| *** jamesmcarthur has quit IRC | 00:12 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:12 | |
| *** jamesmcarthur has quit IRC | 00:18 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:24 | |
| *** ayoung has quit IRC | 00:54 | |
| *** ayoung has joined #openstack-keystone | 00:57 | |
| *** jamesmcarthur has quit IRC | 01:04 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:04 | |
| *** jamesmcarthur has quit IRC | 01:06 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:06 | |
| *** jistr has quit IRC | 01:17 | |
| *** jistr has joined #openstack-keystone | 01:19 | |
| *** jamesmcarthur has quit IRC | 01:56 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:57 | |
| *** jamesmcarthur has quit IRC | 02:02 | |
| *** hoonetorg has quit IRC | 02:17 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:24 | |
| *** hoonetorg has joined #openstack-keystone | 02:31 | |
| *** awalende has joined #openstack-keystone | 02:50 | |
| *** awalende has quit IRC | 02:55 | |
| *** jamesmcarthur has quit IRC | 03:04 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:05 | |
| *** jamesmcarthur has quit IRC | 03:11 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:30 | |
| *** jamesmcarthur has quit IRC | 03:33 | |
| vishakha | abdysn I cannot find any [ssl] section in http://paste.openstack.org/show/788596/ | 04:23 |
|---|---|---|
| vishakha | or I cannot find any ssl = true | 04:29 |
| *** jamesmcarthur has joined #openstack-keystone | 04:42 | |
| *** shyamb has joined #openstack-keystone | 05:19 | |
| *** evrardjp has quit IRC | 05:34 | |
| *** evrardjp has joined #openstack-keystone | 05:34 | |
| *** jamesmcarthur has quit IRC | 05:35 | |
| *** jamesmcarthur has joined #openstack-keystone | 05:37 | |
| *** openstackgerrit has joined #openstack-keystone | 05:39 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: [WIP] Run keystone grenade jobs https://review.opendev.org/703541 | 05:39 |
| *** jamesmcarthur has quit IRC | 05:43 | |
| *** shyamb has quit IRC | 06:00 | |
| *** jamesmcarthur has joined #openstack-keystone | 06:06 | |
| *** renich has joined #openstack-keystone | 06:09 | |
| *** shyamb has joined #openstack-keystone | 06:12 | |
| *** jamesmcarthur has quit IRC | 06:13 | |
| *** renich has quit IRC | 06:18 | |
| *** renich has joined #openstack-keystone | 06:19 | |
| *** renich has quit IRC | 06:20 | |
| *** abdysn has joined #openstack-keystone | 06:24 | |
| *** adriant has quit IRC | 06:40 | |
| *** adriant has joined #openstack-keystone | 06:41 | |
| *** shyamb has quit IRC | 06:52 | |
| *** jamesmcarthur has joined #openstack-keystone | 07:09 | |
| *** jamesmcarthur has quit IRC | 07:14 | |
| *** shyamb has joined #openstack-keystone | 07:36 | |
| *** shyamb has quit IRC | 07:47 | |
| *** bnemec has joined #openstack-keystone | 08:06 | |
| *** awalende has joined #openstack-keystone | 08:07 | |
| *** jamesmcarthur has joined #openstack-keystone | 08:10 | |
| *** tkajinam has quit IRC | 08:10 | |
| *** jamesmcarthur has quit IRC | 08:14 | |
| *** tesseract has joined #openstack-keystone | 08:20 | |
| *** dancn has joined #openstack-keystone | 08:21 | |
| *** abdysn has quit IRC | 08:32 | |
| *** abdysn has joined #openstack-keystone | 08:32 | |
| *** shyamb has joined #openstack-keystone | 08:33 | |
| *** jaosorior has joined #openstack-keystone | 09:19 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Add openstack_groups to assertion https://review.opendev.org/588211 | 09:24 |
| *** xek has joined #openstack-keystone | 09:24 | |
| *** jaosorior has quit IRC | 09:54 | |
| *** shyamb has quit IRC | 09:58 | |
| *** ivve has joined #openstack-keystone | 10:07 | |
| *** openstackgerrit has quit IRC | 10:12 | |
| *** shyamb has joined #openstack-keystone | 10:21 | |
| *** openstackgerrit has joined #openstack-keystone | 10:32 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Updating tox -e all-plugin command https://review.opendev.org/703578 | 10:32 |
| *** shyamb has quit IRC | 11:06 | |
| *** raildo has joined #openstack-keystone | 11:06 | |
| *** shyamb has joined #openstack-keystone | 11:12 | |
| *** awalende has quit IRC | 11:13 | |
| *** raildo_ has joined #openstack-keystone | 11:14 | |
| *** awalende has joined #openstack-keystone | 11:14 | |
| *** raildo has quit IRC | 11:17 | |
| *** tkajinam has joined #openstack-keystone | 12:14 | |
| *** rcernin has quit IRC | 12:28 | |
| *** Luzi has joined #openstack-keystone | 12:28 | |
| *** shyamb has quit IRC | 12:48 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:18 | |
| *** jamesmcarthur has quit IRC | 13:33 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:45 | |
| *** awalende has quit IRC | 14:16 | |
| *** abdysn has quit IRC | 14:20 | |
| *** ayoung has quit IRC | 14:30 | |
| *** Luzi has quit IRC | 14:46 | |
| *** tkajinam has quit IRC | 15:16 | |
| *** jamesmcarthur has quit IRC | 15:25 | |
| gagehugo | o/ | 15:34 |
| *** jamesmcarthur has joined #openstack-keystone | 15:35 | |
| hrybacki | o/ | 15:43 |
| hrybacki | lbragstad: do you know where we have role inheritance documented? I'm only seeing a passing reference to it here in a sample: https://docs.openstack.org/keystone/latest/admin/cli-manage-projects-users-and-roles.html | 15:57 |
| hrybacki | also, since you can specify both a role and a domain when creating a role, should it ever be possible that the project argument is actually a domain id? | 15:58 |
| lbragstad | i think we have documentation that briefly describes it here - https://docs.openstack.org/keystone/latest/admin/service-api-protection.html | 15:58 |
| lbragstad | otherwise - the api reference is here https://docs.openstack.org/api-ref/identity/v3/index.html#list-implied-inference-roles-for-role | 15:59 |
| lbragstad | hrybacki are you asking if it should be possible to create project-specific roles? | 16:00 |
| hrybacki | lbragstad: no I'm wondering if we have a bug in our sanity checks for new role creation (trying to determine if a RHBZ is legit and I should file a LP) | 16:01 |
| lbragstad | oh - reparenting a project? | 16:02 |
| hrybacki | lbragstad: nope, /me fetches | 16:02 |
| hrybacki | lbragstad: https://bugzilla.redhat.com/show_bug.cgi?id=1790593 | 16:02 |
| openstack | bugzilla.redhat.com bug 1790593 in python-openstackclient ""openstack role add" command should not accept Domain ID in --project parameter" [Low,New] - Assigned to rhos-maint | 16:02 |
| lbragstad | well - technically projects are domains, but i can see how that's confusing | 16:05 |
| lbragstad | but since we also have --domain subcommands for openstack role add, i would say overloading --project isn't ideal | 16:06 |
| hrybacki | Yeah, it's confusing at best, given you can specify the domain as well | 16:07 |
| lbragstad | right | 16:07 |
| hrybacki | And naturally, wouldn't the domain default to the parent domain for a given project (rather than a parent-project?) | 16:08 |
| hrybacki | assuming it's a nested project | 16:08 |
| lbragstad | since we support domains as a first class citizen in that command with sub-arguments, i would say overloading --project is broken | 16:08 |
| lbragstad | IMO - a domain should always be a domain, and not a parent project | 16:09 |
| * hrybacki nods | 16:09 | |
| hrybacki | agreeed | 16:09 |
| hrybacki | would there be case where admins may want to have differnt roles underneath different nested projects? That's the only wrinkle I can think of | 16:09 |
| hrybacki | that adds a lot of complexity | 16:10 |
| cmurphy | just confirmed that it's possible to use --project with a domain id but then it breaks role assignment list --names | 16:12 |
| cmurphy | so +1 to fixing it | 16:12 |
| *** openstackgerrit has quit IRC | 16:13 | |
| hrybacki | cmurphy++ thanks. I'll create a LP today | 16:14 |
| hrybacki | thoughts on prio/sev? | 16:14 |
| cmurphy | low/medium imo | 16:14 |
| * hrybacki nods | 16:14 | |
| lbragstad | yeah - there's a documented workaround | 16:15 |
| lbragstad | do we need a keystone fix and an python-openstackclient fix? | 16:15 |
| cmurphy | i'm worried if we change keystone it would be considered and api break | 16:18 |
| hrybacki | lbragstad: TBD -- also, we should think about how far back we want to fix this | 16:18 |
| hrybacki | hmm | 16:18 |
| lbragstad | cmurphy yeah - that's what i was thinking... | 16:19 |
| hrybacki | even if we are just correcting behavior to line up with what should have been the case? | 16:19 |
| cmurphy | i don't think it's severe enough to change keystone, it's technically correct behavior since a domain is a project | 16:19 |
| cmurphy | for all i know that was intended behavior | 16:19 |
| * lbragstad has a feeling this happened when projects and domains were mungled back together | 16:19 | |
| hrybacki | anyone have a tenor sax we can use to summon the cores of years gone by? | 16:20 |
| lbragstad | breaking --names in subsequent API calls isn't good | 16:21 |
| hrybacki | okay, so in a situation where we have a behavior (intended or not) that can break other expected behaviors (e.g. the roles list) how do we handle them? | 16:22 |
| lbragstad | i assume --names in keystone is expecting to only see projects | 16:22 |
| hrybacki | I get not want to break API | 16:22 |
| lbragstad | cmurphy do we consider fixing --names to properly handle domains a backwards incompatible fix? | 16:23 |
| cmurphy | i don't think fixing --names is backwards incompatible, only changing the behavior of --project is technically backwards incompatible | 16:24 |
| lbragstad | ok - cool | 16:26 |
| lbragstad | i agree | 16:27 |
| *** gyee has joined #openstack-keystone | 16:39 | |
| *** dancn has quit IRC | 16:39 | |
| cmurphy | team meeting in about 20 minutes in #openstack-meeting-alt | 16:40 |
| knikolla | o/ | 16:43 |
| *** bnemec has quit IRC | 16:48 | |
| cmurphy | meeting now in #openstack-meeting-alt | 17:01 |
| *** tesseract has quit IRC | 17:01 | |
| cmurphy | lbragstad: hrybacki gyee ^ | 17:03 |
| *** raildo_ has quit IRC | 17:12 | |
| *** kplant has joined #openstack-keystone | 17:16 | |
| *** evrardjp has quit IRC | 17:34 | |
| *** evrardjp has joined #openstack-keystone | 17:34 | |
| *** jamesmcarthur has quit IRC | 18:00 | |
| *** ayoung has joined #openstack-keystone | 18:02 | |
| gyee | cmurphy, lbragstad, gagehugo, can you please take a look? https://review.opendev.org/#/c/702262/ | 18:04 |
| gyee | I am trying to get the stable branches straighten out | 18:05 |
| cmurphy | yes | 18:05 |
| gyee | ty | 18:05 |
| kplant | i'm trying to federate keystone to an external idp via openidc and am getting the error "Missing entity ID from environment". any ideas what that might be? | 18:15 |
| kplant | i thought entityID was a saml2 thing | 18:15 |
| cmurphy | kplant: it's not, it's the unique identifier that you use with --remote-id when you create the idp resource in keystone | 18:16 |
| cmurphy | kplant: that error usually means you set up the <Location ...> paths wrong in your apache config and they're not catching the auth requests before sending them to keystone | 18:17 |
| cmurphy | could also mean you didn't set remote_id_parameter correctly in keystone.conf | 18:17 |
| kplant | wait - should it be remote_id_parameter and not remote_id_attribute? | 18:23 |
| cmurphy | kplant: er sorry remote_id_attribute | 18:23 |
| kplant | phew | 18:23 |
| kplant | :-) | 18:23 |
| cmurphy | i didn't look it up before i said it >.< | 18:23 |
| kplant | i was going to be happy/angry if that was my problem all along, heh | 18:24 |
| cmurphy | lol | 18:25 |
| kplant | so i tried copying my location paths from https://docs.openstack.org/keystone/train/admin/federation/configure_federation.html#federation-openidc | 18:29 |
| kplant | and i also enabled insecure_debug | 18:29 |
| kplant | i don't see anything helpful in the keystone* logs, anywhere else i could maybe look? | 18:29 |
| cmurphy | check the apache access logs to see where the request is really going and make sure it matches the path in <Location ...> for instance if you have keystone running on an /identity path then you'll need to change the example to start with /identity, or if you have different names for the idp or protocol then you should make sure they match in the path, or if you're running keystone one port :5000 | 18:33 |
| cmurphy | make sure the <Location> directive is inside that vhost definition | 18:33 |
| kplant | yep within <VirtualHost *:5000>; will check the apache access logs though | 18:34 |
| kplant | Peer's Certificate issuer is not recognized. | 18:36 |
| ayoung | I thought we got rid of remote-id in the conf? | 18:36 |
| kplant | there we go | 18:36 |
| cmurphy | ayoung: we didn't get rid of it, we just made it an option to make it part of the protocol api and fall back to the config... and i guess we didn't document that o\ | 18:38 |
| kplant | meh, the timestamp from that error is a while ago. that doesn't seem to be the issue | 19:01 |
| kplant | also added 'OIDCSSLValidateServer Off' just in case | 19:01 |
| *** dustinc|PTO is now known as dustinc | 19:13 | |
| hrybacki | lbragstad: cmurphy is it okay if I mark this as triaged and set the prio/sev? https://bugs.launchpad.net/keystone/+bug/1860478 | 19:20 |
| openstack | Launchpad bug 1860478 in OpenStack Identity (keystone) "fetching role assignments should handle domain IDs in addition to project IDs " [Undecided,New] | 19:20 |
| *** jamesmcarthur has joined #openstack-keystone | 19:20 | |
| cmurphy | hrybacki: go for it | 19:20 |
| hrybacki | cmurphy: I must lack some perms to do that | 19:21 |
| cmurphy | oh | 19:22 |
| lbragstad | i think you need to be a member of the keystone-drivers? | 19:22 |
| cmurphy | hrybacki: try now | 19:23 |
| hrybacki | cmurphy++ thanks! | 19:24 |
| hrybacki | lbragstad: weird: https://bugs.launchpad.net/python-openstackclient | 19:32 |
| hrybacki | but bugs do exist against python-opensackclient: https://bugs.launchpad.net/python-openstackclient/+bug/1795180 | 19:32 |
| openstack | Launchpad bug 1795180 in python-openstackclient "openstack client router list does not filter by domain" [Undecided,New] | 19:32 |
| lbragstad | hrybacki they use storyboard | 19:32 |
| hrybacki | ohhh | 19:32 |
| *** jamesmcarthur has quit IRC | 19:46 | |
| *** jamesmcarthur has joined #openstack-keystone | 19:50 | |
| *** jamesmcarthur has quit IRC | 20:01 | |
| *** jamesmcarthur has joined #openstack-keystone | 20:01 | |
| *** jamesmcarthur has quit IRC | 20:08 | |
| *** jamesmcarthur has joined #openstack-keystone | 20:14 | |
| *** kplant has quit IRC | 20:38 | |
| hrybacki | lbragstad: cmurphy so interestingly, we don't allow 'domain names' in the same way that we do 'domain ids' to be passed through during role assignment | 20:40 |
| hrybacki | which makes me believe we may not have expected domains to have come through in the first place? | 20:41 |
| hrybacki | https://www.irccloud.com/pastebin/yPbybM93/ | 20:41 |
| lbragstad | in osc or in keystone's api directly? | 20:41 |
| hrybacki | in osc | 20:41 |
| *** rcernin has joined #openstack-keystone | 20:42 | |
| lbragstad | it's probably tripping because it thinks its dealing with a project https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/v3/role.py#L92-L95 | 20:44 |
| *** openstackgerrit has joined #openstack-keystone | 20:46 | |
| openstackgerrit | Merged openstack/keystone master: Add docs for app cred access rules https://review.opendev.org/697375 | 20:46 |
| *** jamesmcarthur has quit IRC | 20:58 | |
| *** jmlowe has joined #openstack-keystone | 21:00 | |
| *** jamesmcarthur has joined #openstack-keystone | 21:35 | |
| *** jmlowe has quit IRC | 22:09 | |
| *** jmlowe has joined #openstack-keystone | 22:13 | |
| *** jmlowe has quit IRC | 22:17 | |
| *** jamesmcarthur has quit IRC | 22:42 | |
| *** tkajinam has joined #openstack-keystone | 22:57 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!