| morganfainberg | alphabetizing* | 00:00 |
|---|---|---|
| jamielennox | morganfainberg: infra patch is supposed to have a Depends-On: the governance patch | 00:00 |
| morganfainberg | jamielennox, feel free to add it if you want, i'll circle back on it tonight | 00:00 |
| morganfainberg | laptop is about to die and i need food. | 00:00 |
| jamielennox | morganfainberg: ok, i just did a few infra ones recently | 00:01 |
| jamielennox | this is really simple: https://review.openstack.org/#/c/174195/ - can we +a it so maybe gerrit will let me rebase the rest of the chain | 00:02 |
| jamielennox | gerrit freaked out by reorganizing a patch set | 00:03 |
| *** bknudson has joined #openstack-keystone | 00:05 | |
| *** ChanServ sets mode: +v bknudson | 00:05 | |
| *** alexsyip has quit IRC | 00:07 | |
| *** openstackgerrit has quit IRC | 00:22 | |
| *** openstackgerrit has joined #openstack-keystone | 00:22 | |
| *** _cjones_ has quit IRC | 00:26 | |
| *** _cjones_ has joined #openstack-keystone | 00:28 | |
| *** arif-ali has joined #openstack-keystone | 00:33 | |
| *** _cjones_ has quit IRC | 00:34 | |
| *** openstack has joined #openstack-keystone | 00:35 | |
| *** spandhe has quit IRC | 00:43 | |
| *** gyee has quit IRC | 00:46 | |
| *** tqtran has quit IRC | 00:53 | |
| *** browne has quit IRC | 00:59 | |
| *** zzzeek has quit IRC | 01:01 | |
| *** wangh has joined #openstack-keystone | 01:29 | |
| *** _cjones_ has joined #openstack-keystone | 01:29 | |
| *** _cjones_ has quit IRC | 01:34 | |
| *** erkules_ has joined #openstack-keystone | 01:39 | |
| *** erkules has quit IRC | 01:41 | |
| *** browne has joined #openstack-keystone | 01:42 | |
| *** thedodd has quit IRC | 01:53 | |
| *** _cjones_ has joined #openstack-keystone | 02:31 | |
| *** _cjones_ has quit IRC | 02:35 | |
| *** harlowja is now known as harlowja_away | 02:35 | |
| *** harlowja_away is now known as harlowja | 02:37 | |
| *** stevemar has joined #openstack-keystone | 02:39 | |
| *** ChanServ sets mode: +v stevemar | 02:39 | |
| *** lhcheng has quit IRC | 02:54 | |
| stevemar | morganfainberg, o | 03:19 |
| stevemar | morganfainberg, o/ | 03:19 |
| morganfainberg | stevemar, o/ | 03:20 |
| stevemar | morganfainberg, want to review a slide deck? :P | 03:20 |
| morganfainberg | suuuuurrreeee | 03:20 |
| morganfainberg | i'd love to >.> | 03:20 |
| *** lhcheng has joined #openstack-keystone | 03:22 | |
| *** ChanServ sets mode: +v lhcheng | 03:22 | |
| *** _cjones_ has joined #openstack-keystone | 03:37 | |
| *** _cjones_ has quit IRC | 03:42 | |
| *** ajayaa has joined #openstack-keystone | 03:54 | |
| *** harlowja is now known as harlowja_away | 03:56 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Remove retry parameter https://review.openstack.org/174195 | 03:57 |
| *** ajayaa has quit IRC | 04:08 | |
| *** ayoung_ has quit IRC | 04:10 | |
| *** iamjarvo has joined #openstack-keystone | 04:14 | |
| *** lhcheng has quit IRC | 04:21 | |
| *** ishant has joined #openstack-keystone | 04:26 | |
| *** spandhe has joined #openstack-keystone | 04:27 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Fetch user token from request rather than env https://review.openstack.org/174202 | 04:29 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove the _msg_format function https://review.openstack.org/174201 | 04:29 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Base use webob https://review.openstack.org/174200 | 04:29 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't rely on token_info for header building https://review.openstack.org/174199 | 04:29 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Move project included validation https://review.openstack.org/174198 | 04:29 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Depend on keystoneclient for expiration checking https://review.openstack.org/174197 | 04:29 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't store expire into memcache https://review.openstack.org/174196 | 04:29 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Cleanup token hashes generated by cache https://review.openstack.org/174194 | 04:29 |
| *** _cjones_ has joined #openstack-keystone | 04:38 | |
| *** richm has quit IRC | 04:38 | |
| *** _cjones_ has quit IRC | 04:44 | |
| *** spandhe has quit IRC | 04:55 | |
| *** rm_work|away is now known as rm_work | 04:59 | |
| *** lhcheng has joined #openstack-keystone | 05:07 | |
| *** ChanServ sets mode: +v lhcheng | 05:07 | |
| *** ajayaa has joined #openstack-keystone | 05:25 | |
| *** lhcheng_ has joined #openstack-keystone | 05:26 | |
| *** lhcheng has quit IRC | 05:29 | |
| *** wangh has quit IRC | 05:30 | |
| *** wangh has joined #openstack-keystone | 05:31 | |
| *** iamjarvo has quit IRC | 05:31 | |
| *** afazekas has quit IRC | 05:31 | |
| *** wangh has quit IRC | 05:33 | |
| *** iamjarvo has joined #openstack-keystone | 05:37 | |
| *** _cjones_ has joined #openstack-keystone | 05:41 | |
| *** lhcheng_ has quit IRC | 05:52 | |
| *** iamjarvo has quit IRC | 05:54 | |
| *** ishant has quit IRC | 06:05 | |
| *** lhcheng has joined #openstack-keystone | 06:18 | |
| *** ChanServ sets mode: +v lhcheng | 06:18 | |
| *** _cjones_ has quit IRC | 06:19 | |
| *** afazekas_ has joined #openstack-keystone | 06:21 | |
| *** krykowski has joined #openstack-keystone | 06:29 | |
| *** jamielennox is now known as jamielennox|away | 06:34 | |
| *** mabrams has joined #openstack-keystone | 06:41 | |
| *** lhcheng has quit IRC | 06:51 | |
| *** mestery has quit IRC | 07:03 | |
| *** browne has quit IRC | 07:06 | |
| *** pcaruana has quit IRC | 07:11 | |
| *** arif-ali has quit IRC | 07:20 | |
| *** arif-ali has joined #openstack-keystone | 07:21 | |
| *** jaosorior has joined #openstack-keystone | 07:22 | |
| *** amerine has joined #openstack-keystone | 07:23 | |
| *** unixlike has quit IRC | 07:27 | |
| *** unixlike has joined #openstack-keystone | 07:27 | |
| *** afazekas_ has quit IRC | 07:32 | |
| *** henrynash has joined #openstack-keystone | 07:34 | |
| *** ChanServ sets mode: +v henrynash | 07:34 | |
| *** afazekas_ has joined #openstack-keystone | 07:36 | |
| *** henrynash has quit IRC | 07:38 | |
| *** jamielennox|away is now known as jamielennox | 07:43 | |
| *** henrynash has joined #openstack-keystone | 07:45 | |
| *** ChanServ sets mode: +v henrynash | 07:45 | |
| *** mestery has joined #openstack-keystone | 07:46 | |
| *** jistr has joined #openstack-keystone | 07:47 | |
| *** stevemar has quit IRC | 07:49 | |
| *** erkules_ is now known as erkules | 07:53 | |
| *** erkules has joined #openstack-keystone | 07:53 | |
| *** amerine has quit IRC | 07:58 | |
| breton | hello, keystoneers | 08:24 |
| *** marekd has joined #openstack-keystone | 08:29 | |
| *** ChanServ sets mode: +v marekd | 08:29 | |
| marekd | Good morning! | 08:29 |
| openstackgerrit | Dhriti Shikhar proposed openstack/python-keystoneclient: Fixes example code in Using Sessions page https://review.openstack.org/175135 | 08:47 |
| openstackgerrit | Dhriti Shikhar proposed openstack/python-keystoneclient: Fixes example code in Using Sessions page https://review.openstack.org/175135 | 08:48 |
| *** fhubik has joined #openstack-keystone | 08:50 | |
| openstackgerrit | Dhriti Shikhar proposed openstack/python-keystoneclient: Fixes example code in Using Sessions page https://review.openstack.org/175135 | 08:50 |
| *** unixlike has quit IRC | 08:52 | |
| *** unixlike has joined #openstack-keystone | 08:52 | |
| *** f13o has joined #openstack-keystone | 08:54 | |
| *** pnavarro has joined #openstack-keystone | 08:55 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 09:03 |
| *** fhubik is now known as fhubik_afk | 09:06 | |
| *** krykowski has quit IRC | 09:09 | |
| *** fhubik_afk is now known as fhubik | 09:30 | |
| *** pnavarro has quit IRC | 09:41 | |
| *** _cjones_ has joined #openstack-keystone | 09:51 | |
| *** _cjones_ has quit IRC | 09:55 | |
| *** boris-42 has quit IRC | 10:05 | |
| *** boris-42 has joined #openstack-keystone | 10:08 | |
| *** unixlike has quit IRC | 10:08 | |
| *** davidckennedy has joined #openstack-keystone | 10:30 | |
| *** krykowski has joined #openstack-keystone | 10:37 | |
| *** fhubik is now known as fhubik_afk | 10:40 | |
| marekd | mhu: re: https://review.openstack.org/#/c/157821/ Hi. Do you think you want to finish this patch and address bknudson's comments? | 10:40 |
| mhu | marekd, right ! I'll get to it today, sorry for letting this go unattended for so long | 10:57 |
| *** baffle has joined #openstack-keystone | 10:58 | |
| *** jistr has quit IRC | 11:02 | |
| *** jistr has joined #openstack-keystone | 11:04 | |
| *** f13o has quit IRC | 11:10 | |
| samueldmq | morning | 11:15 |
| *** jdennis has quit IRC | 11:16 | |
| *** jdennis has joined #openstack-keystone | 11:19 | |
| baffle | I'm looking at the policy.json/policy.v3cloudsample.json in git, and I can't understand why identity:create_credential and similar are admin only? Shouldn't they match identity:ec2_list_credentials ? Because this is bascially the same functionality, right? | 11:36 |
| *** _cjones_ has joined #openstack-keystone | 11:40 | |
| *** _cjones_ has quit IRC | 11:47 | |
| *** jsheeren has quit IRC | 11:50 | |
| *** fhubik_afk is now known as fhubik | 11:53 | |
| *** markvoelker has joined #openstack-keystone | 12:02 | |
| *** markvoelker_ has joined #openstack-keystone | 12:03 | |
| *** markvoelker_ has quit IRC | 12:04 | |
| *** markvoelker_ has joined #openstack-keystone | 12:05 | |
| *** raildo has joined #openstack-keystone | 12:06 | |
| *** markvoelker has quit IRC | 12:07 | |
| *** richm has joined #openstack-keystone | 12:10 | |
| *** aix has joined #openstack-keystone | 12:21 | |
| *** pnavarro has joined #openstack-keystone | 12:23 | |
| *** gordc has joined #openstack-keystone | 12:34 | |
| *** henrynash has quit IRC | 12:42 | |
| *** jistr has quit IRC | 12:42 | |
| *** jistr has joined #openstack-keystone | 12:43 | |
| *** ajayaa has quit IRC | 12:52 | |
| *** bknudson has quit IRC | 12:53 | |
| *** pnavarro has quit IRC | 13:00 | |
| *** jistr is now known as jistr|mtg | 13:01 | |
| *** joesavak has joined #openstack-keystone | 13:04 | |
| *** henrynash has joined #openstack-keystone | 13:08 | |
| *** ChanServ sets mode: +v henrynash | 13:08 | |
| *** kiran-r has joined #openstack-keystone | 13:11 | |
| marekd | mhu: ok, thanks | 13:12 |
| *** richm has quit IRC | 13:12 | |
| *** henrynash has quit IRC | 13:13 | |
| *** bknudson has joined #openstack-keystone | 13:16 | |
| *** ChanServ sets mode: +v bknudson | 13:16 | |
| *** ayoung_ has joined #openstack-keystone | 13:19 | |
| *** richm has joined #openstack-keystone | 13:23 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: New attributes for SAML assertion https://review.openstack.org/174462 | 13:27 |
| openstackgerrit | Julien Danjou proposed openstack/keystone: Revert "Optimization of waiting subprocesses in ProcessLauncher""" https://review.openstack.org/175857 | 13:30 |
| *** kiran-r has quit IRC | 13:37 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: New attributes for SAML assertion https://review.openstack.org/174462 | 13:39 |
| *** zzzeek has joined #openstack-keystone | 13:39 | |
| *** EmilienM has quit IRC | 13:40 | |
| *** EmilienM has joined #openstack-keystone | 13:41 | |
| *** mabrams has quit IRC | 13:44 | |
| *** lhcheng has joined #openstack-keystone | 13:53 | |
| *** ChanServ sets mode: +v lhcheng | 13:53 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:04 | |
| *** afazekas_ has quit IRC | 14:08 | |
| raildo | dstanek, We still having a problem here: https://review.openstack.org/#/c/158720/12 :P because the get_project have the @controller.protected(), so even we raise a ValidationError in the controller, this decorator will raise a 404 before the our validation | 14:15 |
| *** carlosmarin has joined #openstack-keystone | 14:16 | |
| *** iamjarvo has joined #openstack-keystone | 14:18 | |
| raildo | dstanek, so I think that we can put a validation(to don't accept None) in the get_project in the manager and raise a ProjectNotFound, and we can think in other solution to raise a ValidationError in the controller | 14:18 |
| *** iamjarvo has quit IRC | 14:18 | |
| *** iamjarvo has joined #openstack-keystone | 14:19 | |
| *** iamjarvo has quit IRC | 14:19 | |
| *** iamjarvo has joined #openstack-keystone | 14:20 | |
| *** jistr|mtg is now known as jistr | 14:26 | |
| *** browne has joined #openstack-keystone | 14:30 | |
| *** rushil has joined #openstack-keystone | 14:31 | |
| *** iamjarvo has quit IRC | 14:36 | |
| *** iamjarvo has joined #openstack-keystone | 14:38 | |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Inhrerit roles project calls on keystoneclient v3 https://review.openstack.org/167613 | 14:41 |
| dstanek | raildo: really? i guess i need to look into the protected decorator a little bit. that seems off | 14:45 |
| *** _cjones_ has joined #openstack-keystone | 14:46 | |
| *** iamjarvo has quit IRC | 14:48 | |
| raildo | dstanek, the protected decorator call this: https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L124 | 14:48 |
| raildo | dstanek, and then here: https://github.com/openstack/keystone/blob/master/keystone/resource/controllers.py#L197 | 14:48 |
| raildo | dstanek, and this will raise a 404 | 14:49 |
| *** mattfarina has joined #openstack-keystone | 14:50 | |
| *** _cjones_ has quit IRC | 14:51 | |
| openstackgerrit | Doug Hellmann proposed openstack/keystonemiddleware: Update README to work with release tools https://review.openstack.org/175913 | 14:55 |
| *** iamjarvo has joined #openstack-keystone | 14:55 | |
| *** stevemar has joined #openstack-keystone | 14:58 | |
| *** ChanServ sets mode: +v stevemar | 14:58 | |
| *** pnavarro has joined #openstack-keystone | 15:01 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Materialized path for project hierarchy https://review.openstack.org/173424 | 15:03 |
| dstanek | raildo: I'm confused now. it's OK if get_project returns a 404 for a project that doesn't exist, right? | 15:09 |
| rodrigods | dstanek, ++ and also if we do get_project(None), it needs to validate the None case and raise a ProjectNotFound as well | 15:11 |
| *** mestery has quit IRC | 15:11 | |
| rodrigods | so for list_projects* we would add just the get_project() | 15:12 |
| *** mestery has joined #openstack-keystone | 15:12 | |
| dstanek | rodrigods: isn't that what the patch is already doing? | 15:12 |
| rodrigods | dstanek, almost, in patchset 10 there is an assert method the first validates the None and raises a ValidationError for this case, and then does the get_project() | 15:13 |
| *** fhubik has quit IRC | 15:13 | |
| *** krykowski has quit IRC | 15:14 | |
| dstanek | The thing I don't like about doing the get_project is that is does yet another query, but if that's the best we can do I don't know another way. | 15:14 |
| rodrigods | ++ | 15:15 |
| dstanek | i think i found a bug in that code | 15:15 |
| dstanek | hmm | 15:16 |
| *** amerine has joined #openstack-keystone | 15:17 | |
| *** jsavak has joined #openstack-keystone | 15:26 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Recursive deletion https://review.openstack.org/148730 | 15:28 |
| *** joesavak has quit IRC | 15:29 | |
| *** edmondsw has joined #openstack-keystone | 15:33 | |
| *** pnavarro has quit IRC | 15:34 | |
| *** browne has quit IRC | 15:35 | |
| *** david-lyle has quit IRC | 15:36 | |
| *** gyee has joined #openstack-keystone | 15:50 | |
| *** ChanServ sets mode: +v gyee | 15:50 | |
| *** david-lyle has joined #openstack-keystone | 16:02 | |
| *** haneef has quit IRC | 16:03 | |
| davidckennedy | gyee Many thanks. You're going to love my comment on the spec. | 16:04 |
| gyee | it's *love* Tuesday | 16:06 |
| davidckennedy | Well, it's been *stay awake* Tuesday for me. But I've succeeded and it's home time now. Ta ra. | 16:08 |
| *** davidckennedy has quit IRC | 16:08 | |
| *** _cjones_ has joined #openstack-keystone | 16:09 | |
| *** haneef has joined #openstack-keystone | 16:09 | |
| *** tqtran has joined #openstack-keystone | 16:13 | |
| *** iamjarvo has quit IRC | 16:20 | |
| *** jistr has quit IRC | 16:21 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Recursive deletion https://review.openstack.org/148730 | 16:27 |
| *** joesavak has joined #openstack-keystone | 16:34 | |
| *** jsavak has quit IRC | 16:37 | |
| *** iamjarvo has joined #openstack-keystone | 16:37 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Correctly handle direct mapping with keywords https://review.openstack.org/175980 | 16:39 |
| *** browne has joined #openstack-keystone | 16:43 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Add spec for decoupling auth from API versions to backlog https://review.openstack.org/175983 | 16:47 |
| raildo | Can anyone +A on this bug? there is already 2 +2 on that. :) https://review.openstack.org/#/c/159944/ | 16:47 |
| *** tqtran has quit IRC | 16:48 | |
| *** harlowja_away is now known as harlowja | 16:57 | |
| gyee | raildo, done | 16:58 |
| raildo | gyee, thanks :D | 16:58 |
| *** joesavak has quit IRC | 17:01 | |
| *** _cjones_ has quit IRC | 17:04 | |
| *** _cjones_ has joined #openstack-keystone | 17:07 | |
| *** david-lyle has quit IRC | 17:08 | |
| *** ayoung_ is now known as ayoung_admiyo | 17:14 | |
| *** ayoung_admiyo is now known as ayoung | 17:15 | |
| *** sdake has joined #openstack-keystone | 17:28 | |
| gordc | bknudson: just an fyi, i can't actually create a stable/juno branch for pycadf but i can make a release. might need dhellmann et al to create branch. | 17:28 |
| *** ajayaa has joined #openstack-keystone | 17:29 | |
| bknudson | gordc: I assume you need infra to create it for you. | 17:30 |
| baffle | I'm looking at the policy.json/policy.v3cloudsample.json in git, and I can't understand why identity:create_credential and similar are admin only? Shouldn't they match identity:ec2_list_credentials ? Because this is bascially the same functionality, right? Just v2.0 vs v3? | 17:31 |
| gordc | bknudson: yeah. i know there's a group which allows you to create branches via gerrit... i dont' know what it is though. 'a group that Doug is part of' is all i know. | 17:34 |
| bknudson | that guy loves hoarding power. | 17:35 |
| gordc | lol | 17:35 |
| dhellmann | gordc, bknudson : do you need a stable/juno branch of pycadf? | 17:36 |
| *** rdo has quit IRC | 17:36 | |
| *** tpatil has joined #openstack-keystone | 17:37 | |
| bknudson | dhellmann: gordc was thinking that we could modify stable/juno version of pycadf to not have oslo.messaging in requirements. | 17:37 |
| *** aix has quit IRC | 17:37 | |
| bknudson | or even just have the stable/juno cap of oslo.messaging should work, too. | 17:37 |
| bknudson | this is so that stable/juno keystonemiddleware will work. | 17:38 |
| gordc | dhellmann: http://lists.openstack.org/pipermail/openstack-dev/2015-April/062115.html | 17:38 |
| dhellmann | bknudson: what's failing right now? | 17:38 |
| dhellmann | gordc: ah, I haven't opened that thread yet, reading now | 17:38 |
| bknudson | dhellmann: https://review.openstack.org/#/c/173123/ | 17:38 |
| *** rdo has joined #openstack-keystone | 17:38 | |
| gordc | dhellmann: it's not the only option (as bknudson mentions) but i assume we'll need a stable/juno for pycadf eventually. | 17:39 |
| dhellmann | gordc, bknudson : ok I think you don't want to move that dependency, because it makes what is a test requirement a runtime requirement | 17:40 |
| dhellmann | gordc, bknudson : let me finish with the library release stuff, and then I'll see if I can help you sort this out. | 17:41 |
| bknudson | dhellmann: since pycadf is a runtime requirement already and pycadf has oslo.messaging as a runtime requirement then it's already a run-time requirement. | 17:41 |
| bknudson | but i'm also fine with a change to pycadf. | 17:41 |
| dhellmann | bknudson: yes, true, but it makes a change to the *package* metadata that we should try to avoid if we can | 17:41 |
| dhellmann | because adding it as a runtime dependency will mess with our packager's existing workflows, and should technically trigger a version # change that would move the package out of the juno series | 17:42 |
| bknudson | another option is to move pycadf from requirements.txt to test-requirements... but that would also be lying. | 17:43 |
| *** spandhe has joined #openstack-keystone | 17:43 | |
| bknudson | maybe this repo should be split up | 17:43 |
| gordc | bknudson: pycadf? | 17:43 |
| bknudson | keystonemiddleware | 17:44 |
| *** iamjarvo has quit IRC | 17:44 | |
| gordc | ah i see... if the oslo.messaging req is the concern i should give a headsup. that functionality is deprecated and i was going to drop it as of 1.0 (assuming everyone is ok with that) | 17:44 |
| bknudson | it's not oslo.messaging, it's just that the different middleware in keystonemiddleware is really different. | 17:45 |
| bknudson | auth_token is obviously different than ec2_token and s3_token and audit... they're all going to have different required packages. | 17:45 |
| bknudson | it's only audit that needs pycadf. | 17:46 |
| gordc | bknudson: i see. yeah, i'll let you guys decide that. :) | 17:46 |
| bknudson | ec2_token and s3_token are actually lightweight for requirements, so maybe not worth it to move those out. | 17:47 |
| *** Alexander has joined #openstack-keystone | 17:50 | |
| morganfainberg | bknudson: splitting it up isn't a bad idea | 17:51 |
| *** Alexander is now known as Guest40160 | 17:51 | |
| morganfainberg | bknudson: with the move to middleware releasing with the servers, it is easier to do. | 17:51 |
| morganfainberg | stevemar: ping | 17:51 |
| *** Guest40160 has quit IRC | 17:52 | |
| *** amakarov_ has joined #openstack-keystone | 17:52 | |
| *** samueldmq has quit IRC | 17:53 | |
| stevemar | morganfainberg, pong | 17:53 |
| *** samueldmq_ has joined #openstack-keystone | 17:53 | |
| morganfainberg | Mind chairing the meeting? | 17:53 |
| *** samueldmq_ is now known as samueldmq | 17:53 | |
| morganfainberg | Trying to cram food in before. | 17:53 |
| morganfainberg | I'll be there just hard to type while mobile and run the meeting. | 17:53 |
| stevemar | sure | 17:54 |
| stevemar | while mobile and eating | 17:54 |
| stevemar | hehe | 17:54 |
| morganfainberg | Haha | 17:54 |
| morganfainberg | I can do it if it's an issue. | 17:54 |
| morganfainberg | I've done it before. Just food was really slow today. | 17:54 |
| *** lhcheng_ has joined #openstack-keystone | 17:57 | |
| stevemar | its cool | 17:57 |
| *** davechen has joined #openstack-keystone | 17:58 | |
| *** joesavak has joined #openstack-keystone | 17:59 | |
| dstanek | is it possible to create a circular reference of projects? | 17:59 |
| morganfainberg | dstanek: should not be possible. | 18:00 |
| *** lhcheng has quit IRC | 18:00 | |
| dstanek | morganfainberg: that's what i thought. couldn't update the parent_id :-( | 18:00 |
| dstanek | then i guess it's not a big deal that there is a bug in how to do subtree listings | 18:01 |
| *** lhcheng_ is now known as lhcheng | 18:01 | |
| *** ChanServ sets mode: +v lhcheng | 18:01 | |
| rodrigods | dstanek, it is not possible | 18:02 |
| rodrigods | where is the bug? | 18:02 |
| dstanek | rodrigods: there is two. jas... | 18:03 |
| *** Ephur_ has joined #openstack-keystone | 18:04 | |
| dstanek | bug1: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/resource/backends/sql.py#n97 | 18:04 |
| *** jamesllondon has joined #openstack-keystone | 18:04 | |
| dstanek | bug2: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/resource/backends/sql.py#n109 | 18:04 |
| rodrigods | dstanek, hmm | 18:05 |
| *** Ephur has quit IRC | 18:05 | |
| rodrigods | dstanek, can you explain? | 18:05 |
| dstanek | set('ab') will create set(['a', 'b | 18:06 |
| dstanek | ]']) | 18:06 |
| dstanek | should be set([project_id]) | 18:06 |
| dstanek | and set.union returns a new set; should be set.update() | 18:06 |
| dstanek | rodrigods: we're just Pythoning wrong :-( | 18:08 |
| rodrigods | dstanek, wow | 18:08 |
| rodrigods | thanks for that | 18:08 |
| rodrigods | will add to my "learning python" doc | 18:09 |
| rodrigods | did you submit a fix? | 18:09 |
| *** Ephur_ has quit IRC | 18:09 | |
| *** sdake_ has joined #openstack-keystone | 18:09 | |
| dstanek | not yet because i wasn't sure if we could just delete it | 18:09 |
| dstanek | i created the fix, but i couldn't test because you can't create cycles | 18:10 |
| bknudson | jamielennox: have you seen this stuff in neutron: http://git.openstack.org/cgit/openstack/neutron/tree/etc/neutron.conf#n340 ? | 18:10 |
| dstanek | davechen: we talked about the unique constraint yesterday. can't be added | 18:11 |
| rodrigods | dstanek, the very reason why the bug was merged :( | 18:11 |
| dstanek | should that code just be deleted then? | 18:11 |
| jamielennox | bknudson: maybe it needs to regenerate the conf file (though that looks hand crafted) because i'm sure neturon->nova got finished | 18:11 |
| rodrigods | dstanek, henrynash had a strong preference to have this checks | 18:12 |
| rodrigods | in the first patchsets we didn't add | 18:12 |
| rodrigods | I added after henrynash comments | 18:12 |
| *** sdake has quit IRC | 18:13 | |
| *** jeffDeville has joined #openstack-keystone | 18:14 | |
| *** notmyname has quit IRC | 18:16 | |
| *** notmyname has joined #openstack-keystone | 18:17 | |
| *** jeffDeville has quit IRC | 18:31 | |
| *** jeffDeville has joined #openstack-keystone | 18:31 | |
| *** tqtran has joined #openstack-keystone | 18:32 | |
| *** alexsyip has joined #openstack-keystone | 18:32 | |
| *** openstackgerrit has quit IRC | 18:37 | |
| *** openstackgerrit has joined #openstack-keystone | 18:37 | |
| *** joesavak has quit IRC | 18:38 | |
| *** david-lyle has joined #openstack-keystone | 18:39 | |
| *** pnavarro has joined #openstack-keystone | 18:42 | |
| *** bandwidth has joined #openstack-keystone | 18:42 | |
| *** joesavak has joined #openstack-keystone | 18:42 | |
| bandwidth | quick question: I have the OS-FEDERATION extension activated | 18:43 |
| bandwidth | i get an unscoped token, from which i get a scoped token | 18:43 |
| bandwidth | when I hit nova, nova is trying to validate the token using v2 api | 18:43 |
| bandwidth | which leads to: if (token_ref['token_data']['token']['user']['domain']['id'] != | 18:44 |
| bandwidth | KeyError: 'domain' | 18:44 |
| bandwidth | I've configured nova to use keystone v3 api, but still, it ends up in: validate_v2_token | 18:45 |
| bandwidth | I also removed all the v2 endpoints, but I still have the same issue | 18:45 |
| *** david-ly_ has joined #openstack-keystone | 18:46 | |
| *** david-lyle has quit IRC | 18:46 | |
| *** akerr has joined #openstack-keystone | 18:46 | |
| bandwidth | is there anything i'm missing? | 18:47 |
| bandwidth | all the documentation I can find talks about configuring keystone with an IdP | 18:48 |
| bandwidth | but nothing about the other services that needs keystone to validate tokens | 18:48 |
| stevemar | bandwidth, most keystone folks are in the keystone meeting | 18:48 |
| stevemar | just chill for a bit longer, it's done in 10 minutes :) | 18:48 |
| akerr | Is anyone else seeing conflicting requirements in stable/juno devstack builds? If i'm reading devstack's log right, keystone wants stevedore <=1.2.0 but keystone_middleware wants stevedore >=1.3.0 | 18:49 |
| akerr | here's a link to my logs, the devstacklog.txt.gz file has the interesting bits: http://dcf901611175aa43f968-c54047c910227e27e1d6f03bb1796fd7.r95.cf5.rackcdn.com/09/175909/1/check/cDOT-iSCSI-tempest-openstack/54711c1/ | 18:51 |
| *** jeffDevi_ has joined #openstack-keystone | 18:51 | |
| *** jeffDeville has quit IRC | 18:52 | |
| *** jeffDeville has joined #openstack-keystone | 18:53 | |
| *** jeffDevi_ has quit IRC | 18:56 | |
| *** tqtran has quit IRC | 18:56 | |
| *** bandwidth has quit IRC | 18:57 | |
| anteaya | marekd: let's ensure language is inclusive, I'm personally not a fan of swearing | 18:58 |
| marekd | anteaya: sure, sorry. | 18:58 |
| anteaya | thanks | 18:58 |
| morganfainberg | anteaya, hi!! :) | 19:00 |
| anteaya | hey there | 19:00 |
| morganfainberg | keystone-core members: | 19:00 |
| morganfainberg | https://blueprints.launchpad.net/keystone/+spec/stevedore | 19:00 |
| marekd | stevemar: morganfainberg so you want to push this MFA still ? | 19:00 |
| morganfainberg | does this need a spec? i'm ok with it as is. | 19:00 |
| *** jeffDevi_ has joined #openstack-keystone | 19:01 | |
| morganfainberg | no spec needed imo | 19:01 |
| marekd | morganfainberg: ++ | 19:01 |
| *** jeffDeville has quit IRC | 19:01 | |
| morganfainberg | anyone have complaints about that bp going spec-less? | 19:02 |
| jamielennox | morganfainberg: yep, no-spec | 19:02 |
| gyee | MFA is a concept | 19:02 |
| morganfainberg | gyee, dstanek, ayoung, dolphm, lhcheng, stevemar, ^ | 19:03 |
| lhcheng | morganfainberg: fine with me, it doesn't impact end user directly | 19:03 |
| stevemar | oh heck no | 19:03 |
| gyee | what we talking about MFA support, it needs to be more specific | 19:03 |
| stevemar | i mean 'oh heck no complaints' | 19:03 |
| morganfainberg | stevemar, hehe | 19:03 |
| ayoung | Museum of Fine Arts? | 19:03 |
| morganfainberg | ayoung, Master of Fine Arts | 19:03 |
| stevemar | if someone wants to use a new library to make our code better, then no spec needed | 19:04 |
| lhcheng | ++ | 19:04 |
| *** leonchio_ has joined #openstack-keystone | 19:04 | |
| dolphm | morganfainberg: this change needs to be communicated super well though https://review.openstack.org/#/c/166622/11/keystone/common/config.py | 19:04 |
| dolphm | morganfainberg: release notes, documentation, etc | 19:04 |
| morganfainberg | dolphm, yes. | 19:04 |
| dolphm | morganfainberg: the rest of it doesn't matter to end users | 19:04 |
| morganfainberg | dolphm, it does however support the old-style loading as a fallback | 19:04 |
| ayoung | MFA needs a spec | 19:04 |
| gyee | ++ | 19:04 |
| morganfainberg | ayoung, this was re-stevedore loading, MFA does need a spec | 19:05 |
| ayoung | if it is doing something keystone specific | 19:05 |
| stevemar | dolphm, morganfainberg is there a way to still support the old values? | 19:05 |
| gyee | password + blood test | 19:05 |
| morganfainberg | stevemar, the code already does. | 19:05 |
| stevemar | then we're good | 19:05 |
| ayoung | stevedore is ok, I think | 19:05 |
| morganfainberg | stevemar, it tries loading stevedroe and fails back to loading old style import | 19:05 |
| morganfainberg | stevemar, which is deprecated and will warn | 19:05 |
| *** amakarov_ has quit IRC | 19:05 | |
| morganfainberg | stevemar, in M we can remove that old code path | 19:05 |
| morganfainberg | no more fallback | 19:05 |
| *** davechen has left #openstack-keystone | 19:06 | |
| morganfainberg | bknudson, ^ I think we're good then. please update the BP and reference this eavesdrop. | 19:06 |
| morganfainberg | bknudson, move forward w/o a spec. | 19:06 |
| bknudson | morganfainberg: ok, thanks. | 19:06 |
| morganfainberg | 2 more no-spec items: | 19:06 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1442343 | 19:06 |
| openstack | Launchpad bug 1442343 in Keystone "Mapping openstack_project attribute in k2k assertions with different domains" [Wishlist,In progress] - Assigned to Rodrigo Duarte (rodrigodsousa) | 19:06 |
| morganfainberg | and https://bugs.launchpad.net/keystone/+bug/1442787 | 19:06 |
| openstack | Launchpad bug 1442787 in Keystone "Mapping openstack_user attribute in k2k assertions with different domains" [Wishlist,In progress] - Assigned to Rodrigo Duarte (rodrigodsousa) | 19:06 |
| morganfainberg | if one needs a spec, so does the other | 19:07 |
| *** sdake has joined #openstack-keystone | 19:07 | |
| *** ajayaa has quit IRC | 19:07 | |
| morganfainberg | oh ha | 19:07 |
| morganfainberg | we have a spec: https://review.openstack.org/#/c/174462/ | 19:07 |
| morganfainberg | ok going to drop these from the list. | 19:07 |
| morganfainberg | please review that spec^ | 19:08 |
| stevemar | will review | 19:08 |
| *** _cjones_ has quit IRC | 19:09 | |
| *** jeffDevi_ has quit IRC | 19:10 | |
| marekd | morganfainberg: so i think the change is not that hard, spec can help the visibility | 19:10 |
| *** iamjarvo has joined #openstack-keystone | 19:10 | |
| *** iamjarvo has quit IRC | 19:10 | |
| morganfainberg | marekd, right | 19:10 |
| morganfainberg | marekd, since the spec was proposed we'll run with it. | 19:11 |
| marekd | morganfainberg: ok | 19:11 |
| *** iamjarvo has joined #openstack-keystone | 19:11 | |
| *** sdake_ has quit IRC | 19:11 | |
| *** jeffDeville has joined #openstack-keystone | 19:11 | |
| *** jeffDevi_ has joined #openstack-keystone | 19:15 | |
| stevemar | ayoung, is nkinder afk this week? | 19:16 |
| ayoung | stevemar, conference I think | 19:16 |
| *** jeffDeville has quit IRC | 19:16 | |
| david8hu | ayoung, I like to contribute to dynamic policy, and started to review other specs that dynamic policy dependeds on. | 19:17 |
| ayoung | david8hu, awesome | 19:17 |
| jamielennox | marekd: https://github.com/openstack/python-keystoneclient-saml2 is open for business (even though the governance review hasn't passed), i'll look at cleaning it up to use the base class in ksc | 19:17 |
| ayoung | david8hu, biggest impact is, I think on figuring out how to cache and fetch policy files | 19:17 |
| *** david-ly_ has quit IRC | 19:18 | |
| david8hu | ayoung, my thoughts exact, and how we can make it robust. | 19:18 |
| marekd | jamielennox: so the repo is python-keystoneclient-saml2 but the headline in README says it's python-keystoneclient-federation (which is imho more accurate name) | 19:19 |
| ayoung | david8hu, there is a general caching issues, and if we get it right here, it can have broader impacts | 19:19 |
| jamielennox | marekd: we need to change it over for the rename | 19:19 |
| ayoung | it means that we can cache naythiung we weould go back to keystone to query. There is some prior art in the PKI certs and revocation lists | 19:19 |
| marekd | jamielennox: so, what's the proper name eventually? I remember there was a p-k-federation repo already. | 19:20 |
| jamielennox | marekd: the point is to limit the repo to just the saml plugins, federation is too broad as it's becoming a catch all term for anything that auths via /OS-FEDERATION | 19:20 |
| jamielennox | marekd: this is a rename, -federation -> -saml2 | 19:20 |
| david8hu | ayoung, any pointers to this general caching issue? | 19:20 |
| marekd | jamielennox: roger that. | 19:20 |
| marekd | jamielennox: i personally would squeeze all the plugins there, however there some votes that 'whatever doesnt need lxml can go directly to ksc'. What's your opinion on that? | 19:21 |
| ayoung | david8hu, nope. | 19:21 |
| ayoung | unless you want to look inside my head\ | 19:21 |
| ayoung | david8hu, actaully..yes | 19:21 |
| ayoung | david8hu, http://adam.younglogic.com/2014/10/who-can-sign-for-what/ | 19:21 |
| ayoung | david8hu, but...there is a twist | 19:21 |
| david8hu | ayoung, please dump your brain, and forward the dump to me in an email :) | 19:21 |
| marekd | jamielennox: also, if somebody comesup with oidc plugin are we going to squeeze it in the ksc? or create p-k-oidc repo? | 19:21 |
| ayoung | so ^^ talks about doing in the middleware a lot of what is done in Keystone. Any one of those queries could be cached | 19:22 |
| jamielennox | marekd: i don't want a repo for everything, but if it has new dependencies i don't want to put them in ksc | 19:22 |
| ayoung | it was based on PKI tokens, but we could do something even with Fernet | 19:22 |
| jamielennox | marekd: with stevedore it really makes no difference where it's coming from, so if we end up with 10 ksc-plugin repos i don't care | 19:22 |
| *** gyee has quit IRC | 19:23 | |
| david8hu | ayoung, my question is how does cache now that it data is dirty if it is caching http fetch. | 19:23 |
| bknudson | jamielennox: is that because of session? that's moving to its own repo. | 19:23 |
| marekd | jamielennox: ok, i understand. | 19:23 |
| ayoung | david8hu, certs are nevere "dirty" and revocation list is fetched on time based interval | 19:23 |
| *** jeffDevi_ has quit IRC | 19:24 | |
| ayoung | policy.json is not fetched, but rather handled by puppet etc | 19:24 |
| jamielennox | bknudson: the session repo keystoneauth (ksa) is going to be really light, as few deps as possible | 19:24 |
| marekd | jamielennox: so, https://review.openstack.org/#/c/172155/ should rather go to p-k-saml2 repo, right? | 19:24 |
| *** jeffDeville has joined #openstack-keystone | 19:24 | |
| jamielennox | ... crap should ksc-saml2 have been ksa-saml2? | 19:24 |
| jamielennox | :( | 19:24 |
| bknudson | what's in it? | 19:25 |
| bknudson | an auth plugin? | 19:25 |
| jamielennox | bknudson: yep | 19:25 |
| bknudson | ksa makes more sense then | 19:25 |
| jamielennox | we started the rename before ksa was ready to go - even now i don't know if it's got a repo yte | 19:25 |
| david8hu | ayoung, interesting. | 19:25 |
| marekd | ksa - keystone authentication? | 19:26 |
| *** jamesllondon has quit IRC | 19:26 | |
| marekd | jamielennox: ^^ | 19:26 |
| jamielennox | marekd: keystoneauth specifically but yes | 19:26 |
| marekd | so, this would be essentially what today is keystoneclient/auth directory? | 19:26 |
| jamielennox | marekd, bknudson: https://review.openstack.org/#/c/175596/ | 19:27 |
| bknudson | https://github.com/morganfainberg/keystoneauth/ | 19:27 |
| david8hu | ayoung, I am going to read http://adam.younglogic.com/2014/10/who-can-sign-for-what/ over lunch. | 19:27 |
| marekd | jamielennox: just out of curiosity, what's the goal in spliting everything? | 19:27 |
| jamielennox | marekd: it will contain session auth/ and whatever discover is needed for that | 19:27 |
| dstanek | is there a list somewhere of the preferred software for the different categories (like pecan from web framework)? | 19:27 |
| bknudson | I think we can assume there's going to be a keystoneauth so keystoneauth-saml2 makes more sense. | 19:27 |
| morganfainberg | you know... | 19:27 |
| morganfainberg | we could make all BPs for keystone wishlist bugs... | 19:28 |
| morganfainberg | at it would be less sucky of a UI to deal with | 19:28 |
| morganfainberg | :P | 19:28 |
| jamielennox | marekd: it's so that the other clients can depend on ksa without having the full dependencies of ksc | 19:28 |
| jamielennox | mostly | 19:28 |
| jamielennox | establish like a base client library | 19:28 |
| morganfainberg | https://review.openstack.org/#/c/175610/ https://review.openstack.org/#/c/175596/ | 19:29 |
| morganfainberg | KSA ^ stuff | 19:29 |
| morganfainberg | to get us into gerrit | 19:29 |
| ayoung | david8hu, so, don't get bogged down in the details. We need to solve policy first and foremost | 19:30 |
| jamielennox | morganfainberg: i'm still not sure about ksa not having python- but whatever | 19:30 |
| ayoung | david8hu, What I would really love to see is if we could do the git type approach | 19:30 |
| morganfainberg | jamielennox, i am against naming things python-XXXX | 19:30 |
| ayoung | the hash of the file is the local name, and we could fetch via the hash | 19:31 |
| jamielennox | morganfainberg: agreed, but looks funny against the rest | 19:31 |
| *** _cjones_ has joined #openstack-keystone | 19:31 | |
| morganfainberg | jamielennox, so i exercise my "I'm the PTL" rights here ;) | 19:31 |
| morganfainberg | jamielennox, well not so much | 19:31 |
| morganfainberg | jamielennox, think of it more like oslo | 19:31 |
| morganfainberg | or keystonemiddleware | 19:31 |
| ayoung | david8hu, but really, the questions is "where should it live" | 19:31 |
| ayoung | its not really middleware, as it needs to be a libraray call...sort of | 19:31 |
| jamielennox | morganfainberg: excellent - i'll just quote that if ever asked | 19:32 |
| bknudson | there might be other client libs in other languages so putting keystone- in front makes sense. | 19:32 |
| morganfainberg | jamielennox, seriously. you can. you can say PTL said this is the way it goes | 19:32 |
| ayoung | jamielennox, btw, we are going to have to make the auth plugsin much smarter for K2K | 19:32 |
| bknudson | what about c#-keystoneclient? | 19:32 |
| *** iamjarvo has quit IRC | 19:32 | |
| bknudson | .net-keystoneclient? (it would be invisible) | 19:32 |
| morganfainberg | bknudson, i actually see keystoneauth doing some morphing long term and holding more than python in the repo | 19:32 |
| morganfainberg | bknudson, but shhh don't tell anyone, it might scare them. | 19:32 |
| *** akerr has left #openstack-keystone | 19:33 | |
| morganfainberg | bknudson, there is no reason we can't do more than one language in the repo in a sane way... especially if you change 1 you should change the others | 19:33 |
| morganfainberg | easier to review all at the same time | 19:33 |
| morganfainberg | rather than having to change it in 15 places. | 19:33 |
| jamielennox | ayoung: the plugin that's up for review is probably smart enough - i just don't like the UX of using it, i want to know if there's a plan that can create the plugin for a user given you need to call ~3 ksc functions to get all the params | 19:33 |
| ayoung | jamielennox, that is exactly what I am talking about | 19:34 |
| ayoung | I have no idea. | 19:34 |
| jamielennox | morganfainberg: i came across something in ruby yesterday based on fog, it's still purely v2 auth and hasn't seen an update in a while | 19:34 |
| morganfainberg | jamielennox, yeah i've seen that before | 19:35 |
| morganfainberg | i'd like to actually see keystoneauth house more than python tbh | 19:35 |
| morganfainberg | but i want to start w/ having a solid python impl people can use | 19:35 |
| morganfainberg | then we can branch from there. | 19:35 |
| ayoung | I want the whole damn thing to go away! | 19:36 |
| ayoung | Oh, wait/ | 19:36 |
| jamielennox | that would be cool - and i have no idea how that packaging would work or whether people would accept it | 19:36 |
| morganfainberg | jamielennox, lets fight that battle once keystoneauth is good. | 19:36 |
| morganfainberg | jamielennox, :) | 19:36 |
| ayoung | if we couldget the base functionality into libcurl... | 19:36 |
| jamielennox | heh | 19:36 |
| morganfainberg | jamielennox, at least other p-langs might be easy | 19:36 |
| morganfainberg | jamielennox, java... well easy to test.. not so easy to do "right" | 19:37 |
| ayoung | morganfainberg, probably want to tie the Java one in with something like RESTEasy | 19:37 |
| morganfainberg | ayoung, again a battle to be fought once we have keystoneauth being a "real boy"^wthing" | 19:38 |
| marekd | morganfainberg: >> i actually see keystoneauth doing some morphing long term and holding more than python in the repo<< - it'd be like 'language bindings' ? | 19:38 |
| morganfainberg | marekd, OMG right?! | 19:38 |
| morganfainberg | ;) | 19:38 |
| morganfainberg | marekd, novel concept. | 19:38 |
| morganfainberg | marekd, hehe | 19:38 |
| ayoung | I'd rather we supported SAML and punted on the rest | 19:39 |
| *** jeffDevi_ has joined #openstack-keystone | 19:39 | |
| marekd | morganfainberg: i wasn't trying to give any hints, rather was unsure if that was the point. | 19:39 |
| morganfainberg | marekd, ah | 19:39 |
| jamielennox | marekd: so just do it in c and ffi everywhere? | 19:39 |
| morganfainberg | marekd, the point would be to have language bindings | 19:39 |
| morganfainberg | jamielennox, swig! | 19:39 |
| morganfainberg | jamielennox, use swig! i mean.. no don't | 19:40 |
| morganfainberg | marekd, the point is we can maintain proper language bindings in a nice way. if we can do it all in gerrit it would be better. and we should control this lib. | 19:40 |
| morganfainberg | in whatever form it takes | 19:41 |
| *** jeffDeville has quit IRC | 19:41 | |
| dstanek | jamielennox: morganfainberg: barbican was forced out of falcon? | 19:41 |
| jamielennox | dstanek: was just going to bring that convo here | 19:41 |
| morganfainberg | dstanek, i thought that was celery | 19:41 |
| morganfainberg | but i didn't pay attention | 19:41 |
| morganfainberg | tbh | 19:41 |
| marekd | morganfainberg: right | 19:41 |
| jamielennox | morganfainberg: i think it was falcon, i ended up packaging it for fedora and then they went and switched | 19:42 |
| morganfainberg | jamielennox, then we use pecan | 19:42 |
| dstanek | jamielennox: i was planning on doing a falcon poc after talking about it at pycon | 19:42 |
| morganfainberg | honestly, if we merge all this stuff together like you were working on, changing the routing framework is easier anyway | 19:42 |
| morganfainberg | some of this work has to be done in either case. | 19:42 |
| *** bandwidth has joined #openstack-keystone | 19:43 | |
| dstanek | yes, there is much refactoring to be done | 19:43 |
| morganfainberg | dstanek, since pecan is a known "good" for openstack | 19:43 |
| morganfainberg | lets use it | 19:43 |
| morganfainberg | we can move to falcon / something else later as needed | 19:43 |
| ayoung | marekd, what generates the metadata for samle at, for example, http://hostname:5000/v3/OS-FEDERATION/identity_providers/ipsilon/protocols/saml2/auth/mellon/metadata | 19:44 |
| ayoung | is that mellon? we don't handle that via a controller, right? | 19:44 |
| *** henrynash has joined #openstack-keystone | 19:44 | |
| *** ChanServ sets mode: +v henrynash | 19:44 | |
| jamielennox | morganfainberg, dstanek: right, i think there is a lot of overlap to moving towards any other framework in terms of cleanup | 19:44 |
| morganfainberg | oh we also have to do grenade upgrade from eventlet -> mod_wsgi | 19:44 |
| morganfainberg | this cycle | 19:44 |
| morganfainberg | it's is a requirement | 19:45 |
| jamielennox | dstanek: if you can get falcon approved by tc i'd be happy to go that way instead | 19:45 |
| morganfainberg | we can't punt it/skip it/etc. | 19:45 |
| jamielennox | a/happy/prefer | 19:45 |
| marekd | ayoung: metadata for an IdP ? | 19:45 |
| ayoung | marekd, yeah | 19:45 |
| ayoung | marekd, I'm debugging na ipsilon setup for ECP testing and not sure which code base to look at | 19:45 |
| marekd | ayoung: in keystone-sp case the link is usually specific for a module, in mod_shib that typically be https://host:5000/Shibboleth.sso/Metadata so nothing Keystone specific. | 19:46 |
| ayoung | marekd, OK | 19:47 |
| ayoung | thanks | 19:47 |
| marekd | yw | 19:47 |
| *** jeffDevi_ has quit IRC | 19:49 | |
| dstanek | rodrigods: i'm going to make a bug for that thing i mentioned earlier | 19:50 |
| rodrigods | dstanek, ++ | 19:50 |
| rodrigods | dstanek, would be nice if the fix lands still in kilo | 19:51 |
| bknudson | morganfainberg: can we assume grenade starts with mod_wsgi? | 19:51 |
| bknudson | why do we have to transition? | 19:51 |
| morganfainberg | bknudson: we need to do the transition | 19:51 |
| dstanek | rodrigods: i can land it once i know if i need to fake out the tests | 19:51 |
| morganfainberg | bknudson: it's to test the upgrade path for deployments. | 19:51 |
| *** jeffDeville has joined #openstack-keystone | 19:51 | |
| bknudson | none of our customers are using grenade to do the upgrade. | 19:52 |
| morganfainberg | bknudson, no, grenade is meant to simulate the upgrade | 19:52 |
| morganfainberg | bknudson, and catch errors / prevent errors. i don't expect a deployer to actually use it. | 19:52 |
| marekd | jamielennox: re p-k-saml2 repository. Can I simply there "from keystoneclient import ...." and assume it will be automatically respolved? | 19:52 |
| marekd | resolved. | 19:53 |
| bknudson | I guess I don't see what the errors are it's going to help with. | 19:53 |
| jamielennox | marekd: can you import ksc from ksa? | 19:53 |
| bknudson | you can run keystone in eventlet or in httpd, and we're running both of those. | 19:53 |
| morganfainberg | bknudson, if we can't describe what the upgrade from eventlet to mod_wsgi works like, how can we expect people to do it | 19:53 |
| jamielennox | marekd: or do you mean can you import the ksa plugins from ksc? | 19:53 |
| morganfainberg | bknudson: it really is about ensuring the expected upgrade path to work. | 19:53 |
| marekd | jamielennox: i meant i might need to import few bits from ksc for example in the tests. | 19:54 |
| bknudson | ok. should be easy enough. | 19:54 |
| morganfainberg | bknudson: yeah it shouldn't be hard. | 19:54 |
| bknudson | I've run both on one system. | 19:54 |
| *** tqtran has joined #openstack-keystone | 19:54 | |
| bknudson | using devstack | 19:54 |
| morganfainberg | bknudson: so have I. | 19:54 |
| jamielennox | marekd: sure, there will be a dependency on ksc - don't import directly from ksc/tests though | 19:54 |
| morganfainberg | bknudson: it's because all cases of liberty will run mod_wsgi by default [is the hope] | 19:55 |
| *** jeffDeville has quit IRC | 19:55 | |
| morganfainberg | because in M release eventlet goes away | 19:55 |
| marekd | https://github.com/openstack/python-keystoneclient-saml2/blob/master/keystoneclient_federation/tests/test_auth_saml2.py#L16 | 19:55 |
| marekd | jamielennox: ok, looks like i can. | 19:55 |
| morganfainberg | bknudson the only case eventlet should run in liberty is if we have a gate job (pgsql today) that does it. | 19:55 |
| morganfainberg | explicitly | 19:55 |
| dstanek | rodrigods: https://bugs.launchpad.net/keystone/+bug/1446834 | 19:55 |
| openstack | Launchpad bug 1446834 in Keystone "Project tree cycle checking logic is broken" [Undecided,New] | 19:55 |
| morganfainberg | or k -> L in grenade | 19:55 |
| jamielennox | marekd: yea, that's fine - there will have to be a dependency there | 19:56 |
| dstanek | anyone have thoughts on that one? | 19:56 |
| rodrigods | dstanek, nice! | 19:56 |
| dstanek | just updated the details there too | 19:57 |
| *** jeffDeville has joined #openstack-keystone | 19:59 | |
| marekd | jamielennox: hm, one more question - p-k-saml2 would land in keystoneclient's g-r ? | 20:01 |
| morganfainberg | marekd, no. | 20:02 |
| jamielennox | marekd: the reverse | 20:02 |
| morganfainberg | jamielennox, ++ | 20:02 |
| marekd | allright. | 20:02 |
| *** jeffDeville has quit IRC | 20:08 | |
| ayoung | stevemar, marekd, OK...I unf)(*&ed my SAML setup...how do I test with ECP? | 20:09 |
| *** jeffDeville has joined #openstack-keystone | 20:12 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 20:12 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Recursive deletion https://review.openstack.org/148730 | 20:12 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Dual Scoped Token https://review.openstack.org/176054 | 20:12 |
| *** jeffDeville has quit IRC | 20:15 | |
| *** jamesllondon has joined #openstack-keystone | 20:16 | |
| *** jamesllondon has quit IRC | 20:16 | |
| *** jeffDeville has joined #openstack-keystone | 20:18 | |
| *** david-lyle has joined #openstack-keystone | 20:21 | |
| *** jamesllondon has joined #openstack-keystone | 20:23 | |
| *** jamesllondon has quit IRC | 20:23 | |
| *** jeffDeville has quit IRC | 20:27 | |
| *** jeffDeville has joined #openstack-keystone | 20:27 | |
| openstackgerrit | Erickson Filipe Guedes dos Santos proposed openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 20:33 |
| *** iamjarvo has joined #openstack-keystone | 20:33 | |
| *** jeffDeville has quit IRC | 20:34 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Explicitly close non-transactional SQL sessions https://review.openstack.org/176063 | 20:35 |
| *** jeffDeville has joined #openstack-keystone | 20:35 | |
| *** bandwidth has quit IRC | 20:40 | |
| *** raildo has quit IRC | 20:43 | |
| *** pnavarro has quit IRC | 20:47 | |
| *** jeffDeville has quit IRC | 20:50 | |
| *** jamesllondon has joined #openstack-keystone | 20:51 | |
| *** openstackgerrit has quit IRC | 20:52 | |
| *** openstackgerrit has joined #openstack-keystone | 20:52 | |
| *** Ephur has joined #openstack-keystone | 20:55 | |
| *** bandwidth has joined #openstack-keystone | 20:58 | |
| samueldmq | henrynash, hi | 20:58 |
| *** stevemar2 has joined #openstack-keystone | 21:01 | |
| *** ChanServ sets mode: +v stevemar2 | 21:01 | |
| *** stevemar has quit IRC | 21:01 | |
| *** stevemar2 has quit IRC | 21:02 | |
| *** iamjarvo has quit IRC | 21:03 | |
| *** stevemar has joined #openstack-keystone | 21:04 | |
| *** ChanServ sets mode: +v stevemar | 21:04 | |
| *** iamjarvo has joined #openstack-keystone | 21:20 | |
| *** e0ne_ has joined #openstack-keystone | 21:25 | |
| *** mattfarina has quit IRC | 21:26 | |
| *** e0ne_ has quit IRC | 21:31 | |
| *** sdake_ has joined #openstack-keystone | 21:31 | |
| *** samueldmq has quit IRC | 21:33 | |
| *** sdake has quit IRC | 21:34 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:35 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 21:35 | |
| *** iamjarvo has quit IRC | 21:38 | |
| *** openstackgerrit_ has joined #openstack-keystone | 21:48 | |
| *** sdake has joined #openstack-keystone | 21:53 | |
| *** sdake_ has quit IRC | 21:57 | |
| *** stevemar has quit IRC | 22:00 | |
| *** harlowja is now known as harlowja_away | 22:00 | |
| *** gyee has joined #openstack-keystone | 22:01 | |
| *** ChanServ sets mode: +v gyee | 22:01 | |
| *** harlowja_away is now known as harlowja | 22:05 | |
| *** jaosorior has quit IRC | 22:22 | |
| *** iamjarvo has joined #openstack-keystone | 22:22 | |
| *** akerr has joined #openstack-keystone | 22:23 | |
| *** gordc has quit IRC | 22:23 | |
| *** akerr_ has joined #openstack-keystone | 22:25 | |
| *** henrynash has quit IRC | 22:25 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 22:27 |
| *** akerr has quit IRC | 22:28 | |
| bknudson | morganfainberg: what do you think about https://bugs.launchpad.net/oslo-incubator/+bug/1446583 ? keystone should shut down even when it has active connections? | 22:29 |
| openstack | Launchpad bug 1446583 in Keystone "services no longer reliably stop in stable/kilo" [Critical,In progress] - Assigned to Julien Danjou (jdanjou) | 22:29 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 22:29 |
| bknudson | I guess I could see what other servers do. | 22:30 |
| *** akerr_ has left #openstack-keystone | 22:30 | |
| *** samueldmq has joined #openstack-keystone | 22:31 | |
| *** _cjones_ has quit IRC | 22:33 | |
| *** joesavak has quit IRC | 22:39 | |
| *** bknudson has quit IRC | 22:41 | |
| *** _cjones_ has joined #openstack-keystone | 22:42 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:46 | |
| leonchio_ | someone ... steve, adam, appreciate if you guys can review it again ;-) | 22:50 |
| leonchio_ | thx | 22:50 |
| *** tpatil has quit IRC | 23:01 | |
| morganfainberg | ugh, stevemar disappeared when i needed to bug him | 23:05 |
| morganfainberg | dtroyer, ping: do you know if openstack client can function with the admin token? | 23:05 |
| bigjools | I've had problems using it with v3 | 23:07 |
| gyee | morganfainberg, it can I think, by using the token_endpoint plugin | 23:08 |
| morganfainberg | it must work | 23:08 |
| gyee | unless jamielennox disagrees | 23:08 |
| morganfainberg | somehow. | 23:08 |
| * morganfainberg is glaring at devstack atm. | 23:08 | |
| gyee | thought I used it not long ago | 23:08 |
| * morganfainberg is unhappily glaring at devstack | 23:08 | |
| morganfainberg | ugh. | 23:09 |
| morganfainberg | this looks to be about 20% done for v3 keystone | 23:10 |
| morganfainberg | marvelous. | 23:10 |
| gyee | huh? | 23:10 |
| gyee | openstack --os-auth-type token_endpoint | 23:11 |
| morganfainberg | lots of things *never* use v3 versions: https://github.com/openstack-dev/devstack/blob/master/functions-common#L742-L748 | 23:11 |
| lhcheng | morganfainberg: osc should work for admin token | 23:11 |
| morganfainberg | so everything needs to learn to do this via v3 API first | 23:12 |
| gyee | s/should/does/ | 23:12 |
| morganfainberg | i'm going to make this all stop using v2. | 23:12 |
| jamielennox | you can use admin token with OSC | 23:12 |
| morganfainberg | v3 only. | 23:12 |
| jamielennox | i think its --os-url and --os-token | 23:12 |
| morganfainberg | and this looks to be littered all over the place. | 23:13 |
| gyee | gotta love reading the code :) | 23:14 |
| morganfainberg | or some env variable is set somewhere to make it maybe use v3. | 23:14 |
| gyee | --os-identity-api-version 3 | 23:14 |
| *** ayoung has quit IRC | 23:14 | |
| lhcheng | export OS_IDENTITY_API_VERSION=3 | 23:15 |
| dtroyer | morganfainberg: osc doesn't use token-endpoint as that still tries to get a scoped token, you need to use —os-token for the admin token and —os-url for the direct endpoint you want to talk to | 23:15 |
| morganfainberg | yeah. | 23:15 |
| *** markvoelker_ has quit IRC | 23:16 | |
| dtroyer | we probably should see if it is time for OSC to default to v3… | 23:16 |
| gyee | dtroyer, you mean you don't load that plugin? | 23:17 |
| dtroyer | meaning does the downshift for v2 only clouds work in the popular non-keystone places | 23:17 |
| gyee | I tried specifying all three and it seem to work fine | 23:17 |
| dtroyer | gyee: nope, OSC has its own. ksc's token-endpoint is not the same thing | 23:17 |
| dtroyer | it uses —os-token and —os-auth-url | 23:18 |
| dtroyer | if you use —os-url at all, you're not using a ksc plugin | 23:18 |
| gyee | but it will ignore token_endpoint? | 23:18 |
| gyee | it didn't seem to complain | 23:18 |
| gyee | so if I specify token_endpoint, --os-token, and --os-url it will just ignore the first one | 23:19 |
| dtroyer | the first thing OSC does in selecting and endpoint (guessing) is check for os-token and os-url, if both are present nothing else is checked | 23:19 |
| dtroyer | even before looking at os-auth-type | 23:19 |
| gyee | i c | 23:20 |
| gyee | that explains it | 23:20 |
| dtroyer | we needed to do this to stay compatible with the original behaviour | 23:20 |
| *** edmondsw has quit IRC | 23:21 | |
| *** bandwidth has quit IRC | 23:27 | |
| jamielennox | actually it does. If you use --os-url and --os-token it does use the token_endpoint plugin, it's the straight token plugin that rescopes | 23:30 |
| jamielennox | it just doesn't load the plugin from stevedore | 23:30 |
| jamielennox | so if you don't do --os-auth-type then it looks at what you provided for some sensible defaults | 23:30 |
| * jamielennox is on PTO till the end of the week after today - just in case people are looking for me | 23:32 | |
| *** sdake_ has joined #openstack-keystone | 23:35 | |
| gyee | jamielennox, I need your opinion on the endpoint enforcement thingy | 23:36 |
| gyee | I commended on the spec that supporting service_id may not be good enough as service are also organize by region | 23:37 |
| gyee | and sub region and so on | 23:37 |
| gyee | I think we should support all the endpoint group filters | 23:38 |
| gyee | which are, endpoint_id, region_id, service_id, and service_type | 23:38 |
| *** sdake has quit IRC | 23:38 | |
| *** iamjarvo has quit IRC | 23:40 | |
| *** sdake_ has quit IRC | 23:46 | |
| *** ericksonsantos has quit IRC | 23:48 | |
| *** ericksonsantos has joined #openstack-keystone | 23:49 | |
| *** bknudson has joined #openstack-keystone | 23:54 | |
| *** ChanServ sets mode: +v bknudson | 23:54 | |
| *** rwsu has quit IRC | 23:56 | |
| morganfainberg | hm | 23:59 |
| morganfainberg | http://paste.openstack.org/show/205038/ | 23:59 |
| morganfainberg | this looks weird. | 23:59 |
| morganfainberg | is this because v2 is just awful? | 23:59 |
| bknudson | I got that when I tried to boot an instance once.... | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!