| *** bknudson has joined #openstack-keystone | 00:02 | |
| *** ChanServ sets mode: +v bknudson | 00:02 | |
| *** bknudson has quit IRC | 00:02 | |
| *** dims has quit IRC | 00:02 | |
| *** bknudson has joined #openstack-keystone | 00:02 | |
| *** ChanServ sets mode: +v bknudson | 00:02 | |
| *** arif-ali has quit IRC | 00:09 | |
| *** arif-ali has joined #openstack-keystone | 00:12 | |
| *** boris-42 has quit IRC | 00:12 | |
| *** RichardRaseley has quit IRC | 00:17 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add name parameter to NoMatchingPlugin exception https://review.openstack.org/139898 | 00:25 |
|---|---|---|
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move eventlet server options to a config section https://review.openstack.org/130962 | 00:26 |
| bknudson | anybody else get messages like "ValueError: need more than 0 values to unpack" when running unit tests? | 00:30 |
| bknudson | looks like this: http://paste.openstack.org/show/147561/ | 00:32 |
| *** tellesnobrega has joined #openstack-keystone | 00:32 | |
| bknudson | the tests still pass | 00:32 |
| *** stevemar has quit IRC | 00:36 | |
| *** stevemar has joined #openstack-keystone | 00:37 | |
| *** ChanServ sets mode: +v stevemar | 00:37 | |
| *** tellesnobrega has quit IRC | 00:39 | |
| *** nellysmitt has joined #openstack-keystone | 00:39 | |
| *** nellysmitt has quit IRC | 00:43 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Max complexity check considered harmful https://review.openstack.org/140188 | 00:46 |
| *** aix has quit IRC | 00:49 | |
| *** dims has joined #openstack-keystone | 00:58 | |
| *** avozza is now known as zz_avozza | 01:06 | |
| *** _cjones_ has quit IRC | 01:08 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Split identity server into v2 and v3 https://review.openstack.org/130534 | 01:15 |
| *** gyee has quit IRC | 01:19 | |
| *** andreaf has quit IRC | 01:28 | |
| *** shakamunyi has quit IRC | 01:28 | |
| *** andreaf has joined #openstack-keystone | 01:29 | |
| *** raildo has joined #openstack-keystone | 01:35 | |
| *** jacer_huawei has quit IRC | 01:40 | |
| *** marcoemorais has quit IRC | 01:40 | |
| *** marcoemorais has joined #openstack-keystone | 01:41 | |
| *** raildo has quit IRC | 01:46 | |
| *** lhcheng has quit IRC | 01:47 | |
| *** jacer_huawei has joined #openstack-keystone | 01:55 | |
| *** jacer_huawei has quit IRC | 02:01 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor extract class for signing directory https://review.openstack.org/122281 | 02:07 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Auth token tests create temp cert directory https://review.openstack.org/122280 | 02:07 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 02:07 |
| *** dims has quit IRC | 02:08 | |
| lbragstad | bknudson: I haven't seen that one yet. | 02:11 |
| lbragstad | bknudson: are you just seeing that today? | 02:11 |
| bknudson | jamielennox: https://review.openstack.org/#/c/102403/ is failing now. | 02:11 |
| bknudson | lbragstad: y... it doesn't happen for you? | 02:11 |
| lbragstad | bknudson: nope, I haven't seen it. | 02:11 |
| bknudson | maybe I need to reboot. | 02:11 |
| lbragstad | bknudson: let me pull the latest and try | 02:11 |
| jamielennox | bknudson: oh? did i break something or just a merge conflict | 02:12 |
| jamielennox | bknudson: oh, i see comment | 02:12 |
| lbragstad | bknudson: running the tests now, we'll see what happens! | 02:13 |
| bknudson | jamielennox: y, the change has self._identity_server and that causes discovery to happen now. | 02:13 |
| bknudson | jamielennox: I don't think you broken anything but it's a side-effect that was unexpected. | 02:14 |
| jamielennox | bknudson: yea, i don't know how we get around that | 02:14 |
| jamielennox | creating the plugin won't cause a request, | 02:15 |
| *** erkules_ has joined #openstack-keystone | 02:15 | |
| bknudson | jamielennox: I'll probably look into using the strategy pattern, since that's what I was thinking should be used there. | 02:16 |
| *** ayoung has joined #openstack-keystone | 02:17 | |
| *** ChanServ sets mode: +v ayoung | 02:17 | |
| jamielennox | bknudson: yea - i guess we could create a standard client object with the version discovery not happening until we do a validation | 02:17 |
| *** erkules has quit IRC | 02:18 | |
| jamielennox | i had thought the client subclass would work better there | 02:18 |
| lbragstad | bknudson: I got that same error | 02:25 |
| lbragstad | bknudson: have you opened a bug yet? | 02:30 |
| *** marcoemorais has quit IRC | 02:31 | |
| *** marcoemorais has joined #openstack-keystone | 02:31 | |
| *** stevemar has quit IRC | 02:33 | |
| lbragstad | bknudson: I opened one https://bugs.launchpad.net/keystone/+bug/1400565 | 02:34 |
| uvirtbot | Launchpad bug 1400565 in keystone "ValueError when running Keystone tests" [Undecided,New] | 02:34 |
| *** nellysmitt has joined #openstack-keystone | 02:40 | |
| *** nellysmitt has quit IRC | 02:44 | |
| *** jacer_huawei has joined #openstack-keystone | 02:46 | |
| *** marcoemorais has quit IRC | 02:48 | |
| *** samuelms has quit IRC | 02:49 | |
| *** dims has joined #openstack-keystone | 02:50 | |
| *** stevemar has joined #openstack-keystone | 02:50 | |
| *** ChanServ sets mode: +v stevemar | 02:50 | |
| *** jacer_huawei has quit IRC | 02:56 | |
| bknudson | lbragstad: I hadn't opened an bug since I haven't rebooted yet. | 03:04 |
| *** jacer_huawei has joined #openstack-keystone | 03:07 | |
| ayoung | jamielennox, what other reviews need to go in in order to support auth_token middleware service users in domains other than default | 03:07 |
| jamielennox | ayoung: https://review.openstack.org/#/c/139512/3 | 03:08 |
| jamielennox | and https://review.openstack.org/#/c/129552/ | 03:08 |
| ayoung | jamielennox, last one has a python 3 error, it looks like due to string handling | 03:12 |
| ayoung | http://logs.openstack.org/52/129552/15/check/gate-keystonemiddleware-python33/a916215/console.html | 03:12 |
| jamielennox | ayoung: hmm | 03:13 |
| ayoung | jamielennox, I'll add it as a starred review, though, and keep an eye on it | 03:13 |
| *** dims has quit IRC | 03:13 | |
| *** dims has joined #openstack-keystone | 03:14 | |
| *** dims has quit IRC | 03:18 | |
| *** topol has joined #openstack-keystone | 03:19 | |
| *** ChanServ sets mode: +v topol | 03:19 | |
| *** jacer_huawei is now known as wanghong | 03:20 | |
| *** david-lyle is now known as david-lyle_afk | 03:24 | |
| *** wanghong has quit IRC | 03:25 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor the code to join multiple criteria together https://review.openstack.org/133135 | 03:30 |
| *** jacer_huawei has joined #openstack-keystone | 03:38 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 04:03 |
| *** jacer_huawei is now known as wanghong | 04:11 | |
| *** richm has quit IRC | 04:36 | |
| *** nellysmitt has joined #openstack-keystone | 04:40 | |
| *** nellysmitt has quit IRC | 04:45 | |
| *** lhcheng has joined #openstack-keystone | 04:47 | |
| *** ajayaa has joined #openstack-keystone | 04:49 | |
| *** zzzeek has quit IRC | 04:52 | |
| *** ncoghlan has joined #openstack-keystone | 04:53 | |
| *** harlowja is now known as harlowja_away | 05:16 | |
| *** chrisshattuck has joined #openstack-keystone | 05:18 | |
| *** stevemar has quit IRC | 05:37 | |
| *** stevemar has joined #openstack-keystone | 05:38 | |
| *** ChanServ sets mode: +v stevemar | 05:38 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:06 |
| *** chrisshattuck has quit IRC | 06:08 | |
| *** ajayaa has quit IRC | 06:10 | |
| *** Nakato has quit IRC | 06:12 | |
| *** d34dh0r53 has quit IRC | 06:12 | |
| *** Ephur has quit IRC | 06:13 | |
| *** Ephur has joined #openstack-keystone | 06:13 | |
| *** d34dh0r53 has joined #openstack-keystone | 06:13 | |
| *** Nakato has joined #openstack-keystone | 06:14 | |
| *** erkules_ is now known as erkules | 06:19 | |
| *** nellysmitt has joined #openstack-keystone | 06:42 | |
| *** russellb has quit IRC | 06:43 | |
| *** russellb has joined #openstack-keystone | 06:44 | |
| *** nellysmitt has quit IRC | 06:46 | |
| *** wanghong has quit IRC | 06:49 | |
| *** wanghong has joined #openstack-keystone | 06:49 | |
| *** lhcheng has quit IRC | 06:56 | |
| *** marcoemorais has joined #openstack-keystone | 06:56 | |
| *** xianghui has quit IRC | 06:57 | |
| *** marcoemorais1 has joined #openstack-keystone | 06:58 | |
| *** marcoemorais has quit IRC | 07:01 | |
| *** k4n0 has joined #openstack-keystone | 07:15 | |
| *** drjones has joined #openstack-keystone | 07:21 | |
| *** nellysmitt has joined #openstack-keystone | 07:23 | |
| *** drjones has quit IRC | 07:26 | |
| *** nellysmitt has quit IRC | 07:28 | |
| *** NellyK has joined #openstack-keystone | 07:30 | |
| *** NellyK is now known as nellysmitt | 07:36 | |
| *** nellysmitt has quit IRC | 07:46 | |
| *** topol has quit IRC | 07:48 | |
| *** topol has joined #openstack-keystone | 07:48 | |
| *** ChanServ sets mode: +v topol | 07:48 | |
| *** henrynash has joined #openstack-keystone | 07:53 | |
| *** ChanServ sets mode: +v henrynash | 07:53 | |
| *** topol has quit IRC | 08:00 | |
| *** xianghui has joined #openstack-keystone | 08:02 | |
| *** mzbik has joined #openstack-keystone | 08:04 | |
| *** bdossant has joined #openstack-keystone | 08:08 | |
| *** NellyK has joined #openstack-keystone | 08:14 | |
| *** afazekas has joined #openstack-keystone | 08:18 | |
| *** henrynash has quit IRC | 08:19 | |
| *** jistr has joined #openstack-keystone | 08:20 | |
| *** andreaf has quit IRC | 08:23 | |
| *** NellyK has quit IRC | 08:23 | |
| *** nellysmitt has joined #openstack-keystone | 08:24 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Create a framework for federation plugins https://review.openstack.org/130564 | 08:31 |
| *** zz_avozza is now known as avozza | 08:33 | |
| *** avozza is now known as zz_avozza | 08:36 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 08:42 |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: use keystone v3 api to fetch revocation list https://review.openstack.org/127459 | 08:43 |
| *** ncoghlan has quit IRC | 08:52 | |
| *** zz_avozza is now known as avozza | 08:55 | |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: support micro version if sent https://review.openstack.org/130916 | 09:01 |
| *** avozza is now known as zz_avozza | 09:15 | |
| *** henrynash has joined #openstack-keystone | 09:16 | |
| *** ChanServ sets mode: +v henrynash | 09:16 | |
| *** zz_avozza is now known as avozza | 09:16 | |
| *** bdossant_ has joined #openstack-keystone | 09:20 | |
| *** henrynash has quit IRC | 09:21 | |
| *** bdossant has quit IRC | 09:23 | |
| *** ajayaa has joined #openstack-keystone | 09:28 | |
| *** bdossant_ has quit IRC | 09:34 | |
| *** bdossant_ has joined #openstack-keystone | 09:34 | |
| *** bdossant_ has quit IRC | 09:34 | |
| *** bdossant_ has joined #openstack-keystone | 09:35 | |
| *** aix has joined #openstack-keystone | 09:35 | |
| *** nellysmitt has left #openstack-keystone | 09:58 | |
| *** stevemar has quit IRC | 10:04 | |
| *** jistr has quit IRC | 10:21 | |
| *** bdossant_ has quit IRC | 10:24 | |
| *** bdossant has joined #openstack-keystone | 10:25 | |
| *** marcoemorais1 has quit IRC | 10:40 | |
| *** bdossant has quit IRC | 10:48 | |
| *** jistr has joined #openstack-keystone | 10:49 | |
| *** bjornar has joined #openstack-keystone | 11:07 | |
| *** aix has quit IRC | 11:19 | |
| rodrigods | ayoung, morganfainberg sorry... was afk yesterday | 11:23 |
| rodrigods | ayoung, saw you created an extra spec for graduating oslo.policy | 11:24 |
| *** samuelms has joined #openstack-keystone | 11:25 | |
| *** aix has joined #openstack-keystone | 11:32 | |
| *** htruta has joined #openstack-keystone | 11:41 | |
| *** tellesnobrega has joined #openstack-keystone | 11:42 | |
| *** dims has joined #openstack-keystone | 11:48 | |
| *** andreaf has joined #openstack-keystone | 11:53 | |
| *** tellesnobrega has quit IRC | 11:54 | |
| openstackgerrit | Sergey Kraynev proposed openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 12:00 |
| *** amakarov_away is now known as amakarov | 12:18 | |
| *** afaranha has joined #openstack-keystone | 12:24 | |
| *** raildo has joined #openstack-keystone | 12:25 | |
| *** jamielennox is now known as jamielennox|away | 12:29 | |
| *** oomichi has quit IRC | 12:36 | |
| *** i159 has joined #openstack-keystone | 12:36 | |
| *** xianghui has quit IRC | 12:41 | |
| *** nirupma_ has joined #openstack-keystone | 12:59 | |
| nirupma_ | In http://docs.openstack.org/developer/python-keystoneclient/api/keystoneclient.v2_0.html#keystoneclient.v2_0.users.UserManager.get can we use both username and id? | 13:03 |
| *** xianghui has joined #openstack-keystone | 13:08 | |
| *** darren-wang has joined #openstack-keystone | 13:13 | |
| *** xianghui has quit IRC | 13:14 | |
| *** radez_g0n3 is now known as radez | 13:18 | |
| *** samuelms_ has joined #openstack-keystone | 13:23 | |
| *** bknudson has quit IRC | 13:37 | |
| openstackgerrit | Andre Aranha proposed openstack/keystone-specs: Modify the policy file https://review.openstack.org/135408 | 13:41 |
| *** gordc has joined #openstack-keystone | 13:43 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Inherited role assignments to projects https://review.openstack.org/138552 | 13:54 |
| ayoung | rodrigods, yep | 13:55 |
| rodrigods | ayoung, yeah, will work on this today | 13:57 |
| rodrigods | ayoung, I'm about to send a new version of the policy enforcement lib spec | 13:57 |
| *** bdossant has joined #openstack-keystone | 13:57 | |
| rodrigods | ayoung, and will take a look in the graduate one | 13:57 |
| ayoung | rodrigods, OK. so some thoughts on how we are going to do this | 13:57 |
| rodrigods | ok | 13:57 |
| ayoung | we need to have an abstraction for the file fetch and cache | 13:58 |
| ayoung | and that, I think , needs to be split over the new policy library and the keystone client | 13:58 |
| ayoung | the cache object pulls a few things together | 13:58 |
| ayoung | the storage, which can be either file or something like memcache | 13:58 |
| ayoung | and the fetch mechanism, which for our case would be KC calling to Keystone | 13:59 |
| ayoung | but also the config option to time out cache data | 13:59 |
| *** bdossant has quit IRC | 13:59 | |
| ayoung | rodrigods, make sense? | 13:59 |
| rodrigods | ayoung, we can do this via HEAD/GET approach | 13:59 |
| ayoung | you mean HEAD to see if there is a new version and GET to fetch it if there is? | 14:00 |
| rodrigods | ayoung, yes | 14:00 |
| ayoung | but we don't want to do a HEAD call on every call to Nova, so there still needs to be a timeout | 14:00 |
| *** bdossant has joined #openstack-keystone | 14:00 | |
| ayoung | although we could do that based on the HTTP headers | 14:00 |
| rodrigods | ayoung, yep | 14:01 |
| rodrigods | ayoung, so... IMO this cache layer in the client needs another spec | 14:02 |
| rodrigods | and for the first version of the lib + kc, we would use the files as it is today, or not? | 14:02 |
| *** richm has joined #openstack-keystone | 14:09 | |
| *** tellesnobrega has joined #openstack-keystone | 14:09 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a Py2.6 version of inspect.getcallargs https://review.openstack.org/136210 | 14:10 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a Py2.6 version of assertSetEqual https://review.openstack.org/136211 | 14:10 |
| openstackgerrit | David Stanek proposed openstack/keystone: Expanded mutable hacking checks https://review.openstack.org/136208 | 14:10 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a bit of WSGI code converts unicode to str https://review.openstack.org/136209 | 14:10 |
| *** nkinder has quit IRC | 14:11 | |
| marekd | dstanek: just wanted to follow up how is the federation in functional testing going? | 14:15 |
| *** diegows has joined #openstack-keystone | 14:17 | |
| dstanek | marekd: hey! i'm revamping my patch a little, but basically right now it sets up Keystone behind apache and pysaml2 as an IdP - i can definitely use your help in completing the configuration | 14:17 |
| marekd | dstanek: any VM so we can share the configuration? | 14:17 |
| marekd | dstanek: or configs, scripts | 14:17 |
| marekd | whatever. | 14:17 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Identify groups by name/domain in mapping rules. https://review.openstack.org/139013 | 14:18 |
| dstanek | if you email me a public key i can give you access to my original VM | 14:18 |
| marekd | dstanek: i will | 14:19 |
| marekd | dstanek: give me a sec | 14:19 |
| dstanek | marekd: awesome, thx | 14:19 |
| samuelms | Hi all .. as you may know, we have done some work regarding the policy v3 sample | 14:20 |
| samuelms | https://review.openstack.org/#/q/status:open+branch:master+topic:bp/modify-policy,n,z | 14:20 |
| samuelms | I'd like to have some opinions on that | 14:20 |
| samuelms | in other words, I'd like to know if you think that's something that would be good to have | 14:20 |
| samuelms | we don't want to put more effort if you say us that isn't something you don't would like to see merged on our code | 14:20 |
| samuelms | ayoung, ^ | 14:20 |
| dstanek | marekd: lbragstad and i spent some time yesterday discussing the ideas here: https://etherpad.openstack.org/p/keystone-functional-tests | 14:20 |
| ayoung | samuelms, looking... | 14:20 |
| samuelms | ayoung, maybe that's something we could discuss on our meeting | 14:20 |
| dstanek | marekd: once my patch is fixed up a little bit i'll convert it into a spec | 14:20 |
| *** k4n0 has quit IRC | 14:21 | |
| marekd | dstanek: ++ | 14:21 |
| marekd | dstanek: i've sent you an email | 14:22 |
| ayoung | samuelms, so I think that the effort is good, but there are some details and some long term direction things we should discuss | 14:25 |
| ayoung | I'd like to get the rules for the individual APIs down much shorter | 14:25 |
| *** joesavak has joined #openstack-keystone | 14:25 | |
| ayoung | and maybe just have an indicator on certain APIs that project_is_a_domain | 14:26 |
| samuelms | ayoung, cool ... thanks for this feeback | 14:28 |
| samuelms | ayoung, so I'll put a bullet point in our today's meeting | 14:28 |
| ayoung | samuelms, deal | 14:28 |
| samuelms | ayoung, and we can discuss further together :) | 14:28 |
| *** KanagarajM has joined #openstack-keystone | 14:29 | |
| *** mzbik has quit IRC | 14:29 | |
| *** avozza is now known as zz_avozza | 14:31 | |
| *** zz_avozza is now known as avozza | 14:36 | |
| *** bknudson has joined #openstack-keystone | 14:38 | |
| *** ChanServ sets mode: +v bknudson | 14:38 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller Use case https://review.openstack.org/139824 | 14:39 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Identify groups by name/domain in mapping rules. https://review.openstack.org/139013 | 14:39 |
| ayoung | samuelms, I don't think we want to take meeting time on this. I think that it can be handled with the code review | 14:41 |
| *** lhcheng has joined #openstack-keystone | 14:55 | |
| samuelms | ayoung, I don't wanna take a lot of time. that's just to have an overall of the change and request people to review that | 14:59 |
| samuelms | ayoung, we'd like to have that merged on keystone (at least the spec) asap | 14:59 |
| samuelms | ayoung, so that we have more arguments to propose that to all the other involved services | 14:59 |
| samuelms | ayoung, once we have that merged, we plan to submit the same idea on all the services and then send an email to the mailing list | 15:00 |
| samuelms | ayoung, so that we can have cross-project discussion on the importance of this work | 15:00 |
| samuelms | ayoung, makes sense? | 15:00 |
| *** k4n0 has joined #openstack-keystone | 15:01 | |
| samuelms | ayoung, gotta to have lunch now. I'll be back in an hour | 15:02 |
| *** samuelms is now known as samuelms-away | 15:02 | |
| *** nkinder has joined #openstack-keystone | 15:02 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 15:02 |
| marekd | vsilva: yeah, you can change your score now. | 15:02 |
| *** shakamunyi has joined #openstack-keystone | 15:04 | |
| marekd | vsilva: thank you | 15:04 |
| vsilva | marekd, :D | 15:04 |
| marekd | advantage of having multiple screens | 15:04 |
| *** shakamunyi has quit IRC | 15:04 | |
| *** shakamunyi has joined #openstack-keystone | 15:05 | |
| marekd | nkinder, morganfainberg: https://review.openstack.org/138035 so i think this one is finally ready. | 15:05 |
| *** avozza is now known as zz_avozza | 15:05 | |
| *** zz_avozza is now known as avozza | 15:05 | |
| nkinder | marekd: great! Reviewing now... | 15:06 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Migrate_repo init version helper https://review.openstack.org/137640 | 15:09 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Share engine between migration helpers. https://review.openstack.org/137778 | 15:09 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add primary key to the endpoint_group id column. https://review.openstack.org/137638 | 15:09 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add index to the revocation_event.revoked_at. https://review.openstack.org/137639 | 15:09 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Explicit MySQL engine designation. https://review.openstack.org/138712 | 15:09 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 15:09 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Fix index name the assignment.actor_id table. https://review.openstack.org/137637 | 15:09 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Use metadata.create_all() to fill a test database https://review.openstack.org/93558 | 15:10 |
| marekd | nkinder: thanks. since i got an impression that there is a general agreement on the general concept i push a commit before a final +A on a spec: https://review.openstack.org/#/c/139013/ | 15:12 |
| nkinder | marekd: oh, great. I'll give that a look over today. | 15:13 |
| marekd | no rush | 15:13 |
| marekd | need to add some tests | 15:13 |
| *** ksavich has joined #openstack-keystone | 15:19 | |
| *** ksavich has quit IRC | 15:19 | |
| *** david-lyle has joined #openstack-keystone | 15:21 | |
| *** gokrokve has joined #openstack-keystone | 15:21 | |
| *** ajayaa has quit IRC | 15:23 | |
| *** shakamunyi has quit IRC | 15:25 | |
| *** shakamunyi has joined #openstack-keystone | 15:25 | |
| *** avozza is now known as zz_avozza | 15:26 | |
| *** zz_avozza is now known as avozza | 15:27 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Multifactor Authentication https://review.openstack.org/130376 | 15:30 |
| *** gokrokve has quit IRC | 15:32 | |
| *** gokrokve has joined #openstack-keystone | 15:33 | |
| *** afazekas has quit IRC | 15:36 | |
| morganfainberg | morning | 15:37 |
| marekd | morganfainberg: morning, and thanks for a +2 | 15:40 |
| morganfainberg | marekd, yeah that one was close already | 15:40 |
| marekd | dstanek: morganfainberg: yeah | 15:40 |
| morganfainberg | marekd, ok so have a question about ECP wrap issues | 15:41 |
| morganfainberg | marekd, got a few minutes to discuss what is going on there and what we need to do to solve it? | 15:41 |
| marekd | morganfainberg: yes | 15:41 |
| morganfainberg | i need to understand it because i know i'm going to aiming on k2k federation being stable by k2 | 15:42 |
| morganfainberg | earlier would be better | 15:42 |
| morganfainberg | s/going to aiming/something that makes grammar logic more better phrasing | 15:42 |
| marekd | i was hoping to spend my whole time on that this week but it's not working as planned early. | 15:42 |
| * morganfainberg drinks more coffee. | 15:42 | |
| marekd | morganfainberg: whatever :-) | 15:42 |
| *** zzzeek has joined #openstack-keystone | 15:42 | |
| morganfainberg | marekd, hehe i know you knew what i meant | 15:42 |
| marekd | morganfainberg: given the fact you are native and i am not i would rather think there is such a phrase in American English and I was simply not familiar with it :P | 15:43 |
| marekd | morganfainberg: anyway, what would you like to know? | 15:43 |
| morganfainberg | so first off, i understand we can't validate the crypto on the assertions at the moment | 15:44 |
| marekd | morganfainberg: correct. | 15:44 |
| morganfainberg | i'm not clear on why we're running into that with ECP - besides that we are | 15:44 |
| marekd | morganfainberg: ok | 15:44 |
| morganfainberg | afaict it's due to the wrap mechanism. | 15:44 |
| marekd | morganfainberg: correct. | 15:44 |
| morganfainberg | but.. it's just not clicking clearly, figure you'd be able to explain the missing bit to me. | 15:45 |
| marekd | when i was playing with it, even before Juno | 15:45 |
| rodrigods | morganfainberg, marekd, the SOAP wrap? or the SAML assertion signature validation? | 15:45 |
| rodrigods | just getting into the discussion :P | 15:45 |
| marekd | soap wrap | 15:45 |
| rodrigods | ok, sorry for interrupting, go ahead marekd | 15:46 |
| morganfainberg | marekd, aha, i think i understand the bit i was missing | 15:46 |
| morganfainberg | was missing soap bit | 15:46 |
| morganfainberg | that makes a lot more sense now. | 15:47 |
| * morganfainberg doesn't know how i missed soap was part of the wrap. | 15:47 | |
| marekd | morganfainberg: i needed a possibly quickiest way for transporting saml assertion from a IdP to a SP. So i decided to reuse soapwrap and ECP in general. It's simply I would need to transform assertion into some base64 variation, and build a dnamic url where one of the params is a assertion itself. This is how classic browser websso works. | 15:47 |
| morganfainberg | yep | 15:47 |
| marekd | however, i really don't think this is a problem, as only a part of the original assertion is being signed | 15:48 |
| marekd | and later should be validate | 15:48 |
| morganfainberg | ah | 15:48 |
| rodrigods | here, Shibb was complaining in the validation step (SAML assertion) | 15:48 |
| morganfainberg | ok, i have a much better understanding of what is going on then. | 15:48 |
| marekd | namely <Assertion> object. | 15:48 |
| rodrigods | mostly, it was rejecting the issuer (CA) | 15:49 |
| marekd | rodrigods: how do you know that? | 15:49 |
| rodrigods | marekd, logs | 15:49 |
| rodrigods | Shibboleth uses a pipeline of validators | 15:49 |
| marekd | rodrigods: lol, did it say "CA unknown" or similar ? | 15:49 |
| rodrigods | marekd, yep, something like that | 15:49 |
| marekd | could you check what exactly? | 15:50 |
| rodrigods | yes, let me search in the VM | 15:50 |
| marekd | cause i was getting an error that signature cannot be validated, nothing more. | 15:50 |
| marekd | but to me it doesn't mean it's a CA problem. | 15:50 |
| marekd | it even shouldn't be a CA | 15:50 |
| *** lhcheng_ has joined #openstack-keystone | 15:50 | |
| rodrigods | marekd, you need to add extra log levels | 15:50 |
| marekd | i think i did. | 15:50 |
| rodrigods | specific to the validator | 15:50 |
| *** lhcheng_ has joined #openstack-keystone | 15:51 | |
| rodrigods | there is no example in the web (needed to figure out the path to the validator :P) | 15:51 |
| *** topol has joined #openstack-keystone | 15:51 | |
| *** ChanServ sets mode: +v topol | 15:51 | |
| marekd | rodrigods: so maybe you can share our config with me? | 15:51 |
| marekd | s/our/your/ | 15:52 |
| rodrigods | marekd, yep | 15:52 |
| rodrigods | just a sec | 15:52 |
| marekd | rodrigods: please, send it over an email | 15:52 |
| rodrigods | marekd, here is the log output http://paste.openstack.org/show/147976/ | 15:52 |
| rodrigods | marekd, not the ExplicitKey part, which is the "default" validator (the first one in the pipeline) | 15:53 |
| rodrigods | note* | 15:53 |
| *** lhcheng has quit IRC | 15:53 | |
| marekd | rodrigods: and which line indicates it's a CA problem? | 15:54 |
| marekd | rodrigods: i recall ver similar logs but i am not supe sure it's CA :( | 15:54 |
| rodrigods | marekd, 2014-11-03 14:18:43 DEBUG XMLTooling.TrustEngine.ExplicitKey [2]: no peer credentials validated the signature | 15:55 |
| rodrigods | marekd, its just a hint | 15:55 |
| marekd | rodrigods: ah, ok. | 15:55 |
| marekd | rodrigods: hint. | 15:56 |
| marekd | rodrigods: i thought we had different logs | 15:56 |
| rodrigods | marekd, don't we? | 15:57 |
| rodrigods | marekd, ahh, remembered why I think it is the CA | 15:57 |
| rodrigods | so... looking at the ExplicitKey code, where it logs those messages | 15:58 |
| marekd | rodrigods: well, neither mine not yours mention CA and the last warning is kind of similar, so i think we have similar logs :-) | 15:58 |
| rodrigods | it fails in the signature verification, so I manually tried to use xmlsec to validate it | 15:58 |
| rodrigods | and it was giving me the same error | 15:59 |
| rodrigods | until I pass as argument, the CA signature | 15:59 |
| rodrigods | which worked | 15:59 |
| morganfainberg | lbragstad, ping - re the bug you reported about the unpack values | 15:59 |
| morganfainberg | lbragstad, thats an odd one | 15:59 |
| marekd | rodrigods: good. | 16:00 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Migrate_repo init version helper https://review.openstack.org/137640 | 16:01 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Share engine between migration helpers. https://review.openstack.org/137778 | 16:01 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add primary key to the endpoint_group id column. https://review.openstack.org/137638 | 16:01 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add index to the revocation_event.revoked_at. https://review.openstack.org/137639 | 16:01 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Explicit MySQL engine designation. https://review.openstack.org/138712 | 16:01 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 16:01 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Fix index name the assignment.actor_id table. https://review.openstack.org/137637 | 16:01 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Use metadata.create_all() to fill a test database https://review.openstack.org/93558 | 16:01 |
| *** afazekas has joined #openstack-keystone | 16:01 | |
| marekd | rodrigods: did you validate whle assertion? | 16:01 |
| rodrigods | marekd, yes | 16:01 |
| rodrigods | marekd, maybe... does xmlsec has its own path to store certificates? | 16:02 |
| rodrigods | morganfainberg, following or already multithreading with other stuff? | 16:03 |
| marekd | rodrigods: i don't know but i don't think so at the same moment. | 16:03 |
| morganfainberg | rodrigods, i'm reading the discussion | 16:03 |
| morganfainberg | rodrigods, but mostly just watching atm. | 16:04 |
| marekd | morganfainberg: anything else regarding that matter? Well, my plan is to get back to it, and it get higher and higher priority | 16:04 |
| marekd | almost at the top starting from tmrw. | 16:04 |
| morganfainberg | marekd, you've covered pretty much everything i needed ot know | 16:04 |
| morganfainberg | thanks! | 16:04 |
| amakarov | morganfainberg, greetings! Am I correct in my understanding: if create_trust gets allow_redelegation=False it just wipes redelegation_count out from the stored trust? | 16:04 |
| morganfainberg | :) | 16:04 |
| marekd | morganfainberg: lol, that was quick :P | 16:04 |
| marekd | a magic word: soap wrap :P | 16:05 |
| morganfainberg | marekd, hehe i figured i was missing some bit. | 16:05 |
| morganfainberg | amakarov, setting allow_redelegation=False would just set redelegation_count to 0 | 16:05 |
| morganfainberg | artifically | 16:05 |
| marekd | morganfainberg: staying with K2K i am not sure sure how to proceed with K2K Service Providers objects. | 16:05 |
| *** nirupma_ has quit IRC | 16:05 | |
| morganfainberg | basically, any case we don't allow relegation, we set that value. | 16:06 |
| *** chrisshattuck has joined #openstack-keystone | 16:06 | |
| morganfainberg | marekd, from the service catalog perspective? | 16:06 |
| amakarov | morganfainberg, well, but in this case redelegation_count=0 will be present in returned trust while you want to minimize data size. Besides we don't need that count anymore | 16:06 |
| marekd | morganfainberg: namely this: https://review.openstack.org/#/c/135604/ i am not sure we should make a framwork workable with different protocols, like saml2, oidc and so on | 16:06 |
| morganfainberg | amakarov, well i guess we could remove the value? | 16:07 |
| marekd | morganfainberg: if so, we may need to combine it 'protocol' objects | 16:07 |
| amakarov | morganfainberg, ++ | 16:07 |
| morganfainberg | marekd, hrm. | 16:07 |
| marekd | morganfainberg: oh yes, it gave me a lot of 'hrm'... | 16:07 |
| marekd | morganfainberg: it's even worse :-) | 16:08 |
| morganfainberg | marekd, ok let me re-read this spec | 16:09 |
| ayoung | marekd, morganfainberg so I've been talking with some of the other devs here about SAML providers. Here is what we are planning on doing for RDO etc: | 16:09 |
| ayoung | the SAML Discovery page will be in Ipsilon | 16:09 |
| marekd | ayoung: its another topic, right? | 16:09 |
| marekd | ayoung: ipsilon is a IdP, right? | 16:09 |
| morganfainberg | ayoung, i think that is related but not the same thing. | 16:09 |
| ayoung | no real UI in Keystone, which I think is in keeping with the general desire to keep UI out of Keystone | 16:09 |
| ayoung | ah...hadn't read up | 16:10 |
| ayoung | new topic | 16:10 |
| marekd | :-) | 16:10 |
| morganfainberg | yah | 16:10 |
| marekd | ayoung: ipsilon is a IdP, correct? | 16:10 |
| ayoung | yes, Ipsilon is sortof IdP | 16:10 |
| ayoung | more like IdP gateway, but from our perspective, yes, IdP | 16:11 |
| marekd | ayoung: fair enough. | 16:11 |
| ayoung | but it will also do the multiplexing for other IdPs | 16:11 |
| marekd | ayoung: it's like adfs does today. | 16:11 |
| ayoung | it will be required to talk to Keystone, but also others | 16:11 |
| ayoung | yes, just like ADFS | 16:11 |
| ayoung | think of it as the FOSS equivalent, like we are trying to make FreeIPA for AD | 16:11 |
| morganfainberg | marekd, oh slightly related got a microsoft contact to talk about ADFS 3rd party CI. [slightly related] | 16:12 |
| marekd | morganfainberg: ayoung: rodrigods : lol, 5 parallel topics at the same time... | 16:12 |
| ayoung | So the goal is that Ipsilon should work not just for Keystone and the undercloud, but also as the portal for the end users | 16:12 |
| morganfainberg | marekd, yeah sorry | 16:12 |
| ayoung | Heh...I can wait | 16:12 |
| marekd | morganfainberg: got my email about MS PoC? | 16:12 |
| morganfainberg | marekd, yeah | 16:12 |
| morganfainberg | marekd, i did. i meant to reply - but got caught up in travel etc. | 16:13 |
| morganfainberg | marekd, so re-reading this spec first. | 16:13 |
| marekd | morganfainberg: if you need help please reply, if not, please reply with short 'thanks, no need' :-) | 16:13 |
| morganfainberg | marekd, absolutely will be replying this week [today/tomorrow] | 16:14 |
| marekd | ayoung: let's get back in 10 mins, wanted to finish the SP objects convo now, i don't switch context that fast :-) | 16:14 |
| ayoung | ++ | 16:14 |
| marekd | morganfainberg: so, the thing even with idps is as follows | 16:14 |
| marekd | if you have a federation where you need to configure (means add via identity api ) say 500 IdPs | 16:15 |
| marekd | you need to make up 500 names for each of them, right? | 16:15 |
| morganfainberg | right | 16:15 |
| marekd | normally, with classic IdP you would simply add a Metadata configured by a trusted SP | 16:15 |
| morganfainberg | which seems wrong | 16:15 |
| *** agireud has joined #openstack-keystone | 16:15 | |
| marekd | well, cumbersome and super tedious. | 16:15 |
| morganfainberg | awful UX | 16:16 |
| marekd | the same thing was with SPs | 16:16 |
| marekd | we can now: keep the APIs consistent and carry on with not the best approach b) split the APIs and let users configure SPs by adding SAML metadatas | 16:17 |
| marekd | but i am opting for option a | 16:17 |
| marekd | why, you ask | 16:17 |
| morganfainberg | was actually going to ask why ;) | 16:17 |
| marekd | i simply don't want to start making Keystone a first-class IdP | 16:17 |
| morganfainberg | that is fair enough | 16:17 |
| marekd | well | 16:17 |
| morganfainberg | it's a proxy IDP basically | 16:17 |
| marekd | if we had more people | 16:17 |
| morganfainberg | in k2k, and otherwise only a SP | 16:17 |
| marekd | morganfainberg: this would mean building full set of capabilities that saml2 idp today has | 16:18 |
| marekd | we would need to implement whole saml2 stack | 16:18 |
| morganfainberg | fair enought | 16:19 |
| morganfainberg | the issue i see here is that from the service-provider use-case (e.g. i'm HP providing a public cloud) | 16:19 |
| marekd | yep. | 16:20 |
| morganfainberg | needing a unique name might become hard if we had tons and tons and tons of IDPs | 16:20 |
| *** david-lyle has quit IRC | 16:20 | |
| marekd | morganfainberg: those names are simply entityId which turns to be URLs | 16:20 |
| marekd | in a standard federations. | 16:20 |
| morganfainberg | hm. | 16:21 |
| morganfainberg | ok | 16:21 |
| marekd | we could try to replace ids with uuids (just for PKs in a DB) and try to identify by entityId | 16:21 |
| marekd | and this would make things easier. | 16:22 |
| morganfainberg | i think that might become much better | 16:22 |
| morganfainberg | i was mulling over the implications | 16:22 |
| marekd | but it means changing the API. | 16:22 |
| morganfainberg | right | 16:22 |
| marekd | including the calls | 16:22 |
| morganfainberg | which is problematic for the standard federation consumption | 16:22 |
| marekd | ...why? | 16:22 |
| morganfainberg | if we're changing apis | 16:23 |
| morganfainberg | i'm concerned we break compatbility ons table apis | 16:23 |
| marekd | we woule need to build new api, pt the old one in a deprecated mode and for 1 or 2 cycles handle both. | 16:24 |
| morganfainberg | ok i am behind that change then | 16:24 |
| morganfainberg | yeah | 16:24 |
| marekd | where new api uses uuid as a ID and old uses idp_name as an ID | 16:24 |
| morganfainberg | ack | 16:24 |
| marekd | makes sense? | 16:24 |
| morganfainberg | yep | 16:24 |
| marekd | allrighty. i was going to push another spec for changing idp api either way, but need to talk with marco fargeta from an italian institute either way. | 16:25 |
| marekd | next thing. | 16:25 |
| morganfainberg | right | 16:25 |
| marekd | service providers for K2K again. so we needed to build some login to issue saml assertions | 16:25 |
| morganfainberg | marekd, thanks for helping and driving the backend on this | 16:25 |
| morganfainberg | i really really appreciate it. | 16:25 |
| marekd | morganfainberg: sure :-) that's why i am here :-) | 16:25 |
| morganfainberg | marekd, :) | 16:25 |
| *** agireud has quit IRC | 16:25 | |
| morganfainberg | marekd, but just wanting to be clear how much i appreciate it | 16:26 |
| marekd | morganfainberg: great to hear that :-) | 16:26 |
| ayoung | samuelms-away, I think revision 16 is closer to what we need. | 16:26 |
| *** samuelms-away is now known as samuelms | 16:26 | |
| marekd | morganfainberg: so, k2k and making keystone understand saml ,even in a limited way was some effort, not a matter of building a framework and configuration. But i don't know if we want to make it ready for other federation protocols, like open id connect? | 16:27 |
| marekd | so we are ready for k2k with oidc ? | 16:27 |
| morganfainberg | i don't think we need k2k to be oidc? | 16:27 |
| morganfainberg | s/?// | 16:27 |
| morganfainberg | i'm perfectly happy to say k2k is saml and thats it | 16:28 |
| morganfainberg | since we're issuing the assertion and we control end-to-end | 16:28 |
| marekd | cause if we do....we must be able to distinguis what protocol should be used for which trusted SP, right? | 16:28 |
| morganfainberg | if that makes it/keeps it simpler | 16:28 |
| morganfainberg | marekd, right. which is part of why i don't see the value | 16:28 |
| marekd | morganfainberg: ok, understand. | 16:28 |
| morganfainberg | is there a concern with only using saml2? | 16:28 |
| morganfainberg | or a big win to using oidc for k2k vs saml2? | 16:29 |
| marekd | morganfainberg: the only win is that somebody can federated their cloud with SP talking Saml2,Oidc etc instead of saml2 only. | 16:29 |
| marekd | i am not in a position to talk which protocol is better or more secure...i think both are good. | 16:30 |
| morganfainberg | marekd, this sounds like utilizing keystone as a general idp-proxy | 16:30 |
| morganfainberg | and for non-k2k | 16:30 |
| marekd | morganfainberg: that's my concern too...i want to make something usable and extendable, but i don't want to endup building something like : idp for every possible protocol that exists, and probably screw this up :-) | 16:31 |
| samuelms | ayoung, hi, makes sense ... we changed like that to be compatible with already deployed clouds | 16:31 |
| morganfainberg | marekd, lets start with saying we do SAML2 and thats it | 16:31 |
| morganfainberg | marekd, it's our standard | 16:31 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 16:31 |
| ayoung | samuelms, a good rule of thumb: avoid "or" in the api rules | 16:31 |
| samuelms | ayoung, I think we'll need to write a script for migrating db | 16:31 |
| marekd | morganfainberg: ok. | 16:31 |
| morganfainberg | if someone *really* wants oidc, we can get a spec / discussion on why and what the use-case is. Let's keep this to "do one thing and do it really well" | 16:32 |
| ayoung | samuelms, maybe...one thing at a time | 16:32 |
| marekd | morganfainberg: makes thing much much easier :-) | 16:32 |
| morganfainberg | :) | 16:32 |
| ayoung | samuelms, I'm going to clean up revision 16 as I think it should look | 16:32 |
| samuelms | ayoung, great! | 16:32 |
| marekd | morganfainberg: so ou basically cleaned off my "concerns list" :-) | 16:32 |
| morganfainberg | marekd, happy to help! | 16:32 |
| marekd | morganfainberg: thanks. | 16:32 |
| morganfainberg | marekd, this is why i wanted to make sure i got to sync up with you on this stuff. figured we could solve stuff. | 16:33 |
| *** shakamunyi has quit IRC | 16:33 | |
| marekd | morganfainberg: i am likely to be forced to skip todays meeting but should be back in ~4hours, ayoung can we talk then? | 16:33 |
| morganfainberg | marekd, we're not holding the meeting today [i should send an email] | 16:33 |
| ayoung | marekd, sure | 16:33 |
| *** k4n0 has quit IRC | 16:34 | |
| marekd | morganfainberg: oh, so i am not missing anything :-) great. | 16:34 |
| ayoung | morganfainberg, why not? | 16:34 |
| morganfainberg | my schedule since i'm in Austin talking w/ the folks @ the foundation made it hard to be sure i'm available | 16:34 |
| morganfainberg | basically: review code | 16:34 |
| ayoung | morganfainberg, who says we need you? | 16:34 |
| morganfainberg | was the result from last meeting | 16:34 |
| morganfainberg | ayoung, i offered to let someone run it | 16:34 |
| ayoung | I must have missed that | 16:34 |
| samuelms | ayoung, then you'll submit a new patchset, right? | 16:34 |
| ayoung | samuelms, yes | 16:34 |
| morganfainberg | ayoung, you guys are welcome to run the meeting | 16:34 |
| marekd | morganfainberg: children, no new topics today, instead focus on reviews from 18.00 utc to 19.00 | 16:34 |
| morganfainberg | ayoung, i'm fine with that | 16:34 |
| samuelms | ayoung, perfect! looking forward to see it | 16:34 |
| ayoung | morganfainberg, s'alright | 16:34 |
| samuelms | afaranha, ^ | 16:34 |
| afaranha | ayoung, nice :) Thank you | 16:35 |
| ayoung | morganfainberg I'll lurk, and lead a discussion if others want to. | 16:35 |
| morganfainberg | ayoung, i just asked someone to run the meeting this week, and i think we all said "great lets do code-review" | 16:35 |
| ayoung | morganfainberg, NP, and really, if you are there, I'd rather not hold the serious discussions right now anyway | 16:36 |
| *** gokrokve has quit IRC | 16:36 | |
| morganfainberg | ayoung, hackathon/mid-cycle details updated | 16:37 |
| morganfainberg | ayoung, btw | 16:37 |
| morganfainberg | if you didn't see the email | 16:37 |
| ayoung | cool, I'm going to push for approval to fly today | 16:37 |
| * morganfainberg can't book for anouther day or so | 16:38 | |
| morganfainberg | just waiting to see if i am needed in the bay the day after the midcycle | 16:38 |
| dstanek | i was thinking of flying out Sun the 18th and flying back Thurs the 22nd | 16:40 |
| ayoung | I'll probably fly back night of the 21st | 16:41 |
| morganfainberg | yeah i'm probably going to have to leave on the 21st | 16:42 |
| ayoung | depending on flight availability | 16:42 |
| morganfainberg | btw: make sure to book hotels and such early | 16:42 |
| ayoung | morganfainberg, I don't see an email...what did you title it? | 16:42 |
| morganfainberg | it was a reply to the original one | 16:42 |
| morganfainberg | on dev mailing list | 16:42 |
| ayoung | Re: [openstack-dev] [Keystone] Mid-Cycle Meetup Dates/Time/Location | 16:42 |
| ayoung | got it | 16:42 |
| dstanek | that's what i'm trying to find out now | 16:42 |
| morganfainberg | yeah | 16:42 |
| morganfainberg | mostly i did what dolph did the previous times, just updated the blog post and the wiki page(s) | 16:43 |
| dstanek | usually flight back to cle are in the late afternoon and i'd have to leave by 1 | 16:43 |
| *** ayoung has left #openstack-keystone | 16:44 | |
| *** ayoung has joined #openstack-keystone | 16:44 | |
| *** ChanServ sets mode: +v ayoung | 16:44 | |
| *** gyee has joined #openstack-keystone | 16:47 | |
| *** ChanServ sets mode: +v gyee | 16:47 | |
| *** shakamunyi has joined #openstack-keystone | 16:47 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Policy enforcement library https://review.openstack.org/133480 | 16:48 |
| rodrigods | ayoung, ^ | 16:48 |
| ayoung | rodrigods, ah... | 16:54 |
| ayoung | so I wrote a spec for oslo, too | 16:54 |
| rodrigods | ayoung, I saw it | 16:54 |
| ayoung | I'll take another look at this | 16:54 |
| rodrigods | ayoung, since you added this another spec, I've made this one more focused in the keystoneclient part | 16:55 |
| ayoung | rodrigods, but I think we need to set up the policy library, and then move most of the guts of this spec to that. | 16:55 |
| rodrigods | ayoung, in a github rep? | 16:55 |
| ayoung | and some of it needs to be in middleware | 16:55 |
| ayoung | rodrigods, I think it will break down like this: | 16:55 |
| ayoung | the os-policy library will have the generic rules engine, plus the cache abstraction in it | 16:56 |
| rodrigods | the middleware part still is a bit obscure to me | 16:56 |
| ayoung | middleware will then have the code to call the rules engine, and know that the cache is supposed to be backed by filesystem or memcache | 16:56 |
| *** samuelms_ has quit IRC | 16:56 | |
| ayoung | keystoneclient will be pulled into the cache to fetch the policy file, but I don't think the cache should live *in* client | 16:57 |
| ayoung | but...maybe it should | 16:57 |
| rodrigods | I thought the service would call kc directly | 16:58 |
| *** lhcheng_ has quit IRC | 16:58 | |
| rodrigods | like from kc import policy_enforcer | 16:58 |
| rodrigods | policy_enforcer.enforce( ... ) | 16:58 |
| rodrigods | inside the "protected" method | 16:58 |
| ayoung | rodrigods, that was my initial thought, too. | 16:58 |
| ayoung | But the need to manage the cache kindof munges that | 16:58 |
| ayoung | and the thing that is most like that now is the certs for PKI tokens | 16:59 |
| ayoung | revocation list, too | 16:59 |
| rodrigods | ayoung, hmm | 16:59 |
| rodrigods | so we need a spec to define a cache layer in the middleware as well? | 16:59 |
| ayoung | so we should have a single cache abstraction for those | 16:59 |
| rodrigods | lots of dependencies | 16:59 |
| ayoung | heh | 16:59 |
| ayoung | lots of details | 17:00 |
| ayoung | we are just doing the due dilligence to get it right | 17:00 |
| rodrigods | ayoung, ++ | 17:00 |
| morganfainberg | ayoung, rodrigods, policy lib name thought "Themis": http://www.greek-gods.org/titans/themis.php | 17:00 |
| ayoung | morganfainberg, howabout openstack-policy instead? | 17:00 |
| morganfainberg | ayoung, i don't think that is going to work | 17:01 |
| morganfainberg | just a hunch | 17:01 |
| morganfainberg | notice no libraries are named "openstack-<thing>" | 17:01 |
| ayoung | this is stupid | 17:01 |
| rodrigods | I like those kind of names morganfainberg | 17:01 |
| morganfainberg | i think this is a branding issue | 17:01 |
| rodrigods | :) | 17:01 |
| ayoung | it is a part of the openstack set of applications | 17:01 |
| morganfainberg | there is a reason oslo exists instead of calling all of those libraries openstack-<thing> | 17:02 |
| ayoung | making it impossible to sensibly name things due the the needs to deconflict between the global namespace of python packages and the openstack unwillingness to let us use its name is kindof make-worky to me | 17:02 |
| ayoung | so call it oslo | 17:02 |
| ayoung | oslo-policy, managed by the identity team is fine | 17:02 |
| ayoung | hell, we can leave anyone from oslo-core on it that feels strongly enough | 17:03 |
| morganfainberg | ijust confirmed with the foundation folks we can't name anything openstack-<thing> for now | 17:03 |
| ayoung | I do't want to "hide" it | 17:03 |
| ayoung | themis, while clever, does not describe it | 17:03 |
| morganfainberg | ayoung, the point is if it's under our program we can't make it oslo | 17:03 |
| rodrigods | nova described nova? | 17:03 |
| rodrigods | hehe | 17:03 |
| ayoung | keystone-policy then | 17:04 |
| rodrigods | keystone-policy is too "keystone" | 17:04 |
| morganfainberg | and i'm against namespacing it keystone | 17:04 |
| ayoung | if it has to be named by our team, let us use our code name | 17:04 |
| morganfainberg | if this is the sticking point i'll just pick a name and we'll add it to the wiki and call it that. | 17:05 |
| morganfainberg | but i *dont* want it named keystone, and it can't be oslo under our program | 17:05 |
| ayoung | Why not Keystone? | 17:05 |
| morganfainberg | ayoung, because it isn't keystone specific | 17:05 |
| *** ajayaa has joined #openstack-keystone | 17:05 | |
| morganfainberg | you don't need keystone to work with it | 17:05 |
| ayoung | Keystone isn't anything | 17:05 |
| *** afazekas has quit IRC | 17:05 | |
| rodrigods | morganfainberg, ayoung https://etherpad.openstack.org/p/policy-library-name you just forgot about this :( | 17:05 |
| ayoung | it is a code name for our team | 17:05 |
| morganfainberg | keystone is also a project | 17:06 |
| morganfainberg | in tiself | 17:06 |
| dstanek | morganfainberg: springer? | 17:06 |
| morganfainberg | dstanek lol | 17:06 |
| dstanek | morganfainberg: my names are always from wikipedia http://en.wikipedia.org/wiki/Keystone_%28architecture%29 | 17:07 |
| ayoung | jakarta-policy? | 17:07 |
| morganfainberg | dstanek, ++ | 17:07 |
| dstanek | ayoung: +1 it would excite and severely disappoint java guys! | 17:07 |
| ayoung | Policy is integral to keystone. The fact that keystone-policy can be used stand alone is just an artifact of good design. | 17:08 |
| *** KanagarajM has quit IRC | 17:08 | |
| rodrigods | naming keystone-policy, sounds like we could have nova-policy | 17:08 |
| *** _cjones_ has joined #openstack-keystone | 17:09 | |
| morganfainberg | ayoung, i'm punting this back to oslo land | 17:10 |
| ayoung | rodrigods, if the nova team wanted to have their own policy library, they could | 17:11 |
| morganfainberg | this will be oslo_policy | 17:11 |
| dstanek | rodrigods: i agree...i would actually expect to see {{project}}-policy packages | 17:12 |
| ayoung | Whew | 17:12 |
| morganfainberg | dstanek, i expect if it wasn't a general use case over all of openstack already it would be setup like that | 17:12 |
| rodrigods | morganfainberg, I think having it in oslo could confuse developers because the enforcement handling will be mostly in keystoneclient/middleware | 17:14 |
| rodrigods | ayoung, ^ | 17:14 |
| ayoung | rodrigods, no | 17:14 |
| ayoung | rodrigods, oslo means "openstack common" | 17:14 |
| ayoung | its a generic namespace | 17:14 |
| ayoung | and this is a library | 17:14 |
| ayoung | the part that is keystone specific only will be in keystone code | 17:14 |
| *** avozza is now known as zz_avozza | 17:15 | |
| ayoung | the policy.py file and anything we expand it with will be oslo-policy | 17:15 |
| rodrigods | ayoung, thought the idea was to remove duplicates from everywhere | 17:15 |
| rodrigods | and having them using our enforcement part | 17:15 |
| ayoung | rodrigods, GAH! | 17:15 |
| ayoung | rodrigods, all we are talking about is the name of the promoted library | 17:16 |
| rodrigods | ayoung, ahh | 17:16 |
| ayoung | which will replace the synced-from-incubator code | 17:16 |
| rodrigods | forget ^ | 17:16 |
| ayoung | whew | 17:16 |
| dstanek | anyone remember how late we ended on the last day for the last mid-cycle | 17:18 |
| morganfainberg | dstanek, 5ish | 17:19 |
| morganfainberg | but it was a friday and they kicked us out | 17:19 |
| morganfainberg | or 6ish | 17:19 |
| morganfainberg | ayoung, email sent to dev-list with ${reasons:-0} to keep it in oslo | 17:19 |
| dstanek | alrighty - i'll just leave thurs in the afternoon just in case | 17:20 |
| *** lhcheng has joined #openstack-keystone | 17:21 | |
| rodrigods | ayoung, back to middleware/client discussion? | 17:22 |
| ayoung | rodrigods, sure | 17:23 |
| *** hugokuo has quit IRC | 17:23 | |
| morganfainberg | ayoung, http://lists.openstack.org/pipermail/openstack-dev/2014-December/052574.html | 17:23 |
| *** charz has quit IRC | 17:23 | |
| ayoung | morganfainberg, ++ | 17:24 |
| morganfainberg | ayoung, if you don't mind +1 that i'd appreciate it if you agree | 17:24 |
| ayoung | morganfainberg, wilco | 17:24 |
| rodrigods | ayoung, so we have this cache layer, that should be in middleware | 17:24 |
| rodrigods | and we have the oslo_policy and the enforcement handler | 17:25 |
| rodrigods | the former in keystoneclient? | 17:25 |
| morganfainberg | rodrigods, to start we're going to graduate the policy lib as-is. | 17:25 |
| morganfainberg | well perhaps as-is with minor fixes | 17:25 |
| *** gokrokve has joined #openstack-keystone | 17:25 | |
| morganfainberg | and get a release so it's drop in replacement | 17:25 |
| morganfainberg | we can then scrub it from incubator | 17:25 |
| rodrigods | morganfainberg, need a github rep for it? | 17:26 |
| morganfainberg | rodrigods, we will need to follow the oslo graduation steps (and maintain history) | 17:26 |
| *** marcoemorais has joined #openstack-keystone | 17:26 | |
| morganfainberg | rodrigods, part of that will be pushing the new lib to github so infra can source it in. | 17:26 |
| morganfainberg | rodrigods, https://wiki.openstack.org/wiki/Oslo/CreatingANewLibrary#Graduating_a_Library_from_the_Incubator | 17:27 |
| rodrigods | morganfainberg, great, seems the first steps are yours :) | 17:27 |
| morganfainberg | rodrigods, email has been sent. we're going to give it a day or so to settle and then update spec. | 17:27 |
| morganfainberg | or update spec later today | 17:27 |
| morganfainberg | and start the process | 17:27 |
| rodrigods | morganfainberg, ok, thank you :) | 17:28 |
| rodrigods | I can help ayoung to take care of the spec as well (as I'm doing with the keystoneclient part) | 17:29 |
| morganfainberg | ++ | 17:29 |
| ayoung | rodrigods, updating the oslo spec now | 17:29 |
| rodrigods | ayoung, ++ | 17:30 |
| ayoung | morganfainberg, so what do we namespace policy.py with in this case? | 17:30 |
| ayoung | from oslo_policy import policy? | 17:30 |
| *** charz has joined #openstack-keystone | 17:31 | |
| morganfainberg | yep | 17:31 |
| *** hugokuo has joined #openstack-keystone | 17:34 | |
| ayoung | rodrigods, if you want to go through the steps to clone the repo, please do so | 17:34 |
| rodrigods | ayoung, ok, doing | 17:35 |
| *** ayoung is now known as ayoung-lunch | 17:35 | |
| rodrigods | ayoung, oslo_policy right? (the example is oslo.i18n) | 17:35 |
| rodrigods | morganfainberg, ^ | 17:36 |
| morganfainberg | marekd, sent a reply for ADFS | 17:40 |
| morganfainberg | marekd, email that is | 17:40 |
| lbragstad | morganfainberg: yeah, it was weird. I didn't find it until bknudson said someting | 17:40 |
| lbragstad | something* | 17:40 |
| morganfainberg | lbragstad, but that latest change shouldn't have caused it. | 17:41 |
| lbragstad | and i was able to recreate it | 17:41 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 17:41 |
| morganfainberg | since the unpack is in wsgi? | 17:41 |
| lbragstad | I don't think it was that change. | 17:41 |
| morganfainberg | yeah | 17:41 |
| morganfainberg | i think this might have been lingering for a bit | 17:41 |
| lbragstad | I just recorded that in the bug report for reference | 17:41 |
| morganfainberg | yeah | 17:41 |
| morganfainberg | rodrigods, use oslo_policy | 17:42 |
| morganfainberg | rodrigods, we're trying to get away from the dot-namespace in oslo (oslo.<thing> causes issues in develop / other install modes for python libs) | 17:42 |
| *** stevemar has joined #openstack-keystone | 17:42 | |
| *** ChanServ sets mode: +v stevemar | 17:42 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 17:43 |
| rodrigods | rodrigods, cool | 17:44 |
| rodrigods | morganfainberg, cool | 17:44 |
| bknudson | lbragstad: I tried running some tests by themselves (catalog) and no log in that case... so I don't know where it's coming from | 17:44 |
| bknudson | going back through commits should find it, but it's going to take a while if there's no way to narrow down what test it is. | 17:45 |
| lbragstad | bknudson: yeah, exactly.. that's the tricky part | 17:46 |
| lbragstad | is everyone still planning on reviewing specs during the meeting? | 17:48 |
| openstackgerrit | Merged openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 17:49 |
| morganfainberg | lbragstad, that was the thought iirc | 17:50 |
| lbragstad | cool | 17:50 |
| morganfainberg | lbragstad, also K1 is next week | 17:51 |
| morganfainberg | we have an outstanding BP or two that need code review | 17:51 |
| amakarov | morganfainberg, I've made discussed changes to both spec and code. For now I leave allow_redelegation=False in the trust to explicitly state that the chain is terminated. Is it correct? I don't want to remove it because Heat folks (especially Steven Hardy) want allow redelegation by default in the future :) I've managed to convince them that we don't want it enabled in a new feature, but I think it is a thing to remember. | 17:51 |
| morganfainberg | amakarov, thanks | 17:52 |
| lbragstad | morganfainberg: sounds good | 17:52 |
| lbragstad | morganfainberg: is dolphm's gist still being used for those kinds of reviews? | 17:52 |
| morganfainberg | lbragstad, i belive so | 17:52 |
| morganfainberg | lbragstad, i haven't starred all the things though | 17:52 |
| *** gokrokve has quit IRC | 17:52 | |
| morganfainberg | amakarov, hm. | 17:53 |
| lbragstad | morganfainberg: looking pretty full https://gist.github.com/dolph/651c6a1748f69637abd0 | 17:53 |
| morganfainberg | amakarov, i don't think we need "allow_redelgation" anywhere | 17:53 |
| morganfainberg | lbragstad, yeah | 17:53 |
| *** gokrokve has joined #openstack-keystone | 17:53 | |
| morganfainberg | amakarov, except in the creation request | 17:53 |
| morganfainberg | amakarov, the default behavior could be setting the max_depth to 0 (to disable) in the trust | 17:54 |
| morganfainberg | amakarov, i don't see a need for more than one way to reference "can I redelegate" | 17:55 |
| morganfainberg | having to check 2 values seems silly | 17:55 |
| morganfainberg | amakarov, i think is my point overall. | 17:56 |
| i159 | ayoung: Hi! please see my updates on https://review.openstack.org/#/c/138712/. | 17:57 |
| amakarov | morganfainberg, so what do we do to redelegation_count field? | 17:57 |
| morganfainberg | amakarov, sorry max_depth = redelegation_count | 17:58 |
| morganfainberg | amakarov, but when we disable redelegation for anyreason we just set that to 0 | 17:58 |
| *** david-lyle_afk is now known as david-lyle | 17:58 | |
| morganfainberg | amakarov, that way it avoids needing to check trust['allow_redelegation'] and trust['redelegation_count'] | 17:59 |
| amakarov | morganfainberg, set it to 0 and return; set to 0, store and NOT return; remove completely ? | 17:59 |
| morganfainberg | amakarov, that sounds like the best plan to me. | 17:59 |
| *** packet has joined #openstack-keystone | 17:59 | |
| morganfainberg | amakarov, set to 0 | 17:59 |
| morganfainberg | and store it | 17:59 |
| morganfainberg | do we *need* a field called allow_redelegation if we have redelegation_count? | 18:00 |
| morganfainberg | the way i see it is we always check redelegation_count | 18:00 |
| morganfainberg | if redelegation_count is 0, we either hit the end of the chain or we disallowed redelegation | 18:00 |
| stevemar | no meeting this week? | 18:01 |
| morganfainberg | if there is a real reason to have a second field, i'm open to it, but my concern is that we don't need it | 18:01 |
| amakarov | morganfainberg, there was a discussion in the spec | 18:01 |
| morganfainberg | stevemar, until just now i was supposed to be in a meeting right now and based on last week no one wanted to run it so "review specs" | 18:01 |
| amakarov | https://review.openstack.org/#/c/99908/ | 18:01 |
| stevemar | morganfainberg, right, fair enough | 18:01 |
| morganfainberg | stevemar, and blocking code (for k1) | 18:02 |
| morganfainberg | amakarov, i don't see the spec stating "allow_redelegation" is needed from a store standpoint | 18:03 |
| samuelms | morganfainberg, dont we have keystone meeting starting in few seconds? :-) | 18:03 |
| morganfainberg | samuelms, ^ last week no one wanted to run the meeting and until ~5mins ago i was supposed to be in a meeting. | 18:04 |
| amakarov | morganfainberg, allow_redelegation seems a convenience flag to me, I've asked Steve about it and he said community demands it :) | 18:04 |
| morganfainberg | samuelms, we can have the meeting - but the general consensus was "review specs / code" | 18:04 |
| morganfainberg | amakarov, right, from an API perspective | 18:04 |
| morganfainberg | amakarov, i don't see a benefit for using it in the data store. | 18:04 |
| morganfainberg | amakarov, or in validating trust can redelegate | 18:04 |
| samuelms | morganfainberg, ok. I've added a point on there | 18:05 |
| raildo | morganfainberg, I created the reseller spec :) https://review.openstack.org/#/c/139824/ | 18:05 |
| samuelms | morganfainberg, we'd like to discuss about our proposal for the cloud policy file | 18:05 |
| morganfainberg | samuelms, i am trying to find out if i'm being pulled off to a meeting | 18:05 |
| samuelms | morganfainberg, in which we split global admin role | 18:05 |
| samuelms | morganfainberg, ok | 18:05 |
| morganfainberg | samuelms, i think we're going to keep with the no meeting today - since i might be pulled out any moment | 18:06 |
| openstackgerrit | gordon chung proposed openstack/pycadf: deprecate audit middleware https://review.openstack.org/138386 | 18:06 |
| samuelms | morganfainberg, ok then. I'll ping some people to get some reviews up there | 18:06 |
| morganfainberg | samuelms, ack | 18:07 |
| samuelms | morganfainberg, https://review.openstack.org/#/c/135408/11/specs/kilo/modify-policy.rst | 18:07 |
| samuelms | morganfainberg, would be glad tyo have your opinion :D | 18:07 |
| amakarov | morganfainberg, aha... so you want allow_redelegate to be a request parameter - not a trust field, right? One can specify it in a request, but it is not stored in a trust? | 18:07 |
| *** i159 has quit IRC | 18:07 | |
| morganfainberg | amakarov, yes it would be a parameter in the request, a short-hand to set redelegate_count to 0 | 18:08 |
| anteaya | you aren't meeting today? | 18:08 |
| amakarov | morganfainberg, got it! thanks :) | 18:08 |
| topol | morganfainberg, https://www.morganfainberg.com/blog/2014/11/18/keystone-hackathon-kilo/ doesnt appear to work for me | 18:08 |
| morganfainberg | topol, in what way? | 18:09 |
| *** jamielennox|away is now known as jamielennox | 18:09 | |
| topol | morganfainberg: The server rejected the handshake because the client downgraded to a lower TLS version than the server supports. | 18:09 |
| morganfainberg | anteaya, based on last week's meeting and that I'm in Austin (and supposed to be in a meeting) - no. no one wanted to run the meeting when i asked | 18:09 |
| morganfainberg | topol, cloudflare issue? | 18:09 |
| morganfainberg | topol, try again? | 18:09 |
| morganfainberg | it works for me. | 18:09 |
| topol | I think my firefox is up to date | 18:09 |
| anteaya | morganfainberg: okay thanks, just doing a sanity check | 18:10 |
| morganfainberg | anteaya, will send email really quick | 18:10 |
| topol | morganfainberg, same error: | 18:10 |
| topol | (Error code: ssl_error_inappropriate_fallback_alert) | 18:10 |
| anteaya | sure | 18:10 |
| openstackgerrit | gordon chung proposed openstack/pycadf: sync oslo https://review.openstack.org/138381 | 18:11 |
| morganfainberg | topol, your browser is wierd | 18:11 |
| morganfainberg | just confirmed it with a couple people here | 18:11 |
| openstackgerrit | gordon chung proposed openstack/pycadf: sync oslo https://review.openstack.org/138381 | 18:11 |
| jamielennox | morganfainberg: meeting? | 18:11 |
| topol | morganfainberg, yes its weird. It does work from my phone | 18:12 |
| dstanek | when i the spec approval deadline? | 18:13 |
| dstanek | is* | 18:13 |
| morganfainberg | dstanek, k2 | 18:13 |
| morganfainberg | anteaya, email sent | 18:14 |
| anteaya | thanks | 18:14 |
| anteaya | if only for my benefit | 18:14 |
| dstanek | morganfainberg: that's when the specs have to be merged or the implementations? | 18:14 |
| morganfainberg | anteaya, /me is in Austin meeting with the foundation today this week. | 18:14 |
| morganfainberg | dstanek, specs merged | 18:14 |
| dstanek | morganfainberg: oh, ok :-) thanks | 18:15 |
| jamielennox | hmm, /me is going back to bed | 18:15 |
| samuelms | lbragstad, thanks for your review on that policy spec | 18:15 |
| morganfainberg | dstanek, yeah, any thing that is past the k2 deadline - we will likely need some level of POC/implementation to accept a spec-approval deadline exception | 18:15 |
| lbragstad | samuelms: no problem, | 18:15 |
| lbragstad | samuelms: it's mostly questions | 18:16 |
| morganfainberg | samuelms, once i'm done with this meeting i'm jumping into, i'll be looking at specs/reviews/etc | 18:16 |
| *** jamielennox is now known as jamielennox|away | 18:16 | |
| samuelms | morganfainberg, fair enough :-) | 18:16 |
| samuelms | lbragstad, cool. In fact afaranha is the person who is managing patches, etc | 18:17 |
| samuelms | lbragstad, I'm just helping him to have reviews on that | 18:17 |
| lbragstad | samuelms: cool! | 18:17 |
| samuelms | lbragstad, and then decide if we keep putting efforts or stop wasting them | 18:18 |
| samuelms | lbragstad, if keystone really want that.. we'll speed up to have that spec approved asap | 18:18 |
| dstanek | lbragstad: we're basically in a holding pattern for the XML stuff right? | 18:18 |
| lbragstad | dstanek: yes... it's all pretty much on this guy: https://review.openstack.org/#/c/139051/ | 18:18 |
| lbragstad | because grenade uses old configs on new upgrades of a project | 18:19 |
| lbragstad | so the old keystone paste files contain the xml middleware stuff. | 18:19 |
| lbragstad | so we have to provide a migration, or keep the xmlBodyMiddleware in middleware/core.py | 18:19 |
| lbragstad | once that goes in, I can rerun https://review.openstack.org/#/c/125738/ | 18:20 |
| lbragstad | and then I can rerun https://review.openstack.org/#/c/132122/ | 18:20 |
| lbragstad | ... it's a deep and dark rabbit hole | 18:21 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a wip decorator for tests https://review.openstack.org/131516 | 18:23 |
| *** radez is now known as radez_g0n3 | 18:24 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 18:24 |
| dstanek | lbragstad: sounds like fun | 18:24 |
| lbragstad | dstanek: tons! | 18:24 |
| lbragstad | dstanek: but I think this is the last layer of the onion and we should be done with XML in Keystone | 18:25 |
| *** ajayaa has quit IRC | 18:25 | |
| *** amakarov is now known as amakarov_away | 18:25 | |
| bknudson | lbragstad: the old config needs to work otherwise upgrades won't work. | 18:27 |
| lbragstad | bknudson: the old config will work | 18:27 |
| bknudson | keep the xmlbodymiddleware | 18:27 |
| lbragstad | bknudson: the script will only run on upgrade | 18:27 |
| lbragstad | we will have references to XMLBodyMiddleware the don't exist or do anything, it would be like a glorified deprecation message. | 18:29 |
| lbragstad | that* | 18:30 |
| *** harlowja_away is now known as harlowja | 18:30 | |
| openstackgerrit | Endre Karlson proposed openstack/python-keystoneclient: Allow to allow for other then STABLE api version https://review.openstack.org/130159 | 18:30 |
| ekarlso- | can I get some eyes on ^? | 18:30 |
| *** dims has quit IRC | 18:31 | |
| *** r-daneel has joined #openstack-keystone | 18:35 | |
| *** diegows has quit IRC | 18:38 | |
| *** shakamunyi has quit IRC | 18:39 | |
| afaranha | lbragstad, I answered your questions on the patch, could you read it? If you have any question you can ask me | 18:39 |
| *** saipandi has joined #openstack-keystone | 18:44 | |
| *** jistr has quit IRC | 18:49 | |
| lbragstad | afaranha: sounds good, thanks for the quick turnaround | 18:51 |
| *** diegows has joined #openstack-keystone | 18:55 | |
| *** diegows has quit IRC | 18:57 | |
| dstanek | bknudson: morganfainberg: i'm happy with https://review.openstack.org/#/c/131007/ and i'm going to abandon my review | 18:58 |
| *** saipandi has quit IRC | 19:00 | |
| dstanek | stevemar: should you just abandon https://review.openstack.org/#/c/133815/ ? | 19:01 |
| stevemar | dstanek, yeah i think so | 19:02 |
| *** radez_g0n3 is now known as radez | 19:03 | |
| *** ajayaa has joined #openstack-keystone | 19:07 | |
| openstackgerrit | Endre Karlson proposed openstack/python-keystoneclient: Allow for other then STABLE api version https://review.openstack.org/130159 | 19:07 |
| openstackgerrit | gordon chung proposed openstack/pycadf: sync oslo https://review.openstack.org/138381 | 19:12 |
| *** saipandi has joined #openstack-keystone | 19:13 | |
| *** diegows has joined #openstack-keystone | 19:18 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: sync oslo https://review.openstack.org/138381 | 19:18 |
| *** aix has quit IRC | 19:20 | |
| *** ajayaa has quit IRC | 19:30 | |
| *** ajayaa has joined #openstack-keystone | 19:31 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: deprecate audit middleware https://review.openstack.org/138386 | 19:32 |
| *** ajayaa has quit IRC | 19:33 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone-specs: Read/Write LDAP drivers https://review.openstack.org/140175 | 19:34 |
| *** marcoemorais has quit IRC | 19:39 | |
| *** marcoemorais has joined #openstack-keystone | 19:40 | |
| *** marcoemorais has quit IRC | 19:40 | |
| *** marcoemorais has joined #openstack-keystone | 19:41 | |
| *** marcoemorais has quit IRC | 19:41 | |
| *** marcoemorais has joined #openstack-keystone | 19:41 | |
| *** samuelms_ has joined #openstack-keystone | 19:46 | |
| openstackgerrit | Andre Aranha proposed openstack/keystone-specs: Modify the policy file https://review.openstack.org/135408 | 19:51 |
| *** marcoemorais has quit IRC | 19:52 | |
| *** marcoemorais has joined #openstack-keystone | 19:52 | |
| openstackgerrit | David Stanek proposed openstack/keystone-specs: Adds a spec for fixing Keystone's DI https://review.openstack.org/135931 | 19:54 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: WIP - Add openid connect client support https://review.openstack.org/134700 | 19:56 |
| *** ayoung-lunch is now known as ayoung | 20:00 | |
| *** gyee has quit IRC | 20:06 | |
| rodrigods | morganfainberg, ayoung, just created the lib repo (about to send to github), need to ask some questions first | 20:09 |
| *** saipandi has quit IRC | 20:10 | |
| rodrigods | i'm using openstack.common.lockutils instead of oslo.concurrency.lockutils because I didn't find a way to wrap lockutils in tox.ini without being like that: https://review.openstack.org/#/c/64006/2/run_tests.sh | 20:10 |
| rodrigods | besides that, we are using fileutils and _i18n | 20:10 |
| rodrigods | ahh, and log | 20:11 |
| openstackgerrit | Merged openstack/python-keystoneclient: Project ID in OAuth headers was missing https://review.openstack.org/134364 | 20:16 |
| rodrigods | morganfainberg, ayoung, https://github.com/rodrigods/oslo.policy | 20:31 |
| ayoung | rodrigods, ok | 20:32 |
| ayoung | I don't think we want the lockutils thing longterm | 20:32 |
| ayoung | rodrigods, does it do some sort of monkeypatch? | 20:33 |
| rodrigods | ayoung, monkeypatch? | 20:34 |
| ayoung | google it | 20:34 |
| *** marcoemorais has quit IRC | 20:34 | |
| *** marcoemorais has joined #openstack-keystone | 20:34 | |
| *** marcoemorais has quit IRC | 20:35 | |
| rodrigods | ayoung, ahh, AFAIK, it exports some env vars | 20:36 |
| ayoung | that is it? | 20:37 |
| ayoung | Hmmm. | 20:37 |
| *** marcoemorais has joined #openstack-keystone | 20:41 | |
| rodrigods | ayoung, so I guess the other graduation steps are with you and morganfainberg, right? | 20:42 |
| ayoung | rodrigods, yes. | 20:43 |
| ayoung | Thanks for getting that. Still, what do we do inside Keystone? I thought we used concurency there. | 20:43 |
| rodrigods | ayoung, what do you mean by "inside Keystone"? | 20:44 |
| ayoung | server | 20:44 |
| ayoung | we don't have to modify run_tests...we don't even use it | 20:44 |
| rodrigods | ayoung, yeah... good question | 20:45 |
| ayoung | maybe we dont. | 20:45 |
| rodrigods | ayoung, keystone tests don't use lockutils | 20:45 |
| ayoung | yeah, neither does client | 20:46 |
| ayoung | rodrigods, is it used in the library, or just in the tests? | 20:47 |
| rodrigods | ayoung, just in tests | 20:47 |
| ayoung | looking | 20:47 |
| rodrigods | ayoung, there is a comment in the setup() | 20:47 |
| rodrigods | ayoung, https://github.com/rodrigods/oslo.policy/blob/master/oslo_policy/tests/test_policy.py#L121 | 20:47 |
| ayoung | rodrigods, what happens if you remove that line and run the tests? | 20:48 |
| ayoung | https://github.com/rodrigods/oslo.policy/blob/master/oslo_policy/tests/test_policy.py#L123 | 20:48 |
| rodrigods | ayoung, just a sec | 20:48 |
| rodrigods | ayoung, greenbar | 20:49 |
| ayoung | lets leave it off for now. I think the need for it in our tests is questionable | 20:49 |
| ayoung | although, it might be an issue if the tests are run in parallel? I thought the parallel test runner ran in separate processes, though. | 20:50 |
| *** dims has joined #openstack-keystone | 20:51 | |
| rodrigods | ayoung, by default they are run in parallel right? so I guess not (if the tests passed) | 20:51 |
| ayoung | not necessarily. If the tests are run in parallel on a remote machine, but in the same process... | 20:52 |
| ayoung | morganfainberg, dstanek do you know if that is even a real thing? Why would the policy tests need a concurrency lock? | 20:52 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Add domain roles APIs https://review.openstack.org/139531 | 20:55 |
| rodrigods | ayoung, the commit to remove it is ready here :) let's wait to morganfainberg and dstanek feedback | 20:56 |
| *** marcoemorais has quit IRC | 20:57 | |
| ayoung | rodrigods, heh...patience young Padawan | 20:57 |
| rodrigods | heh | 20:58 |
| ekarlso- | https://review.openstack.org/#/c/130159/ < ok to get a +X ayoung ? | 20:58 |
| ayoung | ekarlso-, +X? | 20:58 |
| ekarlso- | +1/2 ;P | 20:58 |
| ayoung | ekarlso-, I'll have to take some time to actually look at it first | 20:59 |
| *** jamielennox|away is now known as jamielennox | 20:59 | |
| ekarlso- | jamielennox: too https://review.openstack.org/#/c/130159/ ;p | 21:00 |
| *** topol has quit IRC | 21:01 | |
| *** dims has quit IRC | 21:03 | |
| *** dims has joined #openstack-keystone | 21:03 | |
| *** harlowja is now known as harlowja_away | 21:04 | |
| dstanek | rodrigods: link? | 21:06 |
| *** dims has quit IRC | 21:08 | |
| *** henrynash has joined #openstack-keystone | 21:11 | |
| *** ChanServ sets mode: +v henrynash | 21:11 | |
| *** harlowja_away is now known as harlowja | 21:12 | |
| *** marcoemorais has joined #openstack-keystone | 21:23 | |
| *** samuelms_ has quit IRC | 21:30 | |
| *** marcoemorais has quit IRC | 21:33 | |
| *** marcoemorais has joined #openstack-keystone | 21:33 | |
| bknudson | morganfainberg: I thought we were like the first group to do osprofiler? | 21:41 |
| morganfainberg | bknudson, we did some of it, there is another patch that adds all of this... or it's not in requirements | 21:41 |
| morganfainberg | or something /me has to look at the history | 21:41 |
| morganfainberg | there is an outstanding patchset on this. | 21:42 |
| bknudson | morganfainberg: yes, it's -W | 21:42 |
| morganfainberg | yep | 21:42 |
| *** samuelms_ has joined #openstack-keystone | 21:46 | |
| jamielennox | hey, i think this one is non-controversial and on the 'needed for release path': https://review.openstack.org/#/c/139512/ | 21:48 |
| rodrigods | dstanek, https://github.com/rodrigods/oslo.policy/blob/master/oslo_policy/tests/test_policy.py#L121 :) | 21:49 |
| rodrigods | henrynash, saw your review, any feedback about the patch status? +2 ready, etc? | 21:49 |
| rodrigods | (after fix your comments) | 21:49 |
| dstanek | morganfainberg: bknudson: is that the one where the middleware was being turned on by default? | 21:50 |
| morganfainberg | dstanek, think so | 21:50 |
| morganfainberg | dstanek, i need to hunt through the history for a definitive answer but fairly certain that was / is the one | 21:50 |
| morganfainberg | my next question is... this is middleware WHY is each project implementing their own option? | 21:51 |
| morganfainberg | but not sure enough that is what this is about to ask | 21:51 |
| bknudson | https://review.openstack.org/#/c/98836/ ? | 21:51 |
| bknudson | Boris has a bunch of reviews in my watch list. | 21:51 |
| morganfainberg | bknudson, hm, i dunno if that's the one | 21:51 |
| morganfainberg | nope that isn't ti | 21:52 |
| bknudson | that's the one I was thinking of because I see it all the time in my list | 21:52 |
| bknudson | morganfainberg: dstanek: https://review.openstack.org/#/c/103368/18/keystone/common/config.py | 21:56 |
| bknudson | it's in merge conflict now | 21:56 |
| bknudson | has [profiler] enabled | 21:57 |
| dstanek | i still think having it on by default is bad - then you don't need to bikeshed the enabled opiton | 21:58 |
| dstanek | that's effectively proposing all possible middleware is configured in paste as on and then control it with enabled flags | 22:00 |
| *** joesavak has quit IRC | 22:00 | |
| bknudson | it's off by default | 22:00 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Honor the inform and outform parameters https://review.openstack.org/127533 | 22:00 |
| bknudson | auth_token middleware can load it's config from the config file so osprofiler could do the same. | 22:01 |
| dstanek | bknudson: only because i had an issue with it being in the pipeline by default, but it seems that other projects have fallen for it | 22:02 |
| *** harlowja has quit IRC | 22:02 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Endpoint_policy support for default https://review.openstack.org/140491 | 22:04 |
| *** zz_avozza is now known as avozza | 22:07 | |
| *** henrynash has quit IRC | 22:24 | |
| *** gordc has quit IRC | 22:36 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use newer requests-mock syntax https://review.openstack.org/135468 | 22:36 |
| *** harlowja has joined #openstack-keystone | 22:37 | |
| openstackgerrit | David Stanek proposed openstack/keystone-specs: Adds a spec for fixing Keystone's DI https://review.openstack.org/135931 | 22:45 |
| *** philloooo has joined #openstack-keystone | 22:49 | |
| marekd | ayoung: so, what was that thing with ipsilon? | 22:49 |
| openstackgerrit | David Stanek proposed openstack/keystone-specs: Adds a spec for fixing Keystone's DI https://review.openstack.org/135931 | 22:51 |
| ayoung | marekd, I'm in Dad mode right now... | 22:53 |
| marekd | ayoung: ah, ok then :-) | 22:54 |
| * marekd transforming into bed-mode. | 22:54 | |
| *** marekd is now known as marekd|away | 22:54 | |
| *** gokrokve has quit IRC | 22:58 | |
| *** gokrokve has joined #openstack-keystone | 22:59 | |
| *** lhcheng has quit IRC | 23:02 | |
| *** lhcheng_ has joined #openstack-keystone | 23:02 | |
| *** bknudson has quit IRC | 23:03 | |
| *** shakamunyi has joined #openstack-keystone | 23:04 | |
| *** nkinder has quit IRC | 23:04 | |
| *** jamielennox is now known as jamielennox|away | 23:05 | |
| *** mikedillion has joined #openstack-keystone | 23:16 | |
| *** mikedillion has quit IRC | 23:23 | |
| *** jamielennox|away is now known as jamielennox | 23:24 | |
| *** mikedillion has joined #openstack-keystone | 23:24 | |
| *** gyee has joined #openstack-keystone | 23:33 | |
| *** ChanServ sets mode: +v gyee | 23:33 | |
| *** prontotest has joined #openstack-keystone | 23:34 | |
| *** prontotest has left #openstack-keystone | 23:34 | |
| *** lhcheng_ has quit IRC | 23:36 | |
| *** lhcheng has joined #openstack-keystone | 23:37 | |
| *** lhcheng_ has joined #openstack-keystone | 23:39 | |
| *** lhcheng_ has quit IRC | 23:39 | |
| *** shakamunyi has quit IRC | 23:39 | |
| *** lhcheng_ has joined #openstack-keystone | 23:40 | |
| *** lhcheng has quit IRC | 23:41 | |
| *** lhcheng has joined #openstack-keystone | 23:42 | |
| *** dims has joined #openstack-keystone | 23:43 | |
| *** lhcheng_ has quit IRC | 23:44 | |
| *** shakamunyi has joined #openstack-keystone | 23:45 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Take plugin params from ENV rather than default https://review.openstack.org/132240 | 23:45 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Extract the Loadable interface from a plugin https://review.openstack.org/138575 | 23:51 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Make session use the Loadable interface https://review.openstack.org/138576 | 23:51 |
| *** raildo_ has joined #openstack-keystone | 23:53 | |
| *** shakamunyi has quit IRC | 23:54 | |
| *** harlowja has quit IRC | 23:56 | |
| *** chrisshattuck has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!