| *** topol has quit IRC | 00:17 | |
| *** gokrokve has joined #openstack-keystone | 00:24 | |
| *** gokrokve has quit IRC | 00:29 | |
| *** dims has quit IRC | 00:32 | |
| *** dims has joined #openstack-keystone | 00:32 | |
| *** lhcheng has quit IRC | 00:45 | |
| *** marg7175 has joined #openstack-keystone | 01:23 | |
| *** topol has joined #openstack-keystone | 01:29 | |
| *** marg7175 has quit IRC | 01:36 | |
| *** marg7175 has joined #openstack-keystone | 01:37 | |
| *** richm has joined #openstack-keystone | 01:46 | |
| *** alex_xu has joined #openstack-keystone | 01:57 | |
| *** sluo_laptop has joined #openstack-keystone | 02:07 | |
| *** sluo_laptop has quit IRC | 02:15 | |
| *** dims has quit IRC | 02:18 | |
| *** dims has joined #openstack-keystone | 02:19 | |
| *** gokrokve has joined #openstack-keystone | 02:24 | |
| *** dims has quit IRC | 02:25 | |
| *** dims has joined #openstack-keystone | 02:25 | |
| *** oomichi has joined #openstack-keystone | 02:28 | |
| *** gokrokve has quit IRC | 02:29 | |
| *** tellesnobrega has joined #openstack-keystone | 02:32 | |
| *** alex_xu has quit IRC | 02:34 | |
| *** erkules_ has joined #openstack-keystone | 02:39 | |
| *** tellesnobrega has quit IRC | 02:41 | |
| *** alex_xu has joined #openstack-keystone | 02:41 | |
| *** erkules has quit IRC | 02:42 | |
| *** richm has quit IRC | 02:43 | |
| *** fifieldt has quit IRC | 02:45 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 02:59 | |
| *** boris-42 has quit IRC | 03:07 | |
| *** dims_ has joined #openstack-keystone | 03:20 | |
| *** dims has quit IRC | 03:23 | |
| *** gokrokve has joined #openstack-keystone | 03:24 | |
| *** dims_ has quit IRC | 03:29 | |
| *** dims has joined #openstack-keystone | 03:29 | |
| *** gokrokve has quit IRC | 03:29 | |
| *** gokrokve has joined #openstack-keystone | 04:22 | |
| *** gokrokve has quit IRC | 04:53 | |
| *** gokrokve has joined #openstack-keystone | 04:53 | |
| openstackgerrit | rajiv proposed openstack/python-keystoneclient: Does not accept blank password for updation https://review.openstack.org/134454 | 04:55 |
|---|---|---|
| *** gokrokve has quit IRC | 04:58 | |
| *** gokrokve has joined #openstack-keystone | 05:02 | |
| *** sluo_laptop has joined #openstack-keystone | 05:07 | |
| *** oomichi has quit IRC | 05:11 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 05:15 | |
| *** gokrokve has quit IRC | 05:18 | |
| *** gokrokve has joined #openstack-keystone | 05:18 | |
| *** gokrokve has quit IRC | 05:23 | |
| *** jamielennox is now known as jamielennox|away | 05:34 | |
| *** jamielennox|away is now known as jamielennox | 05:41 | |
| *** topol has quit IRC | 05:48 | |
| *** gokrokve has joined #openstack-keystone | 05:49 | |
| *** gokrokve has quit IRC | 05:50 | |
| *** gokrokve has joined #openstack-keystone | 05:51 | |
| *** stevemar has joined #openstack-keystone | 05:52 | |
| *** gokrokve has quit IRC | 05:56 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/134696 | 06:02 |
| *** ukalifon has joined #openstack-keystone | 06:20 | |
| *** miqui has quit IRC | 06:22 | |
| *** gokrokve has joined #openstack-keystone | 06:24 | |
| *** gokrokve has quit IRC | 06:29 | |
| *** KanagarajM has joined #openstack-keystone | 06:30 | |
| *** erkules_ is now known as erkules | 06:42 | |
| *** agireud has joined #openstack-keystone | 06:43 | |
| *** marg7175 has quit IRC | 06:58 | |
| *** agireud has quit IRC | 07:10 | |
| *** gokrokve has joined #openstack-keystone | 07:24 | |
| *** marg7175 has joined #openstack-keystone | 07:25 | |
| *** stevemar has quit IRC | 07:27 | |
| *** gokrokve has quit IRC | 07:29 | |
| *** fifieldt has joined #openstack-keystone | 08:09 | |
| *** links has joined #openstack-keystone | 08:13 | |
| *** jaosorior has joined #openstack-keystone | 08:19 | |
| *** ajayaa has joined #openstack-keystone | 08:24 | |
| *** gokrokve has joined #openstack-keystone | 08:24 | |
| *** gokrokve has quit IRC | 08:29 | |
| *** marg7175 has quit IRC | 08:56 | |
| *** alex_xu has quit IRC | 09:16 | |
| *** gokrokve has joined #openstack-keystone | 09:24 | |
| *** gokrokve has quit IRC | 09:25 | |
| *** gokrokve has joined #openstack-keystone | 09:26 | |
| *** gokrokve has quit IRC | 09:31 | |
| *** ajayaa has quit IRC | 09:59 | |
| *** gokrokve has joined #openstack-keystone | 10:24 | |
| *** gokrokve has quit IRC | 10:29 | |
| *** f13o has quit IRC | 10:33 | |
| *** boris-42 has joined #openstack-keystone | 10:33 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Cache unscoped SAML tokens locally https://review.openstack.org/134606 | 10:51 |
| *** marg7175 has joined #openstack-keystone | 10:57 | |
| *** marg7175 has quit IRC | 11:02 | |
| *** ajayaa has joined #openstack-keystone | 11:04 | |
| *** KanagarajM has quit IRC | 11:04 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 11:05 |
| *** gokrokve has joined #openstack-keystone | 11:24 | |
| *** lhcheng has joined #openstack-keystone | 11:27 | |
| *** gokrokve has quit IRC | 11:29 | |
| *** ajayaa has quit IRC | 11:34 | |
| *** openstackgerrit has quit IRC | 11:48 | |
| *** openstackgerrit has joined #openstack-keystone | 11:49 | |
| *** ajayaa has joined #openstack-keystone | 11:49 | |
| *** dims has quit IRC | 11:50 | |
| *** dims has joined #openstack-keystone | 11:50 | |
| *** nellysmitt has joined #openstack-keystone | 11:58 | |
| *** diegows has joined #openstack-keystone | 12:06 | |
| *** marg7175 has joined #openstack-keystone | 12:11 | |
| *** raildo has joined #openstack-keystone | 12:18 | |
| *** stevemar has joined #openstack-keystone | 12:22 | |
| *** gokrokve has joined #openstack-keystone | 12:24 | |
| *** gokrokve has quit IRC | 12:29 | |
| *** diegows has quit IRC | 12:39 | |
| *** rm_work is now known as rm_work|away | 12:45 | |
| *** diegows has joined #openstack-keystone | 12:51 | |
| *** elynn_ has joined #openstack-keystone | 12:54 | |
| *** ajayaa has quit IRC | 12:56 | |
| *** stevemar has quit IRC | 12:56 | |
| *** f13o has joined #openstack-keystone | 12:59 | |
| *** diegows has quit IRC | 13:03 | |
| *** gokrokve has joined #openstack-keystone | 13:14 | |
| *** diegows has joined #openstack-keystone | 13:20 | |
| *** tristanC_ is now known as tristanC | 13:27 | |
| *** ChanServ sets mode: +o dolphm | 13:30 | |
| *** gordc has joined #openstack-keystone | 13:35 | |
| *** diegows has quit IRC | 13:35 | |
| *** diegows has joined #openstack-keystone | 13:37 | |
| *** gokrokve has quit IRC | 13:38 | |
| *** gokrokve has joined #openstack-keystone | 13:39 | |
| *** k4n0_ has quit IRC | 13:39 | |
| *** gokrokve has quit IRC | 13:43 | |
| *** dims has quit IRC | 13:52 | |
| *** jaosorior has quit IRC | 13:53 | |
| *** dims has joined #openstack-keystone | 13:53 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 13:59 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 14:01 |
| *** henrynash has joined #openstack-keystone | 14:02 | |
| *** tellesnobrega has joined #openstack-keystone | 14:05 | |
| *** nkinder has quit IRC | 14:05 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 14:06 |
| openstackgerrit | henry-nash proposed openstack/keystone: Ensure controllers and managers reference new resource manager. https://review.openstack.org/133525 | 14:06 |
| *** gokrokve has joined #openstack-keystone | 14:09 | |
| *** htruta has joined #openstack-keystone | 14:11 | |
| *** gokrokve has quit IRC | 14:14 | |
| *** elynn_ has quit IRC | 14:14 | |
| *** tellesnobrega has quit IRC | 14:15 | |
| *** thiagop has joined #openstack-keystone | 14:17 | |
| *** ayoung has quit IRC | 14:18 | |
| *** gokrokve has joined #openstack-keystone | 14:24 | |
| *** ayoung has joined #openstack-keystone | 14:26 | |
| *** tellesnobrega has joined #openstack-keystone | 14:28 | |
| *** gokrokve has quit IRC | 14:29 | |
| *** tellesnobrega has quit IRC | 14:32 | |
| *** marg7175 has quit IRC | 14:36 | |
| *** stevemar has joined #openstack-keystone | 14:42 | |
| *** bknudson has joined #openstack-keystone | 14:46 | |
| *** jacorob has joined #openstack-keystone | 14:46 | |
| *** sudorandom has quit IRC | 14:49 | |
| *** nkinder has joined #openstack-keystone | 14:57 | |
| *** gokrokve has joined #openstack-keystone | 14:58 | |
| *** zzzeek has joined #openstack-keystone | 15:02 | |
| *** topol has joined #openstack-keystone | 15:04 | |
| *** radez_g0n3 is now known as radez | 15:05 | |
| *** sudorandom has joined #openstack-keystone | 15:06 | |
| *** richm1 has joined #openstack-keystone | 15:09 | |
| *** jaosorior has joined #openstack-keystone | 15:16 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update keystone readme to point to specs.o.org https://review.openstack.org/134595 | 15:18 |
| ayoung | lbragstad, I wrote something this weekend that I think you might find intersting about token size: http://adam.younglogic.com/2014/11/minimal-token-size/ | 15:24 |
| morganfainberg | 44mornin. | 15:27 |
| morganfainberg | erm.. s/44/ | 15:28 |
| *** amakarov_away is now known as amakarov | 15:29 | |
| ayoung | morganfainberg, 44 morning to you too | 15:29 |
| dstanek | good morning all | 15:29 |
| lbragstad | ayoung: checking | 15:30 |
| ayoung | lbragstad, I can run some other size checks, too, if I missed the data that you are contemplating for AE tokens. | 15:30 |
| lbragstad | ayoung: writing up a script that probably explains things a little better. I'll link it in the review the next iteration | 15:30 |
| morganfainberg | ayoung, not sure a bitmap/bitvector is the right choice, but it's definitly an interesting idea to explore :) | 15:30 |
| ayoung | lbragstad, the short of it is, I don' think they really buy us anything | 15:30 |
| morganfainberg | then again, my answer would be the same in a lot of cases. | 15:30 |
| ayoung | morganfainberg, it is just the absolute smallest I could think of | 15:31 |
| morganfainberg | ayoung, yeah | 15:31 |
| morganfainberg | like i said interesting | 15:31 |
| ayoung | morganfainberg, the real question is : what are we trying to optimize for? | 15:31 |
| ayoung | I think that a better short hand would be the "subordinate service catalogs" | 15:31 |
| morganfainberg | ayoung, in the case of what lbragstad is aiming for, it is a mix between UUID and non-persistence | 15:31 |
| morganfainberg | ayoung, largely it will need the "no catalog in the token" change anyway | 15:32 |
| ayoung | morganfainberg, we can do that today with PKIZ and catalog-less tokens | 15:32 |
| morganfainberg | ayoung, 1k is still too much data | 15:32 |
| ayoung | morganfainberg, what is out size limit? | 15:32 |
| ayoung | our | 15:32 |
| morganfainberg | ayoung, 120-150bytes | 15:32 |
| ayoung | morganfainberg, only going to get that with UUID tokens. | 15:32 |
| ayoung | morganfainberg, you sign any data cryptographicall and it jumps to 500 | 15:33 |
| morganfainberg | ayoung, like i said, a mix of uuid and non-persistence | 15:33 |
| ayoung | morganfainberg, OK...minimal data would be: userid, projectid, expiry | 15:33 |
| morganfainberg | userid, projectid, issued, expiry-delta | 15:33 |
| morganfainberg | btw, why are we storing the expired_at in the token at all? we could just put a TTL (int) in seconds ;) | 15:34 |
| ayoung | morganfainberg, suspect we could calculate expiry from issued if we needed to | 15:34 |
| morganfainberg | yeah | 15:34 |
| morganfainberg | *shrug* | 15:34 |
| ayoung | so... minimal data would look like this: | 15:34 |
| lbragstad | http://pasteraw.com/ml3k9tymvi5rzo2vijc32rw44t415bj | 15:34 |
| lbragstad | something like that | 15:34 |
| ayoung | {f6bcfd33c6534a2cab1d96e74768b5fb,58a4988d35474b5faea068990fe96871,2147483647} | 15:35 |
| stevemar | marekd, ping | 15:35 |
| ayoung | lbragstad, how are you encoding> | 15:35 |
| marekd | stevemar: ding dong | 15:35 |
| morganfainberg | ayoung, uuid.bytes + msgpack | 15:35 |
| morganfainberg | is what he's doing | 15:35 |
| stevemar | marekd, can you review https://review.openstack.org/#/c/134700/ - i'm stuck on something :( | 15:35 |
| ayoung | morganfainberg, so no crypto? | 15:35 |
| lbragstad | or even | 15:36 |
| lbragstad | http://pasteraw.com/5grctaz9vg0ai2tt9sslbxjtg5ncxxh | 15:36 |
| dstanek | lbragstad: i've never actually used msgpack; is it better than struct? | 15:36 |
| morganfainberg | ayoung, i think with HMAC sig we jump to ~150bytes encoded. | 15:36 |
| marekd | stevemar: looking. | 15:36 |
| morganfainberg | ayoung, again this is very specifically provding as small a token w/o persistence as possible. | 15:36 |
| lbragstad | dstanek: I'm just playing with at the moment, so far no issues | 15:36 |
| ayoung | morganfainberg, I understand | 15:36 |
| lbragstad | dstanek: I did a comparison between compressing a dict and using msgpack | 15:37 |
| morganfainberg | ayoung, but largely, i expect this to start as an out-of-tree provider. we can evaluate it at that point. | 15:37 |
| lbragstad | msgpacking with an array of data is shorter | 15:37 |
| morganfainberg | ayoung, if it is something that we like - we can bring it in tree and offer it as the alternative to uuid w/o the token store | 15:37 |
| morganfainberg | ayoung, if we don't, we've still provided the interface for lbragstad and RAX to do this type of token (this is the AE proposal) | 15:38 |
| morganfainberg | ayoung, PKI/PKIZ will of course be our in-tree (to start) options for non-persistence | 15:38 |
| morganfainberg | ayoung, if that makes sense. | 15:38 |
| * morganfainberg glares at expense reports. | 15:39 | |
| ayoung | morganfainberg, where does the 150 bytes limit come from? | 15:40 |
| morganfainberg | ayoung, a nice number we should aim for. I think that limit is a place where swift and the other folks who want UUID length tokens will stop beating us up | 15:40 |
| *** jacorob has quit IRC | 15:41 | |
| morganfainberg | ayoung, and the UX is *similar* on the CLI (curl etc) to uuid. | 15:41 |
| ayoung | morganfainberg, we still need to persist revocation events either way. How is this any better than volitile memcached? | 15:42 |
| morganfainberg | ayoung, revocation events are uncommon - we've discussed that before. | 15:42 |
| morganfainberg | and something that is much less expensive to cleanup than token lists. | 15:42 |
| morganfainberg | since they are relatively uncommon | 15:43 |
| lbragstad | dstanek: here is an example of what we could get (size wise) by using msgpack | 15:43 |
| lbragstad | dstanek: in the best case | 15:43 |
| lbragstad | dstanek: the format of the data being [token format, user_id, project_id, created_at, ttl] | 15:44 |
| morganfainberg | lbragstad, need audit_ids and signer too. | 15:44 |
| lbragstad | morganfainberg: ahh right, | 15:45 |
| lbragstad | what was the link you sent me friday on that? | 15:45 |
| lbragstad | I was digging for it but couldn't recall exactly where it was | 15:45 |
| dstanek | lbragstad: so ~50 bytes of data? | 15:45 |
| *** radez is now known as radez_g0n3 | 15:45 | |
| lbragstad | dstanek: +50 with the HMAC | 15:45 |
| lbragstad | I still have to do that part | 15:46 |
| morganfainberg | lbragstad, i didn't mail was an IRC convo | 15:46 |
| dstanek | lbragstad: a 100 is really good | 15:46 |
| *** jacorob has joined #openstack-keystone | 15:46 | |
| *** gyee has joined #openstack-keystone | 15:47 | |
| ayoung | morganfainberg, how are we getting the HMAC? | 15:48 |
| morganfainberg | ayoung, ask lbragstad he had an idea on it. but tbh i don't remember. I was more worried about supporting this type of exploration than the implementation on that atm. | 15:49 |
| ayoung | morganfainberg, heh | 15:49 |
| morganfainberg | ayoung, HMAC is a realtively solved problem. Our issue is generating a Key and storing the key. | 15:51 |
| morganfainberg | ayoung, if we really go down this path, we can address that. | 15:51 |
| ayoung | morganfainberg, is it a solved problem from python? | 15:51 |
| morganfainberg | ayoung, yes. | 15:52 |
| *** saipandi has joined #openstack-keystone | 15:52 | |
| *** marg7175 has joined #openstack-keystone | 15:52 | |
| morganfainberg | ayoung, https://docs.python.org/2/library/hmac.html | 15:53 |
| morganfainberg | as is hashlib available | 15:53 |
| *** agireud has joined #openstack-keystone | 15:55 | |
| marekd | stevemar: so where are you stuck? | 15:55 |
| *** rwsu has joined #openstack-keystone | 15:56 | |
| marekd | stevemar: it doesn't really get back to the keysone first url ? | 15:56 |
| *** marg7175 has quit IRC | 15:57 | |
| *** marg7175 has joined #openstack-keystone | 15:58 | |
| rodrigods | morganfainberg, ayoung, henrynash, raildo, few moments to discuss get project subtree/parents visibility? | 15:58 |
| raildo | yes | 15:59 |
| stevemar | marekd, sort of | 15:59 |
| stevemar | marekd, the last call there - the one that goes to the 'location' of the previous return | 16:00 |
| marekd | stevemar: i might need to setup something to debug, or at least some links how should the workflow look like. | 16:00 |
| stevemar | it just ends up handing | 16:00 |
| stevemar | hanging* | 16:00 |
| marekd | and what's the location value? | 16:00 |
| *** dtturner has joined #openstack-keystone | 16:01 | |
| marekd | did you check apache logs? (server side) | 16:01 |
| morganfainberg | rodrigods, just a moment, i do need to run off an get breakfast before my day gets too crazy | 16:01 |
| morganfainberg | rodrigods, so might need to do this a bit later today. | 16:01 |
| *** gokrokve_ has joined #openstack-keystone | 16:01 | |
| *** thedodd has joined #openstack-keystone | 16:01 | |
| *** lhcheng has quit IRC | 16:02 | |
| *** radez_g0n3 is now known as radez | 16:04 | |
| *** gokrokve has quit IRC | 16:04 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 16:04 | |
| rodrigods | morganfainberg, no problem, so when you're back you can ping us =) | 16:04 |
| *** agireud has quit IRC | 16:04 | |
| stevemar | marekd, lemme check | 16:06 |
| morganfainberg | rodrigods, will do. gonna go grab food. | 16:10 |
| *** david-lyle_afk is now known as david-lyle | 16:11 | |
| *** jacorob has quit IRC | 16:11 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystonemiddleware: Adds Memcached dependencies doc https://review.openstack.org/134993 | 16:15 |
| *** zzzeek has quit IRC | 16:16 | |
| *** wwriverrat1 has joined #openstack-keystone | 16:18 | |
| *** zzzeek has joined #openstack-keystone | 16:18 | |
| *** jacorob has joined #openstack-keystone | 16:21 | |
| *** agireud has joined #openstack-keystone | 16:21 | |
| *** wwriverrat1 has left #openstack-keystone | 16:23 | |
| *** lhcheng has joined #openstack-keystone | 16:29 | |
| *** agireud has quit IRC | 16:31 | |
| *** gokrokve has joined #openstack-keystone | 16:36 | |
| *** zzzeek has quit IRC | 16:39 | |
| *** gokrokve_ has quit IRC | 16:39 | |
| *** r-daneel has joined #openstack-keystone | 16:39 | |
| *** marg7175 has quit IRC | 16:40 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/134696 | 16:40 |
| *** marg7175 has joined #openstack-keystone | 16:41 | |
| *** zzzeek has joined #openstack-keystone | 16:42 | |
| *** agireud has joined #openstack-keystone | 16:44 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implementing hierarchical calls on keystoneclient v3 (python only) https://review.openstack.org/115770 | 16:50 |
| *** jacorob has quit IRC | 16:59 | |
| *** wwriverrat has joined #openstack-keystone | 17:01 | |
| *** jacorob has joined #openstack-keystone | 17:02 | |
| *** rwsu has quit IRC | 17:03 | |
| *** kobtea has joined #openstack-keystone | 17:05 | |
| ayoung | lbragstad, OK, so the HMAC is small, but that is not enough to actually pass the identification data. How are you passing that? | 17:09 |
| morganfainberg | so based upon the poll for mid-cycle | 17:11 |
| morganfainberg | i think we're going to be in SAT again. | 17:12 |
| stevemar | gyee, best comment ever | 17:14 |
| *** _cjones_ has joined #openstack-keystone | 17:14 | |
| samuelms | morganfainberg, cool :) would be glad to know it | 17:15 |
| morganfainberg | samuelms, there will be some official communication asap. | 17:15 |
| *** _cjones_ has quit IRC | 17:15 | |
| *** _cjones_ has joined #openstack-keystone | 17:15 | |
| samuelms | morganfainberg, great! waiting for this (: thanks | 17:15 |
| morganfainberg | samuelms, i am just trying to pin down location | 17:16 |
| *** rwsu has joined #openstack-keystone | 17:16 | |
| *** raildo has quit IRC | 17:17 | |
| *** sigmavirus24 has left #openstack-keystone | 17:17 | |
| rodrigods | samuelms, schedule your visa interview! =P | 17:18 |
| *** rwsu has quit IRC | 17:18 | |
| rodrigods | morganfainberg, ready to chat about get project? | 17:18 |
| morganfainberg | rodrigods, i haven't gotten breakfast :( | 17:18 |
| morganfainberg | about to go now. | 17:18 |
| rodrigods | morganfainberg, omg =O | 17:18 |
| rodrigods | cool | 17:18 |
| morganfainberg | had something come up that needed full attention | 17:18 |
| samuelms | rodrigods, oops, will do this afternoon | 17:18 |
| morganfainberg | be back in like 1h | 17:19 |
| rodrigods | morganfainberg, great, I'll be here =) | 17:19 |
| *** rwsu has joined #openstack-keystone | 17:21 | |
| gyee | stevemar, some of us do pay attention to the keynotes :D | 17:22 |
| lbragstad | ayoung: the information in the token is based on a format | 17:25 |
| ayoung | lbragstad, explain? | 17:26 |
| *** marcoemorais has joined #openstack-keystone | 17:26 | |
| ayoung | lbragstad, what is in the token itself? | 17:26 |
| lbragstad | ayoung: if you're validating the token on the keystone side, you could have a predefined format for how the information in the token is constructed and have a version for it. | 17:26 |
| lbragstad | https://gist.github.com/lbragstad/a0b30f15b92798df6141#file-msgpack_demo-py-L53-L62 | 17:27 |
| ayoung | lbragstad, is that private? | 17:27 |
| ayoung | lbragstad, ok, so we take the fields we need, encode them, get the HMAC for them, append the HMAC, and that is the token | 17:28 |
| lbragstad | ayoung: you can't view that? | 17:28 |
| lbragstad | I didn't think it was private | 17:28 |
| ayoung | lbragstad, nope | 17:28 |
| lbragstad | damn | 17:29 |
| lbragstad | ayoung: sorry about that... checking | 17:29 |
| ayoung | might be github or something | 17:29 |
| ayoung | keeps asking me to log in, but then barfind | 17:29 |
| lbragstad | https://gist.github.com/lbragstad/a0b30f15b92798df6141 | 17:30 |
| lbragstad | ayoung: I verified that others can access that gist | 17:31 |
| bknudson | I can access it. | 17:31 |
| ayoung | lbragstad, I can see it | 17:31 |
| ayoung | lbragstad, OK, use the base64 url safe encoding. | 17:32 |
| ayoung | Don't do the replacements yourself | 17:32 |
| ayoung | its in the base64 python package | 17:32 |
| lbragstad | ayoung: yeah, those are implementation details, just prototyping so people get a feel for what we're trying to do | 17:32 |
| ayoung | ++ | 17:32 |
| lbragstad | I also need to add the audit ids per morganfainberg 's comment | 17:33 |
| lbragstad | and the hmac, | 17:33 |
| lbragstad | then we can get an accurate estimate on the actual size | 17:33 |
| *** kobtea has quit IRC | 17:36 | |
| *** jacorob has quit IRC | 17:36 | |
| *** harlowja_away is now known as harlowja | 17:41 | |
| ayoung | lbragstad, so with auditid as bytes we are up to 185. | 17:52 |
| ayoung | you are doing: | 17:52 |
| ayoung | compress, encrypt, encode | 17:53 |
| ayoung | I assume it is going to be | 17:53 |
| *** jaosorior has quit IRC | 17:53 | |
| ayoung | hmac, append, compress, encrypt, encode? | 17:53 |
| *** RichardRaseley has joined #openstack-keystone | 17:54 | |
| morganfainberg | ayoung: I'm thinking we need the idp -> domain stuff this cycle. | 17:55 |
| ayoung | Heh | 17:55 |
| morganfainberg | Oh. Hah still op'd here. *fixes* | 17:55 |
| ayoung | what brought on that realization? | 17:55 |
| *** ChanServ sets mode: -o morganfainberg | 17:55 | |
| morganfainberg | Well we've talked about it a bunch. | 17:56 |
| morganfainberg | And a thread talking about idp auth. | 17:56 |
| morganfainberg | And unique usernames. | 17:56 |
| *** rm_work|away is now known as rm_work | 18:00 | |
| *** marcoemorais has quit IRC | 18:01 | |
| *** marcoemorais has joined #openstack-keystone | 18:01 | |
| ayoung | morganfainberg, so...what do we do about the existing federation code that maps multiple users into the default domain? | 18:01 |
| morganfainberg | We maintain it and allow it. | 18:02 |
| morganfainberg | I guess | 18:02 |
| rodrigods | morganfainberg, ayoung, so it means we'll be able to easily revoke fed tokens? =) | 18:02 |
| ayoung | rodrigods, not yet | 18:03 |
| rodrigods | =( | 18:03 |
| morganfainberg | rodrigods: sortof. But we can already do that. Idp id is in the token. | 18:03 |
| morganfainberg | Revocation events. | 18:03 |
| rodrigods | morganfainberg, not in the middleware | 18:03 |
| *** arborism has joined #openstack-keystone | 18:03 | |
| *** arborism is now known as amcrn | 18:03 | |
| rodrigods | we only have access to the token_id there | 18:03 |
| ayoung | ugh...ok, I need to remeber the pre-tree revocation code... | 18:04 |
| *** _cjones_ has quit IRC | 18:05 | |
| *** _cjones_ has joined #openstack-keystone | 18:05 | |
| dolphm | ayoung, bknudson, dstanek, jamielennox, morganfainberg, stevemar, gyee, henrynash, topol, marekd, lbragstad, joesavak, shardy, fabiog, nkinder, lloydm, shrekuma, ksavich, hrybacki, rharwood, grantbow, vdreamarkitex, raildo, rodrigods, amakarov, ajayaa, hogepodge, breton, lhcheng, nonameentername: as a follow up to morgan's email, don't forget that keystone meeting is this time tomorrow! (an hour earlier than pre-summit | 18:06 |
| dolphm | for american daylight savings enthusiasts) | 18:06 |
| stevemar | thanks for the head up dolphm | 18:07 |
| ayoung | rodrigods, OK, here is the original code https://review.openstack.org/#/c/55908/60/keystone/contrib/revoke/model.py,cm | 18:07 |
| dolphm | stevemar: i almost forgot that you're american too! /hugs | 18:08 |
| gyee | ha thanks dolphm | 18:08 |
| stevemar | eww | 18:08 |
| gyee | stevemar, according to nafta, you are an american :) | 18:09 |
| rodrigods | ayoung, domain_id there, so... | 18:09 |
| rodrigods | ? | 18:09 |
| ayoung | rodrigods, you are jumping ahead. we need to change the tree code back to that style so that people can actually understand what it is doing | 18:10 |
| rodrigods | ayoung, ahh, assumed it looked like that today | 18:10 |
| *** dolphm sets mode: +v morganfainberg | 18:10 | |
| ayoung | rodrigods, no | 18:10 |
| morganfainberg | Lol | 18:10 |
| morganfainberg | Nice dolphm | 18:11 |
| ayoung | rodrigods, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/revoke/model.py#n181 | 18:11 |
| *** dolphm sets mode: +o morganfainberg | 18:12 | |
| dolphm | morganfainberg: in my head i was giving you channel op | 18:12 |
| * ayoung imagines morganfainberg on "The Voice" singing "Dream On" | 18:13 | |
| morganfainberg | dolphm: hehe. I just don't like being op'd if I don't need to be. | 18:13 |
| morganfainberg | But it doesn't really matter. | 18:14 |
| dolphm | morganfainberg: it's your hat now, sucker | 18:14 |
| morganfainberg | Hana | 18:14 |
| morganfainberg | Haha* | 18:14 |
| ayoung | rodrigods, think you could revert that? | 18:15 |
| ayoung | I have my boss bothering me for something else right now, and not sure when I can implement | 18:15 |
| rodrigods | ayoung, ++ yes I can | 18:15 |
| ayoung | rodrigods, awesome | 18:15 |
| ayoung | rodrigods, the current tests should pass regardless of the algorithm in the "tree" | 18:16 |
| *** thedodd has quit IRC | 18:16 | |
| ayoung | so long as the tests continue to pass unmodified, you should be OK | 18:16 |
| rodrigods | ayoung, great, just trying to get the big picture here | 18:17 |
| ayoung | rodrigods, ok, so we need the code to be readable/maintainble first | 18:17 |
| *** dolphm sets mode: +v morganfainberg | 18:17 | |
| ayoung | then we need to unify how we turn a token from text into python. The server does it one way, the client a different one | 18:17 |
| *** dolphm sets mode: +v ayoung | 18:18 | |
| *** dolphm sets mode: +g | 18:18 | |
| rodrigods | ayoung, good | 18:18 |
| *** dolphm sets mode: +v dstanek | 18:18 | |
| *** dolphm sets mode: +v bknudson | 18:18 | |
| *** dolphm sets mode: +v gyee | 18:18 | |
| ayoung | and this is actually different from morganfainberg 's code to turn a token into data as well... | 18:18 |
| *** dolphm sets mode: +v stevemar | 18:18 | |
| ayoung | so we really should have a single TokenData class | 18:19 |
| ayoung | we need to make sure the IDP data is in there | 18:19 |
| morganfainberg | ayoung: ++ | 18:19 |
| ayoung | and then we can revoke by IDP | 18:19 |
| rodrigods | ayoung, hmm | 18:19 |
| rodrigods | ++ | 18:19 |
| ayoung | I'd rather do IdP -> domain, but we broke that | 18:19 |
| *** dolphm sets mode: +v jamielennox | 18:19 | |
| ayoung | rodrigods, once we have the server code working, we need to extract it out to the client | 18:20 |
| *** dolphm sets mode: +v henrynash | 18:20 | |
| *** dolphm sets mode: +v topol | 18:20 | |
| *** dolphm sets mode: +v lbragstad | 18:20 | |
| ayoung | that way it can be checked inside of auth_token middleware | 18:20 |
| *** wwriverrat has left #openstack-keystone | 18:20 | |
| rodrigods | ayoung, good | 18:20 |
| * rodrigods wonders why the code has changed so much | 18:21 | |
| ayoung | rodrigods, we had a really smart programmer rewrite it, and I accepted his rewrite | 18:21 |
| ayoung | that was the "tree" approach | 18:21 |
| ayoung | but the algorithm wasn | 18:21 |
| ayoung | 't really as effecient as we thought, and the code got unreadable due to the tricky algorithm | 18:21 |
| morganfainberg | The tree approach is cool. It isn't that maintainable and has efficiency concerns. | 18:22 |
| ayoung | so we are reverting to the more procedural approach | 18:22 |
| ayoung | it should be something like | 18:22 |
| rodrigods | yeah, I got the old code approach | 18:22 |
| ayoung | for attribute_name in _EVENT_NAMES: | 18:22 |
| ayoung | first look for the direct match | 18:23 |
| ayoung | and then | 18:23 |
| ayoung | for alt_name in alternatives.get(name, [name]): | 18:23 |
| ayoung | keep the special check for role | 18:24 |
| *** jacorob has joined #openstack-keystone | 18:25 | |
| rodrigods | ayoung, look for direct matches, in modularized fashion, right? | 18:25 |
| rodrigods | like the one before | 18:25 |
| ayoung | yeah | 18:25 |
| *** dnalezyt has joined #openstack-keystone | 18:27 | |
| *** nellysmitt has quit IRC | 18:27 | |
| *** dnalezyt has quit IRC | 18:27 | |
| rodrigods | ayoung, great, i might bug you to do some review this week =) | 18:28 |
| ayoung | rodrigods, hmmm, I think I had better code than '60' | 18:28 |
| *** dnalezyt has joined #openstack-keystone | 18:28 | |
| *** patrickeast has joined #openstack-keystone | 18:28 | |
| ayoung | rodrigods, hmmmm, my code was doing a linear search through the events | 18:29 |
| ayoung | his code was doing a more efficient search, but then we get killed on the hashtable lookups | 18:30 |
| morganfainberg | ayoung, aand the hashtable building | 18:31 |
| dolphm | morganfainberg: is there an IRC command to list all modes of a user? or all users with a mode? | 18:31 |
| rodrigods | ayoung, don't worry, will take this in consideration | 18:31 |
| morganfainberg | dolphm, uhm | 18:31 |
| morganfainberg | dolphm /msg chanserv flags #openstack-keystone | 18:31 |
| dolphm | morganfainberg: perfect! thanks | 18:32 |
| *** jacorob has left #openstack-keystone | 18:33 | |
| *** jacorob has joined #openstack-keystone | 18:33 | |
| *** ChanServ sets mode: -vvv henrynash bknudson gyee | 18:34 | |
| ayoung | rodrigods, heh, I am worried | 18:37 |
| ayoung | this was hard to get right, and I am not certain we can really make it perform under load without some foresight | 18:38 |
| ayoung | I've often wondered if we can continue to do the tree approach but without hashtables | 18:38 |
| dolphm | bknudson henrynash: you need to register your nickname with NickServ, and configure your IRC client to automatically identify you with a password | 18:39 |
| *** gokrokve_ has joined #openstack-keystone | 18:39 | |
| ayoung | the assumption is that checking revocations is going to be much more common than adding a new revocation event | 18:39 |
| dolphm | gyee: looks like your client isn't configured to identify you either | 18:39 |
| dolphm | bknudson henrynash: see https://freenode.net/faq.shtml#userregistration | 18:39 |
| rodrigods | ayoung, this is true for long-lived tokens | 18:39 |
| rodrigods | right? | 18:40 |
| dolphm | bknudson henrynash gyee: ping me if you need a hand | 18:40 |
| ayoung | rodrigods, well, anything that triggers a revocation event is going to be evaluated, long lived or not | 18:40 |
| ayoung | and evicting older events might end up being the most expensive part | 18:40 |
| morganfainberg | rodrigods, i'm back btw | 18:40 |
| rodrigods | morganfainberg, great .... ping raildo samuelms | 18:41 |
| morganfainberg | ayoung, maybe the right answer is we bucket the events by window e.g. 5 minute / 10 minute 1h | 18:41 |
| gyee | dolphm, I registered my irc handle | 18:41 |
| gyee | I am using xchat | 18:41 |
| morganfainberg | ayoung, then we just drop the buckets vs scrubbing the list | 18:41 |
| ayoung | morganfainberg, the linear search lends itself to that | 18:41 |
| rodrigods | morganfainberg, going to the right bucket should be constant | 18:42 |
| gyee | ah, maybe I didn't configure xchat correctly | 18:42 |
| *** gokrokve has quit IRC | 18:42 | |
| morganfainberg | gyee, you're not identifying w/ nickserv | 18:42 |
| morganfainberg | thats all. | 18:42 |
| rodrigods | morganfainberg, ready to multithread here? (HM + tokens revoke tree) | 18:43 |
| gyee | I am looking for that magic button in xchat | 18:43 |
| dolphm | gyee: it's called Nickserv password in Xchat, i think | 18:43 |
| rodrigods | gyee, should be in the network config | 18:43 |
| dolphm | gyee: in your server settings | 18:43 |
| rodrigods | gyee, or via /nickserver identity ... something like that | 18:43 |
| *** gokrokve_ has quit IRC | 18:43 | |
| dolphm | rodrigods: that will work for today, but i'd like his client to auto-identify him in the future | 18:44 |
| gyee | ah, got it, thanks dolphm, rodrigods! | 18:44 |
| rodrigods | dolphm, ++ | 18:45 |
| *** gyee has quit IRC | 18:45 | |
| rodrigods | morganfainberg, so... the issue is: get project subtree and parents: GET /v3/projects/<project_id>?subtree_as_list and GET /v3/projects/<project_id>?parents_as_list | 18:45 |
| *** gyee has joined #openstack-keystone | 18:45 | |
| *** ChanServ sets mode: +v gyee | 18:45 | |
| morganfainberg | rodrigods, oh boy! | 18:45 |
| morganfainberg | right | 18:46 |
| gyee | yay! | 18:46 |
| morganfainberg | woot | 18:46 |
| gyee | I have a voice! | 18:46 |
| ayoung | rodrigods, OK, I think we should try out the linear search again. I suspect that the most important thing is to "fail fast" when checking an individual event, which means that the least common matched fields should be the first to check | 18:46 |
| dolphm | gyee: ++ | 18:46 |
| morganfainberg | rodrigods, i'm also writing up 2 emails and trying to file an expense report :P | 18:46 |
| ayoung | which would be userid, I am fairly certain | 18:46 |
| rodrigods | morganfainberg, the idea is to return the full project ref , which is not ok since the get_project call is blocked in the policy | 18:47 |
| dolphm | morganfainberg: i spent all morning filing expense reports :( | 18:47 |
| rodrigods | ayoung, need to get both codes into my head in order to provide some insight =( | 18:47 |
| henrynash | dolphm: so where do you input all the commonds listed in uer registration in the link you provided? | 18:47 |
| gyee | converting euro to dollar, with fees on top ain't fun | 18:47 |
| ayoung | rodrigods, heh... | 18:47 |
| ayoung | rodrigods, I have an overview of the tree code on my blog | 18:47 |
| ayoung | link in a moment | 18:47 |
| ayoung | http://adam.younglogic.com/2014/02/efficient-revocation-checking/ | 18:48 |
| dolphm | henrynash: any command starting with "/msg NickServ" is effectively sending a private message to the NickServ user, so anywhere in your client | 18:48 |
| rodrigods | morganfainberg, so, since we are going to implement a the ?subtree and ?parents, that will return only the IDs, in a structured fashion | 18:48 |
| morganfainberg | right | 18:49 |
| henrynash | dolphm: ah, ok | 18:49 |
| dolphm | rodrigods: shouldn't it be ?children then, since there's no tree returned? | 18:49 |
| morganfainberg | dolphm, my expense report is unfun... my VPN connection keeps dying | 18:49 |
| rodrigods | morganfainberg, we want to limit the subtree_as_list and parents_as_list by using the "list_projects_for_user" call, and then getting the subtree and parents | 18:49 |
| morganfainberg | dolphm, so i can't get it submitted. | 18:49 |
| dolphm | morganfainberg: does it at least save as you go? | 18:50 |
| rodrigods | dolphm, children we thought that might confuse the user, since it would mean only immediate children | 18:50 |
| morganfainberg | dolphm, i can't get to the point where it'll save | 18:50 |
| rodrigods | ayoung, reading | 18:50 |
| morganfainberg | dolphm, "edit expense... --- TIMEOUT" | 18:50 |
| morganfainberg | dolphm, all the expenses are pre-populated in our system, i just need to classify and upload receipts | 18:50 |
| morganfainberg | dolphm (and print a paper and mail off the physical receipts for VAT recovery) | 18:50 |
| morganfainberg | dolphm, i get ~5minutes on the VPN max | 18:51 |
| morganfainberg | atm | 18:51 |
| * morganfainberg grumbles about OpenVPN being silly. | 18:51 | |
| dolphm | rodrigods: hmm, valid point. the discrepency between subtree and parents is confusing to me though. i'd expect subtree / supertree and children / parents to complement each other | 18:51 |
| dolphm | morganfainberg: i lost you at "print" | 18:51 |
| gyee | morganfainberg, I scan the receipts and attach them to the report | 18:51 |
| morganfainberg | gyee, can't with the VAT recovery, must be the original receipt | 18:52 |
| dolphm | best practice at rackspace is to take cell phone photos of receipts and toss them | 18:52 |
| dolphm | if you even need a receipt | 18:52 |
| morganfainberg | dolphm, this is a special case for VAT recovery, most of the time it's photo recepit and upload photo | 18:52 |
| gyee | nice! cell phone photos would be awesome | 18:52 |
| ayoung | rodrigods, once you see the elegance of the solution, you will understand why I was seduced by it | 18:52 |
| henrynash | dolphm: thx, done | 18:52 |
| rodrigods | dolphm, parents is not like a supertree, only the list of projects that would get by following the parent_id | 18:52 |
| ayoung | I wonder if we could convert the hashtables into linear searches and get the best of both worlds | 18:53 |
| dolphm | henrynash: did you configure your client to identify you with nickserv / sasl? | 18:53 |
| ayoung | rodrigods, https://bugs.launchpad.net/keystone/+bug/1290625 | 18:54 |
| uvirtbot | Launchpad bug 1290625 in keystone "keystone.contrib.revoke.backends.sql contains several glaring performance problems" [Medium,Triaged] | 18:54 |
| morganfainberg | ayoung, lol | 18:54 |
| henrynash | dolphm: hmm…maybe not :-) | 18:54 |
| morganfainberg | nice bug. | 18:54 |
| dolphm | henrynash: next step then! | 18:54 |
| *** amakarov is now known as amakarov_away | 18:54 | |
| ayoung | morganfainberg, I had a commit for converting the IDs to indexes | 18:54 |
| morganfainberg | rodrigods, for now, ithink the simply parent, children type hierarchy | 18:54 |
| ayoung | * The id column is internal only, and yet, is varchar(64). This should just be an auto incremented int. | 18:54 |
| morganfainberg | rodrigods, and only return IDs is the important part | 18:54 |
| *** links has quit IRC | 18:55 | |
| *** thedodd has joined #openstack-keystone | 18:55 | |
| ayoung | morganfainberg, was there a bug for the hashtable portion of that? | 18:55 |
| rodrigods | morganfainberg, not the full ref? =( we thought about the usecase from a user trying to fetch the projects he/she has access | 18:55 |
| rodrigods | that would also mean a nice UI in horizon =) | 18:55 |
| ayoung | morganfainberg, I'm almostted tempted to leave the tree code as is | 18:55 |
| morganfainberg | didn't we decide we can't return the whole project_ref in *all cases* | 18:55 |
| morganfainberg | ? | 18:55 |
| ayoung | morganfainberg, and see if instead we can performance tune it as is | 18:56 |
| morganfainberg | or is that a followup for the "reseller/SP" case | 18:56 |
| morganfainberg | ? | 18:56 |
| rodrigods | morganfainberg, hmm | 18:57 |
| rodrigods | let me start again | 18:57 |
| rodrigods | we thought about 2 use cases: | 18:57 |
| rodrigods | 1 - a service trying to get the hierarchy (like for the hierarchical quotas use case) | 18:58 |
| morganfainberg | rodrigods, ok sorry the conversation overlap has been ... crazy :P | 18:58 |
| rodrigods | 2 - a user trying to see where he/she has access | 18:58 |
| rodrigods | morganfainberg, I'm lost too | 18:58 |
| rodrigods | =) | 18:58 |
| morganfainberg | dolphm, ayoung, gyee, lbragstad, dstanek, stevemar, henrynash, topol, https://review.openstack.org/#/c/131227/2/reference/project-release-schedules.rst | 18:59 |
| rodrigods | for the first usecase, we have the simple ?subtree -> will return *only IDs* in a structured fashion (not implemented yet) | 18:59 |
| stevemar | thats a lot of reading | 18:59 |
| rodrigods | for the second... we have the ?subtree_as_list -> will return the full project_ref -> will be limited by the projects that could be listed using "list_projects_for_user()" | 19:00 |
| henrynash | rodigods: (i’m not sure why we would only return IDs in that structured case, why not the whole refs?) | 19:00 |
| rodrigods | henrynash, because we would mount the wrong tree, image you have this structure: A -> B -> C, and you only have access to A and C | 19:01 |
| *** NM has joined #openstack-keystone | 19:01 | |
| rodrigods | henrynash, it would return A -> C, which is wrong | 19:01 |
| rodrigods | returning only the IDs, we can return A -> B -> C, since the ID by itself is not a sensitive information | 19:02 |
| henrynash | rodigods: hmm, I’d be tempted to eitehr a) fail that cmd in that case due to lack of permissions | 19:02 |
| rodrigods | henrynash, what about the services that wants to update project quotas? | 19:02 |
| rodrigods | it would need the full info | 19:02 |
| rodrigods | full info == full hierarchy | 19:02 |
| henrynash | rodigods: what does it mean to update a quota? | 19:03 |
| gyee | morganfainberg, besides the clients, who on Free Release Cycle? Swift? | 19:04 |
| henrynash | rodigods: where are the quotas stored (assuming I know nothing about quotas…because I don’t :-) ) | 19:04 |
| morganfainberg | so the full hierarchy is likely a cloud-admin question only | 19:04 |
| morganfainberg | gyee, no one. | 19:04 |
| morganfainberg | gyee, the proposal is to allow other projects to adopt varying release cycles. | 19:04 |
| *** henrynash has left #openstack-keystone | 19:05 | |
| rodrigods | morganfainberg, yep | 19:05 |
| rodrigods | rodrigods, nova -> oslo in the future | 19:05 |
| *** henrynash has joined #openstack-keystone | 19:05 | |
| rodrigods | henrynash, nova -> oslo in the future | 19:06 |
| henrynash | rodigods: sorry. missed some messages trying to reconfigure my IRC client | 19:06 |
| rodrigods | they store only one level quota, to update to the children they will need the full hierarchy | 19:06 |
| *** marcoemorais has quit IRC | 19:06 | |
| *** marcoemorais has joined #openstack-keystone | 19:06 | |
| *** marcoemorais has quit IRC | 19:07 | |
| stevemar | nkinder, can you confirm if this still applies? https://bugs.launchpad.net/python-openstackclient/+bug/1385338 | 19:07 |
| uvirtbot | Launchpad bug 1385338 in python-openstackclient "Keystone v3 authentication request is malformed with latest OSC code" [High,Confirmed] | 19:07 |
| *** marcoemorais has joined #openstack-keystone | 19:07 | |
| dstanek | morganfainberg: that's interesting | 19:07 |
| henrynash | rodigods: so why wouldn’t their be an inherited role that they must have to update all the projects in a hierachy (if indeed they want to operated taht way) | 19:07 |
| henrynash | dolphm: so is there a way I can tell if I know have everything configured OK in my IRC client? | 19:08 |
| rodrigods | henrynash, why return a bunch of information that a service won't use? I mean, they only care about the ID | 19:08 |
| rodrigods | henrynash, that's why I prefer the hierarchy return to have only the IDs | 19:08 |
| *** ChanServ sets mode: +v henrynash | 19:09 | |
| henrynash | rodigods: so I’m not talking about the xxx_as_list, I’m talking about teh structured one... | 19:09 |
| rodrigods | henrynash, me too | 19:09 |
| henrynash | rodigods: ha “-) | 19:09 |
| *** ChanServ sets mode: +v bknudson | 19:09 | |
| henrynash | rodigods: so you think the quotas code will need the structured version? I thought that’s why you wanted the flat list? | 19:10 |
| *** jacorob has quit IRC | 19:11 | |
| rodrigods | henrynash, yeah... the list would be returned to a user that wants to know where he/she has access | 19:11 |
| henrynash | rodigods: oh, I see…hmmm.something smells fishy here | 19:11 |
| rodrigods | henrynash, hmm | 19:12 |
| rodrigods | henrynash, what's your suggestion? return full refs both ways and if the user hasn't access to a project, the call fails? | 19:12 |
| topol | morganfainberg, thanks. will take a look | 19:12 |
| henrynash | rodigods: so what’s the need to ever return any info (including the ID) on a project for which the user doesn’t have access | 19:13 |
| rodrigods | henrynash, just for a service trying to know the full hierarchy (like the quota example) | 19:13 |
| *** bknudson has quit IRC | 19:15 | |
| *** bknudson has joined #openstack-keystone | 19:15 | |
| *** ChanServ sets mode: +v bknudson | 19:15 | |
| henrynash | rodigods: (so here comes the circular argument)…but surely if someone wants to update the quotas for a hierarchy, they must have permission (maybe a specifc “update quota” role) on all nodes in said hierarchy? | 19:15 |
| bknudson | dolphm: am I registered now? | 19:15 |
| henrynash | rodigods: when would we not want that to be true? | 19:15 |
| nkinder | stevemar: I was still seeing that issue last week. | 19:16 |
| nkinder | stevemar: I can set up another test environment and see if it's still there | 19:17 |
| *** marcoemorais has quit IRC | 19:17 | |
| rodrigods | henrynash, thinking... | 19:17 |
| rodrigods | henrynash, and... what about a user that wants to know where he has access? | 19:18 |
| henrynash | rodigods: sounds like a new use case! | 19:18 |
| rodrigods | why we don't return only the projects he has access, and since we do not want to "lie" about the hierarchy, we return it as a list? | 19:18 |
| rodrigods | =) | 19:18 |
| *** marcoemorais has joined #openstack-keystone | 19:19 | |
| henrynash | rodigods: my turn…..thinking | 19:19 |
| stevemar | nkinder, if you could, that would be great | 19:21 |
| stevemar | hoping to release a new osc version | 19:21 |
| *** jaosorior has joined #openstack-keystone | 19:21 | |
| stevemar | so we can break everyone, buahaha | 19:21 |
| *** raildo has joined #openstack-keystone | 19:22 | |
| henrynash | rodigods: so in the list case, I guess that makes sense…..although IF, for instance, someone was doing somkind of quota opertion, then the’d only be operating on some (potentially non-contigious)subset of the tree…so wonder if it would result in what they want | 19:23 |
| *** ukalifon has quit IRC | 19:23 | |
| henrynash | rodigods: e.g. they sumed or set quota for some set of projects…but other projects in the same tree (for whicih they don’t have access) are not summed or updated | 19:23 |
| henrynash | rodigods: seems a bit odd | 19:24 |
| rodrigods | henrynash, yes, that's why we want the full hierarchy | 19:25 |
| rodrigods | for those cases | 19:25 |
| raildo | henrynash, but the quota operations are doing by the Nova service, not for the user, so we don't have this problem | 19:26 |
| raildo | (and other global operations in Nova) | 19:26 |
| dolphm | bknudson: yes, you are! | 19:27 |
| henrynash | raildo: “we don’t have this problem” because? | 19:27 |
| rodrigods | henrynash, do you agree that we can not return a structured hierarchy containing missing parts? so we either return the full info, or return error | 19:27 |
| stevemar | morganfainberg, dolphm does keystone always have 'regionOne' | 19:27 |
| dolphm | henrynash: your current state is good, but if you close your client and re-open it -- we should be able to tell for sure? | 19:27 |
| dolphm | stevemar: no | 19:27 |
| henrynash | dolphm: ok | 19:28 |
| rodrigods | and we would need a list, for the cases where we *can't* return the full hierarchy, but makes sense to return a subset of it | 19:28 |
| *** henrynash has quit IRC | 19:28 | |
| stevemar | dolphm, so how is it created when we spin up devstack? i don't see any code to do that | 19:28 |
| *** henrynash has joined #openstack-keystone | 19:28 | |
| *** ChanServ sets mode: +v henrynash | 19:28 | |
| dolphm | henrynash: looks good! | 19:28 |
| rodrigods | henrynash, and we would need a list, for the cases where we *can't* return the full hierarchy, but makes sense to return a subset of it | 19:28 |
| henrynash | dolphm: thx for your help | 19:28 |
| dolphm | henrynash: now we call all stop worrying about henrynash imposters | 19:29 |
| henrynash | dolphm: i know it was front of mind for everyone here….. | 19:29 |
| henrynash | dolphm: not | 19:29 |
| dolphm | henrynash: it was a popular concern cited at the summit | 19:29 |
| henrynash | dolphm: i”ll be giving classes in how to type in ye olde english style | 19:30 |
| raildo | because using the role service (for update quotas) they can access the full hierarchy, so all the hierarchy will be update. for a user (using other role) we have to filter which projects the user can acess | 19:30 |
| henrynash | raildo: becasue a service user user has full accees, you mean? | 19:31 |
| raildo | henrynash, yes | 19:31 |
| henrynash | railldo: true today, maybe not always true | 19:31 |
| *** jacorob has joined #openstack-keystone | 19:31 | |
| stevemar | dolphm, so how is it created when we spin up devstack? i don't see any code to do that | 19:31 |
| rodrigods | henrynash, yes, that's why return only the IDs, structured, is a good idea =) | 19:32 |
| rodrigods | hehe | 19:32 |
| dolphm | stevemar: does keystoneclient default endpoints to have a region value of 'regionOne' ? | 19:33 |
| raildo | rodrigods, ++ :) | 19:33 |
| *** marcoemorais has quit IRC | 19:34 | |
| dolphm | lbragstad: how's the seasoning coming along? | 19:34 |
| *** marcoemorais has joined #openstack-keystone | 19:34 | |
| morganfainberg | FYI, i've added keystone-specs-core group | 19:34 |
| morganfainberg | there may be a window where cores cannot approve specs/vote +2 on them today | 19:34 |
| lbragstad | it's good, I have three coats done... it takes a really really long time | 19:34 |
| morganfainberg | should be a limited window before i have it fixed | 19:35 |
| lbragstad | burnt myself a few times though... | 19:35 |
| dolphm | lbragstad: fun! | 19:35 |
| morganfainberg | so... don't worry if suddenly you can't +2 a spec for a few minutes | 19:35 |
| morganfainberg | dolphm, ok so SAT looks like this cycle's meetup again. | 19:35 |
| morganfainberg | if you didn't see previous info | 19:35 |
| henrynash | rodigods, raildo: so I’m not opposed to ID only (well you’d need the parent/subtree attribute as well)…just as long as it’s obvious from the api | 19:35 |
| dolphm | morganfainberg: what you're really trying to hint at is that we should all be reviewing specs, and should be noticing this as an issue | 19:36 |
| rodrigods | henrynash, cool | 19:36 |
| morganfainberg | dolphm, haha. maaaaybe ;) | 19:36 |
| henrynash | rodigods, raildo: e.g. GET /projects?subtree_IDs | 19:36 |
| rodrigods | henrynash, for the subtree_as_list, returning only a subset of the hierarchy. Are you OK with using list_projects_for_user(), and then filtering the result? | 19:36 |
| henrynash | rodigodsm raildo: or something liek that | 19:36 |
| raildo | henrynash, sounds good to me | 19:36 |
| morganfainberg | dolphm, unless there is a *real* reason not to do the midcycle in SAT - I'm going to try and get geekdom space again [or bug you to!] | 19:37 |
| rodrigods | henrynash, in this way, we would return only the projects a user *has* access to | 19:37 |
| morganfainberg | oooor space @ RAX if that makes more sense. | 19:37 |
| *** marcoemorais has quit IRC | 19:37 | |
| henrynash | rodigods: you mean as implementation or instead of? | 19:37 |
| rodrigods | henrynash, implementation | 19:37 |
| *** marcoemorais has joined #openstack-keystone | 19:37 | |
| henrynash | rodigods: I’m all for re-using fo code! | 19:38 |
| rodrigods | henrynash, the subtree_ids vs subtree_as_list would need a big red note in the API | 19:38 |
| rodrigods | explaining the differences | 19:38 |
| rodrigods | henrynash, but... I guess we have an agreement here? | 19:39 |
| raildo | henrynash, maybe we have to control who can access these GETs in the policy.json? | 19:39 |
| *** marcoemorais has quit IRC | 19:39 | |
| henrynash | rodigods: btw, are we saying this is GET /projects?subtree_xxx or GET /projects/subtree_xxx ? | 19:39 |
| *** marcoemorais has joined #openstack-keystone | 19:39 | |
| rodrigods | henrynash, /projects/<project_id>?subtree_xxx | 19:40 |
| rodrigods | GET | 19:40 |
| henrynash | rodigods: ok | 19:41 |
| rodrigods | henrynash, great | 19:41 |
| rodrigods | since we have only the subtree_as_list impl right now, will update it to list only the projects the user access to | 19:41 |
| *** gokrokve has joined #openstack-keystone | 19:43 | |
| lbragstad | ayoung: dolphm jacorob morganfainberg here is the token with uuid.uuid4()hex representing the user id and project ids and the HMAC included: http://pasteraw.com/8xz2zfyzpzjfwilu1klkci08s3t5ih5 | 19:44 |
| lbragstad | still missing audit ids. | 19:44 |
| rodrigods | morganfainberg, summary: ?subtree_as_list will only return a subset of the hierarchy -> the projects the user has access to. ?subtree_ids will return a structured information about the full hierarchy will only the IDs (similar to parents_xx) | 19:45 |
| morganfainberg | lbragstad, audit ids will be up to 44 more "useful" characters | 19:45 |
| morganfainberg | in the current impl | 19:45 |
| morganfainberg | prior to msgpack | 19:45 |
| lbragstad | ok | 19:46 |
| *** lhcheng has quit IRC | 19:49 | |
| *** lhcheng has joined #openstack-keystone | 19:49 | |
| ayoung | I wonder if there is an asymmetric equivalent to the HMAC we could use? | 19:52 |
| ayoung | It might be larger than the HMAC, but it can't be that big | 19:52 |
| lbragstad | so with audit_id and hex format uuids, we are at 177 characters msgpack'd | 19:54 |
| dolphm | morganfainberg: id be happy to make geekdom happen again if we have firm dates | 19:54 |
| lbragstad | with audit_ids and byte strings for uuids, we have 133 characters mskpack'd | 19:54 |
| bknudson | I hope geekdom fixes their wireless | 19:55 |
| lbragstad | I don't remember having issues with wireless at Geekdom | 19:55 |
| morganfainberg | dolphm, well looks like i can't make Jan 22, 23 | 19:55 |
| dolphm | bknudson: refresh me - what was the problem before? | 19:55 |
| morganfainberg | going to need to be in sunnyvale those days for $HPSTUFF$ | 19:55 |
| bknudson | wireless didn't work for me. | 19:55 |
| dolphm | bknudson: just you? | 19:56 |
| morganfainberg | so the dates will be January 19 - 21 (Mon, Tue, Wed) | 19:56 |
| bknudson | y, it was just me | 19:56 |
| bknudson | as far as I know | 19:56 |
| dolphm | bknudson: #personalproblem ;) | 19:56 |
| bknudson | wireless works everywhere else! | 19:56 |
| dolphm | bknudson: i didnt realize you *never* had wifi :-/ | 19:56 |
| morganfainberg | since everyone seemed to be ok with either parts of that week. | 19:56 |
| bknudson | I used my phone tether | 19:57 |
| dolphm | bknudson: oooh | 19:57 |
| bknudson | cost $20 | 19:57 |
| dolphm | bknudson: they surely have an IT folk around to pester next time | 19:57 |
| rodrigods | ayoung, just read the blog post... and I have to say... I'm in love with this solution =) | 19:57 |
| ayoung | rodrigods, heh | 19:58 |
| ayoung | I bet we can tune it, but, yea, I think leave it for now | 19:58 |
| morganfainberg | ayoung, which blog post? | 19:58 |
| rodrigods | morganfainberg, http://adam.younglogic.com/2014/02/efficient-revocation-checking/ | 19:58 |
| ayoung | morganfainberg, on the revoke tree | 19:58 |
| morganfainberg | ah yeah | 19:58 |
| * morganfainberg needs to write up a post about SSO next. | 19:58 | |
| morganfainberg | SSO / Federation and next steps | 19:58 |
| dolphm | \o/ | 19:59 |
| ayoung | morganfainberg, BTW, I wrote up the series of steps for Dynamic policy | 19:59 |
| morganfainberg | i was asked to both by HP and cause i deferred on the "results of the summit" post | 19:59 |
| ayoung | http://adam.younglogic.com/2014/11/dynamic-policy-in-keystone/ | 19:59 |
| morganfainberg | ayoung, will read. | 19:59 |
| rodrigods | morganfainberg, btw, what are the blockers to oslo.policy graduate? I'm thinking about submitting the spec | 19:59 |
| ayoung | dolphm, ^^ I'd be really interested in your feedback, but I think it reflects what you origianlly proposed at the midcycle | 19:59 |
| dolphm | ayoung: ack | 20:00 |
| morganfainberg | rodrigods, 2 things: 1) fileutils is in incubator still && 2) we don't have an alternative to oslo.config options. | 20:00 |
| morganfainberg | it's not a big surface area to fix | 20:00 |
| ayoung | dolphm, the one thing was that you were thinking we'd merge the policy offline, and with hierarchical (implied) roles, it might be better to do it in Keystone | 20:00 |
| rodrigods | morganfainberg, how can I start? | 20:00 |
| morganfainberg | rodrigods, basically we need to figure out when fileutils will be graduated if there isn't a timeline we can carry it until it does. | 20:01 |
| morganfainberg | and we also need a new name for the library | 20:01 |
| ayoung | I can post to the mailing list once you guys provide a base level sanity check | 20:01 |
| morganfainberg | it can't be oslo_policy | 20:01 |
| morganfainberg | rodrigods, so it is a fairly straightforward graduation | 20:02 |
| rodrigods | morganfainberg, hmm will ping the folks from oslo about fileutils | 20:02 |
| rodrigods | morganfainberg, the config part would need a local file to handle it? | 20:05 |
| rodrigods | "local file" might not be the right name for it | 20:05 |
| *** droot has joined #openstack-keystone | 20:13 | |
| *** stevemar has quit IRC | 20:13 | |
| *** jacorob has quit IRC | 20:13 | |
| *** droot is now known as theroot | 20:13 | |
| *** theroot is now known as sunil_ | 20:14 | |
| *** sunil_ is now known as _sunil_ | 20:14 | |
| *** amakarov has joined #openstack-keystone | 20:15 | |
| *** amakarov has quit IRC | 20:16 | |
| *** gokrokve has quit IRC | 20:20 | |
| *** gokrokve has joined #openstack-keystone | 20:21 | |
| *** jacorob has joined #openstack-keystone | 20:23 | |
| samuelms | henrynash, ping | 20:24 |
| henrynash | samuelms: hi | 20:24 |
| samuelms | henrynash, few minutes to take a look at our assignment driver/manager language ? :-) | 20:24 |
| samuelms | henrynash, https://etherpad.openstack.org/p/role-assignment-backend-language | 20:24 |
| henrynash | samuelms: sure… | 20:24 |
| samuelms | henrynash, take a look at the end of the doc | 20:24 |
| samuelms | henrynash, I represented a user on project assignment that comes from group membership .. also inherited through a project hierarchy | 20:25 |
| gyee | marekd, stevemar, ping | 20:25 |
| *** gokrokve has quit IRC | 20:25 | |
| henrynash | samuelms: is this what is returned BY the controller? | 20:25 |
| *** jorge_munoz has joined #openstack-keystone | 20:25 | |
| samuelms | henrynash, yes | 20:26 |
| samuelms | henrynash, I proposed to change the 'inherited_to_projects': 'projects' thing to a 'inherited' dict | 20:27 |
| henrynash | samuelms: and remind me what we currectly retunr? | 20:27 |
| samuelms | henrynash, ^ | 20:27 |
| henrynash | samuelms: oh, right, breaking that down | 20:28 |
| samuelms | henrynash, yes .. that's the point.. not sure if we can do that | 20:28 |
| henrynash | samulems: certainly a change to the api spec | 20:29 |
| samuelms | henrynash, yes .. did you like that? | 20:29 |
| henrynash | samuelms: and what you are representing is where the role is inherited from? | 20:30 |
| samuelms | henrynash, inside the inherited dict | 20:30 |
| henrynash | samuelms: right | 20:30 |
| samuelms | henrynash, it contains info from where the inheritance came from | 20:30 |
| henrynash | samuelms: ..and today, that’s not in there at all is it? | 20:30 |
| samuelms | henrynash, just a sec, checking the code again (https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L590) | 20:31 |
| ayoung | nkinder, running a devstack on F20, and the | 20:31 |
| ayoung | apache user was not created | 20:31 |
| ayoung | I added it into /etc/passwd by hand, but that seems strang | 20:32 |
| ayoung | e | 20:32 |
| ayoung | and that seemed to be what was required to get a devstack run to succeed | 20:32 |
| henrynash | samulems: for effective, it’s stored in the assignment link, no? | 20:32 |
| samuelms | henrynash, https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L736-L754 | 20:33 |
| samuelms | henrynash, yes | 20:33 |
| henrynash | samulems: so not sure why we need the extra bit you are adding…is it telling me something more? | 20:33 |
| samuelms | henrynash, hmm .. so assignment link tells us that the assignment came from a domain (inherited), right? | 20:34 |
| henrynash | samuelms: indeed | 20:35 |
| samuelms | henrynash, ok .. but once we have Hierarchical Projects | 20:35 |
| henrynash | samuelms: …and now it might come from a project | 20:35 |
| samuelms | henrynash, we just put the parent's id? | 20:35 |
| *** lhcheng has quit IRC | 20:36 | |
| samuelms | henrynash, if we have 'inherited' dict with 'project' or 'domain' inside it .. we can add a name if we want .. | 20:36 |
| samuelms | henrynash, i think it's more meaningful for the user .. | 20:36 |
| henrynash | samuelms: that’s true… | 20:36 |
| *** kobtea has joined #openstack-keystone | 20:36 | |
| samuelms | henrynash, once we have a deep hierarchy ... oh wait ! I got an id : j239818j28 | 20:37 |
| samuelms | henrynash, no idea of what project that represents :P | 20:37 |
| *** kobtea has quit IRC | 20:37 | |
| henrynash | samuelms: the idea of the assignment link is that you should be ablt to issue a GET of that API and read the assignment | 20:37 |
| *** kobtea has joined #openstack-keystone | 20:37 | |
| henrynash | samulems: or GET /project/proj_id | 20:38 |
| henrynash | samuelms: not sure whether the additional advantage is worth the changeing of the API…. | 20:38 |
| samuelms | henrynash, /projects/parent_id/users/user_id/roles/role_id/inherited_to_projects ? | 20:38 |
| henrynash | samuelms: yep…OK it doesn’t really do you any good…since Getting that just confirms it exists | 20:39 |
| henrynash | samuelms: but in general we try and retunr links that you cold go execute and find our more info | 20:39 |
| samuelms | henrynash, makes sense | 20:40 |
| samuelms | henrynash, a user with any role (doesnt matter) on a project, should be able to do a GET on that project, in your opinion? | 20:41 |
| henrynash | samuelms: well, that depends on policy….a user with any role can get a scoped token to that project | 20:42 |
| *** kobtea has quit IRC | 20:42 | |
| samuelms | henrynash, ok .. just a last thing about the current format we use .. | 20:43 |
| samuelms | henrynash, on this example https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L611-L628 | 20:43 |
| samuelms | henrynash, and everywhere ... why do we use 'inherited_to_projects': 'projects'? | 20:43 |
| raildo | morganfainberg, I need to create a new BP for the HM stuffs and the Reseller use case? | 20:43 |
| samuelms | henrynash, that could be only 'inherited': True/False | 20:44 |
| samuelms | henrynash, if it's inherited .. it's obvious that it is to projects :P | 20:44 |
| henrynash | samuelms: ahhhh…a long and bloody battle was fought.... | 20:44 |
| henrynash | samuelms: and like all good battles some the details are lost in the mists of time… but | 20:44 |
| samuelms | henrynash, haha | 20:45 |
| henrynash | samuelms: at the time I think we also thought about supporting inheritance to a tree of domains | 20:45 |
| samuelms | henrynash, but it doesnt make sense anymore, right? | 20:45 |
| henrynash | samuelms: or indeed to some subset of projects | 20:45 |
| henrynash | samuelms: like you could have an expression in there, e.g. 'inherited_to_projects': ‘name=hen*’ | 20:46 |
| samuelms | henrynash, hmm .. interesting .. so let's keep that .. maybe we'll need it soon :p | 20:47 |
| henrynash | samuelms: I think my default approach was what you are advocating..just make it a boolean, but in order to cater for the requirements that peopel wanted to potentially expand this into, we went for str field we could but other thinsg into | 20:47 |
| samuelms | henrynash, with hierarchical projects .. | 20:47 |
| morganfainberg | raildo, yes a new BP please. | 20:48 |
| samuelms | henrynash, makes sense now .. let's keep that .. maybe useful for hierarchical projects soon | 20:48 |
| *** openstackgerrit has quit IRC | 20:49 | |
| *** openstackgerrit has joined #openstack-keystone | 20:49 | |
| samuelms | henrynash, I just fixed my example to use the assignment link thing | 20:50 |
| samuelms | henrynash, since there's no problem with exposing parent's id .. we should be ok with that | 20:50 |
| raildo | morganfainberg, great :) | 20:51 |
| *** htruta has quit IRC | 20:51 | |
| henrynash | samuelms: is that a real example….is that expanded or simple? | 20:51 |
| henrynash | samuelms: looks like a mix, no? | 20:52 |
| samuelms | henrynash, expanded .. from a inherited role assignment of a group on a parent project | 20:52 |
| samuelms | henrynash, assignment link tells us where it was inherited from | 20:52 |
| henrynash | samuelms: I need to go read up it again! | 20:53 |
| samuelms | henrynash, ok | 20:53 |
| samuelms | henrynash, I described all the cases again .. considering Hierarchical Projects | 20:53 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 20:55 |
| *** _sunil_ has quit IRC | 20:56 | |
| samuelms | henrynash, maybe it should be easier if I show how we have those assignments represented today | 20:56 |
| henrynash | samuelms: agreed | 20:56 |
| samuelms | henrynash, so please stop looking at that .. | 20:56 |
| *** _sunil_ has joined #openstack-keystone | 20:56 | |
| samuelms | henrynash, I'll rewrite and ping you again :) | 20:56 |
| henrynash | samuelms: ok | 20:57 |
| rodrigods | ayoung, have to ask, why not just checking if it is None while appending? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/revoke/model.py#n232 | 20:59 |
| morganfainberg | henrynash, does the deprecated to resource decorator need @staticmethod ? | 20:59 |
| morganfainberg | henrynash, https://review.openstack.org/#/c/130954/20/keystone/assignment/core.py | 20:59 |
| ayoung | rodrigods, see the comment above? #tree.get returns `None` if there is no match, so `bundle.append` | 20:59 |
| henrynash | morganfainberg: what woud that get us…? | 21:00 |
| morganfainberg | henrynash, or should it be moved out of the class scope...it... i'm not sure that works like you're expecting it | 21:00 |
| rodrigods | ayoung, yes... I meant, why before appending to bundle we assign tree.get() to a var and check if it is None? | 21:00 |
| *** _sunil_ has quit IRC | 21:00 | |
| rodrigods | why don't* | 21:00 |
| henrynash | morganfainberg: I do have a test for it….and haev checked the logs and the messages are there | 21:00 |
| morganfainberg | henrynash, it might act weird being in that scope is all. - i've never seen someone use a class scope like that. | 21:01 |
| henrynash | morganfainberg: but I’m on teh ragged edge of my python knowledge, I’ll readily admit | 21:01 |
| morganfainberg | i would expect based upon how it's structured to be @staticmethod and be referenced as @<class>.deprecated_to_resource | 21:01 |
| ayoung | rodrigods, I think we could do it either way. We went back and fort over that as I recall | 21:02 |
| morganfainberg | or to be defined at the top of the file not in a specific scope. | 21:02 |
| *** stevemar has joined #openstack-keystone | 21:02 | |
| *** ChanServ sets mode: +v stevemar | 21:02 | |
| morganfainberg | it *might* work, i just think it's going to be weird. | 21:02 |
| rodrigods | ayoung, great code btw. | 21:02 |
| ayoung | rodrigods, wasn't mine...that was Yorik-Sar's work | 21:02 |
| samuelms | henrynash, for that refactoring that improves the performance of list role assignments .. could I submit a first patch for what we have today (without spliting the code between controller/manager) ? | 21:03 |
| henrynash | morganfainberg: ok, I’ll look into that….also take a look at the way I handled the assignment/resouce config values….it’s in resource/core/__init__() | 21:03 |
| samuelms | henrynash, I mean just rebasing on your work? | 21:03 |
| samuelms | henrynash, and a second one (depending on this first) using the common language (for manager/driver) and splitting the code between controller/manager? | 21:03 |
| morganfainberg | henrynash, yeah the original design of those methods didn't take into account a split like this | 21:04 |
| henrynash | samuelms: you could…but I guess the question would be whether there’s and advantage to do the split into two steps | 21:04 |
| samuelms | henrynash, since we'll introduce a new way to represent expanded assignments at manager level .. and format them at manager level.. maybe it would be easir for other people to review .. | 21:05 |
| henrynash | morganfainberg: happy to get other ideas on that… | 21:05 |
| morganfainberg | dolphm, so i'm off the hook on doing expense reports today... the expense report system is broken :P | 21:06 |
| morganfainberg | dolphm, hah | 21:06 |
| henrynash | morganfainberg: need to go off line for a while…will be back online and look at comments | 21:06 |
| morganfainberg | henrynash, yeah not sure if i have something better up my sleeve on this one | 21:06 |
| morganfainberg | henrynash, will think about it | 21:06 |
| morganfainberg | henrynash, and comment if i have an idea | 21:06 |
| samuelms | samuelms, the first improves the performance itself .. the second split the code between manager/controller | 21:06 |
| dolphm | morganfainberg: i'm in the same boat, except with rackspace's new insurance provider. | 21:07 |
| morganfainberg | dolphm, fun times! | 21:07 |
| openstackgerrit | Andre Aranha proposed openstack/keystone: Creating a policy sample https://review.openstack.org/135083 | 21:08 |
| *** samuelms is now known as samuelms-away | 21:08 | |
| openstackgerrit | Andre Aranha proposed openstack/keystone: Creating a policy sample https://review.openstack.org/123509 | 21:10 |
| *** topol has quit IRC | 21:10 | |
| *** thedodd has quit IRC | 21:10 | |
| rodrigods | morganfainberg, seems fileutils graduation hasn't started yet | 21:11 |
| rodrigods | ayoung, ^ | 21:12 |
| ayoung | rodrigods, nothing moves fast | 21:12 |
| rodrigods | ayoung, do we write its graduation spec or wait? =) | 21:13 |
| ayoung | hmmm | 21:13 |
| *** NM has quit IRC | 21:13 | |
| ayoung | who is the owner of fileutils? | 21:13 |
| rodrigods | ayoung, good question | 21:14 |
| ayoung | http://git.openstack.org/cgit/openstack/oslo-incubator/log/openstack/common/fileutils.py | 21:15 |
| ayoung | seems a little on the trivial side... | 21:16 |
| marekd | gyee: what's up? | 21:17 |
| *** jacorob has quit IRC | 21:17 | |
| ayoung | what do we use from file_utils anyway? | 21:17 |
| *** lhcheng has joined #openstack-keystone | 21:17 | |
| ayoung | read and dlete cached files...ok, I guess we should keep that | 21:17 |
| rodrigods | ayoung, fileutils is going to move to oslo.utils, we won't have a oslo.fileutils | 21:18 |
| ayoung | rodrigods, I would almost want that code out of policy anyway | 21:18 |
| ayoung | it seems to me that policy should be separate from any form of file management, should be up to the caller where and how to find the policy file | 21:19 |
| rodrigods | ayoung, ++ | 21:20 |
| ayoung | and not sure how well that works with mod_wsgi in prefork mode anyway, I think it might be assuming eventlet | 21:20 |
| marekd | gyee: drop me an e-mail if you still need something, as I am running away as of now. | 21:21 |
| *** marekd is now known as marekd|away | 21:21 | |
| *** fifieldt_ has joined #openstack-keystone | 21:22 | |
| *** fifieldt has quit IRC | 21:23 | |
| *** thedodd has joined #openstack-keystone | 21:24 | |
| rodrigods | ayoung, so we drop it and expect the caller to pass the object to be handled? | 21:24 |
| morganfainberg | rodrigods, i'm fine carrying fileutils as incubator as part of the initial graduation | 21:26 |
| morganfainberg | ayoung, unless you have a complaint about that | 21:26 |
| *** radez is now known as radez_g0n3 | 21:27 | |
| *** _sunil_ has joined #openstack-keystone | 21:27 | |
| rodrigods | morganfainberg, ++ so we are left only with the oslo.config blocker (which I didn't get it) | 21:28 |
| *** jacorob has joined #openstack-keystone | 21:28 | |
| dhellmann | rodrigods, morganfainberg : what's the oslo.config issue? | 21:30 |
| morganfainberg | dhellmann, just that we should provide an alternative interface | 21:30 |
| dhellmann | rodrigods: you could also proceed and use the incubated copy of fileutils, then switch to oslo.utils when we graduate it | 21:30 |
| dhellmann | morganfainberg: ah, ok | 21:30 |
| morganfainberg | dhellmann, as we discussed... so people don't *have* to use oslo.config to use policy | 21:30 |
| *** gokrokve has joined #openstack-keystone | 21:31 | |
| dhellmann | sure | 21:31 |
| morganfainberg | rodrigods, ^ and the last blocker - we need a name | 21:31 |
| morganfainberg | 2 really hard things in CS... | 21:31 |
| dhellmann | although I would expect all openstack projects to use oslo.config -- do you expect policy to be used outside of openstack? | 21:31 |
| ayoung | morganfainberg, no complaint, just a longer term direction | 21:31 |
| *** vejdmn has joined #openstack-keystone | 21:31 | |
| morganfainberg | cache coherency ... and naming things | 21:31 |
| dhellmann | morganfainberg: naming things, cache invalidation, and off-by-one errors? | 21:31 |
| ayoung | lets be practical minded about getting it graduated, and I don't think we want to remove the file handling stuff for the people that use it now. | 21:31 |
| morganfainberg | dhellmann, ++ | 21:31 |
| morganfainberg | dhellmann, fence posting? | 21:32 |
| ayoung | Longer term, I want to get the policy file from keystone via Keystoneclienbt | 21:32 |
| morganfainberg | ayoung, not removing the file handling, offer another way to load the file handling | 21:32 |
| ayoung | exactly | 21:32 |
| *** vejdmn has quit IRC | 21:32 | |
| morganfainberg | dhellmann, ideally i'd like to make it a more generic lib | 21:32 |
| morganfainberg | but for now i think we can stick with openstack-only? | 21:32 |
| dhellmann | morganfainberg: sure, just don't let that prevent you from doing something useful in the short term :-) | 21:32 |
| morganfainberg | i know some folks are running keystoen in lieu of shibboleth (et al), maybe similarly they'll want to use the policy. | 21:32 |
| dhellmann | morganfainberg: exactly | 21:33 |
| morganfainberg | rodrigods, so... the only blocker - new name | 21:33 |
| morganfainberg | rodrigods, and no we're not calling it keystonepolicy | 21:33 |
| morganfainberg | :P | 21:33 |
| ayoung | python-keystone-policy | 21:33 |
| ayoung | heh | 21:33 |
| morganfainberg | i mean, we can do that if we want. but i'd like it to not be a "keystone" tagged thing | 21:34 |
| ayoung | agreed, but then the only namespace that makes sense is oslo | 21:34 |
| morganfainberg | it doesn't rely on "keystone" to be a rules parser | 21:34 |
| morganfainberg | ayoung, pycadf isn't oslo namespaced nor is it keystone namespaced | 21:34 |
| morganfainberg | and we own that. | 21:34 |
| morganfainberg | i see policy being similar. | 21:35 |
| ayoung | yeah, cadf. So some sort of long acronym? | 21:35 |
| ayoung | capf | 21:35 |
| morganfainberg | cloud audit something something? | 21:35 |
| ayoung | cpre | 21:35 |
| morganfainberg | woot baclronym! | 21:35 |
| ayoung | cloud policy rules engine | 21:35 |
| morganfainberg | backronym... | 21:35 |
| morganfainberg | cadf -> Cloud Auditing Data Federation | 21:36 |
| morganfainberg | pycpre isn't a bad one | 21:36 |
| ayoung | <fargo>Well now, there ya go!</fargo> | 21:36 |
| morganfainberg | ayoung, ... and on that note. | 21:37 |
| morganfainberg | i'm going to go take care of something really important | 21:37 |
| * morganfainberg goes and gets a replacement driver's license. | 21:37 | |
| ayoung | Heh | 21:37 |
| morganfainberg | it's scary but thye let me drive here in california :P | 21:37 |
| * ayoung goes for more coffee | 21:37 | |
| morganfainberg | ayoung, ooh good idea. | 21:37 |
| morganfainberg | coffee too | 21:37 |
| morganfainberg | nkinder, sorry wont be in the bay for the meetup this time :( | 21:38 |
| morganfainberg | nkinder, lets plan more in advance than starting at the summit for the next mid-cycle. | 21:38 |
| morganfainberg | nkinder, and we'll def. aim for the bay area. | 21:38 |
| ayoung | morganfainberg, why the redirect? | 21:42 |
| ayoung | from Bay to SAT? | 21:42 |
| morganfainberg | ayoung, generally speaking we have more people who can't make it to the Bay this time around. | 21:42 |
| ayoung | OK | 21:42 |
| morganfainberg | ayoung, my goal is that for the next summit (regardless if I'm PTL or not, or if we have PTLs) we can have the details lined up. e.g. "hey everyone midcycle is at XXX" | 21:43 |
| morganfainberg | so it's easy to budget for. | 21:44 |
| morganfainberg | greater lead time, easier to justify, etc. | 21:44 |
| morganfainberg | or even if we have the need for a midcycle (you were cc'd on the thread) | 21:45 |
| *** Kr4zy has joined #openstack-keystone | 21:52 | |
| *** tellesnobrega has joined #openstack-keystone | 21:52 | |
| Kr4zy | anyone having problems starting keystone icehouse when using setting this value, use_syslog_rfc_format=True, in keystone.conf? | 21:53 |
| *** gokrokve has quit IRC | 21:55 | |
| rodrigods | morganfainberg, haha sorry for the delay was driving home =) | 22:03 |
| rodrigods | morganfainberg, the name... hmm | 22:03 |
| rodrigods | I think ayoung has the imagination to it =) | 22:03 |
| *** jacorob has quit IRC | 22:04 | |
| ayoung | I was just trying to use the basic_auth middleware patch and not getting the Authorization header. I just figured out why it doesn't work in devstack now. Anyone want to venture a guess? | 22:06 |
| *** BAKfr has quit IRC | 22:06 | |
| *** BAKfr has joined #openstack-keystone | 22:09 | |
| jamielennox | ayoung: so it seems there's a reason that no one has done certmonger - it's hard :) | 22:16 |
| ayoung | not it isn't | 22:17 |
| ayoung | you just need nalin | 22:17 |
| ayoung | :) | 22:17 |
| ayoung | jamielennox, what is tripping you up? | 22:17 |
| jamielennox | ayoung: so certmaster doesn't support DNS name, email, usage flags and all that stuff that in the getcert request --help | 22:18 |
| jamielennox | turns out we really need the DNS name field | 22:18 |
| ayoung | jamielennox, ah...thought we were going to skip the certmaster one...just use local | 22:18 |
| ayoung | might have the same issues, though | 22:18 |
| jamielennox | i looked at just adding it to certmaster - there hasn't been an update there since about 2011 | 22:18 |
| jamielennox | so i got it to work with local | 22:18 |
| jamielennox | however local doesn't exist in ubuntu installations | 22:19 |
| ayoung | jamielennox, that is an update issue | 22:19 |
| ayoung | its on its way | 22:19 |
| jamielennox | as in it's been packaged already? | 22:19 |
| ayoung | and we can get a version available...its like FreeIPA issues: there are packages now | 22:19 |
| ayoung | jamielennox, I think so. Need to see what is in Debian | 22:19 |
| jamielennox | i kind of figured local would have been trivial - why wouldn't it have been packaged initially ? | 22:19 |
| * ayoung goes to look | 22:20 | |
| ayoung | jamielennox, cuz nalin wrote "local" for us | 22:20 |
| jamielennox | ahhh | 22:20 |
| jamielennox | i think i could fix certmaster fairly quickly - but i don't know where to submit those patches | 22:20 |
| jamielennox | but local would be fine | 22:21 |
| jamielennox | does devstack need to work on OSX? | 22:21 |
| ayoung | https://packages.debian.org/sid/certmonger | 22:22 |
| ayoung | F20 has certmonger-0.75.14-1.fc20.x86_64 | 22:22 |
| ayoung | testing has Package: certmonger (0.75.14-2) | 22:23 |
| ayoung | jamielennox, if it were up to me I'd say "no" but it is not up to me | 22:23 |
| jamielennox | it makes a difference as i ripped out the openssl stuff completely | 22:24 |
| ayoung | jamielennox, thought certmaster was built out of the same repo as certmonger, so patches would go there | 22:24 |
| ayoung | but would not bother | 22:24 |
| ayoung | morganfainberg, dolphm certmonger does not run on Mac. Is that going to be a dealbreaker? | 22:25 |
| jamielennox | so i found https://git.fedorahosted.org/cgit/certmaster.git/tree/ but i agree, with the time it takes to get distributed it's probably not worth it | 22:25 |
| *** marcoemorais has quit IRC | 22:25 | |
| *** gokrokve has joined #openstack-keystone | 22:26 | |
| ayoung | jamielennox, yeah, the intention was that "local" was for selfsign/internal usage, and dogtag for a real CA...and the Semantic's of the world can write their own plugins if they want, too | 22:28 |
| jamielennox | ayoung: yep | 22:28 |
| jamielennox | ayoung: i just thought we were using certmaster for that but locals fine | 22:28 |
| jamielennox | anyway - works on F20 | 22:28 |
| *** Kr4zy has quit IRC | 22:28 | |
| ayoung | sorry to not make that clear...didn't mean to waste your time on the certmaster approach | 22:28 |
| jamielennox | meh - that didn't take long | 22:28 |
| ayoung | jamielennox, so Ade is working on the Barbican plugin | 22:29 |
| jamielennox | it's going to be the cross platform bit that is the problem | 22:29 |
| ayoung | is there a MacOS analogue to Dbus? | 22:29 |
| ayoung | http://stackoverflow.com/questions/2723936/is-there-an-equivalent-to-dbus-on-osx | 22:29 |
| ayoung | jamielennox, looks like dbus would work via brew...we'll let some Mac person set it up, though | 22:30 |
| jamielennox | ayoung: is mac a target though? does anyone do that? morganfainberg ? | 22:31 |
| ayoung | jamielennox, they tend to use a VM to develop | 22:31 |
| ayoung | I think we are good | 22:31 |
| jamielennox | ayoung: ok, well need to see what's going on with local on ubuntu | 22:32 |
| jamielennox | i assume it will mean it won't work under F19 etc | 22:32 |
| ayoung | jamielennox, I think you would need to install the Debian/testing version | 22:32 |
| ayoung | yeah, needs a relatively recent certmonger | 22:32 |
| *** marcoemorais has joined #openstack-keystone | 22:34 | |
| ayoung | OK...stomping herd upstairs...time to go be a dad. | 22:34 |
| *** ayoung is now known as ayoung-dadmode | 22:34 | |
| *** marcoemorais has quit IRC | 22:35 | |
| *** marcoemorais has joined #openstack-keystone | 22:36 | |
| jamielennox | ayoung-dadmode: that deb package relies on "init-system-helpers" of a newer version that 14.04 has - not sure we can get away with updating that | 22:37 |
| *** marcoemorais has quit IRC | 22:37 | |
| *** tellesnobrega has quit IRC | 22:37 | |
| *** marcoemorais has joined #openstack-keystone | 22:37 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Authenticated Encryption Tokens https://review.openstack.org/130050 | 22:38 |
| *** henrynash has quit IRC | 22:43 | |
| morganfainberg | I develop direct on the Mac. As does dolphm | 22:45 |
| *** henrynash has joined #openstack-keystone | 22:46 | |
| *** ChanServ sets mode: +v henrynash | 22:46 | |
| dolphm | i develop keystone as much as possible directly on a mac, but run devstack on a vm, so as long as that's the only place i need certmonger, i'd be fine | 22:48 |
| *** lhcheng_ has joined #openstack-keystone | 22:48 | |
| morganfainberg | dolphm: ++ | 22:48 |
| morganfainberg | that sums up my view. | 22:49 |
| morganfainberg | I would like unit tests (what we have today) to keep working on the Mac. | 22:49 |
| *** lhcheng has quit IRC | 22:51 | |
| *** vejdmn has joined #openstack-keystone | 22:56 | |
| jamielennox | does devstack work on OSX today? | 22:57 |
| jamielennox | i can't imagine it would | 22:58 |
| jamielennox | not to mention - you'd be stupid to run it directly anyway so it probably doesn't matter | 22:58 |
| *** rharwood has joined #openstack-keystone | 23:01 | |
| *** gokrokve has quit IRC | 23:01 | |
| *** gokrokve has joined #openstack-keystone | 23:02 | |
| *** marcoemorais has quit IRC | 23:02 | |
| *** marcoemorais has joined #openstack-keystone | 23:03 | |
| *** marcoemorais has quit IRC | 23:03 | |
| *** marcoemorais has joined #openstack-keystone | 23:04 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Correct token flush logging https://review.openstack.org/131003 | 23:04 |
| *** gokrokve has quit IRC | 23:06 | |
| *** r-daneel has quit IRC | 23:14 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Remove middleware architecture doc https://review.openstack.org/127081 | 23:18 |
| *** nkinder has quit IRC | 23:20 | |
| *** gyee has quit IRC | 23:21 | |
| *** rm_work is now known as rm_work|away | 23:22 | |
| *** rm_work|away is now known as rm_work | 23:23 | |
| *** jaosorior has quit IRC | 23:23 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Configuring Keystone edits https://review.openstack.org/131318 | 23:24 |
| morganfainberg | dolphm: thanks for taking on API working group liaison! | 23:27 |
| morganfainberg | jamielennox: I wouldn't try to run devstack on OS X natively. I might add the scripts would fail. | 23:28 |
| jamielennox | morganfainberg: yea, the scripts would fail, i was thinking about it and there's no brew for mysql or anything | 23:28 |
| *** dims_ has joined #openstack-keystone | 23:28 | |
| *** henrynash has quit IRC | 23:30 | |
| morganfainberg | There is a native MySQL. Dunno how out of date it is though. | 23:30 |
| *** vejdmn has quit IRC | 23:31 | |
| *** dims has quit IRC | 23:32 | |
| *** nkinder has joined #openstack-keystone | 23:33 | |
| *** agireud has quit IRC | 23:39 | |
| *** soren has quit IRC | 23:44 | |
| *** _sunil_ has quit IRC | 23:50 | |
| *** diegows has quit IRC | 23:50 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Replace magic numbers with named symbols https://review.openstack.org/135127 | 23:50 |
| *** _sunil_ has joined #openstack-keystone | 23:50 | |
| stevemar | looks like bknudson is back from paris :) | 23:54 |
| *** _sunil_ has quit IRC | 23:55 | |
| morganfainberg | bknudson, welcome back! | 23:55 |
| *** nkinder has quit IRC | 23:56 | |
| morganfainberg | stevemar, i mean.. hi | 23:56 |
| *** bknudson has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!