| *** timcline has joined #openstack-keystone | 00:04 | |
| *** spzala has joined #openstack-keystone | 00:04 | |
| *** fawadkhaliq has quit IRC | 00:07 | |
| *** fawadkhaliq has joined #openstack-keystone | 00:07 | |
| *** gyee has quit IRC | 00:08 | |
| *** timcline has quit IRC | 00:08 | |
| *** jasonsb has joined #openstack-keystone | 00:08 | |
| *** ayoung has joined #openstack-keystone | 00:11 | |
| *** ChanServ sets mode: +v ayoung | 00:11 | |
| *** jasonsb has quit IRC | 00:12 | |
| *** browne has quit IRC | 00:12 | |
| *** mylu has joined #openstack-keystone | 00:14 | |
| *** mylu has quit IRC | 00:15 | |
| *** browne has joined #openstack-keystone | 00:17 | |
| *** tellesnobrega is now known as tellesnobrega_af | 00:28 | |
| *** richm has quit IRC | 00:33 | |
| *** dflorea has quit IRC | 00:38 | |
| *** mylu has joined #openstack-keystone | 00:39 | |
| *** mylu has quit IRC | 00:41 | |
| *** tqtran has quit IRC | 00:41 | |
| *** mylu has joined #openstack-keystone | 00:42 | |
| *** mylu has quit IRC | 00:44 | |
| *** mylu has joined #openstack-keystone | 00:44 | |
| *** jasonsb has joined #openstack-keystone | 00:45 | |
| *** jasonsb has quit IRC | 00:47 | |
| *** jasonsb has joined #openstack-keystone | 00:47 | |
| *** jasonsb has quit IRC | 00:48 | |
| *** mylu has quit IRC | 00:50 | |
| *** mylu has joined #openstack-keystone | 00:52 | |
| *** markvoelker_ has quit IRC | 00:53 | |
| *** bjornar has quit IRC | 00:54 | |
| *** edmondsw has joined #openstack-keystone | 00:54 | |
| *** tqtran has joined #openstack-keystone | 01:03 | |
| *** mylu has quit IRC | 01:03 | |
| samueldmq | morgan: stevemar_: what's happening in our master gates ? :( | 01:04 |
|---|---|---|
| *** agrebennikov__ has quit IRC | 01:04 | |
| samueldmq | I just saw 298402 hasn't merged yet | 01:04 |
| *** mylu has joined #openstack-keystone | 01:04 | |
| *** timcline has joined #openstack-keystone | 01:04 | |
| *** jasonsb has joined #openstack-keystone | 01:05 | |
| *** tqtran has quit IRC | 01:07 | |
| *** mylu has quit IRC | 01:09 | |
| *** timcline has quit IRC | 01:09 | |
| *** jasonsb has quit IRC | 01:10 | |
| *** jasonsb has joined #openstack-keystone | 01:11 | |
| *** browne has quit IRC | 01:12 | |
| *** spzala has quit IRC | 01:14 | |
| *** spzala has joined #openstack-keystone | 01:14 | |
| *** mylu has joined #openstack-keystone | 01:15 | |
| *** EinstCrazy has joined #openstack-keystone | 01:16 | |
| *** spzala has quit IRC | 01:19 | |
| *** EinstCra_ has joined #openstack-keystone | 01:19 | |
| *** spandhe has quit IRC | 01:20 | |
| *** dan_nguyen has quit IRC | 01:21 | |
| *** mylu has quit IRC | 01:22 | |
| *** EinstCrazy has quit IRC | 01:22 | |
| *** mylu has joined #openstack-keystone | 01:24 | |
| *** knikolla has quit IRC | 01:25 | |
| *** woodster_ has quit IRC | 01:27 | |
| *** edmondsw has quit IRC | 01:30 | |
| *** fawadkhaliq has quit IRC | 01:40 | |
| *** mylu has quit IRC | 01:50 | |
| *** fawadkhaliq has joined #openstack-keystone | 01:54 | |
| *** topol_ is now known as topol | 01:57 | |
| *** ChanServ sets mode: +v topol | 01:57 | |
| *** topol_ has joined #openstack-keystone | 01:58 | |
| *** ChanServ sets mode: +v topol_ | 01:58 | |
| *** topol_ has quit IRC | 02:02 | |
| *** tellesnobrega_af is now known as tellesnobrega | 02:03 | |
| *** tqtran has joined #openstack-keystone | 02:04 | |
| *** timcline has joined #openstack-keystone | 02:05 | |
| *** tqtran has quit IRC | 02:08 | |
| *** timcline has quit IRC | 02:10 | |
| *** spzala has joined #openstack-keystone | 02:14 | |
| *** akanksha_ has quit IRC | 02:17 | |
| *** mylu has joined #openstack-keystone | 02:19 | |
| *** spzala has quit IRC | 02:20 | |
| *** jasonsb has quit IRC | 02:30 | |
| *** fawadkhaliq has quit IRC | 02:33 | |
| *** spzala has joined #openstack-keystone | 02:36 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:42 | |
| *** fawadkhaliq has quit IRC | 02:43 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:45 | |
| *** fawadkhaliq has quit IRC | 02:53 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:53 | |
| *** timcline has joined #openstack-keystone | 03:06 | |
| *** mylu has quit IRC | 03:08 | |
| *** fawadkhaliq has quit IRC | 03:08 | |
| *** mylu has joined #openstack-keystone | 03:09 | |
| openstackgerrit | Merged openstack/keystone: Correct `role_name` constraint dropping https://review.openstack.org/298402 | 03:10 |
| prometheanfire | stevemar_: woooo | 03:10 |
| *** timcline has quit IRC | 03:10 | |
| prometheanfire | samueldmq: you were saying? | 03:10 |
| *** fawadkhaliq has joined #openstack-keystone | 03:10 | |
| *** mylu has quit IRC | 03:11 | |
| *** mylu has joined #openstack-keystone | 03:11 | |
| *** fawadkhaliq has quit IRC | 03:12 | |
| *** jasonsb has joined #openstack-keystone | 03:13 | |
| *** dan_nguyen has joined #openstack-keystone | 03:20 | |
| *** krotscheck is now known as krotscheck_vaca | 03:20 | |
| morgan | prometheanfire: and we hope stable/mitaka lands sooon. | 03:26 |
| prometheanfire | of course :D | 03:29 |
| *** spandhe has joined #openstack-keystone | 03:30 | |
| *** fawadkhaliq has joined #openstack-keystone | 03:32 | |
| *** spandhe_ has joined #openstack-keystone | 03:33 | |
| *** spandhe has quit IRC | 03:34 | |
| *** spandhe_ is now known as spandhe | 03:34 | |
| *** links has joined #openstack-keystone | 03:41 | |
| stevemar_ | soon soon | 03:47 |
| *** markvoelker has joined #openstack-keystone | 03:47 | |
| morgan | soon (tm) | 03:47 |
| *** dan_nguyen has quit IRC | 03:52 | |
| *** mylu has quit IRC | 03:54 | |
| *** dflorea has joined #openstack-keystone | 03:55 | |
| *** markvoelker_ has joined #openstack-keystone | 03:56 | |
| *** markvoelker has quit IRC | 03:56 | |
| stevemar_ | morgan: https://review.openstack.org/#/c/300230/ if you're interested | 03:57 |
| patchbot | stevemar_: patch 300230 - releases - release keystone mitaka-rc2 | 03:57 |
| morgan | nice. | 03:57 |
| morgan | i assume that includes the role thing | 03:57 |
| morgan | ? | 03:57 |
| morgan | stevemar_: yep.. nice | 03:58 |
| morgan | stevemar_: also... what happened to your bouncer? | 03:58 |
| morgan | :) | 03:58 |
| prometheanfire | wooo | 03:59 |
| stevemar_ | morgan: its back online now | 03:59 |
| stevemar_ | bluemix issues | 03:59 |
| morgan | welcome back | 03:59 |
| stevemar_ | they deployed a bunch of new stuff and the load balancer fell over | 04:00 |
| morgan | what host you using? | 04:00 |
| * morgan continues to be happy w/ Vexxhost | 04:00 | |
| stevemar_ | bluemix.net :P | 04:01 |
| stevemar_ | morgan: the VM service is still beta, so bugs are expected | 04:01 |
| *** timcline has joined #openstack-keystone | 04:07 | |
| *** mylu has joined #openstack-keystone | 04:10 | |
| *** dan_nguyen has joined #openstack-keystone | 04:10 | |
| morgan | stevemar_: that stevemar_ dude is shady, what happened to stevemar? | 04:10 |
| morgan | :P | 04:10 |
| *** mylu has quit IRC | 04:10 | |
| *** agrebennikov__ has joined #openstack-keystone | 04:11 | |
| *** timcline has quit IRC | 04:11 | |
| *** mylu has joined #openstack-keystone | 04:13 | |
| *** topol_ has joined #openstack-keystone | 04:14 | |
| *** ChanServ sets mode: +v topol_ | 04:14 | |
| *** dan_nguyen has quit IRC | 04:17 | |
| *** topol_ has quit IRC | 04:19 | |
| *** harlowja_at_home has joined #openstack-keystone | 04:19 | |
| *** spzala has quit IRC | 04:24 | |
| *** spzala has joined #openstack-keystone | 04:24 | |
| *** fawadkhaliq has quit IRC | 04:26 | |
| *** sdake has joined #openstack-keystone | 04:29 | |
| *** spzala has quit IRC | 04:29 | |
| *** markvoelker_ has quit IRC | 04:33 | |
| *** markvoelker has joined #openstack-keystone | 04:33 | |
| *** lhcheng has joined #openstack-keystone | 04:37 | |
| *** ChanServ sets mode: +v lhcheng | 04:37 | |
| *** markvoelker has quit IRC | 04:38 | |
| *** timcline has joined #openstack-keystone | 04:40 | |
| *** mylu has quit IRC | 04:41 | |
| *** lhcheng_ has joined #openstack-keystone | 04:44 | |
| *** mtreinish has quit IRC | 04:44 | |
| *** timcline has quit IRC | 04:44 | |
| *** mylu has joined #openstack-keystone | 04:46 | |
| *** lhcheng has quit IRC | 04:47 | |
| *** dflorea has quit IRC | 04:51 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: create a new `advanced topics` section in the docs https://review.openstack.org/292227 | 04:52 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: group federated identity docs together https://review.openstack.org/292228 | 04:52 |
| stevemar_ | morgan: hmm let me see what's going on in my config settings | 04:53 |
| *** GB21 has joined #openstack-keystone | 04:54 | |
| *** mylu has quit IRC | 04:57 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: create a new `advanced topics` section in the docs https://review.openstack.org/292227 | 04:57 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: group federated identity docs together https://review.openstack.org/292228 | 04:57 |
| *** rcernin has joined #openstack-keystone | 04:57 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:57 | |
| *** stevemar_ has quit IRC | 05:02 | |
| *** stevemar has joined #openstack-keystone | 05:02 | |
| *** ChanServ sets mode: +o stevemar | 05:03 | |
| stevemar | morgan: \o/ | 05:03 |
| stevemar | morgan: you can trust me again, not like evil stevemar_ | 05:03 |
| *** mylu has joined #openstack-keystone | 05:05 | |
| *** GB21 has quit IRC | 05:07 | |
| *** harlowja_at_home has quit IRC | 05:19 | |
| *** GB21 has joined #openstack-keystone | 05:20 | |
| *** tpeoples is now known as tpeoples_vacatio | 05:23 | |
| *** tpeoples_vacatio is now known as tpeoplesvacation | 05:24 | |
| *** spzala has joined #openstack-keystone | 05:25 | |
| *** jaosorior has joined #openstack-keystone | 05:25 | |
| *** markvoelker has joined #openstack-keystone | 05:29 | |
| *** spzala has quit IRC | 05:30 | |
| *** sdake_ has joined #openstack-keystone | 05:30 | |
| *** sdake_ has quit IRC | 05:31 | |
| *** sdake has quit IRC | 05:32 | |
| *** markvoelker has quit IRC | 05:37 | |
| *** timcline has joined #openstack-keystone | 05:41 | |
| *** mylu has quit IRC | 05:43 | |
| *** Nirupama has joined #openstack-keystone | 05:44 | |
| *** timcline has quit IRC | 05:45 | |
| *** mylu has joined #openstack-keystone | 05:48 | |
| *** mylu has quit IRC | 05:48 | |
| *** mtreinish has joined #openstack-keystone | 05:52 | |
| *** spandhe has quit IRC | 06:04 | |
| *** roxanaghe has quit IRC | 06:04 | |
| *** tqtran has joined #openstack-keystone | 06:06 | |
| stevemar | samueldmq: raildo morgan jamielennox rodrigods htruta not sure if you all are interested in putting a "lets get to v3 in the gate" topic for the cross-project sessions: https://etherpad.openstack.org/p/newton-cross-project-sessions | 06:06 |
| *** spandhe has joined #openstack-keystone | 06:10 | |
| *** tqtran has quit IRC | 06:10 | |
| *** spandhe_ has joined #openstack-keystone | 06:16 | |
| *** spandhe has quit IRC | 06:17 | |
| *** spandhe_ is now known as spandhe | 06:17 | |
| *** spandhe_ has joined #openstack-keystone | 06:21 | |
| *** spandhe has quit IRC | 06:21 | |
| *** spandhe_ is now known as spandhe | 06:21 | |
| *** GB21 has quit IRC | 06:25 | |
| *** spzala has joined #openstack-keystone | 06:26 | |
| *** browne has joined #openstack-keystone | 06:27 | |
| jamielennox | stevemar: my concern is everyone just says - yep - because everyone wants it to happen | 06:31 |
| *** spzala has quit IRC | 06:31 | |
| *** browne has quit IRC | 06:32 | |
| *** sdake has joined #openstack-keystone | 06:36 | |
| *** fawadkhaliq has quit IRC | 06:38 | |
| *** furface has quit IRC | 06:38 | |
| *** fawadkhaliq has joined #openstack-keystone | 06:38 | |
| *** browne has joined #openstack-keystone | 06:39 | |
| *** timcline has joined #openstack-keystone | 06:42 | |
| *** browne has quit IRC | 06:44 | |
| *** GB21 has joined #openstack-keystone | 06:44 | |
| *** browne has joined #openstack-keystone | 06:45 | |
| prometheanfire | yesplease to v3, glance not supporting it is annoying (along with glance-scrubber not supporting https...) | 06:45 |
| *** lhcheng_ has quit IRC | 06:46 | |
| *** timcline has quit IRC | 06:47 | |
| *** browne has quit IRC | 06:49 | |
| *** agrebennikov__ has quit IRC | 06:55 | |
| *** spandhe has quit IRC | 07:04 | |
| *** e0ne has joined #openstack-keystone | 07:07 | |
| *** browne has joined #openstack-keystone | 07:08 | |
| stevemar | jamielennox: yeah, that's what i'm afraid of | 07:10 |
| stevemar | jamielennox: | 07:10 |
| stevemar | jamielennox: "ok, great, make it happen" | 07:10 |
| *** browne has quit IRC | 07:13 | |
| *** jamielennox is now known as jamielennox|away | 07:17 | |
| *** markvoelker has joined #openstack-keystone | 07:19 | |
| *** pcaruana has joined #openstack-keystone | 07:25 | |
| *** markvoelker has quit IRC | 07:25 | |
| *** spzala has joined #openstack-keystone | 07:27 | |
| openstackgerrit | Kalaswan Datta proposed openstack/keystone: Clear the project ID from user information https://review.openstack.org/277707 | 07:31 |
| *** spzala has quit IRC | 07:32 | |
| *** e0ne has quit IRC | 07:35 | |
| *** e0ne has joined #openstack-keystone | 07:35 | |
| *** GB21 has quit IRC | 07:40 | |
| *** e0ne has quit IRC | 07:40 | |
| *** timcline has joined #openstack-keystone | 07:42 | |
| *** e0ne has joined #openstack-keystone | 07:45 | |
| *** jaosorior has quit IRC | 07:46 | |
| *** jaosorior has joined #openstack-keystone | 07:46 | |
| *** timcline has quit IRC | 07:47 | |
| *** e0ne has quit IRC | 07:54 | |
| *** tesseract has joined #openstack-keystone | 07:56 | |
| *** fawadkhaliq has quit IRC | 07:56 | |
| *** tesseract is now known as Guest90877 | 07:56 | |
| *** e0ne has joined #openstack-keystone | 07:57 | |
| *** fhubik has joined #openstack-keystone | 07:58 | |
| *** jistr has joined #openstack-keystone | 08:07 | |
| *** e0ne has quit IRC | 08:10 | |
| *** zqfan has joined #openstack-keystone | 08:12 | |
| *** e0ne has joined #openstack-keystone | 08:13 | |
| *** fhubik has quit IRC | 08:16 | |
| *** e0ne has quit IRC | 08:16 | |
| *** e0ne has joined #openstack-keystone | 08:20 | |
| *** e0ne has quit IRC | 08:26 | |
| *** spzala has joined #openstack-keystone | 08:28 | |
| *** e0ne has joined #openstack-keystone | 08:29 | |
| *** GB21 has joined #openstack-keystone | 08:29 | |
| *** e0ne_ has joined #openstack-keystone | 08:31 | |
| *** e0ne has quit IRC | 08:32 | |
| *** e0ne_ has quit IRC | 08:33 | |
| *** spzala has quit IRC | 08:33 | |
| *** timcline has joined #openstack-keystone | 08:43 | |
| openstackgerrit | Tim Kelsey proposed openstack/keystone: Bandit test results https://review.openstack.org/299373 | 08:44 |
| *** timcline has quit IRC | 08:48 | |
| *** e0ne has joined #openstack-keystone | 08:48 | |
| *** ktychkova has quit IRC | 08:49 | |
| *** amit213 has quit IRC | 08:49 | |
| *** ktychkova has joined #openstack-keystone | 08:51 | |
| *** e0ne has quit IRC | 08:53 | |
| *** e0ne has joined #openstack-keystone | 08:58 | |
| *** EinstCrazy has joined #openstack-keystone | 09:06 | |
| *** EinstCra_ has quit IRC | 09:07 | |
| *** markvoelker has joined #openstack-keystone | 09:11 | |
| *** GB21 has quit IRC | 09:13 | |
| *** sdake has quit IRC | 09:13 | |
| *** markvoelker has quit IRC | 09:16 | |
| *** arunkant has quit IRC | 09:21 | |
| *** jaosorior has quit IRC | 09:21 | |
| *** arunkant has joined #openstack-keystone | 09:26 | |
| *** spzala has joined #openstack-keystone | 09:29 | |
| *** spzala has quit IRC | 09:35 | |
| *** e0ne has quit IRC | 09:36 | |
| *** timcline has joined #openstack-keystone | 09:44 | |
| *** mvk has joined #openstack-keystone | 09:46 | |
| *** e0ne has joined #openstack-keystone | 09:47 | |
| *** timcline has quit IRC | 09:48 | |
| *** daemontool has joined #openstack-keystone | 09:57 | |
| *** markvoelker has joined #openstack-keystone | 10:06 | |
| *** e0ne has quit IRC | 10:08 | |
| *** EinstCrazy has quit IRC | 10:11 | |
| *** markvoelker has quit IRC | 10:12 | |
| *** e0ne has joined #openstack-keystone | 10:12 | |
| *** bjornar has joined #openstack-keystone | 10:15 | |
| *** daemontool_ has joined #openstack-keystone | 10:24 | |
| *** daemontool has quit IRC | 10:27 | |
| *** GB21 has joined #openstack-keystone | 10:27 | |
| *** spzala has joined #openstack-keystone | 10:31 | |
| *** spzala has quit IRC | 10:36 | |
| *** fundcor has left #openstack-keystone | 10:41 | |
| *** GB21 has quit IRC | 10:41 | |
| *** GB21 has joined #openstack-keystone | 10:42 | |
| openstackgerrit | Dina Belova proposed openstack/keystone: Add DB operations tracing https://review.openstack.org/294535 | 10:43 |
| openstackgerrit | Dina Belova proposed openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 10:43 |
| *** timcline has joined #openstack-keystone | 10:45 | |
| *** e0ne has quit IRC | 10:47 | |
| *** timcline has quit IRC | 10:50 | |
| *** tellesnobrega is now known as tellesnobrega_af | 10:50 | |
| *** e0ne has joined #openstack-keystone | 10:52 | |
| *** GB21 has quit IRC | 10:56 | |
| *** GB21 has joined #openstack-keystone | 10:56 | |
| *** trown|outtypewww is now known as trown | 10:59 | |
| *** markvoelker has joined #openstack-keystone | 11:02 | |
| *** e0ne has quit IRC | 11:04 | |
| *** markvoelker has quit IRC | 11:06 | |
| *** e0ne has joined #openstack-keystone | 11:08 | |
| *** rudolfvriend has joined #openstack-keystone | 11:09 | |
| *** rudolfvriend has quit IRC | 11:09 | |
| *** rudolfvriend_ has joined #openstack-keystone | 11:09 | |
| *** e0ne has quit IRC | 11:11 | |
| *** rudolfvriend_ has quit IRC | 11:22 | |
| *** rudolfvriend has joined #openstack-keystone | 11:23 | |
| *** GB21 has quit IRC | 11:29 | |
| *** GB21 has joined #openstack-keystone | 11:29 | |
| *** e0ne has joined #openstack-keystone | 11:33 | |
| *** spzala has joined #openstack-keystone | 11:33 | |
| *** daemontool_ is now known as daemontool | 11:37 | |
| *** spzala has quit IRC | 11:38 | |
| *** rk4n has joined #openstack-keystone | 11:38 | |
| *** GB21 has quit IRC | 11:45 | |
| *** GB21 has joined #openstack-keystone | 11:45 | |
| *** timcline has joined #openstack-keystone | 11:45 | |
| *** e0ne has quit IRC | 11:50 | |
| *** timcline has quit IRC | 11:50 | |
| *** e0ne has joined #openstack-keystone | 11:54 | |
| *** e0ne has quit IRC | 11:57 | |
| *** mvk_ has joined #openstack-keystone | 12:03 | |
| *** mvk has quit IRC | 12:07 | |
| *** ninag has joined #openstack-keystone | 12:08 | |
| *** e0ne has joined #openstack-keystone | 12:09 | |
| *** naresht has joined #openstack-keystone | 12:11 | |
| *** Nirupama has quit IRC | 12:13 | |
| *** mvk_ has quit IRC | 12:17 | |
| *** rderose has joined #openstack-keystone | 12:24 | |
| *** gordc has joined #openstack-keystone | 12:24 | |
| *** dave-mccowan has joined #openstack-keystone | 12:32 | |
| *** spzala has joined #openstack-keystone | 12:34 | |
| *** GB21 has quit IRC | 12:35 | |
| htruta | stevemar: I am totally interested! | 12:37 |
| *** GB21 has joined #openstack-keystone | 12:38 | |
| *** spzala has quit IRC | 12:39 | |
| *** henrynash has joined #openstack-keystone | 12:43 | |
| *** ChanServ sets mode: +v henrynash | 12:43 | |
| *** GB21 has quit IRC | 12:46 | |
| *** timcline has joined #openstack-keystone | 12:46 | |
| *** dims_ has quit IRC | 12:49 | |
| *** dims has joined #openstack-keystone | 12:49 | |
| *** mvk_ has joined #openstack-keystone | 12:50 | |
| *** timcline has quit IRC | 12:51 | |
| *** edmondsw has joined #openstack-keystone | 12:53 | |
| *** e0ne has quit IRC | 12:57 | |
| *** henrynash has quit IRC | 13:02 | |
| *** EinstCrazy has joined #openstack-keystone | 13:09 | |
| *** links has quit IRC | 13:12 | |
| *** e0ne has joined #openstack-keystone | 13:15 | |
| *** spzala has joined #openstack-keystone | 13:16 | |
| samueldmq | stevemar: that'd be good | 13:19 |
| samueldmq | morgan: we could also add something related to that conversation on services trusting services, resulting in a token only needing to be validated once for a workflow (eg create instance) | 13:20 |
| *** topol_ has joined #openstack-keystone | 13:22 | |
| *** ChanServ sets mode: +v topol_ | 13:22 | |
| *** pauloewerton has joined #openstack-keystone | 13:23 | |
| *** dansmith is now known as bizarroman | 13:25 | |
| *** bizarroman is now known as bizarrodan | 13:25 | |
| *** clenimar has joined #openstack-keystone | 13:27 | |
| *** dims_ has joined #openstack-keystone | 13:27 | |
| *** topol_ has quit IRC | 13:27 | |
| *** e0ne has quit IRC | 13:29 | |
| *** EinstCrazy has quit IRC | 13:30 | |
| *** richm has joined #openstack-keystone | 13:32 | |
| *** jistr has quit IRC | 13:32 | |
| *** openstackgerrit has quit IRC | 13:33 | |
| *** openstackgerrit has joined #openstack-keystone | 13:33 | |
| *** spzala has quit IRC | 13:36 | |
| *** spzala has joined #openstack-keystone | 13:36 | |
| *** jsavak has joined #openstack-keystone | 13:39 | |
| *** rodrigods has quit IRC | 13:39 | |
| *** rodrigods has joined #openstack-keystone | 13:39 | |
| *** markvoelker has joined #openstack-keystone | 13:47 | |
| *** timcline has joined #openstack-keystone | 13:47 | |
| *** EinstCrazy has joined #openstack-keystone | 13:50 | |
| *** e0ne has joined #openstack-keystone | 13:51 | |
| *** markvoelker has quit IRC | 13:51 | |
| *** timcline has quit IRC | 13:51 | |
| *** jaugustine has joined #openstack-keystone | 13:58 | |
| *** openstack has quit IRC | 13:58 | |
| *** openstack has joined #openstack-keystone | 13:58 | |
| *** dan_nguyen has quit IRC | 13:58 | |
| *** daemontool_ has joined #openstack-keystone | 13:59 | |
| *** daemontool has quit IRC | 13:59 | |
| *** daemontool_ is now known as daemontool | 14:01 | |
| stevemar | samueldmq: htruta sure, feel free to add it to the list of topics to see if it gets picked up, i'd be happy to back you both up | 14:04 |
| *** pushkaru has joined #openstack-keystone | 14:06 | |
| *** sdake has joined #openstack-keystone | 14:06 | |
| htruta | stevemar: what exactly do we want? to have a single v3 only gate or to make all gates run v3 only? | 14:07 |
| *** e0ne has quit IRC | 14:07 | |
| htruta | stevemar: we already have a v3 only gate in glance and neutron | 14:07 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:08 | |
| stevemar | htruta: i guess we want to talk about how every time we make a change in devstack that tries to push the ball forward we end up breaking everything | 14:08 |
| stevemar | so, what do we envision are things to do, and why do we want to pull in other teams/projects? | 14:09 |
| *** jsavak has quit IRC | 14:09 | |
| stevemar | maybe the discussion is over and there's no need for a session, just a matter of fixing things, i'm not sure | 14:09 |
| *** jsavak has joined #openstack-keystone | 14:10 | |
| htruta | stevemar: there isn't exactly a discussion... what we actually need is to gather every kind of problem on that | 14:11 |
| htruta | is the session the better place for it? | 14:11 |
| morgan | samueldmq: that is something we can mostly do once everything uses ksa | 14:18 |
| morgan | With config changes mostly. | 14:18 |
| morgan | Or with minor changes to the other services to allow config for service to service | 14:18 |
| *** tellesnobrega_af is now known as tellesnobrega | 14:18 | |
| stevemar | morgan: there's still a ton of gate jobs that are gonna be bust | 14:20 |
| morgan | Getting to v3 is important independent of the trust thing. The trust thing is something I've been trying to address with as little code as possible. | 14:21 |
| morgan | That won't break as much. It should be almost doable in devstack once ksa is there | 14:22 |
| stevemar | dolphm: lbragstad nonameentername any way we can get a spec for MFA up before the summit? :) | 14:22 |
| *** henrynash has joined #openstack-keystone | 14:28 | |
| *** ChanServ sets mode: +v henrynash | 14:28 | |
| *** rderose_ has joined #openstack-keystone | 14:29 | |
| *** dan_nguyen has joined #openstack-keystone | 14:29 | |
| *** knikolla has joined #openstack-keystone | 14:31 | |
| lbragstad | stevemar I thought there was one up? | 14:32 |
| lbragstad | stevemar https://review.openstack.org/#/c/272287/ | 14:32 |
| patchbot | lbragstad: patch 272287 - keystone-specs - Add spec for multifactor authentication | 14:32 |
| stevemar | whoaaaa | 14:33 |
| *** slberger has joined #openstack-keystone | 14:33 | |
| stevemar | why we we not reviewing it!? | 14:33 |
| stevemar | :) | 14:33 |
| stevemar | probably cause i forgot about it | 14:33 |
| *** lamt has joined #openstack-keystone | 14:36 | |
| *** phalmos has joined #openstack-keystone | 14:37 | |
| *** markvoelker has joined #openstack-keystone | 14:41 | |
| *** ametts has joined #openstack-keystone | 14:42 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 14:44 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:45 | |
| *** jistr has joined #openstack-keystone | 14:46 | |
| *** markvoelker has quit IRC | 14:47 | |
| stevemar | lbragstad: btw, i fixed up https://review.openstack.org/#/c/292227/3 according to your comments | 14:47 |
| patchbot | stevemar: patch 292227 - keystone - create a new `advanced topics` section in the docs | 14:47 |
| *** timcline has joined #openstack-keystone | 14:48 | |
| *** bjornar has quit IRC | 14:49 | |
| *** henrynash has quit IRC | 14:49 | |
| *** spzala has quit IRC | 14:50 | |
| stevemar | lbragstad: also for newton, if you're doing reviews: https://review.openstack.org/#/c/294816/ :) | 14:50 |
| patchbot | stevemar: patch 294816 - keystone - remove endpoint_policy from contrib | 14:50 |
| *** timcline has quit IRC | 14:52 | |
| *** mylu has joined #openstack-keystone | 14:53 | |
| *** woodster_ has joined #openstack-keystone | 14:54 | |
| *** e0ne has joined #openstack-keystone | 14:57 | |
| *** GB21 has joined #openstack-keystone | 14:57 | |
| *** jsavak has quit IRC | 15:02 | |
| *** jsavak has joined #openstack-keystone | 15:03 | |
| *** EinstCrazy has quit IRC | 15:05 | |
| *** markvoelker has joined #openstack-keystone | 15:05 | |
| *** links has joined #openstack-keystone | 15:07 | |
| *** josecastroleon has quit IRC | 15:07 | |
| *** timcline has joined #openstack-keystone | 15:16 | |
| *** tellesnobrega is now known as tellesnobrega_af | 15:17 | |
| *** browne has joined #openstack-keystone | 15:20 | |
| *** mylu has quit IRC | 15:24 | |
| stevemar | low hanging fruit: https://bugs.launchpad.net/keystone/+bug/1564961 | 15:27 |
| openstack | Launchpad bug 1564961 in OpenStack Identity (keystone) "provide a deprecation reason for "domain_id_immutable" config option" [Low,Triaged] | 15:27 |
| *** naresht has quit IRC | 15:27 | |
| *** mylu has joined #openstack-keystone | 15:28 | |
| *** jsavak has quit IRC | 15:29 | |
| *** spzala has joined #openstack-keystone | 15:31 | |
| *** david_cu has joined #openstack-keystone | 15:31 | |
| *** e0ne has quit IRC | 15:31 | |
| edmondsw | stevemar, fyi, someone added a comment in https://review.openstack.org/#/c/282080/ asking if it could be backported to liberty. | 15:31 |
| patchbot | edmondsw: patch 282080 - keystone - Allow user list without specifying domain (MERGED) | 15:31 |
| *** jsavak has joined #openstack-keystone | 15:33 | |
| *** mylu has quit IRC | 15:38 | |
| *** mylu has joined #openstack-keystone | 15:40 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:42 | |
| stevemar | edmondsw: i dont see why not | 15:42 |
| *** GB21 has quit IRC | 15:43 | |
| stevemar | edmondsw: hit that cherry pick button! | 15:43 |
| *** bjornar has joined #openstack-keystone | 15:43 | |
| *** david_cu has quit IRC | 15:43 | |
| edmondsw | stevemar cool. I've never backported something before, so that could be an interesting exercise | 15:43 |
| stevemar | click cherry-pick and type in "stable/liberty" | 15:44 |
| *** Guest90877 has quit IRC | 15:44 | |
| *** roxanaghe has joined #openstack-keystone | 15:46 | |
| *** david_cu has joined #openstack-keystone | 15:50 | |
| *** links has quit IRC | 15:55 | |
| bknudson | classic april fools commit -- https://review.openstack.org/#/c/97838/ | 15:56 |
| patchbot | bknudson: patch 97838 - keystone - replace domains & projects with unicorns & ponies (ABANDONED) | 15:56 |
| knikolla | haha | 15:58 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Define identity interface - easy cases https://review.openstack.org/291950 | 16:02 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Opportunistic LDAP testing https://review.openstack.org/300237 | 16:02 |
| *** rudolfvriend has quit IRC | 16:04 | |
| *** naresht has joined #openstack-keystone | 16:06 | |
| *** trown is now known as trown|lunch | 16:06 | |
| openstackgerrit | Tom Cocozzello (tjcocozz) proposed openstack/keystone: Run federation tests under Python 3 https://review.openstack.org/294797 | 16:07 |
| *** roxanaghe has quit IRC | 16:08 | |
| *** lhcheng has joined #openstack-keystone | 16:09 | |
| *** ChanServ sets mode: +v lhcheng | 16:09 | |
| *** bjornar has quit IRC | 16:12 | |
| *** zzzeek has quit IRC | 16:13 | |
| *** zzzeek has joined #openstack-keystone | 16:14 | |
| *** mylu has quit IRC | 16:15 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Define identity interface - easy cases https://review.openstack.org/291950 | 16:15 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Opportunistic LDAP testing https://review.openstack.org/300237 | 16:15 |
| *** roxanaghe has joined #openstack-keystone | 16:21 | |
| *** rderose_ has quit IRC | 16:23 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Opportunistic LDAP testing https://review.openstack.org/300237 | 16:24 |
| *** e0ne has joined #openstack-keystone | 16:24 | |
| *** e0ne has quit IRC | 16:29 | |
| *** roxanaghe has quit IRC | 16:29 | |
| *** e0ne has joined #openstack-keystone | 16:29 | |
| *** openstackgerrit has quit IRC | 16:31 | |
| *** rcernin has quit IRC | 16:32 | |
| *** jsavak has quit IRC | 16:35 | |
| morgan | stevemar: hehe | 16:36 |
| morgan | edmondsw: oh hai | 16:36 |
| *** jsavak has joined #openstack-keystone | 16:36 | |
| edmondsw | morgan hi | 16:36 |
| edmondsw | ? | 16:36 |
| morgan | just sayin hi | 16:36 |
| morgan | cause why not | 16:36 |
| edmondsw | it's a Friday :) | 16:36 |
| edmondsw | why not | 16:36 |
| morgan | 0936... almost beer oclock | 16:37 |
| morgan | oh wait... | 16:37 |
| morgan | :P | 16:37 |
| morgan | but it's def friday and gorgeous out in Portland! | 16:37 |
| edmondsw | already past noon here... | 16:37 |
| *** gyee has joined #openstack-keystone | 16:37 | |
| *** ChanServ sets mode: +v gyee | 16:37 | |
| morgan | dude. i got billed $0.05 this month by linode =/ | 16:37 |
| morgan | :P | 16:37 |
| *** henrynash has joined #openstack-keystone | 16:37 | |
| *** ChanServ sets mode: +v henrynash | 16:37 | |
| *** naresht has quit IRC | 16:37 | |
| edmondsw | :) | 16:38 |
| morgan | oh sigh... it's Aril 1 | 16:38 |
| morgan | april* | 16:38 |
| *** e0ne has quit IRC | 16:39 | |
| morgan | this means today is a useless day on the internets | 16:39 |
| *** rk4n has quit IRC | 16:40 | |
| *** dflorea has joined #openstack-keystone | 16:40 | |
| *** pushkaru has quit IRC | 16:41 | |
| *** pushkaru has joined #openstack-keystone | 16:41 | |
| *** dflorea has quit IRC | 16:41 | |
| *** henrynash has quit IRC | 16:42 | |
| *** zqfan has quit IRC | 16:42 | |
| *** pcaruana has quit IRC | 16:44 | |
| *** openstackgerrit has joined #openstack-keystone | 16:45 | |
| *** david_cu has quit IRC | 16:47 | |
| *** dflorea has joined #openstack-keystone | 16:48 | |
| *** roxanaghe has joined #openstack-keystone | 16:50 | |
| *** david_cu has joined #openstack-keystone | 16:50 | |
| *** fawadkhaliq has quit IRC | 16:50 | |
| *** edmondsw has quit IRC | 16:50 | |
| *** dflorea has quit IRC | 16:50 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:50 | |
| *** dflorea has joined #openstack-keystone | 16:51 | |
| *** lamt has quit IRC | 16:51 | |
| *** clenimar has quit IRC | 16:54 | |
| *** e0ne has joined #openstack-keystone | 16:55 | |
| *** jsavak has quit IRC | 16:55 | |
| *** jsavak has joined #openstack-keystone | 16:56 | |
| *** tqtran has joined #openstack-keystone | 16:57 | |
| *** jsavak has quit IRC | 17:01 | |
| *** fhubik has joined #openstack-keystone | 17:02 | |
| *** jsavak has joined #openstack-keystone | 17:02 | |
| *** trown|lunch is now known as trown | 17:09 | |
| stevemar | ha | 17:11 |
| stevemar | totally useless internet day | 17:11 |
| *** e0ne has quit IRC | 17:15 | |
| *** fhubik has quit IRC | 17:16 | |
| *** rderose_ has joined #openstack-keystone | 17:24 | |
| samueldmq | bknudson: ahha | 17:25 |
| raildo | stevemar: like the Google Cardboard Plastic | 17:25 |
| samueldmq | dolphm: that was a good one :) | 17:25 |
| samueldmq | in preparation for hierarchical multiponency | 17:26 |
| samueldmq | :-) | 17:26 |
| morgan | did you see google mic drop? | 17:29 |
| morgan | before they turned it off | 17:29 |
| samueldmq | morgan: how did it work ? | 17:31 |
| morgan | google it | 17:31 |
| samueldmq | morgan: I remember to see something in gmail, but haven't tried | 17:31 |
| morgan | it'll describe it better | 17:31 |
| morgan | than i will | 17:31 |
| samueldmq | D: | 17:32 |
| samueldmq | actually I was affraid of googling | 17:32 |
| samueldmq | and reading another april fool's day joke :-) | 17:32 |
| samueldmq | anyways | 17:33 |
| *** rderose_ has quit IRC | 17:40 | |
| *** dflorea has quit IRC | 17:44 | |
| *** fawadkhaliq has quit IRC | 17:52 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:52 | |
| *** markvoelker has quit IRC | 17:52 | |
| *** markvoelker has joined #openstack-keystone | 17:56 | |
| *** jistr has quit IRC | 17:58 | |
| *** dflorea has joined #openstack-keystone | 17:59 | |
| *** dflorea has quit IRC | 18:02 | |
| *** harlowja has quit IRC | 18:02 | |
| *** jed56 has quit IRC | 18:03 | |
| *** dflorea has joined #openstack-keystone | 18:04 | |
| *** tellesnobrega_af is now known as tellesnobrega | 18:07 | |
| *** jsavak has quit IRC | 18:08 | |
| *** jsavak has joined #openstack-keystone | 18:08 | |
| *** gordc has quit IRC | 18:09 | |
| *** daemontool has quit IRC | 18:18 | |
| *** dflorea has quit IRC | 18:18 | |
| *** mvk_ has quit IRC | 18:19 | |
| *** dflorea has joined #openstack-keystone | 18:20 | |
| *** dflorea has quit IRC | 18:23 | |
| *** markvoelker has quit IRC | 18:31 | |
| *** edmondsw has joined #openstack-keystone | 18:32 | |
| *** dflorea has joined #openstack-keystone | 18:43 | |
| *** dflorea has joined #openstack-keystone | 18:43 | |
| *** gordc has joined #openstack-keystone | 18:47 | |
| *** bjornar has joined #openstack-keystone | 18:50 | |
| *** jaugustine has quit IRC | 18:52 | |
| *** david-lyle has quit IRC | 18:53 | |
| *** markvoelker has joined #openstack-keystone | 18:53 | |
| *** markvoelker has quit IRC | 18:53 | |
| *** markvoelker has joined #openstack-keystone | 18:54 | |
| *** markvoelker has quit IRC | 18:54 | |
| *** markvoelker has joined #openstack-keystone | 18:54 | |
| *** dflorea has quit IRC | 18:57 | |
| *** david-lyle has joined #openstack-keystone | 18:59 | |
| *** dflorea has joined #openstack-keystone | 19:01 | |
| *** timcline has quit IRC | 19:02 | |
| *** timcline has joined #openstack-keystone | 19:03 | |
| *** fawadkhaliq has quit IRC | 19:05 | |
| *** lhcheng has quit IRC | 19:06 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:06 | |
| *** fawadkhaliq has quit IRC | 19:07 | |
| *** timcline has quit IRC | 19:07 | |
| *** ebalduf has joined #openstack-keystone | 19:11 | |
| *** jsavak has quit IRC | 19:11 | |
| *** jsavak has joined #openstack-keystone | 19:13 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:13 | |
| *** rderose_ has joined #openstack-keystone | 19:18 | |
| *** rk4n has joined #openstack-keystone | 19:19 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Add logging to cli if keystone.conf is not found https://review.openstack.org/300131 | 19:21 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP - ldap3 Identity Driver https://review.openstack.org/296090 | 19:22 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/300626 | 19:29 |
| *** roxanaghe has quit IRC | 19:34 | |
| *** harlowja has joined #openstack-keystone | 19:37 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP - ldap3 Identity Driver https://review.openstack.org/296090 | 19:39 |
| *** jsavak has quit IRC | 19:39 | |
| *** dflorea has quit IRC | 19:39 | |
| *** sudorandom has quit IRC | 19:39 | |
| *** dflorea has joined #openstack-keystone | 19:41 | |
| *** sudorandom has joined #openstack-keystone | 19:41 | |
| *** dflorea has quit IRC | 19:42 | |
| *** fawadkhaliq has quit IRC | 19:43 | |
| *** mvk_ has joined #openstack-keystone | 19:43 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:44 | |
| *** fawadkhaliq has quit IRC | 19:45 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:46 | |
| lbragstad | dolphm thoughts on https://review.openstack.org/#/c/222042/4 | 19:46 |
| patchbot | lbragstad: patch 222042 - keystonemiddleware - Return default value for pkg_version if missing | 19:46 |
| stevemar | lbragstad: meh to that one | 19:49 |
| *** dflorea_ has joined #openstack-keystone | 19:49 | |
| stevemar | i'm pretty sure jamielennox installed a broken package once | 19:49 |
| stevemar | (according to the bug report anyway) | 19:50 |
| stevemar | but it's harmless | 19:50 |
| lbragstad | stevemar should we abandon and mark the bug as imcomplete? | 19:51 |
| stevemar | lbragstad: that or merge the fix, no one else is hitting the bug | 19:51 |
| *** jsavak has joined #openstack-keystone | 19:54 | |
| lbragstad | crinkle thanks for the quick turnaround on https://review.openstack.org/#/c/300131/3 | 19:54 |
| patchbot | lbragstad: patch 300131 - keystone - Add logging to cli if keystone.conf is not found | 19:54 |
| crinkle | lbragstad: thanks for the comments, looking now | 19:55 |
| bjornar | Can someone please push a quick fix to --keystone-user and --keystone-group to make get_user_group just return with int(argument) if argument is numeric? | 19:56 |
| bjornar | ..this to allow passing uid/gid to it | 19:56 |
| stevemar | bjornar: not really sure what you're referring to? is this ansible/puppet related? | 19:57 |
| *** ebalduf has quit IRC | 19:58 | |
| stevemar | bjornar: i don't think the keystone code base has anything --keystone-user related... this sounds like a tool that is calling keystone | 19:58 |
| stevemar | ohh... maybe the PKI setup command? | 19:59 |
| stevemar | or fernet setup? | 19:59 |
| *** rk4n has quit IRC | 20:00 | |
| lbragstad | bjornar what's the issue you're hitting? | 20:00 |
| lbragstad | stevemar yeah - that's exactly what we do for fernet_setup | 20:01 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/cmd/cli.py#L407-L425 | 20:02 |
| lbragstad | but we use that same logic in PKISetup | 20:02 |
| lbragstad | and SSLSetup | 20:02 |
| stevemar | lbragstad: sounds like he wants to use the uid of a user (or gid of a group), which is an ints, instead of the user name / group name | 20:02 |
| stevemar | $ id -u <username> -- should print your uid | 20:03 |
| *** timcline has joined #openstack-keystone | 20:03 | |
| bjornar | stevemar, yeah, fernet setup/rotate | 20:03 |
| stevemar | bjornar: unfortunately it'll go into the newton release at this point :( | 20:04 |
| *** fawadkhaliq has quit IRC | 20:04 | |
| bjornar | since a user is never a int, it can safely just if int then return int(arg) | 20:04 |
| morgan | stevemar: well. it might be backportable to mitaka 1'st maint release? | 20:04 |
| *** dflorea_ has quit IRC | 20:04 | |
| bjornar | its so simple, you should be able to merge it now ;) | 20:04 |
| morgan | if it's a legit bug | 20:04 |
| *** fawadkhaliq has joined #openstack-keystone | 20:05 | |
| stevemar | morgan: yeah, we can backport to the first maint release | 20:05 |
| *** dflorea has joined #openstack-keystone | 20:05 | |
| morgan | bjornar: it can't go in mitaka release though, it's not a big enough bug (it's a behavior we've had for a while) - for RC blocking | 20:05 |
| morgan | stevemar: yeah i think that sounds like a solid plan | 20:05 |
| stevemar | bjornar: unfortunately everything is frozen, we are only fixing security / release critical bugs at this point for mitaka | 20:05 |
| morgan | hit it in master, plan it [if it's not crazypants icky] into the 1st maint release of mitaka | 20:05 |
| *** rk4n has joined #openstack-keystone | 20:05 | |
| morgan | so it can land as soon as mitaka-final is cut | 20:05 |
| lbragstad | bjornar stevemar morgan this looks like it supports ints interpretted as uids https://github.com/openstack/keystone/blob/master/keystone/common/utils.py#L274 | 20:06 |
| bjornar | morgan, yeah, ok, fine, but would be nice if you could just push it to some branch or however you do it, so I dont need to go throuh this insane pull request cycle for 10 chars of code ;) | 20:06 |
| morgan | lbragstad: yeah looks like it does. | 20:06 |
| morgan | bjornar: well. uhm.. gerrit is the workflow ;) | 20:06 |
| morgan | bjornar: we can handle the backport part once it's submitted | 20:06 |
| morgan | or we can handle writing the code/bug smashing as long as the bug is clearly filed | 20:06 |
| lbragstad | and it doesn't look like any of the fernet cli stuff prevents the use of ints in that comment | 20:07 |
| lbragstad | command* | 20:07 |
| stevemar | bjornar: do you have a fix already? you can write a bug report and attach it | 20:07 |
| lbragstad | bjornar do you have a trace of this failing? | 20:07 |
| bjornar | it does, does not accept ints | 20:07 |
| *** jsavak has quit IRC | 20:07 | |
| morgan | bjornar: so file us a bug, include repro steps/trace of the fail, if you have a fix, feel free to submit it | 20:07 |
| morgan | bjornar: we can take it from there :) | 20:07 |
| morgan | stevemar: also jclouds email, just making sure you saw it | 20:08 |
| bjornar | yeah, ok | 20:08 |
| morgan | bjornar: def. ping us in the channel once the bug is filed | 20:08 |
| *** timcline has quit IRC | 20:08 | |
| morgan | with the number | 20:08 |
| *** jsavak has joined #openstack-keystone | 20:08 | |
| *** roxanaghe has joined #openstack-keystone | 20:09 | |
| bjornar | 2016-04-01 20:09:16.799 9 ERROR keystone ValueError: Unknown user '1000' in --keystone-user | 20:09 |
| *** rk4n has quit IRC | 20:10 | |
| bjornar | #2564 | 20:11 |
| *** pushkaru has quit IRC | 20:11 | |
| bjornar | morgan, PING | 20:12 |
| morgan | lbragstad: ^ [mind helping to get this filed as a bug, i need to run for a few (sorry)] | 20:12 |
| lbragstad | morgan sure | 20:13 |
| lbragstad | bjornar what command are you running? | 20:13 |
| bjornar | says in #2564 | 20:13 |
| lbragstad | what is 2564? | 20:13 |
| lbragstad | do you have a link? | 20:13 |
| bjornar | https://github.com/keystonejs/keystone/issues/2564 | 20:14 |
| *** dflorea has quit IRC | 20:14 | |
| bjornar | I have made this nice tshirt for Austin with the sql queries keystone runs to get a token issues with fernet.. hard to fit on the tshirt tho.. | 20:14 |
| bjornar | ;) | 20:14 |
| morgan | keystonejs? | 20:15 |
| morgan | what is that? | 20:15 |
| lbragstad | bjornar I think you've got the wrong project - for OpenStack Keystone we file bugs against https://bugs.launchpad.net/keystone | 20:15 |
| bjornar | oh, heck.. hehe | 20:15 |
| lbragstad | also - the source for the keystone project is in https://github.com/openstack/keystone | 20:15 |
| lbragstad | and http://git.openstack.org/cgit/openstack/keystone | 20:15 |
| bjornar | just url competion, and did not notice, anyway.. there's the bug.. | 20:15 |
| bjornar | hehe | 20:15 |
| lbragstad | bjornar I can't seem to reproduce with the command you have | 20:17 |
| lbragstad | bjornar here is what I get | 20:17 |
| lbragstad | bjornar http://cdn.pasteraw.com/hu80dcj1kmz2hf0l7jzsr242bxj4cf0 | 20:17 |
| lbragstad | which looks like it's picking up the uid as an integer | 20:17 |
| *** sdake has quit IRC | 20:17 | |
| bjornar | what is your --version ? | 20:18 |
| lbragstad | because I'm getting the expected output from those comments (operation not permitted) | 20:18 |
| lbragstad | bjornar I created on master | 20:18 |
| lbragstad | bjornar what version of keystone are you using? | 20:18 |
| bjornar | hmm.. I believe I am on stable/mitaka branch | 20:19 |
| bjornar | yeah, I am | 20:19 |
| *** rderose_ has quit IRC | 20:20 | |
| lbragstad | bjornar ok - let me try that | 20:21 |
| *** pushkaru has joined #openstack-keystone | 20:21 | |
| lbragstad | bjornar I get the same output from stable/mitaka as I do with master | 20:24 |
| bjornar | This is odd | 20:24 |
| lbragstad | bjornar is there another user ID/group ID you can try with? | 20:25 |
| *** roxanaghe has quit IRC | 20:26 | |
| lbragstad | bjornar I get the expected output when I provide a group or user id that doesn't exist on my system - http://cdn.pasteraw.com/bywgqnkh6crud25cvksrcloc4ryiny5 | 20:26 |
| bjornar | sure.. but perhaps you have the user defined, I dont know, try 99999 99999 | 20:26 |
| bjornar | yeah, exactly | 20:26 |
| lbragstad | bjornar yes - it's the ubuntu user/group on my system | 20:26 |
| lbragstad | which is why it works | 20:26 |
| bjornar | exactly, so it is for sure a bug | 20:27 |
| lbragstad | how? | 20:27 |
| bjornar | a uid does not need to have something defined in /etc/passwd to be used | 20:27 |
| morgan | lbragstad: he's correct | 20:27 |
| morgan | chown can set arbitrary uid | 20:27 |
| morgan | this is used in some cases. | 20:27 |
| bjornar | and in the container case, it is useful not having to generate a passwd file | 20:28 |
| bjornar | So I mean the getuid/gid is simply if(/^%d$/ return int(arg) | 20:28 |
| bjornar | since numeric usernames are not supported | 20:29 |
| lbragstad | hmm | 20:29 |
| bjornar | no hmm, yes | 20:29 |
| *** cdcasey has joined #openstack-keystone | 20:29 | |
| *** cdcasey has left #openstack-keystone | 20:29 | |
| *** timcline has joined #openstack-keystone | 20:30 | |
| bjornar | %d+ even | 20:30 |
| bjornar | or is_numeric or whatever way | 20:30 |
| *** sdake has joined #openstack-keystone | 20:33 | |
| *** roxanaghe has joined #openstack-keystone | 20:35 | |
| lbragstad | bjornar is the problem the fact that you can't specify some integer and have the command succeed? | 20:36 |
| bjornar | yeah | 20:36 |
| bjornar | because I do not have a user I can resolve to the number | 20:37 |
| *** markvoelker has quit IRC | 20:37 | |
| lbragstad | bjornar it appears we rely on pwd to do this checking for us | 20:38 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/common/utils.py#L317 | 20:38 |
| lbragstad | bjornar are you proposing that we remove the logic in place of just returning whatever is supplied (in the integer case)? | 20:39 |
| bjornar | Yes, or return null as name from get_unix_* .. but that might be dangerous | 20:39 |
| morgan | lbragstad: i think he's saying if it's an int, it may not need to do the userlookup | 20:40 |
| morgan | but if it is a string it's worth looking up for the id | 20:40 |
| morgan | bjornar: ^ ? | 20:40 |
| bjornar | so I would say dont even call the get_unix_* when input is numeric | 20:40 |
| ayoung | bjornar, want a better approach? | 20:40 |
| lbragstad | morgan will that ever be dangerous? | 20:40 |
| morgan | eh, you can do it with apache and the like | 20:40 |
| ayoung | https://adam.younglogic.com/2014/05/keystone-federation-via-mod_lookup_identity/ | 20:40 |
| morgan | i'm going to go out on a limb and say not needed | 20:40 |
| morgan | ayoung: that isn't what he's asking for, he's asking for a container case where no posix user is needed. | 20:41 |
| *** browne has quit IRC | 20:41 | |
| *** jsavak has quit IRC | 20:41 | |
| bjornar | this is easy, why complicate it | 20:41 |
| bjornar | if is_numeric(arg) return int(arg) | 20:41 |
| bjornar | done | 20:41 |
| morgan | ayoung: system users for running keystone (fernet posix permissions) | 20:41 |
| *** jsavak has joined #openstack-keystone | 20:41 | |
| morgan | not the keystone api users. | 20:41 |
| morgan | erm s/not needed/ not insecure | 20:41 |
| morgan | lbragstad: ^ bjornar cc | 20:42 |
| *** raildo is now known as raildo-afk | 20:42 | |
| ayoung | morgan, non HTTPD? | 20:42 |
| bjornar | morgan, yeah, was getting afraid there. | 20:42 |
| morgan | ayoung: doesn't matter if it's apache, uwsgi, whatever | 20:42 |
| ayoung | morgan, where did all that crap come from? | 20:42 |
| morgan | it's the system accounts that run the daemons. | 20:42 |
| bjornar | come on guys.. have a basic understanding here | 20:42 |
| bjornar | hehe | 20:42 |
| morgan | so what user is running apache or uwsgi | 20:43 |
| ayoung | John Dennis | 20:43 |
| morgan | and needed access to the fernet key repo | 20:43 |
| ayoung | heh | 20:43 |
| ayoung | GAH... All that crap for PKI | 20:43 |
| bjornar | morgan, asking me? | 20:43 |
| ayoung | I gues we use it for Fernet now? | 20:43 |
| morgan | bjornar: no just was pointing out my statement | 20:44 |
| ayoung | and in the container case, they don't want a posix user? | 20:44 |
| morgan | that it shouldn't be a security concern to not do a user lookup against passwd for running a daemon if the uid specified is an int | 20:44 |
| bjornar | yeah, and to cut the crap and get to the basics, a username or groupname can _never_ be numeric, so if input is numeric, input _IS_ uid/gid. | 20:44 |
| morgan | ayoung: some containers don't have entries in passwd file | 20:44 |
| *** mylu has joined #openstack-keystone | 20:45 | |
| morgan | ayoung: because it's more work to update it everytime you deploy a new one. | 20:45 |
| morgan | so just like root | 20:45 |
| ayoung | morgan, that does not mean getent passwd user does not return anything | 20:45 |
| bjornar | yeah | 20:45 |
| morgan | ayoung: right. it just fails in the python case | 20:45 |
| *** browne has joined #openstack-keystone | 20:45 | |
| morgan | since the user doesn't exist | 20:45 |
| morgan | normal getent may work | 20:45 |
| morgan | python isn't always normal | 20:45 |
| morgan | ayoung: or according to what bjornar is seeing | 20:46 |
| morgan | it fails | 20:46 |
| bjornar | getent passwd 8888 || echo no | 20:46 |
| bjornar | no | 20:46 |
| * morgan hasn't had a chance to test this yet today | 20:46 | |
| *** roxanaghe has quit IRC | 20:46 | |
| ayoung | bjornar, I'm not 100% buying this | 20:46 |
| ayoung | why are you using numerics? | 20:46 |
| bjornar | ayoung, thats because you are stupid | 20:46 |
| ayoung | bjornar, probably | 20:46 |
| bjornar | you dont know unix | 20:46 |
| ayoung | Nah, not at all | 20:46 |
| ayoung | Isn;'t that what happens when a guy starts singing soprano? | 20:47 |
| bjornar | answer is: why would you care why I am using uids .. (and it is explained 10 times by me and morgan) | 20:47 |
| bjornar | morgan, please just do it! | 20:47 |
| bjornar | (and I will give you a tshirt) | 20:48 |
| bjornar | ;) | 20:48 |
| ayoung | bjornar, why are you using numerics? | 20:48 |
| bjornar | because I dont have a /etc/passwd or /etc/group entry | 20:48 |
| bjornar | nothing resolves to the uid I need | 20:48 |
| bjornar | (in the container) | 20:49 |
| bjornar | outside container, it resolves to keystone | 20:49 |
| ayoung | bjornar, the container needs to be able to support the standard posix system call. | 20:49 |
| bjornar | no | 20:49 |
| *** roxanaghe has joined #openstack-keystone | 20:49 | |
| bjornar | it supports the system call.. | 20:49 |
| ayoung | bjornar, yes | 20:49 |
| bjornar | please, give me a break here someone! | 20:50 |
| ayoung | bjornar, the apps should not be looking in etc passwd or antyihg | 20:50 |
| ayoung | bjornar, nope | 20:50 |
| ayoung | you called me stupid | 20:50 |
| morgan | yah ayoung pwd.getpwuid(1111) | 20:50 |
| ayoung | now you need to justify yourself | 20:50 |
| morgan | KeyError: 'getpwuid(): uid not found: 1111' | 20:50 |
| morgan | i'm staying out of the stupid convo | 20:50 |
| ayoung | morgan, nsswitch is not properly configured | 20:50 |
| *** dflorea has joined #openstack-keystone | 20:50 | |
| morgan | no | 20:50 |
| stevemar | this is getting weird, i'm out, dinner won't cook itself | 20:50 |
| morgan | 1111 is a known non-existent value | 20:50 |
| morgan | erm | 20:50 |
| morgan | user | 20:51 |
| morgan | python errors explicitly | 20:51 |
| morgan | and break | 20:51 |
| morgan | s | 20:51 |
| *** pauloewerton has quit IRC | 20:51 | |
| morgan | the command-line tool exits 1 or reports the value | 20:51 |
| morgan | so you can lookup or just pass if needed | 20:51 |
| bjornar | ayoung, you have just proved over 100 lines that you truly are stupid, I will frame it and put it on the wall in austin | 20:51 |
| ayoung | bjornar, go for it | 20:51 |
| morgan | anyway | 20:51 |
| morgan | at a tech level, python throws an error and we don't catch it, shell you could just keep going. | 20:52 |
| ayoung | bjornar, meanwhile, I've kindof worked in this world for a while, so I do, actually, have a sense of what I am talking about | 20:52 |
| bjornar | /save log for_printing.txt | 20:52 |
| * morgan backs off and lets the rest of the convo continue | 20:52 | |
| bjornar | ok, I will quit this crap, but its a small obvious case gone wrong. Just understand it, ok | 20:52 |
| morgan | bjornar: can we refrain from calling names? adam is not stupid - i know this based on working with him a bit | 20:53 |
| bjornar | security is not about usernames, its about uid's | 20:53 |
| morgan | bjornar: your case is, i think, a reasonable request | 20:53 |
| ayoung | bjornar, BTW...I make things happen. You explain to me why it makes sense for a container to OK an ID and not the string version of a name and I'll approve. | 20:53 |
| ayoung | You don't convince me, and it won't. | 20:53 |
| bjornar | morgan, ok, I will find another word for incompetent | 20:53 |
| lbragstad | bjornar can you shed light on some specific about your containers? | 20:53 |
| lbragstad | specifics* | 20:54 |
| morgan | bjornar: adam is just making sure he knows what you're accomplishing so he isn't worried about carrying code that doesn't make sense. and it's just good practice to have a solid user story | 20:54 |
| bjornar | lbragstad, nothing special about them, they just dont have a /etc/passwd and /etc/group file containing the users. | 20:54 |
| ayoung | bjornar, feel free to insult me all you want. Do not insult other people in this channel. | 20:54 |
| morgan | bjornar: so lets phrase it like this: I have containers, and instead of running a CMS to populate all the password/group entries, i use a known uid for my daemons | 20:54 |
| bjornar | morgan, can we just agree that it is totally safe and ok to do: if is_numeric(uid_or_gid) return int(uid_or_gid) ? | 20:54 |
| *** dflorea has quit IRC | 20:55 | |
| bjornar | morgan, exactly what I do | 20:55 |
| morgan | ayoung: ^ and i think that is a fair statement. | 20:55 |
| morgan | so it should be safe to use a uid that isn't in password to run a daemon, right? | 20:55 |
| morgan | or is there a reason not to? | 20:55 |
| ayoung | bjornar, I know of exactly one case where it is necessary for the numeric IDs to match. That is NFS. In the case where a container does not have a NS to resolve to, I am pretty sure it is an error on the container side, but, hey, I am willing to admin when I am wrong. | 20:56 |
| ayoung | But I don't see it yet. | 20:56 |
| bjornar | then you need glasses | 20:56 |
| ayoung | bjornar, I have glasses | 20:57 |
| ayoung | I've had Lasik | 20:57 |
| openstackgerrit | Cristian Sava proposed openstack/keystone: Customize config file location when run as wsgi app. https://review.openstack.org/288216 | 20:57 |
| ayoung | and I still need glasses. | 20:57 |
| ayoung | But I also know how nsswitch is supposed to work, and if that lookup is not working correctly, I want to know why. | 20:57 |
| ayoung | And, I can understand if python hads a bug | 20:57 |
| morgan | ayoung: in this case, nsswitch is correct | 20:58 |
| morgan | ayoung: there just is no user populated, but he knows he wants to run keystone with uid 15000 | 20:58 |
| morgan | since container runs a single process and when the process exits the container exits | 20:59 |
| morgan | (docker style) | 20:59 |
| ayoung | morgan, that is just black magic | 20:59 |
| ayoung | I understand that | 20:59 |
| morgan | ayoung: not really, you can run apache with a UID not in passwd | 20:59 |
| morgan | and most other daemons | 20:59 |
| morgan | you cant if you use a string name | 20:59 |
| morgan | though | 20:59 |
| bjornar | yeah.. users dont exist in the kernel, uid's do | 20:59 |
| morgan | that needs to be in passwd file | 20:59 |
| bjornar | its like ip vs hostname | 20:59 |
| *** roxanaghe has quit IRC | 20:59 | |
| bjornar | you should be able to spesify both, right | 20:59 |
| morgan | so i want to run with uid 10000 or user "keystone" | 20:59 |
| bjornar | ping 10.0.0.1 .. not allowed.. must be a hostname | 21:00 |
| morgan | to be clear, I'm not advocating either way, just clarifying the user-story so we can determine if this makes sense | 21:00 |
| ayoung | morgan, I understand that you *can* but I am not 100 certain you *should* | 21:00 |
| ayoung | and that is what I am pondering | 21:00 |
| bjornar | ayoung, I will seriously kill you in austin! | 21:00 |
| ayoung | yeah, it means that ps shows numbers instead of names | 21:01 |
| ayoung | bjornar, that is one. | 21:01 |
| bjornar | and this log should be for laught from _everyone_ | 21:01 |
| ayoung | bjornar, calm down. I have been in this world for a long time, and I am justifiably paranoid | 21:01 |
| morgan | i am ok with numbers in ps | 21:01 |
| morgan | personally | 21:01 |
| morgan | especially in a container world. but i can see why it worries you | 21:02 |
| ayoung | bjornar, you will buy me a beer in Austin, assuming you are old enough to drink, and apologize for your behavior. | 21:02 |
| morgan | so does SELinux contexts work well with uid only not in passwd? | 21:02 |
| ayoung | morgan, ok...let me walk through this.... | 21:02 |
| * morgan hasn't played with that | 21:02 | |
| *** gordc has quit IRC | 21:02 | |
| morgan | or apparmour | 21:02 |
| ayoung | lets say I do try to look up an id from an username... | 21:02 |
| morgan | that would be where i draw the line. | 21:03 |
| lbragstad | morgan ayoung what about this? http://cdn.pasteraw.com/j58vmoyzfjfbujby161s6tmeh0ruhr0 | 21:03 |
| ayoung | I make the python call, and, assuming that makes the right syscall... | 21:03 |
| morgan | ayoung: right | 21:03 |
| ayoung | getpwnam? | 21:03 |
| morgan | lbragstad: that is a uid above the allowed ammount for the kernel | 21:03 |
| ayoung | Or is that the old deprcated one...been long time since I looked at this | 21:04 |
| morgan | use less than short_int | 21:04 |
| morgan | ayoung: it's getpwnam | 21:04 |
| morgan | for strings | 21:04 |
| morgan | getent is the cli tool | 21:04 |
| morgan | in python its pwd module | 21:04 |
| morgan | pwd.getuid or something like that | 21:04 |
| ayoung | getpwnam("ayoung") = 0x7f160f1d9e00 | 21:04 |
| ayoung | ltrace getent passwd ayoung | 21:04 |
| morgan | yeah | 21:04 |
| morgan | getpwnam isn't used for ints though | 21:05 |
| bjornar | wth are you talking about!? | 21:05 |
| ayoung | and that should call into the nss modules | 21:05 |
| ayoung | for me that is set | 21:05 |
| bjornar | seriously, are you lobotomized, ayoung? | 21:05 |
| morgan | lbragstad: so if you use less than 65k it works | 21:05 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP - ldap3 Identity Driver https://review.openstack.org/296090 | 21:05 |
| morgan | bjornar: ok | 21:05 |
| ayoung | passwd: files sss | 21:05 |
| morgan | bjornar: i'm asking you one more time, please calm down and be polite and stop name calling | 21:05 |
| ayoung | so it is going to try in /etc/passwd, then fallback to nss. | 21:05 |
| ayoung | er sssd | 21:05 |
| morgan | bjornar: we are working through the security implications of uid vs usernmae so the people who are merging code are comfortable. you don't need to stress about it | 21:06 |
| bjornar | fernet_* does is chown uid:gid .. and you refuse to accept I can input uid and gid.. | 21:06 |
| morgan | bjornar: remember we also need to consider auditability. we are not refusing | 21:06 |
| morgan | bjornar: so let this convo go, this is normal for security/audit/etc focused people | 21:07 |
| bjornar | chown 4567890:567890 works fine in unix | 21:07 |
| ayoung | bjornar, that does not mean that Fernet is right. THere is a reason it is not the default token format. PArt of that is maturity | 21:07 |
| morgan | bjornar: but i am serious, please stop calling names (stupid, incompitent, lobotomized), direct attacks like that are not welcome here. | 21:07 |
| bjornar | ayoung, sorry man, you take the first price | 21:07 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Add logging to cli if keystone.conf is not found https://review.openstack.org/300131 | 21:07 |
| ayoung | bjornar, apology accepted, but you still owe me a beer. | 21:08 |
| morgan | ayoung: ok | 21:08 |
| bjornar | ayoung, I wonder what your apology will consist of, must be big | 21:08 |
| morgan | ayoung: ok back to what we're talking | 21:09 |
| ayoung | heh | 21:09 |
| bjornar | the container is running on the system, the system has the username/password, selinux security context is enforced by kernel, not container.. and so on and so on. | 21:09 |
| morgan | yes, use NSS, and do the lookup- it calls passwd/nis/sssd and falls through to nothing | 21:09 |
| *** roxanaghe has joined #openstack-keystone | 21:09 | |
| morgan | so there is no user. but the uid is still usable | 21:09 |
| morgan | in most cases except if you ask "is this user in NSSdb" | 21:10 |
| ayoung | morgan, so, in a container based world, a lot of apps will fail if getpwnam does not work right. Which means that either you end up copying files into the container, or you need an nss module specifically for the container to talk to the base OS | 21:10 |
| bjornar | ayoung, you could buy me a brewery for example. micro is ok.. they should have good ipa's | 21:10 |
| morgan | ayoung: i don't think NSS ever talks to the base os | 21:10 |
| morgan | in general | 21:10 |
| morgan | for containers | 21:10 |
| bjornar | nope | 21:10 |
| bjornar | cant be done | 21:10 |
| morgan | that could be considered a breach of security context | 21:10 |
| morgan | bjornar: it can be done, but it would be like NIS or SSSD | 21:11 |
| morgan | bjornar: it's not done with files | 21:11 |
| bjornar | sure, but then not directlyu | 21:11 |
| morgan | right | 21:11 |
| ayoung | morgan, I think it depends on if they are using Kernel user namespaces. I think that is the default now. It would have to be a deliberate decision. | 21:11 |
| bjornar | and also, I dont want to expose my system user to the contaner.. so | 21:11 |
| *** trown is now known as trown|outtypewww | 21:11 | |
| morgan | ayoung: fair enough, but in almost any normal case you wouldn't fall through | 21:11 |
| morgan | at least not in docker | 21:11 |
| morgan | i haven't tried kubernetes | 21:11 |
| ayoung | morgan, Kubernets doesn't do anything that docker does in this case. | 21:12 |
| bjornar | does not matter, a chown in a container is "containerized" | 21:12 |
| morgan | but i am sure docker, lxc, and lxd are the same by default | 21:12 |
| morgan | bjornar: correct | 21:12 |
| bjornar | it is clone_newns mount... pivot_root | 21:12 |
| bjornar | everything is | 21:13 |
| morgan | ayoung: i don't see a huge security gap to use an id over a name - unless we care (and are opinionated) that keystone must be run by a posix user | 21:13 |
| ayoung | actually, I am not certain that it is using Kernel user namespaces...actually, I am pretty sure that it is not | 21:13 |
| morgan | i don't think that is a needed requirement | 21:13 |
| bjornar | the name becomes a id anyway | 21:13 |
| bjornar | so its no different | 21:13 |
| bjornar | you dont chown with a name, with a int | 21:13 |
| ayoung | which means that uid 2112 in the container has the same privs as uid 2112 outsid the container. | 21:14 |
| bjornar | think dns | 21:14 |
| morgan | ayoung: openstack-puppet may require a username, but that is the CMS being opinionated | 21:14 |
| bjornar | its same mol | 21:14 |
| morgan | ayoung: only if the user can break out of the container | 21:14 |
| bjornar | ayoung, if you know what dns is? | 21:14 |
| morgan | ayoung: which is as serious as a hypervisor breakout | 21:14 |
| ayoung | morgan, I don't think we use puppet inside the container anyway. THe containers tend to be immutable for the most part, so you redeploy for an uptade...I guess you could use puppet to manage the contiaer image outside, but that would bu ugh | 21:15 |
| bjornar | but then you are compromised anyway, and its not because you used a skipped the username -> uid step | 21:15 |
| bjornar | seriously | 21:15 |
| morgan | ayoung: you may use puppet to build the container you then store in the docker repo though | 21:15 |
| bjornar | ..and its not like anyone can run fernet_rotate | 21:15 |
| morgan | ayoung: which case puppet would dictate the requirements | 21:15 |
| ayoung | morgan, but, if you are in a container, and the continer is immutable...should you even do a key rotation without a container redeploy? | 21:15 |
| *** david_cu has quit IRC | 21:16 | |
| morgan | ayoung: not sure. | 21:16 |
| bjornar | ayoung, you keep surprising me | 21:16 |
| bjornar | and thats amazing | 21:16 |
| ayoung | morgan, I know when we were discussin redepoloying policy, the answer was that an update should be a redeploy | 21:16 |
| ayoung | that was from Kolla | 21:16 |
| morgan | ayoung: ok cool container is redeploy | 21:17 |
| morgan | lets step back from that | 21:17 |
| morgan | do you need the uid when making your new container? | 21:17 |
| morgan | erm username | 21:17 |
| morgan | the argument is still roughtly the same | 21:17 |
| morgan | you run "rotate" on the new base container | 21:17 |
| morgan | does that rotate need a username? or is a uid sufficient | 21:18 |
| bjornar | keep in mind, the username is never used for anything else than to resolve to a uid | 21:18 |
| bjornar | think: ping 127.0.0.1 .. not allowed | 21:19 |
| morgan | ayoung: i think uid is sufficient. unless your tool uses username (aka piuppet, or ansible) which are more opinionated than "posix permissions" are | 21:19 |
| ayoung | morgan, so, if it is a redeploy, everything is done in a script called at deploy time, if not done in the container compose step. I would think not. | 21:19 |
| ayoung | Everything should be done as the user running, in this case HTTPD | 21:19 |
| bjornar | httpd?! | 21:19 |
| bjornar | what planet are you from? | 21:19 |
| bjornar | nothing is done as a USER! understand that, everything is done as a UID | 21:20 |
| ayoung | bjornar, this one. http://www.westpoint.edu/SitePages/Home.aspx | 21:20 |
| morgan | bjornar: chill. | 21:20 |
| *** jsavak has quit IRC | 21:21 | |
| morgan | ayoung: sure. but i'm pretty sure we don't to enforce it in our code | 21:22 |
| morgan | we're uid agnostic | 21:22 |
| *** slberger1 has joined #openstack-keystone | 21:22 | |
| *** dflorea has joined #openstack-keystone | 21:22 | |
| morgan | just like running apache with uid 10000 (no user in the passwd file) works | 21:23 |
| ayoung | morgan, right, but then there should be no need for that to bleed over into the container. | 21:23 |
| *** slberger has quit IRC | 21:23 | |
| morgan | it may be not best practice, but do we enforce that? or does the "deplopy script" do it | 21:23 |
| ayoung | Its a leaky abstraction, and I don;t like those | 21:23 |
| morgan | and i don't mean keystone-manage | 21:23 |
| morgan | i mean ansible/puppet/pick-your-poison | 21:23 |
| lbragstad | morgan checking | 21:24 |
| morgan | i fully expect those things to enforce that | 21:24 |
| lbragstad | morgan https://github.com/openstack/openstack-ansible-os_keystone/blob/master/defaults/main.yml#L48-L49 | 21:24 |
| ayoung | morgan, I have to go. | 21:24 |
| lbragstad | morgan that is OSA approach | 21:24 |
| lbragstad | morgan not sure what the others do | 21:24 |
| morgan | lbragstad: yep | 21:24 |
| ayoung | bjornar, let me make one thing clear. We are all professionals here. You've picked on the most mellow of people to insult, which is why you have gotten away with it. The rest of the core developers here are getting very antsy at your attitude. I am willing to help,. but if you keep this up, it will be a kickban, and I do have perms in this room to enforce that. Have I made myself clear? | 21:25 |
| *** ayoung is now known as ayoung-afk | 21:25 | |
| morgan | lbragstad: i fully expect OSA, puppet to require that | 21:25 |
| lbragstad | morgan and that's the variable that we use https://github.com/openstack/openstack-ansible-os_keystone/blob/master/tasks/keystone_post_install.yml#L20-L21 | 21:25 |
| bjornar | ayoung: I started insulting after ~50 lines of explaining the obvious with a spatula | 21:27 |
| *** dflorea has quit IRC | 21:28 | |
| bknudson | https://www.openstack.org/legal/community-code-of-conduct/ | 21:29 |
| *** ayoung-afk is now known as ayoung | 21:30 | |
| *** ayoung is now known as ayoung_afk | 21:30 | |
| *** dflorea has joined #openstack-keystone | 21:31 | |
| bjornar | Ok, this got too far, sorry about some of the insults, but I hope you will think about this and do the (obvious) right thing here. In the meantime, I will step back. | 21:33 |
| morgan | bjornar: thanks. | 21:36 |
| *** bjornar has quit IRC | 21:36 | |
| morgan | lbragstad: yeah. | 21:36 |
| morgan | lbragstad: yep so i think we can relax our side, but expect other tools to still require it | 21:37 |
| *** bjornar has joined #openstack-keystone | 21:38 | |
| morgan | i'll go ahead and file a bug on this [unless you want to] | 21:38 |
| lbragstad | morgan it's all yours | 21:38 |
| morgan | it's really easy code (low hanging fruit) | 21:38 |
| morgan | and we can get a new contributor familiar with this stuff in keystone (or someone can contribute for their workflow) | 21:39 |
| morgan | will file the bug when i'm done with the needing to plugin/get lunch/etc | 21:39 |
| morgan | :) | 21:39 |
| *** lhcheng has joined #openstack-keystone | 21:41 | |
| *** ChanServ sets mode: +v lhcheng | 21:41 | |
| *** timcline has quit IRC | 21:41 | |
| *** daemontool has joined #openstack-keystone | 21:44 | |
| *** ayoung_afk is now known as ayoung | 21:49 | |
| *** pushkaru has quit IRC | 21:49 | |
| ayoung | morgan, aside from Key rotation and Policy are there any other cases where we need to modify files in a container post deploy? | 21:50 |
| morgan | arguably not | 21:51 |
| ayoung | lbragstad, ^^ same question? | 21:51 |
| morgan | but that is just a quick gut check response | 21:51 |
| lbragstad | ayoung config changes? | 21:51 |
| ayoung | morgan, ok...so, how painful is a redeploy? Is doing a redeploy at key rotation time viable? | 21:51 |
| morgan | not really | 21:52 |
| morgan | ayoung: not painful at all | 21:52 |
| ayoung | lbragstad, yeah, but the typical answer on config changes is that those should be immutable in the container and it should be a container redeploy. For keys and policy, we don't have to restart the web container, for config changes we do | 21:52 |
| morgan | ayoung: but you may have different uids in the container than in the base os | 21:52 |
| ayoung | I'm tempted to say that we treat all of those as immutable | 21:52 |
| morgan | ayoung: so even if it's all immutable, maybe you just cat </etc/passwd> and use the id regardless of the base os passwd file | 21:53 |
| morgan | if that makes sense? | 21:53 |
| morgan | which case if rotate happens on /path/to/containerthing/etc/keystone/fernet you might need non-pwnam lookupable user | 21:53 |
| morgan | selinux, apparmor, etc all should still work (uid/gid based) | 21:54 |
| ayoung | morgan, so, our policy discussion leads me to think that all of this multi system sync really should not be managed by Keystone itslef | 21:54 |
| lbragstad | alright - i'm out for the night | 21:54 |
| lbragstad | o/ | 21:54 |
| morgan | lbragstad: cheers | 21:54 |
| morgan | ayoung: yep | 21:54 |
| morgan | ayoung: agreed there | 21:54 |
| ayoung | if we say that puppet or Ansible manages policy, I would be tempted to say the same is true for fernet keys | 21:54 |
| ayoung | and...then getting the uids right is the deployers responsibility | 21:55 |
| ayoung | not something that should be called from keystone. | 21:55 |
| morgan | that is already pretty much the case | 21:55 |
| ayoung | or even callable | 21:55 |
| morgan | keystone-manage is a CLI/admin tool | 21:55 |
| morgan | which is where this all lives | 21:55 |
| morgan | it's administrative/might be used by ansible | 21:55 |
| morgan | or puppet | 21:55 |
| morgan | or directly | 21:55 |
| ayoung | morgan, right, but not in the container | 21:55 |
| knikolla | ayoung, morgan, need a bit of help with ldap if you have time. | 21:55 |
| morgan | i classify that as independant of keystone itself | 21:55 |
| ayoung | knikolla, if it is fast | 21:56 |
| morgan | knikolla: i need to step out for a bit (haven't had a chance to change/cleanup/lunch yet) | 21:56 |
| knikolla | ayoung, it should be very fast. | 21:56 |
| knikolla | it's mostly a dn question | 21:56 |
| morgan | knikolla: then ask away | 21:56 |
| morgan | ayoung: in the container, out of the contianer, the case is mostly the same | 21:56 |
| knikolla | i'm using the freeipa ldap sandbox for my testing | 21:56 |
| ayoung | morgan, so, assume that the webserver runs as apache user in the container, whatever the uuid is, the perms on the key file, the policy file, etc should be group apache, and readable by the webserver....ignoring SELInux for now | 21:56 |
| morgan | ayoung: it's a utility cli tool, - regardless of where it is run. | 21:56 |
| knikolla | and DN of users looks like this. DN: uid=admin,cn=users,cn=accounts,dc=demo1,dc=freeipa,dc=org | 21:56 |
| ayoung | knikolla, OK | 21:57 |
| morgan | ayoung: anyway i'll file a bug on this - we can continue there. | 21:57 |
| morgan | ayoung: lets help knikolla | 21:57 |
| morgan | knikolla: yes that is a DN ;) | 21:57 |
| knikolla | when i try to create (for unit testing purposes) | 21:57 |
| knikolla | it doesn't allow uid as part of the DN | 21:57 |
| knikolla | None - attribute "uid" not allowed | 21:57 |
| ayoung | knikolla, ah. | 21:57 |
| morgan | ayoung: i defer to you. i know it but you'll describe it better | 21:57 |
| ayoung | knikolla, FreeIPA is opinionated | 21:58 |
| morgan | i'm sure | 21:58 |
| morgan | :) | 21:58 |
| ayoung | you can;'t create users from outside, unless it is in the compat tree... | 21:58 |
| ayoung | ugh | 21:58 |
| knikolla | ayoung, i see. | 21:58 |
| ayoung | knikolla, I don't have a good, quick answer for you, undfortunately | 21:58 |
| ayoung | you could use the WebAPI to create a user, but that would be IPA specific | 21:59 |
| knikolla | ayoung, no worries. that helped. | 21:59 |
| ayoung | knikolla, I think the compat tree makes sense for testing, though | 21:59 |
| knikolla | ayoung, well, i got the read only functions to work, so i need to graduate to unit tests. | 21:59 |
| ayoung | knikolla, the idea is that the compat tree lets ldap tools create the stub of a user and then an admin would move them into the real tree later | 21:59 |
| ayoung | knikolla, I have to go get my son, but I'll get you al ink this weekend | 22:00 |
| ayoung | knikolla, http://www.freeipa.org/page/Directory_Server | 22:00 |
| ayoung | Schema Compatibility: publishes an alternate trees containing a computed different view on objects in the DS. For instance, as FreeIPA stores users using RFC 2307bis schema, it publishes alternate tree cn=users,cn=compat,dc=example,dc=com with users in a RFC 2307 schema. It is also used by Trusts feature to allow Active Directory users access legacy system without a recent SSSD version. | 22:00 |
| ayoung | Maybe | 22:00 |
| *** markvoelker_ has joined #openstack-keystone | 22:01 | |
| ayoung | gotta run | 22:01 |
| *** slberger1 has left #openstack-keystone | 22:02 | |
| knikolla | ayoung, thanks! | 22:02 |
| *** daemontool has quit IRC | 22:03 | |
| *** dflorea has quit IRC | 22:04 | |
| *** fawadkhaliq has quit IRC | 22:05 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:05 | |
| *** dflorea has joined #openstack-keystone | 22:11 | |
| *** timcline has joined #openstack-keystone | 22:12 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:13 | |
| *** sdake_ has joined #openstack-keystone | 22:13 | |
| *** sdake has quit IRC | 22:13 | |
| *** dflorea has quit IRC | 22:13 | |
| *** edmondsw has quit IRC | 22:15 | |
| *** dflorea has joined #openstack-keystone | 22:15 | |
| *** ninag has quit IRC | 22:16 | |
| *** timcline has quit IRC | 22:17 | |
| *** sdake has joined #openstack-keystone | 22:19 | |
| *** sdake_ has quit IRC | 22:21 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Supersede the "admin" role with "global_admin" https://review.openstack.org/300683 | 22:23 |
| stevemar | ayoung: thank you for handling that with more than enough patience | 22:25 |
| *** fungi has joined #openstack-keystone | 22:25 | |
| *** sheel has quit IRC | 22:27 | |
| *** browne has quit IRC | 22:28 | |
| *** ametts has quit IRC | 22:28 | |
| *** mylu has quit IRC | 22:32 | |
| *** mylu has joined #openstack-keystone | 22:33 | |
| *** markvoelker_ has quit IRC | 22:39 | |
| *** phalmos has quit IRC | 22:44 | |
| *** fawadkhaliq has quit IRC | 22:44 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:45 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP - ldap3 Identity Driver https://review.openstack.org/296090 | 22:50 |
| *** daemontool has joined #openstack-keystone | 22:51 | |
| knikolla | so it takes 500 lines for a review to have the 'size' colored in red. interesting. | 22:51 |
| *** knikolla has quit IRC | 22:53 | |
| *** mylu has quit IRC | 23:03 | |
| *** fawadkhaliq has quit IRC | 23:04 | |
| *** fawadkhaliq has joined #openstack-keystone | 23:04 | |
| *** blogan has quit IRC | 23:09 | |
| *** roxanaghe has quit IRC | 23:10 | |
| *** roxanaghe has joined #openstack-keystone | 23:10 | |
| *** dflorea has quit IRC | 23:11 | |
| *** dflorea has joined #openstack-keystone | 23:12 | |
| *** timcline has joined #openstack-keystone | 23:13 | |
| *** dflorea has quit IRC | 23:17 | |
| *** daemontool has quit IRC | 23:17 | |
| *** timcline has quit IRC | 23:17 | |
| *** daemontool has joined #openstack-keystone | 23:18 | |
| *** trown|outtypewww is now known as trown | 23:21 | |
| *** knikolla has joined #openstack-keystone | 23:22 | |
| bjornar | morgan, is it plans to support putting fernet keys in db? | 23:23 |
| morgan | we have discussed it before, it is unknown [possibly a summit topic] if we plan to. | 23:23 |
| bjornar | because key rotation would benefit from this when you have multiple machines running keystone | 23:24 |
| bjornar | one could still have a local cache on filesystem or memcache or mem | 23:24 |
| bjornar | but transaction logic would help with key rotation | 23:24 |
| bjornar | I am thinking all workers could periodially try to rotate, only one would succed, the rest would pick up the new key(s) | 23:25 |
| bjornar | atm, I think its just a pain to set up the "infrastructure" around key rotation/distribution with synchronizing and ha and yeah | 23:26 |
| bjornar | So my vote is for sure to place this logic in keystone, and have keystone itself rotate | 23:27 |
| *** spzala has quit IRC | 23:35 | |
| *** spzala has joined #openstack-keystone | 23:35 | |
| *** harlowja has quit IRC | 23:36 | |
| *** dflorea has joined #openstack-keystone | 23:37 | |
| *** dflorea has quit IRC | 23:37 | |
| *** daemontool has quit IRC | 23:38 | |
| *** dflorea has joined #openstack-keystone | 23:38 | |
| *** spzala has quit IRC | 23:40 | |
| *** dflorea has quit IRC | 23:40 | |
| *** dflorea has joined #openstack-keystone | 23:52 | |
| *** dflorea has quit IRC | 23:53 | |
| *** dflorea has joined #openstack-keystone | 23:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!