| *** spatel has joined #openstack-keystone | 00:24 | |
| *** spatel has quit IRC | 00:28 | |
| *** ileixe has joined #openstack-keystone | 01:00 | |
| openstackgerrit | Merged openstack/keystone master: Revert "Resource backend is SQL only now" https://review.opendev.org/687756 | 01:11 |
|---|---|---|
| *** gyee has quit IRC | 01:46 | |
| *** ileixe has left #openstack-keystone | 01:50 | |
| *** awalende has joined #openstack-keystone | 03:34 | |
| *** kumar_biplab has joined #openstack-keystone | 03:38 | |
| *** awalende has quit IRC | 03:39 | |
| cmurphy | adriant: is https://review.opendev.org/618144 something you'd want to take on this cycle? | 04:41 |
| adriant | cmurphy: maybe... but in all likelihood I'll be too busy with internal work before may | 04:43 |
| adriant | and I still need to try and find the time to add MFA support to horizon :/ | 04:44 |
| adriant | review and testing I can commit to, but not doing the implementation myself | 04:45 |
| cmurphy | adriant: okay good to know | 04:47 |
| *** spatel has joined #openstack-keystone | 05:15 | |
| *** spatel has quit IRC | 05:20 | |
| *** Luzi has joined #openstack-keystone | 06:08 | |
| *** kumar_biplab has quit IRC | 06:23 | |
| *** rcernin has quit IRC | 06:53 | |
| *** dancn has joined #openstack-keystone | 07:40 | |
| *** tesseract has joined #openstack-keystone | 08:17 | |
| *** ivve has joined #openstack-keystone | 08:20 | |
| *** dmellado has quit IRC | 08:21 | |
| *** awalende has joined #openstack-keystone | 08:22 | |
| *** dmellado has joined #openstack-keystone | 08:23 | |
| *** dmellado has quit IRC | 08:25 | |
| *** dmellado has joined #openstack-keystone | 08:27 | |
| *** tkajinam has quit IRC | 08:29 | |
| *** trident has quit IRC | 09:16 | |
| *** dmellado has quit IRC | 09:20 | |
| *** dmellado has joined #openstack-keystone | 09:24 | |
| *** trident has joined #openstack-keystone | 09:26 | |
| *** spatel has joined #openstack-keystone | 09:50 | |
| *** pcaruana has joined #openstack-keystone | 09:54 | |
| *** spatel has quit IRC | 09:55 | |
| *** dancn has quit IRC | 10:22 | |
| openstackgerrit | Merged openstack/keystone master: Stop testing Python 2 https://review.opendev.org/688601 | 10:28 |
| openstackgerrit | Slawek Kaplonski proposed openstack/keystone master: Drop old neutron-grenade job https://review.opendev.org/694239 | 10:39 |
| *** dancn has joined #openstack-keystone | 10:40 | |
| *** yan0s has joined #openstack-keystone | 10:43 | |
| *** dancn has quit IRC | 10:55 | |
| *** raildo has joined #openstack-keystone | 11:22 | |
| *** jaosorior has joined #openstack-keystone | 11:25 | |
| *** dave-mccowan has joined #openstack-keystone | 12:01 | |
| *** trident has quit IRC | 12:09 | |
| *** trident has joined #openstack-keystone | 12:18 | |
| *** tesseract has quit IRC | 12:28 | |
| *** tesseract has joined #openstack-keystone | 12:29 | |
| *** Luzi has quit IRC | 12:51 | |
| *** jistr has quit IRC | 12:52 | |
| *** d34dh0r53 has quit IRC | 12:52 | |
| *** vishalmanchanda has quit IRC | 12:52 | |
| *** ianw has quit IRC | 12:52 | |
| *** wdoekes has quit IRC | 12:52 | |
| *** amotoki has quit IRC | 12:52 | |
| *** Anticimex has quit IRC | 12:52 | |
| *** rha has quit IRC | 12:52 | |
| *** coreycb has quit IRC | 12:52 | |
| *** knikolla has quit IRC | 12:52 | |
| *** ildikov has quit IRC | 12:52 | |
| *** openstackstatus has quit IRC | 12:53 | |
| *** Luzi has joined #openstack-keystone | 12:53 | |
| *** jistr has joined #openstack-keystone | 12:53 | |
| *** wdoekes has joined #openstack-keystone | 12:53 | |
| *** d34dh0r53 has joined #openstack-keystone | 12:53 | |
| *** vishalmanchanda has joined #openstack-keystone | 12:53 | |
| *** amotoki has joined #openstack-keystone | 12:53 | |
| *** ianw has joined #openstack-keystone | 12:53 | |
| *** Anticimex has joined #openstack-keystone | 12:53 | |
| *** rha has joined #openstack-keystone | 12:53 | |
| *** coreycb has joined #openstack-keystone | 12:53 | |
| *** ildikov has joined #openstack-keystone | 12:53 | |
| *** knikolla has joined #openstack-keystone | 12:53 | |
| *** spatel has joined #openstack-keystone | 13:30 | |
| *** spatel has quit IRC | 13:34 | |
| *** spatel has joined #openstack-keystone | 13:47 | |
| spatel | Morning folks | 13:57 |
| spatel | I am working on keystone + LDAP integration and i have few question | 13:57 |
| spatel | Is it possible to run hybrid auth so first check SQL and then LDAP | 13:58 |
| spatel | i don't want to touch my service accounts which is currently in SQL | 13:58 |
| cmurphy | spatel: it's not supported in keystone upstream, we recommend using domain-specific backends https://docs.openstack.org/keystone/latest/admin/configuration.html#domain-specific-configuration | 14:02 |
| spatel | cmurphy: thanks for link reading... I have two openstack private cloud in datacenter and i want to integrate in LDAP and both has different creds etc.. so wan't sure how they will fit in LDAP if both cloud has nova account. | 14:04 |
| cmurphy | spatel: I don't understand what you mean by a "nova account" | 14:07 |
| cmurphy | if you use the same ldap directory for both datacenters then the same users could log into both clouds | 14:07 |
| spatel | I have same LDAP but i have different password for all service account like nova,glance etc.. | 14:09 |
| spatel | that is why i wanted to keep service account in SQL so i don't need to create them in LDAP | 14:09 |
| cmurphy | the service accounts should use one domain backed by sql and the regular users should use a different domain backed by ldap | 14:09 |
| spatel | so you are saying i can keep service account in SQL for A domain and create B domain in same cloud and their users will be in LDAP ? | 14:11 |
| spatel | am i missing anything here? | 14:11 |
| cmurphy | spatel: yes that is correct | 14:11 |
| cmurphy | the document will explain how | 14:11 |
| spatel | currently my cloud in production can i do this? | 14:11 |
| spatel | i meant moving account here and there in separate domain | 14:12 |
| cmurphy | you will have to tell your users that they need to authenticate under a new domain and you will have to recreate role assignments for them | 14:12 |
| spatel | oh!! so in short this domain is own namespace /users/role/ etc.. | 14:13 |
| spatel | i need to play in lab and see how it goes :) | 14:14 |
| cmurphy | spatel: it's a namespace for users, you don't have to change the roles themselves but just the role assignments | 14:14 |
| cmurphy | spatel: yes using a lab first is a good idea :) | 14:14 |
| spatel | I was reading this and thought its easy to implement SQL + LDAP hybrid :) | 14:15 |
| spatel | https://www.mattfischer.com/blog/archives/576 | 14:15 |
| cmurphy | that hybrid backend isn't maintained anymore and won't work on latest versions of keystone, and we don't have a backend like that in upstream keystone | 14:15 |
| *** Luzi has quit IRC | 14:33 | |
| lbragstad | cmurphy thoughts on https://review.opendev.org/#/c/694096/ - i'm trying to uncover what the contentious parts were of the original patch | 14:42 |
| cmurphy | lbragstad: it's documented in the comment history in https://review.opendev.org/655166 | 15:02 |
| lbragstad | oh - the federated bit? | 15:02 |
| cmurphy | lbragstad: right | 15:03 |
| Blinkiz | Hello. Am trying to get Password authentication with scoped authorization (/v3/auth/tokens) to work. Am using Postman with first system-scoped example on the page https://docs.openstack.org/api-ref/identity/v3/?expanded=password-authentication-with-scoped-authorization-detail#password-authentication-with-scoped-authorization | 15:06 |
| Blinkiz | I get back error 400, Expecting to find domain in user. The server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error. | 15:06 |
| Blinkiz | It seems that the keystone is always trying without scope. Why is this? | 15:06 |
| lbragstad | Blinkiz i left a comment on the story you linked to yesterday that should help explain what you need to do | 15:06 |
| Blinkiz | oh.. Let me see | 15:07 |
| lbragstad | Blinkiz if you reference a user by their name in the request - you'll need to supply the corresponding domain | 15:07 |
| lbragstad | if you reference them by their ID, you don't need the domain | 15:08 |
| lbragstad | cmurphy https://review.opendev.org/#/c/604201/ wasn't backported - so that's only in train i believe | 15:08 |
| lbragstad | so - stein and rocky would be in the same boat as queens, right? | 15:08 |
| Blinkiz | Oh my.. ID instead of name.. :) | 15:09 |
| lbragstad | Blinkiz you can certainly use both, but if you use username, you'll need to supply the domain id | 15:10 |
| lbragstad | Blinkiz the same is true for project names if you're requesting a project-scoped token, projects and users are both scoped to domains, so you'll need to namespace them by their domain if you're relying on names | 15:11 |
| lbragstad | project ID and user ID are globally unique | 15:11 |
| Blinkiz | lbragstad: thank you for the explanation. | 15:11 |
| lbragstad | no problem | 15:12 |
| *** ayoung has joined #openstack-keystone | 15:28 | |
| cmurphy | lbragstad: I know, but there was a lot of misunderstanding about it and how it worked initially | 15:35 |
| cmurphy | we all eventually agreed it was fine but it took a while to land there | 15:36 |
| * lbragstad nods | 15:36 | |
| lbragstad | thanks cmurphy | 15:36 |
| Blinkiz | lbragstad: May I ask you another think? Do you know if Horizon support scopes? In login form I have Domain, username and password. This domain I supply, is that equal to user_domain or a domain that is in the scope section? | 15:42 |
| Blinkiz | thing | 15:43 |
| Blinkiz | or is "scope" like an attribute on a username + domain? How should I think? | 15:44 |
| lbragstad | Blinkiz it depends, if you supply a domain with a username in the identity portion of the request, it is specific to namespacing the user and completely separate from the scope of the request | 15:44 |
| lbragstad | for example, you can have a request with a username + domain name in the identity portion of the request, and a project name + domain name in the scope portion of the request | 15:45 |
| lbragstad | the result would be a project-scoped token | 15:45 |
| lbragstad | we have some examples here - https://docs.openstack.org/api-ref/identity/v3/?expanded=password-authentication-with-scoped-authorization-detail#project-scoped-with-project-name-example | 15:46 |
| lbragstad | the "scope" section is specific to what you want access to | 15:46 |
| lbragstad | the "identity" portion is everything related to proving you are who you say you are | 15:47 |
| Blinkiz | lbragstad: So when the user is clicking around in Horizon interface, how.. where.. how is the scope applied? is Horizon sending to keystone as in the example you linked to? | 15:47 |
| lbragstad | Horizon will imply scope based on the projects you have access to | 15:47 |
| Blinkiz | aa, what I want to access. I see! | 15:47 |
| Blinkiz | Now I get it | 15:47 |
| Blinkiz | :) | 15:48 |
| lbragstad | you typically see a drop down menu in horizon that lists the projects you have access to | 15:48 |
| Blinkiz | lbragstad: yeah, got it. Light bulb here now :-) | 15:48 |
| lbragstad | when you select one, horizon is going to start requesting scoped tokens for that project | 15:48 |
| lbragstad | cool | 15:48 |
| lbragstad | but - to be explicit, i don't think horizon has system support currently | 15:48 |
| Blinkiz | lbragstad: Thank you for guiding me :) | 15:49 |
| lbragstad | Blinkiz no problem - i'm happy to help | 15:49 |
| Blinkiz | :-) | 15:51 |
| *** spatel has quit IRC | 15:59 | |
| *** ivve has quit IRC | 16:02 | |
| *** gyee has joined #openstack-keystone | 16:11 | |
| *** spatel has joined #openstack-keystone | 16:14 | |
| spatel | cmurphy: this is the best document i found so far https://heig-cloud.github.io/article/2015-12-17%20ldap/ | 16:14 |
| spatel | Love it | 16:14 |
| knikolla | o/ | 16:16 |
| spatel | cmurphy: question is i have running cloud and currently all my users in SQL and in default domain, if i create new domain foo then how existing VMs will be available in foo domain ? | 16:19 |
| spatel | i meant can i give permission to foo domain users in default domain VMs? | 16:21 |
| cmurphy | spatel: your foo domain users can have role assignments on the default domain or projects under the default domain so they can have access to those VMs | 16:24 |
| spatel | cmurphy: thanks!!! let me try and see how it goes... anyway thank you so much!!! | 16:25 |
| cmurphy | spatel: no problem :) | 16:27 |
| *** spatel has quit IRC | 16:30 | |
| *** yan0s has quit IRC | 16:40 | |
| *** cmart has joined #openstack-keystone | 16:45 | |
| *** gshippey has joined #openstack-keystone | 16:47 | |
| cmart | Hello. Does anyone know if I can get/use an *unscoped* application credential? | 16:47 |
| cmurphy | cmart: application credentials can only be project scoped | 16:49 |
| cmart | cmurphy, OK, thank you. The broader goal: I would like some kind of long-lived token/credential that that allows me to authenticate as a user, obtain a list of projects that the user has access to, and generate application credentials for each of those projects. | 16:50 |
| cmart | Do you know of anything else in Keystone that might help me with that? I can do it if I store the user's password, but I want to avoid storing that in my application, if I can. | 16:51 |
| cmurphy | cmart: you can use a scoped token to get the user's list of projects | 17:01 |
| cmurphy | i just checked and you can use an application credential token to do that as well, although i think that's actually a security problem ... | 17:02 |
| *** ayoung has quit IRC | 17:09 | |
| *** ayoung has joined #openstack-keystone | 17:13 | |
| *** tesseract has quit IRC | 17:15 | |
| cmart | cmurphy right, a project-scoped token (or application credential token) can get me a list of my user's projects. but I also want to then obtain project-scoped tokens for each of those projects. it seems like the only long-lived credential that will get me project-scoped tokens for any/all of my projects is my user's password. it would be nice to use some other kind of credential for this.. but it sounds like an application crede | 17:15 |
| cmurphy | cmart: keystone can't support anything like that, application credentials are meant to be generated by humans, there's no concept of a global app cred that can unlock other app creds | 17:19 |
| cmart | cmurphy ok. thank you! | 17:21 |
| cmurphy | np | 17:22 |
| *** ivve has joined #openstack-keystone | 17:24 | |
| *** mvkr has quit IRC | 18:10 | |
| *** baffle has quit IRC | 18:22 | |
| *** awalende has quit IRC | 18:25 | |
| *** awalende has joined #openstack-keystone | 18:25 | |
| *** dave-mccowan has quit IRC | 18:26 | |
| *** awalende has quit IRC | 18:29 | |
| *** dave-mccowan has joined #openstack-keystone | 18:33 | |
| *** jaosorior has quit IRC | 18:34 | |
| *** ayoung has quit IRC | 18:54 | |
| *** ayoung has joined #openstack-keystone | 18:57 | |
| *** ayoung has quit IRC | 19:16 | |
| *** ayoung has joined #openstack-keystone | 19:19 | |
| *** ayoung has quit IRC | 19:39 | |
| *** ayoung has joined #openstack-keystone | 19:41 | |
| *** ayoung has quit IRC | 19:57 | |
| *** ayoung has joined #openstack-keystone | 19:59 | |
| *** ayoung has quit IRC | 20:06 | |
| *** ayoung has joined #openstack-keystone | 20:08 | |
| *** ayoung has quit IRC | 20:13 | |
| *** ayoung has joined #openstack-keystone | 20:15 | |
| *** spatel has joined #openstack-keystone | 20:39 | |
| spatel | cmurphy: do you know about this error, look like this driver is missing - ImportError: Unable to find 'keystone.identity.backends.ldap.Identity' driver in 'keystone.identity' | 20:40 |
| spatel | how do i install it? | 20:40 |
| cmurphy | spatel: what document are you following? | 20:40 |
| cmurphy | you don't need to install anything, you just need driver = ldap in your config | 20:40 |
| spatel | https://heig-cloud.github.io/article/2015-12-17%20ldap/ | 20:40 |
| cmurphy | spatel: i recommend following the official docs | 20:41 |
| spatel | ah!! | 20:41 |
| cmurphy | that document is four years old | 20:41 |
| spatel | "driver = ldap" in /etc/keystone/domains/keystone.foo.conf right? | 20:42 |
| cmurphy | spatel: right | 20:42 |
| spatel | ok | 20:42 |
| spatel | cmurphy: thanks :) now getting different error, let me work my way.. will back if need your help :) | 20:44 |
| lbragstad | cmurphy based on your summary, it sounds like there is a pop-up team forming around the policy work across projects | 20:48 |
| lbragstad | do you know what the next steps are for that? | 20:48 |
| spatel | cmurphy: cool, i can see openstack query LDAP.. progress :) | 20:49 |
| *** ayoung has quit IRC | 20:49 | |
| *** ayoung has joined #openstack-keystone | 20:52 | |
| cmurphy | lbragstad: not really sure, i thought i'd start with creating a wiki page and a governance change and start a thread on the mailing list | 20:52 |
| cmurphy | was going to bring it up at the ptg meeting | 20:52 |
| lbragstad | ok - cool | 20:53 |
| lbragstad | i thought a governance patch was supposed to be proposed somewhere... | 20:53 |
| cmurphy | here https://governance.openstack.org/tc/reference/popup-teams.html | 20:53 |
| cmurphy | we'll need at least one more co-lead and a tc liaison | 20:54 |
| *** gshippey has quit IRC | 21:09 | |
| *** raildo has quit IRC | 21:12 | |
| *** rcernin has joined #openstack-keystone | 21:28 | |
| *** spatel has quit IRC | 21:43 | |
| *** jaosorior has joined #openstack-keystone | 21:45 | |
| *** ayoung has quit IRC | 21:57 | |
| *** ayoung has joined #openstack-keystone | 21:59 | |
| *** jaosorior has quit IRC | 22:02 | |
| *** jaosorior has joined #openstack-keystone | 22:03 | |
| *** jaosorior has quit IRC | 22:51 | |
| *** tkajinam has joined #openstack-keystone | 22:54 | |
| *** dave-mccowan has quit IRC | 23:02 | |
| *** ayoung has quit IRC | 23:03 | |
| *** ayoung has joined #openstack-keystone | 23:05 | |
| *** mvkr has joined #openstack-keystone | 23:11 | |
| *** ivve has quit IRC | 23:14 | |
| *** dave-mccowan has joined #openstack-keystone | 23:17 | |
| *** ayoung has quit IRC | 23:52 | |
| *** ayoung has joined #openstack-keystone | 23:54 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!