| *** marcoemorais has quit IRC | 00:00 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 00:03 |
|---|---|---|
| morganfainberg | dstanek, ^ | 00:03 |
| morganfainberg | dstanek, added the max-timeout (10s default) | 00:04 |
| morganfainberg | dstanek, this now requires a string freeze exception | 00:04 |
| *** dims has joined #openstack-keystone | 00:10 | |
| *** radez is now known as radez_g0n3 | 00:11 | |
| *** gyee has quit IRC | 00:12 | |
| *** jasonsb has quit IRC | 00:13 | |
| *** ayoung has quit IRC | 00:22 | |
| *** wanghong has joined #openstack-keystone | 00:26 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Delete unused examples/pki/certs/middleware.pem https://review.openstack.org/122277 | 00:32 |
| *** amcrn has quit IRC | 00:32 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Remove unused iso8601 https://review.openstack.org/122278 | 00:33 |
| *** Tahmina has quit IRC | 00:34 | |
| *** amcrn has joined #openstack-keystone | 00:34 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: BaseAuthTokenMiddlewareTest.setUp call super normally https://review.openstack.org/122279 | 00:34 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Auth token tests create temp cert directory https://review.openstack.org/122280 | 00:36 |
| *** ayoung has joined #openstack-keystone | 00:36 | |
| cyeoh | can anyone tell me if there is a fixed format for tenant ids? I know that by default its uidv4 with the dashes removed and that historically there have been integers as tenant ids. But is it also now dependent on backends? | 00:37 |
| cyeoh | looking to see if we can do any cheap input validation in the nova api on tenant ids - eg without having to query keystone | 00:38 |
| morganfainberg | cyeoh, project_ids should be uuid4().hex (we auto generate them) -- BUT (big but) someone could do wonky things. | 00:40 |
| morganfainberg | cyeoh, i think officially we are 64byte varchar is our limit | 00:40 |
| cyeoh | morganfainberg: ok, thanks - sounds like it wouldn't be safe for us to do any input validation on them then | 00:41 |
| morganfainberg | cyeoh, i would hope all projects are 32bytes hex, but i honestly can't guarantee old old old sysrtems that have been migrated forward (essex, diablo) continously wouldn't have something odd in them | 00:41 |
| morganfainberg | i think it depends on where we draw that line. | 00:41 |
| cyeoh | yea I had a patch that checked for uidv4 and someone pointed out that they have old entries in the db that have integers as their tenant_ids | 00:42 |
| *** oomichi has joined #openstack-keystone | 00:42 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor extract class for signing directory https://review.openstack.org/122281 | 00:43 |
| cyeoh | the original basic problem was people sending say tenant names instead of tenant ids to the api and API would quietly accept them but do nothing | 00:43 |
| *** bknudson has joined #openstack-keystone | 00:43 | |
| morganfainberg | ah yeah. :( | 00:43 |
| morganfainberg | we do have the "get_project_by_name" but you'd need to know the domain_id too | 00:43 |
| morganfainberg | (most cases up until recently that would be "default") | 00:44 |
| cyeoh | yea and I think its too expensive to query keystone just for tenant id validation | 00:45 |
| morganfainberg | cyeoh, and then there'd be the people who would do something weird like use a UUID hex for the name of the project too. | 00:45 |
| cyeoh | hahaha yea | 00:45 |
| *** alex_xu has quit IRC | 00:45 | |
| oomichi | hi bknudson | 00:45 |
| bknudson | oomichi: hi | 00:46 |
| morganfainberg | cyeoh, ok actually what's the use case? because most of the time people are only ever spinning up instances in their own project, right? | 00:46 |
| oomichi | bknudson: can you take a look at https://review.openstack.org/#/c/121575/ again ? | 00:46 |
| morganfainberg | cyeoh, their own = currently scoped | 00:46 |
| morganfainberg | cyeoh, or is this more for introspection type stuff? | 00:46 |
| oomichi | bknudson: I'd like to know current status of the problem. | 00:46 |
| cyeoh | this specific example was 'nova quota-delete' <tenant_id> I think | 00:46 |
| morganfainberg | cyeoh, ah | 00:47 |
| *** jasonsb has joined #openstack-keystone | 00:47 | |
| morganfainberg | that is a tough one | 00:47 |
| cyeoh | morganfainberg: if you pass an invalid tenant id, nova quite happily goes through its db, doesn't delete anything because it doesn't match any entries and says success! | 00:47 |
| bknudson | oomichi: this was a month ago so I don't remember all of the details... but the test needed to be disabled in before the change to fix it could go in. | 00:47 |
| morganfainberg | cyeoh, maybe it should say "found no project by id XXX" ? | 00:48 |
| bknudson | oomichi: https://review.openstack.org/#/c/109389/ was the change in keystone | 00:48 |
| morganfainberg | cyeoh, but short of that yeah i'd say the only sane option is validate with keystone. | 00:48 |
| morganfainberg | cyeoh, or keep current behavior | 00:48 |
| *** jasonsb has quit IRC | 00:48 | |
| morganfainberg | but that sounds a little less sane from a usability standpoint | 00:48 |
| oomichi | bknudson: yeah, I saw it. and now can we change keystone status to "Fix Released" on https://bugs.launchpad.net/tempest/+bug/1351026 | 00:49 |
| uvirtbot | Launchpad bug 1351026 in keystone "IdentityError in TokensV3TestJSON.test_rescope_token" [Undecided,Fix committed] | 00:49 |
| cyeoh | morganfainberg: yep, have thought about checking how many records have been deleted and complain if none are. Unfortunately its a bit of non trivial db work so that would be deferred to kilo | 00:49 |
| morganfainberg | cyeoh, yeah it is a bit late in the cycle. | 00:49 |
| cyeoh | morganfainberg: yep. anyway thanks for you help! | 00:50 |
| bknudson | oomichi: I'm not working on the bug anymore since it's taken care of. If the revert in tempest passes the gate then should be fine. | 00:50 |
| morganfainberg | cyeoh, np anytime! | 00:50 |
| bknudson | cyeoh: keystone has notifications for tenants | 00:50 |
| bknudson | so if you want to keep a cache of valid tenants should be possible | 00:50 |
| morganfainberg | yeah you could but we know how often things ... uh ... disappear on the message bus | 00:51 |
| bknudson | cyeoh: we have a bug open to have nova clean up when a tenant is deleted | 00:51 |
| bknudson | or, make it so you can't delete the tenant if nova has vms on it | 00:51 |
| *** cjellick has quit IRC | 00:52 | |
| cyeoh | bknudson: oh interesting | 00:52 |
| morganfainberg | bknudson, that latter one i think is very interesting | 00:52 |
| cyeoh | bknudson, morganfainberg: yea we'd need reliable delivery updates if we're going to do input validation on it. | 00:52 |
| *** cjellick has joined #openstack-keystone | 00:53 | |
| cyeoh | actually IIRC there is also another nova bug where we really should be doing tenant id validation so it might be generally useful | 00:53 |
| oomichi | bknudson: thanks, I got it. let's enable the test again. | 00:53 |
| bknudson | part of the problem is... you ask keystone if the tenant is there and it says yes, but then at the same time someone's doing the delete and now it's gone | 00:53 |
| cyeoh | I think it was adding flavor access where we don't do an checking of the tenant id passed | 00:54 |
| bknudson | so it didn't do any good to check if the project exists. | 00:54 |
| *** rodrigods_ has joined #openstack-keystone | 00:54 | |
| cyeoh | bknudson: i think in these cases we could probably live with the race, but we'd have to be careful in others | 00:55 |
| *** cjellick has quit IRC | 00:57 | |
| ayoung | jamielennox|away, you around? If you are , Question: does it make sense to fix httpclient so that authenticate is aware of sessions? I think it does. | 01:01 |
| *** bjornar has quit IRC | 01:10 | |
| *** amcrn has quit IRC | 01:13 | |
| *** dims has quit IRC | 01:17 | |
| *** dims has joined #openstack-keystone | 01:17 | |
| *** dims has quit IRC | 01:21 | |
| *** dims has joined #openstack-keystone | 01:22 | |
| *** meker12 has quit IRC | 01:31 | |
| *** meker12 has joined #openstack-keystone | 01:32 | |
| dstanek | ayoung: i think he's on vacation for a few weeks | 01:34 |
| ayoung | dstanek, HE WENT TO THE CHURCH TO GET MARRIED! | 01:34 |
| * ayoung making reference to old, racist movies | 01:35 | |
| *** amcrn has joined #openstack-keystone | 01:36 | |
| *** meker12 has quit IRC | 01:37 | |
| *** _cjones_ has quit IRC | 01:38 | |
| *** _cjones_ has joined #openstack-keystone | 01:38 | |
| *** _cjones_ has quit IRC | 01:43 | |
| *** zzzeek has quit IRC | 01:45 | |
| *** amcrn has quit IRC | 01:47 | |
| *** oomichi has quit IRC | 01:56 | |
| *** vdreamarkitex has quit IRC | 02:00 | |
| *** openstackgerrit has quit IRC | 02:01 | |
| *** wanghong has quit IRC | 02:06 | |
| *** stevemar has joined #openstack-keystone | 02:08 | |
| *** meker12 has joined #openstack-keystone | 02:09 | |
| *** dims has quit IRC | 02:15 | |
| *** david-lyle has joined #openstack-keystone | 02:16 | |
| *** dims has joined #openstack-keystone | 02:16 | |
| *** openstackgerrit has joined #openstack-keystone | 02:20 | |
| *** dims has quit IRC | 02:21 | |
| *** rodrigods_ has quit IRC | 02:24 | |
| *** meker12 has quit IRC | 02:24 | |
| *** meker12 has joined #openstack-keystone | 02:24 | |
| *** meker12_ has joined #openstack-keystone | 02:27 | |
| *** meker12_ has quit IRC | 02:27 | |
| *** meker12_ has joined #openstack-keystone | 02:28 | |
| *** vdreamarkitex has joined #openstack-keystone | 02:28 | |
| *** meker12 has quit IRC | 02:29 | |
| *** junhongl has joined #openstack-keystone | 02:30 | |
| *** junhongl has quit IRC | 02:33 | |
| *** junhongl has joined #openstack-keystone | 02:33 | |
| YorikSar | morganfainberg: morning/evening | 02:43 |
| morganfainberg | YorikSar, hi | 02:44 |
| YorikSar | morganfainberg: Oh, you're still around, cool. | 02:44 |
| YorikSar | morganfainberg: It looks like everybody's happy with queue version :) | 02:44 |
| YorikSar | morganfainberg: The only change I'm not sure about is help strings for config options :) | 02:45 |
| morganfainberg | YorikSar, those are actually needed, i've had dstanek and one other person confused about the very similar options | 02:45 |
| morganfainberg | and those ones are clearly for KVS | 02:45 |
| YorikSar | morganfainberg: The whole section is for KVS | 02:45 |
| *** alex_xu has joined #openstack-keystone | 02:46 | |
| YorikSar | morganfainberg: But actually it's not a big deal. | 02:46 |
| YorikSar | morganfainberg: I guess we can port this to middleware now, right? | 02:46 |
| morganfainberg | YorikSar, we need some way to make it clear. i just would rather have too much info in help strings vs not enough. we can cut it back next cycle come. | 02:46 |
| morganfainberg | YorikSar, i think we can. | 02:47 |
| YorikSar | morganfainberg: Yes, agree. | 02:47 |
| YorikSar | morganfainberg: Ok, I'll put up new patchset to middleware once I reach work | 02:47 |
| dstanek | YorikSar: great! | 02:49 |
| YorikSar | morganfainberg: I hate waking up before dawn :) | 02:49 |
| *** _cjones_ has joined #openstack-keystone | 02:49 | |
| *** wwriverrat has joined #openstack-keystone | 02:50 | |
| *** meker12_ has quit IRC | 02:50 | |
| *** meker12 has joined #openstack-keystone | 02:51 | |
| dstanek | YorikSar: yeah, my issue was that there was nothing that says the memcache section is only for kvs; and now with the change there is duplicate memcache settings with no guidance about where they are used | 02:51 |
| morganfainberg | we could move it to KVS section but i think it'd net us the same issue. | 02:52 |
| YorikSar | dstanek: I don't oppose them, just... I think I'm too familiar with this corner of Keystone config now :) | 02:52 |
| dstanek | morganfainberg: but that would mean we'd either make existing configurations invalid or support both right? | 02:52 |
| dstanek | YorikSar: i hear ya :-) | 02:53 |
| *** wwriverrat has left #openstack-keystone | 02:53 | |
| morganfainberg | dstanek, something like that | 02:53 |
| YorikSar | dstanek: Let's see what I'll say in couple months when I forget all about this :) | 02:53 |
| morganfainberg | dstanek, oh .. dunno who you need to bug about it... but could we convince RAX to do a 3rd party gate on Jython running keystone... and maybe document how to make it run? | 02:53 |
| *** _cjones_ has quit IRC | 02:53 | |
| morganfainberg | dstanek, it's an interesting deployment model for $reasons_rackspace_deploys_it_llike_that$ | 02:54 |
| dstanek | morganfainberg: probably - where do i find out how to make a third party gate? | 02:54 |
| YorikSar | morganfainberg: Rackspace deploys OpenStack in Jython? | 02:54 |
| morganfainberg | dstanek, antaeya is the gate keeper of 3rd party ci http://ci.openstack.org/third_party.html | 02:54 |
| morganfainberg | YorikSar, keystone | 02:55 |
| * YorikSar found a thought to get his eyes open | 02:55 | |
| dstanek | YorikSar: not everything, keystone for sure | 02:55 |
| YorikSar | wow | 02:55 |
| dstanek | their legacy system was java and they wanted to reuse it as a backend (i think) so jython let me do it "easily" | 02:56 |
| *** meker12 has quit IRC | 02:56 | |
| dstanek | s/their/our/ | 02:56 |
| ayoung | I've been reading mail slowly all day. Mailbox was clear this morning, now there are 600+ messages, and it is almost all #openstack* | 02:56 |
| YorikSar | dstanek: Oh... And how good does that perform? | 02:56 |
| morganfainberg | YorikSar, based on the convos i've had.. passibly | 02:56 |
| morganfainberg | better than eventlet | 02:56 |
| morganfainberg | ;) | 02:56 |
| YorikSar | morganfainberg: Huh... I think I should tell that to our 'scaling' team, let them run some benchmarks :) | 02:57 |
| morganfainberg | ayoung, oh you'll like this... i'm definitely bringing up the possiblity of axing eventlet (for keystone). to open discussion on this front soon. (obviously with multiple cycles of deprecation) | 02:58 |
| ayoung | morganfainberg, so the problem, as I understand it, is the oslo messaging. THat side of the house likes singlethreaded apps | 02:58 |
| ayoung | oh, just for Keystone | 02:58 |
| morganfainberg | ayoung, yep. | 02:58 |
| ayoung | I thought you meant everywhere | 02:58 |
| morganfainberg | ayoung, i wish | 02:58 |
| ayoung | cuz of the memcached issue | 02:59 |
| morganfainberg | ayoung, no cause eventlet sucks issue ;) | 02:59 |
| morganfainberg | ayoung, was talking with infra and we know eventlet deployment is sub-par compared to other options.. we shoudl either figure out how to make eventlet deploy better or focus on making the real methods way better | 02:59 |
| morganfainberg | and.. i agree. | 02:59 |
| ayoung | morganfainberg, I meant "Make eventlet go away everywhere because eventlet to memcach is broken." | 03:00 |
| morganfainberg | ayoung, oh haha i think that is the wrong argument for ridding us of eventlet ;) | 03:01 |
| ayoung | morganfainberg, I thought you were saying it was a show stopper | 03:01 |
| morganfainberg | but it's a side benefit | 03:01 |
| morganfainberg | naaaah | 03:01 |
| morganfainberg | i'm not that insane... | 03:01 |
| morganfainberg | most days | 03:01 |
| ayoung | morganfainberg, BTW, congrats. Between landing willingly at HP and being consumed by Cisco, I know which I would prefer | 03:01 |
| morganfainberg | hehe | 03:02 |
| morganfainberg | the real question will be how much $ do i end up walking away with from the options i had vested/purchased | 03:02 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 03:03 | |
| morganfainberg | those guys are excited though, and i'm really happy for em. | 03:03 |
| ayoung | morganfainberg, OK, remember the mox hell I was in yesterday? Still there. Trying to figure out how to get a testable version of D-O-A to work with Keystone. THought I had it: was going to make "authenticate" serssion aware, but I am tripping over the fact that ...you know what, no one cares about this but Jamie. I'll bug him after the honeymoon | 03:03 |
| morganfainberg | ayoung, i can try and help you tomorrow on the mox front in the morning. | 03:03 |
| ayoung | morganfainberg, if I were a founder, sure. For the average worker bee, does it mean that they are really going to get much out of it. | 03:03 |
| ayoung | morganfainberg, the problem is not mox per se but rather the fact that to use auth plugins, DOA needs to know too much about keystoneclient | 03:04 |
| morganfainberg | ayoung, right. | 03:04 |
| ayoung | and, looking at my "just get it working code" I should not be allowed to write code | 03:04 |
| *** stevemar has quit IRC | 03:04 | |
| morganfainberg | ayoung, i mean.. can we just back it to session like the other clients? | 03:05 |
| ayoung | morganfainberg, so that is what I am trying to do | 03:05 |
| ayoung | but...well, let me show you | 03:05 |
| *** stevemar has joined #openstack-keystone | 03:05 | |
| ayoung | https://review.openstack.org/#/c/121281/1/openstack_auth/backend.py morganfainberg see the nasty auth_ref stuff | 03:06 |
| morganfainberg | ooooh | 03:06 |
| morganfainberg | yeah | 03:06 |
| ayoung | morganfainberg, the old logic is this: | 03:06 |
| ayoung | first, just try to get a token, any token. | 03:06 |
| ayoung | but the new code makes that difficult | 03:06 |
| ayoung | hence my jumping all the way to the auth plugin to do that | 03:06 |
| ayoung | auth_ref, though, is that thing you were looking at before that wraps the token data | 03:07 |
| ayoung | it assumes (IIUC) that there is a service catalog | 03:07 |
| ayoung | now, the old code talks about an unscoped auth_ref, which seems like a contradiction in terms to me | 03:08 |
| ayoung | assumine auth_ref is an access.AccessInfo | 03:08 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Handle federated tokens https://review.openstack.org/121146 | 03:08 |
| morganfainberg | it probably is | 03:09 |
| morganfainberg | or should be | 03:09 |
| ayoung | considering that get_auth_ref in the v3 code ends with | 03:09 |
| ayoung | return access.AccessInfoV3(resp.headers['X-Subject-Token'], | 03:09 |
| ayoung | **resp_data) | 03:09 |
| *** zzzeek has joined #openstack-keystone | 03:09 | |
| ayoung | I'm pretty sure it is | 03:09 |
| *** marcoemorais has joined #openstack-keystone | 03:09 | |
| morganfainberg | ayoung, my brain is already fried. | 03:10 |
| morganfainberg | ayoung, but ick :( | 03:10 |
| ayoung | morganfainberg, this has been my life for this release. Poor jamie | 03:10 |
| ayoung | he's been living in this code for a year+ now | 03:10 |
| morganfainberg | ayoung, i know. | 03:10 |
| morganfainberg | he's got a few week break though, so.. maybe he'll be a bit refreshed | 03:11 |
| *** marcoemorais1 has joined #openstack-keystone | 03:11 | |
| morganfainberg | woohoo ksc has no outstanding release blockers! | 03:12 |
| morganfainberg | yay stevemar, ayoung, jamielennox|away, and marekd, for working through those. | 03:12 |
| morganfainberg | and lots of other people too | 03:12 |
| morganfainberg | >.> | 03:12 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/service_catalog.py#n32 morganfainberg so this is the root of the problem | 03:13 |
| *** marcoemorais has quit IRC | 03:14 | |
| morganfainberg | oh validate or blow up | 03:14 |
| ayoung | oh...wait. | 03:14 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/service_catalog.py#n313 | 03:14 |
| ayoung | heh | 03:14 |
| morganfainberg | ahh | 03:14 |
| ayoung | I was jumping to conclusions...I think I can just fix that in my test... | 03:14 |
| ayoung | just add methods to the kwargs | 03:15 |
| * morganfainberg is happy to be the sounding board. | 03:15 | |
| morganfainberg | ;) | 03:15 |
| ayoung | morganfainberg, ok. so I can move ahead | 03:17 |
| morganfainberg | cool | 03:17 |
| *** jimbaker has quit IRC | 03:17 | |
| stevemar | morganfainberg, yay | 03:17 |
| ayoung | the issue is that I want to make the DOA code just call authenticate, like it did before, and I think I can do that...all I want to be different is how the client is rreated, but I might have to change the unscoped->scoped transition to use the same client...that should be OK | 03:18 |
| *** jimbaker has joined #openstack-keystone | 03:20 | |
| morganfainberg | ayoung, that sounds reasonable | 03:20 |
| *** jimbaker has quit IRC | 03:20 | |
| *** jimbaker has joined #openstack-keystone | 03:20 | |
| morganfainberg | ayoung, it shou;dn't be awful to make that transition at all | 03:20 |
| ayoung | we'll see...this code has taken pretty much the whole release, and it still not review ready | 03:20 |
| morganfainberg | ayoung, do you need/want someone to pickup the enumerate and the tests for the "safer enabled check"? | 03:22 |
| morganfainberg | ayoung, those are the two outstanding bits of code you're working on for keystone/ksc/middleware i think that are RC blockers or RC-potential | 03:22 |
| *** wwriverrat1 has joined #openstack-keystone | 03:28 | |
| ayoung | morganfainberg, I'll knock them out tomorrow. I will probably need this change as well | 03:31 |
| morganfainberg | ayoung, makes sense | 03:31 |
| ayoung | it should be straightforward to review. Its just making another call that used to to direct token things make use of the session if provided | 03:32 |
| ayoung | running the tests now | 03:32 |
| *** ayoung has quit IRC | 03:33 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: PERFORMANCE TEST - DNM https://review.openstack.org/122308 | 03:33 |
| *** zzzeek has quit IRC | 03:34 | |
| *** jasonsb has joined #openstack-keystone | 03:34 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Make client.authenticate use session if provided https://review.openstack.org/122309 | 03:35 |
| *** wwriverrat1 has left #openstack-keystone | 03:37 | |
| *** morgan_remote_ has joined #openstack-keystone | 03:38 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 03:44 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Make client.authenticate use session if provided https://review.openstack.org/122309 | 03:44 |
| *** ayoung has joined #openstack-keystone | 03:50 | |
| *** wwriverrat has joined #openstack-keystone | 03:51 | |
| ayoung | morgan_remote_, check me on this: If I have token, I can request a token. I don;t need any other data. So making validate_token a protected call gives no real protection, right? | 03:51 |
| *** hugokuo has joined #openstack-keystone | 03:53 | |
| *** oomichi has joined #openstack-keystone | 03:53 | |
| openstackgerrit | Kui Shi proposed a change to openstack/keystone: Add memcached_backend configuration https://review.openstack.org/122037 | 03:54 |
| hugokuo | morning | 03:54 |
| hugokuo | hi Guys, | 03:54 |
| hugokuo | I'd like to implement Rackspace-style authentication in my Keystone instance. How could I find the resource ? | 03:55 |
| hugokuo | My Keystone is in Havana | 03:55 |
| *** ayoung has quit IRC | 03:57 | |
| *** wanghong has joined #openstack-keystone | 04:07 | |
| *** k4n0 has joined #openstack-keystone | 04:46 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 04:52 | |
| *** wanghong has quit IRC | 04:54 | |
| *** stevemar has quit IRC | 05:06 | |
| *** wanghong has joined #openstack-keystone | 05:07 | |
| *** stevemar has joined #openstack-keystone | 05:07 | |
| *** HenryG has quit IRC | 05:09 | |
| *** achampion has joined #openstack-keystone | 05:13 | |
| *** achampio1 has quit IRC | 05:15 | |
| *** rushiagr_away is now known as rushiagr | 05:16 | |
| *** harlowja is now known as harlowja_away | 05:20 | |
| *** HenryG has joined #openstack-keystone | 05:22 | |
| morganfainberg | hugokuo, i'm not sure what to recommend as I'm not 100% familiar with the RAX style of auth (compared to say default keystone auth). Your best bet is to ask dstanek, but I can look into this a bit more tomorrow and see what is out there. | 05:36 |
| hugokuo | marcoemorais1: That'd be great to have any clues. THX | 05:37 |
| morganfainberg | hugokuo, what timezone are you in? I'll try and circle back when it's not close to midnight here. | 05:37 |
| morganfainberg | hugokuo, it's been a long day, and i don't want to send you down the wrong path. | 05:37 |
| *** alex_xu has quit IRC | 05:39 | |
| hugokuo | morganfainberg: I'm located in HK (hongKong timezone | 05:39 |
| *** alex_xu has joined #openstack-keystone | 05:39 | |
| hugokuo | appreciate | 05:40 |
| morganfainberg | hugokuo, ok I'll do my best to catch you tomorrow. | 05:40 |
| morganfainberg | hugokuo, we'll see what we can track down. but I *think* RAX uses a custom extension to the API | 05:41 |
| morganfainberg | hugokuo, i'll defer to the RAX employees that work on Keystone though for a definite answer. | 05:41 |
| *** openstackgerrit_ has joined #openstack-keystone | 05:45 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: PERFORMANCE TEST - DNM https://review.openstack.org/122308 | 05:47 |
| *** david-lyle has quit IRC | 05:55 | |
| *** stevemar has quit IRC | 05:56 | |
| *** morganfainberg has quit IRC | 05:58 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 05:58 | |
| *** morgan_remote_ has quit IRC | 06:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/120695 | 06:08 |
| *** ukalifon1 has joined #openstack-keystone | 06:11 | |
| *** morganfainberg has joined #openstack-keystone | 06:13 | |
| *** ajayaa has joined #openstack-keystone | 06:15 | |
| *** jaosorior has joined #openstack-keystone | 06:21 | |
| *** afazekas has joined #openstack-keystone | 06:34 | |
| *** jschwarz has joined #openstack-keystone | 06:35 | |
| jschwarz | hi guys | 06:35 |
| jschwarz | for some reason, on my devstack setup, when I try to create a new VM neutron-server goes about an Unauthorized exception in the nova notifier part of code | 06:36 |
| jschwarz | any ideas? :< | 06:36 |
| *** henrynash has joined #openstack-keystone | 06:41 | |
| *** jamielennox|away has quit IRC | 07:06 | |
| *** andreaf has quit IRC | 07:08 | |
| *** jschwarz is now known as jschwarz|afk | 07:10 | |
| *** marcoemorais1 has quit IRC | 07:11 | |
| *** lufix has joined #openstack-keystone | 07:13 | |
| *** jschwarz|afk has quit IRC | 07:16 | |
| *** garnav has joined #openstack-keystone | 07:21 | |
| *** rodrigods has quit IRC | 07:22 | |
| marekd | morganfainberg: +100 for lack of RC blockers! | 07:25 |
| *** toddnni has quit IRC | 07:27 | |
| *** BAKfr has joined #openstack-keystone | 07:30 | |
| *** jamielennox|away has joined #openstack-keystone | 07:31 | |
| *** jamielennox|away is now known as jamielennox | 07:32 | |
| *** rodrigods has joined #openstack-keystone | 07:34 | |
| *** morganfainberg has quit IRC | 07:35 | |
| *** alex_xu has quit IRC | 07:37 | |
| *** morganfainberg has joined #openstack-keystone | 07:39 | |
| *** marekd has quit IRC | 07:39 | |
| *** alex_xu has joined #openstack-keystone | 07:45 | |
| *** openstackgerrit_ has joined #openstack-keystone | 07:49 | |
| *** afazekas has quit IRC | 07:53 | |
| *** afazekas has joined #openstack-keystone | 07:56 | |
| *** marekd has joined #openstack-keystone | 08:00 | |
| *** jschwarz|afk has joined #openstack-keystone | 08:00 | |
| *** jamielennox has quit IRC | 08:02 | |
| *** openstackgerrit_ has joined #openstack-keystone | 08:03 | |
| *** meker12 has joined #openstack-keystone | 08:04 | |
| *** jamielennox has joined #openstack-keystone | 08:13 | |
| *** jschwarz|afk is now known as jschwarz | 08:14 | |
| *** jschwarz_ has joined #openstack-keystone | 08:31 | |
| *** jschwarz has quit IRC | 08:33 | |
| *** toddnni has joined #openstack-keystone | 08:35 | |
| openstackgerrit | jun xie proposed a change to openstack/python-keystoneclient: Fix a doc_string error https://review.openstack.org/122356 | 08:36 |
| *** k4n0 has quit IRC | 08:37 | |
| *** meker12 has quit IRC | 08:48 | |
| *** meker12 has joined #openstack-keystone | 08:49 | |
| *** aix has joined #openstack-keystone | 08:51 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 08:52 | |
| *** k4n0 has joined #openstack-keystone | 08:53 | |
| openstackgerrit | henry-nash proposed a change to openstack/python-keystoneclient: Add support for endpoint policy. https://review.openstack.org/122367 | 09:09 |
| openstackgerrit | henry-nash proposed a change to openstack/python-keystoneclient: Add support for endpoint policy. https://review.openstack.org/122367 | 09:11 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Ensure identity sql driver supports domain-specific configuration. https://review.openstack.org/121246 | 09:17 |
| *** k4n0 has quit IRC | 09:22 | |
| *** andreaf_ is now known as andreaf | 09:34 | |
| *** k4n0 has joined #openstack-keystone | 09:35 | |
| garnav | Hi all, quick question | 09:42 |
| garnav | s it possible to use other Content-Type appart from application/json? Its a requirement for a keysonte extension Im working on | 09:42 |
| garnav | thanks in advance | 09:42 |
| openstackgerrit | Endre Karlson proposed a change to openstack/python-keystoneclient: Make Keystone use CLI Plugin https://review.openstack.org/121523 | 09:45 |
| *** jschwarz_ has left #openstack-keystone | 09:47 | |
| andreaf | ukalifon1: ping - I fixed my patch and it's now merged - I verified that your test now works as expected | 09:52 |
| andreaf | ukalifon1: https://review.openstack.org/121562 | 09:52 |
| andreaf | ukalifon1: and here you can see your test passing: https://review.openstack.org/#/c/115279/ | 09:53 |
| ukalifon1 | andreaf: yes, I grabbed your fix yesterday and saw that it works. Many thanks ! | 10:19 |
| andreaf | ukalifon1: glad I could help | 10:21 |
| *** meker12 has quit IRC | 10:28 | |
| *** meker12 has joined #openstack-keystone | 10:29 | |
| *** meker12 has quit IRC | 10:33 | |
| *** oomichi has quit IRC | 10:37 | |
| *** dims has joined #openstack-keystone | 10:48 | |
| *** rodrigods_ has joined #openstack-keystone | 10:53 | |
| *** dims has quit IRC | 10:55 | |
| *** dims has joined #openstack-keystone | 10:56 | |
| *** dims has quit IRC | 11:00 | |
| *** dims has joined #openstack-keystone | 11:06 | |
| *** aix has quit IRC | 11:08 | |
| openstackgerrit | Stuart McLaren proposed a change to openstack/keystonemiddleware: Add composite authentication support https://review.openstack.org/108384 | 11:13 |
| *** dims has quit IRC | 11:18 | |
| *** dims has joined #openstack-keystone | 11:18 | |
| *** dims_ has joined #openstack-keystone | 11:19 | |
| *** afaranha has left #openstack-keystone | 11:22 | |
| *** dims has quit IRC | 11:22 | |
| *** rodrigods_ has quit IRC | 11:28 | |
| *** soulxu_ has joined #openstack-keystone | 11:29 | |
| *** alex_xu has quit IRC | 11:32 | |
| *** henrynash has quit IRC | 11:34 | |
| *** diegows has joined #openstack-keystone | 11:35 | |
| *** aix has joined #openstack-keystone | 11:38 | |
| *** soulxu__ has joined #openstack-keystone | 11:43 | |
| *** soulxu_ has quit IRC | 11:47 | |
| *** dhellmann is now known as dhellmann_ | 11:52 | |
| *** meker12 has joined #openstack-keystone | 11:53 | |
| *** soulxu__ has quit IRC | 11:53 | |
| *** soulxu__ has joined #openstack-keystone | 11:53 | |
| *** meker12 has quit IRC | 11:53 | |
| *** meker12 has joined #openstack-keystone | 11:54 | |
| *** achampion has quit IRC | 11:55 | |
| *** soulxu__ has quit IRC | 11:58 | |
| *** soulxu__ has joined #openstack-keystone | 11:59 | |
| *** k4n0 has quit IRC | 12:01 | |
| *** soulxu_ has joined #openstack-keystone | 12:05 | |
| *** soulxu__ has quit IRC | 12:08 | |
| *** soulxu_ has quit IRC | 12:10 | |
| *** soulxu_ has joined #openstack-keystone | 12:10 | |
| *** meker12 has quit IRC | 12:12 | |
| *** meker12 has joined #openstack-keystone | 12:12 | |
| *** rushiagr is now known as rushiagr_away | 12:14 | |
| *** soulxu__ has joined #openstack-keystone | 12:16 | |
| *** diegows has quit IRC | 12:17 | |
| *** soulxu_ has quit IRC | 12:20 | |
| *** rushiagr_away is now known as rushiagr | 12:24 | |
| *** Tahmina has joined #openstack-keystone | 12:32 | |
| *** wap has joined #openstack-keystone | 12:37 | |
| *** gordc has joined #openstack-keystone | 12:37 | |
| wap | hi all | 12:38 |
| wap | i try to enable multiple worker in icehouse | 12:38 |
| wap | im following this patch | 12:38 |
| wap | https://launchpadlibrarian.net/179898469/keystone-multiple-workers.icehouse-backport.inplace.patch | 12:38 |
| wap | and this review: https://review.openstack.org/#/c/42967/ | 12:38 |
| wap | but i still cant run multiple keystone worker | 12:39 |
| wap | http://ur1.ca/i7lek | 12:39 |
| wap | it says AttributeError: 'module' object has no attribute 'ProcessLauncher' | 12:40 |
| wap | whats wwrong with proses launcher in icehouse? | 12:41 |
| *** miqui has joined #openstack-keystone | 12:41 | |
| marekd | morganfainberg: o/ Do you think devstack is ready for IDENTITY API v3 ? | 12:48 |
| *** dims_ has quit IRC | 12:51 | |
| *** dims has joined #openstack-keystone | 12:51 | |
| *** dims has quit IRC | 12:51 | |
| *** dims has joined #openstack-keystone | 12:52 | |
| *** jasondotstar has joined #openstack-keystone | 12:57 | |
| *** vdreamarkitex has quit IRC | 13:02 | |
| *** richm has joined #openstack-keystone | 13:04 | |
| *** meker12 has quit IRC | 13:05 | |
| *** meker12 has joined #openstack-keystone | 13:06 | |
| *** achampion has joined #openstack-keystone | 13:06 | |
| *** meker12 has quit IRC | 13:10 | |
| *** meker12 has joined #openstack-keystone | 13:14 | |
| wap | thanks all, i get it | 13:14 |
| *** wap has quit IRC | 13:14 | |
| *** vdreamarkitex has joined #openstack-keystone | 13:17 | |
| *** dhellmann_ is now known as dhellmann | 13:19 | |
| *** rodrigods_ has joined #openstack-keystone | 13:20 | |
| *** nkinder has quit IRC | 13:23 | |
| *** radez_g0n3 is now known as radez | 13:27 | |
| *** junhongl_ has joined #openstack-keystone | 13:27 | |
| *** henrynash has joined #openstack-keystone | 13:31 | |
| *** vdreamarkitex has quit IRC | 13:32 | |
| *** henrynash has quit IRC | 13:33 | |
| samuelmz | marekd, when I run devstack and then set OS_IDENTITY_API_VERSION to 3 I'm not able to run python-openstackclient D: | 13:35 |
| samuelmz | marekd, did you already have something similar? | 13:35 |
| *** afaranha has joined #openstack-keystone | 13:35 | |
| bknudson | Are we supposed to be doing a client release today? | 13:35 |
| marekd | samuelmz: i can run it, but for instance a project shipped with devstack (demo) seems to be not usable under v3 as it doesn't have domain. | 13:36 |
| marekd | samuelmz: what error did you get | 13:36 |
| bknudson | Looks like keystoneclient has a change to update requirements but it doesn't have oslo updates: https://review.openstack.org/#/c/116255/ | 13:36 |
| samuelmz | marekd, I got ERROR: openstackclient.shell Exception raised: Expecting to find domain in project - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error. (HTTP 400) | 13:37 |
| bknudson | that change is still going through global requirements: https://review.openstack.org/#/c/122408/ | 13:37 |
| bknudson | so once that merges hopefully we'll get an update in keystoneclient & keystonemiddleware | 13:37 |
| *** henrynash has joined #openstack-keystone | 13:37 | |
| samuelmz | marekd, with --debug http://paste.openstack.org/show/112858/ | 13:38 |
| marekd | samuelmz: yeah i had the same thing. | 13:38 |
| marekd | samuelmz: well, i thnk it;s not openstackclient | 13:39 |
| samuelmz | marekd, cool (or not) | 13:39 |
| samuelmz | marekd, it s on keystoneclient | 13:39 |
| marekd | but the fact that project was prepared under v2 | 13:39 |
| samuelmz | marekd, I was able to run it yesterday | 13:39 |
| marekd | samuelmz: and it doesn't have domains there. | 13:40 |
| marekd | and that's the problem. | 13:40 |
| marekd | is my understanding correct ^^ ? | 13:40 |
| rodrigods_ | what about keystone client old CLI? it stopped working here as well =( | 13:41 |
| samuelmz | marekd, I think keystoneclient is broken | 13:41 |
| marekd | samuelmz: if you have cycles maybe you could add a project through v3 | 13:42 |
| marekd | and then see if osc works. | 13:42 |
| samuelmz | marekd, cycles? I didnt understand what you're proposing .. | 13:43 |
| marekd | some time :-) | 13:43 |
| marekd | (like CPU cycles :P) | 13:43 |
| samuelmz | marekd, haha ,makes sensse :) | 13:43 |
| *** topol has joined #openstack-keystone | 13:46 | |
| *** meker12 has quit IRC | 13:48 | |
| *** meker12 has joined #openstack-keystone | 13:49 | |
| *** meker12 has quit IRC | 13:49 | |
| *** vdreamarkitex has joined #openstack-keystone | 13:50 | |
| *** meker12 has joined #openstack-keystone | 13:50 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Update 'Configure Federation' documentation. https://review.openstack.org/122415 | 13:50 |
| *** meker12 has quit IRC | 13:51 | |
| *** henrynash has quit IRC | 13:52 | |
| *** victsou has joined #openstack-keystone | 13:53 | |
| morganfainberg | bknudson, tagged that review (ksc) for a blocker | 13:53 |
| morganfainberg | bknudson, forgot to add itto the list yesterday | 13:53 |
| bknudson | morganfainberg: here's for ksm : https://review.openstack.org/#/c/119142/ | 13:54 |
| morganfainberg | bknudson, added as well | 13:54 |
| *** ukalifon2 has joined #openstack-keystone | 13:56 | |
| morganfainberg | bknudson, turns out switching to UUID tokens and running eventlet with a single worker slowed the gate down by ~20+ minutesfor the postgres job | 13:56 |
| bknudson | morganfainberg: I've got a review out to allow setting multiple eventlet workers. | 13:57 |
| morganfainberg | bknudson, i'm going to open a bug for us to up the default number of workers in keystone (I know you have a CR open for doing so in devstack) | 13:57 |
| *** andreaf is now known as andreaf_ | 13:57 | |
| morganfainberg | bknudson, or we could change ds-g to do it to something like n-proc | 13:57 |
| bknudson | morganfainberg: the gate wouldn't use the default... they have an option for it | 13:57 |
| morganfainberg | once yours merges. | 13:57 |
| *** ukalifon1 has quit IRC | 13:57 | |
| bknudson | morganfainberg: they didn't want n-proc because it uses too much memory | 13:57 |
| marekd | who is devstack's gatekeeper, dtroyer? | 13:58 |
| *** henrynash has joined #openstack-keystone | 13:58 | |
| morganfainberg | marekd, qa- team, dean is core on it though | 13:58 |
| marekd | morganfainberg: thanks. | 13:58 |
| morganfainberg | bknudson, i did a quick sample with 4 workers default and it made the postgres gate faster than the mod_wsgi one | 13:58 |
| bknudson | morganfainberg: how's that possible? | 13:59 |
| *** vdreamarkitex has quit IRC | 13:59 | |
| morganfainberg | one data point, but *shrug* | 13:59 |
| morganfainberg | second datapoint shows it closer to the standard 1h mark like the others | 13:59 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 13:59 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/119142 | 13:59 |
| morganfainberg | https://review.openstack.org/#/c/122308/ | 13:59 |
| bknudson | mod_wsgi seems to re-initialize the application a few times. | 13:59 |
| morganfainberg | bknudson, thats normal. | 14:00 |
| bknudson | https://review.openstack.org/#/c/111620/ looks good! | 14:00 |
| morganfainberg | cool! | 14:00 |
| *** ajayaa has quit IRC | 14:00 | |
| henrynash | morganfainberg:…ok, fixed thta issue | 14:00 |
| morganfainberg | henrynash, yay! thanks for working on that :) | 14:00 |
| bknudson | oh, wait, it doesn't have oslo.config | 14:00 |
| morganfainberg | bknudson, doh! | 14:01 |
| bknudson | still waiting for https://review.openstack.org/#/c/122408/ in requirements | 14:01 |
| morganfainberg | bknudson, ok so with your fix to devstack we just need ds-g to set an appropriate number of workers. I think i'm also going to spin off a specific eventlet tempest run for us that is only run under keystone (for now) | 14:02 |
| *** vdreamarkitex has joined #openstack-keystone | 14:02 | |
| henrynash | morganfainberg” also *trying* to get this in to the cleint: https://review.openstack.org/#/c/122367/ | 14:02 |
| bknudson | morganfainberg: I think there is a review for d-g or it's merged already to set the option. | 14:03 |
| morganfainberg | bknudson, ah let me check. that would be good | 14:03 |
| bknudson | morganfainberg: https://review.openstack.org/#/c/121242/ -- it's WIP | 14:04 |
| bknudson | morganfainberg: then they try to set the default in devstack -- https://review.openstack.org/#/c/122269/ | 14:05 |
| bknudson | so it's caught in a review war as they say. | 14:05 |
| morganfainberg | bknudson, ok so the simplest is if we make our default something not *1* and worry about the devstack review war | 14:05 |
| morganfainberg | later | 14:05 |
| * morganfainberg checks novas default | 14:05 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:10 | |
| *** nkinder has joined #openstack-keystone | 14:10 | |
| *** zzzeek has joined #openstack-keystone | 14:19 | |
| *** david-lyle has joined #openstack-keystone | 14:20 | |
| bknudson | the others default to n-cpu | 14:21 |
| *** meker12 has joined #openstack-keystone | 14:26 | |
| *** meker12 has joined #openstack-keystone | 14:26 | |
| *** david-lyle has quit IRC | 14:27 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: PERFORMANCE TEST - DNM https://review.openstack.org/122308 | 14:30 |
| morganfainberg | bknudson, yeah so that is the what we're going to do, based on chat in -qa we may want devstack to have a separate knob for either just 'main_workers' or both 'main' and 'admin' for keystone (not tied to the global API_WORKERS setting | 14:32 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add info about pysaml2 into federation docs. https://review.openstack.org/122433 | 14:32 |
| morganfainberg | bknudson, ^ that review is just testing the change to see roughly where we land. in either case n-cpu should be the default, i'll open a bug on it now and tag to juno-RC | 14:32 |
| bknudson | morganfainberg: going to change devstack to set API_WORKERS to n-cpu? | 14:32 |
| bknudson | morganfainberg: I think the only reason we didn't have keystone default to n-cpu workers is because the change came late in the prev release. | 14:33 |
| morganfainberg | bknudson, there was discussion in openstack-qa that for keystone we may want that as default in devstack. | 14:33 |
| morganfainberg | bknudson, ++ makes sense to me | 14:33 |
| *** diegows has joined #openstack-keystone | 14:33 | |
| bknudson | we've got internal tempest here where we set multiple workers. so it has been tested more now. | 14:34 |
| morganfainberg | bknudson, keystone is a bit special :P which means the other APIs might get set to n-cpu with a min of 2, we might always be n-cpu. | 14:34 |
| henrynash | bknudson, morganfainberg: when you have a momemnet, let’s get https://review.openstack.org/#/c/121246/ back into the queue… | 14:34 |
| *** david-lyle has joined #openstack-keystone | 14:35 | |
| bknudson | henrynash: what changed? | 14:35 |
| morganfainberg | bknudson, https://bugs.launchpad.net/keystone/+bug/1371154 | 14:36 |
| uvirtbot | Launchpad bug 1371154 in keystone "increase default setting of workers to n-cpu" [Medium,Triaged] | 14:36 |
| henrynash | bknudson: line 112 of identity/core.py I had missed off the is_sql part (self._any_sql = new_config['driver'].is_sql) | 14:36 |
| bknudson | wasn't it just treated as a boolean? seems like it would work either way | 14:37 |
| bknudson | it's either None or an object that will be true-y | 14:37 |
| henrynash | bknudson: so I’d have kind of thought that too….but it definitely makes the difference | 14:39 |
| henrynash | bkundson: what happens is tha if the last driver was ldap….it would still set any_sql to true, even though is_sql was false | 14:41 |
| morganfainberg | henrynash, which is why it ended up being sortof intermittant | 14:41 |
| morganfainberg | and passing check but not gate. | 14:41 |
| *** packet has joined #openstack-keystone | 14:42 | |
| morganfainberg | yeah not failing on a local run for me now. | 14:42 |
| morganfainberg | henrynash, +2 again. | 14:43 |
| henrynash | morganfainberg: thx | 14:43 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Enumerate Projects with Unscoped Tokens https://review.openstack.org/106838 | 14:54 |
| *** jorge_munoz has quit IRC | 14:55 | |
| *** rushiagr is now known as rushiagr_away | 14:56 | |
| *** ukalifon2 has quit IRC | 14:59 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Enumerate Projects with Unscoped Tokens https://review.openstack.org/106838 | 15:01 |
| *** rodrigods_ has quit IRC | 15:02 | |
| *** stevemar has joined #openstack-keystone | 15:04 | |
| *** ayoung has joined #openstack-keystone | 15:04 | |
| marekd | morganfainberg: new keystoneclient will be released today or it's just some bugfixing period closing? | 15:04 |
| morganfainberg | marekd, we need an oslo sync and we're waiting for a patch to make it through requirements first | 15:04 |
| *** andreaf has joined #openstack-keystone | 15:06 | |
| *** victsou has quit IRC | 15:07 | |
| *** Sharath_ has joined #openstack-keystone | 15:07 | |
| marekd | morganfainberg: aha. Cause there is some problem and I am not sure how to respond to this: https://bugs.launchpad.net/python-keystoneclient/+bug/1371085 . Tests were passing before the release, they are indeed not passing now (when I tox -epy27 version fetched from pypi). On the other hand, the problematic line was removed as a result of some refactoring. So it's not in github anymore. How can we classify this bug? | 15:08 |
| uvirtbot | Launchpad bug 1371085 in python-keystoneclient "saml2 unit tests are failing with testtools 0.9.39" [Undecided,New] | 15:08 |
| Sharath_ | Hi, Am new to openstack, started with keystone , have put some logs to get the control flow , but its not clear to me , can you please tell me the one control flow , with that i can findout other flows and try to contribute to the community | 15:10 |
| dstanek | morganfainberg: should there just be one call to super() instead of two calls to the parent's setUp? | 15:11 |
| henrynash | morganfainberg, bknudson: I’d really like to try and get https://review.openstack.org/#/c/122367/ into that keystoneclient release…it’s pretty standalone since it is the class for the new endpoint policy extensions | 15:11 |
| *** meker12_ has joined #openstack-keystone | 15:11 | |
| morganfainberg | dstanek, hm? | 15:11 |
| morganfainberg | dstanek, i think there shouldonly be one.. | 15:11 |
| *** meker12 has quit IRC | 15:12 | |
| dstanek | morganfainberg: yeah, not sure how that code slipped by | 15:12 |
| morganfainberg | ok i need to head out for an appt. today | 15:12 |
| Sharath_ | can any one please explain me one flow ? | 15:12 |
| morganfainberg | i'll be back online when i get to the coffee shop out that way. | 15:12 |
| morganfainberg | henrynash, i'm happy to review that when i'm back | 15:13 |
| ayoung | lbragstad, morganfainberg bknudson https://review.openstack.org/#/c/120592/2/keystone/token/providers/common.py,cm does not need a test | 15:13 |
| henrynash | morganfainberg: thx | 15:13 |
| marekd | dstanek: you are talking about my code? | 15:13 |
| dstanek | morganfainberg: ok, don't rush to get back online | 15:13 |
| ayoung | current testing ensures the change doesn;t break | 15:13 |
| dstanek | marekd: thatbug you mentioned | 15:13 |
| marekd | dstanek: i was inheriting from two classes and needed attributes from both parents. | 15:14 |
| ayoung | and all of the testing in the world will not prevent someone else from doing an end run around the public API like this one was doing | 15:14 |
| morganfainberg | dstanek, nah not rushing :) got a 60mi drive. gonna relax the way out there and enjoy coffee when i arrive. | 15:14 |
| Sharath_ | Hi Morgan , | 15:14 |
| marekd | dstanek: anyway, we can say the fix is already in the master branch. So it should be treated as invalid, I don't think so. Fixed? | 15:15 |
| morganfainberg | Sharath_, hi, i'm sorry i need to get on the road, i'll be back a bit later and can discuss and/or help you out if someone else here is unable to do so before i'm back. | 15:15 |
| bknudson | marekd: I was able to recreate with 0.10.1 but not with master... so I assume we fixed it at some point | 15:15 |
| Sharath_ | Sure Morgan , i will wait for you , Thank you:) | 15:15 |
| marekd | bknudson: i had the same situation. as i write, the problematic line was removed actually as a part of some refactoring or something like that. | 15:16 |
| *** Tahmina has quit IRC | 15:16 | |
| morganfainberg | Sharath_, but i'm pretty sure you can get some further help here in the channel before i'm back, just be patient and don't hesitate to directly ask the questions you have. we're pretty good about responding overall. | 15:16 |
| ayoung | Sharath_, start with keystone/auth/controller | 15:16 |
| morganfainberg | ayoung, ++ thanks :) | 15:16 |
| bknudson | marekd: if there was a bug for the change that fixed it then could mark as a dup or just indicate it was fixed already with that change. | 15:16 |
| marekd | bknudson: there was no bug for that. | 15:17 |
| Sharath_ | Hi ayong | 15:17 |
| Sharath_ | when i install keystone , i started executed some commands in console like ,. keystone --debug token-get | 15:18 |
| ayoung | Sharath_, yep | 15:18 |
| ayoung | so you see that calls the keystone server on the AUTH_URL | 15:18 |
| ayoung | Sharath_, assuming you got rid of OS_SERVER_TOKEN etc | 15:19 |
| ayoung | the username, password, and auth_url all become the URL and POST payload to the token creation process | 15:19 |
| Sharath_ | when i see in the log screen , its hitting to the keystone/common/wsgi.py | 15:19 |
| ayoung | Sharath_, there is a middleware pipeline defined in /etc/keystone/keystone-paste.ini | 15:20 |
| Sharath_ | here i expect how call is going from one class to other , | 15:20 |
| ayoung | in the case of what you are doing, it is V2 token creation, which will go down the [main] public_api pipeline: | 15:21 |
| ayoung | [pipeline:public_api] | 15:21 |
| ayoung | pipeline = sizelimit url_normalize build_auth_context token_auth admin_token_aut | 15:21 |
| ayoung | h xml_body_v2 json_body ec2_extension user_crud_extension public_service | 15:21 |
| Sharath_ | ok ayong , can it possible to explain this flow to me ? | 15:21 |
| ayoung | Sharath_, each of those are defined as python classes earlier in the paste file | 15:21 |
| *** junhongl_ has quit IRC | 15:21 | |
| ayoung | the last one in the list is the one that performs the real logic | 15:22 |
| henrynash | dtsanek, lbragstad: if you have any cycles, trying to get this in for teh client today: https://review.openstack.org/#/c/122367/ (it is pretty standalone…since it covers the class for the endpoint policy extensio) | 15:22 |
| marekd | dstanek: as a future reference, what is the good way if my test class for some reason inherits from >1 classes and I need both parents call setUp() ? | 15:22 |
| ayoung | public_service will take the URL and map it to a python class. the public service is a composite, and you kindof need to know where to look to find the piece you want | 15:22 |
| ayoung | Sharath_, but the start point is http://git.openstack.org/cgit/openstack/keystone/tree/keystone/service.py#n67 | 15:23 |
| ayoung | see token.routers.Router(), in there? That is the router for the /token code. You can find that in | 15:24 |
| *** cjellick has joined #openstack-keystone | 15:24 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/routers.py#n18 | 15:24 |
| *** Sharath__ has joined #openstack-keystone | 15:24 | |
| ayoung | and a POST to /v2.0/tokens will be mapped here: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/routers.py#n21 | 15:25 |
| *** Sharath_ has quit IRC | 15:25 | |
| ayoung | that is: the authenticate methdo of the token_controller, defined a line higher token_controller = controllers.Auth() | 15:25 |
| ayoung | Sharath__, no Private messages please | 15:25 |
| Sharath__ | ok sorry ayong | 15:25 |
| ayoung | NP, just that we can point people to this log in the future. | 15:26 |
| Sharath__ | can u please repeat it once again , due to disconnection i lost conversation | 15:26 |
| ayoung | Sharath__, I can do better | 15:26 |
| ayoung | Sharath__, http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2014-09-18.log | 15:26 |
| Sharath__ | Ok thanks ayong | 15:27 |
| ayoung | Heh, there is a 'u' in my nick | 15:27 |
| ayoung | you won't get my attention in mu IRC client if you miss that | 15:27 |
| ayoung | mu->my | 15:27 |
| Sharath__ | ok ayoung | 15:27 |
| ayoung | Sharath__, I really don't mind explainin this. | 15:28 |
| ayoung | OK, so I'll keep going, read at your own pace | 15:28 |
| Sharath__ | Ok kevin | 15:28 |
| ayoung | so look at the implorts to see what controllers.Auth() means: in this case, it is keystone.token.controllers. The Auth Class' authenticate method is defined http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/controllers.py#n62 | 15:29 |
| ayoung | Sharath__, that logic is hard to follow, but the concise description is this: look up the user in the identity backend. Get their groups. Look up the role assignments in the assignment backend for (user, project) request, and create a token. Persist the token to the backend and return the data to the user | 15:31 |
| ayoung | THat method is the heart of Keystone, and pretty much everything else feeds in to it | 15:31 |
| ayoung | There is a comparable method for the v3 API in keystone/auth/controllers. | 15:32 |
| *** jaosorior has quit IRC | 15:32 | |
| Sharath__ | Oh ok Kevin | 15:32 |
| *** openstackgerrit has quit IRC | 15:33 | |
| ayoung | We've taken most of the logic for creating the token and put it into keystone/tokens/provider.py, with some plugins in the providers sub directory. | 15:33 |
| ayoung | Sharath__, the rest is commentary, go and study:) | 15:33 |
| *** wwriverrat has quit IRC | 15:34 | |
| Sharath__ | So flow will go like this Service , /keystone/service.py -> keystone/token/routers.py -> controllers -> | 15:34 |
| *** packet has quit IRC | 15:34 | |
| Sharath__ | finally response will get from wsgi.py ? | 15:34 |
| Sharath__ | is am rt Kevin ? | 15:35 |
| *** joesavak has joined #openstack-keystone | 15:40 | |
| dstanek | marekd: calling super() will call both parents | 15:41 |
| dstanek | marekd: that is if all classes are super() friendly | 15:42 |
| marekd | dstanek: ok, thanks! | 15:42 |
| *** _cjones_ has joined #openstack-keystone | 15:49 | |
| dstanek | is there anything else that we *need* in before we release a client? | 15:50 |
| *** Sharath__ has quit IRC | 15:55 | |
| *** _cjones_ has quit IRC | 15:57 | |
| *** _cjones_ has joined #openstack-keystone | 15:57 | |
| *** jasonsb has quit IRC | 15:58 | |
| *** _cjones_ has quit IRC | 15:59 | |
| bknudson | dstanek: we need the requirements versions for oslo libs updated to not be alpha | 15:59 |
| *** _cjones_ has joined #openstack-keystone | 15:59 | |
| *** vdreamarkitex has quit IRC | 15:59 | |
| *** nkinder has quit IRC | 16:00 | |
| *** openstackgerrit has joined #openstack-keystone | 16:01 | |
| henrynash | dtsanek: as I said, I’d like to get https://review.openstack.org/#/c/122367/ in | 16:02 |
| *** lufix has quit IRC | 16:03 | |
| *** Sharath_ has joined #openstack-keystone | 16:06 | |
| *** wwriverrat has joined #openstack-keystone | 16:06 | |
| *** afazekas has quit IRC | 16:08 | |
| *** rodrigods has quit IRC | 16:08 | |
| *** henrynash has quit IRC | 16:08 | |
| *** rodrigods has joined #openstack-keystone | 16:11 | |
| *** rodrigods has quit IRC | 16:11 | |
| *** rodrigods has joined #openstack-keystone | 16:11 | |
| *** marcoemorais has joined #openstack-keystone | 16:12 | |
| *** nkinder has joined #openstack-keystone | 16:13 | |
| *** BAKfr has quit IRC | 16:18 | |
| *** garnav has quit IRC | 16:22 | |
| *** Sharath_ has quit IRC | 16:34 | |
| dstanek | bknudson, stevemar, lbragstad: another +2+A on https://review.openstack.org/#/c/119142/ | 16:35 |
| nkinder | dstanek: there were some client things that jamielennox wanted to get in. Let me get his list. | 16:39 |
| nkinder | dstanek: looks like everything he wanted has merged | 16:40 |
| ayoung | nkinder, I have another client change for the Kerberos work. Its basically a refactoring from some of the logic I ewas doing in D-O-A that doesn't belong there: https://review.openstack.org/#/c/122309/ | 16:40 |
| *** packet has joined #openstack-keystone | 16:40 | |
| ayoung | nkinder, I'm working on cleaning it up, but there is possibly going to be more changes like that. | 16:41 |
| nkinder | morganfainberg: does it make sense to bug someone from infra to get another +2 on this before tomorrow? https://review.openstack.org/#/c/120261 | 16:41 |
| *** wwriverrat has left #openstack-keystone | 16:41 | |
| ayoung | nkinder, he might be travelling at the moment.... | 16:42 |
| nkinder | ayoung: ok, I can look at bugging someone | 16:42 |
| nkinder | ayoung: how goes the kerberos auth plugin work? | 16:42 |
| ayoung | nkinder, yes, please do | 16:42 |
| openstackgerrit | A change was merged to openstack/keystone: Ensure identity sql driver supports domain-specific configuration. https://review.openstack.org/121246 | 16:42 |
| ayoung | nkinder, I'm hacking through the tests for the DOA-use-session code to make them pass | 16:43 |
| ayoung | what I have works, and switches nicely between password and Kerberos based authentication, but I have a way to go to make it pass tests | 16:44 |
| ayoung | nkinder, since the DOA code is going to require a series of client fixes, I've been prioritizing getting them in clean | 16:44 |
| ayoung | otherwise, any DOA change will be, well, DOA | 16:44 |
| ayoung | arrival in gerrit that is | 16:45 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Catch AttributeError if no service catalog https://review.openstack.org/100714 | 16:46 |
| *** packet has quit IRC | 16:49 | |
| ayoung | nkinder, looking at the client code, and keeping tests from breaking is insanity inducing work. I fear for jamielennox 's sanity. | 16:50 |
| ayoung | He deserves hazardous duty pay or something | 16:51 |
| *** gyee has joined #openstack-keystone | 16:53 | |
| bknudson | there's nothing that stops us from doing another keystoneclient release tomorrow if we want | 16:59 |
| dstanek | bknudson: i was actually just about to get someone from -infra to help with tagging since nobody spoke up | 17:00 |
| *** packet has joined #openstack-keystone | 17:00 | |
| bknudson | dstanek: we should get the requirements updated first | 17:01 |
| *** jasonsb has joined #openstack-keystone | 17:01 | |
| dstanek | bknudson: is there a review for that already? | 17:01 |
| stevemar | dstanek, probably | 17:02 |
| dstanek | yup - https://review.openstack.org/#/c/116255/ | 17:02 |
| stevemar | should we do a middleware release too? | 17:02 |
| bknudson | dstanek: https://review.openstack.org/#/c/122408/ should be gating now | 17:02 |
| bknudson | dstanek: then it will have to be proposed to keystoneclient and keystonemiddleware | 17:02 |
| *** harlowja_away is now known as harlowja | 17:02 | |
| dstanek | ah, ok | 17:02 |
| dstanek | bknudson: will the bot automatically propose the changes or should i do it by hand to make it faster? | 17:05 |
| bknudson | dstanek: the bot will do it automatically | 17:05 |
| bknudson | I assume it runs quickly and not like once a day? | 17:06 |
| stevemar | bknudson, it does it pretty quickly | 17:08 |
| dstanek | asking in infra now. it may be turned off | 17:09 |
| dstanek | stevemar: i'd like to do a middleware release today, but there are a few outstanding reviews. not sure if they are required before the release or if we should release as is and do a minor release later | 17:10 |
| stevemar | dstanek, if we first we release KSC, does middleware need to change its version in requirements.txt | 17:11 |
| stevemar | ? | 17:11 |
| stevemar | might not need to.. but probably should | 17:11 |
| dstanek | i'm assuming that we need to | 17:12 |
| dstanek | i want to the the client release out the door pretty quickly so that i can concentrate on some of the other stuff | 17:12 |
| dstanek | stevemar: also it's not technically necessary since we >= the client version, but i think it's the right thing to do | 17:13 |
| rodrigods | can someone help me to check what's going in the gate failures here https://review.openstack.org/#/c/117784/ ? | 17:14 |
| rodrigods | check* | 17:14 |
| dstanek | has anyone started looking at the memcache pool reviews? | 17:17 |
| stevemar | dstanek, morgan's been on top of that, its... a bit complex | 17:18 |
| dstanek | stevemar: yep, i've been reviewing it over-and-over, but i think it's probably ready now - since Morgan was doing some of the work i think having another core look at it would be good | 17:20 |
| ayoung | nkinder, so now I am tripping over this: http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/httpclient.py#n70 | 17:20 |
| ayoung | nkinder, which looks like it went in mid July. | 17:21 |
| ayoung | I can hack around it, but it is a Hack | 17:21 |
| *** dhellmann is now known as dhellmann_ | 17:22 | |
| *** thiagop has joined #openstack-keystone | 17:23 | |
| *** packet has quit IRC | 17:25 | |
| *** packet has joined #openstack-keystone | 17:28 | |
| dstanek | ayoung, bknudson: have you guys had a chance to look at https://review.openstack.org/#/c/108384/ recently? | 17:29 |
| bknudson | dstanek: I haven't looked at it again recently. | 17:30 |
| *** openstackgerrit has quit IRC | 17:31 | |
| *** openstackgerrit has joined #openstack-keystone | 17:31 | |
| ayoung | dstanek, last I looked it was good...I thought it was on its way | 17:34 |
| dstanek | ayoung: nope not yet :-( | 17:37 |
| ayoung | dstanek, its important | 17:37 |
| *** nkinder has quit IRC | 17:38 | |
| *** bjornar_ has joined #openstack-keystone | 17:38 | |
| *** henrynash has joined #openstack-keystone | 17:38 | |
| dstanek | ayoung: yes, i agree. that's why i'm trying to get some focus on it :-) | 17:38 |
| ayoung | dstanek, let me deal with the session mishmash I'm on and I'll give it another look | 17:38 |
| dstanek | ayoung: great thanks! | 17:39 |
| *** _cjones_ has quit IRC | 17:46 | |
| *** rushiagr_away is now known as rushiagr | 17:46 | |
| *** _cjones_ has joined #openstack-keystone | 17:46 | |
| *** amcrn has joined #openstack-keystone | 17:47 | |
| *** _cjones_ has quit IRC | 17:51 | |
| *** nkinder has joined #openstack-keystone | 17:54 | |
| *** jasonsb has quit IRC | 17:55 | |
| *** packet has quit IRC | 17:56 | |
| *** _cjones_ has joined #openstack-keystone | 17:57 | |
| *** packet has joined #openstack-keystone | 17:58 | |
| *** afazekas has joined #openstack-keystone | 18:02 | |
| *** rushiagr is now known as rushiagr_away | 18:03 | |
| *** jasonsb has joined #openstack-keystone | 18:03 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add the processutils from oslo-incubator. https://review.openstack.org/122484 | 18:04 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Set the default number of workers when running under eventlet https://review.openstack.org/122485 | 18:04 |
| *** rushiagr_away is now known as rushiagr | 18:15 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Make client.authenticate use session if provided https://review.openstack.org/122309 | 18:16 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Set the default number of workers when running under eventlet https://review.openstack.org/122485 | 18:17 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add the processutils from oslo-incubator. https://review.openstack.org/122484 | 18:17 |
| *** rushiagr is now known as rushiagr_away | 18:20 | |
| *** rushiagr_away is now known as rushiagr | 18:20 | |
| *** jasonsb_ has joined #openstack-keystone | 18:21 | |
| *** marcoemorais has quit IRC | 18:24 | |
| *** jasonsb has quit IRC | 18:24 | |
| *** marcoemorais has joined #openstack-keystone | 18:24 | |
| *** jasonsb has joined #openstack-keystone | 18:27 | |
| *** ukalifon has joined #openstack-keystone | 18:28 | |
| *** jasonsb_ has quit IRC | 18:29 | |
| morganfainberg | bknudson, will address your comments in the worker patch, makes sense. posting in a couple of mins | 18:36 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Set the default number of workers when running under eventlet https://review.openstack.org/122485 | 18:37 |
| ayoung | dstanek, the composite patch required alot of test changes. More than I would expect | 18:37 |
| *** rushiagr is now known as rushiagr_away | 18:40 | |
| *** diegows has quit IRC | 18:41 | |
| ayoung | bknudson, on https://review.openstack.org/#/c/120592/2 needs new tests. | 18:41 |
| ayoung | But it does not | 18:41 |
| ayoung | look at it this way: say someone got code in there that was going direct to SQL and doing a select? Changing that would not require a tests | 18:42 |
| bknudson | if it was related to a bug where the server wasn't working as expected then there should be a test. | 18:42 |
| bknudson | if the test existed already then there wouldn't be a bug | 18:43 |
| *** afazekas has quit IRC | 18:45 | |
| *** jasonsb_ has joined #openstack-keystone | 18:45 | |
| ayoung | bknudson, no | 18:45 |
| *** victsou has joined #openstack-keystone | 18:45 | |
| ayoung | bknudson, this is nitpicking | 18:46 |
| ayoung | we used the wrong call. Yeah, I found a case where it was broken, but that does not mean it needs a new test to be correct | 18:46 |
| bknudson | ayoung: it's not asking for a spelling change, it's asking for testing coverage to make sure we don't reintroduce a bug. | 18:47 |
| bknudson | ayoung: it doesn't need a new test... an existing test could be changed to cover it. | 18:47 |
| ayoung | bknudson, there is no way to ensure we don't reintroduce the real problem | 18:47 |
| ayoung | which is the end run around the enabled check | 18:47 |
| ayoung | and I'm not rewriting the backend to defend against that | 18:47 |
| ayoung | this is just pedantry | 18:47 |
| ayoung | hmmm | 18:48 |
| *** jasonsb has quit IRC | 18:48 | |
| ayoung | I don';t think an existng test could cover it | 18:48 |
| *** dims has quit IRC | 18:48 | |
| *** rushiagr_away is now known as rushiagr | 18:49 | |
| *** dims has joined #openstack-keystone | 18:49 | |
| ayoung | bknudson, but even if there was no bug, this change would still be correct. | 18:49 |
| ayoung | Its a one liner clean up...do we really feel the need to make that much work for ourselves? | 18:50 |
| bknudson | the reason the fix had to be put there and the reason that it failed for you is because there wasn't a test. | 18:51 |
| ayoung | bknudson, its LDAP. THere are so many corner and edge cases as to be ludicris | 18:52 |
| ayoung | and by that, I mean the Wrapper from the mid nineties | 18:52 |
| morganfainberg | ayoung, i think the test is "was identity_api.assert_user_enabled" called | 18:52 |
| morganfainberg | ayoung, simple mock + test? | 18:52 |
| bknudson | the bug is that the LDAP entry doesn't have an enabled attribute. That should be the test. | 18:53 |
| ayoung | morganfainberg, can we quite this? The real thing we need is proper live LDAP test coverage, not this bandaid crap | 18:53 |
| ayoung | bknudson, "some" | 18:53 |
| ayoung | not every LDAP has that attribute | 18:53 |
| ayoung | infact, AD does enabled in a radically different way...not sure what that would look like | 18:53 |
| *** dims has quit IRC | 18:54 | |
| bknudson | even a proper live ldap test wouldn't catch this if all the entries had the enabled attribute. | 18:54 |
| morganfainberg | ayoung, LDAP coverage is not happening in Juno. it's a sizable change in devstack and/or use the new thing functional tests will use to run. | 18:54 |
| *** diegows has joined #openstack-keystone | 18:54 | |
| ayoung | SO please just accept this change, and lets all commit to geting proper ldap testing and stop wasting time triying to put a bandaid one a sucking chest wound | 18:54 |
| *** dims has joined #openstack-keystone | 18:54 | |
| morganfainberg | ayoung, but i agree with bknudson, we should just run a check where 'enabled' isn't there. should be fine. | 18:54 |
| bknudson | I can work on a test. | 18:55 |
| morganfainberg | or at the very least that the assert_enabled was called not just did the ref['enabled'] check | 18:55 |
| ayoung | bknudson, I know you can. But we all have better things to do with our time | 18:55 |
| ayoung | let me see if there is an existing test we can add that check to | 18:56 |
| *** packet has quit IRC | 18:56 | |
| *** jasonsb_ has quit IRC | 18:56 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Update Endpoint Filter API https://review.openstack.org/122046 | 18:56 |
| ayoung | OK, far more concerning is that I cannot see where the test "test_execute_trust_disabled_trustor" lives | 18:58 |
| ayoung | if anywhere... | 18:58 |
| *** rushiagr is now known as rushiagr_away | 18:58 | |
| ayoung | bknudson, morganfainberg am I missing something? I am fairly certain that was one of dolphm 's tests way back when, but I'm not seeing it | 19:00 |
| morganfainberg | ayoung, i don't see it in our master tree either | 19:01 |
| ayoung | shudder | 19:01 |
| ayoung | OK...I'll write the test | 19:01 |
| *** dhellmann_ is now known as dhellmann | 19:01 | |
| *** dhellmann is now known as dhellmann_ | 19:01 | |
| morganfainberg | ayoung, not in icehouse either. | 19:01 |
| morganfainberg | this may be the testing gap | 19:02 |
| ayoung | morganfainberg, nah, it would have been from Grizzly if ever | 19:02 |
| *** dhellmann_ has quit IRC | 19:02 | |
| ayoung | I'll write a v2 and v3 specific version, I think... | 19:02 |
| morganfainberg | ayoung, not even in grizzly | 19:02 |
| *** dhellmann has joined #openstack-keystone | 19:02 | |
| morganfainberg | afaict | 19:02 |
| ayoung | morganfainberg, yeah, that is what I am seeing too | 19:03 |
| ayoung | spooky | 19:03 |
| *** packet has joined #openstack-keystone | 19:04 | |
| *** marcoemorais has quit IRC | 19:04 | |
| ayoung | morganfainberg, the thing is, trusts span multiple backends. Test_v3_auth assumes a sql backend. THere is no LDAP specific test for trusts. Not sure where to put the test that would check the attribute. Not even sure I can check that the proper API is called without mocking the API... | 19:04 |
| ayoung | tell me if this would make sense: | 19:04 |
| *** marcoemorais has joined #openstack-keystone | 19:05 | |
| morganfainberg | dstanek, i think the ksc changes are all through? | 19:05 |
| ayoung | in the test, monkeypatch the call to self.identity_api.assert_user_enabled to set a boolean before calling the underlying function, and test for that boolean aftewards? | 19:05 |
| ayoung | ugh | 19:05 |
| morganfainberg | ah global reqs. | 19:05 |
| *** aix has quit IRC | 19:05 | |
| morganfainberg | ayoung, mock should be fine for that | 19:05 |
| morganfainberg | ayoung, then you can check to make sure the magicmock object was called with the right args | 19:06 |
| ayoung | morganfainberg, I'm not mocking out the entire identity backend | 19:06 |
| ayoung | the entire token pipeline needs to be called to test this. | 19:06 |
| morganfainberg | ayoung, so in your test with mock.patch.object(identity_api, <method you're checking was called>, return_value=True) | 19:06 |
| morganfainberg | or erm. you can't mock/monkey patch if this is a restful testcase | 19:06 |
| ayoung | yeah | 19:07 |
| ayoung | you just realized the scope, didn't you? | 19:07 |
| morganfainberg | but you could do it as a non-restful, just as a identity_api unit/functional | 19:07 |
| morganfainberg | we load identity_api. if identity_api calls assert_user_enabled, that is what we're looking for | 19:07 |
| ayoung | morganfainberg, its the token pipeline. Which is monolithic | 19:07 |
| morganfainberg | since the manager controlls that vs. the driver | 19:07 |
| ayoung | if we could break it into components, then, sure | 19:07 |
| *** victsou has quit IRC | 19:08 | |
| *** victsou_ has joined #openstack-keystone | 19:08 | |
| ayoung | Look at test_token_provider.py and you realize we are not testing at that level | 19:08 |
| ayoung | the real tests are in test_auth and the v3 restful equivalent | 19:09 |
| morganfainberg | ok so we're only caring about testing _populate_uder | 19:09 |
| *** victsou_ has quit IRC | 19:09 | |
| ayoung | well, for the real test gap, its about "a user created a trust, and then got disabled, and then athe trustee tried to use that trust to create a token" | 19:09 |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 19:11 |
| *** victsou_ has joined #openstack-keystone | 19:11 | |
| dstanek | morganfainberg: i was waiting until we have the dep update | 19:13 |
| morganfainberg | dstanek, yeah just saw that | 19:13 |
| morganfainberg | dstanek, need requirements update | 19:13 |
| morganfainberg | it's ~hr back atm. | 19:13 |
| dstanek | morganfainberg: ugg - it just got pushed back in the queue | 19:13 |
| morganfainberg | yep | 19:13 |
| *** _cjones_ has quit IRC | 19:13 | |
| dstanek | it was just at 13 mins! | 19:14 |
| morganfainberg | i expect KSC release will go in tonight | 19:14 |
| *** _cjones_ has joined #openstack-keystone | 19:14 | |
| morganfainberg | dstanek, are there any other ksc changes we want to push into the gate while we're waiting? or are we happy with the state of things | 19:14 |
| *** ukalifon has quit IRC | 19:14 | |
| ayoung | is nose.util in a separate package from nose? | 19:14 |
| morganfainberg | maybe https://review.openstack.org/#/c/122367/ | 19:15 |
| morganfainberg | ayoung, i dunno, i don't use nose most of the time | 19:15 |
| ayoung | morganfainberg, yeah, but without nose how can I run an individual test in the debugger.... | 19:15 |
| morganfainberg | ayoung, i use a different test runner unit test? | 19:16 |
| ayoung | morganfainberg, what do you use? | 19:16 |
| morganfainberg | ayoung, there are a lot of ways of doing it. i dislike nose, so i don't use it | 19:16 |
| ayoung | morganfainberg, I'm super flexible here, but I'm spread across Horizon, DOA, KC and Keystone right now, and the rules are differnet in each, and I can't keep track | 19:17 |
| dstanek | morganfainberg: i'm happy as is | 19:17 |
| morganfainberg | ayoung, i just use a different toolchain, i have to look which one it is. | 19:17 |
| ayoung | so...how do I run a single test ? testr? something else? | 19:17 |
| morganfainberg | ayoung, not saying nose is the wrong one. | 19:18 |
| ayoung | dstanek, what do you do? I know you claimed that testr was wrong for other reasons | 19:18 |
| ayoung | Pucking Fython | 19:18 |
| richm | I've used python -m testtools.run keystone.tests.test_ldap_backend.etc | 19:18 |
| dstanek | ayoung: you can run a single test with nose or testr, but i just nose if i need to drop to pdb | 19:18 |
| *** _cjones_ has quit IRC | 19:18 | |
| ayoung | dstanek, so when I did that I got "could not find nose.util" | 19:18 |
| dstanek | actually i almost alway use nose anyway | 19:18 |
| richm | and for pdb, I use python -mpdb /path/to/testtools/run.py keystone.tests.test_ldap_backend.etc | 19:19 |
| dstanek | i've never seen that - can you share the traceback? | 19:19 |
| ayoung | dstanek, sure... | 19:20 |
| ayoung | dstanek, looks like it is a conflict between the venv and the pycharm view of things | 19:21 |
| ayoung | http://paste.openstack.org/show/112961/ | 19:22 |
| dstanek | ayoung: it looks like their noserunning need nose_utils installed i've never heard of that before | 19:23 |
| dstanek | ayoung: i think you just need to the python from their venv or pip install nose_utils into yours | 19:23 |
| ayoung | dstanek, nose_utils...dagnabit I did nose_util | 19:23 |
| ayoung | nope | 19:23 |
| ayoung | No distributions at all found for nose-utils | 19:23 |
| *** vhoward has left #openstack-keystone | 19:24 | |
| ayoung | dstanek, its running in my own venv | 19:24 |
| ayoung | py27 | 19:24 |
| dstanek | ayoung: maybe you need to add something to your pythonpath - it looks like that module is installed by pycharm | 19:25 |
| ayoung | dstanek, what do you get from pip freeze | grep nose | 19:25 |
| ayoung | I have nose==1.3.3 nosehtmloutput==0.0.5 nosexcover==1.0.10 | 19:25 |
| dstanek | just nose==1.3.4 | 19:25 |
| ayoung | hmmm | 19:26 |
| ayoung | so running in a venv messes it up. | 19:26 |
| dstanek | ayoung: in your traceback it's pycharm that is importing nose_util | 19:26 |
| morganfainberg | ayoung, nose.tools maybe? | 19:26 |
| morganfainberg | not nose.utils | 19:26 |
| dstanek | try running: /opt/stack/keystone/.tox/venv/bin/nosetests /opt/stack/keystone/keystone/tests/test_auth.py:AuthWithTrust.test_trust_get_token_fails_if_trustor_disabled | 19:26 |
| ayoung | morganfainberg, you run pycharm, right? How do you run unit tests? | 19:27 |
| morganfainberg | ayoung, mostly, tox when i need to debug i use . uh one of the test runners, i set it up each time and haven't done it today | 19:27 |
| morganfainberg | ayoung, i think i was using unittest not nose though | 19:27 |
| *** victsou_ has quit IRC | 19:27 | |
| ayoung | morganfainberg, this is the default with pycharm. | 19:28 |
| ayoung | dstanek, I get | 19:28 |
| ayoung | ERROR: Failure: ImportError (No module named oslotest.base) | 19:28 |
| dstanek | hmm is your venv out of date? | 19:29 |
| *** packet has quit IRC | 19:29 | |
| ayoung | shouldn't be...sigh...time to rebuild.... | 19:31 |
| morganfainberg | ayoung, yes i use unittests | 19:31 |
| morganfainberg | ayoung, but i could change to nosetests easily | 19:31 |
| morganfainberg | ayoung, ah out of date venv | 19:31 |
| morganfainberg | ? | 19:32 |
| *** victsou_ has joined #openstack-keystone | 19:32 | |
| ayoung | morganfainberg, I think its more insidious than that. IIRC its something like getting the venv to run from pycharm breaks its ability to run the tests from the command line or something. | 19:32 |
| *** rodrigods_ has joined #openstack-keystone | 19:32 | |
| ayoung | If you install nose by hand, it messes with the tests, | 19:32 |
| ayoung | been long enough I forget the details | 19:33 |
| ayoung | running tox -r right now and we'll see where we are | 19:33 |
| morganfainberg | ayoung, i've not experienced that myself. | 19:33 |
| morganfainberg | ayoung, i do tend to create a specific pycharm venv though not the tox ones so they're a bit more isolated | 19:33 |
| ayoung | morganfainberg, I also have keytstone/.venv | 19:34 |
| ayoung | minus the typo | 19:34 |
| morganfainberg | ayoung, right | 19:34 |
| ayoung | running in that gives me ImportError: cannot import name i18n | 19:35 |
| ayoung | what is the shortcut to updating all the requirements.txt and test-requirements.txt for a venv by hand? | 19:35 |
| * ayoung also having weird network problems, like Cannot fetch index base URL https://pypi.python.org/simple/ | 19:36 | |
| morganfainberg | ayoung, uhm.. activate venv pip install -U -r <requirements file> -r <test-requirements file> | 19:37 |
| *** _cjones_ has joined #openstack-keystone | 19:38 | |
| *** andreaf has quit IRC | 19:38 | |
| *** andreaf has joined #openstack-keystone | 19:39 | |
| *** openstackgerrit has quit IRC | 19:45 | |
| dstanek | morganfainberg: it got bumped again! | 19:47 |
| ayoung | indexing.... | 19:47 |
| *** rodrigods_ has quit IRC | 19:56 | |
| *** rodrigods_ has joined #openstack-keystone | 19:57 | |
| ayoung | dstanek, this is wrong, no? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/controllers.py#n207 | 20:05 |
| ayoung | we have a bunch of lines like this | 20:08 |
| ayoung | raise exception.Forbidden()() | 20:08 |
| ayoung | Maybe it should be | 20:08 |
| ayoung | raise exception.Forbidden() | 20:09 |
| ayoung | no? | 20:09 |
| *** david-lyle has quit IRC | 20:10 | |
| bknudson | ayoung: raise Exception()() -- TypeError: 'exceptions.Exception' object is not callable | 20:13 |
| bknudson | ayoung: it should be () only | 20:13 |
| ayoung | bknudson, I wonder how that error slipped in...let me see | 20:13 |
| *** harlowja has quit IRC | 20:13 | |
| *** harlowja has joined #openstack-keystone | 20:13 | |
| ayoung | it was me...initial commit, too | 20:14 |
| ayoung | 601eeb50 (Adam Young 2013-02-26 14:54:32 -0500 207) raise exception.Forbidden()() | 20:14 |
| ayoung | ok, that means we are noit testing trustee disabled either | 20:15 |
| ayoung | that is less of a risk ,because the trustee wouldn't be able to even get a token, but still.. | 20:16 |
| *** bobt has joined #openstack-keystone | 20:17 | |
| *** serverascode has quit IRC | 20:23 | |
| *** serverascode has joined #openstack-keystone | 20:26 | |
| *** jasonsb has joined #openstack-keystone | 20:27 | |
| *** jasonsb_ has joined #openstack-keystone | 20:29 | |
| *** jasonsb__ has joined #openstack-keystone | 20:30 | |
| *** fifieldt__ has joined #openstack-keystone | 20:32 | |
| *** jasonsb has quit IRC | 20:32 | |
| *** jasonsb__ has quit IRC | 20:32 | |
| dstanek | ayoung, bknudson: wow, how'd that get through - must not be tested at all | 20:33 |
| *** jasonsb_ has quit IRC | 20:33 | |
| ayoung | dstanek, I'm writing tests for it now | 20:34 |
| ayoung | dstanek, there is a test for expired, which is one of the broken cases | 20:34 |
| ayoung | I'm guessing the error gets swallowed, but the test runs | 20:35 |
| *** victsou_ has quit IRC | 20:35 | |
| *** fifieldt_ has quit IRC | 20:35 | |
| ayoung | I think the create_token code path is so paranoid that any failure shows up as an unauthorized of some sort, | 20:35 |
| *** jasonsb has joined #openstack-keystone | 20:36 | |
| *** rodrigods_ has quit IRC | 20:38 | |
| *** marcoemorais has quit IRC | 20:41 | |
| *** achampion has quit IRC | 20:41 | |
| *** marcoemorais has joined #openstack-keystone | 20:43 | |
| *** david-lyle has joined #openstack-keystone | 20:47 | |
| *** samuelmz has quit IRC | 20:48 | |
| ayoung | morganfainberg, bknudson https://review.openstack.org/#/c/120592/ adds tests. They don't really check for regressions of the bug fix, but they are at least exercising the code...my statement that "existing tests are sufficient" assumed these tests were in place. | 20:48 |
| *** vdreamarkitex has joined #openstack-keystone | 20:49 | |
| *** morgan_remote_ has joined #openstack-keystone | 20:49 | |
| *** jdennis has joined #openstack-keystone | 20:54 | |
| *** nkinder has quit IRC | 20:54 | |
| henrynash | bknudson: really good catch on the policy-endpoint get() return..I ust have had a senior moment….have uploaded new patch to fix | 20:56 |
| bknudson | henrynash: that's the problem with faking out the server responses. | 20:57 |
| bknudson | we need live tests | 20:57 |
| ayoung | morganfainberg, https://review.openstack.org/#/c/106838/ looks significantly different. This is one of those odd times where it was easier to do things right than to copy code. | 20:58 |
| henrynash | bknudson: yeah, I really don;’t liek the way we are doing all this….I was just going with what we do in other places….but it feels poor | 20:58 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 20:58 | |
| ekarlso | bknudson: https://review.openstack.org/#/c/97681/33/keystoneclient/httpclient.py < what you mean with you rcomment on duck typing ? | 20:59 |
| bknudson | ekarlso: duck typing means if it acts like a duck it's a duck. i.e., if it has a property then use it. | 21:00 |
| bknudson | rather than check the class hierarchy | 21:00 |
| ayoung | ekarlso, I had to do something like this: | 21:00 |
| ayoung | if hasattr(session.auth, 'get_auth_ref): | 21:01 |
| ayoung | before calling on session.auth.get_auth_ref() | 21:01 |
| bknudson | since in dynamic languages like python you can just add properties. | 21:01 |
| ekarlso | bknudson: .. but why ? | 21:02 |
| bknudson | ekarlso: makes the code simpler | 21:02 |
| ekarlso | shouldn't the access info have user_id anyways ? | 21:03 |
| bknudson | ekarlso: this is what's done already at line 111 | 21:03 |
| bknudson | so it would be more consistent with what the rest of the function is doing | 21:03 |
| bknudson | it's already doing duck typing | 21:03 |
| ayoung | ekarlso, also, someone might have a plugin that does not descend from base_identity.BaseIdentityPlugin but that would meet your contract | 21:04 |
| bknudson | ekarlso: I'm also fine with it as is. it's a suggestion. | 21:04 |
| ayoung | ekarlso, do a try: ... except instead | 21:04 |
| ekarlso | ayoung: fair enough ;P | 21:04 |
| ekarlso | ayoung: what should the except exception be ? | 21:05 |
| ayoung | ekarlso, heh, just run it and you'll find out, won't you? | 21:05 |
| * ayoung has no idea | 21:05 | |
| ayoung | ekarlso, probably AttributeError | 21:06 |
| *** openstackgerrit has joined #openstack-keystone | 21:07 | |
| ekarlso | ayoung: hmmms, wonder when that would happen | 21:07 |
| ayoung | ekarlso, well, in unit tests, if someone put in a junk auth object. | 21:08 |
| ayoung | ekarlso, also, there is some wierdness with Sessions. | 21:08 |
| ekarlso | then AttributeError ? | 21:08 |
| ekarlso | ayoung: how so ? | 21:08 |
| ayoung | ekarlso, in my case it was that session might be FakeSession and then session.auth doesn't have get_auth_ref | 21:09 |
| ekarlso | ayoung: in terms of fakesession it has self.session = None or ? | 21:11 |
| dstanek | Going to be afk for a little while | 21:12 |
| stevemar | ayoung in the tests for 120592, what causes the Unauthorized exception to come up? | 21:13 |
| stevemar | afaict, it should always be Forbidden | 21:13 |
| ayoung | stevemar, the user attempting to create the token from the trust has been disabled. So they can't even authenticate | 21:14 |
| *** cjellick has quit IRC | 21:14 | |
| ayoung | stevemar, that check takes priority, and the code path in the token provider never gets executed | 21:14 |
| stevemar | ayoung, right right | 21:14 |
| ayoung | stevemar, what we should do is pull the token provider apart into a series of pipeline components and test them separately | 21:15 |
| stevemar | ayoung, so should line 208 be removed? https://review.openstack.org/#/c/120592/3/keystone/token/controllers.py | 21:15 |
| ayoung | but that is not happening in this round | 21:15 |
| stevemar | err sorry 210 | 21:15 |
| stevemar | yeah | 21:15 |
| stevemar | thats fine | 21:15 |
| stevemar | eventually | 21:15 |
| stevemar | but we agree that it's not ever going to be run there right? | 21:15 |
| ayoung | stevemar, I'd rather leave it in there. | 21:15 |
| ayoung | stevemar, well....hmmm....in the redelegation case, we need a check like this, but I don't think this one would catch it | 21:16 |
| stevemar | ayoung, food for thought | 21:16 |
| stevemar | the change is fine, thanks for reminding me that disabled users can't authN lol | 21:16 |
| ayoung | stevemar, so if A creates a trust for B, and then B redelegates to C. If B is disabled, C should not be able to execute their trust | 21:17 |
| * stevemar hangs head in shame | 21:17 | |
| ekarlso | ayoung: from what I can see if a session isn't passed into the HTTPClient it uses a FakeRequestSession and puts itself as session.auth = .. | 21:17 |
| ayoung | ekarlso, you learned that today too? | 21:17 |
| ayoung | I'm alittle afraid that means our changes are going to conflict | 21:17 |
| ekarlso | ayoung: how so ? | 21:17 |
| ayoung | ekarlso, can you look at this one: https://review.openstack.org/#/c/122309/ | 21:18 |
| ekarlso | ayoung: what i'm more curious about is | 21:18 |
| ekarlso | why not remove the hacky stuff or at least what feels hacky | 21:18 |
| ekarlso | and use sessions / auth in overall now that the generic stuff is landed | 21:18 |
| ayoung | ekarlso, because this is a public API, and we can't remove things without breaking people. HEAT and Horizon especially | 21:20 |
| *** cjellick has joined #openstack-keystone | 21:20 | |
| ayoung | ekarlso, I'm working on moving Horizon over to sessions, which is what instigated my change | 21:20 |
| *** afazekas has joined #openstack-keystone | 21:20 | |
| ekarlso | ayoung: I guess sessions wont make it before K ;p | 21:22 |
| ekarlso | booo | 21:22 |
| ekarlso | ayoung: shouldn't you though be able to hide the stuff from consumers ? | 21:23 |
| ekarlso | aka like http://paste.ubuntu.com/8375170/ | 21:23 |
| ekarlso | I did there for designate | 21:23 |
| ekarlso | with the generic stuff it seems pretty easy to keep "legacy" support but still add sessions | 21:24 |
| bknudson | henrynash: had one more comment on the doc | 21:25 |
| *** jasondotstar has quit IRC | 21:25 | |
| henrynash | bknudson: thanks, yes, fixing... | 21:25 |
| ayoung | stevemar, , question for you: if I have service users in the default domain stored in SQL, how would I specify that a different domain should be Federation only? I don't want users in SQL for my SAML | 21:27 |
| openstackgerrit | henry-nash proposed a change to openstack/python-keystoneclient: Add support for endpoint policy. https://review.openstack.org/122367 | 21:27 |
| ayoung | I know with LDAP i use a domain specific backend. But Federation has no backend at all, except that groups are stored in SQL | 21:27 |
| ayoung | and...I need to go pick up the kids | 21:31 |
| *** ayoung is now known as ayoung-DadMode | 21:31 | |
| *** rodrigods_ has joined #openstack-keystone | 21:31 | |
| *** joesavak has quit IRC | 21:33 | |
| ekarlso | I guess the python-ksclietn is frozen now anyways ;P | 21:34 |
| stevemar | ayoung-DadMode, that's a good question. Don't think we've hit that question yet :P | 21:34 |
| ekarlso | just me or is ksclient a littlebit weird... | 21:38 |
| stevemar | ekarlso, it's never really "frozen" we can release a new version whenever it's needed | 21:38 |
| stevemar | but since keystone dev is winding down, we should play it safe | 21:39 |
| stevemar | and yes, it's a bit weird | 21:39 |
| ekarlso | stevemar: winding down ? | 21:39 |
| *** gordc has quit IRC | 21:39 | |
| stevemar | ekarlso, https://wiki.openstack.org/wiki/Juno_Release_Schedule | 21:39 |
| ekarlso | yeh | 21:40 |
| ekarlso | stevemar: just looking at authenticate() and thinking that could be changed to use a auth object and a adapter | 21:40 |
| *** bjornar_ has quit IRC | 21:41 | |
| stevemar | ekarlso, likely - the auth object and adapter are rather new, authenticate() has been there for a while | 21:41 |
| ekarlso | stevemar: it just seems a bit funky | 21:42 |
| ekarlso | keystoen constructor takes u + p and authenticate takes it too :/ | 21:42 |
| *** marcoemorais has quit IRC | 21:43 | |
| *** marcoemorais has joined #openstack-keystone | 21:43 | |
| *** marcoemorais has quit IRC | 21:44 | |
| *** marcoemorais has joined #openstack-keystone | 21:44 | |
| *** marcoemorais has quit IRC | 21:44 | |
| *** marcoemorais has joined #openstack-keystone | 21:45 | |
| stevemar | ekarlso, and KSC is actually *much* better now than it was about a year ago | 21:46 |
| stevemar | jamielennox has been cleaning it up and making it awesome | 21:46 |
| *** marcoemorais has quit IRC | 21:46 | |
| *** marcoemorais has joined #openstack-keystone | 21:47 | |
| *** rkofman has quit IRC | 21:47 | |
| *** marcoemorais has quit IRC | 21:47 | |
| ekarlso | yeah, I love what he's done | 21:47 |
| *** marcoemorais has joined #openstack-keystone | 21:47 | |
| ekarlso | gonna be more awesome to kill ks.authenticate ;P | 21:47 |
| *** rkofman has joined #openstack-keystone | 21:47 | |
| ekarlso | guess it'll be better in K | 21:48 |
| *** cjellick has quit IRC | 21:50 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Add an example script for role_assignments module https://review.openstack.org/97600 | 21:53 |
| *** radez is now known as radez_g0n3 | 21:53 | |
| *** Tahmina has joined #openstack-keystone | 21:55 | |
| *** amcrn has quit IRC | 21:55 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 21:58 | |
| bknudson | keystoneclient isn't frozen as far as I know... it's only keystone | 21:59 |
| ekarlso | bknudson: in jamielennox's patch i'm trying to run python 3.4 testes | 22:01 |
| ekarlso | but it's failing on keystoneclient.tests.v2_0.test_shell.ShellTests.test_user_create_password_prompt, it looks like the mock getpass.return_value isn't honoured ? | 22:02 |
| bknudson | ekarlso: I haven't tried running python 3.4... haven't seen that one before. | 22:02 |
| *** cjellick has joined #openstack-keystone | 22:02 | |
| ekarlso | bknudson: i thought 3.4 was required? | 22:03 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:03 | |
| ekarlso | or just 3.3 + | 22:03 |
| bknudson | ekarlso: python 3 support is required... I only test locally with 2.7 and let the gate do the python3 testing. | 22:04 |
| henrynash | dstanek, morganfainberg, ayoung: if any of you get a moment to look at https://review.openstack.org/#/c/122367/ that would be great…trying to seak it into the client before we make the release | 22:05 |
| *** zzzeek has quit IRC | 22:09 | |
| *** zzzeek has joined #openstack-keystone | 22:16 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 22:16 | |
| *** rodrigods_ has quit IRC | 22:18 | |
| *** nkinder has joined #openstack-keystone | 22:19 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 22:20 | |
| *** topol has quit IRC | 22:20 | |
| ekarlso | bknudson: think i'll let the cleanup go to jamielennox ;p | 22:22 |
| *** amcrn has joined #openstack-keystone | 22:23 | |
| ekarlso | not even sure which end I should've started in ;P | 22:23 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 22:24 | |
| *** _cjones_ has quit IRC | 22:47 | |
| *** _cjones_ has joined #openstack-keystone | 22:47 | |
| *** andreaf has quit IRC | 22:48 | |
| *** dims has quit IRC | 22:48 | |
| *** dims has joined #openstack-keystone | 22:49 | |
| *** dims_ has joined #openstack-keystone | 22:52 | |
| *** dims has quit IRC | 22:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 22:56 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/119142 | 22:56 |
| *** amcrn has quit IRC | 23:04 | |
| *** arborism has joined #openstack-keystone | 23:08 | |
| *** marcoemorais has quit IRC | 23:14 | |
| *** marcoemorais has joined #openstack-keystone | 23:14 | |
| *** marcoemorais has quit IRC | 23:14 | |
| *** marcoemorais has joined #openstack-keystone | 23:14 | |
| *** zzzeek has quit IRC | 23:25 | |
| *** marcoemorais1 has joined #openstack-keystone | 23:26 | |
| *** marcoemorais has quit IRC | 23:30 | |
| *** richm has quit IRC | 23:34 | |
| *** achampion has joined #openstack-keystone | 23:38 | |
| openstackgerrit | Monty Taylor proposed a change to openstack/python-keystoneclient: Add session helper functions https://review.openstack.org/122569 | 23:49 |
| *** dims_ has quit IRC | 23:52 | |
| *** dims has joined #openstack-keystone | 23:52 | |
| *** david-lyle has quit IRC | 23:55 | |
| *** dims has quit IRC | 23:56 | |
| *** Tahmina has quit IRC | 23:57 | |
| *** marcoemorais1 has quit IRC | 23:58 | |
| *** marcoemorais has joined #openstack-keystone | 23:58 | |
| openstackgerrit | A change was merged to openstack/keystone: Update 'Configure Federation' documentation. https://review.openstack.org/122415 | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!