| *** jph7 is now known as jph | 01:40 | |
| opendevreview | Takashi Kajinami proposed openstack/oslo.policy master: Add flag to skip undefined rule check https://review.opendev.org/c/openstack/oslo.policy/+/907196 | 01:41 |
|---|---|---|
| opendevreview | Douglas Mendizábal proposed openstack/keystone-tempest-plugin master: Consistent and Secure RBAC (Phase 1) https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/903713 | 05:03 |
| *** zigo_ is now known as zigo | 09:43 | |
| opendevreview | Merged openstack/oslo.policy master: Add flag to skip undefined rule check https://review.opendev.org/c/openstack/oslo.policy/+/907196 | 11:57 |
| d34dh0r5| | #startmeeting keystone | 15:01 |
| opendevmeet | Meeting started Wed Jan 31 15:01:30 2024 UTC and is due to finish in 60 minutes. The chair is d34dh0r5|. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:01 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:01 |
| opendevmeet | The meeting name has been set to 'keystone' | 15:01 |
| *** d34dh0r5| is now known as d34dh0r53 | 15:01 | |
| dmendiza[m] | 🙋♂️ | 15:02 |
| d34dh0r53 | #topic roll call | 15:02 |
| d34dh0r53 | admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, knikolla[m], lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], mharley, jph | 15:02 |
| xek | o/ | 15:07 |
| d34dh0r53 | #topic review past meeting work items | 15:08 |
| d34dh0r53 | #link https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-01-17-15.00.html | 15:08 |
| d34dh0r53 | no updates on my stuff | 15:09 |
| d34dh0r53 | #action d34dh0r53 Look into adding/restoring a known issues section to our documentation | 15:09 |
| d34dh0r53 | #action d34dh0r53 add https://bugs.launchpad.net/keystone/+bug/1305950 to the known issues section of our documentation | 15:09 |
| d34dh0r53 | #topic liaison updates | 15:09 |
| d34dh0r53 | nothing from release management or VMT | 15:10 |
| d34dh0r53 | #topic specification OAuth 2.0 (hiromu) | 15:12 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext | 15:12 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Fenhance-oauth2-interoperability | 15:12 |
| d34dh0r53 | External OAuth 2.0 Specification | 15:13 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-specs/+/861554 | 15:13 |
| d34dh0r53 | OAuth 2.0 Implementation | 15:13 |
| d34dh0r53 | #link https://review.opendev.org/q/topic:bp%252Fsupport-oauth2-mtls | 15:13 |
| d34dh0r53 | OAuth 2.0 Documentation | 15:13 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/838108 | 15:13 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystoneauth/+/838104 | 15:13 |
| Luzi | o/ | 15:13 |
| d34dh0r53 | doesn't look like hiromu is around | 15:15 |
| d34dh0r53 | #topic specification Secure RBAC (dmendiza[m]) | 15:15 |
| d34dh0r53 | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ | 15:16 |
| d34dh0r53 | 2024.1 Release Timeline | 15:16 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_new_defaults=True | 15:16 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_scope=True | 15:16 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/902730 (Merged) | 15:16 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/903713 | 15:16 |
| dmendiza[m] | Yeah, still working on the tempest tests | 15:18 |
| dmendiza[m] | but the policy changes have already merged all the way back to antelope | 15:19 |
| d34dh0r53 | awesome, thanks for the work on that | 15:20 |
| d34dh0r53 | let me know when the tempest tests are ready for review | 15:21 |
| d34dh0r53 | #topic specification Improve federated users management (previously: Add schema version and support to "domain" attribute in mapping rules) (gtema) | 15:23 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-specs/+/748042 (merged) | 15:23 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/739966 (Merged) | 15:23 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone-specs/+/748748 | 15:23 |
| gtema | I have added link to the next spec here | 15:23 |
| gtema | thanks for finally merging the change | 15:23 |
| d34dh0r53 | yep, I'll take a look at the next one | 15:24 |
| gtema | so now we should do next step and allow also management of the user roles in the federated identity | 15:24 |
| gtema | otherwise it is required to have additional software that manages roles for ephemeral users | 15:24 |
| gtema | and that really sucks | 15:24 |
| gtema | I know the spec is currently tied to 2024.1 and it is no chance it can be made in this cycle | 15:25 |
| gtema | but I really appreciate we do not wait with review so that implementation is not blocked | 15:25 |
| gtema | thanks | 15:26 |
| d34dh0r53 | np, thank you | 15:27 |
| d34dh0r53 | #topic open discussion | 15:28 |
| bbobrov | i have topics | 15:28 |
| d34dh0r53 | go ahead bbobrov | 15:28 |
| bbobrov | a topic about unified limits. The page in the docs says that they are experimental - https://docs.openstack.org/keystone/latest/admin/unified-limits.html . Since the Nova 28.0.0 (2023.2 Bobcat) release, it is recommended to use Keystone unified limits for Nova quota limits - https://docs.openstack.org/nova/latest/admin/unified-limits.html | 15:28 |
| bbobrov | Are the limits experimental or are they already stable? | 15:28 |
| d34dh0r53 | I do not know, that is before my time and I'm surprised that it's still marked as experimental | 15:34 |
| bbobrov | an idea just came to me to search in gerrit: https://review.opendev.org/c/openstack/keystone/+/893120 | 15:37 |
| bbobrov | ok, good, then i will consider them to be stable | 15:37 |
| d34dh0r53 | yeah, I think that's safe at this point | 15:38 |
| bbobrov | then the next topic, about password truncation | 15:39 |
| bbobrov | After upgrade to Zed, we got flooded with messages "Truncating password to algorithm specific maximum length 72 characters." and "Truncating user password". They happen even though there is no config about password length. They happen even when somebody is authenticating with application credentials, because it seems that the code path leads to the method that prints the warning. | 15:39 |
| bbobrov | I will file a bugreport about this soon-ish; my question is: what is this all about? Or, more specific, can i just upgrade from Zed to Antilope, or do i need to care about the length of the secrets of application credentials and passwords? | 15:39 |
| d34dh0r53 | I think this has to do with the intrinsic limitation in bcrypt | 15:42 |
| d34dh0r53 | there were some bugs that I fixed in zed time frame that probably need some adjustment | 15:43 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/keystone/+/828595 | 15:44 |
| d34dh0r53 | is that what you're seeing? | 15:44 |
| bbobrov | yes | 15:45 |
| bbobrov | i found that the limit got raised in https://review.opendev.org/c/openstack/keystone/+/890936 | 15:46 |
| bbobrov | #link https://review.opendev.org/c/openstack/keystone/+/890936 | 15:46 |
| bbobrov | but i still don't fully understand whether the issue with the upgrade has been fixed or not | 15:46 |
| d34dh0r53 | I don't think upgrading will eliminate the messages, the truncation means that only the first 72 characters of a password are validated (https://passlib.readthedocs.io/en/stable/lib/passlib.hash.bcrypt.html#security-issues) and in the case of application credentials this probably happens more often | 15:50 |
| bbobrov | but will upgrading break the application credentials? | 15:51 |
| bbobrov | with long secrets | 15:51 |
| d34dh0r53 | I don't think so, just the whole secret won't be used | 15:51 |
| bbobrov | ok then, thanks. | 15:55 |
| d34dh0r53 | I would test that though :) | 15:55 |
| d34dh0r53 | #topic bug review | 15:55 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 | 15:55 |
| d34dh0r53 | no new bugs for keystone | 15:56 |
| d34dh0r53 | #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0 | 15:56 |
| d34dh0r53 | python-keystoneclient is good | 15:56 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0 | 15:56 |
| d34dh0r53 | nothing new for keystoneauth | 15:56 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0 | 15:56 |
| d34dh0r53 | nor keystonemiddleware | 15:56 |
| d34dh0r53 | #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0 | 15:56 |
| Luzi | just a short question (other topic): did anyone of the Keystone team got time to review the domain manager role spec?: https://review.opendev.org/c/openstack/keystone-specs/+/903172 | 15:57 |
| d34dh0r53 | pycadf is GTG | 15:57 |
| d34dh0r53 | dmendiza[m] and I can take a look | 15:57 |
| d34dh0r53 | Luzi: ^ | 15:57 |
| Luzi | thank you :) | 15:58 |
| d34dh0r53 | #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0 | 15:58 |
| d34dh0r53 | no new bugs for ldappool either | 15:58 |
| d34dh0r53 | #undo | 15:58 |
| d34dh0r53 | #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0 | 15:58 |
| d34dh0r53 | Luzi: np | 15:58 |
| d34dh0r53 | #topic conclusion | 15:58 |
| d34dh0r53 | sign up for the vPTG, April 8-12 | 15:59 |
| d34dh0r53 | #link https://openinfra.dev/ptg/ | 15:59 |
| d34dh0r53 | I'll shoot out the agenda in next weeks meeting | 15:59 |
| d34dh0r53 | Thanks everyone! | 15:59 |
| d34dh0r53 | #endmeeting | 16:00 |
| bbobrov | thank you | 16:00 |
| *** d34dh0r53 is now known as d34dh0r5| | 16:01 | |
| d34dh0r5| | #endmeeting | 16:01 |
| opendevmeet | Meeting ended Wed Jan 31 16:01:06 2024 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:01 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-01-31-15.01.html | 16:01 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-01-31-15.01.txt | 16:01 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/keystone/2024/keystone.2024-01-31-15.01.log.html | 16:01 |
| *** d34dh0r5| is now known as d34dh0r53 | 16:01 | |
| bbobrov | so... it seems that it is not the participants who should sign up for the ptg | 16:01 |
| bbobrov | but rather a group you represent | 16:02 |
| bbobrov | no? | 16:02 |
| d34dh0r53 | I've signed up the group but I believe the participants need to register | 16:07 |
| d34dh0r53 | ahh, I don't think they have the link for individual registrations up yet | 16:08 |
| d34dh0r53 | sorry | 16:08 |
| opendevreview | Douglas Mendizábal proposed openstack/keystone-tempest-plugin master: Consistent and Secure RBAC (Phase 1) https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/903713 | 21:01 |
| *** blarnath is now known as d34dh0r53 | 22:17 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!