| *** harlowja has quit IRC | 00:02 | |
| *** harlowja has joined #openstack-keystone | 00:03 | |
| *** gokrokve_ has quit IRC | 00:17 | |
| *** iamjarvo has quit IRC | 00:22 | |
| *** lhcheng_afk is now known as lhcheng | 00:23 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug in Federation list projects endpoint https://review.openstack.org/158163 | 00:30 |
|---|---|---|
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy: Avoid reloading policy files in policy.d for every call https://review.openstack.org/169535 | 00:39 |
| *** raildo has quit IRC | 00:45 | |
| jamielennox | morganfainberg: i'm not sure this pecan can be done in any way that it will be accepted | 00:53 |
| jamielennox | it's just so intertwined | 00:53 |
| *** _cjones_ has quit IRC | 00:54 | |
| *** ncoghlan has joined #openstack-keystone | 00:58 | |
| morganfainberg | jamielennox, :( | 00:59 |
| jamielennox | morganfainberg: step one is probably remove extensions from paste pipeline | 00:59 |
| jamielennox | those things need to be controlled by config | 01:00 |
| morganfainberg | jamielennox, well that is on it's way in liberty | 01:00 |
| morganfainberg | no more extensions ;() | 01:00 |
| morganfainberg | ;) | 01:00 |
| jamielennox | it's the way we enable/disable that's the issue | 01:00 |
| jamielennox | morganfainberg: by god it's necessary though, this is pretty horrible | 01:03 |
| *** jimbaker has joined #openstack-keystone | 01:03 | |
| morganfainberg | jamielennox, yeah | 01:06 |
| morganfainberg | jamielennox, this is why "extensions are going away | 01:06 |
| *** david-lyle has joined #openstack-keystone | 01:15 | |
| *** devlaps has quit IRC | 01:16 | |
| *** tqtran is now known as tqtran_afk | 01:24 | |
| *** diegows has quit IRC | 01:25 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Unified Access Info https://review.openstack.org/135774 | 01:26 |
| *** lhcheng has quit IRC | 01:26 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Unified Access Info https://review.openstack.org/135774 | 01:36 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Merge role id and role name https://review.openstack.org/151657 | 01:41 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug in Federation list projects endpoint https://review.openstack.org/158163 | 01:43 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Policy rules managed from a database https://review.openstack.org/133814 | 01:46 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes bug in Federation list projects endpoint https://review.openstack.org/169113 | 01:46 |
| *** lhcheng has joined #openstack-keystone | 01:47 | |
| *** erkules has quit IRC | 01:49 | |
| *** erkules_ has joined #openstack-keystone | 01:49 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy: Avoid reloading policy files in policy.d for every call https://review.openstack.org/169535 | 01:50 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Template for testing document https://review.openstack.org/163882 | 01:52 |
| ayoung | dims_, if you stop updating the damn thing I'll review it! | 01:53 |
| ayoung | dims_, heh. I guess it is getting attention anyway. THanks for doing that. | 01:54 |
| dims_ | ayoung: was trying to fix what brant pointed out. i think i have it now | 01:54 |
| dims_ | py34,py27,pep8 pass locally as well | 01:54 |
| ayoung | the mtime thing, dims_ ? | 01:54 |
| dims_ | y | 01:54 |
| ayoung | cool | 01:54 |
| *** david-lyle has quit IRC | 01:55 | |
| dims_ | bknudson: i pick the latest mtime from the list of files in a directory and use that | 01:56 |
| ayoung | dims_, the way you are putting those magic cosntants in for times feels icky | 01:56 |
| ayoung | 1427836546 | 01:56 |
| ayoung | I assume that you are going with "some randomish number" rsn+1 srn+2 | 01:57 |
| dims_ | ayoung: it's today's unix time :) | 01:57 |
| dims_ | y i can change it to something else | 01:57 |
| ayoung | dims_, I'd rather that were actually tested against a real Loonix file system | 01:57 |
| ayoung | once can overmock | 01:58 |
| ayoung | one | 01:58 |
| dims_ | i was trying to avoid sleep(s) | 01:58 |
| dims_ | and touch(es) | 01:58 |
| ayoung | I manage to avoid sleep without trying...wait are we still talking about code? | 01:58 |
| dims_ | :) ya | 01:58 |
| ayoung | yeah, I understand, but I think that, in this case, the real FS work means we know it actually works | 01:58 |
| *** iamjarvo has joined #openstack-keystone | 02:00 | |
| dims_ | k i can fix that | 02:00 |
| ayoung | dims_, just the fact that you and bknudson had that conversation makes me want it going against the real fs. I don't trust myself to get stuff like that right. I trust you only marginally more. | 02:01 |
| ayoung | Thanks. I'll add this to the review. | 02:01 |
| dims_ | ayoung: thanks! | 02:01 |
| ayoung | dims_, this is good stuff. | 02:03 |
| ayoung | I might actually use this as the start of a general caching mechanism. We kindof need that | 02:03 |
| ayoung | I also need to figure out a way to generalize fetching files and sticking them in the cache. | 02:04 |
| ayoung | jamielennox, I want the code in policy to be usable by other projects, not just Keystone. We need a generalizable way to say "fetch the poplicy file using this api and cache it" | 02:05 |
| ayoung | maybe that doesn't belong in the policy library, though... | 02:05 |
| jamielennox | right | 02:06 |
| samueldmq | morganfainberg, you around ? would like to talk about 'Reload drivers when their domain config is updated' | 02:06 |
| jamielennox | ayoung: ideally some sort of middleware - and something that can respond to messages from rabbit | 02:07 |
| ayoung | jamielennox, so...can we really do policy from middleware? I mean, I could see doing the endpoint-binding as a policy call, but most of the other things need to fetch objects from the database first | 02:08 |
| ayoung | we had the same thing in Keystone: certain policy required fetching the object first | 02:08 |
| jamielennox | ayoung: i'm not sure, i was thinking we'd be able to check it piece by piece but i don't know | 02:09 |
| jamielennox | probably not | 02:09 |
| ayoung | for create, you can get away with checking on the request itself, but update, read, and delete all need to deduce the project from the object. | 02:09 |
| morganfainberg | samueldmq, hmm? | 02:09 |
| ayoung | jamielennox, its why the cloudsample policy is so complicated...soemthing I'd love to be able to simplify | 02:10 |
| jamielennox | ayoung: right, we need to move those checks out of decorators | 02:10 |
| morganfainberg | jamielennox, ++ | 02:10 |
| jamielennox | morganfainberg: that's as far as i got with pecan last time | 02:10 |
| *** lhcheng has quit IRC | 02:10 | |
| morganfainberg | jamielennox, just like notifications are moving out. | 02:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy: Avoid reloading policy files in policy.d for every call https://review.openstack.org/169535 | 02:10 |
| samueldmq | morganfainberg, the thread safe thing .. | 02:11 |
| samueldmq | morganfainberg, that's not introduced by that patch, right? | 02:11 |
| dims_ | ayoung: done. | 02:11 |
| morganfainberg | samueldmq, we talked about it in the meeting. we're just going to document the shortcomings for this cycle | 02:11 |
| ayoung | that was fast! | 02:11 |
| samueldmq | morganfainberg, ah sorry I missed that .. | 02:11 |
| samueldmq | morganfainberg, so we raise a bug and fix this for L | 02:12 |
| ayoung | dims_, you still have the magic numbers in there. THat just an oversite? | 02:12 |
| jamielennox | ayoung: so long as we build those components from base principals it'll be ok, we can do policy distribution as we figure this stuff out | 02:12 |
| jamielennox | ayoung: because same for auth_token - i'd love to have like some external but local process that responds to the bus and caches certain information across all worker processes | 02:13 |
| samueldmq | morganfainberg, the whole keystone engine (controllers, managers, drivers) need to be stateless in order to make keystone thread-safe | 02:13 |
| ayoung | jamielennox, you mean instead of polling for updates? | 02:14 |
| jamielennox | ayoung: right | 02:14 |
| morganfainberg | samueldmq, no | 02:14 |
| morganfainberg | samueldmq, we mostly already are | 02:14 |
| morganfainberg | this is a SQL implementation issue | 02:14 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy: Avoid reloading policy files in policy.d for every call https://review.openstack.org/169535 | 02:15 |
| dims_ | ayoung: oops. ya | 02:15 |
| morganfainberg | samueldmq, sync up w/ henrynash before opening bugs for L on this | 02:15 |
| samueldmq | morganfainberg, k will go through the meeting log and talk to him tomorrow | 02:16 |
| samueldmq | morganfainberg, thx | 02:16 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy: Avoid reloading policy files in policy.d for every call https://review.openstack.org/169535 | 02:26 |
| ayoung | jamielennox, OK...so how this needs to work: user calls nova, auth token unpacks the token, nova fetches the resource and calls policy...all as done today. Now, if the policy file is out opf date (the stuff dims_ is working on) the enforcement needs to fetch a new copy. That code needs to be common across all of the openstack servcies. I go back and forth between thinking it should be in oslo.policy or if we externalize | 02:29 |
| ayoung | d the fetch | 02:29 |
| *** harlowja is now known as harlowja_away | 02:29 | |
| jamielennox | externalize | 02:29 |
| jamielennox | don't have a policy enforcement library know anything about http | 02:30 |
| ayoung | jamielennox, ok, so we put a shim libraray in keystonemiddleware. It knows enough to call keystone (with a token) to get the policy file | 02:32 |
| ayoung | and... dims_ code needs to trigger a refetch? (not tonight dims_ ,you can drive on as you are working now) | 02:33 |
| *** topol has joined #openstack-keystone | 02:33 | |
| *** ChanServ sets mode: +v topol | 02:33 | |
| jamielennox | ayoung: i don't know, i don't know if i want middleware driving this either | 02:35 |
| ayoung | jamielennox, keystone client? I don't want to make oslo.policy depend on kc | 02:35 |
| ayoung | its "almost" middleware | 02:35 |
| jamielennox | right, but we are getting to the point where we have a lot of state being copied around | 02:36 |
| *** _cjones_ has joined #openstack-keystone | 02:36 | |
| jamielennox | can i have keystonecached? | 02:36 |
| ayoung | jamielennox, yes, yes you can | 02:37 |
| jamielennox | i talked about this in atlanta i think, we need a process on each auth_token service that can cache all this stuff | 02:37 |
| *** topol_ has joined #openstack-keystone | 02:37 | |
| ayoung | you mean something that proxies the keystoneclient calls, and only makes the actual remote call if the cahce is invalid? | 02:38 |
| jamielennox | especially as we push things to httpd where there isn't caching between processes | 02:38 |
| *** topol_ has quit IRC | 02:38 | |
| jamielennox | ayoung: right, something on a unix socket, or something else quick | 02:38 |
| ayoung | does it need to be a process? | 02:38 |
| jamielennox | that can give yes/no answers fast | 02:38 |
| *** topol has quit IRC | 02:38 | |
| *** topol has joined #openstack-keystone | 02:38 | |
| jamielennox | ayoung: i don't know what else you can do that can be shared across worker threads | 02:38 |
| *** ChanServ sets mode: +v topol | 02:38 | |
| *** topol has quit IRC | 02:38 | |
| *** topol has joined #openstack-keystone | 02:39 | |
| *** ChanServ sets mode: +v topol | 02:39 | |
| *** lhcheng has joined #openstack-keystone | 02:40 | |
| jamielennox | ayoung: because i would want this to be like a TPM, no certs, keys, tokens, user/pass escapes, you ask for a validation, or you ask for if it's available and it responds yes/no | 02:40 |
| jamielennox | hmm, that doesn't necessarily track with what i've been pushing for with X-Subject-Token - would need to think some more there | 02:40 |
| dims_ | so...update. if https://review.openstack.org/#/c/169535/ passes the check jobs. it's good to go. addressed all comments from everyone AFAICT :) | 02:40 |
| ayoung | Heh | 02:40 |
| ayoung | dims_, don't port to nova. Make nova use oslo.policy instead | 02:41 |
| dims_ | ayoung: y missed the boat on that one | 02:42 |
| dims_ | first thing when trunk reopens | 02:42 |
| ayoung | ++ | 02:42 |
| dims_ | ayoung: i have it on my list - https://etherpad.openstack.org/p/liberty-nova-summit-ideas | 02:43 |
| ayoung | dims_, read up the conversation I just had with jamielennox about policy. Trying to get the rest of the dynamic policy BP laid out | 02:44 |
| ayoung | jamielennox, the idea of a dedicate process bothers me. Maybe I am being to particular, but I would rather do the work in the thread handling the request | 02:45 |
| ayoung | of course, the precludes listening for messaging | 02:46 |
| ayoung | OK, let's throw it out as a straw man: we have a dedicated process that listens to the queues: one from keystone, one from the webserver, and responds to events from both sides. | 02:49 |
| ayoung | what if we treated that as an optimization? The real deal is that we need to keep a cache fresh, and that we can always fetch from Keystone if the cache is stale. Then the helper process is reduced to keeping the cache fresh. Nova then looks at the cache, and, if it is stale, will m,ake the request via keystone client | 02:50 |
| ayoung | that way, if the helper process dies, we degrade gracefully. | 02:51 |
| ayoung | it will not listen to request from the web server, only from the message queues | 02:52 |
| ayoung | it is responsible for responding to those messages, but also for making requests if the caches are stale. | 02:52 |
| *** _cjones_ has quit IRC | 02:52 | |
| *** _cjones_ has joined #openstack-keystone | 02:53 | |
| *** dims_ has quit IRC | 02:55 | |
| jamielennox | ayoung: what i want to get away from is polling everywhere for all these things | 02:55 |
| jamielennox | we have a message bus | 02:55 |
| jamielennox | i don't like a dedicated process either | 02:56 |
| ayoung | but if the service is down, we miss messages. We need to prime the pump. So we start by fetching. Then bring up the listener. | 02:56 |
| jamielennox | what _would_ be good is writing this stuff as a proper apache module so it gets handled before mod_wsgi | 02:56 |
| ayoung | hmmm...wring side of the wire, I think | 02:59 |
| ayoung | jamielennox, that won't work | 02:59 |
| jamielennox | ayoung: it won't be accepted anyway | 03:00 |
| ayoung | nah...I mean that the cache needs to be on the client side of the web connection, not the server side | 03:00 |
| jamielennox | ayoung: so maybe the thinking here is wrong in that we expect to be able to do this client side | 03:03 |
| jamielennox | ayoung: say we made keystone a proper PEP | 03:03 |
| jamielennox | ayoung: such that we had to make an online request to keystone to test policy | 03:03 |
| ayoung | you mean fire all policy decision over to PEP to check. | 03:04 |
| jamielennox | ayoung: and then we write a caching process that can run on a local machine, or closer to the service, that can handle this instead of keystone | 03:04 |
| jamielennox | standard distributed PEP | 03:04 |
| jamielennox | distributed PEP gets notifications from keystone, fallback to checking via keystone if not avilable | 03:04 |
| jamielennox | much better integration with something like congress | 03:04 |
| ayoung | so we don't "cache" at all in the services, we always make a remote call. THen hide the fact that the remote call is just to the cache | 03:05 |
| ayoung | interesting idea....very | 03:05 |
| jamielennox | well, it's still an external process, just on the same machine | 03:05 |
| jamielennox | now that we don't have to replicate the token table around this is what people have been wanting from a repliated keystone anyway | 03:06 |
| jamielennox | i like it a lot actually, need to think some more on this | 03:06 |
| ayoung | deal...adbn with that, I'm headed to bed | 03:07 |
| *** ayoung is now known as ayoung_ZZZzzz__z | 03:07 | |
| jamielennox | ayoung_ZZZzzz__z: night | 03:07 |
| *** jacer_huawei has quit IRC | 03:09 | |
| *** samueldmq has quit IRC | 03:10 | |
| *** jacer_huawei has joined #openstack-keystone | 03:11 | |
| *** david-lyle has joined #openstack-keystone | 03:13 | |
| *** tqtran_afk has quit IRC | 03:28 | |
| openstackgerrit | darren-wang proposed openstack/keystone: Correcting the name of directory holding dev docs in developing.rst. https://review.openstack.org/169601 | 03:35 |
| jamielennox | nkinder: like that idea a lot ^ | 03:35 |
| *** jacer_huawei has quit IRC | 03:45 | |
| *** jacer_huawei has joined #openstack-keystone | 03:46 | |
| *** _cjones_ has quit IRC | 03:47 | |
| *** rushiagr_away is now known as rushiagr | 03:54 | |
| *** iamjarvo has quit IRC | 04:02 | |
| *** lhcheng has quit IRC | 04:17 | |
| *** rushiagr is now known as rushiagr_away | 04:22 | |
| openstackgerrit | darren-wang proposed openstack/keystone: Correcting the name of directory holding dev docs in developing.rst. Closes-Bug: #1438983 Change-Id: I4afa0194f5f7cab3c562806b052be6f4a8d38357 https://review.openstack.org/169601 | 04:25 |
| openstack | bug 1438983 in Keystone "The directory holding dev docs is "doc" instead of "docs"." [Undecided,Fix released] https://launchpad.net/bugs/1438983 - Assigned to DWang (darren-wang) | 04:25 |
| *** lhcheng has joined #openstack-keystone | 04:25 | |
| *** krtaylor has quit IRC | 04:48 | |
| *** krtaylor has joined #openstack-keystone | 04:50 | |
| *** lhcheng has quit IRC | 04:56 | |
| *** topol has quit IRC | 04:57 | |
| *** rushiagr_away is now known as rushiagr | 05:14 | |
| nkinder | jamielennox: it reminds me of an OCSP responder approach in a way (to offload handling of OSCP checks from a CA) | 05:17 |
| *** rushiagr is now known as rushiagr_away | 05:23 | |
| *** topol has joined #openstack-keystone | 05:25 | |
| *** ChanServ sets mode: +v topol | 05:25 | |
| *** topol has quit IRC | 05:34 | |
| *** lhcheng has joined #openstack-keystone | 05:40 | |
| *** lhcheng has quit IRC | 05:46 | |
| *** packet has quit IRC | 06:07 | |
| *** henrynash has joined #openstack-keystone | 06:13 | |
| *** ChanServ sets mode: +v henrynash | 06:13 | |
| breton | oh | 06:15 |
| breton | I like that thingy from ms word | 06:15 |
| *** henrynash has quit IRC | 06:18 | |
| *** davechen has joined #openstack-keystone | 06:18 | |
| *** KrustyB has joined #openstack-keystone | 06:19 | |
| *** afazekas has joined #openstack-keystone | 06:21 | |
| *** ParsectiX has joined #openstack-keystone | 06:29 | |
| *** ishant has joined #openstack-keystone | 06:41 | |
| *** stevemar has joined #openstack-keystone | 06:45 | |
| *** ChanServ sets mode: +v stevemar | 06:45 | |
| *** stevemar has quit IRC | 06:48 | |
| *** henrynash has joined #openstack-keystone | 07:00 | |
| *** ChanServ sets mode: +v henrynash | 07:00 | |
| *** henrynash has quit IRC | 07:02 | |
| *** erkules_ is now known as erkules | 07:03 | |
| *** markvoelker has quit IRC | 07:09 | |
| *** KrustyB has quit IRC | 07:10 | |
| *** jistr has joined #openstack-keystone | 07:14 | |
| *** KrustyB has joined #openstack-keystone | 07:16 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/144860 | 07:22 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Correcting the name of directory holding dev docs https://review.openstack.org/169601 | 07:29 |
| *** rushiagr_away is now known as rushiagr | 07:30 | |
| *** stevemar has joined #openstack-keystone | 07:36 | |
| *** ChanServ sets mode: +v stevemar | 07:36 | |
| *** rushiagr is now known as rushiagr_away | 07:37 | |
| *** dims_ has joined #openstack-keystone | 07:50 | |
| *** stevemar has quit IRC | 07:50 | |
| *** pnavarro|off has quit IRC | 07:51 | |
| *** dims_ has quit IRC | 07:55 | |
| *** ncoghlan has quit IRC | 08:00 | |
| *** ccard__ has quit IRC | 08:04 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Make Pecan the root routing framework https://review.openstack.org/65428 | 08:09 |
| *** davidckennedy has joined #openstack-keystone | 08:09 | |
| davidckennedy | Why do I see a paperclip in gerrit now? Is there a good reason? | 08:10 |
| breton | davidckennedy: gerrit is based on old MS review tool | 08:18 |
| breton | davidckennedy: maybe it is some bug | 08:18 |
| *** lhcheng has joined #openstack-keystone | 08:20 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Make Pecan the root routing framework https://review.openstack.org/65428 | 08:34 |
| *** hogepodge has quit IRC | 08:46 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/144860 | 08:55 |
| *** rushiagr_away is now known as rushiagr | 09:01 | |
| *** davidckennedy has quit IRC | 09:07 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Migrate_repo init version helper https://review.openstack.org/137640 | 09:17 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Share engine between migration helpers. https://review.openstack.org/137778 | 09:17 |
| *** krykowski has joined #openstack-keystone | 09:21 | |
| *** lhcheng has quit IRC | 09:24 | |
| *** links has joined #openstack-keystone | 09:27 | |
| *** KrustyB has quit IRC | 09:38 | |
| *** davechen has left #openstack-keystone | 09:45 | |
| *** krykowski has quit IRC | 09:48 | |
| *** lhcheng has joined #openstack-keystone | 09:51 | |
| *** dims_ has joined #openstack-keystone | 10:00 | |
| *** dims__ has joined #openstack-keystone | 10:01 | |
| *** lhcheng has quit IRC | 10:01 | |
| *** dims_ has quit IRC | 10:04 | |
| *** rushiagr is now known as rushiagr_away | 10:19 | |
| *** rushiagr_away is now known as rushiagr | 10:22 | |
| *** jistr has quit IRC | 10:23 | |
| *** krykowski has joined #openstack-keystone | 10:28 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 10:35 |
| *** samueldmq has joined #openstack-keystone | 10:35 | |
| *** jistr has joined #openstack-keystone | 10:36 | |
| samueldmq | jamielennox, yeah, now I can see that clippy too o/ | 10:36 |
| *** ishant has quit IRC | 10:44 | |
| *** nellysmitt has joined #openstack-keystone | 10:50 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 10:55 |
| *** lhcheng has joined #openstack-keystone | 11:01 | |
| *** lhcheng has quit IRC | 11:05 | |
| *** jistr is now known as jistr|demo | 11:11 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Adds inherited column to RoleAssignment PK https://review.openstack.org/142472 | 11:26 |
| *** rushiagr is now known as rushiagr_away | 11:28 | |
| *** rushiagr_away is now known as rushiagr | 11:28 | |
| breton | samueldmq: re 142472: good to know! Good luck with the issue | 11:32 |
| samueldmq | breton, yeah, thanks | 11:32 |
| samueldmq | breton, in fact I have a question ... | 11:33 |
| samueldmq | breton, do you know if we do need to drop indexes manually? aren't they dropped when we drop the table? | 11:33 |
| samueldmq | breton, (I committed even with this issue to let you guys know I am still working on this :)) | 11:33 |
| breton | they should be dropped, yes | 11:35 |
| breton | oh, wait | 11:35 |
| * breton misread | 11:35 | |
| breton | they are be dropped automatically when you drop the table | 11:36 |
| samueldmq | breton, hmm ok, so maybe my code works removing the drop of the index ... let me check | 11:36 |
| breton | DROP TABLE always removes any indexes, rules, triggers, and constraints that exist for the target table | 11:36 |
| samueldmq | breton, ++ nice :) | 11:37 |
| *** amakarov_away is now known as amakarov | 11:44 | |
| *** bdossant has joined #openstack-keystone | 11:48 | |
| *** davidckennedy has joined #openstack-keystone | 11:59 | |
| *** lhcheng has joined #openstack-keystone | 12:03 | |
| *** lhcheng has quit IRC | 12:07 | |
| *** edmondsw has joined #openstack-keystone | 12:13 | |
| *** henrynash has joined #openstack-keystone | 12:14 | |
| *** ChanServ sets mode: +v henrynash | 12:14 | |
| *** markvoelker has joined #openstack-keystone | 12:14 | |
| *** david-lyle_ has joined #openstack-keystone | 12:28 | |
| *** atiwari2 has joined #openstack-keystone | 12:28 | |
| *** david-lyle_ has quit IRC | 12:28 | |
| *** Guest37649 has joined #openstack-keystone | 12:29 | |
| *** ChanServ sets mode: +v Guest37649 | 12:29 | |
| *** links has quit IRC | 12:30 | |
| *** gordc has joined #openstack-keystone | 12:30 | |
| *** atiwari1 has quit IRC | 12:31 | |
| *** jeffDeville has joined #openstack-keystone | 12:31 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 12:32 |
| samueldmq | henrynash, ping - would like to talk about ^ | 12:37 |
| henrynash | samueldmq: sure | 12:38 |
| samueldmq | henrynash, let me say what I understood and you correct me if I am wrong | 12:39 |
| samueldmq | henrynash, we have a loop to load specific drivers | 12:39 |
| henrynash | :-) | 12:39 |
| samueldmq | henrynash, and any_sql bool is updated when the first sql driver is found | 12:40 |
| henrynash | so there is a bug in that code anyway…I’m fixing in a separate defect…but go in | 12:40 |
| samueldmq | henrynash, in a multithread env, one thread may load one sql driver and update any_sql to true | 12:40 |
| henrynash | we don;t call that method anymore in the case of Idenity API configs | 12:41 |
| samueldmq | henrynash, but in the time between those two actions (load sql driver and set the flag), another thread may check the flag, see it as false and then load another sql driver | 12:41 |
| henrynash | have you seen the new patch? | 12:41 |
| samueldmq | henrynash, not yet, but that was the issue, right ? ^ | 12:42 |
| samueldmq | henrynash, will take a look | 12:42 |
| *** hogepodge has joined #openstack-keystone | 12:42 | |
| henrynash | yes that was one of the issues…so now we don’t allow it! | 12:43 |
| *** jeffDeville has quit IRC | 12:43 | |
| samueldmq | henrynash, so no specific identity sql driver | 12:43 |
| samueldmq | henrynash, makes sense | 12:44 |
| samueldmq | henrynash, why not always have the default as sql | 12:44 |
| henrynash | no, not allowed….although you can, of cause, set a specific driver for teh default domain, plus other specific LDAP domains…and then leave sql driver in the main config file for another other domains | 12:44 |
| henrynash | exactly | 12:45 |
| samueldmq | henrynash, so .. | 12:45 |
| samueldmq | henrynash, that makes things simpler | 12:45 |
| samueldmq | henrynash, and https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L521-L530 | 12:46 |
| samueldmq | henrynash, and we can change this ^ | 12:46 |
| samueldmq | henrynash, right? | 12:46 |
| *** diegows has joined #openstack-keystone | 12:46 | |
| henrynash | remember we still support it fore file-based domain-specific configurations | 12:47 |
| henrynash | (didn’t want to take it away since it is already out there) | 12:47 |
| henrynash | so we can’t fix that bit of code, no | 12:47 |
| samueldmq | henrynash, oh yes, I was going to break ppl :/ | 12:47 |
| samueldmq | henrynash, ++ | 12:48 |
| samueldmq | henrynash, so this is just for new deployments using the API config setup, right? | 12:48 |
| henrynash | yes | 12:49 |
| samueldmq | henrynash, you made something in keystone manage to migrate files to database, right? | 12:49 |
| henrynash | yes…keystone-manage supports a migration | 12:50 |
| samueldmq | henrynash, this wouldnt break if ppl already using domain-specific config from files do: | 12:50 |
| samueldmq | henrynash, i) load files using the keytone manage | 12:50 |
| samueldmq | henrynash, ii) setup their keystone | 12:50 |
| samueldmq | henrynash, shouldn't them be expecting that to work as previously? | 12:51 |
| samueldmq | if you understand my point ... | 12:51 |
| henrynash | samueldmq: it would, yes…and I have made a note in tehe configuration.rst that sql drives are not supported iwth this experimental feature | 12:51 |
| *** diegows has quit IRC | 12:51 | |
| henrynash | and since we don’t remove the files, the could switch back off the API version, and the files based ones we leap back into use | 12:52 |
| samueldmq | henrynash, configs from files is stable? | 12:52 |
| henrynash | yes | 12:52 |
| samueldmq | henrynash, k then | 12:52 |
| henrynash | (at least we have never said it’s not!) | 12:52 |
| henrynash | it was in icehouse | 12:52 |
| samueldmq | henrynash, now just another thing .. why cant we support mulitple sql? | 12:52 |
| henrynash | or even before? | 12:53 |
| samueldmq | henrynash, yes I think it's stable | 12:53 |
| samueldmq | :) | 12:53 |
| henrynash | so I’m working onthat…..it’s meant to be due to sqlaclhemy not supporting multiple instantiations of itself…but I’ve never actually tried it | 12:53 |
| henrynash | that’s on my list of L | 12:53 |
| samueldmq | henrynash, nice, will be a great step to have it | 12:54 |
| henrynash | agreed | 12:54 |
| samueldmq | henrynash, I feel like a kid waiting for Christmas | 12:54 |
| samueldmq | henrynash, L will be great! | 12:55 |
| henrynash | :-) | 12:55 |
| samueldmq | henrynash, btw, thank you for your review on that federation bug | 12:55 |
| henrynash | np…good to get that fix in | 12:55 |
| samueldmq | :-) | 12:55 |
| samueldmq | henrynash, any remaining bug on inheritance will go away with the refactoring of list_role_assignments | 12:56 |
| samueldmq | henrynash, where methods that need that logic will call list_role_assignments on manager layer | 12:56 |
| henrynash | yeah…let;s get that in early in L | 12:56 |
| samueldmq | henrynash, yeah | 12:56 |
| henrynash | master will open up fo L maybe end of next week…. | 12:57 |
| *** raildo|away is now known as raildo | 12:57 | |
| henrynash | so no tlong to wait | 12:57 |
| samueldmq | henrynash, great! | 12:57 |
| samueldmq | henrynash, btw, did you see the clippy in the gerrit review page? | 12:57 |
| samueldmq | henrynash, Happy April Fool's Day! :) | 12:57 |
| henrynash | I bloody did…..that’s a real blast from the past! | 12:58 |
| samueldmq | haha yeah | 12:58 |
| henrynash | ok, be back on line later… | 12:59 |
| *** mattfarina has joined #openstack-keystone | 12:59 | |
| dims__ | hi anyone here comfortable enough to +2A a oslo.policy change? https://review.openstack.org/#/c/169535/ | 13:02 |
| rodrigods | dims__, looking | 13:02 |
| dims__ | rodrigods: thanks | 13:05 |
| rodrigods | dims__, done | 13:10 |
| *** bknudson has quit IRC | 13:10 | |
| dims__ | thanks | 13:10 |
| *** jaosorior has joined #openstack-keystone | 13:11 | |
| *** nkinder has quit IRC | 13:17 | |
| *** davidcke1 has joined #openstack-keystone | 13:21 | |
| *** viktors has joined #openstack-keystone | 13:22 | |
| *** davidckennedy has quit IRC | 13:23 | |
| *** joesavak has joined #openstack-keystone | 13:26 | |
| -openstackstatus- NOTICE: gerrit has been restarted to restore event streaming. any change events missed by zuul (between 12:48 and 13:28 utc) will need to be rechecked or have new approval votes set | 13:28 | |
| *** Guest37649 has quit IRC | 13:29 | |
| *** Olena has joined #openstack-keystone | 13:31 | |
| *** lastops has joined #openstack-keystone | 13:32 | |
| *** erkules has quit IRC | 13:32 | |
| *** erkules has joined #openstack-keystone | 13:32 | |
| henrynash | morganfainberg, ayoung, dstanek: new patch for last domain-sql change is now available: https://review.openstack.org/#/c/163322/ | 13:36 |
| dstanek | henrynash: nice. is this one of the FFEs? | 13:38 |
| henrynash | dtsanek: yep, as dsicussed in irc meeting yesterday…. | 13:38 |
| dstanek | henrynash: great, i'll have another look | 13:39 |
| openstackgerrit | Matt Fischer proposed openstack/keystone: Add a Lotto token provider https://review.openstack.org/169747 | 13:40 |
| mfisch | guys I'm really hoping I can get a Feature Freeze Exception on that ^ | 13:40 |
| dstanek | mfisch: lol | 13:40 |
| dstanek | mfisch: i should +2A to make the joke complete | 13:41 |
| mfisch | lol | 13:41 |
| *** diegows has joined #openstack-keystone | 13:46 | |
| samueldmq | henrynash, left a comment on the domain-sql, let me know if that makes sense or if you have any comment on my review | 13:46 |
| samueldmq | mfisch, ahha :-) | 13:48 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:48 | |
| Olena | hi everyone! Does anyone know about keyring support? | 13:51 |
| *** henrynash has quit IRC | 13:52 | |
| Olena | I am new in OS (I work as a tech writer). And I'm stuck with a bug https://launchpad.net/bugs/1419990 (patch https://review.openstack.org/#/c/163503/) | 13:52 |
| openstack | Launchpad bug 1419990 in openstack-manuals "Keyring support" [Medium,In progress] - Assigned to ologvinova (ologvinova) | 13:52 |
| Olena | Does the page http://docs.openstack.org/user-guide/content/cli_openrc.html contain info about python-keystoneclient only, or both python-keystoneclient and python-openstackclient? And should we remove the keyring support part here, or do some re-wording? | 13:53 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 13:55 | |
| *** iamjarvo has joined #openstack-keystone | 13:59 | |
| samueldmq | mfisch, reviewd your patch, there is an issue in there | 14:00 |
| samueldmq | mfisch, fixing that should make this be merged today on master, thanks! | 14:00 |
| *** nkinder has joined #openstack-keystone | 14:00 | |
| samueldmq | :-) | 14:00 |
| mfisch | yeah I can't believe I misspelled fernet! | 14:00 |
| mfisch | oh wow good catch! | 14:01 |
| samueldmq | mfisch, yeah that one too (in fernet name) ;) | 14:01 |
| mfisch | man I need to do better testing | 14:02 |
| mfisch | and on that number thing, no wonder I never win | 14:02 |
| samueldmq | mfisch, also fix power_ball range, if it needs to include 35 :) | 14:03 |
| mfisch | I dont even know for sure ;) | 14:03 |
| samueldmq | mfisch, we have no time for tests, this needs to arrive asap, please just fix those issues and let's have it | 14:03 |
| mfisch | lol | 14:04 |
| *** ParsectiX has quit IRC | 14:04 | |
| samueldmq | mfisch, :-) | 14:04 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:04 | |
| samueldmq | mfisch, need to go now, have a happy April fool's day! | 14:04 |
| mfisch | thanks you too ;) | 14:04 |
| openstackgerrit | Matt Fischer proposed openstack/keystone: Add a Lotto token provider https://review.openstack.org/169747 | 14:13 |
| *** rushiagr is now known as rushiagr_away | 14:14 | |
| *** timcline has joined #openstack-keystone | 14:21 | |
| *** bdossant_ has joined #openstack-keystone | 14:23 | |
| *** bdossant has quit IRC | 14:25 | |
| *** bknudson has joined #openstack-keystone | 14:28 | |
| *** ChanServ sets mode: +v bknudson | 14:28 | |
| *** davidcke1 has quit IRC | 14:36 | |
| *** diegows has quit IRC | 14:43 | |
| *** carlosmarin has joined #openstack-keystone | 14:43 | |
| *** timcline_ has joined #openstack-keystone | 14:49 | |
| *** timcline has quit IRC | 14:49 | |
| *** timcline has joined #openstack-keystone | 14:51 | |
| *** timcline_ has quit IRC | 14:53 | |
| *** davechen has joined #openstack-keystone | 14:59 | |
| *** Bsony has joined #openstack-keystone | 15:00 | |
| *** nellysmi_ has joined #openstack-keystone | 15:03 | |
| *** nellysmitt has quit IRC | 15:04 | |
| *** nellysmitt has joined #openstack-keystone | 15:04 | |
| davechen | Hi, I have setup a multi-node OpenStack environment, and compute services are running on each node, but I found there is no information about the compute service except the controller node. | 15:04 |
| davechen | Is this correct? | 15:04 |
| *** packet has joined #openstack-keystone | 15:04 | |
| davechen | I assume there should be some endpoints track the services on different nodes, am I wrong? | 15:05 |
| *** nellysmitt has quit IRC | 15:05 | |
| davechen | If there is a way I can know from Keystone about the services running on different nodes? | 15:07 |
| *** nellysmi_ has quit IRC | 15:08 | |
| *** bdossant_ has quit IRC | 15:09 | |
| *** rushiagr_away is now known as rushiagr | 15:11 | |
| *** arunkant has quit IRC | 15:16 | |
| *** bdossant has joined #openstack-keystone | 15:17 | |
| *** bdossant has quit IRC | 15:21 | |
| amakarov | davechen, have you tried nova cli? | 15:21 |
| *** bdossant has joined #openstack-keystone | 15:21 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 15:22 |
| *** henrynash has joined #openstack-keystone | 15:25 | |
| *** ChanServ sets mode: +v henrynash | 15:25 | |
| *** arunkant has joined #openstack-keystone | 15:29 | |
| *** ayoung_ZZZzzz__z is now known as ayoung_snort | 15:30 | |
| *** ayoung_snort is now known as ayoung_yawn | 15:31 | |
| *** ayoung_yawn is now known as ayoung_grumble | 15:31 | |
| *** ayoung_grumble is now known as ayoung | 15:31 | |
| *** davechen has quit IRC | 15:33 | |
| henrynash | samueldmq: does delattr actually take a “None” third param? | 15:34 |
| *** davechen has joined #openstack-keystone | 15:34 | |
| *** toabctl has joined #openstack-keystone | 15:35 | |
| toabctl | how can I associate policies in juno? seems that it's possible to create new policies with v3 API and the openstackclient but I can't find a way to associate the created policy with a endpoint or service. | 15:36 |
| toabctl | is that WIP? | 15:36 |
| davechen | amakarov: It's told me I am not authorized, I guess my ENV is broken. :-( | 15:36 |
| davechen | amakarov: Horizon shows the same error message. | 15:37 |
| amakarov | davechen, if you deploy devstack you have to source ~./openrc in order to use cli: did you? | 15:38 |
| david-lyle | toabctl: the only way to use that API is have the service push the policy blob and then consume it via the uuid returned | 15:39 |
| david-lyle | it's not actually useful, IMO | 15:39 |
| david-lyle | centralized policy management is slated for a take 2 in Liberty | 15:40 |
| david-lyle | ayoung has some efforts there | 15:40 |
| *** lhcheng has joined #openstack-keystone | 15:40 | |
| ayoung | LIES! | 15:40 |
| ayoung | Wait, what? | 15:40 |
| david-lyle | toabctl: asked about the existing policy API | 15:40 |
| ayoung | Heh | 15:40 |
| david-lyle | I'm trying to say RUN! kindly | 15:41 |
| ayoung | toabctl, lots of Blueprints for it | 15:41 |
| toabctl | david-lyle: hm. so is there any way to override the policy without changing /etc/keystone/policy.json ? I recognzed that there is the policy_dirs var, but that's just for kilo | 15:41 |
| davechen | amakarov: sure, I sourced it. I think I need reinstallation to see what's in it. | 15:41 |
| ayoung | toabctl, Nope | 15:41 |
| toabctl | ayoung: "no" for the override question? | 15:41 |
| david-lyle | hence the need for a centralized solution | 15:41 |
| ayoung | toabctl, treate it as a config file, and manage with Puppet, Chef, Ansible, CFEngine, or JbossOperationalNetwork | 15:41 |
| ayoung | toabctl, you must chagne the policy file | 15:41 |
| ayoung | you want to change the policy file | 15:42 |
| * ayoung drinking too much April 1st Kool Aid | 15:42 | |
| ayoung | toabctl, https://adam.younglogic.com/2014/11/dynamic-policy-in-keystone/ | 15:42 |
| amakarov | davechen, sounds like "90% of notebook failures may be solved with a vacuum cleaner" :) | 15:42 |
| amakarov | s/notebook/laptop/ | 15:43 |
| *** lhcheng has quit IRC | 15:44 | |
| davechen | amakarov: pity, I am not using laptop, but it failed as well. :P | 15:44 |
| ayoung | amakarov, s/laptop/puppy/ | 15:44 |
| * amakarov wanders what puppy issues ayoung solved with vacuum cleaner | 15:45 | |
| ayoung | amakarov, s/solved/exacerbated/ | 15:46 |
| toabctl | ayoung: thanks for the link. so for kilo, there will be the policy_dirs var to override policies, right? or is the api already usable in kilo? | 15:46 |
| ayoung | toabctl, why are you making me be the one to give you all the bad news? | 15:47 |
| ayoung | toabctl, we just got policy graduated as a library | 15:47 |
| ayoung | only Keystone is using the policy library | 15:47 |
| toabctl | ayoung: you seems to be willing to answer :-) | 15:47 |
| *** _cjones_ has joined #openstack-keystone | 15:47 | |
| ayoung | so the other services are still doing the "clone from oslo incubator" approach | 15:47 |
| ayoung | which means it really depends on when they cloned wht features they have | 15:47 |
| ayoung | I'm pretty sure the policy code for the dir went in early enough that most of them picked it up, but to be honest, you;d have to inspect each project to be sure | 15:48 |
| toabctl | ayoung: but at least there's the policy_dirs . that's already an improvement.. | 15:48 |
| ayoung | toabctl, for Keystone, sure | 15:48 |
| ayoung | well, I'm not 100% certain it is an improvement, but if it solves your problem, good | 15:48 |
| ayoung | I suspect it is actually going to be problematic long term, but I | 15:49 |
| ayoung | ''m an optimist | 15:49 |
| toabctl | :) | 15:49 |
| *** Guest54459 is now known as h_m | 15:49 | |
| ayoung | I think we need to acutally merge the policy files inside the keystone server, and then have each service use one and only one, otherwise we'll have the potential for rules conflicts...we might have that anyway | 15:49 |
| ayoung | not certain how the dirs thing is supposed to wrok...let me go read up on it... | 15:50 |
| openstackgerrit | henry-nash proposed openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 15:50 |
| *** henrynash has quit IRC | 15:52 | |
| ayoung | toabctl, shudder. | 15:53 |
| *** iamjarvo has quit IRC | 15:53 | |
| ayoung | toabctl, its as bad as I thought | 15:53 |
| david-lyle | ayoung: the problem is a "default" rule that works across services | 15:53 |
| david-lyle | when trying to combine | 15:53 |
| ayoung | david-lyle, default is one of many problems, yes | 15:54 |
| ayoung | david-lyle, then there is the whole "where do we find the project_id to match against the token" rule, as it varies from object to object | 15:54 |
| david-lyle | one of many | 15:54 |
| david-lyle | and other ownership targets | 15:55 |
| *** davechen has left #openstack-keystone | 15:55 | |
| ayoung | and domains will make it even more fun. So far, domains are confined to Keystone, but I assure you one of the othe projects will find they desperately need them soon | 15:55 |
| david-lyle | 2 years later | 15:55 |
| ayoung | and other ownership targets, like user, and I'm sure someone is going to want Openstack specific groups that are not projects | 15:55 |
| ayoung | OK, I'm going to add a slide to my policy presentation "the dangers of policy.d" | 15:56 |
| *** krykowski has quit IRC | 15:56 | |
| david-lyle | ayoung, I know I'm going to regret this, but I'm willing to fight the policy fight with you | 15:56 |
| ayoung | david-lyle, I know you guys need it. It is part of what drove the design | 15:57 |
| ayoung | The thing we haven;t done yet is provided you with a way to do "if I have this token, what can I do with it" | 15:57 |
| david-lyle | yes, and I'm embarrassed by what we have now | 15:57 |
| ayoung | Which is, basically: [rule for rule in policy where rule.matches(...)] | 15:58 |
| david-lyle | ayoung: that would be ideal, but that mapping becomes very difficult | 15:58 |
| david-lyle | I suppose as long as you return the rule id with the approved, we can map | 15:59 |
| david-lyle | the problem is if new rules are added | 15:59 |
| david-lyle | so horizon knows about action X, what if it's not in the policy file | 15:59 |
| *** bdossant has quit IRC | 15:59 | |
| david-lyle | it won't return approved | 15:59 |
| david-lyle | s/approved/allowed/ | 15:59 |
| david-lyle | so if someone starts changing the policy rules mapped, I get lost on the consumption side | 16:00 |
| david-lyle | so then do you return the exhaustive list of allowed/not-allowed? | 16:01 |
| david-lyle | and I allow the others? | 16:01 |
| david-lyle | but that list is potentially huge depending on the size of my service catalog | 16:01 |
| ayoung | I suspect that the horizon solution would be to cherry pick rules | 16:02 |
| ayoung | "in order to show the create vm page, make sure the compute:create_vm rule passes" type things | 16:03 |
| david-lyle | ayoung, yes, but what if the operator removes the entry for compute:create_vm | 16:04 |
| ayoung | if the policy files are changed, we need a way to synchronize across the cluster. jamielennox and I were discussing last night. | 16:04 |
| ayoung | I don't thing "remove" is going to be possible for a customized policy file, just "override" | 16:04 |
| david-lyle | the more likely case is Horizon supports an extension that requires a rule that may not be mapped yet | 16:04 |
| ayoung | we are going to need an inventory of rules | 16:04 |
| ayoung | that inventory may be a subset, but will be the minimal required set | 16:05 |
| ayoung | david-lyle, the SQL backend will help with all this | 16:05 |
| ayoung | as will the default policy file and fetch the files from Keystone | 16:05 |
| ayoung | and all that deopends on this patch believe it or not: https://review.openstack.org/#/c/138519/ | 16:06 |
| ayoung | I need a unified access info so we can standarize the policy execution | 16:06 |
| ayoung | and...I need a place to put that and make it work...which probably should not be in oslo.policy | 16:06 |
| ayoung | we were talking about middleware, but it can't be a straight middleware piece. | 16:07 |
| ayoung | It needs to be a library call. | 16:07 |
| ayoung | Many of the calls need to fetch an object from the database before we can enforce policy on them | 16:07 |
| ayoung | I thihnk Horizon is going to be limited to checking the policy rules that do not require fetching the objects | 16:08 |
| ayoung | create and list | 16:08 |
| ayoung | not modify or delelte | 16:08 |
| ayoung | delete | 16:08 |
| david-lyle | I'm not sure that's sufficient | 16:09 |
| david-lyle | hmm, we let the user do all the work and then have the API reject them | 16:09 |
| david-lyle | not a great user experience | 16:10 |
| david-lyle | because it's about gets too | 16:10 |
| david-lyle | get the details of an object | 16:11 |
| david-lyle | I provide a link, then the call fails and reports errors | 16:11 |
| *** devlaps has joined #openstack-keystone | 16:13 | |
| ayoung | david-lyle, well, Horizon could fake it. Youi don't need a real object, justo ne that looks like, say, a glance image or a nova VM | 16:14 |
| ayoung | so long as you check the project id matches | 16:14 |
| ayoung | maybe some sort of adapter pattern where we register a bunch of objects and you pass on object, it checks the type, and gets you the project id off of it. THne you could do a mock one based on the exisiting project id? | 16:15 |
| *** tqtran_afk has joined #openstack-keystone | 16:16 | |
| ayoung | david-lyle, I get the first slot to talk about all this: https://www.openstack.org/summit/vancouver-2015/schedule/ | 16:17 |
| ayoung | the more stuff you throw at me ahead of time, the better that talk will be | 16:17 |
| *** tqtran_afk is now known as tqtran | 16:18 | |
| *** ayoung has quit IRC | 16:41 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:43 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 16:43 | |
| *** jistr|demo has quit IRC | 16:47 | |
| *** dims__ has quit IRC | 16:53 | |
| *** dims_ has joined #openstack-keystone | 16:53 | |
| *** ayoung has joined #openstack-keystone | 16:55 | |
| *** ChanServ sets mode: +v ayoung | 16:55 | |
| *** lhcheng has joined #openstack-keystone | 16:56 | |
| ayoung | david-lyle, care to push the button on this one: https://review.openstack.org/#/c/136178/ | 16:58 |
| david-lyle | ayoung: looking | 17:00 |
| *** amakarov is now known as amakarov_away | 17:01 | |
| *** harlowja_away is now known as harlowja | 17:02 | |
| *** pnavarro|off has joined #openstack-keystone | 17:04 | |
| *** _cjones_ has quit IRC | 17:06 | |
| *** _cjones_ has joined #openstack-keystone | 17:13 | |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 17:18 |
| *** iamjarvo has joined #openstack-keystone | 17:19 | |
| *** stevemar has joined #openstack-keystone | 17:20 | |
| *** ChanServ sets mode: +v stevemar | 17:20 | |
| *** pnavarro|off has quit IRC | 17:23 | |
| *** zzzeek has joined #openstack-keystone | 17:27 | |
| morganfainberg | ayoung: david-lyle so I've been thinking on the policy front a lot. What if we really focused down the policy bits to the surface API only. The classic example is nova boot. If I am granted the ability to nova boot we work to make that role (plus the appropriate service token) sufficient to perform all actions needed to do instance create. | 17:30 |
| ayoung | morganfainberg, way ahead of you | 17:30 |
| morganfainberg | The backscroll was a bit in depth so I may have missed where you covered that. | 17:31 |
| ayoung | morganfainberg, nah, I meant in the policy work | 17:32 |
| *** jaosorior has quit IRC | 17:32 | |
| morganfainberg | Right. That is what I was referencing. | 17:32 |
| ayoung | morganfainberg, but that is kindof what I meant by cherry picking | 17:32 |
| ayoung | instead of horizon needing to look at all the rules, it picks the ones that are most representative of what it needs to show | 17:33 |
| ayoung | morganfainberg, btw, don't both him right now, as he is reviewing an ultra critical patch for us! | 17:33 |
| ayoung | https://review.openstack.org/#/c/136178/ | 17:33 |
| morganfainberg | Annnnd as entertained as I am by the April 1 infra joke... I am sad that it gets in the way of mobile useage of gerrit. :( | 17:35 |
| morganfainberg | It jumps around randomly and you can't move it. | 17:36 |
| stevemar | dolphm, lbragstad arounds? i have fernet questions | 17:37 |
| *** diegows has joined #openstack-keystone | 17:37 | |
| morganfainberg | stevemar: dolphm won't be around. lbragstad might be. | 17:37 |
| morganfainberg | stevemar: you should just ask about fernet tokens ;) someone else may be able to answer. | 17:38 |
| stevemar | morganfainberg, i was just going to do that | 17:38 |
| stevemar | how is a single fernet token invalidated? | 17:38 |
| stevemar | and how can we invalidate the token for a specific user? | 17:40 |
| morganfainberg | stevemar: we can. You invalidate it by audit Id | 17:40 |
| morganfainberg | It's the same way we achieved parity with the TRL for revocation events for uuid/pki tokens. | 17:41 |
| morganfainberg | Usually you should not invalidate a specific token though. | 17:41 |
| *** bandwidth has joined #openstack-keystone | 17:42 | |
| morganfainberg | Invalidate for all tokens for a user is again a revocation event: user, timestamp that indicate tokens issued before are no longer valid. | 17:42 |
| bknudson | fernet doesn't support DELETE ? | 17:42 |
| morganfainberg | stevemar: then that is a bug that is a release blocker. | 17:43 |
| * morganfainberg sighs. | 17:43 | |
| morganfainberg | bknudson: ^ if that is the case | 17:43 |
| morganfainberg | Not stevemar :P | 17:43 |
| bknudson | why wouldn't it? | 17:43 |
| morganfainberg | It should! ;) | 17:43 |
| morganfainberg | As far as I know it does. | 17:44 |
| morganfainberg | But if it doesn't it would be a release blocker. | 17:44 |
| stevemar | blah, i need to read the spec more, are there any awesome docs on this? | 17:44 |
| bknudson | there should be a need for fernet to say it supports DELETE of the token. | 17:45 |
| stevemar | morganfainberg, for specs that didn't land in Kilo, do you want them in a liberty approved specs directory, or in the backlog? | 17:45 |
| bknudson | shouldn't | 17:45 |
| *** edmondsw has quit IRC | 17:45 | |
| bandwidth | I'm trying to integrate keystone (OS-FEDERATION) with Shibboleth, I have issues while trying to obtain an unscoped token (Unable to locate metadata for identity provider) | 17:46 |
| *** edmondsw has joined #openstack-keystone | 17:46 | |
| morganfainberg | bknudson: fernet should just support delete. | 17:46 |
| morganfainberg | bknudson: it's part of the provider base. | 17:46 |
| morganfainberg | bknudson: it should be specific magic to accomplish it. | 17:46 |
| bandwidth | is there any configuration samples out there that I could use? the documentation is not clear to me | 17:46 |
| morganfainberg | stevemar: we should probably backlog them. Unless we are fast approving them (see my email to the ml on opening liberty specs) | 17:47 |
| *** spandhe has joined #openstack-keystone | 17:48 | |
| * morganfainberg has to run to meeting now. | 17:48 | |
| *** ljfisher has joined #openstack-keystone | 17:48 | |
| stevemar | bandwidth, there is an awesome doc here: https://zenodo.org/record/11982/files/CERN_openlab_Luca_Tartarini.pdf | 17:49 |
| stevemar | section 4.1 talks about metadata | 17:50 |
| ayoung | delete would be handled by the revocation API, and would revoke on.... | 17:50 |
| bandwidth | stevemar: wow, thank you very much! I should have asked here before 2 days ago ;) | 17:51 |
| ayoung | audit id? | 17:51 |
| ayoung | Yeah, revoke by audit id or audit chain | 17:51 |
| ayoung | morganfainberg, pretty sure it does. Unit tests would not have run for it if it didn;t support delete | 17:52 |
| stevemar | bandwidth, never hesitate to bug the #openstack-keystone channel with questions! helping each other is why were all here | 17:52 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/revoke/core.py#n169 | 17:52 |
| morganfainberg | ayoung: exactly.which is why I said it would be a release blocker if it didn't | 17:52 |
| morganfainberg | ayoung: it wouldn't be just Fernet broken. | 17:53 |
| bandwidth | stevemar: thanks! | 17:53 |
| *** afazekas has quit IRC | 17:53 | |
| ayoung | https://twitter.com/termie/status/583059752835420160 | 17:54 |
| dstanek | still 12 bugs to go! | 17:55 |
| *** timcline has quit IRC | 17:57 | |
| stevemar | ayoung, thats a pretty good convo | 18:00 |
| ayoung | stevemar, I want to unify oauth and trusts. The | 18:01 |
| ayoung | oauth consumers can be transient users in a specific domain | 18:01 |
| ayoung | we didn't have that abstraction back then | 18:02 |
| *** diegows has quit IRC | 18:02 | |
| stevemar | ayoung, my mind is not in the right head space for delegation right now. but it could work | 18:03 |
| ayoung | stevemar, its at the tail end of the policy work "unified delegation mechanism" | 18:03 |
| stevemar | unify all the things! | 18:03 |
| ayoung | the front end of the policy work is me getting a late lunch | 18:03 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Move specs that didn't land in Kilo to the backlog https://review.openstack.org/169862 | 18:08 |
| stevemar | morganfainberg, ayoung, bknudson ^ | 18:08 |
| *** stevemar has quit IRC | 18:09 | |
| *** stevemar has joined #openstack-keystone | 18:10 | |
| *** ChanServ sets mode: +v stevemar | 18:10 | |
| raildo | stevemar, and for specs that are not yet approved? We need to change something? | 18:11 |
| ayoung | raildo, all should be submitted against backlog, not a release | 18:12 |
| raildo | ayoung,ok thanks :) | 18:12 |
| stevemar | got disconnected there for a sec | 18:13 |
| lbragstad | stevemar: whats up? | 18:13 |
| iamjarvo | hey, so when using ldap and i create a user and add a role to the user using keystone.roles.grant a record does not seem to be added in the assignment table | 18:14 |
| stevemar | iamjarvo, it should be... thats a bit weird if it doesn't | 18:15 |
| stevemar | lbragstad, had fernet questions, let me dig them up | 18:15 |
| stevemar | lbragstad, do you have any other docs for fernet? blog or otherwise? | 18:17 |
| openstackgerrit | Merged openstack/keystone-specs: Move specs that didn't land in Kilo to the backlog https://review.openstack.org/169862 | 18:21 |
| *** diegows has joined #openstack-keystone | 18:22 | |
| iamjarvo | stevemar it does! I was using it incorrectly. I do have a question though: I am running into problems with knowing when to pass in an actual object or the name or id in string format. i.e def grant(self, role, user=None, group=None, domain=None, project=None) i assumed domain should be a domain object. What's the best way to figure it out? I read the method in question but still seems vague | 18:26 |
| *** Bsony_ has joined #openstack-keystone | 18:27 | |
| *** Bsony has quit IRC | 18:27 | |
| stevemar | iamjarvo, if you're using keystoneclient then usually it's smart enough to accept both object and uuid. it should be doc'ed in the APIs, lemme pull them up | 18:28 |
| ayoung | iamjarvo, and there is no error? | 18:32 |
| iamjarvo | stevemar based on the behavior that we are seeing i think it wants "domain_id" | 18:32 |
| ayoung | ah...nevermind | 18:32 |
| iamjarvo | ayoung nope just doesnt get created | 18:32 |
| ayoung | that is not friendly | 18:32 |
| ayoung | I assume the API is supposed to return a 404 if it can't find any of the components of the assignment | 18:32 |
| *** Bsony_ has quit IRC | 18:36 | |
| lbragstad | stevemar: we have the docs that exist in the keystone code-base | 18:36 |
| lbragstad | stevemar: I think those live in configuration.rst? | 18:36 |
| iamjarvo | ayoung you are right it does give a 404 for resource not found.keystone.roles.grant(user=user, role=role, project=project) / project needs an object. keystone.roles.grant(user=user, role=role, project="admin") fails with 404 | 18:37 |
| ayoung | "You'll laugh, you'll cry, and you'll probably want to rewrite everything in Go." --termie | 18:38 |
| *** jaosorior has joined #openstack-keystone | 18:38 | |
| rodrigods | ayoung, will be there | 18:38 |
| lbragstad | stevemar: I have unofficial documentation scattered around too though | 18:39 |
| *** pnavarro|off has joined #openstack-keystone | 18:42 | |
| *** carlosmarin has quit IRC | 18:54 | |
| *** carlosmarin has joined #openstack-keystone | 18:56 | |
| ayoung | lbragstad, dolphm dstanek, we should look at what it would take to use Kite to share keys between keystone servers in a Fernet deployment | 18:59 |
| morganfainberg | ayoung: or... We give recommendations like ansible in our docs. | 19:00 |
| morganfainberg | ayoung: unless we make it so kite is independent of keystone itself (optional). I don't want keystone to be responsible to mange key distribution (built-in) | 19:01 |
| morganfainberg | Is all | 19:01 |
| morganfainberg | Even if it is via another service, the builtin part isn't what we need to be doing. | 19:02 |
| ayoung | morganfainberg, As I said, we should look into it. I think Kite will probably be a better tool for it than Ansible, and we are the Kite umbrella project, unless we are going to kill it. | 19:02 |
| *** iamjarvo has quit IRC | 19:02 | |
| morganfainberg | No Barbican is | 19:03 |
| dstanek | kite would be interesting. if someone is using it (and we can take advantage or it) it would be pretty cool to enable | 19:03 |
| morganfainberg | And kite is fine, just I want to make sure we clearly make it "not keystone" synchronizing the keys ;) | 19:03 |
| ayoung | Ah, right. OK, if its not us, we don't have to field the questions | 19:04 |
| ayoung | dstanek, yeah, Kite is actually designed for symmetric key sharing amongst groups, perfect for the Fernet use case | 19:05 |
| dstanek | i know next to nothing about it - i'll have to stand it up and poke at it | 19:05 |
| morganfainberg | ayoung: synchronizing keys and such is a good Devops problem. We can make recommendations / best practices opinions. But keystone should be just the consumer and exactly right, we don't own/lock in a single solution we have to permanently maintain. | 19:06 |
| ayoung | morganfainberg, I was thinking we owned Kite. | 19:06 |
| ayoung | It not being our problem makes me less concerned | 19:06 |
| morganfainberg | Nope. We handed off to Barbican. And afaik it died. | 19:06 |
| ayoung | I wonder if we could Use Kerberos for Key management...I'll ask Simo. | 19:07 |
| morganfainberg | Since no one was using it / wanted to. | 19:07 |
| *** tellesnobrega_ has joined #openstack-keystone | 19:07 | |
| bknudson | kite was requested for securing the message bus... did that whole project go away? | 19:08 |
| *** tellesnobrega_ has quit IRC | 19:08 | |
| morganfainberg | bknudson: afaik yes. | 19:08 |
| bknudson | there's no way to secure the message bus? | 19:08 |
| morganfainberg | That initiative didn't go anywhere last I saw. | 19:08 |
| *** pnavarro|off has quit IRC | 19:10 | |
| lhcheng | lbragstad: qq, fernet tokens is also available for keystone v2? | 19:10 |
| lbragstad | lhcheng: yep | 19:10 |
| *** lifeless has quit IRC | 19:11 | |
| lhcheng | lbragstad: cool. I am a bit late, going to try it out. Thanks! | 19:12 |
| lbragstad | lhcheng: no problem | 19:12 |
| *** iamjarvo has joined #openstack-keystone | 19:12 | |
| *** iamjarvo has quit IRC | 19:12 | |
| *** iamjarvo has joined #openstack-keystone | 19:13 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 19:16 |
| *** rushiagr is now known as rushiagr_away | 19:21 | |
| lbragstad | so if you decide that you only need to rotate every 3 hours, it changes from 1440 / 180 = 8 | 19:21 |
| *** jbonjean has quit IRC | 19:24 | |
| ayoung | So, the message bus itself can be secured, but the issue is that the messages themselves are not signed. I don't know if Rabbit Supports TLS, but I would assume it does...me goes to check, and then I have a surprise... | 19:25 |
| ayoung | https://www.rabbitmq.com/ssl.html | 19:25 |
| ayoung | We are also looking into SASL support for Rabbit. No promises, but we might be able to do something to integrate Rabbit with Kerberos. | 19:25 |
| ayoung | https://www.rabbitmq.com/ssl.html | 19:26 |
| *** jbonjean has joined #openstack-keystone | 19:28 | |
| edmondsw | besides signing, it would be nice for the message bus traffic to be encrypted in a way that rabbit can't decrypt and therefore can't log, etc. | 19:30 |
| edmondsw | if kite really has gone away, that's very disappointing | 19:31 |
| ayoung | edmondsw, nah, it is just resting. | 19:37 |
| ayoung | Its all shagged out from a prolonged squawk | 19:37 |
| *** lifeless has joined #openstack-keystone | 19:40 | |
| *** htruta has quit IRC | 19:40 | |
| *** obedmr has joined #openstack-keystone | 19:43 | |
| *** rm_work is now known as rm_work|away | 19:43 | |
| obedmr | hi all, I'm getting a SSL exception when connecting to a (SSL enabled keystone), I'm posting some details here http://paste.openstack.org/show/197820/ ; thanks for your help. | 19:43 |
| ayoung | obedmr, what error? | 19:44 |
| obedmr | hi ayoung: it's not giving so much details, even when I enabled the debug mode | 19:44 |
| ayoung | obedmr, can you hit the Keystone server from CURL or a web browser? | 19:45 |
| ayoung | If the issue is SSL, it is probably going to show up in any web request | 19:45 |
| ayoung | obedmr, running in HTTPD or Eventlet? | 19:45 |
| obedmr | ayoung: it's running with Eventlet | 19:46 |
| ayoung | USe HTTPD for SSL | 19:46 |
| obedmr | ayoung: is there any documentation for doing it with HTTPD? | 19:47 |
| ayoung | Its the default now. | 19:47 |
| ayoung | obedmr, this a new install? | 19:47 |
| obedmr | yes | 19:47 |
| ayoung | RDO? | 19:47 |
| ayoung | How are youn installing/running? | 19:48 |
| obedmr | I'm installing it in CentOS 7.0, using vagrant | 19:48 |
| ayoung | I know nothing of Vagrant | 19:49 |
| obedmr | well, basically it's hosted in VirtualBox VMs | 19:49 |
| ayoung | obedmr, using the RDO packages or straight from repos or what does it do? | 19:50 |
| ayoung | Ah, precanned VMs with Keystone in them? | 19:50 |
| obedmr | I followed the Offical documentation from docs.openstack, step by step | 19:50 |
| obedmr | the Installagion guide for Red Hat, CentOS, etc | 19:51 |
| ayoung | obedmr, ok, so running in HTTPD is pretty straight forward, but I always do it by hand... | 19:51 |
| ayoung | you can look at what Devstack does. | 19:51 |
| iamjarvo | I am wondering why this domain isn't being found http://pastie.org/private/bx1qdhgsh6gxf8mvdhxpg i am thinking it might be the ldap setup | 19:52 |
| ayoung | I'm, sure there are instructions somewhere, too | 19:52 |
| ayoung | iamjarvo, LDAP identity? Doesn't support multiple domains. So I assumme SQL identity, domain specific backned? | 19:52 |
| iamjarvo | ayoung but its aware if you do the conf file for each domain | 19:53 |
| ayoung | that sounds right | 19:53 |
| ayoung | but it should be able to find the domain...maybe giev an error if the config is bad | 19:53 |
| *** bandwidth has quit IRC | 19:55 | |
| * obedmr taking a look on devstack's ssl configuration | 19:55 | |
| edmondsw | obedmr, this doesn't look terribly complete but it's a start: http://docs.openstack.org/developer/keystone/apache-httpd.html | 19:57 |
| ayoung | obedmr, if you run devstack, it sets up Keystone in HTTPD. You can then copy over the config files etc. to your new setup if you want. | 19:57 |
| iamjarvo | ayoung are you saying we should write code to error if the config is bad? | 19:58 |
| ayoung | iamjarvo, try using the domain id | 19:58 |
| ayoung | I think name doesn;t work, as it has to go and do the name to id lookup.... | 19:58 |
| ayoung | domain is eithe a domain object or a domain id | 19:58 |
| obedmr | ok, excellent, thanks edmondsw and ayoung | 19:58 |
| ayoung | so if you do the find first, you can pass the result into the keystone.roles.grant(role, user=admin, domain=domdahdomdom) | 19:59 |
| ayoung | edmondsw, Oh, sure, if you want to do it the easy way! | 19:59 |
| obedmr | edmondsw: ayoung: just a final question, the best practice for SSL in keystone is to use HTTPD as the front? | 19:59 |
| edmondsw | obedmr, definitely yes | 20:00 |
| obedmr | cool | 20:00 |
| ayoung | obedmr, drop the SSL, and the statment holds true | 20:00 |
| edmondsw | lol | 20:00 |
| ayoung | the best practice for Keystone is to use HTTPD. SSL doubly so | 20:00 |
| stevemar | ayoung, we should probably not support deployments that don't use ssl, but it makes testing much easier | 20:01 |
| obedmr | excellent, thanks guys, I really apreciate the help | 20:01 |
| ayoung | edmondsw, In general, you don't want to do cryptography in python, but rather use native libraries. Eventlet, being single theaded, has no way to scale out an SSL traffic | 20:01 |
| edmondsw | ayoung, oh, I don't disagree with you at all | 20:02 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Creating domain and filtering by parent_id https://review.openstack.org/161378 | 20:05 |
| *** lastops has quit IRC | 20:15 | |
| *** pnavarro|off has joined #openstack-keystone | 20:24 | |
| *** mattfarina has quit IRC | 20:37 | |
| *** ljfisher has quit IRC | 20:38 | |
| *** rm_work|away is now known as rm_work | 20:47 | |
| *** rm_work is now known as rm_work|away | 20:53 | |
| iamjarvo | ayoung domain id worked. i was passing in name instead of id | 20:53 |
| ayoung | told you so! | 20:53 |
| ayoung | iamjarvo, I expect you to field this question here in IRC next time someone asks | 20:54 |
| iamjarvo | i will! | 20:54 |
| iamjarvo | learning lots | 20:54 |
| iamjarvo | back the drawing board though :( "Error getting domain scoped token." | 20:55 |
| iamjarvo | lol | 20:55 |
| ayoung | iamjarvo, are you trying to get a domain scoped token? | 20:58 |
| ayoung | and , if so, how? | 20:59 |
| iamjarvo | i am trying to login using the users ive created | 20:59 |
| *** samueldmq has quit IRC | 20:59 | |
| *** samueldmq has joined #openstack-keystone | 21:00 | |
| ayoung | iamjarvo, Horizon? | 21:04 |
| iamjarvo | yea | 21:04 |
| ayoung | iamjarvo, Horizon knows nothing about domain scoped tokens. | 21:04 |
| iamjarvo | using this patch | 21:07 |
| iamjarvo | https://review.openstack.org/#/c/148082/ | 21:08 |
| *** devlaps1 has joined #openstack-keystone | 21:10 | |
| *** devlaps has quit IRC | 21:10 | |
| *** diegows has quit IRC | 21:10 | |
| *** nkinder has quit IRC | 21:11 | |
| *** jaosorior has quit IRC | 21:12 | |
| *** _cjones_ has quit IRC | 21:14 | |
| dstanek | what exactly is happening in the ssl 2way tests? | 21:16 |
| *** pnavarro|off has quit IRC | 21:18 | |
| *** dims_ has quit IRC | 21:19 | |
| *** htruta has joined #openstack-keystone | 21:19 | |
| *** htruta has quit IRC | 21:20 | |
| *** _cjones_ has joined #openstack-keystone | 21:20 | |
| *** boris-42 has quit IRC | 21:28 | |
| *** edmondsw has quit IRC | 21:29 | |
| bknudson | dstanek: it should be testing that the eventlet server can be configured to require a client cert. | 21:34 |
| *** edmondsw has joined #openstack-keystone | 21:35 | |
| dstanek | bknudson: i'm trying to debug an issue on debian where that's not working | 21:43 |
| bknudson | dstanek: are the certificates invalid? | 21:43 |
| dstanek | they are the ones we bundle with our tests | 21:44 |
| dstanek | examples/pki/... | 21:44 |
| bknudson | dstanek: are you able to recreate the issue? | 21:44 |
| dstanek | the 1way tests pass, but the 2way are not happy | 21:44 |
| dstanek | yes | 21:44 |
| bknudson | dstanek: try recreating the sample certs | 21:45 |
| dstanek | already did that and still have the issue | 21:45 |
| bknudson | so client authenticatoin doesn't work on debian? | 21:46 |
| dstanek | maybe not - i'm creating a more bare bones test case now | 21:46 |
| bknudson | what's the error? | 21:48 |
| dstanek | http://paste.openstack.org/show/197837/ | 21:48 |
| bknudson | didn't like the client certificate | 21:49 |
| bknudson | but that's test_1way_ssl_ok | 21:49 |
| bknudson | I thought you were looking at 2way? | 21:49 |
| dstanek | hmmm...maybe i just broke that too | 21:49 |
| bknudson | if it's 1-way then that's the client didn't like the server cert. | 21:49 |
| dstanek | maybe out cert gen is just broken now that debian has been fixing up the SSL issues | 21:50 |
| *** stevemar has quit IRC | 21:52 | |
| *** bknudson has quit IRC | 21:54 | |
| *** iamjarvo has quit IRC | 21:56 | |
| *** boris-42 has joined #openstack-keystone | 21:57 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:01 | |
| *** ekarlso has quit IRC | 22:04 | |
| *** ekarlso has joined #openstack-keystone | 22:04 | |
| *** iamjarvo has joined #openstack-keystone | 22:05 | |
| *** iamjarvo has quit IRC | 22:05 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 22:08 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 22:12 |
| ayoung | morganfainberg, time to make V3 Identiyt API the default in devstack | 22:17 |
| morganfainberg | ayoung, didn't we already do that? | 22:17 |
| morganfainberg | or you mean in horizon? | 22:17 |
| ayoung | morganfainberg, not in the env var set when you connect | 22:17 |
| morganfainberg | afaik middleware defaults to v3 unless someone does something silly. | 22:17 |
| morganfainberg | oh | 22:18 |
| morganfainberg | that part | 22:18 |
| morganfainberg | sure | 22:18 |
| morganfainberg | ++ | 22:18 |
| morganfainberg | yes! | 22:18 |
| morganfainberg | :) | 22:18 |
| ayoung | $ echo $OS_AUTH_URL | 22:18 |
| ayoung | http://192.168.1.67:5000/v2.0 | 22:18 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 22:18 |
| * morganfainberg wonders what will break. | 22:18 | |
| ayoung | $ echo $OS_IDENTITY_API_VERSION | 22:19 |
| ayoung | 2.0 | 22:19 |
| *** henrynash has joined #openstack-keystone | 22:22 | |
| *** ChanServ sets mode: +v henrynash | 22:22 | |
| *** gordc has quit IRC | 22:25 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 22:25 |
| henrynash | morganfainberg: the patch for domain-config has been updated as we discussed: https://review.openstack.org/#/c/163322/ | 22:25 |
| morganfainberg | henrynash, thanks | 22:25 |
| morganfainberg | oh look clippy | 22:25 |
| morganfainberg | too bad this didn't land: https://review.openstack.org/#/c/169509/3/modules/openstack_project/files/gerrit/GerritSiteHeader.html | 22:26 |
| *** rhagarty_ has joined #openstack-keystone | 22:26 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 22:29 |
| *** nkinder has joined #openstack-keystone | 22:34 | |
| rhagarty_ | hello - I'm new to keystone. Was wondering if there is a way to simply store and retrieve a user/pwd from the keystone service? | 22:39 |
| *** henrynash has quit IRC | 22:42 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 22:43 |
| *** carlosmarin has quit IRC | 22:56 | |
| *** bknudson has joined #openstack-keystone | 23:06 | |
| *** ChanServ sets mode: +v bknudson | 23:06 | |
| *** chlong has joined #openstack-keystone | 23:07 | |
| morganfainberg | ayoung, bknudson, dstanek, jamielennox, could use eyes on https://review.openstack.org/#/c/163322/ | 23:07 |
| * bknudson can't wait until clippy goes away. | 23:08 | |
| morganfainberg | bknudson, you could just adblock the .js out | 23:09 |
| morganfainberg | bknudson, and it wont load anymore | 23:09 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Increase minimum token life required https://review.openstack.org/169947 | 23:18 |
| *** joesavak has quit IRC | 23:21 | |
| *** packet has quit IRC | 23:24 | |
| *** harlowja has quit IRC | 23:31 | |
| *** harlowja has joined #openstack-keystone | 23:32 | |
| *** devlaps1 has quit IRC | 23:37 | |
| *** zzzeek has quit IRC | 23:43 | |
| *** harlowja has quit IRC | 23:49 | |
| *** harlowja has joined #openstack-keystone | 23:50 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!