| openstackgerrit | Arun Kant proposed a change to openstack/keystone: Adding support for ldap connection pooling. https://review.openstack.org/95300 | 00:10 |
|---|---|---|
| *** nkinder has joined #openstack-keystone | 00:10 | |
| *** xianghui has joined #openstack-keystone | 00:19 | |
| *** joesavak has joined #openstack-keystone | 00:24 | |
| *** jsavak has joined #openstack-keystone | 00:27 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Don't log sensitive auth data https://review.openstack.org/101792 | 00:29 |
| *** joesavak has quit IRC | 00:31 | |
| *** marcoemorais has quit IRC | 00:40 | |
| *** xianghui has quit IRC | 00:40 | |
| *** stevemar has joined #openstack-keystone | 00:41 | |
| *** marcoemorais has joined #openstack-keystone | 00:41 | |
| *** dims_ has quit IRC | 00:44 | |
| *** xianghui has joined #openstack-keystone | 00:53 | |
| *** bknudson has joined #openstack-keystone | 01:01 | |
| stevemar | gyee, did you need something, i think you pinged me earlier, but i was afk | 01:03 |
| *** dims_ has joined #openstack-keystone | 01:09 | |
| *** topol has joined #openstack-keystone | 01:20 | |
| *** oomichi has quit IRC | 01:20 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: JSON-Home for V3 https://review.openstack.org/103983 | 01:27 |
| *** kevinbenton has quit IRC | 01:33 | |
| *** kevinbenton has joined #openstack-keystone | 01:33 | |
| *** diegows has quit IRC | 01:37 | |
| *** marcoemorais has quit IRC | 01:39 | |
| *** gabriel-bezerra has quit IRC | 01:39 | |
| *** gabriel-bezerra has joined #openstack-keystone | 01:40 | |
| *** morganfainberg has quit IRC | 01:47 | |
| *** morganfainberg has joined #openstack-keystone | 01:47 | |
| *** mberlin1 has joined #openstack-keystone | 01:48 | |
| *** morganfainberg is now known as captainmorgan | 01:49 | |
| *** morganfainberg_Z has joined #openstack-keystone | 01:49 | |
| *** morganfainberg_Z is now known as morganfainberg | 01:50 | |
| *** mberlin has quit IRC | 01:50 | |
| *** morganfainberg is now known as captainmorgan | 01:50 | |
| *** ChanServ sets mode: +o captainmorgan | 01:51 | |
| captainmorgan | jamielennox, you can blame me for the heat tests that are failing after the new client | 01:57 |
| *** captainmorgan is now known as morganfainberg | 01:58 | |
| morganfainberg | jamielennox, sorry. | 01:58 |
| jamielennox | morganfainberg: i assumed it was you but you never now | 01:58 |
| jamielennox | know | 01:58 |
| morganfainberg | jamielennox, yeah i implemented that test :( | 01:58 |
| jamielennox | what heat tests are failing? i fixed the horizon ones | 01:58 |
| morganfainberg | jamielennox, https://bugs.launchpad.net/heat/+bug/1347319 | 01:58 |
| uvirtbot | Launchpad bug 1347319 in heat "Latest keystoneclient breaks tests" [High,In progress] | 01:58 |
| jamielennox | lol, we have amazing CI - and yet every time | 01:58 |
| morganfainberg | jamielennox, it tries to get the domain from the domain name | 01:59 |
| morganfainberg | jamielennox, or it should have | 01:59 |
| * morganfainberg very much dislikes Mox | 01:59 | |
| morganfainberg | so, i am not sure why *that* doesn't actually work | 02:00 |
| jamielennox | morganfainberg: this is one of the reasons i really like doing mocking at the requests layer | 02:00 |
| morganfainberg | but i just saw it. | 02:00 |
| jamielennox | yea - i thought that would work | 02:00 |
| jamielennox | you aren't actually creating a DomainManager there like heat was | 02:01 |
| jamielennox | morganfainberg: you sure that fixes it? | 02:01 |
| morganfainberg | jamielennox, https://review.openstack.org/#/c/108875/1/heat/tests/test_heatclient.py | 02:01 |
| morganfainberg | jamielennox, shardy just proposed that | 02:01 |
| morganfainberg | i mean, i just got back from the gym and sat down, so i was just *starting* to look at this | 02:02 |
| jamielennox | yea, i was looking - i just don't see the difference | 02:02 |
| jamielennox | i mean the new way is better, but the old way should have worked | 02:02 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Scope unscoped saml2 tokens. https://review.openstack.org/99704 | 02:03 |
| morganfainberg | i think this is mockanything vs mock | 02:03 |
| morganfainberg | it's a subtle object difference | 02:03 |
| morganfainberg | but that whole test suite needs to move to httpretty | 02:03 |
| morganfainberg | you know.. we should just provide a mock client in ksc | 02:04 |
| jamielennox | morganfainberg: well not httpretty, requests-mock | 02:04 |
| morganfainberg | right | 02:04 |
| jamielennox | is the new awesome cause i'm so sick of httpretty | 02:04 |
| morganfainberg | requests-mock, whatever not mocking the object in the client directly | 02:05 |
| morganfainberg | jamielennox, so i think we need to use the token fixtures in keystone | 02:07 |
| morganfainberg | https://review.openstack.org/#/c/106917/ ran into oddities with the version(s) we use in the provider tests doing that | 02:07 |
| morganfainberg | it's *sortof* right | 02:08 |
| morganfainberg | jamielennox, eventually i want to make it better and make the accessinfo stuff align with it | 02:08 |
| morganfainberg | jamielennox, but accessinfo does some special magic in the factory at the moment i didn't want to try and fix (and get a ksc release) prior to getting some stuff in keystone lined up | 02:09 |
| jamielennox | the factories are a mess | 02:11 |
| jamielennox | i think that's stevemar's fault actually | 02:11 |
| jamielennox | :) | 02:11 |
| stevemar | whatt | 02:11 |
| morganfainberg | jamielennox, so i figure, we do it in keystone as cleanly as possible, port the stuff from keystone over and fix the factories, convert to using ksc once we release with the fixes | 02:11 |
| jamielennox | didn't you do the original v3 client stuff | 02:11 |
| stevemar | nope | 02:11 |
| jamielennox | morganfainberg: sure, makes sense to re-use those fixtures | 02:12 |
| jamielennox | i tend to avoid the accessinfo factory | 02:12 |
| jamielennox | most of the time you know if it's a v2 or a v3 token and you can just create the right object | 02:12 |
| jamielennox | stevemar: sorry, my mistake | 02:12 |
| morganfainberg | jamielennox, yeah i really want a descriptor based system that can load in from the JSON and validate in one fell swoop to a unified (non dict based) object | 02:12 |
| morganfainberg | jamielennox, and then that object should be able to re-emit in any token format needed | 02:13 |
| jamielennox | ah, that's fairly different to accessinfo | 02:13 |
| *** gabriel-bezerra has quit IRC | 02:13 | |
| morganfainberg | jamielennox, right. but accessinfo could benefit from parts of that | 02:13 |
| *** alex_xu has joined #openstack-keystone | 02:14 | |
| *** gabriel-bezerra has joined #openstack-keystone | 02:14 | |
| jamielennox | morganfainberg: could do, but i wouldn't target client for it | 02:14 |
| stevemar | jamielennox, https://github.com/openstack/python-keystoneclient/blob/f1cc3cfc42db902589785320547204388aa170a3/keystoneclient/access.py | 02:15 |
| morganfainberg | jamielennox, nah i'd do it first in keystone then move the json->object bits to ksc, then conver keystone to extend that | 02:15 |
| stevemar | nov 2012 :( | 02:15 |
| morganfainberg | jamielennox, for the convert to format bits | 02:15 |
| stevemar | jamielennox, i had to use the accessinfo stuff for oauthy bits, but never created it | 02:16 |
| morganfainberg | but right now, i just need an object that works the same no matter the token format | 02:16 |
| jamielennox | i see feb 2013 | 02:16 |
| jamielennox | stevemar: i think i've done all the oauth in accessinfo bits | 02:16 |
| jamielennox | ayoung was going to use it as part of the revocation stuff | 02:17 |
| jamielennox | but last i saw he'd reverted to his big old dictionary model | 02:17 |
| jamielennox | morganfainberg: any update on gating on middleware? | 02:23 |
| stevemar | jamielennox, yep, you are right | 02:23 |
| morganfainberg | jamielennox, we should be gating on it now | 02:23 |
| morganfainberg | jamielennox, nova and a few other projects have converted over | 02:23 |
| jamielennox | stevemar: on? | 02:24 |
| jamielennox | morganfainberg: cool, now that ksc is released theres a few changes i only want to do if we are properly testing it | 02:24 |
| nkinder | jamielennox: ...question on https://review.openstack.org/#/c/101792 | 02:24 |
| stevemar | jamielennox, that you did the oauthy bits | 02:24 |
| nkinder | jamielennox: shouldn't we try to cover password changes too? | 02:25 |
| nkinder | jamielennox: I know the patch is supposed to be simple... (sorry) | 02:25 |
| nkinder | jamielennox: I think that and authentication are the two possible calls that would contain the password in the request | 02:26 |
| morganfainberg | jamielennox, we should be, i mean... need to check devstack-g logs for a middlewarechange to be 100% sure, but i'm 99% positive we are | 02:26 |
| jamielennox | nkinder: yea, that would make sense | 02:27 |
| jamielennox | morganfainberg: enough for me | 02:27 |
| morganfainberg | jamielennox, -e git+https://git.openstack.org/openstack/keystone@eb11bff863086afe1c791598bd326fe6e12ccc9b#egg=keystone-origin/master | 02:28 |
| morganfainberg | keystonemiddleware==1.0.0.8.g8158b95 from http://logs.openstack.org/11/108211/4/check/check-tempest-dsvm-full/6ba78de/logs/pip-freeze.txt.gz | 02:28 |
| morganfainberg | and. | 02:28 |
| morganfainberg | jamielennox, paste.filter_factory = keystonemiddleware.auth_token:filter_factory from http://logs.openstack.org/11/108211/4/check/check-tempest-dsvm-full/6ba78de/logs/etc/nova/api-paste.ini.txt.gz | 02:28 |
| morganfainberg | i'd say we're gating on it | 02:28 |
| jamielennox | morganfainberg: cool | 02:29 |
| *** gabriel-bezerra has quit IRC | 02:29 | |
| morganfainberg | oh wait | 02:29 |
| morganfainberg | huh | 02:29 |
| jamielennox | ah damnit, i can obscure those calls, but it relies on a patch that is like 4 deep in a queue | 02:30 |
| morganfainberg | keystonemiddleware==1.0.0.6.g68ba62c | 02:30 |
| morganfainberg | ok that looks like the release version... | 02:30 |
| morganfainberg | the g815 one looks like the dev one | 02:30 |
| morganfainberg | bleh. | 02:30 |
| nkinder | jamielennox: I added a comment to that effect in the review. | 02:30 |
| *** gabriel-bezerra has joined #openstack-keystone | 02:30 | |
| nkinder | jamielennox: any other requests that might have the password in it? | 02:30 |
| jamielennox | nkinder: i did a grep and it looks like there is a v2_0/tokens that does another type of authenticate with a password | 02:31 |
| morganfainberg | or is that master | 02:31 |
| * morganfainberg can't tell | 02:31 | |
| *** masahito has quit IRC | 02:31 | |
| morganfainberg | ooh we're always gating on master | 02:32 |
| morganfainberg | hrm. we might need to figure a way to gate one test on current release as well | 02:32 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow passing kwargs from managers to session https://review.openstack.org/106658 | 02:32 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add the 'auth' interface type https://review.openstack.org/104734 | 02:32 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware https://review.openstack.org/104771 | 02:32 |
| gyee | stevemar, sorry I was afk, you still there? | 02:38 |
| nkinder | morganfainberg, jamielennox: is there a policy that every patch should have an associated bug? | 02:38 |
| nkinder | I have some additional unit tests I wrote for trusts that check things from a security perspective | 02:38 |
| stevemar | gyee, yep | 02:38 |
| jamielennox | nkinder: no, only if there is an actual bug you are fixing | 02:39 |
| nkinder | The feature is behaving correctly, but there's a gap in the tests that I'm trying to fill | 02:39 |
| morganfainberg | nkinder, no policy, but it doens't hurt for tracking | 02:39 |
| morganfainberg | nkinder, no one will complain if you add a bug for it :) | 02:39 |
| nkinder | ok, I planned on filing one anyway, but just wanted to see if there were any hard rules | 02:39 |
| morganfainberg | nkinder, but most "add a test nothing else is needed" is reasonable w/o a bug id | 02:39 |
| morganfainberg | nah | 02:39 |
| gyee | stevemar, looking at the saml2.py code | 02:40 |
| gyee | for scoped token, we get the user_id from the token? | 02:40 |
| gyee | https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/saml2.py#L51 | 02:41 |
| gyee | means the token is already exist? | 02:41 |
| stevemar | gyee, user_id was already in the unscoped token | 02:41 |
| stevemar | gyee user_id is retrieved from mapping engine https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/saml2.py#L75-L81 | 02:42 |
| stevemar | gyee, line 80 it's shoved into the unscoped token | 02:43 |
| stevemar | gyee, when the user uses their unscoped token for a scoped token, the user_id is already there | 02:43 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Keystone WebSSO https://review.openstack.org/108611 | 02:55 |
| gyee | stevemar, what's line 50 means though | 02:56 |
| gyee | seem like token is already in the payload? | 02:56 |
| stevemar | gyee, yes, the token is in the payload | 02:56 |
| stevemar | gyee, https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#listing-projects-and-domains | 02:57 |
| stevemar | gyee, "To access this resource, an unscoped token is used" | 02:57 |
| stevemar | gyee, crap: this would be better... https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-a-scoped-os-federation-token-post-authtokens | 02:58 |
| stevemar | gyee, but yeah, it's part of the payload | 02:58 |
| gyee | ah | 02:58 |
| gyee | k, much better | 02:58 |
| gyee | stevemar, thanks! | 02:58 |
| stevemar | gyee, np, we didn't make it part of x-auth-token for some reason... | 02:58 |
| gyee | btw, I am trying to put together a POC to do x.509 auth with the existing framework to get an idea what does it take | 02:59 |
| gyee | seem like its easier than I thought :) | 02:59 |
| gyee | but then again, its getting late and I am hungry for dinner right now | 02:59 |
| gyee | so anything looks good | 02:59 |
| stevemar | gyee, oh i remember, it's cause for the current 'scoping' call, the token id is part of the payload anyway | 03:00 |
| stevemar | n again, its getting late and I am h | 03:00 |
| stevemar | gyee, ignore ^ https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#the-token-authentication-method | 03:00 |
| gyee | stevemar, k, I'll do more code diving later | 03:01 |
| gyee | thanks again | 03:01 |
| stevemar | gyee, it's not that bad! the keystone stuff anyway, setting up saml stuff is a PITA. np, any time | 03:01 |
| *** gyee has quit IRC | 03:02 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Don't log sensitive auth data https://review.openstack.org/101792 | 03:05 |
| *** ncoghlan has joined #openstack-keystone | 03:06 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Specification for OpenID Connect https://review.openstack.org/107890 | 03:08 |
| *** zzzeek has joined #openstack-keystone | 03:14 | |
| jamielennox | morganfainberg: the AccessInfo you copied across to https://review.openstack.org/#/c/106917/6/keystone/token/model.py | 03:14 |
| jamielennox | is based on a dict, is that what you want for server side? | 03:14 |
| morganfainberg | jamielennox, initially, that is the simplest | 03:15 |
| morganfainberg | jamielennox, i figure we can make it better incrementally | 03:15 |
| jamielennox | morganfainberg: ahh, the luxury of server side :) | 03:15 |
| morganfainberg | jamielennox, lol yeah | 03:15 |
| *** harlowja is now known as harlowja_away | 03:15 | |
| jamielennox | morganfainberg: still have a preference for models/token.py so that it encourages others | 03:15 |
| morganfainberg | i talked w/ dolphm, ayoung, and a few others | 03:16 |
| morganfainberg | it was determined <subsystem>model.py was more appropriate | 03:16 |
| morganfainberg | or well.. generally thought as much | 03:16 |
| morganfainberg | i offered both options | 03:16 |
| jamielennox | people never agree with me on these things | 03:17 |
| *** ncoghlan is now known as ncoghlan_afk | 03:17 | |
| * morganfainberg doesn't care which | 03:17 | |
| *** dims_ has quit IRC | 03:19 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Remove SAML unscoped token auth from setup.cfg https://review.openstack.org/107231 | 03:44 |
| *** dims_ has joined #openstack-keystone | 03:46 | |
| *** zzzeek has quit IRC | 03:49 | |
| *** dims_ has quit IRC | 03:51 | |
| *** topol has quit IRC | 04:03 | |
| *** oomichi has joined #openstack-keystone | 04:19 | |
| stevemar | jamielennox, hey dude, have a minute? | 04:28 |
| jamielennox | stevemar: sure | 04:28 |
| stevemar | jamielennox, having a problem and it's one of those silly ones that takes another pair of eyes -> http://paste.openstack.org/show/87691/ | 04:29 |
| stevemar | jamielennox, using curl, create works fine, so i know the endpoint exists... but using the client, it 404s | 04:30 |
| stevemar | when doing: ks.oauth1.consumers.create("blah"), if I did ks.users.list(), it works fine | 04:31 |
| jamielennox | umm, i think my first guess would be that the catalog is setup wrong | 04:33 |
| jamielennox | so you're getting a bad base URL | 04:33 |
| jamielennox | doing logging.basicConfig(level=logging.DEBUG) in your script files will show you the requests that are made from the client | 04:34 |
| *** mrmoje has quit IRC | 04:37 | |
| jamielennox | stevemar: do you have debug output there? | 04:37 |
| stevemar | jamielennox, yeah, just added it, was getting food, let me paste the output | 04:38 |
| stevemar | jamielennox, http://paste.openstack.org/show/87692/ | 04:39 |
| stevemar | Failed to contact the endpoint at http://10.0.2.15:35357/v2.0 for discovery. Fallback to using that endpoint as the base url. | 04:39 |
| stevemar | and obviously have v2.0 will not work as that endpoint | 04:41 |
| jamielennox | yea | 04:41 |
| jamielennox | it's failing discovery for some reason | 04:41 |
| stevemar | was there something i did incorrectly in setting up my client? | 04:41 |
| jamielennox | which is probably the same reason it can't contact the oauth point | 04:41 |
| jamielennox | i doubt it | 04:41 |
| jamielennox | can you http --json http://10.0.2.15:35357/v2.0 | 04:42 |
| jamielennox | ah, that might be force of habit, use wget or curl or whatever you do | 04:42 |
| stevemar | np, whoa that is weird | 04:43 |
| stevemar | $ curl http://10.0.2.15:35357/v2.0 | 04:43 |
| stevemar | {"error": {"message": "Could not find version: v2.0", "code": 404, "title": "Not Found"}} | 04:43 |
| jamielennox | so that is weird | 04:43 |
| stevemar | $ curl http://10.0.2.15:35357/v3 | 04:43 |
| stevemar | {"version": {"status": "stable", "updated": "2013-03-06T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}, {"base": "application/xml", "type": "application/vnd.openstack.identity-v3+xml"}], "id": "v3.0", "links": [{"href": "http://10.0.2.15:35357/v3/", "rel": "self"}]}} | 04:43 |
| stevemar | thats a bit fucky | 04:43 |
| jamielennox | / ? | 04:43 |
| stevemar | funky* | 04:44 |
| jamielennox | lol, same meaning | 04:44 |
| stevemar | pretty much | 04:44 |
| stevemar | i have no idea why v2 is not set up | 04:44 |
| *** gabriel-bezerra has quit IRC | 04:44 | |
| jamielennox | ibm is embracing v3 only? | 04:45 |
| stevemar | hmmm http://10.0.2.15:5000/v2.0 responds with stuff | 04:45 |
| stevemar | not likely, this was spun up with devstack, probably just a corrupted env. | 04:45 |
| stevemar | it's a bit old | 04:45 |
| jamielennox | maybe it was a v3 everywhere devstack trial | 04:46 |
| jamielennox | although password auth worked | 04:46 |
| *** gabriel-bezerra has joined #openstack-keystone | 04:46 | |
| stevemar | bah | 04:48 |
| stevemar | i have no idea | 04:48 |
| *** sumit__ has joined #openstack-keystone | 04:55 | |
| sumit__ | Hi, we are trying to generate token using keystone 'token-get' command, but it is throwing following error: 'NoneType' object has no attribute 'has_service_catalog' | 04:56 |
| sumit__ | How to resolve this ? | 04:57 |
| *** ajayaa has joined #openstack-keystone | 04:57 | |
| *** stevemar has quit IRC | 05:04 | |
| *** mrmoje has joined #openstack-keystone | 05:09 | |
| *** chandankumar has joined #openstack-keystone | 05:18 | |
| *** shausy has joined #openstack-keystone | 05:19 | |
| *** chandankumar_ has joined #openstack-keystone | 05:20 | |
| *** chandankumar has quit IRC | 05:22 | |
| *** ciypro|afk has quit IRC | 05:28 | |
| *** chandankumar_ is now known as chandankumar | 05:28 | |
| *** cjellick_ has joined #openstack-keystone | 05:32 | |
| *** k4n0 has joined #openstack-keystone | 05:33 | |
| *** cjellick has quit IRC | 05:35 | |
| *** cjellick_ has quit IRC | 05:37 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:43 | |
| *** afazekas has quit IRC | 05:47 | |
| *** dims has joined #openstack-keystone | 05:50 | |
| *** dims has quit IRC | 05:55 | |
| ajayaa | dolphm, jamielennox, How do I get an endpoint associated with a service_id via catalog api? | 06:00 |
| *** cjellick has joined #openstack-keystone | 06:03 | |
| *** alex_xu has quit IRC | 06:03 | |
| *** sumit__ has quit IRC | 06:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/106939 | 06:07 |
| *** cjellick has quit IRC | 06:12 | |
| *** alex_xu has joined #openstack-keystone | 06:20 | |
| *** afazekas has joined #openstack-keystone | 06:26 | |
| *** tomoiaga has joined #openstack-keystone | 06:26 | |
| jamielennox | ajayaa: it's not via catalog api, when you create an endpoint you set the service id that it should be associated with | 06:27 |
| jamielennox | so from cli keytone endpoint-create --service-id XXXX | 06:27 |
| jamielennox | sumit__ is gone | 06:28 |
| ajayaa | jaimelennox, remember yesterday I was talking about caching in catalog layer. When I a service is deleted, I need to invalidate the cache entry for associated endpoint also. | 06:28 |
| ajayaa | Currently I am getting all the end points through catalog_api.list_endoints() and iterating through the list to match the service id. | 06:29 |
| ajayaa | jamielennox, | 06:29 |
| ajayaa | jamielennox, I was wondering whether there is a better way to get associated endpoint with a service. | 06:30 |
| jamielennox | oh, it appears you can provide hints to list_endpoitns() | 06:32 |
| jamielennox | that will let you filter for a service id | 06:32 |
| jamielennox | i don't know how you're doing caching to help you invalidate from that | 06:32 |
| ajayaa | what is a hint? Can I just pass the service_id as hint? | 06:34 |
| jamielennox | it's defined in common.driver_hints | 06:35 |
| jamielennox | it's a series of prompts that a backend should respond to - if it knows how | 06:35 |
| jamielennox | so you can tell it that it should only return those associated with a service_id - but you can't trust that it did it | 06:36 |
| jamielennox | as in you still need to iterate over the returned values to make sure | 06:36 |
| jamielennox | use like | 06:36 |
| jamielennox | hints = driver_hints.Hints() | 06:36 |
| jamielennox | hints.add_filter('service_id', 'XXXXXX') | 06:36 |
| jamielennox | i *think* it'll be service id, the SQL hints are fairly simple so it'll match the table name | 06:37 |
| jamielennox | you can see how they're applied in common.sql.utils i think it is | 06:37 |
| jamielennox | keystone.common.sql.core.filter_limit_query | 06:38 |
| ajayaa | jamielennox, Thanks. That is helpful. :) | 06:43 |
| *** jimbaker has quit IRC | 06:43 | |
| *** joesavak has joined #openstack-keystone | 06:44 | |
| ajayaa | jamielennox, To make it work with all kind of backends I think I still need to get all the endpoints and invalidate the one which is associated with the service_id being deleted. | 06:45 |
| *** jsavak has quit IRC | 06:46 | |
| *** jimbaker has joined #openstack-keystone | 06:47 | |
| *** jimbaker has quit IRC | 06:51 | |
| *** jimbaker has joined #openstack-keystone | 06:51 | |
| *** jimbaker has quit IRC | 06:57 | |
| *** jimbaker has joined #openstack-keystone | 07:01 | |
| *** jimbaker has quit IRC | 07:01 | |
| *** jimbaker has joined #openstack-keystone | 07:01 | |
| *** jimbaker has quit IRC | 07:07 | |
| *** cjellick has joined #openstack-keystone | 07:08 | |
| *** jimbaker has joined #openstack-keystone | 07:12 | |
| *** jimbaker has quit IRC | 07:12 | |
| *** jimbaker has joined #openstack-keystone | 07:12 | |
| *** cjellick has quit IRC | 07:13 | |
| *** alex_xu has quit IRC | 07:17 | |
| *** jimbaker has quit IRC | 07:17 | |
| *** jimbaker has joined #openstack-keystone | 07:23 | |
| *** jimbaker has quit IRC | 07:23 | |
| *** jimbaker has joined #openstack-keystone | 07:23 | |
| *** jimbaker has quit IRC | 07:29 | |
| *** alex_xu has joined #openstack-keystone | 07:29 | |
| *** gabriel-bezerra has quit IRC | 07:31 | |
| *** gabriel-bezerra has joined #openstack-keystone | 07:32 | |
| *** jimbaker has joined #openstack-keystone | 07:33 | |
| *** jimbaker has quit IRC | 07:33 | |
| *** jimbaker has joined #openstack-keystone | 07:33 | |
| *** jimbaker has quit IRC | 07:43 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Use keystoneclient.exceptions https://review.openstack.org/108675 | 07:45 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Bump hacking to 0.9.x series https://review.openstack.org/107328 | 07:45 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Removed keystone.apiclient https://review.openstack.org/107926 | 07:46 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Removed keystoneclient.apiclient https://review.openstack.org/107926 | 07:47 |
| *** jimbaker has joined #openstack-keystone | 07:47 | |
| *** jimbaker has quit IRC | 07:47 | |
| *** jimbaker has joined #openstack-keystone | 07:47 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Removed keystoneclient.apiclient https://review.openstack.org/107926 | 07:49 |
| *** dims has joined #openstack-keystone | 07:53 | |
| *** jimbaker has quit IRC | 07:53 | |
| *** mrmoje has quit IRC | 07:55 | |
| *** dims has quit IRC | 07:58 | |
| *** jimbaker has joined #openstack-keystone | 08:00 | |
| *** jimbaker has quit IRC | 08:00 | |
| *** jimbaker has joined #openstack-keystone | 08:00 | |
| *** jimbaker has quit IRC | 08:04 | |
| *** jimbaker has joined #openstack-keystone | 08:07 | |
| *** jimbaker has quit IRC | 08:07 | |
| *** jimbaker has joined #openstack-keystone | 08:07 | |
| openstackgerrit | wanghong proposed a change to openstack/python-keystoneclient: expose the revoke token for V3 https://review.openstack.org/102701 | 08:10 |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: CRUD grant functions don't check user_id and group_id https://review.openstack.org/107973 | 08:12 |
| *** gabriel-bezerra has quit IRC | 08:12 | |
| *** jimbaker has quit IRC | 08:12 | |
| *** gabriel-bezerra has joined #openstack-keystone | 08:12 | |
| *** henrynash has joined #openstack-keystone | 08:15 | |
| *** jimbaker has joined #openstack-keystone | 08:19 | |
| *** jimbaker has quit IRC | 08:19 | |
| *** jimbaker has joined #openstack-keystone | 08:19 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Group related methods for LDAP backend https://review.openstack.org/102244 | 08:23 |
| *** jimbaker has quit IRC | 08:24 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: add internal delete notification for endpoint https://review.openstack.org/108329 | 08:24 |
| *** jimbaker has joined #openstack-keystone | 08:27 | |
| *** jimbaker has quit IRC | 08:27 | |
| *** jimbaker has joined #openstack-keystone | 08:27 | |
| *** andreaf has quit IRC | 08:29 | |
| *** mrmoje has joined #openstack-keystone | 08:30 | |
| *** andreaf has joined #openstack-keystone | 08:30 | |
| *** andreaf_ has joined #openstack-keystone | 08:30 | |
| *** andreaf_ has quit IRC | 08:41 | |
| *** ncoghlan has quit IRC | 08:45 | |
| marekd | jamielennox: ping. | 08:51 |
| *** dims has joined #openstack-keystone | 08:53 | |
| *** dims has quit IRC | 08:58 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Use keystoneclient.exceptions https://review.openstack.org/108675 | 09:02 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Bump hacking to 0.9.x series https://review.openstack.org/107328 | 09:05 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Removed keystoneclient.apiclient https://review.openstack.org/107926 | 09:05 |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Check the url format when create endpoint https://review.openstack.org/93426 | 09:06 |
| *** alex_xu has quit IRC | 09:14 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: add --rebuild option for ssl/pki_setup https://review.openstack.org/88207 | 09:25 |
| *** oomichi has quit IRC | 09:29 | |
| *** ukalifon has joined #openstack-keystone | 09:37 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Catch correct oslo.db exception https://review.openstack.org/108935 | 09:43 |
| *** henrynash has quit IRC | 09:45 | |
| *** henrynash has joined #openstack-keystone | 09:49 | |
| *** henrynash has quit IRC | 09:50 | |
| *** ajayaa has quit IRC | 10:01 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Enforce authenticated=False in saml2 plugin https://review.openstack.org/108944 | 10:18 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Rename saml2_token_url to token_url https://review.openstack.org/108946 | 10:23 |
| *** ajayaa has joined #openstack-keystone | 10:26 | |
| *** afazekas has quit IRC | 10:29 | |
| *** afazekas has joined #openstack-keystone | 10:38 | |
| *** syedawaisali has joined #openstack-keystone | 10:43 | |
| *** dims has joined #openstack-keystone | 10:45 | |
| *** diegows has joined #openstack-keystone | 11:03 | |
| *** cjellick has joined #openstack-keystone | 11:10 | |
| *** cjellick has quit IRC | 11:15 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: generic-mapping-federation https://review.openstack.org/104301 | 11:15 |
| *** kwss has joined #openstack-keystone | 11:16 | |
| *** joesavak has quit IRC | 11:20 | |
| *** jamielennox is now known as jamielennox|away | 11:26 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Check the url format when create endpoint https://review.openstack.org/93426 | 11:26 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Details the proper way to call a callable https://review.openstack.org/104552 | 11:35 |
| *** chandankumar has quit IRC | 11:47 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Insert space between ``#`` and the comment https://review.openstack.org/108965 | 11:47 |
| *** chandankumar has joined #openstack-keystone | 11:49 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: Expand the caching layer in keystone https://review.openstack.org/108970 | 11:54 |
| *** dims has quit IRC | 12:05 | |
| *** k4n0 has quit IRC | 12:05 | |
| openstackgerrit | Abhishek Kekane proposed a change to openstack/keystone: Keystone service throws error on SIGHUP signal https://review.openstack.org/107482 | 12:13 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Allow passing kwargs from managers to session https://review.openstack.org/106658 | 12:19 |
| *** henrynash has joined #openstack-keystone | 12:26 | |
| *** gabriel-bezerra has quit IRC | 12:26 | |
| *** gabriel-bezerra has joined #openstack-keystone | 12:26 | |
| *** dims has joined #openstack-keystone | 12:27 | |
| *** lbragstad has joined #openstack-keystone | 12:35 | |
| *** xianghui has quit IRC | 12:36 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Hierarchical Projects https://review.openstack.org/108841 | 12:37 |
| *** bvandenh has joined #openstack-keystone | 12:41 | |
| *** alex_xu has joined #openstack-keystone | 12:47 | |
| *** rwsu has joined #openstack-keystone | 13:01 | |
| *** bvandenh has quit IRC | 13:02 | |
| *** hrybacki has joined #openstack-keystone | 13:04 | |
| *** dims has quit IRC | 13:07 | |
| *** syedawaisali has quit IRC | 13:07 | |
| *** stevemar has joined #openstack-keystone | 13:15 | |
| *** bknudson has quit IRC | 13:17 | |
| *** zzzeek has joined #openstack-keystone | 13:20 | |
| *** afazekas has quit IRC | 13:27 | |
| *** gordc has joined #openstack-keystone | 13:28 | |
| *** joesavak has joined #openstack-keystone | 13:28 | |
| *** xianghui has joined #openstack-keystone | 13:29 | |
| kwss | stevemar, thanks for renaming the blueprint! :) | 13:30 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: generic-mapping-federation https://review.openstack.org/104301 | 13:31 |
| *** dims has joined #openstack-keystone | 13:37 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Add string id type validation https://review.openstack.org/108862 | 13:38 |
| dstanek | zzzeek: hi | 13:38 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Add string id type validation https://review.openstack.org/108862 | 13:39 |
| zzzeek | hey dstanek | 13:39 |
| dstanek | zzzeek: i created a fedora 20 vm last night, but i could not duplicate the issue | 13:39 |
| zzzeek | ok | 13:39 |
| stevemar | kwss, np! i'm reviewing the spec again | 13:40 |
| kwss | thanks! | 13:40 |
| stevemar | kwss, so the whole issue w/ user_id... is it because some apache plugins already set the user name? | 13:41 |
| dstanek | zzzeek: i had a commit merge yesterday that messed with the xml matcher... you can try to run the tests against c95fdbc5c54052eec30663b7ac82349c6539e2d2 which is the commit right before the change | 13:41 |
| stevemar | kwss, and you want to avoid using the mapping engine unnecessarily if it's already set? | 13:41 |
| zzzeek | dstanek: OK, I have to run out today for awhile but will try later | 13:41 |
| kwss | stevemar, well not necessarily the plugin, but SAML2 already passes the NameID in the assertion, I don't know how mod_shib translates that but it should already be there | 13:42 |
| kwss | other protocols have similar ways of defining this | 13:42 |
| *** bknudson has joined #openstack-keystone | 13:42 | |
| *** afazekas has joined #openstack-keystone | 13:43 | |
| *** topol has joined #openstack-keystone | 13:43 | |
| stevemar | kwss, then NameID would be a remote attribute in the rules, and we use user{id:%0%} in the local rules | 13:44 |
| kwss | stevemar, if we already have it, and know where it is, then we don't need to map it, and it can be used as a mapping value for mapping policies applied to multiple IdPs/protocols | 13:44 |
| stevemar | kwss, i agree that if it's already there, we don't need to map it | 13:44 |
| kwss | stevemar, I think that the NameID is carried in the subject element rather than the attribute statement, not sure if that affects how mod_shib assigns it in the environment | 13:46 |
| marekd | dstanek: around? | 13:46 |
| dstanek | marekd: yep | 13:46 |
| stevemar | kwss, one suggested re-write | 13:48 |
| kwss | stevemar, we're interested in creating virtual organisations, where users can self register for group membership, and we need to insert mappings based on the user_id for this | 13:48 |
| kwss | stevemar, that sounds better, thanks :) I'll patch it now | 13:49 |
| dstanek | lbragstad: you there? | 13:50 |
| lbragstad | dstanek: yep | 13:50 |
| dstanek | lbragstad: so i was thinking that night that the way we are defining type may be insufficient to handle create and update with the same type (at least as is) | 13:51 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: generic-mapping-federation https://review.openstack.org/104301 | 13:51 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Bump hacking to 0.9.x series https://review.openstack.org/107328 | 13:51 |
| dstanek | for update the type may change from 'string' to ['string', 'null'] | 13:52 |
| lbragstad | yeah? | 13:52 |
| dstanek | at least for the optional keys | 13:52 |
| lbragstad | you mean optional keys being either a string or None, right? | 13:52 |
| lbragstad | allowing for a user to update an optional attr with None | 13:52 |
| lbragstad | dstanek: https://review.openstack.org/#/c/108862/ FYI | 13:53 |
| marekd | dstanek: https://review.openstack.org/96867 regarding your comments on that review, you might want to check out this one https://review.openstack.org/#/c/108611/2/specs/juno/keystone-websso.rst ( I posted it as I didn't see the previous bp progressing very much ;/) | 13:53 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Use keystoneclient.exceptions https://review.openstack.org/108675 | 13:53 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Bump hacking to 0.9.x series https://review.openstack.org/107328 | 13:53 |
| dstanek | lbragstad: yes, i'll go through the reviews again and note if i see the case | 13:54 |
| lbragstad | ok, sounds good | 13:54 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Removed keystoneclient.apiclient https://review.openstack.org/107926 | 13:54 |
| dstanek | marekd: is this a new protocol instead of using oauth? | 13:55 |
| marekd | dstanek: there is no new protocol. | 13:55 |
| marekd | dstanek: in fact this is for federation only. | 13:55 |
| *** richm has joined #openstack-keystone | 13:58 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: Expand the caching layer in keystone https://review.openstack.org/108970 | 13:58 |
| dstanek | marekd: hmmm... i'll have to look into this more, but i think it solves a different issue | 13:59 |
| marekd | dstanek: two bps solve websso issue. | 13:59 |
| dstanek | marekd: the other BP seemed to make Keystone IdP more accessible - yours delegates to another IdP | 14:00 |
| *** chandankumar_ has joined #openstack-keystone | 14:01 | |
| marekd | dstanek: I don't follow | 14:01 |
| marekd | dstanek: in case federation and web sso is going to be used | 14:01 |
| marekd | in the other BP will simply redirect to a protected url at the Keystone side | 14:02 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 14:02 |
| dstanek | marekd: where does openstack_auth run? i thought that was used in horizon? | 14:02 |
| marekd | dstanek: user goes through federation workflow | 14:02 |
| marekd | dstanek: horizon. | 14:02 |
| dstanek | the other spec was about not giving horizon credentials and instead having a web interface on Keystone right? or did i misread? | 14:03 |
| marekd | dstanek: not giving credentials - correct, having a web interace on Keystone - but only for passing your credentials. | 14:04 |
| *** chandankumar has quit IRC | 14:04 | |
| marekd | once you have a token you should use your horizon or whatever. | 14:04 |
| *** chandankumar_ has quit IRC | 14:04 | |
| dstanek | marekd: right. your spec isn't doing that though right? it sounds like you pick an IdP and you get redirected there | 14:05 |
| stevemar | kwss, thanks kristy! if i see any other changes i'll upload a new version, i won't change any content though | 14:05 |
| kwss | stevemar, great thanks :) | 14:05 |
| marekd | dstanek: my BP solves one specific issue: websso and nothing more. you need to initiate websso saml workflow with Keystone. Instead of the unscoped token yu will be redirected to a horizon web interface (but with the token). | 14:06 |
| *** chandankumar has joined #openstack-keystone | 14:06 | |
| *** zzzeek has quit IRC | 14:07 | |
| marekd | dstanek: the other BP tries to solve multple problems by applying oAuth2.0 (or homemare oAuth-like protocol) | 14:07 |
| marekd | s/homemare/homemade | 14:07 |
| dstanek | marekd: ok, then i do understand them correctly. i'll go over yours in more detail after i look at lbragstad's latest push | 14:07 |
| marekd | sure, thanks. | 14:07 |
| dstanek | marekd: does you bp make the other bp easier to implement? | 14:08 |
| marekd | no | 14:08 |
| *** afazekas has quit IRC | 14:09 | |
| dstanek | lbragstad: line 35 on https://review.openstack.org/#/c/86484/34/keystone/assignment/schema.py | 14:09 |
| dstanek | lbragstad: during a project update can the domain_id be cleared by sending a null value? | 14:09 |
| lbragstad | I don't see why it couldn't be | 14:09 |
| *** cjellick has joined #openstack-keystone | 14:10 | |
| lbragstad | dstanek: in that case, https://review.openstack.org/#/c/108862/4/keystone/common/validation/parameter_types.py | 14:10 |
| *** cjellick has quit IRC | 14:10 | |
| lbragstad | line 37 should be ['string', 'null'] | 14:10 |
| *** cjellick has joined #openstack-keystone | 14:10 | |
| dstanek | lbragstad: but will all IDs be optional? | 14:11 |
| lbragstad | not necessarily | 14:12 |
| dolphm | dstanek: domain_ids can't be cleared on PATCH /v3/projects/{project_id} | 14:12 |
| lbragstad | dstanek: https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#credentials-v3credentials | 14:13 |
| lbragstad | dstanek: if we were to use that type 'id_string' on credentials it would allow for None on a required attribute | 14:13 |
| dolphm | dstanek: lbragstad: also, this is the problem i ran into when poking around with jsonschema like 2 years ago. i needed different schemas for create vs update, but most attributes were common | 14:13 |
| dstanek | lbragstad: that's my point - there are cases where you want a type require and others where you may not | 14:14 |
| lbragstad | dolphm: yeah, which makes for a lot of duplication in the schema per resource | 14:14 |
| lbragstad | the easiest way to fix that i think would be to control it per resource | 14:14 |
| dolphm | lbragstad: i made my schemas classes that could be walked like dicts by jsonschemas, so i could use inheritance | 14:14 |
| dstanek | lbragstad: dolphm: i had a thought last night that i didn't hack out yet | 14:15 |
| dstanek | let me throw something together real quick | 14:15 |
| lbragstad | ok | 14:15 |
| lbragstad | dolphm: so, you're schemas were classes and not dictionaries | 14:17 |
| *** shausy has quit IRC | 14:19 | |
| dstanek | lbragstad: https://etherpad.openstack.org/p/jsonschema-objects is what i did the day before the hackathon | 14:20 |
| dolphm | lbragstad: they were classes that quacked like dictionaries | 14:20 |
| dstanek | stevemar: ^ i object-ifed the federation schema | 14:20 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/109002 | 14:20 |
| * dolphm is going to go to the castle before claco managers me for working from home | 14:20 | |
| *** tziOm has quit IRC | 14:24 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/106210 | 14:25 |
| stevemar | dstanek, dolphm whats the expected output for curl http://localhost:35357/v2.0 | 14:25 |
| stevemar | i keep getting 404'd | 14:25 |
| *** ayoung has joined #openstack-keystone | 14:25 | |
| *** afazekas has joined #openstack-keystone | 14:27 | |
| dstanek | stevemar: hmmmm...my new devstack doesn't run anything on 35357 - but on 5000 i get a short json doc | 14:27 |
| *** gabriel-bezerra has quit IRC | 14:27 | |
| stevemar | dstanek, yes on 5000 i get that too | 14:28 |
| stevemar | dstanek, i'm wondering if something is screwy with devstack, or keystoneclient | 14:28 |
| *** gabriel-bezerra has joined #openstack-keystone | 14:28 | |
| stevemar | dstanek, cause discovery seems to default to :35357/v2.0 as a fall back | 14:29 |
| dstanek | stevemar: devstack now runs behind apache so i'm betting that's why i'm confused | 14:29 |
| stevemar | but if it's not there, seems like a bad choice to default to that | 14:29 |
| stevemar | ahhh | 14:29 |
| dstanek | stevemar: found it? | 14:32 |
| dstanek | lbragstad: this is what is was thinking https://gist.github.com/dstanek/a4f8fed405df911ada81#file-jsd-py-L34 | 14:32 |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Check the url format when create endpoint https://review.openstack.org/93426 | 14:32 |
| lbragstad | dstanek: http://pasteraw.com/gwxix6ldn8ikd4m8wkxp1kutwkyqkba | 14:33 |
| lbragstad | dstanek: so, the create method wouldn't allow for an attribute to be None, | 14:34 |
| lbragstad | right? | 14:34 |
| lbragstad | and update would allow for a reference to contain an optional attribute that is either of type string or None. | 14:35 |
| dstanek | lbragstad: i'd rather name it though - parameter_types.optional_id_string since you may use it more than once | 14:35 |
| dstanek | lbragstad: you mean in my example? | 14:35 |
| lbragstad | dstanek: yeah, | 14:35 |
| lbragstad | I suppose, if we put these things in common/validation/parameter_types.py | 14:35 |
| lbragstad | we could name them | 14:35 |
| lbragstad | optional and what not | 14:35 |
| dstanek | lbragstad: i think it would be ok to have null optional value - but i coded it to not allow | 14:35 |
| lbragstad | ok | 14:36 |
| lbragstad | I like the idea of optional_id_string and id_string | 14:36 |
| lbragstad | or required_id_string | 14:36 |
| *** david-lyle has joined #openstack-keystone | 14:36 | |
| lbragstad | it would be nice if the schema referenced as much of the common types as possible. | 14:37 |
| dstanek | i'd be fine with it either way - agreed | 14:37 |
| alex_xu | ayoung, hi, are you around | 14:37 |
| lbragstad | ok, gotta run to standup, I'll get something coded up in the first id_string patch | 14:38 |
| dstanek | dolphm, lbragstad: it is worth it to spend another hour or two to take the jsd prototype and implement in keystone? | 14:38 |
| stevemar | dstanek, nope... i'm still confused, i don't see how apache could cause an issue with it | 14:39 |
| dstanek | stevemar: for me i just don't have anything running on that port | 14:40 |
| dstanek | hmmm...actually if i run keystone-all i don't get anything on that port either | 14:41 |
| stevemar | dstanek, "{"error": {"message": "Could not find version: v2.0", "code": 404, "title": "Not Found"}}" | 14:41 |
| stevemar | could not find version is a suspicious error | 14:41 |
| *** gabriel-bezerra has quit IRC | 14:41 | |
| stevemar | it's not "The resource could no be located" | 14:41 |
| *** gabriel-bezerra has joined #openstack-keystone | 14:42 | |
| *** rajesh has joined #openstack-keystone | 14:43 | |
| dstanek | ah, once i specified the sample config i got it running on the right port | 14:44 |
| *** rajesh is now known as Guest57200 | 14:44 | |
| *** vhoward has left #openstack-keystone | 14:44 | |
| dstanek | stevemar: i do get a json doc there | 14:44 |
| dstanek | stevemar: http://paste.openstack.org/raw/87760/ | 14:45 |
| stevemar | dstanek, ?? what do you mean | 14:45 |
| stevemar | what what changes did you do to the sample config? | 14:45 |
| dstanek | stevemar: no changes to it. i had to specify it using: "python bin/keystone-all --config-file=etc/keystone.conf.sample" | 14:46 |
| dstanek | stevemar: otherwise it used the /etc/keystone/keystone.conf installed by devstack | 14:46 |
| *** ukalifon has quit IRC | 14:48 | |
| *** thedodd has joined #openstack-keystone | 14:48 | |
| *** lbragstad has quit IRC | 14:49 | |
| marekd | stevemar: super busy with debugging devstack and port 35357? | 14:49 |
| *** lbragstad has joined #openstack-keystone | 14:50 | |
| marekd | kwss: hellouuu | 14:50 |
| kwss | marekd: hi :) | 14:50 |
| marekd | kwss: i have a question for you - isn't usually WAYF/DS a protocol specific? | 14:51 |
| marekd | is it common to present a WAYF website to a user where he can chhose a protocol (saml, oidc) and the IdP? | 14:51 |
| *** chandankumar_ has joined #openstack-keystone | 14:51 | |
| morganfainberg | morning | 14:51 |
| kwss | marekd, ordinarily the SP will not support multiple protocols, but as Keystone does it needs to be handled differently | 14:52 |
| stevemar | marekd, i got time, whats up | 14:52 |
| marekd | kwss: because I was rather thinking: /OS-FEDERATION/websso/saml2 is fully handled by mod_shib and saml wayf/ds service, whilst /OS-FEDERATION/websso/oidc will have have another wayf servie | 14:52 |
| stevemar | dstanek, thats weird, i am using the default config file, i think anyway, let me check | 14:52 |
| kwss | marekd, but then either horizon, or the user needs to choose the protocol | 14:53 |
| kwss | marekd, if horizon does, how does it know which the user's IdP uses, and if the user does, we expect end users to be protocol aware? | 14:53 |
| marekd | stevemar: this patch: https://review.openstack.org/#/c/106751/ relies on get_options() that you want to remove in https://review.openstack.org/#/c/107231/ | 14:53 |
| marekd | kwss: before i answer it: suppose the /secure is our protected endpoint. | 14:54 |
| marekd | kwss: and this is normal website | 14:54 |
| marekd | kwss: user types host.example.com/secure | 14:55 |
| *** lbragstad has quit IRC | 14:55 | |
| marekd | and by typing that he is already binded to one protocol, right? | 14:55 |
| kwss | marekd, how so? | 14:55 |
| *** chandankumar has quit IRC | 14:55 | |
| marekd | because you cannot configure mod_shib and mod_auth_oidc to protect the same endpoint | 14:55 |
| marekd | kwss: correct me if i am wrong. | 14:55 |
| *** Guest57200 has quit IRC | 14:56 | |
| kwss | marekd, but isn't the protected endpoint actually host.example.com/websso/{protocol}? | 14:57 |
| *** lbragstad has joined #openstack-keystone | 14:57 | |
| marekd | kwss: yes yes yes, i was talking about another usecase. I am proposing /websso/{p} otherwise we will lock ourselves with one protocol only, am I right? | 14:57 |
| kwss | marekd, right, so you need to know the protocol to try to access the protected endpoint? | 14:58 |
| marekd | kwss: I would expect horizon admins to add one option in settings and a button the redirects a user to hardcoded url: /websso/saml2 or /websso/oidc | 14:58 |
| marekd | kwss: i don't think it's common for companies to have multiple federated protocols. | 14:59 |
| kwss | marekd, and if keystone supports both, how does horizon know which to send the user to if the user might have an IdP at either? | 14:59 |
| morganfainberg | dolphm, to Sean Dague's point, TripleO's Program name is "Deployment" | 14:59 |
| morganfainberg | dolphm, TripleO is the code-name | 14:59 |
| kwss | marekd, isn't the point of federation partly to enable cross organisation collaboration? | 14:59 |
| morganfainberg | dolphm, https://wiki.openstack.org/wiki/Programs | 14:59 |
| marekd | kwss: horizon: two buttons: "authN via SAML" -> redirects to /websso/saml2, "authN via oidc" -> redirect to /websso/oidc | 15:00 |
| marekd | kwss: but not with a one protocol usually? | 15:00 |
| *** erecio has joined #openstack-keystone | 15:00 | |
| marekd | kwss: you can ask David | 15:00 |
| marekd | kwss: he probably knows the stuff. | 15:00 |
| ajayaa | morganfainberg, good morning! Please have a look at https://review.openstack.org/#/c/108970/ | 15:01 |
| kwss | marekd, do you not think it's feasible for Org A to use a SAML2 IdP and Org B to use an Open IDC one, and for them to share resources | 15:01 |
| morganfainberg | ajayaa, already looking better (See the added configs!), i'll review it shortl | 15:01 |
| morganfainberg | y | 15:01 |
| kwss | Two buttons is fine, as long as end users know which one they use, but in my experience, end users are often not so aware of underlying mechanisms | 15:02 |
| marekd | kwss: :( | 15:02 |
| ajayaa | morganfainberg, thanks! | 15:02 |
| marekd | kwss: i don't see any specific parameter that lets discovering protocol used. | 15:03 |
| kwss | marekd, Keystone is already capable of functioning as a WAYF service by using /v3/identity_providers and the user gets to choose his IdP name instead | 15:03 |
| marekd | kwss: there is something in what you are saying :-) | 15:04 |
| kwss | marekd, will horizon login page be modified to add a federation login button? | 15:05 |
| marekd | yes, but i don't think it's within the scope of this BP | 15:05 |
| marekd | kwss: if you take a look at BP's references (at the bottom) | 15:05 |
| marekd | there is something published | 15:05 |
| marekd | as we had to sketch something quite quickly as cern joined a federation | 15:06 |
| kwss | marekd, but any client could query Keystone for the IdPs theoretically and give the user a list | 15:06 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Insert space between ``#`` and the comment https://review.openstack.org/108965 | 15:06 |
| marekd | kwss: what client? | 15:06 |
| alex_xu | ayoung, have to go to sleep now. I miss you again :( I just want to ask could you revisit https://review.openstack.org/104157 again, do you think keystone based policy will instead of file based policy, or file based and keystone based can be existed at sametime as different backend? if they can be existed sametime, I will continue push that propose. And will think about keystone based later. | 15:06 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Enforce authenticated=False in saml2 plugin https://review.openstack.org/108944 | 15:06 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Rename saml2_token_url to token_url https://review.openstack.org/108946 | 15:06 |
| dolphm | morganfainberg: that's not what governance says | 15:06 |
| morganfainberg | dolphm, ah so wiki and governance are out of sync | 15:07 |
| morganfainberg | i trust governance then | 15:07 |
| dolphm | morganfainberg: i am wrong! | 15:07 |
| dolphm | devstack's program name is devstack | 15:07 |
| kwss | marekd, horizon or an custom client, it doesn't matter | 15:09 |
| *** radez_g0n3 is now known as radez | 15:10 | |
| marekd | kwss: client like web interface or cli client? | 15:10 |
| marekd | clie should use ecp | 15:10 |
| marekd | cli* | 15:10 |
| kwss | marekd, web interface | 15:10 |
| marekd | kwss: well, if you develop your own webif and want to use websso you have some requirements... | 15:11 |
| *** lbragstad has quit IRC | 15:11 | |
| marekd | kwss: i cannot fix all the problems :-) | 15:11 |
| morganfainberg | ajayaa, just commented, a couple more things to fix, but you're close | 15:11 |
| kwss | marekd, don't worry, I wasn't suggesting you make one, just that if you did, it would work the same | 15:11 |
| *** alex_xu has quit IRC | 15:12 | |
| marekd | stevemar: any comments? | 15:13 |
| marekd | stevemar: (sorry, i focused on disq with kwss ) | 15:13 |
| stevemar | marekd, (sorry, i'm focused on other stuff, too) :( | 15:14 |
| marekd | stevemar: np | 15:14 |
| *** erecio has quit IRC | 15:14 | |
| dolphm | if anyone is interested in trying it, Textual IRC client is available for free on the OS X app store *today only* (it's normally like $5 or $10) | 15:15 |
| morganfainberg | dolphm, it is also free if you want to compile it | 15:17 |
| morganfainberg | dolphm, buying it on the app store is just a "hey i support you guys and may want direct support in the future" | 15:17 |
| morganfainberg | dolphm, https://github.com/Codeux/Textual/ | 15:17 |
| dolphm | morganfainberg: wtf where's the link to github on their site?! | 15:17 |
| morganfainberg | dolphm, they *want* you to pay | 15:18 |
| morganfainberg | dolphm, it's also a fork of limechat (back in the bsd license days) | 15:18 |
| openstackgerrit | Abhishek Kekane proposed a change to openstack/keystone: Keystone service throws error on SIGHUP signal https://review.openstack.org/107482 | 15:18 |
| dolphm | morganfainberg: but they don't even mention that's its open source... | 15:18 |
| dolphm | morganfainberg: i normally use limechat; it's got a couple issues that make me want to try something new | 15:19 |
| morganfainberg | dolphm, they don't have to. it's a secret-ish-sortof | 15:19 |
| *** lbragstad has joined #openstack-keystone | 15:21 | |
| dolphm | morganfainberg: in light of TripleO being the code name, I'm thinking AAA makes a lot more sense | 15:21 |
| morganfainberg | dolphm, ++ | 15:21 |
| morganfainberg | dolphm, i commented as much | 15:22 |
| dolphm | morganfainberg: so, just spell them all out as the program name? | 15:23 |
| morganfainberg | dolphm, short or long form, but spelling them out might be more correct | 15:23 |
| morganfainberg | simply so someone doesn't assume we do accounting | 15:23 |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Keystone part of a PoC for Horizon/Keystone WebSSO https://review.openstack.org/106096 | 15:23 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add docs for how to create an OAuth auth instance https://review.openstack.org/109013 | 15:24 |
| dolphm | morganfainberg: so then we just need to discuss the oxford comma | 15:24 |
| morganfainberg | dolphm, imo always use the oxford comma unless you want the last two elements to be considered a single item :P | 15:24 |
| morganfainberg | dolphm, and in this case, auditing isn't exclusive to authorization | 15:24 |
| morganfainberg | dolphm, /me stops being picky about that kind of grammar :P | 15:25 |
| dolphm | morganfainberg: also, my yaml parser pukes on the comma... | 15:25 |
| morganfainberg | in quotes? | 15:25 |
| dolphm | my yaml syntax highlighter* (going to run a validator now..) | 15:25 |
| *** afazekas has quit IRC | 15:27 | |
| *** tomoiaga has quit IRC | 15:27 | |
| dolphm | morganfainberg: the first two i tried didn't seem to care, but i can't get this one to say it's valid at all http://wiki.ess3.net/yaml/ | 15:29 |
| dolphm | morganfainberg: "Error: Element 'Authentication__Authorization_and_Audit': This element is not expected. Expected is ( groups )." | 15:29 |
| morganfainberg | paste of the yaml? | 15:30 |
| morganfainberg | the link is an empty web-form | 15:30 |
| dolphm | oh, fuck. it's expecting a certain yaml structure. this isn't a yaml validator at all | 15:30 |
| morganfainberg | haha | 15:30 |
| dolphm | morganfainberg: okay, so if the program name is Authentication, Authorization and Audit, is the codename still Keystone or is the codename then AAA? :-/ | 15:32 |
| morganfainberg | I'd keep the codename keystone | 15:32 |
| morganfainberg | no reason to change that. | 15:32 |
| *** joesavak has quit IRC | 15:33 | |
| *** xianghuihui has joined #openstack-keystone | 15:34 | |
| *** xianghui has quit IRC | 15:36 | |
| dolphm | morganfainberg: so, http://pasteraw.com/q7yskbjiokifxmy67od33p9nc2d20dq | 15:36 |
| morganfainberg | dolphm, LGTM | 15:37 |
| *** lbragstad has quit IRC | 15:38 | |
| *** lbragstad has joined #openstack-keystone | 15:39 | |
| *** lbragstad has quit IRC | 15:40 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: generic-mapping-federation https://review.openstack.org/104301 | 15:41 |
| stevemar | kwss, polished it up a bit ^ just formatting | 15:42 |
| kwss | stevemar, thanks so much, I really appreciate it :) | 15:42 |
| stevemar | np! | 15:42 |
| marekd | +1'd | 15:43 |
| *** packet has joined #openstack-keystone | 15:44 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: Expand the caching layer in keystone https://review.openstack.org/108970 | 15:45 |
| ajayaa | morganfainberg, updated. :) | 15:47 |
| morganfainberg | ajayaa, you see the reasoning behind those comments right? caching is a bit fickle and a royal pain to do right | 15:48 |
| *** joesavak has joined #openstack-keystone | 15:48 | |
| morganfainberg | ayoung, you might need to remove 'token caching' bit from the cache_time help | 15:49 |
| morganfainberg | ayoung, not you ajayaa ^ | 15:49 |
| morganfainberg | ajayaa, you still hve 'token' in the help string | 15:49 |
| morganfainberg | ajayaa, https://review.openstack.org/#/c/108970/3/keystone/common/config.py line 750 | 15:50 |
| *** marcoemorais has joined #openstack-keystone | 15:50 | |
| ajayaa | morganfainberg, missed a bit in excitement. Thanks. | 15:50 |
| morganfainberg | and i think https://review.openstack.org/#/c/108970/3/keystone/catalog/core.py line 132 needs to be above the for loop | 15:50 |
| morganfainberg | ajayaa, otherwise you still have hte potential for caching to occur on an endpoint where a service hasn't been invalidated yet | 15:51 |
| ajayaa | morganfainberg, yes. Which one should be done first? the service invalidation or the endpoint invalidation? | 15:53 |
| ajayaa | morganfainberg, endpoint depends on service[id], so service invalidation followed by endpoint invalidation is the right way, I suppose. | 15:54 |
| morganfainberg | ajayaa, yeah you got it | 15:54 |
| dolphm | why does pip consider v1.2b3 to match <1.2 ?! | 15:55 |
| morganfainberg | dolphm, alpha and beta release | 15:56 |
| morganfainberg | dolphm, its dumb | 15:56 |
| morganfainberg | dolphm, you want 1.2(stable) to win over 1.2(alpha) | 15:57 |
| dolphm | blah | 15:57 |
| *** gyee has joined #openstack-keystone | 15:58 | |
| *** jsavak has joined #openstack-keystone | 15:59 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: Expand the caching layer in keystone https://review.openstack.org/108970 | 15:59 |
| stevemar | kwss, yay +2's from everyone, dolphm gyee want to pull the trigger and +A it? | 16:00 |
| *** lbragstad has joined #openstack-keystone | 16:00 | |
| kwss | stevemar, yay :D | 16:00 |
| *** ajayaa has quit IRC | 16:01 | |
| *** joesavak has quit IRC | 16:03 | |
| gyee | stevemar, did | 16:07 |
| *** hrybacki has quit IRC | 16:07 | |
| gyee | this should work for x509 as well, which is coolness | 16:08 |
| *** packet has quit IRC | 16:08 | |
| *** ayoung has quit IRC | 16:09 | |
| *** packet has joined #openstack-keystone | 16:10 | |
| stevemar | yay | 16:11 |
| kwss | :) | 16:11 |
| *** chandankumar_ has quit IRC | 16:13 | |
| *** xianghuihui has quit IRC | 16:16 | |
| dstanek | stevemar: did you get your issue straightened out? | 16:24 |
| *** afazekas has joined #openstack-keystone | 16:24 | |
| stevemar | dstanek, nope, gave up, i dunno whats going on | 16:26 |
| dstanek | stevemar: I don't blame you | 16:28 |
| *** topol_ has joined #openstack-keystone | 16:31 | |
| *** topol has quit IRC | 16:31 | |
| *** topol_ is now known as topol | 16:31 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Add string id type validation https://review.openstack.org/108862 | 16:33 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 16:33 |
| dolphm | lbragstad: can i submit another patchset for the first string id type validation ^ ? | 16:34 |
| lbragstad | dolphm: sure, go for it | 16:35 |
| lbragstad | I'm wrapping my head around dstanek's implementation | 16:35 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Add string id type validation https://review.openstack.org/108862 | 16:39 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 16:39 |
| dolphm | lbragstad: simplied the default regex and expanded the help text for the option ^ | 16:39 |
| lbragstad | dolphm: perfect, thanks | 16:40 |
| *** henrynash has quit IRC | 16:41 | |
| *** henrynash has joined #openstack-keystone | 16:41 | |
| *** lbragstad has quit IRC | 16:43 | |
| *** gabriel-bezerra has quit IRC | 16:43 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: generic-mapping-federation https://review.openstack.org/104301 | 16:45 |
| *** gabriel-bezerra has joined #openstack-keystone | 16:45 | |
| *** henrynash has quit IRC | 16:48 | |
| *** ayoung has joined #openstack-keystone | 16:49 | |
| *** joesavak has joined #openstack-keystone | 16:50 | |
| ayoung | morganfainberg, I just did an clean install and setup of devstack. And Keystone is running in HTTPD, and It made me so happy... | 16:51 |
| morganfainberg | ayoung, :) | 16:51 |
| ayoung | morganfainberg, I'm a figure out how to attach a debugger to it now | 16:51 |
| *** afazekas is now known as _afazekas | 16:52 | |
| *** turul_ has joined #openstack-keystone | 16:52 | |
| *** turul_ is now known as afazekas | 16:52 | |
| *** amcrn has joined #openstack-keystone | 16:53 | |
| *** kwss has quit IRC | 16:53 | |
| *** jsavak has quit IRC | 16:53 | |
| ayoung | morganfainberg so the eventlet approach was to add it to the command line, but I am thinking config options like: DEBUGGER=admin or DEBUGGER=main to distinguish between each of the wsgi apps, otherwise you'll have conflict at startup over who owns the debugging port | 16:54 |
| morganfainberg | probably | 16:54 |
| ayoung | dolphm, can you approve a stable backport https://review.openstack.org/#/c/93060/ ? | 16:56 |
| raildo | morganfainberg: ping | 16:57 |
| *** marcoemorais has quit IRC | 17:00 | |
| *** gokrokve has joined #openstack-keystone | 17:01 | |
| *** marcoemorais has joined #openstack-keystone | 17:02 | |
| ayoung | morganfainberg, what is the "right" way to restart httpd in devstack? | 17:03 |
| ayoung | $ sudo systemctl status httdp.service | 17:03 |
| ayoung | httdp.service | 17:03 |
| ayoung | Loaded: not-found (Reason: No such file or directory) | 17:03 |
| ayoung | but I know it is running | 17:03 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Make token_provider_api contain token persistence https://review.openstack.org/109041 | 17:03 |
| morganfainberg | ayoung, httdp ? | 17:06 |
| morganfainberg | ayoung, i think you have a typo there | 17:06 |
| ayoung | ah | 17:07 |
| *** browne has joined #openstack-keystone | 17:07 | |
| ayoung | morganfainberg, heh, I was expecting it not to work, so I was not surprised when it didn't | 17:07 |
| * morganfainberg slowly plods along getting non-persistent tokens going | 17:07 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Make token_provider_api contain token persistence https://review.openstack.org/109041 | 17:10 |
| *** gokrokve has quit IRC | 17:12 | |
| *** gabriel-bezerra has quit IRC | 17:12 | |
| *** gokrokve has joined #openstack-keystone | 17:13 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:14 | |
| openstackgerrit | Sam Leong proposed a change to openstack/keystone: Disable a domain will revoke tokens under the same domain https://review.openstack.org/107194 | 17:14 |
| *** gabriel-bezerra has joined #openstack-keystone | 17:15 | |
| openstackgerrit | Sam Leong proposed a change to openstack/keystone: Disable a domain will revoke tokens under the same domain https://review.openstack.org/107194 | 17:16 |
| *** gokrokve has quit IRC | 17:17 | |
| ayoung | morganfainberg, OK, so I have horizon running in a VM, with Keystone and the other /opt/stack directories nfs mounted. I'm going to develop on my local desktop system, but see the changes on the remote vm. If this works..... | 17:19 |
| ayoung | morganfainberg, do you know if pycharm has support for remote debugging? | 17:19 |
| morganfainberg | ayoung, it has pydevd support | 17:19 |
| ayoung | excellent | 17:20 |
| dolphm | ayoung: that's not a backport | 17:20 |
| dolphm | ayoung: i also don't understand why I'm a co-author on it | 17:20 |
| morganfainberg | ayoung, i think you need to use it's specific pydevd, | 17:20 |
| ayoung | dolphm, I think you were co-author on the main patch | 17:20 |
| *** harlowja_away is now known as harlowja | 17:20 | |
| ayoung | dolphm, it required modifications, so it is no Cherry Pick, but it is a backport of https://review.openstack.org/#/c/78521/ | 17:21 |
| ayoung | Dolph Mathews | 17:22 |
| ayoung | Mar 18 7:20 AM | 17:22 |
| ayoung | Uploaded patch set 3. | 17:22 |
| dolphm | ayoung: why is there no icehouse backport? | 17:23 |
| ayoung | dolphm, I think it went in already | 17:24 |
| morganfainberg | dolphm, https://review.openstack.org/#/q/I3bb5cc11b3c5c9108cfa656d5f5de1eaeb103fe5,n,z | 17:24 |
| morganfainberg | dolphm, not sure why icehouse one was abandond? was this something that snuck into RC? | 17:24 |
| morganfainberg | or predated Icehouse release | 17:24 |
| morganfainberg | ah | 17:24 |
| ayoung | this fix is in icehouse stable | 17:24 |
| ayoung | commit 9c15b73f8361ce8606a531b5765c94b3927d99c4 | 17:24 |
| morganfainberg | predated icehouse release. | 17:24 |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Refactor set domain-id and mapping code https://review.openstack.org/107680 | 17:25 |
| ayoung | This was one of the things that THe Go Daddy team talked about in the session at the Juno Summit | 17:25 |
| ayoung | morganfainberg, BTW, I replace the /var/www/keystone/admin and main files with symlinks to /opt/stack/keystone/httpd/keystone.py and it seems to work. I think we probably want that in the future. | 17:27 |
| ayoung | in devstack | 17:27 |
| morganfainberg | dolphm, so, quick update on non-persistent tokens. I think I've got 1 big change (will be split up) and 2-3 smaller ones for keystone server to be happy | 17:28 |
| *** Chicago has quit IRC | 17:29 | |
| dolphm | ayoung: i'm reviewing it, but this change has always appeared feature-y to me. i'd suggest bringing it up on the mailing list | 17:32 |
| dolphm | ayoung: the stable maintenance list, to be specific | 17:32 |
| *** gokrokve has joined #openstack-keystone | 17:34 | |
| dolphm | ayoung: +1'd, but ping the list ^ and explain why a configuration option is a desirable backport here | 17:41 |
| ayoung | will do | 17:42 |
| dolphm | dstanek: morganfainberg: any ideas on why the "NoSuchOptError: no such option: validation" here? https://jenkins04.openstack.org/job/gate-keystone-docs/2174/console | 17:43 |
| *** marcoemorais has quit IRC | 17:47 | |
| morganfainberg | dolphm, not sure but https://review.openstack.org/#/c/108862/6/keystone/common/validation/parameter_types.py will never work, the CONF.validation.id_string_regex will always be the default | 17:47 |
| morganfainberg | dolphm, since that will be generated at import time | 17:47 |
| dolphm | morganfainberg: oh that's exactly what it is | 17:48 |
| dolphm | morganfainberg: CONF hasn't been built yet | 17:48 |
| morganfainberg | dolphm, ah | 17:48 |
| openstackgerrit | Arun Kant proposed a change to openstack/keystone: Adding support for ldap connection pooling. https://review.openstack.org/95300 | 17:48 |
| morganfainberg | dolphm, bknudson's change (from like icehouse) is doing it's job! preventing that from happening | 17:48 |
| *** marcoemorais has joined #openstack-keystone | 17:49 | |
| bknudson | y, CONF() doesn't happen until after imports | 17:50 |
| *** bjornar has joined #openstack-keystone | 17:52 | |
| dstanek | hide the schema generation behind functions? | 17:56 |
| dolphm | and that's how i broke python http://pasteraw.com/f0bpuwypijrlczh39umrxfhqugcbn6n | 17:56 |
| dstanek | dolphm: no i mean have validated call a function that returns a schema | 17:58 |
| dolphm | dstanek: understood; the above is what i was already trying | 17:59 |
| dstanek | ah i see | 17:59 |
| dolphm | morganfainberg: uhh, belated question. auth_token used to depend on wsgi things like webob. i don't see any wsgi-things left in keystonemiddleware/requirements.txt | 18:05 |
| dolphm | morganfainberg: so we didn't gain what i thought we gained from the repo split..? or am i missing something | 18:06 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add docs for how to create an OAuth auth instance https://review.openstack.org/109013 | 18:06 |
| morganfainberg | dolphm, hm. well the middleware depends on keystoneclient (whcih we can't remove it's version of middleware from yet**) | 18:07 |
| morganfainberg | dolphm, we might need to increase the requirements for keystonemiddleware to cover a gap, we might be succeeding because we depend on keystoneclient | 18:07 |
| morganfainberg | dolphm, i'm not sure when we can yank the middleware bit out of keystoneclient tbh. | 18:08 |
| dolphm | morganfainberg: i thought of that, but i don't see anything in keystoneclient either. | 18:08 |
| *** jamielennox|away has quit IRC | 18:08 | |
| morganfainberg | hm | 18:08 |
| morganfainberg | dolphm, i don't think we actually rely on webob or wsgi things | 18:09 |
| morganfainberg | dolphm, for auth_token. but we do have things like memcache requiremnt | 18:09 |
| morganfainberg | dolphm, our tests depend on webob | 18:10 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystonemiddleware: remove unused dep: prettytable https://review.openstack.org/109059 | 18:11 |
| morganfainberg | dolphm, s3token relies on webob | 18:11 |
| *** hrybacki has joined #openstack-keystone | 18:11 | |
| dolphm | related change ^ | 18:11 |
| morganfainberg | dolphm, ++ | 18:11 |
| *** jamielenz has joined #openstack-keystone | 18:12 | |
| *** lbragstad has joined #openstack-keystone | 18:13 | |
| dolphm | morganfainberg: is keystonemiddleware going to use stevedore? | 18:14 |
| dolphm | or just client | 18:15 |
| *** jamielennox|away has joined #openstack-keystone | 18:15 | |
| morganfainberg | dolphm, is there a reason for it to? | 18:15 |
| *** gabriel-bezerra has quit IRC | 18:15 | |
| morganfainberg | i think just client | 18:15 |
| dolphm | morganfainberg: not that i can think of | 18:15 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystonemiddleware: remove unused dep: stevedore https://review.openstack.org/109063 | 18:15 |
| morganfainberg | we should move webob to requirements.txt from test-requirements.txt for middleware since S3 relies on webob | 18:16 |
| *** gabriel-bezerra has joined #openstack-keystone | 18:16 | |
| *** jamielenz has quit IRC | 18:16 | |
| dolphm | morganfainberg: ++ i'll do that now | 18:16 |
| *** radez has quit IRC | 18:16 | |
| *** ukalifon1 has joined #openstack-keystone | 18:16 | |
| *** jamielenz has joined #openstack-keystone | 18:17 | |
| *** rwsu_ has joined #openstack-keystone | 18:17 | |
| *** syedawaisali has joined #openstack-keystone | 18:18 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystonemiddleware: move webob from test-requirements to requirements https://review.openstack.org/109064 | 18:18 |
| *** rharwood has quit IRC | 18:18 | |
| stevemar | dolphm is crushing the 1 line changes today | 18:19 |
| *** jamielennox|away has quit IRC | 18:19 | |
| dolphm | stevemar: hey the last one was +1 / -1 | 18:19 |
| *** jamielennox|away has joined #openstack-keystone | 18:20 | |
| *** hrybacki has quit IRC | 18:20 | |
| dolphm | a dude from IBM once told me that IBM engineers write an average of 4 lines of code per day, according to some internal survey/study/whatever IBM does in it's free time | 18:21 |
| *** rwsu has quit IRC | 18:21 | |
| dolphm | so i've now met my quota | 18:21 |
| *** jamielenz has quit IRC | 18:21 | |
| stevemar | dolphm, guys like bknudson bring our average up | 18:22 |
| morganfainberg | dolphm, they take surveys on how many lines of code they write instead of writing them | 18:22 |
| *** hrybacki_ has joined #openstack-keystone | 18:23 | |
| bknudson | I don't follow the development process. | 18:23 |
| dolphm | i wonder what my LOC reviewed vs written ratio is | 18:23 |
| *** rharwood has joined #openstack-keystone | 18:23 | |
| lbragstad | lol | 18:23 |
| dolphm | bknudson: ++ | 18:23 |
| bknudson | with the new spec process we can get keystone to the same level | 18:23 |
| morganfainberg | bknudson, but stackalytics counts specs as LOC, so .. thats hundreds of extra :P | 18:23 |
| *** jamielenz has joined #openstack-keystone | 18:24 | |
| bknudson | you can get a lot done in 4 lines of code | 18:24 |
| *** jamielennox|away has quit IRC | 18:24 | |
| *** radez_g0n3 has joined #openstack-keystone | 18:25 | |
| *** radez_g0n3 is now known as radez | 18:25 | |
| *** jamielennox|away has joined #openstack-keystone | 18:27 | |
| *** xianghui has joined #openstack-keystone | 18:28 | |
| dolphm | oh noes, my 3 hours of sleep last night just caught up with me | 18:28 |
| *** jamielenz has quit IRC | 18:30 | |
| *** jamielennox|away has quit IRC | 18:31 | |
| *** jamielenz has joined #openstack-keystone | 18:31 | |
| *** mrmoje has quit IRC | 18:34 | |
| lbragstad | morganfainberg: when adding a new configuration group is there anything else that needs to be added outside of the options in config.py? | 18:37 |
| stevemar | dolphm, why would you do a silly thing like that | 18:37 |
| morganfainberg | lbragstad, shouldn;t be | 18:38 |
| lbragstad | morganfainberg: ok, sounds good, just wanted to check since I was getting NoSuchOptError: no such option: validation | 18:39 |
| morganfainberg | lbragstad, that is because CONF() isn't built at that point (dolphm asked about i assume the same patch earlier) | 18:39 |
| lbragstad | wanted to make sure I didn't miss a step | 18:39 |
| lbragstad | ah | 18:39 |
| lbragstad | gotcha | 18:39 |
| morganfainberg | it ensures you aren't referencing conf values at import time and therefore not getting updated values when the conf is changed/loaded from the config file | 18:40 |
| ayoung | morganfainberg, I GOT REMOTE DEBUGGING TO WORK !!!!!111!1!11One!11!!Won!!!obiwan!!! | 18:47 |
| lbragstad | morganfainberg: ok, so we if want to reference CONF.validation.id_string_regex here : https://review.openstack.org/#/c/108862/6/keystone/common/validation/parameter_types.py | 18:48 |
| *** syedawaisali has quit IRC | 18:48 | |
| lbragstad | do I have to redo that part and pull it in somewhere else? | 18:48 |
| *** gabriel-bezerra has quit IRC | 18:48 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:49 | |
| lbragstad | morganfainberg: dolphm ok, on the same page now, should we pull the config options for id_string_regex then? | 18:53 |
| morganfainberg | lbragstad, yes, you need to build that object (dict) after keystone is running. | 18:53 |
| dolphm | lbragstad dstanek morganfainberg: i'm trying to think of the simplest way to do that ^ | 18:53 |
| morganfainberg | lbragstad, basically, it can't be referenced until the config file is loaded | 18:53 |
| lbragstad | morganfainberg: and we can't really enforce order can we? | 18:54 |
| morganfainberg | lbragstad, we do by not loading the config until runtim. | 18:54 |
| morganfainberg | lbragstad, or closer to runtime that is | 18:55 |
| dstanek | this is what i was thinking : http://paste.openstack.org/show/87811/ | 18:58 |
| lbragstad | dstanek: oh, gotcha... and that would live in keystone/common/validation/parameter_types.py | 18:58 |
| dolphm | dstanek: lbragstad: my approach is worse http://pasteraw.com/bmv9x5cskvi1jd4y0wgeidkax3pctvl | 19:00 |
| dstanek | lbragstad: yeah, but the kicker is that is can't get called until is it used. not at import time | 19:00 |
| dolphm | dstanek: yeah, test_validation still wants to call it at import | 19:00 |
| *** rwsu_ is now known as rwsu | 19:01 | |
| dstanek | actually i have another idea | 19:01 |
| raildo | dolphm: What is the deadline for spec approval, so that the functionality can get in Juno? | 19:01 |
| dolphm | lbragstad: your call to self.config_fixture.config() can be dropped from test_validation btw, it's only resetting the default | 19:02 |
| lbragstad | and we could reference that in the different schemas by doing, http://paste.openstack.org/show/87812/ | 19:02 |
| lbragstad | for example? | 19:02 |
| dolphm | raildo: we never set a firm date, but the theory was that it would be this week https://wiki.openstack.org/wiki/SpecApprovalDeadline | 19:02 |
| dstanek | lbragstad: no, because that is still import time | 19:03 |
| dolphm | raildo: neutron had a firm date of July 20th based on that wiki, and has enforced it | 19:03 |
| bknudson | I'm looking a this issue with revocation events... | 19:05 |
| raildo | dolphm: ok, I'm a little concerned with the approval of the spec on hierarchical multi-tenancy due to this deadline. | 19:05 |
| lbragstad | dstanek: gotcha | 19:05 |
| bknudson | it looks like if you revoke a scoped token created from an unscoped token then the unscoped token is revoked | 19:05 |
| bknudson | which I think breaks horizon, since it uses an unscoped token | 19:06 |
| raildo | dolphm: There will be some activity in the next days to review the specs with more intensity? | 19:06 |
| bknudson | of course it depends on your database returning timestamps in milliseconds or something... | 19:06 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystonemiddleware: Convert auth_token middleware to use sessions https://review.openstack.org/105031 | 19:07 |
| dolphm | raildo: i'd like to have a feature branch for hierarchical multitenancy, so we can make it easy for people to spin up devstack with it enabled | 19:07 |
| hrybacki_ | jamielenz: !!! | 19:07 |
| bknudson | it looks like it's just a fundamental issue with revocation events | 19:07 |
| dolphm | raildo: don't be too worried about spec approval deadline, though. i think it's fine to see specs evolve in parallel with the implementation, especially for something as impactful as hierarchical multitenancy | 19:08 |
| bknudson | since it doesn't revoke by token id | 19:08 |
| lbragstad | dstanek: well, we could do it without the CONF option | 19:09 |
| raildo | dolphm: For now that the spec is not approved, we're keeping the code as WIP. https://review.openstack.org/#/c/108841/ | 19:09 |
| dolphm | raildo: ++ | 19:10 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Remote Debugging for HTTPD https://review.openstack.org/109081 | 19:11 |
| raildo | dolphm: I'll put the code in a devstack installation and create a small tutorial. | 19:12 |
| dolphm | bknudson: taht should depend on how the scoped token was revoked | 19:12 |
| dolphm | bknudson: (what caused it to be revoked?) | 19:13 |
| bknudson | dolphm: DELETE the scoped token | 19:13 |
| dolphm | bknudson: then the revocation event should contain the scope, which means it wouldn't match the unscoped token | 19:13 |
| bknudson | that makes sense... wonder why it doesn't work that way. | 19:14 |
| dstanek | lbragstad: i'm not at all happy with this, but you can see where my mind is headed http://paste.openstack.org/show/87813/ | 19:14 |
| dolphm | bknudson: when you delete a specific token, the revocation event should contain as much descriptive information about that token as possible, to avoid impacting other tokens | 19:14 |
| bknudson | would essentially be "_revoke_by_user_and_project" | 19:14 |
| *** cjellick has quit IRC | 19:14 | |
| dolphm | bknudson: precise issued_at, for example | 19:14 |
| bknudson | oh, and revoke by user and project and issued_at. | 19:14 |
| dolphm | dstanek: ++ i went down the same road ;) | 19:15 |
| lbragstad | dstanek: gotcha, making sense | 19:15 |
| bknudson | there isn't an example of that in the RevokeTreeTests... I'll see if I can add one. | 19:16 |
| openstackgerrit | Arun Kant proposed a change to openstack/keystone: Adding support for ldap connection pooling. https://review.openstack.org/95300 | 19:16 |
| lbragstad | dstanek: and do you plan on keeping parameter_types.id_string a dictionary or a method? | 19:16 |
| dolphm | bknudson: we had an example of that in the summit session etherpad when we accounted for the DELETE token use case | 19:16 |
| lbragstad | dstanek: nevermind, answered my own question | 19:17 |
| dstanek | it would have to be a function so that the exectuion is defered | 19:17 |
| openstackgerrit | Sam Leong proposed a change to openstack/keystone: Disable a domain will revoke tokens under the same domain https://review.openstack.org/107194 | 19:17 |
| *** rwsu has quit IRC | 19:18 | |
| dstanek | lbragstad: i think i'm going spend a little time right now playing with jsd | 19:19 |
| dolphm | lbragstad: how is that related (or not) to jsonschema? | 19:20 |
| dolphm | lbragstad: is it a javascript lib? | 19:21 |
| lbragstad | dolphm: jsd? | 19:21 |
| dolphm | lbragstad: yes | 19:22 |
| lbragstad | dolphm: no, it's something dstanek came up with https://gist.github.com/dstanek/a4f8fed405df911ada81 | 19:22 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/providers/common.py#n523 | 19:23 |
| dstanek | dolphm: yeah, it's a little hack that i started | 19:23 |
| bknudson | revoke_token doesn't use the scope, only user and expires_at. | 19:23 |
| dolphm | dstanek: are you building a jsonschema definition lib? lol | 19:23 |
| bknudson | the revoke api doesn't provide a function to revoke by user, expiration time, and scope... | 19:24 |
| bknudson | so that probably needs to be added. | 19:24 |
| dolphm | dstanek: if you do, you should totally call it Mage because it's the opposite of https://pypi.python.org/pypi/warlock | 19:24 |
| dstanek | dolphm: sorta - after talking over my ideas at the barbican hackathon i challenged myself to see what an implementation would look like | 19:25 |
| lbragstad | lol | 19:25 |
| dstanek | i showed juan what i thought the federation schema should look like declaratively and then built enough support to make it work | 19:26 |
| lbragstad | dstanek: the jsd.py part is going to be replacing parameter_types.py, right? | 19:30 |
| dolphm | lbragstad: dstanek: bumped api validation to j3 since we don't have enough in to start adding resource validation today | 19:31 |
| lbragstad | dolphm: makes sense | 19:31 |
| dolphm | russellb: ready to tag keystone juno-2 anytime | 19:31 |
| dstanek | lbragstad: i was thinking that it would just used the lib in there instead | 19:31 |
| *** rwsu has joined #openstack-keystone | 19:32 | |
| dolphm | russellb: master is at 686597b52a7b64161ca82e468a401efe22553a22 | 19:32 |
| dstanek | lbragstad: i'll work up an example | 19:32 |
| lbragstad | dstanek: ok, is there anything you want me to start cleaning up | 19:32 |
| dstanek | lbragstad: no specifically - are there more unaddressed comments on the reviews? | 19:33 |
| lbragstad | in assignment validation, no | 19:33 |
| *** fausto has joined #openstack-keystone | 19:33 | |
| lbragstad | I can break the rest of the validation series out of dependency | 19:34 |
| lbragstad | and purpose them | 19:34 |
| dstanek | lbragstad: ah, right. that would be a good idea | 19:34 |
| lbragstad | dstanek: ok, | 19:35 |
| russellb | dolphm: perfect, thanks! | 19:36 |
| russellb | dolphm: want that hash specifically, or whatever HEAD is when i do it within the next hour or 2? | 19:36 |
| * russellb will assume the hash unless i hear otherwise | 19:40 | |
| russellb | based on the gate queue (no keystone patches), that will likely still be HEAD anyway | 19:40 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on the Catalog V3 resources https://review.openstack.org/96266 | 19:43 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Credential V3 https://review.openstack.org/98522 | 19:47 |
| *** zzzeek has joined #openstack-keystone | 19:52 | |
| zzzeek | dstanek: can you tell me, on that fedora VM, what the output of “rpm -qa | grep xml” is ? | 19:52 |
| zzzeek | dstanek: the comparison feature here is using c14n so, my first hunch is a libxml issue | 19:53 |
| dstanek | zzzeek: i deleted it, but it'll only take a few minutes to recreate | 19:53 |
| zzzeek | dstanek: hrm OK | 19:53 |
| zzzeek | dstanek: on my end, the error is non-deterministic | 19:54 |
| zzzeek | dstanek: meaning once in awhile it succeeds | 19:54 |
| zzzeek | dstanek: seems like the canonical form is not working as expected and I am seeing issues here specifically due to dictionary ordering | 19:54 |
| dstanek | zzzeek: it's building now | 19:57 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Make BaseValidationTestCase https://review.openstack.org/109098 | 19:57 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Trust V3 API https://review.openstack.org/104066 | 19:58 |
| bknudson | zzzeek: you might have some idea about this... it looks like the timestamps returned by mysql are only accurate to the second, whereas for sqlite and DB2 they're accurate to a microsecond. | 19:59 |
| zzzeek | dstanek: this test is wrong. the canonicalization does *not* order nodes the way it is expecting: http://paste.openstack.org/show/87823/ | 20:01 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Policy V3 API https://review.openstack.org/104065 | 20:01 |
| zzzeek | bknudson: three things can be getting in the way: mysql version, datatype declared in MySQL, missing features in mysql-python | 20:02 |
| bknudson | zzzeek: ok. I'll look into it more. | 20:02 |
| *** hrybacki_ has quit IRC | 20:03 | |
| lbragstad | dstanek: ok, that *should* be all the validation patches, just not dependent on each other | 20:03 |
| bknudson | zzzeek: if it's the mysql version then there's nothing we could do about it? | 20:04 |
| zzzeek | bknudson: im not up to speed on microsecond support in MySQL, I know its out there but you need to gather the current facts | 20:05 |
| bknudson | zzzeek: ok. | 20:05 |
| zzzeek | bknudson: but overall, if you’re ordeirng by timestamp, I’d point out that sometimes two events can actually be logged in the same microsecond in any case :) | 20:05 |
| bknudson | zzzeek: there seems to be something fishy going on here... 2 timestamps are being compared... one is in the token and one is in the revocation event (they have to be the same) | 20:06 |
| zzzeek | bknudson: risky | 20:07 |
| bknudson | I think the token timestamp is actually stored as a JSON blob so isn't coming from the DB | 20:07 |
| bknudson | but the revocation event timestamp is a sql.Column(sql.DateTime()) | 20:07 |
| zzzeek | bknudson: unless said timestamp is copied from a single source of time | 20:07 |
| bknudson | y, I think the source for the revocation event timestamp (stored in the database) is the timestamp in the token | 20:08 |
| bknudson | so I think it's generally safe, but mysql is truncating | 20:08 |
| bknudson | "MySQL 5.6.4 and up expands fractional seconds support for TIME, DATETIME, and TIMESTAMP values" | 20:09 |
| bknudson | maybe we could store the timestamp as a string. | 20:09 |
| *** ukalifon1 has quit IRC | 20:09 | |
| bknudson | oh, and looks like you also have to "CREATE TABLE t1 (t TIME(3), dt DATETIME(6));" since the default is no fractional part. | 20:11 |
| nkinder | I have some questions about the trust re-delegation work | 20:12 |
| nkinder | The spec seems to cover the ability to create a new trust using a trust token. | 20:12 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Hierarchical Projects https://review.openstack.org/108841 | 20:13 |
| nkinder | I wrote a unit test last week to test something similar around obtaining trust tokens (not creation of a trust) | 20:14 |
| nkinder | What I'm testing is that A creates a trust for B, and B creates a trust for C | 20:15 |
| nkinder | C then gets a trust token to impersonate B | 20:15 |
| nkinder | Then using that trust token that impersonates B, the test attempts to get the trust token for A | 20:15 |
| nkinder | This is rejected (as it should be IMHO). | 20:15 |
| nkinder | The re-delegation spec seems to be more concerned with trust creation. Is the behavior I'm testing expected to change once re-delegation is implemented? | 20:17 |
| nkinder | stevemar, dolphm, ayoung: ^^^ you may have input since you all reviewed the re-delegation spec | 20:18 |
| ayoung | nkinder, I coded in the automatic rejection for trust token used to create trust | 20:18 |
| *** hrybacki_ has joined #openstack-keystone | 20:19 | |
| ayoung | that was a CVE fix late last cycle IIIRC | 20:19 |
| nkinder | ayoung: I'm not talking about trust creation | 20:20 |
| nkinder | I'm talking about executing a trust | 20:20 |
| nkinder | A creates a trust for B | 20:20 |
| nkinder | B creates a trust for C | 20:20 |
| nkinder | That is all fine | 20:20 |
| nkinder | C uses a trust to impersonate B, then uses that trust token to attempt to execute the trust for A | 20:20 |
| ayoung | nkinder, using a trust token to get a trust token? | 20:20 |
| nkinder | ayoung: yes | 20:21 |
| ayoung | I think that was rules out in the original impl | 20:21 |
| nkinder | ayoung: we don't test that now, so it's a unit test gap I'm filling | 20:21 |
| nkinder | ayoung: yeah, which makes sense. We should have unit tests for it to check for regressions though | 20:21 |
| nkinder | ayoung: I just want to be sure redelegation doesn't plan to change that behavior | 20:21 |
| hrybacki_ | Zuul has 287 jobs in the queue... That's three times higher than I've ever seen it before. Is this abnormal? | 20:22 |
| *** hrybacki_ is now known as hrybacki | 20:23 | |
| dolphm | hrybacki_: everyone is trying to hit the juno-2 deadline today | 20:23 |
| zzzeek | dstanek: got the whole thing documented: https://bugs.launchpad.net/keystone/+bug/1347891 | 20:23 |
| uvirtbot | Launchpad bug 1347891 in keystone "mis-use of XML canonicalization in keystone tests" [Undecided,New] | 20:23 |
| *** gokrokve has quit IRC | 20:23 | |
| ayoung | nkinder, talk to shardy to see what he needs. I don't think that was in the Heat use cases | 20:24 |
| dstanek | zzzeek: excellent thanks - i wonder why it works on my vm | 20:24 |
| zzzeek | dstanek: my 99.99% guess is dicationry ordering. but actually i havent confirmed that | 20:24 |
| bknudson | I think there's a proposal to add xml matching to testtools. | 20:24 |
| zzzeek | dstanek: i get different ordering if i run that test under py.test vs. tox vs. testr standalone | 20:25 |
| zzzeek | dstanek: only Python dictionaries / sets do that :) | 20:25 |
| *** radez is now known as radez_g0n3 | 20:25 | |
| dstanek | zzzeek: to answer your earlier question: http://paste.openstack.org/show/87830/ | 20:25 |
| nkinder | ayoung: I'll submit my tests as a patch. It seems separate from what shardy is proposing. | 20:25 |
| zzzeek | dstanek: yeah thats what i have too | 20:25 |
| ayoung | ++ | 20:25 |
| bknudson | doesn't python have native support for xml? | 20:28 |
| dstanek | zzzeek: hmmm...shouldn't the c14n method order the elements in the doc? | 20:29 |
| dstanek | bknudson: depending on the version | 20:29 |
| zzzeek | dstanek: i tested it and it does not. its in the ticket | 20:29 |
| zzzeek | dstanek: read the spec and didn’t see this behavior referred to either: http://www.w3.org/TR/xml-c14n#XMLCanonicalization but then again its a spec, highly verbose | 20:29 |
| dstanek | http://www.w3.org/TR/xml-c14n#DocumentOrder | 20:30 |
| zzzeek | dstanek: taht’s lxml run on my mac and also the fedora VM, same behavior | 20:30 |
| zzzeek | dstanek: whats the output of this script for you? http://paste.openstack.org/show/87823/ | 20:31 |
| zzzeek | dstanek: if it reorders the two nodes there, then theres an xml issue | 20:31 |
| *** rwsu has quit IRC | 20:32 | |
| dstanek | on my mac it's false | 20:32 |
| zzzeek | dstanek: yeah its not ordering those nodes | 20:33 |
| dstanek | zzzeek: this is weird because this hasn't failed in years | 20:34 |
| dstanek | something feels off | 20:34 |
| zzzeek | dstanek: that section 2.2 might be talking just about the namespace and the attributes | 20:34 |
| zzzeek | dstanek: dictionary ordering issues can take years to pop up :) | 20:35 |
| zzzeek | dstanek: OK well, the part i haent looked at is, why is the test receiivng XML from the source that doesnt match | 20:35 |
| -openstackstatus- NOTICE: nodepool is unable to build test nodes so check and gate tests are delayed | 20:40 | |
| *** ChanServ changes topic to "nodepool is unable to build test nodes so check and gate tests are delayed" | 20:40 | |
| dstanek | zzzeek: ha, this was added in 2013 in 167a8b7a | 20:41 |
| *** gokrokve has joined #openstack-keystone | 20:41 | |
| zzzeek | dstanek: yeah i have no idae how to find where this XML comes from w/o learning the whole app’s web service routing | 20:43 |
| dstanek | zzzeek: yeah the reason this works for me is that the XML from the service already matches the expected XML | 20:45 |
| dstanek | zzzeek: when i reorder the expected XML it all breaks | 20:45 |
| dstanek | zzzeek: i'll work on a fix | 20:45 |
| zzzeek | dstanek: w00p thanks | 20:46 |
| dstanek | zzzeek: np, i'll get to it right after dinner | 20:46 |
| zzzeek | dstanek: no rush on my end :) | 20:47 |
| *** stevemar has quit IRC | 20:53 | |
| *** topol has quit IRC | 20:54 | |
| *** topol has joined #openstack-keystone | 20:55 | |
| *** gokrokve has quit IRC | 20:56 | |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Trust unit tests should target additional threat scenarios https://review.openstack.org/109120 | 21:05 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Trust unit tests should target additional threat scenarios https://review.openstack.org/109120 | 21:07 |
| *** gokrokve has joined #openstack-keystone | 21:10 | |
| *** marcoemorais has quit IRC | 21:14 | |
| *** flwang has joined #openstack-keystone | 21:16 | |
| flwang | bknudson: ping | 21:16 |
| *** marcoemorais has joined #openstack-keystone | 21:16 | |
| bknudson | flwang: what's up? | 21:16 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add a test for revoking a scoped token from an unscoped https://review.openstack.org/109125 | 21:23 |
| *** fausto has quit IRC | 21:28 | |
| *** browne has quit IRC | 21:32 | |
| *** gokrokve has quit IRC | 21:46 | |
| *** joesavak has quit IRC | 21:46 | |
| *** gokrokve has joined #openstack-keystone | 21:47 | |
| vishy | morganfainberg: we are suddenly getting certificate validation failures with self signed certs using keystone client 0.10 | 21:47 |
| vishy | anyone else here seen that? | 21:48 |
| vishy | works fine with 0.9 | 21:48 |
| *** gordc has quit IRC | 21:51 | |
| *** gokrokve has quit IRC | 21:52 | |
| *** gokrokve has joined #openstack-keystone | 21:53 | |
| nkinder | vishy: jamielennox should have some ideas about what might be causing that (I'd expect him to show up here sometime soon given his timezone) | 21:53 |
| openstackgerrit | guang-yee proposed a change to openstack/keystone-specs: X.509 SSL certificate authentication https://review.openstack.org/105913 | 21:55 |
| nkinder | ayoung: I have some (potentially crazy) ideas around trusts... | 21:58 |
| * ayoung runs in panic | 21:59 | |
| nkinder | ayoung: you like crazy though, right? :) | 21:59 |
| ayoung | nkinder, I am one Acquainted with the Night. | 21:59 |
| nkinder | ayoung: today, any service you give your token to can create a trust to delegate your roles to itself | 22:00 |
| ayoung | that is true | 22:00 |
| nkinder | ayoung: this is done without the user's consent | 22:00 |
| ayoung | they consented when they gave away their token. | 22:00 |
| nkinder | ayoung: yeah, they are kind of forced to give consent (which sucks) | 22:00 |
| ayoung | I've been trying to get away from that for a long time. Creating trusts with unscoped tokens only makes sense to me | 22:01 |
| nkinder | ayoung: once the whole unscoped token thing behaves as it should, we could say that an unscoped token only can be used to create a trust | 22:01 |
| ayoung | Beat you to it | 22:01 |
| nkinder | ok, but there's a problem there too | 22:01 |
| ayoung | No problems, only opportunities | 22:01 |
| nkinder | the user never gives their unscoped token to the other service, and the other service knows what needs to be delegated (in theory) | 22:02 |
| *** topol has quit IRC | 22:02 | |
| nkinder | ayoung: what about a two-phase approach | 22:02 |
| nkinder | the service creates a trust request, but the user has to approve/enable it | 22:02 |
| nkinder | enabling is only allowed with the unscoped token | 22:02 |
| ayoung | nkinder, policy. If all of the policy files are in one place, the user can know apriori what they need to delegate to perform an action | 22:02 |
| nkinder | the user still needs to be told what is needed in that case though | 22:03 |
| ayoung | I'd rather have them pre-canned | 22:03 |
| ayoung | "use the create VM trust template" | 22:03 |
| nkinder | ayoung: we should talk with shardy about some of these ideas | 22:03 |
| ayoung | nkinder, simo would state that users will just click through whatever they are presented with | 22:04 |
| ayoung | as they do now... | 22:04 |
| ayoung | lets not give them the ability to sign their rights away | 22:04 |
| ayoung | if the service is hacked, or soemthing, lets not let the service define new trusts | 22:04 |
| nkinder | ayoung: that's true, but I would want to restrict a service to have to use the users token to create the unapproved trust | 22:04 |
| *** lbragsta_ has joined #openstack-keystone | 22:05 | |
| ayoung | the templates for trusts are going to be fairly static, and should be reviewable prior to execution | 22:05 |
| nkinder | ayoung: so tyour token that it uses today to create a trust would be used the same way, but the created trust would not be approved (and couldn't contain roles/projects that are not in that token it holds) | 22:05 |
| nkinder | ayoung: so a service can't just go off saying "delegate admin to me" without an admin token in the first place | 22:06 |
| -openstackstatus- NOTICE: zuul is working through a backlog of jobs due to an earlier problem with nodepool | 22:06 | |
| *** ChanServ changes topic to "zuul is working through a backlog of jobs due to an earlier problem with nodepool" | 22:06 | |
| ayoung | " I would want to restrict a service to have to use the users token to create the unapproved trust" | 22:06 |
| ayoung | le me chew that over | 22:07 |
| flwang | ayoung: may I get your opinion about the mail I sent 'more granular role management'? | 22:07 |
| *** lbragstad has quit IRC | 22:08 | |
| ayoung | flwang, assume I know nothing about Amazon. | 22:08 |
| vishy | nkinder: ah looks like 0.10 is ignoring OS_CA_CERT | 22:09 |
| *** lbragsta_ has quit IRC | 22:09 | |
| vishy | er OS_CACERT | 22:09 |
| flwang | ayoung: the link I posted is a GUI like | 22:09 |
| ayoung | awspolicygen.s3.amazonaws.com/policygen.html | 22:10 |
| flwang | I just wanna know do we want to support a role management to manage the function and resource | 22:10 |
| *** shakamunyi has joined #openstack-keystone | 22:10 | |
| ayoung | flwang, Keystone's own RBAC enforcement has the concept of "fetch the object from the database before you apply the rule" but that is not standard across all openstack services. I would like it to be | 22:11 |
| morganfainberg | vishy, not sure why that would have changed. | 22:12 |
| flwang | yep, we are using 'policy' which distributed in projects to manage the 'function' level | 22:12 |
| morganfainberg | vishy, let me see if i can figure it out. | 22:12 |
| morganfainberg | vishy, oh ignoring OS_CACERT ah. ok | 22:12 |
| flwang | ayoung: but seems we still can't manage the 'resource' level for role | 22:12 |
| ayoung | flwang, I'm sorry, I don't understand what you mean | 22:14 |
| *** shakamunyi has quit IRC | 22:15 | |
| ayoung | flwang, Roles are a global list, assigned to functions by policy. The Role requires is not going to vary based on the object out of the database. | 22:15 |
| flwang | ayoung: for example, I'd like to create a role which can only do 'nova delete'(function/rest api level) of 'compute service'(service level) for 'ip: 9.9.9.9' (resource level) | 22:16 |
| ayoung | flwang, nope | 22:16 |
| ayoung | flwang, is 'ip: 9.9.9.9' (resource level) the actualy VM you are trying to delete? | 22:17 |
| vishy | morganfainberg: lol | 22:17 |
| vishy | $ git grep load_from_cli_options | 22:17 |
| vishy | keystoneclient/session.py: def load_from_cli_options(cls, args, **kwargs): | 22:17 |
| vishy | keystoneclient/tests/test_session.py: return client_session.Session.load_from_cli_options(args, **kwargs) | 22:17 |
| vishy | it is never called | 22:17 |
| flwang | ayoung: it's a resource I want to manage | 22:17 |
| ayoung | flwang, what does that mean? | 22:18 |
| morganfainberg | vishy, yeah a few minutes behind you on that *just got back* | 22:18 |
| ayoung | resource as in a virtual machine? | 22:18 |
| flwang | let's think a bigger scenario | 22:18 |
| ayoung | No | 22:18 |
| ayoung | lets define your terms.... | 22:18 |
| morganfainberg | vishy, ok i think we can get that fixed ... uhm... *eye gate* soon™ | 22:18 |
| ayoung | what do you mean by resource? | 22:18 |
| ayoung | flwang, do you mean the object that the api is operating on? | 22:19 |
| flwang | 'resource' sounds like a nova instance, glance images, cinder volume, a network, etc | 22:19 |
| flwang | yep | 22:19 |
| ayoung | OK, so no. we are not planning on defining different roles for different objects | 22:19 |
| flwang | but not all the objects under the tenant | 22:19 |
| ayoung | flwang, sounds like you want a way to distinguish between to objects in the same project. | 22:20 |
| ayoung | er | 22:20 |
| ayoung | two objects | 22:20 |
| flwang | kind of | 22:20 |
| flwang | actually, we got the requirements from our customer | 22:20 |
| ayoung | flwang, I would not say "different roles" for objects, but some other way to differentiate them. Owner is the obvious one. THere is also the hierarchical multitenacy proposal which could potentially help | 22:21 |
| flwang | for example, there is a project for the customer, and they created different resource, VM, images, volumes, networks, but those resource should be managed by different teams | 22:21 |
| ayoung | no, I get it | 22:22 |
| ayoung | I'm just saying there is no plan to support that | 22:22 |
| ayoung | I wouldn't make it object level roles, though | 22:22 |
| flwang | i see, but you mean we should user different owners to workaround it, right? | 22:22 |
| flwang | s/user/use | 22:22 |
| vishy | morganfainberg: i have no idea where the session object is actually created | 22:23 |
| vishy | so i’m a bit confused | 22:23 |
| ayoung | Keystone is never going to be responsible for individual objects, so storing RBAC per object in Keystone does not make sense | 22:23 |
| ayoung | flwang, I don't have a solution for you. We had a rule that worked for trusts...I'll post a link | 22:23 |
| ayoung | flwang, http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n110 | 22:24 |
| morganfainberg | vishy, i think it's all in keystoneclient/client.py | 22:24 |
| vishy | also the options are registered twice | 22:24 |
| vishy | which is extra fun | 22:24 |
| ayoung | that checks that the user_id of the caller matches the trust.trustor_user_id for the trust they are trying to create | 22:24 |
| morganfainberg | vishy, i see that, but that shouldn't matter with the suppress | 22:25 |
| vishy | no i mean | 22:25 |
| vishy | get_base_parser is called two times | 22:25 |
| morganfainberg | vishy, right, and it shouldn't really matter iirc | 22:25 |
| ayoung | flwang, you could put any attribute on the object, and it would have to match the user. You need some attribute on the object to match | 22:26 |
| flwang | ayoung: sounds like tag the object, and match it with the expected user, is it? | 22:27 |
| ayoung | flwang, it could match the role,even | 22:27 |
| ayoung | but you have to have some way of decorating the object. | 22:27 |
| flwang | got it, I will take a look | 22:27 |
| flwang | ayoung: thank you so much for your patience | 22:27 |
| ayoung | flwang, its kindof like SELinux labels now that I think about it | 22:27 |
| ayoung | and...its a really good idea. flwang it might be something we could generalize | 22:28 |
| ayoung | I need to think about it.... | 22:28 |
| flwang | ayoung: good to know | 22:29 |
| morganfainberg | vishy, the load_from_cli_opts shouldn't matter | 22:29 |
| *** ayoung is now known as ayoung-aft | 22:29 | |
| *** dims has quit IRC | 22:29 | |
| morganfainberg | vishy, main gets the base parser that then loads the options: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/shell.py#L317 which then uses the args: | 22:30 |
| morganfainberg | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/shell.py#L359 | 22:30 |
| morganfainberg | for unauth, and for auth: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/shell.py#L379 | 22:30 |
| morganfainberg | vishy, maybe the re-register is horking thigs up? *continues to look* | 22:30 |
| *** dims has joined #openstack-keystone | 22:33 | |
| *** shakamunyi has joined #openstack-keystone | 22:34 | |
| morganfainberg | jamielenz, ping, you around? | 22:34 |
| *** thedodd has quit IRC | 22:38 | |
| *** hrybacki has quit IRC | 22:42 | |
| *** henrynash has joined #openstack-keystone | 22:42 | |
| *** dims has quit IRC | 22:43 | |
| vishy | morganfainberg: lol figured it out | 22:44 |
| morganfainberg | vishy, what is it? | 22:44 |
| morganfainberg | actually, i have a thought, but might be off. | 22:44 |
| morganfainberg | strike that, just disproved my theory, but i see where it *should* be passed through | 22:45 |
| openstackgerrit | Vish Ishaya proposed a change to openstack/python-keystoneclient: Reorder the old compatibility arguments https://review.openstack.org/109141 | 22:51 |
| vishy | morganfainberg: ^^ | 22:51 |
| *** griff has joined #openstack-keystone | 22:51 | |
| morganfainberg | oh | 22:52 |
| vishy | morganfainberg: i could probably do it by specifying the default values in the supressed versions as well | 22:52 |
| morganfainberg | hah | 22:52 |
| morganfainberg | *shrug* | 22:52 |
| vishy | but this is the way the old code did it so seemed safer | 22:52 |
| morganfainberg | yeah | 22:52 |
| vishy | morganfainberg: you probably want to push out a 0.10.1 once that merges | 22:52 |
| morganfainberg | right because os-cacert evaluates to the same target as os_cacert, which the first one wins the definition | 22:52 |
| morganfainberg | vishy, ++ yeah | 22:53 |
| morganfainberg | dolphm, ^^ | 22:53 |
| vishy | ah right dolphm has that responsibility | 22:53 |
| morganfainberg | vishy, yep | 22:53 |
| morganfainberg | vishy, i'll keep an eye on that patch | 22:54 |
| *** bknudson has quit IRC | 23:02 | |
| nkinder | morganfainberg: should we try to get this into 0.10.1 too? https://review.openstack.org/#/c/101792 | 23:03 |
| nkinder | morganfainberg: I just rebased it and addressed the issue gyee pointed out. | 23:03 |
| nkinder | morganfainberg: just working on ensuring we have enough unit test coverage before proposing a new patch | 23:04 |
| morganfainberg | *nod* | 23:04 |
| morganfainberg | if we can get that in, great | 23:04 |
| morganfainberg | well | 23:04 |
| morganfainberg | no not for 0.10.1 | 23:04 |
| morganfainberg | for 0.11 i'd say | 23:04 |
| nkinder | morganfainberg: questions about running python-keystoneclient unit tests are likely forth-coming... | 23:04 |
| nkinder | morganfainberg: that's fine. The other issue is a regression, hence more important | 23:04 |
| morganfainberg | if we land that, we could release 0.11 instead of 0.10.1 | 23:04 |
| morganfainberg | yep | 23:04 |
| gyee | nkinder, k, will take another look | 23:07 |
| nkinder | gyee: not ready yet... | 23:07 |
| gyee | morganfainberg, ++ 0.11 | 23:07 |
| nkinder | gyee: I'm assuming you were referring to the lack of tests for password update operations? | 23:07 |
| gyee | nkinder, right | 23:07 |
| nkinder | gyee: auth seems like it's covered | 23:08 |
| nkinder | gyee: cool, adding tests now | 23:08 |
| *** david-lyle has quit IRC | 23:14 | |
| jamielenz | how the hell did i become jamielenz? | 23:20 |
| *** jamielenz is now known as jamielennox | 23:20 | |
| jamielennox | morganfainberg, vishy: anything i can help with | 23:21 |
| morganfainberg | jamielennox, ^ https://review.openstack.org/#/c/109141/ | 23:21 |
| morganfainberg | jamielennox, looks like the arguments (compat) being registered first broke the env defaults | 23:22 |
| vishy | jamielennox: figured it out but good to know for the future | 23:22 |
| morganfainberg | jamielennox, since the re-register didn't pickup the new default settings | 23:22 |
| morganfainberg | vishy, ++ | 23:22 |
| jamielennox | oh, that's weird - wonder why that matters | 23:23 |
| *** packet has quit IRC | 23:36 | |
| *** dims has joined #openstack-keystone | 23:38 | |
| *** dims has quit IRC | 23:43 | |
| *** gokrokve has quit IRC | 23:51 | |
| morganfainberg | ugh. we issue a hacky token on password change in the OS-KSCRUD/users/{user_id} extensions | 23:52 |
| morganfainberg | we're doing it very wrong | 23:52 |
| *** shakamunyi has quit IRC | 23:56 | |
| openstackgerrit | Nathan Kinder proposed a change to openstack/python-keystoneclient: Don't log sensitive auth data https://review.openstack.org/101792 | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!