| stevemar | jamielennox, oh np, there *was* a patch that leveraged the work, but i think it's abandoned now | 00:00 |
|---|---|---|
| dstanek | jamielennox: is pecan powered by tulip? | 00:03 |
| jamielennox | dstanek: no | 00:03 |
| jamielennox | it's purely a controller thing | 00:03 |
| jamielennox | afaik there is nothing powered by tulip yet | 00:03 |
| dstanek | will it work under tulip or would that be a rewrite? | 00:03 |
| jamielennox | dstanek: i have no idea, i think that's more a general question though | 00:04 |
| jamielennox | it's been accepted as the OS default framework | 00:05 |
| dstanek | it seemed like that was the general directly that people wanted to go | 00:05 |
| bknudson1 | jamielennox: the dependent patch expired | 00:05 |
| *** browne has quit IRC | 00:07 | |
| *** wchrisj has joined #openstack-keystone | 00:15 | |
| *** praneshp has quit IRC | 00:24 | |
| *** praneshp has joined #openstack-keystone | 00:25 | |
| *** praneshp has quit IRC | 00:25 | |
| *** praneshp has joined #openstack-keystone | 00:26 | |
| *** praneshp has quit IRC | 00:28 | |
| *** franco has quit IRC | 00:28 | |
| *** praneshp has joined #openstack-keystone | 00:32 | |
| *** praneshp has quit IRC | 00:33 | |
| *** franco has joined #openstack-keystone | 00:36 | |
| *** richm has quit IRC | 00:38 | |
| *** wchrisj has quit IRC | 00:58 | |
| ayoung | morganfainberg, can you at least kick this on along https://review.openstack.org/#/c/89428/ | 00:59 |
| morganfainberg | ayoung, sec | 00:59 |
| morganfainberg | ayoung yep | 00:59 |
| ayoung | no rush...just want to keep things moving on this. I want compressed tokens in before we cut another client | 00:59 |
| morganfainberg | done | 00:59 |
| morganfainberg | ayoung, nah it was easy, i'm working on something that takes 10+minutes per attempt | 01:00 |
| morganfainberg | ayoung, so quick reviews are easy at this point | 01:00 |
| ayoung | morganfainberg, cool, now, about the follow on patch...you cool with the changes? | 01:00 |
| morganfainberg | looking at it now actually | 01:00 |
| ayoung | https://review.openstack.org/#/c/79411/6..7/keystoneclient/common/cms.py | 01:01 |
| ayoung | that pretty much sums it up | 01:01 |
| morganfainberg | yep | 01:01 |
| morganfainberg | ayoung, we're the only ones that really consume cms_verify atm right | 01:02 |
| morganfainberg | ? | 01:02 |
| ayoung | yes | 01:02 |
| ayoung | morganfainberg, I want to use it with Messaging n the future | 01:02 |
| morganfainberg | i really want to ensure we're not accidentally breaking someone by potentially returning binary data | 01:02 |
| morganfainberg | it's my only concern. | 01:02 |
| morganfainberg | ayoung, other than that LGTM. | 01:03 |
| morganfainberg | ayoung, hm. 2x checking but i think it's a safe (and yes eliminating universal_newlines is good) | 01:03 |
| ayoung | cool | 01:03 |
| morganfainberg | ayoung, stupid question ... we don't need tests for this right? | 01:04 |
| morganfainberg | ayoung, erm extra tests | 01:04 |
| ayoung | morganfainberg, existing tests cover it | 01:04 |
| morganfainberg | ayoung, thought so, but worth asking before +2 | 01:05 |
| morganfainberg | ayoung, +2 on it, with a comment saying as much (about my concern) | 01:07 |
| morganfainberg | ayoung, but i agree, don't think anyone else is using it | 01:08 |
| morganfainberg | ayoung going to hold on the compress one, its a bit more code and i need to get back to this task and figure out broken debian packages. | 01:08 |
| *** nkinder_ has joined #openstack-keystone | 01:12 | |
| ayoung | morganfainberg, that is fine. Compression needs to have full attention. | 01:23 |
| morganfainberg | ayoung, yep | 01:23 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: remove universal_newlines https://review.openstack.org/79411 | 01:37 |
| *** franco has quit IRC | 01:46 | |
| *** rwsu has quit IRC | 01:47 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Fix the catalog format of a sample token https://review.openstack.org/89453 | 01:47 |
| *** franco has joined #openstack-keystone | 01:48 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/89235 | 01:48 |
| *** diegows has quit IRC | 01:51 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/89245 | 01:55 |
| *** gokrokve has quit IRC | 02:06 | |
| *** wchrisj has joined #openstack-keystone | 02:06 | |
| *** gokrokve has joined #openstack-keystone | 02:07 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Compressed Signature and Validation https://review.openstack.org/71181 | 02:08 |
| *** franco has quit IRC | 02:11 | |
| *** gokrokve has quit IRC | 02:11 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add detailed federation configuration docs https://review.openstack.org/89220 | 02:19 |
| *** praneshp has joined #openstack-keystone | 02:19 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make auth_token return a V2 Catalog https://review.openstack.org/89458 | 02:20 |
| *** gokrokve has joined #openstack-keystone | 02:22 | |
| lbragstad1 | stevemar: I had a review up for api validation using json schema but I need to revisit, it's currently a work in progress | 02:23 |
| *** praneshp_ has joined #openstack-keystone | 02:26 | |
| *** praneshp has quit IRC | 02:28 | |
| *** praneshp_ is now known as praneshp | 02:28 | |
| *** zhiyan_ is now known as zhiyan | 02:30 | |
| jamielennox | lbragstad1: where is that? i've got some ideas about jsonschema as well | 02:36 |
| *** wchrisj has quit IRC | 02:47 | |
| *** mberlin has quit IRC | 02:50 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: replace double quotes with single. https://review.openstack.org/89428 | 02:57 |
| *** harlowja is now known as harlowja_away | 02:58 | |
| *** mberlin has joined #openstack-keystone | 03:06 | |
| openstackgerrit | A change was merged to openstack/keystone: Fixes for in-code documentation https://review.openstack.org/87965 | 03:09 |
| *** harlowja_away is now known as harlowja | 03:16 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Make sure all the auth plugins agree on the shared identity attributes. https://review.openstack.org/84945 | 03:17 |
| stevemar | lbragstad1, nothing that leveraged the immutable/mutable stuff in v3 base controller? (i dont remember the details) | 03:33 |
| *** chandan_kumar has joined #openstack-keystone | 04:02 | |
| openstackgerrit | Li Ma proposed a change to openstack/keystone: Password trunction makes password insecure https://review.openstack.org/77325 | 04:09 |
| *** chandan_kumar has quit IRC | 04:10 | |
| *** wchrisj has joined #openstack-keystone | 04:30 | |
| *** jimbaker has quit IRC | 04:53 | |
| *** morganfainberg is now known as morganfainberg_Z | 04:55 | |
| *** jimbaker has joined #openstack-keystone | 04:58 | |
| *** jimbaker has quit IRC | 04:58 | |
| *** jimbaker has joined #openstack-keystone | 04:58 | |
| *** morganfainberg_Z is now known as morganfainberg | 04:59 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Authenticate via oauth https://review.openstack.org/81981 | 05:04 |
| *** daneyon has quit IRC | 05:07 | |
| *** wchrisj has quit IRC | 05:10 | |
| gyee | is launchpad down? I can't seem to access https://bugs.launchpad.net/python-keystoneclient/+bug/1307598 | 05:19 |
| uvirtbot | Launchpad bug 1307598 in python-keystoneclient "Debian/Ubuntu system wide CA certificate file doesn't seem to be used" [Undecided,New] | 05:19 |
| *** stevemar has quit IRC | 05:28 | |
| *** sergmelikyan has quit IRC | 05:35 | |
| *** topol has quit IRC | 05:41 | |
| *** harlowja is now known as harlowja_away | 05:41 | |
| *** jzl-ctrip has quit IRC | 05:53 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Make sure all the auth plugins agree on the shared identity attributes. https://review.openstack.org/84945 | 05:53 |
| *** tomoiaga1 has joined #openstack-keystone | 05:54 | |
| *** gyee has quit IRC | 05:56 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/88503 | 06:01 |
| *** chandan_kumar has joined #openstack-keystone | 06:02 | |
| *** tomoiaga1 is now known as tomoiaga | 06:06 | |
| *** gokrokve has quit IRC | 06:18 | |
| *** derek_c has joined #openstack-keystone | 06:18 | |
| *** gokrokve has joined #openstack-keystone | 06:48 | |
| *** chandan_kumar has quit IRC | 06:49 | |
| *** gokrokve_ has joined #openstack-keystone | 06:50 | |
| *** derek_c has quit IRC | 06:52 | |
| *** gokrokve has quit IRC | 06:53 | |
| *** gokrokve has joined #openstack-keystone | 06:56 | |
| *** gokrokve_ has quit IRC | 06:57 | |
| *** gokrokve has quit IRC | 07:00 | |
| *** chandan_kumar has joined #openstack-keystone | 07:07 | |
| *** derek_c has joined #openstack-keystone | 07:10 | |
| *** derek_c has quit IRC | 07:17 | |
| *** leseb has joined #openstack-keystone | 07:26 | |
| *** gokrokve has joined #openstack-keystone | 07:57 | |
| *** andreaf has joined #openstack-keystone | 07:59 | |
| *** gokrokve has quit IRC | 08:01 | |
| *** jamielennox is now known as jamielennox|away | 08:04 | |
| *** andreaf has quit IRC | 08:12 | |
| *** andreaf has joined #openstack-keystone | 08:13 | |
| *** Chicago has joined #openstack-keystone | 08:22 | |
| *** Chicago has joined #openstack-keystone | 08:22 | |
| *** praneshp has quit IRC | 08:23 | |
| openstackgerrit | Alvaro Lopez Garcia proposed a change to openstack/keystone: Fix typo on cache backend module https://review.openstack.org/89509 | 08:44 |
| *** gokrokve has joined #openstack-keystone | 08:57 | |
| *** gokrokve has quit IRC | 09:01 | |
| *** mberlin has quit IRC | 09:04 | |
| *** mberlin has joined #openstack-keystone | 09:07 | |
| *** mberlin has quit IRC | 09:11 | |
| *** mberlin has joined #openstack-keystone | 09:13 | |
| *** chandan_kumar has quit IRC | 09:15 | |
| *** chandan_kumar has joined #openstack-keystone | 09:29 | |
| *** chandan_kumar is now known as chandankumar | 09:55 | |
| *** chandankumar is now known as chandan_kumar | 09:56 | |
| *** gokrokve has joined #openstack-keystone | 09:58 | |
| *** gokrokve has quit IRC | 10:02 | |
| *** gokrokve has joined #openstack-keystone | 10:59 | |
| *** gokrokve has quit IRC | 11:04 | |
| *** lbragstad1 has quit IRC | 11:37 | |
| *** tomoiaga has quit IRC | 11:38 | |
| *** diegows has joined #openstack-keystone | 11:57 | |
| *** gokrokve has joined #openstack-keystone | 11:59 | |
| *** gokrokve has quit IRC | 12:04 | |
| *** erecio has joined #openstack-keystone | 12:13 | |
| *** bada has joined #openstack-keystone | 12:32 | |
| *** lbragstad has joined #openstack-keystone | 12:53 | |
| *** bknudson1 has quit IRC | 12:55 | |
| *** gokrokve has joined #openstack-keystone | 13:00 | |
| *** gokrokve has quit IRC | 13:04 | |
| lbragstad | dstanek: qq for you on the notification tests | 13:05 |
| dstanek | lbragstad: fire away | 13:05 |
| lbragstad | so, here https://review.openstack.org/#/c/81659/5/keystone/tests/test_notifications.py | 13:06 |
| lbragstad | you have the register_callback method, | 13:06 |
| lbragstad | was the reason to not put that in a setUp() method because we needed to be able to pass in the operator type? | 13:07 |
| lbragstad | like CREATED_OPERATION? | 13:07 |
| lbragstad | register_callback(CREATED_OPERATION); because it's specific to the test case? | 13:07 |
| dstanek | lbragstad: it gets called with different params based on test case | 13:08 |
| lbragstad | dstanek: ok, just checking. I was going to leave a comment suggesting a setUp method but that makes sense | 13:09 |
| dstanek | i would have to create it up into different testcase classes for each invocation - not a bad idea, but a pretty large refactoring | 13:09 |
| dstanek | s/create/break/ | 13:10 |
| lbragstad | dstanek: right, knowing that and the way you have it makes sense | 13:10 |
| openstackgerrit | Matthieu Huin proposed a change to openstack/python-keystoneclient: Limited use trusts https://review.openstack.org/57492 | 13:18 |
| *** bknudson has joined #openstack-keystone | 13:21 | |
| dstanek | lbragstad: did you see this https://review.openstack.org/#/c/87849/? | 13:29 |
| lbragstad | or you do not have permission to view this page. | 13:29 |
| lbragstad | dstanek: ^ | 13:29 |
| lbragstad | The page you requested was not found, or you do not have permission to view this page. | 13:30 |
| dstanek | ah, remove the ? | 13:30 |
| dstanek | lbragstad: did you have a patch to reuse that stuff or should we just put it back in federation? | 13:31 |
| lbragstad | I thought it was being used in other places | 13:31 |
| lbragstad | checking | 13:31 |
| lbragstad | dstanek: ah, I was using it here... but the review got away from me | 13:34 |
| lbragstad | https://review.openstack.org/#/c/76444/5/keystone/catalog/controllers.py | 13:34 |
| ayoung | dstanek, lbragstad https://blueprints.launchpad.net/keystone/+spec/session-extendable-tokens please hack on it. I think that getting this right is essential to proper working with Horizon. | 13:36 |
| dstanek | ayoung: what do you mean by "comes from the original source"? | 13:37 |
| dstanek | ayoung: this sounds similar to oauth refresh tokens | 13:37 |
| *** nkinder_ has quit IRC | 13:43 | |
| *** wchrisj has joined #openstack-keystone | 13:43 | |
| *** wchrisj has left #openstack-keystone | 13:43 | |
| ayoung | dstanek, yep. And for origianl source...that is a good question | 13:46 |
| ayoung | I would guess we would record the IP address of the original requestor and only allow it from there. I realize it could be spoofed | 13:46 |
| ayoung | but if we said "refresh tokens can only come from known endpoints of the Horizon service" it would work | 13:47 |
| ayoung | dstanek, maybe it makes sense for Oauth to be the mechanism for logging in to Horizon. | 13:47 |
| dstanek | ayoung: i think that would be good | 13:48 |
| dstanek | ayoung: you couldn't reliably use IP address. you could have a cluster of horizon boxes | 13:48 |
| ayoung | dstanek, then Keystone needs a webui, if only for the Oauth extension | 13:49 |
| dstanek | ayoung: with oauth2 you wouldn't need a webui | 13:49 |
| ayoung | dstanek, then where are you going to type in userid and password? The whole idea with oauth is that it does not go to the origianl web site. | 13:58 |
| *** kun_huang has joined #openstack-keystone | 13:59 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Allow 'description' in V3 Regions to be optional https://review.openstack.org/78658 | 14:00 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Enforce required parameters for V3 Regions https://review.openstack.org/76444 | 14:00 |
| lbragstad | dstanek: cleaned up^ | 14:01 |
| *** gokrokve has joined #openstack-keystone | 14:01 | |
| *** stevemar has joined #openstack-keystone | 14:02 | |
| *** gokrokve has quit IRC | 14:06 | |
| lbragstad | stevemar: jamielennox|away here is the patch you were asking about last night (specifically the json schema api validation stuff) https://review.openstack.org/#/c/86483/ it's very rough and it's a wip at the moment | 14:06 |
| *** rwsu has joined #openstack-keystone | 14:09 | |
| stevemar | lbragstad, coolio | 14:12 |
| *** ayoung has quit IRC | 14:14 | |
| *** thedodd has joined #openstack-keystone | 14:17 | |
| *** chandan_kumar has quit IRC | 14:17 | |
| *** morganfainberg is now known as morganfainberg_Z | 14:24 | |
| *** david-lyle has joined #openstack-keystone | 14:31 | |
| *** nkinder_ has joined #openstack-keystone | 14:33 | |
| *** gokrokve has joined #openstack-keystone | 14:40 | |
| *** daneyon has joined #openstack-keystone | 14:48 | |
| *** browne has joined #openstack-keystone | 15:19 | |
| mfisch | I hacked up my own password auth backend, but from what I can tell it never gets hit. It seems like the SQL ident driver is doing the password check itself and not using the auth module? Is that right? | 15:20 |
| openstackgerrit | Matthieu Huin proposed a change to openstack/keystone: More random values for oAuth1 verifier https://review.openstack.org/89612 | 15:21 |
| dstanek | mfisch: did you wire it up in the config? | 15:22 |
| mfisch | dstanek: I changed the password line to this: password = keystone.auth.plugins.stacked_password.Password | 15:23 |
| *** richm has joined #openstack-keystone | 15:25 | |
| dstanek | mfisch: from what i understand if you have that in your config and the auth method requested matches it should use it | 15:29 |
| dstanek | mfisch: also i think it's important to note that the methods are tried in order (i believe) | 15:29 |
| mfisch | its odd, I've added some pdb set traces to the normal password module and they're not hit either | 15:30 |
| mfisch | yes on the order, I think I just have the default: methods = external,password,token,oauth1 | 15:30 |
| mfisch | with external commented out | 15:30 |
| *** doddstack has joined #openstack-keystone | 15:31 | |
| *** thedodd has quit IRC | 15:34 | |
| mfisch | well from what I see, doing a simple user-list call the sql authenticate method is hit and the auth password driver is not | 15:34 |
| mhu | mfish, how do you authenticate ? curl ? keystone CLI ? | 15:35 |
| mhu | (and hi :) ) | 15:35 |
| mfisch | mhu: just testing out the cli and bon matin | 15:35 |
| mhu | mfisch, aren't you using by any chance the admin token to authenticate ? | 15:36 |
| mfisch | it even works when I change keystone.conf to point to a non-existant password driver | 15:37 |
| mfisch | mhu: just the basic openrc, password, username, auth_url etc | 15:37 |
| mfisch | even this produces no error | 15:37 |
| mfisch | password = keystone.auth.plugins.does_not_exist.Password | 15:37 |
| dstanek | mfisch: is it the correct config you are changing? also you are not using as OS_TOKEN right? | 15:40 |
| mfisch | dstanek: yes, I dont have a token set. and I'm sure I'm changing the config | 15:41 |
| mfisch | I have pdb traces in the sql driver's authenticate() code and in the password auth modules authenticate() call. The auth module is not being called. | 15:41 |
| mhu | mfisch, the fact that there's no error confirms you're not using a password to authenticate, so it's either because you're using a token or external auth | 15:42 |
| mhu | is your keystone served by apache ? | 15:42 |
| mfisch | no, I dont think so | 15:42 |
| mfisch | the external auth module is commented out, default config | 15:42 |
| mfisch | let me hack up the list and try to force an error | 15:43 |
| *** bach has joined #openstack-keystone | 15:43 | |
| *** _TheDodd_ has joined #openstack-keystone | 15:43 | |
| mfisch | wow it even still works when I have this set for my methods | 15:43 |
| mfisch | methods = thiswontwork | 15:43 |
| dstanek | put in some debugging into keystone/auth/controllers.py's load_auth_methods to see what it sees | 15:45 |
| dstanek | mfisch: ^ | 15:45 |
| mfisch | okay | 15:46 |
| mfisch | so the auth driver is being bypassed | 15:46 |
| *** doddstack has quit IRC | 15:46 | |
| mfisch | from the backtrace, I see controllers.py(265)_authenticate_local() calling directly into the identity driver's auth mechanism | 15:46 |
| mfisch | that's token/controllers.py, wonder how it got there | 15:46 |
| mhu | mfisch, can you run your client with the --debug option, we'll see what's sent to the server | 15:47 |
| mfisch | dstanek: interestingly that method is never called, I wonder how I got into that state | 15:48 |
| dstanek | mfisch: i'm not familiar with that bit of code so i'm stumbling in the dark :-) | 15:49 |
| mfisch | its okay, I am too ;) | 15:49 |
| mfisch | but it's obviously ignoring my settings in the auth section for some reason because it's not upset about bogus values | 15:49 |
| *** zhiyan is now known as zhiyan_ | 15:50 | |
| mhu | mfisch, I suspect it's because it never gets there. It's either intercepted at the middleware level by token_auth or admin_token_auth, or you have a REMOTE_USER env variable set that is used by the external auth method (which is enabled in v2 regardless of config, IIRC) | 15:51 |
| mfisch | mhu: it is enabled by default it appears | 15:52 |
| mfisch | mhu: I did see the token auth call in the stacktrace, let me look again | 15:52 |
| mfisch | token/controllers.py(94)authenticate() | 15:52 |
| dstanek | load_auth_methods should be called at startup in keystone.backends | 15:52 |
| dstanek | mfisch: is it possible that you are hitting the wrong keystone service? | 15:53 |
| mfisch | dstanek: this is what mine dumps out on startup | 15:54 |
| mfisch | auth.methods = ['thiswontwork'] | 15:54 |
| mfisch | endpoint looks good | 15:54 |
| *** sjcazzol has joined #openstack-keystone | 15:54 | |
| mfisch | okay the token auth driver tries external auth if REMOTE_USER is set, and if not it does a "local" auth which calls directly to the identity driver, skipping the auth module | 15:55 |
| sjcazzol | I added a specification for the blueprint https://blueprints.launchpad.net/keystone/+spec/tenants-users-quotas. It would be great if someone could give me some feedback on this. | 15:57 |
| sjcazzol | The specs are linked in the whiteboard | 15:58 |
| mfisch | near as I can tell in the code when you ask for a token it completely bypasses the auth module. It tries external if REMOTE_USER is set and then calls directly to the identity driver, which in this case is SQL | 16:10 |
| mfisch | seems like a bug to me but perhaps I dont understand the design | 16:11 |
| *** chandan_kumar has joined #openstack-keystone | 16:11 | |
| dstanek | mfisch: what code are you looking at? | 16:16 |
| mfisch | dstanek: authenticate() in token/controllers.poy | 16:16 |
| mfisch | sorry, .py | 16:16 |
| mfisch | dstanek: when I call keystone user-list from the CLI i end up here during the token request | 16:17 |
| mfisch | dstanek: see where it calls _authenticate_local()? | 16:18 |
| *** chandan_kumar has quit IRC | 16:20 | |
| mfisch | dstanek: I'm looking at havana code, but it looked similar at a glance for I | 16:21 |
| *** marcoemorais has joined #openstack-keystone | 16:21 | |
| *** shakamunyi has joined #openstack-keystone | 16:43 | |
| *** bach has quit IRC | 16:51 | |
| *** packet has joined #openstack-keystone | 16:51 | |
| afaranha | mhu: About the commit message (https://review.openstack.org/#/c/57492/5//COMMIT_MSG) I don't know what need to be done, I think you can ask Anne Gentle or any Keystone Drivers (https://launchpad.net/~keystone-drivers) | 16:58 |
| *** praneshp has joined #openstack-keystone | 17:09 | |
| *** ayoung_ has joined #openstack-keystone | 17:14 | |
| *** david-lyle is now known as david-lyle_afk | 17:16 | |
| *** harlowja_away is now known as harlowja | 17:18 | |
| *** ayoung_ is now known as ayoung | 17:25 | |
| *** morganfainberg_Z is now known as morganfainberg | 17:26 | |
| ayoung | dstanek, sorry for disappearing...why do you think that "with oauth2 you wouldn't need a webui" to log in? | 17:26 |
| dstanek | ayoung: there is a mobile flow that i think doesn't use a UI in the same way as oauth1 | 17:31 |
| ayoung | dstanek, something has to provide the login ui for form based authentication. I don't think any of the other auth approaches require anything | 17:32 |
| *** gyee has joined #openstack-keystone | 17:33 | |
| ayoung | man, wouldn't it be nice if Basic Auth were skinable or something. | 17:33 |
| dstanek | ayoung: doesn't horizon capture the password? they in the background it could exchange that for the token - almost the same as it does now | 17:33 |
| dstanek | s/they/then/ | 17:33 |
| ayoung | No, they don't | 17:33 |
| ayoung | that would be a security issue, Horizon only does token-for-token exchanges | 17:34 |
| dstanek | how do they get the token then? does the user need to use the cli client to get the first token? | 17:35 |
| *** gyee has quit IRC | 17:39 | |
| morganfainberg | dstanek, horizon passes the username/password in once | 17:49 |
| morganfainberg | dstanek, doesn't store it | 17:49 |
| morganfainberg | dstanek, but after that one time (Getting the unscoped token) they only do token-for-token | 17:50 |
| dstanek | morganfainberg: that's what i thought. so it can do the oauth dance with the credentails at that point | 17:50 |
| morganfainberg | dstanek, yes. | 17:51 |
| morganfainberg | dstanek, keystone can still be the SP in this case. | 17:51 |
| morganfainberg | it's a little wonky but not unsupportable | 17:51 |
| *** chandan_kumar has joined #openstack-keystone | 17:52 | |
| morganfainberg | dstanek, dogpile update merged | 17:55 |
| ayoung | morganfainberg, so, say we exposed oauth to the public, but not the rest of Keystone, with a webform. | 17:55 |
| morganfainberg | to global reqs, we can make sure keystone is sync'd then do your patch to use the new properties. | 17:55 |
| morganfainberg | ayoung, technically you could pass that info through horizon to keystone, now you couldn't use the same info for direct access. | 17:56 |
| *** gyee has joined #openstack-keystone | 17:56 | |
| ayoung | morganfainberg, which horizon? Lets assume there are multiple, and do Oauth correctly, and lets not forget about the non-horizon folks. | 17:57 |
| morganfainberg | ayoung, multiple horizones with distinct domain names? | 17:57 |
| morganfainberg | ayoung, or loadbalanced?> | 17:57 |
| ayoung | sure...or geographically distributed or.... | 17:58 |
| *** topol has joined #openstack-keystone | 17:58 | |
| ayoung | Having Horizon proxy it through seems like a misuse of Oauth. | 17:58 |
| morganfainberg | ayoung, ok distinct hostnames - you auth with separate sessions to each - similar to how the SSO (openID) would work for review.openstack.org and revierw-dev.openstack.org | 17:59 |
| ayoung | ++ | 17:59 |
| morganfainberg | eventually... you want horizon to use the SSO-style auth as a session | 17:59 |
| morganfainberg | not use the token | 17:59 |
| ayoung | +++ | 17:59 |
| ayoung | ++++ | 17:59 |
| morganfainberg | so horizon would be the SP and pass the info back to keystone in that case. | 17:59 |
| morganfainberg | it also couldn't be used by keystone directly, | 17:59 |
| *** packet has quit IRC | 18:00 | |
| morganfainberg | well.. in theory it shouldn't work to take that session and use it against a keystone directly | 18:00 |
| morganfainberg | you would (in theory) need a re-auth for direct access, same mechanism though | 18:00 |
| *** browne has quit IRC | 18:02 | |
| *** jamielennox|away is now known as jamielennox | 18:03 | |
| *** sjcazzol_ has joined #openstack-keystone | 18:06 | |
| *** sjcazzol has quit IRC | 18:08 | |
| *** chandan_kumar has quit IRC | 18:29 | |
| *** gokrokve has quit IRC | 18:33 | |
| *** browne has joined #openstack-keystone | 18:34 | |
| *** gyee has quit IRC | 18:35 | |
| dolphm | #topic open discussion | 18:39 |
| dolphm | whoops. | 18:39 |
| bknudson | I hope it's open discussion here | 18:39 |
| *** dolphm changes topic to "Open discussion." | 18:40 | |
| dolphm | just to be safe | 18:40 |
| *** kun_huang has quit IRC | 18:41 | |
| morganfainberg | LOL | 18:42 |
| morganfainberg | #topic learning where meetbot lives | 18:42 |
| *** kun_huang has joined #openstack-keystone | 18:45 | |
| *** sjcazzol has joined #openstack-keystone | 18:45 | |
| *** sjcazzol_ has quit IRC | 18:46 | |
| *** gyee has joined #openstack-keystone | 18:46 | |
| *** kun_huang has quit IRC | 18:46 | |
| *** Chicago has quit IRC | 18:47 | |
| *** openstackgerrit has quit IRC | 18:49 | |
| *** openstackgerrit has joined #openstack-keystone | 18:49 | |
| *** sjcazzol has quit IRC | 18:49 | |
| *** chandan_kumar has joined #openstack-keystone | 18:53 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make auth_token return a V2 Catalog https://review.openstack.org/89458 | 19:00 |
| nkinder_ | bknudson: I've added your configurable token hashing work to https://wiki.openstack.org/wiki/Security/Juno/Keystone#Notable_changes_since_Icehouse | 19:00 |
| bknudson | I'll do a rebase on https://review.openstack.org/#/c/78241/ so we can keep this moving. | 19:00 |
| bknudson | nkinder_: hasn't even merged yet! | 19:00 |
| nkinder_ | bknudson: when it lands, we need to make sure to update the wiki page | 19:00 |
| nkinder_ | bknudson: I know. I listed it as "IN PROGRESS" | 19:00 |
| bknudson | nkinder_: I wonder if we'll be able to change the default to sha256... | 19:02 |
| *** bach has joined #openstack-keystone | 19:02 | |
| nkinder_ | bknudson: When it does land, we can remove the "IN PROGRESS" note and modify the algorithm table where it is discussed | 19:02 |
| nkinder_ | bknudson: it would be nice. I need to review your latest patches | 19:02 |
| *** bach has quit IRC | 19:02 | |
| *** david-lyle_afk is now known as david-lyle | 19:03 | |
| *** bach has joined #openstack-keystone | 19:05 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Ensure that cached token is not revoked https://review.openstack.org/78241 | 19:08 |
| openstackgerrit | Alexei Kornienko proposed a change to openstack/python-keystoneclient: Ensure that cached token is not revoked https://review.openstack.org/78241 | 19:09 |
| *** leseb has quit IRC | 19:09 | |
| bknudson | the only conflict in https://review.openstack.org/78241 was the change to fix the spelling for "ans1" | 19:09 |
| *** gyee has quit IRC | 19:11 | |
| *** thiagop has quit IRC | 19:11 | |
| *** bvandenh has quit IRC | 19:12 | |
| topol | so bknudson are you happy with https://review.openstack.org/#/c/78241/ | 19:13 |
| topol | did that meet your seal of approval? | 19:13 |
| morganfainberg | dolphm, topol, does it make sense to do a surveymonkey thing for the catalog? or just ask for feedback on the ML? | 19:13 |
| topol | or you are just starting to review it?? | 19:13 |
| bknudson | topol: I took a look at it before and I think I was fine with it. I'll take a look again. | 19:13 |
| morganfainberg | dolphm, topol, i'm thinking a survey would be good, but i don't know if it makes more sense to just read through ML responses. | 19:14 |
| nkinder_ | bknudson: thanks for fixing the asn1 typo! That was bothering me... | 19:14 |
| morganfainberg | dolphm, topol, thinking of asking 2 questions: which catalog backend, which API version | 19:14 |
| bknudson | nkinder_: that was someone else made the change | 19:14 |
| topol | morganfainberg I think just mailing list with a proper subject line to catch folks eye. Im scared the folks will forget to participate in the survey | 19:14 |
| nkinder_ | bknudson: ah, I thought you did | 19:14 |
| bknudson | I just had to resolve the merge conflict | 19:14 |
| morganfainberg | topol, so something like http://pasteraw.com/ai5kneikh0w0xfuqpt6dqt7vjzumwhp for verbiage | 19:15 |
| *** afaranha has quit IRC | 19:15 | |
| morganfainberg | topol, trying to avoid panic :) | 19:15 |
| nkinder_ | bknudson: back to the token hashing algorithm... The difficulty in using sha256 as the default is that older clients will not handle revocations? | 19:16 |
| topol | So I think you could offer the survey or just ask folks to respond to you if they have a strong opinion | 19:16 |
| morganfainberg | topol, might remove the "limitations" sentence. | 19:16 |
| ayoung | nkinder_, that is correct, so we want to make it optional | 19:16 |
| morganfainberg | topol, ok i'll toss a survey in. | 19:16 |
| topol | in the same note and give them a choice. | 19:16 |
| bknudson | nkinder_: there's a transition time while there are both sha256 and md5 tokens out there. | 19:16 |
| nkinder_ | bknudson: they will md5 hash, which won't match the sha256 hash | 19:16 |
| morganfainberg | topol, yep. | 19:16 |
| ayoung | and then deployments that chose to run the newer algorithms have to run with newer clients | 19:17 |
| nkinder_ | bknudson: that requires clients that are aware of the fact that tokens with different hashes are out there | 19:17 |
| topol | Ideally there should be no panic. You arent dropping function. Youa re just prioritizing updates correct? | 19:17 |
| ayoung | "only" the newere algorithm | 19:17 |
| topol | morganfainberg | 19:17 |
| morganfainberg | yep | 19:17 |
| *** chandan_kumar has quit IRC | 19:17 | |
| morganfainberg | topol, that is the plan :) | 19:17 |
| bknudson | nkinder_: yes, the auth token middleware, and clients that do hashing themselves | 19:17 |
| nkinder_ | so the concern is that keystone's default changes, but old client code is still out there that isn't aware as I understand it | 19:17 |
| bknudson | I think horizon hashes the pki token | 19:17 |
| topol | wait, did I see a quote from you about dropping the template catalog. YOU induced the panic :-) | 19:18 |
| topol | morganfainberg, how about a statement stating a desire to stop enhancing the template catalog. If you get panic then you know we need to enhance it | 19:19 |
| morganfainberg | topol, ok i'll reword and include the survey and run it by you one more time. | 19:20 |
| mfisch | dstanek: did you find the code I was referring to earlier? | 19:20 |
| morganfainberg | topol, trying to keep it _really_ simple | 19:20 |
| *** thiagop has joined #openstack-keystone | 19:20 | |
| topol | a la nova network | 19:20 |
| morganfainberg | topol, hehe except nova net is open for changes again iirc | 19:20 |
| topol | Yep agreed. I think one line or two and if anyone freaks you know your answer | 19:21 |
| topol | yes it is. Quite a statement that makes :-) | 19:21 |
| *** gokrokve has joined #openstack-keystone | 19:21 | |
| topol | test your plugins vedors :-) | 19:22 |
| nkinder_ | I'd like to propose a backport of this bug fix for icehouse - https://bugs.launchpad.net/keystone/+bug/1281216 | 19:23 |
| uvirtbot | Launchpad bug 1281216 in keystone "Keystone Havana Authentication Error using samAccountName in Active Directory" [Low,Fix committed] | 19:23 |
| nkinder_ | does that seem acceptable to others? | 19:24 |
| openstackgerrit | Alexei Kornienko proposed a change to openstack/python-keystoneclient: Ensure that cached token is not revoked https://review.openstack.org/78241 | 19:25 |
| dstanek | mfisch: yes, but i'm not sure about the design | 19:26 |
| dstanek | mfisch: we just had our meeting so there are probably still a bunch of devs that could answer that question still here | 19:26 |
| bknudson | nkinder_: I don't see a problem with backporting that change... it's small and it's got tests and it fixes a bug | 19:27 |
| *** afaranha has joined #openstack-keystone | 19:28 | |
| nkinder_ | bknudson: to propose a backport, do I just submit a patch for the stable/icehouse branch and reference the same bug? | 19:30 |
| bknudson | nkinder_: should be able to cherry-pick it -- git-review -X | 19:30 |
| bknudson | then submit that commit to stable/icehouse | 19:30 |
| bknudson | nkinder_: also, I think you're supposed to add icehouse-backport-potential to the bug | 19:31 |
| *** shakamunyi has quit IRC | 19:33 | |
| nkinder_ | bknudson: do I just add that as a comment, or is there somewhere more specific I need to flag that in the bug? | 19:33 |
| bknudson | nkinder_: it's a tag | 19:34 |
| morganfainberg | topol, http://pasteraw.com/1fdlbovrrqgiwzj4ofvrzpxjbft48fc | 19:35 |
| morganfainberg | topol, i'll be x-posting to operators (the same exact email) | 19:35 |
| mfisch | dstanek: thanks | 19:35 |
| *** bach has quit IRC | 19:35 | |
| mfisch | dstanek: I think I'll just assume it's supposed to work that way and just revive my ident driver since the auth ones dont get called | 19:35 |
| openstackgerrit | A change was merged to openstack/keystone: Discourage use of pki_setup https://review.openstack.org/80819 | 19:35 |
| *** bach has joined #openstack-keystone | 19:36 | |
| *** shakamunyi has joined #openstack-keystone | 19:36 | |
| morganfainberg | topol, subject: Catalog Backend in Deployments (Templated, SQL, etc) | 19:36 |
| morganfainberg | topol, is it better to send the same email twice, once to each list? [i think that is the right way] | 19:37 |
| openstackgerrit | Alexei Kornienko proposed a change to openstack/python-keystoneclient: Ensure that cached token is not revoked https://review.openstack.org/78241 | 19:37 |
| topol | morganfainberg, looks perfect | 19:37 |
| morganfainberg | topol, cool. | 19:38 |
| topol | subject looks good too. | 19:38 |
| morganfainberg | sending the messages now. | 19:38 |
| topol | email twice is fine | 19:38 |
| morganfainberg | topol, sent. | 19:40 |
| morganfainberg | lets see what response we end up with | 19:40 |
| morganfainberg | i expect panic. | 19:40 |
| morganfainberg | :P | 19:40 |
| topol | morganfainberg, no panic until after a few beers and I respond by saying we are removing all catalogs so dont worry about the poll | 19:43 |
| topol | until then we are finr | 19:44 |
| topol | fine | 19:44 |
| *** joesavak has joined #openstack-keystone | 19:52 | |
| nkinder_ | bknudson: I don't see any way of adding a tag. Perhaps I need to have some extra permission for that? | 19:54 |
| *** markstur has joined #openstack-keystone | 19:54 | |
| bknudson | nkinder_: there's no edit tags button? looks like ! | 19:55 |
| nkinder_ | bknudson: yep, no button for me | 19:56 |
| bknudson | nkinder_: I added it. | 19:56 |
| nkinder_ | bknudson: thanks! | 19:56 |
| bknudson | maybe you need some kind of authority to do it | 19:57 |
| bknudson | dolphm had already put havana-backport-potential on it. | 19:57 |
| dolphm | nkinder_: bknudson: which bug? | 19:58 |
| nkinder_ | dolphm: https://bugs.launchpad.net/keystone/+bug/1281216 | 19:58 |
| uvirtbot | Launchpad bug 1281216 in keystone "Keystone Havana Authentication Error using samAccountName in Active Directory" [Low,Fix committed] | 19:58 |
| dolphm | nkinder_: bknudson: i'd be happy to backport it if ya'll aren't doing so | 20:00 |
| morganfainberg | topol, haha nice | 20:04 |
| nkinder_ | dolphm: I'll take care of it. It will give me experience in running through the backport process | 20:04 |
| morganfainberg | nkinder_, thankfully backporting isn't too difficult | 20:05 |
| morganfainberg | nkinder_, usually | 20:05 |
| dolphm | nkinder_: awesome - poke me if you have questions | 20:05 |
| bknudson | morganfainberg is having flashbacks to difficult backports | 20:05 |
| morganfainberg | bknudson, you weren't there maN... you weren't there | 20:06 |
| morganfainberg | bknudson, i can only really think of one bad backport | 20:08 |
| morganfainberg | bknudson, and it was only painful because it was icehouse -> havana -> grizzly | 20:09 |
| morganfainberg | or was it havana -> grizzly -> folsom | 20:09 |
| morganfainberg | one of those | 20:09 |
| *** derek_c has joined #openstack-keystone | 20:10 | |
| dolphm | morganfainberg: my worst "backport" required completely separate fixes to be developed for all three branches. | 20:14 |
| morganfainberg | dolphm, thats no fun. | 20:14 |
| *** bach_ has joined #openstack-keystone | 20:15 | |
| *** bach has quit IRC | 20:15 | |
| *** andreaf_ has joined #openstack-keystone | 20:16 | |
| *** andreaf_ has quit IRC | 20:19 | |
| *** leseb has joined #openstack-keystone | 20:19 | |
| *** andreaf_ has joined #openstack-keystone | 20:19 | |
| *** andreaf has quit IRC | 20:20 | |
| *** bach_ has quit IRC | 20:22 | |
| *** bach has joined #openstack-keystone | 20:23 | |
| dolphm | just ran into this serialization format today, which is totally new to me https://code.google.com/p/rson/ | 20:24 |
| morganfainberg | rson. interesting | 20:25 |
| mfisch | morganfainberg: perhaps you can comment on a mystery, when I use password auth and request a token, is it supposed to go through the auth modules? | 20:26 |
| morganfainberg | mfisch, v2.0 or v3? | 20:26 |
| dolphm | morganfainberg: it's like a weird cross of json and yaml developed by a crazy person | 20:27 |
| *** bach has quit IRC | 20:27 | |
| morganfainberg | mfisch, v3 is where the auth plugins/modules are used vs. the logic in the token auth controller | 20:27 |
| ayoung | bknudson so, there is this bug: https://bugs.launchpad.net/oslo.messaging/+bug/1261631 which looks like the solution is to sync openstack/common/rpc/impl_kombu.py but we don't have any part of the RPC subtree | 20:28 |
| morganfainberg | dolphm, yeah i don't see a benefit of this over json. | 20:28 |
| uvirtbot | Launchpad bug 1261631 in oslo/havana "Reconnect on failure for multiple servers always connects to first server" [Low,Fix committed] | 20:28 |
| ayoung | is it invalid fo us, or is it something we can ignore? | 20:28 |
| morganfainberg | dolphm, it's kindof making my head hurt. | 20:28 |
| dolphm | morganfainberg: it seems to have all the inadequacies of yaml and xml | 20:28 |
| mfisch | morganfainberg: v2 | 20:28 |
| dolphm | morganfainberg: i wouldn't describe it as a superset of json at all | 20:28 |
| morganfainberg | mfisch, yeah, v2 wont use the auth plugins. | 20:28 |
| mfisch | morganfainberg: I did see the token driver just calling right to the identity driver | 20:28 |
| mfisch | morganfainberg: ugh, so whats the point of an auth module in v2? | 20:28 |
| morganfainberg | mfisch, https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L60 | 20:29 |
| bknudson | ayoung: how could the bug affect us if we don't use it? | 20:29 |
| morganfainberg | mfisch, this is one of the benefits of using V3 (yes, I know, not supported everywhere yet) | 20:29 |
| bknudson | if we don't have the code | 20:29 |
| ayoung | yeah...I have no clue | 20:29 |
| ayoung | its a clone, so maybe it was done blindly? | 20:29 |
| mfisch | morganfainberg: yeah, thats the code I was looking at earlier, authenticate_local calls direct to ident | 20:29 |
| morganfainberg | mfisch, yep | 20:29 |
| ayoung | Or..are we not doing something that we should be doing? | 20:29 |
| bknudson | ayoung: we use oslo.messaging now for that, I think. | 20:30 |
| morganfainberg | mfisch, v2.0 doesn't have the auth plugin mechanisms | 20:30 |
| morganfainberg | mfisch, it wasn't really designed with that in mind. | 20:30 |
| ayoung | all I know is nkinder_ is about to beat me up about Bugs in....ah crap , now | 20:30 |
| mfisch | morganfainberg: so the docs for it are really designed for v3 | 20:30 |
| morganfainberg | mfisch, if we weren't clear on the auth plugins being a v3 thing we should get the docs updated | 20:30 |
| * nkinder_ looks for his stick | 20:31 | |
| morganfainberg | mfisch, but yes, v3 is where auth plugin logic is used | 20:31 |
| mfisch | morganfainberg: I dont see it called out here: http://docs.openstack.org/developer/keystone/configuration.html#how-to-implement-an-authentication-plugin | 20:31 |
| bknudson | ayoung: this was opened 2013-12-17 ... maybe this was before the switch to oslo.messaging | 20:32 |
| morganfainberg | mfisch, yep, don't see it either. file a bug on this if you don't mind (feel free to fix it too if you're so inclined) | 20:32 |
| morganfainberg | mfisch, good catch. | 20:32 |
| mfisch | not sure if happy to be right or sad that it doesn't work | 20:32 |
| *** derek_c has quit IRC | 20:33 | |
| morganfainberg | mfisch, well, help us get everyone moved to v3 :) then it'll work like you expect! | 20:33 |
| morganfainberg | mfisch (shameless plug for help to get OpenStack on keystone V3) | 20:34 |
| mfisch | I'm on board | 20:34 |
| morganfainberg | dolphm, on the topic of v3 vs v2... we should start thinking about alternate versioning mechanisms so we don't run into the Nova problem if we hit the limits (design or otherwise) of keystone v3 API. | 20:34 |
| dolphm | morganfainberg: the nova problems? | 20:34 |
| dolphm | problem* | 20:35 |
| morganfainberg | dolphm, nova v3 can-o-worms | 20:35 |
| morganfainberg | dolphm, it's a hard sell to make a major API version change. | 20:35 |
| morganfainberg | dolphm, especially as the surface area of the API increases | 20:35 |
| dolphm | morganfainberg: ah yeah... frankly, when both of these api revisions started, openstack was much younger and a transition seemed much more viable | 20:36 |
| morganfainberg | dolphm, i expect we will eventually hit a hard limitation of v3. we should consider options when that happens earlier vs "OMG how do we fix it" | 20:36 |
| dolphm | morganfainberg: every release that goes by makes that much more challenging | 20:36 |
| morganfainberg | dolphm, i am a fan of microversioning. | 20:36 |
| dolphm | morganfainberg: we already are microversioning | 20:36 |
| morganfainberg | dolphm, i mean on the public REST API, we add functionality, but changing it is hard. | 20:36 |
| morganfainberg | dolphm, if we want to change how a whole suite of calls work... how do we do that. | 20:37 |
| mfisch | morganfainberg: https://bugs.launchpad.net/keystone/+bug/1311324 | 20:37 |
| dolphm | morganfainberg: that sounds like a major version bump to me :-/ | 20:37 |
| uvirtbot | Launchpad bug 1311324 in keystone "documentation does not specify that [auth] drivers only work with v3 API" [Undecided,New] | 20:37 |
| morganfainberg | dolphm, a way to handle API incompatible changes w/o breaking the contract | 20:37 |
| morganfainberg | dolphm, right, and that is the hard sell. | 20:37 |
| dolphm | morganfainberg: ideally you don't break *everything* with a major version bump | 20:38 |
| morganfainberg | dolphm, maybe we can do per-api versioning. eh, something to talk about later (or per subsystem) | 20:38 |
| morganfainberg | dolphm, ideally. | 20:38 |
| dolphm | morganfainberg: unfortunately for keystone, part of the motivation for a v3 was simply consistency across the api | 20:38 |
| morganfainberg | dolphm, and for us it's good (same reason nova wanted v3) | 20:38 |
| morganfainberg | dolphm, nothing we need to solve now, but we may want to come up with a API succession plan so to speak - start planning the basics of it (long view) | 20:39 |
| dolphm | morganfainberg: i'm still interested in separating the "identity-api" into smaller APIs... "auth-api", "identity-management-api", "quota-api", etc | 20:39 |
| morganfainberg | dolphm, ++++++ | 20:39 |
| morganfainberg | dolphm, i actually was mulling over some of that. | 20:39 |
| dolphm | morganfainberg: i'd be easy to break the doc down, but what do you win in the real world? | 20:40 |
| dolphm | (for free) | 20:40 |
| morganfainberg | dolphm, leverage HTTP codes to start. 301 /v3/<blah> -> /<blah>/v3 | 20:40 |
| dolphm | morganfainberg: i'd prefer content types over that (application/json+identity-v3.2) | 20:41 |
| morganfainberg | dolphm, and then we can work to increment the major versions of the subsystems as needed. might require continued/better internal isolation, but we've been heading that way. | 20:41 |
| morganfainberg | dolphm, well, i meant for the initial conversion i think the subsystems should be the top level vs the version # | 20:42 |
| morganfainberg | dolphm, past that, content-type would be awesome for that | 20:42 |
| morganfainberg | mfisch, awesome thanks! | 20:43 |
| morganfainberg | dolphm, i really like the idea of content types. | 20:45 |
| morganfainberg | dstanek, do we have a common-ish wsgi implementation across openstack or is it really all over (i think it's the latter) | 20:48 |
| *** _TheDodd_ has quit IRC | 20:49 | |
| dstanek | content-types ftw! | 20:49 |
| dstanek | morganfainberg: i think it's all over the place | 20:49 |
| morganfainberg | dstanek, trying to figure out where to implement HTTP cache headers (etags etc) for APIs so we can get it in all services | 20:50 |
| morganfainberg | we should be specifying this stuff. | 20:50 |
| morganfainberg | i'm wondering if pecan can do this for us. | 20:50 |
| bknudson | I think we already have a hard limitation of v3 if we want to start validating inputs (using jsonschema, for example) | 20:51 |
| dstanek | morganfainberg: i was just asking about pecan vs. tuplip yesterday | 20:51 |
| morganfainberg | dstanek, nice | 20:52 |
| morganfainberg | bknudson, i would agree. | 20:52 |
| morganfainberg | bknudson, i think that makes the argument for splitting the API (and using separate versioning) stronger | 20:53 |
| morganfainberg | bknudson, v3 being the base version. | 20:53 |
| morganfainberg | bknudson, and not saying we should work on a new version of anything until we _must_. | 20:54 |
| dstanek | morganfainberg: the way i've impplemented this in the past is through facades | 20:54 |
| openstackgerrit | Doug Hellmann proposed a change to openstack/keystone: Move stevedore to a production requirement https://review.openstack.org/89420 | 20:54 |
| morganfainberg | dstanek, nod. | 20:54 |
| bknudson | morganfainberg: we could use the same technique that we should use for the client API -- up the version when we remove stuff | 20:55 |
| dstanek | a facade for each supported version - the actual implementation of the model is almost changing, but the facades make it look like it's not for stable apis | 20:55 |
| bknudson | otherwise it's minor version number changes | 20:55 |
| morganfainberg | dstanek, ++ that was the general direction i would like to go | 20:55 |
| morganfainberg | bknudson, sure, but the public facing API can't be a big moving target (I'd argue some of the client stuff is a bit much of a moving target, and we try and minimize that as well) | 20:57 |
| *** erecio has quit IRC | 20:59 | |
| morganfainberg | bknudson, probably nothing we need to address today. | 21:02 |
| morganfainberg | dstanek, ^ | 21:02 |
| dstanek | morganfainberg: what's up? | 21:02 |
| *** derek_c has joined #openstack-keystone | 21:04 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Debug log when token found in revocation list https://review.openstack.org/89693 | 21:08 |
| bknudson | topol: https://review.openstack.org/#/c/78241/ looks ok to me | 21:09 |
| morganfainberg | dstanek, what i just said to bknudson. | 21:09 |
| morganfainberg | dstanek, versions not somethjing we need to solve today. | 21:09 |
| bknudson | morganfainberg: let's solve it today anyways | 21:09 |
| *** kmartin has joined #openstack-keystone | 21:09 | |
| morganfainberg | bknudson, lol | 21:09 |
| morganfainberg | bknudson, lets break all the APIs while we're at it too. | 21:10 |
| morganfainberg | bknudson, can we move to a binary only-format as well (HTTP 2.0?) | 21:10 |
| bknudson | morganfainberg: let's just make up our own protocol similar to HTTP | 21:11 |
| morganfainberg | bknudson, Love it! | 21:11 |
| topol | bknudson, cool | 21:12 |
| *** bach has joined #openstack-keystone | 21:14 | |
| *** gyee has joined #openstack-keystone | 21:20 | |
| *** derek_c_ has joined #openstack-keystone | 21:22 | |
| dolphm | morganfainberg: you can't choose v2 AND v3 in your survey | 21:24 |
| morganfainberg | dolphm, oh i can fix that, sec | 21:24 |
| morganfainberg | oh ... no i can't fix it *doh* | 21:25 |
| dolphm | morganfainberg: the response is going to be 100% v2 then! | 21:25 |
| morganfainberg | there we go | 21:26 |
| morganfainberg | fixed | 21:26 |
| morganfainberg | added a v2.0 and v3 option | 21:26 |
| dolphm | morganfainberg: that works | 21:26 |
| morganfainberg | dolphm, yeah good catch (couldn't change the type of question to be multi-select) | 21:27 |
| gyee | morganfainberg, dolphm, are we going to add cache (dogpile) for identity manager? | 21:32 |
| morganfainberg | gyee, yes | 21:32 |
| gyee | Juno? | 21:33 |
| morganfainberg | gyee, i'm waiting until post summit since the dogpile developer will be there | 21:33 |
| morganfainberg | i might be converting all of the work to oslocache | 21:33 |
| morganfainberg | it's a question of where the code goes, in oslo or in dogpile | 21:33 |
| gyee | i c | 21:33 |
| morganfainberg | since mike will be there, i can talk to him directly about it | 21:33 |
| dolphm | morganfainberg: really? | 21:33 |
| dolphm | morganfainberg: what's his interest in openstack? | 21:34 |
| morganfainberg | dolphm, he wrote SQLAlchemy and Alembic? | 21:34 |
| dolphm | morganfainberg: so he's just attending because we're users? | 21:35 |
| dolphm | and probably doing it all wrong | 21:35 |
| morganfainberg | dolphm, he was asked by oslo / dreamhost to come and chat with us | 21:37 |
| morganfainberg | so we can be aligned with where SQLA and Alembic are going | 21:37 |
| *** markstur has quit IRC | 21:37 | |
| morganfainberg | and contribute some of our work up to the upstream lib | 21:37 |
| dolphm | morganfainberg: is there an interrogate-mike session? | 21:37 |
| morganfainberg | dolphm, i think it's on the cross-project one | 21:38 |
| dolphm | morganfainberg: i don't see it | 21:38 |
| morganfainberg | let me see. | 21:39 |
| morganfainberg | dhellmann, ^ any specifics on the session with mike (SQLA/Dogpile/etc | 21:42 |
| dhellmann | morganfainberg, dolphm : http://summit.openstack.org/cfp/details/157 | 21:42 |
| dstanek | if i have a config option that i want to be a positive integer what is the best way to handle that? | 21:43 |
| morganfainberg | dstanek, IntOpt and validate it's positive? | 21:43 |
| bknudson | oslo.config doesn't support a parser for the option? | 21:43 |
| dstanek | i was thinking of subclassing IntOpt | 21:43 |
| morganfainberg | it sounds like a valuable option intOpt could benefit from | 21:44 |
| morganfainberg | e.g. subclass it and submit the same change up to oslo.config? | 21:44 |
| dstanek | bknudson: not that i can see | 21:44 |
| dhellmann | dstanek: there are some not-well-documented validation features -- look at the type argument | 21:44 |
| morganfainberg | dhellmann is here to save the day! | 21:44 |
| *** daneyon has quit IRC | 21:45 | |
| bknudson | make your own Opt and send in a type= | 21:46 |
| dstanek | dhellmann: type argument to Opt? | 21:46 |
| *** daneyon has joined #openstack-keystone | 21:46 | |
| bknudson | dstanek: Looks like you can pass in min= to IntOpt | 21:47 |
| dstanek | bknudson: where to do see that? | 21:47 |
| dstanek | maybe i have an older version installed | 21:47 |
| bknudson | dstanek: oh, no.. | 21:48 |
| bknudson | dstanek: you can create a types.Integer with min= | 21:48 |
| dhellmann | right, that sounds familiar | 21:48 |
| dstanek | bknudson, dhellmann: got it. that's what i can pass to type | 21:50 |
| dstanek | basically cfg.IntOpt(type=types.integer(min=1)) | 21:50 |
| dstanek | bknudson, dhellmann: thanks! | 21:50 |
| *** topol has quit IRC | 21:51 | |
| bknudson | dstanek: that works? don't you get 2 type parameters to the constructor? | 21:51 |
| *** lbragstad has quit IRC | 21:53 | |
| dstanek | bknudson: not exactly, was just summarizing the solution | 21:54 |
| dstanek | bknudson: i have to pass in the name and other options too | 21:55 |
| openstackgerrit | Doug Hellmann proposed a change to openstack/keystone: Register all backend classes as entry points https://review.openstack.org/89419 | 21:59 |
| *** leseb has quit IRC | 22:01 | |
| *** marcoemorais has quit IRC | 22:02 | |
| *** marcoemorais has joined #openstack-keystone | 22:09 | |
| *** leseb has joined #openstack-keystone | 22:16 | |
| *** dstanek is now known as dstanek_zzz | 22:17 | |
| *** joesavak has quit IRC | 22:18 | |
| *** leseb has quit IRC | 22:21 | |
| *** jimbaker has quit IRC | 22:25 | |
| *** bknudson has quit IRC | 22:25 | |
| *** jimbaker has joined #openstack-keystone | 22:26 | |
| *** jimbaker has quit IRC | 22:26 | |
| *** jimbaker has joined #openstack-keystone | 22:26 | |
| gyee | ayoung, can you restore? https://review.openstack.org/#/c/47441 | 22:29 |
| *** andreaf_ has quit IRC | 22:29 | |
| *** bach has quit IRC | 22:29 | |
| *** derek_c has quit IRC | 22:40 | |
| *** derek_c_ has quit IRC | 22:41 | |
| *** nkinder_ has quit IRC | 22:43 | |
| *** stevemar has quit IRC | 22:47 | |
| *** topol has joined #openstack-keystone | 22:48 | |
| *** derek_c_ has joined #openstack-keystone | 22:53 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 22:54 |
| *** derek_c has joined #openstack-keystone | 22:55 | |
| *** gokrokve has quit IRC | 22:56 | |
| *** derek_c has quit IRC | 23:00 | |
| *** derek_c_ has quit IRC | 23:00 | |
| topol | dstanek, dstanek_zzz still around? | 23:06 |
| morganfainberg | topol, my guess is not (zzzz would be the first reason) | 23:06 |
| topol | morganfainberg, probably just as well. https://review.openstack.org/#/c/83834/ is one ugly patch :-). Wanted to poke some fun | 23:07 |
| topol | but I plus oned it | 23:08 |
| morganfainberg | haha | 23:08 |
| morganfainberg | the comment "I'm a bad person" | 23:08 |
| morganfainberg | thats... great | 23:08 |
| *** browne1 has joined #openstack-keystone | 23:10 | |
| *** david-lyle has quit IRC | 23:10 | |
| topol | morganfainberg, I was gonna say something like save the brutal self assesments for launchpad.. But chose not to | 23:11 |
| topol | Staneks patches are a rgeat way to learn about python 3 | 23:11 |
| *** browne1 has quit IRC | 23:11 | |
| *** browne1 has joined #openstack-keystone | 23:11 | |
| morganfainberg | topol, i -1'd based upon that comment alone | 23:11 |
| morganfainberg | topol, now if it was a FIXME .... :P /s | 23:12 |
| topol | I put a comment that said remove before merging | 23:12 |
| topol | yeah, he might as well said, minus 1 my patch please | 23:12 |
| morganfainberg | topol, if it needs to be removed before merging a -1 would be better, +1 would indicate it's good to go as is. (even as core +1 is "i don't mind it merging as is if other cores want to") | 23:13 |
| topol | OK. I will be more strict. | 23:13 |
| *** browne has quit IRC | 23:14 | |
| morganfainberg | topol, keep in mind your opinion is important :) if it legitimately needs some reworking in your mind, please -1 it! :) | 23:14 |
| morganfainberg | even for a silly comment | 23:14 |
| topol | Yep. it was so absurd I figured he knew to remove it but better safe than sorry. I'll go grab the hammer | 23:14 |
| *** gokrokve has joined #openstack-keystone | 23:20 | |
| *** gokrokve_ has joined #openstack-keystone | 23:36 | |
| *** gokrokve has quit IRC | 23:39 | |
| *** topol has quit IRC | 23:47 | |
| *** daneyon has quit IRC | 23:49 | |
| *** bknudson has joined #openstack-keystone | 23:52 | |
| bknudson | morganfainberg: you were +2 on https://review.openstack.org/#/c/79411/ already | 23:53 |
| morganfainberg | oh yeah | 23:53 |
| morganfainberg | bknudson, +2/+A on that easy changes between the patchsets | 23:54 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!