| *** gokrokve has quit IRC | 00:03 | |
| *** david-lyle has joined #openstack-keystone | 00:11 | |
| *** _cjones_ has quit IRC | 00:12 | |
| *** _cjones_ has joined #openstack-keystone | 00:13 | |
| *** _cjones_ has quit IRC | 00:14 | |
| *** _cjones_ has joined #openstack-keystone | 00:14 | |
| *** david-lyle has quit IRC | 00:17 | |
| *** gyee has quit IRC | 00:27 | |
| *** ChanServ sets mode: -o morganfainberg | 00:28 | |
| *** gokrokve has joined #openstack-keystone | 00:39 | |
| *** gokrokve has quit IRC | 00:40 | |
| *** gokrokve has joined #openstack-keystone | 00:47 | |
| *** ncoghlan has joined #openstack-keystone | 00:56 | |
| *** dims has quit IRC | 00:57 | |
| *** dims has joined #openstack-keystone | 00:57 | |
| *** dims has quit IRC | 01:02 | |
| *** _cjones_ has quit IRC | 01:04 | |
| *** _cjones_ has joined #openstack-keystone | 01:04 | |
| *** ayoung-afk is now known as ayoung | 01:07 | |
| *** _cjones_ has quit IRC | 01:09 | |
| *** r-daneel has quit IRC | 01:10 | |
| ayoung | nkinder, I'm so close on Kerberos I can smell it | 01:23 |
|---|---|---|
| *** oomichi has joined #openstack-keystone | 01:23 | |
| ayoung | I think I have an S4U2 Config issue...I'm getting a 401 when Horizon talks to Keystone | 01:23 |
| nkinder | do you smell what the ayoung is cookin? :) | 01:23 |
| ayoung | nkinder, I posted the code anyway...unit tests pass, and I had it working before... | 01:24 |
| nkinder | 401's are a pain to troubleshoot. It would be really nice to have some policy/auth related debug logging | 01:24 |
| ayoung | https://review.openstack.org/#/c/115463/ | 01:24 |
| ayoung | nkinder, I think I have the S4u2 messd up | 01:24 |
| ayoung | nkinder, http://paste.openstack.org/show/119197/ | 01:25 |
| ayoung | so there are 3 hosts: and I know that 2 of them have working in the past | 01:25 |
| ayoung | HTTP/horizon.cloudlab.freeipa.org@IPA.CLOUDLAB.FREEIPA.ORG is the one I added with your ldif change earlier | 01:26 |
| *** gokrokve_ has joined #openstack-keystone | 01:26 | |
| *** dimsum_ has joined #openstack-keystone | 01:26 | |
| *** toddnni has quit IRC | 01:26 | |
| ayoung | ok...I'm iun rpdb in Horizon | 01:29 |
| *** toddnni has joined #openstack-keystone | 01:29 | |
| *** gokrokve has quit IRC | 01:29 | |
| ayoung | print request dumps the env vars | 01:29 |
| ayoung | 'REMOTE_USER': 'ayoung' | 01:29 |
| ayoung | 'KRB5CCNAME': 'FILE:/run/httpd/krbcache/krb5cc_apache_vSxygc' | 01:29 |
| ayoung | nkinder, is there anything that should show constrained delegation? | 01:29 |
| *** gokrokve_ has quit IRC | 01:30 | |
| *** marcoemorais has quit IRC | 01:31 | |
| ayoung | http://paste.openstack.org/show/119203/ nkinder that looks like S4U2 failed, right? | 01:31 |
| nkinder | ayoung: anything of interest in the kdc log? | 01:32 |
| ayoung | ah...good idea | 01:32 |
| ayoung | let me confirm my apache conf first | 01:32 |
| ayoung | nkinder, http://paste.openstack.org/show/119205/ this is a devstack, so that is in: /etc/httpd/conf.d/horizon.conf | 01:33 |
| ayoung | KrbConstrainedDelegation on | 01:33 |
| ayoung | and I saw that Kerberos worked....ok, lets look on the kdc | 01:34 |
| ayoung | nkinder, I can't tell http://paste.openstack.org/show/119206/ | 01:35 |
| ayoung | but that last line looks like it should be | 01:36 |
| ayoung | ayoung@IPA.CLOUDLAB.FREEIPA.ORG for host/ipa.cloudlab.freeipa.org@IPA.CLOUDLAB.FREEIPA.ORG looks like a delegated ticket to me | 01:36 |
| ayoung | I have an s4 test not with horizon on another server, lets see what that generates | 01:37 |
| nkinder | ayoung: Those are the current kdc logs that get output when you try to use S4U? | 01:38 |
| nkinder | I'm not sure why it would use the host/fqdn service | 01:39 |
| ayoung | yeah...at least, it was the end of the log. I just tried from a different server and got this: | 01:39 |
| ayoung | http://paste.openstack.org/show/119207/ nkinder | 01:39 |
| nkinder | That looks more like it. It's the HTTP service. | 01:39 |
| ayoung | yeah.... | 01:40 |
| ayoung | that was using a shell test I had | 01:40 |
| ayoung | let me move the shell test to the horizon server. | 01:42 |
| *** andreaf has quit IRC | 01:57 | |
| *** andreaf has joined #openstack-keystone | 01:58 | |
| nkinder | I'm having a heck of a time setting up an admin domain when trying to use the domain specific backend feature | 01:58 |
| ayoung | http://horizon.cloudlab.freeipa.org/s4u2test/shell nkinder | 02:00 |
| ayoung | that works when I get rid of the horizon setup | 02:01 |
| ayoung | nkinder, "admin" domain meaning default domain? | 02:01 |
| nkinder | ayoung: I need to set up DNS for your lab stuff | 02:01 |
| ayoung | its just a bunch of host entries | 02:01 |
| nkinder | ayoung: I'm trying to switch over to the v3cloud policy file | 02:01 |
| ayoung | 10.16.18.225 horizon.cloudlab.freeipa.org | 02:02 |
| nkinder | ayoung: So I create an 'admin_domain' with a 'cloud_user' who has 'admin' on the domain | 02:02 |
| ayoung | nkinder, the domain name is admin_domain? | 02:02 |
| nkinder | ayoung: I then update the v3policy cloud_admin rule to specify the domain id of my 'admin_domain' | 02:02 |
| nkinder | yep | 02:02 |
| nkinder | and using the openstack CLI can't find the user and gives a 401 | 02:03 |
| nkinder | curl lets me get a domain scoped token though... interesting | 02:03 |
| ayoung | startby using the SERVICE_TOKEN | 02:03 |
| ayoung | that bypasses all the rules etc | 02:03 |
| ayoung | make sure that the user has the right role assignments | 02:04 |
| ayoung | curl works... | 02:04 |
| ayoung | OK, so Curl lets you get a domain scoped token as the admin user. nkinder did you try to do a GET on /v3/users/<id> with that token? | 02:05 |
| nkinder | ayoung: the token has no roles in it, which is strange | 02:05 |
| nkinder | let me double check my assignment | 02:05 |
| ayoung | sounds like an unscoped token | 02:06 |
| ayoung | http://adam.younglogic.com/2013/09/keystone-v3-api-examples/ | 02:06 |
| nkinder | ayoung: check it - http://paste.openstack.org/show/119214/ | 02:09 |
| nkinder | it's a domain scoped token | 02:09 |
| nkinder | what gives with my role not being in the token? | 02:09 |
| nkinder | this token obviously fails the 'is_admin' portion of the 'cloud_admin' policy rule | 02:10 |
| ayoung | no it is unscoped | 02:10 |
| ayoung | no service catalog | 02:10 |
| ayoung | where is this domain stored | 02:10 |
| ayoung | are you explicitly requesting a scoped token? | 02:11 |
| nkinder | ayoung: but the token has {"domain": {"id": "60a548e4a98a40dca78b768db5bc53de", "name": "admin_domain"} in it | 02:11 |
| *** dimsum_ has quit IRC | 02:11 | |
| ayoung | that is the user domain | 02:11 |
| nkinder | ayoung: let me paste the request | 02:11 |
| ayoung | nkinder, its an unscoped token: | 02:11 |
| ayoung | "user": {"domain": {"id": "60a548e4a98a40dca78b768db5bc53de", .... | 02:11 |
| *** dimsum_ has joined #openstack-keystone | 02:11 | |
| nkinder | ayoung: http://paste.openstack.org/show/119220/ | 02:12 |
| ayoung | nkinder, do we not fail out if there are no roles assigned.. | 02:12 |
| *** Guest33821 is now known as mfisch | 02:12 | |
| ayoung | that is an unscoped request | 02:12 |
| ayoung | look at my example | 02:12 |
| ayoung | http://adam.younglogic.com/2013/09/keystone-v3-api-examples/ | 02:12 |
| ayoung | see the scope portion? | 02:12 |
| ayoung | add in | 02:12 |
| *** mfisch is now known as Guest10736 | 02:13 | |
| ayoung | "scope": { | 02:13 |
| ayoung | 18 "domain" | 02:13 |
| *** dimsum_ has quit IRC | 02:15 | |
| *** arborism has quit IRC | 02:19 | |
| nkinder | ayoung: ok, that looks better | 02:19 |
| nkinder | ayoung: but, I still don't think OSC is working unless I get a domain-scoped token first | 02:19 |
| remote_morgan_ | Hmm that sounds a little odd | 02:22 |
| ayoung | nkinder, I didn't have keystoneclient-kerberos installed on that machine.... | 02:24 |
| ayoung | nkinder, I'll look in a bit...I'm too close to get off track | 02:24 |
| nkinder | remote_morgan_: I'll see what's being sent from the client. I was trying with --os-domain-name instead of --os-project-name | 02:25 |
| remote_morgan_ | Why | 02:25 |
| remote_morgan_ | Wrk | 02:25 |
| remote_morgan_ | Ack! Autocorrect. | 02:25 |
| remote_morgan_ | Ahh even. | 02:25 |
| nkinder | Perhaps it's an OSC bug. After getting my own domain scoped token, OSC is working well to have my cloud_admin manage other domains (including an LDAP domain) | 02:25 |
| ayoung | Exception: Versioning for this project requires either an sdist tarball, or access to an upstream git repository. Are you sure that git is installed? | 02:26 |
| ayoung | Fuck PBR | 02:26 |
| *** amerine has joined #openstack-keystone | 02:26 | |
| * ayoung probably should not curse in logs that are saved in perpetuity. | 02:26 | |
| remote_morgan_ | ayoung: maybe not. | 02:27 |
| *** zigo has quit IRC | 02:27 | |
| remote_morgan_ | But I think you'll likely be forgiven in the log run. | 02:28 |
| ayoung | remote_morgan_, but I installed PBR using pip install -e . | 02:28 |
| ayoung | er | 02:28 |
| ayoung | not PBR< but the pyuthon-keystoneclient-kerberos repo | 02:28 |
| ayoung | I have Git | 02:28 |
| remote_morgan_ | There was some weird bug with the unreleased pbr. They held back the release for some reason. | 02:28 |
| remote_morgan_ | Ah | 02:28 |
| nkinder | remote_morgan_, ayoung: I should expect this to work, right? http://paste.openstack.org/show/119224/ | 02:29 |
| *** zigo has joined #openstack-keystone | 02:29 | |
| ayoung | nkinder, can you post a successful token request from curl so I can compare? | 02:29 |
| ayoung | http://paste.openstack.org/show/119220/ worked? | 02:30 |
| ayoung | ah, but that is unscoped | 02:30 |
| ayoung | nkinder, --os-domain-name admin_domain might just be the users domain name, and you are not requesting a scoped token | 02:30 |
| ayoung | nkinder, this is what remote_morgan_ was ranting against...oh back at the midcycle in January IIRC. | 02:31 |
| nkinder | hmm, that might be it (though it should find the user in that case and just give a 403 if I try to do somthing) | 02:31 |
| ayoung | domain is overloaded | 02:31 |
| ayoung | so we need a way to specify domain for assignments separate from domain for identity | 02:31 |
| ayoung | With the v3, you need to specify the users domain, almost certain that is what --os-domain-name is doing | 02:32 |
| ayoung | no, you need a scoped token to list or get users | 02:32 |
| nkinder | I think I need to use --os-default-domain | 02:32 |
| ayoung | again, I think that is the identity domain | 02:32 |
| ayoung | is there any switch for project domain or so? | 02:33 |
| ayoung | let me see if I have a semi functional osc | 02:33 |
| nkinder | ayoung: got it working | 02:34 |
| nkinder | ayoung, remote_morgan_: http://paste.openstack.org/show/119225/ | 02:34 |
| nkinder | --os-user-domain-name is the key | 02:34 |
| nkinder | otherwise it looks the user up in the default domain | 02:34 |
| ayoung | yep | 02:35 |
| *** diegows has quit IRC | 02:35 | |
| nkinder | ayoung: so here's something interesting... | 02:40 |
| nkinder | If I want to use OSC to grant 'admin' to a user from a domain, I must do it by the id of the user (not name) | 02:41 |
| nkinder | Not a big deal, but a way to specify the user by name and the domain name to look in for the user would be nice | 02:41 |
| ayoung | nkinder, closer....I hacked out PBR and now I can use the keystoneclient to get a token, but not Horizon yet | 02:43 |
| ayoung | nkinder, yeah, that is a pain | 02:43 |
| ayoung | the whole "use names" approach to make Keystone friendly needs to be hacked in everywhere | 02:43 |
| ayoung | with Federation its tricky, though | 02:44 |
| ayoung | you won't know the username | 02:44 |
| ayoung | the id comes from the IdP, and that and the domain_id get hashed. All that is stored in the mapping table is the original user_id, not the username | 02:44 |
| nkinder | ayoung: even more painful is that I can't use 'user show' to show a user form a specific domain | 02:44 |
| ayoung | yep | 02:45 |
| nkinder | ayoung: I can do a 'user list --domain ipa', and that works | 02:45 |
| nkinder | but 'user show --domain ipa admin' is not possible | 02:45 |
| ayoung | welcome to the world of Federation. Everything you know is broken | 02:45 |
| nkinder | --domain isn't a valid option | 02:45 |
| nkinder | which borks me from an automation standpoint | 02:45 |
| ayoung | you need to know the userids a-priori | 02:45 |
| nkinder | I want to look up the user id with 'user show --domain ipa admin -f value -c id', then use that id to create an assignment | 02:45 |
| ayoung | we need a service which is like: If I were to give you user X in domain D what would his id be? | 02:46 |
| ayoung | or her | 02:46 |
| nkinder | 'user show' should take --domain to match the way 'user list' works. That's just an oversight | 02:46 |
| nkinder | I'll file a bug and propose a patch fo rit | 02:46 |
| ayoung | ++ | 02:47 |
| *** ncoghlan is now known as ncoghlan_afk | 02:50 | |
| ayoung | nkinder, OK, I think I know the next problem. | 03:00 |
| ayoung | WSGIDaemonProcess horizon user=ayoung | 03:00 |
| ayoung | guessing that horizon can't read the CCACHE written by apache | 03:00 |
| ayoung | this other one worked | 03:01 |
| ayoung | WSGIDaemonProcess s4u2 user=apache group=apache maximum-requests=10000 | 03:01 |
| ayoung | lets see if horizon will let me change that value... | 03:01 |
| *** toddnni has quit IRC | 03:05 | |
| *** toddnni has joined #openstack-keystone | 03:06 | |
| ayoung | nkinder, OK, how do I pass on the credentials from apache to the unix user ayoung that is running Horizon? | 03:07 |
| *** ncoghlan_afk is now known as ncoghlan | 03:10 | |
| ayoung | nkinder, OK, so the problem I am having is that devstack is running Horizon as ayoung, but I log in to httpd which is running as apache, and the credentials cache is not readable by ayoung | 03:15 |
| nkinder | doh | 03:17 |
| nkinder | so they need to be the same user | 03:17 |
| ayoung | nkinder, or we need to be able to set permissions on them | 03:18 |
| ayoung | IPA does the same user | 03:18 |
| ayoung | nkinder, do you have a clean packstack? What does that do? | 03:18 |
| ayoung | its the WSGIDaemonProcess directive | 03:19 |
| ayoung | if it does not specify a user then I think it continues to run as the parent | 03:19 |
| *** ncoghlan is now known as ncoghlan_afk | 03:20 | |
| *** dguitarbite has quit IRC | 03:36 | |
| *** cjellick has quit IRC | 03:39 | |
| *** cjellick has joined #openstack-keystone | 03:40 | |
| *** cjellick has quit IRC | 03:40 | |
| *** ayoung is now known as ayoung-zz | 03:45 | |
| *** jamielennox has quit IRC | 03:55 | |
| *** ncoghlan_afk is now known as ncoghlan | 03:55 | |
| *** jamielennox has joined #openstack-keystone | 04:02 | |
| *** gokrokve has joined #openstack-keystone | 04:28 | |
| *** lhcheng has quit IRC | 04:33 | |
| *** fifieldt_ has quit IRC | 04:42 | |
| *** gokrokve has quit IRC | 04:44 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:08 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:18 | |
| *** lhcheng has joined #openstack-keystone | 05:22 | |
| *** harlowja is now known as harlowja_away | 05:26 | |
| *** lhcheng has quit IRC | 05:26 | |
| *** lhcheng has joined #openstack-keystone | 05:27 | |
| stevemar | nkinder, ping? | 05:31 |
| *** ajayaa has joined #openstack-keystone | 05:34 | |
| *** oomichi has quit IRC | 06:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/124950 | 06:05 |
| *** thiagop has quit IRC | 06:06 | |
| *** thiagop has joined #openstack-keystone | 06:06 | |
| *** ukalifon has joined #openstack-keystone | 06:13 | |
| *** henrynash has joined #openstack-keystone | 06:15 | |
| *** henrynash has quit IRC | 06:19 | |
| *** stevemar has quit IRC | 06:29 | |
| *** lufix has joined #openstack-keystone | 06:36 | |
| *** dguitarbite has joined #openstack-keystone | 06:42 | |
| *** dimsum_ has joined #openstack-keystone | 06:50 | |
| *** henrynash has joined #openstack-keystone | 06:51 | |
| *** dimsum_ has quit IRC | 06:56 | |
| openstackgerrit | Marcos FermÃn Lobo proposed a change to openstack/keystone: Implement group related methods for LDAP backend https://review.openstack.org/102244 | 06:59 |
| *** andreaf has quit IRC | 06:59 | |
| *** fifieldt has joined #openstack-keystone | 07:22 | |
| *** marekd|away is now known as marekd | 07:39 | |
| *** jistr has joined #openstack-keystone | 07:46 | |
| *** amcrn has joined #openstack-keystone | 07:53 | |
| *** lhcheng has quit IRC | 07:58 | |
| *** ncoghlan has quit IRC | 08:05 | |
| *** openstackgerrit has quit IRC | 08:11 | |
| *** nellysmitt has joined #openstack-keystone | 08:25 | |
| *** ajayaa has quit IRC | 08:35 | |
| *** ajayaa has joined #openstack-keystone | 08:49 | |
| *** jaosorior has joined #openstack-keystone | 08:50 | |
| *** aix has joined #openstack-keystone | 08:52 | |
| *** aix has quit IRC | 09:00 | |
| *** aix has joined #openstack-keystone | 09:01 | |
| *** ajayaa has quit IRC | 09:06 | |
| *** ajayaa has joined #openstack-keystone | 09:08 | |
| *** afaranha has quit IRC | 09:13 | |
| *** samuelmz has quit IRC | 09:13 | |
| *** raildo-zzz has quit IRC | 09:13 | |
| *** htruta has quit IRC | 09:14 | |
| *** thiagop has quit IRC | 09:14 | |
| *** tellesnobrega has quit IRC | 09:14 | |
| *** oomichi_ has joined #openstack-keystone | 09:16 | |
| *** amcrn has quit IRC | 09:26 | |
| *** afazekas has joined #openstack-keystone | 09:32 | |
| *** andreaf_ is now known as andreaf | 09:32 | |
| *** Tahmina has joined #openstack-keystone | 09:38 | |
| *** aix has quit IRC | 09:38 | |
| *** Dafna has joined #openstack-keystone | 09:40 | |
| *** gabriel-bezerra has quit IRC | 09:43 | |
| *** openstackgerrit has joined #openstack-keystone | 09:47 | |
| *** aix has joined #openstack-keystone | 09:52 | |
| *** swamireddy has joined #openstack-keystone | 10:06 | |
| *** dimsum_ has joined #openstack-keystone | 10:29 | |
| *** dimsum_ has quit IRC | 10:35 | |
| *** swamireddy1 has joined #openstack-keystone | 10:47 | |
| *** swamireddy has quit IRC | 10:54 | |
| *** dhellmann has quit IRC | 10:54 | |
| *** Guest10736 has quit IRC | 10:54 | |
| *** dhellmann has joined #openstack-keystone | 10:58 | |
| *** dimsum_ has joined #openstack-keystone | 11:00 | |
| *** Guest10736 has joined #openstack-keystone | 11:06 | |
| *** amakarov_away is now known as amakarov | 11:17 | |
| *** jistr has quit IRC | 11:32 | |
| *** diegows has joined #openstack-keystone | 11:32 | |
| *** diegows has quit IRC | 11:35 | |
| *** diegows has joined #openstack-keystone | 11:36 | |
| *** nidonato has joined #openstack-keystone | 11:42 | |
| *** nidonato has left #openstack-keystone | 11:43 | |
| *** jistr has joined #openstack-keystone | 11:52 | |
| *** jistr is now known as jistr|english | 11:54 | |
| *** tellesnobrega has joined #openstack-keystone | 11:55 | |
| *** topol has joined #openstack-keystone | 12:02 | |
| *** afaranha has joined #openstack-keystone | 12:06 | |
| *** topol has quit IRC | 12:14 | |
| *** bknudson has joined #openstack-keystone | 12:14 | |
| *** dimsum_ has quit IRC | 12:29 | |
| *** dimsum_ has joined #openstack-keystone | 12:29 | |
| *** dims_ has joined #openstack-keystone | 12:30 | |
| *** dims_ has quit IRC | 12:32 | |
| *** dimsum_ has quit IRC | 12:33 | |
| *** dimsum_ has joined #openstack-keystone | 12:33 | |
| *** achampion has quit IRC | 12:37 | |
| *** Tahmina has quit IRC | 12:38 | |
| *** swamireddy has joined #openstack-keystone | 12:47 | |
| *** swamireddy1 has quit IRC | 12:48 | |
| *** openstackgerrit has joined #openstack-keystone | 12:48 | |
| *** radez_g0n3 is now known as radez | 12:59 | |
| *** jistr|english is now known as jistr | 13:07 | |
| *** miqui has joined #openstack-keystone | 13:09 | |
| *** thiagop has joined #openstack-keystone | 13:15 | |
| *** gordc has joined #openstack-keystone | 13:15 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/identity-api: API documentation for Hierarchical Multitenancy https://review.openstack.org/111355 | 13:21 |
| *** r-daneel has joined #openstack-keystone | 13:23 | |
| swamireddy | Hi | 13:24 |
| swamireddy | With latest devstack - I am getting an error with ¨keystone-manage db_sync¨ | 13:24 |
| *** NM has joined #openstack-keystone | 13:24 | |
| swamireddy | and filed bug on the same - https://bugs.launchpad.net/keystone/+bug/1378270 | 13:25 |
| uvirtbot | Launchpad bug 1378270 in keystone "keystone-manage db_sync command failed" [Undecided,Incomplete] | 13:25 |
| swamireddy | is this known issue? | 13:25 |
| swamireddy | dolphm: Iam using the six 1.8.0 and tried with six V 1.7.0, but still the problem persists | 13:27 |
| dolphm | swamireddy: is it a brand new devstack build? | 13:29 |
| swamireddy | dolphm: No...I was old one and working till today...before noon, I added a few services like ceilometer and swift etc..and tried with ./unstack.sh;./stack.sh | 13:31 |
| *** gokrokve has joined #openstack-keystone | 13:35 | |
| *** Kui has quit IRC | 13:38 | |
| *** raildo has joined #openstack-keystone | 13:40 | |
| *** joesavak has joined #openstack-keystone | 13:41 | |
| *** topol has joined #openstack-keystone | 13:42 | |
| *** vhoward has left #openstack-keystone | 13:44 | |
| *** samuelmz has joined #openstack-keystone | 13:45 | |
| *** TemporalBeing has joined #openstack-keystone | 13:45 | |
| *** oomichi_ has quit IRC | 13:46 | |
| dolphm | swamireddy: i have to guess that something in the install of one of those services produced a conflict with keystone's dependencies... neither a fresh devstack nor a stand-alone keystone install exhibit the issue, and i can't really reproduce an "old" devstack install | 13:46 |
| *** victsou is now known as vsilva | 13:52 | |
| *** gokrokve has quit IRC | 13:53 | |
| *** andreaf is now known as andreaf_ | 13:57 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Improve list role assignments filters performance https://review.openstack.org/116682 | 13:58 |
| rodrigods | ^ | 13:58 |
| rodrigods | enforcing: for the brave ones =) | 13:58 |
| rodrigods | dolphm, when you have a moment (or morganfainberg ), could you rebase our branch again? The KVS removal will impact some patches =) | 14:04 |
| *** ayoung has joined #openstack-keystone | 14:06 | |
| *** radez is now known as radez_g0n3 | 14:08 | |
| *** htruta has joined #openstack-keystone | 14:09 | |
| swamireddy | dolphm: Will try the stack.sh on a new VM and update the status. | 14:10 |
| *** mewald1 has joined #openstack-keystone | 14:11 | |
| *** stevemar has joined #openstack-keystone | 14:12 | |
| mewald1 | what exactly is the KVS backend? does it store permanently or just in memory? what are advantages compared to others? | 14:12 |
| morganfainberg | mewald1, KVS is a key-value-store, the old KVS systems are in-memory dictionary based only | 14:13 |
| morganfainberg | mewald1, the newer one (used mostly for token persistence in some cases, e.g. memcached) can use multiple backends | 14:13 |
| morganfainberg | mewald1, via dogpile.cach | 14:14 |
| morganfainberg | e | 14:14 |
| tellesnobrega | ayoung, hey, i'm working with rodrigods and vsilva on the token revocation bug. You guys talked yesterday and from what I saw, we first need to make the connection between domains and idps, implement the revoke by domain id and than we can solve the bug | 14:16 |
| tellesnobrega | is that right? | 14:16 |
| ayoung | tellesnobrega, that is about it | 14:16 |
| ayoung | and I think it might be impossible, but, hey, get at it\ | 14:16 |
| *** vsilva is now known as victsou | 14:16 | |
| ayoung | tellesnobrega, heh | 14:16 |
| ayoung | I think we should probably normalize the rules | 14:16 |
| *** victsou is now known as vsilva | 14:18 | |
| tellesnobrega | ayoung, which part is impossible? connecting domains to idp? | 14:18 |
| ayoung | yeah. please prove me wrong | 14:18 |
| tellesnobrega | we will try | 14:18 |
| ayoung | tellesnobrega, I think right now all we can do is evaluate the rules | 14:18 |
| ayoung | er...well, you know, use the rules to evalue an assertion | 14:19 |
| *** radez_g0n3 is now known as radez | 14:19 | |
| rodrigods | ayoung, tellesnobrega, vsilva maybe we can find another path? besides using the idp domain? | 14:20 |
| rodrigods | when I scope a token, after sending a SAML assertion, is the IdP info lost forever? =( | 14:20 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 14:21 |
| morganfainberg | lbragstad, woot | 14:22 |
| *** ajayaa has quit IRC | 14:22 | |
| lbragstad | morganfainberg: I pushed a corresponding patch to tempest | 14:22 |
| vsilva | Aren't domains many to one in this context, anyway? How would we retrieve the IdP given the domain? ayoung rodrigods tellesnobrega | 14:22 |
| morganfainberg | yay | 14:22 |
| lbragstad | morganfainberg: not *entirely* sure if I'm on the right track but... https://review.openstack.org/#/c/126564/ | 14:22 |
| lbragstad | we had some 345 tests fail w/o the tempest patch | 14:23 |
| morganfainberg | lbragstad, right. mtreinish gave you feedback on the tempest patch | 14:23 |
| morganfainberg | lbragstad, you're roughly on the right path, but should be easier with the config :) | 14:23 |
| morganfainberg | less change for now. | 14:24 |
| lbragstad | morganfainberg: perfect, yeah that will work | 14:24 |
| tellesnobrega | ayoung, when you say normalize the rules, what do you mean? | 14:27 |
| *** swamireddy has quit IRC | 14:30 | |
| *** gokrokve has joined #openstack-keystone | 14:32 | |
| ayoung | nkinder, S4U2Proxy for Horizon works. | 14:35 |
| ayoung | tellesnobrega, do you have a federated setup handy? | 14:36 |
| tellesnobrega | i don't. I'm not sure if rodrigods has one | 14:39 |
| tellesnobrega | he has been working with federation longer than I, I'm just lending him a helping hand on this problem | 14:41 |
| tellesnobrega | we don't have it running, but rodrigods said that it is not a problem to have one soon | 14:47 |
| *** amdl has joined #openstack-keystone | 14:48 | |
| amdl | hello all, I have a working OpenStack cluster, however, I was just wondering how you guys manage this stuff in production? I've got puppet managing the software, but do you use LDAP for keystone? | 14:49 |
| amdl | I can't think how to roll this out, as it were | 14:49 |
| stevemar | morganfainberg, what's the deal with the design summit topics this time around? are we leaving them open? is it up to the PTL to decide a broad topic for the session? are all projects doing it this way? cc dolphm | 14:50 |
| mewald1 | morganfainberg: I thought KVS is one backend and memcache is another. You make is sound like memcache is a KVS backend!? | 14:51 |
| morganfainberg | stevemar, the etherpad is where all the discussion and determination is going. we'll be using that instead of the summit. site | 14:51 |
| morganfainberg | mewald1, memcache is a key-value-store backend for tokens. it's just using a slightly different configuration. it's the advantage to using dogpile.cache. You can even use redis if you would like. | 14:52 |
| morganfainberg | mewald1, there is also a mongo db driver that uses the same basic kvs interface. | 14:52 |
| lbragstad | morganfainberg: there will still be slots on the summit site for scheduling purposes, correct? | 14:52 |
| morganfainberg | mewald1, in Kilo the old KVS drivers are all going away. Meaning, only Token (and I think revoke extension) will have a "KVS" backend, but it will be the new-kvs dogpile based one. | 14:53 |
| morganfainberg | lbragstad, not sure. | 14:53 |
| nkinder | ayoung: cool! Was it just a permissions problem you were running into last night? | 14:53 |
| mewald1 | morganfainberg: so KVS is an interface that can have multiple implementations like mongodb or dogpile. Memcache is another backend with it's own driver - did I get it straight now? | 14:53 |
| morganfainberg | lbragstad, but in short the etherpad is where this is all being discussed as of now. i'm sure i'll need to convert that over to the schedule | 14:54 |
| morganfainberg | mewald1, dogpile is the library with the interface (get, set, delete, get_multi, set_multi, delete_multi), and there are multuple drivers/backends for it: Memcached, Redis, MongoDB, in-memory | 14:55 |
| morganfainberg | mewald1, the token memcache persistence driver just makes some smart(ish) desicions on configuring dogpile for you. | 14:55 |
| morganfainberg | mewald1, so it still uses dogpile, but is more friendly to deployers that used the old (pre-icehouse) token driver. | 14:55 |
| mewald1 | morganfainberg: but icehouse users still have dogpile / KVS and memcache? | 14:56 |
| morganfainberg | mewald1, icehouse and juno still provide roughly the same way to configure token memcache driver. | 14:57 |
| ayoung | nkinder, yes, it was. | 14:57 |
| ayoung | I am now running apache as the ayoung user and it works | 14:57 |
| morganfainberg | mewald1, the plain kvs backend for tokens should only be used for testing. | 14:57 |
| morganfainberg | mewald1, plain kvs = in-memory dictionary based | 14:58 |
| ayoung | tellesnobrega, ok, so look at the rules format in the api docs and you'll see: | 14:58 |
| ayoung | ... | 14:58 |
| mewald1 | morganfainberg: ok thank for explaining | 14:58 |
| morganfainberg | mewald1, they all use a common library to achieve the key-value-store mechanism, you shouldn't need to worry unless you're configuring something that is not memcached or the in-memory store | 14:58 |
| morganfainberg | mewald1, sure. | 14:58 |
| ayoung | nkinder, I'll try and get a new RPM built for DOA | 14:59 |
| ayoung | and I'll hunt down the answer to the PBR issue. | 14:59 |
| morganfainberg | mewald1, the common library is dogpile.cache, there is a section on configuring it in our docs iirc. | 14:59 |
| mewald1 | I have one more question: in the token/backend folder I found rules.py - what kind of a backend is that? | 15:00 |
| ayoung | topol, can I get you top marshall the troops to do some code reviews for consuming the Kerberos stuff? Django Openstack auth stuff | 15:00 |
| *** thedodd has joined #openstack-keystone | 15:00 | |
| morganfainberg | mewald1, i don't see that https://github.com/openstack/keystone/tree/master/keystone/token/backends here | 15:00 |
| mewald1 | morganfainberg: sorry my bad: its policy | 15:01 |
| morganfainberg | mewald1, ah, | 15:01 |
| morganfainberg | mewald1, policy is a bit weird. it handles two things. | 15:01 |
| morganfainberg | mewald1, it handles the policy for keystone and serving policy files out to other services (not currently really used) | 15:01 |
| morganfainberg | so policy backend in keystone is a little odd compared to the other parts. | 15:02 |
| morganfainberg | rules is a basic impl that ignores the "serving policy files to other services" part, but implementes the needed methods for keystone's API enforcement | 15:03 |
| *** jaosorior has quit IRC | 15:03 | |
| *** vsilva is now known as victsou | 15:04 | |
| mewald1 | morganfainberg: where does rules.py store the policies then? or is SQL the only actual backend? | 15:05 |
| tellesnobrega | i found this rules here | 15:05 |
| tellesnobrega | http://docs.openstack.org/api/openstack-identity-service/3/content/map-identities-to-their-own-groups.html | 15:05 |
| morganfainberg | for keystone, it works like the rest of the projects it loads from the policy.json | 15:05 |
| tellesnobrega | what do you mean by normalize them | 15:05 |
| *** victsou is now known as vsilva | 15:06 | |
| *** joesavak has quit IRC | 15:06 | |
| *** vsilva has quit IRC | 15:06 | |
| *** victsou has joined #openstack-keystone | 15:07 | |
| mewald1 | morganfainberg: ok and for all the others it fetches them from sql, right? | 15:07 |
| *** victsou is now known as vsilva | 15:07 | |
| morganfainberg | mewald1, *if* the services store their policies in keystone. No service supports fetching from keystone, so largely you can (for now) assume that interface (the CRUD interface for policy) is not used | 15:08 |
| *** jamielennox has quit IRC | 15:08 | |
| mewald1 | yeah ok - I still wanted to understand the concept | 15:08 |
| *** joesavak has joined #openstack-keystone | 15:10 | |
| bknudson | I've got some questions about using memcache to store tokens... | 15:15 |
| bknudson | it looks like if memcache fails to store the token, that failure is ignored | 15:15 |
| *** vsilva is now known as victsou | 15:18 | |
| *** thedodd has quit IRC | 15:18 | |
| *** bdossant has joined #openstack-keystone | 15:19 | |
| bknudson | but then if we fail to store the token, we still update the user list | 15:22 |
| mewald1 | morganfainberg: are the any documents that compare the different backends and give support for decision making? | 15:22 |
| *** thedodd has joined #openstack-keystone | 15:22 | |
| bknudson | and if the user list update fails then the operation fails | 15:22 |
| bknudson | seems like if memcache returns False because it didn't store the token then the new token operation should fail and the user list shouldn't be updated. | 15:23 |
| mewald1 | morganfainberg: for example: it seems obvious to me that when I scale-out keystone (multiple instances) I wouldn't want a non-shared token cache - things like this | 15:24 |
| ayoung | nkinder, BTW, I saw the project switch was broken On Horizon. Nothing to do with Kerberos, turns out we really need to have the right endpoint urls in the Keystone service catalog. Basically, we need to force Keystone V3 for the service catalog | 15:26 |
| morganfainberg | mewald1, to be honest, i recommend the SQL token driver for production deployments | 15:30 |
| boris-42 | bknudson morganfainberg guys hi there | 15:30 |
| morganfainberg | mewald1, the memcache driver is a poor choice because it is assuming memcache is a good "stable" storage for data, memcache is *not* | 15:30 |
| boris-42 | ayoung hi | 15:30 |
| ayoung | he | 15:30 |
| boris-42 | ayoung morganfainberg bknudson guys you have some performance regression | 15:30 |
| ayoung | hey | 15:30 |
| ayoung | almost certainly | 15:30 |
| boris-42 | compare this | 15:31 |
| boris-42 | http://logs.openstack.org/39/110039/1/check/check-rally-dsvm-keystone/dc46ce6/rally-plot/results.html.gz | 15:31 |
| ayoung | boris-42, it comes with age | 15:31 |
| ayoung | oh, you mean Keystone | 15:31 |
| boris-42 | with this | 15:31 |
| ayoung | nevermind | 15:31 |
| boris-42 | http://logs.openstack.org/03/110803/3/check/gate-rally-dsvm-keystone/a0d41b5/rally-plot/results.html.gz | 15:31 |
| boris-42 | ayoung ya Keystone | 15:31 |
| bknudson | ayoung: there's pills for that now. | 15:31 |
| morganfainberg | bknudson, ++ | 15:31 |
| ayoung | I can't Rally like I used to | 15:31 |
| bknudson | I've seen the ads. | 15:31 |
| boris-42 | ayoung bknudson so are you interested?) or not?) | 15:32 |
| morganfainberg | boris-42, isolated runs != trend. some nodes will be slower | 15:32 |
| ayoung | boris-42, do we care | 15:32 |
| dolphm | lbragstad: did you deactivate your second LP account? | 15:32 |
| mewald1 | morganfainberg: ok, SQL seems to be the obvious choice: shared location, stable/reliable storage and can be used for any other keystone and OpenStack service | 15:32 |
| boris-42 | morganfainberg ayoung guys let me collect more graphs | 15:32 |
| bknudson | boris-42: how do we find out what commit caused it? | 15:32 |
| ayoung | create user is not critical path. Foremost concern is the token pipeline | 15:32 |
| morganfainberg | ayoung, ++ | 15:32 |
| boris-42 | bknudson I will just try to find by hands =0 | 15:32 |
| ayoung | its an interesting piece of info, but not actionable, I think | 15:32 |
| boris-42 | ayoung we can test other functional as well | 15:33 |
| *** k4n0 has quit IRC | 15:33 | |
| morganfainberg | boris-42, issue token, validate token would be much better | 15:33 |
| boris-42 | ayoung it's not a big deal | 15:33 |
| ayoung | boris-42, the one that I've heard people complain about is list user | 15:33 |
| ayoung | as that can kill Horizon | 15:33 |
| morganfainberg | boris-42, but i think more importantly finding a way to trend this vs. isolated tests is going to be the bigger win. | 15:34 |
| boris-42 | morganfainberg heh we have lab in Mirantis for that | 15:34 |
| morganfainberg | boris-42, because you having to hunt for graphs or commits by hand is not really sustainable long term :) | 15:34 |
| boris-42 | morganfainberg actually lemme show you something | 15:34 |
| boris-42 | morganfainberg we have this section https://github.com/stackforge/rally/blob/master/rally-scenarios/rally.yaml#L11-L12 | 15:34 |
| morganfainberg | you have better things to do i'm sure! :) [and we'd like to not have to ask you to do it each time if it's something we can consume :) ] | 15:34 |
| boris-42 | morganfainberg so you can add regression testing | 15:35 |
| boris-42 | morganfainberg like if it take in avg more then 5 second in that tests, rally job will fail | 15:35 |
| boris-42 | morganfainberg so basically we can add more benchmarks in keystone gates | 15:35 |
| boris-42 | morganfainberg and add these SLA checks | 15:35 |
| boris-42 | morganfainberg so you won't need to check by hands graphs | 15:35 |
| boris-42 | morganfainberg just if rally job start failing | 15:36 |
| morganfainberg | sure. that isn't the same as trending though, so we can see the progression of improvement / degredation. | 15:36 |
| boris-42 | morganfainberg ya but it at least allows to make regression tests | 15:36 |
| boris-42 | morganfainberg it's not so simple to make trend testing especially in gates | 15:36 |
| morganfainberg | boris-42, it's def. useful, but it may not be the source it could just indicate the final straw | 15:36 |
| boris-42 | morganfainberg yep sure, but at least you'll get it | 15:37 |
| boris-42 | morganfainberg now you even don't now that there is regression | 15:37 |
| boris-42 | morganfainberg and it happend | 15:37 |
| *** zzzeek has joined #openstack-keystone | 15:37 | |
| morganfainberg | boris-42, honestly, i never look at the rally results. | 15:37 |
| boris-42 | morganfainberg that's sad | 15:37 |
| boris-42 | =) | 15:37 |
| morganfainberg | boris-42, because they're in isolation | 15:37 |
| boris-42 | morganfainberg what do you mean by isolation?) | 15:38 |
| nkinder | ayoung: speaking of horizon and V3, does Horizon work with Keystone domains? | 15:38 |
| boris-42 | morganfainberg I would be more then happy to help you guys start using it.. | 15:38 |
| boris-42 | morganfainberg I just don't know how=) | 15:38 |
| nkinder | ayoung: ...or is it only using v2 and is forced to use the default domain? | 15:39 |
| morganfainberg | boris-42, i look at raly results and unless i look at every result, i can't know if there is a real change. | 15:39 |
| ayoung | nkinder, it works with V3 if set up correctly | 15:39 |
| boris-42 | morganfainberg we can setup a job in such way | 15:39 |
| ayoung | nkinder, needs 3 changes | 15:39 |
| ayoung | 1: change the auth url | 15:39 |
| boris-42 | morganfainberg that if it passed it means no big regression | 15:39 |
| boris-42 | morganfainberg if it failed you'll find what failed | 15:39 |
| ayoung | 2: change the setting the starts wit h MULTI to allow multiple domains | 15:39 |
| morganfainberg | boris-42, this is a case where external CI might be useful, something that runs rally and extracts the data and graphs it. | 15:39 |
| bknudson | I'm just not seeing how it's safe or normal to have tokens only stored in memcache | 15:39 |
| ayoung | 3: set the identity api version to 3: | 15:39 |
| morganfainberg | boris-42, rather than running rally in the local gate in isolation. | 15:39 |
| boris-42 | morganfainberg I don't have hardware=) | 15:39 |
| ayoung | nkinder, in my config file these settings are | 15:40 |
| nkinder | ayoung: interesting. Will try that today | 15:40 |
| morganfainberg | boris-42, but you see my point right? I'm not saying there isn't value to rally, far from it. | 15:40 |
| bknudson | Looks like memcache is supposed to speed up database queries by caching | 15:40 |
| bknudson | not replace the db altogether | 15:40 |
| ayoung | nkinder, | 15:40 |
| ayoung | OPENSTACK_API_VERSIONS = {"identity": 3} | 15:40 |
| ayoung | OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True | 15:40 |
| morganfainberg | boris-42, i'm just looking for how we can get it there and be more useful | 15:40 |
| ayoung | #OPENSTACK_KEYSTONE_URL="https://ayoungf20packstack.cloudlab.freeipa.org/keystone/main/v3" | 15:40 |
| ayoung | er...last one is commented out cuz I'm using a kerberized URL | 15:40 |
| boris-42 | morganfainberg so you can at least start using it =) | 15:40 |
| ayoung | OPENSTACK_KEYSTONE_URL="https://ayoungf20packstack.cloudlab.freeipa.org/keystone/krb/v3" | 15:40 |
| ayoung | ^^ works too | 15:41 |
| morganfainberg | bknudson, absolutely correct. if people didnt already have a "memcache" persistence backend that we need to maintain, i'd have removed it a while ago | 15:41 |
| boris-42 | morganfainberg cause it's already very useful, it's just not everything | 15:41 |
| boris-42 | morganfainberg like trends | 15:41 |
| *** mewald1 has left #openstack-keystone | 15:41 | |
| boris-42 | morganfainberg but you can test your patches, that they don't affect performance, and put regression criteria | 15:41 |
| nkinder | ayoung: so does Horizon have a dialog where you select the domain then (or a box where you type it in)? | 15:41 |
| bknudson | morganfainberg: so you don't think the memcache persistence backend is production ready? | 15:41 |
| boris-42 | morganfainberg that will be much better then nothing | 15:41 |
| bknudson | morganfainberg: because people are trying to use it in production. | 15:42 |
| morganfainberg | boris-42, again, unless i look at *every* result i don't know what it's telling me except that either 1) that rally run was run on a slow node, or 2) somewhere we got slower over time... if i can remember each and every patch. | 15:42 |
| morganfainberg | bknudson, it has never been production quality. memcache is not a stable store. but removing it would break those people who have accepted that and use it anyway | 15:42 |
| bknudson | morganfainberg: and there's other people telling me that they can't use the sql backend. | 15:42 |
| *** jamielennox has joined #openstack-keystone | 15:43 | |
| morganfainberg | bknudson, i think this is part of the summit conversation we're going to need to have on authz (tokens etc) | 15:43 |
| morganfainberg | bknudson, i don't have a good answer today :( | 15:44 |
| boris-42 | morganfainberg with reasonable "avg" duration | 15:44 |
| morganfainberg | bknudson, it is something i want us to have a direction on though this cycle if we can. | 15:44 |
| boris-42 | morganfainberg criterias you won't get often failures cause of slow nodes | 15:45 |
| ayoung | memcache is OK for production with UUID tokens only | 15:45 |
| ayoung | with PKI, you need persisted revocations | 15:45 |
| morganfainberg | ayoung, sortof. | 15:45 |
| morganfainberg | ayoung, if you use more than 1 memcache server, no guarantees (if one fails) you'll have continuing authorization and 2) maximum numbers of active tokens per user (high, but i've seen those limits hit by active clouds/users). | 15:46 |
| morganfainberg | ayoung, it's "passible" for some environments. | 15:46 |
| ayoung | morganfainberg, you might have false negatives ,but not false positives...although there might be some lag in revocations | 15:46 |
| morganfainberg | ayoung, sure - likely a lot of false negatives (well not so false since the tokens don't exist) | 15:47 |
| morganfainberg | unexpected negatives? | 15:47 |
| *** ukalifon has quit IRC | 15:47 | |
| ayoung | morganfainberg, false in that they existing in some memcache server, just not the one your endpoint is talking to? | 15:47 |
| morganfainberg | ayoung, dpeends on the failure. it could be that the memcache server died.. those tokens are gone, no longer existing. or the user | 15:48 |
| boris-42 | morganfainberg so any chance guys to get you involved in performance stuff? | 15:48 |
| morganfainberg | s indexes could go away | 15:48 |
| ayoung | yep | 15:48 |
| boris-42 | morganfainberg or until everything will be automated you won't be interested? | 15:48 |
| morganfainberg | ayoung, meaning you would in theory have tokens that aren't revoked (deleteD) for password changes, trust changes, etc | 15:49 |
| ayoung | ooh | 15:49 |
| morganfainberg | ayoung, i'd counter memcache isn't really "production" ready in any cases | 15:49 |
| ayoung | morganfainberg, eventual semantics do not make a good authorization system | 15:49 |
| bknudson | ayoung: we're trying to use it in production and it's not working. | 15:50 |
| morganfainberg | boris-42, i'm not opposed ot rally as is, i just can't keep all of the data in my head and it's painful to hunt through to find the source of a slowness. | 15:50 |
| ayoung | bknudson, blame termie | 15:50 |
| boris-42 | morganfainberg what about just working for example with me | 15:50 |
| morganfainberg | boris-42, so, we can improve it as is, yes. we should look at how we approach this overall and make it better :) | 15:50 |
| boris-42 | morganfainberg to create reasonable regression stuff | 15:50 |
| boris-42 | morganfainberg so you won't need to keep all in mind | 15:50 |
| morganfainberg | boris-42, sure - but to be clear, i don't want rally to ever be a voting job. | 15:51 |
| boris-42 | morganfainberg if some function start working 2 times slower call juob will fail | 15:51 |
| boris-42 | morganfainberg it's not about voting job | 15:51 |
| morganfainberg | boris-42, not unless it grows a lot of smarts. | 15:51 |
| boris-42 | morganfainberg it's about +1/-1 | 15:51 |
| boris-42 | morganfainberg lemme show you | 15:51 |
| boris-42 | morganfainberg I will make small patch | 15:51 |
| *** bdossant has quit IRC | 15:51 | |
| boris-42 | morganfainberg btw could you take a look at this https://review.openstack.org/#/c/98836/ since Jun 9... | 15:52 |
| morganfainberg | boris-42, like i said we can improve it, just letting you know it needs continued thought on moving forward before it becomes a lot more valueable. let me be clear i'm not saying "no" or "i don | 15:52 |
| morganfainberg | t like it" :) | 15:52 |
| boris-42 | morganfainberg ^ that patch is about making it better | 15:52 |
| boris-42 | morganfainberg it allows to write rally plugins in tree of keystone | 15:52 |
| morganfainberg | right | 15:52 |
| boris-42 | morganfainberg it will be nice to get it in=) | 15:53 |
| morganfainberg | ok give me a few i need to get breakfast before the IRC meeting and i'm at a hotel today so, need to do things like checkout | 15:54 |
| openstackgerrit | Boris Pavlovic proposed a change to openstack/keystone: Add SLA check to create-and-delete-user benchmark https://review.openstack.org/126605 | 15:55 |
| morganfainberg | boris-42, i'll look at that later today, but it should be good (the plugins one) doesn't look wierd or doing something strange | 15:55 |
| boris-42 | morganfainberg so this make job +1/-1 https://review.openstack.org/#/c/126605/1/rally-scenarios/keystone.yaml | 15:56 |
| boris-42 | morganfainberg if avg duration of any of create-delete will > 2 sec it will fail | 15:56 |
| boris-42 | morganfainberg you'll see) | 15:56 |
| boris-42 | morganfainberg need to go home be back later | 15:56 |
| stevemar | nkinder, ping | 15:58 |
| nkinder | stevemar: about to jump into a scrum meeting. I'll get back to you in about 15, cool? | 15:58 |
| dolphm | lbragstad: what version of terminal-notifier are you using? | 15:58 |
| nkinder | stevemar: in the process of rebuilding a set up to try your patch... | 15:58 |
| *** lufix has quit IRC | 15:59 | |
| stevemar | nkinder, you already answered by question, take your time :P | 15:59 |
| lbragstad | dolphm: stable 1.6.1 | 15:59 |
| dolphm | lbragstad: i can't recreate https://github.com/dolph/gerrit-growler/issues/1 | 16:00 |
| dolphm | lbragstad: i can workaround it though, thanks to gerrit's redirects | 16:00 |
| *** afazekas has quit IRC | 16:03 | |
| *** lhcheng has joined #openstack-keystone | 16:05 | |
| lbragstad | dolphm: that works | 16:07 |
| lbragstad | dolphm: thanks for fixing! | 16:07 |
| lbragstad | dolphm: mind making a simple comment here to test? https://review.openstack.org/#/c/110803/ | 16:08 |
| *** gyee has joined #openstack-keystone | 16:08 | |
| *** lhcheng has quit IRC | 16:09 | |
| *** lhcheng has joined #openstack-keystone | 16:09 | |
| dolphm | lbragstad: done | 16:13 |
| lbragstad | dolphm: sweet, I'll let you know what gg does | 16:13 |
| ayoung | So Boston to Vancouver is either 7:30 flight time or 48 houirse driving. ROAD TRIP! | 16:13 |
| dolphm | lbragstad: need to eliminate that delay - i think it might be client-side | 16:13 |
| dolphm | lbragstad: the bulk of it, anyway | 16:13 |
| lbragstad | dolphm: but it varies on location, right? | 16:14 |
| *** samuelmz has quit IRC | 16:14 | |
| dolphm | lbragstad: yeah, it's instant from my cloud server | 16:14 |
| lbragstad | dolphm: but not from your laptop? | 16:15 |
| dolphm | lbragstad: correct | 16:15 |
| lbragstad | interesting... | 16:15 |
| dolphm | lbragstad: it's currently about 30 seconds to my laptop at castle | 16:16 |
| dolphm | lbragstad: also, i'm at castle and food trucks | 16:16 |
| lbragstad | dolphm: 30 seconds from gerrit to gg? | 16:16 |
| dolphm | lbragstad: yes | 16:16 |
| dstanek | food trucks! | 16:16 |
| dolphm | lbragstad: i think i fixed it | 16:16 |
| lbragstad | dolphm: that's better than before, isn't is? | 16:17 |
| dolphm | lbragstad: it's a fraction of a second now | 16:17 |
| lbragstad | sweet | 16:17 |
| *** lhcheng has quit IRC | 16:18 | |
| *** lhcheng has joined #openstack-keystone | 16:19 | |
| dolphm | lbragstad: pull the latest gerrit-growler ( cc dstanek ) | 16:19 |
| *** _cjones_ has joined #openstack-keystone | 16:21 | |
| *** lhcheng_ has joined #openstack-keystone | 16:22 | |
| dolphm | lbragstad: can you recheck this? https://review.openstack.org/#/c/119654/ | 16:22 |
| *** lhcheng has quit IRC | 16:23 | |
| lbragstad | dolphm: waiting on Jenkins? | 16:24 |
| dolphm | lbragstad: my recheck already failed | 16:25 |
| *** lhcheng_ has quit IRC | 16:26 | |
| *** wwriverrat1 has joined #openstack-keystone | 16:26 | |
| *** lhcheng has joined #openstack-keystone | 16:26 | |
| *** thedodd has quit IRC | 16:27 | |
| lbragstad | woohoo! no more duplicate accounts! If anyone needs to add me to a review go ahead and use lbragstad@gmail.com | 16:27 |
| *** jistr has quit IRC | 16:29 | |
| *** marcoemorais has joined #openstack-keystone | 16:29 | |
| *** lhcheng has quit IRC | 16:31 | |
| raildo | lbragstad, do you had some problem with commit due this duplicate account? Some days ago, i was not able to commit due a similar problem | 16:33 |
| lbragstad | raildo: somehow I had two accounts tied to the same email, which I didn't think was possible | 16:34 |
| *** thedodd has joined #openstack-keystone | 16:36 | |
| *** mewald has joined #openstack-keystone | 16:37 | |
| mewald | do public_endpoint and admin_endpoint refer to the the operations listed in section 2 and 3 respectively? http://docs.openstack.org/api/openstack-identity-service/2.0/content/Overview-Identity-API-d1e62.html | 16:39 |
| *** wwriverrat1 has left #openstack-keystone | 16:39 | |
| *** lhcheng has joined #openstack-keystone | 16:42 | |
| *** lhcheng has quit IRC | 16:42 | |
| *** wwriverrat has joined #openstack-keystone | 16:43 | |
| *** zigo has quit IRC | 16:43 | |
| rodrigods | lbragstad, yeah, and gerrit raises an error when we try to add you as reviewer. maybe the folks from openstack-infra can fix that for you | 16:43 |
| *** wwriverrat has left #openstack-keystone | 16:43 | |
| *** gokrokve has quit IRC | 16:45 | |
| *** gokrokve has joined #openstack-keystone | 16:45 | |
| *** gokrokve has quit IRC | 16:45 | |
| *** zigo has joined #openstack-keystone | 16:46 | |
| *** lhcheng has joined #openstack-keystone | 16:49 | |
| *** lhcheng has quit IRC | 16:50 | |
| *** lhcheng has joined #openstack-keystone | 16:51 | |
| raildo | henrynash, I answered a comment on this patch, I was wondering if it was clear to you https://review.openstack.org/#/c/111355/ | 16:52 |
| *** NM has quit IRC | 16:55 | |
| *** lhcheng has quit IRC | 16:55 | |
| *** harlowja_away is now known as harlowja | 16:58 | |
| *** lhcheng has joined #openstack-keystone | 16:59 | |
| *** _cjones_ has quit IRC | 17:05 | |
| *** _cjones_ has joined #openstack-keystone | 17:05 | |
| *** NM has joined #openstack-keystone | 17:06 | |
| *** _cjones_ has quit IRC | 17:10 | |
| *** jsavak has joined #openstack-keystone | 17:10 | |
| stevemar | dolphm, test comment | 17:11 |
| mewald | do public_endpoint and admin_endpoint refer to the the operations listed in section 2 and 3 respectively? http://docs.openstack.org/api/openstack-identity-service/2.0/content/Overview-Identity-API-d1e62.html | 17:12 |
| *** richm has joined #openstack-keystone | 17:12 | |
| marekd | stevemar: o/ does openstack has some auto mechanisms when the response is HTTP 404 ? | 17:12 |
| marekd | openstackclient | 17:12 |
| *** lufix has joined #openstack-keystone | 17:14 | |
| marekd | stevemar: strange thing i noticed today: openstack mapping show idontexist does actually two calls: https://keystone:5000/v3/OS-FEDERATION/mappings/idontexist , the server returns HTP 404 and after that there is another call /v3/OS-FEDERATION/mappings?name=idontexist which lists all the mappings. | 17:14 |
| *** joesavak has quit IRC | 17:14 | |
| stevemar | marekd, yes, it tries a few different ways... | 17:15 |
| *** amcrn has joined #openstack-keystone | 17:15 | |
| *** _cjones_ has joined #openstack-keystone | 17:16 | |
| stevemar | it tries a GET call first, then a find call | 17:16 |
| *** lhcheng has quit IRC | 17:16 | |
| marekd | stevemar: it's osc, not keystoneclient, right? | 17:16 |
| stevemar | marekd, correct | 17:16 |
| marekd | stevemar: how can i disable it? | 17:16 |
| *** lhcheng has joined #openstack-keystone | 17:17 | |
| *** thedodd has quit IRC | 17:17 | |
| marekd | we end up in a situation where mapping doesn't exist. Server returns all the mappings and OSC gets crazy as list of objects is returned. | 17:17 |
| *** andreaf has joined #openstack-keystone | 17:17 | |
| stevemar | marekd, instead of a using utils.find_resource you can just call the client | 17:19 |
| marekd | stevemar: good advice ++ | 17:20 |
| marekd | i will do that. | 17:20 |
| marekd | stevemar: thanks. | 17:20 |
| stevemar | marekd, http://paste.openstack.org/show/119427/ | 17:21 |
| morganfainberg | hm. | 17:21 |
| *** lhcheng has quit IRC | 17:22 | |
| marekd | stevemar: yeah, i figured. | 17:22 |
| *** lufix has quit IRC | 17:23 | |
| rodrigods | henrynash, there? have a question about the error that should be returned in case of circular references | 17:27 |
| *** lhcheng has joined #openstack-keystone | 17:29 | |
| morganfainberg | rodrigods, raildo, wanted to talk to you guys about the multitenency and if we need a summit session on it. (what would the goal be of said sessions) - it looks like there is some data someone added to the etherpad re: hierarchy | 17:29 |
| *** lhcheng has quit IRC | 17:30 | |
| morganfainberg | rodrigods, how would you end up with circular references? | 17:30 |
| *** lhcheng has joined #openstack-keystone | 17:30 | |
| rodrigods | morganfainberg, actually, currently is not possible to have circular references, since we do not allow the update from the parent_id | 17:31 |
| morganfainberg | rodrigods, that was my understanding | 17:31 |
| morganfainberg | rodrigods, cool | 17:31 |
| rodrigods | morganfainberg, but I think that would be a nice check at methods that goes through the hierarchy. to avoid future problems | 17:31 |
| *** lhcheng_ has joined #openstack-keystone | 17:32 | |
| rodrigods | morganfainberg, following a suggestion from henrynash | 17:32 |
| morganfainberg | rodrigods, i'd rather not have an explicit circular ref check that is never used implemented | 17:32 |
| morganfainberg | if we know it is not currently possible, do we need to run what is known to be a no-op? | 17:33 |
| rodrigods | morganfainberg, maybe we can add a test called "check_circular_references" that would break now because we can't update the parent_id, but would be updated later? | 17:34 |
| morganfainberg | if there is legitimate value, i'm open to it, but if it just adds overhead today, lets make sure we *can* implement it down the line if we support moving projects to new parents | 17:34 |
| morganfainberg | rodrigods, i just don't want to run any expensive check we don't need to on all creates etc. | 17:34 |
| raildo | morganfainberg, yes, we suggest a summit session because we have to discuss some points about a more complex way of removing projects, we can recursively delete, or should we delete a project in the middle of the hierarchy and change the parent of the projects below it? the another thing is about update a project in the middle of the hierarchy. How we can do this, we have to invalidate the tokens, we have to change the roles, and other things. | 17:34 |
| raildo | In addition, we are implementing in Hierarchical Projects in Horizon | 17:35 |
| *** lhcheng has quit IRC | 17:35 | |
| raildo | and the Nova folks are implementing hierarchical quotas based in our implemention | 17:35 |
| raildo | So, I believe it would be interesting a session to discuss these features | 17:36 |
| morganfainberg | raildo, sure. just trying to get the topics lined up, if this doesn't end up as a session are you ok with it being handled on the "meetup" day on Friday? | 17:36 |
| *** lhcheng_ has quit IRC | 17:36 | |
| mewald | can somebody know what the credential entity is used for? Weird stuff like fingerprint authentication? :D | 17:37 |
| morganfainberg | raildo, not saying it wont end up as a session. right now we have good availability on slots, but I'm making sure I know where these things line up. | 17:37 |
| rodrigods | morganfainberg, makes sense, will add a comment in the patch with your concerns | 17:37 |
| morganfainberg | rodrigods, cool. thanks :) | 17:37 |
| morganfainberg | raildo, ah, yeah the deletion bit might require some talking through. | 17:38 |
| raildo | morganfainberg, I understand. I suggested that session as a cross projects, due to changes in other projects besides Keystone. | 17:38 |
| lbragstad | rodrigods: yeah, I think they have it straightened out now | 17:38 |
| morganfainberg | raildo, ++ | 17:38 |
| rodrigods | lbragstad, ++ | 17:39 |
| morganfainberg | raildo, lets see where it all lines up. will def. keep it as a possibility for a session. | 17:39 |
| rodrigods | morganfainberg, btw, can you ff our branch? would be nice to have the KVS removal updates | 17:39 |
| raildo | morganfainberg, ok, thank you :) | 17:40 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/126631 | 17:40 |
| morganfainberg | rodrigods, hm, need to see how to do that again. if it's FF-only i think i need to ask -infra to do it | 17:40 |
| rodrigods | morganfainberg, maybe ff won't work because the patch from dolphm | 17:41 |
| rodrigods | that was a "manual" ff | 17:41 |
| rodrigods | I think | 17:41 |
| morganfainberg | rodrigods, yeah not sure. will work on that once we're past the IRC meeting. | 17:41 |
| rodrigods | morganfainberg, thanks =) | 17:42 |
| *** harlowja_ has joined #openstack-keystone | 17:42 | |
| *** harlowja has quit IRC | 17:42 | |
| ayoung | morganfainberg, I'm in dreaming mode: what if we made an utility for generating policy.json file from a data model. It would be a nice little stand along project. | 17:44 |
| ayoung | like an intern/senior thesis type thing | 17:44 |
| morganfainberg | ayoung, haha knew that was where this came from :) | 17:45 |
| ayoung | stand alone | 17:45 |
| ayoung | morganfainberg, I'm trying to get a good list of them | 17:45 |
| ayoung | for things we need | 17:45 |
| ayoung | "I'm interested in Keystone" "Good....go build me one of these....:" | 17:45 |
| morganfainberg | ayoung, that might be very interesting, something that is easier to write (limited types of policy/roles -> acttions) language that parses to the hard-to-read-and-write policy.json | 17:45 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/identity-api: API documentation for Hierarchical Multitenancy https://review.openstack.org/111355 | 17:46 |
| ayoung | morganfainberg, yeah, and dchadwick and dolphm both think that something like a roles hierarchy should be done on the policy side, not on the keystone server...which means we'll need a better mechanism | 17:46 |
| morganfainberg | ayoung, yeah | 17:47 |
| rodrigods | ayoung, morganfainberg, those kind of projects would fit really well in a google summer of code | 17:47 |
| ayoung | rodrigods, or for people's senior thesis projects | 17:48 |
| rodrigods | ayoung, like your final undergrad project? | 17:51 |
| morganfainberg | rodrigods, possibly | 17:51 |
| ayoung | rodrigods, well, hopefull not like "mine" as that never got finished. Never did find a working Ada environment | 17:51 |
| morganfainberg | haha | 17:51 |
| *** cjellick has joined #openstack-keystone | 17:51 | |
| ayoung | morganfainberg, Its not my fault they swiched from HP to Sun workstations between Cow and Firstie year. | 17:52 |
| morganfainberg | lol | 17:52 |
| rodrigods | ayoung, I meant "anyone" hehe sorry | 17:52 |
| ayoung | Hey...this my "Computer Theory" and "Compilers" professor http://www.army.mil/article/72904/First_woman_promoted_to_general_within_Army_Corps_of_Engineers/ | 17:54 |
| rodrigods | lol | 17:55 |
| ayoung | no, I'm serious | 17:56 |
| ayoung | She was CPT Tubesing back then. | 17:56 |
| morganfainberg | we'll start the meeting as soon as rally finishes up | 18:00 |
| stevemar | morganfainberg, we're waiting? | 18:00 |
| morganfainberg | stevemar, hah | 18:00 |
| *** lhcheng has joined #openstack-keystone | 18:01 | |
| *** victsou is now known as vsilva | 18:03 | |
| *** jwy has joined #openstack-keystone | 18:06 | |
| *** lhcheng has quit IRC | 18:06 | |
| stevemar | nkinder, wanted to ping you before i forget, and not interrupt the meeting, do you have any of your automation scripts for setting up IPA available on github? | 18:11 |
| stevemar | nkinder, was hoping to use that as a basis for a CI job | 18:11 |
| nkinder | stevemar: yes, though some of it is using internal yum repos out of convenience | 18:11 |
| nkinder | stevemar: let me clean up some of it for you | 18:12 |
| stevemar | nkinder, whatever works, thanks | 18:12 |
| *** aix has quit IRC | 18:14 | |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 18:17 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Lost and Found https://review.openstack.org/126647 | 18:20 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone-specs: Lost and Found https://review.openstack.org/126647 | 18:22 |
| afaranha | ayoung: When is the spec deleted from the specs? When ger approved or implemented? | 18:22 |
| ayoung | afaranha, never | 18:22 |
| ayoung | it is approved and lives on in perpetuity! | 18:23 |
| afaranha | I like the idea, but I think lost-and-found is not a so intuitive name, why not divide it into Approved directory and/or Implemented? | 18:24 |
| afaranha | Lost and found is a directory that I absolutely ignore, unless I miss something | 18:25 |
| *** mewald has quit IRC | 18:25 | |
| *** swamireddy has joined #openstack-keystone | 18:25 | |
| *** thedodd has joined #openstack-keystone | 18:26 | |
| morganfainberg | ayoung, ++ | 18:26 |
| afaranha | ayoung: But I think its not something that I would -1 it | 18:26 |
| morganfainberg | forevers and evers and evers and evers and evers | 18:26 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Lost and Found https://review.openstack.org/126647 | 18:27 |
| ayoung | afaranha, its in the git repo, not posted for review in gerrit | 18:27 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs | 18:27 |
| *** david-lyle has joined #openstack-keystone | 18:32 | |
| *** amakarov is now known as amakarov_away | 18:33 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Add a parking lot section for approved specs https://review.openstack.org/126652 | 18:33 |
| openstackgerrit | A change was merged to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/124950 | 18:36 |
| *** lhcheng has joined #openstack-keystone | 18:42 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Add a parking lot section for approved specs https://review.openstack.org/126652 | 18:43 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Add a parking lot section for approved specs https://review.openstack.org/126652 | 18:43 |
| *** tqtran has joined #openstack-keystone | 18:43 | |
| *** lhcheng has quit IRC | 18:45 | |
| *** lhcheng has joined #openstack-keystone | 18:46 | |
| stevemar | lbragstad, ayoung ^ | 18:46 |
| ayoung | stevemar, WTF | 18:47 |
| ayoung | you taking over my reviews? | 18:47 |
| ayoung | heh | 18:48 |
| ayoung | stevemar, seriously, though, keep the review id the same | 18:48 |
| stevemar | ayoung, i was actually posting the changes to index.html, kept you as co-author since it was the same content in the readme | 18:48 |
| ayoung | stevemar, that is completely fine with me | 18:48 |
| ayoung | but lets not have multiple reviews out there | 18:49 |
| stevemar | ayoung, where you have it now, won't pass jenkins, the tests expect the files in there to be only specs | 18:49 |
| ayoung | stevemar, you are on the right track...just keep the reviewid. I'm really not that picky, just don't want to have dead review floating around | 18:50 |
| *** lhcheng has quit IRC | 18:50 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Add a parking lot section for approved specs https://review.openstack.org/126652 | 18:52 |
| *** gokrokve has joined #openstack-keystone | 18:52 | |
| stevemar | ayoung, alright, i changed the change-id to match yours, but i don't think that did much :\ | 18:53 |
| stevemar | oh did you want me to patch over your change set? | 18:54 |
| ayoung | stevemar, yes, please | 18:54 |
| stevemar | ah okay | 18:54 |
| *** swamireddy has quit IRC | 18:54 | |
| *** vsilva is now known as victsou | 18:55 | |
| nkinder | morganfainberg: are there any outstanding RC bugs? | 18:57 |
| morganfainberg | nkinder, not that i'm aware of | 18:57 |
| nkinder | morganfainberg: cool | 18:57 |
| rodrigods | morganfainberg, just to remember about the HM rebase or ff =) | 18:57 |
| morganfainberg | rodrigods, right. | 18:57 |
| *** victsou is now known as vsilva | 18:57 | |
| morganfainberg | need to see how to do that. | 18:57 |
| *** raildo is now known as raildo_away | 18:58 | |
| nkinder | stevemar: I came to the same conclusion as you when looking into the 'user show' issue last night | 18:58 |
| *** packet has joined #openstack-keystone | 18:58 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Lost and Found https://review.openstack.org/126647 | 18:59 |
| nkinder | stevemar: we don't have a good way in the API to do a show on a user by name since there is no way to specify the domain to look in | 18:59 |
| ayoung | https://launchpad.net/keystone/+milestone/juno-rc1 | 18:59 |
| *** ayoung is now known as ayoung-mtg | 18:59 | |
| nkinder | stevemar: enumerating all of the users just to find the ID sucks | 18:59 |
| rodrigods | morganfainberg, once i saw a script by dolphm that is for this cases, i think | 18:59 |
| stevemar | nkinder, yeah, it's not an obvious problem with keystone server at first glance | 18:59 |
| nkinder | stevemar: it would work, but it's not going to be fun for large domains | 18:59 |
| stevemar | definitely not | 19:00 |
| nkinder | we would need the API to allow the domain to be specified | 19:00 |
| morganfainberg | rodrigods, https://review.openstack.org/126662 | 19:00 |
| nkinder | otherwise OSC has to hack around it | 19:00 |
| morganfainberg | dolphm, https://review.openstack.org/126662 i *think* moves the feature branch forward. | 19:01 |
| dstanek | morganfainberg: that's a merge though - doesn't it need to be a FF? | 19:01 |
| morganfainberg | dstanek, can't do FF on that branch | 19:01 |
| dstanek | morganfainberg: did it diverge from master? | 19:02 |
| morganfainberg | yeah | 19:02 |
| rodrigods | morganfainberg, yay! \o/ | 19:02 |
| morganfainberg | and if it is FF only i need infra to forward the branch | 19:02 |
| morganfainberg | i can't FF-only it. | 19:02 |
| dstanek | morganfainberg: so what happens now? when the HM stuff is close enough to being merged does it get proposed on master? | 19:03 |
| morganfainberg | dstanek, i think we merge across to master? i dunno | 19:04 |
| morganfainberg | dolphm, ?^ | 19:04 |
| *** thedodd has quit IRC | 19:06 | |
| rodrigods | the first review is really close to be ready, I think: https://review.openstack.org/#/c/117784/ | 19:07 |
| rodrigods | (btw) | 19:07 |
| rodrigods | already implemented the tests henrynash proposed, just waiting to rebase with morganfainberg review | 19:08 |
| *** thedodd has joined #openstack-keystone | 19:08 | |
| dstanek | rodrigods: is there any tests that show what happens when not specifying the parent_id? | 19:09 |
| rodrigods | dstanek, i think that is the "regular" create | 19:11 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/126674 | 19:12 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/126631 | 19:12 |
| rodrigods | rodrigods, for example, the last test does not specifies: https://review.openstack.org/#/c/117786/17/keystone/tests/test_backend.py | 19:12 |
| rodrigods | dstanek, ^ | 19:13 |
| dolphm | morganfainberg: i don't know how to tell you if it's right or wrong... i only know how to run my script to update the branch myself lol | 19:14 |
| dolphm | morganfainberg: let me see if i come up with the same commit sha | 19:14 |
| morganfainberg | dolphm, hehe | 19:14 |
| morganfainberg | ok | 19:14 |
| morganfainberg | probably wont because it | 19:14 |
| morganfainberg | ll have your commiter info | 19:15 |
| dstanek | rodrigods: ah ok, i'll take a look - when reading the lists of tests classes i didn't see anyone for that usecase | 19:15 |
| rodrigods | dstanek, would be nice to have a "create_project_without_parent" test like this one: https://github.com/openstack/keystone/blob/master/keystone/tests/test_backend.py#L1731 ? | 19:16 |
| dolphm | morganfainberg: oh, boo | 19:17 |
| morganfainberg | dolphm, http://paste.openstack.org/show/119464/ | 19:17 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/126679 | 19:17 |
| morganfainberg | dolphm, that was the merge output | 19:17 |
| dolphm | morganfainberg: yep | 19:17 |
| dolphm | morganfainberg: and then a giant list of outstanding commits? | 19:17 |
| dolphm | morganfainberg: this part freaks me out | 19:18 |
| morganfainberg | heh | 19:18 |
| morganfainberg | no outstanding commits in my output | 19:18 |
| dolphm | morganfainberg: really? | 19:18 |
| morganfainberg | but i did a clean checkout of the branch and straight merge | 19:18 |
| morganfainberg | might have been missing a flag to git | 19:18 |
| morganfainberg | that deletion list looks "right" | 19:19 |
| dolphm | morganfainberg: oh - there's a strict process outlined in the wiki | 19:19 |
| morganfainberg | dolphm, hm, i *think* i followed it. must have missed something in there | 19:19 |
| morganfainberg | dolphm, last time i did this was FF only so it broke | 19:19 |
| dolphm | morganfainberg: http://pasteraw.com/jx4536j0ij1cpdxoq2fcxh6suwuedfl | 19:19 |
| morganfainberg | lol | 19:20 |
| morganfainberg | go with yours | 19:20 |
| morganfainberg | but it looks like the same-ish output | 19:20 |
| morganfainberg | dolphm, abandoned mine, will let you push yours instead, since it looks more correct | 19:22 |
| dolphm | morganfainberg: https://review.openstack.org/#/c/126693/ | 19:24 |
| morganfainberg | hehe | 19:24 |
| morganfainberg | dolphm, provided it passes jenkins i'll approve it | 19:25 |
| morganfainberg | (no no reason it shouldn't) | 19:25 |
| morganfainberg | or you can | 19:25 |
| *** david-lyle is now known as david-lyle_afk | 19:25 | |
| rodrigods | and i rebase our patches with it =) | 19:26 |
| *** HenryG has quit IRC | 19:28 | |
| *** david-lyle_afk has quit IRC | 19:30 | |
| morganfainberg | fifieldt, ping re Operator session (e.g. the DevOps session at the ATL summit) | 19:33 |
| morganfainberg | fifieldt, looking for feedback on which format worked the best last time, so we can keep as close to that this time, since i think there was definite value to having a dedicated keystone session for that. | 19:33 |
| dolphm | morganfainberg: rodrigods: dropped my patch in favor of https://review.openstack.org/#/c/126697/ which was generated with slightly more automation | 19:34 |
| morganfainberg | dolphm, ack | 19:34 |
| rodrigods | cool | 19:35 |
| rodrigods | thanks | 19:35 |
| *** samuelmz has joined #openstack-keystone | 19:35 | |
| openstackgerrit | A change was merged to openstack/keystone: Add testcase for coverage of 002_add_endpoint_groups https://review.openstack.org/119654 | 19:36 |
| vsilva | ayoung-mtg, are you around? I looked into the rules and it seems like you're right - I don't see a way that it could give us a link between the token and its IdP. Do you have any other suggestions? | 19:38 |
| vsilva | Maybe you can check it out as well, dolphm (https://bugs.launchpad.net/keystone/+bug/1291157) | 19:38 |
| uvirtbot | Launchpad bug 1291157 in python-keystoneclient "idp deletion should trigger token revocation" [High,Triaged] | 19:38 |
| dolphm | morganfainberg: standlone script you can use https://github.com/dolph/dotfiles/blob/master/bin/git-update - i'll look for a place in infra to contribute it long term | 19:41 |
| morganfainberg | dolphm, thnx | 19:42 |
| *** raildo_away is now known as raildo | 19:44 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Add a new section that lists implemented specs for middleware https://review.openstack.org/126708 | 19:50 |
| *** vsilva is now known as victsou | 20:01 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Add a new section that lists implemented specs for middleware https://review.openstack.org/126708 | 20:03 |
| *** HenryG has joined #openstack-keystone | 20:06 | |
| openstackgerrit | Jin Liu proposed a change to openstack/python-keystoneclient: Error message not saved in Session exception https://review.openstack.org/126713 | 20:07 |
| lbragstad | stevemar: so we're not going to keep jsonutils up to date but we can't remove it? | 20:08 |
| *** harlowja_ is now known as harlowja_away | 20:09 | |
| nkinder | ayoung-mtg, morganfainberg: do you have any idea why I'm getting a 403 for this? http://paste.openstack.org/show/119479/ | 20:12 |
| nkinder | I don't see what's wrong | 20:12 |
| *** gokrokve has quit IRC | 20:13 | |
| *** gokrokve has joined #openstack-keystone | 20:14 | |
| remote_morgan_ | nkinder: nothing stands out as wrong. But honestly harder to see on a phone than laptop screen. | 20:14 |
| nkinder | remote_morgan_: yeah, that'd be a little tough... :) | 20:15 |
| remote_morgan_ | nkinder: once I get to where I can plug in my laptop I can look more closely. | 20:15 |
| remote_morgan_ | And post lunch. | 20:15 |
| nkinder | remote_morgan_: thanks! | 20:15 |
| remote_morgan_ | Sure thing. | 20:15 |
| *** david-lyle has joined #openstack-keystone | 20:15 | |
| *** lhcheng has joined #openstack-keystone | 20:17 | |
| *** gokrokve has quit IRC | 20:18 | |
| *** ayoung-mtg is now known as ayoung | 20:21 | |
| ayoung | victsou, I think we need to parse the rules | 20:21 |
| ayoung | nkinder, seriously? I would put a pdb.set_trace() at the start of the policy enforcement in keystone/common/controller.py | 20:22 |
| nkinder | ayoung: going to resort to that soon... | 20:23 |
| ayoung | pip install rpdb | 20:23 |
| ayoung | then edit the controller and | 20:23 |
| ayoung | import rpdb; rpdb.set_trace() | 20:23 |
| ayoung | hit it from the CLI etc and | 20:23 |
| nkinder | ayoung: we really need to improve the logging around policy evaluation to allow people to troubleshoot this stuff without resorting to a debugger | 20:23 |
| ayoung | telnet localhost 4444 | 20:23 |
| ayoung | nkinder, was just thinking that | 20:23 |
| nkinder | ayoung: will try that after our meeting (and will probably bug you about it) :) | 20:24 |
| ayoung | nkinder, let me see if we have enough control, though | 20:24 |
| ayoung | the policy rules are already parsed. It might require a change in oslo | 20:24 |
| ayoung | nkinder, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n152 | 20:25 |
| ayoung | nkinder, at a minimum, add | 20:25 |
| ayoung | LOG.debug( "% % % " %(creds, action, utils.flatten_dict(target)) ) | 20:26 |
| *** __TheDodd__ has joined #openstack-keystone | 20:26 | |
| *** thedodd has quit IRC | 20:30 | |
| *** lhcheng has quit IRC | 20:31 | |
| *** lhcheng has joined #openstack-keystone | 20:32 | |
| *** lhcheng has quit IRC | 20:36 | |
| *** topol has quit IRC | 20:39 | |
| bknudson | here's an interesting post: http://dormando.livejournal.com/495593.html | 20:41 |
| bknudson | about using memcache for sessions | 20:41 |
| rodrigods | bknudson, ++ | 20:54 |
| stevemar | lbragstad, if one of the other things needs it (like service or fileutils), then it'll be updated when we do an oslo-sync | 20:55 |
| stevemar | whether it's in the .conf file or not | 20:55 |
| lbragstad | stevemar: yeah, I facepalmed when I figured it out... | 20:55 |
| lbragstad | stevemar: thanks for the follow up | 20:56 |
| stevemar | lbragstad, hehe | 20:56 |
| stevemar | np | 20:56 |
| rodrigods | bknudson, how keystone currently handles it? there is a doc somewhere? | 20:57 |
| bknudson | rodrigods: I haven't been looking at the docs, the memcache.py isn't too small. | 20:58 |
| *** marcoemorais has quit IRC | 20:59 | |
| *** marcoemorais has joined #openstack-keystone | 21:00 | |
| rodrigods | bknudson, will take a look, thanks | 21:00 |
| rodrigods | bknudson, dstanek btw, any of you can +A https://review.openstack.org/#/c/120563/ ? | 21:01 |
| rodrigods | bknudson, thanks | 21:02 |
| *** tqtran is now known as tqtran_afk | 21:03 | |
| *** harlowja_away is now known as harlowja_ | 21:04 | |
| *** victsou is now known as vsilva | 21:05 | |
| *** david-lyle has quit IRC | 21:06 | |
| *** _cjones_ has quit IRC | 21:12 | |
| *** Kui has joined #openstack-keystone | 21:12 | |
| *** nellysmitt has quit IRC | 21:13 | |
| *** _cjones_ has joined #openstack-keystone | 21:13 | |
| *** richm has quit IRC | 21:13 | |
| *** packet has quit IRC | 21:24 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes docstrings to be more accurate. https://review.openstack.org/126730 | 21:25 |
| ayoung | rodrigods, looking | 21:25 |
| openstackgerrit | A change was merged to openstack/keystone: Use jsonutils from oslo.serialization https://review.openstack.org/126116 | 21:25 |
| openstackgerrit | A change was merged to openstack/keystone: Use importutils from oslo.utils https://review.openstack.org/126115 | 21:25 |
| openstackgerrit | A change was merged to openstack/keystone: Remove deprecated KVS trust backend. https://review.openstack.org/126493 | 21:27 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: WIP: Force SQLite to properly deal with foreign keys https://review.openstack.org/126030 | 21:32 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes endpoint_filter tests https://review.openstack.org/126029 | 21:32 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Remove database setup duplication https://review.openstack.org/126734 | 21:32 |
| *** jsavak has quit IRC | 21:37 | |
| *** dguitarbite has quit IRC | 21:45 | |
| *** Guest10736 is now known as mfisch | 21:45 | |
| *** mfisch is now known as Guest69465 | 21:46 | |
| *** lhcheng has joined #openstack-keystone | 21:49 | |
| *** __TheDodd__ has quit IRC | 21:55 | |
| *** thedodd has joined #openstack-keystone | 21:55 | |
| *** henrynash has quit IRC | 21:57 | |
| *** gordc has quit IRC | 22:01 | |
| rodrigods | morganfainberg, dolphm, the tests passed, will rebase =) | 22:01 |
| *** lhcheng has quit IRC | 22:05 | |
| *** lhcheng has joined #openstack-keystone | 22:06 | |
| *** henrynash has joined #openstack-keystone | 22:08 | |
| *** rkofman has quit IRC | 22:10 | |
| *** lhcheng has quit IRC | 22:11 | |
| *** rkofman has joined #openstack-keystone | 22:11 | |
| *** radez is now known as radez_g0n3 | 22:12 | |
| *** NM has quit IRC | 22:16 | |
| breton | I am lokking for some task with keystone to get started. Got any ideas? | 22:21 |
| *** gokrokve has joined #openstack-keystone | 22:24 | |
| *** thedodd has quit IRC | 22:30 | |
| *** dguitarbite has joined #openstack-keystone | 22:31 | |
| *** zzzeek has quit IRC | 22:33 | |
| *** david-lyle has joined #openstack-keystone | 22:33 | |
| nkinder | ayoung: so it turns out that target is an empty dict here for 'user list' - http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n193 | 22:34 |
| *** dimsum_ has quit IRC | 22:34 | |
| *** dimsum_ has joined #openstack-keystone | 22:34 | |
| ayoung | nkinder, I recall writing that | 22:35 |
| ayoung | I think target was flattened so we could get things out of the payload | 22:35 |
| ayoung | it was origianlly done for trusts | 22:36 |
| nkinder | ayoung: that means this won't work - http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n9 | 22:36 |
| nkinder | ayoung: with no target, there's nothing to compare against when looking for the domain_id | 22:36 |
| ayoung | user_list has neither keyword args nor query strings | 22:36 |
| ayoung | hmmm | 22:37 |
| nkinder | ayoung: so how can a domain admin list users for their domain only? | 22:37 |
| nkinder | I can show a user if I know their id | 22:37 |
| ayoung | is that logic in the controller or core.... | 22:37 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/controllers.py#n215 | 22:38 |
| ayoung | nkinder, so if you don't add anything.... | 22:38 |
| nkinder | ayoung: now 'user list' does allow you to specify a domain to filter on with '--domain' | 22:38 |
| nkinder | ayoung: the problem is, if you use that option, it attempts to do a domain list | 22:38 |
| nkinder | and only the cloud admin can do that... | 22:39 |
| *** dimsum_ has quit IRC | 22:39 | |
| ayoung | nkinder, is that an API problem or a client problem? | 22:39 |
| nkinder | I wonder if that's purely an OSC bug that it does a domain list | 22:39 |
| nkinder | :) We're thinking the same | 22:39 |
| nkinder | Let me try it with curl | 22:39 |
| ayoung | try it from Curl...suspect client there | 22:39 |
| nkinder | hah, I beat you that time | 22:39 |
| nkinder | I suspect client too | 22:39 |
| *** marcoemorais has quit IRC | 22:40 | |
| *** andreaf has quit IRC | 22:40 | |
| ayoung | nkinder, actually, that one I would try with pdb, and see what keystone client code it is calling | 22:40 |
| nkinder | ayoung: well, I know it does a domain list, as it tells me I'm not authorized for that action | 22:40 |
| ayoung | so it could be KC or OSC, suspect the latter | 22:40 |
| *** andreaf has joined #openstack-keystone | 22:40 | |
| *** henrynash has quit IRC | 22:40 | |
| nkinder | so it's pretty clear that OSC or KC does it | 22:40 |
| *** marcoemorais has joined #openstack-keystone | 22:40 | |
| ayoung | so, what rule gets applied if there is no target. | 22:41 |
| *** marcoemorais has quit IRC | 22:41 | |
| nkinder | ayoung: my guess is the client is trying to look up the domain id by name (though it does that even if I specify a domain id) | 22:42 |
| ayoung | (rule:admin_required and domain_id:%(target.token.user.domain.id)s) or rule:owner | 22:42 |
| ayoung | ah...so look, token is supposed to always be in the target | 22:42 |
| ayoung | someone broke this on me | 22:43 |
| ayoung | I knew it! | 22:43 |
| ayoung | git blame time... | 22:43 |
| ayoung | OK, we have 3 suspects | 22:44 |
| ayoung | c7a5c6cf (Henry Nash | 22:44 |
| *** alex_xu has quit IRC | 22:44 | |
| ayoung | f1f0bbc4 (Arvind Tiwari | 22:44 |
| ayoung | a8ccab37 (Morgan Fainberg | 22:44 |
| ayoung | whoa...way different | 22:44 |
| ayoung | what are awe looking at upstream | 22:44 |
| *** marcoemorais has joined #openstack-keystone | 22:45 | |
| *** marcoemorais has quit IRC | 22:45 | |
| *** marcoemorais has joined #openstack-keystone | 22:46 | |
| *** marcoemorais has quit IRC | 22:46 | |
| *** marcoemorais has joined #openstack-keystone | 22:46 | |
| ayoung | nkinder, I think it was henry | 22:48 |
| ayoung | c7a5c6cf27a80ca50db9f1a1a74e8795eeefd9d1 | 22:48 |
| ayoung | but I plus Aed it so I'd be to blame, too | 22:49 |
| ayoung | nkinder, we used to flatten the whole kwargs and pass that to the rule engine | 22:50 |
| nkinder | ayoung: this works - curl -i -H "X-Auth-Token: <token>" http://localhost:35357/v3/users?domain_id=<id> | 22:50 |
| ayoung | nkinder, but token should be in the target | 22:50 |
| ayoung | well, the token data | 22:50 |
| nkinder | do, the query param should be in the target | 22:50 |
| ayoung | target should never be empty | 22:50 |
| nkinder | s/do/no/ | 22:51 |
| ayoung | nkinder, look at the rule | 22:51 |
| ayoung | "admin_or_owner": "(rule:admin_required and domain_id:%(target.token.user.domain.id)s) or rule:owner", | 22:51 |
| nkinder | it's the query param that should be in there, not the token. The token is compared against the target. | 22:51 |
| nkinder | but this isn't admin_or_owner that protect user_list | 22:51 |
| ayoung | the query param is the first domain_id | 22:51 |
| ayoung | "identity:list_users": "rule:cloud_admin or rule:admin_and_matching_domain_id", | 22:52 |
| ayoung | "admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s", | 22:52 |
| nkinder | yes | 22:52 |
| nkinder | that's the one that is used | 22:52 |
| ayoung | that will never work if there is no param | 22:53 |
| nkinder | but OSC won't supply the domain id unless it looks it up using list_domains first | 22:53 |
| nkinder | ayoung: ok, so there are two issues | 22:53 |
| *** lhcheng has joined #openstack-keystone | 22:53 | |
| ayoung | We had that logic. Someone yanked it on me. | 22:53 |
| nkinder | a bare 'user list' will not set a domain_id | 22:53 |
| ayoung | I remember going through all this with the trust API | 22:53 |
| nkinder | ayoung: so if a domain_id wasn't set, you pull it from the token and set it as the query param? | 22:54 |
| *** marcoemorais has quit IRC | 22:57 | |
| *** marcoemorais has joined #openstack-keystone | 22:58 | |
| ayoung | nkinder, I think so, but that happends after the policy check | 22:59 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/controllers.py#n219 | 22:59 |
| openstackgerrit | A change was merged to openstack/keystone: Replace an instance of keystone/openstack/common/timeutils https://review.openstack.org/126125 | 23:00 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Extracting common code to private method https://review.openstack.org/120563 | 23:00 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n564 | 23:01 |
| ayoung | nkinder, AH HA! | 23:01 |
| ayoung | if not CONF.identity.domain_specific_drivers_enabled: | 23:01 |
| ayoung | # We don't need to specify a domain ID in this case | 23:01 |
| ayoung | return | 23:01 |
| ayoung | nkinder, this changes when you enable domain_specific drivers | 23:01 |
| nkinder | where is that? | 23:01 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n571 | 23:01 |
| *** dimsum_ has joined #openstack-keystone | 23:02 | |
| ayoung | nkinder, so...we do the policy enforcement as a decorator. Novba does not | 23:02 |
| ayoung | Nova does not | 23:02 |
| ayoung | the pattern in Nova is: lookup objects, then make explicit policy call | 23:02 |
| ayoung | that is what we need here | 23:02 |
| stevemar | ayoung, could i bug you for 2 quick reviews https://review.openstack.org/#/c/125535/ and https://review.openstack.org/#/c/124270/ | 23:03 |
| ayoung | stevemar, sure | 23:03 |
| nkinder | ayoung: I have "domain_specific_drivers_enabled = true" | 23:03 |
| ayoung | nkinder, eggs act lee | 23:03 |
| *** dimsum_ has quit IRC | 23:03 | |
| nkinder | ayoung: the problem here is that domain_id is not set in the query param by OSC | 23:03 |
| *** dimsum_ has joined #openstack-keystone | 23:04 | |
| ayoung | nkinder, ok...let me explain what we need to do: | 23:04 |
| ayoung | 1. Break the code inside the decorator out so we can call it directly | 23:04 |
| ayoung | 2. drop the decorator from list_users | 23:04 |
| morganfainberg | ayoung, we likely need to do #1 regardless | 23:04 |
| ayoung | 3. add in an explicit check policy call after the call to lookup domain from token | 23:05 |
| ayoung | 4..make sure the token data is back in the target | 23:05 |
| ayoung | morganfainberg, I think we accidentally broke all of the cloudsample token based rules way back.... | 23:05 |
| *** marcoemorais has quit IRC | 23:05 | |
| nkinder | ok, so you're saying that list_users with no domain_id in the query params should just grab the domain_id out of the token | 23:05 |
| nkinder | ayoung: no, they work (sort of) | 23:06 |
| ayoung | morganfainberg, in c7a5c6cf | 23:06 |
| ayoung | nkinder, not the rule you were looking at...the ones that explicitly reference the token | 23:06 |
| stevemar | morganfainberg, oh you're here too, excellent, can i get a review of https://review.openstack.org/#/c/125708/ | 23:06 |
| ayoung | nkinder, yep | 23:06 |
| ayoung | secrete heh | 23:08 |
| *** tqtran_afk is now known as tqtran | 23:08 | |
| *** jamielennox has quit IRC | 23:10 | |
| ayoung | stevemar, -2 on all your patches. Anything else? | 23:12 |
| ayoung | :) | 23:12 |
| stevemar | ayoung, nooooo | 23:12 |
| ayoung | stevemar, and I'm now leaving on a month PTO...see you in Paris | 23:13 |
| stevemar | oh fancy | 23:13 |
| ayoung | heh | 23:13 |
| stevemar | have fun | 23:13 |
| ayoung | stevemar, seriously, though, any more? | 23:13 |
| ayoung | stevemar, I'm not really leaving on PTO | 23:14 |
| stevemar | ayoung, i have 2 more, https://review.openstack.org/#/c/123933/ and https://review.openstack.org/#/c/126180/ | 23:14 |
| stevemar | d'oh! | 23:14 |
| stevemar | you tricked me good | 23:14 |
| *** NM has joined #openstack-keystone | 23:15 | |
| ayoung | stevemar, trick or treat smell my feet | 23:15 |
| stevemar | i'd rather give you something good to eat | 23:15 |
| ayoung | stevemar, do we really reecord token id in cadf? Please tell me that is the audit it. | 23:15 |
| ayoung | stevemar, with all of these +2As I'm handing out I feel like the candyman | 23:17 |
| nkinder | ayoung: ok, I have an OSC patch that at least allows me to use '--domain <id>' when listing users | 23:17 |
| ayoung | good | 23:17 |
| stevemar | ayoung, the token id is actually a token id, there is a reason for that | 23:17 |
| ayoung | nkinder, so the problem was in osc? | 23:17 |
| stevemar | ayoung, trying to find that reason | 23:18 |
| nkinder | ayoung: well, part of it was | 23:18 |
| ayoung | stevemar, cuz we didn't have token audit ids when we wrote the cadf impl? | 23:18 |
| nkinder | ayoung: we always attempt to look up the passed in '--domain' arg, but a domain admin typically isn't allowed to look any of that info up | 23:18 |
| nkinder | ayoung: so the fix is to try to look it up, but fall back to using the arg as a domain_id in the user_list request | 23:19 |
| nkinder | ayoung: it requires that the domain admin knows their domain ID though | 23:19 |
| nkinder | ayoung: so being able to do a bare 'user list' and have it use the domain from the token would be a nicer experience | 23:19 |
| nkinder | ayoung: I'm not sure who should be responsible for that though... | 23:20 |
| morganfainberg | stevemar, notice ayoung didn't say he wasn't -2ing your patches... just he wasn't going on PTO | 23:20 |
| ayoung | nkinder, domain_id should be in the auth_ref | 23:20 |
| ayoung | session.auth_ref...something | 23:20 |
| ayoung | morganfainberg, it pains me that we are putting token ids in the audit logs | 23:21 |
| morganfainberg | ayoung, wait we're putting token ids in what?! | 23:21 |
| stevemar | ayoung, ahhh here we go: it's the 'audit_id" | 23:21 |
| ayoung | whew | 23:21 |
| stevemar | token_audit_id = token_ref.audit_id | 23:21 |
| morganfainberg | cause i was about to go "when did this happen"? | 23:22 |
| stevemar | nah nah, we're good | 23:22 |
| ayoung | morganfainberg, https://review.openstack.org/#/c/126180/2/doc/source/event_notifications.rst,cm | 23:22 |
| ayoung | we should still call it the token_audit_id in the cadf message | 23:22 |
| morganfainberg | yes we should | 23:22 |
| morganfainberg | are we allowed to change that though? | 23:23 |
| stevemar | https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/mapped.py#L58-L66 | 23:23 |
| morganfainberg | *cough*contract*cough* | 23:23 |
| morganfainberg | maybe we just comment it is the audit id in the doc for now? | 23:23 |
| ayoung | <vader>I am altering the bargain</vader> | 23:23 |
| morganfainberg | ayoung, pray i don't alter it further | 23:23 |
| morganfainberg | ok so.. i'm going to abandon out the -2CR specs. do we have any specs that we expect to be resucitated that are just lingering (as in not updated in the last ~2mo) | 23:24 |
| morganfainberg | i'm about to send the "get your specs proposed email" but want to have a "clean-ish" slate | 23:25 |
| ayoung | morganfainberg, leave any I wrote. I will see to them myself | 23:26 |
| morganfainberg | ayoung, yours except the cookie-for-token were updated recently enough | 23:26 |
| morganfainberg | and session tokens but i know that is coming back | 23:26 |
| ayoung | are you categorically against cookie-for-token? | 23:26 |
| morganfainberg | ayoung, i think it solves the problem in the wrong way. | 23:27 |
| ayoung | session tokens....maybe | 23:27 |
| morganfainberg | ayoung, if we're going down that path we should oauth all the things. | 23:27 |
| morganfainberg | ayoung, the cookie thing that is | 23:27 |
| ayoung | you keep using that word....I do not think it means what you think it means | 23:27 |
| morganfainberg | ayoung, oauth is exactly what i mean in this case | 23:28 |
| morganfainberg | ayoung, or very very closely aligned to oauth | 23:28 |
| ayoung | oauth is not a solution....its just a different mechanism that does what keystone tokens do | 23:28 |
| ayoung | and all the same issues would still apply | 23:28 |
| morganfainberg | ayoung, yes, and it would *also* solve the token size issue | 23:28 |
| morganfainberg | which is what your cookie thing is solving. | 23:28 |
| morganfainberg | among other things e.g. no bearer tokens, locked to endpoints | 23:29 |
| morganfainberg | etc | 23:29 |
| ayoung | is that oauth 1 still or moved on to 2 to get that? | 23:29 |
| morganfainberg | ayoung, might need to be 2 vs 1.1* | 23:29 |
| morganfainberg | *1.1 being weird and broken | 23:29 |
| ayoung | shhhhhh he'll hear you | 23:30 |
| morganfainberg | hehe | 23:30 |
| morganfainberg | for now i'm against the cookie for token thing. we can revisit at the summit but i don't think that is the right approach to the problem. | 23:31 |
| ayoung | morganfainberg, I'll read up on it. As I reacll, it didn't enforce a spec for what is actually in the authorization document | 23:31 |
| morganfainberg | most cases are new tokens and if we go short-term tokens like you want the cookie is essentially useless anyway | 23:31 |
| morganfainberg | because most requests will be a new token, so no size savings, etc | 23:31 |
| ayoung | leave it un-abandondend for now. if nothing else, we can list it in the "alternatives" to the spec we actually end up selecting | 23:31 |
| morganfainberg | eh, i started abandoning already :P sorry. | 23:32 |
| morganfainberg | we can unabandon easily | 23:32 |
| ayoung | done | 23:33 |
| *** marcoemorais has joined #openstack-keystone | 23:33 | |
| *** marcoemorais has quit IRC | 23:34 | |
| *** marcoemorais has joined #openstack-keystone | 23:36 | |
| nkinder | ayoung, stevemar: https://review.openstack.org/#/c/126754/ | 23:36 |
| nkinder | stevemar: going to try your OSC patch out now | 23:36 |
| ayoung | morganfainberg, for a new request, the session approach doesn't cost us anything. Bascially, the endpoint makes the decision to save the token in memcache and returns a session id. This is really no different than if it used sessions directly, which is what most web servers do. | 23:37 |
| ayoung | I don't see a way around it. oauth is going to have the4 exact same constraints | 23:37 |
| ayoung | it kindof fundamental.... | 23:37 |
| ayoung | either I'm missing something or you are...probably both | 23:37 |
| morganfainberg | ayoung, we'll discuss this at the summit. | 23:37 |
| openstackgerrit | A change was merged to openstack/keystone-specs: Updated from global requirements https://review.openstack.org/120638 | 23:38 |
| ayoung | morganfainberg, for certain, but UI'd like to understand what the alternative is...I'll read up on oauth2 | 23:38 |
| morganfainberg | i'm sure it'll be easier to discuss the views in person. | 23:38 |
| morganfainberg | in this case :) | 23:38 |
| morganfainberg | we're defintely having the authorization session, tokens, etc | 23:39 |
| morganfainberg | oauth, or something else. what do we do and what makes the most sense. | 23:39 |
| ayoung | nkinder, we don't allow domain name on those calls? Just id? | 23:39 |
| nkinder | ayoung: nope, just id | 23:40 |
| ayoung | nkinder, hmmm, not what I remember....let me see | 23:40 |
| nkinder | ayoung: this affect lits_projects too, so a new patch is coming... | 23:40 |
| ayoung | nkinder, yep..just confirmed in the identity API docs. I think that we should expand those APIs | 23:42 |
| ayoung | projects are different, | 23:42 |
| ayoung | those are not implicitly namespaced, but if they are inside a domain....we should allow for names | 23:42 |
| ayoung | OK...I'm leaving the office and going to the gym | 23:42 |
| ayoung | bye | 23:42 |
| *** ayoung has quit IRC | 23:43 | |
| *** r-daneel has quit IRC | 23:48 | |
| *** NM has quit IRC | 23:50 | |
| *** lhcheng has quit IRC | 23:53 | |
| *** lhcheng has joined #openstack-keystone | 23:54 | |
| stevemar | nkinder, taking a looksy now | 23:57 |
| *** gokrokve has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!