| xek | Artem Goncharov (gtema) https://review.opendev.org/c/openstack/python-keystoneclient/+/1008792 fixes keystoneclient-devstack-functional job (non-voting) | 10:19 |
|---|---|---|
| gtema | thks - looking | 10:20 |
| opendevreview | Merged openstack/python-keystoneclient master: Fix credential imutable field https://review.opendev.org/c/openstack/python-keystoneclient/+/1008792 | 11:05 |
| opendevreview | Veronika Fisarova proposed openstack/keystone master: Fix IdP remote_ids schema maxLength to match SQL https://review.opendev.org/c/openstack/keystone/+/1009453 | 12:38 |
| opendevreview | Merged openstack/keystone master: EC2 credentials: stop client-forged trust_id impersonation https://review.opendev.org/c/openstack/keystone/+/1009270 | 14:09 |
| *** mhen_ is now known as mhen | 16:20 | |
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: trivial: Add docstrings for ServiceTokenAuthWrapper https://review.opendev.org/c/openstack/keystoneauth/+/1009618 | 17:20 |
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: docs: Add service tokens guide https://review.opendev.org/c/openstack/keystoneauth/+/1009619 | 17:20 |
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: docs: Rework authentication-plugins documentation https://review.opendev.org/c/openstack/keystoneauth/+/1009620 | 17:20 |
| opendevreview | Stephen Finucane proposed openstack/keystoneauth master: Handle optional RelayState in SAML2 ECP responses https://review.opendev.org/c/openstack/keystoneauth/+/1005691 | 17:22 |
| croelandt | gtema: hey! A few months ago we quickly discussed Keystone trusts and how it would be best not to use them anymore. As Glance still uses them, I was hoping to be able to discuss that at PTG so we can try and remove them during the I cycle. Do you think there is a chance we could have a short cross-project session regarding this topic, as I'm not sure anyone in Glance has a really good | 17:28 |
| croelandt | understanding of trusts? | 17:28 |
| gtema | hey, trusts were mentined in https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/thread/ZJUJ6SH7LE7W34HQYSS4GND3MUFCRGOQ/ (pointing at very long https://openstack-experimental.github.io/keystone/vision.html). It is going to be discussed in https://etherpad.opendev.org/p/oct2026-ptg-os-tc (Mon 14:00 UTC) and also likely on Tue in https://etherpad.opendev.org/p/oct2026-ptg-keystone | 17:31 |
| gtema | the TC etherpad (under SRBAC future) contain a very very short tl;dr; version of it with the following item: Replace Keystone trusts with service grants plus RFC 8693 on-behalf-of exchange. Grants are server-side, revocable records. No secret is delegated, and act and delegation_context claims record the chain. | 17:31 |
| gtema | but in any way - definitely will discuss this during ptg | 17:32 |
| gtema | since there are quite strong pre-requisites for this to happen | 17:32 |
| croelandt | oh ok then we'll join these sessions :) | 17:39 |
| croelandt | gtema: regarding the Tuesday session, I take it you are also currently finalizing the agenda and the timeslots should be available later this week? | 17:39 |
| gtema | we don't have much agenda beyond this and this is like a terribly huge topic | 17:40 |
| croelandt | oh. Are you expecting devs from other services to join or is it mostly a "private" discussion? | 17:41 |
| gtema | we can make perhaps a fixed time slot for talking about trusts, since we definitely have shared sessions to talk about EC2 madness | 17:41 |
| gtema | nothing is private ;-) everybody is welcome. The vision is explicitly going to be touched in the TC room since this is a cross-project stuff | 17:42 |
| gtema | sean-k-mooney already shared his interest on trust replacement | 17:43 |
| gtema | I'll try to work out tomorrow fixed time slots for topic like that | 17:44 |
| croelandt | to be fair I barely know what we do with trusts :D | 17:44 |
| croelandt | I'd just like to make sure we're not open to any security vulns in the future | 17:45 |
| gtema | lot of use and barely anybody understands them - it is the root problem of them being a disaster | 17:45 |
| opendevreview | Merged openstack/keystoneauth master: Mark OAuth1 consumer and access secrets as sensitive opts https://review.opendev.org/c/openstack/keystoneauth/+/1005684 | 18:49 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!