| *** tkajinam has quit IRC | 00:07 | |
| *** tkajinam has joined #openstack-keystone | 00:07 | |
| *** Guest88425 is now known as Krenair | 00:13 | |
| *** bnemec has quit IRC | 00:14 | |
| *** jawad_axd has joined #openstack-keystone | 00:14 | |
| *** jawad_axd has quit IRC | 00:18 | |
| *** dave-mccowan has joined #openstack-keystone | 00:20 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone-tempest-plugin master: WIP/PoC:Add RBAC tests https://review.opendev.org/686305 | 00:32 |
|---|---|---|
| *** jawad_axd has joined #openstack-keystone | 00:34 | |
| *** jawad_axd has quit IRC | 00:39 | |
| *** rodrigods has quit IRC | 00:39 | |
| *** gyee has quit IRC | 00:47 | |
| *** jawad_axd has joined #openstack-keystone | 00:55 | |
| *** jawad_axd has quit IRC | 01:00 | |
| *** jawad_axd has joined #openstack-keystone | 01:16 | |
| *** dave-mccowan has quit IRC | 01:16 | |
| *** jawad_axd has quit IRC | 01:21 | |
| *** jawad_axd has joined #openstack-keystone | 01:37 | |
| *** jawad_axd has quit IRC | 01:41 | |
| *** dave-mccowan has joined #openstack-keystone | 01:50 | |
| *** jawad_axd has joined #openstack-keystone | 01:57 | |
| *** jawad_axd has quit IRC | 02:01 | |
| *** dklyle has quit IRC | 02:03 | |
| *** david-lyle has joined #openstack-keystone | 02:03 | |
| *** jawad_axd has joined #openstack-keystone | 02:18 | |
| *** jawad_axd has quit IRC | 02:22 | |
| *** jawad_axd has joined #openstack-keystone | 02:39 | |
| *** jawad_axd has quit IRC | 02:43 | |
| *** awalende has joined #openstack-keystone | 02:44 | |
| *** awalende has quit IRC | 02:49 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:29 | |
| *** jamesmcarthur has quit IRC | 03:44 | |
| *** dave-mccowan has quit IRC | 04:46 | |
| *** pcaruana has joined #openstack-keystone | 05:24 | |
| *** shyamb has joined #openstack-keystone | 06:40 | |
| *** jamesmcarthur has joined #openstack-keystone | 06:46 | |
| *** jamesmcarthur has quit IRC | 06:51 | |
| *** rcernin has quit IRC | 06:56 | |
| *** awalende has joined #openstack-keystone | 07:15 | |
| *** awalende has quit IRC | 07:20 | |
| *** shyamb has quit IRC | 07:41 | |
| *** kozhukalov has joined #openstack-keystone | 07:52 | |
| *** vesper11 has quit IRC | 08:09 | |
| *** jawad_axd has joined #openstack-keystone | 08:09 | |
| *** vesper11 has joined #openstack-keystone | 08:14 | |
| *** amoralej|off is now known as amoralej | 08:14 | |
| *** awalende has joined #openstack-keystone | 08:21 | |
| *** tkajinam has quit IRC | 08:34 | |
| *** shyamb has joined #openstack-keystone | 08:35 | |
| *** dancn has joined #openstack-keystone | 08:35 | |
| *** kozhukalov has quit IRC | 08:58 | |
| *** yan0s has joined #openstack-keystone | 09:04 | |
| *** starborn has joined #openstack-keystone | 09:22 | |
| *** shyamb has quit IRC | 09:23 | |
| *** dancn has quit IRC | 09:46 | |
| *** pawan-gupta has quit IRC | 09:47 | |
| *** shyamb has joined #openstack-keystone | 09:51 | |
| *** dancn has joined #openstack-keystone | 09:58 | |
| *** shyamb has quit IRC | 10:42 | |
| *** shyamb has joined #openstack-keystone | 10:59 | |
| *** shyamb has quit IRC | 11:27 | |
| openstackgerrit | Stephen Finucane proposed openstack/oslo.policy master: Add 'namespaced' flag on checker CLI https://review.opendev.org/610402 | 11:40 |
| *** raildo has joined #openstack-keystone | 12:05 | |
| *** adriant has quit IRC | 12:18 | |
| *** adriant has joined #openstack-keystone | 12:18 | |
| *** tacco has joined #openstack-keystone | 12:48 | |
| tacco | hi there.. i would like to archive ldap group based member/admin access to projects.. whats the best way of doing this? my toughts was to simply add groups to roles.. pointing to the projects.. but i always get the following error when i try to show the ldap based groups. | 12:50 |
| tacco | UserWarning: Policy identity:list_groups failed scope check. The token used to make the request was project scoped but the policy requires ['system', 'domain'] scope. | 12:50 |
| *** shyamb has joined #openstack-keystone | 12:58 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:05 | |
| *** amoralej is now known as amoralej|lunch | 13:09 | |
| *** jamesmcarthur has quit IRC | 13:12 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:13 | |
| *** jamesmcarthur has quit IRC | 13:29 | |
| *** amoralej|lunch is now known as amoralej | 13:51 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:55 | |
| *** dave-mccowan has joined #openstack-keystone | 13:56 | |
| *** jamesmcarthur has quit IRC | 13:59 | |
| lbragstad_ | tacco that means the user your making the call with doesn't have the necessary permissions keystone expects to manage groups | 14:03 |
| *** lbragstad_ is now known as lbragstad | 14:03 | |
| lbragstad | tacco you'll either need to use an admin user or adjust the privileges for your user to include the roles required to manage groups | 14:03 |
| *** jamesmcarthur has joined #openstack-keystone | 14:03 | |
| tacco | it is the initial admin user | 14:05 |
| tacco | and it has the access for system: all and also admin permissions for the created domain | 14:06 |
| tacco | 1da.. is the initial admin user http://paste.openstack.org/show/787723/ | 14:08 |
| tacco | http://paste.openstack.org/show/787724/ with --name in addition | 14:09 |
| *** bnemec has joined #openstack-keystone | 14:10 | |
| *** shyamb has quit IRC | 14:15 | |
| *** jrist has left #openstack-keystone | 14:44 | |
| *** david-lyle is now known as dklyle | 14:51 | |
| *** jawad_axd has quit IRC | 14:58 | |
| *** jawad_axd has joined #openstack-keystone | 15:02 | |
| *** jawad_ax_ has joined #openstack-keystone | 15:06 | |
| *** jawad_axd has quit IRC | 15:06 | |
| *** baffle has joined #openstack-keystone | 15:07 | |
| *** jawad_ax_ has quit IRC | 15:10 | |
| lbragstad | tacco are you using a system-scoped token? | 15:19 |
| lbragstad | not sure if you're using an rc file | 15:20 |
| lbragstad | but if you are, you can set system-scope options that ensure you get a system-scoped tokne | 15:20 |
| *** awalende_ has joined #openstack-keystone | 15:27 | |
| *** awalende has quit IRC | 15:31 | |
| *** awalende has joined #openstack-keystone | 15:31 | |
| *** awalende_ has quit IRC | 15:32 | |
| *** awalende_ has joined #openstack-keystone | 15:34 | |
| *** awalende has quit IRC | 15:36 | |
| *** awalende_ has quit IRC | 15:38 | |
| tacco | lbragstad: ive used both.. the pre created openrc from openstack-ansible in the utility container and as well i#ve tested with rc file downloaded by the admin user from horizon. | 15:39 |
| lbragstad | tacco those rc files likely won't have system scope variables | 15:40 |
| tacco | ok. what variable is to be set? | 15:40 |
| lbragstad | let me see if i can find an example | 15:41 |
| lbragstad | you'll want to set OS_SYSTEM_SCOPE=all instead of OS_PROJECT_NAME or OS_PROJECT_ID | 15:42 |
| *** starborn has quit IRC | 15:42 | |
| tacco | ok. | 15:43 |
| tacco | will try | 15:43 |
| *** baffle has quit IRC | 15:46 | |
| *** jawad_axd has joined #openstack-keystone | 15:56 | |
| tacco | lbragstad: looks better.. so warnings aare gone now.. | 16:01 |
| *** jawad_axd has quit IRC | 16:01 | |
| tacco | but i can't still see no groups in the openstack cli | 16:01 |
| tacco | http://paste.openstack.org/show/787729/ | 16:01 |
| tacco | this is what i have so far. Ldapsearch to proove that there is something behind my keystone configuration. | 16:01 |
| tacco | for users everything works fine.. | 16:01 |
| tacco | but not for groups | 16:01 |
| *** gyee has joined #openstack-keystone | 16:03 | |
| *** dancn has quit IRC | 16:07 | |
| *** jawad_axd has joined #openstack-keystone | 16:17 | |
| *** baffle has joined #openstack-keystone | 16:18 | |
| *** awalende has joined #openstack-keystone | 16:19 | |
| *** jawad_axd has quit IRC | 16:21 | |
| *** awalende has quit IRC | 16:24 | |
| *** jawad_axd has joined #openstack-keystone | 17:18 | |
| *** jawad_axd has quit IRC | 17:23 | |
| *** dklyle has quit IRC | 17:26 | |
| *** david-lyle has joined #openstack-keystone | 17:26 | |
| *** david-lyle has quit IRC | 17:26 | |
| *** david-lyle has joined #openstack-keystone | 17:26 | |
| *** awalende has joined #openstack-keystone | 17:28 | |
| *** awalende has quit IRC | 17:33 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Ensure bootstrap handles multiple roles with the same name https://review.opendev.org/699743 | 18:02 |
| tacco | hm.. still not sure about the group stuff. "should work but didn't" if someone can have a look http://paste.openstack.org/show/92OtyhY1iswbdoONKYr1/ | 18:19 |
| *** openstackgerrit has quit IRC | 18:43 | |
| *** amoralej is now known as amoralej|off | 18:44 | |
| gagehugo | tacco: maybe the group filter? not sure | 18:45 |
| tacco | i've tested the group filter with ldapsearch | 18:48 |
| tacco | on line 4 at the end you can see the same filter | 18:50 |
| tacco | tested the same thing for users.. so this should not be the point @ gagehugo | 18:50 |
| tacco | yes 100% sure that this looks good to me. just copy+paste the filter to find it appearence 3 times.. in the osa-config in the keystone config and in the ldapsearch filter | 18:52 |
| gyee | tacco, typo? "goup_tree_dn" | 19:01 |
| *** jamesmcarthur has quit IRC | 19:03 | |
| gagehugo | that might also do it | 19:04 |
| tacco | yes.. could it be.. if this was the error i will hate myself for asking such stupid things. :D anyway.. thanks for pointing me there | 19:19 |
| tacco | gyee: thanks a lot for making my day.. | 19:22 |
| tacco | this "Was" indeed the problem. | 19:22 |
| *** jamesmcarthur has joined #openstack-keystone | 19:26 | |
| *** davidboo has joined #openstack-keystone | 19:28 | |
| *** awalende has joined #openstack-keystone | 19:30 | |
| *** davidboo has quit IRC | 19:31 | |
| *** awalende has quit IRC | 19:34 | |
| *** jamesmcarthur has quit IRC | 19:38 | |
| *** openstackgerrit has joined #openstack-keystone | 19:58 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Ensure bootstrap handles multiple roles with the same name https://review.opendev.org/699743 | 19:58 |
| *** david-lyle is now known as dklyle | 20:00 | |
| *** jamesmcarthur has joined #openstack-keystone | 20:09 | |
| *** ayoung has joined #openstack-keystone | 21:12 | |
| *** szaher has quit IRC | 21:15 | |
| *** raildo has quit IRC | 21:16 | |
| *** pcaruana has quit IRC | 21:54 | |
| *** gshippey_ has quit IRC | 22:03 | |
| *** jamesmcarthur has quit IRC | 22:04 | |
| *** tkajinam has joined #openstack-keystone | 23:05 | |
| *** rcernin has joined #openstack-keystone | 23:10 | |
| *** awalende has joined #openstack-keystone | 23:23 | |
| *** awalende has quit IRC | 23:28 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!