15:10:26 <d34dh0r53> #startmeeting keystone 15:10:26 <opendevmeet> Meeting started Wed Aug 13 15:10:26 2025 UTC and is due to finish in 60 minutes. The chair is d34dh0r53. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:10:26 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 15:10:26 <opendevmeet> The meeting name has been set to 'keystone' 15:10:33 <d34dh0r53> o/ sorry, lost track of time 15:10:55 <gtema> right, same do I 15:11:10 <d34dh0r53> Reminder: This meeting takes place under the OpenInfra Foundation Code of Conduct 15:11:17 <d34dh0r53> #link https://openinfra.dev/legal/code-of-conduct 15:11:26 <d34dh0r53> #topic roll call 15:11:32 <gtema> o/ 15:11:39 <d34dh0r53> admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek, gmann, zaitcev, reqa, dmendiza[m], dmendiza, mharley, jph, gtema, cardoe, deydra 15:11:45 <d34dh0r53> dmendiza: o/ 15:11:51 <d34dh0r53> welcome back gtema 15:11:56 <gtema> thks 15:14:50 <d34dh0r53> #topic review past meeting work items 15:14:57 <d34dh0r53> #link https://meetings.opendev.org/meetings/keystone/2025/keystone.2025-08-06-15.04.html 15:15:16 <d34dh0r53> one action item, dmendiza look into https://bugs.launchpad.net/keystone/+bug/2119091 15:17:25 <gtema> looks to me like a race condition since the change from where it was reported is now passing 15:17:49 <d34dh0r53> ahh, ok, I didn't look into it 15:18:24 <d34dh0r53> I'll re-add it to the action items, looks like dmendiza is AFK 15:18:31 <d34dh0r53> #action dmendiza look into https://bugs.launchpad.net/keystone/+bug/2119091 15:18:37 <d34dh0r53> next up 15:18:41 <d34dh0r53> #topic liaison updates 15:18:45 <d34dh0r53> nothing from me 15:19:16 <dmendiza[m]> 🙋♂️ 15:19:26 <dmendiza[m]> Sorry, lost track of time 15:19:57 <dmendiza[m]> Yes, bump it, will definitely look at this week. 😅 15:19:59 <d34dh0r53> no worries, so did I :D 15:20:05 <d34dh0r53> 👍️ 15:20:13 <d34dh0r53> #topic specification OAuth 2.0 (hiromu) 15:20:16 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Foauth2-client-credentials-ext 15:20:19 <d34dh0r53> #link https://review.opendev.org/q/topic:bp%252Fenhance-oauth2-interoperability 15:20:27 <d34dh0r53> no updates 15:20:33 <d34dh0r53> #topic specification Secure RBAC (dmendiza) 15:20:35 <d34dh0r53> #link https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#z-release-timeline_ 15:20:38 <d34dh0r53> 2025.2 Release Timeline 15:20:41 <d34dh0r53> Update oslo.policy in keystone to enforce_new_defaults=True 15:20:49 <d34dh0r53> Update oslo.policy in keystone to enforce_scope=True 15:22:32 <d34dh0r53> any updates on SRBAC dmendiza ? 15:23:05 <dmendiza[m]> Negative ... I've been focused on the Security Compliance testing upstream 15:23:26 <dmendiza[m]> I did submit a patch to turn on SRBAC by default on devstack 15:23:42 <dmendiza[m]> but it failed as I somewhat expected 15:23:58 <dmendiza[m]> #link https://review.opendev.org/c/openstack/devstack/+/956210 15:25:15 <gtema> so you found a place where it is overridden, nice 15:29:10 <dmendiza[m]> That's it on my end, I'll look into the failures eventually. 😅 15:29:20 <d34dh0r53> thanks dmendiza 15:29:45 <d34dh0r53> #topic specification OpenAPI support (gtema) 15:29:48 <d34dh0r53> #link https://review.opendev.org/q/topic:%22openapi%22+project:openstack/keystone 15:30:08 <gtema> #action gtema to look into https://bugs.launchpad.net/keystone/+bug/2119543 15:30:16 <gtema> nothing else 15:30:46 <d34dh0r53> cool, I was going to let you know about that bug 15:30:52 <d34dh0r53> #topic open discussion 15:30:56 <d34dh0r53> drencrom 15:30:59 <d34dh0r53> Review patch proposal: https://review.opendev.org/c/openstack/keystone/+/951792 15:31:02 <d34dh0r53> It is passing ldap tests with the devstack patches 15:31:19 <d34dh0r53> I've reviewed that one 15:31:34 <gtema> I just update review-prio on devstack change to +2 15:32:05 <gtema> till that lands - ... 15:32:25 <d34dh0r53> yeah 15:34:33 <d34dh0r53> anything else for open discussion? 15:34:40 <gtema> not from me 15:35:58 <d34dh0r53> cool 15:36:08 <dmendiza[m]> Still working on the regex thing 15:36:13 <d34dh0r53> ack 15:36:20 <d34dh0r53> #topic bug review 15:36:40 <d34dh0r53> #link https://bugs.launchpad.net/keystone/?orderby=-id&start=0 15:37:02 <d34dh0r53> one new bug in keystone 15:37:06 <d34dh0r53> #link https://bugs.launchpad.net/keystone/+bug/2119991 15:39:14 <d34dh0r53> looks like an easy fix 15:40:02 <gtema> calling xmlsec as a subprocess from python looks to me itself like not a great idea in the first place 15:40:58 <d34dh0r53> yeah, there's that 15:42:59 <d34dh0r53> it's in the SAML code too which is pretty old 15:43:29 <gtema> and the bug reports hints people do rely on it still 15:44:49 <d34dh0r53> I think that's from the ubuntu packager 15:45:10 <gtema> ah, right 15:47:16 <d34dh0r53> we do have saml deployments though, so I know it's still being used 15:48:06 <gtema> ok 15:48:53 <d34dh0r53> that's it for keystone 15:49:06 <d34dh0r53> #link https://bugs.launchpad.net/python-keystoneclient/?orderby=-id&start=0 15:49:13 <d34dh0r53> nothing new in python-keystoneclient 15:49:17 <d34dh0r53> #link https://bugs.launchpad.net/keystoneauth/+bugs?orderby=-id&start=0 15:49:36 <d34dh0r53> keystoneauth is good 15:49:39 <d34dh0r53> #link https://bugs.launchpad.net/keystonemiddleware/+bugs?orderby=-id&start=0 15:49:57 <d34dh0r53> nothing new in keystonemiddleware 15:50:16 <d34dh0r53> #link https://bugs.launchpad.net/pycadf/+bugs?orderby=-id&start=0 15:50:19 <d34dh0r53> pycadf is good 15:50:22 <d34dh0r53> #link https://bugs.launchpad.net/ldappool/+bugs?orderby=-id&start=0 15:50:26 <d34dh0r53> so is ldappool 15:50:31 <d34dh0r53> #topic conclusion 15:50:40 <d34dh0r53> nothing else from me, thanks folks! 15:51:10 <gtema> cool 15:51:14 <d34dh0r53> #endmeeting