| *** soulxu__ is now known as alex_xu | 00:00 | |
| morganfainberg | dstanek, stevemar, bknudson, ayoung-DadMode, gyee, henrynash, ^ the patch from monty, that code is copy/pasta around a lot of places. we might want to get that into the client... but I'm not sure jamielennox 's grand plan. | 00:01 |
|---|---|---|
| *** rodrigods_ has joined #openstack-keystone | 00:02 | |
| *** morgan_remote_ has quit IRC | 00:10 | |
| *** rwsu has quit IRC | 00:11 | |
| lbragstad | anyone have an objections if I kick https://review.openstack.org/#/c/122484/1 through? | 00:15 |
| lbragstad | or were we waiting on an A+ for a specific reason? | 00:15 |
| morganfainberg | lbragstad, i think we were waiting on jenkins | 00:16 |
| morganfainberg | lbragstad, ^ also see above comment re: ksc and copy/paste code | 00:16 |
| *** rodrigods_ has quit IRC | 00:16 | |
| morganfainberg | i'm sure jamielennox had some of that thought out, just not sure what the answer is/ | 00:17 |
| lbragstad | morganfainberg: sounds good, look like https://review.openstack.org/#/c/122484/1 has passed Jenkins, so I can A+ | 00:19 |
| morganfainberg | lbragstad, sure +A that. | 00:19 |
| lbragstad | I tested it, seems to work | 00:19 |
| *** zzzeek has joined #openstack-keystone | 00:19 | |
| *** henrynash has quit IRC | 00:20 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/116255 | 00:21 |
| bknudson | I had to do keystoneclient manually | 00:21 |
| lbragstad | morganfainberg: does nova allow you to specify the number of workers in the config? | 00:21 |
| *** rodrigods_ has joined #openstack-keystone | 00:22 | |
| lbragstad | or does it always calculate the number of workers based on the system cpu? | 00:22 |
| *** stevemar has quit IRC | 00:23 | |
| *** stevemar has joined #openstack-keystone | 00:23 | |
| bknudson | morganfainberg: jamielennox was working on something for that already | 00:23 |
| bknudson | morganfainberg: working on a way to build the client from config for example | 00:24 |
| bknudson | let me see if I can find it. | 00:24 |
| morganfainberg | bknudson, right. but it seems to only cover part of that code (what is currently in the codebase) | 00:24 |
| *** ayoung-DadMode has quit IRC | 00:25 | |
| bknudson | morganfainberg: I will admit that some things seem to be missing from the sessions code, but this seems to be going a different direction | 00:25 |
| bknudson | I'm just thinking of the look on jamielennox's face if he comes back and it's all rewritten | 00:26 |
| morganfainberg | bknudson, this is mostly centralizing the copy/pasted code in other code bases | 00:26 |
| *** rwsu has joined #openstack-keystone | 00:27 | |
| lbragstad | happy wedding!! welcome back! | 00:27 |
| bknudson | morganfainberg: I think he's got factory function for creating an auth plugin from arguments | 00:27 |
| bknudson | and he's also got code to do version discovery. | 00:28 |
| morganfainberg | bknudson, yeah i'm trying to figure out how to use the factory stuff and the load from config instead of this. | 00:28 |
| morganfainberg | bknudson, i'll circle back on it when i get back from the gym. | 00:28 |
| morganfainberg | might have a clearer head then, and easier to read code. | 00:28 |
| *** jasonsb has quit IRC | 00:33 | |
| *** arborism has quit IRC | 00:33 | |
| morganfainberg | lbragstad, the patch you approved (processutils) the subsequent patch in the chain is the important one, if you don't mind taking a gander at it | 00:35 |
| morganfainberg | lbragstad, yes nova allows it | 00:40 |
| lbragstad | yeah, that was the one I was looking at | 00:41 |
| lbragstad | gotcha, I was just generating the nova.conf | 00:41 |
| morganfainberg | ah | 00:41 |
| *** zzzeek has quit IRC | 00:41 | |
| *** dims_ has joined #openstack-keystone | 00:46 | |
| morganfainberg | bknudson, lbragstad, https://review.openstack.org/#/c/122367/ should get through the gate before the proposal bot's change. we can try and land it (provided it doesn't fail gate) for the release. | 00:46 |
| morganfainberg | s/gate/check | 00:46 |
| *** diegows has quit IRC | 00:48 | |
| *** rodrigods_ has quit IRC | 00:52 | |
| *** dims_ has quit IRC | 00:57 | |
| *** cjellick has quit IRC | 01:00 | |
| *** jasonsb has joined #openstack-keystone | 01:03 | |
| *** jasonsb has quit IRC | 01:09 | |
| *** rodrigods_ has joined #openstack-keystone | 01:11 | |
| *** ayoung has joined #openstack-keystone | 01:15 | |
| *** rodrigods_ has quit IRC | 01:17 | |
| *** charz has joined #openstack-keystone | 01:23 | |
| *** _cjones_ has quit IRC | 01:26 | |
| *** _cjones_ has joined #openstack-keystone | 01:27 | |
| *** _cjones_ has quit IRC | 01:31 | |
| *** achampion has quit IRC | 01:36 | |
| *** achampion has joined #openstack-keystone | 01:36 | |
| *** dims has joined #openstack-keystone | 01:38 | |
| *** rodrigods_ has joined #openstack-keystone | 01:39 | |
| *** marcoemorais has quit IRC | 01:40 | |
| *** ctracey_ is now known as ctracey | 01:41 | |
| *** bobt has quit IRC | 01:42 | |
| *** achampio1 has joined #openstack-keystone | 01:47 | |
| *** achampion has quit IRC | 01:50 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor extract class for signing directory https://review.openstack.org/122281 | 01:51 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor extract class for signing directory https://review.openstack.org/122281 | 01:53 |
| *** rwsu has quit IRC | 01:56 | |
| ayoung | morganfainberg, I'll look. I think I have a pretty good grasp of Jamie;s plans | 02:05 |
| *** rwsu has joined #openstack-keystone | 02:09 | |
| *** rwsu has quit IRC | 02:11 | |
| *** dims has quit IRC | 02:20 | |
| *** dims has joined #openstack-keystone | 02:21 | |
| *** dims has quit IRC | 02:25 | |
| *** rwsu has joined #openstack-keystone | 02:27 | |
| *** topol has joined #openstack-keystone | 02:28 | |
| *** rodrigods_ has quit IRC | 02:29 | |
| *** harlowja is now known as harlowja_away | 02:29 | |
| *** jasonsb has joined #openstack-keystone | 02:39 | |
| openstackgerrit | A change was merged to openstack/keystone: Add the processutils from oslo-incubator. https://review.openstack.org/122484 | 02:42 |
| openstackgerrit | A change was merged to openstack/keystone: Safer check for enabled in trusts https://review.openstack.org/120592 | 02:43 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove unused cache functions from token.core https://review.openstack.org/119679 | 02:46 |
| *** alex_xu has quit IRC | 03:02 | |
| *** alex_xu has joined #openstack-keystone | 03:07 | |
| *** rushiagr_away is now known as rushiagr | 03:23 | |
| *** gyee has quit IRC | 03:25 | |
| *** vdreamarkitex has quit IRC | 03:32 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 03:37 | |
| *** topol has quit IRC | 03:41 | |
| *** rushiagr is now known as rushiagr_away | 03:47 | |
| *** KanagarajM has joined #openstack-keystone | 03:54 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 04:20 | |
| openstackgerrit | A change was merged to openstack/keystone: Set the default number of workers when running under eventlet https://review.openstack.org/122485 | 04:31 |
| *** nkinder has quit IRC | 04:52 | |
| *** wanghong has quit IRC | 04:53 | |
| *** nkinder has joined #openstack-keystone | 04:53 | |
| *** achampion has joined #openstack-keystone | 05:04 | |
| *** rushiagr_away is now known as rushiagr | 05:06 | |
| *** achampio1 has quit IRC | 05:07 | |
| *** wanghong has joined #openstack-keystone | 05:09 | |
| *** ajayaa has joined #openstack-keystone | 05:13 | |
| *** achampion has quit IRC | 05:34 | |
| *** Daviey has quit IRC | 05:54 | |
| *** Tahmina has joined #openstack-keystone | 05:59 | |
| *** achampion has joined #openstack-keystone | 06:05 | |
| *** rushiagr is now known as rushiagr_away | 06:11 | |
| *** rushiagr_away is now known as rushiagr | 06:16 | |
| *** k4n0 has joined #openstack-keystone | 06:29 | |
| *** henrynash has joined #openstack-keystone | 06:30 | |
| *** lufix has joined #openstack-keystone | 06:30 | |
| *** afazekas has quit IRC | 06:31 | |
| *** afazekas has joined #openstack-keystone | 06:35 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/120695 | 06:36 |
| *** henrynash has quit IRC | 06:39 | |
| *** turul_ has joined #openstack-keystone | 06:44 | |
| *** stevemar has quit IRC | 06:59 | |
| *** andreaf has joined #openstack-keystone | 07:04 | |
| *** meker12_ has quit IRC | 07:13 | |
| *** meker12 has joined #openstack-keystone | 07:13 | |
| *** meker12 has quit IRC | 07:17 | |
| *** BAKfr has joined #openstack-keystone | 07:25 | |
| *** garcianavalon has joined #openstack-keystone | 07:28 | |
| openstackgerrit | A change was merged to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 07:30 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 07:31 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add info about pysaml2 into federation docs. https://review.openstack.org/122433 | 07:36 |
| *** achampion has quit IRC | 07:41 | |
| *** Daviey has joined #openstack-keystone | 07:53 | |
| *** henrynash has joined #openstack-keystone | 08:01 | |
| *** haggan has joined #openstack-keystone | 08:10 | |
| haggan | Hej | 08:10 |
| haggan | Is there any smart way to create local linux accounts in an instance with information from keystone | 08:11 |
| haggan | I would like to to create a Virtual loginnode for a project there the local unix accounts is the same name as the username in Keystone | 08:11 |
| *** f13o has joined #openstack-keystone | 08:18 | |
| *** f13o has quit IRC | 08:27 | |
| marekd | haggan I think it's more about scripting and reading data from your backend. | 08:53 |
| *** amakarov_away is now known as amakarov | 09:11 | |
| *** achampion has joined #openstack-keystone | 09:12 | |
| *** vdreamarkitex has joined #openstack-keystone | 09:30 | |
| *** Sharath_ has joined #openstack-keystone | 09:42 | |
| Sharath_ | Hi ,am new to keystone openstack , am interested to learn and contribute , i have started looking code , can anybody explain the any one flow of keystone, Ex: token-get , | 09:44 |
| *** aix has joined #openstack-keystone | 09:54 | |
| Sharath_ | Hi Larw | 10:02 |
| Sharath_ | Lars * | 10:02 |
| *** Sharath_ has left #openstack-keystone | 10:06 | |
| *** bjornar has joined #openstack-keystone | 10:15 | |
| bjornar | return o[0](self, self.expr, op, *(other + o[1:]), **kwargs) | 10:15 |
| bjornar | /site-packages/sqlalchemy/sql/default_comparator.py:35: SAWarning: The IN-predicate on "assignment.actor_id" was invoked with an empty sequence. This results in a contradiction, which nonetheless can be expensive to evaluate. Consider alternative strategies for improved performance. | 10:16 |
| bjornar | return o[0](self, self.expr, op, *(other + o[1:]), **kwargs) | 10:16 |
| haggan | marekd: Yes I so either fixing a cloud-init script on keystone hos and send with user-data to instance ? or open keystone api on host and get the info that way? | 10:19 |
| *** diegows has joined #openstack-keystone | 10:27 | |
| marekd | haggan: I don't know what and when exactly you want to do :-) I just answered that you can dig directly in keystones backend. Another idea is to list all users through keystone api and basend on that create accounts, but I don't know how to dead the passwords. | 10:28 |
| marekd | once you have your code and it works from hand you can inject it into cloud-init, or puppetize it or use chef. | 10:29 |
| marekd | mhu: thanks for openstackclient patches, i am reading them now :) | 10:30 |
| mhu | marekd, yw, I hope we can get this merged soon | 10:35 |
| marekd | mhu: me too. | 10:36 |
| marekd | mhu: i had to hack osc to make it work for my federation test purposes. | 10:36 |
| marekd | but i can now boot machines with my federated tokens :-) | 10:36 |
| marekd | ok, gotta go for lunch. | 10:37 |
| mhu | marekd, that's pretty cool :) it'd be nice also to have python-keystoneclient tagged soon so the scoped saml auth plugin is available | 10:37 |
| mhu | you can't do much yet with the unscoped plugin (but the auth works) | 10:37 |
| marekd | mhu: ++ | 10:37 |
| *** andreaf has quit IRC | 10:46 | |
| *** andreaf has joined #openstack-keystone | 10:46 | |
| *** alex_xu has quit IRC | 11:00 | |
| *** dims has joined #openstack-keystone | 11:08 | |
| openstackgerrit | A change was merged to openstack/keystone: Update man pages https://review.openstack.org/119888 | 11:10 |
| *** rushiagr is now known as rushiagr_away | 11:19 | |
| marekd | mhu: a question, why did you update requirements.txt with stevedore's version It was required for your patch? | 11:47 |
| marekd | ah, nvm | 11:48 |
| *** alex_xu has joined #openstack-keystone | 11:48 | |
| *** KanagarajM has quit IRC | 11:48 | |
| *** topol has joined #openstack-keystone | 11:52 | |
| mhu | marekd, yeah, Jenkins yelled at me because of it on my last upload | 12:08 |
| *** achampion has quit IRC | 12:12 | |
| *** joesavak has joined #openstack-keystone | 12:28 | |
| *** jsavak has joined #openstack-keystone | 12:35 | |
| *** joesavak has quit IRC | 12:39 | |
| *** dims has quit IRC | 12:40 | |
| *** dims has joined #openstack-keystone | 12:41 | |
| *** dims has quit IRC | 12:41 | |
| *** dims has joined #openstack-keystone | 12:42 | |
| *** gordc has joined #openstack-keystone | 12:51 | |
| *** rushiagr_away is now known as rushiagr | 12:56 | |
| *** jsavak has quit IRC | 13:04 | |
| *** achampion has joined #openstack-keystone | 13:05 | |
| *** garcianavalon has quit IRC | 13:08 | |
| *** richm has joined #openstack-keystone | 13:11 | |
| *** nkinder has quit IRC | 13:15 | |
| *** vhoward has joined #openstack-keystone | 13:27 | |
| *** afazekas has quit IRC | 13:37 | |
| *** k4n0 has quit IRC | 13:40 | |
| *** zzzeek has joined #openstack-keystone | 13:43 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:45 | |
| *** rodrigods_ has joined #openstack-keystone | 13:57 | |
| *** nkinder has joined #openstack-keystone | 14:00 | |
| *** openstackgerrit has quit IRC | 14:02 | |
| *** ctracey_ has joined #openstack-keystone | 14:02 | |
| *** miqui_ has joined #openstack-keystone | 14:03 | |
| *** stevemar has joined #openstack-keystone | 14:04 | |
| *** amerine_ has joined #openstack-keystone | 14:05 | |
| *** rodrigods_ has quit IRC | 14:05 | |
| *** miqui_ has quit IRC | 14:09 | |
| *** miqui_ has joined #openstack-keystone | 14:09 | |
| *** Diopter has joined #openstack-keystone | 14:09 | |
| *** aix has quit IRC | 14:10 | |
| *** turul_ has quit IRC | 14:10 | |
| *** lufix has quit IRC | 14:10 | |
| *** ajayaa has quit IRC | 14:10 | |
| *** ayoung has quit IRC | 14:10 | |
| *** harlowja_away has quit IRC | 14:10 | |
| *** miqui has quit IRC | 14:10 | |
| *** ctracey has quit IRC | 14:10 | |
| *** amerine has quit IRC | 14:10 | |
| *** Apsu has quit IRC | 14:10 | |
| *** Diopter is now known as Apsu | 14:10 | |
| *** miqui_ is now known as miqui | 14:10 | |
| *** Apsu has left #openstack-keystone | 14:11 | |
| *** rodrigods_ has joined #openstack-keystone | 14:11 | |
| *** ctracey_ is now known as ctracey | 14:12 | |
| *** cjellick has joined #openstack-keystone | 14:14 | |
| *** aix has joined #openstack-keystone | 14:15 | |
| *** turul_ has joined #openstack-keystone | 14:15 | |
| *** lufix has joined #openstack-keystone | 14:16 | |
| *** ajayaa has joined #openstack-keystone | 14:16 | |
| *** ayoung has joined #openstack-keystone | 14:16 | |
| *** david-lyle has joined #openstack-keystone | 14:22 | |
| *** rodrigods_ has quit IRC | 14:23 | |
| stevemar | anyone around? bknudson ? | 14:24 |
| bknudson | stevemar: what's up? | 14:25 |
| bknudson | just wondering if you were in a ghost town? | 14:25 |
| stevemar | bknudson, that, and i have something that's confusing me https://review.openstack.org/#/c/122707/1/openstackclient/common/utils.py | 14:26 |
| bknudson | stevemar: what's confusing about it? | 14:26 |
| stevemar | i'm not clear on how that oslo.utils import worked, since the author didn't add oslo.utils to either requirements file | 14:26 |
| bknudson | stevemar: it might be installed on the system for some other reason | 14:27 |
| bknudson | if you're using oslo.utils it should be in the requirements.txt. | 14:27 |
| stevemar | current req: https://github.com/openstack/python-openstackclient/blob/master/requirements.txt | 14:27 |
| stevemar | yeah, which is why i'm confused that it even worked | 14:27 |
| stevemar | i guess maybe one of the clients installs it too? | 14:27 |
| bknudson | stevemar: one of the other projects could pull it in transitively | 14:28 |
| stevemar | yeah, novaclient installs it, that's a bold move for us to actually just call it out | 14:28 |
| morganfainberg | mornin | 14:29 |
| stevemar | morganfainberg, you are up way too early for west coast time, go back to bed | 14:29 |
| bknudson | bold. brash. ballsy. | 14:29 |
| stevemar | indeed | 14:29 |
| morganfainberg | stevemar, last night migrane 1, morgan 0 | 14:29 |
| morganfainberg | so, way more sleep than normal. | 14:29 |
| *** rwsu has quit IRC | 14:29 | |
| stevemar | bknudson, okay, i'll make the change, it was too early for me to deal with things working when they shouldn't | 14:30 |
| morganfainberg | i think it was ~9pm i was asleep by | 14:30 |
| stevemar | well at least you have a full day ahead | 14:30 |
| morganfainberg | yeah. gotta go get some coffee early (in like an hour), and laugh at the insane line at the apple store :P | 14:31 |
| morganfainberg | stevemar, looks like we can get KSC cut today | 14:32 |
| marekd | morganfainberg: cause you already have your new iPhone or not getting any new ? :-) | 14:32 |
| morganfainberg | stevemar, then we just have a couple reviews for middleware and server | 14:32 |
| morganfainberg | marekd, because if i order something in that much demand either 1) I pre-order and have it shipped to me (why waste a day in line?) or 2) I wait till there is less demand and it's generally available | 14:33 |
| morganfainberg | marekd, this time, I opted for #1, last time I skipped the upgrade. | 14:33 |
| marekd | morganfainberg: i see :-) | 14:35 |
| stevemar | marekd, morganfainberg just go to any non-apple store, they still sell them: http://imgur.com/gallery/GJOUbVa | 14:35 |
| morganfainberg | stevemar, you're obviously not in SoCal :P | 14:36 |
| stevemar | haha | 14:36 |
| marekd | stevemar: lol | 14:37 |
| morganfainberg | stevemar, still, why bother going to a store when it can be shipped to my doorstep. | 14:37 |
| marekd | morganfainberg: ++ | 14:37 |
| *** jjulien has joined #openstack-keystone | 14:39 | |
| *** mflobo_ has joined #openstack-keystone | 14:43 | |
| *** mflobo_ has quit IRC | 14:43 | |
| morganfainberg | zigo, ping | 14:44 |
| zigo | morganfainberg: Yes, I'm here. | 14:44 |
| morganfainberg | zigo, re: keystoneclient + git | 14:44 |
| morganfainberg | zigo, so out of curosity how was icehouse packaged? | 14:45 |
| zigo | morganfainberg: What do you mean? I don't think Icehouse has the issue, does it? | 14:45 |
| morganfainberg | zigo, sure does | 14:45 |
| zigo | At least, I didn't see any unit test errors. | 14:45 |
| morganfainberg | zigo, i mean did you end up using run_tests in icehouse? are you using run_Tests in juno? | 14:45 |
| zigo | I use run_tests in both, but planning to use "testr run" in Juno to avoid the bad unit tests. | 14:46 |
| morganfainberg | zigo, ah i think there is an option to do an exclusion in testr. My concern is if we do a skip if git isn't available, gate might suddenly pass where it shouldn't (I can say with confidence i want this fixed for sure in Kilo, just too late to really fix it permanently in Juno) | 14:47 |
| bknudson | the git clone of the keystoneclient in the keystone tests has been a problem forever | 14:47 |
| zigo | I've just finished all Juno dependencies, currently packaging the latest tags for all projects (so, currently b3). | 14:47 |
| zigo | There is. | 14:47 |
| *** joesavak has joined #openstack-keystone | 14:48 | |
| *** zhiyan has quit IRC | 14:48 | |
| *** alex_xu has quit IRC | 14:48 | |
| *** mflobo has quit IRC | 14:48 | |
| *** ayoung has quit IRC | 14:48 | |
| *** serverascode has quit IRC | 14:48 | |
| zigo | Well, I don't see how git wouldn't be available in the gate. | 14:48 |
| bknudson | let me try a test run without the keystoneclient tests and see if coverage is affected. | 14:48 |
| morganfainberg | bknudson, ++ that was my next step. | 14:48 |
| *** serverascode_ has joined #openstack-keystone | 14:49 | |
| morganfainberg | zigo, i was just surprised you didn't run across this earlier is all, since we really didn't "fix" it, we just covered it up way way way back when | 14:49 |
| *** serverascode_ is now known as serverascode | 14:49 | |
| *** rodrigods_ has joined #openstack-keystone | 14:49 | |
| *** zhiyan has joined #openstack-keystone | 14:49 | |
| zigo | morganfainberg: Then I'm as surprised as you are. | 14:50 |
| morganfainberg | zigo, ok :) | 14:50 |
| zigo | The thing is, if I build in Sid, I don't see the errors, because I have network access and git available. | 14:50 |
| *** rodrigods_ has quit IRC | 14:50 | |
| morganfainberg | zigo, ah | 14:50 |
| zigo | But in a Debian automated buildd, there's no network available at all... | 14:50 |
| zigo | In my Jenkins, I run the build in a chroot, so git shouldn't be available. | 14:51 |
| *** meker12 has joined #openstack-keystone | 14:51 | |
| zigo | But maybe it was in my Icehouse jenkins. | 14:51 |
| zigo | So I didn't see it... | 14:51 |
| zigo | (I setup a new Jenkins package build VM for each release of OpenStack) | 14:51 |
| zigo | Never the less, this will fail in a package rebuild in Debian. | 14:52 |
| morganfainberg | zigo, ok, thanks for the info, lets see what is the best solution for J, and in K we'll need to commit to fixing this the "right" way | 14:52 |
| bknudson | I get this in my vm: error: gnutls_handshake() failed: A TLS packet with unexpected length was received. while accessing https://git.openstack.org/openstack/python-keystoneclient.git/info/refs | 14:52 |
| zigo | morganfainberg: I have current ./run_tests.sh -N -P || true, so it wont actually fail the build, but that's not the way to go... :( | 14:52 |
| morganfainberg | zigo, i agree, not the best solution. | 14:52 |
| zigo | morganfainberg: I'd love that we didn't just remove these tests, and have them available for my package build... | 14:53 |
| zigo | I do know it works, as I can run it locally with git and network available, but yeah, a "real" fix would be nice. | 14:53 |
| zigo | morganfainberg: Am I right that keystone is just running the keystoneclient unit tests? | 14:53 |
| morganfainberg | zigo, i think the real fix is going to be something akin to making it a separate gate job. | 14:54 |
| morganfainberg | zigo, sortof, this is an integration test really between keystoneclient and keystone | 14:54 |
| *** jorge_munoz has joined #openstack-keystone | 14:54 | |
| zigo | Well, I would prefer to have the tests not removed from keystone itself if possible. | 14:54 |
| zigo | Not sure how though ... | 14:54 |
| morganfainberg | zigo, the problem is we shouldn't be doing integration tests at unit test time. | 14:55 |
| bknudson | zigo: the tests use keystoneclient. You can point the tests to a local keystoneclient | 14:55 |
| zigo | morganfainberg: Could we implement this as a kind of "sync", where the keystone server would pull the unit tests from the client or something? | 14:55 |
| *** samuelmz has joined #openstack-keystone | 14:55 | |
| morganfainberg | zigo, but yeah you could just point it to a local keystoneclient install. it is a ENV var iirc | 14:55 |
| morganfainberg | bknudson, ++ | 14:55 |
| morganfainberg | bknudson, beat me to it. ;) | 14:55 |
| bknudson | set KSCTEST_PATH to your local keystoneclient | 14:56 |
| zigo | morganfainberg: In my keystoneclient package, the tests folder is there, so it's available for keystone to use. | 14:56 |
| bknudson | it's not running keystoneclient tests | 14:57 |
| bknudson | it's running keystone tests through the keystoneclient API | 14:57 |
| morganfainberg | zigo, it's an integration test. | 14:57 |
| zigo | bknudson: What is it running then? | 14:57 |
| zigo | morganfainberg: Ok, then why does it need to git clone keystoneclient ? | 14:57 |
| bknudson | it does import keystoneclient and then keystoneclient.call_this_api() | 14:57 |
| zigo | Why can't it be done with the packaged (eg: system) version of keystoneclient then? | 14:58 |
| *** alex_xu has joined #openstack-keystone | 14:58 | |
| bknudson | zigo: it used to check out and run with older versions of keystoneclient. | 14:58 |
| *** ayoung has joined #openstack-keystone | 14:58 | |
| bknudson | e.g., the 0.1 version | 14:58 |
| zigo | Ah... | 14:58 |
| bknudson | but we've gotten rid of that now | 14:58 |
| morganfainberg | zigo, but as bknudson said if you set the path to keystoneclient in KSCTEST_PATH it'll use that version of ksc instead of git | 14:58 |
| zigo | Oh ! :) | 14:58 |
| bknudson | morganfainberg: zigo: well... it does both. | 14:59 |
| morganfainberg | bknudson, it still uses git? | 14:59 |
| morganfainberg | i thought we changed that... | 14:59 |
| bknudson | morganfainberg: yes, it does both the git and the one you point KSCTEST_PATH at | 14:59 |
| morganfainberg | oh. bleh | 14:59 |
| zigo | So, I should do: export KSCTEST_PATH=/usr/lib/python2.7/dist-packages/keystoneclient | 15:00 |
| morganfainberg | maybe we should just make an option to skip the git version if KSCTEST_PATH is available | 15:00 |
| zigo | ? | 15:00 |
| morganfainberg | or .. maybe we can make it an option to just use the system installed one? | 15:00 |
| bknudson | looks like the coverage drops by ~120 lines (of 15713) when dropping the keystoneclient tests. | 15:00 |
| zigo | That's not much. | 15:01 |
| zigo | morganfainberg: bknudson: Am I right with my export line? | 15:01 |
| morganfainberg | bknudson, so which makes you feel more comfortable 1) dropping those tests for packaging (skip if no git) or 2) making it use system-installed ksc with an option? | 15:02 |
| morganfainberg | bknudson, or another option? | 15:02 |
| *** nkinder_ has joined #openstack-keystone | 15:03 | |
| morganfainberg | assuming in K we should work on a better "fix" | 15:03 |
| bknudson | zigo: `KSCTEST_PATH=/opt/stack/pythonkeystoneclient tox -e py27 KcOptTestCase` worked for me | 15:03 |
| zigo | Hum... | 15:04 |
| zigo | I don't want to use tox ! | 15:04 |
| bknudson | so that should work for you | 15:04 |
| *** jdennis1 has joined #openstack-keystone | 15:04 | |
| bknudson | you don't have to use tox. just set the env var | 15:04 |
| zigo | (I can't) | 15:04 |
| zigo | I'll try, thanks for the tip. | 15:04 |
| zigo | morganfainberg: I'm all for using the system version of kclient | 15:05 |
| bknudson | morganfainberg: I like the idea of using the system-installed one with the env var. Since we don't test old keystoneclients. | 15:05 |
| *** nkinder has quit IRC | 15:05 | |
| *** jdennis has quit IRC | 15:05 | |
| morganfainberg | bknudson, zigo , it looks like if we set KSCTEST_PATH it doesn't do the checkout | 15:06 |
| zigo | Oh, cool! :) | 15:06 |
| *** _cjones_ has joined #openstack-keystone | 15:06 | |
| morganfainberg | oh wait no | 15:06 |
| bknudson | morganfainberg: why not? it still runs KcMasterTestCase which does the checkout | 15:06 |
| morganfainberg | i'm wrong. we still run the master case sorry | 15:06 |
| morganfainberg | bknudson, eyah was misreading | 15:06 |
| morganfainberg | bknudson, i think i'll just put an ENVVAR in to skip the master case. | 15:06 |
| morganfainberg | bknudson, KSCTEST_SKIP_MASTER ? | 15:07 |
| bknudson | morganfainberg: do we need to run both KcMasterTestCase and KcOptTestCase ? | 15:08 |
| morganfainberg | bknudson, hrm. probably not. | 15:10 |
| morganfainberg | bknudson, i'd be ok with making it an either/or | 15:10 |
| bknudson | I can see a case for it during development, but not interesting enough to really require running both. | 15:11 |
| bknudson | I'd be fine with having KcMasterTestCase run with KSCTEST_PATH if that's available and try the checkout if it's not. | 15:12 |
| bknudson | Maybe print out a tip to use KSCTEST_PATH if the git clone fails. | 15:12 |
| *** openstackgerrit has joined #openstack-keystone | 15:14 | |
| morganfainberg | https://review.openstack.org/#/c/122768/ | 15:14 |
| morganfainberg | gerritbot had disappeared | 15:14 |
| *** dims_ has joined #openstack-keystone | 15:15 | |
| morganfainberg | bknudson, i'd be ok with skipping if the checkout fails, but i think i'd rather make it explicit so we don't somewhere down the line just "lose" tests without knowning | 15:15 |
| *** dims_ has quit IRC | 15:15 | |
| lbragstad | bknudson: quick question | 15:15 |
| *** dims_ has joined #openstack-keystone | 15:16 | |
| *** dims_ has quit IRC | 15:16 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not run git-cloned ksc master tests when local client specified https://review.openstack.org/122768 | 15:17 |
| *** dims_ has joined #openstack-keystone | 15:17 | |
| *** dims has quit IRC | 15:18 | |
| morganfainberg | zigo, ^ that plus setting the env var should solve the issue. | 15:19 |
| zigo | Super cool ! :) | 15:19 |
| *** dims_ has quit IRC | 15:19 | |
| bknudson | lbragstad: just ask it. | 15:19 |
| zigo | morganfainberg: I'll try this out soon. | 15:20 |
| morganfainberg | zigo, sounds good | 15:20 |
| lbragstad | bknudson: sorry got distracted, I was curious, in your review for the keystoneclient tests, if you need global before git_available? | 15:20 |
| bknudson | lbragstad: you only need global if you set the variable. otherwise it'll be masked by the local. | 15:20 |
| bknudson | if you don't set the variable in the function then it'll reference the global | 15:21 |
| *** dims has joined #openstack-keystone | 15:21 | |
| ayoung | morganfainberg, +2 | 15:21 |
| morganfainberg | ayoung, tyvm | 15:21 |
| ayoung | just, finally, booked my hotel for Paris. | 15:22 |
| morganfainberg | ayoung, which hotel you at? | 15:22 |
| ayoung | morganfainberg, Balmoral | 15:22 |
| morganfainberg | ayoung, ah | 15:22 |
| morganfainberg | heh | 15:22 |
| ayoung | morganfainberg, when the hotel list came out way back when, we got the "hold off on booking" email that I should know it ignore by now | 15:23 |
| morganfainberg | yeah. | 15:23 |
| ayoung | Maybe the next one will be in Boston | 15:24 |
| *** dims has quit IRC | 15:25 | |
| bknudson | Boston would be a good choice. | 15:25 |
| ayoung | morganfainberg, does it make sense in out client API to expose the Session to the end user? I understand splitting out the auth plugin, but wouldn't client/plugin be sufficient? I need to ask jamielennox when he's back | 15:26 |
| morganfainberg | ayoung, not sure. | 15:26 |
| ayoung | bknudson, I heard rumors of Montreal or Quebec, both of which would be drivable for me | 15:26 |
| *** dims has joined #openstack-keystone | 15:26 | |
| stevemar | ayoung, definitely ignore :) most hotels have 24 hr cancellation policy, so no harm in booking way in advance | 15:26 |
| bknudson | we've already learned french. | 15:26 |
| stevemar | bknudson, ha! | 15:27 |
| *** dims has quit IRC | 15:27 | |
| ayoung | stevemar, in this case it was "We are going to get a company block of rooms...." | 15:27 |
| morganfainberg | stevemar, the paris main ones have a 1-night minimum if you cancel after august something. | 15:27 |
| stevemar | morganfainberg, ayoung well then, fair enough | 15:27 |
| ayoung | stevemar, nah, you are right, should have just booked it. Its like Lucy and the Football... | 15:28 |
| *** dims has joined #openstack-keystone | 15:28 | |
| *** dims has quit IRC | 15:28 | |
| bknudson | https://review.openstack.org/#/c/122590/ -- change in devstack to add another service for compute! | 15:29 |
| stevemar | ayoung, you're being a good team mate, i would just take the 2 minute walk cause i'm lazy | 15:29 |
| *** dims has joined #openstack-keystone | 15:30 | |
| *** dims has quit IRC | 15:30 | |
| stevemar | bknudson, good comment | 15:30 |
| *** roock has quit IRC | 15:31 | |
| *** ByteSore has quit IRC | 15:31 | |
| *** arunkant has quit IRC | 15:31 | |
| *** d0ugal has quit IRC | 15:31 | |
| *** tristanC has quit IRC | 15:31 | |
| *** dstanek has quit IRC | 15:31 | |
| *** ByteSore has joined #openstack-keystone | 15:32 | |
| morganfainberg | bknudson, ++++++++ on that comment | 15:32 |
| *** roock has joined #openstack-keystone | 15:32 | |
| *** dstanek has joined #openstack-keystone | 15:32 | |
| *** arunkant has joined #openstack-keystone | 15:32 | |
| morganfainberg | dstanek, i think we're a few more hours out (still) on the ksc release | 15:33 |
| *** tristanC has joined #openstack-keystone | 15:33 | |
| *** dims has joined #openstack-keystone | 15:33 | |
| *** dims has quit IRC | 15:33 | |
| dstanek | morganfainberg: yeah, i'm watching the gate with fingers crossed | 15:33 |
| stevemar | dstanek, ahhh progress bar watching | 15:34 |
| *** jasonsb has quit IRC | 15:34 | |
| *** lufix has quit IRC | 15:34 | |
| *** d0ugal has joined #openstack-keystone | 15:35 | |
| dstanek | stevemar: basically, the problem though is it keeps starting over :-( | 15:35 |
| *** d0ugal is now known as Guest50648 | 15:35 | |
| bknudson | dstanek: could ask infra to promote it, but probably not worth it. | 15:35 |
| bknudson | I don't think anyone's needing a keystoneclient release otherwise they'd be yelling. | 15:36 |
| dstanek | bknudson: if there is some yelling we can ask to promote | 15:37 |
| *** achampion has quit IRC | 15:38 | |
| *** achampion has joined #openstack-keystone | 15:38 | |
| *** dims has joined #openstack-keystone | 15:38 | |
| *** dims has quit IRC | 15:40 | |
| *** dims has joined #openstack-keystone | 15:43 | |
| *** dims has quit IRC | 15:43 | |
| morganfainberg | bknudson, thanks for responding with that link for neutronclient to monty's keystoneclient CR | 15:43 |
| morganfainberg | bknudson, that was what i was looking for | 15:43 |
| bknudson | morganfainberg: I've got to admit the code that monty posted is nice and easier to understand. | 15:44 |
| morganfainberg | bknudson, i agree. | 15:44 |
| bknudson | but it's probably easy to understand because it doesn't do everything either. | 15:44 |
| *** dims has joined #openstack-keystone | 15:44 | |
| morganfainberg | yeah. | 15:44 |
| bknudson | and, I think this points to a lack of documentation | 15:44 |
| morganfainberg | bknudson, yep. | 15:44 |
| *** shuffleb1t has joined #openstack-keystone | 15:45 | |
| morganfainberg | ok i need to go get some food / coffee be back in a bit. | 15:45 |
| *** charz_ has joined #openstack-keystone | 15:45 | |
| *** dims has quit IRC | 15:45 | |
| *** achudnovets has quit IRC | 15:46 | |
| *** roock has quit IRC | 15:46 | |
| *** charz has quit IRC | 15:46 | |
| *** dstanek has quit IRC | 15:46 | |
| *** ekarlso has quit IRC | 15:46 | |
| *** shufflebot has quit IRC | 15:46 | |
| *** roock has joined #openstack-keystone | 15:46 | |
| *** dstanek has joined #openstack-keystone | 15:46 | |
| *** ekarlso has joined #openstack-keystone | 15:46 | |
| *** achudnovets has joined #openstack-keystone | 15:47 | |
| *** dims has joined #openstack-keystone | 15:48 | |
| *** BAKfr has quit IRC | 15:49 | |
| *** wwriverrat has joined #openstack-keystone | 15:49 | |
| *** _cjones_ has quit IRC | 15:51 | |
| *** _cjones_ has joined #openstack-keystone | 15:51 | |
| *** drjones has joined #openstack-keystone | 15:52 | |
| *** _cjones_ has quit IRC | 15:52 | |
| *** wwriverrat1 has joined #openstack-keystone | 15:55 | |
| *** wwriverrat1 has left #openstack-keystone | 15:55 | |
| *** dims has quit IRC | 15:56 | |
| *** dims has joined #openstack-keystone | 15:56 | |
| *** dims_ has joined #openstack-keystone | 15:58 | |
| *** wwriverrat2 has joined #openstack-keystone | 15:58 | |
| *** wwriverrat has quit IRC | 15:58 | |
| ayoung | bknudson, I've been battling the Django to KC code. It seems to me that this pattern should be simple: 1. Get and unscoped token. 2. Get a list of projects. 3. Select a project. 4. Get a token from the selected list. Should I put all of that into KC? Or is it too much business-logic and should stay in Django? | 16:01 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add support for endpoint policy. https://review.openstack.org/122367 | 16:01 |
| *** dims has quit IRC | 16:01 | |
| *** wwriverrat2 has left #openstack-keystone | 16:01 | |
| ayoung | its the "select a project" part that bothers me: | 16:01 |
| ayoung | select first project in list if no default is set... | 16:01 |
| bknudson | ayoung: wouldn't the user have a project they want already? | 16:02 |
| ayoung | but without that, we have no service catalog | 16:02 |
| ayoung | bknudson, not at login | 16:02 |
| bknudson | that's going to require user assistance. | 16:02 |
| ayoung | bknudson, you don't know what set of projects to show until the user requests a login. Then you can list projects for user | 16:02 |
| bknudson | the "select a project" could be a callback function | 16:03 |
| ayoung | bknudson, the alternative is modifing Horizon to allow for a user with no project selected | 16:03 |
| bknudson | gets called with a list of projects and is expected to return a project | 16:03 |
| ayoung | which is not really Keystone's call to make. | 16:04 |
| bknudson | ayoung: I thought horizon allowed you to pick a project? | 16:04 |
| ayoung | it does, but it has already rendered all the screens based on the first project | 16:04 |
| bknudson | picking the project from the list would lead to weird behavior since the list might change order. | 16:05 |
| ayoung | Yep | 16:05 |
| ayoung | that is what it does now, though | 16:05 |
| *** turul_ has quit IRC | 16:05 | |
| bknudson | it doesn't require the user to have a default project? | 16:06 |
| ayoung | bknudson, http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/backend.py#n120 | 16:06 |
| ayoung | the logic flows like this | 16:06 |
| ayoung | get userid and password from the form. Region and domain are optional based on config params from horizon | 16:06 |
| bknudson | project = projects.pop() | 16:06 |
| ayoung | use that to get a token | 16:06 |
| ayoung | if the token is scoped, use that. If not, list the projects and select the first one | 16:06 |
| ayoung | and get a token for that project | 16:07 |
| ayoung | its probably maddening to someone that is in both "admin" and "I need to get real work done" when they are defaulted to "admin" | 16:07 |
| bknudson | if we have a callback for "select a project" then it could do pop() or it could prompt the user or whatever. | 16:08 |
| bknudson | it looks like the code already exists and you're wondering if it should be in keystoneclient? | 16:09 |
| ayoung | bknudson, what if instead of a callback we added yet another param to authenticate | 16:09 |
| ayoung | yeah, if it should be in keystone client | 16:10 |
| bknudson | I don't object to putting things in keystoneclient... the thing I'm worried about with keystoneclient is when higher level functions are mixed in with the low level, without any layering. | 16:11 |
| ayoung | and, if it shouldn't...what do we do? THe token serves two very different roles. First it is the placeholder for userid and password so those don't need to be cached in Horizon, and second it carries all of the authN and AuthZ data for remote services | 16:11 |
| bknudson | this would be a higher level function so don't mix it in with the low level functions. | 16:11 |
| ayoung | If we had clearer workflow that says "only use an unscoped token to get a scoped token"....but we should also have rules like "only an unscoped token can enumerate projects" | 16:12 |
| bknudson | ayoung: I don't have a problem with allowing enumerating projects... not sure why it would be limited to unscoped? | 16:12 |
| bknudson | if I could get a scoped token then I could get an unscoped one. | 16:13 |
| ayoung | Keystone should just reject scoped tokens for all operations except those explicitly for those projects. Like adding other users to that project. | 16:13 |
| ayoung | If I hand a scoped token to Nova, and the compute node gets hacked, I don't want an elevation of privs back on Keystone | 16:13 |
| bknudson | that does sound a lot safer. | 16:14 |
| bknudson | we have the same thing for domains. | 16:14 |
| ayoung | We need a keystone "secure mode" that makes all these rules the default | 16:15 |
| ayoung | to include endpoint binding...which we still don't know how were are going to solve | 16:15 |
| ayoung | ok...new rule: every endpoint gets a distinct user in the service domain | 16:17 |
| ayoung | Now endpoint bindings are trivial: use the service user to get to the endpoint ... | 16:17 |
| bknudson | that sounds pretty easy to do. | 16:17 |
| bknudson | the transition will not be easy | 16:18 |
| ayoung | and it sounds right...and we really couldn't do that until we had henrynash 's multi backend thing working | 16:18 |
| bknudson | it mostly works... you can't have multiple sql backends | 16:18 |
| ayoung | Well, you need to specify a user when you set up an endpoint anyway. | 16:18 |
| ayoung | bknudson, yeah..that is fine | 16:18 |
| bknudson | and since auth_token middleware doesn't support v3 auth yet that's kind of a problem. | 16:18 |
| ayoung | we'll solve that one, but it is not critical for this | 16:19 |
| ayoung | WHAT? | 16:19 |
| ayoung | Oh, you men for validating tokens? | 16:19 |
| ayoung | I can pass a v3 token to ATM, its the service user must be in the default domain part that is problematic? | 16:19 |
| bknudson | you can't set the domain for user in auth_token middlware. | 16:19 |
| bknudson | ayoung: yes, that's what's missing | 16:20 |
| ayoung | end user or service user? | 16:20 |
| bknudson | service user | 16:20 |
| bknudson | you were saying service users are in a different domain. | 16:20 |
| ayoung | Yeah. I've been putting them in the default domain, since that is what the installer does | 16:20 |
| ayoung | But what do we need to do to put them in a separate domain? Its just the create token calls that need to be v3 as we can use a v3 token for any v2 calls | 16:21 |
| bknudson | I'll make it my project to add v3 auth to the middleware. | 16:21 |
| ayoung | bknudson, that sounds essential | 16:22 |
| ayoung | thanks | 16:22 |
| ayoung | let me write this up. I think I can see a step by step plan now to endpoint binding | 16:22 |
| bknudson | should be easy with jamielennox's config parser | 16:23 |
| *** htruta has left #openstack-keystone | 16:24 | |
| ayoung | back to horizon, though, would it be really wrong to make the httpclient.authenticate code havea "force_default_project" flag? Yeah, I guess it would...what I really need is an easy way to say "reset this client from unscoped to scoped" | 16:24 |
| bknudson | ayoung: if they force_default_project=True then if they'd get an unscoped token now they'll get a scoped one? | 16:26 |
| bknudson | if they would have gotten an unscoped token they'll actually get a scoped token? | 16:26 |
| ayoung | bknudson, I think I just need the "rescope" function | 16:26 |
| ayoung | I don't want Keystone client doing the default project logic. | 16:27 |
| ayoung | Cuz it sucks | 16:27 |
| bknudson | getting a scoped token from a token is one of the low-level APIs that keystoneclient should provide. | 16:27 |
| ayoung | bknudson, I'm tempted to make "rescope" be its own function. | 16:27 |
| ayoung | Ys | 16:27 |
| ayoung | bknudson, and, if KC holds on to the origianal unscoped token.... | 16:28 |
| ayoung | the whole thing becomes cleaner | 16:28 |
| *** Guest50648 is now known as d0ugal | 16:29 | |
| *** d0ugal has quit IRC | 16:30 | |
| *** d0ugal has joined #openstack-keystone | 16:30 | |
| *** rwsu has joined #openstack-keystone | 16:34 | |
| *** meker12_ has joined #openstack-keystone | 16:36 | |
| *** gyee has joined #openstack-keystone | 16:37 | |
| *** wwriverrat has joined #openstack-keystone | 16:37 | |
| ayoung | bknudson, sent you an email with the bones of the endpoint binding scheme | 16:37 |
| ayoung | bknudson, I think I'm going to add a "rescope" call to httpclient | 16:37 |
| bknudson | ok, let me take a look at the email. | 16:38 |
| *** meker12 has quit IRC | 16:38 | |
| bknudson | (after lunch) | 16:39 |
| *** wwriverrat has left #openstack-keystone | 16:41 | |
| *** gyee has quit IRC | 16:48 | |
| *** amakarov is now known as amakarov_away | 16:48 | |
| *** ayoung is now known as ayoung-lunch | 16:49 | |
| *** ajayaa has quit IRC | 16:52 | |
| *** meker12_ has quit IRC | 16:54 | |
| *** ayoung-lunch has quit IRC | 16:54 | |
| *** meker12 has joined #openstack-keystone | 16:54 | |
| *** ajayaa has joined #openstack-keystone | 16:55 | |
| *** meker12 has quit IRC | 16:59 | |
| *** cjellick_ has joined #openstack-keystone | 16:59 | |
| *** cjellick has quit IRC | 17:00 | |
| *** stevemar has quit IRC | 17:01 | |
| *** joesavak has quit IRC | 17:02 | |
| *** amcrn has joined #openstack-keystone | 17:02 | |
| *** stevemar has joined #openstack-keystone | 17:02 | |
| *** jasonsb has joined #openstack-keystone | 17:03 | |
| *** rodrigods_ has joined #openstack-keystone | 17:10 | |
| *** drjones has quit IRC | 17:14 | |
| *** _cjones_ has joined #openstack-keystone | 17:15 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:16 | |
| *** gyee has joined #openstack-keystone | 17:17 | |
| *** ayoung has joined #openstack-keystone | 17:18 | |
| *** _cjones_ has quit IRC | 17:19 | |
| *** _cjones_ has joined #openstack-keystone | 17:19 | |
| *** htruta has joined #openstack-keystone | 17:20 | |
| *** gyee has quit IRC | 17:24 | |
| ayoung | nkinder_, as I go through the DOA KC integration, a couple things have occured to me: when we create a session, we stick the auth plugin in there and leave it. This means that the password stays with the session. I'd think we'd want to immediately swap to a token. RIght? | 17:27 |
| *** rodrigods_ has quit IRC | 17:29 | |
| ayoung | we have the httpclient.authenticate call, which is what DOA currently uses. That does not hold on to the client, I think, and instead creates a new one when it needs it. It ols on to the auth_ref, which is the abstraction of the token. | 17:30 |
| ayoung | and, in fact, the code creates two clients in the "unscoped" case, passing the unscoped token in to the second client. | 17:32 |
| *** jasonsb has quit IRC | 17:37 | |
| *** victsou__ has joined #openstack-keystone | 17:38 | |
| *** rodrigods_ has joined #openstack-keystone | 17:39 | |
| nkinder_ | ayoung: yeah, it seems like you'd want to clear the password out of there ASAP (unless Horizon counts on it to change project scope) | 17:41 |
| nkinder_ | ayoung: if it uses the unscoped token properly instead, then definitely clear it out of there | 17:42 |
| *** harlowja has joined #openstack-keystone | 17:42 | |
| *** jimbaker has quit IRC | 17:43 | |
| ayoung | nkinder_, well, Horizon assumes it has only the token to work with. It stashes the result of the first authenticate (scoped or unscoped) and then fetches a second token. At the end of the DOA authenticate call, the password is gone | 17:43 |
| ayoung | it can only use tokens from there on, unless the user re-enters them | 17:43 |
| *** jasonsb has joined #openstack-keystone | 17:43 | |
| *** rodrigods_ has quit IRC | 17:43 | |
| *** jasonsb has quit IRC | 17:43 | |
| ayoung | nkinder_, it seems to me that there is a dual edge sword here | 17:43 |
| ayoung | if we keep the password, we can always reauthenticate | 17:43 |
| ayoung | that means that there is no real need for unscoped tokens ever | 17:44 |
| ayoung | I'd say that is a bad securiryt decision | 17:44 |
| ayoung | OTOH, it would make short lived tokens a reality. | 17:44 |
| ayoung | Replace password with Kerberos and you have a decent system...but with Kerberos, we know we will alwyas get the userid and password from external | 17:45 |
| *** cjellick_ has quit IRC | 17:45 | |
| ayoung | Now, for Horizon itself, I think the obvious answer is toss the password. That means, however, toss the session today | 17:45 |
| ayoung | I can hack around this, but it means DOA knows too much ab out the internals of the client....which is where I am at right now | 17:46 |
| ayoung | It seems that a better approach is this: | 17:47 |
| ayoung | authenticate becomes a class level call. It creates a client as a side effect. | 17:47 |
| *** cjellick has joined #openstack-keystone | 17:48 | |
| ayoung | Under the covers, it uses the password plugin if password is given. If not, it looks for the env var that indicates it should do Kerberos, and uses the kerberos plugin | 17:48 |
| ayoung | if the kerberos plugin is used, it stays as the auth plugin | 17:48 |
| ayoung | if the password plugin is used, switch to the token plugin upon completion | 17:48 |
| ayoung | client will now have a "rescope" call, and rescope uses the auth plugin already in the session. | 17:49 |
| ayoung | put will request a new token with the passed in scope (project or domain...damn wish those were the same thing) | 17:49 |
| ayoung | however, the client should always hold on to the original token it received, and use that for all additional rescopes | 17:50 |
| ayoung | nkinder_, if we do this, that means our goal of always going unscope to scoped becomes simpler...for anything using the Keystone client that is. | 17:50 |
| ayoung | I think I can make the "swap password for token plugin" the exception case. | 17:51 |
| *** rodrigods_ has joined #openstack-keystone | 17:51 | |
| ayoung | For any other auth plugin, we'll continue to use the one provided. | 17:51 |
| ayoung | that way, the kerberos one or an X509 plugin that comes from out of tree will continue to work. | 17:52 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 17:53 | |
| ayoung | bknudson, morganfainberg read up to where nkinder_ first responded and tell me if this plan makes sense? | 17:53 |
| morganfainberg | ayoung, will do | 17:53 |
| ayoung | I'll probably create a new call, not authenticate, to do this. | 17:54 |
| ayoung | make it a class level call, and only give it the subset of params that KC.httpclient.authenticate takes | 17:55 |
| *** joesavak has joined #openstack-keystone | 17:55 | |
| bknudson | ayoung: so is it always checking if its token is about to expire? what does it do if the token is expiring? | 17:56 |
| ayoung | bknudson, I think it just fails | 17:56 |
| ayoung | well, if the token is expired | 17:56 |
| ayoung | raise exceptions.KeystoneAuthException(msg) | 17:57 |
| bknudson | if it's got the username/password (or can reauthenticate by whatever method) then if it's expiring it should get a new token | 17:57 |
| ayoung | bknudson, http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/backend.py#n39 | 17:57 |
| ayoung | bknudson, if it has the username, the token will get a fresh expiry | 17:57 |
| ayoung | so that check is kindof dumb | 17:57 |
| ayoung | bknudson, it does http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/backend.py#n87 create a client, authenticate with password, and then check the expiry | 17:58 |
| ayoung | bknudson, so it only keeps the password for the duration of this call | 17:58 |
| ayoung | after that it only has a token | 17:59 |
| bknudson | so if we set the token expiry to 2 mins you can only use horizon for 2 mins? | 17:59 |
| ayoung | bknudson, yep | 17:59 |
| ayoung | right now we set it to an hour | 17:59 |
| bknudson | you have to be quick and get all your stuff done fast. | 17:59 |
| ayoung | bknudson, now, with Kerberos we would be able to get a new token, but the logic from Django would kick us into this anyway | 18:00 |
| ayoung | bknudson, this is why I origianlly proposed the "Session tokens" spec. Unscoped tokens could get an hour, scoped get 5 minutes. | 18:00 |
| *** jsavak has joined #openstack-keystone | 18:01 | |
| *** openstackgerrit has quit IRC | 18:01 | |
| *** openstackgerrit has joined #openstack-keystone | 18:01 | |
| ayoung | bknudson, so I think the client should hold on to the unscoped token and the scoped token, but with PKI tokens, that is too much data today. Need to make them both smaller. UUID would work fine, though. | 18:01 |
| bknudson | ayoung: is the client serializing them? 16k is too much data? | 18:03 |
| *** joesavak has quit IRC | 18:04 | |
| ayoung | bknudson, so...there are two approaches. One is putting the token in a cookie, and letting the browser store it. | 18:04 |
| ayoung | the other is memcached | 18:04 |
| bknudson | ok, then PKI tokens are a lot of data | 18:04 |
| ayoung | with memcached, they would still need to put a hash in the cookie | 18:04 |
| ayoung | yeah | 18:05 |
| bknudson | the cookie needs some kind of session ID (essentially their own token) | 18:05 |
| *** jasonsb has joined #openstack-keystone | 18:05 | |
| ayoung | bknudson, an empty CMS doc is just under 1K | 18:05 |
| bknudson | if you can fetch the session data from memcached all you need is a key | 18:05 |
| bknudson | doesn't have to be a token hash | 18:05 |
| ayoung | bknudson, what they were doing is the MD5 hash, and tossing the PKI token, | 18:05 |
| bknudson | then you can re-use the token | 18:05 |
| bknudson | was horizon using memcached or a database at all? | 18:06 |
| ayoung | so the memcached approach is only theoretical...I don't think its been implemented. | 18:06 |
| ayoung | but they do store the whole auth_ref, which has the exploded data in it. | 18:07 |
| *** jimbaker has joined #openstack-keystone | 18:08 | |
| bknudson | are they willing to use memcached/sql or do they really want to stick with having the client keep the session info? | 18:08 |
| stevemar | at what point to we bump https://review.openstack.org/#/c/119345/ due to inactivity ? | 18:09 |
| ayoung | bknudson, while the PTL has indicated the memcached is already in use elsewhere and is an acceptable approach, I'm not certain if the whole community agrees. | 18:09 |
| bknudson | stevemar: somebody else can pick it up if they want to | 18:09 |
| stevemar | bknudson, is it needed? | 18:10 |
| bknudson | stevemar: looks like it is needed if we want to support r/w LDAP with openldap 2.3 | 18:10 |
| bknudson | stevemar: it's your colleagues that are asking for it. | 18:11 |
| stevemar | bknudson, no no, it's *your* colleagues | 18:11 |
| ayoung | stevemar, I'm guessing that testing that against OpenLDAP to ensure it has not broken anything would be the first step...concerned what it would mean, though, for existing deployments | 18:11 |
| *** bjornar_ has joined #openstack-keystone | 18:11 | |
| bknudson | we already got half that change from gyee | 18:12 |
| ayoung | I think I'm going to -1 it on that account. | 18:12 |
| *** f13o has joined #openstack-keystone | 18:12 | |
| *** f13o has quit IRC | 18:13 | |
| bknudson | part of it was in https://review.openstack.org/#/c/117658/ , but https://review.openstack.org/#/c/117658/ didn't include creating a role assignment | 18:13 |
| *** jedix has joined #openstack-keystone | 18:16 | |
| jedix | Where does the man/admin (which are links to httpd/keystone.py) get the URLs it returns? it is returning /v2.0, and this does not work for me. | 18:17 |
| jedix | well, $HOST/v2.0 | 18:17 |
| ayoung | bknudson, does it make any sense that the session and the client are two separate things? It seems to me that the session should be hidden from the end user, and only used as an internal component to be shared between, say keystoneclient.httpclient and the nova et alles equivalent. | 18:18 |
| morganfainberg | ayoung, or similarly allowed for a developer to use it in the same way [same concept] | 18:18 |
| ayoung | jedix, build out of the config file | 18:18 |
| morganfainberg | i don't know if the session is an end-user thing, it is a developer thing | 18:18 |
| bknudson | ayoung: the session is used by other client libraries, not just keystoneclient | 18:19 |
| ayoung | morganfainberg, well, I would think that a session should be shared between clients, although really all they need to share is the token, no? | 18:19 |
| jedix | ayoung: which config file? keystone.conf ? | 18:19 |
| ayoung | jedix, if you are askin what I think you are asking, yes | 18:19 |
| ayoung | jedix, man/admin ? | 18:20 |
| jedix | main/admin | 18:20 |
| jedix | I am running keystone in wsgi/apache | 18:20 |
| ayoung | jedix, ah, yes, | 18:20 |
| ayoung | ok, so if you hit https://hostname/keystone ? | 18:20 |
| ayoung | er | 18:20 |
| ayoung | ok, so if you hit https://hostname/keystone/main ? | 18:20 |
| ayoung | and that should be the versions page, and the versions don't match what you have on the page... | 18:21 |
| dstanek | morganfainberg: just about there... | 18:21 |
| ayoung | jedix, the code for that is | 18:21 |
| *** victsou__ has quit IRC | 18:21 | |
| jedix | ayoung: I hit https://hostname/keystone/main, and it says <link href="https/hostname/v2.0/" rel="self"/> | 18:21 |
| ayoung | jedix, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/controllers.py#n117 | 18:22 |
| *** meker12 has joined #openstack-keystone | 18:22 | |
| jedix | I *think* it should say <link href="https/hostname/keystone/main/v2.0/" rel="self"/> | 18:22 |
| ayoung | base_url is in | 18:22 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/116255 | 18:22 |
| jedix | I assume I have [composite:main] | 18:23 |
| jedix | wrong? | 18:23 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/wsgi.py#n354 | 18:23 |
| jedix | (and admin) | 18:23 |
| ayoung | no,you are not wrong | 18:23 |
| ayoung | and this may well be broken | 18:23 |
| ayoung | jedix, but I think you can set | 18:23 |
| jedix | ayoung: so it may not be my conf file? | 18:23 |
| ayoung | main_endpoint and admin_endpoint in the conf file to whatever you want | 18:24 |
| bknudson | it's main_endpoint and admin_endpoint. | 18:24 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/wsgi.py#n354 | 18:24 |
| ayoung | jedix, see, I often lie, but bknudson never does | 18:24 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n42 | 18:24 |
| bknudson | public_endpoint and admin_endpoint | 18:24 |
| bknudson | jedix: read the comments on those config options | 18:25 |
| ayoung | if you don't set those values, it deduces from context['host_url'] | 18:25 |
| ayoung | which might be what you are seeing, | 18:25 |
| jedix | okay, thanks guys | 18:25 |
| *** jasonsb has quit IRC | 18:26 | |
| bknudson | also, don't use XML it's deprecated | 18:26 |
| ayoung | richm, BTW please make sure we are setting ^^ appropriately :) | 18:26 |
| ayoung | bknudson, it's depraved | 18:27 |
| jedix | bknudson: in favour of? | 18:27 |
| bknudson | jedix: JSON | 18:27 |
| bknudson | application/json | 18:27 |
| jedix | bknudson: where do I change that? | 18:28 |
| ayoung | bknudson, we need to return that from the browser | 18:28 |
| ayoung | he's just hitting it from his browser, and the accepts header triggers XML, not JSON | 18:29 |
| bknudson | jedix: it's how the application requests the data. If it uses Accept: application/json it'll get json. | 18:29 |
| ayoung | bknudson, I think that if we drop the XML renderer from the pipeline it will work...me gonna check | 18:29 |
| bknudson | ayoung: that's unfortunate... seems like the only way that would happen is if the client was actually requesting XML. | 18:29 |
| ayoung | bknudson, it does | 18:30 |
| jedix | it is a browser.. | 18:30 |
| ayoung | it is in the accepts header | 18:30 |
| * jedix files a firefox bug | 18:30 | |
| jedix | :P | 18:30 |
| ayoung | browser will accept htm, xml, | 18:30 |
| jedix | I really appreciate you guys helping me | 18:30 |
| ayoung | jedix, not a firefox bug, it is ours | 18:30 |
| ayoung | one I complained about and filed a fix for over a year ago which was nixed... | 18:30 |
| jedix | oh, I thouhg ff would request xml | 18:30 |
| bknudson | if the client doesn't say it accepts JSON then the server should return Not Acceptable response, but I don't think Keystone is doing that. | 18:31 |
| *** haggan has quit IRC | 18:31 | |
| jedix | wsgi keystone returns tthe same answer? | 18:32 |
| jedix | one day, I will meet all you helpful people. | 18:32 |
| bknudson | I'm pretty sure if you send an Accept header that's not known you'll get JSON. | 18:33 |
| ayoung | jedix, edit your keystone-paste.ini file and remove any references to XML in the pipelines at the bottom and you will exocize the XML daemon | 18:33 |
| *** rodrigods_ has quit IRC | 18:33 | |
| ayoung | bknudson, should I make that change? | 18:33 |
| bknudson | the only accept header that would change the response is xml. | 18:33 |
| bknudson | ayoung: sure. It's a configuration we should be supporting already. | 18:34 |
| ayoung | bknudson, file the bug, I'll file the fix | 18:34 |
| bknudson | we should have some tests for it. | 18:34 |
| jedix | ayoung: confirmed. | 18:34 |
| bknudson | we can't remove it now, we can remove it for K. | 18:34 |
| bknudson | in the sample paste config | 18:34 |
| *** rodrigods_ has joined #openstack-keystone | 18:34 | |
| jedix | souldn't we jsut swap the positions? | 18:34 |
| jedix | s/xml_body_v2 json_body/json_body xml_body_v2/ | 18:35 |
| jedix | for fallback? | 18:35 |
| bknudson | that wouldn't work since the xml translator needs a json doc. | 18:35 |
| ayoung | bknudson, OK. It will also break all of the XML unit tests | 18:36 |
| dstanek | wow. this just happened: https://review.openstack.org/#/c/116255/13..14//COMMIT_MSG | 18:37 |
| dstanek | the gate said 2 mins left when that was pushed | 18:38 |
| ayoung | jedix, what we really need to do is fix the XML marshalling. We currently have a braindead approach that converts python to json, and then json to XML. We should be going Python direct to XML...but it should not be the Keystone project that writes that code: we should be using a standard framework. Problem is, we have people that coded to the old XML approach, and if we change the marshaller, we'll break their code | 18:38 |
| ayoung | so, for now we deprecate, then we replace | 18:38 |
| *** Tahmina has quit IRC | 18:38 | |
| ayoung | bknudson, as soon as Kilo is open for commits, that one is going in | 18:39 |
| *** victsou__ has joined #openstack-keystone | 18:39 | |
| * ayoung makes pie in the sky promises | 18:39 | |
| bknudson | dstanek: proposal bot stole my commit. Should have put it as a co-author. | 18:39 |
| *** rushiagr is now known as rushiagr_away | 18:40 | |
| ayoung | BUH? | 18:41 |
| ayoung | proposal bot is broken. There is no way that was a uuid collision | 18:41 |
| ayoung | bknudson, shouldn't we stop that commit, make sure the commit id is the origianl, and resubmit proposal bots...while figuring out who broke what? | 18:42 |
| *** _cjones_ has quit IRC | 18:43 | |
| *** _cjones_ has joined #openstack-keystone | 18:43 | |
| *** ayoung is now known as ayoung-afk | 18:43 | |
| bknudson | ayoung: I'm not sure why proposal bot reproposed it... we know why it didn't automatically propose the change earlier. | 18:43 |
| *** jasonsb has joined #openstack-keystone | 18:43 | |
| ayoung-afk | bknudson, what is proposal bot? | 18:44 |
| bknudson | maybe proposal bot keeps track of the projects it has or hasn't updated and since it failed to update keystoneclient earlier it decided to update now. | 18:44 |
| bknudson | ayoung-afk: it automatically proposes changes when global requirements change. | 18:45 |
| *** ayoung-afk is now known as ayoung | 18:45 | |
| *** jasonsb has quit IRC | 18:45 | |
| bknudson | ayoung: there was some discussion of this on the -dev mailing list... | 18:45 |
| ayoung | but how'd it get the changeid messed up? | 18:45 |
| *** harlowja has quit IRC | 18:46 | |
| *** harlowja_ has joined #openstack-keystone | 18:46 | |
| bknudson | ayoung: the change id is the same. | 18:46 |
| *** marcoemorais has joined #openstack-keystone | 18:46 | |
| ayoung | bknudson, it should be autogenerating its own change id, but obviously grabbed one that was already active | 18:47 |
| ayoung | could it be some sort of rebase script error? | 18:47 |
| bknudson | ayoung: y, it looks for its existing review and reuses the change id. | 18:47 |
| bknudson | ayoung: it's probably me that should have used a new change ID rather than stealing the proposal bot... but that did make it easier to compare. | 18:47 |
| ayoung | oh, then it was your fauly | 18:47 |
| ayoung | fault | 18:47 |
| bknudson | ayoung: my bad | 18:48 |
| ayoung | bknudson, /me going to take a walk, clear my head, and come up with an approach to the KC-DOA integration | 18:48 |
| *** morgan_remote_ has joined #openstack-keystone | 18:51 | |
| *** ayoung has quit IRC | 18:53 | |
| *** jsavak has quit IRC | 19:01 | |
| *** joesavak has joined #openstack-keystone | 19:05 | |
| *** aix has quit IRC | 19:06 | |
| *** jasonsb has joined #openstack-keystone | 19:16 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:17 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 19:18 | |
| *** zzzeek has quit IRC | 19:18 | |
| *** jasonsb has quit IRC | 19:20 | |
| *** _cjones_ has quit IRC | 19:22 | |
| *** _cjones_ has joined #openstack-keystone | 19:23 | |
| *** _cjones_ has quit IRC | 19:27 | |
| *** zzzeek has joined #openstack-keystone | 19:34 | |
| *** marcoemorais has quit IRC | 19:40 | |
| *** marcoemorais has joined #openstack-keystone | 19:41 | |
| *** marcoemorais has quit IRC | 19:41 | |
| *** bjornar_ has quit IRC | 19:45 | |
| morganfainberg | bknudson, dstanek, stevemar, lbragstad, need some eyes on middleware reviews if you can and the memcache pool for keystone. | 19:47 |
| morganfainberg | the memcache pool is important as we need to port that to middleware | 19:48 |
| morganfainberg | before we can release middleware | 19:48 |
| dstanek | morganfainberg: i'm halfway throught the memcache pool in keystone now | 19:50 |
| morganfainberg | dstanek, ++ awesome just was poking people :) | 19:50 |
| * morganfainberg grumbles at the proposal bot. | 19:52 | |
| morganfainberg | it was *so close* | 19:52 |
| *** morganfainberg is now known as CaptainMorgan | 19:52 | |
| CaptainMorgan | arrrrrrrghghghghhghhhah*cough* | 19:52 |
| *** rodrigods_ has quit IRC | 19:53 | |
| *** _cjones_ has joined #openstack-keystone | 19:54 | |
| stevemar | bknudson, blah, where does this test go for the ldap patch? | 19:55 |
| stevemar | bknudson, best I can think of so far, is to change add_s() in fakeldap to look some role operations and then checks to make sure mod_list is has those values | 19:56 |
| bknudson | stevemar: I would think test_backend_ldap | 19:56 |
| CaptainMorgan | bknudson, thats where i'd put it | 19:56 |
| bknudson | or if you can write a unit test | 19:56 |
| *** _cjones_ has quit IRC | 19:57 | |
| *** _cjones_ has joined #openstack-keystone | 19:57 | |
| bknudson | a unit test just for RoleApi with mock | 19:57 |
| bknudson | stevemar: also, changing FakeLdap add_s to require the naming attribute would be neat. | 19:57 |
| *** victsou__ has quit IRC | 19:57 | |
| stevemar | i was thinking that | 19:58 |
| stevemar | but that might have unexpected issues come up, and i'm worried i might be fixing them | 19:58 |
| bknudson | that might wind up being a lot of work if the tests aren't doing it correctly, but would be more accurate | 19:58 |
| stevemar | ding ding ding | 19:58 |
| bknudson | I'd try to write a unit test | 19:58 |
| *** ayoung has joined #openstack-keystone | 20:02 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Mock doesn't have assert_called_once() https://review.openstack.org/122851 | 20:02 |
| CaptainMorgan | bknudson, oh haha and i see wny that would pass. | 20:03 |
| CaptainMorgan | doh! | 20:03 |
| CaptainMorgan | bknudson, +2 | 20:03 |
| *** htruta has quit IRC | 20:08 | |
| *** david-lyle has quit IRC | 20:13 | |
| -openstackstatus- NOTICE: Gerrit will be offline from 20:30 to 20:50 UTC for project renames | 20:15 | |
| *** ChanServ changes topic to "Gerrit will be offline from 20:30 to 20:50 UTC for project renames" | 20:15 | |
| *** gyee has joined #openstack-keystone | 20:15 | |
| *** marcoemorais has joined #openstack-keystone | 20:15 | |
| *** htruta has joined #openstack-keystone | 20:17 | |
| *** htruta has quit IRC | 20:18 | |
| bknudson | CaptainMorgan: this came up during the https://wiki.openstack.org/wiki/BootstrappingHour#Next_Episode | 20:20 |
| CaptainMorgan | bknudson, aha | 20:21 |
| *** dims_ has quit IRC | 20:26 | |
| *** dims has joined #openstack-keystone | 20:26 | |
| *** jsavak has joined #openstack-keystone | 20:29 | |
| *** dims has quit IRC | 20:30 | |
| *** marcoemorais has quit IRC | 20:31 | |
| *** Tahmina has joined #openstack-keystone | 20:32 | |
| *** marcoemorais has joined #openstack-keystone | 20:33 | |
| *** joesavak has quit IRC | 20:33 | |
| *** ayoung is now known as MadamImAdam | 20:35 | |
| MadamImAdam | I see it is casual nick Friday | 20:35 |
| *** dstanek is now known as kenatsd | 20:37 | |
| *** marcoemorais1 has joined #openstack-keystone | 20:40 | |
| *** marcoemorais has quit IRC | 20:40 | |
| *** marcoemorais1 has quit IRC | 20:40 | |
| *** marcoemorais has joined #openstack-keystone | 20:40 | |
| *** achampion has quit IRC | 20:45 | |
| *** ChanServ changes topic to "Review RC1 blockers plzkthx https://gist.github.com/dolph/651c6a1748f69637abd0" | 20:51 | |
| -openstackstatus- NOTICE: Gerrit is back online | 20:51 | |
| *** jsavak has quit IRC | 20:53 | |
| *** openstackgerrit has quit IRC | 20:55 | |
| *** openstackgerrit has joined #openstack-keystone | 20:55 | |
| *** ajayaa has quit IRC | 20:56 | |
| bknudson | see this from keystonemiddleware tests? | 21:00 |
| bknudson | /opt/stack/keystonemiddleware/.tox/py27/local/lib/python2.7/site-packages/requests/packages/urllib3/connection.py:220: SystemTimeWarning: System time is way off (before 2014-01-01). This will probably lead to SSL verification errors | 21:00 |
| *** morgan_remote_ has quit IRC | 21:00 | |
| bknudson | maybe it's related to the new version of requests | 21:01 |
| sigmavirus24 | MadamImAdam: Bob Dylan reference? | 21:01 |
| *** gyee has quit IRC | 21:03 | |
| bknudson | I don't get the warnings with requests==2.3.0, but do get it with requests==2.4.0 and requests==2.4.1 | 21:03 |
| *** marcoemorais has quit IRC | 21:03 | |
| *** marcoemorais has joined #openstack-keystone | 21:04 | |
| *** marcoemorais has quit IRC | 21:05 | |
| MadamImAdam | sigmavirus24, yeah, sure, why not. | 21:05 |
| *** marcoemorais has joined #openstack-keystone | 21:05 | |
| sigmavirus24 | heh | 21:05 |
| sigmavirus24 | bknudson: that's a warning in urllib3 that shows up on unverified connections | 21:05 |
| sigmavirus24 | There's a bug to allow the user to turn those off | 21:06 |
| *** marcoemorais has quit IRC | 21:06 | |
| *** marcoemorais has joined #openstack-keystone | 21:06 | |
| bknudson | sigmavirus24: we don't need to see those when running tests. | 21:07 |
| sigmavirus24 | No one's had the opportunity to work on it. Pull requests are more than welcome | 21:07 |
| *** jasonsb has joined #openstack-keystone | 21:08 | |
| bknudson | looks like it uses python warnings so I should be able to turn it off already. | 21:10 |
| *** cjellick has quit IRC | 21:15 | |
| CaptainMorgan | MadamImAdam, casual nick? Nay, it be talk like a pirate day. | 21:16 |
| MadamImAdam | CaptainMorgan, guess it is time to work on my Somali, then | 21:16 |
| *** jorge_munoz has quit IRC | 21:16 | |
| CaptainMorgan | MadamImAdam, hehe | 21:16 |
| MadamImAdam | Waxaan ahay kabtanka hadda. | 21:17 |
| CaptainMorgan | hahaha | 21:17 |
| CaptainMorgan | oh no what have i started... | 21:17 |
| *** andreaf has quit IRC | 21:17 | |
| *** andreaf has joined #openstack-keystone | 21:18 | |
| MadamImAdam | http://www.ganfyd.org/images/6/6e/Touched_by_His_Noodly_Appendage.jpg | 21:18 |
| CaptainMorgan | MadamImAdam, lol oh dear | 21:19 |
| *** gordc has quit IRC | 21:19 | |
| MadamImAdam | Oh look, a teapot shaped planet is orbiting in my Basement. | 21:20 |
| *** cjellick has joined #openstack-keystone | 21:22 | |
| MadamImAdam | I am the Flying Spaghetti Monster. Thou shalt have no other monsters before Me. (Afterwards is OK; just use protection.) The only Monster who deserves capitalization is Me! Other monsters are false monsters, undeserving of capitalization. | 21:26 |
| stevemar | MadamImAdam, even Nessie? shes a pronoun. | 21:27 |
| *** cjellick has quit IRC | 21:27 | |
| MadamImAdam | stevemar, Nessie Nae be na Monster. She's a dear, she be. | 21:27 |
| *** _cjones_ has quit IRC | 21:27 | |
| stevemar | MadamImAdam, but it's in her name :( | 21:27 |
| *** cjellick has joined #openstack-keystone | 21:28 | |
| stevemar | there are no other monsters in Loch Ness | 21:28 |
| MadamImAdam | stevemar, that statement is unverifiable | 21:28 |
| stevemar | ya got a point there | 21:28 |
| *** CaptainMorgan is now known as morganfainberg | 21:28 | |
| MadamImAdam | There is a teapot shaped monster circling Loch Ness even as we speak | 21:28 |
| MadamImAdam | but it is not worthy of capitalization | 21:29 |
| *** _cjones_ has joined #openstack-keystone | 21:29 | |
| *** MadamImAdam is now known as CaptainYoung | 21:30 | |
| CaptainYoung | technically I earned this title. | 21:30 |
| CaptainYoung | But only in the reserves | 21:30 |
| *** david-lyle has joined #openstack-keystone | 21:30 | |
| *** david-lyle has quit IRC | 21:30 | |
| *** rushiagr_away is now known as rushiagr | 21:32 | |
| morganfainberg | hehe | 21:32 |
| *** cjellick has quit IRC | 21:32 | |
| morganfainberg | still earned it! | 21:32 |
| *** saipandi has joined #openstack-keystone | 21:37 | |
| *** CaptainYoung has quit IRC | 21:38 | |
| *** _cjones_ has quit IRC | 21:45 | |
| *** _cjones_ has joined #openstack-keystone | 21:46 | |
| *** rkofman has quit IRC | 21:48 | |
| *** rkofman has joined #openstack-keystone | 21:49 | |
| *** _cjones_ has quit IRC | 21:50 | |
| *** _cjones_ has joined #openstack-keystone | 21:58 | |
| *** harlowja_ has quit IRC | 22:00 | |
| *** harlowja has joined #openstack-keystone | 22:00 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:00 | |
| *** rodrigods_ has joined #openstack-keystone | 22:00 | |
| *** marcoemorais has quit IRC | 22:04 | |
| *** marcoemorais has joined #openstack-keystone | 22:04 | |
| *** marcoemorais has quit IRC | 22:04 | |
| *** marcoemorais has joined #openstack-keystone | 22:05 | |
| *** marcoemorais has quit IRC | 22:05 | |
| *** marcoemorais has joined #openstack-keystone | 22:05 | |
| *** nkinder_ has quit IRC | 22:07 | |
| stevemar | ugh, finally done with that test for ldap ... just making sure the entire suite passes | 22:12 |
| stevemar | bknudson, heads up for ya | 22:12 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Fix user-role-add in LDAP backend https://review.openstack.org/119345 | 22:17 |
| morganfainberg | stevemar, woot 15x lines of code for testing! | 22:17 |
| morganfainberg | oh, not 15, uh, 14 :P | 22:18 |
| stevemar | bknudson, morganfainberg err anyone else ^ | 22:18 |
| stevemar | my normal amount of tabbing isn't working | 22:18 |
| stevemar | :P | 22:18 |
| stevemar | morganfainberg, i *think* that does the trick | 22:18 |
| morganfainberg | stevemar, this *looks* reasonable | 22:19 |
| morganfainberg | stevemar, assume all unit tests are happy? | 22:19 |
| stevemar | the other backend_ldap tests all pass | 22:20 |
| stevemar | i ran them locally | 22:20 |
| morganfainberg | cool | 22:20 |
| *** cjellick has joined #openstack-keystone | 22:21 | |
| *** saipandi has quit IRC | 22:23 | |
| bknudson | change in devstack for auth_token options: https://review.openstack.org/#/c/122882/ | 22:24 |
| *** cjellick has quit IRC | 22:25 | |
| bknudson | I added you all to it | 22:25 |
| *** cjellick has joined #openstack-keystone | 22:25 | |
| bknudson | so when we add new options for v3 auth I'll only have to do it in 1 place. | 22:25 |
| kenatsd | morganfainberg: are you comfortable saying the pooled memcached backend should be the default? | 22:26 |
| morganfainberg | kenatsd, for using memcached? yes | 22:26 |
| morganfainberg | kenatsd, haha i was wondering where you went | 22:26 |
| morganfainberg | kenatsd, if it isn't the default for token, we open up the DOS scenario :( | 22:26 |
| *** cjellick has quit IRC | 22:27 | |
| morganfainberg | for caching, the deployer must pick a backend anyway, so the config docs should be sufficient | 22:27 |
| *** saipandi has joined #openstack-keystone | 22:27 | |
| kenatsd | morganfainberg: i'm just a little worried since it's not really tested in a production like environment | 22:30 |
| *** kenatsd is now known as dstanek | 22:30 | |
| morganfainberg | kenatsd, we could create a new token-backend for it. | 22:31 |
| *** cjellick has joined #openstack-keystone | 22:31 | |
| morganfainberg | my condern is that if we are supporting memcache in eventlet, we need to resolve the thread.local bit | 22:31 |
| morganfainberg | s/condern/concern | 22:31 |
| morganfainberg | dstanek, i'm happy to say it needs to be a new-token backend, and see about an OSSN being published for it instead of making it default for the token persistence backend | 22:35 |
| morganfainberg | and then we can make the pool an option in middleware with a similar oosn | 22:36 |
| morganfainberg | ossn* | 22:36 |
| dstanek | morganfainberg: yeah, i really don't know what to do here. do you think people just haven't run into this issue or people are not using the caching? | 22:36 |
| morganfainberg | for the token persistence backend, i think people don't look at socket usage when talking to memcache or haven't had people try and abuse it in an HA/loadbalanced scenario where you really see the high connection count | 22:38 |
| morganfainberg | for caching, i think very few companies use it. | 22:38 |
| stevemar | bknudson, re your comment, if make it a new unit test, i'd have to fake out another 2 functions | 22:38 |
| morganfainberg | and similarly, you tend to not have people attempting to kill the services this way. | 22:38 |
| morganfainberg | dstanek, i think with auth_token it is less common (except for swift) to use memcache | 22:39 |
| bknudson | stevemar: it doesn't belong in test_backend_ldap because it doesn't depend on different backend configurations. | 22:39 |
| morganfainberg | dstanek, the reason this is all medium prio is because it's not required deployment and *most* people afaict don't deploy with it. | 22:39 |
| bknudson | morganfainberg: they just complain that tokens are filling up their database | 22:40 |
| morganfainberg | bknudson, yeah :( | 22:41 |
| *** topol has quit IRC | 22:43 | |
| *** rodrigods_ has quit IRC | 22:44 | |
| morganfainberg | dstanek, so i'm not opposed to either approach just as long as we decide the way we're solving it :) | 22:46 |
| *** achampion has joined #openstack-keystone | 22:46 | |
| morganfainberg | dstanek, that way we can give an option to avoid eventlet + memcache ick scenarios. | 22:47 |
| *** saipandi has quit IRC | 22:48 | |
| *** saipandi has joined #openstack-keystone | 22:48 | |
| dstanek | morganfainberg: yeah, i agree. i'm just worried that while functional and passing tests that we haven't really put this through it's paces. | 23:04 |
| morganfainberg | dstanek, so lets make it a secondary driver that people can opt into. | 23:04 |
| morganfainberg | dstanek, and for middleware similar, option to deploy. then we cover our bases and we can talk with the security team to see if an OSSN is worth doing / get one out. | 23:05 |
| dstanek | morganfainberg: i feel much more comfortable with that | 23:06 |
| morganfainberg | dstanek, cool. works for me, should be an easy thing to do | 23:06 |
| bknudson | I think we had an ossa for a similar auth_token issue | 23:10 |
| *** jasonsb has quit IRC | 23:10 | |
| bknudson | in that case it could confuse tokens | 23:10 |
| bknudson | so you could potentially get admin role | 23:11 |
| *** achampio1 has joined #openstack-keystone | 23:16 | |
| *** achampion has quit IRC | 23:19 | |
| *** meker12 has quit IRC | 23:22 | |
| *** zzzeek has quit IRC | 23:23 | |
| stevemar | bknudson, i'm now mocking 4 things, still proceed? | 23:25 |
| stevemar | i now have to mock the value of a mock | 23:25 |
| stevemar | it's getting silly pants | 23:26 |
| *** _cjones_ has quit IRC | 23:29 | |
| *** _cjones_ has joined #openstack-keystone | 23:30 | |
| *** _cjones_ has quit IRC | 23:35 | |
| *** dims has joined #openstack-keystone | 23:36 | |
| *** amcrn has quit IRC | 23:39 | |
| *** dims has quit IRC | 23:41 | |
| stevemar | bknudson, i'm out, it's getting silly, i added a paste in the review comments, maybe you know whats going on, i'm stumped | 23:44 |
| morganfainberg | dstanek, bknudson, ok about to post the updated memcache_pool, splitting it to it's own token backend | 23:46 |
| morganfainberg | added another ..WARNING in the documenation as well | 23:46 |
| morganfainberg | just running tests/doc build/pep8 before posting | 23:46 |
| *** stevemar has quit IRC | 23:49 | |
| *** richm has quit IRC | 23:49 | |
| *** cjellick has quit IRC | 23:51 | |
| *** _cjones_ has joined #openstack-keystone | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
