| *** markvoelker has quit IRC | 00:39 | |
| *** gyee has quit IRC | 00:40 | |
| *** markvoelker has joined #openstack-keystone | 00:44 | |
| *** dave-mccowan has quit IRC | 00:58 | |
| adriant | cmurphy, kmalloc: before I go into datetime parsing madness, will keystone ever respond with anything other than a format like: "2015-11-07T02:58:43.578887Z" ? | 01:48 |
|---|---|---|
| adriant | ^ can the timezone be different, can the subseconds be dropped, etc. | 01:48 |
| kmalloc | Uhm. | 01:49 |
| kmalloc | There are time normalizing functions we use | 01:49 |
| adriant | yes, but can those be configured? | 01:49 |
| kmalloc | Use that and adhere to the same standard in the code | 01:49 |
| kmalloc | No | 01:49 |
| adriant | kmalloc: this is for me parsing datetime in keystoneauth | 01:49 |
| adriant | so if I hardcode a datetime parse function for datetime strings from keystone, it will be unlikely to need to be too smart a function? | 01:50 |
| kmalloc | Uh. KSA can’t use Oslo timeutils. | 01:50 |
| adriant | exactly | 01:50 |
| kmalloc | Unlikely. | 01:50 |
| adriant | so it has to be a standalone function since pulling in libraries is a nope | 01:51 |
| kmalloc | Yeah. Let me eat dinner and think about that a bit more | 01:51 |
| adriant | I was just deciding how far down the rabbit hole I needed to go | 01:51 |
| kmalloc | But I think you’re on a safe path. | 01:51 |
| adriant | kk | 01:51 |
| adriant | as long as the date string format can't change (and is always in UTC) then that's easy for me. | 01:52 |
| kmalloc | Look at how we handle the token expiry | 01:53 |
| kmalloc | KSA has to parse that. | 01:53 |
| kmalloc | We should be consistent there with receipts and such | 01:54 |
| kmalloc | So, safe bet is use the same mechanism. | 01:54 |
| adriant | kmalloc: yes! Good point | 02:05 |
| kmalloc | Amazing what a little food/calories does to spark the brain working. | 02:05 |
| * adriant is still recovering from a cold | 02:06 | |
| adriant | so I have a better excuse for zombie logic | 02:06 |
| adriant | there is a iso_parse util function... I am an idiot for missing it | 02:06 |
| kmalloc | I am now entering food coma | 02:06 |
| kmalloc | Dry aged beef, with wild mushrooms, aged cheddar, and fire roasted broccolini | 02:07 |
| kmalloc | ;) | 02:07 |
| adriant | ooooo | 02:07 |
| adriant | fancy | 02:07 |
| *** spsurya has joined #openstack-keystone | 02:12 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystoneauth master: add support for auth_receipts and multi-method auth https://review.opendev.org/675049 | 02:37 |
| openstackgerrit | Adrian Turjak proposed openstack/keystoneauth master: add support for auth_receipts and multi-method auth https://review.opendev.org/675049 | 02:46 |
| *** whoami-rajat has joined #openstack-keystone | 04:18 | |
| *** dave-mccowan has joined #openstack-keystone | 04:56 | |
| *** dave-mccowan has quit IRC | 05:01 | |
| *** jaosorior has quit IRC | 05:24 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system reader and member for endpoint_groups https://review.opendev.org/675272 | 05:33 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system_admin for endpoint_groups https://review.opendev.org/675536 | 05:38 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system_admin for endpoint_groups https://review.opendev.org/675536 | 05:40 |
| *** pcaruana has joined #openstack-keystone | 05:40 | |
| *** pcaruana has quit IRC | 05:49 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Add tests for domain users interacting with endpoint_groups https://review.opendev.org/676108 | 06:22 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system reader and member for endpoint_groups https://review.opendev.org/675272 | 06:28 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system_admin for endpoint_groups https://review.opendev.org/675536 | 06:28 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system_admin for endpoint_groups https://review.opendev.org/675536 | 06:29 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Add tests for domain users interacting with endpoint_groups https://review.opendev.org/676108 | 06:30 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Add tests for project users interacting with endpoint_groups https://review.opendev.org/676115 | 06:38 |
| *** ivve has joined #openstack-keystone | 06:43 | |
| *** tesseract has joined #openstack-keystone | 07:17 | |
| *** rcernin has quit IRC | 07:21 | |
| *** dancn has joined #openstack-keystone | 07:36 | |
| *** pcaruana has joined #openstack-keystone | 07:45 | |
| *** xek has joined #openstack-keystone | 07:53 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Add tests for project users interacting with endpoint_groups https://review.opendev.org/676115 | 08:26 |
| *** jaosorior has joined #openstack-keystone | 08:26 | |
| *** dancn has quit IRC | 08:32 | |
| *** dancn has joined #openstack-keystone | 08:37 | |
| *** trident has quit IRC | 08:54 | |
| *** trident has joined #openstack-keystone | 09:08 | |
| *** takamatsu has joined #openstack-keystone | 09:23 | |
| *** trident has quit IRC | 09:25 | |
| *** trident has joined #openstack-keystone | 09:32 | |
| frickler | I have an issue with application credentials and users that have role assigned only via a group and not directly. those users can create ac's, but when trying to use them, keystone responds with a 404. is that a known issue? this bug looks related but only talks about external groups iiuc https://bugs.launchpad.net/keystone/+bug/1809116 | 09:41 |
| openstack | Launchpad bug 1809116 in OpenStack Identity (keystone) "[rfe] Renewable Application Credentials" [High,In progress] - Assigned to Kristi Nikolla (knikolla) | 09:41 |
| *** xek has quit IRC | 09:41 | |
| *** xek has joined #openstack-keystone | 09:42 | |
| *** dancn has quit IRC | 10:04 | |
| *** rcernin has joined #openstack-keystone | 10:08 | |
| *** jaosorior has quit IRC | 11:04 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system reader and member for policies https://review.opendev.org/676162 | 11:16 |
| *** rcernin has quit IRC | 11:31 | |
| *** trident has quit IRC | 11:34 | |
| *** trident has joined #openstack-keystone | 11:40 | |
| *** dancn has joined #openstack-keystone | 11:56 | |
| *** ivve has quit IRC | 12:09 | |
| *** raildo has joined #openstack-keystone | 12:47 | |
| *** jaosorior has joined #openstack-keystone | 12:47 | |
| *** cwright has joined #openstack-keystone | 13:01 | |
| *** cwright has quit IRC | 13:01 | |
| *** cwright has joined #openstack-keystone | 13:03 | |
| *** pcaruana has quit IRC | 13:23 | |
| *** lbragstad has joined #openstack-keystone | 13:32 | |
| cmurphy | frickler: known issue and just fixed on master https://bugs.launchpad.net/keystone/+bug/1773967 | 13:39 |
| openstack | Launchpad bug 1773967 in keystone (Ubuntu) "Application credentials can't be used with group-only role assignments" [Undecided,New] | 13:39 |
| frickler | cmurphy: hmm, interesing timing. however, I have tested on a fresh devstack installation that has that patch included and am still seeing the issue | 13:44 |
| frickler | steps to reproduce: create a new user without any roles&project. add it to the "nonadmins" group from devstack. create app creds with that user. see a 404 when trying to use them | 13:46 |
| frickler | I'm also failing to understand how that patch fixes anything about groups | 13:47 |
| frickler | hmm, the test looks like it's doing exactly what I'm doing, though. maybe it is more explicit about ids, let me do some more testing | 13:50 |
| cmurphy | i just tried it and it worked | 13:54 |
| gagehugo | o/ | 13:55 |
| *** whoami-rajat has quit IRC | 13:59 | |
| *** pcaruana has joined #openstack-keystone | 14:00 | |
| *** lbragstad has quit IRC | 14:02 | |
| frickler | cmurphy: silly me, I was lacking the /v3 part in the os-auth-url for my test. everything works as it should now, sorry for the confusion and thanks for the pointer. is there a chance to get this fix backported to stable branches? | 14:07 |
| cmurphy | frickler: sure https://review.opendev.org/676200 | 14:10 |
| frickler | cmurphy: thanks, the really interesting branch for me currently is still queens, but if we go step by step, that's o.k. ;) | 14:11 |
| *** jaosorior has quit IRC | 14:15 | |
| *** whoami-rajat has joined #openstack-keystone | 14:25 | |
| *** dancn has quit IRC | 14:56 | |
| *** dave-mccowan has joined #openstack-keystone | 14:58 | |
| *** dave-mccowan has quit IRC | 15:04 | |
| vishakha | cmurphy, gagehugo Could you help me with the get policy [1] https://review.opendev.org/#/c/676162/. its showing the wrong rest API call [2] | 15:34 |
| cmurphy | vishakha: did you mean to link to a paste? what's the issue? | 15:37 |
| vishakha | https://zuul.opendev.org/t/openstack/build/92d90262a86a4aa2bb0b8f70014210ab , the get_policy Rest call is failing | 15:38 |
| gagehugo | hmm | 15:38 |
| gagehugo | heh 418 | 15:39 |
| gagehugo | vishakha s/policy/policies | 15:40 |
| cmurphy | ^ | 15:40 |
| cmurphy | the policy doc is wrong | 15:40 |
| gagehugo | yup | 15:41 |
| vishakha | In code too , its https://github.com/openstack/keystone/blob/master/keystone/common/policies/policy.py#L25 | 15:41 |
| cmurphy | that's what i meant | 15:41 |
| cmurphy | that's wrong | 15:41 |
| cmurphy | the api-ref is right https://docs.openstack.org/api-ref/identity/v3/#policies | 15:41 |
| vishakha | ohk. Thanks. I will push a patch to correct it. | 15:42 |
| vishakha | cmurphy gagehugo Thanks | 15:43 |
| cmurphy | np | 15:43 |
| cmurphy | meeting in 17 minutes in #openstack-meeting-alt | 15:43 |
| cmurphy | bnemec: good suggestion re https://review.opendev.org/675807 | 15:44 |
| cmurphy | i keep forgetting the upgrade check exists | 15:44 |
| cmurphy | maybe it would be okay to use that instead of doing the hacky workaround in the controller | 15:44 |
| *** gyee has joined #openstack-keystone | 15:44 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system reader and member for policies https://review.opendev.org/676162 | 15:46 |
| bnemec | Happy to help. :-) | 15:47 |
| bnemec | I also tend to forget about upgrade checks, but then we don't really have them in Oslo. | 15:48 |
| bnemec | I'm not sure whether they're a replacement for the runtime check though. Are they considered a mandatory part of the upgrade? | 15:49 |
| cmurphy | i don't think so | 15:49 |
| knikolla | cmurphy: will miss weekly meeting as I'm not feeling well today. | 15:56 |
| *** shyamb has joined #openstack-keystone | 15:57 | |
| kmalloc | knikolla: feel better | 15:57 |
| cmurphy | knikolla: okay, get well soon | 15:58 |
| *** vesper11 has quit IRC | 15:58 | |
| *** vesper11 has joined #openstack-keystone | 16:00 | |
| cmurphy | meeting now in #openstack-meeting-alt | 16:01 |
| *** markvoelker has quit IRC | 16:02 | |
| *** spsurya has quit IRC | 16:04 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system reader and member for policies https://review.opendev.org/676162 | 16:11 |
| *** markvoelker has joined #openstack-keystone | 16:12 | |
| *** shyamb has quit IRC | 16:15 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system reader and member for endpoint_groups https://review.opendev.org/675272 | 16:15 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Implement system_admin for endpoint_groups https://review.opendev.org/675536 | 16:16 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Add tests for domain users interacting with endpoint_groups https://review.opendev.org/676108 | 16:16 |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Add tests for project users interacting with endpoint_groups https://review.opendev.org/676115 | 16:17 |
| *** tesseract has quit IRC | 16:43 | |
| *** mvkr has quit IRC | 17:45 | |
| *** markvoelker has quit IRC | 18:12 | |
| *** markvoelker has joined #openstack-keystone | 18:15 | |
| *** manuvakery has quit IRC | 18:28 | |
| *** mrhillsman has joined #openstack-keystone | 18:51 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move list_trusts enforcement to default policies https://review.opendev.org/675807 | 19:00 |
| *** ivve has joined #openstack-keystone | 19:14 | |
| *** mvkr has joined #openstack-keystone | 19:24 | |
| *** mvkr has quit IRC | 19:30 | |
| gyee | cmurphy, kmalloc, we still support writable LDAP? | 19:32 |
| cmurphy | gyee: no | 19:33 |
| *** whoami-rajat has quit IRC | 19:33 | |
| gyee | cmurphy, https://review.opendev.org/#/c/674782/2/keystone/identity/backends/ldap/common.py line 1857 | 19:33 |
| gyee | wonder if we should just deprecate that whole thing | 19:34 |
| kmalloc | gyee: no. | 19:36 |
| gyee | I think emulation mixin was for writable LDAP | 19:37 |
| *** markvoelker has quit IRC | 20:10 | |
| *** markvoelker has joined #openstack-keystone | 20:28 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move list_trusts enforcement to default policies https://review.opendev.org/675807 | 20:45 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move delete_trust enforcement to default policies https://review.opendev.org/676277 | 20:45 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add immutable roles status check https://review.opendev.org/675509 | 20:46 |
| *** xek has quit IRC | 21:04 | |
| *** markvoelker has quit IRC | 21:07 | |
| *** raildo has quit IRC | 21:12 | |
| openstackgerrit | Merged openstack/keystone master: Run 'tempest-ipv6-only' job in gate https://review.opendev.org/671903 | 21:29 |
| *** dancn has joined #openstack-keystone | 21:33 | |
| adriant | cmurphy: can I do a follow up patch unrelated to MFA to KeystoneAuth to get rid of the '>>> ' in the examples... so that they can be easily copy and pasted? | 21:53 |
| cmurphy | adriant: sure | 21:54 |
| adriant | Because I can't think of how many times I've done that, and then been annoyed at having to clean up those | 21:54 |
| adriant | cool | 21:54 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move delete_trust enforcement to default policies https://review.opendev.org/676277 | 21:59 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move get_trust enforcement to default policies https://review.opendev.org/676283 | 21:59 |
| *** markvoelker has joined #openstack-keystone | 22:10 | |
| *** markvoelker has quit IRC | 22:14 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move delete_trust enforcement to default policies https://review.opendev.org/676277 | 22:28 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move get_trust enforcement to default policies https://review.opendev.org/676283 | 22:28 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move list_roles_for_trust enforcement to policies https://review.opendev.org/676284 | 22:28 |
| *** ivve has quit IRC | 22:36 | |
| *** tkajinam has joined #openstack-keystone | 22:59 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add protection tests for trusts API https://review.opendev.org/675720 | 23:13 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move list_trusts enforcement to default policies https://review.opendev.org/675807 | 23:13 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move delete_trust enforcement to default policies https://review.opendev.org/676277 | 23:13 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move get_trust enforcement to default policies https://review.opendev.org/676283 | 23:13 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move list_roles_for_trust enforcement to policies https://review.opendev.org/676284 | 23:13 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Move get_role_for_trust enforcement to policies https://review.opendev.org/676287 | 23:13 |
| *** markvoelker has joined #openstack-keystone | 23:25 | |
| *** markvoelker has quit IRC | 23:36 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystoneauth master: add support for auth_receipts and multi-method auth https://review.opendev.org/675049 | 23:51 |
| adriant | cmurphy: cool, I think I've now addressed all your concerns :) | 23:53 |
| adriant | I'd very heavily suggest setting up an environment and testing it out. While I don't think the patch is very far from a mergable state, I'd think we need enough people to confirm we are happy with the new interfaces before we set them in stone and have to maintain them! | 23:56 |
| adriant | mordred: https://review.opendev.org/675049 is in a state where your feedback/testing would be really valuable. | 23:57 |
| adriant | especially the new MultiFactor loader, since in theory that should now actually allow MFA via the cli | 23:57 |
| mordred | adriant: cool! I'll look at it first thing in the morning | 23:57 |
| adriant | awesome :) | 23:58 |
| adriant | and then later we can chat about token caching for the cli tools | 23:58 |
| adriant | because we'll want a "login" action with MFA that then stores a token, and switchin the cli to using that cached token | 23:58 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!