| *** jamesmcarthur has joined #openstack-keystone | 01:35 | |
| *** jamesmcarthur has quit IRC | 02:38 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:45 | |
| *** rcernin has quit IRC | 02:57 | |
| *** joshualyle has quit IRC | 03:11 | |
| *** rcernin has joined #openstack-keystone | 03:13 | |
| *** wxy-xiyuan has joined #openstack-keystone | 03:15 | |
| *** jamesmcarthur has quit IRC | 03:22 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:23 | |
| *** jamesmcarthur has quit IRC | 03:27 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:53 | |
| *** jamesmcarthur has quit IRC | 04:00 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Run 'tempest-ipv6-only' job in gate https://review.opendev.org/671903 | 04:03 |
|---|---|---|
| *** whoami-rajat has joined #openstack-keystone | 04:19 | |
| *** jamesmcarthur has joined #openstack-keystone | 04:30 | |
| *** jamesmcarthur has quit IRC | 04:38 | |
| *** tkajinam has quit IRC | 05:04 | |
| *** tkajinam has joined #openstack-keystone | 05:05 | |
| *** vishalmanchanda has joined #openstack-keystone | 05:13 | |
| *** gyee has quit IRC | 05:26 | |
| *** jaosorior has quit IRC | 05:31 | |
| *** jamesmcarthur has joined #openstack-keystone | 05:34 | |
| *** jamesmcarthur has quit IRC | 05:39 | |
| *** threestrands has joined #openstack-keystone | 05:44 | |
| *** jamesmcarthur has joined #openstack-keystone | 06:08 | |
| *** jamesmcarthur has quit IRC | 06:15 | |
| *** jaosorior has joined #openstack-keystone | 06:23 | |
| *** yoctozepto has joined #openstack-keystone | 06:34 | |
| yoctozepto | hello keystoners, I want to bring https://bugs.launchpad.net/kolla-ansible/+bug/1833756 to your attention, this is pinned to k-a now and we can fix it but it seems a little inappropriate to me to spam logs with every keystone action - deprecation warnings should probably fire once the policies are parsed and not every time they are interpreted? would love some insight from you, cheers :D | 06:37 |
| openstack | Launchpad bug 1833756 in kolla-ansible "Fresh Stein deployment - keystone logs flooded with each action" [Undecided,New] | 06:37 |
| *** dancn has joined #openstack-keystone | 06:52 | |
| *** jamesmcarthur has joined #openstack-keystone | 06:57 | |
| *** rcernin has quit IRC | 07:02 | |
| *** jamesmcarthur has quit IRC | 07:03 | |
| *** xek has joined #openstack-keystone | 07:09 | |
| *** takamatsu has quit IRC | 07:17 | |
| *** tesseract has joined #openstack-keystone | 07:27 | |
| *** tssurya has joined #openstack-keystone | 07:31 | |
| *** pcaruana has quit IRC | 07:35 | |
| *** jaosorior has quit IRC | 08:03 | |
| *** pcaruana has joined #openstack-keystone | 08:13 | |
| *** tkajinam has quit IRC | 08:19 | |
| *** ondrejduchon has joined #openstack-keystone | 08:25 | |
| *** dancn has quit IRC | 08:27 | |
| *** takamatsu has joined #openstack-keystone | 08:32 | |
| *** takamatsu_ has joined #openstack-keystone | 08:48 | |
| *** threestrands has quit IRC | 08:48 | |
| *** takamatsu has quit IRC | 08:49 | |
| *** jaosorior has joined #openstack-keystone | 09:00 | |
| ondrejduchon | Hello, I am trying to connect rabbitmq and keystonemiddleware with CADF audit notifiations. I set up api-paste.ini (added there audit filter) and then pycacdf config file (from github), for nova_api. Everything works fine when I change 'self._notifier.info(..' to 'self._notifier.audit(..' in file keystonemiddleware/audit/_notifier.py, line 40. With info I cannot see any notifications in rabbitmq. | 09:09 |
| ondrejduchon | Thank you for any tips | 09:11 |
| *** ondrejduchon has quit IRC | 09:17 | |
| *** ondrejduchon has joined #openstack-keystone | 09:21 | |
| *** ivve has joined #openstack-keystone | 09:28 | |
| *** takamatsu_ has quit IRC | 09:30 | |
| *** takamatsu has joined #openstack-keystone | 09:37 | |
| *** jaosorior has quit IRC | 09:50 | |
| *** takamatsu has quit IRC | 10:08 | |
| *** takamatsu has joined #openstack-keystone | 10:24 | |
| *** jaosorior has joined #openstack-keystone | 10:34 | |
| *** pcaruana has quit IRC | 10:45 | |
| *** kplant has joined #openstack-keystone | 11:14 | |
| *** raildo has joined #openstack-keystone | 11:38 | |
| *** ivve has quit IRC | 11:40 | |
| *** jaosorior has quit IRC | 11:48 | |
| *** dancn has joined #openstack-keystone | 12:04 | |
| *** takamatsu has quit IRC | 12:10 | |
| *** pcaruana has joined #openstack-keystone | 12:10 | |
| *** ondrejduchon has quit IRC | 12:14 | |
| *** ondrejduchon_ has joined #openstack-keystone | 12:14 | |
| *** takamatsu has joined #openstack-keystone | 12:31 | |
| *** mchlumsky has joined #openstack-keystone | 12:33 | |
| *** ivve has joined #openstack-keystone | 12:35 | |
| *** jaosorior has joined #openstack-keystone | 12:43 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:46 | |
| *** dancn has quit IRC | 12:52 | |
| *** dancn has joined #openstack-keystone | 12:59 | |
| *** ivve has quit IRC | 13:06 | |
| *** tesseract has quit IRC | 13:20 | |
| *** tesseract has joined #openstack-keystone | 13:24 | |
| *** ivve has joined #openstack-keystone | 13:37 | |
| *** jamesmcarthur has quit IRC | 13:55 | |
| cmurphy | yoctozepto: we have a bug for that filed here https://bugs.launchpad.net/keystone/+bug/1836568 i've just marked it as high priority | 14:19 |
| openstack | Launchpad bug 1836568 in OpenStack Identity (keystone) "Logs filled with unnecessary policy deprecation warnings" [High,Triaged] | 14:19 |
| cmurphy | ondrejduchon_: you may need to change the log levels for keystonemiddleware in your nova paste config | 14:20 |
| yoctozepto | cmurphy: thanks, tried searching bugs but did not find this one | 14:21 |
| yoctozepto | ah, because it had a typo in word 'logs' :D | 14:24 |
| cmurphy | haha yeah | 14:26 |
| *** takamatsu has quit IRC | 14:28 | |
| *** trident has quit IRC | 14:32 | |
| *** trident has joined #openstack-keystone | 14:36 | |
| *** trident has quit IRC | 14:47 | |
| *** trident has joined #openstack-keystone | 14:50 | |
| *** trident has quit IRC | 15:00 | |
| *** trident has joined #openstack-keystone | 15:03 | |
| *** trident has quit IRC | 15:08 | |
| *** trident has joined #openstack-keystone | 15:16 | |
| *** jamesmcarthur has joined #openstack-keystone | 15:18 | |
| *** trident has quit IRC | 15:24 | |
| *** trident has joined #openstack-keystone | 15:27 | |
| *** ondrejduchon_ has quit IRC | 15:28 | |
| *** trident has quit IRC | 15:35 | |
| *** trident has joined #openstack-keystone | 15:38 | |
| *** jamesmcarthur has quit IRC | 15:44 | |
| *** tssurya has quit IRC | 15:46 | |
| *** gyee has joined #openstack-keystone | 15:52 | |
| *** dancn has quit IRC | 15:54 | |
| *** gyee has quit IRC | 16:16 | |
| *** trident has quit IRC | 16:16 | |
| *** gyee has joined #openstack-keystone | 16:17 | |
| *** xek has quit IRC | 16:20 | |
| *** trident has joined #openstack-keystone | 16:21 | |
| *** jamesmcarthur has joined #openstack-keystone | 16:38 | |
| openstackgerrit | Merged openstack/keystone master: Fix python3 compatibility on LDAP search DN from id https://review.opendev.org/672519 | 16:45 |
| *** takamatsu has joined #openstack-keystone | 16:47 | |
| *** trident has quit IRC | 16:48 | |
| *** trident has joined #openstack-keystone | 16:51 | |
| *** takamatsu has quit IRC | 16:59 | |
| *** jamesmcarthur has quit IRC | 17:00 | |
| *** tesseract has quit IRC | 18:05 | |
| *** altlogbot_2 has quit IRC | 18:19 | |
| *** altlogbot_0 has joined #openstack-keystone | 18:20 | |
| *** takamatsu has joined #openstack-keystone | 18:43 | |
| *** whoami-rajat has quit IRC | 19:08 | |
| *** takamatsu has quit IRC | 19:47 | |
| *** kplant has quit IRC | 19:47 | |
| *** mchlumsky has quit IRC | 20:06 | |
| *** trident has quit IRC | 20:44 | |
| *** trident has joined #openstack-keystone | 20:46 | |
| *** kplant has joined #openstack-keystone | 21:08 | |
| *** takamatsu has joined #openstack-keystone | 21:40 | |
| *** brtknr has quit IRC | 21:46 | |
| *** raildo has quit IRC | 22:00 | |
| *** rcernin has joined #openstack-keystone | 22:05 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: Add support for previous TOTP windows https://review.opendev.org/647655 | 22:11 |
| cmurphy | raising priority of https://bugs.launchpad.net/keystone/+bug/1836568 to critical | 22:19 |
| openstack | Launchpad bug 1836568 in OpenStack Identity (keystone) "Logs filled with unnecessary policy deprecation warnings" [Critical,Triaged] | 22:19 |
| adriant | cmurphy: any interest in me finishing: https://review.opendev.org/#/c/647655 ? | 22:47 |
| adriant | I'm not sure if this needed a spec for what was ultimately a tiny quality of life patch | 22:47 |
| adriant | which needs tests... | 22:47 |
| cmurphy | adriant: looks worthwhile, i don't think it needs a spec | 22:49 |
| *** gagehugo has quit IRC | 22:49 | |
| cmurphy | kmalloc: ^ | 22:49 |
| adriant | cmurphy: cool, will add some tests to it and throw it up properly for review | 22:49 |
| adriant | I wrote it ages ago when doing the same code for our custom auth plugin, but never wrote tests for the upstream version | 22:50 |
| adriant | tests will be easy | 22:50 |
| *** gagehugo has joined #openstack-keystone | 22:50 | |
| kmalloc | adriant: it's expanding to allow for like... say one window back one window forward? | 22:51 |
| adriant | only one back | 22:51 |
| adriant | not sure we want forward? | 22:51 |
| kmalloc | adriant: i don't see a reason it needs to be configurable | 22:51 |
| kmalloc | just do it always one back as ok | 22:51 |
| adriant | kmalloc: a config no one has to ever touch mostly, with a default of 1 | 22:52 |
| kmalloc | and just one back is fine. | 22:52 |
| kmalloc | nah, just make it hard set to one, we can add a config if needed | 22:52 |
| kmalloc | but i dislike extra configs if it is expected no one should be touching it | 22:52 |
| kmalloc | and it feels like an good QOL change at face value | 22:52 |
| adriant | kmalloc: I'd still add the config because when doing this internally I kept being told "2 windows back" and had to fight for just the 1 | 22:53 |
| adriant | so I can assume most clouds would want to tweak it a little | 22:53 |
| kmalloc | make it 2 windows back then hard set ;) | 22:53 |
| kmalloc | really, i am more against extra configs for the sake of "someone may want to tweak it" | 22:53 |
| kmalloc | what is kind-of the industry standard (besides U2F)? go with that. | 22:54 |
| adriant | kmalloc: first google result for 'totp previous windows': https://security.stackexchange.com/questions/113208/how-big-window-is-secure-and-practical-with-totp | 22:55 |
| kmalloc | i wont -1 it with a config, just generally would much rather have less config in ekystone. | 22:55 |
| adriant | guy is suggesting 5 minutes of windows back... | 22:55 |
| adriant | so I bet some idiot will want to tweak this | 22:56 |
| adriant | and potentially for a valid reason | 22:56 |
| kmalloc | and i want that idiot (or not so idiot) to come and make the case for why it's so important to tweak it | 22:56 |
| kmalloc | with that said, i wont hold this up if you really feel strongly the config is the only way | 22:56 |
| kmalloc | however... i want some controls if it is config, e.g. max window it can be set to | 22:57 |
| *** tkajinam has joined #openstack-keystone | 22:57 | |
| kmalloc | and that can be very arbitrary (pick a number), but i def. want some upper limit | 22:57 |
| adriant | I'd feel more comfortable with a config, but would settle on hardcoded. Mostly because I would probably start with 1 window back and likely tweak it further based on feedback | 22:58 |
| adriant | kmalloc: 5min upper limit? | 22:58 |
| kmalloc | sure. | 22:58 |
| kmalloc | pick a number, any number you like | 22:58 |
| kmalloc | make that the upper limit | 22:59 |
| adriant | 0-10 | 22:59 |
| adriant | anyone who wants more than that can fight us | 22:59 |
| kmalloc | and set the default to the place you think (gut feeling) is most appropriate | 22:59 |
| adriant | I mean, peacefully argue | 22:59 |
| kmalloc | :) | 22:59 |
| kmalloc | we are tending to issue kevlar shoes with keystone these days, less foot-gunning. | 22:59 |
| kmalloc | which reminds me, i want to figure out if we can support u2f... i think we can't really because CLI. | 23:00 |
| *** gagehugo has quit IRC | 23:01 | |
| kmalloc | yeah https://developers.yubico.com/libfido2/ doesn't look too friendly atm. | 23:02 |
| *** gagehugo has joined #openstack-keystone | 23:04 | |
| adriant | kmalloc: i was actually going to bring up u2f eventually :P | 23:10 |
| adriant | but I think we need gui? | 23:10 |
| kmalloc | you can do it with a CLI. | 23:11 |
| kmalloc | it's just really not super friendly. | 23:11 |
| kmalloc | and fido2 vs u2f (same concept, but fido2 is the evolution/standard) | 23:12 |
| kmalloc | u2f was rolled into fido2 | 23:12 |
| adriant | so could we do it as another auth plugin in Keystone? | 23:13 |
| kmalloc | maybe | 23:17 |
| kmalloc | it has to tie into the CLI and apparently in linux udev needs special rules for it | 23:19 |
| adriant | hmmm, I'm curious because we have people at catalyst using the keys, so I wonder if they had to add the rules, or they were they by default | 23:21 |
| adriant | or if the tools they use add them | 23:21 |
| *** jamesmcarthur has joined #openstack-keystone | 23:22 | |
| *** vishwanathj has quit IRC | 23:36 | |
| *** takamatsu has quit IRC | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!