FEDERATION/identity_providers/keycloak/protocols/saml2/auth/mellon | 19:06 |
| kplant | now the response is: a 400, bad request | 19:06 |
| kplant | the only thing i can pick out from the logs is from apache: "User has disabled cookies, or has lost the cookie before returning from the SAML2 login server." | 19:06 |
| kplant | that happens when my browser is trying to post to the mellon postResponse endpoint | 19:07 |
| cmorpheus | can you tell what the path is that it's trying to use now for the postResponse endpoint? | 19:07 |
| kplant | sure | 19:07 |
| kplant | the full path is: http://sp.keystone.example.org:5000/v3/OS-FEDERATION/identity_providers/keycloak/protocols/saml2/auth/mellon/postResponse | 19:08 |
| cmorpheus | isn't that the same path it was using when you were getting the "expected content-type" problem? | 19:08 |
| kplant | yeah, so the mellon script generated that endpoint in the metadata | 19:09 |
| kplant | so i changed MellonEndpointPath to match it | 19:09 |
| kplant | if i change MellonEndpointPath back to "/v3/mellon" i just get an endless loop now. not even the content-type issue | 19:10 |
| cmorpheus | that's weird | 19:10 |
| cmorpheus | does the 400 error come from keystone or from mellon? | 19:11 |
| cmorpheus | can you show your whole apache config for this vhost? | 19:11 |
| cmorpheus | knikolla: if you're around and have ideas ^ | 19:11 |
| knikolla | cmorpheus: i'm around (and in need of a break from studying japanese) let me read the convo | 19:12 |
| knikolla | logs would be helpful | 19:14 |
| kplant | sorry i had to step away for a moment | 19:18 |
| kplant | sure i can share my config | 19:18 |
| kplant | http://paste.openstack.org/show/754903/ | 19:18 |
| *** jmlowe has joined #openstack-keystone | 19:19 | |
| kplant | cmorpheus: i assume the 400 comes from mellon as it's produced by apache and the event is never recorded in any keystone log | 19:19 |
| kplant | but i could be wrong | 19:19 |
| cmorpheus | kplant: can you share the logs? | 19:20 |
| kplant | sure. what are you looking for exactly? all i can see is "2019-07-26 18:59:36.021713 User has disabled cookies, or has lost the cookie before returning from the SAML2 login server." | 19:21 |
| knikolla | the more the merrier | 19:21 |
| cmorpheus | kplant: the 400 error | 19:21 |
| kplant | http://paste.openstack.org/show/754904/ | 19:22 |
| kplant | started the tail, tried to auth, stopped the tail | 19:22 |
| kplant | let me know if you need more from any specific files | 19:22 |
| knikolla | NotOnOrAfter in SubjectConfirmationData was in the past. | 19:24 |
| knikolla | have you checked that are on the same timezone? | 19:24 |
| kplant | keycloak is in utc, keystone is in utc, client is in edt | 19:25 |
| kplant | http://paste.openstack.org/show/754906/ <-- that's the horizon config as well, the websso statements | 19:31 |
| *** brtknr has quit IRC | 19:40 | |
| *** brtknr has joined #openstack-keystone | 19:40 | |
| cmorpheus | knikolla: that log was from a few minutes before so i'm guessing not relevant | 19:44 |
| kplant | mellon is at least somewhat working as metadata is served when i curl /v3/OS-FEDERATION/identity_providers/keycloak/protocols/saml2/auth/mellon/metadata | 19:48 |
| cmorpheus | kplant: can you paste the metadata? | 19:51 |
| cmorpheus | only thing i can find about that error is in the code itself https://github.com/Uninett/mod_auth_mellon/blob/master/auth_mellon_handler.c#L1845-L1850 which looks pretty straightforward | 19:52 |
| kplant | yeah i found that too | 19:52 |
| kplant | no cookie, throw error message | 19:52 |
| kplant | and sure | 19:52 |
| cmorpheus | in your samltrace when it does POST <stuff>/postResponse is there a Cookie: header ? | 19:53 |
| kplant | http://paste.openstack.org/show/754907/ | 19:54 |
| kplant | i will check | 19:54 |
| kplant | nope, no "cookie" inside <samlp:Response blah blah | 19:56 |
| kplant | no cookie in the html either | 19:56 |
| *** jmlowe has quit IRC | 19:57 | |
| kplant | here's the saml if you care to see it: http://paste.openstack.org/show/754908/ | 20:00 |
| *** jmlowe has joined #openstack-keystone | 20:00 | |
| kplant | i'm heading home. i'll check the channel logs when i get home for updates. thanks cmorpheus knikolla ! | 20:00 |
| *** kplant has quit IRC | 20:00 | |
| cmorpheus | just seems like some kind of issue between the idp and the browser afaict | 20:02 |
| cmorpheus | i would try using the cli and see if you can get that to work | 20:02 |
| *** brtknr_ has joined #openstack-keystone | 20:19 | |
| *** brtknr has quit IRC | 20:22 | |
| *** mchlumsky_ has quit IRC | 20:35 | |
| kmalloc | mnaser: cmorpheus and I were just talking about a service that could be used to auth endpoint in front of keystone to solve pretty much your exact use-case. | 20:44 |
| kmalloc | mnaser: it's just very early on in that discussion. | 20:44 |
| mnaser | ya in this case im trying to build a service that talks on behalf of openstack users | 20:45 |
| mnaser | so a deployer can run it (but a user can deploy it too, as long as they point to keystone and nothing more) | 20:45 |
| *** kplant has joined #openstack-keystone | 20:58 | |
| kplant | do i need anything additional other than python-openstackclient and python-keystoneclient? i don't seem to have v3samlpassword as a valid auth type for cli | 21:14 |
| kplant | nvm. was missing lxml | 21:15 |
| kmalloc | mnaser: ahh | 21:19 |
| kmalloc | mnaser: hhhhmmmm. thats tough cause token validation is considered (in many cases) priviledged. | 21:20 |
| *** beekneemech is now known as bnemec-pto | 21:22 | |
| kplant | cmorpheus: CLI yields: "/S:Envelope/S:Header/ecp:Response/@AssertionConsumerServiceURL should provide a single element list" | 21:23 |
| cmorpheus | oh hrm i can't remember what the fix is for that | 21:23 |
| cmorpheus | it's keystoneauth handling an error response really really badly i think | 21:24 |
| kmalloc | oooh that one... | 21:24 |
| kmalloc | uhm. yeah that's a weird one. | 21:24 |
| cmorpheus | kplant: oh suggestion i should have mentioned before is check the logs on the idp | 21:25 |
| cmorpheus | if you haven't already | 21:25 |
| cmorpheus | samltest.id has them available | 21:25 |
| kplant | yeah the idp just shows successful authentications | 21:25 |
| kplant | good thing you mentioned that though.. my credentials where wrong in the rc | 21:26 |
| kplant | well now it's literally the same error: | 21:27 |
| kplant | [kplant@chrnc-void-kolla-01 ~]$ openstack federation project list --insecure | 21:27 |
| kplant | Bad Request (HTTP 400) | 21:27 |
| cmorpheus | same thing in the apache/keystone logs? | 21:28 |
| cmorpheus | you can add --debug to see what requests the client is making too | 21:29 |
| kplant | yeah i was just looking at that | 21:31 |
| kplant | http://paste.openstack.org/show/754912/ | 21:31 |
| kplant | i'm looking at the logs right now too | 21:31 |
| kplant | this is new: http://paste.openstack.org/ | 21:34 |
| kplant | err | 21:34 |
| kplant | http://paste.openstack.org/show/754914/ | 21:34 |
| mnaser | kmalloc: yeah but my thought process was -- i can take the token that i was given, i will reach out to keystone with said token and ask what roles/projects i have acces sto | 21:37 |
| mnaser | i mean, isnt that already avaialble when you request a token anyways | 21:37 |
| cmorpheus | kplant: not sure about that part | 21:38 |
| cmorpheus | best i can figure it's something wrong with the apache <Location ...> and/or MellonEndpointPath because the 400 is just apache saying that's not a path you've defined | 21:39 |
| kplant | i wonder if apache redirecting to haproxy vip is making am_handle_logout_response() return invalidly | 21:39 |
| kplant | which then in turn is making mellon poop itself | 21:39 |
| cmorpheus | haha yes haproxy will make things confusing, the documentation isn't written with that in mind | 21:40 |
| kplant | yeah i think my next attempt i'll just deploy without haproxy and see how it goes | 21:40 |
| kplant | thanks for the help though | 21:40 |
| cmorpheus | i think you'll have much better luck without haproxy | 21:40 |
| kplant | i'm out of energy for today | 21:41 |
| kplant | when i get it working i'll let you know what path i used in order to confirm/correct the documentation | 21:41 |
| kplant | i'm thinking the longer endpoint is the correct one | 21:41 |
| cmorpheus | i think the documented one might be right actually | 21:42 |
| cmorpheus | based on https://jdennis.fedorapeople.org/doc/mellon-user-guide/mellon_user_guide.html#mellon_endpoint_path | 21:42 |
| kplant | i will definitely try them both and let you know the result either way | 21:43 |
| cmorpheus | cool | 21:43 |
| kplant | yeah that's definitely it am_validate_redirect_url() returns 400 if it can't verify the redirect url | 21:54 |
| *** jamesmcarthur has joined #openstack-keystone | 21:55 | |
| kmalloc | mnaser: sure, if you trust service X with your token :) | 21:59 |
| *** brtknr_ has quit IRC | 22:01 | |
| *** Ben78 has quit IRC | 22:05 | |
| *** whoami-rajat has quit IRC | 22:06 | |
| openstackgerrit | Nate Johnston proposed openstack/keystonemiddleware master: Fix context issue for neutron audit https://review.opendev.org/508659 | 22:08 |
| *** xek__ has quit IRC | 22:12 | |
| *** jamesmcarthur has quit IRC | 22:15 | |
| *** gyee has quit IRC | 22:39 | |
| *** jamesmcarthur has joined #openstack-keystone | 22:45 | |
| *** gyee has joined #openstack-keystone | 22:55 | |
| *** jamesmcarthur has quit IRC | 23:00 | |
| kplant | cmorpheus: cli and websso work without haproxy+nat | 23:08 |
| kplant | blah | 23:08 |
| kplant | and it's working with "MellonEndpointPath /v3/OS-FEDERATION/identity_providers/keycloak/protocols/saml2/auth/mellon" | 23:09 |
| *** jamesmcarthur has joined #openstack-keystone | 23:10 | |
| cmorpheus | kplant: does it work with /v3/mellon ? | 23:31 |
| kplant | it does not | 23:32 |
| kplant | i get an infinite redirect loop | 23:33 |
| kplant | keystone -> idp -> keystone -> idp -> etc... | 23:33 |
| cmorpheus | interesting | 23:33 |
| kplant | any idea how to make the displayed username more friendly than G-[UUID]? i recall in oidc i could just use e-mail instead | 23:39 |
| kplant | i'm trying to force nameid to e-mail with keycloak but no luck yet | 23:40 |
| cmorpheus | kplant: that's part of the mapping, you need to pick out what attribute from the assertion you want to map to the username attribute in keystone | 23:40 |
| cmorpheus | you probably used REMOTE_USER which could be something ugly coming from keycloak, but you can look at the assertion and pick anything | 23:41 |
| kplant | aah - makes sense | 23:41 |
| kplant | i was overthinking it trying to override with MellonUser | 23:41 |
| kplant | that's much simpler :-) | 23:41 |
| *** jamesmcarthur has quit IRC | 23:42 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!