2020-03-03 #opensuse-admin - heroes meeting [20:00:55] Hi everybody, and welcome to the heroes meeting! [20:01:11] Today we "only" have the usual topics, see https://progress.opensuse.org/issues/63172 [20:01:54] let me start with the usual two questions in parallel: [20:02:01] a) who is here for the meeting and [20:02:08] b) does someone from the community have a question? [20:02:30] LCP is here [20:03:33] meinereiner [20:05:10] so - let's start with the status reports ;-) [20:05:48] news-o-o is live, and most of the bugs are fixed [20:06:09] (if not in salt, in production) ;) [20:06:37] the left of jekyll stuff is waiting for their turn [20:06:53] yeah, sadly we have problems with the CI at the moment :-( [20:07:05] nevertheless, thanks for your work on news.o.o! [20:07:35] matrix salt profile is pretty much set up, it just needs the postgres mr to be merged and the firewall/dns stuff [20:08:11] there are also two branches with mailman3 and ipsilon pretty much ready, just waiting for CI to work before sending MRs [20:08:33] also sounds good :-) [20:08:48] in worst case, I can test locally (one more test VM doesn't really matter) and then merge the salt changes manually [20:08:56] but obviously I'd prefer a working CI [20:09:06] yeah [20:10:32] quick report from me: as I already wrote on the ML some days ago, I did a big cleanup in the openSUSE:infrastructure repo and deleted linked packages that were only build for 15.0 or SLE 15 (without SP) - which means we got rid of more than half of the packages there [20:11:55] I've also seen lots of activity from Per to cleanup our mirror infrastructure [20:12:09] from upstream, I did start working on freeipa on openSUSE (continuing stuff after howardg and darix) and securitas/noggin/whatever they rename it to because trademarks apparently I am waiting for Conan Kudo to package, but it has an openSUSE theme now [20:12:13] and you've probably seen the mails that he's working on the forums move [20:12:31] yup [20:13:11] I am also wondering if for testing, we should setup a new freeipa instance or use the existing one because I can't really decide myself [20:14:02] better setup a new one - the risk of breaking the admin login (starting with VPN login) on the whole infrastructure is too big IMHO [20:14:58] sure, so how to even begin setting up a centos/fedora vm >:D [20:15:34] open a ticket and ask for that VM ;-) [20:16:03] alright, you got it [20:16:45] Conan Kudo: any preference for a testing server? fedora or centos [20:21:28] looks like Pharaoh_Atem didn't notice your question ;-) [20:21:36] * Pharaoh_Atem waves [20:21:38] lcp: Fedora [20:21:45] I'm doing all my work right now from Fedora [20:22:16] lcp: oh wait, for FreeIPA? [20:22:17] alright [20:22:21] we should totally do CentOS 8 [20:22:22] yes [20:22:30] decide >:T [20:23:02] well, are we planning to run ipsilon and securitas/noggin/whatever from there? [20:23:05] if so, Fedora [20:23:07] if not, CentOS [20:23:27] nope, we will run as much from openSUSE as possible [20:23:39] even if that means getting poetry in ipsilon repo [20:23:52] errgh [20:23:57] at least CentOS 8 has DNF now [20:24:20] also, maybe we can salt it too >:D [20:24:22] * Pharaoh_Atem is amused at the thought of making more packages for EPEL for openSUSE [20:25:36] lcp: we probably could use salt for it, leveraging the ansible stuff that already exists for ipa/idm [20:26:02] yup, yup [20:28:12] cboltz: fwiw, I was doing some firefighting for $DAYJOB, that's why I didn't notice [20:28:19] I was paged at the same time this started [20:28:26] no problem ;-) [20:28:32] wew [20:28:34] https://progress.opensuse.org/issues/64156 [20:28:51] I might change the title in the future because of the name changing nature >:D [20:29:13] ugh, why can't I log in? [20:29:38] (this uses openSUSE Login, not FreeIPA login) [20:31:08] lcp: nope, no dice [20:31:58] oh, you aren't even a member of admin [20:32:03] welp [20:32:26] maybe you got vinzv'd by anti-spam bot [20:33:05] I should be able to fix that ;-) - what's your username? [20:33:56] found "Pharaoh_Atem", and it was indeed blocked [20:34:56] you should be able to login again [20:35:20] hello, I'm reading the backlog [20:35:27] hi tampakrap [20:35:53] hello [20:36:49] cboltz: yep, thanks! [20:36:56] cboltz: what caused that, out of curiosity? [20:37:15] I'm pretty sure I was able to login in the past [20:37:41] I can only guess - maybe someone accidently disabled your account while blocking spammers [20:37:50] hello, sorry be late [20:37:50] * Pharaoh_Atem shrugs [20:38:03] *reading backlogs too [20:38:12] oh yeah, I also forgot, I looked through our services, most of them support openid/openid connect/saml2 when we get to switch over [20:38:23] except OBS, but that was reported [20:38:24] Pharaoh_Atem: I'm quite sure it wasn't intentional ;-) [20:38:29] lcp: yeeey! :D [20:39:11] I didn't actually go through any admin service because they already work with the existing freeipa, so I assume they work [20:40:01] and then vbulletin is a thing (I really hope we replace it soonish tho) [20:40:16] so in theory, MF-IT has a SAML2 addon for it [20:40:30] so that should be sufficient to get it working with Ipsilon [20:40:51] ah, excellent [20:41:03] at least, that's what was mentioned on the ML earlier today [20:41:15] at this point, that's hearsay [20:41:21] alright, sounds good [20:41:52] worst case, we're going to implement some kind of apache mod_auth_mellon mod_auth_openidc thing [20:42:02] err mod_auth_mellon / mod_auth_openidc [20:42:34] because I'm somewhat certain it respects $REMOTE_USER (that's probably how the CAS thing works for the ICS system) [20:42:56] upstream vB doesn't support *any* SSO, which is a problem :( [20:43:00] for what needs to be done as transition though, we need to actually develop something to move over with the accounts, which will most likely have a workflow of login into old proxy, allow to change username/password and "register" into the new login system [20:43:13] that means we need to have a list of existing usernames [20:43:19] for reservation [20:44:18] Pharaoh_Atem: it's weird tbh, you would expect such popular software would figure that out [20:44:39] I also looked at how mozilla does login for their matrix instance, they use saml with auth0 [20:44:46] erk [20:44:58] I guess we'll SAML to Ipsilon? [20:45:33] yes, but we will need to modify the saml handler to accept usernames verbatim [20:45:57] because the handler does quite a bit of mangling because of some saml implementations having email for id [20:46:45] right [20:46:55] I think Ipsilon sends both? [20:47:10] correct, and it uses usernames as uid [20:47:15] yeah [20:47:17] so it's 2 in 1 [20:47:31] that's pretty much how that's supposed to work :) [20:47:46] also, speaking of SAML, how do we want to reach out to RH about their bugzilla auth enhancements? [20:47:59] do we have a contact at SUSE to loop in for that conversation? [20:48:22] if there is anybody from SUSE infra here, sure [20:48:30] but I think we will need to get board involved [20:48:36] AFAIK someone @SUSE is working on moving bugzilla from Provo to Nuremberg [20:48:43] I can probably find a mail address ;-) [20:48:53] cboltz: that'd be very helpful :) [20:48:55] that would be VERY useful [20:49:02] we should also track this on progress [20:49:06] yes [20:49:17] I need to see if I can dig up a contact on the RH side for rhbz [20:49:44] to my knownledge, the plan is that SUSE will manage bugzilla, and share it with openSUSE, so in theory we can just lean back ;-) [20:50:05] and, if anybody is curious, I decided connect will be killed right after we figure out accounts, because we can do groups in there, and we will just need to get a private mailing list for the member admins to be able to receive emails and assign people to the group in account system [20:50:18] so I don't actually know what to do with the issue on progress :P [20:50:27] deprecate it for a new issue? [20:51:14] I guess so, a big issue for accounts or something more split? [20:51:51] probably a big issue for replacing accounts [20:52:04] err implementing accounts [20:53:07] lcp: speaking about connect - TSP "hides" in a subdirectory of it. Do you know enough about it to move it to a new (well, already existing and idling) VM? [20:53:32] I actually do, but I want to finish moving it to bs4 with new theme [20:53:43] I will also make a new theme for KDE because they are using it too [20:53:56] it will take me a few more days [20:53:58] nice [20:54:15] do we need to worry about events.o.o? [20:54:30] it uses omniauth [20:54:30] https://reimbursements.kde.org/ [20:54:41] cool, then we're set :D [20:54:43] and this uses devise [20:54:50] we are [20:54:58] ugh, and now we're not :( [20:55:06] lcp: ping me when you are ready, and I'll make sure to give you enough permissions on tsp.infra.o.o ;-) [20:55:21] excellent, thank you [20:55:53] Pharaoh_Atem: why? there is devise openid ;) [20:56:26] does it work?! [20:56:39] as a sidenote - TSP currently fetches some fields (for example the realname) from the connect database, we'll need to break/drop this connection [20:56:57] it is an option in the settings [20:57:02] config* [20:57:31] cboltz: that might be fixable with the switchover to openid [20:59:12] maybe it shares some more fields - but having to re-enter those fields won't kill the TSP users ;-) [20:59:46] I know the properties are shared with SAML2 and OIDC, I just don't remember how much is exported with OpenID [21:01:34] FYI: the current TSP setup uses our login proxy (which results in HTTP_X_USERNAME etc. headers) [21:01:55] that's using openSUSE-maintained devise-ichain [21:02:08] it's easy enough to replace [21:02:46] it's also easy to setup if you want to stay with it for the new VM [21:03:02] yup, that's true [21:03:10] (and I have to admit that I'm more familiar with it than with the other auth "stuff" you discussed today) [21:06:40] oh god, the child being urgent made all of the tasks urgent, thanks redmine [21:07:15] well, if that means we get everything done and fixed this week... ;-) [21:07:55] if I get a freeipa vm, I might get it all deployed this month [21:08:32] although, I would rather love to be done with matrix and mailman first, because those are already started and pretty far along [21:10:07] and if I'm given additional year, we might migrate to openSUSE port of FreeIPA ;) [21:14:16] oh yeah, worth noting https://community.letsencrypt.org/t/2020-02-29-caa-rechecking-bug/114591 [21:21:25] that reminds me, I need to do make the same notice for Fedora Infra