| *** jamesmcarthur has joined #openstack-keystone | 00:45 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone-tempest-plugin master: WIP/PoC:Add RBAC tests https://review.opendev.org/686305 | 00:50 |
|---|---|---|
| *** jamesmcarthur has quit IRC | 01:00 | |
| *** rcernin has joined #openstack-keystone | 01:06 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:10 | |
| *** jamesmcarthur has quit IRC | 01:22 | |
| *** vesper has joined #openstack-keystone | 01:38 | |
| *** vesper11 has quit IRC | 01:39 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:45 | |
| *** gyee has quit IRC | 02:00 | |
| *** vishalmanchanda has joined #openstack-keystone | 02:10 | |
| *** jamesmcarthur has quit IRC | 02:22 | |
| *** rcernin has quit IRC | 03:31 | |
| *** gagehugo has quit IRC | 03:45 | |
| *** gagehugo has joined #openstack-keystone | 03:59 | |
| *** adriant has quit IRC | 04:45 | |
| *** adriant has joined #openstack-keystone | 04:50 | |
| *** bnemec has joined #openstack-keystone | 04:53 | |
| *** rcernin has joined #openstack-keystone | 04:57 | |
| *** rcernin has quit IRC | 04:58 | |
| *** rcernin has joined #openstack-keystone | 04:58 | |
| *** evrardjp has quit IRC | 05:33 | |
| *** evrardjp has joined #openstack-keystone | 05:34 | |
| *** rcernin has quit IRC | 06:03 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone-tempest-plugin master: Drop py3.5 from tempest plugins https://review.opendev.org/705887 | 06:04 |
| *** redrobot has quit IRC | 06:04 | |
| *** abdysn has joined #openstack-keystone | 06:06 | |
| *** redrobot has joined #openstack-keystone | 06:06 | |
| *** jaosorior has joined #openstack-keystone | 07:38 | |
| *** jaosorior has quit IRC | 07:53 | |
| *** jaosorior has joined #openstack-keystone | 08:06 | |
| *** tkajinam has quit IRC | 08:12 | |
| *** dancn has joined #openstack-keystone | 08:16 | |
| *** tesseract has joined #openstack-keystone | 08:16 | |
| *** rcernin has joined #openstack-keystone | 08:31 | |
| *** gshippey has joined #openstack-keystone | 08:45 | |
| *** rcernin has quit IRC | 08:48 | |
| *** rcernin has joined #openstack-keystone | 08:53 | |
| *** xek has joined #openstack-keystone | 08:54 | |
| *** rcernin has quit IRC | 09:07 | |
| *** rcernin has joined #openstack-keystone | 09:16 | |
| *** rcernin has quit IRC | 09:20 | |
| *** rcernin has joined #openstack-keystone | 09:26 | |
| *** rcernin has quit IRC | 09:33 | |
| *** shyamb has joined #openstack-keystone | 10:06 | |
| *** shyamb has quit IRC | 10:38 | |
| *** shyamb has joined #openstack-keystone | 11:15 | |
| *** wxy-xiyuan has quit IRC | 11:36 | |
| *** pcaruana has quit IRC | 11:37 | |
| *** pcaruana has joined #openstack-keystone | 11:50 | |
| *** shyamb has quit IRC | 12:13 | |
| *** raildo has joined #openstack-keystone | 12:43 | |
| *** shyamb has joined #openstack-keystone | 12:54 | |
| *** shyamb has quit IRC | 13:18 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:20 | |
| openstackgerrit | Hervé Beraud proposed openstack/oslo.limit master: [ussuri][goal] Drop python 2.7 support and testing https://review.opendev.org/705712 | 13:24 |
| *** abdysn has quit IRC | 13:29 | |
| *** jamesmcarthur has quit IRC | 13:37 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:47 | |
| *** pcaruana has quit IRC | 14:17 | |
| *** jmlowe has joined #openstack-keystone | 15:13 | |
| *** jmlowe has quit IRC | 15:17 | |
| *** jmlowe has joined #openstack-keystone | 15:17 | |
| *** awestin1 has quit IRC | 15:19 | |
| *** awestin1 has joined #openstack-keystone | 15:20 | |
| *** pcaruana has joined #openstack-keystone | 15:49 | |
| cmurphy | lbragstad: stable review if you have a sec https://review.opendev.org/705862 it happens to fix the broken federation jobs by adding the xmlsec1 package | 15:52 |
| lbragstad | cmurphy nice - thanks | 15:53 |
| *** dancn has quit IRC | 16:04 | |
| *** openstackstatus has joined #openstack-keystone | 16:05 | |
| *** ChanServ sets mode: +v openstackstatus | 16:05 | |
| *** jmlowe has quit IRC | 16:08 | |
| *** njohnston has joined #openstack-keystone | 16:09 | |
| njohnston | cmurphy: Hi! I was wondering if you could take another look at https://review.opendev.org/#/c/508659/ whenever it is convenient for you. | 16:09 |
| *** kklimonda has quit IRC | 16:22 | |
| *** kklimonda has joined #openstack-keystone | 16:22 | |
| *** jamesmcarthur has quit IRC | 16:24 | |
| cmurphy | njohnston: will do | 16:29 |
| *** jamesmcarthur has joined #openstack-keystone | 16:38 | |
| *** jamesmcarthur_ has joined #openstack-keystone | 16:41 | |
| *** jamesmcarthur has quit IRC | 16:44 | |
| njohnston | thanks cmurphy! | 16:46 |
| *** jmlowe has joined #openstack-keystone | 16:47 | |
| *** jamesmcarthur_ has quit IRC | 16:55 | |
| *** jamesmcarthur has joined #openstack-keystone | 16:58 | |
| *** jamesmcarthur has quit IRC | 17:05 | |
| *** jamesmcarthur has joined #openstack-keystone | 17:27 | |
| *** gyee has joined #openstack-keystone | 17:29 | |
| raildo | cmurphy, hey, how you doing? I just added a topic in the next team meeting: https://etherpad.openstack.org/p/keystone-weekly-meeting we were discussing the possibility to avoid anyone who isn't using a domain-scoped token to create a project and doesn't supply domain_id in the project reference, to automatically place that project in the default domain | 17:30 |
| raildo | cmurphy, I believe that we should raise an exception on this last scenario, but we can discuss more about it during the meeting :) | 17:31 |
| *** evrardjp has quit IRC | 17:33 | |
| *** evrardjp has joined #openstack-keystone | 17:34 | |
| cmurphy | raildo: okay thanks for the headsup | 17:42 |
| *** jaosorior has quit IRC | 17:49 | |
| *** jmlowe has quit IRC | 17:54 | |
| *** jamesmcarthur has quit IRC | 17:56 | |
| *** TheJulia has quit IRC | 18:01 | |
| *** TheJulia has joined #openstack-keystone | 18:01 | |
| *** johnsom has quit IRC | 18:03 | |
| *** johnsom has joined #openstack-keystone | 18:03 | |
| *** jamesmcarthur has joined #openstack-keystone | 18:03 | |
| *** tesseract has quit IRC | 18:11 | |
| *** kmalloc has quit IRC | 18:27 | |
| *** kmalloc has joined #openstack-keystone | 18:27 | |
| *** masayukig has quit IRC | 18:34 | |
| *** masayukig has joined #openstack-keystone | 18:34 | |
| *** jamesmcarthur has quit IRC | 18:54 | |
| *** jamespage has quit IRC | 18:56 | |
| *** jamespage has joined #openstack-keystone | 18:56 | |
| *** gshippey has quit IRC | 19:01 | |
| *** jamesmcarthur has joined #openstack-keystone | 19:15 | |
| lbragstad | cmurphy do we have a documented example of using application credentials from clouds.yaml? | 19:36 |
| lbragstad | i feel like i've asked this before, but i can't find it | 19:36 |
| cmurphy | lbragstad: i don't think we do | 19:36 |
| *** masayukig has quit IRC | 19:38 | |
| *** kmalloc has quit IRC | 19:39 | |
| *** awestin1 has quit IRC | 19:39 | |
| *** jamespage has quit IRC | 19:39 | |
| *** TheJulia has quit IRC | 19:39 | |
| *** spatel has joined #openstack-keystone | 19:40 | |
| *** johnsom has quit IRC | 19:40 | |
| *** kklimonda has quit IRC | 19:40 | |
| *** xek_ has joined #openstack-keystone | 19:48 | |
| *** xek has quit IRC | 19:51 | |
| *** jmlowe has joined #openstack-keystone | 20:00 | |
| *** jmlowe has quit IRC | 20:01 | |
| *** spatel has quit IRC | 20:09 | |
| *** jmlowe has joined #openstack-keystone | 20:15 | |
| *** jamesmcarthur has quit IRC | 20:21 | |
| *** raildo has quit IRC | 20:30 | |
| *** raildo has joined #openstack-keystone | 20:33 | |
| *** cmart has joined #openstack-keystone | 20:34 | |
| *** cmart has quit IRC | 20:35 | |
| *** jmlowe has quit IRC | 21:08 | |
| *** jmlowe has joined #openstack-keystone | 21:10 | |
| *** jmlowe has quit IRC | 21:22 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add domain admin grant test cases https://review.opendev.org/706120 | 21:25 |
| lbragstad | cmurphy that should be possible right ^ ? | 21:25 |
| *** xek_ has quit IRC | 21:27 | |
| lbragstad | because if it is, we might want to consider changing the policy for list_roles? | 21:32 |
| lbragstad | https://opendev.org/openstack/keystone/src/branch/master/keystone/common/policies/role.py#L81-L92 | 21:34 |
| lbragstad | python-openstackclient seems to fail when domain admins do `openstack role add` commands regardless of using the role ID or the role name, because it attempts to list the roles | 21:35 |
| cmurphy | could've sworn we had a test for that | 21:39 |
| cmurphy | but makes sense that osc would behave that way, i think it does something similar for trusts that's very unfriendly | 21:39 |
| cmurphy | relatedly i was surprised that credentials don't work for domain users https://review.opendev.org/#/c/686305/18/keystone_tempest_plugin/tests/rbac/v3/test_credentials.py@353 | 21:41 |
| lbragstad | yeah - i mean we allow domain users to add roles to things within their authorization, which is good... but we just don't let them discover the roles | 21:43 |
| lbragstad | so - they'd have to do it manually with curl | 21:43 |
| lbragstad | iff they know the role id | 21:43 |
| cmurphy | yuck | 21:45 |
| lbragstad | mhm | 21:46 |
| lbragstad | should we let domain admins list all roles? | 21:56 |
| lbragstad | i mean - we'd be letting them see all roles in the deployment | 21:57 |
| cmurphy | i don't think domain admins should get special system-level powers just for being domain admins, i think the better question is should roles just be public information to anyone authenticated | 21:58 |
| cmurphy | to which - i'm not sure | 21:58 |
| lbragstad | i mean - i saw a lot of power in letting domain admins manage role assignments for entities within their domain | 21:59 |
| lbragstad | but - if don't let them discover roles, then it shoots the usability of that out of the air | 22:00 |
| lbragstad | i'm torn | 22:00 |
| cmurphy | yeah | 22:00 |
| cmurphy | hmm i was gonna say operators could override it if they want to but they can't override scope_types | 22:01 |
| lbragstad | right | 22:04 |
| lbragstad | i mean, operators could have global roles around for other domains (circumventing domain-specific roles) | 22:05 |
| lbragstad | if we open that up for domain-admins, some might consider that a violation of tenancy | 22:05 |
| cmurphy | right, imo it is | 22:07 |
| lbragstad | i'm inclined to agree | 22:07 |
| lbragstad | so - do we keep the grant API open to domain users too? | 22:07 |
| lbragstad | or do we leave it as is? | 22:07 |
| cmurphy | well i think it's too late to change it | 22:09 |
| lbragstad | i mean - if a system operator trusts a domain admin | 22:10 |
| lbragstad | they could be like "here's the ID of the reader, member, and admin roles... dole them out to people within your jurisdiction as you see fit" | 22:11 |
| cmurphy | if we're only talking about the default roles then technically the domain admin could discover that themself by examining their own token, they would have all three ids in there | 22:12 |
| lbragstad | oh - yeah, great point | 22:12 |
| lbragstad | it's kinda like having to crawl under your car to start it, but whatever | 22:12 |
| cmurphy | and if we're talking about other roles and the system admin wants to grant domain admins rights on a case by case basis then they could do some legwork of mirroring certain roles into the domain | 22:13 |
| lbragstad | sure | 22:13 |
| lbragstad | and we have protection testing to make sure domain users can't do anything outside their domain | 22:13 |
| lbragstad | so it's still kinda self-service... | 22:14 |
| cmurphy | yeah | 22:14 |
| lbragstad | ok - so TL;DR, leave it be | 22:15 |
| cmurphy | that'd be my vote | 22:16 |
| lbragstad | ok | 22:16 |
| lbragstad | sweet - thanks for the help cmurphy | 22:16 |
| cmurphy | o7 | 22:16 |
| cmurphy | lbragstad: while i have you here, some more stable backports: https://review.opendev.org/706087 https://review.opendev.org/706088 - second depends on the first | 22:20 |
| lbragstad | cmurphy cool - both look good to me | 22:25 |
| *** raildo has quit IRC | 22:37 | |
| *** tkajinam has joined #openstack-keystone | 22:48 | |
| *** kklimonda has joined #openstack-keystone | 22:59 | |
| *** TheJulia has joined #openstack-keystone | 23:00 | |
| *** masayukig has joined #openstack-keystone | 23:00 | |
| *** jamespage has joined #openstack-keystone | 23:01 | |
| *** awestin1 has joined #openstack-keystone | 23:02 | |
| *** kmalloc has joined #openstack-keystone | 23:02 | |
| *** johnsom has joined #openstack-keystone | 23:02 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:03 | |
| *** jamesmcarthur has quit IRC | 23:06 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!