| *** david-lyle has quit IRC | 00:00 | |
| *** markvoelker has quit IRC | 00:03 | |
| lbragstad | morganfainberg: ^ thanks to jorge_munoz | 00:05 |
|---|---|---|
| lbragstad | dolphm: ++, thanks for fixing up the rename | 00:06 |
| morganfainberg | so i hope we can get the 4 patches moving through the gate today | 00:06 |
| *** samueldmq_ has quit IRC | 00:06 | |
| * lbragstad high-fives the dogs | 00:07 | |
| *** ljfisher has joined #openstack-keystone | 00:07 | |
| morganfainberg | lbragstad, so.. https://review.openstack.org/#/c/159865/ https://review.openstack.org/#/c/152156/ and https://review.openstack.org/#/c/142573/ those are next following KLWT | 00:08 |
| morganfainberg | and then into Henry's | 00:08 |
| openstackgerrit | Merged openstack/keystone: Refactor and provide scaffolding for domain specific loading https://review.openstack.org/157701 | 00:08 |
| lbragstad | sweet | 00:08 |
| morganfainberg | lbragstad, https://review.openstack.org/#/c/159865/ should be an easy one | 00:11 |
| *** chlong has quit IRC | 00:15 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/160567 | 00:15 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 00:16 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 00:17 |
| *** stevemar has joined #openstack-keystone | 00:18 | |
| *** ChanServ sets mode: +v stevemar | 00:18 | |
| *** karimb has quit IRC | 00:24 | |
| *** raildo_ has quit IRC | 00:24 | |
| *** dims has quit IRC | 00:27 | |
| stevemar | morganfainberg, quickly check my comments here? https://review.openstack.org/#/c/159865/ | 00:29 |
| morganfainberg | stevemar, yeah all comments make sense | 00:31 |
| morganfainberg | stevemar, nothing i see should block that up | 00:31 |
| stevemar | morganfainberg, okay | 00:31 |
| jamielennox | i should know this, but how can i load a dependency without the controller? | 00:31 |
| morganfainberg | the manager can be removed as a cleanup patch | 00:31 |
| morganfainberg | jamielennox, load a dependency? as in the API? | 00:32 |
| morganfainberg | jamielennox, <api_thing>.Manager() ? | 00:32 |
| stevemar | i'll pull the trigger and fix the manager thing | 00:32 |
| jamielennox | morganfainberg: as in our non-functional, useless @dependency.provides() PITA | 00:32 |
| morganfainberg | jamielennox, so we load the things in service.py every time, the decorator just sticks them as properties | 00:33 |
| jamielennox | morganfainberg: remove /v3 from the pipeline from keystone-paste.ini and keystone fails to boot | 00:33 |
| stevemar | morganfainberg, bah lbragstad ruined our fun | 00:33 |
| morganfainberg | jamielennox, oh | 00:33 |
| jamielennox | UnresolvableDependencyException: Unregistered dependency: revoke_api | 00:33 |
| morganfainberg | jamielennox, uh. | 00:33 |
| * lbragstad fun-hater \o/ | 00:33 | |
| morganfainberg | jamielennox, wait what?! | 00:33 |
| jamielennox | and there is no v2 version of revoke_api | 00:33 |
| morganfainberg | jamielennox, uhm... that should be handled via the service loading | 00:33 |
| morganfainberg | it shouldn't be controller based. | 00:33 |
| morganfainberg | stevemar, ^ we might have missed another *thing* in loading services non-optionally | 00:34 |
| stevemar | lbragstad, i can't really fix the sp_url thing, it's what's in the spec | 00:34 |
| jamielennox | morganfainberg: dependency injection is pointless when the first thing we do is resolve them all | 00:34 |
| lbragstad | stevemar: ok, that was a minor suggestion | 00:34 |
| lbragstad | stevemar: more of a question really. | 00:34 |
| stevemar | lbragstad, ah okay | 00:34 |
| stevemar | morganfainberg, uh oh | 00:35 |
| morganfainberg | jamielennox, remember we want that "injection" stuff to go away | 00:35 |
| morganfainberg | jamielennox, i think for now we should just be resolving them . if we're not we are doing something wrong | 00:35 |
| jamielennox | morganfainberg: right, should do pecan | 00:35 |
| dstanek | jamielennox: morganfainberg: i have some patches for that, but they need love; henry moved all the things around | 00:35 |
| jamielennox | anyway, any idea why revoke_api is not being loaded | 00:35 |
| stevemar | morganfainberg, jamielennox a patch recently went in that removed a bunch of checks for if revoke_api | 00:35 |
| morganfainberg | jamielennox sure! lets do it! | 00:35 |
| jamielennox | morganfainberg: waiting for things to calm down | 00:35 |
| morganfainberg | jamielennox, my guess is it is missing from service | 00:35 |
| morganfainberg | jamielennox, or similar | 00:36 |
| stevemar | morganfainberg, jamielennox it's in the load_backends code for keystone as a whole | 00:36 |
| morganfainberg | it probably just needs an import instantiation | 00:36 |
| dstanek | i really wish they didn't pick pecan; we'll be the only people i've ever seen using it :-( | 00:36 |
| stevemar | ah crud | 00:36 |
| morganfainberg | dstanek, wellllllll | 00:36 |
| stevemar | jamielennox, morganfainberg shouldn't revoke manager be here: https://github.com/openstack/keystone/blob/d1b707c5686a61cc888b96d915dd1f36fac74527/keystone/backends.py | 00:37 |
| *** bknudson has joined #openstack-keystone | 00:37 | |
| *** ChanServ sets mode: +v bknudson | 00:37 | |
| morganfainberg | stevemar, yep | 00:37 |
| morganfainberg | that would be it | 00:37 |
| morganfainberg | dstanek, didn't we write a bunch of pecan? :P | 00:37 |
| stevemar | grumble grumble | 00:37 |
| stevemar | okieeee 2 more patches coming up! | 00:38 |
| jamielennox | stevemar: you on it? | 00:38 |
| *** karimb has joined #openstack-keystone | 00:38 | |
| stevemar | jamielennox, yeah | 00:39 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: move token version into fernet payload https://review.openstack.org/160579 | 00:39 |
| morganfainberg | stevemar, jamielennox, make sure to file a bog on that. | 00:39 |
| morganfainberg | bug* | 00:39 |
| dstanek | morganfainberg: i'll clean up one or two of those "remove di" patches for you to take a look at | 00:39 |
| stevemar | jamielennox, file the bug would ya? | 00:39 |
| morganfainberg | dstanek, thanks :) | 00:39 |
| * morganfainberg is going to go for dinner now | 00:39 | |
| morganfainberg | be back later on | 00:39 |
| dolphm | lbragstad: ^ https://review.openstack.org/#/c/160579/1/keystone/token/providers/fernet/token_formatters.py | 00:40 |
| dstanek | jamielennox: does pecan give us anything more than a different way to do routing? | 00:40 |
| jamielennox | dstanek: not hugely | 00:40 |
| jamielennox | we can't use wsme because of our weird APIs | 00:40 |
| dolphm | lbragstad: so, BaseTokenFormatter has a generic pack/unpack that handles messagepack and fernet both | 00:40 |
| dstanek | morganfainberg: i think pecan was all dreamhost | 00:40 |
| jamielennox | it'd be a nice cleanup though | 00:40 |
| morganfainberg | jamielennox, i want to get rid of our weird apis :P | 00:40 |
| bknudson | our APIs are broken then | 00:41 |
| dolphm | lbragstad: convenient since it also owns the crypto @property | 00:41 |
| jamielennox | morganfainberg: i know | 00:41 |
| morganfainberg | bknudson, it's the extra field stuff | 00:41 |
| jamielennox | there's no way to handle the 'extra' stuff | 00:41 |
| jamielennox | i filed a bug ages ago, tried to fix it | 00:41 |
| lbragstad | dolphm: makes sense | 00:41 |
| morganfainberg | bknudson, you know... keystone is a badly implemented key-value-store | 00:41 |
| morganfainberg | over rest api | 00:41 |
| jamielennox | this was around the original jsonschema stuff and i got distracted over that | 00:41 |
| lbragstad | dolphm: but you'd need to know the format before unpacking the rest since the Standard format and the Trust format contain different values, | 00:41 |
| lbragstad | right? | 00:41 |
| dolphm | lbragstad: yep | 00:41 |
| dolphm | lbragstad: before calling the last two classes, i suppose | 00:42 |
| lbragstad | dolphm: yeah, that's tough | 00:42 |
| lbragstad | dolphm: I know jacorob thought about that a lot too. | 00:42 |
| lbragstad | dolphm: what we could do | 00:42 |
| lbragstad | dolphm: is to carry the token version externally (same as before) and use that to verify, and once we do, we can ensure the external token version and the internal token version match? | 00:43 |
| lbragstad | dolphm: but that doesn't really make the token version completely internal | 00:43 |
| dolphm | lbragstad: the advantage to internal is integrity checking | 00:44 |
| dolphm | lbragstad: the advantage to external is just convenience | 00:44 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Always load revocation manager https://review.openstack.org/160582 | 00:44 |
| dolphm | lbragstad: so i'd rather ditch convenience in favor of adding more lightness | 00:44 |
| stevemar | jamielennox, ^ | 00:44 |
| dolphm | stevemar: does that mean you agree with me? | 00:44 |
| jamielennox | stevemar: bug 1427440 | 00:45 |
| openstack | bug 1427440 in Keystone "V2 only keystone wont start - revoke not in loaded backends" [Undecided,New] https://launchpad.net/bugs/1427440 | 00:45 |
| stevemar | dolphm, uh | 00:45 |
| dolphm | stevemar: just nod your head, yes | 00:45 |
| * stevemar nods | 00:45 | |
| dolphm | lbragstad: so we're agreed then | 00:45 |
| lbragstad | dolphm: so, in that case | 00:46 |
| lbragstad | we still need a way to pass the token string to the right formatter for validation | 00:46 |
| lbragstad | dolphm: that's if we want to be smart about it, | 00:47 |
| dolphm | lbragstad: something somewhere needs to know how to handle an ambiguous token and parse it correctly | 00:47 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Implement validation on the Identity V3 API https://review.openstack.org/132122 | 00:47 |
| lhcheng | lbragstad: fixed pep8 ^ | 00:47 |
| lbragstad | dolphm: which we've always done with the external token version | 00:47 |
| lbragstad | lhcheng: ++ thanks! | 00:48 |
| lbragstad | dolphm: unless you just pass the token string to every format validator until one works, but I think that'd be ugly | 00:48 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Cleanup comments from 159865 https://review.openstack.org/160584 | 00:48 |
| stevemar | lbragstad, for you bud ^ | 00:49 |
| dolphm | lbragstad: also more than one might "work" | 00:49 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Always load revocation manager https://review.openstack.org/160582 | 00:49 |
| lbragstad | stevemar: thank you sir | 00:50 |
| lbragstad | dolphm: yeah, exactly | 00:50 |
| stevemar | weee it's gating! | 00:50 |
| lbragstad | dolphm: what if | 00:50 |
| lbragstad | you hash/encrypt the token data, right? | 00:51 |
| lbragstad | and at that point you know the token format | 00:51 |
| lbragstad | so, you take the token format and hash that as well and tack that on to the encrypted token string | 00:51 |
| lbragstad | so, everything is still opaque | 00:51 |
| stevemar | lbragstad, could you do this patch quickly? https://review.openstack.org/#/c/151867/ | 00:51 |
| stevemar | it's already 2x +2'ed | 00:52 |
| lbragstad | dolphm: and then on validate, fernet.core always decrypts the beginning of the token, | 00:52 |
| lbragstad | which maintains the integrity check of the token format/version | 00:52 |
| lbragstad | which means you could determine the proper token format and still pass it to the correct token formatter | 00:53 |
| lbragstad | If the token format/version integrity check fails, then bomb out early saying it's an unsupported fernet token | 00:53 |
| dolphm | lbragstad: i don't know if i follow all that without a whiteboardl ol | 00:53 |
| lbragstad | dolphm: ok, so when we are in fernet.core we call to create_token, which lives in token_formatters.py, right? | 00:54 |
| dolphm | alrighty | 00:55 |
| lbragstad | at that point, we know if we are dealing with a StandardTokenFormat or a TrustTokenFormat | 00:55 |
| lbragstad | i.e. F00 or F01 | 00:55 |
| lbragstad | on the way out, we could call some encrypt_sign_token_format(self, token_format) method that takes the token format we know we are dealing with, and encrypt/signs that string (F00 or F01) | 00:56 |
| lbragstad | so, at this point we have two strings, one is an encrypted version of the token format and one is an encrypted version of the token data | 00:57 |
| lbragstad | the token could then turn into {encrypted_token_format}{encrypted_token_data} | 00:57 |
| dolphm | lbragstad: but why not just put it into plaintext? how is that different than version + encrypt(version + payload)? | 00:58 |
| dolphm | s/different/better/ | 00:58 |
| lbragstad | dolphm: it depends on why you want to put the token version in the token payload, | 00:58 |
| lbragstad | are you doing it to make it opaque to the user? | 00:59 |
| lbragstad | s/want/why/ | 00:59 |
| dolphm | lbragstad: to include it in the integrity check, for hardening | 01:00 |
| dolphm | i don't think we have an attack vector today, but it would be easy to accidentally introduce one in the future | 01:01 |
| lbragstad | encrypting the token version and tacking it to the encrypted token data would still require it to be integrity checked on validate | 01:01 |
| lbragstad | but, we'd have to do it in two separate steps if we want to know where to pass the rest of the token data to | 01:01 |
| dolphm | lbragstad: something about that statement makes me think we need to move a bunch of logic closer to the versioned payload code | 01:03 |
| dolphm | lbragstad: like fernet.core shouldn't care about versioning at all | 01:04 |
| dolphm | lbragstad: i also don't see these as "versions," they're more like variants | 01:04 |
| lbragstad | like various token formats.. | 01:04 |
| lbragstad | right? | 01:04 |
| dolphm | you either have vanilla or trust, not 0.0 or 0.1 | 01:04 |
| dolphm | lbragstad: yeah | 01:04 |
| *** markvoelker has joined #openstack-keystone | 01:04 | |
| lbragstad | yeah, we could do that | 01:04 |
| lbragstad | s/do that/move all token specific logic to fernet.core/ | 01:05 |
| dolphm | lbragstad: i'm going to go get food and ponder | 01:05 |
| stevemar | jamielennox, dstanek lbragstad dolphm https://review.openstack.org/#/c/160582/ | 01:05 |
| lbragstad | dolphm: ok, ping me if you have any other ideas.. I'll keep thinking about it | 01:06 |
| openstackgerrit | Victor Silva proposed openstack/keystone: bp/mapping-enhancements https://review.openstack.org/142573 | 01:06 |
| jamielennox | stevemar: ugh - that's a pain | 01:07 |
| jamielennox | stevemar: extra backens | 01:07 |
| stevemar | jamielennox, why is it a pain? | 01:07 |
| jamielennox | this needs to die | 01:07 |
| dstanek | jamielennox: what do you mean? | 01:07 |
| stevemar | ya, i'm confused | 01:07 |
| jamielennox | dstanek: let's just import all that stuff on load | 01:08 |
| jamielennox | ditch the dependency management entirely for all that stuff | 01:08 |
| *** dimsum__ has joined #openstack-keystone | 01:08 | |
| dstanek | jamielennox: yes, i am building the graph without DI right now | 01:08 |
| jamielennox | dstanek: excellent | 01:08 |
| *** david-lyle has joined #openstack-keystone | 01:09 | |
| dstanek | jamielennox: i stashed stuff away when henry was moving stuff around, but now that that's all over i'll start fixing and posting those | 01:09 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Implements whitelist and blacklist mapping rules https://review.openstack.org/142573 | 01:12 |
| *** markvoelker has quit IRC | 01:13 | |
| stevemar | jamielennox, that's what the 'replace extensions' bp was starting to do | 01:14 |
| stevemar | just load the things, and claim it's either experimental or stable | 01:14 |
| stevemar | rather than dealing with dependency weirdness | 01:14 |
| jamielennox | stevemar: well that was more, that was about URIs and discovery tc | 01:15 |
| *** henrynash has quit IRC | 01:15 | |
| *** krtaylor has quit IRC | 01:20 | |
| *** ljfisher has quit IRC | 01:25 | |
| *** nellysmitt has joined #openstack-keystone | 01:25 | |
| openstackgerrit | Merged openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 01:26 |
| * lbragstad \o/ | 01:27 | |
| *** karimb has quit IRC | 01:29 | |
| *** nellysmitt has quit IRC | 01:30 | |
| dstanek | what was the verdict about stopping downgrades for us? | 01:31 |
| *** krtaylor has joined #openstack-keystone | 01:33 | |
| *** _cjones_ has quit IRC | 01:34 | |
| stevemar | dstanek, no official word | 01:40 |
| stevemar | maybe we will officially say something next release | 01:40 |
| stevemar | but it's something that should be openstack wide | 01:40 |
| stevemar | not just us | 01:40 |
| openstackgerrit | Merged openstack/keystone: Populate token with service providers https://review.openstack.org/159865 | 01:49 |
| openstackgerrit | Merged openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 01:49 |
| *** david-lyle has quit IRC | 01:52 | |
| *** david-lyle has joined #openstack-keystone | 01:53 | |
| dstanek | stevemar: yeah, downgrades are dump | 01:53 |
| dstanek | for instance, i just reviewed https://review.openstack.org/#/c/152156/ which is a broken downgrade because it's impossible to represent the new data in the old schema | 01:54 |
| stevemar | dstanek, thanks for reviewing the multiple remote id patch | 01:56 |
| stevemar | it still feels wonky to me | 01:56 |
| stevemar | dstanek / jamielennox https://review.openstack.org/#/c/159671 (really quick ones) | 01:59 |
| dstanek | stevemar: don't need that test anymore? | 02:00 |
| stevemar | dstanek, nope, the test sets oauth_api to None | 02:01 |
| stevemar | self.token_provider_api.driver.oauth_api = None | 02:01 |
| jamielennox | stevemar: can you still disable oauth | 02:01 |
| stevemar | jamielennox, how? | 02:01 |
| stevemar | from the pipeline, yea, but the manager always loads | 02:02 |
| dstanek | i think you just don't add it to the list of accepted methods, but the manager is still created | 02:02 |
| stevemar | list of accepted methods? | 02:03 |
| dstanek | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n391 right? | 02:03 |
| dstanek | or does it not actually have to go in there? | 02:04 |
| *** rwsu is now known as rwsu-afk | 02:06 | |
| stevemar | dstanek, it should now that you mention it | 02:07 |
| stevemar | but that is only checked at authN time | 02:07 |
| stevemar | the manager itself should be loaded once keystone starts, either through eventlet or apache | 02:07 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 02:08 | |
| *** ayoung-lunx is now known as ayoung | 02:09 | |
| *** tqtran has quit IRC | 02:09 | |
| *** zzzeek has quit IRC | 02:10 | |
| *** erkules_ has joined #openstack-keystone | 02:11 | |
| *** erkules has quit IRC | 02:14 | |
| mfisch | is there anything I need to know about switching my revoke provider to the non-deprecated token driver, keystone.contrib.revoke.backends.sql? | 02:14 |
| mfisch | Any chants or incense required? | 02:14 |
| mfisch | seems to just be a drop-in from my testing | 02:14 |
| stevemar | mfisch, it *should* be just that | 02:15 |
| stevemar | mfisch, also, we are not going to deprecate it for another cycle | 02:15 |
| stevemar | thats the story at the moment anyway | 02:15 |
| mfisch | deprecate that one or the one thats already deprecated | 02:15 |
| mfisch | kvs | 02:15 |
| mfisch | kvs is already showing deprcated for me | 02:16 |
| *** lhcheng has quit IRC | 02:16 | |
| stevemar | mfisch, the kvs backend for revoke was slated to be removed in Kilo, but it probably won't be | 02:16 |
| *** lhcheng has joined #openstack-keystone | 02:16 | |
| mfisch | ok | 02:17 |
| stevemar | kvs, yeah morganfainberg and ayoung changed their minds about that, today in fact :) | 02:17 |
| mfisch | deprecation warnings are scary because I never look for them and they tend to become broken without me knowing | 02:17 |
| stevemar | you're getting the news hot off the presses | 02:17 |
| mfisch | so when I find, I fix | 02:17 |
| mfisch | I feel so priveleged | 02:17 |
| stevemar | its still a good move to go to the sql backend | 02:17 |
| stevemar | thats the default now anyway | 02:17 |
| mfisch | what is kvs? | 02:17 |
| mfisch | I mean its still an SQL revoke at some level | 02:17 |
| stevemar | mfisch, gonna have to bug ayoung about the diffs | 02:18 |
| mfisch | no worries | 02:18 |
| mfisch | it was just FYI | 02:19 |
| ayoung | we will certainly have SQL | 02:19 |
| mfisch | I'm switching the puppet default | 02:19 |
| ayoung | kvs is something that I think will come up, and I don't want to yank just to have to put it back | 02:19 |
| ayoung | I don't think Keystone has a puppet backend for anything | 02:20 |
| ayoung | we did discuss a DNS backend for the service catalog at one point | 02:20 |
| mfisch | not sure if that was a joke... | 02:20 |
| ayoung | mfisch, a lame one to be sure | 02:20 |
| ayoung | I misread what you said, and just went with it | 02:20 |
| mfisch | I was very confused... | 02:20 |
| ayoung | yeah, the default should be mysql | 02:21 |
| mfisch | wait until you see my proposal for keystone | 02:21 |
| *** panbalag has quit IRC | 02:21 | |
| mfisch | https://review.openstack.org/#/c/160402/ | 02:21 |
| ayoung | mfisch, deprecate all of keystone? | 02:21 |
| ayoung | mfisch, thanks | 02:21 |
| ayoung | why does puppet require you to repeat yourself? | 02:22 |
| mfisch | where? | 02:22 |
| mfisch | I need a change in there | 02:22 |
| ayoung | both files have the line: $revoke_driver = 'keystone.contrib.revoke.backends.sql', | 02:22 |
| mfisch | oh thats just tests | 02:22 |
| ayoung | its in there like 34 times, twice commented out | 02:23 |
| ayoung | heh | 02:23 |
| ayoung | 4 times | 02:23 |
| mfisch | I get paid my LoC | 02:23 |
| *** david-lyle has quit IRC | 02:23 | |
| ayoung | override_params = is that going to break if we change the default? | 02:24 |
| ayoung | 'revoke_driver' => 'keystone.contrib.revoke.backends.kvs', | 02:24 |
| mfisch | no | 02:24 |
| ayoung | I read that as: change from this default. Is my puppetese correct? | 02:24 |
| mfisch | thats just rspec, unit tests | 02:24 |
| mfisch | yeah | 02:24 |
| mfisch | from the puppet default | 02:24 |
| mfisch | not the keystone or ubuntu/redhat default | 02:24 |
| mfisch | its a unit test | 02:25 |
| mfisch | like if you had a unit test for a different driver, I could say "revoke_driver => 'adam' if I wanted to test puppet | 02:25 |
| dstanek | another easy one https://review.openstack.org/#/c/158411/ | 02:25 |
| *** markvoelker has joined #openstack-keystone | 02:26 | |
| openstackgerrit | Merged openstack/keystone: Rename "Keystone LightWeight Tokens" (KLWT) to "Fernet" tokens https://review.openstack.org/160040 | 02:32 |
| *** mancdaz has quit IRC | 02:32 | |
| stevemar | \o/ | 02:33 |
| *** mancdaz has joined #openstack-keystone | 02:34 | |
| stevemar | dstanek, done | 02:36 |
| mfisch | I saw Keystone Light and got all excited before I kept reading | 02:36 |
| stevemar | it'll be renamed for just that reason | 02:37 |
| dstanek | stevemar: thx | 02:37 |
| stevemar | so much code being merged today! | 02:37 |
| stevemar | now to review henrys stuff | 02:39 |
| *** mancdaz has quit IRC | 02:41 | |
| dolphm | stevemar: 22 reviews in last 24 hours by my count | 02:47 |
| stevemar | 22 patches? | 02:47 |
| dolphm | mfisch: not sure if you're question was ever answered regarding "what is kvs?" -- it's just an in-memory python dict. not for production, and especially not for a multi node deploy! | 02:49 |
| dolphm | stevemar: yessir | 02:49 |
| mfisch | dolphm: it seemed to be working to revoke tokens in mysql | 02:50 |
| dolphm | mfisch: ah, so we have two revocation mechanisms at the moment | 02:50 |
| dolphm | mfisch: one persists a list of revoked tokens to the token backend: the token revocation list | 02:50 |
| *** toddnni_ has joined #openstack-keystone | 02:51 | |
| dstanek | stevemar: you still here? | 02:51 |
| dolphm | mfisch: as of kilo (maybe icehouse?) we also have token revocation *events*: which is actually the discrete driver you're changing | 02:51 |
| dolphm | mfisch: revocation events describe the revoked tokens instead of enumerating them all | 02:51 |
| dolphm | mfisch: the end goal is not to persist any tokens ever | 02:52 |
| mfisch | some mechanisnm is setting the "valid" flag to 0 in mysql | 02:52 |
| dolphm | mfisch: the ones with "0" that are otherwise not expired make up the token revocation list | 02:52 |
| *** toddnni has quit IRC | 02:52 | |
| *** toddnni_ is now known as toddnni | 02:52 | |
| mfisch | not separate table which is good for easy cleanup | 02:53 |
| dolphm | mfisch: either way, it's a lot of tokens that shouldn't be persisted in the first place :( -- unless you're using UUID, in which case, that's by design | 02:54 |
| dolphm | mfisch: the fact that PKI tokens end up in the DB is basically broken | 02:54 |
| mfisch | UUID, waiting for AE | 02:54 |
| dolphm | mfisch: AE is shipping in kilo as "Fernet tokens" | 02:54 |
| mfisch | yep saw that convo here 10 mins ago | 02:55 |
| dolphm | mfisch: cool | 02:55 |
| mfisch | Proof of concept in Kilo or fully working? | 02:55 |
| dolphm | mfisch: PoC has been around since december. an implementation merged today along with docs, and we've got a stream of patches to improve them further | 02:56 |
| mfisch | sounds like it should be pretty solid by may then | 02:57 |
| dolphm | mfisch: so, AE has been renamed twice. once to KLWT, and then to Fernet. anyway, read here about "KLWT" soon-to-be-renamed-to-Fernet: http://docs.openstack.org/developer/keystone/configuration.html#uuid-pki-pkiz-or-klwt | 02:57 |
| dolphm | mfisch: the PKI paragraph also talks about revocations lists vs events | 02:58 |
| mfisch | thx for the docs | 02:59 |
| mfisch | I'm excited for frenets | 02:59 |
| mfisch | err fernets? | 02:59 |
| *** toddnni has quit IRC | 02:59 | |
| *** browne has quit IRC | 02:59 | |
| *** toddnni has joined #openstack-keystone | 03:00 | |
| dolphm | mfisch: good question. | 03:00 |
| dolphm | mfisch: https://github.com/fernet | 03:00 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/160567 | 03:01 |
| dolphm | mfisch: did you see the token format benchmarks? | 03:02 |
| dolphm | mfisch: s/the/my/ | 03:02 |
| mfisch | yeah thats what made me think about this | 03:03 |
| mfisch | thats how I found out | 03:03 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 03:03 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 03:03 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Expose create project with invalid domain_id https://review.openstack.org/160446 | 03:03 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 03:03 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 03:03 |
| *** richm has quit IRC | 03:05 | |
| * dolphm just realized the rename already landed | 03:07 | |
| dolphm | mfisch: ^ http://docs.openstack.org/developer/keystone/configuration.html#uuid-pki-pkiz-or-fernet | 03:07 |
| openstackgerrit | Merged openstack/keystone: Cleanup comments from 159865 https://review.openstack.org/160584 | 03:07 |
| stevemar | dstanek, yep i'm here | 03:13 |
| *** lhcheng has quit IRC | 03:13 | |
| *** lhcheng has joined #openstack-keystone | 03:16 | |
| *** spandhe has quit IRC | 03:16 | |
| openstackgerrit | Merged openstack/keystone: Always load revocation manager https://review.openstack.org/160582 | 03:17 |
| *** lhcheng has quit IRC | 03:21 | |
| *** ncoghlan has joined #openstack-keystone | 03:25 | |
| *** nellysmitt has joined #openstack-keystone | 03:26 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Avoid multiple instances for a provider https://review.openstack.org/124599 | 03:26 |
| stevemar | dstanek, can you take another look @ this guy: https://review.openstack.org/#/c/124599/ | 03:27 |
| openstackgerrit | Merged openstack/keystone: Fixes test_multiple_filters filters definition https://review.openstack.org/158411 | 03:28 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo.policy instead of incubated version https://review.openstack.org/148624 | 03:30 |
| *** nellysmitt has quit IRC | 03:31 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove policy parsing exception https://review.openstack.org/158562 | 03:31 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove incubated version of oslo policy https://review.openstack.org/157158 | 03:31 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Cleanup policy related tests https://review.openstack.org/158561 | 03:31 |
| *** ccard__ has joined #openstack-keystone | 03:31 | |
| *** ccard_ has quit IRC | 03:34 | |
| lbragstad | dolphm: nice work on the rename, happy to see it merged! | 03:39 |
| *** browne has joined #openstack-keystone | 03:39 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 03:42 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 03:42 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Expose create project with invalid domain_id https://review.openstack.org/160446 | 03:42 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 03:42 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 03:42 |
| rodrigods | ^ there are some bug fixes as base for the reseller code, some of them might not make sense but we need them to be triaged or invalidated | 03:43 |
| *** dimsum__ has quit IRC | 03:45 | |
| *** ayoung has quit IRC | 03:50 | |
| *** ccard__ has quit IRC | 03:50 | |
| *** ccard__ has joined #openstack-keystone | 03:51 | |
| *** ccard_ has joined #openstack-keystone | 03:58 | |
| *** ccard__ has quit IRC | 03:58 | |
| *** wanghong has quit IRC | 04:06 | |
| *** wanghong has joined #openstack-keystone | 04:07 | |
| *** thedodd has joined #openstack-keystone | 04:08 | |
| *** wanghong has joined #openstack-keystone | 04:09 | |
| *** harlowja_ is now known as harlowja_away | 04:13 | |
| *** lhcheng has joined #openstack-keystone | 04:18 | |
| *** ccard__ has joined #openstack-keystone | 04:20 | |
| *** ccard_ has quit IRC | 04:21 | |
| *** lhcheng has quit IRC | 04:22 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 04:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 04:34 |
| *** dimsum__ has joined #openstack-keystone | 04:46 | |
| *** dimsum__ has quit IRC | 04:51 | |
| *** markvoelker has quit IRC | 04:59 | |
| *** markvoelker has joined #openstack-keystone | 05:00 | |
| openstackgerrit | Eric Brown proposed openstack/keystonemiddleware: Use oslo_config choices support https://review.openstack.org/160031 | 05:00 |
| *** markvoelker has quit IRC | 05:04 | |
| *** david-lyle_afk has joined #openstack-keystone | 05:06 | |
| *** ajayaa has joined #openstack-keystone | 05:08 | |
| *** ChristyF has quit IRC | 05:09 | |
| *** ChristyF has joined #openstack-keystone | 05:10 | |
| *** lhcheng has joined #openstack-keystone | 05:24 | |
| *** nellysmitt has joined #openstack-keystone | 05:27 | |
| *** haneef has joined #openstack-keystone | 05:30 | |
| *** markvoelker has joined #openstack-keystone | 05:30 | |
| haneef | stevemar: What happened to this page? After you last commit, it shows old doc using keystoneclient instead of openstackclient : https://github.com/openstack/keystone/blob/master/doc/source/cli_examples.rst | 05:31 |
| *** nellysmitt has quit IRC | 05:31 | |
| stevemar | haneef, as it says: 'with full examples are located at OpenStackClient's Command List page' | 05:32 |
| stevemar | http://docs.openstack.org/developer/python-openstackclient/command-list.html | 05:32 |
| haneef | ok, got it. | 05:34 |
| *** thedodd has quit IRC | 05:34 | |
| *** markvoelker has quit IRC | 05:35 | |
| *** thedodd has joined #openstack-keystone | 05:37 | |
| *** david-lyle_afk has quit IRC | 05:44 | |
| *** lhcheng has quit IRC | 05:44 | |
| *** lhcheng has joined #openstack-keystone | 06:06 | |
| *** lhcheng has quit IRC | 06:08 | |
| stevemar | hmm, i think this bug was incorrectly marked as fixed | 06:12 |
| stevemar | https://bugs.launchpad.net/keystone/+bug/1384382 | 06:12 |
| openstack | Launchpad bug 1384382 in Keystone "GET /OS-FEDERATION/saml2/metadata does not work" [High,Fix released] - Assigned to Lance Bragstad (lbragstad) | 06:12 |
| *** ChristyF has quit IRC | 06:18 | |
| *** lhcheng has joined #openstack-keystone | 06:19 | |
| *** redrobot has quit IRC | 06:21 | |
| stevemar | nevermind, looks fixed :) | 06:21 |
| *** gyee has quit IRC | 06:22 | |
| *** redrobot has joined #openstack-keystone | 06:25 | |
| *** redrobot is now known as Guest32544 | 06:25 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/160233 | 06:27 |
| *** jaosorior has joined #openstack-keystone | 06:30 | |
| *** thedodd has quit IRC | 06:31 | |
| *** markvoelker has joined #openstack-keystone | 06:31 | |
| *** markvoelker has quit IRC | 06:36 | |
| *** pnavarro has joined #openstack-keystone | 06:38 | |
| *** nellysmitt has joined #openstack-keystone | 06:42 | |
| *** david-lyle_afk has joined #openstack-keystone | 06:44 | |
| *** pnavarro has quit IRC | 06:53 | |
| *** lhcheng has quit IRC | 07:01 | |
| *** openstackgerrit has quit IRC | 07:22 | |
| *** openstackgerrit has joined #openstack-keystone | 07:22 | |
| *** AnxiousGarlic has joined #openstack-keystone | 07:26 | |
| *** AnxiousGarlic has left #openstack-keystone | 07:27 | |
| *** markvoelker has joined #openstack-keystone | 07:32 | |
| *** lhcheng has joined #openstack-keystone | 07:34 | |
| *** markvoelker has quit IRC | 07:37 | |
| *** lhcheng has quit IRC | 07:41 | |
| *** lhcheng has joined #openstack-keystone | 07:42 | |
| *** ogzy has joined #openstack-keystone | 07:56 | |
| ogzy | where can i find details about keystone's policy.json file, i want to write my own rules and roles | 07:57 |
| stevemar | ogzy, keystones policy.json is based off of oslo's policy, their docs are here: http://docs.openstack.org/developer/oslo.policy/api.html#module-oslo_policy.policy | 07:58 |
| *** krtaylor has quit IRC | 07:58 | |
| ogzy | stevemar: thank you | 07:59 |
| *** erkules_ is now known as erkules | 08:05 | |
| *** browne has quit IRC | 08:07 | |
| *** krtaylor has joined #openstack-keystone | 08:08 | |
| *** stevemar has quit IRC | 08:15 | |
| *** ncoghlan has quit IRC | 08:16 | |
| *** lsmola has joined #openstack-keystone | 08:16 | |
| *** lhcheng has quit IRC | 08:17 | |
| *** dimsum__ has joined #openstack-keystone | 08:24 | |
| *** sigmavirus24_awa has quit IRC | 08:26 | |
| *** dolphm has quit IRC | 08:27 | |
| *** d34dh0r53 has quit IRC | 08:27 | |
| *** dimsum__ has quit IRC | 08:29 | |
| *** d34dh0r53 has joined #openstack-keystone | 08:30 | |
| *** dolphm has joined #openstack-keystone | 08:31 | |
| ogzy | what does identity:get_endpoint means at the policy.json, i didn't get the idea behind using identity:, can someone tell it? | 08:32 |
| *** pnavarro has joined #openstack-keystone | 08:32 | |
| *** markvoelker has joined #openstack-keystone | 08:33 | |
| *** markvoelker has quit IRC | 08:39 | |
| *** mancdaz has joined #openstack-keystone | 08:44 | |
| *** jistr has joined #openstack-keystone | 08:46 | |
| *** davechen_ has joined #openstack-keystone | 08:46 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 08:57 |
| *** karimb has joined #openstack-keystone | 09:16 | |
| openstackgerrit | Merged openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 09:19 |
| *** markvoelker has joined #openstack-keystone | 09:35 | |
| *** ajayaa has quit IRC | 09:38 | |
| *** markvoelker has quit IRC | 09:39 | |
| *** ajayaa has joined #openstack-keystone | 09:40 | |
| *** ajayaa has quit IRC | 09:50 | |
| *** davechen_ has quit IRC | 09:55 | |
| openstackgerrit | Elena Ezhova proposed openstack/keystone: [WIP] Prevent calling waitall() inside a GreenPool's greenthread https://review.openstack.org/160720 | 10:04 |
| *** afazekas has joined #openstack-keystone | 10:05 | |
| *** ajayaa has joined #openstack-keystone | 10:09 | |
| *** henrynash has joined #openstack-keystone | 10:16 | |
| *** ChanServ sets mode: +v henrynash | 10:16 | |
| *** markvoelker has joined #openstack-keystone | 10:35 | |
| *** markvoelker has quit IRC | 10:40 | |
| *** trey has quit IRC | 10:43 | |
| *** trey has joined #openstack-keystone | 10:45 | |
| *** henrynash has quit IRC | 10:45 | |
| *** henrynash has joined #openstack-keystone | 10:46 | |
| *** ChanServ sets mode: +v henrynash | 10:46 | |
| *** henrynash has quit IRC | 10:50 | |
| *** dimsum__ has joined #openstack-keystone | 11:16 | |
| *** ajayaa has quit IRC | 11:20 | |
| *** fmarco76 has joined #openstack-keystone | 11:23 | |
| *** fmarco76 has left #openstack-keystone | 11:25 | |
| *** tellesnobrega has quit IRC | 11:27 | |
| *** ajayaa has joined #openstack-keystone | 11:31 | |
| *** tellesnobrega has joined #openstack-keystone | 11:33 | |
| *** markvoelker has joined #openstack-keystone | 11:36 | |
| *** markvoelker has quit IRC | 11:41 | |
| *** fmarco76 has joined #openstack-keystone | 11:42 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 11:44 |
| *** ajayaa has quit IRC | 11:53 | |
| fmarco76 | https://review.openstack.org/#/c/159803/ | 11:58 |
| fmarco76 | sorry, wrong chat | 11:58 |
| *** EmilienM|afk is now known as EmilienM | 12:05 | |
| openstackgerrit | Sean Dague proposed openstack/oslo.policy: provide more descriptive exception https://review.openstack.org/160761 | 12:10 |
| *** amakarov_away is now known as amakarov | 12:31 | |
| *** markvoelker has joined #openstack-keystone | 12:38 | |
| *** markvoelker has quit IRC | 12:42 | |
| *** aix has quit IRC | 12:44 | |
| *** dimsum__ is now known as dims | 12:46 | |
| *** oguz has joined #openstack-keystone | 13:00 | |
| *** ogzy has quit IRC | 13:03 | |
| *** oguz_ has joined #openstack-keystone | 13:04 | |
| *** markvoelker has joined #openstack-keystone | 13:04 | |
| *** oguz has quit IRC | 13:07 | |
| *** Bsony has joined #openstack-keystone | 13:09 | |
| ekarlso | jamielennox: did you ever comeup with a solution for the allow stuff in the client ? | 13:11 |
| openstackgerrit | Endre Karlson proposed openstack/python-keystoneclient: Allow for other then STABLE api version https://review.openstack.org/130159 | 13:11 |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose register and Check as part of public API https://review.openstack.org/159525 | 13:14 |
| *** dims has quit IRC | 13:14 | |
| openstackgerrit | Elena Ezhova proposed openstack/keystone: Prevent calling waitall() inside a GreenPool's greenthread https://review.openstack.org/160720 | 13:14 |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose register and Check as part of public API https://review.openstack.org/159525 | 13:15 |
| *** dims has joined #openstack-keystone | 13:15 | |
| *** henrynash has joined #openstack-keystone | 13:19 | |
| *** ChanServ sets mode: +v henrynash | 13:19 | |
| *** Bsony has quit IRC | 13:22 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 13:22 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 13:22 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Expose create project with invalid domain_id https://review.openstack.org/160446 | 13:22 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 13:22 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 13:22 |
| *** aix has joined #openstack-keystone | 13:23 | |
| *** Bsony has joined #openstack-keystone | 13:23 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis token backend https://review.openstack.org/150844 | 13:27 |
| *** panbalag has joined #openstack-keystone | 13:28 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis token backend https://review.openstack.org/150844 | 13:29 |
| *** gordc has joined #openstack-keystone | 13:37 | |
| *** aix has quit IRC | 13:44 | |
| *** aix has joined #openstack-keystone | 13:44 | |
| *** jbonjean has quit IRC | 13:46 | |
| *** jbonjean has joined #openstack-keystone | 13:46 | |
| *** jbonjean has quit IRC | 13:47 | |
| *** jbonjean has joined #openstack-keystone | 13:48 | |
| *** jbonjean has quit IRC | 13:48 | |
| *** jbonjean has joined #openstack-keystone | 13:48 | |
| *** oguz_ is now known as ogzy | 13:48 | |
| *** ogzy has joined #openstack-keystone | 13:48 | |
| *** radez_g0n3 is now known as radez | 13:57 | |
| *** grantbow has quit IRC | 14:00 | |
| amakarov | dstanek, hi! About that testing question: is there any suggestion how can we test real backends (Redis in particular) | 14:12 |
| *** ljfisher has joined #openstack-keystone | 14:17 | |
| *** mattfarina has joined #openstack-keystone | 14:18 | |
| *** richm has joined #openstack-keystone | 14:19 | |
| *** nkinder has quit IRC | 14:24 | |
| *** chlong has joined #openstack-keystone | 14:27 | |
| *** joesavak has joined #openstack-keystone | 14:28 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Implement backend driver support for domain config https://review.openstack.org/158051 | 14:29 |
| openstackgerrit | Merged openstack/keystone: Avoid multiple instances for a provider https://review.openstack.org/124599 | 14:29 |
| *** david-lyle has joined #openstack-keystone | 14:31 | |
| *** diegows has joined #openstack-keystone | 14:35 | |
| *** ayoung has joined #openstack-keystone | 14:43 | |
| *** ChanServ sets mode: +v ayoung | 14:43 | |
| *** topol has joined #openstack-keystone | 14:50 | |
| *** ChanServ sets mode: +v topol | 14:50 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 14:56 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 14:56 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 14:56 |
| *** nkinder has joined #openstack-keystone | 15:08 | |
| *** thedodd has joined #openstack-keystone | 15:12 | |
| *** jasondotstar has joined #openstack-keystone | 15:16 | |
| openstackgerrit | Marcos Fermín Lobo proposed openstack/keystone: Implement group related methods for LDAP backend https://review.openstack.org/157327 | 15:22 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 15:22 |
| *** henrynash has quit IRC | 15:23 | |
| *** sigmavirus24 has joined #openstack-keystone | 15:35 | |
| *** henrynash has joined #openstack-keystone | 15:51 | |
| *** ChanServ sets mode: +v henrynash | 15:51 | |
| *** stevemar has joined #openstack-keystone | 15:53 | |
| *** ChanServ sets mode: +v stevemar | 15:53 | |
| doug-fish | hello again keystone friends. I'm still working on k2k federation for Horizon and struggling with getting it to work with the keystone client. In order to facilitate discussion, I've put together a script that makes the same calls I'm making it django_openstack_auth but hopefully in a form that easier to read | 15:54 |
| doug-fish | https://review.openstack.org/#/c/160851/ | 15:54 |
| *** zzzeek has joined #openstack-keystone | 15:54 | |
| openstackgerrit | Elena Ezhova proposed openstack/keystone: Prevent calling waitall() inside a GreenPool's greenthread https://review.openstack.org/160720 | 15:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use choices in config.py https://review.openstack.org/157890 | 15:57 |
| *** pnavarro has quit IRC | 15:57 | |
| *** eezhova has joined #openstack-keystone | 15:59 | |
| *** crinkle has quit IRC | 16:01 | |
| *** crinkle has joined #openstack-keystone | 16:01 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 16:02 |
| *** ekarlso has quit IRC | 16:03 | |
| *** ekarlso has joined #openstack-keystone | 16:07 | |
| *** atiwari has joined #openstack-keystone | 16:14 | |
| *** browne has joined #openstack-keystone | 16:14 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 16:17 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 16:22 |
| *** ChanServ sets mode: +o dolphm | 16:25 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 16:26 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 16:27 |
| *** spandhe has joined #openstack-keystone | 16:30 | |
| *** diegows has quit IRC | 16:31 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 16:34 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 16:35 |
| *** spandhe has quit IRC | 16:35 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 16:35 |
| *** Bsony has quit IRC | 16:36 | |
| *** david-lyle_afk has quit IRC | 16:37 | |
| *** david-lyle has quit IRC | 16:37 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 16:38 |
| openstackgerrit | henry-nash proposed openstack/keystone: Implement backend driver support for domain config https://review.openstack.org/158051 | 16:40 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 16:40 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 16:42 |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 16:43 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 16:43 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 16:44 |
| lbragstad | dstanek: on the v2 token stuff | 16:44 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 16:44 |
| lbragstad | dstanek: the current commit that is up still needs some work for building the token context on the way out of authenticate and validate calls. | 16:45 |
| lbragstad | dstanek: similar to how v3 does it with V3DataHelper.get_token_data() | 16:45 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 16:45 |
| lbragstad | dstanek: currently jorge_munoz is working on it, | 16:45 |
| samueldmq | henrynash, ping - I've a question regarding domain-specific configs :) | 16:46 |
| henrynash | samueldmq: sure | 16:46 |
| samueldmq | henrynash, maybe I missed/forgot something from the spec .. | 16:46 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 16:47 |
| samueldmq | henrynash, ok, so ... when we create a config that has some sensitive options, those options go to the sensitive_configs database, right? | 16:47 |
| samueldmq | henrynash, while the others go to the whitelisted_one .. | 16:47 |
| henrynash | yes | 16:47 |
| samueldmq | henrynash, how are we protecting that data? | 16:47 |
| henrynash | just a differnet table…but also the public API cannot read the sensiive table | 16:48 |
| samueldmq | henrynash, k got it.. and that is just used by the manger | 16:48 |
| samueldmq | manager* | 16:48 |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 16:48 |
| henrynash | yes | 16:48 |
| samueldmq | henrynash, ack, thx | 16:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 16:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 16:50 |
| *** jistr has quit IRC | 16:50 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 16:50 |
| samueldmq | henrynash, this test (https://review.openstack.org/#/c/159928/9/keystone/tests/unit/backend/domain_config/core.py) described the whole thing :) | 16:51 |
| *** thedodd has quit IRC | 16:51 | |
| *** Guest32544 is now known as redrobot | 16:51 | |
| henrynash | :-) | 16:51 |
| *** diegows has joined #openstack-keystone | 16:52 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 16:52 |
| *** henrynash has quit IRC | 16:53 | |
| dstanek | lbragstad: nice, i'm going to make a comment in the review so i don't forget | 16:54 |
| lbragstad | ok | 16:54 |
| dstanek | lbragstad: i'm sure you've seen it, but the patch is broken now that the fernet naming change has merged | 16:54 |
| lbragstad | yeah, I did a rebase, but two of the tests are still failing, | 16:55 |
| dstanek | lbragstad: just an import problem from what i saw | 16:55 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 16:58 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 16:58 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 16:58 |
| *** gyee has joined #openstack-keystone | 16:58 | |
| *** ChanServ sets mode: +v gyee | 16:58 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Expose create project with invalid domain_id https://review.openstack.org/160446 | 16:59 |
| *** nellysmitt has quit IRC | 17:03 | |
| *** ljfisher has quit IRC | 17:05 | |
| *** david-lyle has joined #openstack-keystone | 17:05 | |
| *** _cjones_ has joined #openstack-keystone | 17:05 | |
| amakarov | lbragstad, greetings! Is there any roadmap for Fernet tokens? I'd like to try to replace uuid with them :) | 17:07 |
| lbragstad | amakarov: roadmap? | 17:08 |
| lbragstad | as in a migration guide? | 17:08 |
| amakarov | lbragstad, let me put it this way: when will any pre-pre-pre-alpha be ready for testing? | 17:09 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Adding utf8 to federations tables https://review.openstack.org/159803 | 17:09 |
| lbragstad | amakarov: what kind of testing? | 17:10 |
| lbragstad | are you looking to do?> | 17:10 |
| amakarov | lbragstad, I want to deploy an env with several controllers, switch to Fernet tokens and see how fast Keystone have become :) | 17:11 |
| lbragstad | amakarov: so you want to do some performance testing? You should be able to do some of that now, with the commits that merged recently | 17:12 |
| amakarov | lbragstad, I have a full set of rally tests | 17:12 |
| amakarov | lbragstad, cool! Then the last issue will be revocation engine: how do I sync revocations across several controllers/datacenters/databases? | 17:13 |
| lbragstad | amakarov: that work is probably going to come with a new release of keystonemiddleware | 17:14 |
| *** Bsony has joined #openstack-keystone | 17:14 | |
| lbragstad | amakarov: the keystone server works with Fernet tokens and revocation events, we just need a way for keystonemiddleware (auth_token.py Middleware) to grab those events | 17:15 |
| amakarov | lbragstad, middleware? I'm a little lost: how middleware will help with multiple Keystone servers? | 17:15 |
| amakarov | lbragstad, ok, the user story: as a cloud admin I want to revoke user's X role Y on project Z | 17:16 |
| lbragstad | amakarov: sorry, the middleware will help with the service side, | 17:16 |
| openstackgerrit | Merged openstack/oslo.policy: provide more descriptive exception https://review.openstack.org/160761 | 17:16 |
| *** chlong has quit IRC | 17:17 | |
| *** fmarco76 has quit IRC | 17:17 | |
| amakarov | lbragstad, well, don't mention it now - I'll try postgres with BDR as a backend. I need an rw LDAP replacement for assingnments anyway | 17:18 |
| amakarov | lbragstad, so can I just take master branch and there are Fernet tokens operational? | 17:19 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Service Catalog Subsets by ID https://review.openstack.org/160909 | 17:20 |
| *** lhcheng has joined #openstack-keystone | 17:22 | |
| morganfainberg | amakarov: we need to land 1 more patch for fernet to be fully implemented. | 17:24 |
| morganfainberg | amakarov: but it is close. | 17:24 |
| *** lhcheng_ has joined #openstack-keystone | 17:24 | |
| amakarov | morganfainberg, thanks, eager to try ) | 17:26 |
| *** lhcheng has quit IRC | 17:27 | |
| morganfainberg | lbragstad: how are v2 tokens text_string and v3 bytes (or vice versa)? | 17:28 |
| morganfainberg | Oh wait I know. Header vs url bit | 17:28 |
| morganfainberg | Damn :( | 17:28 |
| amakarov | morganfainberg, can you take a look please? https://review.openstack.org/#/c/141854/ | 17:29 |
| dstanek | morganfainberg: what's the point of having config values for field lengths? (read max_param_size) | 17:30 |
| dstanek | morganfainberg: the only reason i can think of is that our specifications are week and backends can do what they please | 17:30 |
| morganfainberg | dstanek, where? | 17:32 |
| dstanek | morganfainberg: i was looking at why we would want to do this: https://review.openstack.org/#/c/128504/ | 17:32 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Adding utf8 to federations tables https://review.openstack.org/159803 | 17:32 |
| dstanek | morganfainberg: max_param_size is something only used in keystone/token/controllers.py so maybe that's already broken | 17:33 |
| dstanek | our schema could conflict with it | 17:33 |
| morganfainberg | likely is. | 17:34 |
| morganfainberg | so i wonder how much is broken today by that. | 17:34 |
| morganfainberg | the schema and API spec should be the canonical source of truth | 17:35 |
| morganfainberg | not the backend | 17:35 |
| morganfainberg | i think this is a legacy hold-over fix | 17:35 |
| * morganfainberg looks again | 17:35 | |
| morganfainberg | oh | 17:36 |
| morganfainberg | x509 things | 17:36 |
| morganfainberg | uhm. | 17:36 |
| morganfainberg | dstanek, hm. so we should not have config options for that. we should just enforce in schema [json schema] and document in API. if it would break v2 to increase that length / v3, we stick with 64 | 17:38 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 17:39 |
| dstanek | morganfainberg: perfect, that's what i was hoping to hear. making too many config options would suck for a variety of reasons | 17:39 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Adding utf8 to federations tables https://review.openstack.org/159803 | 17:41 |
| openstackgerrit | Merged openstack/oslo.policy: Expose register and Check as part of public API https://review.openstack.org/159525 | 17:42 |
| *** tellesnobrega has quit IRC | 17:43 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 17:44 |
| morganfainberg | mtreinish, ping - i can't get debtcollector to emit the warning. i can get direct calls to warnings.warn to work, etc. | 17:45 |
| morganfainberg | mtreinish, i have no idea why debtcollector isn't working. so i'm going to have to propose not using it - and revisit. | 17:45 |
| morganfainberg | mtreinish, i've tried a ton of different incarnations for calling it and it always seems to boil down to just not calling things in clearly expected manners. | 17:46 |
| morganfainberg | mtreinish, when it hits warnings.warn, i'll poke at it more after k3 | 17:46 |
| *** ljfisher has joined #openstack-keystone | 17:47 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Adding utf8 to federations tables https://review.openstack.org/159803 | 17:47 |
| *** jorge_munoz has joined #openstack-keystone | 17:49 | |
| *** jorge_munoz has left #openstack-keystone | 17:49 | |
| *** jorge_munoz has joined #openstack-keystone | 17:49 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Deprecate Eventlet Deployment in favor of wsgi containers https://review.openstack.org/157495 | 17:50 |
| *** htruta has quit IRC | 17:50 | |
| morganfainberg | stevemar, dstanek, dolphm, lbragstad, ayoung, https://review.openstack.org/157495 should be an easy review. | 17:52 |
| *** pnavarro has joined #openstack-keystone | 17:54 | |
| *** spandhe has joined #openstack-keystone | 17:56 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Deprecate Eventlet Deployment in favor of wsgi containers https://review.openstack.org/157495 | 17:57 |
| *** lhcheng_ is now known as lhcheng | 17:59 | |
| *** htruta has joined #openstack-keystone | 18:00 | |
| *** henrynash has joined #openstack-keystone | 18:00 | |
| *** ChanServ sets mode: +v henrynash | 18:00 | |
| *** tqtran has joined #openstack-keystone | 18:00 | |
| *** lhcheng_ has joined #openstack-keystone | 18:01 | |
| *** browne has quit IRC | 18:02 | |
| breton | well | 18:03 |
| breton | we killed eventlet. | 18:04 |
| *** lhcheng has quit IRC | 18:04 | |
| mtreinish | morganfainberg: ok sure, it worked when I tested it, I'll try to dive into it whenever | 18:04 |
| *** timcline has joined #openstack-keystone | 18:04 | |
| mtreinish | but as long as you guys have something that works | 18:04 |
| *** tellesnobrega has joined #openstack-keystone | 18:04 | |
| mtreinish | there's no real rush | 18:04 |
| *** _cjones_ has quit IRC | 18:05 | |
| *** diegows has quit IRC | 18:06 | |
| *** Bsony has quit IRC | 18:10 | |
| *** Bsony has joined #openstack-keystone | 18:10 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix nits from 157495 https://review.openstack.org/160925 | 18:11 |
| rodrigods | morganfainberg, ^ fixed some nits in the eventlet deprecation patch | 18:11 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 18:12 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 18:12 |
| *** harlowja_away is now known as harlowja_ | 18:12 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 18:14 |
| *** _cjones_ has joined #openstack-keystone | 18:15 | |
| *** lhcheng has joined #openstack-keystone | 18:16 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 18:16 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 18:16 |
| *** lhcheng_ has quit IRC | 18:19 | |
| morganfainberg | rodrigods sure | 18:21 |
| morganfainberg | rodrigods, thanks | 18:21 |
| morganfainberg | mtreinish, yeah it's something odd - i'm sure it's just something called in thr wrong order | 18:22 |
| *** karimb has quit IRC | 18:24 | |
| *** radez is now known as radez_g0n3 | 18:27 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: remove old docstr referring to keyczar https://review.openstack.org/160930 | 18:35 |
| *** dnalezyt has joined #openstack-keystone | 18:36 | |
| mtreinish | morganfainberg: I just looked at the most recent patch for the deprecation, I think it'll bounce off pep8. You left the debtcollector import in there | 18:36 |
| morganfainberg | dang it. | 18:37 |
| morganfainberg | i thought i pulled that out | 18:37 |
| jamielennox | mtreinish: /join #openstack-meeting | 18:37 |
| jamielennox | damnit | 18:37 |
| jamielennox | mtreinish: sorry - that must have been there from yesterday | 18:37 |
| mtreinish | jamielennox: I'm always in there :) | 18:37 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Deprecate Eventlet Deployment in favor of wsgi containers https://review.openstack.org/157495 | 18:37 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix nits from 157495 https://review.openstack.org/160925 | 18:38 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix nits from 157495 https://review.openstack.org/160925 | 18:38 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: refactor: extract fernet packing & unpacking methods https://review.openstack.org/160932 | 18:43 |
| jamielennox | dstanek: you had the last -1 on https://review.openstack.org/#/c/157282/ can you look again - then i can rebase all my other stuff | 18:51 |
| dstanek | jamielennox: sure | 18:51 |
| morganfainberg | ayoung, want to re +2 https://review.openstack.org/#/c/157495/ had to remove an erroneous import | 18:51 |
| dstanek | jamielennox: that was a trivial -1 :-) | 18:52 |
| jamielennox | dstanek: yea, but if i'm going to bug someone about it at least you've seen it before | 18:53 |
| dstanek | jamielennox: yeah, going through it again now | 18:53 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: refactor: consistently refer to "unpacked tokens" as the token's "payload" https://review.openstack.org/160940 | 18:55 |
| ayoung | morganfainberg, happy to | 18:55 |
| henrynash | stevemar, bknudson: all the early patches for domain-config have been updated from your comments and the new versions have passed jenkins (starts at: https://review.openstack.org/#/c/158051/14)….if we can get a few +2’s I’ll try and line up a +A from someone… | 18:55 |
| ayoung | henrynash, looking | 18:56 |
| henrynash | ayoung: thx | 18:57 |
| marekd | dstanek: re: https://review.openstack.org/#/c/142573/15/keystone/contrib/federation/utils.py i am not sure if you are suggesting that some tests are actually missing ? | 18:57 |
| *** jeffDeville has joined #openstack-keystone | 18:58 | |
| *** amakarov is now known as amakarov_away | 18:58 | |
| dstanek | marekd: yes, all of the tests expect empty list instead of a list with stuff | 18:58 |
| dstanek | marekd: the append vs. extend looks broken to me | 18:59 |
| dstanek | marekd: is that the way it's supposed to work? | 18:59 |
| marekd | dstanek: i don't follow what do you mean by saying tests expect empty lists...empty lists of user input (params from assertion) or empty white/black lists ? | 19:01 |
| jeffDeville | hey everyone, I just started using Keystone (Juno) and I'm trying to use openidconnect as the auth provider, but use the sql assignments to manage the roles. a) Is that possible? I've seen ldap references that suggest it might be. b) I seem to need to provide a mapping, but I've yet to find any docs on the syntax. Any suggestions on where to look? c) I don't want to deal w/ mapping OIDC roles to | 19:01 |
| jeffDeville | Keystone ones. I want to manage those from Keystone exclusively. Any pointers on where to look? | 19:01 |
| dstanek | marekd: all these tests seem to compare against [], what about a case where something is returned? | 19:02 |
| morganfainberg | jeffDeville, it should be doable, that is the design. however, you need to map the OIDC users to a group, and assign the role to the group [not to the user directly] | 19:02 |
| morganfainberg | stevemar, ^ jeffDeville's question | 19:02 |
| dstanek | marekd: for example, you have 3 things in the input and 1 is blacklisted; the result should be a list of two things | 19:02 |
| jeffDeville | so we could have a 'user' group and an 'admin' group, and map things to those groups correct? | 19:03 |
| dstanek | marekd: i'm just trying to figure out is .append is right and if so why the tests didn't catch it | 19:03 |
| morganfainberg | jeffDeville, yes. the groups are defined in keystone still. | 19:03 |
| morganfainberg | jeffDeville, you use the federation mapping rules to take the OIDC attributes and put users into those groups. you can use [i think] any attr to map the user to the group. | 19:04 |
| morganfainberg | jeffDeville, i know stevemar has a bit more experience with this directly than I do. | 19:04 |
| morganfainberg | jeffDeville, so he can expand some [he wrote a chunk of the oidc stuff in keystone along w/ marekd for the federation core code] | 19:04 |
| jeffDeville | morganfainberg: Ok, we also need to use domain-based authorization. So we're going to have a LOT of groups here that would correspond to the various sets of permissions we'd need. Is that an accurate statement? | 19:05 |
| *** browne has joined #openstack-keystone | 19:05 | |
| morganfainberg | jeffDeville, explain what you mean by domain authorization please. | 19:05 |
| morganfainberg | i don't want to guess wrong ;) | 19:06 |
| jeffDeville | morganfainberg: stevemar: - Keystone v3 lets you assign roles by domain. We're offering openstack to multiple companies, and so will need to be isolated from one another. We were going to do that w/ domains. | 19:07 |
| *** joesavak has quit IRC | 19:07 | |
| bknudson | henrynash: I had a couple of minor comments on https://review.openstack.org/#/c/158051/ that should be cleaned up. | 19:07 |
| *** joesavak has joined #openstack-keystone | 19:07 | |
| morganfainberg | jeffDeville, you can [with the v3 policy] use groups per domain and map users into those groups | 19:07 |
| stevemar | jeffDeville, catching up... | 19:08 |
| morganfainberg | so yes, you'd need groups that provide the right permissions to the right users. | 19:08 |
| *** ccard__ has quit IRC | 19:08 | |
| *** jsavak has joined #openstack-keystone | 19:09 | |
| stevemar | jeffDeville yeah so morganfainberg explained it perfect | 19:09 |
| *** ccard__ has joined #openstack-keystone | 19:09 | |
| jeffDeville | morganfainberg: stevemar: - So example: if we have 10 users across 2 companies, where each company has 3 roles, we'd need to create 3*2 = 6 groups, and then map each of the 10 users to the appropriate set of group memberships. Correct? | 19:10 |
| henrynash | bknudson: would you be Ok with cleaning that up in a (for Kilo) follow up bug fix? | 19:10 |
| stevemar | it'll behave the same way we do SAML based federation now | 19:10 |
| jeffDeville | So the mapping will basically include a list of all of the relevant userids (I don't know the mapping syntax yet), and anytime a new user comes in, we'll need to rebuild the mapping doc? | 19:10 |
| jeffDeville | morganfainberg: stevemar: ^ (sorry) | 19:11 |
| stevemar | jeffDeville, so yes, i think thats what you would want to do | 19:11 |
| *** aix has quit IRC | 19:11 | |
| stevemar | 2 domains, one per company, and 3 groups per domain | 19:11 |
| stevemar | then assign them roles | 19:11 |
| stevemar | that'll make sure they never collide or have access to each others roles | 19:12 |
| bknudson | henrynash: as long as the commit message summary isn't "Fix comments in review https://review.openstack.org/#/c/158051/". | 19:12 |
| jeffDeville | Thanks morganfainberg: stevemar: - Is there any reference for the mapping syntax, or should I peruse the source? | 19:12 |
| stevemar | jeffDeville, there are definitely some examples in the API, but they might be dated now, we have since made some improvements | 19:13 |
| *** joesavak has quit IRC | 19:13 | |
| morganfainberg | stevemar he;'s useing juno | 19:13 |
| stevemar | jeffDeville, how much do you know about openid connect :D | 19:13 |
| henrynash | bknudson: you mean, make the defect/commit message explict….sure | 19:13 |
| morganfainberg | and all syntax should be backwards compatible | 19:13 |
| bknudson | henrynash: yes. | 19:13 |
| *** ChristyF has joined #openstack-keystone | 19:13 | |
| jeffDeville | stevemar: morganfainberg: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-federation-ext.html#create-a-mapping This? | 19:14 |
| henrynash | bknudson: I’ll raise explict defect(s) | 19:14 |
| jeffDeville | stevemar: Enough to have configured our Forgerock sso provider for it, and connect it successfully using the apache mod. We've registered the identity provider, mapping, and protocol, but the mapping doesn't work because I just copied something from an example. | 19:15 |
| *** topol has quit IRC | 19:15 | |
| stevemar | jeffDeville, excellent, you know everything then :D | 19:16 |
| jeffDeville | stevemar: I've found examples of mapping, but nothing that explains how it works yet, and it's tough to know what's going on because it's taking input -> mapping_it -> output. And the examples don't have much to say on what the input and output looks like. | 19:16 |
| samueldmq | stevemar, ping - have something to discuss about cadf notif initiators .. :) | 19:16 |
| stevemar | jeffDeville, and those examples are more SAML friendly, let me check what i used for oidc | 19:17 |
| stevemar | samueldmq, one sec | 19:17 |
| ayoung | devstack's handling of Horizon is painful. Defining a virtualhost :80 needs to die | 19:17 |
| samueldmq | stevemar, k | 19:17 |
| stevemar | jeffDeville, this is what I was using: https://gist.github.com/stevemart/e1c07cf4df50f621282f#file-oidc_steps-L65-L83 | 19:17 |
| *** mattamizer has joined #openstack-keystone | 19:18 | |
| stevemar | jeffDeville, the apache vhost file is there too | 19:18 |
| stevemar | jeffDeville, oh i used one that had 'groups' at one point | 19:19 |
| jeffDeville | Thanks a ton stevemar:! I'll go digest for awhile and see what I can do on my own. | 19:20 |
| *** radez_g0n3 is now known as radez | 19:20 | |
| bknudson | henrynash: if you want to open a bug that's fine but I don't think that's necessary. | 19:20 |
| henrynash | bknudson: ok | 19:20 |
| stevemar | jeffDeville, PM'ed you a bit more info | 19:21 |
| henrynash | bknudson: I’ll follow up with a two seaprate explict patches that fix those two issues, tied to this bp | 19:21 |
| *** Bsony has quit IRC | 19:21 | |
| marekd | dstanek: ok, so the reason why it's .append() in white and blacklisting cases | 19:22 |
| marekd | are that local rules expect lists | 19:22 |
| marekd | not strings. | 19:22 |
| marekd | dstanek: see line 603 here https://review.openstack.org/#/c/142573/15/keystone/tests/unit/mapping_fixtures.py | 19:22 |
| marekd | it expects all the groups whitelisted by given dict. | 19:23 |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP: Force SQLite to properly deal with foreign keys https://review.openstack.org/126030 | 19:23 |
| marekd | whereas in the 'else' case it is 'extend' cause before we only added single strings, usually it was username | 19:23 |
| marekd | mapped directly from some parameter | 19:24 |
| morganfainberg | marekd, that confused me alot | 19:24 |
| openstackgerrit | Merged openstack/keystone-specs: Alembic for SQL migrations https://review.openstack.org/131531 | 19:24 |
| *** mattamizer has quit IRC | 19:24 | |
| *** Bsony has joined #openstack-keystone | 19:24 | |
| *** Bsony has quit IRC | 19:25 | |
| marekd | morganfainberg: :( | 19:25 |
| *** Bsony has joined #openstack-keystone | 19:25 | |
| marekd | morganfainberg: append vs extend ? | 19:26 |
| morganfainberg | marekd, eyah i clearly did not/do not grok the whitelist/blacklist stuff | 19:27 |
| morganfainberg | it wasn't clear why sometimes append was right and sometimes extend was | 19:27 |
| marekd | morganfainberg: look at the test rule here: https://review.openstack.org/#/c/142573/15/keystone/tests/unit/mapping_fixtures.py line 821 | 19:28 |
| * morganfainberg has a meeting to jump into | 19:28 | |
| marekd | it says, take all the value from assertion:ordPersonType and put every value except those blacklisted in the groups attribute | 19:28 |
| marekd | so groups must be a list efectively, hence we need to direct_maps.append(input - blaclisted_values) | 19:29 |
| stevemar | samueldmq, whats up with the notifier? | 19:29 |
| stevemar | err initiator | 19:30 |
| marekd | so later local rule with take 0'th element ({0} keyword) from direct_maps and put it | 19:30 |
| marekd | morganfainberg: ^^ | 19:30 |
| marekd | dstanek: ^^ | 19:31 |
| marekd | and the tests, yes they expect empty group lists, but here mapping engine effectively outputs group names + domains and we check it here https://review.openstack.org/#/c/142573/15/keystone/tests/unit/test_v3_federation.py line 931 for instance | 19:33 |
| marekd | what I can add is a length comparison | 19:33 |
| *** lsmola has quit IRC | 19:36 | |
| *** jeffDeville has quit IRC | 19:37 | |
| dstanek | marekd: i'm going to have to dig into this again. | 19:39 |
| marekd | i left you a comment. | 19:43 |
| *** kfox1111 has joined #openstack-keystone | 19:46 | |
| dstanek | marekd: i think i get it, but i have a few questions | 19:46 |
| dstanek | marekd: if multiple things are whitelisted does the first always get applied to the local rule? | 19:47 |
| kfox1111 | so is the 'internal' endpoint url ever used? Can I use it to have a private to the physical network compute nodes and have the public addresses unreachable from those nodes? | 19:48 |
| *** jeffDeville has joined #openstack-keystone | 19:48 | |
| samueldmq | stevemar, hi .. does the initiator have some coupling to the resource_type? | 19:48 |
| marekd | dstanek: example? | 19:49 |
| henrynash | stevemar, ayoung: sorry to bug…if you’re OK wth at least the first couple of the domain-config patches….it would be great to start them gating….(starting at: https://review.openstack.org/#/c/158051/) | 19:49 |
| samueldmq | stevemar, if so, maybe I can't use a project_initiator to report a domain notification ... | 19:49 |
| *** lsmola has joined #openstack-keystone | 19:49 | |
| larsks | kfox1111: most services like you configure them to use a specific endpoint type (public/admin/internal). | 19:49 |
| henrynash | gyee: if you are about, see above too | 19:49 |
| stevemar | henrynash, on it dude | 19:49 |
| marekd | dstanek: so, you have input: a,b,c and whitelist: b = > mapped groups for instance will be [a,c] | 19:49 |
| henrynash | stevemar: thx….. | 19:49 |
| larsks | kfox1111: or at least, some services do. | 19:49 |
| marekd | dstanek: uh, sorry, mapped groups will be [b] | 19:50 |
| dstanek | marekd: what what be in {0}? | 19:50 |
| stevemar | samueldmq, the initiator is just the person who created the request, if he fails the policy check it'll be stopped there | 19:50 |
| marekd | 0'th element from direct_map list | 19:50 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: log query string instead of openstack.params and request args https://review.openstack.org/160955 | 19:50 |
| dstanek | marekd: but won't that be a list if there are multple whitelisted things? | 19:50 |
| marekd | dstane: or, output of the 0'th remote rule | 19:50 |
| marekd | dstanek: it will be a list | 19:51 |
| dolphm | bknudson: i marked the corresponding bug as critical- https://review.openstack.org/#/c/160955/ | 19:51 |
| samueldmq | stevemar, ok ... I'll dig it a bit more | 19:51 |
| marekd | and that's why append() is there | 19:51 |
| samueldmq | thx | 19:51 |
| marekd | dstanek: ^^ | 19:51 |
| bknudson | dolphm: let me try it. | 19:52 |
| marekd | dstanek: from the UX, {0}, {1} means: take 0th, 1st output from the remote rule and put it in the local attribute | 19:52 |
| dstanek | marekd: what code takes that list (that may contain another list) and does stuff with it? | 19:52 |
| *** dnalezyt has quit IRC | 19:52 | |
| marekd | dstanek: looking. | 19:52 |
| marekd | dstanek: https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/utils.py#L392 and https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/utils.py#L471 which transforms {0} into real mapped values | 19:54 |
| openstackgerrit | Merged openstack/keystonemiddleware: Extract IdentityServer into file https://review.openstack.org/157282 | 19:54 |
| openstackgerrit | Merged openstack/keystonemiddleware: Move UserAuthPlugin into its own file https://review.openstack.org/157283 | 19:55 |
| *** ccard_ has joined #openstack-keystone | 19:55 | |
| bknudson | devstack didn't work ... AttributeError: 'module' object has no attribute 'SECURITY_TRUST' | 19:56 |
| marekd | dstanek: https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/utils.py#L485 uh, docstring could be updated here so the direct_map include also a list inside | 19:56 |
| *** ccard__ has quit IRC | 19:56 | |
| ayoung | henrynash, so far so good | 19:56 |
| dstanek | marekd: so the output of that will be a str(list)? | 19:56 |
| ayoung | I'm about 1/2 through that patch | 19:56 |
| gyee | henrynash, sure, looking | 19:57 |
| bknudson | maybe we're requiring a newer version of pycadf? | 19:57 |
| henrynash | gyee: thx | 19:57 |
| ayoung | henrynash, would love to see that code eventually moving to oslo.config | 19:57 |
| *** jorge_munoz_ has joined #openstack-keystone | 19:57 | |
| henrynash | ayoung: yeah, understand that desire! | 19:58 |
| marekd | dstanek:aparently yes | 19:59 |
| marekd | dstanek: and later will be transformed to list again with ast.literal_eval() | 19:59 |
| ayoung | henrynash, +2A | 19:59 |
| dstanek | marekd: ah, interesting | 19:59 |
| ayoung | henrynash, get brant's -1 on the next ... | 19:59 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Cleanup docstrings in test_v3_federation.py https://review.openstack.org/160959 | 19:59 |
| henrynash | ayoung: thx you sir..yeah, just saw that…fixing now | 20:00 |
| gyee | I call ayoung's +2A and raise another +2 | 20:00 |
| ayoung | henrynash, he made a lot of comments, not sure which are responsible for the -1 | 20:00 |
| marekd | dstanek: it was not my idea to do the rules substitution using .format() :( | 20:00 |
| ayoung | OK..so it is the API that scares me.... | 20:00 |
| *** ccard_ has quit IRC | 20:01 | |
| ayoung | that is going to be disabled by default, right? | 20:01 |
| *** jorge_munoz_ has quit IRC | 20:01 | |
| *** browne has quit IRC | 20:01 | |
| henrynash | ayoung: yes, the config switch is set to False by default | 20:01 |
| ayoung | OK | 20:01 |
| marekd | dstanek: honestly, i would like to get rod of the way we do substitution today (with .format() ) | 20:02 |
| *** browne has joined #openstack-keystone | 20:02 | |
| ayoung | henrynash, you have a test that confirms that? | 20:02 |
| henrynash | ayoung: hmm, now that’s probably a fair point :-) | 20:02 |
| henrynash | ayoung: I’ll add one | 20:02 |
| ayoung | henrynash, that would be a deal breaker for me. I can't accidentally enable an API that can change configs.... | 20:03 |
| *** ccard_ has joined #openstack-keystone | 20:03 | |
| ayoung | thanks | 20:03 |
| ayoung | henrynash, +2 A on the ldap logging. If you rebase that or something, feel free to re-apply my +2A | 20:03 |
| henrynash | ayoung: thx | 20:04 |
| *** joesavak has joined #openstack-keystone | 20:04 | |
| marekd | dstanek: makes more sense now? | 20:05 |
| dstanek | marekd: yes, fairly complicated though :-) mostly due to the distributed nature of the logic. | 20:06 |
| *** jsavak has quit IRC | 20:06 | |
| dstanek | marekd: for example i would say the str-ing the is wrong because i don't see the ast.literal_eval | 20:07 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use choices in config.py https://review.openstack.org/157890 | 20:07 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 20:07 |
| *** jorge_munoz has quit IRC | 20:07 | |
| marekd | dstanek: well, i am not the original author, but read the code and added many fixes there and yes...now i also had to 'rethink' what's going on. So i can imagine it is not super straightforward. | 20:07 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Implements whitelist and blacklist mapping rules https://review.openstack.org/142573 | 20:08 |
| *** ccard__ has joined #openstack-keystone | 20:08 | |
| marekd | dstanek: dtr'ing is done from the beginning | 20:08 |
| marekd | str'ing | 20:08 |
| *** _cjones_ has quit IRC | 20:09 | |
| kfox1111 | larsks: ok. thanks. | 20:10 |
| *** ccard_ has quit IRC | 20:10 | |
| *** _cjones_ has joined #openstack-keystone | 20:13 | |
| *** jsavak has joined #openstack-keystone | 20:15 | |
| *** _cjones_ has quit IRC | 20:18 | |
| *** joesavak has quit IRC | 20:18 | |
| dstanek | marekd: i think it just needs a little refactoring | 20:19 |
| *** topol has joined #openstack-keystone | 20:20 | |
| *** ChanServ sets mode: +v topol | 20:20 | |
| *** _cjones_ has joined #openstack-keystone | 20:21 | |
| lbragstad | marekd: so _is_mapped_token is what determines if we're dealing with a federated token in the token provider api, correct? https://github.com/openstack/keystone/blob/ec8f6070abf7576d37837bdf5aec45bc7a055f15/keystone/token/providers/common.py#L430-L432 | 20:23 |
| *** radez is now known as radez_g0n3 | 20:26 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample config file https://review.openstack.org/160970 | 20:27 |
| marekd | lbragstad: yes | 20:27 |
| lbragstad | marekd: cool | 20:27 |
| marekd | dstanek: uh.... | 20:27 |
| *** gyee has quit IRC | 20:28 | |
| bknudson | lbragstad: now there's more places to use choices... | 20:28 |
| bknudson | notification_format | 20:28 |
| lbragstad | bknudson: awesome! | 20:28 |
| lbragstad | bknudson: I'll rebase on your sample config update when it merges | 20:29 |
| bknudson | lbragstad: btw -- looks like oslo config generator doesn't list the allowed values. | 20:32 |
| bknudson | in the generated help text. | 20:32 |
| stevemar | thanks bknudson | 20:32 |
| lbragstad | bknudson: I wonder if they plan to build that in? | 20:32 |
| bknudson | stevemar: for what?? | 20:32 |
| stevemar | for updating sample config | 20:32 |
| stevemar | it was getting pretty out of date | 20:32 |
| lbragstad | bknudson: I feel like that would be helpful if you're going to have choices in there | 20:33 |
| stevemar | lbragstad, totally | 20:33 |
| stevemar | lbragstad, i feel that's an error on oslo.config's part | 20:33 |
| bknudson | lbragstad: I'll ask in oslo. | 20:33 |
| *** jorge_munoz has joined #openstack-keystone | 20:34 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Remove extra semicolon from mapping fixtures https://review.openstack.org/148080 | 20:35 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 20:35 |
| *** timcline has quit IRC | 20:39 | |
| lbragstad | dolphm: from our conversation earlier about audit_id info https://github.com/openstack/keystone/blob/ec8f6070abf7576d37837bdf5aec45bc7a055f15/keystone/token/provider.py#L83 | 20:53 |
| dolphm | lbragstad: ... why?! | 20:53 |
| lbragstad | dolphm: I was wrong. they are uuid4 | 20:53 |
| lbragstad | dolphm: i'm not entirely sure why they are base64 encoded. | 20:54 |
| *** timcline has joined #openstack-keystone | 20:54 | |
| dolphm | lbragstad: but why the fsck are they b64 encoded and then mutilated? | 20:54 |
| lbragstad | dolphm: I think they only live in the token_data dict | 20:54 |
| lbragstad | dolphm: morganfainberg might have an answer? | 20:55 |
| lbragstad | dolphm: looks like there was a specific commit made for making them b64 safe | 20:55 |
| lbragstad | https://github.com/openstack/keystone/commit/db6869d616c1315fff8cb93771f59cb961887c18 | 20:56 |
| dolphm | lbragstad: i assume that's just to make them shorter? | 20:56 |
| dolphm | morganfainberg: why do audit ID's need to be url safe? | 20:56 |
| lbragstad | dolphm: we can do that with uuid.bytes? | 20:57 |
| morganfainberg | Uhmmmmmmmm. I don't remember. | 20:57 |
| morganfainberg | There was a reason for it. | 20:57 |
| morganfainberg | They were b64 since bytes sucked to work with in json, and the :-2 was because we didn't need the padding that was the same every time. | 20:58 |
| *** raildo_ has joined #openstack-keystone | 20:58 | |
| morganfainberg | Url safe... I don't remember why. But there was a definitive reason. | 20:59 |
| *** jeffDeville has quit IRC | 20:59 | |
| *** samueldmq is now known as samueldmq-away | 20:59 | |
| morganfainberg | Uuid -> b64 also was shorter than .hex in string form fwiw. | 20:59 |
| dolphm | morganfainberg: that's it? | 21:01 |
| morganfainberg | Yep. | 21:01 |
| morganfainberg | 20characters vs 32. | 21:01 |
| dolphm | morganfainberg: do audit IDs ever appear in URLs or something? | 21:01 |
| morganfainberg | Not today. I think we wanted to at one point. | 21:01 |
| morganfainberg | But hat derailed | 21:02 |
| *** jeffDeville has joined #openstack-keystone | 21:02 | |
| lbragstad | what if we do something like https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/token_formatters.py#L77-L78 | 21:03 |
| lbragstad | ? | 21:03 |
| lbragstad | >>> len(uuid.UUID(uuid.uuid4().hex).bytes) | 21:04 |
| lbragstad | 16 | 21:04 |
| morganfainberg | lbragstad: as long as the audit ids end up conforming to the spec of a "short string" in the exploded token body returned by validate. | 21:04 |
| lbragstad | so is 16 too long? | 21:04 |
| morganfainberg | lbragstad: bytes is really awful to work with in the string repr. | 21:04 |
| morganfainberg | So you need to make it a string before representing it in json / logging / etc | 21:04 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 21:05 |
| morganfainberg | It should always be printable characters. Bytes does not guarantee that. | 21:05 |
| morganfainberg | I don't care what goes in the msgpacked token id | 21:05 |
| dolphm | lbragstad: i don't quite know how you'd reliably go from base64.urlsafe_b64encode(uuid.uuid4().bytes)[:-2] to a hex-encoded string for input to uuid.UUID() ? | 21:05 |
| morganfainberg | I care what is represented outside of that. | 21:05 |
| morganfainberg | In json / to services / from validate. | 21:06 |
| *** radez_g0n3 is now known as radez | 21:06 | |
| dolphm | lbragstad: can you just pass bytes to msgpack? | 21:07 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 21:07 |
| lbragstad | dolphm: I think so | 21:07 |
| lbragstad | dolphm: that's what we do with uuid | 21:07 |
| dolphm | lbragstad: oh, then put the audit IDs in as bytes | 21:07 |
| dolphm | lbragstad: bah, that's right | 21:07 |
| lbragstad | msgpack takes care of it | 21:07 |
| dolphm | lbragstad: let me put up a refactor... | 21:08 |
| lbragstad | cool, | 21:08 |
| henrynash | bknudson: thanks for detailed review of https://review.openstack.org/#/c/158679/ - all items fixed up | 21:08 |
| lbragstad | dolphm: working on a federated token formatter that will probably need to be rebased if we decided to move the token schema logic into token_formatters | 21:08 |
| morganfainberg | Yeah. It doesn't matter what is in the packed data. Just what is resulted in the other end(s) | 21:08 |
| henrynash | ayoung, stevemar: see above | 21:08 |
| ayoung | henrynash, tooo much above. see what? | 21:09 |
| henrynash | ayoung, stevemar: bknudson: thanks for detailed review of https://review.openstack.org/#/c/158679/ - all items fixed up | 21:09 |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 21:10 |
| lbragstad | morganfainberg: I *think* it should be good since the only time a uuid.bytes representation exists is in the token_formatter and before sending things to msgpack | 21:10 |
| morganfainberg | That's fine. | 21:11 |
| morganfainberg | No concerns with that. | 21:11 |
| ayoung | henrynash, you can drop about 90% of the LDAP options there. | 21:11 |
| ayoung | Just saying | 21:11 |
| henrynash | ayoung: meaning that most of them are unlikely to be used? They are the ones that *could* have an affect on the identity driver | 21:12 |
| *** Bsony has quit IRC | 21:12 | |
| henrynash | ayoung: btw, regarding the check to make sure all this is disabeld by default…I’ll add that further up teh chain atthe point anything in the domain config sql tables is actually wired up | 21:13 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: refactor: extract and document audit ID generation https://review.openstack.org/160980 | 21:13 |
| henrynash | ayoung: i.e. here: https://review.openstack.org/#/c/159675/ | 21:14 |
| dolphm | morganfainberg: ^ lbragstad: now you can use that to "safely" decode the audit ID into bytes | 21:14 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 21:15 |
| morganfainberg | dolphm: sure. Or we could just make audit id a provider owned thing and fernet can handle that however it wants. | 21:17 |
| dolphm | morganfainberg: this seems simpler :) | 21:17 |
| morganfainberg | So move audit id generation down to the base driver and override however you want. | 21:18 |
| morganfainberg | Doesn't bother me either way. This just feels like needless to/from strings for fernet. | 21:18 |
| morganfainberg | But again not a huge impact. | 21:18 |
| *** thedodd has joined #openstack-keystone | 21:20 | |
| *** browne has quit IRC | 21:22 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: refactor: extract and document audit ID generation https://review.openstack.org/160980 | 21:23 |
| morganfainberg | notmyname: I'd like to get your take on the fernet tokens as they sit for swift (now that they merged). Post meetings of course. | 21:23 |
| *** browne has joined #openstack-keystone | 21:23 | |
| notmyname | morganfainberg: ack | 21:23 |
| openstackgerrit | Merged openstack/keystone: Remove conditional check (and test) for oauth_api https://review.openstack.org/159671 | 21:24 |
| *** Tahmina has joined #openstack-keystone | 21:26 | |
| notmyname | morganfainberg: I think I win the "disrupt openstack meetings" badge ;-) | 21:29 |
| notmyname | morganfainberg: got a doc for me to look at to know what fernet tokens are? | 21:30 |
| openstackgerrit | Merged openstack/keystone: Implement backend driver support for domain config https://review.openstack.org/158051 | 21:31 |
| morganfainberg | notmyname: will get you some info post meeting. Or lbragstad and dolphm can as well. | 21:31 |
| *** jsavak has quit IRC | 21:31 | |
| *** samueldmq_ has joined #openstack-keystone | 21:31 | |
| *** pnavarro has quit IRC | 21:34 | |
| *** samueldmq_ is now known as samueldmq | 21:34 | |
| dolphm | notmyname: https://github.com/fernet/spec | 21:35 |
| *** Tahmina has quit IRC | 21:35 | |
| dolphm | notmyname: verify.json has an example of one | 21:35 |
| *** remote_morgan_ has quit IRC | 21:36 | |
| lbragstad | dolphm: you can roll this into your patch if you want to http://cdn.pasteraw.com/gwystlxhrflbg0xhkk25nw2yot9cd9h | 21:36 |
| dolphm | lbragstad: put it up as a dependent patch | 21:37 |
| dolphm | lbragstad: are you just handling it differently if it's one to save space? | 21:39 |
| dolphm | one element* | 21:39 |
| *** browne has quit IRC | 21:39 | |
| *** browne has joined #openstack-keystone | 21:39 | |
| lbragstad | dolphm: I was handling the case where it might be a list, | 21:39 |
| lbragstad | morganfainberg: are audit_ids always in a list? | 21:40 |
| lbragstad | morganfainberg: even if it's just one? | 21:40 |
| morganfainberg | lbragstad: yes. | 21:40 |
| lbragstad | oh | 21:40 |
| morganfainberg | Or should be. | 21:40 |
| lbragstad | dolphm: in that case, I'll fix better | 21:40 |
| dolphm | morganfainberg: and it's always either one or two, never an unbounded list? | 21:40 |
| morganfainberg | dolphm: correct | 21:40 |
| morganfainberg | It is either 1: the original token issued or 2: a token that was rescoped | 21:41 |
| morganfainberg | But never more than 2. | 21:41 |
| dolphm | morganfainberg: what if it's a rescoped rescoped token? | 21:41 |
| morganfainberg | You always maintain the original token if and current token Id | 21:41 |
| *** stevemar has quit IRC | 21:41 | |
| morganfainberg | You don't care about the intermediary ids. | 21:41 |
| dolphm | morganfainberg: hmm, alright | 21:42 |
| morganfainberg | S/if/id | 21:42 |
| dolphm | morganfainberg: remind me to ask you why in vancouver | 21:42 |
| morganfainberg | The idea being that we want to drive towards no rescoping a scoped token | 21:42 |
| morganfainberg | And the important part is being able to invalidate a whole session. But not needing to chase a chain to figure that out. | 21:43 |
| morganfainberg | How often do you revoke this token and subordinate tokens? It's not common. | 21:44 |
| morganfainberg | Or not doable :P | 21:44 |
| *** EmilienM has quit IRC | 21:44 | |
| *** EmilienM has joined #openstack-keystone | 21:44 | |
| *** jeffDeville has quit IRC | 21:44 | |
| *** gyee has joined #openstack-keystone | 21:44 | |
| *** ChanServ sets mode: +v gyee | 21:44 | |
| morganfainberg | So we opted for either "this token" or the more nuclear option of "all tokens in a chain" | 21:44 |
| morganfainberg | But not needing to revoke all tokens for a user. | 21:45 |
| dolphm | cool | 21:45 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Convert audit_ids to bytes before msgpacking https://review.openstack.org/160993 | 21:46 |
| lbragstad | dolphm: ^ | 21:46 |
| dolphm | lbragstad: you need to decode the bytes back to strings | 21:47 |
| dolphm | lbragstad: in validate | 21:48 |
| dolphm | lbragstad: right? | 21:48 |
| lbragstad | dolphm: yeah, pushing up another revision | 21:50 |
| morganfainberg | It just seems silly to do bytes -> str -> bytes -> pack -> unpack -> str | 21:52 |
| *** trey has quit IRC | 21:52 | |
| morganfainberg | You could do bytes -> pack -> unpack -> str | 21:52 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add Request ID to outbound calls when set https://review.openstack.org/155672 | 21:53 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add service token to user token plugin https://review.openstack.org/141614 | 21:53 |
| *** jeffDeville has joined #openstack-keystone | 21:54 | |
| *** trey has joined #openstack-keystone | 21:54 | |
| *** jeffDeville has quit IRC | 21:57 | |
| *** mattfarina has quit IRC | 21:59 | |
| notmyname | dolphm: thanks. got any python examples on what a client needs to do? any way I can use this with curl? | 22:00 |
| morganfainberg | notmyname: works the same as uuid tokens, just a little larger (255bytes max) | 22:03 |
| dolphm | notmyname: set keystone's token provider to .fernet. instead of .uuid. and authenticate against v3 | 22:03 |
| dolphm | notmyname: ooh, and run keystone-manage fernet_setup :) | 22:03 |
| morganfainberg | Yeah v3 is needed atm. V2 patch is pending. | 22:03 |
| morganfainberg | dolphm: ++ | 22:03 |
| *** pmath has joined #openstack-keystone | 22:04 | |
| dolphm | morganfainberg: next thing to document ^^ | 22:04 |
| morganfainberg | dolphm: hehe. | 22:04 |
| morganfainberg | How close are we to getting v2 happy? | 22:04 |
| morganfainberg | I'd like to get the last of these things gating today (and related: federated tokens) | 22:04 |
| dolphm | morganfainberg: jorge_munoz and lbragstad are looking for the best way to do something analagous to the v3 token data "helper" | 22:05 |
| *** topol has quit IRC | 22:05 | |
| *** edmondsw has joined #openstack-keystone | 22:05 | |
| lbragstad | since we have to reconstruct the token data | 22:05 |
| morganfainberg | That's hard cause the bad "take crap data and shove it into the token" that v2 does now. | 22:05 |
| morganfainberg | This was part of the fix the provider cleanup. You may just want to make everything v3 then do a v3 -> v2 converter. | 22:06 |
| morganfainberg | Just mangle v3 data to v2 when asked. | 22:06 |
| morganfainberg | For fernet that is. | 22:07 |
| morganfainberg | V3 has all the data needed to construct a v2 token. So should be easy to do so. | 22:08 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 22:11 |
| *** gyee has quit IRC | 22:13 | |
| *** devlaps has joined #openstack-keystone | 22:13 | |
| *** devlaps has quit IRC | 22:13 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 22:13 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 22:14 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 22:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Convert audit_ids to bytes before msgpacking https://review.openstack.org/160993 | 22:18 |
| *** Bsony has joined #openstack-keystone | 22:19 | |
| *** Bsony has quit IRC | 22:23 | |
| pmath | keystone ImportError: No module named access | 22:27 |
| pmath | is this a known issue or a bad upgrade on my part? | 22:27 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 22:27 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 22:27 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 22:27 |
| morganfainberg | pmath, haven't seen that before | 22:27 |
| morganfainberg | so not a known issue as far as i am aware | 22:28 |
| pmath | k thanks | 22:28 |
| *** gyee has joined #openstack-keystone | 22:33 | |
| *** ChanServ sets mode: +v gyee | 22:33 | |
| *** timcline has quit IRC | 22:42 | |
| dolphm | /sigh vancouver comes up in our expense report system as "Vancouver, United States of America" | 22:42 |
| bknudson | vancouver washington? | 22:43 |
| dstanek | dolphm: isn't Canada a US territory? | 22:43 |
| morganfainberg | yeah don't forget there is a vancouver WA | 22:43 |
| *** stevemar has joined #openstack-keystone | 22:44 | |
| *** ChanServ sets mode: +v stevemar | 22:44 | |
| openstackgerrit | Merged openstack/keystone: remove old docstr referring to keyczar https://review.openstack.org/160930 | 22:44 |
| dolphm | dstanek: morganfainberg: Canada isn't even listed in "Travel Cities by Country" | 22:44 |
| *** ayoung has quit IRC | 22:45 | |
| dstanek | dolphm: "other" maybe? | 22:45 |
| dstanek | i guess we don't like our neighbors | 22:45 |
| dolphm | dstanek: there actually is an "Other" if you search for "Other" -- no idea how to find that in the UI though | 22:46 |
| dolphm | lbragstad: i love that this merged with you as the blamer https://github.com/openstack/keystone/blame/master/keystone/tests/unit/token/test_fernet_provider.py#L207-L210 sorry | 22:50 |
| dstanek | dolphm: lbragstad: ouch | 22:51 |
| *** openstackgerrit has quit IRC | 22:51 | |
| *** openstackgerrit has joined #openstack-keystone | 22:51 | |
| morganfainberg | dolphm, wheeee: http://www.macrumors.com/2015/03/03/apple-freak-security-flaw/ | 23:02 |
| *** nkinder has quit IRC | 23:04 | |
| *** spandhe has quit IRC | 23:05 | |
| dstanek | why does gerrit spit out )]}' before the opening { when using the rest API? | 23:08 |
| henrynash | bknudson: thanks for the further review…working on fixes now | 23:10 |
| openstackgerrit | Merged openstack/keystone: Deprecate Eventlet Deployment in favor of wsgi containers https://review.openstack.org/157495 | 23:12 |
| openstackgerrit | Merged openstack/keystone: refactor: extract fernet packing & unpacking methods https://review.openstack.org/160932 | 23:12 |
| openstackgerrit | Merged openstack/keystone: refactor: consistently refer to "unpacked tokens" as the token's "payload" https://review.openstack.org/160940 | 23:13 |
| *** raildo_ has quit IRC | 23:13 | |
| *** Ephur has joined #openstack-keystone | 23:16 | |
| *** CF_ has joined #openstack-keystone | 23:16 | |
| *** ChristyF has quit IRC | 23:17 | |
| doug-fish | where do the unit tests for auth plugins reside? | 23:21 |
| jamielennox | hey, someone want to approve: https://review.openstack.org/#/c/158503/ ? moving functional tests from tempest to ksc | 23:24 |
| jamielennox | doug-fish: ksc/tests/auth | 23:24 |
| *** spandhe has joined #openstack-keystone | 23:24 | |
| doug-fish | thx! | 23:25 |
| *** stevemar has quit IRC | 23:29 | |
| *** chlong has joined #openstack-keystone | 23:31 | |
| openstackgerrit | Merged openstack/keystone: log query string instead of openstack.params and request args https://review.openstack.org/160955 | 23:34 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:36 | |
| *** jorge_munoz has left #openstack-keystone | 23:39 | |
| *** edmondsw has quit IRC | 23:49 | |
| *** gordc has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!