| morganfainberg | mgagne, mod_wsgi based or eventlet based keystone? | 00:00 |
|---|---|---|
| *** harlowja is now known as harlowja_away | 00:01 | |
| *** _cjones_ has quit IRC | 00:04 | |
| *** _cjones_ has joined #openstack-keystone | 00:04 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Fix reference to middleware architecture doc https://review.openstack.org/127078 | 00:05 |
| *** _cjones_ has quit IRC | 00:07 | |
| *** _cjones_ has joined #openstack-keystone | 00:07 | |
| *** cds has quit IRC | 00:11 | |
| *** harlowja_away is now known as harlowja | 00:11 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Remove HTTP_X_STORAGE_TOKEN doc https://review.openstack.org/127083 | 00:11 |
| *** cjellick has quit IRC | 00:14 | |
| *** cjellick has joined #openstack-keystone | 00:19 | |
| *** gokrokve has joined #openstack-keystone | 00:21 | |
| *** openstackstatus has quit IRC | 00:23 | |
| *** alex_xu has joined #openstack-keystone | 00:23 | |
| *** openstackstatus has joined #openstack-keystone | 00:23 | |
| *** ChanServ sets mode: +v openstackstatus | 00:24 | |
| *** cjellick has quit IRC | 00:24 | |
| *** wwriverrat has joined #openstack-keystone | 00:26 | |
| *** wwriverrat has quit IRC | 00:27 | |
| *** arosen has quit IRC | 00:28 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Docstring cleanup https://review.openstack.org/127084 | 00:34 |
| *** ayoung has joined #openstack-keystone | 00:49 | |
| ayoung | flwang1, you still around? | 00:50 |
| flwang1 | ayoung: yes :) | 00:51 |
| ayoung | flwang1, OK...so what do you want 'ResellerAdmin' to do? | 00:51 |
| flwang1 | ayoung: did you see my first question? | 00:51 |
| flwang1 | ayoung: my initial goal is to let a user can create new user for current tenant | 00:51 |
| ayoung | so first off, do you want to be able to create a new user, or assign an existing user to the current tneant? | 00:52 |
| ayoung | let me clear one thing up | 00:52 |
| ayoung | in the past, tenants "owned"users | 00:52 |
| ayoung | not the case now | 00:52 |
| ayoung | domain own users | 00:52 |
| flwang1 | create a new user and the new user only have access to current tenant | 00:52 |
| ayoung | users have roles in tenants | 00:52 |
| ayoung | flwang1, OK, so you need to decide in which domain the user is going to exist | 00:52 |
| ayoung | lets assume that the ResellerAdmin is needs two permissions: | 00:53 |
| flwang1 | so for v3, I need a domain firstly, is it? | 00:53 |
| ayoung | 1. create user in domain "MyDomain" | 00:53 |
| ayoung | yes | 00:53 |
| ayoung | 2. Assign user to role "Member" in project P1 | 00:53 |
| *** _cjones_ has quit IRC | 00:53 | |
| *** _cjones_ has joined #openstack-keystone | 00:54 | |
| flwang1 | ayoung: actually, I saw HP cloud can do that, but I'm not sure how | 00:55 |
| flwang1 | btw, does the Icehouse have fully support for v3? we're still using icehouse | 00:55 |
| ayoung | flwang1, I can't speak to all of Icehouse. All I can suggest is that you try it out | 00:58 |
| flwang1 | ayoung: got it | 00:58 |
| ayoung | flwang1, Are you guys running Horizon? | 00:58 |
| flwang1 | yes | 00:59 |
| ayoung | flwang1, Ok, here is what I found | 00:59 |
| *** _cjones_ has quit IRC | 00:59 | |
| ayoung | 1. There are three changes you need to make to Horizon to get it to do V3. But then the issue is the Keystone catalog | 00:59 |
| ayoung | lets sart with the Keystone catalog: | 00:59 |
| ayoung | I ran a bunch of sql like this: | 00:59 |
| ayoung | update endpoint set url = 'https://ayoungf20packstack.cloudlab.freeipa.org/keystone/main/v3' where url = 'https://ayoungf20packstack.cloudlab.freeipa.org/keystone/main/v2.0'; | 01:00 |
| * ayoung doesn't do port 5000 35357 nonsense | 01:00 | |
| ayoung | at the same time, you need to modify Horizon conf | 01:00 |
| ayoung | it should be in /etc/openstack-dashboard/local.py or something | 01:01 |
| ayoung | /etc/openstack-dashboard/local_settings in a RPM based install, probably something similar in debian/ubuntu | 01:01 |
| ayoung | in that file, change the auth URL to end in v3. | 01:02 |
| ayoung | So for me it started with | 01:02 |
| flwang1 | listening... | 01:02 |
| *** stevemar has joined #openstack-keystone | 01:02 | |
| ayoung | OPENSTACK_KEYSTONE_URL="http://192.168.122.174:5000/v2.0" | 01:02 |
| ayoung | and make it | 01:03 |
| ayoung | OPENSTACK_KEYSTONE_URL="http://192.168.122.174:5000/v3" | 01:03 |
| ayoung | also, enable V3 support with | 01:03 |
| ayoung | 1 sec | 01:03 |
| ayoung | OPENSTACK_API_VERSIONS = {"identity": 3} | 01:04 |
| ayoung | you can set other things there if you need different versions of the othe service apis, like | 01:04 |
| ayoung | "volume": 2 for cinder. | 01:04 |
| ayoung | its a python dictionary, so just make sure you have proper syntax | 01:04 |
| ayoung | finally.... | 01:04 |
| ayoung | OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True | 01:05 |
| ayoung | I'd recommend bringing up a second Horizon server and trying all that | 01:05 |
| flwang1 | so all above is how to enable v3, right? | 01:05 |
| ayoung | flwang1, I assume this is a production deployment? | 01:05 |
| ayoung | yeah, you need all 4 changes in sync | 01:05 |
| flwang1 | ayoung: yes | 01:05 |
| ayoung | and the scary part is the Keystone one | 01:05 |
| flwang1 | is it possible to do that without stopping any services? | 01:06 |
| ayoung | I had been pushing for a hack in Keystone client to ignore the version number from the endpoints, but I guess I need to push harder | 01:06 |
| ayoung | I don't thinks so | 01:06 |
| ayoung | flwang1, how do you guys deploy? | 01:06 |
| flwang1 | puppet | 01:07 |
| ayoung | straight puppet? | 01:07 |
| ayoung | no installer? | 01:07 |
| flwang1 | puppet with debian package | 01:07 |
| ayoung | I would prefer it if we could somehow do this without risking an interruption in service... | 01:08 |
| ayoung | let me think.... | 01:08 |
| ayoung | ideally, the Keystone client would work with versionless URLS | 01:09 |
| ayoung | and jamielennox has done a lot of work to make that happen,but it requires "Discovery" which means multiple orund trips per new client object... | 01:09 |
| ayoung | and older clients assume that it will be V2 | 01:10 |
| ayoung | meaning assuming the urls in the service catalog end in v2 | 01:10 |
| *** marcoemorais has quit IRC | 01:10 | |
| flwang1 | ayoung: okay, so let's assume we have enabled the v3 | 01:10 |
| ayoung | K | 01:10 |
| flwang1 | ayoung: then what's the next step? :) | 01:10 |
| ayoung | I'd create a domain for the reseller | 01:10 |
| ayoung | all of the users that are clients of that reseller get created in there | 01:10 |
| flwang1 | is the reseller must-have? | 01:10 |
| ayoung | you were the one that wanted a reseller | 01:11 |
| ayoung | I'm just following your example | 01:11 |
| flwang1 | ayoung: sorry, they are 2 questions | 01:11 |
| *** jwy has quit IRC | 01:11 | |
| ayoung | lets assume the reseller for now | 01:11 |
| flwang1 | the first one is how to add a new user if I'm a end user | 01:11 |
| ayoung | in v3? | 01:11 |
| flwang1 | the 2nd is how to use the reseller | 01:11 |
| flwang1 | sorry for any confusion | 01:12 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Remove unused iso8601 https://review.openstack.org/122278 | 01:12 |
| ayoung | ah...right, cuz the CLI is v2 | 01:12 |
| ayoung | well, I know many ways, I tend toward curl... | 01:12 |
| ayoung | http://adam.younglogic.com/2013/09/keystone-v3-api-examples/ | 01:12 |
| ayoung | wow, was that year ago | 01:12 |
| ayoung | time flys | 01:12 |
| openstackgerrit | A change was merged to openstack/keystone: Refactor FakeLdap to share delete code https://review.openstack.org/121371 | 01:13 |
| flwang1 | ayoung: in v2, I was trying to add a new role like " manager' | 01:13 |
| ayoung | I think, though, that you can do all of that as an admin in Horizon with V3 enabled | 01:13 |
| * ayoung gonna check. | 01:13 | |
| *** diegows has quit IRC | 01:13 | |
| flwang1 | and set the permission for the new role to create/list/delete users | 01:13 |
| openstackgerrit | A change was merged to openstack/keystone: revise docs on default _member_ role https://review.openstack.org/110803 | 01:13 |
| *** Kui has quit IRC | 01:13 | |
| flwang1 | and set the manager role the current user, but seems it doesn't work | 01:13 |
| flwang1 | in v2 | 01:13 |
| ayoung | flwang1, if you enable V3, you can then create domains etc via horizon | 01:13 |
| *** Kui has joined #openstack-keystone | 01:14 | |
| ayoung | I don't know, however, if it will support your use cases...I've not played around with it too much | 01:14 |
| ayoung | but there is an identity panel, with domains, projects ,etc... | 01:14 |
| flwang1 | ayoung: ok | 01:14 |
| flwang1 | so in v3, as you said, I need create a new domain | 01:15 |
| ayoung | yeah | 01:15 |
| flwang1 | create a new project in the domian, set the user for the project | 01:15 |
| flwang1 | and then is there any api/cli to add a new user for the project? | 01:15 |
| ayoung | domains are top level namespaces, so if you want to give someone, like a reseller, the power to create things, but keep them from stepping on others, confine them to a domain | 01:15 |
| ayoung | the term is "assign a user a role in the project" and yes | 01:16 |
| flwang1 | cool | 01:16 |
| flwang1 | our original idea is like creating a 'managed' cloud for the customer | 01:16 |
| ayoung | flwang1, I wrote a simple Javascript UI for this kind of thing, but the call you want via curl (to start) is | 01:17 |
| flwang1 | that means the customer can create new project, new user based on the resource quota we assigned | 01:17 |
| ayoung | http://adam.younglogic.com/2013/11/more-keystone-v3-api-examples/ | 01:17 |
| ayoung | seee where it says: Let’s give our user this role | 01:17 |
| flwang1 | awesome, awesome :) | 01:17 |
| *** nkinder has joined #openstack-keystone | 01:18 | |
| ayoung | https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#grant-role-to-user-on-project-put-projectsproject_idusersuser_idrolesrole_id | 01:18 |
| ayoung | the call is | 01:18 |
| ayoung | PUT /projects/{project_id}/users/{user_id}/roles/{role_id} | 01:19 |
| *** gokrokve has quit IRC | 01:19 | |
| flwang1 | cooooooool | 01:19 |
| flwang1 | so based on current v3 design, the user case I mentioned above can be meet, is it? | 01:20 |
| ayoung | THink so | 01:21 |
| ayoung | you might want to check out the more advance policy file : | 01:21 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json | 01:21 |
| flwang1 | great | 01:21 |
| flwang1 | ayoung: thank you sooooooooooooo much | 01:21 |
| ayoung | if you enable domain specific backends, the rules for domains change/ | 01:22 |
| ayoung | this is not a well published fact | 01:22 |
| ayoung | But, I think you should try it out, and see. | 01:22 |
| flwang1 | yes | 01:22 |
| ayoung | THe difference is whether a user is limited to enumerating a specifiuc domain or all domains | 01:22 |
| ayoung | the flag is: | 01:22 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n787 | 01:23 |
| ayoung | domain_specific_drivers=True | 01:23 |
| flwang1 | in the case, I think the user is like a 'sub-administrator' of the 'domain' | 01:23 |
| flwang1 | he can do most of the things like a real admin, but just in this domian | 01:23 |
| flwang1 | ayoung: really appreciate for your time and the patient | 01:28 |
| ayoung | good luck | 01:28 |
| *** bknudson has left #openstack-keystone | 01:42 | |
| *** bknudson has joined #openstack-keystone | 01:42 | |
| *** oomichi_ has joined #openstack-keystone | 01:44 | |
| *** david-lyle has joined #openstack-keystone | 01:50 | |
| *** vsilva is now known as victsou | 01:54 | |
| *** victsou is now known as vsilva | 01:54 | |
| *** gokrokve has joined #openstack-keystone | 02:03 | |
| *** _cjones_ has joined #openstack-keystone | 02:05 | |
| *** dimsum_ has joined #openstack-keystone | 02:06 | |
| *** _cjones_ has quit IRC | 02:09 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: sys.exit mock cleanup https://review.openstack.org/124240 | 02:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Tests raise exception if logging problem https://review.openstack.org/119946 | 02:10 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: wrong order of assertEqual args in assertValidRoleAssignmentListResponse https://review.openstack.org/127110 | 02:18 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: use expected_length parameter to assert expected length https://review.openstack.org/127112 | 02:20 |
| *** gokrokve has quit IRC | 02:23 | |
| *** dimsum_ has quit IRC | 02:28 | |
| *** lhcheng has quit IRC | 02:28 | |
| *** dimsum_ has joined #openstack-keystone | 02:28 | |
| *** lhcheng has joined #openstack-keystone | 02:28 | |
| *** dimsum_ has quit IRC | 02:33 | |
| *** alex_xu has quit IRC | 02:33 | |
| *** lhcheng has quit IRC | 02:34 | |
| *** samuelmz_ has joined #openstack-keystone | 02:35 | |
| *** samuelmz_ has quit IRC | 02:35 | |
| *** openstackgerrit has quit IRC | 02:45 | |
| *** alex_xu has joined #openstack-keystone | 02:49 | |
| *** gokrokve has joined #openstack-keystone | 02:54 | |
| *** alex_xu has quit IRC | 03:00 | |
| *** stevemar has quit IRC | 03:12 | |
| *** alex_xu has joined #openstack-keystone | 03:13 | |
| *** stevemar has joined #openstack-keystone | 03:13 | |
| *** gokrokve has quit IRC | 03:23 | |
| *** gokrokve has joined #openstack-keystone | 03:24 | |
| *** harlowja is now known as harlowja_away | 03:29 | |
| *** harlowja_away is now known as harlowja | 03:31 | |
| *** amcrn has quit IRC | 03:32 | |
| *** bknudson has quit IRC | 03:33 | |
| *** gokrokve_ has joined #openstack-keystone | 03:40 | |
| *** gokrokve has quit IRC | 03:42 | |
| *** gokrokve_ has quit IRC | 03:57 | |
| *** gokrokve has joined #openstack-keystone | 04:09 | |
| *** gokrokve has quit IRC | 04:10 | |
| *** marcoemorais has joined #openstack-keystone | 04:26 | |
| *** ncoghlan has joined #openstack-keystone | 04:26 | |
| *** flwang1 has quit IRC | 04:27 | |
| *** marcoemorais1 has joined #openstack-keystone | 04:30 | |
| *** marcoemorais has quit IRC | 04:33 | |
| *** gokrokve has joined #openstack-keystone | 04:41 | |
| *** gokrokve has quit IRC | 04:42 | |
| *** gokrokve has joined #openstack-keystone | 04:42 | |
| *** gokrokve has quit IRC | 04:48 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:00 | |
| *** jamielennox has quit IRC | 05:04 | |
| *** jamielennox has joined #openstack-keystone | 05:09 | |
| *** david-lyle has quit IRC | 05:10 | |
| *** ajayaa has joined #openstack-keystone | 05:17 | |
| *** lhcheng has joined #openstack-keystone | 05:18 | |
| *** swamireddy has joined #openstack-keystone | 05:18 | |
| *** lhcheng has quit IRC | 05:21 | |
| *** lhcheng has joined #openstack-keystone | 05:21 | |
| *** david-lyle has joined #openstack-keystone | 05:27 | |
| *** harlowja is now known as harlowja_away | 05:35 | |
| *** gokrokve has joined #openstack-keystone | 05:43 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:45 | |
| *** gokrokve has quit IRC | 05:48 | |
| *** afazekas has joined #openstack-keystone | 05:51 | |
| *** ncoghlan has quit IRC | 06:19 | |
| *** lhcheng has quit IRC | 06:40 | |
| *** lufix has joined #openstack-keystone | 06:41 | |
| *** gokrokve has joined #openstack-keystone | 06:43 | |
| *** gokrokve has quit IRC | 06:48 | |
| *** ukalifon has joined #openstack-keystone | 06:55 | |
| *** marekd|away is now known as marekd | 06:55 | |
| *** k4n0 has joined #openstack-keystone | 06:56 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 06:59 | |
| *** ukalifon has quit IRC | 07:00 | |
| *** k4n0 has quit IRC | 07:02 | |
| *** k4n0 has joined #openstack-keystone | 07:15 | |
| *** jistr has joined #openstack-keystone | 07:23 | |
| *** andreaf has quit IRC | 07:26 | |
| marekd | mhu: o/ Auth plugins almost there! | 07:29 |
| *** stevemar has quit IRC | 07:41 | |
| *** k4n0 has quit IRC | 07:42 | |
| *** gokrokve has joined #openstack-keystone | 07:43 | |
| *** gokrokve has quit IRC | 07:48 | |
| *** henrynash has joined #openstack-keystone | 07:54 | |
| *** k4n0 has joined #openstack-keystone | 07:55 | |
| *** sunrenjie6 has quit IRC | 08:04 | |
| *** swamireddy has quit IRC | 08:09 | |
| *** jistr has quit IRC | 08:12 | |
| *** swamireddy has joined #openstack-keystone | 08:12 | |
| mhu | marekd, yeah ! Imagine my surprise when I saw so much activity on gerrit ! :D | 08:13 |
| *** flwang1 has joined #openstack-keystone | 08:15 | |
| *** sunrenjie has joined #openstack-keystone | 08:16 | |
| *** marcoemorais1 has quit IRC | 08:22 | |
| *** nellysmitt has joined #openstack-keystone | 08:24 | |
| *** oomichi_ has quit IRC | 08:24 | |
| marekd | mhu: hehe | 08:25 |
| marekd | mhu: that's good because i still need to use some ksc wrappers to authenticate via saml | 08:25 |
| marekd | and now i won't | 08:26 |
| marekd | mappings and protocols are already in the openstackclient. | 08:26 |
| marekd | they got approved yesterday | 08:26 |
| mhu | marekd, I saw this too, that's great | 08:26 |
| marekd | yeah. | 08:26 |
| *** jistr has joined #openstack-keystone | 08:31 | |
| *** david-lyle has quit IRC | 08:35 | |
| *** Daviey has joined #openstack-keystone | 08:37 | |
| *** gokrokve has joined #openstack-keystone | 08:43 | |
| *** gokrokve has quit IRC | 08:48 | |
| *** mflobo_ has joined #openstack-keystone | 08:54 | |
| *** mflobo has quit IRC | 08:56 | |
| *** mflobo_ has quit IRC | 09:12 | |
| *** mflobo has joined #openstack-keystone | 09:13 | |
| *** sunrenjie has quit IRC | 09:29 | |
| *** gokrokve has joined #openstack-keystone | 09:43 | |
| *** gokrokve has quit IRC | 09:48 | |
| marekd | mhu: what's wrong with that patch? https://review.openstack.org/#/c/124101/ | 10:13 |
| mhu | marekd, I am looking into it right now | 10:14 |
| mhu | marekd, looks like gerrit's auto-rebase was a bit lost, I had to help it a bit :) looks fixed now, I'll update my copy after I check tox results locally | 10:20 |
| *** amakarov_away is now known as amakarov | 10:20 | |
| *** eglynn has joined #openstack-keystone | 10:30 | |
| eglynn | hey folks | 10:30 |
| eglynn | would anyone like to comment with some keystone perspective on the memcache auth discussion here https://review.openstack.org/127032 ? | 10:31 |
| eglynn | (given that keystone appears to choose to use memcache in a way that does't, IIUC, support SASL auth) | 10:32 |
| eglynn | ... SASL auth not being worth the candle is of course a valid answer | 10:32 |
| marekd | mhu: yeah, gerrit always tries to autorebase patches | 10:34 |
| marekd | mhu: sometimes needs some help | 10:34 |
| *** topol has joined #openstack-keystone | 10:36 | |
| *** aix_ has quit IRC | 10:38 | |
| *** gokrokve has joined #openstack-keystone | 10:43 | |
| *** gokrokve has quit IRC | 10:48 | |
| *** dimsum_ has joined #openstack-keystone | 10:51 | |
| *** eglynn is now known as eglynn-lunch | 10:58 | |
| *** aix_ has joined #openstack-keystone | 11:07 | |
| *** diegows has joined #openstack-keystone | 11:10 | |
| *** dimsum_ has quit IRC | 11:13 | |
| *** dimsum_ has joined #openstack-keystone | 11:13 | |
| *** dims_ has joined #openstack-keystone | 11:14 | |
| *** dimsum_ has quit IRC | 11:17 | |
| *** ajayaa has quit IRC | 11:38 | |
| *** eglynn-lunch is now known as eglynn | 11:42 | |
| *** gokrokve has joined #openstack-keystone | 11:43 | |
| *** hockeynut has quit IRC | 11:46 | |
| *** swamireddy has quit IRC | 11:46 | |
| *** gokrokve has quit IRC | 11:48 | |
| *** hockeynut has joined #openstack-keystone | 11:48 | |
| *** mgagne has quit IRC | 11:48 | |
| *** mgagne has joined #openstack-keystone | 11:51 | |
| *** mgagne is now known as Guest92054 | 11:51 | |
| *** ajayaa has joined #openstack-keystone | 11:52 | |
| *** aix_ has quit IRC | 11:59 | |
| *** afazekas has quit IRC | 12:04 | |
| *** ajayaa has quit IRC | 12:08 | |
| *** topol has quit IRC | 12:21 | |
| *** openstackgerrit has joined #openstack-keystone | 12:22 | |
| *** raildo has joined #openstack-keystone | 12:23 | |
| *** dims_ has quit IRC | 12:23 | |
| *** dimsum_ has joined #openstack-keystone | 12:24 | |
| *** gokrokve has joined #openstack-keystone | 12:38 | |
| mhu | marekd: I am good with switching "federated" for "federation", "federated" was mostly a placeholder until someone suggested something better :) | 12:38 |
| *** jaosorior has joined #openstack-keystone | 12:39 | |
| marekd | mhu: ok, that's good. | 12:43 |
| *** packet has joined #openstack-keystone | 12:43 | |
| marekd | mhu: thaks | 12:44 |
| marekd | thanks :-) | 12:44 |
| *** vsilva is now known as victsou | 12:48 | |
| *** victsou is now known as vsilva | 12:48 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 12:49 | |
| *** miqui has joined #openstack-keystone | 12:50 | |
| *** aix has joined #openstack-keystone | 12:50 | |
| *** radez_g0n3 is now known as radez | 12:52 | |
| *** saipandi has joined #openstack-keystone | 13:00 | |
| *** saipandi has quit IRC | 13:01 | |
| *** ajayaa has joined #openstack-keystone | 13:01 | |
| *** saipandi has joined #openstack-keystone | 13:05 | |
| *** alex_xu has quit IRC | 13:07 | |
| *** Sanchit has joined #openstack-keystone | 13:07 | |
| *** gordc has joined #openstack-keystone | 13:09 | |
| *** nkinder has quit IRC | 13:13 | |
| Sanchit | Hi, Regarding the ACL permissions on Container, Is it possible to specify a particular role in 'X-Container-Read' and then, all the users with that particular role can access the objects in the specified container? In general terms, is role-based ACL a feature in openstack-swift? | 13:14 |
| rodrigods | marekd, i'm trying to make a k2k fed experimental deployment here. right now I'm stuck at metadata exchange phase. stevemar told me that i'd a need a shibboleth in place for the keystone idp and them, i would exchange the metadata... | 13:14 |
| rodrigods | so, i'm kind lost in this step | 13:19 |
| rodrigods | =) | 13:19 |
| *** joesavak has joined #openstack-keystone | 13:23 | |
| *** thiagop has joined #openstack-keystone | 13:26 | |
| marekd | rodrigods: e.... | 13:28 |
| marekd | rodrigods: treat keystone as identity provider | 13:28 |
| marekd | rodrigods: or never mind...have you ever set up icehouse federation yourself? | 13:28 |
| marekd | (not k2k) | 13:28 |
| *** vhoward has joined #openstack-keystone | 13:29 | |
| rodrigods | marekd, not me, but some folks of my team did and I followed their tutorial to setup the SP part | 13:33 |
| *** portante has left #openstack-keystone | 13:33 | |
| rodrigods | marekd, but we used testshib as IdP | 13:33 |
| rodrigods | we didn't setup an IdP ourselves | 13:33 |
| marekd | rodrigods: ok, so you know how it looks like. So, one of the steps was to provide IdP's metadata (with some urls and what's the most important - its public X509 key) | 13:34 |
| marekd | so now you need to repeat that and simply treat keystone-idp as your IdP :-) | 13:34 |
| marekd | remember you now need two keystones. | 13:34 |
| marekd | one is keystone-sp and this is simply what we delivered in icehouse | 13:35 |
| rodrigods | marekd, yeah... and to setup the SP for the IdP keystone? | 13:35 |
| marekd | ok: for keystone-idp you only setup region. no need for shibboleth no tanything like that. | 13:36 |
| rodrigods | hmm, ok marekd | 13:36 |
| marekd | (well, ok you MUST turn on federation extension | 13:36 |
| marekd | ) | 13:36 |
| marekd | rodrigods: for keystone-sp you need to do it old way -> federation extension, shibboleth and stuff | 13:36 |
| marekd | rodrigods: one step is indeed skipped. | 13:37 |
| marekd | in kestone + testshib you had to generate SP's metadata and provide to testsshib, remember? | 13:37 |
| marekd | in k2k you skip it. | 13:37 |
| marekd | you only want keystone-sp to be able to check and verify signature of saml assertion issued by keystone-idp | 13:38 |
| marekd | rodrigods: can you guess why? | 13:38 |
| marekd | rodrigods: hint: at the keystone-idp side you will need to manually install pysaml2 | 13:39 |
| rodrigods | marekd, that was the exactly step i was stuck in | 13:39 |
| marekd | rodrigods: so skip it :-) | 13:39 |
| rodrigods | marekd, great | 13:39 |
| rodrigods | about the IdP metadata... the way it was setup in regular federation is via an URL to testshib | 13:40 |
| marekd | rodrigods: you have the same here. | 13:40 |
| marekd | rodrigods: w8 | 13:40 |
| marekd | rodrigods: (in fact you can configure your shibboleth to read it from local file and simply copy the file) | 13:41 |
| marekd | rodrigods: there was a bug regardign that and fix was released, however not sure if it is already merged due to relase/candidates policy and timing. | 13:41 |
| *** dtantsur has joined #openstack-keystone | 13:42 | |
| morganfainberg | marekd, rc2 is cut / should be | 13:42 |
| marekd | morganfainberg: ok | 13:42 |
| rodrigods | marekd, hmm | 13:42 |
| morganfainberg | i think i saw a mail from ttx on that front | 13:42 |
| rodrigods | marekd, thanks a lot! | 13:43 |
| marekd | morganfainberg: about rc2? | 13:43 |
| morganfainberg | yeah | 13:43 |
| marekd | morganfainberg: yeah, saw it too | 13:43 |
| marekd | morganfainberg: actually his tweet | 13:43 |
| morganfainberg | ah | 13:43 |
| marekd | rodrigods: you are welcome. | 13:43 |
| morganfainberg | that was it | 13:43 |
| dtantsur | Hi folks! I'm writing a Python service (Flask-based) and I need to authenticate users via keystone token. I also need to check for admin role. What's the easiest way to achieve it? I found GET /token/<ID> endpoint but it does not seem exposed in the client. | 13:44 |
| *** afazekas has joined #openstack-keystone | 13:45 | |
| marekd | dtantsur: maybe import keystoneclient and try to use it internally? | 13:45 |
| openstackgerrit | Kui Shi proposed a change to openstack/keystone: Add memcached_backend configuration https://review.openstack.org/122037 | 13:45 |
| marekd | dtantsur: otherwise you will simply need to build your http calls yourself. | 13:46 |
| *** topol has joined #openstack-keystone | 13:51 | |
| *** Kui has quit IRC | 13:51 | |
| marekd | dolphm: in pasteraw source coude - why are you converting redis keys from sha1 hexdigest to base36? | 13:53 |
| marekd | https://github.com/dolph/pasteraw/blob/master/pasteraw/backend.py#L19 | 13:53 |
| dtantsur | marekd, you mean access GET /token/<ID> using keystoneclient as a basic? yeah I though about it, just wanted to make sure it's the best solution. | 13:53 |
| dolphm | marekd: to produce shorter URLs | 13:53 |
| dolphm | marekd: there's probably a faster way to do that, if you can get an integer out of hashlib.sha1 | 13:54 |
| dolphm | but i don't see an integer digest in the docs, so nevermind | 13:55 |
| *** gokrokve has quit IRC | 13:56 | |
| marekd | dolphm: ah, shorter representation os sha1.hexdigest? | 13:57 |
| marekd | dtantsur: i meant: use client libraries if you can :-) | 13:58 |
| marekd | dtantsur: keystoneclient, novaclient, *client | 13:58 |
| dtantsur | marekd, right, I'm going to use keystoneclient, my question remains the same: how to check a token and get admin role. My experiment up to now were a bit confusing | 13:59 |
| *** nkinder has joined #openstack-keystone | 14:03 | |
| *** gokrokve has joined #openstack-keystone | 14:09 | |
| tellesnobrega | ayoung, i'm trying to see how the keystoneclient is notified when an idp is deleted. I have a federated setup running. What i want to do is to make sure that the client has the information that the idp was deleted, so we can progress solving the token problem | 14:19 |
| ayoung | client? | 14:19 |
| tellesnobrega | middleware | 14:22 |
| tellesnobrega | sorry | 14:22 |
| *** ajayaa has quit IRC | 14:24 | |
| *** bknudson has joined #openstack-keystone | 14:26 | |
| ayoung | tellesnobrega, at the middleware layer, all you get is a list of token ids. Or are you talking about revocation events? Cuz with revocation events, we got a long way to go before those are consumed, and I don't think we should start with the IdP issue, but rather getting the existing code to the client | 14:27 |
| *** ajayaa has joined #openstack-keystone | 14:27 | |
| ayoung | there are no notifications from keystone server to the middleware layers | 14:27 |
| tellesnobrega | hmm | 14:27 |
| ayoung | tellesnobrega, please take some time to read up on how the existing token stuff works. THe problem is that I have three different people asking me about this, and I have no idea who knows what, so it is hard to field the questions | 14:28 |
| ayoung | but there is so much churn here due to revocation evetns being in a halfway state, I don't fault you guys | 14:29 |
| tellesnobrega | i understand | 14:29 |
| tellesnobrega | not how token stuff works lol. what you men | 14:29 |
| tellesnobrega | mean | 14:29 |
| ayoung | yeah...and switch the default from pki back to uuid just complicates matters | 14:30 |
| ayoung | and the fact that I am trying to work on something over in Horizon.... | 14:30 |
| ayoung | nkinder, speaking of horizon...let me know when you have second to talk AUTH_URLs for Kerberos | 14:31 |
| *** richm has joined #openstack-keystone | 14:32 | |
| *** stevemar has joined #openstack-keystone | 14:32 | |
| nkinder | ayoung: sure | 14:32 |
| nkinder | ayoung: you mean the Location set up in the httpd config? | 14:33 |
| ayoung | nkinder, so, I got myself a bit confused. When I realize that I had broken the "switch project" part in the auth_lugins patch for DOA | 14:33 |
| ayoung | I fixed that, and started rebasing the Kerberos one, and maybe I went too far. Before I undo the work, I want to get it clear. | 14:33 |
| ayoung | here's the deal | 14:33 |
| ayoung | I'm working on the assumption that AUTH_URL is not the endpoint in the catalog | 14:34 |
| ayoung | this is epcific to Kerberos, sine mod_auth_kerb does not allow you to pass if you don';t authenticate | 14:34 |
| ayoung | my thinking is that a user going via Horizon has access to kerberos, so S4U2Proxy makes sense, but the service catalog does not mean that all consumers have access to Kerberos | 14:35 |
| ayoung | so... | 14:35 |
| nkinder | ayoung: ok, so Horizon would be configured to use the kerberized AUTH_URL, and OSC could as well | 14:36 |
| ayoung | horizon we would only use Kerberos/S4U2 to get a token the first time, but then the Keystone client is going to use the endpoint in the Serice catalog for additional work | 14:36 |
| nkinder | ayoung: but the catalog would have the regular old AUTH_URL | 14:36 |
| ayoung | yeah | 14:36 |
| *** charz has quit IRC | 14:37 | |
| ayoung | nkinder, its a mess...this whole Kerberos-not-evenly-available really makes it sloppy | 14:37 |
| nkinder | ayoung: the same would apply for federation though. We need to support multiple auth methods that have different URLs | 14:38 |
| ayoung | I wish it were either yes, use kerberos for OpenStack and its everywhere or else a clean way to work around it | 14:38 |
| boris-42 | bknudson hi there | 14:38 |
| nkinder | ayoung: that's just not going to be there from the start. If we can kerberize service users by giving them keytabs, that would be possible though | 14:38 |
| bknudson | boris-42: hi | 14:39 |
| *** charz has joined #openstack-keystone | 14:39 | |
| boris-42 | bknudson we already have a bunch of benchmarks for checking authentication | 14:39 |
| boris-42 | bknudson https://review.openstack.org/#/c/98836/5 | 14:39 |
| boris-42 | bknudson if you wish I can change https://review.openstack.org/#/c/98836/5/rally-scenarios/keystone.yaml | 14:39 |
| boris-42 | bknudson to add them | 14:39 |
| bknudson | boris-42: y, I'm fine with the change as is other than the link doesn't work. | 14:40 |
| boris-42 | bknudson hmmm | 14:40 |
| boris-42 | bknudson are you sure?? | 14:40 |
| boris-42 | bknudson https://wiki.openstack.org/wiki/Rally | 14:40 |
| nkinder | ayoung: so, what happens by leaving the endpoint in the catalog as the non-Kerberized URL? | 14:40 |
| ayoung | nkinder, I had written a basic-auth approach to getting keystone tokens that would, I think, work with mod_auth_kerb falling back to basic-auth: | 14:41 |
| bknudson | boris-42: ok.. I must have copy-pasted it incorrectly | 14:41 |
| ayoung | nkinder, OK, so our working approach is that the AUTH_URL != endpoint and we only use it to get the initial token. | 14:41 |
| boris-42 | bknudson ya there is RST formatting | 14:41 |
| ayoung | nkinder, it means that the client code needs to know to not use the kerberos plugin when doing the switc | 14:41 |
| ayoung | I'll link | 14:41 |
| boris-42 | bknudson lemme update a patch a bit okay? | 14:41 |
| boris-42 | bknudson there is some new functionality in rally =) | 14:41 |
| *** k4n0 has quit IRC | 14:42 | |
| bknudson | the browser added / to the URL for some reason | 14:42 |
| bknudson | boris-42: please, update it | 14:42 |
| ayoung | nkinder, https://review.openstack.org/#/c/115463/5/openstack_auth/views.py,cm switch needs to get an "unscoped plugin" | 14:42 |
| ayoung | I made the mistake last night of making that a Kerberos plugin if the server is kerberized | 14:43 |
| ayoung | https://review.openstack.org/#/c/115463/5/openstack_auth/utils.py,cm see get_scoped_plugin | 14:43 |
| nkinder | ayoung: ah, so we don't get (and keep) an unscoped token in the session? | 14:43 |
| ayoung | nkinder, we keep it, but it is not really used | 14:44 |
| nkinder | ...by session, I mean the session on the horizon side | 14:44 |
| ayoung | that is a wider issue, one I want to discuss with jamielennox when he's back | 14:44 |
| bknudson | dstanek: why is this -2? https://review.openstack.org/#/c/112573/7 | 14:44 |
| nkinder | ayoung: so if we initially used kerberos to get an unscoped token and kept it, we could reuse it to get project-scoped tokens | 14:44 |
| ayoung | the reason I kerberized it is how the initial authentication works | 14:44 |
| ayoung | it kindof blurs authenticate and switch functionality... | 14:44 |
| ayoung | https://review.openstack.org/#/c/115463/5/openstack_auth/backend.py,cm calls the same get_unscoped_token function, but it knows the auth_url and passes it in. | 14:45 |
| nkinder | ayoung: so the switch functionality is going to use the endpoint from the current token, not the configured AUTH_URL? | 14:45 |
| ayoung | I think that I should make only the "get_unscoped_plugin" be kerberos aware | 14:45 |
| ayoung | corect | 14:45 |
| ayoung | correct | 14:45 |
| nkinder | and should it be that way? | 14:45 |
| ayoung | yeah | 14:46 |
| ayoung | it has to, as it makes multiple calls to keystone | 14:46 |
| ayoung | there are other places that also call keystone, if you have an admin token, to do things like create users | 14:46 |
| nkinder | but couldn't it make a call to the configured AUTH_URL any time it attempts to get an unscoped token? | 14:46 |
| ayoung | those all are going to work with the non-spnego url | 14:47 |
| ayoung | the only thing that needs to handle an unscoped token is the initial login | 14:47 |
| ayoung | and rmemeber, that behavior is set up by DJango | 14:47 |
| ayoung | we could probably hack around it, so that if you are kerberized you never get logged out, but it is a larger patch | 14:48 |
| ayoung | and probably needs changes in Horizon | 14:48 |
| ayoung | this is just the "click to login" approach | 14:48 |
| dstanek | bknudson: i'd have to check to see if the newer patches still have the same coverage problem | 14:48 |
| dstanek | bknudson: but also i think this is the exact reverse of what we should be doing | 14:48 |
| dstanek | bknudson: the "list" assertions should not now about the entity's attributes, the entity assertions should | 14:49 |
| *** NM has joined #openstack-keystone | 14:51 | |
| dstanek | bknudson: i have a patch where i removed keys to check almost entirely - i'll get it mergable for an example | 14:51 |
| *** gokrokve has quit IRC | 14:52 | |
| bknudson | dstanek: that sounds like a good refactoring ... pick one or the other. | 14:53 |
| nkinder | ayoung: so what happens today when you switch projects? It re-authenticates using the password that it kept? | 14:54 |
| ayoung | no...today it stores the endpoint in the request...in the "region" variable | 14:54 |
| ayoung | I'm going to maintain that | 14:54 |
| ayoung | and, in fact, I think I'm going to redo the auth_plugins patch to honor that even for listing the projects | 14:55 |
| ayoung | althouhg...crud, it might not be stored there yet | 14:55 |
| *** mewald has joined #openstack-keystone | 14:55 | |
| *** jorge_munoz has joined #openstack-keystone | 14:55 | |
| ayoung | so by "listing the proejcts" I mean during the initial authenticate | 14:55 |
| ayoung | authenticate has to end up with a project scoped token | 14:55 |
| nkinder | ayoung: ok, so it gets unscoped, then uses that to list projects | 14:56 |
| nkinder | ayoung: right? | 14:56 |
| mewald | question about the Endpoint Policy extension: Isn't the whole problem just there because of the attempt to centralize Policies in Keystone? I mean without using the Policy API, we could already implement different policies per endpoint, couldn't we? | 14:56 |
| ayoung | nkinder, yes. And you are now smart enough to review https://review.openstack.org/#/c/121281/6/openstack_auth/backend.py,cm | 14:56 |
| nkinder | ayoung: then it has to get a project-scoped token. How does it authenticate to get this scoped token? | 14:57 |
| nkinder | ayoung: using a password, or the unscoped token? | 14:57 |
| ayoung | nkinder, the unscoped | 14:57 |
| ayoung | seee line 140 of the old code | 14:57 |
| ayoung | I kept that semantics in the new | 14:57 |
| ayoung | nkinder, so, what I wanted to do was to have a "rescope" method on the client. If it is unscoped, add a project id and get a new token scoped to that project | 14:59 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Log token with sha1 https://review.openstack.org/123819 | 15:01 |
| *** mewald has quit IRC | 15:01 | |
| *** jistr has quit IRC | 15:08 | |
| ayoung | nkinder, OK, so DOA does store the "unscoped token" in the request. The switch code can make use of that. | 15:15 |
| *** thedodd has joined #openstack-keystone | 15:15 | |
| mhu | stevemar, thanks ! | 15:17 |
| stevemar | mhu, np | 15:19 |
| stevemar | mhu, thanks for the code :) | 15:19 |
| nkinder | ayoung: yeah, that would be ideal | 15:21 |
| ayoung | nkinder, I think I have a change to the auth_plugins patch that makes sense, and will support unscoped->scoped only | 15:21 |
| ayoung | testing now | 15:22 |
| *** lnxnut has joined #openstack-keystone | 15:31 | |
| *** zzzeek has joined #openstack-keystone | 15:34 | |
| *** cjellick has joined #openstack-keystone | 15:34 | |
| *** dtantsur is now known as dtantsur|afk | 15:37 | |
| *** _cjones_ has joined #openstack-keystone | 15:38 | |
| ayoung | nkinder, hmmm, the unscoped_token_id saved to the session does not seem to be there when I switch projects. Like most thinkgs in DOA, this is going to take longer than I initially thought. I might do it as a second patch on top of the auth_plugins patch. | 15:40 |
| ayoung | nkinder, aaaaaaand the is because of how DOA expects token<->user to work...there are a bunch of factory type things that assume a user has one token, can be created from a token, etc | 15:42 |
| ayoung | beyond the scope of the Kerberos patch, I think | 15:42 |
| morganfainberg | mornin | 15:48 |
| *** lufix has quit IRC | 15:54 | |
| *** lhcheng has joined #openstack-keystone | 16:00 | |
| *** Guest92054 is now known as mgagne | 16:03 | |
| *** mgagne is now known as mgagne_ | 16:03 | |
| *** mgagne_ is now known as Guest31178 | 16:04 | |
| *** Guest31178 has quit IRC | 16:05 | |
| *** Guest31178 has joined #openstack-keystone | 16:05 | |
| ayoung | guten morganfainberg, | 16:06 |
| *** Guest31178 is now known as mgagne | 16:07 | |
| *** lhcheng has quit IRC | 16:08 | |
| *** lhcheng has joined #openstack-keystone | 16:09 | |
| dimsum_ | morganfainberg: folks: the oslo-incubator's crypto/utils.py seems to be used by kite, python-kiteclient and heat, so do we turn it into a oslo library? or does it go somewhere else? | 16:12 |
| dimsum_ | https://review.openstack.org/#/c/125779/ | 16:12 |
| morganfainberg | dimsum_ it could become part of kite if *nothing* else uses it | 16:12 |
| dimsum_ | heat too... | 16:13 |
| morganfainberg | dimsum_, or we could graduate it to an oslo lib if it is legitimately useful | 16:13 |
| morganfainberg | if heat is using it i say it should move to a lib | 16:13 |
| *** lhcheng has quit IRC | 16:13 | |
| morganfainberg | ayoung, i see what you did thar | 16:14 |
| dimsum_ | morganfainberg: another thing related that popped out was that we probably lost securemessage.py in oslo.messaging in the transition | 16:15 |
| dimsum_ | morganfainberg: ack | 16:17 |
| *** thedodd has quit IRC | 16:20 | |
| *** thedodd has joined #openstack-keystone | 16:23 | |
| morganfainberg | dimsum_, hm. | 16:25 |
| morganfainberg | dimsum_, good to know | 16:25 |
| *** david-lyle has joined #openstack-keystone | 16:26 | |
| *** _cjones_ has quit IRC | 16:28 | |
| *** _cjones_ has joined #openstack-keystone | 16:28 | |
| *** swamireddy has joined #openstack-keystone | 16:32 | |
| stevemar | nkinder, more for you at: https://review.openstack.org/#/c/126475/ :P | 16:32 |
| nkinder | stevemar: yep! Reviewing now | 16:32 |
| *** _cjones_ has quit IRC | 16:33 | |
| *** _cjones_ has joined #openstack-keystone | 16:42 | |
| nkinder | stevemar: could you expand on your comment here? https://review.openstack.org/#/c/126754/6/openstackclient/identity/v3/project.py | 16:43 |
| nkinder | stevemar: are you saying we should move away from using find_domain in a future patch? | 16:44 |
| stevemar | nkinder, nah, we should stick to find_domain() | 16:44 |
| nkinder | stevemar: the code was already using find_domain, so I didn't change that | 16:44 |
| stevemar | https://review.openstack.org/#/c/126754/6/openstackclient/identity/v3/group.py line 312 | 16:44 |
| nkinder | stevemar: ah, I see. The project code differs from the group code | 16:46 |
| stevemar | nkinder, actually if you read the function find_domain it already does all that for us :( | 16:46 |
| stevemar | https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/common.py#L42 | 16:46 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 16:46 |
| nkinder | stevemar: ah, so it does | 16:47 |
| stevemar | nkinder, i completely forgot about that function, and we both made the changes in a lot of spots | 16:48 |
| nkinder | stevemar: let me revise my patch... | 16:48 |
| *** _cjones_ has quit IRC | 16:56 | |
| *** marcoemorais has joined #openstack-keystone | 16:56 | |
| *** _cjones_ has joined #openstack-keystone | 16:56 | |
| *** eglynn has quit IRC | 16:57 | |
| *** wwriverrat has joined #openstack-keystone | 17:00 | |
| *** wwriverrat1 has joined #openstack-keystone | 17:00 | |
| *** _cjones_ has quit IRC | 17:01 | |
| *** hyakuhei has quit IRC | 17:01 | |
| *** marcoemorais has quit IRC | 17:01 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:01 | |
| *** gyee has quit IRC | 17:01 | |
| *** marcoemorais has joined #openstack-keystone | 17:02 | |
| *** marcoemorais has quit IRC | 17:02 | |
| *** marcoemorais has joined #openstack-keystone | 17:02 | |
| *** wwriverrat1 has left #openstack-keystone | 17:02 | |
| *** wwriverrat has quit IRC | 17:04 | |
| *** andreaf has joined #openstack-keystone | 17:05 | |
| *** marcoemorais has quit IRC | 17:06 | |
| *** marcoemorais has joined #openstack-keystone | 17:06 | |
| *** _cjones_ has joined #openstack-keystone | 17:15 | |
| *** gyee has joined #openstack-keystone | 17:15 | |
| *** swamireddy1 has joined #openstack-keystone | 17:16 | |
| gyee | ayoung, ping | 17:17 |
| *** swamireddy has quit IRC | 17:17 | |
| *** harlowja_away is now known as harlowja | 17:19 | |
| *** lufix has joined #openstack-keystone | 17:20 | |
| *** edmondsw has joined #openstack-keystone | 17:22 | |
| amakarov | nkinder, ayoung, good day to all! Please review a fix https://review.openstack.org/#/c/125923/ | 17:24 |
| amakarov | There is 1 line ) | 17:25 |
| ayoung | gyee, pong | 17:28 |
| *** arunkant_work has joined #openstack-keystone | 17:29 | |
| *** amakarov is now known as amakarov_away | 17:31 | |
| *** marcoemorais has quit IRC | 17:32 | |
| *** marcoemorais has joined #openstack-keystone | 17:33 | |
| *** marcoemorais has quit IRC | 17:33 | |
| *** marcoemorais has joined #openstack-keystone | 17:33 | |
| *** marcoemorais has quit IRC | 17:33 | |
| *** lhcheng has joined #openstack-keystone | 17:34 | |
| *** marcoemorais has joined #openstack-keystone | 17:35 | |
| gyee | ayoung, sorry I was talking to morganfainberg, I didn't understand your multi signer email, but morgan straighten me out | 17:42 |
| ayoung | cool | 17:42 |
| ayoung | gyee, you are one of the primary people I need to get on board | 17:42 |
| morganfainberg | ayoung, sometimes being able to throw something at people the next desk over helps | 17:42 |
| gyee | haha | 17:42 |
| ayoung | just throwing people helps | 17:42 |
| ayoung | just remember to lift with your legs, not your back | 17:42 |
| morganfainberg | oh sure, but you have to be careful when you're a few stories up... | 17:43 |
| *** jaosorior has quit IRC | 17:43 | |
| gyee | morganfainberg is literally 5 feet from me | 17:43 |
| *** samuelmz has quit IRC | 17:43 | |
| *** marcoemorais has quit IRC | 17:45 | |
| ayoung | gyee, morganfainberg so do you guys get the concern? | 17:45 |
| *** marcoemorais has joined #openstack-keystone | 17:45 | |
| gyee | ayoung, yeah | 17:46 |
| ayoung | gyee, where is the state of X509 Plugin spec? | 17:47 |
| ayoung | Are you doing it all with the Federated plugin, and don;t need any new code? | 17:47 |
| gyee | ayoung, the spec is in review | 17:47 |
| gyee | yeah, I am going to use the mapping plugin | 17:48 |
| gyee | I haven't get a chance to push the code yet | 17:48 |
| ayoung | gyee, OK, so lets assume that gets through | 17:49 |
| *** lhcheng has quit IRC | 17:49 | |
| ayoung | here is what I would think we would need next | 17:49 |
| gyee | ayoung, you can extract signer info from CMS | 17:49 |
| ayoung | gyee, well, you could if I hadn;t put a bug in there | 17:49 |
| gyee | but I don't know if there's apache module that does CMS extraction | 17:49 |
| *** lhcheng has joined #openstack-keystone | 17:49 | |
| *** edmondsw has quit IRC | 17:49 | |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/common/cms.py#n146 and | 17:50 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/common/cms.py#n333 | 17:50 |
| gyee | ayoung, so you are not using apache frontend to validate the cms? | 17:50 |
| ayoung | both ignore the params passed in, making the tokens Base64 PEM instead of DER...which we could parse. | 17:50 |
| *** marcoemorais1 has joined #openstack-keystone | 17:50 | |
| ayoung | nah, I mean that in the PKIZ tokens I was supposed to be SIGNING binary | 17:51 |
| gyee | works fine either way, I suppose you can just add auth_token middleware to Keystone | 17:51 |
| ayoung | then compressing | 17:51 |
| gyee | and have it parse CMS and feed it into the mapping layer | 17:51 |
| ayoung | just means that if we uncompress, we will get Base64 encoded CMS, and we need to unbase64 before we parse, but I digress | 17:51 |
| ayoung | so, yeah, we can get the signing data out of the CMS document | 17:52 |
| *** marcoemorais has quit IRC | 17:52 | |
| ayoung | ok, lets assume a token comes in and it has signing info that this auth_token middleware has never seen | 17:52 |
| ayoung | so it needs to do 3 steps | 17:52 |
| ayoung | 1. fetch the certificate based on that signing info | 17:53 |
| *** amcrn has joined #openstack-keystone | 17:53 | |
| *** swamireddy1 has quit IRC | 17:53 | |
| ayoung | 2. From the certificate, fetch the user | 17:53 |
| ayoung | 3. from the user, fetch the "athority to sign" | 17:53 |
| ayoung | authority | 17:53 |
| ayoung | authority to sign is tricky...it probably should be RBAC | 17:53 |
| *** lufix has quit IRC | 17:53 | |
| *** aix has quit IRC | 17:53 | |
| *** lhcheng has quit IRC | 17:54 | |
| ayoung | so in order for user U to sign tokens for projects in domain D then need the role "DomainSigner" for D | 17:54 |
| ayoung | but we probably don't want to hard code that | 17:55 |
| ayoung | so... | 17:55 |
| ayoung | 3 probably is: | 17:55 |
| ayoung | fetch roles for user on domain D | 17:55 |
| ayoung | and compare with policy | 17:55 |
| ayoung | which means fetching policy on demand | 17:55 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 17:55 | |
| ayoung | gyee, but step 2 ( From the certificate, fetch the user) is pretty much the same mapping rule that you are going to use for the auth plugin | 17:56 |
| ayoung | clear as mud? | 17:57 |
| *** lnxnut has quit IRC | 18:00 | |
| gyee | ayoung, no | 18:00 |
| gyee | I let apache mod_ssl do the dirty work for me | 18:01 |
| ayoung | gyee, sure | 18:01 |
| ayoung | you end up with an env var for the subject, say | 18:01 |
| gyee | right | 18:01 |
| ayoung | gyee, http://www.freeipa.org/page/Environment_Variables#X.509_Authentication | 18:02 |
| ayoung | very useful page | 18:02 |
| *** marcoemorais1 has quit IRC | 18:02 | |
| *** amcrn has quit IRC | 18:02 | |
| gyee | nkinder, morganfainberg, http://tiedhouse.com/dinner-menu, say 6pm? | 18:02 |
| ayoung | SSL_CLIENT_S_DN | 18:02 |
| *** marcoemorais has joined #openstack-keystone | 18:03 | |
| gyee | ayoung, yes, that's what I am using | 18:03 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Extract Assignment tests from IdentityTestCase https://review.openstack.org/121653 | 18:03 |
| morganfainberg | gyee, nkinder, works for me | 18:03 |
| ayoung | gyee, OK, so in the case of validating a token...I can parse the certificate used to sign the token to get that variable | 18:03 |
| ayoung | remember, this is not SSL | 18:04 |
| ayoung | so apache can't handle it for us | 18:04 |
| gyee | ayoung, so you can essentially do this in middleware, same as auth_token | 18:04 |
| *** marcoemorais has quit IRC | 18:04 | |
| gyee | validate CMS and set the env vars | 18:04 |
| *** marcoemorais has joined #openstack-keystone | 18:04 | |
| ayoung | gyee, yep | 18:05 |
| ayoung | exactly | 18:05 |
| gyee | then ingressing the mapping like all other plugin | 18:05 |
| gyee | so we have a consistent pattern | 18:05 |
| ayoung | but this is in, say Nova, not in keystone server, so I need to be able to remotely evaluate the mapping | 18:05 |
| gyee | ayoung, sure, come to think of it, we have per-endpoint policy now, we can think along this line | 18:06 |
| ayoung | yep | 18:06 |
| ayoung | gyee, caching in general is going to be an issue. But again, a digression | 18:07 |
| ayoung | gyee, are you guys right next to Moffit Field? | 18:08 |
| ayoung | Moffet | 18:08 |
| gyee | ayoung, yeah, we can see the jumbo jets parking in NASA | 18:08 |
| *** andreaf has quit IRC | 18:08 | |
| ayoung | If that was not such a pain to get to from SF, I might still be in the Army | 18:08 |
| ayoung | I was 5 years off active service, and overdue for a physical | 18:08 |
| ayoung | they said I had to get to Moffet for sick call...like 5 AM. | 18:09 |
| gyee | dude, can you handle 50 push ups?! | 18:09 |
| gyee | 5 miles in 30 flat | 18:09 |
| ayoung | In a fit of pique, I just flipped the paper over and signed in the "Or sign here to resign..." | 18:09 |
| ayoung | My 2 mile time is now measured with a calendar | 18:09 |
| ayoung | if I hadn't, I probably would have gotten stop-lossed and ended up getting called up for Iraq. | 18:10 |
| ayoung | this was 2001.... | 18:10 |
| gyee | I live 2 miles from a army training facility, still hear canons going off in the middle of the night | 18:10 |
| ayoung | Dublin? | 18:11 |
| gyee | yeah | 18:11 |
| ayoung | I used to drill there | 18:12 |
| gyee | Camp Park | 18:12 |
| ayoung | yeah. They have a rifle range, and a good amount of space for maneuver training. What you probably hear is grenade simulators | 18:14 |
| ayoung | gyee, so the APIs we would need: a GET certificate that uses the signer data | 18:16 |
| *** amerine_ has joined #openstack-keystone | 18:17 | |
| ayoung | ...I guess we could use the mapping from federaion | 18:17 |
| ayoung | and then we'd have to evaluate it in client | 18:17 |
| ayoung | and get policy | 18:18 |
| *** amerine has quit IRC | 18:18 | |
| ayoung | ah...no | 18:18 |
| ayoung | just evaluating the mapping is not enough | 18:18 |
| ayoung | that gives the groups, but we'd need something like a token | 18:18 |
| ayoung | gyee, what if we did something like POST /auth/tokens?fake | 18:19 |
| ayoung | and then you get back a token that would never validate? | 18:19 |
| *** amcrn has joined #openstack-keystone | 18:20 | |
| ayoung | but that had all of the users data on it? Or...with constrainsts, we could do endpoints[] meaning, yeah, its a real token, but no one should accept it | 18:20 |
| gyee | ayoung, yes, right now mapping can handle user_id and group | 18:20 |
| gyee | we need to make it more generic | 18:20 |
| gyee | for the x.509 stuff, I am fine with mapping to groups | 18:21 |
| *** marcoemorais has quit IRC | 18:22 | |
| gyee | groups are permission templates so they are good enough for most use cases | 18:22 |
| ayoung | gyee, right, I just don't want to reimplement the token pipeline in the client | 18:24 |
| ayoung | so I need to be able to take a user and a domain and say "what roles would this user have in this domain" | 18:25 |
| ayoung | and then evalutate against the policy file | 18:25 |
| gyee | ayoung, sorry, need to run, be back in an hour, lets do some brainstorming later | 18:28 |
| ayoung | I'm good. Got it all solved | 18:29 |
| *** amerine_ is now known as amerine | 18:30 | |
| nkinder | gyee: works for me too | 18:31 |
| stevemar | nkinder, OK, *now* this is rebased and everything should be super awesome | 18:40 |
| stevemar | https://review.openstack.org/#/c/126754/ | 18:40 |
| stevemar | all of your domain-ness should be fixed :) | 18:40 |
| *** NM is now known as INFO | 18:42 | |
| lbragstad | bknudson: I think the Location stuff got refactored out the of identity-api spec https://bugs.launchpad.net/keystone/+bug/1182681 | 18:46 |
| uvirtbot | Launchpad bug 1182681 in keystone "v3 doesn't return Location header on 201 Created" [Low,Confirmed] | 18:46 |
| *** INFO is now known as NM | 18:47 | |
| *** andreaf has joined #openstack-keystone | 18:47 | |
| lbragstad | bknudson: looks like it was removed here: https://github.com/openstack/identity-api/commit/a59d354947d4771d4614dbfd89ad45bf63289e45 | 18:49 |
| *** marcoemorais has joined #openstack-keystone | 18:50 | |
| bknudson | lbragstad: the HTTP spec says that the Location header must be returned on a 201 Created | 19:02 |
| bknudson | lbragstad: so if the server isn't returning a Location header then it doesn't conform. | 19:03 |
| *** flwang1 has quit IRC | 19:03 | |
| lbragstad | bknudson: right, I looked for that in the spec but couldn't find what it's suppose to do | 19:05 |
| lbragstad | because it was pulled out | 19:05 |
| bknudson | lbragstad: the spec might have said that location was returned when the server wasn't returning it. | 19:05 |
| *** flwang1 has joined #openstack-keystone | 19:14 | |
| bknudson | Not sure what corosync is but apparently it doesn't work very well. | 19:14 |
| *** lhcheng has joined #openstack-keystone | 19:15 | |
| *** radez is now known as radez_g0n3 | 19:26 | |
| *** afazekas has quit IRC | 19:28 | |
| *** eglynn has joined #openstack-keystone | 19:28 | |
| *** flwang1 has quit IRC | 19:31 | |
| *** marcoemorais has quit IRC | 19:33 | |
| *** marcoemorais1 has joined #openstack-keystone | 19:33 | |
| *** _cjones_ has quit IRC | 19:39 | |
| *** _cjones_ has joined #openstack-keystone | 19:39 | |
| *** _cjones_ has quit IRC | 19:44 | |
| *** ajayaa has quit IRC | 19:45 | |
| *** david-lyle is now known as david-lyle_afk | 19:47 | |
| dstanek | are we not going to remove the catalog kvs backend? | 19:47 |
| *** dimsum_ has quit IRC | 19:48 | |
| *** lhcheng has quit IRC | 19:48 | |
| *** lhcheng has joined #openstack-keystone | 19:48 | |
| lbragstad | bknudson: looks like dolphm removed the Location stuff from the identity-api spec | 19:49 |
| *** topol has quit IRC | 19:52 | |
| *** lhcheng has quit IRC | 19:53 | |
| *** dvorak has quit IRC | 20:02 | |
| *** Kui has joined #openstack-keystone | 20:05 | |
| *** flwang1 has joined #openstack-keystone | 20:05 | |
| *** fifieldt has quit IRC | 20:08 | |
| ayoung | why does argparse hate me? | 20:10 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 20:10 | |
| ayoung | dstanek, wtf am I doing wrong with arg parse: | 20:11 |
| dstanek | ? | 20:12 |
| ayoung | http://fpaste.org/140757/12885533/ | 20:12 |
| ayoung | if I run | 20:12 |
| ayoung | $ python freeipa.py --list | 20:12 |
| ayoung | Usage: freeipa.py [global-options] COMMAND [command-options] | 20:12 |
| ayoung | freeipa.py: error: no such option: --list | 20:12 |
| ayoung | but | 20:12 |
| ayoung | $ python freeipa.py -h | 20:12 |
| ayoung | usage: freeipa.py [-h] [--list] [--host HOST] | 20:12 |
| ayoung | I really just want to ignore the --list to start | 20:13 |
| ayoung | later I'll do something with it | 20:13 |
| dstanek | that's odd - it looks ok | 20:14 |
| *** vhoward has left #openstack-keystone | 20:14 | |
| lbragstad | if --list is a flag should if default if not provided? | 20:15 |
| ayoung | lbragstad, it is | 20:15 |
| dstanek | ayoung: your code works fine for me | 20:15 |
| ayoung | what? | 20:15 |
| dstanek | you probably don't want to default --list to True because if you do there would be no reason to specify --list | 20:16 |
| ayoung | maybe it is the name freeipa conflictin with something? | 20:16 |
| dstanek | ayoung: i deleted the freeipa import because i don't have that, but otherwise it works | 20:16 |
| ayoung | dstanek, I'm betting the freeipa library is running argparse | 20:17 |
| ayoung | mother.... | 20:17 |
| dstanek | ayoung: what do i pip install to get ipalib? | 20:17 |
| lbragstad | but wouldn't that be under a different parser object? | 20:17 |
| ayoung | dstanek, heh, you don't | 20:17 |
| *** dvorak has joined #openstack-keystone | 20:17 | |
| ayoung | i guess python-freeipa? | 20:17 |
| ayoung | lbragstad, yeah, but the second parser is still trying to parse me CLI args | 20:18 |
| dstanek | ayoung: the strange thing is that your help is different | 20:18 |
| ayoung | maybe because context=cli...? | 20:18 |
| ayoung | dstanek, yeah...think that is the freeipa cli parsing coming in...let me see if there is a different context I should set | 20:19 |
| dstanek | ayoung: ah, that would do it | 20:19 |
| dstanek | ayoung: that would be really stupid if it parsed args on import | 20:20 |
| *** fifieldt has joined #openstack-keystone | 20:21 | |
| ayoung | dstanek, this code was written primarily to keep things common between the server and a CLI | 20:24 |
| ayoung | I don't know if people have attempted to use it as a programmatic API on a regular basis | 20:24 |
| ayoung | dstanek, the problem is that I need to specify conetxt ='cli' to turn off debugging ,and I don't think there is a way around that. | 20:25 |
| *** lhcheng has joined #openstack-keystone | 20:26 | |
| ayoung | nope, it isn't the context... | 20:26 |
| ayoung | dstanek, thanks. it was running optparse. I had just followed the example, which called a function that triggered that, but I can change | 20:33 |
| ayoung | #api.bootstrap_with_global_options(context='cli') | 20:34 |
| ayoung | api.bootstrap(context='cli') | 20:34 |
| ayoung | and it works | 20:34 |
| *** cds has joined #openstack-keystone | 20:36 | |
| *** lhcheng has quit IRC | 20:38 | |
| *** lhcheng has joined #openstack-keystone | 20:38 | |
| *** _cjones_ has joined #openstack-keystone | 20:39 | |
| dstanek | ayoung: wierd, but I'm glad you got it figured out | 20:43 |
| *** lhcheng has quit IRC | 20:43 | |
| ayoung | dstanek, I got ansible to use freeipa hostgroups in 19 lines of python | 20:43 |
| ayoung | http://fpaste.org/140767/14128873/ | 20:43 |
| ayoung | http://fpaste.org/140772/41288736/ | 20:43 |
| ayoung | probably could get that down a few lines more | 20:44 |
| dstanek | i really need to start spending some time with freeipa | 20:44 |
| ayoung | dstanek, I've got a public instance up in dreamhost | 20:44 |
| ayoung | https://ipa.younglogic.net/ipa/ui/ | 20:45 |
| dstanek | ayoung: nice | 20:45 |
| ayoung | dstanek, and a Keystone instance that points to it | 20:45 |
| ayoung | all nicely kerberized, too | 20:45 |
| boltR | is the keystone api client's auth_ref property just a JSON representation of the keystone server response? | 20:51 |
| boltR | i'm try to instantiate a Keystone api client just by passing an auth_ref object | 20:52 |
| *** david-lyle_afk is now known as david-lyle | 20:53 | |
| boltR | nvm it's not | 20:54 |
| boltR | guess there's some data massaging i have to do | 20:55 |
| *** alex_xu has joined #openstack-keystone | 20:59 | |
| *** _cjones_ has quit IRC | 21:05 | |
| *** _cjones_ has joined #openstack-keystone | 21:05 | |
| nkinder | stevemar: it doesn't look like check-tempest-dsvm-neutron-icehouse is very happy today... | 21:13 |
| stevemar | nkinder, indeed fwiw -> https://review.openstack.org/#/c/127346/ | 21:13 |
| *** HenryG has quit IRC | 21:14 | |
| nkinder | stevemar: ah, cool. +1'd. | 21:16 |
| *** ayoung is now known as ayoung-afk | 21:16 | |
| nkinder | stevemar: thanks for he clarification on the .id thing for my domain patch | 21:16 |
| stevemar | nkinder, could you tell i gave up half way through the explanation? | 21:16 |
| stevemar | :) | 21:16 |
| nkinder | might as well be consistent even though either approach works | 21:16 |
| nkinder | :) | 21:16 |
| nkinder | stevemar: I am glad you found that find_domain() already took care of the heavy lifting we needed | 21:17 |
| *** lhcheng has joined #openstack-keystone | 21:20 | |
| dstanek | why of why is the KVS catalog so broken... | 21:22 |
| *** gordc has quit IRC | 21:22 | |
| morganfainberg | dstanek, :( | 21:23 |
| morganfainberg | dstanek, at least is it consistently broken? | 21:23 |
| dstanek | morganfainberg: since get_catalog only looks for the catalog key, is it possible to change the endpoints? | 21:24 |
| dstanek | any be extension the templated backend is also broken | 21:24 |
| morganfainberg | dstanek, the templated backend is all sorts of unfun | 21:24 |
| morganfainberg | i think the kvs backend (only used for templated?) can't be changed live. | 21:25 |
| morganfainberg | needs a keystone restart atm | 21:26 |
| stevemar | yeah, i think you need to change the actual templated file and restart | 21:26 |
| stevemar | not to mention the damn things don't have IDs | 21:26 |
| dstanek | if you do a catalog_api.create_endpoint() i don't think it will get into the catalog in kvs | 21:26 |
| stevemar | (the endpoints or service) | 21:26 |
| stevemar | dstanek, pretty sure it won't - theres a patch going around to try and make it less broken | 21:27 |
| dstanek | templated is just dumb because it subclasses kvs so that it gets around the abc enforcement, but none of the methods actually work | 21:27 |
| stevemar | dstanek, https://review.openstack.org/#/c/120011/ | 21:27 |
| dstanek | stevemar: i've seen that one...not quite sure about raising NotImplemented | 21:30 |
| *** alex_xu has quit IRC | 21:31 | |
| *** lhcheng has quit IRC | 21:36 | |
| *** lhcheng has joined #openstack-keystone | 21:36 | |
| *** saipandi has quit IRC | 21:40 | |
| *** henrynash has quit IRC | 21:41 | |
| *** lhcheng has quit IRC | 21:41 | |
| *** _cjones_ has quit IRC | 21:42 | |
| *** _cjones_ has joined #openstack-keystone | 21:43 | |
| *** _cjones_ has quit IRC | 21:44 | |
| *** _cjones_ has joined #openstack-keystone | 21:45 | |
| *** eglynn has quit IRC | 21:50 | |
| nkinder | morganfainberg, gyee: I'm going to have to bail on tonight. Been trying to get over being sick this week, and today has been a losing battle. :( | 21:55 |
| *** topol has joined #openstack-keystone | 21:56 | |
| *** thedodd has quit IRC | 21:59 | |
| *** packet has quit IRC | 22:14 | |
| *** rkofman has quit IRC | 22:14 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:14 | |
| *** packet has joined #openstack-keystone | 22:14 | |
| *** rkofman has joined #openstack-keystone | 22:15 | |
| *** packet has quit IRC | 22:19 | |
| *** henrynash has joined #openstack-keystone | 22:20 | |
| *** joesavak has quit IRC | 22:23 | |
| morganfainberg | nkinder, ah no worries | 22:26 |
| morganfainberg | nkinder, don't get sick! | 22:26 |
| *** nkinder has quit IRC | 22:28 | |
| *** NM has quit IRC | 22:31 | |
| *** thiagop has quit IRC | 22:46 | |
| *** henrynash has quit IRC | 22:48 | |
| *** cds has quit IRC | 22:51 | |
| *** flwang1 has quit IRC | 22:53 | |
| *** flwang1 has joined #openstack-keystone | 22:54 | |
| *** henrynash has joined #openstack-keystone | 22:54 | |
| *** andreaf has quit IRC | 23:01 | |
| *** _cjones_ has quit IRC | 23:04 | |
| *** _cjones_ has joined #openstack-keystone | 23:04 | |
| *** HenryG has joined #openstack-keystone | 23:07 | |
| *** _cjones_ has quit IRC | 23:09 | |
| *** bknudson has quit IRC | 23:17 | |
| *** henrynash has quit IRC | 23:17 | |
| *** nkinder has joined #openstack-keystone | 23:34 | |
| *** _cjones_ has joined #openstack-keystone | 23:35 | |
| *** jorge_munoz has quit IRC | 23:38 | |
| *** david-lyle has quit IRC | 23:40 | |
| *** alex_xu has joined #openstack-keystone | 23:42 | |
| *** nellysmitt has quit IRC | 23:47 | |
| *** _cjones_ has quit IRC | 23:51 | |
| *** _cjones_ has joined #openstack-keystone | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!