| *** dolphm_503 is now known as dolphm | 00:04 | |
| *** nkinder has joined #openstack-keystone | 00:05 | |
| *** david-lyle has quit IRC | 00:13 | |
| *** thedodd has quit IRC | 00:13 | |
| *** topol has joined #openstack-keystone | 00:15 | |
| *** dolphm is now known as dolphm_503 | 00:16 | |
| *** amcrn_ has joined #openstack-keystone | 00:39 | |
| *** amcrn has quit IRC | 00:40 | |
| *** openstack has joined #openstack-keystone | 00:48 | |
| *** gokrokve has quit IRC | 00:49 | |
| *** gokrokve has joined #openstack-keystone | 00:49 | |
| *** chandankumar_ has joined #openstack-keystone | 00:50 | |
| *** topol has quit IRC | 00:54 | |
| *** gokrokve has quit IRC | 00:54 | |
| *** richm has quit IRC | 01:00 | |
| *** openstack has joined #openstack-keystone | 01:00 | |
| *** chandankumar_ has quit IRC | 01:08 | |
| *** chandankumar_ has joined #openstack-keystone | 01:08 | |
| *** achampion has joined #openstack-keystone | 01:14 | |
| *** openstack has quit IRC | 01:26 | |
| *** openstack has joined #openstack-keystone | 01:29 | |
| *** morganfainberg is now known as morganfainberg_Z | 01:30 | |
| *** stevemar has joined #openstack-keystone | 01:32 | |
| *** ChanServ sets mode: +v stevemar | 01:32 | |
| jamielennox | bknudson: the v2 and v3 auth plugins merged over the last few days. I had done everything you had commented on for v2 but i don't think you even saw v3. If you want to comment i'll fix your concerns in a new patch | 01:32 |
|---|---|---|
| bknudson | jamielennox: sorry I didn't have time to review it but since we were asked to look at the i3 stuff I've been reviewing that. | 01:33 |
| bknudson | and there's a lot of i3 stuff | 01:33 |
| *** nkinder has quit IRC | 01:33 | |
| bknudson | I liked it, it just was making non-backwards compatible changes. | 01:34 |
| jamielennox | bknudson: yea, i'm not trying to push - there is a lot to review, but you were fairly involved in the v2 one so i assumed you might have the same on v3 and it flew by | 01:34 |
| jamielennox | any backwards compat issues should have been fixed when it was rebased onto the v2 patch | 01:34 |
| *** gokrokve has joined #openstack-keystone | 01:35 | |
| *** marcoemorais has quit IRC | 01:48 | |
| *** stevemar has quit IRC | 01:52 | |
| *** dolphm_503 is now known as dolphm | 02:16 | |
| *** dstanek has joined #openstack-keystone | 02:20 | |
| *** ChanServ sets mode: +v dstanek | 02:20 | |
| *** zhiyan_ is now known as zhiyan | 02:21 | |
| *** david-lyle has joined #openstack-keystone | 02:37 | |
| *** dolphm is now known as dolphm_503 | 02:37 | |
| *** gokrokve has quit IRC | 02:42 | |
| *** gokrokve has joined #openstack-keystone | 02:43 | |
| *** gokrokve has quit IRC | 02:43 | |
| *** devlaps has quit IRC | 02:44 | |
| *** raies has joined #openstack-keystone | 02:54 | |
| raies | hi someone | 02:55 |
| raies | when I tried I tried following using admin user "curl -i -X POST http://10.0.9.40:35357/v2.0/users/36ea121ef93c4946baa33bd6ba1a094d/OS-KSADM/credentials -H "User-Agent: python-keystoneclient" -H "Content-Type: application/json" -H "X-Auth-Token: "<token>" -d '{"passwordCredentials": {"username": "TU1", "password": "Password"}}' | 02:57 |
| raies | then error 404 Not Found is displayed | 02:57 |
| raies | please someone help on this | 02:57 |
| raies | Actually I want to test credentials API | 02:58 |
| raies | and I tried above method but 404 error message is displayed | 02:58 |
| raies | so can someone help me here | 02:58 |
| *** Kanagaraj has joined #openstack-keystone | 02:59 | |
| raies | Kanagaraj: how to check credential APIs | 03:02 |
| raies | ?? | 03:02 |
| *** stevemar has joined #openstack-keystone | 03:03 | |
| *** ChanServ sets mode: +v stevemar | 03:03 | |
| *** devlaps has joined #openstack-keystone | 03:05 | |
| *** lbragstad has joined #openstack-keystone | 03:07 | |
| *** arosen has left #openstack-keystone | 03:08 | |
| *** arunkant has quit IRC | 03:14 | |
| *** devlaps has quit IRC | 03:15 | |
| *** devlaps has joined #openstack-keystone | 03:24 | |
| *** henrynash has joined #openstack-keystone | 03:32 | |
| *** devlaps has quit IRC | 03:40 | |
| *** henrynash has quit IRC | 03:44 | |
| *** chandan_kumar has joined #openstack-keystone | 03:45 | |
| *** henrynash has joined #openstack-keystone | 03:49 | |
| *** henrynash has quit IRC | 03:55 | |
| *** harlowja is now known as harlowja_away | 03:55 | |
| *** chandan_kumar has quit IRC | 03:57 | |
| *** achampion has quit IRC | 04:08 | |
| *** devlaps has joined #openstack-keystone | 04:13 | |
| *** devlaps has quit IRC | 04:13 | |
| *** devlaps has joined #openstack-keystone | 04:14 | |
| *** amcrn has quit IRC | 04:14 | |
| *** lnxnut has joined #openstack-keystone | 04:15 | |
| *** devlaps has quit IRC | 04:15 | |
| *** devlaps has joined #openstack-keystone | 04:26 | |
| *** devlaps has quit IRC | 04:26 | |
| *** openstack has joined #openstack-keystone | 04:38 | |
| *** lbragstad has quit IRC | 04:42 | |
| *** openstack has quit IRC | 04:48 | |
| *** openstack has joined #openstack-keystone | 04:50 | |
| *** chandan_kumar has joined #openstack-keystone | 04:54 | |
| *** openstack has joined #openstack-keystone | 05:02 | |
| *** david_lyle_ has joined #openstack-keystone | 05:02 | |
| *** marcoemorais has joined #openstack-keystone | 05:05 | |
| *** zhiyan- has joined #openstack-keystone | 05:06 | |
| *** openstack has quit IRC | 05:10 | |
| *** openstack has joined #openstack-keystone | 05:16 | |
| *** openstack has quit IRC | 05:22 | |
| *** openstack has joined #openstack-keystone | 05:23 | |
| *** openstack has quit IRC | 05:28 | |
| *** openstack has joined #openstack-keystone | 05:29 | |
| *** dickson.freenode.net sets mode: +ns | 05:29 | |
| *** dickson.freenode.net sets mode: -o openstack | 05:30 | |
| -dickson.freenode.net- *** Notice -- TS for #openstack-keystone changed from 1393565362 to 1377384024 | 05:30 | |
| *** dickson.freenode.net sets mode: +ct-s | 05:30 | |
| *** tellesnobrega has joined #openstack-keystone | 05:30 | |
| *** zhiyan has joined #openstack-keystone | 05:30 | |
| *** marcoemorais has joined #openstack-keystone | 05:30 | |
| *** david_lyle_ has joined #openstack-keystone | 05:30 | |
| *** lbragstad has joined #openstack-keystone | 05:30 | |
| *** dstanek_afk has joined #openstack-keystone | 05:30 | |
| *** Kanagaraj has joined #openstack-keystone | 05:30 | |
| *** raies has joined #openstack-keystone | 05:30 | |
| *** chandankumar_ has joined #openstack-keystone | 05:30 | |
| *** topol_ has joined #openstack-keystone | 05:30 | |
| *** YorikSar has joined #openstack-keystone | 05:30 | |
| *** bknudson has joined #openstack-keystone | 05:30 | |
| *** orion195 has joined #openstack-keystone | 05:30 | |
| *** jamielennox has joined #openstack-keystone | 05:30 | |
| *** jraim has joined #openstack-keystone | 05:30 | |
| *** huats has joined #openstack-keystone | 05:30 | |
| *** luisbg has joined #openstack-keystone | 05:30 | |
| *** rwsu has joined #openstack-keystone | 05:30 | |
| *** florentflament has joined #openstack-keystone | 05:30 | |
| *** amerine has joined #openstack-keystone | 05:30 | |
| *** harlowja_away has joined #openstack-keystone | 05:30 | |
| *** ChanServ has joined #openstack-keystone | 05:30 | |
| *** lari_ has joined #openstack-keystone | 05:30 | |
| *** morganfainberg_Z has joined #openstack-keystone | 05:30 | |
| *** dickson.freenode.net sets mode: +vvoo dstanek_afk jamielennox ChanServ morganfainberg_Z | 05:30 | |
| *** mhu has joined #openstack-keystone | 05:30 | |
| *** zigo has joined #openstack-keystone | 05:30 | |
| *** chmouel has joined #openstack-keystone | 05:30 | |
| *** koolhead17 has joined #openstack-keystone | 05:30 | |
| *** simo has joined #openstack-keystone | 05:30 | |
| *** dtroyer has joined #openstack-keystone | 05:30 | |
| *** Daviey has joined #openstack-keystone | 05:30 | |
| *** anteaya has joined #openstack-keystone | 05:30 | |
| *** mfisch has joined #openstack-keystone | 05:30 | |
| *** dolphm_503 has joined #openstack-keystone | 05:30 | |
| *** marekd has joined #openstack-keystone | 05:30 | |
| *** sudorandom has joined #openstack-keystone | 05:30 | |
| *** dickson.freenode.net sets mode: +vo morganfainberg_Z dolphm_503 | 05:30 | |
| *** dickson.freenode.net changes topic to "[ Icehouse Milestone 3 Bugs and Blueprints https://launchpad.net/keystone/+milestone/icehouse-3 ] [ Icehouse Feature Freeze March 4, Features must be merged ]" | 05:30 | |
| *** openstack has quit IRC | 05:34 | |
| *** openstack has joined #openstack-keystone | 05:44 | |
| *** Kanagaraj has quit IRC | 05:49 | |
| *** jraim has quit IRC | 05:49 | |
| *** chandankumar_ has quit IRC | 05:49 | |
| *** YorikSar has quit IRC | 05:49 | |
| *** huats has quit IRC | 05:49 | |
| *** florentflament has quit IRC | 05:49 | |
| *** bknudson has quit IRC | 05:49 | |
| *** jamielennox has quit IRC | 05:49 | |
| *** harlowja_away has quit IRC | 05:49 | |
| *** sudorandom has quit IRC | 05:49 | |
| *** tellesnobrega has quit IRC | 05:49 | |
| *** zhiyan has quit IRC | 05:49 | |
| *** lbragstad has quit IRC | 05:49 | |
| *** amerine has quit IRC | 05:49 | |
| *** topol_ has quit IRC | 05:49 | |
| *** rwsu has quit IRC | 05:49 | |
| *** dtroyer has quit IRC | 05:49 | |
| *** Daviey has quit IRC | 05:49 | |
| *** simo has quit IRC | 05:49 | |
| *** dolphm_503 has quit IRC | 05:49 | |
| *** mfisch has quit IRC | 05:49 | |
| *** koolhead17 has quit IRC | 05:49 | |
| *** chmouel has quit IRC | 05:49 | |
| *** zigo has quit IRC | 05:49 | |
| *** mhu has quit IRC | 05:49 | |
| *** lari_ has quit IRC | 05:49 | |
| *** ChanServ has quit IRC | 05:49 | |
| *** morganfainberg_Z has quit IRC | 05:49 | |
| *** raies has quit IRC | 05:49 | |
| *** orion195 has quit IRC | 05:49 | |
| *** marcoemorais has quit IRC | 05:49 | |
| *** david_lyle_ has quit IRC | 05:49 | |
| *** dstanek_afk has quit IRC | 05:49 | |
| *** marekd has quit IRC | 05:49 | |
| *** anteaya has quit IRC | 05:49 | |
| *** luisbg has quit IRC | 05:49 | |
| *** tellesnobrega has joined #openstack-keystone | 05:51 | |
| *** zhiyan has joined #openstack-keystone | 05:51 | |
| *** marcoemorais has joined #openstack-keystone | 05:51 | |
| *** david_lyle_ has joined #openstack-keystone | 05:51 | |
| *** lbragstad__ has joined #openstack-keystone | 05:51 | |
| *** dstanek_afk has joined #openstack-keystone | 05:51 | |
| *** Kanagaraj has joined #openstack-keystone | 05:51 | |
| *** raies has joined #openstack-keystone | 05:51 | |
| *** chandankumar_ has joined #openstack-keystone | 05:51 | |
| *** topol_ has joined #openstack-keystone | 05:51 | |
| *** YorikSar has joined #openstack-keystone | 05:51 | |
| *** bknudson has joined #openstack-keystone | 05:51 | |
| *** orion195 has joined #openstack-keystone | 05:51 | |
| *** jamielennox has joined #openstack-keystone | 05:51 | |
| *** jraim has joined #openstack-keystone | 05:51 | |
| *** huats has joined #openstack-keystone | 05:51 | |
| *** luisbg has joined #openstack-keystone | 05:51 | |
| *** rwsu has joined #openstack-keystone | 05:51 | |
| *** florentflament has joined #openstack-keystone | 05:51 | |
| *** amerine has joined #openstack-keystone | 05:51 | |
| *** harlowja_away has joined #openstack-keystone | 05:51 | |
| *** ChanServ has joined #openstack-keystone | 05:51 | |
| *** lari_ has joined #openstack-keystone | 05:51 | |
| *** morganfainberg_Z has joined #openstack-keystone | 05:51 | |
| *** dickson.freenode.net sets mode: +vvoo dstanek_afk jamielennox ChanServ morganfainberg_Z | 05:51 | |
| *** mhu has joined #openstack-keystone | 05:51 | |
| *** zigo has joined #openstack-keystone | 05:51 | |
| *** chmouel has joined #openstack-keystone | 05:51 | |
| *** koolhead17 has joined #openstack-keystone | 05:51 | |
| *** simo has joined #openstack-keystone | 05:51 | |
| *** dtroyer has joined #openstack-keystone | 05:51 | |
| *** Daviey has joined #openstack-keystone | 05:51 | |
| *** anteaya has joined #openstack-keystone | 05:51 | |
| *** mfisch has joined #openstack-keystone | 05:51 | |
| *** dolphm_503 has joined #openstack-keystone | 05:51 | |
| *** marekd has joined #openstack-keystone | 05:51 | |
| *** sudorandom has joined #openstack-keystone | 05:51 | |
| *** dickson.freenode.net sets mode: +vo morganfainberg_Z dolphm_503 | 05:51 | |
| *** openstack has quit IRC | 06:09 | |
| *** openstack has joined #openstack-keystone | 06:10 | |
| -dickson.freenode.net- [freenode-info] why register and identify? your IRC nick is how people know you. http://freenode.net/faq.shtml#nicksetup | 06:10 | |
| *** zhiyan has left #openstack-keystone | 06:27 | |
| *** jamielennox is now known as jamielennox|away | 07:07 | |
| *** andreaf has joined #openstack-keystone | 07:15 | |
| *** Kanagaraj has quit IRC | 07:23 | |
| *** saju_m has joined #openstack-keystone | 07:32 | |
| *** david_lyle_ has quit IRC | 07:45 | |
| *** marcoemorais has quit IRC | 07:55 | |
| *** marcoemorais has joined #openstack-keystone | 07:57 | |
| *** marcoemorais has quit IRC | 08:01 | |
| *** dstanek_afk has quit IRC | 08:02 | |
| *** topol_ has quit IRC | 08:12 | |
| *** andreaf has quit IRC | 08:15 | |
| *** andreaf has joined #openstack-keystone | 08:20 | |
| *** leseb has joined #openstack-keystone | 08:23 | |
| *** marcoemorais has joined #openstack-keystone | 08:26 | |
| *** bvandenh_ has joined #openstack-keystone | 08:28 | |
| *** marcoemorais has quit IRC | 08:30 | |
| *** marcoemorais has joined #openstack-keystone | 09:27 | |
| *** marcoemorais has quit IRC | 09:32 | |
| *** zoresvit has joined #openstack-keystone | 09:39 | |
| *** zoresvit has quit IRC | 09:40 | |
| *** zoresvit has joined #openstack-keystone | 09:40 | |
| *** zoresvit has quit IRC | 09:44 | |
| *** saju_m has quit IRC | 09:49 | |
| *** saju_m has joined #openstack-keystone | 09:50 | |
| *** xuhanp has joined #openstack-keystone | 09:58 | |
| xuhanp | dolphm_503, ping | 09:59 |
| *** xuhanp has quit IRC | 10:06 | |
| *** bvandenh_ has quit IRC | 10:22 | |
| *** marcoemorais has joined #openstack-keystone | 10:28 | |
| *** marcoemorais has quit IRC | 10:32 | |
| *** marcoemorais has joined #openstack-keystone | 11:29 | |
| *** marcoemorais has quit IRC | 11:33 | |
| *** leseb has quit IRC | 12:03 | |
| *** leseb has joined #openstack-keystone | 12:21 | |
| *** marcoemorais has joined #openstack-keystone | 12:29 | |
| *** topol has joined #openstack-keystone | 12:30 | |
| *** leseb has quit IRC | 12:31 | |
| *** marcoemorais has quit IRC | 12:34 | |
| *** dstanek_afk has joined #openstack-keystone | 12:53 | |
| *** ChanServ sets mode: +v dstanek_afk | 12:53 | |
| *** ayoung has joined #openstack-keystone | 13:20 | |
| *** dstanek_afk is now known as dstanek | 13:22 | |
| *** marcoemorais has joined #openstack-keystone | 13:30 | |
| *** marcoemorais has quit IRC | 13:34 | |
| *** leseb has joined #openstack-keystone | 13:51 | |
| *** leseb has quit IRC | 13:55 | |
| *** dolphm_503 is now known as dolphm | 13:58 | |
| *** browne has joined #openstack-keystone | 14:03 | |
| *** leseb has joined #openstack-keystone | 14:06 | |
| *** sdague has joined #openstack-keystone | 14:10 | |
| sdague | hey, so - https://bugs.launchpad.net/cinder/+bug/1285833 is hitting us in the gate about twice a day, and looks like a very not good race | 14:10 |
| sdague | I think I remember this issue before, where there is a race in token cache where it's not atomic, thus corrupting itself when running in a multi process environment (which the API server is always going to be) | 14:12 |
| dolphm | raies: i'm not actually sure if keystone implements that API... you might be interested in https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#credentials-v3credentials | 14:13 |
| dolphm | sdague: hmm, i'll try to reproduce | 14:14 |
| sdague | we're getting this about twice a day in the gate | 14:14 |
| bknudson | sdague: dolphm: I think I was looking at this just the other day with nova-api... there are multiple caches created. One per process. | 14:15 |
| dolphm | sdague: do you actually think it's new? | 14:15 |
| sdague | dolphm: it's got hits going back 2 weeks | 14:15 |
| bknudson | oh, no, this is different. | 14:15 |
| dolphm | sdague: but that's as long as the archive goes back, right? | 14:15 |
| sdague | so I don't think so. This just seems really like an old issue I remember around revoke cache | 14:16 |
| sdague | dolphm: correct | 14:16 |
| sdague | but also realize that with parallism lower in the gate now, we'd actually be finding issues like this less often | 14:16 |
| sdague | bknudson: how are the caches created? | 14:17 |
| dolphm | sdague: there's a couple caches in auth_token -- this one is just on disk per process unless you configure it otherwise | 14:17 |
| sdague | or more importantly, when are they created | 14:17 |
| bknudson | sdague: this was a different issue with in-memory caching of tokens, not the certificates. | 14:17 |
| sdague | dolphm: ok, when is that created? when keystone client loads, or on first call to it? | 14:18 |
| dolphm | sdague: i'm double checking... | 14:18 |
| sdague | because workers are spawned late | 14:18 |
| dolphm | sdague: on __init__ | 14:19 |
| dolphm | sdague: so, each worker would have their own cache unless you set [auth_token] signing_dir | 14:19 |
| sdague | and if you set signing_dir? | 14:19 |
| sdague | then there is no protection? | 14:20 |
| dolphm | sdague: if you set signing_dir, then they're probably racing to populate the cache | 14:20 |
| sdague | so, in the gate, we're always setting signing_dir | 14:20 |
| *** saju_m has quit IRC | 14:21 | |
| *** leseb has quit IRC | 14:21 | |
| dolphm | sdague: unsetting it might be the simplest solution, along with increasing revocation_cache_time to correspondingly reduce the load | 14:21 |
| sdague | so that seems like keystone client should be locking that access | 14:21 |
| *** leseb has joined #openstack-keystone | 14:21 | |
| dolphm | revocation_cache_time should be increased anyway, it's stupid low | 14:21 |
| dolphm | sdague: our default anyway | 14:22 |
| sdague | dolphm: I don't think it's acceptable to say "you can't set signing_dir and not race" | 14:22 |
| sdague | if it's a valid config option, keystone client needs to not be inherently racy here | 14:22 |
| sdague | sounds like it needs locking around cache access | 14:23 |
| dolphm | sdague: honestly i doubht there's not much gain to having it end-user configurable anyway (vs. just having each worker cache it themselves) | 14:23 |
| sdague | so if it wasn't configurable, where would yuo be putting it? | 14:23 |
| *** ayoung has quit IRC | 14:24 | |
| *** leseb has quit IRC | 14:25 | |
| dolphm | sdague: if you don't set it, it uses tempfile.mkdtemp() per worker (personally i'd rely on that behavior) | 14:27 |
| sdague | dolphm: so the use of signing_dir is *all over* all the documentation around openstack | 14:28 |
| bknudson | could keystoneclient do locking to avoid this? | 14:28 |
| sdague | bknudson: I would think so | 14:28 |
| bknudson | would that be an eventlet function or a lockfile or something? | 14:29 |
| sdague | dolphm: so if you are removing signing_dir entirely from keysteon | 14:29 |
| dolphm | bknudson: yes | 14:29 |
| bknudson | maybe there's an example somewhere | 14:29 |
| sdague | that's fine | 14:29 |
| sdague | but if you aren't, this needs to be fix | 14:29 |
| dolphm | bknudson: client side dogpile? | 14:29 |
| sdague | bknudson: yeh, oslo lockutils makes this pretty easy | 14:29 |
| dolphm | sdague: haven't heard of that -- looking... | 14:29 |
| *** marcoemorais has joined #openstack-keystone | 14:31 | |
| bknudson | I just wonder if we can use lockutils in keystoneclient ... it's got config options... where would it get them from? | 14:31 |
| dolphm | bknudson: auth_token gets CONF from paste | 14:32 |
| bknudson | dolphm: right, but lockutils registers oslo.config options -- http://git.openstack.org/cgit/openstack/oslo-incubator/tree/openstack/common/lockutils.py#n48 | 14:32 |
| bknudson | I guess we could copy the code and get rid of that part. | 14:33 |
| dolphm | bknudson: unless i'm misunderstanding, you should be able to set those options in the paste filter configuration | 14:33 |
| dolphm | bknudson: right next to the conf for signing_dir, for example | 14:34 |
| sdague | so if you want multi process support you need to set a lock path | 14:34 |
| sdague | because of the way it works with open filedescriptors | 14:34 |
| sdague | how is multiprocess locking done today in keystone? | 14:35 |
| sdague | or keystoneclient? | 14:35 |
| *** marcoemorais has quit IRC | 14:35 | |
| sdague | actually, hold on, the lockpath will be set in nova | 14:35 |
| bknudson | sdague: we don't do any... it's typically handled by the backend (database or memcache) | 14:35 |
| sdague | so keystone client will just get that | 14:36 |
| bknudson | or LDAP | 14:36 |
| sdague | bknudson: client side | 14:36 |
| sdague | not the server | 14:36 |
| *** ayoung has joined #openstack-keystone | 14:36 | |
| dolphm | sdague: possibly hacky, but we could just default the lock path to signing_dir? | 14:36 |
| sdague | dolphm: no, you should just let the caller set it | 14:37 |
| sdague | which nova will | 14:37 |
| sdague | or cinder | 14:37 |
| sdague | or any of it | 14:37 |
| bknudson | sdague: I don't think the client library itself would do any locking... and the middleware is obviously not doing it now. | 14:37 |
| dolphm | sdague: right, but i just meant as the default | 14:37 |
| sdague | bknudson: if the client is openning files, it has to do locking | 14:37 |
| sdague | dolphm: there is no default for a reason | 14:38 |
| dolphm | if OSLO_LOCK_PATH isn't set either | 14:38 |
| sdague | because if lockpath isn't secured correctly | 14:38 |
| sdague | it's a problem | 14:38 |
| sdague | there was a long thread on that a couple months ago | 14:38 |
| bknudson | if the application is already setting the config options for us then that shouldn't be a problem. | 14:38 |
| sdague | right, exactly | 14:38 |
| bknudson | isn't it going to say the options are already registered if keystoneclient tries to register the options? | 14:40 |
| lbragstad__ | would we need to register them? or do we just use them? | 14:41 |
| *** lbragstad__ is now known as lbragstad | 14:41 | |
| bknudson | lbragstad: the options are registered on import of the lockutils module | 14:41 |
| sdague | bknudson: that's a good question | 14:41 |
| bknudson | so keystoneclient would have a copy of lockutils and so would nova | 14:41 |
| sdague | honestly, oslo folks might be needed there | 14:41 |
| sdague | to understand | 14:41 |
| bknudson | so they'd both do CONF.register_opts(util_opts) | 14:41 |
| sdague | right | 14:41 |
| lbragstad | ah | 14:41 |
| sdague | let's go take this to -dev | 14:41 |
| bknudson | if lockutils was in a oslo.lockutils library rather then copying then that should be safe | 14:42 |
| sdague | yeh, if wishes were horses .... | 14:43 |
| bknudson | I could have sworn we made this safe when we did the rename of the file rather than writing to it. | 14:43 |
| bknudson | oh, that's the revocation list. | 14:44 |
| bknudson | maybe we need to do the same with the cert files, too. | 14:44 |
| bknudson | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/middleware/auth_token.py#n1342 | 14:45 |
| bknudson | and here's writing the cert file: http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/middleware/auth_token.py#n1374 | 14:45 |
| bknudson | it just overwrites the file. | 14:45 |
| bknudson | so if we did write to a temp file and then rename that should be safe. | 14:46 |
| bknudson | unless readers are closing and opening their file all the time. | 14:46 |
| sdague | bknudson: you tell me | 14:46 |
| sdague | because I don't know how often that's happening, because it's all keystone under the covers | 14:47 |
| dolphm | bknudson: two of them are used by openssl (certs), one is used by keystoneclient (revocation list) | 14:48 |
| dolphm | bknudson: they're all in signing_dir | 14:48 |
| bknudson | the revocation list happens more often, like every second | 14:49 |
| sdague | right, so basically from what I can see every write call in auth_token.py needs to be wrapped in something that makes it automic | 14:51 |
| sdague | be that locking, or tempfile renaming | 14:51 |
| *** leseb has joined #openstack-keystone | 14:52 | |
| * dolphm my brother is having a baby right now so i'm going to run away for a bit | 14:52 | |
| sdague | enjoy | 14:53 |
| *** dolphm is now known as dolphm_503 | 14:53 | |
| *** leseb has quit IRC | 14:53 | |
| *** leseb has joined #openstack-keystone | 14:53 | |
| *** leseb has quit IRC | 14:58 | |
| *** sdague has left #openstack-keystone | 15:16 | |
| topol | bknudson, so if I want to add some docs for the keystone CADF audit support for authentication is that patch considered a bug or do I just say the patch implements the audit blueprint I used to add the feature? | 15:20 |
| bknudson | topol: if the blueprint is closed already then shouldn't use the blueprint | 15:20 |
| bknudson | but if it's still open then can use it | 15:21 |
| *** richm has joined #openstack-keystone | 15:21 | |
| *** lnxnut has joined #openstack-keystone | 15:24 | |
| lbragstad | topol: I had to do that with the notification stuff too, after the initial implementation the blueprint was closed, so I had to create another one to use in the patch for notifications on trusts. | 15:26 |
| topol | lbragstad, for docs couldn't I just open a bug? | 15:26 |
| lbragstad | either or I guess. I did a blueprint since it was extending the use of notifications to OS-TRUST. I could see a bug working too | 15:27 |
| *** simo has left #openstack-keystone | 15:28 | |
| *** marcoemorais has joined #openstack-keystone | 15:32 | |
| *** stevemar has joined #openstack-keystone | 15:34 | |
| *** ChanServ sets mode: +v stevemar | 15:34 | |
| *** chandan_kumar has joined #openstack-keystone | 15:35 | |
| *** marcoemorais has quit IRC | 15:36 | |
| *** david_lyle_ has joined #openstack-keystone | 15:37 | |
| bknudson | topol: you can open a bug | 15:42 |
| bknudson | or just do it without a bug or blueprint | 15:42 |
| topol | bknudson, thanks! | 15:43 |
| *** nkinder has joined #openstack-keystone | 15:45 | |
| *** lbragstad has quit IRC | 15:50 | |
| *** topol has quit IRC | 15:54 | |
| *** leseb has joined #openstack-keystone | 15:54 | |
| *** leseb has quit IRC | 15:59 | |
| *** leseb has joined #openstack-keystone | 16:02 | |
| *** leseb has quit IRC | 16:16 | |
| *** leseb has joined #openstack-keystone | 16:16 | |
| *** YorikSar has quit IRC | 16:17 | |
| *** thedodd has joined #openstack-keystone | 16:18 | |
| *** leseb has quit IRC | 16:21 | |
| *** lbragstad has joined #openstack-keystone | 16:21 | |
| *** chandan_kumar has quit IRC | 16:29 | |
| *** leseb has joined #openstack-keystone | 16:30 | |
| stevemar | dolphm_503, dstanek can you take a look at the saml patch: we're at +2 so far, need another set of eyes on it: https://review.openstack.org/#/c/71353/ | 16:42 |
| dstanek | stevemar: sure thing | 16:42 |
| dstanek | stevemar: i some discussion about the empty policy the other day. is that OK to have? | 16:49 |
| marekd | dstanek: i think dolphm_503 liked it, ayoung eventually too | 16:50 |
| *** david_lyle_ is now known as david-lyle | 16:50 | |
| ayoung | stevemar, I'll +2 anything today | 16:50 |
| dstanek | marekd: what does it mean when it's empty? | 16:50 |
| marekd | dstanek: well, basically when i was trying to put rule_owner for instance, i was failing cause obviously a user doesn't exist in the backend. So I can access /OS-FEDERATION/projects just because I have a token, and nothing more. | 16:52 |
| marekd | dstanek: the call /OS-FEDERATION/projects is to list all accessible projects a federated user can access, as a member of set of keystone groups. | 16:52 |
| *** lbragstad has quit IRC | 16:53 | |
| marekd | dstanek: /OS-FEDERATION/projects or /OS-FEDERATION/domains..but i am using a shortcut here. | 16:53 |
| *** henrynash has joined #openstack-keystone | 16:54 | |
| dstanek | marekd: ah i see and if you don't have a token what is the expected status code? | 16:54 |
| ayoung | marekd, stevemar interesting concept of writing the controller in Assignments and mapping the route in the extension. I like that. | 16:54 |
| *** nkinder has quit IRC | 16:54 | |
| marekd | ayoung: cool! | 16:56 |
| marekd | dstanek: well, it should fail if the token is not present in the backend | 16:59 |
| ayoung | marekd, stevemar, I +2e . Didn't approve to give dolph a few to chime back in. If he doesn't, or gies you an IRC thumbs up, stevemar can push the approve button | 16:59 |
| dstanek | marekd: 5xx fail or a 4xx fail? | 16:59 |
| *** orion195 has quit IRC | 16:59 | |
| marekd | dstanek: let me check | 17:00 |
| dstanek | marekd: maybe there is a test already defining that behavior? | 17:00 |
| marekd | dstanek: there is not, just locally extended it and it looks like you get HTTP 401. | 17:06 |
| *** marcoemorais has joined #openstack-keystone | 17:06 | |
| *** nkinder has joined #openstack-keystone | 17:07 | |
| dstanek | marekd: is the documentation on line 44 https://review.openstack.org/#/c/71353/43/keystone/auth/plugins/saml2.py accurate? | 17:09 |
| dstanek | marekd: it doesn't seem to always set the identity_provider and protocol - and i'm not sure where to find the federated_token | 17:10 |
| *** gyee has joined #openstack-keystone | 17:11 | |
| ayoung | dstanek, If there is no token, the controller will not even let you into the method | 17:12 |
| ayoung | dstanek, that is the difference between @controller.protected with a rule of [] and no decorator | 17:12 |
| marekd | dstanek: yeah, you are right. at some point the token 'dictionary' was flattened, hence federated_token object was removed. | 17:13 |
| dstanek | ayoung: are you talking about authenticate? | 17:13 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L52 | 17:13 |
| ayoung | dstanek, nope | 17:13 |
| marekd | dstanek: about policies i guess | 17:13 |
| dstanek | marekd: ok, the doc confused me a little | 17:13 |
| ayoung | dstanek, policies | 17:13 |
| marekd | dstanek: sorry | 17:13 |
| dstanek | ayoung: ah, i gotcha | 17:14 |
| dstanek | marekd: looks like it's just a little out of date then | 17:14 |
| marekd | ayoung: BTW, what's the difference between policy '' and [] ? Something new and fancy, depicted by [] ? | 17:14 |
| marekd | dstanek: yes :( | 17:14 |
| ayoung | so anything with @controller.protected does a token lookup. If it is not present raise exception.Unauthorized() | 17:14 |
| ayoung | marekd, heh...I wish we had used what was supposed to be the standard for always pass, which is '@' | 17:15 |
| dstanek | marekd: also the identity_provider and protocol - should they always be set or only on an unscoped token? | 17:15 |
| ayoung | marekd, but, I mean "" | 17:15 |
| *** lbragstad has joined #openstack-keystone | 17:16 | |
| marekd | dstanek: also, the identity_provider and protocol variables are only set when dealing with unscoped_token. | 17:17 |
| dstanek | marekd: k, the docs to me seemed to imply that they were alway set | 17:18 |
| ayoung | stevemar, quid-pro-quo https://review.openstack.org/#/c/55908/ I merged in the SQL and RevokeByTree pieces. The majority of the patch is unchanged from the last bknudson review modulo I made the changes he suggested | 17:19 |
| marekd | dstanek: this docstring should be changed so it describes the situation appropriately. | 17:19 |
| marekd | dstanek: eventually :-) | 17:20 |
| dstanek | marekd: i commented and let it as a 0 - i do think that the docs should be fixed sooner rather than later | 17:25 |
| dstanek | s/let/left/ | 17:25 |
| marekd | dstanek: understood. | 17:25 |
| dstanek | marekd: ..and nice job! | 17:26 |
| marekd | dstanek: thanks, stevemar did a good damn contribution here as well. | 17:27 |
| *** lbragstad has quit IRC | 17:37 | |
| *** david-lyle has quit IRC | 17:39 | |
| *** openstack has joined #openstack-keystone | 22:50 | |
| morganfainberg | oh eavesdrop is back! | 22:51 |
| * morganfainberg waves at openstack | 22:51 | |
| morganfainberg | been gone most of the day | 22:51 |
| *** lnxnut has joined #openstack-keystone | 22:54 | |
| *** lbragstad has quit IRC | 23:02 | |
| krsna | morganfainberg, This is one of my first contributions. Just wanted to make sure I did things to desired specifications and requirements. https://review.openstack.org/#/c/77294/ Does that seem half way decent? | 23:19 |
| *** stevemar has quit IRC | 23:21 | |
| *** dolphm_503 has quit IRC | 23:24 | |
| *** wchrisj has joined #openstack-keystone | 23:30 | |
| ayoung_ | morganfainberg, do we have a way of converting a v2 token into a v3? | 23:30 |
| wchrisj | I'm looking for the Keystone v3 auth endpoint in my recent devstack install. Is there something I can do to activate that endpoint? | 23:31 |
| ayoung_ | wchrisj, nope | 23:31 |
| ayoung_ | there are no "versioned" endpoints | 23:32 |
| ayoung_ | there are only identity endpoints | 23:32 |
| *** ayoung_ is now known as ayoung | 23:32 | |
| *** openstack has quit IRC | 23:36 | |
| *** openstack has joined #openstack-keystone | 23:41 | |
| *** lnxnut has quit IRC | 23:43 | |
| *** richm1 has quit IRC | 23:43 | |
| *** lnxnut has joined #openstack-keystone | 23:43 | |
| *** dolphm_503 has joined #openstack-keystone | 23:43 | |
| *** dolphm_503 is now known as dolphm | 23:43 | |
| *** richm has joined #openstack-keystone | 23:49 | |
| morganfainberg | ayoung, uhm not really | 23:51 |
| *** lnxnut has quit IRC | 23:52 | |
| morganfainberg | ayoung, i mean you could just tell the provider to make you a v3 token from the v2 token id. | 23:52 |
| morganfainberg | ayoung, i _think_ that would work, might need a line of code change though | 23:52 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!