| *** spatel has joined #openstack-keystone | 00:50 | |
| adriant | nsmeds, one option is using Adjutant to handle some of those things through it without exposing the 'admin' role. At least for requesting new projects, and managing/inviting users to your projects without needing 'admin'. I have been hoping to add some support for managing projects/subprojects but I likely won't get to that until maybe next cycle. | 01:13 |
|---|---|---|
| *** gyee has quit IRC | 01:49 | |
| nsmeds | okay, thanks @adriant I'll look into it | 02:25 |
| adriant | nsmeds, you can probably solve a lot of your case with policy.json, but there are a lot of fine grained edge cases that don't really work too well. Adjutant was built to be able to act as a service where you can build admin-like apis which wrap around admin functionality in keystone and expose it in a more user friendly less powerful way that is | 02:28 |
| adriant | more aligned with the business logic you might have in mind | 02:28 |
| nsmeds | oh - I've never even heard about this project, it looks really promising | 02:28 |
| adriant | I am the PTL and primary author of the service, so take my words with a grain of salt, as I'm biased :P | 02:28 |
| nsmeds | openstack-ansible even has a role for it, I'm in luck :) | 02:29 |
| nsmeds | okay - I'll stick around this channel and try not to pester you too much with questions ^^ | 02:29 |
| adriant | nsmeds, feel free to pop into #openstack-adjutant as well, and you can bug me there as well, but keystone peeps are definitely the ones to bug abouy keystone policy suggestions | 02:30 |
| adriant | oklhost is the one who wrote the ansible module, and he also hangs out in #openstack-adjutant :) | 02:30 |
| *** mordred has quit IRC | 03:29 | |
| *** carthaca has quit IRC | 03:31 | |
| *** mordred has joined #openstack-keystone | 03:33 | |
| *** dave-mccowan has quit IRC | 03:47 | |
| *** evrardjp has quit IRC | 04:33 | |
| *** evrardjp has joined #openstack-keystone | 04:33 | |
| *** vishalmanchanda has joined #openstack-keystone | 04:47 | |
| *** spatel has quit IRC | 05:08 | |
| *** abdysn has joined #openstack-keystone | 05:11 | |
| openstackgerrit | Jorhson Deng proposed openstack/keystonemiddleware master: support sasl for memcached https://review.opendev.org/743703 | 05:44 |
| openstackgerrit | Jorhson Deng proposed openstack/keystonemiddleware master: support sasl for memcached https://review.opendev.org/743703 | 05:45 |
| *** carthaca has joined #openstack-keystone | 06:18 | |
| *** bengates has joined #openstack-keystone | 07:02 | |
| *** rcernin has quit IRC | 07:02 | |
| *** rcernin has joined #openstack-keystone | 07:03 | |
| *** bengates_ has joined #openstack-keystone | 07:13 | |
| *** bengates has quit IRC | 07:14 | |
| *** bengates has joined #openstack-keystone | 07:15 | |
| *** bengates_ has quit IRC | 07:19 | |
| *** bengates_ has joined #openstack-keystone | 07:19 | |
| *** bengates has quit IRC | 07:22 | |
| *** xek has joined #openstack-keystone | 07:51 | |
| *** mordred has quit IRC | 08:12 | |
| *** mordred has joined #openstack-keystone | 08:18 | |
| *** rcernin has quit IRC | 08:34 | |
| *** Luzi has joined #openstack-keystone | 09:53 | |
| *** tkajinam has quit IRC | 09:58 | |
| *** shyamb has joined #openstack-keystone | 11:09 | |
| *** raildo has joined #openstack-keystone | 11:48 | |
| *** dave-mccowan has joined #openstack-keystone | 12:02 | |
| *** zzzeek has quit IRC | 12:19 | |
| *** zzzeek has joined #openstack-keystone | 12:23 | |
| *** shyam89 has joined #openstack-keystone | 12:27 | |
| *** shyamb has quit IRC | 12:30 | |
| *** shyam89 has quit IRC | 12:42 | |
| *** Luzi has quit IRC | 13:34 | |
| *** vishakha has joined #openstack-keystone | 13:43 | |
| *** tkajinam has joined #openstack-keystone | 13:50 | |
| *** abdysn has quit IRC | 14:04 | |
| *** bengates_ has quit IRC | 14:10 | |
| *** bengates has joined #openstack-keystone | 14:11 | |
| nsmeds | Does anyone know why the `etc/policy.v3cloudsample.json` example file was removed after the Stein release? | 14:36 |
| knikolla | nsmeds: the policy defaults are now in code. you can generate a sample file using oslopolicy-policy-generator https://docs.openstack.org/oslo.policy/latest/cli/oslopolicy-policy-generator.html | 14:48 |
| nsmeds | ok, I'll read into that - thanks @knikolla | 14:49 |
| *** vishalmanchanda has quit IRC | 15:06 | |
| *** gyee has joined #openstack-keystone | 15:16 | |
| nsmeds | and just to confirm: is there really no example policy for setting up a domain-level admin? It feels like this would be a fairly normal use-case, and it surprises me that we'll need to craft a new role from scratch for doing so | 15:23 |
| nsmeds | or am I misunderstanding? | 15:24 |
| knikolla | nsmeds: the default policy, when enforce_scope is enabled is exactly that. | 15:32 |
| knikolla | however not all openstack services do support the different types of scope yet. | 15:32 |
| knikolla | hence it is disabled by default. | 15:32 |
| lbragstad | nsmeds if you're using train or later, keystone supports domain admin use cases when you set `keystone.conf [oslo_policy] enforce_scope = True` | 15:37 |
| lbragstad | we removed the policy.v3cloudsample.json file because the overrides it supplied were duplicates of the behavior we were using in code | 15:37 |
| nsmeds | Bless you both - that's exactly what I was hoping to hear | 15:39 |
| nsmeds | I'll look into that setting | 15:39 |
| lbragstad | nsmeds https://docs.openstack.org/keystone/latest/contributor/services.html#authorization-scopes is pretty dense and it's written for other developers (not operators specifically) | 15:40 |
| lbragstad | but it does describe the overall idea | 15:40 |
| lbragstad | and why it's important | 15:40 |
| nsmeds | ok - I'll take the time to read through it :) thank you! | 15:41 |
| nsmeds | we're using Train thankfully | 15:42 |
| lbragstad | ok - you might not be able to apply it to the entire deployment, but you can at least use it in keystone to get an idea of how things work | 15:43 |
| *** bengates has quit IRC | 16:08 | |
| *** bengates has joined #openstack-keystone | 16:08 | |
| *** bengates has quit IRC | 16:14 | |
| knikolla | reminder for the meeting in ~18 minutes in #openstack-meeting-alt | 16:42 |
| openstackgerrit | Hervé Beraud proposed openstack/oslo.policy master: Add unit tests on cache handler https://review.opendev.org/671113 | 16:48 |
| openstackgerrit | Hervé Beraud proposed openstack/oslo.policy master: Add unit tests on cache handler https://review.opendev.org/671113 | 17:08 |
| openstackgerrit | Hervé Beraud proposed openstack/oslo.policy master: Correctly handle IO errors at policy file load https://review.opendev.org/670571 | 17:08 |
| openstackgerrit | Hervé Beraud proposed openstack/oslo.policy master: Adding tests on cache handler https://review.opendev.org/671309 | 17:08 |
| *** dustinc has joined #openstack-keystone | 19:39 | |
| nsmeds | @lbragstad thanks for that previous link - as an operator, it definitely provides helpful insight into authorization scopes and the current state of OpenStack+IAM. It's well written. | 19:40 |
| lbragstad | nsmeds good deal - glad you found it useful | 19:45 |
| *** vishakha has quit IRC | 19:52 | |
| *** raildo has quit IRC | 21:14 | |
| *** rcernin has joined #openstack-keystone | 21:18 | |
| *** xek has quit IRC | 21:26 | |
| *** rcernin has quit IRC | 21:35 | |
| *** rcernin has joined #openstack-keystone | 21:52 | |
| *** rcernin has quit IRC | 21:57 | |
| *** rcernin has joined #openstack-keystone | 22:09 | |
| *** rcernin has quit IRC | 22:09 | |
| *** rcernin has joined #openstack-keystone | 22:33 | |
| *** lxkong has quit IRC | 22:42 | |
| *** pas-ha has quit IRC | 22:42 | |
| *** sri_ has quit IRC | 22:42 | |
| *** dviroel has quit IRC | 22:43 | |
| *** csatari has quit IRC | 22:43 | |
| *** knikolla has quit IRC | 22:43 | |
| *** sri_ has joined #openstack-keystone | 22:51 | |
| *** dviroel has joined #openstack-keystone | 22:55 | |
| *** lxkong has joined #openstack-keystone | 22:55 | |
| *** csatari has joined #openstack-keystone | 22:55 | |
| *** pas-ha has joined #openstack-keystone | 22:55 | |
| *** knikolla has joined #openstack-keystone | 22:56 | |
| *** ChanServ sets mode: +o knikolla | 22:56 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!