15:02:07 <d34dh0r53> #startmeeting keystone
15:02:07 <opendevmeet> Meeting started Wed May  7 15:02:07 2025 UTC and is due to finish in 60 minutes.  The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:02:07 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:02:07 <opendevmeet> The meeting name has been set to 'keystone'
15:02:37 <d34dh0r53> Reminder: This meeting takes place under the OpenInfra Foundation Code of Conduct
15:02:46 <d34dh0r53> #link https://openinfra.dev/legal/code-of-conduct
15:02:54 <d34dh0r53> #topic roll call
15:03:03 <d34dh0r53> admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], dmendiza, mharley, jph, gtema, cardoe, deydra
15:03:03 <gtema> o/
15:03:05 <dmendiza[m]> 🙋‍♂️
15:03:16 <d34dh0r53> o/
15:04:17 <d34dh0r53> #topic review past meeting work items
15:04:43 <d34dh0r53> #link https://meetings.opendev.org/meetings/keystone/2025/keystone.2025-04-23-15.02.html
15:04:48 <d34dh0r53> no action items from the last meeting
15:04:57 <d34dh0r53> #topic liaison updates
15:05:00 <d34dh0r53> nothing from releases
15:05:24 <d34dh0r53> anything from VMT?
15:05:51 <gtema> not that I would know about
15:06:26 <d34dh0r53> ack, thanks
15:07:04 <d34dh0r53> moving on then
15:07:07 <d34dh0r53> #topic specification OAuth 2.0 (hiromu)
15:07:09 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext
15:07:15 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Fenhance-oauth2-interoperability
15:07:18 <d34dh0r53> External OAuth 2.0 Specification
15:07:19 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone-specs/+/861554 (merged)
15:07:24 <d34dh0r53> OAuth 2.0 Implementation
15:07:28 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Fsupport-oauth2-mtls (merged)
15:07:32 <d34dh0r53> OAuth 2.0 Documentation
15:07:34 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystone/+/838108 (merged)
15:07:36 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystoneauth/+/838104 (merged)
15:08:35 <d34dh0r53> no updates
15:09:24 <d34dh0r53> #link https://review.opendev.org/c/openstack/keystonemiddleware/+/899911 is waiting on dependencies in Barbican and Tacker to merge and then it's good to go.
15:09:40 <d34dh0r53> The others just need rebases once that is merged.
15:09:45 <d34dh0r53> next up
15:09:54 <d34dh0r53> #topic specification Secure RBAC (dmendiza[m])
15:09:57 <d34dh0r53> #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_
15:10:00 <d34dh0r53> 2024.1 Release Timeline
15:10:01 <d34dh0r53> Update oslo.policy in keystone to enforce_new_defaults=True
15:10:04 <d34dh0r53> Update oslo.policy in keystone to enforce_scope=True
15:10:14 <d34dh0r53> any updates dmendiza ?
15:11:15 <dmendiza[m]> Negative, just getting back from PTO
15:11:32 <d34dh0r53> Ack, thanks, and welcome back :)
15:11:42 <d34dh0r53> #topic specification OpenAPI support (gtema)
15:11:47 <d34dh0r53> #link https://review.opendev.org/q/topic:%22openapi%22+project:openstack/keystone
15:12:21 <gtema> since now the os-api-ref and openstackdocstheme requirements are raised I have updated openapi build change
15:12:25 <gtema> #link https://review.opendev.org/c/openstack/keystone/+/948185
15:12:41 <gtema> from my pov it can go this way, so feel free to review
15:13:25 <gtema> and then we can start discussing what and where is missing. It will also help landing jsonschema changes since we can see the schemas easier
15:14:03 <d34dh0r53> cool
15:14:37 <gtema> nothing else on that from me this week
15:15:05 <d34dh0r53> Looks good to me
15:15:11 <d34dh0r53> Thanks gtema
15:15:20 <d34dh0r53> That does it for specs
15:15:26 <d34dh0r53> #topic open discussion
15:15:34 <d34dh0r53> I don't really have anything
15:16:15 <gtema> anyone has ideas or proposals wrt modifying DB schema for the new federation support?
15:16:56 <gtema> it is explicitly about the federated_user table linking to the idp_id and protocol_id while in the new implementation those both go away and instead there are few other attrs
15:17:32 <gtema> currently there is not_null for both of them and therefore I can't use the table without easing those constraints
15:18:02 <gtema> I do not want to introduce new table (federated2_user) - it is going to be insane
15:18:52 <gtema> my idea was to drop the not_null constraint so that I can leave those fields empty while adding new fields and new FK constraints
15:20:05 <d34dh0r53> I'm okay with dropping the constraint
15:20:45 <gtema> I think the code is good enough to handle those properly
15:21:14 <d34dh0r53> Yeah, and if needed we can add some additional checks in the code
15:21:25 <gtema> ok, I will then proceed this way
15:21:41 <d34dh0r53> sounds good
15:22:00 <gtema> thks
15:24:35 <d34dh0r53> cool, any other open discussion topics?
15:24:47 <gtema> not from me
15:25:16 <d34dh0r53> moving on
15:25:20 <d34dh0r53> #topic bug review
15:25:24 <d34dh0r53> #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0
15:25:40 <d34dh0r53> Looks like three new bugs in keystone
15:25:53 <d34dh0r53> #link https://bugs.launchpad.net/keystone/+bug/2110084
15:26:00 <d34dh0r53> #link https://bugs.launchpad.net/keystone/+bug/2109989
15:26:11 <d34dh0r53> #link https://bugs.launchpad.net/keystone/+bug/2109693
15:28:05 <gtema> uhm
15:28:56 <gtema> project creation is another misuse of admin at domain scope
15:32:04 <d34dh0r53> yeah, the first two look like they may be just configuration issues
15:32:47 <d34dh0r53> moving on
15:33:16 <d34dh0r53> #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0
15:33:23 <d34dh0r53> no new bugs for python-keystoneclient
15:33:29 <d34dh0r53> #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0
15:33:38 <d34dh0r53> keystoneauth is good as well
15:33:42 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0
15:33:55 <d34dh0r53> no new bugs in keystonemiddleware
15:33:59 <d34dh0r53> #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0
15:34:01 <d34dh0r53> pycadf is good
15:34:05 <d34dh0r53> #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0
15:34:11 <d34dh0r53> so is ldappool
15:34:18 <d34dh0r53> #topic conclusion
15:34:23 <d34dh0r53> Thanks folks!
15:34:46 <gtema> thanks Dave Wilde (d34dh0r53)
15:35:07 <d34dh0r53> 👍️
15:35:11 <d34dh0r53> #endmeeting