| *** stevemar has quit IRC | 00:07 | |
| *** dims has joined #openstack-keystone | 00:59 | |
| *** stevemar has joined #openstack-keystone | 01:22 | |
| *** dims has quit IRC | 01:26 | |
| *** rodrigods_ has joined #openstack-keystone | 01:27 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 01:27 | |
| *** dims has joined #openstack-keystone | 01:30 | |
| *** dims_ has joined #openstack-keystone | 01:31 | |
| *** dims has quit IRC | 01:35 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:40 | |
| *** dims_ has quit IRC | 01:40 | |
| *** dims has joined #openstack-keystone | 01:41 | |
| *** dims has quit IRC | 01:45 | |
| *** miqui has quit IRC | 02:06 | |
| *** diegows has quit IRC | 02:08 | |
| *** rodrigods_ has quit IRC | 03:09 | |
| *** shakamunyi has joined #openstack-keystone | 03:25 | |
| *** shakamunyi has quit IRC | 04:00 | |
| *** rushiagr_away is now known as rushiagr | 04:40 | |
| *** dims has joined #openstack-keystone | 04:41 | |
| *** dims has quit IRC | 04:46 | |
| *** topol has quit IRC | 05:03 | |
| *** yasu_ has joined #openstack-keystone | 05:06 | |
| *** ajayaa has joined #openstack-keystone | 05:24 | |
| *** ajayaa has quit IRC | 05:41 | |
| stevemar | morganfainberg i'm pushing bknudson's fix for middleware | 05:53 |
|---|---|---|
| stevemar | it made jenkins happy | 05:53 |
| *** ajayaa has joined #openstack-keystone | 05:54 | |
| *** david-lyle has joined #openstack-keystone | 05:59 | |
| *** Clabbe has joined #openstack-keystone | 06:13 | |
| *** k4n0 has joined #openstack-keystone | 06:20 | |
| *** stevemar has quit IRC | 06:22 | |
| *** Sanchit has joined #openstack-keystone | 06:22 | |
| Sanchit | Hi | 06:22 |
| Sanchit | When "allow_account_management" is set to true in "proxy-server.conf" file, the reseller admin is allowed to perform PUT and DELETE operations on an account, but when "allow_account_management" is set to false in "proxy-server.conf" file, the mentioned operations are not allowed. | 06:23 |
| Sanchit | So, in the second case, when "allow_account_management" is set to false in "proxy-server.conf" file , Who(and How) can create and delete an account? | 06:23 |
| *** henrynash has joined #openstack-keystone | 06:31 | |
| *** mflobo has joined #openstack-keystone | 06:37 | |
| *** lufix has joined #openstack-keystone | 06:50 | |
| *** lufix has quit IRC | 06:51 | |
| *** lufix has joined #openstack-keystone | 06:51 | |
| *** meker12 has joined #openstack-keystone | 06:52 | |
| *** afazekas has joined #openstack-keystone | 06:53 | |
| *** meker12 has quit IRC | 07:04 | |
| *** kashyap has joined #openstack-keystone | 07:18 | |
| kashyap | Hi, when I try to create a Keystone user (this is with Juno M3): | 07:20 |
| kashyap | ProgrammingError: (ProgrammingError) (1146, "Table 'keystone.token' doesn't exist") 'SELECT token.id AS token_id, token.expires AS token_expires, token.extra AS token_extra, token.valid AS token_valid, token.user_id AS token_user_id, token.trust_id AS token_trust_id \nFROM token \nWHERE token.id = %s' ('ADMIN_TOKEN',) | 07:20 |
| kashyap | Any hints here? | 07:20 |
| kashyap | Crap, please ignore me. | 07:24 |
| *** ukalifon1 has joined #openstack-keystone | 07:24 | |
| *** garcianavalon has joined #openstack-keystone | 07:26 | |
| kashyap | Hmm, I incorrectly exported the ADMIN token value, now after correctly exporting it, I now seet a "TProgrammingError able 'keystone.domain' doesn't exist" | 07:26 |
| *** henrynash has quit IRC | 07:49 | |
| *** henrynash has joined #openstack-keystone | 07:49 | |
| *** KanagarajM has joined #openstack-keystone | 08:20 | |
| *** ajayaa has quit IRC | 08:32 | |
| *** k4n0 has quit IRC | 08:33 | |
| *** rushiagr is now known as rushiagr_away | 08:44 | |
| *** rushiagr_away is now known as rushiagr | 08:45 | |
| *** amakarov_away is now known as amakarov | 08:47 | |
| *** ajayaa has joined #openstack-keystone | 08:48 | |
| *** k4n0 has joined #openstack-keystone | 08:51 | |
| *** rushiagr is now known as rushiagr_away | 08:56 | |
| *** david-lyle has quit IRC | 09:03 | |
| *** rushiagr_away is now known as rushiagr | 09:23 | |
| *** k4n0 has quit IRC | 09:44 | |
| *** ajayaa has quit IRC | 09:50 | |
| *** andreaf_ is now known as andreaf | 10:01 | |
| *** ajayaa has joined #openstack-keystone | 10:02 | |
| *** jasondotstar has joined #openstack-keystone | 10:07 | |
| *** aix has joined #openstack-keystone | 10:16 | |
| *** mitz_ has joined #openstack-keystone | 10:22 | |
| *** topol has joined #openstack-keystone | 10:27 | |
| *** k4n0 has joined #openstack-keystone | 10:30 | |
| *** topol has quit IRC | 10:32 | |
| *** zigo has quit IRC | 10:50 | |
| *** zigo has joined #openstack-keystone | 10:52 | |
| *** yasu_ has quit IRC | 10:54 | |
| *** dims has joined #openstack-keystone | 10:59 | |
| *** Daviey has quit IRC | 11:09 | |
| *** shakamunyi has joined #openstack-keystone | 11:18 | |
| *** Daviey has joined #openstack-keystone | 11:19 | |
| *** shakamunyi has quit IRC | 11:20 | |
| *** diegows has joined #openstack-keystone | 11:25 | |
| *** achampion has quit IRC | 11:58 | |
| *** marzif__ has quit IRC | 12:02 | |
| *** KanagarajM has quit IRC | 12:06 | |
| *** openstackgerrit has joined #openstack-keystone | 12:14 | |
| *** wanghong has quit IRC | 12:18 | |
| *** wanghong has joined #openstack-keystone | 12:18 | |
| *** rushiagr is now known as rushiagr_away | 12:35 | |
| *** dims has quit IRC | 12:38 | |
| *** andreaf is now known as andreaf_ | 12:38 | |
| *** dims has joined #openstack-keystone | 12:38 | |
| *** gordc has joined #openstack-keystone | 12:39 | |
| *** ajayaa has quit IRC | 12:45 | |
| marekd | are we open with keystone-specs again? | 12:56 |
| *** alex_xu has quit IRC | 13:04 | |
| *** BAKfr has joined #openstack-keystone | 13:04 | |
| *** achampion has joined #openstack-keystone | 13:08 | |
| *** nkinder_ has quit IRC | 13:12 | |
| *** radez_g0n3 is now known as radez | 13:19 | |
| *** bknudson has quit IRC | 13:21 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Remove depreacted kvs backends https://review.openstack.org/123122 | 13:23 |
| henrynash | marekd: there’s a kilo directory in specs….that’s always open (well until we finish Kilo :-) ) | 13:24 |
| marekd | henrynash: ok | 13:27 |
| marekd | thanks :-) | 13:27 |
| henrynash | marekd: I just posted a spec there myself :-) | 13:28 |
| *** zzzeek has joined #openstack-keystone | 13:42 | |
| *** joesavak has joined #openstack-keystone | 13:46 | |
| *** topol has joined #openstack-keystone | 13:48 | |
| *** victsou has joined #openstack-keystone | 13:49 | |
| garcianavalon | join #openstack-horizon | 13:51 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:53 | |
| *** jaosorior has joined #openstack-keystone | 13:54 | |
| *** victsou has quit IRC | 13:55 | |
| *** bknudson has joined #openstack-keystone | 13:56 | |
| *** victsou has joined #openstack-keystone | 13:59 | |
| *** jsavak has joined #openstack-keystone | 14:04 | |
| *** joesavak has quit IRC | 14:08 | |
| *** ayoung has joined #openstack-keystone | 14:11 | |
| mhu | marekd, thx :) | 14:12 |
| marekd | mhu: no problem. | 14:12 |
| *** stevemar has joined #openstack-keystone | 14:13 | |
| mhu | marekd, I was addressing yours and dean's comments, I am about to upload some changes | 14:13 |
| marekd | mhu: ok, great! | 14:13 |
| *** nkinder_ has joined #openstack-keystone | 14:14 | |
| *** andreaf has joined #openstack-keystone | 14:15 | |
| *** alex_xu has joined #openstack-keystone | 14:17 | |
| ayoung | In the interest of getting the KC usable by Horizon.... can https://review.openstack.org/#/c/106838/ get some attention please? | 14:19 |
| *** k4n0 has quit IRC | 14:19 | |
| *** david-lyle has joined #openstack-keystone | 14:24 | |
| *** david-lyle has quit IRC | 14:24 | |
| *** david-lyle has joined #openstack-keystone | 14:27 | |
| *** david-lyle has quit IRC | 14:29 | |
| ayoung | morganfainberg, http://www.bailis.org/blog/understanding-weak-isolation-is-a-serious-problem/ describes what you saw in Galera WRT trust counters | 14:31 |
| *** andreaf has quit IRC | 14:31 | |
| *** Tahmina has joined #openstack-keystone | 14:36 | |
| *** richm1 has joined #openstack-keystone | 14:36 | |
| *** david-lyle has joined #openstack-keystone | 14:40 | |
| *** samuelmz has quit IRC | 14:53 | |
| *** samuelmz has joined #openstack-keystone | 14:53 | |
| *** diegows has quit IRC | 14:55 | |
| dstanek | ayoung: that's pretty interesting | 14:55 |
| ayoung | dstanek, yep...Databases are hard. Lets go NoSQLing | 14:55 |
| marekd | ayoung: you serious now? | 14:56 |
| ayoung | marekd, I am always seriours. All Ways. | 14:56 |
| dstanek | ayoung: those are harder because devs think they are easy and don't get the corner cases :-) this is why i don't like mongo any more | 14:56 |
| ayoung | seriouserand seriouser | 14:56 |
| ayoung | dstanek, I couldn't like it any less | 14:56 |
| marekd | ayoung: dstanek any experience with redis? (looking for opinions) | 14:57 |
| dstanek | marekd: redis is nice, but i mostly have used is as a kvs | 14:57 |
| ayoung | marekd, we have one real choice. PostgreSQL. The rest are going to corrupt your data. | 14:58 |
| dstanek | marekd: i've only used there more complex data structures a tiny bit | 14:58 |
| marekd | ayoung: PostgreSQL with NoSQL features? | 14:58 |
| dstanek | marekd: i have never used it as permanent storage | 14:58 |
| marekd | ayoung: or i misunerstood you. | 14:58 |
| ayoung | marekd, bite your toungue | 14:58 |
| dstanek | marekd: what features do you need? | 14:58 |
| marekd | dstanek: cannot say, just bit my tongue :( | 14:59 |
| marekd | dstanek: no i was going to try some database that could be used in a highly scalable environments out of the box. | 14:59 |
| ayoung | ACID | 14:59 |
| dstanek | ayoung: we're not talking about your party habits here :-) | 15:00 |
| ayoung | marekd, this is why we want to make tokens ephemeral. The more we can avoid the Database issues, the better off we ll are | 15:01 |
| dstanek | marekd: SQL can scale nicely with the right architecture - i would only use nosql if you have a specific need like schemaless | 15:01 |
| marekd | dstanek: uhm | 15:02 |
| ayoung | dstanek, the only acid I've expereicnes at parties was reflux. Despite 10+ years living in San Francisco, I've never done any drugs harder than alcohol and tobacco. Guess Nancy Reagan was successful with me. | 15:02 |
| dstanek | i found mongo to be incredibly hard to scale | 15:02 |
| marekd | dstanek: why? | 15:02 |
| dstanek | marekd: i found it very hard to deal with reworking shards (adding mostly) - working set restriction made running it very, very costly | 15:03 |
| marekd | dstanek: btw you once told me that super() would handle calling methods from all the parents: http://pasteraw.com/cenz1mz4l00oq0zolofl7l5d8jaj6la while this code prints 'A' instead of 'AB'. | 15:04 |
| dstanek | marekd: i started writing a blog post to address your question, but got side tracked | 15:04 |
| *** joesavak has joined #openstack-keystone | 15:04 | |
| marekd | dstanek: what's your blog addreess? | 15:04 |
| marekd | (for future) | 15:05 |
| dstanek | traceback.org | 15:05 |
| marekd | dstanek: thanks. | 15:06 |
| *** jsavak has quit IRC | 15:06 | |
| dstanek | marekd: i have a local version with a totally new design, but i just haven't had the time :-( | 15:07 |
| marekd | sure thing. | 15:07 |
| dstanek | marekd: multiple parents is generally a bad thing and that's why other languages like Java forbid it | 15:08 |
| dstanek | marekd: it's useful (to me) for mixins, but they you would never need super for those since you're not inheriting methods | 15:09 |
| dstanek | marekd: here is you example fixed http://paste.openstack.org/show/114176/ | 15:09 |
| ayoung | Only in OpenStack have I seen a long time developer's patches get derailed by a newcomer non-core making nitpicking, non-essential code review comments. Something is broken in our process. | 15:10 |
| dstanek | ayoung: what patch is that? | 15:10 |
| ayoung | multiple inheritance is an indication that you should probably be using composition instead | 15:10 |
| ayoung | dstanek, so many...right now it is | 15:10 |
| ayoung | https://review.openstack.org/#/c/106838/ | 15:11 |
| dstanek | marekd: the old school way http://paste.openstack.org/show/114177/ | 15:11 |
| ayoung | Its like ... it sits there for a week, and then someone comes in and snipes... | 15:11 |
| dstanek | marekd: in the second version of AllTests the TestCase initialized is called twice, which is what testtools was preventing | 15:11 |
| ayoung | dstanek, I'm just a little frustrated trying to Kerberize Horizon...its just such a PITA, as it requires aligning changes across four projects. I have patches that don't work on Django due to needing this feature in the client | 15:15 |
| ayoung | and no one pays attention to the client, look at how long jamielennox 's queue is. | 15:15 |
| ayoung | makes me long for the days when termie could just swoop in and rewrite all of keystone with no code review what-so-ever | 15:15 |
| dstanek | ayoung: i find it takes me a long time to review many of the clients reviews out there because i find the general design over engineered and overly complicated | 15:19 |
| ayoung | dstanek, really? The client/session/auth-plugin structure or something else? | 15:20 |
| dstanek | ayoung: yes, session, plugins, etc. there is a lot of code to do what we do in there | 15:21 |
| *** cjellick has joined #openstack-keystone | 15:21 | |
| marekd | dstanek: i must confess i didn't really understand why your fixed exmaple prints 'BA'. I guess it has something in common with MRO. | 15:21 |
| *** jamielennox has quit IRC | 15:22 | |
| ayoung | dstanek, so I think the session piece is confusing to someone coding themselves, and really is more of a mechansim for the other clients to use. I Don;t really like exposing it to Django | 15:22 |
| ayoung | dstanek, here's what I would like it to look like: | 15:22 |
| marekd | dstanek: ayoung and lots of **kwargs arguments disappearing somewhere in the clas hierarchy (because they are popped), lots oh inheritance and base.* classes ;/ | 15:22 |
| dstanek | marekd: basically super(X, self) will calculate the mro (so only unique classes) and call the next one in the chain - if that user super then it's rinse and repeat | 15:23 |
| ayoung | yeah, jamies' been battling all the backwards compatibility issues with the old code | 15:23 |
| ayoung | the session stuff probably should be exposable but not required | 15:23 |
| dstanek | marekd: if you don't what the parent's version called then you omit the super() call - but super is cooperative so everything should generally use it for it to work as expected | 15:23 |
| marekd | dstanek: okay | 15:24 |
| marekd | dstanek: makes sense. | 15:24 |
| dstanek | marekd: that's why i needed Object so that both A and B could call super() and not get a TypeError | 15:24 |
| dolphm | \o/ | 15:26 |
| marekd | dstanek: yeah. On the other hand it's makes a diamond class hierarchy with silend method. And often you cannot change parents. | 15:26 |
| marekd | dolphm: o/ | 15:26 |
| *** jorge_munoz has joined #openstack-keystone | 15:27 | |
| dstanek | hey dolphm - why are you doing? | 15:27 |
| dstanek | s/why/how/ | 15:28 |
| marekd | dstanek: what if I cannot change A and B and A.f() and B.f() sets some attributes that I will later need in my Derived(A,B) class? | 15:28 |
| dolphm | dstanek: really well | 15:28 |
| dstanek | dolphm: that's good to hear. | 15:29 |
| dolphm | anyone have a link to that ksc review to fix the options iterator thing? | 15:30 |
| dolphm | https://bugs.launchpad.net/python-keystoneclient/+bug/1372152 ^ | 15:33 |
| uvirtbot | Launchpad bug 1372152 in python-keystoneclient "'help' is not working for several subcommands (version 0.11.0)" [High,In progress] | 15:33 |
| *** lufix has quit IRC | 15:38 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 wrapper plugin for full federation authN https://review.openstack.org/106751 | 15:40 |
| *** r-daneel has joined #openstack-keystone | 15:50 | |
| *** david-lyle has quit IRC | 15:53 | |
| *** _cjones_ has joined #openstack-keystone | 15:53 | |
| *** cjellick has quit IRC | 15:55 | |
| *** david-lyle has joined #openstack-keystone | 15:55 | |
| *** cjellick has joined #openstack-keystone | 15:55 | |
| *** jsavak has joined #openstack-keystone | 15:56 | |
| *** amerine has joined #openstack-keystone | 15:56 | |
| *** joesavak has quit IRC | 15:56 | |
| *** victsou has quit IRC | 15:57 | |
| *** joesavak has joined #openstack-keystone | 15:58 | |
| *** jsavak has quit IRC | 16:01 | |
| *** diegows has joined #openstack-keystone | 16:06 | |
| *** henrynash has quit IRC | 16:09 | |
| *** saipandi has joined #openstack-keystone | 16:11 | |
| *** garcianavalon has quit IRC | 16:11 | |
| kashyap | [JunoM3 User question] Hi, In IceHouse, "By default, the Identity Service creates a special _member_ role." -- It isn't the case in Juno? Because: | 16:12 |
| kashyap | $ keystone user-role-add --user=admin --tenant=admin --role=_member_ | 16:12 |
| kashyap | No role with a name or ID of '_member_' exists. | 16:12 |
| *** marcoemorais has joined #openstack-keystone | 16:15 | |
| nkinder_ | kashyap: I see _member_ in my Juno setup | 16:15 |
| nkinder_ | kashyap: what does 'keystone role-list' show as admin on your system? | 16:15 |
| YorikSar | morganfainberg: ping | 16:15 |
| kashyap | nkinder_, One moment. | 16:16 |
| *** wwriverrat has joined #openstack-keystone | 16:16 | |
| kashyap | (These is are on F21/Rawhide.) | 16:16 |
| YorikSar | dstanek: Or mb you're around? | 16:16 |
| kashyap | nkinder_, It lists only 'admin' role. | 16:16 |
| ayoung | kashyap, there is a config option that defines what role to user for add_user-to-project | 16:17 |
| dstanek | YorikSar: hi | 16:17 |
| *** wwriverrat has left #openstack-keystone | 16:17 | |
| nkinder_ | kashyap: is this a RDO setup via packstack? | 16:17 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/common/config.py#L105 | 16:17 |
| YorikSar | dstanek: Hi. Do you know if morganfainberg is working on memcache pool CR? | 16:17 |
| dstanek | YorikSar: no idea, i haven't seen him yet this morning | 16:18 |
| YorikSar | dstanek: Oh, right, it's Monday morning your time :) | 16:18 |
| YorikSar | dstanek: Ok, I'll just do some cleanup there then. | 16:18 |
| dstanek | it's noon here, which mean 9am for morganfainberg | 16:19 |
| nkinder_ | kashyap: for my all-in-one, I have admin, _member_, ResellerAdmin, and SwiftOperator | 16:19 |
| *** Tahmina has quit IRC | 16:19 | |
| ayoung | dstanek, dolphm what do you think is the right relationship between KC client sessions and Django OpenStack Auth/Horizon? Does the session abstraction even mean anything there? | 16:20 |
| dolphm | ayoung: if you can serlialize the ksc session, why not? | 16:21 |
| ayoung | If a user sends two requests to DOA, they are going to create clients from scratch, based on the token stored in the HTTP session. I don't know if a KC session would/should persist across multiple requests to Horizon | 16:21 |
| ayoung | dolphm, well, right now I don;t think we can. | 16:21 |
| dolphm | ayoung: probably not (i haven't tried, anyway), but that was one of jamie's original goals | 16:21 |
| dstanek | ayoung: i'm not sure what the advantage would be to persist the ksc sesson | 16:22 |
| ayoung | dolphm, I saw a case in one of the patches where serialization failed to the keyring. | 16:22 |
| * kashyap 's IRC proxy got dropped briefly. If something was addressed to me, please re-post. | 16:22 | |
| ayoung | dolphm, dstanek Why do we have that abstrction? I understand client and plugin, but not session | 16:22 |
| ayoung | I mean, I know that requests has a session, what is the KC client adding to that abstraction? | 16:23 |
| ayoung | I originally thought it was so that the same rules were applied when talking to each of the endpoints, but they would have to have their own sessions the way it is coded | 16:23 |
| dstanek | ayoung: the way i understand it is that it benefits you when constructing with credential that have to be evaluated by keystone (email+password) so that you only have to do it once | 16:24 |
| dstanek | ayoung: kind of like a cookiejar when scrapping HTTP sites | 16:24 |
| kashyap | nkinder_, My current DevStack setup has it too, thanks for confirming. I'll investigate my setup more. | 16:25 |
| ayoung | dstanek, So you would expect the session object to be shared across multiple clients (Nova, Glance and the like?) | 16:25 |
| dstanek | ayoung: yes, if they are within the same process | 16:25 |
| *** BAKfr has quit IRC | 16:26 | |
| ayoung | kashyap, _member_ was done in a migration way back when we removed direct "membership" of users in projects | 16:26 |
| ayoung | dstanek, so for Horizon, the right approach would be for the session to be persisted, not the token, in the users cookie? | 16:26 |
| dolphm | ayoung: i don't think it was a migration. it's only dynamically created on v2 default tenancy assignments | 16:26 |
| dolphm | if you don't use v2, you'll never have a _member_ role | 16:26 |
| ayoung | dolphm, I wrote it | 16:26 |
| ayoung | it has been collapsed since then | 16:27 |
| ayoung | it was around migration 16 or so, | 16:27 |
| kashyap | ayoung, I see, I'll look up the config option you alluded to above too. I'm just puzzled why I don't see the _member_ role in this fresh setup | 16:27 |
| ayoung | kashyap, do you have that config option set in the keystone.conf? | 16:27 |
| * kashyap checks | 16:27 | |
| ayoung | My guess is we are finally doing "Member" and not "_member_" | 16:28 |
| kashyap | notmyname, it's not there: | 16:28 |
| kashyap | $ grep member /etc/keystone/keystone.conf | grep -v ^$ | grep -v ^# | 16:28 |
| kashyap | echo $? | 16:28 |
| kashyap | 1 | 16:28 |
| notmyname | ? | 16:28 |
| ayoung | kashyap, that looks suspect | 16:28 |
| kashyap | nonameentername, Err, didn't mean to prompt you, bad tab complete :-( | 16:28 |
| kashyap | Argh, notmyname I meant | 16:29 |
| * kashyap just can't type | 16:29 | |
| ayoung | kashyap, what happens when you call the V2 api to add a user to a project? | 16:29 |
| * notmyname is very familiar with erroneous tab-complete ;-) | 16:29 | |
| *** r-daneel has quit IRC | 16:29 | |
| kashyap | ayoung, You have a quick handy CLI for that? | 16:29 |
| ayoung | coming up | 16:29 |
| ayoung | kashyap, you have an RDO set up with the defaults? | 16:30 |
| kashyap | ayoung, No, to give you the horror, this is hand configured, just started w/ Keystone. | 16:30 |
| ayoung | kashyap, ah, that is why | 16:30 |
| *** marcoemorais has quit IRC | 16:30 | |
| samuelmz | lbragstad, I replied your comments on bugs #1367480 and #1367740 | 16:30 |
| ayoung | we dropped the migration, so you wouldn | 16:30 |
| ayoung | 't have it | 16:31 |
| uvirtbot | Launchpad bug 1367480 in keystone "Add test for grant CRUD on test_backend" [Undecided,New] https://launchpad.net/bugs/1367480 | 16:31 |
| uvirtbot | Launchpad bug 1367740 in keystone "Assignment backends raise non-suggestive exception in grant CRUD" [Undecided,New] https://launchpad.net/bugs/1367740 | 16:31 |
| samuelmz | lbragstad, I'd be glad if you could take a look at them | 16:31 |
| kashyap | ayoung, I'm taking good notes, I can quickly post you a URL if you want to see the sequence of commands I ran. | 16:31 |
| *** marcoemorais has joined #openstack-keystone | 16:31 | |
| lbragstad | samuelmz: sure thing, I'll add them to my queue | 16:31 |
| kashyap | ayoung, Ah, so, what you suggest? | 16:31 |
| morganfainberg | ayoung, interesting article | 16:32 |
| ayoung | kashyap, you need a role for that | 16:32 |
| samuelmz | lbragstad, thanks | 16:32 |
| lbragstad | samuelmz: np | 16:32 |
| ayoung | kashyap, I'd suggest making the role name 'Member' as that is what Horizon does | 16:32 |
| kashyap | ayoung, Okay, will try | 16:33 |
| ayoung | kashyap, we couldn't do that in the migration for fear of conflicting with that role, which is why _member_ | 16:33 |
| ayoung | kashyap, the UUID value for it is probably fine. | 16:33 |
| *** r-daneel has joined #openstack-keystone | 16:33 | |
| kashyap | ayoung, Since I'm not going to use Horizon, so shall I just create the _member_ role and be done w/ it? $ keystone role-create --name _member_ | 16:34 |
| * kashyap just tries | 16:34 | |
| ayoung | kashyap, no make it Mmeber and set the config option too | 16:34 |
| kashyap | ayoung, Ah, okay. | 16:35 |
| ayoung | that is the expected approach. | 16:35 |
| ayoung | kashyap, the default is just a case of "make one mistake and support it for the rest of your life" | 16:35 |
| kashyap | ayoung, Okay, Member role created; now can you please spell out where do I set this config option | 16:36 |
| ayoung | no | 16:36 |
| kashyap | :-) | 16:36 |
| ayoung | woops | 16:36 |
| ayoung | kashyap, heh | 16:36 |
| ayoung | in /etc/keystone/keystone.conf | 16:36 |
| kashyap | I can take no as an answer to "go do your homework" | 16:36 |
| ayoung | the option is the member name one | 16:36 |
| ayoung | member_role_name=Member | 16:37 |
| ayoung | kashyap, take it as "Adam's 8 year old got up too damn early today and Adam is more grumpy, grouchy and irritable than usual" | 16:37 |
| kashyap | ayoung, I appreciate your time, won't leech it more. | 16:38 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Add an optional advanced pool of memcached clients https://review.openstack.org/119774 | 16:38 |
| kashyap | ayoung, Thank you, it works. /me moves forward. | 16:40 |
| morganfainberg | dstanek, re: https://review.openstack.org/#/c/119774/ rebased on to the fix | 16:40 |
| morganfainberg | dstanek, it was a test failure in master due to changed in ksc | 16:40 |
| dolphm | morganfainberg: i was going to suggest discussing bug 1362245 in tomorrow's meeting, but i'm not sure i'll be there. see my comment at the bottom of https://review.openstack.org/#/c/122046/ | 16:43 |
| uvirtbot | Launchpad bug 1362245 in keystone "Update Endpoint Filter APIs" [Low,In progress] https://launchpad.net/bugs/1362245 | 16:43 |
| morganfainberg | dolphm, looking. | 16:43 |
| dolphm | morganfainberg: thoughts on mark as Won't Fix & dropping from RC1? | 16:43 |
| *** jsavak has joined #openstack-keystone | 16:43 | |
| morganfainberg | dolphm, thinking at the very least dropping from RC | 16:43 |
| dolphm | morganfainberg: then if it's not fixed in Juno, i'd rather keep the small wart | 16:43 |
| morganfainberg | dolphm, works for me | 16:44 |
| dolphm | alrighty, i'll push buttons | 16:44 |
| morganfainberg | dolphm, it's not a *big* deal, it's a minor "oh bah this is less consistent than we may have wanted but not crazy weird" | 16:44 |
| ayoung | dolphm, OK, lets assume for the moment that we make Session persistable. Would it then make sense that if a session starts with the Password plugin, it should automatically swap it to a token plugin after authentication? Or, better yet, you never actually assign the password plugin to the session, just use it to allocate the token? | 16:45 |
| *** henrynash has joined #openstack-keystone | 16:45 | |
| *** joesavak has quit IRC | 16:45 | |
| ayoung | The only cases where I can see reusing the auth plugin after initial authentication makes sense is X509/Kerberos cases where the client plugins will be setting some aspect of the request outside the payload body | 16:46 |
| dolphm | morganfainberg: exactly | 16:47 |
| dolphm | ayoung: i'll defer to jamie on those :) | 16:47 |
| *** r-daneel has quit IRC | 16:49 | |
| *** r-daneel_ has joined #openstack-keystone | 16:49 | |
| ayoung | dolphm, I don't think he'd want that. I think he's been working on this in isolation for too long; we really should all understand and, if not agree on the design, at least agree on the problems | 16:49 |
| ayoung | dolphm, and he isn't here...he's out getting all spousified | 16:50 |
| morganfainberg | ayoung, /me reads the backscroll on this topic | 16:52 |
| morganfainberg | YorikSar, pong | 16:52 |
| ayoung | dolphm, I mean, if we can't understand the rationale, how do we expect the people that use the client to | 16:52 |
| YorikSar | morganfainberg: Good morning :) | 16:53 |
| morganfainberg | YorikSar, morning, how are you? | 16:53 |
| ayoung | dolphm, if we persist the session, we can't persist the password. That would be a security issue. | 16:53 |
| YorikSar | morganfainberg: I'm doing some cleanup on new version of Keystone CR. | 16:53 |
| ayoung | And the Password plugin has to hold on to the password | 16:53 |
| YorikSar | morganfainberg: I'm sorry for being absent for so long. | 16:53 |
| morganfainberg | YorikSar, no worries. I was planning on talking to you today about it :) | 16:53 |
| ayoung | If we don't hold on to the password, however, a client program will not be able to reauthenticate once the token expires | 16:54 |
| morganfainberg | YorikSar, it happens man, we're all busy (which is why i've been trying to help it along) | 16:54 |
| dstanek | morganfainberg: the 2.6 failure? | 16:54 |
| morganfainberg | dstanek, yep | 16:54 |
| morganfainberg | dstanek, same issue as the composite auth one had with py26/27/33 | 16:54 |
| morganfainberg | YorikSar, so the big change I made was just splitting it out as optional rather than default. This is because there is some general concern about the drive time on the code in production/production ready and we don't want to leave people high-and-dry if it doesn't work for them. | 16:55 |
| YorikSar | morganfainberg: So far I've fixed all comments and removed all timeouts in tests (zeroed them) to not wait at all. | 16:55 |
| YorikSar | morganfainberg: Yeah, sure. That's reasonable. | 16:56 |
| morganfainberg | YorikSar, ok cool. | 16:56 |
| morganfainberg | YorikSar, sounds good, lets get this wrapped up today if possible :) | 16:57 |
| YorikSar | morganfainberg: I'll post new changes shortly. | 16:57 |
| morganfainberg | YorikSar, great! thanks for this :) | 16:57 |
| YorikSar | morganfainberg: unittests are passing, short 'battle' test and we're good :) | 16:57 |
| morganfainberg | yay! | 16:58 |
| YorikSar | morganfainberg: btw, about comment on copyrights. Did I get it right that you prefer to not leave them around at all? | 16:59 |
| samuelmz | dstanek, I replied your comment on bug #1360406 ... I'd be glad if you could take a look at that .. | 16:59 |
| uvirtbot | Launchpad bug 1360406 in keystone "Wrong return from list role assignments on KVS" [Low,In progress] https://launchpad.net/bugs/1360406 | 16:59 |
| samuelmz | dstanek, we should decide if we'll merge or abandon the patch . | 16:59 |
| morganfainberg | YorikSar, i prefer they not be there, but there is no reason to remove them if your org requires them. officially we allow them. | 16:59 |
| morganfainberg | in fact, i should probably 2x check to see if I am *supposed* to start adding them. | 17:00 |
| YorikSar | morganfainberg: I have no idea if Mirantis requires them... So let's leave them to not hold the patch :) | 17:00 |
| morganfainberg | YorikSar, yeah no one should hold up the patch for a company copyright. The only case I would say we have an issue is if someone assigns the copyright to the Foundation and they do not work for the foundation. That doesn't work. | 17:01 |
| dstanek | samuelmz: i was leaving it open for the likes of dolphm, morganfainberg and other cores to comment | 17:01 |
| YorikSar | morganfainberg: Yeah... | 17:01 |
| dstanek | samuelmz: henrynash has plans to kill that code https://review.openstack.org/#/c/123122/ | 17:02 |
| YorikSar | morganfainberg: Wow, I got commit hash 0010803 - 11 leading 0 bits and digits only! That's a rare one :) | 17:02 |
| morganfainberg | lol | 17:02 |
| morganfainberg | YorikSar, nice! | 17:03 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:04 | |
| morganfainberg | samuelmz, dstanek, basically I don't see a reason to include that in Juno. | 17:04 |
| morganfainberg | samuelmz, dstanek, if it's not in juno i don't think we need to fix it because KVS is going away in Kilo | 17:04 |
| dstanek | morganfainberg: samuelmz: that was my thinking as well | 17:06 |
| *** afazekas has quit IRC | 17:08 | |
| openstackgerrit | Yuriy Taraday proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 17:09 |
| morganfainberg | dolphm, should we remove the milestone from https://bugs.launchpad.net/keystone/+bug/1362245 as well? | 17:09 |
| uvirtbot | Launchpad bug 1362245 in keystone "Update Endpoint Filter APIs" [Low,In progress] | 17:09 |
| YorikSar | morganfainberg, dstanek: ^ - it showed even more performance than I remember | 17:10 |
| YorikSar | probably its queue stuff | 17:10 |
| dstanek | YorikSar: i didn't realize that you were doing performance tests too | 17:11 |
| dstanek | YorikSar: yeah, i would have expected moving the a Queue to perform better - how much better? | 17:11 |
| YorikSar | dstanek: I'm verifying if it works with 'ab -c 100 -n 1000' and it shows 'Requests per second' as well. | 17:12 |
| YorikSar | dstanek: From what I remember, it was around 80 with previous implementation. Now it's 123 | 17:12 |
| YorikSar | dstanek: I guess deque and stdlib Queue really wins with high load :) | 17:13 |
| YorikSar | dstanek: But that's not an exact benchmark - it's running on a VM, with ab on the same VM, with a lot of moving parts. | 17:14 |
| dstanek | YorikSar: still it's very nice work! | 17:15 |
| samuelmz | dstanek, morganfainberg, I will invalidate the bug and abandon the patch, ok? | 17:15 |
| dstanek | samuelmz: i marked the bug and won't fix with a link to henry's proposal | 17:16 |
| samuelmz | dstanek, ok thanks | 17:16 |
| dstanek | samuelmz: once i have a little more time i want to swing back to the rest of the stuff you guys are working on | 17:16 |
| samuelmz | dstanek, np thanks :-) | 17:17 |
| *** amakarov is now known as amakarov_away | 17:18 | |
| *** harlowja_away is now known as harlowja | 17:21 | |
| *** gyee has joined #openstack-keystone | 17:21 | |
| *** Tahmina has joined #openstack-keystone | 17:28 | |
| ayoung | dstanek, does this make sense: create a new class method on httpclient: client_factory. It Takes in: auth_plugin blus the other session level params, but not the full list. It Uses the auth plugin to get a token, then creates a token plugin and ensures that the session has that. We use the "versionless" interface for the auth plugins (not v2 or v3 specific) but allow the factory to explicitly set one: bypass the forc | 17:29 |
| ayoung | ed discovery. | 17:29 |
| *** cjellick has quit IRC | 17:30 | |
| ayoung | So we hide the session from the end user. | 17:30 |
| *** marcoemorais has quit IRC | 17:31 | |
| ayoung | Builds on top of "use session in authenticate" that I started here: https://review.openstack.org/#/c/122309/ | 17:31 |
| *** marcoemorais has joined #openstack-keystone | 17:32 | |
| *** henrynash has quit IRC | 17:32 | |
| *** joesavak has joined #openstack-keystone | 17:33 | |
| *** jsavak has quit IRC | 17:35 | |
| dstanek | ayoung: sounds sane, but i don't understand the current design. i'd have to look into how it's used now | 17:36 |
| ayoung | dstanek, client has 3 use cases: CLI, auth token middleware, Horizon | 17:36 |
| ayoung | Well, four: HEAT etc | 17:36 |
| *** _cjones_ has quit IRC | 17:38 | |
| *** cjellick has joined #openstack-keystone | 17:38 | |
| *** _cjones_ has joined #openstack-keystone | 17:38 | |
| stevemar | morganfainberg, almost there! | 17:39 |
| *** _cjones_ has quit IRC | 17:41 | |
| *** _cjones_ has joined #openstack-keystone | 17:41 | |
| morganfainberg | stevemar, yessss! | 17:42 |
| *** gyee has quit IRC | 17:43 | |
| *** david-lyle has quit IRC | 17:44 | |
| *** amcrn has joined #openstack-keystone | 17:50 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Fix auth_token for old oslo.config https://review.openstack.org/123198 | 17:51 |
| samuelmz | dolphm, do you still want to support pagination on keystone queries? As described on bug #1009023 | 17:53 |
| uvirtbot | Launchpad bug 1009023 in python-keystoneclient "Pagination is not implemented" [Wishlist,Triaged] https://launchpad.net/bugs/1009023 | 17:53 |
| *** gyee has joined #openstack-keystone | 17:53 | |
| *** david-lyle has joined #openstack-keystone | 17:54 | |
| *** aix has quit IRC | 17:55 | |
| *** joesavak has quit IRC | 17:57 | |
| openstackgerrit | A change was merged to openstack/keystone: Add info about pysaml2 into federation docs. https://review.openstack.org/122433 | 17:57 |
| *** joesavak has joined #openstack-keystone | 17:58 | |
| openstackgerrit | Andreas Jaeger proposed a change to openstack/identity-api: Update to clouddocs-maven-plugin 2.1.3 https://review.openstack.org/123201 | 17:58 |
| *** victsou has joined #openstack-keystone | 17:59 | |
| ayoung | can we merge projects and domains into one object? Please? | 18:00 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:00 | |
| ayoung | I want to add rescope(tenant) to the client | 18:00 |
| ayoung | but I need to do something like this | 18:01 |
| ayoung | client.rescope(project_id=None, domain_id=None): | 18:01 |
| *** jsavak has joined #openstack-keystone | 18:01 | |
| ayoung | and then assert only one or the other is set | 18:01 |
| ayoung | or I could make two functions. | 18:01 |
| ayoung | feh | 18:01 |
| *** joesavak has quit IRC | 18:05 | |
| *** harlowja has quit IRC | 18:05 | |
| *** _cjones_ has quit IRC | 18:05 | |
| *** harlowja_ has joined #openstack-keystone | 18:05 | |
| *** _cjones_ has joined #openstack-keystone | 18:06 | |
| *** marcoemorais has quit IRC | 18:06 | |
| *** marcoemorais has joined #openstack-keystone | 18:06 | |
| *** ukalifon1 has quit IRC | 18:08 | |
| *** _cjones_ has quit IRC | 18:10 | |
| *** _cjones_ has joined #openstack-keystone | 18:11 | |
| *** ukalifon has joined #openstack-keystone | 18:11 | |
| morganfainberg | ayoung, i think we talked about making projects/domains one object before | 18:14 |
| ayoung | morganfainberg, I should have insisted on it at inception | 18:15 |
| morganfainberg | ayoung, eh, in fact this came up with the heirarchy stuff last summit | 18:15 |
| ayoung | yeah | 18:16 |
| ayoung | and it is too late to do anything about it now...just more whinging on my part | 18:16 |
| raildo | Now it's some late for that :P | 18:17 |
| *** raildo has left #openstack-keystone | 18:17 | |
| *** raildo has joined #openstack-keystone | 18:17 | |
| *** raildo has left #openstack-keystone | 18:17 | |
| *** raildo has joined #openstack-keystone | 18:18 | |
| raildo | ayoung, do you know if there is an etherpad for proposals to design summit in Keystone? | 18:19 |
| ayoung | raildo, not that I know of | 18:20 |
| raildo | they are using this etherpad for cross-projects https://etherpad.openstack.org/p/kilo-crossproject-summit-topics | 18:24 |
| raildo | I thought there would be equal to the keystone | 18:26 |
| stevemar | bah https://review.openstack.org/#/c/123016/ failed to merge | 18:27 |
| stevemar | bahhhhh | 18:27 |
| *** cjellick has quit IRC | 18:30 | |
| *** gyee has quit IRC | 18:30 | |
| *** david-lyle has quit IRC | 18:33 | |
| *** david-lyle has joined #openstack-keystone | 18:34 | |
| *** htruta has joined #openstack-keystone | 18:40 | |
| *** david-lyle has quit IRC | 18:40 | |
| *** david-lyle has joined #openstack-keystone | 18:41 | |
| nkinder_ | hmmm, still no movement on the kerberos plug-in new repo request :( | 18:45 |
| morganfainberg | nkinder_, i think it needs dolphm's nod (as the PTL) to get it | 18:46 |
| morganfainberg | nkinder_, there otherwise were no complaints afaict | 18:46 |
| nkinder_ | morganfainberg: ah, ok. dolphm is out though, right? | 18:46 |
| morganfainberg | nkinder_, he's around on-and-off right now | 18:47 |
| morganfainberg | nkinder_, but it's not consistent | 18:47 |
| morganfainberg | stevemar, so close: https://launchpad.net/keystone/+milestone/juno-rc1 | 18:48 |
| *** david-lyle has quit IRC | 18:51 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Fix minor spelling issues in comments https://review.openstack.org/122990 | 18:53 |
| morganfainberg | nkinder_, https://review.openstack.org/#/c/120310/ see ttx's comment | 18:53 |
| morganfainberg | nkinder_, and i think that is the only thing that would hold up the repo add | 18:53 |
| morganfainberg | nkinder_, *think* | 18:53 |
| *** openstack has joined #openstack-keystone | 18:55 | |
| *** david-lyle has quit IRC | 18:55 | |
| dstanek | stevemar: patience, young one | 18:55 |
| stevemar | dstanek, haha | 18:55 |
| *** david-lyle has joined #openstack-keystone | 18:55 | |
| morganfainberg | dstanek, well played | 18:55 |
| *** victsou has quit IRC | 18:58 | |
| *** _cjones_ has quit IRC | 19:10 | |
| *** rwsu has joined #openstack-keystone | 19:10 | |
| *** _cjones_ has joined #openstack-keystone | 19:11 | |
| *** _cjones_ has quit IRC | 19:15 | |
| *** marcoemorais has quit IRC | 19:16 | |
| *** marcoemorais has joined #openstack-keystone | 19:16 | |
| *** rushiagr_away is now known as rushiagr | 19:28 | |
| *** david-lyle has quit IRC | 19:29 | |
| *** victsou has joined #openstack-keystone | 19:30 | |
| *** david-lyle has joined #openstack-keystone | 19:30 | |
| *** henrynash has joined #openstack-keystone | 19:33 | |
| *** _cjones_ has joined #openstack-keystone | 19:41 | |
| *** _cjones_ has quit IRC | 19:52 | |
| *** _cjones_ has joined #openstack-keystone | 19:52 | |
| *** vhoward has left #openstack-keystone | 19:56 | |
| *** shakamunyi has joined #openstack-keystone | 19:57 | |
| *** gyee has joined #openstack-keystone | 20:02 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Add an extension to store domain specific configuration in SQL. https://review.openstack.org/123238 | 20:02 |
| morganfainberg | henrynash, woo | 20:02 |
| henrynash | morganfainberg: :-) | 20:03 |
| gyee | henrynash, nice! | 20:04 |
| gyee | that's assuming your primary backend is SQL? | 20:05 |
| *** rushiagr is now known as rushiagr_away | 20:05 | |
| *** topol has quit IRC | 20:08 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Support service user and project in non-default domain https://review.openstack.org/123011 | 20:09 |
| henrynash | gyee: well it is more lined to assignments really (since that’s where domains are)…so it would be perfectly fine to have all LDAP identity, but store domains+domain configurations in SQL | 20:10 |
| openstackgerrit | A change was merged to openstack/identity-api: Update to clouddocs-maven-plugin 2.1.3 https://review.openstack.org/123201 | 20:11 |
| gyee | hanrynash, make sense, I really like that proposal, right now we have to create that domain-specific conf file and bounce keystone | 20:11 |
| kashyap | ayoung, Got a moment? Just got back to my Keystone setup. I'm annoyed enough that I want to stay up to see if I can get to the bottom of this | 20:11 |
| *** _cjones_ has quit IRC | 20:12 | |
| *** _cjones_ has joined #openstack-keystone | 20:12 | |
| kashyap | So, I'm hitting this when I invoke $ keystone --debug token-get: "Expecting a token provided via either --os-token or env[OS_SERVICE_TOKEN]" | 20:13 |
| kashyap | Yes, I did unset the environment variables. | 20:13 |
| stevemar | kashyap, sounds like you unset one too many :) | 20:13 |
| kashyap | unset OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT | 20:13 |
| kashyap | stevemar, :-) | 20:14 |
| kashyap | Yeah, what irks me is - I never had issues w/ Keystone all this time, Juno-M3, I'm shaving all kinds of yaks | 20:14 |
| stevemar | +1 for just using that expression alone | 20:14 |
| stevemar | you've got my attention | 20:14 |
| kashyap | That's my config details - http://paste.openstack.org/show/114291/ | 20:15 |
| henrynash | gyee: yep | 20:15 |
| ayoung | ITS YAK SHAVING DAY! | 20:15 |
| ayoung | dolphm the Kerberos auth plugin repo is just awaiting a +1 from you | 20:15 |
| henrynash | ayoung: and there was me thinking we had to save yaks…when in reality we had to shave them... | 20:15 |
| ayoung | https://review.openstack.org/#/c/120261/ dolphm | 20:16 |
| *** _cjones_ has quit IRC | 20:17 | |
| ayoung | kashyap, remind me to talk to the openstack common client guys so they don't inherit that SERVICE_TOKEN annoyance from us | 20:17 |
| kashyap | ayoung, Yes, sir. I added it to my TODO list. But I'm in the midst of moving between continents next two weeks, so it's all mad as hell here :-) | 20:18 |
| ayoung | kashyap, what is your final destination | 20:18 |
| * ayoung hopes you say Massachusetts | 20:18 | |
| kashyap | ayoung, Belgium | 20:18 |
| ayoung | DAGNABIT! | 20:18 |
| kashyap | :-) | 20:18 |
| kashyap | I'll visit next year | 20:18 |
| ayoung | Oh well. | 20:19 |
| kashyap | stevemar, That's my notes I diligently kept while configuring - https://kashyapc.fedorapeople.org/virt/openstack/keystone-setup-juno.txt | 20:19 |
| * ayoung is looking forward to all the L-release conversations that will end with "We'll always have Paris." | 20:19 | |
| *** bjornar_ has joined #openstack-keystone | 20:20 | |
| *** ayoung is now known as ayoung-afk | 20:20 | |
| kashyap | ayoung-afk, I met you in Boston 4 years ago. I hope I'll see you Paris summit? | 20:20 |
| ayoung-afk | kashyap, gotta run and pick up someone at the train | 20:20 |
| kashyap | Sure. | 20:20 |
| ayoung-afk | I'll be bac k on line in a second... | 20:20 |
| kashyap | No rush, see ya. | 20:20 |
| ayoung-afk | well...little longer than that | 20:20 |
| kashyap | Yeah, don't be pedantic :-) | 20:21 |
| *** andreaf has joined #openstack-keystone | 20:21 | |
| *** jaosorior has quit IRC | 20:22 | |
| stevemar | kashyap, try using openstackclient :D | 20:23 |
| *** _cjones_ has joined #openstack-keystone | 20:23 | |
| stevemar | kashyap, you make some mighty good notes | 20:23 |
| kashyap | Lessons from past, to be diligent when debugging computers. | 20:24 |
| kashyap | stevemar, So, any clues so far what am I doing wrong? I wonder if should just start over | 20:26 |
| stevemar | kashyap, do other keystone commands work with that CLI? | 20:27 |
| stevemar | like `keystone user-list` | 20:28 |
| kashyap | Nope. | 20:28 |
| kashyap | If I explicitly set the env variables on CLI, it does work | 20:28 |
| stevemar | kashyap, that's weird | 20:30 |
| *** morgan_remote_ has joined #openstack-keystone | 20:30 | |
| stevemar | what's that command look like? | 20:30 |
| stevemar | and whats' the output of say `env | grep OS` ? | 20:31 |
| kashyap | 1 sec | 20:31 |
| *** joesavak has joined #openstack-keystone | 20:31 | |
| kashyap | There we go - http://paste.openstack.org/show/114294/ | 20:32 |
| *** jsavak has quit IRC | 20:32 | |
| kashyap | For that error, I know that there's a patch from Adam 'NoneType' object has no attribute 'has_service_catalog' -- https://review.openstack.org/#/c/100714/ | 20:32 |
| kashyap | (I've applied that locally, but I see that's not relevant to _why_ token is not fetched) | 20:34 |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 20:34 |
| * kashyap enables debug logs in keystone.conf & tries | 20:34 | |
| kashyap | Hmm, no dice. | 20:36 |
| *** _cjones_ has quit IRC | 20:38 | |
| *** _cjones_ has joined #openstack-keystone | 20:38 | |
| stevemar | kashyap, i think it's not advised to have both SERVICE_TOKEN/ENDPOINT and USERNAME/PASSWORD set at the same time | 20:38 |
| stevemar | unset those, (but you mention it earlier that you did) | 20:39 |
| stevemar | unset the OS_SERVICE ones | 20:39 |
| kashyap | Yeah, let me try that | 20:40 |
| stevemar | the service ones should just be needed for setting endpoints / services / and the initial admin user/role/project | 20:41 |
| stevemar | beyond that, unset them and always use the username / password combo with OS_AUTH_URL | 20:41 |
| stevemar | kashyap, actually my devstack is failing on what appears to be the same message | 20:42 |
| kashyap | Hmm, which 'same message'? | 20:43 |
| *** _cjones_ has quit IRC | 20:43 | |
| openstackgerrit | A change was merged to openstack/keystone: Update URLs for keystone federation configuration docs https://review.openstack.org/122985 | 20:43 |
| kashyap | stevemar, . . . 'has_service_catalog'? | 20:43 |
| stevemar | kashyap, http://paste.openstack.org/show/114295/ | 20:43 |
| stevemar | looks like it's trying to run keystone token-get | 20:44 |
| kashyap | Aha. | 20:44 |
| * kashyap git pulls his DevStack (and has RECLONE=yes, so I'm sure, it'll do a fresh checkout) | 20:44 | |
| stevemar | kashyap, i just did the same :( | 20:45 |
| kashyap | Oh | 20:46 |
| stevemar | might need https://review.openstack.org/#/c/123021/ | 20:46 |
| stevemar | but thats just tests... | 20:46 |
| stevemar | something weird is up | 20:47 |
| kashyap | Ah, good. So, it's just me going bonkers. | 20:47 |
| kashyap | it's *not* | 20:48 |
| *** david-lyle has quit IRC | 20:49 | |
| *** samuelmz has quit IRC | 20:49 | |
| stevemar | its funny because i thought i removed all references to keystone token-get in devstack | 20:50 |
| *** victsou has quit IRC | 20:50 | |
| stevemar | and replaced them with openstack ones | 20:50 |
| *** david-lyle has joined #openstack-keystone | 20:51 | |
| kashyap | I see. Will let you know if I can reproduce the issue here | 20:52 |
| * kashyap watches DevStack invoke: $ keystone-manage db_sync | 20:54 | |
| *** _cjones_ has joined #openstack-keystone | 20:57 | |
| kashyap | stevemar, Hmm, it doesn't faile for me here. I can post my devstacklog.txt if you prefer | 21:03 |
| stevemar | magic of devstack kashyap, magic of devstack | 21:05 |
| kashyap | :-) | 21:06 |
| kashyap | notmyname, just a test monkey here | 21:06 |
| kashyap | (Err, I prompted you again :-( | 21:06 |
| kashyap | stevemar, Those are the commits I am at: | 21:08 |
| kashyap | DevStack commit: 8fe3f70efd6c74479d2f17b789976fb3dfb8efd2 | 21:08 |
| kashyap | Keystone commit: 641381aec54ad93320c1d38b1d96a61dccc6c1b3 | 21:08 |
| kashyap | python-keystoneclient: 0b06683be6d13d21dfffa19be46e1159edb9fce0 | 21:08 |
| *** henrynash has quit IRC | 21:08 | |
| *** _cjones_ has quit IRC | 21:08 | |
| stevemar | kashyap, are the CLI commands working for you now? | 21:09 |
| kashyap | If you mean on the DevStack instance, testing. . . | 21:09 |
| kashyap | stevemar, Yes, works like a charm. | 21:10 |
| kashyap | There we go, also posted my local.conf -- http://paste.openstack.org/show/114300/ | 21:12 |
| * kashyap now hits the hay, thanks all for the help, will try to check scroll tomorrow. | 21:12 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Fix auth_token for old oslo.config https://review.openstack.org/123250 | 21:13 |
| *** radez is now known as radez_g0n3 | 21:14 | |
| *** _cjones_ has joined #openstack-keystone | 21:15 | |
| *** bjornar_ has quit IRC | 21:19 | |
| *** jasondotstar has quit IRC | 21:28 | |
| *** joesavak has quit IRC | 21:32 | |
| *** amcrn has quit IRC | 21:36 | |
| morganfainberg | bknudson, apt issue on the fix for options | 21:47 |
| bknudson | morganfainberg: ? | 21:47 |
| morganfainberg | bknudson, looks like your fix even hits the wierd edge cases like that. +2 on it and the middleware version | 21:47 |
| morganfainberg | bknudson, nic had a version installed from apt, namespace got wonky | 21:48 |
| morganfainberg | so old oslo.config was being loaded | 21:48 |
| bknudson | morganfainberg: that's what I was thinking must be happing. | 21:49 |
| bknudson | happening | 21:49 |
| morganfainberg | yeah | 21:49 |
| *** harlowja_ has quit IRC | 21:49 | |
| *** harlowja has joined #openstack-keystone | 21:49 | |
| morganfainberg | ayoung-afk, stevemar, gyee, lbragstad, dolphm, could someone look at https://review.openstack.org/#/c/123198/ and +2/+A if it looks good to you? | 21:51 |
| *** rkofman has quit IRC | 21:52 | |
| *** rkofman has joined #openstack-keystone | 21:53 | |
| *** dims_ has joined #openstack-keystone | 21:56 | |
| *** ukalifon has quit IRC | 21:56 | |
| *** dims_ has quit IRC | 21:58 | |
| *** gokrokve has joined #openstack-keystone | 21:58 | |
| *** dims_ has joined #openstack-keystone | 21:58 | |
| *** amcrn has joined #openstack-keystone | 21:58 | |
| *** rodrigods_ has joined #openstack-keystone | 21:59 | |
| gyee | morganfainberg, there's a -1 on that review | 21:59 |
| *** dims has quit IRC | 21:59 | |
| gyee | sorry I got stuck in a meeting, just got back to my desk | 22:00 |
| *** ukalifon1 has joined #openstack-keystone | 22:02 | |
| morganfainberg | gyee, the -1 is dhellmann's due to concern about not validating non-string options | 22:03 |
| morganfainberg | gyee, in this case that is exactly the behavior we're looking for if the option doesn't have a type attribute (fall back to the old logic) | 22:04 |
| morganfainberg | gyee, s/logic/behavior - that is to say, everything was previously treated as a string | 22:04 |
| gyee | morganfainberg, I see | 22:05 |
| morganfainberg | bknudson, ^ correct? just 2x checking my understanding | 22:05 |
| bknudson | morganfainberg: gyee: yep, good explanation | 22:05 |
| stevemar | morganfainberg, lgtm | 22:11 |
| stevemar | beat gyee to the punch! | 22:11 |
| *** _cjones_ has quit IRC | 22:12 | |
| *** _cjones_ has joined #openstack-keystone | 22:12 | |
| gyee | stevemar, I need a new mouse :) | 22:12 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:13 | |
| *** rodrigods_ has quit IRC | 22:29 | |
| *** gordc has quit IRC | 22:35 | |
| *** morgan_remote_ has quit IRC | 22:40 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix enabled emulation naming attribute calculation https://review.openstack.org/123272 | 22:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix create and user-role-add in LDAP backend https://review.openstack.org/119345 | 22:49 |
| *** saipandi has quit IRC | 22:50 | |
| *** wwriverrat has joined #openstack-keystone | 22:51 | |
| *** wwriverrat has left #openstack-keystone | 22:51 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix create and user-role-add in LDAP backend https://review.openstack.org/119345 | 22:51 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix create and user-role-add in LDAP backend https://review.openstack.org/119345 | 22:53 |
| bknudson | ok, I think it's ready. | 22:55 |
| *** amcrn has quit IRC | 23:00 | |
| *** wwriverrat has joined #openstack-keystone | 23:01 | |
| *** bknudson has quit IRC | 23:02 | |
| *** nkinder_ has quit IRC | 23:07 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Fix auth_token for old oslo.config https://review.openstack.org/123250 | 23:23 |
| *** cjellick has joined #openstack-keystone | 23:47 | |
| *** cjellick has quit IRC | 23:47 | |
| *** cjellick has joined #openstack-keystone | 23:48 | |
| *** gokrokve has quit IRC | 23:51 | |
| *** Tahmina has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!