| *** leseb has quit IRC | 00:03 | |
| bknudson | are we going to have blueprints go through gerrit? | 00:03 |
|---|---|---|
| morganfainberg | hmm? | 00:03 |
| bknudson | looks like nova is going that way | 00:04 |
| bknudson | https://review.openstack.org/#/c/79363/ | 00:04 |
| morganfainberg | oh, interesting. | 00:04 |
| morganfainberg | bknudson, so, i'm not seeing how that is massively different than what we're doing with the identity-api stuff? | 00:05 |
| morganfainberg | bknudson, i guess i'll need to see it in action | 00:06 |
| bknudson | one difference is they don't have apparently random people with +2 in the repo | 00:06 |
| morganfainberg | bknudson, i don't see that as a large benefit, i think something like storyboard will really be the winner | 00:06 |
| bknudson | I'm surprised they're going this way with the storyboard work going on. | 00:07 |
| morganfainberg | yeah | 00:07 |
| morganfainberg | i'd say we shouldn't do that if storyboard is going to get traction | 00:07 |
| morganfainberg | in fact, i'm pretty against this kind of setup. | 00:07 |
| morganfainberg | git feels like the wrong tool for the job | 00:07 |
| bknudson | morganfainberg: for example https://review.openstack.org/#/c/73179/ | 00:16 |
| bknudson | who are Andreas Jaeger and Lana Brindley? | 00:16 |
| morganfainberg | no idea | 00:16 |
| morganfainberg | doc folks | 00:16 |
| morganfainberg | it looks like | 00:16 |
| jamielennox | Lana is docs | 00:17 |
| jamielennox | not sure about andreas | 00:17 |
| bknudson | it just seems strange that they can approve changes to the identity API | 00:17 |
| jamielennox | why did they call it nova-specs compute-api seems better | 00:17 |
| morganfainberg | jamielennox, they already have compute-api | 00:17 |
| bknudson | jamielennox: I think it's for their blueprints. | 00:17 |
| morganfainberg | bknudson, they must have magic docs powers | 00:17 |
| morganfainberg | bknudson, because they must have inherited permissions | 00:18 |
| morganfainberg | oh isee it now | 00:18 |
| morganfainberg | everyone here https://review.openstack.org/#/admin/groups/30,members has +2 to identity-api | 00:18 |
| morganfainberg | since they are doc-core | 00:18 |
| bknudson | morganfainberg: now I know who to ask next time I want to make a change. | 00:19 |
| morganfainberg | lol | 00:19 |
| *** Yash has joined #openstack-keystone | 00:20 | |
| Yash | Can I make the user re-authenticate after some minutes by either making his token to expire or by making the user disabled? | 00:21 |
| Yash | I am using python-keystone client | 00:22 |
| bknudson | Yash: delete the token | 00:22 |
| Yash | bknudson: So, taht will force him to be navigated to the login page?> | 00:23 |
| bknudson | Yash: login page? | 00:23 |
| Yash | bknudson: login page of openstack | 00:23 |
| Yash | bknudson: what I a trying to do is...once the user is logged in..im starting a timer..and after some time..i want him to logout | 00:24 |
| bknudson | Yash: I don't know how that works... could ask the horizon folks. | 00:24 |
| Yash | okay.. | 00:24 |
| Yash | what will be consequence of deleting the token? | 00:24 |
| bknudson | the token will be invalidated so it can't be used anymore. | 00:24 |
| bknudson | there's other ways to invalidate a token... disabling the user would do it too | 00:25 |
| Yash | ok......DO you know how to do it using python-keystoneclient? | 00:25 |
| bknudson | looks like we don't have a v3 api for it for some reason. | 00:26 |
| bknudson | Yash: http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/v2_0/tokens.py#n59 | 00:26 |
| bknudson | looks like there's a token delete operation | 00:26 |
| Yash | yes | 00:29 |
| Yash | so..i use this command to authenticate the user | 00:29 |
| Yash | keystone = client.Client(username=username, password=password,tenant_name=tenant_name, auth_url=auth_url) | 00:29 |
| jamielennox | that's a client side solution, isn't there a token expiry length you can set in keystone? | 00:29 |
| jamielennox | [token] expiration = (in seconds) | 00:30 |
| jamielennox | though that will affect everyone | 00:30 |
| Yash | let me see | 00:30 |
| Yash | jamielennox: where do i find it? | 00:30 |
| jamielennox | that's in /etc/keystone.conf | 00:31 |
| Yash | jamielennox: i want the token to expire only for a specific user..not for everyone | 00:31 |
| jamielennox | as i said that's a global setting so you can say that everyone's token is valid for only an hour | 00:31 |
| jamielennox | yea, not sure how to do that one | 00:31 |
| Yash | what kind of object do I call delete on/ | 00:35 |
| Yash | ? | 00:35 |
| Yash | bknudson:?? | 00:35 |
| bknudson | Yash: it's not something I've ever tried... haven't used the keystoneclient API much | 00:37 |
| Yash | ok..no problem..thanks :) | 00:37 |
| *** wchrisj has quit IRC | 00:39 | |
| *** wchrisj has joined #openstack-keystone | 00:41 | |
| *** wchrisj has quit IRC | 00:43 | |
| jamielennox | morganfainberg: can you resurrect your kite in stackforge patches? | 00:49 |
| jamielennox | i think dolphm had one of them as well | 00:49 |
| jamielennox | i'm pretty sure we are going barbican-core for the owner though | 00:49 |
| jamielennox | or actually leave it as kite-core and then we can add barbican people | 00:50 |
| *** marcoemorais has quit IRC | 00:52 | |
| *** wchrisj has joined #openstack-keystone | 00:55 | |
| *** devlaps has quit IRC | 00:55 | |
| *** browne has quit IRC | 01:00 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Update sample config https://review.openstack.org/78024 | 01:09 |
| *** stevemar has joined #openstack-keystone | 01:13 | |
| *** marekd is now known as marekd|away | 01:15 | |
| morganfainberg | bknudson, i'm about to propose a fairly sizable refactor of tests | 01:15 |
| morganfainberg | bknudson, eliminating a bunch of files | 01:15 |
| morganfainberg | it might have overlap w/ yours | 01:15 |
| morganfainberg | bknudson, so lets 2x check :) | 01:16 |
| bknudson | morganfainberg: the only way you could get rid of backend_sql_disk.conf is if you're configuring the connection some other way | 01:17 |
| bknudson | in the code | 01:17 |
| morganfainberg | bknudson, yeah that one i'm leaving the connection string in | 01:17 |
| morganfainberg | bknudson, we'll circle back, maybe ENV var in the future? | 01:18 |
| morganfainberg | bknudson, but i'm removing a lot of the other ones. | 01:18 |
| bknudson | morganfainberg: good riddance. | 01:18 |
| morganfainberg | so far: http://paste.openstack.org/show/73091/ | 01:18 |
| morganfainberg | also will be removing test_overrides.conf | 01:19 |
| morganfainberg | the LDAP ones are probably not going away | 01:19 |
| morganfainberg | yet | 01:19 |
| bknudson | morganfainberg: are the config settings in the test code now? | 01:19 |
| morganfainberg | yep | 01:20 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Fix retry logic https://review.openstack.org/77907 | 01:20 |
| morganfainberg | i probably can eliminate another 3 or 4 files before i'm done | 01:20 |
| morganfainberg | then i'll propose a change afterwards to move the remaining files to kestone/tests/config_files | 01:21 |
| *** wchrisj has quit IRC | 01:22 | |
| bknudson | morganfainberg: so I'm wondering why we have a config() function and a config_overrides()... why not do the config in config()? | 01:22 |
| morganfainberg | i'm fine with collapsing it down | 01:23 |
| morganfainberg | i just wanted to make sure it was clear where things are | 01:23 |
| morganfainberg | easier to review the changes imo | 01:23 |
| morganfainberg | maybe we do that as another 'cleanup' review? | 01:23 |
| bknudson | morganfainberg: it was clear as mud before! | 01:23 |
| morganfainberg | lol | 01:23 |
| morganfainberg | well trying to make mud a bit less murky | 01:23 |
| morganfainberg | and i'd rather not make it hard to read during the cleanup | 01:24 |
| bknudson | so for some reason we had multiple calls to config() and multiple implementeations of config_files. | 01:24 |
| morganfainberg | yeah that is some of the overlap between my proposed change and yours | 01:24 |
| morganfainberg | because i need to do some of the same cleanup | 01:24 |
| bknudson | those were just some little things I noticed when doing the configurable temp dir. | 01:25 |
| * morganfainberg nods | 01:25 | |
| *** browne has joined #openstack-keystone | 01:25 | |
| morganfainberg | oh look at that | 01:28 |
| morganfainberg | i think i found a test gap | 01:28 |
| * morganfainberg 2xchecks | 01:28 | |
| morganfainberg | bknudson, so | 01:29 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/tests/backend_sql.conf | 01:29 |
| morganfainberg | never sets assingmnet backend to use SQL | 01:29 |
| morganfainberg | we're not testing the assingment SQL driver. | 01:29 |
| morganfainberg | *facepalm* | 01:29 |
| morganfainberg | oh wait | 01:29 |
| bknudson | morganfainberg: the assignment backend defaults based on identity | 01:29 |
| morganfainberg | it's defaulted to the same as identity | 01:29 |
| morganfainberg | god i hate that code | 01:29 |
| morganfainberg | :P | 01:29 |
| bknudson | although that might be deprecated at some point | 01:30 |
| morganfainberg | i hope so | 01:30 |
| bknudson | so could make it explicit in the config | 01:30 |
| morganfainberg | :P | 01:30 |
| morganfainberg | going to make it explicit in the test cases | 01:30 |
| morganfainberg | oh actually.. not atm | 01:30 |
| morganfainberg | too much code shift for that in this change i think | 01:31 |
| dstanek | so are all non-feature/non -2ed reviews ok to approve? or do we need to be careful? | 01:32 |
| morganfainberg | dstanek, i'd still be careful | 01:32 |
| bknudson | dstanek: we need to be careful... might be added after dolphm had a chance to -2 | 01:32 |
| morganfainberg | look for string changes that don't comply w/ string freeze | 01:32 |
| morganfainberg | and look for things that are still making changes that we wouldn't want in 11th hour | 01:33 |
| dstanek | there's lots of little things that *should* be fine like https://review.openstack.org/#/c/74263 | 01:33 |
| dstanek | that one in particular won't have side effects, but there are other small changes that might | 01:34 |
| *** richm has quit IRC | 01:34 | |
| bknudson | dstanek: if in doubt, +2 and ask dolphm when he's around. | 01:34 |
| *** nkinder has quit IRC | 01:35 | |
| dstanek | bknudson: that's a good point | 01:35 |
| stevemar | bknudson, that's my motto, except change it to dolphm/bknudson | 01:38 |
| dstanek | stevemar: yo | 01:47 |
| dstanek | stevemar: looking at your comment here on https://review.openstack.org/#/c/79284 | 01:47 |
| dstanek | are those group ids all valid? | 01:48 |
| *** stevemar2 has joined #openstack-keystone | 01:48 | |
| *** stevemar has quit IRC | 01:49 | |
| *** browne has quit IRC | 01:52 | |
| *** wchrisj has joined #openstack-keystone | 01:53 | |
| *** lbragstad has joined #openstack-keystone | 02:00 | |
| *** mberlin1 has joined #openstack-keystone | 02:08 | |
| *** stevemar2 is now known as stevemar | 02:09 | |
| *** mberlin has quit IRC | 02:10 | |
| morganfainberg | bknudson, ok this test run is looking good | 02:18 |
| morganfainberg | bknudson, just debugging the last bits here before posting | 02:18 |
| morganfainberg | :) | 02:18 |
| *** stevemar has quit IRC | 02:26 | |
| *** stevemar has joined #openstack-keystone | 02:27 | |
| *** noorul has joined #openstack-keystone | 02:36 | |
| noorul | hello | 02:36 |
| noorul | I hit this bug in havana https://bugs.launchpad.net/python-keystoneclient/+bug/1195924 | 02:36 |
| noorul | Is there a way to use an updated version of client in havana? | 02:37 |
| *** nkinder has joined #openstack-keystone | 02:37 | |
| *** stevemar has quit IRC | 02:47 | |
| *** zhiyan_ is now known as zhiyan | 02:51 | |
| *** harlowja is now known as harlowja_away | 02:54 | |
| *** harlowja_away is now known as harlowja | 03:06 | |
| morganfainberg | wow... tests have gotten slow | 03:15 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Change the default version discovery URLs https://review.openstack.org/78068 | 03:15 |
| *** daneyon has joined #openstack-keystone | 03:16 | |
| *** stevemar has joined #openstack-keystone | 03:22 | |
| stevemar | any night owls online? | 03:22 |
| morganfainberg | stevemar, no | 03:22 |
| morganfainberg | :P | 03:22 |
| stevemar | or west coast folks | 03:22 |
| stevemar | morganfainberg, how unusual! | 03:22 |
| *** gokrokve has quit IRC | 03:22 | |
| *** daneyon has quit IRC | 03:24 | |
| morganfainberg | our testing has gotten really slow: stevemar | 03:24 |
| morganfainberg | :( | 03:24 |
| morganfainberg | makes me sad | 03:24 |
| *** daneyon has joined #openstack-keystone | 03:25 | |
| stevemar | morganfainberg, my isp is terrible this evening, that makes me sad | 03:27 |
| *** gokrokve has joined #openstack-keystone | 03:27 | |
| morganfainberg | i have 3 test cleanup patches about to post | 03:28 |
| morganfainberg | just waiting for local unit tests to pass first | 03:28 |
| stevemar | morganfainberg, i've added you to client reviews, because i can | 03:31 |
| morganfainberg | lol | 03:31 |
| morganfainberg | i need to do some client reviews :( | 03:31 |
| morganfainberg | but they always make my head hurt these days | 03:31 |
| dstanek | stevemar: i'm always lurking | 03:36 |
| dstanek | stevemar: did you see my comments above? | 03:36 |
| stevemar | dstanek, unlikely, i was probably disconnected | 03:37 |
| dstanek | stevemar: looking at your comment here on https://review.openstack.org/#/c/79284 | 03:37 |
| dstanek | are those group ids all valid? | 03:37 |
| dstanek | (instant replay) | 03:37 |
| stevemar | dstanek, they may not be | 03:38 |
| stevemar | dstanek, cause, mapping | 03:38 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not use keystone.conf.sample in tests https://review.openstack.org/79524 | 03:39 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Removal of test .conf files https://review.openstack.org/79525 | 03:39 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Move test .conf files to keystone/tests/config_files https://review.openstack.org/79526 | 03:39 |
| dstanek | so he would still need to query the db it he really does want to check | 03:39 |
| morganfainberg | dstanek, stevemar ^ | 03:39 |
| noorul | I hit this bug in havana | 03:39 |
| noorul | https://bugs.launchpad.net/python-keystoneclient/+bug/1195924 | 03:40 |
| noorul | Is there a way to use an updated version of client in havana? | 03:40 |
| stevemar | dstanek, absolutely, isn't that what i proposed in my comment? | 03:40 |
| stevemar | ahhh too many links | 03:40 |
| morganfainberg | noorul, that should be long since shipped | 03:40 |
| morganfainberg | noorul, where did you get your release of the client? distribution package install? | 03:41 |
| dstanek | stevemar: maybe, i'll reread i got the impression that you thought we could use that list | 03:41 |
| stevemar | noorul, keystoneclient is at 4.2.0 now | 03:41 |
| stevemar | dstanek, i said get_group i think | 03:41 |
| jamielennox | 4.2.0? whoa | 03:41 |
| stevemar | jamielennox, did i mix up the numbers? is it 4.0.2? | 03:41 |
| morganfainberg | stevemar, 0.6.0 | 03:41 |
| morganfainberg | https://pypi.python.org/pypi/python-keystoneclient | 03:41 |
| jamielennox | i think we're about to do an 0.7 | 03:41 |
| morganfainberg | jamielennox, ++ | 03:42 |
| noorul | morganfainberg: havan | 03:42 |
| morganfainberg | jamielennox, also ^ lots of test config cleanup. | 03:42 |
| noorul | morganfainberg: havana release | 03:42 |
| morganfainberg | noorul, how did you install keystoneclient? apt-get? pip? | 03:42 |
| noorul | apt-get | 03:42 |
| jamielennox | morgan: i haven't been paying attention to the channel | 03:42 |
| stevemar | jamielennox, whoa, i was way off | 03:42 |
| morganfainberg | jamielennox, hehe no worries, just pointing you to them. i think they'll help with keeping tests easier to manage | 03:43 |
| jamielennox | are you doing the test changes now, or for start of J | 03:43 |
| morganfainberg | jamielennox, now would be good. | 03:43 |
| jamielennox | lol, why not just hold it - when does the J cycle open? | 03:43 |
| morganfainberg | jamielennox, when we cut RC | 03:43 |
| stevemar | few more weeks | 03:43 |
| morganfainberg | jamielennox, i'm trying to front load as much as I can to get to parallel testing early in J | 03:43 |
| jamielennox | weeks? huh, i didn't think it was that long | 03:44 |
| noorul | morganfainberg: Is there a way to update this using aptitude | 03:44 |
| morganfainberg | big test changes are hard to land when the cycle is moving | 03:44 |
| stevemar | jamielennox, https://wiki.openstack.org/wiki/Icehouse_Release_Schedule | 03:44 |
| jamielennox | morganfainberg: yea i know i've tried that before | 03:44 |
| stevemar | march 27 to april 10 | 03:44 |
| morganfainberg | noorul, if there is a new update for ubuntu yes, but unfortunately I don't know for sure | 03:44 |
| jamielennox | hmm, can we just start a J feature branch and do revies there or will that just means no-one is doing bugs | 03:45 |
| morganfainberg | noorul, you could use pip to update keystoneclient, but that may be sub-optimal for a production environment | 03:45 |
| morganfainberg | jamielennox, negative it's not how this works. | 03:45 |
| morganfainberg | jamielennox, also resolving bugs would be nightmarish | 03:45 |
| jamielennox | i know | 03:45 |
| morganfainberg | jamielennox, i'm also trying to make sure as we get new features people do tests more correctly | 03:46 |
| morganfainberg | and as long as this all passes check/gate it has no real impact on the project besides cleanup | 03:47 |
| morganfainberg | noorul, let me see if i can dig something up | 03:47 |
| morganfainberg | noorul are you using cloud-archive:havana as the apt source? | 03:49 |
| morganfainberg | noorul, https://wiki.ubuntu.com/ServerTeam/CloudArchive | 03:49 |
| morganfainberg | noorul, if so, they are likely to be the "most up-to-date" first-party packagers | 03:50 |
| morganfainberg | jamielennox, stevemar, oh wow | 03:50 |
| jamielennox | hmm? | 03:50 |
| morganfainberg | jamielennox, stevemar, dstanek, https://wiki.ubuntu.com/ServerTeam/CloudArchive maintaining essex for 5yrs. | 03:50 |
| morganfainberg | same w/ icehouse | 03:50 |
| *** amcrn has quit IRC | 03:50 | |
| jamielennox | wow, that's a nightmare | 03:51 |
| morganfainberg | yeah right? | 03:51 |
| jamielennox | even RHEL isn't attempting that yet | 03:51 |
| morganfainberg | that support schedule is... just wow | 03:51 |
| stevemar | jeez | 03:51 |
| jamielennox | they just decided it moved too quickly for now i think | 03:51 |
| morganfainberg | that means i can use essex (lol why) until... uhm ... 17.04 release of ubuntu | 03:52 |
| stevemar | dstanek, why you no +A https://review.openstack.org/#/c/74263/ | 03:53 |
| jamielennox | gyee: here? | 03:54 |
| jamielennox | stevemar, morganfainberg, dstanek: you guys have any opinions on how we should do auth plugin discovery | 03:55 |
| jamielennox | i've been thinking about a way of loading it via CONF objects | 03:56 |
| jamielennox | or at least do an optional bit from plugins | 03:56 |
| noorul | morganfainberg: yes, I am using cloud-archive:havana | 03:57 |
| stevemar | jamielennox, CONF would make things easier for discovery | 03:57 |
| stevemar | or at least over-riding | 03:57 |
| noorul | morganfainberg: is it safe to uninstall python-keystoneclient and use pip to pull in specific version? | 03:57 |
| jamielennox | stevemar depends what you consider discovery | 03:57 |
| morganfainberg | noorul, then you'll need to either wait for them to roll an updated package, create your own package, or use pip | 03:57 |
| jamielennox | my main use here is for people loading it from outside. eg auth_token | 03:57 |
| stevemar | noorul, you could do pip install --upgrade | 03:58 |
| jamielennox | i think we'll need a way of doing it programatically as well | 03:58 |
| morganfainberg | noorul, it _should_ be safe to use pip, but you'll probably want to make sure it doesn't have any bad interactions in your environment | 03:58 |
| stevemar | noorul, i defer to morganfainberg | 03:58 |
| jamielennox | noorul: put it in a virtualenv if you can - no problems that way | 03:58 |
| morganfainberg | noorul, i can't say with 100% certainty it is safe, but it really ought to not cause issues. | 03:58 |
| morganfainberg | jamielennox, ++ | 03:58 |
| morganfainberg | jamielennox, likely, the best bet is stevedore | 03:59 |
| morganfainberg | jamielennox, i know you don't want to hear that | 03:59 |
| jamielennox | morganfainberg: yea, i'm thinking stevedore | 03:59 |
| morganfainberg | and it does make debugging ugly | 03:59 |
| jamielennox | there are usages that make sense | 03:59 |
| morganfainberg | but it really is the best bet | 03:59 |
| morganfainberg | i want to move all the dogpile stuff to using it | 03:59 |
| jamielennox | i have no problems with stevedore you just need to use it right | 03:59 |
| morganfainberg | i've seen it cause very hard to debug failures if say a plugin loads badly | 04:00 |
| jamielennox | i don't like the magic, but if you specify by name it's ok | 04:00 |
| morganfainberg | no real information on the failure | 04:00 |
| morganfainberg | but that is really my biggest complaint | 04:00 |
| morganfainberg | importutils will at least say "OMG FAILED LIKE THIS" | 04:00 |
| jamielennox | https://etherpad.openstack.org/p/keystoneclient-stevedore | 04:01 |
| jamielennox | if you spell it out like that and make it explicit then you know if oauth isn't available | 04:02 |
| noorul | ok, I will try pip and see how it fairs | 04:02 |
| noorul | thank you morganfainberg jamielennox | 04:02 |
| jamielennox | i'm not sure i like just having everything in a big section and then going through the plugins to figure out what can handle all those options | 04:02 |
| jamielennox | noorul: np | 04:02 |
| morganfainberg | stevemar, you know... if we work at this i think we can remove the CONF object from all test files | 04:05 |
| *** noorul has left #openstack-keystone | 04:06 | |
| morganfainberg | forcing people to not just say CONF.<section>.<opt> = blah and wondering why it doesn't work | 04:06 |
| jamielennox | morganfainberg: is part of that directed at me? | 04:06 |
| morganfainberg | jamielennox, well besides that i need reviews, nothing specific directed at anyone | 04:07 |
| morganfainberg | just that people seem to get confused when we ask them to use opt_in_group or now the config_fixture | 04:07 |
| morganfainberg | i don't think i've had to explain it to a core though. | 04:07 |
| jamielennox | morganfainberg: heh, we all need reviews, you should see my profile atm | 04:08 |
| morganfainberg | i know | 04:08 |
| morganfainberg | i've been slowly working through the ones in keystone | 04:08 |
| *** david-lyle has joined #openstack-keystone | 04:08 | |
| morganfainberg | though it's easier w/ the -2s for FF | 04:09 |
| stevemar | morganfainberg, i'm doing a PoC of something, and deliberately did not create or extend a new .conf | 04:10 |
| stevemar | morganfainberg, just went ahead and did CONF.<group>.<opt> | 04:10 |
| morganfainberg | stevemar :) | 04:10 |
| morganfainberg | stevemar, don't troll :P | 04:10 |
| stevemar | morganfainberg, i've played around with test automation for a while, and i hate prop files for tests | 04:10 |
| morganfainberg | absolutely | 04:10 |
| morganfainberg | i want all the files to go away. | 04:11 |
| stevemar | morganfainberg, even if you do string substitution, which is terrible, it's still hacky | 04:11 |
| morganfainberg | but some of the live test stuff makes it hard | 04:11 |
| stevemar | and not sustainable | 04:11 |
| stevemar | yeah | 04:11 |
| morganfainberg | i have it down to 15 files in the last review | 04:11 |
| morganfainberg | and a few of those files are required since we load things from disk | 04:12 |
| openstackgerrit | ldbragst proposed a change to openstack/keystone: Fixup region description uniqueness https://review.openstack.org/79159 | 04:16 |
| * lbragstad is fried | 04:16 | |
| openstackgerrit | ldbragst proposed a change to openstack/keystone: Fixup region description uniqueness https://review.openstack.org/79159 | 04:17 |
| stevemar | lbragstad, unfry yourself | 04:19 |
| * lbragstad feels like he just tried cracking eggs with the hammer of Thor | 04:20 | |
| * stevemar just looked at lbragstad's review, understands why he is fried | 04:20 | |
| stevemar | it's named mjolnir | 04:20 |
| lbragstad | stevemar: I'm impressed you know that | 04:20 |
| stevemar | lbragstad, comic book trivia is one of my many useless talents | 04:21 |
| lbragstad | ..hey, there are many who would argue it's not useless | 04:21 |
| lbragstad | :) | 04:21 |
| *** wchrisj has quit IRC | 04:24 | |
| *** daneyon has quit IRC | 04:42 | |
| *** daneyon has joined #openstack-keystone | 04:43 | |
| *** wchrisj has joined #openstack-keystone | 04:54 | |
| *** daneyon has quit IRC | 05:03 | |
| *** wchrisj has quit IRC | 05:04 | |
| *** jruano has joined #openstack-keystone | 05:10 | |
| *** gokrokve has quit IRC | 05:13 | |
| *** jruano has quit IRC | 05:22 | |
| openstackgerrit | ldbragst proposed a change to openstack/keystone: Allow 'description' in V3 Regions to be optional https://review.openstack.org/78658 | 05:23 |
| openstackgerrit | ldbragst proposed a change to openstack/keystone: Enforce required parameters for V3 Regions https://review.openstack.org/76444 | 05:23 |
| openstackgerrit | ldbragst proposed a change to openstack/keystone: Fixup region description uniqueness https://review.openstack.org/79159 | 05:23 |
| *** jruano has joined #openstack-keystone | 05:27 | |
| stevemar | jamielennox, i know i sound like a broken record, but you're the client gate-keeper :) - 'if you have time today, oauth for client' | 05:41 |
| stevemar | gnite/gday | 05:42 |
| gyee | jamielennox, here now, sorry I was afk | 05:42 |
| jamielennox | stevemar: ok, shall have a look | 05:42 |
| gyee | oauth! | 05:42 |
| stevemar | gyee, comes out of no where | 05:42 |
| jamielennox | gyee: ah ok, i'm trying to figure out how to do auth plugin abstractions | 05:42 |
| jamielennox | like factory and load from config | 05:42 |
| jamielennox | a replacement for auth_token loading that can be used elsewhere as well | 05:43 |
| *** jruano has quit IRC | 05:43 | |
| gyee | jamielennox, I would look for prior art, like JAAS, GSSAPI, etc | 05:43 |
| gyee | get some inspiration there | 05:43 |
| jamielennox | gyee: i'm not sure that'swhat i'm going for | 05:43 |
| gyee | JAAS is using config file | 05:44 |
| jamielennox | i think i'm just looking for a stevedore based approach that lets people do things like oauth from auth_token without having to specify everything | 05:45 |
| jamielennox | (currently fighting oslo.config) | 05:45 |
| gyee | oauth from auth_token middleware? | 05:47 |
| jamielennox | for example | 05:48 |
| *** stevemar has quit IRC | 05:48 | |
| jamielennox | or kerberos or whatever might be non-standard | 05:48 |
| gyee | jamielennox, I was thinking the same thing when I commented on one of your auth plugin patches, which is to essentially abstract the AccessInfo | 05:51 |
| gyee | AccessInfo is essentiall the auth context | 05:51 |
| *** amcrn has joined #openstack-keystone | 05:52 | |
| jamielennox | i don't want every plugin to have to implement the AccessInfo - it's too big | 05:52 |
| gyee | its auth context | 05:52 |
| jamielennox | the only thing we need to do is implement the plugin interface | 05:54 |
| gyee | are you thinking to automatically detecting auth plugins and make use of them? | 05:54 |
| jamielennox | i'm not sure, i don't think i want it to be too automatick | 05:55 |
| jamielennox | like: https://etherpad.openstack.org/p/keystoneclient-stevedore maybe | 05:55 |
| jamielennox | i'm trying to see if i can make oslo.config do that | 05:55 |
| gyee | where does the conf file live? | 05:56 |
| jamielennox | well it's an issue of how you want to use it i think | 05:56 |
| jamielennox | auth_token will use some | 05:56 |
| gyee | current dir, home, /etc/keystoneclient - in that order? | 05:56 |
| jamielennox | other projects will want something that loads from there config file | 05:57 |
| jamielennox | no, it's a library - i don't want it to have it's own config file | 05:57 |
| gyee | auth_token uses whatever in *-paste.ini or <service>.conf | 05:57 |
| jamielennox | yes | 05:57 |
| jamielennox | so i'm just seeing if we can support a generic case | 05:58 |
| gyee | I see what you mean. So config would be one of the kwargs for client | 05:58 |
| jamielennox | gyee: https://review.openstack.org/#/c/79542/ | 05:59 |
| gyee | actually, with a config file, possibilities abound :) | 06:00 |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/78525 | 06:00 |
| jamielennox | i think there will be a lot of potential with a config file | 06:00 |
| gyee | ++ | 06:01 |
| jamielennox | as in we will need something that allows people to specify what sort of auth you want when using it as part of another application | 06:01 |
| jamielennox | we will need the equivalent for CLI options i think | 06:01 |
| jamielennox | and there is the general factory case | 06:02 |
| jamielennox | i'm trying to figure out how they all tie together | 06:02 |
| jamielennox | note that i don't want to rely on oslo.config just provide helpers and standardize it if people are using it already | 06:04 |
| gyee | CLI is a bit more interesting, bit config file definitely help | 06:06 |
| jamielennox | i'm hoping i can leave CLI up to OSC | 06:08 |
| jamielennox | though i imagine i'll need to have some sort of helpers on the plugins | 06:08 |
| *** harlowja is now known as harlowja_away | 06:08 | |
| gyee | CLI needs to think abstract | 06:09 |
| gyee | like a command may compose of subcommands | 06:10 |
| gyee | for every command, what are the args and their respective data types | 06:10 |
| gyee | that information must be discoverable from the SDK | 06:10 |
| gyee | we can apply the same "discoverability* principal to OCLI | 06:11 |
| gyee | anyway, just some brain farts :) | 06:12 |
| gyee | hopefully, in Juno summit, we can get a bunch of ppl in a room to agree on the framework for discoverability | 06:13 |
| jamielennox | depends what you mean by discoverability | 06:15 |
| jamielennox | if you mean discovering the URLs we talk with i think that's solved or at least standardied | 06:15 |
| gyee | no | 06:15 |
| jamielennox | if you mean creating auth then i don't know what we need to do | 06:15 |
| jamielennox | i'm wondering if i just force people to specify a plugin by name | 06:15 |
| jamielennox | like a stevedore name | 06:15 |
| gyee | I mean OCLI being a generic shell and discover the commands and their args from SDK | 06:15 |
| jamielennox | so everything has plugin_name='oauth' | 06:16 |
| gyee | jamielennox, https://review.openstack.org/#/c/74908/4/keystoneclient/middleware/auth_token.py | 06:16 |
| jamielennox | which makes it a whole lot easier for me and i don't think makes that much of a difference to the user because they will need to have different information depending on the type of auth they are trying to set up | 06:16 |
| gyee | I think admin_token_expiry is still missing | 06:17 |
| jamielennox | gyee: do we still need it? | 06:17 |
| jamielennox | it's a refresh thing | 06:17 |
| jamielennox | when do i need to get a new admin token | 06:17 |
| gyee | jamielennox, yes, it determines when to refresh | 06:17 |
| jamielennox | :682 | 06:17 |
| jamielennox | so if that is managed by an auth plugin why do i want it in the middleware? | 06:18 |
| gyee | unless token_expiry is configurable in password auth plugin as well | 06:19 |
| jamielennox | what? | 06:20 |
| jamielennox | where would expiry be configurable from? | 06:20 |
| jamielennox | that's something that you get given an expiry when you get a token | 06:21 |
| gyee | line 694 | 06:21 |
| gyee | though I am not sure how useful is admin_token_expiry | 06:22 |
| gyee | its basically a delta to determine how soon you need to refresh | 06:22 |
| jamielennox | gyee: it's set on line 699 | 06:24 |
| gyee | oh | 06:25 |
| gyee | we're good then | 06:25 |
| jamielennox | yea, i didn't think it was something configurable | 06:26 |
| jamielennox | good catch on the token auth method | 06:27 |
| jamielennox | no idea how i missed that (or why the tests missed that) | 06:27 |
| gyee | +2ed | 06:28 |
| gyee | jamielennox, time for another keystoneclient release | 06:28 |
| jamielennox | heh, i want to get a few more things in first | 06:29 |
| gyee | the session and auth plugins are very much needed | 06:29 |
| jamielennox | feel free to go crazy on client reviews | 06:29 |
| jamielennox | i need to chat with dolphm, his review said to use 'interface' rather than 'endpoint_type' | 06:29 |
| jamielennox | endpoint_type is used a lot across the client already | 06:29 |
| jamielennox | gyee: easy one; https://review.openstack.org/#/c/78409/ | 06:30 |
| gyee | jamielennox, I am fine with either name, I am not picky on names :) | 06:30 |
| gyee | I care what's under the hood :) | 06:31 |
| jamielennox | i'll talk to him after tomorrows meeting cause that one i want to push through before i get to other clients | 06:31 |
| gyee | jamielennox, something I've learned overtime, if by changing a name earn you a +2, don't even bother to argue :) | 06:32 |
| jamielennox | yea | 06:32 |
| jamielennox | i don't care that much either | 06:32 |
| gyee | the key to happiness in OpenStack is to know the point of diminishing return | 06:34 |
| jamielennox | gyee: so you're defining happiness there as anything where you keep your sanity | 06:38 |
| jamielennox | (not disagreeing) | 06:38 |
| gyee | pretty much :D | 06:38 |
| *** gyee has quit IRC | 06:43 | |
| *** henrynash has joined #openstack-keystone | 06:47 | |
| *** henrynash has quit IRC | 07:01 | |
| *** jaosorior has joined #openstack-keystone | 07:11 | |
| *** YorikSar has quit IRC | 07:24 | |
| *** bvandenh has joined #openstack-keystone | 07:43 | |
| *** jamielennox is now known as jamielennox|away | 07:44 | |
| *** YorikSar has joined #openstack-keystone | 08:04 | |
| *** marekd|away is now known as marekd | 08:05 | |
| *** marcoemorais has joined #openstack-keystone | 08:20 | |
| openstackgerrit | A change was merged to openstack/identity-api: Rename Openstack to OpenStack https://review.openstack.org/73179 | 08:20 |
| *** marcoemorais has quit IRC | 08:24 | |
| *** morganfainberg is now known as morganfainberg_Z | 08:27 | |
| *** florentflament has joined #openstack-keystone | 08:28 | |
| *** leseb has joined #openstack-keystone | 08:35 | |
| *** henrynash has joined #openstack-keystone | 08:45 | |
| *** andreaf has joined #openstack-keystone | 08:48 | |
| *** petertoft has joined #openstack-keystone | 08:50 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Fix state modifying catalog tests https://review.openstack.org/78409 | 08:51 |
| *** henrynash has quit IRC | 09:18 | |
| *** zoresvit has joined #openstack-keystone | 09:20 | |
| *** marcoemorais has joined #openstack-keystone | 09:21 | |
| *** marcoemorais has quit IRC | 09:25 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Validate groups presence for federated authn https://review.openstack.org/79284 | 09:36 |
| *** bvandenh has quit IRC | 09:59 | |
| *** saju_m has joined #openstack-keystone | 10:05 | |
| *** saju_m has quit IRC | 10:18 | |
| *** leseb has quit IRC | 10:20 | |
| *** marcoemorais has joined #openstack-keystone | 10:20 | |
| *** leseb has joined #openstack-keystone | 10:20 | |
| *** leseb has quit IRC | 10:24 | |
| *** marcoemorais has quit IRC | 10:24 | |
| *** saju_m has joined #openstack-keystone | 10:31 | |
| *** andreaf has quit IRC | 10:35 | |
| zoresvit | While working with Identity API v3 (OpenStack Havana) I've found that policy.v3cloudsample.json causes tempest to fail all Identity API v3 tests. Anyone know how to fix that? | 10:39 |
| *** leseb has joined #openstack-keystone | 10:51 | |
| *** saju_m has quit IRC | 10:54 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Uses explicit imports for _ https://review.openstack.org/58766 | 11:20 |
| *** marcoemorais has joined #openstack-keystone | 11:21 | |
| *** marcoemorais has quit IRC | 11:25 | |
| *** andreaf has joined #openstack-keystone | 11:35 | |
| *** leseb has quit IRC | 11:49 | |
| *** leseb has joined #openstack-keystone | 11:50 | |
| openstackgerrit | A change was merged to openstack/keystone: Call an existing method in sync cache for revoke events https://review.openstack.org/79174 | 11:51 |
| openstackgerrit | A change was merged to openstack/keystone: Remove unnecessary calls to self.config() https://review.openstack.org/79226 | 11:51 |
| *** leseb has quit IRC | 11:53 | |
| openstackgerrit | A change was merged to openstack/keystone: Import order is fixed https://review.openstack.org/77106 | 11:59 |
| *** henrynash has joined #openstack-keystone | 12:01 | |
| *** bvandenh has joined #openstack-keystone | 12:09 | |
| *** bvandenh has quit IRC | 12:09 | |
| *** bvandenh has joined #openstack-keystone | 12:09 | |
| *** dims_ has quit IRC | 12:12 | |
| *** dims_ has joined #openstack-keystone | 12:14 | |
| *** ayoung has quit IRC | 12:21 | |
| *** david-lyle has quit IRC | 12:21 | |
| *** marcoemorais has joined #openstack-keystone | 12:22 | |
| *** marcoemorais has quit IRC | 12:26 | |
| *** wchrisj has joined #openstack-keystone | 12:29 | |
| *** wchrisj has quit IRC | 12:29 | |
| *** henrynash has quit IRC | 12:40 | |
| *** raildo has joined #openstack-keystone | 12:40 | |
| *** henrynash has joined #openstack-keystone | 12:41 | |
| *** browne has joined #openstack-keystone | 12:42 | |
| dstanek | zoresvit: using that instead of what tempest normally uses causes the test to fail? | 12:44 |
| *** leseb has joined #openstack-keystone | 12:50 | |
| *** leseb has quit IRC | 12:52 | |
| *** leseb has joined #openstack-keystone | 12:53 | |
| *** leseb has quit IRC | 12:54 | |
| *** leseb has joined #openstack-keystone | 12:54 | |
| *** leseb has quit IRC | 12:58 | |
| *** leseb has joined #openstack-keystone | 13:00 | |
| *** stevemar has joined #openstack-keystone | 13:04 | |
| *** bvandenh has quit IRC | 13:06 | |
| *** lbragstad has quit IRC | 13:18 | |
| *** marcoemorais has joined #openstack-keystone | 13:22 | |
| *** marcoemorais has quit IRC | 13:27 | |
| *** wchrisj has joined #openstack-keystone | 13:28 | |
| *** marekd has quit IRC | 13:39 | |
| *** henrynash has quit IRC | 13:40 | |
| *** henrynash has joined #openstack-keystone | 13:44 | |
| *** marekd has joined #openstack-keystone | 13:44 | |
| *** lbragstad has joined #openstack-keystone | 13:44 | |
| raildo | stevemar: I was interested in contributing to the federation and would like to know how I can do this, is there any functionality that can help, or test, or extend to the client | 13:45 |
| raildo | stevemar: Could you help me or you know who should I contact? | 13:46 |
| stevemar | raildo, that sounds awesome! | 13:46 |
| stevemar | raildo, myself, marekd or dolphm are good points of contact | 13:46 |
| marekd | raildo: hi raildo. | 13:47 |
| marekd | stevemar: o/ | 13:47 |
| raildo | marekd: \o | 13:47 |
| stevemar | raildo, we need folks who can actually test out the federation code in a live environment | 13:47 |
| stevemar | raildo, and we have 0 client support right now | 13:47 |
| marekd | stevemar: mhu is also interested in federation. | 13:47 |
| marekd | stevemar: talked to him yesterday | 13:47 |
| stevemar | nice | 13:48 |
| raildo | I wanted to find a way to start, so I understand how the federation works | 13:48 |
| marekd | raildo: federation in general or Kesytone federation? | 13:48 |
| raildo | keystone federation | 13:48 |
| *** nkinder has quit IRC | 13:48 | |
| marekd | raildo: anything particular you don't understand or you know literally nothing? | 13:50 |
| raildo | stevemar: marekd I became interested in SAML | 13:50 |
| marekd | raildo: ok, so i assume how it works in a 'normal' world. | 13:51 |
| marekd | raildo: it will be working in a Keystone in a pretty much similar way, but in our case this 'protected' resource will be just an OpenStack token... | 13:52 |
| marekd | raildo: are you familiar with terms like Service Provider (SP) and Identity Provider (IdP) ? | 13:53 |
| marekd | raildo: I guess you are. | 13:53 |
| raildo | marekd: yes | 13:53 |
| marekd | raildo: great! | 13:53 |
| raildo | marekd: I can understand how the overall operation of the Federation in Keystone | 13:54 |
| raildo | marekd: but do not know details or how it was implemented. | 13:55 |
| raildo | marekd: and this is what I want to learn more, who knows first test something, then help implement. | 13:55 |
| marekd | raildo: i see. | 13:56 |
| marekd | raildo: i can gather everything and squeeze it into a doc/e-mail if you want. | 13:57 |
| marekd | stevemar would be cc'd so he can correct me or add something new and important. | 13:57 |
| marekd | i think this could be easier rather than on IRC. | 13:57 |
| marekd | but it's up to you. | 13:57 |
| raildo | marekd: sounds good to me | 13:58 |
| marekd | pm me your e-mail, please? | 13:58 |
| raildo | marekd: https://launchpad.net/~raildo | 13:58 |
| marekd | raildo: thanks. | 13:59 |
| marekd | i am about to start writing now. | 14:00 |
| raildo | marekd: thanks for the help. | 14:00 |
| marekd | raildo: no problem! | 14:00 |
| *** richm has joined #openstack-keystone | 14:00 | |
| marekd | stevemar: BW, did you have any chance to take a look at my comments for https://review.openstack.org/#/c/79284/ | 14:01 |
| raildo | marekd: You will be in Summit? if you have any discussion of federation there, wanted to participate, I'll be there. | 14:01 |
| marekd | raildo: yes, i am planning to be at the Summit. | 14:01 |
| raildo | marekd: great! | 14:02 |
| *** tellesnobrega has joined #openstack-keystone | 14:03 | |
| dstanek | marekd, stevemar: whatever you guys come up with to explain the federation design should end up in doc | 14:04 |
| marekd | dstanek: ++ | 14:04 |
| stevemar | dstanek, yep, it's mostly a brief one-liner, then copy/paste the request in v3 api :P | 14:05 |
| stevemar | dstanek, except, i outline the order | 14:05 |
| marekd | dstanek: have never done this - any guideline for that or you are talking about 'some doc', loose format? | 14:05 |
| dstanek | stevemar: ah, i was hoping for more of a design/implementation doc | 14:06 |
| dstanek | marekd: i think anything now would be fine | 14:06 |
| dstanek | marekd: just outlining all the the pieces like mapping, etc. and pointing to where they are implemented | 14:06 |
| marekd | dstanek: ok, i am starting producing something now, as I got two requests for arch/impl description since yesterday. | 14:07 |
| dstanek | also how is plays (if at all) with password auth, oauth and other services | 14:07 |
| dstanek | marekd: let me know as you start working on it and i can help with structure and add newb comments | 14:07 |
| marekd | dstanek: this is what i was asking for - shall i produce .rst file or Google Doc (good to share, teamwork) is fine at the moment? | 14:08 |
| *** gokrokve has joined #openstack-keystone | 14:09 | |
| dstanek | marekd: what ever is easier for you - i think eventually it should end up in the doc directory of the keystone tree | 14:09 |
| marekd | dstanek: + | 14:12 |
| marekd | raildo: mhu: OK, let's change our plans :-) Instead of looping internal e-mail I am now starting to make a description of Federated Keystone. I will share it with you guys asap. Does it work for you? :-) | 14:14 |
| *** henrynash has quit IRC | 14:15 | |
| stevemar | dstanek, sounds like you have something specific in mind? | 14:18 |
| dstanek | stevemar: no not really. i just like design docs because they help understand a system because they should not only tell you what, but a little about the why | 14:21 |
| dstanek | stevemar: and also higher level view of how the pieces are used and fit together | 14:21 |
| raildo | marekd: sounds good to me | 14:22 |
| marekd | raildo: great! | 14:22 |
| mhu | marekd, works for me too | 14:23 |
| *** marcoemorais has joined #openstack-keystone | 14:23 | |
| *** ayoung has joined #openstack-keystone | 14:24 | |
| *** nkinder has joined #openstack-keystone | 14:26 | |
| *** david-lyle has joined #openstack-keystone | 14:26 | |
| *** marcoemorais has quit IRC | 14:28 | |
| *** huats_ is now known as huats | 14:30 | |
| *** henrynash has joined #openstack-keystone | 14:34 | |
| *** wchrisj has quit IRC | 14:38 | |
| *** florentflament has quit IRC | 14:40 | |
| *** bvandenh has joined #openstack-keystone | 14:43 | |
| *** devlaps has joined #openstack-keystone | 14:46 | |
| dolphm | reviews plz! (thanks marekd!) https://review.openstack.org/#/c/79284/ | 14:51 |
| dstanek | dolphm: what do you think about my comment on that review? i don't they we need a new identity function to list groups | 14:54 |
| dolphm | dstanek: looking... | 14:55 |
| *** thedodd has joined #openstack-keystone | 14:56 | |
| *** ayoung has quit IRC | 15:01 | |
| dolphm | dstanek: marekd: i agree with marekd's approach for doing the validation as early as possible, but i'm also hesitant to introduce anything new in the driver just for this... it seems like a manager method that does the heavy lifting utilizing get_group() would be the simplest solution? | 15:02 |
| dstanek | dolphm: why not expand on hints? | 15:02 |
| dolphm | dstanek: but calling list_groups once is much more attractive, and if hints works, then bonus points! | 15:02 |
| *** wchrisj has joined #openstack-keystone | 15:02 | |
| dstanek | dolphm: i don't see why it wouldn't, but then again i've obviously not implemented that yet | 15:03 |
| dolphm | only downside i can think of is that list_groups() isn't cacheable at the moment | 15:03 |
| dolphm | dstanek: would you be opposed to using list_groups() without hints for icehouse? | 15:04 |
| bknudson | is get_group cacheable? | 15:04 |
| dolphm | bknudson: cacheable, yes. cached? not sure... | 15:04 |
| dolphm | bknudson: does not appear to be cached | 15:05 |
| bknudson | could the check_groups_presence be simulated by calling get_group in a loop? | 15:06 |
| dolphm | bknudson: yes | 15:06 |
| bknudson | for each of the groups? | 15:06 |
| bknudson | here's get_group: def get_group(self, group_id, domain_scope=None) | 15:07 |
| bknudson | seems like check_groups_presence would need the domain_scope (whatever that is) | 15:07 |
| marekd | dolphm: iterative try: get_group(gid) except NotFound is probably the easiers, but wasn't you who commented on a similar approach and made me switch into SELECT * FROM X WHERE x IN something ? | 15:10 |
| dstanek | dolphm: no, i wouldn't be opposed to it, but it may be wildly inefficient | 15:11 |
| dstanek | caching on get_group should make it less inefficient | 15:12 |
| *** ayoung has joined #openstack-keystone | 15:16 | |
| ayoung | dolphm, I think that we are doing SAML backwards | 15:17 |
| ayoung | there should be "no" identity backend for SAML | 15:17 |
| marekd | ayoung: this is not something explicite for SAML.... | 15:18 |
| ayoung | marekd, that is not what the review says | 15:18 |
| ayoung | " federated authn" with SAML being the only method | 15:18 |
| ayoung | marekd, why would we want to have any identity store persisted in Keystone for a SAML authentication? | 15:19 |
| ayoung | marekd, ignoring the fact that you don't need a driver change to implement a check for group presence | 15:19 |
| marekd | ayoung because eventually saml2 transforms into groups and roles..? | 15:20 |
| ayoung | marekd, no | 15:20 |
| ayoung | SAML2 transforms into groups via the mapping | 15:20 |
| ayoung | the roles are presisted | 15:20 |
| ayoung | persisted | 15:20 |
| ayoung | marekd, we don't want "shadow" data in Keystone | 15:20 |
| ayoung | we've been having this discussion about users and groups from the IdPs since inception | 15:20 |
| ayoung | its a nightmare. You end up with data sync problems, and it is not the right approach | 15:21 |
| ayoung | it is the reason we have an LDAP provider instead of caching LDAP data in the sql backend | 15:21 |
| ayoung | and it is the reason we are still discussing the Unique identifiers for users to support mutliple IdPs (including LDAP) from issuing them | 15:21 |
| ayoung | sorry, the grammar on that last line was convoluted | 15:22 |
| marekd | ayoung: i am not trying to store any extra users in the backend... | 15:22 |
| ayoung | marekd, yes, but Groups have the same issue | 15:22 |
| ayoung | marekd, what you are saying implicitly is that each SAML provider is going to have a keystone persistance store | 15:23 |
| ayoung | that is not true, and not how we should be thinking about SAML or federation | 15:23 |
| ayoung | instead, think of it as a query for the identity backend that is "pushed" to Keystone | 15:24 |
| marekd | ayoung: i am. | 15:24 |
| *** marcoemorais has joined #openstack-keystone | 15:24 | |
| marekd | ayoung: and i am aware that this 'cached query' wll dissappear shortly after.... | 15:24 |
| ayoung | marekd, then there should be no link between Federation and the SQL or LDAP identity backends | 15:24 |
| ayoung | OK, so this is just a temporary fix? | 15:24 |
| marekd | ayoung: as tempoerary as mapping->groups exist... | 15:25 |
| ayoung | marekd, then no | 15:25 |
| marekd | ayoung: ok, so what do you suggest? | 15:25 |
| ayoung | mapping->groups should not require a persistance of groups | 15:25 |
| marekd | leave as it is ? | 15:25 |
| ayoung | creating the mapping implicitly creates the group | 15:25 |
| ayoung | absolutely | 15:26 |
| ayoung | marekd, if you really want to do something short term | 15:26 |
| marekd | ayoung: i dont | 15:26 |
| marekd | but go ahead. | 15:26 |
| ayoung | don't change the backends, and iterate through the list of groups from the SAML controller | 15:26 |
| ayoung | we don't want to optimize that path | 15:27 |
| dolphm | ayoung: i don't disagree with the notion at all (i'd rather not involve keystone at all in a federated authentication), but we agreed this was the shortest path to federation while utilizing as much existing code as possible | 15:27 |
| ayoung | dolphm, so for a shortcut, just modify the SAML controller | 15:28 |
| ayoung | it will generate more SQL traffic, but so what | 15:28 |
| *** marcoemorais has quit IRC | 15:28 | |
| dolphm | ayoung: maybe in a few releases we'll have keystoneclient.middleware.federated_auth and you'll be able to pass saml docs to all services and be done :) | 15:28 |
| dolphm | and do ABAC :) | 15:28 |
| ayoung | dolphm, nah, we'll still have to stick our fingers in to make it work. We are the puppet masters.... | 15:29 |
| marekd | dolphm: what's ABAC? | 15:29 |
| *** daneyon has joined #openstack-keystone | 15:29 | |
| dolphm | marekd: doing authorization directly based on the SAML assertions, rather than fussing with roles | 15:29 |
| dolphm | attribute based access control | 15:29 |
| marekd | dolphm: ok | 15:29 |
| dolphm | vs RBAC (role-based) | 15:29 |
| ayoung | dolphm, I think it means that we use the mapping layer to generate the policy.json | 15:30 |
| dolphm | ayoung: that implies that keystone is aware of all capabilities of all services, which i disagree with | 15:30 |
| ayoung | dolphm, actually, it means that Keystone is a compile time utility, and not run time. So while you use Keystone to generate Policy.json, it is done offline and then uploaded | 15:31 |
| *** Yash has quit IRC | 15:31 | |
| * ayoung snickers uncontrollable | 15:32 | |
| ayoung | y | 15:32 |
| *** gokrokve has quit IRC | 15:33 | |
| *** gokrokve has joined #openstack-keystone | 15:33 | |
| dolphm | ayoung: i don't think your -1 on marekd's review is reasonable for icehouse; longer term, sure | 15:34 |
| ayoung | dolphm, so... multiple endpoints for the same service (say mulitple glance servers) would they all have the same ABAC policy, or would each have its own? Would it make sense, in your vision,. to centralized the distribution of the ABAC policy rules (however they are done?) | 15:36 |
| dolphm | ayoung: none of that matters to me | 15:36 |
| dolphm | ayoung: it'd be up to them where they got their policy, just like it is today | 15:36 |
| *** gokrokve has quit IRC | 15:37 | |
| ayoung | dolphm, and when a new SAML provider gets registered, with a new set of attributes, how would we map that to the endpoints view of things? We can't just punt on that | 15:37 |
| *** harlowja_away is now known as harlowja | 15:38 | |
| dolphm | ayoung: i think that would have to be centralized, as much as token revocation events are (for example) | 15:38 |
| dolphm | ayoung: unless you wanted different services to carry different degrees of trust or something, but maybe multiple keystone deploys would be the solution there? | 15:39 |
| ayoung | dolphm, and normalized. Roles are the normalization of that today. and the layering on of additional authorization data, local to openstack, but not specific to the endpoints | 15:39 |
| ayoung | interesting... | 15:39 |
| dolphm | ayoung: with ABAC, you wouldn't normalize anything | 15:39 |
| ayoung | dolphm, true, you would deploy a new mapping file. Essentially the same thing | 15:40 |
| ayoung | but there is no means to layer on an additional amount of Openstack specific authorization | 15:41 |
| ayoung | which means that each service is going to roll its onw | 15:41 |
| ayoung | own | 15:41 |
| *** harlowja has quit IRC | 15:43 | |
| dolphm | ayoung: the goal of ABAC is to not fuss with that additional layer | 15:43 |
| ayoung | dolphm, that additional layer is the most important part. | 15:46 |
| marekd | dolphm: ayoung: sorry to interrupt you, but just for the icehouse... | 15:46 |
| ayoung | dolphm, what I have learned from this project is that you need to split authN from authZ, and that authZ needs to have a local set of rules and management. EIther we centralize that for Openstack, or each endpoint is its own little silo. | 15:47 |
| ayoung | marekd, for icehouse, modify your commit to only change the SAML controller | 15:47 |
| marekd | ayoung: auth/plugins/saml2.py and i guess...utilize get_group() and catch NotFound exceptions, right? | 15:47 |
| ayoung | yep | 15:48 |
| marekd | ok | 15:48 |
| marekd | changing.. | 15:48 |
| *** harlowja has joined #openstack-keystone | 15:48 | |
| ayoung | marekd, and a notfound can short circuit your logic. | 15:48 |
| dolphm | ayoung: oh, that's easy enough... totally not what i understood from your review | 15:48 |
| ayoung | any one missing group means raise a 403 | 15:48 |
| dolphm | ayoung: that's basically the same solution dstanek, bknudson and i agreed would work, we just didn't discuss where the implementation should live | 15:48 |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/76691 | 15:49 |
| ayoung | dolphm, yeah, I was just concnerned that this was something more than a short term workaround | 15:49 |
| ayoung | and I still am a little worried about that.... | 15:49 |
| openstackgerrit | Matthieu Huin proposed a change to openstack/keystone: Add missing documentation for enabling federation auth plugin https://review.openstack.org/79483 | 15:49 |
| *** gyee has joined #openstack-keystone | 15:50 | |
| marekd | ayoung: any missin group should raise 403? | 15:50 |
| marekd | dolphm: ^^? | 15:51 |
| *** zhiyan is now known as zhiyan_ | 15:51 | |
| ayoung | marekd, what were you going to do otherwise? | 15:51 |
| marekd | LOG a warning, and I think dolph suggested logging instead of 4xx. | 15:51 |
| ayoung | marekd, hmmmm | 15:53 |
| ayoung | so you would get a reduced set of groups available, but all working mappings would then apply groups? | 15:53 |
| ayoung | marekd, so, with my suggestion, we would have more failures: anytime someone messed up a group, token requests would 4xx. With the other, we'd have more "limited successes" | 15:55 |
| ayoung | IE I requested a token, but didn't get the access I requested | 15:55 |
| marekd | ayoung: yes. | 15:55 |
| ayoung | why bother confirming existence in the backend, then | 15:56 |
| ayoung | just perform the operation and any non-real groups just get dropped | 15:56 |
| ayoung | the whole thing sounds....suspect | 15:56 |
| marekd | if you silently ignore mistakes/misconfiguration and no even log anything it bet most people will conclude "this federation doesn't work", let's file a bug. | 15:57 |
| marekd | and the reasong behind "doesn't work" is a rule with gruop_x as a local object, instead of group_x | 15:57 |
| *** gokrokve has joined #openstack-keystone | 15:57 | |
| ayoung | marekd, if you don't validate the group IDS at this stage, what happens during assignement? | 15:59 |
| ayoung | I would assume that you would get lookups that just give you nothing | 15:59 |
| marekd | ayoung: yes | 15:59 |
| ayoung | but...that is exactly what is going to happend when there is no identity backend behind SAML. | 15:59 |
| marekd | ayoung: RuleProcessor spits whatever it finds in the rules | 15:59 |
| ayoung | I think you should drop this patch | 15:59 |
| marekd | and it's stored in the token. | 15:59 |
| marekd | ayoung: why? | 16:00 |
| marekd | ayoung: but we now are somehow tied to the identity, to groups and so on.... | 16:01 |
| ayoung | marekd, OK...so groups should not be part of the SAML model. They exist due to LDAP, really. If we were writing this in a vacuum (no pre-existing Identiy backend) then the mapping would be in the assignment layer, and the mapping would be from SAML attribute to role_assignment | 16:02 |
| ayoung | maybe we should rewrite it that way in Juno | 16:02 |
| ayoung | David Chadwick would be thrilled | 16:02 |
| ayoung | It is what he origianlly suggested back when groups were introduced | 16:03 |
| marekd | he was suggesting something like rules per uesr. | 16:03 |
| marekd | user | 16:03 |
| ayoung | he was suggesting using the rules engine to implement groups | 16:03 |
| ayoung | users and role assignments were in the same backend | 16:04 |
| ayoung | and when we split identiyt, groups went with users, but roles and assignments went into their own backend | 16:04 |
| ayoung | groups, though, groups can fall into two categories | 16:04 |
| ayoung | groups can be from the attributes from the IdP, but can also be something you want to layer on in Keystone | 16:05 |
| dolphm | jamielennox|away: this is an exciting patch! https://review.openstack.org/#/c/74908/ | 16:05 |
| ayoung | dolphm, I know! | 16:06 |
| ayoung | dolphm, Client is really starting to take shape | 16:06 |
| marekd | dolphm: ayoung stevemar dstanek bknudson : ok, ayoung suggests dropping patch https://review.openstack.org/#/c/79284/. Since our federation is somehow tied to the identity I would land it and not silently pass some mistakes/misconfiguration. We could also treat it as shortterm solution, until the federation layer is rewritten (one day). drop/not drop/change and not extend identity? | 16:06 |
| ayoung | marekd, if you are going to land it, have it error out completely | 16:07 |
| ayoung | lets let people know ASAP that a mapping is bad | 16:07 |
| bknudson | marekd: I don't want to see the identity API changing at this point. | 16:07 |
| stevemar | marekd, i don't think he said drop it | 16:07 |
| stevemar | just don't change identity | 16:07 |
| ayoung | bknudson, I think he means land it with the changes confined to the SAML controller | 16:07 |
| marekd | stevemar: 15:59 < ayoung> I think you should drop this patch | 16:07 |
| stevemar | :O | 16:08 |
| bknudson | ayoung: marekd: confining the changes to the SAML controller makes sense. | 16:08 |
| ayoung | stevemar, read up | 16:08 |
| stevemar | catching up | 16:08 |
| ayoung | bknudson, SAML really should not be talking to ANY identity backend, but if we have that limitation today, we should error out on any mapping mistake | 16:08 |
| ayoung | but...I am not certain that we do | 16:08 |
| bknudson | ayoung: I prefer an error out to a warning message. | 16:09 |
| ayoung | bknudson, ++ | 16:09 |
| marekd | bknudson: ayoung: error then! | 16:09 |
| marekd | bknudson: ayoung and just saml2 controller changes. | 16:09 |
| ayoung | marekd, that might be one of the few times I would say a code generated 5xx error might make sense | 16:10 |
| *** nkinder_ has joined #openstack-keystone | 16:10 | |
| bknudson | marekd: if we feel the need to optimize because there's a lot of groups or something then let's consider that for a future patch. | 16:10 |
| ayoung | I should say "an explicit raise of a 5xx" | 16:10 |
| marekd | bknudson: possible optimization for a future patch? | 16:10 |
| ayoung | bknudson, so, I'd like instead to consider a future patch where mapping bypasses Identiy completely and goes right to the role assignments | 16:11 |
| bknudson | ayoung: so if there's no roles assigned to the group it would fail? | 16:11 |
| ayoung | bknudson, there would be no "groups" | 16:11 |
| ayoung | you get a set of attributes in the SAML document | 16:11 |
| marekd | ayoung: from the user perspective he would be upload rules with role ids instead of group ids like today? | 16:12 |
| ayoung | the mapping is processed in the assignment stage: mapping attr1=x + attr2=y to user gets role=r on project=p | 16:12 |
| ayoung | marekd, yeah | 16:12 |
| *** bvandenh has quit IRC | 16:13 | |
| ayoung | marekd, I think that groups might be an abstraction we add to the mapping API. | 16:13 |
| ayoung | think of it as an intermediate step | 16:13 |
| *** nkinder has quit IRC | 16:13 | |
| dolphm | ayoung: i'm not opposed to a 401, but my thinking was that it was the deployers fault, so just log the condition and don't punish the user | 16:13 |
| ayoung | so attr->group group->role and then we could have a step in the mappuing which is groups =[g1, g2, g3] | 16:13 |
| marekd | looks like almost-0 change in RuleProcessor and lots of groups->roles transformation. | 16:13 |
| ayoung | dolphm, let the users punish the deployer | 16:13 |
| marekd | ayoung: ^^ | 16:14 |
| ayoung | marekd, I think it might make sense if we add the ability to explicitly enumerate the groups in the rules processor. | 16:14 |
| bknudson | dolphm: you must be a deployer | 16:14 |
| ayoung | :) | 16:15 |
| dolphm | bknudson: why? lol | 16:15 |
| marekd | ayoung: enumerate groups? | 16:15 |
| bknudson | dolphm: you don't want users complaining to you | 16:15 |
| ayoung | marekd, yeah....as part of the rules, have a single list which is the set of expected groups | 16:15 |
| ayoung | or... | 16:15 |
| dolphm | bknudson: with the PTL hat, deployers are my users :P | 16:15 |
| ayoung | a tree, and make group membership be hierarchical | 16:16 |
| ayoung | that is probably the right solution. We can discuss at the summit | 16:16 |
| zoresvit | dstanek: yeah, tempest Identity API v3 tests fail with policy.v3cloudsample.json causing 403 Forbidden error... | 16:16 |
| marekd | ayoung: but we already have a list of expected groups? | 16:16 |
| ayoung | marekd, no we don't | 16:16 |
| ayoung | there is no identity backend | 16:16 |
| marekd | ayoung: or we are now talking about something different... | 16:16 |
| ayoung | marekd, when I get a SAML doc, it will be from a remote IdP | 16:17 |
| *** wchrisj has quit IRC | 16:17 | |
| *** henrynash has quit IRC | 16:17 | |
| *** wchrisj has joined #openstack-keystone | 16:17 | |
| bknudson | it would be great if we could deprecate the identity backend. | 16:17 |
| ayoung | bknudson, split it into its own service | 16:17 |
| ayoung | the identity program should have two services: Keystone-idp and keystone-rbac | 16:18 |
| bknudson | ayoung: that supports saml? or a middleware that generates attributes to map? | 16:18 |
| ayoung | or something | 16:18 |
| *** henrynash has joined #openstack-keystone | 16:18 | |
| ayoung | bknudson, sure. SAML | 16:18 |
| ayoung | bknudson, we here at redhat are working on something comparable for LDAP. The ability to set up a SAML gateway as a simple extension to an existing LDAP infrastructure | 16:19 |
| ayoung | so it would be SAML produced from Keystone | 16:21 |
| *** leseb has quit IRC | 16:26 | |
| *** leseb has joined #openstack-keystone | 16:26 | |
| stevemar | reminder that the keystone meeting is an hour later than usual today (for those in daylight savings locations) | 16:28 |
| *** zigo has joined #openstack-keystone | 16:29 | |
| *** leseb has quit IRC | 16:30 | |
| *** vhoward has joined #openstack-keystone | 16:31 | |
| *** ayoung is now known as ayoung-lunch | 16:33 | |
| *** gordc has joined #openstack-keystone | 16:36 | |
| *** gordc has left #openstack-keystone | 16:36 | |
| marekd | ayoung-lunch: how about raising GroupNotFound (which is 404) in case the group we are testing is actually missing? | 16:41 |
| marekd | ayoung-lunch: cause you suggested raising http 403 | 16:41 |
| marekd | GroupNotFound would be 404 and still a reasonable error | 16:42 |
| lbragstad | stevemar: I was wondering why there wasn't any rally chatter in -meeting | 16:52 |
| *** leseb has joined #openstack-keystone | 16:54 | |
| *** marcoemorais has joined #openstack-keystone | 16:58 | |
| *** henrynash has quit IRC | 17:00 | |
| *** ayoung-lunch is now known as ayoung | 17:00 | |
| *** jaosorior has quit IRC | 17:00 | |
| ayoung | marekd, is that IAW the Identity spec? | 17:00 |
| marekd | ayoung: IAW? | 17:01 |
| *** david-lyle has quit IRC | 17:01 | |
| ayoung | marekd, POST tokens doesn't return a 404 does it? | 17:01 |
| ayoung | marekd, https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#authentication-failures | 17:02 |
| marekd | ayoung: good point! | 17:02 |
| ayoung | marekd, 401 NotAuthorized with additional data seems to be expected, but it really wouldn't work | 17:02 |
| ayoung | unless you could request a SAML document without the attribute triggering the group lookup | 17:03 |
| marekd | ayoung: so http 403 Forbidden with data about missing group? | 17:03 |
| ayoung | 500 | 17:03 |
| ayoung | its a config error | 17:03 |
| marekd | hmmm, I have always thought of 500s as bugs in the server code...something went terribly wrong and it's devs' fault. | 17:04 |
| *** leseb has quit IRC | 17:04 | |
| ayoung | marekd, a bad mapping might fall into that category. | 17:04 |
| marekd | ayoung: ok | 17:05 |
| marekd | ayoung: well, not ok, but i will raise 500 | 17:05 |
| ayoung | marekd, Fail FasT! | 17:05 |
| marekd | :-) | 17:05 |
| stevemar | lbragstad, yep, more time for lunch now :) | 17:06 |
| marekd | stevemar: is the meeting hour shiften only today ? | 17:07 |
| marekd | shifted* | 17:07 |
| lbragstad | nope, until daylight savings time happens again | 17:08 |
| lbragstad | :) dst threw me off last time too | 17:08 |
| stevemar | marekd, it's at 1800 UTC, but us/can do day light savings, so it's shifted for us | 17:08 |
| marekd | LOL :D so it's still 18:00 UTC | 17:09 |
| marekd | i thought we are all shifting, not because of dst but some other reasons... | 17:09 |
| marekd | so effectively the meeting would start at 19:00UTC. | 17:10 |
| lbragstad | marekd: you had something up for review didn't you? | 17:11 |
| lbragstad | https://review.openstack.org/#/c/79284/ | 17:12 |
| marekd | lbragstad: https://review.openstack.org/#/c/79284/ but | 17:12 |
| marekd | you can hold off, as we just had discussion and i will throw away few things.. | 17:12 |
| marekd | so no need to waste your time now. | 17:12 |
| lbragstad | marekd: alright, I add myself, so I'll catch the next patch set | 17:13 |
| lbragstad | added* | 17:14 |
| marekd | lbragstad: thanks! | 17:14 |
| lbragstad | np | 17:15 |
| *** henrynash has joined #openstack-keystone | 17:19 | |
| *** henrynash has quit IRC | 17:25 | |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/76691 | 17:30 |
| ayoung | > drop table "group"; | 17:32 |
| ayoung | ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"group"' at line 1 | 17:32 |
| ayoung | how do I do that by hand? | 17:32 |
| ayoung | ah | 17:33 |
| ayoung | drop table `group`; | 17:33 |
| bknudson | I wish jenkins would slow down with the requirements update. it'll never get merged. | 17:33 |
| openstackgerrit | Jenkins proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/79695 | 17:36 |
| ayoung | bknudson, now it is posting them just to spite you | 17:38 |
| *** rupsky has joined #openstack-keystone | 17:38 | |
| dolphm | lbragstad: you have two LP accounts... lbragstad (gmail) and ldbragst (ibm)... which do you use? | 17:39 |
| dolphm | lbragstad: and can you dump the other? :) | 17:39 |
| dolphm | lbragstad: you can associate multiple email addresses with one account | 17:39 |
| lbragstad | dolphm: I use both. Yeah, i can associate them | 17:40 |
| dolphm | lbragstad: why both? | 17:40 |
| ayoung | dolphm, because he uses the gmail one to undermine the things he is forced to commit with the other | 17:40 |
| lbragstad | :) | 17:41 |
| *** rupsky has quit IRC | 17:41 | |
| *** rupsky has joined #openstack-keystone | 17:41 | |
| lbragstad | dolphm: merged them (ldbragst, lbragstad) | 17:45 |
| *** petertoft has quit IRC | 17:46 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add missing documentation for enabling oauth1 auth plugin https://review.openstack.org/79708 | 17:47 |
| bknudson | stevemar: on a related note -- did you see this? https://review.openstack.org/#/c/79213/ | 17:48 |
| stevemar | bknudson, nope, just looking at it now | 17:48 |
| bknudson | stevemar: check out the test failure. | 17:48 |
| stevemar | bknudson, i recall that we spoke about it last week | 17:48 |
| *** rupsky has quit IRC | 17:49 | |
| stevemar | bknudson, interesting, so in this case, it fails to upgrade from h->master right? | 17:52 |
| dstanek | stevemar: the review you just posted about oauth1 docs looks familiar. did you propose something similar already? | 17:52 |
| stevemar | dstanek, mhu posted one for saml, i copied most of the same text | 17:52 |
| bknudson | stevemar: http://logs.openstack.org/13/79213/1/check/check-grenade-dsvm/e5bef9e/logs/new/screen-key.txt.gz | 17:52 |
| dstanek | stevemar: ah, ok. that must be it | 17:52 |
| bknudson | stevemar: so, yes, it was the master keystone that failed to start. | 17:53 |
| bknudson | stevemar: auth.methods = ['external', 'password', 'token', 'oauth1'] | 17:53 |
| *** rupsky has joined #openstack-keystone | 17:53 | |
| *** henrynash has joined #openstack-keystone | 17:53 | |
| stevemar | bknudson, because of: https://github.com/openstack/keystone/blob/stable/havana/etc/keystone.conf.sample#L424 | 17:54 |
| bknudson | stevemar: right... grenade must try to use the same config file? | 17:55 |
| dstanek | running the tests in isolation will really test your patience | 17:55 |
| stevemar | bknudson, likely, why wouldn't it | 17:55 |
| bknudson | stevemar: oauth1 auth isn't going to work if oauth isn't in the pipeline, right? | 17:55 |
| bknudson | stevemar: or is it supposed to work? | 17:56 |
| stevemar | bknudson, correct | 17:56 |
| *** david-lyle has joined #openstack-keystone | 17:56 | |
| dolphm | lbragstad: thanks! | 17:56 |
| lbragstad | dolphm: thank you for the heads up | 17:57 |
| stevemar | bknudson, i guess it could work, if you had it in the pipeline, then created an access token, then removed it from the pipeline, and only added it as an auth method | 17:57 |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: better handling for empty/None ldap values https://review.openstack.org/76002 | 17:58 |
| bknudson | stevemar: if that's the case then the oauth auth plugin should be creating the manager. | 17:58 |
| bknudson | not the router. | 17:58 |
| stevemar | bknudson, the oauth plugin would still need to talk to the oauth api | 17:58 |
| *** amcrn has quit IRC | 18:00 | |
| *** jamielennox|away is now known as jamielennox | 18:06 | |
| *** raildo has quit IRC | 18:06 | |
| *** raildo has joined #openstack-keystone | 18:07 | |
| *** zoresvit1 has joined #openstack-keystone | 18:10 | |
| *** andreaf has quit IRC | 18:17 | |
| *** vhoward has left #openstack-keystone | 18:29 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Validate groups presence for federated authn https://review.openstack.org/79284 | 18:30 |
| marekd | dolphm ayoung bknudson stevemar dstanek lbragstad: ^^ | 18:32 |
| stevemar | cool | 18:32 |
| lbragstad | marekd: thanks! | 18:32 |
| ayoung | marekd, I'm seriously having second thoughts about that | 18:32 |
| marekd | ayoung: you mean? | 18:32 |
| ayoung | I think it might break how people actually want to use DAML | 18:32 |
| ayoung | SAML | 18:32 |
| *** arborism has joined #openstack-keystone | 18:33 | |
| marekd | ? | 18:33 |
| ayoung | if I have an external Identity provider, I don't want to have any data in the identity backend at all | 18:33 |
| ayoung | I know right now we force a user lookup | 18:33 |
| marekd | but you already have....groups... | 18:33 |
| ayoung | but that is dumb, and should be treated as a bug | 18:33 |
| ayoung | there should be no Identity look up at all | 18:33 |
| ayoung | I think that is going to make SAML unusable | 18:33 |
| marekd | and it's not a 10 lines fix.... | 18:33 |
| ayoung | don't take my word on it | 18:33 |
| ayoung | I'll not hold it up, but I have misgivings | 18:34 |
| marekd | ayoung: i completely understand your point! | 18:34 |
| ayoung | I think it is headed the wrong direction | 18:34 |
| ayoung | so...go gather some data | 18:34 |
| *** arborism is now known as amcrn | 18:34 | |
| dstanek | ayoung: i thought the whole idea was to map SAML stuff into Keystone groups | 18:34 |
| marekd | dstanek: it was | 18:35 |
| ayoung | marekd, dstanek can we add this to the keystone meeting in progress? | 18:35 |
| marekd | ayoung: sure. | 18:35 |
| marekd | ayoung: so now you basically feel that the 'federation layer' should never touch any identity/assignments etc.? | 18:36 |
| marekd | ayoung: well...at most map directly to the roles. | 18:36 |
| ayoung | marekd, identity. It should absolutely touch assignments | 18:36 |
| marekd | ayoung: hmmmm, you can always think of it in a way that typical user will be much more familiar and comfortable with a group rather than a role... | 18:38 |
| marekd | ayoung: plus, you now have the ability to map into groups, that can be tied with many roles, am i right? so instead of making many rules, you can create one group, assign many roles, and upload one rule. | 18:39 |
| marekd | which is IMHO also a nice feature. | 18:40 |
| ayoung | marekd, in #openstack-meeting, please | 18:40 |
| marekd | roger! | 18:40 |
| *** lbragstad is now known as lbragstad__ | 18:43 | |
| *** devlaps1 has joined #openstack-keystone | 18:48 | |
| *** devlaps has quit IRC | 18:48 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Cleanup backends after each test https://review.openstack.org/79726 | 18:50 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Cleanup of instance attrs in core tests https://review.openstack.org/79727 | 18:50 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Cleans up test data from limit tests https://review.openstack.org/79728 | 18:50 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Cleanup fixture data added to test instances https://review.openstack.org/79729 | 18:50 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Cleanup keystoneclient tests https://review.openstack.org/79730 | 18:50 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Start using to oslotest https://review.openstack.org/79068 | 18:51 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Allows override of stdout/stderr/log capturing https://review.openstack.org/79069 | 18:51 |
| marekd | ayoung: dstanek dolphm bknudson stevemar lbragstad__: so please take a look at https://review.openstack.org/#/c/79284/ again :-) | 18:58 |
| *** marekd is now known as marekd|away | 18:58 | |
| *** marekd|away has quit IRC | 19:00 | |
| *** gyee has quit IRC | 19:04 | |
| *** harlowja has quit IRC | 19:04 | |
| *** gyee has joined #openstack-keystone | 19:05 | |
| *** harlowja has joined #openstack-keystone | 19:08 | |
| *** petertoft has joined #openstack-keystone | 19:11 | |
| *** ugrans has joined #openstack-keystone | 19:16 | |
| *** gyee has quit IRC | 19:16 | |
| *** lbragstad__ has quit IRC | 19:18 | |
| dstanek | i couldn't get any overall numbers because i haven't been able to run all the tests for a while due to memory issues | 19:20 |
| dstanek | but locally the backend_tests would consume about 681mb - after applying my testing patches that becomes 128mb | 19:20 |
| *** ugrans has quit IRC | 19:24 | |
| ayoung | dstanek, any time improvements on that? | 19:24 |
| dstanek | probably some small improvements, but i was just trying to be able to run the tests again | 19:25 |
| dstanek | next goal is to get all the tests to run in 120 seconds or less! | 19:25 |
| *** lbragstad has joined #openstack-keystone | 19:25 | |
| dstanek | :-) but i don't think that's actually possible | 19:26 |
| *** daneyon has quit IRC | 19:30 | |
| *** amcrn has quit IRC | 19:38 | |
| *** amcrn has joined #openstack-keystone | 19:40 | |
| ayoung | dstanek, I think if tests setup their own sample data instead of expecting all of the fixture data, it will speed things up a lot | 19:41 |
| ayoung | we've made some movement that way | 19:42 |
| *** tohins has joined #openstack-keystone | 19:43 | |
| *** tohins has quit IRC | 19:46 | |
| *** morganfainberg_Z is now known as morganfainberg | 19:48 | |
| morganfainberg | bleh missed the meeting today :( | 19:48 |
| ayoung | morganfainberg, it was basically "if its not a bug its a feature, and delayed until Juno" | 19:49 |
| * morganfainberg is still recovering from a 9pm-4:30am maintenance last week | 19:50 | |
| * morganfainberg doesn't seem able to do that kind of stuff w/o having a really horked sleep schedule for 1+weeks after | 19:50 | |
| *** petertoft has quit IRC | 19:54 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Use AccessInfo in auth_token middleware https://review.openstack.org/74956 | 19:56 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add 'methods' to all v3 test tokens https://review.openstack.org/74955 | 19:56 |
| *** leseb has joined #openstack-keystone | 19:56 | |
| *** petertoft has joined #openstack-keystone | 19:59 | |
| dstanek | morganfainberg: i pushed a bunch of testing stuff a little while ago | 20:02 |
| morganfainberg | dstanek, i saw. | 20:03 |
| morganfainberg | lets get this one in as well | 20:04 |
| morganfainberg | https://review.openstack.org/#/c/79217/3 | 20:04 |
| morganfainberg | dstanek, i think we can get tests much happier with your work | 20:05 |
| dstanek | morganfainberg: i still have a bunch of local cleanup stuff that needs pushing | 20:05 |
| dstanek | ran into some trouble because i want to make sure the tests run in isolation | 20:06 |
| morganfainberg | yeah | 20:06 |
| morganfainberg | we've been less than stellar about isolation | 20:06 |
| dstanek | i'll probably have another 3 or 4 commits related to speeding things up and lowering the memory footprint by tomorrow | 20:07 |
| morganfainberg | cool | 20:07 |
| morganfainberg | i hate the test restructure patches, they are a lot of work to land :( | 20:08 |
| morganfainberg | super useful but hard to get in because things are moving so much | 20:08 |
| morganfainberg | rebase hell | 20:08 |
| dstanek | morganfainberg: yeah, we just have to mover faster ;) | 20:08 |
| morganfainberg | not sure about your feelings on this, but i think this is useful to have https://review.openstack.org/#/c/79422/ | 20:09 |
| morganfainberg | probably should also add --slowest to run_tests | 20:09 |
| morganfainberg | i'm looking at your test ones now | 20:09 |
| dstanek | morganfainberg: stevemar had a good comment on my limits patch; i need to investigate, but i can probably start deleting some code | 20:10 |
| dstanek | bbiab | 20:12 |
| morganfainberg | also | 20:12 |
| *** dstanek is now known as dstanek_afk | 20:12 | |
| dstanek_afk | morganfainberg: ? | 20:12 |
| morganfainberg | i noticed when i ran the tests ayoung's revoke tests were far an away the slowest. | 20:12 |
| morganfainberg | not sure what is significantly different there | 20:12 |
| morganfainberg | dstanek_afk, catch up w/ test stuff when you get back | 20:12 |
| dstanek_afk | i noticed the same thing earlier today | 20:13 |
| jamielennox | morganfainberg: can you bring back: v | 20:14 |
| jamielennox | https://review.openstack.org/#/c/73074/ | 20:14 |
| morganfainberg | jamielennox, oh we need to make it stackforge though, right? | 20:15 |
| jamielennox | morganfainberg: yea - i can make the change and propose it as new if you don't want it | 20:15 |
| morganfainberg | jamielennox, i don't really care one way or another. if you want me to bring that patchset back i can | 20:16 |
| jamielennox | yea, please | 20:16 |
| morganfainberg | else feel free to just steal it and make it stackforge | 20:16 |
| morganfainberg | restored | 20:16 |
| morganfainberg | do you want to make the needed chagnes to make it stackforge? | 20:17 |
| jamielennox | sure | 20:17 |
| morganfainberg | i can look at doing that later today/tomorrow | 20:17 |
| morganfainberg | but if you want it sooner, please go for it | 20:17 |
| *** gyee has joined #openstack-keystone | 20:18 | |
| *** andreaf has joined #openstack-keystone | 20:20 | |
| *** andreaf has quit IRC | 20:21 | |
| *** rupsky has quit IRC | 20:27 | |
| *** mereda has joined #openstack-keystone | 20:30 | |
| *** rupsky has joined #openstack-keystone | 20:30 | |
| *** mereda has quit IRC | 20:42 | |
| *** inquizitor has joined #openstack-keystone | 20:43 | |
| *** inquizitor has quit IRC | 20:47 | |
| *** amcrn has quit IRC | 20:51 | |
| *** arborism has joined #openstack-keystone | 20:53 | |
| *** raildo has quit IRC | 20:58 | |
| *** marcoemorais has quit IRC | 21:01 | |
| *** marcoemorais has joined #openstack-keystone | 21:02 | |
| *** petertoft has quit IRC | 21:02 | |
| *** jimbaker` has joined #openstack-keystone | 21:15 | |
| *** zoresvit1 has quit IRC | 21:22 | |
| *** harlowja has quit IRC | 21:28 | |
| *** YorikSar has quit IRC | 21:28 | |
| *** mberlin1 has quit IRC | 21:28 | |
| *** jimbaker has quit IRC | 21:28 | |
| *** rwsu has quit IRC | 21:28 | |
| *** marcoemorais has quit IRC | 21:28 | |
| *** devlaps1 has quit IRC | 21:28 | |
| *** henrynash has quit IRC | 21:28 | |
| *** dims_ has quit IRC | 21:28 | |
| *** zhiyan_ has quit IRC | 21:28 | |
| *** gyee has quit IRC | 21:28 | |
| *** wchrisj has quit IRC | 21:28 | |
| *** zoresvit has quit IRC | 21:28 | |
| *** bknudson has quit IRC | 21:28 | |
| *** sudorandom has quit IRC | 21:28 | |
| *** haneef_ has quit IRC | 21:28 | |
| *** david-lyle has quit IRC | 21:28 | |
| *** stevemar has quit IRC | 21:28 | |
| *** chandan_kumar has quit IRC | 21:28 | |
| *** arborism has quit IRC | 21:28 | |
| *** nkinder_ has quit IRC | 21:28 | |
| *** browne has quit IRC | 21:28 | |
| *** pete5 has quit IRC | 21:28 | |
| *** jaypipes has quit IRC | 21:28 | |
| *** jamielennox has quit IRC | 21:28 | |
| *** koolhead17 has quit IRC | 21:28 | |
| *** lbragstad has quit IRC | 21:28 | |
| *** thedodd has quit IRC | 21:28 | |
| *** richm has quit IRC | 21:28 | |
| *** dstanek_afk has quit IRC | 21:28 | |
| *** openstackgerrit has quit IRC | 21:28 | |
| *** dtroyer has quit IRC | 21:28 | |
| *** Daviey has quit IRC | 21:28 | |
| *** dolphm has quit IRC | 21:28 | |
| *** mfisch has quit IRC | 21:29 | |
| *** chmouel has quit IRC | 21:29 | |
| *** mhu has quit IRC | 21:29 | |
| *** ChanServ has quit IRC | 21:29 | |
| *** morganfainberg has quit IRC | 21:29 | |
| *** anteaya has quit IRC | 21:29 | |
| *** luisbg has quit IRC | 21:29 | |
| *** zhiyan_ has joined #openstack-keystone | 21:38 | |
| *** chmouel has joined #openstack-keystone | 21:41 | |
| *** dims_ has joined #openstack-keystone | 21:41 | |
| *** henrynash has joined #openstack-keystone | 21:41 | |
| *** devlaps has joined #openstack-keystone | 21:41 | |
| *** marcoemorais has joined #openstack-keystone | 21:41 | |
| *** mfisch has joined #openstack-keystone | 21:41 | |
| *** mhu has joined #openstack-keystone | 21:41 | |
| *** dolphm has joined #openstack-keystone | 21:41 | |
| *** YorikSar_ has joined #openstack-keystone | 21:41 | |
| *** arborism has joined #openstack-keystone | 21:41 | |
| *** gyee has joined #openstack-keystone | 21:41 | |
| *** lbragstad has joined #openstack-keystone | 21:41 | |
| *** david-lyle has joined #openstack-keystone | 21:41 | |
| *** wchrisj has joined #openstack-keystone | 21:41 | |
| *** nkinder_ has joined #openstack-keystone | 21:41 | |
| *** thedodd has joined #openstack-keystone | 21:41 | |
| *** richm has joined #openstack-keystone | 21:41 | |
| *** stevemar has joined #openstack-keystone | 21:41 | |
| *** browne has joined #openstack-keystone | 21:41 | |
| *** zoresvit has joined #openstack-keystone | 21:41 | |
| *** bknudson has joined #openstack-keystone | 21:41 | |
| *** pete5 has joined #openstack-keystone | 21:41 | |
| *** jaypipes has joined #openstack-keystone | 21:41 | |
| *** chandan_kumar has joined #openstack-keystone | 21:41 | |
| *** dstanek_afk has joined #openstack-keystone | 21:41 | |
| *** openstackgerrit has joined #openstack-keystone | 21:41 | |
| *** haneef_ has joined #openstack-keystone | 21:41 | |
| *** sudorandom has joined #openstack-keystone | 21:41 | |
| *** jamielennox has joined #openstack-keystone | 21:41 | |
| *** koolhead17 has joined #openstack-keystone | 21:41 | |
| *** luisbg has joined #openstack-keystone | 21:41 | |
| *** anteaya has joined #openstack-keystone | 21:41 | |
| *** Daviey has joined #openstack-keystone | 21:41 | |
| *** dtroyer has joined #openstack-keystone | 21:41 | |
| *** morganfainberg has joined #openstack-keystone | 21:41 | |
| *** ChanServ has joined #openstack-keystone | 21:41 | |
| *** dickson.freenode.net sets mode: +oo dolphm ChanServ | 21:41 | |
| *** harlowja has joined #openstack-keystone | 21:45 | |
| *** petertoft has joined #openstack-keystone | 21:46 | |
| *** rwsu has joined #openstack-keystone | 21:46 | |
| *** lbragstad has quit IRC | 21:47 | |
| *** petertoft has quit IRC | 21:50 | |
| *** marekd has joined #openstack-keystone | 21:56 | |
| *** petertoft has joined #openstack-keystone | 21:59 | |
| *** jimbaker` is now known as jimbaker | 22:05 | |
| *** rupsky_ has joined #openstack-keystone | 22:13 | |
| *** leseb has quit IRC | 22:13 | |
| *** rupsky has quit IRC | 22:14 | |
| *** leseb has joined #openstack-keystone | 22:19 | |
| *** dims_ has quit IRC | 22:30 | |
| *** andreaf has joined #openstack-keystone | 22:31 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add slowest output to tox runs (testr) https://review.openstack.org/79422 | 22:37 |
| *** openstackstatus has joined #openstack-keystone | 22:44 | |
| *** dims_ has joined #openstack-keystone | 22:45 | |
| *** wchrisj has quit IRC | 22:48 | |
| *** petertoft has quit IRC | 22:49 | |
| *** ayoung has quit IRC | 22:50 | |
| *** arborism is now known as amcrn | 22:55 | |
| morganfainberg | jamielennox, it feels like people go out of their way to avoid using SQL-A | 22:55 |
| jamielennox | morganfainberg: yea, we found that before right | 22:56 |
| morganfainberg | jamielennox, yeah | 22:56 |
| morganfainberg | jamielennox, people love the "session.execute(<raw sql>) | 22:56 |
| jamielennox | dolphm: you still here? re: https://review.openstack.org/#/c/60752/ | 23:02 |
| jamielennox | is that you saying that you want endpoint_type to be renamed to interface? the only problem with that is that i map things passed via kwargs directly to the service_catalog and the service_catalog (object) uses endpoint_type | 23:03 |
| *** lbragstad has joined #openstack-keystone | 23:07 | |
| *** david-lyle has quit IRC | 23:08 | |
| jamielennox | morganfainberg: updated: https://review.openstack.org/#/c/73074 | 23:10 |
| morganfainberg | cool | 23:10 |
| lbragstad | dolphm: qq, here do you mean leave description nullable=False, like it currently is? And carry the optional description change in the catalog manager? https://bugs.launchpad.net/keystone/+bug/1272459 | 23:10 |
| jamielennox | have a look for me as i've no idea if i'm right or how to test it | 23:10 |
| morganfainberg | looking now | 23:10 |
| morganfainberg | looks sane to me | 23:11 |
| jamielennox | there is no barbican.conf file in the acls so i'm not sure if there is a barbican-milestone gorup | 23:11 |
| jamielennox | or a barbican-ptl | 23:11 |
| *** thedodd has quit IRC | 23:15 | |
| *** nkinder_ has quit IRC | 23:17 | |
| *** leseb has quit IRC | 23:21 | |
| *** andreaf has quit IRC | 23:21 | |
| morganfainberg | yeah | 23:27 |
| morganfainberg | infra will poke at me/you if it's wrong | 23:27 |
| morganfainberg | they're good | 23:27 |
| morganfainberg | you could bug SergeyLukjanov specicially | 23:28 |
| morganfainberg | he knows a lot about that stuff and is super helpful | 23:28 |
| morganfainberg | jamielennox, also you need to set the topic to 'new-project' | 23:28 |
| jamielennox | damn, i was going to do that | 23:29 |
| morganfainberg | also, projects are not alphabetical | 23:29 |
| morganfainberg | :P | 23:29 |
| jamielennox | oh? | 23:29 |
| jamielennox | everything i saw was alphabetical | 23:29 |
| jamielennox | or did i add something out of order/ | 23:29 |
| morganfainberg | yeah look at the jenkins failures | 23:29 |
| morganfainberg | no idea | 23:29 |
| morganfainberg | just looking at jenkins failures | 23:30 |
| *** Fin1te has joined #openstack-keystone | 23:31 | |
| *** ayoung has joined #openstack-keystone | 23:34 | |
| *** rupsky_ has quit IRC | 23:41 | |
| morganfainberg | lbragstad, ping migrate stuff | 23:44 |
| morganfainberg | lbragstad, i have an almost working version | 23:44 |
| lbragstad | for rename? | 23:44 |
| morganfainberg | lbragstad, if you want me to post a pass at it (or at least a diff to a paste) | 23:44 |
| morganfainberg | lbragstad, and incorporating the other fixes we talked about | 23:44 |
| lbragstad | morganfainberg: sure, go for it. | 23:44 |
| lbragstad | whatever is easiest for you | 23:44 |
| morganfainberg | lbragstad, e.g. not doing the migrate if the constraint doesn't exist, etc | 23:44 |
| lbragstad | ++ | 23:45 |
| *** marekd is now known as marekd|away | 23:45 | |
| lbragstad | morganfainberg: thank you | 23:45 |
| morganfainberg | lbragstad, i didn't want ot take it over if you really wanted to dive into it | 23:45 |
| lbragstad | either works just fine for me | 23:45 |
| morganfainberg | it's a little painful to interact with non-named (guaranteed named) constraints :P | 23:45 |
| morganfainberg | lbragstad, k will post shortly-ish | 23:46 |
| lbragstad | morganfainberg: cool, thanks! | 23:46 |
| morganfainberg | lbragstad, just doing a couple checks on data introspection | 23:46 |
| lbragstad | good deal | 23:46 |
| *** Fin1te has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!