| *** ykarel_ is now known as ykarel | 04:03 | |
| opendevreview | Merged openstack/keystone stable/2025.2: Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999) https://review.opendev.org/c/openstack/keystone/+/990499 | 06:06 |
|---|---|---|
| zigo | bbobrov: Hi there, are you around? | 12:22 |
| zigo | Not sure what's Artem Goncharov's nick... | 12:22 |
| gtema | it's gtema | 12:23 |
| zigo | Ah, thanks ! :) | 12:23 |
| gtema | welcome | 12:23 |
| zigo | gtema: We're having issues with this last patch: https://review.opendev.org/c/openstack/keystone/+/990494 | 12:23 |
| zigo | It prevents our users to do something like this: | 12:23 |
| zigo | openstack user set --multi-factor-auth-rule password,totp <USER_ID> | 12:23 |
| zigo | We have a special policy checker, so in our policy we have: | 12:24 |
| zigo | "identity:update_user": "http://127.0.0.1:8000/keystone/users/update" | 12:24 |
| zigo | so that it can check if it's a request to enable TOTP. | 12:24 |
| *** ricolin_ is now known as ricolin | 12:24 | |
| zigo | Though with the patch, it doesn't work anymore ... :/ | 12:25 |
| zigo | (and our users are always recieving a 403) | 12:25 |
| *** TheJulia_ is now known as TheJulia | 12:25 | |
| zigo | gtema: Any idea what could be the cause ? | 12:25 |
| gtema | not directly. I would rather ask why is the user allowed to do update_user - this is admin/domain_manager only operation by design | 12:26 |
| zigo | gtema: We just want to allow them to enable TOTP if they want to. | 12:26 |
| zigo | (and nothing else) | 12:27 |
| gtema | but you pass the full payload over there? | 12:27 |
| zigo | To our policy checker ? Yes. | 12:27 |
| gtema | hm, okay. Will try to trace in 30 min | 12:27 |
| zigo | Thanks. | 12:28 |
| zigo | I'm convince it's that one last patch btw, because I splitted the launchpad v4 patch into the 5 patches commited to Gerrit so I could revert them one by one util it would work again. | 12:29 |
| gtema | do you remember that now in some policies you need to check the data from the different key. Can you maybe check from logs whether you receive the data but just looking in the wrong place | 12:29 |
| zigo | You mean in my external policy checker? | 12:29 |
| zigo | Well, its logs says it is reply 200, so it isn't it that's faulty. | 12:30 |
| gtema | yes | 12:30 |
| zigo | (gosh. grammar, sorry...) | 12:30 |
| gtema | we adopted some policies since the keys of the data in the policy has changed | 12:30 |
| opendevreview | Lajos Katona proposed openstack/keystone master: LDAP: add new cfg option for pw expiry format https://review.opendev.org/c/openstack/keystone/+/976618 | 12:32 |
| gtema | zigo - I do not know how to react on your last message. Have you found an error on your side or whether it is just a statement to the grammar in the message | 12:33 |
| zigo | gtema: It's a statement that I'm having English grammar issues when I write on IRC ! :) | 12:43 |
| gtema | okay | 12:43 |
| opendevreview | Takashi Kajinami proposed openstack/oslo.limit master: Remove Python 3.10 support https://review.opendev.org/c/openstack/oslo.limit/+/992644 | 13:32 |
| opendevreview | Takashi Kajinami proposed openstack/oslo.policy master: Remove Python 3.10 support https://review.opendev.org/c/openstack/oslo.policy/+/992646 | 13:34 |
| gtema | zigo - can you trace a bit more your custom external check? It should not only return 200, but return "True" string in the text | 13:40 |
| zigo | Ok, asking my colleague. | 13:44 |
| gtema | would be nice if he can verify that it returns what expected and maybe also check whether it receives what is expected (I assume it would be target.user.... but maybe even target.target.user if I am interpreting the http check in oslo.policy correctly | 13:47 |
| gtema | or perhaps target.request_body.user... | 13:47 |
| zigo | gtema: Thanks a lot, I think we found out. Here's what we need to fix in our external policy checker: | 13:51 |
| zigo | allowed_changes = { | 13:51 |
| zigo | - "user.options.multi_factor_auth_enabled", | 13:51 |
| zigo | - "user.options.multi_factor_auth_rules", | 13:51 |
| zigo | + "request_body.user.options.multi_factor_auth_enabled", | 13:51 |
| zigo | + "request_body.user.options.multi_factor_auth_rules", | 13:51 |
| zigo | Not sure why "request_body." is prefixed now ... | 13:51 |
| gtema | because this is literally what the change does - wraps the content of the body. From the OPA point of view that is used in NG I also question this decision now | 13:52 |
| zigo | Ok, thanks a lot, we'll get our public deployment fixed really soon, this was very much helpful ! :) | 13:56 |
| gtema | you are welcome | 13:56 |
| d34dh0r53 | #startmeeting keystone | 15:04 |
| opendevmeet | Meeting started Wed Jun 10 15:04:04 2026 UTC and is due to finish in 60 minutes. The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:04 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:04 |
| opendevmeet | The meeting name has been set to 'keystone' | 15:04 |
| d34dh0r53 | Reminder: This meeting takes place under the OpenInfra Foundation Code of Conduct | 15:04 |
| d34dh0r53 | #link https://openinfra.dev/legal/code-of-conduct | 15:04 |
| d34dh0r53 | #topic roll call | 15:04 |
| d34dh0r53 | admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], dmendiza, mharley, jph, gtema, cardoe, deydra | 15:04 |
| gtema | o/ | 15:04 |
| d34dh0r53 | dmendiza o/ | 15:05 |
| dmendiza[m] | 🙋♂️ (kinda) | 15:05 |
| d34dh0r53 | #topic review past meeting work items | 15:05 |
| d34dh0r53 | #link https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-05-27-15.02.html | 15:05 |
| d34dh0r53 | nothing to review from last week | 15:06 |
| d34dh0r53 | #topic liaison updates | 15:06 |
| d34dh0r53 | nothing from me | 15:06 |
| gtema | nothing from me either | 15:07 |
| d34dh0r53 | #topic specification Secure RBAC (dmendiza) | 15:07 |
| d34dh0r53 | #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ | 15:07 |
| d34dh0r53 | 2026.1 Release Timeline | 15:07 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_new_defaults=True | 15:07 |
| d34dh0r53 | Update oslo.policy in keystone to enforce_scope=True | 15:08 |
| d34dh0r53 | Devstack still defaults to enforce_scope = False https://opendev.org/openstack/devstack/src/branch/master/lib/keystone#L120 | 15:08 |
| d34dh0r53 | Patch to default to true: https://review.opendev.org/c/openstack/devstack/+/956210 | 15:08 |
| d34dh0r53 | Fix config options in keystone-tempest-plugin https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/930829 | 15:08 |
| dmendiza[m] | I did not get to update the devstack pach 😅 | 15:08 |
| d34dh0r53 | ack, just remove the WIP label or is there more to do? | 15:08 |
| dmendiza[m] | Release notes, and a better explanation of why the change is needed | 15:09 |
| d34dh0r53 | okay, cool | 15:09 |
| d34dh0r53 | #topic specification Secuirty Compliance Testing (dmendiza) | 15:09 |
| d34dh0r53 | #link https://review.opendev.org/c/openstack/devstack/+/957969 | 15:10 |
| d34dh0r53 | no updates on compliance, moving on | 15:12 |
| d34dh0r53 | #topic keystone-rs | 15:12 |
| d34dh0r53 | #link https://github.com/openstack-experimental/keystone | 15:12 |
| dmendiza[m] | No progress ... 😅 | 15:12 |
| gtema | - students started producing PRs and some are already merged. Looking very promising to get a really good progress | 15:12 |
| gtema | - added internal notification mechanism so that providers can register hooks when e.g., user is deleted | 15:13 |
| gtema | - restarted thinking about SCIM implementation which leaded me into the SCIM auth challenge: | 15:13 |
| d34dh0r53 | 🥳 | 15:13 |
| gtema | 1) bearer token (bound to the user's domain scope) | 15:13 |
| gtema | 2. oauth2 client credentials. python keystone uses application creds for that what means it is project scoped - no use | 15:14 |
| gtema | oauth2-mtls - need to do tls termination directly (you can't rely on http proxy when giving customers self-service for that | 15:15 |
| gtema | so this is another hard argument why we need to do termination directly in the app | 15:15 |
| gtema | anyway, the oauth2-mtls leads me to a 4th mapping engine which means it is not practical, I need to rethink the mapping strategy, but I am definitely not going to reuse the mapping stlye of python keystone, it has too many flaws | 15:16 |
| gtema | so I will perhaps introduce a new "universal" mapping engine to be primarily used for tls mappings to implement oauth2-mtls. Afterwards will switch existing oidc/jwt/k8s_auth/spiffe to the new mapping engine | 15:18 |
| gtema | it's really disappointing that oauth2-client-creds is useless | 15:19 |
| gtema | that's it on the topic | 15:19 |
| d34dh0r53 | ack, thanks gtema , that is indeed a bummer about oauth2-client-creds | 15:19 |
| d34dh0r53 | next up | 15:19 |
| d34dh0r53 | #topic open discussion | 15:20 |
| gtema | I think I have one | 15:20 |
| gtema | how open are we for extending use of user/project/domain options beyond what they are currently used for? | 15:20 |
| gtema | one example in mind was related to the ACL protections. Imagine in the user_options we can require over which interface it can authenticate | 15:21 |
| gtema | or the user ACLs, same for project ACLs and so on | 15:21 |
| gtema | such options feel more "native" for that | 15:22 |
| gtema | but at the moment they are "hardcoded" in the code and we would need to decide whether we want to loosen this | 15:23 |
| d34dh0r53 | on the surface that seems like a good idea | 15:23 |
| gtema | I can start some prototyping to test the approach then | 15:24 |
| d34dh0r53 | okay, sounds good, anything else for open discussion? | 15:24 |
| gtema | not from me | 15:25 |
| d34dh0r53 | cool, moving on | 15:26 |
| d34dh0r53 | #topic bug review | 15:26 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 | 15:26 |
| d34dh0r53 | no new keystone bugs 😌 | 15:27 |
| d34dh0r53 | #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0 | 15:27 |
| d34dh0r53 | nothing new in python-keystoneclient | 15:27 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0 | 15:27 |
| d34dh0r53 | keystoneauth is clean | 15:27 |
| d34dh0r53 | #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0 | 15:27 |
| d34dh0r53 | keystonemiddleware is good to go | 15:28 |
| d34dh0r53 | #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0 | 15:28 |
| d34dh0r53 | nothing new here | 15:28 |
| d34dh0r53 | #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0 | 15:28 |
| d34dh0r53 | ldappool is good as well | 15:28 |
| d34dh0r53 | #topic conclusion | 15:28 |
| d34dh0r53 | Thanks all | 15:28 |
| gtema | thanks guys | 15:29 |
| d34dh0r53 | #endmeeting | 15:29 |
| opendevmeet | Meeting ended Wed Jun 10 15:29:06 2026 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:29 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-06-10-15.04.html | 15:29 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-06-10-15.04.txt | 15:29 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/keystone/2026/keystone.2026-06-10-15.04.log.html | 15:29 |
| opendevreview | Boris Bobrov proposed openstack/keystone master: Add release note for EC2 credential app cred guard fix https://review.opendev.org/c/openstack/keystone/+/992748 | 18:46 |
| opendevreview | Stephen Finucane proposed openstack/oslo.policy master: typing: Fix compatibility with typed oslo.config https://review.opendev.org/c/openstack/oslo.policy/+/992763 | 21:21 |
| opendevreview | sean mooney proposed openstack/keystone master: Add regression tests for lazy query DB leaks https://review.opendev.org/c/openstack/keystone/+/992781 | 23:48 |
| opendevreview | sean mooney proposed openstack/keystone master: Materialize lazy SQL backend queries https://review.opendev.org/c/openstack/keystone/+/992782 | 23:48 |
| opendevreview | sean mooney proposed openstack/keystone master: Materialize lazy SQL backend queries https://review.opendev.org/c/openstack/keystone/+/992782 | 23:56 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!