| jamielennox | ekarlso-: heh, top of queue has been in line for 26 hours - borked might be an apt description | 00:01 |
|---|---|---|
| nkinder | jamielennox: sorry for stepping on your repo creation review | 00:08 |
| jamielennox | nkinder: no worries, i fixed it a different way | 00:08 |
| nkinder | jamielennox: I figured I'd try to help move it along while you slept :) | 00:08 |
| jamielennox | nkinder: it takes way to long to get infra to pass some of these reviews to have to turn around and issue another one after the first two patches have landed | 00:08 |
| jamielennox | so i just seeded a base repo onto github they can pull from | 00:09 |
| *** gokrokve has quit IRC | 00:11 | |
| dstanek | gate queue keeps growing | 00:12 |
| nkinder | jamielennox: yeah, makes sense | 00:13 |
| *** RockKuo_Office has joined #openstack-keystone | 00:13 | |
| morganfainberg | gate...gate...gate...gate...gate...gate.. <continues chanting> | 00:13 |
| *** gyee has quit IRC | 00:18 | |
| *** harlowja_ has quit IRC | 00:25 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/identity-api: Updated from global requirements https://review.openstack.org/120635 | 00:25 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone-specs: Updated from global requirements https://review.openstack.org/120638 | 00:25 |
| *** harlowja has joined #openstack-keystone | 00:28 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Allow passing None for username in v2.Password https://review.openstack.org/116757 | 00:28 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Always supply a username to auth_token tests setup https://review.openstack.org/116760 | 00:28 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/116255 | 00:31 |
| openstackgerrit | A change was merged to openstack/keystone: JSON Home data is required https://review.openstack.org/117663 | 00:31 |
| *** cjellick has quit IRC | 00:31 | |
| *** tim_r has joined #openstack-keystone | 00:41 | |
| *** tim__r has quit IRC | 00:43 | |
| *** saipandi has quit IRC | 00:45 | |
| *** marcoemorais has quit IRC | 00:51 | |
| *** wanghong has joined #openstack-keystone | 00:59 | |
| *** jorge_munoz has joined #openstack-keystone | 01:03 | |
| stevemar | morganfainberg, wait a sec, don't other stuff have lxml as a dependency? did you introduce it? | 01:06 |
| stevemar | i don't recall going to requirements project for that | 01:06 |
| stevemar | afk-ish | 01:06 |
| *** gokrokve has joined #openstack-keystone | 01:09 | |
| ayoung | jamielennox, how are we on the new repo? | 01:16 |
| jamielennox | ayoung: no movement, got a push back overnight and i've got a new patch up | 01:16 |
| jamielennox | there is pretty good support for this from infra so if you want to bug them about it be my guest | 01:16 |
| jamielennox | i need to do another repo for -federation | 01:17 |
| ayoung | jamielennox, of course | 01:17 |
| ayoung | walk me through what you did, I've never done this | 01:17 |
| ayoung | OK, this is self explanatory https://review.openstack.org/#/c/120261/8/modules/gerritbot/files/gerritbot_channel_config.yaml,cm | 01:18 |
| jamielennox | sure, my knowledge of infra is kind of sketchy but i've done it a few times now | 01:18 |
| jamielennox | https://review.openstack.org/#/c/120261/8/modules/openstack_project/files/jenkins_job_builder/config/projects.yaml seems to be like a template for defining jobs that can be run for a project | 01:19 |
| ayoung | https://review.openstack.org/#/c/120261/8/modules/openstack_project/files/jenkins_job_builder/config/projects.yaml,cm says "we have a job run on bare-precise and etc" | 01:19 |
| jamielennox | you define there your project and some names and it creates a whole bunch of possible jobs | 01:19 |
| ayoung | I | 01:19 |
| ayoung | 'm assuming those are image names | 01:19 |
| ayoung | or a set of machines that match some profile | 01:19 |
| jamielennox | then https://review.openstack.org/#/c/120261/8/modules/openstack_project/files/zuul/layout.yaml is telling zuul which of those jobs you want to run and when | 01:20 |
| ayoung | py-pi jobs? | 01:20 |
| jamielennox | automatic upload to pypi | 01:20 |
| ayoung | when does that happen? | 01:20 |
| jamielennox | you can git push a signed tag, zuul will package it and push it to pypi | 01:21 |
| jamielennox | which is awesome | 01:21 |
| jamielennox | ayoung: i always end up re-following the instructions here: http://ci.openstack.org/stackforge.html | 01:23 |
| ayoung | ah...that makes it clearer | 01:23 |
| jamielennox | it's never quite that straight forward but after that you can copy from other projects or find -infra people | 01:24 |
| ayoung | cool. thanks for going through the pain of it | 01:24 |
| ayoung | jamielennox, at some point, we should figure out a comparable struacture for Javascript code to what we are doing in Python. | 01:27 |
| ayoung | jamielennox, I suspect there are some lessons we don;t want to relearn the hard way | 01:28 |
| jamielennox | ayoung: yea, i was wondering what of this would be useful elsewhere | 01:28 |
| ayoung | and the next version of Horizon is going to need it | 01:28 |
| jamielennox | i know enough ruby to think at least the structure is ok | 01:28 |
| jamielennox | but i really can't say with javascript | 01:28 |
| ayoung | I think the structure is going to be the same, but the need for requests probably goes away: the browser kindof dictates how you talk to services | 01:29 |
| jamielennox | so the basic structure was at least heavily inspired from requests though | 01:29 |
| jamielennox | session with auth plugin | 01:30 |
| ayoung | since Oslo looks like it is going to be grabbing the CORS middleware, it might end up as an oslo thing | 01:30 |
| jamielennox | pass the session around | 01:30 |
| ayoung | In Angular there is a config for the AJAX requests, and you can, if you want, even set global things...prototype inheritance is weird | 01:30 |
| jamielennox | everytime i dip a toe into javascript i run away | 01:31 |
| *** dims_ has joined #openstack-keystone | 01:32 | |
| jamielennox | i like the theory, the language hurts me | 01:32 |
| ayoung | its unavoidable for web stuff, but I really don't mind the language | 01:32 |
| ayoung | its like plastic lawn furniture | 01:33 |
| ayoung | good for leaving out in the rain..not that nice to sit on, but better than sitting on the ground.... | 01:33 |
| ayoung | easy to break | 01:33 |
| ayoung | jamielennox, but, for example https://github.com/admiyo/keystone-cops/blob/works/keystone.js#L241 | 01:34 |
| ayoung | that is pretty simple: the config holds the headers | 01:34 |
| ayoung | response_promise. has success and failure functions. still seems strange to me that you set them after you make the AJAX call, | 01:35 |
| ayoung | Angular seems pretty simple to work with | 01:36 |
| jamielennox | is $http global? | 01:36 |
| ayoung | yeah | 01:36 |
| ayoung | part of Angular | 01:36 |
| jamielennox | oh, i see it, it's still passed to the funtion | 01:36 |
| *** oomichi has joined #openstack-keystone | 01:37 | |
| ayoung | it is the $scope I have not quite figured out, as that seems to be a global functor or something | 01:37 |
| jamielennox | is there a openstack js project? | 01:37 |
| ayoung | yeah, but I don't know if it is used | 01:37 |
| ayoung | jstack | 01:37 |
| jamielennox | https://ging.github.io/jstack/ | 01:38 |
| jamielennox | https://github.com/gabrielhurley/js-openclient | 01:38 |
| ayoung | thing is, it not worth it to fight the toolkit, and it looks like Horizon is going with Angular | 01:39 |
| ayoung | his looks like it is node.js oriented, which is server side | 01:39 |
| jamielennox | yea, just wondering if this was something you could offload | 01:39 |
| ayoung | Oh, yeah | 01:40 |
| ayoung | I am just thinking we provide guidance | 01:40 |
| ayoung | I'm really just using my POC to test Keystone. Its nice on a live server | 01:40 |
| ayoung | I used it today to debug the LDAP trusts problem we were seeing | 01:41 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Always add auth URI to unauthorized requests https://review.openstack.org/119261 | 01:41 |
| jamielennox | ok, well i think the plugins work well, but i don't know how you would serialize them in javascript | 01:41 |
| ayoung | hey that is one of yours | 01:41 |
| ayoung | let me show you the start... | 01:41 |
| jamielennox | ayoung: they're slowly going through | 01:41 |
| ayoung | https://github.com/admiyo/keystone-cops/blob/works/keystone.js#L73 | 01:41 |
| ayoung | so I'm doing it with a switch statement there, but you can see the code inside the case statements could grow into a full object | 01:42 |
| ayoung | for instance, if you are doing a project scoped token you use this code https://github.com/admiyo/keystone-cops/blob/works/keystone.js#L27 | 01:43 |
| jamielennox | ayoung: so how do you know what you are getting? | 01:43 |
| ayoung | in that case: it is set by the UI | 01:43 |
| ayoung | here... | 01:43 |
| ayoung | https://keystone.younglogic.net/keystone/cops/ | 01:43 |
| ayoung | see the radio buttons? | 01:43 |
| jamielennox | ye | 01:44 |
| ayoung | those are linked to the $scope.auth_method variable | 01:44 |
| ayoung | onclick sets the variable | 01:44 |
| jamielennox | surely in a real plugin though you would want to change the boxes etc based on the plugin type | 01:44 |
| ayoung | the HTML is Angular specific, but very simple: | 01:44 |
| ayoung | https://github.com/admiyo/keystone-cops/blob/works/index.html#L30 | 01:45 |
| ayoung | yes, and typically you do that by having div tags that you make visible or hidden | 01:45 |
| ayoung | I need to do something comparable in D-O-A, but in server side python | 01:46 |
| *** jorge_munoz has quit IRC | 01:46 | |
| ayoung | I had some problems with the UI toolkit for Angular. I got alerts working, then tried to get tabs working, and the alerts broke | 01:47 |
| ayoung | ideally I'd use tabs and be able to use my POC for a handful of tasks. | 01:47 |
| ayoung | I want to be able to create a trusts. add a role to a user, etc | 01:47 |
| *** jorge_munoz has joined #openstack-keystone | 01:48 | |
| *** jorge_munoz has quit IRC | 01:48 | |
| ayoung | I had the "add arole to a user" working ,but using JQuery. As I said, its not worth bucking the toolkit. Rewrite is simple, but not automatic | 01:48 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Implementing hierarchical calls on keystoneclient v3 (python only) https://review.openstack.org/115770 | 01:50 |
| *** jorge_munoz has joined #openstack-keystone | 01:53 | |
| *** jorge_munoz has quit IRC | 01:54 | |
| jamielennox | morganfainberg: i created the -federation repo review as well: https://review.openstack.org/120670 | 01:56 |
| jamielennox | if we have to copy the history from the current client to the new repo do we need to do that in github rather than via gerrit? | 01:57 |
| jamielennox | ayoung: i can at least look at the D-O-A side | 01:57 |
| *** jorge_munoz has joined #openstack-keystone | 01:58 | |
| *** rodrigods_ has joined #openstack-keystone | 01:59 | |
| rodrigods_ | just reported a bug: https://bugs.launchpad.net/python-keystoneclient/+bug/1367997 . Seems like there are some missing tests for projects and domains at keystoneclient v3 | 01:59 |
| uvirtbot | Launchpad bug 1367997 in python-keystoneclient "Missing some v3 tests for projects and domains" [Undecided,New] | 01:59 |
| jamielennox | so how does horizon handle auth between domains in v3? | 02:03 |
| jamielennox | rodrigods_: there are some basic tests that are done because they inherit utils.CrudTests | 02:06 |
| jamielennox | mostly those files contain 'extra' tests that are specific to just that resource | 02:06 |
| openstackgerrit | wanghong proposed a change to openstack/keystonemiddleware: correct docstring https://review.openstack.org/120333 | 02:13 |
| *** rodrigods_ has quit IRC | 02:14 | |
| *** wanghong has quit IRC | 02:15 | |
| *** diegows has quit IRC | 02:17 | |
| *** wanghong has joined #openstack-keystone | 02:19 | |
| *** hrybacki has joined #openstack-keystone | 02:20 | |
| *** amcrn has quit IRC | 02:22 | |
| *** gokrokve has quit IRC | 02:25 | |
| *** yasukun has joined #openstack-keystone | 02:29 | |
| *** dims_ has quit IRC | 02:49 | |
| *** dims_ has joined #openstack-keystone | 02:49 | |
| *** rushiagr_away is now known as rushiagr | 02:53 | |
| *** dims_ has quit IRC | 02:54 | |
| *** rodrigods_ has joined #openstack-keystone | 03:00 | |
| rodrigods_ | jamielennox, ah, ok... thanks | 03:00 |
| *** rodrigods_ has quit IRC | 03:00 | |
| *** KanagarajM has joined #openstack-keystone | 03:03 | |
| *** hrybacki has quit IRC | 03:08 | |
| *** hrybacki has joined #openstack-keystone | 03:10 | |
| *** hrybacki has quit IRC | 03:13 | |
| *** hrybacki has joined #openstack-keystone | 03:14 | |
| *** rushiagr is now known as rushiagr_away | 03:14 | |
| stevemar | jamielennox, i'm confused about the separate repo's how would we pull in changes? | 03:15 |
| jamielennox | stevemar: why would it be different/ | 03:15 |
| stevemar | jamielennox, err, i mean changes to ksc | 03:16 |
| jamielennox | how would we deprecate the existing federation plugin you mean? | 03:16 |
| stevemar | jamielennox, more like... if i want to use a client for federation, i would download that one right - is it going to depend on python-keystoneclient ? or have it's own basemanager/crud manager framework? | 03:17 |
| stevemar | i'm not seeing how the dots connect in a way that this isn't a maintenance nightmare | 03:18 |
| jamielennox | stevemar: i wasn't expecting the managers to move | 03:19 |
| jamielennox | for example there's no reason you couldn't access OS-FEDERATION routes with a regular token | 03:19 |
| jamielennox | it's mostly auth negotiation | 03:20 |
| jamielennox | at least for now i think it's only the auth plugins we want to move | 03:20 |
| stevemar | jamielennox, hmm OK | 03:21 |
| stevemar | are you looking at this from a 'lets not overload ksc' point of view, or from the infra p.o.v. because lxml was used? | 03:22 |
| jamielennox | stevemar: so kerberos was the initial goal | 03:24 |
| jamielennox | there's no py33 support and other issues that kerberos can't be in keystoneclient direct | 03:24 |
| jamielennox | federation is an extension of the same point | 03:24 |
| jamielennox | lxml is the main reason for now | 03:25 |
| stevemar | jamielennox, to that, won't it be the same issue when we eventually get tempest/gate tests up? | 03:31 |
| jamielennox | stevemar: probably | 03:32 |
| jamielennox | it's just that keystoneclient is a dependency of a lot of thing s | 03:32 |
| jamielennox | all the clients for one | 03:32 |
| jamielennox | and having lxml means it doesn't work with pip for some stuff | 03:32 |
| jamielennox | so long as it's not in the main repo i think it's ok because it'll be the end application that takes the dependency | 03:33 |
| *** jorge_munoz has quit IRC | 03:33 | |
| *** alex_xu has joined #openstack-keystone | 03:36 | |
| stevemar | jamielennox, ah OK, *that* makes more sense | 03:37 |
| stevemar | jamielennox, hopefully we can remove that dependency (and the pysaml2 one in keystone) later on | 03:37 |
| *** rodrigods_ has joined #openstack-keystone | 03:37 | |
| stevemar | since we are generally creating pretty static XML content | 03:37 |
| jamielennox | stevemar: is it creation, i thought it was an issue in reading | 03:38 |
| stevemar | bit of both | 03:38 |
| jamielennox | stevemar: is there a way we can do that now? | 03:39 |
| jamielennox | the lxml bit at least | 03:39 |
| jamielennox | if so there's no rush on the -federation repo | 03:39 |
| jamielennox | it was in addition because it was pretty much the exact same review as -kerberos | 03:40 |
| jamielennox | (though as mentioned the infra guys are keen for lxml removal) | 03:40 |
| *** jorge_munoz has joined #openstack-keystone | 03:40 | |
| stevemar | jamielennox, there's definitely a way, but i don't have the time to look it up and get it done before the 18th | 03:42 |
| jamielennox | morganfainberg was looking into it as well | 03:42 |
| stevemar | well, it's used in whopping 4 places | 03:43 |
| *** RockKuo_Office has quit IRC | 03:43 | |
| jamielennox | yea, but it's doing xpath stuff that the python xml can't handle | 03:43 |
| stevemar | python xml == elementTree i think? | 03:44 |
| jamielennox | not sure | 03:44 |
| *** rodrigods_ has quit IRC | 03:45 | |
| stevemar | seems that way | 03:46 |
| *** RockKuo_Office has joined #openstack-keystone | 03:46 | |
| *** rushiagr_away is now known as rushiagr | 03:46 | |
| jamielennox | stevemar: it will have to happen in client one way or another, just depends whether it's worth splitting out the repo once it's done | 03:49 |
| *** jorge_munoz has quit IRC | 03:52 | |
| jamielennox | stevemar: can i grab an opinion while you're here | 03:55 |
| stevemar | sure | 03:55 |
| jamielennox | https://review.openstack.org/#/c/118004/3/keystoneclient/session.py | 03:55 |
| jamielennox | so i need to handle both redirections and retries in the same code | 03:55 |
| jamielennox | and i think that it's just getting too messy | 03:56 |
| stevemar | ah is this for the stuff that was on the ML | 03:56 |
| jamielennox | like there is an edge case where if a request succeeds on the third retry, then goes for a redirect, then needs to retry again then the intial wait count is already 4 seconds and will start doubling | 03:57 |
| jamielennox | so i have to carry another original_ variable through the recursion | 03:57 |
| jamielennox | stevemar: it's not specifically, i've had this one up for a while | 03:57 |
| jamielennox | it's a major 'feature' of other clients that i can't replicate yet. If they are going to cut new clients and update all requirements files then it would be good to have it in | 03:58 |
| jamielennox | anyway, recursion is getting messy - i don't know if i can do it flat any better | 03:59 |
| jamielennox | can you see a structure that makes sense/ | 03:59 |
| stevemar | jamielennox, it's not too bad as-is tbh | 04:00 |
| stevemar | i see what you mean though, it is getting a bit long and overloaded | 04:00 |
| stevemar | for just a basic _send_request | 04:01 |
| jamielennox | right, the redirects isn't too hard and the retries isn't too hard | 04:02 |
| jamielennox | maybe it's enough just to break those two parts apart | 04:02 |
| *** harlowja is now known as harlowja_away | 04:05 | |
| stevemar | jamielennox, separate handlers for retry and redirects? | 04:05 |
| *** ayoung has quit IRC | 04:05 | |
| stevemar | jamielennox, bknudson is great at this sort of stuff | 04:05 |
| *** henrynash has joined #openstack-keystone | 04:05 | |
| stevemar | helps when your native tongue is a programming language | 04:06 |
| jamielennox | stevemar: i was thinking like an inner and an outer loop - but it still becomes recursive if you are allowed to retry accessing the value from the redirect | 04:06 |
| stevemar | jamielennox, damn, its namespace crap, the python stdlib xml parser craps out if it's <something:tag> | 04:08 |
| stevemar | instead of just <tag> | 04:08 |
| stevemar | which is kind of silly | 04:08 |
| stevemar | ugh, and xpath stuff | 04:12 |
| stevemar | yeah we're not losing this dependency any time soon | 04:12 |
| stevemar | unless we switch to some sort of template, which would be awful | 04:13 |
| stevemar | jamielennox, if you could review this one: https://review.openstack.org/#/c/119834/ that would be awesomeo | 04:14 |
| stevemar | is it possible to run 2 keystone instances on the same machine? | 04:31 |
| *** hrybacki has quit IRC | 04:32 | |
| *** gokrokve has joined #openstack-keystone | 04:37 | |
| *** HenryG is now known as HenryG_zzzz | 04:40 | |
| *** ukalifon has joined #openstack-keystone | 04:40 | |
| jamielennox | stevemar: can't see why not | 04:41 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Version independent plugins https://review.openstack.org/81147 | 04:47 |
| *** wanghong has quit IRC | 04:48 | |
| stevemar | jamielennox, apparently getopt supports --options, but it's installed at the system level | 04:48 |
| stevemar | getopts is available, but only does single character flags :( | 04:49 |
| stevemar | -t test_dir ? | 04:49 |
| jamielennox | stevemar: i looked at it for a few minutes and saw that - at which point i got frustrated and gave up | 04:49 |
| jamielennox | but yea, i think -t is fine | 04:49 |
| jamielennox | better to be optional like that | 04:49 |
| jamielennox | stevemar: in my v2 of that patch i had retries count be absolute | 04:51 |
| jamielennox | so even if it went via redirects it only did so many retries | 04:51 |
| jamielennox | do you think that's better - otherwise you can get redirects * retries attempts | 04:52 |
| stevemar | jamielennox, i think this should work: https://review.openstack.org/#/c/120316/4 | 04:59 |
| stevemar | i'll owe you a review tomorrow, and marek too | 05:00 |
| stevemar | ugh no one has reviewed his adfs stuff https://review.openstack.org/#/c/111771/ | 05:00 |
| *** stevemar has quit IRC | 05:05 | |
| *** RockKuo_Office has quit IRC | 05:05 | |
| *** yasukun has quit IRC | 05:08 | |
| *** yasukun has joined #openstack-keystone | 05:10 | |
| *** yasukun has quit IRC | 05:10 | |
| *** yasukun has joined #openstack-keystone | 05:11 | |
| *** RockKuo_Office has joined #openstack-keystone | 05:22 | |
| *** ajayaa has joined #openstack-keystone | 05:32 | |
| *** bvandenh has joined #openstack-keystone | 05:41 | |
| *** amcrn has joined #openstack-keystone | 05:44 | |
| *** jaosorior has joined #openstack-keystone | 05:46 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 05:51 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make tests run against original client and session https://review.openstack.org/117089 | 05:51 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow retrying some failed requests https://review.openstack.org/118004 | 05:51 |
| *** RockKuo_Office has quit IRC | 05:57 | |
| *** hrybacki has joined #openstack-keystone | 06:00 | |
| *** oomichi_ has joined #openstack-keystone | 06:03 | |
| *** oomichi has quit IRC | 06:05 | |
| *** hrybacki has quit IRC | 06:07 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/120695 | 06:08 |
| *** andreaf has joined #openstack-keystone | 06:13 | |
| *** RockKuo_Office has joined #openstack-keystone | 06:13 | |
| *** gokrokve has quit IRC | 06:28 | |
| *** gokrokve has joined #openstack-keystone | 06:28 | |
| openstackgerrit | Kevin Benton proposed a change to openstack/keystone: Fail on empty userId/username before query https://review.openstack.org/120705 | 06:31 |
| *** gokrokve has quit IRC | 06:33 | |
| *** gokrokve has joined #openstack-keystone | 06:34 | |
| *** k4n0 has joined #openstack-keystone | 06:34 | |
| *** afazekas is now known as __afazekas | 06:34 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: fix typos https://review.openstack.org/119841 | 06:35 |
| *** gokrokve has quit IRC | 06:38 | |
| jaosorior | dolphm: are you around_ | 06:46 |
| jaosorior | ? | 06:46 |
| *** gokrokve has joined #openstack-keystone | 07:04 | |
| *** gokrokve has quit IRC | 07:05 | |
| *** gokrokve has joined #openstack-keystone | 07:06 | |
| openstackgerrit | A change was merged to openstack/identity-api: Updated from global requirements https://review.openstack.org/120635 | 07:06 |
| *** amerine has quit IRC | 07:08 | |
| *** gokrokve has quit IRC | 07:10 | |
| *** ukalifon has quit IRC | 07:23 | |
| *** amcrn has quit IRC | 07:23 | |
| *** yasukun has quit IRC | 07:32 | |
| *** yasukun has joined #openstack-keystone | 07:32 | |
| *** gokrokve has joined #openstack-keystone | 07:34 | |
| *** gokrokve has quit IRC | 07:39 | |
| *** oomichi_ has quit IRC | 07:45 | |
| *** garnav has joined #openstack-keystone | 07:49 | |
| *** ukalifon1 has joined #openstack-keystone | 08:00 | |
| *** afazekas_ has joined #openstack-keystone | 08:05 | |
| *** amerine has joined #openstack-keystone | 08:30 | |
| *** BAKfr has joined #openstack-keystone | 08:31 | |
| *** gokrokve has joined #openstack-keystone | 08:37 | |
| *** gokrokve has quit IRC | 08:41 | |
| *** wanghong has joined #openstack-keystone | 08:46 | |
| *** sunrenjie6 has joined #openstack-keystone | 08:46 | |
| *** andreaf has quit IRC | 08:47 | |
| *** oomichi has joined #openstack-keystone | 08:52 | |
| *** oomichi has quit IRC | 09:10 | |
| *** aix has joined #openstack-keystone | 09:26 | |
| *** Xeye is now known as amakarov | 09:31 | |
| ajayaa | vivekd, https://www.getpostman.com/collections/d929e56a725c54996e01 | 09:33 |
| *** gokrokve has joined #openstack-keystone | 09:34 | |
| *** sunrenjie6 has quit IRC | 09:35 | |
| *** gokrokve has quit IRC | 09:39 | |
| *** dims_ has joined #openstack-keystone | 09:51 | |
| *** dims_ has quit IRC | 10:00 | |
| *** ukalifon1 has quit IRC | 10:01 | |
| *** dims_ has joined #openstack-keystone | 10:01 | |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Add a simple module to work with filters and DNs to LDAP backend https://review.openstack.org/117484 | 10:06 |
| *** dims_ has quit IRC | 10:06 | |
| *** d0ugal has quit IRC | 10:08 | |
| *** d0ugal has joined #openstack-keystone | 10:08 | |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Correct typos in keystone/common/base64utils.py docstrings https://review.openstack.org/119775 | 10:14 |
| *** gokrokve has joined #openstack-keystone | 10:34 | |
| *** gokrokve has quit IRC | 10:39 | |
| *** yasukun has quit IRC | 10:58 | |
| *** rodrigods_ has joined #openstack-keystone | 11:07 | |
| *** dims_ has joined #openstack-keystone | 11:17 | |
| *** f13o has joined #openstack-keystone | 11:19 | |
| openstackgerrit | Yuriy Taraday proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 11:19 |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Add a simple module to work with filters and DNs to LDAP backend https://review.openstack.org/117484 | 11:20 |
| *** rodrigods_ has quit IRC | 11:21 | |
| bjornar | When running keystone under wsgi (master) I am experiencing something odd: /v2.0/tenants return fine, but /v2.0/users return 404 | 11:27 |
| bjornar | Debug is on, but nothing in my logs that can explain this | 11:27 |
| bjornar | forget it. | 11:30 |
| bjornar | Was running both was running as "main" | 11:30 |
| *** dims_ has quit IRC | 11:30 | |
| *** dims_ has joined #openstack-keystone | 11:31 | |
| *** gokrokve has joined #openstack-keystone | 11:34 | |
| *** diegows has joined #openstack-keystone | 11:34 | |
| *** dims__ has joined #openstack-keystone | 11:34 | |
| *** dims_ has quit IRC | 11:35 | |
| *** gokrokve has quit IRC | 11:39 | |
| *** RockKuo_Office has quit IRC | 11:52 | |
| *** andreaf has joined #openstack-keystone | 11:54 | |
| *** hrybacki has joined #openstack-keystone | 12:04 | |
| *** alex_xu has quit IRC | 12:08 | |
| *** hrybacki has quit IRC | 12:10 | |
| *** KanagarajM has quit IRC | 12:17 | |
| *** gokrokve has joined #openstack-keystone | 12:34 | |
| *** gokrokve has quit IRC | 12:39 | |
| *** gordc has joined #openstack-keystone | 12:42 | |
| *** radez_g0n3 is now known as radez | 12:47 | |
| *** dims__ has quit IRC | 12:49 | |
| *** dims_ has joined #openstack-keystone | 12:50 | |
| *** dims_ is now known as dims | 12:51 | |
| *** HenryG_zzzz is now known as HenryG | 12:55 | |
| *** miqui has joined #openstack-keystone | 12:55 | |
| dolphm | anyone looking into testQuotedWWWAuthenticateHeader swift-dsvm-functional failures? | 13:05 |
| *** vhoward has joined #openstack-keystone | 13:09 | |
| *** joesavak has joined #openstack-keystone | 13:11 | |
| *** nkinder has quit IRC | 13:12 | |
| *** Ugallu has joined #openstack-keystone | 13:13 | |
| *** ayoung has joined #openstack-keystone | 13:14 | |
| *** hrybacki has joined #openstack-keystone | 13:18 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:19 | |
| *** amerine_ has joined #openstack-keystone | 13:20 | |
| *** amerine_ has quit IRC | 13:21 | |
| *** richm1 has joined #openstack-keystone | 13:21 | |
| *** amerine_ has joined #openstack-keystone | 13:21 | |
| *** amerine has quit IRC | 13:22 | |
| *** amerine has joined #openstack-keystone | 13:26 | |
| *** amerine_ has quit IRC | 13:28 | |
| *** gokrokve has joined #openstack-keystone | 13:34 | |
| * dolphm keystone, swift & openstack/requirements gates are entirely broken due to bug 1368048 | 13:37 | |
| uvirtbot | Launchpad bug 1368048 in swift "testQuotedWWWAuthenticateHeader date time encoding error" [Undecided,In progress] https://launchpad.net/bugs/1368048 | 13:37 |
| dolphm | jamielennox ^ caused by a change to keystonemiddleware | 13:38 |
| *** gokrokve has quit IRC | 13:39 | |
| *** bknudson has joined #openstack-keystone | 13:46 | |
| *** jorge_munoz has joined #openstack-keystone | 14:07 | |
| dstanek | dolphm: ooh, that's not cool. we are sending two www-authenticate headers now? | 14:12 |
| dolphm | dstanek: yes | 14:12 |
| dolphm | dstanek: there's a change at the front of the gate to land a fix in swift's tests - to handle two headers | 14:12 |
| dolphm | the change in keystone middleware was https://review.openstack.org/#/c/119261/ | 14:13 |
| dstanek | yeah, i'm looking at it now | 14:13 |
| dstanek | that's interesting that we extend the headers in _call_app instead of replace | 14:15 |
| *** hrybacki has quit IRC | 14:16 | |
| *** nkinder has joined #openstack-keystone | 14:16 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/python-keystoneclient: Inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 14:24 |
| *** hrybacki has joined #openstack-keystone | 14:26 | |
| *** stevemar has joined #openstack-keystone | 14:28 | |
| ayoung | dolphm, jamielennox probably asleep, but I can look | 14:28 |
| *** vhoward has left #openstack-keystone | 14:29 | |
| dolphm | ayoung: dstanek: the fix/workaround in swift is about to land (just a couple minutes). i think we just need to take another look at that keystonemiddleware change, and decide if we should reconsider the implementation | 14:30 |
| ayoung | dstanek, its a case of "No good deed goes unpunished" | 14:30 |
| ayoung | he was attempting to do the "more correct" thing, but the tests are too rigid | 14:31 |
| ayoung | dolphm, is it only Swift that needs the fix? | 14:31 |
| dolphm | ayoung: *needs* yes | 14:32 |
| ayoung | dolphm, OK, So if the other services are not broken by it, I'd suggest leaving it | 14:32 |
| *** david-lyle has joined #openstack-keystone | 14:32 | |
| ayoung | otherwise, we risk one of them writing a comparable test to swifts in the future | 14:32 |
| *** alex_xu has joined #openstack-keystone | 14:34 | |
| *** gokrokve has joined #openstack-keystone | 14:34 | |
| *** hrybacki has quit IRC | 14:36 | |
| *** topol has joined #openstack-keystone | 14:38 | |
| *** david-lyle has quit IRC | 14:38 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add characterization test for cleanup role assignments for group https://review.openstack.org/119630 | 14:39 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix delete group cleans up role assignments with LDAP https://review.openstack.org/119631 | 14:39 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix using local ID to clean up user/group assignments https://review.openstack.org/119629 | 14:39 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix LDAP group role assignment listing https://review.openstack.org/119480 | 14:39 |
| *** gokrokve has quit IRC | 14:39 | |
| *** gokrokve has joined #openstack-keystone | 14:41 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add characterization test for cleanup role assignments for group https://review.openstack.org/119630 | 14:46 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix delete group cleans up role assignments with LDAP https://review.openstack.org/119631 | 14:46 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix using local ID to clean up user/group assignments https://review.openstack.org/119629 | 14:46 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix LDAP group role assignment listing https://review.openstack.org/119480 | 14:46 |
| garnav | hi all, quick question. If my model has one column as a JsonBlob should I inherit ModelDictMixin instead of DictBase? | 14:56 |
| garnav | Thanks in advance for any help | 14:56 |
| dolphm | bknudson: conflicted with your own skip test patch? | 14:56 |
| bknudson | dolphm: yes. | 14:56 |
| dstanek | dolphm, ayoung: i would think that having multiple www-authenticate isn't allow and we can quickly change the impl to replace the existing one | 14:57 |
| bknudson | I should add tests in a random location rather than at the end. | 14:57 |
| *** ajayaa has quit IRC | 14:57 | |
| dolphm | bknudson: haha | 14:58 |
| *** jsavak has joined #openstack-keystone | 14:58 | |
| dolphm | garnav: that sounds correct - one of the base classes packs unrecognized attributes into the 'extra' column if you want to support that | 14:59 |
| *** joesavak has quit IRC | 14:59 | |
| ayoung | dstanek, technically we are all in a state of sin here anyway, as we do not provide the actual mechanism. THen again Form based authentication is not an actual mechanism. THen again again putting the cleartext username in the body of a JSON is not really a mechanism either | 15:00 |
| ayoung | What does SAML or OAuth specify? That is closest to what we do. | 15:01 |
| *** k4n0 has quit IRC | 15:01 | |
| *** afazekas_ has quit IRC | 15:03 | |
| ayoung | dstanek, If I make a call to swift with and expired or invalid token, we should have in the URL the Keystone server that issued the token. If the token is missing, Keystone middleware really should make no assumptions about where to redirect the user. It should be 401 "You need a token, got find one" | 15:05 |
| ayoung | I'd like to start breaking the assumption that there is one and only one Keystone server for a given Swift deployment. Sure, that is the only case right now, but it should not be. | 15:06 |
| dstanek | ayoung: but those are different issues - i'm just talking about overloading the header | 15:08 |
| ayoung | dstanek, you used the "J" word | 15:09 |
| ayoung | dstanek, I was talking about the URL put in that header | 15:09 |
| amakarov | nkinder, Greetings! Can you please review my patch about fixing broken extra attribute mapping in LDAP models? https://review.openstack.org/#/c/118590/ | 15:09 |
| ayoung | Swift origianlly hard coded their own scheme in there, which is, if I understand it, what we broken | 15:10 |
| ayoung | amakarov, too scared to ask me to? | 15:10 |
| ayoung | amakarov, please include me on all LDAP related changes. | 15:10 |
| ayoung | but you did...so thanks | 15:11 |
| ayoung | amakarov, did you run your changes against a live LDAP server? If so, which one? | 15:12 |
| dstanek | ayoung: we have to determine which header should be returned. maybe if there is already one we don't add ours? | 15:12 |
| *** cjellick has joined #openstack-keystone | 15:12 | |
| dstanek | sounds like keystone and swift devs need to talk through the usecase | 15:12 |
| amakarov | ayoung, I use devstack - 1 minute - I'll see :) | 15:13 |
| ayoung | dstanek, well, Keystone tokens are the authentication mechanism. The header should be standard | 15:13 |
| ayoung | amakarov, devstack is OpenLDAP | 15:13 |
| amakarov | ayoung, well - it's OpenLDAP :) | 15:14 |
| *** david-lyle has joined #openstack-keystone | 15:15 | |
| dstanek | ayoung: while i agree there, i think i heard somewhere that they want swift usable outside of openstack - if that's the case, does we need to behave a little differently? | 15:15 |
| ayoung | dstanek, that would be Swift without Keystone. So no problem, I think. | 15:15 |
| nkinder | amakarov: taking a look now. It's been on my list, but my list gets growing... | 15:16 |
| dstanek | ayoung: what does the client do when it gets two headers? | 15:16 |
| ayoung | dstanek, I don't think that is legal. So, we need to replace | 15:17 |
| ayoung | nkinder, its too big for Juno | 15:18 |
| nkinder | ayoung: yes, I already have that impression | 15:18 |
| ayoung | amakarov, I like where you are headed with the patch, but we are past feature freeze. Once we have RC1 cut, we will open up the Repo for Kilo contributions. | 15:19 |
| dstanek | ayoung: so my question is whether or not we should replace if it exists all of the time or if we can detect that the 401 is the result of a delayed authz | 15:19 |
| ayoung | In order to do that, you change might just be complex enough to require a Spec. | 15:19 |
| ayoung | dstanek, If they are using Keystone as the Auth mechanism, we should own the Auth header | 15:19 |
| ayoung | if there is one there already....500? | 15:19 |
| ayoung | It really is a misconfiguration | 15:20 |
| *** zzzeek has joined #openstack-keystone | 15:20 | |
| ayoung | dstanek, if there are multiple auth mechanisms supported...I'd have to refresh on what HTTP requires | 15:20 |
| ayoung | amakarov, however, the PTL did tag that one as juno-rc-potential so maybe. Is this primarily for read/write or read/only LDAP? | 15:25 |
| amakarov | ayoung, thank you, can you please direct me what is needed in the project now? It was done before patch about read-only LDAP id, and as far as I understand, does not conflict with it. | 15:27 |
| ayoung | amakarov, read only LDAP is not a patch, it is just the general way LDAP is used. \ | 15:28 |
| ayoung | amakarov, are you using LDAP in read/write mode? | 15:28 |
| amakarov | ayoung, rw | 15:28 |
| ayoung | amakarov, interesting...what' | 15:28 |
| ayoung | s you use case? | 15:29 |
| *** BAKfr has quit IRC | 15:30 | |
| nkinder | amakarov: let me see if I understand what the patch is trying to achieve... | 15:31 |
| nkinder | amakarov: if the LDAP entry does not have an attribute that is listed in an additional mapping, you will log a warning in keystone, right? | 15:31 |
| amakarov | ayoung, initially it was about keystone didn't care about additional attribute mapping | 15:31 |
| ayoung | nkinder, he's trying to be able to write to LDAP where the object classes require more attributes than Keystone will send | 15:31 |
| nkinder | ayoung: hold on, just trying to confirm a few things | 15:32 |
| *** gokrokve_ has joined #openstack-keystone | 15:32 | |
| amakarov | ayoung, warning if LDAP entry does not contain required field | 15:33 |
| nkinder | nkinder: so if you configure a mapping for an allowed (MAY) LDAP attribute, you will likely be encountering warnings. | 15:33 |
| nkinder | talking to myself already... :) | 15:33 |
| nkinder | amakarov: 2 lines up ^^^ | 15:33 |
| ayoung | amakarov, yep | 15:33 |
| amakarov | ayoung, and a had to fall back to it because code depend on such behaviour | 15:33 |
| henrynash | quick python question: is an @property in a class only evaluated once, at class instantiation time? (I’m guessing so) | 15:33 |
| nkinder | amakarov: so you are assuming that additional mappings are really inteded for required (MUST) attributes | 15:34 |
| nkinder | amakarov: so that's the "read from LDAP" part of the change | 15:35 |
| amakarov | ayoung, https://bugs.launchpad.net/keystone/+bug/1336769 this bug describes desired behavior | 15:35 |
| uvirtbot | Launchpad bug 1336769 in keystone "LDAP additional attribute mappings do not care about model attribute" [Low,In progress] | 15:35 |
| *** gokrokve has quit IRC | 15:35 | |
| ayoung | amakarov, desired by whom? Heh. OK, so I think you are trying to make a feature work that never worked, but to the rest of the world, it looks like you are trying to implement a new feature | 15:36 |
| amakarov | And yes - for now i treat additional mapping as MUST HAVE | 15:36 |
| ayoung | I think the "additional attributes" code was from the code base that I inherited | 15:36 |
| ayoung | the parentage is something like this | 15:36 |
| nkinder | amakarov: so the real purpose for the mappings as I see if is for user creation | 15:36 |
| nkinder | if you are adding a user to keystone, you configure additional mappings to satisfy LDAP required attribute | 15:37 |
| *** gyee has joined #openstack-keystone | 15:37 | |
| amakarov | nkinder, yes, I didn't see usage of this feature besides user description feild :) | 15:37 |
| ayoung | Nova (pre Keystone) had LDAP support, then someone split out Keystone, and stole the code from Nova. THen termie rewrote Keystone and didn't put LDAP support in there. Then I used the LDAP code from the old code base for the Keystone rewrite. | 15:37 |
| nkinder | if you don't do this, your LDAP add operations would fail with objectclass violations | 15:37 |
| ayoung | I don't think the additional attributes were ever tested, and so I cannot say that they ever worked | 15:37 |
| nkinder | amakarov: so you are trying to pre-validate the entries on the Keystone side based off of the mappings to return a nice error message | 15:38 |
| amakarov | nkinder, yes | 15:38 |
| nkinder | amakarov: the alternative is that we just send off the entry to LDAP and let it reject it | 15:38 |
| *** henrynash has quit IRC | 15:39 | |
| nkinder | amakarov: isn't the latter what happens now? | 15:39 |
| amakarov | nkinder, actually I didn't check it | 15:39 |
| nkinder | amakarov: ok, so a few things | 15:40 |
| *** david-lyle has quit IRC | 15:40 | |
| nkinder | 1 - this is a bug to do more validation on the Keystone side. I expect that the LDAP operation would fail today though, so all we're really getting is improved error messages. | 15:41 |
| amakarov | nkinder, agreed | 15:41 |
| nkinder | 2 - this really only pertains to read-write LDAP, which isn't really the target use-case for Keystone's LDAP backend | 15:41 |
| nkinder | amakarov: That doesn't mean it's not valuable though :) | 15:42 |
| ayoung | amakarov, which is why I asked "why do you want this?:" | 15:42 |
| ayoung | because if we are going to push for read/write enahncements, we need justification | 15:42 |
| *** jimhoagland has joined #openstack-keystone | 15:42 | |
| nkinder | amakarov: LDAP is really thought of as read-only, as the idea is that many people have all of their users/credentials already in an LDAP server and they just want Keystone to use them | 15:42 |
| nkinder | Keystone shouldn't be a user provisioning tool for LDAP | 15:42 |
| nkinder | It *can* be used for that (sort of), but that's simply because of the way that Keystone evolved. | 15:43 |
| ayoung | nkinder, I disagree. | 15:43 |
| nkinder | My feeling is that read-write LDAP in Keystone is an evolutionary dead-end | 15:44 |
| nkinder | ayoung: how so? | 15:44 |
| ayoung | nkinder, we know of at least two major Keystone deployments that go Read write | 15:44 |
| ayoung | Rackspace and CERN both have some read/write in LDAp | 15:44 |
| nkinder | ayoung: sure, I know that it is being used | 15:44 |
| nkinder | that doesn't mean it's ideal | 15:44 |
| ayoung | nkinder, its better than SQL | 15:44 |
| ayoung | that was what I was talking about before | 15:45 |
| amakarov | nkinder, following bug description there should be some feedback from client about wrong data from server | 15:45 |
| ayoung | LDAP has things like Password rotation and all that, but we need a way to do user capture | 15:45 |
| amakarov | and now all works without a warning | 15:45 |
| *** jimhoagland has left #openstack-keystone | 15:45 | |
| nkinder | amakarov: I think that's because the mapping was really only considered for write operations | 15:45 |
| nkinder | amakarov: keystone really doesn't care if we read back an additional mapped attribute, because it never uses them | 15:46 |
| *** bvandenh has quit IRC | 15:46 | |
| nkinder | amakarov: it's really only intended for having a way to fill in those attributes when a user is created in LDAP via Keystone | 15:46 |
| amakarov | nkinder, what if we expect an additional attribute from LDAP but never get it? | 15:46 |
| ayoung | amakarov, like what? | 15:46 |
| nkinder | amakarov: what do we do with the retrieved attribute? | 15:46 |
| *** david-lyle has joined #openstack-keystone | 15:46 | |
| nkinder | amakarov: I think the answer is we never even look at it | 15:47 |
| nkinder | amakarov: res->model doesn't need to look at additional mappings | 15:47 |
| amakarov | nkinder, well, I agree ) | 15:47 |
| nkinder | amakarov: model->res needs to fill them in so LDAP doesn't blow up with an objectclass violation | 15:47 |
| ayoung | amakarov, why do you even care? | 15:48 |
| amakarov | ayoung, good question ) | 15:49 |
| ayoung | amakarov, http://adam.younglogic.com/2014/09/three-types-of-keystone-users/ is how I am thinking about things. But the SQL backend has some limitations, and I want to see the potential for an increased role in REad/Write LDAP. | 15:50 |
| ayoung | So when I see things like this, I pay attention | 15:51 |
| *** arunkant_work has joined #openstack-keystone | 15:51 | |
| amakarov | ayoung, if so we just need all this LDAP backend to read from existing databases and all data bindings are made during deployment? | 15:52 |
| ayoung | amakarov, huh? | 15:52 |
| amakarov | ayoung, and we expect data structure to be immutable | 15:52 |
| ayoung | amakarov, that is the Enterprise use case, yes | 15:53 |
| ayoung | and I would say that most universities fall into that category, too | 15:53 |
| amakarov | ayoung, I'm trying to catch the purpose of the component ) | 15:53 |
| ayoung | amakarov, #1 usage is to read from Corporate LDAP | 15:53 |
| ayoung | and in those cases, LDAP is read only | 15:53 |
| amakarov | ayoung, got it | 15:54 |
| ayoung | amakarov, Assignments and Identity used to be housed in a single backend | 15:54 |
| ayoung | and it wasn't until we split them could we stop writing to LDAP | 15:54 |
| ayoung | so you see a lot of vestiges from that time...and of course, some people are still running with those vestiges | 15:54 |
| amakarov | ayoung, so r/w mode is deprecated or "to be continued" ) | 15:55 |
| amakarov | ? | 15:55 |
| ayoung | amakarov, lets say "to be determined" | 15:55 |
| ayoung | amakarov, I think it stands like this: | 15:56 |
| ayoung | for REad Only use cases, LDAP as it is designed is sufficient (if clunky) | 15:56 |
| ayoung | for Read/Write use case it needs some more work. | 15:56 |
| amakarov | ayoung, thanks for information. So what to do with the patch? | 15:58 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/python-keystoneclient: Inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 15:59 |
| amakarov | ayoung, I can replace errors with warnings logging | 15:59 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/python-keystoneclient: Inherited project role grants on keystoneclient v3 https://review.openstack.org/120822 | 15:59 |
| *** wwriverrat has joined #openstack-keystone | 16:04 | |
| *** jsavak has quit IRC | 16:05 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/python-keystoneclient: Inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 16:09 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/python-keystoneclient: Inherited project role grants on keystoneclient v3 https://review.openstack.org/120822 | 16:09 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Use oslo_debug_helper and remove our own version https://review.openstack.org/120104 | 16:18 |
| *** marcoemorais has joined #openstack-keystone | 16:20 | |
| *** garnav has quit IRC | 16:20 | |
| *** rushiagr is now known as rushiagr_away | 16:21 | |
| *** diegows has quit IRC | 16:22 | |
| *** rwsu has quit IRC | 16:24 | |
| *** rwsu has joined #openstack-keystone | 16:29 | |
| *** bjornar_ has joined #openstack-keystone | 16:33 | |
| *** rwsu has quit IRC | 16:33 | |
| *** rwsu has joined #openstack-keystone | 16:35 | |
| *** r-daneel has joined #openstack-keystone | 16:45 | |
| *** wanghong has quit IRC | 16:46 | |
| *** rushiagr_away is now known as rushiagr | 16:46 | |
| openstackgerrit | A change was merged to openstack/keystone: Document mod_wsgi doesn't support chunked encoding https://review.openstack.org/120274 | 16:50 |
| *** amakarov has quit IRC | 16:54 | |
| *** aix has quit IRC | 16:55 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:59 | |
| *** nkinder_ has joined #openstack-keystone | 17:03 | |
| *** rkofman has quit IRC | 17:05 | |
| *** rkofman has joined #openstack-keystone | 17:06 | |
| *** nkinder has quit IRC | 17:07 | |
| *** alex_xu has quit IRC | 17:09 | |
| *** harlowja_away is now known as harlowja | 17:09 | |
| *** Guest55717 has joined #openstack-keystone | 17:10 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 17:14 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/119142 | 17:15 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/116255 | 17:20 |
| stevemar | dolphm, ping | 17:22 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings validation https://review.openstack.org/118590 | 17:23 |
| *** amakarov has joined #openstack-keystone | 17:27 | |
| *** amakarov is now known as amakarov_away | 17:27 | |
| *** joesavak has joined #openstack-keystone | 17:38 | |
| morgan_remote | Hmm | 17:40 |
| *** openstackgerrit has quit IRC | 17:46 | |
| *** openstackgerrit has joined #openstack-keystone | 17:46 | |
| stevemar | gordc, commented | 17:47 |
| *** portante has quit IRC | 17:51 | |
| *** portante has joined #openstack-keystone | 17:55 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone-specs: Add log translation hints for keystone https://review.openstack.org/105954 | 17:59 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone-specs: Add log translation hints for Keystone https://review.openstack.org/105954 | 18:00 |
| dolphm | stevemar: o/ | 18:01 |
| stevemar | dolphm, you're too late, you're dead to me now | 18:02 |
| morganfainberg | dolphm, no respect man. no respect. | 18:02 |
| dolphm | morganfainberg: my lunch was worth it. | 18:02 |
| stevemar | morganfainberg, i wonder what his excuse will be this time? lunch? food? | 18:02 |
| stevemar | ah ha! | 18:02 |
| morganfainberg | dolphm, a good lunch is always worth it | 18:03 |
| stevemar | dolphm, i was going to say that gordc wanted the role_assignment event name flipped around for consistency | 18:03 |
| dolphm | stevemar: use a different attribute? | 18:04 |
| stevemar | dolphm, but if you recall, cadf has a strict naming convention for their 'action' value, it had to begin with 'create' | 18:04 |
| stevemar | dolphm, the non-cadf events are emitted like: identity.users.created | 18:04 |
| dolphm | stevemar: yeah | 18:04 |
| stevemar | dolphm, but for role_assignments, it's identity.created.role_assignment | 18:04 |
| stevemar | gordc, was asking why the flip | 18:05 |
| stevemar | the answer (i forgot at the time, hence the ping) is cadf's 'action' value has to start with a valid set of words | 18:05 |
| gordc | why you calling me out for. | 18:05 |
| stevemar | gordc, to throw you right under the bus | 18:06 |
| gordc | fair enough | 18:06 |
| *** marcoemorais has quit IRC | 18:06 | |
| *** marcoemorais has joined #openstack-keystone | 18:06 | |
| stevemar | haha, it was a valid question/comment on the review, i couldn't remember why initially | 18:06 |
| dolphm | stevemar: so what's the action we're using for assignments? | 18:06 |
| *** marcoemorais has quit IRC | 18:06 | |
| stevemar | dolphm, action is "created.role_assignment" and the event_type is "identity.created.role_assignment" | 18:07 |
| stevemar | we used the convention of prefixing the action with "identity" for the event_type | 18:07 |
| *** marcoemorais has joined #openstack-keystone | 18:07 | |
| gordc | just to be clear. i'd prefer all the meters be 'identity.<target>.<action>' or 'identity.<action>.<target>' | 18:07 |
| gordc | i think right now there's a mix of both proposed. | 18:07 |
| *** marcoemorais has quit IRC | 18:08 | |
| morganfainberg | ooh are we throwing people under busses today? | 18:08 |
| morganfainberg | stevemar, ^ | 18:08 |
| *** marcoemorais has joined #openstack-keystone | 18:08 | |
| stevemar | gordc, you need to xor that statement | 18:08 |
| * lbragstad raises hand to be the bus driver... | 18:08 | |
| *** rushiagr is now known as rushiagr_away | 18:09 | |
| morganfainberg | lbragstad, knew it! | 18:09 |
| * gordc will be thrower. | 18:09 | |
| dolphm | stevemar volunteers to be throwee. | 18:09 |
| gordc | stevemar: yeah... xor... if you want to get all technically about it. | 18:09 |
| dolphm | gordc: so which of those do you prefer? | 18:09 |
| dolphm | gordc: or we already have both in use anyway? | 18:09 |
| * lbragstad thinks throwee lines starts behind stevemar | 18:10 | |
| stevemar | dolphm, the following meters: | 18:10 |
| dolphm | gordc: topics normally get more specific, so <target>.<action> makes more sense to me | 18:10 |
| gordc | dolphm: we have the former checked in right now... | 18:10 |
| stevemar | dolphm, http://docs-draft.openstack.org/01/119601/3/check/gate-ceilometer-docs/40363ef/doc/build/html/measurements.html#identity-keystone | 18:10 |
| gordc | dolphm: so the one that makes more sense to you. | 18:10 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:11 | |
| gordc | dolphm: i'd prefer the same naming scheme... but i'm pretty indifferent ultimately. | 18:12 |
| stevemar | gordc, i could just change the meter name, without changing they keystone code right? | 18:12 |
| gordc | stevemar: yep. | 18:12 |
| gordc | stevemar: whether you want to change keystone code is up to you guys. | 18:12 |
| stevemar | gordc, i'd have to split the 'action' value, and then re-construct it | 18:13 |
| *** rushiagr_away is now known as rushiagr | 18:14 | |
| stevemar | but i think other places do that already? | 18:14 |
| dolphm | stevemar: split by dots? | 18:14 |
| stevemar | yep | 18:14 |
| gordc | stevemar: maybe? the meter name isn't really based on message event_type... although they are often similar. | 18:14 |
| dolphm | stevemar: open an RC bug and let's fix it in keystone | 18:15 |
| *** henrynash has joined #openstack-keystone | 18:15 | |
| stevemar | dolphm, whats the fix then? change the event_type but not the action? | 18:15 |
| stevemar | dolphm, https://github.com/openstack/keystone/blob/master/keystone/notifications.py#L445-L447 | 18:16 |
| stevemar | we always just prefix identity. to the action | 18:16 |
| dolphm | stevemar: well you've convinced me the event_type is wrong in keystone... so change both? | 18:16 |
| stevemar | dolphm, we can't change both, because 'action' *has* to start with 'create' | 18:17 |
| stevemar | cause of the cadf spec | 18:17 |
| morganfainberg | dolphm, is this https://bugs.launchpad.net/keystone/+bug/1362245 just an identity-api change? | 18:17 |
| uvirtbot | Launchpad bug 1362245 in openstack-api-site "Update Endpoint Filter APIs" [Undecided,New] | 18:17 |
| morganfainberg | oh oh no now i see it | 18:18 |
| stevemar | the best we could do in keystone, is has event_type be correct 'identity.role_assignemnt.created', and then have action be 'created.role_assignment' | 18:18 |
| stevemar | which is kinda silly, cause now we are flipping things around | 18:18 |
| morganfainberg | ayoung, ping re: https://bugs.launchpad.net/keystone/+bug/1361422 it's assigned to you and based on your comment not sure if there is anything we should be doing? if we aren't doing anything... is it incomplete or invaid / still a J-RC target? | 18:19 |
| uvirtbot | Launchpad bug 1361422 in keystone "When using Keystone API v3, catalog won't be returned" [High,Incomplete] | 18:19 |
| dolphm | stevemar: bah. let me look at the code. so event_type="identity.role_assignment.created" and action="created.role_assignment" is ideal, right? | 18:19 |
| stevemar | dolphm, yes | 18:19 |
| dolphm | as i scroll back down and see you typed the same thing | 18:19 |
| stevemar | dolphm, that'll fix the problem, but it'll be inconsistent to us now, instead of ceilometer | 18:20 |
| ayoung | morganfainberg, looking | 18:20 |
| dstanek | henrynash: have you started to hack on https://bugs.launchpad.net/keystone/+bug/1217017 ? i'm curious to know what you came up with | 18:20 |
| uvirtbot | Launchpad bug 1217017 in keystone "dependency injection fails to init domain-specific identity drivers" [Medium,New] | 18:20 |
| dolphm | morganfainberg: yeah it's just applying a low-priority convention we sort of missed in the api review | 18:20 |
| ayoung | morganfainberg, I don't think it is a bug. | 18:20 |
| morganfainberg | ayoung, lets make a call because if it isn't a bug we should punt it from RC1 | 18:20 |
| ayoung | I am not sure why dolphm assigned it to me, but I don't think there is anything to do there | 18:21 |
| ayoung | morganfainberg, bump it | 18:21 |
| dolphm | ayoung: which one? | 18:21 |
| ayoung | dolphm, https://bugs.launchpad.net/keystone/+bug/1361422 | 18:21 |
| uvirtbot | Launchpad bug 1361422 in keystone "When using Keystone API v3, catalog won't be returned" [High,Incomplete] | 18:21 |
| morganfainberg | go uvirtbot go uvirtbot go! | 18:21 |
| morganfainberg | :) | 18:21 |
| gordc | stevemar: why do you have outcome in event_type anyways? seems different to how the authenticate messages are sent. | 18:22 |
| dolphm | ayoung: that was meeting day... but i don't recall | 18:22 |
| ayoung | dolphm, I suspect that you assigned it to me after seeing my comment, thinking I was going to run with it. ALthough your assignment is somehow put before my comment, so maybe you had some other reason. | 18:22 |
| henrynash | dstanek: yep, currently working on it | 18:22 |
| dolphm | ayoung: 18:08:14 <ayoung> https://bugs.launchpad.net/bugs/1361422 is the only incomplete . I can take a look at triaging it | 18:22 |
| uvirtbot | Launchpad bug 1361422 in keystone "When using Keystone API v3, catalog won't be returned" [High,Incomplete] | 18:23 |
| stevemar | gordc, outcome is success or fail right? not create/delete | 18:23 |
| henrynash | dtsanek: ran into a few issues with unit test, which I am debugging | 18:23 |
| dolphm | ayoung: source- http://eavesdrop.openstack.org/meetings/keystone/2014/keystone.2014-09-09-18.02.log.html | 18:23 |
| morganfainberg | lol | 18:23 |
| ayoung | dolphm, I think they are using LDAP and don't hae a default user | 18:23 |
| stevemar | gordc, the authN events are special | 18:23 |
| ayoung | dolphm, ah right...yeah...so not abug...unless they come back with more info | 18:24 |
| ayoung | bump from rc1 | 18:24 |
| dolphm | ayoung: your answer is reasonable enough to drop from RC1 | 18:24 |
| ayoung | ++ | 18:24 |
| dstanek | henrynash: if the section is defined for a domain are you forcing all settings to come from that section or do you fallback to the global section? | 18:24 |
| gordc | stevemar: you're special | 18:24 |
| henrynash | dtsanek: I think teh way I wrote the original code was the the items in the domain specific configs are overrides to that in the main config | 18:25 |
| * gordc drops his mic | 18:25 | |
| stevemar | gordc, stay class up in here | 18:25 |
| * morganfainberg pics the mic up and hands it back to gordc, ' i think you dropped this' | 18:25 | |
| gordc | lol | 18:25 |
| gordc | biab. going to grab some coffee.. | 18:26 |
| henrynash | dtsanek: so you could have the [database] in the global conig, and the driver setting in the domain specifc conffig file | 18:26 |
| *** topol has quit IRC | 18:26 | |
| samuelmz | henrynash, we have a new patch set on 'Improve list role assignments filters performance' (https://review.openstack.org/#/c/116682/) | 18:27 |
| *** mikedillion has joined #openstack-keystone | 18:27 | |
| henrynash | samuelmz: ok, will try and take a look later | 18:27 |
| samuelmz | henrynash, now we consider assignment type when retrieving them | 18:27 |
| samuelmz | henrynash, ok thanks :-) | 18:27 |
| *** mikedillion has quit IRC | 18:30 | |
| *** amcrn has joined #openstack-keystone | 18:32 | |
| *** marcoemorais has quit IRC | 18:32 | |
| *** marcoemorais has joined #openstack-keystone | 18:33 | |
| dolphm | bknudson: was your -2 on https://review.openstack.org/#/c/116374/ based on https://bugs.launchpad.net/keystone/+bug/1315049/comments/1 ? | 18:33 |
| uvirtbot | Launchpad bug 1315049 in keystone "'Provider' object has no attribute 'revoke_api'" [Medium,In progress] | 18:33 |
| dolphm | nonameentername: o/ does your fix address the issue in stable/icehouse? | 18:34 |
| dolphm | regarding the bug above | 18:35 |
| *** ajayaa has joined #openstack-keystone | 18:37 | |
| bknudson | dolphm: yes. I tried it myself and master isn't affected. | 18:37 |
| *** marcoemorais has quit IRC | 18:37 | |
| bknudson | dolphm: so no fix is needed in master | 18:37 |
| *** marcoemorais has joined #openstack-keystone | 18:38 | |
| bknudson | dolphm: unless there's actually a different problem? | 18:38 |
| morganfainberg | bknudson, master isn't affected because i think we enabled revoke by default | 18:38 |
| morganfainberg | bknudson, if someone disabled revoke they would possibly hit that? | 18:39 |
| dolphm | morganfainberg: good question... | 18:39 |
| bknudson | morganfainberg: I tried removing revoke from the pipeline and didn't have any problems. | 18:39 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: SAML2 federated authentication for ADFS. https://review.openstack.org/111771 | 18:39 |
| dolphm | bknudson: isn't there an enable/disable config option too? | 18:39 |
| dolphm | bknudson: OS-REVOKE isn't a real extension | 18:39 |
| morganfainberg | bknudson, hmm. ok. wonder if revoke_api is still getting loaded even w/o the pipeline | 18:39 |
| *** Ugallu has quit IRC | 18:39 | |
| dstanek | morganfainberg: i believe you are correct - it will break if disabled | 18:39 |
| morganfainberg | dstanek, which means other optionals could in theory break. | 18:40 |
| dolphm | bknudson: is the fix correct for stable/icehouse? | 18:40 |
| dstanek | morganfainberg: i think so | 18:40 |
| bknudson | dolphm: the fix in master? there's no problem in master currently so it must have been fixed by some other change. | 18:40 |
| bknudson | dstanek: why would it break if disabled? | 18:41 |
| bknudson | I tried it and didn't have a problem. | 18:41 |
| bknudson | I didn't do a whole lot of testing, though. | 18:41 |
| dstanek | bknudson: there is code that checks for optional behavior by doing 'if self.some_optional_api' | 18:42 |
| dstanek | bknudson: and we don't have defaults on the classes | 18:42 |
| *** wanghong has joined #openstack-keystone | 18:42 | |
| dolphm | bknudson: backport policy for stable branches is to try to land the fix in master first -- a clean cherry pick to stable/icehouse fixes the issue there, and i don't see any harm in it existing in master (although, I agree, I'd like to see some benefit in master to land it) | 18:42 |
| bknudson | dstanek: the dependency code will inject a some_optional_api. | 18:42 |
| bknudson | some_optional_api = None | 18:43 |
| dstanek | bknudson: only if it is configured to be on - the fix is to set it to be None if it's not | 18:43 |
| dolphm | dstanek: configured to be on == keystone.conf os_revoke_enabled = True or something? | 18:43 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/dependency.py#n238 | 18:44 |
| bknudson | "Resolve optional dependencies, sets the attribute to None if there's no provider registered" | 18:44 |
| dolphm | bknudson: but the new test fails without the fix | 18:44 |
| dolphm | bknudson: so, something must be broken about that claim? | 18:45 |
| bknudson | dolphm: that's entirely possible. | 18:45 |
| dstanek | bknudson: i don't think it works as intended then :-) | 18:45 |
| dolphm | bknudson: *should* the test run successfully as written on master? | 18:45 |
| dolphm | without a fix | 18:45 |
| bknudson | dolphm: so the new test does dependency.resolve_future_dependencies(provider_name='some_provider') | 18:46 |
| bknudson | which is the same test as the one just above it: def test_optional_dependency_not_provided(self) | 18:46 |
| bknudson | except it calls with provider_name. | 18:46 |
| bknudson | when the server starts, it calls dependency.resolve_future_dependencies() | 18:46 |
| bknudson | so that's where the user._api = None would happen | 18:47 |
| bknudson | so if there's a bug it's the server is failing to call dependency.resolve_future_dependencies() | 18:47 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/bin/keystone-all#n151 | 18:48 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/httpd/keystone.py#n61 | 18:48 |
| dolphm | bknudson: so, tests maybe aren't calling that? | 18:48 |
| bknudson | the tests are calling it.... | 18:48 |
| dolphm | since, as far as we know, this is only an issue with $ nosetests keystone/tests/test_auth.py | 18:48 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/core.py#n509 | 18:48 |
| dolphm | bknudson: the tests are calling it in stable/icehouse? | 18:49 |
| bknudson | maybe in icehouse there was a problem? | 18:49 |
| dolphm | bknudson: five tests fail in stable/icehouse without the patch | 18:49 |
| morganfainberg | dolphm, land in master, backport, revert in master :P >.> i mean... | 18:49 |
| dolphm | lol | 18:49 |
| bknudson | looks the same in icehouse.. | 18:50 |
| stevemar | oh gawd the gate, some changes have been in there for 28 hrs now | 18:51 |
| stevemar | this is worse than last day of FF | 18:51 |
| ekarlso- | gate flooding :p | 18:51 |
| bknudson | I get FAILED (errors=37) in stable/icehouse | 18:52 |
| dolphm | bknudson: the failing tests do seem to call resolve_future_dependencies() | 18:52 |
| gordc | stevemar: my change took 30hrs to merge... | 18:52 |
| *** henrynash has quit IRC | 18:52 | |
| gordc | i would've smashed things if i needed a recheck. | 18:53 |
| dolphm | my counter stops counting at 24 hours | 18:53 |
| bknudson | dolphm: one thing to note is that resolve_future_dependencies has to be called after all the backends are loaded... so that might be the issue | 18:53 |
| stevemar | gordc, average is 5 rechecks now | 18:53 |
| stevemar | i think | 18:53 |
| stevemar | 4-5 | 18:53 |
| *** __afazekas is now known as afazekas | 18:53 | |
| gordc | stevemar: 4-5 new computers per patch then. | 18:53 |
| bknudson | I ran nosetests in ~/dev/keystone-icehouse and now only 5 errors. | 18:54 |
| gordc | stevemar: back to before i dropped my mic, yes, outcome is success/failure/pending | 18:54 |
| dolphm | bknudson: now you're onto something... | 18:54 |
| dolphm | bknudson: there's no revoke_api in the drivers list when resolve_future_dependencies() is called in stable/icehouse keystone/tests/core.py | 18:54 |
| stevemar | gordc, so the fact that we have create/delete in the event_type is fine | 18:55 |
| gordc | stevemar: yeah... i'm trying to think of another place but nothing comes to mind. | 18:56 |
| bknudson | dolphm: if there's no revoke_api in the drivers list then the requirer's revoke_api should get set to None. | 18:56 |
| dolphm | bknudson: oh damn | 18:56 |
| lbragstad | bknudson: so I rebased on your patch (https://review.openstack.org/#/c/119629/) and tried what you suggested, calling self.identity_api.driver.delete_user(user_id), however the user assignment is still being removed | 18:58 |
| bknudson | lbragstad: in sql? | 18:59 |
| bknudson | lbragstad: or ldap? | 18:59 |
| lbragstad | bknudson: sql | 18:59 |
| bknudson | lbragstad: maybe there's a foreign key? | 19:00 |
| lbragstad | bknudson: that's what i was thinking... | 19:00 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Pass kwargs to auth plugins https://review.openstack.org/120883 | 19:00 |
| *** rushiagr is now known as rushiagr_away | 19:00 | |
| *** henrynash has joined #openstack-keystone | 19:00 | |
| *** ajayaa has quit IRC | 19:01 | |
| *** gokrokve has joined #openstack-keystone | 19:01 | |
| stevemar | gordc, also, review this guy: https://review.openstack.org/#/c/120106/ super easy :D | 19:02 |
| bknudson | dolphm: p self.token_provider_api.revoke_api -> None | 19:02 |
| bknudson | that's in tests.core load_backends() | 19:02 |
| dolphm | ?! | 19:02 |
| bknudson | p self.token_provider_api.revoke_api | 19:03 |
| bknudson | then in the check_revocation_v2() test it's not set. | 19:03 |
| bknudson | so it token_provider_api is getting reset? | 19:03 |
| dolphm | bknudson: i don't see that anywhere | 19:03 |
| *** henrynash has quit IRC | 19:04 | |
| dolphm | bknudson: i'm looking at load_backends in both icehouse and master..? | 19:04 |
| *** russellb has quit IRC | 19:05 | |
| bknudson | dolphm: it's in AuthTest setUp, it does token.provider.Manager() | 19:05 |
| *** gokrokve_ has quit IRC | 19:05 | |
| stevemar | gordc, and this one too :D https://review.openstack.org/#/c/120884/1 | 19:06 |
| bknudson | dolphm: http://git.openstack.org/cgit/openstack/keystone/commit/keystone/tests/test_auth.py?id=0a1cb0e20247a3c7856b409452b01ad6db8069f0 | 19:06 |
| *** gokrokve has quit IRC | 19:06 | |
| gordc | stevemar: i decide what's super easy! | 19:06 |
| *** dtroyer has quit IRC | 19:06 | |
| *** adam_g has quit IRC | 19:06 | |
| bknudson | dolphm: I blame morganfainberg and morgan_remote | 19:07 |
| *** russellb has joined #openstack-keystone | 19:07 | |
| dolphm | bknudson: oh, gotcha | 19:07 |
| *** lbragstad has quit IRC | 19:07 | |
| gordc | stevemar: have you tried running subset of tests using debug_helper? i think it broke at some point when we merged oslotest | 19:07 |
| gordc | does it work for you? | 19:07 |
| bknudson | dolphm: I've wanted to put a check in dependency to raise if it's setting a provider multiple times. | 19:07 |
| dolphm | how do you do a reverse git blame / figure out when a line of code that existed was deleted? | 19:07 |
| dstanek | dolphm, bknudson: the problem with that test is that it doesn't have a @provide anywhere | 19:07 |
| dstanek | so resolve_future_dependencies isn't called | 19:08 |
| stevemar | gordc, whatcha mean? like specifying a test? | 19:08 |
| *** henrynash has joined #openstack-keystone | 19:08 | |
| *** henrynash has quit IRC | 19:08 | |
| bknudson | dolphm: that's my secret... actually I just did a git log and search for manager | 19:08 |
| *** dtroyer has joined #openstack-keystone | 19:08 | |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/log/keystone/tests/test_auth.py | 19:08 |
| bknudson | CTRL+F manager | 19:08 |
| gordc | stevemar: yeah... i haven't tried it with purely oslotests but i think when we merged oslotests and had debug_helper still in ceilometer, i couldn't run a subset of tests. | 19:09 |
| gordc | stevemar: i've no idea if they're related... i just know at some point after i merged original debug_helper patch, it stopped working. | 19:09 |
| bknudson | luckily morganfainberg picks useful commit summary | 19:09 |
| stevemar | gordc, thats weird, i tried it out in keystone and it's fine | 19:09 |
| morganfainberg | bknudson, hmm? | 19:10 |
| stevemar | gordc, in ceilometer there is a weird step that builds virtualenv, maybe thats why | 19:10 |
| gordc | stevemar: cool cool. i'll give it a try agian later... maybe just my environment... or some other weird step i need to figure out. | 19:10 |
| *** hockeynut has quit IRC | 19:10 | |
| *** lbragstad has joined #openstack-keystone | 19:10 | |
| gordc | stevemar: maybe | 19:10 |
| stevemar | gordc, you're gonna have to nuke your debug env in .tox | 19:10 |
| bknudson | morganfainberg: you fixed https://bugs.launchpad.net/keystone/+bug/1315049 with https://bugs.launchpad.net/keystone/+bug/1294994 | 19:10 |
| uvirtbot | Launchpad bug 1315049 in keystone "'Provider' object has no attribute 'revoke_api'" [Medium,In progress] | 19:10 |
| bknudson | in master | 19:10 |
| morganfainberg | bknudson, ahhhh | 19:10 |
| morganfainberg | bknudson, good to know! :) | 19:10 |
| *** d34dh0r53 has quit IRC | 19:11 | |
| dolphm | bknudson: https://review.openstack.org/#/c/120886/ | 19:11 |
| gordc | stevemar: yeah. i tried that... i just gave up and just ran it outside of tox. | 19:11 |
| *** d34dh0r53 has joined #openstack-keystone | 19:11 | |
| morganfainberg | bknudson, oh god that stuff. yeah that was awful | 19:11 |
| gordc | i'll look at it later. | 19:11 |
| stevemar | gordc, cool - whats this stuff do? bash -x {toxinidir}/setup-test-env.sh | 19:11 |
| dolphm | nosetests keystone/tests/test_auth.py runs successfully in stable/icehouse with that ^ but leaving it as WIP until tox finishes | 19:12 |
| gordc | stevemar: configures dbs for backend tests mostly | 19:12 |
| dolphm | bknudson: thanks for the patch :) | 19:12 |
| *** hockeynut has joined #openstack-keystone | 19:12 | |
| *** Ephur has quit IRC | 19:13 | |
| bknudson | dolphm: np | 19:13 |
| stevemar | gordc, just confirms it still works with master, trying my patch now to make sure | 19:14 |
| *** Guest75250 has quit IRC | 19:14 | |
| lbragstad | bknudson: looking at the keystone database and I'm nothings jumping out, no foreign keys between user and assignment or user and role tables, | 19:15 |
| lbragstad | the assignment and role tables have a foreign key reference | 19:15 |
| bknudson | lbragstad: use the debugger and see where it's getting deleted. | 19:15 |
| gordc | stevemar: in ceilometer? | 19:15 |
| *** Ephur has joined #openstack-keystone | 19:15 | |
| *** russellb has quit IRC | 19:15 | |
| stevemar | gordc, yep | 19:15 |
| gordc | well that sucks. | 19:15 |
| *** dolphm has quit IRC | 19:16 | |
| *** dtroyer has quit IRC | 19:17 | |
| stevemar | gordc, http://imgur.com/hO6R9oS | 19:17 |
| *** david-lyle has quit IRC | 19:17 | |
| stevemar | might be your machine | 19:17 |
| *** dolphm has joined #openstack-keystone | 19:17 | |
| *** david-lyle has joined #openstack-keystone | 19:17 | |
| gordc | stevemar: was going to give another mic drop response...i'll refraim | 19:18 |
| gordc | refrain* | 19:18 |
| *** lbragstad has quit IRC | 19:19 | |
| *** lbragstad has joined #openstack-keystone | 19:20 | |
| *** d34dh0r53 has quit IRC | 19:20 | |
| *** d34dh0r53 has joined #openstack-keystone | 19:20 | |
| *** hockeynut has quit IRC | 19:21 | |
| *** hockeynut has joined #openstack-keystone | 19:22 | |
| stevemar | gordc, just tried the new oslo_debug_helper, works too! | 19:22 |
| *** nkinder_ has quit IRC | 19:23 | |
| gordc | f... retry | 19:23 |
| dstanek | dolphm: what's up with https://review.openstack.org/#/c/101829/ ? do you think we should hold off like gyee suggested? | 19:24 |
| *** Ephur has quit IRC | 19:24 | |
| *** bjornar_ has quit IRC | 19:25 | |
| morganfainberg | dstanek, dolphm, not sure why we should hold off on that | 19:25 |
| *** KanagarajM has joined #openstack-keystone | 19:25 | |
| *** dolphm has quit IRC | 19:26 | |
| *** dolphm has joined #openstack-keystone | 19:26 | |
| *** wanghong has quit IRC | 19:26 | |
| morganfainberg | dstanek, it seems like something we'd want to backport and OSSN/OSSA | 19:26 |
| *** lbragstad has quit IRC | 19:28 | |
| *** d34dh0r53 has quit IRC | 19:29 | |
| bknudson | you would do an OSSA if this exposed a security vulnerability... not sure what the vuln would be? | 19:29 |
| morganfainberg | bknudson, OSSN then? | 19:29 |
| dstanek | morganfainberg: what is the OSSN/OSSA for? | 19:29 |
| *** d34dh0r53 has joined #openstack-keystone | 19:29 | |
| morganfainberg | bknudson, based on gyee's comment | 19:30 |
| *** hockeynut has quit IRC | 19:30 | |
| dstanek | morganfainberg: is it a security issue that the user can't tell who gave them the trust? you can't actually exploit that in any way can you? | 19:31 |
| *** hockeynut has joined #openstack-keystone | 19:31 | |
| morganfainberg | dstanek, hm. well.. you can't revoke that token when the trustor changes password/disabled | 19:31 |
| morganfainberg | dstanek, i *think* | 19:31 |
| morganfainberg | i'd need to dig, but it might be revocation related issues | 19:31 |
| *** topol has joined #openstack-keystone | 19:31 | |
| morganfainberg | dstanek, that would be the only security bits | 19:32 |
| dstanek | morganfainberg: that's a good point if the tokens are long lived | 19:32 |
| morganfainberg | dstanek, tokens tend to live 3600s-86400s | 19:33 |
| morganfainberg | range | 19:33 |
| *** lbragstad has joined #openstack-keystone | 19:34 | |
| *** dolphm has quit IRC | 19:35 | |
| *** dolphm has joined #openstack-keystone | 19:35 | |
| morganfainberg | dstanek, i'd say we are definitely "long lived" tokens | 19:36 |
| *** lbragstad has quit IRC | 19:37 | |
| gyee | I think its a security issue because 1) we can't tell who give the trust; and 2) we can't tell if its an impersonation | 19:37 |
| *** lbragstad has joined #openstack-keystone | 19:37 | |
| *** raildo_ has joined #openstack-keystone | 19:38 | |
| gyee | I suppose we can tell by looking at both the user_id and trustee_user_id, if they are the same, then impersonation | 19:38 |
| gyee | if they are different I mean | 19:38 |
| *** d34dh0r53 has quit IRC | 19:38 | |
| *** colettecello has joined #openstack-keystone | 19:38 | |
| *** d34dh0r53 has joined #openstack-keystone | 19:38 | |
| *** csd_ has joined #openstack-keystone | 19:39 | |
| *** hockeynut has quit IRC | 19:39 | |
| dstanek | gyee: can you exploit that? | 19:40 |
| *** hockeynut has joined #openstack-keystone | 19:40 | |
| *** csd has quit IRC | 19:40 | |
| *** raildo has quit IRC | 19:40 | |
| *** gothicmindfood has quit IRC | 19:40 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 19:40 |
| *** csd_ is now known as csd | 19:40 | |
| bknudson | gyee: I have no problem with putting out an ossa for the problem. | 19:43 |
| bknudson | then we'd have to fix it. | 19:43 |
| *** dolphm has quit IRC | 19:44 | |
| *** dolphm has joined #openstack-keystone | 19:44 | |
| *** dims has quit IRC | 19:44 | |
| *** Dafna has quit IRC | 19:45 | |
| gyee | dstanek, bknudson, since devstack doesn't use v2 trust so the problem is unknown | 19:45 |
| morganfainberg | gyee, bknudson, dstanek, the alternative is (i think) breaking v2 trusts (probably a bad idea) | 19:45 |
| morganfainberg | breaking = disabling completly | 19:46 |
| *** lbragstad has quit IRC | 19:46 | |
| gyee | but we are not disabling anything though | 19:46 |
| dstanek | gyee: i'm not against this at all, i'm just curious to know if it's actually exploitable | 19:47 |
| gyee | question is are there any authorization policy out there that takes these two attributes into consideration | 19:47 |
| *** d34dh0r53 has quit IRC | 19:47 | |
| morganfainberg | ok well in SQL tokens, this looks to be non-issue actually | 19:48 |
| morganfainberg | since we always filter on trust_id . /me checks one more thing | 19:48 |
| *** hockeynut has quit IRC | 19:48 | |
| morganfainberg | and in KVS we only care about trustee_user_id it looks like. | 19:49 |
| *** sigmavirus24 has quit IRC | 19:49 | |
| morganfainberg | ok so, not exploitable, afaict, so we can just hold this back probably | 19:49 |
| *** d34dh0r53 has joined #openstack-keystone | 19:50 | |
| *** mgagne has joined #openstack-keystone | 19:51 | |
| gyee | morganfainberg, yeah, looks like they are not needed | 19:51 |
| *** ChanServ sets mode: +o dolphm | 19:51 | |
| morganfainberg | bknudson, gyee, dstanek, no OSSA/OSSN needed | 19:51 |
| morganfainberg | though... it will break revocation events now that i think about it | 19:51 |
| morganfainberg | potentialyl. | 19:51 |
| *** sigmavirus24 has joined #openstack-keystone | 19:51 | |
| gyee | if user_id is the same as trustee_user_id, impersonation is false | 19:52 |
| * dolphm is back from vnc server meltdown | 19:52 | |
| dolphm | err znc | 19:52 |
| morganfainberg | and looks like revocaton events are also unaffected | 19:52 |
| morganfainberg | at worst we are missing some data that could be used for audit in the token body | 19:53 |
| morganfainberg | s/audit/auditing that isn't cadf | 19:53 |
| morganfainberg | dolphm, welcome back | 19:55 |
| gyee | vnc :) | 19:57 |
| gyee | I could use some gnc | 19:57 |
| *** enewlands has joined #openstack-keystone | 19:58 | |
| *** jsavak has joined #openstack-keystone | 19:58 | |
| ayoung | morganfainberg, dolphm, got someone to work on docs, but she works on a mac, and I'm clueless there she's got git but not pip or tox... | 19:59 |
| dolphm | ayoung: homebrew! | 19:59 |
| dolphm | ayoung: http://brew.sh/ | 19:59 |
| dolphm | ayoung: how i provision my own mac to get pip and whatnot https://github.com/dolph/dotfiles/blob/master/provision.sh | 19:59 |
| rharwood | or macports: macports.org | 19:59 |
| dolphm | rharwood: NO | 20:00 |
| rharwood | ? | 20:00 |
| dolphm | macports was never any good, and it's now completely dead | 20:00 |
| morganfainberg | gyee, bknudson, dstanek , commented on the bug and downgraded my score of the patch to +1, it isn't needed for juno rc | 20:00 |
| morganfainberg | gyee, bknudson, dstanek, but i don't mind if we want to include it in RC. | 20:00 |
| rharwood | it has worked fine for me for years and has multiple apple devs working on it... | 20:01 |
| dolphm | morganfainberg: i was about to ask why ya'll didn't +A. | 20:01 |
| *** joesavak has quit IRC | 20:01 | |
| morganfainberg | dolphm, gyee's comment. | 20:01 |
| morganfainberg | dolphm, so can go in, doesn't have to. | 20:01 |
| dolphm | rharwood: that's... really suprising | 20:01 |
| rharwood | I'm not sure why you would think it's dead? | 20:01 |
| morganfainberg | rharwood, i've found brew works a *lot* better | 20:01 |
| *** joesavak has joined #openstack-keystone | 20:02 | |
| morganfainberg | rharwood, my experience macports wasn't particularly friendly when i did use it | 20:02 |
| dolphm | macports drove me back to linux | 20:02 |
| gyee | morganfainberg, I don't have a strong opinion on that one | 20:02 |
| *** lbragstad has joined #openstack-keystone | 20:02 | |
| *** diegows has joined #openstack-keystone | 20:03 | |
| *** colettecello is now known as gothicmindfood | 20:03 | |
| *** dims_ has joined #openstack-keystone | 20:03 | |
| gyee | dolphm, rharwood, I've been using homebrew too, does the job for me | 20:03 |
| gyee | I don't do anything fancy | 20:03 |
| *** jsavak has quit IRC | 20:03 | |
| ayoung | rharwood, yeah, that was annegentle's response as well...looks like it is the way today | 20:05 |
| *** henrynash has joined #openstack-keystone | 20:08 | |
| *** nkinder_ has joined #openstack-keystone | 20:11 | |
| *** topol has quit IRC | 20:12 | |
| *** dims__ has joined #openstack-keystone | 20:17 | |
| *** dims_ has quit IRC | 20:20 | |
| *** dims__ has quit IRC | 20:22 | |
| *** marcoemorais has quit IRC | 20:36 | |
| *** marcoemorais has joined #openstack-keystone | 20:37 | |
| morganfainberg | dolphm, for bug 1294994 did you need me to do the backport? | 20:38 |
| uvirtbot | Launchpad bug 1294994 in keystone "Managers instantiated multiple times" [Medium,Fix released] https://launchpad.net/bugs/1294994 | 20:38 |
| morganfainberg | dolphm, or was there an open cr you had | 20:39 |
| *** marcoemorais has quit IRC | 20:39 | |
| *** radez is now known as radez_g0n3 | 20:40 | |
| *** zzzeek has quit IRC | 20:40 | |
| *** marcoemorais has joined #openstack-keystone | 20:40 | |
| *** marcoemorais has quit IRC | 20:40 | |
| *** marcoemorais1 has joined #openstack-keystone | 20:45 | |
| *** jsavak has joined #openstack-keystone | 20:48 | |
| *** joesavak has quit IRC | 20:52 | |
| *** henrynash has quit IRC | 20:54 | |
| *** r1chardj0n3s_afk has joined #openstack-keystone | 20:54 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 20:56 | |
| *** alex_xu has joined #openstack-keystone | 21:00 | |
| nkinder_ | ayoung: with the multi-backend functionlity, are the service users in a "default" domain, or is there a "service" domain? | 21:01 |
| ayoung | nkinder_, you can do either. | 21:01 |
| ayoung | nkinder_, here's what Henrynash and I discussed | 21:01 |
| ayoung | using something like packstack etc, its going to set up SQL and put the service users in default | 21:02 |
| ayoung | leave them there, and create a new domain for your LDAP, and give it a good name, like REDHAT for us | 21:02 |
| ayoung | so default becomes the service domain. It does mean you need to do V3 everywhere, though | 21:02 |
| ayoung | nkinder_, in fact, that is what I have set up on my public IPA/Keystone demo. | 21:03 |
| ayoung | I left service user, admin, and demo in Defaul, and then have YOUNGLOGIC.NET as the IPA backed domain. | 21:03 |
| nkinder_ | ayoung: ok, I was mainly wondering if you just left it as "default" or if you had to create another domain for the service users. | 21:04 |
| nkinder_ | ayoung: the way you set it up is the way I would expect it | 21:04 |
| *** wwriverrat has left #openstack-keystone | 21:07 | |
| r1chardj0n3s | hi ayoung: did you see my openstack-dev post about the Javascript/CORS stuff? | 21:09 |
| *** jsavak has quit IRC | 21:10 | |
| ayoung | r1chardj0n3s, nope....still parsing though the 2k emails I get every day | 21:12 |
| r1chardj0n3s | ayoung: ok, no worries; the tl;dr is that going the oslo.middleware route is a bad choice :) | 21:12 |
| r1chardj0n3s | ayoung: so I'm going to dodge the CORS bullet entirely | 21:12 |
| ayoung | r1chardj0n3s, why | 21:14 |
| ayoung | we need CORS | 21:14 |
| ayoung | r1chardj0n3s, but, let me read it | 21:15 |
| r1chardj0n3s | for my purposes I'm going to avoid it, the email explains I hope :) | 21:15 |
| openstackgerrit | A change was merged to openstack/keystone: Keystone local authenticate has an unnecessary pending audit record. https://review.openstack.org/120162 | 21:15 |
| *** amcrn_ has joined #openstack-keystone | 21:16 | |
| ayoung | r1chardj0n3s, what is the email title? | 21:16 |
| ayoung | Supporting Javascript clients calling OpenStack APIs | 21:17 |
| ayoung | found it | 21:17 |
| r1chardj0n3s | yah, sent before the overnight (for me overnight) flood | 21:17 |
| ayoung | r1chardj0n3s, you want to do the Proxy solution? That works, but bypasses the service catalog | 21:18 |
| ayoung | not insurmountable | 21:18 |
| r1chardj0n3s | ayoung: it keeps the service catalog but alters the publicURLs in it | 21:18 |
| r1chardj0n3s | I have this working :) | 21:18 |
| ayoung | yeah, I figured that is where you went | 21:18 |
| ayoung | r1chardj0n3s, I think this is a good first step. | 21:19 |
| r1chardj0n3s | I'll clean up what I have and put it in the githubs | 21:19 |
| ayoung | I think we will still want CORS support, but, as I was saying, based onthe actual service catalog. Not all tokens should go everywhere | 21:19 |
| ayoung | r1chardj0n3s, how far along is your Javascript code? | 21:19 |
| r1chardj0n3s | but as I was saying, that's not CORS' business ;) | 21:19 |
| r1chardj0n3s | ayoung: I have a bunch of stuff that I wrote before I saw your code; mine is about the same, but a better structure for the angularjs aspect I think | 21:20 |
| *** amcrn has quit IRC | 21:20 | |
| ayoung | r1chardj0n3s, yeah, mine is proof of concept | 21:20 |
| ayoung | r1chardj0n3s, I have a deep interest in Kerberos. I wonder if you are messing that up | 21:21 |
| r1chardj0n3s | ayoung: I'd love to know! :) | 21:21 |
| ayoung | r1chardj0n3s, nkinder_ lets figure that out | 21:21 |
| ayoung | r1chardj0n3s, WHat are you using for your proxy? | 21:22 |
| r1chardj0n3s | so my plan today (it's just turned Friday here) is to clean the stuff up and get the github repos up with the code and some docs describing the structure of the app | 21:22 |
| r1chardj0n3s | ayoung: at the moment, it's a single-page Flask app | 21:22 |
| ayoung | r1chardj0n3s, Flask is one of them toy webservers isn't it? | 21:23 |
| r1chardj0n3s | ayoung: yes :) | 21:23 |
| ayoung | r1chardj0n3s, can it run behind apache? | 21:23 |
| r1chardj0n3s | ayoung: yes | 21:23 |
| r1chardj0n3s | https://gist.github.com/r1chardj0n3s/3f2f3aca2298ae483440 is the current state of it | 21:24 |
| r1chardj0n3s | it needs some fleshing out | 21:24 |
| ayoung | r1chardj0n3s, so due to you rewriting URLS, we can't use that same Apache to front Keystone directly | 21:24 |
| ayoung | but.... | 21:24 |
| ayoung | I could do S4U2Proxy still | 21:24 |
| *** henrynash has joined #openstack-keystone | 21:25 | |
| r1chardj0n3s | I'm not familiar with that | 21:25 |
| ayoung | r1chardj0n3s, its part of Kerberos | 21:25 |
| r1chardj0n3s | yep, just saw that in the googs :) | 21:25 |
| ayoung | r1chardj0n3s, its part of how I am doing the current Horizon Kerberization | 21:26 |
| r1chardj0n3s | sorry, I gotta afk to cook breakfast & get daughter off to school | 21:26 |
| ayoung | It doesn' | 21:26 |
| ayoung | r1chardj0n3s, what about SAML.... | 21:26 |
| *** cjellick_ has joined #openstack-keystone | 21:26 | |
| *** cjellick has quit IRC | 21:26 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 21:26 | |
| *** adam_g has joined #openstack-keystone | 21:26 | |
| *** adam_g has quit IRC | 21:27 | |
| *** adam_g has joined #openstack-keystone | 21:27 | |
| ayoung | r1chardj0n3s_afk, you might be messing up some of the other web authentication methods, but the only one I think that you would outright break is X509 client certs | 21:27 |
| *** wanghong has joined #openstack-keystone | 21:28 | |
| *** marcoemorais1 has quit IRC | 21:31 | |
| *** marcoemorais has joined #openstack-keystone | 21:32 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:34 | |
| *** marcoemorais1 has quit IRC | 21:34 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:35 | |
| *** marcoemorais1 has quit IRC | 21:35 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:36 | |
| *** marcoemorais1 has quit IRC | 21:36 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:37 | |
| *** marcoemorais has quit IRC | 21:37 | |
| *** marcoemorais1 has quit IRC | 21:37 | |
| *** marcoemorais has joined #openstack-keystone | 21:37 | |
| *** marcoemorais has quit IRC | 21:37 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Add a functional tests for role assignments https://review.openstack.org/119843 | 21:38 |
| *** marcoemorais has joined #openstack-keystone | 21:38 | |
| *** jaosorior has quit IRC | 21:42 | |
| *** enewlands has quit IRC | 22:02 | |
| *** dims_ has joined #openstack-keystone | 22:10 | |
| *** wanghong has quit IRC | 22:11 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Safer check for enabled in trusts https://review.openstack.org/120592 | 22:13 |
| *** amcrn_ is now known as amcrn | 22:13 | |
| *** KanagarajM has quit IRC | 22:13 | |
| *** dims_ has quit IRC | 22:14 | |
| ayoung | morganfainberg, dolphm thanks for the help on Mac. I figure whenever someone is willing to write docs on the security vital stuff, its worth walking them through the process. | 22:15 |
| morganfainberg | ayoung, np | 22:16 |
| morganfainberg | and agreed | 22:16 |
| morganfainberg | ayoung, so... is this worth getting in for J? https://review.openstack.org/#/c/101829/ it has functionally almost no benefit/detriment | 22:17 |
| morganfainberg | ayoung, because if it si we should approve it | 22:17 |
| ayoung | Ok, here's why I think it should go in | 22:17 |
| morganfainberg | at best it's a nice to have. | 22:17 |
| morganfainberg | at worst it's a nice to have :) | 22:18 |
| ayoung | I think that trusts are kindof broken without it. | 22:18 |
| ayoung | It means that you have to do impersonation in order to know who the trustor is, and that is just not something we want to encourage | 22:19 |
| morganfainberg | ayoung, they aren't really broken though. | 22:19 |
| ayoung | morganfainberg, it is, though. It people need to check ownership, and they only check user, we'll have people doing impersonation | 22:19 |
| ayoung | like the Barbican folks | 22:19 |
| morganfainberg | ayoung, *cough* v2 :P | 22:20 |
| ayoung | yeah, I know | 22:20 |
| morganfainberg | ayoung, but again, i'm not opposed to it going in | 22:20 |
| ayoung | but have you ever tried setting up a deployment with V3 everywhere | 22:20 |
| ayoung | its painful, and .... what does Devstack default to these days,like for horizon | 22:20 |
| ayoung | I'd like to get it in | 22:20 |
| morganfainberg | ayoung, so, regardless of it, I have no skin either way here. it has the score to get in just needs approval | 22:20 |
| morganfainberg | and gyee said he doesn't feel strongly either way | 22:21 |
| ayoung | is that dolph? | 22:21 |
| *** alex_xu has quit IRC | 22:21 | |
| morganfainberg | so if you feel strongly, that is a vote to get it in | 22:21 |
| ayoung | I already +2ed it | 22:21 |
| ayoung | willing to +A it now if there is no objection | 22:21 |
| morganfainberg | ayoung, right so i was looking for either punt or +A | 22:21 |
| morganfainberg | nah don't think so | 22:21 |
| morganfainberg | go for it | 22:21 |
| ayoung | will do | 22:21 |
| morganfainberg | ayoung, i just want to get things off the RC list one way or another and this is a very minor thing | 22:22 |
| morganfainberg | ayoung, thanks! :) | 22:22 |
| ayoung | morganfainberg, I think the way that one got missed is that trusts were originally impersonation only. | 22:22 |
| morganfainberg | makes sense | 22:23 |
| ayoung | dolph convinced me that was a bad idea, so it was late in the trusts review process | 22:23 |
| ayoung | but I suspect that the dominant way people were using trusts in V2 were for swift, whcih meant they needed impersonation anyway | 22:23 |
| ayoung | which is why there has been no complaint | 22:23 |
| *** andreaf has quit IRC | 22:23 | |
| jamielennox | ayoung: i'm not here yet, however do you mind having a look at https://review.openstack.org/#/c/118004/ it would be useful for the next release | 22:24 |
| ayoung | however, swift has, I think, changed somehow that makes that no longer a hard requirement | 22:24 |
| notmyname | ? | 22:24 |
| ayoung | jamielennox, I have one for you, too | 22:24 |
| jamielennox | there's one other i think and the rest are ok to wait for | 22:24 |
| jamielennox | is it revocation events? | 22:24 |
| ayoung | https://review.openstack.org/#/c/120883/ jamielennox that is from the kerberos patch | 22:25 |
| notmyname | ayoung: what did swift change? | 22:25 |
| ayoung | notmyname, I'm not sure, but I t thought it was something on the ownership model for the API | 22:25 |
| ayoung | notmyname, this is all hearsay, and will not hold up in court | 22:25 |
| ayoung | but the reason that trusts had impersonation was the objects in swift were owned by users, and to read/write them the trust tokens had to impersonate those users | 22:26 |
| jamielennox | ayoung: +2 - i think i might have wrote that anyway | 22:26 |
| ayoung | jamielennox, thanks | 22:26 |
| ayoung | morganfainberg, can you hit that one as well. I need it in the next client for testing the kerberos auth plugin | 22:27 |
| notmyname | ayoung: we just landed https://review.openstack.org/#/c/86430/ which AFAIK gets us keystone v3 acls | 22:27 |
| ayoung | https://review.openstack.org/#/c/120883/ | 22:27 |
| notmyname | ayoung: errr..."landed". currently waiting/fighting jenkins | 22:27 |
| ayoung | heh, notmyname I know that pain | 22:27 |
| ayoung | notmyname, you coming to Westford for the swift hackathon? | 22:28 |
| notmyname | of course. where else would I be? | 22:28 |
| ayoung | awesome. I'll be here on Tuesday for it. | 22:28 |
| ayoung | Well, I'd be here anyway, but I'll be in the -thon | 22:29 |
| *** diegows has quit IRC | 22:32 | |
| *** gordc has quit IRC | 22:32 | |
| dolphm | morganfainberg: what's different in patchset 2 of https://review.openstack.org/#/c/120924/ ? the diffs on keystone/identity/controllers.py and keystone/token/providers/pki.py aren't loading for me | 22:33 |
| morganfainberg | dolphm, reset the author :P | 22:34 |
| morganfainberg | dolphm, morgan.fainberg@gmail.com vs m@metacloud.com | 22:34 |
| * dolphm scratches head | 22:34 | |
| morganfainberg | dolphm, i also didn't see your upload and was working on the backport myself separately | 22:34 |
| morganfainberg | so when i uploaded it just added patchset 2 | 22:34 |
| morganfainberg | :P | 22:34 |
| dolphm | morganfainberg: oh you're on a different parent sha for some reason | 22:34 |
| morganfainberg | and different commit message | 22:35 |
| morganfainberg | dolphm, https://review.openstack.org/#/c/120924/1..2//COMMIT_MSG | 22:35 |
| morganfainberg | so basically... meh. | 22:36 |
| dolphm | morganfainberg: your local stable/icehouse branch is 2 commits behind github | 22:36 |
| morganfainberg | dolphm, huh. i did a fetch/checkout | 22:36 |
| morganfainberg | weird | 22:36 |
| dolphm | morganfainberg: *shrug* that's the diff i'm seeing in the gerrit UI, but it's timing out trying to render it | 22:37 |
| dolphm | so i'm going to go make dinner | 22:37 |
| dolphm | o/ | 22:37 |
| morganfainberg | yeah. | 22:37 |
| morganfainberg | basically i think the bulk of the change is commit message :P | 22:37 |
| morganfainberg | and parent | 22:37 |
| *** openstackgerrit has quit IRC | 22:38 | |
| *** openstackgerrit_ has joined #openstack-keystone | 22:38 | |
| morganfainberg | it's what happens when you walk away a while back and forget to hit enter on 'git review' then come back :P | 22:38 |
| *** bknudson has quit IRC | 22:39 | |
| *** diegows has joined #openstack-keystone | 22:40 | |
| *** openstackgerrit_ is now known as openstackgerrit | 22:40 | |
| *** gyee has quit IRC | 22:40 | |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: ldap/core deleteTree not always supported https://review.openstack.org/74897 | 22:41 |
| *** dims_ has joined #openstack-keystone | 22:44 | |
| *** ayoung has quit IRC | 22:45 | |
| *** henrynash has quit IRC | 22:57 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: SAML2 federated authentication for ADFS. https://review.openstack.org/111771 | 22:58 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: SAML2 federated authentication for ADFS. https://review.openstack.org/111771 | 23:03 |
| *** diegows has quit IRC | 23:07 | |
| stevemar | dstanek, if you could be so find as to take a look at ^ | 23:11 |
| stevemar | kind* | 23:11 |
| stevemar | marek's been workin hard on it, and I think you reviewed the initial saml patch fairly closely? | 23:12 |
| *** hrybacki has joined #openstack-keystone | 23:25 | |
| *** stevemar has quit IRC | 23:26 | |
| r1chardj0n3s_afk | ayoung: thanks for the email response! | 23:27 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 23:27 | |
| *** arunkant_work has quit IRC | 23:29 | |
| jamielennox | dolphm: you see anything about https://bugs.launchpad.net/swift/+bug/1368048 that needs fixing in middleware? (the problem adding www-authenticate to middleware responses) | 23:30 |
| uvirtbot | Launchpad bug 1368048 in swift "testQuotedWWWAuthenticateHeader date time encoding error" [Critical,Fix committed] | 23:30 |
| *** alex_xu has joined #openstack-keystone | 23:30 | |
| *** r-daneel has quit IRC | 23:33 | |
| *** dims_ has quit IRC | 23:34 | |
| *** oomichi has joined #openstack-keystone | 23:37 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:41 | |
| *** diegows has joined #openstack-keystone | 23:43 | |
| *** jorge_munoz has quit IRC | 23:48 | |
| *** diegows has quit IRC | 23:49 | |
| *** dims_ has joined #openstack-keystone | 23:52 | |
| *** dims__ has joined #openstack-keystone | 23:55 | |
| *** aix has joined #openstack-keystone | 23:56 | |
| *** cjellick_ has quit IRC | 23:57 | |
| *** dims_ has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!