| *** Dave has quit IRC | 00:00 | |
| *** shoutm has joined #openstack-keystone | 00:04 | |
| *** tonytan4ever has joined #openstack-keystone | 00:11 | |
| *** bknudson has joined #openstack-keystone | 00:13 | |
| *** ChanServ sets mode: +v bknudson | 00:13 | |
| *** bknudson has left #openstack-keystone | 00:14 | |
| *** code-R has joined #openstack-keystone | 00:16 | |
| *** code-R_ has joined #openstack-keystone | 00:17 | |
| *** code-R has quit IRC | 00:20 | |
| *** david-lyle_ has joined #openstack-keystone | 00:22 | |
| *** david-lyle_ has quit IRC | 00:27 | |
| *** korean101 has quit IRC | 00:53 | |
| *** chlong has quit IRC | 00:54 | |
| *** spandhe has quit IRC | 00:56 | |
| *** chlong has joined #openstack-keystone | 01:11 | |
| *** chlong is now known as chlong_POffice | 01:21 | |
| *** tqtran has joined #openstack-keystone | 01:36 | |
| *** tqtran has quit IRC | 01:40 | |
| *** davechen has joined #openstack-keystone | 01:46 | |
| *** code-R_ has quit IRC | 01:53 | |
| *** david-lyle_ has joined #openstack-keystone | 02:25 | |
| *** TxGVNN has joined #openstack-keystone | 02:25 | |
| *** david-lyle_ has quit IRC | 02:29 | |
| *** lamt has joined #openstack-keystone | 02:37 | |
| *** code-R has joined #openstack-keystone | 02:43 | |
| *** code-R has quit IRC | 02:43 | |
| *** code-R has joined #openstack-keystone | 02:44 | |
| *** GB21 has quit IRC | 02:45 | |
| *** code-R_ has joined #openstack-keystone | 02:53 | |
| *** code-R has quit IRC | 02:56 | |
| *** __zouyee has joined #openstack-keystone | 02:57 | |
| openstackgerrit | Merged openstack/keystone: Added cache for id mapping manager https://review.openstack.org/328820 | 02:59 |
|---|---|---|
| *** __zouyee has quit IRC | 03:00 | |
| *** patchbot has quit IRC | 03:01 | |
| *** EinstCrazy has joined #openstack-keystone | 03:14 | |
| *** nkinder has quit IRC | 03:15 | |
| *** EinstCrazy has quit IRC | 03:25 | |
| openstackgerrit | Merged openstack/keystone: Add schema validation to create role https://review.openstack.org/345700 | 03:26 |
| *** code-R_ has quit IRC | 03:27 | |
| *** code-R has joined #openstack-keystone | 03:33 | |
| *** nkinder has joined #openstack-keystone | 03:35 | |
| *** davechen has quit IRC | 03:43 | |
| *** nkinder has quit IRC | 03:47 | |
| *** patchbot has joined #openstack-keystone | 04:02 | |
| *** GB21 has joined #openstack-keystone | 04:15 | |
| *** tsufiev has quit IRC | 04:15 | |
| *** tsufiev has joined #openstack-keystone | 04:17 | |
| *** david-lyle_ has joined #openstack-keystone | 04:26 | |
| *** david-lyle_ has quit IRC | 04:32 | |
| *** GB21 has quit IRC | 04:32 | |
| *** notmyname has quit IRC | 04:36 | |
| *** code-R has quit IRC | 04:37 | |
| *** code-R has joined #openstack-keystone | 04:38 | |
| *** fifieldt has joined #openstack-keystone | 04:47 | |
| *** roxanaghe has joined #openstack-keystone | 04:48 | |
| *** roxanaghe has quit IRC | 04:48 | |
| *** notmyname has joined #openstack-keystone | 04:48 | |
| *** dikonoor has joined #openstack-keystone | 04:52 | |
| *** code-R has quit IRC | 04:56 | |
| *** code-R has joined #openstack-keystone | 04:56 | |
| *** spandhe has joined #openstack-keystone | 05:05 | |
| *** GB21 has joined #openstack-keystone | 05:08 | |
| openstackgerrit | Merged openstack/keystone: Use freezegun to increment clock in test_v3_assignment https://review.openstack.org/343860 | 05:10 |
| *** GB21 has quit IRC | 05:16 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: Add schema validation to v2 create tenant https://review.openstack.org/346594 | 05:26 |
| *** GB21 has joined #openstack-keystone | 05:29 | |
| *** sheel has joined #openstack-keystone | 05:35 | |
| *** tqtran has joined #openstack-keystone | 05:37 | |
| *** spandhe has quit IRC | 05:38 | |
| *** tqtran has quit IRC | 05:42 | |
| *** davechen has joined #openstack-keystone | 05:46 | |
| *** EinstCrazy has joined #openstack-keystone | 05:47 | |
| *** davechen has quit IRC | 05:48 | |
| *** roxanaghe has joined #openstack-keystone | 05:49 | |
| *** tonytan4ever has quit IRC | 05:50 | |
| *** roxanaghe has quit IRC | 05:53 | |
| *** EinstCrazy has quit IRC | 06:00 | |
| *** spandhe has joined #openstack-keystone | 06:03 | |
| *** rcernin has joined #openstack-keystone | 06:05 | |
| *** itisha has joined #openstack-keystone | 06:07 | |
| *** NishaYadav has joined #openstack-keystone | 06:07 | |
| *** NishaYadav is now known as Guest78107 | 06:08 | |
| *** code-R has quit IRC | 06:09 | |
| *** code-R has joined #openstack-keystone | 06:16 | |
| *** Guest78107 has quit IRC | 06:17 | |
| *** nisha_ has joined #openstack-keystone | 06:17 | |
| *** nisha__ has joined #openstack-keystone | 06:20 | |
| *** nisha__ has quit IRC | 06:20 | |
| *** nisha_ has quit IRC | 06:20 | |
| *** jed56 has joined #openstack-keystone | 06:23 | |
| *** spandhe has quit IRC | 06:24 | |
| *** spandhe has joined #openstack-keystone | 06:25 | |
| *** david-lyle_ has joined #openstack-keystone | 06:29 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add endpoint functional tests https://review.openstack.org/340418 | 06:32 |
| *** david-lyle_ has quit IRC | 06:33 | |
| *** code-R_ has joined #openstack-keystone | 06:36 | |
| *** pcaruana has joined #openstack-keystone | 06:37 | |
| *** davechen has joined #openstack-keystone | 06:39 | |
| *** code-R has quit IRC | 06:39 | |
| *** tesseract- has joined #openstack-keystone | 06:41 | |
| *** code-R_ has quit IRC | 06:43 | |
| *** code-R has joined #openstack-keystone | 06:43 | |
| *** tonytan4ever has joined #openstack-keystone | 06:50 | |
| *** spandhe has quit IRC | 06:54 | |
| *** tonytan4ever has quit IRC | 06:55 | |
| *** code-R has quit IRC | 07:09 | |
| *** GB21 has quit IRC | 07:39 | |
| *** Dave has joined #openstack-keystone | 07:46 | |
| openstackgerrit | Swapnil Kulkarni (coolsvap) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 07:50 |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** nishaYadav has joined #openstack-keystone | 08:01 | |
| *** GB21 has joined #openstack-keystone | 08:04 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** Gorian has quit IRC | 08:11 | |
| *** Gorian has joined #openstack-keystone | 08:12 | |
| *** EinstCrazy has joined #openstack-keystone | 08:12 | |
| * nishaYadav waves hello o/ | 08:14 | |
| *** nishaYadav has quit IRC | 08:25 | |
| *** nishaYadav has joined #openstack-keystone | 08:26 | |
| *** nishaYadav is now known as Guest31397 | 08:26 | |
| *** EinstCra_ has joined #openstack-keystone | 08:29 | |
| *** david-lyle_ has joined #openstack-keystone | 08:31 | |
| *** EinstCrazy has quit IRC | 08:31 | |
| *** EinstCra_ has quit IRC | 08:34 | |
| *** david-lyle_ has quit IRC | 08:36 | |
| *** tqtran has joined #openstack-keystone | 08:39 | |
| *** EinstCrazy has joined #openstack-keystone | 08:43 | |
| *** tqtran has quit IRC | 08:43 | |
| *** tonytan4ever has joined #openstack-keystone | 08:52 | |
| *** tonytan4ever has quit IRC | 08:56 | |
| *** amakarov has joined #openstack-keystone | 09:07 | |
| *** mvk has quit IRC | 09:27 | |
| *** Guest31397 is now known as nishaYadav | 09:28 | |
| *** alex_xu has quit IRC | 09:31 | |
| *** david-lyle_ has joined #openstack-keystone | 09:32 | |
| *** alex_xu has joined #openstack-keystone | 09:34 | |
| *** GB21 has quit IRC | 09:34 | |
| *** david-lyle_ has quit IRC | 09:36 | |
| *** TxGVNN has quit IRC | 09:38 | |
| openstackgerrit | Dinesh Bhor proposed openstack/keystone: Replace OpenStack LLC with OpenStack Foundation https://review.openstack.org/346675 | 09:39 |
| *** kswiatek has joined #openstack-keystone | 09:43 | |
| *** kaszkiet has joined #openstack-keystone | 09:44 | |
| *** TxGVNN has joined #openstack-keystone | 09:44 | |
| *** GB21 has joined #openstack-keystone | 09:46 | |
| *** davechen has left #openstack-keystone | 09:47 | |
| kswiatek | hi, I need help with devstack, maybe you could help me :) | 09:48 |
| kswiatek | I have devstack on my vm, 2 deafult users and one I created (admin, demo, xaxa) | 09:48 |
| kswiatek | when i create instance as admin, as non-admin user when i type: nova list --all-tenants I see instances created by admin | 09:50 |
| kswiatek | no matter which user/project I use | 09:50 |
| kswiatek | any idea where can be problem? i use devstack from master branch | 09:50 |
| *** hwcomcn has joined #openstack-keystone | 09:50 | |
| *** hwcomcn has quit IRC | 09:51 | |
| *** hwcomcn has joined #openstack-keystone | 09:52 | |
| *** hwcomcn has quit IRC | 09:55 | |
| *** hwcomcn has joined #openstack-keystone | 09:58 | |
| *** mvk has joined #openstack-keystone | 10:00 | |
| *** hwcomcn has quit IRC | 10:03 | |
| *** nishaYadav has quit IRC | 10:04 | |
| *** hwcomcn has joined #openstack-keystone | 10:04 | |
| *** hwcomcn has quit IRC | 10:05 | |
| *** hwcomcn has joined #openstack-keystone | 10:06 | |
| *** nishaYadav has joined #openstack-keystone | 10:14 | |
| *** nishaYadav is now known as Guest37032 | 10:14 | |
| *** Guest37032 is now known as nisha_ | 10:18 | |
| *** EinstCrazy has quit IRC | 10:36 | |
| *** tqtran has joined #openstack-keystone | 10:41 | |
| *** tqtran has quit IRC | 10:45 | |
| *** nisha_ has quit IRC | 10:46 | |
| *** nisha_ has joined #openstack-keystone | 10:57 | |
| *** nisha__ has joined #openstack-keystone | 11:16 | |
| *** nisha_ has quit IRC | 11:17 | |
| *** nisha__ has quit IRC | 11:18 | |
| *** TxGVNN has quit IRC | 11:21 | |
| *** gordc has joined #openstack-keystone | 11:27 | |
| *** nishaYadav has joined #openstack-keystone | 11:31 | |
| *** nishaYadav is now known as Guest65955 | 11:32 | |
| *** david-lyle_ has joined #openstack-keystone | 11:34 | |
| *** Guest65955 is now known as nisha_ | 11:34 | |
| *** david-lyle_ has quit IRC | 11:39 | |
| *** rodrigods has quit IRC | 11:47 | |
| *** rodrigods has joined #openstack-keystone | 11:47 | |
| *** sdake has joined #openstack-keystone | 11:54 | |
| *** edmondsw has joined #openstack-keystone | 11:59 | |
| *** mvk has quit IRC | 12:02 | |
| *** Guest32906 is now known as flaper87 | 12:10 | |
| *** flaper87 has quit IRC | 12:10 | |
| *** flaper87 has joined #openstack-keystone | 12:10 | |
| *** raildo has joined #openstack-keystone | 12:11 | |
| *** d0ugal_ is now known as d0ugal | 12:17 | |
| *** d0ugal has quit IRC | 12:17 | |
| *** d0ugal has joined #openstack-keystone | 12:17 | |
| *** mvk has joined #openstack-keystone | 12:17 | |
| *** iurygregory has joined #openstack-keystone | 12:22 | |
| *** tonytan4ever has joined #openstack-keystone | 12:24 | |
| *** tonytan4ever has quit IRC | 12:28 | |
| *** tangchen has joined #openstack-keystone | 12:29 | |
| *** GB21 has quit IRC | 12:32 | |
| *** GB21 has joined #openstack-keystone | 12:35 | |
| openstackgerrit | Tang Chen proposed openstack/keystoneauth: Use assertEqual() instead of assertDictEqual() https://review.openstack.org/346743 | 12:36 |
| *** pauloewerton has joined #openstack-keystone | 12:37 | |
| *** sheel has quit IRC | 12:46 | |
| *** GB21 has quit IRC | 12:52 | |
| *** aurelien__ has joined #openstack-keystone | 12:54 | |
| *** jsavak has joined #openstack-keystone | 12:56 | |
| *** Trident has quit IRC | 13:08 | |
| *** bknudson has joined #openstack-keystone | 13:18 | |
| *** ChanServ sets mode: +v bknudson | 13:18 | |
| *** thiagolib has quit IRC | 13:18 | |
| *** woodster_ has joined #openstack-keystone | 13:19 | |
| *** jaugustine_ has joined #openstack-keystone | 13:27 | |
| *** tonytan4ever has joined #openstack-keystone | 13:30 | |
| *** julim has joined #openstack-keystone | 13:31 | |
| *** ayoung has joined #openstack-keystone | 13:32 | |
| *** ChanServ sets mode: +v ayoung | 13:32 | |
| *** david-lyle_ has joined #openstack-keystone | 13:36 | |
| *** david-lyle_ has quit IRC | 13:41 | |
| *** jaugustine_ has quit IRC | 13:43 | |
| *** tqtran has joined #openstack-keystone | 13:43 | |
| *** jaugustine_ has joined #openstack-keystone | 13:44 | |
| *** sdake_ has joined #openstack-keystone | 13:45 | |
| *** sdake has quit IRC | 13:45 | |
| *** nk2527 has quit IRC | 13:46 | |
| *** nk2527 has joined #openstack-keystone | 13:47 | |
| *** tqtran has quit IRC | 13:47 | |
| *** danpawlik has joined #openstack-keystone | 13:50 | |
| *** gordc has quit IRC | 13:52 | |
| *** BjoernT has joined #openstack-keystone | 13:55 | |
| *** richm has joined #openstack-keystone | 13:58 | |
| *** code-R has joined #openstack-keystone | 14:00 | |
| *** hwcomcn has quit IRC | 14:04 | |
| *** tonytan_brb has joined #openstack-keystone | 14:04 | |
| *** jaugustine_ has quit IRC | 14:06 | |
| *** tonytan4ever has quit IRC | 14:06 | |
| *** code-R_ has joined #openstack-keystone | 14:08 | |
| *** code-R_ has quit IRC | 14:09 | |
| *** ravelar159 has joined #openstack-keystone | 14:10 | |
| *** code-R_ has joined #openstack-keystone | 14:10 | |
| *** code-R has quit IRC | 14:14 | |
| *** pblaho has joined #openstack-keystone | 14:16 | |
| ayoung | pblaho, welcome! | 14:18 |
| pblaho | ayoung: hi and thank you | 14:18 |
| ayoung | pblaho, so you are tackling v3 everywhere, right? | 14:18 |
| pblaho | ayoung: yeah :-) | 14:19 |
| ayoung | pblaho, we worked through it last summer using a Packstack install and then post-configuration using Ansible | 14:19 |
| pblaho | and I do not understand some things how keystone do | 14:19 |
| *** gordc has joined #openstack-keystone | 14:20 | |
| ayoung | pblaho, what has confused you so far? | 14:20 |
| pblaho | ayoung: I do not understand how policies from policy.json are checked | 14:21 |
| ayoung | pblaho, ah...ok | 14:21 |
| ayoung | pblaho, that is kindof separate from calling via v3. | 14:21 |
| pblaho | ayoung: I have an env installed using tripleo-quickstart and enabled keystone v3 ... hopefully correctly | 14:21 |
| pblaho | ayoung: aha... | 14:22 |
| *** jaugustine has joined #openstack-keystone | 14:22 | |
| ayoung | a policy check happens when the server calls it, not from middleware. So, say I do openstack server create, all of the middleware code from keystonemiddleware happens, and then, somewhere in the nova code, it explicitly calls the policy check. It is not automated, and is something that each of the services needs to implement | 14:22 |
| ayoung | so, keystone's v3 api is always enabled | 14:22 |
| ayoung | you would have to work pretty hard to disable it, so you probably are set there | 14:23 |
| ayoung | to confirm, from your undercloud, you can do | 14:23 |
| ayoung | . ./overcloudrc | 14:23 |
| *** code-R has joined #openstack-keystone | 14:23 | |
| ayoung | look at the OS_AUTH_URL env var | 14:24 |
| *** catintheroof has joined #openstack-keystone | 14:24 | |
| ayoung | and chop off the /v2.0 | 14:24 |
| ayoung | or, better yet, use this hack: | 14:24 |
| ayoung | pblaho, http://adam.younglogic.com/2016/03/v3fromv2/ | 14:24 |
| * ayoung should update that with the logic to clear old envvars | 14:24 | |
| *** code-R has quit IRC | 14:25 | |
| *** mvk has quit IRC | 14:25 | |
| *** code-R has joined #openstack-keystone | 14:25 | |
| *** code-R_ has quit IRC | 14:26 | |
| ayoung | pblaho, I'd put this at the top of the generated file... | 14:26 |
| ayoung | for key in `set | grep -E '^OS_'` ; do unset $key ; done | 14:26 |
| *** mvk has joined #openstack-keystone | 14:26 | |
| pblaho | ayoung: nice script... | 14:28 |
| *** gordc has quit IRC | 14:28 | |
| *** roxanaghe has joined #openstack-keystone | 14:28 | |
| *** gordc has joined #openstack-keystone | 14:29 | |
| ayoung | pblaho, and...as I look at it, and try to code from my blog editing software, I realize that the "clear the environment" line needs to go after | 14:29 |
| ayoung | NEW_OS_AUTH_URL=`echo $OS_AUTH_URL | sed 's!v2.0!v3!'` | 14:30 |
| * ayoung just updated blog... | 14:30 | |
| ayoung | doh | 14:30 |
| * ayoung needs more coffee | 14:30 | |
| *** GB21 has joined #openstack-keystone | 14:30 | |
| *** michauds has joined #openstack-keystone | 14:30 | |
| *** clenimar has joined #openstack-keystone | 14:32 | |
| ayoung | ok...anyway, once you have a workable v3 rc file, run openstack token issue and you should get a token | 14:32 |
| ayoung | make sure the OS_AUTH_URL ends in v3 | 14:33 |
| *** roxanaghe has quit IRC | 14:33 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: Retry revocation on MySQL deadlock https://review.openstack.org/344924 | 14:33 |
| SamYaple | ayoung: isnt swift the only thing that still requires OS_AUTH_URL to end in v3? | 14:34 |
| ayoung | SamYaple, depends | 14:34 |
| SamYaple | i thought the goal was versionless for that variable | 14:34 |
| ayoung | SamYaple, yes, but discovery is a whole 'nother level | 14:35 |
| ayoung | SamYaple, http://adam.younglogic.com/2016/07/bypassing-discovery-keystoneauth1/ | 14:35 |
| SamYaple | new blog post? this month? i guess ill give it a read | 14:36 |
| ayoung | SamYaple, Heh | 14:36 |
| stevemar | o/ | 14:36 |
| pblaho | ayoung: is OS_PROJECT_DOMAIN_NAME and OS_PROJECT_NAME required in the rc file? | 14:36 |
| ayoung | pblaho, yes | 14:36 |
| ayoung | pblaho, ok...here's a short primer | 14:36 |
| ayoung | keystone uses tokens, which are a short cookie that points to auth data. When you get a token, or when a service validates it, the auth data might be scoped to something, or might be unscoped | 14:37 |
| ayoung | the scope is almost always a project | 14:37 |
| ayoung | to uniquely identify a project, you either can use the OS_PROJECT_ID env var, or you can use the name. But the name is only unique within its doamin, so you need to set both OS_PROJECT_DOMAIN_NAME and OS_PROJECT_NAME | 14:38 |
| pblaho | ayoung: ok... | 14:39 |
| ayoung | the same is true of the user; either you can set just the OS_USER_ID, or you can set OS_USER_DOMAIN_NAME and OS_USERNAME | 14:39 |
| pblaho | ayoung: what to do if I have user who is admin for domain but do not have admin role for any project inside that domain? | 14:39 |
| SamYaple | ayoung: openstack stack is just hacks upon hacks as it turns out. | 14:39 |
| ayoung | SamYaple, that is why the Keystone Mascot is a Turtle | 14:40 |
| ayoung | "it is Turtles all the way down." | 14:40 |
| SamYaple | i get it | 14:40 |
| ayoung | http://www.zazzle.com/its_turtles_all_the_way_down_coffee_mug-168755893561171603 | 14:40 |
| SamYaple | keystone v4 will fix it all im sure. well just switch to RFC1149 for exchanging fernet keys | 14:41 |
| *** BjoernT has quit IRC | 14:41 | |
| *** slberger has joined #openstack-keystone | 14:42 | |
| * ayoung googles RFC1149 | 14:42 | |
| ayoung | SamYaple, I think we were going to bring back Kite to rotate keys. right stevemar ? | 14:44 |
| stevemar | kite is dead, we'll need a new time | 14:45 |
| SamYaple | I hear storms can also cause data loss with that method, too | 14:45 |
| stevemar | name* | 14:45 |
| ayoung | pblaho, anyway, you should have V3 enabled. Assuming you do, and can get a token, the real question is how to make all of the other services | 14:45 |
| ayoung | stevemar, but it is the best way to get keys into the cloud? | 14:45 |
| stevemar | barbican absorbed kite - didn't it? | 14:46 |
| ayoung | stevemar, I think it is so ironic that we spent all that time on Kite, realized it was a mismatch for the requirement, killed it, and now have the perfect use case for it. | 14:46 |
| SamYaple | ayoung: i would think a rocket would be the best way, that names not taken right? maybe rkt for short? | 14:46 |
| stevemar | ha | 14:47 |
| ayoung | SamYaple, actually, I would like it to be a Keystone to Keystone REST call, so no new project, based on PKI | 14:47 |
| ayoung | use a PKCS11 file to transmit it | 14:47 |
| ayoung | But Keystone replica's don't know about each other, and making them know about each other is not part of the plan | 14:48 |
| *** tonytan_brb has quit IRC | 14:48 | |
| *** tonytan4ever has joined #openstack-keystone | 14:49 | |
| pblaho | ayoung: I am not sure I understand it at all :-) | 14:49 |
| pblaho | ayoung: http://paste.openstack.org/show/541611/ | 14:49 |
| pblaho | ayoung: since line 20 in new terminal | 14:50 |
| *** code-R_ has joined #openstack-keystone | 14:50 | |
| ayoung | pblaho, try openstack token issue | 14:50 |
| SamYaple | oh theres a token issue alright | 14:50 |
| ayoung | SamYaple, ha | 14:50 |
| SamYaple | enough puns. i gots work todo | 14:51 |
| ayoung | pblaho, OK, so that is the policy issue | 14:51 |
| pblaho | ayoung: http://paste.openstack.org/show/541612/ | 14:51 |
| pblaho | ayoung: I use this policy file - https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json | 14:51 |
| ayoung | pblaho, doing a project show with the name means it has to do a list to resolve the name. And the policy must be wonky. let me see.... | 14:51 |
| pblaho | ayoung: ok, I will try it with project id | 14:52 |
| *** code-R has quit IRC | 14:52 | |
| *** code-R_ has quit IRC | 14:52 | |
| ayoung | pblaho, ah...did Tripleo switch over to the v3 cloud sample policy file? | 14:52 |
| ayoung | "identity:list_projects": "rule:cloud_admin or rule:admin_and_matching_domain_id", | 14:52 |
| *** code-R has joined #openstack-keystone | 14:53 | |
| ayoung | that rule implies that you have a domain scoped token....I'm still not 100% happy with cloudsample.... | 14:53 |
| ayoung | "cloud_admin": "role:admin and (token.is_admin_project:True or domain_id:admin_domain_id)", | 14:53 |
| ayoung | hmmmmm | 14:53 |
| pblaho | ayoung: I will paste my current policy file in a minute.... | 14:54 |
| pblaho | ayoung: http://paste.openstack.org/show/541613/ | 14:55 |
| ayoung | "identity:list_projects": "rule:cloud_admin or rule:admin_and_matching_domain_id", | 14:55 |
| ayoung | yeah...same thing. | 14:55 |
| ayoung | make that a member rule, I think | 14:55 |
| ayoung | what do we do for default oplicy | 14:55 |
| pblaho | ayoung: ok, openstack project show ID works... | 14:55 |
| ayoung | cool | 14:56 |
| pblaho | ayoung: so every time I use names instead of IDs it will make a call to get a list of objects? and so it needs proper rights? | 14:56 |
| ayoung | pblaho, yep | 14:57 |
| pblaho | ayoung: and what do you mean by making it member rule? | 14:58 |
| ayoung | pblaho, I mean a rule that any member of a project should be able to make. Not your job to do, though. I need to take another pass at policy at some point and figure out what these really should be. | 14:58 |
| ayoung | pblaho, maybe what it should be is that openstack project show with no parameters should just use the current project id, but ...I'll fugyre that out later | 14:59 |
| *** rcernin has quit IRC | 15:00 | |
| pblaho | ayoung: I have another question... openstack project list --user adm1 should show me projects that user has rights to? | 15:00 |
| ayoung | pblaho, sounds right | 15:01 |
| ayoung | pblaho, again, policy might interfere | 15:01 |
| *** tonytan_brb has joined #openstack-keystone | 15:01 | |
| pblaho | ayoung: yeah, again with ID works, not with username :-) | 15:01 |
| *** spandhe has joined #openstack-keystone | 15:02 | |
| *** jsavak has quit IRC | 15:03 | |
| *** KevinE has joined #openstack-keystone | 15:03 | |
| *** tonytan4ever has quit IRC | 15:04 | |
| *** KevinE has quit IRC | 15:04 | |
| ayoung | pblaho, ok, so back to v3 everywhere.... | 15:04 |
| *** KevinE has joined #openstack-keystone | 15:04 | |
| ayoung | the big thing is the config files for Nova etc having an updated auth_token section | 15:05 |
| ayoung | I know that EmilienM did a lot of work along these lines | 15:05 |
| pblaho | ayoung: I am not sure what do you mean by v3 everywhere.... | 15:05 |
| ayoung | pblaho, replacing the points in server to server communication where authentication was using v2 to use v3, so we can make things domain aware | 15:06 |
| pblaho | ayoung: b/c I am not working on getting TripleO to have keystone v3 everywhere... I am now doing some integration with ManageIQ project | 15:06 |
| ayoung | for example... | 15:06 |
| ayoung | https://github.com/admiyo/rippowam/blob/master/roles/packstack/tasks/serviceauth.yml | 15:06 |
| *** jsavak has joined #openstack-keystone | 15:06 | |
| *** spandhe has quit IRC | 15:08 | |
| ayoung | pblaho, Oh | 15:08 |
| ayoung | pblaho, that makes sense. The same general issues apply, though | 15:09 |
| pblaho | ayoung: I am not sure what info you got :-) | 15:09 |
| ayoung | pblaho, I glazed right over the CFME part of the message. | 15:09 |
| pblaho | ayoung: haha | 15:10 |
| pblaho | ayoung: I am glad that you take time and helped me... | 15:10 |
| pblaho | ayoung: and be sure that I will ping you in the future w/r/t anything keystone related :-) | 15:10 |
| ayoung | pblaho, I focused on the part that said "Petr has started concentrating on some of the keystone v3 integration work" | 15:10 |
| pblaho | ayoung: oh, I see... | 15:11 |
| *** shoutm has quit IRC | 15:11 | |
| ayoung | pblaho, my understanding is that CFME is pretty much going to focus on one project for a deployment | 15:11 |
| pblaho | ayoung: there is work to have domain support for openstack overcloud | 15:12 |
| ayoung | so you should not need to expose project_list, but do you need user_list? If so, we might need to work on the default policy to be nicer | 15:12 |
| ayoung | pblaho, ok...what are the requirements? | 15:12 |
| pblaho | ayoung: not usre exactly now... | 15:12 |
| ayoung | pblaho, Status Quo, then.. | 15:13 |
| pblaho | ayoung: I was solving one bug with getting project list into CFME and during that I found out that these policies are not exactly flawless :-) | 15:13 |
| ayoung | pblaho, they are very conservative | 15:14 |
| pblaho | ayoung: if I will get more info on what is needed w/r/t policies I will let you know | 15:14 |
| *** pgbridge has joined #openstack-keystone | 15:20 | |
| *** nisha_ has quit IRC | 15:24 | |
| *** nisha_ has joined #openstack-keystone | 15:25 | |
| *** pcaruana has quit IRC | 15:26 | |
| *** jgarza has joined #openstack-keystone | 15:27 | |
| *** roxanaghe has joined #openstack-keystone | 15:29 | |
| jgarza | Created a domain, project, user and assigned the role to the user in the project. Sourced the user file but I still cannot list users in the project cause it says it requires authentication even though the user is admin? | 15:31 |
| ayoung | jgarza, heh...you just missed that discussion | 15:33 |
| *** dave-mccowan has joined #openstack-keystone | 15:33 | |
| *** roxanaghe has quit IRC | 15:33 | |
| jgarza | ayoung, nooooooooo | 15:34 |
| ayoung | jgarza, one sec, I'll get you the evesdrop link | 15:34 |
| ayoung | jgarza, around http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2016-07-25.log.html#t2016-07-25T14:52:33 | 15:34 |
| jgarza | ayoung, I am new. Just trying to learn how to operate keystone. I don't know where exactly the token stuff comes in. | 15:34 |
| jgarza | ayoung, but I setup the fernet token provider and ran the fernet_setup | 15:35 |
| *** nisha_ has quit IRC | 15:35 | |
| ayoung | jgarza, w00t! Ship it! | 15:36 |
| jgarza | ayoung, ha yeah just stumbling around devstack | 15:36 |
| *** david-lyle_ has joined #openstack-keystone | 15:37 | |
| *** gyee has joined #openstack-keystone | 15:39 | |
| *** ChanServ sets mode: +v gyee | 15:39 | |
| *** code-R has quit IRC | 15:39 | |
| *** aurelien__ has quit IRC | 15:40 | |
| *** david-lyle_ has quit IRC | 15:43 | |
| *** adrian_otto has joined #openstack-keystone | 15:45 | |
| *** sdake has joined #openstack-keystone | 15:46 | |
| *** browne has joined #openstack-keystone | 15:47 | |
| *** sdake_ has quit IRC | 15:49 | |
| *** slberger has quit IRC | 15:53 | |
| *** aastha has joined #openstack-keystone | 15:55 | |
| *** slberger has joined #openstack-keystone | 15:56 | |
| *** samueldmq has joined #openstack-keystone | 15:56 | |
| *** ChanServ sets mode: +v samueldmq | 15:56 | |
| samueldmq | hey keystone | 15:57 |
| *** KevinE has quit IRC | 15:58 | |
| stevemar | ahoy samueldmq | 15:58 |
| jgarza | does anyone know the openstack command to move a project to a certain domain? It seems to automatically end up in Default domain | 15:59 |
| bknudson | samueldmq made it back | 15:59 |
| bknudson | or are you still in u.s.? | 15:59 |
| stevemar | jgarza: when you create there is an option to set the domain, same with the "set" command | 15:59 |
| samueldmq | stevemar: hey | 15:59 |
| jgarza | stevemar thanks! | 15:59 |
| stevemar | jgarza: make sure you are using v3 of the API with OSC (set OS_IDENTITY_API_VERSION to 3) | 15:59 |
| samueldmq | bknudson: I am back, got to home last night | 16:00 |
| samueldmq | bknudson: (finally) | 16:00 |
| stevemar | samueldmq: you need to take it easy today :) | 16:00 |
| stevemar | bknudson: you're online and able to chat :O | 16:00 |
| samueldmq | stevemar: yeah indeed, just wanted to say hello and see if nisha needed anything :) | 16:01 |
| bknudson | stevemar: don't tell my manager | 16:03 |
| samueldmq | haha | 16:03 |
| *** jsavak has quit IRC | 16:06 | |
| *** jsavak has joined #openstack-keystone | 16:07 | |
| dstanek | samueldmq: how long was the return trip? | 16:07 |
| bknudson | jamielennox|away: please take a look at https://review.openstack.org/#/c/343694/ (another proposal in nova for the oslo.context change) | 16:08 |
| patchbot | bknudson: patch 343694 - nova - Prepare context tests for new to_dict() attributes | 16:08 |
| jgarza | stevemar, I can use project set --name to change the name of the project but when I use project set --domain to set the domain it should belong to it says doesn't exist :/ | 16:09 |
| samueldmq | dstanek: from hotel to home (home) it was around 33 hours | 16:09 |
| *** nishaYadav has joined #openstack-keystone | 16:09 | |
| samueldmq | home (sweet home)* | 16:09 |
| samueldmq | :) | 16:09 |
| lbragstad | samueldmq damn | 16:09 |
| lbragstad | samueldmq glad you had a safe trip | 16:09 |
| samueldmq | lbragstad: thanks :) | 16:10 |
| nishaYadav | samueldmq, hey, nice to see you :) | 16:10 |
| samueldmq | yes, too long, I will need a few days to recover completly | 16:10 |
| samueldmq | nishaYadav: hey hey, how are you? | 16:10 |
| nishaYadav | samueldmq, I am good, registered for this nick | 16:10 |
| nishaYadav | thanks | 16:11 |
| stevemar | jgarza: can you also pass in `--os-identity-api-version 3` | 16:12 |
| samueldmq | nishaYadav: nice you now have a registered nickname | 16:13 |
| jgarza | stevemar, still claiming devstack project demo doesn't exist. Exported the v3 lines as well. | 16:14 |
| *** dave-mccowan has quit IRC | 16:14 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Skip middleware request processing for admin token https://review.openstack.org/344496 | 16:14 |
| *** code-R has joined #openstack-keystone | 16:15 | |
| jgarza | stevemar, it's weird. I can run every other project set command on any project. But when I run it with --domain 'Name' it can't find the project all of a sudden | 16:15 |
| stevemar | jgarza: paste the output here: http://paste.openstack.org/ and share? you can pass in --debug to give lots of info | 16:15 |
| stevemar | jgarza: ohhh, wait a tick. i think i remember this bug | 16:16 |
| stevemar | jgarza: the --domain argument there is for finding projects that are non-default. we don't allow moving projects to other domains :( | 16:16 |
| jgarza | stevemar, ahhh I see then. thanks that saved me so much time ha | 16:17 |
| stevemar | jgarza: https://github.com/openstack/python-openstackclient/commit/66931c6931ee39cc58159d3823b46ad225f39ec8 | 16:17 |
| *** code-R_ has joined #openstack-keystone | 16:18 | |
| *** TxGVNN has joined #openstack-keystone | 16:19 | |
| *** code-R has quit IRC | 16:20 | |
| *** tesseract- has quit IRC | 16:21 | |
| *** david-lyle_ has joined #openstack-keystone | 16:35 | |
| *** samueldmq has quit IRC | 16:36 | |
| *** GB21 has quit IRC | 16:41 | |
| *** dan_nguyen has joined #openstack-keystone | 16:42 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 16:47 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 16:47 |
| *** roxanaghe has joined #openstack-keystone | 16:48 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Re-target unified delegations to O https://review.openstack.org/346942 | 16:49 |
| rderose | stevemar jamielennox: the last day of the midcycle, we talked about including LDAP in the lockout requirements for PCI | 16:50 |
| *** haplo37__ has joined #openstack-keystone | 16:50 | |
| rderose | stevemar jamielennox: however, thinking about this some more, I don't think we should do that | 16:51 |
| rderose | stevemar jamielennox: LDAP (like AD) already have their own lockout policies | 16:51 |
| rderose | stevemar jamielennox: so it would be redundant. Therefore, I think it only makes sense for the SQL backend. | 16:52 |
| rderose | stevemar jamielennox: let me know if you disagree | 16:52 |
| *** roxanaghe has quit IRC | 16:52 | |
| *** tqtran has joined #openstack-keystone | 16:54 | |
| bknudson | rderose: I agree. LDAP servers typically already support lockout. | 16:55 |
| bknudson | I wasn't invited to the discussion. | 16:55 |
| rderose | cool, thanks bknudson, I'll keep it as is (only supporting SQL backend) | 16:56 |
| bknudson | same is true for all the other PCI requirements, I think? | 16:57 |
| bknudson | also, not just LDAP but also users coming in through federation | 16:58 |
| *** karthikb has joined #openstack-keystone | 16:59 | |
| rderose | bknudson: true, most PCI is only supported by the SQL backend | 16:59 |
| rderose | bknudson: the exceptions are validating password strength. If this feature is turned on, it will validate all password updates (manager level) | 17:00 |
| *** david-lyle_ has quit IRC | 17:01 | |
| rderose | bknudson: And disabling inactive users also is supported by all identities (federated, LDAP, SQL, custom...) | 17:01 |
| rderose | bknudson: everything else is SQL backend only | 17:01 |
| *** nkinder has joined #openstack-keystone | 17:01 | |
| *** david-lyle_ has joined #openstack-keystone | 17:07 | |
| *** mvk has quit IRC | 17:12 | |
| *** karthikb has quit IRC | 17:14 | |
| *** roxanaghe has joined #openstack-keystone | 17:14 | |
| *** pcaruana has joined #openstack-keystone | 17:23 | |
| *** gordc has quit IRC | 17:26 | |
| *** dikonoor has quit IRC | 17:31 | |
| *** tonytan_brb is now known as tonytan4ever | 17:33 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add schema validation to create service in v2 https://review.openstack.org/346962 | 17:33 |
| *** spandhe has joined #openstack-keystone | 17:35 | |
| *** Gorian_ has joined #openstack-keystone | 17:40 | |
| bknudson | my opinion is that password strength should be handled by sql driver too since LDAP already implements it. | 17:41 |
| *** sdake has quit IRC | 17:41 | |
| *** harlowja has joined #openstack-keystone | 17:43 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Fix v2-ext API enabled documentation https://review.openstack.org/346965 | 17:45 |
| *** pgbridge has quit IRC | 17:46 | |
| *** jgarza has quit IRC | 17:48 | |
| *** ravelar159 has quit IRC | 17:49 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add rolling upgrade steps to keystone-manage https://review.openstack.org/337680 | 17:51 |
| *** KevinE has joined #openstack-keystone | 17:51 | |
| henrynash | rderose, stevemar, jammielennox: on PCI for other backends, I think there was a request from at least one customer who want to be able to lock out (an LDAP) user form keystone, but not to lock them out of all corporate systems | 17:56 |
| *** david-lyle has quit IRC | 17:57 | |
| *** david-lyle_ is now known as david-lyle | 17:57 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Fix v2-ext API enabled documentation https://review.openstack.org/346965 | 17:57 |
| rderose | bknudson: ^ henrynash | 17:59 |
| bknudson | rderose: that sounds like having a disabled option for shadow users. | 18:01 |
| rderose | henrynash: oh I see, hmm... | 18:01 |
| bknudson | locked out because of invalid password attempts? | 18:01 |
| rderose | bknudson henrynash: yeah, locked out because too many failed auth attempts | 18:02 |
| *** nk2527 has quit IRC | 18:02 | |
| bknudson | seems like something you would want implemented in your idp rather than requiring every application to re-implement. | 18:02 |
| rderose | bknudson: I think henrynash is saying to set this for LDAP, so that the user is locked out of keystone, but not an LDAP lockout where the user would be locked out of all corporate systems | 18:03 |
| henrynash | rederose: ++ | 18:03 |
| henrynash | rederose: I'm not syaing that we should definitely do this...but that we have certainly seen this request from a customer.... | 18:04 |
| bknudson | yes, the idp (LDAP in this example) would know what the application is that's using it for authentication and be able to lock out by application. | 18:04 |
| bknudson | rather than requiring keystone and outlook, etc., to implement a lock-out feature. | 18:04 |
| rderose | bknudson: so with lockout policy for LDAP, you can configure lockout by application? | 18:05 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Fix v2-ext API enabled documentation https://review.openstack.org/346965 | 18:05 |
| henrynash | bknudson: that's certainly an option - although could you do that with LDAP? I guess you could remove it from the keystone group or something (whcih is probably how LDAP might permission a given user for keystone) | 18:05 |
| bknudson | nothing stops you from doing that in an LDAP server. | 18:05 |
| bknudson | LDAP is a protocol | 18:05 |
| rderose | bknudson: right, I guess I'm thinking more of AD | 18:06 |
| bknudson | (and the LDAP protocol doesn't even have authorization) | 18:06 |
| rderose | bknudson: and other common LDAP identity stores | 18:07 |
| bknudson | I don't know. But the user could just as well ask them to add a feature as ask us. | 18:08 |
| bknudson | it would be more useful to everybody if the LDAP server had the feature. | 18:08 |
| rderose | bknudson: yeah, good point | 18:08 |
| *** gordc has joined #openstack-keystone | 18:08 | |
| *** adrian_otto has quit IRC | 18:11 | |
| *** jaugustine_ has joined #openstack-keystone | 18:16 | |
| *** jaugustine_ has quit IRC | 18:18 | |
| stevemar | rderose: henrynash bknudson catching up | 18:22 |
| stevemar | rderose: bknudson henrynash do any ADs have that feature? how would it know where the request is coming from (keystone vs outlook) ? | 18:24 |
| bknudson | I heard at the keystone meetup that it's really easy to set up an LDAP server, so if you have a separate LDAP server for keystone you can handle it there. | 18:26 |
| henrynash | bknudson: not sure that is what most corporate directory manages would like....another LDAP/AD which they have to sync and maintain? | 18:28 |
| *** ayoung has quit IRC | 18:30 | |
| bknudson | this was in the context of adding more info to ldap (assignments) | 18:30 |
| *** ravelar159 has joined #openstack-keystone | 18:34 | |
| *** nishaYadav has quit IRC | 18:34 | |
| *** nk2527 has joined #openstack-keystone | 18:36 | |
| *** roxanagh_ has joined #openstack-keystone | 18:36 | |
| *** ravelar159 has quit IRC | 18:38 | |
| *** roxanagh_ has quit IRC | 18:41 | |
| *** michauds has quit IRC | 18:42 | |
| *** spandhe has quit IRC | 18:43 | |
| *** julim has quit IRC | 18:43 | |
| *** sdake has joined #openstack-keystone | 18:44 | |
| *** julim has joined #openstack-keystone | 18:45 | |
| *** ravelar159 has joined #openstack-keystone | 18:47 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make AuthWithTrust testable against uuid and fernet https://review.openstack.org/345686 | 18:52 |
| *** michauds has joined #openstack-keystone | 18:58 | |
| *** ksavich has joined #openstack-keystone | 19:00 | |
| *** slberger has quit IRC | 19:02 | |
| *** TxGVNN has quit IRC | 19:02 | |
| *** jsavak has quit IRC | 19:05 | |
| *** EinstCrazy has joined #openstack-keystone | 19:05 | |
| *** fifieldt has quit IRC | 19:05 | |
| *** ksavich has quit IRC | 19:05 | |
| *** EinstCrazy has quit IRC | 19:10 | |
| *** EinstCrazy has joined #openstack-keystone | 19:14 | |
| *** EinstCrazy has quit IRC | 19:15 | |
| *** slberger has joined #openstack-keystone | 19:18 | |
| *** fifieldt has joined #openstack-keystone | 19:18 | |
| *** ddieterly has joined #openstack-keystone | 19:19 | |
| *** chlong_POffice has quit IRC | 19:30 | |
| *** chlong_POffice has joined #openstack-keystone | 19:31 | |
| *** spandhe has joined #openstack-keystone | 19:33 | |
| *** code-R_ has quit IRC | 19:33 | |
| *** jsavak has joined #openstack-keystone | 19:34 | |
| *** ddieterly is now known as ddieterly[away] | 19:36 | |
| *** roxanagh_ has joined #openstack-keystone | 19:37 | |
| *** ddieterly[away] is now known as ddieterly | 19:38 | |
| *** roxanagh_ has quit IRC | 19:41 | |
| *** code-R has joined #openstack-keystone | 19:44 | |
| *** jsavak has quit IRC | 19:54 | |
| *** jsavak has joined #openstack-keystone | 19:54 | |
| *** pgbridge has joined #openstack-keystone | 19:54 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 19:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Allow V2TestCase to be tested against fernet and uuid https://review.openstack.org/345687 | 19:58 |
| *** gyee has quit IRC | 20:01 | |
| *** jsavak has quit IRC | 20:03 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password expires validation https://review.openstack.org/333360 | 20:06 |
| *** slberger has quit IRC | 20:07 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password expires validation https://review.openstack.org/333360 | 20:08 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add schema validation to create service in v2 https://review.openstack.org/346962 | 20:08 |
| *** slberger has joined #openstack-keystone | 20:09 | |
| *** ddieterly is now known as ddieterly[away] | 20:12 | |
| *** ddieterly[away] is now known as ddieterly | 20:12 | |
| *** ddieterly is now known as ddieterly[away] | 20:13 | |
| *** ravelar159 has quit IRC | 20:13 | |
| *** sdake has quit IRC | 20:16 | |
| *** jsavak has joined #openstack-keystone | 20:16 | |
| *** ravelar159 has joined #openstack-keystone | 20:17 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add schema validation to create service in v2 https://review.openstack.org/346962 | 20:21 |
| *** ddieterly[away] is now known as ddieterly | 20:34 | |
| browne | should a v3 token ever include the service catalog in v2 format? | 20:35 |
| browne | i ask because that's what i'm seeing in an environment. v3 token with v2 service catalog | 20:36 |
| *** roxanagh_ has joined #openstack-keystone | 20:37 | |
| bknudson | v3 token should never include the service catalog in v2 format. | 20:38 |
| *** raildo has quit IRC | 20:39 | |
| browne | crap | 20:39 |
| browne | http://paste.openstack.org/raw/541647/ | 20:40 |
| bknudson | that is messed up. | 20:40 |
| browne | this is stable/mitaka. not sure the root cause yet | 20:41 |
| browne | but results in this bug: https://bugs.launchpad.net/keystonemiddleware/+bug/1605355 | 20:41 |
| openstack | Launchpad bug 1605355 in keystonemiddleware "TypeError: string indices must be integers" [Undecided,New] | 20:41 |
| *** roxanagh_ has quit IRC | 20:42 | |
| *** isd has joined #openstack-keystone | 20:46 | |
| isd | Hey all. I'm trying to integrate keystonemiddleware into an existing service. I think I've got things mostly rigged up correctly, but the middleware is trying to connect to keystone via https, despite having explicitly specified http: as the scheme in auth_url. https is obviously desirable for production, but for development on my local machine I'd like to be able to avoid messing with certs; is there a way to force pla | 20:50 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 20:52 |
| *** gyee has joined #openstack-keystone | 20:53 | |
| *** ChanServ sets mode: +v gyee | 20:53 | |
| *** jsavak has quit IRC | 20:56 | |
| *** chlong_POffice has quit IRC | 20:56 | |
| *** jsavak has joined #openstack-keystone | 20:56 | |
| lbragstad | jamielennox|away I have a few questions on the views stuff | 21:00 |
| lbragstad | jamielennox|away leaving them as comments on your review | 21:01 |
| lbragstad | jamielennox|away but I have a feeling I'll need to sit down with you to fully grasp them | 21:01 |
| lbragstad | jamielennox|away ping me whenever you read them and have time to visit about them? | 21:01 |
| *** gyee has quit IRC | 21:03 | |
| *** haplo37__ has quit IRC | 21:03 | |
| *** chlong_POffice has joined #openstack-keystone | 21:09 | |
| *** itisha has quit IRC | 21:10 | |
| *** mvk has joined #openstack-keystone | 21:15 | |
| *** gagehugo has joined #openstack-keystone | 21:17 | |
| isd | Is there a reference somewhere for the config options that keystonemiddleware recognizes? I can't even find that. | 21:17 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 21:19 |
| *** julim has quit IRC | 21:20 | |
| bknudson | isd: from http://docs.openstack.org/ , there's a link to "Services and Libraries", which has a link for keystonemiddleware, which has a link to "Middlware Architecture" which has a section on configuration | 21:21 |
| bknudson | http://docs.openstack.org/developer/keystonemiddleware/middlewarearchitecture.html#configuration | 21:21 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 21:21 |
| isd | bknudson: thanks. | 21:23 |
| notmorgan | oooh how was the midcycle? | 21:33 |
| notmorgan | stevemar: ^ | 21:33 |
| bknudson | we all were missing notmorgan | 21:33 |
| lbragstad | notmorgan it was good | 21:33 |
| notmorgan | bknudson: aw, sorry I couldn't make it | 21:33 |
| notmorgan | but ftr, I feel quite relaxed with less travel :) | 21:34 |
| * notmorgan has to be in SF tomorrow though | 21:34 | |
| notmorgan | and my flight is PDX -> SEA -> SFO *blink* | 21:34 |
| bknudson | trying to get more miles. | 21:35 |
| openstackgerrit | Ron De Rose proposed openstack/keystone-specs: Add rolling upgrade steps to keystone-manage https://review.openstack.org/337680 | 21:35 |
| notmorgan | lol | 21:35 |
| notmorgan | nah, i don't expect to collect another 18k miles this year | 21:35 |
| notmorgan | so no platinum status next year | 21:35 |
| notmorgan | #ohwell | 21:35 |
| notmorgan | but not being on a plane is nice. | 21:36 |
| notmorgan | I'd take a train to SF, but that is a LONG train ride | 21:36 |
| bknudson | as long as it's comfy | 21:36 |
| stevemar | lol @ PDX -> SEA -> SFO | 21:37 |
| notmorgan | plane is like 4hrs w/ layover | 21:37 |
| notmorgan | train is like 19hr | 21:37 |
| notmorgan | yeah i'll take 4hr | 21:37 |
| stevemar | notmorgan: midcycle was nice | 21:38 |
| stevemar | just writing up my recap | 21:38 |
| notmorgan | did cburgess get yall setup with a good location too? | 21:38 |
| lbragstad | notmorgan yep - it was nice | 21:39 |
| notmorgan | i know it wasn't the merakai offices but... | 21:39 |
| cburgess | notmorgan I think that depends on who you ask. Most folks seemed to find it adequate. | 21:39 |
| notmorgan | i hear cisco has nice offices | 21:39 |
| cburgess | Some yes | 21:39 |
| bknudson | we've definitely had worse. | 21:40 |
| bknudson | not sure if we've had anything especially better | 21:40 |
| bknudson | I enjoyed the midcycles in san antonio but for some reason the wireless never works. | 21:41 |
| *** jsavak has quit IRC | 21:42 | |
| *** spandhe has quit IRC | 21:42 | |
| *** Gorian_ has quit IRC | 21:45 | |
| *** adrian_otto has joined #openstack-keystone | 21:46 | |
| *** josdotso has joined #openstack-keystone | 21:48 | |
| josdotso | Hi folks. Trying to better understand auth plugins. Right now, I'm struggling to get auth-type v3oidcpassword working using CLI of python-openstackclient. I have many questions -- but the most pressing is this: Suppose I perfect my syntax for v3oidcpassword on $(openstack), how applicable will this all be when I want to do $(neutron) or $(nova) for example? | 21:50 |
| *** ravelar159 has quit IRC | 21:51 | |
| josdotso | Today I tried $(nova --auth-type v3oidcpassword) vs. $(nova --auth-type v3oidcpasswordFOO) and found that nova complained "ERROR (NoMatchingPlugin): The plugin v3oidcpasswordFOO could not be found".. but for the "v3oidcpassword" looked like an arg issue. Seems like $(nova) will support v3oidcpassword once $(openstack) works, right? | 21:52 |
| bknudson | If I was working on the other CLIs I wouldn't bother implementing auth plugins and assume people who want that functionality would use openstack client. | 21:54 |
| josdotso | bknudson: But openstack client cannot do all that the legacy clients can. | 21:56 |
| josdotso | And what if the auth type is requisite | 21:56 |
| bknudson | then I would focus on implementing all that the legacy clients can. | 21:57 |
| josdotso | Agreed. | 21:57 |
| *** adriant has joined #openstack-keystone | 22:00 | |
| notmorgan | bknudson: the geekdom midcycle was really nice | 22:03 |
| notmorgan | josdotso: legacy clients should still use keystoneauth. | 22:04 |
| notmorgan | josdotso: i would only implement for keystoneauth, osc should be hooking into novaclient under the hood anyway | 22:04 |
| notmorgan | josdotso: some clients are lagging behind | 22:04 |
| josdotso | notmorgan: so v3oidcpassword won't work readily in the older clients then, correct? | 22:05 |
| notmorgan | josdotso: but that will be remedied and keystoneclient.session is deprecated/going away | 22:05 |
| josdotso | *today | 22:05 |
| notmorgan | josdotso: possibly, but no guarantees it will be easy to implement for both | 22:05 |
| notmorgan | and/or really be worth the effort | 22:05 |
| openstackgerrit | Merged openstack/keystone: Refactor TestAuthExternalDomain to not inherit tests https://review.openstack.org/343886 | 22:05 |
| notmorgan | newclient explicitly should work with old servers, provided keystone server is supporting the OID auth mechanism in a cloud, you should be able to use the new client | 22:06 |
| josdotso | ok cool. Just thinking of end use case right now. IaaS standardizing on OIDC in a new release causes client side issues because older clients. | 22:06 |
| josdotso | *because users still use older clients | 22:06 |
| notmorgan | carrot to use the new client | 22:06 |
| notmorgan | which is going to have more security eyes on/fixes/etc | 22:07 |
| notmorgan | and i assume this is end user, not service->service [since that is very tied to release of openstack] | 22:07 |
| henrynash | having problems running openstack client...getting: Discovering versions from the identity service failed when creating the password plugin. Attempting to determine version from URL. | 22:07 |
| henrynash | is the the clouds.yaml thing? | 22:07 |
| josdotso | Makes sense. and yeah.. thinking about end user experience. | 22:07 |
| openstackgerrit | Merged openstack/keystone: Don't run TokenCacheInvalidation with Fernet https://review.openstack.org/343932 | 22:08 |
| notmorgan | henrynash: everytime i've seen that it's actually a conflict with clouds.yaml and/or auth url and/or ENV var+cli opotions | 22:08 |
| notmorgan | henrynash: and/or saying use v3 but sending a v2 auth endpoint | 22:08 |
| henrynash | notmorgan: yep, I think my clouds.yaml (from devstack) does have v3 in the endpoints | 22:08 |
| notmorgan | henrynash: basically it comes down to telling the client conflicting info... and the client is not smart enough to say "uhhh you're crazy | 22:09 |
| notmorgan | ": | 22:09 |
| henrynash | notmorgan: it's an older devstack | 22:09 |
| notmorgan | yah | 22:09 |
| josdotso | I did uncover that legacy clients can interact with an OIDC-enforced cloud by taking the --os-auth-token as output of openstack command | 22:09 |
| notmorgan | likely the issue | 22:09 |
| henrynash | notmorgan: ok, thx | 22:09 |
| josdotso | .. thanks folks | 22:09 |
| notmorgan | josdotso: if the client uses keystoneauth it almost always can use any auth method keystoneauth supports | 22:09 |
| notmorgan | josdotso: if it's using ekystoneclient.session (or worse not even session), it gets a bit weirder | 22:10 |
| notmorgan | josdotso: most clients are using keystoneauth these days | 22:10 |
| josdotso | notmorgan: Oh i see. That's good news. I'll try to pull together a list of what is what | 22:10 |
| notmorgan | :) | 22:10 |
| *** isd has left #openstack-keystone | 22:10 | |
| notmorgan | the idea is OSC really is the common cli | 22:11 |
| notmorgan | the other clients *could* do things | 22:11 |
| notmorgan | and may expose extra options (for now) | 22:11 |
| notmorgan | but it should hook into the common auth module (keystoneauth) | 22:11 |
| josdotso | Yeah, I get that. Legacy client libs were both CLI and Lib, and now we're looking for them to be just libs, right? | 22:11 |
| josdotso | YMMV | 22:11 |
| notmorgan | exactly | 22:12 |
| notmorgan | :) | 22:12 |
| josdotso | ok cool. thanks! | 22:12 |
| notmorgan | the push for keystoneauth was just to isolate the exposure and consolidate a ton of code. | 22:12 |
| notmorgan | :) | 22:12 |
| notmorgan | happy to help | 22:12 |
| josdotso | any tips on where to look in each legacy client lib for the obvious "new or old" import? | 22:13 |
| *** pauloewerton has quit IRC | 22:13 | |
| josdotso | I guess I can just search for "keystoneauth" and if zero results, fail | 22:13 |
| josdotso | https://github.com/openstack/nova/blob/59c57ae77ae15bc8bd319126bfb4f9cf251030c0/nova/context.py#L24 | 22:14 |
| josdotso | requirements.txt, duh .. later folks | 22:15 |
| adriant | Hey, do we have any good documentation on disabling the V2 identity API (what is left of it)? | 22:16 |
| *** gordc has quit IRC | 22:19 | |
| notmorgan | josdotso: you can also look at codesearch.openstack.org for more expanded regex matching | 22:21 |
| openstackgerrit | Merged openstack/keystone: Run AuthWithToken against all token providers https://review.openstack.org/343935 | 22:22 |
| josdotso | ty! | 22:22 |
| *** roxanagh_ has joined #openstack-keystone | 22:26 | |
| josdotso | Guess this one is using keystoneauth, but also keystoneclient.. Hmm: https://github.com/openstack/aodh/blob/3b312fd0ec075c1cff035c272f016ba8547f041e/aodh/keystone_client.py#L21 | 22:28 |
| josdotso | oh hmm.. that's aodh server side, nvm | 22:29 |
| *** roxanagh_ has quit IRC | 22:30 | |
| *** ddieterly has quit IRC | 22:33 | |
| openstackgerrit | Merged openstack/keystone: refactor: inherit AuthWithRemoteUser for other providers https://review.openstack.org/345075 | 22:34 |
| openstackgerrit | Merged openstack/keystone: refactor: make TestAuthKerberos test pki/pkiz/uuid https://review.openstack.org/345089 | 22:38 |
| openstackgerrit | Merged openstack/keystone: refactor: make TestAuthExternalDefaultDomain test uuid/pki/pkiz https://review.openstack.org/345090 | 22:38 |
| openstackgerrit | Merged openstack/keystone: refactor: make TestFetchRevocationList test uuid https://review.openstack.org/345099 | 22:39 |
| openstackgerrit | Merged openstack/keystone: Use freezegun in OSRevokeTests https://review.openstack.org/345104 | 22:39 |
| *** michauds has quit IRC | 22:42 | |
| openstackgerrit | Merged openstack/keystone: Only run KvsTokenCacheInvalidation against uuid https://review.openstack.org/345108 | 22:44 |
| openstackgerrit | Merged openstack/keystone: Use freezegun in AssignmentInheritanceTestCase https://review.openstack.org/345684 | 22:46 |
| *** slberger has left #openstack-keystone | 22:52 | |
| *** spandhe has joined #openstack-keystone | 22:57 | |
| Gorian | hey | 23:01 |
| *** ddieterly has joined #openstack-keystone | 23:02 | |
| *** ddieterly has quit IRC | 23:04 | |
| *** ddieterly has joined #openstack-keystone | 23:04 | |
| *** ddieterly is now known as ddieterly[away] | 23:05 | |
| *** ddieterly has joined #openstack-keystone | 23:06 | |
| *** ddieterly has quit IRC | 23:07 | |
| openstackgerrit | Merged openstack/keystone: Replace OpenStack LLC with OpenStack Foundation https://review.openstack.org/346675 | 23:19 |
| *** chlong_POffice has quit IRC | 23:25 | |
| *** pgbridge has quit IRC | 23:31 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone-specs: New TOTP contrib plugin for non-admin access to TOTP credentials https://review.openstack.org/345705 | 23:33 |
| *** ravelar159 has joined #openstack-keystone | 23:39 | |
| *** chlong_POffice has joined #openstack-keystone | 23:42 | |
| *** ravelar159 has quit IRC | 23:45 | |
| openstackgerrit | Merged openstack/keystone-specs: Re-target unified delegations to O https://review.openstack.org/346942 | 23:46 |
| josdotso | notmorgan: In my audit, I saw four kinds of keystoneauth1 usage... One was to "import keystoneauth1 loading", Second was to "import keystoneauth1 adapter" and third was to "import keystoneauth1 session"..fourth was "import keystoneauth1 plugin"... Which of these have the best outlook for allowing v3oidcpassword ? | 23:46 |
| josdotso | http://codesearch.openstack.org/?q=%5Ekeystoneauth1&i=nope&files=&repos= | 23:47 |
| *** roxanaghe has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!