| *** zz_avozza is now known as avozza | 00:01 | |
| *** jasondotstar has joined #openstack-keystone | 00:21 | |
| *** jasondotstar has quit IRC | 00:21 | |
| *** oomichi has joined #openstack-keystone | 00:35 | |
| *** stevemar has quit IRC | 00:40 | |
| *** samuelms has joined #openstack-keystone | 00:42 | |
| *** boris-42 has quit IRC | 00:52 | |
| *** avozza is now known as zz_avozza | 01:22 | |
| samuelms | bknudson, hi, how max-complexity in tox.ini is calculated? | 01:23 |
|---|---|---|
| samuelms | bknudson, ahh .. just saw that's the McCabe complexity threshold | 01:25 |
| *** lhcheng has joined #openstack-keystone | 01:31 | |
| *** jacer_huawei has joined #openstack-keystone | 01:41 | |
| *** jacer_huawei is now known as wanghong | 01:41 | |
| *** wanghong has quit IRC | 01:56 | |
| openstackgerrit | wanghong proposed openstack/keystone: remove assignments for foreign actors when deleting domain https://review.openstack.org/127433 | 01:57 |
| *** stevemar has joined #openstack-keystone | 02:05 | |
| *** ChanServ sets mode: +v stevemar | 02:05 | |
| *** fifieldt has joined #openstack-keystone | 02:05 | |
| *** wanghong has joined #openstack-keystone | 02:09 | |
| *** lhcheng has quit IRC | 02:13 | |
| *** erkules_ has joined #openstack-keystone | 02:17 | |
| *** erkules has quit IRC | 02:19 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: User ids that begin with 0 cannot authenticate through ldap https://review.openstack.org/137449 | 02:26 |
| openstackgerrit | wanghong proposed openstack/keystone: add circular check when updating region https://review.openstack.org/130474 | 02:26 |
| openstackgerrit | wanghong proposed openstack/keystone: Can't update catalog objects when using kvs driver https://review.openstack.org/130180 | 02:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: sync to oslo commit b19af08 https://review.openstack.org/138253 | 02:29 |
| openstackgerrit | wanghong proposed openstack/keystone: Can't update catalog objects when using kvs driver https://review.openstack.org/130180 | 02:32 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove XML support https://review.openstack.org/125738 | 02:32 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update docs to no longer show XML support https://review.openstack.org/125753 | 02:32 |
| *** ncoghlan has joined #openstack-keystone | 02:34 | |
| openstackgerrit | Merged openstack/keystone: Typo in policy call https://review.openstack.org/139780 | 02:38 |
| openstackgerrit | wanghong proposed openstack/keystone: add circular check when updating region https://review.openstack.org/130474 | 02:42 |
| openstackgerrit | wanghong proposed openstack/keystone: Can't update catalog objects when using kvs driver https://review.openstack.org/130180 | 02:42 |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystone: Add library oslo.concurrency in file oslo.config.generator.rc https://review.openstack.org/137270 | 02:44 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Adds openSUSE support for developer documentation https://review.openstack.org/129256 | 02:44 |
| openstackgerrit | Merged openstack/keystone: Move notification unit tests to unit test dir https://review.openstack.org/133834 | 02:56 |
| openstackgerrit | wanghong proposed openstack/keystone: remove unnecessary checks in assignment/controllers.py https://review.openstack.org/130722 | 03:00 |
| openstackgerrit | Merged openstack/keystone: make sample_data.sh account for the default options in keystone.conf https://review.openstack.org/136199 | 03:05 |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: fallback to online validation if offline validation fails https://review.openstack.org/131036 | 03:16 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add name parameter to NoMatchingPlugin exception https://review.openstack.org/139898 | 03:16 |
| *** lhcheng has joined #openstack-keystone | 03:25 | |
| *** david-lyle_afk has quit IRC | 03:31 | |
| *** david-lyle_afk has joined #openstack-keystone | 03:43 | |
| *** david-lyle_afk has quit IRC | 03:50 | |
| *** wanghong has quit IRC | 03:51 | |
| *** WDarren has joined #openstack-keystone | 03:52 | |
| *** david-lyle_afk has joined #openstack-keystone | 04:02 | |
| *** david-lyle_afk has quit IRC | 04:02 | |
| *** wanghong has joined #openstack-keystone | 04:06 | |
| WDarren | does "endpoint policy" extension mean that we can set "policy.json" for other services? | 04:09 |
| WDarren | I think examples in the current docs about "endpoin policy" is vague | 04:10 |
| WDarren | e.g. "blob": "--serialized-blob--" | 04:10 |
| *** dimsum__ has quit IRC | 04:11 | |
| WDarren | can anybody provide a more specific example about "blob"? | 04:12 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add a test to ensure the version check error https://review.openstack.org/139512 | 04:17 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 04:17 |
| *** ajayaa has joined #openstack-keystone | 04:17 | |
| jamielennox | WDarren: henry nash is the expert on that one, essentially it means though that we can set a policy.json specific to a service at a URL, and have services with different policies for different uses | 04:18 |
| jamielennox | the blob will essentially be the contents of policy.json | 04:18 |
| jamielennox | this is moving towards a place where keystone controls policy for all of OpenStack - i'm not aware of how you could use that functionality now | 04:19 |
| *** lhcheng has quit IRC | 04:20 | |
| *** ishant has joined #openstack-keystone | 04:28 | |
| *** ishant has quit IRC | 04:28 | |
| *** lhcheng has joined #openstack-keystone | 04:36 | |
| *** samuelms has quit IRC | 04:39 | |
| *** samuelms has joined #openstack-keystone | 04:40 | |
| *** samuelms has quit IRC | 04:44 | |
| stevemar | jamielennox, ping, can i bug you to review https://review.openstack.org/#/c/130564/ and https://review.openstack.org/#/c/134364/ | 04:50 |
| stevemar | jamielennox, also, i'm thinking about how to best position this guy: https://review.openstack.org/#/c/134700/ on top of the 'federation framework' | 04:50 |
| jamielennox | stevemar: so https://review.openstack.org/#/c/134364/5/keystoneclient/v3/contrib/oauth1/access_tokens.py will change a little | 04:52 |
| jamielennox | the object that is passed to the managers is an adapter, so you should be able to do self.client.get_endpoint() | 04:52 |
| stevemar | jamielennox, is that merged yet? | 04:53 |
| jamielennox | stevemar: i think so | 04:53 |
| jamielennox | stevemar: actually yes | 04:53 |
| stevemar | jamielennox, gah, okay, thanks for the heads up, i'll change it up | 04:54 |
| stevemar | jamielennox, as soon as that merges i'll be adding functional tests to osc to catch this stuff | 04:54 |
| jamielennox | added the comment, you should be able to use https://review.openstack.org/#/c/117089/ to test it | 04:55 |
| jamielennox | i haven't touched that in a while i assume it still merges | 04:55 |
| WDarren | jamielennox: I'm not using it now, just feel confused when reading docs because no examples show what blob is. | 04:57 |
| jamielennox | the framework one i wrote initially - i don't mind so much on that one, i like the clean up but i'm really hoping that marekd|away finishes of the push he's been doing to allow the unscoped->scoped transition to go via the regular Token mechanism rather than need something federation specific | 04:57 |
| stevemar | jamielennox, i'm assuming self.client.get_endpoint will be http://hostname:port/v3 (or v2.0) right? | 04:57 |
| jamielennox | stevemar: if you give AUTH_INTERFACE it will be whatever you gave to auth_url= | 04:58 |
| jamielennox | otherwise give version=(2,0) or version=(3,0) if you want the versioned endpoint | 04:59 |
| *** lhcheng has quit IRC | 04:59 | |
| *** david-lyle_afk has joined #openstack-keystone | 05:01 | |
| jamielennox | stevemar: i'm not sure session does the right thing everywhere about cloning the headers dict | 05:02 |
| jamielennox | stevemar: headers=self.HEADER_X_FORM might end up with token in it or some other junk | 05:02 |
| stevemar | jamielennox, so far it doesn't seem to do anything too bad to it | 05:03 |
| jamielennox | stevemar: yep, just looking and saw it | 05:03 |
| jamielennox | at that point there isn't a token or anything to pollute with | 05:04 |
| *** wanghong has quit IRC | 05:05 | |
| *** wanghong has joined #openstack-keystone | 05:05 | |
| stevemar | jamielennox, do you mean self.api.get_endpoint() ? | 05:06 |
| jamielennox | stevemar: yes, from memory api/client are the same thing there - something the apiclient guys were trying to chang e | 05:06 |
| *** dimsum__ has joined #openstack-keystone | 05:11 | |
| stevemar | jamielennox, oh looks like you already fixed that for me :) | 05:15 |
| stevemar | jamielennox, just the project id is missing now, cause of the apache issue | 05:15 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Project ID in OAuth headers was missing https://review.openstack.org/134364 | 05:17 |
| stevemar | jamielennox, ^ it's now a tiny change | 05:17 |
| *** dimsum__ has quit IRC | 05:17 | |
| jamielennox | stevemar: +2 - i assume you know what you are doing there and i don't have a setup to test it | 05:18 |
| stevemar | jamielennox, it's just to satisfy mod_wsgi, it's the exact same code on the server side, but mod_wsgi filters out headers with underscores | 05:19 |
| jamielennox | stevemar: if that tests patch fixes things for you leave a review | 05:21 |
| jamielennox | it's been around a while | 05:21 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134125 | 05:21 |
| *** serverascode___ has quit IRC | 05:37 | |
| *** serverascode___ has joined #openstack-keystone | 05:41 | |
| stevemar | jamielennox, ugh that federation framework patch is in a rough rebase | 05:50 |
| *** k4n0 has joined #openstack-keystone | 06:01 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:05 |
| *** tylerdurden has joined #openstack-keystone | 06:32 | |
| *** shakamunyi has quit IRC | 06:34 | |
| openstackgerrit | wanghong proposed openstack/keystone: fix wrong indentation in contrib/federation/utils.py https://review.openstack.org/139923 | 06:57 |
| *** wanghong has quit IRC | 07:00 | |
| *** stevemar has quit IRC | 07:03 | |
| *** wanghong has joined #openstack-keystone | 07:13 | |
| *** nellysmitt has joined #openstack-keystone | 07:36 | |
| *** erkules_ is now known as erkules | 07:40 | |
| *** quack_quack_ has quit IRC | 07:49 | |
| *** mzbik has joined #openstack-keystone | 07:50 | |
| *** quack_quack_ has joined #openstack-keystone | 07:52 | |
| *** tsufiev has quit IRC | 07:58 | |
| *** amakarov_away has quit IRC | 08:00 | |
| *** lhcheng has joined #openstack-keystone | 08:00 | |
| *** lhcheng has quit IRC | 08:04 | |
| *** bdossant has joined #openstack-keystone | 08:06 | |
| *** amakarov has joined #openstack-keystone | 08:09 | |
| *** jamielennox is now known as jamielennox|away | 08:12 | |
| *** tsufiev has joined #openstack-keystone | 08:14 | |
| *** jistr has joined #openstack-keystone | 08:16 | |
| *** joe_____ has joined #openstack-keystone | 08:21 | |
| *** zz_avozza is now known as avozza | 08:25 | |
| *** WDarren has left #openstack-keystone | 08:34 | |
| *** WDarren has joined #openstack-keystone | 08:35 | |
| *** WDarren has left #openstack-keystone | 08:36 | |
| *** Nakato_ is now known as Nakato | 08:38 | |
| *** darren-wang has joined #openstack-keystone | 08:41 | |
| *** ncoghlan has quit IRC | 08:46 | |
| *** gothicmindfood has quit IRC | 08:48 | |
| *** nellysmitt has quit IRC | 08:49 | |
| *** nellysmitt has joined #openstack-keystone | 08:52 | |
| *** nellysmitt has quit IRC | 08:54 | |
| *** nellysmitt has joined #openstack-keystone | 08:56 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/134794 | 08:58 |
| *** marekd|away is now known as marekd | 09:06 | |
| *** nellysmitt has quit IRC | 09:12 | |
| *** dimsum__ has joined #openstack-keystone | 09:15 | |
| *** gothicmindfood has joined #openstack-keystone | 09:15 | |
| *** nellysmitt has joined #openstack-keystone | 09:18 | |
| *** afazekas has joined #openstack-keystone | 09:19 | |
| *** dimsum__ has quit IRC | 09:20 | |
| *** Roland has joined #openstack-keystone | 09:21 | |
| *** oomichi has quit IRC | 09:22 | |
| *** joe_____ has quit IRC | 09:23 | |
| *** samuelms has joined #openstack-keystone | 09:44 | |
| *** nellysmitt has quit IRC | 09:45 | |
| *** aix has joined #openstack-keystone | 09:46 | |
| openstackgerrit | wanghong proposed openstack/keystone: set endpoint enabled default to True if not specified(kvs) https://review.openstack.org/139958 | 09:51 |
| *** samuelms has quit IRC | 10:21 | |
| *** nellysmitt has joined #openstack-keystone | 10:28 | |
| *** jistr has quit IRC | 10:51 | |
| openstackgerrit | darren-wang proposed openstack/keystone: Adding [database] section to the introduction to the structure of keystone's primary configuration file. https://review.openstack.org/139971 | 11:02 |
| *** jistr has joined #openstack-keystone | 11:09 | |
| *** andreaf has joined #openstack-keystone | 11:19 | |
| *** andreaf has quit IRC | 11:32 | |
| *** andreaf has joined #openstack-keystone | 11:47 | |
| *** dimsum__ has joined #openstack-keystone | 11:47 | |
| *** avozza is now known as zz_avozza | 11:55 | |
| *** dimsum__ is now known as dims | 12:05 | |
| *** luisjariz has joined #openstack-keystone | 12:09 | |
| *** zz_avozza is now known as avozza | 12:26 | |
| *** jistr has quit IRC | 12:27 | |
| *** jistr has joined #openstack-keystone | 12:28 | |
| *** tellesnobrega has joined #openstack-keystone | 12:29 | |
| *** jamielennox|away is now known as jamielennox | 12:31 | |
| *** wanghong has quit IRC | 12:32 | |
| *** luisjariz has quit IRC | 12:32 | |
| *** wanghong has joined #openstack-keystone | 12:34 | |
| *** wanghong has quit IRC | 12:38 | |
| *** jamielennox is now known as jamielennox|away | 12:41 | |
| *** Roland has left #openstack-keystone | 12:42 | |
| *** wanghong has joined #openstack-keystone | 12:42 | |
| *** tellesnobrega has quit IRC | 12:53 | |
| *** wanghong has quit IRC | 12:59 | |
| lbragstad | morganfainberg: yep, I'll be there on wednesday | 13:06 |
| *** ajayaa has quit IRC | 13:07 | |
| *** bknudson has quit IRC | 13:08 | |
| *** saipandi has joined #openstack-keystone | 13:10 | |
| *** jacer_huawei has joined #openstack-keystone | 13:20 | |
| *** jacer_huawei has quit IRC | 13:25 | |
| *** jacer_huawei has joined #openstack-keystone | 13:27 | |
| *** jacer_huawei has quit IRC | 13:34 | |
| *** jacer_huawei has joined #openstack-keystone | 13:35 | |
| *** gordc has joined #openstack-keystone | 13:38 | |
| *** radez_g0n3 is now known as radez | 13:39 | |
| *** jacer_huawei has quit IRC | 13:42 | |
| *** bjornar has quit IRC | 13:48 | |
| *** jacer_huawei has joined #openstack-keystone | 14:04 | |
| *** ajayaa has joined #openstack-keystone | 14:09 | |
| *** richm has joined #openstack-keystone | 14:15 | |
| *** samuelms has joined #openstack-keystone | 14:16 | |
| *** mikedillion has joined #openstack-keystone | 14:17 | |
| *** jacer_huawei has quit IRC | 14:17 | |
| *** joesavak has joined #openstack-keystone | 14:23 | |
| *** saipandi has quit IRC | 14:24 | |
| *** ajayaa has quit IRC | 14:24 | |
| *** ayoung has joined #openstack-keystone | 14:26 | |
| *** ChanServ sets mode: +v ayoung | 14:26 | |
| *** ayoung has quit IRC | 14:26 | |
| *** mzbik has quit IRC | 14:32 | |
| *** samuelms has quit IRC | 14:33 | |
| *** ayoung has joined #openstack-keystone | 14:33 | |
| *** ChanServ sets mode: +v ayoung | 14:33 | |
| *** bdossant has quit IRC | 14:34 | |
| *** bdossant has joined #openstack-keystone | 14:35 | |
| *** bdossant has quit IRC | 14:36 | |
| *** jacer_huawei has joined #openstack-keystone | 14:43 | |
| *** jacer_huawei has quit IRC | 14:47 | |
| *** zzzeek has joined #openstack-keystone | 14:50 | |
| *** jacer_huawei has joined #openstack-keystone | 14:53 | |
| rodrigods | ayoung, using https://review.openstack.org/#/c/133480 as spec to graduate oslo.policy as well. Need to address stevemar comments though, planning to do it today | 14:59 |
| rodrigods | ayoung, (saw your topic for tomorrow's meeting) | 14:59 |
| ayoung | rodrigods, cool | 14:59 |
| *** jacer_huawei has quit IRC | 14:59 | |
| *** bknudson has joined #openstack-keystone | 15:00 | |
| *** ChanServ sets mode: +v bknudson | 15:00 | |
| ayoung | rodrigods, so...I'm thinking we need a general "Cache" mechansim. Its for all things in a middleware that eed t fetch docs from Keystone, like the certs in PKI and the policy files | 15:00 |
| ayoung | Keystone client would accept a cache object for operations, but Middleware would actively manage it | 15:01 |
| *** jacer_huawei has joined #openstack-keystone | 15:03 | |
| *** tellesnobrega has joined #openstack-keystone | 15:12 | |
| *** nellysmitt has quit IRC | 15:12 | |
| morganfainberg | morning | 15:17 |
| *** nellysmitt has joined #openstack-keystone | 15:19 | |
| *** gordc has quit IRC | 15:20 | |
| lbragstad | morganfainberg: I will be available wednesday in austin | 15:20 |
| lbragstad | morganfainberg: just fyi | 15:20 |
| *** gordc has joined #openstack-keystone | 15:23 | |
| morganfainberg | lbragstad, great! | 15:28 |
| *** tellesnobrega has quit IRC | 15:28 | |
| *** nkinder has joined #openstack-keystone | 15:30 | |
| *** andreaf has quit IRC | 15:32 | |
| *** andreaf has joined #openstack-keystone | 15:33 | |
| *** k4n0 has quit IRC | 15:40 | |
| *** jorge_munoz has joined #openstack-keystone | 15:40 | |
| *** mikedillion has quit IRC | 15:40 | |
| *** tellesnobrega has joined #openstack-keystone | 15:49 | |
| morganfainberg | rodrigods, you're using the same spec to graduate policy as well as other things? | 15:49 |
| *** aix has quit IRC | 15:55 | |
| morganfainberg | ayoung, ping: re: https://bugs.launchpad.net/keystone/+bug/1400362 | 15:56 |
| uvirtbot | Launchpad bug 1400362 in keystone "check and delete policy_association_for_region_and_servce performs create" [High,New] | 15:56 |
| ayoung | morganfainberg, yep | 15:56 |
| ayoung | morganfainberg, thats a backport. | 15:56 |
| morganfainberg | ah | 15:57 |
| *** nkinder has quit IRC | 15:57 | |
| ayoung | morganfainberg, | 15:57 |
| morganfainberg | not a worry, just want to make sure we're not leaving bugs in "new state" | 15:57 |
| morganfainberg | :) | 15:57 |
| ayoung | morganfainberg, that is: that one has backport potential | 15:57 |
| ayoung | I just posted the bug | 15:57 |
| morganfainberg | wanted to check before marking it as something besides "new" | 15:57 |
| morganfainberg | right | 15:57 |
| ayoung | needs at least one other person to look at it to confirm | 15:57 |
| ayoung | I think a simple code review shows the problem | 15:58 |
| morganfainberg | oh 20min ago | 15:58 |
| morganfainberg | hah, thought this was older | 15:58 |
| morganfainberg | sorry | 15:58 |
| ayoung | compare it with the other check and delete functions and you can see it is a copy and paste error, and has never beeen run for realz | 15:58 |
| dstanek | pre-spec spec for functional testing - https://etherpad.openstack.org/p/keystone-functional-tests | 15:58 |
| morganfainberg | yeah i'm trying to read through it. now. | 15:58 |
| *** nkinder has joined #openstack-keystone | 15:58 | |
| morganfainberg | dstanek, cool! | 15:58 |
| ayoung | morganfainberg, BTW, I'm going to make a comparable set of functions like this | 15:59 |
| morganfainberg | ayoung, nice "create" there | 16:00 |
| morganfainberg | wow. | 16:00 |
| morganfainberg | solid bug. | 16:00 |
| morganfainberg | ayoung, I'm tagging this to K1. | 16:01 |
| ayoung | morganfainberg, ++ | 16:02 |
| ayoung | morganfainberg, anyway, I'm going to make 3 "default_policy" functions there | 16:02 |
| morganfainberg | if henrynash can't get to it, either you or I should get the patch in before k1 | 16:02 |
| ayoung | and they will just leave off anything but the policy id | 16:03 |
| ayoung | I can get a functioning patch | 16:03 |
| ayoung | will need a little more time to get a test going, but I should be able to bootstrap from Henry's last patch | 16:03 |
| morganfainberg | ayoung, i think: https://bugs.launchpad.net/keystone/+bug/1384377 is a fail-fast issue not a potential security issue | 16:03 |
| uvirtbot | Launchpad bug 1384377 in keystone "Policy rule position errors" [Undecided,New] | 16:03 |
| morganfainberg | ayoung, btw. all tests i've done show this as a policy.py issue where it fails (safe) but incorrectly | 16:04 |
| *** david-lyle_afk is now known as david-lyle | 16:06 | |
| ayoung | morganfainberg, its not security if it is a case where it fails instead of succeeds | 16:07 |
| ayoung | so, agreed | 16:07 |
| ayoung | is it shortcicuit logic in policy? | 16:08 |
| ayoung | rodrigods, you correcting the typos on https://review.openstack.org/#/c/133480 ? | 16:09 |
| *** gordc has quit IRC | 16:10 | |
| *** darren-wang has quit IRC | 16:11 | |
| *** gordc has joined #openstack-keystone | 16:15 | |
| *** gordc has quit IRC | 16:15 | |
| *** jorge_munoz has quit IRC | 16:17 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/140053 | 16:18 |
| *** jorge_munoz has joined #openstack-keystone | 16:19 | |
| openstackgerrit | Merged openstack/keystone: Correct max_project_tree_depth config help text https://review.openstack.org/139736 | 16:21 |
| *** mikedillion has joined #openstack-keystone | 16:22 | |
| *** gordc has joined #openstack-keystone | 16:23 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Multifactor Authentication https://review.openstack.org/130376 | 16:24 |
| openstackgerrit | Merged openstack/keystone: Adds openSUSE support for developer documentation https://review.openstack.org/129256 | 16:26 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add index to the revocation_event.revoked_at. https://review.openstack.org/137639 | 16:27 |
| morganfainberg | ayoung, right. i can't make it suceed in a case it should fail. | 16:27 |
| morganfainberg | ayoung, it's a shortcircut that is happening incorrectly but safely afaict | 16:28 |
| morganfainberg | it's still a scary bug | 16:28 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add index to the revocation_event.revoked_at. https://review.openstack.org/137639 | 16:28 |
| morganfainberg | because policy... | 16:28 |
| ayoung | morganfainberg, we need to get the typos fixed in https://review.openstack.org/#/c/133480 to move that library promotion along | 16:28 |
| morganfainberg | ayoung, about to step into a meeting here in austin, will take a look when done | 16:29 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add index to the revocation_event.revoked_at. https://review.openstack.org/137639 | 16:29 |
| ayoung | morganfainberg, we got it covered. | 16:29 |
| morganfainberg | ++ | 16:29 |
| *** marcoemorais has joined #openstack-keystone | 16:35 | |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Migrate_repo init version helper https://review.openstack.org/137640 | 16:36 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Share engine between migration helpers. https://review.openstack.org/137778 | 16:36 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add primary key to the endpoint_group id column. https://review.openstack.org/137638 | 16:36 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add index to the revocation_event.revoked_at. https://review.openstack.org/137639 | 16:36 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Explicit MySQL engine designation. https://review.openstack.org/138712 | 16:36 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 16:36 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Fix index name the assignment.actor_id table. https://review.openstack.org/137637 | 16:36 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Use metadata.create_all() to fill a test database https://review.openstack.org/93558 | 16:36 |
| *** jorge_munoz has quit IRC | 16:39 | |
| *** packet has joined #openstack-keystone | 16:40 | |
| *** marcoemorais1 has joined #openstack-keystone | 16:40 | |
| *** marcoemorais has quit IRC | 16:42 | |
| *** marcoemorais1 has quit IRC | 16:43 | |
| *** marcoemorais has joined #openstack-keystone | 16:45 | |
| *** marcoemorais has quit IRC | 16:47 | |
| *** jacer_huawei has quit IRC | 16:52 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes links in Shibboleth configuration docs https://review.openstack.org/140077 | 16:54 |
| *** jacer_huawei has joined #openstack-keystone | 16:55 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes a type check to make it work in Python 3 https://review.openstack.org/125410 | 17:00 |
| openstackgerrit | David Stanek proposed openstack/keystone: Updates Python3 requirements https://review.openstack.org/130579 | 17:00 |
| openstackgerrit | David Stanek proposed openstack/keystone: Mocks out the memcache library for tests https://review.openstack.org/125409 | 17:00 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a fork of python-ldap for Py3 testing https://review.openstack.org/95827 | 17:00 |
| *** jorge_munoz has joined #openstack-keystone | 17:07 | |
| *** lhcheng has joined #openstack-keystone | 17:09 | |
| *** afazekas has quit IRC | 17:11 | |
| *** avozza is now known as zz_avozza | 17:12 | |
| *** tellesnobrega has quit IRC | 17:13 | |
| *** chrisshattuck has joined #openstack-keystone | 17:17 | |
| *** openstackgerrit has quit IRC | 17:19 | |
| *** openstackgerrit has joined #openstack-keystone | 17:19 | |
| *** tylerdurden has quit IRC | 17:20 | |
| *** jorge_munoz has quit IRC | 17:26 | |
| *** _cjones_ has joined #openstack-keystone | 17:30 | |
| *** jacer_huawei has quit IRC | 17:31 | |
| *** jacer_huawei has joined #openstack-keystone | 17:32 | |
| *** zz_avozza is now known as avozza | 17:35 | |
| *** htruta has joined #openstack-keystone | 17:36 | |
| *** _cjones_ has quit IRC | 17:37 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Make the mutable default arg check very strict. https://review.openstack.org/136126 | 17:37 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a Py2.6 version of inspect.getcallargs https://review.openstack.org/136210 | 17:37 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a Py2.6 version of assertSetEqual https://review.openstack.org/136211 | 17:37 |
| openstackgerrit | David Stanek proposed openstack/keystone: Expanded mutable hacking checks https://review.openstack.org/136208 | 17:37 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a bit of WSGI code converts unicode to str https://review.openstack.org/136209 | 17:37 |
| *** stevemar has joined #openstack-keystone | 17:52 | |
| *** ChanServ sets mode: +v stevemar | 17:52 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/140053 | 18:03 |
| *** mzbik has joined #openstack-keystone | 18:04 | |
| openstackgerrit | Tyler North proposed openstack/keystone: Allow pre-hashed passwords for users https://review.openstack.org/140104 | 18:06 |
| *** amcrn has joined #openstack-keystone | 18:07 | |
| *** tnorth has joined #openstack-keystone | 18:09 | |
| tnorth | Hello everyone, I've got a change I'd like to add to keystone https://review.openstack.org/#/c/140104/ | 18:09 |
| tnorth | that basically reverts back this change https://git.openstack.org/cgit/openstack/keystone/commit/?id=e492bbc68ef41b276a0a18c6dbeda242d46b66f4 | 18:09 |
| tnorth | if someone could take a look it'd be much appreicated! thanks! | 18:09 |
| *** jistr has quit IRC | 18:11 | |
| *** mikedillion has quit IRC | 18:19 | |
| *** harlowja_away is now known as harlowja | 18:20 | |
| *** mikedillion has joined #openstack-keystone | 18:20 | |
| *** mikedillion has quit IRC | 18:22 | |
| tnorth | Also just curious to see if anyone else thinks this is a bug | 18:24 |
| tnorth | https://bugs.launchpad.net/keystone/+bug/1400443 | 18:24 |
| uvirtbot | Launchpad bug 1400443 in keystone "Keystone should support pre-hashed passwords" [Undecided,New] | 18:24 |
| tnorth | seems like a good idea for security to me | 18:24 |
| lbragstad | morganfainberg: quick question on the structure of token things. With the token/persistence directory, the drivers inherit from token.persistence.Driver. For the non_persistence case, should they inherit from their own keystone/token/non_persistence/core.py:Driver class? | 18:26 |
| morganfainberg | Hmm. No. The provider will just not call into provider.persistence | 18:28 |
| morganfainberg | The idea behind moving things to provider.persistence and removing direct access to token_api is to allow the provider to determine if it should persist anything. | 18:29 |
| morganfainberg | So in non-persistence a driver wouldn't be needed. | 18:29 |
| lbragstad | ok, so backends in keystone/token/non_persistence/backends/driver.py:Driver() shouldn't inherit from anything? | 18:32 |
| *** avozza is now known as zz_avozza | 18:39 | |
| *** marcoemorais has joined #openstack-keystone | 18:42 | |
| morganfainberg | wait | 18:42 |
| lbragstad | morganfainberg: oh wait, yeah.. so in non-persistence a new provider would be added to keystone/token/providers/<non-persistence-driver>.py | 18:42 |
| morganfainberg | yes | 18:43 |
| lbragstad | ahhhh | 18:43 |
| morganfainberg | or providers/backends | 18:43 |
| lbragstad | providers doens't have a backend | 18:43 |
| lbragstad | or backends/ | 18:43 |
| lbragstad | all backends for providers just live in keystone/token/providers/ | 18:44 |
| morganfainberg | yeah wherever they live | 18:45 |
| *** jaosorior has joined #openstack-keystone | 18:45 | |
| lbragstad | ok | 18:45 |
| lbragstad | morganfainberg: cool | 18:45 |
| lbragstad | morganfainberg: that helps, thank you | 18:45 |
| openstackgerrit | ayoung proposed openstack/keystone: default policy https://review.openstack.org/140113 | 18:50 |
| *** nellysmitt has quit IRC | 18:52 | |
| openstackgerrit | ayoung proposed openstack/keystone: policy default https://review.openstack.org/140113 | 18:54 |
| *** marcoemorais has quit IRC | 18:59 | |
| *** marcoemorais has joined #openstack-keystone | 18:59 | |
| *** marcoemorais has quit IRC | 18:59 | |
| *** marcoemorais has joined #openstack-keystone | 18:59 | |
| *** lhcheng has quit IRC | 19:02 | |
| *** lhcheng has joined #openstack-keystone | 19:02 | |
| *** henrynash has joined #openstack-keystone | 19:05 | |
| *** ChanServ sets mode: +v henrynash | 19:05 | |
| *** raildo has joined #openstack-keystone | 19:07 | |
| henrynash | rodigods: ping | 19:07 |
| *** jacer_huawei has quit IRC | 19:09 | |
| *** henrynash has quit IRC | 19:09 | |
| *** marcoemorais has quit IRC | 19:12 | |
| *** marcoemorais has joined #openstack-keystone | 19:13 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Make the mutable default arg check very strict https://review.openstack.org/136126 | 19:13 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a Py2.6 version of inspect.getcallargs https://review.openstack.org/136210 | 19:13 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a Py2.6 version of assertSetEqual https://review.openstack.org/136211 | 19:13 |
| openstackgerrit | David Stanek proposed openstack/keystone: Expanded mutable hacking checks https://review.openstack.org/136208 | 19:13 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a bit of WSGI code converts unicode to str https://review.openstack.org/136209 | 19:13 |
| openstackgerrit | ayoung proposed openstack/keystone: Check and delete for policy_association_for_region_and_service https://review.openstack.org/140122 | 19:14 |
| *** htruta_ has joined #openstack-keystone | 19:19 | |
| *** aix has joined #openstack-keystone | 19:19 | |
| *** htruta has quit IRC | 19:20 | |
| *** lhcheng has quit IRC | 19:23 | |
| *** jacer_huawei has joined #openstack-keystone | 19:25 | |
| *** zzzeek has quit IRC | 19:29 | |
| *** jacer_huawei has quit IRC | 19:30 | |
| *** tnorth has left #openstack-keystone | 19:32 | |
| *** tnorth has quit IRC | 19:32 | |
| *** zzzeek has joined #openstack-keystone | 19:32 | |
| *** amcrn has quit IRC | 19:34 | |
| *** lhcheng has joined #openstack-keystone | 19:38 | |
| *** shakamunyi has joined #openstack-keystone | 19:38 | |
| *** amcrn has joined #openstack-keystone | 19:40 | |
| *** jacer_huawei has joined #openstack-keystone | 19:46 | |
| *** jorge_munoz has joined #openstack-keystone | 19:48 | |
| *** nkinder has quit IRC | 19:50 | |
| *** RichardRaseley has joined #openstack-keystone | 19:50 | |
| *** jacer_huawei has quit IRC | 19:54 | |
| *** radez is now known as radez_g0n3 | 19:54 | |
| morganfainberg | hrm, no henrynash huh | 19:57 |
| *** radez_g0n3 is now known as radez | 19:57 | |
| *** henrique has joined #openstack-keystone | 19:57 | |
| dstanek | morganfainberg: ack on the meeting tomorrow - i'll probably sit it to see how it goes | 19:57 |
| *** htruta_ has quit IRC | 19:59 | |
| morganfainberg | dstanek, great. the relmanagment 1 on 1 is still cancelled, but the cross-project meeting/release meeting/whatever it is, i'll be there for | 19:59 |
| morganfainberg | please sit in on the meeting and hang out though | 19:59 |
| dstanek | morganfainberg: i shall...i've very interested in the inner workings of our processes | 20:00 |
| *** nellysmitt has joined #openstack-keystone | 20:01 | |
| *** ajayaa has joined #openstack-keystone | 20:02 | |
| openstackgerrit | ayoung proposed openstack/keystone: default policy https://review.openstack.org/140113 | 20:08 |
| *** mzbik has quit IRC | 20:08 | |
| *** jacer_huawei has joined #openstack-keystone | 20:10 | |
| *** topol has joined #openstack-keystone | 20:13 | |
| *** gyee has joined #openstack-keystone | 20:13 | |
| *** ChanServ sets mode: +v gyee | 20:13 | |
| *** ChanServ sets mode: +v topol | 20:13 | |
| *** ajayaa has quit IRC | 20:15 | |
| *** samuelms has joined #openstack-keystone | 20:17 | |
| ayoung | morganfainberg, should I change https://review.openstack.org/#/c/133480/5/specs/keystoneclient/policy-enforce.rst,cm to be in keystonemiddleware? | 20:17 |
| *** raildo has quit IRC | 20:18 | |
| morganfainberg | ayoung, ok so why would it be in middleware, why would it be in client? | 20:21 |
| *** amakarov is now known as amakarov_away | 20:22 | |
| morganfainberg | i'm not clear why graduating policy.py has anything to do with keystoneclient. | 20:22 |
| ayoung | morganfainberg, good question. I was obviosuly origianlly thinking client. jamielennox|away was inisitant on middleware. I guess the rationale for middleware is that it is always supposedto be called from inside a service | 20:22 |
| ayoung | morganfainberg, graduiating to its own library also should be broken out to a separate spec | 20:22 |
| morganfainberg | ++ | 20:23 |
| morganfainberg | ok that out of the way | 20:23 |
| ayoung | the more I think about it, the more I suspect that the right steps are this: | 20:23 |
| ayoung | 1. rewrite spec for pure graduation reqs | 20:23 |
| ayoung | create a cache abstraction...this is for handling the files | 20:23 |
| morganfainberg | i think that middleware is likely the right place to do enforcement | 20:23 |
| morganfainberg | ooooooor | 20:23 |
| ayoung | like certs etc...things that need to be called from the endpoints and then held on to | 20:23 |
| morganfainberg | actually... | 20:24 |
| ayoung | and then the client is used to populate the cache | 20:24 |
| morganfainberg | i'm not sure this enforcement belongs in either client or middleware (it might be consumed by middleware) | 20:24 |
| * morganfainberg re-reads the spec. | 20:24 | |
| *** radez is now known as radez_g0n3 | 20:24 | |
| ayoung | well, it don't know if we could even do it as a straight middleware call, but having it available in middleware seems to make sense | 20:24 |
| morganfainberg | this spec feels like it's really meant to be part of the policy lib. | 20:25 |
| ayoung | its just that the fetch needs to be from the client | 20:25 |
| morganfainberg | the way it's written. | 20:25 |
| ayoung | so a cache object that ties the two together... | 20:25 |
| morganfainberg | hm | 20:25 |
| morganfainberg | ok i see | 20:25 |
| *** ksavich has joined #openstack-keystone | 20:26 | |
| ayoung | morganfainberg, I'd like to keep the graduated policy lib agnositic of Keystone itself. I think the congress folks are using it (or should) and it should not be a problem for them | 20:27 |
| *** radez_g0n3 is now known as radez | 20:28 | |
| morganfainberg | hm | 20:28 |
| morganfainberg | right | 20:28 |
| ayoung | so the cache object would have either a filesystem or a memcache place to store the policy, and a method to fetch it from keystone | 20:28 |
| ayoung | or, in their case, fetch from congress | 20:28 |
| morganfainberg | so lets set congress aside, we don't care about the backend (keystone, congress, etc) a *way* to fetch it. | 20:29 |
| ayoung | we could do the same thing with CMS for PKIZ tokens, and then the cache could be abstracted enough to support both flat files and the NSS Database | 20:29 |
| morganfainberg | what i'm thinking is: policy does this with stevedore and plugins | 20:29 |
| morganfainberg | something configured | 20:29 |
| ayoung | yeah...just using them as a second datapoint | 20:29 |
| ayoung | the policy engine is content-agnositic, and should remain that way | 20:29 |
| morganfainberg | so the policy lib *can* fetch if a plugin is configured | 20:29 |
| morganfainberg | congress would provide a stevedore loaded plugin | 20:30 |
| morganfainberg | as would keystone | 20:30 |
| morganfainberg | you can configure it | 20:30 |
| ayoung | meh | 20:30 |
| morganfainberg | that plugin knows how to fetch/etc | 20:30 |
| ayoung | you still need to say which plugin to use | 20:30 |
| morganfainberg | that is in config | 20:30 |
| ayoung | I say let the consumer worry about that | 20:30 |
| morganfainberg | policy provides *that* config option | 20:30 |
| ayoung | and the consumer passes the cache in to the api call | 20:30 |
| morganfainberg | i'd make that plugin responsible for that | 20:31 |
| morganfainberg | this doesn't belong in either keystoneclient or middleware as you've described | 20:31 |
| ayoung | consumer needs to manage its own config file | 20:31 |
| morganfainberg | the consumer already doesn't. | 20:31 |
| ayoung | so...it stevedor something that should be possilbe, but not required | 20:31 |
| morganfainberg | oslo.XXX with config | 20:31 |
| ayoung | AAA-policy! | 20:32 |
| morganfainberg | with stevedore, if the plugin is supplied it will load in from policy and use that | 20:32 |
| morganfainberg | policy lib | 20:32 |
| ayoung | it puts a dependency on stevedore that is not there now. I'd rather make that optional | 20:33 |
| morganfainberg | thats a fine dep to have | 20:33 |
| ayoung | I mean, I'd be OK with the keystoneclient or middleware code doing that | 20:33 |
| morganfainberg | it's not onerous | 20:33 |
| ayoung | but not the policy enginer | 20:33 |
| ayoung | engine | 20:33 |
| morganfainberg | but it doesn't belong in ekystonemiddleware or client as described | 20:33 |
| ayoung | the cache object? | 20:34 |
| ayoung | I think you are missing some of the complexit | 20:34 |
| ayoung | the cache object will nee to be populated with config values , maybe even a user object, in order to make a call to keystone | 20:34 |
| ayoung | so the cache for our cases needs a keystoneclient or comparable object | 20:35 |
| ayoung | sso, lets put the cache interface into aaa-policy, but put the keystone implementation into KC, and call it from Kmid | 20:36 |
| morganfainberg | sure. | 20:36 |
| morganfainberg | ok so my point was how is keystoneclient called in this case? | 20:37 |
| *** nellysmitt has quit IRC | 20:37 | |
| ayoung | OK, I think it would be like this: | 20:37 |
| ayoung | Keystonemiddleware creates a cache object and puts it into the applications context | 20:38 |
| *** _cjones_ has joined #openstack-keystone | 20:38 | |
| ayoung | when a user calls an API, the endpoint gets the cache object and uses it to call aaa-policy.enforce | 20:38 |
| morganfainberg | hm. | 20:38 |
| ayoung | passes in the cache object, or could even call it on the cache object if we want | 20:38 |
| ayoung | the cache sees that there is no policy file (or it is outdated) and fetches | 20:39 |
| ayoung | fetch uses the KClient to get policy | 20:39 |
| morganfainberg | yeah i think my concern was the cache interface being in ksc | 20:39 |
| ayoung | I can see that | 20:39 |
| morganfainberg | which makes it weird. | 20:39 |
| ayoung | I think interface for this goes in aaa-policy | 20:39 |
| morganfainberg | yeah | 20:39 |
| morganfainberg | that solves my concern | 20:39 |
| morganfainberg | but we should have a clean spec to graduate policy - that to begin with. | 20:40 |
| ayoung | cache implementation can go into either one. Probably have a file one in KC, but a memcached based on in middleware? | 20:40 |
| ayoung | Agreed. I'll work on that spec. | 20:40 |
| morganfainberg | uhm. | 20:41 |
| ayoung | Are we officially OpenStack authentication, authorization, and audit now? Is OSAAA-Policy and OK name? | 20:41 |
| morganfainberg | that is a question we're going to need to get TC approval for.... | 20:42 |
| morganfainberg | and foundation likely | 20:42 |
| morganfainberg | but i don't have an issue with it | 20:42 |
| morganfainberg | somethingsomething lawyer things on names something something | 20:42 |
| morganfainberg | i'll put it on the TC agenda. | 20:42 |
| *** _cjones_ has quit IRC | 20:42 | |
| morganfainberg | and yes we are authn, authz, and audit | 20:42 |
| ayoung | according to https://wiki.openstack.org/wiki/Programs we are still identity | 20:42 |
| morganfainberg | wiki is out of date | 20:43 |
| ayoung | lets see the yaml | 20:43 |
| ayoung | http://git.openstack.org/cgit/openstack/governance/tree/reference/programs.yaml#n41 | 20:43 |
| ayoung | they updated the PTL | 20:43 |
| ayoung | morganfainberg, found a very elegant way to do default policy: | 20:46 |
| ayoung | https://review.openstack.org/#/c/140113/ | 20:46 |
| ayoung | got the fix and tests for the othe policy issue, too | 20:47 |
| morganfainberg | ayoung, ok need to duck out here and run off for a few. | 20:47 |
| morganfainberg | will take a look. | 20:47 |
| ayoung | go for it...I'll work up the graduation spec | 20:47 |
| *** _cjones_ has joined #openstack-keystone | 20:52 | |
| *** _cjones_ has quit IRC | 20:54 | |
| *** ksavich has quit IRC | 20:54 | |
| *** _cjones_ has joined #openstack-keystone | 20:54 | |
| *** nkinder has joined #openstack-keystone | 21:02 | |
| *** marcoemorais has quit IRC | 21:03 | |
| *** marcoemorais has joined #openstack-keystone | 21:03 | |
| *** amcrn has quit IRC | 21:06 | |
| *** henrique has quit IRC | 21:06 | |
| *** ksavich has joined #openstack-keystone | 21:07 | |
| *** ksavich has quit IRC | 21:12 | |
| *** fifieldt_ has joined #openstack-keystone | 21:15 | |
| *** fifieldt has quit IRC | 21:19 | |
| *** gyee has quit IRC | 21:32 | |
| *** radez is now known as radez_g0n3 | 21:37 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Authenticated Encryption Tokens https://review.openstack.org/130050 | 21:56 |
| ayoung | lbragstad, I don't think we can say identifiers are 32chars long | 21:57 |
| ayoung | userids are 64 chars long | 21:57 |
| lbragstad | ayoung: legacy uuids? | 21:58 |
| lbragstad | so, you mean for backwards compatible stuff? | 21:59 |
| ayoung | lbragstad, no, I'm talking today, we have not ids to 32chars | 21:59 |
| ayoung | how is msgpack dealing with the length of strings? | 21:59 |
| lbragstad | msgpack just condenses stuff | 22:00 |
| *** boris-42 has joined #openstack-keystone | 22:00 | |
| ayoung | the more I look at it, the more it looks like ASN1 to me | 22:01 |
| lbragstad | ayoung: there is an example of msgpack output in the review | 22:01 |
| ayoung | yeah...just looking at your comment. | 22:02 |
| ayoung | lbragstad, I'm just worried that we are going to get something that works for some set of tokens, but not, say ,federated | 22:02 |
| ayoung | and the list of groupids is one thing that we are kindof handwaving away | 22:03 |
| lbragstad | I just addressed that in the last past | 22:03 |
| lbragstad | patch* | 22:03 |
| ayoung | I would like to see the size of a federated AE token with a handful of groups specified | 22:03 |
| ayoung | how big? | 22:03 |
| lbragstad | https://gist.github.com/lbragstad/5381c639a3a4e17e1124 | 22:04 |
| lbragstad | that's an example | 22:04 |
| lbragstad | add a couple group ids and you're at ~210 characters | 22:04 |
| ayoung | we could do the same thing with roles? | 22:07 |
| lbragstad | you mean a role? | 22:07 |
| ayoung | multiple | 22:07 |
| lbragstad | why multiple | 22:07 |
| ayoung | list of roles | 22:07 |
| ayoung | cuyz right now tokens have more than one role in them | 22:07 |
| *** joesavak has quit IRC | 22:08 | |
| lbragstad | sure, but isn't the plan to make that go away? | 22:10 |
| lbragstad | per the discussion we were having the other day? | 22:10 |
| ayoung | lbragstad, do you want to postpone AE tokens until that happens? Not going to be in Kilo | 22:11 |
| *** oomichi has joined #openstack-keystone | 22:11 | |
| lbragstad | ayoung: no, not really because you could still make AE tokens work if you have more than one role on the projec t | 22:11 |
| ayoung | lbragstad, yeah, but then you assume "all of the roles" which, to be hondest, is how standard rtokens work toady, but not trust etc. So we are back to multiple formats | 22:12 |
| lbragstad | you assume all of the roles are on a token? | 22:16 |
| lbragstad | I don't think ae tokens is trying to fix that problem | 22:18 |
| *** tellesnobrega has joined #openstack-keystone | 22:33 | |
| ayoung | lbragstad, AE tokens are codifying the problem. The old token format did not specify that the set of roles was the complete set the user had, that was only an implementation detail | 22:36 |
| *** nellysmitt has joined #openstack-keystone | 22:38 | |
| lbragstad | ayoung: gotta run, be back on in a bit | 22:39 |
| ayoung | I'll be gone | 22:40 |
| *** nellysmitt has quit IRC | 22:43 | |
| bknudson | ae tokens will need to know that it's scoped to a project or domain or trust | 22:46 |
| *** packet has quit IRC | 22:46 | |
| *** topol has quit IRC | 22:47 | |
| *** tellesnobrega has quit IRC | 22:49 | |
| *** gordc has quit IRC | 22:50 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone-specs: This blueprint details the work required to add read and write LDAP drivers. https://review.openstack.org/140175 | 22:54 |
| *** bknudson has quit IRC | 22:55 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: This blueprint details the work required to add read and write LDAP drivers. https://review.openstack.org/140175 | 22:59 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone-specs: Read/Write LDAP drivers https://review.openstack.org/140175 | 23:02 |
| *** ayoung has quit IRC | 23:03 | |
| *** marcoemorais has quit IRC | 23:07 | |
| *** marcoemorais has joined #openstack-keystone | 23:08 | |
| *** jamielennox|away is now known as jamielennox | 23:15 | |
| *** jaosorior has quit IRC | 23:23 | |
| jamielennox | morning everyone | 23:26 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone-specs: This blueprint details the work required to add read and write LDAP drivers. https://review.openstack.org/140175 | 23:30 |
| morganfainberg | jamielennox, mornin | 23:32 |
| *** marcoemorais1 has joined #openstack-keystone | 23:32 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone-specs: Read/Write LDAP drivers https://review.openstack.org/140175 | 23:32 |
| *** marcoemorais has quit IRC | 23:33 | |
| morganfainberg | jamielennox, so as a quick note, i pushed ayoung to not put the caching interface for policy in either ksc or middleware | 23:33 |
| morganfainberg | jamielennox, the interface itself goes in policy lib, ksc/middleware just has a way to "fetch" if needed. recommending stevedore plugin | 23:33 |
| *** jdennis has quit IRC | 23:33 | |
| morganfainberg | jamielennox, more to discuss i'm sure but, as proposed it didn't belong in either ksc or middleware. | 23:33 |
| * morganfainberg is about to run off | 23:34 | |
| jamielennox | morganfainberg: so the more i think about it i'm just as happy to hve policy go to oslo - we can get core as needed | 23:35 |
| jamielennox | morganfainberg: i think the initial policy library should only be the enforcement engine | 23:35 |
| *** jdennis has joined #openstack-keystone | 23:35 | |
| morganfainberg | jamielennox, they would prefer we own it. | 23:35 |
| morganfainberg | and yes. | 23:35 |
| jamielennox | we need to figure out the caching aspect before we actually stick it in a library | 23:35 |
| morganfainberg | that is what is initially graduated | 23:35 |
| morganfainberg | anything beyond that will need to be separate. | 23:35 |
| jamielennox | i'm not sure on some of ayoung's client changes, he's pushing a token interface which i don't think belongs in client | 23:36 |
| morganfainberg | where does the interface belong? | 23:36 |
| jamielennox | unfortunately whilst middleware would be nice for policy enforcement the way we do it now can't be enforced by middleare | 23:36 |
| jamielennox | morganfainberg: keystone is the only place that ever needs to build a token | 23:36 |
| morganfainberg | jamielennox, and i don't see policy being enforced by middleware ever | 23:37 |
| morganfainberg | tbh | 23:37 |
| morganfainberg | because policy enforcement has more to do than just "can i access REST URL with role" in projects besides keystone | 23:37 |
| jamielennox | https://review.openstack.org/#/c/137268/ is my take on token interface | 23:37 |
| morganfainberg | even in keystone | 23:37 |
| jamielennox | what more do you want to do than enforcing rest access? | 23:38 |
| jamielennox | if you mean object based policy then sure, but are you thinking something else | 23:39 |
| morganfainberg | so, in the case of nova, they do lookups on the object and make sure they match things like project | 23:39 |
| morganfainberg | all in a single enforce | 23:39 |
| morganfainberg | so it is object based, and we do awful hacky things in keystone to get the same kind of enforcement | 23:39 |
| morganfainberg | so middleware is likely the wrong place for policy enforcement. | 23:40 |
| jamielennox | morganfainberg: i'm somewhat of the opinion that the object based policy is going to be a different object/enforcement point | 23:40 |
| morganfainberg | i have *no* idea what ayoung is proposing at this point because the specs are wildly inconsistent and combining things in odd ways | 23:40 |
| jamielennox | that's possibly where these quota and policy enforcement point as a seperate service needs to live | 23:40 |
| jamielennox | morganfainberg: :) | 23:40 |
| morganfainberg | jamielennox, the issue is we use the same policy language for this enforcement atm | 23:40 |
| jamielennox | morganfainberg: yea - i think that's a mistake | 23:41 |
| jamielennox | the policy we do now should be rest only | 23:41 |
| morganfainberg | and we can't break backwards compat. | 23:41 |
| jamielennox | then we split object based | 23:41 |
| jamielennox | then we could actually enforce at middleware | 23:41 |
| morganfainberg | ok so policy enforcement graduation and figure out the next step? | 23:41 |
| jamielennox | morganfainberg: is there a start for that somewhere? | 23:41 |
| jamielennox | that review i posted: https://review.openstack.org/#/c/137268/ is the interface i want policy to consume | 23:42 |
| morganfainberg | i ... am not sure. | 23:42 |
| morganfainberg | it needs to be a spec | 23:42 |
| morganfainberg | but it's somewhat involved with like 2 or 3 different specs | 23:42 |
| jamielennox | that way auth_token contolls the token information to expose, and policy controls the reading, so we can modify this stuff without having to fix every server every time | 23:42 |
| jamielennox | i put something about this on the ML a week or so ago | 23:42 |
| morganfainberg | right | 23:43 |
| jamielennox | I think dhellmann is right - there's nothing i can do about the current context layout as bad as it is | 23:43 |
| morganfainberg | :( | 23:43 |
| jamielennox | it would be a huge win just to remove is_admin, and generate_admin_context from the library | 23:43 |
| morganfainberg | +++++++++ | 23:43 |
| morganfainberg | want to +++ more | 23:44 |
| jamielennox | it scares me a little but i've had to mess with glance's context object and i can see the need to standardize | 23:44 |
| jamielennox | i was almost hoping we could standardize on that auth_token object | 23:44 |
| openstackgerrit | Merged openstack/keystone: User ids that begin with 0 cannot authenticate through ldap https://review.openstack.org/137449 | 23:45 |
| jamielennox | ^ ? that's sad | 23:45 |
| morganfainberg | that ldap does wierd things? | 23:45 |
| morganfainberg | yeah | 23:45 |
| *** marcoemorais1 has quit IRC | 23:46 | |
| openstackgerrit | Merged openstack/keystone: Remove useless field passed into SQLAlchemy "distinct" statement https://review.openstack.org/133343 | 23:46 |
| *** marcoemorais has joined #openstack-keystone | 23:46 | |
| morganfainberg | ok anyway | 23:46 |
| morganfainberg | need to go | 23:46 |
| morganfainberg | back later | 23:46 |
| jamielennox | morganfainberg: cya | 23:47 |
| *** zz_avozza is now known as avozza | 23:47 | |
| *** marcoemorais has quit IRC | 23:50 | |
| *** marcoemorais has joined #openstack-keystone | 23:50 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 23:51 |
| *** chrisshattuck has quit IRC | 23:57 | |
| *** gyee has joined #openstack-keystone | 23:58 | |
| *** ChanServ sets mode: +v gyee | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!