| *** dan_nguyen has quit IRC | 00:16 | |
| *** clenimar has quit IRC | 00:17 | |
| openstackgerrit | Ryosuke Mizuno proposed openstack/keystone: Add validation rules for create token using a JSON schema https://review.openstack.org/325086 | 00:20 |
|---|---|---|
| *** roxanaghe has quit IRC | 00:25 | |
| dstanek | #success I was able to perform a roundtrip between keystone and testshib.org using my new SAML2 middleware! | 00:26 |
| openstackstatus | dstanek: Added success to Success page | 00:26 |
| dstanek | openstackstatus: thanks! | 00:28 |
| *** clenimar has joined #openstack-keystone | 00:30 | |
| gyee | dstanek, what does success smell like? | 00:30 |
| openstackgerrit | Merged openstack/keystone: Return 404 instead of 401 for tokens w/o roles https://review.openstack.org/322280 | 00:34 |
| *** raddaoui has quit IRC | 00:37 | |
| dstanek | gyee: beer! | 00:46 |
| *** lucas has joined #openstack-keystone | 00:55 | |
| *** lucas has quit IRC | 00:59 | |
| *** lucas has joined #openstack-keystone | 01:03 | |
| *** BjoernT has joined #openstack-keystone | 01:08 | |
| ayoung | dstanek, the real test would be talking to ADFWS | 01:10 |
| ayoung | ADFS | 01:10 |
| ayoung | I think that is the most Common SAML IdP we have to work with. | 01:10 |
| ayoung | dstanek, have you looked at Ipsilon? | 01:11 |
| *** markvoelker has joined #openstack-keystone | 01:13 | |
| *** tqtran has quit IRC | 01:16 | |
| *** markvoelker has quit IRC | 01:18 | |
| *** BjoernT has quit IRC | 01:27 | |
| *** frontrunner has quit IRC | 01:31 | |
| *** EinstCrazy has joined #openstack-keystone | 01:35 | |
| *** toddnni_ has joined #openstack-keystone | 01:39 | |
| *** toddnni has quit IRC | 01:40 | |
| *** toddnni_ is now known as toddnni | 01:40 | |
| *** EinstCra_ has joined #openstack-keystone | 01:41 | |
| *** EinstCr__ has joined #openstack-keystone | 01:44 | |
| *** EinstCrazy has quit IRC | 01:44 | |
| *** EinstCra_ has quit IRC | 01:46 | |
| *** lucas has quit IRC | 01:53 | |
| *** tonytan4ever has joined #openstack-keystone | 02:11 | |
| jamielennox | whats the thing that provides the deprecated in version N+1 functions | 02:15 |
| jamielennox | it's debtcollector underneath, but i thought there was something in oslo to handle the version naming | 02:16 |
| jamielennox | oh, nvm - it's in oslo_log and not oslo.utils | 02:19 |
| *** lucas has joined #openstack-keystone | 02:26 | |
| *** TxGVNN has joined #openstack-keystone | 02:29 | |
| *** sdake has joined #openstack-keystone | 02:32 | |
| *** sdake has quit IRC | 02:34 | |
| *** woodster_ has quit IRC | 02:38 | |
| *** richm has quit IRC | 02:45 | |
| *** openstackgerrit has quit IRC | 02:47 | |
| *** openstackgerrit has joined #openstack-keystone | 02:47 | |
| *** sheel has joined #openstack-keystone | 02:49 | |
| *** dan_nguyen has joined #openstack-keystone | 02:49 | |
| *** gyee has quit IRC | 02:50 | |
| *** dave-mccowan has quit IRC | 02:54 | |
| *** dan_nguyen has quit IRC | 02:59 | |
| stevemar | dstanek: nice :) | 02:59 |
| stevemar | dstanek: got something for viewing? :) | 02:59 |
| *** rderose has joined #openstack-keystone | 03:02 | |
| *** rderose has quit IRC | 03:03 | |
| jamielennox | notmorgan, dstanek: https://review.openstack.org/326794 | 03:04 |
| *** dan_nguyen has joined #openstack-keystone | 03:04 | |
| *** dan_nguyen has quit IRC | 03:06 | |
| *** jorge_munoz has quit IRC | 03:08 | |
| *** jorge_munoz has joined #openstack-keystone | 03:10 | |
| *** EinstCr__ has quit IRC | 03:13 | |
| *** sdake has joined #openstack-keystone | 03:28 | |
| *** spandhe has quit IRC | 03:32 | |
| *** links has joined #openstack-keystone | 03:35 | |
| *** lucas has quit IRC | 03:42 | |
| *** EinstCrazy has joined #openstack-keystone | 03:44 | |
| *** julim has quit IRC | 03:45 | |
| *** TxGVNN has quit IRC | 03:45 | |
| *** EinstCrazy has quit IRC | 03:47 | |
| stevemar | jamielennox: so, what i miss? :) | 03:47 |
| jamielennox | stevemar: are you back now? | 03:47 |
| *** clenimar has quit IRC | 03:51 | |
| stevemar | jamielennox: monday i'll be back | 03:51 |
| *** TxGVNN has joined #openstack-keystone | 03:51 | |
| jamielennox | stevemar: and just can't wait till then? | 03:51 |
| stevemar | jamielennox: just got some free time now and looking to chat :) | 03:51 |
| *** raddaoui has joined #openstack-keystone | 03:52 | |
| stevemar | :P | 03:52 |
| jamielennox | heh, | 03:52 |
| jamielennox | so really not much has happened | 03:52 |
| stevemar | a few more specs i noticed | 03:52 |
| jamielennox | i'm assuming you saw the meeting transcripts | 03:52 |
| stevemar | not really | 03:52 |
| stevemar | i suppose i should do that >.> | 03:52 |
| *** sdake has quit IRC | 03:53 | |
| jamielennox | stevemar: probably easier than relating them seeing they're logged | 03:53 |
| jamielennox | i think dolph's spec might have missed cut off but it will be good to have and easy to approve | 03:53 |
| *** ebalduf_ has joined #openstack-keystone | 03:53 | |
| jamielennox | umm, henry's and my spec are both kind of blocked on ML discussions | 03:54 |
| jamielennox | no problems with the release | 03:54 |
| jamielennox | and you were around when we were discussing the ksa release - no fallout i've seen | 03:54 |
| stevemar | jamielennox: ah right, nice job on that, you fixed it up so kerb and saml have a path forward | 03:55 |
| jamielennox | oh, yea that didn't make release | 03:55 |
| *** TxGVNN has quit IRC | 03:55 | |
| jamielennox | and i got something wrong in py3 so the tests are failling, but the mechanism seems to work | 03:55 |
| stevemar | i like dolph's spec, that'll be easy to approve, but i think there are a few comments around it | 03:56 |
| stevemar | the whole project name constraint thing is ugh | 03:56 |
| stevemar | just not something i wanted to deal with :) | 03:56 |
| *** iurygregory_ has quit IRC | 03:57 | |
| jamielennox | stevemar: yea, i've written a draft reply or two to that - i just don't know what to say | 03:59 |
| jamielennox | stevemar: hey ever seen/used [extras] on entrypoints? https://setuptools.readthedocs.io/en/latest/pkg_resources.html#creating-and-parsing | 04:00 |
| stevemar | jamielennox: want to take a gander at https://review.openstack.org/#/c/274400/ and it's related change? | 04:01 |
| patchbot | stevemar: patch 274400 - keystonemiddleware - Use extras for oslo.messaging dependency | 04:01 |
| stevemar | ohhh | 04:01 |
| stevemar | jamielennox: nope :\ | 04:02 |
| jamielennox | haven't played with it yet, but maybe that would let us declare that the kerberos entrypoint required the kerberos extras installed? | 04:03 |
| jamielennox | stevemar: auditing middleware shouldn't have lived in that repo :( | 04:03 |
| stevemar | jamielennox: :( | 04:04 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Update the keystone-manage man page options https://review.openstack.org/326764 | 04:04 |
| stevemar | it's not the worst place for it | 04:04 |
| jamielennox | stevemar: i'm inclined to just make it a direct dependency | 04:04 |
| stevemar | the dependency on oslo.messaging is messy | 04:05 |
| jamielennox | audit is used much less than auth_token but it's likely to be installed anywhere auth_token is anyway | 04:05 |
| jamielennox | why? | 04:05 |
| stevemar | the audit bits will re-use the context | 04:06 |
| *** tonytan_brb has joined #openstack-keystone | 04:07 | |
| jamielennox | so? | 04:08 |
| *** tonytan4ever has quit IRC | 04:08 | |
| *** devananda has quit IRC | 04:11 | |
| stevemar | (i'm confused as to what the question was) | 04:11 |
| jamielennox | stevemar: why can't we just have a direct dependency on oslo.messaging | 04:13 |
| *** browne has quit IRC | 04:13 | |
| stevemar | jamielennox: good point... most services that use ksm will have oslo.messaging | 04:14 |
| jamielennox | it shouldn't be that big a dependency and it's not a client side thing so i think just depend on it directly | 04:15 |
| *** EinstCrazy has joined #openstack-keystone | 04:22 | |
| *** devananda has joined #openstack-keystone | 04:23 | |
| stevemar | jamielennox: let me take a tally of projects that are using keystonemiddleware and *not* oslo.messaging | 04:25 |
| jamielennox | stevemar: oslo.messaging needs to do some [extras] work | 04:26 |
| jamielennox | https://github.com/openstack/oslo.messaging/blob/master/requirements.txt | 04:26 |
| *** shoutm has joined #openstack-keystone | 04:26 | |
| stevemar | jamielennox: pretty short list of projects that don't use both ksm and oslo.messaging | 04:31 |
| stevemar | distil | 04:31 |
| stevemar | surveil | 04:31 |
| stevemar | cue | 04:31 |
| stevemar | ekko | 04:31 |
| stevemar | freezer-api | 04:31 |
| stevemar | fuel-ostf | 04:31 |
| stevemar | fuel-web | 04:31 |
| stevemar | ironic-inspector | 04:31 |
| stevemar | marshal | 04:31 |
| stevemar | monasca-api | 04:31 |
| stevemar | monasca-log-api | 04:31 |
| stevemar | zaqar | 04:31 |
| jamielennox | zaqar doesn't use oslo.messaging? | 04:31 |
| stevemar | 12 out of 53 projects | 04:32 |
| jamielennox | guess that makes sense | 04:32 |
| stevemar | jamielennox: yeah, that surprised me too | 04:32 |
| stevemar | https://github.com/openstack/zaqar/blob/master/requirements.txt | 04:32 |
| jamielennox | stevemar: i think we just do it, it's a well known dependency, all the distros have it packaged already, everyone else won't notice | 04:32 |
| jamielennox | as is audit middleware is unusable | 04:33 |
| stevemar | jamielennox: i doubt most both of those projects would even notice | 04:33 |
| jamielennox | yep | 04:33 |
| stevemar | jamielennox: want me to post something on the ML? | 04:33 |
| jamielennox | stevemar: your call, but i don't think it's necessary | 04:33 |
| stevemar | at least tag the bigger projects, like fuel and zaqar | 04:33 |
| jamielennox | they can't exactly opt out anyway | 04:34 |
| stevemar | :) | 04:34 |
| jamielennox | we should get audit more widely used, it seems weird as is | 04:34 |
| stevemar | jamielennox: why do you say it's unusable as is? | 04:34 |
| jamielennox | oh, i guess not, everyone has the oslo.messaging dependency seperately so doesn't notice the addition | 04:35 |
| *** tonytan_brb has quit IRC | 04:36 | |
| *** browne has joined #openstack-keystone | 04:36 | |
| stevemar | yep | 04:36 |
| *** edtubill has joined #openstack-keystone | 04:38 | |
| *** lhcheng has joined #openstack-keystone | 04:42 | |
| *** ChanServ sets mode: +v lhcheng | 04:42 | |
| *** jaosorior has joined #openstack-keystone | 04:50 | |
| *** browne has quit IRC | 04:53 | |
| *** spandhe has joined #openstack-keystone | 04:53 | |
| *** spandhe_ has joined #openstack-keystone | 04:54 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Pass a request to controllers instead of a context https://review.openstack.org/318658 | 04:57 |
| *** spandhe has quit IRC | 04:58 | |
| *** spandhe_ is now known as spandhe | 04:58 | |
| *** sdake has joined #openstack-keystone | 05:01 | |
| *** tonytan4ever has joined #openstack-keystone | 05:03 | |
| *** ebalduf_ has quit IRC | 05:05 | |
| *** tonytan4ever has quit IRC | 05:09 | |
| *** GB21 has joined #openstack-keystone | 05:09 | |
| stevemar | jamielennox: meh https://bugs.launchpad.net/keystonemiddleware/+bug/1590254 | 05:11 |
| openstack | Launchpad bug 1590254 in keystonemiddleware "depend directly on oslo.messaging" [Undecided,New] | 05:11 |
| *** edtubill has quit IRC | 05:15 | |
| openstackgerrit | Merged openstack/keystone: clean up test_resource_uuid https://review.openstack.org/281546 | 05:19 |
| *** sdake has quit IRC | 05:32 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:33 | |
| *** tonytan4ever has joined #openstack-keystone | 05:33 | |
| *** spandhe has quit IRC | 05:37 | |
| *** tonytan4ever has quit IRC | 05:38 | |
| *** GB21 has quit IRC | 05:44 | |
| *** EinstCrazy has quit IRC | 05:59 | |
| *** EinstCrazy has joined #openstack-keystone | 05:59 | |
| *** EinstCrazy has quit IRC | 05:59 | |
| *** EinstCrazy has joined #openstack-keystone | 06:05 | |
| *** GB21 has joined #openstack-keystone | 06:06 | |
| *** lifeless has quit IRC | 06:13 | |
| *** rcernin has joined #openstack-keystone | 06:13 | |
| *** shoutm_ has joined #openstack-keystone | 06:36 | |
| *** henrynash_ has joined #openstack-keystone | 06:37 | |
| *** ChanServ sets mode: +v henrynash_ | 06:37 | |
| *** shoutm has quit IRC | 06:38 | |
| *** lhcheng has quit IRC | 06:47 | |
| *** openstackgerrit has quit IRC | 06:48 | |
| *** openstackgerrit has joined #openstack-keystone | 06:48 | |
| *** belmoreira has joined #openstack-keystone | 06:49 | |
| *** sdake has joined #openstack-keystone | 06:54 | |
| *** martinus__ has joined #openstack-keystone | 06:58 | |
| *** EinstCra_ has joined #openstack-keystone | 06:59 | |
| *** tesseract has joined #openstack-keystone | 07:00 | |
| *** EinstCrazy has quit IRC | 07:02 | |
| *** EinstCra_ has quit IRC | 07:05 | |
| *** EinstCrazy has joined #openstack-keystone | 07:05 | |
| openstackgerrit | henry-nash proposed openstack/keystone: WIP - Cache fernet tokens the same way we do UUID https://review.openstack.org/326234 | 07:09 |
| *** henrynash_ has quit IRC | 07:10 | |
| *** sdake has quit IRC | 07:10 | |
| *** fawadkhaliq has quit IRC | 07:23 | |
| *** henrynash_ has joined #openstack-keystone | 07:42 | |
| *** ChanServ sets mode: +v henrynash_ | 07:42 | |
| *** openstackgerrit has quit IRC | 07:48 | |
| *** openstackgerrit has joined #openstack-keystone | 07:48 | |
| *** henrynash_ has quit IRC | 07:54 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zqfan has joined #openstack-keystone | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:02 | |
| *** shoutm_ has quit IRC | 08:05 | |
| *** shoutm has joined #openstack-keystone | 08:05 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:09 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** fhubik has joined #openstack-keystone | 08:15 | |
| *** EinstCrazy has quit IRC | 08:15 | |
| *** EinstCrazy has joined #openstack-keystone | 08:18 | |
| *** jaosorior has quit IRC | 08:25 | |
| *** jaosorior has joined #openstack-keystone | 08:25 | |
| *** dmk0202 has joined #openstack-keystone | 08:37 | |
| *** raddaoui has quit IRC | 08:37 | |
| *** shoutm has quit IRC | 08:37 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS disable inactive users requirements https://review.openstack.org/326918 | 08:39 |
| *** nisha_ has joined #openstack-keystone | 08:40 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS disable inactive users requirements https://review.openstack.org/326918 | 08:40 |
| *** EinstCrazy has quit IRC | 08:43 | |
| *** EinstCrazy has joined #openstack-keystone | 08:43 | |
| *** EinstCrazy has quit IRC | 08:45 | |
| *** fawadkhaliq has quit IRC | 08:45 | |
| nisha_ | hey all! | 08:46 |
| *** EinstCrazy has joined #openstack-keystone | 08:47 | |
| *** openstackgerrit has quit IRC | 08:48 | |
| *** openstackgerrit has joined #openstack-keystone | 08:48 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS disable inactive users requirements https://review.openstack.org/326918 | 08:51 |
| *** arunkant has quit IRC | 08:52 | |
| *** arunkant has joined #openstack-keystone | 08:52 | |
| *** GB21 has quit IRC | 08:53 | |
| *** mvk has quit IRC | 09:03 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS disable inactive users requirements https://review.openstack.org/326918 | 09:06 |
| nisha_ | I want to remove a downloaded patch from python-keystoneclient, so that I can download an updated version of the same patch, can anyone please help me? | 09:06 |
| nisha_ | I just tried this, $ git review -R <patch_number> but it didnt work as expected | 09:07 |
| *** GB21 has joined #openstack-keystone | 09:09 | |
| nisha_ | and btw I typed that command after going inside python-keystoneclient directory | 09:10 |
| jamielennox | nisha_: normally jsut running git review -d <number> again should fetch the latest one | 09:14 |
| nisha_ | jamielennox, when i use the -d command again, it says Downloading refs/changes/06/289306/20 from gerrit | 09:16 |
| nisha_ | Branch already exists - reusing | 09:16 |
| nisha_ | jamielennox, does that mean, i already have the latest updated patch | 09:16 |
| nisha_ | ? | 09:16 |
| *** sdake has joined #openstack-keystone | 09:16 | |
| jamielennox | nisha_: it should | 09:17 |
| jamielennox | do git log -1 and see the commit hash, it should match the latest review | 09:17 |
| *** EinstCrazy has quit IRC | 09:18 | |
| *** GB21 has quit IRC | 09:18 | |
| *** nisha__ has joined #openstack-keystone | 09:19 | |
| *** belmoreira has quit IRC | 09:19 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS disable inactive users requirements https://review.openstack.org/326918 | 09:20 |
| *** nisha_ has quit IRC | 09:21 | |
| *** EinstCrazy has joined #openstack-keystone | 09:21 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/325589 | 09:21 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 09:22 |
| *** nisha__ is now known as nisha_ | 09:26 | |
| nisha_ | jamielennox, thanks | 09:29 |
| *** fawadkhaliq has joined #openstack-keystone | 09:32 | |
| *** fawadkhaliq has quit IRC | 09:33 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:33 | |
| *** fawadkhaliq has quit IRC | 09:33 | |
| *** mvk has joined #openstack-keystone | 09:34 | |
| *** GB21 has joined #openstack-keystone | 09:42 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:42 | |
| *** belmoreira has joined #openstack-keystone | 09:48 | |
| *** sdake has quit IRC | 09:49 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 09:49 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 09:49 |
| *** nisha__ has joined #openstack-keystone | 09:49 | |
| *** nisha_ has quit IRC | 09:52 | |
| *** markvoelker has joined #openstack-keystone | 09:53 | |
| *** henrynash_ has joined #openstack-keystone | 09:55 | |
| *** ChanServ sets mode: +v henrynash_ | 09:55 | |
| *** nisha__ is now known as nisha_ | 10:01 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 10:01 |
| samueldmq | morning keystone | 10:09 |
| *** rk4n has joined #openstack-keystone | 10:12 | |
| *** jamie_h has joined #openstack-keystone | 10:12 | |
| *** lifeless has joined #openstack-keystone | 10:35 | |
| openstackgerrit | henry-nash proposed openstack/keystone: WIP - Cache fernet tokens the same way we do UUID https://review.openstack.org/326234 | 10:40 |
| openstackgerrit | henry-nash proposed openstack/keystone: Revert to caching fernet tokens the same way we do UUID https://review.openstack.org/326234 | 10:41 |
| *** rk4n_ has joined #openstack-keystone | 10:43 | |
| *** rk4n__ has joined #openstack-keystone | 10:45 | |
| *** rk4n_ has quit IRC | 10:45 | |
| *** rk4n has quit IRC | 10:46 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Revert to caching fernet tokens the same way we do UUID https://review.openstack.org/326234 | 10:47 |
| *** lifeless has quit IRC | 10:47 | |
| *** lifeless_ has joined #openstack-keystone | 10:47 | |
| *** tesseract has quit IRC | 10:50 | |
| *** tesseract has joined #openstack-keystone | 10:51 | |
| *** d0ugal has quit IRC | 10:59 | |
| *** yolanda has quit IRC | 10:59 | |
| *** d0ugal has joined #openstack-keystone | 11:00 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Fix incorrect query example https://review.openstack.org/326994 | 11:00 |
| *** afazekas is now known as __afazekas | 11:05 | |
| *** d0ugal has quit IRC | 11:09 | |
| *** doug-fish has joined #openstack-keystone | 11:09 | |
| *** fawadkhaliq has quit IRC | 11:12 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:19 | |
| *** fawadkhaliq has quit IRC | 11:25 | |
| samueldmq | henrynash_: hi | 11:27 |
| henrynash_ | samueldmq: hi | 11:28 |
| henrynash_ | brb | 11:29 |
| *** henrynash_ has quit IRC | 11:29 | |
| *** d0ugal has joined #openstack-keystone | 11:32 | |
| *** henrynash_ has joined #openstack-keystone | 11:34 | |
| *** ChanServ sets mode: +v henrynash_ | 11:34 | |
| henrynash_ | smaueldmq: hi | 11:34 |
| *** fawadkhaliq has joined #openstack-keystone | 11:38 | |
| *** henrynash_ has quit IRC | 11:39 | |
| *** fawadkhaliq has quit IRC | 11:40 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:40 | |
| samueldmq | henrynash: sorry went afk for a bit | 11:40 |
| samueldmq | henrynash: about patch 326234 | 11:41 |
| patchbot | samueldmq: https://review.openstack.org/#/c/326234/ - keystone - Revert to caching fernet tokens the same way we do... | 11:41 |
| *** doug-fish has quit IRC | 11:41 | |
| *** gordc has joined #openstack-keystone | 11:43 | |
| *** fawadk has joined #openstack-keystone | 11:43 | |
| *** sdake has joined #openstack-keystone | 11:44 | |
| *** fawadkhaliq has quit IRC | 11:44 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:44 | |
| openstackgerrit | Merged openstack/keystone: Update the keystone-manage man page options https://review.openstack.org/326764 | 11:47 |
| *** fawadk has quit IRC | 11:48 | |
| *** yolanda has joined #openstack-keystone | 11:49 | |
| *** nisha_ has quit IRC | 11:49 | |
| *** nisha_ has joined #openstack-keystone | 11:49 | |
| *** __afazekas is now known as afazekas | 11:49 | |
| *** jbell8 has quit IRC | 11:50 | |
| *** jbell8 has joined #openstack-keystone | 11:51 | |
| openstackgerrit | Merged openstack/keystone-specs: Fix incorrect query example https://review.openstack.org/326994 | 11:53 |
| *** jbell8 has quit IRC | 11:55 | |
| *** markvoelker has quit IRC | 11:56 | |
| *** jbell8 has joined #openstack-keystone | 11:56 | |
| *** amrith is now known as _amrith_ | 11:58 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone-specs: WIP -Alternative policy enforcement https://review.openstack.org/323791 | 12:02 |
| *** fawadkhaliq has quit IRC | 12:03 | |
| *** pnavarro has joined #openstack-keystone | 12:06 | |
| *** ayoung has quit IRC | 12:07 | |
| *** clenimar has joined #openstack-keystone | 12:11 | |
| *** markvoelker has joined #openstack-keystone | 12:12 | |
| *** zqfan has quit IRC | 12:13 | |
| *** sdake has quit IRC | 12:13 | |
| *** EinstCrazy has quit IRC | 12:14 | |
| *** EinstCrazy has joined #openstack-keystone | 12:14 | |
| *** frontrunner has joined #openstack-keystone | 12:14 | |
| *** henrynash_ has joined #openstack-keystone | 12:15 | |
| *** ChanServ sets mode: +v henrynash_ | 12:15 | |
| henrynash_ | samueldmq: hi | 12:15 |
| samueldmq | henrynash_: hey | 12:16 |
| samueldmq | henrynash_: so, I was talking to henrynash :) (fyi there is henrynash and henrynash_ logged in the channel( | 12:16 |
| henrynash_ | samueldmq: and there both me ;-) | 12:17 |
| samueldmq | henrynash_: hehe | 12:17 |
| samueldmq | henrynash_: so, about patch 326234 | 12:18 |
| patchbot | samueldmq: https://review.openstack.org/#/c/326234/ - keystone - Revert to caching fernet tokens the same way we do... | 12:18 |
| henrynash_ | samueldmq: I’m still an IRCbouncer virgin… | 12:18 |
| samueldmq | henrynash_: lol hehe | 12:18 |
| henrynash_ | samueldmq: so yes, on the patch | 12:18 |
| samueldmq | henrynash_: I ended up leaving a review | 12:19 |
| *** EinstCrazy has quit IRC | 12:19 | |
| henrynash_ | samuedlmq: yes, was just replying | 12:19 |
| samueldmq | henrynash_: basically I am confused why that never gets invalidated | 12:19 |
| henrynash_ | samueldmq: so it’s true, the cache itself is never invlalidated, but token validation will fail if there is a relevant revoke event | 12:19 |
| henrynash_ | samueldmq: this was teh same in Liberty | 12:20 |
| samueldmq | henrynash_: gotcha | 12:20 |
| *** aurelien__ has joined #openstack-keystone | 12:20 | |
| samueldmq | henrynash_: I have a pathc for invalidating the token cache when the token is deleted 316991 | 12:21 |
| henrynash_ | samueldmq: cool... | 12:21 |
| samueldmq | henrynash_: so I was wondering if it wasn't good to make your dependent and add an invalidate to that method when the token is revoked (at least) | 12:21 |
| *** aurelien__ has quit IRC | 12:21 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:22 | |
| *** pnavarro has quit IRC | 12:22 | |
| *** GB21 has quit IRC | 12:23 | |
| henrynash_ | samueldmq: so was also thinking about at least invalidating it in the explcit revoke() case | 12:23 |
| henrynash | samueldmq: I’d like to keep the two separate, since we are first just re-instating the old fucntionaly…and then we can enhance it for thing slike that | 12:24 |
| henrynash | let me have another look, hoever | 12:24 |
| samueldmq | henrynash or henrynash_ ? | 12:25 |
| * samueldmq is confused | 12:25 | |
| henrynash_ | no idea why it keeps changing!!!! | 12:25 |
| henrynash_ | damn, it did it again! | 12:25 |
| samueldmq | henrynash[_]: yes take a look at that, I am just pulling the revocation logic to the provider, since fernet does not reach persistence code | 12:26 |
| henrynash_ | yep, understand | 12:26 |
| *** fawadkhaliq has quit IRC | 12:26 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:33 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Revert to caching fernet tokens the same way we do UUID https://review.openstack.org/326234 | 12:38 |
| openstackgerrit | henry-nash proposed openstack/keystone: Revert to caching fernet tokens the same way we do UUID https://review.openstack.org/326234 | 12:41 |
| *** rderose has joined #openstack-keystone | 12:44 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 12:50 |
| shewless | Hi there. Is there anyone who can help me get federation working with keystone? I've tried following the steps here: http://docs.openstack.org/developer/keystone/federation/federated_identity.html but I'm stuck. I'm trying to get an unscoped token (at the bottom of the instructions) but I keep getting an error. (Attempted to authenticate with an unsupported method). | 12:54 |
| shewless | I'm using shibbeth as my service provider and right now I'm trying to use testshib as my IDP | 12:55 |
| *** julim has joined #openstack-keystone | 12:55 | |
| *** rodrigods has quit IRC | 12:56 | |
| *** rodrigods has joined #openstack-keystone | 12:56 | |
| *** edmondsw has joined #openstack-keystone | 13:00 | |
| *** links has quit IRC | 13:03 | |
| *** pnavarro has joined #openstack-keystone | 13:03 | |
| *** ebalduf_ has joined #openstack-keystone | 13:03 | |
| *** fawadkhaliq has quit IRC | 13:04 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 13:07 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 13:13 |
| openstackgerrit | Merged openstack/keystone-specs: Add spec for fernet key store backends https://review.openstack.org/311268 | 13:18 |
| *** links has joined #openstack-keystone | 13:18 | |
| *** richm has joined #openstack-keystone | 13:20 | |
| *** sheel has quit IRC | 13:25 | |
| *** ayoung has joined #openstack-keystone | 13:26 | |
| *** ChanServ sets mode: +v ayoung | 13:26 | |
| *** nisha__ has joined #openstack-keystone | 13:29 | |
| *** nisha_ has quit IRC | 13:32 | |
| dstanek | shewless: are you seeing any errors in your log? | 13:36 |
| dstanek | shewless: one common mistake is to have a broken mapping | 13:36 |
| *** _amrith_ is now known as amrith | 13:40 | |
| *** fhubik has quit IRC | 13:42 | |
| *** edtubill has joined #openstack-keystone | 13:43 | |
| *** edtubill has quit IRC | 13:43 | |
| *** diazjf has joined #openstack-keystone | 13:44 | |
| shewless | +dtanek: not seeing any errors in the log. but I think I found the problem. my apache config defines this location: <Location /v3/OS-FEDERATION/identity_providers/idp_1/protocols/saml2/auth> | 13:45 |
| shewless | +dstanek: but I think idp_1 and saml2 are just placeholders for the identity provider and protocol that I created - is that right? | 13:46 |
| samueldmq | rderose: hi! | 13:47 |
| rderose | samueldmq: hi | 13:48 |
| samueldmq | rderose: I am willing to review PCI-DSS things | 13:48 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 13:48 |
| samueldmq | rderose: where should I start ? | 13:48 |
| *** nisha__ has quit IRC | 13:49 | |
| rderose | :) | 13:49 |
| *** nisha__ has joined #openstack-keystone | 13:50 | |
| rderose | samueldmq: start with https://review.openstack.org/#/c/314284/ | 13:51 |
| patchbot | rderose: patch 314284 - keystone - Add password table columns to meet PCI-DSS change ... | 13:51 |
| rderose | samueldmq: and then: https://review.openstack.org/#/c/320156/ | 13:51 |
| patchbot | rderose: patch 320156 - keystone - PCI-DSS Change password requirements | 13:51 |
| samueldmq | rderose: cool, i got that chain | 13:52 |
| samueldmq | rderose: commit messages are pretty descriptive | 13:52 |
| *** TxGVNN has joined #openstack-keystone | 13:52 | |
| shewless | for the "protocol" in federation: is it freeform or does it "have" to be something specific? # openstack federation protocol create protocol-name --identity-provider provider-name --mapping mapping-name | 13:53 |
| shewless | is "protocol-name" saml2 or can it be anything? | 13:53 |
| rderose | samueldmq: thx | 13:57 |
| *** clenimar has quit IRC | 13:59 | |
| shewless | +dstanek: I'm now seeing this.. broken mapping? Could not map any federated user properties to identity values. Check debug logs or the mapping used for additional details | 14:01 |
| *** ametts has joined #openstack-keystone | 14:02 | |
| *** clenimar has joined #openstack-keystone | 14:04 | |
| knikolla | o/ | 14:04 |
| *** ebalduf_ has quit IRC | 14:04 | |
| *** fhubik has joined #openstack-keystone | 14:05 | |
| *** yolanda_ has joined #openstack-keystone | 14:08 | |
| *** yolanda has quit IRC | 14:09 | |
| *** yolanda_ has quit IRC | 14:09 | |
| *** yolanda has joined #openstack-keystone | 14:09 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users and deprecate driver backend https://review.openstack.org/323596 | 14:14 |
| *** TxGVNN has quit IRC | 14:16 | |
| *** TxGVNN has joined #openstack-keystone | 14:16 | |
| *** diazjf has quit IRC | 14:17 | |
| *** diazjf has joined #openstack-keystone | 14:19 | |
| *** dave-mccowan has joined #openstack-keystone | 14:26 | |
| *** jaosorior has quit IRC | 14:26 | |
| *** raddaoui has joined #openstack-keystone | 14:26 | |
| *** spzala has joined #openstack-keystone | 14:28 | |
| lbragstad | henrynash_ samueldmq I see your fernet patches - I just have a few more things to straighten up with the performance testing CI and we should be able to test those | 14:29 |
| *** links has quit IRC | 14:29 | |
| *** diazjf has quit IRC | 14:30 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone-specs: Drop Support for Driver Versioning https://review.openstack.org/324081 | 14:32 |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/python-keystoneclient: Handle EmptyCatalog exception in list federated projects https://review.openstack.org/243153 | 14:32 |
| lbragstad | dolphm here is what I came up with last night for the gerrit event stream listener https://github.com/lbragstad/keystone-performance/blob/master/listener/listen.py | 14:34 |
| *** tonytan4ever has joined #openstack-keystone | 14:34 | |
| lbragstad | using pygerrit ^ | 14:35 |
| *** dan_nguyen has joined #openstack-keystone | 14:36 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/python-keystoneclient: Handle EmptyCatalog exception in list federated projects https://review.openstack.org/243153 | 14:36 |
| *** julim has quit IRC | 14:37 | |
| bknudson | lbragstad: were you going to use the rest api or is this the ssh client? | 14:38 |
| lbragstad | bknudson i'm using the event stream - https://pypi.python.org/pypi/pygerrit/0.2.1 | 14:38 |
| lbragstad | specifically using pygerrit.client | 14:39 |
| *** julim has joined #openstack-keystone | 14:40 | |
| *** julim has quit IRC | 14:40 | |
| *** clenimar has quit IRC | 14:41 | |
| lbragstad | I've never played with pygerrit but figured I'd tinker with it | 14:42 |
| *** pauloewerton has joined #openstack-keystone | 14:42 | |
| bknudson | I assume it's what 3rd party ci typically uses | 14:42 |
| bknudson | you'll need special access to use the ssh stream | 14:43 |
| bknudson | anyone can use the rest api | 14:43 |
| *** woodburn has quit IRC | 14:44 | |
| *** clenimar has joined #openstack-keystone | 14:45 | |
| lbragstad | bknudson i had to supply some stuff to pygerrit in order to get it to work | 14:45 |
| bknudson | oh, I thought you'd need another ID for the gerrit stream | 14:46 |
| dolphm | nonameentername: i said monday, but i think that was just when i came across the failure. this log was from the periodic stable mitaka build from last thursday: http://logs.openstack.org/periodic-stable/periodic-keystone-python27-db-mitaka/a445f52/console.html.gz | 14:48 |
| lbragstad | bknudson the only thing I need to supply was my gerrit id | 14:48 |
| lbragstad | bknudson and it used an ssh key from the box i was developing on (that was already uploaded to gerrit) | 14:49 |
| bknudson | lbragstad: watch out if infra decides to disable your id | 14:49 |
| dolphm | bknudson: reading the stream should be no big deal | 14:49 |
| dolphm | unless they've changed that recently | 14:49 |
| lbragstad | well - it seemed to be really easy to do - it was only a few lines of code | 14:49 |
| *** timcline has joined #openstack-keystone | 14:49 | |
| dolphm | lbragstad: but before you start posting review feedback, you should get a 3rd party CI account | 14:50 |
| *** diazjf has joined #openstack-keystone | 14:50 | |
| lbragstad | and all the events come back as nice little objects | 14:50 |
| lbragstad | dolphm yeah - that's on my list of things to do today | 14:50 |
| samueldmq | lbragstad: those are henrynash_'s patches, but yes, great you will be able to do the performance testing :D | 14:53 |
| *** diazjf has quit IRC | 14:56 | |
| *** clenimar has quit IRC | 14:56 | |
| *** links has joined #openstack-keystone | 14:57 | |
| *** fhubik_brb has joined #openstack-keystone | 14:58 | |
| *** fhubik has quit IRC | 14:58 | |
| *** fhubik_brb has quit IRC | 14:58 | |
| *** clenimar has joined #openstack-keystone | 15:00 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:00 | |
| *** clenimar has quit IRC | 15:01 | |
| *** tonytan4ever has quit IRC | 15:03 | |
| *** lucas___ has joined #openstack-keystone | 15:05 | |
| *** frickler has quit IRC | 15:06 | |
| *** frickler has joined #openstack-keystone | 15:06 | |
| *** sheel has joined #openstack-keystone | 15:07 | |
| *** tonytan4ever has joined #openstack-keystone | 15:09 | |
| *** KevinE has joined #openstack-keystone | 15:10 | |
| lbragstad | does anyone have a preference on what the user id of the keystone performance service user should be? | 15:10 |
| lbragstad | also - we will need a dedicated email address for the service user account because gerrit assumes user email addresses are unique across the system | 15:13 |
| *** browne has joined #openstack-keystone | 15:14 | |
| lbragstad | I could create a 'keystone-performance' user in gerrit and hook it up to a dummy keystone-performance@gmail.com email address? | 15:15 |
| bknudson | I think infra wants a prefix on the name | 15:15 |
| lbragstad | this is what i'm reading http://docs.openstack.org/infra/system-config/third_party.html#creating-a-service-account | 15:15 |
| *** nisha__ has quit IRC | 15:17 | |
| *** nisha__ has joined #openstack-keystone | 15:17 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 15:18 |
| *** julim has joined #openstack-keystone | 15:20 | |
| *** julim has quit IRC | 15:20 | |
| *** julim has joined #openstack-keystone | 15:21 | |
| *** david-lyle has joined #openstack-keystone | 15:21 | |
| *** julim has quit IRC | 15:22 | |
| *** julim has joined #openstack-keystone | 15:22 | |
| *** woodster_ has joined #openstack-keystone | 15:24 | |
| *** diazjf has joined #openstack-keystone | 15:26 | |
| *** lucas___ has quit IRC | 15:26 | |
| *** dmk0202 has quit IRC | 15:29 | |
| *** diazjf has quit IRC | 15:30 | |
| *** lucas____ has joined #openstack-keystone | 15:32 | |
| *** julim has quit IRC | 15:32 | |
| *** julim has joined #openstack-keystone | 15:42 | |
| *** julim has quit IRC | 15:43 | |
| *** julim has joined #openstack-keystone | 15:44 | |
| *** julim has quit IRC | 15:44 | |
| *** belmoreira has quit IRC | 15:46 | |
| *** julim has joined #openstack-keystone | 15:46 | |
| *** julim has quit IRC | 15:46 | |
| *** julim has joined #openstack-keystone | 15:47 | |
| *** diazjf has joined #openstack-keystone | 15:47 | |
| *** nisha_ has joined #openstack-keystone | 15:50 | |
| *** nisha__ has quit IRC | 15:51 | |
| *** julim has quit IRC | 15:57 | |
| *** chlong has quit IRC | 15:58 | |
| *** fawadkhaliq has quit IRC | 16:07 | |
| *** edtubill has joined #openstack-keystone | 16:07 | |
| *** julim has joined #openstack-keystone | 16:12 | |
| *** julim has quit IRC | 16:12 | |
| *** julim has joined #openstack-keystone | 16:13 | |
| *** gyee has joined #openstack-keystone | 16:15 | |
| *** ChanServ sets mode: +v gyee | 16:15 | |
| *** links has quit IRC | 16:15 | |
| shewless | I'm getting further in my keystone federation with testshib. I'm hitting a new error "Missing entity ID from environment" in the keystone log. I have a --remote-id set for my identity provider.. I'm not sure what else I need. Any hints? | 16:16 |
| dstanek | shewless: sounds like your remote_id_attribute is incorrect | 16:19 |
| dstanek | shewless: for testshib.org is should be 'Shib-Identity-Provider' | 16:20 |
| *** rk4n has joined #openstack-keystone | 16:20 | |
| *** pushkaru has joined #openstack-keystone | 16:21 | |
| shewless | +dstanek: that's what I though but I have it set to that exact string. Do I have to setup my protocol or identity provider with that same 'Shib-Identity-Provider'? | 16:22 |
| *** rk4n__ has quit IRC | 16:23 | |
| dstanek | shewless: you shouldn't have to do anything else with that string. the error is because that key is not in the environment provided by mod_shib | 16:25 |
| dstanek | shewless: can you paste.o.o the environment from your log? | 16:25 |
| shewless | +dstanek: how do I paste the environment? | 16:25 |
| dstanek | shewless: grab it from the keystone.log and paste to paste.openstack.org | 16:26 |
| *** daemontool has joined #openstack-keystone | 16:27 | |
| *** lucas____ has quit IRC | 16:28 | |
| *** browne has quit IRC | 16:30 | |
| shewless | +dstanek: this is my apache2/keystone-public.log.. I doubt it's what you need but it's a start http://paste.ubuntu.com/17122182 | 16:30 |
| dstanek | shewless: try turing on debug logging | 16:31 |
| *** lucas___ has joined #openstack-keystone | 16:31 | |
| *** tesseract has quit IRC | 16:31 | |
| shewless | +dstanek: in keystone? I'm not sure how | 16:32 |
| *** lucas____ has joined #openstack-keystone | 16:32 | |
| shewless | like: debug=true in keystone.conf I guess | 16:32 |
| dstanek | shewless: look for the 'debug' settings in keystone.conf. there are a couple there | 16:33 |
| *** d0ugal has quit IRC | 16:33 | |
| *** luca_____ has joined #openstack-keystone | 16:33 | |
| *** diazjf has quit IRC | 16:34 | |
| *** diazjf has joined #openstack-keystone | 16:34 | |
| *** luca_____ has quit IRC | 16:34 | |
| *** luc______ has joined #openstack-keystone | 16:34 | |
| dstanek | shewless: also to step back for a second | 16:35 |
| *** lucas___ has quit IRC | 16:35 | |
| dstanek | you are using testshib.org as your IdP right? and you are using Horizon to login? | 16:35 |
| *** frontrunner has quit IRC | 16:36 | |
| shewless | +dstanek: any better: http://paste.ubuntu.com/17122379 | 16:36 |
| shewless | +dstanek: yes you are correct. | 16:36 |
| *** lucas____ has quit IRC | 16:36 | |
| *** yolanda has quit IRC | 16:37 | |
| dstanek | shewless: can you also paste your config? | 16:38 |
| *** luc______ has quit IRC | 16:39 | |
| *** diazjf has quit IRC | 16:40 | |
| *** yolanda has joined #openstack-keystone | 16:40 | |
| *** Guest47242 is now known as med_ | 16:41 | |
| *** med_ has joined #openstack-keystone | 16:41 | |
| *** lucas___ has joined #openstack-keystone | 16:41 | |
| *** rcernin has quit IRC | 16:42 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:42 | |
| *** fawadkhaliq has quit IRC | 16:42 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:42 | |
| shewless | +dstanek: http://paste.ubuntu.com/17122586 | 16:42 |
| *** lhcheng has joined #openstack-keystone | 16:45 | |
| *** ChanServ sets mode: +v lhcheng | 16:45 | |
| *** lucas___ has quit IRC | 16:46 | |
| *** frontrunner has joined #openstack-keystone | 16:47 | |
| *** d0ugal has joined #openstack-keystone | 16:49 | |
| *** mvk has quit IRC | 16:50 | |
| *** diazjf has joined #openstack-keystone | 16:55 | |
| dstanek | shewless: so you are successfully getting redirected to testshib.org to login, but on the redirect back you are getting the 500? | 16:56 |
| *** rderose has quit IRC | 16:56 | |
| *** daemontool has quit IRC | 16:57 | |
| shewless | +dstanek: I'm not even sure if that's happening.. I can do a tcpdump.. in my browser I see this: {"error": {"message": "Missing entity ID from environment (Disable insecure_debug mode to suppress these details.)", "code": 401, "title": "Unauthorized"}} | 16:58 |
| shewless | and the address bar is: http://...:5000/v3/auth/OS-FEDERATION/websso/testshib?origin=https://.../auth/websso/ | 16:59 |
| shewless | I can't figure out where OS_FEDERATION/websso/testshib? is coming from.. | 16:59 |
| *** rderose has joined #openstack-keystone | 17:00 | |
| *** ayoung has quit IRC | 17:01 | |
| shewless | +dstanek: If I tcpdump the management interface where horizon/keystone is running I don't see any information going to testshib.. so maybe it's not getting that far? | 17:02 |
| shewless | +dstanek: or is my browser supposed to be doing that part? | 17:04 |
| *** tonytan4ever has quit IRC | 17:04 | |
| dstanek | shewless: tcp dumping isn't going to help. the redirect back to keystone is handled by the metadata (i think). i don't think you will ever seen keystone<->testshib traffic | 17:09 |
| dstanek | but you are logging in and getting redirected back to keystone and then getting the 500? | 17:10 |
| *** browne has joined #openstack-keystone | 17:10 | |
| *** sdake has joined #openstack-keystone | 17:10 | |
| shewless | +dstanek: I get to the horizon login screen. It says "Authenticate using" and I have an entry in there called "Testshib SAML". I click connect and then I see this error: {"error": {"message": "Missing entity ID from environment (Disable insecure_debug mode to suppress these details.)", "code": 401, "title": "Unauthorized"}} | 17:11 |
| *** lucas___ has joined #openstack-keystone | 17:11 | |
| shewless | I don't have a chance to log in anywhere | 17:12 |
| dstanek | shewless: sounds like maybe mod_shib isn't correctly configured in apache? can you paste your keystone apache config? | 17:12 |
| dstanek | shewless: so i think the flow (in the brower) is something like horizon->keystone->testshib->keystone->horizon - the url on keystone's side should be protected with mod_shib to force it to redirect to the IdP if the user hasn't authed | 17:14 |
| *** jsifantu has joined #openstack-keystone | 17:15 | |
| shewless | +dstanek: here you go: http://paste.ubuntu.com/17123622 | 17:15 |
| *** lucas___ has quit IRC | 17:17 | |
| dstanek | shewless: are you using the saml2 protocol? an earlier error message led me to believe you created a testshib protocol | 17:18 |
| dstanek | shewless: also for websso i was using LocationMatch "/v3/auth/OS-FEDERATION/identity_providers/.*?/protocols/saml2/websso"> in my config | 17:20 |
| shewless | I created both.. but right now I'm using the saml2 protocol | 17:20 |
| dstanek | shewless: can you do a request now that you are using the saml2 protocola and paste the keystone log? | 17:22 |
| *** tonytan4ever has joined #openstack-keystone | 17:23 | |
| shewless | +dstanek: I think in local_setting.py I put the wrong value.. I put testshib and I think I should have put saml2. I'm trying again.. | 17:23 |
| *** TxGVNN has quit IRC | 17:23 | |
| dstanek | shewless: that should change the URL to hopefully the protected one | 17:23 |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: Honor ldap_filter on filtered group list https://review.openstack.org/325939 | 17:24 |
| shewless | +dstanek: darn still not working.. same problem.. I'll check the logs to see if they changed | 17:24 |
| *** jorge_munoz_ has joined #openstack-keystone | 17:25 | |
| shewless | +dstanek: the URL does look different but the end result is the same (same error about missing entity ID) | 17:25 |
| *** jsifantu has quit IRC | 17:26 | |
| *** itisha has joined #openstack-keystone | 17:26 | |
| samueldmq | rderose: so, patch 323596 changes the structure of the code, because now it acts as any other backend that can have a custom driver | 17:27 |
| patchbot | samueldmq: https://review.openstack.org/#/c/323596/ - keystone - Refactor shadow users and deprecate driver backend | 17:27 |
| samueldmq | rderose: but it doesn't make that sense to shadow users | 17:27 |
| *** jorge_munoz has quit IRC | 17:28 | |
| *** jorge_munoz_ is now known as jorge_munoz | 17:28 | |
| dstanek | shewless: when you go directly to http://...:5000/v3/auth/OS-FEDERATION/websso/testshib?origin=https://.../auth/websso/ what happens? | 17:28 |
| rderose | to me the backend is the data access layer if you will | 17:28 |
| rderose | samueldmq:^ | 17:28 |
| samueldmq | rderose: yes? | 17:29 |
| samueldmq | and.. | 17:29 |
| rderose | samueldmq: and I certainly don't think we should allow every backend to be customized | 17:29 |
| rderose | samueldmq: it creates technical debt | 17:29 |
| rderose | samueldmq: so core -> backend is okay, so core -> backend/shadow.py should be acceptable | 17:30 |
| dstanek | rderose: i don't know that i agree with that change. will 'shadow' be used as an identity backend? | 17:30 |
| shewless | +dstanek: I get this error | 17:30 |
| shewless | {"error": {"message": "Missing entity ID from environment (Disable insecure_debug mode to suppress these details.)", "code": 401, "title": "Unauthorized"}} | 17:30 |
| *** BjoernT has joined #openstack-keystone | 17:31 | |
| rderose | samueldmq: so shadow.py is just another backend data access object, that is not customizable | 17:31 |
| rderose | dstanek: no, shadow will not be used as an identity backend | 17:31 |
| dstanek | rderose: i don't think it belongs in keystone.identity.backends then | 17:32 |
| rderose | dstanek: but it is identity backend code :) | 17:32 |
| samueldmq | rderose: why not just keep it as identity/shadow_backends/sql.py | 17:32 |
| samueldmq | rderose: the only difference is that there won't be a public generic driver that can be customized | 17:32 |
| rderose | dstanek: where do we put backend code that is not a driver then? | 17:32 |
| samueldmq | rderose: and plugged | 17:32 |
| *** pushkaru has quit IRC | 17:33 | |
| rderose | samueldmq: because, so for every backend object, we're going to create these folders and structure? | 17:33 |
| dstanek | rderose: i think where it was | 17:33 |
| rderose | samueldmq: to me that only makes sense if it is pluggable | 17:33 |
| samueldmq | rderose: isn't it a driver ? it does sql queries on entities to db | 17:33 |
| rderose | dstanek: so every backend should be pluggable; thus customizable? | 17:34 |
| dstanek | rderose: it's not for every backend object. the architecture is that when we have a driver interface that we put implementations in a separate package | 17:34 |
| rderose | samueldmq: I think of it more as a database access object, then a driver | 17:34 |
| dstanek | rderose: what does it hurt? | 17:34 |
| samueldmq | dstanek: ++ and just remove the config option to plug drivers that implemnet that interface | 17:34 |
| samueldmq | even the driver interface can be maintained, and used internally | 17:35 |
| dstanek | rderose: how will it be injected in the future? | 17:35 |
| rderose | dstanek: if everything is customizable, it makes changes slow, but we always have to be concerned about that. and it makes referential integrity impossible. lets stop the insanity :) | 17:35 |
| rderose | * changes slow, because we are always have to be concerned with the custom implementation (sorry) | 17:36 |
| dstanek | rderose: we only have to be concerned with the interface and semantics | 17:36 |
| dstanek | if someone writes a mongo version then who cares? | 17:36 |
| dstanek | maybe this just need to be in the actual identity backends | 17:37 |
| rderose | dstanek: what about referential integrity? | 17:37 |
| dstanek | rderose: it's not needed | 17:37 |
| *** thumpba has joined #openstack-keystone | 17:37 | |
| samueldmq | rderose: my view is that every keystone subsystem has that structure with core owning the manager and driver signature and backends/ containing the drivers | 17:37 |
| shewless | +dstanek: in my shibboleth xml my entity is https://../shibboleth. But in my address bar the origin is https://../auth/websso - does that matter? | 17:37 |
| rderose | dstanek: it could improve performance | 17:37 |
| samueldmq | rderose: if the issue is to not allow custom drivers for shadow users, just deprecate the config option | 17:37 |
| dstanek | rderose: how would there be an improvment in performace? | 17:38 |
| rderose | samueldmq: what's the point of the interface then | 17:38 |
| samueldmq | rderose: make sure the drivers we implement are in agreement with it | 17:38 |
| rderose | dstanek: if we have referential integrity between user table and other tables, faster queries | 17:39 |
| samueldmq | rderose: if we implemented an LDAP driver, it would need to follow the interface | 17:39 |
| *** rk4n has quit IRC | 17:39 | |
| samueldmq | rderose: and the only thing the manager needs to know if the interface | 17:39 |
| openstackgerrit | henry-nash proposed openstack/keystone: Revert to caching fernet tokens the same way we do UUID https://review.openstack.org/326234 | 17:39 |
| samueldmq | rderose: it's like a java interface (or an interface everywhere) :) | 17:39 |
| rderose | samueldmq: :) | 17:39 |
| dstanek | rderose: doesn't your shadow users backend already use RI? | 17:39 |
| dstanek | isn't that why it needed to share tables? | 17:40 |
| rderose | dstanek: part of the goal of shadow users is to have RI. My point is, is we always allow for custom drivers, then we can never really have referential integrity. And not everything should be customizable, to me creates technical debt. | 17:41 |
| *** rk4n has joined #openstack-keystone | 17:42 | |
| dstanek | what about in this case? do we have RI? | 17:42 |
| rderose | dstanek: between the different user objects, yes | 17:42 |
| dstanek | i actually think it makes a cleaner architecture. not technical debt. | 17:42 |
| rderose | samueldmq dstanek: if you want to keep structure, but eliminate the config option, I suppose I could live with that for now | 17:43 |
| *** jsifantu has joined #openstack-keystone | 17:43 | |
| rderose | samueldmq dstanek: but I do think we need come up with a better design pattern | 17:43 |
| dstanek | i guess i just don't see the deficiency | 17:44 |
| rderose | dstanek: I do see some value; just don't like that every time I need a database object, I've got to do this whole driver thing | 17:44 |
| dstanek | rderose: that's probably a constant in most of our subsystems that won't go away | 17:45 |
| dstanek | at least not anytime soon | 17:45 |
| dstanek | what we have started to do is support less and less implementations | 17:45 |
| dstanek | but we still need to declare interface | 17:46 |
| rderose | dstanek: okay, I can live with that | 17:46 |
| rderose | samueldmq dstanek: I'll create a new refactor patch for shadows users :) | 17:46 |
| bknudson | we've had requests / ideas about switching to objects rather than passing around dicts before. | 17:46 |
| rderose | samueldmq dstanek: adding it to my list | 17:46 |
| rderose | bknudson: ++ | 17:46 |
| dstanek | bknudson: ++ | 17:46 |
| samueldmq | and having an interface rather than a single implementation (sql) won't let us to do RI | 17:46 |
| samueldmq | bknudson: I think there was a spec from ayoung | 17:47 |
| rderose | samueldmq: but not allowing everything to be customizable will | 17:47 |
| samueldmq | bknudson: that's a nice thing | 17:47 |
| samueldmq | rderose: you can only do RI if everything is sql right? | 17:48 |
| dstanek | samueldmq: i think RI is a red herring here as there isn't any RI impact based on this change | 17:48 |
| *** diazjf has quit IRC | 17:48 | |
| rderose | samueldmq: not everything, I'd settle for some :) I mean we currently have a ton of island tables | 17:48 |
| *** lucas___ has joined #openstack-keystone | 17:48 | |
| *** diazjf has joined #openstack-keystone | 17:49 | |
| samueldmq | dstanek: yes, I was just thinking if there was a way to do opportunistic RI in the future, if we really needed it :) | 17:49 |
| samueldmq | but we can't really do it right in databases if the objects are not in databases all the time (depends on the driver, maybe it's ldap) | 17:50 |
| samueldmq | so I think we're doing it right, because RI would be something driver specific, when we support multiple | 17:50 |
| *** diazjf has quit IRC | 17:50 | |
| *** nisha_ has quit IRC | 17:50 | |
| henrynash_ | notmorgan, ayoung: I’m kind of at the point that I think will have to abandon the specs for both project hierarchical naming and namig relaxation - neither can provide the gurantee that an auth request before the upgrade will work after the upgrade without modification | 17:50 |
| *** nisha__ has joined #openstack-keystone | 17:50 | |
| rderose | samueldmq: that's my point, not all drivers need a custom implementation | 17:50 |
| *** pushkaru has joined #openstack-keystone | 17:51 | |
| dstanek | rderose: which ones don't? | 17:51 |
| notmorgan | henrynash_: yeah, sorry :( | 17:51 |
| notmorgan | henrynash_: but you see my concern. | 17:51 |
| notmorgan | we *cant* break current auth requests. | 17:51 |
| *** sdake has quit IRC | 17:51 | |
| samueldmq | rderose: so you want to propose removing their driver config options? and do RI in sql? | 17:51 |
| henrynash_ | notmorgan: yep, which was kind of why I was a bit cool on the hierarchical naming version…not sure it bought us TAHT much….tehy both break the auth | 17:52 |
| dstanek | henrynash_: that's unfortunate | 17:52 |
| rderose | dstanek: well, shadow users for one, mapping_id probably not... | 17:52 |
| samueldmq | rderose: is it worth it to do half-RI? | 17:52 |
| rderose | dstanek: catalog, credential... | 17:52 |
| samueldmq | we also don't control whether people have custom driver or not | 17:52 |
| dstanek | rderose: catalog and credential definitely need to be backends | 17:53 |
| rderose | samueldmq: yeah, definitely | 17:53 |
| samueldmq | rderose: so yeah, that's one point :) | 17:53 |
| dstanek | there should be RI within a subsystem and if we are not doing that then we are wrong | 17:53 |
| samueldmq | dstanek: ++ so RI inside idenity is okay, and expected, right ? | 17:54 |
| samueldmq | dstanek: between the shadow tables and the others | 17:54 |
| dstanek | samueldmq: i would expect it | 17:54 |
| rderose | dstanek samueldmq: alright guys, new patch coming | 17:55 |
| dstanek | i'm actually used to not having RI between subsystems. on high volume websites i worked on we dropped RI on certain tables because it slows down inserts | 17:55 |
| *** jsifantu has quit IRC | 17:55 | |
| samueldmq | dstanek: and then you make sure things are as expected in the business logic (you narrow things there) | 17:57 |
| samueldmq | dstanek: I am also used to it, it makes sense to me at the point you think you may have different actual backends for the data (and drivers), so you just can't do it | 17:58 |
| dstanek | samueldmq: right. enforce the RI in code. | 17:58 |
| *** browne has quit IRC | 17:58 | |
| dstanek | shewless: it sounds like mod_shib isn't picking up your request | 17:58 |
| shewless | +dstanek: I have this in apache config: WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/.*?/protocols/.*?/auth)$ | 17:59 |
| samueldmq | rderose: nice, looking forward to review it | 17:59 |
| shewless | +dstanek: but the URL is :5000/v3/auth/OS-FEDERATION/websso/saml2? | 17:59 |
| samueldmq | rderose: I left a review just to register our conversation/decision | 17:59 |
| shewless | +dstanek: I think that might be the problem... I'm not sure why the URL is showing like that.. | 17:59 |
| rderose | samueldmq: cool :) | 17:59 |
| rderose | samueldmq dstanek: PCI patches are ready when you have time | 18:00 |
| dstanek | shewless: here is my current config on the code where i'm writing my saml2 middleware http://paste.openstack.org/show/508990/ | 18:02 |
| *** adrian_otto has joined #openstack-keystone | 18:02 | |
| shewless | +dstanek: thanks. do you think I would need the keystone.conf or any other conf as well? | 18:03 |
| shewless | +dstanek: do I need taht alias /identity stuff? | 18:03 |
| dstanek | shewless: not sure, but this should get your apache in the right state | 18:03 |
| dstanek | the /identity is just what devstack currently does | 18:03 |
| *** browne has joined #openstack-keystone | 18:03 | |
| shewless | +dstanek.. you have a location for sso and a location for non sso | 18:04 |
| *** chris_hultin has joined #openstack-keystone | 18:04 | |
| dstanek | yep | 18:04 |
| adrian_otto | hey everyone. I am having a little trouble getting v3 to work with my OSAD setup. It seems to work just fine for generating v2 tokens. This is what happens when a client tries to get a v3 token: http://paste.openstack.org/show/508989/ Any guidance? | 18:04 |
| adrian_otto | it's definitely using a self-signed certificate. Does that matter? | 18:05 |
| openstackgerrit | henry-nash proposed openstack/keystone: Revert to caching fernet tokens the same way we do UUID https://review.openstack.org/326234 | 18:06 |
| dstanek | adrian_otto: is that the entire log? after the POST it really doesn't show what the error was | 18:06 |
| dstanek | are you getting 500s? | 18:06 |
| adrian_otto | the client gets a 500 back, yeah | 18:06 |
| adrian_otto | that's just the part of the log that was written at the time of the request | 18:07 |
| lbragstad | I don't think anything from that paste is issuing the 500 | 18:07 |
| *** jamie_h has quit IRC | 18:07 | |
| adrian_otto | oh, interesting | 18:07 |
| lbragstad | that's pretty normal output when using self-signed certs | 18:07 |
| adrian_otto | good to know | 18:07 |
| odyssey4me | adrian_otto if the v2 endpoint is working then it's most likely that the request isn't providing a domain/project | 18:07 |
| odyssey4me | a v3 request needs a bit more info | 18:08 |
| dstanek | adrian_otto: do you have a detailed error message in the 500 response? | 18:08 |
| adrian_otto | here is the trace from the client side:http://paste.openstack.org/show/508993/ | 18:08 |
| bknudson | "GET /mservices HTTP/1.1" 500 59 | 18:08 |
| *** henrynash_ has quit IRC | 18:09 | |
| dstanek | adrian_otto: you are getting a token and then /mservices is failing | 18:09 |
| adrian_otto | that's how the client gets the catalog of services from keystone, right? | 18:09 |
| bknudson | no, keystone doesn't have an /mservices | 18:09 |
| dstanek | i'm assuming that's a magnum URL | 18:10 |
| *** frontrunner has quit IRC | 18:10 | |
| bknudson | not sure why that would cause a 500 error... should be 404 not found | 18:10 |
| adrian_otto | yes, I did a magnum service-list | 18:10 |
| -openstackstatus- NOTICE: Zuul has been restarted to correct an error condition. Events since 17:30 may have been missed; please 'recheck' your changes if they were uploaded since then, or have "NOT_REGISTERED" errors. | 18:10 | |
| dstanek | adrian_otto: is there any info in the magnum log? | 18:10 |
| adrian_otto | but I did not see an error come up in the magnum log file. | 18:11 |
| adrian_otto | let me try it again | 18:11 |
| odyssey4me | is magnum configured to communicate using Keystone v3 on a service-service level? | 18:11 |
| bknudson | if keystone and magnum are separate log files then /mservices should not show up in keystone log file | 18:11 |
| bknudson | that would indicate that the client is talking to keystone when it should be talking to magnum | 18:11 |
| adrian_otto | yeah, magnum is in a different service container on this host, and has its own log | 18:12 |
| dstanek | bknudson: it wasn't. that was the client log | 18:12 |
| adrian_otto | maybe I'm crashing magnum or something. I'll look there | 18:12 |
| *** jsifantu has joined #openstack-keystone | 18:12 | |
| bknudson | dstanek: makes sense. The log doesn't show the port. | 18:13 |
| dstanek | based on the keystone log you have it doen't look like magnum ever gets around to calling back to keystone. not sure it it needs to or now | 18:13 |
| dstanek | s/now/not/ | 18:13 |
| adrian_otto | thanks for the help, I'll chime in a bit later and let you know what I found. The cert error was throwing me off the scent here, sorry. | 18:13 |
| dstanek | adrian_otto: happy bug hunting | 18:13 |
| adrian_otto | tx! | 18:13 |
| bknudson | is the connectionpool logging from session? | 18:14 |
| bknudson | maybe we could improve that. | 18:14 |
| bknudson | keystoneauth? | 18:14 |
| bknudson | "Starting new HTTP connection (1)" -- what does the (1) mean? We need better logging | 18:15 |
| dstanek | i would guess that's a requests thing | 18:15 |
| shewless | +dstanek: praise the Lord I'm one step further!!!! Now I see a testshib page... but more work is needed. it's an ERROR.. in fact it says "Something horrible happened".. lol | 18:15 |
| dstanek | shewless: what does it say the error is? | 18:15 |
| dstanek | there should me a one line message at the bottom of that paragraph | 18:16 |
| zigo | notmorgan: FYI, I gave up using uwsgi, and now the Debian package uses Apache directly. The reasoning is that it's what Ubuntu does, and I don't want to break puppet-openstack, so I prefer my packages behaves the same way as the one in Ubuntu. | 18:16 |
| dstanek | it's likely that your metadata isn't corect | 18:16 |
| *** BjoernT has quit IRC | 18:16 | |
| shewless | +dstanek: http://pastebin.com/1FRCz8kJ | 18:16 |
| shewless | Error Message: SAML 2 SSO profile is not configured for relying party https://mycloud.sandvine.com/shibboleth | 18:16 |
| dstanek | shewless: did you upload the metadata? | 18:17 |
| shewless | +dstanek: I did. and I downloaded the corresponding shibboleth2.xml file and put it in /etc/shibboleth/ | 18:18 |
| shewless | +dstanek: and the entityID of that file says: entityID="https://mycloud.sandvine.com/shibboleth | 18:18 |
| shewless | +dstanek: maybe I'll retry the upload.. I did it yesterday morning | 18:18 |
| dstanek | shewless: the metadata you uploaded was incorrect | 18:20 |
| dstanek | it says entity id is https://mycloud.sandvine.com/ | 18:20 |
| dstanek | Metadata | 18:20 |
| dstanek | bad paste... | 18:21 |
| dstanek | http://mycloud.sandvine.com/Shibboleth | 18:21 |
| dstanek | with an uppercase s | 18:21 |
| dstanek | shewless: you can search for the entities here: http://mycloud.sandvine.com/Shibboleth | 18:21 |
| *** lucas___ has quit IRC | 18:22 | |
| shewless | +dstanek: that link doesn't work: The page you were looking for doesn't exist | 18:22 |
| dstanek | that's what you entity id is set to. | 18:23 |
| dstanek | https://www.testshib.org/entities.html | 18:24 |
| shewless | +dstanek: interesting.. let me try and upload a new one and see if that works | 18:25 |
| *** welldannit has joined #openstack-keystone | 18:25 | |
| welldannit | hello. if anyone has a few minutes im having some troubles getting keystone/ldap working on liberty | 18:25 |
| dstanek | welldannit: go ahead an just ask your questions. hopefully someone is around to answer them | 18:26 |
| welldannit | i did this a long time ago and back then i defined roles/project and users in ldap | 18:26 |
| shewless | +dstanek: well it worked... I just re-uploaded the metadata... I'm not sure how I went wrong the first time.. maybe it's because the apache config was screwed up | 18:26 |
| welldannit | now it looks like the "right" way to do things is to use a domain and only define users/groups in ldap | 18:27 |
| shewless | +dstanek: next: Error Message: No peer endpoint available to which to send SAML response | 18:27 |
| welldannit | unforutnately i can't figure out how to get the user set up to have access to any projects | 18:27 |
| *** pushkaru has quit IRC | 18:28 | |
| *** ayoung has joined #openstack-keystone | 18:28 | |
| *** ChanServ sets mode: +v ayoung | 18:28 | |
| *** jsifantu has quit IRC | 18:28 | |
| dstanek | shewless: can you paste your metadata? for some reason it can't find the HTTP-POST url | 18:29 |
| shewless | +dstanek: does the identity provider need to POST to the service provider? My server is not publicly accessible.. | 18:31 |
| *** nisha_ has joined #openstack-keystone | 18:31 | |
| dstanek | shewless: hmm...so yes i think the IdP makes a metadata request from the service provider | 18:32 |
| dstanek | shewless: https://idp.testshib.org/cgi-bin/idplog.cgi?lines=300&logname=idp-process.log | 18:32 |
| *** links has joined #openstack-keystone | 18:32 | |
| dstanek | but it may just be your metadata | 18:33 |
| dstanek | that log is not just your stuff, but anyone running against testshib | 18:33 |
| shewless | +dstanek: hmm looks liek that might be the case.. I thought it would all happen a session initiated by my server.. | 18:33 |
| *** BjoernT has joined #openstack-keystone | 18:33 | |
| shewless | +dstanek: maybe it's time to switch to my IT departments internal IDP and see if I can get that to work. I just wanted to work out the kinks first | 18:34 |
| shewless | +dstanek: thanks for all of your help. we'll see | 18:34 |
| samueldmq | rderose: you still around ? | 18:35 |
| dstanek | shewless: you could always fire up a cloud server and experiment with testshib | 18:35 |
| samueldmq | rderose: I am on the first patch on the chain ( patch 314284 ) | 18:35 |
| patchbot | samueldmq: https://review.openstack.org/#/c/314284/ - keystone - Add password table columns to meet PCI-DSS change ... | 18:35 |
| *** nisha__ has quit IRC | 18:35 | |
| *** rk4n has quit IRC | 18:35 | |
| shewless | +dstanek: good idea. I'm concerned about the mapping file and how the roles are setup. Do you know if it's possible for each user to have their own project when logging in via federation? | 18:36 |
| *** frontrunner has joined #openstack-keystone | 18:36 | |
| shewless | +dstanek: I know when I used ldap I had to manually create the project ahead of time, but I could map the project id to the user id in keystone.conf (there is some option for that) | 18:36 |
| dstanek | shewless: if the projects already exists they you should be able to map to them. right now there is no mechansim to create them...yet. there is a spec for that | 18:37 |
| *** sdake has joined #openstack-keystone | 18:37 | |
| shewless | +dstanek: okay. Do I map them with shibboloeth/attribute-map.xml or the mapping in openstack itself? | 18:37 |
| rodrigods | dstanek, ^ interesting... the timing of shewless question and the spec proposal :) | 18:37 |
| shewless | +rodrigods: it's a good idea :P | 18:38 |
| rodrigods | shewless, yes it is! | 18:38 |
| dstanek | shewless: attribute-map.xml will them mod_shib what attributes to pull out of the assertion and what you want them called for keystone | 18:38 |
| *** BjoernT has quit IRC | 18:38 | |
| dstanek | then you have to create a json mapping in keystone to match those things that do other things | 18:39 |
| *** woodburn has joined #openstack-keystone | 18:39 | |
| dstanek | i'm assuming you've at least seen the json with local and remote blocks... | 18:39 |
| shewless | +dstanek: yes I have. I took a crack at adding one.. I just don't really know what it all means | 18:40 |
| shewless | +dstanek: or how to relate it | 18:40 |
| rodrigods | shewless, this might help: http://docs.openstack.org/developer/keystone/mapping_combinations.html | 18:40 |
| dstanek | shewless: basically when you login to an IdP it will provide the service providers some attributes about you like name/group/etc. the attribute-map.xml is just telling mod_shib which ones you care about. | 18:41 |
| dstanek | the the link rodrigods shows how to take those and do something useful | 18:41 |
| *** pushkaru has joined #openstack-keystone | 18:42 | |
| *** jsifantu has joined #openstack-keystone | 18:43 | |
| dstanek | setting up federation is an exercise in pain | 18:43 |
| rodrigods | lol | 18:43 |
| shewless | +dstanek: thanks.. I'm feeling the pain. what's the local vs remote stuff? | 18:43 |
| dstanek | remote does the matching for example the IdP says the user is in a particular group | 18:44 |
| dstanek | if that matches the local declares who keystone thinks the user is. gives them a keystone group/etc | 18:44 |
| rderose | samuelmq: hi, back now | 18:44 |
| samueldmq | rderose: left a review there :) | 18:45 |
| dstanek | shewless: for example keystone may have a group called 'developer' and IdP1 calls it 'Devs' - you create a mapping | 18:45 |
| samueldmq | rderose: in "" | 18:45 |
| rderose | samuelmq: responding now | 18:45 |
| samueldmq | rderose: nice | 18:46 |
| dstanek | that way when IdP2 calls it 'Engineers' you can just create a new mapping and keystone is IdP agnostic | 18:46 |
| shewless | +dstanek: okay I'll try and federate with my internal IDP and then I'll see about this mapping!! | 18:46 |
| dstanek | shewless: word of warning. you'll even after a successful auth through an IdP you'll get a 401 if the mappings don't match | 18:47 |
| *** yolanda has quit IRC | 18:48 | |
| *** nisha_ has quit IRC | 18:49 | |
| *** pgbridge has joined #openstack-keystone | 18:49 | |
| rderose | samueldmq: let me know if that makes sense | 18:50 |
| *** nisha_ has joined #openstack-keystone | 18:51 | |
| samueldmq | rderose: sure, looking in a bit, just finishing another review | 18:54 |
| rderose | samueldmq: cool | 18:55 |
| samueldmq | henrynash: you still around ? | 19:02 |
| *** alex_xu has quit IRC | 19:02 | |
| samueldmq | henrynash: had a question around ldap things ... nevermind I figured it out :) | 19:05 |
| samueldmq | henrynash: something related to options_name and ldap_filter | 19:05 |
| *** alex_xu has joined #openstack-keystone | 19:06 | |
| *** harlowja has quit IRC | 19:12 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add helper scripts for generating policy info https://review.openstack.org/321243 | 19:13 |
| samueldmq | rderose: replied | 19:15 |
| *** harlowja has joined #openstack-keystone | 19:15 | |
| rderose | samueldmq: yes, I added a default value utcnow() and doesn't work with sqlplus | 19:17 |
| dolphm | nonameentername: (in case you don't have scrollback) i said monday, but i think that was just when i came across the failure. this log was from the periodic stable mitaka build from last thursday: http://logs.openstack.org/periodic-stable/periodic-keystone-python27-db-mitaka/a445f52/console.html.gz | 19:19 |
| rderose | samueldmq: I tried to get a default date value to work, spent a lot of time on this | 19:20 |
| samueldmq | gyee: patch 325939 waiting for you to get approved | 19:20 |
| patchbot | samueldmq: https://review.openstack.org/#/c/325939/ - keystone - Honor ldap_filter on filtered group list | 19:20 |
| *** frontrunner has quit IRC | 19:21 | |
| samueldmq | rderose: how are you testing against the different rmdbs ? manually ? | 19:21 |
| rderose | tempest tests | 19:21 |
| *** gagehugo has joined #openstack-keystone | 19:21 | |
| samueldmq | rderose: ( I am asking because I don't know if we have a gate for sqlplus) | 19:21 |
| rderose | gates test postgres as well, right? | 19:22 |
| rderose | samueldmq ^ | 19:23 |
| samueldmq | rderose: I think so | 19:24 |
| samueldmq | rderose: did you see my other comment about not having expired column at all ? | 19:25 |
| *** rcernin has joined #openstack-keystone | 19:25 | |
| rderose | samueldmq: it's a good point. I think it's still convenient to have the flag. Can you live with changing the name to enabled? | 19:26 |
| samueldmq | rderose: yes I can, but that's something very easy to identify (only lattest is valid) | 19:27 |
| samueldmq | rderose: instead of querying enabled=True, query the latest, doesn't seem that complex | 19:27 |
| rderose | samueldmq: what if all password are expired? | 19:27 |
| samueldmq | rderose: we may get other's view on it too, I am not too hard on that | 19:27 |
| samueldmq | rderose: hmm, only last password is valid, and only if it has not expired (comparing with password_expires_days) | 19:28 |
| samueldmq | rderose: that can be done, but sure with enabled flag the logic seems much simpler, specially when querying | 19:29 |
| rderose | samueldmq: yeah, I'll give it some thought though | 19:29 |
| rderose | samueldmq: thx | 19:29 |
| samueldmq | rderose: sure | 19:30 |
| *** links has quit IRC | 19:31 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Improve policy sample generation testing https://review.openstack.org/327299 | 19:32 |
| gyee | samueldmq, yeah, 325939 looks good | 19:35 |
| *** gyee has quit IRC | 19:40 | |
| *** chris_hultin has left #openstack-keystone | 19:40 | |
| *** spzala has quit IRC | 19:46 | |
| *** sdake_ has joined #openstack-keystone | 19:47 | |
| *** sdake has quit IRC | 19:48 | |
| rcernin | ayoung, hi! Is it possible to use domain functionality to segment users, projects and rights assigned to each others. In keystone v3, is it possible to activate multi-identity ldap backend based on each domain created. | 19:49 |
| ayoung | rcernin, yes and yes | 19:49 |
| rcernin | ayoung, Keystone with APIv3 | 19:49 |
| rcernin | :-) | 19:49 |
| ayoung | rcernin, the devil is in the details, but yes | 19:50 |
| *** yolanda has joined #openstack-keystone | 19:50 | |
| rcernin | ayoung, yes and yes but we have an issue with configuring it, we think the issue lays in the policy.json, we get ERROR: openstack You are not authorized to perform the requested action: identity:list_domains (Disable debug mode to suppress these details.) (HTTP 403) | 19:51 |
| rcernin | :-) | 19:51 |
| ayoung | rcernin, Deja View. I was just looking at that this morning | 19:51 |
| rcernin | ayoung, do you have time with me or are you going to sleep soon :) | 19:51 |
| ayoung | rcernin, I'm too drunk to sleep. | 19:51 |
| rcernin | ayoung, yeah it's most likely it | 19:51 |
| ayoung | Just kidding | 19:51 |
| rcernin | :D | 19:51 |
| ayoung | its the middle of the afternoon here | 19:51 |
| rcernin | Its almost 10pm here, was waiting for you :-) | 19:52 |
| ayoung | still on Coffee, have not switch to alcohol yet | 19:52 |
| ayoung | rcernin, I'm on US East Coast time | 19:52 |
| rcernin | We are in Brno. | 19:52 |
| ayoung | and going to make more coffee | 19:52 |
| rcernin | Caffeine levels dropped? | 19:52 |
| *** nisha_ has quit IRC | 19:54 | |
| ayoung | rcernin, was talking about this with ebarrera this morning | 19:54 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users and deprecate driver backend https://review.openstack.org/323596 | 19:55 |
| rcernin | ayoung, yes! thats him, I am his colleague. And I am trying to help him as he is not online during night and I am and I know you are here. | 19:55 |
| ayoung | rcernin, so, what policy file are you using | 19:55 |
| ayoung | cloud samle? OSP7 which is Kilo, right? | 19:55 |
| rcernin | ayoung, /usr/share/keystone/policy.v3cloudsample.json | 19:55 |
| rcernin | ayoung, yes | 19:56 |
| ayoung | rcernin, Horizon lacked support for Domain scoped tokens in Kilo | 19:56 |
| rcernin | ayoung, in the beginning we got a Newton since they downloaded the master branch but it's same with Kilo too. | 19:56 |
| ayoung | in Newton, I think Horizon has support for Domain scoped tokens | 19:57 |
| ayoung | which is what the cloud sample requires | 19:57 |
| ayoung | I think you want default policy for Kilo | 19:57 |
| rcernin | ayoung, well they have Kilo, but first they used github to download the policy.json but they got master branch, we told them to get it for kilo or /usr/share.. folder | 19:57 |
| ayoung | rcernin, this is for an internal deploy, I think it is OK to let any user do "list domains" | 19:57 |
| rcernin | ayoung, it doesn't work for them in CLI either | 19:58 |
| rcernin | ayoung, not just Horizon | 19:58 |
| rcernin | ayoung, we understand that Horizon lacked the support, maybe you told us already. But at least could we get it working in CLI? | 19:58 |
| samueldmq | rodrigods: do you have integration tests for federation mapping ? | 20:00 |
| ayoung | rcernin, the CLI with the policy you have right now needs a domain scoped token, not project. To do that, edit your RC file like this: | 20:00 |
| ayoung | unset OS_PROJECT_DOMAIN_NAME | 20:00 |
| ayoung | unset OS_PROJECT_NAME | 20:00 |
| ayoung | unset OS_PROJECT_DOMAIN_ID | 20:00 |
| ayoung | unset OS_PROJECT_ID | 20:00 |
| ayoung | OS_DOMAIN_NAME=Default | 20:01 |
| *** fawadkhaliq has quit IRC | 20:01 | |
| ayoung | and do openstack token issue | 20:01 |
| *** fawadkhaliq has joined #openstack-keystone | 20:01 | |
| ayoung | rcernin, of course, if the user does not have a role on the Default domain, they will not get a token | 20:01 |
| ayoung | so you might need to do | 20:01 |
| ayoung | openstack --os-cacert ~/.ossipee/deployments/ayoungosp8.oslab/ca.crt role add --user admin --domain Default admin | 20:02 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 20:04 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 20:04 |
| ayoung | rcernin, make sense? | 20:05 |
| rcernin | ayoung, whats difference between OS_USER_DOMAIN_NAME and OS_DOMAIN_NAME ? | 20:05 |
| rcernin | ayoung, I am checking the RC we have now. | 20:05 |
| *** fawadkhaliq has quit IRC | 20:05 | |
| rcernin | so I will have http://paste.openstack.org/show/509013/ | 20:06 |
| ayoung | rcernin, OS_USER_DOMAIN_NAME is the namespace for the user lookup. OS_DOMAIN_NAME says "scope this token to a domain named=X" | 20:06 |
| ayoung | rcernin, looks right, assuming the name is 'default' and not 'Default' | 20:07 |
| samueldmq | rodrigods: change 307508 is the one addressing both protocols and mappings right ? | 20:08 |
| rcernin | ayoung, could you look at https://access.redhat.com/solutions/2019453 | 20:08 |
| samueldmq | patch | 20:08 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users and deprecate driver backend https://review.openstack.org/323596 | 20:08 |
| samueldmq | patch 307508 | 20:08 |
| patchbot | samueldmq: https://review.openstack.org/#/c/307508/ - keystone - Add protocols integration tests | 20:08 |
| rcernin | ayoung, there is what we did. | 20:08 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 20:09 |
| *** amrith is now known as _amrith_ | 20:09 | |
| ayoung | rcernin, not fair to the other room users to post something that needs a RH login | 20:09 |
| rcernin | ok | 20:09 |
| rcernin | sorry | 20:09 |
| rcernin | I am sorry guys. can I pm you ? | 20:10 |
| ayoung | rcernin, nah, its ok | 20:11 |
| rcernin | Just ignore that :-) | 20:11 |
| ayoung | nothing private in that link but the paywall | 20:11 |
| rcernin | let's say I am drunk too. | 20:11 |
| rcernin | yeah :_( | 20:11 |
| ayoung | Heh | 20:11 |
| ayoung | I seee lots of CURL. Someone was reading my blog | 20:11 |
| *** pnavarro has quit IRC | 20:12 | |
| rcernin | 10% skill 20 percent curl :D | 20:12 |
| samueldmq | bknudson: rderose: dstanek: this is ayoung's patch I mentioned earlier about using python objects within keystone https://review.openstack.org/#/c/184651/ | 20:12 |
| patchbot | samueldmq: patch 184651 - keystone - IAM Models | 20:12 |
| ayoung | rcernin, so, try what I suggested. To do Domain operations using the v3cloud sample policyf file needs a domain scoped token. | 20:12 |
| ayoung | samueldmq, I miss that code. | 20:13 |
| rcernin | ayoung, will do thank you for you time. | 20:13 |
| ayoung | rcernin, anytime | 20:13 |
| rderose | samueldmq: cool, will look at later. thx for sharing this. | 20:14 |
| openstackgerrit | ayoung proposed openstack/keystone: IAM Models https://review.openstack.org/184651 | 20:14 |
| ayoung | samueldmq, running pep on that wshows everything that is wrong with our dev process. We are pedantic about code comments, but blaise about proper object oriented code | 20:16 |
| ayoung | Missing docstring in magic method | 20:16 |
| ayoung | Feh you should not need a docstring THERE! | 20:16 |
| ayoung | First line should be in imperative mood ('Determine', not 'Determines') | 20:16 |
| ayoung | how about "thou shalt not use dictionaries for thy domain model!" | 20:16 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 20:18 |
| notmorgan | ayoung: pep is a code style guide/linter | 20:18 |
| notmorgan | ayoung: it is NOT meant to address OO design | 20:18 |
| notmorgan | ayoung: show me static analysis that addresses OO design. | 20:18 |
| ayoung | notmorgan, the fact that we place more ephasis on pep8 messages than on the code itself. | 20:19 |
| notmorgan | no. | 20:19 |
| *** mvk has joined #openstack-keystone | 20:19 | |
| notmorgan | we can't automate oo design principles | 20:19 |
| ayoung | notmorgan, the rules of pep8 are, for the most part busy work | 20:19 |
| notmorgan | we automate the peices we do so that we have a consistent style | 20:20 |
| ayoung | they are random and I gives less than the gum I scraped off my shoe for them | 20:20 |
| notmorgan | have you ever stepped into a code base with no linting/style guides? it's awful | 20:20 |
| notmorgan | so block code that isn't formatted right, this is so you, the reviewer, does not need to worry about it | 20:20 |
| notmorgan | if the style is wrong but not caught by the linters - fix the linters or roll with it | 20:20 |
| ayoung | notmorgan, forcing comments into code or even that a comment has to be imperetive? | 20:21 |
| ayoung | Yeah. yeah... | 20:21 |
| ayoung | but WE don't care about it | 20:21 |
| notmorgan | so propose disabling that specific check:P | 20:21 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users and deprecate driver backend https://review.openstack.org/323596 | 20:21 |
| ayoung | that is what bothers me | 20:21 |
| ayoung | as a team. Hell, blame termie | 20:21 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users and deprecate driver backend https://review.openstack.org/323596 | 20:21 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 20:21 |
| notmorgan | *I* care about it. i care that the low bandwidth part of our dev process now (reviewers) is already overloaded | 20:21 |
| ayoung | blame me for not rewriting it back when I could get changes throutgh on this project without an act of congress | 20:21 |
| notmorgan | so if i don't need to look at style of code -- with a couple minor excpetions (i'll complain about for/else) | 20:22 |
| notmorgan | i am happy. i know the style is conforming to our accepted practices. | 20:22 |
| notmorgan | so i can focus on OO design bits when needed | 20:22 |
| ayoung | I think the latter is the true statement. I am mad at myself for tjhe places I "went along" insted of holding tru to my principals WRT codiong | 20:22 |
| ayoung | and now thins are way too set to make the change easily | 20:22 |
| ayoung | I'm annoyed about Domains still | 20:23 |
| ayoung | I'm annoyed that bug 968696n is still open | 20:23 |
| openstack | bug 968696 in Glance ""admin"-ness not properly scoped" [High,In progress] https://launchpad.net/bugs/968696 - Assigned to Sharat Sharma (sharat-sharma) | 20:23 |
| ayoung | and I'm annoyed that we are working on a system built around bearer tokens | 20:23 |
| bknudson | we need to do a reset and redesign | 20:24 |
| notmorgan | ayoung: i have been trying to lay framework for getting us out from under that, and you have too. | 20:24 |
| notmorgan | bknudson: keystone v4! and split auth! | 20:24 |
| bknudson | set priorities that get us where we want to be | 20:24 |
| ayoung | notmorgan, so..let me start by bringing that code back to life... | 20:24 |
| bknudson | seems like something we should be able to do as a core team | 20:24 |
| *** spzala has joined #openstack-keystone | 20:25 | |
| bknudson | rather than being at the whim of whatever specs are proposed | 20:25 |
| notmorgan | bknudson: agreed. i honestly think it's not too far out to get done. unfortunately..... | 20:25 |
| *** spzala has quit IRC | 20:26 | |
| *** spzala has joined #openstack-keystone | 20:26 | |
| notmorgan | it's still a lot of work. | 20:26 |
| *** thumpba has quit IRC | 20:27 | |
| bknudson | there's also a lot of overhead in the way we're working now, since there's a lack of focus. | 20:30 |
| *** henrynash_ has joined #openstack-keystone | 20:31 | |
| *** ChanServ sets mode: +v henrynash_ | 20:31 | |
| *** jbell8 has quit IRC | 20:31 | |
| dolphm | lbragstad: i just approved this, but i'd be eager to see a performance delta with your benchmarking work https://review.openstack.org/#/c/326234/ | 20:33 |
| patchbot | dolphm: patch 326234 - keystone - Revert to caching fernet tokens the same way we do... | 20:33 |
| lbragstad | dolphm sounds good - i'm getting there... working on the performance scheduler now (hoping to have something done by the end of the day) | 20:33 |
| notmorgan | bknudson: truth | 20:35 |
| *** devananda has quit IRC | 20:35 | |
| *** sheel has quit IRC | 20:35 | |
| ayoung | dstanek, so...I was trying to verbalize why I was so opposed to your middleware approach. I think if we do SAML in middleware, and you develop against Shib, it will elevate Shib to a higher degree of support than other Federation providers. I can't support that. | 20:36 |
| ayoung | And I don't want to provide preferential treatment for *any* specific Federation implementation if we can help it | 20:37 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 20:37 |
| ayoung | I'm already annoyed that DefCore defines shib compliance as a requirement | 20:37 |
| dolphm | ayoung: it does? | 20:39 |
| ayoung | dolphm, yes....the registrastion step would | 20:39 |
| dolphm | ayoung: in 2016.01? | 20:39 |
| ayoung | dolphm, defcore? | 20:39 |
| dolphm | ayoung: https://github.com/openstack/defcore/blob/master/2016.01.json ? | 20:39 |
| ayoung | dolphm, hmmmm, maybe it is compliance? | 20:40 |
| dolphm | ayoung: https://github.com/openstack/defcore/blob/master/2016.01.json#L2708 | 20:40 |
| ayoung | dolphm, I'll get the letter of the law | 20:40 |
| *** pushkaru has quit IRC | 20:40 | |
| dolphm | ayoung: i haven't gone deeper than that line | 20:40 |
| ayoung | maybe it is not defcore, but some agreement enforced by the Federation | 20:40 |
| *** chris_hultin has joined #openstack-keystone | 20:40 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 20:41 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users https://review.openstack.org/323596 | 20:43 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 20:43 |
| *** dave-mccowan has quit IRC | 20:44 | |
| *** spzala has quit IRC | 20:45 | |
| *** openstackgerrit has quit IRC | 20:48 | |
| *** openstackgerrit has joined #openstack-keystone | 20:48 | |
| dstanek | FTR, i hate shib | 20:49 |
| ayoung | dstanek, I have to admit, I've not touched it. I am not overly found of SAML in general | 20:50 |
| bknudson | ayoung: what's wrong with saml? | 20:50 |
| dstanek | bknudson: mostly the ml part | 20:50 |
| ayoung | bknudson, ask the Swift team if we could make them support SAML | 20:50 |
| ayoung | the amount of traffic required to do a simple auth is simply too high | 20:51 |
| bknudson | I imagine that would be a tough sell due to overhead | 20:51 |
| ayoung | and yet we have to support it. | 20:51 |
| bknudson | what would be swift's perfect system? | 20:52 |
| ayoung | so the end users still pay the price, just only when they talk to Keystone...and in doing so, we've broken the web | 20:52 |
| ayoung | we now support tokens, which are not HTTP | 20:52 |
| ayoung | I mean, they look like it, but you can't just hit a website, your browser can't do it | 20:52 |
| dstanek | when i read the saml spec i get the feeling that they kept saying "this isn't complicated enough. how do we add more features so that things are not interoperable?" | 20:52 |
| ayoung | dstanek, its because they are doing at the HTTP layer stuff that really should be done at the network layer | 20:53 |
| ayoung | https client cert is really the only way I can see Web AuthN making any sort of sense in an efficient manner | 20:53 |
| ayoung | SAML is like a short term certificate that you get via redirects | 20:53 |
| notmyname | ayoung: bknudson: /me doesn't know anything about SAML, so couldn't tell you what swift's view on it is | 20:54 |
| ayoung | hold SAML and X509 side by side, and squint, and you can see the family resemblance | 20:54 |
| dstanek | ayoung: oauth is http and still simple | 20:54 |
| ayoung | notmyname, I know based on how they threw a fit over PKI tokens | 20:54 |
| ayoung | dstanek, and still broken | 20:54 |
| notmyname | ayoung: yeah, and those were terrible ;-) | 20:54 |
| dstanek | "once everyone hates the protocol we can consider it feature complete" | 20:55 |
| *** gyee has joined #openstack-keystone | 20:55 | |
| *** ChanServ sets mode: +v gyee | 20:55 | |
| ayoung | notmyname, again, because I was trying to work within the restrictiones set by using Keystone | 20:55 |
| ayoung | Really, there are two secure ways to authenticate over the network. Kerberso and X509 Client cert. And Kerberos requires HTTPS. So, if you want a singel authZ mechanism, use X509 | 20:56 |
| *** roxanaghe has joined #openstack-keystone | 20:56 | |
| ayoung | But, the world has decided it is too complicated | 20:56 |
| bknudson | so we're stuck with web forms | 20:56 |
| ayoung | bknudson, so SAML is better than handing your password direct to some random application | 20:57 |
| ayoung | But, again, there are many better ways to do that, too. | 20:57 |
| ayoung | OK...so, lets deal with dstanek 's real issue. Lets assume you got the middleware to work, and then the time came to write an API for adding a new IdP | 20:58 |
| ayoung | that is the point that we have a nightmare on our hands | 20:58 |
| dstanek | whoa...how'd i get dragged into this :-) | 20:59 |
| ayoung | dstanek, you are writing the SAML middleware | 20:59 |
| *** dave-mccowan has joined #openstack-keystone | 21:00 | |
| ayoung | dstanek, the Kent folks had that in their POC 4 years ago. | 21:00 |
| *** lhcheng has quit IRC | 21:00 | |
| dstanek | ayoung: saml outside of shib? | 21:00 |
| *** gagehugo has quit IRC | 21:00 | |
| ayoung | dstanek, I don't know what they used for an IdP, but the SAML processing was done inside Keystone, not via an Apache module | 21:01 |
| ayoung | I'm, assumigmn they used whatever the University of Kent had as an IdP | 21:01 |
| dstanek | ayoung: do you have any links? i know that they often didn't use our tooling | 21:01 |
| *** sdake_ has quit IRC | 21:01 | |
| ayoung | dstanek, its irrelevant. THe code is so different from what they proposed, | 21:02 |
| dstanek | the work they did that i am familiar with is using mod_shib and that IdP federation that consists of many universities | 21:02 |
| samueldmq | dstanek: fyi: added you as a reviwer to patch 323596 (what we were discussing with rderose earlier) | 21:02 |
| patchbot | samueldmq: https://review.openstack.org/#/c/323596/ - keystone - Refactor shadow users | 21:02 |
| dstanek | samueldmq: yay! | 21:02 |
| ayoung | it is the registration of KEystone as a SP that is the hard problem to solve | 21:02 |
| ayoung | dstanek, prior to that | 21:02 |
| ayoung | https://kar.kent.ac.uk/43212/ | 21:03 |
| ayoung | http://www.slideshare.net/openstack/federatedaccessopenstackpdf | 21:03 |
| *** julim has quit IRC | 21:04 | |
| *** lhcheng has joined #openstack-keystone | 21:05 | |
| *** ChanServ sets mode: +v lhcheng | 21:05 | |
| rodrigods | samueldmq, ^ right | 21:05 |
| dstanek | ayoung: oh my, the abc talks to the cs backed by the cdc and watched by the fbi | 21:05 |
| dstanek | i don't think i'd be smart enough to go to kent | 21:05 |
| rodrigods | samueldmq, mappings: https://review.openstack.org/#/c/305444/ protocols: https://review.openstack.org/#/c/307508/10 | 21:05 |
| patchbot | rodrigods: patch 305444 - keystone - Add mapping rules integration tests | 21:05 |
| patchbot | rodrigods: patch 307508 - keystone - Add protocols integration tests | 21:05 |
| *** chlong has joined #openstack-keystone | 21:06 | |
| ayoung | https://www.youtube.com/watch?v=H_aiDDU5z18 | 21:06 |
| *** edtubill has quit IRC | 21:06 | |
| dstanek | lol, did they leave off steps to make it harder? | 21:06 |
| *** jbell8 has joined #openstack-keystone | 21:07 | |
| dstanek | ayoung: it's been a while since i have seen that movie | 21:07 |
| ayoung | dstanek, so are you going to go ahead with writing the SAML middleware piece? | 21:07 |
| dstanek | ayoung: yeah, i have the acs flow working. i don't see a better option right now. | 21:08 |
| ayoung | dstanek, so, I know you can make that part work. Its the follow on that worries me. | 21:09 |
| samueldmq | rodrigods: thanks | 21:09 |
| dstanek | ayoung: me too | 21:09 |
| ayoung | dstanek, I'm a little worried about doing the crypto in python inside mod_wsgi, but I can see ways to mitigate that. Its the registration of the Identity provider that we need to focus on. | 21:10 |
| ayoung | dstanek, lets say you were in my position, where the apache config was pretty much a requirement. | 21:10 |
| dstanek | ayoung: yeah the default implementation actually shells out which isn't great | 21:10 |
| ayoung | we can take the tool that talks to Ipsilon, merge it with the Keycloak one to have a generic SAML IDP registration tool. It would still be a configuration piece, though | 21:11 |
| ayoung | and calling that from an API would be tricky | 21:11 |
| ayoung | especially once you consider HA etc | 21:11 |
| ayoung | OTOH, we need something that also does OpenIDC. | 21:12 |
| dstanek | ayoung: i need to take some time to install and understand Ipsilon | 21:12 |
| ayoung | So...the question is, are we going to turn Keystone into ADFS | 21:12 |
| ayoung | dstanek, I have an ansible role I can share with you for that | 21:13 |
| dstanek | ayoung: that would be great | 21:13 |
| ayoung | dstanek, credit goes to jamielennox for writing it... link in a sec | 21:13 |
| ayoung | https://github.com/admiyo/rippowam/blob/master/roles/ipsilonserver/tasks/main.yml | 21:13 |
| ayoung | so, we used FreeIPA and supported Kerberos (GSSAPI) | 21:14 |
| *** diazjf has joined #openstack-keystone | 21:14 | |
| ayoung | dstanek, it has a UI for registering a new remote SP, too, I think | 21:14 |
| *** ametts has quit IRC | 21:14 | |
| ayoung | Have not run it in a while...might still have one somewhere... | 21:15 |
| ayoung | dstanek, nah, disabled it in Rippowam as I was working on Keycloak. | 21:16 |
| dstanek | that's a good start though | 21:16 |
| ayoung | hmmm. I wonder if I can just in stall that role...let me try | 21:16 |
| ayoung | dstanek, I might be able to set one up on Dreamhost | 21:19 |
| ayoung | https://ipa.younglogic.net/idp | 21:19 |
| ayoung | Yay! | 21:19 |
| ayoung | OK, let me see if I have passwords | 21:19 |
| bknudson | ayoung: you mean your client cert, right? | 21:20 |
| ayoung | bknudson, I mean Kerberos passwords, actually | 21:23 |
| ayoung | dstanek, let me see if I can grant you access... | 21:23 |
| *** mvk_ has joined #openstack-keystone | 21:25 | |
| *** jsifantu has quit IRC | 21:27 | |
| *** diazjf has quit IRC | 21:28 | |
| *** mvk has quit IRC | 21:28 | |
| notmorgan | lbragstad: found a bug in our token provider. also untested code path(s) | 21:29 |
| lbragstad | notmorgan sweet | 21:29 |
| notmorgan | lbragstad: https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L243 | 21:30 |
| notmorgan | lbragstad: "providers.common" is not exported via __all__ or in __init__ in keystone.token.providers | 21:30 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 21:30 |
| notmorgan | you must explciitly import common *or* expose it via __init__ and __all__ | 21:30 |
| *** lifeless_ is now known as lifeless | 21:30 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 21:30 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 21:31 |
| notmorgan | lbragstad: so we're either randomly erroring and it hasn't been reported or we're not ever hitting that | 21:31 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/325589 | 21:31 |
| notmorgan | lbragstad: which means... we should ditch it | 21:31 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 21:31 |
| *** tonytan4ever has quit IRC | 21:31 | |
| notmorgan | lbragstad: would you mind poking at that and/or fixing it? | 21:32 |
| lbragstad | notmorgan when i'm done with the performance work i will | 21:32 |
| * notmorgan is looking at how hard it will be to fix the awfulness of multiple token paths. | 21:32 | |
| notmorgan | i think i have another possibility to fix the things with some minor restructureing. | 21:33 |
| *** diazjf has joined #openstack-keystone | 21:35 | |
| *** rk4n has joined #openstack-keystone | 21:37 | |
| *** jbell8 has quit IRC | 21:41 | |
| notmorgan | lbragstad: found another bug =/ | 21:45 |
| notmorgan | lbragstad: it's again, mostly "correctness" but this is in the fernet formatter selector | 21:45 |
| notmorgan | lbragstad: basically a fall through case that is possibly wrong | 21:46 |
| notmorgan | in a for loop. | 21:46 |
| *** pauloewerton has quit IRC | 21:48 | |
| lbragstad | notmorgan i think that stuff is based on order? | 21:49 |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: fix ldap delete_user group member cleanup https://review.openstack.org/327358 | 21:49 |
| *** sdake has joined #openstack-keystone | 21:49 | |
| notmorgan | right, so if nothing happens with reate_arguments_apply you fall through to the last payload thing always | 21:50 |
| notmorgan | lbragstad: in the list | 21:50 |
| notmorgan | create_arguments_apply* | 21:51 |
| *** diazjf has quit IRC | 21:51 | |
| notmorgan | becuase of the way the for-loop works. ideally we should assert a correct version vs. just relying that the order "makes sense" and falls through correctly | 21:51 |
| lbragstad | that makes sense | 21:52 |
| notmorgan | so whatever is last in PAYLOAD_CLASSES is the "default" - it would be better to set an explicit default, and if create_arguments_apply matches, we override/break | 21:52 |
| notmorgan | or if we don't set one that matches, raise a proper error vs an opaque (potentially) 500 error | 21:52 |
| notmorgan | lbragstad: having some space from the token subsystem makes this a lot easier to identify errors :P | 21:53 |
| openstackgerrit | Merged openstack/python-keystoneclient: Handle EmptyCatalog exception in list federated projects https://review.openstack.org/243153 | 21:53 |
| *** rcernin is now known as rcernin|off | 21:54 | |
| *** sdake has quit IRC | 21:54 | |
| notmorgan | lbragstad: so a quick way to align validation - move unpack/pack into the main provider's ._get_token_id passthrough/.get_token_data, and then "store" the fernet payload adjacent to the body of the uuid so we can just call the reconstruction code paths, and strip that extra data if the "pull from db body" uuid prodiver is used. | 21:55 |
| *** r-daneel has joined #openstack-keystone | 21:55 | |
| *** sdake has joined #openstack-keystone | 21:55 | |
| lbragstad | ok | 21:56 |
| notmorgan | lbragstad: so simply do token_body = { _body: {<today's body>}, 'fernet_payload': <payload> } in the db. | 21:56 |
| lbragstad | is that going to break on upgrade? | 21:56 |
| notmorgan | lbragstad: nah. it would break on downgrade | 21:56 |
| lbragstad | you're talking about storing uuid tokens like that? | 21:56 |
| notmorgan | lbragstad: basically we'd just switch/case if sql_result.has_key('fernet_payload') or ('_body') | 21:57 |
| notmorgan | we can validate either way: reconstruct/pull from the db directly | 21:57 |
| notmorgan | and not pass the other data around. | 21:57 |
| notmorgan | it means you wont be able to use <new> keystone [newton] issuing tokens for pre-newton keystones | 21:58 |
| notmorgan | but if the SQL result doesn't have either value in the db column, we just take the serialized version as-is | 21:58 |
| notmorgan | so it looks like: | 21:58 |
| notmorgan | sql-query => body | 21:58 |
| notmorgan | json.loads(body) | 21:58 |
| notmorgan | if '<new key>' not in loaded_json: validate(loaded_json). | 21:59 |
| lbragstad | but if you get a token from newton keystone and try to validate it against a pre-newton keystone it will break, right? | 21:59 |
| notmorgan | in uuid yes. | 21:59 |
| notmorgan | in fernet no | 22:00 |
| notmorgan | fernet stays the same | 22:00 |
| notmorgan | you need the new simple switch/case thing to know what part of the token stored in the db to take. | 22:00 |
| notmorgan | the other alternative would be to extend the schema to have a fernet_payload | 22:01 |
| notmorgan | *shrug* it's just brutal to migrate the token table | 22:02 |
| * notmorgan doesn't really care. | 22:02 | |
| lbragstad | notmorgan true | 22:02 |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: fix ldap delete_user group member cleanup https://review.openstack.org/327358 | 22:02 |
| notmorgan | lbragstad: i'd be fine with simply doing another token table columnb | 22:03 |
| notmorgan | i was looking for a no-sql-migrate options | 22:03 |
| lbragstad | notmorgan yeah - i'm fine with that | 22:04 |
| *** jorge_munoz has quit IRC | 22:04 | |
| notmorgan | lbragstad: so the patch sets i'm going to propose: pass the unpack/pack through the main provider interface | 22:05 |
| notmorgan | lbragstad: make "validate_non-persistent_token" something more like "validate_reconstruct_token" | 22:05 |
| notmorgan | lbragstad: and then rework so we can switch on "reconstruct" from uuid or not with the same fernet formatters. | 22:06 |
| notmorgan | lbragstad: i'll decide if i want to migrate a column in or not. | 22:06 |
| lbragstad | ok | 22:06 |
| lbragstad | notmorgan i wanted to start working on a patch to pull all token token formatter logic in to the controllers | 22:06 |
| notmorgan | lbragstad: controller? | 22:07 |
| lbragstad | er - out of the token provider | 22:07 |
| notmorgan | uhm | 22:07 |
| notmorgan | you mean v2 vs v3 format? | 22:07 |
| lbragstad | yes | 22:07 |
| notmorgan | ah ok. | 22:07 |
| notmorgan | yeah lets not do that until we validate tokens the same way [most of the time] | 22:07 |
| lbragstad | the if statements for all the stuff makes my head spin | 22:08 |
| notmorgan | if we simply finish the "always a v3 token" then v3->v2 | 22:08 |
| notmorgan | for "body" transformation | 22:08 |
| notmorgan | i think we're good. | 22:08 |
| notmorgan | but lets fix the way we validate first. | 22:08 |
| *** henrynash_ has quit IRC | 22:11 | |
| *** rcernin|off has quit IRC | 22:21 | |
| *** edmondsw has quit IRC | 22:37 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:44 | |
| *** gordc has quit IRC | 22:44 | |
| samueldmq | rderose: I like 'Drop Support for Driver Versioning' | 22:46 |
| *** woodburn1 has joined #openstack-keystone | 22:46 | |
| samueldmq | rderose: I always thought it was something hard to maintain; let's see what feedback we get from operators, and if we can drop it, deprecate and remove later :) | 22:47 |
| *** lhcheng has quit IRC | 22:48 | |
| *** woodburn has quit IRC | 22:48 | |
| *** yolanda has quit IRC | 22:55 | |
| *** lhcheng has joined #openstack-keystone | 22:55 | |
| *** ChanServ sets mode: +v lhcheng | 22:55 | |
| *** KevinE has quit IRC | 22:59 | |
| *** markvoelker has quit IRC | 23:13 | |
| *** lhcheng has quit IRC | 23:14 | |
| *** lhcheng has joined #openstack-keystone | 23:15 | |
| *** ChanServ sets mode: +v lhcheng | 23:15 | |
| *** rk4n has quit IRC | 23:15 | |
| *** dan_nguyen has quit IRC | 23:16 | |
| *** fawadkhaliq has quit IRC | 23:17 | |
| *** fawadkhaliq has joined #openstack-keystone | 23:18 | |
| *** fawadkhaliq has quit IRC | 23:21 | |
| *** pgbridge has quit IRC | 23:26 | |
| *** timcline has quit IRC | 23:28 | |
| rderose | samueldmq: thanks, appreciate that. yeah, curious to see what feedback we'll get. I have hard time believing that folks would actually upgrade with changing and testing their custom drivers. | 23:28 |
| *** timcline has joined #openstack-keystone | 23:28 | |
| *** lhcheng has quit IRC | 23:31 | |
| *** dan_nguyen has joined #openstack-keystone | 23:31 | |
| *** lhcheng has joined #openstack-keystone | 23:31 | |
| *** ChanServ sets mode: +v lhcheng | 23:31 | |
| *** timcline has quit IRC | 23:33 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 23:35 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 23:35 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/325589 | 23:35 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/326918 | 23:35 |
| *** lhcheng has quit IRC | 23:40 | |
| *** markvoelker has joined #openstack-keystone | 23:44 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Use http_proxy_to_wsgi from oslo.middleware https://review.openstack.org/327418 | 23:46 |
| *** markvoelker has quit IRC | 23:49 | |
| rderose | samueldmq: * without changing and testing their custom drivers | 23:49 |
| *** iurygregory_ has joined #openstack-keystone | 23:50 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Use http_proxy_to_wsgi from oslo.middleware https://review.openstack.org/327418 | 23:51 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!