| *** richm has left #openstack-keystone | 00:06 | |
| jamielennox | morganfainberg: do you know where to address the problems here: http://lists.openstack.org/pipermail/openstack-stable-maint/2014-June/002337.html ? | 00:09 |
|---|---|---|
| *** praneshp has quit IRC | 00:14 | |
| hrybacki | jamielennox: I met with the glance folks today about keystoneclient integration -- they seemed very open to input from our team | 00:17 |
| hrybacki | specifically they asked if you/me/ayoung would look over https://review.openstack.org/#/c/82126/ -- see if everything seems to be in order, if they are missing things, etc.. | 00:17 |
| jamielennox | hrybacki: excellent, | 00:18 |
| jamielennox | oh, someones had a go at it already | 00:18 |
| hrybacki | yep :) | 00:18 |
| hrybacki | the power of weekly meetings | 00:19 |
| jamielennox | what have they done there? they don't seem to be going for a session | 00:19 |
| hrybacki | I haven't had a chance to look over it myself | 00:20 |
| hrybacki | but that's the kind of feedback they need | 00:20 |
| jamielennox | oh | 00:20 |
| jamielennox | they are using the session in shell to get a token and endpoint and then using the existing client from then on | 00:20 |
| jamielennox | damn, i need to get some reviews pushed through - everyone needs the same stuff | 00:21 |
| hrybacki | let me know when you do, I want to be on the same page as you | 00:21 |
| jamielennox | hrybacki: so what they've done is not what i was suggesting you look at | 00:21 |
| hrybacki | ? | 00:22 |
| jamielennox | i have a review to push through a standard set of CLI params, it's waiting for people | 00:22 |
| jamielennox | so as i was saying the other day there are multiple parts to a python-*client, there's the CLI part and the library part | 00:22 |
| hrybacki | nods | 00:22 |
| jamielennox | when i was talking about using the session i was suggesting we replace the core of the libraries, what they've done is to use the session to get out the token they need in the shell | 00:23 |
| jamielennox | shell = CLI | 00:23 |
| ayoung_afk | hrybacki, sorry to leave you hanging today | 00:23 |
| ayoung_afk | I was knocked out | 00:23 |
| hrybacki | ayoung_afk: no worries | 00:23 |
| jamielennox | and then pass that token value through to all there existing http code | 00:23 |
| hrybacki | ayoung_afk: I saw your late night pushes | 00:23 |
| ayoung_afk | some sort of bug.... | 00:23 |
| hrybacki | -- | 00:23 |
| ayoung_afk | I think I'm through it now | 00:24 |
| ayoung_afk | hrybacki, anything come out of the glance meeting? | 00:24 |
| hrybacki | ++ | 00:24 |
| hrybacki | just what I was telling jamie | 00:24 |
| *** otwieracz has quit IRC | 00:24 | |
| hrybacki | they are open to collaboration and want our help in integrating keystoneclient | 00:25 |
| *** otwieracz has joined #openstack-keystone | 00:25 | |
| hrybacki | https://review.openstack.org/#/c/82126/ | 00:25 |
| hrybacki | but jamie was saying they are not on track yet -- I haven't looked over it myself yet | 00:25 |
| ayoung_afk | jamielennox, which reviews | 00:25 |
| ayoung_afk | looks like they just went for V3 API supportwithout going full session, kindof like Neutron did | 00:26 |
| hrybacki | https://review.openstack.org/#/c/82126/ | 00:26 |
| jamielennox | ayoung_afk: theres or which of mine need mergine? | 00:26 |
| *** ayoung_afk is now known as ayoung | 00:26 | |
| ayoung | jamielennox "damn, i need to get some reviews pushed through - everyone needs the same stuff" | 00:26 |
| jamielennox | ayoung: yea, they used the session to get a token, but didn't convert the existing library | 00:26 |
| ayoung | its astart | 00:26 |
| jamielennox | https://review.openstack.org/#/c/95015/ | 00:26 |
| jamielennox | and then the dependencies of that | 00:26 |
| jamielennox | that one and the follow on are ready to go | 00:26 |
| jamielennox | the two after that need a little more work | 00:27 |
| *** hrybacki is now known as hrybacki_afkish | 00:27 | |
| jamielennox | damn, the second one needs a rebase | 00:28 |
| jamielennox | ayoung: when's the meetup? | 00:29 |
| *** yfujioka has joined #openstack-keystone | 00:30 | |
| ayoung | next week, wed-fri | 00:30 |
| ayoung | er | 00:30 |
| ayoung | two weeks | 00:30 |
| ayoung | next week is a Holiday | 00:30 |
| dstanek | jamielennox: why would oslo.config fail to import? https://review.openstack.org/#/c/95015/9/keystoneclient/session.py | 00:31 |
| jamielennox | dstanek: because oslo.config shouldn't be a dependency of keystoneclient | 00:32 |
| jamielennox | it currently is, but if middleware comes out it won't be | 00:32 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session loading from CLI options https://review.openstack.org/95678 | 00:36 |
| dstanek | jamielennox: odd, so there will be functionality available to people that do have it installed? | 00:37 |
| jamielennox | dstanek: it's not really useful unless you have it installed | 00:37 |
| jamielennox | you get back a list of oslo.conf options which you then need to register with a CONF object | 00:38 |
| jamielennox | so the consumer is going to have that available | 00:38 |
| morganfainberg | jamielennox, not sure who to bug about stable maint | 00:38 |
| jamielennox | morganfainberg: i had a quick chat in -infra, they gave me some pointers but i've got no idea what to do with it | 00:39 |
| hrybacki_afkish | i'm heading out, have a good day/night all! | 00:40 |
| morganfainberg | jamielennox, i can try and help some once i get back from the gym and openstack meetup | 00:40 |
| morganfainberg | jamielennox, i don't have a ton of time to spend at the moment though | 00:40 |
| morganfainberg | need to get going | 00:40 |
| jamielennox | morganfainberg: they said to look at the ironic setup and look at that | 00:40 |
| morganfainberg | jamielennox, ok i'[ll look at the scroll back and if i can help i will | 00:40 |
| morganfainberg | it's probably not too bad to fix | 00:41 |
| *** hrybacki_afkish has quit IRC | 00:47 | |
| *** xianghui has quit IRC | 00:50 | |
| openstackgerrit | Michael McCune proposed a change to openstack/python-keystoneclient: Correcting using-api-v2.rst https://review.openstack.org/102986 | 00:51 |
| dstanek | jamielennox: is depending on oslo.config a bad thing? | 00:53 |
| jamielennox | dstanek: it's not horrible i guess - it just generally doesn't make sense from a client perspective | 00:53 |
| jamielennox | we do it now anyway, so if it's an issue i can take out the check for now | 00:54 |
| dstanek | jamielennox: i'm just looking throught that series or reviews now and i noticed that dhellmann was also wondering the same thing | 00:55 |
| jamielennox | dstanek: that's a little different, he's looking at the auth plugins | 00:56 |
| jamielennox | and i created my own intermediate format rather than use oslo options | 00:57 |
| *** oomichi is now known as oomichi_away | 00:57 | |
| jamielennox | oslo.config is good for config files, there is some CLI support there but it isn't used by any of the clients - it's only parsed for CLI options when starting the servers | 00:57 |
| dstanek | jamielennox: is there any reason that it's not? | 00:58 |
| jamielennox | it also doesn't support cliff | 00:58 |
| jamielennox | dstanek: honestly i don't know | 00:58 |
| jamielennox | i tried to figure out how it worked and got my brain tied in knots | 00:58 |
| dstanek | haha, me too | 00:58 |
| dstanek | i think that code needs a lot of love | 00:59 |
| dstanek | jamielennox: there are things like this https://review.openstack.org/#/c/99831 that i think may have just worked on accident | 01:02 |
| jamielennox | dstanek: i expect to have the oslo.config debate for those parameters which is why i haven't updated those reviews | 01:05 |
| jamielennox | i might bring it up at the next meeting | 01:05 |
| jamielennox | i don't think it affects the first two reviews about the session for now though | 01:05 |
| *** openstackgerrit has quit IRC | 01:06 | |
| jamielennox | dstanek: mmm, that's fun | 01:06 |
| jamielennox | i had this problem with a review just the other day, you can't stub a deprecated argument in oslo.config because it doesn't actually get registered | 01:07 |
| jamielennox | it seems like such an easy problem.... | 01:07 |
| *** xianghui has joined #openstack-keystone | 01:07 | |
| *** openstackgerrit has joined #openstack-keystone | 01:08 | |
| dstanek | jamielennox: ah yes, i ran into something similar during my oslo.config travels | 01:10 |
| *** topol has joined #openstack-keystone | 01:11 | |
| *** marcoemorais has quit IRC | 01:13 | |
| *** zzzeek has quit IRC | 01:15 | |
| *** hrybacki_afkish has joined #openstack-keystone | 01:18 | |
| *** zhiyan_ is now known as zhiyan | 01:18 | |
| *** zzzeek has joined #openstack-keystone | 01:33 | |
| *** jamielennox is now known as jamielennox_afk | 01:33 | |
| *** praneshp has joined #openstack-keystone | 01:37 | |
| *** mberlin has joined #openstack-keystone | 01:39 | |
| *** mberlin1 has quit IRC | 01:40 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds hacking check for debug logging translations https://review.openstack.org/101636 | 01:56 |
| *** dims_ has quit IRC | 02:02 | |
| *** praneshp_ has joined #openstack-keystone | 02:06 | |
| *** praneshp has quit IRC | 02:09 | |
| *** praneshp_ is now known as praneshp | 02:09 | |
| openstackgerrit | A change was merged to openstack/keystone: Adds oslo.db support for Python 3 tests https://review.openstack.org/102624 | 02:12 |
| *** zzzeek has quit IRC | 02:24 | |
| *** nsquare has quit IRC | 02:38 | |
| *** rodrigods_ has quit IRC | 02:41 | |
| *** harlowja is now known as harlowja_away | 02:53 | |
| *** dstanek is now known as dstanek_zzz | 02:54 | |
| *** zhiyan is now known as zhiyan_ | 03:05 | |
| *** stevemar2 has joined #openstack-keystone | 03:05 | |
| *** otwieracz has quit IRC | 03:05 | |
| *** zhiyan_ is now known as zhiyan | 03:06 | |
| *** stevemar has quit IRC | 03:07 | |
| *** otwieracz has joined #openstack-keystone | 03:12 | |
| *** dstanek_zzz is now known as dstanek | 03:15 | |
| *** dstanek is now known as dstanek_zzz | 03:25 | |
| *** jamielennox_afk is now known as jamielennox | 04:01 | |
| *** hrybacki_afkish has quit IRC | 04:11 | |
| *** dstanek_zzz is now known as dstanek | 04:16 | |
| *** dstanek is now known as dstanek_zzz | 04:26 | |
| *** stevemar2 has quit IRC | 04:27 | |
| *** stevemar2 has joined #openstack-keystone | 04:30 | |
| *** stevemar2 is now known as stevemar | 04:30 | |
| *** Chicago has joined #openstack-keystone | 04:55 | |
| *** yfujioka has left #openstack-keystone | 05:04 | |
| *** packet has quit IRC | 05:06 | |
| *** oomichi_away is now known as oomichi | 05:07 | |
| *** stevemar has quit IRC | 05:09 | |
| *** ajc_ has joined #openstack-keystone | 05:15 | |
| *** dstanek_zzz is now known as dstanek | 05:17 | |
| *** chandan_kumar has joined #openstack-keystone | 05:22 | |
| *** dstanek is now known as dstanek_zzz | 05:27 | |
| *** chandan_kumar has quit IRC | 05:35 | |
| *** henrynash has joined #openstack-keystone | 05:41 | |
| *** chandan_kumar has joined #openstack-keystone | 05:42 | |
| *** tkelsey_ has joined #openstack-keystone | 05:45 | |
| *** topol has quit IRC | 05:48 | |
| *** henrynash has quit IRC | 05:53 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 05:55 |
| *** stevemar has joined #openstack-keystone | 05:58 | |
| *** stevemar2 has joined #openstack-keystone | 06:13 | |
| *** praneshp_ has joined #openstack-keystone | 06:13 | |
| *** praneshp has quit IRC | 06:14 | |
| *** stevemar has quit IRC | 06:15 | |
| *** praneshp_ has quit IRC | 06:18 | |
| *** dstanek_zzz is now known as dstanek | 06:18 | |
| *** ukalifon1 has joined #openstack-keystone | 06:20 | |
| *** praneshp has joined #openstack-keystone | 06:21 | |
| *** tomoiaga has joined #openstack-keystone | 06:21 | |
| *** dstanek is now known as dstanek_zzz | 06:28 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/101800 | 06:32 |
| *** ncoghlan has joined #openstack-keystone | 06:34 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/101404 | 06:37 |
| *** stevemar2 has quit IRC | 06:38 | |
| *** afazekas_ has quit IRC | 06:46 | |
| *** afazekas has quit IRC | 06:52 | |
| *** jamielennox is now known as jamielennox|away | 06:52 | |
| *** rwsu has quit IRC | 06:53 | |
| *** praneshp_ has joined #openstack-keystone | 06:53 | |
| *** praneshp has quit IRC | 06:55 | |
| *** praneshp_ is now known as praneshp | 06:55 | |
| *** ukalifon1 has quit IRC | 06:55 | |
| *** henrynash has joined #openstack-keystone | 07:00 | |
| *** praneshp has quit IRC | 07:04 | |
| *** mrda is now known as mrda-weekend | 07:06 | |
| *** BAKfr has joined #openstack-keystone | 07:06 | |
| *** dstanek_zzz is now known as dstanek | 07:18 | |
| *** dstanek is now known as dstanek_zzz | 07:28 | |
| *** ukalifon has joined #openstack-keystone | 07:48 | |
| *** ukalifon has quit IRC | 07:55 | |
| *** nkinder has quit IRC | 08:06 | |
| *** nkinder has joined #openstack-keystone | 08:06 | |
| *** rwsu has joined #openstack-keystone | 08:08 | |
| *** rwsu has quit IRC | 08:08 | |
| *** dstanek_zzz is now known as dstanek | 08:19 | |
| *** dstanek is now known as dstanek_zzz | 08:29 | |
| *** dstanek_zzz is now known as dstanek | 09:20 | |
| *** marekd|away is now known as marekd | 09:26 | |
| *** oomichi has quit IRC | 09:27 | |
| *** dstanek is now known as dstanek_zzz | 09:30 | |
| baffle | Hi, I have a problem using the identity:list_projects policy in Keystone. My current rule is: "identity:list_projects": "rule:cloud_admin or (rule:admin_required and domain_id:%(domain_id)s)" but when I try to list projects in Horizon, I see the following in the log: enforce identity:list_projects: {'is_delegated_auth': False, 'group_ids': [], 'user_id': u'58acf68ca8a84ce596cb65d3823088c3', 'roles': [u'admin'], 'trustee_id': None, 'trustor_id': | 09:44 |
| baffle | And then I get "You are not authorized to perform the requested action, identity:list_projects.". Do this mean that the auth context does not have a domain id, so my "rule:cloud_admin" rule will fail? | 09:45 |
| *** ncoghlan has quit IRC | 09:48 | |
| *** zhiyan is now known as zhiyan_ | 09:57 | |
| *** dstanek_zzz is now known as dstanek | 10:21 | |
| *** dstanek is now known as dstanek_zzz | 10:31 | |
| *** rodrigods_ has joined #openstack-keystone | 11:00 | |
| openstackgerrit | A change was merged to openstack/keystone: Regenerate sample config file https://review.openstack.org/102294 | 11:15 |
| *** rodrigods_ has quit IRC | 11:16 | |
| *** dstanek_zzz is now known as dstanek | 11:22 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 11:25 |
| *** dstanek is now known as dstanek_zzz | 11:32 | |
| *** topol has joined #openstack-keystone | 11:39 | |
| *** topol has quit IRC | 11:47 | |
| *** ajc_ has quit IRC | 12:03 | |
| *** zhiyan_ is now known as zhiyan | 12:08 | |
| *** bknudson has joined #openstack-keystone | 12:14 | |
| *** joesavak has joined #openstack-keystone | 12:20 | |
| *** erecio has joined #openstack-keystone | 12:21 | |
| *** dstanek_zzz is now known as dstanek | 12:22 | |
| *** dstanek is now known as dstanek_zzz | 12:32 | |
| *** dstanek_zzz is now known as dstanek | 12:33 | |
| *** richm has joined #openstack-keystone | 12:35 | |
| *** nsquare has joined #openstack-keystone | 12:37 | |
| openstackgerrit | Juan Manuel Ollé proposed a change to openstack/keystone: Adding Role for an unexisting user should fail https://review.openstack.org/93982 | 12:42 |
| *** hrybacki_afkish has joined #openstack-keystone | 12:51 | |
| *** erecio has quit IRC | 12:54 | |
| *** erecio has joined #openstack-keystone | 12:55 | |
| *** hrybacki_afkish is now known as hrybacki | 12:56 | |
| *** csd has joined #openstack-keystone | 13:10 | |
| *** bobt has joined #openstack-keystone | 13:11 | |
| csd | hi, let me pull a question I asked on openstack-dev over as this might be a better place: | 13:13 |
| csd | hi, I'm looking for CORS support for keystone. I see an abandoned code review here: https://review.openstack.org/ | 13:13 |
| csd | #/c/21958/ | 13:13 |
| csd | and an article on how to install it here: http://blog.yunak.eu/2013/07/24/keystone_cors/ | 13:14 |
| csd | that seems to be the current state. Just checking if anyone is aware or any further work that I might have missed before dwelving into those more | 13:14 |
| csd | as they are all >1 year solutions | 13:14 |
| *** radez_g0n3 is now known as radez | 13:16 | |
| bknudson | Do you expect that openstack would work if I set the identity endpoint to /v3 ? | 13:19 |
| bknudson | Is that something that should work? | 13:20 |
| bknudson | Or do we only support /v2.0? | 13:20 |
| bknudson | Or are we saying we also support an unversioned endpoint? (Although I'm pretty sure that doesn't work) | 13:20 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add identity mapping capability https://review.openstack.org/102430 | 13:30 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: multi-backend support for identity https://review.openstack.org/74214 | 13:30 |
| *** vhoward has left #openstack-keystone | 13:33 | |
| dstanek | csd: this is the first i have heard about tha | 13:38 |
| dstanek | csd: your link appears to just be middleware so if you need that support you should be able to use it without it being included in openstack projects | 13:39 |
| csd | dstanek, what about ? CORS ? | 13:39 |
| csd | I heard of CORS recently from a co-worker who's writing some ajax code to talk to keystone+nova and ran into this problem | 13:41 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: multi-backend support for identity https://review.openstack.org/74214 | 13:41 |
| csd | dstanek, are you saying that you don't think CORS should be in openstack project ? I think it would be good for keystone to (configurably) support CORS | 13:42 |
| csd | as it would permit web clients to talk REST to openstack components directly (horizon doesn't suffer this because django middleware takes care of it is my understanding) | 13:43 |
| raildo | ayoung: I was reading the keystone on-spec Endpoint Policy Assignment, I know it is still very early, but I'm with a doubt. What is the difference between this proposal and the API policy existing at Keystone? | 13:44 |
| dstanek | csd: i'm not saying it shouldn't be there. just that i believe you can use it anyway. | 13:49 |
| csd | dstanek, understood. the instructions seem to be okay for the most part. I was just wondering if anyone knew of more recent attempts at making it part of keystone | 13:50 |
| csd | as that would be a better place to go if it existed | 13:50 |
| tomoiaga | bknudson: nova may not work. If you plan on using two endpoints for v3 and v2 that may be ok. Otherwise stick with v2. You can use keystone v3 directly (by setting the url). Just keep in mind that nova looks at the service catalog and will work with keystone v2 only | 13:51 |
| *** stevemar has joined #openstack-keystone | 13:51 | |
| dstanek | csd: the review you linked to wasn't for keystone it was for oslo | 13:51 |
| bknudson | tomoiaga: ok, we've got some work to do then | 13:52 |
| dstanek | csd: i just browsed the comments and i think there was still a bit or work to do to properly support it; maybe the original author's case worked and didn't feel the need to continue? | 13:52 |
| *** stevemar has quit IRC | 13:52 | |
| tomoiaga | bknudson: for example, I am using keystone v3 and pass a token to nova directly. Nova won't need to authenticate anymore (I've done some work to overwrite the authentication method in nova to work things out, no big deal) | 13:53 |
| dstanek | csd: looks like there were no objections to it so you can probably pick up the patch and start fixing the issues | 13:53 |
| *** stevemar has joined #openstack-keystone | 13:53 | |
| csd | dstanek, okay. thanks. | 13:54 |
| *** kwss has joined #openstack-keystone | 14:06 | |
| marekd | stevemar: looks like SPs will be required no matter what way we choose in k2k bp. Let me start playing with that on Monday. | 14:12 |
| stevemar | marekd, you sure? I can probably pick that up, you are busy with client stuff? | 14:15 |
| hrybacki | dolphm: in regards to http://dolphm.com/openstack-juno-design-summit-outcomes-for-keystone/ -- how much progress has been made in the doc improvement speak underneath the Identity API v3 everywhere header? | 14:15 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 14:15 |
| marekd | stevemar: client is stalled as I'm waiting for some reviewers' input :/ | 14:15 |
| stevemar | marekd, alright, and then mapping engine improvements ... | 14:18 |
| marekd | stevemar: with that i would wait for geneal spec approval :-) | 14:18 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Simplified Mapping for Federated Authentication https://review.openstack.org/100280 | 14:18 |
| marekd | general | 14:18 |
| marekd | stevemar: instead of coding, you can make a good use of your power by looking here: https://review.openstack.org/#/c/83829/ | 14:25 |
| stevemar | marekd, i have the powerrrr | 14:25 |
| marekd | stevemar: you do | 14:26 |
| *** rwsu has joined #openstack-keystone | 14:27 | |
| *** daneyon has joined #openstack-keystone | 14:27 | |
| *** dstanek is now known as dstanek_zzz | 14:30 | |
| *** zhiyan is now known as zhiyan_ | 14:32 | |
| marekd | stevemar: actually, if you want to help with the client stuff, you can try it out with TFIM...unless I can get some access (which is not possible I am guessing). THere is some email with useful code inside. | 14:32 |
| ayoung | raildo, right now, if an endpoint wanted to fetch policy from Keystone, it would need to know the policy id | 14:33 |
| ayoung | how is it going to find that out? | 14:33 |
| *** tomoiaga has quit IRC | 14:33 | |
| stevemar | marekd, your assumption was correct | 14:34 |
| stevemar | marekd, since the k2k spec seems to be on the right path, i'll spend time reviewing client and testing it out | 14:35 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Simplified Mapping for Federated Authentication https://review.openstack.org/100280 | 14:35 |
| *** dstanek_zzz is now known as dstanek | 14:35 | |
| marekd | stevemar: thanks a lot, appreciate it! | 14:35 |
| stevemar | marekd, i wanted to make sure k2k was on the right path first.. | 14:35 |
| marekd | stevemar: reasonable goal | 14:35 |
| dstanek | stevemar, marekd: who is responsible for the "bursting" requirements? | 14:37 |
| marekd | dstanek: for federating clouds? | 14:37 |
| marekd | dstanek: or you are saying about tech step? | 14:37 |
| marekd | stevemar: i am about to start merging SAML ECP auth plugin with this https://review.openstack.org/#/c/79542/9 | 14:38 |
| dstanek | marekd: the k2k mentions it a few times and i'd like to see if i can get clarification | 14:38 |
| marekd | dstanek: i think it is not going to happen automatically - keystoneclient will probably not automatically change endpoints...at least not at the very beginning I am guessing. Right stevemar ? | 14:39 |
| *** comstud is now known as bearhands | 14:40 | |
| dstanek | marekd: when i think automatic i think on the nova side | 14:40 |
| dstanek | nova sees that it is nearing capacity and bursts to a different cloud | 14:40 |
| stevemar | dstanek, oh thats interesting | 14:40 |
| marekd | dstanek: i was not expecting to work it that way... | 14:41 |
| stevemar | i thought keystoneclient would do it | 14:41 |
| marekd | stevemar: ++ | 14:41 |
| stevemar | kwss, a +1 ! | 14:42 |
| stevemar | woooo | 14:42 |
| marekd | stevemar: saw it. | 14:42 |
| marekd | stevemar: i think it still needs some polishing, but it's definitely a good sign. | 14:42 |
| dstanek | how would ksc know that nova was at capacity? maybe keystonemiddleware (kmw) | 14:42 |
| stevemar | my weekend is officially starting off well | 14:42 |
| kwss | stevemar, :) | 14:43 |
| stevemar | oh i like the introduction of the kmw acronym | 14:43 |
| *** zzzeek has joined #openstack-keystone | 14:43 | |
| dstanek | i'm lazy and i hate to type | 14:43 |
| marekd | dstanek: i was predicting this would require human step. | 14:43 |
| marekd | dstanek: somebody once mentioned nova cannot monitor resource usage and capacity...am I right? | 14:44 |
| marekd | stevemar: did you ever have auto-burst in mind? | 14:44 |
| dstanek | marekd: the spec to me is ambiguous ... it says a will burst to b and if b if full b will burst to c | 14:44 |
| marekd | dstanek: i think it's too much for J release. | 14:45 |
| dstanek | in my view niether a or b will burst anywhere | 14:45 |
| marekd | or i would keep it as optional... | 14:45 |
| dstanek | marekd: nova really doesn't know how many more VMs it can create? | 14:46 |
| marekd | dstanek: i am nova noob, i don't know. | 14:46 |
| stevemar | dstanek, would the logic have to be introduced for other services, like cinder or glance? | 14:47 |
| dstanek | stevemar: i would image so if the intent is for them to do the bursting | 14:48 |
| marekd | they all already use keystoneclient, right? | 14:49 |
| marekd | (to cover all that token fun) | 14:49 |
| dstanek | marekd: probably | 14:49 |
| stevemar | dstanek, then i think it would make sense to make kmw or ksc handle this then, change it in one spot instead of many | 14:50 |
| dstanek | but you can put the bursting login directly into ksc only | 14:50 |
| marekd | dstanek: if you want to burst automatically how do you want services to choose what cloud to choose next? | 14:50 |
| dstanek | marekd: i'm not saying that we should do this at all - i'm saying the spec language implies to me that we are | 14:51 |
| dstanek | oh, actually there are a few new comments about bursting | 14:52 |
| marekd | i am wondering what are joesavak's opinion on new k2k proposal. | 14:52 |
| *** bobt has quit IRC | 14:53 | |
| dstanek | i have a meeting with him in a few - hopefully we cover it | 14:53 |
| marekd | dstanek: first big change - abandoning SAML/OIDC protocols in favor of something custom. | 14:54 |
| dstanek | yeah, i was catching up on the chat | 14:55 |
| marekd | dstanek: superb! :-) | 14:55 |
| dstanek | my only concern there is that we'll be reinventing the wheel | 14:55 |
| marekd | dstanek: well.. | 14:57 |
| *** ukalifon1 has joined #openstack-keystone | 14:59 | |
| kwss | Hi guys, probably a stupid question, but when I use a federated token to list projects, should I be putting it in the X-SUBJECT-TOKEN header? | 15:03 |
| marekd | kwss: hmmm, not x-auth-token ? | 15:06 |
| kwss | marekd, actually I tried in both X-AUTH-TOKEN and X-SUBJECT-TOKEN but I guess I did something wrong because the token is always rejected as invalid :S | 15:07 |
| marekd | kwss: hmm, your policies are ok? | 15:07 |
| kwss | marekd, I'm using the example policy, do I need to change it? | 15:08 |
| marekd | kwss: let me check | 15:10 |
| kwss | marekd, thanks! I didn't see anything about it in the docs but it's more than possible I missed it :) | 15:10 |
| marekd | kwss: https://github.com/openstack/keystone/blob/master/etc/policy.json#L140 it's there in default policy file so you should have it too... | 15:10 |
| kwss | marekd, hmm yes that's definitely in my policy, I must have messed up something else :S | 15:12 |
| marekd | kwss: logs dont say anything? | 15:13 |
| kwss | marekd, just "RBAC: Invalid token" | 15:14 |
| marekd | kwss: :( When you are getting unscoped token, you are copying X-Subject-Token value from that response and later put it in X-Auth-Token when listing projects, right? | 15:16 |
| kwss | marekd, yep | 15:16 |
| *** thedodd has joined #openstack-keystone | 15:19 | |
| marekd | kwss: in both cases api cannot find that token (wow, suprise) | 15:20 |
| marekd | this warning is logger either here: https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L75 or here: https://github.com/openstack/keystone/blob/master/keystone/middleware/core.py#L271 | 15:21 |
| *** openstackgerrit has quit IRC | 15:21 | |
| kwss | marekd, yea, but I can look in the mysql db and see the token there... | 15:22 |
| *** hrybacki has quit IRC | 15:23 | |
| marekd | kwss: you are using uuid? | 15:24 |
| kwss | marekd, no, PKI | 15:24 |
| *** hrybacki has joined #openstack-keystone | 15:25 | |
| marekd | kwss: i would just try to debug just before the exception is raised. | 15:26 |
| marekd | log whatever can be logged... | 15:26 |
| marekd | pdb w/ apache might be difficult i guess | 15:27 |
| *** david-lyle has joined #openstack-keystone | 15:29 | |
| kwss | marekd, if I put an error in the policy.json file, should the request fail? | 15:29 |
| stevemar | kwss, are you issuing a curl request, can you put it on http://paste.openstack.org/ ? | 15:29 |
| kwss | stevemar, I'm using a rest client, let me just try it with curl fast | 15:31 |
| stevemar | kwss, i was doing: curl -X GET -H "X-Auth-Token: $TOKEN_ID" http://localhost:5000/v3/OS-FEDERATION/projects | 15:32 |
| stevemar | and it was alright | 15:32 |
| *** ukalifon1 has quit IRC | 15:35 | |
| kwss | curl -X GET -H "X-Auth-Token: $TOKEN_ID" --insecure https://localhost:5000/v3/OS-FEDERATION/projects {"error": {"message": "The request you have made requires authentication. (Disable debug mode to suppress these details.)", "code": 401, "title": "Unauthorized"}} | 15:40 |
| kwss | stevemar, is it because it's https? I wouldn't have thought so though | 15:40 |
| marekd | kwss: i wouldnt say so... | 15:41 |
| marekd | (https) | 15:41 |
| *** openstackgerrit has joined #openstack-keystone | 15:45 | |
| *** afaranha has joined #openstack-keystone | 15:45 | |
| kwss | marekd, stevemar I got it!! Thanks so much. The rest client was inserting newlines into the token! Sorry to waste your time | 15:45 |
| marekd | kwss: uh, good to know it was not openstack ;-) | 15:46 |
| kwss | marekd, I was pretty sure it was my fault the whole time.. :D | 15:46 |
| marekd | kwss: not yours | 15:48 |
| *** hrybacki has quit IRC | 15:48 | |
| kwss | marekd, haha, you're too kind to my newbie mistakes ^^ | 15:49 |
| *** doddstack has joined #openstack-keystone | 15:52 | |
| stevemar | kwss, great to hear it was the rest client! | 15:52 |
| marekd | kwss: what rest client are you using (so others dont repeat that mistake)? :-) | 15:53 |
| kwss | It's a firefox plugin call RESTClient | 15:54 |
| *** BAKfr has quit IRC | 15:55 | |
| *** thedodd has quit IRC | 15:55 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/identity-api: Remove duplicate section title https://review.openstack.org/103177 | 15:55 |
| *** nsquare has quit IRC | 15:57 | |
| *** kwss has quit IRC | 16:01 | |
| *** sbasam has quit IRC | 16:04 | |
| *** erecio has quit IRC | 16:04 | |
| *** dstanek is now known as dstanek_zzz | 16:05 | |
| *** dstanek_zzz is now known as dstanek | 16:07 | |
| *** marekd is now known as marekd|away | 16:07 | |
| *** marekd|away is now known as marekd|weekend | 16:07 | |
| *** jsavak has joined #openstack-keystone | 16:09 | |
| *** joesavak has quit IRC | 16:11 | |
| *** joesavak has joined #openstack-keystone | 16:12 | |
| *** sbasam has joined #openstack-keystone | 16:13 | |
| *** jsavak has quit IRC | 16:14 | |
| *** sbasam has quit IRC | 16:14 | |
| boris-42 | dolphm morganfainberg Hi guys, if you are interested in getting osprofiler in keystone +1 this patch https://review.openstack.org/#/c/102362/ that adds it to global requieremtns=) | 16:18 |
| *** joesavak has quit IRC | 16:22 | |
| *** nsquare has joined #openstack-keystone | 16:32 | |
| morganfainberg | boris-42, what was the other patch you wanted me tolook at yesterday? sorry got swamped and am trying to find it in my backlog | 16:34 |
| *** xianghui has quit IRC | 16:34 | |
| *** joesavak has joined #openstack-keystone | 16:36 | |
| dolphm | boris-42: is osprofiler dependent on apache? | 16:37 |
| dolphm | boris-42: oh, that's the license! duh | 16:38 |
| morganfainberg | dolphm, :) | 16:38 |
| *** chandan_kumar has quit IRC | 16:46 | |
| *** hrybacki has joined #openstack-keystone | 16:47 | |
| *** praneshp has joined #openstack-keystone | 16:48 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Propose Specification for non-persistent-tokens https://review.openstack.org/95976 | 16:49 |
| morganfainberg | woooooo | 16:49 |
| morganfainberg | :) | 16:49 |
| *** sbasam has joined #openstack-keystone | 16:53 | |
| *** harlowja_away is now known as harlowja | 16:56 | |
| stevemar | dolphm, i'd appreciate some input on https://review.openstack.org/#/c/100023/14 :) | 17:03 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Correct the region table to be InnoDB and UTF8 https://review.openstack.org/102964 | 17:14 |
| *** tkelsey_ has quit IRC | 17:18 | |
| *** ukalifon1 has joined #openstack-keystone | 17:20 | |
| boris-42 | dolphm yep that is license=) | 17:25 |
| morganfainberg | dolphm, stevemar, ayoung, gyee, https://github.com/openstack/keystone/blob/master/keystone/common/config.py#L43 compute_port in keystone's config? | 17:25 |
| *** daneyon has quit IRC | 17:25 | |
| boris-42 | dolphm there is only one requirements WebOb | 17:25 |
| boris-42 | morganfainberg so I was speaking about this patch https://review.openstack.org/#/c/98836/ | 17:26 |
| boris-42 | morganfainberg but you already +2 it | 17:26 |
| morganfainberg | boris-42, yep, saw it after a lot of backlog searching | 17:26 |
| morganfainberg | :) | 17:26 |
| boris-42 | morganfainberg thx= | 17:26 |
| stevemar | morganfainberg, according to blame :P https://github.com/openstack/keystone/commit/23a4fe9ec7b9f3c007793e339110dc43e8781d6f | 17:26 |
| boris-42 | morganfainberg with plugins & profiler it will be super useful | 17:26 |
| boris-42 | morganfainberg finally easy to use=) | 17:27 |
| *** vhoward has joined #openstack-keystone | 17:27 | |
| morganfainberg | stevemar, sure, i might have changed it last there | 17:27 |
| stevemar | morganfainberg, it seems pointless though | 17:28 |
| morganfainberg | stevemar, https://github.com/openstack/keystone/commit/1ed2046eaa91fa36926d66a5fe1e88ccd65373bb before that | 17:28 |
| morganfainberg | stevemar, https://github.com/openstack/keystone/commit/1ed2046eaa91fa36926d66a5fe1e88ccd65373bb | 17:30 |
| morganfainberg | stevemar, looks like it originates about there | 17:30 |
| stevemar | morganfainberg, i did a search, i don't think it's used... | 17:30 |
| *** jsavak has joined #openstack-keystone | 17:31 | |
| *** doddstack has quit IRC | 17:31 | |
| morganfainberg | stevemar, running tests will remove if it isn't | 17:31 |
| stevemar | morganfainberg, we should double check with henrynash | 17:32 |
| morganfainberg | ? it was added back in 2012. | 17:32 |
| morganfainberg | by termie | 17:32 |
| morganfainberg | look at the last link | 17:32 |
| morganfainberg | stevemar, it's used for test i think | 17:34 |
| *** joesavak has quit IRC | 17:34 | |
| stevemar | morganfainberg, having a config option for a test sounds silly | 17:35 |
| morganfainberg | stevemar | 17:35 |
| morganfainberg | ye | 17:35 |
| gyee | morganfainberg, what's compute port doing in there? | 17:35 |
| stevemar | gyee, thats what we're trying to figure out :) | 17:35 |
| morganfainberg | gyee, it looks like it's used for testing | 17:35 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Extracting get group roles for project logic to drivers. https://review.openstack.org/86025 | 17:37 |
| gyee | morganfainberg, stevemar, I don't think it's been used | 17:38 |
| *** dstanek is now known as dstanek_zzz | 17:45 | |
| *** dstanek_zzz is now known as dstanek | 17:46 | |
| morganfainberg | gyee, stevemar, it's used | 17:49 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/catalog/backends/templated.py#L110 | 17:49 |
| *** joesavak has joined #openstack-keystone | 17:49 | |
| morganfainberg | in the templated backend | 17:49 |
| morganfainberg | it _assumes_ it can replace items in our default template with items from the keystone config object | 17:50 |
| morganfainberg | how is that useful... | 17:51 |
| morganfainberg | ?!! | 17:51 |
| morganfainberg | i mean the nova part | 17:51 |
| *** jsavak has quit IRC | 17:52 | |
| henrynash | morganfainberg: hi | 17:54 |
| morganfainberg | henrynash, heyya | 17:54 |
| henrynash | morganfainberg: was there a question for me? | 17:56 |
| morganfainberg | henrynash, nah, | 17:56 |
| *** dstanek is now known as dstanek_zzz | 17:57 | |
| henrynash | morganfainberg: oh, ok! | 17:57 |
| morganfainberg | henrynash, was trying to chase down why 'compute_port' was in the keystone config :P | 17:57 |
| morganfainberg | loooong history | 17:57 |
| henrynash | morganfainberg: yep, somewhere betweem columbus and madonna (the singer that is) | 17:57 |
| gyee | morganfainberg, I see. Compute port shouldn't be replaceable at catalog creation time | 17:57 |
| gyee | that's wrong | 17:57 |
| morganfainberg | gyee, yep fixing it now | 17:58 |
| gyee | that's static data | 17:58 |
| morganfainberg | uhuh | 17:58 |
| henrynash | morganfainberg, ayoung, dolphm, dstanek: both remaining multi-backend uuid patches are now posted (https://review.openstack.org/#/c/102430/ and https://review.openstack.org/#/c/74214) | 17:59 |
| ayoung | henrynash, thanks | 18:00 |
| *** thedodd has joined #openstack-keystone | 18:02 | |
| *** harlowja is now known as harlowja_away | 18:04 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not use keystone's config for nova's port https://review.openstack.org/103204 | 18:04 |
| bknudson | Does anyone know if our keystone docs ever said to set the identity endpoint to /v3? | 18:11 |
| bknudson | how would that work? applications don't know if identity endpoints supports v2 or v3. | 18:11 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not use keystone's config for nova's port https://review.openstack.org/103204 | 18:14 |
| *** harlowja_away is now known as harlowja | 18:15 | |
| _elmiko | bknudson: i was just reading the keystoneclient docs last night, and in the "Using API v3" page it recommends using the discovery mechanism. it looked like this avoided calling out the version and allowed discovery. | 18:20 |
| *** _elmiko is now known as elmiko | 18:20 | |
| elmiko | bknudson: http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html | 18:21 |
| elmiko | not sure if that's what you meant | 18:21 |
| bknudson | elmiko: I know that we've got the discovery thing, but I don't think that the other services that use keystone auth ever implemented it... especially in icehouse. | 18:22 |
| elmiko | bknudson: probably not(re: others implementing) | 18:22 |
| *** marcoemorais has joined #openstack-keystone | 18:24 | |
| *** bknudson has quit IRC | 18:38 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Consolidate provider calls to token_api.create_token https://review.openstack.org/73768 | 18:47 |
| morganfainberg | dolphm, wow forgot those even exists | 18:48 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Pass token expiry to the .create_token() method https://review.openstack.org/73769 | 18:50 |
| *** erecio has joined #openstack-keystone | 18:52 | |
| *** bknudson has joined #openstack-keystone | 18:53 | |
| dolphm | morganfainberg: this one looks hopeless, abandon? https://review.openstack.org/#/c/73477/ | 18:53 |
| dolphm | (re-abandon?) | 18:53 |
| morganfainberg | hmmm | 18:53 |
| morganfainberg | that one needs a lot more love | 18:54 |
| morganfainberg | i can probably fix it though | 18:54 |
| morganfainberg | i mean... we need to do that anyway | 18:55 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Add ``user`` object to the mapping rules examples. https://review.openstack.org/90121 | 18:55 |
| dolphm | morganfainberg: ack | 18:55 |
| hrybacki | dolphm: I think https://review.openstack.org/#/c/102602 is ready | 18:55 |
| dolphm | hrybacki: a test exercising the new defaults would be appreciated, but otherwise lgtm | 18:56 |
| *** bknudson has quit IRC | 18:57 | |
| hrybacki | ++ | 18:57 |
| morganfainberg | hrybacki, second the adding tests would be great | 18:58 |
| morganfainberg | hrybacki, but that can be done as a follow-up | 18:58 |
| morganfainberg | hrybacki, (please do it as a followup :) | 18:59 |
| hrybacki | morganfainberg: dumb new guy questions -- how does one do a followup? Is there a special procedure for that? There seems to be a lot of procedures for things around OS :P | 18:59 |
| morganfainberg | hrybacki, if you make a new commit on top of your current one, when you use git-review it'll ask if you want to submit both | 19:00 |
| hrybacki | nods, versus just an amend | 19:00 |
| morganfainberg | hrybacki, yep | 19:01 |
| openstackgerrit | yuriy brodskiy proposed a change to openstack/python-keystoneclient: fixing minor grammatical issue https://review.openstack.org/103218 | 19:01 |
| hrybacki | morganfainberg: thanks! | 19:01 |
| morganfainberg | hrybacki, and dont hesitate to ask questions, even if they seem dumb - we've all had to ask them at one point, happy to answer any i can | 19:02 |
| morganfainberg | (and it wasn't a dumb question) | 19:02 |
| hrybacki | hah, thank you. Working with such a large project has been quite the learning experience | 19:03 |
| morganfainberg | hrybacki, and (I hope) it's been fun too | 19:03 |
| hrybacki | morganfainberg: it gets more fun as I understand more -- as it stands nothing is simple to me. Even making two parameters optional has a wide range of side effects I can't fully grasp just yet | 19:04 |
| *** marcoemorais has quit IRC | 19:05 | |
| morganfainberg | hrybacki, yep. | 19:05 |
| *** marcoemorais has joined #openstack-keystone | 19:05 | |
| *** marcoemorais has quit IRC | 19:05 | |
| *** marcoemorais has joined #openstack-keystone | 19:06 | |
| *** marcoemorais has quit IRC | 19:06 | |
| *** marcoemorais has joined #openstack-keystone | 19:06 | |
| *** bknudson has joined #openstack-keystone | 19:11 | |
| *** achampion has joined #openstack-keystone | 19:18 | |
| *** praneshp has quit IRC | 19:20 | |
| *** openstackgerrit has quit IRC | 19:20 | |
| *** marcoemorais has quit IRC | 19:22 | |
| *** openstackgerrit has joined #openstack-keystone | 19:22 | |
| *** marcoemorais has joined #openstack-keystone | 19:22 | |
| *** marcoemorais has quit IRC | 19:22 | |
| *** dstanek_zzz is now known as dstanek | 19:23 | |
| *** marcoemorais has joined #openstack-keystone | 19:23 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Add initial service provider API for OS-FEDERATION https://review.openstack.org/103223 | 19:25 |
| morganfainberg | jdennis, ping if you have some time to look at LDAP stuff, https://review.openstack.org/#/c/95300/ it would be appreciated | 19:25 |
| *** marcoemorais has quit IRC | 19:25 | |
| *** marcoemorais has joined #openstack-keystone | 19:26 | |
| morganfainberg | jdennis, i'm doing a review of it now, but i'm happier when I have smarter and more knowledgeable follks input on this kind of stuff :) | 19:26 |
| jdennis | morganfainberg: ok, I'll try to take a peek | 19:27 |
| morganfainberg | jdennis, thanks. its not overly complex, but i feel like it could use more eyes, make sure I don't miss some subtlety in the LDAP front when using the pooling lib | 19:28 |
| jdennis | morganfainberg: rcrit is probably a good person as well to take a look, Rob is excellent at this stuff | 19:29 |
| ayoung | morganfainberg, is there any good reason to avoid putting the keystone endpoint id into the auth_token config? It will let us fetch policy by endpoint (if we want) and do endpoint binding of the tokens. We could do the first based on the service user, but not the second. I'm thinking we just bite the bullet and say "emdpoints need to know their own id" | 19:37 |
| nkinder | morganfainberg: I'm taking a look now too... | 19:37 |
| ayoung | me too | 19:38 |
| ayoung | that seems...invasive | 19:38 |
| nkinder | morganfainberg: have you done any benchmarking with/without the pool enabled? | 19:39 |
| *** vhoward- has joined #openstack-keystone | 19:41 | |
| ayoung | nkinder, morganfainberg doesn't it seems like that code should be a decorator on the PythonLDAPHandler(? | 19:41 |
| *** toddnni_ has joined #openstack-keystone | 19:41 | |
| *** raildo1 has joined #openstack-keystone | 19:41 | |
| *** gmurphy_ has joined #openstack-keystone | 19:42 | |
| *** jraim_ has joined #openstack-keystone | 19:42 | |
| *** raildo has quit IRC | 19:43 | |
| *** vhoward has quit IRC | 19:43 | |
| *** gmurphy has quit IRC | 19:43 | |
| *** jraim has quit IRC | 19:43 | |
| *** toddnni has quit IRC | 19:43 | |
| *** otwieracz has quit IRC | 19:43 | |
| *** huats has quit IRC | 19:43 | |
| *** toddnni_ is now known as toddnni | 19:43 | |
| ayoung | But I think that the changes look "right" | 19:43 |
| *** jraim_ is now known as jraim | 19:43 | |
| *** huats has joined #openstack-keystone | 19:43 | |
| *** huats has quit IRC | 19:43 | |
| *** huats has joined #openstack-keystone | 19:43 | |
| ayoung | nkinder, do you have any idea how we could test it? Is it just a case of having a replicated LDAP server? | 19:44 |
| nkinder | ayoung: you only need one LDAP server | 19:44 |
| nkinder | ayoung: it just reuses connections (and has multiple that it keeps open) | 19:44 |
| hrybacki | morganfainberg, dolphm: in regards to those tests -- it looks like I would only need to create one additional test in v2_0/test_endpoints as v2_0/test_shell already covers the use case, yeah? | 19:44 |
| *** otwieracz has joined #openstack-keystone | 19:44 | |
| ayoung | nkinder, to ensure it doesn't crash, yeah. But to test the pooling, you'd need two and kill one, no? | 19:44 |
| nkinder | ayoung: no, this is not for failover (though reconnect should be tested) | 19:45 |
| dolphm | hrybacki: i didn't look, but that sounds correct - copy/paste an existing test for that function, rename the new test, change the input to take advantage of the new defaults, and make sure the output is correct | 19:45 |
| hrybacki | dolphm++ | 19:45 |
| ayoung | nkinder, then what is means by "pool" if it is not "select one from a set of servers?" | 19:45 |
| nkinder | ayoung: a pool of connections (not necessarily servers) | 19:46 |
| ayoung | nkinder, ah...just reuse...OK, so this should be the default I'd expect? | 19:46 |
| nkinder | ayoung: it allows reuse, but also comes in handy when you have async LDAP operations | 19:46 |
| nkinder | ...but keystone can't/doesn't do that, right? | 19:47 |
| nkinder | morganfainberg: will keystone even try to perform multiple LDAP operations at the same time? | 19:49 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: Add tests for optional create endpoint params https://review.openstack.org/103229 | 19:49 |
| *** vhoward- has left #openstack-keystone | 19:50 | |
| jdennis | right off I see a few issues, shouldn't there be a min and max pool size? | 19:50 |
| nkinder | the other thing I don't like it that a connection stays bound as the last user who was authenticated | 19:51 |
| nkinder | ...and unbind is a no-op | 19:51 |
| jdennis | isn't the _common_ldap_initialization function stomping on global attributes? | 19:52 |
| jdennis | err, rather I mean global ldap config values | 19:52 |
| *** jsavak has joined #openstack-keystone | 20:02 | |
| *** david-lyle has quit IRC | 20:03 | |
| *** david-ly_ has joined #openstack-keystone | 20:04 | |
| *** thedodd has quit IRC | 20:05 | |
| *** joesavak has quit IRC | 20:06 | |
| jdennis | the code is setting and resetting every option on every call | 20:07 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/99278 | 20:08 |
| bknudson | if you unbind an ldap connection then it's disconnected | 20:08 |
| bknudson | so unbinding in a connection pool would essentially not be a pool | 20:08 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 20:08 |
| bknudson | maybe unbind would bind as a different user? | 20:08 |
| richm | in LDAPv3 you are supposed to be able to issue multiple bind requests on a connection to switch identities | 20:09 |
| *** erecio has quit IRC | 20:09 | |
| richm | one technique I have seen used is that the connection pool does a bind as a proxy user | 20:10 |
| richm | to authenticate as a "real" user, the connection pool issues a proxy authentication request using the identity and credentials of the "real" user | 20:10 |
| nkinder | bknudson: it can bind as anonymous or a proxy user | 20:10 |
| richm | this avoids bind overhead | 20:10 |
| bknudson | I like those options | 20:11 |
| richm | the 389 "ldap" backend (aka chaining/database link) uses this technique | 20:11 |
| jdennis | where is ConnectionManager defined? I don't see it | 20:12 |
| *** ukalifon1 has quit IRC | 20:13 | |
| morganfainberg | back | 20:15 |
| morganfainberg | nkinder, yeah i wasn't sure about the bind/unbind | 20:15 |
| morganfainberg | nkinder, i wanted to see what people thought first | 20:16 |
| ayoung | morganfainberg, you get the feeling we've upped our game on LDAP? | 20:16 |
| bknudson | jdennis: it's in ConnectionPool | 20:16 |
| morganfainberg | ayoung, maybe a little :P | 20:16 |
| bknudson | jdennis: it's in ldappool | 20:16 |
| jdennis | bknudson: I must be silly, but I don't see an ldappool in the changeset nor in master | 20:17 |
| nkinder | jdennis: it's an external lib | 20:18 |
| bknudson | jdennis: https://pypi.python.org/pypi/ldappool/ | 20:18 |
| morganfainberg | jdennis, it just cleared global reqs not too long ago | 20:18 |
| *** fifieldt has quit IRC | 20:19 | |
| morganfainberg | nkinder it sounds like we need a 'go bind as this user' type connection that is only ever used for that purpose | 20:20 |
| morganfainberg | nkinder, and the general use-case do things as keystone connection (or pool) | 20:20 |
| morganfainberg | nkinder so we don't perform things as a random user. | 20:20 |
| jdennis | I don't see how you differentiate connections with different options sharing the same URL | 20:21 |
| *** jraim has quit IRC | 20:21 | |
| *** jraim has joined #openstack-keystone | 20:21 | |
| nkinder | morganfainberg: yes, you could have an authentication pool and a regular lookup/other stuff pool | 20:21 |
| morganfainberg | nkinder, and the pool wouldn't get re-used across eventlet workers (keystone can be configured with multiple workers now), because if it could you could end up with weird pool stuffs | 20:23 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Migrate default extensions https://review.openstack.org/96326 | 20:23 |
| morganfainberg | jdennis, with what i'm describing, we'd just use a separate pool and only ever 'bind as user for auth purposes' from that pool, the other pool of connections would be used for the keystone ldap operations | 20:24 |
| jdennis | I guess that's why every ldap call resets every option :-( | 20:24 |
| morganfainberg | jdennis, =/ | 20:24 |
| ayoung | doing an authenticate should reset to connection at the end | 20:25 |
| ayoung | doing any other call should ensure that the connection is set as the admin user | 20:25 |
| ayoung | it can be one pool, or authenticate doesn't need to use a pool. | 20:25 |
| morganfainberg | ayoung, yes | 20:27 |
| nkinder | ayoung: ideally we would still use a pool for auth | 20:27 |
| nkinder | ...but, I'd prefer to have sssd handle all of this for us instead | 20:27 |
| ayoung | nkinder, oh, yes | 20:28 |
| ayoung | nkinder, but I suspect that the LDAP code will live on for a long while. Not everyone is going to be onboard with SSSD | 20:28 |
| *** rodrigods has quit IRC | 20:29 | |
| morganfainberg | richm's point with the prxy user is good too | 20:30 |
| morganfainberg | if we can do that in our ldap stuff it would solve the same issue | 20:30 |
| *** fifieldt has joined #openstack-keystone | 20:31 | |
| *** jsavak has quit IRC | 20:33 | |
| *** joesavak has joined #openstack-keystone | 20:42 | |
| *** navid has joined #openstack-keystone | 20:42 | |
| *** thedodd has joined #openstack-keystone | 20:45 | |
| *** otwierac1 has joined #openstack-keystone | 20:48 | |
| *** thedodd has quit IRC | 20:50 | |
| dstanek | morganfainberg: you ever see this http://logs.openstack.org/26/95826/6/gate/gate-keystone-python26/fa13f3c/console.html ? | 20:50 |
| morganfainberg | dstanek, looks like the wrong node was trying to run py26 | 20:51 |
| morganfainberg | or... cent6 node doesn't have py26 anymore? | 20:51 |
| dstanek | odd right? | 20:52 |
| *** otwieracz has quit IRC | 20:52 | |
| *** otwierac1 is now known as otwieracz | 20:52 | |
| morganfainberg | i'd raise that up w/ infra | 20:58 |
| morganfainberg | they might want to know. | 20:58 |
| dstanek | morganfainberg: there was a bug already for it | 21:00 |
| morganfainberg | ah | 21:00 |
| morganfainberg | cool | 21:00 |
| *** navid has quit IRC | 21:03 | |
| *** clayg has joined #openstack-keystone | 21:04 | |
| clayg | is this where the keystone devs hang out!? | 21:04 |
| morganfainberg | clayg, yep yep | 21:05 |
| clayg | I'm trying to review a swift patch for the keystone auth middleware that deals with domains, but my devstack setup only comes with users in the default domain | 21:05 |
| jdennis | clayg: ducks and runs, these are not the devs you're looking for :-) | 21:05 |
| clayg | https://review.openstack.org/#/c/86430/ | 21:05 |
| clayg | I hear that the keystone client is gunna support domains in the future, but I was wondering how you guys test out domains while that's all getting fleshed out | 21:06 |
| * clayg hopes for use_domains = true option in local.conf | 21:06 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove backend_entities from backend_ldap.conf https://review.openstack.org/103241 | 21:06 |
| clayg | ... but you know a blog post or gist or even a crappy opinonated curl script would probably get me back on track | 21:08 |
| clayg | I found http://www.mirantis.com/blog/manage-openstack-projects-using-domains-havana/ but it's all like - but it starts with "install this custom policy file" and I'm hoping it's gotten easier in the past 4 montsh? | 21:09 |
| *** jsavak has joined #openstack-keystone | 21:10 | |
| clayg | hrmmm... | 21:10 |
| * clayg lurks in case anyone wants to bust out some knowledge for me | 21:11 | |
| morganfainberg | clayg, ok sorry was in another convo at the moment you popped up | 21:11 |
| morganfainberg | clayg, if you're using V2 api for keystone, you will only ever get things back from v2. | 21:12 |
| clayg | morganfainberg: oh no worries brother, didn't mean to sound impatient :) | 21:12 |
| clayg | morganfainberg: i only managed to get as far as changint the auth_verison = 3.0 option in my authtoken middleware config - but I feel like that's a start! | 21:13 |
| clayg | morganfainberg: i'm told that I need to upgrade my swiftclient to get v3 token, but we have an associated patch for that - so I feel like that's getting closer | 21:13 |
| morganfainberg | clayg, sure that should be the starting place | 21:14 |
| clayg | morganfainberg: the last part of my understanding (and the limits of my expierence) are that I need a user that is not in the default domain - which brings me to keystone client support | 21:14 |
| morganfainberg | clayg, hm well from the shell, i don't think you can do it | 21:14 |
| morganfainberg | clayg, the CLI in keystoneclient is rather limited | 21:14 |
| *** david-ly_ has quit IRC | 21:14 | |
| clayg | morganfainberg: i'm guessing curl will let me - but no idea what the syntax might look like | 21:14 |
| morganfainberg | clayg, keystone client as a library has the support for V3 | 21:14 |
| clayg | morganfainberg: oh... unless maybe I can do it in horizon!? | 21:14 |
| *** joesavak has quit IRC | 21:14 | |
| morganfainberg | clayg, http://docs.openstack.org/developer/keystone/api_curl_examples.html | 21:15 |
| clayg | morganfainberg: ok, some some custom python scripts to make the api calls will probably work out for me? does anyone have anything lying about or could scr - nice :D | 21:15 |
| ayoung | dstanek, I'm trying to do some horizon auth development. I Have a packstack installed machine; all RPMs. I git cloned the django-openstack-auth repo and did sudo python ./setup.py develop to overwrite the RPM version of that code with thegit version, but I get | 21:15 |
| ayoung | File "/usr/lib64/python2.7/distutils/cmd.py", line 59, in __init__ | 21:15 |
| ayoung | raise TypeError, "dist must be a Distribution instance" | 21:15 |
| ayoung | is this a case of me having to pull multiple files in via PIP? | 21:15 |
| clayg | morganfainberg: that's a big ol' pile of win right there - i knew i came to the right place! | 21:16 |
| morganfainberg | ayoung, you can use 'pip -e <path>' as well | 21:16 |
| morganfainberg | ayoung it would do dependency resolution from pypi | 21:16 |
| morganfainberg | clayg, happy to help! | 21:16 |
| ayoung | morganfainberg, what pip command would that be? | 21:17 |
| morganfainberg | ayoung, oh sorry pip -e install <path> | 21:17 |
| morganfainberg | ayoung, erm | 21:17 |
| morganfainberg | install -e | 21:17 |
| morganfainberg | yeah install - | 21:17 |
| ayoung | morganfainberg, from a git repo | 21:17 |
| *** jsavak has quit IRC | 21:17 | |
| morganfainberg | e | 21:17 |
| morganfainberg | so if you're in the repo directory: pip install -e . | 21:17 |
| morganfainberg | might need sudo | 21:17 |
| morganfainberg | depends on your perms, or if you're installing in venv | 21:18 |
| morganfainberg | you wouldn't need sudo with a venv | 21:18 |
| ayoung | ah, I think it was the hacked PBR that messed things up | 21:18 |
| ayoung | morganfainberg, nah, I wanted somethingthat would survive a reboot no matter how I hacked it, so I start with Packstack (root install) | 21:20 |
| *** stevemar2 has joined #openstack-keystone | 21:22 | |
| *** bobt has joined #openstack-keystone | 21:24 | |
| *** zigo_ has joined #openstack-keystone | 21:24 | |
| *** shuffleb1t has joined #openstack-keystone | 21:26 | |
| *** jgriffit1 has joined #openstack-keystone | 21:26 | |
| morganfainberg | stevemar, careful stevemar2 is here now. i hear he's shady | 21:27 |
| *** morganfainberg is now known as stevemar3 | 21:27 | |
| stevemar3 | oh snap, stevemar3 | 21:27 |
| *** david-lyle has joined #openstack-keystone | 21:27 | |
| stevemar3 | bah it's not fun when he's not paying attention to irc | 21:27 |
| *** stevemar3 is now known as morganfainberg | 21:28 | |
| stevemar2 | stevemar3, i hate my isp | 21:28 |
| morganfainberg | stevemar2, :P | 21:28 |
| stevemar2 | morganfainberg, i'm thinking i should log off, got folks coming by | 21:29 |
| stevemar2 | morganfainberg, and now they are entering ... so i'm outta here, see ya later, likely | 21:30 |
| *** otwieracz has quit IRC | 21:31 | |
| *** jraim has quit IRC | 21:31 | |
| *** marcoemorais has quit IRC | 21:31 | |
| *** hrybacki has quit IRC | 21:31 | |
| *** stevemar has quit IRC | 21:31 | |
| *** mhu has quit IRC | 21:31 | |
| *** bearhands has quit IRC | 21:31 | |
| *** mrda-weekend has quit IRC | 21:31 | |
| *** mgagne has quit IRC | 21:31 | |
| *** dolphm has quit IRC | 21:31 | |
| *** vishy has quit IRC | 21:31 | |
| *** zigo has quit IRC | 21:31 | |
| *** jgriffith has quit IRC | 21:31 | |
| *** Ephur has quit IRC | 21:31 | |
| *** shufflebot has quit IRC | 21:31 | |
| *** uvirtbot has quit IRC | 21:31 | |
| *** radez is now known as radez_g0n3 | 21:32 | |
| *** stevemar2 has quit IRC | 21:35 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not support toggling key_manglers in cache layer https://review.openstack.org/103247 | 21:37 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Session Adapters https://review.openstack.org/86237 | 21:41 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Make parameters in EndpointManager optional https://review.openstack.org/102602 | 21:41 |
| *** dstanek is now known as dstanek_zzz | 21:42 | |
| *** rwsu has quit IRC | 21:49 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: endpoint policy https://review.openstack.org/99842 | 21:56 |
| *** dstanek_zzz is now known as dstanek | 22:03 | |
| *** henrynash has quit IRC | 22:04 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not support toggling key_manglers in cache layer https://review.openstack.org/103247 | 22:06 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/101800 | 22:08 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove db, db.sqlalchemy from openstack-common.conf https://review.openstack.org/103251 | 22:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Sync with oslo-incubator e9bb0b59 https://review.openstack.org/103252 | 22:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Update requirements to oslo.config>=1.4.0.0a1 https://review.openstack.org/103253 | 22:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Use config fixture from oslo.config https://review.openstack.org/103254 | 22:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove fixture from openstack-common.conf https://review.openstack.org/103255 | 22:10 |
| *** dstanek is now known as dstanek_zzz | 22:13 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/101404 | 22:13 |
| *** daneyon has joined #openstack-keystone | 22:38 | |
| *** daneyon has quit IRC | 22:38 | |
| *** daneyon has joined #openstack-keystone | 22:39 | |
| *** achampion has quit IRC | 22:49 | |
| *** dstanek_zzz is now known as dstanek | 22:51 | |
| *** elmiko is now known as _elmiko | 22:57 | |
| *** dstanek is now known as dstanek_zzz | 23:01 | |
| *** esp has joined #openstack-keystone | 23:05 | |
| *** david-lyle has quit IRC | 23:05 | |
| *** david-lyle has joined #openstack-keystone | 23:07 | |
| *** david-lyle has quit IRC | 23:11 | |
| *** bobt has quit IRC | 23:12 | |
| *** xianghui has joined #openstack-keystone | 23:18 | |
| *** dstanek_zzz is now known as dstanek | 23:30 | |
| *** openstackgerrit has quit IRC | 23:37 | |
| *** xianghui has quit IRC | 23:38 | |
| *** xianghui has joined #openstack-keystone | 23:50 | |
| *** daneyon has quit IRC | 23:51 | |
| *** rwsu has joined #openstack-keystone | 23:54 | |
| *** daneyon has joined #openstack-keystone | 23:54 | |
| *** zzzeek has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!