| *** lbragstad has joined #openstack-keystone | 00:29 | |
| *** ChanServ sets mode: +o lbragstad | 00:29 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/oslo.policy master: Dropping the py35 testing https://review.openstack.org/652453 | 01:17 |
|---|---|---|
| *** Dinesh__Bhor has quit IRC | 01:19 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:21 | |
| *** lbragstad has quit IRC | 01:50 | |
| *** masayukig has joined #openstack-keystone | 01:55 | |
| *** dave-mccowan has quit IRC | 02:03 | |
| *** masayukig has quit IRC | 02:10 | |
| *** masayukig has joined #openstack-keystone | 02:10 | |
| *** lbragstad has joined #openstack-keystone | 02:12 | |
| *** ChanServ sets mode: +o lbragstad | 02:12 | |
| *** dave-mccowan has joined #openstack-keystone | 02:13 | |
| *** dave-mccowan has quit IRC | 02:17 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:19 | |
| *** jamesmcarthur has quit IRC | 02:26 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:26 | |
| *** jamesmcarthur has quit IRC | 02:32 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:46 | |
| *** jamesmcarthur has quit IRC | 02:49 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:50 | |
| *** jamesmcarthur has quit IRC | 02:54 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:31 | |
| *** jamesmcarthur has quit IRC | 03:32 | |
| *** imacdonn has quit IRC | 04:05 | |
| *** imacdonn has joined #openstack-keystone | 04:06 | |
| *** whoami-rajat has joined #openstack-keystone | 04:37 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Fix federated unscoped federated token formatter https://review.openstack.org/652520 | 04:38 |
| *** jaosorior has joined #openstack-keystone | 04:48 | |
| *** vishakha has joined #openstack-keystone | 04:58 | |
| *** rcernin has quit IRC | 05:08 | |
| *** rcernin has joined #openstack-keystone | 05:10 | |
| *** tkajinam has quit IRC | 05:28 | |
| *** tkajinam has joined #openstack-keystone | 05:54 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone-specs master: NIT : Fix broken link https://review.openstack.org/652569 | 06:17 |
| *** pcaruana has joined #openstack-keystone | 06:19 | |
| *** tkajinam_ has joined #openstack-keystone | 06:48 | |
| *** tkajinam has quit IRC | 06:51 | |
| *** lbragstad has quit IRC | 06:52 | |
| openstackgerrit | zhufl proposed openstack/keystone master: Add missing ws separator between words https://review.openstack.org/652576 | 06:55 |
| *** rcernin has quit IRC | 07:05 | |
| *** spotz has joined #openstack-keystone | 07:22 | |
| *** shyamb has joined #openstack-keystone | 07:44 | |
| *** shyamb has quit IRC | 07:51 | |
| *** phasespace has quit IRC | 08:08 | |
| *** nkinder has quit IRC | 08:10 | |
| *** nkinder has joined #openstack-keystone | 08:13 | |
| *** starborn has joined #openstack-keystone | 08:16 | |
| *** tkajinam_ has quit IRC | 08:20 | |
| *** awalende has joined #openstack-keystone | 08:22 | |
| *** shyamb has joined #openstack-keystone | 08:23 | |
| *** shyamb has quit IRC | 08:50 | |
| *** sapd1 has quit IRC | 08:59 | |
| *** shyamb has joined #openstack-keystone | 09:01 | |
| *** shyamb has quit IRC | 09:23 | |
| *** shyamb has joined #openstack-keystone | 09:23 | |
| pas-ha | hi all, I have a question on this option -`[security_compliance]disable_user_account_days_inactive`. When user is 'disabled' - what is affected? Is user is being still able to authorize? Can this setting be overridden by some user option (like ignore_password_expiry)? | 10:19 |
| openstackgerrit | Merged openstack/keystone master: Add missing ws separator between words https://review.openstack.org/652576 | 10:20 |
| pas-ha | In fact there are more options in this section that when set may currently affect other projects - mostly those that create temporary users on the fly (Heat is the main example that comes to mind right now). | 10:21 |
| *** shyamb has quit IRC | 10:56 | |
| frickler | kmalloc: cmurphy: thanks for digging through that middleware issue. now I'm wondering whether when we plan to actually merge that, we would want/need to be able to make a choice between internal/public and maybe admin for backwards compatibility. and also whether that would be one option used in both locations or possibly two different options | 11:01 |
| frickler | mordred: ^^ too | 11:02 |
| *** shyamb has joined #openstack-keystone | 11:15 | |
| *** raildo has joined #openstack-keystone | 11:30 | |
| *** sapd1 has joined #openstack-keystone | 11:44 | |
| *** mvkr has joined #openstack-keystone | 11:48 | |
| *** thomasmckay has quit IRC | 11:50 | |
| openstackgerrit | Jens Harbott (frickler) proposed openstack/keystonemiddleware master: Add a new option to choose the Identity endpoint https://review.openstack.org/651790 | 12:00 |
| frickler | kmalloc: cmurphy: mordred: ^^ something like this maybe, though I'm not sure yet whether it might be better to be conservative and keep "admin" as the default. moving to "public" might require a major version bump? | 12:02 |
| *** shyamb has quit IRC | 12:07 | |
| *** shyamb has joined #openstack-keystone | 12:11 | |
| kmalloc | Across a release barrier it should be fine to change the default. It probably requires an option (might be doable today with some code changes, didn't look at your proposal yet, it is way pre-coffee for me...) | 12:16 |
| *** shyamb has quit IRC | 12:19 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:24 | |
| *** jamesmcarthur has quit IRC | 12:35 | |
| *** nicolasbock has joined #openstack-keystone | 12:35 | |
| *** shyamb has joined #openstack-keystone | 12:37 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:46 | |
| *** jamesmcarthur has quit IRC | 13:12 | |
| *** shyamb has quit IRC | 13:14 | |
| *** shyamb has joined #openstack-keystone | 13:14 | |
| *** lbragstad has joined #openstack-keystone | 13:14 | |
| *** ChanServ sets mode: +o lbragstad | 13:14 | |
| *** ganso has joined #openstack-keystone | 13:17 | |
| *** jroll has quit IRC | 13:25 | |
| *** jroll has joined #openstack-keystone | 13:26 | |
| ganso | hi keystone folks! I have a question about domains and users and was wondering if anyone could help me. Before v3, the admin was an all-powerful user across all projects (there were no domains back then). Then, when domains were added, we could have domain admins that are not cloud admins (thus, not all-powerful). Having just upgrade from v2 to v3 I am having 2 problems: | 13:29 |
| ganso | 1) my admin user, member of admin_domain, admin project can list users, create users, add roles, etc. I created a demo_domain, demo_project, demo_admin and demo_user. I added the admin role to the demo_admin, but still, my demo_admin cannot list users. Isn't it expected that a domain admin could list and create new users? | 13:32 |
| ganso | 2) I am trying to emulate the old behavior, having the all-powerful admin see all resources of every project in every domain. I assigned the admin role for my admin (all-powerful) user of the demo_domain, demo_project, and also a member role of the demo_project, but still my admin cannot list volumes. In fact, I cannot even authenticate. Is this still possible? Am I missing something? | 13:34 |
| *** shyamb has quit IRC | 13:34 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:35 | |
| *** awalende has quit IRC | 13:38 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 13:46 | |
| *** bnemec has joined #openstack-keystone | 13:46 | |
| *** jamesmcarthur has quit IRC | 13:49 | |
| openstackgerrit | Jens Harbott (frickler) proposed openstack/keystonemiddleware master: Add a new option to choose the Identity endpoint https://review.openstack.org/651790 | 13:58 |
| cmurphy | pas-ha: it sets the 'disabled' attribute on the user, so users can't authenticate (and therefore can't authorize) | 14:03 |
| cmurphy | frickler: kmalloc i think it may be worth a deprecation cycle? | 14:03 |
| cmurphy | ganso: have you changed your keystone policy files at all? | 14:04 |
| ganso | cmurphy: no | 14:04 |
| *** awalende has joined #openstack-keystone | 14:10 | |
| cmurphy | ganso: what version of openstack are you using? | 14:11 |
| ganso | cmurphy: queens | 14:12 |
| ganso | cmurphy: I just upgraded to queens, lost v2, and hence I have noticed the behavior above | 14:12 |
| cmurphy | ganso: how are you authenticating? and what message does it give you when it fails to authenticate? | 14:13 |
| *** awalende has quit IRC | 14:14 | |
| ganso | cmurphy: I am creating a pastebin, just a sec | 14:16 |
| ganso | cmurphy: http://paste.openstack.org/show/749312/ | 14:18 |
| openstackgerrit | Jens Harbott (frickler) proposed openstack/keystonemiddleware master: DNM: Test with admin-less devstack https://review.openstack.org/652037 | 14:18 |
| lbragstad | ganso it looks like you're overriding the policies listed in policy.v3cloudsample.json (and not the default policies) for identity:list_users | 14:23 |
| lbragstad | https://opendev.org/openstack/keystone/src/branch/stable/queens/etc/policy.v3cloudsample.json#L67 | 14:24 |
| kmalloc | Sure deprecation cycle.makes sense. | 14:25 |
| ganso | lbragstad: hmm it is possible the charm did that... I will try to overwrite it with the value from the sample and see what happens. thanks! | 14:27 |
| lbragstad | ganso with queens - you can just comment out that line too and the default in code will take over | 14:27 |
| frickler | cmurphy: kmalloc: how would you deprecate an implicit default? what I can see is: add the option and stick to the original default, change the default next cycle. but I wouldn't call that deprecation | 14:27 |
| ganso | lbragstad: hold on a sec, the line I see different is "cloud_admin", not list_users. | 14:28 |
| frickler | though that would imply we still need added configuration in order to be able to drop the admin endpoint this cycle. may be worth the effort for stability reasons, though. | 14:29 |
| ganso | lbragstad: is that correct? | 14:29 |
| cmurphy | frickler: we'd have to add an explicit log warning for when the setting isn't overridden (plus release note) | 14:29 |
| cmurphy | oslo.config can't really handle it on its own | 14:29 |
| frickler | cmurphy: ah, I see. but that would imply that (a guessed 90%) of all deployments that would just be fine with the changed default, instead need to add the config option in just to drop it again next cycle | 14:32 |
| cmurphy | frickler: oh, for some reason i was thinking there was already a config option that controls this | 14:33 |
| frickler | cmurphy: no, it was a static, hardcoded default | 14:33 |
| cmurphy | right, i remember now | 14:34 |
| frickler | cmurphy: I added it as a config option in the latest PS | 14:34 |
| frickler | though it still fails the lower-constraints job for some reason :( http://logs.openstack.org/90/651790/6/check/openstack-tox-lower-constraints/6e8204d/testr_results.html.gz | 14:34 |
| ganso | lbragstad: ok I replaced the cloud_admin line, which was different, and I still have the same error while listing users | 14:38 |
| ganso | lbragstad: as demo_admin | 14:38 |
| lbragstad | so - are you overriding identity:list_users? | 14:41 |
| lbragstad | or are you using the default of rule:admin_required? | 14:43 |
| cmurphy | kmalloc: lbragstad in light of the impending pike final release we need some reviews https://review.openstack.org/#/q/is:open+NOT+label:workflow%253D-1+branch:%22%255Estable/.*%2524%22+(project:openstack/keystone+OR+project:openstack/keystonemiddleware) | 14:51 |
| kmalloc | Done | 14:56 |
| cmurphy | thanks guys | 14:57 |
| lbragstad | mhmm | 14:57 |
| ganso | lbragstad: my env shows: "identity:list_users": "rule:cloud_admin or rule:admin_and_matching_domain_id", | 15:08 |
| ganso | lbragstad: and the sample policy file you linked shows "identity:list_users": "rule:cloud_admin or rule:admin_and_matching_domain_id", | 15:08 |
| ganso | so it is the same | 15:08 |
| ganso | lbragstad: the only difference is in cloud_admin definition, my env shows: "cloud_admin": "rule:admin_required and (is_admin_project:True or domain_id:d5ec723ddc5b40c89bfc4fce65ebea5a or project_id:768a425c965644f5a5884f19ef9ba302)", | 15:08 |
| ganso | lbragstad: and the default is "cloud_admin": "role:admin and (is_admin_project:True or domain_id:admin_domain_id)", | 15:09 |
| ganso | lbragstad: so I changed to the default, but it still did not change the outcome | 15:09 |
| lbragstad | ok - so | 15:10 |
| lbragstad | that's probably happening because demo_project isn't your is_admin_project | 15:10 |
| lbragstad | i'm not sure how familiar you are with the "admin_project" concept in keystone? | 15:10 |
| lbragstad | it looks like you're policy is still requiring the users to be a "cloud_admin" | 15:13 |
| lbragstad | your* | 15:13 |
| ganso | lbragstad: what about rule:admin_and_matching_domain_id ? | 15:13 |
| lbragstad | ganso that's a workaround to allow domain administrators to list users within the domain they have authorization on | 15:13 |
| ganso | my demo_admin has the admin role for the project, and admin role for the demo_domain | 15:13 |
| ganso | lbragstad: yes, that is what I expected to work. But my demo_admin cannot list users on its domain | 15:14 |
| *** markvoelker has joined #openstack-keystone | 15:20 | |
| lbragstad | ganso unfortunately, i don't think domain admin support is fully baked in keystone with policy overrides alone | 15:27 |
| lbragstad | for example | 15:27 |
| lbragstad | ganso we have a bug fix in stein that fixes all of that | 15:28 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1748027 | 15:28 |
| openstack | Launchpad bug 1748027 in OpenStack Identity (keystone) "The v3 users API should account for different scopes" [High,Fix released] - Assigned to Lance Bragstad (lbragstad) | 15:28 |
| lbragstad | https://review.openstack.org/#/c/647550/ | 15:28 |
| lbragstad | but the fix wasn't completely isolated to policy overrides, we had to make some modifications to the actual API code that processes the requests to ensure we didn't leak users outside of the domain an administrator was scoped to | 15:29 |
| *** erus has joined #openstack-keystone | 15:33 | |
| erus | o/ | 15:33 |
| *** starborn has quit IRC | 15:36 | |
| *** gyee has joined #openstack-keystone | 15:38 | |
| ganso | lbragstad: hmmm I see, so the problem that I am observing in queens is not a configuration problem on my end. It is a known bug and due to that domain admins that are not cloud admins cannot list users, correct? | 15:40 |
| lbragstad | yeah - it's more of an RFE | 15:42 |
| *** erus has quit IRC | 15:42 | |
| lbragstad | ganso but - domain admins can call GET /v3/users/{user_id} if that user is within their domain | 15:43 |
| *** erus has joined #openstack-keystone | 15:43 | |
| lbragstad | and that is supported by policy configuration | 15:44 |
| lbragstad | https://opendev.org/openstack/keystone/src/branch/stable/queens/etc/policy.v3cloudsample.json#L64 makes sure the user in the request ({user_id}) has the same domain id as the domain in the token scope used to make the request | 15:45 |
| lbragstad | that's harder to do with a call like identity:list_users GET /v3/users because there isn't anything to compare the domain id from the request to | 15:45 |
| lbragstad | and that's where we had to make changes to the API to make sure we filter the request according to the domain if the request was made with a domain-scoped token | 15:46 |
| ganso | lbragstad: oh I understand now, thank you! | 15:47 |
| ganso | lbragstad: and regarding my issue #2, where I am trying to have an all-powerful admin see every resource | 15:48 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Fix federated unscoped federated token formatter https://review.openstack.org/652520 | 15:50 |
| lbragstad | ganso yeah - so that's another issue | 15:50 |
| lbragstad | but - still something we're working on | 15:50 |
| ganso | lbragstad: ok, thank you! thought that was misconfiguration on my end as well! =) | 15:50 |
| lbragstad | ganso i should clarify, we're trying to pull support into keystone for a default `reader` role as a first-class citizen | 15:51 |
| lbragstad | https://bugs.launchpad.net/keystone/+bugs?field.tag=default-roles - are the bugs we're using to track that work | 15:51 |
| lbragstad | and most of that work started landing in Stein | 15:51 |
| lbragstad | https://docs.openstack.org/releasenotes/keystone/stein.html goes into detail exactly which APIs in keystone now have a read-only role | 15:52 |
| *** vishakha has quit IRC | 16:38 | |
| *** jmlowe has joined #openstack-keystone | 16:40 | |
| cmurphy | team dinner poll https://framadate.org/BHNNU9S3f9N3lasH | 16:43 |
| *** jmlowe has quit IRC | 16:50 | |
| *** erus has quit IRC | 16:50 | |
| *** erus has joined #openstack-keystone | 16:51 | |
| *** ayoung has joined #openstack-keystone | 17:08 | |
| ayoung | I hjate that I don't get connected automagically anymore | 17:08 |
| clarkb | if you set up sasl it should still work | 17:26 |
| clarkb | most clients do regular client auth concurrently with joining channels which is why the other thing doesn't work | 17:26 |
| clarkb | but sasl auths on connection | 17:26 |
| *** jmlowe has joined #openstack-keystone | 17:30 | |
| *** ayoung has quit IRC | 17:51 | |
| *** erus has quit IRC | 17:51 | |
| *** erus has joined #openstack-keystone | 17:52 | |
| *** jamesmcarthur_ has quit IRC | 18:04 | |
| *** markvoelker has quit IRC | 18:26 | |
| canori01 | hello, so I set admin_project_name and admin_project_domain_name in keystone.conf and see that the values are being set. However, when I assign a user admin role in horizon, they are able to see everything. Is this expected behavior still? | 18:31 |
| *** jmlowe has quit IRC | 18:55 | |
| *** jamesmcarthur has joined #openstack-keystone | 19:01 | |
| *** markvoelker has joined #openstack-keystone | 19:04 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Support endpoint updates in bootstrap https://review.openstack.org/441652 | 19:26 |
| *** jmlowe has joined #openstack-keystone | 20:10 | |
| lbragstad | canori01 it is a behavior we're working to address across projects | 20:23 |
| *** jamesmcarthur has quit IRC | 20:37 | |
| *** erus has quit IRC | 20:37 | |
| *** pcaruana has quit IRC | 20:38 | |
| *** erus has joined #openstack-keystone | 20:38 | |
| *** jamesmcarthur has joined #openstack-keystone | 20:39 | |
| *** dave-mccowan has joined #openstack-keystone | 20:54 | |
| *** jamesmcarthur has quit IRC | 20:56 | |
| *** dave-mccowan has quit IRC | 20:57 | |
| *** ceryx has left #openstack-keystone | 21:01 | |
| *** ccstone has joined #openstack-keystone | 21:02 | |
| *** eglute has joined #openstack-keystone | 21:27 | |
| *** erus has quit IRC | 21:27 | |
| *** erus has joined #openstack-keystone | 21:27 | |
| *** jamesmcarthur has joined #openstack-keystone | 21:27 | |
| *** raildo has quit IRC | 21:29 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Make fetching all foreign keys in a join https://review.openstack.org/347972 | 21:36 |
| *** mvkr has quit IRC | 21:38 | |
| *** awalende has joined #openstack-keystone | 21:40 | |
| *** awalende has quit IRC | 21:45 | |
| *** mvkr has joined #openstack-keystone | 21:51 | |
| *** erus has quit IRC | 21:51 | |
| *** jamesmcarthur has quit IRC | 21:52 | |
| *** erus has joined #openstack-keystone | 21:52 | |
| *** whoami-rajat has quit IRC | 21:54 | |
| *** jamesmcarthur has joined #openstack-keystone | 21:55 | |
| *** jamesmcarthur has quit IRC | 21:55 | |
| *** jamesmcarthur has joined #openstack-keystone | 22:00 | |
| *** jamesmcarthur has quit IRC | 22:25 | |
| *** erus has quit IRC | 22:51 | |
| *** tkajinam has joined #openstack-keystone | 22:53 | |
| *** markvoelker has quit IRC | 22:57 | |
| *** markvoelker has joined #openstack-keystone | 23:08 | |
| *** lbragstad has quit IRC | 23:13 | |
| *** rcernin has joined #openstack-keystone | 23:24 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!