| *** mhen_ is now known as mhen | 02:13 | |
| opendevreview | Merged openstack/keystone master: Import LOG where it is used https://review.opendev.org/c/openstack/keystone/+/969955 | 04:19 |
|---|---|---|
| *** darmach3 is now known as darmach | 04:26 | |
| opendevreview | Merged openstack/keystone master: Fix role assignment cache for federated users https://review.opendev.org/c/openstack/keystone/+/967048 | 11:54 |
| opendevreview | Merged openstack/keystone master: Remove unused bandit target https://review.opendev.org/c/openstack/keystone/+/962839 | 11:58 |
| opendevreview | Merged openstack/keystone master: Use native hook of bashate https://review.opendev.org/c/openstack/keystone/+/962842 | 11:58 |
| opendevreview | Ivan Anfimov proposed openstack/keystone master: Drop flake8-docstrings https://review.opendev.org/c/openstack/keystone/+/962843 | 12:12 |
| opendevreview | Ivan Anfimov proposed openstack/keystone master: Drop flake8-docstrings https://review.opendev.org/c/openstack/keystone/+/962843 | 12:12 |
| opendevreview | Ivan Anfimov proposed openstack/keystone master: Drop flake8-docstrings https://review.opendev.org/c/openstack/keystone/+/962843 | 12:12 |
| opendevreview | Ivan Anfimov proposed openstack/keystone master: Cap hacking https://review.opendev.org/c/openstack/keystone/+/906965 | 12:14 |
| opendevreview | Ivan Anfimov proposed openstack/keystone master: Cap hacking https://review.opendev.org/c/openstack/keystone/+/906965 | 12:15 |
| opendevreview | Ivan Anfimov proposed openstack/keystone master: Cap hacking https://review.opendev.org/c/openstack/keystone/+/906965 | 12:15 |
| opendevreview | Ivan Anfimov proposed openstack/keystone master: Cap hacking https://review.opendev.org/c/openstack/keystone/+/906965 | 12:16 |
| opendevreview | Stephen Finucane proposed openstack/oslo.limit master: typing: Accept None project ID https://review.opendev.org/c/openstack/oslo.limit/+/970247 | 13:01 |
| opendevreview | Stephen Finucane proposed openstack/oslo.limit master: typing: Be looser in what we accept https://review.opendev.org/c/openstack/oslo.limit/+/970248 | 13:01 |
| opendevreview | Takashi Kajinami proposed openstack/pycadf master: ruff: Enable missing E5 check https://review.opendev.org/c/openstack/pycadf/+/970255 | 13:18 |
| cardoe | gtema: | 15:12 |
| cardoe | should we backport https://review.opendev.org/c/openstack/keystone/+/967048 ? | 15:12 |
| cardoe | sorry for splitting the message up premature enter key | 15:13 |
| gtema | I think it would make sense | 15:13 |
| lajoskatona | Hi, I got a question from on of our downstream teams, which they sent out to openstack-discuss also: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/thread/3T5VDI23TZDBFNZLBVDOUGUQCRLCOL2N/ | 15:26 |
| lajoskatona | They tried using user_additional_attribute_mapping like this one: user_additional_attribute_mapping = passwordExpirationTime:password_expires_at | 15:27 |
| gtema | lajoskatona - ack. I have seen that question but hoping somebody with ldap experience to jump in. I am very curious since ldap is considered a read-only backend with no possibility to change password through keystone, so I am confused with the question | 15:28 |
| lajoskatona | but on keystone API the user's password_expires_at filed is still empty, do yo have perhaps any tips what should be a next step to integrate their ldap server (389ds) with keystone? | 15:28 |
| lajoskatona | gtema: to tell the truth I am totally dumb for this topic so I had to read keystone and ldap docs half a day to understand the basics of the question :-) | 15:29 |
| gtema | I feel you | 15:30 |
| lajoskatona | perhaps I answer to the mail with the findings with the cfg option user_additional_attribute_mapping, and hope that it will hit a memory for somebody | 15:31 |
| gtema | I really do not understand the question properly, since as I wrote - you are not expected to do anything with the password rotation through Keystone | 15:32 |
| lajoskatona | my understanding is that they expect keystone to know about the ldap server password expiration time | 15:35 |
| gtema | "Is it not possible for keystone to respond token with minimum scope to only change password?" - this part of the message is what confuses me | 15:36 |
| opendevreview | Doug Goldstein proposed openstack/keystone stable/2025.2: Fix role assignment cache for federated users https://review.opendev.org/c/openstack/keystone/+/970284 | 17:04 |
| cardoe | gtema: ^ so that's my backport | 17:04 |
| cardoe | Did you happen to see my federation mapping docs update as well? | 17:05 |
| gtema | oh, that looks huge. And I am not sure in at least one thing and need to verify first | 17:05 |
| cardoe | gtema: well its suppose to capture all the issues I've run into | 18:19 |
| gtema | And you are sure with local account pre-existence requirement? I was sure it is not the case. Would need to dig the code | 18:20 |
| cardoe | gtema: yes... https://opendev.org/openstack/keystone/src/commit/a71b056a5b3f776c23abf0e840f942cc4945bc3b/keystone/auth/plugins/mapped.py#L239 | 22:00 |
| cardoe | So that causes the user context to be created not from the ephemeral data but from the user_name or user_id in the domain_name or domain_id. It will call a get_user() from the appropriate domain and if that user doesn't exist then it won't create the context. | 22:01 |
| cardoe | The result is that users won't be able to login when they are type=local cause they won't already be in the database. | 22:02 |
| opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Add v3websso OpenID Connect Web SSO authentication plugin https://review.opendev.org/c/openstack/keystoneauth/+/970328 | 23:15 |
| cardoe | mnaser: ^ that's the websso plugin integrated. I've used it so far today and it works fine. Claude wrote up some docs for me and the tests. | 23:17 |
| cardoe | I had to rewrite it from multipart to WebOb since multipart is not in global requirements. | 23:17 |
| mnaser | Thats neat. The only concern I would have is the pace of maintainability... | 23:19 |
| mnaser | [@_oftc_cardoe:matrix.org](https://matrix.to/#/@_oftc_cardoe:matrix.org) why not add this as a dependency of keystoneauth instead of add it natively ? It can allow us to keep moving this thing at a good pace. | 23:20 |
| mnaser | Keystone stuff takes forever to merge. | 23:20 |
Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!