| *** spandhe has quit IRC | 00:07 | |
| stevemar | morganfainberg, meh, not worth the effort | 00:10 |
|---|---|---|
| *** markvoelker has joined #openstack-keystone | 00:25 | |
| dstanek | stevemar: most things aren't | 00:27 |
| *** bknudson has joined #openstack-keystone | 00:30 | |
| *** ChanServ sets mode: +v bknudson | 00:30 | |
| *** trey has quit IRC | 00:33 | |
| *** trey has joined #openstack-keystone | 00:35 | |
| *** mattfarina has quit IRC | 00:36 | |
| *** zzzeek has quit IRC | 00:41 | |
| *** browne has quit IRC | 00:46 | |
| *** gyee has quit IRC | 00:48 | |
| *** _cjones_ has quit IRC | 00:55 | |
| *** gokrokve has quit IRC | 01:11 | |
| *** lhcheng has quit IRC | 01:18 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: WIP: Randomize the memcache urls https://review.openstack.org/167468 | 01:21 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove parent_id in v2 tenant response https://review.openstack.org/164367 | 01:23 |
| *** diegows has quit IRC | 01:25 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample config file. https://review.openstack.org/163654 | 01:25 |
| *** ayoung has joined #openstack-keystone | 01:30 | |
| *** ChanServ sets mode: +v ayoung | 01:30 | |
| *** mattfarina has joined #openstack-keystone | 01:36 | |
| *** browne has joined #openstack-keystone | 01:37 | |
| *** stevemar has quit IRC | 01:46 | |
| *** dims has quit IRC | 01:47 | |
| *** erkules_ has joined #openstack-keystone | 02:13 | |
| *** erkules has quit IRC | 02:15 | |
| *** spandhe has joined #openstack-keystone | 02:16 | |
| *** harlowja is now known as harlowja_away | 02:17 | |
| *** spandhe_ has joined #openstack-keystone | 02:20 | |
| *** spandhe has quit IRC | 02:21 | |
| *** spandhe_ is now known as spandhe | 02:21 | |
| openstackgerrit | Merged openstack/keystone: create _member_ role as specified in CONF https://review.openstack.org/142897 | 02:22 |
| openstackgerrit | Merged openstack/keystone: Remove parent_id in v2 token response https://review.openstack.org/156867 | 02:27 |
| *** thedodd has joined #openstack-keystone | 02:28 | |
| *** _cjones_ has joined #openstack-keystone | 02:29 | |
| *** _cjones_ has quit IRC | 02:29 | |
| *** _cjones_ has joined #openstack-keystone | 02:30 | |
| *** _cjones_ has quit IRC | 02:30 | |
| *** _cjones_ has joined #openstack-keystone | 02:31 | |
| *** richm has quit IRC | 02:38 | |
| *** haneef_ has joined #openstack-keystone | 02:40 | |
| *** r-daneel has quit IRC | 02:41 | |
| *** thedodd has quit IRC | 02:47 | |
| *** samueldmq has joined #openstack-keystone | 03:01 | |
| *** tqtran has quit IRC | 03:04 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Template for testing document https://review.openstack.org/163882 | 03:06 |
| *** jonxml has joined #openstack-keystone | 03:08 | |
| *** jonxml has quit IRC | 03:08 | |
| *** samueldmq has quit IRC | 03:14 | |
| *** cburgess has quit IRC | 03:28 | |
| *** cburgess has joined #openstack-keystone | 03:28 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:36 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/144860 | 03:45 |
| *** csd has quit IRC | 03:51 | |
| *** csd has joined #openstack-keystone | 03:59 | |
| *** yasu_ has joined #openstack-keystone | 03:59 | |
| *** yasu_ has quit IRC | 04:03 | |
| *** krtaylor has quit IRC | 04:05 | |
| *** krtaylor has joined #openstack-keystone | 04:08 | |
| *** stevemar has joined #openstack-keystone | 04:17 | |
| *** ChanServ sets mode: +v stevemar | 04:17 | |
| *** lhcheng has joined #openstack-keystone | 04:18 | |
| *** lhcheng has quit IRC | 04:23 | |
| stevemar | jamielennox, ping | 04:41 |
| *** rushiagr_away is now known as rushiagr | 04:44 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update sample config file https://review.openstack.org/163654 | 04:46 |
| *** drjones has joined #openstack-keystone | 05:05 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update install.rst for Fedora https://review.openstack.org/167488 | 05:05 |
| *** _cjones_ has quit IRC | 05:08 | |
| *** spandhe has quit IRC | 05:23 | |
| jamielennox | stevemar: kindof | 05:24 |
| stevemar | jamielennox, oh nice | 05:24 |
| stevemar | jamielennox, well, i'll leave my question open ended on the cache review | 05:24 |
| jamielennox | stevemar: that was me replying to the ping - i haven't seen the comment | 05:24 |
| stevemar | jamielennox, yeah, no worries they were in regards to the same thing | 05:25 |
| stevemar | instead of asking you on irc i will ask there | 05:25 |
| jamielennox | ok | 05:25 |
| jamielennox | so just to note, the other thing that really needs to be serialized for OSC is the version discovery logic | 05:25 |
| jamielennox | i'm torn between whether i should expose that from the session, give like a get_state() function that you can serialize manually | 05:26 |
| jamielennox | or use something like | 05:26 |
| jamielennox | https://github.com/ionrock/cachecontrol | 05:26 |
| jamielennox | which is what i think pip uses | 05:26 |
| stevemar | the latter sounds tried and true | 05:27 |
| jamielennox | but it comes with an inbuilt file cache handler, i just don't know what you should/could cache of auth-ed requests | 05:27 |
| jamielennox | but i guess it means we could start putting actual http cache headers in and expecting them to be used | 05:28 |
| *** drjones has quit IRC | 05:38 | |
| *** _cjones_ has joined #openstack-keystone | 05:38 | |
| *** drjones has joined #openstack-keystone | 05:39 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Document websso setup https://review.openstack.org/164012 | 05:39 |
| *** _cjones_ has quit IRC | 05:43 | |
| jamielennox | stevemar: oh, also https://github.com/jamielennox/django-openstack-auth-kerberos seems to be working well, i'll see how the approach goes with websso stuff tomorrow | 05:47 |
| *** jamielennox is now known as jamielennox|away | 05:49 | |
| morganfainberg | stevemar, ping | 05:50 |
| stevemar | jamielennox, i think tqtran and lhcheng are lookin at that | 05:50 |
| stevemar | morganfainberg, whats up | 05:50 |
| *** lhcheng has joined #openstack-keystone | 05:50 | |
| *** ishant has joined #openstack-keystone | 05:52 | |
| *** dims has joined #openstack-keystone | 05:54 | |
| *** markvoelker has quit IRC | 06:17 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Rename notification for create/delete grants https://review.openstack.org/167501 | 06:19 |
| *** dims has quit IRC | 06:28 | |
| *** markvoelker has joined #openstack-keystone | 06:47 | |
| *** markvoelker has quit IRC | 06:52 | |
| *** afazekas is now known as __afazekas | 07:01 | |
| morganfainberg | ayoung, ever want a vector version of the Keystone logo? https://github.com/morganfainberg/keystone_stuff/blob/master/KeystoneLogo.svg | 07:03 |
| morganfainberg | or well .svg at least | 07:03 |
| *** drjones has quit IRC | 07:05 | |
| *** browne has quit IRC | 07:14 | |
| *** henrynash has joined #openstack-keystone | 07:16 | |
| *** ChanServ sets mode: +v henrynash | 07:16 | |
| *** stevemar has quit IRC | 07:17 | |
| breton | keystone has logo? | 07:27 |
| morganfainberg | breton, it's an oooooold logo back from when termie made keystone lite | 07:27 |
| morganfainberg | breton, :) | 07:27 |
| *** afazekas has joined #openstack-keystone | 07:32 | |
| *** markvoelker has joined #openstack-keystone | 07:48 | |
| *** Bsony has joined #openstack-keystone | 07:50 | |
| *** chlong has quit IRC | 07:52 | |
| *** markvoelker has quit IRC | 07:53 | |
| marekd | morganfainberg: we should made a spec for Keystone logo | 08:06 |
| *** dims has joined #openstack-keystone | 08:13 | |
| *** lhcheng is now known as lhcheng_afk | 08:26 | |
| *** jistr has joined #openstack-keystone | 08:38 | |
| *** dims has quit IRC | 08:45 | |
| *** markvoelker has joined #openstack-keystone | 08:49 | |
| *** Bsony_ has joined #openstack-keystone | 08:51 | |
| *** pnavarro has joined #openstack-keystone | 08:54 | |
| *** markvoelker has quit IRC | 08:54 | |
| *** Bsony has quit IRC | 08:54 | |
| *** Bsony_ has quit IRC | 09:22 | |
| *** lhcheng_afk has quit IRC | 09:31 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Let "region" be effective both in the testcase and API https://review.openstack.org/167534 | 09:37 |
| *** davechen has joined #openstack-keystone | 09:37 | |
| *** ajayaa has joined #openstack-keystone | 09:40 | |
| *** dims has joined #openstack-keystone | 09:43 | |
| *** dims_ has joined #openstack-keystone | 09:46 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Let "region" be effective both in the testcase and API https://review.openstack.org/167534 | 09:47 |
| *** markvoelker has joined #openstack-keystone | 09:50 | |
| *** dims has quit IRC | 09:50 | |
| *** davechen has left #openstack-keystone | 09:52 | |
| *** markvoelker has quit IRC | 09:54 | |
| openstackgerrit | rajiv proposed openstack/python-keystoneclient: Now keystone enables listing of user by name https://review.openstack.org/167543 | 10:18 |
| *** henrynash has quit IRC | 10:33 | |
| *** bknudson has quit IRC | 10:33 | |
| *** erkules_ is now known as erkules | 10:36 | |
| *** erkules has joined #openstack-keystone | 10:36 | |
| *** krykowski has joined #openstack-keystone | 10:38 | |
| openstackgerrit | Merged openstack/keystone: Update sample config file https://review.openstack.org/163654 | 10:43 |
| *** Bsony has joined #openstack-keystone | 10:48 | |
| *** Tahmina has joined #openstack-keystone | 10:48 | |
| *** samueldmq-away is now known as samueldmq- | 10:49 | |
| *** samueldmq- is now known as samueldmq | 10:49 | |
| samueldmq | morganfainberg, marekd ++ keystone logo o/ | 10:50 |
| marekd | hey | 10:50 |
| samueldmq | marekd, hello, good morning :) | 10:50 |
| *** markvoelker has joined #openstack-keystone | 10:50 | |
| marekd | samueldmq: good morning :-) | 10:51 |
| *** markvoelker has quit IRC | 10:55 | |
| *** henrynash has joined #openstack-keystone | 11:05 | |
| *** ChanServ sets mode: +v henrynash | 11:05 | |
| marekd | henrynash: Hi. Do you know if we are still allowed to +A patches like this one: https://review.openstack.org/#/c/167488/ ? | 11:06 |
| marekd | morganfainberg: ^^ | 11:10 |
| *** henrynash has quit IRC | 11:12 | |
| *** bdossant has joined #openstack-keystone | 11:16 | |
| *** bdossant has quit IRC | 11:21 | |
| *** henrynash has joined #openstack-keystone | 11:23 | |
| *** ChanServ sets mode: +v henrynash | 11:23 | |
| marekd | henrynash: Hi. Do you know if we are still allowed to +A patches like this one: https://review.openstack.org/#/c/167488/ ? | 11:44 |
| *** Tahmina has quit IRC | 11:47 | |
| *** chlong has joined #openstack-keystone | 11:50 | |
| *** markvoelker has joined #openstack-keystone | 11:51 | |
| henrynash | marekd: I think so……I don’t believe there is any reason not to... | 11:51 |
| *** markvoelker has quit IRC | 11:56 | |
| *** openstackgerrit has quit IRC | 12:06 | |
| *** openstackgerrit has joined #openstack-keystone | 12:06 | |
| *** henrynash has quit IRC | 12:06 | |
| *** dims_ has quit IRC | 12:07 | |
| *** jaosorior has joined #openstack-keystone | 12:08 | |
| *** dims has joined #openstack-keystone | 12:08 | |
| *** markvoelker has joined #openstack-keystone | 12:09 | |
| *** amakarov_away is now known as amakarov | 12:10 | |
| *** richm has joined #openstack-keystone | 12:12 | |
| *** ajayaa has quit IRC | 12:14 | |
| *** rushiagr is now known as rushiagr_away | 12:20 | |
| *** junhongl_ has joined #openstack-keystone | 12:20 | |
| *** ajayaa has joined #openstack-keystone | 12:26 | |
| *** gordc has joined #openstack-keystone | 12:34 | |
| *** Bsony has quit IRC | 12:50 | |
| *** bknudson has joined #openstack-keystone | 12:51 | |
| *** ChanServ sets mode: +v bknudson | 12:51 | |
| openstackgerrit | Merged openstack/keystone: Update install.rst for Fedora https://review.openstack.org/167488 | 12:53 |
| *** Bsony has joined #openstack-keystone | 12:56 | |
| *** rwsu has quit IRC | 12:56 | |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 13:08 |
| *** Bsony has quit IRC | 13:16 | |
| *** ishant has quit IRC | 13:18 | |
| *** Bsony has joined #openstack-keystone | 13:21 | |
| *** joesavak has joined #openstack-keystone | 13:21 | |
| *** gabriel-bezerra has joined #openstack-keystone | 13:26 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Document mapping of policy action to operation https://review.openstack.org/155919 | 13:27 |
| *** joesavak has quit IRC | 13:27 | |
| *** Bsony has quit IRC | 13:29 | |
| *** ajayaa has quit IRC | 13:30 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update access control configuration in httpd config https://review.openstack.org/164515 | 13:33 |
| *** krtaylor has quit IRC | 13:35 | |
| *** rushiagr_away is now known as rushiagr | 13:35 | |
| *** openstackgerrit has quit IRC | 13:36 | |
| *** openstackgerrit has joined #openstack-keystone | 13:36 | |
| *** angular_mike has joined #openstack-keystone | 13:37 | |
| *** Bsony has joined #openstack-keystone | 13:38 | |
| *** kodoku has joined #openstack-keystone | 13:38 | |
| rodrigods | marekd, hey, is there a change to add the /saml2/ecp endpoint? | 13:39 |
| kodoku | Hi, I have just a question : What is the role of valid column in token table in keystone database ? | 13:39 |
| marekd | rodrigods: what do you mean ? | 13:39 |
| bknudson | kodoku: if the token has been revoked then valid is false. | 13:39 |
| rodrigods | marekd, a new endpoint is being added here: https://review.openstack.org/#/c/162866/ | 13:41 |
| marekd | rodrigods: https://review.openstack.org/#/c/162866/ there is this... | 13:41 |
| kodoku | bknudson: ok So what is the variable in keystone.conf for increase time to revoke because i have issue with glance and in my database I see : id: bbe8a562d4644565b7d245660ad12847 | valid: 0 | expired: 2015-03-29 14:51:28 | | 13:41 |
| rodrigods | marekd, yep, an API spec update is needed (and should merge prior to this change) | 13:41 |
| *** krtaylor has joined #openstack-keystone | 13:41 | |
| rodrigods | marekd, is there a change for it? | 13:41 |
| *** diegows has joined #openstack-keystone | 13:41 | |
| marekd | rodrigods: rodrigods ah, i don't think so. | 13:42 |
| marekd | go ahead :-) | 13:42 |
| bknudson | kodoku: tokens are revoked due to a change in password or changing roles for the user or by being explicitly deleted... there's no time to revoke. | 13:42 |
| kodoku | bknudson hummmm, It's admin user and I have never change his password | 13:44 |
| kodoku | bknudson: I have this bug : https://bugs.launchpad.net/nova/+bug/1407592 | 13:44 |
| openstack | Launchpad bug 1407592 in OpenStack Compute (nova) "Snapshots fail to upload larger (~30G+) images, with error '500 Internal Server Error Failed to upload image'" [Undecided,Incomplete] | 13:44 |
| bknudson | kodoku: as I mentioned, there are other reasons a token can be revoked. | 13:44 |
| rodrigods | marekd, ok | 13:45 |
| *** r-daneel has joined #openstack-keystone | 13:45 | |
| kodoku | bknudson: ok so maybe you have an idea for this revoke ? because I make just a snapshot in horizon and I have always this bug if snapshot is long.... | 13:46 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:47 | |
| marekd | maybe token expire ? | 13:48 |
| kodoku | bknudson: ok I see in keystone log "DELETE /v2.0/tokens/dae5335b53a8409285c0b42801a650d6 HTTP/1.1" 204 103 0.027625" | 13:48 |
| kodoku | marekd token have 5 days of live | 13:49 |
| *** krtaylor has left #openstack-keystone | 13:50 | |
| kodoku | Why my token is delete O_o | 13:50 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Deprecate memcache as token persistence backend https://review.openstack.org/167594 | 13:51 |
| kodoku | bknudson No ideas ? | 13:55 |
| bknudson | kodoku: the only way for that to happen is for somebody to issue a DELETE /v2.0/tokens/dae5335b53a8409285c0b42801a650d6 | 13:55 |
| bknudson | when somebody does that then the token is revoked. | 13:56 |
| bknudson | keystone doesn't have any control over this. | 13:56 |
| kodoku | bknudson: I am the only one to use my platform and I don't use api... | 13:57 |
| *** pnavarro has quit IRC | 13:57 | |
| kodoku | maybe a glance bug ? | 13:58 |
| bknudson | I don't know glance. | 14:01 |
| *** Ephur has quit IRC | 14:03 | |
| *** Ephur has joined #openstack-keystone | 14:05 | |
| *** uschreiber_ has joined #openstack-keystone | 14:08 | |
| dstanek | kodoku: is there a user agent string in your log? | 14:09 |
| *** Ephur has quit IRC | 14:10 | |
| bknudson | oooh we should log the user agent. | 14:11 |
| bknudson | truncated in case they send us a long string. | 14:12 |
| *** henrynash has joined #openstack-keystone | 14:12 | |
| *** ChanServ sets mode: +v henrynash | 14:12 | |
| *** Ephur has joined #openstack-keystone | 14:13 | |
| kodoku | dstanek no user agent id | 14:13 |
| bknudson | there's a cross-project spec for request ID | 14:14 |
| kodoku | 2015-03-25 14:09:32.072 19136 INFO eventlet.wsgi.server [-] 10.121.141.41 - - [25/Mar/2015 14:09:32] "DELETE /v2.0/tokens/dae5335b53a8409285c0b42801a650d6 HTTP/1.1" 204 103 0.027625 | 14:14 |
| bknudson | which if the applications log that too then you'd know where it came from | 14:14 |
| kodoku | 10.121.141.41 is my horizon ip | 14:15 |
| kodoku | So horizon delete my token ? | 14:15 |
| dstanek | kodoku: looks like it | 14:16 |
| *** browne has joined #openstack-keystone | 14:16 | |
| kodoku | dstanek I try snap with glance python client for test | 14:16 |
| *** atiwari has joined #openstack-keystone | 14:17 | |
| *** timcline has joined #openstack-keystone | 14:21 | |
| *** Bsony has quit IRC | 14:22 | |
| bknudson | we've had complaints in the past where someone did something (boot an instance for example) and then delete the token (since they think they're done with it), and then the boot fails | 14:27 |
| bknudson | applications (such as nova) shouldn't forward the user's token on. | 14:28 |
| bknudson | they should create a trust or we should provide an easy way for a service to get a token from a token that doesn't get revoked. | 14:29 |
| kodoku | dstanek bknudson ok when I sign out of horizon, my token is delete !!! | 14:29 |
| kodoku | So when I sign out of horizon and if my snapshot is in progress, snap failed ! | 14:30 |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Inhrerit roles project calls on keystoneclient v3 https://review.openstack.org/167613 | 14:31 |
| *** rushiagr is now known as rushiagr_away | 14:42 | |
| *** carlosmarin has joined #openstack-keystone | 14:44 | |
| *** rushiagr_away is now known as rushiagr | 14:45 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Endpoint to generate ECP assertions https://review.openstack.org/167621 | 14:49 |
| rodrigods | marekd, ^ | 14:49 |
| *** samueldmq_ has joined #openstack-keystone | 14:49 | |
| *** atiwari has quit IRC | 14:51 | |
| marekd | rodrigods: is the exampple of ECP wrapper assertion generated by Keystone ? | 14:59 |
| ayoung | So If I do a keystone token-get from the command line and the user does not have a default project set in the user table, I still get back a tenant_id value. How'd we pull that one off? | 15:02 |
| *** browne has quit IRC | 15:04 | |
| ayoung | ah...env vars..right | 15:06 |
| *** henrynash has quit IRC | 15:07 | |
| *** openstackgerrit has quit IRC | 15:08 | |
| *** openstackgerrit has joined #openstack-keystone | 15:09 | |
| *** uschreiber_ has quit IRC | 15:09 | |
| *** _cjones_ has joined #openstack-keystone | 15:19 | |
| *** _cjones_ has quit IRC | 15:20 | |
| ayoung | $ keystone user-role-list | 15:21 |
| ayoung | WARNING: Bypassing authentication using a token & endpoint (authentication credentials are being ignored). | 15:21 |
| ayoung | Unknown Attribute: auth_tenant_id | 15:21 |
| ayoung | what did we do there... | 15:22 |
| breton | folks, what do you think of https://review.openstack.org/167594 ? | 15:23 |
| ayoung | breton, no. It is useful. I'd just put in a recommendation that people not use it at all. | 15:26 |
| ayoung | breton, If we get fernet tokens to take off, we can go ephemeral everywhere, and get rid of all the token backends | 15:26 |
| ayoung | I won't argue the relative merits of memcache versus memcache pool, as I would not run with either of them without revocation events. | 15:27 |
| breton | ayoung: but it's totally non-ha. If one of memcache instances dies, the whole cloud becomes slow | 15:29 |
| *** stevemar has joined #openstack-keystone | 15:29 | |
| *** ChanServ sets mode: +v stevemar | 15:29 | |
| ayoung | breton, we don't just desing for HA. We have many people running mini-deployments all in one | 15:29 |
| breton | isn't it the the concept of cloud that we can lose a node and keep everything running as before? | 15:30 |
| ayoung | removing it would cause more churn than leaving it. | 15:30 |
| ayoung | breton, the surest way to find out who uses a feature that you would never use yourself is threaten to remove it. Then find oput who yells when you break things | 15:31 |
| breton | ayoung: the problem is not that no one uses it. The problem is that it's a ticking bomb. And if people rely on it and think "well, it supports multiple memcache hosts, what can go wrong?" it's going to explode on them | 15:32 |
| *** samueldmq_ has quit IRC | 15:33 | |
| *** kodoku has quit IRC | 15:35 | |
| breton | memcache_pool lacks this problem. In fact, it solves multiple problems of memcache driver, including the one linked to the review. | 15:38 |
| *** thedodd has joined #openstack-keystone | 15:41 | |
| ayoung | breton, that is fine, and I am not saying we should not promote the memcache pool, just that deprecating the memcache driver is not worth the effort. | 15:44 |
| *** richm has quit IRC | 15:44 | |
| *** _cjones_ has joined #openstack-keystone | 15:45 | |
| *** _cjones_ has quit IRC | 15:45 | |
| *** _cjones_ has joined #openstack-keystone | 15:46 | |
| ayoung | GAH...we don't make it possible to find out if default project is set on a user using the serivce token? | 15:48 |
| *** richm has joined #openstack-keystone | 15:48 | |
| *** gokrokve has joined #openstack-keystone | 15:51 | |
| *** rwsu has joined #openstack-keystone | 15:53 | |
| *** Bsony has joined #openstack-keystone | 15:56 | |
| ayoung | morganfainberg, https://etherpad.openstack.org/p/keystone-troubleshooting | 15:59 |
| ayoung | That might be more trouble than it is worth | 15:59 |
| *** Bsony has quit IRC | 16:02 | |
| *** richm has quit IRC | 16:03 | |
| *** richm has joined #openstack-keystone | 16:04 | |
| *** lhcheng_afk has joined #openstack-keystone | 16:09 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Restore name to services listed in catalog https://review.openstack.org/167675 | 16:16 |
| *** pnavarro has joined #openstack-keystone | 16:16 | |
| *** lhcheng_afk is now known as lhcheng | 16:19 | |
| *** chlong has quit IRC | 16:22 | |
| haneef | rodrigods: is your k2k federation setup work with current master? | 16:24 |
| stevemar | haneef, i think gyee tried it out recently a few days ago | 16:26 |
| haneef | Not with current master, as for as I know. I can ask him | 16:26 |
| gabriel-bezerra | haneef: you mean his blog post? | 16:26 |
| haneef | I thought he had is vm intact. I'm getting this error: https://bugs.launchpad.net/keystone/+bug/1436141 | 16:27 |
| openstack | Launchpad bug 1436141 in Keystone "Federation get unscoped token from assertion throws : ERROR tuple index out of range" [Undecided,New] | 16:27 |
| stevemar | seems to crap out at: local_mapping local: {u'name': u'{0}'} | 16:30 |
| stevemar | dstanek, can you take a look at the bug? ^ | 16:30 |
| *** krykowski has quit IRC | 16:31 | |
| *** browne has joined #openstack-keystone | 16:31 | |
| stevemar | haneef, i think the mapping is off | 16:31 |
| haneef | Can you explain it bit? Is that a configuration? | 16:32 |
| *** chlong has joined #openstack-keystone | 16:33 | |
| stevemar | haneef, i commented on the patch, a different mapping, try that one out | 16:35 |
| stevemar | haneef, the one in rodrigods blog might be incorrect | 16:36 |
| marekd | haneef: https://bugs.launchpad.net/keystone/+bug/1401057 i think this is your problem. | 16:37 |
| openstack | Launchpad bug 1401057 in Keystone "Direct mapping in mapping rules don't work with keywords" [Undecided,In progress] - Assigned to Marek Denis (marek-denis) | 16:37 |
| marekd | haneef: a remote rule that has some keyword like 'any_one_of' 'not_any_of' cannot pass value to the direct mapping ({0} in local rule) | 16:37 |
| haneef | Thanks stevemar: I will try it tonight and get back to you. It is in my home setup | 16:37 |
| stevemar | haneef, cool, it should work, i hope | 16:38 |
| marekd | stevemar: haneef it should. | 16:38 |
| stevemar | rodrigods, can you update your blog's mapping? maybe put up a new patch to our docs that gives a valid sample, and point your blog to the official mapping in the docs? it'll keep us from getting defects :) | 16:39 |
| *** chlong has quit IRC | 16:39 | |
| rodrigods | haneef, no... | 16:40 |
| rodrigods | stevemar, I've updated it recently, not using {0} anymore | 16:40 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: remove auth_ prefix https://review.openstack.org/167687 | 16:40 |
| *** gokrokve_ has joined #openstack-keystone | 16:40 | |
| rodrigods | marekd, yes, the example is generated by keystone | 16:40 |
| marekd | rodrigods: ok | 16:40 |
| openstackgerrit | Cyril Roelandt proposed openstack/python-keystoneclient: Prevent a UnicodeDecodeError in the s3token middleware https://review.openstack.org/161762 | 16:41 |
| ayoung | nkinder, ^^ I think that is going to be important for troubleshooting keystone. We might want to carry that in RDO etc for Juno and Icehouse | 16:41 |
| rodrigods | haneef, the blog post should work only for the Juno version of K2K | 16:42 |
| rodrigods | haneef, planning to write a new one to address the changes from Kilo | 16:43 |
| *** gokrokve has quit IRC | 16:43 | |
| marekd | ++ | 16:43 |
| haneef | marekd: One more question, In Shibblobath configuration, it works if I add SP entityId in Application defaults, but If I use Appplication override+applicationId setting, it doesn't. Any idea? | 16:43 |
| haneef | s/SP/IDP | 16:43 |
| marekd | not at the first glance. | 16:44 |
| ayoung | dtroyer, , does the common CLI support keystone operations using the SERVICE_TOKEN? | 16:48 |
| ayoung | ah --os-token maybe | 16:49 |
| *** gyee has joined #openstack-keystone | 16:49 | |
| *** ChanServ sets mode: +v gyee | 16:49 | |
| stevemar | ayoung, it sure does | 16:49 |
| dtroyer | ayoung: yup, —os-token and —os-url (not auth-url) | 16:50 |
| ayoung | stevemar, so I have people using Juno and Icehouse for deployments. Can we cound on the versions of the common CLI for troubleshooting those? | 16:50 |
| stevemar | ayoung, depends on what is installed by the distro | 16:51 |
| ayoung | dtroyer, thanks...need to figure out the library dependency issues to use that to troubleshoot Juno deployments; I don;t think people can update a Juno deployment use a modern CLI | 16:51 |
| ayoung | stevemar, nah, it is distro irrelevent. You ugrade one thing, and it pulls in an ugraded oslo lib, you;ve gone and corrupted the whole deployment | 16:51 |
| ayoung | you can't mix and match...but you can run the client on a different machine than you have deployed on, and I think that is the advice I will dole out | 16:52 |
| ayoung | stevemar, Trying to write a troubleshooting guide: https://etherpad.openstack.org/p/keystone-troubleshooting | 16:53 |
| ayoung | its hard to think Juno when my head is in Liberty | 16:53 |
| stevemar | ayoung, # mysql; use keystone; select * from assignments; :P | 16:54 |
| stevemar | dtroyer, getting funky results when using admin token for OSC | 16:54 |
| stevemar | i suggest we all look at: https://review.openstack.org/#/c/167692/ | 16:55 |
| stevemar | OS manuals patch for using Kilo, lots of updates | 16:56 |
| *** jistr has quit IRC | 16:58 | |
| *** tqtran has joined #openstack-keystone | 17:04 | |
| *** henrynash has joined #openstack-keystone | 17:07 | |
| *** ChanServ sets mode: +v henrynash | 17:07 | |
| ayoung | stevemar, I have a whole section on doing unspeakable things at the database level | 17:10 |
| ayoung | Or should I call you Sneaky McPeterson? | 17:10 |
| *** gokrokve_ has quit IRC | 17:15 | |
| *** amakarov is now known as amakarov_away | 17:18 | |
| *** harlowja_away is now known as harlowja | 17:18 | |
| stevemar | dolphm, ping | 17:19 |
| stevemar | dolphm, your LP skills are better than mine, can you target https://bugs.launchpad.net/keystone/+bug/1395959 to just Juno and not kilo? | 17:20 |
| openstack | Launchpad bug 1395959 in Keystone "assignment table migration fails for keystone-manage db_sync if duplicate entry exists" [Undecided,In progress] - Assigned to Will Foster (wfoster-b) | 17:20 |
| *** tqtran is now known as tqtran_afk | 17:20 | |
| ayoung | stevemar, I'm going to make that a blog post | 17:21 |
| stevemar | ayoung, excellent | 17:22 |
| stevemar | i like blog posts | 17:22 |
| stevemar | samueldmq, is this bug resolved? https://bugs.launchpad.net/keystone/+bug/1409201 | 17:23 |
| openstack | Launchpad bug 1409201 in Keystone " Typos in configuration.rst" [Low,In progress] - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 17:23 |
| dstanek | morganfainberg: is that long list of bugs in the release-blocking reviews all real blockers? | 17:31 |
| morganfainberg | nope | 17:31 |
| morganfainberg | dstanek, but i didn't star any of them | 17:31 |
| morganfainberg | so i have no control over them | 17:31 |
| morganfainberg | dstanek, the BP ones are the important ones | 17:32 |
| morganfainberg | dstanek, after that use the rc-1 milestone | 17:32 |
| samueldmq | stevemar, yes it is | 17:33 |
| samueldmq | stevemar, sorry, that's happened again, forgot to close it | 17:33 |
| samueldmq | raildo, I saw your 069 script updated the FK constraint of domain_id property on Project table | 17:35 |
| samueldmq | raildo, make use you do the same for user and group | 17:35 |
| samueldmq | raildo, https://github.com/openstack/keystone/blob/master/keystone/common/sql/migrate_repo/versions/044_icehouse.py#L250-L260 | 17:35 |
| *** henrynash has quit IRC | 17:51 | |
| *** henrynash has joined #openstack-keystone | 17:52 | |
| *** ChanServ sets mode: +v henrynash | 17:52 | |
| *** lhcheng has quit IRC | 17:54 | |
| *** gokrokve has joined #openstack-keystone | 18:00 | |
| *** lhcheng has joined #openstack-keystone | 18:00 | |
| *** browne has quit IRC | 18:05 | |
| *** browne has joined #openstack-keystone | 18:05 | |
| *** gokrokve has quit IRC | 18:06 | |
| *** stevemar has quit IRC | 18:06 | |
| *** stevemar2 has joined #openstack-keystone | 18:06 | |
| *** ChanServ sets mode: +v stevemar2 | 18:06 | |
| *** j_king has quit IRC | 18:08 | |
| *** gokrokve has joined #openstack-keystone | 18:09 | |
| *** lhcheng has quit IRC | 18:17 | |
| *** afazekas has quit IRC | 18:19 | |
| *** pnavarro has quit IRC | 18:22 | |
| raildo | samueldmq, the Fk for user and group was removed here: https://github.com/openstack/keystone/blob/master/keystone/common/sql/migrate_repo/versions/064_drop_user_and_group_fk.py | 18:24 |
| raildo | samueldmq, and I'm removing the Fk for project in the previous patch | 18:24 |
| raildo | samueldmq, so, there is not any other FK for domain table. | 18:25 |
| *** j_king has joined #openstack-keystone | 18:31 | |
| samueldmq | raildo, k | 18:40 |
| *** stevemar2 has quit IRC | 18:44 | |
| *** stevemar2 has joined #openstack-keystone | 18:45 | |
| *** ChanServ sets mode: +v stevemar2 | 18:45 | |
| *** thedodd has quit IRC | 18:48 | |
| *** thedodd has joined #openstack-keystone | 18:49 | |
| morganfainberg | stevemar2, https://bugs.launchpad.net/keystone/+bug/1395959 updated for juno not master | 18:50 |
| openstack | Launchpad bug 1395959 in Keystone juno "assignment table migration fails for keystone-manage db_sync if duplicate entry exists" [Undecided,New] | 18:50 |
| stevemar2 | morganfainberg, thx dude | 18:51 |
| stevemar2 | ah, i thought that was how it was done, looks like i did it right the first time | 18:51 |
| morganfainberg | stevemar2, also that imposter is in the channel again | 18:51 |
| morganfainberg | stevemar2, "target to series" and then mark the main bug invalid, but not the series bug | 18:52 |
| stevemar2 | gorram reavers! | 18:52 |
| *** krtaylor has joined #openstack-keystone | 18:52 | |
| stevemar2 | yep | 18:52 |
| stevemar2 | trying to further triage the RC bugs | 18:52 |
| *** thedodd has quit IRC | 18:54 | |
| *** lhcheng has joined #openstack-keystone | 18:55 | |
| *** lhcheng_ has joined #openstack-keystone | 18:56 | |
| *** lhcheng has quit IRC | 18:56 | |
| *** Bsony has joined #openstack-keystone | 18:59 | |
| *** thedodd has joined #openstack-keystone | 19:02 | |
| *** harlowja is now known as harlowja_away | 19:02 | |
| *** rushiagr is now known as rushiagr_away | 19:03 | |
| stevemar2 | lbragstad, can you revisit https://review.openstack.org/#/c/117611/ i think we can close out that bug :) | 19:06 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: region.description is optional and can be null https://review.openstack.org/117611 | 19:06 |
| * morganfainberg is doing a mass eviction of bugs from rc-1 milestone | 19:07 | |
| morganfainberg | this doesn't mean the bug can't land, it means it is not a release blocker | 19:08 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Loosen the validation schema used for trustee/trustor ids https://review.openstack.org/145024 | 19:11 |
| stevemar2 | lbragstad, dstanek take a look at: https://review.openstack.org/#/c/151592/ should be a no-brainer | 19:17 |
| dstanek | stevemar2: did you ping us because we can't be trusted to do the hard reviews? | 19:18 |
| stevemar2 | dstanek, obviously | 19:18 |
| dstanek | damn | 19:18 |
| stevemar2 | dstanek, because you are alive and breathing, i saw you type before | 19:18 |
| stevemar2 | i need live bodies for reviews | 19:18 |
| *** zzzeek has joined #openstack-keystone | 19:19 | |
| morganfainberg | ok RC1 milestone is now paired down to just the blockers | 19:19 |
| rodrigods | morganfainberg, we have a critical bug of HMT: https://bugs.launchpad.net/keystone/+bug/1434916 | 19:20 |
| openstack | Launchpad bug 1434916 in Keystone "GET /v3/projects/project_id with parents_as_list or subtree_as_list option is leaking extra data" [Undecided,In progress] - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 19:20 |
| dstanek | stevemar2: am i blind? what uses _add_self_ref....? | 19:20 |
| rodrigods | morganfainberg, leaking information in subtree_as_list and parents_as_list calls | 19:20 |
| dstanek | ah, it's overriding a base class method | 19:21 |
| stevemar2 | ++ | 19:21 |
| stevemar2 | lhcheng_, ping | 19:23 |
| lhcheng_ | stevemar2: pong | 19:24 |
| stevemar2 | lhcheng_, commented on the bug! | 19:24 |
| stevemar2 | lhcheng_, i started https://review.openstack.org/#/c/167501/ last night, but i wasn't sure if i liked it | 19:24 |
| *** thedodd has quit IRC | 19:25 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: use tokens returned by delete_tokens to invalidate cache https://review.openstack.org/153501 | 19:27 |
| lhcheng_ | stevemar2: oh didn't know you were already working on it. | 19:27 |
| stevemar2 | lhcheng_, i was playing around, nothing serious | 19:27 |
| stevemar2 | if you agree with the approach you can continue that patch, and i'll review it | 19:27 |
| stevemar2 | or else start up another, i'll still review it, and abandon mine | 19:27 |
| stevemar2 | there are a few ways we can solve this one | 19:28 |
| *** stevemar2 has left #openstack-keystone | 19:32 | |
| *** stevemar2 has joined #openstack-keystone | 19:32 | |
| *** ChanServ sets mode: +v stevemar2 | 19:32 | |
| lhcheng_ | stevemar2: what other options do we have? | 19:33 |
| *** thedodd has joined #openstack-keystone | 19:33 | |
| stevemar2 | lhcheng_, i'm not sure :) | 19:34 |
| stevemar2 | send 2 notifications? | 19:34 |
| stevemar2 | send a deprecation message in the payload | 19:34 |
| stevemar2 | i dunno | 19:34 |
| lhcheng_ | stevemar2: thinking about it more, thought at some point you tried to change the format in older patch. But then reverted back, due to we don't want to break backwards compatbility | 19:34 |
| lhcheng_ | stevemar2: will get back to you in a bit, in a meeting. | 19:35 |
| stevemar2 | kk | 19:36 |
| morganfainberg | rodrigods, updated and tagged to RC1 | 19:36 |
| stevemar2 | lhcheng_, right, but maybe that was being overly cautious ? | 19:36 |
| morganfainberg | lbragstad, can you pair down your starred list to reflect only things here: https://bugs.launchpad.net/keystone/+milestone/kilo-rc1 | 19:37 |
| morganfainberg | lbragstad, the other things can land, but they aren't high priority/rc blockers | 19:37 |
| *** harlowja_away is now known as harlowja | 19:38 | |
| *** thedodd has quit IRC | 19:39 | |
| rodrigods | morganfainberg, thanks | 19:39 |
| samueldmq | lhcheng_, thanks for working on #1432892 | 19:40 |
| *** lhcheng_ has quit IRC | 19:41 | |
| *** lhcheng has joined #openstack-keystone | 19:47 | |
| *** Tahmina has joined #openstack-keystone | 19:49 | |
| *** lhcheng has quit IRC | 19:51 | |
| *** lhcheng has joined #openstack-keystone | 19:52 | |
| *** lhcheng_ has joined #openstack-keystone | 19:55 | |
| *** carlosmarin has quit IRC | 19:56 | |
| *** browne has quit IRC | 19:58 | |
| *** lhcheng has quit IRC | 19:59 | |
| *** browne has joined #openstack-keystone | 20:02 | |
| *** angular_mike has quit IRC | 20:03 | |
| lbragstad | morganfainberg: yep | 20:06 |
| *** Bsony has quit IRC | 20:06 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Fixes remaining oslo imports from namespace https://review.openstack.org/167778 | 20:07 |
| samueldmq | bknudson, ^ | 20:08 |
| *** lhcheng_ is now known as lhcheng | 20:12 | |
| samueldmq | stevemar2, ping - saw your comment on #167778/ | 20:12 |
| samueldmq | stevemar2, how does that oslo sync work? | 20:13 |
| *** stevemar2 has quit IRC | 20:15 | |
| *** tqtran_afk is now known as tqtran | 20:16 | |
| *** browne has quit IRC | 20:26 | |
| *** browne has joined #openstack-keystone | 20:26 | |
| *** carlosmarin has joined #openstack-keystone | 20:27 | |
| *** gyee has quit IRC | 20:30 | |
| marekd | dstanek: any comment on https://review.openstack.org/#/c/152156/30/keystone/contrib/federation/backends/sql.py ? | 20:31 |
| dstanek | marekd: maybe, i'll take a look in a sec | 20:32 |
| marekd | dstanek: apreciate | 20:32 |
| haneef | marekd: In the mapping, is it openstack_role or openstack_roles. | 20:33 |
| rodrigods | haneef, _roles | 20:36 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Adds inherited column to RoleAssignment PK https://review.openstack.org/142472 | 20:36 |
| marekd | rodrigods: o, thanks. | 20:37 |
| marekd | i was grepping for that. | 20:37 |
| samueldmq | henrynash, ^ you may be interested on this | 20:37 |
| samueldmq | henrynash, Adds inherited column to RoleAssignment PK https://review.openstack.org/142472 | 20:38 |
| haneef | rodrigods: Thanks. Let me check with openstack roles | 20:39 |
| *** gokrokve has quit IRC | 20:39 | |
| *** gokrokve has joined #openstack-keystone | 20:40 | |
| *** Tahmina has quit IRC | 20:44 | |
| dstanek | marekd: i just commented. it seems bad that the models and migrations will be out of sync | 20:44 |
| rodrigods | haneef, the assertion contains something like: http://paste.openstack.org/show/196747/ | 20:44 |
| openstackgerrit | Merged openstack/keystone: add missing links for v3 OS-EC2 API response https://review.openstack.org/151592 | 20:45 |
| *** gokrokve has quit IRC | 20:47 | |
| haneef | Yes. openstack_roles work. steve gave http://paste.openstack.org/show/196671/ which has openstack_role which caused the confusion | 20:47 |
| *** gokrokve has joined #openstack-keystone | 20:48 | |
| *** henrynash has quit IRC | 20:53 | |
| openstackgerrit | Merged openstack/keystone: region.description is optional and can be null https://review.openstack.org/117611 | 20:54 |
| *** henrynash has joined #openstack-keystone | 20:54 | |
| *** ChanServ sets mode: +v henrynash | 20:54 | |
| *** jaosorior has quit IRC | 21:02 | |
| *** Bsony has joined #openstack-keystone | 21:03 | |
| *** mattfarina has quit IRC | 21:07 | |
| marekd | dstanek: this whole patch is simply hard. | 21:11 |
| marekd | it cause so many problems. | 21:11 |
| marekd | caused | 21:11 |
| marekd | dstanek: do you have any alternatives? | 21:11 |
| dstanek | marekd: i think it's just a matter of using SQL instead of the models to do the queries - looking for an example so i can add a comment about it | 21:18 |
| *** lhcheng_ has joined #openstack-keystone | 21:29 | |
| *** lhcheng has quit IRC | 21:29 | |
| *** richm has quit IRC | 21:31 | |
| *** carlosmarin has quit IRC | 21:36 | |
| *** gokrokve has quit IRC | 21:45 | |
| *** samueldmq is now known as samueldmq-away | 21:48 | |
| *** lhcheng_ is now known as lhcheng | 21:49 | |
| *** dims has quit IRC | 21:50 | |
| morganfainberg | marekd, dstanek, the model should not be used for migration. | 21:51 |
| morganfainberg | the model should reflect expected state when running the code | 21:51 |
| *** dims has joined #openstack-keystone | 21:54 | |
| *** dims has quit IRC | 21:55 | |
| *** dims has joined #openstack-keystone | 21:55 | |
| dstanek | morganfainberg: yeah, i have a fix that uses table.c.column | 21:56 |
| morganfainberg | dstanek, ++ | 21:56 |
| dstanek | but i also don't like the fact that there is no specific test for the upgrade and that there is no downgrade | 21:56 |
| dstanek | and because there is no downgrade there is a hack in the shared code | 21:56 |
| morganfainberg | downgrade should be skipped with a "we don't do downgrades" | 21:56 |
| morganfainberg | ;) | 21:57 |
| dstanek | morganfainberg: while i agree i really hate https://review.openstack.org/#/c/152156/30/keystone/tests/unit/test_sql_upgrade.py | 21:57 |
| morganfainberg | dstanek, i have a fix for that actually. | 21:57 |
| morganfainberg | dstanek, it's way way way way way better than what we have | 21:57 |
| morganfainberg | dstanek, but it's a big change - i need to dig it up | 21:58 |
| openstackgerrit | David Stanek proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 21:58 |
| morganfainberg | dstanek, but i think you'll like it. | 21:58 |
| *** iamjarvo has joined #openstack-keystone | 21:58 | |
| *** timcline has quit IRC | 21:58 | |
| bknudson | there was a post to the -dev mailing list for neutron I think ... they deleted all the downgrades. | 21:58 |
| dstanek | morganfainberg: my fix https://review.openstack.org/#/c/152156/30..31/keystone/contrib/federation/migrate_repo/versions/006_add_remote_id_table.py | 21:59 |
| morganfainberg | bknudson, thats what we're going to do in liberty, but we can wedge in an upgrade right now that says "no downgrades" | 21:59 |
| morganfainberg | bknudson, mostly because i don't want to unwind all the code this close to RC | 21:59 |
| morganfainberg | bknudson, and accidentally lose coverage we may want. | 21:59 |
| morganfainberg | bknudson, i mean, thats me personally | 22:00 |
| morganfainberg | bknudson, wont say no if someone else wants to unwind that and remove all downgrades earlier | 22:00 |
| morganfainberg | provided we don't break anything | 22:00 |
| bknudson | I like deleting code. | 22:00 |
| morganfainberg | bknudson, i know you do | 22:00 |
| morganfainberg | bknudson, maybe i can dig up my fix and have it posted up for review tomorrow | 22:01 |
| morganfainberg | would be easier with downgrades removed. | 22:01 |
| bknudson | most of our migrations are placeholders | 22:03 |
| morganfainberg | bknudson, yay for the collapses! | 22:03 |
| dstanek | would anything break if we delete all of the downgrades and fix the test_sql_upgrade tests? | 22:04 |
| bknudson | downgrades would break | 22:05 |
| morganfainberg | dstanek, starting to work on that now: steps - 1: clear message downgrades dont work when they are attempted, 2: delete downgrades and downgrade tests, 3: restructure upgrade test(ing) | 22:05 |
| morganfainberg | dstanek, i have a lot of this work done, will have it posted up later today | 22:06 |
| bknudson | https://bugs.launchpad.net/keystone/+bug/1434103 | 22:06 |
| openstack | Launchpad bug 1434103 in Magnum "SQL schema downgrades are no longer supported" [Undecided,New] | 22:06 |
| dstanek | morganfainberg: sweet, looking forward to seeing the deletes | 22:06 |
| morganfainberg | dstanek, this likely can't land until liberty because of strings/translations - but we can have the code up for review | 22:07 |
| morganfainberg | dstanek, and land it as soon as we cut rc | 22:08 |
| bknudson | what strings? | 22:08 |
| *** jamielennox|away is now known as jamielennox | 22:08 | |
| bknudson | deleting strings shoud be fine | 22:08 |
| morganfainberg | bknudson, communication to the user why a downgrade fails | 22:08 |
| morganfainberg | new strings | 22:08 |
| morganfainberg | we want good UX | 22:08 |
| morganfainberg | or are new strings allowed? | 22:08 |
| dstanek | we can just use an existing string like "An unknown error has occured" ;) | 22:08 |
| bknudson | Not Found | 22:09 |
| morganfainberg | bknudson, LOL | 22:09 |
| morganfainberg | bknudson, "I'M A TEAPOT" | 22:09 |
| dstanek | new strings are not allowed iirc | 22:09 |
| bknudson | user "downgrade" Not found | 22:09 |
| morganfainberg | oh wait we don't have that one yet | 22:09 |
| bknudson | I don't know what the ux is for the neutron change, but they just deleted the migrations: https://review.openstack.org/#/c/165740/ | 22:10 |
| bknudson | +42, -1024 | 22:10 |
| morganfainberg | bknudson, i have an idea how to do the UX. | 22:10 |
| morganfainberg | bknudson, so should be not too bad | 22:11 |
| bknudson | http://sonicfanchara.wikia.com/wiki/File:HA_HA_-NELSON_SIMPSONS.jpg would be good. | 22:11 |
| bknudson | or a picture of a paper shredder. | 22:12 |
| morganfainberg | :) | 22:12 |
| morganfainberg | downgrade = sql.drop_database(keystone0 | 22:12 |
| *** Bsony has quit IRC | 22:17 | |
| *** iamjarvo has quit IRC | 22:19 | |
| *** henrynash has quit IRC | 22:39 | |
| morganfainberg | bknudson, dstanek, so far: 25 files changed, 44 insertions(+), 505 deletions(-) | 22:41 |
| bknudson | looking good. | 22:41 |
| dstanek | nice | 22:41 |
| bknudson | there was a note to -dev about yapf... I'm going to try it | 22:42 |
| bknudson | it's slow | 22:42 |
| dstanek | yapf? | 22:42 |
| bknudson | https://github.com/google/yapf | 22:42 |
| morganfainberg | now: 42 files changed, 44 insertions(+), 662 deletions(-) | 22:44 |
| morganfainberg | i think thats all the migrations | 22:44 |
| morganfainberg | now to see what i broke... | 22:44 |
| dstanek | i wonder how well that works. IME tools like that sometimes make things harder to read and then you need to have '# pragma: don't touch' lines all over the place | 22:45 |
| bknudson | it causes tox -e pep8 to fail | 22:45 |
| bknudson | it's got 80 chars rather than 79 | 22:45 |
| dstanek | bknudson: the new version of https://review.openstack.org/#/c/155919 seems to be adding policy rules now instead of just commenting them | 22:47 |
| dstanek | did you intend that? | 22:47 |
| bknudson | no! | 22:47 |
| bknudson | there have been a lot of merge conflicts. | 22:47 |
| dstanek | err...wait | 22:48 |
| dstanek | nm, viewing between the 10..11 was showing new lines, but they were introduced in the rebase | 22:48 |
| bknudson | whew! | 22:48 |
| dstanek | any reason not to +a that one? | 22:49 |
| bknudson | cruelty? | 22:49 |
| bknudson | you like making things difficult for operators and developers? | 22:49 |
| bknudson | maybe you're concerned it's going to slow keystone down? | 22:50 |
| bknudson | or think it should go someplace else. | 22:50 |
| dstanek | yes, all three! | 22:50 |
| bknudson | I'll probably propose it to the admin guide if I can figure out the xml | 22:50 |
| dstanek | i'm going to submit a patch to the JSON spec to allow comments | 22:50 |
| dstanek | never get in, but at least i can feel better about myself | 22:51 |
| morganfainberg | dstanek, lol | 22:51 |
| * morganfainberg checks if mordred is here. | 22:51 | |
| morganfainberg | yep | 22:51 |
| morganfainberg | dstanek, we should use toml instead of json | 22:51 |
| * morganfainberg continues about his day after trolling. | 22:52 | |
| * mordred throws cat at morganfainberg | 22:52 | |
| lhcheng | breton: ping | 22:52 |
| bknudson | could use ini files. | 22:52 |
| * mordred throws cat at bknudson | 22:53 | |
| morganfainberg | bknudson, we should write our own DSL for this | 22:53 |
| dstanek | morganfainberg: i'll have a spec written up; maybe i'll invent ksML | 22:53 |
| bknudson | oh, that's what it is. | 22:53 |
| *** gyee has joined #openstack-keystone | 22:54 | |
| *** ChanServ sets mode: +v gyee | 22:54 | |
| bknudson | we need a python version of JSON. | 22:54 |
| morganfainberg | bknudson, PSON? | 22:54 |
| morganfainberg | bknudson, wouldn't that just be pickle? | 22:54 |
| bknudson | safer than that. | 22:54 |
| morganfainberg | you should write PSON specification then | 22:54 |
| dstanek | something without python versioning issues | 22:54 |
| morganfainberg | and we should make it a standard. | 22:54 |
| morganfainberg | that all things should use cause it'll unifiy things | 22:55 |
| * morganfainberg keeps trying to make the XKCD joke. | 22:55 | |
| *** gordc has quit IRC | 22:55 | |
| morganfainberg | bknudson, oh damn it | 22:56 |
| morganfainberg | someone beat us to PSON | 22:57 |
| morganfainberg | https://github.com/dcodeIO/PSON | 22:57 |
| lhcheng | morganfainberg: this seems already fixed: https://bugs.launchpad.net/keystone/+bug/1431842 | 22:57 |
| openstack | Launchpad bug 1431842 in Keystone "GET /v3/auth/tokens without X-Subject-Token raises TypeError" [Medium,Triaged] - Assigned to Lin Hua Cheng (lin-hua-cheng) | 22:57 |
| lhcheng | morganfainberg: just tested it, I got an error: 401 - "The request you have made requires authentication. (Disable debug mode to suppress these details.)" | 22:57 |
| morganfainberg | lhcheng, is it broken/working in juno and icehouse as well? | 22:57 |
| morganfainberg | well juno at least | 22:57 |
| morganfainberg | if so we should makr it as invalid or... dupe if we can find the duplicate | 22:58 |
| lhcheng | morganfainberg: just tested in master | 22:58 |
| morganfainberg | lhcheng, lets confirm juno then makr it as invalid | 22:58 |
| morganfainberg | if it's working | 22:58 |
| morganfainberg | lhcheng, thanks! | 22:58 |
| lhcheng | morganfainberg: from the bug report, seems related to fernet changes. But it seems like lbragstad already fixed it somehow | 22:58 |
| lhcheng | morganfainberg: sure, will do | 22:58 |
| *** markvoelker has quit IRC | 22:58 | |
| morganfainberg | lhcheng, you might not be able to mark invalid le tme know if you can't and i will | 22:59 |
| lhcheng | morganfainberg: yup, that options is available for me | 22:59 |
| lhcheng | morganfainberg: thanks | 22:59 |
| morganfainberg | great | 22:59 |
| bknudson | I told yapf the max line length and it still made lines too long... not ready for prime time. | 23:01 |
| bknudson | it mostly just reformats the function arguments so they're all on separate lines. | 23:03 |
| lhcheng | bknudson: thanks for the rebase on: https://review.openstack.org/#/c/164367/ There are 2 +2s on it and gate passed, I think we can move it forward :) | 23:05 |
| lhcheng | bknudson: thanks! | 23:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Cleanup Token Tests https://review.openstack.org/167832 | 23:09 |
| *** chlong has joined #openstack-keystone | 23:10 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Cleanup Token Tests https://review.openstack.org/167832 | 23:10 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove SQL Downgrades https://review.openstack.org/167834 | 23:15 |
| morganfainberg | bknudson, dstanek, ^ | 23:15 |
| morganfainberg | +58, -664 | 23:16 |
| bknudson | morganfainberg: what's the ux? | 23:16 |
| morganfainberg | bknudson, changed the help string on keystone-manage and raise DBMigrationError | 23:17 |
| morganfainberg | Longer term we can make it even better | 23:17 |
| morganfainberg | or oslo.db will grow super powers | 23:17 |
| morganfainberg | likely the latter | 23:17 |
| bknudson | the spec said oslo.db would grow super powers. | 23:17 |
| morganfainberg | yeah | 23:18 |
| morganfainberg | just need to be careful not to suddenly break gate doing so | 23:18 |
| morganfainberg | so this is our starting place. | 23:18 |
| bknudson | with super powers comes super responsibility | 23:18 |
| morganfainberg | hehe | 23:18 |
| morganfainberg | next patch i'll propose a new way to test upgrades where it just walks up to max and each version it looks for a ._post_xx_migrate_test (like how nova does it) | 23:20 |
| bknudson | they tried to do that a long time ago and got -1d | 23:20 |
| morganfainberg | i think it's a better way to do it in general | 23:20 |
| bknudson | because we said to put it in oslo or something. | 23:21 |
| *** krtaylor has quit IRC | 23:21 | |
| morganfainberg | yeah i think it'll make our migration tests cleaner, sow e should prob do it | 23:21 |
| morganfainberg | if it makes it's way into oslo... great. | 23:21 |
| bknudson | put it in oslo? | 23:21 |
| bknudson | oslotest? | 23:21 |
| morganfainberg | less for us to carry | 23:21 |
| morganfainberg | but if it doesn't cleaner / easier to understand tests is a win | 23:21 |
| bknudson | removing downgrades definitely makes testing easier. | 23:22 |
| morganfainberg | bknudson, not sure where it should live. | 23:22 |
| morganfainberg | bknudson, ++ yes. | 23:22 |
| morganfainberg | bknudson, it also means upgrades don't need to do silly things like keep hints for downgrades around | 23:22 |
| morganfainberg | not that we needed to do that, but cinder does | 23:22 |
| morganfainberg | and we were about to need to for domain -> is_domain(project) | 23:22 |
| *** Bsony has joined #openstack-keystone | 23:23 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add relay_state_prefix to Service Provider https://review.openstack.org/166078 | 23:25 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 23:25 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 23:25 |
| *** Bsony has quit IRC | 23:28 | |
| dstanek | morganfainberg: nice | 23:30 |
| *** chlong has quit IRC | 23:37 | |
| *** chlong has joined #openstack-keystone | 23:37 | |
| morganfainberg | bknudson, https://bugs.launchpad.net/keystone/+bug/1405726 feel free to classify this, i don't have a DB2 environment to validate with | 23:42 |
| openstack | Launchpad bug 1405726 in Keystone "getting scoped federation token fails when using db2" [Undecided,New] | 23:42 |
| morganfainberg | bknudson, classify/prioritise | 23:42 |
| openstackgerrit | Merged openstack/keystone: Document mapping of policy action to operation https://review.openstack.org/155919 | 23:42 |
| morganfainberg | or bounce it. | 23:42 |
| bknudson | I can take a look at it. | 23:42 |
| morganfainberg | bknudson, the '/rel/' links in our API docs are just placeholders right? | 23:44 |
| morganfainberg | e.g. http://docs.openstack.org/api/openstack-identity/3/rel/domain_config | 23:44 |
| morganfainberg | not expected to actually link to something useful | 23:44 |
| bknudson | morganfainberg: they're identifiers that happen to look like URLs | 23:44 |
| morganfainberg | ah right | 23:45 |
| morganfainberg | thnx | 23:45 |
| bknudson | they're not pointing to anything useful now. | 23:45 |
| bknudson | although json home spec says it could provide some documentation | 23:45 |
| *** markvoelker has joined #openstack-keystone | 23:47 | |
| *** markvoelker has quit IRC | 23:52 | |
| *** r-daneel has quit IRC | 23:52 | |
| bknudson | morganfainberg: doesn't using distinct on a json object seem a little weird? (regarding https://bugs.launchpad.net/keystone/+bug/1405726 ) -- whether you're db2 or not | 23:55 |
| openstack | Launchpad bug 1405726 in Keystone "getting scoped federation token fails when using db2" [Undecided,New] | 23:55 |
| morganfainberg | bknudson, it does | 23:55 |
| bknudson | since it's not a canonical representation can't expect 2 values to be the same anyways. | 23:56 |
| morganfainberg | bknudson, then again... i hate the "extra" stuff anyway. | 23:56 |
| morganfainberg | which this is related to | 23:56 |
| openstackgerrit | Merged openstack/keystone: Remove parent_id in v2 tenant response https://review.openstack.org/164367 | 23:56 |
| bknudson | I would assume the extra junk isn't being used anyways. | 23:56 |
| morganfainberg | i'm happy to see this fixed to something better | 23:57 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix sample policy to allow user to check own token https://review.openstack.org/164848 | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
