| *** spatel has joined #openstack-keystone | 00:16 | |
| *** dave-mccowan has joined #openstack-keystone | 02:55 | |
| *** dave-mccowan has quit IRC | 03:00 | |
| *** markvoelker has quit IRC | 03:43 | |
| *** markvoelker has joined #openstack-keystone | 03:44 | |
| *** markvoelker has quit IRC | 03:48 | |
| *** markvoelker has joined #openstack-keystone | 04:13 | |
| *** markvoelker has quit IRC | 04:18 | |
| *** evrardjp has quit IRC | 04:33 | |
| *** evrardjp has joined #openstack-keystone | 04:33 | |
| *** vishakha has joined #openstack-keystone | 04:58 | |
| *** abdysn has joined #openstack-keystone | 05:11 | |
| *** rcernin has quit IRC | 05:14 | |
| *** rcernin has joined #openstack-keystone | 05:39 | |
| *** rcernin has quit IRC | 05:47 | |
| *** rcernin has joined #openstack-keystone | 05:48 | |
| *** markvoelker has joined #openstack-keystone | 05:58 | |
| *** markvoelker has quit IRC | 06:03 | |
| *** spatel has quit IRC | 06:20 | |
| *** xek has joined #openstack-keystone | 07:17 | |
| *** bengates has joined #openstack-keystone | 07:18 | |
| *** bengates has quit IRC | 07:21 | |
| *** bengates has joined #openstack-keystone | 07:22 | |
| *** hoonetorg has joined #openstack-keystone | 07:52 | |
| *** rcernin has quit IRC | 07:57 | |
| *** markvoelker has joined #openstack-keystone | 07:59 | |
| *** markvoelker has quit IRC | 08:04 | |
| *** xek has quit IRC | 08:14 | |
| *** bengates_ has joined #openstack-keystone | 08:17 | |
| *** bengates has quit IRC | 08:21 | |
| *** shyamb has joined #openstack-keystone | 09:37 | |
| *** markvoelker has joined #openstack-keystone | 10:00 | |
| *** xek has joined #openstack-keystone | 10:02 | |
| *** markvoelker has quit IRC | 10:05 | |
| *** xek has quit IRC | 10:10 | |
| *** shyamb has quit IRC | 10:10 | |
| *** also_stingrayza has joined #openstack-keystone | 10:22 | |
| *** stingrayza has quit IRC | 10:25 | |
| *** rcernin has joined #openstack-keystone | 10:33 | |
| *** tkajinam has quit IRC | 10:37 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Change the default Identity endpoint to internal https://review.opendev.org/662734 | 10:43 |
|---|---|---|
| *** shyamb has joined #openstack-keystone | 10:49 | |
| *** rcernin has quit IRC | 11:04 | |
| *** shyamb has quit IRC | 11:06 | |
| *** shyamb has joined #openstack-keystone | 11:20 | |
| *** dave-mccowan has joined #openstack-keystone | 11:30 | |
| *** Luzi has joined #openstack-keystone | 11:31 | |
| *** raildo has joined #openstack-keystone | 11:38 | |
| *** shyam89 has joined #openstack-keystone | 11:54 | |
| *** shyamb has quit IRC | 11:56 | |
| *** markvoelker has joined #openstack-keystone | 11:57 | |
| *** xek has joined #openstack-keystone | 12:13 | |
| *** xek has quit IRC | 12:18 | |
| *** shyam89 has quit IRC | 12:19 | |
| *** hemna_ has quit IRC | 12:41 | |
| *** lbragstad has joined #openstack-keystone | 12:47 | |
| *** hemna has joined #openstack-keystone | 12:54 | |
| *** markvoelker has quit IRC | 13:04 | |
| *** xek has joined #openstack-keystone | 13:30 | |
| *** Luzi has quit IRC | 13:31 | |
| *** redrobot has joined #openstack-keystone | 13:33 | |
| *** abdysn has quit IRC | 14:05 | |
| vishakha | lbragstad: o/. I wanted to discuss regarding #link https://bugs.launchpad.net/keystone/+bug/1886017 | 14:27 |
| openstack | Launchpad bug 1886017 in OpenStack Identity (keystone) ""allow expired" feature is broken against json web token" [Medium,Confirmed] - Assigned to Vishakha Agarwal (vishakha.agarwal) | 14:27 |
| lbragstad | vishakha sure - what's up? | 14:31 |
| vishakha | lbragstad: As described in the bug in json web token we are not able to view fetch the expired token info. I happened to see that first, it tries to validate the token [1] https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L145 . Inside validation while doing decoding of the token [2] | 14:49 |
| vishakha | https://github.com/openstack/keystone/blob/3eb8cafb8d19b7f9ff9bb99e82b84a4a0722d5f4/keystone/token/providers/jws/core.py#L180 , it raises expired signature [3] https://github.com/jpadilla/pyjwt/blob/617831697f87207533cca2d85f9924855a875a6e/jwt/api_jwt.py#L196 because the signature is expired. | 14:49 |
| vishakha | In fernet token, it works fine because it gets successfully validated. And after validation, it increases the expiration time [4] https://github.com/openstack/keystone/blob/3eb8cafb8d19b7f9ff9bb99e82b84a4a0722d5f4/keystone/token/provider.py#L191 after validation [5]https://github.com/openstack/keystone/blob/3eb8cafb8d19b7f9ff9bb99e82b84a4a0722d5f4/keystone/token/provider.py#L146 | 14:49 |
| vishakha | Without token decode how can I fetch "expires_at" of token. And do something on it. | 14:55 |
| vishakha | ? | 14:56 |
| *** kplant_ has joined #openstack-keystone | 14:58 | |
| *** kplant has quit IRC | 14:58 | |
| lbragstad | vishakha i think the fernet works because we're not letting the cryptography library validate token expiration | 14:58 |
| vishakha | lbragstad: Yes Fernet are not checking the expiration. | 14:59 |
| *** kplant_ has quit IRC | 14:59 | |
| lbragstad | vishakha one thing we might be able to do would be to break the ExpiredSignatureError exception into its own case | 14:59 |
| lbragstad | and handle it differently | 15:00 |
| vishakha | But If JWT library will raise this exception, It wont be decoded. We will not be able to change its expires_at. I am still not sure how we can handle it differently? | 15:04 |
| lbragstad | i'm checking the pyjwt code quick | 15:09 |
| lbragstad | vishakha what if you try something like this? | 15:17 |
| lbragstad | http://paste.openstack.org/show/795577/ | 15:17 |
| lbragstad | vishakha that should short-circuit the _validate_exp() method | 15:18 |
| lbragstad | and give you back the payload | 15:18 |
| lbragstad | for an expired JWT | 15:18 |
| vishakha | lbragstad: True, Will work for this case. Thanks | 15:20 |
| lbragstad | vishakha yep - we'll just need to add some tests for it since it doesn't sound like we have any currently? | 15:21 |
| vishakha | I think we wont have any test cases related to this. | 15:22 |
| vishakha | *dont | 15:22 |
| lbragstad | ok - sounds good | 15:25 |
| *** bengates_ has quit IRC | 16:06 | |
| mnaser | is there an 'expected' issue with ussuri about TypeError's during auth? | 16:50 |
| mnaser | http://paste.openstack.org/show/795581/ | 16:50 |
| mnaser | i'm running into this in a few keystone ussuri envs | 16:50 |
| mnaser | https://github.com/openstack/keystone/blob/master/keystone/models/token_model.py#L421-L423 | 16:51 |
| mnaser | so i'm assuming get_role is returning a string for some reason, not a dict | 16:52 |
| mnaser | (sql backend) | 16:52 |
| mnaser | http://paste.openstack.org/show/795582/ | 16:53 |
| mnaser | i also have this other one too | 16:53 |
| mnaser | which sounds like check_revocation_v3 is called with token = None | 16:54 |
| mnaser | hmm, _validate_token has `MEMOIZE_TOKENS` decorator | 16:56 |
| mnaser | and this env did have a memcache blip at some point | 16:56 |
| mordred | mnaser: I mean - the sqlbackend has return self._get_role(session, role_id).to_dict() | 16:58 |
| mordred | so I'd expect that to always return a dict - but yeah, if memoize is intercepting | 16:59 |
| mnaser | mordred: i gues i'm looking at the 2nd traceback code down here https://github.com/openstack/keystone/blob/3eb8cafb8d19b7f9ff9bb99e82b84a4a0722d5f4/keystone/token/provider.py#L154 | 16:59 |
| mnaser | so maybe for some reason memoize is returning 'None' | 16:59 |
| mnaser | last time this happened, rolling out / restarting the memcache stopped the issue for a bit till it surfaced again (probably when memcache has some sorts of connectivity issue) | 17:00 |
| mordred | mnaser: yeah - looking at MEMOIZE_TOKENS this might be a place where oslo.cache needs to be improvied | 17:01 |
| *** vishakha has quit IRC | 18:15 | |
| *** gregwork has quit IRC | 18:49 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Write a symptom for checking memcache connections https://review.opendev.org/737579 | 19:09 |
| *** xek has quit IRC | 19:23 | |
| *** xek has joined #openstack-keystone | 19:24 | |
| openstackgerrit | Merged openstack/keystone master: Adding note for create a project without domain info https://review.opendev.org/719656 | 20:50 |
| *** xek has quit IRC | 21:21 | |
| *** raildo has quit IRC | 21:21 | |
| *** markvoelker has joined #openstack-keystone | 22:07 | |
| *** markvoelker has quit IRC | 22:12 | |
| *** tkajinam has joined #openstack-keystone | 22:42 | |
| *** rcernin has joined #openstack-keystone | 23:01 | |
| *** rcernin has quit IRC | 23:07 | |
| *** rcernin has joined #openstack-keystone | 23:10 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!