| *** jamesmcarthur has joined #openstack-keystone | 00:03 | |
| *** jamesmcarthur has quit IRC | 00:08 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:37 | |
| *** jamesmcarthur has quit IRC | 00:42 | |
| *** cmart has quit IRC | 00:43 | |
| *** mvkr has quit IRC | 01:04 | |
| *** awalende has joined #openstack-keystone | 01:05 | |
| *** awalende has quit IRC | 01:10 | |
| *** mvkr has joined #openstack-keystone | 01:17 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:39 | |
| *** jamesmcarthur has quit IRC | 01:43 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:10 | |
| *** jamesmcarthur has quit IRC | 02:15 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:52 | |
| *** jamesmcarthur has quit IRC | 02:57 | |
| *** spatel has joined #openstack-keystone | 03:04 | |
| spatel | morning | 03:04 |
|---|---|---|
| spatel | I am having issue setting up my openrc file with multi-domain keystone | 03:05 |
| spatel | This is my openrc file - http://paste.openstack.org/show/786693/ | 03:06 |
| spatel | but somehow its saying authorization fail.. | 03:06 |
| spatel | I can use same account username/password in horizon and it works | 03:07 |
| *** awalende has joined #openstack-keystone | 03:13 | |
| *** awalende has quit IRC | 03:18 | |
| *** renich has joined #openstack-keystone | 03:27 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:29 | |
| *** jamesmcarthur has quit IRC | 03:34 | |
| *** jamesmcarthur has joined #openstack-keystone | 04:31 | |
| *** jamesmcarthur has quit IRC | 04:35 | |
| *** cmart has joined #openstack-keystone | 04:36 | |
| *** renich_ has joined #openstack-keystone | 04:44 | |
| *** renich has quit IRC | 04:45 | |
| *** cmart has quit IRC | 05:11 | |
| *** spatel has quit IRC | 05:11 | |
| *** tkajinam has quit IRC | 05:37 | |
| *** tkajinam has joined #openstack-keystone | 05:38 | |
| *** jamesmcarthur has joined #openstack-keystone | 06:07 | |
| *** jamesmcarthur has quit IRC | 06:12 | |
| *** pcaruana has joined #openstack-keystone | 06:32 | |
| *** renich has joined #openstack-keystone | 07:27 | |
| *** renich_ has quit IRC | 07:28 | |
| *** tesseract has joined #openstack-keystone | 08:16 | |
| *** amoralej|off is now known as amoralej | 08:16 | |
| *** tkajinam has quit IRC | 08:19 | |
| *** renich has quit IRC | 08:19 | |
| *** renich has joined #openstack-keystone | 08:33 | |
| *** ivve has joined #openstack-keystone | 10:35 | |
| *** takamatsu has quit IRC | 10:55 | |
| *** jaosorior has joined #openstack-keystone | 11:13 | |
| *** rcernin has quit IRC | 11:40 | |
| *** raildo has joined #openstack-keystone | 11:53 | |
| *** jawad_axd has joined #openstack-keystone | 12:48 | |
| *** amoralej is now known as amoralej|lunch | 13:07 | |
| *** raildo has quit IRC | 13:28 | |
| *** raildo has joined #openstack-keystone | 13:29 | |
| *** jaosorior has quit IRC | 13:38 | |
| *** tkajinam has joined #openstack-keystone | 14:00 | |
| *** amoralej|lunch is now known as amoralej | 14:02 | |
| lbragstad | cmurphy in case you want to take a look before it lands | 14:14 |
| lbragstad | https://review.opendev.org/#/c/669181/ | 14:14 |
| *** renich_ has joined #openstack-keystone | 14:39 | |
| *** renich has quit IRC | 14:41 | |
| *** jawad_axd has quit IRC | 14:48 | |
| *** jaosorior has joined #openstack-keystone | 15:04 | |
| *** spatel has joined #openstack-keystone | 15:16 | |
| spatel | cmurphy: Hii | 15:17 |
| spatel | Are you there? | 15:18 |
| spatel | I am having very strange issue, my openrc doesn't like LDAP account, if i add local account that works | 15:18 |
| *** tkajinam has quit IRC | 15:19 | |
| lbragstad | spatel do you have any logs? | 15:25 |
| spatel | I am collecting but just wanted to check if i am dealing with bug here.. | 15:25 |
| lbragstad | ldap authentication can be tricky and it's hard to diagnose the issue without more information | 15:25 |
| *** awalende has joined #openstack-keystone | 15:45 | |
| *** renich_ has quit IRC | 15:46 | |
| *** spatel has quit IRC | 15:48 | |
| *** awalende has quit IRC | 15:50 | |
| cmurphy | lbragstad: thanks, lgtm | 15:52 |
| *** spatel has joined #openstack-keystone | 15:54 | |
| *** vishakha has joined #openstack-keystone | 15:56 | |
| *** cmart has joined #openstack-keystone | 16:00 | |
| *** ivve has quit IRC | 16:02 | |
| vishakha | o/ | 16:02 |
| spatel | lbragstad: can you see this issue? http://paste.openstack.org/show/786735/ | 16:09 |
| lbragstad | spatel it looks like you have dns issues | 16:10 |
| lbragstad | you need to either update your catalog or double check your dns configuration | 16:10 |
| spatel | I already have DNS name configure for that IP.. | 16:10 |
| lbragstad | sure - but your catalog is referencing ip addresses | 16:11 |
| spatel | who tells openstack use name instead of IP?> | 16:11 |
| lbragstad | python-openstackclient uses the catalog to discover other services in your cloud | 16:11 |
| spatel | how should i fix that? | 16:11 |
| lbragstad | update the endpoints | 16:11 |
| spatel | how? i never done that before | 16:11 |
| spatel | do i need to edit each service ? | 16:12 |
| lbragstad | use the cli and do it manually - `openstack endpoint set --help` | 16:12 |
| lbragstad | you might have to iterate all the serviecs, | 16:13 |
| lbragstad | but i think you only need to update the endpoints that correspond to the services | 16:13 |
| spatel | hmm! | 16:14 |
| spatel | let me try hold on | 16:14 |
| *** jamesmcarthur has joined #openstack-keystone | 16:19 | |
| *** ygk_12345 has joined #openstack-keystone | 16:23 | |
| *** tesseract has quit IRC | 16:23 | |
| ygk_12345 | hi all | 16:23 |
| ygk_12345 | i have added an ldap domain to keystone. but when I do a user list from that domain it is gateway 504 timeout | 16:24 |
| ygk_12345 | any idea ? | 16:24 |
| spatel | lbragstad: i don't think you can update endpoint URL from command line, | 16:25 |
| spatel | lots of people saying use MySQL directly | 16:25 |
| ygk_12345 | can anyone here help me with my issue please | 16:25 |
| ygk_12345 | http://paste.openstack.org/show/786738/ | 16:25 |
| lbragstad | spatel i don't recommend modifying the database directly | 16:27 |
| lbragstad | using the CLI works just ifne | 16:27 |
| lbragstad | fine* | 16:27 |
| lbragstad | http://paste.openstack.org/show/786739/ | 16:27 |
| lbragstad | spatel endpoint operations are typically reserved for admins, so if you hit permission issues you might need to use a different user | 16:30 |
| spatel | hmm! let me try.. thanks | 16:30 |
| *** ygk_12345 has quit IRC | 16:34 | |
| spatel | lbragstad: you are awesome!! that works | 16:37 |
| spatel | lbragstad: i am going to change all of them now | 16:37 |
| lbragstad | sounds good - glad you got it working | 16:37 |
| spatel | lbragstad: how to handle this one? should i put them in quotes ' ' ? | 16:42 |
| -spatel- [root@ostack-osa-eng ~]# openstack endpoint set --url https://openstack-eng.example.com:8004/v1/%(tenant_id)s 7dd979b3ea6d4459a780aa09baff8d06 | 16:42 | |
| -spatel- -bash: syntax error near unexpected token `(' | 16:42 | |
| knikolla | spatel: put it in single quotes | 16:45 |
| aloga | hello there | 16:52 |
| aloga | I have a question regarding https://review.opendev.org/#/c/373983/6 | 16:52 |
| aloga | this was a spec we proposed some time ago in order to provide a native OpenID Connect plugin for Keystone, rather than relying on the Apache module | 16:53 |
| aloga | this way all OpenID Connect stuff can be configured within Keystone, not in Apache | 16:54 |
| aloga | we have sucessfully implemented it as an auth plugin to an extent: https://github.com/IFCA/keystone-oidc-auth-plugin/ | 16:54 |
| aloga | since OpenID connect requires a redirect for the user agent to be redirected from the relying party (keystone) to the OpenID Connect provider (OP) | 16:55 |
| spatel | knikolla: single quotes works | 16:56 |
| aloga | IIRC, this was possible with the old WSGI plumbing, as you could raise a 302 exception and it was propagated to the user | 16:56 |
| aloga | however, it is not possible anymore with Flask | 16:56 |
| aloga | therefore this bug: https://bugs.launchpad.net/keystone/+bug/1854041 | 16:57 |
| openstack | Launchpad bug 1854041 in OpenStack Identity (keystone) "Keystone should propagate redirect exceptions from auth plugins" [Undecided,New] | 16:57 |
| aloga | so, the question is, would a solution to bug 1854041 make sense to you? | 16:58 |
| openstack | bug 1854041 in OpenStack Identity (keystone) "Keystone should propagate redirect exceptions from auth plugins" [Undecided,New] https://launchpad.net/bugs/1854041 | 16:58 |
| aloga | i.e. allow plugins either to raise redirect exceptions or raise any HTTP exception and propagate it to the user? | 16:59 |
| aloga | (the piece of code in Flask Keystone that manages the Keystone exceptions and converts them to JSON is https://github.com/openstack/keystone/blob/master/keystone/server/flask/application.py#L77) | 17:02 |
| *** ivve has joined #openstack-keystone | 17:06 | |
| knikolla | aloga: would you like to add that topic to next week's meeting? https://etherpad.openstack.org/p/keystone-weekly-meeting | 17:08 |
| knikolla | i don't think many people are around these days due to US holidays. | 17:08 |
| aloga | knikolla: thanks | 17:11 |
| aloga | knikolla: what time are the meetings though? | 17:11 |
| knikolla | aloga: http://eavesdrop.openstack.org/#Keystone_Team_Meeting | 17:12 |
| knikolla | you can grab a .ics here | 17:12 |
| knikolla | Weekly on Tuesday at 1600 UTC in #openstack-meeting-alt | 17:12 |
| aloga | knikolla: yes, I got it, many thanks | 17:13 |
| knikolla | awesome :) | 17:13 |
| aloga | knikolla: I see that there is also a related documentation change | 17:13 |
| aloga | (related to OIDC) | 17:13 |
| knikolla | aloga: yeah, we were missing documentation authenticating using oauth 2.0 bearer tokens rather than the usual oidc flow. | 17:17 |
| aloga | knikolla: yes, however, there are still 2 outstanding problems with the current setup | 17:17 |
| aloga | knikolla: you require all CLI to get registered as an OpenID Connect client | 17:18 |
| aloga | s/you/the setup/ I mean :-9 | 17:18 |
| knikolla | not necessarily. you can have a public client and have all CLI use that. | 17:18 |
| knikolla | as in not confidential. | 17:19 |
| aloga | well, yes, that may be the case | 17:19 |
| aloga | but anyway, the other problems still exist | 17:21 |
| aloga | since it is using Oauth2 bearer tokens you may miss any additional claims the the userinfo endpoint returns | 17:21 |
| aloga | unless: you use the introspection endpoint to validate the token (the provider has to support it) and the provider returns those additional claims in the introspection response (also the provider has to support it) | 17:22 |
| aloga | therefore you cannot do any mappings on those additional claims | 17:22 |
| *** jamesmcarthur has quit IRC | 17:22 | |
| aloga | and the other outstanding problem is that it is impossible to use two different identity providers | 17:23 |
| aloga | it is possible to configure two different providers using *only* openid | 17:23 |
| aloga | but when mixing openid and oauth it is not, as the plugin does not allow to define per-location OIDCOAuth* options | 17:24 |
| aloga | and mixing it is required for CLI and WEB access | 17:24 |
| knikolla | in general, single sign-on and CLI don't mix well together and you have to compromise something, somewhere. | 17:25 |
| knikolla | This is partially a limitation of the standards, and partially a matrix of idps only supporting a subset of the features available. | 17:26 |
| aloga | yes, but I do see a large limitation not being able to use several OPs | 17:26 |
| aloga | maybe this is not the case for a commercial provider that would use their very own idp, but for instance in science and distributed computing it is a limiting issue | 17:27 |
| knikolla | I understand that, my compromise was to run an idp broker | 17:27 |
| aloga | where users can come from different trusted sources | 17:27 |
| knikolla | so: multiple idps -> single idp -> openstack / kubernetes / etc | 17:27 |
| *** spatel has quit IRC | 17:28 | |
| aloga | knikolla: yes, and in some cases this is what it is being done | 17:30 |
| aloga | but the dynamics of research projects, funding agencies, idps, identity providers and so on are difficult sometimes | 17:30 |
| *** gshippey has joined #openstack-keystone | 17:30 | |
| aloga | and not always it is possible to use an idp proxy for that | 17:30 |
| knikolla | that they are | 17:30 |
| knikolla | are you able to use application credentials for your users cli access? | 17:31 |
| knikolla | That should make the experience more tolerable. | 17:31 |
| aloga | no, application credentials are not always usable | 17:31 |
| *** jaosorior has quit IRC | 17:32 | |
| knikolla | i would be amazed if something was *always* usable across multiple identity providers | 17:33 |
| knikolla | try to think up of something that would make your life easier, and we can discuss that next tuesday during the meeting | 17:33 |
| aloga | knikolla: well... | 17:34 |
| aloga | knikolla: I do not have any decision power here | 17:35 |
| aloga | knikolla: the scientific cloud in europe has adopted OpenID Connect as the solution | 17:35 |
| aloga | knikolla: the most used middleware is OpenStack | 17:35 |
| knikolla | That's much much better than the scientific cloud here going with SAML and no SAML ECP. | 17:36 |
| aloga | knikolla: but the outstanding problem that lots of sites are seeing is that they cannot configure two idps | 17:36 |
| knikolla | here in the US* | 17:36 |
| aloga | knikolla: basically because the oidc mod for apache does not support it | 17:37 |
| aloga | knikolla: *and* that configuration has to be managed in Apache, not keystone | 17:37 |
| aloga | knikolla: some sites do not see as an acceptable solution to deploy a proxy | 17:38 |
| aloga | anyway, we are anticipating discussion here :-) | 17:39 |
| aloga | and I have to leave | 17:39 |
| aloga | thanks for the feedback | 17:39 |
| knikolla | np :) | 17:40 |
| cmurphy | knikolla: we forgot to talk about it during the ptg but want to propose http://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/support-federated-attr.html and http://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/expiring-group-memberships.html to the ussuri directory? | 17:47 |
| *** openstackgerrit has quit IRC | 17:49 | |
| *** ab-a has joined #openstack-keystone | 17:53 | |
| *** jaosorior has joined #openstack-keystone | 18:26 | |
| *** amoralej is now known as amoralej|off | 18:48 | |
| *** jamesmcarthur has joined #openstack-keystone | 19:36 | |
| *** cmart has quit IRC | 19:44 | |
| *** cmart has joined #openstack-keystone | 20:13 | |
| bnemec | Heh, response to the policy popup team has almost been _too_ good. I'm not sure we want to have a bunch of projects all trying to figure out the best practices in parallel. | 20:24 |
| bnemec | But I guess we don't want to discourage people if they're willing to do the work now. | 20:24 |
| bnemec | #NiceProblemToHave | 20:24 |
| * bnemec sits in the timeout corner for using a hashtag on IRC | 20:24 | |
| cmurphy | i was thinking the same...i definitely don't want to discourage people from jumping on the policy bandwagon but maybe the disband criteria should still be limited to a few projects? | 20:30 |
| bnemec | Maybe just drop the migration complete bullet entirely? As I understand it the main output from the popup team should be the documentation of best practices. Migrating all the things is a job for the community goal. | 20:41 |
| bnemec | Although finishing at least one of the migrations might be necessary to have a complete picture of how it will work. | 20:42 |
| *** vishakha has quit IRC | 20:45 | |
| cmurphy | i think having at least a couple projects completely finished is important | 20:45 |
| cmurphy | the issues nova will face are going to be different from what neutron faces are going to be different from what cinder faces etc | 20:45 |
| bnemec | True, and we may not know which subset need to be completed yet. | 20:50 |
| bnemec | It's probably not worth agonizing about. If we get to the point where we feel like the popup team has served its purpose and all of the listed projects aren't migrated yet we can worry about it then. | 20:52 |
| cmurphy | ++ | 21:20 |
| *** threestrands has joined #openstack-keystone | 21:27 | |
| *** raildo has quit IRC | 21:28 | |
| *** d34dh0r53 has quit IRC | 21:39 | |
| *** d34dh0r53 has joined #openstack-keystone | 21:39 | |
| *** jaosorior has quit IRC | 21:59 | |
| *** rcernin has joined #openstack-keystone | 22:04 | |
| *** pcaruana has quit IRC | 22:16 | |
| *** tkajinam has joined #openstack-keystone | 23:08 | |
| *** gshippey has quit IRC | 23:30 | |
| *** cmart has quit IRC | 23:33 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!