15:01:03 <dmendiza[m]> #startmeeting keystone
15:01:03 <opendevmeet> Meeting started Tue Aug 16 15:01:03 2022 UTC and is due to finish in 60 minutes.  The chair is dmendiza[m]. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:01:03 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:01:03 <opendevmeet> The meeting name has been set to 'keystone'
15:01:11 <dmendiza[m]> #topic Roll Call
15:01:16 <dmendiza[m]> Courtesy ping for admiyo, bbobrov, crisloma, d34dh0r53, dpar, dstanek, hrybacki, knikolla, lbragstad, lwanderley, kmalloc, rodrigods, samueldmq, ruan_he, wxy, sonuk, vishakha, Ajay, rafaelwe, xek
15:01:46 <d34dh0r53> o/ lurking
15:02:12 <xek> o/
15:02:28 <h-asahina> o/
15:02:54 <xek> -
15:04:22 <dmendiza[m]> Hi y'all!
15:04:25 <dmendiza[m]> Let's get started
15:04:38 <dmendiza[m]> #topic Review Previous Meeting Action Items
15:04:54 <dmendiza[m]> #link https://meetings.opendev.org/meetings/keystone/2022/keystone.2022-08-09-15.02.html
15:04:58 <dmendiza[m]> We didn't have any
15:05:08 <dmendiza[m]> #topic Liaison  U pdates
15:05:25 <dmendiza[m]> Just a quick update from the release/maintenance side
15:05:35 <dmendiza[m]> We've marked the Pike branck as EOL
15:05:37 <dmendiza[m]> #link https://review.opendev.org/c/openstack/releases/+/851559
15:05:44 <dmendiza[m]> #info Pike is now EOL
15:10:22 <dmendiza[m]> OK, moving on
15:10:31 <dmendiza[m]> #topic OAuth 2.0
15:10:39 <dmendiza[m]> h_asahina 👋
15:10:45 <h-asahina> hi
15:10:47 <dmendiza[m]> Any updates this week?
15:11:15 <h-asahina> first of all, we submitted a patch for keystonemiddleware Zuul error   https://review.opendev.org/c/openstack/keystonemiddleware/+/852590
15:12:50 <h-asahina> please kindly reveiew it. by this patch we can merge https://review.opendev.org/c/openstack/keystonemiddleware/+/830737. of cource we have to reply knikolla's comment before doing that.
15:13:32 <h-asahina> I also updated the spec https://review.opendev.org/c/openstack/keystone-specs/+/843765, according to the previous meeting.
15:13:36 <dmendiza[m]> h-asahina: ac, merged the first patch
15:13:41 <dmendiza[m]> *ack
15:13:51 <h-asahina> thanks
15:14:18 <dmendiza[m]> h-asahina: yeah, last Friday was a day off for Red Hat, so we didn't get a chance to review your udpates
15:14:24 <dmendiza[m]> we'll review this Friday for the reviewathon
15:14:40 <h-asahina> got it thanks.
15:14:52 <h-asahina> can i confirm the schedule?
15:15:44 <h-asahina> I suppose this spec and 3 patches that we submitted during Yoga cycle can be merged within Zed cycle. do you feel it possible?
15:16:23 <dmendiza[m]> #link https://releases.openstack.org/zed/schedule.html
15:16:29 <dmendiza[m]> We have a couple of weeks before Zed-3
15:16:49 <dmendiza[m]> we should try to get everything reviewed this week so we can have some time to update patches if needed.
15:19:15 <h-asahina> okey. that's right. from our side, it would be helpful at least if these three patches will be merged in Zed: https://review.opendev.org/c/openstack/keystoneauth/+/830734; https://review.opendev.org/c/openstack/keystonemiddleware/+/830737; https://review.opendev.org/c/openstack/keystone/+/830739
15:21:27 <h-asahina> like you said, we have tiem. if you leave the comment this week, we'll update the patches next week.
15:21:42 <dmendiza[m]> great, thanks h-asahina
15:23:13 <h-asahina> thanks. that's all from my side :)
15:24:33 <dmendiza[m]> OK, moving on ...
15:24:51 <dmendiza[m]> #topic Secure RBAC
15:27:37 <dmendiza[m]> Looks like the pop-ups are not really happening anymore.
15:27:53 <dmendiza[m]> The patch to delay system scope did merge so I'll have to review that
15:27:58 <dmendiza[m]> #link https://review.opendev.org/c/openstack/governance/+/847418/14/goals/selected/consistent-and-secure-rbac.rst
15:31:59 <dmendiza[m]> #topic Open Discussion
15:32:13 <dmendiza[m]> Anything else y'all want to talk about before we look at bug reports?
15:36:09 <h-asahina> if you have time, i'd like to talk about my comment on the spec briefly
15:36:14 <h-asahina> :dmendiza
15:36:53 <h-asahina> if it's better to wait for the next review comment, i'll wait.
15:37:38 <dmendiza[m]> h-asahina: I think maybe it would be better to talk about it after folks have a had a chance to read it
15:37:48 * dmendiza[m] has not read the update yet 😅
15:38:39 <h-asahina> ah, sorry, i meant my reply comment which is the questions about the last meeting.
15:38:52 <dmendiza[m]> Sure go ahead
15:39:36 <h-asahina> thanks, I have two questions: (i) delegation of Users' permission; (ii) usage of mapping API in our case.
15:41:02 <h-asahina> (i) according to your suggestion, we are implementing mTLS OAuth2.0 so that User API is used for OAuth2.0 client management
15:42:00 <h-asahina> basically we think it'll work, but we have concerns that delegation of user permission is not possible.
15:42:34 <h-asahina> for example, it's not possible for non-admin user who is only allowed to access Tacker API to delegate it's role to a client
15:43:06 <h-asahina> but it's possible if we use credentials API and allow this user to access the credentials API.
15:44:29 <h-asahina> do you have any idea to solve this problem or justify this issue?
15:46:22 <dmendiza[m]> Hmm... I am not sure.  I'd like to find out what knikolla thinks...  we should follow-up with him and try to get an answer.
15:46:31 <h-asahina> ok
15:46:56 <h-asahina> (ii) You said we can look at mapping API as a reference
15:47:52 <h-asahina> but we feel we can just use it to manage mapping rules between DN in a client cert and keystone Users' attributes (e.g., username, project_id).
15:48:35 <h-asahina> do you feel it's reasonable?
15:50:22 <h-asahina> let me explain further, we thought we have to implement the similar codes from scratch but now we think we don't have to.
15:55:21 <h-asahina> it's also knikolla's comment https://meetings.opendev.org/meetings/keystone/2022/keystone.2022-08-09-15.02.log.html#l-65, maybe it's better to wait for him?
15:58:33 <dmendiza[m]> Yeah ... I think he may be referring to mapping cert attributes -> user attributes so we can get the correct roles in the token
15:59:32 <dmendiza[m]> I'll ask knikolla about it if he joins the review on Friday
15:59:48 <dmendiza[m]> That's about all the time we have for the meeting this week.
15:59:53 <dmendiza[m]> Thanks for joining, everyone!
15:59:57 <dmendiza[m]> #endmeeting