| *** markvoelker has joined #openstack-keystone | 00:11 | |
| *** itlinux has joined #openstack-keystone | 00:26 | |
| *** itlinux has quit IRC | 00:33 | |
| *** itlinux has joined #openstack-keystone | 00:35 | |
| *** itlinux has quit IRC | 00:38 | |
| *** itlinux has joined #openstack-keystone | 00:39 | |
| *** markvoelker has quit IRC | 00:44 | |
| *** itlinux has quit IRC | 00:44 | |
| *** itlinux has joined #openstack-keystone | 00:46 | |
| *** itlinux has quit IRC | 00:48 | |
| *** ileixe has joined #openstack-keystone | 00:49 | |
| *** ileixe has quit IRC | 00:51 | |
| *** ileixe has joined #openstack-keystone | 00:51 | |
| *** itlinux has joined #openstack-keystone | 01:07 | |
| *** itlinux has quit IRC | 01:10 | |
| *** gyee has quit IRC | 01:22 | |
| *** dklyle_ has joined #openstack-keystone | 01:27 | |
| *** david-lyle has quit IRC | 01:31 | |
| *** itlinux has joined #openstack-keystone | 01:45 | |
| *** itlinux has quit IRC | 01:47 | |
| *** itlinux has joined #openstack-keystone | 01:49 | |
| *** itlinux has quit IRC | 01:52 | |
| *** itlinux has joined #openstack-keystone | 01:56 | |
| *** itlinux has quit IRC | 02:01 | |
| *** david-lyle has joined #openstack-keystone | 02:12 | |
| *** dklyle_ has quit IRC | 02:15 | |
| *** lbragstad has quit IRC | 02:26 | |
| *** lbragstad has joined #openstack-keystone | 02:33 | |
| *** ChanServ sets mode: +o lbragstad | 02:33 | |
| *** rcernin has joined #openstack-keystone | 03:07 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 03:08 | |
| openstackgerrit | Yang Youseok proposed openstack/keystonemiddleware master: Add auth invalidation in auth_token for identity endpoint update https://review.openstack.org/633695 | 03:15 |
|---|---|---|
| *** adriant has quit IRC | 03:18 | |
| *** adriant has joined #openstack-keystone | 03:27 | |
| *** Dinesh_Bhor has quit IRC | 03:30 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 03:39 | |
| *** itlinux has joined #openstack-keystone | 03:41 | |
| *** rcernin has quit IRC | 04:35 | |
| *** lbragstad has quit IRC | 04:38 | |
| *** erus1 has quit IRC | 04:38 | |
| *** erus1 has joined #openstack-keystone | 04:39 | |
| *** itlinux has quit IRC | 04:44 | |
| *** itlinux_ has joined #openstack-keystone | 04:45 | |
| *** itlinux_ has quit IRC | 04:45 | |
| *** Dinesh_Bhor has quit IRC | 04:48 | |
| *** itlinux has joined #openstack-keystone | 04:59 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:00 | |
| *** itlinux has quit IRC | 05:03 | |
| *** itlinux has joined #openstack-keystone | 05:04 | |
| *** itlinux has quit IRC | 05:26 | |
| *** erus1 has quit IRC | 05:26 | |
| *** erus1 has joined #openstack-keystone | 05:26 | |
| *** itlinux has joined #openstack-keystone | 05:40 | |
| *** Ebukha has joined #openstack-keystone | 05:40 | |
| *** vishakha has joined #openstack-keystone | 05:55 | |
| *** adriant has quit IRC | 06:06 | |
| *** markvoelker has joined #openstack-keystone | 06:07 | |
| *** adriant has joined #openstack-keystone | 06:07 | |
| *** Ebukha has quit IRC | 06:10 | |
| *** markvoelker has quit IRC | 06:11 | |
| *** pcaruana has joined #openstack-keystone | 07:02 | |
| *** Ebukha has joined #openstack-keystone | 07:08 | |
| *** markvoelker has joined #openstack-keystone | 07:08 | |
| *** Ebukha has quit IRC | 07:30 | |
| *** markvoelker has quit IRC | 07:41 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Fix wrong example for direct_maps https://review.openstack.org/635444 | 07:46 |
| *** itlinux has quit IRC | 07:50 | |
| *** itlinux has joined #openstack-keystone | 07:59 | |
| *** Emine has joined #openstack-keystone | 08:02 | |
| *** awalende has joined #openstack-keystone | 08:05 | |
| *** itlinux_ has joined #openstack-keystone | 08:06 | |
| *** itlinux has quit IRC | 08:09 | |
| *** tkajinam has quit IRC | 08:15 | |
| *** itlinux_ has quit IRC | 08:22 | |
| *** shyamb has joined #openstack-keystone | 08:30 | |
| *** markvoelker has joined #openstack-keystone | 08:38 | |
| *** xek__ has joined #openstack-keystone | 08:49 | |
| *** shyamb has quit IRC | 08:55 | |
| *** Ebukha has joined #openstack-keystone | 08:59 | |
| *** markvoelker has quit IRC | 09:12 | |
| *** shyamb has joined #openstack-keystone | 09:36 | |
| *** yan0s has joined #openstack-keystone | 10:03 | |
| *** shyamb has quit IRC | 10:05 | |
| *** markvoelker has joined #openstack-keystone | 10:09 | |
| *** shyamb has joined #openstack-keystone | 10:09 | |
| *** vishakha has quit IRC | 10:41 | |
| *** erus1 has quit IRC | 10:41 | |
| *** markvoelker has quit IRC | 10:41 | |
| *** Dinesh_Bhor has quit IRC | 10:41 | |
| *** erus1 has joined #openstack-keystone | 10:41 | |
| *** shyamb has quit IRC | 10:57 | |
| *** ileixe has quit IRC | 11:20 | |
| *** markvoelker has joined #openstack-keystone | 11:38 | |
| *** dave-mccowan has joined #openstack-keystone | 12:03 | |
| *** markvoelker has quit IRC | 12:11 | |
| *** mgheorghe has joined #openstack-keystone | 12:17 | |
| *** raildo has joined #openstack-keystone | 12:30 | |
| *** markvoelker has joined #openstack-keystone | 13:08 | |
| *** markvoelker has quit IRC | 13:41 | |
| *** raildo has quit IRC | 13:42 | |
| *** erus1 has quit IRC | 13:42 | |
| *** erus1 has joined #openstack-keystone | 13:43 | |
| *** imus has joined #openstack-keystone | 13:47 | |
| *** raildo has joined #openstack-keystone | 13:49 | |
| *** lbragstad has joined #openstack-keystone | 13:58 | |
| *** ChanServ sets mode: +o lbragstad | 13:58 | |
| *** jmlowe has quit IRC | 14:09 | |
| *** mgheorghe has quit IRC | 14:14 | |
| *** jmlowe has joined #openstack-keystone | 14:30 | |
| *** irclogbot_1 has joined #openstack-keystone | 14:30 | |
| *** markvoelker has joined #openstack-keystone | 14:38 | |
| *** raildo has quit IRC | 14:42 | |
| knikolla | o/ | 14:45 |
| lbragstad | \o | 14:47 |
| *** raildo has joined #openstack-keystone | 14:55 | |
| *** david-lyle has quit IRC | 14:57 | |
| *** Ebukha has quit IRC | 15:00 | |
| *** Ebukha has joined #openstack-keystone | 15:04 | |
| *** awalende has quit IRC | 15:04 | |
| *** awalende has joined #openstack-keystone | 15:04 | |
| *** awalende has quit IRC | 15:08 | |
| *** markvoelker has quit IRC | 15:11 | |
| *** dansmith has quit IRC | 15:13 | |
| *** imacdonn has quit IRC | 15:13 | |
| *** dansmith has joined #openstack-keystone | 15:14 | |
| gagehugo | o/ | 15:20 |
| *** Ebukha has quit IRC | 15:25 | |
| kmalloc | o/ | 15:46 |
| kmalloc | \o | 15:46 |
| kmalloc | /o\ | 15:46 |
| *** markvoelker has joined #openstack-keystone | 16:08 | |
| *** yan0s has quit IRC | 16:09 | |
| *** gyee has joined #openstack-keystone | 16:13 | |
| *** lbragstad has quit IRC | 16:15 | |
| *** lbragstad has joined #openstack-keystone | 16:16 | |
| *** ChanServ sets mode: +o lbragstad | 16:16 | |
| *** pcaruana has quit IRC | 16:21 | |
| *** markvoelker has quit IRC | 16:41 | |
| *** imus has quit IRC | 16:53 | |
| *** awalende has joined #openstack-keystone | 17:05 | |
| *** erus1 has quit IRC | 17:05 | |
| *** erus1 has joined #openstack-keystone | 17:05 | |
| *** awalende has quit IRC | 17:09 | |
| kmalloc | o/ | 17:16 |
| kmalloc | going to run out to get some breakfast and some food stock in case we have an extra snowy weekend (as is expected in the forecast) | 17:17 |
| *** itlinux has joined #openstack-keystone | 17:19 | |
| *** itlinux_ has joined #openstack-keystone | 17:26 | |
| *** itlinux has quit IRC | 17:27 | |
| gagehugo | lbragstad: I will be out tomorrow, just a heads up | 17:29 |
| *** dklyle has joined #openstack-keystone | 17:29 | |
| lbragstad | sounds good | 17:29 |
| lbragstad | thanks for the heads up | 17:29 |
| *** xek__ has quit IRC | 17:30 | |
| *** xek has joined #openstack-keystone | 17:30 | |
| *** jmlowe has quit IRC | 17:37 | |
| *** markvoelker has joined #openstack-keystone | 17:38 | |
| lbragstad | i need a quick sanity check | 17:55 |
| *** erus1 has quit IRC | 17:55 | |
| lbragstad | we use web servers to manage keystone processes | 17:55 |
| lbragstad | and we've removed eventlet support | 17:56 |
| *** erus1 has joined #openstack-keystone | 17:56 | |
| lbragstad | every new request coming in instantiates a new request context to handle that request | 17:56 |
| *** itlinux_ has quit IRC | 17:58 | |
| lbragstad | we only support the eventlet case for testing | 18:00 |
| lbragstad | https://git.openstack.org/cgit/openstack/keystone/tree/keystone/server/wsgi.py#n22 | 18:01 |
| *** erus1 has quit IRC | 18:01 | |
| lbragstad | otherwise - it looks like we fire off one of those for every request | 18:01 |
| lbragstad | which loads backends, configs, etc... | 18:02 |
| lbragstad | if we wanted to address wxy-xiyuan's concern about loading jws keys only when they are changed | 18:02 |
| *** erus1 has joined #openstack-keystone | 18:02 | |
| lbragstad | we'd have to preserve key repository state across processes/threads, right? | 18:02 |
| *** aojea has joined #openstack-keystone | 18:03 | |
| *** markvoelker has quit IRC | 18:11 | |
| *** mvkr has quit IRC | 18:12 | |
| lbragstad | ah - nevermind... | 18:15 |
| lbragstad | looks like we load a flask app and then return that to the web server? | 18:15 |
| lbragstad | we load all backends and whatnot before returning the app to serve to the web server | 18:18 |
| gagehugo | does the jws loading issue apply to fernet keys as well? | 18:36 |
| lbragstad | yeah | 18:43 |
| lbragstad | we read the keys from the filesystem on every request | 18:43 |
| lbragstad | but - we instantiate a provider for each process/thread | 18:44 |
| *** erus1 has quit IRC | 18:44 | |
| lbragstad | at least according to what i'm seeing locally | 18:44 |
| *** erus1 has joined #openstack-keystone | 18:45 | |
| lbragstad | and apparently we have a downstream team that hit performance issues reading keys from disk on every request | 18:46 |
| lbragstad | i suppose i could see that being a problem if you have keypairs for 100s on nodes | 18:46 |
| lbragstad | of nodes* | 18:46 |
| lbragstad | iiuc - the trick is going to be implementing something that watches for changes on the directory without reading files | 18:47 |
| lbragstad | to recreate in a local environment - make sure you disable caching and cache_on_issue | 18:49 |
| lbragstad | so you force the keys to be read every time | 18:49 |
| lbragstad | i was wondering why token validation wasn't being run - but it was because the token was already cached | 18:50 |
| *** jmlowe has joined #openstack-keystone | 18:59 | |
| *** markvoelker has joined #openstack-keystone | 19:08 | |
| lbragstad | ` | 19:30 |
| *** lbragstad has quit IRC | 19:32 | |
| *** lbragstad has joined #openstack-keystone | 19:32 | |
| *** ChanServ sets mode: +o lbragstad | 19:32 | |
| kmalloc | lbragstad: we don't use eventlet even for testing. | 19:37 |
| kmalloc | we use wsgiref | 19:37 |
| kmalloc | lbragstad: yes, you need to assume each process (uwsgi is the runner in most cases) will maintain state. | 19:37 |
| kmalloc | lbragstad: as long as mtime is enabled for the key repository or similar, you're fine and can stat the files/directory without needing to do the complete reload | 19:38 |
| lbragstad | right | 19:38 |
| lbragstad | i was testing os.path.getmtime() but it didn't seem to work the way i was expecting it to | 19:38 |
| lbragstad | or i was using it wrong | 19:38 |
| kmalloc | lbragstad: it is a bit weird. | 19:38 |
| kmalloc | you could also just be aggressive on cycling processes. | 19:39 |
| lbragstad | that would be up to the web server though, right? | 19:39 |
| kmalloc | yeah | 19:39 |
| kmalloc | the other thing that could be done is have an internal timer for reloading | 19:39 |
| lbragstad | hmm | 19:40 |
| kmalloc | so 1) load on new process, 2) load after X period, 3) if unseen key, load with a delay if the same key is seen and still doesn't load in | 19:40 |
| lbragstad | what about using pynotify? | 19:40 |
| kmalloc | pynotify may or may not work well. | 19:40 |
| kmalloc | i've had mixed results with inotify like stuff | 19:41 |
| kmalloc | so what i would do is keep the fingerprint of the key in cache (in-process), and if we haven't seen a key before refresh the data from the repo, if the key *still* doesn't exist, Negative-Cache it for ~5 or 10m | 19:42 |
| lbragstad | what do you generate the fingerprint off of? | 19:42 |
| lbragstad | the file name? | 19:42 |
| *** markvoelker has quit IRC | 19:42 | |
| kmalloc | or the key data? | 19:42 |
| lbragstad | mm | 19:42 |
| kmalloc | this is pki | 19:42 |
| kmalloc | you can get fingerprints for the .pem | 19:43 |
| kmalloc | and should be something we can derive from the data in the JSE | 19:43 |
| lbragstad | it would be nice to have a reusable solution for fernet keys, too | 19:43 |
| kmalloc | fernet would be a slightly different workflow, but ultimately doable | 19:43 |
| kmalloc | if key is not found, try and load from the repo, set timout before we try and reload again | 19:44 |
| kmalloc | make the cache/fingerprint/nx-cache code backend specific | 19:44 |
| kmalloc | and if it isn't implemented, reload on all requests | 19:44 |
| kmalloc | since Asym and Sym crypto work differently we can't derive a fingerprint from the ciphertext (necessarily) in the fernet/symetric cases | 19:45 |
| lbragstad | right | 19:45 |
| lbragstad | the fingerprint would have to be something else | 19:45 |
| kmalloc | in asym, you should always be able to derive the fingerprint, so we can be more efficient at caching. | 19:45 |
| lbragstad | like a hash of the key contents or something | 19:45 |
| kmalloc | right, now, if we encoded a key fingerprint (sha?) outside the ciphertext payload in fernet | 19:46 |
| kmalloc | (requires new formatter) we could leverage similar code, just fingerprint the keys. | 19:46 |
| kmalloc | it's still going to be differnet code paths, but ultimately pretty straightforward | 19:47 |
| lbragstad | today - the fernet repository just loads a list of Fernet keys | 19:47 |
| lbragstad | er - key contents that it passes as a list to cryptography | 19:47 |
| kmalloc | right, so we'd load tuples in-memory, fingerprint: key | 19:47 |
| lbragstad | yeah | 19:47 |
| lbragstad | we could have a key abstraction on top of that | 19:47 |
| kmalloc | and if we put the fingerprint in the payload [larger fernet tokens] we could avoid needing to load the repo every request | 19:47 |
| kmalloc | yeh | 19:47 |
| kmalloc | i like this plan. | 19:48 |
| kmalloc | i could probably mock this up pretty quickly | 19:48 |
| kmalloc | for JSE i see this as a big win. | 19:48 |
| lbragstad | ok - so you have a cache of Key objects | 19:48 |
| lbragstad | the expose a .contents property | 19:48 |
| lbragstad | and a .fingerprint property | 19:49 |
| kmalloc | something like that | 19:49 |
| lbragstad | how do we detect new changes to the directory without loading all the keys again (because that's what we do today and we're back to the same performance) | 19:49 |
| kmalloc | and we check token-crypto fingerprint (fernet, data is outside of ciphertext; JSE do direct fingerprint) | 19:49 |
| kmalloc | no if you see an unknown key, load the repo, if the key *still* doesn't exist, negatively cache it | 19:50 |
| kmalloc | so the workflow is: Check if fingerprint is a loaded key, use it. check if it is negatively cached (and cache is still in-play), invalid, load repo and use key if it exists or negatively cache it | 19:51 |
| kmalloc | we always load the repo when we load it | 19:51 |
| kmalloc | catch all changes | 19:51 |
| kmalloc | the caveat is that we need an explicit timeout where we load the repo to cache keys removed from the repo | 19:51 |
| kmalloc | so we need to set a window we're comfortable -- like 300s, where we will reload the repo *anyway* | 19:52 |
| kmalloc | if we haven't reloaded due to new-key being found in a token | 19:52 |
| lbragstad | right - what we need is a thing that tells us of 1.) a key was added under a new name 2.) a key was added with the same name (contents changed) 3.) a key was removed | 19:52 |
| kmalloc | since we're leaning on a fingerprint of the key not file name, we don't care about case 2 | 19:53 |
| kmalloc | case 2 would be the same as case 1. | 19:53 |
| lbragstad | i was thinking that would be generic enough for fernet | 19:53 |
| kmalloc | we should place some cryptographic information about which key was used in the fernet payload (unencrypted) if we want to use similar code to JSE | 19:54 |
| kmalloc | if not, we implement it as file-specific for fernet and do: | 19:54 |
| kmalloc | 1) see if data decrypts with any key in memory, 2) load repo if no decryption (set timeout between forced loads), 3) guaranteed load after expiry of in-memory cache | 19:55 |
| kmalloc | it would be different code paths and that is because fernet is fundamentally different code. | 19:55 |
| lbragstad | ya | 19:56 |
| kmalloc | i prefer the add some data about the key in the fernet payload so we can | 19:58 |
| kmalloc | make the process faster/more reliable | 19:58 |
| kmalloc | if we are willing to expand token sizes (JSE) we should consider the same for fernet | 19:59 |
| lbragstad | so - the key fingerprint has to be derived from key contents | 20:01 |
| lbragstad | i think | 20:01 |
| kmalloc | yeh | 20:01 |
| lbragstad | because it's possible for keys to be renamed | 20:01 |
| kmalloc | it could be some kind of sha -- or something* | 20:02 |
| lbragstad | right | 20:02 |
| kmalloc | it will expand the payload | 20:02 |
| lbragstad | ok - i think i was missing that piece of information before | 20:02 |
| kmalloc | size | 20:02 |
| lbragstad | i wasn't assuming we would solve this with additional data from the token itself | 20:02 |
| kmalloc | but it will save loading from disk as much and speed up validation, since you don't have to try each key | 20:02 |
| lbragstad | i was assuming all directory state changes would get picked up by inspecting the filesystem | 20:03 |
| kmalloc | yeah, lets not try and do that | 20:03 |
| kmalloc | the reason is it allows us to lean on tech like vault | 20:03 |
| kmalloc | or any thing else to load the keys | 20:03 |
| lbragstad | sure | 20:03 |
| lbragstad | that's a good point | 20:03 |
| kmalloc | not locking us into a on-disk repo or "write your own code" | 20:03 |
| lbragstad | although i was thinking a solution under that assumption would also be reuseable for knikolla's mutable config change | 20:04 |
| kmalloc | possibly | 20:04 |
| *** erus1 has quit IRC | 20:04 | |
| *** erus1 has joined #openstack-keystone | 20:05 | |
| lbragstad | ok - security question | 20:06 |
| kmalloc | sure | 20:06 |
| lbragstad | we can't put the fingerprint in the payload of the fernet token | 20:06 |
| lbragstad | because that would mean we would have to cycle through the keys to decrypt it to figure out the fingerprint | 20:07 |
| lbragstad | at which point, we've already lost | 20:07 |
| kmalloc | put it outside of the ciphertext | 20:07 |
| lbragstad | so - we have to keep it outside the ciphertext | 20:07 |
| kmalloc | yeah | 20:07 |
| kmalloc | it would be a new formatter | 20:07 |
| lbragstad | is it problematic to expose that to end users? | 20:07 |
| kmalloc | i don't think so... if we use a secure 1-way-hash | 20:07 |
| lbragstad | or is it no more problematic than expose ciphertext | 20:08 |
| lbragstad | yeah - i suppose | 20:08 |
| kmalloc | we could use a PBKDF and drop the salt after hashing if we wanted | 20:08 |
| lbragstad | ciphertext is arguable more valuable to a bad actor than a one-way has | 20:08 |
| lbragstad | hash* | 20:08 |
| kmalloc | it becomes just a way we identify the key in memory | 20:08 |
| kmalloc | as long as we use the same data (consistently) we're solid. | 20:09 |
| kmalloc | it could even be a partial hash or any number of things as long as it's something reproducable | 20:10 |
| lbragstad | the new token formatter is going to have to handle both types of tokens for a release, and that's not assuming a fast forward upgrade case | 20:10 |
| kmalloc | sure. thats easy though | 20:10 |
| lbragstad | another security thing.. | 20:10 |
| lbragstad | as an attacker | 20:11 |
| lbragstad | i could generate a whole bunch of tokens | 20:11 |
| lbragstad | and group tokens by their owning key | 20:11 |
| lbragstad | which gives me a group of cipher text that i know was create with the same token | 20:11 |
| lbragstad | s/token/key/ | 20:11 |
| kmalloc | yep. but that is something you can assume within a given window anyway | 20:12 |
| lbragstad | (e.g., isolating tokens issued by a specific keystone service behind a load balancer) | 20:12 |
| kmalloc | knowing how fernet works. | 20:12 |
| kmalloc | unless someone does the weird thing where they have multiple keystones using the same keys in different orders | 20:13 |
| *** erus1 has quit IRC | 20:13 | |
| lbragstad | i suppose that would be more applicable to jws | 20:13 |
| *** erus1 has joined #openstack-keystone | 20:13 | |
| lbragstad | i could target a specific keystone service if i find tokens with the same fingerprint | 20:13 |
| lbragstad | server* | 20:13 |
| kmalloc | yeah | 20:13 |
| kmalloc | asymmetric crypto assumes you know what key was used. | 20:14 |
| kmalloc | well some/many forms do | 20:15 |
| lbragstad | i think you can make that assumption between intended audiences (keystone servers) | 20:15 |
| lbragstad | since they assume the token they are getting was signed with a token in their possession | 20:16 |
| kmalloc | symmetric crypto may assume a priori exchange of keys/knowing outside of the ciphertext what key was used. | 20:16 |
| kmalloc | rather than communicating along with the ciphertext what key was used. | 20:16 |
| kmalloc | in keystone we brute-force that by trying all of our keys | 20:16 |
| lbragstad | right | 20:16 |
| lbragstad | well - that's an implementation detail of pyca/cryptography | 20:17 |
| lbragstad | but yeah | 20:17 |
| lbragstad | i wouldn't be surprised if they have thought about this exact problem | 20:17 |
| kmalloc | with fernet, not expecting if anyone thought about this at this point | 20:18 |
| kmalloc | it's pretty much dead. | 20:18 |
| kmalloc | except for us | 20:18 |
| lbragstad | oh - i'm talking about the pyca folks | 20:21 |
| kmalloc | oh yeah | 20:21 |
| lbragstad | i don't think the multi key fernet thing was a detail of the heroku specification | 20:21 |
| kmalloc | I would prefer to push folks towards JSE as we get it implemented. | 20:21 |
| kmalloc | i am also 100% ok with saying JSE does the "don't reload from disk every time" | 20:22 |
| kmalloc | and fernet leans on pyca so we just do what they do | 20:22 |
| kmalloc | it can totally be an implementation detail of the token formatter/provider | 20:22 |
| lbragstad | sure | 20:24 |
| lbragstad | initially - i suppose | 20:24 |
| * lbragstad heads to #cryptography quick | 20:24 | |
| *** aojea has quit IRC | 20:26 | |
| lbragstad | oops #cryptography-dev actually | 20:27 |
| * knikolla will read back later. in a meeting | 20:33 | |
| *** blake has joined #openstack-keystone | 20:35 | |
| *** markvoelker has joined #openstack-keystone | 20:39 | |
| *** raildo has quit IRC | 20:46 | |
| *** markvoelker has quit IRC | 21:11 | |
| *** xek has quit IRC | 21:22 | |
| *** blake has quit IRC | 21:55 | |
| *** erus1 has quit IRC | 21:55 | |
| *** dave-mccowan has quit IRC | 21:56 | |
| *** erus1 has joined #openstack-keystone | 21:56 | |
| *** markvoelker has joined #openstack-keystone | 22:08 | |
| *** markvoelker has quit IRC | 22:42 | |
| *** tkajinam has joined #openstack-keystone | 22:55 | |
| *** Emine has quit IRC | 22:59 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement JWS token provider https://review.openstack.org/614549 | 23:02 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Clarify cache_on_issue configuration option help text https://review.openstack.org/635690 | 23:02 |
| *** whoami-rajat has quit IRC | 23:03 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Clarify cache_on_issue configuration option help text https://review.openstack.org/635690 | 23:03 |
| *** mvkr has joined #openstack-keystone | 23:03 | |
| *** takamatsu has quit IRC | 23:19 | |
| *** markvoelker has joined #openstack-keystone | 23:39 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!