| openstackgerrit | Ilya Sviridov proposed openstack/keystone master: IAM integration https://review.openstack.org/648296 | 00:27 |
|---|---|---|
| *** lbragstad has joined #openstack-keystone | 00:45 | |
| *** ChanServ sets mode: +o lbragstad | 00:45 | |
| *** lbragstad has quit IRC | 00:57 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:58 | |
| *** ileixe has joined #openstack-keystone | 01:03 | |
| *** jamesmcarthur has quit IRC | 01:07 | |
| *** awalende has joined #openstack-keystone | 01:13 | |
| *** gyee has quit IRC | 01:16 | |
| *** awalende has quit IRC | 01:18 | |
| *** sapd1 has joined #openstack-keystone | 01:35 | |
| *** jhesketh has joined #openstack-keystone | 02:12 | |
| *** whoami-rajat has joined #openstack-keystone | 02:58 | |
| *** erus has quit IRC | 03:28 | |
| *** erus has joined #openstack-keystone | 03:29 | |
| *** ileixe has quit IRC | 04:29 | |
| *** shyamb has joined #openstack-keystone | 04:44 | |
| *** rcernin has quit IRC | 04:47 | |
| *** erus has quit IRC | 04:47 | |
| *** erus has joined #openstack-keystone | 04:47 | |
| *** shyamb has quit IRC | 04:53 | |
| *** erus has quit IRC | 04:53 | |
| *** erus has joined #openstack-keystone | 04:54 | |
| *** ileixe has joined #openstack-keystone | 04:57 | |
| *** rcernin has joined #openstack-keystone | 05:01 | |
| *** shyamb has joined #openstack-keystone | 05:03 | |
| *** markvoelker has joined #openstack-keystone | 05:04 | |
| *** whoami-rajat has quit IRC | 05:07 | |
| *** erus has quit IRC | 05:48 | |
| *** erus has joined #openstack-keystone | 05:48 | |
| *** rcernin has quit IRC | 06:03 | |
| *** shyamb has quit IRC | 06:27 | |
| *** whoami-rajat has joined #openstack-keystone | 06:31 | |
| *** shyamb has joined #openstack-keystone | 06:38 | |
| *** rcernin has joined #openstack-keystone | 06:47 | |
| *** rcernin has quit IRC | 06:47 | |
| *** rcernin has joined #openstack-keystone | 06:48 | |
| *** ileixe has quit IRC | 07:02 | |
| *** phasespace has quit IRC | 07:02 | |
| *** ileixe has joined #openstack-keystone | 07:03 | |
| *** pcaruana has joined #openstack-keystone | 07:20 | |
| *** shyamb has quit IRC | 07:36 | |
| *** erus has quit IRC | 07:36 | |
| *** erus has joined #openstack-keystone | 07:36 | |
| *** shyamb has joined #openstack-keystone | 07:46 | |
| *** phasespace has joined #openstack-keystone | 07:46 | |
| *** rcernin has quit IRC | 07:48 | |
| *** erus has quit IRC | 07:48 | |
| *** erus has joined #openstack-keystone | 07:49 | |
| *** shyamb has quit IRC | 07:56 | |
| *** rcernin has joined #openstack-keystone | 08:04 | |
| *** tkajinam has quit IRC | 08:09 | |
| *** awalende has joined #openstack-keystone | 08:16 | |
| *** zlangi has joined #openstack-keystone | 08:24 | |
| *** erus has quit IRC | 08:26 | |
| *** erus has joined #openstack-keystone | 08:26 | |
| *** zlangi has quit IRC | 08:35 | |
| *** shyamb has joined #openstack-keystone | 08:47 | |
| *** ileixe has quit IRC | 09:18 | |
| *** ileixe has joined #openstack-keystone | 09:29 | |
| *** shyamb has quit IRC | 09:37 | |
| *** shyamb has joined #openstack-keystone | 09:44 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Raise METHOD NOT ALLOWED instead of 500 error on protocol create https://review.openstack.org/648241 | 10:00 |
| cmurphy | kmalloc: ^ fixed the unit test for that | 10:00 |
| cmurphy | can only get the expected flask response by using test_client() | 10:01 |
| *** shyamb has quit IRC | 10:03 | |
| *** shyamb has joined #openstack-keystone | 10:12 | |
| *** melwitt has quit IRC | 10:26 | |
| *** melwitt has joined #openstack-keystone | 10:32 | |
| *** hoonetorg has quit IRC | 10:39 | |
| *** hoonetorg has joined #openstack-keystone | 10:52 | |
| *** mvkr has joined #openstack-keystone | 11:09 | |
| *** whoami-rajat has quit IRC | 12:10 | |
| *** markvoelker has quit IRC | 12:20 | |
| *** whoami-rajat has joined #openstack-keystone | 12:20 | |
| *** lbragstad has joined #openstack-keystone | 12:30 | |
| *** ChanServ sets mode: +o lbragstad | 12:30 | |
| *** shyamb has quit IRC | 12:38 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:45 | |
| *** mchlumsky has joined #openstack-keystone | 12:47 | |
| *** lbragstad has quit IRC | 12:49 | |
| jdennis | cmurphy: are the keystone meeting minutes archived somewhere (hopefully where you can search across all the minutes) | 12:50 |
| *** shyamb has joined #openstack-keystone | 12:50 | |
| *** raildo has joined #openstack-keystone | 12:52 | |
| cmurphy | jdennis: they're archived here http://eavesdrop.openstack.org/meetings/keystone/2019/ so not very searchable unless you want to download all of them | 12:52 |
| jdennis | cmurphy: thanks, I'm trying to research a customer RFE and there is a chance it was once a blueprint, last time I looked at keystone's bp list there were quite a few but not there are just 3, were the abondoned bp removed and if so are they archived somewhere? | 12:56 |
| cmurphy | jdennis: they were converted into RFE bugs, so you can probably find it in https://bugs.launchpad.net/keystone/+bugs?field.tag=rfe | 12:56 |
| jdennis | cmurphy: many thanks | 12:57 |
| cmurphy | you're welcome | 12:57 |
| jdennis | cmurphy: btw, that federation bug with mellon we worked on a while back required a fix to the Lasso library, that fix merged upstream recently | 12:58 |
| *** ileixe has quit IRC | 13:00 | |
| cmurphy | jdennis: good to hear, i suppose we should close the bug but i'm not sure when the fix will land in which distros/packages | 13:00 |
| *** lbragstad has joined #openstack-keystone | 13:02 | |
| *** ChanServ sets mode: +o lbragstad | 13:02 | |
| jdennis | cmurphy: the RFE I was researching was the ability to force a specific UUID when a user is created, I recall a discussion on this topic (at one of the OpenStack conferences?) and issues were raised but that's all I recall. Do you remember anything with respect to forcing a specific UUID to a user? | 13:04 |
| cmurphy | jdennis: it comes up fairly often | 13:05 |
| cmurphy | jdennis: this is what we have currently proposed http://specs.openstack.org/openstack/keystone-specs/specs/keystone/stein/explicit-domains-ids.html | 13:05 |
| cmurphy | ayoung has some patches up but they didn't make it into stein | 13:05 |
| jdennis | cmurphy: thanks | 13:05 |
| *** lbragstad has quit IRC | 13:07 | |
| *** erus has quit IRC | 13:15 | |
| *** erus has joined #openstack-keystone | 13:16 | |
| *** lbragstad has joined #openstack-keystone | 13:17 | |
| *** ChanServ sets mode: +o lbragstad | 13:17 | |
| *** jhesketh has quit IRC | 13:18 | |
| *** itlinux has quit IRC | 13:26 | |
| *** shyamb has quit IRC | 13:26 | |
| gagehugo | o/ | 13:27 |
| lbragstad | good UGT | 13:37 |
| cmurphy | \o | 13:37 |
| zigo | Hi there. | 13:45 |
| zigo | What changed in Stein that makes it impossible for me to bootstrap the admin user correctly? What do I need to do? | 13:46 |
| zigo | A new role or something? | 13:46 |
| zigo | Looks like to me, there's some policy change or something... | 13:46 |
| zigo | Is it the new --bootstrap-service-name thing? | 13:46 |
| kmalloc | Thanks :) | 13:49 |
| zigo | Ah no, my bad. | 13:50 |
| zigo | Unrelated. | 13:50 |
| kmalloc | I was 2x checking if the 405 was really correct | 13:50 |
| zigo | So, what's wrong? | 13:50 |
| kmalloc | Otherwise it's good | 13:50 |
| cmurphy | zigo: what problem are you having? | 13:50 |
| cmurphy | kmalloc: i'm still slightly doubtful but will defer to you | 13:51 |
| kmalloc | Yeah let me confirm, I might respin to 404 this morning. | 13:51 |
| kmalloc | I just barely woke up 3 minutes ago. :P | 13:51 |
| zigo | cmurphy: You are not authorized to perform the requested action: identity:create_project. (HTTP 403) (Request-ID: req-b84c5980-c4f5-4cd1-8783-c6083d7382f4) | 13:51 |
| zigo | cmurphy: That's when my package does: openstack project create --or-show service --description "Default Debian service project" | 13:51 |
| *** jamesmcarthur has quit IRC | 13:52 | |
| zigo | This used to work in Rocky... | 13:52 |
| cmurphy | lbragstad: want to tackle that ^ | 13:52 |
| lbragstad | zigo how are you bootstrapping the admin user? | 13:53 |
| knikolla | o/ | 13:54 |
| zigo | export OS_BOOTSTRAP_USERNAME=${ADMIN_USER_NAME} | 13:55 |
| zigo | export OS_BOOTSTRAP_PROJECT_NAME=${ADMIN_TENANT_NAME} | 13:55 |
| zigo | export OS_BOOTSTRAP_PASSWORD=${ADMIN_USER_PW} | 13:55 |
| zigo | su keystone -s /bin/sh -c 'keystone-manage bootstrap --bootstrap-role-name admin --bootstrap-service-name keystone --bootstrap-region-id regionOne --bootstrap-admin-url http://IP:5000 --bootstrap-public-url http://IP:5000 --bootstrap-internal-url http://IP:5000' | 13:55 |
| *** erus has quit IRC | 13:55 | |
| knikolla | adriant: whenever you are around i have a few questions about adjutant unit tests. | 13:55 |
| zigo | cmurphy: Like this... | 13:55 |
| *** erus has joined #openstack-keystone | 13:55 | |
| lbragstad | oh.. you're not getting that error when you do bootstrap per se | 13:57 |
| lbragstad | you're getting a 403 immediately after you run bootstrap and try creating a service project, right? | 13:57 |
| zigo | lbragstad: Exactly, yes. | 14:02 |
| zigo | When I'm supposed to be admin, and it's supposed to be ok ... | 14:04 |
| lbragstad | are you supplying policy overrides in your policy file? | 14:04 |
| zigo | lbragstad: What's that? | 14:04 |
| zigo | I'm just shipping the normal /etc/keystone/policy.json ... | 14:04 |
| lbragstad | does it contain anything? | 14:04 |
| zigo | lbragstad: Sure, all the rules generated by oslo-policy-sample-generator ... | 14:05 |
| zigo | When I edit it, and remove the restrictions, of course, it starts to work. | 14:05 |
| zigo | Though what I wonder is why can't the admin user do stuff by default ... | 14:05 |
| zigo | My Debian package hasn't changed much since Rocky. | 14:05 |
| lbragstad | what do the keystone logs say when you do this? | 14:05 |
| zigo | Looking ... | 14:06 |
| zigo | lbragstad: http://paste.openstack.org/show/748536/ | 14:07 |
| *** erus has quit IRC | 14:07 | |
| zigo | the policy requires ['system'] scope <--- What's that? | 14:07 |
| *** erus has joined #openstack-keystone | 14:07 | |
| lbragstad | zigo it's a new concept that was introduced in Queens and we're starting to roll it out across projects, but heavily in keystone this release | 14:08 |
| lbragstad | zigo how familiar are you with RBAC authorization in OpenStack? | 14:09 |
| cmurphy | it should have no effect if [oslo_policy]/enforce_scope=false which should be the default | 14:09 |
| zigo | lbragstad: Well, I've been packaging OpenStack in Debian since 2011, wrote my own installer, etc... | 14:09 |
| lbragstad | unless there is an override | 14:09 |
| zigo | So I know what the roles are for. | 14:09 |
| lbragstad | zigo awesome | 14:10 |
| lbragstad | zigo system scope is a way for services to protect their deployment level APIs | 14:10 |
| lbragstad | ultimately, it's a way to solve the problem where anyone with the `admin` role on a project can do anything in the deployment by default | 14:10 |
| zigo | cmurphy: You are right, it looks like enforce_scope is set to false by default. | 14:11 |
| lbragstad | zigo can you paste the actual policy check string for identity:update_project ? | 14:11 |
| cmurphy | zigo: but what lbragstad said is right, if you are overriding the policy files - which you are, if you're generating those files and installing them in /etc/keystone - then enforce_scope doesn't matter | 14:11 |
| lbragstad | enforce_scope = False will just give you warning that someone is using the wrong scope to access a resource | 14:12 |
| lbragstad | (e.g., someone using a project-scoped token to update a project) | 14:12 |
| *** mvkr has quit IRC | 14:12 | |
| zigo | "identity:update_project": "role:admin and system_scope:all" | 14:13 |
| zigo | So, how do I get my script to gain the system_scope token type? :) | 14:13 |
| * lbragstad grabs a link | 14:13 | |
| lbragstad | so - it looks like oslo policy isn't OR'ing the policies when they are generated | 14:14 |
| *** erus has quit IRC | 14:14 | |
| lbragstad | also - if you're not overriding a policy, you probably don't need to have it in your policy file (which should help mitigate issues like this) | 14:14 |
| lbragstad | we keep all the defaults in code now | 14:15 |
| *** erus has joined #openstack-keystone | 14:15 | |
| zigo | lbragstad: Do you mean I should replace the "and" by an "or" ? | 14:15 |
| lbragstad | this is an exmaple of how you would get a system-scoped token directly from the API https://developer.openstack.org/api-ref/identity/v3/index.html?expanded=token-authentication-with-scoped-authorization-detail#id30 | 14:15 |
| lbragstad | oh - no | 14:16 |
| lbragstad | the default policy for identity:update_project is https://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/policies/project.py#n129 | 14:16 |
| zigo | lbragstad: Ok for the json bits, but in my Debian package maintainer script, I'm just with the shell ... | 14:17 |
| lbragstad | but - notice we deprecated the *old* policy, which was project specific | 14:17 |
| lbragstad | https://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/policies/project.py#n65 is the old policy | 14:17 |
| lbragstad | in the event the operator isn't overriding the policy | 14:17 |
| lbragstad | oslo.policy will apply a logical OR to those two policies | 14:17 |
| lbragstad | which allows for smoother upgrades | 14:18 |
| lbragstad | and less security holes when people switch to the new release | 14:18 |
| lbragstad | that's all that i meant by the oslo.policy OR comment | 14:18 |
| lbragstad | you can do something like `openstack project create --or-show service --description "some description" --os-system-scope all` | 14:20 |
| lbragstad | or you can specify it in an RC file | 14:20 |
| zigo | lbragstad: Can't I just use --os-system-scope all when I'm doing the bootstraping? | 14:20 |
| lbragstad | or you can define system-scope in clouds.yaml https://pasted.tech/pastes/b7fe96e3a12fcaa4eecf8e87aa3d882776c1a20f.raw | 14:20 |
| zigo | My code is here: https://salsa.debian.org/openstack-team/services/keystone/blob/debian/stein/debian/keystone.postinst.in#L36 | 14:20 |
| lbragstad | so line 93 is what fails? | 14:21 |
| zigo | Yeah... | 14:21 |
| zigo | And the lines after that... | 14:21 |
| lbragstad | so - you can add export OS_SYSTEM_SCOPE=all at line 42 | 14:22 |
| zigo | Ah, thanks ! :) | 14:22 |
| lbragstad | `export OS_SYSTEM_SCOPE=all` | 14:22 |
| lbragstad | but... | 14:23 |
| zigo | Not working... | 14:24 |
| *** erus has quit IRC | 14:24 | |
| lbragstad | sorry - it might need to go up a level | 14:24 |
| *** erus has joined #openstack-keystone | 14:24 | |
| lbragstad | working on a diff for you | 14:24 |
| lbragstad | on sec | 14:24 |
| lbragstad | one sec* | 14:24 |
| * zigo .oO( Hopefully, puppet-openstack is fixed for this bits already...) | 14:25 | |
| *** awalende has quit IRC | 14:27 | |
| *** jamesmcarthur has joined #openstack-keystone | 14:27 | |
| *** awalende has joined #openstack-keystone | 14:27 | |
| zigo | FYI, I looked into https://docs.openstack.org/keystone/latest/admin/bootstrap.html and these things aren't documented at all. I would strongly suggest the team to edit the doc before the final release, otherwise, you wont get a happy debian developer's kindly asking for help, but very frustrated users ! :) | 14:27 |
| kmalloc | The core of the issue seems to be the sample generator | 14:27 |
| kmalloc | You're overriding the in-code policy | 14:28 |
| lbragstad | https://pasted.tech/pastes/0267672e544438935dbcef2fa3115caada794d59.raw | 14:28 |
| kmalloc | By providing a policy file at all | 14:28 |
| * lbragstad isn't sure if the sample generator should generate OR'd policies | 14:28 | |
| kmalloc | It should not | 14:28 |
| zigo | Right, that's what I was saying: --os-system-scope all a bit everywhere ! :) | 14:29 |
| zigo | Thanks. | 14:29 |
| zigo | Will try that. | 14:29 |
| kmalloc | If no policy is overridden, there should be no policy on disk | 14:29 |
| kmalloc | On-disk policy is to change behavior, and prevent the "OR" | 14:29 |
| zigo | kmalloc: For Debian users, it's much nicer to have a plain text file that tells what's going on, rather than nothing. | 14:30 |
| zigo | Oh... | 14:30 |
| zigo | kmalloc: So, basically, if I remove the file, then everything will work again? | 14:30 |
| zigo | Got ya ... | 14:30 |
| kmalloc | It should! | 14:30 |
| *** whoami-rajat has quit IRC | 14:30 | |
| kmalloc | :) | 14:30 |
| zigo | Let me try then. | 14:30 |
| kmalloc | We might want to add a sample with deprecated option | 14:30 |
| kmalloc | For the cases like zigo, explicitly opted in to generate it and provide the "or" | 14:31 |
| *** awalende has quit IRC | 14:32 | |
| lbragstad | zigo but.. even if you remove the file, at some point in the future you might be in the same predicament | 14:32 |
| kmalloc | Yeah. | 14:32 |
| kmalloc | But that would be clearly in upgrade docs. | 14:32 |
| lbragstad | ultimately, you'll need to update clients to ask for the right scope when working with specific resourecs | 14:32 |
| lbragstad | resources* | 14:32 |
| lbragstad | for example, this would fix the issue for you https://pasted.tech/pastes/cb5b02a4edfdefea9739eac707f93a80f79003c7.raw | 14:32 |
| lbragstad | er... future-proof your script by always using a system-scoped token when dealing with project resources | 14:33 |
| kmalloc | I'll be back post coffee. | 14:33 |
| zigo | If I remove the policy.json, then keystone just crashes ... | 14:33 |
| zigo | FileNotFoundError: [Errno 2] No such file or directory: '/etc/keystone/policy.json' | 14:33 |
| zigo | So, not an option. | 14:33 |
| lbragstad | (because using a project-scoped token to access projects violates tenancy) | 14:33 |
| lbragstad | zigo remove the path to that file in your /etc/keystone/keystone.conf | 14:33 |
| *** phasespace has quit IRC | 14:36 | |
| lbragstad | you could be setting that file in keystone.conf https://docs.openstack.org/keystone/latest/configuration/config-options.html#oslo_policy.policy_file | 14:36 |
| *** yan0s has joined #openstack-keystone | 14:37 | |
| *** mvkr has joined #openstack-keystone | 14:37 | |
| zigo | lbragstad: If I set policy_file to empty, then keystone tries to load /etc/keystone which is a directory, then fails and crashes ... | 14:38 |
| zigo | The only way I see that will fix my issue is to edit the policy.json and get rid of the system scope stuff there. | 14:38 |
| zigo | Which is quite annoying, and counter-productive considering what the team's done. | 14:38 |
| lbragstad | what do you have set in your configuration file that's policy related? | 14:39 |
| zigo | lbragstad: Absolutely nothing, just the default, as per the generated config file. | 14:40 |
| zigo | http://paste.openstack.org/show/748537/ | 14:41 |
| zigo | That's my keystone.conf | 14:41 |
| zigo | Quite pristine ... | 14:41 |
| lbragstad | https://pasted.tech/pastes/e4a87a0ece29f49a4cde8de8990220892a1d4077.raw is what i have | 14:41 |
| zigo | This config I pasted is the one set by the package, which only sets the db and nothing more. I have a more rich thing in production, fixed by puppet-keystone. | 14:42 |
| lbragstad | that makes sense | 14:43 |
| lbragstad | does https://pasted.tech/pastes/cb5b02a4edfdefea9739eac707f93a80f79003c7.raw work for you? | 14:44 |
| zigo | Should I just sed -i 's/ and system_scope:all//g' ? | 14:44 |
| zigo | lbragstad: Nope, it fails too... | 14:44 |
| lbragstad | i wouldn't, because some day in the future we're going to remove the deprecated policies | 14:44 |
| lbragstad | on the same line? | 14:44 |
| zigo | Oh... | 14:44 |
| lbragstad | or on another line? | 14:44 |
| zigo | Nope, it fails too. | 14:46 |
| lbragstad | do you have a log? | 14:47 |
| zigo | Oh, hang on. | 14:47 |
| zigo | policy.json missing | 14:47 |
| *** itlinux has joined #openstack-keystone | 14:47 | |
| lbragstad | also - i removed the project specific bits since they're not need if you're only call system-specific APIs https://pasted.tech/pastes/a08473fc3de72bd9a5aa54ad166bd5d579e09833.raw | 14:49 |
| lbragstad | not needed* | 14:50 |
| zigo | I still get: You are not authorized to perform the requested action: identity:update_project.: keystone.exception.ForbiddenAction: You are not authorized to perform the requested action: identity:update_project. | 14:50 |
| zigo | Is it a security risk if I just get rid of the " and system_scope:all" in policy.json ? | 14:51 |
| lbragstad | yeah - it would be | 14:53 |
| zigo | :/ | 14:53 |
| lbragstad | because then a user with `admin` on a project can modify projects | 14:53 |
| lbragstad | or the service catalog | 14:53 |
| lbragstad | you could just use a completely empty policy file, too | 14:53 |
| zigo | Well, why would I give the admin flag? | 14:53 |
| zigo | I mean role... | 14:53 |
| lbragstad | to allow APIs to be more self-serviceable might be an example of why someone would need admin on a project, or domain | 14:56 |
| lbragstad | but if you remove the override all together, the default and the deprecated default should be pulled from keystone | 14:56 |
| zigo | Well, told ya, when I set an empty value for policy_file, then keystone just crashes at start ... :/ | 14:57 |
| zigo | So I can't just "remove the file". | 14:57 |
| lbragstad | that blows my mind, because i haven't used a policy file or defined one in configuration in a long time | 14:59 |
| lbragstad | what if you just remove the contents? | 14:59 |
| *** erus has quit IRC | 15:01 | |
| *** erus has joined #openstack-keystone | 15:01 | |
| zigo | trying... | 15:04 |
| lbragstad | bnemec any idea on that? | 15:05 |
| bnemec | I'm not sure you want to set an empty value for policy_file. That's not necessarily the same thing as leaving it unset. | 15:07 |
| lbragstad | well - i think the crux of it was that keystone was crashing when it *wasn't* set | 15:08 |
| lbragstad | which is strange because I haven't set a value for policy_file in keystone for a long time | 15:08 |
| bnemec | Yeah, but there's a default value of 'policy.json' in oslo.policy, so if your deployment is creating an empty one in the right location you might not notice. | 15:09 |
| bnemec | I have no idea if that's the case, but it's one possibility. | 15:09 |
| bnemec | Oh, and projects can override the default for that: https://github.com/openstack/oslo.policy/blob/master/oslo_policy/opts.py#L107 | 15:10 |
| lbragstad | hmmm | 15:11 |
| lbragstad | http://paste.openstack.org/show/748537/ is the configuration file zigo is using | 15:11 |
| lbragstad | and for some reason keystone barfs on that but not on https://pasted.tech/pastes/e4a87a0ece29f49a4cde8de8990220892a1d4077.raw | 15:12 |
| bnemec | I assume keystone is failing on 'policy.json not found' or something like that? | 15:13 |
| zigo | lbragstad: An empty policy.json seems to do the trick. | 15:13 |
| zigo | But then how can I be sure that policy is enforced correctly? | 15:14 |
| lbragstad | with the system-scope changes to your installation script? | 15:14 |
| zigo | lbragstad: For the moment, yeah, it's there... | 15:14 |
| zigo | --os-system-scope all | 15:14 |
| lbragstad | ok | 15:14 |
| zigo | I can try without it. | 15:15 |
| lbragstad | https://pasted.tech/pastes/5a932d51c7c31945c242d2ca0915d894752fd123 | 15:15 |
| lbragstad | ^ no policy file defined, no policy file on disk | 15:15 |
| lbragstad | and that allows me to do - https://pasted.tech/pastes/29a3a2c508c0e3825ff6afb9d5192c39ce731029 | 15:16 |
| zigo | Looks like it all works without the --os-system-scope all thingy ... | 15:16 |
| zigo | So, I'll go for the empty policy.json file by default then. | 15:17 |
| zigo | Thanks a lot. | 15:17 |
| lbragstad | yeah - that's because keystone is applying a logical OR to the deprecated policy and the new default (which is system-specific) | 15:17 |
| zigo | Though the system-specific one seems kind of failing over, apparently ... :P | 15:17 |
| lbragstad | falling over? | 15:17 |
| zigo | Well, if there's only that one, then nothing works anymore, as you saw, with the policy.json file on disk. | 15:18 |
| * lbragstad tries locally | 15:18 | |
| *** erus has quit IRC | 15:23 | |
| *** erus has joined #openstack-keystone | 15:24 | |
| lbragstad | zigo bnemec https://pasted.tech/pastes/7ca657728bf0d3f5247ac2a16cb013718e59e81e.raw | 15:25 |
| lbragstad | so that's overriding the update_project policy in policy.yaml with the same policy that zigo was using | 15:25 |
| lbragstad | and using system-scope to access it from the APIO | 15:25 |
| lbragstad | API* | 15:25 |
| lbragstad | fwiw --os-cloud devstack-admin is a project-scoped context | 15:26 |
| lbragstad | --os-cloud devstack-system-admin is a system-scoped context | 15:26 |
| *** smcginnis has joined #openstack-keystone | 15:28 | |
| *** jhesketh has joined #openstack-keystone | 15:28 | |
| zigo | Ok, I'm uploading keystone to Debian with the empty policy.json trick then... :P | 15:33 |
| *** erus has quit IRC | 15:33 | |
| zigo | The package just check if there's no policy.json in /etc/keystone, and creates an empty one if there's none, that's it. | 15:33 |
| zigo | So an admin can still override ... | 15:33 |
| *** erus has joined #openstack-keystone | 15:33 | |
| zigo | If the team says it's fine this way, then we're done! :) | 15:33 |
| *** jhesketh has quit IRC | 15:34 | |
| lbragstad | it should be fine since it'll just be using the policies that are registered in code, which should allow for smoother upgrades... | 15:35 |
| zigo | :) | 15:35 |
| lbragstad | but i find it weird that i can't recreate this issue where keystone crashes because the policy file doesn't exist | 15:35 |
| zigo | lbragstad: Are you using devstack? | 15:35 |
| lbragstad | yes | 15:36 |
| zigo | lbragstad: Wait for a bit when my package is uploaded to Debian Experimental, then you can try in Buster / Sid directly ... | 15:36 |
| lbragstad | ok | 15:36 |
| zigo | (Stein goes to Experimental, since Buster is in freeze and got Rocky in it) | 15:36 |
| zigo | FYI, for Stein, I switched Keystone to use uwsgi, like I'm doing for most OpenStack services these days. | 15:37 |
| lbragstad | nice | 15:37 |
| *** erus has quit IRC | 15:51 | |
| *** erus has joined #openstack-keystone | 15:51 | |
| cmurphy | there are a few more patches for master that we need asap so we can backport to stein https://review.openstack.org/#/c/647737/ https://review.openstack.org/647498 https://review.openstack.org/643937 https://review.openstack.org/647586 https://review.openstack.org/648241 | 15:56 |
| cmurphy | lbragstad don't look | 15:56 |
| cmurphy | except for https://review.openstack.org/648241 | 15:57 |
| *** smcginnis has left #openstack-keystone | 15:58 | |
| lbragstad | https://review.openstack.org/#/c/648241/3/keystone/tests/unit/test_v3_federation.py,unified@1547 is only testing the absence of the trailing / ? | 16:00 |
| lbragstad | otherwise those two are identical? | 16:00 |
| cmurphy | correct | 16:00 |
| cmurphy | i think kmalloc is still coffeeing and considering whether that needs to be a 404 or 405 | 16:01 |
| lbragstad | ok - looks good to me | 16:03 |
| kmalloc | Yeah. | 16:04 |
| kmalloc | I need to check one thing. | 16:04 |
| kmalloc | I think the trailing / is all that I changed, and the non trailing / case was already working like the test expected | 16:05 |
| *** erus has quit IRC | 16:05 | |
| kmalloc | I want to be sure and in that case a 404 might be better. | 16:05 |
| kmalloc | Because / is routed, but is invalid data. | 16:05 |
| * bnemec hates significant trailing /'s | 16:05 | |
| kmalloc | bnemec: it is significant in routing, in rest a /xxxxx is a resource, and without / is a list | 16:06 |
| *** erus has joined #openstack-keystone | 16:06 | |
| kmalloc | And / without xxxx is saying resource=None (oddly) | 16:06 |
| bnemec | Yeah, I'm sure there are good reasons, but I've lost so much time over the years debugging problems that turned out to be because I had/didn't have a trailing / on an address. | 16:07 |
| bnemec | My face can only take so many palms. :-P | 16:07 |
| *** gyee has joined #openstack-keystone | 16:12 | |
| *** yan0s has quit IRC | 16:15 | |
| *** erus has quit IRC | 16:18 | |
| *** erus has joined #openstack-keystone | 16:18 | |
| *** whoami-rajat has joined #openstack-keystone | 16:32 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 17:17 | |
| *** jamesmcarthur has quit IRC | 17:21 | |
| *** erus has quit IRC | 17:25 | |
| *** erus has joined #openstack-keystone | 17:26 | |
| *** mvkr has quit IRC | 17:31 | |
| *** itlinux has quit IRC | 17:46 | |
| *** itlinux has joined #openstack-keystone | 17:47 | |
| *** erus has quit IRC | 18:02 | |
| *** erus has joined #openstack-keystone | 18:03 | |
| kmalloc | cmurphy: ok, so let me try something. i think the trailing slash should be 404 now that i've dug into it | 18:25 |
| kmalloc | and a non-trailing slash should be 405. | 18:26 |
| *** jamesmcarthur_ has quit IRC | 18:47 | |
| cmurphy | interesting | 18:49 |
| *** rcernin has quit IRC | 19:36 | |
| *** jamesmcarthur has joined #openstack-keystone | 19:51 | |
| *** erus has quit IRC | 19:51 | |
| *** erus has joined #openstack-keystone | 19:51 | |
| *** erus has quit IRC | 19:57 | |
| *** erus has joined #openstack-keystone | 19:58 | |
| *** mchlumsky has quit IRC | 19:58 | |
| *** pcaruana has quit IRC | 20:08 | |
| *** efried has quit IRC | 20:22 | |
| *** efried has joined #openstack-keystone | 20:26 | |
| *** efried has quit IRC | 20:44 | |
| kmalloc | cmurphy: oh so this bug affects delete *and* patch as well | 20:52 |
| kmalloc | cmurphy: =/ | 20:53 |
| kmalloc | fixing it now | 20:53 |
| kmalloc | i'm creating a new resource for it. | 20:53 |
| kmalloc | just no other good way to do it. | 20:53 |
| *** itlinux has quit IRC | 20:59 | |
| cmurphy | o7 | 20:59 |
| *** raildo has quit IRC | 21:03 | |
| *** openstackgerrit has quit IRC | 21:07 | |
| redrobot | ohai again Keystone friends | 21:14 |
| kmalloc | going to need some serious reworking to handle these cases. | 21:16 |
| redrobot | I was wondering why keystone-manage is installed to different locations in Ubuntu vs Fedora ? | 21:17 |
| redrobot | in Ubuntu it's /usr/local/bin/keystone-manage | 21:18 |
| redrobot | but in Fedora it's /usr/bin/keystone-manage | 21:18 |
| redrobot | Seems to be a recent change | 21:19 |
| redrobot | I just noticed because it broke the Fedora gate in Barbican | 21:20 |
| redrobot | because it's looking for keystone-manage in /usr/local/bin | 21:20 |
| redrobot | Also noticed there is no Fedora gate for Keystone? | 21:20 |
| cmurphy | redrobot: that's up to the packagers, keystone doesn't control where the distro packages installs the binaries | 21:21 |
| cmurphy | or do you mean in devstack? | 21:23 |
| cmurphy | http://git.openstack.org/cgit/openstack-dev/devstack/tree/inc/python#n41 | 21:24 |
| redrobot | cmurphy, pip install -e path/to/keystone/repo | 21:30 |
| redrobot | cmurphy, so, neither a package nor devstack. Just straight pip | 21:31 |
| *** rcernin has joined #openstack-keystone | 21:44 | |
| kmalloc | cmurphy: ok so have a fix. this was a when this API was ported. all fixed | 21:51 |
| *** openstackgerrit has joined #openstack-keystone | 21:52 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Raise METHOD NOT ALLOWED instead of 500 error on protocol create https://review.openstack.org/648241 | 21:52 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Raise METHOD NOT ALLOWED instead of 500 error on protocol CRUD https://review.openstack.org/648241 | 21:52 |
| kmalloc | ^ fixed and should resolve the issue(s) | 21:52 |
| kmalloc | cmurphy: probably should hve someone not me/lbragstad backport to stien. | 21:52 |
| kmalloc | lbragstad: ^ needs re-+2 | 21:52 |
| cmurphy | kmalloc: so still convinced 405 is right? | 21:55 |
| *** rcernin has quit IRC | 21:55 | |
| cmurphy | glancing at https://specs.openstack.org/openstack/api-sig/guidelines/http/response-codes.html#failure-code-clarifications | 21:55 |
| kmalloc | yes. it is consistent | 21:55 |
| cmurphy | If a request is made to a known resource URI, but the HTTP method used for the request is not supported for that resource, the return code should be 405 Method Not Allowed. The response should include the Allow header with the list of accepted request methods for the resource. | 21:56 |
| kmalloc | which is done by flask | 21:56 |
| kmalloc | the explicit raise is removed | 21:56 |
| kmalloc | the normalization middleware is now doing it's job and mapping trailing '/' to no trailing '/' | 21:56 |
| kmalloc | so OS-FEDERATION/identity_providers/{idp_id}/protcols and OS-FEDERATION/identity_providers/{idp_id}/protcols/ is the same route | 21:57 |
| kmalloc | where OS-FEDERATION/identity_providers/{idp_id}/protcols/{protocol_id} raises a 404 if it doesn't exist or if it fails validation 400 | 21:57 |
| kmalloc | (doesn't exist for delete/patch, put for validation) | 21:57 |
| kmalloc | in the case of OS-FEDERATION/identity_providers/{idp_id}/protcols and OS-FEDERATION/identity_providers/{idp_id}/protcols/ put, delete, and patch are not routed and should raise 405, the method is not allowed | 21:58 |
| kmalloc | it is not acting on a resource | 21:58 |
| kmalloc | a similar case for this is in the OS-EP-FILTER api, we have /<project_id>/endpoints and /<project_id>/endpoints/<endpoint_id> | 21:59 |
| kmalloc | this fix makes the IDP protocols API consistent and fixes the 500 errior | 21:59 |
| kmalloc | the added test is redundant but shows explicit fixing in the way keystone is meant to work | 21:59 |
| kmalloc | i think i derped this one up when porting os-federation | 22:00 |
| kmalloc | initially | 22:00 |
| *** rcernin has joined #openstack-keystone | 22:04 | |
| cmurphy | kmalloc: i think the service provider tests are going to fail, left a comment | 22:05 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Raise METHOD NOT ALLOWED instead of 500 error on protocol CRUD https://review.openstack.org/648241 | 22:06 |
| kmalloc | ^ | 22:06 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Raise METHOD NOT ALLOWED instead of 500 error on protocol CRUD https://review.openstack.org/648241 | 22:07 |
| kmalloc | there | 22:07 |
| cmurphy | lgtm, if that goes through tonight i'll propose the backport when i wake up | 22:09 |
| kmalloc | ++ | 22:10 |
| kmalloc | this was an annoying fix because i haven't looked at this part of keystone in a while (the flask API bit) | 22:11 |
| kmalloc | wasn't too bad to get back into. it would have been a LOT worse with the old wsgi framework (though this wouldn't have happened) | 22:11 |
| *** awalende has joined #openstack-keystone | 22:28 | |
| *** awalende has quit IRC | 22:33 | |
| *** erus has quit IRC | 22:39 | |
| *** erus has joined #openstack-keystone | 22:40 | |
| adriant | knikolla: I doubt you're awake, but feel free to jump into #openstack-adjutant | 22:47 |
| *** erus has quit IRC | 22:52 | |
| *** whoami-rajat has quit IRC | 22:52 | |
| *** erus has joined #openstack-keystone | 22:52 | |
| *** jamesmcarthur has quit IRC | 22:57 | |
| *** tkajinam has joined #openstack-keystone | 22:59 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:14 | |
| *** adriant has quit IRC | 23:34 | |
| *** jamesmcarthur has quit IRC | 23:42 | |
| *** erus has quit IRC | 23:42 | |
| *** erus has joined #openstack-keystone | 23:43 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:43 | |
| *** jamesmcarthur has quit IRC | 23:48 | |
| *** adriant has joined #openstack-keystone | 23:49 | |
| *** gyee has quit IRC | 23:57 | |
| *** jhesketh has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!