| *** markvoelker has quit IRC | 00:05 | |
| *** markvoelker has joined #openstack-keystone | 00:07 | |
| *** markvoelker has quit IRC | 00:14 | |
| *** markvoelker has joined #openstack-keystone | 00:19 | |
| *** Ben78 has joined #openstack-keystone | 01:03 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Import LDAP job into project https://review.opendev.org/687436 | 01:04 |
|---|---|---|
| *** ayoung has quit IRC | 01:19 | |
| *** ayoung has joined #openstack-keystone | 01:20 | |
| *** tkajinam_ has joined #openstack-keystone | 01:26 | |
| *** tkajinam has quit IRC | 01:28 | |
| *** ayoung has quit IRC | 02:19 | |
| *** ayoung has joined #openstack-keystone | 02:19 | |
| *** Ben78 has quit IRC | 02:22 | |
| *** spatel has quit IRC | 02:47 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Import LDAP job into project https://review.opendev.org/687436 | 03:06 |
| *** markvoelker has quit IRC | 03:09 | |
| *** markvoelker has joined #openstack-keystone | 03:10 | |
| *** markvoelker has quit IRC | 03:23 | |
| *** markvoelker has joined #openstack-keystone | 03:24 | |
| *** markvoelker has quit IRC | 04:35 | |
| *** markvoelker has joined #openstack-keystone | 04:35 | |
| *** ayoung has quit IRC | 04:55 | |
| *** ayoung has joined #openstack-keystone | 04:55 | |
| *** ayoung has quit IRC | 05:12 | |
| *** ayoung has joined #openstack-keystone | 05:13 | |
| *** vishakha has joined #openstack-keystone | 05:57 | |
| *** jaosorior has quit IRC | 06:33 | |
| openstackgerrit | Andrii Ostapenko proposed openstack/keystonemiddleware master: Do not audit service catalog endpoint id https://review.opendev.org/687463 | 06:45 |
| *** jaosorior has joined #openstack-keystone | 07:04 | |
| *** xek_ has joined #openstack-keystone | 07:07 | |
| *** pcaruana has joined #openstack-keystone | 07:10 | |
| *** tesseract has joined #openstack-keystone | 07:13 | |
| *** ayoung has quit IRC | 07:24 | |
| *** ayoung has joined #openstack-keystone | 07:25 | |
| *** shyamb has joined #openstack-keystone | 07:33 | |
| *** awalende has joined #openstack-keystone | 07:41 | |
| *** ivve has joined #openstack-keystone | 07:41 | |
| *** shyamb has quit IRC | 07:48 | |
| *** dancn has joined #openstack-keystone | 07:48 | |
| *** ayoung has quit IRC | 07:52 | |
| *** ayoung has joined #openstack-keystone | 07:54 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/ldappool master: Follow the PTI for docs https://review.opendev.org/685402 | 08:05 |
| *** tkajinam_ has quit IRC | 08:10 | |
| *** shyamb has joined #openstack-keystone | 08:19 | |
| *** dancn has quit IRC | 08:45 | |
| *** awalende has quit IRC | 08:47 | |
| *** dancn has joined #openstack-keystone | 08:47 | |
| *** jaosorior has quit IRC | 08:53 | |
| *** ayoung has quit IRC | 09:04 | |
| *** ayoung has joined #openstack-keystone | 09:07 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone-tempest-plugin master: Follow the PTI for docs https://review.opendev.org/685260 | 09:08 |
| *** xek_ has quit IRC | 09:11 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/pycadf master: Follow the PTI for docs https://review.opendev.org/685432 | 09:15 |
| *** shyamb has quit IRC | 09:21 | |
| *** shyamb has joined #openstack-keystone | 09:22 | |
| *** jaosorior has joined #openstack-keystone | 09:31 | |
| *** mvkr has quit IRC | 09:39 | |
| *** awalende has joined #openstack-keystone | 09:42 | |
| *** awalende has quit IRC | 09:47 | |
| *** mvkr has joined #openstack-keystone | 09:53 | |
| *** shyamb has quit IRC | 09:59 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Fix wrong interface description https://review.opendev.org/687526 | 10:08 |
| *** jamesmcarthur has joined #openstack-keystone | 10:15 | |
| *** jamesmcarthur has quit IRC | 10:19 | |
| *** shyamb has joined #openstack-keystone | 10:21 | |
| *** awalende has joined #openstack-keystone | 10:23 | |
| *** awalende_ has joined #openstack-keystone | 10:23 | |
| *** awalende has quit IRC | 10:27 | |
| *** ayoung has quit IRC | 10:38 | |
| *** ayoung has joined #openstack-keystone | 10:39 | |
| *** tesseract has quit IRC | 10:44 | |
| *** tesseract has joined #openstack-keystone | 10:46 | |
| *** rcernin has quit IRC | 10:48 | |
| *** raildo has joined #openstack-keystone | 11:30 | |
| *** shyamb has quit IRC | 11:35 | |
| *** jaosorior has quit IRC | 11:58 | |
| *** xek_ has joined #openstack-keystone | 12:03 | |
| *** ayoung has quit IRC | 12:12 | |
| *** ayoung has joined #openstack-keystone | 12:15 | |
| *** jaosorior has joined #openstack-keystone | 12:28 | |
| *** ayoung has quit IRC | 12:38 | |
| *** awalende has joined #openstack-keystone | 12:39 | |
| *** ayoung has joined #openstack-keystone | 12:41 | |
| *** awalende_ has quit IRC | 12:43 | |
| *** markvoelker has quit IRC | 13:10 | |
| *** markvoelker has joined #openstack-keystone | 13:11 | |
| *** markvoelker has quit IRC | 13:11 | |
| *** markvoelker has joined #openstack-keystone | 13:11 | |
| *** ayoung has quit IRC | 13:12 | |
| *** ayoung has joined #openstack-keystone | 13:14 | |
| openstackgerrit | Colleen Murphy proposed openstack/ldappool master: Follow the PTI for docs https://review.opendev.org/685402 | 13:17 |
| *** awalende has quit IRC | 13:26 | |
| *** ayoung has quit IRC | 13:26 | |
| *** awalende has joined #openstack-keystone | 13:27 | |
| *** ayoung has joined #openstack-keystone | 13:27 | |
| *** jawad_axd has joined #openstack-keystone | 13:28 | |
| *** bnemec has quit IRC | 13:29 | |
| *** awalende has quit IRC | 13:30 | |
| *** awalende has joined #openstack-keystone | 13:31 | |
| *** bnemec has joined #openstack-keystone | 13:31 | |
| *** pcaruana has quit IRC | 13:31 | |
| *** jaosorior has quit IRC | 13:33 | |
| *** pcaruana has joined #openstack-keystone | 13:33 | |
| *** efried has joined #openstack-keystone | 13:38 | |
| efried | o/ keystoners | 13:38 |
| efried | To your knowledge, does any keystone component (particularly -middleware) ever inject a project ID into any part of the req (.url, .environ['SCRIPT_NAME'], .environ['PATH_INFO'], etc)? | 13:40 |
| efried | mordred, lbragstad, kmalloc, cmurphy: ^ | 13:41 |
| lbragstad | mmm | 13:44 |
| lbragstad | keystonemiddleware will set request headers based on the token | 13:44 |
| lbragstad | (e.g., your project comes from the token and gets set on the request as HTTP_X_PROJECT_ID) | 13:45 |
| *** spatel has joined #openstack-keystone | 13:45 | |
| lbragstad | https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L88 | 13:45 |
| efried | k, headers don't bother me. | 13:45 |
| efried | I'm trying to rip NoAuthMiddleware out of nova's tests, and one thing it was doing was injecting project_id into the URL. | 13:45 |
| lbragstad | depending on how you have service catalog endpoints setup, project ids can end up in the path | 13:45 |
| lbragstad | for example, /v2.1/{tenant_id}/servers | 13:46 |
| efried | right, and ksa will rip that out when doing version discovery | 13:46 |
| lbragstad | yeah - oslo.context also uses the request environment to inflate context objects for services | 13:46 |
| lbragstad | for service == in services using oslo.context | 13:46 |
| efried | but if the service catalog has http://foo.com/{proj_id}/ -- or you in any other way request a non-discovery thing without a version -- I'm pretty sure nova will kick you a 300 asking you to use a versioned endpoint. | 13:47 |
| lbragstad | https://docs.openstack.org/keystone/latest/contributor/service-catalog.html#endpoints describes how endpoints can inject project ids into the path - but i don't recommend that | 13:48 |
| lbragstad | ^ specifically, the last paragraph there is what you're seeing i think | 13:49 |
| efried | Yeah, I'm not really worried about if it's in the service catalog. (Which, right, is not recommended, but we have to continue to support because it exists in legacy deployments, sad-face.) | 13:49 |
| efried | It's that I'm having to adjust a test that was expecting the proj ID to be absent because it was testing a piece of the paste pipeline that was *before* NoAuthMiddleware injected that proj ID. | 13:49 |
| *** spatel has quit IRC | 13:50 | |
| efried | now that NoAuthMiddleware is out of the picture, I have to make it expect that proj ID to be present, which changes the response (200->300 as noted above) | 13:50 |
| lbragstad | so - what is NoAuthMiddleware injecting for a project ID value? | 13:50 |
| efried | so I wanted to make sure that was still realistic | 13:50 |
| efried | oh, just a dummy proj ID value. | 13:50 |
| efried | whatever you set up your fixture with. | 13:51 |
| lbragstad | mm | 13:51 |
| efried | so my educated guess is: | 13:51 |
| efried | We need our API tests to make sure they will work with the legacy proj-id-in-URL as well as the more modern not-that | 13:51 |
| *** jawad_axd has quit IRC | 13:51 | |
| efried | so we have tests with a testscenarios framework that runs identical tests with and without that | 13:52 |
| lbragstad | with and without the middleware? | 13:52 |
| efried | with and without a proj ID in all the request URLs for all the tests. | 13:52 |
| *** jawad_axd has joined #openstack-keystone | 13:52 | |
| lbragstad | ahh | 13:52 |
| efried | So my guess is that they stuffed it into NoAuthMiddleware because it was convenient, not because it was in any way equivalent to what actual auth middleware would do. | 13:53 |
| *** sapd1_ has joined #openstack-keystone | 13:53 | |
| efried | This is further supported by the fact that NoAuthMiddleware was *also* injecting RequestContext into the req. | 13:53 |
| lbragstad | oh... | 13:54 |
| efried | That would normally come from another piece of middleware that the noauth2 pipeline didn't have in it. | 13:54 |
| *** gagehugo has quit IRC | 13:56 | |
| *** jenglisch has quit IRC | 13:56 | |
| *** johanssone has quit IRC | 13:56 | |
| *** ivve has quit IRC | 13:56 | |
| *** sapd1 has quit IRC | 13:56 | |
| *** jmccrory has quit IRC | 13:56 | |
| *** aning__ has quit IRC | 13:56 | |
| *** cwright has quit IRC | 13:56 | |
| lbragstad | nova.api.auth:NovaKeystoneContext.factory i assume | 13:56 |
| efried | yup | 13:56 |
| *** ivve has joined #openstack-keystone | 13:56 | |
| *** aning_ has joined #openstack-keystone | 13:56 | |
| lbragstad | ok - looking at nova's paste file | 13:56 |
| efried | So my change is going through the `keystone` pipeline, and therefore hitting that middleware. I'm just mocking out the part that builds the actual context. | 13:56 |
| efried | ...to build the same context that NoAuthMiddleware used to build. | 13:56 |
| lbragstad | got it - i see the noauth2 pipeline, but that must be what you're removing | 13:56 |
| efried | exactly | 13:56 |
| efried | I can't remove the pipeline yet (that's coming in a different change) but I can stop our tests using it. | 13:57 |
| *** jawad_axd has quit IRC | 13:57 | |
| efried | my current change is also stubbing the ksm middleware entirely, with a TODO to use the AuthTokenFixture we talked about yesterday. | 13:57 |
| *** openstackstatus has quit IRC | 13:58 | |
| *** johanssone has joined #openstack-keystone | 13:58 | |
| efried | anyway, current task was just to make sure that it actually was a bogus thing for NoAuthMiddleware to have been the thing injecting the proj ID. | 13:58 |
| efried | I'm now doing it up front. | 13:58 |
| efried | ...when creating what is effectively the "endpoint" the fixture would have gotten from the "service catalog" if such a thing existed. | 13:59 |
| lbragstad | so - the endpoint your creating has the project id hard coded... right? | 13:59 |
| *** cwright has joined #openstack-keystone | 14:00 | |
| *** jaosorior has joined #openstack-keystone | 14:03 | |
| efried | lbragstad: yes | 14:07 |
| efried | for a subset of the scenarios | 14:07 |
| lbragstad | i think you're on the right track... | 14:07 |
| lbragstad | https://opendev.org/openstack/keystone/src/branch/master/keystone/catalog/backends/sql.py#L363-L364 | 14:07 |
| efried | the validation stuffs the same proj ID into the sample templates. The point is just to make sure that things get called with the URLs we expect, and that calling them with and without proj IDs in the URLs works. | 14:08 |
| lbragstad | https://opendev.org/openstack/keystone/src/branch/master/keystone/common/utils.py#L400-L437 | 14:08 |
| lbragstad | keystone is doing all the substitution in the server, before we give the catalog back to the end user | 14:09 |
| lbragstad | so - i don't think there is anything substitution-wise happening in middleware at all... | 14:09 |
| efried | okay, nice. So I'm right in saying that the proj ID will either be there from the start, or not be there at all. | 14:09 |
| efried | good | 14:09 |
| lbragstad | yeah - it should be there from the start... | 14:09 |
| efried | Thanks as always lbragstad :) | 14:09 |
| lbragstad | it looks like ksa and keystonemiddleware just treat endpoint['url'] as a url... | 14:10 |
| lbragstad | and they don't actually inspect it to see if it has a project id in it... so if you set something up to exercise a dummy url with a project id in it (the legacy way) and run your tests... you should be good? | 14:10 |
| lbragstad | anytime efried | 14:12 |
| efried | lbragstad: yes, we run all of our tests both with and without proj ID in the url, which is how I ended up here :) | 14:17 |
| * lbragstad nods | 14:17 | |
| *** jamesmcarthur has joined #openstack-keystone | 14:19 | |
| *** jdwidari has joined #openstack-keystone | 14:35 | |
| *** ayoung has quit IRC | 14:36 | |
| *** ayoung has joined #openstack-keystone | 14:38 | |
| *** ayoung has quit IRC | 14:49 | |
| *** ayoung has joined #openstack-keystone | 14:51 | |
| *** awalende has quit IRC | 14:51 | |
| *** awalende has joined #openstack-keystone | 14:52 | |
| *** jawad_axd has joined #openstack-keystone | 14:53 | |
| *** awalende has quit IRC | 14:57 | |
| *** ivve has quit IRC | 15:03 | |
| *** jaosorior has quit IRC | 15:11 | |
| *** ayoung has quit IRC | 15:12 | |
| *** ayoung has joined #openstack-keystone | 15:13 | |
| *** jdwidari has quit IRC | 15:13 | |
| *** Ben78 has joined #openstack-keystone | 15:21 | |
| *** jdwidari has joined #openstack-keystone | 15:26 | |
| gregwork | does a cloud operator require a user in a project to issue a project scoped token | 15:39 |
| gregwork | for themselves? | 15:39 |
| *** jdwidari has quit IRC | 15:42 | |
| lbragstad | gregwork yes | 15:44 |
| lbragstad | gregwork https://docs.openstack.org/keystone/latest/contributor/services.html#authorization-scopes describes some of that | 15:45 |
| lbragstad | gregwork we also have a patch up that describes what operators get out of the box with Train | 15:46 |
| lbragstad | https://657b14bfa6092f8bf722-e48c4084f6218ce55719e5f9f078d786.ssl.cf1.rackcdn.com/686828/1/check/openstack-tox-docs/94b6bde/docs/admin/service-api-protection.html | 15:46 |
| lbragstad | https://review.opendev.org/#/c/686828/ | 15:46 |
| lbragstad | still looking for some reviews/feedback on ^ | 15:47 |
| *** jdwidari has joined #openstack-keystone | 15:47 | |
| lbragstad | https://review.opendev.org/#/c/676648/ is also ready for some reviews | 15:48 |
| lbragstad | thanks mordred for the reviews there | 15:48 |
| *** jdwidari has quit IRC | 15:50 | |
| cmurphy | sorry meant to look at those yesterday, they're on my list for today | 15:50 |
| *** openstackgerrit has quit IRC | 15:52 | |
| lbragstad | thanks! | 15:54 |
| *** ayoung has quit IRC | 16:01 | |
| *** ayoung has joined #openstack-keystone | 16:02 | |
| *** spatel has joined #openstack-keystone | 16:07 | |
| *** ayoung has quit IRC | 16:09 | |
| *** ayoung has joined #openstack-keystone | 16:10 | |
| *** spatel has quit IRC | 16:12 | |
| *** ayoung has quit IRC | 16:14 | |
| *** ayoung has joined #openstack-keystone | 16:17 | |
| *** jamesmcarthur has quit IRC | 16:22 | |
| *** jamesmcarthur has joined #openstack-keystone | 16:30 | |
| *** dancn has quit IRC | 16:31 | |
| *** jamesmcarthur has quit IRC | 16:35 | |
| *** jamesmcarthur has joined #openstack-keystone | 16:39 | |
| *** bnemec has quit IRC | 16:45 | |
| *** bnemec has joined #openstack-keystone | 16:47 | |
| *** markvoelker has quit IRC | 16:53 | |
| *** markvoelker has joined #openstack-keystone | 16:54 | |
| *** gyee has joined #openstack-keystone | 16:58 | |
| *** jawad_ax_ has joined #openstack-keystone | 17:02 | |
| *** jawad_axd has quit IRC | 17:02 | |
| *** ayoung has quit IRC | 17:37 | |
| *** ayoung has joined #openstack-keystone | 17:38 | |
| *** gagehugo has joined #openstack-keystone | 17:49 | |
| lbragstad | stable/train backports of the removal of the sample policy file https://review.opendev.org/#/c/687639/ | 17:50 |
| lbragstad | starting ^ | 17:50 |
| cmurphy | lbragstad: i thought we weren't going to backport that? | 17:50 |
| cmurphy | the final rc is due like today | 17:51 |
| lbragstad | the policy file removal? | 17:51 |
| lbragstad | oh - nevermind then | 17:51 |
| lbragstad | i thought we discussed that here - http://eavesdrop.openstack.org/meetings/keystone/2019/keystone.2019-10-01-16.01.log.html#l-17 | 17:52 |
| cmurphy | hmm i guess we didn't exactly come down on a hard decision | 17:54 |
| cmurphy | i don't mind backporting it but we'll have to get the stable team to merge it today so we can request an rc2 | 17:54 |
| cmurphy | so that packagers have time to handle it | 17:54 |
| lbragstad | sure - it's up to you, my rationale behind backporting it was so that we had a unified front with the release of train | 17:55 |
| lbragstad | e.g., we don't ship the sample policy file anymore because we completed addressed what it was providing | 17:55 |
| cmurphy | yeah that makes sense | 17:56 |
| lbragstad | want me to head over to -release and request and rc2? | 17:56 |
| lbragstad | an rc2* | 17:56 |
| cmurphy | i was going to head to -stable first to beg for reviews | 17:57 |
| lbragstad | aha | 17:57 |
| * lbragstad tags along | 17:57 | |
| lbragstad | i think i'm the only stable core within keystone now that kmalloc is out | 17:58 |
| lbragstad | =/ | 17:58 |
| cmurphy | yeah | 17:58 |
| *** ayoung has quit IRC | 18:12 | |
| *** ayoung has joined #openstack-keystone | 18:13 | |
| *** openstackgerrit has joined #openstack-keystone | 18:16 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Overhaul the RBAC documentation for administrators https://review.opendev.org/686828 | 18:16 |
| *** raildo has quit IRC | 18:27 | |
| lbragstad | gagehugo knikolla would either of you be interested in taking a peek at https://review.opendev.org/#/c/686828/ | 18:34 |
| *** jamesmcarthur has quit IRC | 18:45 | |
| knikolla | lbragstad: looking | 19:02 |
| lbragstad | awesome - ty knikolla | 19:02 |
| *** pcaruana has quit IRC | 19:07 | |
| *** mgagne has quit IRC | 19:11 | |
| *** tesseract has quit IRC | 19:20 | |
| cmurphy | knikolla: gagehugo can you review https://review.opendev.org/677585 as well? | 19:36 |
| knikolla | sure :) | 19:36 |
| lbragstad | lol - while we have you here! | 19:44 |
| knikolla | cmurphy: so just making sure I understand correctly. listing for access rules without any arguments will list all access rules across all application credentials, and if you want to list access rules of a specific credential you should use list(id=app_cred_id) ? | 19:48 |
| knikolla | actually, not, id is the access rule id as opposed to the application credential id. | 19:50 |
| cmurphy | knikolla: no you can't filter access rules by app cred, but you could just look up the app cred itself | 19:50 |
| knikolla | ah, okay. | 19:51 |
| knikolla | that answered my question, +2/A | 19:51 |
| cmurphy | thanks knikolla | 19:51 |
| knikolla | weren't we going to kill python-keystoneclient though? /shrug | 19:59 |
| cmurphy | we're a long way from that | 20:00 |
| cmurphy | we need this for openstackclient and horizon | 20:00 |
| knikolla | so openstacksdk is not there yet :( | 20:00 |
| cmurphy | i haven't evaluated feature parity in sdk but it's not a drop-in replacement for keystoneclient in osc and horizon | 20:01 |
| knikolla | that is true | 20:03 |
| *** ayoung has quit IRC | 20:06 | |
| *** ayoung has joined #openstack-keystone | 20:08 | |
| openstackgerrit | Merged openstack/keystoneauth master: Allow initializing session with connection retries https://review.opendev.org/676648 | 20:23 |
| *** pcaruana has joined #openstack-keystone | 20:33 | |
| *** pcaruana has quit IRC | 20:40 | |
| *** awalende has joined #openstack-keystone | 21:01 | |
| *** xek_ has quit IRC | 21:04 | |
| *** awalende has quit IRC | 21:05 | |
| *** ayoung has quit IRC | 21:07 | |
| *** ayoung has joined #openstack-keystone | 21:08 | |
| *** ayoung has quit IRC | 21:21 | |
| *** ayoung has joined #openstack-keystone | 21:24 | |
| *** ayoung has quit IRC | 21:43 | |
| *** ayoung has joined #openstack-keystone | 21:44 | |
| *** rcernin has joined #openstack-keystone | 22:14 | |
| *** efried has quit IRC | 22:26 | |
| *** markvoelker has quit IRC | 22:28 | |
| cmurphy | argh i forgot db placeholders | 22:42 |
| *** jamesmcarthur has joined #openstack-keystone | 22:42 | |
| *** efried has joined #openstack-keystone | 22:45 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add schema placeholders for Train https://review.opendev.org/687691 | 22:46 |
| cmurphy | can i get a quick review on that ^ lbragstad knikolla gagehugo | 22:46 |
| openstackgerrit | Merged openstack/keystone master: Overhaul the RBAC documentation for administrators https://review.opendev.org/686828 | 22:49 |
| *** spatel has joined #openstack-keystone | 22:54 | |
| *** spatel has quit IRC | 22:58 | |
| *** tkajinam has joined #openstack-keystone | 23:02 | |
| *** Ben78 has quit IRC | 23:05 | |
| *** openstackstatus has joined #openstack-keystone | 23:18 | |
| *** ChanServ sets mode: +v openstackstatus | 23:18 | |
| *** gyee has quit IRC | 23:27 | |
| *** jamesmcarthur has quit IRC | 23:43 | |
| *** dklyle has quit IRC | 23:47 | |
| *** david-lyle has joined #openstack-keystone | 23:47 | |
| *** markvoelker has joined #openstack-keystone | 23:48 | |
| *** markvoelker has quit IRC | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!