| *** oomichi has joined #openstack-keystone | 00:10 | |
| *** leseb has joined #openstack-keystone | 00:50 | |
| *** leseb has quit IRC | 00:54 | |
| *** jimbaker has quit IRC | 00:56 | |
| *** jimbaker has joined #openstack-keystone | 01:00 | |
| *** jimbaker has quit IRC | 01:00 | |
| *** jimbaker has joined #openstack-keystone | 01:00 | |
| stevemar | hey bknudson, when are you leaving MN, apparently i'm connecting there on tuesday | 01:05 |
|---|---|---|
| stevemar | wondering if we're on the same flight | 01:05 |
| *** mberlin1 has joined #openstack-keystone | 01:09 | |
| *** mberlin has quit IRC | 01:11 | |
| *** gokrokve_ has quit IRC | 01:13 | |
| *** leseb has joined #openstack-keystone | 01:16 | |
| *** leseb has quit IRC | 01:21 | |
| *** jaosorior has quit IRC | 01:22 | |
| *** diegows has quit IRC | 01:39 | |
| *** bobt has joined #openstack-keystone | 01:55 | |
| *** jamielennox is now known as jamielennox|away | 02:07 | |
| *** miqui_ has quit IRC | 02:11 | |
| *** leseb has joined #openstack-keystone | 02:17 | |
| *** dims has quit IRC | 02:18 | |
| *** leseb has quit IRC | 02:22 | |
| *** gokrokve has joined #openstack-keystone | 02:25 | |
| *** dstanek is now known as dstanek_zzz | 02:27 | |
| *** achampion has quit IRC | 02:37 | |
| *** dstanek_zzz is now known as dstanek | 02:38 | |
| *** gokrokve has quit IRC | 02:41 | |
| *** gokrokve has joined #openstack-keystone | 02:41 | |
| *** dims has joined #openstack-keystone | 02:44 | |
| *** gokrokve has quit IRC | 02:46 | |
| *** dims has quit IRC | 02:50 | |
| *** jamielennox|away is now known as jamielennox | 03:00 | |
| *** hrybacki has quit IRC | 03:02 | |
| *** hrybacki has joined #openstack-keystone | 03:06 | |
| *** lbragstad_ has joined #openstack-keystone | 03:09 | |
| *** leseb has joined #openstack-keystone | 03:18 | |
| *** leseb has quit IRC | 03:23 | |
| *** zhiyan_ is now known as zhiyan | 03:40 | |
| *** hrybacki has quit IRC | 03:45 | |
| *** dims_ has joined #openstack-keystone | 03:46 | |
| *** lbragstad_ has left #openstack-keystone | 03:48 | |
| *** dims_ has quit IRC | 03:51 | |
| *** lbragstad_ has joined #openstack-keystone | 03:58 | |
| *** darren has joined #openstack-keystone | 03:59 | |
| darren | Hi all, I'm pretty new to keystone, do we have official explanations of Domain, Region, Tenant and Project? I'm confused with these concepts, better with some examples. | 04:01 |
| *** darren has quit IRC | 04:05 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert keystone CLI to use auth plugins https://review.openstack.org/95680 | 04:16 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Plugin loading from config objects https://review.openstack.org/79542 | 04:16 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow loading auth plugins from CLI https://review.openstack.org/95679 | 04:16 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Provide an __all__ for auth module https://review.openstack.org/104529 | 04:16 |
| *** leseb has joined #openstack-keystone | 04:18 | |
| *** zhiyan is now known as zhiyan_ | 04:20 | |
| *** leseb has quit IRC | 04:23 | |
| morganfainberg | hrybacki, pong [only semi here, Keystone Developer needs food badly </bad gauntlet reference>] | 04:37 |
| *** dims_ has joined #openstack-keystone | 04:47 | |
| *** dims_ has quit IRC | 04:52 | |
| *** ajc_ has joined #openstack-keystone | 04:52 | |
| *** KanagarajM has joined #openstack-keystone | 05:07 | |
| openstackgerrit | A change was merged to openstack/keystone: Sync with oslo-incubator e9bb0b59 https://review.openstack.org/103252 | 05:11 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: endpoint_id and service_id should be random uuid https://review.openstack.org/103989 | 05:16 |
| *** leseb has joined #openstack-keystone | 05:19 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 05:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Use jsonutils to load adapter response https://review.openstack.org/105065 | 05:22 |
| *** leseb has quit IRC | 05:24 | |
| *** chandan_kumar has joined #openstack-keystone | 05:34 | |
| *** KanagarajM has quit IRC | 05:41 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Keystoneclient create user API should have optional password. https://review.openstack.org/97597 | 05:41 |
| *** afazekas is now known as __afazekas | 05:43 | |
| *** dims_ has joined #openstack-keystone | 05:47 | |
| *** dims_ has quit IRC | 05:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/103380 | 06:00 |
| *** bobt has quit IRC | 06:01 | |
| *** ukalifon has joined #openstack-keystone | 06:15 | |
| *** leseb has joined #openstack-keystone | 06:20 | |
| *** stevemar has quit IRC | 06:23 | |
| *** leseb has quit IRC | 06:24 | |
| *** henrynash has joined #openstack-keystone | 06:42 | |
| *** dims_ has joined #openstack-keystone | 06:48 | |
| *** dims_ has quit IRC | 06:53 | |
| *** xianghui has joined #openstack-keystone | 06:56 | |
| *** leseb has joined #openstack-keystone | 07:09 | |
| *** BAKfr has joined #openstack-keystone | 07:09 | |
| *** tomoiaga has joined #openstack-keystone | 07:10 | |
| *** afazekas_ has joined #openstack-keystone | 07:15 | |
| *** xianghui has quit IRC | 07:16 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix docs and scripts for pki_setup and ssl_setup https://review.openstack.org/103697 | 07:17 |
| *** chandan_kumar is now known as chandankumar | 07:23 | |
| *** mitz_ has quit IRC | 07:41 | |
| *** dstanek is now known as dstanek_zzz | 08:08 | |
| *** xianghui has joined #openstack-keystone | 08:11 | |
| *** jimbaker has quit IRC | 08:14 | |
| *** jimbaker has joined #openstack-keystone | 08:18 | |
| *** jimbaker has quit IRC | 08:18 | |
| *** jimbaker has joined #openstack-keystone | 08:18 | |
| *** mitz_ has joined #openstack-keystone | 08:23 | |
| *** leseb has quit IRC | 08:26 | |
| *** leseb has joined #openstack-keystone | 08:28 | |
| *** dstanek_zzz is now known as dstanek | 08:29 | |
| *** zhiyan_ is now known as zhiyan | 08:30 | |
| *** kwss has joined #openstack-keystone | 08:35 | |
| *** tkelsey has joined #openstack-keystone | 08:38 | |
| *** dstanek is now known as dstanek_zzz | 08:39 | |
| *** kwss is now known as kwss_afk | 08:43 | |
| *** leseb has quit IRC | 08:46 | |
| *** leseb has joined #openstack-keystone | 08:46 | |
| *** leseb has quit IRC | 08:47 | |
| *** andreaf_ has joined #openstack-keystone | 08:56 | |
| *** kwss_afk is now known as kwss | 09:04 | |
| *** tomoiaga has quit IRC | 09:22 | |
| *** ajayaa has joined #openstack-keystone | 09:28 | |
| *** praneshp has quit IRC | 09:40 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: reengineered-federation https://review.openstack.org/104301 | 09:45 |
| *** bvandenh has joined #openstack-keystone | 10:02 | |
| *** oomichi has quit IRC | 10:04 | |
| *** xianghui has quit IRC | 10:11 | |
| *** xianghui has joined #openstack-keystone | 10:13 | |
| *** xianghui has quit IRC | 10:22 | |
| *** tomoiaga has joined #openstack-keystone | 10:36 | |
| *** dims_ has joined #openstack-keystone | 10:53 | |
| *** xianghui has joined #openstack-keystone | 10:57 | |
| *** dims_ has quit IRC | 10:58 | |
| tomoiaga | I am wondering if I sould start working with domains or they will be deprecated in a future version in favor of hierarchical multitenancy) ? | 11:04 |
| *** dims_ has joined #openstack-keystone | 11:14 | |
| *** xianghui has quit IRC | 11:19 | |
| *** jimbaker has quit IRC | 11:33 | |
| *** jimbaker has joined #openstack-keystone | 11:37 | |
| *** jimbaker has quit IRC | 11:37 | |
| *** jimbaker has joined #openstack-keystone | 11:37 | |
| *** jdennis has joined #openstack-keystone | 11:52 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix the section name in CONTRIBUTING.rst https://review.openstack.org/103758 | 11:59 |
| *** afazekas_ has quit IRC | 12:02 | |
| openstackgerrit | mouad benchchaoui proposed a change to openstack/keystone: Retreive token domain depending on scope https://review.openstack.org/105137 | 12:04 |
| *** topol has joined #openstack-keystone | 12:12 | |
| *** topol has quit IRC | 12:13 | |
| *** topol has joined #openstack-keystone | 12:14 | |
| *** afazekas_ has joined #openstack-keystone | 12:17 | |
| *** topol has quit IRC | 12:19 | |
| *** dstanek_zzz is now known as dstanek | 12:20 | |
| *** xianghui has joined #openstack-keystone | 12:21 | |
| *** rodrigods_ has joined #openstack-keystone | 12:22 | |
| *** afazekas_ has quit IRC | 12:23 | |
| *** huats_ has joined #openstack-keystone | 12:28 | |
| *** huats_ has quit IRC | 12:28 | |
| *** huats_ has joined #openstack-keystone | 12:28 | |
| *** jraim has quit IRC | 12:28 | |
| *** serverascode has quit IRC | 12:28 | |
| *** mgagne has quit IRC | 12:28 | |
| *** baffle_ has joined #openstack-keystone | 12:30 | |
| *** Ephur has quit IRC | 12:30 | |
| *** jgriffit1 has joined #openstack-keystone | 12:30 | |
| *** jraim has joined #openstack-keystone | 12:30 | |
| *** tristanC_ has joined #openstack-keystone | 12:30 | |
| *** huats has quit IRC | 12:30 | |
| *** baffle has quit IRC | 12:31 | |
| *** jgriffith has quit IRC | 12:31 | |
| *** mfisch has quit IRC | 12:31 | |
| *** tristanC has quit IRC | 12:31 | |
| *** mgagne has joined #openstack-keystone | 12:31 | |
| *** jraim has quit IRC | 12:31 | |
| *** jraim has joined #openstack-keystone | 12:31 | |
| *** tristanC_ is now known as tristanC | 12:31 | |
| *** serverascode has joined #openstack-keystone | 12:31 | |
| *** mfisch has joined #openstack-keystone | 12:32 | |
| *** mfisch has quit IRC | 12:32 | |
| *** mfisch has joined #openstack-keystone | 12:32 | |
| *** Ephur has joined #openstack-keystone | 12:33 | |
| *** ajc_ has quit IRC | 12:33 | |
| *** radez_g0n3 is now known as radez | 12:34 | |
| *** dims_ has quit IRC | 12:37 | |
| *** dims_ has joined #openstack-keystone | 12:37 | |
| *** gokrokve has joined #openstack-keystone | 12:37 | |
| *** gokrokve has quit IRC | 12:38 | |
| *** henrynash has quit IRC | 12:39 | |
| *** bknudson has quit IRC | 12:39 | |
| *** gokrokve has joined #openstack-keystone | 12:39 | |
| *** gokrokve has quit IRC | 12:43 | |
| *** lbragstad_ has quit IRC | 12:43 | |
| *** afazekas_ has joined #openstack-keystone | 12:49 | |
| *** ayoung has joined #openstack-keystone | 12:51 | |
| *** huats_ is now known as huats | 12:53 | |
| *** bknudson has joined #openstack-keystone | 12:54 | |
| *** ajayaa has quit IRC | 12:59 | |
| *** kwss has left #openstack-keystone | 13:03 | |
| *** diegows has joined #openstack-keystone | 13:05 | |
| *** raildo has joined #openstack-keystone | 13:09 | |
| *** chandan_kumar has joined #openstack-keystone | 13:10 | |
| *** ajayaa has joined #openstack-keystone | 13:11 | |
| *** joesavak has joined #openstack-keystone | 13:13 | |
| *** chandankumar has quit IRC | 13:15 | |
| *** chandan_kumar is now known as chandankumar | 13:15 | |
| *** dstanek is now known as dstanek_zzz | 13:17 | |
| *** hrybacki has joined #openstack-keystone | 13:17 | |
| *** ukalifon has quit IRC | 13:17 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/104018 | 13:28 |
| *** dhellmann_ is now known as dhellmann | 13:29 | |
| *** stevemar has joined #openstack-keystone | 13:30 | |
| *** ukalifon has joined #openstack-keystone | 13:33 | |
| *** xianghui has quit IRC | 13:36 | |
| *** zhiyan is now known as zhiyan_ | 13:37 | |
| bknudson | stevemar: departs at 2:40PM | 13:49 |
| *** dhellmann is now known as dhellmann_ | 13:51 | |
| stevemar | bknudson, I'm landing in SAT at noon. I had very few departure options, either super early or super late | 13:51 |
| bknudson | you must be leaving early | 13:52 |
| *** david-lyle has joined #openstack-keystone | 13:53 | |
| stevemar | bknudson, yeah 7amish. leaving MN at 9:15 | 13:53 |
| bknudson | it's going to be 100'F there very day. | 13:53 |
| bknudson | you'll be sunburned by the time I'm there | 13:54 |
| stevemar | it's already 76 there *now* | 13:54 |
| bknudson | I promised I wouldn't complain about heat after last winter. | 13:55 |
| stevemar | good point, even if we get a bit roasted | 13:56 |
| *** otwieracz has quit IRC | 13:58 | |
| *** mostly_d34dh0r53 is now known as d34dh0r53 | 14:03 | |
| *** tomoiaga has quit IRC | 14:04 | |
| *** otwieracz has joined #openstack-keystone | 14:05 | |
| *** topol has joined #openstack-keystone | 14:07 | |
| *** ukalifon has quit IRC | 14:07 | |
| *** tellesnobrega has joined #openstack-keystone | 14:10 | |
| *** vhoward- has left #openstack-keystone | 14:10 | |
| *** dstanek_zzz is now known as dstanek | 14:13 | |
| dstanek | just arrived at the barbican hackathon! | 14:13 |
| *** jaosorior has joined #openstack-keystone | 14:17 | |
| *** jgriffit1 has quit IRC | 14:19 | |
| *** ukalifon has joined #openstack-keystone | 14:21 | |
| *** bklei has joined #openstack-keystone | 14:23 | |
| bklei | Anyone willing to review https://review.openstack.org/#/c/92390? This is for keystone V3 support in the neutron client... | 14:24 |
| *** tkelsey has quit IRC | 14:25 | |
| *** dhellmann_ is now known as dhellmann | 14:26 | |
| *** afaranha has joined #openstack-keystone | 14:26 | |
| *** gokrokve has joined #openstack-keystone | 14:27 | |
| ayoung | bklei, sure | 14:28 |
| dolphm | stevemar: 78* | 14:30 |
| hrybacki | 100* in Houston feels like a brisk 75* in Georgia. I love that dry heat | 14:31 |
| dolphm | hrybacki: are you suggesting houston is dry, or georgia is dry? both are humid in my experience! | 14:32 |
| *** xianghui has joined #openstack-keystone | 14:33 | |
| hrybacki | Given that I only spent a week in Houston (in June), my experience was that it was very dry. Georgia, where I spent closer to 9 months, felt like a sauna in the summer and a cold shower in the winter -- always. | 14:33 |
| bklei | thanks ayoung | 14:34 |
| dolphm | hrybacki: current humidity in houston is only 75% :P | 14:34 |
| ayoung | hrybacki, might have had something to do with the lodgings in Georgia, too. | 14:35 |
| hrybacki | well that's no fun | 14:35 |
| dolphm | stevemar: also, the high today is only 94 F | 14:35 |
| hrybacki | ayoung++ solid point | 14:35 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 14:35 |
| stevemar | dolphm, we haven't had a high in the 90s yet | 14:35 |
| hrybacki | dolphm: it sounds like a very similar climate to Raleigh today | 14:35 |
| dolphm | low 70's to mid 90's all week, no rain | 14:36 |
| dstanek | marekd|away: you're coming to the hackathon right? | 14:40 |
| marekd|away | dstanek: yes. | 14:40 |
| *** marekd|away is now known as marekd | 14:40 | |
| *** hrybacki_ has joined #openstack-keystone | 14:40 | |
| marekd | dstanek: why are you asking? | 14:40 |
| dstanek | marekd: when do you get in? in the barbican hackathon they mentioned your request for secrets not tied to a project | 14:41 |
| *** hrybacki has quit IRC | 14:41 | |
| dolphm | dstanek: are you at geekdom now? | 14:42 |
| marekd | dstanek: i could be available tomorrow, but not the whole day, since I will have some other work-related business... | 14:43 |
| dvorak | I'd appreciate some eyeballs on this review is people have some time - https://review.openstack.org/#/c/101726/ | 14:44 |
| dvorak | it's my rework of the token flush behavior to make the range selection more flexible | 14:44 |
| marekd | dstanek: is barbican hackathon also happening on Wed? | 14:44 |
| marekd | dstanek: maybe it'd be better to gather some folks involved in k2k and only then talk with Barbican folks? | 14:45 |
| marekd | dstanek: besides I am not sure if we want to make such dependency... (waiting for them to implement that) | 14:45 |
| dolphm | marekd: yes, mon-wed | 14:46 |
| dstanek | dolphm: yes, i'm at geekdom | 14:46 |
| dstanek | marekd: yes, it's also on Wednesday so it can wait until then | 14:47 |
| dstanek | marekd: i just wanted to make sure you were going to be here | 14:47 |
| marekd | so i'd wait for morganfainberg, stevemar to arrive and only then meet with Barbicans. | 14:47 |
| marekd | dstanek: i will! :D | 14:47 |
| ayoung | http://lists.openstack.org/pipermail/openstack-dev/2014-July/039398.html dolphm I wrote this up based on the confusion over my "Session Tokens" proposal. I was hoping for some feedback and insight. | 14:48 |
| *** hrybacki_ has quit IRC | 14:49 | |
| *** hrybacki has joined #openstack-keystone | 14:50 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 14:51 |
| *** chandankumar has quit IRC | 14:51 | |
| *** joesavak has quit IRC | 14:53 | |
| *** ukalifon has quit IRC | 14:55 | |
| morganfainberg | dolphm, ah so weather has been decent? | 14:56 |
| morganfainberg | dolphm, wow, sounds like it's cooler in SA than here in Pasadena the last few days :P | 14:56 |
| dolphm | morganfainberg: it's not terrible! | 14:57 |
| *** gokrokve has quit IRC | 14:57 | |
| *** joesavak has joined #openstack-keystone | 14:58 | |
| *** gokrokve has joined #openstack-keystone | 14:58 | |
| morganfainberg | dolphm, nice. | 14:58 |
| *** marekd is now known as marekd|away | 15:00 | |
| *** gokrokve_ has joined #openstack-keystone | 15:00 | |
| *** bklei has quit IRC | 15:02 | |
| *** gokrokve has quit IRC | 15:02 | |
| *** d34dh0r53 is now known as mostly_d34dh0r53 | 15:03 | |
| *** mostly_d34dh0r53 is now known as d34dh0r53 | 15:05 | |
| *** afazekas_ has quit IRC | 15:05 | |
| *** chandan_kumar has joined #openstack-keystone | 15:06 | |
| *** gokrokve_ has quit IRC | 15:06 | |
| *** gokrokve has joined #openstack-keystone | 15:07 | |
| *** ajayaa has quit IRC | 15:08 | |
| *** gokrokve has quit IRC | 15:11 | |
| *** richm has joined #openstack-keystone | 15:19 | |
| *** thedodd has joined #openstack-keystone | 15:21 | |
| *** doddstack has joined #openstack-keystone | 15:24 | |
| *** thedodd has quit IRC | 15:26 | |
| *** bobt has joined #openstack-keystone | 15:28 | |
| *** xianghui has quit IRC | 15:31 | |
| *** ayoung is now known as ayoung-afk | 15:31 | |
| *** xianghui has joined #openstack-keystone | 15:32 | |
| *** dtroyer has quit IRC | 15:36 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystonemiddleware: Move auth_token session code to middleware repo https://review.openstack.org/105031 | 15:40 |
| *** daneyon has joined #openstack-keystone | 15:42 | |
| *** daneyon has quit IRC | 15:44 | |
| *** daneyon has joined #openstack-keystone | 15:45 | |
| *** d34dh0r53 is now known as mostly_d34dh0r53 | 15:46 | |
| *** mostly_d34dh0r53 is now known as d34dh0r53 | 15:47 | |
| *** rwsu has joined #openstack-keystone | 15:47 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/identity-api: Adding support for self registration to Virtual Organisations https://review.openstack.org/105218 | 16:05 |
| dolphm | marekd|away: i just put this back into review ^ did the other patch that we had to revert get back into review? | 16:06 |
| morganfainberg | dolphm, so, what is the status of the identity-api repo? someone specifically asked me about this earlier today. | 16:07 |
| morganfainberg | and i didn't know how to answer | 16:07 |
| morganfainberg | as in. how do we handle it vs. specs | 16:07 |
| dolphm | morganfainberg: i was hoping to discuss at the hackathon... but i'd like to move the contents of it into something like keystone-specs/specs/api/ ? | 16:08 |
| morganfainberg | ++ @ hackathon works for me | 16:08 |
| morganfainberg | i ... should probably pack things for flight tomorrow morning :P | 16:08 |
| dolphm | morganfainberg: which makes me wish we had renamed identity-api to keystone-specs instead of making a new repo... unless you have a solution to preserve the history at whatnot? | 16:08 |
| morganfainberg | i ... might be able to work with infra to support a merge commit for that | 16:09 |
| morganfainberg | i'll ask what the view on that would be | 16:09 |
| morganfainberg | if we can do a merge commit, i can preserve the history. | 16:09 |
| bknudson | I don't see what the point is of changing specs | 16:10 |
| bknudson | I mean changing api doc | 16:10 |
| bknudson | the specs are the changes to make to the api. We still need to have something that shows what the api currently is | 16:11 |
| *** afazekas_ has joined #openstack-keystone | 16:11 | |
| dolphm | bknudson: we'd be able to propose a spec with it's actual api impact in a single patchset | 16:11 |
| bknudson | we could put them all in keystone and have the code, too | 16:11 |
| *** KanagarajM has joined #openstack-keystone | 16:12 | |
| dolphm | bknudson: i *do* like the separation between the api documentation and the implementation | 16:12 |
| *** KanagarajM has quit IRC | 16:12 | |
| bknudson | just don't like it when someone unexpectedly approves the changes | 16:13 |
| *** gokrokve has joined #openstack-keystone | 16:14 | |
| bknudson | I thought we wanted to be able to not specify everything about the REST API changes, so having the update to the api with the spec would require fully specifying the REST API | 16:15 |
| bknudson | It just seems like we're already having to make changes all over the place for specs... | 16:15 |
| morganfainberg | bknudson, dolphm, we could move the REST change bit out of the spec doc. | 16:15 |
| bknudson | change tempest, update requirements, update keystoneclient, ... | 16:15 |
| morganfainberg | if we merged them | 16:15 |
| morganfainberg | "go make the change to /api/<whatever> | 16:15 |
| dolphm | bknudson: "we wanted to be able to not specify everything about the REST API changes" <-- because that was redundant with identity-api | 16:16 |
| *** doddstack has quit IRC | 16:16 | |
| dolphm | morganfainberg: my backup plan was to revise the API Impact section to require link to a review on identity-api | 16:17 |
| dolphm | and then it would still make sense to approve spec -> api -> implementation | 16:17 |
| morganfainberg | dolphm, i'd rather it be all one repo. | 16:17 |
| dolphm | morganfainberg: me too | 16:17 |
| morganfainberg | dolphm, but that is a reasonable enough backup | 16:17 |
| bknudson | I hope we don't end up with wadls in specs | 16:17 |
| dolphm | bknudson: that would happen. or we could just bring the v3 stuff over? | 16:18 |
| morganfainberg | dolphm, though we should move to .rst only instead of .md | 16:18 |
| dolphm | morganfainberg: the choice of md was a technical one from the docs team that we never took advantage of, so that's viable | 16:18 |
| morganfainberg | dolphm, if its in specs repo, i say .rst | 16:19 |
| morganfainberg | dolphm, and it means v2.0 would either get dropped or need to be converted | 16:19 |
| dolphm | morganfainberg: let's just move v3 then? | 16:19 |
| morganfainberg | .md -> rst is easier than uh.. whatever v2.0 is | 16:19 |
| morganfainberg | dolphm, sure | 16:20 |
| morganfainberg | dolphm, this looks easy: http://bfroehle.com/2013/04/26/converting-md-to-rst/ | 16:21 |
| dolphm | morganfainberg: wonder if it works | 16:22 |
| morganfainberg | dolphm, dunno :P will have to find out i guess | 16:22 |
| dolphm | morganfainberg: your approval fell on it's face: https://review.openstack.org/#/c/104018/ | 16:23 |
| morganfainberg | awesome | 16:24 |
| morganfainberg | fatal: read error: Connection reset by peer | 16:24 |
| morganfainberg | 2014-07-07 15:22:18.379 | error: Could not fetch origin | 16:24 |
| morganfainberg | LOL | 16:24 |
| dolphm | morganfainberg: in rst https://gist.github.com/dolph/db4a393c342b439294dd | 16:25 |
| morganfainberg | gee, looks like it works | 16:25 |
| *** dtroyer has joined #openstack-keystone | 16:29 | |
| *** mrutkows has joined #openstack-keystone | 16:30 | |
| *** marcoemorais has joined #openstack-keystone | 16:31 | |
| afaranha | Hey, what's the method called when I list a user's roles? | 16:31 |
| *** hrybacki has quit IRC | 16:33 | |
| *** thedodd has joined #openstack-keystone | 16:34 | |
| *** packet has joined #openstack-keystone | 16:41 | |
| *** arunkant has joined #openstack-keystone | 16:42 | |
| *** harlowja_away is now known as harlowja | 17:01 | |
| *** richm has quit IRC | 17:03 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 17:05 |
| *** xianghui has quit IRC | 17:05 | |
| raildo | afaranha: https://github.com/openstack/keystone/blob/master/keystone/assignment/core.py#L119 | 17:08 |
| *** bobt has quit IRC | 17:14 | |
| dolphm | afaranha: depends ;) | 17:15 |
| *** arosen has joined #openstack-keystone | 17:16 | |
| dolphm | afaranha: there's also list_role_assignments() and list_grants() | 17:17 |
| *** richm has joined #openstack-keystone | 17:17 | |
| *** topol_ has joined #openstack-keystone | 17:17 | |
| afaranha | dolphm: I'm currently using in list_role_assignments | 17:18 |
| afaranha | But I don't know if I change it or just use it | 17:18 |
| afaranha | What I want to do is this: List the role assignments of the users and the inherit roles | 17:19 |
| afaranha | So, I want the method that lists the user roles to concat it's returns with the inherit roles | 17:19 |
| *** topol has quit IRC | 17:19 | |
| *** topol_ is now known as topol | 17:20 | |
| *** bobt has joined #openstack-keystone | 17:20 | |
| *** BAKfr has quit IRC | 17:20 | |
| *** topol has quit IRC | 17:24 | |
| dolphm | afaranha: GET /v3/role_assignments?user.id={user_id}&scope.OS-INHERIT:inherited_to=projects&effective | 17:24 |
| *** thedodd has quit IRC | 17:28 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Correct the region table to be InnoDB and UTF8 https://review.openstack.org/102964 | 17:35 |
| dolphm | morganfainberg: why is the error handling in migration_helpers rather than in migration 37 itself? | 17:39 |
| morganfainberg | because once you get into the migration itself, you are wedged | 17:39 |
| morganfainberg | the sanity check is called after migration script is run, but the db version is already updated by then | 17:40 |
| dolphm | morganfainberg: shouldn't migration 37 be fixed AND have a new migration to convert the table? | 17:40 |
| *** ayoung-afk is now known as ayoung | 17:40 | |
| morganfainberg | if you didn't have utf-8 charset, you can't run another migration | 17:40 |
| morganfainberg | basically, you get wedged in a bad way | 17:41 |
| *** gyee has joined #openstack-keystone | 17:41 | |
| dolphm | hrm. | 17:41 |
| morganfainberg | dolphm, so what happens is | 17:42 |
| morganfainberg | upgrade db schema, on the next schema action (any action) https://github.com/openstack/keystone/blob/stable/icehouse/keystone/openstack/common/db/sqlalchemy/migration.py#L194 is run | 17:42 |
| morganfainberg | it's the same in oslo.db, but icehouse is where this hits up | 17:42 |
| morganfainberg | hits us* | 17:42 |
| morganfainberg | so, before the next migration (up or down) we run sanity check, and BOOM | 17:42 |
| morganfainberg | explode. | 17:42 |
| *** afazekas_ has quit IRC | 17:43 | |
| morganfainberg | can't migrate up or down. | 17:43 |
| *** hrybacki has joined #openstack-keystone | 17:43 | |
| morganfainberg | i guess i could go one step further and even check to make sure the table is wrong using the same query as sanity_check does. narrow the "fix" scope | 17:44 |
| morganfainberg | https://github.com/openstack/keystone/blob/stable/icehouse/keystone/openstack/common/db/sqlalchemy/migration.py#L211 | 17:44 |
| *** bobt has quit IRC | 17:45 | |
| dolphm | morganfainberg: does sanity check only run before upgrades? | 17:48 |
| morganfainberg | yep | 17:48 |
| dolphm | morganfainberg: if we ran db_sync twice in the gate, would this have been caught? | 17:48 |
| morganfainberg | nope. because we default to innodb and utf8 in gate | 17:48 |
| dolphm | morganfainberg: isn't it rdo that defaults to broken? | 17:49 |
| ayoung | Wow. Someone had to really work at the Oracle Paid time off web app to make it so bad. | 17:49 |
| morganfainberg | dolphm, it might be, but we default all other tables in all migrations to utf8 + innodb | 17:49 |
| morganfainberg | because oslo.db requires it | 17:49 |
| morganfainberg | so, in short, we don't care what your mysql defaults really are - we set what we expect. this case the table snuck through without it | 17:50 |
| dolphm | morganfainberg: just wondering if we can help catch this earlier next time, even if we're not gating on broken defaults in our gate | 17:50 |
| morganfainberg | i think the next step is to make our base table always set these values | 17:50 |
| morganfainberg | but i felt that was above and beyond something i wanted to backport. | 17:51 |
| dolphm | morganfainberg: isn't there a base table in oslodb that does that? | 17:51 |
| morganfainberg | doesn't look like it | 17:51 |
| morganfainberg | or we wouldn't have ended up in this situation | 17:51 |
| morganfainberg | oslo.db probably should supply it. | 17:52 |
| dolphm | morganfainberg: can keystone itself use memcache encrypt? | 17:53 |
| dolphm | morganfainberg: via dogpile | 17:53 |
| morganfainberg | dolphm, i could layer a proxy in that does it, not hard to do | 17:53 |
| morganfainberg | but the current memcache_crypt we have wouldn't work | 17:53 |
| morganfainberg | dolphm, it is on the list of "this is a good idea" to implement. | 17:54 |
| morganfainberg | ugh. i need to go eat breakfast. got distracted and should have gone 2hrs ago | 17:55 |
| *** topol has joined #openstack-keystone | 18:01 | |
| *** KanagarajM has joined #openstack-keystone | 18:04 | |
| *** thedodd has joined #openstack-keystone | 18:14 | |
| hrybacki | ayoung: mind reviewing https://review.openstack.org/#/c/105031/ when you get a chance? | 18:14 |
| *** afazekas_ has joined #openstack-keystone | 18:14 | |
| *** KanagarajM has quit IRC | 18:14 | |
| *** dims_ has quit IRC | 18:14 | |
| *** rodrigods has quit IRC | 18:17 | |
| *** rodrigods has joined #openstack-keystone | 18:18 | |
| *** dims has joined #openstack-keystone | 18:19 | |
| ayoung | hrybacki, +2 from me. That was pretty well reviewed in the client | 18:25 |
| hrybacki | ayoung++ wanna do another? ;) https://review.openstack.org/#/c/103229/ | 18:25 |
| hrybacki | the follow up tests for another simple fix | 18:26 |
| ayoung | hrybacki, respond to Jamie's question. Another review comment is OK. | 18:26 |
| * hrybacki nods | 18:27 | |
| *** amcrn has joined #openstack-keystone | 18:34 | |
| *** afazekas_ has quit IRC | 18:35 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: Add tests without optional create endpoint params https://review.openstack.org/103229 | 18:39 |
| *** radez is now known as radez_g0n3 | 18:39 | |
| *** gyee has quit IRC | 18:42 | |
| *** CaioBrentano has joined #openstack-keystone | 18:45 | |
| morganfainberg | ayoung, hrybacki, be aware we're not _actually_ testing the middleware yet against real services | 18:49 |
| CaioBrentano | Hi all | 18:49 |
| CaioBrentano | I have a stupid question… I'm configuring swift to use keystone… I couldnt understand what is the diference between public port (5000) and admin port (35357). Does anybody have any document to help me? | 18:49 |
| *** praneshp has joined #openstack-keystone | 18:49 | |
| morganfainberg | ayoung, hrybacki, still waiting for it to hit global requirements | 18:49 |
| hrybacki | morganfainberg: I feel lied to now... | 18:50 |
| morganfainberg | ayoung, also https://review.openstack.org/#/c/104026/ if you don't mind. | 18:50 |
| morganfainberg | ayoung, need some support on that and the icehouse version before we can get the tempest change merged | 18:50 |
| *** ukalifon1 has joined #openstack-keystone | 18:51 | |
| morganfainberg | hrybacki, we test (unit tests) but until we get it in the global requirements, we can't update services to use it | 18:51 |
| morganfainberg | hrybacki, so we test we just don't do tempest with it. | 18:51 |
| ayoung | morganfainberg, I'll give it a hit here in a moment | 18:51 |
| hrybacki | morganfainberg: nods. I was wondering why it passed things that the keystoneclient version didin't | 18:51 |
| morganfainberg | hrybacki, the ds-g tempest runs are so we start testing as soon as we get a project updated to use it | 18:51 |
| morganfainberg | ayoung, it can wait till the hackathon, just want it on your radar :) | 18:52 |
| *** keith_newstadt has joined #openstack-keystone | 18:52 | |
| *** packet has quit IRC | 18:52 | |
| hrybacki | I wish I could join y'all at the hackathon | 18:52 |
| ayoung | morganfainberg, ++ | 18:53 |
| ayoung | hrybacki, be careful what you wish for. | 18:53 |
| *** CaioBrentano has left #openstack-keystone | 18:53 | |
| hrybacki | ayoung: no earthly magic could make something like that happen in 24 hours | 18:53 |
| morganfainberg | hrybacki, who said anything about magic? | 18:53 |
| morganfainberg | :P | 18:53 |
| ayoung | that is like asking to attend a 3 day long meeting. With me. Amnesty International has already filed a protest | 18:53 |
| hrybacki | morganfainberg: money is magic now a days ;) | 18:54 |
| morganfainberg | ayoung, to be fair, amnesty international filed a protest long before they knew it was going to be a full 3 days. | 18:54 |
| hrybacki | ayoung: I love hackathons. My first 'conference' was the sprints portion of PyCon a couple of years back. Very tiring, very fun, great learning experience. | 18:54 |
| morganfainberg | hrybacki, where are you located? maybe the next hackathon, mid-K cycle! | 18:55 |
| hrybacki | morganfainberg: Greensboro/Raleigh NC | 18:55 |
| morganfainberg | hrybacki, we're getting marekd|away ! if we got marekd|away, I'm sure we can get you out for it | 18:55 |
| morganfainberg | ayoung, too bad jamielennox didn't want to do the insane travel for the hackathon :P | 18:55 |
| morganfainberg | hrybacki, you going to be in Paris for the summit in November? | 18:56 |
| hrybacki | morganfainberg: That'd be lovely. But, my internship will be over and I'll be back in classes =/ | 18:57 |
| morganfainberg | hrybacki, doh! | 18:57 |
| morganfainberg | hrybacki, well even with your internship being over, keep contributing!!! | 18:57 |
| ayoung | morganfainberg, couldn't get a Red Hat to spring for an intern, especially when he didn't join the project effort until June. If he's still heads down on Keystone work in the future, we'll get him to the January conf. | 18:57 |
| morganfainberg | ayoung, ++ | 18:57 |
| ayoung | He doesn't even work for my group, but I hijacked him | 18:58 |
| morganfainberg | ayoung, so... doing it right! | 18:58 |
| hrybacki | ^^ true | 18:58 |
| hrybacki | morganfainberg: I plan to. This is exciting stuff. Rather turbulent but fun none the less. | 18:58 |
| ayoung | morganfainberg, its because what we are doing with the client right now is critical path. Most of the rest of Keystone work right now is just lower priority as far as security goes | 18:58 |
| ayoung | so his team lead understands that we need the client stuff straightened out for all the projects sake | 18:59 |
| ayoung | that is why jamielennox , hrybacki , and I are all working on it pretty much exclusively | 18:59 |
| morganfainberg | ayoung, it's great when team leads get that and work with it. | 18:59 |
| hrybacki | tickets aren't as expensive as I thought they would be... ~how much are rooms for the duration of the hackathon? | 19:00 |
| *** radez_g0n3 is now known as radez | 19:00 | |
| morganfainberg | hrybacki, i think i'm paying ~$130, but i'm not staying at the recommended hotel | 19:01 |
| mrutkows | ayoung/keith_newstadt: matt rutkowski here for chat on audit middleware... o/ | 19:01 |
| morganfainberg | hrybacki, a night that is. (corp policy said the valencia was out) | 19:01 |
| hrybacki | morganfainberg: Hmmm. Debating on throwing it on the card. | 19:02 |
| morganfainberg | hrybacki, $114/night (contact me for a corporate code). [bug dolph] at the Valencia | 19:02 |
| topol | o/ | 19:03 |
| morganfainberg | hrybacki, (he's the "contact me for the corporate code" statement) | 19:03 |
| hrybacki | ayoung: (after your chat on audit middleware) thoughts on value of me going to the hackathon? | 19:03 |
| morganfainberg | topol, o\ | 19:03 |
| morganfainberg | topol, did you see my message to you this morning? | 19:03 |
| hrybacki | morganfainberg: will do | 19:03 |
| topol | morganfainberg forgot to respond, got disteracted | 19:03 |
| morganfainberg | dolphm, ^ hrybacki might need that corporate code | 19:03 |
| morganfainberg | topol, don't worry, i'll bug ya tomorrow night and get the details sent off | 19:04 |
| mrutkows | ayoung: have you seen Keith on recently? | 19:04 |
| keith_newstadt | mrutkows: i'm here now | 19:04 |
| topol | morganfainberg, perfect | 19:04 |
| mrutkows | wave | 19:04 |
| keith_newstadt | do we have everyone? | 19:04 |
| topol | hi keith_newstadt | 19:04 |
| ayoung | mrutkows, keith_newstadt yeah, I'm here, too | 19:05 |
| keith_newstadt | hi topol | 19:05 |
| keith_newstadt | ok, let's start... | 19:05 |
| *** andreaf has quit IRC | 19:05 | |
| topol | sure, go | 19:05 |
| ayoung | BTW, other keystone devs, we are going to be having a mini meeting on Audit | 19:05 |
| *** andreaf has joined #openstack-keystone | 19:05 | |
| ayoung | topol, was the driver, but keith_newstadt is interested in taking it to the next level | 19:05 |
| ayoung | right now, the audit code lives...where? | 19:06 |
| *** chandan_kumar has quit IRC | 19:06 | |
| *** gyee has joined #openstack-keystone | 19:06 | |
| keith_newstadt | here, let me start on what we're trying to accomplish at symc | 19:07 |
| morganfainberg | gyee, mini audit meeting happening, you might be interested in [happening nowish] | 19:07 |
| ayoung | morganfainberg, thanks | 19:07 |
| keith_newstadt | we're bringing a few services to iso certification, including some openstack core and some homegrown services | 19:07 |
| keith_newstadt | the homegrown services are built in openstack style, with keystone auth and the same style of design | 19:07 |
| keith_newstadt | iso requires an audit log of changes to the environment | 19:08 |
| ayoung | http://docs.openstack.org/developer/pycadf/middleware.html#enabling-audit-middleware | 19:08 |
| ayoung | hmmm.chop the internal anchor off that | 19:08 |
| ayoung | the plan is to put that middleware in the keystonemiddleware project; | 19:09 |
| ayoung | http://git.openstack.org/cgit/openstack/keystonemiddleware | 19:09 |
| morganfainberg | hm. this might require the TC's approval, it is an increase of scope of the Keystone project | 19:09 |
| mrutkows | the audit middleware filter is optional and lives apart from any specific project code right now and is part of oslo-common | 19:09 |
| ayoung | we've got the project underway, and are working to integrate it into the build system | 19:09 |
| topol | so we are putting what where??? | 19:10 |
| keith_newstadt | i'm not familiar with it. what does it provide? | 19:10 |
| morganfainberg | i don't think it's a hard sell, just it is increasing scope. | 19:10 |
| topol | the pycadf code? | 19:10 |
| ayoung | keith_newstadt, see the link I just posted | 19:10 |
| *** andreaf_ has quit IRC | 19:10 | |
| dhellmann | ayoung: why do you want the audit middleware to live in keystone? | 19:10 |
| mrutkows | keystone uses pyCADF library directly | 19:10 |
| *** andreaf_ has joined #openstack-keystone | 19:11 | |
| mrutkows | Brad knows that code moreson than i | 19:11 |
| ayoung | dhellmann, because it is the right place for audit; right next to policy | 19:11 |
| topol | what does ayoung mean by audit middleware | 19:11 |
| gyee | morgainfainberg, sorry I missed part of the conversation, are we talking about API auditing? | 19:11 |
| ayoung | ideally, the policy middleware would implement the policy enforcement | 19:11 |
| morganfainberg | i don't think it's wildly out of whack for Identity to help cover audit (since we provide a lot of the stuff that goes into it) but. ah dhellmann ! a good person to have jump in | 19:11 |
| ayoung | I don't know if we could ever make it a straight middleware | 19:11 |
| ayoung | OK...let me lay things out | 19:11 |
| dhellmann | is there something wrong with working on it where it lives now? | 19:11 |
| morganfainberg | gyee, aye. and you didn't miss much, i pinged you right at the start | 19:11 |
| ayoung | 1. right now, keystone issues tokens with roles in them | 19:12 |
| ayoung | roles are used by policy enforcement to grant/deny access | 19:12 |
| ayoung | that decision (policy enforcement) is what needs to be audited | 19:12 |
| ayoung | the middleware duplicates that | 19:12 |
| ayoung | but lacks the context | 19:12 |
| dhellmann | why don't you just use the library? | 19:13 |
| ayoung | and...I don't think it can be done as a straight middleware | 19:13 |
| ayoung | dhellmann, for policy? | 19:13 |
| ayoung | because the library from oslo is just a rules engine | 19:13 |
| dhellmann | for auditing | 19:13 |
| dhellmann | whatever you're talking about moving | 19:13 |
| ayoung | dhellmann, in time, yes. | 19:13 |
| ayoung | we need to do this in usable chunks | 19:13 |
| dhellmann | it's a library. it's meant to be reused. if it doesn't work, help fix the api. why move the code somewhere else? | 19:13 |
| morganfainberg | ayoung, ok ok wait. are we talking audit or policy | 19:13 |
| mrutkows | ayoung: excellent, the last iteration of the CADF spec. created a "control" type event for policy decisions and allow/deny outcomes | 19:13 |
| morganfainberg | lets keep the scope to the convo at hand. | 19:13 |
| morganfainberg | if we're not talking policy lets leave that to the side for now. | 19:14 |
| ayoung | morganfainberg, I was answering dhellmann's question.. | 19:14 |
| ayoung | policy and audit are hand and glove | 19:14 |
| gyee | "auditing" usually have to meeting certain security properties, like cipher chaining of log entries to make sure there's no tempering | 19:14 |
| mrutkows | ayoung: +1 | 19:14 |
| ayoung | morganfainberg, can't | 19:14 |
| *** afazekas_ has joined #openstack-keystone | 19:14 | |
| ayoung | if we treat them separately, we will end up with them in split proejcts | 19:15 |
| ayoung | we already havea broken policy mechanism (endpoints can't fetch) | 19:15 |
| gyee | not sure how we are going to aggregate those log | 19:15 |
| ayoung | gyee, that can be something we read from the config file | 19:15 |
| mrutkows | ayoung: yes, using XACML terms. the policy enforcement point (or PEP) should centrally report / audit all policy decisions or it could get messy | 19:15 |
| ayoung | ++ | 19:16 |
| ayoung | mrutkows, right. sothe problem thus far is that openstack has treated tokens, passwords, and role assignemtns as one system, and policy as a separate | 19:16 |
| ayoung | now audit comes in, and it risks become a third | 19:16 |
| topol | isnt audit interleaved into the other two? | 19:17 |
| ayoung | topol, it should be | 19:17 |
| ayoung | but if it is a stand alone middleware it can't be...so gordon't first approach is just a starting point | 19:17 |
| mrutkows | ayoung: i believe that the creation of events that support audit are separate from an independent audit service for users? | 19:17 |
| ayoung | so we put the audit middleware into the keystonemiddleware repo, then refactor | 19:18 |
| dhellmann | none of this explains why the middleware code has to move somewhere other than where it is. I'm fine if the keystone team wants to adopt pycadf, since it needs more devs anyway, but I need more detail than "because dependencies" :-) | 19:18 |
| mrutkows | ayoung: but the audit filter was created as a convenience | 19:18 |
| *** rodrigods has quit IRC | 19:18 | |
| topol | dhellmann, Im kind of like you trying to understand. I look at auditng as pycadf plu decorators + notifications | 19:18 |
| ayoung | dhellmann, keystonemiddleware is the portion of keystone program managed code designed to run in other serivces | 19:18 |
| mrutkows | ayoung: as long as the correct notifier (with audit channel setup) is used the audit middleware filter need no tbe used | 19:18 |
| ayoung | mrutkows, right, and it was a fine proof-of-concept | 19:19 |
| ayoung | mrutkows, I wanted to have it done via policy enforcement, but that is also currently implemented by eachj project | 19:19 |
| ayoung | cut-and-paste code, | 19:19 |
| ayoung | with the security and bug fix problems that implies | 19:19 |
| morganfainberg | ayoung, policy shouldn't be incubator, dhellmann knows my stance on that, but what is wrong with it graduating into it's own olso lib? | 19:20 |
| morganfainberg | ayoung, similar with audit? | 19:20 |
| morganfainberg | ayoung, i don't see the _need_ to move it to the keystonemiddleware. | 19:20 |
| ayoung | morganfainberg, it is a single system with Keystone. It needs to be reviewed by keystone devs. Oslo devs are generalists, not security folks. | 19:21 |
| *** ukalifon1 has left #openstack-keystone | 19:21 | |
| morganfainberg | dhellmann, can keystone folks be core on a graduated library? | 19:21 |
| morganfainberg | dhellmann, or is it oslo-core only? | 19:21 |
| topol | ayoung which code needs to be reviewed by keystone devs? the pycadf librabry or something else? | 19:21 |
| dhellmann | morganfainberg: each library has its own core team | 19:21 |
| ayoung | morganfainberg, and, there is a lot of work to do before we can get to a stable end state; | 19:21 |
| ayoung | topol, the policy/audit code | 19:22 |
| dhellmann | although if it's going to be largely keystone folks, I agree it would make just as much sense to move it into the keystone program | 19:22 |
| ayoung | morganfainberg, but, it belongs in keystonemiddleware; | 19:22 |
| morganfainberg | dhellmann, sure. | 19:22 |
| ayoung | here is the flow | 19:22 |
| ayoung | user gets token from keystone service, user sendstoken to , say glance | 19:22 |
| ayoung | right now, auth token middlewared unpacks token, verifies, but also says 403 | 19:22 |
| ayoung | that is a mistake, and we want to remove that | 19:23 |
| ayoung | as there are some calls that are fine to be unauthenticated, or that don't need a role | 19:23 |
| ayoung | so, once we do that, we need to keep from opening up a security hole in the apps | 19:23 |
| morganfainberg | sure, move 100% to defer policy | 19:23 |
| ayoung | we need a second layer that enforces policy | 19:23 |
| ayoung | it is this layer that needs to send audit events | 19:23 |
| morganfainberg | but policy is driven by methods on the controllers, you can't do anything with that in the middleware layer | 19:24 |
| ayoung | I know | 19:24 |
| ayoung | and that means it needs to be a library called by the other services | 19:24 |
| topol | ayoung, perfect. so the tricky part is the policy layer. audit just hitches a ride | 19:24 |
| ayoung | topol, right | 19:24 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 19:24 |
| ayoung | morganfainberg, so we make it possible for other services to call keystonemiddleware.policy.whatever | 19:25 |
| ayoung | we do that as a refactoring effort; | 19:25 |
| morganfainberg | ok, so are you saying policy language needs to encompass say... REST API calls? e.g. PUT <uri>, roles=[list]? | 19:25 |
| morganfainberg | or are we saying keep policy at the controller level? | 19:25 |
| ayoung | start with letting people deploy the audit middleware, and by getting the policy stuff clean enough to live in there | 19:25 |
| dhellmann | moving the code around to different libraries is going to break apis and existing deployments, so we need a migration plan to mitigate those issues | 19:25 |
| morganfainberg | dhellmann, ++ | 19:25 |
| ayoung | dhellmann, exactly, so this is a first step that | 19:26 |
| topol | dhellmann, what code does he want to move exactly??? | 19:26 |
| ayoung | does not require changeing other services | 19:26 |
| dhellmann | topol: excellent question :-) | 19:26 |
| ayoung | other than allowing the to use audit | 19:26 |
| topol | the policy stuff??? | 19:26 |
| ayoung | the code I want to move for policy...I'll post a link. | 19:26 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py | 19:26 |
| ayoung | that is "necessary but not sufficient" | 19:27 |
| ayoung | we need to extract the decorators as well; and those are still tightly coupled to keystone server | 19:27 |
| dhellmann | I was more worried about whatever you want to move out of pycadf or oslo-incubator | 19:27 |
| dhellmann | maybe you could write this up in a spec? | 19:27 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L87 | 19:27 |
| ayoung | dhellmann, that is the plan, but I can't own it. I have too much on my plate, I need the Audit drivers to understand the endstate and work with me on it | 19:28 |
| ayoung | hence this meeting of the minds | 19:28 |
| morganfainberg | ok so we're talking about a path to graduate policy to it's own library, and where that emits audit events, but not precluding the direct use of pycadf for certain cases | 19:28 |
| ayoung | yes...although "to its own library" should be keystonemiddleware | 19:28 |
| morganfainberg | so, pycadf stays in oslo, and policy + some policy_audit moves under keystone? | 19:28 |
| * morganfainberg is trying to understand. | 19:28 | |
| ayoung | Its the reason I didn't love the name keystonemiddleware | 19:29 |
| ayoung | its more keystone-client-for-other-services | 19:29 |
| dhellmann | https://wiki.openstack.org/wiki/Oslo/GraduationStatus#oslo.policy | 19:29 |
| *** rodrigods_ has quit IRC | 19:29 | |
| ayoung | morganfainberg, there is the whole question of how to fetch policy. | 19:29 |
| ayoung | And that needs to be audited as well. | 19:29 |
| morganfainberg | ok, so, i don't see audit needing it's own middleware. | 19:30 |
| ayoung | Then there is the question about centralized configuration of audit logging, and how to distribute that. | 19:30 |
| morganfainberg | i see this completely as a graduation path for policy | 19:30 |
| mrutkows | morgan: I believe that direct use of pyCADF is what we have done already and will continue to do so if is integral to keystone and usable for ISO audit purposes. | 19:30 |
| morganfainberg | ayoung, audit should use pycadf, plain and simple. | 19:30 |
| dhellmann | morganfainberg: there's already an audit middleware, are you saying we don't need that? | 19:30 |
| ayoung | morganfainberg, 100% Agreed | 19:30 |
| ayoung | dhellmann, not long term | 19:30 |
| morganfainberg | dhellmann, i think it fills a gap | 19:30 |
| topol | morganfainberg +++ | 19:31 |
| ayoung | dhellmann, short term yes | 19:31 |
| dhellmann | ok | 19:31 |
| morganfainberg | dhellmann, and could be useful for bootstrapping new projects | 19:31 |
| ayoung | morganfainberg, you said that better than I did | 19:31 |
| mrutkows | morgan: agree (per above stmt) | 19:31 |
| morganfainberg | mrutkows ++ | 19:31 |
| ayoung | Keystone IPA. Identity, Policy, Audit. Smooth. | 19:31 |
| topol | what replaces audit middleware? | 19:31 |
| *** rodrigods has joined #openstack-keystone | 19:31 | |
| mrutkows | audit middleware does not get replaces | 19:32 |
| ayoung | topol, OK, so let me try to make that a little clearer | 19:32 |
| dhellmann | eliminating the audit middleware may resolve an issue we have with circular dependencies with some proposed libs and oslo.messaging, so that's nice to know :-) | 19:32 |
| ayoung | I'm assuing we need audit today...that is going to use the audit middleare | 19:32 |
| morganfainberg | dhellmann, good point | 19:32 |
| ayoung | at the same time, we work at getting the policy enforcement code from keystone server into the keystonemiddleware repo. | 19:32 |
| mrutkows | topol: audit middleware can still be used for API audits only, but hard core auditing will also use keystone generated IAP events | 19:32 |
| ayoung | We clean it up so that it is usable by the other projects. | 19:33 |
| ayoung | at the same point, we integrate auditing into the policy mechanism, such that every policy decision emits and CADF message | 19:33 |
| ayoung | at some point, we cut over from using the middleware to using the policy enforcement | 19:34 |
| ayoung | its a longer path, as we need to help the other projects switch over, comparable to what we are doing with the client/session effort right now | 19:34 |
| dhellmann | so would you want us to graduate the policy module as a library in the way we've planned, to preserve the commit history, or do you really want to put it into the keystonemiddleware repository? | 19:34 |
| morganfainberg | ayoung, so policy doesn't end up in middleware at all, it stays (roughly) the same with policy being controller + decorator based | 19:34 |
| ayoung | morganfainberg, yes | 19:34 |
| morganfainberg | it just happens to emit audit as well? | 19:34 |
| ayoung | decorator moves to keystonemiddleware | 19:34 |
| ayoung | yes | 19:34 |
| morganfainberg | ayoung, no, not to keystonemiddleware. | 19:35 |
| morganfainberg | it itsn't middleware | 19:35 |
| ayoung | morganfainberg, you want to push for it being a stand alone library from the start? | 19:35 |
| morganfainberg | ayoung, yes. | 19:35 |
| ayoung | That is going to be messy | 19:35 |
| morganfainberg | ayoung, not any more messy than splitting keystoneclient and keystonemiddleware was | 19:35 |
| morganfainberg | ayoung, actually, probably less messy, since we are talking about building on the policy from incubator | 19:36 |
| ayoung | morganfainberg, I guess I am ok with it, so long as it is under the review of the same devs working on auth token middleware and the currrent policy code | 19:36 |
| ayoung | morganfainberg, that is a problem; policy in incubator is just a rules engine | 19:36 |
| ayoung | and it is owned by Oslo, and when I brought all this up two summits ago I was accused of a powergrab | 19:36 |
| ayoung | me whistles | 19:37 |
| ayoung | policy as a rules engine can be separate | 19:37 |
| ayoung | as it might be used by, say, Neutron for firewall rules or something different than Keystone manages | 19:37 |
| ayoung | this is specifically Keystone RBAC | 19:37 |
| *** afazekas_ has quit IRC | 19:37 | |
| ayoung | of which Auth token middleware is the starting point | 19:38 |
| morganfainberg | still needs to graduate, i'll defer to dhellmann if the policy library should be inclusive for the way we're doing policy enforcement or if it should be built on as aother layer for what ayoung is talking about | 19:38 |
| * ayoung going to abbreviate that to AtM | 19:38 | |
| ayoung | morganfainberg, so In the interest of keeping the refactoring process moving, I would like to do it all in keystonemiddleware | 19:38 |
| morganfainberg | if it is oslo.policy, it feels like (in my mind) it could encompass the decorators etc | 19:39 |
| ayoung | as we can put ATM and audit middleware in there | 19:39 |
| ayoung | then, refactor | 19:39 |
| ayoung | then, if needs be, extract it to its own library | 19:39 |
| *** amcrn is now known as ghost_of_amcrn | 19:39 | |
| morganfainberg | if it is meant to stand alone outside of openstack, i don't see it being the right place for the decorators that are more openstack/keystone/auth_token driven | 19:39 |
| morganfainberg | the question is, what is oslo.policy's goal to provide. | 19:39 |
| morganfainberg | if we answer that, the rest becomes much easier | 19:40 |
| ayoung | morganfainberg, I think you are hung up on that we called the repo keystonemiddleware. | 19:40 |
| morganfainberg | dhellmann, and in eithe rcase we should maintain the policy history. | 19:40 |
| ayoung | morganfainberg, so oslo.policy is the rules engine | 19:40 |
| ayoung | decorators....maybe | 19:40 |
| morganfainberg | ayoung, ok so i'm lost. what part of the code goes in keystonemiddleware? | 19:41 |
| ayoung | morganfainberg, I'd rather start with it in keystonemiddleware, and then move it to its own oslo thing once it is mature. | 19:41 |
| morganfainberg | if the engine and decorators are in oslo.policy | 19:41 |
| morganfainberg | what goes in middleware? | 19:41 |
| *** bvandenh has quit IRC | 19:41 | |
| dhellmann | morganfainberg: I think infra has to get involved if the policy history is merged into another repo, but I think they can do that without a huge hassle. So we could graduate it and then figure out how to proceed. | 19:42 |
| morganfainberg | dhellmann, yeah i know the steps to merge into another repo, we're going to do it for identity-api, but i want to be sure we're putting things in the right place | 19:42 |
| dhellmann | yeah, that part isn't clear to me yet | 19:42 |
| morganfainberg | dhellmann, its not "trivial" to do. | 19:42 |
| ayoung | morganfainberg, authorization.py, the decorators (maybe) can be oslo | 19:42 |
| ayoung | we need code to fetch the policy file from keystone, but that needs more design work | 19:43 |
| dhellmann | oslo isn't the only team allowed to create reusable libraries, so if you just mean that those things can go into their own library the keystone program could still own it | 19:43 |
| ayoung | morganfainberg, the engine itself is different from binding the engine to a controller | 19:43 |
| dhellmann | oh, god, why is something going to fetch a policy file? | 19:43 |
| ayoung | I'd rather keep the decorators out of the controller | 19:44 |
| ayoung | dhellmann, if you are going to use my other name, please use a capitol G | 19:44 |
| * dhellmann probably doesn't have enough background on these plans | 19:44 | |
| morganfainberg | ok, lets step WAY back. | 19:45 |
| ayoung | http://adam.younglogic.com/2013/07/a-vision-for-keystone/ | 19:46 |
| dhellmann | perhaps some of you could also review this spec for policy directories (mirroring the --config-dir feature of oslo.config): https://review.openstack.org/#/c/104157/ | 19:46 |
| morganfainberg | dhellmann, ++ will do | 19:46 |
| morganfainberg | dhellmann, good idea to mirror that btw. | 19:47 |
| morganfainberg | ayoung, so, when it comes to policy enforcement, how does it work. ignore where the policy file comes from | 19:47 |
| morganfainberg | ayoung, is this a decorator on a controller like keystone? is this a middleware that enforces on the REST + HTTP method? | 19:48 |
| morganfainberg | ayoung, or is it something else i'm not seeing? | 19:48 |
| ayoung | morganfainberg, it is a decorator | 19:48 |
| morganfainberg | ayoung, and it decorates the controller method? | 19:48 |
| dhellmann | is "controller" a web api controller? | 19:49 |
| *** erecio has joined #openstack-keystone | 19:49 | |
| *** erecio has quit IRC | 19:49 | |
| mrutkows | morgan: ideally policy files are controlled entities and actions taken against them strictly audited, each policy should have an associated ID that can be tracked | 19:49 |
| ayoung | morganfainberg, see the link to controller I posted above, that code needs to be cleaned up, moved to that authrzie.py file, and extracted | 19:49 |
| ayoung | dhellmann, yes | 19:49 |
| ayoung | a controller is a web API controller | 19:49 |
| morganfainberg | dhellmann, controller from the MVC design pattern | 19:49 |
| *** dstanek is now known as dstanek_zzz | 19:49 | |
| morganfainberg | mrutkows, ++ perfect | 19:49 |
| dhellmann | ok | 19:49 |
| ayoung | morganfainberg, agreed we should table "where the policy file comes from" for this discussion | 19:50 |
| ayoung | mrutkows, ++ | 19:50 |
| mrutkows | morgan: and as policy decision events are created the policy ID is logged (even the rule and PIP information used can be recorded) | 19:50 |
| morganfainberg | mrutkows, ok, cool, that makes a lot of sense | 19:51 |
| ayoung | dhellmann, there is also the fact that each policy file starts with a set of rule-definitions that really should be common acros all the services, like "how do we define admin" | 19:51 |
| *** keith_newstadt has quit IRC | 19:51 | |
| *** keith_newstadt has joined #openstack-keystone | 19:52 | |
| topol | mrutkow, i agree with everything you said. I get lost on all the proposed code shuffling between projects | 19:52 |
| mrutkows | topol: thx Brad | 19:52 |
| ayoung | topol, My goal was to get it to a central point, and it currently is split across more than just keystone projects, but glance, nova, and so for | 19:53 |
| ayoung | th | 19:53 |
| morganfainberg | topol, the only code shuffling i see being warranted is some extraction of keystone-specific things to the general library and graduation of policy to it's own library | 19:53 |
| topol | can we propose patches to where things sit now and then refactor as a second phase? | 19:53 |
| ayoung | so I'd like to put it all in keystonemiddleware, and have one library to work on, for RBAC, for policy, for audit, | 19:53 |
| topol | or a simpliststic refactoring as porposed by morganfainberg | 19:53 |
| ayoung | if people object to having the decorators in their code say keystonemiddleware, then we put the decorators into oslo | 19:54 |
| dhellmann | I thought the oslo policy library was something keystone wanted to manage? | 19:54 |
| ayoung | but the logic at the guts of the decorators stay in keystonemiddleware | 19:54 |
| topol | why would folks object to decorators in their code??? they are used all over the place?? | 19:54 |
| ayoung | dhellmann, I'm OK with the policy engine being a more general purpose piece of code | 19:55 |
| ayoung | we don't need to manage it directly, but it does need to get a stand alone library | 19:55 |
| dhellmann | ok | 19:55 |
| morganfainberg | dhellmann, i'm happy to manage it if that is what it takes to get it out of incubator :) | 19:55 |
| ayoung | dhellmann, to start, though, we can leave it in incubated, so long as the code that we use is all managed in a single, replaceable library | 19:55 |
| ayoung | so keystonemiddleware.openstack.common.policy is OK for start | 19:55 |
| dhellmann | morganfainberg: volunteers welcome! it didn't make the cut this cycle, since we're working from the bottom up | 19:56 |
| morganfainberg | dhellmann, right | 19:56 |
| morganfainberg | dhellmann, i talked to you @ the summit about it :) | 19:56 |
| dhellmann | morganfainberg: that was a million years ago | 19:56 |
| ayoung | topol, no, not "object to decorators in their code." I said "object to their decorators coming from keystonemiddleware" | 19:56 |
| topol | dhellmann, Ha Ha | 19:56 |
| topol | ayoung, OK | 19:57 |
| morganfainberg | ayoung, why make everyone use keystonemiddleware for that instead of just graduating policy, it's not a big step of work to graduate it. | 19:57 |
| topol | morganfainberg+++ | 19:57 |
| morganfainberg | dhellmann, looks like breaking oslo.config dep and minor shuffling would get us graduated? | 19:57 |
| topol | I think thats less headaches for the keystone team | 19:57 |
| dhellmann | ok, I feel like you all understand what you're proposing but I'm not 100% clear on the specifics of moving A to B and who owns what. Could we have a mailing list message with a specific list of steps in the order they may need to be taken? That would also give me something to point the oslo core team to to discuss changing ownership of the policy module, if that's still something you want. | 19:57 |
| topol | dhellmann +++ | 19:57 |
| topol | good call | 19:57 |
| morganfainberg | dhellmann, yeah this is a good ML topic | 19:57 |
| ayoung | dhellmann, I can do that | 19:57 |
| dhellmann | morganfainberg: yeah, the config dependency isn't a small thing, though, because we want to avoid having every project declare those options differently | 19:58 |
| arosen | Hi, I asked about this on friday but figured I'd ask again here. Do you guys have any pointers on how a new project should integrate with the keystone middleware? Or should I just look at nova/neutron and figure it out from there? | 19:58 |
| morganfainberg | dhellmann, right. | 19:58 |
| ayoung | dhellmann, we have a patch for creating a keystoneclient from a config file. I think it would be comparable | 19:58 |
| ayoung | arosen, heh | 19:58 |
| arosen | I got the client side figured out, so I'm working on the server side now. | 19:58 |
| ayoung | arosen, start with auth token middleware from the keystonemiddleware repo. | 19:59 |
| *** dstanek_zzz is now known as dstanek | 19:59 | |
| ayoung | And you will be ahead of the curve.... | 19:59 |
| *** andreaf has quit IRC | 19:59 | |
| dhellmann | ayoung: I had some feedback on that patch series, but haven't come back around to look at them in a while. | 19:59 |
| *** andreaf has joined #openstack-keystone | 19:59 | |
| dhellmann | ayoung: I'm not sure how they're related, though. | 19:59 |
| mrutkows | have to run to next meeting, will look for ML discussion and track | 20:00 |
| topol | me too | 20:00 |
| keith_newstadt | i have to drop off for another meeting. interesting conversation guys. we'll start with the auditing middleware for the short term, but will stay involved to see where we can contribute. this is an area that we are interested in. | 20:00 |
| ayoung | I'm going to write this up | 20:00 |
| mrutkows | ayoung, tyvm | 20:00 |
| keith_newstadt | ayoung, thanks | 20:01 |
| arosen | ayoung: there is needs to be a part before that with api-paste.ini within the project? | 20:01 |
| openstackgerrit | A change was merged to openstack/keystone: Updated from global requirements https://review.openstack.org/104018 | 20:04 |
| *** mrutkows has quit IRC | 20:04 | |
| *** marcoemorais has quit IRC | 20:06 | |
| ayoung | arosen, you just walked into a huge discussion around the issues you will face | 20:06 |
| ayoung | basically, keystone provides a token that a user hands to your service. You service has a paste pipeline set up to call auth-token middleware | 20:07 |
| ayoung | or ATM for short | 20:07 |
| ayoung | really it is | 20:07 |
| *** marcoemorais has joined #openstack-keystone | 20:07 | |
| ayoung | keystoneclient.middleware.auth_token | 20:07 |
| ayoung | but we are moving it to | 20:07 |
| *** marcoemorais has quit IRC | 20:07 | |
| ayoung | keystonecmiddleware.auth_token | 20:07 |
| *** ghost_of_amcrn is now known as amcrn | 20:07 | |
| *** marcoemorais has joined #openstack-keystone | 20:08 | |
| ayoung | arosen, after that comes policy enforcment | 20:08 |
| ayoung | the best example of it I can show you is here; | 20:08 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L87 | 20:08 |
| ayoung | arosen, and that is code I want to pull out and put into keystonemiddleware | 20:08 |
| arosen | ayoung: yup I remember reading a thread about this on the mailing list. | 20:15 |
| arosen | ayoung: I'll keep digging in nova/neutron and see how they integrate with this pipeline. Was just wondering if there was a doc out there already that explained this. | 20:16 |
| ayoung | arosen, nah, dig into Keystone | 20:16 |
| hrybacki | morganfainberg, dolphm: This may be an odd question but would it be possible to get an email formally 'inviting' me to attend the hackathon? It will go a long way in convincing my uni to reimburse some travel funds | 20:23 |
| morganfainberg | hrybacki, of course I can send one! :) | 20:23 |
| morganfainberg | hrybacki, dolphm might have a better form-letter-y thing though handy | 20:24 |
| morganfainberg | not sure ;) | 20:24 |
| dolphm | i don't have anything pre-written | 20:24 |
| morganfainberg | topol, might be able to help too! | 20:24 |
| morganfainberg | topol has all sorts of form-lettery stuff | 20:24 |
| morganfainberg | he works for IBM >.> | 20:24 |
| hrybacki | lol | 20:24 |
| topol | yes, I have done those before | 20:24 |
| dolphm | topol: is totally the person to ask for form lattery things | 20:24 |
| morganfainberg | topol, see what i did there :P | 20:24 |
| morganfainberg | dolphm, ++ | 20:25 |
| topol | its all true, all true | 20:25 |
| topol | let me dig it up | 20:25 |
| hrybacki | topol: thanks! | 20:25 |
| dolphm | morganfainberg: i happen to have a recent example of topol's form letteryness https://twitter.com/dolphm/status/485509345921073152 | 20:26 |
| topol | dolphm, so I found it. You want me to send it to you and you send the invite? | 20:26 |
| dolphm | topol: happy to | 20:26 |
| morganfainberg | dolphm, also the corp code for the valencia might be good to add in :) | 20:28 |
| morganfainberg | save some $$ on hotel if possible. | 20:28 |
| morganfainberg | hrybacki, phsaw, magic. | 20:28 |
| morganfainberg | :) | 20:29 |
| hrybacki | morganfainberg++ told ya magic was real ;) | 20:29 |
| topol | dolphm, sent the letter sample to you gmail account | 20:30 |
| topol | dolphm you may need to change the letter | 20:30 |
| topol | the one I sent was to get someone here from China | 20:31 |
| topol | you will need to bump up why it benefits the university to have hrybacki attend | 20:31 |
| arosen | ayoung: I guess I should start at create_server in bin/keystone-all and make my way up to how the keystone-paste.ini is loaded? | 20:32 |
| ayoung | arosen, start with the link I posted, which is a decorator call | 20:32 |
| ayoung | look at | 20:32 |
| topol | dolphm if you need help let meknow | 20:32 |
| morganfainberg | dolphm, bknudson, requirements update is going through gate (well recheck now) | 20:33 |
| arosen | ayoung: K | 20:33 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/controllers.py#n206 | 20:33 |
| ayoung | arosen, see the decorator there? | 20:33 |
| morganfainberg | middleware should hit today in global requirements, so we can get a project or few converted over and get real testing | 20:33 |
| morganfainberg | real = tempest | 20:33 |
| topol | hrybacki, what are the types of things that help the university understand its a good investment to send you? | 20:33 |
| ayoung | arosen, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n87 | 20:34 |
| arosen | ayoung: yup the protected decorator implementation. | 20:34 |
| ayoung | is where it is implemented | 20:34 |
| ayoung | and that is what I want to pull out into the keystonemiddleware repo | 20:34 |
| hrybacki | topol: hmm | 20:34 |
| arosen | ayoung: k, i'll start reading through this to figure out where I need to hook in. thanks! | 20:34 |
| arosen | brb | 20:34 |
| topol | hrybacki, which university and what department are you in? | 20:35 |
| hrybacki | topol: well, I'm showing that our uni/department supports and promotes the open source community -- specifically undergraduates focusing in the area | 20:35 |
| hrybacki | topol: University of North Carolina - Greensboro (UNCG) -- Computer Science | 20:35 |
| topol | hrybacki, no way, I served on a students master's thesis defense committee fromthere | 20:36 |
| topol | hrybacki, its an hour away | 20:36 |
| hrybacki | topol: where are you? | 20:36 |
| topol | hrybacki, raleigh, NC | 20:37 |
| topol | actually cary NC | 20:37 |
| hrybacki | topol: hah, I'm in Raleigh for the summer | 20:37 |
| topol | hrybacki, what dept | 20:37 |
| hrybacki | ? | 20:37 |
| topol | at the school? compter science? | 20:37 |
| topol | electrical enginnering? | 20:38 |
| hrybacki | topol: ah, yes, Computer Science | 20:38 |
| topol | hrybacki, have you made contributions to Keystone? Whats you stackalytics ID? | 20:39 |
| ayoung | topol, stop trying to steal my intern | 20:39 |
| hrybacki | topol: I wasn't aware of stackanalytics | 20:40 |
| hrybacki | ayoung: fret not, I love what RH stands for | 20:40 |
| topol | ayoung, not stealing, just trying to get details to ghost write a letter for dolphm | 20:40 |
| ayoung | Heh | 20:40 |
| ayoung | topol, nah, I know you are aboveboard, just had to say it | 20:40 |
| topol | ayoung :-) | 20:40 |
| topol | pretty funny | 20:40 |
| topol | but nice to know he's right here in raliegh....:-) | 20:41 |
| topol | :-) | 20:41 |
| ayoung | topol, I've been throwing him at the client issues | 20:41 |
| hrybacki | topol: I didn't register with it and I don't see my launchpad id in the individual engineers section | 20:41 |
| ayoung | he's gotten a couple minor patches through, | 20:41 |
| topol | K, I can make that work | 20:41 |
| hrybacki | ayoung: and several in the queue :P | 20:41 |
| ayoung | hrybacki, yep | 20:41 |
| morganfainberg | topol, http://stackalytics.com/?user_id=hrybacki | 20:41 |
| hrybacki | morganfainberg: actual name, heh | 20:42 |
| morganfainberg | hrybacki, goes by LP id | 20:42 |
| hrybacki | topol: I'll be transitioning to a coffee shop downtown for the remainder of the day to do some work for a client -- I generally do most week nights. Feel free to join in. Nice to here a keystone person is close :P | 20:43 |
| topol | k, dolphm,. morganfainberg, hrybacki, writing a new invite letter now | 20:43 |
| hrybacki | morganfainberg: my gravatar on stackanalytics accurately depicts every time I dive into this code base... | 20:44 |
| morganfainberg | hrybacki, had to disable my 3rd party cookie blocking addon to see the gravatar | 20:45 |
| morganfainberg | hrybacki, nice one :) | 20:45 |
| *** bobt has joined #openstack-keystone | 20:47 | |
| topol | dolphm, hrybacki, morganfainberg. how's this? | 20:55 |
| topol | To whom it might concern, | 20:55 |
| topol | I would like to formally invite Harry Rybacki to the OpenStack Keystone Hackathon being hosted by Rackspace and being held in San Antonio July 8-11. OpenStack is an open source Infrastructure as a Service cloud operating system that currently is growing at a pace that surpasses the Linux Open Source Community. Harry has started contributing to OpenStack Keystone which is the authentication an | 20:55 |
| topol | d authorization component used by OpenStack. By attending the Keystone hackathon, Harry will not only get to contribute his expertise to the project, but will also gain key insights into the open source development processes and philosophies used by OpenStack. OpenStack skills are in extremely high demand by vendors such as Rackspace, Red Hat, IBM, HP, Cisco, and numerous others. By... | 20:55 |
| topol | ...funding Harry to attend the OpenStack Keystone hackathon, UNCG will be taking advantage of an outstanding opportunity to start building a relationship with this critically important open source community. We very much hope that UNCG can help Harry to obtain funding to attend this conference. We look forward to continued collaboration with Harry and with UNCG and hope that you see this... | 20:55 |
| topol | ...as a mutually beneficial opportunity. | 20:55 |
| topol | best regards, | 20:55 |
| topol | Dolph Mathews | 20:55 |
| hrybacki | topol++ | 20:56 |
| topol | dolphm , sent by emaiil as well | 20:56 |
| hrybacki | thank you! | 20:56 |
| morganfainberg | topol, looks good to me! | 20:56 |
| topol | hrybacki, you are welcome. now who needs a new oxycotin prescription??? :-) | 20:57 |
| hrybacki | lol | 20:57 |
| morganfainberg | topol, <insert comment about california and other perscriptions> | 20:58 |
| morganfainberg | topol, :P | 20:58 |
| topol | dolphm, if you want me to co-sign with you at the bottom to put the fancy shmancy credentials in play thats fine too | 20:58 |
| topol | morganfainberg, almost went there but decorum prevented me | 20:59 |
| morganfainberg | topol, notice i didn't get too specific! | 20:59 |
| morganfainberg | topol, dude, i need glasses! >.> | 20:59 |
| morganfainberg | topol, what were you thinking?! :P | 21:00 |
| *** harlowja is now known as harlowja_away | 21:02 | |
| *** marcoemorais has quit IRC | 21:11 | |
| hrybacki | The airlines know... Ticket prices went from ~500 to ~1000. In the hour since I first looked. | 21:14 |
| ayoung | morganfainberg, is get_member_from_driver generalizable http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py?h=stable/icehouse#n120 | 21:14 |
| *** marcoemorais has joined #openstack-keystone | 21:14 | |
| morganfainberg | thats the callback stuff, right? | 21:14 |
| morganfainberg | oh no it isn't | 21:14 |
| morganfainberg | uhm. sec | 21:14 |
| morganfainberg | ayoung, i think you could make it more general, but it would require passing a callback in. | 21:15 |
| morganfainberg | that might also be a keystone-only construct | 21:16 |
| morganfainberg | ayoung, nova does it a little bit differently | 21:17 |
| morganfainberg | http://git.openstack.org/cgit/openstack/nova/tree/nova/api/openstack/compute/servers.py#n1075 | 21:17 |
| morganfainberg | ayoung, nova does the work and then does enforcement instead of as a decorator | 21:18 |
| morganfainberg | work = get resources in the controller method | 21:18 |
| *** topol has quit IRC | 21:20 | |
| ayoung | morganfainberg, its that "enforce" method I think we need to make general | 21:21 |
| ayoung | the decorators could stay as a keystone only implementation | 21:21 |
| stevemar | can someone take a looksy at https://review.openstack.org/#/c/104321/ | 21:22 |
| *** radez is now known as radez_g0n3 | 21:26 | |
| *** marcoemorais has quit IRC | 21:26 | |
| *** marcoemorais has joined #openstack-keystone | 21:27 | |
| *** marcoemorais has quit IRC | 21:27 | |
| *** marcoemorais has joined #openstack-keystone | 21:27 | |
| *** marcoemorais has quit IRC | 21:27 | |
| *** marcoemorais has joined #openstack-keystone | 21:28 | |
| *** marcoemorais has quit IRC | 21:28 | |
| *** marcoemorais has joined #openstack-keystone | 21:28 | |
| *** marcoemorais has quit IRC | 21:29 | |
| *** marcoemorais has joined #openstack-keystone | 21:29 | |
| *** joesavak has quit IRC | 21:32 | |
| morganfainberg | ayoung, the enforce method is already general. | 21:44 |
| morganfainberg | ayoung, that comes straight afaict from policy | 21:44 |
| ayoung | morganfainberg, there is some setup specific to each service | 21:44 |
| morganfainberg | not much http://git.openstack.org/cgit/openstack/nova/tree/nova/policy.py | 21:45 |
| ayoung | morganfainberg, yep | 21:46 |
| ayoung | and code to that effect lives in just about every project | 21:46 |
| ayoung | keystone is the only one that does the decorator approach. Not certain that the decorator is a great idea. It really only works when you cache | 21:47 |
| morganfainberg | even then. | 21:48 |
| ayoung | morganfainberg, it also means that the policy rules get embedded in the controller. You can't do what we do with the trusts where the whole rule goes into policy, to include what field to match on what | 21:48 |
| ayoung | morganfainberg, I'm doing this as a blog post. It needs images and stuff. | 21:49 |
| morganfainberg | this is something worth discussing a bit more in depth at the hackathon i think | 21:49 |
| morganfainberg | hrybacki, make sure you clear your cookies / use incognito browser | 21:50 |
| morganfainberg | hrybacki, some airlines do shaaaaady things "oh you looked, ok we | 21:50 |
| *** dstanek is now known as dstanek_zzz | 21:50 | |
| morganfainberg | ll jack up the prices next time you look" | 21:50 |
| hrybacki | morganfainberg: I only read the first line and the hairs on the back of my neck began to rise. Make sure you flip those sentences around so as not to induce heart attacks ;) | 21:51 |
| morganfainberg | lol | 21:52 |
| morganfainberg | and... gate is going to punt requiremnets update | 21:57 |
| morganfainberg | *sigh* | 21:57 |
| *** andreaf_ has quit IRC | 21:57 | |
| *** andreaf has quit IRC | 21:57 | |
| *** andreaf has joined #openstack-keystone | 21:58 | |
| *** andreaf_ has joined #openstack-keystone | 21:58 | |
| *** ayoung is now known as ayoung_dad_mode | 22:03 | |
| *** harlowja_away is now known as harlowja | 22:04 | |
| *** d34dh0r53 is now known as mostly_d34dh0r53 | 22:11 | |
| *** bknudson has quit IRC | 22:16 | |
| *** rodrigods_ has joined #openstack-keystone | 22:34 | |
| *** rodrigods_ has quit IRC | 22:34 | |
| *** stevemar has quit IRC | 22:35 | |
| *** stevemar has joined #openstack-keystone | 22:36 | |
| *** thedodd has quit IRC | 22:38 | |
| *** rodrigods_ has joined #openstack-keystone | 23:02 | |
| *** david-lyle has quit IRC | 23:04 | |
| *** daneyon has quit IRC | 23:05 | |
| jamielennox | morganfainberg: don't push the decorator policy around, it really needs to be a part of the function | 23:12 |
| jamielennox | if it wasn't for the caching layer the decorator would be terrible | 23:13 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone-specs: Propose Specification for Endpoint Group Filter https://review.openstack.org/102023 | 23:13 |
| jamielennox | we (can't remember all involved) discussed this at summit that maybe we can do a decorator to ensure that somewhere within the function that policy was called, but not to do the resource call there | 23:14 |
| morganfainberg | except the caching layer is done at the manager level | 23:17 |
| morganfainberg | not at the controller level | 23:17 |
| morganfainberg | and the polcy enforcement is only at the controller level | 23:17 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone-specs: Propose Specification for Endpoint Group Filter https://review.openstack.org/102023 | 23:18 |
| jamielennox | right, but the controller level is doing a lookup to enforce policy, and then goes into the function which will generally perform the same lookup | 23:20 |
| hrybacki | jamielennox: I made the actual session object private in https://review.openstack.org/#/c/105031/ and made you the change author -- fyi! | 23:20 |
| hrybacki | everything else is the same though | 23:20 |
| jamielennox | hrybacki: oh, cool | 23:21 |
| hrybacki | aside from making changes to match changes in auth_token since you made 74908 | 23:21 |
| jamielennox | hrybacki: actually that's great because we no longer have to worry about trove's stupid gate issues until trove decided to convert to keystonemiddleware | 23:21 |
| hrybacki | glad to be of use | 23:22 |
| jamielennox | hrybacki: are you still looking at glanceclient - i had a look through it the other day and realize just want a steaming pile i had dropped you in | 23:23 |
| hrybacki | not super actively -- got caught up with other things. Everything is so turbulent around here it's hard to sink my teeth into anything | 23:23 |
| jamielennox | hrybacki: ok - i wouldn't worry about it too much then, if you want to have a look at another client we'll find something that is at least requests based but if you have stuff you're working on already don't worry about it | 23:24 |
| hrybacki | Well, I'm fresh out of stuff to do so we should think about another client ;) | 23:24 |
| jamielennox | hrybacki: never say you're bored around here :) | 23:27 |
| hrybacki | jamielennox: I said no such thing :P | 23:27 |
| jamielennox | people will find things for you | 23:27 |
| hrybacki | That's okay when I'm also looking for things :P | 23:28 |
| hrybacki | Did you have another client in mind? | 23:28 |
| jamielennox | hrybacki: comment on https://review.openstack.org/#/c/105031/ | 23:31 |
| jamielennox | (they might have been my mistakes) | 23:32 |
| hrybacki | reviewing | 23:33 |
| jamielennox | umm, let me have a look | 23:34 |
| jamielennox | i made a start on cinderclient | 23:34 |
| jamielennox | i know there is a review for neutronclient | 23:34 |
| jamielennox | i haven't even looked at swift, but swift is a bit of a special case i think | 23:34 |
| *** dims has quit IRC | 23:37 | |
| *** oomichi has joined #openstack-keystone | 23:38 | |
| hrybacki | they are all special, aren't they? | 23:40 |
| hrybacki | posted comments | 23:40 |
| *** jaosorior has quit IRC | 23:42 | |
| jamielennox | ugh, yea swift might be a problem | 23:44 |
| hrybacki | jamielennox: safe to assume you won't be at the hackathon? | 23:45 |
| jamielennox | hrybacki: would love to, but no | 23:46 |
| hrybacki | I suppose you'd probably need to be boarding a flight about now | 23:47 |
| jamielennox | hrybacki: you can be the designated client whip cracker if you like | 23:47 |
| hrybacki | jamielennox: while normally I would say that I would love to, I need to have something to show by the 8th (actual code that is) | 23:48 |
| jamielennox | that's ok, i can get ayoung_dad_mode to do it | 23:49 |
| hrybacki | heh, he's already cracking a whip ;) | 23:50 |
| jamielennox | always, i'm not sure what his current focus is though | 23:50 |
| jamielennox | hrybacki: comment on https://review.openstack.org/#/c/105031/ | 23:51 |
| hrybacki | was already on it | 23:51 |
| jamielennox | hrybacki: new one | 23:52 |
| jamielennox | essentially this change shouldn't touch anything about caching at all | 23:52 |
| hrybacki | I'll make that local. Should we change it's name? It could confuse people as it did me. | 23:53 |
| *** rodrigods has quit IRC | 23:53 | |
| jamielennox | if you like, but it's nothing to do with this particular review so you should make it another one | 23:53 |
| jamielennox | morganfainberg: what's our license to break things with keystonemiddleware | 23:53 |
| jamielennox | morganfainberg: or did we do 1.0 already | 23:54 |
| morganfainberg | we shipped 1.0.0 | 23:54 |
| hrybacki | they 1.0'd yesterday | 23:54 |
| *** gabriel-bezerra has quit IRC | 23:54 | |
| *** tellesnobrega has quit IRC | 23:54 | |
| *** raildo has quit IRC | 23:54 | |
| morganfainberg | based on discussions, it made the most sense to make 1.0.0 a no-risk adoption | 23:54 |
| jamielennox | yea, i see the point in that | 23:55 |
| *** afaranha has quit IRC | 23:55 | |
| *** dims has joined #openstack-keystone | 23:57 | |
| *** rodrigods has joined #openstack-keystone | 23:57 | |
| *** raildo has joined #openstack-keystone | 23:58 | |
| *** gabriel-bezerra has joined #openstack-keystone | 23:58 | |
| *** tellesnobrega has joined #openstack-keystone | 23:59 | |
| *** afaranha has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!