| *** jmlowe has quit IRC | 00:19 | |
| -openstackstatus- NOTICE: due to unscheduled restart of zuulv3.o.o you will need to 'recheck' your jobs that were last running. Sorry for the inconvenience. | 00:32 | |
| *** rmcallis has joined #openstack-keystone | 00:33 | |
| *** aojea has joined #openstack-keystone | 00:47 | |
| *** aojea has quit IRC | 00:51 | |
| *** markvoelker_ has quit IRC | 00:53 | |
| *** markvoelker has joined #openstack-keystone | 00:54 | |
| *** thorst has joined #openstack-keystone | 00:57 | |
| *** markvoelker has quit IRC | 00:58 | |
| *** thorst has quit IRC | 01:02 | |
| *** thorst has joined #openstack-keystone | 01:03 | |
| *** thorst has quit IRC | 01:08 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 01:23 | |
| *** AlexeyAbashkin has quit IRC | 01:27 | |
| *** aojea has joined #openstack-keystone | 01:48 | |
| *** aojea has quit IRC | 01:52 | |
| *** thorst has joined #openstack-keystone | 02:03 | |
| *** thorst has quit IRC | 02:08 | |
| *** Shunli has joined #openstack-keystone | 02:18 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 02:23 | |
| *** AlexeyAbashkin has quit IRC | 02:27 | |
| *** pramodrj07 has quit IRC | 02:29 | |
| *** MasterOfBugs has quit IRC | 02:29 | |
| *** dave-mccowan has quit IRC | 02:44 | |
| *** namnh has joined #openstack-keystone | 02:46 | |
| *** chlong has quit IRC | 02:47 | |
| *** dave-mccowan has joined #openstack-keystone | 02:48 | |
| *** nicolasbock has quit IRC | 02:53 | |
| *** namnh has quit IRC | 02:56 | |
| *** namnh has joined #openstack-keystone | 02:57 | |
| *** thorst has joined #openstack-keystone | 03:04 | |
| *** wes_dillingham has quit IRC | 03:06 | |
| *** thorst has quit IRC | 03:09 | |
| *** jmlowe has joined #openstack-keystone | 03:12 | |
| *** openstackgerrit has quit IRC | 03:22 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 03:23 | |
| *** chrome0 has quit IRC | 03:25 | |
| *** AlexeyAbashkin has quit IRC | 03:27 | |
| *** chrome0 has joined #openstack-keystone | 03:31 | |
| *** rmcallis has quit IRC | 03:37 | |
| *** links has joined #openstack-keystone | 03:46 | |
| *** aojea has joined #openstack-keystone | 03:49 | |
| *** aojea has quit IRC | 03:54 | |
| *** rmcallis has joined #openstack-keystone | 04:11 | |
| *** rmcallis has quit IRC | 04:44 | |
| *** zsli_ has joined #openstack-keystone | 04:47 | |
| *** dave-mccowan has quit IRC | 04:47 | |
| *** Shunli has quit IRC | 04:50 | |
| *** aojea has joined #openstack-keystone | 04:50 | |
| *** aojea has quit IRC | 04:54 | |
| *** thorst has joined #openstack-keystone | 05:05 | |
| *** hyakuhei has quit IRC | 05:05 | |
| *** thorst has quit IRC | 05:10 | |
| *** josecastroleon has quit IRC | 05:10 | |
| *** josecastroleon has joined #openstack-keystone | 05:11 | |
| *** jmlowe has quit IRC | 05:28 | |
| *** markvoelker has joined #openstack-keystone | 05:35 | |
| *** markvoelker_ has joined #openstack-keystone | 05:37 | |
| *** markvoelker has quit IRC | 05:39 | |
| *** markvoelker_ has quit IRC | 05:46 | |
| *** markvoelker has joined #openstack-keystone | 05:47 | |
| *** markvoelker has quit IRC | 05:50 | |
| *** markvoelker has joined #openstack-keystone | 05:50 | |
| *** markvoelker has quit IRC | 05:51 | |
| *** aojea has joined #openstack-keystone | 05:51 | |
| *** aojea has quit IRC | 05:55 | |
| *** cfriesen has quit IRC | 06:32 | |
| *** belmoreira has joined #openstack-keystone | 06:40 | |
| *** pcaruana has joined #openstack-keystone | 06:45 | |
| *** markvoelker has joined #openstack-keystone | 06:45 | |
| *** thorst has joined #openstack-keystone | 06:58 | |
| *** josecastroleon has quit IRC | 06:59 | |
| *** josecastroleon has joined #openstack-keystone | 07:01 | |
| *** ioggstream has joined #openstack-keystone | 07:02 | |
| *** thorst has quit IRC | 07:03 | |
| *** tesseract has joined #openstack-keystone | 07:17 | |
| *** belmoreira has quit IRC | 07:26 | |
| *** hoonetorg has joined #openstack-keystone | 07:32 | |
| *** wasmum has joined #openstack-keystone | 07:34 | |
| *** aojea has joined #openstack-keystone | 07:38 | |
| *** aojea has quit IRC | 07:48 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:57 | |
| *** ppiela_ has joined #openstack-keystone | 08:04 | |
| *** ppiela has quit IRC | 08:04 | |
| *** akrzos has quit IRC | 08:07 | |
| *** akrzos has joined #openstack-keystone | 08:09 | |
| *** openstackgerrit has joined #openstack-keystone | 08:22 | |
| openstackgerrit | Shan Guo proposed openstack/keystone master: Remove v2.0 assignment schema https://review.openstack.org/512964 | 08:22 |
|---|---|---|
| *** clayton_ has joined #openstack-keystone | 08:27 | |
| *** clayton has quit IRC | 08:28 | |
| *** clayton_ is now known as clayton | 08:28 | |
| *** jrist has quit IRC | 08:30 | |
| *** mnaser has quit IRC | 08:30 | |
| *** Trident has joined #openstack-keystone | 08:36 | |
| *** aojea has joined #openstack-keystone | 08:44 | |
| *** mnaser has joined #openstack-keystone | 08:47 | |
| *** aojea has quit IRC | 08:48 | |
| *** david-lyle has quit IRC | 08:53 | |
| *** thorst has joined #openstack-keystone | 08:59 | |
| *** thorst has quit IRC | 09:04 | |
| *** zsli_ has quit IRC | 09:30 | |
| *** aojea has joined #openstack-keystone | 09:45 | |
| *** sapd__ has quit IRC | 09:45 | |
| *** sapd_ has joined #openstack-keystone | 09:45 | |
| *** sapd_ has quit IRC | 09:47 | |
| *** sapd_ has joined #openstack-keystone | 09:48 | |
| *** aojea has quit IRC | 09:49 | |
| *** AlexeyAbashkin has quit IRC | 09:49 | |
| *** mvk has quit IRC | 09:50 | |
| *** aojea has joined #openstack-keystone | 10:45 | |
| *** aojea has quit IRC | 10:50 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 10:55 | |
| *** thorst has joined #openstack-keystone | 11:00 | |
| *** chlong has joined #openstack-keystone | 11:01 | |
| *** namnh has quit IRC | 11:04 | |
| *** thorst has quit IRC | 11:05 | |
| *** jrist has joined #openstack-keystone | 11:09 | |
| *** zzzeek has quit IRC | 11:10 | |
| *** zzzeek has joined #openstack-keystone | 11:14 | |
| *** dave-mccowan has joined #openstack-keystone | 11:31 | |
| *** dave-mcc_ has joined #openstack-keystone | 11:35 | |
| *** dave-mccowan has quit IRC | 11:37 | |
| *** nicolasbock has joined #openstack-keystone | 11:40 | |
| *** aojea has joined #openstack-keystone | 11:46 | |
| *** belmoreira has joined #openstack-keystone | 11:50 | |
| *** aojea has quit IRC | 11:50 | |
| *** thorst has joined #openstack-keystone | 11:52 | |
| *** mvk has joined #openstack-keystone | 12:07 | |
| *** Dinesh_Bhor has quit IRC | 12:09 | |
| *** ppiela_ has quit IRC | 12:10 | |
| *** wes_dillingham has joined #openstack-keystone | 12:14 | |
| *** edmondsw has joined #openstack-keystone | 12:21 | |
| *** raildo has joined #openstack-keystone | 12:26 | |
| *** dave-mcc_ is now known as dave-mccowan | 12:29 | |
| *** jhesketh_ has joined #openstack-keystone | 12:38 | |
| *** jhesketh has quit IRC | 12:43 | |
| *** links has quit IRC | 12:44 | |
| *** clayton has quit IRC | 12:45 | |
| *** aojea has joined #openstack-keystone | 12:47 | |
| *** panbalag has joined #openstack-keystone | 12:47 | |
| *** panbalag has left #openstack-keystone | 12:48 | |
| *** clayton has joined #openstack-keystone | 12:49 | |
| *** aojea has quit IRC | 12:51 | |
| *** tommylikehu has quit IRC | 13:02 | |
| *** tommylikehu has joined #openstack-keystone | 13:03 | |
| *** belmoreira has quit IRC | 13:04 | |
| *** rmcallis has joined #openstack-keystone | 13:15 | |
| *** lbragstad has joined #openstack-keystone | 13:16 | |
| *** ChanServ sets mode: +o lbragstad | 13:16 | |
| *** rmcallis has quit IRC | 13:19 | |
| *** panbalag has joined #openstack-keystone | 13:31 | |
| lbragstad | wxy_: let me know if/when you want to visit with sdague about the unified limits stuff | 13:32 |
| *** rmascena has joined #openstack-keystone | 13:32 | |
| *** clenimar has joined #openstack-keystone | 13:35 | |
| *** raildo has quit IRC | 13:35 | |
| *** rmascena is now known as raildo | 13:40 | |
| dims | @lbragstad : wxy_ : i'd like to listen in too, ping me too please | 13:47 |
| lbragstad | dims: will do! | 13:47 |
| lbragstad | it'll be exciting to see that stuff work into the release :) | 14:05 |
| lbragstad | in queens rather | 14:05 |
| knikolla | o/ | 14:08 |
| dims | hey knikolla | 14:15 |
| *** ppiela has joined #openstack-keystone | 14:15 | |
| dims | when are you reaching sydney knikolla ? | 14:16 |
| knikolla | dims: i think on sunday | 14:16 |
| knikolla | i leave on friday and arrive on sunday. sounds like a fun trip. | 14:17 |
| knikolla | return flight on thursday evening. | 14:18 |
| *** rmascena has joined #openstack-keystone | 14:18 | |
| *** raildo has quit IRC | 14:20 | |
| *** ioggstream has quit IRC | 14:27 | |
| *** ppiela_ has joined #openstack-keystone | 14:28 | |
| *** ppiela has quit IRC | 14:28 | |
| *** ioggstream has joined #openstack-keystone | 14:29 | |
| *** erlon has joined #openstack-keystone | 14:32 | |
| *** david-lyle has joined #openstack-keystone | 14:38 | |
| *** phalmos has joined #openstack-keystone | 14:38 | |
| *** iogg has joined #openstack-keystone | 14:39 | |
| *** ioggstream has quit IRC | 14:39 | |
| dims | knikolla : ack, i reach sat. return thu as well | 14:45 |
| *** aojea has joined #openstack-keystone | 14:48 | |
| *** josecastroleon has quit IRC | 14:50 | |
| *** chlong has quit IRC | 14:52 | |
| *** aojea has quit IRC | 14:53 | |
| *** josecastroleon has joined #openstack-keystone | 14:53 | |
| *** rmascena is now known as raildo | 14:56 | |
| *** cfriesen has joined #openstack-keystone | 14:56 | |
| *** catintheroof has joined #openstack-keystone | 15:13 | |
| *** pcaruana has quit IRC | 15:19 | |
| *** tesseract has quit IRC | 15:20 | |
| *** McClymontS has quit IRC | 15:26 | |
| *** rmcallis has joined #openstack-keystone | 15:27 | |
| *** rmcallis has quit IRC | 15:27 | |
| gagehugo | o/ | 15:32 |
| *** panbalag has quit IRC | 15:32 | |
| lbragstad | o/ | 15:42 |
| *** panbalag has joined #openstack-keystone | 15:49 | |
| *** aojea has joined #openstack-keystone | 15:49 | |
| *** aojea has quit IRC | 15:54 | |
| *** jmlowe has joined #openstack-keystone | 15:54 | |
| *** links has joined #openstack-keystone | 15:55 | |
| gagehugo | ptg in Dublin huh | 16:02 |
| raildo | gagehugo, yeap, Feb. 26th, right? | 16:06 |
| ayoung | Oooh. Dublin! | 16:09 |
| gagehugo | yeah | 16:10 |
| *** panbalag has left #openstack-keystone | 16:14 | |
| *** alex_xu has quit IRC | 16:24 | |
| *** links has quit IRC | 16:28 | |
| *** alex_xu has joined #openstack-keystone | 16:31 | |
| *** markvoelker has quit IRC | 16:32 | |
| *** markvoelker has joined #openstack-keystone | 16:33 | |
| magicboiz | ayoung: ping | 16:34 |
| magicboiz | ayoung: can I ask you for some help with x509+federation? | 16:34 |
| ayoung | https://blogs.gnome.org/markmc/2014/02/20/naked-pings/ | 16:34 |
| ayoung | the second request is much gooderer. | 16:34 |
| ayoung | magicboiz, happy to help | 16:35 |
| ayoung | cmurphy can you tell gyee that I need him in here? Heh Heh. | 16:35 |
| magicboiz | ayoung: sorry, I'm not used to IRC convention (not yet :) ) | 16:35 |
| ayoung | magicboiz, Its OK. I treat it as a teachable moment. | 16:36 |
| magicboiz | ayoung: I'me getting error like this: "Cannot find "remote_id_attribute" in configuration group mapped. Trying default location in group federation." | 16:36 |
| magicboiz | ayoung: I have created a idP to reflect my x509 CA | 16:36 |
| magicboiz | ayoung: mapped rules | 16:36 |
| ayoung | magicboiz, paste your mapping file please. http://paste.openstack.org/ | 16:36 |
| magicboiz | ayoung: I've linked idp and mapped rules... | 16:36 |
| magicboiz | ok | 16:36 |
| *** markvoelker has quit IRC | 16:38 | |
| magicboiz | ayoung: https://pastebin.com/LdgZfs0V | 16:38 |
| magicboiz | ayoung: this is my CA cert (public): https://pastebin.com/U0And87t | 16:41 |
| magicboiz | CN is "devstackca" | 16:41 |
| ayoung | magicboiz, I don't think it your CA cert is used in the rules, only the client cert | 16:41 |
| magicboiz | ayoung: I think you're right, but why? | 16:42 |
| ayoung | the anyoneof syntax looks funny, too | 16:42 |
| ayoung | one sec... | 16:42 |
| magicboiz | ayoung: this is the keystone_error.log: https://pastebin.com/xj5NW9ik | 16:42 |
| *** mvk has quit IRC | 16:42 | |
| *** gyee has joined #openstack-keystone | 16:43 | |
| gyee | ayoung, you were looking for me? | 16:43 |
| ayoung | gyee, ! | 16:43 |
| ayoung | Yes, yes I was...we have magicboiz here trying to do Federation with X509 | 16:43 |
| ayoung | AFAIK you are the only one that has every tested that | 16:44 |
| gyee | yes | 16:44 |
| ayoung | cmurphy, you ROCK! | 16:44 |
| ayoung | gyee, mapping file is: https://pastebin.com/LdgZfs0V | 16:44 |
| cmurphy | :) | 16:44 |
| ayoung | error log is https://pastebin.com/xj5NW9ik | 16:44 |
| ayoung | magicboiz, I suspect you should drop the anyoneof rule and just get it working for a single cert with a known value | 16:45 |
| ayoung | your mapping is too complex for my simple mind | 16:45 |
| ayoung | once you have that working, try it with one that is the next level of complexity | 16:46 |
| magicboiz | ayoung: I've got it from here: https://docs.hpcloud.com/hos-4.x/helion/security/horizon_ssl_auth.html | 16:46 |
| gyee | http://files.meetup.com/1675038/X.509_Authn_Authz.pdf | 16:46 |
| gyee | my slides from the talk | 16:46 |
| gyee | let me check the mapping | 16:46 |
| ayoung | magicboiz, ah! | 16:46 |
| ayoung | there is a config value you need to add in the file | 16:46 |
| ayoung | under federation, gyee has remote_id_attribute | 16:47 |
| ayoung | remote_id_attribute = SSL_CLIENT_I_DN_CN | 16:47 |
| ayoung | I hate that | 16:47 |
| *** AlexeyAbashkin has quit IRC | 16:47 | |
| gyee | yes, you need to set remote_id_attribute | 16:48 |
| ayoung | gyee, you rock...those slides are going to help magicboiz much more than I am | 16:48 |
| * ayoung goes for more coffee | 16:48 | |
| gyee | no problem | 16:48 |
| magicboiz | ayoung: yes, I think that param is already set in my keystone.conf: | 16:48 |
| magicboiz | stack@ubuntu:~$ grep remote_id_attribute /etc/keystone/keystone.conf | 16:48 |
| magicboiz | remote_id_attribute = SSL_CLIENT_I_DN_CN | 16:48 |
| magicboiz | gyee: Your config is pretty similar to mine | 16:48 |
| ayoung | Could not map any federated user properties to identity values | 16:49 |
| ayoung | /opt/stack/keystone/keystone/federation/utils.py line 538 | 16:49 |
| ayoung | magicboiz, the heavy artillery is breaking out the remote debugger: | 16:49 |
| magicboiz | gyee: your "any_one_of" in mapped rules is more complex than mine (which is empty) | 16:49 |
| ayoung | https://adam.younglogic.com/2015/02/debugging-openstack-with-rpdb/ | 16:50 |
| *** aojea has joined #openstack-keystone | 16:50 | |
| gyee | magicoiz, that's because how the cert is parsed | 16:51 |
| gyee | i.e. SSL is terminated at HAProxy or Apache | 16:51 |
| gyee | the RDNs of the cert subject DN may get re-ordered | 16:52 |
| magicboiz | gyee: do you find any issue in my mapped file? | 16:52 |
| knikolla | ayoung: oooo rpdb, that looks amazing | 16:52 |
| magicboiz | gyee: I'm testing with devstack WITHOUT tls | 16:53 |
| magicboiz | ayoung: rpdb that sound pretty complex for me :) | 16:53 |
| ayoung | knikolla, it has saved me on more than one occasion. Caveat that multiple trips through the same code path are not a food idea. | 16:53 |
| ayoung | magicboiz, nah...just shows you what is going on in a running system | 16:53 |
| gyee | any_one_of cannot be empty I think | 16:53 |
| *** wes_dillingham has quit IRC | 16:53 | |
| ayoung | think of it like getting an X-Ray while you are in the middle of a road race :) | 16:53 |
| gyee | otherwise, it match nothing | 16:53 |
| ayoung | gyee, he can just drop that stanza, right? | 16:54 |
| knikolla | ayoung: i used to pdb, but that got tricky with everything running through apache | 16:54 |
| magicboiz | ayoung: :) | 16:54 |
| ayoung | an empty block is not the same as the absence of that block | 16:54 |
| gyee | typically in a production env, SSL is terminated at HAProxy or one of the first layer LBs | 16:54 |
| *** aojea has quit IRC | 16:54 | |
| magicboiz | gyee: ok, so I should try with any_one_of = "C = ES, ST = Madrid, L = Madrid, O = devstackca, CN = devstackca"?? | 16:55 |
| gyee | the SSL certificate attributes are passed via headers | 16:55 |
| magicboiz | gyee: yes I know, but now I'm trying to setup a PoC with devstack. | 16:55 |
| gyee | just enable logging of the headers at Apache | 16:56 |
| magicboiz | The problem with devstack+TLS is that configures a TLS apache proxy for every (fxx) service (keystone, horizon, neutron...) | 16:56 |
| gyee | and you'll see what they look like | 16:56 |
| magicboiz | gyee: so I had to enable SSL/443 on sites-enabled/keystone.conf | 16:56 |
| gyee | yes | 16:56 |
| magicboiz | gyee: according to logs, they're passed ok (i think): https://pastebin.com/xj5NW9ik | 16:57 |
| magicboiz | 'SSL_CLIENT_S_DN': [u'CN=castillo,O=devstackca,L=Madrid,ST=Madrid,C=ES'] | 16:57 |
| kmalloc | wow, gyee lives! | 16:58 |
| gyee | good! | 16:58 |
| magicboiz | so it might be "any_one_of" which is empty and not matching anything... | 16:58 |
| gyee | that's what you need in any_one_of | 16:58 |
| magicboiz | ok let me try.... | 16:58 |
| gyee | wow kmalloc is Morgan? | 16:58 |
| *** jmlowe has quit IRC | 16:58 | |
| kmalloc | gyee: yep | 16:59 |
| gyee | kmalloc sound too C++ish :-) | 17:01 |
| gyee | I remember the alloc malloc days | 17:01 |
| kmalloc | gyee: kernel malloc is too C++ish? | 17:04 |
| gyee | ahh | 17:05 |
| kmalloc | gyee: https://people.netfilter.org/rusty/unreliable-guides/kernel-hacking/routines-kmalloc.html | 17:07 |
| kmalloc | ;) | 17:07 |
| kmalloc | oops: https://www.kernel.org/doc/htmldocs/kernel-api/API-kmalloc.html | 17:07 |
| magicboiz | gyee: something has changed, now I'me getting "Could not find domain: devstackca." | 17:08 |
| magicboiz | I was trying with domain "federated_users"... | 17:08 |
| gyee | good | 17:08 |
| gyee | that means mapping is workig | 17:09 |
| gyee | you mapped the O rdn to domain | 17:09 |
| gyee | O=devstackca | 17:09 |
| gyee | if you want to make user to federated_user domain, you need to change to map | 17:09 |
| gyee | "domain": {"name": "federated_users"} | 17:10 |
| gyee | typically, the information on the cert dictates what domain the user belongs to | 17:11 |
| *** rha has quit IRC | 17:14 | |
| magicboiz | gyee: ok. I think that problem is solved. great! | 17:14 |
| gyee | good :-) | 17:15 |
| magicboiz | gyee: Now, after keystone "executes" sso_callback_template.html, I'me get redirected to horizon login window, but i get "Login failed: You are not authorized for any projects or domains." | 17:16 |
| magicboiz | arrgh | 17:16 |
| kmalloc | magicboiz: that sounds like the user doesn't have a grant on a project | 17:17 |
| kmalloc | which is a totally different issue (and possibly not related to your setup of SSO/Certs) | 17:17 |
| gyee | yep, like kmalloc said | 17:18 |
| magicboiz | kmalloc: checking pdf from gyee I found some diffs in my configs vs his configs....let me double check... | 17:18 |
| *** iogg has quit IRC | 17:18 | |
| gyee | my slides are outdated | 17:19 |
| magicboiz | For example: OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = False (in my config) | 17:19 |
| *** rha has joined #openstack-keystone | 17:19 | |
| *** rha has quit IRC | 17:19 | |
| *** rha has joined #openstack-keystone | 17:19 | |
| gyee | now that keystone support auto project creation, I'll need to update the slides | 17:19 |
| magicboiz | gyee: those slides are pure honey :) | 17:19 |
| gyee | hahahah | 17:19 |
| magicboiz | should be included in official keystone doc!! | 17:20 |
| gyee | they are mostly there, in bits and pieces | 17:21 |
| * lbragstad heads to lunch | 17:22 | |
| *** aojea has joined #openstack-keystone | 17:22 | |
| rybridges | Hello all. Have a question. I am wondering if there is any kind of batch API available in the python keystoneclient in the ocata version. For example, let's say I want to create 100 projects, is there some API that I can use to create all of those projects in one call rather than doing 1 call per project? | 17:25 |
| ayoung | gyee, that was pretty cool. Well done. | 17:25 |
| ayoung | rybridges, nope. And I kindof wanted one, too. | 17:26 |
| gyee | ayoung, thanks | 17:26 |
| ayoung | never quite figured out how to do batch with REST | 17:26 |
| rybridges | Thanks ayoung. So there are no batch API for any keystone operations at this time then? | 17:26 |
| gyee | do it with Ansible | 17:26 |
| ayoung | gyee, still one call at a time. Pay for the round trip. | 17:26 |
| gyee | I am a big fan of Ansible now | 17:26 |
| gyee | ayoung, I am about to do a POC with Ansible Tower | 17:27 |
| ayoung | gyee, as am I...BTW, I am now A Solutions Architect, which is Salesese for Sales Engineer. Which means I get to work with Ansible as part of my Day job | 17:27 |
| ayoung | Tower that is | 17:27 |
| gyee | nice | 17:27 |
| ayoung | I get to learn and play with all our cloud techs: cloudforms, ansible, openstack, openshift, rhv | 17:28 |
| gyee | that sound like a dream job! | 17:28 |
| ayoung | gyee, more travel. | 17:29 |
| ayoung | just started, and 90 days trainup, so I won't really know what it is like until after the turn of the year | 17:30 |
| ayoung | but one thing I want to do is gather up real user stories from customers and have honest feedback. Turn them into real reqs | 17:30 |
| gyee | that's very important, it's an eye opener when we write code versus writing production-ready code | 17:31 |
| ayoung | yep | 17:31 |
| gyee | things seem easy for developers could be a daily struggle for operation guys | 17:32 |
| ayoung | gyee, I know...people find work-arounds, the go on about their job, and it never gets communicated upstream. | 17:32 |
| gyee | hope you enjoy travel more than I do these days :-) | 17:34 |
| gyee | them seats on the plane seem to be getting smaller and smaller | 17:34 |
| gyee | either that or I am getting wider :-) | 17:35 |
| ayoung | Hoping to keep the travel mostly limited to the North East. My Region is New England. SO far they've sent me to RDU | 17:36 |
| magicboiz | gyee: got it. User was not correctly related with project. | 17:38 |
| magicboiz | gyee, ayoung: thanks so much guys!! | 17:38 |
| gyee | you're welcome | 17:39 |
| ayoung | I'm pretty impressed. I though that was going to be worse. | 17:39 |
| magicboiz | ayoung: jajaja without debugger!! | 17:39 |
| gyee | ayoung, in a production system, you'll have to jump through hoops to run rpdb | 17:40 |
| gyee | that's assuming customers security people let you | 17:40 |
| ayoung | yep, but you should be testing out the X509 setup in development first I'd hope | 17:40 |
| magicboiz | gyee: if I set remote_id_attribute in keystone.conf, can I add another sso idP (a keycloack server for example)? | 17:40 |
| gyee | magicboiz, yes, remote_id_attriute is per provider, afaik | 17:41 |
| ayoung | we really need to do away with that config value | 17:41 |
| ayoung | all per protocol stuff should be per protocol. Doy | 17:41 |
| gyee | ayoung, agree, that should come from mapping as well perhaps | 17:41 |
| magicboiz | gyee: remote_id_attribute is set under [federation] section..... | 17:43 |
| *** wes_dillingham has joined #openstack-keystone | 17:44 | |
| ayoung | let me see how that is used. I think we can do away with it. | 17:44 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/federation/utils.py#n276 | 17:46 |
| ayoung | remote_id_parameter = CONF[protocol]['remote_id_attribute'] | 17:46 |
| gyee | magicboiz, you can configure remote_id_attribute under the protocol section | 17:46 |
| gyee | that'll overwrite the default one | 17:47 |
| ayoung | so at a minimum, yeah, you should be able to do it per protocol...although 2 different X509 configs are not going co-exist that way | 17:47 |
| gyee | right | 17:47 |
| magicboiz | ayoung: great. I need a domain with x509 idP and another domain with ldap or sso/saml2 | 17:47 |
| ayoung | magicboiz, so, try adding an [X509] section to your config file and move the value there, and make sure we ain't broke nuffin | 17:48 |
| *** mvk has joined #openstack-keystone | 17:48 | |
| ayoung | please to be removing it from the [federation] section or you will get a false reading | 17:48 |
| ayoung | suggest you remove it first, make sure it is broken, then add to the [X509] part and ensure it works...you know, to keep from fooling yourself | 17:49 |
| magicboiz | ayoung: well, I have defined as "mapped" actually | 17:49 |
| magicboiz | ayoung: ok | 17:49 |
| ayoung | ah, yeah... | 17:49 |
| ayoung | you are going to want to distinguish between the two protocols. THey can both be implemented with mapped | 17:50 |
| gyee | you shouldn't call protocol "mapped" | 17:50 |
| gyee | mapped is very generic | 17:50 |
| *** catinthe_ has joined #openstack-keystone | 17:53 | |
| *** catintheroof has quit IRC | 17:53 | |
| magicboiz | ok, adding section: | 17:55 |
| magicboiz | [mapped] | 17:55 |
| magicboiz | remote_id_attribute = SSL_CLIENT_I_DN_CN | 17:55 |
| magicboiz | did the trick | 17:55 |
| magicboiz | :) | 17:55 |
| gyee | yay | 17:55 |
| *** lbragstad has quit IRC | 17:56 | |
| ayoung | magicboiz, you might be OK with that, if the other plugin you use is not 'mapped' | 17:57 |
| ayoung | I don't think we enforce the strings that are used for the protocol name, either | 17:58 |
| *** catintheroof has joined #openstack-keystone | 17:59 | |
| magicboiz | ayoung: | 17:59 |
| magicboiz | ayoung: ok | 17:59 |
| magicboiz | I do really LOOOVE when I launch the cirros instance and I can ping 8.8.8.8 | 17:59 |
| magicboiz | jajajajaja | 17:59 |
| ayoung | heh | 17:59 |
| gyee | to paraphrase the operation people, you nightmare just got started :-) | 18:01 |
| *** catinthe_ has quit IRC | 18:01 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/conf/auth.py | 18:04 |
| ayoung | ok...so I think we are way too restrictive there | 18:04 |
| ayoung | magicboiz, you might have to cheat. You can mess with both the external and the mapped options...I don't think you can add an X509 option. Which is not right | 18:05 |
| *** catinthe_ has joined #openstack-keystone | 18:05 | |
| ayoung | we need ALL of the Federation information wrapped up in the protocol object of the Federated data. None of it should come from config. | 18:05 |
| ayoung | I'm going to open a bug on this,. | 18:06 |
| magicboiz | ayoung: ok... I quit from now....until tomorrow :) | 18:06 |
| gyee | we got x509 and saml working at the same time | 18:06 |
| magicboiz | ayoung, gyee : thanks again for your effort helping me :) | 18:06 |
| magicboiz | bye | 18:07 |
| *** catintheroof has quit IRC | 18:07 | |
| gyee | no problem | 18:07 |
| ayoung | gyee, yep, probably by using different names of the plugins. | 18:07 |
| ayoung | saml, X509, and Kerberos should all be implemented via mapped, but we need a config value for each | 18:07 |
| gyee | ayoung, you may be right that we can't use the same plugin for two different protocols | 18:07 |
| ayoung | and, since we can't dynamically name a config section, I bet you set one of them in the [federation] section and the other in [mapped] | 18:08 |
| gyee | but the name is just artificial right? | 18:08 |
| gyee | you can have different names using the same "class" | 18:08 |
| ayoung | gyee, sort of. look at the link I just posted and tell me how you read it | 18:09 |
| ayoung | https://bugs.launchpad.net/keystone/+bug/1724645 | 18:11 |
| openstack | Launchpad bug 1724645 in OpenStack Identity (keystone) "remote_id_attribute config options prevents multiple protocol variations for Federation" [Undecided,New] | 18:11 |
| gyee | ayoung, I can double check with our QA to see if anything had changed. But we got both x509 and saml working at the same time | 18:14 |
| *** catintheroof has joined #openstack-keystone | 18:14 | |
| ayoung | gyee, try to get 2 different X509 setups working side by side, or 2 SAML | 18:14 |
| ayoung | with different mappings, etc | 18:15 |
| gyee | oh that may not work | 18:15 |
| *** catinthe_ has quit IRC | 18:15 | |
| ayoung | you can use the same IdP, but use different attributes from the assertions | 18:15 |
| ayoung | we need to move remote_id_attribute from the config file to the protocol object. | 18:15 |
| gyee | yeah, that's good poit | 18:15 |
| *** lbragstad has joined #openstack-keystone | 18:16 | |
| *** ChanServ sets mode: +o lbragstad | 18:16 | |
| gyee | ayoung, I don't see it as a problem though | 18:17 |
| gyee | for x509, unless we want to different attributes as IDs, which doesn't make much sense, we don't need two different ID mapping | 18:18 |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:19 | |
| kmalloc | you can somewhat do dynamic configs, but it's wonky | 18:20 |
| kmalloc | not recommended from a usability standpoint | 18:21 |
| gyee | kmalloc, maybe zookeeper or consul or something | 18:22 |
| kmalloc | nah, we could do it in oslo.config if we needed. but ugh. lets not do that | 18:22 |
| kmalloc | now, we could provide the config in a delimited manner (and a list config) where we can stack most of the config on a line and split it apart... again not super usable | 18:23 |
| *** AlexeyAbashkin has quit IRC | 18:24 | |
| gyee | maybe we don't need protocol? just provider and mapping is good enough? | 18:24 |
| gyee | nevermind, I wasn't thinking :-) | 18:25 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone master: Delete users before deleting domains https://review.openstack.org/506340 | 18:27 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone master: Delete users before deleting domains https://review.openstack.org/506340 | 18:29 |
| *** raildo has quit IRC | 18:29 | |
| *** aojea has quit IRC | 18:30 | |
| samueldmq | lbragstad: cmurphy ^ | 18:30 |
| lbragstad | samueldmq: sweet - thanks! | 18:31 |
| samueldmq | lbragstad: ++ I added a question in the patch | 18:31 |
| samueldmq | I am not sure how to test the migration | 18:31 |
| *** raildo has joined #openstack-keystone | 18:33 | |
| *** raildo has quit IRC | 18:44 | |
| *** markvoelker has joined #openstack-keystone | 18:44 | |
| ayoung | gyee, I'm not sure you are wrong there...what does the protocol object have on it if not this...looking | 18:48 |
| kmalloc | samueldmq: -1, added a comment on how to test the migration | 18:55 |
| kmalloc | samueldmq: but the -1 is for the test and verifying that in all cases re-adding the FK (if it exists) wont break anything | 18:56 |
| samueldmq | kmalloc: comments appreciated. I will follow your suggestions | 19:00 |
| samueldmq | kmalloc: regarding the delete with cascade I will leave as an improvement, we can do that consistently for other things too | 19:00 |
| samueldmq | for now I think just fixing the issue is fine | 19:01 |
| samueldmq | but I like the suggestion too. | 19:01 |
| *** ppiela has joined #openstack-keystone | 19:04 | |
| *** ppiela_ has quit IRC | 19:04 | |
| cfriesen | lbragstad: I've abandoned https://review.openstack.org/#/c/505345/, but while testing it I noticed something interesting. When I had a large number of endpoints (260) the code at http://paste.openstack.org/show/624015/ would hang. It works fine with 13 endpoints. | 19:06 |
| cfriesen | The "openstack" client seemed to work fine with the larger number of endpoints. | 19:07 |
| cfriesen | Is there something wrong with that code, or should I open a keystone bug? | 19:09 |
| *** aojea has joined #openstack-keystone | 19:16 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 19:19 | |
| *** aojea has quit IRC | 19:21 | |
| *** AlexeyAbashkin has quit IRC | 19:24 | |
| *** raildo has joined #openstack-keystone | 19:52 | |
| *** wes_dillingham has quit IRC | 19:52 | |
| lbragstad | cfriesen: that code looks ok to me | 20:00 |
| lbragstad | and you said openstackclient was behaving fine with that many endpoints? | 20:00 |
| *** gema has quit IRC | 20:06 | |
| *** gyee has quit IRC | 20:07 | |
| *** gema has joined #openstack-keystone | 20:08 | |
| *** gema has quit IRC | 20:08 | |
| *** gema has joined #openstack-keystone | 20:08 | |
| *** openstackgerrit has quit IRC | 20:17 | |
| *** blake has joined #openstack-keystone | 20:32 | |
| *** blake is now known as Guest87829 | 20:32 | |
| *** Guest87829 is now known as blake | 20:35 | |
| *** openstackgerrit has joined #openstack-keystone | 20:36 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Specification for system roles https://review.openstack.org/464763 | 20:36 |
| cfriesen | lbragstad: yes, I ran "openstack endpoint list" no problem | 20:38 |
| cfriesen | this is with the stable/pike branch of devstack | 20:39 |
| lbragstad | cfriesen: so - it's limited to either keystoneauth or python-keystoneclient | 20:41 |
| lbragstad | having to deal with a bunch of endpoints | 20:41 |
| cfriesen | seems like it, yes | 20:42 |
| lbragstad | as far as i know - ksa deals with the endpoints in that situation | 20:42 |
| lbragstad | if you want to open a generic bug against keystoneauth, i'll see if someone more experienced with the library can take a look | 20:43 |
| lbragstad | generic as in just reported the slow down | 20:43 |
| lbragstad | cc mordred efried cmurphy ^ | 20:44 |
| efried | osc isn't going through ksa? | 20:45 |
| cfriesen | interestingly, with two regions it works, but with three it doesn't | 20:46 |
| cfriesen | it just hangs indefinitely at the last line | 20:46 |
| efried | cfriesen Cool, let's get a bug with a repro. | 20:46 |
| efried | cfriesen How long have you left it? | 20:46 |
| efried | And how long does it take with 260x2? | 20:47 |
| cfriesen | with 260 endpoints its maybe 5 seconds to run "openstack endpoint list" | 20:48 |
| cfriesen | with 39 endpoints it's 1.9 seconds. | 20:49 |
| cfriesen | but the python code seems to hang indefinitely....I've left it for over a minute. | 20:49 |
| *** lkwan has quit IRC | 20:50 | |
| *** raildo has quit IRC | 20:52 | |
| *** catintheroof has quit IRC | 20:53 | |
| *** catintheroof has joined #openstack-keystone | 20:54 | |
| *** sbezverk has quit IRC | 20:54 | |
| *** raildo has joined #openstack-keystone | 20:54 | |
| *** catintheroof has quit IRC | 20:58 | |
| *** raildo has quit IRC | 20:58 | |
| *** rmascena has joined #openstack-keystone | 20:58 | |
| cfriesen | hmm...seems to be the third keystone endpoint that is causing the problem. | 20:59 |
| *** blake has quit IRC | 21:00 | |
| *** raildo has joined #openstack-keystone | 21:02 | |
| *** rmascena has quit IRC | 21:02 | |
| cfriesen | bug opened: https://bugs.launchpad.net/keystone/+bug/1724686 | 21:03 |
| openstack | Launchpad bug 1724686 in OpenStack Identity (keystone) "authentication code hangs when there are many endpoints" [Undecided,New] | 21:03 |
| *** thorst has quit IRC | 21:04 | |
| cfriesen | okay, looks like it is specifically three or more keystone admin endpoints that trigger it, the public endpoints don't matter | 21:07 |
| *** gyee has joined #openstack-keystone | 21:10 | |
| *** gyee has quit IRC | 21:10 | |
| *** gyee has joined #openstack-keystone | 21:11 | |
| *** gyee has quit IRC | 21:11 | |
| *** john5223 has quit IRC | 21:14 | |
| *** john5223 has joined #openstack-keystone | 21:15 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 21:19 | |
| *** AlexeyAbashkin has quit IRC | 21:24 | |
| *** phalmos has quit IRC | 21:29 | |
| *** jmlowe has joined #openstack-keystone | 21:39 | |
| openstackgerrit | Merged openstack/keystone master: Deleting an identity provider doesn't invalidate tokens https://review.openstack.org/512872 | 21:41 |
| *** edmondsw has quit IRC | 21:44 | |
| *** rmascena has joined #openstack-keystone | 21:45 | |
| *** raildo has quit IRC | 21:47 | |
| *** openstackgerrit has quit IRC | 21:48 | |
| *** edmondsw has joined #openstack-keystone | 21:50 | |
| *** rmascena has quit IRC | 21:51 | |
| *** edmondsw has quit IRC | 21:54 | |
| *** edmondsw has joined #openstack-keystone | 21:56 | |
| *** markvoelker_ has joined #openstack-keystone | 21:57 | |
| *** edmondsw_ has joined #openstack-keystone | 21:58 | |
| *** panbalag has joined #openstack-keystone | 21:59 | |
| *** edmondsw has quit IRC | 22:00 | |
| *** markvoelker has quit IRC | 22:00 | |
| *** edmondsw_ has quit IRC | 22:02 | |
| *** lbragstad has quit IRC | 22:03 | |
| *** dave-mccowan has quit IRC | 22:11 | |
| kmalloc | samueldmq: i don't think we can change the behavior for a cascade actually | 22:14 |
| kmalloc | samueldmq: the more i read it | 22:14 |
| *** jmlowe has quit IRC | 22:16 | |
| *** gyee has joined #openstack-keystone | 22:17 | |
| *** raildo has joined #openstack-keystone | 22:20 | |
| *** lbragstad has joined #openstack-keystone | 22:22 | |
| *** ChanServ sets mode: +o lbragstad | 22:22 | |
| *** med_ has quit IRC | 22:23 | |
| *** Guest34657 has quit IRC | 22:23 | |
| *** brad[] has quit IRC | 22:23 | |
| *** med_ has joined #openstack-keystone | 22:23 | |
| *** mfisch has joined #openstack-keystone | 22:23 | |
| *** brad[] has joined #openstack-keystone | 22:23 | |
| *** mfisch has quit IRC | 22:23 | |
| *** mfisch has joined #openstack-keystone | 22:23 | |
| *** med_ is now known as Guest99060 | 22:23 | |
| *** edmondsw has joined #openstack-keystone | 22:32 | |
| *** jmlowe has joined #openstack-keystone | 22:33 | |
| *** edmondsw has quit IRC | 22:36 | |
| *** nicolasbock has quit IRC | 22:43 | |
| *** raildo has quit IRC | 22:54 | |
| *** dave-mccowan has joined #openstack-keystone | 23:06 | |
| *** ppiela has quit IRC | 23:08 | |
| *** lbragstad has quit IRC | 23:09 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 23:19 | |
| *** AlexeyAbashkin has quit IRC | 23:23 | |
| *** thorst has joined #openstack-keystone | 23:32 | |
| *** thorst has quit IRC | 23:36 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!