| *** arun_kant has quit IRC | 00:01 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Configurable token hash algorithm https://review.openstack.org/80401 | 00:06 |
|---|---|---|
| *** dims_ has quit IRC | 00:07 | |
| *** dims_ has joined #openstack-keystone | 00:21 | |
| *** stmi has left #openstack-keystone | 00:23 | |
| dstanek | marekd|away: that would be awesome | 00:33 |
| *** amcrn has quit IRC | 00:43 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Ensure JSON headers in Auth Requests https://review.openstack.org/85209 | 01:04 |
| *** marcoemorais has quit IRC | 01:10 | |
| *** joesavak has joined #openstack-keystone | 01:18 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Allow hash tokens with sha256 https://review.openstack.org/80398 | 01:19 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Ensure JSON headers in Auth Requests https://review.openstack.org/85209 | 01:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add new error for invalid auth response https://review.openstack.org/85213 | 01:24 |
| *** askb_ has joined #openstack-keystone | 01:25 | |
| *** askb_ has quit IRC | 01:28 | |
| *** askb_ has joined #openstack-keystone | 01:28 | |
| *** askb_ has quit IRC | 01:28 | |
| *** askb_ has joined #openstack-keystone | 01:29 | |
| *** joesavak has quit IRC | 01:34 | |
| *** stevemar has joined #openstack-keystone | 01:36 | |
| *** stevemar has quit IRC | 01:53 | |
| *** mberlin has joined #openstack-keystone | 01:55 | |
| *** mberlin1 has quit IRC | 01:56 | |
| *** stevemar has joined #openstack-keystone | 02:00 | |
| *** morganfainberg is now known as morganfainberg_Z | 02:22 | |
| *** zhiyan_ is now known as zhiyan | 02:24 | |
| *** dims_ has quit IRC | 02:29 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Create a V3 Token Generator https://review.openstack.org/78878 | 02:32 |
| *** stevemar has quit IRC | 02:33 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Remove legacy_endpoint_id and enabled from service catalog https://review.openstack.org/85147 | 03:09 |
| *** ayoung is now known as ayoung_ZZZzzz__ | 03:09 | |
| *** polyservice has joined #openstack-keystone | 03:11 | |
| *** stevemar has joined #openstack-keystone | 03:24 | |
| openstackgerrit | A change was merged to openstack/keystone: Removes useless wrapper from manager base class https://review.openstack.org/84553 | 03:47 |
| *** jamielennox is now known as jamielennox|away | 03:58 | |
| *** polyservice has quit IRC | 04:02 | |
| *** harlowja is now known as harlowja_away | 04:03 | |
| *** jamielennox|away is now known as jamielennox | 04:03 | |
| *** masoto has joined #openstack-keystone | 04:10 | |
| *** david-lyle has joined #openstack-keystone | 04:11 | |
| *** dstanek has quit IRC | 04:13 | |
| *** chandan_kumar has joined #openstack-keystone | 04:16 | |
| *** stevemar has quit IRC | 04:20 | |
| *** lbragstad has joined #openstack-keystone | 04:25 | |
| *** wchrisj_ has quit IRC | 04:44 | |
| *** wchrisj has joined #openstack-keystone | 04:54 | |
| *** marcoemorais has joined #openstack-keystone | 05:05 | |
| *** chandan_kumar has quit IRC | 05:06 | |
| *** ben00b has joined #openstack-keystone | 05:06 | |
| *** marcoemorais1 has joined #openstack-keystone | 05:06 | |
| *** ben00b has quit IRC | 05:08 | |
| *** chandan_kumar has joined #openstack-keystone | 05:08 | |
| *** marcoemorais has quit IRC | 05:09 | |
| openstackgerrit | Andrey Kurilin proposed a change to openstack/python-keystoneclient: Use `HttpNotImplemented` in `tests.v3.test_trusts` https://review.openstack.org/73993 | 05:14 |
| *** marcoemorais1 has quit IRC | 05:19 | |
| *** marcoemorais has joined #openstack-keystone | 05:19 | |
| *** zhiyan is now known as zhiyan_ | 05:25 | |
| *** henrynash has joined #openstack-keystone | 05:29 | |
| *** harlowja_away has quit IRC | 05:29 | |
| *** gokrokve has joined #openstack-keystone | 05:39 | |
| *** gokrokve_ has joined #openstack-keystone | 05:40 | |
| *** lbragstad has quit IRC | 05:43 | |
| *** gokrokve has quit IRC | 05:44 | |
| *** topol has quit IRC | 05:48 | |
| *** Guest__ has joined #openstack-keystone | 05:54 | |
| *** Guest__ is now known as bach | 05:55 | |
| *** bach is now known as bachng | 05:55 | |
| *** bachng has quit IRC | 05:57 | |
| *** Guest__ has joined #openstack-keystone | 05:58 | |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/83955 | 06:00 |
| *** Guest__ is now known as bach | 06:04 | |
| *** gokrokve_ has quit IRC | 06:07 | |
| *** bach has quit IRC | 06:13 | |
| *** Guest__ has joined #openstack-keystone | 06:18 | |
| *** Guest__ has quit IRC | 06:38 | |
| *** bvandenh has joined #openstack-keystone | 06:38 | |
| *** henrynash has quit IRC | 06:40 | |
| *** masoto has quit IRC | 06:57 | |
| *** marekd|away is now known as marekd | 06:59 | |
| *** chandankumar_ has joined #openstack-keystone | 06:59 | |
| *** saju_m has joined #openstack-keystone | 07:12 | |
| *** leseb has joined #openstack-keystone | 07:23 | |
| *** chandankumar_ has quit IRC | 07:23 | |
| *** mberlin has quit IRC | 07:34 | |
| *** mberlin has joined #openstack-keystone | 07:45 | |
| *** marcoemorais has quit IRC | 07:50 | |
| *** henrynash has joined #openstack-keystone | 07:54 | |
| *** zhiyan_ is now known as zhiyan | 07:56 | |
| *** d0ugal has joined #openstack-keystone | 08:06 | |
| *** henrynash has quit IRC | 08:23 | |
| *** henrynash has joined #openstack-keystone | 08:30 | |
| *** henrynash has quit IRC | 08:32 | |
| *** wchrisj has quit IRC | 08:33 | |
| *** wchrisj has joined #openstack-keystone | 08:33 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: List all forbidden attributes in the request body. https://review.openstack.org/84389 | 08:55 |
| *** saju_m has quit IRC | 09:56 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: List all forbidden attributes in the request body. https://review.openstack.org/84389 | 09:58 |
| *** leseb has quit IRC | 10:04 | |
| *** saju_m has joined #openstack-keystone | 10:10 | |
| *** jaosorior has joined #openstack-keystone | 10:12 | |
| *** saju_m has quit IRC | 10:14 | |
| *** leseb has joined #openstack-keystone | 10:17 | |
| jaosorior | Hello | 10:18 |
| jaosorior | I have a fix for this bug https://bugs.launchpad.net/keystone/+bug/1278738 but I found that I could also refactor some of the code from the create_trust function in keystone/trust/controllers.py to improve readability. If you guys agree that it is a good idea, should I open a separate bug for that? | 10:20 |
| uvirtbot | Launchpad bug 1278738 in keystone "trusts in keystone fail in driver when impersonation is not provided" [Undecided,New] | 10:21 |
| *** mberlin has quit IRC | 10:28 | |
| *** mberlin has joined #openstack-keystone | 10:30 | |
| *** saju_m has joined #openstack-keystone | 10:30 | |
| *** saju_m has quit IRC | 10:35 | |
| *** saju_m has joined #openstack-keystone | 10:36 | |
| *** chandankumar_ has joined #openstack-keystone | 10:39 | |
| *** saju_m has quit IRC | 10:40 | |
| *** saju_m has joined #openstack-keystone | 10:41 | |
| jamielennox | jaosorior: don't worry about a bug for just a refactor like that - if you have it submit it for review | 10:46 |
| jaosorior | alright | 10:47 |
| jaosorior | thanks | 10:47 |
| *** jamielennox is now known as jamielennox|away | 10:49 | |
| *** d0ugal has quit IRC | 10:51 | |
| *** chandankumar_ has quit IRC | 10:55 | |
| *** chandankumar_ has joined #openstack-keystone | 11:13 | |
| *** saju_m has quit IRC | 11:38 | |
| *** david-lyle has quit IRC | 11:54 | |
| *** Chicago has quit IRC | 12:06 | |
| *** saju_m has joined #openstack-keystone | 12:11 | |
| *** saju_m has quit IRC | 12:14 | |
| *** saju_m has joined #openstack-keystone | 12:16 | |
| *** dstanek has joined #openstack-keystone | 12:31 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Fix response for missing attributes in trust https://review.openstack.org/85327 | 12:34 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Fix base.CrudManager.put() method. https://review.openstack.org/85020 | 12:35 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Fix base.CrudManager.put() method. https://review.openstack.org/85020 | 12:39 |
| *** askb_ has quit IRC | 12:43 | |
| *** d0ugal has joined #openstack-keystone | 12:46 | |
| *** d0ugal has joined #openstack-keystone | 12:46 | |
| *** chandankumar_ has quit IRC | 12:47 | |
| *** Fin1te has joined #openstack-keystone | 12:49 | |
| *** Fin1te has left #openstack-keystone | 12:51 | |
| dolphm | ayoung_ZZZzzz__: bknudson: ping me when one of ya'll has a chance to discuss https://bugs.launchpad.net/keystone/+bug/1302106 | 12:55 |
| uvirtbot | Launchpad bug 1302106 in keystone "LDAP non-URL safe characters cause auth failure" [High,Triaged] | 12:55 |
| *** saju_m has quit IRC | 12:57 | |
| *** henrynash has joined #openstack-keystone | 12:58 | |
| *** ayoung_ZZZzzz__ is now known as ayoung | 13:02 | |
| ayoung | dolphm, hmmm | 13:03 |
| ayoung | dolphm, I'm not certain that CN="Doe, John" is right anyway | 13:03 |
| ayoung | I'd defer to some LDAP type folks that are smarter than me on that. But assuming we have to support it anyway, it should not be too hard to reproduce | 13:04 |
| ayoung | I don't know if it is "Non URL Safe" that is the issue, in that the username is not passed as an URL parameter, but rather in the body of the JSON. I suspect it is more string handling than anything else, in how the BaseLDAP builds the filter | 13:05 |
| ayoung | dolphm, on the same note, I want to backport the series of patches that John Dennis did for UTF-* characters and LDAP. We have a requirement it ship it for a Havana based release. I'm going to submit it for backport to Havana-Stable. | 13:07 |
| ayoung | I'm tempted to take his 4 patches and squash them into one. | 13:07 |
| bknudson | dolphm: It looks like its a failure to properly escape characters in the LDAP filter | 13:09 |
| dolphm | ayoung: i think it's just that it's a comma, but yeah, the point is that we're not using http://www.python-ldap.org/doc/html/ldap-filter.html somewhere | 13:09 |
| *** joesavak has joined #openstack-keystone | 13:10 | |
| *** d0ugal has quit IRC | 13:11 | |
| *** wchrisj is now known as wchrisj_ | 13:14 | |
| *** d0ugal has joined #openstack-keystone | 13:15 | |
| ayoung | dolphm, regarding your comment "you're introducing a new public method to the driver -- make it private" is that OK to make private if it is used by a subclass? | 13:16 |
| dolphm | ayoung: what subclass? | 13:17 |
| ayoung | dolphm, the endpoint_filter sql_catalog | 13:17 |
| dolphm | ayoung: can you fix the bug before rewriting everything? | 13:19 |
| *** lbragstad has joined #openstack-keystone | 13:20 | |
| ayoung | dolphm, well, when I changed the test to check the endpoint, it broke the test for filter. I really need to make the change for botrh the baseclass and the subclass to fix the bug, otherwise filtered catalogs will have legacy_endpoint in them as well | 13:20 |
| dolphm | ayoung: understood - so make that change carefully, and then refactor later in master | 13:20 |
| dolphm | ayoung: the work you did isn't backportable as a single patch - it's too extensive | 13:20 |
| *** topol has joined #openstack-keystone | 13:21 | |
| ayoung | dolphm, really? | 13:22 |
| ayoung | becuse it changes endpoint_filter as well? | 13:23 |
| dolphm | ayoung: because you completely rewrote endpoint_filter and refactored the sql catalog backend | 13:23 |
| ayoung | dolphm, the endpoint filter code as it was written was wrong, and it was hard to see that it was wrong. It duplicated logic that was done correctly in the baseclass, and duplicated it incorrectly. | 13:25 |
| dolphm | ayoung: then you should track that work in a separate bug! | 13:25 |
| dolphm | ayoung: we can't backport undocumented changes | 13:26 |
| *** vhoward- has joined #openstack-keystone | 13:26 | |
| ayoung | I'm fairly certain that if we look at the service catalog as produced by that there would be other problems. But this fix is for "legacy_endpoint and enabled" and the refactoring makes it so that the fix applies across all catalogs | 13:26 |
| ayoung | its relly not that big a change | 13:26 |
| dolphm | ayoung: it's fine for master, but it's completely out of scope to be backported for the referenced bug | 13:27 |
| ayoung | dolphm, so do it as two changes: one that fixes the bug, and then a second that is a refactor to remove the duplicated code? OK | 13:29 |
| dolphm | ayoung: ++ we'll backport the first one (even to stable/havana) and then the refactor can stay in master | 13:30 |
| ayoung | Deal | 13:30 |
| ayoung | does havana have the endpoint_filter bug? | 13:30 |
| ayoung | er. extension? | 13:30 |
| dolphm | ayoung: yes | 13:30 |
| ayoung | OK., then it should backport clean | 13:30 |
| dolphm | ayoung: probably, it hasn't been touched since it landed afaik | 13:30 |
| dolphm | ayoung: landed in havana-3 i think | 13:30 |
| ayoung | cool | 13:31 |
| bknudson | ldap.filter.escape_filter_chars('Doe, John') -> 'Doe, John' | 13:33 |
| dolphm | bknudson: really? lol | 13:33 |
| bknudson | ldap.filter.escape_filter_chars('Doe, John',1) -> 'Doe\\2c\\20John' | 13:33 |
| bknudson | the code looks like it's doing escape_filter_chars everywhere it needs to. | 13:34 |
| dolphm | bknudson: python -c "import ldap.filter; print ldap.filter.escape_filter_chars('John, Doe', escape_mode=1)" | 13:34 |
| ayoung | dolphm, bknudson do you ever get this when running tox? http://paste.openstack.org/show/75081/ I ran tox -epy27 -r last night and it ran fine, then, to test in the venv, I ran activate then pip install nose. Now tox -epy27 fails with the above stack trace | 13:36 |
| ayoung | I'm not certain what file is missing | 13:36 |
| bknudson | ayoung: I haven't seen that one before. | 13:37 |
| ayoung | bknudson, I wonder if it is because I am running tox from within the venv... | 13:37 |
| ayoung | lemme try it without | 13:37 |
| dolphm | ayoung: that's new to me | 13:37 |
| dolphm | ayoung: maybe it's trying to remove itself | 13:38 |
| ayoung | it looks like it. I ran it from outside the venv and ...well, it is running | 13:38 |
| dolphm | ayoung: i've never sourced a tox environment, i suppose | 13:39 |
| ayoung | dolphm, yeah, I think that is the problem here. tox is itself a python program, so I suspect that running it with the venv active is messing it up. | 13:39 |
| ayoung | dolphm, I'm going to repost the patch. I ran the failing tests for endpoint filter and they pass now. I suspect we are good. I'll keep the tox run going local, too, but it is slow | 13:40 |
| ayoung | did the sqlite in memory fix go in, or is that Juno? | 13:40 |
| jaosorior | Hi, I uploaded a patch for a bug (https://review.openstack.org/85327) and got a Jenkins error for the environment py27. I ran the tests with that environment in my machine (before pushing, and after I saw the error) and the tests passed here. This is the output of the test in Jenkins http://paste.openstack.org/show/75082/ . Any ideas on how I may reproduce | 13:40 |
| jaosorior | this? | 13:40 |
| dolphm | ayoung: it's in juno | 13:41 |
| ayoung | ah, that is part of my problem... | 13:41 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Remove legacy_endpoint_id and enabled from service catalog https://review.openstack.org/85147 | 13:41 |
| ayoung | dolphm, I think you'll prefer ^^ | 13:41 |
| dolphm | jaosorior: that looks like a transient error caused by concurrent test runners, which we just introduced to master | 13:41 |
| ayoung | https://review.openstack.org/#/c/85147/1..3/keystone/contrib/endpoint_filter/backends/catalog_sql.py | 13:41 |
| bknudson | ldapsearch -LL -D cn=Manager,dc=openstack,dc=org -w pwd -s base -b "cn=Doe\\2c\\20John,ou=Users,dc=openstack,dc=org" --> dn: cn=Doe\2C John,ou=Users,dc=openstack,dc=org | 13:41 |
| bknudson | so looks like the escaping works | 13:42 |
| dolphm | jaosorior: you could probably reproduce by running keystone.tests.test_revoke repeatedly | 13:42 |
| *** d0ugal has quit IRC | 13:42 | |
| bknudson | oh, this is a filter. | 13:42 |
| dolphm | bknudson: what does the "oh" mean? | 13:42 |
| bknudson | the value allowed in a filter might be different than the dn | 13:43 |
| dolphm | ayoung: is there an 'enabled' exposed for services too? | 13:43 |
| *** bknudson has left #openstack-keystone | 13:43 | |
| *** bknudson has joined #openstack-keystone | 13:43 | |
| dolphm | ayoung: nevermind, doesn't look like it | 13:43 |
| bknudson | ldapsearch -LL -D cn=Manager,dc=openstack,dc=org -w pwd -s one -b "ou=Users,dc=openstack,dc=org" "(cn=Doe, John)" -> dn: cn=Doe\2C John,ou=Users,dc=openstack,dc=org | 13:43 |
| bknudson | so that gets the user. | 13:43 |
| dolphm | ayoung: did you see my comment about moving the new assertions in keystone/tests/test_v3.py ? | 13:44 |
| bknudson | maybe active directory is pickier | 13:44 |
| dolphm | bknudson: ++ probably so | 13:44 |
| bknudson | ldapsearch -LL -D cn=Manager,dc=openstack,dc=org -w ofs5dac -s one -b "ou=Users,dc=openstack,dc=org" "(cn=Doe\\2c\\20John)" -> returns the user | 13:45 |
| dolphm | bknudson: that's escape_mode=1 ? | 13:45 |
| bknudson | so looks like openldap also accepts the escaped filter | 13:45 |
| jaosorior | dolphm, so, how could I get Jenkins to run the tests again? | 13:47 |
| dolphm | jaosorior: file a bug against keystone with the stack trace you saw, note that it was a transient error in the bug report, and then leave a comment on the review with just "recheck bug <the bug number you created>" | 13:49 |
| jaosorior | thanks | 13:51 |
| dolphm | ayoung: and why do you need to "Bypass the check for XML" ? | 13:52 |
| *** richm has joined #openstack-keystone | 13:54 | |
| *** derek_c has joined #openstack-keystone | 13:57 | |
| marekd | dstanek: LOL, as usual, 1 line of fixes and 100 of tests, new hierarchy etc :P | 13:59 |
| dstanek | marekd: gotta love testing :-) | 14:00 |
| marekd | dstanek: now even saying I wasted ~1.5h trying to use self.assertRaisesRegexp and compare messages from the raised exception...and failed :P | 14:01 |
| marekd | which is strange, as the text is identical and the only difference I could find was comparision of str vs. unicode. | 14:02 |
| marekd | dstanek which was resulting in True when I checked it on the normal interpreter. | 14:02 |
| dstanek | marekd: i've never tried that before, but you said regexp so i understand | 14:03 |
| marekd | dstanek: so please just don't -1 for not comparing exception messages and we all will be happy. | 14:05 |
| marekd | dstanek: i am now making the changes to address your comments. | 14:05 |
| dstanek | marekd: i wouldn't do that to you! | 14:07 |
| *** d0ugal_ has joined #openstack-keystone | 14:07 | |
| ayoung | dolphm, when you said "assert against service_id" do you mean something like self.assertEqual(service['id'], endpoint['service_id']) | 14:11 |
| ayoung | if so, I can't do that. service_id has been removed from the endpoint | 14:11 |
| dstanek | bknudson: looking at https://review.openstack.org/#/c/75708 - is that to replace the ones generated by sphinx? | 14:13 |
| bknudson | dstanek: that should be a WIP... seems like it lost it when I restored | 14:14 |
| bknudson | dstanek: this will be the input to sphinx | 14:14 |
| dstanek | bknudson: ah ok - i'm move on to the next review then | 14:15 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: List all forbidden attributes in the request body. https://review.openstack.org/84389 | 14:17 |
| marekd | dstanek: ^^ | 14:17 |
| *** d0ugal_ is now known as d0ugal | 14:18 | |
| *** ayoung has quit IRC | 14:18 | |
| dstanek | marekd: nice, i'll take a look after this meeting | 14:18 |
| marekd | dstanek: no problem, take your time. | 14:18 |
| *** d0ugal is now known as d0ugal_ | 14:19 | |
| *** d0ugal_ is now known as d0ugal | 14:19 | |
| *** d0ugal has joined #openstack-keystone | 14:19 | |
| *** thedodd has joined #openstack-keystone | 14:26 | |
| *** saju_m has joined #openstack-keystone | 14:31 | |
| dstanek | bknudson: i didn't mockpatch existed in oslotest - i'll make a second patch to change the import | 14:31 |
| *** saju_m has quit IRC | 14:34 | |
| *** saju_m has joined #openstack-keystone | 14:35 | |
| *** stevemar has joined #openstack-keystone | 14:37 | |
| *** vhoward- has left #openstack-keystone | 14:38 | |
| *** david-lyle has joined #openstack-keystone | 14:38 | |
| bknudson | dolphm: my active directory server also accepted "(cn=Doe, John)" filter -- didn't need to escape the , | 14:40 |
| bknudson | dolphm: also, looks like the exception is raised by the python-ldap library and not as a response from the server. | 14:41 |
| dolphm | bknudson: so you weren't able to reproduce? | 14:43 |
| *** browne has joined #openstack-keystone | 14:43 | |
| bknudson | dolphm: I wasn't able to reproduce it | 14:44 |
| bknudson | dolphm: I'm not running on ubuntu cloud ... don't know what python-ldap that's using. | 14:44 |
| dolphm | bknudson: i was just trying to figure out what was in use | 14:45 |
| dolphm | bknudson: the bug report was from a stable/havana deployment | 14:45 |
| bknudson | dolphm: I should try my python-ldap... I was just using the command-line. | 14:45 |
| dolphm | bknudson: they could have been using 2.4.13 (released july 2013) versus the latest (2.4.15) | 14:46 |
| dolphm | i doubt that would have changed between the two | 14:46 |
| *** gokrokve has joined #openstack-keystone | 14:48 | |
| *** topol has quit IRC | 14:50 | |
| dolphm | bknudson: could try 2.3.13 i suppose (packaged in precise) | 14:50 |
| bknudson | no complaints from ldap_.search_s('ou=Users,dc=openstack,dc=org', ldap.SCOPE_ONELEVEL, '(cn=Doe, John)') | 14:56 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Ignore broken endpoints in get_v3_catalog https://review.openstack.org/81527 | 14:56 |
| dolphm | bknudson: thanks for investigating... i untargeted rc2, and left it as rc-potential for now | 14:57 |
| dolphm | bknudson: should probably reduce the priority to medium as well? | 14:57 |
| bknudson | one more try -- create a user in keystone and try to set its id | 14:57 |
| bknudson | dolphm: I think I recreated it... had to run in keystone | 15:04 |
| *** jsavak has joined #openstack-keystone | 15:04 | |
| bknudson | keystone --os-username john --os-password=blkpwd token-get -- {'desc': 'Bad search filter'} | 15:04 |
| dolphm | bknudson: so john is the _name / sAMAccountName and _id is cn with comma there? | 15:05 |
| bknudson | dolphm: I'll need to start up the debugger. | 15:05 |
| bknudson | or maybe I could just look at the debug | 15:06 |
| dolphm | bknudson: i wonder if we're really butchering something then :-/ | 15:06 |
| bknudson | (&(&(objectClass=groupOfNames)(member=cn=Doe\, John,ou=Users,dc=openstack,dc=org))(objectClass=groupOfNames)) | 15:06 |
| dolphm | bknudson: that's raising the bad search filter? | 15:07 |
| bknudson | dolphm: looks like it... ldapsearch also doesn't like it | 15:07 |
| *** joesavak has quit IRC | 15:07 | |
| bknudson | it doesn't mind "(&(&(objectClass=groupOfNames)(member=cn=Doe, John,ou=Users,dc=openstack,dc=org))(objectClass=groupOfNames))" (remove the \ from the ,) | 15:08 |
| dolphm | bknudson: ha | 15:08 |
| dolphm | bknudson: where are we inserting the \ ? | 15:08 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap.py#n331 | 15:13 |
| bknudson | it's building a filter and it's not escaping there... maybe that's it. | 15:13 |
| dolphm | bknudson: would it be escaped by _id_to_dn() already? | 15:14 |
| bknudson | the dn shouldn't be escaped, but it has to be escaped for the filter | 15:15 |
| bknudson | it's easy to add the filter escape, but I'll have to look into the _id_to_dn also. | 15:15 |
| bknudson | well, I'm able to get a token | 15:17 |
| bknudson | escaping the user_dn in list_user_groups() | 15:17 |
| dolphm | bknudson: what's the diff? | 15:18 |
| bknudson | (&(&(objectClass=groupOfNames)(member=cn=Doe\5c, John,ou=Users,dc=openstack,dc=org))(objectClass=groupOfNames)) | 15:18 |
| bknudson | weird | 15:18 |
| dolphm | wtf | 15:18 |
| bknudson | it's getting the right roles | 15:19 |
| dolphm | bknudson: does python-ldap have an unescape method? | 15:20 |
| bknudson | the dn shouldn't be escaped... I'll see what id_to_dn is doing | 15:20 |
| marekd | stevemar: https://review.openstack.org/#/c/84389/8/keystone/tests/test_v3_controller.py line 52: you want to move """ from line 52 to line 51 ? | 15:21 |
| dolphm | bknudson: http://www.python-ldap.org/doc/html/ldap-dn.html#ldap.dn.escape_dn_chars | 15:21 |
| dolphm | marekd: i think he's just saying you can use a """one line docstr""" | 15:21 |
| stevemar | marekd, if you can | 15:22 |
| stevemar | dolphm, knows what i means | 15:22 |
| marekd | stevemar: yeah, i am blind today.... | 15:22 |
| stevemar | marekd, happens :) | 15:22 |
| marekd | thanks dolphm | 15:22 |
| stevemar | marekd, """one line docstr""" no period at the end of the sentence | 15:23 |
| dolphm | marekd: regarding being blind http://www.ted.com/talks/chris_hadfield_what_i_learned_from_going_blind_in_space | 15:23 |
| stevemar | marekd, no issues, it's a friday after all | 15:23 |
| stevemar | dolphm, saw that one, it's awesome, anything hadfield is awesome | 15:23 |
| marekd | sounds like good recommendation to watch it. | 15:25 |
| *** ilives has quit IRC | 15:25 | |
| dstanek | has anyone seen this error? http://logs.openstack.org/50/84050/5/gate/gate-keystone-python26/205fc03/console.html | 15:26 |
| dstanek | maybe another parallel issue? | 15:27 |
| marekd | stevemar: actually I was not sure about that 'no period': tox -epep8 -> ./keystone/tests/test_v3_controller.py:24:1: H402 one line docstring needs punctuation. | 15:27 |
| dolphm | dstanek: ++ jaosorior ran into something similar http://paste.openstack.org/show/75082/ | 15:27 |
| dolphm | marekd: we don't enforce that | 15:28 |
| *** browne has quit IRC | 15:28 | |
| dolphm | marekd: and in fact, there's probably more preference against it | 15:28 |
| dolphm | marekd: just like you wouldn't put a period in an email's subject line | 15:28 |
| marekd | dolphm: so pep8 tests are different on gerrit from my local tests ? | 15:29 |
| marekd | different on gerrit and my local machine? *** | 15:29 |
| stevemar | yeah, the exceptions are in tox.ini | 15:30 |
| stevemar | marekd, https://github.com/openstack/keystone/blob/master/tox.ini#L39 | 15:30 |
| dstanek | dolphm: looks like it's been reported by stevemar - https://bugs.launchpad.net/keystone/+bug/1300581 | 15:30 |
| stevemar | run it using flake8 | 15:30 |
| uvirtbot | Launchpad bug 1300581 in keystone "test_revoke.RevokeTreeTests.test_cleanup fails" [Critical,Triaged] | 15:30 |
| stevemar | dstanek, yes, it's been creeping up more and more lately | 15:31 |
| dolphm | marekd: they shouldn't be! tox -e pep8 should be identical, and even running flake8 locally should pickup config from tox.ini | 15:31 |
| dstanek | marekd: unless you have older pep8, hacking, etc | 15:31 |
| dolphm | dstanek: ooh, that is the same one. thanks! | 15:31 |
| dstanek | you can 'tox -re pep8' to recreate your venv | 15:31 |
| dstanek | dolphm, stevemar, morganfainberg_Z: is anyone working on that already? | 15:32 |
| dolphm | dstanek: no | 15:32 |
| stevemar | dstanek, afaik, no | 15:32 |
| stevemar | dolphm, i think it merits some investigation now, thats 4 rechecks in 3 days | 15:33 |
| stevemar | dstanek, bknudson found a similar one, but it complained about keystoneclient tests | 15:33 |
| dstanek | stevemar: i think i'm going to look at it now | 15:33 |
| marekd | dstanek: tox.ini also includes that 'ignore period warning' thing. so maybe my venv is old. | 15:33 |
| dstanek | marekd: recreate it just to be safe. only takes a min or two | 15:34 |
| marekd | dstanek: of course. | 15:34 |
| marekd | dstanek: thanks | 15:34 |
| *** saju_m has quit IRC | 15:35 | |
| marekd | o, now it worked :P | 15:35 |
| dolphm | dstanek: should neither of the patches on https://bugs.launchpad.net/keystone/+bug/1230279 be Closes-Bug? | 15:36 |
| uvirtbot | Launchpad bug 1230279 in keystone "malformed endpoint URLs are destroying the API" [Medium,In progress] | 15:36 |
| bknudson | dolphm: looks like the query is correct... it's able to find the user in the group | 15:36 |
| bknudson | u'(&(objectClass=groupOfNames)(member=cn=Doe\\5c, John,ou=Users,dc=openstack,dc=org))' | 15:36 |
| bknudson | [{'id': u'4ce1790d07aa44e7aac63daae199943b', 'name': u'blkgrp'}] | 15:36 |
| bknudson | I added john to the group | 15:36 |
| dolphm | bknudson: that's the strangest looking escape / encoding syntax i've ever seen | 15:37 |
| *** d0ugal has quit IRC | 15:38 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Remove legacy_endpoint_id and enabled from service catalog https://review.openstack.org/85147 | 15:38 |
| dolphm | ayoung: ^ | 15:38 |
| dolphm | stevemar: review? https://review.openstack.org/#/c/85147/ | 15:39 |
| marekd | stevemar: dolphm: wait a sec, the pep8 failed again with (I guess?) the error H402, whereas the link from stevemar mentioned ignoring H803 and the comment says: "Commit message should not end with a period" | 15:41 |
| *** kun_huang has joined #openstack-keystone | 15:43 | |
| openstackgerrit | Davanum Srinivas (dims) proposed a change to openstack/keystone: enable multiple keystone-all worker processes https://review.openstack.org/85395 | 15:46 |
| *** kun_huang has quit IRC | 15:47 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: List all forbidden attributes in the request body. https://review.openstack.org/84389 | 15:53 |
| *** marekd is now known as marekd|away | 15:54 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix invalid LDAP filter for user ID with comma https://review.openstack.org/85402 | 15:57 |
| *** joesavak has joined #openstack-keystone | 15:59 | |
| *** jsavak has quit IRC | 16:00 | |
| *** RockKuo_TW has quit IRC | 16:01 | |
| *** gokrokve has quit IRC | 16:06 | |
| bknudson | I'm working on a unit test for ^ -- not sure if our FakeLdap can handle it. | 16:09 |
| openstackgerrit | A change was merged to openstack/keystone: Reduce environment logging https://review.openstack.org/82391 | 16:14 |
| dstanek | i don't see how this test_cleanup failure can be a parallel tests problem - it's not using the DB or anything shared from what i can tell | 16:24 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: List all forbidden attributes in the request body. https://review.openstack.org/84389 | 16:25 |
| stevemar | dstanek, you think it's something else? | 16:28 |
| *** leseb has quit IRC | 16:31 | |
| dstanek | stevemar: i don't have any idea what because i can't reproduce, but i can't see how it couldn't be something else | 16:33 |
| *** topol has joined #openstack-keystone | 16:36 | |
| *** chandankumar_ has joined #openstack-keystone | 16:42 | |
| stevemar | dstanek, double negatives everywhere | 16:42 |
| stevemar | dstanek, but i hear ya :) | 16:42 |
| dstanek | stevemar: :-) that's what happens when you keep editing the same line before sending | 16:42 |
| dstanek | stevemar: that test class is testing RevokeTree which keeps it's own instance state and isn't using a db or shared resource | 16:43 |
| dstanek | stevemar: this line is curious thought - Adding cache-proxy 'keystone.tests.test_cache.CacheIsolatingProxy' to backend. | 16:45 |
| *** Guest__ has joined #openstack-keystone | 16:48 | |
| openstackgerrit | Davanum Srinivas (dims) proposed a change to openstack/keystone: enable multiple keystone-all worker processes https://review.openstack.org/85395 | 16:53 |
| *** Guest__ has quit IRC | 16:54 | |
| *** browne has joined #openstack-keystone | 16:59 | |
| *** gokrokve has joined #openstack-keystone | 17:00 | |
| *** harlowja has joined #openstack-keystone | 17:04 | |
| *** marcoemorais has joined #openstack-keystone | 17:04 | |
| openstackgerrit | Davanum Srinivas (dims) proposed a change to openstack/keystone: enable multiple keystone-all worker processes https://review.openstack.org/85395 | 17:07 |
| *** chandankumar_ has quit IRC | 17:09 | |
| *** leseb has joined #openstack-keystone | 17:32 | |
| *** leseb has quit IRC | 17:37 | |
| *** marcoemorais has quit IRC | 17:40 | |
| *** marcoemorais has joined #openstack-keystone | 17:41 | |
| dolphm | third review appreciated on https://review.openstack.org/#/c/85147/ since i refactored the tests in the most recent patchset! | 17:42 |
| *** zhiyan is now known as zhiyan_ | 17:42 | |
| *** morganfainberg_Z is now known as morganfainberg | 17:45 | |
| morganfainberg | dolphm, +2 | 17:48 |
| dolphm | morganfainberg: thanks! | 17:48 |
| morganfainberg | dolphm, didn't +A though, | 17:51 |
| morganfainberg | dolphm, wasn't sure if you wanted approved or not. | 17:51 |
| dolphm | morganfainberg: go for it | 17:52 |
| morganfainberg | dolphm, done. | 17:52 |
| dolphm | morganfainberg: i was about to propose a backport | 17:52 |
| morganfainberg | approved! | 17:52 |
| dstanek | morganfainberg: i really like to see this '+0, -229' | 17:53 |
| morganfainberg | dstanek, hehe | 17:53 |
| dolphm | dstanek: ++! | 17:53 |
| dstanek | is it OK to remove that deprecated stuff now? | 17:53 |
| morganfainberg | dstanek, the assignment proxy stuff, yes. it has an erroneously deleted whitespace line in it though | 17:54 |
| morganfainberg | dstanek, bknudson pointed it out. artifact from the rebase. | 17:54 |
| dolphm | dstanek: i think so, there wasn't much we targeted for removal in juno | 17:54 |
| *** derek_c has quit IRC | 17:54 | |
| morganfainberg | dstanek, i'll fix that here in a moment. | 17:54 |
| dstanek | morganfainberg: that would be awesome | 17:55 |
| dstanek | dolphm: i was thinking the same; particularly because these object would have been used by plugins/programmers and not operators | 17:56 |
| bknudson | seems like keystone should be picking the attributes from service catalog to put in the token catalog... | 17:56 |
| bknudson | rather than removing things that show up in there | 17:56 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove assignment proxy methods/controllers https://review.openstack.org/83219 | 17:56 |
| dolphm | bknudson: yeah, that's how services are built for v3... i'd like to apply that to v3 endpoints next | 17:56 |
| morganfainberg | dstanek, ^ whitespace change fixed. | 17:56 |
| dolphm | we should also remove the empty 'extras' dict that was stuffed into the v3 token for absolutely no reason | 17:57 |
| bknudson | the 'extras' was what I was wondering about | 17:57 |
| dolphm | bknudson: no use case. | 17:57 |
| morganfainberg | dolphm, bknudson, don't we have a non-extras sqlbase now? | 17:58 |
| bknudson | yes, finally | 17:58 |
| dolphm | morganfainberg: yes | 17:58 |
| morganfainberg | we should be moving (it sounds like) the endpoints to that. | 17:58 |
| morganfainberg | or uhm. service... or whichever | 17:58 |
| *** marcoemorais has quit IRC | 17:58 | |
| dolphm | morganfainberg: 'extras' in the v3 token isn't coming from an 'extras' column | 17:58 |
| morganfainberg | oh | 17:58 |
| morganfainberg | OH. v3 token extras | 17:58 |
| * morganfainberg facepalms | 17:58 | |
| bknudson | oh, I was thinking about the extras in endpoints | 17:59 |
| bknudson | I expect those would wind up in the token catalog | 17:59 |
| dolphm | bknudson: they would, if any | 17:59 |
| *** wchrisj_ has quit IRC | 17:59 | |
| *** wchrisj has joined #openstack-keystone | 17:59 | |
| *** openstackgerrit has quit IRC | 18:01 | |
| *** openstackgerrit has joined #openstack-keystone | 18:01 | |
| *** marcoemorais1 has joined #openstack-keystone | 18:02 | |
| *** marcoemorais1 has quit IRC | 18:02 | |
| *** marcoemorais1 has joined #openstack-keystone | 18:03 | |
| *** Gue______ has joined #openstack-keystone | 18:07 | |
| *** marcoemorais1 has quit IRC | 18:12 | |
| dolphm | bknudson: left a question on https://review.openstack.org/#/c/85402/ | 18:13 |
| *** morganfainberg is now known as morganfainberg_Z | 18:14 | |
| bknudson | dolphm: I'm working on a test, but our FakeLDAP doesn't handle DNs correctly (specifically a DN with a , in an attribute value) | 18:16 |
| dolphm | bknudson: figures :P | 18:16 |
| openstackgerrit | A change was merged to openstack/keystone: Add slowest output to tox runs (testr) https://review.openstack.org/79422 | 18:17 |
| bknudson | dolphm: it's the regex here: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/fakeldap.py#n402 | 18:17 |
| richm | jdennis wrote a DN class for IPA for this and many other reasons - DN handling is "hard" | 18:18 |
| dolphm | skrillex is running for PTL of cinder :D | 18:18 |
| dolphm | richm: this is why i prefer integration testing over mocksing every time! | 18:19 |
| * dolphm is wondering where that s came from | 18:20 | |
| richm | mocking ldap is "hard" | 18:20 |
| dstanek | richm, dolphm: part of the reason that it's hard is because we are over mocking | 18:22 |
| *** marcoemorais has joined #openstack-keystone | 18:22 | |
| dolphm | "don't we test for this?" "yes, but our mock code had a bug in it." "we should test the mock." #goinginthewrongdirection | 18:22 |
| bknudson | there's a fakeldap package -- https://pypi.python.org/pypi/fakeldap/0.5.1 | 18:22 |
| bknudson | maybe it's better | 18:22 |
| dstanek | i think in many cases like ldap we should just be checking that we conform to the ldap library interface and not worry so much about all of the details | 18:22 |
| dolphm | bknudson: whoa | 18:22 |
| bknudson | "This code is still experimental and not very tested as of yet. So is the documentation" | 18:23 |
| bknudson | https://pypi.python.org/pypi/dataflake.fakeldap/1.1 | 18:23 |
| dolphm | bknudson: Development Status :: 2 - Pre-Alpha | 18:23 |
| *** vhoward- has joined #openstack-keystone | 18:24 | |
| richm | I see split('=') and split(',') so probably not | 18:24 |
| *** vhoward- has left #openstack-keystone | 18:26 | |
| *** vhoward- has joined #openstack-keystone | 18:30 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone: Filter User by project https://review.openstack.org/84136 | 18:33 |
| *** leseb has joined #openstack-keystone | 18:33 | |
| *** Gue______ has quit IRC | 18:36 | |
| *** morganfainberg_Z is now known as morganfainberg | 18:37 | |
| *** ayoung has joined #openstack-keystone | 18:37 | |
| *** leseb has quit IRC | 18:37 | |
| openstackgerrit | Priti Desai proposed a change to openstack/keystone: Adding one more check on project_id https://review.openstack.org/85199 | 18:38 |
| *** Gue______ has joined #openstack-keystone | 18:40 | |
| ayoung | dolphm, you realize you removed the part of the test that showed that endpoint_filtering was broken? | 18:44 |
| dolphm | ayoung: ? | 18:45 |
| ayoung | dolphm, the change in the test | 18:45 |
| ayoung | https://review.openstack.org/#/c/85147/3..4/keystone/tests/test_v3.py | 18:45 |
| ayoung | I realize I didn't post my response before disappearing | 18:46 |
| ayoung | the XML marshalling is broken | 18:46 |
| ayoung | that is why: #Bypass the check for XML is done on a string type | 18:46 |
| dolphm | ayoung: i kept that, i just inverted the condition from testing for a string, which is just a coincidence, to conditionally executing if it's a list | 18:46 |
| ayoung | service needs to be something other than string to have endpoints contained. I was about to run another test in the debugger to see what XML puts in there | 18:46 |
| ayoung | dolphm, am I reading the patch wrong? Let me look again. I though that check was just gone | 18:47 |
| dolphm | ayoung: it's a "string" because service is actually a key that you're looking at | 18:47 |
| ayoung | dolphm, ah, you moved it to https://review.openstack.org/#/c/85147/4/keystone/tests/test_v3.py | 18:48 |
| ayoung | OK...I like that | 18:48 |
| ayoung | I just looked at the v3 v4 diff and it didn't show that for some reason...another reason not to 100% trust gerrits diffs of patches. OK, Looks good | 18:48 |
| dolphm | ayoung: <service name="foobar"><endpoint url="abc" interface="public"></service> is being converted to 'catalog': {'service': {'name': 'foobar', 'endpoint': {'url': 'abc', 'interface': 'public'}} | 18:49 |
| dolphm | you can only have one service and one endpoint - i think it's an unhandled pattern in the xml translation middleware | 18:49 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix invalid LDAP filter for user ID with comma https://review.openstack.org/85402 | 18:50 |
| ayoung | dolphm, I suspect that what we will want to do is adopt WSME's marshalling for the XML fix instead of trying to do it ourselves. I'm OK with that | 18:50 |
| bknudson | I wonder how long the xml has been broken | 18:51 |
| dolphm | bknudson: if it's not tested i guarantee it's broken | 18:51 |
| dolphm | bknudson: so: forever. | 18:51 |
| ayoung | bknudson, when was the spec written. Bah-dump bump crash. | 18:51 |
| bknudson | maybe it's just because they haven't been using v3 in general | 18:51 |
| *** rwsu has quit IRC | 18:57 | |
| *** marcoemorais has quit IRC | 19:06 | |
| *** chenxu has joined #openstack-keystone | 19:06 | |
| *** marcoemorais has joined #openstack-keystone | 19:06 | |
| *** marcoemorais has quit IRC | 19:07 | |
| chenxu | hey folks… just curious, if there a way for an admin user to obtain a token as another user? | 19:07 |
| *** marcoemorais has joined #openstack-keystone | 19:07 | |
| chenxu | basically, I want an admin user to be able to create VMs for a particular user/tenant | 19:08 |
| chenxu | not sure if there is a good way of doing so | 19:08 |
| *** rwsu has joined #openstack-keystone | 19:13 | |
| *** Gue______ has quit IRC | 19:22 | |
| dolphm | chenxu: the admin would either have to reset the user's credentials and authenticate normally, or the user would have to explicitly create a trust with the admin allowing impersonation | 19:24 |
| *** leseb has joined #openstack-keystone | 19:24 | |
| dolphm | chenxu: if you only care about tenancy (which it sounds like you should, as the identity shouldn't matter there), then the admin can assign themselves the appropriate role(s) on that tenant, do the work, and revoke the assignment if necessary | 19:24 |
| bknudson | there's an ldap.filter.escape_filter_chars but I don't see an unescape_filter_chars | 19:26 |
| *** chenxu has quit IRC | 19:27 | |
| *** leseb has quit IRC | 19:28 | |
| dolphm | bknudson: i figure the client might not have reason to unescape things, but i wanted to play with it if it was there | 19:28 |
| dolphm | bknudson: +2 | 19:30 |
| dolphm | dstanek: https://review.openstack.org/#/c/85402/ | 19:30 |
| bknudson | I'm thinking it's not worth it to try to get fakeldap to make this testable | 19:31 |
| bknudson | well, let me think about it some more. | 19:31 |
| bknudson | maybe I'll just skip mucking with the dn if we can't parse the dn. | 19:32 |
| openstackgerrit | A change was merged to openstack/keystone: Replace all use of mox with mock https://review.openstack.org/84050 | 19:33 |
| dolphm | bknudson: i agree, it'd be nice to have for master though | 19:34 |
| dolphm | bknudson: proposed backports btw https://review.openstack.org/#/q/Ib4886e66af0e979fcf23a84bcd51b07034547cb9,n,z | 19:35 |
| *** topol has quit IRC | 19:35 | |
| bknudson | dolphm: why no (cherry-picked) in the backports? | 19:37 |
| dolphm | bknudson: git ready milestone-proposed && git review -x 85402 && git review milestone-proposed # shrug | 19:38 |
| *** dstanek has quit IRC | 19:38 | |
| *** elmiko has joined #openstack-keystone | 19:39 | |
| bknudson | dolphm: use -X rather than -x | 19:39 |
| elmiko | hey all, i'm doing some work with openstack-sahara and i'm running into an issue with a keystone endpoint. where might i find the v3 api? | 19:39 |
| bknudson | "not recommended in most situations" -- not sure why it says that. | 19:39 |
| dolphm | bknudson: *reading* | 19:39 |
| bknudson | elmiko: here's the spec: https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md | 19:40 |
| elmiko | bknudson: tyvm :) | 19:40 |
| *** jaosorior has quit IRC | 19:40 | |
| dolphm | bknudson: -x be aware: if you are not careful, this can easily result in additional patch sets for dependent changes. | 19:40 |
| *** morganfainberg is now known as morganfainberg_Z | 19:42 | |
| dolphm | bknudson: i think i just want -x because i don't want a new branch created either (git ready creates a untracked/disposable branch) | 19:42 |
| bknudson | dolphm: the only diff with -X should be that it adds the (cherry-picked) ? | 19:43 |
| dolphm | bknudson: just tried it, i end up untracked as well. -X will also pull a change without its dependent reviews, potentially breaking it | 19:44 |
| bknudson | dolphm: -x does more? | 19:44 |
| openstackgerrit | A change was merged to openstack/keystone: Remove legacy_endpoint_id and enabled from service catalog https://review.openstack.org/85147 | 19:45 |
| dolphm | bknudson: this is what i'm reading http://pasteraw.com/chldonzbj7q4muvifhdykikx9j4r3l1 | 19:45 |
| dolphm | bknudson: from man git-review | 19:45 |
| *** dstanek has joined #openstack-keystone | 19:46 | |
| dolphm | bknudson: i think you're right, the help text just needs to be updated. they shouldn't be copy/pasted and out of sync | 19:46 |
| bknudson | I think it's just saying that a cherry-pick doesn't create a branch like "review/dolph_mathews/(detached" | 19:48 |
| *** Gue______ has joined #openstack-keystone | 19:48 | |
| dstanek | dolphm: i don't know much about ldap, but that change looks fine to me | 19:48 |
| elmiko | is there an endpoint "v3/tokens"? | 19:48 |
| bknudson | elmiko: v3/auth/tokens | 19:49 |
| dolphm | elmiko: /v3/auth/tokens | 19:49 |
| elmiko | hmm, i'm getting an error with keystoneclient.sessions trying to POST to "v3/tokens", could that be coming from sahara? | 19:49 |
| dstanek | my next-review list for openstack/keystone keep shrinking! | 19:50 |
| bknudson | next feature for next-review and maybe reviewday is to know about the dependencies between reviews. | 19:51 |
| dolphm | bknudson: why is this wip? https://review.openstack.org/#/c/84912/ | 19:53 |
| dolphm | bknudson: ++ | 19:53 |
| bknudson | dolphm: marekd|away (I think) has a review that just removes the code... | 19:53 |
| bknudson | dolphm: https://review.openstack.org/#/c/84952/ | 19:54 |
| *** morganfainberg_Z is now known as morganfainberg | 20:00 | |
| dolphm | bknudson: isn't the federation controller already using it's own version of this? | 20:01 |
| bknudson | dolphm: I think it was moved up so that it could be used otherwise. | 20:01 |
| bknudson | used in other places. | 20:01 |
| dolphm | bknudson: right, i'd rather use it in more places i suppose | 20:01 |
| dolphm | bknudson: and delete the one in contrib.federation | 20:02 |
| dolphm | although it must not be called check_required_params | 20:02 |
| bknudson | I think we should switch to the same technique that nova uses -- they have jsonschema | 20:03 |
| *** chenxu has joined #openstack-keystone | 20:03 | |
| dolphm | dstanek: this done broke https://review.openstack.org/#/c/81527/ | 20:05 |
| dolphm | bknudson: ++ i've been wanting jsonschema forever | 20:05 |
| chenxu | dolphm: I wonder if the admin can simply use its token to post to compute API v2/{tenant_id}/servers | 20:06 |
| chenxu | dolphm: maybe nova won’t check if a user belongs to the tenant as long as it’s an admin? | 20:06 |
| dolphm | chenxu: if so, i wouldn't rely on that behavior | 20:07 |
| chenxu | dolphm: I hope this is configurable in policy.json | 20:07 |
| *** erecio has joined #openstack-keystone | 20:07 | |
| dstanek | dolphm: i thought it may have failures and was waiting to rebase it on my mox commit that just merged | 20:08 |
| dstanek | dolphm: i didn't expect the failures to look like that though | 20:08 |
| chenxu | dolphm: I mean, if admin can add itself to the tenant anyway, why not allow it to perform in that tenant in the first place | 20:08 |
| dolphm | chenxu: that's an authorization question that falls on the individual services to answer (nova, in this case); keystone's answer is to provide the appropriate authorization data for nova to make explicit decisions via policy.json :) | 20:09 |
| nkinder | ayoung: how big of a size reduction did you see with your changes to remove the legacy endpoint ID from the tokens? | 20:10 |
| chenxu | dolphm: cool, thanks! | 20:11 |
| dstanek | dolphm: ah, it looks like my rebase onto jamie's change was a bad merge | 20:11 |
| *** erecio has quit IRC | 20:14 | |
| *** erecio has joined #openstack-keystone | 20:14 | |
| ayoung | bknudson, nkinder each endpoint went from 800 bytes to 400, I think....X about 8....maybe 3K? | 20:15 |
| ayoung | nkinder, I'm about to compate | 20:15 |
| ayoung | compare | 20:15 |
| *** morganfainberg is now known as morganfainberg_Z | 20:15 | |
| *** Gue______ has quit IRC | 20:17 | |
| ayoung | nkinder, last one I fetched was 6798 after applying the fix | 20:19 |
| ayoung | lemme try again without it | 20:19 |
| *** erecio has quit IRC | 20:20 | |
| *** erecio has joined #openstack-keystone | 20:21 | |
| *** leseb has joined #openstack-keystone | 20:24 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add tests for user ID with comma https://review.openstack.org/85478 | 20:25 |
| *** chenxu has quit IRC | 20:26 | |
| bknudson | you won't be impressed with the change to fakeldap. | 20:26 |
| bknudson | or you will be impressed by my laziness | 20:27 |
| *** leseb has quit IRC | 20:29 | |
| dolphm | bknudson: lazy works for me | 20:32 |
| *** Guest___ has joined #openstack-keystone | 20:34 | |
| dolphm | bknudson: that self.db stuff is nasty | 20:35 |
| *** afaranha has quit IRC | 20:38 | |
| bknudson | the tests didn't work... need to do some encoding/decoding | 20:38 |
| *** raildo has quit IRC | 20:38 | |
| *** Guest___ has quit IRC | 20:38 | |
| *** afaranha has joined #openstack-keystone | 20:42 | |
| *** afaranha has quit IRC | 20:47 | |
| *** chenxu has joined #openstack-keystone | 20:48 | |
| *** afaranha has joined #openstack-keystone | 20:51 | |
| dolphm | just went through a bunch of bugs and added official tags to them as necessary... it seems most of our bug reports are against the ldap driver | 20:52 |
| dolphm | and i tried to populate this tag a bit https://bugs.launchpad.net/keystone/+bugs?field.tag=performance | 20:52 |
| *** elmiko has left #openstack-keystone | 20:53 | |
| *** erecio has quit IRC | 20:54 | |
| dolphm | i've been asked a few times about small ways to improve performance - it'd be nice to have more reports for known performance bottlenecks. (like a lot of things) those end up being cultural knowledge rather than documented anywhere | 20:54 |
| *** dstanek has quit IRC | 20:56 | |
| *** afaranha has left #openstack-keystone | 20:58 | |
| *** chenxu has quit IRC | 20:58 | |
| *** florentflament has quit IRC | 21:00 | |
| bknudson | fetching the service catalog from the db every time is not the fastest. | 21:01 |
| bknudson | well, building the service catalog from the db | 21:01 |
| *** florentflament has joined #openstack-keystone | 21:02 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add tests for user ID with comma https://review.openstack.org/85478 | 21:04 |
| ayoung | dolphm, what is the magic incantation to push something for backport review again? | 21:06 |
| ayoung | I thought it was git push gerrit HEAD:refs/for/milestone-proposed | 21:07 |
| *** ayoung is now known as ayoung-afk | 21:10 | |
| *** joesavak has quit IRC | 21:11 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Prefer () to continue line per PEP8 https://review.openstack.org/84010 | 21:12 |
| dolphm | ayoung-afk: git review milestone-proposed | 21:12 |
| *** chenxu has joined #openstack-keystone | 21:14 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove assignment proxy methods/controllers https://review.openstack.org/83219 | 21:16 |
| *** leseb has joined #openstack-keystone | 21:25 | |
| *** chenxu has quit IRC | 21:26 | |
| *** chenxu has joined #openstack-keystone | 21:29 | |
| *** chenxu has quit IRC | 21:29 | |
| *** leseb has quit IRC | 21:29 | |
| *** david-lyle has quit IRC | 21:40 | |
| *** stevemar has quit IRC | 22:13 | |
| *** thedodd has quit IRC | 22:22 | |
| *** dstanek has joined #openstack-keystone | 22:23 | |
| *** leseb has joined #openstack-keystone | 22:26 | |
| *** leseb has quit IRC | 22:30 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Convert test_backend_ldap to config fixture https://review.openstack.org/85509 | 22:40 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Allow any attributes in mapping https://review.openstack.org/81040 | 22:40 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Include extra attributes in list results https://review.openstack.org/81041 | 22:40 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance tests for user extra attribute mapping https://review.openstack.org/81046 | 22:40 |
| *** gokrokve has quit IRC | 22:44 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix invalid LDAP filter for user ID with comma https://review.openstack.org/85402 | 22:45 |
| *** dstanek has quit IRC | 22:49 | |
| *** henrynash has quit IRC | 22:52 | |
| *** dstanek has joined #openstack-keystone | 22:53 | |
| *** Fin1te has joined #openstack-keystone | 22:55 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Use oslo.test mockpatch https://review.openstack.org/83968 | 22:55 |
| *** jaosorior has joined #openstack-keystone | 23:01 | |
| bknudson | dstanek: pep8 1.5.3 can enforce space after a '#' in a comment | 23:06 |
| dstanek | bknudson: nice, i'll test that out and adjust my changeset | 23:17 |
| dstanek | bknudson: i just got finished adding the noqa support to address your comments | 23:18 |
| *** gokrokve has joined #openstack-keystone | 23:23 | |
| *** topol has joined #openstack-keystone | 23:26 | |
| *** leseb has joined #openstack-keystone | 23:27 | |
| *** derek_c has joined #openstack-keystone | 23:28 | |
| *** leseb has quit IRC | 23:31 | |
| nkinder | can anyone explain the purpose of hash_ldap_user_password()? | 23:35 |
| nkinder | it looks like we call it in the LDAP identity backend for create and update, but I don't really understand why | 23:36 |
| *** dstanek has quit IRC | 23:37 | |
| *** serverascode has joined #openstack-keystone | 23:39 | |
| *** dstanek has joined #openstack-keystone | 23:39 | |
| *** browne has quit IRC | 23:42 | |
| *** Fin1te has quit IRC | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!