Monday, 2019-08-12

« Sunday, 2019-08-11 Index Tuesday, 2019-08-13 »
*** jamesmcarthur has joined #openstack-keystone00:45
*** jamesmcarthur has quit IRC01:13
*** jamesmcarthur has joined #openstack-keystone01:20
*** cmorpheus is now known as cmurphy01:24
*** jamesmcarthur has quit IRC01:30
openstackgerritColleen Murphy proposed openstack/keystone master: [WIP] Add immutable resource option for roles  https://review.opendev.org/66673901:49
openstackgerritColleen Murphy proposed openstack/keystone master: Add --immutable-roles flag to bootstrap command  https://review.opendev.org/67522801:49
openstackgerritColleen Murphy proposed openstack/keystone master: Add immutable roles status check  https://review.opendev.org/67550901:49
*** jamesmcarthur has joined #openstack-keystone02:12
openstackgerritColleen Murphy proposed openstack/keystone master: Add protection tests for trusts API  https://review.opendev.org/67572002:31
*** jamesmcarthur has quit IRC02:38
*** jamesmcarthur has joined #openstack-keystone02:47
*** mordred has quit IRC02:48
*** mordred has joined #openstack-keystone02:48
*** jamesmcarthur has quit IRC02:56
*** jamesmcarthur has joined #openstack-keystone02:59
*** jamesmcarthur has quit IRC03:25
openstackgerritColleen Murphy proposed openstack/keystone master: [WIP] Move hardcoded trust enforcement to default policies  https://review.opendev.org/67580704:15
cmurphykmalloc: beekneemech interested in your thoughts on ^ on monday04:15
openstackgerritColleen Murphy proposed openstack/keystone master: [WIP] Add immutable resource option for roles  https://review.opendev.org/66673904:19
openstackgerritColleen Murphy proposed openstack/keystone master: Add --immutable-roles flag to bootstrap command  https://review.opendev.org/67522804:19
openstackgerritColleen Murphy proposed openstack/keystone master: Add immutable roles status check  https://review.opendev.org/67550904:19
openstackgerritMerged openstack/keystone master: Add API changes for app cred access rules  https://review.opendev.org/62816804:36
*** pcaruana has joined #openstack-keystone05:29
*** pcaruana has quit IRC05:37
*** jamesmcarthur has joined #openstack-keystone05:47
*** pcaruana has joined #openstack-keystone05:50
*** dancn has joined #openstack-keystone05:51
*** jamesmcarthur has quit IRC06:03
*** jamesmcarthur has joined #openstack-keystone06:06
*** jamesmcarthur has quit IRC06:21
*** markvoelker has joined #openstack-keystone06:31
*** markvoelker has quit IRC06:36
*** jamesmcarthur has joined #openstack-keystone06:45
*** jamesmcarthur_ has joined #openstack-keystone06:51
*** jamesmcarthur_ has quit IRC06:53
*** jamesmcarthur_ has joined #openstack-keystone06:53
*** jamesmcarthur_ has quit IRC06:53
*** jamesmcarthur_ has joined #openstack-keystone06:54
*** jamesmcarthur has quit IRC06:54
*** jamesmcarthur_ has quit IRC07:04
*** jamesmcarthur has joined #openstack-keystone07:05
*** ivve has joined #openstack-keystone07:05
*** jamesmcarthur has quit IRC07:10
*** rcernin has quit IRC07:13
*** tesseract has joined #openstack-keystone07:14
openstackgerritMerged openstack/keystone master: Update api-ref for revocation list OS-PKI  https://review.opendev.org/67529607:53
*** tesseract has quit IRC08:42
*** dancn has quit IRC08:42
*** irclogbot_1 has quit IRC08:42
*** hogepodge has quit IRC08:42
*** mordred has quit IRC08:42
*** dancn has joined #openstack-keystone08:42
*** mordred has joined #openstack-keystone08:43
*** tesseract has joined #openstack-keystone08:43
*** openstackgerrit has quit IRC08:45
*** irclogbot_1 has joined #openstack-keystone08:47
*** irclogbot_1 has quit IRC08:49
*** irclogbot_1 has joined #openstack-keystone08:52
*** jaosorior has joined #openstack-keystone09:07
*** mvkr has joined #openstack-keystone09:47
*** xek has joined #openstack-keystone09:57
*** markvoelker has joined #openstack-keystone10:09
*** markvoelker has quit IRC10:14
*** pcaruana has quit IRC10:43
*** pcaruana has joined #openstack-keystone10:43
*** jaosorior has quit IRC10:54
*** whoami-rajat has joined #openstack-keystone11:08
*** openstackgerrit has joined #openstack-keystone11:32
openstackgerritJens Harbott (frickler) proposed openstack/python-keystoneclient master: Stop using an admin endpoint by default  https://review.opendev.org/67587011:32
fricklercmurphy: kmalloc: ^^ that's what it would take to make heat work in my devstack patch, but the tests blow up awfully and I'm unsure about backwards compatibility, pls let me know what you think11:34
fricklersee also https://review.opendev.org/67577811:35
*** raildo has joined #openstack-keystone11:48
*** jaosorior has joined #openstack-keystone12:03
*** pas-ha has quit IRC12:13
*** pas-ha has joined #openstack-keystone12:14
*** aprice has quit IRC12:14
*** aprice has joined #openstack-keystone12:14
*** markvoelker has joined #openstack-keystone12:28
*** jroll has quit IRC13:01
*** jroll has joined #openstack-keystone13:02
*** frickler has quit IRC13:18
*** mchlumsky has joined #openstack-keystone13:25
*** mchlumsky has quit IRC13:52
*** mchlumsky has joined #openstack-keystone13:53
*** beekneemech is now known as bnemec13:54
*** atmark has joined #openstack-keystone14:00
openstackgerritColleen Murphy proposed openstack/keystone master: Add immutable roles status check  https://review.opendev.org/67550914:18
*** dancn has quit IRC14:26
*** dancn has joined #openstack-keystone14:32
openstackgerritMerged openstack/oslo.policy master: Move doc related modules to doc/requirements.txt  https://review.opendev.org/66942714:42
openstackgerritRadosław Piliszek proposed openstack/keystone master: Honor group_members_are_ids for user_enabled_emulation  https://review.opendev.org/67478214:43
yoctozeptofinally found time to dig into keystone's unit tests ^14:43
*** petitbois has joined #openstack-keystone14:53
petitboishey all -- not sure of the right place to ask this but i am having trouble authenticating my keystone object in python. I'd like to grab a user name from a user ID. Here's what I've got: http://paste.openstack.org/show/756341/14:53
cmurphythanks yoctozepto15:11
cmurphypetitbois: answered in -dev15:11
yoctozeptocmurphy: yw; you had some doubts on the mailing list iirc - is everything clear now?15:13
cmurphyyoctozepto: i still have some doubts, that ldap code is pretty dense and it's not clear to me how we didn't see this problem before, i'll probably be relying on people like raildo and gyee to help verify it15:16
yoctozeptocmurphy: yeah, the code could use some cleanup, hence sprinkled TODOs15:19
yoctozeptothough I have yet to see ldap-facing code that I could describe as 'clean'15:20
yoctozeptocould be this old technology was not meant to ever be interfaced 'cleanly' :-)15:20
*** dave-mccowan has joined #openstack-keystone15:20
raildocmurphy, ack, I'll review it util eod15:21
cmurphythanks raildo15:21
mnaserso i'm having fun with ldap recently.15:22
yoctozeptomnaser: "fun" you mean15:22
mnaserright15:24
mnaserfor some reason keystone is not getting any records back and i'm wondering if its because its requesting users that have "userPassword" attribute15:24
mnaserand this LDAP server does not supply it15:24
yoctozeptomnaser: run debugging to see the queries, helped me15:26
mnasergah15:27
mnaserof course15:27
mnaser"dn: CN=XXXX,OU=Users,OU=$LOCATION,DC=$CORP,DC=com"15:27
mnaserwhy would they not do CN=XXX,OU=$LOCATION,OU=USERS,DC=$CORP,DC=com15:28
* mnaser shrugs15:28
mnaseri wonder if that was it the whole time i'm ashamed :<15:28
yoctozeptomnaser: change user root dn15:29
mnaseryeah, i think that was it, i thought it was like some sort of tagged system15:29
mnaserso i had it saying like15:29
yoctozeptothere is a lot of magic in this ldap code15:29
mnaserOU=Users,DC=$CORP,DC=com15:29
mnaseri think it might have done it15:29
yoctozeptonot to mention string interpolation domination15:29
yoctozeptowhich makes it hard to read and search through15:29
mnasergreat now i dont have access to the server that it gets referred to15:31
mnaser`ldap_chase_v3referrals` seems to run15:31
mnaserhttps://bugs.launchpad.net/keystone/+bug/1233365 hrmmm15:32
openstackLaunchpad bug 1233365 in OpenStack Identity (keystone) "LDAP backend fails when connecting to Active Directory root DN" [High,Fix released] - Assigned to Dolph Mathews (dolph)15:32
yoctozeptomnaser: almost 6 years since that15:36
mnaseryoctozepto: doing an ldapsearch seems to give me all the users from ldap with same filter that keystone uses, but user list shows 4..15:37
mnaserresult: 4 Size limit exceeded15:37
mnaseroh hm15:37
mnaserso i take the exact filterstr and attrs in ldapsearch on the same server15:45
mnaserand it returns a result15:45
mnaserbut keystone ldap debug => "ld 0x38d2aa0 response count 0"15:45
mnaserbase=DC=<corp>,DC=com scope=1 filterstr=(&(&(sAMAccountName=<user>))(objectClass=organizationalPerson)(employeeID=*)) attrs=['employeeID', 'enabled', 'sAMAccountName', 'mail', 'userPassword', 'cn']15:46
mnaserldapsearch -x -b "dc=<corp>,dc=com" -D "<snip>" -H ldaps://<snip>:636 -W "(&(&(sAMAccountName=<user>))(objectClass=organizationalPerson)(employeeID=*))" employeeID enabled sAMAccountName mail userPassword cn15:47
mnaserthe manual ldapsearch returns a result :<15:47
*** petitbois has quit IRC15:49
yoctozeptomnaser: scope=1 is single level15:51
yoctozeptoldapsearch probably did scope=215:51
yoctozeptofor subtree15:52
yoctozeptoit is configurable in keystone15:52
*** dancn has quit IRC15:52
mnaseryoctozepto: yes indeed, darn ok let me try it out15:54
*** gyee has joined #openstack-keystone15:54
*** dave-mccowan has quit IRC15:56
*** dtruong has quit IRC15:59
*** problem_v has joined #openstack-keystone16:00
*** dtruong has joined #openstack-keystone16:00
kmallocyoctozepto, mnaser: you can blame ayoung for most of the LDAP code ;). It's aweful to deal with (not adam's fault, but LDAP in python is gross...wait...strike "python" from that statement)16:34
*** dklyle_ is now known as dklyle16:34
yoctozeptokmalloc: yeah, it's gross anywhere you go, it lacks modern approach in libs16:36
kmallocyoctozepto: well pyldap is actually pretty good, but since we lean on python-ldap and ldappool...it's not so easy to convert16:38
kmallocor wait was it not pyldap, it was ldap3... that was the lib16:39
kmallocpyldap was the fork =/16:39
kmallocldap3 is pretty darn good16:39
yoctozeptokmalloc: never tried anyway, my ldap journey was mostly with ldapjs in node.js and it was clumsy16:39
kmallocyoctozepto: i find a lot of <talk some protocol that isn't HTTP(ish)> in node/javascript is clumsy at best16:40
openstackgerritColleen Murphy proposed openstack/keystone master: Move list_trusts enforcement to default policies  https://review.opendev.org/67580716:40
yoctozeptokmalloc: nah, database access is pretty good (think sql/redis/mongodb/other-nosql-but-still-noldap-friends)16:40
*** ivve has quit IRC17:27
*** whoami-rajat has quit IRC17:38
*** jamesmcarthur has joined #openstack-keystone17:53
*** atmark has quit IRC17:59
*** atmark has joined #openstack-keystone18:00
*** markvoelker has quit IRC18:13
*** markvoelker has joined #openstack-keystone18:20
*** dancn has joined #openstack-keystone18:24
*** rafaelweingartne has joined #openstack-keystone18:27
rafaelweingartneHello Guys, I am creating a Keystone python client using: "ks_client_v3.Client(session=session, trust_id=trust_id,....."Is it possible to use this client to generate tokens on the fly? Something similar to "openstack token issue"18:28
*** jamesmcarthur has quit IRC18:30
openstackgerritAlex Schultz proposed openstack/keystoneauth master: Cleanup session on delete  https://review.opendev.org/67413918:31
*** jamesmcarthur has joined #openstack-keystone18:32
*** jamesmcarthur has quit IRC18:34
*** jamesmcarthur has joined #openstack-keystone18:34
kmallocrafaelweingartne: are you trying to generate tokens that are extracted and used by a non-python application or something wrapped around keystoneclient?18:35
rafaelweingartneI want to use by a python application18:36
kmallocrafaelweingartne: if you are looking for something wrapped around keystoneclient, I recommend using keystonauth instead (works like requests): https://docs.openstack.org/keystoneauth/latest/using-sessions.html18:36
rafaelweingartneit is something I am creating for ceilometer18:36
kmallocrafaelweingartne: keystoneauth offloads a lot of the work for you and works just like requests and handles token creation/renewal/etc18:36
rafaelweingartneI do not actually want a wrapper, I would like to execute the raw HTTP request with a token18:36
kmallocright. keystoneauth allows you to work just like requests does and handles openstack specific discovery/catalog parsing if you want18:38
kmallockeystoneauth is what openstack client and most other *-client libraries use.18:38
kmallocand what the SDK uses to implement access to openstack services18:38
rafaelweingartnehmm18:38
rafaelweingartneI am not sure I follow18:38
kmallockeystoneauth is a library that is based on python requests.18:38
rafaelweingartneI mean, I will need to generate an HTTP request programmatically, and for that, I would need a token18:39
kmallocwe bake into it's session code authentication (most forms), etc.18:39
*** markvoelker has quit IRC18:39
rafaelweingartneI do have the keystone client, but I am not sure how to use it to issue a token that I can use in the header of my HTTP request18:39
kmallocok, lets step back.18:39
rafaelweingartneSure18:40
kmallocyou're writing a python app that communicates with openstack services (ceilometer)? and what does it use to issue the requests to http?18:40
kmallochttplib? raw socket? curl (popen), python-requests?18:40
*** markvoelker has joined #openstack-keystone18:40
rafaelweingartnehttplib18:41
kmallocok. i highly recommend using python-requests if you can over straight httplib.18:41
kmallocit is, frankly, more feature complete18:41
kmallocand is generally super easy to use in comparison18:42
rafaelweingartneis python requests the one you get when importing "requests"?18:42
kmallocyes18:42
rafaelweingartneso, I am using the latter18:42
rafaelweingartnesorry for the confusion18:42
kmallocno worries :)18:42
kmallocif you're using requests, keystoneauth implements all the auth workflow on top of requests and is a potential drop in replacement18:42
rafaelweingartnehmm18:42
kmallochttps://docs.openstack.org/keystoneauth/latest/using-sessions.html you create a session (which is really a requests object with extra openstack logic)18:43
kmallocand can either pass it to a current client (e.g. ceilometer-client) or you can make direct http calls via session.get() etc18:44
kmallocsee https://docs.openstack.org/keystoneauth/latest/using-sessions.html#service-discovery18:44
kmallocas an example where you say "talk to identity and call /users"18:44
rafaelweingartneok, let me see if I understood18:44
kmallocit parses the catalog returned and allows working with the token (and handles adding the x-auth header) when communicating to the endpoint of your choice18:45
kmallocwe created keystoneauth as a low-ish level library to offload the headache of auth in openstack, and we have plugins for most forms of auth (all new auth types end up with a plugin eventually)18:45
*** frickler has joined #openstack-keystone18:48
rafaelweingartneSo, I just need to get the session and then issue the command "session_object.get("URL of the service I want to execute an HTTP GET request to")"?18:49
kmallocpretty much. it can either handle /parse from the token's catalog, or you can use it just like requests and pass a complete url.18:50
kmallocthough if it's a known endpoint, i recommend using the discovery bits, it helps offload needing to know apriori two bits of data (the auth endpoint and the service endpoint)18:50
kmallocif you look at that link (the sessions one) it's pretty comprehensive on the forms you can use.18:51
kmallocand like i said, it's how openstack client, openstack SDK, and most other tools talk to openstack services.18:51
rafaelweingartnethat is cool18:51
rafaelweingartnethanks!!18:51
kmallocheck yeah :)18:52
kmallocit's why we created the lib. saves lots of re-implemetation18:52
kmallocand it is something we heavily test18:52
kmallocalso, note keystoneauth's API contract is extremely strict.18:52
kmallocbarring a security reason, we will not break your use, even if it's unintended use of the lib18:52
kmallocbasically, if we change out (even across major versions) behavior, we are wrong and i've reverted changes to ensure consistency18:53
rafaelweingartneis the response a "response" object?18:53
rafaelweingartneor is it just the response body18:53
kmallocyes, it should be a requests response objecty18:53
kmallocobject*18:53
rafaelweingartnethanks18:54
kmallocsure thing18:54
*** ivve has joined #openstack-keystone18:58
rafaelweingartneDure, it works!19:02
rafaelweingartnedude*19:02
rafaelweingartneAwesome19:02
*** jamesmcarthur has quit IRC19:08
*** rafaelweingartne has quit IRC19:09
kmallocrafaelweingartne: glad it made your life easier!19:09
openstackgerritColleen Murphy proposed openstack/keystone master: Move list_trusts enforcement to default policies  https://review.opendev.org/67580719:29
*** tesseract has quit IRC19:32
*** dave-mccowan has joined #openstack-keystone19:54
*** raildo has quit IRC20:52
*** pcaruana has quit IRC20:56
*** xek has quit IRC21:02
*** markvoelker has quit IRC21:24
cmurphykmalloc: could i get you to look at https://review.opendev.org/675807 before i keep going on the trust policies21:51
kmalloclooking21:52
kmalloccmurphy: i think i see one bug22:03
*** markvoelker has joined #openstack-keystone22:03
kmalloccmurphy: it mostly looks ok22:03
cmurphykmalloc: good catch22:05
*** lbragstad has joined #openstack-keystone22:09
*** vishwanathj has quit IRC22:10
*** mchlumsky has quit IRC22:14
*** lbragstad has quit IRC22:17
*** dancn has quit IRC22:25
*** dancn has joined #openstack-keystone22:30
*** ivve has quit IRC22:33
*** markvoelker has quit IRC22:35
*** hoonetorg has quit IRC22:48
*** hoonetorg has joined #openstack-keystone22:50
*** hoonetorg has quit IRC22:57
*** vishwanathj has joined #openstack-keystone22:58
openstackgerritColleen Murphy proposed openstack/keystone master: Add protection tests for trusts API  https://review.opendev.org/67572022:58
openstackgerritColleen Murphy proposed openstack/keystone master: Move list_trusts enforcement to default policies  https://review.opendev.org/67580722:58
*** dancn has quit IRC23:00
*** markvoelker has joined #openstack-keystone23:00
*** hoonetorg has joined #openstack-keystone23:01
*** vishwanathj has quit IRC23:03
*** markvoelker has quit IRC23:05
*** rcernin has joined #openstack-keystone23:11
*** dave-mccowan has quit IRC23:17
*** markvoelker has joined #openstack-keystone23:18
*** dave-mccowan has joined #openstack-keystone23:37
« Sunday, 2019-08-11 Index Tuesday, 2019-08-13 »

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!