| bknudson | dolphm: do you have a bot that posts rechecks? | 00:07 |
|---|---|---|
| *** gokrokve has joined #openstack-keystone | 00:09 | |
| *** gokrokve has quit IRC | 00:14 | |
| *** amirosh has quit IRC | 00:17 | |
| *** amirosh has joined #openstack-keystone | 00:18 | |
| *** amirosh has quit IRC | 00:22 | |
| *** diegows has joined #openstack-keystone | 00:24 | |
| *** oomichi has joined #openstack-keystone | 00:35 | |
| bknudson | dolphm: I brought up the pip failures in -infra... they seem to have some idea of which systems are worse than others at least. | 01:01 |
| *** gokrokve has joined #openstack-keystone | 01:09 | |
| *** gokrokve has quit IRC | 01:14 | |
| morganfainberg | YorikSar, ping me here tomorrow and i can describe a bit more in detail the interruption(s) | 01:26 |
| morganfainberg | lbragstad, dolphm, not sure if we can "fix" this one https://bugs.launchpad.net/keystone/+bug/1328067 I think we want to mark this as "wont fix" for keystone server, it isn't really fixable. (we could change the "placeholder" to "DO NOT USE THIS ID"). | 01:36 |
| uvirtbot | Launchpad bug 1328067 in python-keystoneclient "Token with "placeholder" ID issued" [Medium,Triaged] | 01:36 |
| morganfainberg | lbragstad, dolphm, we can fix middleware to not ever pass the id extracted from the body to the underlying service. and client if it use the id from the body, that should be fixed. | 01:37 |
| morganfainberg | I did try and extra the id from the V2 token at one point, it's a serious mess. | 01:37 |
| lbragstad | morganfainberg: I'm fine with bumping it | 01:41 |
| morganfainberg | lbragstad, i'm trying a quick fix for it now, but i think it wont be API compatible | 01:41 |
| lbragstad | that makes sense | 01:41 |
| morganfainberg | and until we dump V2 api... it wont *ever* be fixable. | 01:41 |
| morganfainberg | though i *think* we might be better served stopping issueing V2 tokens completely and just figuring out how to convert V2 tokens to V3 tokens and make it some kind of middleware | 01:42 |
| morganfainberg | but that also might break PKI v2 users... now that i think about it | 01:42 |
| jamielennox | i have a client patch that addresses this | 01:44 |
| lbragstad | morganfainberg: lol I think you just defined the ultimate double edged sword | 01:45 |
| jamielennox | oh - and it's merged already https://review.openstack.org/#/c/113415/ | 01:45 |
| jamielennox | not going to be useful to heat until it's made use of in auth_token i guess | 01:45 |
| morganfainberg | jamielennox, ++ ok so we can mark as "fix committed" for client | 01:45 |
| morganfainberg | middleware likely needs to be tagged in that bug | 01:46 |
| morganfainberg | and in keystone i *think* we just need to say wont fix :( | 01:46 |
| morganfainberg | lbragstad, i'll post my fix with a big fat warning "THIS MAY BE API INCOMPATIBLE" if it passes unit tests. | 01:49 |
| morganfainberg | lbragstad the move to the token model in the server may have solved all the issues with needing the id in the token body. | 01:49 |
| lbragstad | sounds good | 01:54 |
| *** dims has joined #openstack-keystone | 01:54 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Work toward Python 3.4 support and testing https://review.openstack.org/118802 | 01:59 |
| *** HenryG_ is now known as HenryG | 02:01 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix dn_startswith https://review.openstack.org/119478 | 02:02 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove the token id from V2 token body https://review.openstack.org/119673 | 02:07 |
| morganfainberg | lbragstad, ^ | 02:09 |
| lbragstad | morganfainberg: perfect, thanks! | 02:10 |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: Inaccurate description found in keystone's docs https://review.openstack.org/116820 | 02:10 |
| *** nkinder has joined #openstack-keystone | 02:32 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Sets a default timeout for cached data https://review.openstack.org/113586 | 02:33 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove unused cache functions from token.core https://review.openstack.org/119679 | 02:40 |
| *** diegows has quit IRC | 02:41 | |
| *** rushiagr_away is now known as rushiagr | 02:52 | |
| *** dims has quit IRC | 02:56 | |
| *** oomichi is now known as oomichi_away | 02:57 | |
| *** nkinder has quit IRC | 02:59 | |
| *** oomichi_away has quit IRC | 03:02 | |
| *** rushiagr is now known as rushiagr_away | 03:03 | |
| *** rushiagr_away is now known as rushiagr | 03:05 | |
| *** gokrokve has joined #openstack-keystone | 03:09 | |
| *** amirosh has joined #openstack-keystone | 03:10 | |
| *** amirosh has quit IRC | 03:11 | |
| *** amirosh has joined #openstack-keystone | 03:12 | |
| *** gokrokve has quit IRC | 03:14 | |
| *** rushiagr is now known as rushiagr_away | 03:16 | |
| *** amirosh has quit IRC | 03:16 | |
| *** swartulv has quit IRC | 03:23 | |
| *** stevemar has quit IRC | 03:28 | |
| openstackgerrit | A change was merged to openstack/keystone: Add docs for enabling endpoint policy https://review.openstack.org/118530 | 03:43 |
| *** stevemar has joined #openstack-keystone | 03:44 | |
| morganfainberg | lbragstad, well it looks like removing the ID from the v2 token doesn't break anything. though it still is likely not API compatible | 03:45 |
| morganfainberg | stevemar, ohhai | 03:45 |
| jamielennox | morganfainberg: makes sense, the services should be using the output from auth_token middleware and it uses the value from the headers not from within the token | 03:51 |
| morganfainberg | jamielennox, yep | 03:52 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Proper handling of catalog err cond w/os-token and os-endpoint https://review.openstack.org/118682 | 04:08 |
| *** gokrokve has joined #openstack-keystone | 04:09 | |
| *** rushiagr_away is now known as rushiagr | 04:11 | |
| *** gokrokve has quit IRC | 04:14 | |
| *** amirosh has joined #openstack-keystone | 04:41 | |
| *** amirosh has quit IRC | 04:42 | |
| *** amirosh has joined #openstack-keystone | 04:43 | |
| openstackgerrit | A change was merged to openstack/keystone: Add characterization test for group role assignment listing https://review.openstack.org/119479 | 04:43 |
| stevemar | morganfainberg, ahoy hoy | 04:45 |
| *** amirosh has quit IRC | 04:47 | |
| *** ncoghlan has joined #openstack-keystone | 04:56 | |
| *** ajayaa has joined #openstack-keystone | 05:18 | |
| *** ukalifon1 has joined #openstack-keystone | 05:26 | |
| *** amirosh has joined #openstack-keystone | 06:09 | |
| *** gokrokve has joined #openstack-keystone | 06:09 | |
| *** ajayaa has quit IRC | 06:11 | |
| *** amerine has joined #openstack-keystone | 06:12 | |
| *** gokrokve has quit IRC | 06:14 | |
| *** amerine has quit IRC | 06:17 | |
| *** ajayaa has joined #openstack-keystone | 06:38 | |
| *** ajayaa has quit IRC | 07:08 | |
| *** jaosorior has joined #openstack-keystone | 07:09 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Refactor assignment expansion related functions https://review.openstack.org/119363 | 07:13 |
| *** stevemar has quit IRC | 07:13 | |
| *** ajayaa has joined #openstack-keystone | 07:21 | |
| *** afazekas_ has joined #openstack-keystone | 07:22 | |
| *** ncoghlan is now known as ncoghlan_afk | 07:24 | |
| *** ajayaa has quit IRC | 07:33 | |
| *** ncoghlan_afk is now known as ncoghlan | 07:34 | |
| *** nsaje_ has left #openstack-keystone | 07:51 | |
| *** ajayaa has joined #openstack-keystone | 07:55 | |
| *** Daviey has quit IRC | 08:01 | |
| *** gokrokve has joined #openstack-keystone | 08:09 | |
| *** henrynash has joined #openstack-keystone | 08:12 | |
| *** gokrokve has quit IRC | 08:14 | |
| *** Daviey has joined #openstack-keystone | 08:17 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Keystone part of a PoC for Horizon/Keystone WebSSO https://review.openstack.org/106096 | 08:25 |
| *** andreaf_ is now known as andreaf | 08:29 | |
| *** aix has joined #openstack-keystone | 08:39 | |
| *** KanagarajM has joined #openstack-keystone | 08:43 | |
| *** amirosh has quit IRC | 08:50 | |
| *** amirosh has joined #openstack-keystone | 08:51 | |
| *** amirosh has quit IRC | 08:55 | |
| *** gokrokve has joined #openstack-keystone | 09:09 | |
| *** ncoghlan has quit IRC | 09:11 | |
| *** BAKfr has joined #openstack-keystone | 09:11 | |
| *** gokrokve has quit IRC | 09:13 | |
| *** bvandenh has joined #openstack-keystone | 09:32 | |
| *** bdossant has joined #openstack-keystone | 10:03 | |
| *** gokrokve has joined #openstack-keystone | 10:09 | |
| *** gokrokve has quit IRC | 10:14 | |
| *** rm_work has quit IRC | 10:15 | |
| *** rm_work|away has joined #openstack-keystone | 10:22 | |
| *** rm_work|away is now known as rm_work | 10:22 | |
| *** rm_work has joined #openstack-keystone | 10:22 | |
| *** dims has joined #openstack-keystone | 11:00 | |
| *** Alexander has joined #openstack-keystone | 11:01 | |
| *** Alexander is now known as Guest60332 | 11:02 | |
| *** Guest60332 has left #openstack-keystone | 11:03 | |
| *** amirosh has joined #openstack-keystone | 11:06 | |
| *** gokrokve has joined #openstack-keystone | 11:09 | |
| *** gokrokve has quit IRC | 11:14 | |
| *** dims has quit IRC | 11:16 | |
| *** dims has joined #openstack-keystone | 11:16 | |
| *** dims_ has joined #openstack-keystone | 11:17 | |
| *** dims has quit IRC | 11:21 | |
| *** alexander__ has joined #openstack-keystone | 11:33 | |
| *** diegows has joined #openstack-keystone | 11:35 | |
| *** x-eye_ has joined #openstack-keystone | 11:37 | |
| *** alexander__ has quit IRC | 11:38 | |
| *** topol has joined #openstack-keystone | 11:38 | |
| *** x-eye_ has quit IRC | 11:40 | |
| *** amakarov has joined #openstack-keystone | 11:46 | |
| *** gokrokve has joined #openstack-keystone | 12:09 | |
| *** gokrokve has quit IRC | 12:14 | |
| *** KanagarajM has quit IRC | 12:15 | |
| *** dims_ has quit IRC | 12:16 | |
| *** dims has joined #openstack-keystone | 12:16 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Fix LDAP group role assignment listing https://review.openstack.org/119480 | 12:20 |
| *** dims_ has joined #openstack-keystone | 12:20 | |
| *** dims has quit IRC | 12:21 | |
| *** bjornar has joined #openstack-keystone | 12:29 | |
| bjornar | Hello guys. I am experiencing around 200ms load time for the "POST /v2.0/tokens" call | 12:29 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings validation https://review.openstack.org/118590 | 12:39 |
| *** ayoung has joined #openstack-keystone | 12:40 | |
| *** topol has quit IRC | 12:43 | |
| *** radez_g0n3 is now known as radez | 12:51 | |
| *** vhoward has joined #openstack-keystone | 13:04 | |
| *** gokrokve has joined #openstack-keystone | 13:09 | |
| *** richm1 has joined #openstack-keystone | 13:11 | |
| *** gokrokve has quit IRC | 13:13 | |
| *** joesavak has joined #openstack-keystone | 13:14 | |
| *** bknudson has quit IRC | 13:25 | |
| dstanek | henrynash: ping | 13:28 |
| henrynash | dstanek: hi | 13:28 |
| dstanek | henrynash: i just saw that you took over https://bugs.launchpad.net/keystone/+bug/1217017 | 13:28 |
| uvirtbot | Launchpad bug 1217017 in keystone "dependency injection fails to init domain-specific identity drivers" [Medium,New] | 13:28 |
| dstanek | henrynash: i just commented on it - take a look and let me know if that makes sense | 13:28 |
| henrynash | dstanek: actually, I didn’t realize that you had worked on it allready…so I didn’t mean to take it from udner your feet | 13:28 |
| henrynash | dtsanek: I just felt responsible since I did the multi-domain stuff! | 13:29 |
| dstanek | henrynash: no i just did a little research yesterday | 13:30 |
| dstanek | i've been browsing the bugs this weekend so that i can pick up a few this week | 13:30 |
| henrynash | dstanek: and I agree with your comment….I knew in the back of my mind i needed to update the sql driver to handle the dymamic configs | 13:30 |
| dstanek | the complicated part is that there needs to be either a way to fall back to the global config or explicit documentation saying that we don't do that | 13:31 |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Prevent domains creation for the default LDAP+SQL https://review.openstack.org/116858 | 13:32 |
| dstanek | for instance, the reported only has the driver listed in the config and not any of the other options | 13:32 |
| *** bdossant has quit IRC | 13:33 | |
| *** bdossant has joined #openstack-keystone | 13:42 | |
| *** bdossant has quit IRC | 13:42 | |
| *** r-daneel has joined #openstack-keystone | 13:45 | |
| *** bknudson has joined #openstack-keystone | 13:46 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes code comment to be more accurate https://review.openstack.org/119760 | 13:46 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:58 | |
| *** gokrokve has joined #openstack-keystone | 14:00 | |
| *** nkinder has joined #openstack-keystone | 14:00 | |
| samuelmz | henrynash, ping | 14:04 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add characterization test for cleanup role assignments for group https://review.openstack.org/119630 | 14:09 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix delete group cleans up role assignments with LDAP https://review.openstack.org/119631 | 14:09 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix using local ID to clean up user/group assignments https://review.openstack.org/119629 | 14:09 |
| *** Daviey has quit IRC | 14:10 | |
| *** Daviey has joined #openstack-keystone | 14:25 | |
| *** topol has joined #openstack-keystone | 14:25 | |
| *** zzzeek has joined #openstack-keystone | 14:28 | |
| *** ajayaa has quit IRC | 14:29 | |
| *** david-lyle has joined #openstack-keystone | 14:30 | |
| *** afaranha has quit IRC | 14:33 | |
| openstackgerrit | Yuriy Taraday proposed a change to openstack/keystonemiddleware: Add a pool of memcached clients https://review.openstack.org/119774 | 14:33 |
| *** thiagop has quit IRC | 14:34 | |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Correct typos in keystone/common/base64utils.py docstrings https://review.openstack.org/119775 | 14:34 |
| *** samuelmz has quit IRC | 14:34 | |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Correct typos in keystone/common/base64utils.py docstrings https://review.openstack.org/119775 | 14:35 |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Correct typos in keystone/common/base64utils.py docstrings https://review.openstack.org/119775 | 14:35 |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Correct typos in keystone/common/base64utils.py docstrings https://review.openstack.org/119775 | 14:35 |
| *** saipandi has joined #openstack-keystone | 14:37 | |
| *** amirosh has quit IRC | 14:59 | |
| *** amirosh has joined #openstack-keystone | 15:00 | |
| YorikSar | morganfainberg: Eh... Why use ' everywhere? :) | 15:01 |
| morganfainberg | YorikSar, it's the general style for keystone | 15:02 |
| morganfainberg | YorikSar, https://github.com/openstack/keystone/blob/master/HACKING.rst#keystone-specific-commandments | 15:02 |
| YorikSar | morganfainberg: ' is for constants and stuff, " is for text :) | 15:02 |
| YorikSar | morganfainberg: Oh... | 15:02 |
| morganfainberg | YorikSar, """ is for docstrings, everywhere else (unless there is a reason to use ") should be ' | 15:03 |
| morganfainberg | YorikSar, for readability if you have apostophes or similar it's ok to use " but we try and keep quotation consistent | 15:04 |
| YorikSar | morganfainberg: I wonder what brought to writing this down in the doc... | 15:04 |
| YorikSar | morganfainberg: Why don't use ''' for docstrings? | 15:04 |
| morganfainberg | YorikSar, i think that is actually a broader python ism | 15:04 |
| *** amirosh has quit IRC | 15:04 | |
| morganfainberg | YorikSar, http://legacy.python.org/dev/peps/pep-0257/ | 15:05 |
| YorikSar | morganfainberg: Huh... | 15:06 |
| YorikSar | morganfainberg: Ok, that's the longest conversation I ever had about choosing between ' and " :) | 15:06 |
| morganfainberg | hehe | 15:07 |
| morganfainberg | ayoung, dolphm, https://review.openstack.org/#/c/119673/ possible solution for bug 1328067 but need a pair of eyes to know if that is breaking api compatibility. | 15:08 |
| uvirtbot | morganfainberg: Error: Could not parse data returned by Launchpad: The read operation timed out | 15:08 |
| morganfainberg | uvirtbot, poor poor bot, | 15:09 |
| uvirtbot | morganfainberg: Error: "poor" is not a valid command. | 15:09 |
| ayoung | morganfainberg, sorry, can't context switch....I'm writing Error handling Macros in C for python_kerberos.... | 15:09 |
| dolphm | morganfainberg: yeah, the ID certainly needs to be in the response, but you can persist it however youw ant | 15:09 |
| morganfainberg | dolphm, the issue is PKI tokens decoded will no longer contain the id | 15:10 |
| morganfainberg | dolphm, but live-validation would still contain the id (normal response) | 15:10 |
| YorikSar | morganfainberg: About config options... Won't people hit us if we add some config args this late in the cycle?.. | 15:10 |
| morganfainberg | dolphm, and issue body | 15:10 |
| morganfainberg | YorikSar, keystonemiddleware is a bit separate from the named releases, and it shouldn't matter if we aren't changing current option defaults | 15:11 |
| dolphm | morganfainberg: so which responses are missing the ID then - on token issuance? | 15:11 |
| morganfainberg | YorikSar, this is something that should be configurable when we release it. | 15:11 |
| morganfainberg | dolphm, cms token decode | 15:11 |
| YorikSar | morganfainberg: Oh, ok then. I'll add all args there are in Keystone patch. | 15:11 |
| morganfainberg | YorikSar, yeah middleware is a bit easier in some regards than Keystone server | 15:12 |
| * YorikSar wonders how that sentence should've looked like in English... | 15:12 | |
| morganfainberg | YorikSar, close enough ;) | 15:12 |
| YorikSar | morganfainberg: So that's a backdoor, right? Whatever we can't do in Keystone we do in middleware and then just import in Keystone ;) | 15:12 |
| morganfainberg | YorikSar, not really. auth_token doesn't get imported by keystone | 15:13 |
| *** jorge_munoz has joined #openstack-keystone | 15:13 | |
| morganfainberg | YorikSar auth_token is used by other services. | 15:13 |
| *** aix has quit IRC | 15:13 | |
| YorikSar | morganfainberg: Huh?.. But how we'll reuse pool from keystonemiddleware in Keystone then? | 15:14 |
| morganfainberg | YorikSar so the options you're adding to keystonemiddleware are available to deploying nova. | 15:14 |
| *** cjellick has joined #openstack-keystone | 15:14 | |
| YorikSar | morganfainberg: Yeah, they'll all be in paste.ini iiuc | 15:14 |
| *** cjellick has quit IRC | 15:15 | |
| *** aix has joined #openstack-keystone | 15:15 | |
| morganfainberg | YorikSar, lets talk about that. i think we are just going to need the code in both places for now. in K we can split the pool code into it's own package | 15:15 |
| *** diegows has quit IRC | 15:15 | |
| *** stevemar has joined #openstack-keystone | 15:15 | |
| *** cjellick has joined #openstack-keystone | 15:15 | |
| morganfainberg | we just *cant* do it for J because we're past the dependency freeze | 15:15 |
| YorikSar | morganfainberg: Actually, there is keystonemiddleware in Keystone's requirements.txt, so we can reuse it... | 15:15 |
| morganfainberg | YorikSar, the only reason for that is because of some compat stuff for moving middleware, i'm not convinced we should make it a public interface in middleware. | 15:16 |
| morganfainberg | YorikSar, and if it isn't a public interface in middleware, keystone should not depend on it | 15:16 |
| *** afazekas_ has quit IRC | 15:17 | |
| morganfainberg | YorikSar, in short, i don't *want* people to use the pool from keystonemiddleware long term. if keystone depends on it we can't ever remove it. | 15:17 |
| morganfainberg | YorikSar, well eventually we might but as long as someone is using Juno Keystone, the middleware wont be able to remove that code. | 15:17 |
| YorikSar | morganfainberg: If we won't have keystonemiddleware remove from requirements we can safely use a small piece of 'private' API from Keystone, just for one cycle... | 15:18 |
| morganfainberg | YorikSar, no, because middleware can/will be updated in the future and used by people deploying Juno | 15:18 |
| YorikSar | morganfainberg: Oh, but if we do so, we won't be able to upgrate keystonemiddleware, I get it. | 15:19 |
| morganfainberg | YorikSar, yep | 15:19 |
| morganfainberg | YorikSar, so lets just put the code in both places until next cycle. | 15:19 |
| YorikSar | morganfainberg: That... Makes me sad. Another copypaste? | 15:19 |
| morganfainberg | YorikSar, sadly | 15:19 |
| morganfainberg | YorikSar, but it's less debt to cleanup / carry forward than making the kyestonemiddleware dependency more permanent | 15:20 |
| YorikSar | morganfainberg: Yeah. Btw, will we be able to switch to external lib in stable/juno? | 15:20 |
| morganfainberg | YorikSar, no | 15:20 |
| morganfainberg | dolphm, ah need to add the token_ids back in during validate of PKI, looks like i missed that. | 15:21 |
| ayoung | morganfainberg, yeah...don't do that | 15:21 |
| morganfainberg | ayoung, ? | 15:21 |
| ayoung | remove "placeholder" | 15:22 |
| YorikSar | morganfainberg: Will _MemcachedCachePool ok as class name instead of _RealCachePool? | 15:22 |
| ayoung | morganfainberg, maybe change the string? | 15:22 |
| morganfainberg | YorikSar, like i said that was a NIT, you don't need to change it. | 15:22 |
| morganfainberg | YorikSar, it was a "i don't like this name,but eh, i wont block this patch if you don't change it" | 15:22 |
| morganfainberg | YorikSar, :) | 15:22 |
| ayoung | something like "A token ID here is impossible due to the incompleteness theorem" | 15:22 |
| YorikSar | morganfainberg: I don't like _RealCachePool too, just didn't want to spend too much time thinking about it. | 15:22 |
| ayoung | or "blame Godel" for short? | 15:23 |
| morganfainberg | ayoung, there is no reason to put anything there - we already override it and put other things in on token body response | 15:23 |
| ayoung | I don;t want to change the body of the token, as then the result will not match the hash | 15:23 |
| dstanek | can we mark https://bugs.launchpad.net/keystone/+bug/1262057 as won't fix since the xml middleware is deprecated? | 15:23 |
| uvirtbot | Launchpad bug 1262057 in keystone "XML middleware will try to convert everything even if it's not json" [Undecided,Incomplete] | 15:23 |
| morganfainberg | ayoung, too late, we do it already | 15:24 |
| ayoung | morganfainberg, story of Keystone, isn't it? | 15:24 |
| ayoung | "too late, we need to live with this decision" | 15:24 |
| morganfainberg | ayoung, issue_v2_token, issues token, replaces id in body, we return that modified body | 15:24 |
| morganfainberg | ayoung, thankfully v3 tokens do not have that issue. | 15:24 |
| ayoung | yeah... | 15:24 |
| ayoung | morganfainberg, I wrote that code... I've repressed those memories | 15:25 |
| ayoung | dimly recall it being needed by something | 15:25 |
| morganfainberg | if i could get away with it, i would only issue v3 tokens. | 15:25 |
| morganfainberg | ayoung, mostly it is needed internal to keystone, moving to the tokenmodel solved a lot of that | 15:25 |
| morganfainberg | ayoung, and a fix to middleware will solve any chance of an issue of it being passed to the underlying services behind the middleware | 15:26 |
| morganfainberg | (mostly not used) | 15:27 |
| ayoung | morganfainberg, you want to bet on that? There are Java implementations that consume Keystone out there.... | 15:27 |
| ayoung | THink we can really just change this? | 15:27 |
| morganfainberg | ayoung, this is why it is marked -2 and needed other eyes on it. | 15:27 |
| morganfainberg | ayoung, to the java impl consume PKI or uuid? | 15:27 |
| morganfainberg | ayoung, i honestly don't know if we can fix it, but this is a stab at fixing it before we say "nope wont fix" | 15:28 |
| ayoung | heh | 15:30 |
| ayoung | the Java is just at reminder that we can't just fix things in middleware. | 15:31 |
| *** gokrokve_ has joined #openstack-keystone | 15:31 | |
| morganfainberg | ayoung, this is tagged as a juno rc1 bug. so need to figure out if we want to say "wont fix" and the fix will be when v2 tokens are dropped | 15:32 |
| morganfainberg | i am inclined to say the answer is wont fix. | 15:33 |
| ayoung | morganfainberg, how bad is the bug? Is ita acutally breaking something, or is it just people going "why does my token_id say placeholder?" | 15:33 |
| morganfainberg | ayoung, well, heat at least was trying to extract the token id from the token body | 15:33 |
| ayoung | yeah...they worked around it a long while ago | 15:34 |
| ayoung | but.... | 15:34 |
| morganfainberg | ayoung, it is invalid data in the token. | 15:34 |
| ayoung | depends on how you squint at tit | 15:34 |
| ayoung | at it | 15:34 |
| morganfainberg | ayoung, so i'd say the bug is ugly, but may be something we need to fix. | 15:34 |
| morganfainberg | erm don't need to fix | 15:34 |
| ayoung | the token_id doesn't belong inside the token itself | 15:34 |
| *** gokrokve has quit IRC | 15:34 | |
| ayoung | but we didn';t write the format, we inherited it... | 15:35 |
| morganfainberg | ayoung, correct. | 15:35 |
| morganfainberg | ayoung, like i said, ugly, but maybe nothing we need/can fix | 15:35 |
| ayoung | yep | 15:36 |
| morganfainberg | ayoung, it is invalid data (proof based on the fact that we replace the data and return something that wont hash to the same id) | 15:36 |
| ayoung | sure | 15:36 |
| morganfainberg | ayoung, so i'm 100% content to abandon and mark the bug as wont fix/cant fix. just needed to do the due diligence of "can this be fixed before we bail on it" | 15:37 |
| morganfainberg | and the code change was minimal. | 15:37 |
| ayoung | morganfainberg, heh, if Horizon used that value instead of hashing themselves, we probably would have a better story now, wouldn't we | 15:37 |
| morganfainberg | lol | 15:37 |
| *** mikedillion has joined #openstack-keystone | 15:40 | |
| *** rodrigods has joined #openstack-keystone | 15:42 | |
| *** bvandenh has quit IRC | 15:42 | |
| amakarov | morganfainberg, greetings, i have a bug fix for review, but it has low priority - what to do next? I'm not so familiar with workflow yet, are low-priority bug fixes ignored for now, near the deadline? :) | 15:42 |
| morganfainberg | amakarov, depends on the bug. | 15:42 |
| morganfainberg | amakarov, low priority fixes doesn't mean we don't want them. | 15:42 |
| morganfainberg | amakarov, often times extra low prio/wishlist bugs make their way in even towards the end because the code is written and the benefit of fixing the bug is absolutely there. | 15:43 |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Refactor LDAP backend using context manager for connection https://review.openstack.org/118138 | 15:44 |
| amakarov | morganfainberg, so I just leave my patch there and take another one, or have to ask somebody to review it? I don't want to be noisy :) | 15:47 |
| morganfainberg | amakarov, this one: https://review.openstack.org/#/c/118590/ ? | 15:47 |
| morganfainberg | amakarov, there is no harm in asking in IRC for reviews :) | 15:48 |
| openstackgerrit | Yuriy Taraday proposed a change to openstack/keystonemiddleware: Add a pool of memcached clients https://review.openstack.org/119774 | 15:49 |
| YorikSar | morganfainberg: gtg, will be back later today. I've added config options there ^ | 15:49 |
| morganfainberg | YorikSar, thank you very much! | 15:49 |
| morganfainberg | amakarov, and i think it is reasonable to expect some reviews on that code in the near term. like i said, the code is there and fixing bugs isn't a bad thing :) | 15:50 |
| *** jaosorior has quit IRC | 15:52 | |
| amakarov | morganfainberg, point taken, thanks :) Yes it was my very own bug to try contribution :) There is a malfunctioning feature covered with a wrong test. I hope it may be somewhat useful. | 15:52 |
| morganfainberg | amakarov, so i'll provide some immidiate comment feedback on the patch, some things i'm seeing (e.g. unrelated whitespace changes) that will need to be else where. i've also tagged nkinder on the review since he has helped a lot on LDAP related stuff. | 15:53 |
| nkinder | morganfainberg, amakarov: I'll take a look at it a bit later today. | 15:54 |
| amakarov | nkinder, thanks - I'm new to opensource and any feedback would be vary valuable for me now | 15:55 |
| morganfainberg | amakarov well welcome then! | 15:57 |
| *** stevemar has quit IRC | 15:58 | |
| *** stevemar has joined #openstack-keystone | 15:59 | |
| *** gyee has joined #openstack-keystone | 15:59 | |
| *** mikedillion has quit IRC | 16:04 | |
| *** BAKfr has quit IRC | 16:07 | |
| *** andreaf is now known as andreaf_ | 16:09 | |
| *** wwriverrat1 has joined #openstack-keystone | 16:09 | |
| *** wwriverrat1 has left #openstack-keystone | 16:09 | |
| *** mikedillion has joined #openstack-keystone | 16:09 | |
| *** wwriverrat has quit IRC | 16:11 | |
| *** rushiagr is now known as rushiagr_away | 16:14 | |
| *** samuelmz has joined #openstack-keystone | 16:17 | |
| *** samuelmz has quit IRC | 16:27 | |
| *** rodrigods has quit IRC | 16:27 | |
| *** gokrokve has joined #openstack-keystone | 16:28 | |
| *** mikedillion has quit IRC | 16:28 | |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone: Clean up federated identity audit code https://review.openstack.org/119804 | 16:29 |
| *** samuelmz has joined #openstack-keystone | 16:30 | |
| *** mikedillion has joined #openstack-keystone | 16:30 | |
| *** gokrokve_ has quit IRC | 16:31 | |
| *** gokrokve has quit IRC | 16:32 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Refactor keystone-all and http/keystone https://review.openstack.org/62275 | 16:39 |
| *** wwriverrat1 has joined #openstack-keystone | 16:42 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 16:49 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/119142 | 16:49 |
| *** gokrokve has joined #openstack-keystone | 16:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/116255 | 16:54 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings validation https://review.openstack.org/118590 | 16:54 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:00 | |
| *** marcoemorais has joined #openstack-keystone | 17:00 | |
| *** jsavak has joined #openstack-keystone | 17:02 | |
| *** rkofman has quit IRC | 17:03 | |
| *** rkofman has joined #openstack-keystone | 17:04 | |
| *** joesavak has quit IRC | 17:04 | |
| *** diegows has joined #openstack-keystone | 17:05 | |
| *** rushiagr_away is now known as rushiagr | 17:06 | |
| *** amakarov has quit IRC | 17:09 | |
| *** htruta has joined #openstack-keystone | 17:10 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds pipeline hints to the example paste config https://review.openstack.org/119827 | 17:10 |
| *** gyee has quit IRC | 17:12 | |
| *** amirosh has joined #openstack-keystone | 17:12 | |
| Morgan_ | Hmm irc cloud is pretty nice. | 17:13 |
| *** harlowja_away is now known as harlowja | 17:14 | |
| *** jaosorior has joined #openstack-keystone | 17:18 | |
| *** joesavak has joined #openstack-keystone | 17:24 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds hint about filter placement to extension docs https://review.openstack.org/119834 | 17:24 |
| stevemar | dstanek, thanks | 17:25 |
| stevemar | dstanek, do you mind adding your last patch to this chain? https://review.openstack.org/#/c/119159/ | 17:27 |
| *** jsavak has quit IRC | 17:27 | |
| dstanek | hey stevemar | 17:28 |
| stevemar | or review the chain :) and i'll rebase your stuff later :) | 17:28 |
| dstanek | stevemar: yeah i can based that on yours | 17:28 |
| Morgan_ | dstanek: I'm going to be building an experimental functional gate job that will let us live test against ldap. I'll bug you when it's time to start migrating tests to functional (looking at the restful cases). If you have ideas there. | 17:28 |
| dstanek | Morgan_: sounds good | 17:29 |
| *** gyee has joined #openstack-keystone | 17:29 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: correct typos https://review.openstack.org/119838 | 17:30 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/identity-api: fix a/an typos https://review.openstack.org/119839 | 17:32 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: fix typos https://review.openstack.org/119841 | 17:34 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Add a functional tests for role assignments https://review.openstack.org/119843 | 17:38 |
| *** ayoung has quit IRC | 17:41 | |
| *** amirosh has quit IRC | 17:41 | |
| *** amirosh has joined #openstack-keystone | 17:42 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Add a functional tests for role assignments https://review.openstack.org/119843 | 17:44 |
| *** gyee has quit IRC | 17:46 | |
| *** amirosh has quit IRC | 17:47 | |
| samuelmz | henrynash, ping | 17:52 |
| *** ayoung has joined #openstack-keystone | 17:52 | |
| henrynash | samuelmz: hi | 17:52 |
| samuelmz | henrynash, hi | 17:53 |
| samuelmz | henrynash, concerning your comment at https://review.openstack.org/#/c/116682/4/keystone/assignment/controllers.py | 17:53 |
| samuelmz | henrynash, you are proposing to call list_role_assignments on the backend by passing user_id, group_id, project_id and domain_id, right? | 17:54 |
| samuelmz | henrynash, so at the backend (SQL in this example), we should do something like this (http://paste.openstack.org/show/108406/) | 17:55 |
| henrynash | samuelmz: or you pass add the assignment type to what you pass into the backend | 17:56 |
| samuelmz | henrynash, the assignmenttype representation is specific to backend | 17:57 |
| samuelmz | henrynash, for sql we have class AssignmentType: USER_PROJECT = 'UserProject' ... | 17:57 |
| dolphm | dstanek: https://review.openstack.org/#/c/114305/ ?? | 17:57 |
| samuelmz | henrynash, but we could have an AssignmentType class at controller class .. and then every backend would use it | 17:58 |
| henrynash | samuelmz: so yes, that’s the tradoff…but I’d actually argue that assignment type is a concept that is not backend specific…teh fact that we happen to store it in an SQL table is, hwoever, specific | 17:58 |
| lbragstad | henrynash: fyi I tried adding a test for the user-role-assignment bug you're subscribed to | 17:58 |
| dstanek | dolphm: that's based on the script i use to do the updates | 17:59 |
| *** wwriverrat1 has left #openstack-keystone | 17:59 | |
| dolphm | dstanek: what does your script add to oslo's thing? | 18:00 |
| henrynash | samuelmz: but you can do it eitehr way… | 18:00 |
| samuelmz | henrynash, hm.. +1 for putting this in the controller | 18:00 |
| samuelmz | henrynash, but how would we represent this? like we're doing in the sql? | 18:00 |
| dstanek | dolphm: i just saw your comment | 18:00 |
| henrynash | samuelmz: you mean, how would you represent it in other backend (e.g. LDAP), or how would you represent this in the controller? | 18:01 |
| dstanek | dolphm: it actually uses olso's update, but does all the git stuff to have bknudson style comments in the commit message; it runs update, figures out what changed and then commits | 18:01 |
| samuelmz | henrynash, if so, we should convert UserProject to ['user','project'] to create metadata-user-project on kvs ... | 18:01 |
| henrynash | lbragstad: and did it dow thie issue? | 18:01 |
| samuelmz | henrynash, yes, that's the point | 18:01 |
| lbragstad | henrynash: I wasn't able to recreate it using v3 | 18:02 |
| henrynash | samuelmz: yes, you would map AssignmentType to some local storage mechanism that was appropriate | 18:02 |
| henrynash | samuelmz: (but don’t worry about kvs backend, we deleting it in Kilo-1 :-) ) | 18:03 |
| samuelmz | henrynash, ok :) | 18:03 |
| samuelmz | henrynash, and what about ldap? | 18:03 |
| henrynash | lbragstad: ok..thanks for info | 18:03 |
| henrynash | samuelmz: well, It’s mapped into the oobject types and tree I guess | 18:04 |
| *** raildo has joined #openstack-keystone | 18:04 | |
| samuelmz | henrynash, yes, I mean.. do you have plans to delete ldap? | 18:04 |
| henrynash | samulemz: NO! | 18:04 |
| samuelmz | henrynash, :-) | 18:04 |
| lbragstad | henrynash: no problem, I left a paste of my test and the test up for review in the bug report. | 18:05 |
| samuelmz | henrynash, I asked this because I saw we could use ldap enabling federation | 18:05 |
| henrynash | samuelmz: so I’m not saying defintley expose AssignmentType….but just consider that as an option…. | 18:05 |
| henrynash | samuelmz: so, in the long run, yes, I agree that the ldap identity driver will go away…but it’s probably a long time | 18:06 |
| dolphm | dstanek: lol sounds like it's worth reviewing then :) | 18:06 |
| samuelmz | henrynash, I think we could keep the way in which it's being done | 18:06 |
| samuelmz | henrynash, I mean exposing or not AssignmentType is another refactoring, | 18:07 |
| henrynash | samuelmz: ok, no | 18:07 |
| raildo | I think I have the same doubt that samuelmz | 18:07 |
| henrynash | samuelmz:….I meant: OK, np | 18:07 |
| dstanek | dolphm: i had to ditch the old VM where i kept this locally, so i pushed to gerrit so i could easily share with my new VM | 18:07 |
| samuelmz | henrynash, cool :) I dont like the idea of mixing lots of things in a single patch | 18:07 |
| samuelmz | henrynash, thanks | 18:07 |
| henrynash | samuelmz: yw | 18:07 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:09 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds pipeline hints to the example paste config https://review.openstack.org/119827 | 18:15 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds hint about filter placement to extension docs https://review.openstack.org/119834 | 18:15 |
| dstanek | stevemar: ^ | 18:15 |
| stevemar | dstanek, :D thanks ! | 18:16 |
| *** david-lyle has quit IRC | 18:17 | |
| *** david-lyle has joined #openstack-keystone | 18:20 | |
| *** aix has quit IRC | 18:21 | |
| dolphm | dstanek: can you file a bug for this and target rc1? https://review.openstack.org/#/c/118640/ | 18:22 |
| dolphm | dstanek: just want to make sure that lands | 18:23 |
| dolphm | dstanek: and evaluate it for backporting | 18:23 |
| openstackgerrit | A change was merged to openstack/identity-api: fix a/an typos https://review.openstack.org/119839 | 18:24 |
| *** cjellick has quit IRC | 18:26 | |
| *** cjellick has joined #openstack-keystone | 18:26 | |
| topol | dolphm, you there | 18:28 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Enable filtering of services by name https://review.openstack.org/110904 | 18:28 |
| dolphm | topol: o/ | 18:28 |
| topol | dolph, so for auditing of federated identity we took out the pending because we felt it was unnecessary. I noticed for standards authenticate we still have a pending audit record. Should I submit a patch to pull that out as well so that we are consistent? | 18:30 |
| *** vhoward has left #openstack-keystone | 18:30 | |
| *** afaranha has joined #openstack-keystone | 18:30 | |
| topol | dolphm^ | 18:30 |
| dolphm | topol: didn't we pull it out of federated because there was no work being done between PENDING and the result? | 18:30 |
| afaranha | dstanek: Hello, I'm reviewing a patch that you submited and in line 34: https://review.openstack.org/#/c/119834/2/doc/source/extensions/oauth1.rst you put an extra new line. | 18:31 |
| *** rushiagr is now known as rushiagr_away | 18:32 | |
| topol | dolphm, I thought the reasoning was that pending was only for long running operations and we felt the fed authenticate was quick | 18:33 |
| topol | long running = operation they may take a lot of time (like starting a VM) | 18:33 |
| dolphm | topol: that's right -- so local auth wouldn't be long running either | 18:34 |
| dolphm | topol: +1 for removing it then | 18:34 |
| topol | dolphm, that was my thought. So Iwas gonna submit a patch to remove it | 18:34 |
| topol | dolphm, K, I assume it needs a bug as well since it is something external that someone may notice a difference | 18:35 |
| dolphm | topol: ++ | 18:35 |
| dstanek | afaranha: i did that on purpose so that it matches the other extension docs | 18:35 |
| topol | dolphm, Im on it. Thanks | 18:35 |
| afaranha | dstanek: Do you mean keep the pattern? | 18:38 |
| *** edmondsw has joined #openstack-keystone | 18:44 | |
| *** mikedillion has quit IRC | 18:49 | |
| dolphm | morganfainberg: this review fixes a "typo" in one of your comments, but i don't think it was a typo. since you wrote it, you be the judge: https://review.openstack.org/#/c/117902/ | 18:49 |
| morganfainberg | dolphm, that is a typo, but not the one that is being fix | 18:50 |
| morganfainberg | dolphm, should be 'in a sane manner' not in same manner | 18:50 |
| *** openstackgerrit has quit IRC | 18:51 | |
| dolphm | morganfainberg: thank you! | 18:52 |
| morganfainberg | dolphm, commented on the patch as well. | 18:52 |
| *** rodrigods has joined #openstack-keystone | 18:53 | |
| *** rodrigods has quit IRC | 18:53 | |
| *** rodrigods has joined #openstack-keystone | 18:53 | |
| morganfainberg | dolphm, posted a version that fixes the correct typo | 18:53 |
| morganfainberg | dolphm, left the original author though. | 18:53 |
| morganfainberg | dolphm, so patchset 2. | 18:54 |
| dolphm | morganfainberg: +2. there's another review out there that rewrites that bit of the comment | 18:54 |
| morganfainberg | ah | 18:54 |
| dolphm | i don't know what's going on with all the trivial comment changes | 18:54 |
| morganfainberg | race to rebase | 18:54 |
| *** jorge_munoz has quit IRC | 18:55 | |
| *** jorge_munoz has joined #openstack-keystone | 18:56 | |
| morganfainberg | LOL https://bugs.launchpad.net/keystone/+bug/996912 wow | 19:01 |
| uvirtbot | Launchpad bug 996912 in keystone "Wrong exception caught for admin checking in ec2" [Medium,Triaged] | 19:01 |
| morganfainberg | that has been around for a while | 19:01 |
| *** mikedillion has joined #openstack-keystone | 19:04 | |
| *** openstackgerrit has joined #openstack-keystone | 19:06 | |
| *** openstackgerrit has quit IRC | 19:06 | |
| *** openstackgerrit has joined #openstack-keystone | 19:06 | |
| *** marcoemorais has quit IRC | 19:09 | |
| *** marcoemorais has joined #openstack-keystone | 19:10 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Updates package comment to be more accurate. https://review.openstack.org/114326 | 19:14 |
| bknudson | what is keystone-manage saml_idp_metadata ? | 19:20 |
| dolphm | dstanek: this one is waiting for you https://review.openstack.org/#/c/117523/ | 19:22 |
| *** marcoemorais has quit IRC | 19:22 | |
| dolphm | bknudson: it signs a bunch of keystone.conf options as a saml doc so keystone can later serve it as a static file, basically | 19:22 |
| dolphm | marekd: stevemar: need docs ^ | 19:22 |
| *** marcoemorais has joined #openstack-keystone | 19:23 | |
| bknudson | ok | 19:23 |
| stevemar | dolphm, on it | 19:23 |
| *** ukalifon1 has quit IRC | 19:24 | |
| bknudson | there's a docstring in the command handler. I'll use that in the man page. | 19:24 |
| stevemar | bknudson, dolphm dstanek i have about 5 or so doc related changes, can i get a review for them? It's getting a PITA to rebase if I want to add new docs for k2k federation | 19:26 |
| joesavak | stevemar - you rock. | 19:26 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Update man pages https://review.openstack.org/119888 | 19:32 |
| dstanek | afaranha: since i was changing that line and it was too long i decided to break it up | 19:35 |
| dstanek | dolphm: neat, i'll take a look | 19:35 |
| dstanek | stevemar: sure. | 19:35 |
| dolphm | k2k doc series starts here https://review.openstack.org/#/c/118532/ | 19:36 |
| *** amcrn has joined #openstack-keystone | 19:40 | |
| *** wwriverrat1 has joined #openstack-keystone | 19:41 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update paste pipelines in configuration docs https://review.openstack.org/118533 | 19:51 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the revocation configuration docs https://review.openstack.org/118536 | 19:51 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the revocation configuration docs https://review.openstack.org/118536 | 19:55 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Make the extension docs a top level entry in the landing page https://review.openstack.org/119159 | 19:55 |
| stevemar | dolphm is padding his review stats | 20:01 |
| stevemar | -2 all the things! | 20:01 |
| dolphm | stevemar: pretty much | 20:01 |
| *** wwriverrat1 has left #openstack-keystone | 20:01 | |
| dolphm | stevemar: ONLY TEN REVIEWS TO GO UNTIL I CAN HAVE SANITY AGAIN | 20:01 |
| dolphm | this has taken all day | 20:01 |
| *** gyee has joined #openstack-keystone | 20:03 | |
| dstanek | dolphm: why do you not like this one? https://review.openstack.org/#/c/114997 | 20:07 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Make the extension docs a top level entry in the landing page https://review.openstack.org/119159 | 20:08 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Adds pipeline hints to the example paste config https://review.openstack.org/119827 | 20:08 |
| dolphm | dstanek: oh, hrm. probably a mistake, let me review | 20:09 |
| dolphm | also probably not the only mistake i made | 20:09 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Adds hint about filter placement to extension docs https://review.openstack.org/119834 | 20:09 |
| dstanek | dolphm: i'm tearing into why i don't like the details right now, but i think if it's fixed up it will be good to have | 20:09 |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Use id attribute map for read-only LDAP https://review.openstack.org/117658 | 20:10 |
| dstanek | we made a decision to only validate v3 right? i don't remember why, but i remember reading that from somewhere | 20:11 |
| *** tim_r has quit IRC | 20:13 | |
| *** tim__r has joined #openstack-keystone | 20:13 | |
| dolphm | lbragstad: ^ | 20:15 |
| bknudson | do we have validation of the extensions? | 20:15 |
| dstanek | dolphm: lbragstad: i'm thinking because v2 is deprecated..maybe? | 20:15 |
| lbragstad | bknudson: not yet, core api has validation | 20:16 |
| *** arunkant has quit IRC | 20:17 | |
| lbragstad | dstanek: I believe so | 20:17 |
| dstanek | lbragstad: not in keystone.identity though | 20:17 |
| lbragstad | dstanek: but I don't think I could dig up the conversation | 20:17 |
| lbragstad | right | 20:17 |
| lbragstad | keystone core api - identity | 20:17 |
| dstanek | = good times! | 20:18 |
| gyee | bknudson, nkinder, can you guys take another look? https://review.openstack.org/#/c/117658/ | 20:18 |
| nkinder | gyee: yep, will do | 20:19 |
| nkinder | gyee: may take me a bit, as I'm heading into a meeting in 10 minutes. | 20:19 |
| gyee | nkinder, no problem, thanks! | 20:19 |
| *** arunkant has joined #openstack-keystone | 20:20 | |
| *** Haneef has joined #openstack-keystone | 20:20 | |
| dstanek | lbragstad: https://review.openstack.org/#/c/114997 adds some user validation to identity | 20:22 |
| nkinder | gyee: ok, I got to it early... | 20:22 |
| Haneef | ayoung: I have an idea on how to use v3 polcy file without breaking backward compatability. Can I assign https://blueprints.launchpad.net/keystone/+spec/update-policy-to-cloud to myself and work on it? I don't want to create one more blueprint | 20:22 |
| nkinder | gyee: changes look good, but there are some additional tests that I think should be added | 20:23 |
| nkinder | gyee: I mentioned them in my comment for patch 7 (not inline) | 20:23 |
| ayoung | Haneef, have you seen henrynash 's work on assigning policy to endpoint this release? | 20:23 |
| Haneef | ayoung: ok. I will have a look at it and get back to you | 20:24 |
| gyee | nkinker, k, I'll see if I can add them | 20:26 |
| *** r-daneel has quit IRC | 20:27 | |
| *** r-daneel has joined #openstack-keystone | 20:28 | |
| openstackgerrit | A change was merged to openstack/keystone: Avoid conversion of binary LDAP values https://review.openstack.org/119457 | 20:38 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove trailing space from string https://review.openstack.org/119905 | 20:42 |
| *** HenryG has quit IRC | 20:48 | |
| lbragstad | dstanek: I saw that a while back, shouldn't be too bad to refactor now that the rest of the validation stuff for the core api is in | 20:49 |
| dstanek | lbragstad: probably only take a few minutes to fix my issues - i'm not going to do it right now to give the author a chance | 20:51 |
| lbragstad | dstanek: yep, that's a good plan | 20:52 |
| dstanek | lbragstad: i'll probably send an email in a few - because if would be nice to have that fixed up so that we can validate other identity calls | 20:52 |
| lbragstad | ++ | 20:53 |
| morganfainberg | dstanek, ping - actually sec. | 20:57 |
| dstanek | morganfainberg: pong | 20:57 |
| morganfainberg | haha so the bug about things caching forever | 20:57 |
| morganfainberg | invalid | 20:57 |
| morganfainberg | i think | 20:58 |
| morganfainberg | 2x checking | 20:58 |
| *** marekd has quit IRC | 20:59 | |
| morganfainberg | dstanek, yeah already have an override in the [cache] section | 21:00 |
| *** HenryG has joined #openstack-keystone | 21:00 | |
| morganfainberg | dstanek, https://github.com/openstack/keystone/blob/master/keystone/common/config.py#L293-L297 and https://bitbucket.org/zzzeek/dogpile.cache/src/1c753914b335b4391bc5847a87b7c52ca81c2bc6/dogpile/cache/region.py?at=master#cl-960 | 21:01 |
| morganfainberg | dstanek, we can probably mark this https://bugs.launchpad.net/keystone/+bug/1355919 as invalid | 21:02 |
| uvirtbot | Launchpad bug 1355919 in keystone "By default when caching is enabled, objects will be cached forever" [Medium,In progress] | 21:02 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Move test_binary_attribute_values https://review.openstack.org/119928 | 21:03 |
| *** stevemar has quit IRC | 21:03 | |
| *** stevemar has joined #openstack-keystone | 21:04 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove unused cache functions from token.core https://review.openstack.org/119679 | 21:05 |
| stevemar | dstanek, do you have a suggestion for the os-revoke stuff? you're right, it's only for icehouse or newer | 21:05 |
| *** amcrn has quit IRC | 21:05 | |
| *** topol has quit IRC | 21:06 | |
| *** topol has joined #openstack-keystone | 21:06 | |
| dstanek | morganfainberg: we don't use that default do we? | 21:08 |
| dstanek | morganfainberg: that's what i was adding here: https://review.openstack.org/#/c/113586/4/keystone/assignment/core.py | 21:08 |
| morganfainberg | dstanek, that is the default it is added to the cache region config | 21:08 |
| dstanek | stevemar: maybe just something about is being the new default in the example config? | 21:08 |
| morganfainberg | dstanek, https://github.com/openstack/keystone/blob/master/keystone/common/cache/core.py#L91 | 21:09 |
| morganfainberg | which is used if expiration_time is none on any calls in the cache region, including the decorators | 21:09 |
| *** arborism has joined #openstack-keystone | 21:10 | |
| *** arborism is now known as amcrn | 21:11 | |
| dstanek | morganfainberg: hmmm...where does dogpile.cache use that default value? | 21:12 |
| dstanek | morganfainberg: the bug is probably invalid if dogpile.cache is taking care of it, but i think the code should be merged to make it explicit | 21:13 |
| morganfainberg | dstanek, i want to get out of the logic being in keystone instead move it more towards dogpile | 21:14 |
| dstanek | there is a lot of indirection when using dogpile.cache and i think this will come up again | 21:14 |
| morganfainberg | dstanek, if at all possible. | 21:14 |
| dstanek | the logic of which config values to use? | 21:14 |
| morganfainberg | dstanek, i think if we just made our cache layer use a get_expiration_fn that had reasonable docstring saying "dogpile enforces the default" would be sufficient | 21:15 |
| *** edmondsw has quit IRC | 21:15 | |
| morganfainberg | otherwise it is *pointless* to have the default handled like dogpile is meant to | 21:15 |
| morganfainberg | so we're always overriding it. | 21:15 |
| morganfainberg | similar to how the should_cache_fn works | 21:15 |
| *** marcoemorais has quit IRC | 21:17 | |
| dstanek | morganfainberg: you just saying to remove the " or CONF.cache_time" from our functions? | 21:17 |
| morganfainberg | dstanek, no, use the same way we do should_cache_fn(<section>) instead of lambdas | 21:18 |
| morganfainberg | https://github.com/openstack/keystone/blob/249d83529af0c746c6980aa0dbd2287bc8de345e/keystone/common/cache/core.py#L155 | 21:18 |
| morganfainberg | have a docstring that says "the default is set with XXX option on the region" | 21:18 |
| morganfainberg | and use that instead of the lambdas/separate functions in each module | 21:18 |
| dstanek | morganfainberg: that would work | 21:20 |
| *** jdennis has quit IRC | 21:20 | |
| morganfainberg | dstanek, i'll post that up, i'm about 50% of the way there already | 21:20 |
| stevemar | dstanek, what about this? http://paste.openstack.org/show/108480/ | 21:28 |
| *** david-lyle has quit IRC | 21:28 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes formatting error in debug log statement https://review.openstack.org/118640 | 21:29 |
| dstanek | dolphm, bknudson: i changed to commit message to add a reference to the bug i just created ^ | 21:30 |
| dstanek | s/to/the/ | 21:30 |
| bknudson | dstanek: who was asking for a bug? | 21:31 |
| bknudson | oh, it actually fails? | 21:31 |
| dstanek | bknudson: dolphm asked earlier | 21:31 |
| bknudson | dstanek: it doesn't actually fail? | 21:31 |
| dstanek | bknudson: yes, i was getting a typeerror | 21:32 |
| dstanek | stevemar: i think that sounds good now | 21:32 |
| bknudson | dstanek: well, now I want a unit test! | 21:32 |
| dstanek | bknudson: i can add one :-) | 21:32 |
| bknudson | dstanek: LOG.debug raises if there's an extra argument? | 21:33 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the revocation configuration docs https://review.openstack.org/118536 | 21:33 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Make the extension docs a top level entry in the landing page https://review.openstack.org/119159 | 21:33 |
| stevemar | dstanek, ^ | 21:34 |
| stevemar | and if you could hit the rebase button on your changes :) | 21:34 |
| dstanek | bknudson: http://paste.openstack.org/show/108488/ | 21:35 |
| dstanek | that's basically what i saw | 21:35 |
| bknudson | ok. I'm surprised we don't see that all the time. | 21:36 |
| bknudson | so that does show that the code isn't covered by unit tests | 21:36 |
| dstanek | bknudson: or maybe that it doesn't run at a debug level? | 21:42 |
| bknudson | dstanek: the coverage report shows that it is covered... so maybe it's not at debug? | 21:44 |
| *** mikedillion has quit IRC | 21:46 | |
| *** dims_ has quit IRC | 21:48 | |
| *** dims has joined #openstack-keystone | 21:49 | |
| *** dims has quit IRC | 21:53 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Move unit tests from test_backend_ldap https://review.openstack.org/119928 | 21:55 |
| *** dims has joined #openstack-keystone | 21:56 | |
| bknudson | p LOG.isEnabledFor(logging.DEBUG) -- True ... so it should be logged. | 22:01 |
| *** dims has quit IRC | 22:03 | |
| *** jasondotstar has quit IRC | 22:03 | |
| bknudson | dstanek: LOG.debug() must just print it out rather than propagating the exception. | 22:03 |
| *** dims has joined #openstack-keystone | 22:03 | |
| *** marcoemorais has joined #openstack-keystone | 22:03 | |
| bknudson | https://docs.python.org/2/library/logging.html#logging.Handler.handleError | 22:06 |
| *** dims has quit IRC | 22:08 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Make the default cache time more explicit in code https://review.openstack.org/113586 | 22:10 |
| morganfainberg | dstanek, ^ | 22:10 |
| bknudson | apparently you're supposed to set logging.raiseExceptions to False in production. | 22:10 |
| *** stevemar has quit IRC | 22:12 | |
| *** miqui has joined #openstack-keystone | 22:13 | |
| rm_work | Can you guys tell me what you think of this workflow? This is the current proposed workflow for Neutron-LBaaS --> Keystone/Barbican interaction: http://i.imgur.com/zVq3Iut.png | 22:15 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Make the default cache time more explicit in code https://review.openstack.org/113586 | 22:17 |
| *** topol has quit IRC | 22:23 | |
| *** jorge_munoz has quit IRC | 22:24 | |
| *** amcrn_ has joined #openstack-keystone | 22:30 | |
| *** amcrn has quit IRC | 22:32 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Tests raise exception if logging problem https://review.openstack.org/119946 | 22:35 |
| rm_work | ayoung / dolphm: So, I think I had talked to you guys in the past about the plan to use Trusts and Impersonation to interface between LBaaS and Barbican -- can you take a look at this (fairly simplistic) workflow and tell me if it makes sense to you? http://i.imgur.com/GQlXnbv.png | 22:36 |
| *** gokrokve has quit IRC | 22:48 | |
| *** bknudson has quit IRC | 22:49 | |
| *** jaosorior has quit IRC | 22:52 | |
| *** marcoemorais has quit IRC | 22:55 | |
| *** marcoemorais has joined #openstack-keystone | 22:55 | |
| *** marcoemorais has quit IRC | 22:56 | |
| *** joesavak has quit IRC | 22:56 | |
| *** marcoemorais has joined #openstack-keystone | 22:56 | |
| nkinder | rm_work: I know I chatted with you before about that | 22:59 |
| nkinder | rm_work: the diagram is missing some info about how the trust is used | 22:59 |
| nkinder | rm_work: there are two distinct operations - creation of a trust and execution of a trust | 22:59 |
| rm_work | yeah | 23:00 |
| rm_work | ok so #4 is the creation (I did say " | 23:00 |
| rm_work | ok so #4 is the creation (I did say "create a Trust") | 23:00 |
| rm_work | #5 is the execution of the Trust | 23:00 |
| rm_work | I assumed executing the trust still requires Impersonation? | 23:00 |
| nkinder | rm_work: yeah, but is the flow always "create and execute" at the same time? | 23:00 |
| rm_work | nkinder: essentially | 23:01 |
| nkinder | rm_work: or can those be disjointed? | 23:01 |
| rm_work | well | 23:01 |
| *** amcrn_ is now known as amcrn | 23:01 | |
| rm_work | it's more like UPSERT | 23:01 |
| rm_work | Create Trust if not already created | 23:01 |
| nkinder | rm_work: if they happen at the same time, you might as well just use the users ticket directly against barbican to get the SSL cert/key | 23:01 |
| rm_work | nkinder: in THIS scenario it is in-line | 23:01 |
| rm_work | but then we will need to skip directly to step #5 in the future | 23:01 |
| nkinder | ok, if there is possibly a trust already and you execute it at some point in the future, then the trust makes sense | 23:02 |
| rm_work | with no user interaction | 23:02 |
| rm_work | so this is the initial setup of the LB | 23:02 |
| nkinder | rm_work: ok, so in the diagram I would have LBaaS->Keystone (create trust) | 23:02 |
| nkinder | then LBaaS->Keystone (execute trust) | 23:02 |
| rm_work | how exactly does the trust "execution" work? | 23:02 |
| nkinder | then LBaaS->Barbican (forward trust token) | 23:02 |
| rm_work | ah ok | 23:02 |
| nkinder | rm_work: it's just like getting a token | 23:02 |
| rm_work | it's a Keystone token GET | 23:03 |
| rm_work | got it | 23:03 |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Use id attribute map for read-only LDAP https://review.openstack.org/117658 | 23:03 |
| nkinder | but it's a different resource | 23:03 |
| nkinder | yeah, more or less | 23:03 |
| nkinder | you pass it a trust id to execute | 23:03 |
| rm_work | k | 23:03 |
| *** marcoemorais1 has joined #openstack-keystone | 23:04 | |
| nkinder | rm_work: maybe calling out "create trust if it doesn't exist" would make it more clear too just to show that the creation is optional | 23:04 |
| rm_work | k | 23:04 |
| rm_work | nkinder: "5. LBaaS executes the Trust with Keystone to receive an Impersonation Key" ? | 23:06 |
| rm_work | does that make sense? | 23:06 |
| *** marcoemorais1 has quit IRC | 23:06 | |
| rm_work | or am I still getting it wrong | 23:06 |
| rm_work | I know there is a line between Trusts and Impersonation but I am not exactly sure where it leis | 23:06 |
| *** marcoemorais1 has joined #openstack-keystone | 23:06 | |
| rm_work | *where it is | 23:06 |
| nkinder | s/impersonation key/trust token/ | 23:06 |
| rm_work | ok | 23:06 |
| *** dguitarbite has joined #openstack-keystone | 23:07 | |
| rm_work | so with the Trust token, when we hit Barbican, we'll be in the user's Project scope? | 23:07 |
| rm_work | or will we ALSO need to do Impersonation | 23:07 |
| nkinder | rm_work: yes, the users project scope and the roles that they defined when the trust was created | 23:07 |
| rm_work | we need both the user's roles and also our "admin" roles to do the operations we want | 23:07 |
| nkinder | impersonation just sets the user in the token to the user AFAIK | 23:07 |
| nkinder | rm_work: which barbican keys off of IIRC | 23:08 |
| rm_work | ok, I will have to test | 23:08 |
| nkinder | so you will need a trust token with impersonation | 23:08 |
| *** marcoemorais has quit IRC | 23:08 | |
| morganfainberg | nkinder, yes impersonation = you are that user, vs just have the roles of that user | 23:08 |
| rm_work | nkinder: is that a single operation? | 23:08 |
| nkinder | rm_work: it's an option when creation the trust | 23:08 |
| nkinder | creating | 23:08 |
| rm_work | ah | 23:08 |
| rm_work | "Trust With Impersonation" boolean? :P | 23:08 |
| nkinder | so the user would stay as the LBaaS user with the users roles without impersonation | 23:08 |
| nkinder | with impersonation just sets the user in the trust token too | 23:09 |
| rm_work | so, we don't technically need their *roles* at all, I believe? if we were to impersonate them? | 23:09 |
| rm_work | so maybe we don't even need Trusts, JUST impersonation? | 23:09 |
| nkinder | rm_work: yeah, not with barbican | 23:09 |
| nkinder | well, you need the ability to impersonate a user when they may not have sent you a token, right? | 23:09 |
| nkinder | for automation purposes? | 23:09 |
| rm_work | yes | 23:10 |
| nkinder | yeah, so you needs trusts for that property | 23:10 |
| rm_work | ok | 23:10 |
| rm_work | 4. LBaaS hijacks the user's Keystone Token and uses it to create a Trust (with Impersonation) between the User and the LBaaS Service-Account (if one doesn't exist already), receiving a TrustID | 23:10 |
| rm_work | is that right then? | 23:10 |
| nkinder | yes | 23:10 |
| nkinder | and you store that trust id somewhere in LBaaS to use at execution time later | 23:11 |
| rm_work | yes | 23:11 |
| rm_work | then 5. LBaaS executes the Trust with Keystone to receive an Impersonation Key | 23:11 |
| nkinder | s/impersonation key/trust token (with impersonation)/ | 23:11 |
| rm_work | then 6. LBaaS reads the user's Certificate info using the Trust Token (with Impersonation) | 23:12 |
| nkinder | yep, sounds correct | 23:12 |
| rm_work | k | 23:12 |
| *** raildo has quit IRC | 23:17 | |
| rm_work | nkinder: http://i.imgur.com/fldU3OW.png | 23:21 |
| nkinder | the arrow between 4 and 5 is confusuing, but you have the idea right in the text | 23:23 |
| rm_work | heh yeah | 23:23 |
| nkinder | I would expect 5 to return the trust ID | 23:23 |
| rm_work | not sure the best way to do some of those arrows | 23:23 |
| nkinder | then 6 to execute the trust with an arrow from LBaaS->Keystone | 23:24 |
| nkinder | and 7 to return the trust token | 23:24 |
| rm_work | err, but 4 returns the trustID? | 23:24 |
| rm_work | 5 returns a trustToken | 23:25 |
| rm_work | and 6 uses that token in Barbican? | 23:25 |
| *** gokrokve has joined #openstack-keystone | 23:28 | |
| nkinder | rm_work: http://goo.gl/svqRwz | 23:29 |
| rm_work | heh yeah | 23:31 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:31 | |
| rm_work | i used to use this | 23:31 |
| rm_work | I should start again :P | 23:31 |
| rm_work | maybe I'll redo this whole thing in this tool | 23:31 |
| nkinder | rm_work: I gotta take off, but does my explanation make sense? | 23:32 |
| rm_work | yeah, i thought that was the same as what I had :P | 23:32 |
| rm_work | but you're saying it isn't quite? | 23:33 |
| nkinder | rm_work: the arrows just weren't showing two distinct operations (round trips) to Keystone | 23:33 |
| rm_work | err | 23:33 |
| nkinder | rm_work: you have the idea right | 23:33 |
| rm_work | well it's more of a process diagram than an actual tracking of each and every API call | 23:34 |
| rm_work | like #1 is actually 2+ API calls | 23:34 |
| rm_work | and from #1 to #2 is not really linked, nor #2 to #3 | 23:35 |
| nkinder | rm_work: yeah, abstracting some of the detail away is fine. The main reason to show those keystone actions as separate is that we expect to execute a trust that already exists (which is the whole reason for having a trust) | 23:36 |
| nkinder | rm_work: it allows that flow to be shows by simply eliminating the boxes for trust creation/trust id return | 23:36 |
| nkinder | rm_work: either way, it's a nitpick on my part :) | 23:37 |
| nkinder | rm_work: gotta go, bbl | 23:37 |
| rm_work | kk, thanks for the feedback | 23:37 |
| jamielennox | morning all - yes it's client review time, here are a couple with a +2 already: | 23:41 |
| jamielennox | https://review.openstack.org/#/c/115903/ | 23:41 |
| jamielennox | https://review.openstack.org/#/c/117399/ | 23:41 |
| jamielennox | https://review.openstack.org/#/c/81147/ (a bit trickier than the first two) | 23:42 |
| *** nkinder has quit IRC | 23:42 | |
| jamielennox | there are a number of super easy ones as well (less than 50 lines!) | 23:44 |
| jamielennox | https://review.openstack.org/#/c/118520/ | 23:45 |
| jamielennox | https://review.openstack.org/#/c/117669/ | 23:45 |
| jamielennox | (that one is +10,-2) | 23:45 |
| jamielennox | https://review.openstack.org/#/c/112440/ | 23:46 |
| *** richm1 has quit IRC | 23:47 | |
| *** stevemar has joined #openstack-keystone | 23:48 | |
| *** hrybacki has joined #openstack-keystone | 23:49 | |
| *** gokrokve has quit IRC | 23:53 | |
| *** dims has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
