| *** ljfisher has quit IRC | 00:02 | |
| *** chrisshattuck has quit IRC | 00:05 | |
| *** nkinder has quit IRC | 00:05 | |
| *** dims has quit IRC | 00:08 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Import functional CLI tests from tempest https://review.openstack.org/158503 | 00:12 |
|---|---|---|
| *** abhirc has quit IRC | 00:25 | |
| *** raildo has quit IRC | 00:26 | |
| morganfainberg | gyee, we need more than a single string for k2k | 00:28 |
| jamielennox | morganfainberg: http://www.jamielennox.net/blog/2015/02/23/v3-authentication-with-auth-token-middleware/ | 00:28 |
| morganfainberg | gyee, the single string is just not enough. | 00:28 |
| morganfainberg | jamielennox, ^ cc, so the separate service_providers is a better construct. especially since they don't have a region or other such things | 00:29 |
| jamielennox | morganfainberg: i like the idea of reusing existing though, project specific endpoints etc will all be required for service_providers | 00:30 |
| morganfainberg | jamielennox, yes. it sadly [short of redefining the catalog data and what is returned] isn't really possible in the current constructs | 00:30 |
| morganfainberg | and *that* will likely break people more than having an element they don't know what to do with (the service_providers list) | 00:31 |
| jamielennox | i don't think either will break people | 00:31 |
| jamielennox | we've managed to add a whole bunch of new services that old clients didn't know about and they just ignore the service_catalog entry | 00:32 |
| jamielennox | morganfainberg: what i think we're missing here is some definition of how this should work regarding flow | 00:34 |
| gyee | morganfainberg, but they are two different endpoints right, one for auth and the other for service API | 00:34 |
| jamielennox | morganfainberg: we had the same arguments about whether we should have endpoints from external clouds in our service catalog | 00:35 |
| jamielennox | and i think we rightly said no there | 00:35 |
| morganfainberg | jamielennox, there is a difference between endpoints that don't conform data wise and those that do | 00:35 |
| jamielennox | (that was my last memory and i hope that happened0 | 00:35 |
| morganfainberg | we are wedging this data into endpoints now, even though we just ripped it out of region because it wasn't a good fit for region | 00:35 |
| gyee | jamielennox, how are we proposal to solve the external service problem | 00:35 |
| gyee | its easy to say they are not our problem :) | 00:36 |
| jamielennox | gyee: i kind of think putting it in the existing service catalog is saying it's not our problem | 00:36 |
| gyee | but holistically, it all in the same stack | 00:36 |
| gyee | jamielennox, huh? | 00:37 |
| gyee | external Keystone is a service, as far as we are concerned | 00:37 |
| gyee | peer service | 00:37 |
| jamielennox | gyee: how do we differentiate it from the keystone service already in the catalog | 00:38 |
| gyee | jamielennox, we don't have to, that's the beauty of it | 00:39 |
| gyee | as far as we are concerned, its an endpoint providing some service | 00:39 |
| jamielennox | that's going to confuse keystoneclient looking in the catalog though right? | 00:40 |
| gyee | no, keystoneclient cares about that filter | 00:40 |
| gyee | which is basically a dict | 00:40 |
| gyee | an endpoint is no different from an identity, which is essentially a set of attributes | 00:40 |
| jamielennox | but you'd still have service_type='identity' right? | 00:40 |
| gyee | service_type is up to us to define | 00:41 |
| gyee | but its one of the attributes which make up an endpoint | 00:41 |
| *** dims has joined #openstack-keystone | 00:42 | |
| jamielennox | gyee: so how do you see this working? | 00:43 |
| jamielennox | can you pastebin what the client flow would be | 00:44 |
| gyee | jamielennox, we have auth plugins, endpoint lookup, header overrides, and auth overrides right? | 00:45 |
| jamielennox | gyee: with a session and auth plugin, and say novaclient, how would we get nova working in another cloud | 00:45 |
| jamielennox | i think all those things are currently commited | 00:46 |
| gyee | jamielennox, it will require some degree of orchestration on the client side | 00:47 |
| gyee | like from the catalog, get a list of other keystone endpoints out there that you have access to | 00:48 |
| morganfainberg | gyee, the issue is we need more than just a url get_endpoint now needs to give different information back | 00:48 |
| gyee | then request to authenticate to a given provider, and list the projects you have access to | 00:48 |
| morganfainberg | gyee, than any other endpoint | 00:48 |
| morganfainberg | because you need to know the Identity URI and the SP Auth URI | 00:48 |
| morganfainberg | this isn't a *normal* endpoint. | 00:48 |
| jamielennox | gyee: this is what i want to know though - how much orchestration | 00:49 |
| morganfainberg | having .get_endpoint return different information is not good if it has historically always returned 1 thing: a url/uri | 00:49 |
| jamielennox | gyee: because i know we can filter for whatever we like - but how would we expect heat or something to handle that, do we need a user to provide filters for everything? | 00:49 |
| gyee | no, it would all be handled by the app | 00:50 |
| morganfainberg | gyee, saying "this is the app's problem" is not good ux | 00:50 |
| morganfainberg | it's how we've made a lot of things really awful for our users | 00:50 |
| morganfainberg | and users != deployers | 00:50 |
| morganfainberg | in this case | 00:50 |
| gyee | federation, websso, etc are really app thingy | 00:51 |
| gyee | you don't expect user to curl through all the whole thing :) | 00:51 |
| morganfainberg | i also disagree strongly that keystone catalog is a facilitator - it should be well defined and clear what is available. | 00:51 |
| gyee | that ain't fun | 00:51 |
| gyee | who's going to see that catalog? end users? | 00:52 |
| morganfainberg | gyee, but why should i need to know how to handle something totally different again when everything in the catalog today looks roughly the same. now we suddenly have data that doesn't conform to a list construct | 00:52 |
| morganfainberg | a list should be homogenous data types in most cases | 00:52 |
| morganfainberg | gyee, yes, an end user could see it. | 00:52 |
| morganfainberg | gyee, in fact you have to assume an end user will see this. | 00:52 |
| gyee | what's end user going to do with the catalog? | 00:53 |
| morganfainberg | do not say "oh that's an app problem" - and if you do, great what do i use in ksc .get_endpoint | 00:53 |
| morganfainberg | and now i get some endpoints that return data X and some that return data y? | 00:53 |
| gyee | end user need to launch a VM, they just need to provider the username/password/some cred, and the app does the rest | 00:54 |
| morganfainberg | gyee, so now i'm writing my own app | 00:54 |
| morganfainberg | gyee, and i use ksc to do so | 00:55 |
| morganfainberg | i say .get_endpoint() | 00:55 |
| morganfainberg | to use local services i get back a single url, to use k2k i get back something totally different | 00:55 |
| morganfainberg | the datatypes are not the same | 00:55 |
| gyee | well, there are two urls there, auth_url and sp_url, which constitute two separate endpoints | 00:56 |
| morganfainberg | the same thing holds true if i'm iterating through service['endpoints'], some things have wildly different data types? | 00:56 |
| morganfainberg | except now we have random endpoint types which we're trying to pair that down to "internal and external" | 00:56 |
| morganfainberg | basically i'm saying things are such a mess now lets not keep making it worse | 00:57 |
| gyee | 'identity' service have two different types of endpoints today, pubic, interna, and admin | 00:57 |
| morganfainberg | gyee, so now we're adding more and more endpoint types | 00:57 |
| gyee | sure, if it needs to be | 00:57 |
| gyee | or different service | 00:58 |
| morganfainberg | i think we're doing it horribly wrong | 00:58 |
| morganfainberg | the current catalog should be used as a list of services that work like endpoints do today | 00:58 |
| gyee | but there was never any expectation that the endpoints must be accessed with a token | 00:58 |
| morganfainberg | and i very much disagree with the wedge data into places | 00:58 |
| morganfainberg | gyee, should we just revert the region url change then? | 00:58 |
| morganfainberg | i mean, region makes more sense than endpoint | 00:59 |
| gyee | I think of region as a group of endpoints, nothing more | 00:59 |
| morganfainberg | we took this out of region because it is an awful match for region, now we're putting it in an equally bad place where it doesn't fit | 00:59 |
| morganfainberg | so what region does a k2k federation belong to | 00:59 |
| gyee | hell I would use endpoint group to replace region if I have the choice | 00:59 |
| morganfainberg | because region is required | 00:59 |
| morganfainberg | the data does not fit the profile of the data in service/endpoint | 01:00 |
| jamielennox | morganfainberg: don't revert the region thing, we have enough trouble trying to define what a region is without shoehorning a service provider on top of it | 01:02 |
| jamielennox | i made a last ditch effort right before juno to remove regions as urls | 01:02 |
| jamielennox | gyee: your right in that we never said that elements of the catalog have to be accessed with a token - but i think that's the way we've been operating and i think we should | 01:03 |
| jamielennox | we need to figure out (summit?) exactly how the catalog is supposed to work | 01:03 |
| jamielennox | and figure out hierarchical regions and whatever relation to it | 01:04 |
| jamielennox | it's not this problem but related | 01:04 |
| *** drjones has quit IRC | 01:06 | |
| jamielennox | morganfainberg: on DNS - i've wanted to do this for some time, but in what situations is DNS lookup appropriate? should reading from conf in auth_token middleware be allowed to use DNS discovery? | 01:06 |
| *** atiwari has quit IRC | 01:07 | |
| morganfainberg | jamielennox, i think it should simply be an option | 01:07 |
| *** ljfisher has joined #openstack-keystone | 01:08 | |
| jamielennox | morganfainberg: would having it on the 'generic' plugins be sufficient? | 01:08 |
| *** ayoung has joined #openstack-keystone | 01:09 | |
| *** ChanServ sets mode: +v ayoung | 01:09 | |
| jamielennox | or simply the CLI part of generic | 01:09 |
| *** adam_g is now known as adam_g_out | 01:09 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:10 | |
| *** devlaps has quit IRC | 01:11 | |
| morganfainberg | jamielennox, i think so. | 01:11 |
| morganfainberg | jamielennox, the idea is that there should be away to say i'm using "cloud.rackspace.com" and know how to lookup it's auth URL from DNS. | 01:11 |
| morganfainberg | it's a minor "quality of life" type improvement | 01:12 |
| *** ljfisher has quit IRC | 01:12 | |
| jamielennox | morganfainberg: it's something i've talked about before at least - it's a help for your enterprise style deployments | 01:12 |
| jamielennox | but you still have so many other credentials you need that you generally get and rc file so it hasn't been a big issue | 01:12 |
| morganfainberg | jamielennox, it would just be a minor QOL thing. if you know where it goes i'd love to see it happen :) | 01:13 |
| morganfainberg | jamielennox, i agree it's not a super big priority, but minor quality of life changes = make users happy | 01:14 |
| morganfainberg | and happy users means more people use this stuff. | 01:14 |
| jamielennox | lipstick on a pig | 01:14 |
| morganfainberg | esp. if it's "easy" | 01:14 |
| morganfainberg | jamielennox, don't underestimate dressing it up. | 01:14 |
| *** david-lyle is now known as david-lyle_afk | 01:19 | |
| gyee | that's one pretty hog | 01:19 |
| gyee | the name's Wilbur I think | 01:20 |
| jamielennox | babe | 01:21 |
| *** radez_g0n3 is now known as radez | 01:22 | |
| ayoung | I'm going to infer from this that we got a release of policy. https://review.openstack.org/#/c/148624/ | 01:28 |
| ayoung | "Well, we'd have to be talkin' about one charming motherf******* pig." | 01:29 |
| ayoung | http://imoviequotes.com/wp-content/uploads/2014/09/10-02-Pulp-Fiction-quotes.gif | 01:30 |
| ayoung | I mean he'd have to be ten times more charmin' than that Arnold on Green Acres, you know what I'm sayin'? | 01:31 |
| *** browne has quit IRC | 01:31 | |
| *** browne has joined #openstack-keystone | 01:32 | |
| gyee | hahahaha | 01:32 |
| gyee | ayoung, I love that quote | 01:32 |
| morganfainberg | ayoung, policy was tagged. release (with subsequent tag) will happen soonish | 01:36 |
| morganfainberg | ayoung, tag != announced release | 01:36 |
| ayoung | morganfainberg, so we can't build against it yet? | 01:36 |
| ayoung | he's just getting things ready with that review? | 01:37 |
| morganfainberg | ayoung, i mean you could pip install it | 01:37 |
| morganfainberg | but yeah it's not in global reqs | 01:37 |
| morganfainberg | and the first one will be the announced release (for global reqs) | 01:37 |
| ayoung | Ah...that is still a good step forward | 01:37 |
| ayoung | had a frustrating experience with packages and deployment today. Case where running Keystone/Juno with everything else Icehouse would have made sense, but since it is an all-in-one install we have to get the latests dependencies across the board | 01:38 |
| ayoung | would love to make the norm each openstack service runs in its own container | 01:38 |
| morganfainberg | ayoung, youre not the first person even in the last 7 days i've heard that from | 01:38 |
| ayoung | its like; they don't even look at the LDAP issues when "certifying" a release will suit their needs | 01:39 |
| ayoung | they lock in to an older version, and then expect the LDAP stuff to be magically cleared up. | 01:40 |
| *** abhirc has joined #openstack-keystone | 01:40 | |
| ayoung | Its like : that was one of our major features moving to Juno. No, we are not going to backport it, and no, we can't work around it | 01:40 |
| *** _cjones_ has joined #openstack-keystone | 01:43 | |
| *** krtaylor has quit IRC | 01:43 | |
| *** jamielennox is now known as jamielennox|away | 01:46 | |
| ayoung | morganfainberg, Its that we've gone through all these unnatural convolutions to make them into sepratable services...Keystone is about as artificial a construct as you can find...and then the installers go and all-in-one on us, and then people are going to complain about complexity | 01:47 |
| ayoung | "You are doing it wrong" | 01:48 |
| *** abhirc has quit IRC | 01:48 | |
| *** abhirc has joined #openstack-keystone | 01:49 | |
| ayoung | starting to really despise what is happening in our Puppet layer. It is a degree of codification that should not be there | 01:50 |
| morganfainberg | ayoung, =/ | 01:50 |
| ayoung | It means that people can't "configure" what they should be configuring | 01:50 |
| ayoung | becuase they can't hack through all the layers of puppet to get to what needs changing | 01:50 |
| *** samueldmq has quit IRC | 01:51 | |
| ayoung | in this case, one of our guys spent a day trying to get a puppetized install to work where it was using pre-defined service user accounts instead of the ones that puppet tries to inject | 01:51 |
| ayoung | a classic REad-Only LDAP setup | 01:51 |
| ayoung | sometimes you just have to tell them "yes, I could make it work. But we won't support it." | 01:52 |
| morganfainberg | ayoung, hah | 01:54 |
| morganfainberg | have i mentioned how happy i was to write the eventlet deprecation review? | 01:54 |
| morganfainberg | and email? | 01:54 |
| morganfainberg | and LDAP assignment one(s)? | 01:55 |
| *** nkinder has joined #openstack-keystone | 01:55 | |
| *** gyee has quit IRC | 01:55 | |
| *** krtaylor has joined #openstack-keystone | 01:55 | |
| *** abhirc has quit IRC | 02:02 | |
| *** himangi has joined #openstack-keystone | 02:03 | |
| morganfainberg | stevemar, hmm. | 02:07 |
| stevemar | morganfainberg, o/ | 02:08 |
| morganfainberg | sec | 02:08 |
| *** jamielennox|away is now known as jamielennox | 02:12 | |
| *** dims has quit IRC | 02:14 | |
| ayoung | what was the hack to get the unified diff in gerit? | 02:16 |
| morganfainberg | ,cm? | 02:17 |
| morganfainberg | ,unified? | 02:17 |
| morganfainberg | something | 02:17 |
| morganfainberg | like that | 02:17 |
| ayoung | ,unified worked. thanks morganfainberg | 02:18 |
| morganfainberg | ayoung, sure thing! :) | 02:19 |
| *** erkules_ has joined #openstack-keystone | 02:20 | |
| ayoung | morganfainberg, so...reading https://review.openstack.org/#/c/153803/3/specs/backlog/HMAC-Signature-Based-Token.rst,unified is he proposing KLWT? | 02:20 |
| *** erkules has quit IRC | 02:23 | |
| *** abhirc has joined #openstack-keystone | 02:24 | |
| *** markvoelker has quit IRC | 02:25 | |
| *** markvoelker has joined #openstack-keystone | 02:26 | |
| morganfainberg | ayoung, something similar but different | 02:26 |
| ayoung | how is it different? | 02:27 |
| *** markvoelker has quit IRC | 02:30 | |
| morganfainberg | ayoung, there is less data transmitted between keystone and the endpoints i *think* | 02:32 |
| morganfainberg | also no support for encrypting the data | 02:32 |
| morganfainberg | ayoung, so i *think* this is a defined message built from data, passed to keystone and validated witha simple true/false, but all the data is housed in the token like PKI. | 02:33 |
| morganfainberg | i *think* | 02:33 |
| morganfainberg | i need to ask arvind to spend some time explaining a bit more. to me | 02:33 |
| ayoung | So...big tokens? | 02:33 |
| morganfainberg | yeah | 02:33 |
| morganfainberg | i think so | 02:33 |
| morganfainberg | i feel like there is some merit here that we can turn into useful w/ KLWT | 02:34 |
| morganfainberg | but not sure what it is yet | 02:34 |
| morganfainberg | so more description/discussion will help suss that out | 02:34 |
| *** abhirc has quit IRC | 02:34 | |
| morganfainberg | or show it really is just KLWT and isn't needed | 02:34 |
| ayoung | So... post Kilo, I want to add an option to have a signer field, and once again push all the validation to the remote service. THis might help | 02:35 |
| morganfainberg | right like i said, possibly some merit here | 02:35 |
| ayoung | anything that is not in the token body will get fetched and cached | 02:35 |
| morganfainberg | but it's hard to pick it out in at least the previous version of this | 02:35 |
| ayoung | We may decide to absorb Kite into Keystone | 02:35 |
| ayoung | For HA keystone it seems to be the safest way to distribute the signing keys | 02:36 |
| morganfainberg | sure. | 02:36 |
| morganfainberg | this is the part i'm not sure about | 02:37 |
| morganfainberg | http://paste.openstack.org/show/180919/ | 02:37 |
| morganfainberg | hm, i think he has a mis-understanding of the PKI system: * Services have to share same PKI artifacts (private key) | 02:38 |
| morganfainberg | since only keystone has the private keys (he's not talking about straight key distribution here) | 02:39 |
| morganfainberg | or it's something else. | 02:39 |
| morganfainberg | ayoung, it's on my list to get some clarity on | 02:39 |
| ayoung | morganfainberg, my guess is that is a key sharing thing: Keystone shares a different Key with each service, otherwise the service can pretend to be Keystone and sign tokens itself. | 02:41 |
| morganfainberg | ah | 02:42 |
| ayoung | but...that seems to contradict what he says elsewhere | 02:42 |
| ayoung | Validation will be done by matching the message digest with the signature | 02:42 |
| ayoung | othewise,...use hands a token body to a service, service calculate the HMAC, hands that to Keystone, and Keystone verifies? | 02:43 |
| *** lhcheng is now known as lhcheng_afk | 02:43 | |
| ayoung | to verify HMAC they need the symmetric key... | 02:43 |
| morganfainberg | except he was talking about the PKI tokens and issue with PKI tokens | 02:43 |
| morganfainberg | in that line | 02:43 |
| ayoung | +1. Keystone will be responsible for generating signature, token and signature | 02:44 |
| ayoung | 124+validation. | 02:44 |
| morganfainberg | right | 02:44 |
| morganfainberg | the line i'm talking about is in at 67 | 02:44 |
| morganfainberg | which is problem description | 02:44 |
| ayoung | I think he is discussing KLWT | 02:44 |
| morganfainberg | which is under the PKI tokens section | 02:45 |
| ayoung | Services have to share same PKI artifacts (private key) that can cause as big | 02:45 |
| ayoung | 68+ security gap. Is just plane rrongggg | 02:45 |
| morganfainberg | yeah i think we have some miscommunication on how PKI works | 02:45 |
| ayoung | Um. Wikipedia PKI | 02:45 |
| morganfainberg | heh | 02:46 |
| ayoung | https://en.wikipedia.org/wiki/Public_key_infrastructure | 02:46 |
| * ayoung shrug | 02:46 | |
| ayoung | morganfainberg, I got called out by Windish on Twitter for using a selfsigned cert for my blog. Funny thing is, it makes perfect sense for me to do so, as I only care about my security, not my readers | 02:47 |
| *** diegows has quit IRC | 02:47 | |
| *** spandhe has quit IRC | 02:48 | |
| morganfainberg | hah | 02:49 |
| mtreinish | morganfainberg: if you get a sec: https://review.openstack.org/155901 should be quick | 02:49 |
| morganfainberg | looking | 02:49 |
| morganfainberg | ooh i want to see that in action | 02:50 |
| morganfainberg | if that makes things all have request ids that'd be cool | 02:50 |
| mtreinish | morganfainberg: yeah it puts request_ids in all the response headers: http://logs.openstack.org/01/155901/3/check/check-tempest-dsvm-full/1947e89/logs/tempest.txt.gz#_2015-02-17_15_38_09_714 | 02:51 |
| morganfainberg | ayoung, so silly question, doesn't that need to go before token auth? so we know a failed request has an id as well? or is that not common in openstack land (cc mtreinish for the common/uncommon-ness) | 02:51 |
| morganfainberg | or do we not care about a failed auth having an id? | 02:52 |
| ayoung | wha | 02:52 |
| morganfainberg | FTR: i'm good with that as is ^^ | 02:52 |
| morganfainberg | https://review.openstack.org/#/c/155901/3/etc/keystone-paste.ini | 02:52 |
| mtreinish | morganfainberg: I was just listening to ayoung on the proper placement in the pipeline :) | 02:52 |
| ayoung | morganfainberg, you askin about mtreinish 's review? | 02:52 |
| morganfainberg | yeah | 02:52 |
| morganfainberg | mtreinish, if it's something we need to adjust location we can do that quickly and still get this in or do it afterwards. | 02:52 |
| morganfainberg | mtreinish, not gonna bike-shed it here just was thinking if there was a reason we'd want a request id prior to json_body | 02:53 |
| mtreinish | morganfainberg: yeah, it's a simple change either way | 02:53 |
| ayoung | I think All I said was that it needed to not be the last thing in the list...can;t remember thexact context | 02:53 |
| ayoung | so, what does request_id do? | 02:53 |
| morganfainberg | you said after json_body | 02:53 |
| morganfainberg | it generates a unique request id | 02:53 |
| morganfainberg | so we get somethjing like: http://logs.openstack.org/01/155901/3/check/check-tempest-dsvm-full/1947e89/logs/tempest.txt.gz#_2015-02-17_15_38_09_714 in our logs | 02:54 |
| morganfainberg | (see req-eblah blah blah) | 02:54 |
| ayoung | if the JSON is crap, would we still want a unique request id? | 02:54 |
| ayoung | or would we just kick it back | 02:54 |
| *** browne has quit IRC | 02:54 | |
| *** lhcheng_afk has quit IRC | 02:54 | |
| morganfainberg | ayoung, json_body happens after auth. | 02:54 |
| ayoung | I think after JSON makes sense... | 02:54 |
| morganfainberg | my only questions was do we need auth failures to have a unique id | 02:54 |
| ayoung | morganfainberg, so what | 02:54 |
| mtreinish | morganfainberg: well the keystone logging is the next part. I still need to figure out to teach the context class to use it | 02:54 |
| *** browne has joined #openstack-keystone | 02:54 | |
| *** browne has quit IRC | 02:54 | |
| ayoung | ah | 02:54 |
| mtreinish | the oslo docs are bit sparse (ie non existent) | 02:55 |
| morganfainberg | mtreinish, :( yeah. digging into oslo.messaging it's been "exciting" | 02:55 |
| mtreinish | morganfainberg: I would think so, so you can track down the failure in the logs easily | 02:55 |
| morganfainberg | not bad. | 02:55 |
| morganfainberg | just exciting | 02:55 |
| ayoung | what do we need the request id for? A failure seems to be not so important here | 02:55 |
| morganfainberg | ayoung, i'd be ok with it as is, but if we'd want unique ids on failed auth - we should move it. i'm just amking sure we're not missing something crazy by putting it later in the pipeline | 02:56 |
| ayoung | we want to track something across multiple services, the failure means it is not recognized by the remote service as a valid request. OK. No big deal...what are we using the ids for? Audit? | 02:56 |
| morganfainberg | ayoung, the unique id is only per-service today, we don't unify them [yet] i don't think | 02:57 |
| morganfainberg | some work has to be done in session to do something about that i think | 02:57 |
| mtreinish | ayoung: it's super useful for debugging if you've got multiple concurrent requests being able to map them to the incoming call is kinda important | 02:57 |
| morganfainberg | mtreinish, am i wrong that we keep unified Ids across services now? | 02:57 |
| morganfainberg | mtreinish, because i'd be happy to be wrong there ;) | 02:57 |
| mtreinish | morganfainberg: yeah there was a bp for it at one point, but I think it lost momentum | 02:58 |
| morganfainberg | mtreinish, ok | 02:58 |
| morganfainberg | so this is a unique id that doesn't persist outside of keystone | 02:58 |
| mtreinish | it would be really nice to have | 02:58 |
| morganfainberg | if the auth failure was maintained across services in a single request i think it being earlier would be very good | 02:58 |
| ayoung | mtreinish, I'm OK with you ignoring my comment if I have a bad assumption | 02:58 |
| morganfainberg | anyone who goes over sizelimit can suck it :P | 02:58 |
| ayoung | after url_normalize is OK, though? | 02:59 |
| morganfainberg | i think so | 02:59 |
| ayoung | mtreinish, comment rescinded | 02:59 |
| morganfainberg | if the url_normalization is bad i am happy to tell somebody we don't care. thats just malicious | 02:59 |
| morganfainberg | or so broken | 03:00 |
| morganfainberg | mtreinish, so let me respin this to undo that and i'll +2 and ayoung can too | 03:00 |
| morganfainberg | mtreinish, and we'll approve [unless you want to move it around] | 03:00 |
| ayoung | yeah, happy to do so | 03:00 |
| morganfainberg | mtreinish, but this is a case i don't want you to have to since it was 2-cores disagreeing :) | 03:00 |
| morganfainberg | not fair to make ya do it | 03:00 |
| morganfainberg | in fact... doing it myself now | 03:00 |
| mtreinish | morganfainberg: no you can go ahead and respin | 03:01 |
| mtreinish | it's 10pm here and I'm a few beers in, so I'd probably screw it up... | 03:01 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add oslo request id middleware to keystone paste pipeline https://review.openstack.org/155901 | 03:01 |
| morganfainberg | mtreinish, +2, and respun | 03:03 |
| morganfainberg | back to patchset 2 | 03:03 |
| mtreinish | morganfainberg: cool, thanks | 03:03 |
| morganfainberg | like i said, not fair if one core says do X and another says do Y | 03:03 |
| morganfainberg | ;) | 03:03 |
| morganfainberg | we should resolve that | 03:03 |
| morganfainberg | ayoung, hah beat me to kicking the WebSSO thing through to the gate | 03:05 |
| ayoung | :) | 03:06 |
| morganfainberg | ayoung, ws looking at it and then hit refresh, oh look +A | 03:06 |
| morganfainberg | anyway it looks pretty good, nothing but nits if anything | 03:06 |
| mtreinish | morganfainberg: heh, that's pretty normal :) | 03:06 |
| stevemar | request id eh | 03:07 |
| morganfainberg | stevemar, yeah | 03:07 |
| morganfainberg | you know those cool things that help trace actions through logs | 03:07 |
| *** markvoelker has joined #openstack-keystone | 03:08 | |
| stevemar | i don't, but lets pretend that i do | 03:08 |
| *** MasterPiece has quit IRC | 03:11 | |
| *** _cjones_ has quit IRC | 03:14 | |
| *** samueldmq has joined #openstack-keystone | 03:19 | |
| *** ccard__ has joined #openstack-keystone | 03:31 | |
| dolphm | lbragstad: i can't think of a reason for the token format / version / whatever to prefix the new tokens, since they need to be validated online anyway (only keystone needs to validate them, not auth_token). and the version thing, while useful, belongs as the first part of the ciphertext / msgpack'd piece so it's integrity can be verified | 03:32 |
| ayoung | jamielennox, so...the V3AccessInfo interface assumes it got the ['token'] portion of the response, which does not include oauth data | 03:32 |
| lbragstad | dolphm: yes, that's correct | 03:32 |
| ayoung | jamielennox, or the trust data | 03:33 |
| lbragstad | I think when this was planned out, people wants a way to make sure we were confined to a format | 03:33 |
| jamielennox | ayoung: really? | 03:33 |
| lbragstad | I believe nonameentername had raised that concern | 03:33 |
| jamielennox | ayoung: i think there was trust information in v3 access info | 03:33 |
| ayoung | jamielennox, it seems to be the case | 03:33 |
| ayoung | its one level up | 03:34 |
| dolphm | lbragstad: confied? | 03:34 |
| dolphm | lbragstad: confined*? | 03:34 |
| *** ccard_ has quit IRC | 03:34 | |
| lbragstad | yeah, I can't recall the exact reason but I thought that was it | 03:34 |
| lbragstad | jacorob: you around? | 03:34 |
| dolphm | lbragstad: next up, i can't think of a reason to include the 'issued_at' timestamp because it's already part of fernet's algorithm | 03:36 |
| ayoung | jamielennox, let me confirm | 03:36 |
| lbragstad | dolphm: the only reason I can think of why we need that in there is because we need to have a way to pull out the created at time for revocation events | 03:36 |
| ayoung | jamielennox, so we have no trust or oauth tokens in here http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/examples/pki/cms | 03:37 |
| ayoung | that seems like an oversite | 03:37 |
| ayoung | er oversight | 03:37 |
| jamielennox | ayoung: :( | 03:37 |
| dolphm | lbragstad: hmmmmmmm | 03:37 |
| dolphm | lbragstad: when you decrypt, you give the max token lifespan, as crypto.decrypt(ciphertext, ttl=CONF.token.expiration) ... there must be another (hazmat layer) API call to fetch the create date out? | 03:38 |
| ayoung | https://github.com/openstack-attic/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#authentication-responses | 03:39 |
| ayoung | JOY | 03:39 |
| ayoung | we broke the links! | 03:39 |
| lbragstad | dolphm: we do that on decrypt? | 03:39 |
| dolphm | lbragstad: we can / should | 03:40 |
| lbragstad | dolphm: I thought we just passed the created at and expires at time | 03:40 |
| lbragstad | oh | 03:40 |
| morganfainberg | ayoung, yep | 03:40 |
| morganfainberg | ayoung, there is a reason for that | 03:40 |
| morganfainberg | ayoung, don't use identity-api repo. | 03:40 |
| ayoung | morganfainberg, we broken all options | 03:40 |
| morganfainberg | it wasn't maintained and people were wrongly filing bugs against it | 03:40 |
| ayoung | the link was from the public site | 03:41 |
| morganfainberg | http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html | 03:41 |
| ayoung | it was a link to the identity7 api repo | 03:41 |
| morganfainberg | http://specs.openstack.org/openstack/keystone-specs/api/v2.0/identity-api-v2.0.html | 03:41 |
| morganfainberg | we need to update that link then | 03:41 |
| morganfainberg | to the correct / maintained version | 03:41 |
| ayoung | http://developer.openstack.org/api-ref-identity-v3.html#identity-v3-ext | 03:41 |
| morganfainberg | ayoung, that still loads for me | 03:42 |
| morganfainberg | http://developer.openstack.org/api-ref-identity-v3.html#identity-v3-ext | 03:42 |
| ayoung | morganfainberg, it doesn't matter: I think we fail to documkent where oauth data should be in the token anyway | 03:42 |
| dolphm | lbragstad: worst case (if we want to stick to the recipes layer), we can have the revocation event api call decrypt() again with a tighter ttl (that of an otherwise-matching revocation event), but that would be gross | 03:42 |
| ayoung | the reading of the spec is ambiguous enought: | 03:42 |
| ayoung | it just says in the token data. | 03:42 |
| lbragstad | dolphm: yeah, I could see where that might be misleading | 03:43 |
| dolphm | lbragstad: according to the fernet spec, the create timestamp should just be ... encrypted[9:9+64] | 03:43 |
| morganfainberg | dolphm, thats the fernet one? | 03:43 |
| dolphm | morganfainberg: yes | 03:43 |
| ayoung | jamielennox, OK....I think we got it for trusts, though. and it is inside the "token" section | 03:43 |
| ayoung | https://github.com/openstack-attic/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-trust-ext.md#consuming-a-trust-with-post-authtokens | 03:43 |
| dolphm | lbragstad: i'm probably off by one... [8:8+64] | 03:44 |
| jamielennox | ayoung: isn't token the outer layer for v3 tokens? | 03:44 |
| *** spandhe has joined #openstack-keystone | 03:44 | |
| ayoung | jamielennox, | 03:44 |
| ayoung | I'll link to the review...maybe I have bad logic | 03:44 |
| ayoung | jamielennox, https://review.openstack.org/#/c/138519/12/keystoneclient/models/builder.py,cm | 03:45 |
| morganfainberg | ayoung, the attic one is very much out of date | 03:45 |
| ayoung | https://review.openstack.org/#/c/138519/12/keystoneclient/models/builder.py,cm | 03:46 |
| ayoung | or better yet | 03:46 |
| ayoung | https://review.openstack.org/#/c/138519/12/keystoneclient/models/builder.py,unified | 03:46 |
| morganfainberg | ayoung, http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-trust-ext.html#consuming-a-trust is the one you're looking for to include any new spec stuff | 03:46 |
| morganfainberg | such as redelegation | 03:46 |
| morganfainberg | etc | 03:46 |
| ayoung | def _build_token_values_v3(self, token_data) | 03:46 |
| *** tqtran has quit IRC | 03:47 | |
| ayoung | morganfainberg, actually, I wanted the /identity-api.html, but close enough | 03:47 |
| morganfainberg | sure | 03:47 |
| ayoung | as I wanted what we actually showed in the complete tokne | 03:47 |
| ayoung | token | 03:47 |
| *** spandhe_ has joined #openstack-keystone | 03:47 | |
| jamielennox | ayoung: you sure you want this in client? how about keystone-common as a library? | 03:48 |
| ayoung | jamielennox, I want keystone-common as a library | 03:48 |
| ayoung | but I'm learning a metric ton about how the client is using it. | 03:48 |
| *** spandhe has quit IRC | 03:48 | |
| *** spandhe_ is now known as spandhe | 03:48 | |
| ayoung | and that is catching alot of my errors | 03:49 |
| dolphm | lbragstad: actually i think the timestamp is base64.urlsafe_b64decode(encrypted)[1:8] (but that's still just bytes) | 03:49 |
| jamielennox | ayoung: awesome | 03:50 |
| ayoung | jamielennox, I wouldn't have caught this one if not for the client... | 03:50 |
| ayoung | I've backed off on tryiung to use it for V2 tokens | 03:50 |
| ayoung | probably should chop that code out completely for the first round | 03:51 |
| ayoung | but we'll need it for enforcing policty...which is why I origianlly did all this | 03:51 |
| * ayoung goes looking for a brick wall in his house | 03:51 | |
| lbragstad | dolphm: dumb question, is the time stamp an int? | 03:52 |
| lbragstad | or a string? | 03:52 |
| dolphm | lbragstad: i'm trying to figure that out | 03:53 |
| dolphm | >>> bytes(base64.urlsafe_b64decode(encrypted)[1:8]) | 03:53 |
| dolphm | '\x00\x00\x00\x00T\xeb\xf1' | 03:53 |
| dolphm | or maybe i need to decode the whole thing first :P | 03:54 |
| dolphm | oh wait, i am | 03:54 |
| dolphm | base64.urlsafe_b64decode(encrypted)[0:1] comes out as expected: the fernet version 0x80 (the first and only version) | 03:54 |
| *** stevemar has quit IRC | 03:55 | |
| *** stevemar has joined #openstack-keystone | 03:55 | |
| *** ChanServ sets mode: +v stevemar | 03:55 | |
| *** himangi has quit IRC | 03:55 | |
| dolphm | lbragstad: Timestamp: This field is a 64-bit unsigned big-endian integer. It records the number of seconds elapsed between January 1, 1970 UTC and the time the token was created. | 04:00 |
| dolphm | https://github.com/fernet/spec/blob/master/Spec.md | 04:00 |
| *** chrisshattuck has joined #openstack-keystone | 04:00 | |
| lbragstad | dolphm: sweet | 04:00 |
| dolphm | lbragstad: YAY | 04:04 |
| dolphm | lbragstad: >>> print(datetime.datetime.fromtimestamp(struct.unpack(">Q", str(base64.urlsafe_b64decode(encrypted)[1:9]))[0]).strftime('%Y-%m-%d %H:%M:%S')) | 04:04 |
| dolphm | 2015-02-24 03:35:03 | 04:04 |
| dolphm | lbragstad: it's 4:04 UTC now, so that means it almsot took me 30 minutes to figure out how to do that | 04:04 |
| lbragstad | dolphm: lol, that string needs a comment | 04:05 |
| dolphm | lbragstad: i can do that one sec | 04:05 |
| dolphm | lbragstad: # base64 decode the ciphertext and slice the 8-byte timestamp, starting from the second byte, unpacking it into an unsigned long-long, and string format it into a human-recognizable datetime of the token's creation time | 04:08 |
| dolphm | you can also simplify it to: | 04:08 |
| dolphm | print(datetime.datetime.fromtimestamp(struct.unpack(">Q", base64.urlsafe_b64decode(encrypted)[1:9])[0]).strftime('%Y-%m-%d %H:%M:%S')) | 04:08 |
| ayoung | morganfainberg, which hotel did you end up going with. I just realized I have not reserved yet | 04:08 |
| lbragstad | dolphm: +2 | 04:09 |
| lbragstad | dolphm: works for me! | 04:09 |
| dolphm | lbragstad: i wouldn't consider that to be toooooo hazmatty | 04:09 |
| dolphm | just make sure you slice the correct bytes | 04:10 |
| dolphm | lbragstad: rip out those create times! | 04:10 |
| stevemar | dolphm, go home | 04:11 |
| dolphm | stevemar: i... already am home | 04:11 |
| stevemar | morganfainberg, so what's on the chopping block for tomorrow? | 04:11 |
| stevemar | dolphm, but are *home* | 04:11 |
| stevemar | are you* | 04:11 |
| dolphm | stevemar: i... was? | 04:12 |
| * lbragstad is lost | 04:13 | |
| stevemar | dolphm, keystone has missed the dolphinator | 04:14 |
| *** harlowja is now known as harlowja_away | 04:14 | |
| *** harlowja_away is now known as harlowja | 04:15 | |
| morganfainberg | stevemar, i haven't looked at the specs yet | 04:15 |
| morganfainberg | ayoung, uh | 04:16 |
| morganfainberg | ayoung, waterfront? | 04:16 |
| morganfainberg | fairmont | 04:16 |
| morganfainberg | something | 04:16 |
| morganfainberg | i might be changing to a westin though | 04:16 |
| ayoung | Nice! | 04:16 |
| dolphm | stevemar: lol *hugs* | 04:16 |
| openstackgerrit | Merged openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 04:16 |
| morganfainberg | but haven't thought much about it | 04:16 |
| ayoung | stevemar, dolphm lbragstad you guys picked a hotel yet? | 04:16 |
| dolphm | ayoung: yeah, uhh | 04:16 |
| * morganfainberg needs to book flights | 04:17 | |
| *** devlaps has joined #openstack-keystone | 04:17 | |
| morganfainberg | but that is a bigger deal. | 04:17 |
| morganfainberg | devlaps, shouldn't you be at home w/ your family or something? ;) | 04:17 |
| stevemar | Delta Vancouver Suites Hotel | 04:17 |
| *** ajayaa has joined #openstack-keystone | 04:17 | |
| stevemar | ayoung, ^ | 04:17 |
| devlaps | i am. at home and coding :) | 04:17 |
| stevemar | 550 West Hastings St, Vancouver CA | 04:18 |
| morganfainberg | devlaps, but not hacking on keystone :( i see how it is.. you don't <3 us anymore | 04:18 |
| morganfainberg | :P | 04:18 |
| devlaps | mortganfainberg: that can be fixed :) plenty of keystone <3 | 04:18 |
| morganfainberg | so hack on some keystone code! | 04:18 |
| morganfainberg | ;) | 04:19 |
| dolphm | ayoung: i, uhh, made an excel https://docs.google.com/spreadsheets/d/16Y4yvjqG19PIXIsPTZYu4gv_SMT9ZiJHQaOaqPwyDjM/edit?usp=sharing | 04:19 |
| morganfainberg | ooh that reminds me need to book hotel for april thing | 04:19 |
| devlaps | morganfainberg: will do :) | 04:19 |
| morganfainberg | oh fun | 04:20 |
| morganfainberg | i get to go to DC april 26 and 27 i think | 04:20 |
| *** MasterPiece has joined #openstack-keystone | 04:20 | |
| stevemar | dolphm, i feel that excel is overly detailed | 04:21 |
| *** samueldmq has quit IRC | 04:22 | |
| stevemar | dolphm, unless you are bringing a pet, i feel a pet column is not needed | 04:23 |
| dolphm | stevemar: people might have allergies in places where pets are allowed | 04:23 |
| dolphm | stevemar: i was considerate | 04:23 |
| stevemar | this is hilarious | 04:23 |
| morganfainberg | dolphm, 70ft yact? | 04:23 |
| dolphm | morganfainberg: that was the original goal | 04:24 |
| morganfainberg | but no internetz | 04:24 |
| *** radez is now known as radez_g0n3 | 04:24 | |
| morganfainberg | now i feel like i need to switch and get the 70ft yact... :P | 04:25 |
| ayoung | dolphm, very nice... | 04:25 |
| stevemar | delta suites is 10 min walk | 04:25 |
| ayoung | I just wanted an indoor ppol | 04:25 |
| dolphm | stevemar: why walk when a yacht can drop you off at the convention center | 04:25 |
| stevemar | dolphm, you have a good point there | 04:26 |
| dolphm | ayoung: why have an indoor pool when you can have an outdoor ocean? | 04:26 |
| stevemar | excellent points all around | 04:26 |
| morganfainberg | the real winner: https://www.airbnb.com/rooms/5067214?checkin=05%2F17%2F2015&checkout=05%2F23%2F2015&guests=5&s=rZnE | 04:26 |
| stevemar | former mayor | 04:26 |
| ayoung | because it is Canada and don't think I want to swim in the Ocean that far north in May. Even late may. | 04:27 |
| morganfainberg | ayoung, def. not on the west coast | 04:27 |
| morganfainberg | on the east coast... it's warmer... | 04:27 |
| ayoung | morganfainberg, no sufficiently to make a difference | 04:27 |
| dolphm | morganfainberg: and that includes insurance | 04:27 |
| *** ajayaa has quit IRC | 04:28 | |
| morganfainberg | ayoung, people regularly swim maine and north... late may wouldn't be awful. people don't swim in SoCal even most of the summer w/o wet suits | 04:28 |
| morganfainberg | until you're down in like San Diego | 04:28 |
| *** richm has quit IRC | 04:28 | |
| morganfainberg | the water is way warmer on the east coast than here | 04:29 |
| morganfainberg | only $8217/night too | 04:29 |
| stevemar | oh jeez | 04:29 |
| stevemar | that airbnb is crazy | 04:30 |
| *** lhcheng_afk has joined #openstack-keystone | 04:30 | |
| morganfainberg | 6524.54 USD / night [assuming the 8k is CAD] | 04:30 |
| *** lhcheng_afk has quit IRC | 04:30 | |
| morganfainberg | 815 a night if all beds are full (8) / person [USD] | 04:30 |
| dolphm | morganfainberg: all prices are USD | 04:30 |
| morganfainberg | oh | 04:31 |
| morganfainberg | lame | 04:31 |
| *** lhcheng_afk has joined #openstack-keystone | 04:31 | |
| morganfainberg | so 1088 / night? | 04:31 |
| morganfainberg | wow CAD is really .8 USD | 04:31 |
| *** csoukup has joined #openstack-keystone | 04:32 | |
| morganfainberg | it wasn't that long ago it was almost 1:1 | 04:32 |
| morganfainberg | i love that Oriana is "relocateable" | 04:32 |
| morganfainberg | hahaha | 04:32 |
| dolphm | morganfainberg: the harbor is actually damn near the convention center already | 04:33 |
| morganfainberg | i know | 04:33 |
| dolphm | morganfainberg: i also found one in seattle that was willing to relocate | 04:33 |
| morganfainberg | hah | 04:34 |
| ayoung | Did you know that if you die in Canada you die in real life? | 04:37 |
| ayoung | http://xkcd.com/180/ | 04:37 |
| morganfainberg | lol | 04:37 |
| lbragstad | ayoung: no hotel yet | 04:37 |
| *** markvoelker has quit IRC | 04:39 | |
| *** markvoelker has joined #openstack-keystone | 04:39 | |
| ayoung | http://xkcd.com/195/ there is no green left now | 04:40 |
| ayoung | bed | 04:43 |
| *** ayoung has quit IRC | 04:43 | |
| *** ccard_ has joined #openstack-keystone | 04:43 | |
| *** markvoelker has quit IRC | 04:44 | |
| *** ccard__ has quit IRC | 04:45 | |
| dolphm | morganfainberg: the Oriana also includes two Marquipt hydraulic 3500 lb. capacity cranes | 04:45 |
| morganfainberg | i don't know what i'd do with those | 04:46 |
| morganfainberg | but.. something? | 04:46 |
| dolphm | morganfainberg: well then may i sell you on the 10 cu. ft bar refrigerator and Mansfield vacuum toilet system? | 04:46 |
| morganfainberg | haha | 04:46 |
| dolphm | morganfainberg: i wonder if the microwave interferes with the Simrad flybridge radar system | 04:47 |
| dolphm | i need a 16" hydraulic bow thruster in my life | 04:48 |
| jamielennox | dolphm: why do you care about pets | 04:52 |
| dolphm | jamielennox: allergies | 04:52 |
| jamielennox | oh these are mostly airbnbs | 04:53 |
| dolphm | jamielennox: all but 4 or 5 | 04:53 |
| dolphm | jamielennox: was looking for a better value than hotels | 04:53 |
| jamielennox | apparently not having modify permissions means you can't change the size of columns so couldn't tell | 04:53 |
| *** krtaylor has quit IRC | 04:55 | |
| *** spandhe has quit IRC | 04:59 | |
| morganfainberg | o.m.g. | 04:59 |
| morganfainberg | https://www.youtube.com/watch?v=6M-YX-r0Ll4 | 04:59 |
| *** MasterPiece has quit IRC | 05:00 | |
| jamielennox | stevemar: so if the federation stuff you are doing is just CRUD based you can probably do it in regular ksc | 05:00 |
| stevemar | jamielennox, oh hai | 05:03 |
| *** ajayaa has joined #openstack-keystone | 05:04 | |
| stevemar | jamielennox, basically i just need to post something to /auth/os-federation/saml | 05:04 |
| stevemar | + service provider CRUD (but that's unrelated) | 05:04 |
| jamielennox | i think that stuff is ok in ksc | 05:05 |
| jamielennox | we don't have an extensions mechanism | 05:05 |
| jamielennox | and i don't want to start doing managers and stuff outside | 05:05 |
| *** krtaylor has joined #openstack-keystone | 05:07 | |
| *** c_soukup has joined #openstack-keystone | 05:09 | |
| stevemar | jamielennox, yeah the manager bits were making me wary of adding to ksc-federation | 05:09 |
| *** csoukup_ has joined #openstack-keystone | 05:10 | |
| *** markvoelker has joined #openstack-keystone | 05:10 | |
| *** csoukup has quit IRC | 05:13 | |
| *** c_soukup has quit IRC | 05:14 | |
| *** krtaylor has quit IRC | 05:14 | |
| *** lhcheng_afk has quit IRC | 05:15 | |
| *** devlaps has quit IRC | 05:17 | |
| *** MasterPiece has joined #openstack-keystone | 05:17 | |
| *** markvoelker has quit IRC | 05:17 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Cleanup policy related bits in tests https://review.openstack.org/158561 | 05:20 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove policy parsing exception https://review.openstack.org/158562 | 05:22 |
| *** krtaylor has joined #openstack-keystone | 05:26 | |
| *** csoukup_ has quit IRC | 05:32 | |
| *** jamielennox is now known as jamielennox|away | 05:33 | |
| *** chrisshattuck has quit IRC | 05:33 | |
| *** jamielennox|away is now known as jamielennox | 05:34 | |
| *** lhcheng_afk has joined #openstack-keystone | 05:34 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 05:42 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 05:42 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Emit failure notifications for CADF audits events https://review.openstack.org/156905 | 05:42 |
| morganfainberg | stevemar, you have no idea how much i hate passing info to methods just so a decorator can consume it | 05:43 |
| morganfainberg | stevemar, i think we're doing something horribly wrong if that is a pattern | 05:43 |
| stevemar | morganfainberg, i equally hate it and think it's silly as balls | 05:43 |
| morganfainberg | stevemar what was the result w/ bkudson and thread.local | 05:43 |
| stevemar | but the only option was equally hated | 05:43 |
| stevemar | he hatd it | 05:43 |
| morganfainberg | because tbh, i want to say no on principle on the current thing | 05:43 |
| morganfainberg | like remove the decorators level of no | 05:43 |
| stevemar | i'm kinda stuck here | 05:44 |
| morganfainberg | and emit directly from the controller | 05:44 |
| morganfainberg | not the manager. | 05:44 |
| stevemar | morganfainberg, we could do that | 05:44 |
| morganfainberg | i think this is a sign the decorators do not work for us | 05:44 |
| stevemar | it's forcing a puzzle piece to fit | 05:45 |
| morganfainberg | is my issue. if you are passing data into a method so a decorator can use it, you're doing it wrong. | 05:45 |
| stevemar | i 100% agree | 05:45 |
| stevemar | but it's the only way to get the darn data | 05:45 |
| morganfainberg | so either we use initiator for emit in the methods | 05:45 |
| morganfainberg | or we thread.local it | 05:45 |
| morganfainberg | so, i'd just rip the decorators out and make the methods emit the notifications directly | 05:45 |
| morganfainberg | at least it'd be easier to follow. and it open the door to do smarter (not only at start/end) notifications | 05:46 |
| morganfainberg | so, instead of decorator, use a direct emit call in the manager method.. probably the cleanest option | 05:46 |
| stevemar | blah | 05:46 |
| stevemar | i want my stuff in first :) | 05:46 |
| stevemar | then refactor | 05:46 |
| morganfainberg | stevemar, i'm not ok with this impl. | 05:46 |
| stevemar | but i understand if that isn't good | 05:47 |
| morganfainberg | stevemar, i'll help you do this if you need | 05:47 |
| stevemar | that'd be great | 05:47 |
| morganfainberg | can probably whip up the change tonight after food. | 05:47 |
| stevemar | sure, we can iterate on it together | 05:47 |
| morganfainberg | then we can add the initiator / stuff after on top | 05:47 |
| morganfainberg | btw, you know if we move to pecan we get the thread.local for free >.> | 05:48 |
| morganfainberg | because thats just how it works | 05:48 |
| stevemar | i'm switching through too many things right now, the mental context switching is kicking my ass | 05:48 |
| morganfainberg | ok i'll propose a couple changes for notifications tonight and rebase your stuff on top of it if i can | 05:48 |
| morganfainberg | depending on tired | 05:49 |
| morganfainberg | vs not tired | 05:49 |
| stevemar | okay, i'll be up a few more hours anyway, gotta do a few more things by tomorrow | 05:49 |
| morganfainberg | i wont be starting for an hour or so. | 05:49 |
| morganfainberg | need fooodz | 05:49 |
| morganfainberg | time for pizza | 05:49 |
| morganfainberg | :) | 05:49 |
| stevemar | noice | 05:50 |
| morganfainberg | stevemar, yeah sorry man. this just an absolutely awful pattern i don't want to encourage. if we're doing it this way we're def. doing it wrong :{ | 05:50 |
| stevemar | no, it | 05:50 |
| stevemar | it's fine | 05:50 |
| stevemar | just getting antsy to get stuff finished before ff | 05:51 |
| morganfainberg | stevemar, can i get https://review.openstack.org/#/c/155901/ a +2/+a on that? | 05:51 |
| morganfainberg | should be easy | 05:51 |
| stevemar | +3 | 05:51 |
| *** atmark1 has left #openstack-keystone | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/158572 | 06:04 |
| stevemar | i bet openstack proposal bot has so many commits, probably not much of a reviewer though | 06:05 |
| stevemar | jamielennox, also about the samlize token for ksc, you okay with having token_id as one of the arguments? | 06:06 |
| jamielennox | umm | 06:07 |
| stevemar | i am wondering if it's better to dig that out of the auth_ref | 06:07 |
| morganfainberg | jamielennox: not sure why -kerberos is broken in pypi. Might ask you to make me an owner so I can poke it with a stick. | 06:07 |
| jamielennox | i don't see how it's much better | 06:07 |
| jamielennox | morganfainberg: sure | 06:08 |
| morganfainberg | Gonna bug infra more about it tmrrow. | 06:08 |
| morganfainberg | In either case. | 06:08 |
| jamielennox | morganfainberg: pypi username? | 06:08 |
| morganfainberg | Uhm. Uhhhhhh | 06:08 |
| jamielennox | stevemar: i think token_id is better | 06:08 |
| jamielennox | marginally but whatever | 06:09 |
| morganfainberg | Look at kite, I should be an owner. Mdrnstm maybe? | 06:09 |
| jamielennox | did we release kite | 06:09 |
| morganfainberg | Nope | 06:09 |
| jamielennox | https://pypi.python.org/pypi/kite - 404 | 06:09 |
| jamielennox | we should reserve that | 06:09 |
| jamielennox | one of these days i want to finish it | 06:09 |
| morganfainberg | Kite client. | 06:09 |
| morganfainberg | That one I know I registered. | 06:09 |
| morganfainberg | Python-kiteclient. | 06:10 |
| jamielennox | morganfainberg: gave you owner on -kerberos | 06:10 |
| *** harlowja is now known as harlowja_away | 06:11 | |
| *** markvoelker has joined #openstack-keystone | 06:13 | |
| jamielennox | Server response (403): You are not allowed to store 'kite' package information | 06:13 |
| jamielennox | if kite exists why do i get 404 on /pypi/kite? | 06:14 |
| *** _cjones_ has joined #openstack-keystone | 06:14 | |
| jamielennox | kite exists on the index page: https://pypi.python.org/simple/ with no information - and a dead link | 06:16 |
| jamielennox | gogo pypi UI | 06:16 |
| *** lhcheng_afk has quit IRC | 06:17 | |
| *** markvoelker has quit IRC | 06:17 | |
| *** _cjones_ has quit IRC | 06:20 | |
| marekd | morganfainberg: looking at the patch. | 06:38 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revamp the documentation surrounding notifications https://review.openstack.org/126180 | 06:39 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 06:41 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Emit failure notifications for CADF audits events https://review.openstack.org/156905 | 06:41 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revamp the documentation surrounding notifications https://review.openstack.org/126180 | 06:41 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 06:41 |
| morganfainberg | stevemar, so | 06:42 |
| stevemar | morganfainberg, hola | 06:42 |
| morganfainberg | stevemar, only question i have is... what is your feeling on naming of these new notiiers | 06:42 |
| stevemar | morganfainberg, i don't care | 06:42 |
| morganfainberg | i can do one of two things... 1: make a magic wrapper that makes it so you can call it either as decorator or function.. oor | 06:43 |
| stevemar | (not trying to sound snippy) | 06:43 |
| morganfainberg | find some random name :P | 06:43 |
| stevemar | morganfainberg, i'd like it if audit was in the name | 06:44 |
| stevemar | audit_event, audit notification | 06:44 |
| morganfainberg | so .. instead of notifications.created, notifications.audit_created ? | 06:44 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add documentation for key terms and basic authenticating https://review.openstack.org/152018 | 06:46 |
| stevemar | morganfainberg, shoot i'd like it to be just in audit.py (so it's called as audit.created) but i think that'll be too hard | 06:47 |
| morganfainberg | actually. hm. | 06:47 |
| stevemar | notifications.audit_created would work for me | 06:47 |
| morganfainberg | i think thats doable. | 06:48 |
| morganfainberg | i think i'm going to keep it notifications for this change we can move it later if needed | 06:48 |
| *** rushiagr_away is now known as rushiagr | 06:49 | |
| *** lhcheng_afk has joined #openstack-keystone | 06:49 | |
| stevemar | morganfainberg, makes sense | 06:50 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Classifying extensions and defining process https://review.openstack.org/146793 | 06:57 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add links to extensions that point to api specs https://review.openstack.org/147311 | 06:58 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Implements whitelist and blacklist mapping rules https://review.openstack.org/142573 | 06:58 |
| *** lhcheng_afk has quit IRC | 07:04 | |
| *** MasterPiece has quit IRC | 07:09 | |
| marekd | morganfainberg: how heavily are we relying memcached now? (are we trying to cache as much as possible?) | 07:16 |
| morganfainberg | marekd, uhm | 07:16 |
| morganfainberg | marekd, only when it's turned on | 07:16 |
| morganfainberg | marekd, and configured | 07:16 |
| morganfainberg | marekd, some things but not everything | 07:16 |
| marekd | and sqlalchemy has some internal caching layer ? | 07:17 |
| morganfainberg | marekd, eh, kindof, but usually you layer dogpile in directly as well | 07:18 |
| *** mzbik has joined #openstack-keystone | 07:19 | |
| morganfainberg | i think | 07:19 |
| *** xavpaice has joined #openstack-keystone | 07:25 | |
| *** MasterPiece has joined #openstack-keystone | 07:26 | |
| stevemar | jamielennox, can you update https://blueprints.launchpad.net/keystone/+spec/unscoped-catalog - i think it's done? | 07:34 |
| *** chlong has quit IRC | 07:34 | |
| stevemar | or if it's targeted to a release or not | 07:34 |
| marekd | stevemar: https://review.openstack.org/#/c/126180/14..16/doc/source/event_notifications.rst,cm where is event_type here? | 07:41 |
| stevemar | line 42 | 07:42 |
| *** rushiagr is now known as rushiagr_away | 07:42 | |
| stevemar | also lines 226, 270, 313, 368 | 07:42 |
| openstackgerrit | Abhishek Kekane proposed openstack/keystone: Eventlet green threads not released back to pool https://review.openstack.org/130824 | 07:43 |
| marekd | stevemar: ah, thanks. Gerrit hid it from me and I didn't expand full page. | 07:43 |
| stevemar | marekd, s'all good | 07:43 |
| morganfainberg | stevemar, almost have the additional notifiers in place | 07:44 |
| morganfainberg | stevemar, running tests now. | 07:44 |
| openstackgerrit | Merged openstack/keystone: Add oslo request id middleware to keystone paste pipeline https://review.openstack.org/155901 | 07:52 |
| stevemar | morganfainberg, ++ | 08:02 |
| morganfainberg | hmm | 08:05 |
| morganfainberg | stevemar, ok having a test issue. | 08:07 |
| morganfainberg | stevemar, posting the code while i hunt why this isn't working. | 08:07 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 08:07 |
| morganfainberg | stevemar, it's not calling the callbacks :( | 08:09 |
| stevemar | morganfainberg, i don't think you want the internal classmethod there, since it's internal and not worth auditing | 08:11 |
| morganfainberg | yah probably | 08:11 |
| stevemar | the callbacks are tricky | 08:11 |
| morganfainberg | i know... i wrote a bunch of that code :P | 08:11 |
| morganfainberg | or re-wrote it | 08:11 |
| stevemar | didn't want to place these at the controller level and keep them decorator? | 08:16 |
| stevemar | that way we get context | 08:16 |
| morganfainberg | nah. | 08:16 |
| morganfainberg | because the controllers could call many things on maangers | 08:16 |
| morganfainberg | this way we always catch the events, you can't "go around" a controller | 08:17 |
| morganfainberg | ok this is wierd | 08:22 |
| morganfainberg | it's not looping through the subscribers... | 08:22 |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/158572 | 08:22 |
| morganfainberg | the dict looks correct... | 08:23 |
| morganfainberg | oh derp | 08:25 |
| *** henrynash has joined #openstack-keystone | 08:29 | |
| *** ChanServ sets mode: +v henrynash | 08:29 | |
| morganfainberg | stevemar, ^^ | 08:30 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 08:30 |
| morganfainberg | erm that one | 08:30 |
| stevemar | hehe, that was derpy | 08:32 |
| morganfainberg | stevemar, going to rebase your non-doc changes on this one. but not doc ones, those should prob not be inline unless they need to be | 08:32 |
| morganfainberg | stevemar, do they need to be? | 08:32 |
| morganfainberg | s/inline/in the chain | 08:33 |
| stevemar | there's only 1 doc one, the chained up ones should be merged on top | 08:33 |
| morganfainberg | so i should rebase mine on your doc one? | 08:33 |
| morganfainberg | then yours on this one? | 08:33 |
| morganfainberg | or well, guess that doesn't matter much | 08:33 |
| stevemar | morganfainberg, the doc one can go in solo, no big deal there | 08:35 |
| morganfainberg | ok i will let the doc one stay as is then | 08:35 |
| stevemar | morganfainberg, i'm confused on how this will handle the case where the operation fails, i guess wrap things in a try/catch | 08:36 |
| stevemar | errr try/except | 08:36 |
| morganfainberg | stevemar, currently we don't emit a cadf for these on failure | 08:36 |
| morganfainberg | we try/except and raise the execpt before notifications are sent | 08:36 |
| morganfainberg | oh https://review.openstack.org/#/c/156905/ | 08:37 |
| stevemar | morganfainberg, yep, i had a patch for.. yep | 08:37 |
| stevemar | i think that was the one benefit of using decorators | 08:37 |
| morganfainberg | yeah but the pattern really makes my skin crawl | 08:38 |
| stevemar | but tbh, that is value-add, the goal was parity with existing notifications | 08:38 |
| morganfainberg | so we can try/catch | 08:38 |
| morganfainberg | and do the same thing. | 08:38 |
| stevemar | yeah | 08:38 |
| morganfainberg | it's not automatic | 08:38 |
| stevemar | just change outcome | 08:38 |
| morganfainberg | yeah. | 08:38 |
| morganfainberg | totally doable. | 08:38 |
| stevemar | so don't bother trying to rebase that one, unless you are feeling brave | 08:38 |
| morganfainberg | eh. i'll do that tmmrow | 08:38 |
| morganfainberg | this one should be straight forward | 08:39 |
| morganfainberg | https://review.openstack.org/#/c/155660/4 | 08:39 |
| morganfainberg | just a bunch of things to change. | 08:39 |
| morganfainberg | but still straight forward | 08:39 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revamp the documentation surrounding notifications https://review.openstack.org/126180 | 08:39 |
| stevemar | rebased to master ^ | 08:40 |
| stevemar | at least most of the work was good :P just the initiator | 08:40 |
| stevemar | which should also be enhanced to get the project id too... | 08:41 |
| stevemar | of the user | 08:41 |
| *** pnavarro has joined #openstack-keystone | 08:51 | |
| *** jistr has joined #openstack-keystone | 08:54 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enable endpoint_policy, endpoint_filter and oauth by default https://review.openstack.org/153842 | 08:56 |
| stevemar | marekd, ^^ just a rebase | 08:56 |
| marekd | stevemar: re+2'd both patches. :-) | 08:57 |
| stevemar | \o/ | 08:57 |
| *** swartulv has quit IRC | 09:04 | |
| marekd | stevemar: still here? | 09:06 |
| morganfainberg | stevemar, so i think i have these done. | 09:06 |
| marekd | so, the remite_id must be unique and the only constraint is websso | 09:06 |
| morganfainberg | stevemar, i am going to push this, its been a lot of mucking around to get there. | 09:06 |
| marekd | remember that we get identity_provider object from remote_id | 09:06 |
| stevemar | marekd, i'm here | 09:07 |
| stevemar | morganfainberg, sounds good | 09:07 |
| morganfainberg | stevemar i apologize if i blow this one up :P | 09:08 |
| stevemar | marekd, really it *must be* unique, bah | 09:08 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 09:08 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 09:08 |
| marekd | stevemar: hm? | 09:08 |
| stevemar | morganfainberg, i don't think you should have removed the decorators | 09:10 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 09:10 |
| openstackgerrit | Merged openstack/keystone: Classifying extensions and defining process https://review.openstack.org/146793 | 09:10 |
| morganfainberg | stevemar, why? | 09:10 |
| stevemar | morganfainberg, i thought the internal callbacks still needed them | 09:11 |
| morganfainberg | nope, just replaced all that | 09:11 |
| morganfainberg | the internal callbacks are called via the same mechanism | 09:11 |
| morganfainberg | i just replicatdd the logic | 09:11 |
| morganfainberg | having a decorator for the sake of a decorator is bad. | 09:11 |
| morganfainberg | have some bugs still in notifications not being sent. but imminently fixabler | 09:12 |
| stevemar | i'll have to pull this down and play around | 09:13 |
| morganfainberg | basically instead of having a notifier decorator, notifications are called directly inline | 09:13 |
| morganfainberg | of the function | 09:13 |
| morganfainberg | and there are some bugs to still squash in the testing, i'm seeing them go by | 09:14 |
| stevemar | morganfainberg, found at least one mistake | 09:14 |
| morganfainberg | but should be easy to fix | 09:14 |
| morganfainberg | yeah i needed to post to gerrit to move to my test vm | 09:15 |
| stevemar | keystone/identity/core.py -> notifications._ACTIONS.deleted -> notifications.Audit.deleted | 09:15 |
| morganfainberg | yeah | 09:15 |
| morganfainberg | thats the one i'm seeing mostly | 09:15 |
| morganfainberg | stevemar, have that fixed in the next patch | 09:16 |
| morganfainberg | just waiting for tests to run locally | 09:16 |
| *** markvoelker has joined #openstack-keystone | 09:17 | |
| *** karimb has joined #openstack-keystone | 09:21 | |
| *** markvoelker has quit IRC | 09:22 | |
| *** karimb has quit IRC | 09:23 | |
| *** aix has quit IRC | 09:25 | |
| *** karimb has joined #openstack-keystone | 09:27 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 09:27 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 09:27 |
| morganfainberg | stevemar, ^^ fixed | 09:27 |
| morganfainberg | and passes all tests now | 09:27 |
| morganfainberg | stevemar, i'll rebase the failure one tomorrow and then deprecated the decorator versions | 09:29 |
| *** henrynash has quit IRC | 09:30 | |
| stevemar | marekd, instead of adding us 1 at a time, type in keystone-core in gerrit ui :) | 09:31 |
| stevemar | morganfainberg, i'll look at it tomorrow | 09:31 |
| *** stevemar has quit IRC | 09:34 | |
| marekd | stevemar, oh i didn't know that. Thanks! | 09:35 |
| *** openstackgerrit has quit IRC | 09:36 | |
| *** openstackgerrit has joined #openstack-keystone | 09:36 | |
| *** himangi has joined #openstack-keystone | 09:40 | |
| *** nellysmitt has joined #openstack-keystone | 09:44 | |
| *** jaosorior has joined #openstack-keystone | 09:50 | |
| *** aix has joined #openstack-keystone | 09:52 | |
| *** harlowja_away has quit IRC | 10:04 | |
| *** himangi has quit IRC | 10:08 | |
| *** markvoelker has joined #openstack-keystone | 10:18 | |
| *** markvoelker has quit IRC | 10:23 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 10:23 |
| *** fmarco76 has joined #openstack-keystone | 10:24 | |
| *** aix has quit IRC | 10:30 | |
| *** himangi has joined #openstack-keystone | 10:33 | |
| *** jamielennox is now known as jamielennox|away | 10:42 | |
| *** aix has joined #openstack-keystone | 10:43 | |
| *** jamielennox|away is now known as jamielennox | 10:58 | |
| *** himangi has quit IRC | 10:58 | |
| *** jamielennox is now known as jamielennox|away | 11:01 | |
| *** jamielennox|away is now known as jamielennox | 11:02 | |
| *** henrynash has joined #openstack-keystone | 11:02 | |
| *** ChanServ sets mode: +v henrynash | 11:02 | |
| *** jamielennox is now known as jamielennox|away | 11:08 | |
| *** jamielennox|away is now known as jamielennox | 11:10 | |
| *** markvoelker has joined #openstack-keystone | 11:19 | |
| *** dims has joined #openstack-keystone | 11:20 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Implements whitelist and blacklist mapping rules https://review.openstack.org/142573 | 11:21 |
| *** markvoelker has quit IRC | 11:24 | |
| *** jamielennox is now known as jamielennox|away | 11:38 | |
| *** diegows has joined #openstack-keystone | 11:39 | |
| *** jamielennox|away is now known as jamielennox | 11:41 | |
| *** MasterPiece has quit IRC | 11:44 | |
| *** henrynash has quit IRC | 11:52 | |
| *** himangi has joined #openstack-keystone | 11:54 | |
| *** chlong has joined #openstack-keystone | 11:56 | |
| *** markvoelker has joined #openstack-keystone | 12:05 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug in SQL when honoring driver_hints https://review.openstack.org/158412 | 12:07 |
| *** markvoelker has quit IRC | 12:11 | |
| *** henrynash has joined #openstack-keystone | 12:24 | |
| *** ChanServ sets mode: +v henrynash | 12:24 | |
| *** ajayaa has quit IRC | 12:31 | |
| *** amakarov_away is now known as amakarov | 12:35 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Fix for KVS cache backend incompatible with redis-py https://review.openstack.org/153307 | 12:35 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 12:36 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 12:36 |
| *** chlong has quit IRC | 12:44 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Refactor and provide scaffolding for domain specific loading https://review.openstack.org/157701 | 13:00 |
| openstackgerrit | henry-nash proposed openstack/keystone: Implement backend driver support for domain config https://review.openstack.org/158051 | 13:01 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 13:03 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 13:03 |
| *** markvoelker has joined #openstack-keystone | 13:06 | |
| *** himangi has quit IRC | 13:09 | |
| *** markvoelker has quit IRC | 13:11 | |
| *** jamielennox is now known as jamielennox|away | 13:18 | |
| *** jamielennox|away is now known as jamielennox | 13:20 | |
| *** radez_g0n3 is now known as radez | 13:25 | |
| *** gordc has joined #openstack-keystone | 13:28 | |
| *** rushiagr_away is now known as rushiagr | 13:43 | |
| *** ioram has joined #openstack-keystone | 13:44 | |
| *** csoukup has joined #openstack-keystone | 13:50 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Chain a trust with a role specified by name https://review.openstack.org/148642 | 13:56 |
| *** bknudson has joined #openstack-keystone | 13:57 | |
| *** ChanServ sets mode: +v bknudson | 13:57 | |
| *** radez is now known as radez_g0n3 | 13:59 | |
| *** richm has joined #openstack-keystone | 14:00 | |
| *** markvoelker has joined #openstack-keystone | 14:07 | |
| *** richm has quit IRC | 14:08 | |
| *** dims has quit IRC | 14:13 | |
| *** dims has joined #openstack-keystone | 14:13 | |
| *** nkinder has quit IRC | 14:18 | |
| *** mzbik has quit IRC | 14:19 | |
| ccard | I have keystone set up with domain-specific configuration, with one domain (testdomain1) using LDAP as the identity backend, while the default domain is using the sql backend. The "openstack user list --domain testdomain1" command works ok, and shows the users from the LDAP backend. I have also created a project (testproject1) in the testdomain1 domain ok. But if I try to do "openstack role add --domain testdomain1 --user <user> _member_" or | 14:23 |
| ccard | "openstack role add --project testproject1 --user <user> _member_" I get the error message "ERROR: openstack The request you have made requires authentication. (HTTP 401)". Any ideas? | 14:23 |
| ccard | (This is Juno) | 14:23 |
| *** joesavak has joined #openstack-keystone | 14:25 | |
| *** ljfisher has joined #openstack-keystone | 14:25 | |
| rodrigods | henrynash, makes sense to call list_projects_in_subtree(None) ? | 14:26 |
| henrynash | rodigods: what’s the context? | 14:27 |
| rodrigods | henrynash, was thinking if we could return all hierarchies | 14:28 |
| *** nellysmitt has quit IRC | 14:28 | |
| rodrigods | so we'd need to pass project_id=None to list_projects_in_subtree() | 14:28 |
| *** nellysmitt has joined #openstack-keystone | 14:29 | |
| *** nellysmitt has quit IRC | 14:29 | |
| rodrigods | I'm thinking about not allowing it, raising an exception if it is being called with project_id=None | 14:29 |
| *** nellysmitt has joined #openstack-keystone | 14:29 | |
| henrynash | rodigods: what would be the difference from that and just list_projects() | 14:29 |
| rodrigods | henrynash, no difference, actually | 14:30 |
| rodrigods | would be just a really expensive list_projects() :P | 14:30 |
| henrynash | rodigods: sounds like there isn’t probaly a reason to support it | 14:30 |
| henrynash | rodigods: and we want to avoid given people the chance to issue dumb commands :-) | 14:31 |
| rodrigods | henrynash, great :) | 14:31 |
| rodrigods | thanks henrynash | 14:31 |
| *** markvoelker has quit IRC | 14:32 | |
| *** markvoelker has joined #openstack-keystone | 14:33 | |
| *** ayoung has joined #openstack-keystone | 14:37 | |
| *** ChanServ sets mode: +v ayoung | 14:37 | |
| *** markvoelker has quit IRC | 14:38 | |
| *** abhirc has joined #openstack-keystone | 14:38 | |
| *** abhirc has quit IRC | 14:39 | |
| *** joesavak has quit IRC | 14:41 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Correct initialization order for logging to use eventlet locks https://review.openstack.org/154915 | 14:44 |
| amakarov | bknudson, greetings! I've tried to invent a solution for initialization order, please look here ^^. | 14:48 |
| bknudson | amakarov: seems way more complicated than necessary. | 14:51 |
| amakarov | bknudson, just wrote that I fear it too much for the issue :) | 14:51 |
| *** nkinder has joined #openstack-keystone | 14:52 | |
| amakarov | and also I think passing a special function to another function slowly turns code to a mess... | 14:53 |
| *** joesavak has joined #openstack-keystone | 14:53 | |
| *** nellysmitt has quit IRC | 14:55 | |
| amakarov | bknudson, I can just follow your suggestion in the comment in hope of future refactoring | 14:55 |
| bknudson | amakarov: y, it will. Eventually the functions can be put into a class, where the base class provides methods that can be overridden. | 14:55 |
| bknudson | that would be a useful refactoring. | 14:56 |
| amakarov | bknudson, ok, let's put it that way | 14:56 |
| bknudson | please. | 14:56 |
| bknudson | amakarov: you can see setup_backends does something similar... passing in methods... so those could be abstract methods instead. | 14:57 |
| bknudson | I thought this file was larger so it would be more work to create a class but it's actually only a couple of functions. | 14:57 |
| amakarov | bknudson, I understand it. Do we need a class that does _all_ the initialization with abstract overridables for specific parts? | 14:59 |
| bknudson | amakarov: maybe... I think you'll find out when you create the class. | 15:00 |
| amakarov | bknudson, got it | 15:01 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fixes some HMT internal calls https://review.openstack.org/158720 | 15:06 |
| rodrigods | henrynash, ayoung, ^ found some bugs in the already merged HMT code while implementing the new features | 15:06 |
| ayoung | rodrigods, point of process: can you try to make the change description more specific? | 15:07 |
| ayoung | " Fixes some HMT internal calls" seems to say "I've lumped a bunch of changes together" | 15:07 |
| rodrigods | ayoung, absolutely... | 15:07 |
| ayoung | and someone is going to say "split the patch" | 15:07 |
| ayoung | so | 15:07 |
| ayoung | instead say what you've fixed | 15:08 |
| rodrigods | ok | 15:08 |
| ayoung | thanks | 15:08 |
| ayoung | rodrigods, I'm on information overload. Anything you do that helps me context switch is greatly appreciated | 15:08 |
| *** joesavak has quit IRC | 15:08 | |
| rodrigods | ayoung, I understand, thanks for the feedback | 15:08 |
| openstackgerrit | Merged openstack/keystone: Remove invalid comment/statement at role manager https://review.openstack.org/158029 | 15:11 |
| *** joesavak has joined #openstack-keystone | 15:12 | |
| breton | щр | 15:12 |
| breton | oh | 15:12 |
| breton | yes, that was me who said "split the patch" | 15:13 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/157770 | 15:14 |
| marekd | God bless UTF-8 | 15:14 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:16 | |
| *** nellysmitt has joined #openstack-keystone | 15:18 | |
| marekd | while runnin unit tests a setUp() method is ran before every question, right? | 15:20 |
| bknudson | marekd: the test setUp runs before every test_ method. | 15:21 |
| marekd | bknudson: thank you. | 15:21 |
| bknudson | we seem to have very large setUps in our tests. | 15:22 |
| ayoung | Hey.... I just learned that /whois for a nick will list the channels that person is in | 15:22 |
| *** jsavak has joined #openstack-keystone | 15:23 | |
| *** devlaps has joined #openstack-keystone | 15:24 | |
| *** devlaps has quit IRC | 15:24 | |
| marekd | bknudson: that's true. and of course every test_* method starts with a 'fresh database' populated by setUp() ? | 15:24 |
| bknudson | marekd: yes, and then there's the generic user / project / role fixtures that get loaded for almost every test. | 15:25 |
| *** joesavak has quit IRC | 15:27 | |
| samueldmq-away | bknudson, so for test_v3_* load_sample_data is called for every test? | 15:27 |
| *** samueldmq-away is now known as samueldmq | 15:28 | |
| marekd | samueldmq: yes. | 15:29 |
| bknudson | samueldmq: looks like it: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/rest.py#n69 | 15:30 |
| *** Ephur has quit IRC | 15:30 | |
| bknudson | it's load_fixtures, no load_sample_data. | 15:30 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 15:32 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix _get_children() method from SQL backend https://review.openstack.org/158731 | 15:32 |
| *** nellysmitt has quit IRC | 15:32 | |
| *** nellysmitt has joined #openstack-keystone | 15:32 | |
| bknudson | I think the nova unit tests actually take less time than keystone's. | 15:33 |
| marekd | samueldmq: just remove this 'cleaning' part and i will be happy to +2 | 15:33 |
| *** jsavak has quit IRC | 15:36 | |
| *** jsavak has joined #openstack-keystone | 15:37 | |
| samueldmq | bknudson, well.... loading that for each test is definitively not the best approach IMO ... | 15:39 |
| samueldmq | bknudson, it just reduces a little bit of code .... but increases execution time and readability (once the used entities are not created in the test itself) | 15:40 |
| bknudson | samueldmq: it's been that way a long time, just waiting for someone to come in and clean it up. | 15:40 |
| samueldmq | bknudson, we should either i) create a common scenario used by everyone or ii) create entities at each test | 15:41 |
| samueldmq | bknudson, I do prefer i) | 15:41 |
| bknudson | I prefer ii | 15:41 |
| *** chrisshattuck has joined #openstack-keystone | 15:41 | |
| samueldmq | bknudson, hm .. why? | 15:41 |
| bknudson | I think we already have i ? | 15:41 |
| samueldmq | bknudson, what I said looks like i) | 15:42 |
| *** jsavak has quit IRC | 15:42 | |
| samueldmq | bknudson, but it should be created once ... not for each test | 15:42 |
| bknudson | I prefer ii because it shows what's being tested. | 15:42 |
| samueldmq | bknudson, there is a common scenario, use it and let it as it was at the end | 15:42 |
| bknudson | the reason it's recreated every time is to ensure that the starting point is the same. | 15:42 |
| *** stevemar has joined #openstack-keystone | 15:43 | |
| *** ChanServ sets mode: +v stevemar | 15:43 | |
| bknudson | rather than having different tests messing with the same data. | 15:43 |
| samueldmq | bknudson, well .... henrynash told me somewhen he prefers this (as you) | 15:43 |
| *** csoukup has quit IRC | 15:43 | |
| samueldmq | bknudson, ok ... so it makes easier to someone read any test | 15:43 |
| samueldmq | bknudson, the only con is that it takes longer ... | 15:44 |
| samueldmq | bknudson, if we had small classes (one for functionality, for ex), we could use a scenario in there .... and if it was shared ... that wasnt a big problem | 15:44 |
| bknudson | if it means you can run tests in parallel then it can take a lot less time. | 15:44 |
| samueldmq | bknudson, great point ! sharing data would result in race conditions | 15:45 |
| samueldmq | bknudson, and possibly take longer at the end | 15:45 |
| samueldmq | bknudson, I was thinking with a batch brain ... and you with a cloud parallel one ... thx | 15:46 |
| samueldmq | :) | 15:46 |
| *** david-lyle_afk is now known as david-lyle | 15:47 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug in Federation list projects endpoint https://review.openstack.org/158163 | 15:48 |
| samueldmq | marekd, ^ | 15:48 |
| lbragstad | stevemar: spec registered and targeted https://review.openstack.org/#/c/145317/22 | 15:49 |
| *** markvoelker has joined #openstack-keystone | 15:49 | |
| *** rushiagr is now known as rushiagr_away | 15:50 | |
| stevemar | lbragstad, thanks sir | 15:50 |
| lbragstad | stevemar: thank you! | 15:51 |
| *** realist__ has joined #openstack-keystone | 15:53 | |
| realist__ | Hi, I am unable to install Devstack, i submitted my question here yesterday and got no answer : https://ask.openstack.org/en/question/61583/devstack-installation-failure/ | 15:53 |
| *** abhirc has joined #openstack-keystone | 15:54 | |
| *** mattfarina has joined #openstack-keystone | 15:55 | |
| samueldmq | bknudson, well.. I think I'll grab this ... I'll talk to henrynash and dstanek to see how it would look like with functional + data-driven tests | 15:58 |
| samueldmq | thx | 15:58 |
| *** abhirc_ has joined #openstack-keystone | 15:58 | |
| dstanek | samueldmq: reading up on the convo | 15:59 |
| realist__ | Is it acceptable to ask questions here ? | 15:59 |
| *** abhirc has quit IRC | 15:59 | |
| bknudson | samueldmq: functional tests might require setting up some global users that aren't modified by the tests. They're not going to start from a clean db every time. | 16:01 |
| dstanek | marekd: see the section starting at line 90 here: https://etherpad.openstack.org/p/keystone-test-restructuring | 16:02 |
| dstanek | bknudson: why not make new users each time? | 16:03 |
| bknudson | dstanek: they can, I'd expect it to be much slower on real db than it is using sqlite. | 16:04 |
| breton | not really. Postgres works quite fast on our tests. | 16:06 |
| dstanek | bknudson: not saying we should, but i'd rather lean toward the automated approach vs. doing it like devstack | 16:07 |
| bknudson | dstanek: the tempest tests create a lot of fixtures in the class setup for better or worse. | 16:07 |
| bknudson | maybe not for identity tests, though? | 16:08 |
| *** csoukup has joined #openstack-keystone | 16:11 | |
| *** chrisshattuck has quit IRC | 16:11 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 16:15 |
| *** jamielennox is now known as jamielennox|away | 16:15 | |
| *** chrisshattuck has joined #openstack-keystone | 16:15 | |
| dstanek | bknudson: not sure, i'm in the middle of converting a few v3 unit tests into functional tests now; i'll post when i'm done | 16:15 |
| bknudson | dstanek: awesome! | 16:15 |
| *** jamielennox|away is now known as jamielennox | 16:16 | |
| *** mhu has quit IRC | 16:16 | |
| bknudson | I hope it's a test for getting a token. | 16:16 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 16:16 |
| bknudson | that's kind of important. | 16:16 |
| morganfainberg | realist__: you can always ask questions here. | 16:17 |
| morganfainberg | realist__: but realize sometimes it takes a while to get the answer. | 16:17 |
| morganfainberg | We do our best to make sure questions get answered | 16:18 |
| *** mhu has joined #openstack-keystone | 16:20 | |
| morganfainberg | realist__: that looks like (iirc) an out of date oslo. So we changed the oslo namespace from oslo.config to oslo_config. I am guessing this is a vm you previously used for devstack? You are likely going to need to update all your oslo libraries to resolve this. I recommend (if you can afford it) to start with a clean VM (easiest solution). | 16:21 |
| realist__ | morganfainberg: thats true. | 16:22 |
| realist__ | morganfainberg: thank you. | 16:22 |
| morganfainberg | Sure thing :) | 16:22 |
| morganfainberg | Happy to help. | 16:22 |
| samueldmq | bknudson, hmm ... so for internal tests (backend, unit) it does make sense to create data in each test ... | 16:25 |
| samueldmq | bknudson, and for functional ones (that would be expensive to put in parallel) we could use a common scenario .. right? | 16:26 |
| bknudson | samueldmq: right... we might start out creating data in each test for functional and only if it turns out to be too expensive could use a common scenario. | 16:27 |
| samueldmq | bknudson, ++ | 16:28 |
| samueldmq | bknudson, for backend tests .. there is a data-driven approach being introduced on keystone .... | 16:28 |
| samueldmq | bknudson, it's from henrynash https://review.openstack.org/#/c/149178/ | 16:28 |
| samueldmq | bknudson, it supports the idea of creating data for each test | 16:28 |
| *** richm1 has joined #openstack-keystone | 16:29 | |
| henrynash | samueldmq, bknudson: well, it’s just a short-hand data driven approach | 16:29 |
| samueldmq | henrynash, but a great start imo ... we could make it generic to be used by other backends in the future :-) | 16:30 |
| *** richm1 is now known as richm | 16:30 | |
| bknudson | 'entities': {'domain': [{'contents': {'user': 1, 'group': 1, -- doesn't look very obvious to me what this is testing. | 16:30 |
| samueldmq | bknudson, this still is not testing.. just setting up the data | 16:31 |
| samueldmq | bknudson, to be used on the test cases | 16:31 |
| bknudson | it's also not obvious what data is being set up. | 16:31 |
| samueldmq | bknudson, the specific attributes of a user/proejct etc? | 16:32 |
| bknudson | looking at "'entities': {'domain': [{'contents': {'user': 1, 'group': 1," I have no idea what's going on. | 16:32 |
| samueldmq | create a domain, containing 1 user and 1 group | 16:33 |
| bknudson | every time I see that I'll have to read the documentation. | 16:34 |
| samueldmq | that shouldnt be that hard if you get the approach ... maybe this is not too easy now because the approach is completely different from what we have today | 16:34 |
| ccard | RE my issue with "openstack role add" for a user in a domain, I see the same issue with a domain that doesn't use LDAP as the backend, so I think the LDAP part is not connected. The issue seems to be that the request sent to keystone doesn't have a domain in the v3 token. | 16:34 |
| samueldmq | bknudson, yes... the idea is good, that makes complex test cases smaller and easier to understand :) | 16:34 |
| samueldmq | bknudson, looking forward to see your reviews there :-) | 16:35 |
| openstackgerrit | Matthieu Huin proposed openstack/keystone: Get method's class name according to python version https://review.openstack.org/158777 | 16:35 |
| samueldmq | possibly there are some cons that I didnt notice | 16:35 |
| bknudson | the test itself is definitely shorter. | 16:36 |
| samueldmq | ++ | 16:36 |
| samueldmq | and will become much easier as well.. once you get familiar with the approach | 16:37 |
| *** realist__ has quit IRC | 16:37 | |
| bknudson | but tests should be short and simple to begin with (one rule is to have a single call to assert) | 16:37 |
| bknudson | a unit test shouldn't require a test plan. | 16:38 |
| amakarov | bknudson, common.setup_backends() is still needed for testing engine - I want to leave it be, what do you think about it? | 16:38 |
| samueldmq | bknudson, so we should have 1 test case per test ? | 16:38 |
| bknudson | samueldmq: yes. | 16:38 |
| samueldmq | bknudson, why not group them if it makes sense .. instead of multiples tests with common scenario ? | 16:39 |
| bknudson | amakarov: I don't have a problem with that... maybe the tests can be fixed up later... the tests 'should' be able to use the same setup. | 16:39 |
| samueldmq | wouldnt that be too purist? | 16:39 |
| bknudson | samueldmq: because it makes it harder to see what the test was actually trying to verify when it failed, and also if the test fails in the middle then the rest of the test isn't run. | 16:40 |
| *** _cjones_ has joined #openstack-keystone | 16:40 | |
| amakarov | bknudson, I'll postpone it till another patch - too many for a single bugfix | 16:40 |
| bknudson | amakarov: yes, please, don't mix the refactoring in with the bug fix. | 16:41 |
| *** _cjones_ has quit IRC | 16:41 | |
| samueldmq | bknudson, good point... than maybe we could keep the setup ('entities' and 'assignments' as they are) and split 'tests' out of test plan ... | 16:42 |
| samueldmq | bknudson, and then we should call separate test cases one by one | 16:42 |
| bknudson | samueldmq: that would be great | 16:42 |
| *** _cjones_ has joined #openstack-keystone | 16:42 | |
| *** radez_g0n3 is now known as radez | 16:42 | |
| samueldmq | nice! fell free to let a review :) | 16:43 |
| samueldmq | henrynash, ^ | 16:43 |
| samueldmq | bknudson, I'll add a comment there later if you didnt get time to do so | 16:43 |
| bknudson | samueldmq: I wouldn't -1 for this... it's my opinion and different developers have different opinions on it. | 16:44 |
| bknudson | if someone likes to construct their tests this way I'm fine with it. | 16:44 |
| bknudson | I'm usually just happy that there are tests. | 16:45 |
| *** _cjones_ has quit IRC | 16:46 | |
| *** _cjones_ has joined #openstack-keystone | 16:46 | |
| samueldmq | bknudson, great! we share that opinion .. I'll add a comment and let's see what henry and others think about | 16:47 |
| samueldmq | bknudson, we could even let it as is and keep the idea in mind .. and then refactor when we put that for all backends (if we go for it ) | 16:48 |
| samueldmq | bknudson, yes, the fact of having tests is already great | 16:49 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Do not allow the use of slash in the project name https://review.openstack.org/157152 | 16:54 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 16:54 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 16:54 |
| ccard | is it even possible to get a domain scoped v3 token using the openstack cli? | 16:55 |
| rodrigods | ccard, yes, you just need to export the right environment vars | 16:59 |
| samueldmq | bknudson, yes, the fact of having tests is already great | 17:01 |
| samueldmq | bknudson, sorry, I meant to re-run tests in the terminal ... | 17:01 |
| *** ioram has quit IRC | 17:07 | |
| *** nellysmitt has quit IRC | 17:17 | |
| *** jistr has quit IRC | 17:18 | |
| *** nellysmitt has joined #openstack-keystone | 17:18 | |
| *** rwsu-afk is now known as rwsu | 17:18 | |
| *** afazekas has quit IRC | 17:26 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Correct initialization order for logging to use eventlet locks https://review.openstack.org/154915 | 17:28 |
| *** afazekas has joined #openstack-keystone | 17:28 | |
| amakarov | bknudson, ^^ | 17:28 |
| amakarov | bknudson, it's growing... | 17:28 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Cleanup policy related bits in tests https://review.openstack.org/158561 | 17:29 |
| ccard | rodrigods: I've tried all the combinations of environment variables that seemed likely, no luck | 17:31 |
| rodrigods | ccard, you should import username, password, domain_name and user_domain_name | 17:31 |
| rodrigods | ccard, or _id (if it is the case) | 17:32 |
| rodrigods | export* | 17:32 |
| *** _cjones_ has quit IRC | 17:33 | |
| *** _cjones_ has joined #openstack-keystone | 17:36 | |
| stevemar | gordc, could you help reduce the amount of open patches i have :) https://review.openstack.org/#/c/156463/ | 17:36 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Correct unscoped token request layout https://review.openstack.org/158791 | 17:38 |
| gordc | stevemar: ah right. i forgot about that patch. | 17:38 |
| *** chrisshattuck has quit IRC | 17:39 | |
| ccard | rodrigods: I'm probably confused, but what I'm trying to do is give a user access to a project in a domain. As far as I can see, the command to do this is "openstack role add --project testproject1 --user ccard _member_", is that right? | 17:39 |
| mhu | stevemar, hi ! I didn't realize you were already working on https://launchpad.net/bugs/1420125 from the bug description, let me know if you want to get back to it | 17:39 |
| openstack | Launchpad bug 1420125 in Keystone "href variables for federation controller are inconsistent" [Low,In progress] - Assigned to Matthieu Huin (mhu-s) | 17:39 |
| stevemar | mhu, i'm not, just reported it | 17:40 |
| stevemar | mhu, there was a patch there, but i abandoned it, since we will have to deprecate it | 17:40 |
| stevemar | you can look at the patch for notes | 17:40 |
| mhu | stevemar, will do, thx ! | 17:40 |
| stevemar | np | 17:41 |
| morganfainberg | stevemar, argh... https://review.openstack.org/#/c/155660/ merge conflict | 17:41 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 17:41 |
| stevemar | blah | 17:41 |
| *** lhcheng_afk has joined #openstack-keystone | 17:42 | |
| ccard | rodrigods: no matter what combination of OS_ variables I export, I can't get this command to run without (at best) getting a 401 error, and the keystone log seems to indicate that this is because the v3 token it gets isn't domain scoped. | 17:42 |
| stevemar | ccard, paste of your env. vars? | 17:43 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 17:43 |
| morganfainberg | stevemar, ^^ rebased. | 17:43 |
| *** pdesai has joined #openstack-keystone | 17:43 | |
| *** fmarco76 has left #openstack-keystone | 17:46 | |
| ccard | stevemar: with these settings: http://pastebin.com/ht9ahYmQ, "openstack user list --domain testdomain1" works | 17:46 |
| *** browne has joined #openstack-keystone | 17:46 | |
| ccard | but # openstack role add --project testproject1 --user ccard _member_ | 17:46 |
| ccard | ERROR: openstack The request you have made requires authentication. (HTTP 401) | 17:46 |
| ccard | keystone.log here: http://pastebin.com/HMqqC5nK | 17:49 |
| *** tqtran has joined #openstack-keystone | 17:49 | |
| *** karimb has quit IRC | 17:56 | |
| stevemar | ccard, bah keystone meeeting now, i might be a bit longer to get back to you | 17:59 |
| ccard | stevemar: ok, I'm off home now anyway | 17:59 |
| *** pnavarro has quit IRC | 17:59 | |
| *** lhcheng_afk is now known as lhcheng | 18:00 | |
| *** spandhe has joined #openstack-keystone | 18:01 | |
| jamielennox | /join #openstack-meeting | 18:07 |
| *** devlaps has joined #openstack-keystone | 18:11 | |
| *** jacorob has left #openstack-keystone | 18:11 | |
| *** raildo_away is now known as raildo | 18:12 | |
| *** jacorob has joined #openstack-keystone | 18:12 | |
| *** harlowja has joined #openstack-keystone | 18:20 | |
| *** tqtran_ has joined #openstack-keystone | 18:20 | |
| *** xavpaice has left #openstack-keystone | 18:21 | |
| *** tqtran has quit IRC | 18:21 | |
| *** joesavak has joined #openstack-keystone | 18:24 | |
| *** harlowja has quit IRC | 18:24 | |
| *** harlowja has joined #openstack-keystone | 18:24 | |
| *** aix has quit IRC | 18:29 | |
| *** diegows has quit IRC | 18:30 | |
| *** gyee has joined #openstack-keystone | 18:31 | |
| *** ChanServ sets mode: +v gyee | 18:31 | |
| openstackgerrit | Merged openstack/pycadf: Additional doc clean up https://review.openstack.org/156463 | 18:39 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis token backend https://review.openstack.org/150844 | 18:44 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis token backend https://review.openstack.org/150844 | 18:45 |
| *** krtaylor has quit IRC | 18:48 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Recursive deletion and project disabling https://review.openstack.org/148730 | 18:57 |
| marekd | morganfainberg: gyee re: service providers let me get back with that once i am done with my dinner and other evening stuff. | 18:59 |
| gyee | marekd, I am fine with it | 18:59 |
| *** krtaylor has joined #openstack-keystone | 19:00 | |
| morganfainberg | I'm going to relocate and will be doing cleanup now. | 19:00 |
| morganfainberg | So will be around in 15 mins. Or so. | 19:01 |
| marekd | me in more 40 mins. | 19:01 |
| gyee | marekd, my feeling is that we may just ended up needing a more comprehensive catalog service | 19:01 |
| *** pdesai1 has joined #openstack-keystone | 19:01 | |
| ayoung | marekd, K2K provider list...keep it out of the Service catalog. Any reason to force it in there? | 19:02 |
| *** browne has quit IRC | 19:03 | |
| lhcheng | ayoung: is there a spec or bug that describes the changes in Access Info? Wanted to check if there would be an impact on django_openstack_auth. | 19:03 |
| *** amakarov is now known as amakarov_away | 19:04 | |
| *** pdesai has quit IRC | 19:04 | |
| *** browne has joined #openstack-keystone | 19:04 | |
| gyee | ayoung, its for workflow, user needs to know what other clouds he have access to | 19:05 |
| gyee | otherwise, we'll have to create a separate API for that | 19:06 |
| *** csoukup has quit IRC | 19:11 | |
| *** pdesai has joined #openstack-keystone | 19:14 | |
| stevemar | bknudson, going to put your requested changes in a test clean up patch for policy | 19:14 |
| stevemar | cool? | 19:14 |
| bknudson | stevemar: ok... does that also take care of dhellmann's comment? | 19:15 |
| *** pdesai1 has quit IRC | 19:15 | |
| stevemar | bknudson, it should, not with a fixture but with your suggestion | 19:16 |
| stevemar | i'll add it here https://review.openstack.org/#/c/158561/ | 19:16 |
| bknudson | stevemar: I think I noticed another place where there was an addCleanup for resetting the enforcer... | 19:16 |
| *** _cjones_ has quit IRC | 19:16 | |
| stevemar | bknudson, probably, check the patch i linked, i tried to make things more consistent there | 19:17 |
| bknudson | stevemar: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_v3.py#n149 | 19:17 |
| ayoung | lhcheng, should be no impact. The goal is a drop in replacement for the access info | 19:17 |
| ayoung | the main goal is to make it possible to have a strict Python object model instead of dictionaries. | 19:18 |
| ayoung | gyee, so we don't have proper support in the SC for what we need, do we | 19:18 |
| bknudson | stevemar: so test_v3.RestfulTestCase already does self.addCleanup(rules.reset) ... | 19:18 |
| ayoung | we need to be able to put something into the SC that is not shown by default | 19:18 |
| lhcheng | ayoung, ah yes it is just a dictionary now. cool, good to know. | 19:19 |
| ayoung | and only shows up if specifically requested, like in the K2K case | 19:19 |
| stevemar | so we're doing it unnecessarily in a bunch of spots, youre saying? | 19:19 |
| ayoung | lhcheng, review is WIP | 19:19 |
| bknudson | stevemar: if the cleanup can just happen on every test then add it to the base testcase, then we'll always start with a clean setup. | 19:19 |
| ayoung | https://review.openstack.org/#/c/138519/ lhcheng | 19:19 |
| ayoung | gyee, the only scoping of a catalog we perform is per project today. Would that be sufficient? | 19:20 |
| gyee | ayoung, we do, endpoint constraints | 19:20 |
| ayoung | gyee, those are are neither necessary nor sufficient, I think. Here it is an advertisement project | 19:21 |
| *** _cjones_ has joined #openstack-keystone | 19:21 | |
| ayoung | I have a token for K1 and I want to use in K2 | 19:21 |
| ayoung | but K2 should not show up as an endpoint in the SC for K1 except in rare occurances | 19:21 |
| ayoung | we don't really care what K2 does (ok we do, be we can't enforce it) | 19:22 |
| gyee | if user is allowed to access K2, why not? | 19:22 |
| lhcheng | ayoung, thanks for the link! added myself to the reviewer, will check it later. | 19:22 |
| ayoung | lhcheng, thanks | 19:22 |
| gyee | ayoung, problem right now is we don't have seamless resource discovery across boundaries | 19:23 |
| gyee | this is a problem with federation in general | 19:23 |
| gyee | user does not have an aggregated view, that's mostly application logic | 19:24 |
| gyee | aggregated view from API | 19:24 |
| gyee | ayoung, think DB design, how can we have a *view* which consists columns from different tables | 19:25 |
| gyee | if we can apply that thinking into federation at a macro level, we can get there | 19:26 |
| stevemar | bknudson, can you mark bp https://blueprints.launchpad.net/keystone/+spec/prefer-notifications if it's done | 19:27 |
| ayoung | gyee, HMT, and service catalog scoping. I have a general idea of how this should work, but it is not "in the next 10 days" type stuff | 19:28 |
| ayoung | ideally, we would be able to have a reusable entity that is subset of the global service catalog | 19:29 |
| ayoung | the default catalog would have what most people use | 19:29 |
| ayoung | but some people would see a different subset, possibly with the K2K info in it | 19:29 |
| gyee | ayoung, yeah, it definitely needs some thinking in that area | 19:31 |
| gyee | not that easy | 19:31 |
| ayoung | gyee, do we have "hidden" service catalog items yet? | 19:32 |
| gyee | why hidden? | 19:32 |
| ayoung | gyee, I mean, not show up by default | 19:32 |
| gyee | ayoung, yeah, endpoint filtering | 19:32 |
| gyee | Bob's working on the enforcement middleware | 19:32 |
| ayoung | yeah, but that removes items | 19:32 |
| ayoung | does that keep them from showing up if not explicitly asked for? | 19:33 |
| gyee | yeah, it won't show up in a scoped token | 19:33 |
| gordc | stevemar: hey, can you ask someone whether db2 nosql supports ttl? | 19:33 |
| ayoung | OK...so we could make K2K other keystones be endpoint filtered away | 19:33 |
| *** devlaps has quit IRC | 19:33 | |
| jamielennox | i currentl have IRC and no other internet - how can i be seeing this and ping: unknown host google.com at the same time | 19:34 |
| stevemar | bknudson, ^ do you know what gordc is talking about? | 19:34 |
| gordc | stevemar: or more importantly if it is still supported. | 19:34 |
| ayoung | jamielennox, DNS failure? | 19:34 |
| ayoung | and IRC is using IP address | 19:34 |
| bknudson | gordc: does mongodb support it? I didn't think it did. | 19:35 |
| gyee | ayoung, right, that's why I was pushing SP as an endpoint | 19:35 |
| jamielennox | 100% packet loss from ping 8.8.8.8 | 19:35 |
| ayoung | gyee, I think that fits the abstraction | 19:35 |
| gyee | so we can put them under endpoint constraint as well | 19:35 |
| ayoung | jamielennox, try another dns...I'm inside VPN so I don't have one | 19:35 |
| ayoung | let me give you the dreamhost one, but tread lightly | 19:36 |
| gordc | bknudson: mongodb has native ttl support. i'm assuming db2 doesn't (it's just a translation engine on top of sql?) | 19:36 |
| marekd | morganfainberg: ayoung stevemar gyee: I am back. | 19:36 |
| gyee | ayoung, a robust SC is essentially in discoverability | 19:36 |
| gyee | essential | 19:36 |
| ayoung | marekd, OK, so K2k other keystone in catalog is, I think, the right approach | 19:37 |
| ayoung | the service catalog should say where a user can use a token | 19:37 |
| ayoung | and K2K falls into that category | 19:37 |
| bknudson | gordc: I'll ask around. | 19:38 |
| marekd | ayoung: so put remote keystones into endpoint list? | 19:38 |
| ayoung | the remote Keystone should be endpoint filtered such that it does not show up by default, maybe scoped to a specific project | 19:38 |
| ayoung | marekd, yes, I think so | 19:38 |
| ayoung | it passes the test "can I use a token here?" | 19:38 |
| gordc | bknudson: thanks! | 19:38 |
| marekd | ayoung: not really, as you need to exchange your token for an assertion, and trade that assertion for another token issued by a remote keystone. | 19:39 |
| morganfainberg | ayoung, so there is an issue there: 1) we can't decouple the two URIs and .get_endpoint in ksc would return something unsuable | 19:39 |
| morganfainberg | ayoung, and ^^ you can't just use the token. | 19:39 |
| ayoung | marekd, ah.... | 19:39 |
| ayoung | we should be able to, damnit | 19:39 |
| ayoung | that was what I designed years ago | 19:39 |
| ayoung | ok... | 19:39 |
| gyee | but why even restrict to tokens? | 19:40 |
| marekd | that 'one token to rule them all' was discussed in July last year, and posed some security concerns. | 19:40 |
| ayoung | gyee, no "restrict" but "allow" | 19:40 |
| morganfainberg | and yes, SPs should be filtered per project, and if the SP isn't in the catalog we should never issue SAML for it. | 19:40 |
| *** mestery has joined #openstack-keystone | 19:40 | |
| *** flaviof has joined #openstack-keystone | 19:40 | |
| ayoung | that works. And if we allow tokens in the future, it still makes sense | 19:40 |
| morganfainberg | s/per project/per project|domain | 19:40 |
| gyee | marekd, right, bearer tokens are dangerous :) | 19:40 |
| bknudson | gordc: DB2 nosql doesn't support TTL. | 19:40 |
| marekd | gyee: i think there is a thin line between seamless bursting into remote cloud and overtaking remote clouds. | 19:41 |
| ayoung | SAML is just a bearer token | 19:41 |
| morganfainberg | ayoung, so, part of the issue is the current catalog is very naive and can't tightly couple endpoints and we need 2 uris here. | 19:41 |
| ayoung | there is no silver bullet | 19:42 |
| gyee | just use x509 cert and surf the clouds at ease | 19:42 |
| morganfainberg | ayoung, but SAML is a much easier sell to the security focused people than keystone tokens | 19:42 |
| morganfainberg | ayoung, trust me ;) | 19:42 |
| morganfainberg | even though they could be functionally interchangeable | 19:42 |
| morganfainberg | the whole standards thing | 19:42 |
| ayoung | I trust you the same as I do anyone. About as far as I can throw you. | 19:42 |
| gordc | bknudson: cool cool. thanks for confirming | 19:42 |
| ayoung | But you are light | 19:42 |
| morganfainberg | you could prob thow me a bit further than some other folks | 19:43 |
| morganfainberg | anyway | 19:43 |
| marekd | my oncly concern is that one day i would like to be able # openstack list server --federated and get a nice list of VMs from all federated clouds | 19:43 |
| marekd | be able to make neutron net across my clouds and things like that. | 19:43 |
| gyee | marekd, yeah, we all want that | 19:43 |
| jamielennox | morganfainberg: so we can always do the two parts via the interface filters but it's not pretty | 19:44 |
| marekd | and i am fearing that if we start splitting endpoint we will need to unwind it faster than we think. | 19:44 |
| morganfainberg | now if we put this in the normal catalog we need 2 things: 1) new definitions of the endpoint types, that are new for the k2k stuff. | 19:44 |
| morganfainberg | and 2) a way to ensure you can never filter one of those endpoints out but not the other via endpoint filtering | 19:44 |
| morganfainberg | oh and 3) [off by one error!] a non sucky way to manage that. | 19:44 |
| gyee | never heard of off by one :D | 19:45 |
| morganfainberg | right now the data structures are not endpoints in the catalog. | 19:45 |
| morganfainberg | they are something totally different | 19:45 |
| morganfainberg | and need to be so federation can do stuff with it | 19:45 |
| morganfainberg | and the workflow is very different than normal token operations. | 19:45 |
| morganfainberg | so if we address those issues ^^ we can put it in the normal catalog. otherwise this needs to be separate so we can manage it appropriately. | 19:46 |
| morganfainberg | in both cases we need to support the idea of filtering per domain|project | 19:46 |
| morganfainberg | and not issue SAML if that endpoint wouldn't appear in the catalog | 19:46 |
| marekd | morganfainberg: we don't have logic for such filtering now :( | 19:47 |
| gyee | morganfainberg, with SP as a separate thingy, we need to add more plumbing for the filtering part right? | 19:47 |
| morganfainberg | marekd, no we don't and because this has been so contentious we haven't worked on it | 19:47 |
| ayoung | does this call for a separate API then? | 19:47 |
| morganfainberg | ayoung, this already has a separate API [based on the spec] | 19:47 |
| morganfainberg | that is hooked into federation | 19:48 |
| ayoung | and it stays out of the SC for now? | 19:48 |
| morganfainberg | ayoung, today we have no way to represent it to end users | 19:48 |
| morganfainberg | we ripped out the region part cause that was bad | 19:48 |
| morganfainberg | this is putting the representation for users back in | 19:48 |
| morganfainberg | right now it doesn't work. | 19:48 |
| morganfainberg | at all | 19:48 |
| morganfainberg | unless you magically know how to ask for tokens and urs | 19:48 |
| morganfainberg | uris to auth against | 19:48 |
| gyee | ayoung, that goes back to the "view" thing we talked about earlier. What does an end user view of an SP? | 19:49 |
| gyee | or does end user really cares as long as we tell him there's a service you can use | 19:49 |
| ayoung | morganfainberg, "magically" sounds like it could be handled by the client | 19:49 |
| morganfainberg | ayoung, magically as in you just happen to know - you can't get that info w/o being cloud admin atm | 19:50 |
| morganfainberg | ayoung, and able to setup SPs. | 19:50 |
| ayoung | that sounds like policy, then | 19:50 |
| morganfainberg | no, there is *no* way to get it now | 19:50 |
| morganfainberg | there is no API for it | 19:50 |
| morganfainberg | this is putting the API for the client to get it | 19:50 |
| morganfainberg | which the SC was where we said we'd put it... | 19:50 |
| morganfainberg | back when this was designed | 19:50 |
| morganfainberg | ok i lied, you can probably get it if you're cloud admin but i don't want you to list all SPs to guess at that. | 19:51 |
| jamielennox | what are the two URLs that are required for service providers? the base keystone and the OS-FEDERATION one? | 19:51 |
| stevemar | jamielennox, yeah 'auth_url' and 'sp_url' | 19:51 |
| marekd | jamielennox: one for sending your SAML, second is usually /v3/auth/tokens | 19:52 |
| stevemar | http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-federation-ext.html#register-a-service-provider | 19:52 |
| marekd | once you have your session open | 19:52 |
| *** pdesai1 has joined #openstack-keystone | 19:52 | |
| jamielennox | ok, so i think that's wrong - we shouldn't have both - but we can get away with one | 19:52 |
| *** pdesai1 has quit IRC | 19:52 | |
| jamielennox | from a catalog perspective auth_url shouldn't be there | 19:52 |
| marekd | jamielennox: then you will move this responsibility to the user. | 19:52 |
| jamielennox | because you can't communicate with auth_url with your token | 19:52 |
| jamielennox | does it make sense to only include sp_url, do the unscoped catalog, scope based on that | 19:53 |
| * morganfainberg is thinking we should just revert the change to pull this out of the region and say "screw it we'll keep a bad ux, at least that wasn't contentious to land" | 19:53 | |
| jamielennox | unscoped catalog would contain the auth_url | 19:53 |
| marekd | but you *will be* able to if you use K2K. | 19:53 |
| jamielennox | or some other way of returning auth_url | 19:53 |
| jamielennox | marekd: no, with my local keystone token i can't talk to a remote keystone | 19:54 |
| jamielennox | i need to get a token in that remote cloud | 19:54 |
| gyee | morganfainberg, lets just make it work for now and improve later, baby steps | 19:54 |
| marekd | jamielennox: wait a second. who is issuing unscoped token? | 19:54 |
| *** pdesai has quit IRC | 19:54 | |
| gyee | morganfainberg, the ocean temp is raising :) | 19:55 |
| gyee | anyhoo, food time | 19:55 |
| jamielennox | marekd: wouldn't the initial call to the remote sp_url be getting an unscoped | 19:55 |
| ayoung | ++ | 19:56 |
| marekd | jamielennox: no, it merely SAML stuff. | 19:56 |
| ayoung | marekd, ok, I think the flow is something like this | 19:56 |
| marekd | sp_url is something like: https://example.com:5000/Shibboleth.sso/SAML2/ECP" | 19:56 |
| marekd | ayoung: let me finish | 19:56 |
| jamielennox | marekd: k2k? | 19:56 |
| *** sanket has joined #openstack-keystone | 19:57 | |
| marekd | jamielennox: yes, saml/oidc in general. | 19:57 |
| jamielennox | ergh, that's right - we shortcutted that and didn't actually use keystone tokens to talk between keystones | 19:57 |
| ayoung | user gets token, from token gets assertion, list sps, get sp-url. passes assertion to spur, gets unscoped token | 19:57 |
| marekd | ayoung: he needs auth_url to get unscoped token | 19:57 |
| ayoung | last unscoped token has auth_url in the (new unscoped) catalog | 19:57 |
| ayoung | this is redonculous | 19:57 |
| morganfainberg | marekd, it's part of the redirect logic right? | 19:57 |
| ayoung | redickledockle | 19:57 |
| marekd | sp_url is where he puts his saml assertion, but then, he doensn't know where to go and ask for a token. | 19:57 |
| marekd | morganfainberg: yes. | 19:58 |
| marekd | morganfainberg: we do this today with Icehouse federation too. | 19:58 |
| morganfainberg | marekd, yeah just clarifying why we need both urls | 19:58 |
| marekd | morganfainberg: it's hidden in normal websso, because it's one of 302 redirect. | 19:58 |
| morganfainberg | yes | 19:58 |
| marekd | morganfainberg: yes we do, if tey are not in the server, client will need to make an efford, go to cloud admin, ask, export env variable | 19:59 |
| morganfainberg | yep. | 19:59 |
| marekd | this is what i had to do when we had only one url in a region. | 19:59 |
| jamielennox | marekd: but we never post SAML to /auth/tokens do we? | 19:59 |
| marekd | jamielennox: no, we dont, | 19:59 |
| *** rm_work is now known as rm_work|away | 19:59 | |
| morganfainberg | jamielennox, no, you don't because that doesn't know how to read SAML [and not everything *is* saml] | 19:59 |
| marekd | jamielennox: sp_url: https://example.com:5000/Shibboleth.sso/SAML2/ECP, auth_url: keystone/v3/auth/tokens | 19:59 |
| jamielennox | that's good - just checking | 20:00 |
| morganfainberg | you could still have username/password that needs to not be processed by saml | 20:00 |
| jamielennox | so the return from the OS-FEDERATION urls has to be a keystone token | 20:00 |
| *** lhcheng is now known as lhcheng_afk | 20:00 | |
| marekd | first, go to sp_url, take cookie session in return, then, go to auth_url, and since you have your cookie, you can get through, which effectively means get unscoped fed-token. | 20:00 |
| jamielennox | sp_url being something shib doesn't make sense there, we don't have an external sp, we have a keystone | 20:00 |
| morganfainberg | jamielennox, the SP_url is shibboleth validating the SAML auth and passing/telling you to fly a kite | 20:01 |
| morganfainberg | without hitting that first you can't get things over to the auth url. it's not a pass-through | 20:01 |
| marekd | morganfainberg: ++ | 20:01 |
| jamielennox | right - but in the k2k situation what is going to be our sp_url? | 20:01 |
| marekd | jamielennox: sp_url: https://example.com:5000/Shibboleth.sso/SAML2/ECP, auth_url: keystone/v3/auth/tokens | 20:01 |
| morganfainberg | SP url is apache mod_shib | 20:01 |
| marekd | examples ^^ | 20:01 |
| morganfainberg | which validates things, in a web browser you're then 302'd to the real location | 20:02 |
| morganfainberg | which in our case is an AUTH URL | 20:02 |
| marekd | morganfainberg: +++++++ | 20:02 |
| jamielennox | mmm, k2k should have been done with actual tokens..... | 20:02 |
| *** rm_work|away is now known as rm_work | 20:02 | |
| morganfainberg | but we can't know that, because it's apriori knowledge, from the SP usually, in this case we are IDP initiated | 20:02 |
| morganfainberg | jamielennox, it would have died | 20:02 |
| stevemar | died so fast | 20:03 |
| marekd | jamielennox: that would mean reinventing what saml give sus for free. | 20:03 |
| morganfainberg | jamielennox, the keystone tokens are extremely hard to sell to security folks when they need to move across network boundries | 20:03 |
| jamielennox | marekd: as do tokens | 20:03 |
| marekd | jamielennox: crypto, signing etc. | 20:03 |
| marekd | jamielennox: plus, with saml we can burst into non openstack services | 20:03 |
| *** flaviof has quit IRC | 20:04 | |
| bknudson | aws? | 20:04 |
| marekd | bknudson: for instance. | 20:04 |
| marekd | joesavak had some use cases for that. | 20:04 |
| *** flaviof has joined #openstack-keystone | 20:04 | |
| morganfainberg | technically this makes it *more* possible for keystone to provide identity to apps that aren't openstack aware | 20:04 |
| morganfainberg | and... it gives warm and fuzzies to the security folks because they understand saml workflows | 20:05 |
| bknudson | I hope that doesn't happen. | 20:05 |
| morganfainberg | and saying "it works like saml but it's something else" does not sell well to enterprise folks | 20:05 |
| morganfainberg | you can replace saml with oidc or anything else | 20:05 |
| morganfainberg | bknudson, i don't really classify it as a win to provide identity outside of openstack to openstack. but meh | 20:06 |
| morganfainberg | someone could do it | 20:06 |
| morganfainberg | in fact i wouldn't advertise it in our docs :P | 20:06 |
| morganfainberg | the last reason we benefit from SAML is that is reuses a lot of the workflows we designed for federation | 20:07 |
| marekd | jamielennox: yeah, we are somewhat screwed that we still need separate token per cloud. | 20:07 |
| morganfainberg | there really wasn't extra glue needed on the service provider side to "work" | 20:07 |
| bknudson | https://review.openstack.org/#/c/156509/1/api/v3/identity-api-v3.rst has as an example "auth_url": "https://example.com:5000/v3/OS-FEDERATION/identity_providers/acme/protocols/saml2/auth" / "sp_url": "https://example.com:5000/Shibboleth.sso/SAML2/ECP" | 20:08 |
| bknudson | is that not a k2k example? | 20:08 |
| stevemar | morganfainberg, yeah it came as a freebie | 20:08 |
| marekd | bknudson: it is. | 20:08 |
| stevemar | i feel like bknudson is going to say something profound | 20:09 |
| marekd | <drumroll> | 20:09 |
| bknudson | I don't think it will be profound... just trying to figure out how it works. | 20:10 |
| bknudson | I haven't used it. | 20:10 |
| *** csoukup has joined #openstack-keystone | 20:11 | |
| stevemar | *womp womp* | 20:11 |
| bknudson | I send SAML to "sp_url" and then get a token? | 20:11 |
| marekd | bknudson: 1) local authn, get local token, trade it for corresponding saml assertion and send to sp_url, once you are done, use your cookie and go to auth_url. You are already authenticated, so you will get unscoped token ready to use with remote cloud. | 20:11 |
| stevemar | bknudson, you'd get an unscoped token | 20:11 |
| bknudson | marekd: ok, thanks. | 20:11 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 20:11 | |
| ayoung | morganfainberg, any security person that looks at keystone and doesn't have apoplexy should probably not be a security person | 20:12 |
| marekd | ayoung: quote of the day. | 20:13 |
| jamielennox | marekd: even in the case of k2k you'd get an unscoped token? | 20:13 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 20:13 | |
| bknudson | we could use some docs in api/v3/identity-api-v3.rst that says what auth_url and sp_url are. | 20:13 |
| ayoung | marekd, I just like the work apoplexy | 20:13 |
| ayoung | word | 20:13 |
| marekd | jamielennox: yes. | 20:13 |
| stevemar | jamielennox, always | 20:13 |
| morganfainberg | bknudson, sure so we should probably get that into marekd's reviews for changing the API docs | 20:13 |
| morganfainberg | jamielennox, i am going to try and re-release -kerb5 again | 20:14 |
| jamielennox | so how does the project and roles from local cloud get to remote cloud again | 20:14 |
| jamielennox | i know the answer is 'mapping' but remind me where | 20:14 |
| * jamielennox has given talks on this stuff... | 20:15 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 20:16 |
| marekd | jamielennox: it's mapping on the remote side | 20:17 |
| marekd | always remote side | 20:17 |
| marekd | it's once you get through remote.keystone.com/v3/auth/tokens | 20:17 |
| bknudson | on the local side you get a SAML assertion with roles and stuff? | 20:17 |
| marekd | bknudson: yes | 20:17 |
| stevemar | jamielennox, roles/projects/user info on local keystone are transformed into saml assertion, hand saml assertion to remote keystone, through the mapping you are dumped into a group, once in a group you can list projects/domains | 20:18 |
| bknudson | so then your mapping is remote roles -> local group, I guess. | 20:18 |
| jamielennox | marekd: right - but i just exchanged my local scoped token, for a saml, which got me a remote unscoped token, then .... | 20:18 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 20:18 |
| marekd | jamielennox: yes, but i will let remote admin to decide what resources i can touch with this set of roles | 20:18 |
| jamielennox | ok, right - you go into a group with existing perms, remember that now | 20:19 |
| jamielennox | it's early here | 20:19 |
| stevemar | jamielennox, refer to latter half of what i said ^ - the mapping will always just give you a token with group/idp info. from there use that token to call /domains or /projects | 20:19 |
| stevemar | :D | 20:19 |
| stevemar | we *could* do project to project mapping to get back a scoped token | 20:19 |
| stevemar | but that would be a lot of out-of-band communication between deployers i think | 20:19 |
| marekd | stevemar: i planned to implement this shortcut next cycle. | 20:20 |
| jamielennox | i think we'll need some way of doing thta | 20:20 |
| marekd | jamielennox: the problem here is that we need mapping at the remote side and also...we must trust each other (hence federation and resources sharing), but cannot trust in 100% | 20:20 |
| marekd | the goal is to find there this boundary is. | 20:21 |
| jamielennox | otherwise the experience sucks, you've burst over to your remote cloud and you need to go through scoping again when you may not know what projects even exist or what they do ther e | 20:21 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Rename test_content_types https://review.openstack.org/158854 | 20:21 |
| dolphm | lbragstad: ^ https://review.openstack.org/#/c/158854/ | 20:21 |
| jamielennox | we kind of need default_project_id for federated users | 20:21 |
| jamielennox | and i hate that i said that | 20:21 |
| bknudson | horizon will show the projects on the remote cloud. | 20:21 |
| marekd | jamielennox: to skip one scoping step? | 20:22 |
| lbragstad | dolphm: reviewed | 20:22 |
| jamielennox | marekd: to not have to make users pick | 20:22 |
| jamielennox | it's fine in the horizon case where you are stepping through things manually | 20:23 |
| * marekd feels we will re-discuss whole k2k somewhere very soon. | 20:23 | |
| bknudson | without a ui you'd need some way to provide the remote project just like you had to provide the local project. | 20:23 |
| jamielennox | but in an automated scenario i want to burst a few compute nodes out onto a public cloud i have to go through it all again | 20:23 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Rename test_content_types https://review.openstack.org/158854 | 20:23 |
| dolphm | lbragstad: fixeded | 20:23 |
| bknudson | finally renaming test_content_types! | 20:24 |
| jamielennox | bknudson: wouldn't in 90% of the time having come from a project means you will end up in another project | 20:24 |
| jamielennox | specific project to specific project | 20:24 |
| bknudson | jamielennox: y, probably, in the bursting scenario. | 20:24 |
| lbragstad | dolphm: want me to open a bug saying that the new test_v2.py should be consolidated with test_v2_auth.py? | 20:25 |
| morganfainberg | jamielennox, that really depends on the mapping rules | 20:25 |
| jamielennox | morganfainberg: agreed | 20:25 |
| jamielennox | anyway either way it's an optimization step for something we've got | 20:25 |
| morganfainberg | jamielennox, but also explicitly mapping always to a project = bad if we do the unscoped->scoped only | 20:25 |
| jamielennox | if we have to deal with the longer case we should do that first | 20:26 |
| stevemar | jamielennox, putting that in place won't negate any of the current work, it'll be a great add-on | 20:26 |
| *** nellysmitt has quit IRC | 20:26 | |
| jamielennox | ok | 20:26 |
| jamielennox | what about a landing page | 20:26 |
| jamielennox | something on keystone that returns {sp_url: '', auth_url: ''} | 20:27 |
| jamielennox | and then that url goes into the catalog | 20:27 |
| jamielennox | it would need to be accessible with local clouds token ... | 20:27 |
| morganfainberg | jamielennox, uh | 20:29 |
| morganfainberg | you mean the IDP cloud or the SP cloud? | 20:29 |
| jamielennox | if we do it locally there is no point in including it in token, if we put it in token it's the same as creating a new service_providers section | 20:29 |
| jamielennox | sometimes i think i should make my own empty channel and just type things out there first | 20:29 |
| morganfainberg | hehe | 20:30 |
| * morganfainberg is trying to fix -kerberos now too | 20:30 | |
| jamielennox | alright - i don't think it works in catalog | 20:31 |
| jamielennox | lets make /auth/service_providers first | 20:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Rename test_keystoneclient* https://review.openstack.org/158856 | 20:31 |
| dolphm | lbragstad: in the same spirit ^ | 20:31 |
| jamielennox | then i think it gets its own section in token | 20:32 |
| morganfainberg | jamielennox, ok so we just add another round trip to know if you *can* burst? | 20:32 |
| dolphm | lbragstad: i don't think refactors deserve bugs - they're not user facing | 20:32 |
| morganfainberg | this feels like catalog data, just not service/endpoint data | 20:32 |
| jamielennox | morganfainberg: /auth/catalog exists, you'd need to make /auth/service_providers regardless | 20:32 |
| morganfainberg | jamielennox, ok hold on | 20:33 |
| morganfainberg | back up | 20:33 |
| morganfainberg | i need to know what SPs i can burst to. this *feels* like catalog data | 20:33 |
| morganfainberg | you are now advocating we make another round trip to get the sps? | 20:33 |
| marekd | resources discovery | 20:33 |
| morganfainberg | [not complaining, just clarifying] | 20:33 |
| morganfainberg | so if i want to burst, i have my token, then i ask /service_providers for a list | 20:34 |
| morganfainberg | that is scope specific | 20:34 |
| morganfainberg | then i can burst. | 20:34 |
| jamielennox | i'm saying that if we don't put it in the standard catalog we need to have that path | 20:34 |
| morganfainberg | assuming i already have a catalog because i'm an end user. | 20:34 |
| jamielennox | for the same reasons as ?include_catalog=False | 20:34 |
| morganfainberg | jamielennox, so marekd's prposal was to put a new section in the catalog, that is always there if you can burst | 20:35 |
| morganfainberg | so you'd just use /auth/catalog and look for "service_providers" in it | 20:35 |
| jamielennox | is there no provision for using an unscoped token? | 20:36 |
| jamielennox | guess not the mapping would fail | 20:36 |
| morganfainberg | you can't use unscoped | 20:36 |
| morganfainberg | because SAML requires scope information (or should) to know if you can burst to a given SP | 20:36 |
| morganfainberg | saml generation | 20:36 |
| jamielennox | that's an implementation limitation, i was just thinking of the idea | 20:37 |
| morganfainberg | well no, that isnt | 20:37 |
| morganfainberg | that is a design choice | 20:37 |
| morganfainberg | authing against a cloud does not mean you are allowed to burst. | 20:38 |
| *** samueldmq_ has joined #openstack-keystone | 20:38 | |
| morganfainberg | you should only be allowed to burst if you've been granted the capability to do so [some SPs might allow all scopes] | 20:38 |
| *** pdesai has joined #openstack-keystone | 20:38 | |
| morganfainberg | but for example i have developers and i don't want them able to consume resources on $burst_target_public_cloud that should be handled via scope - because RBAC limitations in keystone, but it works | 20:39 |
| jamielennox | ok fair enough | 20:39 |
| morganfainberg | if i'm not working on the project that would allow me to burst (result in a useful mapping) i shouldn't be able to. | 20:39 |
| jamielennox | alright, i agree, they should be a seperate section, not just a standard endpoint in catalog | 20:40 |
| morganfainberg | jamielennox, so if we really need this to be another round trip - sure we can do that. it does feel like catalog data though. | 20:40 |
| jamielennox | now i need some breakfast and a coffee | 20:41 |
| morganfainberg | jamielennox, go get coffee :) | 20:41 |
| morganfainberg | it's important | 20:41 |
| jamielennox | morganfainberg: agree they should be in token, just saying we needed constistency in the /auth paths | 20:41 |
| morganfainberg | jamielennox, sure. | 20:41 |
| *** jaosorior has quit IRC | 20:41 | |
| morganfainberg | jamielennox, totally buy that. thats why i said a round trip is fine, but if it isn't then catalog is a good place for it | 20:42 |
| morganfainberg | i would prefer from a UX to not have another round trip | 20:42 |
| openstackgerrit | Morgan Fainberg proposed openstack/python-keystoneclient-kerberos: Fix the package name in setup.cfg https://review.openstack.org/158860 | 20:42 |
| openstackgerrit | Morgan Fainberg proposed openstack/python-keystoneclient-kerberos: Fix the package name in setup.cfg https://review.openstack.org/158860 | 20:44 |
| *** samueldmq_ has quit IRC | 20:49 | |
| *** marzif_ has joined #openstack-keystone | 20:49 | |
| *** pnavarro has joined #openstack-keystone | 20:51 | |
| *** sanket has quit IRC | 20:53 | |
| lbragstad | dolphm: those make sense | 20:57 |
| ayoung | Hollleeee Moleeee. I just realized how much of my job is keeping people from writing code. Gah | 20:57 |
| dolphm | ayoung: =) | 20:57 |
| morganfainberg | ayoung, and i realized how much of my life is meetings :P | 20:58 |
| dolphm | "You can look, but don't touch." "But I want to write my own encryption implementation." "Please, please don't touch ANYTHING." | 20:58 |
| ayoung | dolphm, exactly | 20:58 |
| morganfainberg | dolphm, no worse "oh god why did you write that?!" | 20:58 |
| ayoung | morganfainberg, I feel that way about Keystone tokens. | 20:58 |
| morganfainberg | dolphm, "you touched something" | 20:58 |
| morganfainberg | ayoung, i feel that way about a lot of keystone things. | 20:59 |
| ayoung | morganfainberg, You know that whole rant you said earlier about SAML? I have actually said pretty much the exact same thing. I was only pretending to argue with you | 20:59 |
| morganfainberg | ayoung, :) | 20:59 |
| morganfainberg | ayoung, i figured. | 20:59 |
| morganfainberg | ayoung, you usually get way more involved when you legitimately disagree with a direction | 21:00 |
| ayoung | morganfainberg, If I can figure out a way to keep from handing a token to Nova that nova has to hand to Neutron (etc) we can get rid of sooooo much | 21:00 |
| morganfainberg | ayoung, i'd love to do that | 21:00 |
| stevemar | morganfainberg, i looked away for a bit, did we come to a resolution on the whole catalog issue? | 21:00 |
| morganfainberg | stevemar, uh. well sortof | 21:00 |
| morganfainberg | ayoung, a poor re-implmentation of kerberos is not what i want keystone's auth model to be. | 21:02 |
| ayoung | morganfainberg, Kerberos is only authentication anyway | 21:02 |
| morganfainberg | i wasn't specific on which Auth<thing> it was ;) | 21:02 |
| ayoung | In a corp environment, Kerberos is always partenred with an LDAP groups lookup to see what a user can actually do | 21:03 |
| *** pdesai1 has joined #openstack-keystone | 21:03 | |
| openstackgerrit | Merged openstack/python-keystoneclient-kerberos: Fix the package name in setup.cfg https://review.openstack.org/158860 | 21:03 |
| morganfainberg | jamielennox, ayoung, https://pypi.python.org/pypi/python-keystoneclient-kerberos | 21:06 |
| morganfainberg | we had a bug in setup.cfg | 21:06 |
| morganfainberg | that was the whole issue | 21:06 |
| morganfainberg | all fixed now | 21:06 |
| morganfainberg | and released | 21:06 |
| *** pdesai has quit IRC | 21:06 | |
| ayoung | excellent. Thanks morganfainberg | 21:06 |
| jamielennox | what was it? | 21:07 |
| morganfainberg | jamielennox, https://github.com/openstack/python-keystoneclient-kerberos/commit/46d0f4eedf163d358831fa875a2ce676fabd557f | 21:07 |
| jamielennox | morganfainberg: oh | 21:08 |
| jamielennox | morganfainberg: dumb :) | 21:08 |
| ayoung | mtreinish, can you put this one to bed https://review.openstack.org/#/c/145331 it is asecurity issue, and tempest is key to move the ball down the court | 21:10 |
| ayoung | mtreinish, consider this an official request for Horse Trading. | 21:11 |
| mtreinish | ayoung: heh, it was on my review list for today anyway :) | 21:11 |
| mtreinish | ayoung: it won't be able to land util the icehouse gate is fixed (the fix should be going through the gate now) | 21:12 |
| ayoung | mtreinish, thanks. Its one of those cases where RH has put all the effort in to it, and we are a bit trigger shy cuz we don't want to be railroading through changes, but it is the right thing | 21:12 |
| ayoung | mtreinish, I mean, I don't think anyone is against the idea of "use SSL everywhere" right? | 21:13 |
| ayoung | and thanks for dealing with the gate issue, too | 21:13 |
| mtreinish | ayoung: sure, no worries | 21:15 |
| mtreinish | ayoung: I just +A'd the change | 21:15 |
| morganfainberg | jamielennox, can you check -federation for the same bug? | 21:15 |
| ayoung | mtreinish, now...what horse was it I was supposed to buy from you? | 21:15 |
| morganfainberg | jamielennox, and if it's there feel free to self +2/+A it. | 21:15 |
| mtreinish | ayoung: heh, I'll put it in the bank :) once I figure out the request_id logging for keystone | 21:16 |
| ayoung | Ah..already paid! | 21:16 |
| morganfainberg | jamielennox, nvm https://github.com/openstack/python-keystoneclient-federation/blob/master/setup.cfg#L2 looks good to me | 21:16 |
| morganfainberg | jamielennox, are we ready to tag/release -federation too? | 21:17 |
| jamielennox | morganfainberg: no | 21:18 |
| jamielennox | i never know how much to trust pypi stats | 21:22 |
| jamielennox | 37 downloads today of ksc-kerberos | 21:22 |
| morganfainberg | jamielennox, just ignore the stats | 21:23 |
| *** diegows has joined #openstack-keystone | 21:23 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis token backend https://review.openstack.org/150844 | 21:24 |
| lbragstad | dolphm: are you able to run nosetests against test_content_types.py? | 21:30 |
| dolphm | lbragstad: test_v2? | 21:30 |
| lbragstad | dolphm: yes | 21:30 |
| dolphm | lbragstad: either way, yes | 21:30 |
| lbragstad | ok, thanks | 21:31 |
| dolphm | lbragstad: you can't? | 21:31 |
| lbragstad | dolphm: nope, cleaned out my .pyc files but end up with 45 some errors | 21:31 |
| dolphm | lbragstad: | 21:31 |
| dolphm | .. | 21:32 |
| *** marzif_ has quit IRC | 21:32 | |
| dolphm | lbragstad: still running but http://pasteraw.com/neaquvi7t41ykab887t0jrh7o3x5hqy | 21:32 |
| *** lhcheng_afk is now known as lhcheng | 21:34 | |
| lbragstad | dolphm: did yours complete with 116 tests passed? | 21:36 |
| dolphm | lbragstad: yes | 21:38 |
| *** _cjones_ has quit IRC | 21:39 | |
| morganfainberg | stevemar, ok so once i'm done with meetings and $stuff$ for bp cleanup / priority reviews i'll rebase that other patchset for you for the cadf failure notifications | 21:39 |
| *** pnavarro has quit IRC | 21:46 | |
| *** diegows has quit IRC | 21:46 | |
| stevemar | morganfainberg, tried to do some LP cleanup for you | 21:49 |
| morganfainberg | stevemar, thnx | 21:50 |
| *** _cjones_ has joined #openstack-keystone | 21:50 | |
| *** karimb has joined #openstack-keystone | 21:52 | |
| morganfainberg | anyone have an issue with '/' being an excluded character from project names? | 21:59 |
| *** pdesai1 has quit IRC | 22:00 | |
| morganfainberg | before we start merging things in. | 22:00 |
| bknudson | morganfainberg: I think that's proposing a change that's not backwards-compatible. | 22:00 |
| morganfainberg | bknudson, yeah thats my feeling | 22:00 |
| bknudson | it doesn't meet the stability guidelines. | 22:00 |
| bknudson | unless it's disabled by default. | 22:01 |
| morganfainberg | yep | 22:01 |
| marekd | bknudson: they said they had some migrations plans that was generally agreed. | 22:02 |
| *** pdesai has joined #openstack-keystone | 22:02 | |
| morganfainberg | marekd, but i don't see any clear migration plan nor how that would impact an operator | 22:02 |
| *** c_soukup has joined #openstack-keystone | 22:02 | |
| bknudson | marekd: they got an exemption from the openstack stability requirements? | 22:02 |
| morganfainberg | or end user. | 22:02 |
| * morganfainberg has not proposed an exemption | 22:02 | |
| marekd | bknudson: i don't know | 22:02 |
| marekd | rodrigods: raildo are the persons to ask. | 22:03 |
| *** elarson has joined #openstack-keystone | 22:03 | |
| bknudson | Here's the list: https://wiki.openstack.org/wiki/APIChangeGuidelines#Generally_Not_Acceptable | 22:03 |
| *** csoukup has quit IRC | 22:04 | |
| morganfainberg | bknudson, fwiw, -2 has been applied to it | 22:04 |
| sigmavirus24 | elarson: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/session.py#L131 | 22:04 |
| bknudson | morganfainberg: thanks! | 22:04 |
| bknudson | doesn't want keystone to get kicked out of openstack. | 22:04 |
| sigmavirus24 | elarson: also https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/session.py#L77 | 22:04 |
| morganfainberg | haha | 22:04 |
| elarson | sigmavirus24: there it is! | 22:04 |
| morganfainberg | bknudson, we have been good about not breaking things | 22:04 |
| sigmavirus24 | elarson: i'll be your tour guide today =P | 22:05 |
| bknudson | let's not start now. | 22:05 |
| morganfainberg | bknudson, but this is a challenging thing to address. | 22:05 |
| morganfainberg | bknudson, i think we broke the API contract 2 times in ~6 cycles. | 22:05 |
| elarson | sigmavirus24: I tip really well | 22:05 |
| morganfainberg | and those were clearly we either violated RFC or OMG security | 22:05 |
| henrynash | dumb question on how our routers->controller calls work…. | 22:05 |
| morganfainberg | henrynash, pattern matching | 22:05 |
| morganfainberg | henrynash, i mean... there is a lot more to it, but thats the gist of it, matches pattern, pass request to specified method | 22:06 |
| morganfainberg | some are baked in patterns in the V3 router base | 22:06 |
| henrynash | what determins the name of the parameter in teh controller api call that cotains the body of, say, a put/patch call? | 22:06 |
| morganfainberg | iirc, i'd need to 2x check, but it's exploded as kwargs from JSON | 22:06 |
| henrynash | is it just the key of the dict, i.e. {‘domain’ : {}} ? | 22:06 |
| morganfainberg | via the request object | 22:06 |
| morganfainberg | yeah | 22:07 |
| morganfainberg | i *think* | 22:07 |
| morganfainberg | i'd need to go dig to be 100% sure | 22:07 |
| *** lhcheng has quit IRC | 22:07 | |
| morganfainberg | cburgess, ping - coffee? | 22:07 |
| dstanek | morganfainberg: is this to replace or supplement decorators? https://review.openstack.org/#/c/158600/5 | 22:08 |
| morganfainberg | dstanek, replace, since the decorators are far too limited and do too much digging into the callstack to figure things out | 22:09 |
| *** gyee has quit IRC | 22:09 | |
| morganfainberg | but, since not everything was converted there, no deprecation was set. this is specifically with the cadf-for-all-notifications view in mind | 22:09 |
| *** lhcheng has joined #openstack-keystone | 22:09 | |
| *** sacharya has joined #openstack-keystone | 22:09 | |
| morganfainberg | the decorators are nice in one regard, but we start running into silly patterns like adding a kwarg to a method so a decorator can try and consume it. it makes my skin crawl. | 22:10 |
| dstanek | morganfainberg: ++ i have been known to publicly blast decorators; almost never a good idea | 22:11 |
| morganfainberg | dstanek, i'd much much rather use the pecan model, but thread.local has about as much disdain as my view on adding kwargs so a decorator can consume it | 22:11 |
| dolphm | dstanek: when are they a good idea? | 22:11 |
| morganfainberg | so, i'll say we make the notifications better by just notifying with the values we need where we need it instead of by magic | 22:11 |
| cburgess | morganfainberg: Sure | 22:11 |
| henrynash | ok, thanks….just having a problem with my put/patch calls failing with “resource not found” | 22:11 |
| sigmavirus24 | elarson: ping me with other questions wherever | 22:11 |
| morganfainberg | dolphm, memoization caching | 22:12 |
| dstanek | dolphm: when you move into a new house and the walls are all blank :-) | 22:12 |
| morganfainberg | dolphm, deprecation warnings where the only thing you're doing is doing "hey you shouldn't do this anymore, go over there" | 22:12 |
| elarson | sigmavirus24: I'll try to avoid bugging you ;) | 22:12 |
| morganfainberg | cburgess, should i walk over to your office or meet me somewhere? | 22:13 |
| dolphm | dstanek: disagree with morganfainberg? | 22:13 |
| dstanek | dolphm: no | 22:13 |
| cburgess | morganfainberg: inteligensia? | 22:13 |
| morganfainberg | cburgess, sure. | 22:13 |
| dstanek | my general rule is that they should only be used it they don't force context on a function or interfere with it's inputs/outputs | 22:14 |
| cburgess | morganfainberg: When? Now? 2:30? What time will you be there? | 22:14 |
| morganfainberg | cburgess, i'm already here ;) | 22:14 |
| dstanek | so i find things like @route('/') completely dumb :-) | 22:14 |
| cburgess | morganfainberg: LOL ok.. I'll head over. | 22:14 |
| morganfainberg | dolphm, sure. | 22:15 |
| morganfainberg | erm dstanek, sure | 22:15 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 22:15 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Emit failure notifications for CADF audits events https://review.openstack.org/156905 | 22:15 |
| stevemar | morganfainberg, not using the new function you made, just rebased to resovle conflicts ^ | 22:16 |
| stevemar | gotta head out to a meetup! | 22:16 |
| morganfainberg | stevemar, ++ yeah thanks | 22:16 |
| morganfainberg | stevemar, saw it. will fix those as well today | 22:16 |
| *** rm_work is now known as rm_work|away | 22:16 | |
| *** radez is now known as radez_g0n3 | 22:16 | |
| *** gyee has joined #openstack-keystone | 22:17 | |
| *** ChanServ sets mode: +v gyee | 22:17 | |
| *** stevemar has quit IRC | 22:17 | |
| *** gyee has quit IRC | 22:18 | |
| *** gyee has joined #openstack-keystone | 22:26 | |
| *** ChanServ sets mode: +v gyee | 22:26 | |
| dolphm | dstanek: alrighty then, i agree | 22:27 |
| *** darrenc is now known as darrenc_afk | 22:29 | |
| *** lhcheng has quit IRC | 22:30 | |
| *** lhcheng has joined #openstack-keystone | 22:32 | |
| *** jaosorior has joined #openstack-keystone | 22:33 | |
| *** gyee has quit IRC | 22:34 | |
| *** openstackgerrit has quit IRC | 22:37 | |
| *** openstackgerrit has joined #openstack-keystone | 22:37 | |
| *** nkinder has quit IRC | 22:39 | |
| dstanek | dolphm: i don't remember what i said but i blasted them here : http://frompythonimportpodcast.com/2010/06/15/episode-004-dave-hates-decorators-where-code-goes-to-die/ | 22:44 |
| dstanek | i should probably listen again since i was mostly caught off-guard by the topic | 22:45 |
| *** henrynash has quit IRC | 22:47 | |
| *** toddnni has quit IRC | 22:53 | |
| *** toddnni has joined #openstack-keystone | 22:54 | |
| *** c_soukup has quit IRC | 22:55 | |
| *** darrenc_afk is now known as darrenc | 22:56 | |
| *** rm_work|away is now known as rm_work | 23:00 | |
| lbragstad | easy one https://review.openstack.org/#/c/158854/ | 23:00 |
| *** harlowja is now known as harlowja_away | 23:02 | |
| *** pdesai1 has joined #openstack-keystone | 23:04 | |
| *** harlowja_away is now known as harlowja | 23:05 | |
| *** lhcheng has quit IRC | 23:06 | |
| *** lhcheng has joined #openstack-keystone | 23:06 | |
| *** bknudson has quit IRC | 23:07 | |
| *** mestery has quit IRC | 23:07 | |
| *** lhcheng_ has joined #openstack-keystone | 23:08 | |
| *** pdesai has quit IRC | 23:08 | |
| *** lhcheng_ has quit IRC | 23:09 | |
| *** lhcheng_ has joined #openstack-keystone | 23:10 | |
| *** lhcheng has quit IRC | 23:11 | |
| *** _cjones_ has quit IRC | 23:12 | |
| *** Tahmina has joined #openstack-keystone | 23:13 | |
| *** _cjones_ has joined #openstack-keystone | 23:14 | |
| *** sacharya has quit IRC | 23:17 | |
| *** chlong has joined #openstack-keystone | 23:19 | |
| *** pdesai1 has quit IRC | 23:23 | |
| *** spandhe has quit IRC | 23:23 | |
| *** karimb has quit IRC | 23:25 | |
| *** gyee has joined #openstack-keystone | 23:27 | |
| *** ChanServ sets mode: +v gyee | 23:27 | |
| *** _cjones_ has quit IRC | 23:30 | |
| *** lhcheng_ has quit IRC | 23:33 | |
| jamielennox | gyee: do you mind having a look at https://review.openstack.org/#/c/157277/ and https://review.openstack.org/#/c/157278/ | 23:33 |
| *** gordc has quit IRC | 23:33 | |
| *** lhcheng has joined #openstack-keystone | 23:33 | |
| gyee | jamielennox, looking | 23:34 |
| *** lhcheng_ has joined #openstack-keystone | 23:35 | |
| *** lhcheng has quit IRC | 23:38 | |
| *** henrynash has joined #openstack-keystone | 23:40 | |
| *** ChanServ sets mode: +v henrynash | 23:40 | |
| *** ayoung has quit IRC | 23:42 | |
| rodrigods | morganfainberg, saw your comment in the slash change | 23:42 |
| rodrigods | looks like we are really breaking the api | 23:42 |
| rodrigods | :( | 23:42 |
| *** _cjones_ has joined #openstack-keystone | 23:43 | |
| *** ljfisher has quit IRC | 23:45 | |
| *** chlong_ has joined #openstack-keystone | 23:50 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 23:51 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 23:52 |
| dstanek | is it pyCADF or PyCADF? | 23:53 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove explicit mentions of JSON from test_v2 https://review.openstack.org/158917 | 23:55 |
| *** Tahmina has quit IRC | 23:58 | |
| *** joesavak has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
