| *** amerine has quit IRC | 00:02 | |
| *** _cjones_ has quit IRC | 00:11 | |
| jamielennox | morganfainberg, or anyone else: ksc-saml or ksc-saml2 | 00:15 |
|---|---|---|
| morganfainberg | lhcheng, that direct map one is not worth the headache for rc | 00:16 |
| morganfainberg | jamielennox, we have that? | 00:17 |
| jamielennox | morganfainberg: no, we were going to rename ksc-federation | 00:18 |
| morganfainberg | oh sure | 00:18 |
| morganfainberg | uhm call it saml2 | 00:18 |
| jamielennox | ok | 00:18 |
| morganfainberg | we don't support non-saml2 things | 00:18 |
| morganfainberg | and saml3 may be totally different | 00:18 |
| jamielennox | god forbid | 00:19 |
| *** r-daneel has quit IRC | 00:24 | |
| *** browne has quit IRC | 00:29 | |
| *** dims_ has joined #openstack-keystone | 00:35 | |
| *** dims has quit IRC | 00:36 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Stops injecting revoke_api into TestCase https://review.openstack.org/163008 | 00:40 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient-federation: Rename project to keystoneclient-saml2 https://review.openstack.org/173628 | 00:47 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes an unused tox environment https://review.openstack.org/173631 | 00:47 |
| *** leonchio_ has quit IRC | 00:47 | |
| openstackgerrit | Merged openstack/keystone: Redundant events on group grant revocation https://review.openstack.org/171305 | 00:48 |
| jlk | morganfainberg: hi there.... so I think I'm running into haproxy problems with saml2 stuffs. | 00:49 |
| jlk | specifically: | 00:49 |
| jlk | 015-04-07 06:50:07 ERROR OpenSAML.MessageDecoder.SAML2ECP [5]: PAOS response targeted at (https://bbg-staging-01.openstack.blueboxgrid.com:5001/Shibboleth.sso/SAML2/ECP), but delivered to (http://bbg-staging-01.openstack.blueboxgrid.com:5001/Shibboleth.sso/SAML2/ECP) | 00:49 |
| morganfainberg | gyee, stevemar, ^ cc | 00:49 |
| jlk | I think this is because haproxy terminates the ssl, and passes off to the backend via http | 00:49 |
| morganfainberg | yeah | 00:49 |
| morganfainberg | gyee, ^ what did we do to address that? | 00:50 |
| jlk | I do have: reqadd X-Forwarded-Proto:\ https | 00:50 |
| jlk | but that's obv not enough | 00:50 |
| morganfainberg | you might be able to get away with [if the target] was the HTTP | 00:51 |
| morganfainberg | instead of the https | 00:51 |
| morganfainberg | and you just hit https, which then pushes it down to the http | 00:51 |
| jlk | except that our proxy isn't listening to the http port :/ | 00:51 |
| morganfainberg | there is a way to reverse proxy shib | 00:51 |
| morganfainberg | jlk, https://wiki.shibboleth.net/confluence/display/SHIB2/SPReverseProxy | 00:52 |
| *** jeffDeville has joined #openstack-keystone | 00:52 | |
| * morganfainberg is reading this page | 00:52 | |
| morganfainberg | so no idea if it's helpful yet, just figured i'd point you to what i was looking at | 00:52 |
| morganfainberg | so first is: With SSL offloaded to the proxy, also set handlerSSL="false" in shibboleth2.xml, so the Shibboleth handler will accept protocol messages on plain HTTP. | 00:54 |
| jlk | yeah I'm reading. | 00:55 |
| jlk | that's already set to false | 00:55 |
| morganfainberg | because HAProxy isn't *really* a reverse proxy it looks like | 00:56 |
| morganfainberg | in your config you're using it as a load balancer, right? | 00:56 |
| jlk | maybe ServerName | 00:57 |
| morganfainberg | that might be it. | 00:57 |
| jlk | yeah it's load balancing and ssl offloading | 00:57 |
| morganfainberg | jlk, https://lists.internet2.edu/sympa/arc/shibboleth-users/2011-01/msg00420.html looks like *exactly* what we're doing here | 00:58 |
| morganfainberg | result thread: | 00:59 |
| morganfainberg | Yes sir! my virtual hosts were not correctly configured with the https | 00:59 |
| morganfainberg | scheme. Problem solved: | 00:59 |
| morganfainberg | ServerName https://MyApplication.com | 00:59 |
| morganfainberg | UseCanonicalName On | 00:59 |
| jlk | giving that a go | 01:00 |
| *** tqtran has joined #openstack-keystone | 01:01 | |
| jlk | well, new error message now, to be tackled tomorrow | 01:02 |
| jlk | 2015-04-07 06:50:13 ERROR OpenSAML.SecurityPolicyRule.MessageFlow [7]: replay detected of message ID (82bd889fae7a485eb1ce574037f1ba01) | 01:02 |
| morganfainberg | i'm guessing that is detecting re-use of the assertion | 01:02 |
| jlk | morganfainberg: thanks so far, I think that got me farther. | 01:02 |
| gyee | jlk, make sure you set session affinity at haproxy | 01:02 |
| jlk | gyee: it is set | 01:02 |
| gyee | the request url has to match the sp url | 01:02 |
| gyee | make sure the protocol is set to https | 01:03 |
| jamielennox | morganfainberg: be good to get ptl +1 on https://review.openstack.org/#/c/173619/ | 01:05 |
| morganfainberg | jamielennox, done | 01:06 |
| *** jeffDeville has quit IRC | 01:07 | |
| *** ayoung has joined #openstack-keystone | 01:09 | |
| *** ChanServ sets mode: +v ayoung | 01:09 | |
| morganfainberg | jlk: https://bugzilla.mozilla.org/show_bug.cgi?id=667429 | 01:09 |
| openstack | Mozilla bug 667429 in Networking: HTTP "Shibboleth Replay Detection Failure" [Normal,Resolved: invalid] - Assigned to nobody | 01:10 |
| morganfainberg | oh neato | 01:10 |
| morganfainberg | openstack knows how to talk to mozila bugtracker | 01:10 |
| * morganfainberg did not intend that when configuring it btw. | 01:10 | |
| ayoung | morganfainberg, I'm guessing it is a standard bot that parses the name bugzilla | 01:10 |
| ayoung | let's seee... | 01:10 |
| ayoung | https://bugzilla.younglogic.net/show_bug.cgi?id=667429 | 01:11 |
| morganfainberg | ayoung, no mozilla's is part of the base config | 01:11 |
| * morganfainberg did the puppet work (or parts of it) to enable that feature | 01:11 | |
| gyee | problem is shibboleth validates binding after the policy | 01:11 |
| gyee | and the shit is hardcoded | 01:12 |
| gyee | binding should be part of policy | 01:12 |
| *** lhcheng has quit IRC | 01:12 | |
| *** jeffDeville has joined #openstack-keystone | 01:12 | |
| gyee | morganfainberg, https://code.google.com/p/websso/source/browse/Cpp-cs/depends/cpp-opensaml2/saml/saml2/binding/impl/SAML2ECPDecoder.cpp | 01:13 |
| gyee | line 125 | 01:13 |
| gyee | policy is validated on line 114 | 01:14 |
| gyee | binding validation should be dictated by policy | 01:14 |
| *** sdake_ has joined #openstack-keystone | 01:17 | |
| morganfainberg | w.t.f. | 01:20 |
| morganfainberg | that is dumb | 01:20 |
| *** sdake has quit IRC | 01:21 | |
| *** alexsyip has quit IRC | 01:23 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Prompt for password on CLI if not provided https://review.openstack.org/173605 | 01:23 |
| *** tqtran has quit IRC | 01:23 | |
| morganfainberg | gyee, at least that is a known "why" | 01:24 |
| *** davechen has joined #openstack-keystone | 01:27 | |
| gyee | morganfainberg, yet, so haproxy to keystone has to be the same protocol to preserve the request url | 01:30 |
| gyee | to get around the binding validation | 01:30 |
| *** davechen1 has joined #openstack-keystone | 01:34 | |
| *** davechen has quit IRC | 01:36 | |
| *** vilobhmm1 has quit IRC | 01:37 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Provide a means to get all installed plugins https://review.openstack.org/156466 | 01:38 |
| gyee | jlk, make sure X-Forwarded-Proto is set to https | 01:41 |
| morganfainberg | gyee, laaaaaaaaaaaaame | 01:41 |
| gyee | heh | 01:42 |
| morganfainberg | isn't what "handlerSSL="false" in shibboleth2.xml" is meant for? | 01:44 |
| morganfainberg | or is that only solving 50% of it | 01:44 |
| *** davechen has joined #openstack-keystone | 01:45 | |
| gyee | won't solve it, they have to make binding validation as part of policy | 01:45 |
| gyee | that's the right way to do it I think | 01:45 |
| morganfainberg | xtra lame | 01:46 |
| gyee | can you imaging part of your authorization is coming from policy while other part comes from the code? | 01:46 |
| morganfainberg | sure i can. | 01:46 |
| gyee | that's major suckage | 01:46 |
| * morganfainberg looks at keystone | 01:46 | |
| *** davechen1 has quit IRC | 01:46 | |
| * morganfainberg looks at shibboleth | 01:46 | |
| morganfainberg | don't have to look that far | 01:46 |
| gyee | hahaha | 01:46 |
| morganfainberg | :P | 01:46 |
| gyee | the security auditors are going to hate us | 01:47 |
| *** jeffDeville has quit IRC | 01:47 | |
| gyee | like what? you have to make us read the code to find out what's going on?!!! | 01:47 |
| morganfainberg | we are doing better | 01:47 |
| morganfainberg | but... | 01:47 |
| morganfainberg | uh. yeah | 01:48 |
| morganfainberg | :P | 01:48 |
| *** jeffDeville has joined #openstack-keystone | 01:48 | |
| *** erkules has quit IRC | 01:48 | |
| *** erkules_ has joined #openstack-keystone | 01:48 | |
| * gyee is imaging the congress people going over the code | 01:49 | |
| *** sdake has joined #openstack-keystone | 01:52 | |
| openstackgerrit | Nathan Kinder proposed openstack/keystone: Fix incorrect setting in WebSSO documentation https://review.openstack.org/173643 | 01:53 |
| *** davechen1 has joined #openstack-keystone | 01:55 | |
| *** davechen has quit IRC | 01:55 | |
| *** sdake_ has quit IRC | 01:56 | |
| *** jeffDeville has quit IRC | 01:56 | |
| *** gyee has quit IRC | 02:02 | |
| jlk | gyee: morganfainberg: wait, I'm confused. I already have X-Forwarded-Proto set to https | 02:03 |
| *** harlowja is now known as harlowja_away | 02:17 | |
| *** dims_ has quit IRC | 02:21 | |
| openstackgerrit | Kun Huang proposed openstack/python-keystoneclient: Use "RegionOne" as default region https://review.openstack.org/173165 | 02:22 |
| *** vilobhmm1 has joined #openstack-keystone | 02:28 | |
| *** browne has joined #openstack-keystone | 02:32 | |
| *** Ephur has quit IRC | 02:46 | |
| stevemar | gyee, morganfainberg what is this going on about shib? | 02:48 |
| morganfainberg | stevemar, issues with haproxy + shibboleth | 02:56 |
| *** richm has quit IRC | 03:33 | |
| ayoung | stevemar, https://bugs.launchpad.net/django-openstack-auth/+bug/1444244 might bite you in a deployment | 03:34 |
| openstack | Launchpad bug 1444244 in django-openstack-auth "websso does not prepend WEBROOT to redirect URL" [Undecided,New] | 03:34 |
| ayoung | looks like an easyish fix | 03:35 |
| *** ashleighfarnham has joined #openstack-keystone | 03:37 | |
| stevemar | ayoung, i was hoping to improve the way we validate the hostname on the keystone side | 03:49 |
| ayoung | stevemar, Meh | 03:50 |
| ayoung | I think strict is fine there | 03:50 |
| ayoung | OK...going to bed. Need to test this out tomorrow | 03:51 |
| *** ayoung is now known as ayoung_ZZZzzz | 03:52 | |
| *** ashleighfarnham has quit IRC | 03:56 | |
| *** stevemar has quit IRC | 04:01 | |
| *** ashleighfarnham has joined #openstack-keystone | 04:04 | |
| *** sdake has quit IRC | 04:11 | |
| *** ashleighfarnham has quit IRC | 04:13 | |
| *** rushiagr_away is now known as rushiagr | 04:36 | |
| *** rushiagr is now known as rushiagr_away | 04:38 | |
| *** rushiagr_away is now known as rushiagr | 04:38 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow saving and caching the plugin auth state https://review.openstack.org/149175 | 04:43 |
| *** lhcheng has joined #openstack-keystone | 04:50 | |
| *** ChanServ sets mode: +v lhcheng | 04:50 | |
| *** stevemar has joined #openstack-keystone | 04:55 | |
| *** ChanServ sets mode: +v stevemar | 04:55 | |
| *** ajayaa has joined #openstack-keystone | 05:14 | |
| openstackgerrit | Merged openstack/keystone: Fix incorrect setting in WebSSO documentation https://review.openstack.org/173643 | 05:21 |
| *** lhcheng has quit IRC | 05:57 | |
| *** lhcheng has joined #openstack-keystone | 05:58 | |
| *** ChanServ sets mode: +v lhcheng | 05:58 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/172624 | 06:05 |
| *** ajayaa has quit IRC | 06:07 | |
| *** browne has quit IRC | 06:09 | |
| *** henrynash has joined #openstack-keystone | 06:10 | |
| *** ChanServ sets mode: +v henrynash | 06:10 | |
| *** stevemar has quit IRC | 06:15 | |
| *** henrynash has quit IRC | 06:15 | |
| *** alex_xu has quit IRC | 06:18 | |
| *** ajayaa has joined #openstack-keystone | 06:24 | |
| *** alex_xu has joined #openstack-keystone | 06:30 | |
| *** kiran has joined #openstack-keystone | 06:33 | |
| *** kiran is now known as kiran-r | 06:33 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove assigned protocol before removing IdP https://review.openstack.org/173696 | 06:38 |
| *** lhcheng has quit IRC | 06:39 | |
| *** lhcheng has joined #openstack-keystone | 06:41 | |
| *** ChanServ sets mode: +v lhcheng | 06:41 | |
| *** vilobhmm1 has quit IRC | 06:49 | |
| *** henrynash has joined #openstack-keystone | 07:02 | |
| *** ChanServ sets mode: +v henrynash | 07:02 | |
| *** henrynash has quit IRC | 07:02 | |
| *** rwsu has quit IRC | 07:09 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Make get_trust a protected method https://review.openstack.org/172620 | 07:10 |
| *** mabrams has joined #openstack-keystone | 07:12 | |
| *** pnavarro has joined #openstack-keystone | 07:20 | |
| *** jistr has joined #openstack-keystone | 07:24 | |
| *** krykowski has joined #openstack-keystone | 07:33 | |
| *** chlong has quit IRC | 07:35 | |
| *** c0m0 has joined #openstack-keystone | 07:42 | |
| *** fhubik has joined #openstack-keystone | 07:47 | |
| *** jaosorior has joined #openstack-keystone | 07:49 | |
| *** rushiagr is now known as rushiagr_away | 07:49 | |
| *** rushiagr_away is now known as rushiagr | 08:01 | |
| *** viktors has joined #openstack-keystone | 08:25 | |
| viktors | hi folks! Can someone approve patch with two +2 - https://review.openstack.org/#/c/137637/ (Fix index name the assignment.actor_id table) ? Thanks! | 08:28 |
| *** davechen1 has left #openstack-keystone | 08:47 | |
| *** lhcheng has quit IRC | 09:00 | |
| *** lhcheng has joined #openstack-keystone | 09:02 | |
| *** ChanServ sets mode: +v lhcheng | 09:02 | |
| *** sdake has joined #openstack-keystone | 09:10 | |
| *** jamie_h has joined #openstack-keystone | 09:12 | |
| jamie_h | are there any fixture files that can be run to set up keystone with an initial data set of users, projects, etc.? | 09:13 |
| *** lhcheng has quit IRC | 09:18 | |
| *** fhubik is now known as fhubik_afk | 09:21 | |
| *** fhubik_afk is now known as fhubik | 09:30 | |
| *** jeffDeville has joined #openstack-keystone | 09:30 | |
| *** fhubik is now known as fhubik_afk | 09:45 | |
| *** jamielennox is now known as jamielennox|away | 09:52 | |
| *** fhubik_afk is now known as fhubik | 10:03 | |
| *** jeffDeville has quit IRC | 10:20 | |
| *** ParsectiX has joined #openstack-keystone | 10:33 | |
| *** topol has joined #openstack-keystone | 10:40 | |
| *** ChanServ sets mode: +v topol | 10:40 | |
| *** sdake has quit IRC | 10:46 | |
| samueldmq | morning | 10:51 |
| *** fhubik has quit IRC | 10:53 | |
| *** fhubik has joined #openstack-keystone | 10:54 | |
| *** mattfarina has joined #openstack-keystone | 10:58 | |
| *** mattfarina has quit IRC | 11:04 | |
| *** dims has joined #openstack-keystone | 11:08 | |
| *** mattfarina has joined #openstack-keystone | 11:11 | |
| breton | heya | 11:11 |
| samueldmq | breton, hello | 11:14 |
| samueldmq | :) | 11:14 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 11:23 |
| *** jdennis has quit IRC | 11:36 | |
| *** fhubik is now known as fhubik_afk | 11:47 | |
| *** jsheeren has joined #openstack-keystone | 11:47 | |
| jsheeren | good afternoon! | 11:48 |
| jsheeren | i have a small question concerning keystone and the apache wsgi script | 11:48 |
| jsheeren | when i run the keystone python client outside of apache, i get the results i asked for | 11:48 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Adds inherited column to RoleAssignment PK https://review.openstack.org/142472 | 11:49 |
| jsheeren | when i configure it in an apache vhost, with the wsgi script i get following error: Target WSGI script '/var/www/cgi-bin/keystone/main' cannot be loaded as Python module. ImportError: cannot import name messaging | 11:49 |
| jsheeren | I'm running Ubuntu server 14.04 and have installed all necessary packages .. including oslo.messaging: ii python-oslo.messaging 1.4.1-0ubuntu1~cloud0 all oslo messaging library | 11:50 |
| jsheeren | anyone have an idea i which direction i should look? | 11:50 |
| *** aix has quit IRC | 11:50 | |
| jsheeren | i should mention i'm installing openstack juno | 11:51 |
| jsheeren | following http://docs.openstack.org/juno/install-guide/install/apt/content/index.html | 11:51 |
| samueldmq | jsheeren, hi, thanks for coming to ask in our community | 11:52 |
| samueldmq | jsheeren, I think you will find most of people up in ~2 - 3 hours | 11:52 |
| samueldmq | jsheeren, unfortunately I don't have enough deployment experience to help you out :) | 11:53 |
| samueldmq | :/ | 11:53 |
| jsheeren | samueldmq: hi, thanks, i'll ask again in a few hours. i can continue without the keystone/httpd stuff | 11:53 |
| samueldmq | jsheeren, great | 11:53 |
| jsheeren | samueldmq: thanks for your answer! see you in a few hours | 11:54 |
| samueldmq | jsheeren, no problem | 11:55 |
| samueldmq | dolphm, ping - you up to talk about the placeholders on migrations ? | 11:57 |
| *** mabrams has left #openstack-keystone | 12:02 | |
| *** arif-ali has quit IRC | 12:05 | |
| *** raildo has joined #openstack-keystone | 12:06 | |
| *** arif-ali has joined #openstack-keystone | 12:12 | |
| *** fhubik_afk is now known as fhubik | 12:17 | |
| *** fhubik has quit IRC | 12:25 | |
| *** fhubik has joined #openstack-keystone | 12:26 | |
| *** aix has joined #openstack-keystone | 12:28 | |
| *** bknudson has joined #openstack-keystone | 12:30 | |
| *** ChanServ sets mode: +v bknudson | 12:30 | |
| dstanek | samueldmq: do you need to use one? | 12:33 |
| *** gordc has joined #openstack-keystone | 12:34 | |
| *** henrynash has joined #openstack-keystone | 12:40 | |
| *** ChanServ sets mode: +v henrynash | 12:40 | |
| *** jdennis has joined #openstack-keystone | 12:51 | |
| *** jeffDeville has joined #openstack-keystone | 12:52 | |
| *** ayoung_ZZZzzz is now known as ayoung | 13:06 | |
| *** mattfarina has quit IRC | 13:06 | |
| samueldmq | dstanek, sorry was afk (daily meeting :)) | 13:08 |
| samueldmq | dstanek, yeah, basically I need to use one | 13:08 |
| *** mattfarina has joined #openstack-keystone | 13:08 | |
| samueldmq | dstanek, but I think we had better options than putting placeholder files | 13:09 |
| samueldmq | dstanek, and would like to discuss about :-) | 13:09 |
| samueldmq | dstanek, you available for a quick discussion ? (yeah, I hope it's quick) | 13:10 |
| *** dims has quit IRC | 13:13 | |
| *** fhubik is now known as fhubik_afk | 13:14 | |
| samueldmq | basically, if we left none instead of placeholders would avoid to have duplicated migrations | 13:14 |
| *** dims has joined #openstack-keystone | 13:15 | |
| samueldmq | in my case, I am writing 072, and we will need to backport it as 068, and then cherry-pick, right? | 13:15 |
| samueldmq | if we hadn't created 068_placeholder, I just needed to write 068 on master and then backport | 13:16 |
| *** fhubik_afk is now known as fhubik | 13:16 | |
| samueldmq | Q: but how to leave those hold those places (68-72) ? | 13:16 |
| samueldmq | A: we add a test that fails if them exist, so we make sure we really want to add such migrations when we do | 13:17 |
| samueldmq | bknudson, morning, you might be interested on this as well ^ | 13:17 |
| *** topol has quit IRC | 13:20 | |
| *** richm has joined #openstack-keystone | 13:21 | |
| dstanek | samueldmq: i think the problem is that it won't be picked up because we will be past that number | 13:23 |
| dstanek | samueldmq: the migration systems i have worked on in the past only keep track of what they have migrated to and not each individual migration | 13:23 |
| *** david-lyle has quit IRC | 13:24 | |
| breton | I don't quite understand what's the problem now | 13:24 |
| samueldmq | dstanek, so we store the number of the latest version we have migrated, instead of a list of migrated versions | 13:24 |
| breton | sa-m stores the last applied migration | 13:25 |
| samueldmq | breton, hi, do you know what those 068-072 placeholders are for ? | 13:25 |
| samueldmq | dstanek, ^ yeah so it will not work like I described :/ | 13:25 |
| dstanek | samueldmq: right - dolphm post describes it pretty well | 13:26 |
| dstanek | samueldmq: does that make sense? | 13:27 |
| *** joesavak has joined #openstack-keystone | 13:28 | |
| dstanek | in stable they will not have had place holders applied so we can add them later | 13:28 |
| breton | http://dolphm.com/backporting-openstack-database-migrations-to-stable-branches/ , right? | 13:28 |
| dstanek | on master we will go passed the placeholders so the migration will need to be applied twice | 13:28 |
| dstanek | breton: yes | 13:28 |
| breton | samueldmq: "Deployments hopping between stable/* branches" part describes your concernes, doesn't it? :) | 13:28 |
| dstanek | samueldmq: the thing you may be thinking is why not just merge the commit with the migration into stable and not use a placeholder... | 13:29 |
| samueldmq | dstanek, yeah, that's what I was saying | 13:29 |
| dstanek | but if you do that for say 072 and later you find out you need to also merge 068, then you are in trouble since the system thinks it has already migrated to 072 - the older migrations will not be applied | 13:30 |
| *** r-daneel has joined #openstack-keystone | 13:31 | |
| samueldmq | dstanek, but you shouldnt need to migrate 068 right? since the placeholders are only for backports, which are meant to be idempotent | 13:31 |
| dstanek | samueldmq: no i'm saying if you didn't do placeholders you would run into the problem i described above - merging things out of order would not work | 13:32 |
| samueldmq | breton, yes that section describes what I was saying, thanks | 13:32 |
| samueldmq | dstanek, yeah, because we just store the last migration we run, instead of individual migrations we have ran | 13:32 |
| samueldmq | dstanek, I agree with you, and.. if this model is good, we could change the migration control to support individual migrations we have ran, if that's worth it | 13:34 |
| samueldmq | dstanek, I think we would have a better model for our migrations/backport | 13:34 |
| samueldmq | what you think? | 13:34 |
| dstanek | samueldmq: i'm not sure sure - the empty migrations are not really a problem for me | 13:34 |
| samueldmq | dstanek, well they work, but : | 13:35 |
| samueldmq | dstanek, i) duplicated migrations ii) the process need a cherry-pick after backport | 13:36 |
| samueldmq | dstanek, iii) when backporting/cherry-picking, we need to fix the tests on test_sql_upgrade, in order to upgrade to the right version | 13:36 |
| dstanek | samueldmq: going the other way can be just as bad | 13:36 |
| dstanek | for instance one of the systems i worked with in the past forced you to do all migrations | 13:37 |
| samueldmq | dstanek, why? we won't have i) ii) iiI) above | 13:37 |
| samueldmq | dstanek, go ahead | 13:37 |
| dstanek | so what ended up happening is that you had to know which migrations were already applied to run a command telling it so | 13:37 |
| samueldmq | dstanek, the results are exactly the same at the end | 13:38 |
| samueldmq | dstanek, it just makes the process of slotting and backporting easier, imo :) | 13:38 |
| dstanek | samueldmq: not sure - we have yet to do a backport, but we would for sure have had to manually tell the system that things were applied | 13:38 |
| breton | samueldmq: the whole thing will change after I finish that alembic stuff | 13:39 |
| dstanek | also what happens if you need to change the migratiion? | 13:39 |
| *** ozialien has joined #openstack-keystone | 13:39 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis cache backend https://review.openstack.org/173000 | 13:39 |
| breton | samueldmq: there won't be any more placeholders because migrations will not be numbered | 13:39 |
| dstanek | breton: how does alembic store completed migrations? just the last one or all that are applied? | 13:39 |
| breton | *enumerated | 13:39 |
| dstanek | breton: so how does it know what was applied? | 13:40 |
| samueldmq | dstanek, why manually ? keystone-manage db_sync stores it for us, dont it? | 13:40 |
| samueldmq | dstanek, today it knows the last migration ran, right? | 13:40 |
| *** Ephur has joined #openstack-keystone | 13:40 | |
| samueldmq | breton, nice | 13:40 |
| samueldmq | dstanek, interesting question ^ :) | 13:41 |
| * samueldmq needs to read about alembic | 13:41 | |
| dstanek | samueldmq: not necessarily - that's why this is a fun problem | 13:41 |
| dstanek | actually i think in South you also had to tell it about migration you already ran | 13:42 |
| dstanek | yeah, i need to read about it too. i don't understand how the ordering works just flipping through the tutorial | 13:43 |
| breton | dstanek: last one afaik | 13:43 |
| samueldmq | dstanek, hmm, nice | 13:43 |
| dstanek | breton: if it stores the last one then we'd have the same placeholder issue | 13:44 |
| breton | dstanek: it keeps "down_revision" in migration .py | 13:44 |
| samueldmq | breton, so it stores each individual migration ran ? | 13:44 |
| dstanek | breton: how are the migrations ordered? | 13:44 |
| samueldmq | dstanek, I think 'the second one' is storing each migration | 13:44 |
| breton | dstanek: based on their parent revision | 13:46 |
| breton | dstanek: like in git | 13:47 |
| dstanek | breton: interesting - since if uses version control the placeholder issue melts away | 13:47 |
| breton | dstanek: there are merges and branches and stuff | 13:47 |
| *** markvoelker has joined #openstack-keystone | 13:48 | |
| davidckennedy | henrynash I've got stuck with endpoint enforcement. If the token is v2 the service_id will not be in the catalog so we'd only be able to filter by endpoint_id - so should I fail all v2 tokens where the endpoint enforcement is by service_id only? | 13:50 |
| *** fhubik has quit IRC | 13:57 | |
| amakarov_away | rodrigods, hi! Are you here? | 13:58 |
| *** amakarov_away is now known as amakarov | 13:58 | |
| rodrigods | amakarov, hi | 13:59 |
| amakarov | rodrigods, Looks like HMT is only implemented in SQL, right? | 14:00 |
| *** rushil has joined #openstack-keystone | 14:01 | |
| rodrigods | amakarov, yes, it was part of the discussion about freezing the LDAP assignment backend | 14:01 |
| amakarov | rodrigods, so it's ok if I stick to SQL too? | 14:02 |
| rodrigods | amakarov, absolutely! | 14:02 |
| amakarov | rodrigods, thanks ) | 14:02 |
| *** stevemar has joined #openstack-keystone | 14:09 | |
| *** ChanServ sets mode: +v stevemar | 14:09 | |
| *** markvoelker_ has joined #openstack-keystone | 14:13 | |
| *** markvoelker has quit IRC | 14:16 | |
| *** ozialien has quit IRC | 14:17 | |
| morganfainberg | davidckennedy: v2 is special cased all over, I think failure if service Id is missing in v2 is fair for enforcement. | 14:17 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 14:17 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Recursive deletion and project disabling https://review.openstack.org/148730 | 14:17 |
| morganfainberg | davidckennedy: or we add service id to v2 *cringe* | 14:17 |
| *** ozialien has joined #openstack-keystone | 14:19 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:20 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Recursive deletion https://review.openstack.org/148730 | 14:22 |
| rodrigods | henrynash, ^ tried to comply with gyee suggestions. | 14:22 |
| henrynash | will check! | 14:23 |
| *** ozialien has quit IRC | 14:26 | |
| viktors | dstanek: ping | 14:26 |
| *** browne has joined #openstack-keystone | 14:29 | |
| *** rushiagr is now known as rushiagr_away | 14:33 | |
| *** topol has joined #openstack-keystone | 14:33 | |
| *** ChanServ sets mode: +v topol | 14:33 | |
| *** kiran-r has quit IRC | 14:36 | |
| *** markvoelker has joined #openstack-keystone | 14:36 | |
| *** markvoel_ has joined #openstack-keystone | 14:38 | |
| *** markvoelker_ has quit IRC | 14:40 | |
| *** markvoel_ has quit IRC | 14:41 | |
| *** markvoelker has quit IRC | 14:42 | |
| davidckennedy | morganfeinberg yes, I don't think it would be right to start adding stuff to v2 tokens. Whoever configures keystonemiddleware has the option of specifying an endpoint_id to enforce so v2 should still work in that case. I'm adding some info to the config properties to make this clear. | 14:45 |
| davidckennedy | But if we don't fail a token when only service_id is enforced then we might as well lock the door but leave the window open - it would be possible just to walk round endpoint enforcement just by using v2 token. | 14:46 |
| morganfainberg | davidckennedy: so we document "service id only" is a v3 feature. | 14:53 |
| *** joesavak has quit IRC | 14:53 | |
| morganfainberg | davidckennedy: we have a lot of v3 only features. | 14:54 |
| morganfainberg | And we should fail if service Id only *and* v2 | 14:54 |
| *** rwsu has joined #openstack-keystone | 15:00 | |
| dstanek | viktors: hi | 15:03 |
| viktors | dstanek: hi! | 15:04 |
| davidckennedy | morganfeinberg I'm picking up where a colleague left off and I'm piecing together his intentions so it's a little sketchy. Whatever is done with this we'll need to document it. The spec will need updating and I'll do that once I've got it coherent. | 15:04 |
| viktors | are you still working on functional test for keystone? | 15:04 |
| davidckennedy | back shortly. | 15:05 |
| *** davidckennedy has quit IRC | 15:05 | |
| *** thedodd has joined #openstack-keystone | 15:07 | |
| dstanek | viktors: yes, i have a few things cooking in there | 15:07 |
| *** jsheeren has quit IRC | 15:07 | |
| dstanek | viktors: that's me pre-summit focus | 15:09 |
| viktors | dstanek: I want to show to you patch https://review.openstack.org/#/c/171115/ - it's might be related to your work | 15:10 |
| viktors | will such code play well with your approach? | 15:11 |
| dstanek | viktors: cool. I'll take a look in a bit | 15:11 |
| *** rushiagr_away is now known as rushiagr | 15:11 | |
| dstanek | viktors: I'll let you know in about an hour | 15:11 |
| *** markvoelker has joined #openstack-keystone | 15:12 | |
| viktors | dstanek: ok | 15:12 |
| *** c0m0 has quit IRC | 15:13 | |
| *** markvoelker has quit IRC | 15:16 | |
| *** pnavarro has quit IRC | 15:16 | |
| *** ParsectiX has quit IRC | 15:17 | |
| *** david-lyle has joined #openstack-keystone | 15:19 | |
| *** david-lyle_ has joined #openstack-keystone | 15:19 | |
| *** david-lyle_ has quit IRC | 15:19 | |
| *** c0m0 has joined #openstack-keystone | 15:19 | |
| *** pnavarro has joined #openstack-keystone | 15:20 | |
| *** ozialien has joined #openstack-keystone | 15:26 | |
| *** jamie_h has quit IRC | 15:28 | |
| *** stevemar has quit IRC | 15:28 | |
| *** pnavarro is now known as pnavarro|off | 15:31 | |
| viktors | folks, can someone +A patch with two +2 - https://review.openstack.org/#/c/137637/ ? Thanks! | 15:31 |
| *** jdennis has quit IRC | 15:32 | |
| *** davidckennedy has joined #openstack-keystone | 15:33 | |
| *** ajayaa has quit IRC | 15:34 | |
| *** browne has quit IRC | 15:34 | |
| *** _cjones_ has joined #openstack-keystone | 15:34 | |
| *** sdake has joined #openstack-keystone | 15:35 | |
| rodrigods | henrynash, replied your comments | 15:35 |
| *** _cjones_ has quit IRC | 15:38 | |
| *** _cjones_ has joined #openstack-keystone | 15:38 | |
| henrynash | ok…thx | 15:38 |
| *** sdake_ has joined #openstack-keystone | 15:39 | |
| *** samueldmq has quit IRC | 15:40 | |
| *** sdake has quit IRC | 15:42 | |
| *** joesavak has joined #openstack-keystone | 15:47 | |
| *** csoukup has joined #openstack-keystone | 15:48 | |
| *** viktors is now known as viktors|afk | 15:54 | |
| *** jeffDeville has quit IRC | 15:56 | |
| *** sdake has joined #openstack-keystone | 15:59 | |
| ayoung | do we need a CLI command openstack token get ? | 15:59 |
| *** tqtran has joined #openstack-keystone | 15:59 | |
| *** vilobhmm1 has joined #openstack-keystone | 16:00 | |
| *** vilobhmm11 has joined #openstack-keystone | 16:02 | |
| ayoung | viktors|afk, done | 16:03 |
| *** sdake_ has quit IRC | 16:03 | |
| *** tqtran_ has joined #openstack-keystone | 16:03 | |
| *** jistr has quit IRC | 16:03 | |
| *** alexsyip has joined #openstack-keystone | 16:04 | |
| *** jistr has joined #openstack-keystone | 16:04 | |
| *** vilobhmm1 has quit IRC | 16:04 | |
| *** krykowski has quit IRC | 16:06 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Materialized path for project hierarchy https://review.openstack.org/173424 | 16:07 |
| *** csoukup has quit IRC | 16:08 | |
| *** jistr has quit IRC | 16:09 | |
| *** markvoelker has joined #openstack-keystone | 16:13 | |
| *** rushil has quit IRC | 16:13 | |
| *** kiran has joined #openstack-keystone | 16:14 | |
| *** jistr has joined #openstack-keystone | 16:15 | |
| *** jistr has quit IRC | 16:17 | |
| *** _cjones_ has quit IRC | 16:19 | |
| *** markvoelker has quit IRC | 16:19 | |
| ayoung | $ openstack --os-auth-url http://controller.oslab.openstack.engineering.redhat.com:5000/v2.0 project list | 16:19 |
| ayoung | ERROR: openstack Authorization Failed: Cannot authenticate without an auth_url | 16:19 |
| *** tqtran_ has quit IRC | 16:19 | |
| ayoung | package hell | 16:20 |
| *** browne has joined #openstack-keystone | 16:20 | |
| *** _cjones_ has joined #openstack-keystone | 16:21 | |
| ayoung | OK...I'm guessing we can't run with cligg 10 | 16:27 |
| ayoung | cliff | 16:27 |
| *** davidckennedy has quit IRC | 16:37 | |
| *** EmilienM is now known as EmilienM|afk | 16:38 | |
| *** c0m0 has quit IRC | 16:40 | |
| *** markvoelker has joined #openstack-keystone | 16:44 | |
| *** afazekas has joined #openstack-keystone | 16:47 | |
| *** zzzeek has joined #openstack-keystone | 16:48 | |
| *** markvoelker has quit IRC | 16:50 | |
| *** tqtran_ has joined #openstack-keystone | 16:50 | |
| *** jaosorior has quit IRC | 16:52 | |
| *** tqtran_ has quit IRC | 16:54 | |
| *** david-lyle has quit IRC | 16:57 | |
| *** raildo has quit IRC | 16:58 | |
| ayoung | dtroyer, I'm trying to unravel a packaing mystery running OSC. I have, I think, all the dpes up to date, but running the basic commands like project list fail with : | 17:00 |
| ayoung | File "/usr/lib/python2.7/site-packages/keystoneclient/v2_0/client.py", line 196, in get_raw_token_from_identity_service | 17:00 |
| ayoung | _("Authorization Failed: %s") % e) | 17:00 |
| ayoung | AuthorizationFailure: Authorization Failed: Cannot authenticate without an auth_url | 17:00 |
| *** ozialien has quit IRC | 17:00 | |
| *** kiran has quit IRC | 17:00 | |
| ayoung | I've both set the env var and passed it on the command line. | 17:00 |
| *** lhcheng has joined #openstack-keystone | 17:01 | |
| *** ChanServ sets mode: +v lhcheng | 17:01 | |
| ayoung | but somehow auth_url doesn't make it down to the token fetch step | 17:01 |
| dstanek | viktors|afk: i think that's a good idea - doesn't impact what i am doing in any way. is it ready to come out of wip? | 17:04 |
| dtroyer | ayoung: so first, assumptions: you have master or current release on osc and *client deps? | 17:06 |
| *** raildo has joined #openstack-keystone | 17:06 | |
| ayoung | dtroyer, I'm using the RDO build opf the packages. which means ... | 17:06 |
| ayoung | python-openstackclient-1.0.3-post18.fc21.noarch | 17:06 |
| ayoung | dtroyer, and...the RDO packaging is somewhat broken WRT versions... | 17:07 |
| ayoung | as in, the spec files don't seem to have version dependencies in them | 17:07 |
| ayoung | dtroyer, so I've been making sure I had the right versions manually | 17:08 |
| ayoung | for cliff, I had to jump up to | 17:08 |
| ayoung | python-cliff-1.10.0-2.fc21.noarch | 17:08 |
| ayoung | which I built myself | 17:08 |
| ayoung | using 1.7 gave me an error that we should look into as well, maybe need to bump the required verions up above 1.7...but I want a positive run first. | 17:09 |
| *** david-lyle has joined #openstack-keystone | 17:09 | |
| dtroyer | on 1.0.3 you should be good with cliff 1.7.0, modulo packaging patches | 17:09 |
| ayoung | dtroyer, if I do that I get | 17:09 |
| dtroyer | but there is a requirements.txt bump to set the stable/kilo (roughly 1.0.3) to cliff 1.10.0 | 17:09 |
| ayoung | dtroyer, some error about the deferred help arg not being supported | 17:10 |
| ayoung | so I jumped to 10 | 17:10 |
| ayoung | I can reproduce it if you want, as the problem I'm seeing might be clidff related | 17:10 |
| *** david-lyle has quit IRC | 17:11 | |
| ayoung | let me try from master without the rpm, and see if it is my RPM that is broken | 17:11 |
| dtroyer | heh, we only merged the deferred help thing yesterday that requires that in cliff…unless something earlier needed it. | 17:11 |
| *** david-lyle has joined #openstack-keystone | 17:11 | |
| dtroyer | that's a secondary problem though | 17:11 |
| *** samueldmq has joined #openstack-keystone | 17:11 | |
| ayoung | wooo hole bunch of pip packages got grabbed... | 17:12 |
| ayoung | dtroyer, what does it mean that it uninstalls these packages: http://paste.openstack.org/show/204017/ | 17:14 |
| ayoung | that the RPM versions were out of date with what python setup.py install forced in based on requirements.txt? | 17:14 |
| dtroyer | it means that since you probably had those installed from pacakges, now you have a mess since botht he pacakges and the pip installs write to the same place | 17:15 |
| dtroyer | this has long been a problem and everyone points in the opposite direction when you bring it up between python and fedora folk. | 17:16 |
| ayoung | dtroyer, nah, I understand the mess, and am capable of dealing with it | 17:17 |
| ayoung | I just thought that the versions of those packages I had fulfilled the pip dependencies | 17:18 |
| ayoung | dtroyer, this feels like a problem with cliff. | 17:19 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:19 | |
| ayoung | or oslo config or something dealing withthe arg parsing | 17:19 |
| dtroyer | for the auth thing, use —debug and look for the auth messages just after the bunch of commandmanager messages, make sure the plugin chosen is what you expect | 17:22 |
| *** aix has quit IRC | 17:22 | |
| *** ajayaa has joined #openstack-keystone | 17:32 | |
| *** jeffDeville has joined #openstack-keystone | 17:33 | |
| *** harlowja_away is now known as harlowja | 17:36 | |
| jlk | morganfainberg: so I'm still a bit stuck, not sure how to proceed with the haproxy issue. As a last ditch solution I could take out haproxy and terminate ssl right in apache | 17:37 |
| morganfainberg | jlk, i'll have gyee here in a moment | 17:37 |
| morganfainberg | jlk, so we can talk it through | 17:38 |
| morganfainberg | i just sat down in sunnyvale | 17:38 |
| jlk | alright | 17:38 |
| *** markvoelker has joined #openstack-keystone | 17:47 | |
| *** markvoelker has quit IRC | 17:52 | |
| *** openstackstatus has quit IRC | 17:58 | |
| *** openstackstatus has joined #openstack-keystone | 17:59 | |
| *** ChanServ sets mode: +v openstackstatus | 17:59 | |
| ayoung | dtroyer, DEBUG: openstackclient.api.auth Auth plugin osc_password selected | 18:01 |
| ayoung | DEBUG: openstackclient.identity.v2_0.project.ListProject take_action(Namespace(columns=[], formatter='table', long=False, max_width=0, quote_mode='nonnumeric')) | 18:01 |
| ayoung | DEBUG: openstackclient.identity.client Instantiating identity client: <class 'openstackclient.identity.client.IdentityClientv2'> | 18:01 |
| *** edmondsw has joined #openstack-keystone | 18:02 | |
| dtroyer | ayoung: that's what I would expect | 18:02 |
| *** ozialien has joined #openstack-keystone | 18:02 | |
| *** pnavarro|off has quit IRC | 18:02 | |
| dtroyer | is that where the error occurs? | 18:02 |
| ayoung | dtroyer, yeah... | 18:02 |
| ayoung | dtroyer, here's the full paste | 18:03 |
| -openstackstatus- NOTICE: Gerrit has stopped emitting events so Zuul is not alerted to changes. We will restart Gerrit shortly to correct the problem. | 18:03 | |
| *** ChanServ changes topic to "Gerrit has stopped emitting events so Zuul is not alerted to changes. We will restart Gerrit shortly to correct the problem." | 18:03 | |
| ayoung | http://paste.openstack.org/show/204023/ dtroyer | 18:03 |
| ayoung | dtroyer, argparse is responsible for both the CLI args and the env vars, right? | 18:04 |
| ayoung | and that is from the base python install | 18:05 |
| *** ashleighfarnham has joined #openstack-keystone | 18:06 | |
| *** mattamizer has joined #openstack-keystone | 18:07 | |
| *** alexsyip has quit IRC | 18:07 | |
| dstanek | jlk: what is the issue with haproxy? | 18:08 |
| jlk | dstanek: haproxy is terminating ssl, communicating with keystone (apache) via http, but saml2 doesn't like that. | 18:09 |
| jlk | it appears to be a protocol level issue and I need to make haproxy talk to apache via ssl instead | 18:09 |
| dstanek | jlk: ah, odd. so the mod_ship expects the traffic over ssl? | 18:10 |
| jlk | apparently | 18:10 |
| jlk | otherwise it throws a replay error | 18:10 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:10 | |
| dtroyer | ayoung: there is a chunk of stuff missing in there, here is my output for the same thing against a default devstack: http://paste.openstack.org/show/204024/ | 18:10 |
| *** david-lyle has quit IRC | 18:10 | |
| dtroyer | specifically, you don't have lines 17-42 and i'm not sure why | 18:11 |
| dstanek | jlk: have you gone through this? https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0CCcQFjAB&url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fdisplay%2FSHIB2%2FSPReverseProxy&ei=-6kuVbezFtOxogTGkICoDA&usg=AFQjCNGKA4xBjX8fX1jNYrXx1WgvBk6MRg | 18:12 |
| dstanek | hmmm..that was an ugly url | 18:12 |
| jlk | yea | 18:12 |
| ayoung | dtroyer, well, that gives me a good place to put a pdb break point | 18:13 |
| jlk | I already have handlerSSL set to false but that wasn't enough | 18:13 |
| jlk | and I was setting the ServerName right. | 18:13 |
| ayoung | DEBUG: openstackclient.api.auth fetching option os_auth_url | 18:13 |
| jlk | those were giving me a different error at first | 18:13 |
| jlk | now that those are fixed it's a new replay error rather than a name mismatch | 18:13 |
| ayoung | dtroyer, is that a cliff thing? it looks like plugin enumeration, | 18:14 |
| dtroyer | cliff knows nothing about auth | 18:15 |
| ayoung | dtroyer, ah...and those are the params being passed down, too, but that is in OSC, not KC yet | 18:15 |
| dtroyer | This starts in clientmanager.py setup_auth() | 18:15 |
| dstanek | jlk: any reason not to use SSL all the way back to the Apache server? | 18:16 |
| jlk | well, because typically we don't have apache sitting in front of keystone, we typically have keystone running it's own thing, and doing ssl termination there is... exciting. | 18:17 |
| jlk | for this demo, we're going to insert ssl between haproxy and apache to get it to work, but it's not a desired outcome. We'd normally want to terminate ssl at the load balancer | 18:17 |
| morganfainberg | It's a limit of policy stuff. | 18:18 |
| dstanek | if you are using mod_shib you'll have to have apache anyway; i'm also paranoid about clear text traffic anywhere (even in the private, internal network) | 18:19 |
| ayoung | dtroyer, ok, breakpoint in that function shows: (Pdb) print self._cli_options.os_auth_url | 18:19 |
| ayoung | http://controller.oslab.openstack.engineering.redhat.com:5000/v2.0 | 18:19 |
| morganfainberg | Yeah. | 18:19 |
| ayoung | so it is properly parsed and accepted. | 18:19 |
| *** jdennis has joined #openstack-keystone | 18:19 | |
| ayoung | and print self.auth_plugin_name returns osc_password | 18:20 |
| ayoung | dtroyer, what should be doing all of the DEBUG: openstackclient.api.auth fetching option os_auth_url | 18:21 |
| ayoung | type statements? | 18:21 |
| dtroyer | ayoung: what I don't see in your output is the log messages from auth.build_auth_params() | 18:21 |
| *** EmilienM|afk is now known as EmilienM | 18:22 | |
| ayoung | dtroyer, I don't think it gets that far, errors out on the line before I think | 18:22 |
| *** krotscheck has joined #openstack-keystone | 18:23 | |
| jlk | lolol, note to self, when changing time to try and use an old token, don't forget to change time back to do other things | 18:23 |
| amakarov | rodrigods, hi! Thanks a lot for your tips: I'll address them a bit later (when I can access gerrit again), and I can say for adjacency list in external table: it ruins performance entirely, especially in the reseller case: every insert will cause reindexing of a looong table. I tried, really :) Materialized path performs much better from my experience. Just to say this approach is best used in discussion engines (with quickly updated long | 18:23 |
| amakarov | conversation threads) | 18:23 |
| dtroyer | but it does print the messages from openstackclient.identity.v2_0.project.ListProject so somehow it kept going... | 18:23 |
| krotscheck | Gerrit is back | 18:23 |
| morganfainberg | Yay gerrit | 18:23 |
| rodrigods | amakarov, np! thanks! | 18:24 |
| ayoung | dtroyer, I think I am getting the wrong error message. I think I should be getting | 18:24 |
| ayoung | Set a scope, such as a project or domain, with --os-project-name or OS_PROJECT_NAME | 18:24 |
| ayoung | let me try again | 18:24 |
| ayoung | dtroyer, if I undertand what is happening, this call is failing out, but then the client is continuing to try and process, instead of reporting the error here | 18:25 |
| dtroyer | that's what it seems like | 18:25 |
| *** ChanServ changes topic to "Liberty Development Open | Look for RC-critical bugs | Review KeystoneClient and KeystoneMiddleware code | Review Liberty Keystone Specs" | 18:25 | |
| -openstackstatus- NOTICE: Gerrit has been restarted. New patches, approvals, and rechecks between 17:30 and 18:20 UTC may have been missed by Zuul and will need rechecks or new approvals added. | 18:25 | |
| ayoung | dtroyer, there is a bug in here somewhere...just not sure where | 18:26 |
| dtroyer | ayoung: so auth.check_valid_auth_options() doesn't require a project, so yeah, we should somewhere trap that and give a decent error message | 18:26 |
| ayoung | dtroyer, it shouldn't require a project. we should be able to perform some operatiosn against keystone with unscoped tokens | 18:27 |
| ayoung | I was trying to list my projects.... | 18:27 |
| dtroyer | I'm not always clear on scoped/unscoped token business so there is likely the root cause ;) | 18:27 |
| ayoung | this is a Keystoneism. Think like "I'm a new user to this cloud...what am I allowed to do?" | 18:28 |
| dtroyer | ...and what is allowed with unscoped tokens | 18:28 |
| ayoung | and you think...ok, what projects am I in. | 18:28 |
| ayoung | not much, but a user listing their own projects is one | 18:28 |
| dtroyer | agreed, that should work | 18:28 |
| ayoung | That is what Horizon does. A user comes in and does not have a project set (and if their account doese not have a default proejct) they only get back an unscoped token, which they use to enuemrate their projects. THen Horizon selects the first from the list | 18:29 |
| dtroyer | this very likely could be an impedance mis-match between OSC and ksc's plugins, as in something specific needs to be set to allow it to work right | 18:29 |
| ayoung | dtroyer, I'll file the bug, anyway, and we can track the discussion in there | 18:30 |
| dtroyer | I was just typing that…sounds good | 18:30 |
| samueldmq | dstanek, morganfainberg so backporting migrations will require a downgrade | 18:32 |
| ayoung | dtroyer, https://bugs.launchpad.net/python-openstackclient/+bug/1444640 | 18:37 |
| openstack | Launchpad bug 1444640 in python-openstackclient "Not setting project returns error AuthorizationFailure: Authorization Failed: Cannot authenticate without an auth_url" [Undecided,New] | 18:37 |
| *** farhan has joined #openstack-keystone | 18:42 | |
| *** rushil has joined #openstack-keystone | 18:46 | |
| *** farhan has quit IRC | 18:46 | |
| *** tqtran is now known as tqtran_afk | 18:49 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Materialized path for project hierarchy https://review.openstack.org/173424 | 18:56 |
| amakarov | rodrigods, ^^ | 18:56 |
| *** tqtran has joined #openstack-keystone | 19:02 | |
| *** amakarov is now known as amakarov_away | 19:03 | |
| *** tqtran has quit IRC | 19:06 | |
| *** pnavarro has joined #openstack-keystone | 19:08 | |
| *** stevemar has joined #openstack-keystone | 19:13 | |
| *** ChanServ sets mode: +v stevemar | 19:13 | |
| *** pnavarro has quit IRC | 19:14 | |
| *** pnavarro has joined #openstack-keystone | 19:20 | |
| *** pnavarro has quit IRC | 19:20 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Make get_trust a protected method https://review.openstack.org/172620 | 19:22 |
| *** ashleighfarnham has quit IRC | 19:25 | |
| *** david-lyle has joined #openstack-keystone | 19:30 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Materialized path for project hierarchy https://review.openstack.org/173424 | 19:32 |
| lhcheng | bknudson: got a upgrade related question.. how do we handle update of policy file? | 19:37 |
| lhcheng | bknudson: I hit a problem while working on: https://review.openstack.org/#/c/172620/ | 19:38 |
| bknudson | lhcheng: I can tell you how our product handles it... we have chef scripts that update it. | 19:38 |
| lhcheng | bknudson: the patch fixes an unused policy rule, and now our code consumes it | 19:38 |
| lhcheng | bknudson: the problem is, grenade does not consume the latest policy file when it runs | 19:39 |
| bknudson | typically we require that the server works with the old file. | 19:39 |
| lhcheng | for upgrade, it is assumed that the policy file have to be updated manually by the user? | 19:39 |
| bknudson | I think this is considered part of our stability guidelines. | 19:40 |
| lhcheng | bknudson: so for your case, the chef script merges the policy file with the new one? | 19:40 |
| bknudson | lhcheng: the update scripts just overwrite it... I guess a customer might have supplied their own policy file so they'd like that to continue to work. | 19:41 |
| lhcheng | bknudson: yup, that guideline makes perfect sense. | 19:42 |
| bknudson | lhcheng: so what's the failure if the old policy file is used? | 19:43 |
| bknudson | you can't use trusts? | 19:43 |
| samueldmq | morganfainberg, dolphm I have an issue when backporting a migration :/ | 19:44 |
| lhcheng | can't GET trust | 19:44 |
| lhcheng | bknudson: the definition in the policy file is: "identity:get_trust": "rule:admin_or_owner", | 19:44 |
| lhcheng | bknudson: the definition of "owner" doesn't apply for trust | 19:44 |
| samueldmq | morganfainberg, dolphm basically I cant backport 073 to 068 since in stable/juno the last migration is 055, and it will then look for 056 | 19:45 |
| lhcheng | bknudson: it needs to be trustor_or_trustee | 19:45 |
| bknudson | lhcheng: seems easier to just remove the line from policy.json... | 19:45 |
| dolphm | samueldmq: to which branch are you trying to backport a migration to? | 19:46 |
| morganfainberg | samueldmq: you have to do the same idempotent migration for each backport. | 19:46 |
| samueldmq | dolphm, I am trying to backport it to stable/juno | 19:46 |
| morganfainberg | samueldmq: the 068 one is for kilo | 19:46 |
| morganfainberg | Not Juno. | 19:46 |
| dolphm | samueldmq: what's the master review? | 19:46 |
| samueldmq | morganfainberg, so I create 056 there, and when we cherry-pick it back, we do so for 068 | 19:47 |
| samueldmq | dolphm, let me get the link | 19:47 |
| samueldmq | dolphm, https://review.openstack.org/#/c/142472/ | 19:47 |
| morganfainberg | Does this need to go to Juno? | 19:47 |
| samueldmq | morganfainberg, well, this should go for when role assignments were introduced, right? | 19:48 |
| samueldmq | (which is not juno) | 19:48 |
| morganfainberg | So kilo is easy. It's rc2 | 19:48 |
| dolphm | samueldmq: you should also focus on landing it to master before we discuss backporting | 19:48 |
| morganfainberg | But land in master and do rc2 | 19:48 |
| *** alex_xu has quit IRC | 19:48 | |
| morganfainberg | Juno is not important until those two are done. | 19:48 |
| lhcheng | bknudson: hah that would fix the confusion of having it there. :) But using the policy file instead of having the code do it is the "right" thing to do.. | 19:49 |
| samueldmq | dolphm, morganfainberg k makes sense, it just got a merge conflict this afternoon | 19:49 |
| *** alex_xu has joined #openstack-keystone | 19:49 | |
| samueldmq | I will rebase and it will be up for review again | 19:49 |
| samueldmq | thanks | 19:49 |
| *** markvoelker has joined #openstack-keystone | 19:50 | |
| bknudson | lhcheng: I can't think of a way to do it right that doesn't break backwards compatiliby with the policy.json... the default is admin-only, so if you use a new rule then that won't work either. | 19:50 |
| *** ozialien has quit IRC | 19:50 | |
| bknudson | maybe it could be done but that would require some invention in oslo.policy | 19:50 |
| bknudson | keystone would have to tell oslo.policy to use a special default rule for the trust rules. | 19:51 |
| lhcheng | bknudson: yeah, maintaining the backward compatibility is tricky. The crazy thing is, it wasn't even consume before. :P | 19:52 |
| *** rushil has quit IRC | 19:52 | |
| bknudson | the first step can be to remove it, since that's an easy fix. | 19:52 |
| bknudson | then we can think about how to add it back in. | 19:53 |
| bknudson | we've got stable/kilo branches now. | 19:53 |
| *** markvoelker has quit IRC | 19:55 | |
| lhcheng | bknudson: yeah, seems like that's the only non-disruptive way to do it.. | 19:55 |
| lhcheng | bknudson: do you mean remove it for stable/kilo (tag as rc potential) ? | 19:56 |
| bknudson | Doesn't seem worth it to backport. | 19:57 |
| bknudson | I was just mentioning stable/kilo branches because I didn't expect that to happen already. | 19:57 |
| lhcheng | ah, got it | 19:58 |
| *** ajayaa has quit IRC | 19:58 | |
| breton | bknudson: there is proposed/kilo now afaik | 19:59 |
| lhcheng | bknudson: thanks for the guidance, I'll just remove it from policy.json for now.. | 20:00 |
| bknudson | breton: and stable/kilo http://git.openstack.org/cgit/openstack/keystone/log/?h=stable/kilo | 20:00 |
| bknudson | not sure what we're supposed to use. | 20:01 |
| breton | and they point to the same commit. weird. | 20:02 |
| breton | when I googled for proposed/ branches some time ago, they were suggested to be used before release. And now there is stable/. | 20:03 |
| lhcheng | seems like stable/kilo is where is should be.. dhellmann has been moving all our patches from proposed/kilo to stable/kilo | 20:03 |
| lhcheng | https://review.openstack.org/#/c/173678/ | 20:03 |
| *** henrynash has quit IRC | 20:05 | |
| *** rushiagr is now known as rushiagr_away | 20:06 | |
| dstanek | aggregator sounds interesting, but feels strange as a bolt-on | 20:07 |
| ayoung | dtroyer, um... ERROR: openstack Multiple possible networks found, use a Network ID to be more specific. (HTTP 400) (Request-ID: req-657a6947-54b0-4c95-9891-3e6d422fe687) | 20:09 |
| ayoung | but we don't have that as CLI param to server create? | 20:09 |
| *** edmondsw has quit IRC | 20:10 | |
| breton | bknudson: lhcheng: there is a reply from infra- about branches in #openstack-dev | 20:14 |
| *** rushil has joined #openstack-keystone | 20:16 | |
| bknudson | works for me. Don't expect me to +2 anything in stable/ since I don't have authority anyways. | 20:20 |
| *** rushiagr_away is now known as rushiagr | 20:24 | |
| dtroyer | ayoung: if that's not part of the —nic argument then we are missing that option | 20:25 |
| ayoung | dtroyer yeah this is what it shows | 20:26 |
| dtroyer | I am not on top of that as much as I'd like, particularly if it's a Neutron back-end | 20:26 |
| ayoung | --nic <nic-config-string> | 20:26 |
| ayoung | Specify NIC configuration (optional extension) | 20:26 |
| ayoung | I was able to determine what it needed from the nova docs http://docs.openstack.org/juno/install-guide/install/yum/content/launch-instance-neutron.html | 20:26 |
| dtroyer | right, I think we've just copied the argument format…that certainly needs attention | 20:27 |
| openstackgerrit | David J Hu proposed openstack/python-keystoneclient: Access Info Formatter https://review.openstack.org/172514 | 20:27 |
| ayoung | dtroyer, https://bugs.launchpad.net/python-openstackclient/+bug/1444685 | 20:29 |
| openstack | Launchpad bug 1444685 in python-openstackclient "server create does not explain network values" [Undecided,New] | 20:29 |
| ayoung | great bug for someone to cut their teeth on in Open Stack. | 20:29 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Adds inherited column to RoleAssignment PK https://review.openstack.org/142472 | 20:34 |
| bknudson | "Fuel Devops McRobotson "? | 20:35 |
| breton | bknudson: where is that? | 20:37 |
| bknudson | breton: https://bugs.launchpad.net/keystonemiddleware/+bug/1411063 | 20:38 |
| openstack | Launchpad bug 1411063 in keystonemiddleware "S3token incorrect condition expression for ssl_insecure (CVE-2015-1852)" [Critical,In progress] - Assigned to Tristan Cacqueray (tristan-cacqueray) | 20:38 |
| bknudson | it's the last comment. | 20:38 |
| breton | bknudson: it's our bot spamming bugreports again :( | 20:39 |
| breton | sorry about that, I'll notify people about that | 20:40 |
| bknudson | no problem. | 20:40 |
| breton | "about that, about that" | 20:41 |
| breton | :( | 20:41 |
| jlk | holy crap you guys, I think I just got a token out of this simulate_idp.py thing! | 20:41 |
| *** stevemar has quit IRC | 20:41 | |
| *** gyee has joined #openstack-keystone | 20:44 | |
| *** ChanServ sets mode: +v gyee | 20:44 | |
| *** gyee has quit IRC | 20:44 | |
| *** thedodd has quit IRC | 20:49 | |
| *** alexsyip has joined #openstack-keystone | 20:52 | |
| dstanek | jlk: simulate_idp.py? | 20:53 |
| jlk | yeah something that's been passed around to help test federation stuff | 20:53 |
| *** jeffDeville has quit IRC | 20:54 | |
| *** rushil has quit IRC | 20:57 | |
| dstanek | jlk: neat. where can i get my hands on that? | 20:57 |
| dstanek | i assume that you've fix your SSL troubles | 20:58 |
| jlk | it may not actually have been ssl, it may have been needing to restart shib before trying the simulation again | 20:58 |
| jlk | I'm running more tests | 20:58 |
| *** raildo has quit IRC | 21:00 | |
| *** gyee has joined #openstack-keystone | 21:00 | |
| *** ChanServ sets mode: +v gyee | 21:00 | |
| jlk | yeah | 21:01 |
| jlk | I don't need ssl between haproxy and apache after all. | 21:01 |
| jlk | morganfainberg: gyee: we were chasing a red herring this morning. The reason I was getting a replay warning was because I needed to restart shib service between simulation attempts. | 21:02 |
| *** mattfarina has quit IRC | 21:02 | |
| *** mattamizer has quit IRC | 21:03 | |
| morganfainberg | jlk, aha! | 21:04 |
| morganfainberg | ok so we're good | 21:04 |
| morganfainberg | yay! | 21:04 |
| jlk | yeah, no ssl between haproxy and apache. | 21:04 |
| morganfainberg | nice | 21:04 |
| morganfainberg | btw, this is awesome it shows we are safe from replay attacks :P | 21:05 |
| jlk | at least until you restart the service :) | 21:05 |
| dstanek | that sorta worries me in a production deployment - too easy to sniff | 21:05 |
| morganfainberg | lol | 21:05 |
| jlk | dstanek: we're working toward ssl everywhere on our private network, but openstack doesn't make this easy | 21:06 |
| ayoung | jlk, richm has been working on that, too. We need to get off eventlet everywhere | 21:07 |
| ayoung | it is annoying, cuz we dug our own hole here | 21:07 |
| *** leonchio_ has joined #openstack-keystone | 21:07 | |
| dstanek | ayoung: that's two different issues, although i do agree | 21:07 |
| richm | apache == ssl termination + wsgi | 21:08 |
| ayoung | dstanek, I'd argue it is one and the same, as with HTTPD, we'd have SSL by default, and people would have worked through the issues by now | 21:08 |
| jlk | so without doing a lot of tweaking, doing apache fronted keystone vs eventlet fronted keystone made things significantly slower | 21:08 |
| jlk | LOTS of variables at play of course, but it wasn't a very comforting first step | 21:08 |
| dstanek | ayoung: it's trivial to put a terminator in front of an eventlet app | 21:09 |
| ayoung | dstanek, no it isn't | 21:09 |
| ayoung | that solves the easy part of the problem | 21:09 |
| richm | apache = x509 cert auth termination + SASL auth termination + federation auth termination + etc. | 21:09 |
| ayoung | dstanek, it doesn't solve the whole problem | 21:10 |
| dstanek | ayoung: SSL everywhere is the problem i want to solve. what is the other one? | 21:10 |
| ayoung | dstanek, getting the damn thing set up right so the service catalog finds the endpoints | 21:10 |
| ayoung | and getting it tested in devstack | 21:10 |
| jlk | we also have the problem of trying to do many services on a single host, each service with it's own venv, and to front them all with apache gets.. interesting | 21:10 |
| ayoung | and getting it into puppet | 21:10 |
| ayoung | and getting into all the things that consume puppet | 21:10 |
| ayoung | and so forth and so on on merrily down the stream | 21:11 |
| dstanek | again that's different. you can put up SSL in front of eventlet with a trivial init script. so people should start doing that | 21:11 |
| *** joesavak has quit IRC | 21:11 | |
| ayoung | dstanek, come live in my world for a week and you will have a different perspective | 21:11 |
| ayoung | or..should I say, in richm's world | 21:12 |
| dstanek | i'm already doing this stuff all over the place so there is no reason when we can't get openstack services to fix their stuff; this can totally be done | 21:12 |
| dstanek | i'm also not arguing that we should keep eventlet | 21:13 |
| richm | If SSL is the only problem with eventlet then yes, there are other ways to solve that problem - just put some sort of proxy/shim in front of it - doesn't have to be apache | 21:13 |
| dstanek | i just think we need to be careful to not conflate unrelated issues - it makes it harder for people to agree when they think you are like congress sliding a personal thing through under the cloak of another issue | 21:14 |
| dstanek | richm: exactly | 21:14 |
| richm | But there is also the problem that keystone + eventlet doesn't scale very well with thousands of connections and requests - perhaps there is also another way to solve that problem without apache wsgi too | 21:15 |
| dstanek | there are several ways to deal with that issue - in my personal stuff i always favor running nginx and it should be able to work there too | 21:16 |
| richm | nginx + wsgi? | 21:16 |
| dstanek | yes, i do that all of the time - that's the most popular deployment scenario for Python app IME | 21:17 |
| dstanek | nginx -> gunicorn -> application | 21:18 |
| dstanek | gunicorn runs the app multi-(process, thread) and nginx will proxy to it | 21:18 |
| richm | instead of apache + wsgi + application | 21:19 |
| bknudson | dstanek: how do you do haproxy? | 21:19 |
| dstanek | bknudson: what do you mean? it just sits in front of all of the nginx servers | 21:20 |
| bknudson | dstanek: I was just wondering if you changed it up when you did haproxy. | 21:20 |
| dstanek | bknudson: no, it's no different then when i use apache | 21:21 |
| dstanek | bknudson: maybe i need to submit my patch - i have keystone running under gunicorn | 21:21 |
| dstanek | which btw can be run behind apache too, but there is the added benefit that the python is out of process | 21:22 |
| bknudson | dstanek: then apache is just reverse proxy? | 21:23 |
| dstanek | bknudson: yes | 21:24 |
| dstanek | that's what i'd do with nginx too | 21:24 |
| *** rushiagr is now known as rushiagr_away | 21:24 | |
| bknudson | dstanek: does gunicorn have the plugins for federation? | 21:24 |
| dstanek | i'll do a little research on deployment speeds and report back tomorrow - i'm curious | 21:25 |
| dstanek | bknudson: no, you'd have to run it behind something that does (Apache does obviously, but i thought that there was some plugins for nginx too) | 21:26 |
| *** dims_ has joined #openstack-keystone | 21:46 | |
| *** jamielennox|away is now known as jamielennox | 21:46 | |
| *** dims has quit IRC | 21:48 | |
| *** topol has quit IRC | 21:49 | |
| *** tqtran has joined #openstack-keystone | 21:52 | |
| *** vilobhmm11 has quit IRC | 21:53 | |
| *** markvoelker has joined #openstack-keystone | 21:53 | |
| *** bknudson has quit IRC | 21:54 | |
| *** tqtran has quit IRC | 21:57 | |
| *** markvoelker has quit IRC | 21:58 | |
| *** _cjones_ has quit IRC | 22:24 | |
| *** _cjones_ has joined #openstack-keystone | 22:37 | |
| *** gordc has quit IRC | 22:45 | |
| *** markvoelker_ has joined #openstack-keystone | 22:53 | |
| *** zzzeek has quit IRC | 23:01 | |
| *** erkules_ is now known as erkules | 23:03 | |
| *** chlong has joined #openstack-keystone | 23:11 | |
| jamielennox | what's the point of memcaching the data of a PKI token? do we do that on purpose? | 23:16 |
| *** mhu has quit IRC | 23:16 | |
| *** mhu has joined #openstack-keystone | 23:16 | |
| dstanek | jamielennox: we get it out of cache even though we have the actual data already? | 23:25 |
| jamielennox | it appears that we do memcache instead of just validating the PKI token | 23:25 |
| jamielennox | i would think time difference would be negligable | 23:26 |
| *** drjones has joined #openstack-keystone | 23:31 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove unused policy rule for get_trust https://review.openstack.org/174155 | 23:33 |
| *** mestery_ has joined #openstack-keystone | 23:33 | |
| *** j_king_ has joined #openstack-keystone | 23:34 | |
| *** luminalf1ux has joined #openstack-keystone | 23:34 | |
| *** HenryG_ has joined #openstack-keystone | 23:35 | |
| dstanek | jamielennox: that's an interesting decision. so that means we must have memcached installed? | 23:37 |
| jamielennox | no, i think if memcache isn't available it's ignored | 23:37 |
| *** nonameentername has joined #openstack-keystone | 23:38 | |
| *** _cjones_ has quit IRC | 23:38 | |
| *** luminalflux has quit IRC | 23:38 | |
| *** j_king has quit IRC | 23:38 | |
| *** grantbow has quit IRC | 23:38 | |
| *** arunkant has quit IRC | 23:38 | |
| *** HenryG has quit IRC | 23:38 | |
| *** bigjools has quit IRC | 23:38 | |
| *** bigjools_ has joined #openstack-keystone | 23:38 | |
| *** cburgess_ has joined #openstack-keystone | 23:38 | |
| *** vhoward- has joined #openstack-keystone | 23:38 | |
| *** markvoelker has joined #openstack-keystone | 23:39 | |
| *** vhoward has quit IRC | 23:39 | |
| *** _nonameentername has quit IRC | 23:39 | |
| *** mestery has quit IRC | 23:39 | |
| *** cburgess has quit IRC | 23:39 | |
| *** arunkant has joined #openstack-keystone | 23:39 | |
| *** bigjools_ is now known as bigjools | 23:39 | |
| *** markvoelker_ has quit IRC | 23:40 | |
| *** bigjools has quit IRC | 23:40 | |
| *** bigjools has joined #openstack-keystone | 23:40 | |
| *** markvoelker has quit IRC | 23:40 | |
| *** markvoelker has joined #openstack-keystone | 23:40 | |
| *** markvoelker_ has joined #openstack-keystone | 23:41 | |
| *** grantbow has joined #openstack-keystone | 23:41 | |
| *** grantbow has joined #openstack-keystone | 23:41 | |
| *** markvoelker has quit IRC | 23:45 | |
| *** tqtran_afk is now known as tqtran | 23:57 | |
| *** mattamizer has joined #openstack-keystone | 23:58 | |
| *** wolsen_ is now known as wolsen | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!