| openstackgerrit | A change was merged to openstack/keystone: update example with a status code we actually use https://review.openstack.org/104699 | 00:06 |
|---|---|---|
| *** gyee has quit IRC | 00:14 | |
| *** dims__ has quit IRC | 00:17 | |
| *** gokrokve has joined #openstack-keystone | 00:23 | |
| *** gokrokve has quit IRC | 00:27 | |
| *** dims__ has joined #openstack-keystone | 00:45 | |
| *** dims__ has quit IRC | 00:51 | |
| openstackgerrit | Anne Gentle proposed a change to openstack/identity-api: Updates pom and fixes a problem to fix the build https://review.openstack.org/104729 | 00:55 |
| *** rodrigods_ has joined #openstack-keystone | 01:02 | |
| *** mberlin1 has joined #openstack-keystone | 01:14 | |
| *** mberlin has quit IRC | 01:16 | |
| ayoung | jamielennox, doesn't seem to make a difference. | 01:21 |
| jamielennox | ayoung: i'm actually looking at some stuff now about client and unscoped tokens - it's a disaster | 01:22 |
| ayoung | jamielennox, yeah | 01:22 |
| ayoung | jamielennox, glad its not just me seeing this | 01:22 |
| ayoung | jamielennox, so here is how it should work | 01:22 |
| ayoung | if you create a mgmt=False client, you use the AUTH url for everything, but only allow a very little bit | 01:23 |
| ayoung | like user self admin and listing projects | 01:23 |
| ayoung | no catalog is good there: I'd like to make catalog optional, or at least not have it in the token. | 01:23 |
| *** rwsu has quit IRC | 01:23 | |
| jamielennox | ayoung: kind of, really you should be using public anyway | 01:23 |
| jamielennox | ayoung: but yes, i just wrote a patch that i haven't submitted yet so that you can ask for the auth_url | 01:25 |
| jamielennox | unrelated to what you're doing | 01:25 |
| ayoung | jamielennox, I need this for Horizon | 01:25 |
| jamielennox | ayoung: yea, makes sense - i'm not sure how it would work now | 01:27 |
| ayoung | jamielennox, I think I need a hack to make mgmt=False work, or something smarter to say "here is your management url" | 01:28 |
| ayoung | jamielennox, would that be part of the client, the session, or the Auth plugin? | 01:28 |
| ayoung | I'm thinking client | 01:29 |
| jamielennox | umm, session | 01:29 |
| jamielennox | hang on, i'll submit the one i'm working on | 01:29 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add the auth endpoint to the identity plugin base. https://review.openstack.org/104734 | 01:32 |
| jamielennox | ayoung: hmm, it doesn't make all that much sense without context ^ | 01:32 |
| *** diegows has quit IRC | 01:32 | |
| ayoung | jamielennox, I think client, not session | 01:32 |
| *** rodrigods_ has quit IRC | 01:32 | |
| ayoung | I think that two different clients should be able to use two different base urls, no? | 01:33 |
| jamielennox | ayoung: they do | 01:33 |
| jamielennox | that would mean saying that endpoint_filter={'interface': 'auth'} will always give you the auth_url | 01:33 |
| jamielennox | and then the idea would be to expose that at a higher level and cut out management altogether | 01:34 |
| jamielennox | because a boolean there is not expressive enough | 01:34 |
| jamielennox | ah, stupid shell tests doing there own mocking | 01:35 |
| *** junhongl has joined #openstack-keystone | 01:39 | |
| *** junhongl has quit IRC | 01:39 | |
| ayoung | jamielennox, so wouldn't it make sense to specify mgmt url as a kwarg when creating the client? | 01:41 |
| jamielennox | creating? no i don't think so - it's more a hangover from the v2 days where there was actually a difference between admin and public url | 01:42 |
| jamielennox | saying always use public would cut out a big chunk of what the client could actually do | 01:42 |
| jamielennox | i think as part of the adapter i allowed people to specify a default though | 01:43 |
| jamielennox | it makes more sense for other clients | 01:43 |
| *** dims__ has joined #openstack-keystone | 01:46 | |
| *** dims__ has quit IRC | 01:50 | |
| ayoung | jamielennox, so you have a patch that addresses this?> | 01:52 |
| jamielennox | ayoung: i'm trying to do things that will make it better | 01:53 |
| ayoung | jamielennox, I just need to make progress; I'm ok with a throwaway patch for now, so long as the general approach makes sense | 01:54 |
| jamielennox | ayoung: trying to figure out how to emulate this mess with sessions: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/tenants.py#L112-L120 | 01:54 |
| jamielennox | which i guess is exactly the same problem :) | 01:55 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Initial kerberos plugin implementation. https://review.openstack.org/74974 | 01:55 |
| jamielennox | i guess you can c&p that into v3 and i'll fix v3 projects at the same time | 01:55 |
| ayoung | jamielennox, into v3 list? | 01:56 |
| jamielennox | project list | 01:56 |
| jamielennox | if all you need is a hack for unscoped tokens | 01:56 |
| ayoung | jamielennox, ugh | 01:57 |
| ayoung | jamielennox, why not in CrudManager? | 01:57 |
| jamielennox | lovely isn't it | 01:57 |
| jamielennox | because it only applies to projects/tenants and a couple of user operations as they are the only things you can do with an unscoped token | 01:57 |
| ayoung | jamielennox, so what. Don't enforce policy on the client | 01:58 |
| ayoung | let them call whatever they want via the AUTH url, and then we'll restrict it on the server | 01:58 |
| jamielennox | i'm not following | 01:58 |
| jamielennox | it should only go within project list | 01:58 |
| ayoung | jamielennox, nah, let it go within the generic list function: Instead of getting the base URL from the service catalog, the user can explicitly set it. For all objects of a specific service | 02:02 |
| jamielennox | ayoung: what is the point of allowing v2 to list eg users on the auth_url? | 02:02 |
| ayoung | jamielennox, because a given deployment should be able to add or remove whatever they want from a given pipeline, and because we are trying to cut down dependence on the service catalog. | 02:03 |
| jamielennox | that's debatable on the service catalog - we're trying to change it but there is a lot of work that depends on keystone supplying a service catalog | 02:05 |
| jamielennox | if we make that same change everywhere then clients suddenly start having to manage there own catalogs again | 02:05 |
| jamielennox | as it is you are saying that the user should re-use the auth_url | 02:05 |
| ayoung | Auth URL is obvious for Keystone, but what about for the other clients? | 02:07 |
| jamielennox | so that generic list function is almost exactly the same everywhere | 02:08 |
| jamielennox | and it's one of the main pieces the oslo apiclient people are trying to synchronize | 02:08 |
| jamielennox | ayoung: take the hack for now, i'm doing some stuff in this area and i'll show you in a day or two | 02:09 |
| ayoung | jamielennox, wilco | 02:09 |
| jamielennox | it's the same level as bad as the v2 | 02:09 |
| jamielennox | isn't roger the agreement? | 02:10 |
| jamielennox | this file is completely untested: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/tokens.py | 02:11 |
| * jamielennox cries a little | 02:12 | |
| ayoung | jamielennox, http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/httpclient.py#n570 | 02:16 |
| *** zhiyan_ is now known as zhiyan | 02:17 | |
| ayoung | jamielennox,Morse code operators used to send just the R character to indicate a message received. When Radio came around, the Army came up ewith a Phonetic alphabet to help ake thing clear when spelling across the air. 'R' was Roger, just like A=Able, B=Baker,C=Charlie, and so on. roger means "recieved" due to the army not realizing that it was the same amount of syllables. And the Army has even changed the Phonetic | 02:19 |
| ayoung | Alphabet since then, so that R is now Romeo, but we all still say Roger due to old WWII flicks | 02:19 |
| ayoung | WILCO means Will Comply | 02:19 |
| ayoung | and it implies Received. | 02:19 |
| ayoung | So you are never supposed to say "Roger, Wilco" | 02:20 |
| ayoung | and Out (end of transmision) implies Over (I'm done speaking) | 02:20 |
| ayoung | but in the movies we hear "Roger Wilco, over and Out | 02:20 |
| ayoung | " | 02:20 |
| jamielennox | interesting | 02:21 |
| jamielennox | ayoung: did you want me to do anything with the link above? | 02:21 |
| ayoung | jamielennox, note them message: | 02:21 |
| ayoung | "concatenating self.management_url and url and" | 02:22 |
| jamielennox | yea, anything that goes through _cs is supposed to be authenticated | 02:22 |
| ayoung | but it doesn't seem to do that, it seems to just get the service catalog | 02:22 |
| jamielennox | however get/post/put etc all go through _cs | 02:22 |
| jamielennox | management_url should be the admin url from the catalog | 02:22 |
| ayoung | http://fpaste.org/115476/44405461/ | 02:22 |
| ayoung | why can't that be explicitly set? | 02:23 |
| ayoung | or can it... | 02:23 |
| jamielennox | i'm trying to make it settable | 02:23 |
| jamielennox | well at least that's what endpoint_filter is doing | 02:23 |
| jamielennox | any reason why you'd ever want to get a token from an admin url, like: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/tokens.py#L52-L59 | 02:24 |
| jamielennox | (implies v2) | 02:24 |
| *** dims__ has joined #openstack-keystone | 02:25 | |
| ayoung | jamielennox, um...yeah, there was...I want to say it was due to auth_token middleware, and only having a single URL to work with | 02:25 |
| jamielennox | ok, but auth_token definetly doesn't use that code | 02:25 |
| jamielennox | i guess my question is can i just change that to always use auth_url or do i need to try both | 02:26 |
| ayoung | jamielennox, I don't know. Lets assume that there is someone out htere that mkes use of every last dumb mistake we've ever mande | 02:31 |
| ayoung | made | 02:31 |
| ayoung | the real question is "do we care" | 02:32 |
| ayoung | jamielennox, what does _cs mean in _cs_request? | 02:37 |
| jamielennox | ayoung: no idea, that's way older than my involvement | 02:38 |
| jamielennox | it's present in novaclient and most others | 02:38 |
| jamielennox | but all through the testing as well you will see people calling a client cs - client.Client(..) | 02:38 |
| jamielennox | so cs was obviously something | 02:38 |
| *** hrybacki has joined #openstack-keystone | 02:55 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: add --rebuild option for ssl/pki_setup https://review.openstack.org/88207 | 03:00 |
| ayoung | jamielennox, OK, so I see why it wouldn't be a session wide thing, because the session is supposed to be for all endpoints, and this is specific to one. I think it makes sense for it to be client specific | 03:01 |
| openstackgerrit | Anne Gentle proposed a change to openstack/identity-api: Updates pom and fixes a problem to fix the build https://review.openstack.org/104729 | 03:08 |
| ayoung | jamielennox, do I want this review, then? https://review.openstack.org/#/c/104734/1 | 03:09 |
| jamielennox | ayoung: eventually, but it'll make more sense mixed in with the 4 or 5 others that i'm doing now | 03:10 |
| ayoung | jamielennox, ok. So here is the endstate: I want to use the kerberos plugin from horizon to authenticate, and get an unscoped token, and to then enumerate the projects for a user with that token. Then, once the user selects a project, they get a scoped token | 03:11 |
| jamielennox | yep | 03:12 |
| jamielennox | so it's just enumerating projects with an unscoped token that hasn't been tested | 03:13 |
| ayoung | I've tested it. It breaks | 03:18 |
| ayoung | but I assume that is what you are working on. I'll look for it on Monday. Please send me an email with the set of patches I need to apply and I'll give them a test. | 03:18 |
| *** ajc_ has joined #openstack-keystone | 03:28 | |
| *** ajc_ has quit IRC | 03:28 | |
| *** hrybacki has quit IRC | 03:29 | |
| *** ajc_ has joined #openstack-keystone | 03:30 | |
| *** bobt has quit IRC | 03:33 | |
| openstackgerrit | A change was merged to openstack/identity-api: Updates pom and fixes a problem to fix the build https://review.openstack.org/104729 | 03:42 |
| *** dims__ has quit IRC | 03:56 | |
| boris-42 | jamielennox hi | 04:09 |
| jamielennox | boris-42: hi | 04:09 |
| boris-42 | jamielennox I make new release of osprofiler | 04:09 |
| boris-42 | jamielennox so now it looks like https://review.openstack.org/#/c/103367/3/keystoneclient/session.py | 04:10 |
| boris-42 | jamielennox is it ok ? | 04:10 |
| jamielennox | great, yea that looks good | 04:10 |
| boris-42 | jamielennox as well I reply on your comment | 04:10 |
| jamielennox | thanks for that, i know it was a little bit over cautious | 04:10 |
| boris-42 | jamielennox no worries | 04:10 |
| boris-42 | jamielennox I agree that it looks better | 04:11 |
| boris-42 | jamielennox so it is better to change API before everybody start using it=) | 04:11 |
| jamielennox | yep | 04:11 |
| jamielennox | ok, i think i didn't present my point well for the commit message | 04:12 |
| jamielennox | i see what you mean you are looking at profiling calls to keystone, i was thinking it was keystone trying to profile other calls | 04:12 |
| boris-42 | jamielennox so in keystone there will be another patch | 04:13 |
| boris-42 | jamielennox with actually trace points | 04:13 |
| boris-42 | jamielennox so e.g. when you are making request to nova via nova python client | 04:13 |
| boris-42 | jamielennox user will get in trace tracepoints from keystone as well | 04:14 |
| boris-42 | jamielennox which is nice | 04:14 |
| jamielennox | yea, just a word in commit message that turns it around | 04:14 |
| jamielennox | i put a comment on there | 04:14 |
| boris-42 | jamielennox lemme see | 04:14 |
| jamielennox | the first line is still keystoneclient because it's keystoneclient that you use to talk to keystone | 04:14 |
| *** openstackgerrit has quit IRC | 04:14 | |
| boris-42 | jamielennox yep but the keystone is actually profiled.. | 04:14 |
| jamielennox | the s/in/for comment is what made me think you were trying to do things in keystone server | 04:15 |
| boris-42 | jamielennox yep agree with s/in/for/ | 04:15 |
| jamielennox | if you can fix those two (you can do it from gerrit directly) i'll + | 04:15 |
| jamielennox | 2 | 04:15 |
| boris-42 | jamielennox done | 04:16 |
| jamielennox | cool, _2 | 04:17 |
| jamielennox | +2 | 04:17 |
| boris-42 | jamielennox thanks | 04:17 |
| boris-42 | jamielennox we will need actually as well one more small change in ceilometer | 04:17 |
| boris-42 | jamielennox https://github.com/openstack/ceilometer/blob/master/ceilometer/profiler/notifications.py#L39 | 04:18 |
| boris-42 | jamielennox need to add here exchange | 04:18 |
| jamielennox | that's ok, it shouldn't affect the keystoneclient side at all, the headers will get used when ceilometer catches up | 04:19 |
| boris-42 | jamielennox so quite soon profiler can be available in python gates | 04:19 |
| boris-42 | jamielennox yep | 04:19 |
| boris-42 | jamielennox it's more about getting this in gate running=) | 04:19 |
| boris-42 | which is my major goal | 04:19 |
| boris-42 | combine benchmarks & profiling | 04:19 |
| jamielennox | will be good to see, i don't think there has been enough done looking at profiling | 04:20 |
| *** dims__ has joined #openstack-keystone | 04:22 | |
| boris-42 | jamielennox ? | 04:22 |
| jamielennox | boris-42: never mind, i was agreeing with you | 04:22 |
| boris-42 | jamielennox heh=) | 04:22 |
| boris-42 | jamielennox btw what about moving bin/* folder to keystone/cmd/* like in other projects?) | 04:23 |
| boris-42 | jamielennox I spend 1 hour to find it lol=) | 04:23 |
| *** dims__ has quit IRC | 04:24 | |
| jamielennox | heh, i think it's just because we don't use setuptools for those entry points, it is actually a script | 04:24 |
| jamielennox | if you want to convert it i think people would accept it | 04:24 |
| boris-42 | if __name__ == '__main__': | 04:24 |
| boris-42 | ahh I see | 04:24 |
| boris-42 | yep probably it will be better to convert | 04:25 |
| boris-42 | will be cleaner for newbies like me | 04:25 |
| boris-42 | =) | 04:25 |
| *** gokrokve has joined #openstack-keystone | 04:27 | |
| boris-42 | jamielennox so here is the patch in the project https://review.openstack.org/#/c/103368/9 | 04:37 |
| *** hrybacki has joined #openstack-keystone | 04:51 | |
| *** dstanek is now known as dstanek_zzz | 04:58 | |
| *** hrybacki has quit IRC | 05:05 | |
| *** amcrn has quit IRC | 05:07 | |
| *** gokrokve has quit IRC | 05:11 | |
| *** dims has joined #openstack-keystone | 05:24 | |
| *** chandan_kumar has joined #openstack-keystone | 05:29 | |
| *** dims has quit IRC | 05:29 | |
| *** andreaf has joined #openstack-keystone | 05:44 | |
| *** KanagarajM has joined #openstack-keystone | 05:54 | |
| *** chandan_kumar has quit IRC | 06:01 | |
| *** henrynash has joined #openstack-keystone | 06:17 | |
| *** stevemar has quit IRC | 06:19 | |
| *** KanagarajM has quit IRC | 06:31 | |
| *** KanagarajM has joined #openstack-keystone | 06:32 | |
| *** tkelsey has joined #openstack-keystone | 06:37 | |
| *** chandan_kumar has joined #openstack-keystone | 06:38 | |
| *** KanagarajM has quit IRC | 06:39 | |
| *** afazekas_ has joined #openstack-keystone | 06:39 | |
| *** KanagarajM has joined #openstack-keystone | 06:39 | |
| *** BAKfr has joined #openstack-keystone | 07:13 | |
| *** andreaf has quit IRC | 07:13 | |
| *** andreaf has joined #openstack-keystone | 07:14 | |
| *** dims_ has joined #openstack-keystone | 07:26 | |
| *** dims_ has quit IRC | 07:31 | |
| *** mrda is now known as mrda-away | 07:41 | |
| *** KanagarajM has quit IRC | 07:45 | |
| *** amerine has quit IRC | 07:51 | |
| *** leseb has joined #openstack-keystone | 07:57 | |
| *** openstackgerrit has joined #openstack-keystone | 08:19 | |
| *** KanagarajM has joined #openstack-keystone | 08:24 | |
| *** dims_ has joined #openstack-keystone | 08:26 | |
| *** dims_ has quit IRC | 08:33 | |
| *** dstanek_zzz is now known as dstanek | 08:40 | |
| *** bvandenh has joined #openstack-keystone | 08:45 | |
| *** leseb has quit IRC | 08:47 | |
| *** leseb has joined #openstack-keystone | 08:48 | |
| *** leseb has quit IRC | 08:52 | |
| *** dstanek is now known as dstanek_zzz | 09:05 | |
| *** oomichi has quit IRC | 09:08 | |
| *** leseb has joined #openstack-keystone | 09:09 | |
| openstackgerrit | gordon chung proposed a change to openstack/keystone-specs: move audit middleware to keystonemiddleware repo https://review.openstack.org/104584 | 09:37 |
| openstackgerrit | gordon chung proposed a change to openstack/keystone-specs: move audit middleware to keystonemiddleware repo https://review.openstack.org/104584 | 09:38 |
| *** praneshp has quit IRC | 09:52 | |
| *** gordc has joined #openstack-keystone | 09:54 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Implement Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 09:55 |
| *** xianghui has quit IRC | 09:55 | |
| *** xianghui has joined #openstack-keystone | 09:56 | |
| *** chandan_kumar is now known as chandankumar | 09:59 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Make OS-FEDERATION core.Driver methods abstract https://review.openstack.org/104851 | 10:12 |
| *** leseb has quit IRC | 10:13 | |
| *** marekd|away is now known as marekd | 10:13 | |
| *** leseb has joined #openstack-keystone | 10:13 | |
| *** leseb has quit IRC | 10:18 | |
| *** gokrokve has joined #openstack-keystone | 10:41 | |
| *** rodrigods_ has joined #openstack-keystone | 10:46 | |
| *** rodrigods_ has quit IRC | 10:57 | |
| *** gokrokve has quit IRC | 10:59 | |
| *** leseb has joined #openstack-keystone | 10:59 | |
| *** leseb has quit IRC | 11:04 | |
| *** zhiyan is now known as zhiyan_ | 11:12 | |
| *** leseb has joined #openstack-keystone | 11:15 | |
| *** htruta has quit IRC | 11:26 | |
| *** rodrigods_ has joined #openstack-keystone | 11:29 | |
| *** dims has joined #openstack-keystone | 11:31 | |
| *** dims has quit IRC | 11:35 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Make OS-FEDERATION core.Driver methods abstract https://review.openstack.org/104851 | 11:47 |
| *** openstackgerrit has quit IRC | 11:49 | |
| *** openstackstatus has quit IRC | 11:50 | |
| *** openstack has joined #openstack-keystone | 11:50 | |
| *** openstackgerrit has joined #openstack-keystone | 11:50 | |
| *** openstackstatus has joined #openstack-keystone | 11:51 | |
| *** ChanServ sets mode: +v openstackstatus | 11:51 | |
| *** rodrigods_ has quit IRC | 11:52 | |
| *** rodrigods_ has joined #openstack-keystone | 11:53 | |
| *** KanagarajM has quit IRC | 12:02 | |
| *** rodrigods_ has quit IRC | 12:05 | |
| *** afaranha has quit IRC | 12:07 | |
| *** ajc_ has quit IRC | 12:07 | |
| *** htruta has joined #openstack-keystone | 12:10 | |
| *** dhellmann is now known as dhellmann_ | 12:20 | |
| *** therve has joined #openstack-keystone | 12:34 | |
| *** htruta has quit IRC | 12:36 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: multi-backend support for identity https://review.openstack.org/74214 | 12:39 |
| *** dstanek_zzz is now known as dstanek | 12:52 | |
| *** diegows has joined #openstack-keystone | 12:53 | |
| *** leseb has quit IRC | 12:59 | |
| *** leseb has joined #openstack-keystone | 13:02 | |
| *** dims has joined #openstack-keystone | 13:09 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Implement Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 13:34 |
| rodrigods | marekd, I suppose there is a needed change at keystoneclient as well? ^ | 13:41 |
| marekd | rodrigods: in general or now? | 13:42 |
| rodrigods | marekd, in general | 13:42 |
| marekd | rodrigods: BTW, this is WIP :-) | 13:42 |
| marekd | rodrigods: ah, you mean for Service provider's CRUD? | 13:42 |
| marekd | well, yes, but I wouldn't bother right now... | 13:43 |
| marekd | rodrigods: i am building some stub for Service Providers but the end result may be sslightly different. | 13:43 |
| marekd | that's why it will be wip until we finalize specs | 13:43 |
| rodrigods | marekd, cool, will try to be updated with this =) | 13:44 |
| marekd | sure :-) | 13:44 |
| marekd | btw | 13:45 |
| marekd | if you want to help with keystoneclient and Icehouse federation | 13:45 |
| marekd | ...do you have access to some SAML IdPs ? | 13:45 |
| rodrigods | marekd, yeah, we've made a deploy here in the lab to test Icehouse federation | 13:46 |
| rodrigods | is there anything to be implemented at keystoneclient? | 13:46 |
| marekd | what idp? | 13:46 |
| marekd | rodrigods: ^^ | 13:46 |
| rodrigods | Shibboleth | 13:47 |
| marekd | hm, do you fancy playing with https://review.openstack.org/#/c/99704/ and the depending patch? | 13:47 |
| rodrigods | marekd, never used it, but seems something nice to play with =) | 13:49 |
| marekd | i'd appreciate :-) | 13:50 |
| marekd | i tested it against real shib IdP, but the more eyes on that the better. | 13:50 |
| rodrigods | marekd, cool | 13:51 |
| marekd | reviews appreciated as well :-) | 13:52 |
| marekd | rodrigods: but that's obvious :-) | 13:52 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add schema check for OS-FEDERATION mapping table https://review.openstack.org/104896 | 13:52 |
| marekd | rodrigods: i will need to wrap the ecp plugins with another class but generally the workflow and the core code stays... | 13:53 |
| marekd | until we figure out there is something fundamentally wrong :-) | 13:54 |
| *** bvandenh has quit IRC | 13:59 | |
| rodrigods | marekd, nice | 14:03 |
| *** gordc has quit IRC | 14:09 | |
| *** chandankumar has quit IRC | 14:17 | |
| *** chandankumar has joined #openstack-keystone | 14:25 | |
| *** gokrokve has joined #openstack-keystone | 14:31 | |
| *** stevemar has joined #openstack-keystone | 14:38 | |
| openstackgerrit | Jordan Pittier proposed a change to openstack/python-keystoneclient: Ensure no double slash in get token URL https://review.openstack.org/104911 | 14:46 |
| *** rodrigods_ has joined #openstack-keystone | 14:56 | |
| *** rodrigods_ has quit IRC | 15:03 | |
| *** gokrokve has quit IRC | 15:04 | |
| *** richm has joined #openstack-keystone | 15:08 | |
| *** richm has left #openstack-keystone | 15:08 | |
| *** topol has joined #openstack-keystone | 15:13 | |
| *** rodrigods_ has joined #openstack-keystone | 15:18 | |
| *** rodrigods_ has quit IRC | 15:21 | |
| *** leseb has quit IRC | 15:43 | |
| *** leseb has joined #openstack-keystone | 15:43 | |
| *** leseb has quit IRC | 15:48 | |
| stevemar | marekd, ping | 15:53 |
| *** BAKfr has quit IRC | 15:54 | |
| marekd | stevemar: hey | 16:01 |
| stevemar | marekd, it's so busy today! | 16:02 |
| stevemar | :D | 16:02 |
| marekd | July 4th :D | 16:02 |
| marekd | do you know if the docs' bug if now fixed? | 16:04 |
| marekd | there are couple of patches pending ;/ | 16:04 |
| stevemar | marekd, i doubt it, just try rechecking :P | 16:05 |
| marekd | stevemar: nah, i will be more eco and save some CPUs cycles :P | 16:06 |
| stevemar | marekd, oh maybe, this was merged: https://review.openstack.org/#/c/104729/ | 16:06 |
| *** hrybacki has joined #openstack-keystone | 16:07 | |
| marekd | stevemar: i can see you are doing the job :D | 16:08 |
| stevemar | marekd, the gate isn't exactly under heavy load atm :P | 16:08 |
| stevemar | marekd, yep! done! | 16:08 |
| stevemar | marekd, so how did you want to split up the k2k work? | 16:08 |
| stevemar | you've got a handle on SP? | 16:08 |
| marekd | stevemar: should be easy. | 16:09 |
| stevemar | i can update idp w/ public keys? | 16:09 |
| marekd | stevemar: sure. Do you want to add an attribute? | 16:09 |
| stevemar | marekd, yeah, add a column to the table, i can do mapping enhancements if they are required (project, role, domain) | 16:09 |
| stevemar | marekd, the auth piece should be similar, but need to verify it's signed properly | 16:10 |
| marekd | stevemar: hmmm, TBH I woiuld hold off with that: adding an attribute to IdP can be easy, but mapping enhacements. After yesterday's discussions are we sure we will use custome protocol and not get back to saml idea? | 16:11 |
| marekd | I am not so sure...;/ | 16:11 |
| stevemar | yeah :( | 16:11 |
| marekd | so it's of course up to your decision but you very likely can waste your time. | 16:11 |
| marekd | i think SPs will be used anyway, so i started doing that. But mappings? I am not sure. I think lots will happen during the hackathon. | 16:12 |
| marekd | how about you trying saml ecp client plugin aith TFIM? | 16:12 |
| marekd | i don't the access and I am very interested how it works ;/ | 16:12 |
| marekd | so we can confirm it works with IBM product. | 16:12 |
| *** leseb has joined #openstack-keystone | 16:14 | |
| *** gokrokve has joined #openstack-keystone | 16:15 | |
| *** leseb has quit IRC | 16:15 | |
| *** leseb has joined #openstack-keystone | 16:15 | |
| *** tkelsey has quit IRC | 16:15 | |
| *** leseb has quit IRC | 16:15 | |
| *** gokrokve has quit IRC | 16:19 | |
| *** topol has quit IRC | 16:23 | |
| marekd | stevemar: i am out of here. Flying to the States tmrw | 16:30 |
| marekd | see ya on Tuesday! | 16:30 |
| *** marekd is now known as marekd|away | 16:31 | |
| *** chandankumar has quit IRC | 16:36 | |
| openstackgerrit | A change was merged to openstack/identity-api: Revert "Trusted Attributes Policy for External Identity Providers" https://review.openstack.org/103986 | 16:38 |
| openstackgerrit | A change was merged to openstack/identity-api: Fix links sections in federation mapping docs https://review.openstack.org/103888 | 16:41 |
| *** raildo has left #openstack-keystone | 16:58 | |
| *** rodrigods has quit IRC | 16:58 | |
| *** praneshp has joined #openstack-keystone | 16:58 | |
| stevemar | yay things merged! | 17:06 |
| *** thedodd has joined #openstack-keystone | 17:13 | |
| *** achampion has quit IRC | 17:13 | |
| *** thedodd has quit IRC | 17:28 | |
| *** afazekas_ has quit IRC | 17:29 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Remove duplicate section title https://review.openstack.org/103177 | 17:55 |
| morganfainberg | omg | 17:57 |
| morganfainberg | mergeseseseseseseses | 17:57 |
| morganfainberg | ? | 17:57 |
| morganfainberg | stevemar, thats right, you don't get the day off do ya? | 17:57 |
| morganfainberg | stevemar, since you work today *shifty eyes* | 17:58 |
| morganfainberg | stevemar, mind takeing a look at https://review.openstack.org/#/c/104026/ - i need a couple +2s on it (even failing tempest) before we can merge the tempest fixes. | 17:58 |
| morganfainberg | stevemar, even a +1 saying you'd support the change would be good and/or lots of comments | 17:58 |
| stevemar | morganfainberg, yes... today... *shifty eyes* | 17:58 |
| stevemar | i'm holding down the fort! | 17:58 |
| stevemar | morganfainberg, oof ... yes, that one | 17:59 |
| morganfainberg | i'm gonna go buy some new cycling gear today | 18:00 |
| morganfainberg | maybe a new car | 18:00 |
| morganfainberg | gonna go for a nice big bike ride tomorrow morning :) | 18:00 |
| morganfainberg | and then pack for the meetup on... uh... sunday i think or monday | 18:00 |
| stevemar | morganfainberg, things are open? | 18:00 |
| stevemar | i thought stores would be closed up? | 18:01 |
| morganfainberg | lots of stuff is open | 18:01 |
| morganfainberg | the 4th is a big sale day | 18:01 |
| morganfainberg | they just close early | 18:01 |
| morganfainberg | nah. | 18:02 |
| morganfainberg | banks are closed | 18:02 |
| stevemar | i guess just retail is open then | 18:02 |
| morganfainberg | the 4th is a big money day. so retail and such are open | 18:02 |
| morganfainberg | yeah. services companies get the day off, etc | 18:03 |
| *** achampion has joined #openstack-keystone | 18:10 | |
| *** diegows has quit IRC | 18:13 | |
| *** achampion has quit IRC | 18:14 | |
| *** tkelsey has joined #openstack-keystone | 18:19 | |
| *** diegows has joined #openstack-keystone | 18:25 | |
| *** tkelsey has quit IRC | 18:32 | |
| openstackgerrit | A change was merged to openstack/identity-api: Updated from global requirements https://review.openstack.org/104383 | 18:36 |
| *** achampion has joined #openstack-keystone | 18:57 | |
| *** diegows has quit IRC | 18:58 | |
| boris-42 | morganfainberg around | 18:59 |
| morganfainberg | boris-42, breifly | 19:00 |
| boris-42 | morganfainberg heh happy holidays btw=) why are you working lol?) | 19:00 |
| morganfainberg | boris-42, not working, just ahppen to be on the computer where IRC is logged in :) | 19:00 |
| boris-42 | morganfainberg =) | 19:00 |
| boris-42 | morganfainberg so about profiling it's ready to be merged.. | 19:01 |
| morganfainberg | nice! | 19:01 |
| boris-42 | morganfainberg so guys can we somehow put priority for it? | 19:01 |
| boris-42 | morganfainberg so probably during next thing I'll automate everything in rally | 19:01 |
| morganfainberg | i'll look at it either sunday or monday. | 19:01 |
| morganfainberg | we're at the hackathon next week, so it'll be easier to review some of thise stuff | 19:01 |
| boris-42 | morganfainberg yep that will be nice | 19:01 |
| morganfainberg | boris-42, so, since apache performance should be a bit better: https://review.openstack.org/#/q/status:open+topic:bug/1334368,n,z | 19:02 |
| boris-42 | morganfainberg so here are 2 super tiny pathces | 19:02 |
| boris-42 | morganfainberg https://review.openstack.org/#/c/103367/ | 19:02 |
| boris-42 | morganfainberg https://review.openstack.org/#/c/103368/ | 19:02 |
| morganfainberg | those are the reviews that block apache keystone | 19:02 |
| boris-42 | morganfainberg btw something happened with perfromance | 19:02 |
| boris-42 | morganfainberg and it's already better | 19:02 |
| morganfainberg | well we have had a bunch of things shift | 19:03 |
| boris-42 | morganfainberg compare pls | 19:03 |
| boris-42 | morganfainberg http://logs.openstack.org/63/91463/1/check/check-rally-dsvm-rally/30e0b0c/rally-plot/results.html.gz | 19:03 |
| morganfainberg | and eventlet now _can_ run multi worker | 19:03 |
| boris-42 | morganfainberg http://logs.openstack.org/68/103368/10/check/check-rally-dsvm-keystone/2643b72/rally-plot/results.html.gz | 19:04 |
| hrybacki | morganfainberg: if you're doing quick reviews I'd love if you could glance at these ;) https://review.openstack.org/#/c/103229/ and https://review.openstack.org/#/c/103989/ -- trying to get them merged before they are forgotten! | 19:04 |
| boris-42 | morganfainberg so compare thoos things | 19:04 |
| boris-42 | hrybacki hm why they should be random? | 19:04 |
| boris-42 | hrybacki https://review.openstack.org/#/c/103989/3/keystoneclient/tests/v2_0/test_endpoints.py | 19:04 |
| boris-42 | hrybacki personally I dislike random in tests | 19:05 |
| hrybacki | boris-42: as per bknudson | 19:05 |
| morganfainberg | boris-42, also we have seen a change based upon the clouds tempest runs in. | 19:05 |
| boris-42 | morganfainberg ? | 19:05 |
| boris-42 | morganfainberg but it's not related to rally gates at all | 19:05 |
| morganfainberg | boris-42, running in different hp / rax clouds/AZ/etc has produced different results on _anything_ we run | 19:05 |
| boris-42 | morganfainberg or you mean that tempest is passing faster | 19:05 |
| morganfainberg | boris-42, so if you land in a slow now, rally would be slow | 19:06 |
| morganfainberg | slow node* | 19:06 |
| boris-42 | morganfainberg yep it will be slower a bit | 19:06 |
| morganfainberg | generally, i think the underlying VMs have been better lately with the changes | 19:06 |
| boris-42 | morganfainberg but there is no more such crap | 19:06 |
| morganfainberg | also, we run tempest in trusty now not precise | 19:06 |
| morganfainberg | 14.04 vs 12.04 | 19:06 |
| morganfainberg | different kernels | 19:06 |
| boris-42 | morganfainberg ahh | 19:06 |
| morganfainberg | different lots of stuff | 19:06 |
| boris-42 | morganfainberg in any case you are getting better result now=) | 19:06 |
| morganfainberg | yep | 19:07 |
| boris-42 | morganfainberg ooo | 19:07 |
| boris-42 | morganfainberg thanks https://review.openstack.org/#/c/103367/ | 19:07 |
| boris-42 | !! | 19:07 |
| openstack | boris-42: Error: "!" is not a valid command. | 19:07 |
| morganfainberg | boris-42, yeah that was an easy one | 19:07 |
| boris-42 | morganfainberg the second one is as well easy | 19:07 |
| boris-42 | morganfainberg we will have a bit to hack devstack gate project | 19:07 |
| boris-42 | morganfainberg to be able to enable in rally gates profiling | 19:07 |
| morganfainberg | boris-42, the 2nd one takes more than a quick glance | 19:08 |
| morganfainberg | boris-42, and i need to run to a store before they close today | 19:08 |
| boris-42 | morganfainberg he | 19:08 |
| boris-42 | morganfainberg btw fyi | 19:08 |
| boris-42 | morganfainberg I updated read me file | 19:08 |
| boris-42 | morganfainberg https://github.com/stackforge/osprofiler | 19:08 |
| morganfainberg | hrybacki, those are a bit more involved than a quick glance right now can get done | 19:08 |
| boris-42 | morganfainberg so it will help you a lot | 19:08 |
| morganfainberg | hrybacki, i'll need to circle back later on | 19:08 |
| hrybacki | morganfainberg: ++ thank you! | 19:08 |
| boris-42 | morganfainberg so just read the read me file=) | 19:09 |
| morganfainberg | boris-42, nice! | 19:09 |
| morganfainberg | hehe | 19:09 |
| boris-42 | morganfainberg and you'll understand what is happening=) | 19:09 |
| *** jdennis has quit IRC | 19:09 | |
| morganfainberg | boris-42, if you have any kind of real workloads to test https://review.openstack.org/#/c/103304/ on, i'd appreciate it | 19:09 |
| morganfainberg | boris-42, i'm trying to justify the work and continuing on that path | 19:10 |
| boris-42 | morganfainberg to put some rally jobs? | 19:10 |
| morganfainberg | boris-42, but it's looking like a wash fom tempest and rally | 19:10 |
| boris-42 | morganfainberg I mean benchmarks in task of rally | 19:10 |
| morganfainberg | boris-42, not just for rally, but from a "is this change benefitting us at all" | 19:10 |
| morganfainberg | boris-42, right, but rally is contrived, and the benchmark isn't as defined as a real workload | 19:10 |
| morganfainberg | boris-42, yet | 19:10 |
| morganfainberg | boris-42, eventually it'll be more rounded, i'm positive | 19:11 |
| boris-42 | morganfainberg but actually with random() | 19:11 |
| boris-42 | morganfainberg we can trigger a lot of operations | 19:11 |
| morganfainberg | boris-42, but i'm looking for shorter term "does this really make things better, worse, or no change" | 19:11 |
| morganfainberg | sure. | 19:11 |
| boris-42 | morganfainberg or we can just run multiply commands | 19:11 |
| morganfainberg | hehe | 19:11 |
| morganfainberg | like i said, looking to find if that makes any real difference | 19:11 |
| boris-42 | morganfainberg btw we can test it on local installation | 19:11 |
| boris-42 | morganfainberg so it will be the same hardware | 19:12 |
| boris-42 | morganfainberg with change and without | 19:12 |
| morganfainberg | yeah, that would work. just let me know if you have a few minutes to run some tests | 19:12 |
| boris-42 | morganfainberg on different benchmarks | 19:12 |
| boris-42 | morganfainberg yep I have | 19:12 |
| boris-42 | morganfainberg I will run some tests | 19:12 |
| morganfainberg | comment on the review if you do get a chance | 19:12 |
| morganfainberg | i'd love to get feedback on the value | 19:12 |
| morganfainberg | if it's no benefit, i'll shelve that work until we solve the other stuff going on | 19:12 |
| boris-42 | morganfainberg sure I will just put results | 19:12 |
| boris-42 | morganfainberg and you'll make decison=) | 19:12 |
| morganfainberg | e.g. apache, non-persistent tokens, etc | 19:13 |
| morganfainberg | boris-42, ++ awesome | 19:13 |
| boris-42 | morganfainberg so we have benchmark | 19:13 |
| boris-42 | morganfainberg for tokens | 19:13 |
| boris-42 | morganfainberg that calls authentification | 19:13 |
| boris-42 | morganfainberg I actually can run all set of benchmarks | 19:13 |
| boris-42 | morganfainberg related to keystone | 19:13 |
| boris-42 | and share results | 19:13 |
| morganfainberg | cool | 19:14 |
| boris-42 | actually I'll just do that | 19:14 |
| morganfainberg | the non-persistent tokens may be less of a performance win and more of a "no overhead cause we don't store them" win. | 19:14 |
| boris-42 | morganfainberg btw we have some user stories | 19:14 |
| boris-42 | morganfainberg https://github.com/stackforge/rally/blob/master/doc/user_stories/keystone/authenticate.rst | 19:14 |
| morganfainberg | cool. | 19:14 |
| boris-42 | morganfainberg difference of authenticate in case of default installation and apache=) | 19:14 |
| morganfainberg | wow the apache one is waaaaaay better | 19:15 |
| morganfainberg | holy crap | 19:15 |
| boris-42 | morganfainberg =) | 19:15 |
| morganfainberg | have you tried with multiple eventlet workers? | 19:15 |
| boris-42 | morganfainberg that's why we started these user stores | 19:15 |
| boris-42 | morganfainberg it's not my work | 19:15 |
| boris-42 | morganfainberg it's done by nkhare | 19:15 |
| *** diegows has joined #openstack-keystone | 19:15 | |
| morganfainberg | ah | 19:15 |
| boris-42 | morganfainberg that wrote most of keystone benchmarks | 19:15 |
| morganfainberg | can try that same kind of stuff with https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L59-L63 set higher | 19:16 |
| morganfainberg | and compare to apache | 19:16 |
| boris-42 | morganfainberg so I'll make one more user story | 19:16 |
| boris-42 | morganfainberg I'l ask nkhare | 19:16 |
| morganfainberg | ++ | 19:16 |
| boris-42 | morganfainberg cause I don't have the same hardware | 19:16 |
| boris-42 | morganfainberg and it's kind of important thing=) | 19:16 |
| morganfainberg | right | 19:17 |
| morganfainberg | yep | 19:17 |
| boris-42 | morganfainberg so wait for my user sotry=) | 19:17 |
| *** dims has quit IRC | 19:22 | |
| *** jdennis has joined #openstack-keystone | 19:23 | |
| *** stevemar has quit IRC | 19:49 | |
| *** dstanek is now known as dstanek_zzz | 19:59 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add profiling support to keystoneclient https://review.openstack.org/103367 | 20:14 |
| boris-42 | morganfainberg ^ woot | 20:19 |
| *** dstanek_zzz is now known as dstanek | 20:20 | |
| *** dims has joined #openstack-keystone | 20:27 | |
| *** dstanek is now known as dstanek_zzz | 20:30 | |
| *** dstanek_zzz is now known as dstanek | 20:32 | |
| *** hrybacki has quit IRC | 20:40 | |
| *** chandankumar has joined #openstack-keystone | 20:46 | |
| *** chandankumar has quit IRC | 21:03 | |
| *** dstanek is now known as dstanek_zzz | 21:05 | |
| *** dstanek_zzz is now known as dstanek | 21:12 | |
| *** dims has quit IRC | 21:12 | |
| *** henrynash has quit IRC | 21:22 | |
| *** jamielennox is now known as jamielennox|away | 22:02 | |
| *** dstanek is now known as dstanek_zzz | 22:11 | |
| *** andreaf has quit IRC | 22:22 | |
| *** andreaf has joined #openstack-keystone | 22:24 | |
| *** zhiyan_ is now known as zhiyan | 22:26 | |
| *** boris-42 has quit IRC | 22:29 | |
| *** boris-42 has joined #openstack-keystone | 22:29 | |
| *** mrda-away is now known as mrda | 23:05 | |
| *** dstanek_zzz is now known as dstanek | 23:13 | |
| *** diegows has quit IRC | 23:20 | |
| *** dstanek is now known as dstanek_zzz | 23:22 | |
| *** zhiyan is now known as zhiyan_ | 23:36 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!