| *** lbragstad has joined #openstack-keystone | 00:20 | |
| *** ChanServ sets mode: +o lbragstad | 00:20 | |
| *** lbragstad has quit IRC | 00:27 | |
| *** itlinux has quit IRC | 02:02 | |
| *** links has joined #openstack-keystone | 02:11 | |
| *** lbragstad has joined #openstack-keystone | 02:15 | |
| *** ChanServ sets mode: +o lbragstad | 02:15 | |
| *** r-daneel has joined #openstack-keystone | 02:24 | |
| *** r-daneel has quit IRC | 02:32 | |
| *** lbragstad has quit IRC | 03:29 | |
| *** r-daneel has joined #openstack-keystone | 03:40 | |
| *** rmcall has quit IRC | 04:02 | |
| *** rmcall has joined #openstack-keystone | 04:12 | |
| *** dave-mccowan has quit IRC | 04:53 | |
| *** threestrands has quit IRC | 06:10 | |
| *** threestrands has joined #openstack-keystone | 06:23 | |
| *** threestrands has quit IRC | 07:00 | |
| *** rcernin has quit IRC | 07:11 | |
| *** Justas__ has quit IRC | 07:26 | |
| *** hoonetorg has quit IRC | 07:30 | |
| *** hoonetorg has joined #openstack-keystone | 07:46 | |
| *** pcaruana has joined #openstack-keystone | 07:47 | |
| *** links has quit IRC | 07:55 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:56 | |
| *** links has joined #openstack-keystone | 08:07 | |
| *** tesseract has joined #openstack-keystone | 08:15 | |
| *** rmcall has quit IRC | 08:31 | |
| *** r-daneel has quit IRC | 09:28 | |
| *** links has quit IRC | 09:32 | |
| *** links has joined #openstack-keystone | 09:45 | |
| *** r-daneel has joined #openstack-keystone | 09:46 | |
| openstackgerrit | Merged openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/545656 | 09:59 |
|---|---|---|
| *** r-daneel has quit IRC | 10:06 | |
| *** kmalloc has joined #openstack-keystone | 10:14 | |
| *** r-daneel has joined #openstack-keystone | 10:22 | |
| *** AlexeyAbashkin has quit IRC | 11:07 | |
| *** goutham has joined #openstack-keystone | 11:17 | |
| *** nixi_girl has joined #openstack-keystone | 11:18 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 11:32 | |
| *** nixi_girl has quit IRC | 11:43 | |
| *** nixi_girl has joined #openstack-keystone | 11:54 | |
| *** nixi_girl has left #openstack-keystone | 11:54 | |
| *** masber has joined #openstack-keystone | 11:58 | |
| *** raildo has joined #openstack-keystone | 12:04 | |
| *** dave-mccowan has joined #openstack-keystone | 12:16 | |
| *** belmoreira has joined #openstack-keystone | 12:16 | |
| *** dmellado has quit IRC | 12:26 | |
| *** nixi_girl has joined #openstack-keystone | 12:31 | |
| *** links has quit IRC | 12:37 | |
| *** dmellado has joined #openstack-keystone | 13:07 | |
| *** edmondsw has joined #openstack-keystone | 13:12 | |
| *** narcis has joined #openstack-keystone | 13:14 | |
| nixi_girl | hi im using https://docs.openstack.org/keystone/latest/advanced-topics/federation/shibboleth.html for setup shiboleth,and at the third step ,it says i should (Make sure the keystone.conf vhost file contains a <Location> directive for the Shibboleth module and a <Location> directive for each identity provider) | 13:15 |
| nixi_girl | but in shib.conf and keystone vhost conf i dont have such a location for identity provider! should i add it myself? | 13:16 |
| *** mchlumsky has joined #openstack-keystone | 13:17 | |
| cmurphy | nixi_girl: yes, you should add it to the keystone one (leave the shib one alone) | 13:19 |
| nixi_girl | cmurphy : thanks cmurphy, and in shib.conf i have the location for shib but the content is diffrent from content in this link | 13:23 |
| nixi_girl | content of my shib location is auth type none require all granted | 13:24 |
| nixi_girl | should i edit this to be like the content in link? | 13:25 |
| *** Supun has joined #openstack-keystone | 13:26 | |
| cmurphy | nixi_girl: did you create shib.conf yourself? if not then it comes from the shibboleth package and shouldn't be edited at all | 13:28 |
| nixi_girl | no i didnt created it myself ,and its comed from the shibboleth package ,ok i dont edited so,thanks again | 13:33 |
| *** narcis has quit IRC | 13:33 | |
| *** nixi_girl has quit IRC | 13:33 | |
| *** mchlumsky has quit IRC | 13:35 | |
| *** mchlumsky has joined #openstack-keystone | 13:38 | |
| *** dmellado has quit IRC | 13:38 | |
| *** belmorei_ has joined #openstack-keystone | 13:46 | |
| *** belmoreira has quit IRC | 13:48 | |
| *** masuberu has joined #openstack-keystone | 13:54 | |
| *** masber has quit IRC | 13:58 | |
| *** goutham has quit IRC | 14:11 | |
| *** belmorei_ has quit IRC | 14:21 | |
| *** belmoreira has joined #openstack-keystone | 14:21 | |
| *** lbragstad has joined #openstack-keystone | 14:23 | |
| *** ChanServ sets mode: +o lbragstad | 14:23 | |
| *** jistr is now known as jistr|mtg | 14:31 | |
| *** links has joined #openstack-keystone | 14:41 | |
| *** dmellado has joined #openstack-keystone | 14:44 | |
| *** jroll has quit IRC | 14:47 | |
| *** jroll has joined #openstack-keystone | 14:48 | |
| gagehugo | o/ | 14:49 |
| *** links has quit IRC | 14:49 | |
| *** lbragstad has quit IRC | 14:53 | |
| *** lbragstad has joined #openstack-keystone | 14:55 | |
| *** ChanServ sets mode: +o lbragstad | 14:55 | |
| lbragstad | o/ | 14:55 |
| *** links has joined #openstack-keystone | 15:02 | |
| *** dmellado has quit IRC | 15:02 | |
| *** jistr|mtg is now known as jistr | 15:02 | |
| *** Supun has quit IRC | 15:09 | |
| -openstackstatus- NOTICE: Zuul has been restarted to pick up latest memory fixes. Queues were saved however patches uploaded after 14:40UTC may have been missed. Please recheck if needed. | 15:15 | |
| *** tonytan4ever has joined #openstack-keystone | 15:37 | |
| *** tonytan4ever has quit IRC | 15:37 | |
| *** Supun has joined #openstack-keystone | 15:38 | |
| *** pcaruana has quit IRC | 16:07 | |
| *** idlemind has joined #openstack-keystone | 16:09 | |
| *** masuberu has quit IRC | 16:21 | |
| *** r-daneel has quit IRC | 16:23 | |
| *** slunkad_ has quit IRC | 16:31 | |
| mnaser | question: does the keystone api have pagination or not? i found list_limit but that seems to be hard limit | 16:43 |
| mnaser | the reason behind the question: logging into a large deployment of horizon with a big # of projects takes forever, because it requests 1000+ projects | 16:43 |
| *** AlexeyAbashkin has quit IRC | 16:50 | |
| *** panbalag has joined #openstack-keystone | 17:00 | |
| *** belmoreira has quit IRC | 17:04 | |
| *** links has quit IRC | 17:09 | |
| *** dmellado has joined #openstack-keystone | 17:10 | |
| openstackgerrit | Merged openstack/keystone master: Simplify token persistence callbacks https://review.openstack.org/544616 | 17:16 |
| openstackgerrit | Merged openstack/keystone master: Simplify federation and oauth token callbacks https://review.openstack.org/544737 | 17:16 |
| *** itlinux has joined #openstack-keystone | 17:21 | |
| lbragstad | mnaser keystone doesn't implement paging because in certain situations, keystone can't guarantee the response ordering depending on the backend being used | 17:24 |
| lbragstad | listing projects from ldap for example | 17:25 |
| lbragstad | we're unable to page the response because ldap might not give us the same ordering of projects when you ask for the second page =/ | 17:25 |
| lbragstad | we did implement caching of a user's role assignment though | 17:28 |
| lbragstad | assignments* | 17:29 |
| lbragstad | mnaser this might be relevant to you - https://bugs.launchpad.net/keystone/+bug/1700852 | 17:30 |
| openstack | Launchpad bug 1700852 in OpenStack Identity (keystone) ocata "Slow listing projects for user with many role assignments" [Medium,Confirmed] | 17:30 |
| lbragstad | https://review.openstack.org/#/c/487143/ | 17:30 |
| lbragstad | cmurphy i think i found an issue with token validation + application credentials | 18:02 |
| cmurphy | lbragstad: uh oh | 18:05 |
| kmalloc | ugh | 18:08 |
| lbragstad | cmurphy https://bugs.launchpad.net/keystone/+bug/1750415 | 18:10 |
| openstack | Launchpad bug 1750415 in OpenStack Identity (keystone) "validation of app cred tokens is dependent on CONF.token.cache_on_issue" [Critical,Triaged] | 18:10 |
| lbragstad | we need to make sure the application credential is rebuilt in the validation process | 18:11 |
| kmalloc | yay cache issues | 18:13 |
| kmalloc | =/ | 18:13 |
| lbragstad | we stuff the token reference into the cache by default | 18:13 |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:15 | |
| cmurphy | how is this different from any other token? | 18:16 |
| *** openstackgerrit has quit IRC | 18:18 | |
| lbragstad | i think the cached version is holding on the restriction informaiton | 18:18 |
| *** openstackgerrit has joined #openstack-keystone | 18:19 | |
| openstackgerrit | Stefan Nica proposed openstack/keystonemiddleware master: Add option to disable using oslo_message notifier https://review.openstack.org/545943 | 18:19 |
| lbragstad | the app cred restriction information is populated during authentication and cached | 18:19 |
| lbragstad | which is dependent on the specific application credential being used during authentication time being present (because we have to check if it is unrestricted or not) | 18:19 |
| *** AlexeyAbashkin has quit IRC | 18:20 | |
| lbragstad | i don't think we incorporated that into the validation process | 18:20 |
| lbragstad | we definitely repopulate the methods used during validation, but i don't think we actually grab any information about the specific application credential in order to determine if it is restricted at all | 18:21 |
| *** oikiki has joined #openstack-keystone | 18:21 | |
| kmalloc | that makes sense. | 18:22 |
| cmurphy | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/providers/common.py#n491 | 18:22 |
| cmurphy | we look it up there | 18:22 |
| kmalloc | and shouldn't be hard to fix if that is the case. | 18:22 |
| cmurphy | if there's no cache that should go to db | 18:22 |
| kmalloc | lbragstad: the paste doesn't give the keystone log | 18:22 |
| kmalloc | just the test log | 18:22 |
| kmalloc | which doesn't help us a ton | 18:23 |
| lbragstad | working on a patch quick | 18:23 |
| kmalloc | k | 18:23 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Expose bug in application credential token validation https://review.openstack.org/545945 | 18:23 |
| lbragstad | ^ | 18:23 |
| kmalloc | lbragstad: i still want to see the actual keystone bits not just a paste of the 500 error | 18:24 |
| kmalloc | i don't accept the bug as is - there is more info needed to make sure we're actually solving and testing for the error | 18:25 |
| lbragstad | yep - working on it | 18:25 |
| lbragstad | let me grab a better log | 18:25 |
| kmalloc | also, the @wip decorator isn't that useful in these cases, since we don't know why it's failing. blindly checking if it fails is no better, we should be looking for a specific error | 18:25 |
| kmalloc | not jsut "an error" | 18:25 |
| kmalloc | i would like to see us fix @wip. | 18:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Expose bug in application credential token validation https://review.openstack.org/545945 | 18:26 |
| kmalloc | i disagree with "any error is fine" vs "look for error X, if it is a new error, it shouldn't be caught under the same bug" | 18:26 |
| lbragstad | log from the test run http://paste.openstack.org/show/677699/ | 18:28 |
| lbragstad | without wip - so that it fails | 18:28 |
| kmalloc | this looks like we might be mis-populating the token data | 18:28 |
| kmalloc | in general | 18:28 |
| *** jrist is now known as jrist-afk | 18:28 | |
| *** jrist-afk is now known as jrist | 18:28 | |
| *** tesseract has quit IRC | 18:30 | |
| kmalloc | lbragstad: so, this looks like a case where the app_cred_id isn't being passed down into the get_token_data | 18:30 |
| *** oikiki has quit IRC | 18:31 | |
| lbragstad | yeah - or we're not to repopulate the application credentials for a user | 18:31 |
| kmalloc | so it's def in the methods | 18:32 |
| lbragstad | if 'application_credential' is one of the auth methods | 18:32 |
| kmalloc | just not populating | 18:32 |
| kmalloc | yeah | 18:32 |
| *** oikiki has joined #openstack-keystone | 18:32 | |
| lbragstad | ok - here is the diff i have http://paste.openstack.org/show/677705/ | 18:33 |
| lbragstad | and here are the token references | 18:33 |
| lbragstad | http://paste.openstack.org/show/677708/ | 18:33 |
| lbragstad | one after authenticating | 18:34 |
| lbragstad | and the other is from validating that same token when trying to delete a trust | 18:34 |
| lbragstad | (which is using a reconstructed token reference) | 18:34 |
| kmalloc | uhm. | 18:35 |
| kmalloc | where do we store the app_cred_id in the token payload? | 18:35 |
| kmalloc | i think that is the issue here. | 18:35 |
| kmalloc | so reconstructing the token.. there is no app_Cred | 18:36 |
| kmalloc | looking in https://github.com/openstack/keystone/blob/master/keystone/token/token_formatters.py | 18:37 |
| lbragstad | commented - http://paste.openstack.org/show/677712/ | 18:37 |
| lbragstad | and yes | 18:37 |
| lbragstad | that's the issue | 18:37 |
| kmalloc | fun times | 18:37 |
| kmalloc | and we're going to need to backport the fix to queens. | 18:37 |
| lbragstad | yeah | 18:37 |
| lbragstad | we can either ask keystone for all application credentials for a user and project if 'application_credential' is in the token methods, | 18:38 |
| lbragstad | or we can put the app_cred_id in the payload | 18:38 |
| lbragstad | the second will work for sure | 18:38 |
| *** r-daneel has joined #openstack-keystone | 18:39 | |
| kmalloc | make more formatters | 18:40 |
| kmalloc | don't just ask for all app creds it may not be appropriate | 18:40 |
| kmalloc | it also means you might get the wrong cred | 18:40 |
| kmalloc | you can have multiple app creds, which one are you supposed to populate from if you as for all? | 18:41 |
| kmalloc | this is likely going to need to have multiple formatters created for the various scope types. | 18:41 |
| kmalloc | lbragstad: added the bug target to Queens as well | 18:42 |
| kmalloc | and commented on the bug with updated information | 18:42 |
| lbragstad | right now app creds require project scope, i think | 18:44 |
| kmalloc | thats fine | 18:45 |
| kmalloc | it means a new project scope subclass token version | 18:45 |
| kmalloc | easy enough to do. | 18:45 |
| *** mvk_ has quit IRC | 18:48 | |
| cmurphy | lbragstad: have you reproduced this on devstack? because i haven't been able to so far | 18:50 |
| lbragstad | cmurphy i haven't with devstack - just with tests locally | 18:50 |
| lbragstad | i discovered it refactoring the token provider API | 18:50 |
| kmalloc | the issue should occur with any token validation if the token has fallen out of cache | 18:51 |
| kmalloc | if you check app_cred info | 18:51 |
| kmalloc | since we don't store any information about the app_cred in the token payload | 18:51 |
| kmalloc | but the pre-seeded cache does have that information | 18:51 |
| kmalloc | unless i'm totally mis-reading the fernet formatter somehow | 18:52 |
| kmalloc | validation of an app_cred token* | 18:52 |
| kmalloc | not "any token" | 18:52 |
| lbragstad | what i've found is that the application_credential_restricted property isn't present when validating an application credential token | 18:53 |
| kmalloc | expected from what i see in the code | 18:54 |
| lbragstad | i have devstack on another box, let me see if i can use that to recreate | 18:54 |
| *** edmondsw has quit IRC | 18:55 | |
| *** edmondsw has joined #openstack-keystone | 18:56 | |
| mnaser | lbragstad: looks like the issue might live a bit more in horizon land, listing all projects takes 0.583918 via CLI | 18:57 |
| lbragstad | mnaser oh - nice | 18:57 |
| lbragstad | well - probably not nice, but... | 18:57 |
| mnaser | lbragstad: ~1000 projects, so i guess building a giant table without pagination can result this | 18:57 |
| *** edmondsw has quit IRC | 19:00 | |
| *** harlowja has joined #openstack-keystone | 19:03 | |
| cmurphy | lbragstad: okay reproduced | 19:05 |
| cmurphy | you're right it's the restricted key | 19:06 |
| cmurphy | lbragstad: are you working on a patch? | 19:08 |
| lbragstad | cmurphy i was just recreating with a devstack setup | 19:08 |
| lbragstad | and recording it | 19:08 |
| lbragstad | but it looks like you got it | 19:08 |
| lbragstad | i don't have anything rolling for a fix locally, yet | 19:09 |
| cmurphy | okay i can take it | 19:11 |
| lbragstad | cmurphy did you just disable caching in devstack? | 19:13 |
| cmurphy | lbragstad: i disabled cache_on_issue like your bug report said | 19:14 |
| lbragstad | ok | 19:14 |
| *** Supun has quit IRC | 19:42 | |
| *** Supun has joined #openstack-keystone | 19:43 | |
| *** mvk_ has joined #openstack-keystone | 19:59 | |
| *** Supun has quit IRC | 20:07 | |
| *** dave-mccowan has quit IRC | 20:14 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Populate application credential data in token https://review.openstack.org/545971 | 20:25 |
| cmurphy | lbragstad: kmalloc ^ | 20:25 |
| lbragstad | nice | 20:25 |
| cmurphy | probably needs some tests and a release note but should fix the bug | 20:25 |
| lbragstad | i have a test locally | 20:25 |
| lbragstad | wrapping up the wip decorator bit and writing a commit message for it | 20:25 |
| cmurphy | okay it's already based on your trusts test so if you update it i can rebase | 20:26 |
| *** aojea_ has joined #openstack-keystone | 20:30 | |
| *** edmondsw has joined #openstack-keystone | 20:30 | |
| *** aojea_ has quit IRC | 20:30 | |
| lbragstad | that's perfect | 20:31 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Expose bug in application credential token validation https://review.openstack.org/545945 | 20:32 |
| lbragstad | new test that gives a little more context around the failure. | 20:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Expose bug in application credential token validation https://review.openstack.org/545945 | 20:34 |
| *** itlinux has quit IRC | 20:36 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Populate application credential data in token https://review.openstack.org/545971 | 20:58 |
| *** mvk_ has quit IRC | 21:01 | |
| lbragstad | cmurphy so we're moving the application_credential_restricted property? | 21:10 |
| cmurphy | lbragstad: i'd like to, is that okay? | 21:11 |
| lbragstad | that's what i'm wondering, too | 21:12 |
| cmurphy | it is technically api breaking | 21:12 |
| lbragstad | right | 21:13 |
| cmurphy | but we haven't actually released yet | 21:13 |
| lbragstad | right... | 21:13 |
| cmurphy | but if the token has app cred data then it stops making sense for it to be a property on its own | 21:13 |
| lbragstad | rock <- -> hard place | 21:13 |
| cmurphy | lol | 21:14 |
| lbragstad | right - providing a little information in an application credential reference seems more useful | 21:14 |
| lbragstad | versus a one-off property of the token? | 21:14 |
| cmurphy | right | 21:15 |
| cmurphy | ¯\_(ツ)_/¯ | 21:17 |
| lbragstad | well - it's the same approach we take for other things in the token (e.g. the domain, project, etc..) | 21:18 |
| lbragstad | cc kmalloc ? | 21:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Expose bug in application credential token validation https://review.openstack.org/545945 | 21:19 |
| lbragstad | cmurphy ok - finally got my stuff together, that patch should be right ^ | 21:19 |
| kmalloc | uhm | 21:19 |
| kmalloc | this one is hard re breaking change | 21:19 |
| kmalloc | if we can land it before release of Q ... i think we're ok | 21:19 |
| kmalloc | but we'd need to land the backport ASPA | 21:19 |
| kmalloc | ASAP | 21:19 |
| kmalloc | i also agree providing the reference is more useful | 21:20 |
| cmurphy | sweet | 21:20 |
| kmalloc | long term | 21:20 |
| *** AlexeyAbashkin has joined #openstack-keystone | 21:26 | |
| *** clayton has quit IRC | 21:28 | |
| *** AlexeyAbashkin has quit IRC | 21:31 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Populate application credential data in token https://review.openstack.org/545971 | 21:33 |
| cmurphy | kmalloc: lbragstad ^ needs a rereview | 21:34 |
| cmurphy | oh wait release note | 21:34 |
| kmalloc | cmurphy: you can add the relnot as a followup if you want | 21:35 |
| kmalloc | cmurphy: consider my +2 sticky | 21:35 |
| kmalloc | as long as zuul says "ok" | 21:36 |
| kmalloc | lbragstad: ^ | 21:36 |
| *** rcernin has joined #openstack-keystone | 21:36 | |
| cmurphy | we have to backport so i'd rather have fewer commits | 21:36 |
| *** threestrands has joined #openstack-keystone | 21:37 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Populate application credential data in token https://review.openstack.org/545971 | 21:39 |
| lbragstad | cmurphy in that case, feel free to roll my patch into yours if you want | 21:40 |
| cmurphy | lbragstad: okie | 21:40 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Populate application credential data in token https://review.openstack.org/545971 | 21:41 |
| lbragstad | cmurphy looks good, just one question inline. passes for me locally | 21:50 |
| cmurphy | lbragstad: right now it's always going to be project scoped, it can't be unscoped or system scoped, so project_id should always be there when the token is being assembled | 21:55 |
| lbragstad | ok - i figured as much | 21:55 |
| lbragstad | we can cross that bridge when we open up that functionality | 21:55 |
| cmurphy | that's what i figured | 21:55 |
| *** raildo has quit IRC | 22:04 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: rewrite keystone https://review.openstack.org/545450 | 22:07 |
| *** openstackgerrit has quit IRC | 22:18 | |
| *** mvk_ has joined #openstack-keystone | 22:22 | |
| *** masber has joined #openstack-keystone | 22:23 | |
| *** dave-mccowan has joined #openstack-keystone | 22:38 | |
| *** dave-mccowan has quit IRC | 23:05 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 23:06 | |
| *** AlexeyAbashkin has quit IRC | 23:10 | |
| *** masber has quit IRC | 23:34 | |
| *** oikiki has quit IRC | 23:36 | |
| *** r-daneel has quit IRC | 23:36 | |
| *** masber has joined #openstack-keystone | 23:37 | |
| *** masber has quit IRC | 23:57 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!