| *** lbragstad has quit IRC | 00:23 | |
| *** ayoung has joined #openstack-keystone | 01:32 | |
| *** openstackgerrit has joined #openstack-keystone | 02:02 | |
| openstackgerrit | zhenmei proposed openstack/keystone master: Fix create nonlocal user issue https://review.opendev.org/661183 | 02:02 |
|---|---|---|
| *** Dinesh_Bhor has joined #openstack-keystone | 02:05 | |
| *** ayoung has quit IRC | 02:48 | |
| *** whoami-rajat has joined #openstack-keystone | 03:04 | |
| *** Dinesh_Bhor has quit IRC | 03:33 | |
| *** liushuo has joined #openstack-keystone | 03:35 | |
| *** liushuo has quit IRC | 04:08 | |
| *** liushuo has joined #openstack-keystone | 04:08 | |
| *** joshualyle has joined #openstack-keystone | 04:09 | |
| *** viks___ has joined #openstack-keystone | 04:18 | |
| *** jhesketh has quit IRC | 04:19 | |
| *** jhesketh has joined #openstack-keystone | 04:19 | |
| *** dave-mccowan has quit IRC | 04:23 | |
| *** liushuo_ has joined #openstack-keystone | 04:45 | |
| *** liushuo has quit IRC | 04:48 | |
| *** eivis has joined #openstack-keystone | 05:05 | |
| *** vishakha has joined #openstack-keystone | 06:04 | |
| *** pcaruana has joined #openstack-keystone | 06:26 | |
| *** rcernin has quit IRC | 07:06 | |
| eivis | Probably most of you still asleep, but you might answer when wake up | 07:09 |
| eivis | as kmalloc said i can filter branches with user_filter, but as im doing it i get en error which says "UnicodeDecodeError: 'ascii' codec can't decode byte 0xc5 in position 24: ordinal not in range(128)" | 07:11 |
| *** tesseract has joined #openstack-keystone | 07:16 | |
| eivis | does it mean that python can handle non-latin letters in user_tree_dn but it fails on user_filter? | 07:16 |
| eivis | user_tree_dn= OU=Informacinių technologijų ir sistemų centras,OU=one,DC=example,DC=com | 07:16 |
| *** liushuo_ has quit IRC | 07:52 | |
| *** liushuo_ has joined #openstack-keystone | 07:52 | |
| *** liushuobj__ has joined #openstack-keystone | 08:11 | |
| *** liushuo_ has quit IRC | 08:14 | |
| *** tkajinam has quit IRC | 08:16 | |
| kmalloc | eivis: it is possible the ldap driver cannot handle unicode letter in the user_tree_dn. i'd need to see the whole traceback to know if it's an issue in python-ldap or in keystone (or some other lib we lean on) | 08:18 |
| *** liushuo_ has joined #openstack-keystone | 08:29 | |
| *** liushuobj__ has quit IRC | 08:32 | |
| *** tesseract has quit IRC | 08:38 | |
| *** tesseract has joined #openstack-keystone | 08:40 | |
| *** imacdonn has quit IRC | 08:42 | |
| *** imacdonn has joined #openstack-keystone | 08:43 | |
| *** liushuobj__ has joined #openstack-keystone | 08:44 | |
| *** rcernin has joined #openstack-keystone | 08:46 | |
| *** liushuo has joined #openstack-keystone | 08:47 | |
| *** liushuo_ has quit IRC | 08:48 | |
| *** liushuobj__ has quit IRC | 08:49 | |
| *** liushuo_ has joined #openstack-keystone | 08:55 | |
| *** liushuo has quit IRC | 08:58 | |
| *** rcernin has quit IRC | 09:07 | |
| *** eivis has quit IRC | 09:11 | |
| *** jaosorior has quit IRC | 09:22 | |
| *** jaosorior has joined #openstack-keystone | 09:24 | |
| *** eivis has joined #openstack-keystone | 09:26 | |
| eivis | well I think with user_tree_dn everything fine cuz, when i comment out user_filter I am getting response with users. (Openstack queens) | 09:29 |
| eivis | https://pastebin.com/baKcDece there is traceback | 09:29 |
| *** xek has joined #openstack-keystone | 09:55 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/python-keystoneclient master: Follow bandit B105: hardcoded_password_string https://review.opendev.org/667304 | 10:36 |
| openstackgerrit | Vishakha Agarwal proposed openstack/python-keystoneclient master: Blacklist bandit 1.6.0 & cap sphinx for 2.7 https://review.opendev.org/660609 | 10:38 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Remove [signing] config https://review.opendev.org/659434 | 10:56 |
| *** liushuobj__ has joined #openstack-keystone | 11:36 | |
| *** liushuo_ has quit IRC | 11:40 | |
| *** raildo has joined #openstack-keystone | 11:43 | |
| *** liushuo_ has joined #openstack-keystone | 11:54 | |
| *** liushuo_ has quit IRC | 11:55 | |
| *** liushuobj__ has quit IRC | 11:57 | |
| *** lbragstad has joined #openstack-keystone | 12:17 | |
| *** dave-mccowan has joined #openstack-keystone | 12:52 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone master: Fixing dn_to_id function for cases were id is not in the DN https://review.opendev.org/649177 | 12:58 |
| *** xek_ has joined #openstack-keystone | 13:05 | |
| *** xek has quit IRC | 13:07 | |
| *** raildo has quit IRC | 13:27 | |
| *** vishakha has quit IRC | 13:38 | |
| *** raildo has joined #openstack-keystone | 13:39 | |
| *** raildo has quit IRC | 13:44 | |
| *** raildo has joined #openstack-keystone | 13:46 | |
| *** mloza has quit IRC | 13:47 | |
| *** raildo has quit IRC | 13:52 | |
| *** mloza has joined #openstack-keystone | 13:56 | |
| *** jistr is now known as jistr|call | 14:05 | |
| *** jdennis has quit IRC | 14:11 | |
| *** ayoung has joined #openstack-keystone | 14:12 | |
| *** jistr|call is now known as jistr | 14:22 | |
| *** raildo has joined #openstack-keystone | 14:23 | |
| *** mloza has quit IRC | 14:40 | |
| *** jdennis has joined #openstack-keystone | 14:45 | |
| lbragstad | cmurphy i'm reading https://etherpad.openstack.org/p/keystone-train-ptg-application-credentials (linked from https://review.opendev.org/#/c/661790/1) | 14:49 |
| lbragstad | i'm a bit fuzzy on that topic | 14:50 |
| lbragstad | is the api traceability reason related to capability APIs? or was that something else? | 14:50 |
| lbragstad | oh - or that it's hard to use access rule configs because it's hard for operators to know what the dependency between API calls is? | 14:52 |
| *** xek__ has joined #openstack-keystone | 15:03 | |
| cmurphy | lbragstad: the problem is we don't have a complete map of all APIs in openstack, the best we have is what is published in the api-ref, and moreover this could theoretically be used on !openstack, which means it would have to be left up the operator to curate thousands of API paths/methods for their deployment | 15:05 |
| *** xek_ has quit IRC | 15:05 | |
| lbragstad | aha | 15:06 |
| lbragstad | and for https://review.opendev.org/#/c/663440/7//COMMIT_MSG | 15:06 |
| lbragstad | before we weren't planning on exposing access rules as their own resource, right? | 15:06 |
| cmurphy | right | 15:06 |
| lbragstad | ok - and the apparent benefit there is that it makes it easier for users to re-use things? | 15:07 |
| cmurphy | they're still not "exposed" they're just managed as their own resource internally | 15:07 |
| lbragstad | oh - but we plan to expose them as their own resource eventually through the api? | 15:07 |
| openstackgerrit | Benoît Knecht proposed openstack/keystone master: backends/ldap: Fix auth for UTF-8 user names https://review.opendev.org/667645 | 15:07 |
| cmurphy | wait no they are exposed | 15:07 |
| cmurphy | sorry | 15:08 |
| * cmurphy looks at the code | 15:08 | |
| cmurphy | i need better commit messages >.> | 15:08 |
| lbragstad | so - access rules are going to be their own thing that users can create and query? | 15:09 |
| lbragstad | but creation of access rules must be done using application credentials? | 15:10 |
| cmurphy | with this code you can only create access rules through an app cred, i also haven't exposed a way to directly query one's own access rules independently of an app cred - but maybe we should | 15:13 |
| cmurphy | https://review.opendev.org/#/c/628168/25/keystone/api/users.py@614 is the general idea of what it is now | 15:13 |
| lbragstad | ok - that makes sense | 15:14 |
| lbragstad | i wasn't seeing the API to query it directly | 15:14 |
| lbragstad | s/it/access rules/ | 15:15 |
| cmurphy | right, i guess it probably makes sense to add that | 15:15 |
| lbragstad | so - is the main thing right now that access rules are completely separate from application credentials internally? | 15:15 |
| lbragstad | to users, they're still compounded together? | 15:15 |
| cmurphy | yes, and i don't think there is necessarily a need to be able to create access rules themselves independently from app creds | 15:16 |
| * lbragstad nods | 15:16 | |
| cmurphy | just perhaps to query them | 15:16 |
| lbragstad | ok - that makes sense | 15:17 |
| lbragstad | i think i agree | 15:17 |
| cmurphy | cool | 15:17 |
| lbragstad | the reverts look good - i just kicked a bunch of those through | 15:17 |
| cmurphy | sweet | 15:17 |
| lbragstad | is the stuff we just talked about for access rules + application credentials documented somewhere? | 15:18 |
| lbragstad | if so, i clearly glazed over it | 15:18 |
| cmurphy | https://review.opendev.org/661784 | 15:18 |
| lbragstad | oh - sure... | 15:18 |
| cmurphy | :) | 15:18 |
| lbragstad | i even said i was going to look at that | 15:19 |
| *** whoami-rajat has quit IRC | 15:22 | |
| kmalloc | o/ | 15:32 |
| *** whoami-rajat has joined #openstack-keystone | 15:38 | |
| openstackgerrit | Corey Bryant proposed openstack/keystone master: Enable LDAP _dn_to_id() for non-default ID attrs https://review.opendev.org/666575 | 15:58 |
| openstackgerrit | Corey Bryant proposed openstack/keystone master: Enable LDAP _dn_to_id() for non-default ID attrs https://review.opendev.org/666575 | 16:01 |
| openstackgerrit | Corey Bryant proposed openstack/keystone master: Enable LDAP _dn_to_id() for non-default ID attrs https://review.opendev.org/666575 | 16:10 |
| openstackgerrit | Corey Bryant proposed openstack/keystone master: Enable LDAP _dn_to_id() for non-default ID attrs https://review.opendev.org/666575 | 16:33 |
| jrosser | this describes www_authenticate_uri as being a 'public' endpoint https://opendev.org/openstack/keystonemiddleware/src/branch/master/keystonemiddleware/auth_token/_opts.py#L42 | 16:34 |
| *** tesseract has quit IRC | 16:35 | |
| jrosser | but almost universally in a non trivial deployment that has a concept of 'public' and 'internal' endpoints, it is necessary to set www_authenticate_uri to the 'internal' keystone endpoint | 16:35 |
| * jrosser confused | 16:36 | |
| kmalloc | jrosser: www_authenticate_uri should be a response sent to the end user if they try and hit the endpoint with an invalid token or without a token at all. www_authenticate_uri is not intended for the service user | 16:46 |
| kmalloc | jrosser: this populates the WWW-Authenticate header is populated on a 401. | 16:47 |
| kmalloc | jrosser: https://github.com/openstack/keystonemiddleware/blob/3e62d25dacb4282609d897f8a9cf08c3603b12d7/doc/source/middlewarearchitecture.rst#exchanging-user-information | 16:48 |
| jrosser | but does that differentiate a "client" that is inside or outside the control plane of the cloud? | 16:48 |
| kmalloc | jrosser: it can't. | 16:48 |
| jrosser | sorry if this is silly questions but in openstack-ansible we universally set that to the internal api endpoint | 16:48 |
| jrosser | and things just don't work if we do otherwise | 16:49 |
| kmalloc | the recommendation i can make is for public (end user) communication to an endpoint, have a version of the service with middleware configured to point at the public endpoint | 16:49 |
| kmalloc | for internal, have a separate process that points internal | 16:49 |
| jrosser | i.e run two sets of keystone with different configs | 16:49 |
| kmalloc | no. | 16:49 |
| kmalloc | two nova processes | 16:49 |
| kmalloc | this is keystonemiddleware | 16:50 |
| kmalloc | keystone catalog can contain internal and external interfaces for each endpoint | 16:50 |
| jrosser | blimey - that config is in pretty much every service though, surely not two of everything? | 16:50 |
| kmalloc | if you're relying on www-authenticate to know where to get a token, it needs to point to the place that is expected | 16:51 |
| kmalloc | end users (external) may not be able to talk to an internal interface | 16:51 |
| kmalloc | if you realkly have a differentiated environment, where some traffic is internal and some is external you need to either a) live with mix communication (not great), or b) run a separate process/middleware for each interface | 16:52 |
| kmalloc | realistically, www-authenticate-uri should only be used in the case of a 401. it should be 100% ok to use the public keystone interface in all cases. | 16:55 |
| kmalloc | even internal traffic should be able to auth on the public interface. it should only be used *if* a 401 occurs and the client doesn't already know where to get a token. | 16:56 |
| jrosser | not if the internal networks don't route to the external ones | 16:56 |
| kmalloc | if your network is that isolated and you have internal clients that do not know the auth_uri a-priori and are leaning on www-authenticate, you will need a separately configured interface (nova, e.g.) | 16:58 |
| kmalloc | it's a question of which clients you're breaking with a singularly configured endpoint with multiple interfaces. | 16:58 |
| jrosser | so auth_uri should be bootstrapping the internal clients to know where the internal auth endpoint is? | 17:01 |
| kmalloc | ideally. | 17:01 |
| jrosser | and www-authenticate-uri should only be used in for something that didnt have that bootstrap info, i.e an external user | 17:01 |
| kmalloc | and only if the user doesn't have a token or has an expired token | 17:02 |
| kmalloc | 401 Unauthorized | 17:02 |
| jrosser | ok, great, thats really helpful | 17:02 |
| kmalloc | now, that may not actually be what is happening everywhere | 17:02 |
| * jrosser returns to the heat/magnum code and digs some more | 17:02 | |
| kmalloc | but that is the intent | 17:02 |
| jrosser | kmalloc: I think I might be seeing a sort of second order thing, where service A wants to use service B internally, and service B redirects A to www-authenticate-uri which may not be accessible | 17:20 |
| jrosser | And that might be horizon<>everything, or magnum>heat as examples | 17:20 |
| kmalloc | yeah. and magnum/heat/horizon is a special(ish) case | 17:30 |
| jrosser | kmalloc: is this documented anywhere, what keystone expects the contract between services to be for auth, and how these special cases should be handled? | 17:33 |
| kmalloc | jrosser: mostly covered in https://github.com/openstack/keystonemiddleware/blob/3e62d25dacb4282609d897f8a9cf08c3603b12d7/doc/source/middlewarearchitecture.rst#exchanging-user-information | 17:43 |
| cmurphy | kmalloc: lbragstad stable patch to fix the stein gate https://review.opendev.org/667105 | 17:45 |
| openstackgerrit | Merged openstack/keystone master: Revert "Add API for /v3/access_rules_config" https://review.opendev.org/661790 | 17:45 |
| openstackgerrit | Merged openstack/keystone master: Revert "Add manager support for app cred access rules" https://review.opendev.org/661791 | 17:45 |
| openstackgerrit | Merged openstack/keystone master: Revert "Add a permissive mode for access rules config" https://review.opendev.org/661792 | 17:45 |
| lbragstad | cmurphy done | 17:50 |
| *** jistr_ has joined #openstack-keystone | 17:52 | |
| *** jistr has quit IRC | 17:53 | |
| cmurphy | ty | 17:55 |
| *** altlogbot_0 has quit IRC | 17:55 | |
| *** altlogbot_2 has joined #openstack-keystone | 17:57 | |
| *** altlogbot_2 has quit IRC | 17:57 | |
| *** altlogbot_1 has joined #openstack-keystone | 17:59 | |
| *** altlogbot_1 has quit IRC | 18:01 | |
| *** altlogbot_0 has joined #openstack-keystone | 18:02 | |
| *** dklyle has quit IRC | 19:09 | |
| *** phughk has quit IRC | 19:18 | |
| *** whoami-rajat has quit IRC | 19:22 | |
| *** dklyle has joined #openstack-keystone | 19:36 | |
| *** altlogbot_0 has quit IRC | 19:46 | |
| *** altlogbot_0 has joined #openstack-keystone | 19:47 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement domain reader support for grants https://review.opendev.org/645968 | 20:01 |
| *** altlogbot_0 has quit IRC | 20:15 | |
| *** altlogbot_3 has joined #openstack-keystone | 20:18 | |
| * kmalloc is back from dentist. | 20:30 | |
| *** altlogbot_3 has quit IRC | 20:43 | |
| *** altlogbot_2 has joined #openstack-keystone | 20:44 | |
| *** eivis has quit IRC | 20:53 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement domain admin support for grants https://review.opendev.org/667730 | 20:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove obsolete grant policies from policy.v3cloudsample.json https://review.opendev.org/667731 | 20:58 |
| *** efried has left #openstack-keystone | 21:00 | |
| *** altlogbot_2 has quit IRC | 21:00 | |
| lbragstad | those ^ will need some release notes | 21:00 |
| lbragstad | otherwise - a set of eyes might be good, too | 21:00 |
| lbragstad | i'm starting to glaze over policy stuff... be prepared to see some mistakes | 21:01 |
| *** altlogbot_2 has joined #openstack-keystone | 21:04 | |
| *** pcaruana has quit IRC | 21:05 | |
| *** raildo has quit IRC | 21:30 | |
| *** mloza has joined #openstack-keystone | 21:33 | |
| *** rcernin has joined #openstack-keystone | 22:00 | |
| *** xek__ has quit IRC | 22:10 | |
| *** rcernin has quit IRC | 22:19 | |
| *** rcernin has joined #openstack-keystone | 22:20 | |
| openstackgerrit | Corey Bryant proposed openstack/keystone master: Add Python 3 Train unit tests https://review.opendev.org/667746 | 22:43 |
| openstackgerrit | Corey Bryant proposed openstack/keystoneauth master: Add Python 3 Train unit tests https://review.opendev.org/667747 | 22:44 |
| openstackgerrit | Corey Bryant proposed openstack/keystonemiddleware master: Add Python 3 Train unit tests https://review.opendev.org/667748 | 22:44 |
| *** tkajinam has joined #openstack-keystone | 23:05 | |
| openstackgerrit | Corey Bryant proposed openstack/keystone-specs master: Add Python 3 Train unit tests https://review.opendev.org/667755 | 23:29 |
| openstackgerrit | Corey Bryant proposed openstack/ldappool master: Add Python 3 Train unit tests https://review.opendev.org/667756 | 23:30 |
| openstackgerrit | Corey Bryant proposed openstack/pycadf master: Add Python 3 Train unit tests https://review.opendev.org/667757 | 23:30 |
| openstackgerrit | Corey Bryant proposed openstack/python-keystoneclient master: Add Python 3 Train unit tests https://review.opendev.org/667758 | 23:31 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!