| gyee | henrynash_, yes, looking now | 00:01 |
|---|---|---|
| henrynash_ | gyee: thx | 00:02 |
| *** ayoung has quit IRC | 00:04 | |
| henrynash_ | lbragstad: thanks for issueing a recheck on https://review.openstack.org/#/c/266617/ it came back good, let me know if you haev questions on it that prevent approval…thanks | 00:09 |
| *** quick_question has joined #openstack-keystone | 00:22 | |
| quick_question | Hi all! | 00:23 |
| quick_question | Is anybody know how manage permissions to region? | 00:23 |
| quick_question | I see 'add_endpoint_group_to_project' in 'keystone/policy.json' | 00:23 |
| quick_question | is it right direction? | 00:23 |
| *** jsavak has joined #openstack-keystone | 00:24 | |
| *** timcline has joined #openstack-keystone | 00:24 | |
| *** quick_question has quit IRC | 00:32 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264346 | 00:34 |
| *** tsymanczyk has joined #openstack-keystone | 00:34 | |
| *** tsymanczyk is now known as Guest12155 | 00:35 | |
| *** spzala has joined #openstack-keystone | 00:37 | |
| *** spzala has quit IRC | 00:42 | |
| *** jsavak has quit IRC | 00:47 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Support the reading of default values of domain configuration options https://review.openstack.org/260335 | 00:52 |
| *** lhcheng_ has quit IRC | 00:55 | |
| *** ayoung has joined #openstack-keystone | 00:58 | |
| *** ChanServ sets mode: +v ayoung | 00:58 | |
| *** timcline has quit IRC | 00:59 | |
| *** fawadkhaliq has joined #openstack-keystone | 01:00 | |
| *** shoutm has joined #openstack-keystone | 01:00 | |
| *** EinstCrazy has joined #openstack-keystone | 01:07 | |
| *** Guest12155 has quit IRC | 01:07 | |
| *** lhcheng has joined #openstack-keystone | 01:08 | |
| *** ChanServ sets mode: +v lhcheng | 01:08 | |
| *** ankita_w_ has quit IRC | 01:18 | |
| *** henrynash_ has quit IRC | 01:21 | |
| *** henrynash_ has joined #openstack-keystone | 01:22 | |
| *** ChanServ sets mode: +v henrynash_ | 01:22 | |
| *** tsymancz1k has joined #openstack-keystone | 01:22 | |
| *** shoutm_ has joined #openstack-keystone | 01:23 | |
| *** shoutm has quit IRC | 01:24 | |
| *** _zouyee has joined #openstack-keystone | 01:27 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Support the reading of default values of domain configuration options https://review.openstack.org/260335 | 01:27 |
| *** davechen has joined #openstack-keystone | 01:30 | |
| *** tsymancz1k is now known as tsymanczyk | 01:31 | |
| *** henrynash_ has quit IRC | 01:32 | |
| *** _cjones_ has quit IRC | 01:33 | |
| *** spzala has joined #openstack-keystone | 01:38 | |
| *** shoutm_ has quit IRC | 01:41 | |
| *** _zouyee has quit IRC | 01:43 | |
| *** spzala has quit IRC | 01:43 | |
| *** shoutm has joined #openstack-keystone | 01:45 | |
| *** csoukup has joined #openstack-keystone | 01:48 | |
| *** shoutm_ has joined #openstack-keystone | 02:11 | |
| *** shoutm has quit IRC | 02:13 | |
| *** spzala has joined #openstack-keystone | 02:19 | |
| *** richm has quit IRC | 02:26 | |
| *** c_soukup has joined #openstack-keystone | 02:28 | |
| *** csoukup has quit IRC | 02:31 | |
| *** wanghua has joined #openstack-keystone | 02:34 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 02:40 | |
| *** henrynash_ has joined #openstack-keystone | 02:45 | |
| *** ChanServ sets mode: +v henrynash_ | 02:45 | |
| davechen | notmorgan, stevemar: I want to bug you that there might be still some issues from `keystone-manage bootstrap`. | 02:48 |
| davechen | https://bugs.launchpad.net/keystone/+bug/1534140 | 02:48 |
| openstack | Launchpad bug 1534140 in OpenStack Identity (keystone) "keystone-manage bootstrap should not create user/project if it fails" [Undecided,New] - Assigned to Dave Chen (wei-d-chen) | 02:48 |
| *** edmondsw has quit IRC | 02:49 | |
| davechen | the user/project or whatever should not be created if the bootstrap fails, it make end user to remove them manually. | 02:49 |
| davechen | and hard to identify the root cause is where they are. | 02:49 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 02:49 | |
| davechen | rollback may helpful in this case. | 02:50 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Improve Conflict error message in IdP creation https://review.openstack.org/265279 | 02:51 |
| *** lhcheng has quit IRC | 02:52 | |
| *** tonytan4ever has quit IRC | 02:53 | |
| *** fawadkhaliq has quit IRC | 02:54 | |
| *** spandhe has quit IRC | 03:06 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 03:09 | |
| *** dims has quit IRC | 03:11 | |
| *** ngupta has joined #openstack-keystone | 03:14 | |
| henrynash_ | stevemar: a couple of (hopefully) quick ones for you to approve: https://review.openstack.org/#/c/266617/ and https://review.openstack.org/#/c/260335/ | 03:15 |
| *** _zouyee has joined #openstack-keystone | 03:17 | |
| *** jasonsb has joined #openstack-keystone | 03:20 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add schema for OAuth1 consumer API https://review.openstack.org/266791 | 03:23 |
| *** shoutm has joined #openstack-keystone | 03:25 | |
| lbragstad | stevemar can you review this guy again - https://review.openstack.org/#/c/266617/ | 03:25 |
| *** shoutm_ has quit IRC | 03:26 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity https://review.openstack.org/262045 | 03:34 |
| *** gyee has quit IRC | 03:49 | |
| *** links has joined #openstack-keystone | 03:49 | |
| *** links has quit IRC | 03:56 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:20 | |
| *** vgridnev has joined #openstack-keystone | 04:33 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 04:35 | |
| *** itlinux has joined #openstack-keystone | 04:35 | |
| *** yogirackspace has joined #openstack-keystone | 04:39 | |
| *** links has joined #openstack-keystone | 04:40 | |
| *** yogirackspace has quit IRC | 04:43 | |
| *** fawadkhaliq has quit IRC | 04:51 | |
| *** itlinux has quit IRC | 05:06 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:08 | |
| *** vivekd has joined #openstack-keystone | 05:16 | |
| *** jaosorior has joined #openstack-keystone | 05:19 | |
| *** chlong has joined #openstack-keystone | 05:24 | |
| *** spzala has quit IRC | 05:24 | |
| *** agireud has quit IRC | 05:27 | |
| *** agireud has joined #openstack-keystone | 05:28 | |
| *** sirushti has quit IRC | 05:34 | |
| *** itlinux has joined #openstack-keystone | 05:37 | |
| *** wanghua has quit IRC | 05:44 | |
| openstackgerrit | Dave Chen proposed openstack/keystone-specs: Enable `id`, `enabled` filter for list IdP https://review.openstack.org/267949 | 05:50 |
| openstackgerrit | Dave Chen proposed openstack/keystone-specs: Enable `id`, `enabled` filter for list IdP https://review.openstack.org/267949 | 05:53 |
| *** _zouyee has quit IRC | 06:00 | |
| *** Nirupama has joined #openstack-keystone | 06:00 | |
| *** vivekd has quit IRC | 06:01 | |
| *** boris-42 has quit IRC | 06:03 | |
| *** c_soukup has quit IRC | 06:04 | |
| *** Ephur has quit IRC | 06:11 | |
| *** vgridnev has quit IRC | 06:12 | |
| *** henrynash_ has quit IRC | 06:14 | |
| stevemar | henrynash: yep, i have it open | 06:14 |
| stevemar | lbragstad: i'll try! | 06:15 |
| *** agireud has quit IRC | 06:16 | |
| *** agireud has joined #openstack-keystone | 06:18 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Support the reading of default values of domain configuration options https://review.openstack.org/260335 | 06:20 |
| *** ankita_wagh has joined #openstack-keystone | 06:25 | |
| *** ninag has joined #openstack-keystone | 06:33 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix indentation for oauth context https://review.openstack.org/267649 | 06:37 |
| *** ninag has quit IRC | 06:37 | |
| *** chlong has quit IRC | 06:40 | |
| *** agireud has quit IRC | 06:42 | |
| *** jasonsb has quit IRC | 06:42 | |
| *** agireud has joined #openstack-keystone | 06:44 | |
| *** jaosorior has quit IRC | 06:45 | |
| *** jaosorior has joined #openstack-keystone | 06:46 | |
| *** vgridnev has joined #openstack-keystone | 06:52 | |
| *** jaosorior has quit IRC | 06:55 | |
| *** gildub has quit IRC | 07:02 | |
| *** agireud has quit IRC | 07:08 | |
| *** _zouyee has joined #openstack-keystone | 07:09 | |
| openstackgerrit | Merged openstack/oslo.policy: Add oslopolicy-checker command-line tool https://review.openstack.org/170978 | 07:09 |
| *** agireud has joined #openstack-keystone | 07:10 | |
| *** jaosorior has joined #openstack-keystone | 07:11 | |
| *** links has quit IRC | 07:17 | |
| *** vivekd has joined #openstack-keystone | 07:19 | |
| *** fawadkhaliq has quit IRC | 07:29 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:29 | |
| *** links has joined #openstack-keystone | 07:30 | |
| stevemar | night keystone is quiet tonight | 07:35 |
| *** links has quit IRC | 07:39 | |
| *** vivekd has quit IRC | 07:41 | |
| *** links has joined #openstack-keystone | 07:41 | |
| *** ankita_wagh has quit IRC | 07:43 | |
| *** vivekd has joined #openstack-keystone | 07:45 | |
| *** fawadkhaliq has quit IRC | 08:08 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:09 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3) https://review.openstack.org/267456 | 08:09 |
| *** pnavarro has joined #openstack-keystone | 08:15 | |
| *** vivekd has quit IRC | 08:16 | |
| *** vgridnev has quit IRC | 08:16 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3/contrib) https://review.openstack.org/268003 | 08:20 |
| *** fawadkhaliq has quit IRC | 08:20 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:21 | |
| stevemar | jamielennox: did ksm go from assertRaises to with mock.patch.object in it's tests between kilo and liberty? | 08:33 |
| stevemar | for general checking of exceptions? | 08:33 |
| jamielennox | stevemar: ahh, i don't think so - doesn't it still use assertTraises? | 08:34 |
| stevemar | jamielennox: https://review.openstack.org/#/c/230157/2 | 08:34 |
| stevemar | the tests specifically | 08:34 |
| *** shoutm_ has joined #openstack-keystone | 08:35 | |
| stevemar | jamielennox: having trouble with tests, not just the ones included in the backport | 08:36 |
| *** shoutm has quit IRC | 08:36 | |
| stevemar | locally anyway | 08:36 |
| *** daemontool has joined #openstack-keystone | 08:36 | |
| stevemar | jamielennox: i noticed that there is a call in liberty... call_middleware | 08:37 |
| stevemar | instead of set_middleware and then calling self.middleware() | 08:37 |
| jamielennox | we moved a bunch of stuff around in there over the last cycle or two | 08:37 |
| stevemar | yeah, it's making backports hard >.< | 08:37 |
| stevemar | http://paste.openstack.org/show/483975/ | 08:38 |
| stevemar | there we go ^ | 08:38 |
| stevemar | that's why i asked about assertions, all the failures look like they are not catching exceptions when they should | 08:38 |
| *** shoutm_ has quit IRC | 08:40 | |
| stevemar | well i'm stuck | 08:45 |
| stevemar | just compared the kilo proposed backport with the liberty one, and they look the same to me | 08:46 |
| * stevemar shrugs | 08:46 | |
| *** itlinux has quit IRC | 08:49 | |
| stevemar | jamielennox: if you have 5 minutes, take a look, i'm scratching my head as to why it's failing: https://jenkins02.openstack.org/job/gate-keystonemiddleware-python27/125/console | 08:54 |
| stevemar | this was the *last* thing on my todo list :@ | 08:54 |
| stevemar | it has defeated me | 08:54 |
| jamielennox | hmm, where those errors are raise might hvae moved | 08:55 |
| *** csoukup_ has joined #openstack-keystone | 09:00 | |
| *** ninag has joined #openstack-keystone | 09:00 | |
| *** csoukup_ has quit IRC | 09:05 | |
| *** ninag has quit IRC | 09:05 | |
| *** belmoreira has joined #openstack-keystone | 09:05 | |
| *** fhubik has joined #openstack-keystone | 09:07 | |
| *** fawadkhaliq has quit IRC | 09:09 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:09 | |
| *** mhickey has joined #openstack-keystone | 09:11 | |
| *** fhubik has quit IRC | 09:12 | |
| *** vgridnev has joined #openstack-keystone | 09:15 | |
| *** jistr has joined #openstack-keystone | 09:27 | |
| *** gildub has joined #openstack-keystone | 09:36 | |
| *** vivekd has joined #openstack-keystone | 09:51 | |
| *** davechen has left #openstack-keystone | 09:55 | |
| *** EinstCrazy has quit IRC | 10:08 | |
| *** e0ne has joined #openstack-keystone | 10:08 | |
| *** EinstCrazy has joined #openstack-keystone | 10:08 | |
| *** EinstCrazy has quit IRC | 10:14 | |
| *** mhickey has quit IRC | 10:25 | |
| *** thiagolib has joined #openstack-keystone | 10:28 | |
| thiagolib | someone did deploy the opentack Solaris 11 and have seen this error svcadm : Instance " svc : / application / OpenStack / Keystone : default " is in maintenance state . | 10:29 |
| *** fhubik has joined #openstack-keystone | 10:37 | |
| *** shoutm has joined #openstack-keystone | 10:38 | |
| *** gildub has quit IRC | 10:42 | |
| *** mhickey has joined #openstack-keystone | 10:44 | |
| *** sileht has quit IRC | 10:48 | |
| *** sileht has joined #openstack-keystone | 10:48 | |
| *** agireud has quit IRC | 10:49 | |
| *** agireud has joined #openstack-keystone | 10:51 | |
| *** _zouyee has quit IRC | 10:53 | |
| *** ninag has joined #openstack-keystone | 10:55 | |
| *** ninag has quit IRC | 10:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264346 | 11:03 |
| *** dims has joined #openstack-keystone | 11:12 | |
| *** hughsaunders_ has joined #openstack-keystone | 11:26 | |
| *** hughsaunders has quit IRC | 11:27 | |
| *** hughsaunders_ is now known as hughsaunders | 11:27 | |
| samueldmq | morning keystoners | 11:34 |
| *** fawadkhaliq has quit IRC | 11:57 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:58 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy SQL driver https://review.openstack.org/212006 | 12:14 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy drivers https://review.openstack.org/212006 | 12:19 |
| *** agireud has quit IRC | 12:25 | |
| *** agireud has joined #openstack-keystone | 12:27 | |
| *** EinstCrazy has joined #openstack-keystone | 12:28 | |
| *** Quick has joined #openstack-keystone | 12:32 | |
| Quick | Hello everyone! Is it possible to restrict access to the Region for the Tenant or User (Juno)? | 12:35 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for the policy drivers https://review.openstack.org/212957 | 12:36 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy drivers https://review.openstack.org/212006 | 12:39 |
| *** Nirupama has quit IRC | 12:45 | |
| Quick | Thanks, good point | 12:45 |
| *** fhubik is now known as fhubik_brb | 12:47 | |
| samueldmq | Quick: hi | 12:47 |
| samueldmq | Quick: I know there is endpoint_filtering so taht you can filter the endpoints that goes in a token (scoped to a project) for a given region | 12:48 |
| samueldmq | Quick: if that's what you're looking for ... | 12:48 |
| samueldmq | Quick: but I am not sure that's available in Juno | 12:49 |
| samueldmq | Quick: let me check | 12:49 |
| *** openstackgerrit has quit IRC | 12:50 | |
| samueldmq | Quick: yes endpoint_filter extension is available in juno, which EOL has passed btw | 12:50 |
| *** openstackgerrit has joined #openstack-keystone | 12:50 | |
| samueldmq | Quick: https://github.com/openstack/keystone/blob/juno-eol/keystone/contrib/endpoint_filter/core.py | 12:50 |
| Quick | I would like to split regions between tenants. Tenants A and B can use region 1, 2 and 3. Tenant C can use 3 and 4. | 12:52 |
| samueldmq | Quick: what if you filter endpoints from regions 1, 2 and 3 for projects A and B; and endpoints from regions 3 and 4 for project C ? | 12:54 |
| *** links has quit IRC | 12:55 | |
| Quick | As I understand it will be the same result. | 12:56 |
| Quick | Ideally Horizon should show available Regions only | 12:57 |
| *** links has joined #openstack-keystone | 12:58 | |
| *** raildo-afk is now known as raildo | 13:01 | |
| *** pauloewerton has joined #openstack-keystone | 13:02 | |
| *** links has quit IRC | 13:03 | |
| *** Quick has quit IRC | 13:09 | |
| *** ninag has joined #openstack-keystone | 13:21 | |
| *** alexpro has joined #openstack-keystone | 13:23 | |
| *** browne has joined #openstack-keystone | 13:23 | |
| *** fhubik_brb is now known as fhubik | 13:26 | |
| *** fawadkhaliq has quit IRC | 13:30 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:30 | |
| *** Ephur has joined #openstack-keystone | 13:34 | |
| *** vivekd has quit IRC | 13:36 | |
| *** iurygregory has quit IRC | 13:47 | |
| *** browne has quit IRC | 13:49 | |
| *** doug-fish has joined #openstack-keystone | 13:53 | |
| *** dslev has joined #openstack-keystone | 13:53 | |
| *** ngupta has quit IRC | 13:59 | |
| *** richm has joined #openstack-keystone | 13:59 | |
| *** csoukup has joined #openstack-keystone | 14:04 | |
| *** jsavak has joined #openstack-keystone | 14:05 | |
| *** spzala has joined #openstack-keystone | 14:07 | |
| *** fhubik is now known as fhubik_brb | 14:20 | |
| *** fhubik_brb is now known as fhubik | 14:24 | |
| *** fhubik has quit IRC | 14:24 | |
| *** browne has joined #openstack-keystone | 14:36 | |
| *** dansmith is now known as superdan | 14:43 | |
| *** jaosorior has quit IRC | 14:45 | |
| *** jaosorior has joined #openstack-keystone | 14:46 | |
| *** petertr7_away is now known as petertr7 | 14:51 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 14:56 |
| *** fawadkhaliq has quit IRC | 14:56 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 14:58 |
| *** fawadkhaliq has joined #openstack-keystone | 14:59 | |
| lbragstad | ayoung dolphm how do we want to handle bind in keystone with fernet tokens? We are 52 tests away from passing with fernet as the default for all keystone tests, some of which are 501 because fernet doesn't support bind authentication. | 15:01 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 15:02 |
| *** kibm has joined #openstack-keystone | 15:03 | |
| lbragstad | ayoung dolphm pinging you guys because I thought we had a conversation around this before | 15:04 |
| lbragstad | ayoung dolphm I want to say we punted on it because bind required us to pack things in the token that could be unbound. | 15:05 |
| *** EinstCrazy has quit IRC | 15:07 | |
| lbragstad | or if anyone else wants to weigh in ;) ^ | 15:07 |
| *** Ephur has quit IRC | 15:08 | |
| *** pauloewerton has quit IRC | 15:11 | |
| *** ericksonsantos has quit IRC | 15:11 | |
| *** jaosorior has quit IRC | 15:11 | |
| *** jaosorior has joined #openstack-keystone | 15:12 | |
| *** daemontool has quit IRC | 15:16 | |
| *** fawadkhaliq has quit IRC | 15:19 | |
| *** raildo is now known as raildo-afk | 15:20 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:24 | |
| *** timcline has joined #openstack-keystone | 15:25 | |
| tjcocozz | lbragstad, found this ... https://bugs.launchpad.net/keystone/+bug/1433311/comments/2 | 15:26 |
| openstack | Launchpad bug 1433311 in OpenStack Identity (keystone) "Fernet tokens don't support token bind" [Wishlist,Triaged] | 15:26 |
| lbragstad | tjcocozz ah - i thought it was something along those lines | 15:27 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Mark password/secret options as secret https://review.openstack.org/268198 | 15:27 |
| lbragstad | tjcocozz maybe i'll send a note to the mailing list | 15:27 |
| tjcocozz | lbragstad, in evesdrop it sounded like you were still going to push for it. What changed? | 15:28 |
| openstackgerrit | Brant Knudson proposed openstack/keystoneauth: Mark password/secret options as secret https://review.openstack.org/268199 | 15:29 |
| lbragstad | tjcocozz I was just concerned about breaking/people who rely on it but wanted to move to fernet | 15:30 |
| lbragstad | notmorgan was also a part of that conversationm | 15:31 |
| *** chmouel has quit IRC | 15:32 | |
| *** pnavarro has quit IRC | 15:33 | |
| *** aix has quit IRC | 15:33 | |
| *** freerunner has quit IRC | 15:34 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 15:35 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix indentation for oauth context https://review.openstack.org/267649 | 15:35 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 15:35 |
| *** jamie_h has joined #openstack-keystone | 15:35 | |
| *** pnavarro has joined #openstack-keystone | 15:35 | |
| ayoung | lbragstad, disable the bind tests. | 15:37 |
| lbragstad | ayoung so we won't be supporting bind with the default provider? | 15:38 |
| ayoung | lbragstad, correct | 15:38 |
| ayoung | lbragstad, bind does not do any good in a live lookup | 15:38 |
| *** chmouel has joined #openstack-keystone | 15:38 | |
| lbragstad | ok | 15:38 |
| ayoung | in order for bind to make sense we should do | 15:38 |
| ayoung | authenticate against the remote service and just query the keystone server for roles | 15:38 |
| ayoung | I have that as a spec, but Morgan has soemthing slightly better planned and we'll go with that | 15:39 |
| lbragstad | ayoung and that wouldn't require any bind auth to keystone directly | 15:39 |
| ayoung | lbragstad, I seriously doubt anyone is using bind | 15:39 |
| ayoung | nope | 15:39 |
| *** vryzhenkin has joined #openstack-keystone | 15:39 | |
| ayoung | the bind had to be set up on the initial token request | 15:39 |
| ayoung | the fact that it did work with uuid was kindof irrelelvant | 15:39 |
| lbragstad | ayoung awesome, thanks... i'll parse those | 15:44 |
| *** ngupta has joined #openstack-keystone | 15:44 | |
| *** ngupta has quit IRC | 15:46 | |
| jorge_munoz | I have been having issues redelegating a trusted token. I have taken the step of creating a trust (Trustor User A and Trustee User B) and authenticating with trust to generate a trusted token for User B. Using User’s B trusted token to create a new trust redelegated to User C, returns a 403 Forbbiden. Are these the correct step to redelegate a trust. If not, whose token should be used? | 15:47 |
| lbragstad | jorge_munoz that sounds like redelegation to me | 15:48 |
| lbragstad | jorge_munoz you did have `allow_redelegation` set to True on the trust you created between User A and User B, right? | 15:49 |
| jorge_munoz | lbragstad: yes | 15:49 |
| lbragstad | jorge_munoz was redelegation count set, too? | 15:49 |
| jorge_munoz | lbragstad: 3 | 15:49 |
| *** roxanagh_ has joined #openstack-keystone | 15:50 | |
| lbragstad | ok, so you have both set | 15:50 |
| lbragstad | and creating a new trust between User B and User C results in a 503? | 15:50 |
| jorge_munoz | 403 using the User B trusted token | 15:51 |
| lbragstad | jorge_munoz ah right - 403... | 15:51 |
| lbragstad | ayoung does that sound right to you? | 15:51 |
| lbragstad | ^ | 15:51 |
| ayoung | jorge_munoz, run it in the debugger, see what is actually kicking out the error. | 15:52 |
| ayoung | jorge_munoz, You are passimng the old trust id in when createing the new trust, right? | 15:53 |
| lbragstad | ayoung that is the intended use case for redelegation - right? | 15:53 |
| ayoung | lbragstad, yeah, but I think you specify the actual trust, too | 15:53 |
| lbragstad | ayoung ahhh | 15:54 |
| lbragstad | ayoung trying to find an example request | 15:55 |
| *** tonytan4ever has joined #openstack-keystone | 15:55 | |
| jorge_munoz | ayoung: No, I did not pass the old trust_id on the new trust. I’ll try that. | 15:56 |
| lbragstad | jorge_munoz if that is actually the problem - we should add some documentation here with that request - https://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-trust-ext.html | 15:56 |
| ayoung | jorge_munoz, Read the docs on that one...I think its specified that way | 15:56 |
| lbragstad | ayoung those docs ^ | 15:57 |
| *** josecastroleon has quit IRC | 15:57 | |
| lbragstad | I'm not seeing an example of "here's how you create a re-delegated trust" | 15:57 |
| lbragstad | jorge_munoz can you use paste to show us what you're seeing? | 15:58 |
| lbragstad | like, pasteraw or something? | 15:59 |
| *** henrynash_ has joined #openstack-keystone | 15:59 | |
| *** ChanServ sets mode: +v henrynash_ | 15:59 | |
| *** ngupta has joined #openstack-keystone | 16:00 | |
| lbragstad | jorge_munoz use http://pasteraw.com/ | 16:00 |
| lbragstad | copy and paste your requests into there and then drop the links here so we can look at them | 16:00 |
| *** aix has joined #openstack-keystone | 16:01 | |
| *** jsavak has quit IRC | 16:03 | |
| *** slberger has joined #openstack-keystone | 16:03 | |
| jorge_munoz | lbragstad: http://cdn.pasteraw.com/seeess53b0unouhnuppmyu8m9oaib1j | 16:03 |
| *** belmoreira has quit IRC | 16:05 | |
| *** roxanagh_ has quit IRC | 16:06 | |
| *** jsavak has joined #openstack-keystone | 16:07 | |
| *** roxanagh_ has joined #openstack-keystone | 16:10 | |
| *** kibm has quit IRC | 16:20 | |
| *** dslev has quit IRC | 16:20 | |
| *** vivekd has joined #openstack-keystone | 16:25 | |
| openstackgerrit | venkatamahesh proposed openstack/keystone: Fedora link is too old and so updated with newer version https://review.openstack.org/228109 | 16:26 |
| *** phalmos has joined #openstack-keystone | 16:31 | |
| *** kibm has joined #openstack-keystone | 16:31 | |
| *** ericksonsantos has joined #openstack-keystone | 16:31 | |
| *** vgridnev has quit IRC | 16:32 | |
| *** timcline has quit IRC | 16:32 | |
| *** pauloewerton has joined #openstack-keystone | 16:33 | |
| *** vgridnev has joined #openstack-keystone | 16:33 | |
| *** vgridnev has quit IRC | 16:34 | |
| *** spandhe has joined #openstack-keystone | 16:36 | |
| *** ryanpetrello is now known as ryanpetrello1 | 16:47 | |
| *** itlinux has joined #openstack-keystone | 16:48 | |
| *** ryanpetrello1 is now known as ryanpetrello | 16:48 | |
| *** vivekd has quit IRC | 16:48 | |
| *** vivekd has joined #openstack-keystone | 16:54 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:55 | |
| *** timcline has joined #openstack-keystone | 17:02 | |
| *** ninag has quit IRC | 17:03 | |
| *** kibm has quit IRC | 17:11 | |
| *** e0ne has quit IRC | 17:13 | |
| *** lhcheng has joined #openstack-keystone | 17:15 | |
| *** ChanServ sets mode: +v lhcheng | 17:15 | |
| *** vgridnev has joined #openstack-keystone | 17:16 | |
| *** _cjones_ has joined #openstack-keystone | 17:23 | |
| *** raildo-afk is now known as raildo | 17:24 | |
| *** raildo is now known as raildo-afk | 17:25 | |
| *** vryzhenkin is now known as freerunner | 17:27 | |
| *** shaleh has joined #openstack-keystone | 17:28 | |
| *** kibm has joined #openstack-keystone | 17:30 | |
| *** timcline has quit IRC | 17:34 | |
| *** browne has quit IRC | 17:44 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:46 | |
| *** ankita_wagh has joined #openstack-keystone | 17:48 | |
| *** jamielennox is now known as jamielennox|away | 17:52 | |
| *** ericksonsantos has quit IRC | 17:53 | |
| *** pauloewerton has quit IRC | 17:53 | |
| *** jamie_h has quit IRC | 17:54 | |
| *** telemonster has quit IRC | 17:55 | |
| *** kibm has quit IRC | 17:55 | |
| *** jsavak has quit IRC | 17:55 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 17:57 | |
| *** mhickey has quit IRC | 17:57 | |
| *** browne has joined #openstack-keystone | 17:58 | |
| *** browne has quit IRC | 17:58 | |
| *** e0ne has joined #openstack-keystone | 18:00 | |
| *** jsavak has joined #openstack-keystone | 18:03 | |
| *** kibm has joined #openstack-keystone | 18:03 | |
| *** pauloewerton has joined #openstack-keystone | 18:05 | |
| *** ericksonsantos has joined #openstack-keystone | 18:05 | |
| *** jasonsb has joined #openstack-keystone | 18:10 | |
| *** vivekd has quit IRC | 18:11 | |
| *** henrynash_ has quit IRC | 18:14 | |
| *** tonytan4ever has quit IRC | 18:21 | |
| *** jsavak has quit IRC | 18:21 | |
| *** jsavak has joined #openstack-keystone | 18:22 | |
| *** timcline has joined #openstack-keystone | 18:25 | |
| *** timcline_ has joined #openstack-keystone | 18:29 | |
| *** timcline has quit IRC | 18:30 | |
| *** jed56 has quit IRC | 18:33 | |
| *** tonytan4ever has joined #openstack-keystone | 18:34 | |
| *** dslev has joined #openstack-keystone | 18:34 | |
| *** browne has joined #openstack-keystone | 18:35 | |
| lbragstad | jorge_munoz do you have redelegation set to true in your keystone config? https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L2013-L2014 | 18:38 |
| *** _cjones_ has quit IRC | 18:39 | |
| *** drjones has joined #openstack-keystone | 18:39 | |
| *** ericksonsantos has quit IRC | 18:40 | |
| *** ericksonsantos has joined #openstack-keystone | 18:40 | |
| jorge_munoz | lbragstad: yes | 18:41 |
| *** pauloewerton has quit IRC | 18:43 | |
| *** kibm has quit IRC | 18:45 | |
| *** ericksonsantos has quit IRC | 18:53 | |
| *** jasonsb has quit IRC | 18:57 | |
| *** petertr7 is now known as petertr7_away | 19:00 | |
| *** browne has quit IRC | 19:01 | |
| *** kibm has joined #openstack-keystone | 19:03 | |
| *** narengan_ has joined #openstack-keystone | 19:09 | |
| *** jrist has quit IRC | 19:12 | |
| *** shoutm has quit IRC | 19:19 | |
| openstackgerrit | Merged openstack/keystone: Enable limiting in ldap for users https://review.openstack.org/233070 | 19:24 |
| *** pnavarro has quit IRC | 19:25 | |
| tjcocozz | lbragstad, ping | 19:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264346 | 19:28 |
| lbragstad | stevemar is it not possible to do something like http://cdn.pasteraw.com/p0gof3ry8zesnsvsspmzkco0isiamxc with osc | 19:31 |
| lbragstad | stevemar what I end up with is this - http://cdn.pasteraw.com/n49ae3mkxgguwjvcy9yzrv10hdicp1z | 19:31 |
| stevemar | lbragstad: coming at me with trust auth questions... | 19:31 |
| lbragstad | but trust should technically be the scope | 19:32 |
| *** ericksonsantos has joined #openstack-keystone | 19:32 | |
| stevemar | lbragstad: hmm, it should | 19:32 |
| lbragstad | stevemar it's more of a OSC question ;) | 19:32 |
| stevemar | give me 1 sec, finishing up something else | 19:32 |
| lbragstad | ok | 19:32 |
| lbragstad | thanks | 19:32 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied roles driver and manager https://review.openstack.org/264260 | 19:33 |
| ayoung | henrynash, are you working on the policy file changes for IMplied Roles API or shall I ? https://review.openstack.org/#/c/242614/47 | 19:35 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 19:35 |
| *** jistr has quit IRC | 19:37 | |
| *** kibm has quit IRC | 19:37 | |
| stevemar | lbragstad: looking now | 19:37 |
| stevemar | lbragstad: can you add --debug to your command, i wanna see what code bubbled up that error? | 19:38 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 19:43 |
| lbragstad | stevemar yep | 19:46 |
| stevemar | lbragstad: i *just* created a trustee and a trust | 19:46 |
| stevemar | now how do i auth... | 19:46 |
| lbragstad | http://cdn.pasteraw.com/863w4dtba16wlngddn1kuzzid516adr | 19:47 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: WIP: Extract assignment backend tests to own file https://review.openstack.org/268307 | 19:47 |
| lbragstad | stevemar this is my rc file http://cdn.pasteraw.com/p0gof3ry8zesnsvsspmzkco0isiamxc | 19:47 |
| lbragstad | stevemar i'm trying to auth at the trustee | 19:47 |
| stevemar | lbragstad: yeah, i just tried that, and it barfed | 19:48 |
| lbragstad | stevemar ah | 19:48 |
| lbragstad | stevemar I am trying to recreate some of the issues jorge_munoz keeps hitting | 19:49 |
| *** kibm has joined #openstack-keystone | 19:49 | |
| lbragstad | but instead of doing it with curl, i was going to see if i could reproduce it with the client | 19:49 |
| stevemar | lbragstad: i know you can auth with different auth types... http://paste.openstack.org/show/484037/ | 19:49 |
| stevemar | but it looks like trust isn't on there | 19:50 |
| stevemar | maybe OSC is just blocking too much? | 19:50 |
| lbragstad | stevemar yeah I'm not seeing trust | 19:50 |
| ayoung | is it an OSC issue? | 19:51 |
| *** petertr7_away is now known as petertr7 | 19:52 | |
| lbragstad | ayoung I'm hitting something with OSC and trusts - but jorge_munoz is having a hard time with the redelegation stuff | 19:52 |
| ayoung | lbragstad, right. I was asking if redelegation is not supported from OSC? | 19:52 |
| lbragstad | i think what stevemar and I just recreated is possibly a limitation with OSC (or it could be) | 19:52 |
| ayoung | I could see that | 19:52 |
| lbragstad | yeah | 19:53 |
| ayoung | does OSC support passing redelegated_trust_id ? | 19:53 |
| *** tjcocozz has left #openstack-keystone | 19:54 | |
| stevemar | lbragstad: trying to patch osc now | 19:54 |
| lbragstad | ayoung not that I know of | 19:54 |
| ayoung | well there ya go. | 19:54 |
| lbragstad | ayoung but I don't think that explains jorge_munoz 's issues | 19:55 |
| ayoung | pretty sure it is in KC | 19:55 |
| *** drjones has quit IRC | 19:55 | |
| dstanek | lbragstad: is there any reason you're not using the clouds.yaml format? | 19:55 |
| lbragstad | i just happen to stumble across the OSC thing because that's what I wanted to test it with locally | 19:55 |
| lbragstad | dstanek i have no good reason not to use it | 19:55 |
| stevemar | dstanek: old habits die hard | 19:55 |
| lbragstad | stevemar ++ | 19:56 |
| stevemar | lbragstad: i patched osc to get past that point, but now it's complaining that there is no service catalog | 19:56 |
| lbragstad | hmmm | 19:56 |
| lbragstad | interesting | 19:56 |
| *** browne has joined #openstack-keystone | 19:56 | |
| ayoung | lbragstad, I don't see it on KC even | 19:56 |
| lbragstad | either way - jorge_munoz is trying to do https://github.com/openstack/keystone/blob/08ce1a504b73c3f95f60ea6fc990fbf19a8b8c0e/keystone/tests/unit/test_v3_auth.py#L3046-L3105 locally but keeps hitting 403s | 19:57 |
| ayoung | lbragstad, http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/v3/contrib/trusts.py | 19:57 |
| stevemar | lbragstad: http://paste.openstack.org/show/484039/ | 19:57 |
| ayoung | lbragstad, is he hitting an issue with policy ? | 19:58 |
| lbragstad | ayoung yeah, there isn't anything in the ksc codebase for redelegated_trust_id | 19:58 |
| *** _cjones_ has joined #openstack-keystone | 19:58 | |
| lbragstad | ayoung i believe jorge_munoz is using the standard v3 policy | 19:58 |
| lbragstad | jorge_munoz right? | 19:58 |
| jorge_munoz | lbragstad: yes | 19:58 |
| ayoung | jorge_munoz, you have logging turned on? Is it showing an RBAC failure? | 19:58 |
| lbragstad | jorge_munoz ayoung this one - https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L2013-L2014 | 19:59 |
| jorge_munoz | ayoung: yes, both debug and verbose. I’ll add a paste | 20:00 |
| dstanek | jorge_munoz: does the trustor_id match the admin's user_id? | 20:01 |
| jorge_munoz | dstanek: yes | 20:01 |
| *** ankita_wagh has quit IRC | 20:01 | |
| *** ankita_wagh has joined #openstack-keystone | 20:01 | |
| stevemar | lbragstad: well, way to give me more osc work :( | 20:02 |
| lbragstad | stevemar :) | 20:02 |
| jorge_munoz | http://cdn.pasteraw.com/l7v1hn1izkz8kbge13ijffca773qcdf | 20:02 |
| dstanek | jorge_munoz: so you've created a trust between a user and an admin. but when you redelegate from the admin to somebody else it fails? | 20:02 |
| jorge_munoz | dstanek: Yes, it fails when redelegating the trust to some other user using the trusted token. | 20:03 |
| jorge_munoz | It might be failing because the user_id on the policy does not match the trustor’s id. | 20:04 |
| jorge_munoz | Looking into it now. | 20:04 |
| ayoung | RBAC: Authorization granted inner /home/jorge/source/keystone/keystone/common/controller.py:162 | 20:05 |
| ayoung | 2016-01-15 20:01:25.664 30424 WARNING keystone.common.wsgi [req-2dded95f-05eb-4b8b-9e45-5e9f8f0160a4 873d63b2cce1464a8d3acd01d53664f5 1cc82e7e6ae94806af7860fd597eb88a - 661775fb45784c12948076da48d03224 661775fb45784c12948076da48d03224] You are not authorized to perform the requested action. | 20:05 |
| ayoung | not policy IIUC | 20:05 |
| *** petertr7 is now known as petertr7_away | 20:07 | |
| ayoung | u'redelegated_trust_id': u'a9d062599e8e499daf69d45962b7501d', <- So the trustor on this request needs to be the trustee from that one | 20:07 |
| *** aix has quit IRC | 20:08 | |
| jorge_munoz | I had tried that too. | 20:09 |
| jorge_munoz | 2016-01-15 20:10:02.045 31847 WARNING keystone.common.wsgi [req-c0f13061-6b09-46ca-90a6-2441c1853aad 873d63b2cce1464a8d3acd01d53664f5 1cc82e7e6ae94806af7860fd597eb88a - 661775fb45784c12948076da48d03224 661775fb45784c12948076da48d03224] You are not authorized to perform the requested action: identity:create_trust | 20:09 |
| jorge_munoz | The trust test cases seem to be done incorrectly then. https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L2013-L2014. Following trust use the trustor of all chained trust. | 20:10 |
| jorge_munoz | Sorry incorrect link: https://github.com/openstack/keystone/blob/08ce1a504b73c3f95f60ea6fc990fbf19a8b8c0e/keystone/tests/unit/test_v3_auth.py#L3046-L3105 | 20:12 |
| ayoung | jorge_munoz, I don't like the user names used on those tests. | 20:15 |
| ayoung | Ideally it would be origian_trustor, originial_trustee, redelegated_trustee | 20:16 |
| jorge_munoz | ayoung: Right, that what i got from the documentation. | 20:17 |
| ayoung | jorge_munoz, can you hack the unit tests to show that it is bad? | 20:19 |
| *** henrynash_ has joined #openstack-keystone | 20:20 | |
| *** ChanServ sets mode: +v henrynash_ | 20:20 | |
| *** e0ne has quit IRC | 20:23 | |
| mc_nair | Hey everyone - is there a reason that Keystone's get_project command needs to be admin_required instead of admin_or_owner? | 20:24 |
| mc_nair | it's causing some issues with the Nested Quota driver in Cinder and looking through different possible fixes | 20:24 |
| *** dslev has quit IRC | 20:24 | |
| stevemar | mc_nair: who "owns" a project? users have roles on projects | 20:25 |
| *** kibm has quit IRC | 20:25 | |
| mc_nair | stevemar: sorry - was talking more in terms of policy.json (https://github.com/openstack/keystone/blob/master/etc/policy.json#L6). But I guess more specifically - would it be terrible to let a member of a project be able to do "get_project" for their current project | 20:26 |
| *** e0ne has joined #openstack-keystone | 20:26 | |
| mc_nair | so I guess that would be a policy similar to https://github.com/openstack/cinder/blob/master/etc/cinder/policy.json#L3 | 20:27 |
| *** petertr7_away is now known as petertr7 | 20:29 | |
| dolphm | mc_nair: i think you should be able to do that, certainly | 20:31 |
| ayoung | mc_nair, get_proejct should be safe | 20:31 |
| jorge_munoz | ayoung: So in the line every redelegated trust in the chain is created with the original trustor’s id. https://github.com/openstack/keystone/blob/08ce1a504b73c3f95f60ea6fc990fbf19a8b8c0e/keystone/tests/unit/test_v3_auth.py#L3080 | 20:32 |
| ayoung | just about all of the gets should be safe. Even Trusts are really not secret info, and GET user has no password | 20:32 |
| ayoung | jorge_munoz, let me look at what the code does, then | 20:32 |
| ayoung | maybe that is right | 20:32 |
| mc_nair | ahhhh, that would fix all my problems :) so it'd be reasonable to change the default Keystone policy.json to let get_project for users of the current project then? | 20:32 |
| *** ericksonsantos has quit IRC | 20:33 | |
| *** kibm has joined #openstack-keystone | 20:34 | |
| ayoung | mc_nair, look at the cloudsample version | 20:35 |
| *** ericksonsantos has joined #openstack-keystone | 20:36 | |
| ayoung | "identity:get_project": "rule:cloud_admin or rule:admin_and_matching_target_project_domain_id or rule:admin_and_matching_target_project_id", | 20:36 |
| *** spzala has quit IRC | 20:36 | |
| *** ankita_wagh has quit IRC | 20:36 | |
| ayoung | hmmm...we seem to be overly restrictive there | 20:36 |
| *** spzala has joined #openstack-keystone | 20:36 | |
| *** ankita_wagh has joined #openstack-keystone | 20:36 | |
| ayoung | mc_nair, it is for just these reasons I am pushing the implied roles changes | 20:37 |
| henrynash_ | ayoung, stevemar, gyee, dstanek, bknudson, (+ other cores): all the domain specifc set of patches have been up for a while now and had at least some reviews - I’d really like to get some more eyes on them. They are dependent on Implied Roles of course, which is why that has to be merged first. The actual modification to implies roles is pretty tiny (https://review.openstack.org/#/c/263064/), but the chain of patches sta | 20:37 |
| henrynash_ | here: https://review.openstack.org/#/c/261846/ | 20:37 |
| henrynash_ | (domain specific roles, that is) | 20:37 |
| ayoung | henrynash_, I've figured the best thing to do was to push from the bottom | 20:37 |
| mc_nair | ayoung: sorry - didn't follow the last question | 20:38 |
| ayoung | mc_nair, it was a statement | 20:38 |
| henrynash_ | ayoung: push from the bottom turtle up? | 20:38 |
| ayoung | Heh | 20:38 |
| ayoung | henrynash_, I want the implied roles stuff in. Noneof domain specific stuff can get in until implied roles | 20:39 |
| mc_nair | ayoung: haha - oh reading. Could I get a link to that patch your referencing? | 20:39 |
| henrynash_ | ayoung: yeah, on get_project..I’d haev thought you can get-project if you have a role on it… | 20:39 |
| ayoung | mc_nair, https://review.openstack.org/#/c/242614/ | 20:40 |
| henrynash_ | ayoung: no arguing with that!!!! | 20:40 |
| henrynash_ | ayoung: implied roles getting in, that is | 20:40 |
| *** spzala has quit IRC | 20:40 | |
| ayoung | henrynash_, We'll get it done...Dave did a decent code review. After it gets in, I'd like to revisit the policy files. jamielennox|away has a spec for a default set of roles, but we might want to go even more granular than he did | 20:41 |
| henrynash_ | ayoung: btw, when you added the policy.json entries for implied roles, don’t they have to docuemnted somewhere (policy_mapping.rst ?)- I think there is a test that checks that they are….so you latest patcg might fail | 20:42 |
| ayoung | henrynash_, it might. If so, it is new to me, but that would not be the first time. Let's see. | 20:42 |
| henrynash_ | ayoung: it’s all greek/json to me…. | 20:42 |
| *** ankita_wagh has quit IRC | 20:45 | |
| *** browne has quit IRC | 20:46 | |
| ayoung | henrynash_, I could see an argument that the same mechanism for Domain Specific Roles should work at the Project level | 20:46 |
| ayoung | If we were to make project specific roles, and use domain-is-a-project...would that serve? | 20:46 |
| ayoung | It would be strange with name masking, I guess, the way things get inherited | 20:46 |
| henrynash_ | ayoung: one can make that argument, although seems to me that usually policy type structrues are made a the company/division level…whcih wht these map to domains | 20:47 |
| mc_nair | ayoung: thanks for the info! I'm new to Keystone so let me know if I'm missing something, but would implied roles fix things, without changing the policy.json to not require admin for something like get_project? Cause a normal member of the project wouldn't inherit that admin role? | 20:47 |
| ayoung | henrynash_, except that far more places have company->project than company->domain if you are ,say ,buying space on a public cloud | 20:48 |
| ayoung | henrynash_, it depends on if you thinkg DSR is assignement side or identity side. I've been thinking of it as assignment side, in which case it is really project scoped | 20:49 |
| henrynash_ | ayoung: well, that’s true today…but I see company->domain becoming more previlent as a company wants more control of how they portion of teh cloud opreates | 20:49 |
| henrynash_ | ayoung: that’s why I’m pushing all this domain config stuff via APIs for iinstance, domain roles…I think we’ll want to do domain specific (i.e. polic controlled) federation mapping crud etc. | 20:50 |
| ayoung | henrynash_, I'd like to mull that over. I think that Proj Specific is the more powerful abstraction, as it carries domain with it. Can we make that work? Make DSR a degenerate case, maybe by namespacing the whole thing? | 20:50 |
| *** fawadkhaliq has quit IRC | 20:51 | |
| *** fawadkhaliq has joined #openstack-keystone | 20:53 | |
| *** fawadkhaliq has quit IRC | 20:55 | |
| *** ankita_wagh has joined #openstack-keystone | 21:01 | |
| *** jrist has joined #openstack-keystone | 21:04 | |
| *** jsavak has quit IRC | 21:04 | |
| *** jaosorior has quit IRC | 21:05 | |
| *** jsavak has joined #openstack-keystone | 21:05 | |
| *** spzala has joined #openstack-keystone | 21:06 | |
| *** jsavak has quit IRC | 21:11 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Improve Conflict error message in IdP creation https://review.openstack.org/265279 | 21:12 |
| *** jsavak has joined #openstack-keystone | 21:12 | |
| lbragstad | ayoung so, if we aren't going to support bind with the default token format moving forward, can we deprecate it? | 21:13 |
| ayoung | lbragstad, yes, I think that is the right call | 21:13 |
| *** narengan_ has quit IRC | 21:13 | |
| *** rletrocquer has quit IRC | 21:13 | |
| *** roxanaghe has quit IRC | 21:13 | |
| *** kibm has quit IRC | 21:16 | |
| jorge_munoz | ayoung: lbragstad : Thanks solved my issue. The test are correct. Redelegated trust should have the trustor_id from the admin. | 21:17 |
| lbragstad | jorge_munoz awesome! | 21:18 |
| ayoung | jorge_munoz, please explain | 21:18 |
| lbragstad | jorge_munoz so the issue was? | 21:18 |
| ayoung | " from the admin" is who | 21:18 |
| jorge_munoz | When redelegating a trust, the trustor_id should be set to the creator of the original trust. | 21:20 |
| lbragstad | jorge_munoz what were you setting it to before/ | 21:20 |
| lbragstad | ? | 21:20 |
| *** edmondsw has joined #openstack-keystone | 21:20 | |
| jorge_munoz | Yes, my issue was the the expire time. I made the mistake of setting the expire time for the redelegated trust later then the original. | 21:21 |
| *** edmondsw has quit IRC | 21:21 | |
| ayoung | I think there is a misleading comment in the code that indicates the old logic of enforcing only the trustor may call that method | 21:21 |
| lbragstad | ah... | 21:22 |
| lbragstad | the trustor can only call what method? | 21:22 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/trust/controllers.py#n123 | 21:22 |
| ayoung | should read "The user creating the trust must either be the trustor, or a trustee redelegating the trust." | 21:23 |
| lbragstad | ahhh... so it doesn't matter what the policy is | 21:23 |
| ayoung | "identity:create_trust": "user_id:%(trust.trustor_user_id)s", is also wrong... (from v3) | 21:24 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json#n99 | 21:24 |
| lbragstad | ayoung yeah, i think it's the same in the original policy file too | 21:24 |
| *** timcline_ has quit IRC | 21:24 | |
| ayoung | how did that work, then? | 21:25 |
| lbragstad | ayoung i'm not sure... that's kind of confusing because we have policy enforced in two places, right? | 21:25 |
| lbragstad | we have some in the policy file and some in the trust api? | 21:25 |
| ayoung | lbragstad, it used to be hardcoded into the trust API cuz I was Paranoid | 21:26 |
| ayoung | I thought we killed that, though | 21:26 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/trust/controllers.py#n118 | 21:27 |
| *** pnavarro has joined #openstack-keystone | 21:27 | |
| *** kibm has joined #openstack-keystone | 21:27 | |
| ayoung | user_id == trustore_id is all over the place there | 21:28 |
| *** doug-fish has quit IRC | 21:28 | |
| lbragstad | hmmm | 21:28 |
| lbragstad | so this is strange | 21:28 |
| lbragstad | what jorge_munoz seems to have recreated isn't what I was thinking redelegation was | 21:29 |
| lbragstad | which could totally be my fault | 21:29 |
| ayoung | lbragstad, need amakarov in this discussion | 21:29 |
| lbragstad | ayoung yes we do | 21:29 |
| jorge_munoz | Using the trustee’s trusted token I was able to create a new trust, but the trustor on the trust matches the id on the original trust. | 21:29 |
| lbragstad | I haven't seen him in irc for a while though | 21:30 |
| lbragstad | let's use user-a, user-b, and user-c | 21:30 |
| lbragstad | user-a is the trustor | 21:30 |
| ayoung | jorge_munoz, in the call to redelegate the trust, what do you specify as the trustor_id? | 21:30 |
| lbragstad | user-a creates a trust between user-a and user-b | 21:30 |
| lbragstad | making user-b the trustee | 21:30 |
| ayoung | check | 21:30 |
| jorge_munoz | the trustor id from the original trust. | 21:31 |
| ayoung | jorge_munoz, that should fail the policy check | 21:31 |
| lbragstad | what jorge_munoz did was get a trust scoped token for *user-b* and created a trust with the trustor being user-a and the trustee being user-c | 21:31 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json#n99 | 21:31 |
| *** daemontool has joined #openstack-keystone | 21:31 | |
| ayoung | lbragstad, right, and that should fail the check "identity:create_trust": "user_id:%(trust.trustor_user_id)s", | 21:31 |
| ayoung | AH...was this impersonated? | 21:32 |
| ayoung | jorge_munoz, ^^ you were doing impersonation, I remember seeing in the paste you sent | 21:32 |
| jorge_munoz | ayoung: yes | 21:32 |
| ayoung | that is why it worked. Hmmm | 21:33 |
| *** jsavak has quit IRC | 21:33 | |
| ayoung | that policy check needs to change | 21:33 |
| ayoung | we're going to force people to do impersonation when we should not be | 21:33 |
| lbragstad | yep | 21:33 |
| lbragstad | that's weird | 21:33 |
| *** jsavak has joined #openstack-keystone | 21:34 | |
| ayoung | I'm going to sleep on that one. My kneejerk reaction is that it should not be in the policy file | 21:34 |
| ayoung | Anyone should be able to create some trust, but the rules for who can create a specific trust are too complex for policy | 21:34 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity https://review.openstack.org/262045 | 21:35 |
| ayoung | lbragstad, I could see it working like this, though: if you are redelegating a trust, specify yourself as the trustor_id in the request. DUring the redelegation process, we replace the trustor_id with the original trustor_id fetched based on the original redlegated_trust_id | 21:37 |
| ayoung | but that is working around policy | 21:38 |
| ayoung | lbragstad, jorge_munoz https://bugs.launchpad.net/keystone/+bug/1534834 can you mark this as confirmed? | 21:43 |
| openstack | Launchpad bug 1534834 in OpenStack Identity (keystone) "Policy check forces impersonation for redelgation of trust" [Undecided,New] | 21:43 |
| *** jsavak has quit IRC | 21:49 | |
| *** jsavak has joined #openstack-keystone | 21:50 | |
| *** kibm has quit IRC | 21:53 | |
| *** jamielennox|away is now known as jamielennox | 21:54 | |
| *** drjones has joined #openstack-keystone | 21:55 | |
| *** _cjones_ has quit IRC | 21:55 | |
| openstackgerrit | Tom Cocozzello proposed openstack/python-keystoneclient: set up incude names for list role assignments https://review.openstack.org/255392 | 21:55 |
| *** spandhe has quit IRC | 21:58 | |
| *** tonytan4ever has quit IRC | 21:58 | |
| *** dims_ has joined #openstack-keystone | 21:59 | |
| *** dims has quit IRC | 22:01 | |
| *** kibm has joined #openstack-keystone | 22:05 | |
| ayoung | stevemar, are the failures here something we should be expecting right now? https://review.openstack.org/#/c/264260/ | 22:07 |
| *** e0ne has quit IRC | 22:08 | |
| stevemar | ayoung: no, just recheck, a lot of the jobs have had transient failures lately | 22:08 |
| ayoung | ok | 22:08 |
| *** tonytan4ever has joined #openstack-keystone | 22:09 | |
| jorge_munoz | ayoung: done, thanks | 22:09 |
| *** pnavarro has quit IRC | 22:10 | |
| *** kibm has quit IRC | 22:12 | |
| *** kibm has joined #openstack-keystone | 22:12 | |
| *** petertr7 is now known as petertr7_away | 22:14 | |
| *** shaleh has quit IRC | 22:16 | |
| *** tonytan4ever has quit IRC | 22:22 | |
| *** daemontool has quit IRC | 22:24 | |
| *** phalmos has quit IRC | 22:25 | |
| *** vgridnev has quit IRC | 22:26 | |
| *** daemontool has joined #openstack-keystone | 22:28 | |
| *** kibm has quit IRC | 22:30 | |
| *** daemontool has quit IRC | 22:37 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Mark password/secret options as secret https://review.openstack.org/268199 | 22:43 |
| henrynash_ | samueldmq, htruta: final part of assignment manager cleanup: https://review.openstack.org/#/c/265650/ | 22:47 |
| *** kibm has joined #openstack-keystone | 22:48 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:50 | |
| stevemar | bknudson_: this is finally passing yay - https://review.openstack.org/#/c/257127/5 | 22:50 |
| jamielennox | stevemar: sorry for delay, going to look into that middleware backport now | 22:52 |
| jamielennox | stevemar: also i _bet_ that ^ breaks someone | 22:52 |
| stevemar | jamielennox: oh for sure | 22:53 |
| jamielennox | i don't understand how that pattern got started | 22:53 |
| stevemar | jamielennox: step 1 was making sure it didn't break devstack | 22:53 |
| jamielennox | oh? one of the core projects? | 22:53 |
| stevemar | jamielennox: neutron :) | 22:53 |
| stevemar | neutronclient anyway | 22:54 |
| jamielennox | stevemar: how much time did you put into that backport to kilo? | 22:54 |
| stevemar | jamielennox: i had to patch all these projects: https://review.openstack.org/#/q/topic:stop_using_oslo_inc | 22:54 |
| stevemar | jamielennox: about an hour at 2am :P | 22:54 |
| *** csoukup has quit IRC | 22:54 | |
| jamielennox | wow, seriously? shows the proliferation of copy & paste | 22:55 |
| stevemar | jamielennox: oh yeah? stupid mistake somewhere? | 22:55 |
| jamielennox | no the projects using openstack.comon | 22:55 |
| stevemar | oh, that, yeah ... ugh | 22:55 |
| jamielennox | for the backport i'm wondering if i should just start again so i understand what got changed | 22:55 |
| stevemar | i did a search on hound/codesearch and was gonna cry | 22:56 |
| stevemar | jamielennox: if you think that's best, sure | 22:56 |
| stevemar | i started from the beginning as well, thinking the same thing | 22:56 |
| stevemar | jamielennox: it's saturday, take it easy | 22:57 |
| *** ankita_wagh has quit IRC | 22:59 | |
| *** jsavak has quit IRC | 23:10 | |
| *** jsavak has joined #openstack-keystone | 23:11 | |
| *** spzala has quit IRC | 23:14 | |
| *** spzala has joined #openstack-keystone | 23:15 | |
| *** kibm has quit IRC | 23:16 | |
| *** spzala has quit IRC | 23:19 | |
| *** slberger has left #openstack-keystone | 23:26 | |
| *** kibm has joined #openstack-keystone | 23:28 | |
| *** dims_ has quit IRC | 23:29 | |
| openstackgerrit | Merged openstack/keystone: Update v3policysample tests to use admin_project not special domain_id https://review.openstack.org/266617 | 23:33 |
| *** roxanagh_ has quit IRC | 23:33 | |
| *** roxanaghe has joined #openstack-keystone | 23:34 | |
| *** dims has joined #openstack-keystone | 23:37 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264346 | 23:37 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264346 | 23:38 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied roles driver and manager https://review.openstack.org/264260 | 23:42 |
| *** roxanaghe has quit IRC | 23:44 | |
| *** spandhe has joined #openstack-keystone | 23:53 | |
| *** jsavak has quit IRC | 23:56 | |
| *** dims has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!