| *** tellesnobrega has quit IRC | 00:05 | |
| *** marcoemorais has joined #openstack-keystone | 00:06 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Move eventlet server options to a config section https://review.openstack.org/130962 | 00:06 |
|---|---|---|
| *** marcoemorais has quit IRC | 00:07 | |
| *** marcoemorais has joined #openstack-keystone | 00:07 | |
| *** stevemar has joined #openstack-keystone | 00:13 | |
| *** stevemar is now known as notstevemar | 00:13 | |
| *** cjellick has quit IRC | 00:15 | |
| *** oomichi has joined #openstack-keystone | 00:17 | |
| *** marcoemorais has quit IRC | 00:18 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Create a seperate page for old specs https://review.openstack.org/130379 | 00:29 |
| *** marcoemorais has joined #openstack-keystone | 00:32 | |
| *** amcrn has quit IRC | 00:33 | |
| *** ayoung-dadmode is now known as ayoung | 00:33 | |
| *** marcoemorais has quit IRC | 00:36 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Move eventlet server options to a config section https://review.openstack.org/130962 | 00:41 |
| *** tellesnobrega has joined #openstack-keystone | 00:45 | |
| *** david-lyle has joined #openstack-keystone | 00:46 | |
| *** drjones has quit IRC | 00:51 | |
| *** david-lyle has quit IRC | 00:51 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 00:51 | |
| morganfainberg | ayoung, i think you're right, a backlog for specs would be worth having | 00:55 |
| morganfainberg | ayoung, *cough* comment on https://review.openstack.org/#/c/125457/ *cough* | 00:55 |
| morganfainberg | erm | 00:56 |
| ayoung | morganfainberg, I think you have Ebola | 00:56 |
| ayoung | 21 days quarentine | 00:56 |
| morganfainberg | https://review.openstack.org/#/c/123726/ | 00:56 |
| morganfainberg | that one as is is almost perfect example for backlog | 00:56 |
| ayoung | morganfainberg, we've got a live demo to do next week, and we've yet to get all the pieces together. Little bit in crunch mode at the moment | 00:57 |
| ayoung | Ah...yep | 00:57 |
| morganfainberg | ayoung, notice i'm not saying "go do it" was just poiting out that i agree with you :) | 00:57 |
| ayoung | morganfainberg, are you going to implement "backlog" as a part of the specs? | 00:57 |
| ayoung | excellent | 00:57 |
| morganfainberg | ayoung, i'm thinking we make "lost and found" a "backlog" | 00:57 |
| ayoung | I think I have an implementer for that one actually | 00:57 |
| ayoung | deal | 00:57 |
| ayoung | morganfainberg, but... | 00:58 |
| ayoung | backlog should be just for Good ideas to start.... | 00:58 |
| ayoung | lost and found can be more than just a backlog...but good idea to merge them | 00:58 |
| morganfainberg | well we have "nothing" to put in the lost and found | 00:58 |
| morganfainberg | since we have nothng to go in there the same concept could be used for a backlog today | 00:58 |
| morganfainberg | lost and found can happen if we ever need it | 00:59 |
| * morganfainberg continues to review specs. | 00:59 | |
| ayoung | morganfainberg, how about a tag "Available for interested parties to implement" on a spec to indicate "go do it" versus "I'm still planning on doing this once it is implemented" | 00:59 |
| morganfainberg | ayoung, if a spec isn't proposed to the backlog (or moved there cause we decide the original implementor isn't interested) it's open to anyonme | 01:00 |
| morganfainberg | if it's targeted at a release [current] or being pulled forward by someone it has implementor | 01:00 |
| morganfainberg | but adding "hey this is a good idea but I want to do damn it, but not today... and i'm not sure when" doesn't help anyone | 01:00 |
| ayoung | wel...not completely agreeing. At the start, it should be proposed to backlog | 01:00 |
| ayoung | yes it does: I have had a bunch of people ask me "how do I get involved" and the answer should be "pick something off the backlog" | 01:01 |
| morganfainberg | no, the "this is MY thing" doesn't help | 01:01 |
| morganfainberg | the backlog absolutely helps | 01:01 |
| openstackgerrit | Anne Gentle proposed a change to openstack/keystone-specs: Adds v2.0 files for api spec https://review.openstack.org/131315 | 01:02 |
| morganfainberg | but the way i see it, backlog is "good ideas that either we don't have time for or we don't have bandwidth for" | 01:02 |
| morganfainberg | and should be available for people to pickup | 01:02 |
| morganfainberg | if that makes sense. | 01:02 |
| morganfainberg | i think i'm *really* agreeing with the oncept of a backlog as long as it doesn't have the "we put something in the backlog and say no one can touch it but XXX person" | 01:03 |
| *** ChanServ sets mode: -o morganfainberg | 01:03 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove implemented TODO in catalog/backends/sql.py https://review.openstack.org/129830 | 01:05 |
| *** gabriel-bezerra has joined #openstack-keystone | 01:07 | |
| openstackgerrit | wanghong proposed a change to openstack/keystonemiddleware: fallback to online validation if offline validation fails https://review.openstack.org/131036 | 01:09 |
| ayoung | morganfainberg, deal | 01:15 |
| ayoung | morganfainberg, the only thing is there should be a clear sense of whether someone is working on it or not | 01:15 |
| morganfainberg | i'd say if somenoe is working on it it should be targeted or have a review up to target it | 01:15 |
| ayoung | putting it in the backlog first off means "here is the idea, is this good or bad" | 01:15 |
| morganfainberg | it can be a dependent change proposed at the same time | 01:16 |
| ayoung | but it needs to be approved first | 01:16 |
| ayoung | before we assign... | 01:16 |
| ayoung | the work flow should be light: | 01:16 |
| morganfainberg | so change 1: on backlog, change 2: move from backlog | 01:16 |
| morganfainberg | it shows someone is actively working on it. | 01:16 |
| ayoung | I propose for backlog. It gets approved. I propose moving to "kilo" | 01:16 |
| morganfainberg | if its an "idea" you want anyone to pickup, just omit the second change :) | 01:17 |
| ayoung | but if someone just looks at the git repo (not gerrit) they won't see the proposal | 01:17 |
| openstackgerrit | Anne Gentle proposed a change to openstack/keystone-specs: Adds v2.0 files for api spec https://review.openstack.org/131315 | 01:17 |
| ayoung | OTOH you need to look at the git repo to see what is available | 01:17 |
| morganfainberg | ah but we, the reviewers will. and they'd need to look at the review list *anyway* | 01:17 |
| morganfainberg | since you're proposing moving it from the backlog | 01:17 |
| ayoung | OK...so if you ant to pick up a spec, submit the "move to release" request | 01:18 |
| ayoung | and...what about abandonware? | 01:18 |
| morganfainberg | we can (cores) shuffle things back to lost+found or backlog | 01:18 |
| morganfainberg | at each cycle. | 01:18 |
| morganfainberg | if no one is pulling it forward, it gets shuffled. | 01:18 |
| ayoung | OK...this sounds about right | 01:18 |
| ayoung | we'll have a pinch or two as we adjuste the straps, but I think we can carry this load | 01:19 |
| morganfainberg | likely backlog replaces lost+found completly | 01:19 |
| morganfainberg | yeah it's def not bad. the streamlinging of the specs is helping | 01:19 |
| morganfainberg | and remember truely trivial bps wont need a spec | 01:19 |
| morganfainberg | e.g. "i want to fix docs everywhere" | 01:19 |
| ayoung | Lets get them into the backlog at least to float the idea | 01:19 |
| morganfainberg | probably doesn't need a spec. | 01:19 |
| ayoung | sure | 01:20 |
| morganfainberg | that is the concept of "trivial bp" | 01:20 |
| ayoung | OK, I'm with you. I like this | 01:20 |
| morganfainberg | or another trivial bp: the i18n hints | 01:20 |
| morganfainberg | no need to spec it, but it's a bp | 01:20 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Configuring Keystone edits https://review.openstack.org/131318 | 01:21 |
| ayoung | want me to repurpose the lost-and-found request for this? | 01:21 |
| morganfainberg | if it has any rest changes, no matter how trivial, it's a spec. | 01:21 |
| morganfainberg | yeah | 01:21 |
| morganfainberg | if you have time, if not i'll do it this week | 01:21 |
| morganfainberg | i have some backlog work to do myself - e.g. documenting the whole spec process for people | 01:21 |
| morganfainberg | what we consider trivial, etc | 01:21 |
| *** topol has joined #openstack-keystone | 01:22 | |
| morganfainberg | it's part of what *i'm* commiting to as PTL os we can get specs, bugs, and BPs really managable | 01:22 |
| morganfainberg | it's why i've been on such a tear to get things in order | 01:22 |
| *** jdennis has joined #openstack-keystone | 01:22 | |
| morganfainberg | ayoung, btw, the DAG for roles, yes please. | 01:23 |
| morganfainberg | esp. depending on where policy discussions go | 01:23 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Backlog https://review.openstack.org/126647 | 01:24 |
| ayoung | morganfainberg, ^^ I just changed the commit message | 01:24 |
| morganfainberg | ayoung, ++. | 01:24 |
| ayoung | need to change the dir name | 01:24 |
| morganfainberg | right. | 01:24 |
| ayoung | etc etc | 01:24 |
| openstackgerrit | Anne Gentle proposed a change to openstack/keystone-specs: Adds v2.0 files for api spec https://review.openstack.org/131315 | 01:24 |
| ayoung | morganfainberg, I think we're going to need someone to implement the nova spec "fetch policy by endpoint id" to prime the pump on policy | 01:25 |
| morganfainberg | and we need some *thing* to make it work (looking for the magic invocation in sphinx to say "look if it's empty... ignore it sheesh" | 01:25 |
| ayoung | I'll put in a backlog spec.... | 01:25 |
| morganfainberg | ayoung, i think we will know a lot more about that post summit sessions | 01:25 |
| ayoung | morganfainberg, my take is we should do 90% of the work in Keystoneclient, and then make the call from Nova where they currently do their policy enforcement | 01:26 |
| morganfainberg | ayoung, sure. | 01:26 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Doc about deleting a domain specific backend domain https://review.openstack.org/131319 | 01:26 |
| ayoung | Actually, we could do that inside Keystone itself, if we could short circuit the actual fetch | 01:26 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Configuring Keystone edits https://review.openstack.org/131318 | 01:27 |
| morganfainberg | ayoung, *cough* summit session on policy *cough* | 01:27 |
| ayoung | Deal | 01:27 |
| morganfainberg | specifically to figure out the next steps here | 01:27 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Configuring Keystone edits https://review.openstack.org/131318 | 01:29 |
| *** chrisshattuck has joined #openstack-keystone | 01:30 | |
| morganfainberg | bknudson, going to move eventlet options under their own section? | 01:30 |
| morganfainberg | bknudson, or does that come after this configuration type change | 01:30 |
| morganfainberg | erm | 01:30 |
| morganfainberg | doc change | 01:30 |
| bknudson | morganfainberg: https://review.openstack.org/#/c/130962/ | 01:30 |
| morganfainberg | aha | 01:31 |
| bknudson | they're separate. | 01:31 |
| morganfainberg | nice | 01:31 |
| morganfainberg | yay. | 01:31 |
| *** david-lyle has joined #openstack-keystone | 01:31 | |
| morganfainberg | makes far too much sense to have eventlet options in a separate config group | 01:31 |
| bknudson | when I was updating the config docs for the eventlet options change I noticed there were other issues in the config doc. | 01:31 |
| morganfainberg | bknudson, ah | 01:31 |
| bknudson | y, it's a little weird with the ssl options, so make sure you agree with how that was done. | 01:32 |
| morganfainberg | yeah i'm going to take a hard look at it | 01:32 |
| bknudson | and, it's a little weird with the service catalog substitution too. | 01:32 |
| morganfainberg | i think i need a break from ripping spec proposals apart | 01:32 |
| bknudson | but those things were weird to begin with. | 01:32 |
| morganfainberg | the sc subst stuff will always be wierd | 01:32 |
| * morganfainberg wonders if we can make keystone-all an entrypoint | 01:33 | |
| morganfainberg | like how nova works | 01:33 |
| morganfainberg | instead of having to maintain bin/<stuff> | 01:33 |
| morganfainberg | doesn't mean we wouldn't have the code elsewhere, just it would be pbr magic | 01:34 |
| *** david-lyle has quit IRC | 01:36 | |
| bknudson | morganfainberg: https://review.openstack.org/#/c/62275/ was my attempt at putting the code elsewhere. | 01:37 |
| morganfainberg | bknudson, at that point we could make it an entrypoint | 01:38 |
| morganfainberg | i do remember that change. | 01:38 |
| bknudson | I haven't looked at how nova does it. | 01:38 |
| bknudson | http://git.openstack.org/cgit/openstack/nova/tree/setup.cfg#n35 | 01:39 |
| morganfainberg | yepo | 01:39 |
| morganfainberg | thats what i was thinking we should aim for | 01:39 |
| bknudson | might as well be consistent | 01:39 |
| morganfainberg | it mostly just moves your reduced stuff to soemthing like keystoen.cli | 01:39 |
| morganfainberg | but i like not needing a /bin directory in-tree | 01:39 |
| bknudson | how does nova calculate possible_topdir?? | 01:40 |
| openstackgerrit | Anne Gentle proposed a change to openstack/keystone-specs: Adds v2.0 files for api spec https://review.openstack.org/131315 | 01:40 |
| morganfainberg | bknudson, that is the question i am not sure of | 01:40 |
| morganfainberg | it's why i didn't get anywhere with that change. | 01:41 |
| bknudson | if nova doesn't need to figure out a possible_topdir I don't know why we have to. | 01:41 |
| morganfainberg | i admit i haven't spent much time noodling on it | 01:41 |
| bknudson | is it for development? | 01:42 |
| morganfainberg | or for tests | 01:42 |
| bknudson | maybe git blame can help | 01:42 |
| morganfainberg | i actually think it's mostly for test purposes. | 01:43 |
| morganfainberg | or for laaaaazy magic ux purposes | 01:43 |
| bknudson | tests work fine for me | 01:43 |
| bknudson | I'll propose a change to get rid of it and see who complains | 01:43 |
| bknudson | https://github.com/openstack/keystone/commit/34e9a9771eb68ff9d98ae1b43a562eabc26849b6 -- something with config file | 01:44 |
| bknudson | files | 01:44 |
| morganfainberg | lol | 01:47 |
| morganfainberg | works for me | 01:47 |
| bknudson | I guess it's just something relative to the keystone-all file, so it could just as well be relative to keystone.cmd.all | 01:49 |
| morganfainberg | bknudson, ++ | 01:49 |
| morganfainberg | less out-of-project files we need to maintain the better imo. | 01:50 |
| *** chrisshattuck has quit IRC | 01:57 | |
| bknudson | so how do I get a keystone-all now? | 01:58 |
| morganfainberg | you put the relevant code into like keystone.cli (look at how nova does that) and set a console entry point | 01:58 |
| morganfainberg | it will get built from code and reference the target method(s) | 01:58 |
| morganfainberg | http://git.openstack.org/cgit/openstack/nova/tree/setup.cfg#n35 | 01:59 |
| morganfainberg | http://git.openstack.org/cgit/openstack/nova/tree/nova/cmd/all.py | 01:59 |
| bknudson | morganfainberg: right, that was easy enough... now what do I do to call it? | 01:59 |
| morganfainberg | largely it's moving the code into the project | 01:59 |
| morganfainberg | i'd call it keystone-all | 01:59 |
| morganfainberg | :) | 02:00 |
| bknudson | how do I execute keystone-all? | 02:00 |
| morganfainberg | oh you install the project and then it should be in the path | 02:00 |
| bknudson | there's no keystone-all now... do I run some pbr command? | 02:00 |
| morganfainberg | pbr make the "console" scripts on install | 02:00 |
| *** jacer_huawei has quit IRC | 02:00 | |
| morganfainberg | and in the case of the VENV the console scripts will be in the VENV | 02:01 |
| morganfainberg | VENV/bin/<script-name> | 02:01 |
| bknudson | python setup.py build_scripts -- didn't do it | 02:02 |
| bknudson | .tox/py27/bin/python setup.py install -- now I've got a keystone-all | 02:04 |
| morganfainberg | yeah | 02:04 |
| morganfainberg | build_scripts isn't magic pbr hooks into | 02:04 |
| morganfainberg | install is | 02:04 |
| bknudson | it started... this seems to work. | 02:05 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Refactor keystone-all and http/keystone https://review.openstack.org/62275 | 02:06 |
| bknudson | kind of sloppy for now, but seems to work | 02:06 |
| morganfainberg | bknudson, i think we'll want to the same for keystone-manage, but that can be separate | 02:08 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Refactor keystone-all and http/keystone https://review.openstack.org/62275 | 02:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Refactor keystone-all and http/keystone https://review.openstack.org/62275 | 02:11 |
| *** jacer_huawei has joined #openstack-keystone | 02:12 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove token persistence proxy https://review.openstack.org/124809 | 02:13 |
| bknudson | alright, I think I got everything cleaned up in 62275 | 02:13 |
| morganfainberg | cool | 02:16 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 02:20 | |
| *** notstevemar has quit IRC | 02:24 | |
| *** lhcheng_ has quit IRC | 02:33 | |
| *** lhcheng has joined #openstack-keystone | 02:34 | |
| *** tellesnobrega has quit IRC | 02:34 | |
| *** david-lyle has joined #openstack-keystone | 02:36 | |
| ayoung | jamielennox, morganfainberg can we get a +2A on https://review.openstack.org/#/c/123614/14 | 02:37 |
| ayoung | I can't submit the Django review until we have a working client plugin | 02:38 |
| *** alex_xu has joined #openstack-keystone | 02:39 | |
| *** tellesnobrega has joined #openstack-keystone | 02:40 | |
| *** david-lyle has quit IRC | 02:41 | |
| *** lhcheng has quit IRC | 02:44 | |
| *** dims_ has quit IRC | 02:44 | |
| *** tellesnobrega has quit IRC | 02:45 | |
| ayoung | r1chardj0n3s, I'm going to head to bed soon. Let me know if you have a moment | 02:46 |
| *** dims__ has joined #openstack-keystone | 02:47 | |
| *** dims__ has quit IRC | 02:49 | |
| *** k-kosaka has joined #openstack-keystone | 02:51 | |
| *** gordc has joined #openstack-keystone | 02:52 | |
| openstackgerrit | Kenjiro Kosaka proposed a change to openstack/keystone: Sample Identity endpoints changed to unversioned https://review.openstack.org/130669 | 02:52 |
| *** tellesnobrega has joined #openstack-keystone | 02:54 | |
| *** alex_xu has quit IRC | 03:01 | |
| *** jacer_huawei has quit IRC | 03:04 | |
| *** tellesnobrega_ has joined #openstack-keystone | 03:05 | |
| *** tellesnobrega has quit IRC | 03:06 | |
| *** jacer_huawei has joined #openstack-keystone | 03:08 | |
| *** alex_xu has joined #openstack-keystone | 03:13 | |
| r1chardj0n3s | ayoung: hi | 03:15 |
| ayoung | r1chardj0n3s, hey | 03:15 |
| ayoung | r1chardj0n3s, did you try what I posted earlier? | 03:15 |
| ayoung | kinit rjones@YOUNGLOGIC.NET | 03:15 |
| r1chardj0n3s | ayoung: I've been scratching my head at the kerberos stuff. a lot to absorb there. the thing you suggested is no go - the tools and environment aren't on my Mac or my cloud ubuntu instance | 03:16 |
| ayoung | r1chardj0n3s, ah...ok, so you need the kerberos workstation package | 03:16 |
| r1chardj0n3s | ayoung: but I've been trying read the various docs before jumping in | 03:16 |
| ayoung | r1chardj0n3s, I'm happy to help | 03:16 |
| ayoung | its not quite as bad as you might think. | 03:17 |
| ayoung | https://fermilinux.fnal.gov/documentation/security/kerberos-newer-linux/ | 03:17 |
| r1chardj0n3s | I need it to be on my Mac I think, which is where angboard is | 03:17 |
| ayoung | apt-get install krb5-user | 03:17 |
| ayoung | r1chardj0n3s, I know that other mac users have gotten it to work, but I know naught from mac | 03:17 |
| ayoung | morganfainberg, you have kerberos on your mac, right? | 03:18 |
| morganfainberg | ayoung, i do, but i'm actually at the point where my whole machine went sideways | 03:19 |
| * morganfainberg sighs | 03:19 | |
| morganfainberg | it's going to be re-install | 03:19 |
| ayoung | morganfainberg, does this still make sense: http://web.mit.edu/macdev/KfM/Common/Documentation/osx-kerberos-extras.html | 03:19 |
| r1chardj0n3s | ayoung: I kinda got lost/overwhelmed trying to grok that article "Setting Up S4U2Proxy With FreeIPA" | 03:19 |
| ayoung | seems like it is old and out of date | 03:19 |
| ayoung | r1chardj0n3s, heh, | 03:19 |
| morganfainberg | ayoung, that is pretty out dated | 03:19 |
| r1chardj0n3s | ayoung: there's a heck of a lot of domain knowledge embedded in that sucker ;) | 03:19 |
| ayoung | lets start with just getting the client | 03:19 |
| morganfainberg | ayoung, i don't think it makes a lot of sense | 03:19 |
| morganfainberg | i *think* most of the stuff comes default in 10.10 | 03:20 |
| *** gordc_ has joined #openstack-keystone | 03:20 | |
| ayoung | r1chardj0n3s, do you have krb5.conf file in whatever passes for /etc on Mac? | 03:20 |
| r1chardj0n3s | ayoung: nup | 03:20 |
| ayoung | r1chardj0n3s, morganfainberg isn't there some 3rd party library repo for macs | 03:21 |
| morganfainberg | ayoung, brew | 03:21 |
| ayoung | http://clc.its.psu.edu/UnivServices/itadmins/mac/kerbldaplogins says something about clc | 03:22 |
| ayoung | ah, yeah ,brew | 03:22 |
| r1chardj0n3s | ayoung: yes, homebrew and I'm searching for something there ;) | 03:22 |
| morganfainberg | but krb5 i *think* is a base install in yosemite (what I have) | 03:22 |
| openstackgerrit | Matthew Edmonds proposed a change to openstack/keystone: Adds IPv6 url validation support https://review.openstack.org/131326 | 03:23 |
| *** gordc has quit IRC | 03:23 | |
| ayoung | "Mac OS X comes with kerberos already installed." | 03:23 |
| r1chardj0n3s | morganfainberg: yeah, but I'm afeared of upgrading to yosemite just before Paris :) | 03:23 |
| ayoung | r1chardj0n3s, from a command line run kinit | 03:23 |
| ayoung | actually, you should be able to run kinit rjones@YOUNGLOGIC.NET | 03:24 |
| r1chardj0n3s | ayoung: *cough* well, that's embarrasing, I must have typo'ed that before :/ | 03:24 |
| ayoung | there is that cough again. Suspect you caught it from morganfainberg . Pretty sure he has the Eeebola. 21 day quarentine for both of you | 03:24 |
| r1chardj0n3s | ok kinit run | 03:25 |
| ayoung | http://computing.help.inf.ed.ac.uk/kerberos-mac-os-x looks like a decent tutorial | 03:25 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Use correct name of oslo debugger script https://review.openstack.org/130046 | 03:25 |
| ayoung | r1chardj0n3s, klist should show you your tickets | 03:25 |
| r1chardj0n3s | yup | 03:25 |
| ayoung | r1chardj0n3s, cool...ok, so I'm not certain how well this next part is going to work. | 03:25 |
| ayoung | But | 03:26 |
| r1chardj0n3s | :) | 03:26 |
| ayoung | r1chardj0n3s, you have firefox installed? | 03:26 |
| r1chardj0n3s | I do | 03:26 |
| ayoung | morganfainberg, were you able to get all this working using firefox on Mac? | 03:26 |
| ayoung | r1chardj0n3s, got back to ipa.younglogic.com, but don't log in, or, if you are logged in, log out | 03:26 |
| ayoung | you should have the login dialog infront of you | 03:26 |
| r1chardj0n3s | yup (I don't use FF generally, so it wasn't logged in) | 03:27 |
| ayoung | We're gonna see if your browser can use Kerberos to authenticate you to the ipa server. It should be able to... | 03:27 |
| *** harlowja is now known as harlowja_away | 03:27 | |
| ayoung | OK, so there is a small link that says something like "click here to configure" | 03:27 |
| r1chardj0n3s | ok, it's punted me to an unauthorized page, tellting me how to configure FF | 03:28 |
| ayoung | yeah, go through that process. | 03:28 |
| ayoung | We streamlined it as much as possble, but there are a few things that need to be done for an ipa server to set up a little more than your average web app | 03:29 |
| ayoung | however, once you have it, it means that the stuff we need for angboard will work, too | 03:29 |
| ayoung | r1chardj0n3s, BTW, I just completed a packstack install on another machine up on younglogic.net. I'll try to get angboard up and running there tomorrow | 03:30 |
| r1chardj0n3s | ok, I'm not sure what it just did, but my FF is now configured and accessing my account on ipa | 03:30 |
| *** harlowja_away is now known as harlowja | 03:30 | |
| r1chardj0n3s | (well, I did a certificate thing, installed some extension in FF, configured that with I guess my krb token) | 03:31 |
| r1chardj0n3s | ok, so the extension was for negotiate support, roger | 03:32 |
| r1chardj0n3s | hm, all a bit black box. I'm gonna have to go back to figuring out how to make that work from JS | 03:32 |
| r1chardj0n3s | though I assume that's going to still need some browser extension given that the krb tokens are in the OS | 03:33 |
| r1chardj0n3s | also, I had to do the krb login from the command line which is suboptimal from a web perspective ;) | 03:33 |
| r1chardj0n3s | ok, Lynn Root, you legend http://www.roguelynn.com/words/explain-like-im-5-kerberos/ | 03:34 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/130897 | 03:34 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/131329 | 03:34 |
| ayoung | yeah, there are other ways of managing the kerberos login, but command line is lowest common denominator | 03:34 |
| * ayoung still sad Lynn no longer works for RH | 03:34 | |
| ayoung | she's been seduced by the dark side of the web: Spotify! | 03:35 |
| r1chardj0n3s | wow, ok, I found a *thesis* for adapting kerberos for browser-based environment | 03:35 |
| ayoung | we really just need a browser plugin, surprised no one has written one | 03:35 |
| r1chardj0n3s | well, no, redhat *has* written one :) | 03:36 |
| ayoung | r1chardj0n3s, OK, I have a kerberized Keystone server, and the ability to hit it from javascript | 03:36 |
| ayoung | let me give you user a role... | 03:36 |
| ayoung | OK, hit https://keystone.younglogic.net/keystone/cops/old.html# and lets see what happen | 03:37 |
| ayoung | this is pure javascript in front of Keystone | 03:37 |
| ayoung | Domain name is YOUNGLOGIC.NET | 03:37 |
| ayoung | you can try using userid and poassword first, and then we'll try kerberos | 03:38 |
| *** miqui has quit IRC | 03:38 | |
| ayoung | r1chardj0n3s, I need to know the userid generated for your user. Its the big long sha256 | 03:39 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/131122 | 03:39 |
| r1chardj0n3s | 42524c7ca1a996863625b413e73392ae95be9b4f90b89603a7fdf87523929ae1 | 03:39 |
| r1chardj0n3s | :) | 03:39 |
| ayoung | and it only gets generated the first time you login | 03:39 |
| r1chardj0n3s | Chrome has kerberos built in, but disabled by default "for security reasons" | 03:40 |
| ayoung | um. yeah | 03:40 |
| r1chardj0n3s | you need to whitelist servers to enable it | 03:40 |
| ayoung | I know. I think I worked through that 4 years ago? | 03:40 |
| ayoung | 3+ anyway | 03:40 |
| *** marcoemorais has joined #openstack-keystone | 03:40 | |
| ayoung | OK. So on that keystone UI page, try listing projects | 03:41 |
| ayoung | you should now have a Member role on the demo project, and should be able to get a token for that | 03:41 |
| ayoung | I did a slightly nicer Proof of concept here https://keystone.younglogic.net/keystone/cops/ | 03:41 |
| ayoung | but it doesn't do the role thing | 03:41 |
| ayoung | in both cases, the general thing is "get an unscoped token, list projects, select a project, get a scoped token" | 03:42 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove implemented TODO in catalog/backends/sql.py https://review.openstack.org/129830 | 03:42 |
| r1chardj0n3s | ok, I've clicked around somewhat randomly, and now I have something under Roles :) | 03:43 |
| r1chardj0n3s | and now I have "trusts" | 03:43 |
| r1chardj0n3s | brb, putting the damned heater on | 03:44 |
| *** richm has quit IRC | 03:44 | |
| r1chardj0n3s | ayoung: I suspect that supporting this might require some small amount of support in the proxy | 03:45 |
| ayoung | r1chardj0n3s, OK, so I'll get the proxy up and running tomorrow (close to midnight here) and see if I can make it work. I suspect I know what it will take | 03:46 |
| *** tellesnobrega_ has quit IRC | 03:47 | |
| r1chardj0n3s | ayoung: yes, go to sleep :) angboard should just work, but if you run into issues I'll be up and about at 7AM local time (UTC+11) | 03:47 |
| *** marcoemorais has quit IRC | 03:48 | |
| ayoung | thanks. You are in the same timezone as jamielennox | 03:48 |
| r1chardj0n3s | I don't think I know jamie, but I do know some other red hatters (not openstackers) | 03:48 |
| ayoung | r1chardj0n3s, he's up the coast in Brisbane | 03:49 |
| r1chardj0n3s | ayoung: yup, that's the RH office - they don't do remote workers in AU AFAIK | 03:49 |
| *** dims__ has joined #openstack-keystone | 03:50 | |
| *** tellesnobrega has joined #openstack-keystone | 03:52 | |
| *** dims__ has quit IRC | 03:55 | |
| ayoung | npm install....Oh Em Gee | 03:56 |
| ayoung | I think I saw an ASN1 library in there | 03:56 |
| ayoung | r1chardj0n3s, so angboard is hanging on me | 04:02 |
| r1chardj0n3s | ayoung: oh, you're still up! | 04:02 |
| ayoung | I suspect it is the "open the browser" aspect | 04:02 |
| ayoung | r1chardj0n3s, my wife is yelling down at me "It's midnight" | 04:02 |
| r1chardj0n3s | ayoung: it might be - just try hitting 0.0.0.0:9000 | 04:02 |
| r1chardj0n3s | ayoung: or go to bed | 04:02 |
| r1chardj0n3s | ayoung: :) | 04:02 |
| r1chardj0n3s | ayoung: there is a known issue with grunt at startup getting the flask app and proxy stuff synchronised; thanks for the prod, I'll look into it right now | 04:03 |
| ayoung | r1chardj0n3s, it works when I do a local 0.0.0.0:9000 ,but not across the web. Suspect it is a floating IP issue | 04:03 |
| ayoung | and...with that I'm off to bed | 04:04 |
| r1chardj0n3s | ayoung: ok, catch you tomorrow! | 04:04 |
| *** ayoung has quit IRC | 04:04 | |
| *** david-lyle has joined #openstack-keystone | 04:06 | |
| *** gyee has joined #openstack-keystone | 04:11 | |
| *** ajayaa has joined #openstack-keystone | 04:14 | |
| *** tellesnobrega has quit IRC | 04:15 | |
| *** gordc_ has quit IRC | 04:18 | |
| *** chrisshattuck has joined #openstack-keystone | 04:28 | |
| *** vsilva is now known as victsou | 04:28 | |
| *** tellesnobrega has joined #openstack-keystone | 04:34 | |
| *** victsou is now known as vsilva | 04:35 | |
| *** links has joined #openstack-keystone | 04:39 | |
| *** stevemar has joined #openstack-keystone | 04:44 | |
| *** lhcheng has joined #openstack-keystone | 05:09 | |
| *** lhcheng_ has joined #openstack-keystone | 05:11 | |
| *** lhcheng has quit IRC | 05:14 | |
| *** gyee has quit IRC | 05:19 | |
| *** fifieldt__ has quit IRC | 05:20 | |
| *** ncoghlan has joined #openstack-keystone | 05:22 | |
| *** topol has quit IRC | 05:33 | |
| *** stevemar has quit IRC | 05:37 | |
| *** harlowja is now known as harlowja_away | 05:37 | |
| *** chrisshattuck has quit IRC | 05:43 | |
| *** topol_ has joined #openstack-keystone | 05:49 | |
| *** topol_ is now known as topol | 05:49 | |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: minor fix on the dubug information and python annotation https://review.openstack.org/131344 | 05:52 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 05:58 | |
| *** topol has quit IRC | 06:02 | |
| *** alex_xu has quit IRC | 06:05 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/130929 | 06:06 |
| *** afazekas_drunk is now known as afazekas | 06:08 | |
| *** ajayaa has quit IRC | 06:12 | |
| *** alex_xu has joined #openstack-keystone | 06:19 | |
| *** david-lyle has quit IRC | 06:20 | |
| *** ajayaa has joined #openstack-keystone | 06:24 | |
| *** alex_xu has quit IRC | 06:32 | |
| *** tellesnobrega has quit IRC | 06:44 | |
| *** alex_xu has joined #openstack-keystone | 06:44 | |
| *** dims__ has joined #openstack-keystone | 06:44 | |
| *** dims__ has quit IRC | 06:49 | |
| *** david-lyle has joined #openstack-keystone | 06:50 | |
| *** david-lyle has quit IRC | 06:54 | |
| *** ajayaa has quit IRC | 06:57 | |
| *** k4n0 has joined #openstack-keystone | 06:57 | |
| *** alex_xu has quit IRC | 07:02 | |
| *** fifieldt has joined #openstack-keystone | 07:06 | |
| *** ukalifon1 has joined #openstack-keystone | 07:15 | |
| *** lhcheng_ has quit IRC | 07:17 | |
| *** oomichi has quit IRC | 07:19 | |
| *** ajayaa has joined #openstack-keystone | 07:21 | |
| *** david-lyle has joined #openstack-keystone | 07:21 | |
| *** david-lyle has quit IRC | 07:25 | |
| *** jacer_huawei has quit IRC | 07:31 | |
| *** nellysmitt has joined #openstack-keystone | 07:33 | |
| *** alex_xu has joined #openstack-keystone | 07:39 | |
| *** jacer_huawei has joined #openstack-keystone | 07:48 | |
| *** links has quit IRC | 07:48 | |
| *** jaosorior has joined #openstack-keystone | 07:50 | |
| *** ncoghlan has quit IRC | 07:54 | |
| *** jacer_huawei has quit IRC | 08:12 | |
| *** alex_xu has quit IRC | 08:14 | |
| openstackgerrit | A change was merged to openstack/keystone: Use correct name of oslo debugger script https://review.openstack.org/130045 | 08:18 |
| *** nellysmitt has quit IRC | 08:19 | |
| *** david-lyle has joined #openstack-keystone | 08:21 | |
| *** nellysmitt has joined #openstack-keystone | 08:24 | |
| *** jacer_huawei has joined #openstack-keystone | 08:25 | |
| *** david-lyle has quit IRC | 08:26 | |
| *** amakarov_away is now known as amakarov | 08:35 | |
| *** links has joined #openstack-keystone | 09:01 | |
| *** links has quit IRC | 09:17 | |
| *** tomoiaga has joined #openstack-keystone | 09:17 | |
| *** k-kosaka has quit IRC | 09:19 | |
| *** david-lyle has joined #openstack-keystone | 09:22 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use connection retrying from keystoneclient https://review.openstack.org/129868 | 09:24 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Add versions to requests https://review.openstack.org/130531 | 09:24 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use an adapter in IdentityServer https://review.openstack.org/130530 | 09:25 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 09:25 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use Discovery fixtures for auth token tests https://review.openstack.org/130247 | 09:25 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Convert authentication into a plugin https://review.openstack.org/115857 | 09:25 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Split identity server into v2 and v3 https://review.openstack.org/130534 | 09:25 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Additional discovery changes https://review.openstack.org/130533 | 09:25 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use real discovery object in auth_token middleware. https://review.openstack.org/130532 | 09:25 |
| *** david-lyle has quit IRC | 09:26 | |
| *** jamielennox_ has joined #openstack-keystone | 09:28 | |
| *** bjornar has joined #openstack-keystone | 09:29 | |
| bjornar | What services does not speak keystone v3 api? | 09:30 |
| bjornar | ..in juno.. | 09:30 |
| *** andreaf has joined #openstack-keystone | 09:36 | |
| *** andreaf_ has joined #openstack-keystone | 09:39 | |
| jamielennox_ | bjornar: it depends how you look at it, auth_token middleware is generally the only thing that talks to keystone (other than heat) - auth_token will use v3 for validation but it can only authenticate itself with v2 (for now) | 09:39 |
| bjornar | ..I just want to get rid of the admin endpoint... | 09:43 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Doc about deleting a domain specific backend domain https://review.openstack.org/131319 | 09:50 |
| *** jamielennox_ has quit IRC | 09:53 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Doc about deleting a domain specific backend domain https://review.openstack.org/131319 | 09:53 |
| jamielennox | bjornar: unfortunately not yet, auth_token still defaults to using that | 10:05 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Update requests-mock syntax https://review.openstack.org/131380 | 10:05 |
| *** tellesnobrega has joined #openstack-keystone | 10:16 | |
| *** f13o_f13o has joined #openstack-keystone | 10:18 | |
| *** f13o_f13o has quit IRC | 10:18 | |
| *** dims__ has joined #openstack-keystone | 10:19 | |
| *** nellysmitt has quit IRC | 10:20 | |
| *** david-lyle has joined #openstack-keystone | 10:23 | |
| *** dims__ has quit IRC | 10:23 | |
| *** tellesnobrega has quit IRC | 10:24 | |
| *** david-lyle has quit IRC | 10:28 | |
| *** tellesnobrega has joined #openstack-keystone | 10:36 | |
| *** tellesnobrega has quit IRC | 10:43 | |
| *** dims__ has joined #openstack-keystone | 10:43 | |
| *** gabriel-bezerra has quit IRC | 10:44 | |
| *** tellesnobrega has joined #openstack-keystone | 10:47 | |
| *** tellesnobrega has quit IRC | 10:51 | |
| *** tellesnobrega has joined #openstack-keystone | 10:55 | |
| *** andreaf has quit IRC | 10:55 | |
| *** andreaf_ is now known as andreaf | 10:55 | |
| *** tellesnobrega has quit IRC | 10:59 | |
| *** nellysmitt has joined #openstack-keystone | 11:01 | |
| bjornar | jamiec, did you get anything done with the performance of token generation and the numerous sql queries? Dont see anything in the short juno changelog.. | 11:19 |
| bjornar | jamielennox, that was for you, sorry. | 11:19 |
| jamiec | np :) | 11:19 |
| *** gabriel-bezerra has joined #openstack-keystone | 11:23 | |
| *** david-lyle has joined #openstack-keystone | 11:24 | |
| *** nellysmitt has quit IRC | 11:25 | |
| *** david-lyle has quit IRC | 11:28 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/130897 | 11:47 |
| *** nellysmitt has joined #openstack-keystone | 11:48 | |
| jamielennox | bjornar: i'm not aware of anything targetting that specifically | 11:53 |
| jamielennox | but i've been a bit removed from that sort of thing | 11:53 |
| bjornar | ok ic.. who is into this? | 11:57 |
| *** thiagop has joined #openstack-keystone | 11:58 | |
| *** htruta has joined #openstack-keystone | 11:58 | |
| *** samuelms has joined #openstack-keystone | 11:59 | |
| *** afaranha has joined #openstack-keystone | 11:59 | |
| *** raildo has joined #openstack-keystone | 12:02 | |
| *** ajayaa has quit IRC | 12:04 | |
| *** gordc has joined #openstack-keystone | 12:05 | |
| *** dims__ has quit IRC | 12:07 | |
| *** dims__ has joined #openstack-keystone | 12:07 | |
| *** ajayaa has joined #openstack-keystone | 12:17 | |
| *** gordc has quit IRC | 12:20 | |
| jamielennox | probably morganfainberg is best to ask | 12:24 |
| *** david-lyle has joined #openstack-keystone | 12:24 | |
| *** gordc has joined #openstack-keystone | 12:26 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: get_endpoint should return the override https://review.openstack.org/131408 | 12:27 |
| jamielennox | he was the one looking into things like non-persistent backends so probably did the most in that area in juno | 12:27 |
| *** ajayaa has quit IRC | 12:28 | |
| *** david-lyle has quit IRC | 12:29 | |
| *** miqui has joined #openstack-keystone | 12:36 | |
| *** k4n0 has quit IRC | 12:46 | |
| *** edmondsw has joined #openstack-keystone | 12:50 | |
| *** gordc has quit IRC | 12:54 | |
| tomoiaga | I'm wondering if there is a way as an admin to generate a token on behalf of another user. I'm trying to avoid the need for a user to log in to keystone if he's already logged in someplace else (not LDAP or Kerberos, just a simple Django app). | 12:58 |
| tomoiaga | right now I can scope that token to a project and work that way, but I don't necessarly like that solution | 12:59 |
| *** saipandi has quit IRC | 13:02 | |
| *** bknudson has quit IRC | 13:05 | |
| *** alex_xu has joined #openstack-keystone | 13:07 | |
| *** nkinder has quit IRC | 13:14 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Split up assignments, making role-assignments pluggable. https://review.openstack.org/129397 | 13:19 |
| *** richm has joined #openstack-keystone | 13:21 | |
| *** nellysmitt has quit IRC | 13:24 | |
| *** bknudson has joined #openstack-keystone | 13:25 | |
| *** david-lyle has joined #openstack-keystone | 13:25 | |
| *** ajayaa has joined #openstack-keystone | 13:27 | |
| *** david-lyle has quit IRC | 13:29 | |
| *** shikui__ has quit IRC | 13:30 | |
| *** thedodd has joined #openstack-keystone | 13:32 | |
| *** ajayaa has quit IRC | 13:33 | |
| *** joesavak has joined #openstack-keystone | 13:39 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Refactor keystone-all and http/keystone https://review.openstack.org/62275 | 13:43 |
| *** topol has joined #openstack-keystone | 13:48 | |
| *** gordc has joined #openstack-keystone | 13:48 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Entrypoints for commands https://review.openstack.org/131435 | 13:51 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:53 | |
| *** ttw has quit IRC | 13:57 | |
| *** dims__ has quit IRC | 14:04 | |
| *** nkinder has joined #openstack-keystone | 14:05 | |
| *** vhoward has left #openstack-keystone | 14:07 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone-specs: Authenticated Encryption Tokens https://review.openstack.org/130050 | 14:10 |
| *** vejdmn has joined #openstack-keystone | 14:15 | |
| *** miqui has quit IRC | 14:25 | |
| *** david-lyle has joined #openstack-keystone | 14:26 | |
| *** vejdmn has quit IRC | 14:27 | |
| *** vejdmn1 has joined #openstack-keystone | 14:27 | |
| *** radez_g0n3 is now known as radez | 14:29 | |
| *** david-lyle has quit IRC | 14:31 | |
| *** thedodd has quit IRC | 14:33 | |
| *** miqui has joined #openstack-keystone | 14:37 | |
| *** alex_xu has quit IRC | 14:41 | |
| *** ayoung has joined #openstack-keystone | 14:42 | |
| *** ayoung has quit IRC | 14:46 | |
| *** saipandi has joined #openstack-keystone | 14:50 | |
| *** vejdmn has joined #openstack-keystone | 14:52 | |
| *** vejdmn1 has quit IRC | 14:53 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 14:55 |
| *** ayoung has joined #openstack-keystone | 15:00 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make tests run against original client and session https://review.openstack.org/117089 | 15:03 |
| *** david-lyle has joined #openstack-keystone | 15:05 | |
| *** ukalifon1 has quit IRC | 15:10 | |
| *** nellysmitt has joined #openstack-keystone | 15:12 | |
| *** chrisshattuck has joined #openstack-keystone | 15:13 | |
| *** tomoiaga has quit IRC | 15:17 | |
| richm | If using keystone with ldap for the identity backend, what are LDAP groups (ou=groups) used for? | 15:18 |
| richm | keystone project/tenant == ldap group? | 15:20 |
| ayoung | richm, Keystone user groups | 15:21 |
| ayoung | richm, no, identity is users and groups. Either can get role assignments | 15:21 |
| richm | http://docs.openstack.org/admin-guide-cloud/content/configuring-keystone-for-ldap-backend.html | 15:21 |
| richm | seems to imply that tenants and roles are part of the identity backend | 15:22 |
| ayoung | they used to be, but we split them out. Keystone is the "identiyt" api but I'm referring to the identity backend, separate from assignments backend, so a subset of Keystone | 15:22 |
| ayoung | richm, but that looks old and outdated | 15:22 |
| ayoung | richm, each time I think we have the docs straight, I get another link to something with old info | 15:23 |
| richm | so if I have ldap for the identity backend, and sql for the assignment backend, what would cause a lookup in ldap for (member=uid=myuserid,ou=people,dc=example,dc=com) in ou=groups,dc=example,dc=com? | 15:24 |
| ayoung | richm, the token process goes like this: | 15:24 |
| ayoung | 1. authenticate (ldap query) 2. get groups for the user (ldap query) 3. resolve role assignements for user and roles. ....etc | 15:25 |
| *** jorge_munoz has joined #openstack-keystone | 15:25 | |
| ayoung | richm, are you using v2 or v3? | 15:26 |
| richm | # cat /root/keystonerc_admin | 15:26 |
| ayoung | dman cats | 15:27 |
| richm | export OS_AUTH_URL=http://localhost:5000/v2.0/ | 15:27 |
| ayoung | OK, so v2 | 15:27 |
| ayoung | if you are using the keystone cli that is also pretty much constrained to v2 | 15:27 |
| ayoung | so... | 15:27 |
| ayoung | that hits the token controller (we split auth between v2 and v3, into two packages, which was a mistake, but anyway....) | 15:28 |
| richm | different but related question - let's say I want to set up an ldap server to be used as the read-only identity backend for keystone - what do I put in ou=groups? | 15:28 |
| ayoung | the token controller starts roughly here http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/controllers.py | 15:28 |
| ayoung | richm, FreeIPA setup? | 15:28 |
| richm | ayoung: that too, but I'm assuming plain ldap will probably be simpler | 15:28 |
| ayoung | FreeIPA pretty simple...for that I have... | 15:29 |
| richm | but are you first installing keystone with sql for identity and assignment, then "moving" the service accounts into ldap/ipa while at the same time changing keystone to use ldap for identity? | 15:30 |
| *** chrisshattuck has quit IRC | 15:30 | |
| ayoung | richm, nah, don' | 15:30 |
| ayoung | t move nothing | 15:30 |
| ayoung | leave the service users in SQL | 15:30 |
| ayoung | richm, http://adam.younglogic.com/2014/08/getting-service-users-out-of-ldap/ | 15:30 |
| richm | but that assumes multiple domain support | 15:30 |
| ayoung | group_tree_dn=cn=groups,cn=accounts,dc=ipa,dc=cloudlab,dc=freeipa,dc=org | 15:30 |
| ayoung | yep | 15:30 |
| ayoung | richm, but that is where we are going | 15:31 |
| ayoung | ask nkinder : we're going V3 eerywhere, and pushing the use of the openstack common client | 15:31 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Create a framework for federation plugins https://review.openstack.org/130564 | 15:31 |
| richm | yes, but I would also like to try to handle the case where users may not yet be on that version that supports v3 | 15:31 |
| ayoung | richm, That is OK. | 15:32 |
| richm | unfortunately puppet has a lot of hardcoded references to v2.0 | 15:32 |
| ayoung | richm, with LDAP, you can make the LDAP domain the default domain. It just means that the remote endpoints need to use the V3 API to validate tokens etc | 15:32 |
| ayoung | richm, we'll be untangling that for a while | 15:33 |
| richm | right, which is going to be a big problem with puppet | 15:33 |
| ayoung | but we need to cut the puppet strings | 15:33 |
| ayoung | screw Puppet. lets go with Ansible! | 15:33 |
| richm | puppet has ":5000/v2.0" and ":35357/v2.0" hard coded everywhere | 15:33 |
| ayoung | richm, all those need to die anyway | 15:34 |
| richm | because, duh, why would you ever want to do something else? | 15:34 |
| jamielennox | ayoung: speaking of which that middleware stack needed rebasing again: starting https://review.openstack.org/#/c/115857/ can you +a again | 15:34 |
| jamielennox | richm: bah - die /v2.0 | 15:34 |
| ayoung | Oh, I don't know. Maybe becasue port 5000 is assigned to another service and 35357 is ins the middle of the ephemeral range? Perhaps? | 15:34 |
| jamielennox | richm: is that an endpoint and service catalog thing or more? | 15:34 |
| richm | jamielennox: in a few cases, more | 15:35 |
| ayoung | jamielennox, its probably endemic across the puppet modules due to cut-and-pastism | 15:35 |
| jamielennox | damn - we can't do much about the service catalog for now, but that really should be all | 15:35 |
| jamielennox | i guess AUTH_URL still mostly relies on it - for now | 15:35 |
| richm | which brings me back to my original problem - let's say I want to do this with v2.0 without domains - because puppet - how do I set up my ldap backend ahead of time so that I can just do a brand new keystone installation with a read-only identity backend? | 15:35 |
| ayoung | you need the service users in LDAP | 15:36 |
| richm | right | 15:36 |
| ayoung | so...assuming you get them in there somehow, the LDAP config still looks like what I have on my blog | 15:37 |
| ayoung | [ldap] | 15:37 |
| ayoung | url=ldap://ipa.cloudlab.freeipa.org | 15:37 |
| ayoung | user_tree_dn=cn=users,cn=accounts,dc=ipa,dc=cloudlab,dc=freeipa,dc=org | 15:37 |
| ayoung | user_id_attribute=uid | 15:37 |
| ayoung | user_name_attribute=uid | 15:37 |
| ayoung | group_tree_dn=cn=groups,cn=accounts,dc=ipa,dc=cloudlab,dc=freeipa,dc=org | 15:37 |
| ayoung | For AD, there are more values... nkinder does it thusly: https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-ad-setup/vm-post-cloud-init.sh | 15:38 |
| ayoung | https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-ad-setup/vm-post-cloud-init.sh#L56 | 15:38 |
| richm | does anything need to be in ou=groups? | 15:38 |
| *** cjellick has joined #openstack-keystone | 15:38 | |
| ayoung | openstack-config --set /etc/keystone/keystone.conf ldap group_tree_dn cn=users,$VM_AD_SUFFIX | 15:39 |
| ayoung | actually I think that is a typo | 15:39 |
| richm | right - yes - he borrowed most of that stuff from my ad vm setup and ipa/ad/keystone demo scripts | 15:39 |
| *** cjellick has quit IRC | 15:39 | |
| ayoung | richm, is that how AD does groups, or should that be ou=groups,$VM_AD_SUFFIX? | 15:40 |
| richm | cn=users - AD mixes groups in with users | 15:40 |
| ayoung | Ah, OK | 15:40 |
| nkinder | ayoung: yeah, they are mixed | 15:40 |
| ayoung | and how does it do group assignmnets? | 15:40 |
| nkinder | member/memberOf | 15:40 |
| ayoung | is it still member_of | 15:40 |
| ayoung | cool | 15:40 |
| nkinder | except keystone doesn't use memberOf | 15:41 |
| nkinder | which would be more efficient than looking up the groups... | 15:41 |
| ayoung | nkinder, "premature optimization is the root of all evil" --Don Knuth | 15:42 |
| ayoung | Or was it Bjarne Stroustrup? | 15:43 |
| *** cjellick has joined #openstack-keystone | 15:43 | |
| ayoung | Knuth | 15:43 |
| ayoung | nkinder, so I have a running Packstack on horizon.younglogic.net. | 15:44 |
| ayoung | I'm going through the rest of your clolud-init step by step | 15:44 |
| *** edmondsw has quit IRC | 15:47 | |
| *** andreaf has quit IRC | 15:48 | |
| dstanek | ayoung: Stroustrup butchered C | 15:50 |
| ayoung | dstanek, no, he documented the butchery | 15:50 |
| ayoung | it was being butched long before he got his hands on it. | 15:50 |
| ayoung | dstanek, but C is a mess anyway | 15:50 |
| ayoung | https://twitter.com/admiyoung/status/507900170605182976 | 15:51 |
| ayoung | richm, https://bugs.launchpad.net/openstack-manuals/+bug/1386768 | 15:52 |
| uvirtbot | Launchpad bug 1386768 in openstack-manuals "LDAP in OpenStack Cloud Administrator Guide  Needs update for multiple backends" [Undecided,New] | 15:52 |
| ayoung | Feel free to take it! | 15:52 |
| dstanek | ayoung: i love C! beautiful in it's simplicity - it's the programmers that made it suck | 15:53 |
| *** _cjones_ has joined #openstack-keystone | 15:53 | |
| ayoung | dstanek, no, you love a particular subset of C. | 15:53 |
| ayoung | Try writing a compiler, or even a parser for C, and you will start cursing | 15:54 |
| ayoung | not just a subset, but the whole language | 15:54 |
| ayoung | its a Code Golem | 15:54 |
| *** _cjones_ has quit IRC | 15:54 | |
| *** _cjones_ has joined #openstack-keystone | 15:54 | |
| dstanek | ayoung: yeah, i had to write a C parser for a compiler class - i leave that to the GCC guys because I don't care how the sausage is made | 15:55 |
| amakarov | ayoung, http://en.wikipedia.org/wiki/Compilers:_Principles,_Techniques,_and_Tools :) | 15:55 |
| ayoung | amakarov, most of those go out the window with a language that you can't write in BNF | 15:56 |
| ayoung | Like C | 15:56 |
| amakarov | ayoung, I like C too ))) | 15:57 |
| amakarov | just kidding :) | 15:57 |
| ayoung | amakarov, I like C. I like C++. I like Java, and I'm learning to tolerate Python and Javascript. I've done Assembly, COBOL, FORTRAN and Visual Basic during my professional career as well. Every programming language sucks. | 15:58 |
| ayoung | But, as they say in the Army: | 15:59 |
| ayoung | EMBRACE THE SUCK! | 15:59 |
| *** lhcheng has joined #openstack-keystone | 15:59 | |
| *** miqui has quit IRC | 15:59 | |
| *** miqui_ has joined #openstack-keystone | 15:59 | |
| amakarov | ayoung, LOL when I served in army they said: good is good, bad is bad but nothing is even worse | 16:00 |
| ayoung | I like that | 16:00 |
| ayoung | My favorite was "Half Assed, full blast. Don't know where we're going but we shoulda been there yesterday." | 16:00 |
| amakarov | ayoung, I thought only our roads are so bad ) | 16:03 |
| ayoung | I was light infantry. We crossed roads tactically, and stayed in the woods whenever possible. | 16:03 |
| *** gyee has joined #openstack-keystone | 16:04 | |
| amakarov | Quite an experience I'd say. | 16:05 |
| *** marcoemorais has joined #openstack-keystone | 16:08 | |
| *** BAKfr has quit IRC | 16:17 | |
| *** BAKfr has joined #openstack-keystone | 16:18 | |
| *** edmondsw has joined #openstack-keystone | 16:20 | |
| *** stevemar has joined #openstack-keystone | 16:21 | |
| *** miqui_ has quit IRC | 16:26 | |
| *** marcoemorais has quit IRC | 16:32 | |
| *** marcoemorais has joined #openstack-keystone | 16:32 | |
| *** dims__ has joined #openstack-keystone | 16:33 | |
| *** thedodd has joined #openstack-keystone | 16:33 | |
| amakarov | ayoung, help me please! I'm editing trust spec and see references with non-existing URL's | 16:39 |
| amakarov | like this: Relationship:``http://docs.openstack.org/api/openstack-identity/3/ext/OS-TRUST/1.0/rel/trusts`` | 16:40 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/python-keystoneclient-kerberos: kerberos client plugin https://review.openstack.org/123614 | 16:40 |
| amakarov | I think I have to change them, but I don't know correct ones | 16:41 |
| *** marcoemorais has quit IRC | 16:41 | |
| *** harlowja_away is now known as harlowja | 16:46 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:46 | |
| *** chrisshattuck has joined #openstack-keystone | 16:47 | |
| dstanek | in the horizon meeting they are talking dress codes for Paris - this makes me realize that I may be in trouble | 16:48 |
| *** chrisshattuck has joined #openstack-keystone | 16:49 | |
| bknudson | dstanek: they love if you wear black. | 16:49 |
| dstanek | i may have to go buy some nicer pants/shirts :-) | 16:50 |
| jamielennox | all horizon developers must wear a bright yellow beanie at all times | 16:51 |
| amakarov | bknudson, as our horizon guys say they talked about a place to booze where a dress code not so strict ) | 16:51 |
| richm | using the keystone client, given a username or userid, how do I find out which projects/tenants that user "belongs to" (if that is the correct terminology)? | 16:51 |
| dstanek | jamielennox: ++ | 16:52 |
| dstanek | jamielennox: can we wear red? | 16:52 |
| marekd | ayoung: how can you work most of the time in a language that you barely tolerate? :-) | 16:56 |
| amakarov | marekd, maybe there is a Zen in Python? ;) | 16:56 |
| jamielennox | dstanek: might be considered as promoting segregation | 16:56 |
| amakarov | jamielennox, maybe you can help me? Where are http://docs.openstack.org/api/openstack-identity/3/ext/OS-TRUST/1.0/rel/trusts moved to? | 16:58 |
| amakarov | I'm thying to document what I've done to trusts and run into invalid links in docs | 16:59 |
| amakarov | s/thying/trying | 16:59 |
| jamielennox | amakarov: i don't know where they are published to, i always just looked at the sources https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-trust-ext.md | 17:00 |
| jamielennox | github markdown renders them fairly well | 17:00 |
| *** marcoemorais has joined #openstack-keystone | 17:01 | |
| *** marcoemorais has quit IRC | 17:01 | |
| amakarov | jamielennox, thank you | 17:01 |
| *** marcoemorais has joined #openstack-keystone | 17:01 | |
| jamielennox | ayoung: can you kick off https://review.openstack.org/#/c/115857/ again - it had to be rebased, then there are two or three that can be merged after that | 17:02 |
| *** jaosorior has quit IRC | 17:03 | |
| marekd | amakarov: what Zen? | 17:04 |
| amakarov | jamielennox, that's the document I'm about to patch, it itself contains incorrect links | 17:04 |
| marekd | amakarov: ayoung is right - there is no perfect language :( | 17:04 |
| *** marcoemorais has quit IRC | 17:05 | |
| amakarov | marekd, >>> import this | 17:05 |
| marekd | amakarov: with all Python's flexibility it's sometimes frustrating and just ridiculous, esp. with bigger projects. | 17:05 |
| jamielennox | amakarov: ok not sure then | 17:05 |
| marekd | amakarov: seen that | 17:05 |
| *** marcoemorais has joined #openstack-keystone | 17:05 | |
| *** ukalifon has joined #openstack-keystone | 17:06 | |
| amakarov | marekd, IJK :) IMHO language it a tool. There is neither universal tool nor perfect language. | 17:07 |
| *** marcoemorais has quit IRC | 17:07 | |
| dstanek | marekd: the problem i've encountered in bigger projects is that people still do the stupid tricks they do in smaller projects instead of something more like C++/Java | 17:07 |
| *** marcoemorais has joined #openstack-keystone | 17:07 | |
| dstanek | just because you can doesn't mean you should | 17:07 |
| *** marcoemorais has quit IRC | 17:07 | |
| *** marcoemorais has joined #openstack-keystone | 17:08 | |
| *** marcoemorais has quit IRC | 17:08 | |
| *** marcoemorais has joined #openstack-keystone | 17:09 | |
| amakarov | marekd, I like Assembly but I'd never use it for markup ) | 17:09 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Split up assignments and make the assignments piece pluggable https://review.openstack.org/130954 | 17:10 |
| marekd | dstanek: i think it;s because those languages simply enforce people to do that. | 17:13 |
| marekd | dstanek: + i find really inconvenient that e.g. in OpenStack we all endup documenting parameters types...but in docstrings. And it's really up to you or other reviewers if you catch my error if I wrongly document a method or not. | 17:14 |
| dstanek | exactly. left to their own devices programmers will typically use a sledgehammer when they could have used a screwdriver :-) | 17:15 |
| dstanek | except for type that's the same in most other languages | 17:15 |
| *** marcoemorais has quit IRC | 17:15 | |
| marekd | i really wish one day there was a cPython version where you can enforce types. | 17:16 |
| marekd | this is string, and that's int | 17:17 |
| marekd | and dear Python, please take care of that. | 17:17 |
| dstanek | marekd: http://www.infoq.com/news/2014/08/python-type-annotation-proposal | 17:18 |
| marekd | dstanek: i have seen that. | 17:19 |
| marekd | :-) | 17:19 |
| ayoung | marekd, Type safety is the thing I miss the most | 17:19 |
| marekd | dstanek: and you, what are your preffered languages apart from Python? | 17:19 |
| marekd | anybody tried Go already? | 17:19 |
| *** marcoemorais has joined #openstack-keystone | 17:20 | |
| dstanek | i like C and GO - erlang to some extent | 17:20 |
| ayoung | jamielennox, https://review.openstack.org/#/c/115857/8..9/keystonemiddleware/auth_token.py,cm did we lost IPv6 specific code? Intentionally? | 17:21 |
| *** ukalifon has quit IRC | 17:21 | |
| morganfainberg | dstanek: we should write keystone in earlang | 17:22 |
| dstanek | morganfainberg: not i :-) bigger apps in erlang make my head spin | 17:22 |
| dstanek | morganfainberg: functional is cool, but i can't really think that way yet | 17:23 |
| morganfainberg | marekd: I was working on go a few weeks ago digging into why a lib only worked for rax cloud | 17:23 |
| morganfainberg | Turns out, no "real" region support. | 17:23 |
| dstanek | morganfainberg: i thought that maybe it was just too awesome | 17:23 |
| morganfainberg | dstanek: I had to work on ejabberd. It did make my head spin. | 17:24 |
| morganfainberg | Wonder if we could replace rabbitmq with ejabberd. | 17:24 |
| *** vejdmn has quit IRC | 17:25 | |
| dstanek | yes, but you might have to build in a little extra queue specific logic | 17:25 |
| *** vejdmn has joined #openstack-keystone | 17:25 | |
| dstanek | i've used ejabberd as a queue in a prior life | 17:25 |
| morganfainberg | it might be more stable >.> | 17:25 |
| * morganfainberg kinda wants to look into it :P | 17:26 | |
| morganfainberg | see how hard it would be to write an oslo.messaging driver that would do what is needed | 17:26 |
| morganfainberg | ejabberd clustering is pretty spot on. | 17:26 |
| dstanek | the python libraries for it sucked when i last used it | 17:26 |
| morganfainberg | fair enough | 17:28 |
| *** stevemar is now known as notstevemar | 17:29 | |
| notstevemar | dstanek, morganfainberg review request :) https://review.openstack.org/#/c/131268/ | 17:30 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Correct use of noqa https://review.openstack.org/131274 | 17:30 |
| dstanek | notstevemar: tell stevemar that it looks good | 17:36 |
| notstevemar | dstanek, will do | 17:36 |
| openstackgerrit | Mehdi Abaakouk proposed a change to openstack/keystone-specs: tokens swift persistent backend https://review.openstack.org/131515 | 17:39 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds a wip decorator for tests https://review.openstack.org/131516 | 17:42 |
| openstackgerrit | Matthew Edmonds proposed a change to openstack/keystone: Adds IPv6 url validation support https://review.openstack.org/131326 | 17:43 |
| dstanek | ayoung: ^ not exactly what you wanted, but based on what i have done in the past | 17:43 |
| ayoung | dstanek, Adds IPv6 url validation support ? | 17:45 |
| *** amcrn has joined #openstack-keystone | 17:46 | |
| *** morganfainberg is now known as alsonotstevemar | 17:46 | |
| alsonotstevemar | I like this trend | 17:46 |
| *** alsonotstevemar is now known as morganfainberg | 17:47 | |
| dstanek | ayoung: no the wip decorator | 17:52 |
| openstackgerrit | Matthew Edmonds proposed a change to openstack/keystone: Adds IPv6 url validation support https://review.openstack.org/131326 | 17:53 |
| *** henrynash has joined #openstack-keystone | 17:58 | |
| *** marcoemorais has quit IRC | 17:59 | |
| *** marcoemorais has joined #openstack-keystone | 17:59 | |
| *** marcoemorais has quit IRC | 18:01 | |
| *** marcoemorais has joined #openstack-keystone | 18:01 | |
| *** marcoemorais has quit IRC | 18:01 | |
| bknudson | looking at http://www.infoq.com/news/2014/08/python-type-annotation-proposal -- python will turn into C++ or Java soon enough | 18:02 |
| *** marcoemorais has joined #openstack-keystone | 18:02 | |
| ekarlso | just as wel.. | 18:05 |
| ekarlso | not having to check stuff all over the place | 18:05 |
| openstackgerrit | werner mendizabal proposed a change to openstack/keystone-specs: Multifactor Authentication https://review.openstack.org/130376 | 18:08 |
| openstackgerrit | Matthew Edmonds proposed a change to openstack/keystone: Adds IPv6 url validation support https://review.openstack.org/131326 | 18:09 |
| *** cds has joined #openstack-keystone | 18:09 | |
| dstanek | lbragstad: did you see my note here: https://review.openstack.org/#/c/125738/13/keystone/token/controllers.py ? | 18:11 |
| *** ukalifon has joined #openstack-keystone | 18:11 | |
| dstanek | jamielennox: ^ | 18:11 |
| lbragstad | dstanek: yep, I did | 18:11 |
| lbragstad | I was going to try it and possibly dig into it a bit | 18:12 |
| lbragstad | see if there is a test we can add, or if we can just remove that? | 18:12 |
| lbragstad | dstanek: maybe in a subsequent patch? | 18:12 |
| jamielennox | dstanek: i honestly can't remember | 18:12 |
| *** amerine_ has quit IRC | 18:12 | |
| jamielennox | i think one came through as an empty list rather than an empty dict in XML | 18:12 |
| jamielennox | if you didn't specify any auth | 18:12 |
| lbragstad | interesting | 18:12 |
| jamielennox | kind of makes sense, XML has no way to distinguish what should go between empty tags | 18:13 |
| lbragstad | I was wondering if it was something like but wasn't completely sure | 18:13 |
| jamielennox | makes sense in like an "oh XML" kind of way | 18:13 |
| openstackgerrit | Matthew Edmonds proposed a change to openstack/keystone: Adds IPv6 url validation support https://review.openstack.org/131326 | 18:15 |
| lbragstad | jamielennox: so you agree it can be omitted? | 18:15 |
| *** amerine has joined #openstack-keystone | 18:15 | |
| jamielennox | lbragstad: i'm surprised that no tests pick it up, if they don't i think it's ok to remove | 18:17 |
| jamielennox | it's been there a long time so the problem may have been fixed higher up | 18:17 |
| lbragstad | jamielennox: sounds good, thanks for the input | 18:18 |
| dstanek | lbragstad: i only tested removing from your patch - if it's XML related i would expect test failures if it's removed from master | 18:18 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: I18n https://review.openstack.org/131199 | 18:18 |
| lbragstad | dstanek: but the tests are removed from my patch as well? | 18:20 |
| dstanek | lbragstad: you mean the XML ones? | 18:20 |
| jamielennox | bknudson: i saw that ^ and some of the other docs changes - they're fine but i'm hoping to push through this auth_token change before approving them because they'll be easier to rebase than the plugin one | 18:20 |
| jamielennox | well ^ is the -client one, but i saw the middleware one as well | 18:20 |
| dstanek | lbragstad: that why i think it would/should fail if you removed those lines from master | 18:21 |
| lbragstad | dstanek: yeah, the XML ones | 18:21 |
| lbragstad | oh, right | 18:21 |
| lbragstad | dstanek: sorry, I misunderstood you | 18:21 |
| dstanek | lbragstad: :-) np | 18:21 |
| lbragstad | dstanek: was it you or bknudson who was interested in running coverage before and after the XML removal patch? | 18:21 |
| bknudson | lbragstad: I did it. | 18:22 |
| dstanek | lbragstad: probably bknudson, but i'd also be interested | 18:22 |
| lbragstad | bknudson: do you recall what the coverage was? | 18:22 |
| bknudson | lbragstad: and didn't notice anything that's not checked now that was before | 18:22 |
| lbragstad | bknudson: interesting... so the XML cases weren't tested? | 18:23 |
| bknudson | lbragstad: no, they weren't testing anything new | 18:23 |
| dstanek | lbragstad: i removed the lines from master and have the test running now | 18:23 |
| jamielennox | lbragstad: more likely they were tested by XML and something else as well | 18:23 |
| jamielennox | the something else will keep the coverage the same | 18:23 |
| lbragstad | dstanek: cool | 18:24 |
| lbragstad | jamielennox: gotcha, makes sense | 18:24 |
| bknudson | to give an example, if we remove the keystoneclient master tests then there will be things that aren't being tested. | 18:24 |
| dstanek | anyone like regexes (or torture:) https://review.openstack.org/131326 | 18:24 |
| jamielennox | bknudson: :( | 18:24 |
| bknudson | so we should write some new tests and then delete the keystoneclient tests. | 18:24 |
| jamielennox | bknudson: :) | 18:25 |
| *** amerine_ has joined #openstack-keystone | 18:26 | |
| jamielennox | dstanek: that's crazy - i thought there was a jsonschema IPv6 field | 18:26 |
| dstanek | jamielennox: no idea - i haven't looked yet | 18:27 |
| jamielennox | there is a lbragstad note above it, something about GPL | 18:27 |
| lbragstad | jamielennox: yep | 18:27 |
| lbragstad | so jsonshema uses rfc3987 | 18:27 |
| jamielennox | i'm surprised that jsonschema can depend on it then | 18:27 |
| lbragstad | which is GPL licensed and we couldn't get it into global requirements | 18:28 |
| amakarov | Is here anybody related to /openstack/keystone-specs project? I've just compiled it and found out that external links are broken | 18:28 |
| jamielennox | or at least it seems like jsonschema's llicensing issue | 18:28 |
| dstanek | lbragstad: jamielennox: looks like XML passed in an emtpy string for auth: http://paste.openstack.org/show/126076/ | 18:29 |
| marekd | gyee: did you have any luck running adfs w/ Keystone? | 18:29 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 18:29 |
| lbragstad | dstanek: sweet, thanks for running tat | 18:29 |
| lbragstad | that* | 18:29 |
| *** amerine has quit IRC | 18:29 | |
| lbragstad | dstanek: removed in the latest patch ^ | 18:29 |
| gyee | marekd, I have try the client part yet | 18:30 |
| gyee | on my todo list | 18:30 |
| *** thedodd has quit IRC | 18:30 | |
| gyee | marekd, the apache setup works great, thanks for the tips! | 18:30 |
| marekd | gyee: no problem. | 18:30 |
| lbragstad | dstanek: that regex is insane | 18:32 |
| *** packet has joined #openstack-keystone | 18:34 | |
| dstanek | lbragstad: yeah, there are lots of examples on the interwebs so it's just about comparing http://bit.ly/1wzxrsX | 18:35 |
| lbragstad | dstanek: I think I saw one that was similar on stackoverflow or something like that | 18:36 |
| lbragstad | https://gist.github.com/mnordhoff/2213179 | 18:37 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:38 | |
| *** marcoemorais has quit IRC | 18:40 | |
| *** ukalifon has quit IRC | 18:40 | |
| *** amerine has joined #openstack-keystone | 18:45 | |
| *** amerine_ has quit IRC | 18:46 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update docs to no longer show XML support https://review.openstack.org/125753 | 18:56 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Alembic for SQL migrations https://review.openstack.org/131531 | 18:57 |
| *** marcoemorais has joined #openstack-keystone | 18:59 | |
| dstanek | just missed it! | 19:00 |
| morganfainberg | dstanek, , yeah sorry | 19:00 |
| morganfainberg | i like log.warning | 19:00 |
| dstanek | :) I just thought of it | 19:00 |
| morganfainberg | but honestly, i don't care enough to say it needs to be one way or another unless oslo.log cares | 19:01 |
| dstanek | I agree but the question was asked for I thought I'd bring it up | 19:01 |
| *** joesavak has quit IRC | 19:03 | |
| morganfainberg | ok i think i'm going to change the no-spec thing to allow people to add BPs for review | 19:04 |
| morganfainberg | rather than "we review the BPs" | 19:04 |
| *** joesavak has joined #openstack-keystone | 19:05 | |
| *** topol has quit IRC | 19:06 | |
| *** cjellick has quit IRC | 19:08 | |
| jamielennox | ayoung: kick along https://review.openstack.org/#/c/115857/9 please | 19:08 |
| ayoung | jamielennox, done | 19:09 |
| ayoung | jamielennox, https://review.openstack.org/#/c/129868/6 too? | 19:10 |
| *** marcoemorais has quit IRC | 19:10 | |
| jamielennox | ayoung: there there are a couple there with two +2s | 19:10 |
| jamielennox | if you don't i willl | 19:10 |
| ayoung | good to go | 19:10 |
| ayoung | one, first 3 are covered | 19:11 |
| ayoung | jamielennox, https://review.openstack.org/#/c/130531/4 eneds another +2 morganfainberg bknudson gyee please | 19:11 |
| gyee | ayoung, change looks good, but no tests? | 19:15 |
| gyee | jamielennox, what's this auth.AUTH_INTERFACE magic? | 19:15 |
| jamielennox | gyee: has been around for a while - essentially returns the AUTH_URL | 19:16 |
| gyee | its declared as an object() | 19:16 |
| gyee | so its a special marker? | 19:16 |
| jamielennox | yes | 19:16 |
| jamielennox | needed because we still have routes that have to be sent to the auth interface rather than reading from the service catalog | 19:16 |
| jamielennox | also because my service catalog in unscoped didn't get picked up - so you need to be able to request things to go to the auth_url | 19:17 |
| gyee | k, I see what you did there | 19:17 |
| gyee | clever :) | 19:17 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:18 | |
| jamielennox | gyee: so it's a bit hard to put tests in there because the exact values returned by that function change over the next few patches | 19:19 |
| jamielennox | I've considered the fact that i changed something so significant and it passes the existing tests and the gate to be proof that there has been no functional changes | 19:19 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 19:19 | |
| gyee | jamielennox, k, wfe | 19:20 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: I18n https://review.openstack.org/131287 | 19:20 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds a wip decorator for tests https://review.openstack.org/131516 | 19:21 |
| jamielennox | if you look at https://review.openstack.org/#/c/130533/4/keystonemiddleware/auth_token.py querying the actual keystone server moves into that function so the tests would have to change | 19:21 |
| gyee | if there's a problem with the gates, we'll blame the newly minted QA liaison :D | 19:21 |
| jamielennox | gyee: works for me | 19:22 |
| jamielennox | gyee: keep going down the chain, the next one: https://review.openstack.org/#/c/130247/5 is super easy | 19:23 |
| ayoung | jamielennox, nkinder is it OK if I just revert the param to None for the kerberos patch, and let if fail that way? | 19:25 |
| jamielennox | ayoung: i was just looking at that one i was going to make it raise a RuntimeError | 19:26 |
| ayoung | deal | 19:26 |
| ayoung | jamielennox, I'll let you submit, then | 19:26 |
| jamielennox | dstanek had the -1 if you can explain it past him i don't mind | 19:26 |
| jamielennox | maybe we just follow dstanek's advice | 19:27 |
| jamielennox | ayoung: i had the default in there because it technically should be a kwarg - but it will make no real difference so long as it's called correctly | 19:28 |
| jamielennox | (which it is because it's always keystoneclient that calls it) | 19:28 |
| ayoung | ++ | 19:28 |
| jamielennox | can i use utils.positional here? | 19:30 |
| jamielennox | from ksc? do we consider ksc.utils public? | 19:31 |
| *** gyee has quit IRC | 19:31 | |
| ayoung | jamielennox, I don't think auth_token uses it | 19:32 |
| ayoung | other than that, I can't say | 19:32 |
| jamielennox | yea - i've never wanted to rely on it outside of ksc | 19:32 |
| ayoung | richm, do you still have the Keystone LDAP Puppet issue? | 19:33 |
| richm | ayoung: yeah | 19:33 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient-kerberos: kerberos client plugin https://review.openstack.org/123614 | 19:33 |
| *** amerine has quit IRC | 19:33 | |
| *** amerine has joined #openstack-keystone | 19:34 | |
| *** cjellick has joined #openstack-keystone | 19:35 | |
| dstanek | jamielennox: -1 on what? | 19:35 |
| jamielennox | dstanek: the kerberos plugin ^ | 19:35 |
| *** cjellick has quit IRC | 19:35 | |
| jamielennox | i did what you suggested, just remove the default. Technically it's a required keyword argument which keystone 2 can't express | 19:36 |
| *** cjellick has joined #openstack-keystone | 19:36 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 19:36 |
| dstanek | jamielennox: yeah, just took a look and it looks much better | 19:36 |
| bknudson | keystone 2? | 19:37 |
| morganfainberg | bknudson, keystone 4 | 19:37 |
| morganfainberg | oh sorry was thinking we were just tossing numbers out there | 19:37 |
| bknudson | at least we dropped 2.6 | 19:38 |
| *** pack3t has joined #openstack-keystone | 19:39 | |
| *** pack3t has quit IRC | 19:39 | |
| amakarov | morganfainberg, good day! I've done some docs modifications, and have a question for now: what to do with broken links on the pages? | 19:42 |
| amakarov | morganfainberg, file a bug or fix in place? | 19:43 |
| *** marcoemorais has joined #openstack-keystone | 19:43 | |
| morganfainberg | broken links? | 19:44 |
| *** amerine has quit IRC | 19:44 | |
| morganfainberg | amakarov, ^ | 19:44 |
| amakarov | morganfainberg, I'm about https://review.openstack.org/131541 there are plenty of links to nowhere. For example: | 19:46 |
| amakarov | Create trustPOST /OS-TRUST/trusts | 19:46 |
| amakarov | Relationship: http://docs.openstack.org/api/openstack-identity/3/ext/OS-TRUST/1.0/rel/trusts | 19:46 |
| amakarov | oops | 19:46 |
| amakarov | Relationship: http://docs.openstack.org/api/openstack-identity/3/ext/OS-TRUST/1.0/rel/trusts | 19:46 |
| amakarov | morganfainberg, I presume it's something old | 19:47 |
| morganfainberg | where is that link hiding? | 19:47 |
| * morganfainberg isn't seeing it | 19:47 | |
| morganfainberg | oh | 19:47 |
| morganfainberg | interesting | 19:47 |
| amakarov | morganfainberg, it's in keystone-specs | 19:47 |
| morganfainberg | Relationship: http://docs.openstack.org/api/openstack-identity/3/ext/OS-TRUST/1.0/rel/trust_role | 19:47 |
| morganfainberg | ooooooo | 19:48 |
| morganfainberg | uh | 19:48 |
| morganfainberg | amakarov, we might need to work on that | 19:49 |
| morganfainberg | hmmm | 19:49 |
| amakarov | morganfainberg, does it block trust redelegation issue? | 19:49 |
| morganfainberg | bknudson, ayoung, ping- in our docs "Relationship: http://docs.openstack.org/api/openstack-identity/3/ext/OS-TRUST/1.0/rel/trust_role " should that *point* to something? | 19:50 |
| morganfainberg | bknudson, ayoung, http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-trust-ext.html#check-if-role-is-delegated-by-a-trust | 19:50 |
| morganfainberg | for example is where that is | 19:50 |
| dolphm | amakarov: they're not intended to be working links, they're just namespaces | 19:50 |
| morganfainberg | dolphm, ah | 19:50 |
| morganfainberg | amakarov, no it wouldn't block the review in either case | 19:50 |
| amakarov | dolphm, a relief ) | 19:50 |
| ayoung | morganfainberg, yes | 19:51 |
| bknudson | morganfainberg: the relationship doesn't have to point to anything. It's just an ID. | 19:51 |
| amakarov | morganfainberg, thanks, got it | 19:51 |
| morganfainberg | bknudson, yep. | 19:51 |
| bknudson | similar to the XML namespace id. | 19:51 |
| amakarov | can somebody suggest what else to write in the docs? | 19:52 |
| morganfainberg | ah | 19:52 |
| amakarov | https://review.openstack.org/131541 | 19:52 |
| *** ukalifon1 has joined #openstack-keystone | 19:53 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 19:56 |
| dstanek | nkinder: do you have an easy way to test https://review.openstack.org/#/c/123614 against a live setup? | 19:59 |
| nkinder | dstanek: for me to test it, or for you to set up an environment to test it? | 20:00 |
| dstanek | nkinder: either - do you test by hand or do you have some scripts? | 20:01 |
| nkinder | dstanek: it's all scripted - https://github.com/nkinder/rdo-vm-factory | 20:01 |
| nkinder | dstanek: the scripts are based on Fedora 20+ or RHEL7 | 20:02 |
| dstanek | nkinder: neat, i'll check that out | 20:02 |
| dstanek | nkinder: thanks | 20:02 |
| nkinder | dstanek: on a F20 system with enough memory, you can clone that repo and just run setup.sh in rdo-kerberos-setup to build it all | 20:02 |
| ayoung | dstanek, I do | 20:02 |
| ayoung | you can hit the keystone server a keystone.younglogic.net | 20:02 |
| nkinder | dstanek: I'll test the latest patch this afternoon too | 20:02 |
| ayoung | dstanek, pretty sure I already gave you an account | 20:03 |
| ayoung | dstanek, nope, not yet...I'll give you one | 20:03 |
| *** amakarov is now known as amakarov_away | 20:04 | |
| ayoung | dstanek, sent you login info in a PM. Headed home now, will be aback online in a bit | 20:07 |
| *** ayoung has quit IRC | 20:07 | |
| *** thedodd has joined #openstack-keystone | 20:08 | |
| *** nkinder has quit IRC | 20:08 | |
| *** ukalifon1 has quit IRC | 20:28 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 20:30 | |
| r1chardj0n3s | morning | 20:30 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone-specs: API documentation for Hierarchical Multitenancy https://review.openstack.org/130103 | 20:31 |
| rodrigods | morganfainberg, henrynash nice comment from bknudson in the HM API spec | 20:32 |
| rodrigods | should we only allow disable a leaf project? | 20:33 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: I18n https://review.openstack.org/131199 | 20:33 |
| jamielennox | bknudson: what is the DocImpact of https://review.openstack.org/#/c/131199/ | 20:33 |
| bknudson | jamielennox: document that it's supported now and how to enable it. | 20:37 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient-kerberos: kerberos client plugin https://review.openstack.org/123614 | 20:37 |
| jamielennox | bknudson: ok, that's fair enough | 20:37 |
| bknudson | jamielennox: I actually don't know what you have to do to enable it... since we call it from keystoneclient and keystonemiddleware maybe we have to call something. | 20:38 |
| bknudson | I mean we call keystoneclient from keystone | 20:38 |
| jamielennox | bknudson: i have no idea - this is what i mean by we'd never looked at i18n for libraries. I'm *guessing* that you must do a global setting when you start keystone that translates to everything you import as well -? | 20:39 |
| *** david-lyle has quit IRC | 20:48 | |
| *** radez is now known as radez_g0n3 | 20:51 | |
| openstackgerrit | A change was merged to openstack/keystone: Use oslo.concurrency instead of sync'ed version https://review.openstack.org/131268 | 20:59 |
| *** lhcheng has quit IRC | 20:59 | |
| *** marcoemorais has quit IRC | 21:01 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:01 | |
| *** joesavak has quit IRC | 21:11 | |
| *** nkinder has joined #openstack-keystone | 21:12 | |
| *** nellysmitt has quit IRC | 21:16 | |
| openstackgerrit | Anne Gentle proposed a change to openstack/keystone-specs: Adds v2.0 files for api spec https://review.openstack.org/131315 | 21:18 |
| *** harlowja is now known as harlowja_away | 21:21 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Provide useful info when parsing policy file https://review.openstack.org/131574 | 21:24 |
| morganfainberg | lbragstad, ayoung, dstanek, nkinder, topol, stevemar, notstevemar, dolphm, bknudson, jamielennox, gyee, henrynash, http://kilodesignsummit.sched.org/event/bc0a9cdc4f3b190cf83214fc5f07c3cd | 21:32 |
| dolphm | morganfainberg: cool! | 21:32 |
| morganfainberg | cross project workshop, highly recommend everyone show up if possible :) | 21:32 |
| bknudson | 3 attendees already! | 21:33 |
| morganfainberg | it *might* change timeslot, but that is based on russel's recent email to -dev | 21:33 |
| russellb | i hope not to move stuff | 21:33 |
| russellb | unless it's really bad | 21:33 |
| russellb | but yeah, you guys basically have 2 sessions in a row | 21:34 |
| russellb | morganfainberg: i have you listed as the lead for both | 21:34 |
| russellb | unless you say otherwise | 21:34 |
| morganfainberg | russellb, hehe ok | 21:34 |
| morganfainberg | oh woot we got the policy discussion one! | 21:34 |
| russellb | yeah | 21:34 |
| morganfainberg | yay! | 21:34 |
| morganfainberg | :) | 21:34 |
| morganfainberg | same group: http://kilodesignsummit.sched.org/event/0cc08a23b52afbb8d3526d530806c6c2 | 21:34 |
| *** saipandi has quit IRC | 21:35 | |
| morganfainberg | russellb, thats good, we can take those and get the keystone-specifics worked on in our dedidcated session then / more focused | 21:35 |
| morganfainberg | russellb, likely it'll be me, ayoung, nkinder leading the policy one (provided both of them can make it) | 21:35 |
| morganfainberg | same as the keystone focused one. | 21:36 |
| russellb | morganfainberg: just update https://etherpad.openstack.org/p/kilo-crossproject-summit-topics | 21:36 |
| russellb | as you see fit | 21:36 |
| russellb | need descriptions too | 21:36 |
| morganfainberg | yep. | 21:36 |
| morganfainberg | do you want me to create the dedicated etherpads for these? | 21:36 |
| nkinder | morganfainberg: I'll be there for the policy one for sure | 21:36 |
| openstackgerrit | Jorge Munoz proposed a change to openstack/keystone-specs: Refresh Token spec https://review.openstack.org/131575 | 21:38 |
| morganfainberg | nkinder, added http://kilodesignsummit.sched.org/event/061876b56285e8a46443bc3bf730031b | 21:39 |
| morganfainberg | the link at the top of that sched.org description | 21:39 |
| ekarlso | jamielennox: how did the cli plugin stuff end ? | 21:40 |
| lbragstad | morganfainberg: awesome | 21:40 |
| morganfainberg | so people know we are doing the more focused work in the keystone session | 21:40 |
| morganfainberg | russellb, let me go get lunch and i'll get some stuff updated for you / descriptions /etc | 21:41 |
| russellb | morganfainberg: thanks! | 21:41 |
| *** packet has quit IRC | 21:42 | |
| *** marcoemorais1 has quit IRC | 21:42 | |
| *** marcoemorais has joined #openstack-keystone | 21:45 | |
| *** tellesnobrega_ has joined #openstack-keystone | 21:45 | |
| *** harlowja_away is now known as harlowja | 21:46 | |
| *** dims__ has quit IRC | 21:46 | |
| richm | the base puppet keystone ldap identity backend install is working - there must be a problem in my multi-domain patches - investigating | 21:47 |
| *** lhcheng has joined #openstack-keystone | 21:47 | |
| *** marcoemorais has quit IRC | 21:48 | |
| nkinder | richm: interesting... | 21:48 |
| *** marcoemorais has joined #openstack-keystone | 21:48 | |
| nkinder | richm: I haven't gotten a setup fully going with your patches yet | 21:48 |
| *** tellesnobrega_ has quit IRC | 21:50 | |
| *** david-lyle has joined #openstack-keystone | 21:53 | |
| dolphm | morganfainberg: already aware of the schedule conflict for keystone feature adoption? | 21:55 |
| *** vejdmn has quit IRC | 21:55 | |
| richm | I'll send you my working patches - at least you can get up and running with full read-write ldap identity backend | 21:55 |
| morganfainberg | dolphm, with? | 21:55 |
| dolphm | morganfainberg: Congress http://kilodesignsummit.sched.org/event/e82e30d5f2c961a4f9d8641833b1715d | 21:56 |
| morganfainberg | hmm | 21:56 |
| dolphm | morganfainberg: http://kilodesignsummit.sched.org/event/bc0a9cdc4f3b190cf83214fc5f07c3cd | 21:56 |
| morganfainberg | russellb, ^ | 21:56 |
| dolphm | not critical, but definitely an overlap in target audience | 21:56 |
| morganfainberg | dolphm, yeah was looking at my schedule still. | 21:56 |
| *** tellesnobrega_ has joined #openstack-keystone | 21:56 | |
| morganfainberg | russellb, not sure if we can move (as dolphm said not super critical) but congress has expressed interest in collaborating and we have a genuine overlap in audience | 21:57 |
| dolphm | i'd suggest swapping Congress with Kolla http://kilodesignsummit.sched.org/event/14b3884522b5501a71404b481d5b45f1 | 21:58 |
| russellb | this for the policy thing? | 21:58 |
| russellb | so ... help me understand the overlap in "policy" | 21:58 |
| russellb | i took your policy thing to be related to policy.json type policy | 21:58 |
| morganfainberg | russellb, the keystone feature adoption overlaps with congress session | 21:58 |
| russellb | API RBAC like policy | 21:58 |
| morganfainberg | russellb, congress is a project focused on poilicy, which | 21:59 |
| russellb | oh that one. | 21:59 |
| morganfainberg | yeah | 21:59 |
| russellb | congress scope isn't entirely clear to me, honestly | 21:59 |
| morganfainberg | its timeslot overlap | 21:59 |
| russellb | the scope seems .... very big. | 21:59 |
| dolphm | yep, it's oslo.policy but a service | 21:59 |
| russellb | dolphm: your thing, right? | 21:59 |
| russellb | not congress | 21:59 |
| morganfainberg | russellb, i was planning on showing up and trying to figure that out / help get them pointed | 21:59 |
| dolphm | but i'd fix the issue by tweaking the "Other Projects" track, not the cross project track | 21:59 |
| morganfainberg | russellb, since i *think* they have potential. | 22:00 |
| morganfainberg | dolphm, ah hm. | 22:00 |
| russellb | their "policy" seems different | 22:00 |
| russellb | it's ... | 22:00 |
| morganfainberg | i wonder if we can get that tweaked | 22:00 |
| russellb | yeah. | 22:00 |
| morganfainberg | let me chase down hoge and ttx | 22:00 |
| morganfainberg | if we can't fix it no worries | 22:00 |
| russellb | yeah, see what ttx thinks | 22:00 |
| morganfainberg | keystoen feature > congress imo | 22:00 |
| morganfainberg | for this team that is | 22:01 |
| * russellb nods | 22:01 | |
| russellb | i would think so! | 22:01 |
| dolphm | russellb: oh - i have not looked at congress is a long while. the scope has certainly changed! | 22:01 |
| morganfainberg | dolphm, yeah whoa, it's changed since last i looked | 22:02 |
| *** tellesnobrega_ has quit IRC | 22:02 | |
| morganfainberg | huh | 22:02 |
| dolphm | it sounds like it leans more toward the auditing side | 22:02 |
| russellb | maybe i need to look again | 22:02 |
| morganfainberg | looks like they're mosting business rules "policy" | 22:02 |
| morganfainberg | and auditing | 22:03 |
| morganfainberg | meh, ok nvm | 22:03 |
| russellb | yeah.. | 22:03 |
| dolphm | still conflicts with keystone's interesets | 22:03 |
| morganfainberg | i'll corner some of them and bug them to join our session(s) | 22:03 |
| morganfainberg | or at least visit with us in the PODs | 22:03 |
| russellb | what really struck me is I even saw references to things like, automatically resolving policy violations | 22:03 |
| russellb | that's getting out of control, IMO | 22:03 |
| russellb | and also involving congress in all decisions made to make sure they don't violate policy | 22:03 |
| morganfainberg | russellb, thats just not really doable imo | 22:03 |
| russellb | that was my take | 22:04 |
| russellb | anyway, i really need to take my feedback to congress :) | 22:04 |
| russellb | just haven't had time | 22:04 |
| russellb | maybe a good beer topic next week if i can grab the right person | 22:04 |
| morganfainberg | now if they fit the bill on "holders of policy configs" and "what roles / capabilities can i do with X" or the inverse of "what do i need to have capability wise to do x" that would be useful | 22:04 |
| russellb | right now i just want to make sure i understand their goals properly | 22:04 |
| morganfainberg | but it looks out of the scope i was even thinking of now. | 22:05 |
| morganfainberg | which is largely what the larger-policy topic is about | 22:05 |
| dolphm | morganfainberg: i was thinking the same as you. what's described in the current readme is not what i remember from a wiki / email way back when | 22:05 |
| morganfainberg | the 3 things listed above | 22:05 |
| morganfainberg | anyway | 22:05 |
| morganfainberg | dolphm, you mind co-leading the keystone feature adoption x-project workshop? | 22:06 |
| morganfainberg | dolphm, or should i drag jamielennox into it ;) | 22:06 |
| morganfainberg | [for funsies] | 22:06 |
| dolphm | morganfainberg: except that i'd also like to be in the congress session | 22:06 |
| dolphm | morganfainberg: and yeah, that should be jamielennox :D | 22:06 |
| morganfainberg | dolphm, works for me. i'll drag jamielennox in | 22:06 |
| morganfainberg | we can sync up with the congress "stuff" after | 22:06 |
| dolphm | i'd also like to be in Growth Challenges | 22:07 |
| dolphm | but i'll settle for part 2 | 22:07 |
| morganfainberg | aye | 22:07 |
| *** Gippa has joined #openstack-keystone | 22:08 | |
| morganfainberg | dolphm, sounds good i think we can handle policy [besides we're going to have a keystone session later on it anyway] | 22:09 |
| *** thiagop has quit IRC | 22:09 | |
| morganfainberg | also http://kilodesignsummit.sched.org/event/01bc059c3574746dd8c513843bb19cf3 is fairly interesting. | 22:09 |
| morganfainberg | we might need someone to sit in that one as well. | 22:09 |
| *** thedodd has quit IRC | 22:09 | |
| *** bknudson has quit IRC | 22:11 | |
| morganfainberg | dolphm, http://imgur.com/mnCNjNc omg *explodes head* | 22:16 |
| morganfainberg | i just realized how awful those colors are too | 22:16 |
| *** thedodd has joined #openstack-keystone | 22:19 | |
| morganfainberg | i totally need another sched.org account for "would like to go" calendar vs. "must go" | 22:22 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:24 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/130897 | 22:28 |
| openstackgerrit | Matthew Edmonds proposed a change to openstack/keystone: Adds IPv6 url validation support https://review.openstack.org/131326 | 22:31 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/131122 | 22:33 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/131595 | 22:33 |
| *** david-lyle_ has joined #openstack-keystone | 22:33 | |
| *** thedodd has quit IRC | 22:35 | |
| openstackgerrit | Matthew Edmonds proposed a change to openstack/keystone: Adds IPv6 url validation support https://review.openstack.org/131326 | 22:36 |
| *** david-lyle has quit IRC | 22:36 | |
| *** andreaf has joined #openstack-keystone | 22:37 | |
| *** gyee has joined #openstack-keystone | 22:39 | |
| *** david-lyle has joined #openstack-keystone | 22:41 | |
| nkinder | dstanek: just successfully tested the latest revision of https://review.openstack.org/#/c/123614/ | 22:42 |
| *** jorge_munoz has quit IRC | 22:42 | |
| *** david-lyle_ has quit IRC | 22:45 | |
| *** gordc has quit IRC | 22:45 | |
| *** dims__ has joined #openstack-keystone | 22:46 | |
| *** dims__ has quit IRC | 22:52 | |
| *** amcrn has quit IRC | 22:52 | |
| *** dims__ has joined #openstack-keystone | 22:55 | |
| *** dims__ has quit IRC | 22:55 | |
| *** dims__ has joined #openstack-keystone | 22:56 | |
| *** henrynash has quit IRC | 22:56 | |
| *** dims__ has quit IRC | 22:57 | |
| *** dims__ has joined #openstack-keystone | 22:57 | |
| *** chrisshattuck has quit IRC | 22:59 | |
| *** Gippa has quit IRC | 23:05 | |
| *** andreaf has quit IRC | 23:08 | |
| *** henrynash has joined #openstack-keystone | 23:10 | |
| *** andreaf has joined #openstack-keystone | 23:11 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Doc about deleting a domain specific backend domain https://review.openstack.org/131319 | 23:13 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Doc about deleting a domain specific backend domain https://review.openstack.org/131319 | 23:15 |
| *** andreaf has quit IRC | 23:16 | |
| *** andreaf has joined #openstack-keystone | 23:17 | |
| morganfainberg | nkinder: before he cross project session I'd like to sit down with you. Want to hammer out some details before hand. | 23:36 |
| morganfainberg | Policy one that is. | 23:37 |
| *** henrynash has quit IRC | 23:40 | |
| *** amcrn has joined #openstack-keystone | 23:42 | |
| *** andreaf has quit IRC | 23:43 | |
| *** david-lyle has quit IRC | 23:50 | |
| *** packet has joined #openstack-keystone | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!