| *** markvoelker has quit IRC | 00:11 | |
| lbragstad | kmalloc so - about the approach i just tried | 00:17 |
|---|---|---|
| lbragstad | if each token has a hash of the private key used to sign it - that doesn't really help the keystone node that has to verify the token signature | 00:19 |
| lbragstad | hashes are one-way | 00:20 |
| lbragstad | so if i have a hash of a private key - how do you find the corresponding public key from that hash? | 00:20 |
| lbragstad | without iterating each public key and trying the signatures until you find one that works? | 00:20 |
| lbragstad | and then learning the mapping | 00:21 |
| *** ileixe has joined #openstack-keystone | 00:48 | |
| *** ayoung has joined #openstack-keystone | 00:50 | |
| ayoung | https://python-social-auth-docs.readthedocs.io/en/latest/ | 00:50 |
| *** markvoelker has joined #openstack-keystone | 01:09 | |
| lbragstad | huh - interesting | 01:24 |
| lbragstad | i'll have to read that tomorrow | 01:24 |
| *** markvoelker has quit IRC | 01:41 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:43 | |
| kmalloc | lbragstad: store it in a dict | 02:13 |
| kmalloc | lbragstad: hash - | 02:13 |
| kmalloc | > key_data in memory | 02:14 |
| kmalloc | keystone tracks that data internally and encodes that in the token. | 02:14 |
| kmalloc | in the case of asym crypto, you use the fingerprint method for the keypair | 02:14 |
| kmalloc | hashes are one way, we hash it and store the value in keystone, we then embed that in the token | 02:15 |
| kmalloc | keystone can lookup the private data from the hashed value since it's in memory | 02:15 |
| kmalloc | lbragstad: Fingerprints are created by applying a cryptographic hash function to a public key. Since fingerprints are shorter than the keys they refer to, they can be used to simplify certain key management tasks. In Microsoft software, "thumbprint" is used instead of "fingerprint". | 02:16 |
| kmalloc | anyway... we can make this work. | 02:17 |
| * kmalloc has to run off to dinner. | 02:17 | |
| *** markvoelker has joined #openstack-keystone | 02:38 | |
| *** markvoelker has quit IRC | 03:12 | |
| *** vishakha has joined #openstack-keystone | 03:43 | |
| *** markvoelker has joined #openstack-keystone | 04:09 | |
| eandersson | lbragstad, is there a change to id_mapping ? | 04:17 |
| eandersson | We are seeing id_mapping's happening under the user table instead now | 04:17 |
| *** whoami-rajat has joined #openstack-keystone | 04:24 | |
| *** lbragstad has quit IRC | 04:35 | |
| *** markvoelker has quit IRC | 04:41 | |
| *** gyee has quit IRC | 05:36 | |
| *** markvoelker has joined #openstack-keystone | 05:38 | |
| *** markvoelker has quit IRC | 06:12 | |
| *** Dinesh_Bhor has quit IRC | 06:57 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:03 | |
| *** markvoelker has joined #openstack-keystone | 07:09 | |
| *** pcaruana has joined #openstack-keystone | 07:23 | |
| *** markvoelker has quit IRC | 07:41 | |
| *** takamatsu has joined #openstack-keystone | 08:00 | |
| *** awalende has joined #openstack-keystone | 08:09 | |
| *** Emine has joined #openstack-keystone | 08:12 | |
| *** yan0s has joined #openstack-keystone | 08:13 | |
| *** tkajinam has quit IRC | 08:14 | |
| *** markvoelker has joined #openstack-keystone | 08:38 | |
| *** xek has joined #openstack-keystone | 08:45 | |
| *** yan0s has quit IRC | 08:51 | |
| *** Emine has quit IRC | 09:05 | |
| *** markvoelker has quit IRC | 09:12 | |
| *** whoami-rajat has quit IRC | 09:14 | |
| *** yan0s has joined #openstack-keystone | 09:17 | |
| *** whoami-rajat has joined #openstack-keystone | 09:28 | |
| *** ygk_12345 has joined #openstack-keystone | 09:47 | |
| ygk_12345 | hi all | 09:48 |
| *** david-lyle has joined #openstack-keystone | 09:54 | |
| *** dklyle has quit IRC | 09:57 | |
| *** vishakha has quit IRC | 10:02 | |
| *** markvoelker has joined #openstack-keystone | 10:10 | |
| *** vishakha has joined #openstack-keystone | 10:11 | |
| ygk_12345 | can anyone help me with ldap domains please | 10:16 |
| ygk_12345 | i am trying to add users to ldap projects , but it is not working | 10:16 |
| *** Dinesh_Bhor has quit IRC | 10:21 | |
| *** markvoelker has quit IRC | 10:42 | |
| *** erus1 has quit IRC | 10:42 | |
| *** erus1 has joined #openstack-keystone | 10:42 | |
| *** Emine has joined #openstack-keystone | 11:02 | |
| *** ygk_12345 has quit IRC | 11:05 | |
| *** takamatsu_ has joined #openstack-keystone | 11:20 | |
| *** ileixe has quit IRC | 11:20 | |
| *** takamatsu has quit IRC | 11:20 | |
| *** markvoelker has joined #openstack-keystone | 11:39 | |
| *** Emine has quit IRC | 11:51 | |
| *** markvoelker has quit IRC | 12:12 | |
| *** raildo has joined #openstack-keystone | 12:13 | |
| *** erus1 has quit IRC | 12:13 | |
| *** erus1 has joined #openstack-keystone | 12:14 | |
| *** whoami-rajat has quit IRC | 12:24 | |
| *** whoami-rajat has joined #openstack-keystone | 12:44 | |
| *** Emine has joined #openstack-keystone | 12:47 | |
| *** markvoelker has joined #openstack-keystone | 13:09 | |
| *** gary_perkins has quit IRC | 13:18 | |
| *** obre has quit IRC | 13:18 | |
| *** obre has joined #openstack-keystone | 13:18 | |
| *** gary_perkins has joined #openstack-keystone | 13:19 | |
| *** erus1 has quit IRC | 13:19 | |
| *** erus1 has joined #openstack-keystone | 13:21 | |
| *** vishakha has quit IRC | 13:32 | |
| *** markvoelker has quit IRC | 13:42 | |
| *** awalende has quit IRC | 14:24 | |
| *** TheJulia is now known as needssleep | 14:25 | |
| *** awalende has joined #openstack-keystone | 14:25 | |
| *** awalende has quit IRC | 14:29 | |
| *** dave-mccowan has joined #openstack-keystone | 14:29 | |
| *** lbragstad has joined #openstack-keystone | 14:31 | |
| *** ChanServ sets mode: +o lbragstad | 14:31 | |
| lbragstad | kmalloc ok - so jws would need to rely on fingerprints and fernet would have to rely on hashes | 14:34 |
| *** markvoelker has joined #openstack-keystone | 14:39 | |
| kmalloc | lbragstad: yes | 14:41 |
| *** mchlumsky has joined #openstack-keystone | 14:44 | |
| *** raildo has quit IRC | 14:52 | |
| *** gary_perkins has quit IRC | 14:55 | |
| *** gary_perkins has joined #openstack-keystone | 14:56 | |
| *** gary_perkins has quit IRC | 14:56 | |
| *** gary_perkins has joined #openstack-keystone | 14:56 | |
| *** raildo has joined #openstack-keystone | 15:00 | |
| *** whoami-rajat has quit IRC | 15:04 | |
| *** Emine has quit IRC | 15:05 | |
| *** markvoelker has quit IRC | 15:12 | |
| *** whoami-rajat has joined #openstack-keystone | 15:31 | |
| *** pcaruana has quit IRC | 15:31 | |
| *** Emine has joined #openstack-keystone | 15:52 | |
| *** markvoelker has joined #openstack-keystone | 16:09 | |
| *** erus1 has quit IRC | 16:09 | |
| *** erus1 has joined #openstack-keystone | 16:10 | |
| *** gyee has joined #openstack-keystone | 16:38 | |
| *** markvoelker has quit IRC | 16:43 | |
| *** ileixe has joined #openstack-keystone | 16:53 | |
| *** Emine has quit IRC | 17:03 | |
| lbragstad | ok - i'm playing around with something similar to pyinotify, just because i'm curious | 17:09 |
| lbragstad | i have it setup to reload keys if the repository directories change | 17:09 |
| lbragstad | and i'm not noticing any real performance difference between caching the private key and not caching it | 17:10 |
| lbragstad | but - it's also a single key, and not multiple | 17:10 |
| lbragstad | so it might not be that big of a performance hit to load that key everytime in favor of keeping the code simpler | 17:10 |
| lbragstad | but - i'm going to try with a bunch of public keys and see how that affects token validation | 17:11 |
| lbragstad | ok - from what i can tell, key caching isn't making as much of a difference as what i was expecting | 17:36 |
| *** yan0s has quit IRC | 17:37 | |
| lbragstad | if i put 100+ public keys in the repository and disable all caching (because we want to test exercising the entire validation path for timing) | 17:37 |
| lbragstad | token validation time is about 2.0 - 1.8 seconds | 17:37 |
| *** opetrenko has quit IRC | 17:37 | |
| lbragstad | if i cache all the keys in process, token validation time goes to about 1.8 seconds, with the fastest being 1.6 | 17:38 |
| lbragstad | which is still quite a bit... | 17:38 |
| lbragstad | but, i was expecting a read from disk to take longer? | 17:38 |
| lbragstad | to put this in perspective, if i enable token caching (like we do by default) token validation takes 0.058s | 17:39 |
| *** Emine has joined #openstack-keystone | 17:40 | |
| *** markvoelker has joined #openstack-keystone | 17:40 | |
| kmalloc | remember you have file system cache too | 17:46 |
| kmalloc | pynotify and inotify-like is not guaranteed to work. | 17:46 |
| kmalloc | i tend to prefer to not lock us into file-system specific code. | 17:48 |
| kmalloc | i also think the brute-force mechanism of try-every-key is sub-wonderful. | 17:49 |
| kmalloc | read from disk really depends on a lot of things. NFS can be a lot slower, iscsi delays (network), disk-cache, filesystem cache, io pressure on the disk itself. | 17:51 |
| kmalloc | do a throughput test on the disk with the repo and then re-run the test, watch it be a lot slower. | 17:51 |
| lbragstad | i was testing things out with https://pypi.org/project/watchdog/ | 18:02 |
| lbragstad | i'm not sure if knikolla could reuse that for the mutable config bits or now | 18:03 |
| lbragstad | not* | 18:03 |
| lbragstad | but i though the file handler stuff was kind of nice | 18:03 |
| lbragstad | you subclass a FileSystemEventHandler and specify what actions to you want to take when certain things happen | 18:04 |
| lbragstad | what i was playing with locally https://pasted.tech/pastes/d7e5363143bf44ddad8313a17beddca1a64907cc.raw | 18:06 |
| lbragstad | i'll work on an implementation using the approach with fingerprints this afternoon | 18:07 |
| *** jmlowe has quit IRC | 18:11 | |
| *** Emine has quit IRC | 18:12 | |
| *** markvoelker has quit IRC | 18:13 | |
| *** Emine has joined #openstack-keystone | 18:16 | |
| *** whoami-rajat has quit IRC | 18:34 | |
| *** Emine has quit IRC | 18:38 | |
| eandersson | Is it intended that the ldap provider now populates users and not id_mapping? | 18:44 |
| eandersson | (or both) | 18:44 |
| *** Emine has joined #openstack-keystone | 18:55 | |
| *** Emine has quit IRC | 19:06 | |
| *** markvoelker has joined #openstack-keystone | 19:10 | |
| lbragstad | eandersson if you have users coming from ldap - they will appear in the non-local user table | 19:35 |
| lbragstad | the local user table is specific to mysql users | 19:36 |
| eandersson | interesting | 19:36 |
| eandersson | I wonder why we are seeing ldap in user as well as non-local user table | 19:36 |
| lbragstad | eandersson are you on master? | 19:37 |
| eandersson | Rocky | 19:37 |
| lbragstad | hm | 19:37 |
| lbragstad | is it causing an issue or just trying to figure it ou? | 19:37 |
| lbragstad | out*? | 19:37 |
| eandersson | Well we have a globally replicated Keystone deployment | 19:38 |
| eandersson | And this makes replication problematic :p | 19:38 |
| eandersson | local_user vs. nonlocal_user is great for us | 19:39 |
| lbragstad | oh - sure | 19:39 |
| lbragstad | that makes sense | 19:39 |
| eandersson | but users combining both not so much | 19:39 |
| *** ceryx has joined #openstack-keystone | 19:39 | |
| eandersson | the information users is identical to nonlocal_users | 19:40 |
| eandersson | only difference is that users has created_at date | 19:40 |
| eandersson | (all other variables are NULL) | 19:40 |
| lbragstad | because they're shadowed i assume | 19:40 |
| lbragstad | the created_at date would be the time stamp of when that happened i would think | 19:40 |
| eandersson | Yea | 19:40 |
| *** markvoelker has quit IRC | 19:44 | |
| eandersson | If we are replicating local_user is it safe to ignore users? | 19:47 |
| eandersson | We obviously don't care about replicating ldap users | 19:47 |
| eandersson | nvm don't think that is safe | 19:48 |
| lbragstad | i want to say there is logic in keystone that factors in both | 19:49 |
| lbragstad | i can take a poke at it once i wrap up a few things i'm working on | 19:49 |
| lbragstad | i'll see if i can get devstack up and running with ldap | 19:50 |
| eandersson | Thanks lbragstad | 19:50 |
| * kmalloc reads up | 19:53 | |
| kmalloc | eandersson: oh i think we did some weird things in regards to ldap in the past | 19:53 |
| kmalloc | really ldap is a special case when it comes to the shadowing local and non-local | 19:53 |
| eandersson | Yea - it was done in id_mapping before | 19:54 |
| kmalloc | yep. | 19:54 |
| eandersson | (Mitaka) | 19:54 |
| kmalloc | we have been trying to move towards a local user object regardless of identity source | 19:54 |
| kmalloc | i am not sure how far shadow things have gotten, it's on a long to-do to get a deep dive in to see what we need to do to fix all this stuff upo | 19:55 |
| kmalloc | it's very haphazard at the moment | 19:55 |
| *** trident has quit IRC | 20:21 | |
| *** trident has joined #openstack-keystone | 20:22 | |
| *** trident has quit IRC | 20:34 | |
| *** trident has joined #openstack-keystone | 20:35 | |
| *** markvoelker has joined #openstack-keystone | 20:40 | |
| *** whoami-rajat has joined #openstack-keystone | 20:48 | |
| *** dave-mccowan has quit IRC | 20:50 | |
| *** dave-mccowan has joined #openstack-keystone | 20:53 | |
| *** raildo has quit IRC | 20:57 | |
| *** markvoelker has quit IRC | 21:12 | |
| *** dave-mccowan has quit IRC | 21:18 | |
| lbragstad | well - by not using a for loop over public keys, token validation went from ~1.647363 seconds to ~0.008633 seconds with 100+ public keys (simulating a deployment with over 100 individual API servers) | 21:29 |
| kmalloc | :) | 21:38 |
| *** erus1 has quit IRC | 21:38 | |
| kmalloc | that is a real improvement | 21:38 |
| *** erus1 has joined #openstack-keystone | 21:38 | |
| gyee | public keys? are we bringing back PKI token? | 21:41 |
| lbragstad | nope | 21:41 |
| lbragstad | well... jws tokens | 21:41 |
| gyee | oic | 21:42 |
| gyee | interesting, why not go all in on PKI then? we need a system to trust that public key anyway | 21:45 |
| lbragstad | the idea of bringing pki tokens back has been brought up a few times | 21:45 |
| kmalloc | JWS is essentially PKI tokens but we don't need to encode the entire payload still. | 21:46 |
| gyee | no necessary PKI token, but using a proper X.509 cert to convey that public key | 21:46 |
| lbragstad | having the whole response in the token id was a bit of a deal breaker | 21:46 |
| kmalloc | ^^ | 21:46 |
| gyee | no, you just need to have the unique id of the cert there | 21:47 |
| lbragstad | actually - nevermind... my test failed, those numbers might not be accurate | 21:57 |
| kmalloc | gyee: a fingerprint is sufficient as part of the payload. | 22:00 |
| kmalloc | (this is not encrypted, this is signed) | 22:00 |
| lbragstad | nevermind - i'm not seeing much of a performance difference | 22:06 |
| lbragstad | token validation is just slow without caching i thin | 22:06 |
| lbragstad | think* | 22:06 |
| *** markvoelker has joined #openstack-keystone | 22:10 | |
| lbragstad | i guess i'm just surprised that implementing an in-process cache doesn't have as much of an effect on performance as i was thinking | 22:10 |
| lbragstad | i'm curious to hear if wxy-xiyuan has more details | 22:10 |
| lbragstad | sounds like an internal team hit an issue iterating over all keys downstream | 22:11 |
| kmalloc | lbragstad: do harddisk performance test while runnign your test | 22:32 |
| kmalloc | simulate load on the disks while running the validation test | 22:33 |
| kmalloc | and yeah token caching off is slow | 22:34 |
| kmalloc | known | 22:34 |
| lbragstad | yeah | 22:41 |
| *** markvoelker has quit IRC | 22:42 | |
| *** whoami-rajat has quit IRC | 23:08 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!