| *** jistr has joined #openstack-keystone | 00:01 | |
| *** david-lyle has quit IRC | 00:03 | |
| *** david-lyle has joined #openstack-keystone | 00:07 | |
| *** thorst has joined #openstack-keystone | 00:11 | |
| *** markvoelker has joined #openstack-keystone | 00:13 | |
| *** lamt has quit IRC | 00:14 | |
| *** edmondsw has joined #openstack-keystone | 00:15 | |
| *** thorst has quit IRC | 00:15 | |
| *** edmondsw has quit IRC | 00:19 | |
| *** thorst has joined #openstack-keystone | 00:21 | |
| *** thorst has quit IRC | 00:28 | |
| *** david-lyle has quit IRC | 00:36 | |
| *** jlvillal is now known as jlvillal_pto | 00:42 | |
| *** zhurong has joined #openstack-keystone | 00:43 | |
| *** charz has joined #openstack-keystone | 00:48 | |
| *** thorst has joined #openstack-keystone | 00:52 | |
| *** thorst has quit IRC | 00:52 | |
| *** dave-mcc_ has joined #openstack-keystone | 00:56 | |
| *** lucasxu has joined #openstack-keystone | 01:17 | |
| *** lucasxu has quit IRC | 01:20 | |
| *** thorst has joined #openstack-keystone | 01:26 | |
| *** liujiong has joined #openstack-keystone | 01:26 | |
| *** lucasxu has joined #openstack-keystone | 01:30 | |
| *** shuyingya has joined #openstack-keystone | 01:36 | |
| *** xuhaigang has joined #openstack-keystone | 01:36 | |
| *** dave-mccowan has joined #openstack-keystone | 01:37 | |
| *** dave-mcc_ has quit IRC | 01:39 | |
| xuhaigang | hi, can someone tell me how to restart keystone service? | 01:41 |
|---|---|---|
| xuhaigang | keystone service in devstack | 01:43 |
| *** spzala has quit IRC | 01:48 | |
| *** spzala has joined #openstack-keystone | 02:09 | |
| *** spzala has quit IRC | 02:13 | |
| *** jrist has joined #openstack-keystone | 02:20 | |
| *** lwanderley has quit IRC | 02:40 | |
| *** spzala has joined #openstack-keystone | 02:46 | |
| *** spzala has quit IRC | 02:51 | |
| *** namnh has joined #openstack-keystone | 02:59 | |
| *** stingaci has joined #openstack-keystone | 03:12 | |
| *** rderose has quit IRC | 03:13 | |
| *** stingaci has quit IRC | 03:17 | |
| *** spzala has joined #openstack-keystone | 03:27 | |
| *** spzala has quit IRC | 03:32 | |
| *** david-lyle has joined #openstack-keystone | 03:35 | |
| *** akrzos has joined #openstack-keystone | 03:39 | |
| *** dave-mccowan has quit IRC | 03:39 | |
| *** david-lyle has quit IRC | 03:42 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 03:46 | |
| *** links has joined #openstack-keystone | 03:47 | |
| *** zhurong has quit IRC | 03:51 | |
| *** voelzmo has joined #openstack-keystone | 04:02 | |
| *** zhurong has joined #openstack-keystone | 04:04 | |
| *** spzala has joined #openstack-keystone | 04:06 | |
| *** voelzmo has quit IRC | 04:10 | |
| *** spzala has quit IRC | 04:11 | |
| *** markvoelker has quit IRC | 04:11 | |
| *** jamielennox is now known as jamielennox|away | 04:18 | |
| *** voelzmo has joined #openstack-keystone | 04:20 | |
| *** spzala has joined #openstack-keystone | 04:27 | |
| *** spzala has quit IRC | 04:32 | |
| *** lucasxu has quit IRC | 04:33 | |
| *** voelzmo has quit IRC | 04:43 | |
| *** rcernin has joined #openstack-keystone | 04:48 | |
| *** lamt has joined #openstack-keystone | 04:53 | |
| *** melwitt has joined #openstack-keystone | 04:54 | |
| *** rcernin has quit IRC | 04:55 | |
| *** rcernin has joined #openstack-keystone | 04:55 | |
| *** rcernin is now known as rcernin|wfh | 04:55 | |
| *** spzala has joined #openstack-keystone | 05:09 | |
| *** markvoelker has joined #openstack-keystone | 05:12 | |
| *** spzala has quit IRC | 05:14 | |
| *** markvoelker has quit IRC | 05:17 | |
| *** browne has quit IRC | 05:20 | |
| *** lamt has quit IRC | 05:33 | |
| *** richm has quit IRC | 05:44 | |
| *** spzala has joined #openstack-keystone | 05:46 | |
| *** spzala has quit IRC | 05:50 | |
| *** zhurong has quit IRC | 05:55 | |
| *** zhurong has joined #openstack-keystone | 06:16 | |
| *** lamt has joined #openstack-keystone | 06:18 | |
| *** spzala has joined #openstack-keystone | 06:22 | |
| *** spzala has quit IRC | 06:27 | |
| *** pcaruana has joined #openstack-keystone | 06:34 | |
| *** voelzmo has joined #openstack-keystone | 06:42 | |
| *** spzala has joined #openstack-keystone | 06:49 | |
| *** belmoreira has joined #openstack-keystone | 06:51 | |
| *** spzala has quit IRC | 06:54 | |
| breton | xuhaigang: service apache2 restart | 06:57 |
| *** Shunli has joined #openstack-keystone | 07:05 | |
| *** aloga has joined #openstack-keystone | 07:06 | |
| *** tesseract has joined #openstack-keystone | 07:07 | |
| breton | so | 07:13 |
| breton | Rock or Rex? | 07:13 |
| *** markvoelker has joined #openstack-keystone | 07:13 | |
| *** aojea_ has joined #openstack-keystone | 07:16 | |
| *** markvoelker has quit IRC | 07:17 | |
| *** rha has joined #openstack-keystone | 07:22 | |
| *** spzala has joined #openstack-keystone | 07:26 | |
| *** spzala has quit IRC | 07:30 | |
| *** liujiong has quit IRC | 07:33 | |
| *** liujiong has joined #openstack-keystone | 07:33 | |
| *** lwanderley has joined #openstack-keystone | 07:39 | |
| *** lwanderley has quit IRC | 07:41 | |
| *** dulek has joined #openstack-keystone | 07:50 | |
| *** stingaci has joined #openstack-keystone | 07:54 | |
| *** spzala has joined #openstack-keystone | 07:57 | |
| *** stingaci has quit IRC | 07:58 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** spzala has quit IRC | 08:02 | |
| *** zigo has joined #openstack-keystone | 08:18 | |
| xuhaigang | breton: ok, thx! | 08:33 |
| *** zhurong has quit IRC | 08:41 | |
| xuhaigang | breton: I try this command, but it does not work in devstack. | 08:43 |
| *** johnthetubaguy has joined #openstack-keystone | 08:45 | |
| *** andymccr has joined #openstack-keystone | 08:45 | |
| *** spzala has joined #openstack-keystone | 08:49 | |
| xuhaigang | breton: sorry, my breakpoint is wrong, it's ok now :) | 08:53 |
| *** spzala has quit IRC | 08:54 | |
| *** voelzmo has quit IRC | 08:58 | |
| *** tovin07 has joined #openstack-keystone | 08:59 | |
| *** frickler has joined #openstack-keystone | 08:59 | |
| *** voelzmo has joined #openstack-keystone | 09:05 | |
| *** voelzmo has quit IRC | 09:06 | |
| *** freerunner has joined #openstack-keystone | 09:22 | |
| *** Shunli has quit IRC | 09:30 | |
| *** lamt has quit IRC | 09:36 | |
| *** lwanderley has joined #openstack-keystone | 09:40 | |
| *** lwanderley has quit IRC | 09:41 | |
| *** Aurelgad1o has joined #openstack-keystone | 09:44 | |
| *** zhurong has joined #openstack-keystone | 09:54 | |
| *** zhurong has quit IRC | 09:55 | |
| *** liujiong has quit IRC | 10:01 | |
| *** nicolasbock has joined #openstack-keystone | 10:02 | |
| *** richm has joined #openstack-keystone | 10:13 | |
| *** jaosorior has joined #openstack-keystone | 10:15 | |
| *** links has quit IRC | 10:16 | |
| *** tesseract has quit IRC | 10:30 | |
| *** links has joined #openstack-keystone | 10:32 | |
| *** tesseract has joined #openstack-keystone | 10:44 | |
| openstackgerrit | Huangsm proposed openstack/keystone-specs master: List Users Filter By Some Information https://review.openstack.org/454668 | 10:48 |
| *** jaosorior has quit IRC | 10:53 | |
| *** jaosorior has joined #openstack-keystone | 10:53 | |
| *** jaosorior has quit IRC | 10:53 | |
| *** jaosorior has joined #openstack-keystone | 10:56 | |
| *** shuyingya has quit IRC | 10:57 | |
| *** shuyingya has joined #openstack-keystone | 10:58 | |
| *** jaosorior_ has joined #openstack-keystone | 11:00 | |
| *** jaosorior has quit IRC | 11:01 | |
| *** links has quit IRC | 11:04 | |
| *** links has joined #openstack-keystone | 11:05 | |
| *** voelzmo has joined #openstack-keystone | 11:05 | |
| *** spzala has joined #openstack-keystone | 11:10 | |
| *** markvoelker has joined #openstack-keystone | 11:14 | |
| *** spzala has quit IRC | 11:16 | |
| *** raildo has joined #openstack-keystone | 11:16 | |
| *** openstackgerrit has quit IRC | 11:18 | |
| *** markvoelker has quit IRC | 11:19 | |
| *** pcaruana has quit IRC | 11:22 | |
| *** namnh has quit IRC | 11:27 | |
| *** jaosorior_ is now known as jaosorior | 11:37 | |
| *** lamt has joined #openstack-keystone | 11:38 | |
| *** spzala has joined #openstack-keystone | 11:47 | |
| *** thorst has joined #openstack-keystone | 11:47 | |
| *** spzala has quit IRC | 11:52 | |
| *** stingaci has joined #openstack-keystone | 11:56 | |
| *** lamt has quit IRC | 11:57 | |
| *** stingaci has quit IRC | 12:00 | |
| *** rmascena has joined #openstack-keystone | 12:03 | |
| *** raildo has quit IRC | 12:05 | |
| *** jaosorior has quit IRC | 12:09 | |
| *** jaosorior has joined #openstack-keystone | 12:09 | |
| *** edmondsw has joined #openstack-keystone | 12:09 | |
| *** markvoelker has joined #openstack-keystone | 12:14 | |
| *** spzala has joined #openstack-keystone | 12:23 | |
| *** zeus has joined #openstack-keystone | 12:25 | |
| *** spzala has quit IRC | 12:28 | |
| *** spilla has joined #openstack-keystone | 12:33 | |
| *** shuyingya has quit IRC | 12:34 | |
| *** lamt has joined #openstack-keystone | 12:35 | |
| *** spilla has quit IRC | 12:36 | |
| *** spilla has joined #openstack-keystone | 12:48 | |
| *** spzala has joined #openstack-keystone | 12:49 | |
| *** spzala has quit IRC | 12:49 | |
| *** spzala has joined #openstack-keystone | 12:49 | |
| *** stingaci has joined #openstack-keystone | 12:54 | |
| *** stingaci has quit IRC | 12:59 | |
| gagehugo | o/ | 13:03 |
| *** catintheroof has joined #openstack-keystone | 13:03 | |
| *** openstackgerrit has joined #openstack-keystone | 13:21 | |
| openstackgerrit | Dinesh Bhor proposed openstack/python-keystoneclient master: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 13:21 |
| lbragstad | o/ | 13:21 |
| *** ravelar has joined #openstack-keystone | 13:22 | |
| dstanek | xuhaigang: what OS are you running? Fedora? you just have to restart apache, which may be called httpd in your environment | 13:22 |
| *** kencjohnston has joined #openstack-keystone | 13:24 | |
| lbragstad | for those of you who write, I found this guide informative - https://www.linkedin.com/pulse/effective-writer-spend-more-time-planning-less-writing-michael-gass | 13:27 |
| Dinesh_Bhor | nice! | 13:31 |
| *** ayoung has joined #openstack-keystone | 13:32 | |
| ayoung | Heh...just noticed I got kickbanned. Someone was having fun. | 13:33 |
| dstanek | ayoung: fun day yesterday. sorry you missed it | 13:34 |
| dstanek | i guess today is a 1.5 cup of coffee day. i just realized that i only have 8g of coffee left | 13:37 |
| lbragstad | looks like there is a new patch set for the OpenStack mission -> https://review.openstack.org/#/c/447031/4/resolutions/20170317-cloud-applications-mission.rst | 13:38 |
| lbragstad | ayoung i spent yesterday reading the NIST RBAC model | 13:38 |
| ayoung | dstanek, I use a french press, which is 2 scoops per cup | 13:39 |
| ayoung | lbragstad, learn anything? | 13:39 |
| lbragstad | ayoung yeah - i thought it was good | 13:39 |
| lbragstad | ayoung i'm going to parse it again this weekend | 13:39 |
| ayoung | lbragstad, OK, so a couple things as I mentioned prior | 13:39 |
| ayoung | We do Scoped RBAC, which is different from NIST | 13:39 |
| ayoung | THe best example I can give is in NIST Role=MAYOR_OF_CHIGAGO | 13:40 |
| ayoung | in ours Role=Mayor, Project=Chicago | 13:40 |
| lbragstad | ayoung right | 13:40 |
| *** lwanderley has joined #openstack-keystone | 13:40 | |
| ayoung | ours is more scalable, but you can do a one-to-one translation between them if you need. | 13:40 |
| ayoung | lbragstad, also, I chose not to use the term hierarchical roles instead used implied roles for a couple reasons | 13:40 |
| ayoung | 1. we used hierarchical for the project hierarchy | 13:41 |
| ayoung | 2. role inference really is a DAG | 13:41 |
| ayoung | lbragstad, dstanek I think I have an analogy for you guys. | 13:41 |
| ayoung | Say You want to borrow my car, one of the two actually | 13:41 |
| *** lwanderley has quit IRC | 13:41 | |
| ayoung | I have a Hyundai and a Suburu, and you want the Subaru cuz you are going skiing | 13:42 |
| ayoung | lets say this crazy car is a remote start...(my Hyundai is, actually, but lets say the Subaru is too) | 13:42 |
| ayoung | I always get into the car with my whole Key ring in my pocket | 13:43 |
| ayoung | and that is how I start the car...push the button, and I have no idea which Key I have actually starts the car | 13:43 |
| ayoung | in order to let you use my car, I could give you the whole key ring | 13:43 |
| ayoung | or I could figure out which key actually starts it.... | 13:43 |
| dstanek | ayoung: i also use a french press. i usually use about 17g of grounds and 289g water per cup | 13:44 |
| ayoung | to do that, I have to take my key ring apart, and try each key in turn to start it | 13:44 |
| ayoung | dstanek, I still use Imperial Measure for Coffee. | 13:44 |
| ayoung | two tablespoons | 13:44 |
| ayoung | not sure what that maps to in grams... | 13:44 |
| dstanek | ayoung: :-) my scale only does grams afaik | 13:44 |
| * ayoung suspects you take coffee a bit more seriously than I | 13:45 | |
| lbragstad | it depends on the bean and the grind | 13:45 |
| * ayoung has no scale | 13:45 | |
| ayoung | heh...much more fun to talk about than RBAC | 13:45 |
| ayoung | anyway...so Keys are Roles | 13:45 |
| ayoung | and the Car is the API we want to call | 13:45 |
| ayoung | And lending you the car is setting up some autonomous system to call the API on my behalf | 13:46 |
| ayoung | I want to know which Key to give you to lend you my car | 13:46 |
| lbragstad | sure | 13:46 |
| ayoung | and I want to know which role to add to the delegation agreement to set up the autonomous system | 13:46 |
| ayoung | I don't want to have to give every role I am assigned to the system | 13:46 |
| ayoung | just the minimal... | 13:46 |
| *** spzala has quit IRC | 13:47 | |
| ayoung | that is what I am trying to get at here: the need to put the ROLE on the outside of the API, to make it discoverable. To figure out which key we need without starting the car. | 13:47 |
| * ayoung looks into Amazon Drone Coffee deliver services for dstanek | 13:47 | |
| lbragstad | ayoung so that was something that stuck out to me in the symmetric RBAC model | 13:48 |
| lbragstad | because it requires the ability to review roles and permissions | 13:48 |
| *** dave-mccowan has joined #openstack-keystone | 13:49 | |
| ayoung | Yeah...of course, we are not really doing the constrained part that depends upon, but yes. | 13:50 |
| lbragstad | ideally - we need to be in order to get to the symmetric model | 13:50 |
| ayoung | we don't enforce "Role A implies your cannot have Role B" | 13:50 |
| ayoung | right | 13:50 |
| *** shuyingya has joined #openstack-keystone | 13:50 | |
| ayoung | that is kindof like "if you can order supplies, you cannot sign off on releasing the Money for those supplies" | 13:50 |
| lbragstad | in the constrained model - it leaves a lot of stuff open to interpretation | 13:51 |
| ayoung | so that illegal purchases get caught, or at least more than one person needs to collude. | 13:51 |
| *** zhurong has joined #openstack-keystone | 13:51 | |
| ayoung | I think we are OK without that for now, but we could, in theory add that in the future. It would be the opposite of an inference rule, I think | 13:52 |
| lbragstad | ayoung do you remember that role map idea we talked about a long time ago? | 13:52 |
| ayoung | refresh my memory | 13:52 |
| lbragstad | ayoung it's pretty much implied roles | 13:52 |
| lbragstad | but operations in openstack have other things they require in order to work | 13:53 |
| lbragstad | like nova needing to be able to get a port from neutron in order to boot a server | 13:53 |
| *** zhurong has quit IRC | 13:53 | |
| lbragstad | some time back we talked about building a map of those operations (like a big tree of which operations *needed* which operations in order to work) | 13:54 |
| lbragstad | so - because you're allowed to boot instances, its implied that you can create a port in neutron | 13:54 |
| dstanek | to have a concrete openstack case.... one example i have been using is that i was to delegate the ability to reboot a specific VM. i was hoping that the capabilities api would allow me to understand what role that means and that we'd be able to scope to an instance somehow | 13:54 |
| *** shuyingya has quit IRC | 13:55 | |
| lbragstad | dstanek not sure if you've had the chance to parse the doc yet | 13:55 |
| lbragstad | dstanek but it breaks RBAC into four levels | 13:55 |
| lbragstad | flat (level 1), hierarchical (level 2), constrained (level 3), and symmetric (level 4) | 13:56 |
| dstanek | lbragstad: yes, i did a read through yesterday | 13:56 |
| lbragstad | ok | 13:56 |
| lbragstad | nice | 13:56 |
| lbragstad | to me - level 4 makes sense | 13:56 |
| lbragstad | but i'm not quite sure how we'd apply level 3 | 13:56 |
| dstanek | lbragstad: what level 3 hierarchical or constrained? | 13:57 |
| lbragstad | and i was thinking of that operation map as a way to do that somehow - but ran out of steam yesterday | 13:57 |
| lbragstad | dstanek hierarchical is level 2 | 13:57 |
| lbragstad | constrained is level 3 | 13:57 |
| lbragstad | dstanek level 2 is just the ability to imply roles really | 13:58 |
| lbragstad | (i.e. because I have the project lead role I can do project developer operations) | 13:58 |
| dstanek | what's interesting to me is the read-only case. we is this idea attached to a role instead of attached to a poicy? | 14:00 |
| dstanek | i've been trying to dig into the amazon policy model as i have time and it actually very interesting | 14:01 |
| lbragstad | https://www.youtube.com/watch?v=Du478i9O_mc did a pretty good job of describing it | 14:03 |
| dstanek | https://aws.amazon.com/code/AWS-Policy-Examples/6851158459579252 i think is just missing a principal that constrains the policy to a role | 14:03 |
| *** peterstac has joined #openstack-keystone | 14:04 | |
| dstanek | what's interesting here is that people seem to be grouping policy statements by policy and not by service | 14:04 |
| lbragstad | sdb:GetAttributes for example | 14:05 |
| dstanek | right, so in their policy you can say this user/group/whatever can perform some_action on this resource/set of resources/all resources | 14:06 |
| dstanek | i want the devs to have read-only access to arn:aws:s3:::images, but ops to have full access of that resource | 14:07 |
| ayoung | I think 4 does not really require 3, more that it builds on it for use cases we don't really care about here | 14:07 |
| ayoung | dstanek, and that grouping is where OpenStack started, with the Project as the means of grouping | 14:08 |
| dstanek | ayoung: lbragstad: i took notes during that initial reading...i really need to go back over it again | 14:08 |
| lbragstad | i need to reread levels 3 and 4 | 14:09 |
| ayoung | lbragstad, dstanek I think NIST has an implied "This all applies to our one organization" built into its approach | 14:09 |
| dstanek | ayoung: groupd you mean user/group/whatever? | 14:09 |
| knikolla | morning o/ | 14:09 |
| ayoung | knikolla, hey... | 14:09 |
| lbragstad | i think 3 is hard to fit in our model today - but I won't rule out the fact we might care about it in the future | 14:09 |
| dstanek | ayoung: yes, i think you are correct about the organization semantics of the doc from what i've seen | 14:10 |
| dstanek | lbragstad: when you say have to fit in, do you mean because conflicts would be hard to find? | 14:12 |
| lbragstad | dstanek i seem to understand the ability to stack roles on top of each other, using implied roles | 14:13 |
| lbragstad | but in the case where you can't do something because you have a *specific* role is kind of confusing for me to think about in our situation | 14:13 |
| ayoung | I think level 3 would require the unified delegation model | 14:14 |
| lbragstad | and the way we do things in openstack all bubbles up to a global/cloud admin | 14:14 |
| lbragstad | which is kinda like the director role from the examples in the NIST RBAC model | 14:14 |
| dstanek | lbragstad: yeah, in my mind it's hard because you have to unwind the role hierarchy and evaluate policy for them. and since policy is all over the place some situations are impossible today | 14:15 |
| *** thorst has quit IRC | 14:15 | |
| lbragstad | level 3 attempts to limit the damage done by one person having too much power | 14:15 |
| ayoung | Admin is pretty much the definition of that. | 14:16 |
| lbragstad | we treat admin as the admin of the cloud (i.e. God-mode) and we imply with great power comes great responsibility | 14:16 |
| lbragstad | right - the way we apply rbac kind of conflicts with that specific level of RBAC as defined in the NIST document | 14:17 |
| ayoung | yeah, so we really should revisit the idea that a user can get a token with a subset of their roles | 14:17 |
| ayoung | cuz if you are admin, you don't always want to be acting as admin | 14:17 |
| lbragstad | ayoung that'd effectively be the dynamic separation of duty | 14:17 |
| ayoung | Yep | 14:17 |
| lbragstad | because you're limiting each session (i.e. token) to a specific scope | 14:17 |
| ayoung | effectively me not giving you my whole key ring to lend you my car.... | 14:18 |
| *** spzala has joined #openstack-keystone | 14:18 | |
| dstanek | ayoung: ++ it's the same reason i use sudo instead of logging is as root everywhere | 14:18 |
| lbragstad | ayoung i think that part comes in level 4 | 14:18 |
| ayoung | https://review.openstack.org/#/c/186979/ needs to be approved, not -2ed stevemar | 14:18 |
| lbragstad | because you as a user need to be able to figure out which key starts your car first | 14:18 |
| ayoung | just a spec freeze -2 that needs to be removed...that one and | 14:18 |
| *** thorst has joined #openstack-keystone | 14:18 | |
| ayoung | then this... | 14:19 |
| *** spzala_ has joined #openstack-keystone | 14:19 | |
| ayoung | https://review.openstack.org/#/c/310074/ | 14:19 |
| ayoung | lbragstad, you see the logic | 14:19 |
| dstanek | i'd love to be able to delegate something like computed:vm:reboot:12345 | 14:20 |
| ayoung | dstanek, you mean an individual VM? | 14:20 |
| ayoung | I think the best we can get from Keystone alone is the ability to perform a single operation on all of a class of resources in a project | 14:21 |
| dstanek | yes, as a user i want to give my team the ability to do a few targeted actions | 14:21 |
| ayoung | so computed:vm:reboot | 14:21 |
| dstanek | ayoung: yeah, it has to be evaluated at policy time *and* to some extent grant time | 14:21 |
| ayoung | you want it to only reboot a single VM, needs to be in its own project. Anything beyond that requires support from Nova to imp[lement, but I think it is still a huge improvement | 14:22 |
| openstackgerrit | ayoung proposed openstack/keystone master: Fernet token formatter with explicit role https://review.openstack.org/310074 | 14:22 |
| *** spzala has quit IRC | 14:22 | |
| ayoung | stevemar, please remove -2 on https://review.openstack.org/#/c/310074/ as well | 14:22 |
| knikolla | ayoung: theoretically we can expand role-check-from-middleware for that /servers/12345/action | 14:23 |
| dstanek | ayoung: totally agree. i just trying to define what we should be doing overall. then real world constraints would dictate how we get there | 14:23 |
| ayoung | knikolla, yeah, I think so | 14:23 |
| ayoung | knikolla, need to think it through. If there are multiple paths for the same URL, they all need to be evaluated | 14:24 |
| ayoung | otherwise, there is a potential hack | 14:24 |
| knikolla | true | 14:25 |
| dstanek | ayoung: this is why i want to stay away from URL | 14:25 |
| *** david-lyle has joined #openstack-keystone | 14:25 | |
| knikolla | also scope-check | 14:25 |
| *** links has quit IRC | 14:25 | |
| ayoung | dstanek, you have to provie a viable alternative | 14:25 |
| dstanek | ask nova about compute:vm:reboot - they already know all 4 urls that can trigger that action | 14:25 |
| ayoung | knikolla, nah, scope check is not our problem | 14:25 |
| ayoung | dstanek, OpenStack is not Nova | 14:25 |
| ayoung | Keystone cares Bugger All about Nova | 14:26 |
| ayoung | Nova is just the biggest consumer | 14:26 |
| ayoung | but the same things we say about Nova have to be true of any service that uses Keystone | 14:26 |
| dstanek | nova is just a concrete example | 14:26 |
| ayoung | dstanek, you can't tell an end user that in order to find out what role they need, they have to read the code | 14:26 |
| lbragstad | it doesn't really matter what the operation is, we just need a way to ask the service about the operation | 14:26 |
| knikolla | ayoung: by scope check i mean, can this user restrict access to the url of this resource. is it his resource to do that? | 14:26 |
| ayoung | they might not actually have access to the code | 14:26 |
| dstanek | ayoung: why would they have to do that? they know they want to reboot a vm | 14:27 |
| ayoung | dstanek, no, they want to tell another system It can reboot a VM | 14:27 |
| ayoung | and in doing so, are going to create a trust. | 14:27 |
| ayoung | And what role do they assigned to that trust? | 14:27 |
| dstanek | what role do you need for compute:vm:reboot? | 14:28 |
| ayoung | dstanek, right | 14:28 |
| ayoung | dstanek, or, take the case of something like Trove | 14:28 |
| ayoung | it wants to do a bunch of stuff on your behalf | 14:28 |
| ayoung | it better tell you what roles you need to give it, otherwise you have to give it everything | 14:28 |
| dstanek | ayoung: right....my point is you use the string 'compute:vm:reboot' instead of a URL | 14:29 |
| ayoung | and that might not be legal. In a, you know, Federal law meaning of the term | 14:29 |
| ayoung | dstanek, users never see that string | 14:29 |
| ayoung | they see either a web UI or call the CLI | 14:29 |
| ayoung | and they need to be able to automatically map from what they are calling to the policy | 14:29 |
| dstanek | right, and they wouldn't really see the URL in those cases without --debug | 14:30 |
| ayoung | dstanek, I started with the policy rules. Mapping them automatically is a non-starter...to much code in the way | 14:30 |
| dstanek | they say 'openstack user list' and that is actually 'identity:user:list' | 14:30 |
| ayoung | dstanek, but their tooling knows the URL, and thus could deduce it for them | 14:30 |
| ayoung | dstanek, right, so say that has a switch | 14:30 |
| ayoung | 'openstack user list --test | 14:30 |
| ayoung | that means don't actually run it, just tell me what would happen if I did | 14:31 |
| lbragstad | that seems like a long way to do capabilities | 14:31 |
| dstanek | i would argue that you might not be able to know the URL. for example, when action (or multiple actions) are hidden behind URLs | 14:31 |
| ayoung | and it might be able to say "in order to do that, you need Role R" | 14:31 |
| dstanek | ayoung: sure....but you still don't need URL | 14:32 |
| ayoung | dstanek, I know, but you need something | 14:32 |
| ayoung | and I need you to lay out what that alternative something is in a mechanism we can talk through from start to finish | 14:32 |
| ayoung | dstanek, if you need a role that Nova doesn't tell you in order to, say, fetch the image from glance, then, yes, the operation will fail | 14:33 |
| ayoung | that was the idea of the map lbragstad was talking about before | 14:33 |
| dstanek | ayoung: 'openstack user list --test' returns some roles by querying for the capabilities of a service - part of what comes back would like look the keys in policy | 14:33 |
| ayoung | ideally, the role you need to perform the operation on Nova would be the course grained one that implies the fine grained ones for glance cinder and neutron | 14:33 |
| *** Dinesh_Bhor has quit IRC | 14:34 | |
| ayoung | dstanek, so now every service out there, including non-openstack ones need to implement our API? | 14:34 |
| ayoung | our capabilities API? | 14:34 |
| ayoung | if not, you are back to trial and error, and the security hole that implies | 14:35 |
| dstanek | ayoung: yes, or provide a service that does it | 14:35 |
| dstanek | ayoung: even with the URL approach there is something for them to do. it's not a freebe either | 14:35 |
| ayoung | dstanek, so, I am proposing Keystone as that service | 14:35 |
| lbragstad | i don't really see how providing a capability api would be a bad thing | 14:35 |
| ayoung | lbragstad, providing it is fine. Requiring it is not. | 14:36 |
| lbragstad | ayoung sure | 14:36 |
| *** lucasxu has joined #openstack-keystone | 14:36 | |
| lbragstad | ayoung if a service wants to leverage openstack infrastructure for providing better rbac, supply a capabilities API according to this specification | 14:36 |
| dstanek | ayoung: is the theoretical service consuming keystone tokens? | 14:37 |
| ayoung | dstanek, yep | 14:37 |
| *** stradling has joined #openstack-keystone | 14:37 | |
| lbragstad | in that case wouldn't that be more of a reason to supply a capabilities API? | 14:38 |
| dstanek | ayoung: so they've already somewhat committed to openstack.... if you don't have a capabilities API then you can get the fancy delegation | 14:39 |
| lbragstad | s/can/can't/ ? | 14:39 |
| *** eglute has joined #openstack-keystone | 14:39 | |
| *** thorst has quit IRC | 14:39 | |
| dstanek | lbragstad: ++ can't | 14:39 |
| lbragstad | dstanek i was about to say - sweet! we're done! | 14:39 |
| lbragstad | +2/A let's go home | 14:40 |
| *** lwanderley has joined #openstack-keystone | 14:40 | |
| dstanek | ayoung: lbragstad: i have a meeting in 20 and now i have an ideal related to this to hack together before that meeting :-) will you guys be around a little later to continue? | 14:40 |
| dstanek | lbragstad: the sad thing is that i am already home | 14:40 |
| lbragstad | dstanek ayoung yeah - i'll be around | 14:40 |
| lbragstad | dstanek ayoung let me know if you wanna do a hangout or something, that's always an option, too | 14:41 |
| ayoung | dstanek, lbragstad yep | 14:41 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Remove unused revocation check in revoke_models https://review.openstack.org/451452 | 14:41 |
| *** lwanderley has quit IRC | 14:41 | |
| ayoung | dstanek, lbragstad but you could actually put auth-token middleware in front of a random API and get RBAC. You'd only need to wire up the scope check, and that could be done via custom middleware, not altering the original application | 14:42 |
| ayoung | but more likely that they are already looking at Keystone tokens and usiong them for auth | 14:42 |
| ayoung | capabilites and RBAC are 2 different things, though | 14:42 |
| ayoung | capabilities do not vary per user | 14:43 |
| ayoung | they vary per service | 14:43 |
| ayoung | RBAC varies per Token | 14:43 |
| *** thorst has joined #openstack-keystone | 14:43 | |
| *** thorst has quit IRC | 14:43 | |
| *** thorst has joined #openstack-keystone | 14:44 | |
| lbragstad | ayoung IFF the role the token is scoped to changes | 14:44 |
| ayoung | or the inference rules, which are maintained in Keystone, not the remote system | 14:44 |
| *** belmoreira has quit IRC | 14:47 | |
| ayoung | Heh, I still parse IFF as "Identify Friend or Foe" reinforced now by "The Expanse" | 14:50 |
| *** rderose has joined #openstack-keystone | 14:50 | |
| lbragstad | psh | 14:50 |
| lbragstad | iff == if and only if | 14:51 |
| lbragstad | people messing with redefining acronyms | 14:51 |
| *** rajpatel has joined #openstack-keystone | 14:53 | |
| ayoung | RPG | 14:54 |
| *** chris_hultin|AWA is now known as chris_hultin | 14:54 | |
| *** lamt has quit IRC | 14:58 | |
| *** voelzmo has quit IRC | 15:02 | |
| *** chris_hultin is now known as chris_hultin|AWA | 15:04 | |
| *** rcernin|wfh has quit IRC | 15:04 | |
| *** rajpatel has quit IRC | 15:06 | |
| *** catintheroof has quit IRC | 15:06 | |
| *** catintheroof has joined #openstack-keystone | 15:06 | |
| *** catintheroof has quit IRC | 15:07 | |
| *** catintheroof has joined #openstack-keystone | 15:15 | |
| *** catintheroof has quit IRC | 15:16 | |
| *** catintheroof has joined #openstack-keystone | 15:26 | |
| *** catintheroof has quit IRC | 15:27 | |
| *** redrobot has joined #openstack-keystone | 15:33 | |
| *** aojea_ has quit IRC | 15:42 | |
| *** oomichi has joined #openstack-keystone | 15:43 | |
| *** jaosorior has quit IRC | 15:44 | |
| *** niteshnarayanlal has joined #openstack-keystone | 15:49 | |
| *** stingaci has joined #openstack-keystone | 15:53 | |
| *** rajpatel has joined #openstack-keystone | 16:15 | |
| *** voelzmo has joined #openstack-keystone | 16:18 | |
| *** lwanderley has joined #openstack-keystone | 16:19 | |
| *** lucasxu has quit IRC | 16:24 | |
| *** spzala_ has quit IRC | 16:29 | |
| *** ediardo has joined #openstack-keystone | 16:33 | |
| *** spzala has joined #openstack-keystone | 16:35 | |
| *** spzala has quit IRC | 16:39 | |
| *** spzala has joined #openstack-keystone | 16:41 | |
| *** rajpatel has quit IRC | 16:41 | |
| *** tesseract has quit IRC | 16:42 | |
| *** rajpatel has joined #openstack-keystone | 16:42 | |
| *** rajpatel has quit IRC | 16:45 | |
| *** spzala has quit IRC | 16:46 | |
| *** catintheroof has joined #openstack-keystone | 16:51 | |
| *** spzala has joined #openstack-keystone | 16:52 | |
| *** spzala has quit IRC | 16:57 | |
| *** catintheroof has quit IRC | 16:57 | |
| *** spzala has joined #openstack-keystone | 16:58 | |
| *** spzala has quit IRC | 17:03 | |
| *** samueldmq has joined #openstack-keystone | 17:06 | |
| samueldmq | ooh I got banned from keystone | 17:07 |
| samueldmq | from #openstack-keystone* | 17:07 |
| samueldmq | glad to be back | 17:07 |
| samueldmq | o/ | 17:07 |
| *** spzala has joined #openstack-keystone | 17:17 | |
| *** ravelar has quit IRC | 17:17 | |
| *** spzala has quit IRC | 17:21 | |
| *** spzala has joined #openstack-keystone | 17:23 | |
| *** lucasxu has joined #openstack-keystone | 17:24 | |
| *** spzala has quit IRC | 17:27 | |
| *** spzala has joined #openstack-keystone | 17:29 | |
| *** ravelar has joined #openstack-keystone | 17:29 | |
| *** spzala has quit IRC | 17:33 | |
| *** spzala has joined #openstack-keystone | 17:35 | |
| *** spzala has quit IRC | 17:39 | |
| ayoung | knikolla, got a WIP of the client changes for RBAC? | 17:39 |
| *** cburgess has joined #openstack-keystone | 17:45 | |
| *** chlong_ has joined #openstack-keystone | 17:46 | |
| *** spzala has joined #openstack-keystone | 17:50 | |
| *** lwanderley has quit IRC | 17:55 | |
| *** lwanderley has joined #openstack-keystone | 18:02 | |
| *** rajpatel has joined #openstack-keystone | 18:04 | |
| *** stingaci has quit IRC | 18:12 | |
| *** rajpatel has quit IRC | 18:33 | |
| dstanek | welcome back samueldmq | 18:37 |
| ayoung | knikolla, can you check to see if https://review.openstack.org/454847 will solve the issues you saw with https://review.openstack.org/#/c/441469/ | 18:37 |
| knikolla | ayoung: for the client, i hope to have something to show you by the end of today or tomorrow. | 18:42 |
| knikolla | ayoung: should i rebase on top of your change for tempest? | 18:42 |
| ayoung | knikolla, cool. | 18:42 |
| ayoung | knikolla, my changes is not going to jhelp | 18:42 |
| ayoung | it is just unit tests. I think I have to submit to devstack to stop enabling the config option by default | 18:42 |
| ayoung | or maybe it is how the test is run? Is it gate option? | 18:43 |
| knikolla | ayoung: i don't know | 18:44 |
| ayoung | knikolla, pretty sure it is devstack setting admin_project_name which is the problem | 18:44 |
| ayoung | it looks like it defaults it | 18:44 |
| knikolla | ayoung: still that doesn't explain the non-deterministic failures | 18:45 |
| mtreinish | knikolla: the non deterministic failures are likely because the project is being reused | 18:46 |
| mtreinish | tempest tests are run in parallel and expect each class to have isolated projects | 18:46 |
| mtreinish | when you force all admin users to run in a single project the project scoped resources will change for all the tests running in parllel | 18:47 |
| mtreinish | and cause a bunch of random failures | 18:47 |
| knikolla | mtreinish: wouldn't they be different resources? | 18:48 |
| mtreinish | knikolla: the easiest way to think about it is a list api call | 18:48 |
| mtreinish | if you have 2 tests creating and deleting resources in the same project and doing list calls that they're using to verify | 18:49 |
| mtreinish | those tests will race against each other, and the lists will differ depending on the other tests | 18:50 |
| knikolla | mtreinish: oh right, makes sense. | 18:50 |
| *** rajpatel has joined #openstack-keystone | 18:53 | |
| dolphm | TERMIE?! https://review.openstack.org/#/q/owner:ansmith%2540redhat.com+status:open | 18:54 |
| ayoung | dolphm, sure looks like it. | 18:55 |
| ayoung | dolphm, then again, people used to assume ayoung was andrew young, so maybe just a common name? | 18:55 |
| dolphm | ayoung: i think so | 18:56 |
| ayoung | dolphm, https://review.openstack.org/#/q/owner:%22Andy+Smith%22 | 18:59 |
| dolphm | ayoung: definitely not termie. there's trailing whitespace | 18:59 |
| ayoung | Heh | 18:59 |
| ayoung | dolphm, there is an Andy Young at RH. Think that is him. | 19:01 |
| ayoung | Eer | 19:01 |
| ayoung | Andy Smith | 19:01 |
| ayoung | dolphm, yeah, and he's in the messaging group. Not termie. We can all relax | 19:02 |
| *** thorst has quit IRC | 19:03 | |
| *** Aqsa has joined #openstack-keystone | 19:10 | |
| *** aojea has joined #openstack-keystone | 19:10 | |
| ayoung | what is the release note process again? Google searching just gives me the actual release notes, not the tool | 19:13 |
| *** openstackgerrit has quit IRC | 19:19 | |
| knikolla | ayoung: what do you mean by release note process? | 19:20 |
| lbragstad | ayoung you can use your tox environment | 19:24 |
| lbragstad | tox -e reno | 19:24 |
| ayoung | lbragstad, thanks, I found it | 19:24 |
| lbragstad | er.. releasenotes* ? | 19:24 |
| ayoung | tox -e venv -- reno new is_admin_project | 19:24 |
| ayoung | or summat like dat | 19:24 |
| *** thorst has joined #openstack-keystone | 19:32 | |
| *** blake has joined #openstack-keystone | 19:37 | |
| *** chlong_ has quit IRC | 19:37 | |
| *** knikolla has left #openstack-keystone | 19:37 | |
| *** knikolla has joined #openstack-keystone | 19:37 | |
| *** lwanderley has quit IRC | 19:39 | |
| *** aojea has quit IRC | 19:39 | |
| *** aojea has joined #openstack-keystone | 19:40 | |
| *** chlong has joined #openstack-keystone | 19:42 | |
| *** aojea has quit IRC | 19:45 | |
| *** spzala has quit IRC | 20:09 | |
| *** spzala has joined #openstack-keystone | 20:12 | |
| *** spzala has quit IRC | 20:16 | |
| *** lucasxu has quit IRC | 20:17 | |
| *** spzala has joined #openstack-keystone | 20:17 | |
| *** voelzmo has quit IRC | 20:31 | |
| *** rajpatel has quit IRC | 20:37 | |
| *** lwanderley has joined #openstack-keystone | 20:43 | |
| *** aojea has joined #openstack-keystone | 20:45 | |
| *** stradling has quit IRC | 20:48 | |
| *** blake has quit IRC | 21:01 | |
| *** voelzmo has joined #openstack-keystone | 21:01 | |
| *** edmondsw has quit IRC | 21:02 | |
| *** edmondsw has joined #openstack-keystone | 21:02 | |
| *** mvk has joined #openstack-keystone | 21:04 | |
| *** voelzmo has quit IRC | 21:05 | |
| *** edmondsw has quit IRC | 21:07 | |
| *** spilla has quit IRC | 21:08 | |
| *** chlong has quit IRC | 21:08 | |
| *** catintheroof has joined #openstack-keystone | 21:12 | |
| *** catintheroof has quit IRC | 21:16 | |
| *** spzala has quit IRC | 21:20 | |
| *** thorst has quit IRC | 21:22 | |
| *** openstackgerrit has joined #openstack-keystone | 21:25 | |
| openstackgerrit | Peter Sabaini proposed openstack/keystone master: Only commit if we're not autocommitting https://review.openstack.org/454894 | 21:25 |
| *** Aqsa has quit IRC | 21:30 | |
| *** aojea has quit IRC | 21:44 | |
| *** rajpatel has joined #openstack-keystone | 21:56 | |
| *** SamYaple has joined #openstack-keystone | 22:01 | |
| *** SamYaple has quit IRC | 22:06 | |
| *** SamYaple has joined #openstack-keystone | 22:06 | |
| *** thorst has joined #openstack-keystone | 22:22 | |
| *** sjain has joined #openstack-keystone | 22:23 | |
| *** sjain has quit IRC | 22:31 | |
| *** thorst has quit IRC | 22:41 | |
| *** shuyingya has joined #openstack-keystone | 22:47 | |
| *** shuyingya has quit IRC | 22:51 | |
| *** rajpatel is now known as rajpatel_away | 23:37 | |
| *** thorst has joined #openstack-keystone | 23:39 | |
| *** thorst has quit IRC | 23:43 | |
| *** thorst has joined #openstack-keystone | 23:56 | |
| morgan | ayoung: <releasenotename>-deadbeefdeadbeefdeadbeef.yml | 23:56 |
| morgan | simple | 23:57 |
| *** thorst has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!