| *** RockKuo has joined #openstack-keystone | 00:11 | |
| *** wchrisj has joined #openstack-keystone | 00:20 | |
| *** wchrisj has quit IRC | 00:50 | |
| openstackgerrit | A change was merged to openstack/keystone: Clean up config help text https://review.openstack.org/78497 | 01:13 |
|---|---|---|
| openstackgerrit | A change was merged to openstack/keystone: Cleanup config.py https://review.openstack.org/81671 | 01:13 |
| *** derek_c has joined #openstack-keystone | 01:19 | |
| *** wchrisj has joined #openstack-keystone | 02:07 | |
| *** mberlin has quit IRC | 02:10 | |
| *** mberlin has joined #openstack-keystone | 02:10 | |
| *** wchrisj has quit IRC | 02:21 | |
| *** chandan_kumar has joined #openstack-keystone | 02:29 | |
| *** chandan_kumar has quit IRC | 02:30 | |
| *** jamielenz is now known as jamielennox|away | 02:37 | |
| *** jamielennox|away is now known as jamielennox | 02:38 | |
| *** derek_c has quit IRC | 02:41 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Isolate backend loading https://review.openstack.org/74293 | 03:27 |
| *** chandan_kumar has joined #openstack-keystone | 03:30 | |
| *** chandan_kumar has quit IRC | 03:31 | |
| *** chandan_kumar has joined #openstack-keystone | 03:31 | |
| *** chandan_kumar has quit IRC | 03:48 | |
| *** zhiyan_ is now known as zhiyan | 03:50 | |
| *** kun_huang has joined #openstack-keystone | 03:57 | |
| *** chandan_kumar has joined #openstack-keystone | 04:08 | |
| *** jimbaker` is now known as jimbaker | 04:09 | |
| *** jimbaker has quit IRC | 04:10 | |
| *** jimbaker has joined #openstack-keystone | 04:10 | |
| *** topol has joined #openstack-keystone | 04:22 | |
| *** derek_c has joined #openstack-keystone | 04:24 | |
| *** stevemar has joined #openstack-keystone | 04:34 | |
| *** zhiyan is now known as zhiyan_ | 04:39 | |
| *** chandan_kumar has quit IRC | 05:02 | |
| *** derek_c has quit IRC | 05:07 | |
| *** saju_m has joined #openstack-keystone | 05:13 | |
| *** chandan_kumar has joined #openstack-keystone | 05:27 | |
| *** mfisch has quit IRC | 05:29 | |
| *** mfisch has joined #openstack-keystone | 05:31 | |
| *** mfisch has joined #openstack-keystone | 05:31 | |
| *** derek_c has joined #openstack-keystone | 05:35 | |
| *** henrynash has joined #openstack-keystone | 05:44 | |
| *** topol has quit IRC | 05:52 | |
| *** stevemar has quit IRC | 05:58 | |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/83955 | 06:00 |
| *** rwsu has joined #openstack-keystone | 06:35 | |
| *** saju_m has quit IRC | 06:41 | |
| *** RockKuo has quit IRC | 06:51 | |
| *** saju_m has joined #openstack-keystone | 06:55 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Moves test database setup/teardown into a fixture https://review.openstack.org/85651 | 07:02 |
| *** chandan_kumar has quit IRC | 07:02 | |
| *** chandan_kumar has joined #openstack-keystone | 07:07 | |
| *** henrynash has quit IRC | 07:22 | |
| *** leseb has joined #openstack-keystone | 07:34 | |
| *** marekd|away is now known as marekd | 07:51 | |
| *** derek_c has quit IRC | 07:55 | |
| *** RockKuo has joined #openstack-keystone | 08:15 | |
| *** nkinder has quit IRC | 08:22 | |
| *** nkinder has joined #openstack-keystone | 08:27 | |
| *** henrynash has joined #openstack-keystone | 08:33 | |
| openstackgerrit | Matthieu Huin proposed a change to openstack/identity-api: Fix for federation token request examples https://review.openstack.org/79491 | 08:58 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: List all forbidden attributes in the request body. https://review.openstack.org/84389 | 09:00 |
| *** saju_m has quit IRC | 09:27 | |
| *** nkinder has quit IRC | 09:28 | |
| *** jaosorior has joined #openstack-keystone | 09:46 | |
| *** kurguzov has quit IRC | 10:03 | |
| *** nkinder has joined #openstack-keystone | 10:04 | |
| *** leseb has quit IRC | 10:18 | |
| *** leseb has joined #openstack-keystone | 10:19 | |
| *** leseb has quit IRC | 10:23 | |
| *** saju_m has joined #openstack-keystone | 10:32 | |
| *** inc0 has joined #openstack-keystone | 10:45 | |
| inc0 | hello, which API call will return me list of all tenants? even on admin tenant I don't get full list. | 10:46 |
| *** saju_m has quit IRC | 10:49 | |
| *** leseb has joined #openstack-keystone | 10:49 | |
| *** leseb has quit IRC | 10:53 | |
| *** henrynash has quit IRC | 11:03 | |
| jaosorior | inc0, what version of the API are you using? | 11:03 |
| inc0 | jaosorior, v2 | 11:04 |
| *** leseb has joined #openstack-keystone | 11:04 | |
| jaosorior | well, the resource to get the list of tenants in v2.0 is under /tenants | 11:09 |
| jaosorior | for example, if you were using curl to get the info, you would do something like this: | 11:09 |
| jaosorior | curl -s -H "X-Auth-Token: <your authenticated token>" http://<some address>:35357/v2.0/tenants | 11:10 |
| jaosorior | or, are you using the keystone cli client? | 11:10 |
| jaosorior | or something else? | 11:11 |
| *** RockKuo has quit IRC | 11:14 | |
| inc0 | jaosorior, python client, but query you've shown will only show tenants this user has access to | 11:20 |
| inc0 | but not all of them I guess | 11:20 |
| inc0 | even if I use port 35357 | 11:21 |
| *** saju_m has joined #openstack-keystone | 11:25 | |
| inc0 | ah, sorry my fault | 11:33 |
| inc0 | it seems its working, thank you very muich | 11:33 |
| *** afaranha has left #openstack-keystone | 11:38 | |
| jaosorior | alright :) | 11:47 |
| *** jamielennox is now known as jamielennox|away | 11:56 | |
| *** lbragstad has quit IRC | 12:01 | |
| *** henrynash has joined #openstack-keystone | 12:06 | |
| *** zigo has quit IRC | 12:26 | |
| *** lbragstad has joined #openstack-keystone | 12:34 | |
| *** erecio has joined #openstack-keystone | 12:41 | |
| *** andreaf has quit IRC | 12:45 | |
| henrynash | ayoung: ping | 12:58 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Moves test database setup/teardown into a fixture https://review.openstack.org/85651 | 12:59 |
| *** raildo has joined #openstack-keystone | 13:02 | |
| *** RockKuo has joined #openstack-keystone | 13:18 | |
| *** dims has joined #openstack-keystone | 13:22 | |
| *** andreaf has joined #openstack-keystone | 13:28 | |
| *** nkinder has quit IRC | 13:42 | |
| *** dstanek_zzz is now known as dstanek | 13:48 | |
| *** henrynash has quit IRC | 13:50 | |
| *** henrynash has joined #openstack-keystone | 13:51 | |
| *** chandan_kumar has quit IRC | 13:56 | |
| *** joesavak has joined #openstack-keystone | 13:56 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Refactor: moved flatten function to utils https://review.openstack.org/85721 | 14:08 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: List all forbidden attributes in the request body. https://review.openstack.org/84389 | 14:20 |
| *** stevemar has joined #openstack-keystone | 14:23 | |
| *** nkinder has joined #openstack-keystone | 14:31 | |
| dstanek | marekd: i just had one more really small comment on that review | 14:47 |
| marekd | dstanek: yep, noticed it. | 14:47 |
| marekd | dstanek: so the order is like: http://pasteraw.com/iqrewot0nikcalu5pmi9b7lr06a96t3 | 14:49 |
| *** saju_m has quit IRC | 14:50 | |
| dstanek | marekd: yep | 14:53 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: List all forbidden attributes in the request body. https://review.openstack.org/84389 | 14:55 |
| dstanek | marekd: this talks about the details http://docs.openstack.org/developer/hacking/#imports | 14:55 |
| marekd | dstanek: thanks. | 14:56 |
| dstanek | dolphm: ping | 14:59 |
| dstanek | dolphm: did you ever publish your raspberrypy code? | 15:02 |
| marekd | dstanek: ^^ guessing...OpenStack on Raspbian? ? | 15:03 |
| *** nkinder has quit IRC | 15:03 | |
| dstanek | marekd: he has a webapp of some sort running in a py that watches zuul | 15:04 |
| *** thedodd has joined #openstack-keystone | 15:05 | |
| *** inc0 has quit IRC | 15:05 | |
| *** inc0_ has joined #openstack-keystone | 15:05 | |
| dolphm | dstanek: yes, and then i made it really slow with my last feature add :P | 15:06 |
| dolphm | dstanek: https://github.com/dolph/gatewatch | 15:06 |
| dstanek | dolphm: nice, thanks | 15:06 |
| dolphm | dstanek: demo http://gatewatch.dolphm.com/ | 15:06 |
| *** david-lyle has joined #openstack-keystone | 15:08 | |
| *** bada has joined #openstack-keystone | 15:09 | |
| *** ayoung has joined #openstack-keystone | 15:11 | |
| *** nkinder has joined #openstack-keystone | 15:15 | |
| *** Guest_ has joined #openstack-keystone | 15:16 | |
| *** gyee has joined #openstack-keystone | 15:20 | |
| *** browne has joined #openstack-keystone | 15:24 | |
| *** browne has quit IRC | 15:24 | |
| nkinder | ayoung: I did some security research of Keystone this weekend that you might find interesting - https://wiki.openstack.org/wiki/Security/Icehouse/Keystone | 15:27 |
| nkinder | ayoung: I'd like to be sure I'm not missing anything, and there are some areas I wasn't 100% clear on. | 15:28 |
| nkinder | ayoung: I'm trying to use Keystone as an example for collecting this information. I'd like to get this sort of information in place for all integrated projects. | 15:29 |
| *** wchrisj has joined #openstack-keystone | 15:36 | |
| *** browne has joined #openstack-keystone | 15:36 | |
| ayoung | nkinder, I'll take a look | 15:43 |
| ayoung | nkinder, on the MD5, you kindof allude to it, but "user cannot generate the text that leads to the MD5." | 15:45 |
| *** browne has quit IRC | 15:45 | |
| ayoung | LDAP password hashing is only done for Read Write Keystone | 15:46 |
| *** browne has joined #openstack-keystone | 15:46 | |
| ayoung | nkinder, I would strongly recommend that keystone-manage pki_setup and ssl_setup be deprecated | 15:47 |
| nkinder | ayoung: why should LDAP password hashing be needed, even for read/write? | 15:47 |
| ayoung | nkinder, storing the password? Where else is it done? | 15:48 |
| nkinder | ayoung: the LDAP server should hash the passwords, not keystone | 15:48 |
| ayoung | yepo | 15:48 |
| ayoung | nkinder, actually, Keystone should get out of the Password busienss | 15:48 |
| nkinder | ayoung: keystone should not be doing any hashing for LDAP passwords at all. | 15:48 |
| ayoung | ++ | 15:48 |
| ayoung | nkinder, keystone should not be doing passwords at all | 15:48 |
| nkinder | ayoung: well, that too. :) | 15:49 |
| ayoung | nkinder, I think the use of selfsigned certs for tokens and SSL should be called out | 15:49 |
| ayoung | in Red | 15:49 |
| ayoung | use a blink tag | 15:49 |
| *** marcoemorais has joined #openstack-keystone | 15:50 | |
| *** nkinder has quit IRC | 16:02 | |
| *** saju_m has joined #openstack-keystone | 16:12 | |
| *** jsavak has joined #openstack-keystone | 16:15 | |
| *** chandan_kumar has joined #openstack-keystone | 16:16 | |
| *** nkinder has joined #openstack-keystone | 16:18 | |
| *** joesavak has quit IRC | 16:19 | |
| *** RockKuo has quit IRC | 16:19 | |
| *** joesavak has joined #openstack-keystone | 16:19 | |
| *** jsavak has quit IRC | 16:22 | |
| *** Guest_ has quit IRC | 16:25 | |
| *** Guest_ has joined #openstack-keystone | 16:25 | |
| *** zigo has joined #openstack-keystone | 16:28 | |
| *** zigo has quit IRC | 16:33 | |
| dolphm | any reason why keystone.common.cache.backends.mongo couldn't be used as a general [kvs] backend? | 16:34 |
| dolphm | i had only considered it for caching, but... it looks like it would work as a general backend too | 16:34 |
| *** zigo has joined #openstack-keystone | 16:34 | |
| *** saju_m has quit IRC | 16:35 | |
| *** Guest_ has quit IRC | 16:36 | |
| *** Guest_ has joined #openstack-keystone | 16:36 | |
| *** jaosorior has quit IRC | 16:40 | |
| *** zigo has quit IRC | 16:41 | |
| *** richm has joined #openstack-keystone | 16:42 | |
| *** zigo has joined #openstack-keystone | 16:46 | |
| *** leseb has quit IRC | 16:46 | |
| *** Guest_ has quit IRC | 16:52 | |
| *** Guest_ has joined #openstack-keystone | 16:52 | |
| *** harlowja has joined #openstack-keystone | 16:56 | |
| *** Guest_ has quit IRC | 16:58 | |
| *** Guest_ has joined #openstack-keystone | 16:58 | |
| *** Guest_ has quit IRC | 16:59 | |
| *** Guest_ has joined #openstack-keystone | 16:59 | |
| *** marcoemorais has quit IRC | 17:00 | |
| *** marcoemorais has joined #openstack-keystone | 17:02 | |
| dstanek | only 970 failing tests still! winning! | 17:07 |
| *** henrynash has quit IRC | 17:12 | |
| *** amcrn has joined #openstack-keystone | 17:13 | |
| *** topol has joined #openstack-keystone | 17:14 | |
| openstackgerrit | Priti Desai proposed a change to openstack/keystone: Adding one more check on project_id https://review.openstack.org/85199 | 17:17 |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Make sure all the auth plugins agree on the shared identity attributes. https://review.openstack.org/84945 | 17:28 |
| gyee | dolphm, https://review.openstack.org/#/c/84945/ | 17:29 |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/85762 | 17:31 |
| *** marcoemorais has quit IRC | 17:33 | |
| *** marcoemorais has joined #openstack-keystone | 17:34 | |
| *** Guest_ has quit IRC | 17:42 | |
| *** Guest_ has joined #openstack-keystone | 17:43 | |
| *** Guest_ has quit IRC | 17:49 | |
| *** dolphm changes topic to "Open for Juno development; submit design summit session proposals ASAP (deadline: April 20th) http://summit.openstack.org/" | 17:54 | |
| *** kun_huang has quit IRC | 18:02 | |
| *** marcoemorais has quit IRC | 18:03 | |
| *** nkinder has quit IRC | 18:03 | |
| *** marcoemorais has joined #openstack-keystone | 18:03 | |
| *** nkinder has joined #openstack-keystone | 18:09 | |
| *** pcargnel has joined #openstack-keystone | 18:22 | |
| pcargnel | hi! where can I found stored the project_id in a group? | 18:24 |
| *** raildo has quit IRC | 18:30 | |
| ayoung | morganfainberg_Z, wake up! What is the trick to getting fail fast to work in tox? | 18:32 |
| ayoung | pcargnel, there is no stored project_id in groups | 18:32 |
| ayoung | dolphm, mongo could very well be a KVS backend | 18:32 |
| ayoung | that was the intention dolphm | 18:33 |
| pcargnel | ayoung, If I have to look for group roles of a user related to a specific project, can I use the tenant_id instead? | 18:33 |
| ayoung | pcargnel, roles are in the assignments backend, so what you want is "what roles are assigned to a group" | 18:34 |
| ayoung | and roles are assigned per proejct | 18:34 |
| ayoung | pcargnel, so, I think what you are asking is 'how can I find out what role assignments a user would get in a specific project based on their group membership?' | 18:35 |
| ayoung | or something along those lines? | 18:35 |
| pcargnel | Yes, kind of. I need to get group roles for a user in project. It's related to this bug https://bugs.launchpad.net/keystone/+bug/1205506 | 18:36 |
| uvirtbot | Launchpad bug 1205506 in keystone "get_group_project_roles() asks same ldap query for all groups associated with user" [Medium,Triaged] | 18:36 |
| *** morganfainberg_Z is now known as morganfainberg | 18:39 | |
| morganfainberg | afternoon | 18:39 |
| *** andreaf has quit IRC | 18:40 | |
| morganfainberg | ayoung, bunch of milestone-proposed patches, anything i should be aware of before reviewing them? | 18:41 |
| ayoung | morganfainberg, those are all backports of the UTF-8 stuff. Lets make sure they clear gate before spending any time on them | 18:43 |
| ayoung | they pass unit tests, but there was some pep8 weirdness | 18:43 |
| morganfainberg | ayoung, ++ thanks! just want to prioritize milestone-proposed | 18:44 |
| morganfainberg | ayoung, i'll keep an eye on the master patches/equivalents. | 18:44 |
| ayoung | morganfainberg, master went in for those | 18:44 |
| morganfainberg | hm. oh ok i see, you're getting them to pas check then worry about approval | 18:44 |
| ayoung | morganfainberg, they were all done by jdennis, but he's off this month, so our manager asked me to shepherd them through | 18:44 |
| morganfainberg | ayoung, sorrry, need more coffee :P | 18:45 |
| ayoung | the real deal is that I need to backport them to havana | 18:45 |
| morganfainberg | ayoung, ah yeah | 18:45 |
| morganfainberg | ayoung, but they need to land in I first, I get it | 18:45 |
| ayoung | morganfainberg, how do I get fail-fast? | 18:45 |
| morganfainberg | ayoung, use run_tests | 18:45 |
| ayoung | yuck | 18:45 |
| ayoung | no way in tox? | 18:45 |
| morganfainberg | ayoung, i'm working on getting a patch into tox so we can make it work | 18:45 |
| ayoung | k | 18:45 |
| morganfainberg | it needs to not be part of "testr-args" it has to be an option to testr itself | 18:46 |
| morganfainberg | so -- --subunit --failfast nets a "unknown option" | 18:46 |
| morganfainberg | the fix is make is so we can do optional replacements. | 18:46 |
| morganfainberg | in the tox.ini config | 18:46 |
| morganfainberg | https://bitbucket.org/hpk42/tox/pull-request/86/support-optional-env-variable-substitution/diff | 18:47 |
| ayoung | morganfainberg, can I hack tox.ini to get it for now? | 18:49 |
| *** saju_m has joined #openstack-keystone | 18:51 | |
| *** Guest_ has joined #openstack-keystone | 18:58 | |
| *** MrDan has joined #openstack-keystone | 19:00 | |
| *** MrDan has left #openstack-keystone | 19:00 | |
| *** thedodd has quit IRC | 19:01 | |
| dstanek | morganfainberg: this database fixturing is a royal pain | 19:02 |
| dstanek | morganfainberg: partially because i wanted to do the right thing and remove the db setup/teardown from TestCase and put it where it belongs | 19:03 |
| *** thedodd has joined #openstack-keystone | 19:03 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Change package to build docs to correct name https://review.openstack.org/85618 | 19:04 |
| *** joesavak has quit IRC | 19:04 | |
| *** Guest_ has quit IRC | 19:09 | |
| *** derek_c has joined #openstack-keystone | 19:10 | |
| stevemar | dstanek, mind if i pick your brain for a sec | 19:14 |
| morganfainberg | ayoung, yeah | 19:14 |
| dstanek | stevemar: sure | 19:15 |
| morganfainberg | ayoung, if you put the --fail-fast (or is if --failfast) arg in http://git.openstack.org/cgit/openstack/keystone/tree/tox.ini#n12 right after --slowest | 19:15 |
| morganfainberg | ayoung, that _should_ do it | 19:15 |
| stevemar | dstanek, can you take a look at the changes here: https://review.openstack.org/#/c/85572/ | 19:15 |
| morganfainberg | dstanek, yeah :( | 19:15 |
| ayoung | morganfainberg, good enough, although I've moved on and am running once again with run_tests.sh. I wonder if fail-fast as the default behaviour would be OK? | 19:16 |
| morganfainberg | ayoung, not for gate | 19:16 |
| ayoung | no? I guess not | 19:16 |
| ayoung | morganfainberg, could we do a second target? | 19:16 |
| morganfainberg | ayoung, nah, we want all failures not just the first | 19:16 |
| ayoung | tox -epy27-fast? | 19:16 |
| dstanek | stevemar: looking now | 19:17 |
| morganfainberg | ayoung, we could but we lose the magic "pyXX" version targeting | 19:17 |
| morganfainberg | ayoung, tox looks for pyXX not pyXX.* | 19:17 |
| stevemar | dstanek, line 90, I want to move that function too, but it requires identity_api; is there a way to use the dependency function without a class? cause utils doesn't have any class but the rule processor | 19:17 |
| ayoung | ah | 19:17 |
| morganfainberg | ayoung, it's... kinda silly. | 19:17 |
| morganfainberg | ayoung, i wish i could leverage the "magic" versioning. | 19:17 |
| dstanek | stevemar: pass it as a param | 19:17 |
| ayoung | morganfainberg, there is a lot of silliness in development work | 19:18 |
| morganfainberg | ayoung, i might propose another fix to tox to let us define the added py\d{2}.* regex instead for the magic version setting | 19:19 |
| ayoung | ++ | 19:19 |
| morganfainberg | ayoung, let me figure out the best way to do it and propose this fix as well. | 19:20 |
| morganfainberg | the worst part about contributing to tox is that they use hg and i suck at using hg for version control :P | 19:20 |
| morganfainberg | hmm. wait a sec --failfast should work as we have it. | 19:21 |
| * morganfainberg goes and checks | 19:21 | |
| stevemar | dstanek, i don't like it when you're correct so quickly | 19:21 |
| stevemar | :) | 19:21 |
| morganfainberg | stevemar, dstanek has that super power | 19:21 |
| dstanek | stevemar: :-) about the param? | 19:22 |
| stevemar | yessum | 19:22 |
| stevemar | dstanek, serves me right for trying to do this too late at night | 19:22 |
| dstanek | stevemar: believe me i know the feeling - i was up until 3am messing around with database fixtures | 19:23 |
| *** inc0_ has quit IRC | 19:24 | |
| bknudson | Nova's got a problem when it's using neutron. | 19:24 |
| bknudson | It takes the token on the boot request and passes it on to neutron | 19:25 |
| *** Chicago has quit IRC | 19:25 | |
| bknudson | but of course the token could expire or get revoked | 19:25 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Refactor: move federation functions to federation utils https://review.openstack.org/85572 | 19:25 |
| bknudson | sounds like a place where a trust could be used? | 19:25 |
| morganfainberg | ayoung, oh i see how we have to do this. wow... "-- --subunit -- --failfast" | 19:25 |
| morganfainberg | ayoung, that is such a horrible syntax. | 19:25 |
| ayoung | morganfainberg, python rarely bothers itself with such limiting factors as Syntax | 19:26 |
| *** thedodd has quit IRC | 19:29 | |
| *** marcoemorais has quit IRC | 19:31 | |
| *** thedodd has joined #openstack-keystone | 19:31 | |
| *** thedodd has quit IRC | 19:31 | |
| *** marcoemorais has joined #openstack-keystone | 19:31 | |
| *** thedodd has joined #openstack-keystone | 19:33 | |
| *** joesavak has joined #openstack-keystone | 19:36 | |
| bknudson | Looks like Nova could use the user's token to create a trust which gives the nova user the user's roles on the project | 19:38 |
| *** doddstack has joined #openstack-keystone | 19:38 | |
| bknudson | Then Nova could get its own token and use that to get a token with "scope" { (the new trust) } | 19:38 |
| *** thedodd has quit IRC | 19:40 | |
| morganfainberg | bknudson, isn't that what heat (essentially) does? | 19:41 |
| bknudson | probably, when talking to nova | 19:41 |
| *** leseb has joined #openstack-keystone | 19:47 | |
| *** jimbaker has quit IRC | 19:51 | |
| *** henrynash has joined #openstack-keystone | 19:51 | |
| *** jimbaker has joined #openstack-keystone | 19:51 | |
| *** jimbaker has quit IRC | 19:51 | |
| *** jimbaker has joined #openstack-keystone | 19:51 | |
| bknudson | "Expecting to find trust_id in trust." ... wonder why that is. | 20:00 |
| bknudson | oops, my fault | 20:02 |
| *** marcoemorais has quit IRC | 20:03 | |
| *** marcoemorais has joined #openstack-keystone | 20:03 | |
| *** harlowja has quit IRC | 20:03 | |
| bknudson | that seems to work... I'll see if nova will take it. | 20:04 |
| *** dims has quit IRC | 20:08 | |
| morganfainberg | ayoung, http://logs.openstack.org/45/84945/2/check/gate-keystone-python26/562fa41/console.html i'm trying to figure out why this is occurring. I don't see how we could get into this situation | 20:08 |
| *** mhu1 has joined #openstack-keystone | 20:09 | |
| morganfainberg | ayoung, i'm going to propose some attribute cleanup code for test_revoke cases, but I don't think that will actually help. | 20:09 |
| *** mhu has quit IRC | 20:10 | |
| *** mhu1 is now known as mhu | 20:10 | |
| ayoung | morganfainberg, looks like a mess | 20:10 |
| morganfainberg | ayoung, yeah | 20:10 |
| ayoung | morganfainberg, could be something is getting double counted | 20:10 |
| morganfainberg | ayoung, only sometimes | 20:11 |
| morganfainberg | ayoung, not consistently. | 20:11 |
| ayoung | morganfainberg, only on 26, or across the board? | 20:11 |
| morganfainberg | sometimes 27 | 20:11 |
| morganfainberg | 33 doesn't work so... dunnio | 20:11 |
| morganfainberg | it's intermittent so it feels like a parallel testing issue | 20:12 |
| morganfainberg | and therefore test isolation problems | 20:12 |
| ayoung | wow...that one is in a loop....hmmm, maybe something hasn't caught up? But it should be single threaded....could it be a problem in event delivery? | 20:13 |
| morganfainberg | ayoung, yeah that is my concern | 20:13 |
| ayoung | morganfainberg, looks like something didn't get delivered | 20:14 |
| ayoung | self.assertEqual(turn + 1, len(self.tree.revoke_map | 20:14 |
| morganfainberg | right. | 20:14 |
| ayoung | 4 != 3 means the the turn is 4, and we expect 4 delivered events | 20:14 |
| morganfainberg | which ... this loop feels like it should break differently. | 20:14 |
| ayoung | morganfainberg, could also be something wonky in the match logic. | 20:15 |
| morganfainberg | ayoung, i hope it's that rather than the former tbh | 20:15 |
| ayoung | morganfainberg, could be a glitch in the test logic. Is it always that same line that fails? | 20:17 |
| morganfainberg | ayoung, i think it's always 418 | 20:17 |
| ayoung | morganfainberg, hmmm | 20:17 |
| morganfainberg | ayoung, that is the first equalcheck in _assertEventsMatchIteration | 20:17 |
| henrynash | ayoung: hi….I have a rather dumb question about….errr…keystone | 20:18 |
| morganfainberg | well the first one lookin into the tree map | 20:18 |
| ayoung | henrynash, fire away | 20:18 |
| *** harlowja has joined #openstack-keystone | 20:19 | |
| henrynash | ayoung: so keystone is single threaded as far as processing a cmds, right (i.e. we don’t try and process more than one wsgi cmd in parallel do we)? | 20:19 |
| ayoung | henrynash, wow, loaded question. | 20:19 |
| ayoung | henrynash, Eventlet is single threaded ,but you can run multiple worker threads | 20:20 |
| ayoung | and HTTPD is multiprocess | 20:20 |
| henrynash | ayoung: right, so if you are kicking it off our of Apache, then it depends on how you haev that configured | 20:20 |
| ayoung | morganfainberg, If it were reversed: that more events were delivered than expected, I would blame it on parallel testing | 20:21 |
| morganfainberg | ayoung, ok. i'll do a deep dive on the delivery parts | 20:21 |
| morganfainberg | ayoung, this one is potentially icky, wanted to make you aware of it | 20:21 |
| morganfainberg | ayoung, might have further questions as i continue here | 20:22 |
| henrynash | ayoung: what about non Apache confgs…. like can we be processing a cmd via the admin port and the publc port in parallel too (we start two servers right, one for each)? | 20:22 |
| *** derek_c has quit IRC | 20:25 | |
| *** derek_c has joined #openstack-keystone | 20:25 | |
| ayoung | henrynash, yes we can | 20:25 |
| ayoung | henrynash, althought, I think that those are both in the same thread, now that I think about it | 20:26 |
| ayoung | morganfainberg, I'm wondering if it could still be parallel testing | 20:26 |
| henrynash | ayoung: that was the bit I was not so sure of | 20:26 |
| ayoung | maybe the event got swallowed by the wrong test? | 20:27 |
| ayoung | henrynash, I lie | 20:27 |
| ayoung | test empirically | 20:27 |
| morganfainberg | ayoung, i think i'm going to propose attribute cleanup on these tests see if it helps | 20:27 |
| henrynash | ayoung: so, no change there….:-) | 20:27 |
| morganfainberg | ayoung, but ... it's an odd one | 20:27 |
| ayoung | Nope, I have always lied | 20:27 |
| ayoung | morganfainberg, yep | 20:27 |
| henrynash | ayoung: i always lie about lieing | 20:28 |
| *** amcrn has quit IRC | 20:28 | |
| *** jsavak has joined #openstack-keystone | 20:31 | |
| morganfainberg | ayoung, that shouldn't be possible in a single thread... should it? | 20:31 |
| ayoung | morganfainberg, not in a single thread | 20:32 |
| *** marcoemorais has quit IRC | 20:32 | |
| ayoung | morganfainberg, I'm just brainstorming | 20:32 |
| *** marcoemorais has joined #openstack-keystone | 20:32 | |
| morganfainberg | ayoung, ahh | 20:32 |
| morganfainberg | ayoung, ok | 20:32 |
| *** amcrn has joined #openstack-keystone | 20:33 | |
| *** andreaf has joined #openstack-keystone | 20:34 | |
| *** joesavak has quit IRC | 20:35 | |
| *** afaranha has joined #openstack-keystone | 20:37 | |
| *** saju_m has quit IRC | 20:41 | |
| *** jsavak has quit IRC | 20:43 | |
| marekd | ayoung: http://logs.openstack.org/89/84389/13/check/gate-keystone-python26/1957ef4/console.html#_2014-04-07_15_06_24_145 isn't the fail you and morganfainberg were taling ~30 mins ago? | 20:46 |
| ayoung | marekd, yep | 20:47 |
| ayoung | marekd, and it happened on a differen iteration, and a different line | 20:47 |
| ayoung | actually...that maybe the same line | 20:47 |
| andreaf | bknudson: ping | 20:48 |
| marekd | ayoung: yep, but the error was similar, that's why i was not sure. Any reason for *not* 'recheck no bug' and hoping it will pass this time? | 20:48 |
| bknudson | andreaf: what's up? | 20:48 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_revoke.py#n418 | 20:48 |
| andreaf | bknudson: hi, thanks for your review on https://review.openstack.org/#/c/74387/ | 20:49 |
| ayoung | recheck bug # | 20:49 |
| ayoung | morganfainberg, was that bug filed? | 20:49 |
| *** erecio has quit IRC | 20:49 | |
| andreaf | bknudson: I addressed most of your comments, only I didn't go for the abstract class as I'd like to still be able to instantiate the class and unit test the implemented methods | 20:49 |
| bknudson | andreaf: ok | 20:50 |
| andreaf | bknudson: if you have time for another review the new patchset is up an passing check | 20:50 |
| bknudson | andreaf: yep, it's on my list | 20:50 |
| andreaf | bknudson: thanks | 20:51 |
| marekd | ayoung: ok https://bugs.launchpad.net/keystone/+bug/1300581 | 20:51 |
| uvirtbot | Launchpad bug 1300581 in keystone "test_revoke.RevokeTreeTests.test_cleanup fails" [Critical,Triaged] | 20:51 |
| morganfainberg | marekd, it'll pass most of the time | 20:51 |
| morganfainberg | marekd, it's highly transient | 20:51 |
| *** pcargnel has quit IRC | 21:00 | |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/85762 | 21:09 |
| mhu | stevemar, got a moment to talk about your OpenID connect PoC ? | 21:13 |
| openstackgerrit | Jenkins proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/85833 | 21:16 |
| stevemar | mhu, err, in the middle of something, but write anyways, and i'll see if i can reply? | 21:17 |
| mhu | stevemar, just wanted some advice on how to test it with google oidc | 21:19 |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/85762 | 21:21 |
| *** marekd is now known as marekd|away | 21:23 | |
| openstackgerrit | Jenkins proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/85833 | 21:27 |
| *** derek_c has quit IRC | 21:27 | |
| *** harlowja is now known as harlowja_away | 21:31 | |
| *** topol has quit IRC | 21:32 | |
| gyee | dolphm, ayoung, morganfainberg, https://bugs.launchpad.net/keystone/+bug/1304049 | 21:34 |
| uvirtbot | Launchpad bug 1304049 in keystone "able to create two users with the same name in the same domain" [Undecided,New] | 21:34 |
| *** harlowja_away is now known as harlowja | 21:35 | |
| gyee | thought we tested this some time back already, apparently not | 21:35 |
| ayoung | gyee, wowza | 21:35 |
| *** topol has joined #openstack-keystone | 21:35 | |
| *** derek_c has joined #openstack-keystone | 21:41 | |
| *** nkinder has quit IRC | 21:46 | |
| *** nkinder has joined #openstack-keystone | 21:46 | |
| *** derek_c has quit IRC | 21:53 | |
| *** nkinder has quit IRC | 21:55 | |
| *** leseb has quit IRC | 22:02 | |
| *** marcoemorais has quit IRC | 22:03 | |
| *** marcoemorais has joined #openstack-keystone | 22:03 | |
| *** henrynash has quit IRC | 22:05 | |
| *** marcoemorais has quit IRC | 22:05 | |
| *** marcoemorais has joined #openstack-keystone | 22:05 | |
| *** amcrn has quit IRC | 22:08 | |
| *** amcrn has joined #openstack-keystone | 22:12 | |
| *** askb_ has joined #openstack-keystone | 22:17 | |
| *** topol has quit IRC | 22:21 | |
| morganfainberg | gyee, oh dear | 22:21 |
| morganfainberg | gyee, that using SQL or LDAP? | 22:22 |
| morganfainberg | gyee, or both? | 22:22 |
| morganfainberg | looks like sql in that case. | 22:22 |
| gyee | morganfainberg, I only tested with sql so far | 22:24 |
| morganfainberg | gyee, does this work w/ the milestone proposed? if so we should tag it with RC potential | 22:24 |
| *** lbragstad has quit IRC | 22:24 | |
| gyee | morganfainberg, yeah should be RC potential | 22:25 |
| gyee | I tested against the latest master | 22:25 |
| morganfainberg | gyee, ++ you working on this? or want me to jump on it. (happy to help if needed) | 22:25 |
| morganfainberg | gyee, if you've got it, ping me with the review so i can +2 it when ready :) | 22:25 |
| gyee | morganfainberg, should be a trivial fix I think, I'll work on it | 22:26 |
| morganfainberg | gyee, ack | 22:26 |
| gyee | morganfainberg, I don't think we should put a security tag on it as this is admin protected API. What do you think? | 22:27 |
| morganfainberg | gyee, agree | 22:28 |
| morganfainberg | gyee, this might also need Havana backport | 22:28 |
| gyee | ouch | 22:28 |
| morganfainberg | i'll take a look and tag the bug if it looks like this could occur | 22:28 |
| morganfainberg | i'm wondering if it's better to force the backends to handle this or the manager... there is an advantage w/ SQL of just making it a unique constraint, but it looks like something better implemented outside of individual backends (so a badly implemented backend doesn't repeat this) | 22:30 |
| gyee | morganfainberg, yet it should be backend neutral. But I hear ya, performance may take a hit | 22:32 |
| gyee | but lookup is hitting dogpile so it shouldn't be that bad | 22:32 |
| morganfainberg | gyee, i'm inclined to say push this down to the backends. | 22:33 |
| morganfainberg | gyee, and document/test for it | 22:33 |
| morganfainberg | gyee, but i'll defer to your choice (I don't mind either) | 22:34 |
| *** zhiyan_ has quit IRC | 22:34 | |
| *** zhiyan_ has joined #openstack-keystone | 22:35 | |
| morganfainberg | gyee, looks like KVS checks for this. | 22:35 |
| gyee | morganfainberg, I prefer doing it in the manager for consistency. Only advantage of doing it in the backend is performance but mileage may vary depending on the type of backend. | 22:35 |
| morganfainberg | gyee, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/kvs.py#n121 | 22:36 |
| morganfainberg | that same code is in havana | 22:36 |
| gyee | yeah, but almost nobody using kvs identity backend in production | 22:37 |
| morganfainberg | gyee, ldap might work/might not depending on the attribute used for name | 22:37 |
| morganfainberg | gyee, sql def. doesn't have a check for this / schema to limit it | 22:37 |
| morganfainberg | oh wow. | 22:37 |
| morganfainberg | actually... | 22:37 |
| gyee | morganfainberg, ldap should work if username is part of the DN | 22:37 |
| morganfainberg | this might be a migration issue. | 22:38 |
| gyee | otherwise, same problem | 22:38 |
| morganfainberg | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/sql.py#n41 | 22:38 |
| gyee | so group is having the same issue? | 22:39 |
| gyee | wow, lemme verify | 22:39 |
| morganfainberg | gyee, we don't create the unique constraint in the user table. | 22:39 |
| morganfainberg | looking at group now. | 22:39 |
| *** andreaf has quit IRC | 22:40 | |
| morganfainberg | gyee, we create a unique constraint on name/domain_id in the group table | 22:40 |
| morganfainberg | migration 014, line ~34 | 22:41 |
| gyee | yeah, group is fine looks like | 22:41 |
| morganfainberg | we just never created the unique constraint...and it looks like LDAP we don't enforce it, we rely on the LDAP server to enforce it | 22:41 |
| morganfainberg | for user/domain | 22:41 |
| gyee | morganfainberg, LDAP only enforce DN uniqueness afaik | 22:42 |
| morganfainberg | gyee, yeah | 22:43 |
| morganfainberg | gyee, well... i think there are other unique ways to contrain it, but not typically used | 22:43 |
| morganfainberg | gyee, so ... LDAP group is probably going to have the same issue *checks* | 22:43 |
| gyee | probably, I | 22:44 |
| morganfainberg | gyee, yep. unless the name is part of the DN, you could have the same issue with LDAP group afaict | 22:44 |
| gyee | ll need to boot up my openldap vm to check it out | 22:44 |
| morganfainberg | gyee, just looking at the code, we don't do a group name check. | 22:44 |
| gyee | k, we have some problem with ldap backend then | 22:46 |
| morganfainberg | gyee, and the manager doesn't know about "get_group_by_name" | 22:46 |
| morganfainberg | gyee, this looks like we need to push it to the backends since we'd need to expand the manager api / driver api (i'd rather not) for H | 22:46 |
| gyee | no shit, really? | 22:46 |
| morganfainberg | yep, get_group is all we have. | 22:47 |
| morganfainberg | which takes an id | 22:47 |
| morganfainberg | the question is ... do we care about names in groups? | 22:47 |
| *** nkinder has joined #openstack-keystone | 22:47 | |
| morganfainberg | for users, yes. | 22:47 |
| morganfainberg | i ... don't think we do for groups in this case. | 22:47 |
| gyee | morganfainberg, yes, group name should be unique within a domain | 22:48 |
| gyee | morganfainberg, oh maybe not, we are not using group name anywhere except in UI | 22:49 |
| morganfainberg | gyee, ok lets target this for the driver. we can make this a manager construct in Juno if we really don't like it (e.g. fix it later) but i think Icehouse and Havana have "shipped" on this front | 22:49 |
| morganfainberg | gyee, yeah that is what it looks like to me | 22:49 |
| gyee | but that would be a usability issue at the very least | 22:49 |
| morganfainberg | gyee, we can hold on the group name stuff for H | 22:49 |
| morganfainberg | i don't think it's super critical for I even. | 22:49 |
| gyee | morganfainberg, I agree, group name is not that urgent | 22:50 |
| morganfainberg | so i'd love to fix the constraint in the db for H, but i think that is a tall order w/ no backport sql migrations available | 22:50 |
| morganfainberg | i think best bet is just get_user_by_name in the manager and raise a conflict if it exists for H and I | 22:51 |
| morganfainberg | gyee, fix the constraint in J for consistency | 22:51 |
| gyee | morganfainberg, k, I'll try the driver approach | 22:51 |
| nkinder | morganfainberg: how much do you know about the token backend? | 22:51 |
| morganfainberg | nkinder, more than i'd like to :) | 22:51 |
| nkinder | morganfainberg: I'm trying to understand why the entire PKI token needs to be kept there. | 22:52 |
| nkinder | morganfainberg: I know we need to have information about the token for revocation | 22:52 |
| gyee | nkinder, for performance | 22:52 |
| gyee | create token is a multiple lookup | 22:52 |
| morganfainberg | nkinder, it actually doesn't. i'm about to start work on not storing it there (ephemeral tokens), if we're using pki tokens i expect to use cms to extract it in all cases in Juno | 22:52 |
| morganfainberg | nkinder, part of that work will be to address the data structure and create calls etc (gyee pointed out the lookup issue) | 22:53 |
| dstanek | morganfainberg: does that setup_database stuff actually do anything useful? i removed the function and none of the test failed | 22:53 |
| morganfainberg | dstanek, if you're using non-sqlite it does the migration | 22:53 |
| nkinder | I was doing some SQL queries on a Havana install I have. It's idle, and I had 1300 tokens in the backend (with a 24 hour validity period and token_flush configured via cron) | 22:54 |
| dstanek | morganfainberg: ah, ok - i'll have to test with something else then - is there a specific test that should fail? | 22:54 |
| morganfainberg | dstanek, our unit tests don't rely on migrations now. we test the migrations explicitly and separately, but use the in-mem sqlite (so reflection created tables) for generic unit tests / restful testcases | 22:54 |
| morganfainberg | dstanek, any restful test case | 22:54 |
| morganfainberg | dstanek, make sure to set your concurrency to 1 | 22:55 |
| morganfainberg | dstanek, though... i wonder if the reflection created tables would work in mysql even. | 22:55 |
| morganfainberg | nkinder, yeah. | 22:55 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Moves test database setup/teardown into a fixture https://review.openstack.org/85651 | 22:55 |
| nkinder | morganfainberg: It seems like we would only need an identifier (hash) of the token, then info on who the token was issued to, what roles it has, etc. I'm simplifying, but the point is that the token shouldn't be needed in it's entirety | 22:55 |
| dstanek | morganfainberg: it should work just fine | 22:56 |
| morganfainberg | nkinder, remember we use the same store for UUID as well, and technically we use PKI and UUID tokens interchanably | 22:56 |
| morganfainberg | nkinder, e.g. if you provide the short hash of the PKI token, it should work as a UUID token | 22:56 |
| morganfainberg | nkinder, when uuid tokens die, that issue goes away. in J there will be an option to eliminate UUID token support. | 22:57 |
| nkinder | morganfainberg: cool | 22:57 |
| morganfainberg | nkinder, so i think you just added one extra phase to ephemeral tokens: 1) no uuid - meaning only store the hash data and use PKI data decode in keystone, 2) don't store any data for tokens (revocation events) | 22:58 |
| morganfainberg | nkinder, good idea! :) | 22:58 |
| morganfainberg | s/hash data/hash and timestamp info | 22:59 |
| nkinder | morganfainberg: we need some data for tokens though, right? | 23:00 |
| nkinder | morganfainberg: for example, if you delete a group, all tokens issued for members of that group are revoked | 23:00 |
| morganfainberg | nkinder, some basic data if we support revoke_by_id | 23:00 |
| nkinder | morganfainberg: we'd need a way to look that up | 23:00 |
| morganfainberg | nkinder, correct. the enumrated token methods (old style token revocation list) will maintain some basic data in the table | 23:01 |
| nkinder | that should be pretty minimal compared to the whole token with catalog, etc. | 23:01 |
| morganfainberg | nkinder, using revocation events will remove that need completely, since we can match the PKI decoded data against the event vs. an explicit TRL | 23:01 |
| morganfainberg | nkinder, it'll be basically what we have now with the json blob eliminated | 23:02 |
| morganfainberg | or more to the point, unused | 23:02 |
| *** jamielennox|away is now known as jamielennox | 23:07 | |
| ayoung | nkinder, the entire token is kept in the backend in case the permissions change, so we can record the origianl permissions and not what they were at the time of checking. That said, morganfainberg actually had the ephemeral patches in the pipeline, but needs the revocation events first | 23:15 |
| *** doddstack has quit IRC | 23:16 | |
| ayoung | revocations are in, but there is as of yet no client support | 23:16 |
| *** ayoung is now known as ayoung_cooking | 23:17 | |
| *** david-lyle has quit IRC | 23:20 | |
| *** gyee has quit IRC | 23:21 | |
| jamielennox | damn, that openssl bug is nasty - will have huge repocussions | 23:24 |
| morganfainberg | jamielennox, which one? | 23:28 |
| *** amcrn has quit IRC | 23:33 | |
| *** marcoemorais has quit IRC | 23:35 | |
| *** marcoemorais has joined #openstack-keystone | 23:35 | |
| jamielennox | heartbleed? | 23:36 |
| jamielennox | question mark because i think that's what it's called | 23:36 |
| jamielennox | http://heartbleed.com/' | 23:38 |
| jamielennox | how many bugs have fancy websites with a .com ? | 23:38 |
| *** koolhead17 has quit IRC | 23:40 | |
| *** derek_c has joined #openstack-keystone | 23:51 | |
| *** koolhead17 has joined #openstack-keystone | 23:53 | |
| *** gyee has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!