| *** dims has quit IRC | 00:07 | |
| *** rm_work|away is now known as rm_work | 00:08 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 00:10 |
|---|---|---|
| *** cjellick has quit IRC | 00:12 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 00:12 |
| *** cjellick has joined #openstack-keystone | 00:12 | |
| *** bobt_ has quit IRC | 00:14 | |
| *** cjellick has quit IRC | 00:17 | |
| *** r-daneel has quit IRC | 00:17 | |
| *** amcrn has quit IRC | 00:19 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not load auth plugins by class in tests https://review.openstack.org/117062 | 00:19 |
| morganfainberg | jamielennox, do you *really* need a deleter? | 00:21 |
| morganfainberg | jamielennox, for auth_token in Access? | 00:21 |
| gyee | morganfainberg, jamielennox, I have a question on that patch as well | 00:22 |
| morganfainberg | gyee, see your comment, haden't gotten that far yet :P | 00:22 |
| jamielennox | morganfainberg: probably not in terms of will it be used, however it's not good enough to set auth_token = None it needs to be done | 00:22 |
| gyee | seem kinda dangerous to allow both auth_token and token ID | 00:22 |
| *** amerine has quit IRC | 00:23 | |
| jamielennox | gyee: i hadn't seen your comment | 00:24 |
| gyee | jamielennox, refresh button :) | 00:24 |
| jamielennox | gyee: so take the PKI token case - what is token['token']['id'] ? | 00:25 |
| jamielennox | from memory it says 'stubbed' or something similar | 00:25 |
| *** jimhoagland has joined #openstack-keystone | 00:26 | |
| gyee | no, for v2, its a token hash I think | 00:26 |
| jamielennox | gyee: i should have double checked maybe there is a hack for this somewhere, but you can't put the hash of a token within a PKI token | 00:27 |
| gyee | jamielennox, https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L407 | 00:30 |
| *** amerine has joined #openstack-keystone | 00:31 | |
| morganfainberg | jamielennox, it says placeholder | 00:31 |
| morganfainberg | jamielennox, if you cms decode a v2 PKI token | 00:32 |
| morganfainberg | gyee, ^ | 00:32 |
| morganfainberg | gyee, keystone replaces the value in the validate step / store to persistence | 00:32 |
| jamielennox | just logged into 3 devstacks and i've got them all running UUIDs | 00:32 |
| morganfainberg | jamielennox, there is an active bug on it, but it's not "fixable" | 00:32 |
| morganfainberg | jamielennox, i mean... i could fix it and remove the id from the token data, but i think that is backwards incompatible | 00:32 |
| jamielennox | morganfainberg: right there's nothing we can do about it | 00:32 |
| gyee | jamielennox, oh, you mean local verify | 00:33 |
| morganfainberg | ['access']['token']['id'] = 'Sorry, we screwed up, don't use this value' | 00:33 |
| gyee | k, well can we at least check for 'placeholder'? | 00:34 |
| jamielennox | gyee: why? | 00:34 |
| jamielennox | it's available if not given otherwise use the override | 00:34 |
| jamielennox | because the place i want to use this most is in auth_token middleware | 00:34 |
| gyee | because we open it up for abuse | 00:34 |
| jamielennox | where i have the token already, it came via header | 00:34 |
| gyee | what if auth_token is not the same as token id and token id is not the special 'placeholder'? | 00:34 |
| morganfainberg | jamielennox, reminds me, we need to figure out how we're going to align KeystoneToken model and accessinfo | 00:34 |
| jamielennox | i don't want to rely on the value that came from verify the token i want to force set it | 00:34 |
| jamielennox | morganfainberg: i think we keep them seperate | 00:35 |
| jamielennox | gyee: then something very wrong has happened in your verification | 00:35 |
| jamielennox | also we never document 'placeholder' it's just something that ends up in code | 00:36 |
| morganfainberg | jamielennox, i think we could extract the "go get stuff" logic out and get the two aligned using the same code | 00:36 |
| gyee | sheeeeit | 00:36 |
| morganfainberg | jamielennox, and then just alyer the "go get stuff" logic in for use in keystoneclient / session | 00:36 |
| jamielennox | morganfainberg: so the AccessInfo in keystoneclient is not right | 00:37 |
| morganfainberg | jamielennox, that was the main reason i didn't use AccessInfo, i didn't want to get bound up trying to remove "go get stuff" logic and then waiting for a release to work on keystone | 00:37 |
| jamielennox | my concern is that we end up with keystone having issues and having to wait for the whole cycle of requirements to get fixes in | 00:37 |
| jamielennox | there are going to be very different requirements of the server side model | 00:37 |
| jamielennox | (to the point i'd love to have token.save()) | 00:37 |
| morganfainberg | jamielennox, we already have some of that issue with cms | 00:38 |
| gyee | so what are we saying, allow override now and improve it later? | 00:38 |
| jamielennox | i see CMS as a view on the model, it doesn't impact AccessInfo and shouldn't on the server side | 00:39 |
| morganfainberg | gyee, allow override, when v2 tokens die (v2 api) we let that go away | 00:39 |
| jamielennox | morganfainberg: i think go independant for now and lets have a look at summit or so | 00:39 |
| morganfainberg | jamielennox, we use cms to sign | 00:39 |
| morganfainberg | jamielennox, and validate in the server | 00:39 |
| * gyee puts a stick into the heart of v2 | 00:39 | |
| morganfainberg | jamielennox, in k1 we should look at extracting some of that stuff to a separate lib, then we can make ksc depend on it, and avoid circular deps in keystonemiddleware.... | 00:39 |
| morganfainberg | or something | 00:39 |
| morganfainberg | though we might get shot by packagers | 00:40 |
| jamielennox | gyee: so the other side of this is that the Identity Plugins in auth use auth_ref.token_id as the value that they are going to put into the X-Auth-Token field | 00:40 |
| morganfainberg | for doing that again | 00:40 |
| jamielennox | gyee: that gets correctly set if 1) you load it directly from a response object (which we do in the plugins - but can't in auth_token) 2) you are using UUID | 00:40 |
| jamielennox | gyee: I want to pass a 'ready-to-go' plugin out of auth_token so the services can use it, but if i do it know then the services are going to end up with a 'placeholder' token value | 00:41 |
| jamielennox | gyee: so i need a way to override it and at least this way it's standard across UUID/CMS and v2/v3 | 00:42 |
| gyee | jamielennox, k, lets do this | 00:43 |
| gyee | I don't see any good alternative right now | 00:43 |
| jamielennox | gyee: i don't know if it's any more open to abuse than it was before | 00:43 |
| jamielennox | gyee: the whole object is built on top of a dictionary so i could always have done something nasty like auth_ref['token']['id'] = 'whatever i want' | 00:44 |
| jamielennox | AccessInfo is one of those good ideas badly implemented, candidate for fixing in ksc2 | 00:44 |
| *** nkinder has joined #openstack-keystone | 00:46 | |
| gyee | I think originally it was born out of convenience, then it morph into a standard interface for token | 00:47 |
| jamielennox | gyee: that could be the tagline for the whole keystoneclient | 00:48 |
| gyee | we just need to make it a rock solid standard | 00:50 |
| * jamielennox just got completely surprised by someone asking about keystone and worker processes - completely missed that review | 00:59 | |
| morganfainberg | jamielennox, yeah it's there | 01:00 |
| morganfainberg | jamielennox, but seriously: apache + mod_wsgi | 01:00 |
| jamielennox | i thought we were saying no to that and use apahce | 01:00 |
| morganfainberg | that is my answer | 01:00 |
| morganfainberg | we don't gate on multi-eventlet workers | 01:00 |
| morganfainberg | there was some demand for it. | 01:01 |
| morganfainberg | it snuck in | 01:01 |
| morganfainberg | it's mostly harmless | 01:01 |
| morganfainberg | but i wouldn't recommend using it | 01:01 |
| *** marcoemorais has quit IRC | 01:04 | |
| gyee | jamielennox, +2 on the token override patch, will let morganfainberg do the honor :) | 01:04 |
| morganfainberg | gyee, oh go ahead if it has a +2 | 01:04 |
| gyee | dinner bell is ringing for me | 01:04 |
| morganfainberg | gyee, i've not looked at it too in depth. | 01:04 |
| gyee | k, no turning back now | 01:05 |
| morganfainberg | if it's really solving an issue sounds reasonable to me. | 01:05 |
| gyee | till the next round of refactoring anyway :D | 01:05 |
| morganfainberg | gyee, phsaw, we have 10hrs before it'll get through gate... and we can always revert it :P | 01:05 |
| *** dims has joined #openstack-keystone | 01:05 | |
| jamielennox | yea, i was going to hold of til the gate cleared but i'm not going to get anything passed with that strategy | 01:06 |
| gyee | damn, missed topol's ping early | 01:06 |
| * gyee hope he didn't get accuse of anything | 01:06 | |
| jamielennox | gyee: version independant plugins have now made it to the top of the review queue | 01:07 |
| gyee | jamielennox, yeah, I am way behind on reviews, still working on internal user stories | 01:08 |
| gyee | I really really really fucking hate agile | 01:08 |
| jamielennox | that's fine, i'm behind on reviews as well | 01:09 |
| *** dims_ has joined #openstack-keystone | 01:09 | |
| *** dims__ has joined #openstack-keystone | 01:11 | |
| *** dims has quit IRC | 01:11 | |
| *** zzzeek has quit IRC | 01:12 | |
| *** dims_ has quit IRC | 01:14 | |
| morganfainberg | bknudson, ping would a NamedTuple solve your namespace request, i think that is *really* what we're looking for (both waht I was aiming for and what you were suggesting with a namespace) | 01:15 |
| morganfainberg | bknudson, also buys us __iter__ for free, etc | 01:15 |
| *** amerine has quit IRC | 01:15 | |
| morganfainberg | except.... namedtuple isn't in py26 collections *grumble* | 01:16 |
| morganfainberg | or is it | 01:17 |
| morganfainberg | oh it is | 01:18 |
| morganfainberg | yay | 01:18 |
| *** jimhoagland has quit IRC | 01:24 | |
| *** zzzeek has joined #openstack-keystone | 01:32 | |
| *** gyee has quit IRC | 01:32 | |
| *** zzzeek has quit IRC | 01:35 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Notification cleanup: namespace actions https://review.openstack.org/117330 | 01:43 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Notification cleanup: namespace actions https://review.openstack.org/117330 | 01:49 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Comments to docstrings for notification emit methods https://review.openstack.org/117331 | 01:50 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add commas for ease of maintenance https://review.openstack.org/117332 | 01:50 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow providing an endpoint_override to requests https://review.openstack.org/117399 | 01:59 |
| *** yasukun has joined #openstack-keystone | 02:00 | |
| *** openstackgerrit has quit IRC | 02:02 | |
| *** openstackgerrit has joined #openstack-keystone | 02:02 | |
| openstackgerrit | A change was merged to openstack/keystone: Update sample config https://review.openstack.org/117087 | 02:03 |
| *** dims__ has quit IRC | 02:13 | |
| *** dims has joined #openstack-keystone | 02:14 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 02:22 |
| *** stevemar has joined #openstack-keystone | 02:45 | |
| *** KanagarajM has joined #openstack-keystone | 02:47 | |
| *** zzzeek has joined #openstack-keystone | 02:52 | |
| *** yasukun has quit IRC | 02:53 | |
| *** yasukun has joined #openstack-keystone | 02:54 | |
| *** rm_work is now known as rm_work|away | 03:20 | |
| *** alex_xu has quit IRC | 03:43 | |
| *** zzzeek has quit IRC | 03:45 | |
| *** mitz_ has quit IRC | 03:59 | |
| *** mitz has joined #openstack-keystone | 03:59 | |
| *** dims has quit IRC | 04:17 | |
| *** amerine has joined #openstack-keystone | 04:20 | |
| *** bobt_ has joined #openstack-keystone | 04:29 | |
| *** ncoghlan has joined #openstack-keystone | 04:31 | |
| *** stevelle has quit IRC | 04:41 | |
| *** stevemar has quit IRC | 04:48 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:59 | |
| *** bobt_ has quit IRC | 05:03 | |
| *** stevelle_ has joined #openstack-keystone | 05:11 | |
| *** dims has joined #openstack-keystone | 05:18 | |
| *** dims has quit IRC | 05:22 | |
| *** stevelle_ is now known as stevelle | 05:23 | |
| *** oomichi has quit IRC | 05:42 | |
| *** alex_xu has joined #openstack-keystone | 05:49 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 05:58 |
| *** ukalifon1 has joined #openstack-keystone | 05:59 | |
| *** k4n0 has joined #openstack-keystone | 06:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:06 |
| *** amirosh has joined #openstack-keystone | 06:09 | |
| *** ncoghlan_afk is now known as ncoghlan | 06:09 | |
| *** wanghong has joined #openstack-keystone | 06:16 | |
| *** toddnni has quit IRC | 06:17 | |
| *** toddnni has joined #openstack-keystone | 06:22 | |
| openstackgerrit | Kanagaraj Manickam proposed a change to openstack/keystone: Endpoint table is missing reference to region table https://review.openstack.org/113183 | 06:38 |
| *** afazekas has joined #openstack-keystone | 06:41 | |
| ByteSore | hi people, got a question.. i've been testing alot today with glance authentication.. i can't get it to work. when i run a glance index i'm getting an error in the api.log: NotAuthenticated: Authentication required i have the OS_USERNAME and all set to the right info. if i check it with swift the credentials do work. | 06:43 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 06:48 |
| *** ncoghlan has quit IRC | 07:07 | |
| *** jaosorior has joined #openstack-keystone | 07:11 | |
| *** harlowja_ is now known as harlowja_away | 07:14 | |
| *** bvandenh has joined #openstack-keystone | 07:26 | |
| *** mflobo_ has joined #openstack-keystone | 07:37 | |
| *** mflobo has quit IRC | 07:41 | |
| *** ukalifon3 has joined #openstack-keystone | 07:58 | |
| *** ukalifon1 has quit IRC | 07:59 | |
| *** yasukun has quit IRC | 08:00 | |
| *** rushiagr_away is now known as rushiagr | 08:08 | |
| *** ajayaa has joined #openstack-keystone | 08:09 | |
| *** rushiagr is now known as rushiagr_away | 08:12 | |
| *** henrynash has joined #openstack-keystone | 08:19 | |
| *** boris-42 has quit IRC | 08:21 | |
| *** boris-42 has joined #openstack-keystone | 08:30 | |
| *** ukalifon3 has quit IRC | 08:36 | |
| *** jamielennox is now known as jamielennox|away | 08:36 | |
| *** ukalifon has joined #openstack-keystone | 08:37 | |
| *** mflobo_ has quit IRC | 08:50 | |
| *** mflobo has joined #openstack-keystone | 08:50 | |
| *** timmer has joined #openstack-keystone | 09:03 | |
| *** henrynash has quit IRC | 09:15 | |
| *** henrynash has joined #openstack-keystone | 09:37 | |
| *** oomichi has joined #openstack-keystone | 09:47 | |
| *** henrynash has quit IRC | 09:52 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/python-keystoneclient: Attributes required using token for auth https://review.openstack.org/115228 | 09:54 |
| *** henrynash has joined #openstack-keystone | 10:04 | |
| *** henrynash has quit IRC | 10:13 | |
| *** alex_xu has quit IRC | 10:20 | |
| *** henrynash has joined #openstack-keystone | 10:22 | |
| *** diegows has joined #openstack-keystone | 10:25 | |
| *** alex_xu has joined #openstack-keystone | 10:28 | |
| *** roock has joined #openstack-keystone | 10:31 | |
| roock | hello. I'm trying to get the keystone munin plugin running, but i'm getting an error https://gist.github.com/roock/4312b1d04ebe35e72e73 anyone who can help? thank you in advance! | 10:35 |
| *** HenryG has quit IRC | 10:43 | |
| *** aix has joined #openstack-keystone | 10:52 | |
| *** KanagarajM has quit IRC | 11:01 | |
| *** f13o has joined #openstack-keystone | 11:35 | |
| openstackgerrit | Razumovsky Peter proposed a change to openstack/keystone: Add a simple module to work with filters and DNs to LDAP backend https://review.openstack.org/117484 | 11:36 |
| *** henrynash has quit IRC | 11:39 | |
| *** HenryG has joined #openstack-keystone | 11:52 | |
| *** richm has joined #openstack-keystone | 12:04 | |
| *** afazekas has quit IRC | 12:06 | |
| f13o | hi | 12:14 |
| *** erecio has joined #openstack-keystone | 12:18 | |
| mflobo | f13o, Hi! | 12:19 |
| *** gordc has joined #openstack-keystone | 12:37 | |
| *** alex_xu has quit IRC | 12:58 | |
| *** jasondotstar has joined #openstack-keystone | 13:00 | |
| *** nkinder has quit IRC | 13:09 | |
| *** k4n0 has quit IRC | 13:10 | |
| *** ajayaa has quit IRC | 13:11 | |
| *** afazekas has joined #openstack-keystone | 13:16 | |
| *** oomichi has quit IRC | 13:20 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove assignment_api dependency on token_api https://review.openstack.org/115338 | 13:22 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Standardize AccessInfo token setting https://review.openstack.org/113415 | 13:23 |
| *** radez_g0` is now known as radez | 13:24 | |
| *** diegows has quit IRC | 13:30 | |
| f13o | I am running keystone on icehouse, and client version 0.7.1 | 13:32 |
| f13o | I source admin rc file | 13:32 |
| f13o | with OS_SERVICE_TOKEN and OS_SERVICE_ENDPOINT | 13:32 |
| f13o | keystone catalog | 13:33 |
| f13o | fails with: "'NoneType' object has no attribute 'has_service_catalog'" | 13:33 |
| f13o | If I unset OS_SERVICE_TOKEN and OS_SERVICE_ENDPOINT, keystone catalog succeeds, but... | 13:33 |
| f13o | keystone tenant-list then hangs... as my installation (Fuel based) has adminURL on internal non-accessible network (I am running from public network, remote host) | 13:34 |
| f13o | I've been browsing docs and google, but is the only solution to use different credentials (token and non-token) for different calls? | 13:35 |
| *** joesavak has joined #openstack-keystone | 13:42 | |
| *** jsavak has joined #openstack-keystone | 13:44 | |
| *** afazekas has quit IRC | 13:46 | |
| *** joesavak has quit IRC | 13:48 | |
| *** zzzeek has joined #openstack-keystone | 13:50 | |
| *** bklei has joined #openstack-keystone | 13:54 | |
| *** ukalifon3 has joined #openstack-keystone | 13:56 | |
| *** ukalifon has quit IRC | 13:56 | |
| *** stevemar has joined #openstack-keystone | 13:56 | |
| *** gokrokve has joined #openstack-keystone | 14:00 | |
| *** andreaf has joined #openstack-keystone | 14:03 | |
| *** nkinder has joined #openstack-keystone | 14:04 | |
| *** diegows has joined #openstack-keystone | 14:04 | |
| dstanek | f13o: sounds like a bug. can you file it on launchpad? be sure to say what version of the client you are using | 14:05 |
| *** r-daneel has joined #openstack-keystone | 14:05 | |
| f13o | done: https://bugs.launchpad.net/keystone/+bug/1362630 | 14:10 |
| uvirtbot` | Launchpad bug 1362630 in keystone "keystone catalog command line fails with "'NoneType' object has no attribute 'has_service_catalog'"" [Undecided,New] | 14:10 |
| lbragstad | nonameentername: I reviewed you change here and had one very minor comment https://review.openstack.org/#/c/116374/ | 14:11 |
| *** andreaf has quit IRC | 14:14 | |
| *** amerine has quit IRC | 14:19 | |
| *** david-lyle has joined #openstack-keystone | 14:19 | |
| *** topol has joined #openstack-keystone | 14:20 | |
| *** henrynash has joined #openstack-keystone | 14:22 | |
| *** Lordanat1 has joined #openstack-keystone | 14:23 | |
| *** andreaf has joined #openstack-keystone | 14:28 | |
| *** david-lyle has quit IRC | 14:30 | |
| *** david-lyle has joined #openstack-keystone | 14:30 | |
| openstackgerrit | A change was merged to openstack/keystone: Add libxmlsec1 as external package dependency on OS X https://review.openstack.org/116907 | 14:33 |
| *** amerine has joined #openstack-keystone | 14:33 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Notify a consumer that all dependenices injected https://review.openstack.org/117523 | 14:41 |
| *** amirosh has quit IRC | 14:42 | |
| *** amirosh has joined #openstack-keystone | 14:42 | |
| *** andreaf has quit IRC | 14:43 | |
| *** andreaf has joined #openstack-keystone | 14:43 | |
| *** bklei has quit IRC | 14:46 | |
| *** bklei has joined #openstack-keystone | 14:47 | |
| *** amirosh has quit IRC | 14:47 | |
| *** bobt_ has joined #openstack-keystone | 14:48 | |
| *** bklei has quit IRC | 14:48 | |
| *** bklei has joined #openstack-keystone | 14:49 | |
| *** cjellick has joined #openstack-keystone | 14:52 | |
| *** andreaf has quit IRC | 14:54 | |
| *** andreaf has joined #openstack-keystone | 14:54 | |
| *** diegows has quit IRC | 14:58 | |
| *** jorge_munoz has joined #openstack-keystone | 14:59 | |
| *** ukalifon3 has quit IRC | 14:59 | |
| *** cjellick has quit IRC | 14:59 | |
| *** cjellick has joined #openstack-keystone | 15:00 | |
| *** jsavak has quit IRC | 15:07 | |
| *** joesavak has joined #openstack-keystone | 15:07 | |
| *** joesavak has joined #openstack-keystone | 15:10 | |
| *** jsavak has joined #openstack-keystone | 15:13 | |
| *** joesavak has quit IRC | 15:17 | |
| *** HenryG has quit IRC | 15:28 | |
| *** cjellick has quit IRC | 15:36 | |
| *** cjellick has joined #openstack-keystone | 15:37 | |
| morganfainberg | dolphm, oops, the join(str(a) for a in Actions) is superfluous | 15:37 |
| morganfainberg | dolphm, join(Actions) should be sufficient as those are all strings anyway | 15:37 |
| *** gokrokve_ has joined #openstack-keystone | 15:38 | |
| *** cjellick has quit IRC | 15:41 | |
| *** gokrokve has quit IRC | 15:41 | |
| *** jimhoagland has joined #openstack-keystone | 15:43 | |
| *** gyee has joined #openstack-keystone | 15:47 | |
| *** david-ly_ has joined #openstack-keystone | 15:48 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add index for actor_id in assignments table. https://review.openstack.org/117541 | 15:49 |
| *** david-lyle has quit IRC | 15:51 | |
| *** wwriverrat has joined #openstack-keystone | 15:51 | |
| *** wwriverrat has left #openstack-keystone | 15:52 | |
| openstackgerrit | werner mendizabal proposed a change to openstack/keystone: Set revoke_api attribute to None on provider object https://review.openstack.org/116374 | 15:54 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 15:54 |
| XEye | Hi, all! I'm a newbie here and i'd like to have one my very own bug to start contributing. How about https://bugs.launchpad.net/keystone/+bug/1336769? May I have it please? :) | 16:03 |
| uvirtbot` | Launchpad bug 1336769 in keystone "LDAP additional attribute mappings do not care about model attribute" [Low,New] | 16:03 |
| *** jraim__ has quit IRC | 16:06 | |
| *** erecio has quit IRC | 16:06 | |
| *** jraim_ has joined #openstack-keystone | 16:06 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 16:08 |
| morganfainberg | XEye, Feel free to grab the bug and start working on it. :) make sure you've read the wiki on how to contribute https://wiki.openstack.org/wiki/How_To_Contribute | 16:09 |
| morganfainberg | XEye, we're always happy to have people jump in and help us out! | 16:09 |
| morganfainberg | XEye, and welcome! | 16:10 |
| *** xianghui has quit IRC | 16:11 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Cleanup superfluous string comprehension and coersion https://review.openstack.org/117552 | 16:11 |
| *** diegows has joined #openstack-keystone | 16:11 | |
| *** erecio has joined #openstack-keystone | 16:13 | |
| XEye | <morganfainberg>, thank you :) | 16:19 |
| *** rm_work|away is now known as rm_work | 16:19 | |
| dstanek | XEye: welcome! | 16:21 |
| morganfainberg | dstanek, i feel silly | 16:23 |
| dstanek | morganfainberg: why is that? | 16:23 |
| morganfainberg | i missed a useless use of list comprehension when cleaning up a patch: https://review.openstack.org/#/c/117552/ | 16:23 |
| * morganfainberg hangs head in shame. | 16:24 | |
| morganfainberg | :P | 16:24 |
| dstanek | morganfainberg: :-) happens to the best of us | 16:25 |
| morganfainberg | dstanek, though i'm digging named tuples | 16:25 |
| *** elmiko has joined #openstack-keystone | 16:26 | |
| elmiko | hey folks, has there been any backport of the domain or trust scoping into the v2 rest api? (e.g. could i supply a domain for a user in a v2 call?) | 16:26 |
| *** bklei_ has joined #openstack-keystone | 16:27 | |
| *** bklei has quit IRC | 16:29 | |
| morganfainberg | elmiko, domains are a v3 concept, so you can't scope to a domain in v2. | 16:29 |
| *** david-ly_ is now known as david-lyle | 16:30 | |
| morganfainberg | elmiko, and v2 is effectively a frozen API we're trying to get everyone to move towards v3, so i don't expect porting extra functionality back to it. | 16:30 |
| morganfainberg | dstanek, so domain scoped token request to nova, looks sane to me: http://paste.openstack.org/show/101486/ probably should document it though | 16:31 |
| *** diegows has quit IRC | 16:31 | |
| elmiko | morganfainberg: thanks, i really want to use v3 but i'm working with some old code. looks like it's time to pull out the upgrade hammer ;) | 16:31 |
| morganfainberg | dstanek, unless that much data poses a security risk? | 16:31 |
| morganfainberg | elmiko, :) sure thing! happy to help | 16:31 |
| morganfainberg | nkinder, ^ what i posed to dstanek. using a domain scoped token to nova. | 16:32 |
| *** joesavak has joined #openstack-keystone | 16:32 | |
| *** jsavak has quit IRC | 16:32 | |
| dstanek | morganfainberg: your worried about the contents of that message? | 16:32 |
| morganfainberg | dstanek, not worried just 2x checking | 16:32 |
| dstanek | wow...my grammer sucks | 16:32 |
| morganfainberg | i don't see any reason it would be an issue | 16:33 |
| morganfainberg | but... no coffee and need to run off to an appointment | 16:33 |
| *** gokrokve has joined #openstack-keystone | 16:33 | |
| dstanek | morganfainberg: i don't see any issue with having the project_id since it's now any kind of pii | 16:33 |
| morganfainberg | so i'm not trusting my gut check on security related | 16:33 |
| morganfainberg | thats kindof my thought | 16:33 |
| morganfainberg | but that seems *quite* reasonable and requires no changes on our part | 16:34 |
| morganfainberg | that is an out-of-the-box devstack | 16:34 |
| *** marcoemorais has joined #openstack-keystone | 16:35 | |
| *** gokrokve_ has quit IRC | 16:36 | |
| morganfainberg | dstanek, so yay all my patches are (all the important ones) are in gate | 16:37 |
| morganfainberg | dstanek, time to get the reviews up so we can get the rest of everything in before FF | 16:37 |
| *** gokrokve has quit IRC | 16:37 | |
| morganfainberg | dstanek, though, be back in a bit, need to head off to an appointment | 16:38 |
| *** gokrokve has joined #openstack-keystone | 16:38 | |
| *** aix has quit IRC | 16:40 | |
| *** jsavak has joined #openstack-keystone | 16:42 | |
| *** bvandenh has quit IRC | 16:43 | |
| *** gokrokve has quit IRC | 16:43 | |
| *** andreaf_ has joined #openstack-keystone | 16:43 | |
| *** bobt_ has quit IRC | 16:44 | |
| *** andreaf has quit IRC | 16:44 | |
| dolphm | lbragstad: dstanek: can one of ya'll confirm that the patches listed for v3 api validation on https://gist.github.com/dolph/651c6a1748f69637abd0 are the only ones that need to merge? | 16:45 |
| *** joesavak has quit IRC | 16:45 | |
| dstanek | dolphm: that looks correct to me | 16:47 |
| *** xianghui has joined #openstack-keystone | 16:48 | |
| dolphm | dstanek: do they need to merge in that order? or can they be parallelized any further? | 16:50 |
| dolphm | dstanek: it seems reasonable, i just wanted to check | 16:51 |
| *** gyee has quit IRC | 16:51 | |
| *** jsavak has quit IRC | 16:51 | |
| dstanek | I think they need to merge in that order - they add depend on the same import being added | 16:52 |
| dstanek | oh, and they all basically append more tests to the same file | 16:52 |
| dolphm | dstanek: oh yeah, that'd be a pain | 16:54 |
| raildo | dolphm: Could you create a branch for hierarchical projects? I do not have permission to do this. https://wiki.openstack.org/wiki/GerritJenkinsGit#Create_proposed.2F.2A_Branch | 16:54 |
| dolphm | raildo: YES! thanks for reminding me | 16:54 |
| raildo | dolphm: :D | 16:55 |
| *** joesavak has joined #openstack-keystone | 16:55 | |
| morganfainberg | raildo, ack! sorry i meant to check on that yesteray afternoon for you! | 16:55 |
| morganfainberg | raildo, sorry!! | 16:55 |
| raildo | morganfainberg: no problem | 16:55 |
| *** lsmola has quit IRC | 16:56 | |
| dolphm | raildo: it looks like i don't have permission to do so either :( i'll ping ttx and ensure it gets created | 16:58 |
| dolphm | raildo: there should be a field for a new branch on https://review.openstack.org/#/admin/projects/openstack/keystone,branches | 16:58 |
| raildo | dolphm: sounds good to me, thank you! | 16:59 |
| *** gokrokve has joined #openstack-keystone | 17:01 | |
| morganfainberg | dolphm, i need to take off (appt to run to) but, https://bugs.launchpad.net/python-keystoneclient/+bug/1360892 this bug looks correct, i didn't get a chance to dig into it yesterday, i *think* we'll want to get this in for the next ksc release. but it is one of those ones i want to doubly be sure we don't accidently break something in the process. | 17:01 |
| uvirtbot` | Launchpad bug 1360892 in python-keystoneclient "EC2 v4 signature calculation is wrong, in case of request is POST" [Undecided,In progress] | 17:01 |
| dolphm | morganfainberg: ack | 17:02 |
| *** harlowja_away is now known as harlowja_ | 17:03 | |
| *** harlowja_ is now known as harlowja_away | 17:04 | |
| *** harlowja_away is now known as harlowja_ | 17:09 | |
| *** andreaf_ has quit IRC | 17:09 | |
| *** andreaf_ has joined #openstack-keystone | 17:10 | |
| *** edmondsw_ has joined #openstack-keystone | 17:14 | |
| dstanek | is http://git.openstack.org/cgit/openstack/identity-api/tree/v3/src/markdown/identity-api-v3.md officially published somewhere? | 17:15 |
| bknudson | dstanek: yes, at http://git.openstack.org/cgit/openstack/identity-api/tree/v3/src/markdown/identity-api-v3.md | 17:16 |
| dstanek | i just found this: http://docs.openstack.org/api/openstack-identity-service/3/content/openstack-identity-api-v3.html | 17:16 |
| *** RicoLin has quit IRC | 17:17 | |
| dstanek | so what is this? http://developer.openstack.org/api-ref-identity-v3.html | 17:17 |
| bknudson | dstanek: WADLs | 17:17 |
| *** erecio has quit IRC | 17:17 | |
| bknudson | and it's also out of date | 17:17 |
| dstanek | ah, that's why it's practically useless. thanks! | 17:18 |
| *** Haneef has joined #openstack-keystone | 17:19 | |
| *** erecio has joined #openstack-keystone | 17:20 | |
| stevemar | dolphm, so is FF going to be extended because jenkins/zuul shutdown? | 17:22 |
| bknudson | isn't it down for about 30 mins? | 17:22 |
| dolphm | stevemar: shutdown? or just minor downtime | 17:22 |
| dolphm | stevemar: and probably not | 17:23 |
| henrynash | kanagarajM: ping | 17:23 |
| *** diegows has joined #openstack-keystone | 17:23 | |
| henrynash | dolphm: do you think we need to retain the trusts kvs backend? I didn’t mark that one…wonder if I should? | 17:24 |
| dolphm | henrynash: yes, deprecate them all except token :) | 17:25 |
| henrynash | dolphm: Ok….the templated catalog depends on catalog kvs | 17:25 |
| dolphm | stevemar: you're just talking about renaming glance? | 17:26 |
| henrynash | dolphm: I wasn’t sure if people wanted to keep the templated catalog | 17:26 |
| dolphm | henrynash: ooh, that's an interesting one... | 17:26 |
| dolphm | henrynash: people do use it, but not kvs directly afaik | 17:26 |
| bknudson | I think jaypipes would complain if it wasn't supported | 17:26 |
| henrynash | dolphm: that’s what I thought | 17:26 |
| dolphm | bknudson: rax private cloud found a use for it as well, last i heard. but it was broken, so they went with sql | 17:27 |
| bknudson | well, other than it's broken it's a great choice. | 17:27 |
| raildo | henrynash: I'm a little worried about the amount of patches about hierarchical projects and the deadline for featureFreeze. | 17:27 |
| bknudson | it's easy to configure devstack for templated backend so maybe we could have a test run of it. | 17:28 |
| raildo | henrynash: Although the implementation is almost ready, we still need some code reviews :( Is there anything that I can do to speed up this process? | 17:28 |
| henrynash | raildo: indeed | 17:28 |
| dolphm | raildo: moving to a feature branch means we don't have to worry about feature freeze for the moment | 17:28 |
| raildo | dolphm: great :) | 17:29 |
| lbragstad | dolphm: those are the correct api validation patches https://gist.github.com/dolph/651c6a1748f69637abd0 | 17:29 |
| dolphm | henrynash: i've always felt that the templated driver should just be the kvs driver with a different __init__ (populate a standard kvs driver from a file) | 17:29 |
| raildo | dolphm: i did not know that | 17:29 |
| lbragstad | the trust one is in rough shape because the validation blows up on the test_v3_auth.py unit tests. I opened a bug for that | 17:29 |
| dolphm | raildo: we don't use feature branches very often - but this is a great use case for one | 17:29 |
| henrynash | dolphm: let me have a look at it | 17:29 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Improve list role assignments filters performance https://review.openstack.org/116682 | 17:30 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Base methods to handle hierarchical projects https://review.openstack.org/111841 | 17:30 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Add parent_project_id field https://review.openstack.org/111840 | 17:30 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Inherited roles to projects https://review.openstack.org/116921 | 17:30 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/111842 | 17:30 |
| dolphm | raildo: emailed ttx btw | 17:31 |
| raildo | dolphm: With this I am relieved, thank you | 17:31 |
| henrynash | anyone know how to check if an index exists in sqlalchemy? | 17:32 |
| dolphm | raildo: when it's available on github, you'll be able to `git review feature/hierarhical-multitenancy` to submit patches to the new branch in gerrit. then, just abandon all the ones on master | 17:32 |
| raildo | ok, we'll do that! | 17:33 |
| *** cjellick has joined #openstack-keystone | 17:34 | |
| gabriel-bezerra | who has worked with the implementation of the ldap identity backend? | 17:35 |
| *** cjellick has quit IRC | 17:35 | |
| Haneef | dolphm: keystone identity-api ( domain/user/project) will work only with domain scoped token as per v3 policy file. It can work with either domain scope or project scope with v2 policy file? What is the recomended scope going forward? | 17:35 |
| gabriel-bezerra | am I going to have to register the services' accounts on ldap if I use that backend? | 17:35 |
| *** cjellick has joined #openstack-keystone | 17:36 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add index for actor_id in assignments table. https://review.openstack.org/117541 | 17:36 |
| *** andreaf_ has quit IRC | 17:36 | |
| *** andreaf has joined #openstack-keystone | 17:37 | |
| *** ukalifon1 has joined #openstack-keystone | 17:37 | |
| *** shakamunyi has joined #openstack-keystone | 17:41 | |
| *** arunkant_work has joined #openstack-keystone | 17:43 | |
| *** bklei_ has quit IRC | 17:46 | |
| *** andreaf has quit IRC | 17:47 | |
| *** andreaf has joined #openstack-keystone | 17:47 | |
| henrynash | Haneef: what’s a “v2 policy file”? | 17:48 |
| david-lyle | henrynash: current default | 17:49 |
| Haneef | Yes | 17:50 |
| *** amcrn has joined #openstack-keystone | 17:51 | |
| henrynash | david_lyle: ah, well that’s not really a v2 policy fie (since v2 didn’t have RBAC)…it;s a v3 policy file suitable for simple deployments where there is central admin for everything | 17:51 |
| Haneef | The problem is heat is creating user from the code and it is using project scoped token. Due to this we can't move move to v3 policy file which expects domain scoped for create_user | 17:51 |
| david-lyle | henrynash: understood, I just knew what Haneef was referring to | 17:51 |
| *** andreaf has quit IRC | 17:51 | |
| *** ukalifon1 has quit IRC | 17:52 | |
| david-lyle | for HP v3 is really all about domains | 17:52 |
| david-lyle | hence v3 policy vs v2 (current) | 17:52 |
| david-lyle | not accurate nomenclature, just what has been used | 17:52 |
| henrynash | Haneef, david-lyle: well, there are two choices….you can chaneg the policy file…or use a domain token…:-) | 17:53 |
| Haneef | I agree I will rephrase it. -- for create_user operation -- should the token be scoped to domain or project. Assuming I'm creating user using v3 api | 17:53 |
| david-lyle | domain information is not properly added into the credentials used to check policy without a domain scoped token | 17:53 |
| henrynash | Haneef: so remember the policy file is an example to what we anticipate people will do with delegation of admin with multiple domains | 17:54 |
| *** andreaf has joined #openstack-keystone | 17:54 | |
| david-lyle | per comments on a recent review -2, that was by design | 17:54 |
| henrynash | Haneef: but it does indeed seem sensible to me that most peopel would use a domain scoped token to ensure you had persmission to create users in that domain | 17:54 |
| Haneef | henrynash: I agree but people can't do that, if one of the core services is not using that way. | 17:55 |
| henrynash | Haneef: which core service | 17:55 |
| Haneef | heat | 17:55 |
| henrynash | Haneef: we need to chaneg Heat then | 17:55 |
| david-lyle | https://bugs.launchpad.net/keystone/+bug/1338550 | 17:56 |
| uvirtbot` | Launchpad bug 1338550 in keystone "V3 API project/user/group list only work with domain scoped token" [Undecided,Invalid] | 17:56 |
| henrynash | Haneef: otherwide we throw multi-domain RABC out the window | 17:56 |
| *** morganfainberg is now known as morganfainberg_Z | 17:57 | |
| Haneef | henrynash: I agree with you. I will file a defect against heat referncing this bug. Let me see what is their response | 17:57 |
| henrynash | david-lyle: btw, as to your comment in the bug, a suer CAN read THEIR user record | 17:58 |
| henrynash | david-lyle: and I think we could tweak it so that they could list the groups they are a member of | 17:59 |
| david-lyle | henrynash: ok, I'll dig in again | 18:01 |
| *** cjellick has quit IRC | 18:02 | |
| *** cjellick_ has joined #openstack-keystone | 18:02 | |
| gabriel-bezerra | Hi! Am I going to have to register the services' accounts on my LDAP server if I use is as identity backend? | 18:02 |
| *** cjellick_ has quit IRC | 18:06 | |
| *** andreaf has quit IRC | 18:15 | |
| *** andreaf has joined #openstack-keystone | 18:19 | |
| *** bklei has joined #openstack-keystone | 18:21 | |
| *** gyee has joined #openstack-keystone | 18:21 | |
| *** andreaf has quit IRC | 18:29 | |
| openstackgerrit | A change was merged to openstack/keystone: Mark kvs backends as deprecated, for removal in Kilo. https://review.openstack.org/117288 | 18:35 |
| *** rm_work is now known as rm_work|away | 18:37 | |
| dstanek | dolphm, lbragstad : you guys around? | 18:39 |
| lbragstad | dstanek: yep | 18:40 |
| dstanek | i was thinking that it would be nice for all of the ID fields to eventually be string_id instead of just strings - that would mean that we'd have to have some last commit that doesn't exist yet to make that change | 18:41 |
| dstanek | thoughts? | 18:41 |
| lbragstad | dstanek: that would work | 18:41 |
| dstanek | i made a change locally to do that, but i can't do anything with it until things merge | 18:42 |
| *** jaosorior has quit IRC | 18:42 | |
| dstanek | i merged all of the commit in my local repo to make the change | 18:42 |
| lbragstad | dstanek: cool, and everything worked fine? | 18:43 |
| dstanek | lbragstad: yes, looks good | 18:51 |
| lbragstad | dstanek: sweet | 18:52 |
| lbragstad | the trust stuff is still broken I think | 18:52 |
| lbragstad | still digging into that | 18:52 |
| *** amirosh has joined #openstack-keystone | 18:53 | |
| dstanek | lbragstad: why did you have to manually add id here? https://review.openstack.org/#/c/98522/16/keystone/tests/test_v3_identity.py | 18:56 |
| lbragstad | dstanek: checking | 18:58 |
| *** jimhoagland_ has joined #openstack-keystone | 19:00 | |
| dstanek | stevemar: yt? | 19:09 |
| *** amerine has quit IRC | 19:09 | |
| stevemar | dstanek, ahoy | 19:09 |
| Haneef | henrynash: Do you any insight on this defect? https://bugs.launchpad.net/keystone/+bug/1361306. Any reason why we don't use mapping. | 19:09 |
| uvirtbot` | Launchpad bug 1361306 in keystone "Keystone doesn't handle user_attribute_id mapping" [Undecided,New] | 19:09 |
| dstanek | stevemar: is there an identity-api change to document the region.url? | 19:09 |
| stevemar | dstanek, there is | 19:09 |
| lbragstad | dstanek: I'm not entirely sure why that's there/ | 19:09 |
| lbragstad | the new_credentials_ref() doesn't really need to call new_ref() though, | 19:10 |
| lbragstad | since it doesn't share a lot of the same attributes | 19:10 |
| henrynash | Haneef: no, not sure…seems odd…I’d have to dig in to it…but a bit busy right now | 19:10 |
| stevemar | dstanek, URL to region -> https://review.openstack.org/#/c/114118/ | 19:10 |
| stevemar | dstanek, route for exchanging token for saml -> https://review.openstack.org/#/c/113998/ | 19:11 |
| dstanek | stevemar: thx | 19:11 |
| stevemar | dstanek, np, thanks for looking at it :) | 19:11 |
| stevemar | i'll be here if you have any questions! | 19:11 |
| henrynash | dstanek: quite afew test for some reason create a random ID and THEN call a xxxx_new_ref() call | 19:11 |
| stevemar | dstanek, i'm working on brants comments to the first patch of the k2k chain https://review.openstack.org/#/c/110542/ going to try to make the tests a bit better | 19:12 |
| henrynash | dtsanek: I’ve been trying to remove them wherever I see them | 19:12 |
| *** amerine has joined #openstack-keystone | 19:27 | |
| dstanek | henrynash: nice. once we get past FF i have a bunch of stuff to push up for review related to fixing our tests | 19:28 |
| *** openstackgerrit has quit IRC | 19:31 | |
| *** openstackgerrit has joined #openstack-keystone | 19:32 | |
| *** jsavak has joined #openstack-keystone | 19:33 | |
| *** joesavak has quit IRC | 19:34 | |
| lbragstad | dstanek: I think it was because of earlier implementations | 19:34 |
| lbragstad | https://review.openstack.org/#/c/98522/11/keystone/tests/test_v3.py | 19:34 |
| marcoemorais | hello I am integrating keystone with openldap backend and I am running into the same issue as Yanping https://lists.launchpad.net/openstack/msg16482.html | 19:36 |
| marcoemorais | I don't want to have redefine the schema in my deployment so I am trying to extend groupOfNames to add an enabled attribute (and description as well, thou that might not be needed), here is the ldif https://gist.github.com/marcoemorais/4ce65a7e12fbb8105d2a | 19:36 |
| marcoemorais | since I am an LDAP newbie could someone help me to let me know whether what I am trying to do is recommended approach? | 19:36 |
| marcoemorais | in case it helps here is logging output from keystone which shows the UNDEFINED_TYPE error {'info': 'enabled: attribute type undefined', 'desc': 'Undefined attribute type'} | 19:37 |
| marcoemorais | https://gist.github.com/marcoemorais/9ff2ffa41f453a1aaeac | 19:37 |
| openstackgerrit | David Stanek proposed a change to openstack/identity-api: Updated required attributes for region https://review.openstack.org/117599 | 19:37 |
| stevemar | dstanek, lbragstad bknudson could one of you +2/+A this guy: https://review.openstack.org/#/c/117157/ Ajaeger said it was the last one on his list | 19:38 |
| bknudson | stevemar: this looks like we don't need docutils at all anymore. | 19:39 |
| dstanek | stevemar: bknudson: done - we don't need it. sphinx will bring it in for us | 19:41 |
| bknudson | ah, ok. | 19:41 |
| openstackgerrit | A change was merged to openstack/keystone-specs: Remove docutils pin https://review.openstack.org/117157 | 19:41 |
| dstanek | there was some issue that made us require a specific version | 19:41 |
| dstanek | wow...why can't keystone be that fast | 19:41 |
| bknudson | it can | 19:42 |
| dstanek | that would be unreal | 19:43 |
| *** dims has joined #openstack-keystone | 19:46 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Notify a consumer that all dependenices injected https://review.openstack.org/117523 | 19:47 |
| *** amirosh has quit IRC | 19:50 | |
| *** amirosh has joined #openstack-keystone | 19:50 | |
| *** dims has quit IRC | 19:53 | |
| *** amirosh has quit IRC | 19:55 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on the Catalog V3 API https://review.openstack.org/96266 | 20:10 |
| dolphm | dstanek: +2'd on your -1 https://review.openstack.org/#/c/104065/ | 20:10 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Credential V3 https://review.openstack.org/98522 | 20:10 |
| *** joesavak has joined #openstack-keystone | 20:11 | |
| stevemar | dstanek, we're making description required for regions? | 20:14 |
| *** jsavak has quit IRC | 20:14 | |
| dstanek | stevemar: oops i forgot to leave a comment after i posted that | 20:14 |
| dstanek | stevemar: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/backends/sql.py#n29 | 20:14 |
| dstanek | dolphm: i think that might need to change anyway, but i'd be happy to follow it up with another patch | 20:16 |
| dolphm | stevemar: ? description shouldn't be required | 20:16 |
| dolphm | dstanek: what needs to change? | 20:16 |
| dstanek | stevemar: WIPed it so that i can write a test first | 20:18 |
| stevemar | dolphm, referring to this: https://review.openstack.org/#/c/117599/1/v3/src/markdown/identity-api-v3.md | 20:18 |
| stevemar | alrighty | 20:18 |
| dstanek | dolphm: it's based on outdated reviews | 20:20 |
| dolphm | dstanek: so abandon that identity api change ^ ? | 20:21 |
| dolphm | dstanek: before i -1 it? :) | 20:21 |
| *** Dafna has quit IRC | 20:23 | |
| dstanek | dolphm: is it not actually required? | 20:23 |
| dolphm | dstanek: i don't see why it should be | 20:24 |
| dolphm | dstanek: don't we set it to an empty string if it's not provided at the api layer? | 20:24 |
| dstanek | dolphm: not sure looking for that now | 20:24 |
| dolphm | lbragstad: i think you wrote that ^ | 20:25 |
| dolphm | dstanek: in the manager layer for create_region | 20:25 |
| lbragstad | yeah | 20:25 |
| lbragstad | that was when we were fixing a bug that required a migration for the regions table | 20:26 |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone: Add audit support to keystone federation https://review.openstack.org/114337 | 20:26 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/catalog/core.py#L98-L101 | 20:26 |
| lbragstad | if `description` isn't provided in the reference, it gets set to an empty string in the manager | 20:26 |
| dolphm | dstanek: i.e. it's optional in the API defintion ^ | 20:27 |
| lbragstad | yep | 20:27 |
| dstanek | lbragstad: yes i found it and already abandoned the review | 20:27 |
| lbragstad | it's *not* optional at the backend/db layer, but it should never get that far being null | 20:27 |
| dolphm | dstanek: with jsonschema, what happen if you make it required but have a default value of '' ? | 20:27 |
| lbragstad | dolphm: that should still be valid unless you do something like make it match a pattern | 20:28 |
| dolphm | and validate it as a string, of course | 20:28 |
| lbragstad | the pattern being a regex or something, or set min and max length | 20:28 |
| dolphm | lbragstad: all descriptions should start with a capital letter and end in a period and make subtle references to can haz memes #regexthat | 20:29 |
| lbragstad | ++ | 20:29 |
| dolphm | lbragstad: minLength = 0, maxLength = 255? | 20:29 |
| dolphm | but really it's a backend limitation | 20:29 |
| dolphm | i don't know that the api should care | 20:29 |
| dolphm | except in the case of IDs | 20:30 |
| dolphm | cause those are portable across projects and whatnot | 20:30 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Update region with a null description should 400 https://review.openstack.org/117611 | 20:31 |
| dstanek | dolphm, lbragstad: see that one ^ | 20:32 |
| dstanek | i like using numbers as verbs! | 20:34 |
| lbragstad | the funny thing is that it's perfectly acceptable in this case :) | 20:34 |
| dstanek | i guess the fix would be as simple as copying the block from create to update | 20:37 |
| lbragstad | dstanek: so `name` isn't here https://review.openstack.org/#/c/96266/31/keystone/catalog/schema.py | 20:38 |
| lbragstad | but it also doesn't have a dedicated column here http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/backends/sql.py#n55 | 20:38 |
| lbragstad | so, we will add it to the services properties because the docs specify it | 20:39 |
| dstanek | lbragstad: but i think we should still validate it to some extent | 20:39 |
| lbragstad | dstanek: I agree | 20:39 |
| dstanek | lbragstad: the nice thing about having jsonschema is that it could act as machine readable documentation | 20:39 |
| lbragstad | yeah | 20:40 |
| lbragstad | dstanek: i'll add `name` to the service_properties and use the name parameter type, so that should take care of the second comment | 20:41 |
| dstanek | lbragstad: i was just comparing the schema to the docs and the sql backends | 20:41 |
| lbragstad | that's good, because I missed a couple things | 20:42 |
| *** fifieldt_ has quit IRC | 20:42 | |
| dstanek | it wasn't fun :-( very tedious | 20:42 |
| lbragstad | dstanek: should we just use parameter_type.name for service.type? | 20:43 |
| lbragstad | a service['type'] shouldn't be 0 or greater than 255 | 20:43 |
| lbragstad | and it's of type string, so... | 20:44 |
| dstanek | lbragstad: no i'd rather add a new name - otherwise it's confusing | 20:44 |
| dstanek | or you can do it inline until there is a reason to add a new name | 20:44 |
| lbragstad | ok | 20:44 |
| bknudson | there must be some weird thing happens when the tests run... seems like it uses the keystoneclient from .tox/py27 for some and then switches to the installed one. | 20:44 |
| bknudson | probably something with loading / unloading keystoneclient for the client tests. | 20:45 |
| dstanek | i suspect that's part of the issue with name in general. name has different sizes in different models | 20:45 |
| dolphm | bknudson: uh oh | 20:45 |
| dstanek | bknudson: likely something wonky in the magic | 20:45 |
| dolphm | bknudson: the unit test jobs in the gate won't have one pre-installed though, right? | 20:46 |
| dolphm | bknudson: (you're just seeing a local behavior?) | 20:46 |
| bknudson | that's possible... not sure how the unit tests jobs are set up. | 20:46 |
| bknudson | should be easy enough to uninstall local keystoneclient and see. | 20:47 |
| dstanek | lbragstad: did you forget to 'git add' the schema? | 20:48 |
| dstanek | or is that in a future push? | 20:49 |
| lbragstad | dstanek: ... for which commit? | 20:49 |
| dstanek | the catalog one i think | 20:49 |
| dstanek | yes, that one | 20:49 |
| lbragstad | dstanek: I pushed a change to the credential patch before seeing your comments on the catalog schema | 20:50 |
| lbragstad | so this https://review.openstack.org/#/c/96266/32/keystone/catalog/schema.py | 20:50 |
| lbragstad | it's the latest version, | 20:50 |
| lbragstad | adding some tests to the catalog schema patch right now and I'll push | 20:51 |
| lbragstad | dstanek: should we have a list of invalid and valid url types for testing? | 20:51 |
| bknudson | dolphm: btw, you weren't kidding about needing some docstrings in keystoneclient.common.cms. | 20:52 |
| *** rm_work|away is now known as rm_work | 20:52 | |
| dolphm | bknudson: i started writing a patch that just adding a bunch of FIXME's where documentation was necessary and mixing, but it got to be rediculous | 20:53 |
| dolphm | and missing* | 20:53 |
| *** radez is now known as radez_g0n3 | 20:54 | |
| bknudson | keystone calls half of the functions in there | 20:54 |
| bknudson | I did `sudo rm -r /usr/local/lib/python2.7/dist-packages/python-keystoneclient.egg-link` and now the tests pass with my patched .tox/py27/keystoneclient | 20:56 |
| dstanek | lbragstad: cool, i may not be here to review it until late tonight - got a 'meet the teach' and then a Browns game | 20:56 |
| bknudson | so I think there is something happening when the tests run. | 20:56 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: token signing support alternative message digest https://review.openstack.org/117372 | 20:56 |
| lbragstad | dstanek: no worries, I'll have a new patch up within the hour | 20:57 |
| lbragstad | review it whenever you're free to do so | 20:57 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Configurable PKI token signature digest https://review.openstack.org/117380 | 20:57 |
| *** fifieldt_ has joined #openstack-keystone | 20:59 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: token signing support alternative message digest https://review.openstack.org/117372 | 21:01 |
| *** amerine_ has joined #openstack-keystone | 21:02 | |
| *** amerine has quit IRC | 21:02 | |
| *** andreaf has joined #openstack-keystone | 21:06 | |
| *** cjellick has joined #openstack-keystone | 21:06 | |
| *** jsavak has joined #openstack-keystone | 21:13 | |
| *** cjellick_ has joined #openstack-keystone | 21:14 | |
| *** cjellick has quit IRC | 21:14 | |
| *** topol has quit IRC | 21:16 | |
| *** joesavak has quit IRC | 21:16 | |
| *** dhellmann is now known as dhellmann_ | 21:17 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Update region entries to include URLs https://review.openstack.org/114118 | 21:17 |
| stevemar | dolphm, dstanek ^ | 21:18 |
| *** bklei has quit IRC | 21:22 | |
| *** jsavak has quit IRC | 21:23 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on the Catalog V3 API https://review.openstack.org/96266 | 21:26 |
| *** sagara has joined #openstack-keystone | 21:34 | |
| *** andreaf has quit IRC | 21:37 | |
| *** andreaf has joined #openstack-keystone | 21:37 | |
| *** nkinder has quit IRC | 21:39 | |
| *** andreaf has quit IRC | 21:43 | |
| *** wwriverrat has joined #openstack-keystone | 21:44 | |
| *** erecio has quit IRC | 21:57 | |
| *** amcrn has quit IRC | 22:08 | |
| *** amcrn has joined #openstack-keystone | 22:14 | |
| *** amcrn has quit IRC | 22:17 | |
| *** henrynash has quit IRC | 22:20 | |
| *** gordc has quit IRC | 22:26 | |
| *** jimhoagland has quit IRC | 22:27 | |
| *** jimhoagland_ is now known as jimhoagland | 22:27 | |
| *** stevemar has quit IRC | 22:27 | |
| *** bobt has joined #openstack-keystone | 22:27 | |
| *** sagara has quit IRC | 22:33 | |
| *** morganfainberg_Z is now known as morganfainberg | 22:34 | |
| *** henrynash has joined #openstack-keystone | 22:36 | |
| gyee | bknudson, can you wait in on this one? https://bugs.launchpad.net/keystone/+bug/1361306 | 22:39 |
| uvirtbot` | Launchpad bug 1361306 in keystone "Keystone doesn't handle user_attribute_id mapping" [High,Confirmed] | 22:39 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 22:40 |
| gyee | just to make sure I wasn't smoking somethin | 22:40 |
| *** wwriverrat has left #openstack-keystone | 22:40 | |
| gyee | s/wait/weight/ | 22:40 |
| bknudson | gyee: I was already waiting. | 22:40 |
| gyee | ha | 22:41 |
| bknudson | the bug just points to some code but doesn't say what issue is that it causes. | 22:42 |
| gyee | problem is we are ignoring the user_id_attribute map | 22:42 |
| gyee | we always take the leftmost RDN as the id | 22:42 |
| gyee | that's dangerous assumption | 22:43 |
| bknudson | so we've got an option and it doesn't do anything? | 22:43 |
| gyee | that lead to ID conflict | 22:43 |
| *** henrynash has quit IRC | 22:43 | |
| gyee | say I have uid=gyee,ou=marketing,dc=acme,dc=com and uid=gyee,ou=dev,dc=acme,dc=com | 22:43 |
| gyee | two different person, same ID | 22:44 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 22:44 |
| bknudson | gyee: you're asking for it if you do that! We already say IDs have to be unique. | 22:44 |
| gyee | we've got to be flexible to allow user_id_attribute map to something that is globally unique | 22:44 |
| bknudson | oh, so you're trying to make it unique by picking a different attributes | 22:44 |
| bknudson | attribute | 22:44 |
| gyee | bknudson, say my email is globally unique | 22:45 |
| bknudson | put the email in the DN | 22:45 |
| gyee | if I set user_id_attribute = emial | 22:45 |
| gyee | but we are dealing with read-only LDAPs | 22:45 |
| gyee | customers ain't going to remodel their garage in order to buy our car :) | 22:45 |
| bknudson | gyee: we do actually use user_id_attr... | 22:46 |
| bknudson | https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L1247 | 22:47 |
| gyee | bknudson, only in search filter | 22:47 |
| bknudson | it's self.id_attr | 22:47 |
| gyee | but not when it create the model | 22:47 |
| *** jorge_munoz has quit IRC | 22:47 | |
| bknudson | that would be on create I guess? or a base search? | 22:47 |
| gyee | in get() | 22:47 |
| bknudson | gyee: what's the proposed fix? | 22:49 |
| gyee | bknudson, https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L1278 | 22:49 |
| gyee | bknudson, I think we need to use the id map just like the rest | 22:49 |
| gyee | should be trivial I think | 22:49 |
| bknudson | gyee: dn_to_id can't work the same. | 22:49 |
| bknudson | it doesn't even make sense anymore... you'd need entry_to_id | 22:50 |
| morganfainberg | hmm. | 22:50 |
| gyee | bknudson, exactly | 22:50 |
| gyee | I don't know why it was that way | 22:50 |
| bknudson | that's not going to be trivial | 22:50 |
| bknudson | gyee: https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L1370 | 22:50 |
| bknudson | the user ID attr is used in _ldap_get, isn't that good enough? | 22:50 |
| morganfainberg | gyee, isn't that issue (the same uid) the *reason* we went with henry-nash's hashing things to = uid? | 22:51 |
| bknudson | So you pass in a user id, it gets the right entry | 22:51 |
| morganfainberg | gyee, oh because you're captureing uid from the same tree. | 22:51 |
| bknudson | of course, the user's ID is the DN ID and not the ID in the entry | 22:51 |
| gyee | morganfainberg, henrynash's patch only cares about internal IDs | 22:51 |
| gyee | external IDs shouldn't be changing | 22:51 |
| morganfainberg | gyee, if that part of the tree (ou=marketing) was a separate domain, it would work, but that isn't it. | 22:52 |
| gyee | morganfainberg, yes, if in a separate domain, it will work | 22:52 |
| bknudson | _dn_to_id is only used in a couple of places. | 22:52 |
| gyee | but for a single flat domain, it won't | 22:52 |
| bknudson | so maybe it is a relatively easy change. | 22:52 |
| gyee | bknudson, yes (with fingers crossed) | 22:53 |
| bknudson | gyee: it's also used in list_users_in_gorup | 22:53 |
| bknudson | list_users_in_group | 22:53 |
| gyee | yeah, that's dangerous | 22:53 |
| bknudson | so now instead of getting the IDs back from the member attrs you need to fetch each entry | 22:53 |
| gyee | we could end up with multiple users with the same id | 22:53 |
| bknudson | which will be "a little" slow if you have a large group. | 22:54 |
| bknudson | oh wait, it already does fetch the users for the group. | 22:54 |
| gyee | bknudson, I think the user group search is also not complete | 22:55 |
| bknudson | so not a trivial change but it doesn't look like it's ridiculously difficult | 22:55 |
| gyee | it won't work for reversed lookup | 22:55 |
| bknudson | is_user_in_group? | 22:55 |
| bknudson | see if I can find that. | 22:55 |
| gyee | the way it is implemented right now, it only works if we search the group objectclass first, then get the membership from the attributes | 22:56 |
| bknudson | where's that code? | 22:56 |
| gyee | if we have (say) memberOf attribute at the user object, that probably won't work | 22:56 |
| dolphm | bknudson: this file handling is super funky... https://review.openstack.org/#/c/110542/37/keystone/contrib/federation/idp.py | 22:56 |
| bknudson | list_group_users ? | 22:56 |
| gyee | yeah | 22:57 |
| bknudson | dolphm: it is wacky... file handling can't be that hard. | 22:57 |
| bknudson | gyee: that just returns DNs, so that's not going to work. | 22:58 |
| bknudson | it has to return IDs from all the users. | 22:58 |
| gyee | yeah, we have more work to do | 22:58 |
| bknudson | or we have to provide a function that checks if a user is in a group that does the lookups | 22:58 |
| dolphm | bknudson: i played around with it a bit, this seems more sane, but totally untested: http://pasteraw.com/43iidlfh6kooyw0gitm6ia54e3olob6 | 22:58 |
| dolphm | bknudson: anyway, i'll post that in the review for later | 22:59 |
| bknudson | oh, delete=False. | 22:59 |
| bknudson | you've got the kitchen sink there... try / except / else / finally ! | 23:00 |
| bknudson | you can't extend the "with tempfile.NamedTemporaryFile" to include the "subprocess.Popen(command_list" ? | 23:01 |
| bknudson | is that only because subprocess.Popen can also raise IOError? | 23:01 |
| dolphm | bknudson: uhh, you need the file written in order to read it with popen | 23:01 |
| dolphm | bknudson: maybe that's what the flush was for at some point? | 23:01 |
| dolphm | bknudson: and yeah, i didn't want the ioerrors to be confused | 23:01 |
| bknudson | dolphm: I couldn't tell from the docs if something written to the file was supposed to be available. | 23:02 |
| morganfainberg | bknudson, i think the flush guarantees it. but otherwise it's questionable | 23:02 |
| dolphm | morganfainberg: that's what i'd assume. the questionable bit may be up to a buffer or something, and luck | 23:03 |
| * dolphm runs to food | 23:03 | |
| dolphm | morganfainberg: cross your fingers on your changes. they're only an hour from failing now! | 23:03 |
| morganfainberg | dolphm, LOL. barring any massive gate resets | 23:03 |
| dolphm | nooooo | 23:03 |
| morganfainberg | dolphm, and ceilometer change has queued things in it | 23:04 |
| morganfainberg | so.. might be even longer :P | 23:04 |
| *** nkinder has joined #openstack-keystone | 23:05 | |
| gyee | nkinder, need your input too, https://bugs.launchpad.net/keystone/+bug/1361306 | 23:06 |
| uvirtbot` | Launchpad bug 1361306 in keystone "Keystone doesn't handle user_attribute_id mapping" [High,Confirmed] | 23:06 |
| bknudson | gyee: were you planning to work on a fix? | 23:09 |
| nkinder | gyee: I'll take a look | 23:12 |
| gabriel-bezerra | morganfainberg: have you worked on saml2 federation? | 23:15 |
| morganfainberg | ugh. | 23:15 |
| gabriel-bezerra | on the extension? | 23:15 |
| morganfainberg | dolphm, we have an issue with the endpoint grouping API :( i'm going to post a fix to the spec. | 23:15 |
| morganfainberg | dolphm, we accepted a change where HEAD != GET responses to the API spec | 23:16 |
| morganfainberg | gabriel-bezerra, no was looking at something else | 23:16 |
| morganfainberg | gabriel-bezerra, i've not used it. marekd|away and stevemar are really the two leading the charge on that front. | 23:16 |
| gabriel-bezerra | morganfainberg: oh, ok. thanks | 23:17 |
| *** david-lyle has quit IRC | 23:17 | |
| *** arunkant_work has quit IRC | 23:18 | |
| morganfainberg | dolphm, or... someone fixed it :) | 23:18 |
| morganfainberg | dolphm, woo | 23:18 |
| *** Haneef has quit IRC | 23:19 | |
| gyee | bknudson, yeah, working on it | 23:28 |
| nkinder | gyee: yeah, we shouldn't expect the id attribtue to exist in the DN at all | 23:28 |
| gyee | nkinder, thanks for looking, I am working on a fix | 23:29 |
| nkinder | gyee: ok, add me to the review when you post it | 23:29 |
| gyee | k, will do | 23:29 |
| *** shakamunyi has quit IRC | 23:33 | |
| *** edmondsw_ has quit IRC | 23:34 | |
| *** ncoghlan has joined #openstack-keystone | 23:35 | |
| ncoghlan | ping jamielennox|away | 23:35 |
| morganfainberg | dolphm, annnnnd Boom, fail :( | 23:35 |
| ncoghlan | jamielennox|away: when you get back, had a question about python-ldap, python3-ldap and https://wiki.openstack.org/wiki/Python3 | 23:36 |
| bknudson | morganfainberg: Server 74f5042a-ceaf-45aa-bd31-da7f63517040 failed to build and is in ERROR status ? | 23:38 |
| morganfainberg | bknudson, yeah :( | 23:38 |
| morganfainberg | bknudson, fairly common issue. | 23:39 |
| morganfainberg | bknudson, well fairly common result, underlying problem, haven't had a chance to look at yet | 23:39 |
| bknudson | morganfainberg: it's probably the SAML2 plugin dependency on token api. | 23:40 |
| *** amcrn has joined #openstack-keystone | 23:40 | |
| bknudson | just get rid of that and no problems :) | 23:40 |
| morganfainberg | bknudson, lol | 23:40 |
| morganfainberg | bknudson, oh hey, wanted to ask directly, is the code removal of filter by email a big UX win? | 23:40 |
| morganfainberg | bknudson, for stable/icehouse? | 23:41 |
| morganfainberg | bknudson, or is doc change sufficient? | 23:41 |
| morganfainberg | bknudson, just thinking from a 'do we need to add code to stable' perspective | 23:41 |
| bknudson | morganfainberg: I'm personally embarrassed if the product I support gives out a 500 error. | 23:41 |
| morganfainberg | bknudson, sure. though to be fair a lot of products give out 500s if you ask it undocumented things (we are undocumenting it :P) | 23:42 |
| bknudson | a web application shouldn't 500 ever. | 23:43 |
| bknudson | and I believe we do document that query parameters that aren't expected are ignored. | 23:44 |
| morganfainberg | bknudson, that makes it worth fixing :) | 23:44 |
| morganfainberg | bknudson, for sure. | 23:44 |
| bknudson | I don't think anybody is having a real problem with this since I explained it to him. | 23:44 |
| morganfainberg | right. | 23:44 |
| morganfainberg | i'll dig into the docs when i get back from food. | 23:45 |
| morganfainberg | and reference that line with the +2 then. | 23:45 |
| morganfainberg | bknudson, thanks! | 23:45 |
| bknudson | no problem. | 23:45 |
| *** openstackgerrit has quit IRC | 23:46 | |
| *** openstackgerrit has joined #openstack-keystone | 23:46 | |
| *** jamielennox|away is now known as jamielennox | 23:47 | |
| morganfainberg | bknudson, oh https://review.openstack.org/#/c/102425 - devstack change to "fix" apache logs somewhat | 23:48 |
| morganfainberg | bknudson, so we get proper oslofmt instead of some wierd oslo+apache format | 23:48 |
| morganfainberg | bknudson, if you are interested this change. | 23:49 |
| *** gokrokve has quit IRC | 23:51 | |
| jamielennox | oops, just rechecked a review because nothing had happened since yesterday, it hadn't got lost after all - just the head of the check queue has been running for >30hrs | 23:52 |
| jamielennox | just extended that one by a day | 23:52 |
| openstackgerrit | A change was merged to openstack/keystone: Remove oauth controller dependency on token_api https://review.openstack.org/115343 | 23:53 |
| *** ncoghlan is now known as ncoghlan_afk | 23:54 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!