| morganfainberg | and v3 is so wildly different you can't even use similar cli args | 00:00 |
|---|---|---|
| bknudson | OS_VOLUME_API_VERSION=1 openstack server create --image cirros-0.3.2-x86_64-uec --flavor 1 blktest1 | 00:00 |
| morganfainberg | not the warning | 00:00 |
| morganfainberg | the endpoint create error | 00:00 |
| bknudson | oh. | 00:00 |
| morganfainberg | interface *must* be "internal" "public" or "admin" | 00:00 |
| *** amerine has quit IRC | 00:01 | |
| morganfainberg | and we accept some wacky different params for v2. | 00:01 |
| morganfainberg | --region RegionOne --publicurl http://172.16.30.15:9292 --adminurl http://172.16.30.15:9292 --internalurl | 00:01 |
| *** markvoelker has joined #openstack-keystone | 00:02 | |
| bknudson | morganfainberg: http://developer.openstack.org/api-ref-identity-v2-ext.html | 00:02 |
| bknudson | see /v2.0/tenants/{tenantId}/OS-KSCATALOG/endpoints | 00:02 |
| morganfainberg | i.. | 00:03 |
| bknudson | I wonder what /v2.0/OS-KSCATALOG/endpointTemplates is? | 00:03 |
| morganfainberg | wtf? | 00:03 |
| morganfainberg | i mean.. | 00:03 |
| bknudson | endpoint for v3 is different -- http://developer.openstack.org/api-ref-identity-v3.html | 00:03 |
| morganfainberg | really?! | 00:03 |
| morganfainberg | yeah | 00:04 |
| morganfainberg | the OS-KSCATALOG thing | 00:04 |
| morganfainberg | wow. | 00:04 |
| morganfainberg | i don't think i've ever looked at that. | 00:04 |
| bknudson | quit looking into the abyss. | 00:04 |
| morganfainberg | i'm trying to fix devstack so it'll stand up a devstack based on v3 keystone api | 00:05 |
| morganfainberg | well *only* v3 keystone api | 00:05 |
| bknudson | nice! | 00:05 |
| bknudson | is there a switch for one or the other? | 00:05 |
| bknudson | I thought there was a version options | 00:05 |
| morganfainberg | it'll be changing IDENTIT_API_VERSION to v3 | 00:06 |
| morganfainberg | or = 3 that is | 00:06 |
| morganfainberg | vs 2.0 | 00:06 |
| bknudson | I've got a TODO on my list to change devstack so it won't try to make a /v3 identity endpoint | 00:06 |
| morganfainberg | so i'm chasing down all the hard-coded stuff | 00:06 |
| bknudson | there's an option for which to make and since we never run with /v3 it makes no sense to allow it | 00:07 |
| morganfainberg | i figure if we can standup a v3 devstack then i can put an experimental dsgate job in that we can execute that is v3 disabled | 00:07 |
| bknudson | and we've got jerks here who keep saying they should be able to put /v3 in their catalog. | 00:07 |
| morganfainberg | and we can chase down what is actually broken | 00:07 |
| morganfainberg | i think there is 1 thing left in openstack that breaks v3-only [with v2 disabled] | 00:07 |
| morganfainberg | and that is heat. | 00:07 |
| morganfainberg | i *think* | 00:07 |
| bknudson | neutron works? | 00:07 |
| morganfainberg | jamielennox did a fix for that | 00:08 |
| morganfainberg | haven't gotten far enough to try running tempest | 00:08 |
| bknudson | it didn't work for us to set /v3 for the endpoint. | 00:08 |
| morganfainberg | step 1: make v3 standup cleanly | 00:08 |
| bknudson | but then our python-keystoneclient was really backlevel. | 00:08 |
| morganfainberg | step 2: provide function to disable v2 | 00:08 |
| morganfainberg | step 3: ??? | 00:08 |
| morganfainberg | step 4: profit | 00:08 |
| bknudson | steal underpants | 00:08 |
| morganfainberg | yes! | 00:08 |
| *** markvoelker has quit IRC | 00:08 | |
| morganfainberg | bknudson, so OS-KSCATALOG doesn't exist in our codebase | 00:09 |
| morganfainberg | fwiw | 00:09 |
| bknudson | what's the API then? | 00:09 |
| morganfainberg | dead:P | 00:09 |
| bknudson | how is devstack creating endpoints? | 00:09 |
| jamielennox | i did a bunch of fixes for tempest - i was doing them in conjunction with v3 policy and allowing tempest to get a domain scoped token | 00:10 |
| morganfainberg | i think openstackclient is doing something wrong | 00:10 |
| jamielennox | that's not finished yet - i haven't tried with the standard policy for ages | 00:10 |
| morganfainberg | where v2 = different CLI arguments when it shouldn't be. | 00:10 |
| morganfainberg | jamielennox, yeah i figure we should be able to run openstack w/ stupid policy but v3 | 00:10 |
| morganfainberg | jamielennox, everything can live in default domain. just able to turn v2.0 off | 00:11 |
| morganfainberg | jamielennox, then we can deprecate v2.0 and work on solving issues like tempest v3 and better default policy | 00:11 |
| jamielennox | right | 00:11 |
| morganfainberg | dtroyer, halp. why does osc change behavior on arguments for endpoint create between v2 and v3? | 00:13 |
| morganfainberg | dtroyer, this looks like a bug/incorrect behavior. it's the same API extension in keystone | 00:13 |
| morganfainberg | http://paste.openstack.org/show/205039/ | 00:14 |
| *** samueldmq has quit IRC | 00:14 | |
| morganfainberg | i wonder how many other commands are going to get horked up | 00:14 |
| jamielennox | morganfainberg: the way endpoints are defined changes between v2 and v3 | 00:15 |
| morganfainberg | jamielennox, really? | 00:15 |
| jamielennox | service becomes a more important thing in v3, then an endpoint has an interface, whereas in v2 endpoint has public, internal and admin urls | 00:15 |
| morganfainberg | jamielennox, because afaict we don't have a V2 CRUD for creating a catalog. | 00:16 |
| jamielennox | you don't create a catalog | 00:16 |
| jamielennox | you create services and endpoints | 00:16 |
| morganfainberg | for creating endpoints and the like | 00:16 |
| bknudson | http://www.amazon.com/Port-Authority-J790-Glacier-X-Large/dp/B0036XH14Q/ref=sr_1_10_mc?s=apparel&ie=UTF8&qid=1429654781&sr=1-10 | 00:17 |
| bknudson | oops | 00:17 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/controllers.py#n93 | 00:17 |
| morganfainberg | i'm just not seeing it wired up. | 00:17 |
| jamielennox | bknudson: looks good | 00:17 |
| bknudson | that's the create_endpoint in controller | 00:17 |
| bknudson | I will look good. | 00:17 |
| morganfainberg | bknudson, right. i'm not seeing routes. | 00:17 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/admin_crud/core.py#n204 | 00:18 |
| morganfainberg | ah we do it in that annoying thing | 00:18 |
| morganfainberg | ok | 00:18 |
| jamielennox | ooo, admin_curd - i always forget to look there | 00:18 |
| morganfainberg | crap. | 00:18 |
| morganfainberg | rm -rf contrib/admin_crud | 00:19 |
| morganfainberg | oopse | 00:19 |
| bknudson | over the weekend I ordered a screen protector from amazon and it was $0.01 | 00:19 |
| bknudson | I didn't think you could get anything for 1c | 00:19 |
| morganfainberg | ok looks like i need to special case this whole creation bit. | 00:20 |
| bknudson | you could change the openstack CLI to take the same params for v3 | 00:20 |
| morganfainberg | it probably should be able to | 00:21 |
| *** alexsyip has quit IRC | 00:21 | |
| bknudson | that would make it easier | 00:21 |
| morganfainberg | unfortunately | 00:22 |
| morganfainberg | this is not something i can assume is fixed, so need to special case it in devstack | 00:23 |
| morganfainberg | if it gets better we can fix itdown the line in devstack too | 00:23 |
| bknudson | If you can't assume support of openstack commands then can you assume the openstack command is even there? | 00:23 |
| morganfainberg | well i dont want to assume something magical from the future | 00:23 |
| *** _cjones_ has quit IRC | 00:23 | |
| *** david-lyle has quit IRC | 00:24 | |
| *** tqtran has quit IRC | 00:24 | |
| *** david-lyle has joined #openstack-keystone | 00:27 | |
| bknudson | looks like even auth_token middleware uses persistent connections to keystone | 00:33 |
| jamielennox | bknudson: if you are maintaining your session object then you should get connection pooling | 00:35 |
| *** alexsyip has joined #openstack-keystone | 00:49 | |
| *** browne has quit IRC | 01:00 | |
| *** ayoung has joined #openstack-keystone | 01:02 | |
| *** ChanServ sets mode: +v ayoung | 01:02 | |
| *** iamjarvo has joined #openstack-keystone | 01:10 | |
| *** iamjarvo has quit IRC | 01:10 | |
| *** iamjarvo has joined #openstack-keystone | 01:10 | |
| *** alexsyip has quit IRC | 01:11 | |
| *** gyee has quit IRC | 01:12 | |
| *** lhcheng has quit IRC | 01:22 | |
| *** _cjones_ has joined #openstack-keystone | 01:24 | |
| *** rushil has quit IRC | 01:32 | |
| *** spandhe has quit IRC | 01:35 | |
| *** erkules_ has joined #openstack-keystone | 01:38 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Fetch user token from request rather than env https://review.openstack.org/174202 | 01:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove the _msg_format function https://review.openstack.org/174201 | 01:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Base use webob https://review.openstack.org/174200 | 01:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't rely on token_info for header building https://review.openstack.org/174199 | 01:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Move project included validation https://review.openstack.org/174198 | 01:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Depend on keystoneclient for expiration checking https://review.openstack.org/174197 | 01:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't store expire into memcache https://review.openstack.org/174196 | 01:39 |
| *** erkules has quit IRC | 01:40 | |
| ayoung | leonchio_, you around? | 01:41 |
| ayoung | lets talk tokenless | 01:41 |
| *** iamjarvo has quit IRC | 01:42 | |
| *** deep has joined #openstack-keystone | 01:42 | |
| *** davechen has joined #openstack-keystone | 01:43 | |
| deep | morganfainberg: hey | 01:48 |
| *** zzzeek has quit IRC | 01:48 | |
| morganfainberg | deep: hi. About to drop off for about an hour or two. | 01:48 |
| ayoung | morganfainberg, am I being hard headed in insisting that the tokenless auth and the X509 aspect be split? | 01:49 |
| deep | morganfainberg: Hi Morgan, had a very quick question. Can catch you later too. | 01:49 |
| ayoung | I mean, I agree that his use case will be the most common. | 01:49 |
| morganfainberg | deep: if you ask I can respond when I am done. | 01:50 |
| morganfainberg | ayoung: not impossible. Will think while at the gym on that. | 01:50 |
| ayoung | morganfainberg, thanks | 01:50 |
| *** jamesllondon has quit IRC | 01:53 | |
| *** zzzeek has joined #openstack-keystone | 01:54 | |
| *** zzzeek has quit IRC | 01:54 | |
| *** jamesllondon has joined #openstack-keystone | 01:54 | |
| deep | can a domain admin not get a list of projects for a given user? I keep on getting a 403 error even though I have an updated policy.son file with the right authorization. I am using the the following API: /keystone/v3/users/<userid>/projects. | 01:55 |
| *** stevemar has joined #openstack-keystone | 01:56 | |
| *** ChanServ sets mode: +v stevemar | 01:56 | |
| *** davechen1 has joined #openstack-keystone | 01:58 | |
| *** davechen has quit IRC | 02:00 | |
| *** browne has joined #openstack-keystone | 02:01 | |
| *** markvoelker has joined #openstack-keystone | 02:01 | |
| *** darrenc is now known as darrenc_afk | 02:02 | |
| *** harlowja is now known as harlowja_away | 02:03 | |
| *** deep has quit IRC | 02:04 | |
| *** _cjones_ has quit IRC | 02:08 | |
| ayoung | deep hmmm | 02:16 |
| *** darrenc_afk is now known as darrenc | 02:16 | |
| *** iamjarvo has joined #openstack-keystone | 02:33 | |
| *** iamjarvo has quit IRC | 02:33 | |
| *** iamjarvo has joined #openstack-keystone | 02:34 | |
| *** jamielennox is now known as jamielennox|away | 02:39 | |
| *** spandhe has joined #openstack-keystone | 02:54 | |
| *** lhcheng has joined #openstack-keystone | 03:01 | |
| *** ChanServ sets mode: +v lhcheng | 03:01 | |
| morganfainberg | ayoung: I think this is a known issue with the policy file (cc deep) | 03:07 |
| morganfainberg | Ah deep left. | 03:07 |
| ayoung | yeah | 03:07 |
| morganfainberg | So. Re toke less auth separate from x509 | 03:09 |
| morganfainberg | I think it's fine to couple them as long as t is designed in a way that x509 is not the only way to do it. X509 is the first method that is supported. | 03:09 |
| morganfainberg | Without the x509 use case it's hard to justify the work. But it shouldn't be the only usable method with token less. | 03:10 |
| morganfainberg | The design needs to be modular out the door | 03:10 |
| morganfainberg | ayoung: that in line with your thoughts? | 03:11 |
| ayoung | morganfainberg, sort of | 03:11 |
| ayoung | I'd say x509 and Kerberos are about equal in demand | 03:11 |
| ayoung | you can use a Keytab with Kerberos and get the same type of behavior | 03:12 |
| ayoung | and...for UserID password, I'd like to see Basic-Auth | 03:12 |
| ayoung | I'm not 100% certain how that would work, but I suspect mod_auth_mysql or sumtin | 03:12 |
| ayoung | and then we would have a story regardless of the auth mechanism, for treating all service users the same way | 03:14 |
| *** richm has quit IRC | 03:20 | |
| *** iamjarvo has quit IRC | 03:27 | |
| ayoung | http://httpd.apache.org/docs/2.2/mod/mod_authn_dbd.html | 03:28 |
| morganfainberg | Anyway. Modular to begin with so x509 is the first supported but easy to add others. | 03:31 |
| morganfainberg | Again, I see this as a variation on a theme we call federation. | 03:32 |
| morganfainberg | Same basic tool chains. Apache passes some data down to us, we consume it and map to a user | 03:32 |
| ayoung | morganfainberg, the issue is, I think, that the mapping code should probably be reused to do the X509 to Keystone translation. The code I looked at was not doing that. | 03:46 |
| morganfainberg | That was the direction we had originally agreed on afaicr | 03:46 |
| morganfainberg | Sooooo... Let's revisit. Was the spec moved forward to Liberty yet? | 03:47 |
| * morganfainberg thought it ended in the backlog. | 03:47 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/backlog/keystone-tokenless-authz-with-x509-ssl-client-cert.rst morganfainberg | 03:51 |
| morganfainberg | yep | 03:51 |
| morganfainberg | so that needs to move from backlog to liberty | 03:51 |
| morganfainberg | and we should revisit to ensure it's doing the right thing | 03:51 |
| ayoung | morganfainberg, I think we need to make a clean distinction bvetween X509 and tokenless. We want to be able to use X509 for reguolar token ops too | 03:52 |
| ayoung | the X509 for token *should* work but I don;t know if anyone has tested it | 03:52 |
| ayoung | if it works to get an Federated unscoped token, it should work against Keystone in general. RIght? | 03:53 |
| morganfainberg | ayoung, should | 03:56 |
| ayoung | OK, I was wrong | 03:56 |
| ayoung | https://review.openstack.org/#/c/156870/24/keystone/common/tokenless_auth.py,cm | 03:56 |
| ayoung | I missed this file completely, they are using federation and mapping | 03:57 |
| morganfainberg | looks like it's doing exactly what we asked. | 03:57 |
| morganfainberg | cool | 03:57 |
| ayoung | GAH...they suck at naming | 03:57 |
| ayoung | tokenless_auth_helper? | 03:57 |
| morganfainberg | hah | 03:58 |
| * stevemar admits that he suggested that name | 03:58 | |
| morganfainberg | oh LOOK i disable the craptacular wifi on the ATT router | 03:58 |
| ayoung | its another place that should be using the access info | 03:58 |
| morganfainberg | and my latency goes from 1000-1500ms to 200 | 03:58 |
| ayoung | schweet | 03:58 |
| morganfainberg | they keep remotely re-enabling it | 03:58 |
| ayoung | I have the same issues with wifi, tend to use the cat5 where ever available | 03:59 |
| morganfainberg | because they keep trying to fix my broken phone line | 03:59 |
| * morganfainberg has to run wifi | 03:59 | |
| ayoung | stevemar, Helper is not a good class name | 03:59 |
| morganfainberg | but i use a router that isn't a POS | 03:59 |
| ayoung | stevemar, It should be MappedAuthBuilder or something like that | 03:59 |
| morganfainberg | ayoung, MappedAuthBuildingHelperSpecialClassyLikeThingAMerjigger | 04:00 |
| ayoung | morganfainberg, needs more cowbell | 04:00 |
| ayoung | MappedAuthBuildingHelperSpecialClassyLikeThingWITHCOWBELLAMerjigger | 04:01 |
| stevemar | ayoung, it was just something i thought of, the original code was not the prettiest | 04:01 |
| ayoung | OK, have to admit I am not going to get ECP working tonight | 04:01 |
| morganfainberg | https://youtu.be/8Ix7jqxXQ2I?t=17 ? | 04:01 |
| ayoung | stevemar, have you looked at the unified access info builder? It is designed for this kind of use case | 04:02 |
| ayoung | It would be a Director, actually | 04:02 |
| ayoung | MappedAccessDirectory? | 04:02 |
| ayoung | https://review.openstack.org/#/c/138519/19/keystoneclient/models/builder.py,cm | 04:03 |
| ayoung | heh Directory....muscle memor | 04:03 |
| stevemar | it also needs docstrings for the class | 04:03 |
| stevemar | ayoung, oh, i *didn't* suggest that name | 04:05 |
| stevemar | huzzah | 04:05 |
| ayoung | Heh | 04:05 |
| ayoung | I like where they are headed, though | 04:05 |
| stevemar | i just suggested to put it in it's own class | 04:05 |
| stevemar | err... own file | 04:05 |
| stevemar | module, whatever the heck python calls it | 04:06 |
| ayoung | we need to get access info merged | 04:06 |
| ayoung | I'll loop back around on that here shortly/ | 04:06 |
| stevemar | malrighty | 04:06 |
| *** lhcheng has quit IRC | 04:07 | |
| ayoung | stevemar, http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/tests/unit/v3/test_auth_saml2.py#n101 what is the identity provider URL supposed to be here? | 04:09 |
| ayoung | the test code doesn't make it clear | 04:09 |
| ayoung | self.IDENTITY_PROVIDER_URL = 'http://local.url' | 04:09 |
| marekd | ayoung: you can try using ksc and possibly plugin https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/auth/v3/saml2.py#L88 | 04:10 |
| ayoung | marekd, I have an IdP all set up. Works with websso, just got ecp support enagbled, and what are you doing up? | 04:10 |
| ayoung | marekd, so I was trying to follow the code that the test does | 04:11 |
| stevemar | marekd !! | 04:11 |
| stevemar | we haven't had a late night chat in so long | 04:12 |
| marekd | stevemar: now it's my turn to stay late. | 04:12 |
| ayoung | marekd, is there some special suburl for the IdP? | 04:14 |
| marekd | ayoung: sec. | 04:15 |
| *** joesavak has joined #openstack-keystone | 04:16 | |
| *** iamjarvo has joined #openstack-keystone | 04:17 | |
| ayoung | OK..in the webSSO it should not be anything on the idp, as Keystone is supposed to do the redirect...in the ECP case, do we go to the IdP first and make a response? Is this the URL We need here, something on the IdP ECP ? Can we get this out of the metadata? | 04:19 |
| ayoung | http://ecp.cloudlab.freeipa.org:5000/v3/OS-FEDERATION/identity_providers/ipsilon/protocols/saml2/auth/mellon/metadata | 04:20 |
| marekd | ayoung: so it's somethink like: https://idp.testshib.org/idp/profile/SAML2/SOAP/ECP for the shibboleth | 04:21 |
| ayoung | marekd, ok...that looks familiar | 04:21 |
| ayoung | in the sp metat data I have | 04:21 |
| ayoung | http://ecp.cloudlab.freeipa.org:5000/v3/OS-FEDERATION/identity_providers/ipsilon/protocols/saml2/auth/mellon/ECP | 04:22 |
| ayoung | would it make sense to go there? and then get redirected? | 04:22 |
| ayoung | nah..needs a post. | 04:22 |
| marekd | wait wait. | 04:23 |
| marekd | ayoung: looks like you we are talking different things now. | 04:24 |
| ayoung | I think my Idp might be misconfigured. We were battling this | 04:24 |
| ayoung | no, I am just behind | 04:24 |
| marekd | first of all ecp.cloudlab.freeipa.org is you keystone-sp, right? | 04:24 |
| marekd | with mod_mellon and so on. | 04:24 |
| ayoung | this is internal, but yes | 04:24 |
| ayoung | ecp is keystione ipa.... is IdP | 04:25 |
| ayoung | I think the Ipa is misconfigured. I hit a different Ipsilon server and it respondded on | 04:25 |
| ayoung | https://hostname/idp/saml2/SOAP/ECP | 04:25 |
| ayoung | I think we were hardcoding something...I think I know how to fix...1 sec | 04:25 |
| *** sdake has joined #openstack-keystone | 04:29 | |
| *** joesavak has quit IRC | 04:29 | |
| *** sdake_ has joined #openstack-keystone | 04:32 | |
| marekd | ayoung: auth url for keystone-sp would be /OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth | 04:32 |
| marekd | so skip /mellon/ECP part from your auth url. | 04:33 |
| ayoung | marekd, but that gets build by the saml plugin from t\just the auth url | 04:33 |
| ayoung | marekd, let me paste | 04:33 |
| *** sdake has quit IRC | 04:33 | |
| ayoung | http://paste.openstack.org/show/205047/ | 04:33 |
| marekd | ayoung: let met get back in an hour or so, need to get to work now (email if you are not here then). | 04:36 |
| ayoung | marekd, I need to go to bed | 04:36 |
| ayoung | I won;t be uop in an hour or so...but tomorrow I will have people I can ask | 04:37 |
| *** pnavarro has joined #openstack-keystone | 04:45 | |
| *** kiran-r has joined #openstack-keystone | 04:50 | |
| *** iamjarvo has quit IRC | 05:03 | |
| *** iamjarvo has joined #openstack-keystone | 05:04 | |
| *** iamjarvo has quit IRC | 05:08 | |
| *** _cjones_ has joined #openstack-keystone | 05:21 | |
| *** _cjones_ has quit IRC | 05:26 | |
| *** sdake_ has quit IRC | 05:42 | |
| *** ajayaa has joined #openstack-keystone | 05:52 | |
| *** markvoelker has quit IRC | 06:10 | |
| *** jamesllondon has quit IRC | 06:10 | |
| *** _cjones_ has joined #openstack-keystone | 06:22 | |
| *** pnavarro has quit IRC | 06:26 | |
| *** _cjones_ has quit IRC | 06:27 | |
| *** stevemar has quit IRC | 06:31 | |
| *** sdake has joined #openstack-keystone | 06:35 | |
| *** spandhe has quit IRC | 06:36 | |
| *** markvoelker has joined #openstack-keystone | 06:40 | |
| *** markvoelker has quit IRC | 06:45 | |
| *** spandhe has joined #openstack-keystone | 06:51 | |
| *** blogan has quit IRC | 06:52 | |
| *** ptoohill has quit IRC | 06:53 | |
| *** jaosorior has joined #openstack-keystone | 06:54 | |
| *** blogan has joined #openstack-keystone | 06:56 | |
| *** ptoohill has joined #openstack-keystone | 06:57 | |
| *** browne has quit IRC | 06:58 | |
| *** bdossant has joined #openstack-keystone | 07:03 | |
| *** henrynash has joined #openstack-keystone | 07:17 | |
| *** ChanServ sets mode: +v henrynash | 07:17 | |
| *** sdake has quit IRC | 07:35 | |
| *** markvoelker has joined #openstack-keystone | 07:41 | |
| *** markvoelker has quit IRC | 07:46 | |
| *** sdake has joined #openstack-keystone | 07:48 | |
| *** jistr has joined #openstack-keystone | 07:50 | |
| *** josecastroleon has joined #openstack-keystone | 07:52 | |
| *** spandhe has quit IRC | 07:54 | |
| *** lhcheng has joined #openstack-keystone | 07:55 | |
| *** ChanServ sets mode: +v lhcheng | 07:55 | |
| *** sdake has quit IRC | 08:00 | |
| *** josecastroleon has quit IRC | 08:01 | |
| *** josecastroleon_ has joined #openstack-keystone | 08:07 | |
| *** henrynash has quit IRC | 08:09 | |
| *** josecastroleon_ has quit IRC | 08:10 | |
| *** henrynash has joined #openstack-keystone | 08:12 | |
| *** ChanServ sets mode: +v henrynash | 08:12 | |
| *** rushiagr_away is now known as rushiagr | 08:13 | |
| openstackgerrit | Deepti Ramakrishna proposed openstack/python-keystoneclient: Document non-standard encoding of the PKI token. https://review.openstack.org/176230 | 08:13 |
| marekd | Hm, I am having trouble finding logs from yesterday's Keystone meeting. Anybody possess such link ? | 08:18 |
| *** lhcheng has quit IRC | 08:32 | |
| *** lhcheng has joined #openstack-keystone | 08:37 | |
| *** ChanServ sets mode: +v lhcheng | 08:37 | |
| *** lhcheng has quit IRC | 08:39 | |
| *** markvoelker has joined #openstack-keystone | 08:42 | |
| *** markvoelker has quit IRC | 08:47 | |
| *** g2` has quit IRC | 08:54 | |
| *** g2` has joined #openstack-keystone | 08:58 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 09:04 |
| *** lhcheng has joined #openstack-keystone | 09:15 | |
| *** ChanServ sets mode: +v lhcheng | 09:15 | |
| *** rushiagr is now known as rushiagr_away | 09:17 | |
| *** Ephur has quit IRC | 09:19 | |
| *** afazekas_ has joined #openstack-keystone | 09:21 | |
| *** lhcheng has quit IRC | 09:30 | |
| *** e0ne has joined #openstack-keystone | 09:30 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 09:31 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Materialized path for project hierarchy https://review.openstack.org/173424 | 09:36 |
| *** rushiagr_away is now known as rushiagr | 09:37 | |
| *** markvoelker has joined #openstack-keystone | 09:43 | |
| *** erkules_ is now known as erkules | 09:44 | |
| *** erkules has joined #openstack-keystone | 09:44 | |
| *** markvoelker has quit IRC | 09:47 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Materialized path for project hierarchy https://review.openstack.org/173424 | 09:48 |
| *** davechen1 has quit IRC | 09:57 | |
| *** g2` has quit IRC | 09:58 | |
| *** henrynash has quit IRC | 09:59 | |
| *** _cjones_ has joined #openstack-keystone | 10:00 | |
| *** aix has joined #openstack-keystone | 10:00 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 10:01 |
| *** g2` has joined #openstack-keystone | 10:01 | |
| *** _cjones_ has quit IRC | 10:05 | |
| *** samueldmq has joined #openstack-keystone | 10:27 | |
| samueldmq | morning | 10:28 |
| breton | morning! | 10:34 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: New attributes for SAML assertion https://review.openstack.org/174462 | 10:39 |
| *** markvoelker has joined #openstack-keystone | 10:43 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 10:48 |
| *** rushiagr is now known as rushiagr_away | 10:48 | |
| *** markvoelker has quit IRC | 10:48 | |
| *** e0ne is now known as e0ne_ | 10:51 | |
| *** e0ne_ is now known as e0ne | 10:55 | |
| *** aix has quit IRC | 11:07 | |
| *** davidckennedy has joined #openstack-keystone | 11:13 | |
| *** afazekas_ has quit IRC | 11:18 | |
| *** e0ne is now known as e0ne_ | 11:27 | |
| *** afazekas_ has joined #openstack-keystone | 11:33 | |
| *** e0ne_ has quit IRC | 11:38 | |
| *** bknudson has quit IRC | 11:40 | |
| *** markvoelker has joined #openstack-keystone | 11:44 | |
| *** markvoelker has quit IRC | 11:45 | |
| *** markvoelker has joined #openstack-keystone | 11:45 | |
| samueldmq | breton, ayoung could you please revisit 'Adds inherited column to RoleAssignment PK' ? | 11:45 |
| samueldmq | breton, ayoung https://review.openstack.org/#/c/142472/ | 11:46 |
| *** _cjones_ has joined #openstack-keystone | 11:49 | |
| *** _cjones_ has quit IRC | 11:53 | |
| *** e0ne has joined #openstack-keystone | 11:58 | |
| *** aix has joined #openstack-keystone | 11:58 | |
| *** ayoung has quit IRC | 12:03 | |
| *** ajayaa has quit IRC | 12:07 | |
| *** raildo has joined #openstack-keystone | 12:09 | |
| *** lhcheng has joined #openstack-keystone | 12:30 | |
| *** ChanServ sets mode: +v lhcheng | 12:30 | |
| *** iamjarvo has joined #openstack-keystone | 12:32 | |
| *** iamjarvo has quit IRC | 12:33 | |
| *** iamjarvo has joined #openstack-keystone | 12:33 | |
| *** lhcheng has quit IRC | 12:34 | |
| breton | samueldmq: will do later today | 12:36 |
| *** rushiagr_away is now known as rushiagr | 12:39 | |
| *** e0ne is now known as e0ne_ | 12:41 | |
| *** gordc has joined #openstack-keystone | 12:41 | |
| *** bknudson has joined #openstack-keystone | 12:43 | |
| *** ChanServ sets mode: +v bknudson | 12:43 | |
| *** e0ne_ is now known as e0ne | 12:46 | |
| *** mattfarina has joined #openstack-keystone | 13:07 | |
| *** zzzeek has joined #openstack-keystone | 13:09 | |
| *** rushiagr is now known as rushiagr_away | 13:12 | |
| *** henrynash has joined #openstack-keystone | 13:13 | |
| *** ChanServ sets mode: +v henrynash | 13:13 | |
| *** afazekas_ has quit IRC | 13:13 | |
| samueldmq | breton, nice thanks | 13:14 |
| samueldmq | henrynash, hi - you around ? | 13:14 |
| henrynash | samueldmq: hi | 13:14 |
| *** richm has joined #openstack-keystone | 13:14 | |
| samueldmq | henrynash, just to let you know I have a blog post on domain-specific configs on sql | 13:15 |
| samueldmq | henrynash, http://www.samueldmq.com/domain-specific-configuration-on-sql/ | 13:15 |
| samueldmq | :-) | 13:15 |
| henrynash | samueldmq: nice!!!!!! | 13:15 |
| samueldmq | henrynash, 'A kilo of domain-specific configs on SQL' : ) | 13:17 |
| henrynash | samuldmq: cute, indeed! | 13:18 |
| samueldmq | hehe | 13:18 |
| dstanek | henrynash: samueldmq: is there any reason why we don't throw an exception when listing a subtree that contains a reference cycle? right now it just returns None | 13:22 |
| *** ajayaa has joined #openstack-keystone | 13:22 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes cyclic ref detection in project subtree https://review.openstack.org/176304 | 13:22 |
| henrynash | dstanek: I’d have expected it to throw an error… | 13:23 |
| dstanek | henrynash: see my patch above ^ | 13:24 |
| henrynash | dstanek: looking | 13:24 |
| henrynash | dstanek: so agree it should error….if we ever hit the coniditon, we’ve no way to know whether returning partial data is a good thing or a bad thing | 13:26 |
| samueldmq | dstanek, hi - looking | 13:26 |
| henrynash | dstanek: I assuume you found teh actual bug referenced by inspection, rather than actuall hitting it? | 13:27 |
| dstanek | henrynash: yes, i was reading though a code review and spotted it | 13:27 |
| henrynash | dstanek: yet again the stanel knowledge shines through! | 13:28 |
| dstanek | henrynash: from what i can tell you can't create a cycle through the manager so i wouldn't expect this bug to be possible in a real environment | 13:28 |
| henrynash | s/stanel/stanek/ | 13:28 |
| henrynash | dstanek: no, you can’t…so it’s really a check to ensure we don’t have infinite loops i our code | 13:28 |
| samueldmq | dstanek, ++, yeah since you modified directly in the sql | 13:29 |
| henrynash | dstanek: something really bad has happened if we hit it | 13:29 |
| dstanek | henrynash: should i create a patch to fix the None and make it raise an exception? | 13:29 |
| *** stevemar has joined #openstack-keystone | 13:29 | |
| *** ChanServ sets mode: +v stevemar | 13:29 | |
| dstanek | my worry is that if we don't and this does happen that there will be no way to detect and know what's happening | 13:30 |
| henrynash | dtsanek: i think we should…I’m OK to do it if you like, or feel free to do it if you like | 13:30 |
| henrynash | dstanek: otehr than the logs….and that could be ages until anyone spots that | 13:30 |
| samueldmq | dstanek, henrynash actually we can hit this in real-envs, since we can use a ldap managed outside, right? | 13:31 |
| samueldmq | but I dunno if ldap is really used by anyone for resource | 13:31 |
| samueldmq | and yes, I agree an error should be better, and logging it should be a plus | 13:31 |
| henrynash | samueldmq: (I doubt it): I thikn the ldap case is that just the same as someone updating sql directly | 13:32 |
| henrynash | samueldmq: …and I think we log it already…just don’t raise an error…which we should | 13:32 |
| samueldmq | henrynash, right, I agree | 13:33 |
| *** ayoung has joined #openstack-keystone | 13:33 | |
| *** ChanServ sets mode: +v ayoung | 13:33 | |
| samueldmq | henrynash. dstanek I am wondering if we could have an automated approach to find bugs like this | 13:33 |
| dstanek | i thought ldap didn't allow hierarchical projects | 13:34 |
| samueldmq | I dunno, I knew softwares like findbugs in the past, dunno for python | 13:34 |
| samueldmq | dstanek, actually no, not yet | 13:34 |
| dstanek | samueldmq: for this one no, not really | 13:34 |
| samueldmq | henrynash, ^ should we support it? | 13:34 |
| samueldmq | dstanek, this one is interesting since you couldnt even use your @wip, since it will never fail | 13:35 |
| samueldmq | dstanek, @infinite_loop | 13:35 |
| samueldmq | hah | 13:35 |
| *** rushil has joined #openstack-keystone | 13:36 | |
| dstanek | the way this could have been caught is to start making sure all cases are tested and looking at the coverage report - the coverage report showed that this code was never hit | 13:36 |
| samueldmq | dstanek, oh! a gate job warning coverage was reduced for any specific job would be good :p | 13:37 |
| samueldmq | dstanek, but would carry ppl to put their focus on passing it | 13:37 |
| dstanek | samueldmq: that becomes dangerous - we as developers should really be looking into this | 13:37 |
| samueldmq | dstanek, as we discussed a few days ago | 13:37 |
| henrynash | dtsanek: yep, I think that’s my bad….not testing it…. | 13:37 |
| *** stevemar has quit IRC | 13:37 | |
| rodrigods | marekd, around? | 13:38 |
| marekd | rodrigods: Hi. | 13:38 |
| samueldmq | dstanek, how do you check test coverage for keystoen ? | 13:38 |
| marekd | samueldmq: tox -ecover | 13:38 |
| samueldmq | marekd, thx | 13:38 |
| dstanek | henrynash: not your fault - we have a half dozen people listed as authors on the patch and at least 2 cores gave is a +2 - i think we just need to be a little more formal with reviewing coverage | 13:39 |
| samueldmq | dstanek, ++ | 13:39 |
| henrynash | dstanek: agreed | 13:39 |
| samueldmq | dstanek, I agree, the ones I know do it often are you and bknudson | 13:39 |
| samueldmq | I will start doing it more often | 13:39 |
| rodrigods | marekd, keystone is throwing an error when I try to scope a federated token | 13:40 |
| rodrigods | marekd, http://paste.openstack.org/show/205092/ | 13:40 |
| rodrigods | marekd, did you see this before? | 13:40 |
| bknudson | there's a thread on the mailing list about having a job that automatically checks coverage | 13:40 |
| marekd | rodrigods: let me see. | 13:40 |
| rodrigods | marekd, Juno version, btw | 13:40 |
| samueldmq | bknudson, I will look for it | 13:41 |
| samueldmq | bknudson, then it would fail if test coverage was reduced ? | 13:41 |
| dstanek | ugg...i hope not. i hate that idea. always leads to gaming the system. | 13:41 |
| samueldmq | bknudson, I've been discussing about this with dstanek | 13:42 |
| samueldmq | ^ | 13:42 |
| marekd | rodrigods: hm, is it master? | 13:42 |
| rodrigods | marekd, stable/juno | 13:43 |
| ayoung | https://review.openstack.org/#/c/135774/ please approve. Unified Access info is holding up a slew of other features | 13:45 |
| ayoung | I'm working on the client code now | 13:45 |
| rodrigods | marekd, aaaand the code http://paste.openstack.org/show/205094/ | 13:45 |
| *** iamjarvo has quit IRC | 13:46 | |
| *** e0ne is now known as e0ne_ | 13:46 | |
| dstanek | i think in a couple of cases my patches may have decreased coverage because we were testing useless things | 13:47 |
| marekd | rodrigods: let me check few spots. | 13:47 |
| marekd | rodrigods: try with auth method set to 'saml2' instead of 'token' | 13:49 |
| rodrigods | marekd, tried already... | 13:50 |
| rodrigods | "message": "Expecting to find saml2 in identity - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error.", "code": 400, "title": "Bad Request" | 13:50 |
| marekd | rodrigods: i bet you removed 'saml2' from your auth methods from keystone.conf. | 13:51 |
| samueldmq | ayoung, so each service would instantiate an access info object from the HTTP headers set by keystonemiddleware ? | 13:51 |
| ayoung | samueldmq, yes | 13:51 |
| ayoung | samueldmq, they already do | 13:51 |
| ayoung | it is just a dictionary | 13:51 |
| ayoung | this is a strict python class model, but can act as a dictionary | 13:51 |
| samueldmq | ayoung, where this code will be placed ? oslo ? | 13:51 |
| ayoung | no KC | 13:51 |
| ayoung | it is common code, but the primary consumer is KC.... | 13:52 |
| ayoung | there is a follow on patch to make KC use it | 13:52 |
| marekd | rodrigods: i am also curious what's in self.fed_token_id (or how the token actually looks like). | 13:52 |
| ayoung | https://review.openstack.org/#/c/160134/7 samueldmq | 13:52 |
| *** iamjarvo has joined #openstack-keystone | 13:52 | |
| *** iamjarvo has quit IRC | 13:53 | |
| rodrigods | marekd, http://paste.openstack.org/show/205097/ | 13:53 |
| *** iamjarvo has joined #openstack-keystone | 13:53 | |
| rodrigods | marekd, fed_token_id is the Unscoped token id | 13:53 |
| samueldmq | ayoung, ok but .. I cant see why kc there ... middleware is in front of the services, and set the headers | 13:53 |
| *** iamjarvo has quit IRC | 13:54 | |
| samueldmq | ayoung, the service read the headers themselves and create the dict ( today ) | 13:54 |
| ayoung | samueldmq, and how does middleware validate the token? | 13:54 |
| rodrigods | marekd, and here the auth_context http://paste.openstack.org/show/205098/ | 13:54 |
| samueldmq | ayoung, k middleware uses the kc | 13:54 |
| *** jdennis has quit IRC | 13:54 | |
| *** iamjarvo has joined #openstack-keystone | 13:54 | |
| ayoung | and it will get the access info from that | 13:54 |
| samueldmq | ayoung, and sets the HTTP headers in the request, before passing it to the service right? | 13:54 |
| ayoung | samueldmq, none of that will change | 13:55 |
| ayoung | its just the implementation of the access info that I'm changing here. | 13:55 |
| samueldmq | ayoung, dont the services also need to build accessinfo ? | 13:55 |
| *** bandwidth has joined #openstack-keystone | 13:55 | |
| ayoung | samueldmq, yes. the goal here is that they all have a common definition. If they need to recreate it, they can use the builder | 13:56 |
| *** e0ne_ has quit IRC | 13:56 | |
| *** henrynash has quit IRC | 13:56 | |
| *** henrynash has joined #openstack-keystone | 13:57 | |
| *** ChanServ sets mode: +v henrynash | 13:57 | |
| samueldmq | ayoung, right, but as it ( the builders and accessinfo object ) will be used by services + client, I was thinking about the place to put it, that's why I asked if it was on oslo | 13:58 |
| *** iamjarvo has quit IRC | 13:58 | |
| samueldmq | ayoung, but it makes sense to have it on kc as well, since kc itself uses it | 13:59 |
| samueldmq | ayoung, and the services already import kc | 13:59 |
| ayoung | samueldmq, maybe eventually, but for now it stays in KC | 13:59 |
| ayoung | yep | 13:59 |
| samueldmq | ayoung, yes great | 13:59 |
| *** e0ne has joined #openstack-keystone | 13:59 | |
| bandwidth | question: does Juno services (nova, cinder, heat...) support keystone v3 API? I mean, can they talk v3? | 13:59 |
| henrynash | anyone have any experience in using TLS with AD and multipel domain controllers? | 13:59 |
| samueldmq | ayoung, I will take a deeper look on it later today, need to get my kid on the school | 13:59 |
| ayoung | thanks | 13:59 |
| *** tqtran has joined #openstack-keystone | 14:02 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:05 | |
| *** stevemar has joined #openstack-keystone | 14:07 | |
| *** ChanServ sets mode: +v stevemar | 14:07 | |
| *** Ephur has joined #openstack-keystone | 14:09 | |
| rodrigods | marekd, what I know so far... isn't the mapped plugin that is taking care of the request | 14:10 |
| *** henrynash has quit IRC | 14:12 | |
| marekd | rodrigods: what makes you think so? | 14:12 |
| rodrigods | marekd, added lots of prints in its authenticate() method | 14:13 |
| marekd | rodrigods: how does keystone.conf [auth] look like ? | 14:14 |
| marekd | i'd rather suspect some misconfiguration, rather that bug..but who knows :-) | 14:14 |
| rodrigods | marekd, yeah, me too | 14:15 |
| rodrigods | looking | 14:15 |
| rodrigods | methods = external, password, token, saml2, oidc | 14:15 |
| rodrigods | saml2 = keystone.auth.plugins.mapped.Mapped | 14:15 |
| rodrigods | oidc = keystone.auth.plugins.mapped.Mapped | 14:15 |
| rodrigods | marekd, ^ | 14:15 |
| marekd | rodrigods: change to saml2 = keystone.auth.plugins.saml2.Saml2 | 14:17 |
| marekd | and try again. | 14:17 |
| rodrigods | the same =( | 14:18 |
| *** samueldmq_ has joined #openstack-keystone | 14:22 | |
| *** edmondsw has joined #openstack-keystone | 14:23 | |
| marekd | rodrigods: maybe remove external ? | 14:23 |
| marekd | just to be sure nothing is messing around. | 14:23 |
| marekd | rodrigods: i can try to dig a little bit directly on your keystone-sp, otherwise i can guess with you :-) | 14:24 |
| marekd | for sure unscoped token looks correct. | 14:24 |
| *** stevemar has quit IRC | 14:26 | |
| rodrigods | marekd, thanks for the help | 14:28 |
| marekd | rodrigods: try to figure out what auth plugin is being used/loaded. | 14:28 |
| marekd | unless you did it. | 14:28 |
| rodrigods | marekd, I know that "token" is being used | 14:28 |
| *** iamjarvo has joined #openstack-keystone | 14:29 | |
| marekd | rodrigods: so you are using auth method 'saml2' and token.Token is loaded? | 14:29 |
| *** iamjarvo has quit IRC | 14:29 | |
| rodrigods | marekd, neither work, with saml2 it returns "Expecting to find saml2 in identity - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error.", "code": 400, "title": "Bad Request" | 14:30 |
| *** iamjarvo has joined #openstack-keystone | 14:30 | |
| *** iamjarvo has quit IRC | 14:30 | |
| *** iamjarvo has joined #openstack-keystone | 14:30 | |
| *** iamjarvo has quit IRC | 14:30 | |
| *** iamjarvo has joined #openstack-keystone | 14:31 | |
| marekd | rodrigods: http://paste.openstack.org/show/205094/ -> iirc you should change 2 lines here. | 14:31 |
| *** iamjarvo has quit IRC | 14:31 | |
| marekd | rodrigods: so it's methods: ['saml2'] and later 'saml2': { 'id': self.fed_token_id } | 14:32 |
| marekd | (sorry for saying this, i don't know whether you changed it or not :-) | 14:32 |
| *** iamjarvo has joined #openstack-keystone | 14:32 | |
| *** iamjarvo has quit IRC | 14:32 | |
| rodrigods | marekd, yay! | 14:32 |
| rodrigods | it worked! | 14:32 |
| *** iamjarvo has joined #openstack-keystone | 14:33 | |
| *** iamjarvo has quit IRC | 14:33 | |
| rodrigods | marekd, many many thanks | 14:33 |
| marekd | rodrigods: no problem :-) | 14:33 |
| *** iamjarvo has joined #openstack-keystone | 14:33 | |
| *** iamjarvo has quit IRC | 14:33 | |
| rodrigods | marekd, luckly you remembered how the request was made in Juno :) | 14:33 |
| *** iamjarvo has joined #openstack-keystone | 14:34 | |
| marekd | i know i was playing with that and since Kilo (or master) your 'token' method should also work. | 14:34 |
| *** iamjarvo has quit IRC | 14:34 | |
| *** iamjarvo has joined #openstack-keystone | 14:35 | |
| *** iamjarvo has quit IRC | 14:35 | |
| *** iamjarvo has joined #openstack-keystone | 14:36 | |
| *** iamjarvo has quit IRC | 14:36 | |
| *** iamjarvo has joined #openstack-keystone | 14:36 | |
| *** iamjarvo has quit IRC | 14:36 | |
| *** iamjarvo has joined #openstack-keystone | 14:37 | |
| *** iamjarvo has quit IRC | 14:37 | |
| *** iamjarvo has joined #openstack-keystone | 14:38 | |
| *** iamjarvo has quit IRC | 14:38 | |
| *** iamjarvo has joined #openstack-keystone | 14:39 | |
| *** iamjarvo has quit IRC | 14:39 | |
| *** iamjarvo has joined #openstack-keystone | 14:39 | |
| *** iamjarvo has quit IRC | 14:40 | |
| *** iamjarvo has joined #openstack-keystone | 14:40 | |
| *** iamjarvo has quit IRC | 14:41 | |
| *** iamjarvo has joined #openstack-keystone | 14:41 | |
| *** iamjarvo has quit IRC | 14:41 | |
| *** iamjarvo has joined #openstack-keystone | 14:42 | |
| *** iamjarvo has quit IRC | 14:42 | |
| *** iamjarvo has joined #openstack-keystone | 14:43 | |
| *** iamjarvo has quit IRC | 14:43 | |
| *** sdake has joined #openstack-keystone | 14:43 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Remove saml2 comment in scoping federated token https://review.openstack.org/176339 | 14:43 |
| rodrigods | marekd, ^ | 14:43 |
| *** iamjarvo has joined #openstack-keystone | 14:44 | |
| *** samueldmq_ has quit IRC | 14:44 | |
| *** sdake_ has joined #openstack-keystone | 14:44 | |
| marekd | rodrigods: i am notsure whether resoping fed-token would work. | 14:45 |
| marekd | then we could probably leave --federated-token-id-- .... | 14:45 |
| *** tqtran has quit IRC | 14:45 | |
| marekd | ayoung: did you solve your problems with ipsilon + ecp ? | 14:46 |
| ayoung | marekd, not yet, but got some advice...try8ing to update access info first, will return to it later today | 14:46 |
| rodrigods | marekd, true | 14:47 |
| marekd | ayoung: https://gist.github.com/zaccone/509136cfa1c4efca6926 for the record, this is my snipped that i used (successfully) when I was playing with it. | 14:47 |
| marekd | ayoung: looks pretty much like yours. | 14:47 |
| ayoung | marekd, still helps. THanks | 14:47 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Remove saml2 comment in scoping federated token https://review.openstack.org/176339 | 14:47 |
| marekd | ayoung: can you remind me what was failing actually? | 14:47 |
| *** sdake has quit IRC | 14:48 | |
| *** iamjarvo has quit IRC | 14:49 | |
| *** browne has joined #openstack-keystone | 14:50 | |
| marekd | rodrigods: ok, voted on the patch. | 14:54 |
| marekd | rodrigods: thanks. | 14:54 |
| *** bandwidth has quit IRC | 14:54 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 14:55 |
| *** ajayaa has quit IRC | 14:55 | |
| *** bandwidth has joined #openstack-keystone | 14:56 | |
| *** ajayaa has joined #openstack-keystone | 14:58 | |
| *** iamjarvo has joined #openstack-keystone | 15:08 | |
| *** bdossant has quit IRC | 15:12 | |
| *** bdossant has joined #openstack-keystone | 15:13 | |
| *** iamjarvo has quit IRC | 15:18 | |
| *** tqtran has joined #openstack-keystone | 15:22 | |
| *** _cjones_ has joined #openstack-keystone | 15:23 | |
| openstackgerrit | Merged openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 15:24 |
| *** tqtran has quit IRC | 15:26 | |
| *** _cjones_ has quit IRC | 15:28 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 15:32 |
| *** joesavak has joined #openstack-keystone | 15:33 | |
| *** kiran-r has quit IRC | 15:34 | |
| *** rwsu has joined #openstack-keystone | 15:34 | |
| *** csoukup has joined #openstack-keystone | 15:35 | |
| *** c_soukup has joined #openstack-keystone | 15:36 | |
| *** e0ne has quit IRC | 15:36 | |
| *** csoukup has quit IRC | 15:36 | |
| *** c_soukup has quit IRC | 15:36 | |
| *** csoukup has joined #openstack-keystone | 15:37 | |
| *** e0ne has joined #openstack-keystone | 15:37 | |
| *** iamjarvo has joined #openstack-keystone | 15:43 | |
| *** iamjarvo has quit IRC | 15:44 | |
| *** gyee has joined #openstack-keystone | 15:44 | |
| *** ChanServ sets mode: +v gyee | 15:44 | |
| *** iamjarvo has joined #openstack-keystone | 15:44 | |
| *** iamjarvo has quit IRC | 15:45 | |
| marekd | Hm, typically when user wants to use any OpenStack service he would authenticate with Keystone, get a token, later put this token in the X-Auth-Token header and issue a HTTP request to service like glance or nova. Now, it will be keystonemiddleware that will take care of the validating of the X-Auth-Token (and the detailed steps would be: ksm auhenticates with some service account, gets a token, and then validates the user's token stored in | 15:46 |
| *** sdake_ has quit IRC | 15:48 | |
| ayoung | marekd, is this a problem? | 15:54 |
| marekd | ayoung: not at all. I am asing is my understanding of the workflow is correct. | 15:54 |
| ayoung | marekd, ah, just saw your question. My problem with ECP was still getting Ipsilon setup. We are just getting ECP support into the server | 15:54 |
| marekd | ayoung: yeah, i know. | 15:55 |
| ayoung | There is something wrong with my metadata setup, and I don't know what | 15:55 |
| *** jsavak has joined #openstack-keystone | 15:55 | |
| ayoung | but the server metadata doesn't have the ECP URL in it | 15:55 |
| marekd | ayoung: if you need to test ECP itself you don't need any single bit of Keystone or OpenStack. | 15:55 |
| ayoung | I've compared it with a working one, and that does have the meta data in it | 15:56 |
| marekd | server - idp or sever sp ? | 15:56 |
| ayoung | marekd, my goal is to make sure that the ECP support in Ipsilon will work with the ECP support in Keystone client | 15:56 |
| ayoung | IDP | 15:56 |
| ayoung | SP looks OK | 15:56 |
| *** joesavak has quit IRC | 15:58 | |
| ayoung | marekd, one sec...let me repost the access info patch with the audit_ids in it, and then I'll swich back to ECP mode | 15:58 |
| marekd | ayoung: i will be here ~20 minutes more :/ | 15:59 |
| ayoung | marekd, its OK, I think I'm tracking | 15:59 |
| ayoung | I have a script that shows what is supposed to happen with ECP for a generic resource. I'll use that to troubleshoot my setup until and then should be able to use the code you gisted to test the client auth plugin | 16:00 |
| *** browne has quit IRC | 16:08 | |
| morganfainberg | Hmm. | 16:08 |
| gyee | morganfainberg, need your opinion on the endpoint filtering enforcement middleware | 16:10 |
| gyee | currently it allows enforcement on both service_id and endpoint_id | 16:11 |
| morganfainberg | Right. | 16:11 |
| gyee | I am debating whether we should also allow service_type and region_id | 16:11 |
| gyee | because for V2 catalog, only service_type is there | 16:11 |
| morganfainberg | The initial scope is service_id and endpoint_id. | 16:12 |
| gyee | I can't think of a case where a service_type corresponding to multiple service_ids | 16:12 |
| gyee | our schema allows it however | 16:12 |
| morganfainberg | Rackspace does it. | 16:12 |
| gyee | oh | 16:12 |
| *** jistr has quit IRC | 16:12 | |
| morganfainberg | Legacy compute and non-legacy compute | 16:12 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Service with no endpoints should not be in catalog https://review.openstack.org/176383 | 16:12 |
| gyee | ah | 16:12 |
| gyee | yes | 16:12 |
| morganfainberg | But they use repose to do enforcement | 16:13 |
| morganfainberg | I think service type would be very logical | 16:13 |
| gyee | so should we allow service_type and region_id? I think its worth supporting all | 16:13 |
| gyee | k, thanks | 16:14 |
| morganfainberg | I don't see a huge demand for region_id, but it's trivial to add | 16:14 |
| gyee | davidckennedy, ^^^ | 16:14 |
| morganfainberg | You'll need to update the spec to cover those added extra bits though. | 16:14 |
| gyee | davidckennedy, can you please update the spec? | 16:14 |
| gyee | or I can update it if davidckennedy is occupied | 16:14 |
| morganfainberg | Do we want this as a logical or, logical and, or??? | 16:15 |
| gyee | logical and | 16:15 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Service with no endpoints should not be in catalog https://review.openstack.org/176383 | 16:15 |
| gyee | that's how endpoint group is setup | 16:15 |
| morganfainberg | What is the effect of service_id and service_type are set, or service_id and endpoint_id or service_type and region_id | 16:16 |
| gyee | wait, sorry | 16:16 |
| gyee | I mean logical or | 16:16 |
| morganfainberg | Ok | 16:16 |
| gyee | union of all | 16:16 |
| gyee | my bad | 16:16 |
| morganfainberg | Make sure that is very clearly documented | 16:16 |
| gyee | will do | 16:16 |
| davidckennedy | gyee morganfeinberg if we're using service_type then we should drop service_id right? | 16:17 |
| *** _cjones_ has joined #openstack-keystone | 16:18 | |
| gyee | don't drop it | 16:18 |
| gyee | just do the union of all the results | 16:18 |
| davidckennedy | but it doesn't work for v2 anyway and surely service_type would do as well? | 16:19 |
| gyee | if service_type is there, use it | 16:19 |
| gyee | if absence, skip it | 16:19 |
| gyee | absent | 16:19 |
| gyee | result = (service_type matches) || (service_id matches) || (endpoint_id matches) || (region_id matches) | 16:20 |
| davidckennedy | ORs? | 16:20 |
| *** henrynash has joined #openstack-keystone | 16:20 | |
| *** ChanServ sets mode: +v henrynash | 16:20 | |
| gyee | that's how we process the endpoint group filters at the server side | 16:20 |
| gyee | right | 16:21 |
| davidckennedy | I think this is a bit odd. That means that if a region is specified then all endpoints will be valid - given an association | 16:22 |
| *** jsavak has quit IRC | 16:22 | |
| davidckennedy | So whoever configures it has to be pretty careful that they are not giving away more than they want? | 16:23 |
| davidckennedy | gyee I'll make those changes to the spec tomorrow and see how it looks. | 16:24 |
| *** bdossant has quit IRC | 16:25 | |
| *** davidckennedy has quit IRC | 16:26 | |
| morganfainberg | I wonder if we could use Oslo.policy DSL for this. | 16:26 |
| gyee | oh? | 16:27 |
| morganfainberg | gyee: ^ davidckennedy | 16:27 |
| gyee | DSL | 16:27 |
| gyee | policy match is a logical and | 16:27 |
| gyee | nevermind, it can be both | 16:28 |
| morganfainberg | Is a logical <whatever> | 16:28 |
| morganfainberg | yes | 16:28 |
| gyee | yeah | 16:28 |
| gyee | I like the idea | 16:28 |
| morganfainberg | Well it doesn't do bitwise operations and isn't Turing complete. :P | 16:28 |
| gyee | because we will be introducing police enforcement middleware as part of policy revamp anyway | 16:29 |
| gyee | lets do this! | 16:29 |
| morganfainberg | But we already have a tool for this. The issue is we are giving people a ton of rope to to shoo themselves in the foot (yay mixed up metaphors). | 16:29 |
| gyee | I call it "flexibility" | 16:29 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: service child process normal SIGTERM exit https://review.openstack.org/176391 | 16:30 |
| morganfainberg | We could craft a basic rule set that is better than straight logical or/ands and put it in the config. | 16:30 |
| morganfainberg | Just with a warning "OMG DO NOT CHANGE THIS unless you know wtf you are doing" | 16:30 |
| gyee | lemme tinker around with the code | 16:30 |
| gyee | tinker with | 16:30 |
| gyee | there should be only one rule I think | 16:31 |
| gyee | (service_id%(service_id)s or ...) | 16:31 |
| morganfainberg | It may be worth hard-coding a nice rule set first pass: (region_id? &(service_id || service_type || endpoint_id) | 16:31 |
| gyee | yes I agree | 16:32 |
| morganfainberg | Or just make that the logical policy w/o the DSL ^ | 16:32 |
| morganfainberg | That is a weird mix of regex and ldap notation ^ | 16:33 |
| *** _cjones_ has quit IRC | 16:33 | |
| gyee | policy is pretty straight forward, only issue is to turn the catalog into a flatten dict | 16:33 |
| gyee | which is not a big deal | 16:33 |
| morganfainberg | But if region id, it is an and with, service id, endpoint id, or service type | 16:34 |
| *** alexsyip has joined #openstack-keystone | 16:34 | |
| gyee | can oslo policy handle wildcard matches? | 16:34 |
| gyee | it would be awesome if it can do that | 16:34 |
| morganfainberg | Or would it be: region id & (service_id || service_type) & endpoint id | 16:34 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Sync oslo-incubator Ie51669bd278288b768311ddf56ad31a2f28cc7ab https://review.openstack.org/176391 | 16:34 |
| morganfainberg | gyee: not sure if it can. | 16:34 |
| gyee | we should | 16:35 |
| morganfainberg | Ok so I think we need to make the enforcement configurable. Think about the default rule. | 16:36 |
| gyee | yes definitely | 16:36 |
| gyee | let me work on the patch | 16:36 |
| morganfainberg | Because I think it needs to be the best general use-case option. | 16:36 |
| gyee | morganfainberg, should I also submit a spec to make oslo policy handle wildcard matches? | 16:37 |
| morganfainberg | Let's evaluate that separately. | 16:37 |
| gyee | k | 16:37 |
| gyee | for the hierarchical/tree stuff, wildcard matches definitely helps | 16:38 |
| *** bandwidth has quit IRC | 16:40 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Materialized path for project hierarchy https://review.openstack.org/173424 | 16:41 |
| amakarov | rodrigods, gyee hi! Can you please take a look again? ^^ | 16:45 |
| rodrigods | amakarov, will do, thx | 16:46 |
| *** _cjones_ has joined #openstack-keystone | 16:46 | |
| *** Ctina has joined #openstack-keystone | 16:49 | |
| amakarov | rodrigods, wait, fixing something... | 16:49 |
| *** browne has joined #openstack-keystone | 16:50 | |
| amakarov | done | 16:50 |
| *** e0ne has quit IRC | 16:50 | |
| *** joesavak has joined #openstack-keystone | 16:53 | |
| morganfainberg | ayoung: going to have stickers with the KSL logo made for the summit. Light background or dark? | 16:55 |
| morganfainberg | As in made to standout on a light background or a dark one. | 16:55 |
| gyee | neon, grow in the dark :) | 16:57 |
| gyee | amakarov, looking | 16:57 |
| amakarov | gyee, adding an example now, just a moment please :) | 16:59 |
| gyee | k | 16:59 |
| *** harlowja_away is now known as harlowja | 16:59 | |
| amakarov | gyee, rodrigods, raildo welcome! https://review.openstack.org/#/c/173424 | 17:01 |
| raildo | :) | 17:01 |
| *** jaosorior has quit IRC | 17:02 | |
| *** tqtran has joined #openstack-keystone | 17:05 | |
| *** _cjones_ has quit IRC | 17:08 | |
| ayoung | morganfainberg, link? | 17:08 |
| *** lhcheng has joined #openstack-keystone | 17:08 | |
| *** ChanServ sets mode: +v lhcheng | 17:08 | |
| ayoung | I want to say dark, but I need to see the colors | 17:08 |
| morganfainberg | https://github.com/morganfainberg/keystone_stuff/blob/master/KeystoneLogo.svg | 17:09 |
| morganfainberg | basically. | 17:09 |
| morganfainberg | i have a version that works on a dark background too | 17:09 |
| morganfainberg | it inverts some colors. | 17:09 |
| ayoung | morganfainberg, should we drop the word. Make it so you just have to know? | 17:11 |
| *** lhcheng_ has joined #openstack-keystone | 17:11 | |
| morganfainberg | ayoung, perhaps. | 17:12 |
| morganfainberg | ayoung, I'm going to do a few variations on it. one variation might be no word | 17:12 |
| ayoung | morganfainberg, I kindof want this: http://upload.wikimedia.org/wikipedia/commons/5/5c/8500_-_Milano_-_Palazzo_Borgazzi_%281829%29_-_Dettaglio_-_Foto_Giovanni_Dall%27Orto,_31-Aug-2007.jpg | 17:13 |
| morganfainberg | line art it? | 17:13 |
| ayoung | although this is probably more accurate http://sugarmtnfarm.com/blog/uploaded_images/ArcKeyStoneDSCF5630-706588.jpg | 17:13 |
| ayoung | Will do! | 17:13 |
| morganfainberg | hah | 17:13 |
| *** lhcheng has quit IRC | 17:14 | |
| ayoung | morganfainberg, https://www.google.com/search?q=keystone+images&tbm=isch&tbo=u&source=univ&sa=X&ei=YtY3VeK7B4vBggTd5oGgBA&ved=0CCoQsAQ&biw=1680&bih=851#imgrc=ZhxAyiQU1rPVcM%253A%3BygR5X1ywZEuKoM%3Bhttp%253A%252F%252Fwww.buffaloah.com%252Fa%252FDCTNRY%252Fk%252Fkeystone_fairfax.JPG%3Bhttp%253A%252F%252Fwww.buffaloah.com%252Fa%252FDCTNRY%252Fk%252Fkey.html%3B648%3B387 but modify the face to look like a certain bearded someone? | 17:14 |
| morganfainberg | haha no | 17:14 |
| ayoung | Heh | 17:14 |
| morganfainberg | fwiw, i like the KSL logo because it's simple. | 17:14 |
| *** _cjones_ has joined #openstack-keystone | 17:15 | |
| amakarov | morganfainberg, what about this one? :) https://www.google.com/search?q=keystone+images&tbm=isch&tbo=u&source=univ&sa=X&ei=YtY3VeK7B4vBggTd5oGgBA&ved=0CCoQsAQ&biw=1680&bih=851#imgrc=jE0qObx8RqtdoM%253A%3B_qI-J_NXX7NtYM%3Bhttp%253A%252F%252Fupload.wikimedia.org%252Fwikipedia%252Fcommons%252F5%252F5c%252F8500_-_Milano_-_Palazzo_Borgazzi_(1829)_-_Dettaglio_-_Foto_Giovanni_Dall'Orto%252C_31-Aug-2007.jpg%3Bhttp%253A%252F%252Fen.wikipedia.org%25 | 17:15 |
| amakarov | 2Fwiki%252FKeystone_(architecture)%3B2592%3B1944 | 17:15 |
| morganfainberg | amakarov, direct link please? | 17:15 |
| morganfainberg | amakarov, the google search = line-wrap and icky | 17:15 |
| gyee | tinyurl | 17:15 |
| morganfainberg | gyee, bit.ly | 17:16 |
| gyee | ah nice | 17:16 |
| lhcheng_ | ayoung: haha that reminds me of someone | 17:17 |
| ayoung | amakarov, that is the same one I posted. I like | 17:17 |
| morganfainberg | ayoung, this one is... just disturbing http://www.stonecarver.com/architecture/key-lion-keystone.jpg | 17:17 |
| morganfainberg | and i don't know why... | 17:17 |
| gyee | damn that one scary! | 17:17 |
| amakarov | http://dic.academic.ru/pictures/wiki/files/68/Dresden_Residenzschloss_06.jpg | 17:18 |
| morganfainberg | so, these are all great... but bad for stickers/logos | 17:19 |
| amakarov | And I like this one with a lion: http://www.idealstone.ru/upload/resize_cache/iblock/a43/300_1000_1/a434576338173676f72aaf3315c66718.jpg | 17:19 |
| ayoung | amakarov, the Dresden one is great | 17:20 |
| amakarov | morganfainberg, then maybe something like this: http://krov-m.ru/d/269827/d/2_48.jpg | 17:20 |
| gyee | yeah for a sticker, make it cartoonish | 17:20 |
| morganfainberg | this is why the KSL logo is good | 17:20 |
| morganfainberg | it's already cartoonish... it's already associated with us | 17:20 |
| amakarov | morganfainberg, system of baloons :D | 17:21 |
| morganfainberg | amakarov, goes into the cloud. | 17:21 |
| gyee | even better! | 17:21 |
| morganfainberg | here is the original fwiw | 17:21 |
| morganfainberg | https://camo.githubusercontent.com/160d8ec179f975175efe17a3225dfd557772c1b2/687474703a2f2f7465726d2e69652f646174612f6d656469756d5f6b736c2e706e67 | 17:21 |
| morganfainberg | the svg i linked earlier was just a vectorization | 17:22 |
| ayoung | the keystone ios floating away...the whole bridge is gonna collapse. Plus, not sure the "light" aspect is something I'd emphasize. | 17:22 |
| morganfainberg | it doesn't say "light" | 17:23 |
| morganfainberg | and you don't know if it's floating away or floating down into place ;) | 17:23 |
| *** sdake has joined #openstack-keystone | 17:24 | |
| ayoung | quick sketch http://www.younglogic.com/images/Keystone-Lion.jpg | 17:25 |
| amakarov | morganfainberg, then it's better a helicopter instead of baloons :) | 17:25 |
| morganfainberg | ok i'm now sorry i asked. | 17:25 |
| ayoung | morganfainberg, nah, that is not it. ...we want cartoony...let me see | 17:25 |
| morganfainberg | never mind wont bother with this. | 17:26 |
| harlowja | or u guys can actually use a keystone stone :-P | 17:26 |
| harlowja | http://upload.wikimedia.org/wikipedia/commons/thumb/2/24/Arch_voussoirs.svg/2000px-Arch_voussoirs.svg.png | 17:26 |
| harlowja | best logo ever, lol | 17:26 |
| *** spandhe has joined #openstack-keystone | 17:26 | |
| morganfainberg | better to have people bikeshed over other things than a stupid sticker | 17:26 |
| ayoung | I'd like to do something that plays on the openstack logo | 17:26 |
| morganfainberg | so yeah nevermind. | 17:26 |
| morganfainberg | ayoung, lets just say Trademark makes that very hard. | 17:27 |
| ayoung | plays on.... | 17:27 |
| morganfainberg | ayoung, there is a reason we don't have logos for the projects that really do that. | 17:27 |
| morganfainberg | ayoung, stay out of waters that muddy/get close to the official OS logo(s) | 17:28 |
| morganfainberg | ayoung, its a headache. | 17:28 |
| Ctina | this looks nice yet simple if it was changed a little obviously https://stocklogos.com/logo/keystone-construction-0 | 17:29 |
| *** sdake has quit IRC | 17:29 | |
| *** sdake has joined #openstack-keystone | 17:30 | |
| *** bandwidth has joined #openstack-keystone | 17:30 | |
| ayoung | leonchio_, let's talk! | 17:31 |
| ayoung | leonchio_, I think the code I saw is pretty close | 17:31 |
| leonchio_ | hey ayoung | 17:31 |
| leonchio_ | that's the good sign;-) | 17:32 |
| gyee | did review.openstack.org just died on me? | 17:32 |
| amakarov | morganfainberg, maybe get the top half of the openstack logo and put a key stone atop? | 17:32 |
| leonchio_ | so what exactly you can suggest my patch needs to be done? | 17:32 |
| ayoung | since the spec is already approaved, we can leave it as linking x509 and tokenless. I think there is nothing serious in the code that ties the two together | 17:32 |
| -openstackstatus- NOTICE: gerrit is restarting to clear hung stream-events tasks. any review events between 16:48 and 17:32 utc will need to be rechecked or have their approval votes reapplied to trigger testing in zuul | 17:32 | |
| amakarov | http://logo-kid.com/openstack-logo.htm | 17:32 |
| morganfainberg | amakarov, i'm done, i'm sorry i asked. | 17:32 |
| ayoung | leonchio_, I had missed the whole mapping piece of it | 17:32 |
| morganfainberg | amakarov, not bothering. | 17:32 |
| amakarov | morganfainberg, np | 17:32 |
| morganfainberg | amakarov, and we can't do those things witht he OS logo. | 17:33 |
| gyee | amakarov, that the latest? https://review.openstack.org/#/c/173424/14/specs/backlog/materialize-project-hierarchy.rst | 17:33 |
| amakarov | gyee, yes | 17:33 |
| leonchio_ | ayoung, ok as you may tell the mapping is basically follows the same mechansim as the federation, but we don't need grouping though | 17:33 |
| ayoung | morganfainberg, so...to put it to rest: use the keystone from your logo, but actually show it in an arch. Balloons are optional | 17:33 |
| amakarov | ayoung, ++ | 17:34 |
| morganfainberg | ayoung, not going to bother | 17:34 |
| ayoung | leonchio_, we need the "map to an existing user" feature... | 17:34 |
| ayoung | not sure where that is | 17:34 |
| morganfainberg | ayoung, i'm already done and over this. | 17:34 |
| morganfainberg | ayoung, someone else can do something like this if they care. | 17:34 |
| ayoung | morganfainberg, you started it. | 17:34 |
| morganfainberg | ayoung, i asked a "dark or light background" not "what logo" | 17:34 |
| leonchio_ | ayoung, yes, that's exactly what this patch needs, user + domain so that we can make sure the user is in the system in order to authenticate | 17:34 |
| gyee | hahahaha, morgainfainber see what "open" source get you now? | 17:35 |
| morganfainberg | someone else can do this. | 17:35 |
| ayoung | I think that patch is out there leonchio_ take a look, and, if it is, make sure yours depends on it | 17:35 |
| leonchio_ | ayoung, group in federation is used to assign scope which this patch does not need | 17:35 |
| ayoung | leonchio_, right... | 17:35 |
| lhcheng_ | gyee: how about sticking a keystone on the openstack logo? | 17:35 |
| *** lhcheng_ is now known as lhcheng | 17:35 | |
| *** ChanServ sets mode: +v lhcheng | 17:35 | |
| amakarov | lhcheng_, we can't | 17:35 |
| morganfainberg | leonchio_, trademark issues | 17:36 |
| lhcheng | oh | 17:36 |
| lhcheng | heh that would have been nice | 17:36 |
| leonchio_ | morganfainberg, what's trademark issues? | 17:36 |
| ayoung | IGGY PECK FTW https://www.google.com/search?q=arch+of+pancakes&source=lnms&tbm=isch&sa=X&ei=H9w3VdGDHYGENvOEgJgJ&ved=0CAgQ_AUoAg&biw=1680&bih=851#imgrc=PQWj8pXPQPpKwM%253A%3BRdx5_0ZUOkpBPM%3Bhttp%253A%252F%252F4.bp.blogspot.com%252F-NlvYJ-KLd3M%252FUkuZ94gwxaI%252FAAAAAAAAcI8%252Fb7alzHjqHW4%252Fs1600%252Fcomposition.jpg%3Bhttp%253A%252F%252Fwww.thirdstoryies.com%252F2013%252F10%252F02%252Fstorytime-iggy-peck-architect-and-rosie-r | 17:36 |
| ayoung | evere-engineer%252F%3B1600%3B1020 | 17:36 |
| ayoung | heh. | 17:36 |
| morganfainberg | leonchio_, the openstack logo is a registered trademark. | 17:36 |
| ayoung | let me shorten that | 17:36 |
| leonchio_ | ayoung, so this is the patch you are referring to ? https://review.openstack.org/#/c/109295/ | 17:37 |
| ayoung | http://4.bp.blogspot.com/-NlvYJ-KLd3M/UkuZ94gwxaI/AAAAAAAAcI8/b7alzHjqHW4/s1600/composition.jpg | 17:37 |
| morganfainberg | leonchio_, changing that / incorporating it with other things... it's bad legally | 17:37 |
| morganfainberg | leonchio_, and it *must* be defended to the Trademark is lost. so it just isn't possible. | 17:37 |
| *** gyee is now known as chinese_gyee | 17:37 | |
| ayoung | leonchio_, heh...feel free to use any code out of that patch you want | 17:37 |
| ayoung | I was actually ... let me find it. | 17:37 |
| chinese_gyee | morganfainberg, what trademark, never heard of it | 17:37 |
| *** chinese_gyee is now known as gyee | 17:38 | |
| morganfainberg | gyee, hah. | 17:38 |
| lhcheng | morganfainberg: I actually asked about sticking keystone to logo :P | 17:38 |
| *** Ctina has quit IRC | 17:38 | |
| leonchio_ | ayoung, ok, thanks, will review it | 17:38 |
| lhcheng | morganfainberg: but yeah, that makes sense | 17:38 |
| morganfainberg | lhcheng, you there are tons of rules on how close things can be etc. | 17:38 |
| morganfainberg | lhcheng, /me has been wading through the legalese for this recently | 17:39 |
| lhcheng | morganfainberg: eekk | 17:40 |
| morganfainberg | trademark usage is difficult. | 17:40 |
| lhcheng | likely need the lawyers to get involved | 17:41 |
| lhcheng | is the old KSL logo trademarked? | 17:41 |
| gyee | let me check with my couz in China to see if they can make the O slightly tilted so there's no trademark issue :) | 17:42 |
| lhcheng | gyee haha | 17:42 |
| *** david-lyle has quit IRC | 17:42 | |
| *** amakarov is now known as amakarov_away | 17:46 | |
| morganfainberg | lhcheng, no it's public domain | 17:48 |
| morganfainberg | lhcheng, afaict | 17:48 |
| * morganfainberg asked around about it. | 17:48 | |
| morganfainberg | ayoung, we should just pick an animal for our mascot instead http://en.wikipedia.org/wiki/Keystone_species | 17:51 |
| *** leonchio_ is now known as samleong | 17:55 | |
| *** e0ne has joined #openstack-keystone | 18:00 | |
| ayoung | morganfainberg, OK, you were the one that browbeat me into writing access info. We need it. Please bleed on the review. | 18:04 |
| ayoung | https://review.openstack.org/#/c/138519 | 18:04 |
| ayoung | I'll work on rebasing the dependent reviews, but ^^ is needed by a lot of the server side code | 18:05 |
| ayoung | samleong, please look at https://review.openstack.org/#/c/138519 as well, as that is what your patch should be building | 18:06 |
| openstackgerrit | Merged openstack/keystone-specs: Remove saml2 comment in scoping federated token https://review.openstack.org/176339 | 18:06 |
| *** david-lyle has joined #openstack-keystone | 18:07 | |
| *** sleong has joined #openstack-keystone | 18:07 | |
| *** richm has quit IRC | 18:13 | |
| *** joesavak has quit IRC | 18:13 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 18:14 |
| *** richm has joined #openstack-keystone | 18:18 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Test updates to prep for unified access info https://review.openstack.org/160133 | 18:19 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Use Model for access_info https://review.openstack.org/160134 | 18:19 |
| *** sleong has quit IRC | 18:20 | |
| *** aix has quit IRC | 18:21 | |
| *** sleong has joined #openstack-keystone | 18:23 | |
| *** richm has quit IRC | 18:24 | |
| *** ayoung has quit IRC | 18:24 | |
| *** sleong has quit IRC | 18:24 | |
| *** sleong has joined #openstack-keystone | 18:26 | |
| *** richm has joined #openstack-keystone | 18:28 | |
| *** sleong has quit IRC | 18:29 | |
| *** samleon has joined #openstack-keystone | 18:30 | |
| *** joesavak has joined #openstack-keystone | 18:30 | |
| *** lhcheng_ has joined #openstack-keystone | 18:35 | |
| *** lhcheng has quit IRC | 18:39 | |
| morganfainberg | marekd, reading your email. was a bit late last night to really grok it. | 18:42 |
| morganfainberg | marekd, will have some answers/responses later today /tomorrow | 18:42 |
| samleong | ayoung, great, will review it as well | 18:47 |
| *** samleong has quit IRC | 18:47 | |
| *** samleon has quit IRC | 18:47 | |
| *** samleon has joined #openstack-keystone | 18:47 | |
| *** thedodd has joined #openstack-keystone | 18:49 | |
| *** stevemar has joined #openstack-keystone | 18:50 | |
| *** ChanServ sets mode: +v stevemar | 18:50 | |
| *** rushil has quit IRC | 18:51 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes KVS catalog backend https://review.openstack.org/158442 | 18:52 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds missing list_endpoints tests https://review.openstack.org/176434 | 18:52 |
| samueldmq | hi, I have a question regarding keystonemiddleware | 18:53 |
| samueldmq | v3 support specifically | 18:53 |
| samueldmq | does it need any config to work with v3 ? how does it know the token version (infer from its format ) ? | 18:54 |
| *** carlosmarin has quit IRC | 18:59 | |
| bknudson | v3 tokens are totally different than v2 tokens | 19:00 |
| *** carlosmarin has joined #openstack-keystone | 19:00 | |
| bknudson | samueldmq: http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token/__init__.py#n396 | 19:00 |
| samueldmq | bknudson, yeah, I am trying to understand everything because I am working on testing all services with v3 | 19:01 |
| samueldmq | using devstack | 19:01 |
| samueldmq | bknudson, and was trying to realize if just changing the keystone url to v3 was enough (no change in middleware) | 19:01 |
| samueldmq | thx for that link ^ | 19:02 |
| dstanek | i think that the version of the token doesn't have too much to do with the version of the API | 19:02 |
| bknudson | samueldmq: auth_token supports version discovery if you use an unversioned auth URL. | 19:02 |
| samueldmq | dstanek, oh really ? Oo | 19:02 |
| bknudson | so it will pick v3 if the server says it's available. | 19:02 |
| morganfainberg | it should also work if you use v3 specifically | 19:02 |
| samueldmq | bknudson, hmm nice | 19:02 |
| morganfainberg | but then it will only use v3 | 19:02 |
| *** lsmola__ has joined #openstack-keystone | 19:03 | |
| samueldmq | morganfainberg, so yes, that's what I want, using specifically | 19:03 |
| bknudson | yes, you can tell it to also use v3 but recommended setting is unversioned. | 19:03 |
| morganfainberg | bknudson, ++ | 19:03 |
| dstanek | samueldmq: one is the version of the token format and the other is the API | 19:03 |
| samueldmq | bknudson, nice, and then middleware choose the right version (newer one, whatever) | 19:03 |
| samueldmq | dstanek, I thought they had raised together | 19:04 |
| samueldmq | ftw | 19:04 |
| samueldmq | o/ | 19:04 |
| bknudson | you can validate a v2 token with v3 or a v3 token with v2. | 19:05 |
| bknudson | although some v3 tokens cannot be validated using v2. | 19:05 |
| dstanek | samueldmq: the concepts are mostly orthogonal - it's just unfortunate that the version numbers are the same | 19:05 |
| samueldmq | bknudson, yes that's what I was thinking, but I didnt know any v3 could be validated against v2 | 19:06 |
| dstanek | someone was in there the other day asking for to for a token version upgrade because they have v2 tokens and wanted to use the v3 api | 19:06 |
| *** lsmola_ has quit IRC | 19:06 | |
| samueldmq | dstanek, I have been here for some months, and hadnt realized | 19:06 |
| bknudson | I doubt that there is anything we could do with versions where people would understand it | 19:06 |
| * samueldmq facepalm | 19:06 | |
| bknudson | other than if we did actual microversioning | 19:07 |
| bknudson | I don't know how many times I've been asked if we support v3. | 19:07 |
| bknudson | "keystone v3" | 19:07 |
| dstanek | bknudson: totally agree | 19:07 |
| samueldmq | bknudson, what to do so? microversioning ? | 19:07 |
| samueldmq | 3.x.y .. ? | 19:07 |
| bknudson | and every time it's asked they actually mean something different. | 19:07 |
| *** lhcheng_ is now known as lhcheng | 19:08 | |
| *** ChanServ sets mode: +v lhcheng | 19:08 | |
| samueldmq | how* | 19:08 |
| bknudson | samueldmq: nova is doing microversioning... I think there's a spec. | 19:08 |
| samueldmq | bknudson, https://wiki.openstack.org/wiki/Nova/ProposalForAPIMicroVersions | 19:08 |
| samueldmq | bknudson, will take a look, thanks | 19:09 |
| *** _cjones_ has quit IRC | 19:09 | |
| *** lsmola__ has quit IRC | 19:10 | |
| morganfainberg | bknudson, lol | 19:10 |
| samueldmq | morganfainberg, so I understand more and more why we should have just /auth instead of /v2/auth and /v3/auth | 19:10 |
| morganfainberg | samueldmq, yeah | 19:10 |
| morganfainberg | samueldmq, CRUD != Auth | 19:10 |
| bknudson | CREATE token, DELETE token. | 19:10 |
| samueldmq | morganfainberg, ++ and this just make people confused | 19:11 |
| bknudson | we don't have update token (yet!) | 19:11 |
| samueldmq | bknudson, true :p | 19:11 |
| samueldmq | bknudson, rescoping ? | 19:11 |
| morganfainberg | bknudson, sortof. we aren't realllllly doing tradition REST in these cases | 19:11 |
| bknudson | REST would be to use www-authenticate | 19:11 |
| morganfainberg | ok let me clarify: Keysotone's management interfaces (identity, assignment) CRUD have little to do with the act of auth. | 19:12 |
| samueldmq | morganfainberg, please do :) | 19:12 |
| morganfainberg | bknudson, hey webSSO. | 19:12 |
| morganfainberg | bknudson, >.> | 19:12 |
| samueldmq | morganfainberg, so auth could be taken to a different place than identity,assignment crud ? :P | 19:14 |
| morganfainberg | samueldmq, this is really about avoiding mixing interacting with a specific version of keystone and the contract on auth | 19:15 |
| *** jdennis has joined #openstack-keystone | 19:15 | |
| samueldmq | morganfainberg, ++ | 19:15 |
| *** stevemar has quit IRC | 19:15 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Script to sync oslo https://review.openstack.org/114305 | 19:16 |
| bknudson | if we want a different contract for auth, then what about identity, assignment, etc. | 19:17 |
| bknudson | might as well just go to microversioning | 19:18 |
| *** david-lyle has quit IRC | 19:18 | |
| morganfainberg | bknudson, why is auth API version dependabnt? | 19:18 |
| morganfainberg | because historically it was? | 19:18 |
| bknudson | all of the apis are version dependent | 19:18 |
| bknudson | this seems to just be the way that we did versioning, put it on the URL | 19:19 |
| bknudson | although the docs said you could do versioning in a header for a long time. | 19:19 |
| morganfainberg | i think part of the massive headache we have had with getting adoption of v3 has been because auth *was* version dependant | 19:19 |
| samueldmq | I think if we could make it optionally dependent (and in the header instead of in the url) we were good | 19:20 |
| morganfainberg | so the idea that to support use of keystone v3 meant you had to do all of keystone v3. well who cares. a v2 token could represent everything important for v3 if we had wanted to. the only cases it couldn't would be project "name", and domains. | 19:21 |
| morganfainberg | it also means that if we change/deprecate an API we aren't impacting auth. | 19:22 |
| morganfainberg | if we wanted a v4 management api, we could do it. | 19:22 |
| *** lsmola__ has joined #openstack-keystone | 19:23 | |
| morganfainberg | and not worry about breaking how people auth with keystone | 19:23 |
| samueldmq | morganfainberg, and should be a good idea, to make people understand crud apis != auth version | 19:23 |
| samueldmq | :p | 19:23 |
| bknudson | we can support v2 auth for a long time. | 19:23 |
| bknudson | if the token format/features change then things will break again. | 19:23 |
| bknudson | if you pass a v3 token with non-default domain to v2 auth then it's rejected | 19:24 |
| morganfainberg | bknudson, honestly if we didn't have PKI tokens, i'd move v2 auth to a middleware translator | 19:24 |
| samueldmq | if we get services working with v3, let's make it default for devstack gates and deprecate v2 | 19:24 |
| morganfainberg | samueldmq, that is the plan in liberty | 19:24 |
| bknudson | all of the controllers should just be translators | 19:24 |
| morganfainberg | bknudson, it's a lot closer to that today. | 19:25 |
| samueldmq | morganfainberg, nice, and I am trying to start this by testing the devstack + identity v3 thing-y :p | 19:25 |
| morganfainberg | bknudson, than it was even in juno | 19:25 |
| *** rushil has joined #openstack-keystone | 19:26 | |
| samueldmq | henrynash, hi, could you revisit 'Adds inherited column to RoleAssignment PK' ? | 19:27 |
| samueldmq | henrynash, https://review.openstack.org/#/c/142472/ | 19:27 |
| samueldmq | morganfainberg, is there a chance to still get this in rc2 ? ^ | 19:27 |
| morganfainberg | samueldmq, no | 19:27 |
| samueldmq | it's been ready for review, just waiting people to do so | 19:28 |
| samueldmq | it's been there for some days :/ | 19:28 |
| morganfainberg | samueldmq, it can be evaluated for a backport, but i don't think it's going to happen for RC2 | 19:28 |
| samueldmq | morganfainberg, k then, so if we decide we backport | 19:28 |
| samueldmq | morganfainberg, ack | 19:28 |
| morganfainberg | samueldmq, rc2 was pretty much complete as of monday | 19:28 |
| morganfainberg | we have one outstanding issue that is a bit more sestemic | 19:28 |
| morganfainberg | and needs love [oslo-incubator related] | 19:28 |
| morganfainberg | which is currently through check. | 19:29 |
| samueldmq | morganfainberg, the think dstanek is working on ? | 19:29 |
| dstanek | samueldmq: i'm not working on any rc2 stuff | 19:29 |
| dstanek | i think morganfainberg means the service bug they found in incubator | 19:30 |
| morganfainberg | samueldmq, bknudson has been working on it | 19:30 |
| morganfainberg | dstanek, yes | 19:30 |
| samueldmq | dstanek, ah sorry, I saw 'Script to sync oslo' https://review.openstack.org/#/c/114305/ | 19:30 |
| samueldmq | dstanek, and thought it was related | 19:30 |
| samueldmq | morganfainberg, you have link ? | 19:31 |
| dstanek | samueldmq: nope, i'm going through all of my outstanding patches and make sure they all still work | 19:31 |
| samueldmq | dstanek, ++ :-) | 19:31 |
| morganfainberg | https://review.openstack.org/#/q/I7b43a67a0b67fe0ff5ac3d87708ecc4ab52102f8,n,z | 19:31 |
| morganfainberg | https://review.openstack.org/#/c/176151/ | 19:31 |
| samueldmq | dstanek, I need to do the same, have some patches to be updated/get back to life | 19:31 |
| samueldmq | morganfainberg, the fix on master and its backport to kilo, right ? | 19:32 |
| morganfainberg | yep | 19:32 |
| morganfainberg | and both depend on oslo-incubator change | 19:32 |
| samueldmq | morganfainberg, k, so let's check if I understand things correctly :p | 19:33 |
| samueldmq | morganfainberg, this is non-keystone code inside keystone, and have to be manually updated | 19:34 |
| *** ayoung has joined #openstack-keystone | 19:34 | |
| *** ChanServ sets mode: +v ayoung | 19:34 | |
| morganfainberg | oslo-incubator | 19:34 |
| morganfainberg | anyway i need to go get food. | 19:34 |
| samueldmq | morganfainberg, go | 19:35 |
| morganfainberg | i'm now 4hrs late from when i needed to get breakfast :P | 19:35 |
| samueldmq | morganfainberg, np, bon apetit | 19:35 |
| samueldmq | bknudson, dstanek only oslo-incubator code need to be synchronized manually, right ? | 19:36 |
| *** jimbaker has quit IRC | 19:36 | |
| dstanek | that's the only thing we copy-paste everywhere | 19:36 |
| samueldmq | and all the code for keystone is under openstack/common | 19:36 |
| *** jimbaker has joined #openstack-keystone | 19:36 | |
| *** jimbaker has quit IRC | 19:37 | |
| *** jimbaker has joined #openstack-keystone | 19:37 | |
| samueldmq | dstanek, hmm, and then when the code get incubated, we add it as a dependency to the projects that need it | 19:37 |
| dstanek | samueldmq: yes, but they call it graduation. when the things grows up into it's own lib | 19:38 |
| *** lhcheng_ has joined #openstack-keystone | 19:38 | |
| dstanek | samueldmq: that commit you mentioned above is that i used to update our incubated code; it's modeled after bknudson's documented process | 19:38 |
| samueldmq | dstanek, great and now you just need to run the script and commit the code | 19:39 |
| samueldmq | dstanek, bknudson great job ! :) | 19:39 |
| bknudson | realize that the oslo-incubator code is almost all going away | 19:39 |
| bknudson | and being moved into real libraries | 19:40 |
| *** lhcheng_ has quit IRC | 19:40 | |
| *** lhcheng_ has joined #openstack-keystone | 19:40 | |
| bknudson | so where it used to be a lot of work it's been much less work lately | 19:40 |
| *** lhcheng has quit IRC | 19:40 | |
| *** lhcheng_ is now known as lhcheng | 19:41 | |
| *** ChanServ sets mode: +v lhcheng | 19:41 | |
| *** david-lyle has joined #openstack-keystone | 19:41 | |
| *** _cjones_ has joined #openstack-keystone | 19:42 | |
| morganfainberg | dstanek, could use a second +2 on https://review.openstack.org/#/c/176391/ | 19:44 |
| morganfainberg | dstanek, if you don't mind. | 19:44 |
| dstanek | morganfainberg: looking | 19:44 |
| samueldmq | bknudson, ack, thanks for the update | 19:44 |
| *** stevemar has joined #openstack-keystone | 19:44 | |
| *** ChanServ sets mode: +v stevemar | 19:44 | |
| morganfainberg | dstanek, the oslo-change should be gating so should be sane to +2/A that | 19:44 |
| dstanek | morganfainberg: done | 19:45 |
| *** ayoung has left #openstack-keystone | 19:46 | |
| *** ayoung has joined #openstack-keystone | 19:46 | |
| *** ChanServ sets mode: +v ayoung | 19:46 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Use Model for access_info https://review.openstack.org/160134 | 19:49 |
| *** openstackgerrit has quit IRC | 19:54 | |
| *** openstackgerrit has joined #openstack-keystone | 19:54 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed dependency.provider https://review.openstack.org/163029 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed optional dependency support https://review.openstack.org/162770 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Decouple notifications from DI https://review.openstack.org/162769 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Isolate injection tests https://review.openstack.org/162768 | 19:56 |
| dstanek | lbragstad: minor modification to change the commit message on https://review.openstack.org/#/c/162768/ | 19:57 |
| morganfainberg | testing | 19:57 |
| morganfainberg | testing... | 19:57 |
| morganfainberg | one.. | 19:58 |
| morganfainberg | two.. | 19:58 |
| dstanek | one. | 19:58 |
| dstanek | two.. | 19:58 |
| dstanek | three... | 19:58 |
| _cjones_ | Quick question on keystone/nova v3 migration using _novaclient from within a Neutron extension. Is anyone around to answer? | 20:00 |
| _cjones_ | I'll free-beer you if you can help solve my issue (and you're attending the summit in Vancouver). | 20:02 |
| *** tqtran is now known as tqtran_afk | 20:04 | |
| dstanek | _cjones_: go ahead and ask; i'm sure someone will be able to answer it, just maybe not in real time | 20:04 |
| samueldmq | _cjones_, lol just ask your question and someone can have your answer | 20:04 |
| samueldmq | dstanek, ++ | 20:04 |
| _cjones_ | Okay. :) | 20:04 |
| _cjones_ | So previously I'd instantiate like this: | 20:05 |
| _cjones_ | nova = nova_client.Client('admin', CONF.nova_admin_password, project_name....) | 20:05 |
| _cjones_ | Migrating to keystone v3 this no longer works with the admin user. | 20:06 |
| _cjones_ | Is there a nice way to extract the credentials of the current tenant admin to pass along? | 20:06 |
| _cjones_ | (I know why it doesn't work... because the policies have changed) I just don't know how to rectify. | 20:07 |
| _cjones_ | Current nova policy is: | 20:08 |
| _cjones_ | "context_is_admin": "role:admin", | 20:08 |
| _cjones_ | "admin_or_owner": "is_admin:True or project_id:%(project_id)s", | 20:08 |
| _cjones_ | "default": "rule:admin_or_owner", | 20:08 |
| _cjones_ | So I assume we're hitting the "is_admin:True". | 20:08 |
| bknudson | use of identity v3 or v2 shouldn't affect nova's policy enforcement. | 20:09 |
| dstanek | _cjones_: when you say "no longer works", what exactly is happening? exception, failure to auth, etc? | 20:10 |
| samueldmq | morganfainberg, https://github.com/openstack/glance/blob/master/glance/common/auth.py#L122-L125 | 20:10 |
| samueldmq | morganfainberg, glance: try v2 auth, otherwise v1 auth, oh ! | 20:10 |
| morganfainberg | yeah | 20:10 |
| *** e0ne has quit IRC | 20:12 | |
| _cjones_ | dstanek Thanks. Perhaps a bit premature for question time. | 20:18 |
| _cjones_ | bknudson understood. That's why I'm thinking this is more of a policy issue that must change when using v3. | 20:19 |
| dstanek | _cjones_: what is the new policy? | 20:19 |
| _cjones_ | dstanek: Sorry. I'm speaking with my keystone guy here. He says that this works with the keystone v2 policy, but using the v3 policy we get 'not authorized'. | 20:21 |
| dstanek | what is the v3 policy? the nova policy is not controlled by keystone | 20:21 |
| _cjones_ | We're using the one out of the box essentially... policy.v3cloudsample.json | 20:22 |
| _cjones_ | I think we're running into an issue of a obtaining a domain scoped token from keystone, but only need a project scoped token for nova. | 20:30 |
| samueldmq | _cjones_, what are you changing ? | 20:31 |
| samueldmq | _cjones_, just from the default policy.json to policy.v3cloudsample.json ? | 20:31 |
| _cjones_ | Changed nothing. | 20:31 |
| samueldmq | _cjones_, or trying to use v3 auth instead of v2 auth ? | 20:31 |
| _cjones_ | samueldmq, correct sir. | 20:31 |
| samueldmq | _cjones_, so you just changed the policy | 20:32 |
| _cjones_ | samueldmq, also use v3 auth. | 20:32 |
| samueldmq | _cjones_, k so v3 auth is still being adopted by other services | 20:33 |
| samueldmq | _cjones_, you should be able to use v2 auth and policy.v3cloudsample.json | 20:33 |
| samueldmq | bknudson, dstanek ^ am I right ? | 20:34 |
| _cjones_ | samueldmq, we are looking for domain support so we need v3. | 20:36 |
| samueldmq | _cjones_, nova still does nothing with domains, it does not even udnerstand domains | 20:36 |
| samueldmq | _cjones_, are you going to implement some support on nova side ? | 20:36 |
| _cjones_ | Does it need to? As long as it has authenticated? Is this just a nova policy issue? | 20:38 |
| samueldmq | _cjones_, we're talking about nova policy or keystone policy ? | 20:39 |
| samueldmq | _cjones_, you said you moved from keystone policy.json to keystoen policy.v3cloudsample.json, right ? | 20:39 |
| _cjones_ | samueldmq: Correct. This has been done. | 20:39 |
| _cjones_ | Also using v3 auth. | 20:40 |
| samueldmq | _cjones_, the error happens when you try to instantiate the client ? | 20:40 |
| samueldmq | _cjones_, or when you try a specific operation? | 20:40 |
| bknudson | the policy file has no effect on v2 | 20:41 |
| *** stevemar has quit IRC | 20:41 | |
| samueldmq | bknudson, ++ | 20:41 |
| bknudson | actually there are a couple of v2 operations that use the policy file | 20:41 |
| bknudson | ... and, when v2 checks for is_admin it's using the policy file. | 20:42 |
| samueldmq | bknudson, yeah, maybe that instantiating the nova client as he's doing with admin/CONF.nova_admin_password is using the keystone is_admin thing | 20:43 |
| samueldmq | bknudson, and when going to v3cloudsample, that stops working | 20:43 |
| samueldmq | not sure | 20:43 |
| bknudson | interesting... definitely possible. | 20:43 |
| bknudson | although I thought other deployers were using the cloud policy file without problems. | 20:43 |
| dstanek | so reading back...it looks like he is failing to get a project scoped token | 20:44 |
| samueldmq | dstanek, yeah | 20:44 |
| samueldmq | he's trying to do 2 things here: i) v3cloudsample policy ii) nova use v3 auth | 20:44 |
| *** ajayaa has quit IRC | 20:44 | |
| *** stevemar has joined #openstack-keystone | 20:45 | |
| *** ChanServ sets mode: +v stevemar | 20:45 | |
| _cjones_ | samueldmq: Correct. Okay guys. We're going to do a bit more experimenting. | 20:45 |
| samueldmq | _cjones_, could you try to use v2 auth on nova + keystone v3cloudsmaple | 20:45 |
| samueldmq | _cjones_, change one thing by time, and see what happens :) | 20:45 |
| _cjones_ | samueldmq: We can try. I'll let you know when we get a result. | 20:46 |
| samueldmq | _cjones_, great, I am going afk for a bit, but interested on what's happening | 20:46 |
| dstanek | _cjones_: are you able to auth and get the correct token? | 20:47 |
| _cjones_ | dstanek: Yes. That's correct. | 20:47 |
| dstanek | _cjones_: then what operation are you trying to perform when you get the unauthorized access error? | 20:48 |
| openstackgerrit | Baldemar Silva proposed openstack/pycadf: Add test to cover mask value for utils.mask_value https://review.openstack.org/176479 | 20:50 |
| _cjones_ | dstanek: Sorry. It looks like it may be our driver. Give us some more time, I'll be back. Thanks. | 20:52 |
| *** carlosmarin has left #openstack-keystone | 20:54 | |
| *** csoukup has quit IRC | 20:56 | |
| *** david-lyle_ has joined #openstack-keystone | 20:58 | |
| *** david-lyle has quit IRC | 20:59 | |
| *** raildo has quit IRC | 20:59 | |
| *** mattfarina has quit IRC | 21:01 | |
| dstanek | bknudson: if we stop modifying the config global in our tests can't we get rid of this reset? https://review.openstack.org/#/c/162765/2/keystone/tests/unit/core.py | 21:02 |
| bknudson | dstanek: yes! | 21:03 |
| bknudson | how do we stop people from modifying the config global in the tests? | 21:03 |
| morganfainberg | dstanek, didn' | 21:03 |
| morganfainberg | t we mostly move everything to the fixture? | 21:03 |
| dstanek | bknudson: ok, that's what i thought; good question - i can probably rid something for the tests | 21:03 |
| dstanek | morganfainberg: almost - that's what that patch is trying to do | 21:03 |
| morganfainberg | bknudson, wrap the config global in magic sauce that says DONT DO THAT. | 21:04 |
| bknudson | nice. | 21:04 |
| bknudson | magic sauce | 21:04 |
| dstanek | morganfainberg: exactly - but in a way that doesn't break the config_fixture - no sure what that actually does yet | 21:04 |
| dstanek | i'll fix up this patch and report back | 21:04 |
| morganfainberg | dstanek, the config fixture works in a specific manner | 21:04 |
| morganfainberg | it sets an override value and clears overrides | 21:05 |
| bknudson | if there's no magic sauce then that's fine... hopefully reviewers will catch it. | 21:05 |
| morganfainberg | prevent setting non-override values | 21:05 |
| bknudson | y, that should be good enough. | 21:05 |
| *** tqtran has joined #openstack-keystone | 21:05 | |
| morganfainberg | the conf object does: option( override set? return overide, else return real value) | 21:05 |
| bknudson | if you set an override then the config fixture should take care of it anyways. | 21:05 |
| morganfainberg | exactly | 21:05 |
| dstanek | bknudson: you mean with CONF.set_override? | 21:06 |
| morganfainberg | dstanek, yeah the fixture does that and auto-cleans up after in the tearDown | 21:06 |
| morganfainberg | so preventing direct setting of values but not breaking set_override should be sufficient | 21:07 |
| dstanek | ok, on it :-) | 21:08 |
| morganfainberg | dstanek, wow we were really close weren't we | 21:08 |
| * morganfainberg was looking at that patch | 21:09 | |
| dstanek | haha, if actually handles the case where we would call CONF.set_override ourselves. | 21:09 |
| *** tqtran has quit IRC | 21:09 | |
| dstanek | should i convert those to use the config fixture too | 21:09 |
| dstanek | morganfainberg: yes, almost there | 21:09 |
| morganfainberg | yeah i was sure that was almost all cleaned up juno-ish | 21:10 |
| *** stevemar has quit IRC | 21:13 | |
| *** david-lyle_ has quit IRC | 21:15 | |
| *** david-lyle has joined #openstack-keystone | 21:15 | |
| *** alexsyip has quit IRC | 21:16 | |
| *** rdo has quit IRC | 21:19 | |
| *** gyee has quit IRC | 21:20 | |
| *** david-lyle has quit IRC | 21:21 | |
| *** rdo has joined #openstack-keystone | 21:21 | |
| dolphm | so for stable/juno, since the ldap identity driver wasn't multi-domain aware, there's basically no way to use heat? (which depends on domains & trusts) | 21:24 |
| morganfainberg | dolphm, LDAP identity driver is still not multi domain aware. | 21:24 |
| dolphm | henrynash: morganfainberg: ^ ? | 21:24 |
| EmilienM | ayoung: your reply on puppet-keystone is much appreciated, thanks. I'll poke you when needed :-) | 21:24 |
| morganfainberg | dolphm, juno has henrynash's mapping thing right? | 21:24 |
| dolphm | morganfainberg: right, but at least in kilo, heat can create additional domains and stick users in them (sql-backed) | 21:25 |
| morganfainberg | dolphm, you'd need to make the LDAP domain a per-domain identity configuration | 21:25 |
| ayoung | dolphm, heat can't do temporary users in their own domain if LDAP is not writable | 21:25 |
| morganfainberg | dolphm, if you make the default driver ldap you can't make extra domains | 21:25 |
| dolphm | morganfainberg: in juno, does heat require just one domain, or the ability to create new domains? | 21:25 |
| ayoung | you have it right dolphm | 21:25 |
| morganfainberg | dolphm, not sure. | 21:25 |
| morganfainberg | dolphm, i think they always try do to more than 1 domain | 21:25 |
| ayoung | they were copying creds around back then I think | 21:25 |
| ayoung | morganfainberg, I'd have to look at the time frame when they switched to that | 21:26 |
| ayoung | dolphm, Juno I think you could do this: | 21:26 |
| *** gyee has joined #openstack-keystone | 21:26 | |
| *** ChanServ sets mode: +v gyee | 21:26 | |
| morganfainberg | dstanek, holy crap. | 21:28 |
| morganfainberg | dstanek, looks like we have 3 libs in all our requirements for keystone not py3 compat. | 21:28 |
| morganfainberg | dstanek, ldap, ldappool, and pysqlite | 21:29 |
| morganfainberg | we... might be able to hit py3 compat this cycle . | 21:29 |
| dolphm | morganfainberg: so for a mysql-only deployment, all ours deps work on py3? | 21:29 |
| *** openstackgerrit has quit IRC | 21:29 | |
| morganfainberg | dstanek, yep. | 21:29 |
| morganfainberg | dolphm, ^ yep | 21:29 |
| dolphm | :) | 21:29 |
| *** openstackgerrit has joined #openstack-keystone | 21:30 | |
| morganfainberg | dolphm, i haven't tested this. nor have I tested this with mod_wsgi | 21:30 |
| morganfainberg | dolphm, but purely python install wise. it works | 21:30 |
| morganfainberg | dolphm, i think we can aim for py34 this cycle too. | 21:30 |
| morganfainberg | woo | 21:30 |
| dolphm | then it'll work in httpd | 21:30 |
| dstanek | morganfainberg: yes, we are really close | 21:31 |
| morganfainberg | dstanek, how broken / awesome is: https://pypi.python.org/pypi/ldap3 ? | 21:34 |
| morganfainberg | dstanek, because i think that is our major blocker | 21:34 |
| morganfainberg | ldappool we could re-implement py3 friendly if needed. | 21:35 |
| dstanek | morganfainberg: my understanding is that it has a different API than python-ldap | 21:36 |
| morganfainberg | so not drop-in | 21:36 |
| dstanek | and python-ldap's impl needs love from what i understand | 21:36 |
| morganfainberg | but the question is, if we moved to ldap3 (whole-sale) | 21:36 |
| morganfainberg | would we win? | 21:36 |
| morganfainberg | btw: python-memcached looks to be py3 compat. | 21:37 |
| dstanek | not sure, i don't know much about the state of ldap in python | 21:37 |
| *** david-lyle has joined #openstack-keystone | 21:37 | |
| dstanek | no there is still some issues there | 21:37 |
| morganfainberg | dstanek, i might take a crack at converting us to ldap3 | 21:38 |
| morganfainberg | if it looks good go through the g-r dance | 21:38 |
| dstanek | i say go for it | 21:39 |
| morganfainberg | though it might be a good deal slower since python-ldap has c-bindings | 21:39 |
| morganfainberg | and we likely will need to implement our own ldappool | 21:40 |
| morganfainberg | but thats not the end of the world. | 21:40 |
| dstanek | do we need a pool if we get rid of eventlet | 21:40 |
| dstanek | ? | 21:40 |
| morganfainberg | it helps not tearing down and restarting the connection | 21:40 |
| morganfainberg | however we accomplish that | 21:40 |
| dstanek | you just need a single connection is sit around | 21:41 |
| morganfainberg | oh ldap3 already has pooling | 21:44 |
| morganfainberg | nead | 21:44 |
| morganfainberg | neat* | 21:44 |
| *** sdake has quit IRC | 21:44 | |
| *** bknudson has quit IRC | 21:46 | |
| *** edmondsw has quit IRC | 21:47 | |
| *** dramakri has joined #openstack-keystone | 21:48 | |
| dstanek | "that was easy" | 21:55 |
| *** tqtran_afk is now known as tqtran | 22:01 | |
| *** bknudson has joined #openstack-keystone | 22:05 | |
| *** ChanServ sets mode: +v bknudson | 22:05 | |
| *** openstackgerrit has quit IRC | 22:11 | |
| *** openstackgerrit has joined #openstack-keystone | 22:11 | |
| *** david-lyle_ has joined #openstack-keystone | 22:20 | |
| *** david-lyle has quit IRC | 22:20 | |
| *** _cjones_ has quit IRC | 22:25 | |
| *** _cjones_ has joined #openstack-keystone | 22:25 | |
| *** hogepodge has quit IRC | 22:27 | |
| *** sdake has joined #openstack-keystone | 22:32 | |
| *** hogepodge has joined #openstack-keystone | 22:32 | |
| samleon | ayoung, just looked at your basic auth path, it is a good idea to support the standard http authentication in ks, but what i am not sure if you wanted my x509 patch to support the basic auth as well? | 22:33 |
| *** gordc has quit IRC | 22:47 | |
| *** joesavak has quit IRC | 22:55 | |
| *** david-lyle_ has quit IRC | 22:57 | |
| *** stevemar has joined #openstack-keystone | 23:01 | |
| *** ChanServ sets mode: +v stevemar | 23:01 | |
| morganfainberg | ayoung, will be looking at accessinfo tonight | 23:06 |
| morganfainberg | ayoung, finally done with meetings. | 23:06 |
| *** thedodd has quit IRC | 23:13 | |
| *** bandwidth has quit IRC | 23:14 | |
| morganfainberg | dstanek, ok so ldap3 is pretty freaking cool | 23:22 |
| morganfainberg | dstanek, has an abstraction layer | 23:22 |
| dstanek | abstraction over what? | 23:23 |
| dstanek | turns out making the CONF read-only isn | 23:23 |
| morganfainberg | https://ldap3.readthedocs.org/en/latest/abstraction.html | 23:23 |
| dstanek | 't as easy as i hoped | 23:23 |
| dstanek | during the runtime of the test CONF.clear() is called and that actually does some setattr stuff | 23:23 |
| *** david-lyle has joined #openstack-keystone | 23:24 | |
| dstanek | oh, neat. kinda like an orm | 23:24 |
| morganfainberg | yeah | 23:25 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes tests to use the config fixture https://review.openstack.org/162765 | 23:25 |
| dstanek | morganfainberg: what do you think of https://review.openstack.org/#/c/126030/ for the short term? | 23:26 |
| morganfainberg | sec | 23:26 |
| *** markvoelker has quit IRC | 23:26 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:27 | |
| *** rushil has quit IRC | 23:30 | |
| *** sdake has quit IRC | 23:39 | |
| morganfainberg | dstanek, ok off the phone | 23:52 |
| morganfainberg | looking | 23:52 |
| morganfainberg | dstanek, honestly | 23:52 |
| morganfainberg | dstanek, i'd rather spend time on functional testing.... butttttttt... | 23:52 |
| morganfainberg | as a quick intirim fi | 23:52 |
| morganfainberg | fix | 23:52 |
| morganfainberg | that looks reasonable | 23:52 |
| dstanek | there's actually nothing more to do on that patch. just a small amount of docs. after that goes in there would some added checking on the FKs for us | 23:55 |
| morganfainberg | dstanek, like i said | 23:55 |
| morganfainberg | for a quick intirim fix | 23:55 |
| morganfainberg | wfm | 23:55 |
| morganfainberg | i just want to kill sqlite in keystone | 23:55 |
| morganfainberg | "they'll be none of that" | 23:56 |
| stevemar | do it do it | 23:56 |
| morganfainberg | s/they'll/there'll/ | 23:56 |
| morganfainberg | stevemar, need functional testing up and running | 23:56 |
| morganfainberg | stevemar, so we can validate everything works as expected | 23:56 |
| stevemar | morganfainberg, i have nothing to deliver this release it seems | 23:56 |
| stevemar | topes hasn't told me anything insane | 23:56 |
| morganfainberg | stevemar: /me hands stands you on quicksand, hands you the bus labled "Stable ABIs" | 23:57 |
| * morganfainberg runs | 23:57 | |
| stevemar | i was thinking functional tests with stanek, or the sqlite stuff | 23:57 |
| stevemar | or moving extensions to core | 23:58 |
| stevemar | or more notifications | 23:58 |
| stevemar | but i'm not committed to anything | 23:58 |
| stevemar | wee | 23:58 |
| stevemar | i'll make keystone-identity-provider and split the code base | 23:58 |
| dstanek | morganfainberg: what will we use on our unit tests? just mocks? | 23:58 |
| morganfainberg | dstanek, restful test cases are functional right? | 23:59 |
| morganfainberg | dstanek, what outside of the restful cases are using a DB? | 23:59 |
| dstanek | yes, but the backend tests are not | 23:59 |
| morganfainberg | dstanek, drizzle? :P | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
