Tuesday, 2019-09-17

« Monday, 2019-09-16 Index Wednesday, 2019-09-18 »
*** markvoelker has quit IRC00:02
openstackgerritMerged openstack/keystoneauth master: Fix misspell word  https://review.opendev.org/68060000:09
*** gyee has quit IRC00:14
*** jamesmcarthur has joined #openstack-keystone00:21
*** jamesmcarthur has quit IRC00:23
*** jamesmcarthur has joined #openstack-keystone00:23
openstackgerritLance Bragstad proposed openstack/keystone master: Add default roles and scope checking to project tags  https://review.opendev.org/68250300:30
lbragstadgagehugo cmurphy ^ fixed up some of the tests - only 4 are failing and they're for domain and project users (filtering cases)00:30
gagehugoack00:45
*** masayukig has joined #openstack-keystone00:47
*** Ben78 has quit IRC01:03
*** Ben78 has joined #openstack-keystone01:05
*** jamesmcarthur has quit IRC01:05
openstackgerritzhufl proposed openstack/keystone master: Add remote_id definition in _perform_auth  https://review.opendev.org/67970601:39
*** markvoelker has joined #openstack-keystone02:03
*** markvoelker has quit IRC02:08
*** baffle has quit IRC02:18
*** baffle has joined #openstack-keystone02:25
*** Ben78 has quit IRC02:30
*** jamesmcarthur has joined #openstack-keystone02:38
*** jamesmcarthur has quit IRC02:57
*** dave-mccowan has quit IRC03:00
*** jamesmcarthur has joined #openstack-keystone03:56
*** jamesmcarthur has quit IRC03:56
*** jamesmcarthur has joined #openstack-keystone03:57
*** etp has joined #openstack-keystone04:19
*** jamesmcarthur has quit IRC04:51
*** pcaruana has joined #openstack-keystone05:16
*** Luzi has joined #openstack-keystone05:16
*** jamesmcarthur has joined #openstack-keystone05:21
*** pcaruana has quit IRC05:29
*** adriant has quit IRC05:54
*** spsurya has joined #openstack-keystone05:55
*** jamesmcarthur has quit IRC06:10
openstackgerritColleen Murphy proposed openstack/keystone master: Add remote_id definition in _perform_auth  https://review.opendev.org/67970606:20
*** jamesmcarthur has joined #openstack-keystone06:32
*** jamesmcarthur has quit IRC06:37
*** jamesmcarthur has joined #openstack-keystone06:45
*** markvoelker has joined #openstack-keystone06:47
*** dancn has joined #openstack-keystone06:51
*** markvoelker has quit IRC06:52
*** xek has joined #openstack-keystone06:57
*** xek has quit IRC07:08
*** jamesmcarthur has quit IRC07:17
*** ivve has joined #openstack-keystone07:21
*** trident has quit IRC07:22
*** trident has joined #openstack-keystone07:31
*** vishakha has joined #openstack-keystone07:34
*** trident has quit IRC07:36
*** jamesmcarthur has joined #openstack-keystone07:44
*** trident has joined #openstack-keystone07:46
*** rcernin has quit IRC07:47
*** jamesmcarthur has quit IRC07:50
*** jamesmcarthur has joined #openstack-keystone07:52
openstackgerritBernhard M. Wiedemann proposed openstack/keystonemiddleware master: Make tests pass in 2020  https://review.opendev.org/65778008:03
*** tkajinam has quit IRC08:03
*** jamesmcarthur has quit IRC08:15
*** jamesmcarthur has joined #openstack-keystone08:16
*** dancn has quit IRC08:24
openstackgerritBernhard M. Wiedemann proposed openstack/keystonemiddleware master: Make tests pass in 2022  https://review.opendev.org/65778008:37
*** dancn has joined #openstack-keystone08:38
*** aloga has joined #openstack-keystone08:59
*** pcaruana has joined #openstack-keystone09:19
*** jamesmcarthur has quit IRC09:31
*** jamesmcarthur has joined #openstack-keystone09:32
*** jamesmcarthur has quit IRC10:07
*** pcaruana has quit IRC10:07
*** Luzi has quit IRC10:13
*** Luzi has joined #openstack-keystone10:29
*** dancn has quit IRC10:33
*** f0o has joined #openstack-keystone10:39
*** jamesmcarthur has joined #openstack-keystone10:40
f0oHi, I've got a question regarding oslo-policy for identity:create_credential. I'm running Rocky and got the rule '"identity:create_credential": "rule:admin_or_owner or user_id:%(target.credential.user_id)s"' in my policy but I'm still getting a denied eventhough the debug logs from enforcer.py show the correct user_id in the target.credential object and the correct user_id in the context object.10:42
f0oAny ideas?10:42
*** pcaruana has joined #openstack-keystone10:55
*** jdwidari has joined #openstack-keystone10:59
*** jamesmcarthur has quit IRC11:12
openstackgerritBernhard M. Wiedemann proposed openstack/keystonemiddleware master: Make tests pass in 2022  https://review.opendev.org/65778011:19
openstackgerritVishakha Agarwal proposed openstack/keystoneauth master: Generate pdf documentation  https://review.opendev.org/68227211:20
*** dancn has joined #openstack-keystone11:51
*** takamatsu has joined #openstack-keystone11:52
*** raildo has joined #openstack-keystone11:59
*** etp has quit IRC12:04
*** jamesmcarthur has joined #openstack-keystone12:10
*** jamesmcarthur has quit IRC12:10
*** jamesmcarthur_ has joined #openstack-keystone12:10
*** markvoelker has joined #openstack-keystone12:11
*** jamesmcarthur_ has quit IRC12:26
*** pcaruana has quit IRC12:27
*** openstackstatus has quit IRC12:28
*** openstack has joined #openstack-keystone12:29
*** ChanServ sets mode: +o openstack12:29
*** jamesmcarthur has joined #openstack-keystone12:29
*** openstackstatus has joined #openstack-keystone12:29
*** ChanServ sets mode: +v openstackstatus12:29
*** jmlowe has joined #openstack-keystone12:33
lbragstadf0o it doesn't look like the credential in the create request is being passed to the ENFORCER object https://opendev.org/openstack/keystone/src/branch/stable/rocky/keystone/api/credentials.py#L11712:53
lbragstadwe changed that in stein - https://opendev.org/openstack/keystone/src/branch/master/keystone/api/credentials.py#L132-L13712:55
lbragstadso - the policy that you're trying to implement is actually the default in a newer release https://opendev.org/openstack/keystone/src/branch/master/keystone/common/policies/credential.py#L8112:58
lbragstadbut implementing that policy requires some code changes to the API that pass the credential reference from the request to the enforcement library12:59
*** pcaruana has joined #openstack-keystone12:59
*** pcaruana has quit IRC13:28
*** Luzi has quit IRC13:38
f0oah ok that makes sense13:40
f0oI'll try to patch upgrade keystone to stein then13:40
*** jamesmcarthur has quit IRC13:47
*** xek has joined #openstack-keystone13:56
*** pcaruana has joined #openstack-keystone13:59
openstackgerritLance Bragstad proposed openstack/keystone master: Add default roles and scope checking to project tags  https://review.opendev.org/68250314:04
*** jamesmcarthur has joined #openstack-keystone14:17
*** jamesmcarthur has quit IRC14:22
*** lbragstad_ has joined #openstack-keystone14:26
*** jamesmcarthur has joined #openstack-keystone14:27
*** lbragstad has quit IRC14:28
*** jamesmcarthur has quit IRC14:32
*** jamesmcarthur has joined #openstack-keystone14:38
*** jamesmcarthur has quit IRC14:43
*** FlorianFa has quit IRC14:44
*** jamesmcarthur has joined #openstack-keystone14:48
*** dancn has quit IRC14:50
*** pcaruana has quit IRC14:55
*** noonedeadpunk has left #openstack-keystone14:57
lbragstad_f0o sounds good - let us know how it goes14:59
cmurphyI don't have much for the agenda today, anyone have topics to discuss at the meeting? https://etherpad.openstack.org/p/keystone-weekly-meeting15:11
cmurphywill anyone be around for office hours afterward?15:11
*** sapd1 has quit IRC15:14
*** sapd1 has joined #openstack-keystone15:15
lbragstad_i'll be around - but i don't have topics15:17
gagehugoI don't have anything15:18
cmurphyi was thinking we could do a bug triage and put together a list of rc1 priorities15:18
cmurphybut we could maybe do that during the meeting since the agenda is light15:18
lbragstad_fwiw - https://review.opendev.org/#/c/682503/ passes locally for me15:19
lbragstad_it should be ready for real reviews15:20
cmurphywoot15:20
lbragstad_with the gate in the state that it is, i didn't bother breaking it apart (sorry!)15:20
cmurphymaybe i've been looking at too many of these but i don't mind it being all in one patch15:21
lbragstad_same15:23
*** lbragstad_ is now known as lbragstad15:23
*** ivve has quit IRC15:27
openstackgerritRalf Haferkamp proposed openstack/keystone master: Fix PostgreSQL specifc issue with credentials encoding  https://review.opendev.org/68173615:27
*** gyee has joined #openstack-keystone15:32
cmurphymeeting in #openstack-meeting-alt in 6 minutes15:54
*** jmlowe has quit IRC15:55
cmurphymeeting now in #openstack-meeting-alt16:01
openstackgerritMerged openstack/keystonemiddleware master: Make tests pass in 2022  https://review.opendev.org/65778016:25
openstackgerritBen Nemec proposed openstack/oslo.policy master: Fix reference cycle caused by deprecated sample override  https://review.opendev.org/68215016:44
*** pcaruana has joined #openstack-keystone16:55
cmurphyoffice hours will start in a sec17:00
* lbragstad grabs water17:00
gagehugolemme grab water as well17:01
cmurphyhttps://meet.jit.si/keystone-office-hours17:03
cmurphyhttps://bugs.launchpad.net/keystone/+bugs?orderby=-datecreated&start=017:10
cmurphyhttps://bit.ly/2kOdZxl17:12
cmurphy^ without incomplete bugs17:12
*** jmlowe has joined #openstack-keystone17:25
jrosserif the db_sync one can merge that would be great, because the RDO packages are built with the bug included our gates are wedged up in OSA17:37
lbragstadcmurphy i resurrected my tool for generating this report https://pasted.tech/pastes/8a9e42a658ad7b387867d8ec394df9e9dce07d2f.raw17:42
lbragstadcmurphy bnemec gagehugo https://etherpad.openstack.org/p/keystone-train-rc-bug-traige17:43
cmurphyjrosser: that one is already approved https://review.opendev.org/68244717:44
jrossercmurphy: ah great, should have checked again since I looked last!17:46
*** jmlowe has quit IRC18:02
lbragstadtrain RC1 bug list https://launchpad.net/keystone/+milestone/train-rc118:04
lbragstadfyi - this is what i used to generate the bug report https://github.com/lbragstad/launchpad-toolkit#recent-bugs18:06
lbragstadi had to tinker with dependency versions, but i'm pushing those fixes soo18:07
lbragstadsoon*18:07
cmurphyi'd already been using the bug_report.py part of that but hadn't looked at the other scripts yet :)18:07
lbragstadrecent_bugs.py needs to be refactored, it's old18:08
lbragstadbut - it works (kinda?)18:08
*** jmlowe has joined #openstack-keystone18:31
openstackgerritBen Nemec proposed openstack/oslo.policy master: Suppress deprecation warnings in oslopolicy-list-redundant  https://review.opendev.org/68211718:35
*** hemna_ is now known as hemna_afk18:43
*** Ben78 has joined #openstack-keystone18:46
*** Krenair has quit IRC18:47
*** xek_ has joined #openstack-keystone18:54
*** xek has quit IRC18:57
openstackgerritGage Hugo proposed openstack/keystone master: Specify keystone is OS user for fernet and credential setup  https://review.opendev.org/67472518:59
gagehugo^ for https://bugs.launchpad.net/keystone/+bug/183855418:59
openstackLaunchpad bug 1838554 in OpenStack Identity (keystone) "Specify keystone is OS user for fernet and credential setup" [Low,In progress] - Assigned to Gage Hugo (gagehugo)18:59
*** jdwidari has quit IRC19:01
*** jmlowe has quit IRC19:08
gyeecmurphy, lbragstad, shouldn't the removal of an identity provider be automatically cleanup the auto generated federated domain for that IDP as well?19:17
lbragstadumm- i think so?19:17
lbragstadi thought ron fixed a bug for that a while ago19:17
gyeeI am seeing a bunch of auto generated federated domains leftover after a tempest run19:18
gyeethis is stable/rocky btw19:18
lbragstadoh - interesting19:18
gyeemaybe we need to backport a patch or two?19:18
lbragstadmaybe... i'd see if that's the case with master19:19
lbragstadbut i thought we had a discussion about cleaning up those domains when an IdP is deleted19:19
gyeelet me fire up my keystone vagrant and see if this is happening in master branch as well19:19
cmurphygyee: are you seeing it only with tempest or did you verify it with one idp/one domain?19:20
gyeeI haven't try the second part yet19:21
gyeejust the tempest ones19:21
cmurphycould be tempest doing something weird19:21
gyeeI do see those delete domains calls in keystone access logs19:23
lbragstadactually - it looks like the relationship is the other way around19:25
Ben78A Fernet token is smaller than a PKI token because it contains less data. Can someone kindly explain why keystone community did not reduced the content of PKI token and replaced it with Fernet?19:25
lbragstadhttps://opendev.org/openstack/keystone/src/branch/master/keystone/federation/core.py#L52-L5419:26
lbragstadBen78 the PKI implementation in keystone had some other issues that were security concerns - but we could also only make the tokens so small, i don't think it would have been possible to generate a pki token less than 1700 characters19:27
lbragstadwhen we implemented fernet, we compared the size of the two formats and pki token with a single entry in the service catalog would generate 1700 character tokens19:28
gyeecmurphy, manually deleting one identity provider from openstack CLI doesn't seem to cleanup the auto generated domain19:28
lbragstadgyee if you delete the domain it should clean up the idp19:28
gyeelbragstad, why design it this way?19:29
gyeefrom usability stand point, would it be easier for user to just delete the IDP?19:29
cmurphyi guess because the domain owns the idp19:30
cmurphyit would be like saying delete user should cause the user's domain to be deleted19:30
cmurphybut idk19:31
lbragstadwell - a domain can be used my multiple idps, right?19:32
lbragstadby*19:32
gyeebut this sounds weird, IdP was created before the auto generated domain though19:32
cmurphyseems so19:32
cmurphyhttps://opendev.org/openstack/keystone/src/branch/master/keystone/federation/core.py#L71-L7719:32
cmurphythe domain is either generated when the idp is created or the idp is created within an existing domain19:33
lbragstadyeah - so you could point two idps to the same domain19:33
lbragstadin theory19:33
cmurphyyeah19:33
gyeeeven with the auto generated ones?19:33
cmurphyseems like you could19:34
gyeeI would think those auto generated ones are 1:119:34
cmurphycreate one idp with an autogenerated one, then create another using the same domain19:34
gyeealllrighty then, lets fix tempest :-)19:35
cmurphy++19:35
*** problem_v has quit IRC19:40
*** dtruong has quit IRC19:40
*** problem_v has joined #openstack-keystone19:40
*** dtruong has joined #openstack-keystone19:40
*** spsurya has quit IRC19:48
*** jmlowe has joined #openstack-keystone19:48
Ben78lbragstad: Thanks for the response. You do not store any service catalog in a Fernet token. Why do you need to put service catalog in a PKI token?! If you consider the same data and use the same key size, the size of the both format could be almost the same.19:57
gyeeBen78, are you sure they are the same? PKI token have the signature and the ASN.1 overhead. Fernet uses symmetric crypto.20:15
lbragstadBen78 fernet tokens do not contain catalog data20:16
lbragstadBen78 when PKI tokens were originally developed, the whole idea (long term) was to use them at the service and allow for offline validation20:17
lbragstadas opposed to having the service put the token on the wire back to keystone to validate, or alternatively have the service fetch the catalog repeatedly20:17
gyeeand pushing token revocation list was PITA :-)20:17
lbragstadyeah - that was a whole other wart from that idea20:18
lbragstadBen78 you can generate pki tokens on releases that support it by using the ?nocatalog query string20:19
Ben78lbragstad, gyee: So, the problem was token revocation not the size. Because, the size could be reduced if you eliminate service catalog entries20:20
lbragstadsize was an attributing factor, for sure20:21
lbragstadby default - keystone was issuing tokens that exceed http header limits20:21
gyeeI remember even with the nocatalog option, some tokens were still exceeding the http header limits20:22
lbragstadif you wanted to get around the issue you could recompile apache with settings to bump up that limit20:23
Ben78Maybe the newer public crypto scheme like ECDSA could solve it.20:24
lbragstadmaybe, but at this point there are other open standards that implement that logic20:25
lbragstadhttps://jwt.io/20:25
lbragstadbefore - keystone was handling all the signing and validation locally by shelling out to openssl with subprocess20:26
lbragstadat least that's what the PKI implementation did20:26
lbragstadthat actually introduced a couple of validation/revocation issues for us since we were maintaining that code, but since then there have been improvements in pyca/cryptography and RFCs to standardize token formas20:27
lbragstadformats*20:27
lbragstadhttps://www.rfc-editor.org/rfc/rfc7518.html goes into extensive detail on the algorithms used by RFC 751920:29
lbragstadin fact - keystone has a token format today that uses ECDSA20:29
gyeelbragstad, really? which token?20:30
lbragstadjws20:30
gyeeoh20:30
Ben78Is there a document that explains validation/revocation issues with PKI? (I need to explain to my advisory every detail)20:31
lbragstadwe had a security advisory for an issue with pki20:31
Ben78*advisor20:32
lbragstadhttps://docs.openstack.org/keystone/latest/configuration/config-options.html#token describes the two token formats we offer today (in place of PKI)20:32
lbragstadhttps://docs.openstack.org/keystone/latest/admin/tokens.html helps, too20:32
lbragstadhttps://bugs.launchpad.net/keystonemiddleware/+bug/149080420:33
openstackLaunchpad bug 1490804 in OpenStack Security Notes "[OSSA 2016-005] PKI Token Revocation Bypass (CVE-2015-7546)" [Critical,Fix released] - Assigned to Nathan Kinder (nkinder)20:33
lbragstad^ that contains a *lot* of context20:33
Ben78Thanks20:34
lbragstadhttps://bugs.launchpad.net/keystonemiddleware/+bug/1490804/comments/7320:34
openstackLaunchpad bug 1490804 in OpenStack Security Notes "[OSSA 2016-005] PKI Token Revocation Bypass (CVE-2015-7546)" [Critical,Fix released] - Assigned to Nathan Kinder (nkinder)20:35
lbragstad^ that's a good summary20:35
cmurphylbragstad: i don't think we need to do anything for identity:list_role_assignments_for_tree20:35
cmurphybased on your comment https://opendev.org/openstack/keystone/src/branch/master/keystone/common/policies/role_assignment.py#L52-L5820:35
cmurphyrule:admin_required actually seems right20:36
lbragstadok - cool20:36
lbragstadi supppose we could simplify it to just "role:admin" thne20:36
lbragstadthen*20:36
cmurphyyeah could do20:37
cmurphyi'll do that20:37
lbragstadbut - if we do that and enforce_scope=False, i assume it will break with system-scoped and domain-scoped tokens20:37
cmurphyi think they already can't use that api, if the behavior is based on finding a project id in the token20:38
lbragstadok - coo20:38
lbragstadcool*20:38
cmurphywe need tests for it too i guess20:39
lbragstadBen78 what release of openstack are you using?20:40
Ben78lbragstad: Stein20:47
*** trident has quit IRC20:48
lbragstadBen78 were you looking to use PKI?20:48
lbragstador was there a particular reason why you were looking into it?20:48
Ben78No, I am working on a new token format20:48
lbragstadoh - cool20:49
lbragstadi assume it does something different than what fernet or jws does?20:49
cmurphylbragstad: i was wrong, the project id comes from a query filter https://opendev.org/openstack/keystone/src/branch/master/keystone/api/role_assignments.py#L91-L9320:50
Ben78I need to explain why my Format is better than UUID, PKI, and Fernet. And, now jws ;)20:50
lbragstadBen78 heh - i've had to do that before, good luck!20:50
lbragstad:)20:51
lbragstadcmurphy that kinda sucks, i was hoping it would have just come from the token20:51
lbragstadwould have made things easier20:51
gyee*better* has to be in the context of everything, support, troubleshoot, usability, upgrade, etc20:51
Ben78lbragstad: thanks!20:51
gyeeperformance, security, everything20:51
cmurphylbragstad: yeah, well makes me think it probably makes sense for system/domain readers to have access to it?20:51
lbragstadyeah...20:52
gyeewe often design features that is good at one thing and suck at others20:52
lbragstadcmurphy if it was hard-coded to come from the token, then system and domain users wouldn't really care, we'd just force them to get a project-scoped token20:52
lbragstadBen78 what problems are you hoping to solve with your new token format?20:52
lbragstadwe still might have some of those problems upstream20:52
Ben78lbragstad: bearer token20:53
lbragstadaha20:53
lbragstadthe infamous bearer-token problem20:53
gyeelbragstad, anybody uses jws in production right now, just curious about its performance compare to fernet20:55
Ben78gyee: Mine improves security. I am little bit worry about the size20:56
lbragstadgyee i'm not sure if anyone is using it in production, yet20:56
lbragstadBen78 how did you solve the bearer-token issue, request signing?20:57
*** pcaruana has quit IRC20:58
Ben78lbragstad: Signing request with a trick (without signing request)20:59
*** trident has joined #openstack-keystone21:00
lbragstadis the token format based on symmetric or asymmetric cryptography?21:00
Ben78It is based on symmetric crypto21:00
lbragstaddid you reuse the fernet utilities?21:00
lbragstador did you use another symmetric crypto provider?21:02
Ben78What do you mean? Keystone still issues Fernet tokens but users can change tokens in a way that only keystone can validate them21:02
Ben78we call it Recursive Augmented Fernet Token (RAFT)21:03
lbragstadso does each user get a shared secret key from keystone?21:04
lbragstadBen78 have you open-sourced it?21:04
lbragstadi'd love to take a look21:04
Ben78No, each user continue to get Fernet token21:04
*** raildo has quit IRC21:12
openstackgerritColleen Murphy proposed openstack/keystone master: Fix validation of role assignment subtree list  https://review.opendev.org/68275021:24
openstackgerritColleen Murphy proposed openstack/keystone master: Fix validation of role assignment subtree list  https://review.opendev.org/68275021:30
*** markvoelker has quit IRC21:35
openstackgerritBen Nemec proposed openstack/oslo.policy master: Suppress deprecation warnings in oslopolicy-list-redundant  https://review.opendev.org/68211721:50
*** jamesmcarthur has quit IRC22:13
*** xek_ has quit IRC22:15
*** Krenair has joined #openstack-keystone22:30
openstackgerritColleen Murphy proposed openstack/keystone master: Allow system/domain scope for assignment tree list  https://review.opendev.org/68276222:54
*** tkajinam has joined #openstack-keystone23:04
*** markvoelker has joined #openstack-keystone23:22
*** jamesmcarthur has joined #openstack-keystone23:24
*** adriant has joined #openstack-keystone23:35
*** rcernin has joined #openstack-keystone23:44
*** jamesmcarthur has quit IRC23:50
« Monday, 2019-09-16 Index Wednesday, 2019-09-18 »

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!