[Yahoo-eng-team] [Bug 1888886] Re: Keystone lower-constraints job failure due to PyMySQL==0.10.0

2020-08-04 Thread Colleen Murphy
This bug was about the lower-constraints job not having pymysql pinned in the lower-constraints file. Raising the upper-constraint is a different issue. ** Summary changed: - Keystone gate failure due to PyMySQL==0.10.0 + Keystone lower-constraints job failure due to PyMySQL==0.10.0 ** Changed

[Yahoo-eng-team] [Bug 1878438] Re: error when using token get from application credential authentication

2020-05-13 Thread Colleen Murphy
You do not need to create a new token or a new session. The application credential session should be used for your keystone client session. ** Changed in: keystone Status: In Progress => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team,

[Yahoo-eng-team] [Bug 1872599] Re: Create a domain, projects, users, and roles in keystone

2020-04-15 Thread Colleen Murphy
The document you are referencing in https://bugs.launchpad.net/keystone/+bug/1872599/comments/2 is for pike, please see the up to date documentation for your release. ** Changed in: keystone Status: Incomplete => Invalid -- You received this bug notification because you are a member of

[Yahoo-eng-team] [Bug 1854041] Re: Keystone should propagate redirect exceptions from auth plugins

2020-04-14 Thread Colleen Murphy
** Changed in: keystone Status: Expired => Confirmed -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1854041 Title: Keystone should propagate redirect

[Yahoo-eng-team] [Bug 1866817] Re: Invalid input for field 'roles/0/id': 'role_admin' does not match '^[a-zA-Z0-9-]+$'

2020-04-06 Thread Colleen Murphy
> seems to work fine on train region but fails on rocky region The user in your rocky region does not have the image_viewer, role_viewer, or role_admin roles assigned. Assign those roles to the user on the project and it will work. > I would like to harden my ec2 keystone policy, like

[Yahoo-eng-team] [Bug 1850087] Re: keystone: token replaced at auth_context middleware

2020-04-01 Thread Colleen Murphy
** Changed in: keystone Status: Expired => New -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1850087 Title: keystone: token replaced at auth_context

[Yahoo-eng-team] [Bug 1858410] Re: Got error 'NoneType' when executing unittest on stable/rocky

2020-03-06 Thread Colleen Murphy
No longer affects the reporter ** Changed in: keystone Status: Triaged => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1858410 Title: Got error

[Yahoo-eng-team] [Bug 1865121] Re: 'openstack token issue' command doesn't issue token for MFA enabled user

2020-02-28 Thread Colleen Murphy
You were offline when I responded to your query on IRC: http://eavesdrop.openstack.org/irclogs/%23openstack-keystone /%23openstack-keystone.2020-02-27.log.html#t2020-02-27T13:51:49 In short, the support is partially there already in keystoneauth:

[Yahoo-eng-team] [Bug 1863393] [NEW] Project query parameters parents_as_list and subtree_as_list do not work

2020-02-14 Thread Colleen Murphy
Public bug reported: The api-ref documents the parents_as_list and subtree_as_list parameters to the GET /v3/projects/{project_id} endpoint to show either a project's heritage or a project's descendants as a full list of project objects, as opposed to a plain list of IDs which can be requested

[Yahoo-eng-team] [Bug 1756190] Re: Project tags is too restrictive

2020-02-06 Thread Colleen Murphy
I tested this and I believe ksc/osc is not affected by this, the server- side changes were enough to return the correct result. ** Changed in: python-keystoneclient Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is

[Yahoo-eng-team] [Bug 1861571] Re: Install and configure in keystone

2020-02-05 Thread Colleen Murphy
*** This bug is a duplicate of bug 1803438 *** https://bugs.launchpad.net/bugs/1803438 Marked as duplicate of https://bugs.launchpad.net/keystone/+bug/1803438 and proposed the backport that should have been done for that https://review.opendev.org/706095 ** This bug has been marked a

[Yahoo-eng-team] [Bug 1803438] Re: Install and configure in keystone

2020-02-05 Thread Colleen Murphy
** Also affects: keystone/rocky Importance: Undecided Status: New ** Changed in: keystone/rocky Status: New => In Progress -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone).

[Yahoo-eng-team] [Bug 1857086] Re: Trying to update user options field for ldap user gives 403 forbidden

2020-01-09 Thread Colleen Murphy
Going to tentatively mark this as wontfix, but it's not a hard no from me - if you come up with a good solution for your environment please post it here. ** Changed in: keystone Status: Incomplete => Won't Fix -- You received this bug notification because you are a member of Yahoo!

[Yahoo-eng-team] [Bug 1831018] Re: Improper close connection to database leading to mysql/mariadb block connection.

2020-01-09 Thread Colleen Murphy
Marking as invalid for keystone, this is a problem in oslo.db or sqlalchemy. ** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone).

[Yahoo-eng-team] [Bug 1857086] Re: Trying to update user options field for ldap user gives 403 forbidden

2020-01-08 Thread Colleen Murphy
We discussed this a bit in yesterday's meeting: http://eavesdrop.openstack.org/meetings/keystone/2020/keystone.2020-01-07-17.00.log.html#l-24 Auth methods are separate from identity backends, and moreover user resource options are separate from users, so it should be possible to set MFA options

[Yahoo-eng-team] [Bug 1858012] [NEW] List role assignments by role ID may leak extra system assignments outside of filter

2019-12-31 Thread Colleen Murphy
Public bug reported: If there are multiple role assignments on the system and some of the assignments use different roles, it's possible for the /v3/role_assignments?role.id={role_id} query to include some system role assignments that don't match the role ID. For example: > curl -H

[Yahoo-eng-team] [Bug 1845539] Re: Removed as of Ussuri

2019-12-01 Thread Colleen Murphy
** Also affects: keystonemiddleware Importance: Undecided Status: New -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1845539 Title: Removed as of Ussuri

[Yahoo-eng-team] [Bug 1840090] Re: Cannot reparent projects

2019-11-04 Thread Colleen Murphy
This is still a valid request, we just need to discuss whether there is a way forward on it. ** Changed in: keystone Importance: Undecided => Wishlist ** Changed in: keystone Status: Expired => New -- You received this bug notification because you are a member of Yahoo! Engineering

[Yahoo-eng-team] [Bug 1850656] Re: Deploy will fail if keystone.conf has '[oslo_policy]/enforce_scope=true'

2019-10-31 Thread Colleen Murphy
> It either ends up having Client Error with admin-project-scoped auth or 401 with supposedly defalt-domain-scoped auth. The scope_type for identity:create_endpoint is "system": https://docs.openstack.org/keystone/latest/configuration/policy.html So neither a project- nor domain-scoped token

[Yahoo-eng-team] [Bug 1848625] Re: Domain admin can't list users in domain via CLI

2019-10-18 Thread Colleen Murphy
> Maybe we should provide a way to generate a domain vs project scoped token from Horizon when logged in as the desired user. I think that's a valid request, could you file that with the horizon project? ** Changed in: keystone Status: New => Invalid -- You received this bug

[Yahoo-eng-team] [Bug 1848400] Re: Can not change domain of role

2019-10-17 Thread Colleen Murphy
This is not a bug. A role's domain is not just a property but its namespace; a domain owns a role, same as it owns a user or a project. If it was allowed to change, anything that referred to it by its name and domain would suddenly find it missing. Instead of changing a role's domain, just create

[Yahoo-eng-team] [Bug 1845412] Re: Update ldap user information and it can't be identified by keystone

2019-09-27 Thread Colleen Murphy
Glad I could help, I will mark this bug as "invalid" since the question has been answered. ** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone).

[Yahoo-eng-team] [Bug 1845539] [NEW] Removed as of Ussuri

2019-09-26 Thread Colleen Murphy
Public bug reported: This issue is for tracking removals during the Ussuri release. Use the "Related-bug" commit message tag and link to this issue from release notes for changes that remove deprecated items from keystone. This issue will be closed at the end of the cycle. ** Affects: keystone

[Yahoo-eng-team] [Bug 1829454] Re: Deprecated as of Train

2019-09-26 Thread Colleen Murphy
Closing with the release of RC1. ** Changed in: keystone Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1829454 Title:

[Yahoo-eng-team] [Bug 1829453] Re: Removed as of Train

2019-09-26 Thread Colleen Murphy
Closing with the release of RC1. ** Changed in: keystone Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1829453 Title:

[Yahoo-eng-team] [Bug 1845540] [NEW] Deprecated as of Ussuri

2019-09-26 Thread Colleen Murphy
Public bug reported: This issue is for tracking deprecations during the Ussuri release. Use the "Related-bug" commit message tag and link to this issue from release notes for changes that deprecate items in keystone. This issue will be closed at the end of the cycle. ** Affects: keystone

[Yahoo-eng-team] [Bug 1844621] Re: Unittest TestBlockCommentsBeginWithASpace not pass

2019-09-25 Thread Colleen Murphy
** Changed in: keystone Status: Incomplete => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1844621 Title: Unittest

[Yahoo-eng-team] [Bug 1844461] [NEW] Role assignment list for subtree is only project scoped

2019-09-17 Thread Colleen Murphy
Public bug reported: The identity:list_role_assignment_for_subtree is limited to the 'project' scope type, but this means that system readers and domain readers can't list role assignments for the subtree of a project they would otherwise have access to. Since the project ID is specified as a

[Yahoo-eng-team] [Bug 1842416] Re: assert_user_enabled function should raise UserDisabled exception when user is disabled

2019-09-17 Thread Colleen Murphy
Thanks for the bug report, but as I commented on the patch the assertion function is working as intended and should not be changed. ** Changed in: keystone Status: In Progress => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is

[Yahoo-eng-team] [Bug 1818732] Re: EC2 credential API doesn't use default roles

2019-09-16 Thread Colleen Murphy
** Changed in: keystone Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1818732 Title: EC2 credential API doesn't use

[Yahoo-eng-team] [Bug 1843464] [NEW] TOTP previous windows passcode test fails intermittently

2019-09-10 Thread Colleen Murphy
Public bug reported: The keystone.tests.unit.test_v3_auth.TestAuthTOTP.test_with_passcode_in_previous_windows_extended test fails in CI occasionally, with traceback: Traceback (most recent call last): File "/home/zuul/src/opendev.org/openstack/keystone/keystone/tests/unit/test_v3_auth.py",

[Yahoo-eng-team] [Bug 1824239] Re: RFE: predictable role ids

2019-09-06 Thread Colleen Murphy
As far as I'm concerned https://bugs.launchpad.net/keystone/+bug/1824239/comments/3 still applies and this is still not on the roadmap. ** Changed in: keystone Status: In Progress => Won't Fix -- You received this bug notification because you are a member of Yahoo! Engineering Team,

[Yahoo-eng-team] [Bug 1840288] [NEW] Trusts GET API leaks existence information to unauthorized users

2019-08-15 Thread Colleen Murphy
*** This bug is a security vulnerability *** Public security bug reported: The current implementation of the GET /v3/OS-TRUST/trusts/{trust_id} API leaks information about the existence of a trust to unauthorized users. If an authenticated user requests a trust that either does not exist or has

[Yahoo-eng-team] [Bug 1709344] Re: Identity resource options for multi-factor are undocumented

2019-08-09 Thread Colleen Murphy
** Changed in: keystone Status: Triaged => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1709344 Title: Identity resource options for

[Yahoo-eng-team] [Bug 1836568] Re: Logs filled with unnecessary policy deprecation warnings

2019-08-01 Thread Colleen Murphy
** Also affects: oslo.policy Importance: Undecided Status: New -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1836568 Title: Logs filled with

[Yahoo-eng-team] [Bug 1791111] Re: allow change password upon first use as user

2019-07-30 Thread Colleen Murphy
Since this is for new users only, the admin will need to provide the user with enough information to be able to change their password before first login, like some kind of onboarding packet. This would have to include their user ID. There's no way that keystone could supply the user's ID without

[Yahoo-eng-team] [Bug 1837061] Re: RFE: Application Credential API (CRUD) to 403 if app-cred auth method not enabled

2019-07-30 Thread Colleen Murphy
Marking wontfix based on above comment, feel free to reopen if you want to discuss it further. ** Changed in: keystone Status: New => Won't Fix -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone).

[Yahoo-eng-team] [Bug 1836618] Re: Due to case sensitivity of a user name compare in a keystone test, the test might fail

2019-07-29 Thread Colleen Murphy
Backends such as MySQL or LDAP are case-insensitive, case-preserving, as explained in https://docs.openstack.org/keystone/latest/admin/case- insensitive.html#backends . If you request details for a user in all lower-case, the username will be returned as it was stored in the backend, not as you

[Yahoo-eng-team] [Bug 1835303] Re: Unclear exception message for incorrect login details

2019-07-29 Thread Colleen Murphy
Adding more generic hints to the keystone message makes sense. I'll retarget this at keystone. ** Project changed: keystoneauth => keystone ** Summary changed: - Unclear exception message for incorrect login details + "Unauthorized" error message needs more hints ** Changed in: keystone

[Yahoo-eng-team] [Bug 1837513] Re: Install and configure in keystone

2019-07-24 Thread Colleen Murphy
** Changed in: keystone Status: Fix Committed => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1837513 Title: Install and configure in keystone

[Yahoo-eng-team] [Bug 1836872] Re: [RFE] Default project auto creation

2019-07-17 Thread Colleen Murphy
Thanks for the suggestion! However, I'm going to mark this as Won't Fix since I don't think this is within keystone's purview. The reason we have auto-created projects for mapped users is because without it there is no way to create direct role assignments for those users since they don't exist

[Yahoo-eng-team] [Bug 1836650] Re: Bug when configuring Keystone events format

2019-07-16 Thread Colleen Murphy
Marking this as invalid for keystone since it seems to be a configuration issue with a deployment tool and not a bug in keystone itself. If you think keystone itself needs to be fixed, feel free to change the status back to "new". ** Changed in: keystone Status: Incomplete => Invalid --

[Yahoo-eng-team] [Bug 1832267] Re: add raw format link to keystone config sample.

2019-07-15 Thread Colleen Murphy
** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1832267 Title: add raw format link to keystone config

[Yahoo-eng-team] [Bug 1835299] [NEW] Architecture documents are out of date

2019-07-03 Thread Colleen Murphy
Public bug reported: The following documents: https://docs.openstack.org/keystone/latest/contributor/api_change_tutorial.html https://docs.openstack.org/keystone/latest/getting-started/architecture.html refer to the pre-Flask constructs of controllers.py, the internal WSGI implementation, and

[Yahoo-eng-team] [Bug 1833340] Re: Keystone build from source fails on intel

2019-06-19 Thread Colleen Murphy
"fatal error: Python.h: No such file or directory" means you need the python2 or python3 development libraries installed, which you can do by installing either the python-dev, python3-dev, python-devel or python3-devel package on your distribution, depending on what version of python you are using

[Yahoo-eng-team] [Bug 1832005] Re: Race during Keystone deploy (fernet)

2019-06-18 Thread Colleen Murphy
I'm going to mark this as invalid for keystone. Keystone does expect the setup to happen in a specific order, and it is up to the operator or deployment tool to meet those requirements. Keystone can't accommodate implementation differences between different deployment tools. ** Changed in:

[Yahoo-eng-team] [Bug 1831400] Re: doc: Invalid index of keystone highlight in Rocky

2019-06-07 Thread Colleen Murphy
Please do not report trivial errors like this, just go ahead and submit the correction. In this case the error was not in keystone but was in the releases project, so marking this as invalid. ** Changed in: keystone Status: Fix Committed => Invalid -- You received this bug notification

[Yahoo-eng-team] [Bug 1807697] Re: RFE: Token returns Project's tag properties

2019-05-28 Thread Colleen Murphy
Okay, in that case I'll close this bug for now. If you get stuck or have questions, feel free to reopen this or contact us in #openstack-keystone or on the openstack-discuss mailing list. ** Changed in: keystone Status: In Progress => Won't Fix -- You received this bug notification

[Yahoo-eng-team] [Bug 1829574] [NEW] Refactor API protection tests

2019-05-17 Thread Colleen Murphy
Public bug reported: There is a lot of repetition in the protection unit tests, which hinders reusability and may be slowing down the tests. At a minimum, a lot of the test setup work can be moved out of setUp() and into setUpClass() which should avoid some unnecessary churn during the test runs.

[Yahoo-eng-team] [Bug 1829573] [NEW] Refactor API unit tests to use flask test_client

2019-05-17 Thread Colleen Murphy
* tests can be converted the same way. ** Affects: keystone Importance: Low Assignee: Colleen Murphy (krinkle) Status: In Progress ** Tags: test-improvement ** Changed in: keystone Importance: Undecided => Low -- You received this bug notification because you are a mem

[Yahoo-eng-team] [Bug 1829453] [NEW] Removed as of Train

2019-05-16 Thread Colleen Murphy
Public bug reported: This issue is for tracking removals during the Train release. Use the "Related-bug" commit message tag and link to this issue from release notes for changes that remove deprecated items from keystone. This issue will be closed at the end of the cycle. ** Affects: keystone

[Yahoo-eng-team] [Bug 1829454] [NEW] Deprecated as of Train

2019-05-16 Thread Colleen Murphy
Public bug reported: This issue is for tracking deprecations during the Train release. Use the "Related-bug" commit message tag and link to this issue from release notes for changes that deprecate items in keystone. This issue will be closed at the end of the cycle. ** Affects: keystone

[Yahoo-eng-team] [Bug 1828783] Re: More user-friendly websso unauthorized

2019-05-15 Thread Colleen Murphy
The vague error message from keystone is intentional. We can't give more details about the cause of the failed authentication or authorization issue without exposing information an attacker could use to target the system. If you are in a non-production test environment, you can set

[Yahoo-eng-team] [Bug 1816167] Re: RFE: Service Catalog Standardization

2019-05-04 Thread Colleen Murphy
The standard is documented in the spec, plus the Service Types Authority helps a ton with standardizing catalogs. We can't change the way keystone itself validates catalog entries without breaking the API, so there's nothing we can do here. ** Changed in: keystone Status: Triaged => Won't

[Yahoo-eng-team] [Bug 1824239] Re: RFE: predictable role ids

2019-05-04 Thread Colleen Murphy
We discussed this at the PTG, there is really only a need for users, projects, and domains to have predictable IDs, so we should not tackle role IDs at this point. We can reopen this if we find a specific real- world use case that requires it. ** Changed in: keystone Status: In Progress =>

[Yahoo-eng-team] [Bug 1816163] Re: RFE: Better expose public interfaces

2019-05-04 Thread Colleen Murphy
We used to have versioned driver interfaces at one point, it was too cumbersome to maintain. We try to support driver writers as best we can by being extremely strict about documenting changes to the public interfaces in release notes. Closing this as won't fix, feel free to reopen if you think

[Yahoo-eng-team] [Bug 1816112] Re: RFE: Object Dependency Lifecycle

2019-05-04 Thread Colleen Murphy
https://review.opendev.org/499703 closes this ** Changed in: keystone Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone).

[Yahoo-eng-team] [Bug 1815972] Re: RFE: Use views effectively

2019-05-04 Thread Colleen Murphy
We dropped the V2 API, plus refactoring our API controllers to use Flask means that Flask now can handle all of the view rendering, so this work is not as important any more. Closing as won't fix, feel free to reopen if this is something that should be revisited. ** Changed in: keystone

[Yahoo-eng-team] [Bug 1825214] Re: Install and configure in keystone

2019-04-19 Thread Colleen Murphy
** Also affects: keystone (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1825214 Title: Install and configure

[Yahoo-eng-team] [Bug 1825111] Re: package dependencies error with keystone rel. stein

2019-04-19 Thread Colleen Murphy
I suspect this is a packaging issue and not an issue with the keystone documentation or source code, so tagging the Ubuntu team. ** Also affects: keystone (Ubuntu) Importance: Undecided Status: New ** Changed in: keystone Status: Confirmed => Incomplete -- You received this

[Yahoo-eng-team] [Bug 1732502] Re: project-list command does not work for a user with admin role on domain

2019-04-15 Thread Colleen Murphy
*** This bug is a duplicate of bug 1750660 *** https://bugs.launchpad.net/bugs/1750660 I think this is covered by https://bugs.launchpad.net/keystone/+bug/1750660 and the default project policies now account for domain scope. ** This bug has been marked a duplicate of bug 1750660 The v3

[Yahoo-eng-team] [Bug 1823847] Re: Multiple rules in a mapping is not working with type: "local" attribute

2019-04-12 Thread Colleen Murphy
** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1823847 Title: Multiple rules in a mapping is not working with

[Yahoo-eng-team] [Bug 1823847] Re: Multiple rules in a mapping is not working with type: "local" attribute

2019-04-09 Thread Colleen Murphy
Unfortunately the "local" type within the "local" section is not a matching rule. Only the keys in the "remote" section are matched, then they are mapped to attributes in the "local" section. If the user doesn't exist already in keystone, but still matches the remote rule '"type":

[Yahoo-eng-team] [Bug 1822251] Re: grenade job fail due to missing memcache module

2019-03-29 Thread Colleen Murphy
** Also affects: devstack Importance: Undecided Status: New ** Changed in: keystone Status: Confirmed => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone).

[Yahoo-eng-team] [Bug 1801873] Re: Unable to delete domains when users was managed by LDAP back-end

2019-03-21 Thread Colleen Murphy
I was able to reproduce this on Stein. ** Changed in: keystone Status: New => Triaged ** Changed in: keystone Milestone: None => stein-rc2 ** Also affects: keystone/stein Importance: Medium Status: Triaged ** Also affects: keystone/rocky Importance: Undecided

[Yahoo-eng-team] [Bug 1798184] Re: [SRU] PY3: python3-ldap does not allow bytes for DN/RDN/field names

2019-03-20 Thread Colleen Murphy
** Also affects: keystone/stein Importance: Medium Assignee: Corey Bryant (corey.bryant) Status: Fix Released ** Also affects: keystone/rocky Importance: Undecided Status: New -- You received this bug notification because you are a member of Yahoo! Engineering Team,

[Yahoo-eng-team] [Bug 1810393] Re: shadow user cache is not cleaned when the related idp is deleted.

2019-03-15 Thread Colleen Murphy
cky Importance: Undecided => High ** Changed in: keystone/rocky Assignee: (unassigned) => Colleen Murphy (krinkle) -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bug

[Yahoo-eng-team] [Bug 1819299] Re: Keystone Installation Tutorial for Red Hat Enterprise Linux and CentOS in keystone

2019-03-15 Thread Colleen Murphy
** Changed in: keystone Milestone: None => stein-rc1 ** Also affects: keystone/rocky Importance: Undecided Status: New ** Also affects: keystone/stein Importance: Low Assignee: Chason Chan (chen-xing) Status: Fix Released -- You received this bug notification

[Yahoo-eng-team] [Bug 1754723] Re: 'openstack user list' is not listing userid correctly in case of LDAP

2019-03-12 Thread Colleen Murphy
Using the hash of the ID is intentional when keystone has a domain configured to use the LDAP backend. Otherwise there would be no way to guarantee uniqueness, since the ID comes from an external provider and since there could be multiple domains configured to use LDAP. ** Changed in: keystone

[Yahoo-eng-team] [Bug 1819017] Re: Python3 type confusion breaks LDAP integration

2019-03-08 Thread Colleen Murphy
*** This bug is a duplicate of bug 1798184 *** https://bugs.launchpad.net/bugs/1798184 This is already fixed in master and the backport to rocky is in progress: https://review.openstack.org/613648 See bug #1798184 for more details. ** This bug has been marked a duplicate of bug 1798184

[Yahoo-eng-team] [Bug 1817623] Re: Create a domain, projects, users, and roles in keystone

2019-03-01 Thread Colleen Murphy
Okay, closing then. Thanks! ** Changed in: keystone Status: Incomplete => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1817623 Title: Create a

[Yahoo-eng-team] [Bug 1818085] [NEW] Application credential role validation has inconsistent error handling

2019-02-28 Thread Colleen Murphy
Public bug reported: If a role is provided by ID, keystone validates it in the app cred manager and a NotFound is properly masked as a validation error by the controller. If a role is provided by name, keystone searches for it in _normalize_role_list in the controller and will raise a NotFound

[Yahoo-eng-team] [Bug 1817540] Re: centos 7.6 clean instillation error

2019-02-25 Thread Colleen Murphy
This appears to be an issue with mariadb, not keystone. This may help resolve the mariadb issue: https://dba.stackexchange.com/questions/160099/mariadb-disable-the- gssapi-plugin ** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a

[Yahoo-eng-team] [Bug 1817313] [NEW] RBAC Enforcer Programming Error raised for malformed federation protocol request

2019-02-22 Thread Colleen Murphy
Public bug reported: On devstack, I mistakenly tried to create a federation protocol without providing its name in the request path: curl -H "x-auth-token: $token" -H "content-type: application/json" http://localhost/identity/v3/OS- FEDERATION/identity_providers/myidp/protocols -X PUT -d

[Yahoo-eng-team] [Bug 1815539] Re: Self-service policies for credential APIs are broken in stable/rocky

2019-02-21 Thread Colleen Murphy
** Also affects: keystone/rocky Importance: Undecided Status: New -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1815539 Title: Self-service policies for

[Yahoo-eng-team] [Bug 1813926] Re: Over-indented Pep8 issue hit during keystone build

2019-01-30 Thread Colleen Murphy
** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1813926 Title: Over-indented Pep8 issue hit during keystone

[Yahoo-eng-team] [Bug 1813265] [NEW] Documentation should use endpoints with path /identity instead of port 5000

2019-01-25 Thread Colleen Murphy
Public bug reported: In devstack we configure keystone to run on port 80/443 proxied through the /identity URL path. We semi-officially recommend doing the same in production, but all of our documentation points to using port 5000 with no path. We should update the documentation to use the

[Yahoo-eng-team] [Bug 1811605] [NEW] Tokenless authentication is broken

2019-01-13 Thread Colleen Murphy
Public bug reported: When trying to use tokenless authentication, authentication fails with the following traceback: http://paste.openstack.org/show/742271/ git bisect shows this is the commit that introduced the bug: 0dc5c4edabd5cb0455ffe1c4f8cf8369f64b2197 Steps to reproduce: (Can start out

[Yahoo-eng-team] [Bug 1641026] Re: Keystone ldap tree_dn does not support Chinese

2019-01-03 Thread Colleen Murphy
This seems to still be a problem at least in keystone in Queens https://bugs.launchpad.net/keystone/+bug/1810441 ** Changed in: keystone Status: Expired => Confirmed -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to

[Yahoo-eng-team] [Bug 1804700] Re: keystone-manage bootstrap raises ValueError

2018-11-28 Thread Colleen Murphy
bootstrap is doing the right thing by requiring a password, but it's not acceptable to be emitting a traceback. The error message "Either --bootstrap-password argument or OS_BOOTSTRAP_PASSWORD must be set." and an appropriate exit code is correct, causing a traceback is not. ** Changed in:

[Yahoo-eng-team] [Bug 1803882] Re: Keystone – error message is not correct/clear in case when no “rule” is associated to user

2018-11-21 Thread Colleen Murphy
Using the --project flag with the openstack client sets the default_project_id attribute of a user which was only used for the keystone v2 API. With the v3 API (the only supported version) it's now necessary to explicitly create the role assignment with $ openstack role add --user new-user

[Yahoo-eng-team] [Bug 1804041] [NEW] Federation documentation should include examples for nginx

2018-11-19 Thread Colleen Murphy
Public bug reported: Our federation guide only discusses Apache HTTPD modules for Shibboleth, Mellon, and OpenIDC. A specific ask from operators at the Berlin Forum was for documentation for Nginx as well. ** Affects: keystone Importance: Undecided Status: New ** Tags:

[Yahoo-eng-team] [Bug 1804042] [NEW] RFE: Add ability to restrict auth by forwarded IP

2018-11-19 Thread Colleen Murphy
Public bug reported: At the Berlin summit, I heard from two different operators that it would be useful to be able to allow users to opt into restricting authentication access by IP address range. This could be implemented as an auth method or more likely as a new user option. This RFE is a

[Yahoo-eng-team] [Bug 1713574] Re: python 3 errors with memcache enabled

2018-10-29 Thread Colleen Murphy
I don't think this should have been triaged for keystoneauth, the fix for this was merged in keystonemiddleware. ** Changed in: keystoneauth Status: Incomplete => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to

[Yahoo-eng-team] [Bug 1795800] Re: Username enumeration via response timing difference

2018-10-25 Thread Colleen Murphy
I disagree that this is too hard to fix. In fact I'm fairly sure I found it already: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/core.py?h=stable/pike#n174 We do a user lookup long before bothering to try to validate the password. The fix is to continue to go

[Yahoo-eng-team] [Bug 1793347] Re: keystone upgrade fails q->r oslo.log requirement to low

2018-10-25 Thread Colleen Murphy
Morgan, that's not true, we've switched to managing our own requirements: http://lists.openstack.org/pipermail/openstack- dev/2018-March/128352.html Looking at stable/rocky we still refer to 3.36.0 so we do need to fix that ourselves

[Yahoo-eng-team] [Bug 1799929] Re: Invalid command 'WSGIDaemonProcess', perhaps misspelled or defined by a module not included in the server configuration

2018-10-25 Thread Colleen Murphy
You need to install the mod_wsgi package, which is mentioned here: https://docs.openstack.org/keystone/latest/install/keystone-install- rdo.html#install-and-configure-components ** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member

[Yahoo-eng-team] [Bug 1795046] Re: Rocky Openstack CentOS documentation not matching

2018-10-22 Thread Colleen Murphy
As Adam said, you need to set OS_IDENTITY_API_VERSION=3 for the openstack client to recognize that it needs to handle this v3-specific subcommand. Marking this as invalid. ** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of

[Yahoo-eng-team] [Bug 1783010] Re: Configure the Apache HTTP server (incorrect edit file)

2018-10-22 Thread Colleen Murphy
The instructions are correct as-is, /etc/apache2/apache2.conf is a valid place to set the ServerName. ** Changed in: keystone Status: In Progress => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack

[Yahoo-eng-team] [Bug 1750415] Re: validation of app cred tokens is dependent on CONF.token.cache_on_issue

2018-10-10 Thread Colleen Murphy
** Changed in: keystone/queens Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1750415 Title: validation of app cred

[Yahoo-eng-team] [Bug 1768572] Re: Limit API lacks abstraction for enforcement models

2018-10-10 Thread Colleen Murphy
** Changed in: keystone Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1768572 Title: Limit API lacks abstraction for

[Yahoo-eng-team] [Bug 1779286] Re: Install and configure in keystone

2018-10-10 Thread Colleen Murphy
The bug report points to the OBS (SUSE) install guide, /etc/sysconfig/apache2 is correct for SUSE. The RDO (CentOS) install guide is here: https://docs.openstack.org/keystone/queens/install/keystone-install- rdo.html#configure-the-apache-http-server It points to /etc/httpd/conf/httpd.conf which

[Yahoo-eng-team] [Bug 1431987] Re: Emit failure notifications for CADF audits events

2018-10-10 Thread Colleen Murphy
** Changed in: keystone Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1431987 Title: Emit failure notifications for

[Yahoo-eng-team] [Bug 1590805] Re: Revoking "admin" role from a group invalidates domain admin's token

2018-10-10 Thread Colleen Murphy
Agreed, this looks like this was fixed in https://review.openstack.org/440281 , please reopen if you disagree ** Changed in: keystone Status: Triaged => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to

[Yahoo-eng-team] [Bug 1796612] Re: User password guideline in keystone

2018-10-09 Thread Colleen Murphy
** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1796612 Title: User password guideline in keystone Status in

[Yahoo-eng-team] [Bug 1796247] Re: Auth API returns 401 when the token has invalid project

2018-10-05 Thread Colleen Murphy
The 401 and vague error message with regard to the token API is deliberate, as providing specific details about the reason for failure can be leveraged by an attacker to focus their attacks. If you are running a test deployment and NOT RUNNING IN PRODUCTION, there is an insecure_debug config

[Yahoo-eng-team] [Bug 1794726] [NEW] Keystone as a SAML IdP does not work when mod_auth_mellon is used as the SP

2018-09-27 Thread Colleen Murphy
Public bug reported: The SAML assertion produced by a keystone IdP is technically invalid. When mod_auth_mellon is used as the SP, the SP rejects the SAMLResponse with the error message: Error processing ECP authn response. Lasso error: [101] Signature element not found. This is due to

[Yahoo-eng-team] [Bug 1794710] [NEW] WebSSO initial redirect 404s

2018-09-27 Thread Colleen Murphy
Public bug reported: On current master of horizon, when WebSSO is configured, after selecting the SSO auth method from the "Authenticate Using" dropdown menu, instead of redirecting to the configured identity provider, horizon redirects to

[Yahoo-eng-team] [Bug 1768980] Re: Wrong Port in "Create OpenStack client environment scripts in keystone" document

2018-09-26 Thread Colleen Murphy
** Changed in: keystone Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1768980 Title: Wrong Port in "Create OpenStack

[Yahoo-eng-team] [Bug 1750843] Re: pysaml2 version in global requirements must be updated to 4.5.0

2018-09-26 Thread Colleen Murphy
** Changed in: keystone Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1750843 Title: pysaml2 version in global

  1   2   >