| *** jorge_munoz has quit IRC | 00:00 | |
| *** shakamunyi has joined #openstack-keystone | 00:02 | |
| *** shakamunyi has quit IRC | 00:03 | |
| morganfainberg | dstanek: I want to circle back on the osprofiler issues. Will ping you tomorrow on it. | 00:03 |
|---|---|---|
| jamielennox | can someone kick off https://review.openstack.org/#/c/139512/ - it's an additional test and in queue needed for a middleware release | 00:05 |
| jamielennox | also: https://review.openstack.org/#/c/132652/ | 00:08 |
| jamielennox | ekarlso-: we need that review of yours - i just don't really like the interface and want to know if there is a better way to do it | 00:09 |
| *** samuelms_ has quit IRC | 00:10 | |
| *** david-lyle is now known as david-lyle_afk | 00:11 | |
| *** gokrokve has quit IRC | 00:14 | |
| *** packet has quit IRC | 00:15 | |
| *** gokrokve has joined #openstack-keystone | 00:15 | |
| *** dims has quit IRC | 00:17 | |
| *** dims has joined #openstack-keystone | 00:19 | |
| *** gokrokve has quit IRC | 00:20 | |
| *** philloooo has quit IRC | 00:23 | |
| *** lhcheng_ has joined #openstack-keystone | 00:23 | |
| *** lhcheng has quit IRC | 00:24 | |
| *** _cjones_ has quit IRC | 00:27 | |
| *** dims has quit IRC | 00:30 | |
| *** nkinder has joined #openstack-keystone | 00:43 | |
| *** dims has joined #openstack-keystone | 00:43 | |
| *** dyasny has joined #openstack-keystone | 00:45 | |
| *** jamielennox is now known as jamielennox|away | 00:48 | |
| *** gyee has quit IRC | 00:50 | |
| dyasny | hey all, can anyone help me with a v3 endpoint? I have one working, but it's 2.0, the codebase is supposed to support v3 as well, but I've no idea how to get a v3 auth url to work | 00:51 |
| *** avozza is now known as zz_avozza | 00:56 | |
| *** mikedillion has quit IRC | 01:00 | |
| *** _cjones_ has joined #openstack-keystone | 01:01 | |
| *** mikedillion has joined #openstack-keystone | 01:01 | |
| *** tellesnobrega_ has joined #openstack-keystone | 01:05 | |
| raildo_ | hi dyasny, do you need to enable the v3 configuration to use the API v3. Here there a quickly documentation (this is not the best way but works) explains how you can do this: http://www.symantec.com/connect/blogs/how-switch-keystone-v20-v3 | 01:08 |
| raildo_ | dyasny, so, after that, you can use the Endpints API v3: http://developer.openstack.org/api-ref-identity-v3.html#endpoints-v3 | 01:09 |
| dyasny | raildo_, cool, I have seen that link, but it requires a token, what I have is admin user and password instead | 01:10 |
| *** dims has quit IRC | 01:11 | |
| *** mikedillion has quit IRC | 01:14 | |
| *** xianghui has joined #openstack-keystone | 01:15 | |
| *** zzzeek has quit IRC | 01:16 | |
| *** gokrokve has joined #openstack-keystone | 01:18 | |
| raildo_ | the other way is setting the global variable: =OS_IDENTITY_API_VERSION=v3 (or just 3 i don't remember now) and the OS_AUTH_URL=http://127.0.0.1:35357/v3 | 01:18 |
| raildo_ | dyasny, I think this changes are enough to enable keystone v3. | 01:19 |
| dyasny | raildo_, and I don't need to run keystone endpoint-create for the v3 URL? | 01:20 |
| raildo_ | after that you'll need. This changes is to enable the keystone v3. | 01:20 |
| dyasny | raildo_, ah, ok, so first I enable, then I create | 01:21 |
| raildo_ | dyasny, yes | 01:21 |
| *** afaranha_ has joined #openstack-keystone | 01:21 | |
| dyasny | makes sense :) | 01:21 |
| raildo_ | dyasny, you can use the POST /v3/endpoints with the body http://paste.openstack.org/raw/148284/ | 01:22 |
| dyasny | raildo_, I keep seeing this notation, where do I apply it? | 01:22 |
| * dyasny is a newb at this stuff, can you tell? | 01:23 | |
| raildo_ | hahaha no problem | 01:23 |
| raildo_ | you can use a rest client like postman for the API calls http://www.getpostman.com/ or you can use the keystone client to create a endpoint | 01:24 |
| raildo_ | $ pip install python-keystoneclient | 01:25 |
| raildo_ | :) | 01:25 |
| *** marcoemorais has quit IRC | 01:26 | |
| raildo_ | so you just need to make a source openrc with your user and password, and after that, you can use the keystone client | 01:26 |
| dstanek | @morganfainberg: ok, i'm around now and i'll be around all day tomorrow | 01:28 |
| morganfainberg | i'm avout to head to dinner | 01:28 |
| morganfainberg | i think | 01:28 |
| morganfainberg | so. don't want to need to run middle of the convo | 01:28 |
| morganfainberg | i also might have a fix to help SQL token backend not suck as much until we can ditch it 100% | 01:28 |
| raildo_ | dyasny, you can see more about the keystone client here: http://docs.openstack.org/cli-reference/content/keystoneclient_commands.html | 01:29 |
| dyasny | raildo_ I have keystone client, I think | 01:30 |
| dyasny | at least I can run keystone commands | 01:30 |
| dyasny | problem is, most of them return 404 | 01:30 |
| dyasny | raildo_ the worst part is I get this for admin, but not a simple user | 01:31 |
| *** xianghui has quit IRC | 01:32 | |
| *** xianghui_ has joined #openstack-keystone | 01:32 | |
| raildo_ | dyasny, hum.. that is a little problem here, you need the permission to do this action and in the policy.json, you need to be a admin to create a endpoint: https://github.com/openstack/keystone/blob/master/etc/policy.json#L24 | 01:33 |
| *** xianghui_ is now known as xianghui | 01:33 | |
| dyasny | raildo_, the 404 happens as admin | 01:33 |
| dyasny | I wonder how I can check where the request is going, maybe there's more than one service and one of them is down | 01:34 |
| *** lhcheng_ has quit IRC | 01:34 | |
| raildo_ | but you can get a token for the admin user? | 01:34 |
| *** lhcheng has joined #openstack-keystone | 01:35 | |
| dyasny | raildo_, my rc file only contains username and pass, no tokens in there | 01:35 |
| *** mitz- has quit IRC | 01:39 | |
| *** lhcheng has quit IRC | 01:39 | |
| *** mitz_ has joined #openstack-keystone | 01:41 | |
| raildo_ | dyasny, right, so, you can use this file to get a token to use in keystone. you can run a commend like $ source openrc <user> <password> | 01:41 |
| raildo_ | and after that you can use the keystone in command line | 01:41 |
| raildo_ | or you can export a token like OS_SERVICE_TOKEN=admin | 01:42 |
| raildo_ | :) | 01:42 |
| dyasny | raildo_, http://fpaste.org/158197/18175764/ this is what my openrc file looks like | 01:43 |
| dyasny | for another user I simply change the user, tenant and password lines | 01:43 |
| dyasny | raildo_ could a service-create command pointing to a v3 URL before enabling v3 cause this? | 01:44 |
| raildo_ | no. because the keystone client service-create use the v2.0 =/ | 01:45 |
| raildo_ | I always use the API calls to do this =/ | 01:46 |
| raildo_ | dyasny, you can see how use the keystone v3 API here: http://adam.younglogic.com/2013/09/keystone-v3-api-examples/ | 01:46 |
| raildo_ | that is very simple :) | 01:46 |
| dyasny | raildo_ seems to be quite straightforward | 01:49 |
| raildo_ | dyasny, ++ | 01:50 |
| raildo_ | dyasny, Any questions, you can talk here :) | 01:52 |
| dyasny | raildo_, thanks, let me get into the thingie first :) | 01:52 |
| *** shakamunyi has joined #openstack-keystone | 01:53 | |
| *** oomichi_ has joined #openstack-keystone | 01:57 | |
| *** htruta_ has joined #openstack-keystone | 02:02 | |
| dyasny | raildo_, {"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}} | 02:04 |
| dyasny | after I create the token file and run the curl command | 02:04 |
| raildo_ | dyasny, ok so run the command echo $TOKEN | 02:05 |
| raildo_ | what is the return? | 02:05 |
| dyasny | empty | 02:06 |
| dyasny | tried to port 5000 and 35357 | 02:06 |
| dyasny | raildo_ ^^ | 02:07 |
| raildo_ | so, you don't export the token =/ | 02:07 |
| dyasny | no, only username and password | 02:08 |
| raildo_ | you can try this examples too http://adam.younglogic.com/2013/11/more-keystone-v3-api-examples/ | 02:08 |
| *** harlowja has joined #openstack-keystone | 02:10 | |
| dyasny | raildo_, ok, I got the token, had a typo in the json file initially | 02:13 |
| raildo_ | yeah \o | 02:13 |
| *** erkules_ has joined #openstack-keystone | 02:14 | |
| raildo_ | so, you can use this token, to create a endpoint | 02:14 |
| raildo_ | you just need to create a .json file, with the body http://paste.openstack.org/raw/148284/ | 02:15 |
| *** r-daneel has quit IRC | 02:15 | |
| raildo_ | curl -si -H"X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://localhost:35357/v3/endpoints -d @<file_json_name>.json | 02:16 |
| *** erkules has quit IRC | 02:16 | |
| dyasny | raildo_, it looks, when I enable --debug (good thing I googled that one up, strace is insane) I can see that the initial request goes to the v2.0 portal, but that one returns v3 somewhere down the road, which brings me to a 404. I can pastebin it | 02:22 |
| *** raildo_ has quit IRC | 02:24 | |
| *** henrique has joined #openstack-keystone | 02:26 | |
| *** htruta_ has quit IRC | 02:29 | |
| *** afaranha_ has quit IRC | 02:40 | |
| *** oomichi_ has quit IRC | 02:44 | |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: support micro version if sent https://review.openstack.org/130916 | 02:45 |
| *** henrique has quit IRC | 02:45 | |
| *** _cjones_ has quit IRC | 02:49 | |
| *** _cjones_ has joined #openstack-keystone | 02:50 | |
| *** drjones has joined #openstack-keystone | 02:51 | |
| *** htruta_ has joined #openstack-keystone | 02:51 | |
| *** tellesnobrega_ has quit IRC | 02:51 | |
| *** wanghong has quit IRC | 02:52 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:53 | |
| *** _cjones_ has quit IRC | 02:54 | |
| *** r-daneel has joined #openstack-keystone | 02:56 | |
| *** r-daneel has quit IRC | 03:00 | |
| *** sluo_wfh has joined #openstack-keystone | 03:01 | |
| *** drjones has quit IRC | 03:05 | |
| *** _cjones_ has joined #openstack-keystone | 03:05 | |
| *** chrisshattuck has joined #openstack-keystone | 03:06 | |
| *** wanghong has joined #openstack-keystone | 03:09 | |
| *** harlowja is now known as harlowja_away | 03:12 | |
| *** r-daneel has joined #openstack-keystone | 03:15 | |
| *** chrisshattuck has quit IRC | 03:25 | |
| *** jamielennox|away is now known as jamielennox | 03:26 | |
| *** sluo_wfh is now known as sluo_laptop | 03:26 | |
| *** richm has quit IRC | 03:34 | |
| *** oomichi_ has joined #openstack-keystone | 03:35 | |
| *** htruta_ has quit IRC | 03:42 | |
| *** Shohei has quit IRC | 03:49 | |
| *** Shohei has joined #openstack-keystone | 03:50 | |
| *** r-daneel has quit IRC | 03:50 | |
| *** Shohei_ has joined #openstack-keystone | 03:52 | |
| *** Shohei has quit IRC | 03:54 | |
| *** diegows has quit IRC | 03:59 | |
| dyasny | raildo, still here? | 04:03 |
| *** Shohei_ has quit IRC | 04:33 | |
| *** Shohei has joined #openstack-keystone | 04:34 | |
| *** Shohei has quit IRC | 04:36 | |
| *** Shohei has joined #openstack-keystone | 04:36 | |
| *** Shohei has quit IRC | 04:44 | |
| *** Shohei has joined #openstack-keystone | 04:45 | |
| *** _cjones_ has quit IRC | 04:49 | |
| *** _cjones_ has joined #openstack-keystone | 05:00 | |
| *** _cjones_ has quit IRC | 05:08 | |
| *** tellesnobrega_ has quit IRC | 05:12 | |
| *** _cjones_ has joined #openstack-keystone | 05:13 | |
| *** _cjones_ has quit IRC | 05:14 | |
| *** radez is now known as radez_g0n3 | 05:15 | |
| *** _cjones_ has joined #openstack-keystone | 05:15 | |
| *** lhcheng has joined #openstack-keystone | 05:19 | |
| *** harlowja_away is now known as harlowja | 05:28 | |
| *** harlowja is now known as harlowja_away | 05:29 | |
| *** davechen_ has joined #openstack-keystone | 05:38 | |
| *** KanagarajM has joined #openstack-keystone | 05:46 | |
| *** gokrokve_ has joined #openstack-keystone | 05:53 | |
| *** gokrokve has quit IRC | 05:57 | |
| *** gokrokve_ has quit IRC | 05:58 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:05 |
| *** gyee has joined #openstack-keystone | 06:08 | |
| *** ChanServ sets mode: +v gyee | 06:08 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Expose version matching functions to the public https://review.openstack.org/129935 | 06:15 |
| *** gokrokve has joined #openstack-keystone | 06:23 | |
| *** gokrokve has quit IRC | 06:25 | |
| *** gokrokve has joined #openstack-keystone | 06:25 | |
| *** Shohei has quit IRC | 06:28 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Auth token tests create temp cert directory https://review.openstack.org/122280 | 06:28 |
| *** Shohei has joined #openstack-keystone | 06:29 | |
| *** gokrokve has quit IRC | 06:30 | |
| *** gokrokve has joined #openstack-keystone | 06:32 | |
| *** Shohei has quit IRC | 06:33 | |
| *** gokrokve_ has joined #openstack-keystone | 06:34 | |
| *** Shohei has joined #openstack-keystone | 06:35 | |
| *** gokrokve has quit IRC | 06:36 | |
| *** gokrokve_ has quit IRC | 06:39 | |
| *** oomichi_ has quit IRC | 06:46 | |
| *** lhcheng has quit IRC | 06:47 | |
| *** lhcheng has joined #openstack-keystone | 06:48 | |
| *** henrynash has joined #openstack-keystone | 06:48 | |
| *** ChanServ sets mode: +v henrynash | 06:48 | |
| *** lhcheng has quit IRC | 06:53 | |
| *** ajayaa has joined #openstack-keystone | 06:55 | |
| *** Shohei has quit IRC | 07:07 | |
| *** _cjones_ has quit IRC | 07:13 | |
| *** henrynash has quit IRC | 07:18 | |
| *** henrynash has joined #openstack-keystone | 07:19 | |
| *** ChanServ sets mode: +v henrynash | 07:19 | |
| *** zz_avozza is now known as avozza | 07:24 | |
| *** k4n0 has joined #openstack-keystone | 07:25 | |
| ekarlso- | jamielennox: uhm, ok, so who'll figure out that ? | 07:39 |
| *** nellysmitt has joined #openstack-keystone | 07:55 | |
| *** gyee has quit IRC | 07:58 | |
| *** Shohei has joined #openstack-keystone | 08:00 | |
| *** mzbik has joined #openstack-keystone | 08:02 | |
| *** bdossant_ has joined #openstack-keystone | 08:05 | |
| *** bdossant has quit IRC | 08:09 | |
| *** _cjones_ has joined #openstack-keystone | 08:15 | |
| *** avozza is now known as zz_avozza | 08:16 | |
| *** jistr has joined #openstack-keystone | 08:17 | |
| *** henrynash has quit IRC | 08:17 | |
| *** _cjones_ has quit IRC | 08:20 | |
| *** stevemar has quit IRC | 08:25 | |
| jamielennox | ekarlso-: i'm not sure - this is why it's been left for a while | 08:26 |
| jamielennox | i was talking to gyee about it a bit and we were talking about like allow=(DEPRECATED, UNKNOWN) or something | 08:26 |
| *** oomichi has joined #openstack-keystone | 08:26 | |
| jamielennox | he was suggesting just allowing setting a base endpoint_filiter as a dictionary on the adapter | 08:27 |
| jamielennox | i just don't want to have to keep adding these booleans that represent one thing | 08:28 |
| *** gokrokve has joined #openstack-keystone | 08:32 | |
| *** Shohei has quit IRC | 08:37 | |
| *** gokrokve has quit IRC | 08:37 | |
| *** Shohei has joined #openstack-keystone | 08:37 | |
| ekarlso- | jamielennox: well it'd be awesome if u could look at it | 08:38 |
| *** Shohei has quit IRC | 08:38 | |
| *** Shohei has joined #openstack-keystone | 08:38 | |
| *** zz_avozza is now known as avozza | 08:39 | |
| *** oomichi has quit IRC | 08:40 | |
| *** nellysmitt has quit IRC | 08:41 | |
| *** andreaf has quit IRC | 08:47 | |
| *** andreaf has joined #openstack-keystone | 08:48 | |
| *** marekd|away is now known as marekd | 08:55 | |
| *** yasu_ has joined #openstack-keystone | 09:17 | |
| *** lsmola has quit IRC | 09:18 | |
| *** i159 has joined #openstack-keystone | 09:20 | |
| *** lsmola has joined #openstack-keystone | 09:22 | |
| *** nellysmitt has joined #openstack-keystone | 09:29 | |
| *** gokrokve has joined #openstack-keystone | 09:32 | |
| *** gokrokve has quit IRC | 09:37 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:10 | |
| *** bdossant_ has quit IRC | 10:12 | |
| *** bdossant has joined #openstack-keystone | 10:12 | |
| *** aix has joined #openstack-keystone | 10:14 | |
| *** tellesnobrega_ has quit IRC | 10:23 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:31 | |
| *** gokrokve has joined #openstack-keystone | 10:32 | |
| *** gokrokve has quit IRC | 10:36 | |
| *** lhcheng has joined #openstack-keystone | 10:42 | |
| *** tellesnobrega_ has quit IRC | 10:43 | |
| *** ajayaa has quit IRC | 10:54 | |
| *** ajayaa has joined #openstack-keystone | 10:56 | |
| *** ajayaa has quit IRC | 11:01 | |
| *** NellyK has joined #openstack-keystone | 11:01 | |
| *** NellyK is now known as nellysmi_ | 11:02 | |
| *** nellysmitt has quit IRC | 11:04 | |
| *** ajayaa has joined #openstack-keystone | 11:19 | |
| *** lhcheng has quit IRC | 11:22 | |
| *** lhcheng has joined #openstack-keystone | 11:23 | |
| *** nellysmi_ has quit IRC | 11:25 | |
| *** esco-franc has joined #openstack-keystone | 11:27 | |
| esco-franc | hi people | 11:27 |
| *** lhcheng has quit IRC | 11:27 | |
| esco-franc | i would like to talk about the OTP implementation in keystone... | 11:29 |
| esco-franc | Are there volotaries? | 11:29 |
| *** gokrokve has joined #openstack-keystone | 11:32 | |
| *** gokrokve has quit IRC | 11:37 | |
| *** jamielennox is now known as jamielennox|away | 11:38 | |
| *** nellysmitt has joined #openstack-keystone | 12:04 | |
| *** david-lyle_afk is now known as david-lyle | 12:09 | |
| *** aix has quit IRC | 12:09 | |
| *** ajayaa has quit IRC | 12:10 | |
| *** esco-franc_ has joined #openstack-keystone | 12:12 | |
| *** esco-franc has quit IRC | 12:13 | |
| *** david-lyle is now known as david-lyle_afk | 12:17 | |
| *** david-lyle_afk is now known as david-lyle | 12:17 | |
| *** jistr has quit IRC | 12:20 | |
| *** david-lyle is now known as david-lyle_afk | 12:23 | |
| *** david-lyle_afk is now known as david-lyle | 12:23 | |
| *** jaosorior has joined #openstack-keystone | 12:27 | |
| *** ajayaa has joined #openstack-keystone | 12:28 | |
| *** david-lyle is now known as david-lyle_afk | 12:31 | |
| *** david-lyle_afk is now known as david-lyle | 12:31 | |
| *** gokrokve has joined #openstack-keystone | 12:32 | |
| *** diegows has joined #openstack-keystone | 12:36 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Identify groups by name/domain in mapping rules. https://review.openstack.org/139013 | 12:36 |
| *** gokrokve has quit IRC | 12:37 | |
| marekd | rodrigods: ^^ you were instersted in it as well | 12:38 |
| *** jistr has joined #openstack-keystone | 12:40 | |
| rodrigods | marekd, nice! | 12:40 |
| marekd | feel free to review :-) | 12:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Policy enforcement library https://review.openstack.org/133480 | 12:43 |
| rodrigods | ayoung, ^ we need to discuss the middleware bits, so we can update this spec | 12:44 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Scope federated token with 'token' identity method https://review.openstack.org/130593 | 12:52 |
| marekd | morganfainberg: coul you take a look at this patch ^^ ? | 12:53 |
| *** dyasny has quit IRC | 12:53 | |
| marekd | ayoung: websso + ipsilon. you wanted to talk yesterday | 12:54 |
| samuelms | dolphm, morning .. just saw my patch for refactoring list role assignments got out of the list of blocking reviews for the release | 12:57 |
| samuelms | dolphm, I'll work hard to have everything ready to review again until tomorrow (now considering the inherited roles on projects) | 12:57 |
| samuelms | dolphm, I hope it will still be able to be back on that list and then we have it in k1 (-: | 12:59 |
| *** david-lyle is now known as david-lyle_afk | 13:00 | |
| *** aix has joined #openstack-keystone | 13:04 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Policy enforcement library https://review.openstack.org/133480 | 13:13 |
| dhellmann | rodrigods, ayoung : oslo.concurrency installs a command line app called 'lockutils-wrapper' for use in tox.ini | 13:18 |
| *** amakarov_away is now known as amakarov | 13:18 | |
| rodrigods | dhellmann, hmm, thanks! Will update the code base, we also need to figure out if lockutils is *really* needed | 13:22 |
| *** yasu_ has quit IRC | 13:31 | |
| *** gokrokve has joined #openstack-keystone | 13:32 | |
| ayoung | dhellmann, thanks. What's it do? | 13:33 |
| ayoung | marekd, OK, lets start with that. | 13:34 |
| ayoung | rodrigods, stay tuned! | 13:34 |
| *** richm has joined #openstack-keystone | 13:34 | |
| *** diegows has quit IRC | 13:36 | |
| ayoung | marekd, so here is the link to Ipsilon https://git.fedorahosted.org/cgit/ipsilon.git/tree/README | 13:36 |
| *** gokrokve has quit IRC | 13:37 | |
| ayoung | marekd, think of Ipsilon as an analogue to ADFS for *nix Systems | 13:37 |
| dhellmann | ayoung: it takes the place of the old "python -m" hack to set OSLO_LOCK_PATH for you | 13:41 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Memcache connection pool excess check https://review.openstack.org/140681 | 13:42 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Memcache connection pool excess check https://review.openstack.org/140681 | 13:44 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 13:47 |
| *** esco-franc_ has quit IRC | 13:48 | |
| ajayaa | Hi guys. Would keystone devs be okay with a NOSQL backend for keystone? We have started with the easiest one, token backend. Hopefully we would be able to migrate other backends as well. I just wanted to know people's opinion on this thing before we have invested too much in this. :) | 13:51 |
| ajayaa | ayoung, dstanek, dolphm ^^ | 13:52 |
| *** rushiagr has joined #openstack-keystone | 13:53 | |
| *** stevemar has joined #openstack-keystone | 13:54 | |
| *** ChanServ sets mode: +v stevemar | 13:54 | |
| stevemar | marekd, ping | 13:54 |
| marekd | hey | 14:01 |
| marekd | what's up? | 14:01 |
| ayoung | ajayaa, don't do it! | 14:06 |
| ayoung | We are trying to drop the Token backend | 14:07 |
| ayoung | and the other backends need transactions | 14:07 |
| ayoung | marekd, hey, I got dibs..I not only contacted you first, I didn't send a naked ping like stevemar did. | 14:07 |
| marekd | ayoung: hey. I think we can talk in parallel, just no more than 5 topic at the same time in a group of three.... | 14:08 |
| marekd | ayoung: actually..sorry...i didn't read up and didn't notice your msgs ;/ | 14:09 |
| marekd | ayoung: ok, so let's suppose Ipsilon is like ADFS. To me it's like a standarlone service that can act as a legitimate SAML2 IdP. | 14:09 |
| ayoung | 'Salright | 14:09 |
| marekd | ayoung: you said ipsion will have discovery page | 14:10 |
| marekd | great | 14:10 |
| ayoung | marekd, so I want the discovery page to live in Ipsilon. Question then is how to sync the list of IdpS | 14:10 |
| marekd | ayoung: i'd handle this in ipsilon. | 14:10 |
| marekd | and again, stay away with that from Keystone. | 14:11 |
| marekd | leave discovery to services like ADFS or ipsilon. | 14:11 |
| *** rushiagr is now known as rushiagr_away | 14:11 | |
| marekd | keystone is only a service provider here, nothing else. | 14:11 |
| *** nkinder has quit IRC | 14:13 | |
| amakarov | ajayaa, there is an effort to make policies manageable, I'd suggest you look there. You may propose your storage for policies since there is none now :) | 14:15 |
| amakarov | ajayaa, btw, this is not mongodb, i hope? | 14:16 |
| ajayaa | amakarov, nope. | 14:17 |
| *** KanagarajM has quit IRC | 14:17 | |
| ajayaa | amakarov, cassandra or a a generic api layer on top of it. | 14:17 |
| ajayaa | The transactional requirements can be avoided by schema design, I suppose. I can't say with 100% surety unless I take each backend case by case and analyse. | 14:18 |
| ajayaa | ayoung ^ | 14:19 |
| ajayaa | btw, the token backend being removed thing, is it a part of making tokens ephemeral? | 14:20 |
| amakarov | ajayaa, hmm... Isn't it an overkill? And Cassandra, AFAIK, tends to be an SQL backend :) It has it's API, but as I recall, they shifted to recommend using SQL interface | 14:21 |
| *** joesavak has joined #openstack-keystone | 14:21 | |
| amakarov | ajayaa, do you have actual performance problem with existing backends to introduce a new one? | 14:22 |
| ajayaa | amakarov, for small deployments it seems an overkill. But failure scenarios and things like geo-replication are better handled by cassandra. | 14:22 |
| *** bknudson has joined #openstack-keystone | 14:23 | |
| *** ChanServ sets mode: +v bknudson | 14:23 | |
| amakarov | ajayaa, can you give us a link to BP? | 14:23 |
| ajayaa | amakarov, No bp yet. Just floating the idea and measuring the reaction to it. :) | 14:24 |
| amakarov | ajayaa, I think it needs discussion. Anyway, bp has it's advantages - at list your idea become somewhat more persistent :) | 14:25 |
| ajayaa | amakarov, Yes. I would go ahead and try to put as much detail I can think of. :) | 14:26 |
| amakarov | ajayaa, for example, I wand to use Redis: https://blueprints.launchpad.net/keystone/+spec/redis-storage-backend | 14:26 |
| amakarov | ajayaa, I don't have enough time for now to implement, but it is something I may show my colleagues | 14:27 |
| *** mzbik has quit IRC | 14:27 | |
| ajayaa | amakarov, that's cool. | 14:28 |
| *** gokrokve has joined #openstack-keystone | 14:32 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Identify groups by name/domain in mapping rules. https://review.openstack.org/139013 | 14:34 |
| *** gokrokve has quit IRC | 14:37 | |
| marekd | rodrigods: thanks for review :-) | 14:38 |
| ayoung | ajayaa, We are currently splitting up the assignment backend. I'd probably recommend starting there. | 14:39 |
| ayoung | Projects and domain probably make sense for NosQL...so long as the revocation events are transactional | 14:39 |
| *** dims has joined #openstack-keystone | 14:39 | |
| *** darren-wang has quit IRC | 14:41 | |
| ajayaa | ayoung, Thanks for the suggestion. BTW, regarding the token backend, I thought UUID tokens are not going away very soon and if UUID token is used then we would need a table to keep track of user and project and role associated with that token. | 14:41 |
| ajayaa | and PKI tokens are too large to fit into http headers where you have large catalogs. | 14:43 |
| *** radez_g0n3 is now known as radez | 14:44 | |
| ayoung | ajayaa, well, there is already Dogpile support for multiple Key Value store backends. A Cassandra one would not be too hard to add. | 14:46 |
| ayoung | Just, I'd rather people spent effort on strategic changes as opposed to bandaids for things we are looking to fix anyway | 14:46 |
| ayoung | there really is no good reason to persist tokens | 14:47 |
| ajayaa | ayoung, correct. So the tokens backend is going to use dogpile apis which in turn could use any backend? | 14:47 |
| ayoung | rodrigods, looking at the policy file now | 14:47 |
| ayoung | One issue is that domain scoped tokens are strange | 14:48 |
| *** rushiagr_away is now known as rushiagr | 14:48 | |
| openstackgerrit | Mehdi Abaakouk proposed openstack/keystone-specs: tokens swift persistent backend https://review.openstack.org/131515 | 14:48 |
| ayoung | ideally, everything would be the same scope. For example, if I were to say "role:admin and domain_id:%(domain_id)s" that is actually an error | 14:48 |
| ayoung | because a project scoped token will match that | 14:49 |
| ayoung | thus, we need a test that a token is domain scoped | 14:49 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Inherited role assignments to projects https://review.openstack.org/138552 | 14:53 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix inherited user role test docstring https://review.openstack.org/140705 | 14:53 |
| rodrigods | ayoung, which one? | 14:53 |
| ayoung | rodrigods, for example, all of the user operations that require domain scoped token should have: | 14:53 |
| ayoung | :"scope:domain" in their rules (I think) testing now | 14:54 |
| rodrigods | ayoung, that's true | 14:55 |
| rodrigods | never noticed that problem | 14:55 |
| rodrigods | samuelms, afaranha ^ | 14:55 |
| samuelms | ayoung, nice catch... check for scope is really the right thing to do | 14:58 |
| ayoung | samuelms, for now...I'm actually trying to do away with the distinction between projects and domains | 14:58 |
| samuelms | ayoung, please gimme a ping (not naked btw) to say if it worked :p | 14:58 |
| ayoung | and move to a domain Is-A project, just a special onw | 14:59 |
| ayoung | one | 14:59 |
| *** nkinder has joined #openstack-keystone | 15:00 | |
| samuelms | ayoung, gotta have lunch.. back soon | 15:02 |
| *** samuelms is now known as samuelms-away | 15:02 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Memcache connection pool excess check https://review.openstack.org/140681 | 15:04 |
| *** dims has quit IRC | 15:05 | |
| *** dims has joined #openstack-keystone | 15:05 | |
| *** topol has joined #openstack-keystone | 15:09 | |
| *** ChanServ sets mode: +v topol | 15:09 | |
| *** dims has quit IRC | 15:10 | |
| *** ajayaa has quit IRC | 15:11 | |
| marekd | stevemar: do we need urls in regions for something else than K2K ? | 15:12 |
| marekd | stevemar: oh, and wantem me to ping you when it's ready: https://review.openstack.org/#/c/139013 | 15:13 |
| *** r-daneel has joined #openstack-keystone | 15:24 | |
| vsilva | hey marekd, how can we help you with the mapping enhancements? | 15:27 |
| vsilva | or better put, do you want any help? | 15:27 |
| *** gokrokve has joined #openstack-keystone | 15:30 | |
| *** gordc has joined #openstack-keystone | 15:35 | |
| *** philloooo has joined #openstack-keystone | 15:43 | |
| philloooo | Hey I am not sure if it's a good place to ask problems about federated keystone... I setup keystone with federation in devstack, and was able to generate scoped token for federated user. But It seems the federated token can not be used as a normal scoped token? | 15:43 |
| *** dyasny has joined #openstack-keystone | 15:44 | |
| philloooo | The token can be validated via keystone api, but I can't use the token to construct a session object in keystoneclient, report "user not found error". If it's not a good place to ask, please point me to the right place... | 15:46 |
| rodrigods | one line fix (noticed while writing inherited roles to project tests): https://review.openstack.org/#/c/140705/1/keystone/tests/test_backend.py | 15:47 |
| rodrigods | ayoung, morganfainberg ^ | 15:47 |
| *** dyasny has quit IRC | 15:50 | |
| morganfainberg | morning | 15:50 |
| rodrigods | morganfainberg, morning :) need your feedback in the oslo.policy codebase, whenever you have a moment | 15:52 |
| morganfainberg | yeah | 15:52 |
| ayoung | rodrigods, if you need a comment to explain what a test is about, you really should rename the test | 15:54 |
| rodrigods | ayoung, I think the intention of the docstring is to give a testplan, and since we have a pattern to be followed, that's why this first line is there | 15:56 |
| ayoung | rodrigods, yeah...the name 'grants' is what caught my attention | 15:56 |
| ayoung | I think we should not be calling things grants anymore | 15:56 |
| ayoung | they are role assignments. | 15:56 |
| rodrigods | ayoung, true... | 15:58 |
| marekd | vsilva: hey, so first of all first part is implemented here https://review.openstack.org/#/c/139013 | 15:58 |
| marekd | please review, and put lots of +1s so cores have easier job :-) | 15:58 |
| openstackgerrit | ayoung proposed openstack/keystone: Identify groups by name/domain in mapping rules. https://review.openstack.org/139013 | 15:58 |
| vsilva | yeah, I saw that marekd | 15:59 |
| vsilva | what then? :) | 15:59 |
| marekd | vsilva: so, please review :-) | 16:00 |
| marekd | vsilva: there is one last point not yet touched | 16:00 |
| marekd | ah, no. | 16:01 |
| marekd | sorry | 16:01 |
| marekd | two work items | 16:01 |
| marekd | implementation of whitelisting/blacklisting | 16:01 |
| marekd | and 'groups' keywork | 16:01 |
| marekd | and 'groups' keyword | 16:01 |
| ayoung | marekd, I gave you aplaceholder BP for that one: https://blueprints.launchpad.net/keystone/+spec/mapping-enhancements but I can't find the actual spec | 16:01 |
| ayoung | link? | 16:01 |
| marekd | https://review.openstack.org/#/c/138035/14/specs/kilo/mapping-enhancements.rst | 16:02 |
| rodrigods | ayoung, since I got your attention here, can you elaborate about the middleware part in https://review.openstack.org/#/c/133480 ? | 16:02 |
| *** dyasny has joined #openstack-keystone | 16:03 | |
| ayoung | rodrigods,yeah. OK, look at the code that is in Keystone and in Nova beyond just the straight policy.py file. There is stuff for pulling the contexts together before passing to Policy. That is the stuff I was origianlly thinking about. | 16:03 |
| ayoung | in keytstone, rules.py | 16:03 |
| afaranha | ayoung, the difference between projects and domain is that a project admin cannot create/list/delete projects, neither CRUD of users | 16:03 |
| vsilva | cool marekd. By 'what then' I meant what else other than reviewing the first part? It looks like it's already going pretty well | 16:04 |
| ayoung | rodrigods, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/policy/backends/rules.py | 16:05 |
| marekd | vsilva: so i mentioned that there are two work items not touched yet. | 16:05 |
| ayoung | afaranha, one sec...I'll address that after helping rodrigods | 16:05 |
| rodrigods | ayoung, thought this part was in the controller | 16:05 |
| marekd | vsilva: you can implement one and i may take another. | 16:05 |
| rodrigods | the decorator controller | 16:05 |
| ayoung | rodrigods, also http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/authorization.py | 16:05 |
| ayoung | rodrigods, and | 16:05 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n54 | 16:06 |
| ayoung | rodrigods, then, if you look at what nova does: | 16:06 |
| marekd | vsilva: there is whitelist/blacklist impl and later 'groups' keyword. | 16:06 |
| vsilva | sweet marekd, toss me whichever one you don't pick | 16:06 |
| ayoung | http://git.openstack.org/cgit/openstack/nova/tree/nova/policy.py | 16:06 |
| ayoung | we need to drop "is_admin" | 16:07 |
| marekd | vsilva: how about you make white/blacklisting ? and I will toss anoher patch on top of yours? | 16:08 |
| marekd | vsilva: fine for you? | 16:08 |
| vsilva | that sounds good marekd | 16:09 |
| rodrigods | ayoung, so nova doesn't build a auth_context like Keystone, just uses the credentials dict | 16:09 |
| marekd | great | 16:09 |
| ayoung | rodrigods, and that credentials dict is built in middleware | 16:09 |
| rodrigods | ayoung, hmm | 16:10 |
| rodrigods | ayoung, so for the first version (without caches) we'd remove this logic from middleware? | 16:10 |
| *** jistr has quit IRC | 16:10 | |
| ayoung | rodrigods, no...I think we also need the caches up front | 16:11 |
| ayoung | middleware can still build the context | 16:11 |
| rodrigods | ayoung, the idea is to make a really generic context? | 16:11 |
| ayoung | meaning? | 16:11 |
| rodrigods | ayoung, a context that could be used directly by Keystone/Nova/Glance, without the need of http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/authorization.py | 16:12 |
| rodrigods | could be used directly by Keystoneclient, to pass it to the policy lib, I mean | 16:12 |
| rodrigods | and could work for everyone | 16:12 |
| ayoung | rodrigods, so, yeah, that is what I was targetting. I also want the same context to be usable for revocation events. | 16:13 |
| openstackgerrit | Andre Aranha proposed openstack/keystone: Modify the policy v3 sample https://review.openstack.org/123509 | 16:13 |
| ayoung | That is what I have in the WIP patch: https://review.openstack.org/#/c/138519/ | 16:13 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 16:14 |
| morganfainberg | rodrigods, did you follow the steps in the graduation document? | 16:14 |
| morganfainberg | rodrigods, also, what is the git repo? | 16:14 |
| morganfainberg | git/github | 16:14 |
| ayoung | lets see if a rebase makes it through the neutron tests | 16:14 |
| rodrigods | morganfainberg, yes... https://github.com/rodrigods/oslo.policy me and ayoung were wondering if could remove the dependency from lockutils | 16:15 |
| svasheka | hi, is there a way to create trust using python keystone client? | 16:15 |
| morganfainberg | hm. | 16:15 |
| rodrigods | morganfainberg, it's used here: https://github.com/rodrigods/oslo.policy/blob/master/oslo_policy/tests/test_policy.py#L121 | 16:16 |
| ayoung | rodrigods, BTW, did you see dhellmann 's post earlier about the cli for concurrency? | 16:16 |
| rodrigods | ayoung, yes :) | 16:16 |
| ayoung | "rodrigods, ayoung : oslo.concurrency installs a command line app called 'lockutils-wrapper' for use in tox.ini" | 16:16 |
| morganfainberg | rodrigods, then no. since it's in the test. | 16:16 |
| ayoung | svasheka, yes | 16:16 |
| morganfainberg | rodrigods, removing that dependency has to be done post import into gerrit | 16:16 |
| morganfainberg | rodrigods, so it goes under normal review | 16:16 |
| rodrigods | morganfainberg, hmm ok | 16:17 |
| rodrigods | morganfainberg, but I can use the libs instead of incubated code, right? | 16:17 |
| openstackgerrit | David Stanek proposed openstack/keystone-specs: Adds a spec for fixing Keystone's DI https://review.openstack.org/135931 | 16:17 |
| morganfainberg | rodrigods, i would graduate it as-is then convert to the lib under gerrit | 16:17 |
| morganfainberg | rodrigods, *or* convert to the lib before graduation | 16:17 |
| morganfainberg | the change needs to go through gerrit imo | 16:17 |
| morganfainberg | dstanek, nice ^! | 16:18 |
| dstanek | morganfainberg: if people would stop finding things wrong with it, it would be done :-) | 16:18 |
| morganfainberg | hwhw | 16:19 |
| morganfainberg | hehe* | 16:19 |
| rodrigods | morganfainberg, great, will have another look in it and I think it is free for you and ayoung perform the other steps | 16:19 |
| morganfainberg | rodrigods, great. | 16:19 |
| ayoung | svasheka, I'm working on some client examples. By Client, I mean python code, mind you, not CLI | 16:19 |
| rodrigods | ayoung, thanks for the middleware explanation, will try to address dstanek comments in the spec and ping you if I need help | 16:20 |
| *** samuelms-away is now known as samuelms | 16:20 | |
| ayoung | rodrigods, ++ | 16:20 |
| *** timcline has joined #openstack-keystone | 16:21 | |
| *** ajayaa has joined #openstack-keystone | 16:22 | |
| *** gokrokve has quit IRC | 16:23 | |
| rodrigods | morganfainberg, so I think it's ready for the oslo folks take a look :) | 16:24 |
| dstanek | rodrigods: is that for the policy spec? | 16:25 |
| rodrigods | dstanek, the github repo? | 16:26 |
| dstanek | rodrigods: ah, the comment you linked to yesterday | 16:26 |
| dstanek | rodrigods: are you thinking about removing the lock? | 16:27 |
| rodrigods | dstanek, yes... we couldn't figure out if it is really needed | 16:27 |
| rodrigods | but I guess we will propose via regular gerrit review once the lib graduates | 16:27 |
| dstanek | rodrigods: i can look right now and see if i can tell - do you have that link handy? | 16:27 |
| rodrigods | dstanek, https://github.com/rodrigods/oslo.policy/blob/master/oslo_policy/tests/test_policy.py#L121 | 16:28 |
| rodrigods | dstanek, but morganfainberg suggested we proceed like I described above | 16:28 |
| *** mikedillion has joined #openstack-keystone | 16:29 | |
| morganfainberg | dstanek, we either need to make change prior to move to it's own repo or post, we probably shouldn't do it as part of the "move to it's own repo" if it works as is | 16:29 |
| *** baker_ has joined #openstack-keystone | 16:30 | |
| *** gokrokve has joined #openstack-keystone | 16:30 | |
| dstanek | morganfainberg: yes, i totally agree - i would probably wait until after the move to make it cleaner/quicker | 16:31 |
| *** dims has joined #openstack-keystone | 16:32 | |
| *** jaosorior has quit IRC | 16:33 | |
| *** baker_ has quit IRC | 16:33 | |
| *** baker__ has joined #openstack-keystone | 16:33 | |
| *** zzzeek has joined #openstack-keystone | 16:35 | |
| *** dims has quit IRC | 16:36 | |
| *** dims has joined #openstack-keystone | 16:36 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 16:37 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor identity version handling to strategy pattern https://review.openstack.org/140765 | 16:37 |
| samuelms | morganfainberg, did you see the spec for use Swift as kvs storage for tokens in Keystone ? | 16:38 |
| morganfainberg | samuelms, i don't know what the advantage to that would be | 16:38 |
| morganfainberg | that sounds like a lot of overhead to store tokens | 16:38 |
| morganfainberg | i don't know if i saw an actual spec for it though | 16:38 |
| samuelms | morganfainberg, yep .. in addition, I'm concerned about the increase of network traffic | 16:38 |
| morganfainberg | samuelms, yeah. | 16:39 |
| samuelms | morganfainberg, https://review.openstack.org/#/c/131515/5/specs/kilo/tokens-swift-backend.rst | 16:39 |
| morganfainberg | because you also need a token to get a ... token if swift is configured poorly | 16:39 |
| samuelms | morganfainberg, please see my comment at line 60 | 16:39 |
| samuelms | morganfainberg, well, take your time .. you may be busy right now | 16:40 |
| morganfainberg | samuelms, i'm actually working on a fix *right now* to handle token bloat with some advanced sql work | 16:40 |
| morganfainberg | something we should have done before - as a stopgap and if we move to revocation events (we need to get that done *hint ayoung*) we can fix an issue that makes the token table really hard to work with | 16:41 |
| dstanek | samuelms: you are close on the lazy loading idea | 16:42 |
| morganfainberg | in-fact if we didn't have to update the rows for deletion [easier with rev. events] we *could* move that table back to MyISAM and eliminate overhead/locking problems (no gap-lock) for deletes, since append to MyISAM doesn't readlock. | 16:42 |
| dstanek | samuelms: in what i am proposing all for deps would need to be provided to the object's __init__. they could be real instances or possibly fakes | 16:42 |
| morganfainberg | doesn't solve the Postgres case(s), but we can't solve this issue db-agnostic | 16:42 |
| samuelms | morganfainberg, nice, do you have already submitted any patch? | 16:44 |
| samuelms | morganfainberg, would like to take a look at =B | 16:44 |
| *** mikedillion has quit IRC | 16:44 | |
| samuelms | dstanek, cool | 16:45 |
| *** shakamunyi has quit IRC | 16:45 | |
| samuelms | dstanek, for tests, we reload api's, etc for each test? | 16:45 |
| samuelms | dstanek, or we do that for each test class? | 16:46 |
| *** ctracey has quit IRC | 16:46 | |
| *** zhiyan has quit IRC | 16:46 | |
| dstanek | samuelms: we would just be creating instances in the setUp - just like we do now | 16:46 |
| *** serverascode___ has quit IRC | 16:47 | |
| dstanek | samuelms: but you'll see Object(Dep1(), Dep2()) instead of clearing out the DI cache and getting new instance automagically | 16:47 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 16:47 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor identity version handling to strategy pattern https://review.openstack.org/140765 | 16:47 |
| *** jraim has quit IRC | 16:48 | |
| *** _cjones_ has joined #openstack-keystone | 16:50 | |
| *** _cjones_ has quit IRC | 16:50 | |
| samuelms | dstanek, got that. but we pass Object(Dep1(), Dep2()) or something like Object('dep1', 'dep') and then Object class would call a kind of 'object dependency manager' to instantiate them: | 16:50 |
| dstanek | rodrigods: i'm not sure why that would be needed; if we run tests in parallel they are using different objects anyway | 16:50 |
| *** _cjones_ has joined #openstack-keystone | 16:50 | |
| samuelms | dstanek, ? | 16:50 |
| samuelms | dstanek, that's a question :p | 16:50 |
| morganfainberg | samuelms, no code yet, i'm testing this out | 16:51 |
| morganfainberg | samuelms, making sure it will work | 16:51 |
| dstanek | samuelms: no, Object would just get the instances; the pattern of DI separates the construction of an object graph from the object graph itself | 16:51 |
| rodrigods | dstanek, yeah, and they pass (greenbar) | 16:51 |
| samuelms | morganfainberg, ok :) | 16:51 |
| samuelms | morganfainberg, feel free to ping me once you post any code | 16:52 |
| morganfainberg | samuelms, absolutely, it is (initially) going to be mysql specific | 16:52 |
| morganfainberg | and sqlite will *never* see this solved. | 16:52 |
| morganfainberg | cause i just don't care enough to try and do this for sqlite | 16:52 |
| samuelms | morganfainberg, haha ++ | 16:52 |
| dstanek | samuelms: the new objects are essentially like this: http://paste.openstack.org/show/129171/ | 16:53 |
| dstanek | samuelms: they don't know how their dependencies are created | 16:53 |
| openstackgerrit | ZhiQiang Fan proposed openstack/python-keystoneclient: Enable hacking rule F821 https://review.openstack.org/134096 | 16:53 |
| samuelms | dstanek, yeah, I got that bit ... what I was thinking was if we had instances created for each test, we could have: def __init__(self, credential_api, identity_api, revoke_api=None, ***LAZY=False***): | 16:54 |
| dstanek | samuelms: the creation is handled in what i was calling an uber factory http://paste.openstack.org/show/129179/ | 16:54 |
| *** remix_tj has joined #openstack-keystone | 16:54 | |
| samuelms | dstanek, and if Object called 'object dependency manager' to instantiate, we just need to lazy evaluate, and then just load credential_api if the test uses it | 16:54 |
| samuelms | dstanek, but I got your idea, looks great | 16:55 |
| samuelms | dstanek, great, so that you can even define at the 'uber factory' if the api's will be singletons or not, etc. | 16:56 |
| samuelms | dstanek, and anyone who needs an api, request it to that factory | 16:56 |
| samuelms | dstanek, right? | 16:56 |
| dstanek | samuelms: exactly - all the objects know is that they are constructed with the right things | 16:57 |
| samuelms | dstanek, perfect ++ | 16:57 |
| samuelms | dstanek, looking forward to see the patch | 16:57 |
| dstanek | samuelms: our tests would essentially acts as factories creating object, fakes and mocks; and then glue them together to do interesting things | 16:57 |
| samuelms | dstanek, ++ | 16:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/134794 | 17:03 |
| *** jsavak has joined #openstack-keystone | 17:04 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: sync oslo https://review.openstack.org/138381 | 17:05 |
| *** i159 has quit IRC | 17:05 | |
| david-lyle_afk | ayoung, morganfainberg, if you get a chance will you take a look at this https://review.openstack.org/#/c/136980/ It's a proposal by cinder toward an API to provide list of actions the user can perform | 17:05 |
| *** joesavak has quit IRC | 17:05 | |
| *** david-lyle_afk is now known as david-lyle | 17:06 | |
| * david-lyle guess I'm here now | 17:06 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change tenant to project https://review.openstack.org/127066 | 17:06 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change admin user to service user. https://review.openstack.org/127075 | 17:06 |
| *** baker__ has quit IRC | 17:08 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change admin user to service user. https://review.openstack.org/127075 | 17:09 |
| remix_tj | Hello, i'm planning a multi region setup of openstack swift with keystone auth. I'm looking for infos about the setup of keystone: can i have a redundant keystone setup on every region or i can have only one active server? | 17:11 |
| *** k4n0 has quit IRC | 17:12 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: deprecate audit middleware https://review.openstack.org/138386 | 17:13 |
| ayoung | david-lyle, so...sort of | 17:13 |
| ayoung | david-lyle, https://adam.younglogic.com/2014/11/dynamic-policy-in-keystone/ is my attempt to lay out the steps to get there. It should not be cinder specific | 17:14 |
| *** joesavak has joined #openstack-keystone | 17:15 | |
| *** browne has joined #openstack-keystone | 17:15 | |
| david-lyle | ayoung: so a grander vision | 17:16 |
| david-lyle | :) | 17:16 |
| ayoung | david-lyle, driven by a conversation long ago with a Horizon dev.... | 17:16 |
| ayoung | Who was asking exactly the same question. | 17:16 |
| ayoung | I think that conversation was in Portland | 17:17 |
| *** jsavak has quit IRC | 17:18 | |
| david-lyle | I think we've had this conversation off and on for a couple years now :) | 17:18 |
| david-lyle | I'd love to see this happen | 17:18 |
| david-lyle | and I really don't want to see each project do it individually, we'll arrive at chaos | 17:19 |
| david-lyle | this is a TC or at least larger cross-project related question/decision | 17:19 |
| david-lyle | more likely the cross-project, the TC doesn't seem to take on these types of discussions | 17:21 |
| raildo | morganfainberg, do you have some free time to review the HMT specs? :) | 17:24 |
| *** zzzeek has quit IRC | 17:25 | |
| *** nellysmitt has quit IRC | 17:25 | |
| *** zzzeek has joined #openstack-keystone | 17:25 | |
| ayoung | samuelms, OK, so it looks like Keystone does not preserve the "scope" value when creating the context | 17:27 |
| morganfainberg | populating a table with 5MM rows is a slow process... | 17:27 |
| morganfainberg | a test table that is. | 17:27 |
| *** marcoemorais has joined #openstack-keystone | 17:28 | |
| rodrigods | ayoung, question: I understood the context passed to the enforcer should be as generic as possible, but since Keystone Server doesn't use the middleware, this https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py will remain the same? | 17:33 |
| ayoung | rodrigods, sort of | 17:33 |
| ayoung | rodrigods, I want to replace it with this: | 17:33 |
| *** browne has quit IRC | 17:33 | |
| ayoung | https://review.openstack.org/#/c/138519/ rodrigods | 17:33 |
| ayoung | rodrigods, which is very much keystone specific, which is why I was origianlly thinking that policy enforcement needed to be in keystoneclient | 17:34 |
| ayoung | and this stuff is hard and lots of details which is why you seem to get a different answer from me every time you ask a question. Sorry about that. | 17:35 |
| rodrigods | ayoung, heh | 17:36 |
| *** avozza is now known as zz_avozza | 17:36 | |
| rodrigods | ayoung, ok... makes sense to me | 17:36 |
| rodrigods | but I'm still in the direction of the enforcement being in Keystonecleint | 17:36 |
| ayoung | rodrigods, let me try to lay it out step by step | 17:36 |
| ayoung | one, a user gets a token and calls an API on some remote service endpoint. Let's say Glance for example | 17:37 |
| ayoung | keystonemiddleware.auth_token.Auth is responsible for unpacking the token and putting it in the request object somehow | 17:37 |
| ayoung | that middleware does not check policy | 17:38 |
| ayoung | because most of the APIs need to fetch and object from their datastore first, and see if the user has access to that object | 17:38 |
| ayoung | so, lets say that the API is to write a new image into a project. In this case, the Glance server would want to run the policy check to determine if the user has write access to that project | 17:39 |
| ayoung | actually, in that case, everything is specified in the API...bad example | 17:40 |
| ayoung | but most glance APIs are that simple...I think that glance objects tend to be immutable. | 17:40 |
| *** gokrokve has quit IRC | 17:40 | |
| rodrigods | ayoung, ok, anything that needs "target..." | 17:40 |
| ayoung | Let's change the example a bit: swift | 17:40 |
| ayoung | a user wants to modify an object stored in a swift container | 17:40 |
| ayoung | so first swift needs to fetch the record for that object from its store and check policy against that record | 17:41 |
| *** jraim has joined #openstack-keystone | 17:41 | |
| * ayoung acknowledges that it is hard to come up with a proper example here | 17:41 | |
| ayoung | so, yeah, target | 17:41 |
| *** philloooo has quit IRC | 17:42 | |
| ayoung | what we want is for the services to be able to call: | 17:42 |
| ayoung | enforce_policy(api_name, auth_context_from_auth_token_middleware, target_from_persisted_store) | 17:42 |
| ayoung | OK, so the enforce_policy call is going to be passed through to oslo.policy, but then there is caching, so... | 17:43 |
| ayoung | policy.enforce_policy needs to get the right set of rules | 17:43 |
| ayoung | lets assume that this is the first call on this server. | 17:44 |
| ayoung | so there is no cache object to start | 17:44 |
| rodrigods | ayoung, hmm this looks like exactly how I was thinking... but I think we need to know about the future plans to have a cache, but not implement it right now | 17:44 |
| ayoung | policy.enforce_policy then needs to create a cache object | 17:44 |
| ayoung | well., we have an ENFORCER object right now | 17:44 |
| ayoung | I think that can morph into the cache | 17:45 |
| rodrigods | ayoung, the enforcer can store the cache, all in Keystoneclient | 17:45 |
| ayoung | So the enforcer needs a backing store, and the policy.py file assumes it is in the local filesystem, I think | 17:45 |
| rodrigods | just remembered about the cache need in middleware | 17:45 |
| *** aix has quit IRC | 17:45 | |
| morganfainberg | ayoung, what is the cache object? | 17:45 |
| morganfainberg | ayoung, as in what are you planning on caching? | 17:46 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/openstack/common/policy.py#n200 | 17:46 |
| *** gyee has joined #openstack-keystone | 17:46 | |
| *** ChanServ sets mode: +v gyee | 17:46 | |
| ayoung | morganfainberg, the cache object is to abstract away the remote call to fetch the policy file from keystone server | 17:46 |
| * notmyname just logged in and sees you're talking about swift | 17:47 | |
| ayoung | morganfainberg, right now, policy.py assumes that it is getting its rules from a file in the file system, and that file is named by CONF.policy_file | 17:47 |
| morganfainberg | notmyname, yeah they're using it as an example | 17:47 |
| *** afaranha has quit IRC | 17:47 | |
| ayoung | or, an explictly passed in file | 17:47 |
| ayoung | notmyname, were are talking policy enforcement. I might be taking Swift's name in vain here. | 17:47 |
| morganfainberg | ayoung, right - just making sure i wasn't missing something or seeing some other cache being created | 17:47 |
| notmyname | ayoung: heh. let me know if I can help with details or use cases :-) | 17:48 |
| ayoung | morganfainberg, right, so I want the cache to do two things: hide how the file is actually fetched, and determine when it needs to fetch a new file | 17:48 |
| rodrigods | my question is: where is this cache being placed? middleware/kc/policy lib | 17:48 |
| ayoung | notmyname, I need to look at the policy.json file deployed by swift. I learn something new each time I look at that from a different service | 17:48 |
| ayoung | rodrigods, OK back to our example | 17:49 |
| morganfainberg | ayoung, so, you *may* want to look at how dogpile.cache handles proxy objects - so the way you "add" the caching in is by a proxy object that caches the data - that layers on top of the "fetch" logic | 17:49 |
| ayoung | morganfainberg, I suspect I do | 17:49 |
| morganfainberg | so the base functionality is fetch, and proxy does caching. | 17:49 |
| morganfainberg | or even proxy object could be smarter than that | 17:49 |
| ayoung | morganfainberg, so you specify customer "fetchers" then? | 17:50 |
| ayoung | custom | 17:50 |
| *** stevemar has quit IRC | 17:50 | |
| morganfainberg | ayoung, so the way proxy in dogpile works is a lot like our managers work | 17:50 |
| morganfainberg | just can layer them as deep as you want | 17:50 |
| ayoung | morganfainberg, we have dogpile in auth_token, right? | 17:50 |
| morganfainberg | no | 17:50 |
| morganfainberg | we need to get it there | 17:50 |
| *** gokrokve has joined #openstack-keystone | 17:51 | |
| ayoung | morganfainberg, OK, so lets talk WRT policy. Where would each piece of the caching mechanism live? | 17:51 |
| morganfainberg | so ideally, i would like to see caching done via dogpile | 17:52 |
| ayoung | policy should not be reading from the file system | 17:52 |
| morganfainberg | whether tha is an KVS-style or memoized, i'm not concerned | 17:52 |
| ayoung | so would we have a "file" backed dogpile impl? | 17:52 |
| *** shakamunyi has joined #openstack-keystone | 17:52 | |
| ayoung | policy should be able to stand alone. So I would think it would be something like this: | 17:52 |
| morganfainberg | what you would have is a stevedore (or similar) plugin that says "I fetch files by XXX method", one of which would be file, one would be keystone etc | 17:52 |
| *** afaranha has joined #openstack-keystone | 17:53 | |
| morganfainberg | if you *wanted* to you could use memoize decorator to cache - alternative you use a proxy, an object that is called (works like our manager via getattr overload) but is a chain of objects not just a manager->driver | 17:53 |
| morganfainberg | that could implement the dogpile proxy. | 17:54 |
| ayoung | there is a RuleCache object. Its an abstract base class that lives in In oslo.policy. In oslo.policy we have a default implementation that uses that cache. Then, in middleware or in keystoneclient, we have a cache implementation that fetches its data from keystone based on endpoint id. | 17:54 |
| amakarov | morganfainberg, hello! A case: we have a trust with depth 10, changed max_redelegation_count to 5, restarted keystone, and trying to redelegate. What's the result? | 17:54 |
| morganfainberg | amakarov, old trusts should maintain their max depth - it already exists, new trusts are constrained. | 17:54 |
| ayoung | amakarov, you can redelegate the trust to 5 only now | 17:54 |
| morganfainberg | amakarov, redelegation_count | 17:54 |
| ayoung | ah, that is only enforced on trust creation? | 17:55 |
| morganfainberg | amakarov, i'd say so | 17:55 |
| ayoung | then yeah, delegate to 10 | 17:55 |
| morganfainberg | ayoung, ^ | 17:55 |
| ayoung | ++ | 17:55 |
| amakarov | morganfainberg, so redelegated trust will have depth 9 regardless of config constraint? | 17:55 |
| morganfainberg | amakarov, yeah the *max* is only enforced on initial trust creation | 17:55 |
| *** ctracey has joined #openstack-keystone | 17:55 | |
| *** shakamunyi has quit IRC | 17:55 | |
| morganfainberg | amakarov, the one that enables redelegation | 17:56 |
| ayoung | morganfainberg, OK, so the cache interface would need to get initialization data from somewhere. I'm guessing that for keystone, that should be from CONF | 17:56 |
| amakarov | morganfainberg, thanks | 17:56 |
| ayoung | actaully, for the default file based on, that would work, too | 17:56 |
| morganfainberg | amakarov, makes sense right? I'm open to be convinced otherwise, but i thnk the UX would be *very bad* otherwise, suddenly a trust breaks because someone changed a config in keystone | 17:56 |
| rodrigods | ayoung, your design up there... didn't get why you need a cache in oslo.policy if we have the cache in kc for the specific endpoint/service | 17:57 |
| ayoung | morganfainberg, so the question is, should the keystone based cache implementation live in keystone client then? I think it should. Then keystonemiddleware really is out of the picture for enforcement | 17:57 |
| *** timcline_ has joined #openstack-keystone | 17:57 | |
| *** timcline has quit IRC | 17:57 | |
| rodrigods | ayoung, not totally out, since it builds the context :) | 17:57 |
| ayoung | rodrigods, policy is a generic rules engine. It should be able to function for use cases other than keystone | 17:57 |
| morganfainberg | ayoung, so this might be a middleware thing. | 17:58 |
| morganfainberg | gyee, ping - need to ask a question re HP stuff, but want to make sure you're here before typing it all out | 17:58 |
| gyee | k | 17:58 |
| openstackgerrit | Haneef Ali proposed openstack/keystone: Fix wrong log message in token flush https://review.openstack.org/140790 | 17:58 |
| gyee | just got back to my desk | 17:58 |
| ayoung | morganfainberg, I know it feels like it should be, but I think it will work better as a straight function call. It won't be a WSGI middleware | 17:59 |
| rodrigods | ayoung, the enforcement to be in the middleware, it should be (like) a decorator, right? (like to imagine how I'd implement designs :P) | 18:01 |
| morganfainberg | rodrigods, no. | 18:01 |
| morganfainberg | rodrigods, it can't be | 18:02 |
| morganfainberg | rodrigods, right now | 18:02 |
| amakarov | morganfainberg, I agree about UX - pedigree tracking, for example, will be easier. I needed approval :) | 18:02 |
| morganfainberg | and i'm worried about too many PEPs if we do REST PEP, then object PEP, then other PEP | 18:02 |
| morganfainberg | pep = policy enforcement point | 18:02 |
| morganfainberg | so lets start with 1 pep, and break it up once we have all the mechanics working unless we have a good reason to invert it. | 18:03 |
| morganfainberg | right now we have 1 PEP and we can make that work, so i think we can probably keep with that for now. | 18:03 |
| *** serverascode___ has joined #openstack-keystone | 18:03 | |
| morganfainberg | and it wont *really* break anyone | 18:03 |
| rodrigods | morganfainberg, the enforcement logic being fully performed by oslo.policy? | 18:03 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Self Management of Domain Scoped Roles https://review.openstack.org/138728 | 18:04 |
| morganfainberg | ayoung, i think you're right - the fetcher is a KSC thing - the file base fetcher is a plugin that likely is from oslo_policy | 18:04 |
| morganfainberg | ayoung, so, oslo_policy has the "fetch" logic that uses a stevedore plugin? | 18:04 |
| morganfainberg | ayoung, the default is file-based (compat for now with today) that is provided with oslo_policy. KSC (or even separate pip package, doesn't matter) implements a "get from keystone" one | 18:05 |
| morganfainberg | ayoung, does that line up with your thoughts? | 18:05 |
| ayoung | morganfainberg, I think so. | 18:05 |
| ayoung | morganfainberg, the nice thing about this is then it is callable from middleware, but not tied to it. I think that is the right abstraction | 18:05 |
| *** lhcheng has joined #openstack-keystone | 18:05 | |
| *** jsavak has joined #openstack-keystone | 18:06 | |
| ayoung | rodrigods, I could see adding the decorator to keystonemiddleware | 18:06 |
| morganfainberg | ayoung, yeah eventually we *could* lift strictly rest level enforcement to it's own PEP in middleware | 18:06 |
| morganfainberg | but to start we don't do that. | 18:06 |
| *** shakamunyi has joined #openstack-keystone | 18:06 | |
| ayoung | AHA! | 18:07 |
| ayoung | and then in Keystone server we have an alternate fetcher that pulls policy right out of the keystone.policy.Manager | 18:08 |
| ayoung | morganfainberg, I think we move all of the common policy enforcement code from keystone.common.controll into the middleware | 18:08 |
| ayoung | to include the decorator, if at all possible | 18:09 |
| ayoung | we could do the same thing with "fetchers" for the target data | 18:09 |
| *** joesavak has quit IRC | 18:09 | |
| ayoung | same thing as we are talking about doing for the cahce | 18:09 |
| ayoung | cache | 18:09 |
| *** zhiyan has joined #openstack-keystone | 18:09 | |
| ayoung | rodrigods, we have this line: https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L124 | 18:10 |
| ayoung | self.get_member_from_driver(kwargs[key]) | 18:10 |
| ayoung | I think we would need to abstract that away somehow. That is the thing that says "get the object" | 18:10 |
| *** hugokuo has quit IRC | 18:10 | |
| *** charz has quit IRC | 18:10 | |
| ayoung | some sort of lambda object would be probably the right abstraction | 18:10 |
| morganfainberg | ayoung, yep. | 18:11 |
| morganfainberg | ayoung, the pulling out of the manager directly that is for keystone | 18:12 |
| morganfainberg | ayoung, we need to ditch the decorator in ksytone i think | 18:12 |
| ayoung | morganfainberg, I think we could leave it as a decorator if we specified the helper function in there, but the guts of the decorator function should get pulled out into something directly callable. | 18:13 |
| *** gokrokve has quit IRC | 18:13 | |
| ayoung | and then the decorator becomes relatively trivial: | 18:13 |
| morganfainberg | ayoung, we already ahve that it makes it *very* hard to read | 18:14 |
| ayoung | morganfainberg, I'm not wedded to it. | 18:14 |
| morganfainberg | ayoung, the callback is in there for object fetching | 18:14 |
| morganfainberg | and enforcement | 18:14 |
| ayoung | the callback is actually in the controller | 18:14 |
| morganfainberg | i think nova's model is much better | 18:14 |
| ayoung | self.get_member_from_driver(kwargs[key]) | 18:14 |
| morganfainberg | no - the callback is passed to the decorator | 18:14 |
| morganfainberg | there are cases we need to get *other* objects | 18:14 |
| morganfainberg | so we have even wackier decorator stuff | 18:15 |
| morganfainberg | i'd say we should use the nova model, explicitly call at the expected PEP not do all sorts of wierd stuff to get around the decorator | 18:15 |
| rodrigods | that's how I see it http://paste.openstack.org/show/148856/ :) | 18:15 |
| rodrigods | morganfainberg, so for that design, I can only see it working in keystoneclient | 18:16 |
| *** esp has joined #openstack-keystone | 18:16 | |
| ayoung | morganfainberg, "the callback is passed to the decorator" where? | 18:16 |
| ayoung | I think you are going from memory | 18:16 |
| ayoung | not from the code: | 18:16 |
| morganfainberg | ayoung, sec let me find it but i know we do it | 18:16 |
| ayoung | morganfainberg, start here https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L124 | 18:17 |
| ayoung | get_member_from_driver is implemented by each of the controllers | 18:17 |
| morganfainberg | ayoung, https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L541 | 18:17 |
| rodrigods | keystone/assignment/controllers.py: @controller.protected(callback=_check_grant_protection) | 18:17 |
| morganfainberg | rodrigods, not sure what "client.enforce" is referencing in your example | 18:18 |
| ayoung | Ah...so we have two ways of doing the same thing | 18:18 |
| ayoung | I missed that callback implementation | 18:18 |
| rodrigods | morganfainberg, a enforcer class in the client, like rules.py | 18:18 |
| morganfainberg | rodrigods, no the enforcer should *not* be implemented in keystoneclient | 18:18 |
| morganfainberg | the enforcer comes from policy.py, in oslo_policy. oslo_policy has a plugin that knows how to fetch the policy file | 18:19 |
| morganfainberg | ksc implements a plugin that can get it from keystone (or it could be a new packaged if needed) | 18:19 |
| ayoung | But I+2ed that... | 18:19 |
| ayoung | https://review.openstack.org/#/c/38308/ | 18:19 |
| *** nellysmitt has joined #openstack-keystone | 18:19 | |
| morganfainberg | ayoung, yeah we needed it - because the decorator is limited | 18:20 |
| morganfainberg | if the PEP could be in the controller function - we wouldn't need the callback | 18:20 |
| *** charz has joined #openstack-keystone | 18:20 | |
| *** nellysmitt has quit IRC | 18:20 | |
| ayoung | so we could start by removing the "get_member_from_driver" to the callback mechanism | 18:20 |
| morganfainberg | the decorator wraps the function - so we needed a way to "do extra" work | 18:20 |
| morganfainberg | ayoung, well - except the callback largely replaces (wholesale) the enforcement logic | 18:21 |
| morganfainberg | it's all hard to read. | 18:21 |
| rodrigods | ayoung, so this https://review.openstack.org/#/c/133480/ lost its meaning, right? | 18:21 |
| ayoung | rodrigods, not entirely | 18:21 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 18:21 |
| morganfainberg | ayoung, so i think we should remove the decorator - maybe have a decorator that ensures a PEP was actuated | 18:21 |
| ayoung | rodrigods, that is the part we are discussing now: what to do about the code that is common to all things that need to enforce keystone policy | 18:21 |
| ayoung | morganfainberg, you mean test on the way out? | 18:22 |
| morganfainberg | basically the wrapper just causes a failure if enforcement wasn't called | 18:22 |
| morganfainberg | so there isn't an "oops" in the logic | 18:22 |
| morganfainberg | this api requires enforcement - we make sure it's called [this is a wild thought don't take it as we "should do it"] | 18:22 |
| morganfainberg | move away from using the decorator to do the real enforcement. | 18:23 |
| ayoung | morganfainberg, what if we made the callback mandatory? | 18:23 |
| morganfainberg | ayoung, i don't think it's going to make things more readable. | 18:23 |
| *** hugokuo has joined #openstack-keystone | 18:24 | |
| morganfainberg | ayoung, or easier to understand | 18:24 |
| morganfainberg | again i'm not set that we *need* to ditch the decorator, i just know it has limitations - and we have crazy/ugly workarounds for it | 18:24 |
| ayoung | morganfainberg, yeah...Its just that we want to make it easy to audit that all methods have protection on them. | 18:24 |
| ayoung | I hear ya | 18:25 |
| morganfainberg | ayoung, thats why i was thinking @enforce_required | 18:25 |
| rodrigods | ayoung, so about the spec, I don't think I can write all the changes being discussed here :) | 18:25 |
| morganfainberg | all that wrapper does is guarantee that enforcement was called in the function - or fails. | 18:25 |
| morganfainberg | ayoung, s/does/would do | 18:25 |
| dstanek | we don't do dynamic mapping in federation now right? we pick a single mapping based on IdP and use it? | 18:25 |
| morganfainberg | dstanek, i want to say that is correct | 18:25 |
| ayoung | morganfainberg, we could even do that as a middleware component | 18:26 |
| morganfainberg | ayoung, not sure how middleware does it - but that is because i haven't thought about it | 18:26 |
| morganfainberg | ayoung, remember some APIs *wont* be enforced | 18:26 |
| ayoung | morganfainberg, I just meant a middleware component that checkedthat policy is enforced | 18:26 |
| dstanek | morganfainberg: well, two 'maybes' make a 'most likely' - i'll go with it | 18:26 |
| morganfainberg | dstanek, :) | 18:27 |
| ayoung | morganfainberg, well, a no-op policy should be OK if they stop enforce "TOKEN-REQUIERD_ON_ALL_APIS" at the auth_token level | 18:27 |
| morganfainberg | dstanek, gyee and marekd would be the ones to 100% confirm - only cause i don't see stevemar | 18:27 |
| dstanek | morganfainberg: i see that the mapped auth plugin used federation_api.get_mapping_from_idp_and_protocol to it's a safe bet that mapping are based on IdP and protocol | 18:30 |
| *** harlowja_away is now known as harlowja | 18:31 | |
| rodrigods | dstanek, yes, you tie mapping/protocol/idp | 18:31 |
| gyee | yes, map to protocol is 1:1, protocol to idp is 1:* | 18:32 |
| rodrigods | gyee, ++ | 18:32 |
| gyee | sorry idp to protocol is 1 to many | 18:32 |
| gyee | rodrigods, what's your email? I am looking at k2k federation, your blog is very help btw | 18:33 |
| dstanek | thanks rodrigods & gyee | 18:33 |
| rodrigods | gyee, rodrigods@lsd.ufcg.edu.br :) | 18:33 |
| rodrigods | gyee, glad it helps | 18:33 |
| dstanek | morganfainberg: i was frightened when i read https://review.openstack.org/#/c/138728/ - the pin idea :-( lots of holes to plug | 18:33 |
| rodrigods | gyee, or rodrigodsousa@gmail.com . I might be more responsive in the former | 18:34 |
| gyee | rodrigods, thanks | 18:35 |
| dtroyer | Keystone-ites: with use_tls enabled for LDAP, is the server cert validated? if so, does it use the system certs if tls_cacert* is not supplied? | 18:47 |
| gyee | dtroyer, should be | 18:50 |
| gyee | it will fall back to system cert | 18:51 |
| dtroyer | ok, cool. thanks | 18:51 |
| openstackgerrit | Andre Aranha proposed openstack/keystone: Modify the policy v3 sample https://review.openstack.org/123509 | 18:52 |
| afaranha | ayoung, rodrigods I just fixed yours reviews, could you review again, please? https://review.openstack.org/#/c/123509/ | 18:55 |
| ayoung | afaranha, nope | 18:56 |
| ayoung | afaranha, I'm editing it as we speak :) | 18:56 |
| ayoung | afaranha, we don't have the cloud_admin role, although that is an interesting addition | 18:57 |
| afaranha | :P great! | 18:57 |
| samuelms | ayoung, :) | 18:57 |
| ayoung | afaranha, sorry about that. | 18:58 |
| ayoung | I'll post mine WIP | 18:58 |
| ayoung | but I'm not done | 18:58 |
| ayoung | was just running tox | 18:58 |
| afaranha | ayoung, no problem :), thanks! | 18:58 |
| openstackgerrit | ayoung proposed openstack/keystone: Modify the default policy https://review.openstack.org/123509 | 18:58 |
| afaranha | you are editing the spec right? | 18:58 |
| *** joesavak has joined #openstack-keystone | 18:59 | |
| *** jsavak has quit IRC | 18:59 | |
| afaranha | ayoung Yes, our intention is to create a role to be clear to the admin who gets which role | 18:59 |
| ayoung | GAH! ignore the changes to policy.json | 18:59 |
| ayoung | afaranha, so different forms of admin get different roles...maybe | 19:00 |
| dstanek | samuelms: your comment on the self management review made me bust out laughing | 19:00 |
| afaranha | ayoung, policy.json is the next step :) | 19:00 |
| ayoung | I'm in the middle. Don't spend too much time onthat review | 19:00 |
| afaranha | As we discussed with Henry Nash | 19:00 |
| *** timcline_ has quit IRC | 19:01 | |
| samuelms | dstanek, haha | 19:02 |
| samuelms | dstanek, did I lie? | 19:02 |
| afaranha | ayoung I didn't try yet, does this scope:domain works? Didn't know we could have this key | 19:02 |
| *** marcoemorais has quit IRC | 19:02 | |
| *** marcoemorais has joined #openstack-keystone | 19:03 | |
| *** marcoemorais has quit IRC | 19:03 | |
| dstanek | samuelms: no, i read it very quickly 'i think almost all comments were addressed' and did a double take when my brain processed 'none' | 19:03 |
| afaranha | ayoung, Ah, ok! gonna make the reviews after reading everything :P | 19:03 |
| *** marcoemorais has joined #openstack-keystone | 19:03 | |
| ayoung | afaranha, yeah, I want to get it such that each API is specified like this: | 19:03 |
| ayoung | rule:role_admin | 19:04 |
| *** timcline has joined #openstack-keystone | 19:04 | |
| ayoung | and then role_admin is defined by the base role and the scope | 19:04 |
| samuelms | dstanek, haha :-) | 19:04 |
| *** amakarov is now known as amakarov_away | 19:05 | |
| *** jistr has joined #openstack-keystone | 19:05 | |
| afaranha | ayoung, Great! having a different way of checking for each set of rules is a pain | 19:05 |
| ayoung | afaranha, the target having the domain set on each object makes the rules really tricky | 19:06 |
| ayoung | hence all of the | 19:06 |
| ayoung | "admin_and_matching_group_domain_id": "role:admin and domain_id:%(group.domain_id)s", | 19:06 |
| *** gordc has quit IRC | 19:06 | |
| rodrigods | ayoung, you didn't ack about updating https://review.openstack.org/#/c/133480/ :) | 19:07 |
| *** ayoung is now known as shhh_im_busy | 19:07 | |
| *** chrisshattuck has joined #openstack-keystone | 19:07 | |
| afaranha | ayoung this rule is deprecated, I just removed compatibility with the old admin role, as we agreed earlier | 19:08 |
| *** shhh_im_busy is now known as ayoung | 19:10 | |
| ayoung | afaranha, what I think we want is something that allows the service to fetch an object, and then to check attributes on that object without knowing the specific object type. Those attributes we know of are; domain, project, and owner | 19:12 |
| *** gordc has joined #openstack-keystone | 19:13 | |
| afaranha | ayoung something like "target", but target need to know the object, an I correct? | 19:15 |
| afaranha | I'll look at the policy code to understand better | 19:15 |
| *** _cjones_ has quit IRC | 19:17 | |
| *** _cjones_ has joined #openstack-keystone | 19:18 | |
| vsilva | ping dstanek; how's the infra going? | 19:20 |
| dstanek | vsilva: right now i'm stuck getting an IdP running and configured to talk to Keystone | 19:21 |
| vsilva | dstanek, is that within some special infra or any idp? you're using pysaml2, right? | 19:22 |
| *** baker has joined #openstack-keystone | 19:22 | |
| dstanek | vsilva: any IdP i haven't look at it again since Monday, but that's where it stopped | 19:23 |
| dstanek | vsilva: not sure yet how to tell pysaml2 to trust the keystone sp | 19:23 |
| rodrigods | dstanek, you mean exchange metatada? | 19:24 |
| samuelms | dstanek, rodrigods matadata* :p | 19:26 |
| samuelms | dstanek, rodrigods, me metadata* :p | 19:26 |
| *** erkules_ is now known as erkules | 19:27 | |
| *** jistr has quit IRC | 19:30 | |
| *** shakamunyi has quit IRC | 19:33 | |
| *** shakamunyi has joined #openstack-keystone | 19:34 | |
| *** timcline has quit IRC | 19:35 | |
| *** marcoemorais has quit IRC | 19:40 | |
| *** marcoemorais has joined #openstack-keystone | 19:41 | |
| *** marcoemorais has quit IRC | 19:42 | |
| *** marcoemorais has joined #openstack-keystone | 19:43 | |
| *** timcline has joined #openstack-keystone | 19:43 | |
| *** timcline has quit IRC | 19:44 | |
| bknudson | I changed /opt/stack/keystone/.tox/py27/local/lib/python2.7/site-packages/eventlet/wsgi.py so it raises an exception that's not caught so I could get a backtrace when the tests log... | 19:46 |
| bknudson | http://paste.openstack.org/show/148908/ | 19:46 |
| openstackgerrit | ayoung proposed openstack/keystone: Check and delete for policy_association_for_region_and_service https://review.openstack.org/140122 | 19:46 |
| bknudson | it looks like test_connection_pool_maximum_connection_get_timeout is starting a thread on a timer and when the timer goes off it gets an error. | 19:46 |
| bknudson | maybe something has been closed or something. | 19:46 |
| *** timcline has joined #openstack-keystone | 19:56 | |
| ayoung | afaranha, dagnabit...I don't like this. I want to be able to say that whatever the fetched object is is the target | 19:56 |
| ayoung | and that user.project.id == target.object.project_id. | 19:57 |
| ayoung | we should not have to specify a separate rule for each object type | 19:57 |
| bknudson | does the connection pool have to be closed or something? | 19:58 |
| bknudson | I didn't even think the tests used eventlet. | 20:01 |
| *** dims has quit IRC | 20:02 | |
| ayoung | bknudson, unit tests have to specify which threading model to use | 20:06 |
| ayoung | and the default is eventlet. Its set from the test setup using the environment module, IIRC | 20:06 |
| bknudson | yep, environment.use_eventlet() | 20:07 |
| ayoung | bknudson, try setting STANDARD_THREADS | 20:08 |
| bknudson | do we need that so we can run a server at the same time as the clients in a single thread? | 20:08 |
| ayoung | no idea | 20:09 |
| bknudson | it might not even be that test that's the problem... could be another test that put the action on eventlet and it just notices it in this other test. | 20:09 |
| ayoung | afaranha, I missed you earlier post. Yes 'something like "target", but target need to know the object, an I correct' | 20:09 |
| *** timcline has quit IRC | 20:10 | |
| bknudson | maybe there's a way to tell eventlet to run until all current actions are complete | 20:10 |
| afaranha | ayoung, agreed. But there's also some rules that we don't use target, other we don't use the object, etc. I didn't test if a rule that uses object.field_id works with TARGET.object.field_id | 20:11 |
| afaranha | maybe not | 20:11 |
| afaranha | or rules that only gets the field_id if work like: OBJECT.field_id.... | 20:11 |
| *** timcline has joined #openstack-keystone | 20:11 | |
| ayoung | afaranha, Ok I think I can do this: | 20:12 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n125 | 20:13 |
| ayoung | policy_dict['target'] = {self.member_name: ref, 'member':ref} | 20:13 |
| ayoung | then collapse all of those rules into | 20:13 |
| ayoung | "admin_and_matching_target_group_domain_id": "rule:admin_required and domain_id:%(target.member.domain_id)s", | 20:14 |
| ayoung | lets see if that works | 20:14 |
| afaranha | ayoung, "We deduce this by seeing if the class has specified a get_member() method and that kwargs contains the appropriate entity id." | 20:17 |
| afaranha | So, projects and domains need the method get_member in order to work? | 20:18 |
| ayoung | afaranha, nah, its on the controller right now | 20:18 |
| ayoung | afaranha, we'll work to make this smoother. RIght now I'm trying to make it work at all for Keystone | 20:20 |
| afaranha | ayoung, I didn't get 100% how this method works.... | 20:22 |
| ayoung | MAJIK! | 20:22 |
| afaranha | It assumes that exists a self.member_name, so this variable should be the the "domain_id" that we specify in the policy... | 20:22 |
| ayoung | AHHH but the grants code is not going to let that work | 20:23 |
| afaranha | Why? Is it something that we can change easily? | 20:24 |
| ayoung | yeah..I can beat it into shape | 20:25 |
| ayoung | this code is getting uglier by the hour, though | 20:25 |
| afaranha | ah! Right, guess I understood that code now. At least what it does | 20:25 |
| openstackgerrit | Merged openstack/keystone: Fix inherited user role test docstring https://review.openstack.org/140705 | 20:27 |
| *** dyasny has quit IRC | 20:30 | |
| afaranha | ayoung, Ok, grant will not work with this because it can be target to a project or a domain, right? | 20:30 |
| ayoung | afaranha, nah, I'll make it work | 20:33 |
| *** jsavak has joined #openstack-keystone | 20:33 | |
| afaranha | ayoung, Although I think it's not a problem because the rule will match with the id provided, project_id or domain_id. | 20:36 |
| rodrigods | ayoung, https://review.openstack.org/140161 cleaned it up. | 20:36 |
| *** joesavak has quit IRC | 20:37 | |
| ayoung | thanks rodrigods | 20:37 |
| afaranha | "project_admin_for_grants": "role:project_admin and project_id:%(target.member.id)s", | 20:37 |
| ayoung | afaranha, I got that to work | 20:37 |
| afaranha | ayoung, What did you modified? | 20:38 |
| *** timcline has quit IRC | 20:39 | |
| ayoung | patience...let me work. | 20:40 |
| ayoung | I'll post it in time, but there is a little trial and error going on | 20:41 |
| ayoung | afaranha, OK...tests are running. Here's what I did so far. | 20:43 |
| ayoung | I added a key "memeber" into the dictionary in a couple places | 20:43 |
| ayoung | first is in the commonn/controller.py code that adds the object to the context. There other is in the callback method that is used for grants | 20:43 |
| *** rushiagr is now known as rushiagr_away | 20:43 | |
| afaranha | Nice! | 20:43 |
| ayoung | with that, I can check the domain id on member in a bunch of rules, and collect them together | 20:44 |
| ayoung | I have a rule like this now: | 20:44 |
| ayoung | "domain_matches":"domain_id:%(domain_id)s or domain_id:%(target.member.domain_id)s " | 20:44 |
| ayoung | and then | 20:44 |
| ayoung | "domain_admin_for_grants" : "role:admin and rule:domain_matches", | 20:44 |
| ayoung | so I have a bunch that I will reduce to just "domain_admin" | 20:45 |
| afaranha | ayoung, great! Looking forward to see the code | 20:47 |
| afaranha | feel free to ping me when it's comitted | 20:48 |
| *** shakamunyi has quit IRC | 20:53 | |
| *** xxj has quit IRC | 20:55 | |
| *** shakamunyi has joined #openstack-keystone | 20:56 | |
| *** ajayaa has quit IRC | 20:58 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup to stop server in test_wsgi https://review.openstack.org/140835 | 20:58 |
| *** xxj has joined #openstack-keystone | 20:59 | |
| *** dims has joined #openstack-keystone | 21:03 | |
| *** xxj has quit IRC | 21:04 | |
| *** dims has quit IRC | 21:08 | |
| *** xxj has joined #openstack-keystone | 21:08 | |
| marekd | dstanek: so i looked at my scripts today and apparently openstack was at its best so i could confige everything via openstaclient, didn't need to write custom wrappers utilizing ksc. | 21:10 |
| *** dims has joined #openstack-keystone | 21:17 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup eventlet use in tests https://review.openstack.org/140835 | 21:21 |
| ayoung | bknudson, so I agree with the changes in keystone/tests/test_wsgi.py | 21:22 |
| ayoung | I think I was responsible for the changes in keystone/tests/test_auth.py and that strikes an alarm chord | 21:23 |
| bknudson | ayoung: if the tests don't work without the call to "environment.use_eventlet(monkeypatch_thread=False)" then there's something wrong happening. | 21:24 |
| ayoung | did you run keystone/tests/test_auth.py alone? | 21:24 |
| bknudson | ayoung: Yes, since that was the comment... let me try it again. | 21:24 |
| ayoung | bknudson, I believe you. I suspect that some other assumption has changed | 21:25 |
| bknudson | tox -e py27 keystone.tests.test_auth -- worked... | 21:25 |
| bknudson | is there some other way that you run the tests? | 21:25 |
| bknudson | maybe I can do testr in the venv | 21:25 |
| ayoung | looks right | 21:25 |
| ayoung | you can do | 21:25 |
| ayoung | /opt/stack/keystone/.tox/py27/bin/python -m nose -s keystone.tests.test_auth | 21:26 |
| bknudson | "$ .tox/py27/bin/testr run keystone.tests.test_auth" -- failed with an import error "keystone.tests.test_v3_federationNon-zero exit code (2) from test listing." | 21:26 |
| ayoung | but that should be pretty much the same thing you ran | 21:26 |
| ayoung | I pip installed nose | 21:27 |
| *** timcline has joined #openstack-keystone | 21:27 | |
| bknudson | y, I needed to .tox/py27/bin/pip install nose | 21:27 |
| *** timcline has quit IRC | 21:27 | |
| bknudson | $ .tox/py27/bin/python -m nose -s keystone.tests.test_auth -- "Ran 70 tests in 11.987s" | 21:28 |
| bknudson | worked for me. | 21:28 |
| bknudson | there's a warning about The IN-predicate on "assignment.actor_id" that I still haven't looked into | 21:28 |
| ayoung | yeah...that is a different issue though. I think you are good | 21:28 |
| ayoung | bknudson, what was happening before is that the environement call was not part of the code path for this test, and was only being set if the server tests were run first | 21:29 |
| ayoung | if you ran this test alone, you got the errors you would expect if neither eventlet nor standard threads were set | 21:30 |
| bknudson | ayoung: I tried running an individual test and that worked, too... keystone.tests.test_auth:AuthWithToken.test_auth_token_project_group_role | 21:32 |
| ayoung | I think you are good | 21:32 |
| *** timcline has joined #openstack-keystone | 21:32 | |
| *** timcline has quit IRC | 21:32 | |
| bknudson | not much info in the commit... https://github.com/openstack/keystone/commit/811dfdb5dd9b21754a5bea76304ca62960e9474c ... maybe something was fixed, but it would be interesting to know why it didn't work before. | 21:34 |
| bknudson | I'll try checking out that commit. | 21:34 |
| ayoung | bknudson, I'm guessing that the environment.use_eventlet call for the global tests was moved. | 21:35 |
| *** afaranha_ has joined #openstack-keystone | 21:36 | |
| bknudson | maybe there's a test runner that for some reason wasn't doing the test.core imports. | 21:36 |
| ayoung | git show aca10c16 | 21:37 |
| ayoung | I changed that | 21:37 |
| ayoung | last January | 21:37 |
| ayoung | the other change happened. | 21:37 |
| *** timcline has joined #openstack-keystone | 21:38 | |
| ayoung | Tue Jan 21 14:45:06 2014 -0500 | 21:38 |
| bknudson | running with the commit before 811dfd the tests still work. | 21:39 |
| ayoung | Mon Jan 6 21:13:04 2014 -0500 | 21:39 |
| bknudson | probably too many things have changed. | 21:39 |
| ayoung | but that is when I made the change origianlly, not when it merged | 21:39 |
| *** timcline has quit IRC | 21:39 | |
| ayoung | bknudson, try it with STANDARD_THREADS set | 21:40 |
| bknudson | ayoung: like this? STANDARD_THREADS=1 .tox/py27/bin/python -m nose -s keystone.tests.test_auth | 21:41 |
| ayoung | maybe it was something along those lines...I can't remember the order that this happened | 21:41 |
| ayoung | 1? True? I think they are the same | 21:41 |
| bknudson | monkeypatch_thread = not os.getenv('STANDARD_THREADS') -- so it's just checking if it's a non-empty string | 21:44 |
| bknudson | test_auth does "environment.use_eventlet(monkeypatch_thread=False)" whereas core.py does "environment.use_eventlet()" ... I wonder what difference that would make | 21:45 |
| ayoung | probably an issue with memcached | 21:46 |
| *** jsavak has quit IRC | 21:52 | |
| *** diegows has joined #openstack-keystone | 21:55 | |
| *** afaranha__ has joined #openstack-keystone | 21:56 | |
| *** afaranha_ has quit IRC | 21:56 | |
| bknudson | lbragstad: did you open a bug for the issue with the messages when running tests? I didn't find one... I think https://review.openstack.org/#/c/140835/ should fix it. | 22:00 |
| *** jamielennox|away has quit IRC | 22:08 | |
| *** shakamunyi has quit IRC | 22:08 | |
| *** xxj has quit IRC | 22:09 | |
| *** charz has quit IRC | 22:09 | |
| *** serverascode___ has quit IRC | 22:09 | |
| *** jamielennox|away has joined #openstack-keystone | 22:10 | |
| *** jamielennox|away is now known as jamielennox | 22:10 | |
| *** ChanServ sets mode: +v jamielennox | 22:10 | |
| *** shakamunyi has joined #openstack-keystone | 22:10 | |
| *** zigo has quit IRC | 22:11 | |
| *** zigo has joined #openstack-keystone | 22:12 | |
| *** serverascode___ has joined #openstack-keystone | 22:12 | |
| *** charz has joined #openstack-keystone | 22:12 | |
| *** r-daneel has quit IRC | 22:16 | |
| *** andreaf has quit IRC | 22:17 | |
| *** andreaf has joined #openstack-keystone | 22:17 | |
| ayoung | afaranha, OK, I have most of them, but I've run into another snag with the creation functions. Those don't have a `member` so much as you need to check the container (proejct or domain) before creating something inside that container | 22:21 |
| *** xxj has joined #openstack-keystone | 22:22 | |
| afaranha__ | ayoung, How is it working? in create project we have the rule checking target.project.domain_id | 22:30 |
| ayoung | afaranha__, those become target.member.domain_id | 22:30 |
| ayoung | its the ones in the request that are like this | 22:30 |
| ayoung | "rule:cloud_admin or (role:admin and project_id:%(scope.project.id)s)" | 22:30 |
| *** mfisch has quit IRC | 22:31 | |
| ayoung | or : "role:admin and domain_id:%(project.domain_id)s" | 22:31 |
| *** mfisch has joined #openstack-keystone | 22:32 | |
| afaranha__ | ayoung, where does this scope comes from? | 22:32 |
| ayoung | I don't know. I think it might be a typo | 22:32 |
| ayoung | but the other is not | 22:32 |
| *** mfisch is now known as Guest76485 | 22:32 | |
| *** Guest76485 has joined #openstack-keystone | 22:32 | |
| *** Guest76485 is now known as mfisch | 22:33 | |
| *** topol has quit IRC | 22:34 | |
| afaranha__ | ayoung, Sorry, didn't get it all. If we have something like: project.domain_id we are not able to user target.member.domain_id or just member.domain_id, correct? | 22:34 |
| afaranha__ | ayoung, I'll just review a few points, as you are working on that :) | 22:38 |
| ayoung | afaranha__, I'll post another WIP here so you can see where I'm at | 22:38 |
| afaranha__ | great! | 22:41 |
| *** mflobo has quit IRC | 22:42 | |
| ayoung | afaranha__, OK, I think I can go one step further | 22:44 |
| openstackgerrit | ayoung proposed openstack/keystone: Modify the default policy https://review.openstack.org/123509 | 22:44 |
| ayoung | afaranha__, I think I can get rid of those custom rules by expandind the meaning of domain_matches | 22:44 |
| *** RichardRaseley has joined #openstack-keystone | 22:45 | |
| *** baker has quit IRC | 22:48 | |
| afaranha__ | ayoung, Sure, we can reduce even more the rules, there still duplications: admin_on_domain_filter and admin_on_project_filter | 22:49 |
| ayoung | yeah. | 22:49 |
| afaranha__ | Can we reduce the rules that checks an id, like this one: | 22:50 |
| afaranha__ | domain_id:%(target.member.domain_id)s | 22:51 |
| afaranha__ | into: | 22:51 |
| afaranha__ | domain_id:%(target.member.id)s | 22:51 |
| afaranha__ | ? | 22:51 |
| afaranha__ | in this case the member is domain, we same also for project | 22:51 |
| afaranha__ | ayoung, In the assignment controller we have: ref['member'] = ref['project'] | 22:55 |
| afaranha__ | don`t we need this for domain and group also? | 22:56 |
| ayoung | non | 22:56 |
| ayoung | if the member is a project, we need the member.domain_id | 22:56 |
| ayoung | we might also need to test | 22:56 |
| ayoung | member.project_id | 22:57 |
| *** _cjones_ has quit IRC | 23:01 | |
| afaranha__ | ayoung, Right, we also need to check the domain_id on users | 23:04 |
| *** _cjones_ has joined #openstack-keystone | 23:04 | |
| *** chrisshattuck has quit IRC | 23:04 | |
| *** zz_avozza is now known as avozza | 23:08 | |
| ayoung | afaranha__, so we need to check these very closely. I have a suspicion that it would be easy to fool the "or" checks into incorrectly passing by putting bogus data into a request | 23:12 |
| ayoung | It might be OK if coupled with JSON home and strict parsing, so that putting, say a bogus group value into a create_project call would cause it to fail. | 23:14 |
| *** thedodd has joined #openstack-keystone | 23:14 | |
| ayoung | afaranha__, I'm going to repost, but it is still very much WIP | 23:15 |
| openstackgerrit | ayoung proposed openstack/keystone: Modify the cloud policy https://review.openstack.org/123509 | 23:16 |
| *** jdandrea has joined #openstack-keystone | 23:17 | |
| openstackgerrit | ayoung proposed openstack/keystone: Modify the cloud policy https://review.openstack.org/123509 | 23:18 |
| afaranha__ | ayoung, Let me check, I think I`ll understand better | 23:18 |
| ayoung | afaranha__, I think what I want to do is the same kind of thing that the "member" does. Maybe called "request_member" and make it an explicit set in the API. | 23:19 |
| jdandrea | Q: When requesting :5000/v2.0 I see "localhost" used for the rel="self" links, but I can't find where to change that in the keystone.conf. catalog shows the proper URLs though. | 23:19 |
| ayoung | so if you are creating a user you set request_member: user | 23:19 |
| *** thedodd has quit IRC | 23:20 | |
| ayoung | jdandrea, public_endpoitn | 23:20 |
| ayoung | endpoint | 23:21 |
| jdandrea | ayoung: The public endpoints look good when I use keystone catalog and keystone endpoint-list. Just not when I go to the :5000/v2.0 URL. | 23:21 |
| * jdandrea scratches head | 23:21 | |
| *** gordc has quit IRC | 23:23 | |
| afaranha__ | ayoung, don`t know the effect that it would have and if it`s necessary, let me think | 23:23 |
| afaranha__ | ayoung, This is the same issue we have before, so that's the reason we declare rule for domain admin and project admin between each set of operations | 23:24 |
| *** raildo_ has joined #openstack-keystone | 23:24 | |
| ayoung | jdandrea, look at the code that generates it. I don't think it is hard coded. Its in keystone/service.py | 23:25 |
| jdandrea | ayoung: sure ... checking. | 23:26 |
| ayoung | afaranha__, it might be necessary. I'll lok tomorrow. Got to go into family mode now | 23:26 |
| *** ayoung is now known as ayoung_dad_mode | 23:26 | |
| jdandrea | ayoung_dad_mode: I don't see localhost in there. | 23:27 |
| jdandrea | ayoung_dad_mode: I also bounced keystone just in case. No change. | 23:27 |
| jdandrea | Weird. | 23:27 |
| jdandrea | ayoung_dad_mode: Ahhh, but the default public_endpoint DOES use localhost. | 23:28 |
| jdandrea | I bet it's not set in the conf. | 23:28 |
| jdandrea | It's not, but it's not set on our other OS installs either and it is ok. | 23:29 |
| jdandrea | (on those) | 23:29 |
| afaranha__ | ayoung_dad_mode, hehehe, gonna check the review, thanks for the help o/ | 23:29 |
| jdandrea | ayoung_dad_mode: Ok, I see a difference between common/config.py on one OS install and another. On the one that shows the proper self link, there is no public_endpoint or admin_endpoint URL. On the one that shows localhost, there's public_endpoint and admin_endpoint with the default using localhost. | 23:32 |
| *** r-daneel has joined #openstack-keystone | 23:33 | |
| *** Tahmina has joined #openstack-keystone | 23:34 | |
| jdandrea | ayoung_dad_mode: Should I use %(public_port)s in the value or actually put in 5000? | 23:34 |
| jdandrea | Ah, use the var. It works now! | 23:35 |
| openstackgerrit | Merged openstack/keystonemiddleware: Add a test to ensure the version check error https://review.openstack.org/139512 | 23:37 |
| jdandrea | Thx ayoung_dad_mode | 23:37 |
| *** r-daneel has quit IRC | 23:38 | |
| *** RichardRaseley has quit IRC | 23:42 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Fix passing parameters to log message https://review.openstack.org/140871 | 23:46 |
| *** r-daneel has joined #openstack-keystone | 23:50 | |
| *** tellesnobrega_ has joined #openstack-keystone | 23:55 | |
| *** tellesnobrega_ has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!