| *** HenryG has quit IRC | 00:05 | |
| nkinder | ekarlso: so it doesn't even advertise v2.0 on 35357 - http://paste.openstack.org/show/117923/ | 00:14 |
|---|---|---|
| dstanek | morganfainberg: migration question...when exactly does the migration_tmp table get created? | 00:16 |
| remote_morgan_ | Uhh for what migration? Or you mean the SQLite in mem thing? | 00:17 |
| dstanek | remote_morgan_: i'm messing with test_sql_upgrade and i'm trying to figure out the exact setup/teardown steps | 00:18 |
| remote_morgan_ | The in memory schema is created when the db connector connects to the "db" | 00:18 |
| remote_morgan_ | Which should be the on setup bit. Then schema is created with reflection. | 00:19 |
| remote_morgan_ | I'll be at my desk in 2 minutes and I can like directly to the code | 00:19 |
| dstanek | remote_morgan_: ok | 00:19 |
| morganfainberg | ok sec | 00:20 |
| dstanek | morganfainberg: let me step back and tell you what i want to do | 00:21 |
| morganfainberg | dstanek, ok | 00:21 |
| dstanek | morganfainberg: i want to delete the db file on teardown if using a file - and then don't drop tables | 00:21 |
| dstanek | effectively the sqlite verision of drop database | 00:21 |
| morganfainberg | ok | 00:22 |
| dstanek | my change right now is really simple,but yields crazy results...jas i'll paste | 00:23 |
| dstanek | morganfainberg: hack -> http://paste.openstack.org/show/117928/ | 00:23 |
| morganfainberg | ok for the migration test: https://github.com/openstack/keystone/blob/master/keystone/tests/test_sql_upgrade.py#L167-L172 this is where the db is made the path being the special sqlite:// means when we get a DB connection, connect *that* descriptor to in-memory | 00:25 |
| dstanek | morganfainberg: result -> http://paste.openstack.org/show/117929/ | 00:25 |
| morganfainberg | dstanek, sql.cleanup() ? | 00:25 |
| dstanek | morganfainberg: that's how we get a new engine | 00:26 |
| dstanek | morganfainberg: i few lines up from your link it creates the db_file path...doesn't that get used in these tests? | 00:27 |
| morganfainberg | not if you're using in-mem db | 00:27 |
| morganfainberg | which is the default for everything | 00:27 |
| morganfainberg | if you close the descriptor, it is freed back to the system | 00:27 |
| morganfainberg | the table.drop stuff *should* be for non-in-mem sqlite dbs | 00:28 |
| morganfainberg | e.g. MySQL | 00:28 |
| morganfainberg | or in the case of disk-based sqlite. | 00:28 |
| dstanek | morganfainberg: so what i wanted to do for non-sqlite is just 'drop database' and 'create database' | 00:29 |
| morganfainberg | sure. | 00:29 |
| morganfainberg | i'm wondering if there is some magic addcleanup that was added somewhere | 00:30 |
| *** gokrokve has quit IRC | 00:30 | |
| dstanek | morganfainberg: i'm in the middle of a bigger change where i'm creating a new db using the process pid so that we can have multiple workers creating/dropping databases | 00:30 |
| morganfainberg | because honestly... i've never seen that error you pasted | 00:30 |
| morganfainberg | dstanek, doesn't oslo.db already have something to do that? | 00:30 |
| morganfainberg | opportunistic tests | 00:30 |
| dstanek | morganfainberg: yeah, maybe i'll unwind my changes and see where the table gets created | 00:30 |
| dstanek | morganfainberg: not sure, but i'll take a look | 00:31 |
| morganfainberg | it should already exist iirc | 00:31 |
| morganfainberg | for the in-memory sqlite, it's a non-issue, each descriptor is it's own db schema, free and clear | 00:31 |
| morganfainberg | erm, engine | 00:31 |
| morganfainberg | which is why we only create the engine in setup now. | 00:32 |
| dstanek | morganfainberg: maybe http://git.openstack.org/cgit/openstack/oslo.db/tree/oslo/db/sqlalchemy/test_migrations.py | 00:32 |
| morganfainberg | somewhere in icehouse it was ugly. | 00:32 |
| dstanek | morganfainberg: i'll take a deeper look at oslo.db to see if it can help me out - thanks for the pointer | 00:32 |
| morganfainberg | dstanek, zzzeek and dhellmann might have a couple pointers where the opportunistic tests are | 00:33 |
| morganfainberg | for db schema creation | 00:33 |
| morganfainberg | dstanek, longer term rather than needing a "clean" schema eatch time we should be able to test / cleanup in a given test case (except the migration tests, those need a clean schema) | 00:33 |
| morganfainberg | that way we can run the tests against any db backend and not need special magic to create the schemas or multiple dbs. | 00:34 |
| dstanek | morganfainberg: cleanup by deleting created rows? | 00:35 |
| morganfainberg | dstanek, we should know what entiies we create, we should be able to verify they were cleaned up | 00:36 |
| *** leveldoc has quit IRC | 00:37 | |
| morganfainberg | this is forward thinking for the functional testing (replacement of the RESTful test cases). | 00:37 |
| dstanek | morganfainberg: i actually don't mind the nuke it approach then reload the fixture data | 00:37 |
| morganfainberg | dstanek, except that it's very expensive and each db engine requires special code to know how to handle multiple active schemas | 00:38 |
| dstanek | morganfainberg: from the outside you may not alway know what entities are created | 00:38 |
| morganfainberg | being able to validate we created the expected entity sounds less like a checking sql thing and more of a checking what methods were called, unit vs functional | 00:39 |
| dstanek | it also means that if you have several processes accessing the database you may introduce intermittent errors | 00:39 |
| morganfainberg | erm, the expected rows | 00:39 |
| morganfainberg | dstanek, if multuple tests accessing the keystone "process" at once would introduce those intermittant errors, so would "Real" runtime | 00:39 |
| morganfainberg | or even multiple keystone processes against a single db | 00:40 |
| dstanek | morganfainberg: no, i don't mean like that. we have tests that validate counts that you wouldn't have in production | 00:40 |
| dstanek | and other things | 00:40 |
| morganfainberg | those are the ones that need to be looked at. | 00:40 |
| morganfainberg | closely | 00:40 |
| morganfainberg | is there a real benefit to looking at how many of x items are there vs looking to see if item X or Y is/isnot there? | 00:41 |
| morganfainberg | with perhaps exception of revocation events. | 00:41 |
| morganfainberg | since those expire off / are superseded directly | 00:41 |
| dstanek | i don't think those are bad tests necessarily - what if you have a filter and wanted to make sure it worked? | 00:41 |
| dstanek | sure the 4 records you wanted are in there, but you'd still have to check that the other records are not | 00:42 |
| morganfainberg | wouldn't the approach be "Create record X, Y, and Z" where record z doesn't match, check for existence of X and Y but not Z | 00:42 |
| dstanek | i'm not against the idea, but i think we have a lot of work before we are even close to talking in more details | 00:42 |
| morganfainberg | sure, i'm just saying think about this when you're reworking it. | 00:43 |
| morganfainberg | and remember each db engine takes special code to know how to handle multiple schemas / dbs, because giving that super power to mysql is different than pgsql | 00:43 |
| morganfainberg | and i don't know how DB2 would work if we even continued to see ibm test it | 00:44 |
| morganfainberg | 1st step: make it better, 2nd step, keep making it better :) | 00:44 |
| dstanek | morganfainberg: i'm actually working on two different, inter-related things right now - experimenting, so that i can write a spec | 00:45 |
| morganfainberg | sounds good. | 00:46 |
| *** alex_xu has quit IRC | 00:46 | |
| morganfainberg | whopse sorry wrong window :P | 00:46 |
| dstanek | actually i guess three things :-( | 00:46 |
| morganfainberg | what things? | 00:46 |
| dstanek | i'm wading through a pile right now | 00:46 |
| morganfainberg | (not that it doesn't sound good btw, just... was talking dinner to someone :P ) | 00:47 |
| dstanek | :-) | 00:47 |
| dstanek | 1. reducing database queries | 00:47 |
| dstanek | 2. stopping 404 when we should 400 validation error | 00:47 |
| dstanek | 3. run tests on non-sqlite databases | 00:47 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix tests using extension drivers https://review.openstack.org/124603 | 00:48 |
| morganfainberg | i'd like to revisit - https://review.openstack.org/#/c/103304/ | 00:48 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Avoid multiple instances for a provider https://review.openstack.org/124599 | 00:48 |
| morganfainberg | in the query cleanup | 00:48 |
| morganfainberg | or as part of it | 00:48 |
| morganfainberg | there is a lot of added overhead GC ickyness for just "checking" existence that we throw away. | 00:48 |
| morganfainberg | "is this here, oh yes? ok moving on" | 00:48 |
| dstanek | morganfainberg: those are going away | 00:48 |
| morganfainberg | ah ok | 00:48 |
| dstanek | that will reduce the number of queries | 00:49 |
| morganfainberg | yes. | 00:49 |
| *** r-daneel has quit IRC | 00:49 | |
| dstanek | let me write this up for you to see :-( | 00:49 |
| morganfainberg | and if we are just checking existence or a single attribute "enabled" we should make sure we're only looking at that. | 00:49 |
| morganfainberg | or doing the partial obj load that SQLA can do | 00:49 |
| dstanek | morganfainberg: the biggest challenge is coming up with a spec name that has all three components | 00:49 |
| morganfainberg | rather than the "load everything and do all the oject/bookeeping stuff" | 00:49 |
| morganfainberg | you know, you are allowed to have more than one spec ;) and just say "this one requires XXX to be completed first" | 00:50 |
| dstanek | the primary reason we do the gets is to raise a 404 | 00:50 |
| dstanek | morganfainberg: yes, but they are inter related | 00:50 |
| morganfainberg | sure. i thinke the last one is the easiest one to split out btw. | 00:50 |
| dstanek | fixing one forces me to fix the other and then the other | 00:51 |
| morganfainberg | at face value | 00:51 |
| dstanek | acually i can probably split off the run tests on non-sqlite - i just need part of the fix there to do the others | 00:52 |
| morganfainberg | yeah | 00:52 |
| morganfainberg | that should make writing the spec a little more straightforward | 00:52 |
| morganfainberg | ok i need to head to the gym. | 00:54 |
| morganfainberg | be back a bit later. | 00:54 |
| *** zzzeek has quit IRC | 01:00 | |
| *** stevemar has joined #openstack-keystone | 01:06 | |
| *** dims has joined #openstack-keystone | 01:07 | |
| bknudson | https://review.openstack.org/#/c/124979/ | 01:14 |
| *** marcoemorais has quit IRC | 01:19 | |
| *** praneshp has quit IRC | 01:20 | |
| *** ncoghlan has joined #openstack-keystone | 01:37 | |
| *** richm has quit IRC | 01:50 | |
| *** gokrokve has joined #openstack-keystone | 01:52 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use openstackclient examples in configuration documentation https://review.openstack.org/124270 | 01:54 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the CLI examples to also use openstackclient https://review.openstack.org/124095 | 01:55 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add v3 openstackclient CLI examples https://review.openstack.org/124489 | 01:55 |
| *** gokrokve_ has joined #openstack-keystone | 01:55 | |
| *** HenryG has joined #openstack-keystone | 01:56 | |
| *** HenryG has quit IRC | 01:56 | |
| *** HenryG has joined #openstack-keystone | 01:58 | |
| *** gokrokve has quit IRC | 01:58 | |
| *** dims has quit IRC | 01:58 | |
| *** dims has joined #openstack-keystone | 01:59 | |
| *** dims has quit IRC | 02:03 | |
| *** NM has joined #openstack-keystone | 02:05 | |
| *** gokrokve_ has quit IRC | 02:11 | |
| nkinder | There's nothing like encountering a bug, filing it, fixing it, then finding it's already been fixed in master... | 02:14 |
| *** andreaf has quit IRC | 02:16 | |
| *** andreaf has joined #openstack-keystone | 02:16 | |
| nkinder | ekarlso: the httpd issue you're encountering is https://bugs.launchpad.net/keystone/+bug/1343579 | 02:18 |
| uvirtbot | Launchpad bug 1343579 in keystone "Versionless GET on keystone gives different answer with port 5000 and 35357" [High,Fix released] | 02:18 |
| nkinder | ekarlso: bknudson fixed it recently, and it just went into Juno RC1. | 02:18 |
| *** topol has joined #openstack-keystone | 02:19 | |
| *** gokrokve has joined #openstack-keystone | 02:21 | |
| *** harlowja is now known as harlowja_away | 02:27 | |
| *** gokrokve has quit IRC | 02:34 | |
| *** gokrokve has joined #openstack-keystone | 02:35 | |
| *** zzzeek has joined #openstack-keystone | 02:39 | |
| *** gokrokve has quit IRC | 02:39 | |
| *** amcrn has quit IRC | 02:40 | |
| *** NM has quit IRC | 02:50 | |
| morganfainberg | nkinder, hehe | 02:55 |
| nkinder | morganfainberg: at least I arrived at the same fix :P | 02:55 |
| morganfainberg | bknudson woot -1287!! | 02:55 |
| morganfainberg | we use memorycache?! | 02:56 |
| *** ncoghlan is now known as ncoghlan_afk | 02:58 | |
| morganfainberg | guh | 02:58 |
| morganfainberg | ... that is *not* ok | 02:58 |
| morganfainberg | nkinder, i think my isp is sucking tonight... what do you think: 64 bytes from 8.8.8.8: icmp_seq=3 ttl=41 time=807.732 ms | 02:59 |
| nkinder | ugg, yeah | 02:59 |
| nkinder | morganfainberg: I had a fun one a month back with 80% packet loss | 02:59 |
| morganfainberg | thats the low end. upwards of 1200ms ping | 02:59 |
| nkinder | it's comcastic... | 02:59 |
| morganfainberg | and getting about 1% packet loss :( | 02:59 |
| morganfainberg | nah charter for me. | 03:00 |
| morganfainberg | yay no options. | 03:00 |
| nkinder | comcast will own them soon enough | 03:00 |
| morganfainberg | oh.. not my isp *sigh* | 03:00 |
| morganfainberg | looks like my router is on the fritz | 03:01 |
| morganfainberg | 500ms to the router... wtf. | 03:02 |
| nkinder | router reboot time? | 03:03 |
| morganfainberg | oh wow | 03:03 |
| morganfainberg | 5G network = not crappy | 03:03 |
| morganfainberg | 2.4G network = 500ms to the router | 03:03 |
| morganfainberg | *wow* | 03:03 |
| morganfainberg | 5G: 64 bytes from 172.16.30.1: icmp_seq=65 ttl=64 time=1.004 ms | 03:03 |
| morganfainberg | 2.4G: 64 bytes from 172.16.30.1: icmp_seq=18 ttl=64 time=531.654 ms | 03:03 |
| nkinder | that's strange | 03:04 |
| morganfainberg | probably a lot of interferance on the 2.4G space | 03:04 |
| morganfainberg | at least 50 networks show up when i scan for wifi | 03:04 |
| morganfainberg | i am guessing i have 1 device that uses 2.4Ghz everything else is 5G so i don't notice :P | 03:05 |
| *** gyee has quit IRC | 03:17 | |
| *** zzzeek has quit IRC | 03:21 | |
| *** marcoemorais has joined #openstack-keystone | 03:47 | |
| *** amcrn has joined #openstack-keystone | 04:00 | |
| *** gokrokve has joined #openstack-keystone | 04:06 | |
| *** amcrn has quit IRC | 04:09 | |
| *** gokrokve has quit IRC | 04:13 | |
| *** gokrokve has joined #openstack-keystone | 04:13 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:15 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 04:15 | |
| *** gokrokve has quit IRC | 04:18 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the CLI examples to also use openstackclient https://review.openstack.org/124095 | 04:31 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add v3 openstackclient CLI examples https://review.openstack.org/124489 | 04:31 |
| *** NM has joined #openstack-keystone | 04:34 | |
| *** NM has quit IRC | 04:40 | |
| *** lhcheng has quit IRC | 04:42 | |
| *** lhcheng has joined #openstack-keystone | 04:42 | |
| *** jamielennox has quit IRC | 04:43 | |
| stevemar | morganfainberg, gotta love living in a condo/building | 04:47 |
| stevemar | interference for everyone! | 04:47 |
| *** lhcheng has quit IRC | 04:47 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 04:55 | |
| *** jamielenz has joined #openstack-keystone | 05:00 | |
| *** jamielenz is now known as jamielennox | 05:00 | |
| *** lhcheng has joined #openstack-keystone | 05:02 | |
| *** andreaf has quit IRC | 05:32 | |
| *** andreaf has joined #openstack-keystone | 05:33 | |
| openstackgerrit | Chmouel Boudjnah proposed a change to openstack/keystonemiddleware: Encode middleware error message as bytes https://review.openstack.org/123451 | 05:52 |
| *** lsmola has joined #openstack-keystone | 06:09 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/124950 | 06:12 |
| *** lufix has joined #openstack-keystone | 06:17 | |
| *** topol has quit IRC | 06:17 | |
| *** stevemar has quit IRC | 06:18 | |
| *** nellysmitt has joined #openstack-keystone | 06:19 | |
| *** praneshp has joined #openstack-keystone | 06:20 | |
| *** praneshp_ has joined #openstack-keystone | 06:21 | |
| *** jaosorior has joined #openstack-keystone | 06:22 | |
| *** praneshp has quit IRC | 06:24 | |
| *** praneshp_ is now known as praneshp | 06:24 | |
| marekd | what was all that hassle with XML and federation code? | 06:33 |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Templated catalog backend not implemented https://review.openstack.org/120011 | 06:45 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 06:57 | |
| *** marcoemorais has quit IRC | 06:59 | |
| *** marcoemorais has joined #openstack-keystone | 06:59 | |
| *** marcoemorais1 has joined #openstack-keystone | 07:01 | |
| *** marcoemorais has quit IRC | 07:04 | |
| *** nellysmitt has quit IRC | 07:16 | |
| *** nellysmitt has joined #openstack-keystone | 07:17 | |
| *** afazekas has joined #openstack-keystone | 07:21 | |
| *** nellysmitt has quit IRC | 07:21 | |
| *** nellysmitt has joined #openstack-keystone | 07:46 | |
| *** swartulv has quit IRC | 07:46 | |
| *** Daviey has quit IRC | 07:47 | |
| *** swartulv has joined #openstack-keystone | 07:47 | |
| *** andreaf has quit IRC | 07:49 | |
| *** andreaf has joined #openstack-keystone | 07:49 | |
| *** jistr has joined #openstack-keystone | 08:00 | |
| *** lhcheng has quit IRC | 08:04 | |
| *** lhcheng has joined #openstack-keystone | 08:05 | |
| *** andreaf has quit IRC | 08:07 | |
| *** andreaf has joined #openstack-keystone | 08:08 | |
| *** lhcheng has quit IRC | 08:09 | |
| *** ukalifon1 has joined #openstack-keystone | 08:22 | |
| *** ncoghlan has quit IRC | 08:26 | |
| *** ukalifon1 has quit IRC | 08:31 | |
| *** henrynash has joined #openstack-keystone | 08:53 | |
| *** henrynash has quit IRC | 08:54 | |
| *** jimbaker has quit IRC | 08:56 | |
| *** marcoemorais1 has quit IRC | 09:12 | |
| *** andreaf has quit IRC | 09:15 | |
| *** andreaf has joined #openstack-keystone | 09:16 | |
| *** jasondotstar has joined #openstack-keystone | 09:35 | |
| *** aix has joined #openstack-keystone | 09:39 | |
| *** ukalifon1 has joined #openstack-keystone | 09:47 | |
| *** andreaf has quit IRC | 09:49 | |
| *** andreaf has joined #openstack-keystone | 09:50 | |
| *** praneshp has quit IRC | 09:55 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/python-keystoneclient: Endpoint selection logic fix https://review.openstack.org/125923 | 10:08 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/python-keystoneclient: Endpoint selection logic fix https://review.openstack.org/125923 | 10:09 |
| *** amakarov_away has quit IRC | 10:14 | |
| *** ukalifon1 has quit IRC | 10:15 | |
| *** amakarov has joined #openstack-keystone | 10:15 | |
| *** andreaf has quit IRC | 10:24 | |
| *** andreaf has joined #openstack-keystone | 10:26 | |
| *** lhcheng has joined #openstack-keystone | 10:28 | |
| *** lhcheng has quit IRC | 10:33 | |
| *** henrynash has joined #openstack-keystone | 10:34 | |
| *** nellysmitt has quit IRC | 10:38 | |
| *** nellysmitt has joined #openstack-keystone | 10:38 | |
| *** nellysmi_ has joined #openstack-keystone | 10:40 | |
| *** nellysmitt has quit IRC | 10:40 | |
| *** henrynash has quit IRC | 10:42 | |
| *** andreaf has quit IRC | 10:42 | |
| *** andreaf has joined #openstack-keystone | 10:43 | |
| *** henrynash has joined #openstack-keystone | 10:56 | |
| *** henrynash has quit IRC | 10:59 | |
| *** dims has joined #openstack-keystone | 10:59 | |
| *** henrynash has joined #openstack-keystone | 11:02 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/python-keystoneclient: Endpoint selection logic fix https://review.openstack.org/125923 | 11:07 |
| *** henrynash has quit IRC | 11:15 | |
| *** andreaf has quit IRC | 11:17 | |
| *** andreaf has joined #openstack-keystone | 11:17 | |
| *** diegows has joined #openstack-keystone | 11:18 | |
| breton | I am trying to deploy keystone and I'm stuck on http://docs.openstack.org/developer/keystone/configuration.html#preparing-your-deployment | 11:50 |
| breton | [sql] was removed and something else related to oslo is used now | 11:50 |
| breton | I've opened #1377101 about it | 11:51 |
| breton | could someone give me a hint on what to read about how to configure now? | 11:51 |
| *** nellysmi_ has quit IRC | 11:54 | |
| *** jimbaker has joined #openstack-keystone | 11:58 | |
| *** jimbaker has quit IRC | 11:58 | |
| *** jimbaker has joined #openstack-keystone | 11:58 | |
| mhu | marekd: jenkins is giving you a tough time :) | 12:04 |
| breton | bknudson: git blames you for this change. Could you please update the docs? | 12:07 |
| *** zzzeek has joined #openstack-keystone | 12:07 | |
| *** zzzeek has quit IRC | 12:14 | |
| openstackgerrit | Davanum Srinivas (dims) proposed a change to openstack/keystone: Typo olso -> oslo https://review.openstack.org/125951 | 12:19 |
| *** zzzeek has joined #openstack-keystone | 12:19 | |
| *** zzzeek has joined #openstack-keystone | 12:21 | |
| *** zzzeek has quit IRC | 12:21 | |
| *** ukalifon has joined #openstack-keystone | 12:25 | |
| *** lhcheng has joined #openstack-keystone | 12:30 | |
| *** bknudson has quit IRC | 12:34 | |
| *** lhcheng has quit IRC | 12:35 | |
| *** andreaf has quit IRC | 12:39 | |
| *** andreaf has joined #openstack-keystone | 12:39 | |
| marekd | mhu: :( | 12:49 |
| marekd | mhu: how is auth plugins in osc patch going ? | 12:50 |
| marekd | i haven't looked there for a while :( | 12:50 |
| marekd | mhu: https://review.openstack.org/#/c/124767/ also this is not a very good news | 12:50 |
| mhu | marekd, I've updated the patch so that --os-auth-plugin is not needed for v3 password auth to ensure backward compatibility, now I am waiting for reviews | 12:52 |
| mhu | marekd, yep, saw that in my mail feed :( | 12:52 |
| marekd | mhu: keeping this backward compatible will lead to something i seen already in ksc and really hated it: some hacks that really have nothing in common with readibility, and turns out i am now to be blamed fo that. | 12:52 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: PKI and PKIZ tokens unnecessary whitespace removed https://review.openstack.org/120043 | 12:53 |
| marekd | mhu: ah, that patch with new method _guess_auth_plugin (or similar) | 12:53 |
| mhu | marekd, yep | 12:53 |
| marekd | mhu: so i saw it. | 12:53 |
| *** dims has quit IRC | 12:55 | |
| *** bknudson has joined #openstack-keystone | 12:55 | |
| *** dims has joined #openstack-keystone | 12:55 | |
| *** thiagop has joined #openstack-keystone | 12:57 | |
| marekd | bknudson: o/ | 13:03 |
| bknudson | marekd: hi | 13:04 |
| *** joesavak has joined #openstack-keystone | 13:04 | |
| marekd | bknudson: i have a question regarding https://review.openstack.org/#/c/124767/ and you -1. When I think about it now I realize we might get into similar problems with other arguments and __init__ signatures should be more generic (**kwargs) and more standardized. Now, is there any way to drop this backward compatibility or I will need to add some subclases that just reimplement __init__ and rather the args signature? | 13:06 |
| marekd | bknudson: i can imagine one day we would like to remove username/password from those auth plugins, because we may want to introduce more authn methods for authenticating agains IdP (for isntance kerberos or certs) | 13:07 |
| bknudson | marekd: just because **kwargs is used doesn't mean that you can make backwards-incompatible changes (like removing functionality that might be in use) | 13:09 |
| bknudson | marekd: here's the docs for that stability guidelines -- https://wiki.openstack.org/wiki/APIChangeGuidelines | 13:10 |
| bknudson | I assume this means no backwards-incompatible api changes without deprecating | 13:10 |
| ayoung | bknudson, marekd https://review.openstack.org/#/c/123614/ is languishing. marekd I know Jose would probably like to finally get his patch in | 13:12 |
| ayoung | mhu, link? | 13:13 |
| bknudson | I have +2 in openstack/python-keystoneclient-kerberos ? I don't know anything about kerberos. | 13:13 |
| mhu | ayoung, https://review.openstack.org/#/c/108325/ | 13:14 |
| ayoung | mhu, did you try it with Kerberos? | 13:15 |
| mhu | ayoung, no, just with available ksc plugins as of 0.11 | 13:15 |
| ayoung | mhu, kerberos is in a separate repo. I havea public, kerberized Keystone | 13:15 |
| ayoung | mhu, you on Ubuntu or Fedora? | 13:16 |
| mhu | ayoung, ubuntu atm | 13:16 |
| ayoung | mhu, ok. I don't have an .deb, just and RPM, but you can get it from the git repo if you want to try it | 13:17 |
| *** gordc has joined #openstack-keystone | 13:17 | |
| * ayoung checking to see if he has a working client | 13:17 | |
| ayoung | mhu, I'm on a sprint to finish up Kerberos for Horizon | 13:17 |
| ayoung | I'll git it a test run after that | 13:17 |
| marekd | ayoung: i also doubt i have any powerful right on this kerberos repo. | 13:18 |
| ayoung | marekd, its a Keystone team repo | 13:18 |
| marekd | ayoung: still, not me. | 13:18 |
| ayoung | lets just get it reviewed by the people that care about it | 13:18 |
| openstackgerrit | Davanum Srinivas (dims) proposed a change to openstack/keystone: Switch LdapIdentitySqlAssignment to use oslo.mockpatch https://review.openstack.org/125951 | 13:19 |
| marekd | ayoung: uhm. | 13:19 |
| ayoung | marekd, c'mon, i CERN cares about Kerberos.... | 13:19 |
| dims | bknudson: thanks for the suggestion | 13:20 |
| ayoung | the actual plugin is trivial | 13:20 |
| marekd | ayoung: i do, i saw those patches before, I will reread them again. | 13:20 |
| ayoung | its the rest of the repo stuff that has complicated it | 13:20 |
| bknudson | dims: you going to switch to oslotest.mockpatch ? | 13:20 |
| ayoung | marekd, thanks | 13:20 |
| dims | bknudson: https://review.openstack.org/125951 | 13:21 |
| bknudson | dims: awesome! ... do we have to update test-requirements.txt? | 13:21 |
| marekd | bknudson: **kwargs simply mean that I don't need to respect arguments ordering, and here it is the whole hassle and this lack of backward compatibility. | 13:22 |
| dims | dims@dims-mac:~/openstack/keystone$ cat test-requirements.txt | grep oslotest | 13:22 |
| dims | oslotest>=1.1.0 # Apache-2.0 | 13:22 |
| bknudson | great. +2 | 13:22 |
| dims | already at the level we need bknudson | 13:22 |
| *** radez_g0n3 is now known as radez | 13:25 | |
| *** henrynash has joined #openstack-keystone | 13:26 | |
| *** NM has joined #openstack-keystone | 13:47 | |
| *** r-daneel has joined #openstack-keystone | 13:47 | |
| bknudson | marekd: right, if this function had started with **kwargs then I assume you wouldn't be making the change in https://review.openstack.org/#/c/124767/ . | 13:49 |
| bknudson | marekd: btw, if there's some overriding reason to ignore the backwards-compatibility requirement I can be convinced that this is ok. | 13:50 |
| *** henrynash has quit IRC | 13:53 | |
| marekd | bknudson: i really doubt anybody (apart from me) wrote the code using this or any saml plugin. | 13:53 |
| rodrigods | dolphm, are you there? When I try to rebase our patches with the recent changes in the branch, gerrit shows this list of commits to proceed: http://paste.openstack.org/show/118116/ | 13:54 |
| rodrigods | should I type "yes" ? =) | 13:54 |
| *** jamielennox has quit IRC | 13:56 | |
| *** jsavak has joined #openstack-keystone | 13:56 | |
| bknudson | marekd: I don't think that's a good enough reason... the versions that contains the old interface are published out there already and may be packaged up in distros so someone can come along much later and start using it. | 13:56 |
| *** thiagop has quit IRC | 13:59 | |
| *** topol has joined #openstack-keystone | 13:59 | |
| *** thiagop has joined #openstack-keystone | 13:59 | |
| marekd | bknudson: okay then. I will add some classmethods that will reorder the args list. | 14:00 |
| *** joesavak has quit IRC | 14:00 | |
| bknudson | marekd: that sounds good. | 14:01 |
| bknudson | the old interface can be deprecated | 14:01 |
| marekd | bknudson: how/when ? | 14:04 |
| bknudson | marekd: say that it's deprecated in the docstring and then in a couple releases (12 months?) it can be removed. | 14:05 |
| *** stevemar has joined #openstack-keystone | 14:11 | |
| marekd | bknudson: you mean thefunction signature for instance, right? | 14:12 |
| *** gokrokve has joined #openstack-keystone | 14:13 | |
| *** jamielennox has joined #openstack-keystone | 14:15 | |
| *** gokrokve has quit IRC | 14:15 | |
| *** gokrokve has joined #openstack-keystone | 14:16 | |
| *** alex_xu has joined #openstack-keystone | 14:16 | |
| marekd | mhu: do you have a working federated testbed? | 14:20 |
| mhu | marekd: almost, my test VMs were recently destroyed on the test lab ... Currently rebuilding stuff | 14:21 |
| marekd | mhu: devstack at least? | 14:22 |
| marekd | pure devstack | 14:22 |
| mhu | marekd, yep | 14:22 |
| marekd | mhu: in devstack, you have two users | 14:22 |
| marekd | demo and admin | 14:22 |
| marekd | admin is like a real admin user? | 14:22 |
| marekd | mhu: should it be able to see all the virtual machines in this cloud setup ? | 14:23 |
| mhu | marekd, it's a matter of roles and policies. The admin user has obviously the admin role, which is allowed pretty much everything in policy.json files | 14:26 |
| marekd | in devstack, right? | 14:27 |
| mhu | marekd, yup | 14:27 |
| marekd | mhu: can you do me a favor and list what you have in env | grep OS | grep -v OS_PASSWORD | 14:27 |
| marekd | i actually want to know what variables you have | 14:28 |
| marekd | not even a values. | 14:28 |
| mhu | I don't usually have env variables set, I call the CLI like this, for example: OS_USERNAME=admin OS_PROJECT_DOMAIN_NAME=default OS_USER_DOMAIN_NAME=default OS_PROJECT_NAME=admin OS_AUTH_URL=http://192.168.56.101:5000/v3 OS_PASSWORD=admin OS_IDENTITY_API_VERSION=3 OS_AUTH_PLUGIN=v3password openstack --debug user list | 14:29 |
| mhu | (this is for v3 password auth) | 14:30 |
| marekd | yeah, i can see that | 14:30 |
| *** lhcheng has joined #openstack-keystone | 14:32 | |
| marekd | mhu: thanks, that helped. | 14:32 |
| mhu | marekd, glad to be of assistance ! also OS_AUTH_PLUGIN is not mandatory | 14:33 |
| mhu | unless you use saml-based auth | 14:33 |
| *** lhcheng has quit IRC | 14:36 | |
| *** gokrokve has quit IRC | 14:40 | |
| *** zzzeek has joined #openstack-keystone | 14:41 | |
| *** gokrokve has joined #openstack-keystone | 14:42 | |
| *** richm has joined #openstack-keystone | 14:42 | |
| dolphm | rodrigods: no, which review are you rebasing? | 14:43 |
| dolphm | rodrigods: gerrit permissions will likely stop you from uploading those merge commits anyway | 14:43 |
| nkinder | ayoung: I will try your client patches with kerberos today | 14:43 |
| ayoung | nkinder, awesome | 14:43 |
| ayoung | nkinder, did you see the above about the common client and auth plugins? | 14:44 |
| nkinder | ayoung: was just reading that | 14:45 |
| ayoung | https://review.openstack.org/#/c/108325/ | 14:45 |
| *** mflobo has quit IRC | 14:45 | |
| *** gokrokve_ has joined #openstack-keystone | 14:47 | |
| nkinder | marekd: fyi - I finally got around to setting up federation with mod_auth_mellon and ipsilon | 14:48 |
| nkinder | marekd: I'll be adding some updates to the docs to cover mod_auth_mellon config | 14:49 |
| *** ukalifon has quit IRC | 14:49 | |
| dolphm | rodrigods: instead of rebasing, i updated my local feature/hierarchical-multitenancy branch, checked out HEAD~0, and then cherry-picked all four of your changes onto that branch: http://pasteraw.com/757vzb4wegpqnz8tpxlz8mlu0buswy5 | 14:49 |
| dolphm | rodrigods: do you want to try doing the same, or should i upload these changes to gerrit? | 14:50 |
| nkinder | ayoung: ok, so the kerberos plug-in and 108325 are needed to allow the CLI to work with kerberos? | 14:50 |
| ayoung | nkinder, yes | 14:51 |
| *** gokrokve has quit IRC | 14:51 | |
| ayoung | nkinder, I've not tested it yet, but it looks like it should | 14:51 |
| nkinder | ayoung: ok, I'll review mhu's patch today too then | 14:51 |
| ayoung | nkinder, thanks | 14:51 |
| nkinder | ayoung: I have ipa/ipsilon/keystone/mod_mellon config nearly fully automated | 14:52 |
| ayoung | nkinder, I'm glad DOA does not have a physical presense | 14:53 |
| nkinder | ayoung: there's one manual step to register keystone as a SP with ipsilon, but I'm looking for a way to do that in automation | 14:53 |
| ayoung | I would be arrested for either murder or Arson | 14:53 |
| ayoung | actually, it is the client code...it really is not designed for what DOA needs to do, and that needs to change | 14:54 |
| ayoung | It turns out that, while I had login working, listing projects happened later, and was bypassing the plugin code | 14:54 |
| ayoung | and...the code is just horrible | 14:54 |
| *** henrynash has joined #openstack-keystone | 14:55 | |
| ayoung | and I'm going back to beating it into submission | 14:55 |
| dolphm | rodrigods: i'm assuming you're AFK for the day, so i'm going to go ahead and upload | 14:57 |
| *** cjellick has quit IRC | 14:59 | |
| marekd | nkinder nice :-) di you try it out with a browser or keystoneclient? | 15:01 |
| nkinder | marekd: I was just using a browser | 15:02 |
| marekd | nkinder: hm, does ipsilon already have the ECP imlemented? | 15:02 |
| ayoung | djammit django | 15:02 |
| marekd | if not, there is no point in trying ksc. | 15:02 |
| nkinder | marekd: No, I don't think it has ECP (could be mistaken) | 15:03 |
| marekd | nkinder: ok. | 15:03 |
| marekd | nkinder: anyway, it's good that you make mod_mellon working. | 15:03 |
| nkinder | marekd: Ipsilon is currently in the middle of adding the ability to pull user info from LDAP to put in the assertion. I need that do be able to do anything really useful. | 15:03 |
| marekd | nkinder: do you think you will be able to update our docs, so your discovery is also reflected (we only put configs for Apache + shibboleth) | 15:04 |
| nkinder | marekd: So I can identity the user, but I need to be able to customize things to put in group membership and other info that keystone's mappings can rely on. | 15:04 |
| nkinder | marekd: yes, that's my plan | 15:04 |
| marekd | nkinder: great! | 15:04 |
| nkinder | marekd: will you be at the summit? | 15:04 |
| marekd | nkinder: yes. | 15:08 |
| nkinder | marekd: great. I'll have a set up of it that I can show you | 15:08 |
| marekd | nkinder: awesome! | 15:08 |
| *** wwriverrat has joined #openstack-keystone | 15:09 | |
| marekd | stevemar: o/ do you think you will be able to comment ~now on my e-mail regarding protocols? | 15:10 |
| stevemar | marekd, o/ | 15:11 |
| *** wwriverrat has joined #openstack-keystone | 15:12 | |
| stevemar | nkinder, you owe me docs! :) | 15:12 |
| *** wwriverrat has left #openstack-keystone | 15:13 | |
| nkinder | stevemar: :) | 15:13 |
| nkinder | stevemar: I started reviewing your OSC CLI stuff last night. Will wrap up today. | 15:13 |
| nkinder | stevemar: looks like great stuff | 15:13 |
| nkinder | I keep steering people to OSC who are just familiar with KSC but want to do v3 stuff | 15:14 |
| nkinder | examples will save me some typing :) | 15:14 |
| stevemar | nkinder, examples save us all a lot of typing :P | 15:15 |
| marekd | stevemar: so? | 15:16 |
| marekd | :-) | 15:16 |
| stevemar | marekd, i like $ os federation protocol create --identity-provider idp --mapping test_mapping | 15:17 |
| dstanek | so DatabaseAlreadyControlledError is killing my soul | 15:17 |
| stevemar | the args should have dashes (-) not underscores (_) | 15:17 |
| stevemar | looking at the wiki now marekd | 15:18 |
| marekd | yeah, but basically e.g identity-provider should be flags | 15:18 |
| marekd | that was my question | 15:18 |
| *** david-lyle has joined #openstack-keystone | 15:18 | |
| marekd | stevemar: ^^ | 15:18 |
| stevemar | yeahh | 15:18 |
| stevemar | i think for the same of usability i would make them 'required flags' | 15:19 |
| stevemar | sake* | 15:19 |
| marekd | stevemar: ok, so i will recode my patch then. | 15:19 |
| *** henrynash has joined #openstack-keystone | 15:20 | |
| stevemar | marekd, commented | 15:22 |
| marekd | stevemar: thank you sir! | 15:22 |
| stevemar | marekd, in parser.add_argument() you can set required=True for optional arguments (ones that start with --) | 15:25 |
| marekd | stevemar: good hint | 15:26 |
| stevemar | marekd, moar comments! | 15:28 |
| *** thedodd has joined #openstack-keystone | 15:28 | |
| vsilva | ping, bknudson | 15:31 |
| *** dims is now known as dimsum_ | 15:32 | |
| vsilva | regarding https://review.openstack.org/#/c/123619/ (Explicit complaint about old OpenSSL when testing). So you´re saying I should grab the version outside the class? | 15:33 |
| vsilva | (and then decorate it with a skipIf) | 15:33 |
| dstanek | Vancouver, BC? | 15:34 |
| bknudson | vsilva: yes, use skipIf | 15:34 |
| dimsum_ | dstanek: y | 15:37 |
| *** cjellick has joined #openstack-keystone | 15:37 | |
| *** ukalifon1 has joined #openstack-keystone | 15:39 | |
| dstanek | dimsum_: never been, but the pictures look great | 15:39 |
| dimsum_ | dstanek: y looking forwared. i have not been there either | 15:40 |
| *** bdossant has quit IRC | 15:40 | |
| *** lufix has quit IRC | 15:44 | |
| marekd | stevemar: ehhh, when you say args you don't mean metavar? | 15:48 |
| *** gokrokve has joined #openstack-keystone | 15:50 | |
| *** gokrokve_ has quit IRC | 15:53 | |
| *** thedodd has quit IRC | 15:55 | |
| stevemar | marekd, i use the term too loosely :( | 15:57 |
| marekd | stevemar: i am constantly confused | 15:59 |
| marekd | stevemar: if i make: parser.add_argument('--foo', metava='<name>') | 15:59 |
| marekd | i will later have variable parser.foo | 15:59 |
| marekd | right? | 15:59 |
| stevemar | yes | 15:59 |
| stevemar | metavar is just for the help output | 16:00 |
| marekd | if i make parser.add_argument('--foo-bar', metava='<name>') i will have parser.foo_bar | 16:00 |
| stevemar | yes | 16:00 |
| marekd | and the naming should be with (-) | 16:00 |
| marekd | foo-bar, not foo_bar | 16:00 |
| rodrigods | thanks dolphm , was at a meeting, sorry for not being able to respond | 16:01 |
| dolphm | rodrigods: no worries | 16:02 |
| dolphm | rodrigods: if you have other patch sequences, try cherry picking each patch in order onto an updated branch | 16:02 |
| dolphm | rodrigods: i also recommend working on untracked local branches (git checkout HEAD~0) | 16:02 |
| dolphm | marekd: ++ | 16:03 |
| rodrigods | dolphm, yeah, thanks... will do that | 16:04 |
| dolphm | dstanek: dimsum_: vancouver is great, especially all the islands in the straight | 16:04 |
| dimsum_ | dolphm: nice | 16:05 |
| morganfainberg | Vancouver will be a good venue | 16:13 |
| morganfainberg | means i'll need to hang out w/ people in Seattle around the trip as well | 16:14 |
| *** lhcheng has joined #openstack-keystone | 16:14 | |
| *** jistr has quit IRC | 16:21 | |
| *** marcoemorais has joined #openstack-keystone | 16:22 | |
| *** imkarrer has joined #openstack-keystone | 16:30 | |
| *** ayoung is now known as ayoung-runch | 16:33 | |
| dolphm | dstanek: morganfainberg: wait, what's in vancouver? | 16:37 |
| morganfainberg | dolphm, May summit | 16:37 |
| dolphm | ooh, missed that | 16:38 |
| dolphm | i see the save the date now | 16:38 |
| dolphm | https://www.openstack.org/summit/vancouver-2015/ | 16:38 |
| raildo_away | Vancouver should be cool :) | 16:38 |
| *** aix has quit IRC | 16:40 | |
| *** raildo_away is now known as raildo | 16:40 | |
| *** richm has quit IRC | 16:40 | |
| *** lhcheng is now known as lcheng | 16:42 | |
| stevemar | yay vancouver | 16:43 |
| *** gyee has joined #openstack-keystone | 16:50 | |
| dstanek | stevemar: ++ | 16:52 |
| dstanek | travel will be a little better for me | 16:52 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add v3 openstackclient CLI examples https://review.openstack.org/124489 | 16:53 |
| stevemar | dstanek, slightly, yes | 16:53 |
| stevemar | dstanek, i'm just excited to not have to bring a passport | 16:54 |
| marekd | dstanek: stevemar when do you arrive? | 16:54 |
| marekd | to PAris ofc | 16:54 |
| stevemar | dstanek, or worry about exchanging money | 16:54 |
| stevemar | marekd, the 3rd :\ | 16:54 |
| marekd | stevemar: and leave? | 16:55 |
| stevemar | marekd, the 8th :( | 16:55 |
| marekd | short trip | 16:55 |
| *** NM has quit IRC | 16:59 | |
| *** jsavak has quit IRC | 17:03 | |
| *** amcrn has joined #openstack-keystone | 17:04 | |
| remote_morgan_ | stevemar: you should exchange money for Vancouver anyway. | 17:05 |
| stevemar | morganfainberg, just get smaller denominations :P | 17:06 |
| *** ukalifon1 has quit IRC | 17:06 | |
| dstanek | marekd: i'm on the Sunday before. maybe the 2nd | 17:08 |
| dstanek | stevemar: money, phone and language are my biggest worries | 17:08 |
| marekd | stevemar: what currency they have in Vancouver? | 17:09 |
| marekd | dstanek: oh yes, french ppl don't speak english. | 17:09 |
| *** NM has joined #openstack-keystone | 17:09 | |
| stevemar | marekd, canadian dollars in vancouver :) | 17:09 |
| marekd | stevemar: and what $$ you have in Toronto? | 17:10 |
| marekd | canadian i'd say as well? | 17:10 |
| marekd | dstanek: and for the money? What is the problem with them? | 17:10 |
| stevemar | marekd, yep | 17:10 |
| stevemar | marekd, i think dstanek is worried about euros | 17:10 |
| dstanek | marekd: it just adds to the hassle; traveling already sucks | 17:11 |
| marekd | dstanek: get your US credit card and let your bank do the rest. | 17:11 |
| marekd | dstanek: usually bank rates are better then in the cantors. | 17:12 |
| *** andreaf has quit IRC | 17:12 | |
| * marekd bear in mind American Express might not work in Europe | 17:12 | |
| dstanek | marekd: yes, but i may need cash for incidentals right? or if i'm in a pinch it would be nice to know i have some cash | 17:12 |
| *** andreaf has joined #openstack-keystone | 17:12 | |
| stevemar | marekd, do alot of places not take amex? | 17:13 |
| dstanek | marekd: i have read that amex is usually only accepted in high end places and that visa is the most commonly accepted card...but that's just reading travel blogs | 17:13 |
| stevemar | i just need it for taxi | 17:13 |
| stevemar | dstanek, ++ on cash for incidentals, i'll be taking some out | 17:13 |
| remote_morgan_ | Unfortunately I need to use Amex for travel. But I know I can use it to get cash if needed. | 17:14 |
| marekd | stevemar: dstanek you gyus are talking like you never left us before. :-) | 17:14 |
| marekd | stevemar: or CA in your case | 17:14 |
| marekd | :P | 17:14 |
| stevemar | dstanek, and you have a nexus phone, so just buy a phone card at the airport and enjoy your unlocked goodness | 17:14 |
| dstanek | marekd: i havent' been out of the US since we started needing a passport to get into Canada - been a really long time | 17:15 |
| marekd | dstanek: get the money from the ATM and you have euros. | 17:15 |
| remote_morgan_ | marekd: my experience in Europe has been most credit cards work. Just costs a chunk of change for foreign transactions depending on the cc | 17:15 |
| remote_morgan_ | *shrug* | 17:15 |
| remote_morgan_ | And yea ATM! :) | 17:16 |
| marekd | remote_morgan_: i am saying Amex can not work everywhere.... | 17:16 |
| marekd | may not work everywhere. | 17:16 |
| dstanek | stevemar: i'm a little paranoid to bring my personal phone after i read about the rate of phone hacking in france | 17:16 |
| marekd | dstanek: ? | 17:16 |
| remote_morgan_ | marekd: oh yeah. But that is true for some Visa cards etc as well. | 17:16 |
| *** praneshp has joined #openstack-keystone | 17:17 | |
| marekd | remote_morgan_: that also work the other way round. I might have Visa credit card issue by my european bank and it may be rejected in the US | 17:17 |
| dstanek | marekd: i was reading some security blogs that mentioned the cyber hacking in France, specifically in the larger cities, is very common | 17:17 |
| marekd | remote_morgan_: i would simply assume that Amex will be accepted *everywhere*. | 17:18 |
| marekd | remote_morgan_: i would simply assume that Amex will *NOT* be accepted *everywhere*. | 17:18 |
| dstanek | marekd: so i've been thinkin about buying somethings like http://www.scottevest.com/v3_store/BP.shtml | 17:18 |
| marekd | sorry | 17:18 |
| remote_morgan_ | Right | 17:18 |
| marekd | we don't use amex in europe, that's all | 17:19 |
| marekd | ok, need to run | 17:19 |
| marekd | cheers | 17:19 |
| * dstanek thinks marekd is the international man of mystery | 17:20 | |
| stevemar | dstanek, he most definitely is | 17:23 |
| *** afazekas has quit IRC | 17:26 | |
| *** dhellmann is now known as dhellmann_ | 17:29 | |
| *** amcrn has quit IRC | 17:38 | |
| *** jamielennox has quit IRC | 17:43 | |
| *** amcrn has joined #openstack-keystone | 17:45 | |
| *** andreaf has quit IRC | 17:47 | |
| *** andreaf has joined #openstack-keystone | 17:47 | |
| *** harlowja_away is now known as harlowja | 17:48 | |
| remote_morgan_ | dstanek: ++ | 17:49 |
| remote_morgan_ | Hmm. Quota info in keystone again. Hmm. | 17:52 |
| remote_morgan_ | ok so I think I have 3 sessions for keystone definitely in mind (with 4 still open). | 17:52 |
| remote_morgan_ | 1) client. (Lots to discuss here), 2) object life cycle (dependency injection), 3) authz (tokens, future, something new instead, etc). | 17:54 |
| *** praneshp has quit IRC | 17:54 | |
| remote_morgan_ | Next week I'll be trying to line up the sessions a bit more clearly. I think CI might be a pod/meetup-day topic. | 17:54 |
| remote_morgan_ | For example. | 17:54 |
| *** sigmavirus24 has joined #openstack-keystone | 17:59 | |
| *** ukalifon1 has joined #openstack-keystone | 18:00 | |
| *** ayoung-runch has quit IRC | 18:01 | |
| *** gokrokve_ has joined #openstack-keystone | 18:02 | |
| *** lsmola has quit IRC | 18:03 | |
| *** praneshp has joined #openstack-keystone | 18:05 | |
| *** gokrokve has quit IRC | 18:07 | |
| *** gokrokve_ has quit IRC | 18:07 | |
| *** ayoung has joined #openstack-keystone | 18:09 | |
| rodrigods | dolphm, there? | 18:11 |
| dolphm | rodrigods: eating lunch but yes | 18:11 |
| *** gokrokve has joined #openstack-keystone | 18:11 | |
| vsilva | bknudson, http://paste.openstack.org/show/118193/ | 18:11 |
| rodrigods | dolphm, no problem. you can respond when you have a moment =)... anyway, what did here: | 18:12 |
| rodrigods | 1 - checked out the branch origin/feature/hierarchical-multitenancy | 18:12 |
| vsilva | Is this really what you meant? I'm having a hard time finding it better than before, but I'm happy to send it over if you think it's better (than https://review.openstack.org/#/c/123619/) | 18:12 |
| *** gokrokve_ has joined #openstack-keystone | 18:12 | |
| *** marcoemorais has quit IRC | 18:12 | |
| rodrigods | 2 - did a cherry pick with our first patch: https://review.openstack.org/#/c/117784/ | 18:13 |
| *** marcoemorais has joined #openstack-keystone | 18:13 | |
| *** david-lyle has quit IRC | 18:13 | |
| bknudson | vsilva: put that code to get the openssl version in a function so you can call it. | 18:13 |
| rodrigods | 3 - changed the file script 055_add_parent_project to 056_add_parent_project to | 18:13 |
| *** marcoemorais has quit IRC | 18:13 | |
| rodrigods | 4 - git checkout HEAD~0 | 18:13 |
| *** marcoemorais has joined #openstack-keystone | 18:13 | |
| *** marcoemorais has quit IRC | 18:13 | |
| *** jaosorior has quit IRC | 18:13 | |
| rodrigods | 5 - git review -R feature/hierarchical-multitenancy | 18:13 |
| *** marcoemorais has joined #openstack-keystone | 18:14 | |
| rodrigods | dolphm, gerrit still tries to send the huge list of reviews =( | 18:14 |
| *** marcoemorais has quit IRC | 18:14 | |
| *** marcoemorais has joined #openstack-keystone | 18:14 | |
| dolphm | rodrigods: did you update the branch between step 1 and 2? | 18:15 |
| *** gokrokve has quit IRC | 18:16 | |
| *** amakarov has quit IRC | 18:16 | |
| rodrigods | dolphm, yes | 18:16 |
| dolphm | rodrigods: so then, do step 4 before step 2 | 18:17 |
| dolphm | rodrigods: and then step 2 is just "git review -x 117784" | 18:17 |
| dolphm | then make your edits, git commit --amend, and git review -R feature/hierarchical-multitenancy | 18:18 |
| rodrigods | dolphm, great will try it here | 18:18 |
| rodrigods | thanks | 18:18 |
| dolphm | rodrigods: let me know how it goes | 18:18 |
| dstanek | morganfainberg: i'm about ready to pull my hair out | 18:20 |
| vsilva | aight bknudson, sending this over: http://paste.openstack.org/show/118201/ | 18:21 |
| bknudson | vsilva: you can post changes to gerrit then it can be reviewed there. | 18:21 |
| *** gokrokve_ has quit IRC | 18:22 | |
| rodrigods | dolphm, it worked! =DD | 18:24 |
| rodrigods | thanks | 18:24 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: WIP: Fixes endpoint_filter https://review.openstack.org/126029 | 18:25 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: WIP: Force SQLite to properly deal with foreign keys https://review.openstack.org/126030 | 18:25 |
| dolphm | rodrigods: awesome, glad to hear | 18:25 |
| ayoung | dolphm, WRT roles and permissions: if "admin" should cover all of the permissions of "member" should we do role inference or inheritance, where admin implies member? Or should all of that kind of logic be left to the policy? | 18:25 |
| dolphm | ayoung: policy, for sure | 18:25 |
| dstanek | dolphm: in my pursuit to break everything i think i found (err fixed) an interesting bug - https://review.openstack.org/#/c/126029/1 | 18:26 |
| dolphm | dstanek: haha | 18:26 |
| ayoung | dolphm, you think its better to have more explicit rules in policy.json? | 18:26 |
| dolphm | dstanek: this sounds like a juno target | 18:26 |
| dolphm | ayoung: define more explicit? | 18:27 |
| *** andreaf has quit IRC | 18:27 | |
| ayoung | dolphm, if you want an API to work for admin or member, you need a rule that matches either role | 18:27 |
| ayoung | and that needs to be duplicated for all of the APIs that want it | 18:27 |
| ayoung | like we have admin_or_owner | 18:27 |
| *** andreaf has joined #openstack-keystone | 18:27 | |
| *** jamielennox has joined #openstack-keystone | 18:27 | |
| dstanek | dolphm: yeah i can't find any other reports in our list of bugs | 18:28 |
| dolphm | ayoung: correct. i'd like to get to a point where the policy JSON is generated by something (horizon or a CLI) that perhaps expresses those relationships | 18:28 |
| dolphm | ayoung: it is unwieldy by hand, for sure | 18:28 |
| dolphm | dstanek: i'm not aware of one either | 18:29 |
| rodrigods | ayoung, what do you think about this proposal: https://review.openstack.org/#/c/123509/ ? | 18:29 |
| ayoung | rodrigods, I think there are some good ideas in there | 18:30 |
| ayoung | rodrigods, I think we are limited today by mechanisms | 18:30 |
| rodrigods | ayoung, awesome... what do you mean about "mechanisms"? | 18:31 |
| ayoung | rodrigods, the issue is that we want those definitions to be common across openstack | 18:31 |
| ayoung | so nova and glance get them, too | 18:31 |
| rodrigods | ayoung, absolutely | 18:31 |
| rodrigods | that's why we've submitted to keystone, nova, glance, cinder and neutron | 18:31 |
| ayoung | rodrigods, I was tooling around with this strawman: https://review.openstack.org/#/c/125704/ | 18:31 |
| ayoung | rodrigods, it goes against what dolphm just stated | 18:32 |
| vsilva | bknudson, what I was going to say is that sending this code over to the skipIf means that the tests in that class are skipped without saying anything when you run tox; that takes us back to the problem of old OpenSSL breaking things silently and people not knowing why. | 18:32 |
| ayoung | but if nothing else, we can leave it up there as an alternative to what we end up actually doing | 18:32 |
| ayoung | rodrigods, there was a proposal to have service specific roles two summits back | 18:33 |
| vsilva | having these older versions also mean many tests breaking in other test classes, so I don't think skipping won't do - it's just a matter of catching that and really breaking with a good message somewhere imho | 18:33 |
| vsilva | *will do | 18:33 |
| ayoung | rodrigods, I am not certain that it is the right scope: I could see and argument for roles and services being coupled, but also for endpoint specific roles and roles for a group of related services | 18:34 |
| ayoung | rodrigods, it all comes down to how granular we want to delegate permissions to do something. The constraints spec is also related | 18:34 |
| ayoung | rodrigods, https://review.openstack.org/#/c/123726/ | 18:35 |
| bknudson | vsilva: setupclass doesn't work then? | 18:35 |
| rodrigods | ayoung, hmm | 18:35 |
| rodrigods | ayoung, maybe a first step would have such type of policies? | 18:36 |
| *** marcoemorais has quit IRC | 18:36 | |
| rodrigods | splitting admin global role into explicit ones | 18:36 |
| *** marcoemorais has joined #openstack-keystone | 18:37 | |
| *** marcoemorais has quit IRC | 18:37 | |
| *** marcoemorais has joined #openstack-keystone | 18:37 | |
| vsilva | bknudson, I hadn't heard about setupclass but a quick look at the docs tells me it's perfect. thanks! | 18:37 |
| ayoung | rodrigods, first step was the ability to assigne a policy to an endpoint. Next thing we need is for the policy engine to be able to fetch its policy from Keystone | 18:39 |
| ayoung | once we do that, we can make policy far more granular | 18:40 |
| ayoung | the assignment part went in to Juno thanks to henrynash , but the fetch part is harder. It means that an endpoint needs to know its own identity | 18:41 |
| ayoung | also, the code for policy is not part of keystonemiddleware, but rather oslo, which does not have any way to call to Keystone server to fetch the policy | 18:41 |
| *** gokrokve has joined #openstack-keystone | 18:41 | |
| ayoung | rodrigods, that is really what we need next, I think: fetch policy for endpoint | 18:42 |
| rodrigods | ayoung, interesting.... right now we are working on a PoC to replace Horizon's policies copies to policies fetched from Keystone via the enpoint-policy API | 18:44 |
| ayoung | rodrigods, so that Horizon can show the right UI to a use based on roles? | 18:44 |
| rodrigods | ayoung, exactly! | 18:44 |
| ayoung | ++ | 18:44 |
| rodrigods | we discussed here how it would work in the future | 18:45 |
| rodrigods | all policies would be stored in keystone? | 18:45 |
| dstanek | we don't seem to have any non-HTTP exceptions in Keystone | 18:46 |
| bknudson | dstanek: it's crazy... the managers should not be raising HTTP exceptions. | 18:47 |
| rodrigods | dolphm, the same approach would work to send reviews to keep our branch up-to-date? | 18:48 |
| dolphm | rodrigods: no, you need someone in this group to upload merge commits to the feature branch, otherwise gerrit won't accept them https://review.openstack.org/#/admin/groups/145,members | 18:50 |
| dolphm | rodrigods: long term, that'll just be morganfainberg | 18:50 |
| rodrigods | dolphm, hmm ok, thanks =) | 18:50 |
| dolphm | dstanek: by design! although arguably NotFound should never be exposed to HTTP (but if it is, it can be rendered correctly) | 18:51 |
| dstanek | dolphm: shouldn't the internal parts of keystone raise domain specific, non-HTTP errors and the controller (web) layer translate those into HTTP errors? | 18:52 |
| bknudson | dstanek: that's exactly what it should do. | 18:54 |
| bknudson | doesn't make sense especially when the backends can be called from cli | 18:55 |
| raildo | ayoung, to do that what rodrigods are saying, i need to now how the services(Nova, Horizon...) can use the role "service". How they do that? | 18:56 |
| raildo | https://github.com/openstack/keystone/blob/master/etc/policy.json#L3 | 18:56 |
| ayoung | raildo, um...basically, its in the policy file. I'm not ever sure if they do | 18:56 |
| ayoung | raildo, https://github.com/openstack/keystone/blob/master/etc/policy.json#L90 | 18:57 |
| ayoung | raildo, I think it is just to limit them to only validating tokens. | 18:57 |
| ayoung | Oh, and the new apis | 18:58 |
| ayoung | "identity:check_policy_association_for_service" and the like | 18:58 |
| vsilva | bknudson, hold on a minute, setUpClass is never called when running the tests with tox! It might have something to do with the way we the suite works. Have you seen something like this? | 19:00 |
| bknudson | vsilva: they use setupclass all the time in tempest code. | 19:05 |
| *** amcrn has quit IRC | 19:07 | |
| *** amcrn has joined #openstack-keystone | 19:09 | |
| dolphm | bknudson: yes, but i find that's prone to programmer error, so i'm in favor of mostly dual-purpose exceptions | 19:14 |
| dolphm | dstanek: ^ | 19:14 |
| dolphm | programmer error in terms of compromising end-user experience unintentionally. like things aren't caught that should be, and then you end up with a 500 instead of a 400, or whatever | 19:15 |
| bknudson | dolphm: y, I'm not sure what a safe solution would look like. | 19:15 |
| dstanek | dolphm: bknudson: theoretically there should be tests for the known expected exceptions and then anything else by definition would be a 500; we are actually pretty good there | 19:20 |
| *** thedodd has joined #openstack-keystone | 19:21 | |
| *** david-lyle has joined #openstack-keystone | 19:21 | |
| *** andreaf has quit IRC | 19:21 | |
| *** andreaf has joined #openstack-keystone | 19:22 | |
| raildo | ayoung, my doubt is how the service use this role? Internally they create a user, like "nova_user" and grant this role "service"? | 19:27 |
| ayoung | raildo, done at install time | 19:28 |
| *** gyee has quit IRC | 19:28 | |
| raildo | ayoung, hum... i get it. | 19:29 |
| raildo | ayoung, thanks! | 19:29 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:34 | |
| *** topol has quit IRC | 19:35 | |
| dstanek | what is the difference between juno-rc-potential and juno-backport-potential? | 19:50 |
| bknudson | dstanek: juno-backport would go in stable/juno | 19:51 |
| bknudson | which there isn't one yet, so no real difference | 19:51 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 19:52 | |
| vsilva | bknudson, I looked into the tempest tests and into many others which indeed use setUpClass, but it is simply not called if it's in CMSTest. rodrigods and I have been over this for some time now and our best guess is that it's something about inheriting from both utils.TestCase and testresources.ResourcedTestCase, but had no luck in finding out what. | 19:53 |
| vsilva | You can check it out yourself if you want to double check that it is indeed not called - that should be pretty quick. I'll just fix the pep8 issue and update the review, hopefully someone comes up with a suggestion | 19:55 |
| dstanek | bknudson: thx for the info | 19:55 |
| bknudson | vsilva: I'll try it. | 19:55 |
| *** vsilva has left #openstack-keystone | 19:56 | |
| *** vsilva has joined #openstack-keystone | 19:56 | |
| *** mfisch has quit IRC | 19:56 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes an error deleting an endpoint group project https://review.openstack.org/126050 | 20:04 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Validates controller methods exist when specified https://review.openstack.org/126051 | 20:04 |
| *** dhellmann_ is now known as dhellmann | 20:04 | |
| *** mfisch has joined #openstack-keystone | 20:06 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 20:06 | |
| *** mfisch is now known as Guest86318 | 20:06 | |
| dstanek | "Thank you for your bug report" -> You're welcome! | 20:06 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use openstackclient examples in configuration documentation https://review.openstack.org/124270 | 20:07 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the CLI examples to also use openstackclient https://review.openstack.org/124095 | 20:07 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add v3 openstackclient CLI examples https://review.openstack.org/124489 | 20:07 |
| bknudson | vsilva: that is weird... wonder what the deal is. | 20:08 |
| vsilva | bknudson, tell me about it! I'm glad I'm not crazy. | 20:08 |
| nkinder | ayoung: are your rpms on fedorapeople up to date for the kerberos auth plugin? | 20:12 |
| ayoung | nkinder, yes | 20:12 |
| nkinder | ayoung: ok, cool | 20:12 |
| stevemar | dstanek, errrr my gosh -> Validates controller methods exist when specified, you are my favorite person | 20:12 |
| dstanek | stevemar: :-) so simple, yet so powerful | 20:13 |
| stevemar | i know! | 20:13 |
| vsilva | bknudson, what do you suggest then? | 20:15 |
| dstanek | stevemar: it took me an embarrassingly long time figuring out what the endpoint_filter tests were trying to test | 20:15 |
| bknudson | vsilva: I need to try some more things | 20:15 |
| vsilva | all right | 20:15 |
| nkinder | stevemar: do you think we should add '=' chars in the section starting at line 1183 here? https://review.openstack.org/#/c/124270/6..7/doc/source/configuration.rst | 20:16 |
| nkinder | stevemar: not trying to be too nit-picky here... :) | 20:16 |
| stevemar | nkinder, you're not being too nit picky at all, i thought the same thing when writing it up, it was more of a 'meh' for me | 20:17 |
| nkinder | stevemar: yeah, that's my feeling too | 20:18 |
| nkinder | stevemar: I'm cool with it either way, so let me know what you want to do | 20:18 |
| nkinder | stevemar: I've +1'd it as it stands. If you decide to tweak it, I'll make sure to vote on it again. | 20:20 |
| bknudson | vsilva: ok, I think we tried hard enough. Let's just do it in init | 20:23 |
| bknudson | I'll ask lifeless about it if I can find him. | 20:24 |
| rodrigods | vsilva, bknudson great | 20:24 |
| stevemar | nkinder, the only reason i'd be opposed it because i want it merged, it's had quite a few eyes on it now | 20:25 |
| nkinder | stevemar: me too. :) There's a whole chain you have waiting for this one too | 20:26 |
| nkinder | stevemar: I'm with you. Let's get it in as is. It's correct, and all of the examples work. | 20:26 |
| *** andreaf has quit IRC | 20:29 | |
| *** Tahmina has joined #openstack-keystone | 20:29 | |
| *** andreaf has joined #openstack-keystone | 20:29 | |
| *** dims_ has joined #openstack-keystone | 20:31 | |
| *** __TheDodd__ has joined #openstack-keystone | 20:31 | |
| *** thedodd has quit IRC | 20:31 | |
| *** dimsum_ has quit IRC | 20:34 | |
| stevemar | nkinder, there is actually one outside of the chain that hasn't gotten any love :( | 20:35 |
| nkinder | stevemar: point me at it and I'll review it | 20:36 |
| stevemar | nkinder, YAY - https://review.openstack.org/#/c/123933/ | 20:36 |
| *** Kui has joined #openstack-keystone | 20:38 | |
| ayoung | dstanek, how do I force a compile of a python file? | 20:38 |
| nkinder | stevemar: oh, nice! Killing 'tenant' references... | 20:38 |
| nkinder | ayoung: delete the .pyc? | 20:38 |
| ayoung | nkinder, no, I mean explicitly compile to see the errors for bad syntax | 20:38 |
| stevemar | run pep8 :P | 20:39 |
| ayoung | nkinder, I can't just import into the python interpreter, as that errors out on a django config warning | 20:39 |
| ayoung | stevemar, not working on my remote machine where I need this | 20:39 |
| nkinder | ayoung: python -m py_compile <file>? | 20:40 |
| ayoung | same error | 20:40 |
| ayoung | django.core.exceptions.ImproperlyConfigured: Requested setting CACHES, but settings are not configured. You must either define the environment variable DJANGO_SETTINGS_MODULE or call settings.configure() before accessing settings. | 20:40 |
| ayoung | wait, OI had it wrong | 20:41 |
| ayoung | and...no complaints... | 20:41 |
| Kui | https://review.openstack.org/#/c/122037/ someone help to review? | 20:41 |
| ayoung | it must be something that is failing at runtime after the DJANGO_SETTINGS_MODULE issue, but Django swallows it | 20:41 |
| ayoung | Kui, that looks like it could use a spec | 20:42 |
| ayoung | I'm not certain, as it is fairly simple, but... | 20:42 |
| ayoung | Kui, I'd want morganfainberg 's input on that one | 20:43 |
| *** fifieldt has quit IRC | 20:44 | |
| dstanek | ayoung: did you get it to work? | 20:44 |
| ayoung | dstanek, the copile, use, Django, not so much | 20:45 |
| dstanek | morganfainberg, zzzeek: this seem to cause crazy migration errors: https://review.openstack.org/#/c/126030/ | 20:45 |
| dstanek | morganfainberg, zzzeek: i'd appreciate any thoughts on where to look | 20:46 |
| Kui | ayoung, morganfainberg had some comment on this bug, and agreed this idea. This change needs review by him too. | 20:46 |
| zzzeek | dstanek: i’d imagine, since sqlalhcemy-migrate probably doesnt support that | 20:46 |
| ayoung | dstanek, yeah I think I'm back to running | 20:46 |
| dstanek | ayoung: if you just want to check for compile time errors you can just run the file through python | 20:46 |
| zzzeek | dstanek: they should look into not having that option turned on when migrations run | 20:46 |
| *** raildo is now known as raildo_away | 20:47 | |
| ayoung | dstanek, I tries that, but what I needed was load time errors, and Django was masking them | 20:47 |
| dstanek | zzzeek: that's easy enough - so you think sqlalchemy-migrate has some hard coded assumptions about sqlite? | 20:47 |
| ayoung | it was compiling fine | 20:47 |
| dstanek | zzzeek: it works on databases with real FK support so i just assumed it would work with sqlite too | 20:48 |
| zzzeek | dstanek: sqlite doesnt have any facilities for db migrations so migrate drops whole tables and recreates them | 20:48 |
| ayoung | dstanek, the naming convention where packages sit on the good variable names is really annoying. session is an object, dangit | 20:49 |
| *** dimsum_ has joined #openstack-keystone | 20:51 | |
| dstanek | ayoung: i find django polarizing for experienced developers; some love it and some hate it | 20:51 |
| dstanek | zzzeek: ok that makes sense. i'll re-enable it for these tests | 20:52 |
| dstanek | zzzeek: i'm trying to get the Keystone tests to run under non-SQLite databases, but apparenty some of our tests don't care about foreign keys | 20:53 |
| dstanek | zzzeek: thanks again! | 20:53 |
| ayoung | dstanek, I'm not even really in Django mode, just that if I get a parse error in the plugin, the Horizon code swallows it and doesn't show me the actual problem. I don;t think it is Django, just us. | 20:54 |
| *** dims_ has quit IRC | 20:55 | |
| *** gokrokve has quit IRC | 20:55 | |
| *** mfisch has joined #openstack-keystone | 21:01 | |
| *** fifieldt has joined #openstack-keystone | 21:01 | |
| *** mfisch is now known as Guest49899 | 21:01 | |
| *** mfisch` has joined #openstack-keystone | 21:01 | |
| gordc | does anyone see a oslo.db error when they run keystone-manage db_sync? | 21:05 |
| vsilva | bknudson, all right | 21:11 |
| *** gokrokve has joined #openstack-keystone | 21:12 | |
| *** andreaf has quit IRC | 21:15 | |
| *** andreaf has joined #openstack-keystone | 21:15 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 21:17 | |
| nkinder | ayoung: so I have mod_auth_kerb setup for a location of "/krb"... | 21:18 |
| nkinder | ayoung: I can access that via browser, and I can see that mod_auth_kerb authenticates me | 21:19 |
| nkinder | ayoung: but, keystone returns a 404 | 21:19 |
| nkinder | ayoung: shouldn't the version discovery details be returned like it does for my "/" location that isn't kerberized? | 21:19 |
| ayoung | using the right auth url? | 21:19 |
| ayoung | nah | 21:20 |
| ayoung | no discovery | 21:20 |
| ayoung | nkinder, you'd need to go in and set the URL correct in the Keystone conf file for the /krb | 21:20 |
| ayoung | 404 for what? | 21:20 |
| *** gordc has quit IRC | 21:21 | |
| ayoung | you mean you should see the version page? Yes, you should | 21:21 |
| *** ukalifon1 has quit IRC | 21:22 | |
| *** __TheDodd__ is now known as thedodd | 21:23 | |
| nkinder | ayoung: yes, I see the version page without kerberos | 21:24 |
| nkinder | ayoung: but my /krb url doesn't (it 404's) | 21:24 |
| ayoung | nkinder, past your config | 21:25 |
| ayoung | wsgi-keystone.conf | 21:25 |
| ayoung | paste | 21:25 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 21:25 | |
| *** radez is now known as radez_g0n3 | 21:25 | |
| nkinder | ayoung: http://paste.openstack.org/show/118251/ | 21:26 |
| ayoung | "/var/www/cgi-bin/keystone/main" so are you getting spnego kicking in hitting /krb? | 21:32 |
| *** henrynash has quit IRC | 21:37 | |
| nkinder | ayoung: yep, let me grab the relevant logs | 21:39 |
| ayoung | nkinder, let me see, I have a machine I converted from packstack that should look like that | 21:39 |
| *** andreaf has quit IRC | 21:40 | |
| *** andreaf has joined #openstack-keystone | 21:40 | |
| ayoung | nkinder, I did away with the virtual hosts, though. That 5000 thing is insane | 21:40 |
| *** Dafna has quit IRC | 21:41 | |
| nkinder | ayoung: here's what I see in access/error for a single request to /krb - http://paste.openstack.org/show/118252/ | 21:41 |
| nkinder | ayoung: I also tweaked the WsgiProcessGroup to just use the same one for kerberos, but no luck there | 21:41 |
| ayoung | nkinder, you could try just converting /main to kerberos | 21:42 |
| ayoung | do the whole auth url just to see if it works | 21:42 |
| ayoung | you have ipsilon on port 5000? | 21:43 |
| ayoung | oh, neverming | 21:44 |
| *** david-lyle has quit IRC | 21:47 | |
| nkinder | yeah, ipsilon is on a different server | 21:49 |
| nkinder | ayoung: so it doesn't even hit keystone.log with anything. How can I see if mod_wgsi is calling "main"? | 21:50 |
| ayoung | nkinder, is it in the error log? | 21:50 |
| ayoung | /etc/httpd/error_log? | 21:51 |
| ayoung | er | 21:51 |
| ayoung | make that var | 21:51 |
| ayoung | /var/log/httpd/error_log? | 21:51 |
| nkinder | ayoung: nope | 21:51 |
| nkinder | none of the error logs (keystone uses a custom one) | 21:51 |
| ayoung | yeah, but if keystone is not triggered it will end up in the main logs | 21:52 |
| *** dimsum_ has quit IRC | 22:02 | |
| *** dimsum_ has joined #openstack-keystone | 22:02 | |
| *** andreaf has quit IRC | 22:05 | |
| *** rkofman has quit IRC | 22:05 | |
| *** rkofman has joined #openstack-keystone | 22:06 | |
| *** dimsum_ has quit IRC | 22:07 | |
| nkinder | ayoung: ok, so it's hitting the "main" script in cgi-bin and is calling deploy.loadapp() | 22:08 |
| ayoung | nkinder, is this one of the cases where it errors out on oslo conf because it is already loaded? You might need a separate WSGI process | 22:09 |
| nkinder | ayoung: not sure yet. I didn't see an error about that... | 22:10 |
| nkinder | ayoung: but I had a separate process before, and it didn't work | 22:10 |
| ayoung | nkinder, yeah, its like programming by side effects | 22:10 |
| ayoung | coding inside Apache can be frustrating | 22:10 |
| ayoung | if needs be, use rpdb | 22:10 |
| nkinder | ayoung: I'm going to start adding logging in paste.deploy... | 22:10 |
| ayoung | selinux disabled? | 22:11 |
| ayoung | shouldn't be an issue | 22:11 |
| ayoung | as there are no new files | 22:11 |
| *** bknudson has quit IRC | 22:14 | |
| nkinder | ayoung: sigh.... | 22:15 |
| nkinder | ayoung: so if I add /krb to keystone-paste.ini, it works | 22:15 |
| rm_work | ayoung / nkinder / morganfainberg / whoever: just sent to the openstack-dev ML: "[openstack-dev] [Neutron] Barbican Integration for Advanced Services" if you want to give that a look, very similar to what we talked about here before, and I think I incorporated most of your concerns/comments | 22:15 |
| rm_work | Would love your feedback on that thread if you have any further comments :) | 22:15 |
| nkinder | ayoung: I guess the /krb isn't stripped off | 22:15 |
| nkinder | rm_work: cool, will take a look this weekend | 22:15 |
| ayoung | nkinder, huh? I've not seen that | 22:15 |
| nkinder | ayoung: maybe it's related to my doc root or something? | 22:16 |
| rm_work | thanks :) | 22:16 |
| nkinder | ayoung: paste your entire wsgi config for me | 22:16 |
| ayoung | nkinder, almost certainly. As I said, I've a fairly different setup. I don't like the nonstandard ports | 22:16 |
| nkinder | ayoung: so my setup is this... | 22:17 |
| ayoung | nkinder, http://paste.openstack.org/show/118265/ | 22:17 |
| nkinder | '/' - normal keystone | 22:17 |
| nkinder | '/krb' - kerberized keystone | 22:17 |
| ayoung | nkinder, this was an all in one, so I merged in the horizon and keystone configs | 22:18 |
| *** NM has quit IRC | 22:18 | |
| ayoung | for :5000? | 22:18 |
| nkinder | '/v3/OS-FEDERATION/identity_providers/ipsilon/protocols/saml2/auth' - federated keystone auth | 22:18 |
| nkinder | ayoung: yeah, I have horizon in the same httpd too | 22:18 |
| ayoung | what change did you make to paste? | 22:19 |
| nkinder | yes, all 5000. I have a seaprate wsgi config for 35357 | 22:19 |
| nkinder | ayoung: one sec... | 22:19 |
| nkinder | ayoung: http://paste.openstack.org/show/118268/ | 22:21 |
| nkinder | ayoung: this approach seems fine, though debugging to figure out the 404 sucked | 22:21 |
| nkinder | ayoung: the same would need to be done for "admin" too, but I'm just focusing on "main" | 22:22 |
| *** andreaf has joined #openstack-keystone | 22:23 | |
| ayoung | nkinder, BTW< I'm going to recommend that we stop generateing UUIDs for the service IDS, and instead use human readable, standard strings | 22:24 |
| *** rwsu has quit IRC | 22:24 | |
| ayoung | there is no benefit, and some harm, to generating a different service ID on each install | 22:24 |
| ayoung | now keystone here is not keystone there....and so forth | 22:25 |
| ayoung | [Fri Oct 03 22:28:32.076429 2014] [core:emerg] [pid 6167] (28)No space left on device: AH00023: Couldn't create the mpm-accept mutex | 22:29 |
| ayoung | AHHHH! | 22:29 |
| *** gyee has joined #openstack-keystone | 22:29 | |
| *** zzzeek has quit IRC | 22:30 | |
| *** _1_joseito has joined #openstack-keystone | 22:31 | |
| _1_joseito | hola | 22:31 |
| *** ayoung is now known as ayoung-dad-mode | 22:32 | |
| *** _1_joseito has quit IRC | 22:32 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:33 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 22:33 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:34 | |
| *** richm has joined #openstack-keystone | 22:38 | |
| *** richm has quit IRC | 22:39 | |
| remote_morgan_ | ayoung-dad-mode: I'm thinking the best bet is service "name" == service id | 22:42 |
| *** thedodd has quit IRC | 22:43 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update 'Configuring Services' documentation https://review.openstack.org/123933 | 22:47 |
| stevemar | thanks for the review nkinder | 22:47 |
| nkinder | stevemar: sure, looking at the new patch now | 22:48 |
| nkinder | stevemar: you accidentally nuked an 's' at the end of line 113 - https://review.openstack.org/#/c/123933/2..3/doc/source/configuringservices.rst | 22:49 |
| nkinder | stevemar: fix that, and it'll get a +1 from me | 22:50 |
| stevemar | whoopsie | 22:50 |
| *** dimsum_ has joined #openstack-keystone | 22:51 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update 'Configuring Services' documentation https://review.openstack.org/123933 | 22:51 |
| *** NM has joined #openstack-keystone | 22:51 | |
| remote_morgan_ | nkinder: did you solve the 404? | 22:58 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Explicit complaint about old OpenSSL when testing https://review.openstack.org/123619 | 22:58 |
| nkinder | remote_morgan_: yep. paste config needed to be updated | 23:00 |
| *** amcrn has quit IRC | 23:00 | |
| ayoung-dad-mode | remote_morgan_, me too | 23:04 |
| ayoung-dad-mode | but im not really here | 23:04 |
| nkinder | ayoung-dad-mode: python-keystoneclient-kerberos seems to require git (though it doesn't have a "requires" for it) | 23:08 |
| nkinder | ayoung-dad-mode: even after installing it, I get the typical pbr blow-up | 23:08 |
| ayoung-dad-mode | nkinder, um, nah | 23:08 |
| ayoung-dad-mode | nkinder, OK, I'll take a look later this weekend | 23:09 |
| ayoung-dad-mode | nah->bah | 23:09 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 23:10 | |
| nkinder | ayoung-dad-mode: yeah, for later - http://paste.openstack.org/show/118286/ | 23:10 |
| remote_morgan_ | nkinder: ah ok | 23:11 |
| *** r-daneel has quit IRC | 23:56 | |
| *** cjellick has quit IRC | 23:56 | |
| *** cjellick has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!