| kmalloc | knikolla: oh no | 00:30 |
|---|---|---|
| kmalloc | hahaha | 00:30 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain_id column for limit https://review.openstack.org/620202 | 01:59 |
| *** imacdonn has joined #openstack-keystone | 02:52 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain level limit support - Manager https://review.openstack.org/621468 | 03:05 |
| *** Nel1x has quit IRC | 04:39 | |
| *** nehaalhat has joined #openstack-keystone | 05:13 | |
| nehaalhat | wxy-xiyuan: Hi, I want your suggestion on: https://blueprints.launchpad.net/python-keystoneclient/+spec/return-request-id-to-caller | 05:14 |
| nehaalhat | wxy-xiyuan: As patches submitted to implement this are not suffient, I am going to propose one or two patch..... should I push those patches under same BP, as bp is not marked as implemented yet. | 05:22 |
| nehaalhat | wxy-xiyuan: or I need to report a bug for this | 05:22 |
| *** elbragstad has quit IRC | 06:03 | |
| wxy-xiyuan | nehaalhat: Hi, A follow-up for the BP is fine I think | 06:32 |
| nehaalhat | wxy-xiyuan: ok, thank you | 06:34 |
| *** rcernin has quit IRC | 06:57 | |
| *** pcaruana has joined #openstack-keystone | 07:25 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:43 | |
| *** mkrai has joined #openstack-keystone | 07:47 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain_id column for limit https://review.openstack.org/620202 | 07:48 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [WIP]Add domain level limit support - Manager https://review.openstack.org/621468 | 07:48 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Ensure change is addressed for unified limit table https://review.openstack.org/621497 | 07:48 |
| mkrai | Hi, I am getting this error http://paste.openstack.org/show/736563/ while setting up devstack. Can someone help? | 07:49 |
| *** Dinesh_Bhor has quit IRC | 07:55 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 08:04 | |
| *** amoralej|off is now known as amoralej | 08:23 | |
| *** trident has quit IRC | 08:28 | |
| *** trident has joined #openstack-keystone | 08:30 | |
| *** alexchadin has joined #openstack-keystone | 08:58 | |
| *** xek has joined #openstack-keystone | 08:59 | |
| *** mkrai has quit IRC | 09:35 | |
| *** awalende has joined #openstack-keystone | 09:44 | |
| *** Dinesh_Bhor has quit IRC | 09:46 | |
| *** awalende_ has joined #openstack-keystone | 09:53 | |
| *** awalende has quit IRC | 09:56 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 10:14 | |
| *** awalende has joined #openstack-keystone | 10:45 | |
| *** awalende_ has quit IRC | 10:49 | |
| *** shrasool has joined #openstack-keystone | 10:49 | |
| *** Dinesh_Bhor has quit IRC | 10:50 | |
| *** shrasool has quit IRC | 11:24 | |
| *** awalende_ has joined #openstack-keystone | 11:41 | |
| *** awalende has quit IRC | 11:44 | |
| *** awalende_ has quit IRC | 11:58 | |
| *** awalende has joined #openstack-keystone | 11:59 | |
| openstackgerrit | Merged openstack/keystone master: Keep federation jobs running on Xenial https://review.openstack.org/611563 | 12:26 |
| *** awalende has quit IRC | 12:33 | |
| *** alexchadin has quit IRC | 12:44 | |
| *** awalende has joined #openstack-keystone | 12:45 | |
| *** alexchadin has joined #openstack-keystone | 12:59 | |
| *** amoralej is now known as amoralej|lunch | 13:22 | |
| *** alexchadin has quit IRC | 13:29 | |
| *** jroll has quit IRC | 13:38 | |
| *** jroll has joined #openstack-keystone | 13:38 | |
| *** jaosorior has joined #openstack-keystone | 13:47 | |
| *** amoralej|lunch is now known as amoralej | 14:00 | |
| *** Nel1x has joined #openstack-keystone | 14:08 | |
| openstackgerrit | Merged openstack/oslo.policy master: oslopolicy-checker: iterate through rules in sorted order https://review.openstack.org/619724 | 14:25 |
| *** jmlowe has quit IRC | 14:25 | |
| *** jmlowe has joined #openstack-keystone | 14:26 | |
| *** SteelyDan is now known as dansmith | 14:28 | |
| *** raildo has joined #openstack-keystone | 14:43 | |
| *** lbragstad has joined #openstack-keystone | 14:49 | |
| *** ChanServ sets mode: +o lbragstad | 14:49 | |
| lbragstad | so - i think my x1c just died on me... | 14:50 |
| cmurphy | oh no :_( | 14:51 |
| *** dave-mccowan has joined #openstack-keystone | 14:53 | |
| *** awalende has quit IRC | 14:55 | |
| *** lbragstad has quit IRC | 14:58 | |
| *** lbragstad has joined #openstack-keystone | 15:00 | |
| *** ChanServ sets mode: +o lbragstad | 15:00 | |
| lbragstad | yeah - i'm pretty surprised... looks like it fails reading from the drive, so i might try a new hard drive... | 15:01 |
| *** beekneemech is now known as bnemec | 15:01 | |
| *** awalende has joined #openstack-keystone | 15:02 | |
| *** awalende has quit IRC | 15:07 | |
| *** jdennis has joined #openstack-keystone | 15:17 | |
| *** mchlumsky has joined #openstack-keystone | 15:24 | |
| *** mchlumsky has quit IRC | 15:28 | |
| *** mchlumsky has joined #openstack-keystone | 15:29 | |
| *** itlinux has quit IRC | 15:34 | |
| *** jhesketh has quit IRC | 15:55 | |
| *** jhesketh has joined #openstack-keystone | 15:57 | |
| *** jmlowe has quit IRC | 16:04 | |
| *** gyee has joined #openstack-keystone | 16:04 | |
| *** raildo_ has joined #openstack-keystone | 16:06 | |
| *** erus has joined #openstack-keystone | 16:06 | |
| erus | Hi everyone :) | 16:07 |
| cmurphy | hi erus :D | 16:07 |
| erus | How are you doing? | 16:07 |
| *** jdennis has quit IRC | 16:08 | |
| *** raildo has quit IRC | 16:09 | |
| *** fiddletwix has joined #openstack-keystone | 16:14 | |
| *** dklyle has joined #openstack-keystone | 16:15 | |
| *** jdennis has joined #openstack-keystone | 16:25 | |
| *** itlinux has joined #openstack-keystone | 16:33 | |
| *** itlinux has quit IRC | 16:33 | |
| *** itlinux has joined #openstack-keystone | 16:34 | |
| *** itlinux_ has joined #openstack-keystone | 16:50 | |
| *** itlinux has quit IRC | 16:54 | |
| *** itlinux_ has quit IRC | 16:55 | |
| *** itlinux has joined #openstack-keystone | 16:56 | |
| *** erus has quit IRC | 16:56 | |
| *** erus has joined #openstack-keystone | 16:59 | |
| nsmeds | morning/evening everyone. Making some progress getting v3cloudpolicy working - but one issue I'm trying to understand. When I run `openstack token issue`, the token does not have `domain_id` attribute, which is required for the `cloud_admin` policy. | 17:15 |
| nsmeds | The user I'm running this with was created in the "cloud_admin" domain, and has admin role at the system and domain level. | 17:16 |
| nsmeds | any ideas? | 17:16 |
| lbragstad | nsmeds i think it depends on the environment variables osc is using to get the token | 17:32 |
| kmalloc | o/ | 17:33 |
| nsmeds | that's what I'd expect as well... https://gist.github.com/nikosmeds/885b6456f2c5823a65fb843921e43fe3 | 17:34 |
| nsmeds | solved. missing `export OS_DOMAIN_NAME=cloud_admin` | 17:39 |
| lbragstad | yep | 17:40 |
| nsmeds | that one line has likely caused all my problems for last like 5 days | 17:40 |
| nsmeds | gg | 17:40 |
| *** raildo_ has quit IRC | 17:42 | |
| lbragstad | oh - i suppose, you were getting a domain scoped token to actually pass the domain policies in policy.v3cloudsample.json | 17:43 |
| kmalloc | oh | 17:45 |
| kmalloc | man | 17:45 |
| kmalloc | that is annoying | 17:45 |
| kmalloc | :P | 17:45 |
| kmalloc | erus: Hi! :) | 17:46 |
| nsmeds | <3 appreciate your help guys - hopefully smoother sailing going forward | 17:46 |
| kmalloc | nsmeds: yes, very much hopefully so | 17:46 |
| erus | Hi kmalloc how are you? :) | 17:56 |
| kmalloc | erus: good | 17:56 |
| kmalloc | how about yourself? | 17:56 |
| * kmalloc is trying to wake up. | 17:57 | |
| * kmalloc is finally drinking coffee. | 17:57 | |
| erus | kmalloc: very well, so excited about starting with keystone :) | 18:00 |
| lbragstad | welcome erus :) | 18:01 |
| erus | I little nervous but doing my best | 18:01 |
| erus | Thanks lbragstad :) | 18:01 |
| lbragstad | kmalloc have you hit this with your x1? https://forums.lenovo.com/t5/ThinkPad-X-Series-Laptops/2100-Detection-Error-on-Storage-Device-M-2/td-p/4160865 | 18:08 |
| kmalloc | lbragstad: nope | 18:15 |
| kmalloc | lbragstad: i've had next to zero issues with the hardware on the X1C6 *except* linux kernel support problems | 18:15 |
| lbragstad | hmm | 18:15 |
| *** amoralej is now known as amoralej|off | 18:24 | |
| lbragstad | looks like some of the recordings from berlin are making it up | 18:26 |
| *** erus has quit IRC | 18:30 | |
| *** jmlowe has joined #openstack-keystone | 18:36 | |
| *** erus has joined #openstack-keystone | 18:37 | |
| *** jmlowe has quit IRC | 18:39 | |
| *** raildo has joined #openstack-keystone | 18:57 | |
| aning | Hi, question about token revocation, how are "issued_before" and "revoked_at" of revcation_event table used in determining token validation? | 19:00 |
| *** jmlowe has joined #openstack-keystone | 19:06 | |
| aning | I couldn't find where in the source code they are used. | 19:07 |
| lbragstad | it might depend on the event, but those are used in https://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py#n143 | 19:09 |
| aning | lbragstad: And I found there could be multiple entries for the same project for example | 19:13 |
| aning | in that revocation_event table. | 19:14 |
| lbragstad | it depends on the type of event | 19:14 |
| lbragstad | for example, keystone persists a revocation event when you change your password | 19:15 |
| lbragstad | or if you explicitly revoke a token | 19:15 |
| aning | I bet the latest one, the one with the latest "issued_before" is the one that are used ultimatle. | 19:15 |
| lbragstad | (using DELETE /v3/auth/tokens) | 19:15 |
| aning | Yeah, I understand how these events are created, but not sure which of the mutilple entries are ultimately effective/ | 19:16 |
| lbragstad | how do you mean? | 19:17 |
| aning | I could create a revoke event by disable a project, then I can create another one by delete the project. | 19:17 |
| aning | they have different issued_before | 19:18 |
| aning | which one is used in determining the a fernet token received? | 19:18 |
| aning | I would think it's the latest one, but not 100% sure. | 19:19 |
| lbragstad | well - fernet will validate the project (if it's a project-scoped token) on line | 19:19 |
| * lbragstad digs in the code | 19:19 | |
| aning | I could be wrong, but would a fernet token checked against the revocation_event table to see if it's revoked or not? | 19:21 |
| lbragstad | only in some cases | 19:22 |
| lbragstad | the majority of fernet validation is done on line | 19:22 |
| lbragstad | meaning, when a fernet token is validated, it's decrypted and the values are double checked | 19:22 |
| lbragstad | which is a different approach to what revocation events were originally used for | 19:22 |
| lbragstad | for example - when UUID tokens were used, the information in the token wasn't validated in that way at validation time | 19:23 |
| lbragstad | instead, during authentication, the token would get built and written to the data base | 19:23 |
| lbragstad | then at validation time, it would get pulled out of the backend and returned to the user | 19:24 |
| aning | Right. | 19:24 |
| lbragstad | revocation events were written to catch invalid tokens before leaving keystone | 19:24 |
| lbragstad | and since uuid tokens never validated anything at validation time, revocation events had to make up for that in their implementation | 19:24 |
| lbragstad | for example, if you had a uuid token scoped to a project and an administrator took away your role assignment on that project, the revocation event would have the project ID and the time at which the role was removed | 19:25 |
| lbragstad | which was compared to the UUID token reference | 19:25 |
| aning | If I explicitely revoke a fernet token by 'openstack token revoke', there will be a event created | 19:26 |
| lbragstad | now, keystone just pull the project id + user id from the token and asks the assignment backend if the user has any role assignments on the project, if no.. then it's considered a 401 | 19:26 |
| aning | with an audit id in it. | 19:26 |
| lbragstad | aning yep - exactly | 19:26 |
| lbragstad | because we don't write fernet tokens down anywhere, explicit revocations have to happen with audit-ids | 19:26 |
| aning | Other than this case, revoke event are not actually used? I mean for fernet token. | 19:27 |
| lbragstad | we can't flip a bit in the token table saying a particular token is deleted, or revoked, because fernet tokens are non-persistent | 19:27 |
| lbragstad | fernet tokens have to use them for password changes | 19:27 |
| lbragstad | but yeah - those are the two big cases for revocations events | 19:27 |
| lbragstad | now that only fernet is supported | 19:27 |
| lbragstad | everything else should be validated online | 19:27 |
| *** aojea has joined #openstack-keystone | 19:29 | |
| lbragstad | that said - you bring up a good point.. there is probably some work to be done with revocation events so that we're not writing them if we don't need them | 19:29 |
| aning | Yeah, that make sense. Project deletion, disable, etc, can be done by checking project validation | 19:29 |
| aning | lbragstad: I would think for explicit revocation, we don't event need 'issued_before' and 'revoked_at', since audit_id are actually unique. | 19:47 |
| aning | For user password change, probably we don't need to create multiple entries in the table. Just update the exsiting one. | 19:49 |
| aning | if there is one in the table already. | 19:50 |
| lbragstad | yeah - you're probably on to something there | 19:54 |
| lbragstad | the data we persist for revocation events never really evolved after we implemented non-persistent tokens | 19:54 |
| lbragstad | so - i'm sure there are things we could optimize or just cut out completely | 19:55 |
| aning | lbragstad: thx. I may come back on this later on ... | 19:57 |
| lbragstad | aning sure thing... if you come up with any redundancies we should open them as bugs | 19:58 |
| aning | lbragstad: well, so far I see the multiple entries a bit confusing, and could be optimized. | 19:59 |
| * lbragstad steps away to grab lunch quick | 19:59 | |
| *** david-lyle has joined #openstack-keystone | 20:16 | |
| *** dklyle has quit IRC | 20:18 | |
| *** jmlowe has quit IRC | 20:23 | |
| kmalloc | aning: a lot of the revocation table needed to be as it was due to PKI and UUID tokens | 20:28 |
| kmalloc | we could eliminate a number of the bits for it. | 20:28 |
| aning | kmalloc: right | 20:28 |
| kmalloc | revoke events are really only useful (at this point) for password changes and/or grant changes. | 20:29 |
| aning | kmalloc: what do you mean by grant changes, role assignment? | 20:29 |
| kmalloc | we've just not touched them (because they mostly just work) for a while. | 20:29 |
| kmalloc | yeah role assignments. | 20:29 |
| kmalloc | you could issue a revoke event if a role is removed from a user | 20:30 |
| kmalloc | oh, and explicit token revoke (don't do this... really, not worth the headache) | 20:30 |
| aning | but I think role assignment can be checked online, since the ids are in token ... | 20:30 |
| kmalloc | it can be. this is a wider reaching bit behavior. | 20:30 |
| kmalloc | i disagree with the dynamically change the roles within a token bit in fernet | 20:31 |
| kmalloc | as it *could* change working behavior of a token mid-flight | 20:31 |
| kmalloc | that is a side conversation | 20:32 |
| kmalloc | so, realistically we only need revocations for password changes (this could also be done implicitly based upon the password change time) | 20:32 |
| kmalloc | and explicit revocations (which I really would like to see go away) | 20:32 |
| kmalloc | disabled user/project/domain is all live | 20:32 |
| kmalloc | etc. etc. | 20:33 |
| aning | Looks like there are quite a bit that can be optimized around this. | 20:34 |
| lbragstad | well - we use online validation for role assignment | 20:36 |
| lbragstad | assignments* | 20:36 |
| *** jmlowe has joined #openstack-keystone | 20:39 | |
| *** jmlowe has quit IRC | 20:41 | |
| *** raildo has quit IRC | 20:47 | |
| *** raildo_ has joined #openstack-keystone | 20:47 | |
| *** erus has quit IRC | 21:09 | |
| *** erus has joined #openstack-keystone | 21:11 | |
| lbragstad | kmalloc hrybacki were either of you able to ack this by simo one last time? https://review.openstack.org/#/c/541903/ | 21:32 |
| *** amoralej|off is now known as amoralej | 21:46 | |
| *** amoralej is now known as amoralej|off | 21:47 | |
| hrybacki | lbragstad: sure thing | 21:49 |
| lbragstad | cmurphy after watching a couple other project updates, i wish i would have included more contributor data | 22:03 |
| lbragstad | seems like an interesting data point I've always kinda glossed over | 22:04 |
| cmurphy | lbragstad: that's a good idea | 22:04 |
| *** jaosorior has quit IRC | 22:13 | |
| kmalloc | lbragstad: i have not been able to. | 22:16 |
| *** jaosorior has joined #openstack-keystone | 22:16 | |
| kmalloc | aning: i think we can probably narrow revocation events down to a very small number | 22:17 |
| kmalloc | aning: like... explicit revocations | 22:17 |
| kmalloc | and thats it. [hopefully] | 22:17 |
| aning | The ones with audit_ids? | 22:17 |
| *** rcernin has joined #openstack-keystone | 22:18 | |
| *** pcaruana has quit IRC | 22:18 | |
| aning | kmalloc: how would you handle user password change? | 22:18 |
| lbragstad | those might still need revocation events | 22:20 |
| kmalloc | lbragstad, aning: look at the user's password change timestamp and compare it to the tokens | 22:27 |
| kmalloc | we already have to load the user object | 22:27 |
| kmalloc | we have the password data from that | 22:27 |
| kmalloc | :) | 22:27 |
| kmalloc | we can eliminate another rev. event that way | 22:27 |
| lbragstad | oh - sure.. that might work | 22:28 |
| kmalloc | yeah | 22:28 |
| kmalloc | just optimisations we didn't have originally | 22:28 |
| lbragstad | i suppose the PCI-DSS stuff might make that possible | 22:28 |
| kmalloc | the PCI-DSS work has added a lot of extra metadata that is useful | 22:28 |
| kmalloc | ;) | 22:28 |
| lbragstad | yeah | 22:28 |
| kmalloc | i only realized that bit when we talked about it earlier today | 22:28 |
| kmalloc | soooo yay aning helping us realize added benefits of code we already wrote | 22:29 |
| aning | ;) | 22:29 |
| *** itlinux has quit IRC | 22:38 | |
| lbragstad | jaosorior nice work on https://www.youtube.com/watch?v=k6-ihXsNFEE | 22:41 |
| *** irclogbot_1 has quit IRC | 22:47 | |
| *** aojea has quit IRC | 22:48 | |
| *** lbragstad has quit IRC | 22:51 | |
| *** lbragstad has joined #openstack-keystone | 22:52 | |
| *** ChanServ sets mode: +o lbragstad | 22:52 | |
| jaosorior | lbragstad: thanks! | 22:53 |
| *** jaosorior has quit IRC | 22:53 | |
| *** irclogbot_1 has joined #openstack-keystone | 23:08 | |
| *** eandersson has joined #openstack-keystone | 23:17 | |
| hrybacki | lbragstad ASK IS OUT! | 23:17 |
| hrybacki | wow caps | 23:17 |
| lbragstad | super excited | 23:17 |
| lbragstad | <3 !!!!!! | 23:18 |
| *** raildo_ has quit IRC | 23:24 | |
| eandersson | Anyone know why trustee would fail if e.g. heat_owner role was removed and re-created? | 23:30 |
| openstackgerrit | Merged openstack/oslo.policy master: Fully log RBAC enforcement data https://review.openstack.org/619260 | 23:31 |
| lbragstad | eandersson did the role id change? | 23:33 |
| eandersson | yea | 23:33 |
| eandersson | figured that would be it, but not sure how to fix it, manually change it back? :D | 23:33 |
| lbragstad | hmm | 23:35 |
| lbragstad | could you create a new trust, or rotate it out/ | 23:35 |
| lbragstad | ? | 23:35 |
| lbragstad | or use application credentials? | 23:37 |
| lbragstad | since they are more "rotate-able"? | 23:38 |
| *** jdennis has quit IRC | 23:40 | |
| lbragstad | that might not be possible depending on the release you're using i suppose | 23:46 |
| *** jdennis has joined #openstack-keystone | 23:57 | |
| eandersson | thank lbragstad | 23:57 |
| eandersson | Is this a normal implementation? https://github.com/openstack/senlin/blob/111ea8eabd2ec0f942c5a1f4ddb2fdcea8f98ba4/senlin/engine/service.py#L240 | 23:58 |
| eandersson | Seems Senlin stores some of the trustee data in the db? | 23:58 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!