| cardoe | rm_work: but it’s not a security oops when you are using SSO in a browser you are not prompted to change auth or select auth. It’s using that. The clouds.yaml implies no credentials or permissions. Your SSO token is unscoped and all that happens with clouds.yaml is that it tries to do is rescope the unscoped token to what clouds.yaml has. | 00:49 |
|---|---|---|
| rm_work | hmmm mine usually asks if i want to use the current identity and i click no and type my other one | 00:51 |
| rm_work | (in the browser) | 00:51 |
| rm_work | but if it doesn't re-pop the browser for the other profile i wouldn't get that chance | 00:51 |
| rm_work | or for some i have to clear my cookies before re-auth with is already annoying | 00:52 |
| opendevreview | Oria Weng proposed openstack/openstacksdk master: Identity: Add support for endpoint group/endpoint and endpoint group/project associations https://review.opendev.org/c/openstack/openstacksdk/+/999040 | 09:37 |
| opendevreview | Vladislav Terekhov proposed openstack/openstacksdk master: identity: Add federated attribute support to User https://review.opendev.org/c/openstack/openstacksdk/+/1001638 | 10:27 |
| opendevreview | Stephen Finucane proposed openstack/openstacksdk master: Pass segment_size in create_object https://review.opendev.org/c/openstack/openstacksdk/+/931575 | 10:57 |
| opendevreview | Merged openstack/openstacksdk master: Migrate requirements to pyproject.toml https://review.opendev.org/c/openstack/openstacksdk/+/953484 | 12:27 |
| opendevreview | Merged openstack/keystoneauth master: Add HTTP 429 Too Many Requests support https://review.opendev.org/c/openstack/keystoneauth/+/997255 | 12:27 |
| opendevreview | Merged openstack/keystoneauth master: Terminate the elements hashed into the cache id https://review.opendev.org/c/openstack/keystoneauth/+/1000843 | 13:37 |
| opendevreview | Merged openstack/keystoneauth master: pre-commit: Bump versions https://review.opendev.org/c/openstack/keystoneauth/+/1001538 | 13:37 |
| opendevreview | Merged openstack/openstacksdk master: Identity: Add support for endpoint groups https://review.opendev.org/c/openstack/openstacksdk/+/995762 | 14:59 |
| opendevreview | Thomas Sell proposed openstack/ansible-collections-openstack master: Fix subnet module when subnet already exists https://review.opendev.org/c/openstack/ansible-collections-openstack/+/1001685 | 15:27 |
| opendevreview | Thomas Sell proposed openstack/ansible-collections-openstack master: Fix subnet module when subnet already exists https://review.opendev.org/c/openstack/ansible-collections-openstack/+/1001685 | 15:30 |
| opendevreview | Merged openstack/openstacksdk master: Identity: Add support for endpoint group/endpoint and endpoint group/project associations https://review.opendev.org/c/openstack/openstacksdk/+/999040 | 15:39 |
| stephenfin | cardoe: jfyi stevedore 5.9.1 is out and should be in u-c soon https://review.opendev.org/c/openstack/releases/+/1001666 | 16:27 |
| stephenfin | https://review.opendev.org/c/openstack/releases/+/1001666 | 16:27 |
| cardoe | stephenfin: you got any examples of how to use or drive it? | 16:27 |
| stephenfin | that adds docs for and fixes the conflict resolution stuff, so you should be able to rely on it in KSA | 16:27 |
| stephenfin | https://docs.openstack.org/stevedore/latest/user/conflict_resolution.html | 16:28 |
| cardoe | perfect | 16:28 |
| cardoe | stephenfin: as an aside... can you merge keystonemiddleware too? | 16:28 |
| stephenfin | this can probably be another standalone precursor patch. easier to merge that way | 16:29 |
| stephenfin | cardoe: afraid not :( | 16:29 |
| stephenfin | gtema can though | 16:29 |
| cardoe | well there's a lot of cleanups that tkajinam and I have pitched out and gtema says its a lack of reviewers | 16:30 |
| cardoe | a lot of its cleanups to pyproject.toml and such | 16:30 |
| cardoe | but that's an aside | 16:30 |
| opendevreview | Vladislav Terekhov proposed openstack/openstacksdk master: compute: Fix server create attribute https://review.opendev.org/c/openstack/openstacksdk/+/1001700 | 16:30 |
| cardoe | I'll get https://review.opendev.org/c/openstack/keystoneauth/+/1001419 cleaned up today and I saw it's parent you added David and gtema... I assume getting their +2 is the blocker. | 16:31 |
| stephenfin | I can review middleware changes, but I can't commit to reviewing keystone itself and I think the two go hand-in-hand currently | 16:31 |
| stephenfin | and unlike ksa it doesn't have a natural home in SDK | 16:32 |
| stephenfin | cardoe: Not a blocker, no. I'd just like to give them some chance to weigh in | 16:33 |
| cardoe | okay sounds good. | 16:34 |
| cardoe | My plan is to follow up on the WebSSO protocol and formalize that a bit better with a spec. I plan on fixing the CSRF issue by allowing a nonce in the protocol. | 16:34 |
| opendevreview | Vladislav Terekhov proposed openstack/openstacksdk master: compute: Fix server create attribute https://review.opendev.org/c/openstack/openstacksdk/+/1001700 | 16:35 |
| stephenfin | makes sense 👌 | 16:38 |
| cardoe | Another aside... "openstack subnet pool set" and "openstack subnet pool unset" aren't complementary. You have to delete a subnet pool to change most of the settings. I've got a patch series coming to fix that up. | 16:38 |
| cardoe | Just lemme know how I can help. I'd like to see gophercloud and openstacksdk be pretty feature parity and us to clean up the typing and api stuff. | 16:39 |
| cardoe | One area I'd appreciate you input on is going to be some of the scope changed I'd like to do. | 16:39 |
| cardoe | So maybe sometime when you have 30 minutes we can setup a meetpad and talk? | 16:40 |
| cardoe | Cause I'd like to propose some specs and I'm not sure of the right places for that either. | 16:40 |
| stephenfin | Sure. This week is almost over and I've got some Mythos findings to finish working through, but I could do something towards the end of next week | 16:43 |
| stephenfin | though I will say async might be better if we starting getting too into the weeds, since it affords time to actually go and research things | 16:43 |
| stephenfin | s/if/once/ | 16:43 |
| stephenfin | I had never really considered the fact that unscoped tokens are a thing and that the shape of clouds.yaml entires isn't necessarily as good as it should be | 16:44 |
| stephenfin | ...before starting on reviews for this websso work | 16:44 |
| cardoe | yeah so that was actually one of the struggles in the original scope adoption failure review. | 16:53 |
| cardoe | That people had to flip flop between three OS_CLOUD entries to be able to run commands. | 16:53 |
| cardoe | I'm happy to post something async but it's a bit more than can fit into a few lines of IRC | 16:57 |
| cardoe | How would you like to get that? email? etherpad? | 16:57 |
| stephenfin | etherpad? At least to start | 16:57 |
| cardoe | Will do. | 16:58 |
| cardoe | I'll share that tomorrow or so. | 17:06 |
| opendevreview | Merged openstack/openstacksdk master: identity: Add federated attribute support to User https://review.opendev.org/c/openstack/openstacksdk/+/1001638 | 17:20 |
| cardoe | rm_work: so your identities are tied back to the same identity_provider and protocol values in clouds.yaml? | 17:37 |
| cardoe | rm_work: cause I've got other identities too but they have different values for one of those. | 17:38 |
| opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Expose the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | 18:19 |
| cardoe | rm_work: I have a solution. | 18:44 |
| opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Expose the unscoped token of a federated plugin https://review.opendev.org/c/openstack/keystoneauth/+/1001419 | 18:53 |
| cardoe | rm_work: ^ updates the cache_id elements to behave like the Password plugin which includes username/password in the hash. I'm not necessarily a fan of password being in there. But it does invalidate the cache when the password changes. | 18:54 |
| cardoe | Now when I rebase the v3websso plugin, I'll include username in the elements... which while not used at all by the plugin... will allow you to have two different cache entries. | 18:55 |
| opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Add a v3websso authentication plugin https://review.opendev.org/c/openstack/keystoneauth/+/1000759 | 19:19 |
| opendevreview | Doug Goldstein proposed openstack/keystoneauth master: Add a v3websso authentication plugin https://review.opendev.org/c/openstack/keystoneauth/+/1000759 | 19:35 |
| cardoe | stephenfin, rm_work: assuming you give me the grace of doing the conflict resolution changes with stevedore in a separate patch ^ should address all the feedback now. | 19:36 |
| rm_work | oh yeah I guess that works since it's just unused in the actual auth process with websso 😛 | 23:40 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!