| *** doddstack has quit IRC | 00:00 | |
| *** derek_c has quit IRC | 00:02 | |
| morganfainberg | jamielennox, i'm going to be making a global "turn all mod_wsgi capable services on under httpd" option in devstack | 00:14 |
|---|---|---|
| *** gokrokve has joined #openstack-keystone | 00:14 | |
| jamielennox | morganfainberg: yea, i saw the comment on the review - seems like a good idea | 00:14 |
| morganfainberg | jamielennox, i think i'm going to fix the is_apache_enabled_service method to return true if a certain variable is set | 00:15 |
| morganfainberg | jamielennox, prob. the easiest approach | 00:16 |
| jamielennox | morganfainberg: as opposed to? | 00:16 |
| jamielennox | oh, rather that APACHE_ENABLED_SERVICES=key,... | 00:16 |
| morganfainberg | yep | 00:16 |
| jamielennox | i did it that way because it tied in with the existing approach - i have no attachment | 00:16 |
| morganfainberg | like ENABLE_APACHE_MOD_WSGI_SERVICES | 00:16 |
| morganfainberg | or something | 00:16 |
| jamielennox | morganfainberg: the way i saw that going was | 00:17 |
| jamielennox | if ENABLE_APACHE_MOD_WSGI_SERVICES; then | 00:17 |
| jamielennox | APACHE_ENABLED_SERVICES=key,swift,... | 00:17 |
| jamielennox | fi | 00:17 |
| jamielennox | of += i guess | 00:17 |
| jamielennox | or | 00:17 |
| morganfainberg | nah, | 00:17 |
| jamielennox | why rule out people wanting to deploy keystone that way and not swift? | 00:18 |
| morganfainberg | if ENABLE_APACHE_MOD_WSGI_SERVICES; then true else <current logic> | 00:18 |
| morganfainberg | so you either get all services under mod_wsgi, or you specify the ones you want in APACHE_ENABLED_SERVICES | 00:18 |
| jamielennox | morganfainberg: oh, you'll keep both? | 00:18 |
| morganfainberg | jamielennox, yes | 00:19 |
| jamielennox | oh, i see what you mean | 00:19 |
| *** gokrokve has quit IRC | 00:19 | |
| morganfainberg | jamielennox, i can see a case you don't want swift under apache... or <new cool service> | 00:19 |
| jamielennox | i thought you were just going to replace the whole check with a global true/false | 00:19 |
| morganfainberg | nah. | 00:19 |
| jamielennox | morganfainberg: well either way works | 00:20 |
| morganfainberg | don't want to take granularity out | 00:20 |
| morganfainberg | but, there is no real benefit to doing a complex test matrix (at this point) of apache / non-apache services | 00:20 |
| jamielennox | the downside would be nova could get a is_apache_enabled_service == true - but if they are checking that then they should be using it correctly | 00:20 |
| jamielennox | morganfainberg: no, not for gate - i was thinking people using devstack individually | 00:21 |
| morganfainberg | right. | 00:21 |
| morganfainberg | they should follow the same mechanism as previous (swift keystone) mechanisms | 00:21 |
| morganfainberg | if is_apache_enabled_service <service> | 00:21 |
| morganfainberg | and get a true/false back | 00:21 |
| morganfainberg | not expect... something else | 00:21 |
| jamielennox | ok, that's cool and makes sense | 00:22 |
| jamielennox | i'd love to see it in the gate | 00:22 |
| jamielennox | though i know my keystone SSL stuff in devstack doesn't work with apache | 00:23 |
| morganfainberg | i'm hoping to have this ready for a non-vote check this week | 00:23 |
| morganfainberg | plans to make it gate this cycle | 00:23 |
| jamielennox | morganfainberg: ++ then start converting other services | 00:24 |
| morganfainberg | well more to the point, make it the default deployment for keystone | 00:24 |
| morganfainberg | exactly! | 00:24 |
| jamielennox | though i think we should start by fixing up out own wsgi script | 00:24 |
| jamielennox | symlinking the script and checking the name is a little odd if we want to make this the default | 00:24 |
| morganfainberg | that is part of why we do non-vote check | 00:24 |
| morganfainberg | also want to deploy shared on port 80/443 | 00:24 |
| morganfainberg | so there is more work to be done in devstack as well | 00:24 |
| jamielennox | morganfainberg: i'll be honest i don't care about 80/443 at all | 00:24 |
| morganfainberg | we do because of ephemeral port issues | 00:25 |
| stevemar | bknudson, thanks for the review again | 00:25 |
| morganfainberg | 5000 isn't our port, and 35357 is .. a conflict between linux and IANA | 00:25 |
| morganfainberg | so, eliminate the issue. | 00:25 |
| jamielennox | morganfainberg: i think we ditch the IANA port | 00:33 |
| jamielennox | nobody knows what it is anyway because it's supposed to be private and returned by the service catalog | 00:34 |
| jamielennox | anyone using 35357 directly is trying to do weird things with auth and should stop | 00:34 |
| jamielennox | i don't think we eliminate the issue at all by moving to 443 | 00:34 |
| morganfainberg | jamielennox, i agree, but we have work to do to get there | 00:35 |
| *** browne has quit IRC | 00:35 | |
| jamielennox | morganfainberg: absolutely - my point was i don't think moving to 443 is solving that issue at all | 00:35 |
| morganfainberg | jamielennox, well.. it's not that someone is using 35357 directly | 00:36 |
| jamielennox | and there is ~zero other benefit i see | 00:36 |
| morganfainberg | jamielennox, it's that some other service could be using it and prevents keystone from starting | 00:36 |
| morganfainberg | something = anything using an ephemeral port under the default config of linux | 00:37 |
| morganfainberg | jamielennox, so it does solve the problem, it means using mod_wsgi and HTTP's port(s) we avoid keystone not starting because something claimed our port | 00:37 |
| morganfainberg | jamielennox, nothing (but httpd/web servers) should be on 80 or 443 | 00:38 |
| jamielennox | morganfainberg: but again that's a 35357 issue - yes we should absolutey ditch that port, but people know and use :5000 and i don't mind keeping that one | 00:39 |
| morganfainberg | jamielennox, we don't own that port. | 00:39 |
| morganfainberg | jamielennox, there is a legitimate service that owns it | 00:39 |
| jamielennox | morganfainberg: and? | 00:40 |
| morganfainberg | whatever "commplex-main 5000 tcp" is | 00:40 |
| jamielennox | if they are running it on the same box as keystone that's an obvious issue | 00:40 |
| jamielennox | but i think "don't do that" is good advice for that situation | 00:40 |
| jamielennox | wireshark is the only thing i can think of that may get confused | 00:41 |
| morganfainberg | jamielennox, i think we just have a difference of opinion here. | 00:41 |
| morganfainberg | jamielennox, i disagree with co-opting a port for arguably the one service in OpenStack that needs a well defined port (the rest can come from the catalog) | 00:42 |
| jamielennox | morganfainberg: fair | 00:42 |
| jamielennox | morganfainberg: i think running things on /identity is a hack | 00:42 |
| jamielennox | if you are going to run on 443 you should own the service | 00:43 |
| morganfainberg | jamielennox, i would prefer to run /identity /compute /storage | 00:43 |
| morganfainberg | etc | 00:43 |
| morganfainberg | or openstack/identity openstack/compute etc | 00:43 |
| jamielennox | OS_AUTH_URL=https://keystone.company.com | 00:43 |
| jamielennox | love it https=no need for port numbers | 00:43 |
| ayoung | stevemar, looks like the separator character is configuratble in mod_lookup_identity, so I'm good. | 00:43 |
| morganfainberg | jamielennox, doesn't mean i wouldn't run under httpd. | 00:44 |
| stevemar | ayoung, awesome, i was hoping thats the case! | 00:44 |
| jamielennox | morganfainberg: right you can do vhosts etc - though i did start having trouble last time i tried that | 00:44 |
| morganfainberg | jamielennox, (actually i want to allow for a DNS serve record lookup) | 00:44 |
| ayoung | stevemar, so what mapping do I use to say "just accept this as a list of groups?" | 00:44 |
| jamielennox | apache doesn't share python interpretters as well as you'd tink | 00:44 |
| morganfainberg | jamielennox, vhosts aren't an issue, sharing a default (ip) vhost is. | 00:44 |
| ayoung | stevemar, I assume I need to have the groups in the local IdP as well? | 00:44 |
| morganfainberg | jamielennox, mod_wsgi is good about not colliding them if the vhosts are really separate | 00:45 |
| ayoung | er...identity backend | 00:45 |
| jamielennox | morganfainberg: DNS is a nice idea, but all it gives you is an IP | 00:45 |
| morganfainberg | jamielennox, and port. | 00:45 |
| morganfainberg | jamielennox, serve (txt) record | 00:45 |
| stevemar | ayoung, yes, the local groups must already exist in the identity backend | 00:45 |
| jamielennox | morganfainberg: dns will give you a port? | 00:45 |
| morganfainberg | sorry SRV record | 00:45 |
| ayoung | stevemar, I can work with that...what's the magic for the rule? | 00:45 |
| morganfainberg | jamielennox, http://en.wikipedia.org/wiki/SRV_record | 00:45 |
| stevemar | and you have to create a basic mapping rule, let me send you an example | 00:46 |
| jamielennox | morganfainberg: huh - i stand corrected | 00:46 |
| jamielennox | can you make it indicate http/s | 00:46 |
| jamielennox | only 80 vs 443 i guess | 00:46 |
| morganfainberg | jamielennox, _identity._https.<company>.com ? | 00:47 |
| morganfainberg | encode the information in the name. | 00:47 |
| jamielennox | morganfainberg: right but that's another lookup right? | 00:47 |
| jamielennox | as in you query for _http and then for _https if not found | 00:47 |
| jamielennox | (reverse the order) | 00:47 |
| morganfainberg | jamielennox, well, perhaps you could do something about it | 00:48 |
| morganfainberg | *shrug* | 00:48 |
| morganfainberg | jamielennox, or use TLS instead of SSL, so you can negotiate | 00:48 |
| jamielennox | because we still have the problem there with determining a path from that root | 00:48 |
| morganfainberg | jamielennox, not sure how well apache supports that | 00:48 |
| morganfainberg | jamielennox, but interesting idea | 00:48 |
| morganfainberg | jamielennox, well in the case of the SRV record you'd assume you own the whole VHOST | 00:49 |
| morganfainberg | jamielennox, well whole port | 00:49 |
| jamielennox | morganfainberg: can we dump it all in JSON in a TXT record? | 00:49 |
| morganfainberg | jamielennox, sure. that could be also possible | 00:49 |
| morganfainberg | jamielennox, but SRV is probably a better definition format | 00:50 |
| jamielennox | morganfainberg: always - but if you want to include /identity then you need to convey that somehow | 00:50 |
| morganfainberg | jamielennox, sure. things to think about as we support better options | 00:51 |
| stevemar | ayoung, steps are here: https://gist.github.com/stevemart/c67b7bb238ff5ef6ab6a and mapping object is here: https://gist.github.com/stevemart/4cf26cfe4f85aa76fc54 | 00:53 |
| *** derek_c has joined #openstack-keystone | 00:53 | |
| stevemar | ayoung, the steps has the mapping object in the curl, but i made it easier to see in the second link | 00:53 |
| ayoung | stevemar, {"user":{"name":"{0}"}}],"remote":[{"type":"sub"}]} how does that munge the data that comes in? | 00:53 |
| ayoung | stevemar, I want a rule that says: any group (g) a user has in REMOTE_GROUPS gives the use membership in group(g) local | 00:55 |
| stevemar | ayoung, the user part of the rule is different from the group part. the user part is required, and could be something like 'ADFS_EMAIL' in this example: https://gist.github.com/zaccone/914822d37ac2eea420ce | 00:56 |
| ayoung | stevemar, I need username to be REMOTE_USER | 00:57 |
| ayoung | It doesn't need to be anything more complex than that | 00:57 |
| stevemar | ayoung, i think you still need to enumerate the different groups | 00:58 |
| ayoung | explicitly? | 00:58 |
| ayoung | in the map[ping, or just in the backend? | 00:59 |
| stevemar | in the rule, because a specific group (on the idp) has to map to a specific keystone group id | 00:59 |
| ayoung | stevemar, no wildcards? I'm sure that we had match_any semantics | 01:01 |
| ayoung | stevemar, what about type? | 01:02 |
| ayoung | local { | 01:03 |
| ayoung | "group": { | 01:03 |
| ayoung | "name": "{0}" | 01:03 |
| ayoung | } | 01:03 |
| ayoung | } | 01:03 |
| ayoung | stevemar, http://fpaste.org/97656/39873359/ no? | 01:07 |
| *** marcoemorais has quit IRC | 01:07 | |
| stevemar | ayoung, let me check the code for a sec | 01:08 |
| *** diegows has quit IRC | 01:11 | |
| stevemar | ayoung, no luck, you have to specify the group id in the local section. it was designed that way, because the thought was that the idp's group/role name would be very different from keystones group id | 01:12 |
| ayoung | stevemar, OK...we fix that as a feature request for Juno | 01:13 |
| stevemar | ayoung, if i had groups g1, g2, ... coming from an idp, and just used a wild card, it wouldn't know what to actually map to? i guess you were hoping to use names | 01:13 |
| *** gyee has quit IRC | 01:13 | |
| ayoung | stevemar, I'm doing default domain, but there would have to be some mapping of domain for it to be useful | 01:13 |
| stevemar | but group names are not unique, yeah, what i was going to get at | 01:14 |
| *** gokrokve has joined #openstack-keystone | 01:14 | |
| ayoung | stevemar, I think the norm would be that group_id==group_name@@domainid just like we were saying for user_id. Perhaps someway of distinguishing users from groups would head off some confusion, too | 01:14 |
| stevemar | ayoung, i managed to make a PoC for openID connect and actually communicated with our internal ibm idp, it worked awesomely :) | 01:15 |
| stevemar | ayoung, that could work | 01:15 |
| *** gokrokve_ has joined #openstack-keystone | 01:17 | |
| *** gokrokve has quit IRC | 01:18 | |
| *** gokrokve_ has quit IRC | 01:20 | |
| *** gokrokve has joined #openstack-keystone | 01:26 | |
| ayoung | stevemar, so would I add "any_of" ? | 01:28 |
| ayoung | "any_one_of": [ | 01:28 |
| *** gokrokve has quit IRC | 01:30 | |
| *** gokrokve has joined #openstack-keystone | 01:35 | |
| *** gokrokve has quit IRC | 01:38 | |
| *** lbragstad has quit IRC | 01:38 | |
| stevemar | ayoung, yes, "any_one_of": ['some group name'] | 01:40 |
| *** lbragstad has joined #openstack-keystone | 01:41 | |
| *** gyee has joined #openstack-keystone | 01:42 | |
| *** bach has joined #openstack-keystone | 01:42 | |
| *** lbragstad has quit IRC | 01:50 | |
| *** zhiyan_ is now known as zhiyan | 01:52 | |
| *** bach has quit IRC | 01:57 | |
| ayoung | stevemar, "keystoneclient.openstack.common.apiclient.exceptions.Forbidden: Could not change immutable attribute(s) 'mapping' in target FederationProtocol (HTTP 403)" | 02:07 |
| ayoung | that is what I get when I do | 02:07 |
| ayoung | keystone_client.federation.mappings.create(mapping_id='map_id',rules=rules) | 02:08 |
| ayoung | keystone_client.federation.identity_providers.create(id='sssd') | 02:08 |
| ayoung | keystone_client.federation.protocols.create(identity_provider_id='sssd', protocol_id='kerberos', mapping='map_id') | 02:08 |
| *** shakamunyi has quit IRC | 02:11 | |
| *** sbfox has joined #openstack-keystone | 02:16 | |
| *** ayoung has quit IRC | 02:17 | |
| *** mberlin1 has joined #openstack-keystone | 02:21 | |
| *** mberlin has quit IRC | 02:22 | |
| *** stevemar has quit IRC | 02:29 | |
| *** nkinder has joined #openstack-keystone | 02:42 | |
| *** bach has joined #openstack-keystone | 02:45 | |
| *** sbfox has quit IRC | 02:48 | |
| *** bknudson has quit IRC | 02:54 | |
| *** daneyon_ has joined #openstack-keystone | 02:58 | |
| derek_c | what's a "group" in keystone? how is that different from a "project"? | 02:59 |
| *** daneyon has quit IRC | 03:00 | |
| *** bach has quit IRC | 03:09 | |
| derek_c | within the sql auth backend, is there a way to get a list of projects that a given user is associated with? | 03:15 |
| *** bach has joined #openstack-keystone | 03:15 | |
| *** bach has quit IRC | 03:17 | |
| *** lbragstad has joined #openstack-keystone | 03:20 | |
| *** daneyon_ has quit IRC | 03:26 | |
| *** daneyon has joined #openstack-keystone | 03:27 | |
| *** mfisch has quit IRC | 03:27 | |
| *** gokrokve has joined #openstack-keystone | 03:27 | |
| *** derek_c has quit IRC | 03:32 | |
| *** richm has quit IRC | 03:38 | |
| *** dstanek is now known as dstanek_zzz | 03:44 | |
| *** sbfox has joined #openstack-keystone | 03:45 | |
| *** mfisch has joined #openstack-keystone | 03:46 | |
| *** mfisch has joined #openstack-keystone | 03:47 | |
| *** cp16net has joined #openstack-keystone | 03:47 | |
| cp16net | ping anyone around? | 03:48 |
| cp16net | looks like the uuid provider is not working now... its requiring /etc/keystone/ssl/certs/signing_cert.pem and this doesnt exist when setting the KEYSTONE_TOKEN_FORMAT=UUID | 03:49 |
| cp16net | https://gist.github.com/cp16net/11389597 | 03:49 |
| *** praneshp has quit IRC | 03:55 | |
| *** gyee has quit IRC | 04:04 | |
| *** marcoemorais has joined #openstack-keystone | 04:04 | |
| *** chandan_kumar has joined #openstack-keystone | 04:05 | |
| *** dstanek_zzz is now known as dstanek | 04:05 | |
| *** marcoemorais has quit IRC | 04:08 | |
| *** dstanek is now known as dstanek_zzz | 04:15 | |
| *** morganfainberg is now known as morganfainberg_Z | 04:20 | |
| *** cynosure_ has joined #openstack-keystone | 04:21 | |
| *** praneshp has joined #openstack-keystone | 04:21 | |
| *** cynosure_ has quit IRC | 04:22 | |
| *** gokrokve has quit IRC | 04:22 | |
| *** praneshp_ has joined #openstack-keystone | 04:22 | |
| jamielennox | cp16net: that looks like a bug, can you file it please? | 04:23 |
| *** marcoemorais1 has joined #openstack-keystone | 04:24 | |
| *** praneshp has quit IRC | 04:26 | |
| *** praneshp_ is now known as praneshp | 04:26 | |
| *** dstanek_zzz is now known as dstanek | 04:28 | |
| *** marcoemorais1 has quit IRC | 04:29 | |
| *** marcoemorais has joined #openstack-keystone | 04:30 | |
| *** sbfox has quit IRC | 04:36 | |
| *** sbfox has joined #openstack-keystone | 04:38 | |
| *** dstanek is now known as dstanek_zzz | 04:48 | |
| *** harlowja is now known as harlowja_away | 04:56 | |
| *** gokrokve has joined #openstack-keystone | 05:14 | |
| *** daneyon has quit IRC | 05:24 | |
| *** dstanek_zzz is now known as dstanek | 05:40 | |
| *** gokrokve_ has joined #openstack-keystone | 05:48 | |
| *** dstanek is now known as dstanek_zzz | 05:49 | |
| *** gokrokve has quit IRC | 05:52 | |
| *** gokrokve_ has quit IRC | 05:57 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/90288 | 06:01 |
| *** chandan_kumar has quit IRC | 06:01 | |
| *** sbfox has quit IRC | 06:05 | |
| *** praneshp has quit IRC | 06:12 | |
| *** chandan_kumar has joined #openstack-keystone | 06:16 | |
| *** jamielennox is now known as jamielennox|away | 06:18 | |
| *** chandan_kumar has quit IRC | 06:22 | |
| *** gokrokve has joined #openstack-keystone | 06:27 | |
| *** gokrokve_ has joined #openstack-keystone | 06:29 | |
| *** bvandenh has joined #openstack-keystone | 06:31 | |
| *** bvandenh has quit IRC | 06:31 | |
| *** gokrokve has quit IRC | 06:32 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/identity-api: Remove email as optional query parameter https://review.openstack.org/90656 | 06:32 |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/identity-api: Fix typo in federation api https://review.openstack.org/90659 | 06:32 |
| *** jaosorior has joined #openstack-keystone | 06:33 | |
| *** gokrokve_ has quit IRC | 06:34 | |
| *** chandan_kumar has joined #openstack-keystone | 06:40 | |
| *** dstanek_zzz is now known as dstanek | 06:40 | |
| *** dstanek is now known as dstanek_zzz | 06:50 | |
| *** gokrokve has joined #openstack-keystone | 06:57 | |
| *** dstanek_zzz is now known as dstanek | 07:05 | |
| *** marekd|afk is now known as marekd | 07:13 | |
| *** dstanek is now known as dstanek_zzz | 07:15 | |
| openstackgerrit | Victor Sergeyev proposed a change to openstack/keystone: oslo.db implementation https://review.openstack.org/77210 | 07:25 |
| *** dstanek_zzz is now known as dstanek | 08:06 | |
| *** dstanek is now known as dstanek_zzz | 08:16 | |
| *** amcrn has quit IRC | 08:18 | |
| *** leseb has joined #openstack-keystone | 08:18 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Refactor create_trust for readability https://review.openstack.org/90943 | 08:19 |
| *** leseb has quit IRC | 08:35 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Sync test_migrations https://review.openstack.org/80618 | 08:37 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Redundant unique constraint https://review.openstack.org/84447 | 08:37 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Corresponding `nullable` value. https://review.openstack.org/84446 | 08:37 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Migration DB_INIT_VERSION in common place https://review.openstack.org/88016 | 08:37 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 08:37 |
| *** leseb has joined #openstack-keystone | 08:38 | |
| *** leseb has quit IRC | 08:42 | |
| *** leseb has joined #openstack-keystone | 08:43 | |
| *** dstanek_zzz is now known as dstanek | 09:07 | |
| *** chandan_kumar has quit IRC | 09:14 | |
| *** chandan_kumar has joined #openstack-keystone | 09:15 | |
| *** dstanek is now known as dstanek_zzz | 09:17 | |
| *** marcoemorais has quit IRC | 09:49 | |
| openstackgerrit | Matthieu Huin proposed a change to openstack/keystone: More random values for oAuth1 verifier https://review.openstack.org/89612 | 10:00 |
| *** andreaf has joined #openstack-keystone | 10:06 | |
| *** dstanek_zzz is now known as dstanek | 10:08 | |
| *** dstanek is now known as dstanek_zzz | 10:18 | |
| *** leseb has quit IRC | 10:29 | |
| *** dstanek_zzz is now known as dstanek | 11:09 | |
| *** dstanek is now known as dstanek_zzz | 11:18 | |
| *** leseb has joined #openstack-keystone | 11:20 | |
| *** dstanek_zzz is now known as dstanek | 11:54 | |
| *** erecio has joined #openstack-keystone | 12:09 | |
| *** zhiyan is now known as zhiyan_ | 12:23 | |
| *** dims has quit IRC | 12:33 | |
| dstanek | dolphm: you around? | 12:38 |
| dolphm | dstanek: yep! | 12:38 |
| dstanek | i was looking at https://review.openstack.org/#/c/89612; what is the concern about UI issues? | 12:39 |
| dolphm | dstanek: UX* | 12:44 |
| dstanek | dolphm: ah, ha - totally misread that | 12:44 |
| dolphm | dstanek: L41 looks like it addresses my concern https://review.openstack.org/#/c/89612/5/keystone/contrib/oauth1/core.py | 12:45 |
| *** sphoorti has joined #openstack-keystone | 12:45 | |
| dstanek | dolphm: i think i only have one more issue with that review, but i'm going over it again | 12:46 |
| dolphm | dstanek: on that line, or something else? | 12:46 |
| dstanek | ''.translate only takes a single arg (the table) in py3 | 12:46 |
| dolphm | dstanek: i was about to say that translate() was new to me - i was about to look it up ... | 12:47 |
| dolphm | dstanek: i don't even see translate in the string module? | 12:48 |
| *** dims has joined #openstack-keystone | 12:48 | |
| dstanek | dolphm: it's a string method | 12:48 |
| dolphm | dstanek: oh the docs i was looking at were deprecated anyway! | 12:48 |
| dstanek | i've provided an alternate solution | 12:48 |
| dolphm | dstanek: post it! http://2.bp.blogspot.com/--zPE6kh7LM8/UART_ugKLSI/AAAAAAAACyI/0qwnJ7sMQWY/s1600/sonic-the-hedgehog.gif | 12:53 |
| dstanek | the biggest issue is i don't have a way that works in both - trying to get of the version check | 12:57 |
| dstanek | at least with string translation tables - my new way is much more basic | 12:58 |
| dolphm | dstanek: iterative string replace or something? | 13:05 |
| *** leseb has quit IRC | 13:06 | |
| *** leseb has joined #openstack-keystone | 13:06 | |
| *** leseb has quit IRC | 13:07 | |
| *** leseb has joined #openstack-keystone | 13:07 | |
| dolphm | dstanek: http://pasteraw.com/8hxweehdyciobpf3l7m4982evta94vg | 13:08 |
| dolphm | the second is py34 | 13:09 |
| dstanek | dolphm: i just did a simple containment test since it's very easy to read and performance really doesn't matter here | 13:12 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Sync test_migrations https://review.openstack.org/80618 | 13:15 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Redundant unique constraint https://review.openstack.org/84447 | 13:15 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Correct `nullable` values in models and migrations https://review.openstack.org/84446 | 13:15 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Migration DB_INIT_VERSION in common place https://review.openstack.org/88016 | 13:15 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 13:15 |
| *** joesavak has joined #openstack-keystone | 13:17 | |
| *** bknudson has joined #openstack-keystone | 13:24 | |
| *** sphoorti has quit IRC | 13:39 | |
| *** nkinder has quit IRC | 13:40 | |
| dolphm | morganfainberg_Z: think we can land https://blueprints.launchpad.net/keystone/+spec/ephemeral-pki-tokens in j1? | 13:40 |
| *** richm has joined #openstack-keystone | 13:43 | |
| dolphm | dstanek: checkout the bottom two http://pasteraw.com/jg0r4bs1d8n7gnvxmn6cprwaix6au3m | 13:55 |
| dstanek | dolphm: you may have to adjust for py2.6 - i don't think it has dict comprehensions | 13:57 |
| dolphm | dstanek: dammit. | 13:58 |
| dolphm | dstanek: or do you just have to use dict() instead? | 13:59 |
| dstanek | dolphm: yeah, something like dict.fromkeys((ord(i) for i in '...'), None) | 14:01 |
| dstanek | i'm pretty sure fromkeys is in 2.6 | 14:01 |
| dstanek | or the standard dict((ord(i), None) for i in '...') | 14:01 |
| *** stevemar has joined #openstack-keystone | 14:08 | |
| *** topol has joined #openstack-keystone | 14:17 | |
| stevemar | marekd, thanks for the email :) | 14:17 |
| marekd | stevemar: no problem, i think it should solve ayoung's issue :-) | 14:18 |
| marekd | stevemar: btw it's funny he didn't put any body here and neither client nor server complained.... | 14:20 |
| marekd | stevemar: https://github.com/admiyo/python-keystoneclient/commit/ed635f3dbfc81f1c86cc7dc9a688fc62a4d61583#diff-5f96027df52cfcac40372e71f5df9ea3R58 | 14:20 |
| *** david-lyle_ has joined #openstack-keystone | 14:22 | |
| stevemar | marekd, that is funny | 14:22 |
| *** zhiyan_ is now known as zhiyan | 14:23 | |
| marekd | stevemar: not funny at all.... | 14:23 |
| marekd | stevemar: well ok, to be honest I didn't run the code, i don't even know if Adam did it. | 14:23 |
| stevemar | marekd, there are inconsistencies between including xyz_id and not including it | 14:24 |
| marekd | stevemar: you mean? | 14:25 |
| *** david-lyle_ is now known as david-lyle | 14:25 | |
| *** thedodd has joined #openstack-keystone | 14:29 | |
| *** diegows has joined #openstack-keystone | 14:31 | |
| dolphm | this is holding up a few approved patches: https://review.openstack.org/#/c/84446/ | 14:33 |
| cp16net | jamielennox|away: https://bugs.launchpad.net/keystone/+bug/1314010 | 14:33 |
| uvirtbot | Launchpad bug 1314010 in keystone "uuid support should not require ssl cert (dup-of: 1312858)" [Undecided,New] | 14:33 |
| uvirtbot | Launchpad bug 1312858 in python-keystoneclient "Keystone + Devstack fail when KEYSTONE_TOKEN_FORMAT=UUID" [High,In progress] | 14:33 |
| openstackgerrit | Ihar Hrachyshka proposed a change to openstack/keystone: Synced jsonutils from oslo-incubator https://review.openstack.org/91054 | 14:36 |
| *** sbfox has joined #openstack-keystone | 14:37 | |
| *** nkinder has joined #openstack-keystone | 14:39 | |
| *** andreaf has quit IRC | 14:41 | |
| dstanek | stevemar, marekd: thoughts on https://review.openstack.org/#/c/84446 ? also why is mapping_id not a foreign key? | 14:45 |
| marekd | dstanek: let me see | 14:46 |
| stevemar | dstanek, no good reason, it is for idp, but not mapping https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/backends/sql.py | 14:48 |
| marekd | dstanek: https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/backends/sql.py#L29 | 14:49 |
| marekd | dstanek: looks like inconsistency between sqlalchemy model and migration scripts...? | 14:49 |
| *** YorikSar has left #openstack-keystone | 14:50 | |
| stevemar | marekd, it's not inconsistent though, it's not in the model either | 14:50 |
| dstanek | marekd: yes, the fix is for nullability, but i'm wondering if it needs to be a foreign key - although a migration for that may be hard if the column does have null values | 14:50 |
| marekd | stevemar: hold on, we are talking about https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/backends/sql.py#L29 'not being null'...right? | 14:51 |
| dstanek | stevemar: the model says the column is not nullable and i think the migration makes it nullable | 14:51 |
| marekd | dstanek: ++ | 14:51 |
| stevemar | marekd, the fix here https://review.openstack.org/#/c/84446/24 is for nullable values, that are inconsistnet | 14:51 |
| dstanek | just thought you guys may weigh in on that review | 14:52 |
| stevemar | but dstanek is asking why no FK, which we should use | 14:52 |
| *** topol has quit IRC | 14:53 | |
| marekd | stevemar: ok, appartenly thinking about the same, talking about something else i got puzzled after yours 'it's not in the model either | 14:53 |
| marekd | ' | 14:53 |
| marekd | let me look for older patches | 14:53 |
| marekd | concerning mapping_id FKness | 14:54 |
| stevemar | dstanek, re: nullable mapping_id, you are concerned that the patch is assuming the model as the correct version? when really the model could be wrong? | 14:55 |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Check that the user is dumb moved to the common method https://review.openstack.org/88517 | 15:02 |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Check that the user is dumb moved to the common method https://review.openstack.org/88517 | 15:04 |
| dstanek | stevemar: that is one concern yes | 15:06 |
| dstanek | stevemar: i have a question about https://review.openstack.org/#/c/81980 when you have a sec | 15:10 |
| *** Manishanker_ has joined #openstack-keystone | 15:10 | |
| stevemar | dstanek, whats the q | 15:13 |
| dstanek | stevemar: what is the expected behavior is someone uses client.oauth1 without the oauthlib library installed? | 15:14 |
| dstanek | an AttributeError from inside oauth1? | 15:14 |
| *** daneyon has joined #openstack-keystone | 15:15 | |
| stevemar | dstanek, that's what i'm trying to nail down | 15:18 |
| *** gokrokve_ has joined #openstack-keystone | 15:18 | |
| stevemar | we don't seem to have an expected behaviour for this sort of situation? | 15:19 |
| dstanek | stevemar: what would actually be using client.oauth1? | 15:20 |
| *** shakamunyi has joined #openstack-keystone | 15:21 | |
| stevemar | openstackclient would call it, for starters | 15:22 |
| *** gokrokve has quit IRC | 15:22 | |
| stevemar | dstanek, ^ and if there are any python scripts | 15:22 |
| stevemar | (not sure i understand the question) | 15:22 |
| dstanek | stevemar: that's what i thought | 15:23 |
| dstanek | i have a comment on the view and i wanted to make sure i'm not way off base | 15:24 |
| dstanek | stevemar: published my thoughs | 15:29 |
| *** zhiyan is now known as zhiyan_ | 15:31 | |
| marekd | dstanek: stevemar: back in here. i think we didn't conclude with the mapping_id FKness - are you okay with changing that? I think dstanek is as he raised the question. | 15:32 |
| stevemar | marekd, i'm okay with it, it should be a FK, should be a new patch set | 15:35 |
| openstackgerrit | Ihar Hrachyshka proposed a change to openstack/python-keystoneclient: Synced jsonutils from oslo-incubator https://review.openstack.org/91080 | 15:36 |
| stevemar | dstanek, also, thanks for answering that question about why json was required | 15:36 |
| marekd | dstanek: stevemar: if so, do you think the patch should make q | 15:39 |
| marekd | this https://review.openstack.org/#/c/84446/24 a dependency somewhat? | 15:39 |
| marekd | well, not dependency but there will be somehow a conflict... | 15:40 |
| stevemar | marekd, the making mapping_id a FK should go in last, i think that series of patches will be merged soon | 15:40 |
| marekd | stevemar: ok | 15:40 |
| *** zhiyan_ is now known as zhiyan | 15:42 | |
| openstackgerrit | A change was merged to openstack/keystone: Refactor notifications https://review.openstack.org/81660 | 15:50 |
| dstanek | stevemar: no problem | 15:50 |
| *** topol_ has joined #openstack-keystone | 15:55 | |
| *** leseb has quit IRC | 15:55 | |
| *** andreaf has joined #openstack-keystone | 15:55 | |
| *** Manishanker_ has left #openstack-keystone | 15:56 | |
| *** leseb has joined #openstack-keystone | 15:58 | |
| *** topol_ is now known as topol | 15:59 | |
| openstackgerrit | A change was merged to openstack/keystone: Some methods in ldap were moved to superclass https://review.openstack.org/86250 | 16:02 |
| *** gokrokve_ has quit IRC | 16:02 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Check that the user is dumb moved to the common method https://review.openstack.org/88517 | 16:04 |
| dolphm | love the subject ^ | 16:05 |
| marekd | stevemar: dstanek: a question. in the sql files in contrib/federation/migrate_repo/versions there are now two files -> 001_*.py with identity_provider and federation_protocol CREATE script, and 002_*.py with mapings. Now, to make federation_protocol.mapping_id a FK I have two options: merge all the tables into one migration file, so move 002_ content to 001 or add 003 script that alter the table. Now, can we go option 1? :-) | 16:06 |
| marekd | dolphm: ++ | 16:06 |
| * dolphm the user isn't normally an idiot, the user is just drunk! | 16:06 | |
| openstackgerrit | A change was merged to openstack/keystone: Use oslo.test mockpatch https://review.openstack.org/83968 | 16:08 |
| *** zhiyan is now known as zhiyan_ | 16:11 | |
| *** ayoung has joined #openstack-keystone | 16:15 | |
| *** sbfox has quit IRC | 16:16 | |
| *** browne has joined #openstack-keystone | 16:18 | |
| *** sbfox has joined #openstack-keystone | 16:18 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Escape values in LDAP search filters https://review.openstack.org/87142 | 16:18 |
| *** chandan_kumar has quit IRC | 16:19 | |
| *** jaosorior has quit IRC | 16:21 | |
| *** marcoemorais has joined #openstack-keystone | 16:31 | |
| *** leseb has quit IRC | 16:35 | |
| *** Chicago has quit IRC | 16:43 | |
| openstackgerrit | A change was merged to openstack/keystone: Ignore broken endpoints in get_v3_catalog https://review.openstack.org/81527 | 16:46 |
| rodrigods | is there anyone available to review this blueprint: https://blueprints.launchpad.net/python-keystoneclient/+spec/roles-assignment-support? | 16:47 |
| *** vhoward has left #openstack-keystone | 16:48 | |
| *** ericn has joined #openstack-keystone | 16:58 | |
| *** harlowja_away is now known as harlowja | 16:59 | |
| openstackgerrit | Brian Lamar proposed a change to openstack/python-keystoneclient: Allow token revocation list to be unimplemented https://review.openstack.org/91100 | 17:01 |
| *** amcrn has joined #openstack-keystone | 17:02 | |
| stevemar | rodrigods, the commandline portion should be done in https://blueprints.launchpad.net/python-openstackclient | 17:07 |
| dstanek | dolphm, morganfainberg_Z: any thoughts on ayoung's comments here: https://review.openstack.org/#/c/73368/ ? i don't mind moving the model defs, but it's different from what was discussed in SAT so i want a concensus before stuff starts moving back and forth | 17:07 |
| rodrigods | stevemar, thanks, will update the description and assign OSC as well | 17:08 |
| stevemar | dolphm, there is nothing on the meeting agenda for today :\ | 17:09 |
| dolphm | stevemar: fixed | 17:10 |
| dolphm | dstanek: thinking | 17:10 |
| *** topol has quit IRC | 17:11 | |
| *** praneshp has joined #openstack-keystone | 17:17 | |
| *** morganfainberg_Z is now known as morganfainberg | 17:18 | |
| morganfainberg | dolphm, wow thats'a great subject! | 17:18 |
| *** chandan_kumar has joined #openstack-keystone | 17:20 | |
| *** gyee has joined #openstack-keystone | 17:23 | |
| *** ericn has quit IRC | 17:24 | |
| morganfainberg | also good morning or afternoon (depending on where you are) | 17:25 |
| dolphm | dstanek: i hate the idea of "optional dependencies" -- doubly so for extensions. if we want to use internal callbacks, that's fine, but we need to be super careful about plaintext passwords being passed into a notification framework! | 17:26 |
| morganfainberg | dstanek, looking at ayoung's comment | 17:26 |
| dolphm | dstanek: regarding where the model lives, i don't really care that much, but it seems like a natural evolution for the base identity implementation (to support deployer-configurable features like repeating old passwords, etc) | 17:26 |
| morganfainberg | honestly, i'd make this a core feature of SQL vs an extension | 17:27 |
| dolphm | dstanek: i suppose this is another argument against making it an API extension in the first place, but IIRC i lost that argument | 17:27 |
| morganfainberg | this is part of keeping SQL a "real" IDP (see summit session) | 17:27 |
| dolphm | morganfainberg: ++ | 17:28 |
| morganfainberg | dolphm, can we defer until post summit session? if we're keeping SQL as a first class IDP we make it core part of SQL | 17:28 |
| morganfainberg | dstanek, ^ (what i just ask'd dolph) | 17:28 |
| dolphm | dstanek: if you called the table just 'password' it would avoid any unnecessary connotation with the extension | 17:29 |
| dolphm | morganfainberg: yes | 17:29 |
| morganfainberg | dolphm, because i want SQL as a first class IDP still, and I think this needs to not be an extension | 17:29 |
| dolphm | dstanek: morganfainberg: let's be ready to +A or abandon in the session though :) | 17:29 |
| morganfainberg | dolphm, ++ | 17:29 |
| morganfainberg | dolphm, dstanek, it may make more sense to call the table user_password, and we move all password lookups for SQL to it (migrate them out of the user data) | 17:30 |
| dstanek | dolphm, morganfainberg: so make is part of the SQL backend instead of an extension? | 17:30 |
| morganfainberg | dolphm, dstanek, that would be my preference - though we might lose that argument :( | 17:31 |
| dstanek | who would argue that? if you don't want to use it then don't | 17:31 |
| morganfainberg | dstanek, there tends to be the sentiment that everything should be an extension | 17:32 |
| morganfainberg | dstanek, i don't think we will lose this argument though | 17:32 |
| dolphm | we introduced an API attribute for this, right? | 17:32 |
| morganfainberg | dstanek, but it might happen | 17:32 |
| ayoung | dstanek, if the rotation is going into core, the SQL goes into core. If the rotation is in an extension, the SQL is in an extension | 17:32 |
| *** openstackgerrit has quit IRC | 17:32 | |
| morganfainberg | ayoung, ok that works for me. | 17:32 |
| ayoung | But...extension can be "supported buy default or not" | 17:33 |
| *** openstackgerrit has joined #openstack-keystone | 17:33 | |
| dolphm | ayoung: i was originally arguing for this to be core api, which is i think how we got ehre | 17:33 |
| ayoung | morganfainberg, so I think "extension first" | 17:33 |
| morganfainberg | ayoung, i don't think this belongs as an extension at all. | 17:33 |
| ayoung | dolphm, I'd rather make most of the identity stuff and extension | 17:33 |
| ayoung | user managemend does not belong in core; | 17:33 |
| dolphm | https://gist.github.com/dolph/7665011 | 17:33 |
| morganfainberg | ayoung, that is a different argument. | 17:33 |
| ayoung | understood | 17:33 |
| dolphm | specifically https://gist.github.com/dolph/7665011#user-self-service-password-rotation | 17:33 |
| dstanek | dolphm: this adds new resource URLs to manage the rotated passwords | 17:34 |
| morganfainberg | ayoung, and i'm not opposed to that. | 17:34 |
| ayoung | morganfainberg, but I thik rotation is a good starting point for splitting user out into an extension, and thne being able to run Keystone/IdP on a separate machine from Keystone/Assignement | 17:34 |
| ayoung | But...all I insist on is that we don't split the SQL from the implementation | 17:35 |
| ayoung | the rest I will state my preference and then let it roll | 17:35 |
| morganfainberg | ayoung, i'd rather keep identity management stuff (user, password, etc) more centralized before we make an effort to split it up | 17:35 |
| dolphm | ayoung: "don't split the SQL from the implementation" ? | 17:35 |
| ayoung | dolphm, for the the password rotation | 17:35 |
| dolphm | ayoung: i don't understand the statement | 17:36 |
| ayoung | SQL migrate repo is in the same place as the code. so if the code is core, the migrations go in core. If the rotate is in an extension, the migrations go in the extension | 17:36 |
| morganfainberg | ayoung, i also think that splitting the management stuff off (IDP separate system from assignment) is a great point to discuss in the SQL as a first class IDP session (and I am a big supporter of being able to run ID separately) | 17:36 |
| *** sbfox has quit IRC | 17:36 | |
| morganfainberg | dolphm, dstanek, i don't disagree w/ ayoung, we should keep the pieces together. I'd like to see this as core though vs extension. | 17:37 |
| dolphm | dstanek: i don't think you need to introduce new driver methods for this patch | 17:37 |
| dolphm | dstanek: s/need to/should/ | 17:37 |
| dstanek | ayoung: that's what is interestig about our compromise. the code is in identity core and all the extension does is add the URL support | 17:38 |
| *** ukalifon1 has joined #openstack-keystone | 17:38 | |
| morganfainberg | dolphm, there was one case, since admin password changes invalidate all passwords. | 17:38 |
| morganfainberg | dolphm, so you need to know if it was a user update or a password change | 17:38 |
| morganfainberg | dolphm, password change == rotation (iirc from the discussion) | 17:38 |
| dolphm | morganfainberg: correct... | 17:38 |
| dolphm | *looking through sql driver* | 17:38 |
| ukalifon1 | ayoung: Hi. I'm working with the federation API. I created an identity provider, a protocol in it (saml2) and now I'm creating a mapping. Where in all this do I define that the source is saml.myorg.com ? | 17:40 |
| ukalifon1 | Look at the docs here: https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md | 17:40 |
| *** sbfox has joined #openstack-keystone | 17:40 | |
| dolphm | ukalifon1: that's done in your shibboleth configuration | 17:40 |
| dolphm | ukalifon1: start there before working with the federation API in keystone | 17:41 |
| dstanek | dolphm: i needed a way to manage rotated passwords separate from regular passwords | 17:42 |
| ayoung | dstanek, are you sure? | 17:43 |
| dstanek | yes, because changing a password doesn't automatically rotate it; you have to specifically ask for it to be rotated | 17:43 |
| ukalifon1 | dolphm: thanks, how do I configure shibboleth and where can I find the docs? | 17:44 |
| dstanek | if we are going to support checking against the last X password then me may have to store it, but it would not be active after the password change | 17:45 |
| morganfainberg | dstanek, if we make all password checks go against this new table in SQL wouldn't that resolve that? | 17:45 |
| dstanek | morganfainberg: resolve having to know if it's rotated? | 17:46 |
| morganfainberg | dstanek, the "may have to store it | 17:46 |
| morganfainberg | " | 17:46 |
| morganfainberg | ? | 17:46 |
| morganfainberg | dstanek, oh i see. i was thinking from a password history / rotation mechanism. nevermind. | 17:47 |
| *** chandan_kumar has quit IRC | 17:49 | |
| dolphm | marekd: ^ see ukalifon1 | 17:52 |
| dolphm | dstanek: but why not migrate away the 'password' field, from the User table right now? | 17:53 |
| morganfainberg | dstanek, dolphm , +++ | 17:53 |
| morganfainberg | dolphm, i'd love to see the password info get moved out of the user_ref wherever possible (eliminates something we need to "filter" out) | 17:54 |
| dstanek | dolphm, morganfainberg: i can make that change too | 17:55 |
| dolphm | morganfainberg: that's exactly what i was thinking | 17:57 |
| dstanek | we've talked about that a few times; the last time we talked about it just waiting until we add all of the other password features - that why the tables isn't named passwords | 17:58 |
| *** jamielennox|away is now known as jamielennox | 18:03 | |
| *** ericn has joined #openstack-keystone | 18:06 | |
| andreaf | bknudson: hi | 18:10 |
| bknudson | andreaf: hi | 18:10 |
| andreaf | bknudson: I addressed your comments on https://review.openstack.org/#/c/81872/7 | 18:11 |
| andreaf | https://review.openstack.org/#/c/81872/ | 18:11 |
| andreaf | bknudson:I decided to go for a comment rather than mass-rename for now, I added some explanations in the patch-set | 18:11 |
| bknudson | andreaf: ok | 18:12 |
| andreaf | bknudson: let me know if you are ok with that | 18:12 |
| bknudson | andreaf: the name isn't super important. I'm sure keystonev3 is being used all over tempest. | 18:13 |
| bknudson | andreaf: also, there's an issue where v3 tests are in the admin package. | 18:13 |
| bknudson | http://git.openstack.org/cgit/openstack/tempest/tree/tempest/api/identity/admin/v3 -- why is it admin/v3? | 18:14 |
| bknudson | makes no sense | 18:14 |
| andreaf | bknudson: well yes that's not aligned with compute, so it's inconsistent. The code structure is much better now I think but there are still a few inconsistencies | 18:16 |
| andreaf | can you file a LP for that so we have it in qa queue? | 18:16 |
| bknudson | ok | 18:16 |
| andreaf | thanks | 18:17 |
| andreaf | it should be v3/admin rather than admin/v3 to be the same as compute | 18:18 |
| andreaf | but another inconsistency is that for instance glance has v1 and v2 folders, while compute has v2 tests in root foler and v3 in subfolder, and so does keystone | 18:18 |
| bknudson | there's an admin interface and public interface in v2, but v3 is served the same on both admin and public interfaces | 18:19 |
| bknudson | so v3 should be a sibling of admin | 18:20 |
| andreaf | bknudson: the admin folder refers to the role required on the user to run the tests, rather than the interface | 18:20 |
| rodrigods | stevemar, https://blueprints.launchpad.net/python-keystoneclient/+spec/roles-assignment-support and https://blueprints.launchpad.net/python-keystoneclient/+spec/roles-assignment-list. any suggestion? | 18:20 |
| bknudson | for v3, you can configure keystone to allow whatever role you want. it's not required to be admin. | 18:21 |
| bknudson | in v2 the admin api requires admin | 18:21 |
| andreaf | bknudson: good to know. I guess that's true for the other services as well, it depends on the policy configu | 18:22 |
| andreaf | but I'd say a common deployment option is to require admin | 18:22 |
| andreaf | bknudson: there is WIP to identify which tests require admin roles to run - see https://review.openstack.org/#/c/86967/ in case you want to comment on it - the spec is still open | 18:23 |
| andreaf | bknudson: we had a question in the QA meeting on best practices for setting up admin roles with keystone v3 - I sent a message to the DL about thi http://lists.openstack.org/pipermail/openstack-dev/2014-April/033698.html | 18:27 |
| dolphm | morganfainberg: nasty bug with db_sync - but i'm not able to reproduce on a fresh wheezy64 install https://bugs.launchpad.net/keystone/+bug/1314340 | 18:31 |
| uvirtbot | Launchpad bug 1314340 in keystone "db_sync throws CRITICAL KeyError: <VerNum(1)>" [Undecided,New] | 18:31 |
| dolphm | morganfainberg: getting a 14.04 box in a minute | 18:32 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Compressed Signature and Validation https://review.openstack.org/71181 | 18:34 |
| morganfainberg | dolphm, i already commented on it | 18:34 |
| morganfainberg | dolphm, the issue is https://github.com/openstack/keystone/blob/master/keystone/common/sql/migration_helpers.py#L165 | 18:34 |
| *** sbfox has quit IRC | 18:35 | |
| morganfainberg | dolphm, the 0 needs to reference the DB_INIT_VERSION | 18:35 |
| morganfainberg | dolphm, if db_sync was called instead of db_version this issue wouldn't have occured | 18:35 |
| ayoung | can someone confirm the fingerprint for the new ssh key? | 18:36 |
| morganfainberg | ayoung, for gerrit? | 18:36 |
| ayoung | yeah | 18:36 |
| dolphm | morganfainberg: weird | 18:36 |
| morganfainberg | 28:c6:42:b7:44:d2:48:64:c1:3f:31:d8:1b:6e:3b:63 (RSA) | 18:37 |
| morganfainberg | 6c:95:14:fd:8b:0f:de:d3:e3:10:77:5a:de:22:8a:5f (DSA) | 18:37 |
| dolphm | ayoung: https://review.openstack.org/#/settings/ssh-keys | 18:37 |
| ayoung | 28:c6:42:b7:44:d2:48:64:c1:3f:31:d8:1b:6e:3b:63 | 18:37 |
| morganfainberg | dolphm, yeah looks like we have a couple places we need to solve that. | 18:37 |
| ayoung | ++ | 18:37 |
| morganfainberg | dolphm, erm, one that is | 18:37 |
| morganfainberg | ayoung, https://review.openstack.org/#/settings/ssh-keys and from the email from Fungi (signed [infra] to the ML) | 18:38 |
| morganfainberg | ayoung in case you were wondering where i got the info | 18:38 |
| ayoung | morganfainberg, thanks | 18:38 |
| morganfainberg | ayoung np | 18:39 |
| *** sbfox has joined #openstack-keystone | 18:39 | |
| *** marcoemorais1 has joined #openstack-keystone | 18:40 | |
| ayoung | We done? | 18:40 |
| *** marcoemorais has quit IRC | 18:42 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Set proper DB_INIT_VERSION on db_version command https://review.openstack.org/91123 | 18:43 |
| *** ukalifon1 has quit IRC | 18:46 | |
| dolphm | morganfainberg: bknudson: o/ | 18:58 |
| bknudson | dolphm: \o | 18:58 |
| morganfainberg | o\ | 18:58 |
| dolphm | bknudson: there's no use case i can think of for having a revocation list with uuid tokens | 18:58 |
| dolphm | bknudson: if the uuid token is in the cache, you're done | 18:58 |
| jamielennox | dolphm: it depends on your cache strategy i guess | 18:59 |
| jamielennox | if you cache UUID tokens for 5 minutes then you don't | 18:59 |
| dolphm | jamielennox: "then you don't" ... what? | 18:59 |
| bknudson | you can set the cache time different from the revocation list cache time | 18:59 |
| jamielennox | if your tokens default to 24 hours expiry and you cache for the whole thing then you need the revocation list | 18:59 |
| morganfainberg | jamielennox, 5min is within clock skew iirc, so... | 18:59 |
| bknudson | so the revocation list cache time is 10 sec and the token cache time is 5 mins | 18:59 |
| morganfainberg | hmm. | 19:00 |
| jamielennox | (also not defending the process here - just why i think it came about) | 19:00 |
| dolphm | jamielennox: wtf | 19:00 |
| dolphm | jamielennox: that's layering unnecessary complexity for absolutely zero gain | 19:00 |
| morganfainberg | food time... | 19:01 |
| jamielennox | dolphm: depedning on how you're using your tokens i can see gain in that | 19:01 |
| *** morganfainberg is now known as morganfainberg_Z | 19:01 | |
| jamielennox | if your revocation lists are good (better than ours is) | 19:01 |
| dolphm | jamielennox: so you're starting with a false premise, continue... | 19:01 |
| jamielennox | you cache all the active tokens you have memory for and you don't need to online validate every 5 minutes | 19:02 |
| bknudson | all you need to check against is the revocation list | 19:02 |
| bknudson | assuming the revocation list is available | 19:02 |
| jamielennox | if you're talking a small number of revocations then that traffic is way smaller than continual validations | 19:02 |
| *** ericn has quit IRC | 19:02 | |
| jamielennox | i don't recommend anyone do that setup with the system we have today - but i can see the argument | 19:03 |
| dolphm | and you don't mean revocation *events* -- you actually mean revocation *list*? | 19:04 |
| *** vhoward has joined #openstack-keystone | 19:05 | |
| *** erecio_1 has joined #openstack-keystone | 19:05 | |
| jamielennox | dolphm: i don't think i care enough about this argument to be on the defensive, but i mean with a good revocation system (which we don't have) I can see an argument for caching a UUID token for it's full expiry period | 19:06 |
| dolphm | jamielennox: if you're starting with a false premise, then it's not an argument :) | 19:06 |
| *** vhoward has left #openstack-keystone | 19:07 | |
| jamielennox | dolphm: it's always an argument - i just might be wrong | 19:07 |
| *** erecio has quit IRC | 19:08 | |
| dolphm | jamielennox: i don't think you can be wrong in an invalid argument | 19:12 |
| *** thiagop has quit IRC | 19:20 | |
| gabriel-bezerra | jamielennox, morganfainberg_Z: Might you review https://review.openstack.org/90631, please? | 19:27 |
| jamielennox | gabriel-bezerra: cool, i didn't know you could do that | 19:28 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token configurable check of revocations for cached https://review.openstack.org/90472 | 19:28 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Compressed Token Provider https://review.openstack.org/91145 | 19:29 |
| ayoung | bknudson, ^^ should be WIP, but I don't see the button letting me set that | 19:30 |
| *** afaranha has joined #openstack-keystone | 19:30 | |
| bknudson | ayoung: set WorkFlow -1 | 19:30 |
| ayoung | bknudson, where? | 19:31 |
| bknudson | ayoung: where you would set WorkFlow +1 to approve it | 19:31 |
| ayoung | bknudson, thanks | 19:31 |
| bknudson | ayoung: I switched to the "new" view so am not sure what the old buttons are | 19:31 |
| ayoung | got it, thanks./ I am not even sure if that will pass tox, I suspect not. | 19:32 |
| bknudson | ayoung: updated https://review.openstack.org/90472 to have a config option | 19:32 |
| ayoung | bknudson, I'll remove the -2 | 19:32 |
| *** dstanek is now known as dstanek_zzz | 19:33 | |
| gabriel-bezerra | thanks, jamielennox | 19:33 |
| openstackgerrit | A change was merged to openstack/keystone: Move hacking code to a separate fixture https://review.openstack.org/86998 | 19:34 |
| jamielennox | gabriel-bezerra: np | 19:34 |
| dolphm | how do you know if you're using the new / old view? | 19:34 |
| bknudson | dolphm: go to Settings | 19:35 |
| bknudson | Preferences | 19:35 |
| bknudson | it's the Change View option | 19:35 |
| dolphm | bknudson: thanks | 19:35 |
| dolphm | bknudson: i'll try the New view later to see what all the complaining is about | 19:36 |
| bknudson | I just thought I'd try it since there were complaints on the ml. | 19:36 |
| ayoung | bknudson, yeah, its different. But the big plus is that it givers you all of the comments inline.... | 19:38 |
| ayoung | OK...time to move.... | 19:38 |
| *** ayoung has quit IRC | 19:39 | |
| jamielennox | bknudson: ahh - the new view might need some css tweaks | 19:47 |
| bknudson | jamielennox: what's not working? | 19:48 |
| rodrigods | stevemar, created the additional blueprint: https://blueprints.launchpad.net/python-openstackclient/+spec/roles-assignment-list | 19:48 |
| jamielennox | bknudson: it's just really squished together, but i like having the line comments out like that | 19:49 |
| jamielennox | oo, the new screen let's you edit the commit message from gerrit - there's no going back now | 19:51 |
| dolphm | the javascript seems super slow in the new view | 19:52 |
| morganfainberg_Z | dolphm, i switched back because the new view was kinda wonky | 19:52 |
| *** morganfainberg_Z is now known as morganfainberg | 19:52 | |
| jamielennox | hmm, and all of the pregenerated git pull/checkout links are gone | 19:54 |
| jamielennox | i use those | 19:54 |
| morganfainberg | jamielennox, they are int the top right dropdown | 19:54 |
| *** dstanek_zzz is now known as dstanek | 19:55 | |
| morganfainberg | jamielennox, i didn't think UX would get better in gerrit... but i didn't think it would end up this much worse :P | 19:55 |
| bknudson | git-review -d to pull it | 19:55 |
| jamielennox | morganfainberg: ah, thanks | 19:55 |
| jamielennox | bknudson: yea, i just never got in the habit | 19:55 |
| dolphm | +1 for git-review -d / -x | 19:56 |
| jamielennox | clicking on the project name in a review now gives you the settings for the project, clicking on the magnifying glass next to it no longer defaults to status:open so you see everything | 19:57 |
| bknudson | does the new gerrit still have drafts? | 19:57 |
| morganfainberg | jamielennox, yeah that... bothers me | 19:57 |
| morganfainberg | bknudson, i'm guessing it does, but drafts were aweful | 19:57 |
| morganfainberg | bknudson, WIP is better | 19:57 |
| dolphm | bknudson: (why do you need drafts?) | 19:58 |
| *** leseb has joined #openstack-keystone | 19:58 | |
| bknudson | would be nice if we had a better way to review the embargoed changes | 19:58 |
| dolphm | bknudson: that's coming! | 19:58 |
| morganfainberg | bknudson, yes that is planned. | 19:58 |
| bknudson | would have to hide them from zuul? | 19:59 |
| bknudson | zuul status page | 19:59 |
| morganfainberg | bknudson, i think that is all in the works | 19:59 |
| dolphm | bknudson: separate infrastructure | 19:59 |
| *** dstanek is now known as dstanek_zzz | 20:04 | |
| *** derek_c has joined #openstack-keystone | 20:05 | |
| *** erecio_2 has joined #openstack-keystone | 20:10 | |
| *** bach has joined #openstack-keystone | 20:12 | |
| *** erecio_1 has quit IRC | 20:12 | |
| *** bach has quit IRC | 20:15 | |
| *** ayoung has joined #openstack-keystone | 20:37 | |
| *** dstanek_zzz is now known as dstanek | 20:38 | |
| *** leseb has quit IRC | 20:41 | |
| *** klrmn has joined #openstack-keystone | 20:42 | |
| klrmn | i have a newly installed keystone server, but nothing is showing up in /var/log/keystone/ … what do i need to do to get logging turned on? | 20:43 |
| gabriel-bezerra | klrmn: check if verbose=True or debug=True on /etc/keystone/keystone.conf | 20:57 |
| gabriel-bezerra | in the [DEFAULT] section | 20:58 |
| gabriel-bezerra | morganfainberg: Might you review https://review.openstack.org/90631, please? | 21:00 |
| *** dstanek is now known as dstanek_zzz | 21:00 | |
| *** erecio_2 has quit IRC | 21:01 | |
| *** marcoemorais1 has quit IRC | 21:03 | |
| morganfainberg | gabriel-bezerra, i'll look at it when i'm out of my next slew of meetings | 21:03 |
| *** marcoemorais has joined #openstack-keystone | 21:04 | |
| *** dstanek_zzz is now known as dstanek | 21:05 | |
| *** marcoemorais has quit IRC | 21:06 | |
| *** andreaf has quit IRC | 21:06 | |
| *** marcoemorais has joined #openstack-keystone | 21:08 | |
| *** derek_c has quit IRC | 21:13 | |
| *** derek_c has joined #openstack-keystone | 21:13 | |
| *** morganfainberg is now known as morganfainberg_Z | 21:22 | |
| *** morganfainberg_Z is now known as morganfainberg | 21:25 | |
| *** bach has joined #openstack-keystone | 21:27 | |
| boris-42 | morganfainberg ping | 21:27 |
| *** daneyon_ has joined #openstack-keystone | 21:27 | |
| *** daneyon has quit IRC | 21:28 | |
| boris-42 | dolphm ping | 21:28 |
| *** derek_c has quit IRC | 21:31 | |
| *** morganfainberg is now known as morganfainberg_Z | 21:33 | |
| *** morganfainberg_Z is now known as morganfainberg | 21:34 | |
| *** bach has quit IRC | 21:35 | |
| *** joesavak has quit IRC | 21:40 | |
| morganfainberg | boris-42, hi | 21:41 |
| morganfainberg | boris-42, here now | 21:41 |
| *** sbfox has quit IRC | 21:41 | |
| boris-42 | morganfainberg so we need to get +1 from dolphm in infra | 21:41 |
| boris-42 | morganfainberg here https://review.openstack.org/#/c/90404/ | 21:42 |
| morganfainberg | ah | 21:42 |
| morganfainberg | dolphm, ^ when you get a chance could use your eyes. | 21:42 |
| morganfainberg | boris-42, best bet is keep following up with us. i'll work from this side. | 21:43 |
| morganfainberg | boris-42, hopefully we can get that in soonish :) | 21:43 |
| boris-42 | morganfainberg yep we just get approve for glance performance job | 21:44 |
| boris-42 | morganfainberg so we will see how it works there=) | 21:44 |
| morganfainberg | cool! | 21:44 |
| morganfainberg | boris-42, thanks for the work on this! | 21:44 |
| *** sbfox has joined #openstack-keystone | 21:44 | |
| boris-42 | morganfainberg it should support plugins | 21:45 |
| morganfainberg | nice | 21:45 |
| boris-42 | morganfainberg otherwise it won't be sexy | 21:45 |
| morganfainberg | hehe | 21:45 |
| boris-42 | morganfainberg cause you will need to merge new benchmarks first in rally | 21:45 |
| morganfainberg | yeah, plugin support makes it super awesome instead of just very cool | 21:45 |
| boris-42 | morganfainberg and this process is not quite fast=) | 21:45 |
| *** dstanek is now known as dstanek_zzz | 21:45 | |
| boris-42 | morganfainberg cause we are nerds=) | 21:45 |
| morganfainberg | boris-42, yep. :) hehe | 21:46 |
| boris-42 | morganfainberg actually patch is already done https://review.openstack.org/#/c/72679/ | 21:46 |
| boris-42 | morganfainberg just waiting for pretty .rst with description | 21:46 |
| morganfainberg | yeah docs are good. | 21:47 |
| *** praneshp has quit IRC | 21:50 | |
| *** praneshp has joined #openstack-keystone | 21:51 | |
| *** dims has quit IRC | 21:57 | |
| bknudson | I think I | 22:00 |
| bknudson | I'm going to have to give up on the new gerrit view | 22:00 |
| bknudson | the diff viewer doesn't show _s | 22:00 |
| morganfainberg | bknudson, yeah it's a little odd and has some issues | 22:02 |
| gabriel-bezerra | Hi guys. Have you ever seen this on Keystone? TypeError: expected byte string object for header value, value of type unicode found | 22:05 |
| gabriel-bezerra | it is showing up when I POST /v3/auth/tokens | 22:06 |
| morganfainberg | gabriel-bezerra, yep. | 22:06 |
| gabriel-bezerra | I'm trying to deploy a federated Keystone, so it is running in Apache, but I haven't turned SSL nor Shib on yet. | 22:07 |
| morganfainberg | gabriel-bezerra, i can actually point you at the bug. | 22:07 |
| morganfainberg | master? | 22:07 |
| morganfainberg | or icehouse? | 22:07 |
| gabriel-bezerra | master | 22:07 |
| morganfainberg | gabriel-bezerra, https://review.openstack.org/#/c/90476/ that review should fix the issue | 22:07 |
| morganfainberg | bug https://bugs.launchpad.net/python-keystoneclient/+bug/1312971 | 22:07 |
| uvirtbot | Launchpad bug 1312971 in python-keystoneclient "mod_wsgi exception processing UTF-8 Header" [High,Triaged] | 22:07 |
| morganfainberg | gabriel-bezerra, that isn't the end-all fix, but it's the immidiate stopgap | 22:09 |
| *** dims has joined #openstack-keystone | 22:10 | |
| gabriel-bezerra | Is there any workaround for it? | 22:10 |
| morganfainberg | either apply that patch, or don't use HTTPd to deploy. i expect we'll get that fix committed into master soon | 22:11 |
| morganfainberg | since you're doing federation, the only real solution is to apply that patch | 22:11 |
| morganfainberg | since HTTPD is needed. | 22:11 |
| *** daneyon_ has quit IRC | 22:11 | |
| morganfainberg | i'll poke at some people here this afternoon and see if we can get it at least into gate (depending on the depth of the queue it make take time to actually merge) | 22:12 |
| *** daneyon has joined #openstack-keystone | 22:12 | |
| gabriel-bezerra | oh, good. | 22:13 |
| gabriel-bezerra | I'll keep an eye on it | 22:13 |
| *** topol has joined #openstack-keystone | 22:14 | |
| gabriel-bezerra | should I subscribe as a reviewer to get updates? | 22:14 |
| morganfainberg | gabriel-bezerra, if you would like. | 22:14 |
| gabriel-bezerra | morganfainberg: thank you for reviewing my change about keystone on apache in devstack | 22:17 |
| gabriel-bezerra | what should I do now to move it forward? | 22:17 |
| morganfainberg | gabriel-bezerra, sure thing! glad to have more people contributing. | 22:17 |
| morganfainberg | gabriel-bezerra, now it's a waiting game mostly, need to get the core team on devstack to review/approve it | 22:17 |
| gabriel-bezerra | should I poke anyone or add them as reviewers? | 22:18 |
| gabriel-bezerra | or they already have a list with +1ed and verified changes? | 22:19 |
| *** topol has quit IRC | 22:19 | |
| bknudson | dstanek_zzz: dolphm: stevemar: any reason https://review.openstack.org/#/c/84446/ wasn't approved already? | 22:20 |
| morganfainberg | gabriel-bezerra, not sure what their workflow is, you can ask them in IRC or just add them to the review (always good) | 22:20 |
| morganfainberg | gabriel-bezerra, i haven't had a huge issue with devstack reviews languishing without eyes on them | 22:24 |
| morganfainberg | gabriel-bezerra, also realize this week is officially marked as a quiet week for the openstack community (preparing for the design summit and we've released icehouse) there are a number of people on vacation this week | 22:25 |
| morganfainberg | gabriel-bezerra, so thinks might move a little slower until after the design summit | 22:25 |
| morganfainberg | gabriel-bezerra, s/thinks/things | 22:25 |
| gabriel-bezerra | ok, right | 22:26 |
| stevemar | bknudson, cause we're wimps? | 22:28 |
| bknudson | let's all grow a pair! | 22:28 |
| morganfainberg | bknudson, stevemar, quick -2 that! | 22:28 |
| morganfainberg | i mean... | 22:28 |
| morganfainberg | +1 | 22:28 |
| *** bach has joined #openstack-keystone | 22:28 | |
| morganfainberg | i mean.. approve | 22:28 |
| bknudson | https://review.openstack.org/#/c/84446/ is approved now... seemed to have enough reviews and I think all the comments were addressed. | 22:30 |
| gabriel-bezerra | morganfainberg: thank you for your hand on those changes. Got to go now. | 22:30 |
| *** zigo_ has joined #openstack-keystone | 22:35 | |
| morganfainberg | gabriel-bezerra, thanks for working on that stuff! have a good one! | 22:37 |
| *** zigo has quit IRC | 22:37 | |
| bknudson | If we want to add a foreign key can do it in a separate commit. | 22:37 |
| bknudson | I'm not even sure how you would do that safely. | 22:37 |
| *** thedodd has quit IRC | 22:37 | |
| *** bach has quit IRC | 22:40 | |
| *** dstanek_zzz is now known as dstanek | 22:41 | |
| stevemar | bknudson, i guess the downgrade path would be hard? | 22:41 |
| bknudson | stevemar: how would you know which mapping the federation_protocol was referring to if it wasn't referring to an existing one? | 22:43 |
| bknudson | was supposed to refer to | 22:43 |
| stevemar | bknudson, yeah, i can see how that could be a problem | 22:44 |
| *** nkinder has quit IRC | 22:50 | |
| morganfainberg | bknudson, adding a FK sanely? | 22:56 |
| morganfainberg | bknudson, uhm... | 22:56 |
| *** david-lyle has quit IRC | 22:59 | |
| *** bach has joined #openstack-keystone | 23:08 | |
| *** bach has quit IRC | 23:14 | |
| *** shakamunyi has quit IRC | 23:14 | |
| *** shakamunyi has joined #openstack-keystone | 23:19 | |
| openstackgerrit | A change was merged to openstack/identity-api: Fix typo in federation api https://review.openstack.org/90659 | 23:21 |
| *** dstanek is now known as dstanek_zzz | 23:21 | |
| *** bknudson has quit IRC | 23:23 | |
| *** amcrn has quit IRC | 23:36 | |
| *** dstanek_zzz is now known as dstanek | 23:45 | |
| *** stevemar has quit IRC | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
