So, hi. Hello, everyone. My name is Martin, and I'm here today to explain how to integrate Active Directory with Keystone. First a bit about my background. I'm a tech writer at Red Hat, where I work on the OpenStack and Keystone and Neutron documentation. But before becoming a tech writer, I was actually a sys admin in Active Directory and VMware. So I imagine many of you are here today because you have an OpenStack environment and an Active Directory environment and you want to be able to integrate them together in some kind of meaningful way. And specifically, you want your 80 users to be able to use their username and password to log into OpenStack. Well, if you haven't done that kind of integration before, I might understand why, because under Keystone version two, you might have been expected to do a few things that you weren't exactly comfortable with. And well, I have an entire slide to explain those things, and so I'll get to that. But I will say that first I need to describe that this procedure is looking at the here and now today. So this is what customers are doing in Keylo and Liberty with Red Hat OpenStack seven and eight. This is how people are today in the market integrating with Active Directory. So first I'll explain what's being discussed in this talk. I'm going to give a very quick overview of Active Directory and Keystone, how they relate to each other for the purposes of this talk. I'm going to describe exactly what you needed to do under Keystone v2 and why you might have been unhappy with that. I'm going to talk about how Keystone version three solves all of those problems. I'm going to make a big deal about encryption using LDAPS, and then I'm going to also go over the steps that Windows admins would need to do, and then also what the OpenStack admins need to do to their Keystone and NOVA. I have a demonstration prepared in real time, and then we're going to look at just the high availability options to make this a bit more resilient. There is also a landing page for this presentation. You'll see the URL over there. So that's where I have a link to this guide that's the partner guide, have a link to the slides, and whatever else that I feel is relevant I'll throw in there as well. So if you feel like you need to take notes and everything, well, some more background is that there is a whole integration guide that we've created that talks how you can do this integration with IDM and Active Directory and just generic LDAP. So if you go to that page, you'll see a link to that guide, and everything I'm saying here gets unpacked in full detail right there. Cool. So a very short overview of Active Directory for purposes of this talk. It is, in fact, a Microsoft product, and it uses an LDAP back end to hold a central repository of user accounts, and these accounts get replicated in a database to a number of servers. These are known as domain controllers, described here as DCs. And so any changemaker on DC will get replicated across to another one. That's pretty handy. It is considered LDAP-compatible, and you can encrypt your LDAP lookup traffic using LDAP as encryption. So I just make a note there specifically to say that tested in my personal lab, but also if customers are running, I've seen customers using Server 2012 R2 for this integration, 2008 R2, and anecdotally, I've tested this myself with SAMBA4's domain controller emulation, and it actually works identically to what I've done before, but I suppose whether that's actually supported by your vendor or not, that's going to be a question for your TAM or SRM. So a quick overview then also of how Keystone fits into OpenStack. Keystone is essential to anything working in OpenStack. It performs AuthN and AuthZ services, so the AuthZ is using credentials and, oh no, sorry, I always get this mixed up. The AuthZ is with, no, I was right. The authentication is the user's name and password, and the authorization is how the Keystone validates it. You actually have access to the permissions that you claim to have. It's also the way that tenants are managed, so you can keep users segregated from each other and end points for all these services, how they would integrate with Keystone, it manages the end points, and specifically this validation is done with Keystone version 3 multi-domain. So if you're running Keystone version 2, you're going to need to use Keystone version 3 for this to work in order to get access to the multi-domain compatibility. So the old way that you might have seen on the Internet and a bunch of documentation out there is for Keystone version 2, and this is a long list of reasons why you might not have wanted to do this, so it required you to create a bunch of AD user accounts and instead use those service accounts instead of your local accounts that you are using for each component. So this, as you can imagine, resulted in a lot of concern for people because if you lose a lot of control over your IPv2 environment, if something happens to your service account while it's in AD, it could become disabled or some security policy gets applied that disables it or the password expires, you're going to have a bad time because that service could get impacted and not be able to start properly. I suppose also for political reasons, OpenSec admins are going to lose control of service accounts, you might not always like that, but then there are also things to make the AD admins uncomfortable because it required writing to LDAP and if you can avoid that, that should be the way to go. Also, yes, you'll see steps that require you to actually make changes to the AD schema, which is a major task that you can do to your AD environment. If something goes wrong, all authentication could potentially fail and to recover from that, you'd have to take the major step of shutting down all your domain controllers, powering one up, restoring from backup, then letting the good one replicate all its goodness back to the bad ones. Active Directory is unavailable for the duration of that, so if you can't avoid making changes to your AD schema, that's really what you want to do. Keystone version 3 solves all those issues that I've just described. Again, this is using the multi-domain support that is what enables this. You'll service accounts state locally in your Keystone database. There are no AD schema changes required and LDAP read only. These are all things that are going to make a lot of people feel more comfortable about this integration. Also, yes, if your domain controller becomes unavailable, it's going to not affect services. The service is going to keep running. Who will be impacted will be those number of users who have their user accounts in Active Directory and are expecting to be able to log into your OpenStack while they're not going to be able to. I'd describe later on how to make that configuration more resilient. Yes, encryption is important. Let me go back to the previous slide. You'll see, I'll just highlight there, user logs into Horizon and they authenticate with the username and password, and that goes through to Keystone. That's great, but what's going to happen is that Keystone is going to query the domain controller and that connection under vanilla default 389 lookup is not encrypted. So it's going to look like what I've highlighted here, clear text, SBC LDAP, password there and clear text for anyone to go and grab. This, yes, the result of just a TCP dump running on F1. So I think I've made that point really clear. I'm going to describe next how you can solve this and how you configure LDAP's encryption on both the 80 side and on the OpenStack side. So I think I've made that point very clear, encrypt. So here is all in one page, everything you need to do for LDAP's encryption. I will first give you a tour of, let's go over there. So here is the Active Directory domain controller. There's going to be a certificate. So your Windows admins are going to be very first step, step one, they have to go and export the certificate that they've configured. It's going to be the local and the local computer for that service. They're going to need to export out the certificate and they'll know it's the right one because they'll have set this up previously and it will be the one that's using server authentication. So they export that out as a, let's go back, as an X509.CER file that can use the GUI just to do that and then they securely send that to you. You can use whatever secure means are available to get that onto your OpenStack server and then you're going to convert it to a .pam file from the previously used CER. And then, I suppose for REL, you're going to copy it into that location and then update CHRUS and that'll make REL aware of it. If you're using a different distribution of Linux, you'll have equivalent steps. And then in order to get Keystone to use it, you're going to copy it, you're going to convert it again and then copy it over into that SSL search directory. So there's a later step where you configure Keystone to refer to that location. So I'll get to that. But here is the LDPS configuration on one page so that what I'm describing here isn't going to happen to you. Oh, yeah.  There is another little step that happens later on but it's pretty optional. So this is PowerShell code. So they're going to create a new AD user called SVCLDAP. Now, they can choose whatever name they want but I've just used SVCLDAP to give it more of a service account name. And this account does not need to have any special privileges. It doesn't need to be an admin account. Just normal user will do. Create it, set a password for it, enable it and then you would then create a new group called GRP-OpenStack. And that group is going to be the group where all the users that need access to this Active Directory, sorry, to the OpenStack environment, they're going to need to be members of that group. So create the group, then add the user that you just created into that group and then that will be all they have to do except for a little bit later. And then for the ongoing BAU of continuously adding more users to that group and removing them according to your business practices. So here I talk about what needs to be done on your controller. So if you're not using controller concepts, this would be on your Keystone server. You're going to configure SC Linux because obviously you're running SC Linux or you might have an equivalent but that's what you need to set on it. And then you need to create a domains sub folder. So this is a new Keystone v3 specific step. You create a folder called domains and then you give the Keystone service ownership of that.  And also what you see there is the back end is looking at my SQL. That's the bulletin for authorization. Yes. So some more steps you have to do on your controller. You're going to configure the local settings for dashboard. So what this is going to do is on your dashboard, it's going to look a bit different. I'll take you out here. So yeah, what's going to happen, what's going to appear there now is a new field called domain. And so when your user logs in, they're going to have to type in that domain. That field is not case sensitive, so they can use some variation that they're familiar with. And then as a result, they'll be able to log in with their username and password. I suppose once you've completed the rest of the steps, but that's going to be the change to the user experience. And so returning. So a step for the Windows admins, if they don't really know it, they're going to need to get the net bias name of their Active Directory domain. In this example, it's lab. And then you're going to create a corresponding keystone domain also called lab. It doesn't strictly have to be lab, but it doesn't strictly have to match what's in the AD domain, but that's going to be the field that gets entered here. So that's going to be useful for the users to keep that consistent. Okay, so you've created that domain. And so now on this page, these are all the steps that are going to go into this new keystone.conf file. So this is in the new domains folder that you've just created. You're going to create this new file called lab.keystone.domainname.conf. And here is everything on one page of what that file is going to look like. What I've highlighted and read over there are the settings you're going to need to think about that you're going to need to change. Everything else is underlined. You'd most likely be able to keep it as is. So the URL is LDAPS. As you can see on port 636, that's for the encrypted LDAPS port, not the 389. For user, you can see SVC LDAP is in there. So this is using the distinguished name. If you're not sure how to get your distinguished name in AD, I'll show you right here. Let's go out of that. So you can use tool called add see edit. And in add see edit, it gives you your same view that you have of your actor directory but with just more of the guts revealed. And you locate your SVC LDAP account and properties. So you find distinguished name. That is the value that you're going to paste in. So that easy. There's also power shell ways to do it. But I thought the GUI would be more representative because you're going to need to populate a few more distinguished name fields in there. Let's see. Okay. So here's what's cool is this is the user filter. So what this means is that you're giving the distinguished name of the GRP openset group that you created earlier. And the result of this is going to be that that is going to limit the visibility that Keystone is going to have to your actor directory. So when it does lookups, it's not going to pull down the entire database. It's only going to look for members of that GRP openset group. Much more efficient. And just gives you more control over who's getting exposed. Also, yes, this is what I mentioned before. You're going to specify the path to that TLS CA cert file that you converted from all those various formats before. Next slide. Yeah, you're going to give the Keystone service ownership of that of that file. And then so here I'm showing how you give the built in admin account access to that domain. So you get the UID of the of the lab that you just created of the of the lab domain that you just created. You get the UID of the admin account. That's the built in admin account because we're specifying domain default. And then you're pulling down a list of all the available roles. And then in that in that bottom step, you're tying this all together and creating a command where for the domain in lab and for user matching that UID admin, you're going to give them admin permissions. Yes, to that tenant. Yeah. So, oh yeah, so some some final configuration that you also going to have to do for your compute nodes, just kind of set them to use auth version v3 so that they're aware of Keystone v3 and then restart the necessary services in order for that to take effect. Oh yeah, so as a result of all that configuration, you can now go to your Keystone server and retrieve a list of all the active directory users. And what you're going to get back is a list of everyone that's in the member of the GRP OpenStack group. You're going to pull down a list of roles. And then in this example, user one who has that UID is going to be added to the demo project as a regular member and that's going to just make them a general user. So this is what this would have to be a BAU task for you. Anytime a user needs access to that, you just follow this step. Yeah. So as a result of all these changes, authentication is going to be limited to certain users in GRP OpenStack group. They need to be members of that group, of course. And the crucial authorization, what I just demonstrated over here, that is still managed by your OpenStack admins. Yeah. And by example, they need to be explicitly added to a tenant. I'll demonstrate all of that now. So I will just put the notes. So first of all, let me show you. So this is my my pack stack OpenStack environment. And here is my Active Directory server. This is server 2008 R2. And over here you can see a list of all of all the users that I've created. And you can see the GRP OpenStack group. You can see the members of that group is this bunch of users here, including SVCLDAP and Kate and Lisa and Timmy. So in theory now, when I run the OpenStack user list command for the domain lab, I can expect to see them come back. And yes, there they are. Lisa, Kate and Timmy, SVCLDAP. Also, also another way to pull down a list of users is using the LDAP search command. Let's see. So this bypasses, oh wait, I don't need to put in the correct magic word, which I have here. So this is just a raw dump from LDAP. This is a good way to test that you have that initial connectivity, because this bypasses what you've entered into the keystone.conf.  But you can see there's Timmy, there's Kate, Lisa and the GRP OpenStack group. Okay, so to demonstrate the workflow a bit, I'll create a new user, Dorothy. And then Dorothy needs to be a member of GRP OpenStack. So we'll get her in there. Okay. So now, when I do the OpenStack user list group, we should expect to see Dorothy in that list. And so there she is. So now, though, before we've done any kind of authorization, let's see what it looks like when she tries to log in. Let's see what happens because now the OpenStack admin hasn't gone and actually given her access to any tenants. Let's make that camel case. So you can see there, you're not authorized for any projects. So even though she can log in and it authenticates her, she's not getting anything because the OpenStack admin hasn't done that yet. So now let's demonstrate how we're going to give her that access. So we have Dorothy's UID. Okay. Let's pull down the list of the roles and then we're also going to get the list of domains. A product, project role? Yeah. Let's check the OpenStack. We're putting in Dorothy's UID and then making her an admin. So now, when Dorothy tries to log in again, she is now authenticating and she's able to, she has administrative access to the demo project. And she's able to do all the usual things you might expect. Yeah. Also, I'll show, so I mentioned all the service accounts before. There are all still within the default domain. So that's, I guess, the default domain is the default domain. That's where the service account remain untouched and not an AD. That is all I'm going to demonstrate. Quick talk about the high availability options available to you. Yes, you can do general DNS aliasing. So you can create a DNS aliases for one domain controller and then have it intermediary between the other so that you have to go in manually each time the one domain controller goes down and update that alias to the other IP address or the other domain controller. It's not really super ideal. Because there's going to be an outage while the admins realize that the server is unavailable and then they have to go in manually update the field and then also wait for it to propagate out. But it's an option I've seen people use. You can also have a hardware load balancer in between. But here we go, the comma separated list of domain controllers. So what I mean by that is in your keystone.domain name.conf file, just have a comma separated list here. So comma and then the full LDF string of another domain controller. So what's going to happen is that authentication is going to continue going to the domain controller until it becomes unavailable. And then keystone will send this queries on to another one. A few things about that sort of setup though is that you don't want the firewall on DC1 or an intermediary firewall to silently reject traffic from the keystone server. Because that can affect the way that keystone automatically detects the unavailability of that service. So just something to keep in mind. Yeah, as I say all the time, test these in your environment first. You don't want to wait until it's actually gone down before you know what's going on. Yeah, so getting near the end. So just to find a link again to the resources page, it looks like this. So I have the slides, I link to the guide and the event page and where I am on LinkedIn. So just everything on one. I'll update this with probably a link to the YouTube of this talk when that becomes available. And then also just to talk more about what's in the keystone integration guide. So it includes, yes, full detail of everything I described. I haven't covered absolutely every step. I've just highlighted the ones that you might have questions about. There are still a few things here and there that are going to need to be done differently. Also talk about how you can troubleshoot these things, steps along the way.  I talk about options for how you can do that. And yeah, because I'm a former SysEdman, I went and included things that you might get asked during the CAD meeting when your ITAL guys are going to ask you tough questions. Specifically, the impact. So just like the one liner that they need to say, you know, what exactly are you doing? Well, that's in there. And also talk a bit about the outage requirements. Yeah, this is where I've mentioned before, you know, these configurations are very similar for Red Hat IDM and for generic LDAP. And they are there in the guide. Let me actually pull up this guide I'm talking about all the time. So this is what it looks like. Active Directory integration. Key terms. I'll describe assumptions. There's the impact statement. All these steps in detail. And then yes, some troubleshooting. So then I do this all over again for IDM and for generic LDAP. So if you're integrating these things, I could suggest you look here as well. Cool. Oh, that's everything. That's the end. Thank you. Is there someone there with the question? Yes. Yeah. Okay. So that it works. So my first question is, since as you mentioned with the version three of Keystone service, you do support the case when LDAP server itself is read only? Yes. So yeah, in that case, it will cause issue because the internal OpenStack service account cannot be created in the LDAP server. So I know looks like we have the solution uses multi domain. So we keep the existing local service account with local domain. We create new domain for LDAP account. Yeah. So in those case, we would have secure the issues in case OpenStack service need to access some something across the domain to LDAP domain. No, no, but I can let Adam Young answer that one. He's he's got to. So it works. Yeah. Oh, I can, I can. You have a service user. I don't know. Here you go. There's actually a rule that says don't give Adam a microphone. Ask the Keystone guys are pretty strong about it. So what you have with thanks, Adam. Okay, like I said, so for those of you do know, I'm Adam Young Keystone core. I also work for Red Hat. I did the original LDAP implementation, which is why he's deferring to me here. But if what we say is different, he's done it more recently. And as I tell everybody, I lie. So verify everything that I tell you. Because I also don't remember which versions things work in which way it as far as that goes. There is no security issue because it only has access to OpenStack resources. Okay, so if you have, say a Nova user that stored in the sequel back end, which is where these local users go, it cannot get access to active directory type stuff for outside of Keystone. So I don't know how there would be a security issue there. Thought is in case the service account for no one, right? If there's any chance Nova service need to access user information, but those user information are in different domain. The domain is different from the Nova service account. So that's kind of like cross domain access, right? So this is domain as Keystone understands it, not a domain as in active directory domain. Yes, yes, the Keystone domain. So that's allowed. You can set that up in Keystone. When you do a role assignment, a role assignment can be across domains. You can say user in domain one has this role on domain two, stuff like that. So that's Keystone's job now, is to do these kind of role assignments, which is exactly what he was showing when he was doing the assignments there for project or for domain specific operations. Okay, one more question is I saw you demo the whole thing with the redhead version of OpenStack. So is there any compatibility issue, you know, if we test everything with the standard OpenStack version, when we really start to go to production, which we also use the OpenStack, your version, right? So something I took out of this talk, which is really cool, is I did not know that this could work with SON before. And so what I think the answer is going to be, we've been talking about how to do continuous integration for the LDAP stuff. We don't even have continuous integration for straight LDAP, which the active directory stuff is a subset of. We could potentially use SON before as the CI approach to making sure the active directory specific stuff works. And I think we're going to do that. So thank you. So basically, basically that means the redhead version of OpenStack is compatible with the standard version. Okay, sorry, one last question. I saw the demo and you use LDAP, but in your demo, you always have very small user list, but in reality, in big enterprise, right, we always have huge user list. So when you create, you know, user manager or the first step, you want to list the user, but with enterprise situation, that will not work. Oh yeah, I'd expect they'd be using OpenStack, sorry, PowerShell for access to that list. Yeah, we already had this issue because when we test this scenario, it doesn't work. We cannot list the user because it's huge. So what's the planning OpenStack to fix this issue? You're saying you can turn on paging. I'm going to say don't do that. I'm going to say don't list users in general. With Federation, you're not going to have access to the user list anyway. So the goal is to get away from list users as being something that you do. Now, it makes it really painful in order to do role assignments that we've got problems to solve there. None of this is actually directory specific. Also, your when you list users as some company who will remain nameless found out, if you don't limit the number of results that come back, your queries could take a really long time like hours to come back. So you probably on the AD and in LDAP side in general should limit the number of results that come on back. So there's a lot to be done there. Let's look at other people. Okay, I wanted to, I'm over here. Oh, wait. Oh, there you go. Yes. Sorry. So I know I think it's with Kilo that it's implementing some group based permissions, I guess. So my question is, you know, in order to grant when you created Dorothy or whoever the name was, you had to go in and grant them access to as an admin to a project. So is there ability to specify a LDAP group to have certain access into a project? I do know of people doing that. I actually just this last week I was attempting to replicate it in my lab. It does seem like that there could be customer demand for that because that's going to ease the workload. Absolutely done and it works now. When he added her to that, what would you call the group? A GRP. He could have created a role assignment on that group. So that as soon as you add Dorothy to that group, she could have logged in. He just created, he created an individual role assignment, but a role assignment in Keystone can be on either a user or on a group. And so long as the user has that group, there's return when they do the LDAP query, they will get a role assignment automatically. So yes, that works now. Is that a user or only Keystone? Essex? That's been there since LDAP support's been there. Okay. Thank you. So great demo. Thank you. I see from the demo you are doing authentication with LDAP and authorization locally. Yes. Is authorization also supported with LDAP like if we want user to be assigned a particular way? We removed it. What's the reason for that? Because LDAP is read-only. Yeah. Yeah. That people seem to really want their LDAP to be read-only as much as possible. You don't have LDAP schema that maps to things like roles very well. A group is essentially the same concept. So instead of trying to force custom schema into AD or whatever your LDAP server is, they use read-only to group-based role assignment. Thank you. Okay. So I saw that you used a kind of proxy account for the LDAP. So you had some user to log in and have an LDAP search in a given container for users and as a way to do the authentication. So for a general LDAP, you should have, give certain permissions for that user to read the password attribute of the object. Do you have to do this kind of thing for AD as well? No. So it's automatically granted, right? The reason he did it that way is because of most AD setups, you don't have anonymous. But if you had anonymous browsing there, then everything could be done anonymous. The only thing that's done as an explicit user is that when you log in as that user, it does a simple bind and that's how it authenticates the users. So that's not done as that admin account. That's done as that user's account and then that's dropped. And then the admin account that he set up there is strictly for like the list users and general capabilities. Yeah. Okay. So no extra ACLs needed for that? No. No. That was a general vanilla user account. Okay. Yeah. This game you laid out required you to create a group and active directory that was dedicated to the OpenStack users. Yeah. If you have a campus group that doesn't want to mess with groups like that, they don't care if you just use active directory for authentication. And they're ready to let you see everything. Is that doable? That will work too? I don't know. Yes. Or why wouldn't you do that? Is there a good reason not to do that? Just to limit who can get access to OpenStack. Yeah. Well, but aren't you controlling access to OpenStack on the OpenStack side? Yes. You have to assign them to a project. Yeah. Authorization can be in OpenStack. Yeah. You could, but there are some business practices that prefer having multiple layers of control over a single transaction. Can you go back to your config slide? Yes. That one. So you can see in here there's nothing that actually filters. You don't see group in there anywhere at all. A member of user filter. That's the one place you could drop that out. We don't have this right? It's in my national lab. Okay. Yeah. So my question is if you have 10,000 users is there something I should be looking out for? I heard less users. Is there anything else? Well, not from the AD side. Well, I suppose what's something to consider is that, you know, these lookups are going to be hitting a single domain controller. And so just having that second one in the list isn't going to have like round robin lookups to them, right? So yeah, you want to at least have some monitoring, performance monitoring of your DC. You might have to scale it up just adding additional resources. On the OpenStack side, I think. Oh, on the active directory side. Yeah. On the OpenStack side, I wouldn't imagine so. Oh, answer from paging. Paging is you need to consider everybody thinks it should be good. I will try it out. Thank you. Cool. I have two questions. First one, if you can go back to your config file for a moment. Yeah. Okay. So on their user filter, actually, sorry, on their user 3DM, say I specify our organization on unit because that's how pretty much will it be recursive? So will it search for the O use underneath it? Yes. Oh, okay. Yeah, yeah, because in V2 you couldn't search underneath. It was only in the static. Okay. All right. And the other question is, can I use global catalogs? So if I have three domains, and they all share the same parent, I can search from the parent to the global through each three. Like big companies where you have a search separated by continents. So I will use the global catalog. So I don't have to specify three domains. I set up the parent through a global catalog so I can say, look everywhere. Is that supposedly work? Oh, okay. Right, the only problem later is going to be if you pull 100,000 users. Right, then you have to do pages, pulling whatever. Right. That's massive. Yeah. Let me answer a slightly different question from what you asked though. Okay. Because if you don't have that single tree for all of those, some people probably in that case with the M&A, you can set up multiple domains where they're all looking at the same AD server, where the difference is the tree that you have there too. So it may make sense to say, if we have Bank of America just bought Chase, and so we still have Chase's after-directory out there, put that in its own domain specific back end like this, everything else is going to be roughly the same, but the trees that you use for those. Okay, thank you. I just want to jump in with a couple things. You've only said one thing here that's actually incorrect. Oh, yes. Which is you do not, even under the old stuff, need to change the schema. That was like the one rule I had in Violet that is, we had to work with the default schemas. So everything is in place that you could work with after-directory without doing the schema, even with the old way of doing things. I mentioned that because I actually saw docs that, multiple docs that actually prescribe schema changes. Yeah, I wanted to put that to race straight away. So, bullet in the brain, no matter what, you don't need schema changes. Why don't you ask your question and I'll get with the rest of the stuff. So, two questions really. The first one is, if I only have one directory regardless of its AD or not, do I have to specify a domain? Okay, so that was in the, my notion of what you had there. It's only on the horizon config where you do that. You can actually do two things. One, you can actually change the default domain. Now, so long as all your service users are using v3 as easy pointed there, those can still, the default, the ID will still be default, but Keystone will say, if you're asking for a v2 token, you can give it out that way. And so for a lot of backwards compatibility issues, that's an issue. So you can say that, you know, domain ID, big long UID is the default domain. In which case you don't have to make that change in horizon. The other thing that was in horizon, there's another config option that you don't know about yet, obviously, which says, here's the domain to you. So even though if I'm doing v3, I don't have that value there, and it pre-fills out the domain. Oh yeah, yeah, you can do that. So it's in the local settings file, an option to say, this is the domain to use for people logging in. I know there was once a time when I couldn't get that working, so I left it out, but sounds good. And then, just to, not to be the dead horse, but just to make sure I understand, going back to the authorization discussion earlier, so if I have a directory, again, not totally just AD, but if I have a directory with groups that I can use to manage authorizations, can I use those groups to manage authorizations for different roles inside a keystone? Absolutely, and I was almost tempted to have them pull up a demo again and show that that works. You can do a group based role assignment. Okay. So anything that comes through as a group will be available for role assignments. The reason why we don't push that that hard is because typically we say AD and LDAP is is read only and you're not going to have access to that information. If you do have that degree of power, then yes, you absolutely can use it. Now, the other thing you can do is you can assign users to groups in other domains and do all sorts of walking stuff where you can actually manage your groups within keystone, but that's beyond the scope and that's again, nothing AD specific. Yeah. Thank you. Thank you. The recording, so if you can. Oh, yeah. Yeah, thanks. To expand on that question, you were saying that in order to your question about the role assignment, that's if you change a schema within actual... No, no, no. I'm tempted to have you just show that. But no, it's the groups. Remember how explicitly I'm not used to the group? He was doing it because of this filter right here, but it's also going to show up in the list of groups that's returned when you do the query. The general pattern is this. You go to keystone and request a token as the end user. The first thing that's going to do is take the password you did and the user you have build it into the end and do a simple bind just to authenticate you. Then as that admin user that he added there, the user line they have in second, it's going to do list groups for users. Okay. And that's going to come back as a second list and you can do any group assignments based on what's returned there. So it doesn't show it here, but all of the user underscore attributes, there are a whole bunch of group ones too. So whatever type of group you're using, posits groups, whatever, you just tell it what attributes to do. So what's the membership attribute? It figures all of that out. One thing when using groups is to do group-based role assignment. Groups didn't exist in Keystone v2. So if you connect to do a role assignment over v2, you won't see any of the group commands with like the open stack client. So be sure to connect with v3 and you could do group lists from LDAP and you could do group-based role assignment. Another thing I want to clarify, v2 versus v3 is the API version. Every version of Keystone from I want to say Folsom or Grizzly onward supports both. You don't have to redeploy Keystone, you don't have to change anything there. The only difference is the auth URL that you use to talk to it. The standard auth URL ends with slash v2.0 or the ones in all the documentation. There's discovery that's supposed to work that you don't even have to add the version onto it. But if you want to force it to v3, it just ends in slash v3. Of course we need to v3.0 because, you know, why be consistent? But it's all, it's not a different version of Keystone. It's the versions of the Keystone API and they are both supported everywhere. Very few people know how to actually remove them. And those people avoided their warranty. Just to expand on the group thing again, does all this, the group assignments, does that work with AD nested groups as well? Yeah, we don't have the config up here for it, but there's query options for saying, what is the query that you do to get back the groups? So as long as it comes back in the query that you say, here's the groups that the user has, then yes, you will get those. Okay, just a quick question. Responding to a previous saying you had, so that you said that the first thing that what the user does, although the authentication is good, is that you bind to the LDA if it was a user? Is it? Yes. So that's the way to authenticate that. Don't you need to have a plain text password for that? Say that again? A plain text, a password is needed for that. The user does pass their plain text password in the token request. Yes. Is that an issue? Okay, but you, you don't have it in your hand. I mean. It's not stored anywhere. It's not, that's just so. So the way it works is it uses an LDAP simple bind. So the user passes their plain text password to Keystone. Keystone looks up the user, finds the DN, and then it attempts to actually do an LDAP bind as that user and passing the password. The hash comparison is done by Active Directory or whatever LDAP server it is. You don't need any, Keystone doesn't need any read access to the user password attribute. So the LDAP server does all of that. I, well maybe I'm wrong, but when I debug, let's say the communication to Keystone. So when I'm talking to a port of 5,000, I see some SH1 hashed password traveling over there. So it's not clear text. So could it be decrypted on the Keystone side? What is that? Well, this is the password. What I'm just authenticating to the, how do you answer it from a security perspective? Well, it's, the clear text password definitely is passed all the way through. So I mean, for what you're seeing with a hashed password, I'd be curious to know what that is, but you can't, you can't authenticate to AD or another LDAP server with a hashed password. You might be thinking of maybe Keystone doing some of its own hash in comparison, but LDAP, you have to use a clear text password. Yeah, yeah, yeah, definitely. Yeah, yeah, yeah, yeah. Okay. Okay folks, I think we're low on time. All right. Thanks very much. Thanks for attending. You're great.


if you are trying to keep the law, if you are trying to keep the 10 Commandments, my only question is, why in the world would you do that? There is a danger to people who might even have good intentions or maybe it might even reveal if they don't have good intentions at all. But there are people out there who name the name of Christ who are doing their very best to adhere to the law or at least doing their very best to adhere to the 10 Commandments. The problem with that is that is very dangerous and might get you a ticket to hell. Now I wanna make it clear, there is a difference between someone that is trying to keep the law versus someone who does not violate or offend certain tenants of the law. The difference is the person that's trying to keep the law is trying to guard, trying to regard it, trying to hold it, trying to make that be the reason why they either stay safe or become safe. That is a person that's trying to fulfill all the dictates and reach the lofty standards of perfection that the law dictates. The problem with trying to keep the law, even the 10 Commandments is that once you violate them, then you violated if you violated one, you violated them all. And then what's required once you violate that? Well, what's required if you violate the law is a sacrifice, two problems with that. One, the sacrifice that you would have to give according to the law is done away with. The only other sacrifice is for those who are not trying to keep the law. I understand that a believer would want to not sin. I get that. The problem is that's a hard issue to overcome and we should, as we live, we should sin a lot less than we did in the past. We'll never get to the point where we sin less and if a person says they do not sin, well then John says that person is a liar. But if you do, we do have an advocate for us. That is Jesus Christ, our Lord. He is our advocate. Now, the question was kind of broached to Jesus by a scribe. Remember, these are the people who at the time wanted to kind of test Jesus to see if maybe he was guilty of violating any aspects of the law. And so you would always have this constant friction, this battle between the Pharisees and the scribes. Well, in Mark 12, 29, one of the scribes comes him and asks him, verse 28, let's start there. He says, one of the scribes came and heard them arguing and recognized that he had answered them well, asked him, what commandment is the foremost of all? Jesus answered, he says, the foremost is hero Israel, the Lord our God is one. Now, we'll come back to that in just a second. But the interesting point is, notice what he did not go to. One, he did not go to the 10 Commandments. There is a knee-jerk response amongst Christians when they hear the word commandment, verse, go back to verse 28. When they hear this word commandment, entele, which means a command, a charge, a statute, teaching, they think naturally, 10 Commandments, commandment, commandment, 10 Commandments. And so therefore, when they hear commandment, they naturally go for some, naturally go to the 10 Commandments. Jesus's Commandments aren't only limited to the 10 Commandments. They are more exhausted than the 10 Commandments. And so even still, asking which commandment is the most important commandment, notice that Jesus did not go to the 10 Commandments. Instead, he went to what we call the Shema which is found in Deuteronomy 6. He says, the foremost of it is, here, oh Israel, the Lord our God is one.  He says in the second one, that is this, you shall love your neighbor as you love yourself. There is no other commandment greater than these. Why is that? Because in fulfilling that, everything that God would want you to do, everything that God would want you to adhere to, whatever he might not want you to violate, it's all covered in that. The problem with the law is you are helpless when it comes to trying to keep the law perfectly. And this was also reiterated in Matthew 20 to 36 when he says, teacher, which is the great commandment in the law?  And so he said the same thing that was stated in Mark chapter 12. So if you want to keep what God's commands are, what Jesus has commanded us to do, love him, regard him as one, love him, and then love your neighbor. Notice what he did not do. He did not run through the litany that sometimes people will do in going through the Ten Commandments. Does that mean we ought to intentionally violate or go against the Ten Commandments? No, obviously not. What it really means is that trying to keep the Ten Commandments doing our very best, making sure, I need to make sure I follow commandment one, follow commandment two, follow commandment three, follow commandment four, well it becomes tedious. What ends up happening is, just like with Israel, just like Paul tries to assess or understand, is you can't. You have an issue. Now with Israel, their issue was what? Their heart. God tells them circumcise their heart, they don't do it, they can't do it. So what does God's remedy? He says, I will circumcise your heart. And then as he says in Ezekiel 36, he says that I will put my spirit in you and I will cause you to walk in my commandments or my teaching or my statues. Same thing. And so having the Holy Spirit in you is all that's required. Because what does he say in 36 verse 27? That in having that, I will cause you. The word I say, I will cause, I will make you to walk in my teachings. Even if you're not fully sure what all of his teachings are, we're gonna get to that in just a little bit. But there's a problem that we have on the board. That is there are people that are intentionally trying to keep the Ten Commandments. There are people that are trying to keep the law in different aspects of the law. The problem is those that live by the law, they will also be judged according to the law and then ultimately die by the law. What we have today are modern day Judaizers. These were the people who wanted to compel the Gentile believers to become Jews or adhere to Judaism and then convert or then place their faith in Christ. But what they really had in mind was really still keeping the law. Now let's be clear. Many people who want to keep the law want to do so to show themselves. Want to have something to boast and to brag about. Not all, but many do. Some do so out of ignorance. Some do so because they think it's the right thing to do. But if they're honest with themselves, they realize they can't do it. They can't do anything but fail according to the law. When you compare your works, what you do according to the dictates of the law, you will fail 10 times out of 10. And then Paul brings this up with these Judaizers then, even for the Judaizers of today, because we do have modern day Judaizers in Galatians one. He says, I am amazed that you are so quickly deserting him who called you by the grace of Christ for a different gospel. Now think about it, this isn't just there because they were doing something that's unheard of. This is what we're even seeing today. You are abandoning Christ for a different gospel, which is really not another gospel. What is this other gospel? What the gospel is that it's Christ plus the law. It's faith in Christ plus keeping the law. This is which is really not another gospel. Only there are some who are disturbing you and want to distort the gospel of Christ. But even if we or an angel from heaven should preach to you a gospel, contrary to what we have preached to you, he is to be a curse. And so if there are people there that are teaching you that you must keep the law, people teach that you have to keep the 10 commandments. Paul says that person is a curse. Why? Because they're teaching another way to gain salvation other than the way that's been taught, which is placing faith in Christ. Now, Paul goes to even more detail as we go further into the ladies. Remember, this is the whole point of this letter because of these Judaizers that are coming. Notice what he says in chapter two, verse 16, knowing that a man is not justified by the works of law. Justified means to be declared right and treated as such, declared right by who? By God. So you are not in right standing by God because of the works of the law, doing or keeping the law, but by the faith, by the faith of Jesus Christ. Even we have believed in Jesus Christ that we might be justified by the faith of Christ and not by the works of the law. So not by doing anything of the law will it make you justified, for by the works of the law shall no flesh be justified. Now it's vitally important that we get what Paul is trying to say and relate what he's trying to say with what people are trying to say also today about keeping the 10 commandments, about keeping the law. We'll come back to the 10 commandments in a second, but apply that and see how that works in regards to this verse. Verse 17, but if we seek to be justified by Christ, we ourselves also are found sinners. Is therefore Christ the minister of sin? And what's his statement? Well, God forbid. No, he's not. For if I build again the things which I destroyed, I make myself a transgressor. For I through the law am dead to the law that I might live unto God. I am crucified with Christ. Nevertheless, I live yet not I, but Christ who lives in me. And the life which I now live in the flesh, I live by faith, by the faith of God who loved me and gave me himself or gave himself for me. So what's in us is Christ in us who's working in us. Not me trying to keep the law or aspects of the law. It's just simply me yielding to Christ and letting him work through me. In that, what will happen? Will I ever offend if Christ gets his way in me? Will I offend what God wants us to do? No, I will not. We'll come to that more so a little bit later, but go to verse three, chapter one.  So who's fooling you? Who's messing you up? He says this, this is the only thing I want to find out from you. Did you receive the spirit by the works of the law? In other words, did you receive the Holy Spirit by keeping the law? Any aspects of the 10 commandments included? No, obviously not. Are you so foolish having begun by the spirit which is by faith in Christ? Are you now being perfected, being kept, being completed by the flesh, by keeping the law, by keeping the works, by keeping the 10 commandments? Did you suffer so many things in vain? If indeed it was in vain, that is if indeed you are a believer. So then does he who provide you with the spirit and works miracles among you do it by works of the law or by hearing with faith? Now this should be pretty clear. Anyone that is trying to ingrain it, there's nothing wrong with the 10 commandments. There's nothing wrong with the law. There's nothing, as a matter of fact, Paul makes a point. There's nothing wrong with the law. The problem isn't with the law, the problem is with us, which is why we place our faith in the one who doesn't have a problem with keeping the law, who doesn't have a problem with obeying, who doesn't have a problem with sin. He has no sin problem. We do. Now look what it says in verse 10. For as many as are the works of the law are under a curse for it is written. Curses everyone who does not abide by all things written in the book of the law to perform them. So that now that no one is justified by the law before God is evident. The righteous man, the righteous shall live by faith. Understand, you are justified only by faith. Now listen to what he says in verse 12. He says, however, the law is not a faith. On the contrary, he who practices them shall live by them. That should be clear and it should be scary. If you practice those, if it is your goal, your aim, your desire to fulfill the law, if it's your desire to keep the commandments, you must live by them and all of them. And why is that scary? Because there is no other redemption that can be found in that because there is no sacrifice that God is gonna take from the law. The only sacrifice that he will take was what was given and you have decided that you are not going to follow that rather that you may say it in mouth, but indeed you're trying to keep the law which means you are cut off. As a matter of fact, what did Paul say in Galatians 5? In verse two, Paul says that if you receive a circumcision that is being a part of the law, Christ will be of no benefit to you and I testify again to every man who receives circumcision that he is under obligation to keep the whole law.  You who are seeking to be justified by the law, you have fallen from grace. Anyone that is trying to be justified by keeping the law, which part of the law, any part of the law, if you think I've got to keep this, this, this, this and this or this, I don't have to keep that but I got to keep this, it doesn't matter, you are cut off because if you only keep one aspect of it, you are required to keep all aspects of it. That is his point. Does that mean that there are no commandments of Christ that we should not keep? That's not what he's saying as a matter of fact, John 14.15 says, if you love me, you will keep my commandments. Again, don't have the need your response to think that he's speaking of the 10 commandments because what did he just tell us was his commandments? Well, he gave us two. Regard him as one, the Lord our God is one and love him with all your heart. Then the second one is to love your neighbors. If you do those two things, you are good. There's no problem that you have to worry about. Are you gonna keep both of those laws fulfilled perfectly? No, that's why we rely on the Christ that's in us. But are we saying that the 10 commandments are of no value? No, what it really is is a guide. Now here's the interesting thing. Every aspect of the 10 commandments and every aspect of the law that God wants us to adhere to today, they've been carried over. Think about this. All 10 commandments have been carried over, except for one, that is to keep the Sabbath. The Sabbath is not enforced. We are not required to keep the Sabbath. If you wanna keep the Sabbath, fine, you are not required to do so. Every other of the other nine, they all have been reiterated in some way, shape, or fashion. 1 Corinthians 8, 6, and Mark 12, 29 covers the first one. You should have no other guys before you. 1 John 15, 21, and Acts 5, 20. We cannot have any idols, that's covered as well. So here are the first two that have been reiterated in the New Testament. So should we have any other guys or any idols? Obviously not, because it's been told to us, to the church. What about taking his name in vain? Well, if you take it as just using his name flippantly, well, that's covered in the New Testament. Or if you think that it's just calling yourself a Christian when you really are not, that's also covered as well. Jesus said that, everyone who says to me, Lord, Lord. So however you take using the Lord's name in vain, that's also reiterated in the New Testament. What about out of your mother and father? Well, Ephesians 6 covers that. Do not murder. Well, 1 Peter 4, 15 covers that as well as do not steal. It's also covered in 1 Peter 4. Do not commit adultery. That's also covered in 1 Corinthians. And again, the only commandment of the 10 commandments that is not reiterated is to keep the Sabbath. Why? Because Jesus is our Sabbath rest. We are not trying to keep that. We are trying to keep him. We're trying to be in him, I should say, not trying to keep him. We are kept by him and that's the rest that we will enter into. But again, we're not called to keep any aspect of the law. As a matter of fact, when they were trying to figure out the church, these Jewish slaves of the church were trying to figure out what should happen to these Jews? What should they keep? What tennis of the law do they keep? If any, what burdens should be put upon them? What do they say? If we go to Acts chapter five, I'm sorry, verse 15, and I want you to notice this argument, this issue that comes up in the church. This issue is should the Gentiles have to observe the law of Moses, which is the law including the 10 commandments, should the Jews have to deal with any of that? What should we require the Gentiles to do? And remember, this is a Jewish led church at this time. The leaders of this church are Jewish apostles. And those which says in verse one of chapter 15, some men came down from Judea and began teaching the brethren, unless you are circumcised according to the custom of Moses, you cannot be saved. And when Paul and Barnabas had great dissension and debate with them, the brethren determined that Paul and Barnabas and some of the others should go up to Jerusalem to the apostles and elders concerning this issue. Therefore, being sent on their way by the church, they were passing through both Phoenicia and Samaria, describing in detail the conversion of the Gentiles and were bringing great joy to all the brethren. When they arrived at Jerusalem, they were received by the church and the apostles and the elders and they reported all that God had done with them. But some of the sect of the Pharisees who had believed stood up, saying it is necessary to circumcise them and to direct them to observe the law of Moses. Well, wasn't the law of Moses? Well, the first 10 things were the 10 commandments as well as the rest of it. And so the question is, were they supposed to adhere to? What was the church's response? These are the apostles who we have their writings and they're leading by the Holy Spirit. What was their response? Eventually, James stood up, gives a response and all of the church agrees with this. What he says, therefore it is my judgment that we do not trouble those who are turning to God from among the Gentiles. That's me, that's you. But that we write to them that they may abstain from things contaminated by idols and from fornication and from what is strangled and from blood. For Moses from the ancient generations has in every city, those who preach him since he has read in the synagogue every Saturday. Then it seemed good to the apostles and the elders with the whole church to choose men from among them to send them to Antioch with Paul and Barnabas. Judas called for Silas and Silas leading men and the brethren and they sent them by letter. Therefore we have sent Judas and Silas who themselves will also report the same things by word of mouth. For it seemed good, look what he says.  This is what the church has required the burden for them to adhere to. Notice what he says, verse 29. That you abstain from things sacrificed to idols and from blood and from things strangled and from fornication. If you keep yourselves free from such things, you will do well, farewell. What's missing, the 10 Commandments, what's missing, the law. All of this is what they require them to do. Why? Because if you are a believer in Christ, what do you have? You literally have the Holy Spirit in you. Why is that important? Well, we are supposed to walk according to the Holy Spirit. We are to walk in accompaniment with the Holy Spirit. What does the Bible say in Galatians 5? Verse 16, chapter 5, you know very well, walk by the Spirit and you will not carry out the desires of flesh. For the flesh sets the desires against the Spirit and the Spirit against the flesh. For these are in opposition to one other, so that you may not do the things that you please, but if you are led by the Spirit, you are no longer under the law. You are not under the law if you are led by the Spirit. If you're not led by the Spirit and you wanna keep the law, well, then have at it. If you wanna keep the law, do your very best. I wish you well. You're gonna fail, but I wish you well. Maybe you have what it takes. Maybe you have what no one else has ever found, the ability to keep the law. But as for the rest of us who are led by the Spirit, we will be led by the Spirit. And what will we not offend? We will not offend any aspect of the law because the law is not of our concern. Instead, we are led by the Spirit that's in us and we'll live by the Spirit that's in us. We will fail from time to time, but because we are not living according to the law, we're living according to faith in Christ, then our payment has been made. We have been ransomed, we have been redeemed wide by the blood of Christ. Anyone else who wants to live by the dictates of the law the dictates of the law requires that when they sin, that an offering must be given. God is not accepting offerings under the law.  However, that's different than the person who is living to Christ, who's living according to the Holy Spirit and doesn't want to do anything wrong. That's one thing, but your desires are two different things. One desire is to check the box to make sure that they haven't sin. And in that case, be like a Pharisee where they have something to boast about, whereas the other's desire is just to live for Christ because he's already checked off all the boxes. And remember what differentiates us from other false religions. They have to do things to be saved. All we have to do is place our faith in the one who did something for us. Amen.


Hello everybody hooded cobra commander 788 here and it's time for a patrons choice poll We haven't done one of these since before cobra convergence and since we've looked at a lot of cobra I wanted to give you some GI Joe options for an upcoming review This is a poll that will be conducted on patreon if you would like to vote in the poll Please check out my patreon Support at any level gets you the right to vote I will give you three options Just go to the poll on patreon and select the one you want The one that gets the most votes will be reviewed option one is lifeline version 4 from 1994 This is an often overlooked figure of a character that can be polarizing But I know some of you love lifeline So if you'd like to see a review of lifeline version 4 go to patreon and select option 1 option 2 is Wetsuit version 3 from 1992. This is another figure. That's often forgotten the version 4 figure from 1993 is very similar, so I may review both in the same video if this one wins So this one could be a twofer if you would like to see a review of wetsuit version 3 Go to patreon and select option 2 option 3 is the 1988 swamp masher That's right. It's the swamp masher again This thing loses every time I put it in a poll But I feel good about it this time if you would finally like to see a review of the swamp masher Go to patreon and select option 3 those are your choices We could stay with the 1990 theme for this year or we could delve into the 1980s with the swamp masher The choice is yours as noted You do need to be a supporter on patreon in order to vote Support at any level even one single dollar gets you the right to vote So please check out my patreon voting will begin as soon as this video goes up Which is monday august 31st It will end on friday september 4th and the winning option will be published on sunday september 13th As always if there is a tie i will break the tie But the swamp masher cannot win with a tie it needs to win outright in order to be reviewed So let's see if that happens. I look forward to seeing what you choose head on over to patreon voting starts now


We demystify what goes on behind the therapy room door. Join us on this voyage of discovery and co-creative conversations. This is The Therapy Show, behind closed doors podcast, with Bob Cook and Jackie Jones. Welcome back to episode 111 of The Therapy Show, behind closed doors. I know we were one, one, one. And what we're going to be talking about today is a therapy by Roat, the inexperienced therapist. I love that title, Bob. Yes.  But I fell for a lot, quite a long time that I was doing therapy by Roat. Me too. Because I didn't feel very confident. Yeah. And what I mean by therapy by Roat, it's a bit like, it's a bit like, I played chess for a long time. And recently I've stopped because it takes too much time up anyway. And when you play chess, what you do, there's three parts, three, it's like three games within one chess. You've got the beginning game, which is opening moves. You've got the middle game, and then you've got the end game. And one game leads to the one game, one leads to another game.  And so you've got some sense of competencies. So that is what you start, it's a bit like the opening moves. You cling on to those things like staying behind the clients, getting contract. Yeah, we have certain things that you're taught. And because of lack of confidence and experience, we cling on to that. That's what I mean by that. And I'm not saying that won't work at all because staying behind clients, getting contracts, therapy being, you know, paced at the right speed, awareness of attunement. They're all very important things to grasp hold of. And therapists that just starts out, or counsellors just starts out, they really have those cornerstones to hang on to. Yeah. Of course. In those early days, I think that it's important for the early beginning therapist to have these cornerstones to hold on to. And they may be the cornerstones that actually develop the therapy. And though it minimizes spontaneity, it takes away risk, but at least it provides security and safety. Yeah, absolutely. I remember in the early days feeling that, you know, therapy was very disjointed for me. I'd have lots of notes and I'd have lots of things planned and prepared. You know, I didn't really pay much attention to this is going to sound terrible. I did pay attention to what the client brought in the room, but I planned for my own peace of mind, if that makes sense. So it was like, you know, if they don't come with anything, what we're going to fill an hour for. So I would have a plan of how it was going to be. That's what I mean by therapy, by voting. Yeah. Yeah. And very important. So by the way, because you're then minimizing your own anxiety. Yeah. Well, it certainly helped me. It's a way of dealing with your own anxiety in the process. And important to have these cornerstones and structures and early plans of the way we see things.  And then the 20 minute chunk in the middle and then another 10 minutes at the end of it and how the actual time were and watching the clock to round it up. And yeah, it was very, very structured when I first started. I think it is for most people. And that's what I mean by therapy, by voting. And there's nothing wrong with that, especially if you're beginning. So you say structures to minimize your anxiety, to feel soothed. And in a way, you'll start eventually to move from a less anxious purse place. So you can actually hear the content of what the client is bringing. Absolutely. Yeah. And when you say it like that, I didn't hear a lot of what, well, yeah, I didn't, I wasn't in the room a lot of the time I was in my head more than anything. It's kind of like when you're learning how to drive, everything is disjointed and it's, you know, you know, looking in your mirror and pushing your gears down and doing all of that. And there just comes a point where it's, it's just more seamless. Yeah. It was a fair while, I think, before my therapy was seamless. I'm not even sure whether it is all the time now. No, it'd be odd if it doesn't. But I wanted, I think it's important for the podcast people to think, listening to us. Just to think about if you're still carrying on that process. You see, hopefully as you get more experienced, you'll feel more able to take risks away from the sort of road to all the structured sequence. Yeah. Allow yourself to go into the world of intuition. Yeah. The activity or even spontaneity, if you're going to keep clinging on those, so those cornerstones that I was just talking about, you know, pacing, achievement, involvement, all these different ones, then creativity, intuition, intuition, spontaneity can all fall by the way. There needs to be a sometimes, a sometime in your experience. I think this is a process, never an event where you start to take a risk away from the structured sequence of therapy, which you've been so used to. Yeah. Now, when does that happen, is the bit? I think that happens, as you become more experienced and you even perhaps, you know, develop some of your own style. Yeah. I think that's, that's important is when we start to develop our own style. Absolutely. Yeah. I can remember feeling really exposed when I was starting to try and make my own, because you, that's one of the reasons why we did this podcast behind closed doors, because you don't observe other people giving therapy. So we don't know how we're meant to do it a lot at the time. And there's never one way, but what happens in the training, people, and this is, in some ways there are many ways to train therapists, but this is how I was trained, I suspect you were trained, you learn different theories, different treatment plans, different ways of doing things. I was remembering in my early days of training, that book came out, Personality Adaptations. Yeah. Looking at the different adaptations, schizoid, paranoid, you know, historical. I've actually got that on my desk as we speak. I love that book. Yes, to you today and Personality Adaptations are my two most favourite books. Okay. I do not want you to hear what I'm going to say as a minimisation of this book. That's really important if it's one of your favourite books. So you have these different adaptations and different personality styles. And in that book, particularly, they talk about the best way to work with each particular personality style. So for example, a schizoid, somebody who's schizoiding and withdrawing, you would go a certain way and follow certain channels. And there's three different channels as the open door, the target door, the trap door. You're smiling, I suspect, because you know this book so well. You're describing me to a tee when I first started doing this. I would read that chapter on how to work with that personality type. Absolutely. So a client that sees the world through feelings is histronic. Therefore, you need to make sure that the open door is through feelings and then thinking XXX. And if you follow this path that is said in this book, this will happen and the person will get better. Yeah. And they're great structures to hold on to. Yeah. And I did hold on to them. And to know them and they may work. And that's, and what I don't want to happen, though, is the therapist follows those ways of being or that type of therapy for the next 30 years. No. It's okay to have it in their heads. Yeah. But I think to actually develop their own style, as well as sort of having the security and safety of following these particular processes is also important. Yeah. So even though that might be your favourite book, I know for absolute certainty that you have developed your own style and, you know, it isn't like that. That's what I'm just talking about. No, no, but I can't. Well, as you were talking, I can remember literally reading those chapters on how to work with all the different personality types in my early days. Yeah. And it was a security blanket that if all else fails, you know, to me, and I've got this knowledge, but you do learn to use your intuition and go with certain things that, you know, knowing what personality adaptation the client is, he's always helpful, but then using that, the way that I do it. Yeah. It's a wonderful piece of theory, as is so many other pieces of wonderful pieces of theory. Yeah. You know, the different modalities.  Yeah. Yeah. Absolutely. Yeah. And everybody's different. Everybody is unique when they come in and to just do the same thing with every client, day in, day out. It's not, there's something that kind of came up for me when you were talking then. And I'm thinking, I actually miss part of it. Being an experienced psychotherapist now, I have just realized that sometimes I lose touch with a client who's new that's coming in, that it's new for them, that they haven't experienced any of this before. And I think I'm thinking though that I miss an opportunity to put them at ease. And I need to start doing that with new clients. Because me being a new therapist, when I was seeing a new client, I think we met on the same, do you know what I mean? Just familiarizing ourselves with the space and the room. And I always offered them a cup of tea or coffee now if they're a new client, but just to give them time to acclimatize to being in the room. I don't think I give them the opportunity to do that anymore. Yes. It's interesting that you can pick up on that and think of yourself, well, this is the loss perhaps. Yeah. When I moved to this sort of experienced place, that you're sort of feeling the loss of perhaps those early days. Yeah. I haven't thought about my early days for a long time, but I think, I think, you know, in the assessments I do at the Institute, I do a lot of them, where I assess, I make an assessment in half an hour of, you know, what they want and we talk between each other. And then I pass them on to a therapist of their choice. Quite often, I say, as they're telling their story and everything, I often say, you know, in the psychotherapy business, two and two doesn't necessarily make four. Even though we can look at like this, this way, sometimes makes five. Yeah. Yeah. You know, I've said XXX, when you go to your new therapist, just take that as a hypothesis. Yeah. A black and white process. And again, I know it's very important for people who are trained to be a psychotherapist to learn these theories, to be able to talk about clinical, you know, clinical work and to a clinical theory into practice. And I know it's a whole process, a bit like that, what you talked about learning to drive. Yeah. And she would do that.  Because one of the things I want to go into this podcast is sometimes if we follow everything by rote, we lose the person in front of us. Yeah. We lose the relationship with the client because we're more concentrated on these theoretical structures. Yeah. I think, for me, one of the things in the early days, and I can actually remember taking this to my supervisor, was a huge fear of mine, what if I get it wrong? That really was my biggest fear. What if I cause more damage in that room and get it wrong? Yeah. They can't fear when we start seeing our early clients. And what did your supervisor say? I think she actually said that you can't do any more damage to them, rather, you know, more than what they're coming with, if that makes sense.  And I think it was, I just needed some sort of reassurance, but that was my biggest fear is that I would, yeah, I would do more damage. I wanted to get that reassurance. I agree with your supervisor. It's kind of like my son, I can remember he was in the military, as were you, Bob. And I used to worry about him and he used to say to me, I've been trained how to do this, Mum, I know what to do. And I think that's what it all comes down to, is having the training.  Yeah, I was watching a program on television about the training of the Marines. And when I was in the army, it was the people were those sort of crackers, I thought, forward to actually want to be commandos or whatever it is, at the high level. And I was watching the program about what commanders in their early training to get the green beret have to go through. They're green berry and my God, there are four days of, you know, really physical things that they have to do, as well as using a lot of other things. But what the person said at the end of it, as they gave the green berry to these people who have gone through all these physical trainings and everything else, they said, okay, now you've got the green berries, it all begins, you know, life begins. However, you will have had this training repetitively over the last year, which will be you will integrate. I don't think you said that word, it's mine, and hold you in good stead when you're actually in the field. And in this way, it's the same raw training. That's exactly how it feels. You're out in the field and you've had the training. Yeah, absolutely. So the training is the structures.  And I hope, move away from that by road, or at least if you are going to continue that way, to develop your own style and, you know, maybe take some clinical risks with your supervisor's advice and develop levels of spontaneity in your own way of being in the therapy room. Yeah. But your training is the starting point, isn't it? Yeah, absolutely. And it is, it's having that grounding that you can always fall back on, that you know the stuff. Yeah, you're not making it up. You've done the training. Well, Scopied came out. Well, perhaps I won't go down that road. But I think it's very important that training isn't just six weeks or six months. You know, I think to be a competent psychotherapist, you need four or five, six years. Yeah. You need, because of the reason we're just talking about here. Yeah. Yeah. When I look back, there was something I saw on Facebook the other day. I think it was, you know, NLP training in a weekend and cost you $7 or something. And it was, it was scary to think that people would use that and then start potentially to see people. Now, the more comprehensive training, the more competent training, the more you'll have the platform to be able to use your imagination, creativity, spontaneity and all the things I've just been talking about to develop your own style and have your own originality in the world of therapy. Yeah. That might be an interesting podcast about how do we find our own style?  Some people get me and some people don't. And I'm okay with that. I know I'm not for everybody. I think one of the ways, by the way, is having the courage to take risks with clinical support, you know, with the soup.  And it's always for the good of the client as well.  It's got to be for the benefit of the client. Yeah. Yeah. So, so, so that's taken as well. I hope, but you are right, there's many narcissistic therapists, unfortunately, who they keep their ego in the room and lose sight of the client. But in the service of the client is a very important sentence. Yeah. But yeah, I think it's good to find our own style and our own unique way of, you know, doing the wonderful training that we all get at MIP in Manchester. And you know, if you see therapists or things, can you tell that they've done your training or where they've had training? Oh, interestingly, now I can. So when I used to go to conferences, well, still go to conferences, you know, go to TA conferences, take that, or integrative conferences, but talk about TA conferences, because I've been in a lot of them. When I, the most important thing isn't, you know, about, well, the most important thing when you're talking about TA therapist is just so somebody says they're a TA therapist. It's like, where did you train? Because wherever they trained will be the style of TA that they then incorporate. Yeah. So at MIP, it's a very relational, integrative psychotherapy training. Which has TA as its bedrock. Whereas you can might go somewhere else, where it's much more redecisional or it's more a shorter or whatever, but it has a different style to it. So yeah, the answer is yes. I could usually tell the way they talk about how they work. Because that's a bit, if you're going to come here, you're going to put relationship, relationship top and you're going to think about integration as the, as the goal for cure. Yeah. And you'll, TA will be the bedrock for that. Whereas that might not be the way to another training institute. The one thing I do know though, psychotherapists have four or five, six years of training before they get, say, UPACP registered. They get a really good comprehensive training to be able to learn and practice and develop their style. Yeah. And again, you know, one of the things that I always sing, you know, the Manchester Institute of Psychotherapy Praise is that, you know, we passed our competencies at kind of at the end of year two, but then we're still in training for another two years. So we're handheld for the next two years, which I thought was absolutely amazing. I feel sad when people go through, say, two year training or one year training, because they don't have the support of training. I think training support, if you like, they left alone, defend for themselves. They haven't, they haven't got that backup of training. Yeah. I think that's so important when we're talking about developing our own style and being able to encompass, you know, therapy by roads, as well as our own unique, original style. Yeah. Absolutely. So you've got your own style and I've got my own style and we're both trained in transaction analysis. And it's, it's a process and never an event. What I'm talking about here. I use that quote so many times, Bob. It's a process, never an event. I've said it for 40 years, but I think it's very apt in the world of psychotherapy. Yeah, absolutely.  That's absolutely true. Yeah. And it, you know, there is, I can remember moments of imposter syndrome and thinking, I haven't got a clue what I'm doing.  It's about taking it to supervision.  I can remember referring on, you know, if I had a client that I knew I wasn't capable of working with that I would refer them on. So it's, it's about knowing your limitations in the early days as well, I think. Yeah. And I think throughout the whole of my reign of being a clinical psychotherapist, supervision and my own therapy were pivotal in giving me that sort of ability of self-reflection, security and confidence. So I didn't, I wasn't on the road by myself. Yeah, absolutely. I had somebody with me who was part of the process. Yeah. And having your own personal therapy, it's a form of self-care as well. I think it's, you know, it's, it's good, it's a good modelling role to your, you know, clients. Oh, it's, you know, it's absolutely essential. Yeah. Everybody should have therapy, Bob. Totally agree. Yeah.  Yes. Yeah. And money. So I think you're completely right. Everybody should have therapy. And then there's the whole process of how do people get therapy who, you know, haven't got that affordability, appelless. Yeah. Absolutely. The waiting lists are so long at the moment as well. So I'm not sure what we're doing next time, Bob. I sent you another big list. You've sent me another big list. I've got a few ones here. And one of them is working with loneliness as a clinical condition. Yeah, that's a good one. Another one is loving hating therapy. Let's do both of those. One of my favourite records of all time, the probably, perhaps was why I picked this title, but it's up to therapy, was by Leonard Cohen. And the album was called Love and Hate. And it was all, all the songs were quite, I don't know what they were, but they were about love and hate in life. My dad always said that there's a very thin line between love and hate. And I never understood what he meant until I was an adult. I thought he was spot on. You say it in the therapy room a lot. Yeah. I thought that would be good. So I certainly like to talk about that. And I'd also like to talk about, you know, the concept of loneliness in the therapy process and how it's presented. It comes up and what we do about it. Yeah. Those two good ones. Okie doke. Right. So until next time, Bob, thank you so much. Yes. Goodbye, everybody. And of course, to you, Jackie. Take care. Bye-bye. Bye. You've been listening to The Therapy Show, behind closed doors podcast. We hope you enjoyed the show. Don't forget to subscribe and leave us a review. We'll be back next week with another episode.


I'm James Anderson. I'm 84 years old. Through the years I've always done repair work. I've enjoyed just taking things apart and seeing how they work. Death goes way back to childhood when I took apart an electric plug and my grandmother's floor lamp and promptly blew out all the fuses. I've had a computer since the days of what we call then transportable computers, a lug-able computer, weighed as much as my wife's sewing machine that I carried around. So I've had owned a computer since probably the mid-1980s and I've always been interested in using them, although I'd never been an IT person. I'd never had any training in it. I work at Free Geek. I learned about Free Geek from my friend Bob, who was a neighbor. I had just returned from working for 13 weeks in Zimbabwe. I saw the need for computers among young people who were studying and who seemed deprived to me of the opportunities that computers offered them. So when I heard about Free Geek and its program of receiving donations of used computers and the possibility that through rebuilding them I would be able to provide computers to some of those young people. After a couple of years here I moved into rebuilding laptops and since I've been rebuilding laptops we've sent well over 100 laptops to various African nations and to be used in schools and by non-profit organizations. Free Geek makes a huge point of being open source. So every PC computer here goes out with Linux-based. That's hundreds and hundreds and hundreds. This is just one room with our laptops waiting to be repaired. All of these that are working will go out with Linux-based operating systems. My continuing goal in being at Free Geek is to provide the laptops for Africa and the kind of problem solving that's involved. You've run into an issue with a computer and I find it very rewarding to solve that problem. I like the tinkering but above all I just simply enjoy the community. It's an unusual place and the results are very rewarding. So as long as I'm able I think I will be here on Fridays as long as they'll let me and I have no indication that they won't.