| *** ducttap__ has quit IRC | 00:07 | |
| *** ducttape_ has joined #openstack-keystone | 00:17 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs master: Update project-tags spec https://review.openstack.org/484529 | 00:19 |
|---|---|---|
| *** ducttape_ has quit IRC | 00:21 | |
| *** ducttape_ has joined #openstack-keystone | 00:22 | |
| *** boris-42__ has quit IRC | 00:27 | |
| *** ducttape_ has quit IRC | 00:27 | |
| *** dave-mccowan has quit IRC | 00:42 | |
| *** phalmos has joined #openstack-keystone | 00:43 | |
| *** lucasxu has joined #openstack-keystone | 00:45 | |
| *** lucasxu has quit IRC | 00:45 | |
| *** thorst has joined #openstack-keystone | 00:46 | |
| *** dave-mccowan has joined #openstack-keystone | 00:46 | |
| *** thorst has quit IRC | 00:51 | |
| *** ducttape_ has joined #openstack-keystone | 01:01 | |
| *** daidv__ has quit IRC | 01:05 | |
| *** ducttape_ has quit IRC | 01:12 | |
| *** ducttape_ has joined #openstack-keystone | 01:17 | |
| *** daidv__ has joined #openstack-keystone | 01:21 | |
| *** ducttape_ has quit IRC | 01:21 | |
| *** harlowja has quit IRC | 01:34 | |
| *** namnh has joined #openstack-keystone | 01:34 | |
| namnh | breton: hi boris | 01:39 |
| namnh | are you here? | 01:39 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 01:55 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient master: Updated from global requirements https://review.openstack.org/484577 | 01:56 |
| *** dave-mccowan has quit IRC | 02:02 | |
| *** zhurong has joined #openstack-keystone | 02:05 | |
| *** otleimat has quit IRC | 02:05 | |
| *** samueldmq_ has joined #openstack-keystone | 02:06 | |
| *** vryzhenkin has joined #openstack-keystone | 02:12 | |
| *** mancdaz_ has joined #openstack-keystone | 02:12 | |
| *** _d34dh0r53_ has joined #openstack-keystone | 02:12 | |
| *** d34dh0r53 has quit IRC | 02:13 | |
| *** mancdaz has quit IRC | 02:13 | |
| *** diablo_rojo_phon has quit IRC | 02:13 | |
| *** samueldmq has quit IRC | 02:13 | |
| *** freerunner has quit IRC | 02:13 | |
| *** mancdaz_ is now known as mancdaz | 02:13 | |
| *** vryzhenkin is now known as freerunner | 02:13 | |
| *** samueldmq_ is now known as samueldmq | 02:14 | |
| *** diablo_rojo_phon has joined #openstack-keystone | 02:14 | |
| *** ducttape_ has joined #openstack-keystone | 02:15 | |
| *** ducttape_ has quit IRC | 02:19 | |
| openstackgerrit | Eric Fried proposed openstack/keystoneauth master: Discourage 'version' and accept 'M.latest' https://review.openstack.org/483604 | 02:25 |
| *** dave-mccowan has joined #openstack-keystone | 02:26 | |
| *** rodrigods has quit IRC | 02:43 | |
| *** dave-mccowan has quit IRC | 02:44 | |
| *** thorst has joined #openstack-keystone | 02:47 | |
| *** thorst has quit IRC | 02:52 | |
| *** rodrigods has joined #openstack-keystone | 02:55 | |
| *** chlong has quit IRC | 03:11 | |
| *** prashkre has joined #openstack-keystone | 03:23 | |
| *** ducttape_ has joined #openstack-keystone | 03:28 | |
| *** markvoelker has quit IRC | 03:29 | |
| *** ducttap__ has joined #openstack-keystone | 03:30 | |
| *** ducttape_ has quit IRC | 03:34 | |
| *** harlowja has joined #openstack-keystone | 03:40 | |
| *** ducttap__ has quit IRC | 03:43 | |
| *** ducttape_ has joined #openstack-keystone | 03:48 | |
| *** thorst has joined #openstack-keystone | 03:48 | |
| *** ducttape_ has quit IRC | 03:52 | |
| *** thorst has quit IRC | 03:53 | |
| *** links has joined #openstack-keystone | 03:55 | |
| *** aselius has quit IRC | 04:17 | |
| *** prashkre has quit IRC | 04:28 | |
| *** prashkre has joined #openstack-keystone | 04:36 | |
| *** gyee has quit IRC | 04:44 | |
| *** nicolasbock has joined #openstack-keystone | 04:44 | |
| *** harlowja has quit IRC | 04:54 | |
| *** zzzeek has quit IRC | 04:55 | |
| *** prashkre has quit IRC | 04:59 | |
| *** zhurong has quit IRC | 05:00 | |
| *** aojea has joined #openstack-keystone | 05:02 | |
| *** aojea has quit IRC | 05:06 | |
| *** aojea has joined #openstack-keystone | 05:11 | |
| *** josecastroleon1 has joined #openstack-keystone | 05:12 | |
| *** josecastroleon has quit IRC | 05:15 | |
| *** aojea has quit IRC | 05:16 | |
| *** nicolasbock has quit IRC | 05:19 | |
| *** aojea has joined #openstack-keystone | 05:20 | |
| *** nicolasbock has joined #openstack-keystone | 05:21 | |
| *** aojea has quit IRC | 05:25 | |
| *** rcernin has joined #openstack-keystone | 05:29 | |
| *** aojea has joined #openstack-keystone | 05:29 | |
| *** markvoelker has joined #openstack-keystone | 05:30 | |
| *** aojea has quit IRC | 05:34 | |
| *** zzzeek has joined #openstack-keystone | 05:36 | |
| *** zzzeek has quit IRC | 05:37 | |
| *** zzzeek has joined #openstack-keystone | 05:38 | |
| *** mvpnitesh has joined #openstack-keystone | 05:43 | |
| *** aojea has joined #openstack-keystone | 05:45 | |
| *** thorst has joined #openstack-keystone | 05:49 | |
| *** ducttape_ has joined #openstack-keystone | 05:49 | |
| *** aojea has quit IRC | 05:50 | |
| *** zhurong has joined #openstack-keystone | 05:50 | |
| *** thorst has quit IRC | 05:53 | |
| *** ducttape_ has quit IRC | 05:53 | |
| *** aojea has joined #openstack-keystone | 06:03 | |
| *** markvoelker has quit IRC | 06:04 | |
| *** aojea has quit IRC | 06:08 | |
| *** aojea has joined #openstack-keystone | 06:13 | |
| openstackgerrit | LiChunlin proposed openstack/keystone master: Add a hacking rule for string interpolation at logging https://review.openstack.org/484250 | 06:15 |
| *** aojea has quit IRC | 06:17 | |
| openstackgerrit | M V P Nitesh proposed openstack/keystone master: Added support for a ``description`` attribute for V3 Identity Roles https://review.openstack.org/484348 | 06:19 |
| *** phalmos has quit IRC | 06:37 | |
| *** markvoelker has joined #openstack-keystone | 07:02 | |
| openstackgerrit | Merged openstack/oslo.policy master: Updated from global requirements https://review.openstack.org/484569 | 07:07 |
| *** tesseract has joined #openstack-keystone | 07:18 | |
| *** aojea has joined #openstack-keystone | 07:20 | |
| *** markvoelker has quit IRC | 07:34 | |
| *** thorst has joined #openstack-keystone | 07:50 | |
| *** thorst has quit IRC | 07:54 | |
| *** mvpnitesh has quit IRC | 07:57 | |
| *** mvk has quit IRC | 08:27 | |
| *** tobberydberg has joined #openstack-keystone | 08:30 | |
| *** markvoelker has joined #openstack-keystone | 08:32 | |
| *** zhurong has quit IRC | 08:44 | |
| *** mvk has joined #openstack-keystone | 08:55 | |
| *** mvpnitesh has joined #openstack-keystone | 08:57 | |
| *** markvoelker has quit IRC | 09:05 | |
| *** ma9_1 has joined #openstack-keystone | 09:12 | |
| *** tobberydberg has quit IRC | 09:14 | |
| *** clenimar has joined #openstack-keystone | 09:30 | |
| *** clenimar has left #openstack-keystone | 09:30 | |
| *** clenimar has joined #openstack-keystone | 09:30 | |
| *** mvk has quit IRC | 09:33 | |
| *** mvk has joined #openstack-keystone | 09:47 | |
| *** Dinesh_Bhor has quit IRC | 09:50 | |
| *** thorst has joined #openstack-keystone | 09:51 | |
| *** bhagyashris has quit IRC | 09:53 | |
| *** thorst has quit IRC | 09:55 | |
| *** markvoelker has joined #openstack-keystone | 10:01 | |
| *** thorst has joined #openstack-keystone | 10:12 | |
| *** thorst has quit IRC | 10:16 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 10:21 | |
| *** markvoelker has quit IRC | 10:34 | |
| *** zhurong has joined #openstack-keystone | 10:52 | |
| *** ducttape_ has joined #openstack-keystone | 11:00 | |
| *** thorst has joined #openstack-keystone | 11:03 | |
| *** raildo has joined #openstack-keystone | 11:03 | |
| openstackgerrit | Merged openstack/keystoneauth master: Expose valid_interfaces as a ListOpt for config files https://review.openstack.org/482743 | 11:04 |
| openstackgerrit | Merged openstack/keystoneauth master: Remove deprecated_since for interface and fix text https://review.openstack.org/484528 | 11:04 |
| openstackgerrit | Merged openstack/keystoneauth master: Remove kwargs from adapter.get_endpoint_data https://review.openstack.org/482744 | 11:04 |
| *** jistr is now known as jistr|tpb | 11:05 | |
| *** ducttape_ has quit IRC | 11:05 | |
| *** namnh has quit IRC | 11:05 | |
| *** dave-mccowan has joined #openstack-keystone | 11:17 | |
| *** dave-mccowan has quit IRC | 11:23 | |
| *** jistr|tpb is now known as jistr | 11:28 | |
| *** aojea has quit IRC | 11:29 | |
| *** markvoelker has joined #openstack-keystone | 11:32 | |
| openstackgerrit | Merged openstack/keystone master: Merged the caching subsections in admin docs https://review.openstack.org/483009 | 11:39 |
| openstackgerrit | Merged openstack/keystone master: Expanded the best practices subsection in devdocs https://review.openstack.org/476541 | 11:43 |
| openstackgerrit | Merged openstack/keystone master: Reorganised developer documentation https://review.openstack.org/476606 | 11:44 |
| *** bhagyashris has joined #openstack-keystone | 11:57 | |
| bhagyashris | mordred: Hi, morning. | 11:58 |
| *** chlong has joined #openstack-keystone | 12:00 | |
| *** jmlowe_ has quit IRC | 12:04 | |
| *** markvoelker has quit IRC | 12:05 | |
| *** clayton has quit IRC | 12:08 | |
| *** clayton has joined #openstack-keystone | 12:09 | |
| *** aojea has joined #openstack-keystone | 12:24 | |
| *** edmondsw has joined #openstack-keystone | 12:29 | |
| *** aojea has quit IRC | 12:29 | |
| mordred | morning bhagyashris | 12:32 |
| *** markvoelker has joined #openstack-keystone | 12:33 | |
| *** aojea has joined #openstack-keystone | 12:33 | |
| *** aojea has quit IRC | 12:38 | |
| *** jmlowe has joined #openstack-keystone | 12:38 | |
| bhagyashris | mordred: I have added request_id_logger as per the our discussion the changes I have made in keystoneauth is: http://paste.openstack.org/show/615711/ and now I am able to see the log in the service log which I have pasted here: http://paste.openstack.org/show/615712/. so Can you please guide me what exactly should I do to log the request_id in the service log? | 12:40 |
| *** aojea has joined #openstack-keystone | 12:42 | |
| *** aojea has quit IRC | 12:47 | |
| *** mvpnitesh has quit IRC | 12:49 | |
| *** catintheroof has joined #openstack-keystone | 12:51 | |
| bhagyashris | mordred: Please ref the links: Changes made in keystoneauth: http://paste.openstack.org/show/615714/ and n-api service log link: http://paste.openstack.org/show/615715/ | 12:55 |
| *** catintheroof has quit IRC | 12:58 | |
| *** ducttape_ has joined #openstack-keystone | 13:02 | |
| *** ayoung has joined #openstack-keystone | 13:02 | |
| *** catintheroof has joined #openstack-keystone | 13:06 | |
| *** ducttape_ has quit IRC | 13:06 | |
| *** bknudson has joined #openstack-keystone | 13:06 | |
| *** aojea has joined #openstack-keystone | 13:09 | |
| *** catintheroof has quit IRC | 13:11 | |
| lbragstad | o/ | 13:13 |
| *** aojea has quit IRC | 13:14 | |
| *** aojea has joined #openstack-keystone | 13:19 | |
| samueldmq | morning keystone | 13:19 |
| samueldmq | lbragstad: o/ | 13:19 |
| *** aojea has quit IRC | 13:24 | |
| *** nicolasbock has quit IRC | 13:27 | |
| *** zhurong has quit IRC | 13:28 | |
| *** nicolasbock has joined #openstack-keystone | 13:28 | |
| *** lucasxu has joined #openstack-keystone | 13:31 | |
| *** nicolasbock has quit IRC | 13:32 | |
| knikolla | o/ | 13:33 |
| *** nicolasbock has joined #openstack-keystone | 13:35 | |
| *** ma9_ has joined #openstack-keystone | 13:35 | |
| *** links has quit IRC | 13:38 | |
| *** ma9_1 has quit IRC | 13:38 | |
| *** ma9_ has quit IRC | 13:40 | |
| *** ma9_ has joined #openstack-keystone | 13:41 | |
| *** ma9_ has quit IRC | 13:44 | |
| knikolla | gagehugo: regarding https://bugs.launchpad.net/keystone/+bug/1702211 . did you reproduce it by running that test only individually? | 13:45 |
| openstack | Launchpad bug 1702211 in OpenStack Identity (keystone) "test_password_history_not_enforced_in_admin_reset failed in tempest test" [Undecided,Confirmed] | 13:45 |
| *** aojea has joined #openstack-keystone | 13:47 | |
| *** aojea has quit IRC | 13:47 | |
| *** aojea has joined #openstack-keystone | 13:47 | |
| *** ma9_ has joined #openstack-keystone | 13:48 | |
| *** ma9_1 has joined #openstack-keystone | 13:51 | |
| *** catintheroof has joined #openstack-keystone | 13:51 | |
| *** ma9_ has quit IRC | 13:55 | |
| *** ducttape_ has joined #openstack-keystone | 13:57 | |
| *** ma9_1 has quit IRC | 14:00 | |
| gagehugo | knikolla yeah, I didn't make any progress though after that | 14:07 |
| knikolla | gagehugo: hmm… that excludes race conditions with other tests | 14:12 |
| *** ducttape_ has quit IRC | 14:15 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone master: DO NOT MERGE: Test commit for new CI job https://review.openstack.org/484823 | 14:32 |
| *** ducttap__ has joined #openstack-keystone | 14:32 | |
| *** aselius has joined #openstack-keystone | 14:33 | |
| openstackgerrit | Eric Fried proposed openstack/keystoneauth master: Discourage 'version' and accept 'M.latest' https://review.openstack.org/483604 | 14:45 |
| *** otleimat has joined #openstack-keystone | 15:00 | |
| morgan | mmm hi | 15:03 |
| * mordred sees a morgan | 15:03 | |
| morgan | lbragstad: eyes on https://review.openstack.org/#/c/483514/ to see if this is a reasonable direction before I build the test suite | 15:03 |
| morgan | should be straight-forward (basically take a catalog from the SQL backend and construct the YAML for it, then check to make sure everything is the same, except IDs (since those are programatically generated) | 15:04 |
| mordred | morgan: ++ | 15:06 |
| morgan | mordred: and... frankly... if this works... i would love for it to be the default choice of backend [long term] | 15:08 |
| mordred | morgan: ++ it's a better choice for backend for the general case | 15:08 |
| morgan | if we do a v4 keystone, i expect the catalog backend to be much simpler | 15:08 |
| morgan | no more endpoint filtering... | 15:08 |
| morgan | etc | 15:08 |
| morgan | mordred: ideally (if we had a consistent choice for DLM that will be in every cloud </rant>) I would use something like ZK or consul to populate the catalog via active connections in middleware. | 15:09 |
| morgan | but i like yaml-filesystem catalog data as a close second. | 15:10 |
| lbragstad | morgan: ++ | 15:10 |
| mordred | morgan: we do have a consistent choice for DLM that will be in every cloud | 15:11 |
| mordred | morgan: it got decided that openstack clouds can count on etcd existing / being a hard requirement | 15:11 |
| mordred | I don't konw all the details - dims has been driving that more | 15:12 |
| lbragstad | nice | 15:12 |
| breton | what's wrong with endpoint filtering? What was the reason we implemented it in the first place? | 15:12 |
| lbragstad | breton: it was a way to filter the catalog based on your role assignments | 15:12 |
| lbragstad | has anyone here taken the plunge to f26, yet? | 15:13 |
| dims | mordred : morgan : when queens opens up, we should encourage projects to depend directly on etcd3, all the infra and background work is done and ready | 15:13 |
| mordred | dims: ossum | 15:13 |
| lbragstad | cc dstanek? | 15:14 |
| morgan | mordred: bleh, the worst of the choices for what i wanted imo | 15:15 |
| morgan | mordred: but *shrug* | 15:15 |
| morgan | breton: we implemented it because a certain organisation wanted it, and it never really grew much support because it wasn't used/is-now-irrelevant-in-almost-any-scenario | 15:16 |
| *** bknudson has left #openstack-keystone | 15:17 | |
| *** bknudson has joined #openstack-keystone | 15:21 | |
| breton | i wonder how much of our stuff is there, but not used. | 15:22 |
| breton | endpoint policies? | 15:25 |
| breton | x.509? (/me sighs) | 15:25 |
| breton | ec2/s3? | 15:25 |
| breton | credentials? | 15:25 |
| breton | oauth1? | 15:25 |
| breton | lets have v4 and throw it all away | 15:27 |
| morgan | pretty much, but we can't delete v3 | 15:27 |
| morgan | we can make a clean(er) v4. | 15:28 |
| morgan | but the v3 stuff will need to be maintained forever(tm) | 15:28 |
| breton | we can after some years | 15:28 |
| *** bknudson has left #openstack-keystone | 15:28 | |
| breton | like v2 | 15:28 |
| morgan | nope. | 15:28 |
| morgan | as per the TC, we cannot delete an API. V2 is a special case. | 15:29 |
| morgan | at least AFAIU | 15:29 |
| morgan | i know v2 was a special case because it is deemed insecure and has other holes in it | 15:29 |
| morgan | that cannot easily be fixed. | 15:29 |
| morgan | that are addressed in v3 | 15:30 |
| breton | what holes for example? | 15:30 |
| raildo | global admin for example, we didn't had a proper token scope on v2 | 15:31 |
| *** bknudson has joined #openstack-keystone | 15:31 | |
| lbragstad | we still don't | 15:31 |
| *** rcernin has quit IRC | 15:32 | |
| raildo | yeap, but it's much better than on v2 | 15:33 |
| lbragstad | i think we can at least fix it in v3 without a major version rev | 15:33 |
| lbragstad | it's just going to take a lot of work | 15:33 |
| raildo | ++ | 15:34 |
| *** mvk has quit IRC | 15:34 | |
| morgan | v2 has 2 roles: admin/member | 15:35 |
| morgan | v2 exposes data (tokens) in the URL. | 15:35 |
| morgan | you can technically auth for a non-default domain by id in v2 | 15:35 |
| morgan | which has a lot of weird implications (not massive security hole...but...not a good behavior) | 15:35 |
| morgan | the CRUD management of v2 was all over the place | 15:35 |
| morgan | OS-KSADM/<thing> | 15:36 |
| morgan | and something not under OS-KS... prefixes | 15:36 |
| breton | well, 2 roles thing is not a hole. A lot of small deployments use only member and admin. Domains became a hole only because v3 was added :) API inconsistency was bad, right. | 15:37 |
| bknudson | has web application authentication changed enough over the years that a more industry-standard technique is the way to go? | 15:37 |
| bknudson | it's time to re-think openstack auth. | 15:38 |
| breton | what is industry-standard technique? | 15:38 |
| * breton feels out of industry | 15:38 | |
| bknudson | lots of systems are going to openid connect | 15:38 |
| morgan | bknudson: the 2 roles are an issue... because it is hard-coded basically | 15:39 |
| morgan | s/bknudson/breton | 15:39 |
| morgan | sorry brant :P | 15:40 |
| morgan | OIDC and OAUTH2 (and SAML for more enterpris-y things) are the standards i see everywhere | 15:40 |
| morgan | but for that to work, you would need to either grant auth to each API you'd want to use and/or have the API under a single pane of glass (which is not guaranteed in openstack land) | 15:41 |
| morgan | but mostly, it's pre-auth+sessions | 15:41 |
| bknudson | we should also re-think auth. I haven't looked into oauth2 enough to know how the auth works (apparently there's an auth part to the token) | 15:43 |
| bknudson | at this point I think an auth service is the way to go… more soa / microservices if that's what we're calling ourselves | 15:44 |
| bknudson | we'd also need a service for projects. | 15:45 |
| lbragstad | yeah | 15:45 |
| bknudson | (since that's part of openstack and not general auth) | 15:45 |
| lbragstad | right | 15:45 |
| lbragstad | that seems fine - but i think it would be valuable to offer oauth2 | 15:46 |
| lbragstad | at least as a way to minimize openstack-isms | 15:46 |
| bknudson | yes, I think that should be our goal. | 15:47 |
| lbragstad | since project, and especially HMT, is an openstack-ism we should keep that, but offloading common things in favor of existing wheels would be nice | 15:48 |
| lbragstad | (if possible) | 15:48 |
| lbragstad | i really need to just take a weekend and try and map out what it would take to apply oauth2 to openstack in a way that makes sense | 15:49 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move auth plugin development doc to contrib guide https://review.openstack.org/484168 | 15:50 |
| gagehugo | I will be missing the keystone meeting today | 15:50 |
| lbragstad | gagehugo: thanks for the heads up | 15:51 |
| openstackgerrit | Merged openstack/keystone master: Reorganised api-ref index page https://review.openstack.org/483409 | 15:53 |
| *** brad[] has quit IRC | 16:00 | |
| *** rcernin has joined #openstack-keystone | 16:02 | |
| *** aojea has quit IRC | 16:02 | |
| openstackgerrit | Sean Dague proposed openstack/keystoneauth master: Add ability to specify a microversion in a request https://review.openstack.org/482746 | 16:11 |
| openstackgerrit | Merged openstack/keystoneauth master: Minor cleanup https://review.openstack.org/478621 | 16:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move development environment setup to contributor docs https://review.openstack.org/481405 | 16:23 |
| *** lwanderley has joined #openstack-keystone | 16:23 | |
| *** ducttape_ has joined #openstack-keystone | 16:24 | |
| *** ducttap__ has quit IRC | 16:28 | |
| *** Adri2000 has quit IRC | 16:30 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move development environment setup to contributor docs https://review.openstack.org/481405 | 16:31 |
| edmondsw | lbragstad I'm looking at a bug where during processing of a project deleted event I need to know what domain that project was in... is there some cache I can pull that from or would we have to modify the even notification to include that information? | 16:38 |
| lbragstad | edmondsw: that's a tricky one | 16:39 |
| edmondsw | yeah... | 16:39 |
| lbragstad | edmondsw: because by the time you get the notification the projects is already gone | 16:39 |
| lbragstad | so making a request to get any information about it isn't going to work | 16:39 |
| edmondsw | yeah, that's what I was afraid of | 16:40 |
| *** brad[] has joined #openstack-keystone | 16:40 | |
| lbragstad | edmondsw: there is a work around | 16:40 |
| lbragstad | edmondsw: i had a couple really good discussions with folks that presented a couple different options | 16:40 |
| lbragstad | i ended up writing about them hoping to get some feedback | 16:40 |
| lbragstad | https://www.lbragstad.com/blog/improving-auditing-in-keystone | 16:41 |
| edmondsw | :) I'll read up | 16:42 |
| edmondsw | the bug (not yet opened) is that https://github.com/openstack/keystone/commit/51d5597df729158d15b71e2ba80ab103df5d55f8 uses the default driver, whereas it needs to lookup the driver for that project's domain to actually work properly | 16:42 |
| lbragstad | edmondsw: option #2 would give you a solution today without any modifications to keystone | 16:43 |
| edmondsw | lbragstad I don't think that works here. We can't require an operator to set all that up for keystone to work properly | 16:45 |
| edmondsw | i.e. to fix this bug | 16:45 |
| edmondsw | if we were talking about adding a feature, maybe | 16:45 |
| lbragstad | what needs the domain of the project? | 16:47 |
| lbragstad | the consuming application? | 16:47 |
| edmondsw | keystone itself | 16:47 |
| edmondsw | see my comment above @ 12:42 | 16:47 |
| lbragstad | looking at the patch | 16:48 |
| openstackgerrit | Merged openstack/keystoneauth master: Add support for next_min_version and not_before https://review.openstack.org/482745 | 16:48 |
| lbragstad | edmondsw: what do you have configured for resource backends? | 16:50 |
| lbragstad | i'm assuing identity is using sql/ | 16:50 |
| lbragstad | assuming* sql? | 16:51 |
| edmondsw | nope | 16:51 |
| edmondsw | I saw this problem with a custom driver, but it doesn't really matter | 16:51 |
| edmondsw | the current impl will always try to use the default driver instead of using the driver for the domain of the project | 16:52 |
| edmondsw | e.g. if you setup LDAP as the default driver, you'd use the ldap driver instead of sql, even if the project was actually from a different domain that uses the sql driver | 16:52 |
| lbragstad | ok - so soft deletes don't really help us much in this case | 16:53 |
| lbragstad | well - i suppose they kind of do | 16:53 |
| edmondsw | yeah, they would | 16:54 |
| lbragstad | because the request for the deleted project would come in through the whole API | 16:55 |
| lbragstad | and I assume there is logic to find the domain of the project | 16:56 |
| lbragstad | built into that path already | 16:56 |
| lbragstad | i'm tempted to say that this is one edge case where it might be acceptable to put the domain id of the project that was removed into the notification | 16:58 |
| edmondsw | lbragstad actually, maybe we don't need the domain_id here... maybe we just call this for all configured domains | 16:58 |
| edmondsw | I was confusing project domain with user domain... we care about the user domain here, not the project domain | 16:59 |
| lbragstad | ohhhh | 16:59 |
| edmondsw | yeah, that helps :) | 16:59 |
| lbragstad | ok - hold on | 16:59 |
| lbragstad | ... yeah - the project is already going to be gone, right? | 16:59 |
| lbragstad | the callback is to set the default_project_id for a user if that project no longer exists to none | 17:00 |
| edmondsw | right | 17:01 |
| edmondsw | and we need to do that for users in all domains | 17:01 |
| edmondsw | not just one | 17:01 |
| lbragstad | so - what's the right thing to do in that case? | 17:01 |
| edmondsw | loop through every domain config and do it for all of them? | 17:01 |
| *** agrebennikov has joined #openstack-keystone | 17:01 | |
| *** agrebennikov has quit IRC | 17:02 | |
| lbragstad | this is using multiple identity backends | 17:02 |
| lbragstad | per domain | 17:02 |
| lbragstad | so LDAP per domain | 17:02 |
| *** agrebennikov has joined #openstack-keystone | 17:02 | |
| lbragstad | for example | 17:02 |
| edmondsw | right | 17:02 |
| edmondsw | so we need to go do the cleanup in each of those domains | 17:02 |
| edmondsw | s/domains/backends/ | 17:02 |
| lbragstad | that's weird | 17:03 |
| edmondsw | why? | 17:03 |
| lbragstad | sorry - what you said isn't weird | 17:03 |
| lbragstad | i was thinking about the relationship and it feels circular (?) | 17:03 |
| lbragstad | because domains own projects | 17:03 |
| lbragstad | and domains own users | 17:03 |
| lbragstad | and a user can have a default project | 17:04 |
| lbragstad | is there anything stopping a user from having a default project outside their domain? | 17:04 |
| lbragstad | i.e. say Bob is in the Acme backend which puts him in the Acme domain | 17:05 |
| lbragstad | and Alice is in the Foo backend, which puts her in the Foo domain | 17:05 |
| edmondsw | the fact that we use domains for both projects and users constantly confuses everyone | 17:05 |
| edmondsw | :) | 17:05 |
| edmondsw | same entity, totally different and unrelated usage | 17:06 |
| edmondsw | it's awful | 17:06 |
| edmondsw | a user in domain A can have roles on projects in any domain | 17:06 |
| lbragstad | if there is a Bar domain that has a Baz project, and Bob has a role on the Bar domain and the Baz project, that could be set as his default project id | 17:06 |
| *** jistr is now known as jistr|off | 17:06 | |
| lbragstad | ^ that's essentially how you'd recreate the bug, right? | 17:07 |
| lbragstad | because when you delete the Baz project, it should set Bob's default project ID to None | 17:08 |
| edmondsw | think of it like this... I create 3 domains, with the default using sql driver, 2nd using LDAP for ldap_server_1 and 3rd using LDAP for ldap_server_2 | 17:10 |
| edmondsw | I have users in each of those, and some of the users in each of those are setup with default project_id as project foo | 17:10 |
| edmondsw | when foo gets deleted, I need to update the users in all of those backends to no longer use foo as their default project | 17:11 |
| edmondsw | lbragstad ^ make sense? | 17:11 |
| lbragstad | yeah - that makes sense | 17:11 |
| lbragstad | does the current callback not loop through all domains? | 17:12 |
| lbragstad | or all backends? | 17:12 |
| edmondsw | opened https://bugs.launchpad.net/keystone/+bug/1705072 and included that example | 17:13 |
| openstack | Launchpad bug 1705072 in OpenStack Identity (keystone) "clearing default project_id from users using wrong driver implementation" [Undecided,New] | 17:13 |
| edmondsw | lbragstad no it just uses the default domain backend | 17:13 |
| edmondsw | that's the bug | 17:13 |
| *** ducttap__ has joined #openstack-keystone | 17:19 | |
| *** ducttape_ has quit IRC | 17:22 | |
| *** harlowja has joined #openstack-keystone | 17:24 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Added index.rst in each sub-directory https://review.openstack.org/484157 | 17:25 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Add ability to specify a microversion in a request https://review.openstack.org/482746 | 17:26 |
| *** reedip_ has joined #openstack-keystone | 17:30 | |
| reedip_ | hi guys | 17:30 |
| reedip_ | I am getting the following error in keystone.log | 17:30 |
| reedip_ | User 6051be91029c4673b7eb0e6778177790 has no access to project f22f9b5338ba49239b7bf64cfcfa86c3 _populate_roles /usr/lib/python2.7/dist-packages/keystone/token/providers/common.py:454 | 17:31 |
| reedip_ | Any pointers how to resolve this? | 17:31 |
| *** nicolasbock has quit IRC | 17:35 | |
| *** nicolasbock has joined #openstack-keystone | 17:36 | |
| *** bknudson has quit IRC | 17:38 | |
| lbragstad | reedip_: that's telling you that the user in question doesn't have any role assignments on the project they are attempting to scope to | 17:41 |
| reedip_ | lbragstad : I assigned admin role to that user using openstack role add --user UID --project PID | 17:42 |
| lbragstad | when you list role assignment - do you see that assignment? | 17:43 |
| reedip_ | lbragstad : how do I list role assignment ? | 17:44 |
| lbragstad | reedip_: https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/role-assignment.html | 17:45 |
| reedip_ | lbragstad : checking , can you give me 2 min of your time for the same? | 17:45 |
| lbragstad | reedip_: yeah - just post your update here | 17:46 |
| reedip_ | lbragstad : ohk , so the project field is empty | 17:48 |
| reedip_ | Its a long value but I can see the project and group is empty | 17:49 |
| lbragstad | reedip_: if you do `openstack role assignment list` it should give you all role assignments | 17:49 |
| reedip_ | It does, but for this user, it shows the domain but nothing in the project | 17:50 |
| lbragstad | `openstack role assignment list --user 6051be91029c4673b7eb0e6778177790` should give you the ones specific to the user in question | 17:50 |
| lbragstad | ah | 17:50 |
| lbragstad | so - that user doesn't actually have a role assignment on project f22f9b5338ba49239b7bf64cfcfa86c3 | 17:51 |
| reedip_ | yep | 17:51 |
| reedip_ | so should I execute role add again ? | 17:51 |
| lbragstad | reedip_: yeah - or investigate why it didn't work the first time you did it? | 17:51 |
| reedip_ | ok , thanks :) | 17:51 |
| lbragstad | is f22f9b5338ba49239b7bf64cfcfa86c3 a project or a domain? | 17:51 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Add ability to specify a microversion in a request https://review.openstack.org/482746 | 17:52 |
| *** spilla_ has joined #openstack-keystone | 17:52 | |
| reedip_ | its a project | 17:52 |
| *** bknudson has joined #openstack-keystone | 17:53 | |
| lbragstad | reedip_: ok - just double checking | 17:53 |
| reedip_ | :) | 17:53 |
| *** tesseract has quit IRC | 17:58 | |
| *** sjain_ has joined #openstack-keystone | 17:59 | |
| *** deep-book-gk_ has joined #openstack-keystone | 18:09 | |
| *** deep-book-gk_ has left #openstack-keystone | 18:09 | |
| *** lwanderley has quit IRC | 18:13 | |
| lbragstad | announcement: office hours will be starting in 40 minutes | 18:21 |
| knikolla | cool | 18:21 |
| openstackgerrit | Eric Fried proposed openstack/keystoneauth master: Discourage 'version' and accept 'M.latest' https://review.openstack.org/483604 | 18:27 |
| lbragstad | #startmeeting keystone-office-hours | 19:00 |
| openstack | Meeting started Tue Jul 18 19:00:02 2017 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. | 19:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 19:00 |
| openstack | The meeting name has been set to 'keystone_office_hours' | 19:00 |
| lbragstad | alright - who's around for office hours? | 19:00 |
| knikolla | o/ | 19:00 |
| gagehugo | o/ | 19:02 |
| *** chlong_ has joined #openstack-keystone | 19:03 | |
| lbragstad | o/ | 19:03 |
| lbragstad | alright i'm working on trying to recreate https://bugs.launchpad.net/keystone/+bug/1694589 | 19:04 |
| openstack | Launchpad bug 1694589 in OpenStack Identity (keystone) "Federation protocol creation gives error" [Undecided,New] | 19:04 |
| lbragstad | #link https://bugs.launchpad.net/keystone/+bug/1694589 | 19:05 |
| *** chlong has quit IRC | 19:05 | |
| *** sjain_ has quit IRC | 19:06 | |
| *** reedip_ has quit IRC | 19:12 | |
| *** gyee has joined #openstack-keystone | 19:17 | |
| gagehugo | I will be helping with project tags mostly but feel free to ping me | 19:17 |
| lbragstad | gagehugo: sounds good - no worries | 19:18 |
| lbragstad | knikolla: you're an ldap guy | 19:23 |
| lbragstad | right? | 19:23 |
| knikolla | lbragstad: i wear that hat in keystone since, but don't have much experience outside | 19:23 |
| * lbragstad slaps an "LDAP Expert" sticker on knikolla | 19:24 | |
| lbragstad | knikolla: thoughts - https://bugs.launchpad.net/keystone/+bug/1704205 ? | 19:24 |
| openstack | Launchpad bug 1704205 in OpenStack Identity (keystone) "GET /v3/role_assignments?effective&include_names API fails with unexpected 500 error" [Undecided,New] | 19:24 |
| *** bknudson has quit IRC | 19:25 | |
| knikolla | looking | 19:28 |
| knikolla | lbragstad: seems like an easy fix | 19:28 |
| lbragstad | knikolla: which part? | 19:29 |
| *** zzzeek has quit IRC | 19:29 | |
| knikolla | lbragstad: what i had in mind before reading the comments. reading the comments now. | 19:29 |
| *** zzzeek has joined #openstack-keystone | 19:30 | |
| knikolla | lbragstad: i prefer the ' ' approach. | 19:34 |
| lbragstad | knikolla: versus using '<missing>' | 19:34 |
| knikolla | lbragstad: similar to https://review.openstack.org/#/c/458954/ | 19:35 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone master: Updated from global requirements https://review.openstack.org/484553 | 19:35 |
| knikolla | <missing> is a special string. an empty string is an empty string. | 19:36 |
| lbragstad | knikolla: yeah - i don't like the '<missing>' approach | 19:36 |
| knikolla | the issue is where else will the app break with a missing name | 19:37 |
| lbragstad | knikolla: the trick is going to be finding all those places and accounting for it | 19:37 |
| lbragstad | and by it, I mean accounting for a misconfigured LDAP installation | 19:37 |
| knikolla | lbragstad: yeah. where would we draw the line. | 19:40 |
| knikolla | i think also having this as wont fix is acceptable. | 19:41 |
| lbragstad | if we did filter within keystone - i would think logging each user that doesn't have a name attribute from LDAP is acceptable | 19:41 |
| knikolla | lbragstad: or treat the user as disabled if required attributes are missing. | 19:43 |
| lbragstad | knikolla: yeah - logging in addition to ignoring the user completely in keysotne | 19:44 |
| *** nicolasbock has quit IRC | 19:53 | |
| lbragstad | knikolla: edmondsw adjusted the priority https://bugs.launchpad.net/keystone/+bug/1704205 | 19:57 |
| openstack | Launchpad bug 1704205 in OpenStack Identity (keystone) "GET /v3/role_assignments?effective&include_names API fails with unexpected 500 error" [Low,Triaged] | 19:57 |
| *** dave-mccowan has joined #openstack-keystone | 19:58 | |
| edmondsw | lbragstad I'm going to try to find time to work on that, or get someone else around here to do so. And don't be surprised if we ask about backporting once it's fixed | 19:59 |
| edmondsw | may be low for you, but it's actually a pretty significant problem for us | 19:59 |
| lbragstad | edmondsw: backporting to ocata should be fine if we get the fix in before pike releases | 19:59 |
| lbragstad | edmondsw: i'm going to target it to pike-3 then | 19:59 |
| edmondsw | tx | 20:00 |
| knikolla | hmm… it will change behaviour. but of something which is broken. so should be fine. | 20:00 |
| lbragstad | knikolla: the behavior is a 500 right now | 20:00 |
| knikolla | exactly | 20:00 |
| edmondsw | yeah... no interop concern there, at least ;) | 20:00 |
| lbragstad | it would effectively fall under the first group here - http://specs.openstack.org/openstack/api-wg/guidelines/api_interoperability.html#evaluating-api-changes | 20:02 |
| lbragstad | #link http://specs.openstack.org/openstack/api-wg/guidelines/api_interoperability.html#evaluating-api-changes | 20:02 |
| lbragstad | knikolla: ^ | 20:02 |
| knikolla | yup | 20:02 |
| *** bknudson has joined #openstack-keystone | 20:05 | |
| *** Dinesh_Bhor has quit IRC | 20:17 | |
| *** dave-mccowan has quit IRC | 20:17 | |
| * cmurphy waves to office hours crowd | 20:17 | |
| *** dave-mccowan has joined #openstack-keystone | 20:24 | |
| knikolla | cmurphy: o/ | 20:27 |
| *** dave-mccowan has quit IRC | 20:27 | |
| *** spilla_ has quit IRC | 20:39 | |
| lbragstad | cmurphy: o/ | 20:45 |
| lbragstad | cmurphy: fwiw - i'm going through all new/untriaged bugs | 20:45 |
| *** raildo has quit IRC | 20:48 | |
| cmurphy | lbragstad: i'm reviewing mordredcode | 20:53 |
| *** rcernin has quit IRC | 20:57 | |
| lbragstad | cmurphy: ksa? | 20:57 |
| cmurphy | lbragstad: yup | 20:59 |
| lbragstad | nice | 20:59 |
| lbragstad | that's good because we're going to have to get a release together next week | 21:00 |
| lbragstad | for python-keystoneclient and keystoneauth | 21:00 |
| *** lucasxu has quit IRC | 21:02 | |
| *** lucasxu has joined #openstack-keystone | 21:06 | |
| *** ducttape_ has joined #openstack-keystone | 21:07 | |
| *** ducttap__ has quit IRC | 21:10 | |
| *** lucasxu has quit IRC | 21:17 | |
| *** blake has joined #openstack-keystone | 21:26 | |
| *** thorst has quit IRC | 21:30 | |
| *** thorst has joined #openstack-keystone | 21:42 | |
| *** thorst has quit IRC | 21:44 | |
| *** jmlowe has quit IRC | 21:46 | |
| * samueldmq is back | 21:51 | |
| samueldmq | lbragstad: office hours running now? | 21:51 |
| lbragstad | samueldmq: yessir | 21:51 |
| lbragstad | for another 9 minutes! | 21:51 |
| samueldmq | lbragstad: nice, anything that needs an extra couple of eyes on? | 21:52 |
| samueldmq | just 9 minutes left ? | 21:52 |
| morgan | hm. | 21:54 |
| morgan | samueldmq: can you look at https://review.openstack.org/#/c/483514/ and let me know if you see anything horribly wrong (looking for a couple spare eyes before writing the tests) | 21:55 |
| samueldmq | morgan: sure, looking | 21:56 |
| morgan | i am 100% positive some code will need to change. | 21:57 |
| morgan | because zero testing. | 21:57 |
| morgan | i'm looking for general direction good/bad/"WAIT WHAT WAS THAT?!?!" from folks before doing the next chunk of things which inc. testing | 21:57 |
| morgan | s/testing/writing tests/ | 21:57 |
| samueldmq | morgan: am I understanding it wrong or ... is that an attempt to get something towards a static global catalog for the future? | 21:58 |
| morgan | it is a method to do so | 21:58 |
| morgan | it replaces templated backend | 21:58 |
| morgan | with something that natively does v2/v3 catalogs | 21:58 |
| samueldmq | morgan: then I assume we are expecting people to adopt more that | 21:59 |
| morgan | and can accurately express most anything in the SQL catalog *except* endpoint groups, filtering, policy | 21:59 |
| morgan | we have ~3% of the folks still using templated | 21:59 |
| samueldmq | (as I dont think lots of folks use templated catalog as of today) | 21:59 |
| morgan | according to the last user poll | 21:59 |
| samueldmq | exactly | 21:59 |
| morgan | and a general desire to be able to continue using a CMS managed catalog | 21:59 |
| morgan | rather than an API driven one | 22:00 |
| morgan | the templated one has not been well tested and is extremely limited in what it can produce | 22:00 |
| morgan | part of why the templated one has limited use is because it has been semi-broken on an off. | 22:00 |
| lbragstad | #endmeeting | 22:01 |
| * morgan would encourage a CMS-driven catalog over SQL-based one for most use-cases. | 22:01 | |
| openstack | Meeting ended Tue Jul 18 22:01:23 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 22:01 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2017/keystone_office_hours.2017-07-18-19.00.html | 22:01 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/keystone_office_hours/2017/keystone_office_hours.2017-07-18-19.00.txt | 22:01 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2017/keystone_office_hours.2017-07-18-19.00.log.html | 22:01 |
| lbragstad | morgan: ++ | 22:03 |
| samueldmq | morgan: well, that sounds to be a sane idea to me :) | 22:11 |
| lbragstad | cc odyssey4me andymccr might be interested in some of that, too | 22:18 |
| * lbragstad steps away for a bit | 22:18 | |
| *** gyee has quit IRC | 22:20 | |
| samueldmq | morgan: I left a quick comment in the representation | 22:31 |
| samueldmq | of that yaml | 22:32 |
| *** gyee has joined #openstack-keystone | 22:38 | |
| *** edmondsw has quit IRC | 22:47 | |
| *** bknudson has quit IRC | 22:52 | |
| *** ducttape_ has quit IRC | 23:01 | |
| *** thorst has joined #openstack-keystone | 23:04 | |
| *** thorst has quit IRC | 23:06 | |
| *** ducttape_ has joined #openstack-keystone | 23:18 | |
| *** ducttap__ has joined #openstack-keystone | 23:20 | |
| *** ducttape_ has quit IRC | 23:20 | |
| *** ducttap__ has quit IRC | 23:24 | |
| *** catintheroof has quit IRC | 23:25 | |
| *** dave-mccowan has joined #openstack-keystone | 23:29 | |
| *** dave-mcc_ has joined #openstack-keystone | 23:37 | |
| *** dave-mccowan has quit IRC | 23:38 | |
| *** dave-mcc_ has quit IRC | 23:45 | |
| *** lucasxu has joined #openstack-keystone | 23:55 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!