| *** zzzeek has quit IRC | 00:11 | |
| *** _cjones_ has quit IRC | 00:27 | |
| *** gyee has quit IRC | 00:29 | |
| *** tqtran_ has quit IRC | 00:34 | |
| *** _cjones_ has joined #openstack-keystone | 00:37 | |
| *** _cjones_ has quit IRC | 00:39 | |
| *** bknudson has joined #openstack-keystone | 01:21 | |
| *** ChanServ sets mode: +v bknudson | 01:21 | |
| *** alexsyip has quit IRC | 01:22 | |
| *** erkules_ has joined #openstack-keystone | 01:36 | |
| *** erkules has quit IRC | 01:38 | |
| *** _cjones_ has joined #openstack-keystone | 01:39 | |
| *** harlowja is now known as harlowja_away | 02:02 | |
| *** xianghuihui has joined #openstack-keystone | 02:02 | |
| *** xianghuihui has quit IRC | 02:09 | |
| *** tqtran has joined #openstack-keystone | 02:19 | |
| *** TommyTheKid has quit IRC | 02:20 | |
| *** tqtran has quit IRC | 02:24 | |
| *** _cjones_ has quit IRC | 02:24 | |
| *** ayoung has quit IRC | 02:56 | |
| *** lhcheng has quit IRC | 03:04 | |
| *** richm has quit IRC | 03:07 | |
| *** spandhe has quit IRC | 03:13 | |
| *** samueldmq has quit IRC | 03:20 | |
| *** lhcheng has joined #openstack-keystone | 03:39 | |
| *** ChanServ sets mode: +v lhcheng | 03:39 | |
| *** rushiagr_away is now known as rushiagr | 03:40 | |
| openstackgerrit | Merged openstack/keystone-specs: New attributes for SAML assertion https://review.openstack.org/174462 | 03:40 |
|---|---|---|
| *** xianghuihui has joined #openstack-keystone | 03:40 | |
| *** xianghuihui has quit IRC | 03:40 | |
| *** xianghuihui has joined #openstack-keystone | 03:41 | |
| *** xianghuihui has quit IRC | 03:41 | |
| *** lhcheng_ has joined #openstack-keystone | 03:42 | |
| *** lhcheng has quit IRC | 03:42 | |
| *** spandhe has joined #openstack-keystone | 03:51 | |
| *** spandhe_ has joined #openstack-keystone | 03:54 | |
| *** spandhe has quit IRC | 03:56 | |
| *** spandhe_ is now known as spandhe | 03:56 | |
| *** rushiagr is now known as rushiagr_away | 04:00 | |
| *** rushiagr_away is now known as rushiagr | 04:02 | |
| *** _cjones_ has joined #openstack-keystone | 04:08 | |
| *** _cjones_ has quit IRC | 04:13 | |
| *** lhcheng_ has quit IRC | 04:49 | |
| *** lhcheng has joined #openstack-keystone | 04:49 | |
| *** ChanServ sets mode: +v lhcheng | 04:49 | |
| *** markvoelker_ has quit IRC | 04:51 | |
| *** tqtran has joined #openstack-keystone | 04:53 | |
| morganfainberg | jamielennox|away: wanted to discuss ayoung's access info when you have time. I'd like to move on that initiative but get it in the right place(es). | 05:00 |
| *** browne has joined #openstack-keystone | 05:03 | |
| *** rushiagr is now known as rushiagr_away | 05:06 | |
| *** kiran-r has joined #openstack-keystone | 05:15 | |
| *** lhcheng has quit IRC | 05:29 | |
| *** afazekas has quit IRC | 05:31 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update openid connect docs to include other distros https://review.openstack.org/173043 | 05:35 |
| *** e0ne has joined #openstack-keystone | 05:43 | |
| *** e0ne is now known as e0ne_ | 05:43 | |
| *** e0ne_ is now known as e0ne | 05:43 | |
| *** e0ne has quit IRC | 05:45 | |
| *** afazekas has joined #openstack-keystone | 05:49 | |
| *** ajayaa has joined #openstack-keystone | 05:50 | |
| *** _cjones_ has joined #openstack-keystone | 05:57 | |
| *** rushiagr_away is now known as rushiagr | 06:01 | |
| *** david-ly_ has joined #openstack-keystone | 06:01 | |
| *** _cjones_ has quit IRC | 06:02 | |
| *** david-lyle has quit IRC | 06:03 | |
| *** josecastroleon has joined #openstack-keystone | 06:03 | |
| *** tqtran has quit IRC | 06:14 | |
| *** stevemar has quit IRC | 06:32 | |
| *** chlong has quit IRC | 06:39 | |
| *** krykowski has joined #openstack-keystone | 07:11 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Move federated auth plugins to separate repo. https://review.openstack.org/176727 | 07:18 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Standardize federated auth token scoping https://review.openstack.org/176759 | 07:18 |
| *** tqtran has joined #openstack-keystone | 07:23 | |
| *** tqtran has quit IRC | 07:27 | |
| *** browne has quit IRC | 07:42 | |
| *** jistr has joined #openstack-keystone | 07:44 | |
| *** e0ne has joined #openstack-keystone | 07:47 | |
| *** e0ne has quit IRC | 07:49 | |
| *** lhcheng has joined #openstack-keystone | 07:51 | |
| *** ChanServ sets mode: +v lhcheng | 07:51 | |
| *** e0ne has joined #openstack-keystone | 07:53 | |
| *** e0ne has quit IRC | 08:05 | |
| *** e0ne has joined #openstack-keystone | 08:09 | |
| *** jistr is now known as jistr|mtg | 08:09 | |
| *** e0ne has quit IRC | 08:11 | |
| *** lhcheng has quit IRC | 08:13 | |
| *** fhubik has joined #openstack-keystone | 08:14 | |
| *** pnavarro has joined #openstack-keystone | 08:14 | |
| *** lhcheng has joined #openstack-keystone | 08:20 | |
| *** ChanServ sets mode: +v lhcheng | 08:20 | |
| *** aix has joined #openstack-keystone | 08:40 | |
| *** lhcheng has quit IRC | 08:58 | |
| *** fhubik is now known as fhubik_afk | 09:07 | |
| *** e0ne has joined #openstack-keystone | 09:10 | |
| *** ncoghlan has quit IRC | 09:12 | |
| *** e0ne is now known as e0ne_ | 09:16 | |
| *** e0ne_ has quit IRC | 09:21 | |
| *** bdossant has joined #openstack-keystone | 09:25 | |
| *** jistr|mtg is now known as jistr | 09:32 | |
| *** _cjones_ has joined #openstack-keystone | 09:34 | |
| *** e0ne has joined #openstack-keystone | 09:35 | |
| *** henrynash has quit IRC | 09:35 | |
| *** fhubik_afk is now known as fhubik | 09:38 | |
| *** _cjones_ has quit IRC | 09:39 | |
| *** henrynash has joined #openstack-keystone | 09:44 | |
| *** ChanServ sets mode: +v henrynash | 09:44 | |
| *** jaosorior has joined #openstack-keystone | 09:46 | |
| *** henrynash has quit IRC | 09:50 | |
| *** henrynash has joined #openstack-keystone | 09:53 | |
| *** ChanServ sets mode: +v henrynash | 09:53 | |
| *** henrynash has quit IRC | 09:53 | |
| *** markvoelker has joined #openstack-keystone | 10:06 | |
| *** jdennis has quit IRC | 10:07 | |
| *** fhubik has quit IRC | 10:11 | |
| *** markvoelker has quit IRC | 10:11 | |
| *** fhubik has joined #openstack-keystone | 10:11 | |
| *** fhubik has quit IRC | 10:16 | |
| *** fhubik_afk has joined #openstack-keystone | 10:16 | |
| *** fhubik_afk is now known as fhubik | 10:16 | |
| *** Bsony has joined #openstack-keystone | 10:20 | |
| *** samueldmq has joined #openstack-keystone | 10:24 | |
| samueldmq | morning | 10:25 |
| *** spandhe has quit IRC | 10:26 | |
| marekd | morganfainberg: re: Indeed we haven't release ksc-saml2 repo yet, but ksc has already support for federated plugins so I feel we should support some backwards compatibility. Until now we didn't expect users to provider 'protocol' value, now I feel we should. For some time (two releases of ksc?) we should probably warn, that soon this parameter will be required , and later complain painfully when they don't provide it. | 10:26 |
| marekd | morganfainberg: https://review.openstack.org/#/c/176727/3/keystoneclient/contrib/auth/v3/federation.py | 10:26 |
| openstackgerrit | Merged openstack/keystone-specs: Tokenless authz with X.509 SSL client cert https://review.openstack.org/177019 | 10:27 |
| *** fhubik_afk has joined #openstack-keystone | 10:37 | |
| *** fhubik has quit IRC | 10:41 | |
| *** dguerri is now known as _dguerri | 10:59 | |
| *** _dguerri is now known as dguerri | 11:00 | |
| *** markvoelker has joined #openstack-keystone | 11:07 | |
| *** markvoelker has quit IRC | 11:12 | |
| *** e0ne is now known as e0ne_ | 11:13 | |
| samueldmq | hi, do we have a liaison for API consistency around services ? iirc dolphm was it, am I right ? | 11:19 |
| *** dguerri is now known as _dguerri | 11:20 | |
| *** e0ne_ has quit IRC | 11:23 | |
| *** _cjones_ has joined #openstack-keystone | 11:23 | |
| *** _cjones_ has quit IRC | 11:27 | |
| marekd | All,is there any reason why versionutils.deprecated were not implemented in keystoneclient? | 11:29 |
| *** _dguerri is now known as dguerri | 11:37 | |
| *** amakarov_away is now known as amakarov | 11:38 | |
| *** e0ne has joined #openstack-keystone | 11:43 | |
| breton | marekd: there is a spec about that from bknudson afair | 11:48 |
| openstackgerrit | Merged openstack/keystone: Update openid connect docs to include other distros https://review.openstack.org/173043 | 11:49 |
| *** fhubik_afk has quit IRC | 11:50 | |
| marekd | breton: https://blueprints.launchpad.net/python-keystoneclient?searchtext=deprecate that's all I could find. | 11:50 |
| marekd | and the closest is that one https://blueprints.launchpad.net/python-keystoneclient/+spec/deprecations | 11:50 |
| marekd | https://review.openstack.org/#/c/147026/ | 11:51 |
| *** markvoelker has joined #openstack-keystone | 11:54 | |
| *** diegows has joined #openstack-keystone | 11:57 | |
| *** EmilienM has quit IRC | 12:01 | |
| *** EmilienM has joined #openstack-keystone | 12:01 | |
| *** erkules_ is now known as erkules | 12:11 | |
| *** erkules has joined #openstack-keystone | 12:11 | |
| breton | marekd: https://review.openstack.org/#/c/153881/ | 12:21 |
| marekd | breton: i wonder how does this spec correspond to https://blueprints.launchpad.net/python-keystoneclient/+spec/deprecations | 12:24 |
| *** ashishjain has joined #openstack-keystone | 12:33 | |
| *** raildo has joined #openstack-keystone | 12:39 | |
| marekd | bknudson: Hi. Do you predict any progress regarding https://review.openstack.org/#/c/153881/ ? | 12:39 |
| bknudson | marekd: y, I need to look into debtcollector. | 12:42 |
| *** bknudson has quit IRC | 12:42 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone-specs: Do not add new 'db' command and subcommands for it https://review.openstack.org/177219 | 12:44 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone-specs: Target Alembic for Liberty https://review.openstack.org/177220 | 12:44 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: alembic initial support https://review.openstack.org/150057 | 12:46 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use migration_cli for db migrations https://review.openstack.org/147548 | 12:46 |
| *** diegows has quit IRC | 12:46 | |
| *** ajayaa has quit IRC | 12:51 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 12:51 |
| *** e0ne is now known as e0ne_ | 12:53 | |
| *** e0ne_ is now known as e0ne | 12:55 | |
| *** afazekas has quit IRC | 12:55 | |
| *** henrynash has joined #openstack-keystone | 12:56 | |
| *** ChanServ sets mode: +v henrynash | 12:56 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/177232 | 12:58 |
| raildo | henrynash, ping, can you see the ericksonsantos's comment in the patch set 13, here: https://review.openstack.org/#/c/158720/ ? | 13:01 |
| henrynash | will do…will check a bit later… | 13:02 |
| *** henrynash has quit IRC | 13:02 | |
| *** gordc has joined #openstack-keystone | 13:04 | |
| *** ajayaa has joined #openstack-keystone | 13:07 | |
| *** jbonjean has left #openstack-keystone | 13:10 | |
| *** richm has joined #openstack-keystone | 13:11 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 13:12 |
| *** jdennis has joined #openstack-keystone | 13:13 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 13:13 |
| *** afazekas has joined #openstack-keystone | 13:13 | |
| *** davechen has joined #openstack-keystone | 13:15 | |
| *** kiran-r has quit IRC | 13:18 | |
| *** rushil has joined #openstack-keystone | 13:19 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 13:20 |
| *** rushil has quit IRC | 13:20 | |
| *** rushil has joined #openstack-keystone | 13:21 | |
| openstackgerrit | Cyril Roelandt proposed openstack/python-keystoneclient: Print an error message when no tenant is specified https://review.openstack.org/148305 | 13:23 |
| *** mattfarina has joined #openstack-keystone | 13:27 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Correctly handle direct mapping with keywords https://review.openstack.org/175980 | 13:31 |
| *** diegows has joined #openstack-keystone | 13:32 | |
| *** ayoung_ has joined #openstack-keystone | 13:34 | |
| *** ajayaa has quit IRC | 13:42 | |
| *** ajayaa has joined #openstack-keystone | 13:43 | |
| *** bknudson has joined #openstack-keystone | 13:44 | |
| *** ChanServ sets mode: +v bknudson | 13:44 | |
| *** rushiagr is now known as rushiagr_away | 13:44 | |
| *** ayoung_ is now known as ayoung | 13:46 | |
| dolphm | samueldmq: i think there are several of us that would fit that description, but what's up? | 13:48 |
| *** ashishjain has quit IRC | 13:49 | |
| samueldmq | dolphm, hi, some services (I know nova and cinder) throw 400 when use try to use an unscoped or domain scoped token | 13:54 |
| samueldmq | dolphm, I think that should be 401, shouldn't ? | 13:54 |
| *** diegows has quit IRC | 13:54 | |
| samueldmq | dolphm, I was wondering if it would be useful to have this consistent on all services, then improving UX | 13:54 |
| htruta | dstanek, bknudson: feeling like doing some review? https://review.openstack.org/#/c/167613/ | 13:56 |
| dolphm | samueldmq: oh that's an interesting question | 13:56 |
| *** stevemar has joined #openstack-keystone | 13:57 | |
| *** ChanServ sets mode: +v stevemar | 13:57 | |
| dolphm | samueldmq: yeah, that should be a 401. you have at least identified yourself, but you don't carry the correct authorization for the requested action, so 401. | 13:57 |
| samueldmq | dolphm, great, I will submit bugs for those I am seeing this | 13:58 |
| dolphm | samueldmq: if there's an interesting argument to be had, it would be between 401 and 403, not 400 | 13:58 |
| samueldmq | dolphm, thanks | 13:58 |
| samueldmq | dolphm, ++ I agree | 13:58 |
| dstanek | htruta: sure - i just need a few minutes to finish up what i'm working on | 13:58 |
| samueldmq | dolphm, Malformed request URL: URL's project_id 'abbe4eac077b42efa5f7872925f10d93' doesn't match Context's project_id 'None' | 13:58 |
| samueldmq | dolphm, bad ux | 13:59 |
| htruta | dstanek: cool. | 13:59 |
| *** dguerri is now known as _dguerri | 14:01 | |
| dolphm | samueldmq: agree, but how on earth are you getting that error message? why do you have a tenant-specific URL with an unscoped token? | 14:01 |
| *** tqtran has joined #openstack-keystone | 14:01 | |
| dolphm | (or a domain scoped token) | 14:01 |
| samueldmq | dolphm, I am checking all the services compatibility with v3 auth | 14:01 |
| samueldmq | dolphm, I've tested nova, cinder, glance last night | 14:02 |
| samueldmq | dolphm, rest api (with curl) works fine, clients with a keystone session too | 14:02 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:03 | |
| samueldmq | dolphm, the final goal is to have devstack using v3 auth to deploy the env (create what it needs) *and* deploying all services to use v3 auth as well | 14:03 |
| samueldmq | dolphm, this is on morganfainberg list for L | 14:03 |
| dolphm | samueldmq: it's on mine as well :D | 14:03 |
| *** alex_xu has quit IRC | 14:03 | |
| samueldmq | dolphm, and then have gate jobs all working with v3 auth | 14:03 |
| samueldmq | dolphm, o/ | 14:03 |
| dolphm | samueldmq: i *really* want to see a gate job running asap, even if it's failing and non-voting | 14:03 |
| *** pnavarro has quit IRC | 14:04 | |
| samueldmq | dolphm, I am still at the beginning, checking services->clients->osclient | 14:04 |
| samueldmq | dolphm, then will modify devstack, and after the gate jobs | 14:05 |
| *** _dguerri is now known as dguerri | 14:05 | |
| samueldmq | dolphm, I think this flow makes sense ... what you think about it ? | 14:05 |
| dolphm | samueldmq: i saw a paste you had the other day with about 7 steps? it made sense to me | 14:06 |
| samueldmq | dolphm, great! hmm .. you're always there ... silently :p | 14:06 |
| dolphm | samueldmq: i'd personally modify devstack to not deploy v2 first, and then approach it from a break-fix perspective | 14:06 |
| dolphm | samueldmq: ;) | 14:07 |
| samueldmq | dolphm, to see things exploding | 14:07 |
| bknudson | what step is making amends? | 14:07 |
| samueldmq | bknudson, dolphm http://paste.openstack.org/show/205246/ | 14:07 |
| bknudson | I don't think any cloud provider wants to use devstack. | 14:08 |
| bknudson | seems like step 1 is to have devstack deploy keystone without v2. | 14:09 |
| bknudson | and maybe step 0 is to change keystone so that it's easy do disable v2. | 14:09 |
| *** afazekas has quit IRC | 14:09 | |
| samueldmq | bknudson, me neither, I dont think any of them use devstack | 14:10 |
| samueldmq | bknudson, hmm yeah, the final goal is to get jobs running v3 auth only | 14:10 |
| samueldmq | bknudson, how should I proceed to disable v2 ? modifying the paste config ? | 14:10 |
| bknudson | v3 auth or v3? | 14:10 |
| samueldmq | bknudson, both | 14:11 |
| bknudson | the way we say to do it now is to modify the paste config | 14:11 |
| samueldmq | bknudson, I meant running exclusively v3 | 14:11 |
| bknudson | I don't think this is easy enough. | 14:11 |
| bknudson | it would be easier to have a config option. | 14:11 |
| *** vhoward has left #openstack-keystone | 14:11 | |
| samueldmq | bknudson, yeah, and devstack does it right ? (the past config .. ) | 14:11 |
| *** vhoward has joined #openstack-keystone | 14:11 | |
| samueldmq | I am trying to realize how to disable it on devstack | 14:12 |
| bknudson | I don't think devstack is modifying the paste config? | 14:12 |
| dolphm | bknudson: it's already trivial to disable v2 in keystone? | 14:12 |
| bknudson | you have to modify the paste config now. | 14:12 |
| dolphm | for the love of god, paste is not hard | 14:13 |
| bknudson | he he | 14:13 |
| dolphm | adding bullshit complexity on top of paste is not a damned solution to anything | 14:13 |
| dolphm | i really hope you're joking | 14:13 |
| bknudson | a lot of people don't like modifying the paste config | 14:13 |
| bknudson | and scripting changes in the paste config isn't always easy either. | 14:14 |
| dolphm | that's because they've never read the docs on paste and have zero understanding of wsgi | 14:14 |
| *** alex_xu has joined #openstack-keystone | 14:14 | |
| bknudson | you also have to know where to stick the middleware in the pipeline if it's got special requirements | 14:14 |
| bknudson | although for changing v2 it's probably just deleting lines. | 14:15 |
| bknudson | for disabling v2 | 14:15 |
| marekd | stevemar: Just noticed a bug (aith a bug fix): https://bugs.launchpad.net/keystone/+bug/1440958 | 14:16 |
| openstack | Launchpad bug 1440958 in Keystone "loosen validation on matching trusted dashboard" [Medium,Fix committed] - Assigned to Lin Hua Cheng (lin-hua-cheng) | 14:16 |
| marekd | i am not sure if it's good that http://paste.openstack.org/show/205705/ would work... | 14:16 |
| dolphm | bknudson: yep, it looks just like this https://github.com/dolph/keystone-deploy/commit/6c64ff78277101cee71d190178e496cc33c461ab#diff-667a3f5039a453b764e5e6fafc91668a | 14:16 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the misuse of `versionutils.deprecated` https://review.openstack.org/176646 | 14:16 |
| marekd | stevemar: did anybody complain about it? | 14:16 |
| samueldmq | dolphm, btw thanks, will use it :) | 14:18 |
| stevemar | marekd, on the phone... why is /evil_marek a bad thing? | 14:18 |
| dolphm | bknudson: and at minimum it's a one-line delete to drop v2 for testing purposes. my diff just thoroughly removes the remaining cruft | 14:18 |
| *** ajayaa has quit IRC | 14:19 | |
| *** lhcheng has joined #openstack-keystone | 14:19 | |
| *** ChanServ sets mode: +v lhcheng | 14:19 | |
| dolphm | two* line delete | 14:19 |
| dolphm | samueldmq: all you *have* to do is delete the /v2.0 lines from [composite:main] and [composite:admin] https://github.com/openstack/keystone/blob/master/etc/keystone-paste.ini#L98 | 14:19 |
| marekd | stevemar: evil_marek will intercept all the calls, he may steal the token. | 14:20 |
| samueldmq | dolphm, nice ... btw, I could have a patch on keystone to remove it from our sample paste file | 14:20 |
| bknudson | maybe devstack could have a config for what versions are enabled | 14:20 |
| samueldmq | dolphm, and point to my patch on devstack local.conf | 14:20 |
| dolphm | (but then v2 might still be advertised in the multiple chioce response? i'm not sure if the v2 app factories will still be initialized or not) | 14:20 |
| dolphm | bknudson: yeah, that toggle belongs in devstack (or whatever the deployment tooling is) | 14:22 |
| *** davechen has left #openstack-keystone | 14:23 | |
| *** csoukup has joined #openstack-keystone | 14:23 | |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: Policy rules mangaged from a database https://review.openstack.org/133814 | 14:23 |
| *** tqtran has quit IRC | 14:26 | |
| *** henrynash has joined #openstack-keystone | 14:27 | |
| *** ChanServ sets mode: +v henrynash | 14:27 | |
| samueldmq | dolphm, well, osclient looks to be working pretty well with v3 auth already | 14:27 |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: Policy rules mangaged from a database https://review.openstack.org/133814 | 14:29 |
| samueldmq | dolphm, that's great, but I still need to disable v2, since services may still be using v2 api with v3 tokens | 14:29 |
| samueldmq | dolphm, sorry, need to go afk for a bit | 14:29 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Service with no endpoints should not be in catalog https://review.openstack.org/176383 | 14:33 |
| stevemar | marekd, an evil marek from the same host? | 14:37 |
| marekd | stevemar: imagine host webhost provider.... | 14:37 |
| marekd | or... i don't know personal space for cern users. | 14:38 |
| marekd | where netloc is same for everyone, home.web.cern.ch/Name.Surname | 14:39 |
| *** bandwidth has joined #openstack-keystone | 14:46 | |
| *** krykowski has quit IRC | 14:48 | |
| *** vhoward has quit IRC | 14:51 | |
| *** vhoward has joined #openstack-keystone | 14:52 | |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: Policy rules mangaged from a database https://review.openstack.org/133814 | 14:52 |
| *** henrynash has quit IRC | 14:58 | |
| *** zzzeek has joined #openstack-keystone | 14:58 | |
| *** _cjones_ has joined #openstack-keystone | 15:00 | |
| *** Bsony_ has joined #openstack-keystone | 15:04 | |
| *** _cjones_ has quit IRC | 15:05 | |
| *** browne has joined #openstack-keystone | 15:05 | |
| *** Bsony has quit IRC | 15:06 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Add docstrings for ``protocol`` parameter https://review.openstack.org/177303 | 15:08 |
| stevemar | marekd, why would horizon send the token to /evil_marek? | 15:11 |
| *** generic_ has joined #openstack-keystone | 15:11 | |
| *** e0ne is now known as e0ne_ | 15:12 | |
| generic_ | exit | 15:12 |
| *** generic_ has quit IRC | 15:12 | |
| *** ashishjain has joined #openstack-keystone | 15:13 | |
| *** e0ne_ is now known as e0ne | 15:13 | |
| *** topol has joined #openstack-keystone | 15:14 | |
| *** ChanServ sets mode: +v topol | 15:14 | |
| dstanek | stevemar: because evil_marek is more fun than marekd | 15:15 |
| *** Bsony_ has quit IRC | 15:17 | |
| *** david-ly_ is now known as david-lyle | 15:22 | |
| stevemar | dstanek, but more evil too | 15:23 |
| *** e0ne is now known as e0ne_ | 15:29 | |
| *** e0ne_ is now known as e0ne | 15:30 | |
| *** rm_work|away is now known as rm_work | 15:30 | |
| bandwidth | I'm trying to get the OS-FEDERATION extension work, but I'm facing an issue when asking Nova for the list of my servers. basically, the domain_id is not set: if (token_ref['token_data']['token']['user']['domain']['id'] != KeyError 'domain' | 15:31 |
| stevemar | bandwidth, that should have been fixed in kilo or the latest middleware... | 15:35 |
| ayoung | morganfainberg, crappy line drawing, but...https://twitter.com/admiyoung/status/591595899249385472/photo/1 | 15:39 |
| *** ajayaa has joined #openstack-keystone | 15:40 | |
| dstanek | ayoung: what am i looking at? | 15:41 |
| ayoung | dstanek, My attempt to convert a blank black mug into a Keystone Tchotcke | 15:41 |
| ayoung | dstanek, it would help if I could draw a straight line. I was rushing out the door this morning, and wanted to make the mug memorable cuz I was bringing it in to the office. | 15:42 |
| *** lhcheng_ has joined #openstack-keystone | 15:42 | |
| *** Bsony has joined #openstack-keystone | 15:43 | |
| *** Ephur has joined #openstack-keystone | 15:44 | |
| morganfainberg | Haha nice. ;) | 15:45 |
| *** lhcheng has quit IRC | 15:45 | |
| *** ajayaa has quit IRC | 15:50 | |
| *** spandhe has joined #openstack-keystone | 15:50 | |
| *** ajayaa has joined #openstack-keystone | 15:50 | |
| *** alexsyip has joined #openstack-keystone | 15:51 | |
| stevemar | ayoung, i like it | 15:57 |
| *** _cjones_ has joined #openstack-keystone | 16:02 | |
| *** _cjones_ has quit IRC | 16:07 | |
| *** e0ne has quit IRC | 16:07 | |
| samueldmq | ayoung, ping - I need to talk to you about dynamic policies | 16:07 |
| ayoung | samueldmq, I need to shift gearts back to that soon | 16:08 |
| ayoung | samueldmq, dealing with ECP and SAML ATM | 16:08 |
| samueldmq | ayoung, I am trying to get a big picture of what we've done, and what misses, etc | 16:08 |
| samueldmq | ayoung, yeah makes sense | 16:08 |
| ayoung | samueldmq, that is what my presentation is going to be about. I need to write it. | 16:08 |
| samueldmq | ayoung, our team have plans to collaborate with that, so that's why I need a big picture | 16:08 |
| samueldmq | ayoung, do you have an etherpad or something like it ? | 16:09 |
| ayoung | samueldmq, OK, so first off is, I think, to clean up the policy file for Nova, | 16:09 |
| samueldmq | ayoung, I see the blog post and that oslo.policy is graduated | 16:09 |
| ayoung | samueldmq, I really can't shift gears right now | 16:09 |
| *** gyee has joined #openstack-keystone | 16:09 | |
| *** ChanServ sets mode: +v gyee | 16:09 | |
| samueldmq | ayoung, maybe we can talk later today ? | 16:09 |
| ayoung | we should do this on the BP page for Dynamic policy | 16:09 |
| *** bdossant has quit IRC | 16:09 | |
| samueldmq | ayoung, k, but the general plan is still according the blog post | 16:10 |
| ayoung | yep | 16:10 |
| samueldmq | ayoung, I am going to write up a summary and current status, and then I validate with you later | 16:11 |
| ayoung | samueldmq, I want to go incremental for most things, so we show real value at each release | 16:11 |
| samueldmq | ayoung, shouldnt take lot of your time | 16:11 |
| ayoung | but also go in parallel where possible, so multiple people can be productive | 16:11 |
| samueldmq | ayoung, ++ | 16:11 |
| ayoung | samueldmq, we need a sync with the Kent team | 16:11 |
| ayoung | they are doing the DB stuff..look at that BP | 16:11 |
| samueldmq | ayoung, do you have in mind as far as you want to go in L ? | 16:11 |
| samueldmq | ayoung, k got it, will look the spec | 16:12 |
| ayoung | samueldmq, let's schedule some time to talk about it, and see if we can link in Ioram | 16:12 |
| samueldmq | ayoung, the spec you're talking specifically is Dynamic Policy Overview | 16:12 |
| samueldmq | ? | 16:12 |
| ayoung | samueldmq, yeah | 16:12 |
| samueldmq | ayoung, great, yeah let's schedule some time to talk about this | 16:13 |
| samueldmq | ayoung, also, we have the summit | 16:13 |
| *** _cjones_ has joined #openstack-keystone | 16:13 | |
| ayoung | samueldmq, OK, so I don't know what happend to the old BP, but: https://blueprints.launchpad.net/keystone/+spec/dynamic-policy | 16:16 |
| ayoung | need to link the other BPs to that, etc | 16:17 |
| ayoung | and now...ECP and lunch | 16:17 |
| *** xgerman has joined #openstack-keystone | 16:18 | |
| samueldmq | ayoung, k go, bon apetit | 16:18 |
| xgerman | hi | 16:19 |
| xgerman | I am from Neutron and I have a question about some use case and how othe rprojects handle it | 16:19 |
| *** browne has quit IRC | 16:20 | |
| samueldmq | xgerman, hi, just go ahead, ask and someone might the right answers for your questions :-) | 16:21 |
| samueldmq | might have* :) | 16:21 |
| xgerman | so we have some admin functionality where an admin might do stuff on balf of a user. Currently we only check the admin tenant-id/credentials with keystone but not the if the teannt-id of the user exists the admin is doing stuff for because that would require another keystone roundtrip | 16:22 |
| *** rm_work is now known as rm_work|away | 16:22 | |
| xgerman | any ideas how say nova or other deal with that | 16:22 |
| dolphm | morganfainberg: are we still using kilo-rc-potential, or have we switched to kilo-backport-potential? | 16:28 |
| morganfainberg | dolphm: if it would block the rc, aka needing an rc3. Use rc-potential. | 16:29 |
| morganfainberg | Otherwise backport is more correct. | 16:29 |
| dolphm | okay, so backport in this case | 16:29 |
| morganfainberg | ++ | 16:29 |
| dolphm | dstanek: approved https://review.openstack.org/#/c/159521/ but there are outstanding nits that should be addressed, plzkthx! | 16:36 |
| *** jistr has quit IRC | 16:36 | |
| dstanek | dolphm: sure. | 16:36 |
| morganfainberg | ... | 16:44 |
| morganfainberg | It is by caffeine alone I set my mind in motion,it is by the beans of Java that thoughts acquire speed, the hands acquire shaking, the shaking becomes a warning; it is by caffeine alone I set my mind in motion. | 16:44 |
| morganfainberg | yesssssss | 16:44 |
| samueldmq | morganfainberg, hehe o/ | 16:46 |
| samueldmq | The Programmer's Mantra | 16:47 |
| xgerman | ok, posted to the ML | 16:57 |
| morganfainberg | xgerman, more eyes on the ML in general. thanks. | 16:58 |
| xgerman | you are welcome | 16:58 |
| ayoung | marekd, OK, I am trying an ECP based workflow. the first thing accessed should be an URL like this, right: http://$HOSTNAME:5000/v3/OS-FEDERATION/identity_providers/ipsilon/protocols/saml2/auth | 17:00 |
| ayoung | stevemar, ^^ | 17:01 |
| *** browne has joined #openstack-keystone | 17:02 | |
| *** vhoward has left #openstack-keystone | 17:03 | |
| *** samleon has quit IRC | 17:03 | |
| *** samleon has joined #openstack-keystone | 17:04 | |
| *** _cjones_ has quit IRC | 17:08 | |
| *** _cjones_ has joined #openstack-keystone | 17:12 | |
| *** rm_work|away is now known as rm_work | 17:12 | |
| openstackgerrit | Merged openstack/keystone: Fix the misuse of `versionutils.deprecated` https://review.openstack.org/176646 | 17:14 |
| openstackgerrit | Merged openstack/keystone: Remove pysqlite test-requirement dependency https://review.openstack.org/176557 | 17:16 |
| morganfainberg | yay^ 2 libaries to switch out to be close to py3 / ready for experimental job again. | 17:17 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 17:18 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 17:19 |
| *** ajayaa has quit IRC | 17:20 | |
| *** spandhe has quit IRC | 17:24 | |
| *** dguerri is now known as _dguerri | 17:24 | |
| openstackgerrit | Merged openstack/keystone: Isolate injection tests https://review.openstack.org/162768 | 17:25 |
| openstackgerrit | Merged openstack/keystone: Remove project association before removing endpoint group https://review.openstack.org/173192 | 17:25 |
| *** _dguerri is now known as dguerri | 17:25 | |
| *** ChanServ changes topic to "Liberty Development Open | RC2 For Kilo has been tagged, please look for any new RC blockers | Review Liberty Specs" | 17:29 | |
| openstackgerrit | Merged openstack/keystone: Fixes the SQL model tests https://review.openstack.org/159521 | 17:29 |
| openstackgerrit | Merged openstack/pycadf: Add trove conf file to setup.cfg https://review.openstack.org/176988 | 17:29 |
| dstanek | morganfainberg: zzzeek: is there any advice for handling dogpile.cache key mangling in Python3? | 17:29 |
| morganfainberg | dstanek, magic. | 17:29 |
| morganfainberg | dstanek: depends on what aspect. | 17:30 |
| dstanek | from dogpile.cache.util import sha1_mangle_key always expends input to be bytes so the obvious thing for me to always wrap the key mangler | 17:30 |
| dstanek | but was hoping there was a better way | 17:30 |
| openstackgerrit | Merged openstack/keystonemiddleware: Update README to work with release tools https://review.openstack.org/175913 | 17:30 |
| zzzeek | dstanek: there’s a key mangler argument | 17:30 |
| morganfainberg | dstanek: yeah that would be the right thing... OR fix the keymangler upstream to handle non-bytes cases | 17:30 |
| morganfainberg | dstanek: (better solution) | 17:30 |
| zzzeek | morganfainberg: sure | 17:30 |
| morganfainberg | dstanek: since zzzeek is our upstream here, it's easy to bug him about this stuff :) | 17:31 |
| dstanek | it's not obvious what the expected behavior would be? just check for text type and encode? | 17:31 |
| morganfainberg | dstanek: as long as it results in a consistent key | 17:32 |
| *** raildo has quit IRC | 17:32 | |
| morganfainberg | yeah | 17:32 |
| zzzeek | dstanek: i wouldnt want to do any isinstance() in there. id want it to know up front what it will be getting | 17:32 |
| zzzeek | dstanek: if this is an always py3k thing then we can look at compat.py3k flag | 17:32 |
| morganfainberg | zzzeek: the issue is keymangler is parsing args | 17:32 |
| morganfainberg | zzzeek: it might be bytes, it might be text | 17:32 |
| morganfainberg | zzzeek: hashing requires bytes. | 17:33 |
| morganfainberg | s/parsing/hashing | 17:33 |
| zzzeek | morganfainberg: when would it be bytes? these are the cache keys being used with get(), put() right. we’re sending bytes-based keys? id think that’s the speial case | 17:33 |
| dstanek | exactly and right now it is always expecting bytes | 17:33 |
| dstanek | zzzeek: but the decorator takes the args, whatever they are, and makes a key from them | 17:34 |
| *** spandhe has joined #openstack-keystone | 17:34 | |
| zzzeek | morganfainberg dstanek : id say, “if py3k: key = key.encode()” would be the reasonable default no ? | 17:34 |
| morganfainberg | hm. | 17:34 |
| morganfainberg | zzzeek: if an argument is already bytes though, that might explode, no? | 17:35 |
| dstanek | zzzeek: not because i think that will fail it is is bytes | 17:35 |
| zzzeek | or just, “key_mangler = sha1_key_mangler_create(encoding=‘utf8’)” | 17:35 |
| morganfainberg | zzzeek: keymangler acts on the passed argument values | 17:35 |
| zzzeek | morganfainberg: yes, but when does that happen | 17:35 |
| morganfainberg | zzzeek: we have cases in keystone where arguments will be typed bytes | 17:35 |
| morganfainberg | zzzeek: because underlying things are expecting bytes, or it came in as bytes | 17:35 |
| zzzeek | morganfainberg: oh you send one or the other arbitrarily? then use your own mangler :) | 17:35 |
| *** raildo has joined #openstack-keystone | 17:36 | |
| morganfainberg | zzzeek: i think that is not a very friendly answer. | 17:36 |
| dstanek | i would imagine that this is a problem for everyone in py3 | 17:36 |
| *** _cjones_ has quit IRC | 17:36 | |
| morganfainberg | dstanek: thats my thought | 17:36 |
| *** _cjones_ has joined #openstack-keystone | 17:36 | |
| zzzeek | morganfainberg: wasn’t meant to be unfriendly, I think the keys sent to the caching region should be of the same type in the default case | 17:36 |
| morganfainberg | zzzeek: and by not friendly i mean, not friendly to developers. | 17:36 |
| morganfainberg | not you personally. | 17:36 |
| zzzeek | morganfainberg: the isinstance() thing is a hole that everyone falls into too often | 17:37 |
| morganfainberg | zzzeek: in the case of hashing, it's important | 17:37 |
| morganfainberg | because hashing *does* require bytes | 17:37 |
| dstanek | that means that we'd have 2 different regions - a bytes one and a text one | 17:37 |
| morganfainberg | and python (even py3) sucks at bytes vs text_string | 17:37 |
| samueldmq | ayoung, what do you mean by 'to clean up the policy file for Nova', I dont understand clearly the work that need to be done | 17:37 |
| morganfainberg | dstanek: or a custom keymangler | 17:37 |
| dstanek | for now i'll keep my hacked up key mangler and we can revisit later | 17:37 |
| openstackgerrit | gordon chung proposed openstack/pycadf: drop audit middleware https://review.openstack.org/176969 | 17:38 |
| ayoung | samueldmq, so...let me show | 17:38 |
| dstanek | morganfainberg: yeah, that's what i already did | 17:38 |
| zzzeek | morganfainberg / dstanek : clearly, having a simple function like “sha1_mangle_key” is too simplisitc. Add API to util.py such that we can get a variety of key mangler types | 17:38 |
| zzzeek | one that accepts only strings, one that acepts only bytes, one that checks with isinstance() | 17:38 |
| morganfainberg | zzzeek: sure, or maybe we offer an upstream alternative... yeah | 17:38 |
| ayoung | samueldmq, bascially, each rule has http://git.openstack.org/cgit/openstack/nova/tree/etc/nova/policy.json#n3 | 17:38 |
| morganfainberg | zzzeek: as long as we provide nice options for developers, we induce less rage. | 17:39 |
| ayoung | samueldmq, it does not even check if the rule has any role at all, just that the token is scoped to the project | 17:39 |
| zzzeek | morganfainberg: and i think having it via a factory is best. key_mangler = util.make_a_key_mangler(here_are_the_things_I_want) | 17:39 |
| morganfainberg | zzzeek: I can see that as a benefit | 17:39 |
| ayoung | samueldmq, and the rule admin_or_owner basically checks for the admin role... | 17:40 |
| morganfainberg | zzzeek: i would argue the default should check and do both bytes and text handling, but i'll argue that with you separately from "adding this into the libary support wise" even as a config'd option | 17:40 |
| ayoung | one anything, not just that context | 17:40 |
| zzzeek | morganfainberg: just because, I dont want to bury a concrete isinstance() at the base of all cache operations for everyone | 17:40 |
| dstanek | zzzeek: will using the factory handle the case where is could be either bytes or text? | 17:40 |
| zzzeek | dstanek: yes | 17:40 |
| samueldmq | ayoung, looking | 17:40 |
| zzzeek | dstanek: this is the factory that you or morganfainberg is giong to write me a PR for | 17:40 |
| ayoung | which means that if I have admin on anything, I can use that token against nova and get access to any API | 17:40 |
| dstanek | zzzeek: ah, haha ok | 17:40 |
| samueldmq | ayoung, oh! that's the global admin thing as admin=1 | 17:40 |
| ayoung | right | 17:41 |
| ayoung | so, what we want is to start there | 17:41 |
| *** tqtran has joined #openstack-keystone | 17:41 | |
| samueldmq | ayoung: samueldmq, and the rule admin_or_owner basically checks for the admin role... | 17:41 |
| samueldmq | should check, you mean, right? | 17:41 |
| ayoung | samueldmq, since a project is created in Keystone, checking that both the project id and and that the user has the admin role on that project should be the norm | 17:42 |
| * morganfainberg wonders if we can convince zzzeek to move dogpile to gerrit >.> | 17:42 | |
| *** r-daneel has joined #openstack-keystone | 17:42 | |
| morganfainberg | zzzeek: i have a couple PRs i owe you | 17:42 |
| morganfainberg | zzzeek, and an update of that key one. | 17:42 |
| morganfainberg | zzzeek: hopefully soon. | 17:42 |
| zzzeek | morganfainberg: not to stackforge but i am curious about having gerrits for bitbucket/github projects | 17:42 |
| ayoung | samueldmq, the problem is that we do not have a good way to create a global admin that can clean up anything...OTOH, that would probably violate the goals of the reseller spec anyway | 17:43 |
| samueldmq | ayoung, what we need to for nova is : 'role:admin and project_id:%(project_id)s', right ? | 17:43 |
| morganfainberg | zzzeek: i find PRs to be wholly distasteful and it usually deters me from contributing to projects unless i really really really care | 17:43 |
| ayoung | samueldmq, so I want it like this | 17:43 |
| morganfainberg | zzzeek: dogpile i actually care enough about to do PRs, but PRs are a broken work flow when you exceed ~3 devs imo | 17:43 |
| dstanek | zzzeek: http://gerrithub.io/ | 17:44 |
| morganfainberg | zzzeek: linux kernel aside because... there is always exceptions | 17:44 |
| ayoung | "compute_extension:admin_actions:pause": "rule:proejct_matches and role:member", | 17:44 |
| morganfainberg | dstanek, neat | 17:44 |
| ayoung | but with an enhanced 'role ' that knows member implies admin | 17:44 |
| ayoung | now, we could do this | 17:44 |
| zzzeek | morganfainberg: i am ready for gerrits and not PRs but woudl need time to get that all working. plus i prefer bitbucket as home base so it has to integrate iwth that | 17:45 |
| ayoung | "member" : "role:admin or role:member" | 17:45 |
| ayoung | then it would be | 17:45 |
| morganfainberg | zzzeek: sure. i totally get time + likeing bitbucket | 17:45 |
| ayoung | "compute_extension:admin_actions:pause": "rule:proejct_matches and rule:member", | 17:45 |
| morganfainberg | zzzeek: we all need clones or more time in a day | 17:45 |
| dolphm | self.scale_up() | 17:46 |
| dolphm | self.scale_horizontally() * | 17:46 |
| ayoung | samueldmq, rule:project_matches is Nova specific | 17:46 |
| samueldmq | ayoung, well ;; "context_is_admin": "role:admin", | 17:46 |
| ayoung | the other projects might need to do more complex logic. I know Keystone does | 17:47 |
| ayoung | samueldmq, I was thinking more like | 17:47 |
| *** rm_work is now known as rm_work|away | 17:47 | |
| samueldmq | ayoung, sorry but I didnt get why we can't just change them to be what we need : 'role:admin and project_id:%(project_id)s' | 17:47 |
| ayoung | samueldmq, we want people to make the minimal edits | 17:47 |
| ayoung | the rules get too complex. Look at what Henrynash had to do in cloudsample | 17:48 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n37 | 17:48 |
| ayoung | make that two rules, and you can vary the role on a per APR line by line | 17:48 |
| ayoung | APR->API | 17:49 |
| samueldmq | ayoung, k so what you're looking for is something to simplify the policy definition | 17:49 |
| samueldmq | ayoung, not making it more powerful for now | 17:49 |
| ayoung | samueldmq, first, we need a standard to say something like: an api should have a scope matching portion and a role portion | 17:49 |
| ayoung | and the role portion comes at the end. | 17:49 |
| ayoung | then people can know that to change the role assigned to an api they just edit that one part of the line | 17:50 |
| samueldmq | ayoung, and we need to make it easy, by using this pattern | 17:50 |
| ayoung | so say you split member into reader and writer | 17:50 |
| ayoung | you would add rules at the top to indicate that, and modify the appropriate api lines accordingly | 17:50 |
| ayoung | this is the stuff I am going to do for my talk | 17:51 |
| *** harlowja_away is now known as harlowja | 17:51 | |
| ayoung | show how to do sets-of-roles (hate the term inheritance there) using the existing mechs | 17:51 |
| ayoung | a role is a set of permissions, so we can talk in terms of subsets | 17:51 |
| ayoung | member can be a set which is composed of role:member role:reader role:writer | 17:52 |
| samueldmq | ayoung, ah I think I got it | 17:52 |
| ayoung | and then the individual rules would be | 17:52 |
| samueldmq | ayoung, so basically all we talked so far we can do with the current mechanisms | 17:52 |
| ayoung | rule:role_member or rule:role_writer | 17:52 |
| ayoung | right | 17:52 |
| ayoung | but start by getting the file into the right format | 17:52 |
| *** Ctina has joined #openstack-keystone | 17:52 | |
| ayoung | now..lets talk admin for a moment | 17:52 |
| samueldmq | nice, you want to reorganize and define a pattern to define rules across apis | 17:52 |
| ayoung | right now, If I am admin anywhere, I am admin everywhere | 17:53 |
| ayoung | what we want, instead, is the inherited roles you guys did being enforced | 17:53 |
| *** rushil_ has joined #openstack-keystone | 17:53 | |
| ayoung | but that means that a user now needs to get a token scoped to a particular something as opposed to a god token | 17:53 |
| ayoung | got tokens bad | 17:53 |
| ayoung | god tokens bad I mean | 17:53 |
| *** rushil has quit IRC | 17:54 | |
| ayoung | so...we create a new role...call it ALL | 17:54 |
| samueldmq | we need to enforce admin role + project scope, rigjt ? | 17:54 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 17:54 |
| ayoung | it means all Roles, not all roles everywhere | 17:54 |
| samueldmq | k go ahead | 17:54 |
| ayoung | and stop using the term Admin | 17:54 |
| ayoung | samueldmq, you are right: "we need to enforce admin role + project scope" only lets call it ALL to avoid clashes | 17:54 |
| samueldmq | k | 17:55 |
| ayoung | certain things need role "ALL" and certain things need role "Member" but always on the appropriate scope | 17:55 |
| samueldmq | all doesnt care about scope, right ? | 17:56 |
| ayoung | "service_or_admin": "rule:admin_required or rule:service_role", is another way of saying the service role set should include role:service or role:admin, as I don;'t think we have any calls that won't let admin operate | 17:56 |
| ayoung | now, the service_role APIs don't have a matching scope | 17:57 |
| ayoung | identity:validate_token" or identity:revocation_list etc | 17:57 |
| ayoung | and that is OK. those rules will be explicitly unscoped, but then maybe we drop the "service implies admin" for them | 17:57 |
| bandwidth | stevemar: so that means, no federation with Juno, right? | 17:57 |
| ayoung | seems to me we should have some scoping for everything...but that takes us off in a tangent | 17:58 |
| stevemar | bandwidth, it'll have some issues that were ironed out in kilo | 17:58 |
| ayoung | I wonder when anyone would use an admin token to validate a token instead of a token scoped to a service user. | 17:58 |
| samueldmq | ayoung, from what you said the ALL thing, I was thinking like: | 17:59 |
| morganfainberg | ayoung, more often than you'd like. less often than we know | 17:59 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 18:00 |
| samueldmq | ayoung, "compute:create": "ALL or (match_scope and match_role)" | 18:00 |
| samueldmq | ayoung, ^ at least the logic of it | 18:00 |
| ayoung | morganfainberg, what would be the right scope for an admin user to be able to validate a token? I am admin on <what?> | 18:00 |
| ayoung | samueldmq, no | 18:00 |
| ayoung | let me take ojne that has a non-empty rule | 18:00 |
| ayoung | "compute_extension:admin_actions:pause": "rule:admin_or_owner", right now would become | 18:01 |
| morganfainberg | ayoung, dunno | 18:01 |
| morganfainberg | ayoung, i'd rather enforce a service scoped user to keystone | 18:01 |
| ayoung | "compute_extension:admin_actions:pause": "rule:project_matches and rule:role_member" | 18:01 |
| ayoung | morganfainberg, so would I | 18:01 |
| morganfainberg | ayoung, but today can we differentiate between admin on X and Y w/o breaking everyone? | 18:01 |
| ayoung | morganfainberg, no we can't at least not in default policy...let me see cloudsample | 18:02 |
| ayoung | morganfainberg, in cloudsample, we have no calls that use just service token, but those do not check scope at all, either | 18:02 |
| ayoung | morganfainberg, http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n104 | 18:02 |
| ayoung | that rule is defined http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n5 | 18:03 |
| samueldmq | ayoung, you want to have 'enforce scope + role' everywhere, but at the same time allowing (for compatibility) the old admin anywhere can do everywhere | 18:03 |
| samueldmq | ayoung, righ ? | 18:03 |
| morganfainberg | samueldmq: that should be a function of the policy file | 18:03 |
| morganfainberg | samueldmq: or policy rules | 18:03 |
| ayoung | morganfainberg, we are saying that service users should go in the service domain anyway...what if I present on a rule that enforces them having the service rule on the service domain, and then they request a tick for that...I guess they would need a default proejct to work today, and we don't specify that in the auth_toekn section consumed by middleware | 18:04 |
| morganfainberg | ayoung: yeah | 18:04 |
| ayoung | so...we would create a service project in the service domain, and they get a token with the service role scoped on it by default? | 18:04 |
| ayoung | that would work today | 18:04 |
| morganfainberg | ayoung: we could adjust that project requirement *if* we suppoerted a service scope... but i .. | 18:04 |
| morganfainberg | that sounds like it's getting ugly/scary | 18:05 |
| ayoung | morganfainberg,this is for "how an operator can do it today" not for changing what we ship by default | 18:05 |
| morganfainberg | ayoung, ahh | 18:05 |
| ayoung | one of my guidelines, I think, will be "scope all the things" | 18:05 |
| morganfainberg | lol | 18:06 |
| ayoung | morganfainberg, actually, the service role has to be assigned on some scope today anyway | 18:08 |
| samueldmq | ayoung, is there a need to write a spec for anything in dynamic policies ? or are they all defined a t https://review.openstack.org/#/q/project:openstack/keystone-specs+branch:master+topic:dynamic-policy,n,z | 18:08 |
| morganfainberg | ayoung: do we need to revisit service scope? | 18:08 |
| morganfainberg | ayoung: as a real thing | 18:08 |
| morganfainberg | ? | 18:08 |
| ayoung | morganfainberg, one sec..let me see what is going on in a runnin instance | 18:08 |
| dstanek | is this test valuable? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/tests/test_core.py#n50 | 18:08 |
| *** dguerri is now known as _dguerri | 18:09 | |
| morganfainberg | dstanek: possibly? | 18:09 |
| morganfainberg | dstanek: oh uh.. | 18:09 |
| ayoung | ok, rdo deployment has no Service role | 18:09 |
| dstanek | it's testing to make sure our tests get an exception if there is a deprecatoin warning | 18:10 |
| morganfainberg | dstanek: that looks like it's testing "does python work" | 18:10 |
| ayoung | I think it was testing "do our tests work" | 18:10 |
| dstanek | morganfainberg: right | 18:10 |
| morganfainberg | dstanek: i see no value in testing base python interpreter stuff | 18:10 |
| morganfainberg | honestly | 18:10 |
| dstanek | ayoung: more precisely "do our tests configure Python correctly" | 18:10 |
| ayoung | who wrote that...git blame? | 18:11 |
| dstanek | ayoung: i'm betting bknudson | 18:11 |
| dolphm | gordc: it looks like you opened 3 bugs for the audit middleware somehow - i closed 1448237 and 1448238 in favor of 1448239 (the one stevemar triaged): https://bugs.launchpad.net/pycadf/+bug/1448239 | 18:11 |
| openstack | Launchpad bug 1448239 in pycadf "drop audit middleware" [Medium,In progress] - Assigned to gordon chung (chungg) | 18:11 |
| stevemar | dolphm, launchpad win! | 18:12 |
| dolphm | yeah.. | 18:12 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 18:13 |
| ayoung | morganfainberg, so RDO set up we give service userse the admin role on the service project | 18:13 |
| ayoung | samueldmq, this is under the unified policy file, I think | 18:13 |
| bknudson | test_deprecations verifies that the code in the test setup to catch if there are any use of deprecations works. otherwise we don't have any idea or not if it's actually protecting anything. | 18:13 |
| gordc | dolphm: hmmmm.. i guess i spazzed out. | 18:13 |
| gordc | thanks for cleaning up | 18:14 |
| bknudson | using a deprecated function typically doesn't raise an exception. | 18:14 |
| bknudson | the test itself is kind of goofy... not sure why it doesn't just call warnings module. | 18:15 |
| ayoung | samueldmq, the other thing we need to do is rework the spec on fetching policy from Keystone before enforcing it. dolphm wanted it under middleware...which is probably wehere iot belongs, but it is a library call, not a middleware call. | 18:15 |
| bandwidth | stevemar: did you try keystone from kilo with the services with juno? | 18:15 |
| samueldmq | ayoung, yeah I also think middleware is the right place | 18:15 |
| ayoung | we need to clarify how nova talks to libraray talks to keystone, with caching of the policy file in the middle there somewhere | 18:15 |
| samueldmq | ayoung, hm .. | 18:16 |
| dstanek | bknudson: it does now :-) | 18:16 |
| ayoung | I don't think so...I think middleware is part of it, but I would say that anyone should be able to fetch policy and operate on it. Horizon does not use middleware, but needs to figure out things from policy | 18:16 |
| samueldmq | ayoung, so collaboration points would be the unified policy (implementing it and helping to maintain the spec) | 18:16 |
| samueldmq | ayoung, and the fetching policy spec | 18:16 |
| ayoung | I would prefer to have a KC interface, and then have middleware provide a cache layer in front of it | 18:16 |
| ayoung | samueldmq, yes | 18:17 |
| ayoung | samueldmq, as well as thedefault spec | 18:17 |
| ayoung | once we have a unfieid policy file, default makes more sense | 18:17 |
| samueldmq | ayoung, great, I will propose these 3 collaboration points, thanks | 18:17 |
| samueldmq | ayoung, btw, just to check ... 'Add to the policy library the essential code to enforce policy based on a keystone token' is already done, right? | 18:17 |
| samueldmq | ayoung, as we've already graduated oslo.policy | 18:18 |
| ayoung | samueldmq, we also want to make the other projects replace oslo incubator with the policy library | 18:18 |
| ayoung | which means that some work needs to be done for Neutron, see the mailing list on that one | 18:18 |
| samueldmq | ayoung, nice | 18:18 |
| ayoung | that will require a new release of policy lib with symbols made public | 18:18 |
| ayoung | nice thing about that is we will pick up the fix needed for endpoint binding | 18:19 |
| morganfainberg | stevemar: ping | 18:19 |
| ayoung | so..question of priorities...lets make highest priority anything that can be used on its own with no other dependencies | 18:19 |
| stevemar | morganfainberg, pong | 18:19 |
| morganfainberg | stevemar: can you help me get the -specs repo to move kilo specs to "previous"? | 18:20 |
| morganfainberg | stevemar: if you don't mind | 18:20 |
| samueldmq | ayoung, ++ | 18:20 |
| samueldmq | ayoung, I got it, I understand a big part of the things, will become more familiar as we get into collaboration | 18:21 |
| stevemar | morganfainberg, oh yeah, i was thinking about doing that | 18:21 |
| ayoung | samueldmq, that give you enough to work on? | 18:21 |
| samueldmq | ayoung, thanks | 18:21 |
| morganfainberg | stevemar: :) | 18:21 |
| stevemar | morganfainberg, have like 10 things to do before 5pm :P | 18:21 |
| samueldmq | ayoung, well ... yes, I will propose all those points to my manager, thanks | 18:21 |
| ayoung | ++ | 18:21 |
| morganfainberg | stevemar: not needed *today* just a "can you toss this on your stack" for "soon" | 18:21 |
| *** jaosorior has quit IRC | 18:22 | |
| ayoung | samueldmq, we should still set up a time for a group of us to discuss dynamic policy prior to the summit | 18:25 |
| dstanek | i'm going the spam this room in a few minutes with Python3 commits.... | 18:25 |
| openstackgerrit | Merged openstack/keystone: Tests don't override default config with default https://review.openstack.org/166631 | 18:25 |
| morganfainberg | dstanek, sounds good | 18:25 |
| samueldmq | ayoung, k, once we decide what we can grab from those points for now (before summit) | 18:26 |
| morganfainberg | dstanek, btw: i am putting a spec up for handing ldap3 and pymemcache updates | 18:26 |
| dstanek | hmmm....looks like maybe only half of them are ready | 18:26 |
| morganfainberg | dstanek, so we can tag this work to a specific initiative | 18:26 |
| samueldmq | ayoung, I will tell you and we schedule a meeting to talk about the policy stuff | 18:26 |
| samueldmq | ayoung, in general | 18:26 |
| samueldmq | ayoung, works for you ? | 18:26 |
| marekd | ayoung: yes | 18:27 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Move kilo specs to 'implemented' section https://review.openstack.org/177377 | 18:28 |
| stevemar | morganfainberg, ^ | 18:28 |
| ayoung | marekd, I've been debugging since then. That part works, and it is fouling up on the IdP side...It might be (probably is) a config set up problem cuz I'm not getting a transaction ID allocated, but also cuz the IdP is redierceting where it should just be answering the request for an assertion. | 18:29 |
| marekd | ayoung: transaction at the SP or IdP side? | 18:30 |
| ayoung | marekd, who should be allocating the transaction id? Maybe that is the problem. Does the SP allocate it? | 18:33 |
| ayoung | marekd, the problem was on the IdP side, but if it was getting the transaction id from the request, then it is a provider problem, isn't it | 18:33 |
| *** rm_work|away is now known as rm_work | 18:34 | |
| marekd | ayoung: there might be some transaction-id like string/number but i don't think it's required. It helps and probably works more like session-id | 18:36 |
| *** jdennis has quit IRC | 18:36 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Add spec for python-3 compatibility https://review.openstack.org/177380 | 18:36 |
| *** jdennis has joined #openstack-keystone | 18:37 | |
| ayoung | marekd, I'm working with a pretty new setup..quite likely both bugas and config errors. I need to get down to fewer moving parts before I can solve this, but I think I am close to getting ECP testing working. I need to head out now, but I'll keep hacking on it over the weekend | 18:37 |
| *** ayoung is now known as ayoung-bye | 18:37 | |
| morganfainberg | dstanek, ^ | 18:37 |
| *** ayoung-bye has quit IRC | 18:37 | |
| dstanek | morganfainberg: do you want to link that back to the existing blueprint? | 18:40 |
| morganfainberg | dstanek, we have an existing BP? | 18:40 |
| morganfainberg | oh. didn't know | 18:40 |
| morganfainberg | we can do that | 18:41 |
| morganfainberg | and mark the new one superseded | 18:41 |
| morganfainberg | cause.. i don't care as long as we're tracking :) | 18:41 |
| morganfainberg | dstanek: aslo https://review.openstack.org/#/c/177375/ | 18:41 |
| morganfainberg | dstanek: x-project spec about py3 stuffs | 18:42 |
| dstanek | all my commits are 'bp python3', but i can change that | 18:42 |
| morganfainberg | dstanek: your call i'm happy to quickly update the new spec | 18:42 |
| *** panbalag has joined #openstack-keystone | 18:42 | |
| morganfainberg | dstanek: you're down as leading this charge btw [and i'm committing to help with the ldap3 stuff and/or pymemcache] | 18:42 |
| *** lhcheng_ has quit IRC | 18:44 | |
| dstanek | morganfainberg: sounds good to me | 18:45 |
| morganfainberg | dstanek: so should i update the bp link in the spec or you changing your targets in commits? | 18:47 |
| dstanek | morganfainberg: depends. we already have a base of work under 'bp python3' i'm assuming that we'd want all of the work to be under the same bp. so i say update the bp link | 18:48 |
| morganfainberg | updating now | 18:48 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Add spec for python-3 compatibility https://review.openstack.org/177380 | 18:49 |
| morganfainberg | dstanek, ^^ | 18:49 |
| panbalag | Hi.. I have configured keystone to use SSL and its certificates are not signed by a trusted authority (I setup my own CA using openssl). When i try to issue keystone endpoint-list, I get "Authorization Failed: SSL exception connecting to https://10.8.0.50:35357/v2.0/tokens"...I tried using --insecure option (along with --debug) ..I see "Starting new HTTPS connection ..." but the curl command in the debug lists http connectio | 18:49 |
| morganfainberg | panbalag: are the endpoints in the catalog HTTPS or HTTP for keystone? | 18:50 |
| *** rm_work is now known as rm_work|away | 18:50 | |
| panbalag | morganfainberg, did you mean the "keystone_admin" file I sourced? | 18:50 |
| morganfainberg | panbalag: so the service catalog might be telling the client to use http even though you are originally authenticating with https. | 18:52 |
| panbalag | morganfainberg, how do I change the service catalog? | 18:52 |
| morganfainberg | panbalag: can you use curl to get a token and/or interact with keystone directly instead of via the python cli? | 18:52 |
| morganfainberg | panbalag: depends on if you're using the templated catalog of the catalog in the SQL backend | 18:52 |
| panbalag | morgafainberg, ok let me try the curl command directly | 18:52 |
| morganfainberg | panbalag: note curl command scrubbs the token | 18:53 |
| *** alextrcitiy has quit IRC | 18:53 | |
| morganfainberg | panbalag: in --debug | 18:53 |
| morganfainberg | panbalag: so you'll need to get a valid token first [copy/paste doesn't work directly] | 18:53 |
| morganfainberg | if you see {SHA1}<hexstring> for the token, that is obfuscated | 18:53 |
| morganfainberg | or similar | 18:53 |
| morganfainberg | if it's a 32-byte uuid hex string *or* PKI string [really really long] then it's a real token. | 18:54 |
| *** rm_work|away is now known as rm_work | 18:56 | |
| panbalag | morganfainberg, curl command works fine with https. | 18:58 |
| morganfainberg | panbalag: ok so this tells me that the client is being confused. if it's using http instead of https | 18:58 |
| morganfainberg | panbalag: after the token is received | 18:59 |
| morganfainberg | panbalag: are you using the templated catalog or the SQL based catalog (this will be in the keystone config under [catalog]) | 18:59 |
| morganfainberg | and the option will be driver | 18:59 |
| morganfainberg | this might also be related to the 'admin_endpoint' and 'public_endpoints' in the keystone config | 19:00 |
| morganfainberg | panbalag, ^ | 19:00 |
| morganfainberg | panbalag: https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L21-L35 | 19:00 |
| panbalag | morganfainberg, it is SQL based - "keystone.catalog.backends.sql.Catalog"...the public_endpoint and admin_point have been commented out | 19:04 |
| morganfainberg | panbalag: so the default is http with those commented out iirc | 19:04 |
| morganfainberg | panbalag you may need to change and specify https://<host of keystone>:<port>/.... like shown in the comment of that config file | 19:04 |
| morganfainberg | panbalag: alternatively you may also need to look at the endpoints in the catalog and update the keystone ones to reference https | 19:05 |
| morganfainberg | panbalag: i unfortunately am a bit context switched to another topic so can't tell you which one of those / if both will be needed off the top of my head | 19:05 |
| panbalag | morganfainberg, ok.I'll change the admin/public endpoint first and see if that helps... | 19:06 |
| panbalag | morganfainberg, that didnt help..looks like I need to change the endpoint in the catalog..any idea how to change it? | 19:09 |
| *** lhcheng has joined #openstack-keystone | 19:14 | |
| *** ChanServ sets mode: +v lhcheng | 19:14 | |
| *** rm_work is now known as rm_work|away | 19:22 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Group role revocation invalidates all user tokens https://review.openstack.org/141854 | 19:23 |
| amakarov | morganfainberg, hi! Looks like I've figured out how to support TRL ^^ | 19:24 |
| *** jdennis has quit IRC | 19:25 | |
| *** _dguerri is now known as dguerri | 19:30 | |
| *** amakarov is now known as amakarov_away | 19:33 | |
| bknudson | gordc: any progress on a pycadf stable/juno branch (so we can get keystonemiddleware going again) | 19:42 |
| openstackgerrit | Merged openstack/keystone: Cleanup test keeping unnecessary fixture references https://review.openstack.org/161544 | 19:43 |
| *** rm_work|away is now known as rm_work | 19:43 | |
| gordc | bknudson: ah right. i was going to ping you about that yesterday. | 19:44 |
| bknudson | gordc: good news, I assume. | 19:44 |
| gordc | bknudson: errr.. more like i forgot.lol | 19:44 |
| gordc | dhellmann: ^ any chance you free and able to create a stable/juno branch for pycadf. | 19:44 |
| bknudson | looks like the pycadf branch would be 0.6.0 | 19:45 |
| openstackgerrit | Merged openstack/keystone: Entrypoints for commands https://review.openstack.org/131435 | 19:45 |
| bknudson | that was 2014-08-21... the next release 0.7.0 was 2015-01-19 | 19:45 |
| gordc | bknudson: yep. (i thought there was a 0.6.1 but guess not) | 19:45 |
| bknudson | and juno was 2014-10-16. | 19:45 |
| gordc | morganfainberg: i don't know if you have abilities to create branches on pycadf. | 19:46 |
| morganfainberg | gordc, i cannot create branches, but it is easy to ask infra to | 19:46 |
| gordc | bknudson: yeah that seems sane to me. looks like we need ot branch on https://github.com/openstack/pycadf/releases/tag/0.6.0 | 19:46 |
| morganfainberg | gordc, or at least i don't think i can | 19:46 |
| * morganfainberg checks | 19:47 | |
| morganfainberg | gordc, get the branch name and sha of the commit the branch should be based on | 19:47 |
| morganfainberg | i do not have "create branch" superpowers. | 19:47 |
| gordc | morganfainberg: https://github.com/openstack/pycadf/commit/52727bcea3a98e72331e748ce5f9e3a111a64cd1 | 19:47 |
| morganfainberg | but we just need to ask -infra. | 19:47 |
| morganfainberg | what do you want this branch called? | 19:48 |
| gordc | stable/juno? bknudson? | 19:48 |
| bknudson | stable/juno | 19:48 |
| morganfainberg | ah ok | 19:48 |
| bknudson | there's a stable/kilo branch already | 19:48 |
| *** _cjones_ has quit IRC | 19:49 | |
| *** iurygregory has quit IRC | 19:51 | |
| *** Bsony has quit IRC | 19:54 | |
| *** Ctina_ has joined #openstack-keystone | 19:55 | |
| openstackgerrit | David Stanek proposed openstack/keystone: pep8 whitespace changes https://review.openstack.org/177402 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes order of imports for pep8 https://review.openstack.org/177403 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Ignore multiple imports per line for six.moves https://review.openstack.org/177404 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Replaced filter with a list comprehension https://review.openstack.org/177405 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: eventlet now supports Python3 https://review.openstack.org/177406 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: pycadf now supports Python3 https://review.openstack.org/177407 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes mocking of oslo messaging for Python3 https://review.openstack.org/177408 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Updates the *py3 requirements files https://review.openstack.org/177409 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes use of dict methods for Python3 https://review.openstack.org/177410 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Handles Python3 builtin changes https://review.openstack.org/177411 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Handles modules that moved in Python3 https://review.openstack.org/177412 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes a whitespace issue https://review.openstack.org/177413 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Add mocking for ldappool for Python3 tests https://review.openstack.org/177414 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes deprecations test for Python3 https://review.openstack.org/177415 | 19:56 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactor deprecations tests https://review.openstack.org/177416 | 19:57 |
| openstackgerrit | David Stanek proposed openstack/keystone: Add mocking for memcache for Python3 tests https://review.openstack.org/177417 | 19:57 |
| openstackgerrit | David Stanek proposed openstack/keystone: basestring no longer exists in Python3 https://review.openstack.org/177418 | 19:57 |
| * stevemar stabs dstanek | 19:57 | |
| * dstanek deflect the stab with a banana and used a roll of duct tape to subdue his attackers | 19:57 | |
| raildo | haha | 19:58 |
| dstanek | stevemar: on the plus side most of those should be easy reviews | 19:58 |
| stevemar | bananas! my only weakness | 19:58 |
| *** Ctina has quit IRC | 19:58 | |
| stevemar | i'm wondering about https://github.com/openstack/keystone/blob/master/etc/policy.json#L67 | 19:59 |
| *** Ctina_ has quit IRC | 19:59 | |
| stevemar | whats up with "target.credential.user_id"... the v2 ec2 specific controller doesn't use 'credential' | 19:59 |
| bknudson | policy on v2? | 20:00 |
| stevemar | ah wait it does | 20:00 |
| stevemar | https://github.com/openstack/keystone/blob/862cbb427a4b4d3fb6969541521b67c92a823a69/keystone/contrib/ec2/controllers.py#L191-L203 | 20:00 |
| stevemar | using 'target' in the rule is tripping me up | 20:02 |
| panbalag | morganfainberg, I switched back to http and deleted the old endpoint using "keystone endpoint-delete"..then created a new endpoint with https. But creating a new endpoint gave an error..so to create I exported "OS_SERVICE_ENDPOINT=" and then the new https endpoint for keystone was created..But now when I look at "keystone --debug endpoint-list", I can see https, but this time the token is wrong..so the final output is "The r | 20:03 |
| morganfainberg | panbalag: give me a few minutes (or we can see if osmeone lese can help here) and i'll try and duplicate | 20:04 |
| morganfainberg | panbalag: but my laptop is running low on battery | 20:04 |
| panbalag | morganfainberg, sure no problem. please take your time. | 20:04 |
| morganfainberg | panbalag: so it might be a good bit later | 20:04 |
| panbalag | morganfainberg, ok | 20:05 |
| dstanek | panbalag: what is the error you are getting? | 20:05 |
| panbalag | dstanek, "The resource could not be found. (HTTP 404)""..that is because the token is wrong.. | 20:06 |
| panbalag | dstanek, not sure why the token got changed | 20:06 |
| dstanek | panbalag: can you auth and get a new token? | 20:06 |
| panbalag | dstanek, what is the command to get a new token? | 20:07 |
| *** ericksonsantos has quit IRC | 20:08 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Allow wsgiref to reconstruct URIs per the WSGI spec https://review.openstack.org/177427 | 20:08 |
| *** _cjones_ has joined #openstack-keystone | 20:09 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Add spec for 'stable driver abis' https://review.openstack.org/177428 | 20:10 |
| morganfainberg | gyee, bknudson, dstanek, ^ | 20:10 |
| morganfainberg | stable driver ABIs | 20:10 |
| dolphm | Application Blocking Interfaces? | 20:10 |
| morganfainberg | dstanek, Application Binary Interface | 20:11 |
| morganfainberg | dolphm, ^ | 20:11 |
| bknudson | this really affect gyee or anyone else who wants to write their own drivers... this isn't something I want to do. | 20:11 |
| morganfainberg | dolphm, since the communication to the driver is in-python and/or another protocol vs say HTTP rest interface | 20:11 |
| morganfainberg | bknudson, input on this is what i'm looking for | 20:12 |
| morganfainberg | bknudson, more than anything - including dissent on the whole idea | 20:12 |
| dolphm | panbalag: keystone token-get ... or openstack token <something> (?) | 20:12 |
| morganfainberg | hence proposal to the backlog vs. liberty | 20:12 |
| bknudson | I think it's good practice to essentially treat every subsystem as an API anyways. | 20:12 |
| morganfainberg | bknudson, i would agree. | 20:12 |
| morganfainberg | bknudson: since we discussed it, i am puttng it up for review | 20:13 |
| bknudson | do http URLs allow unicode? | 20:15 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Add spec for 'stable driver abis' https://review.openstack.org/177428 | 20:15 |
| morganfainberg | bknudson, uhmm... | 20:15 |
| bknudson | I didn't think that was allowed. | 20:15 |
| morganfainberg | bknudson, i think that gets url-encoded | 20:15 |
| morganfainberg | bknudson, what spawned that question? | 20:16 |
| bknudson | https://bugs.launchpad.net/bugs/1448286 | 20:17 |
| openstack | Launchpad bug 1448286 in Keystone "unicode query string raises UnicodeEncodeError" [Medium,In progress] - Assigned to Dolph Mathews (dolph) | 20:17 |
| morganfainberg | oh huh | 20:17 |
| *** rm_work is now known as rm_work|away | 20:17 | |
| *** Bsony has joined #openstack-keystone | 20:17 | |
| bknudson | obviously keystone shouldn't 500 given a URL | 20:18 |
| morganfainberg | bknudson, it would need to be URL encoded. | 20:18 |
| dolphm | bknudson: it's allowed as of not too long ago, relatively speaking. think filtering lists for unicode values in keystone for that bug | 20:18 |
| morganfainberg | dolphm, if someone passes non-encoded utf-8 it likely would break in apache layer | 20:19 |
| *** rm_work|away is now known as rm_work | 20:19 | |
| morganfainberg | dolphm, but we should do a url-decode on these params | 20:19 |
| bknudson | it's scary that the error is coming out of python lib -- python2.7/urllib | 20:20 |
| morganfainberg | dolphm, but afaict filtering should be urlencoded when hitting the http layer | 20:20 |
| bknudson | we could monkey-patch urllib. | 20:20 |
| dstanek | i'm pretty sure unicode needs to be % encoded | 20:20 |
| morganfainberg | that error we can make better | 20:20 |
| morganfainberg | but it should be a 400 series | 20:20 |
| morganfainberg | not a 500 | 20:20 |
| morganfainberg | it is, in-fact, a bad request | 20:21 |
| dolphm | maybe curl is encoding them but hiding that fact, not sure | 20:22 |
| dolphm | with -v it still renders unicode | 20:22 |
| dolphm | > GET /?Ϡ HTTP/1.1 | 20:23 |
| morganfainberg | dolphm, use telnet | 20:23 |
| *** Bsony has quit IRC | 20:23 | |
| morganfainberg | dolphm, i don't trust curl in this case - it does magic sometimes | 20:23 |
| dstanek | that's super funny - it dies logging the querystring | 20:23 |
| gyee | morganfainberg, ++ for ABI | 20:23 |
| gyee | that'll make it easier for people to contribute the drivers out of tree as well | 20:24 |
| *** jdennis has joined #openstack-keystone | 20:24 | |
| bknudson | gordc: https://review.openstack.org/#/q/status:open+project:openstack/pycadf+branch:stable/juno,n,z ? | 20:24 |
| morganfainberg | gyee, so comment on the spec :) | 20:24 |
| gyee | yes, reviewing | 20:24 |
| gordc | bknudson: is there another item to approve? | 20:24 |
| panbalag | dstanek, dolphm, morganfainberg.. figured out the issue.. I made a typo in the port in the adminURL while creating a new endpoint... after creating a new endpoint, https works fine... | 20:24 |
| dstanek | google doesn't like the unicode - http://paste.openstack.org/show/205795/ | 20:25 |
| morganfainberg | panbalag: aha ouch | 20:25 |
| bknudson | gordc: did you want me to post the review to move the requirement? | 20:25 |
| dolphm | morganfainberg: telnet works fine | 20:25 |
| morganfainberg | dolphm, no wsgi errors? | 20:25 |
| gordc | oh! that's what you meant. sure. | 20:25 |
| dolphm | morganfainberg: not after my patch | 20:25 |
| gordc | or if you don't have pycadf loaded i can do it | 20:25 |
| morganfainberg | dolphm: without? | 20:25 |
| bknudson | gordc: I don't have pycadf, so go ahead. | 20:25 |
| panbalag | morganfainberg, dolphm, dstanek..Thanks for the help. | 20:25 |
| morganfainberg | dolphm: because again, this should be a 400 if it's not urlencoded | 20:25 |
| bknudson | gordc: I don't need to pad my stats. | 20:25 |
| gordc | bknudson: lol kk | 20:26 |
| dolphm | morganfainberg: crashes with unicodedecodeerror... on logging | 20:26 |
| morganfainberg | dolphm: the ietf says afaict it should be urlencoded. | 20:26 |
| bknudson | although if I have a commit in pycadf then I can run for PTL... | 20:26 |
| morganfainberg | dolphm: hm.. wonder if apache is doing $magic$ for us too | 20:26 |
| morganfainberg | this all looks suspect | 20:26 |
| dolphm | morganfainberg: either way, a logging call shouldn't have anything to do with returning a 400 | 20:26 |
| gordc | bknudson: it's a highly contested seat | 20:26 |
| *** Bsony has joined #openstack-keystone | 20:27 | |
| morganfainberg | dolphm: true | 20:27 |
| dolphm | GET /v3/projects/Ϡ HTTP/1.1 returns... | 20:27 |
| dolphm | {"error": {"message": "Could not find project: \u03e0", "code": 404, "title": "Not Found"}} | 20:27 |
| dstanek | morganfainberg: i took the same request i made against google and did it against apache.org (which ignored it and gave me a page) | 20:28 |
| bknudson | GET /v3/users/(ﾉಠ益ಠ）ﾉ ┻━┻ | 20:28 |
| dolphm | (i.e. it's handling the path correctly, but not the query string) | 20:28 |
| openstackgerrit | Merged openstack/keystone: Correct request logging query parameters separator https://review.openstack.org/166002 | 20:28 |
| morganfainberg | bknudson: Best test ever | 20:28 |
| dolphm | bknudson: that returns a 400 because you have spaces in the path :P | 20:29 |
| bknudson | oh, I meant to flip the table straight up, not forward. | 20:29 |
| gordc | bknudson: you have a bug i can attach to? | 20:31 |
| bknudson | gordc: no, I didn't open any bugs. | 20:31 |
| gordc | bknudson: kk | 20:31 |
| *** Bsony has quit IRC | 20:32 | |
| bknudson | Switched to a new branch '(ﾉಠ益ಠ）ﾉ┻━┻' | 20:33 |
| stevemar | bknudson, you always pad your stats | 20:34 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient-saml2: Remove unused private classes on tests https://review.openstack.org/171263 | 20:34 |
| *** lhcheng has quit IRC | 20:35 | |
| stevemar | gordc, bknudson we should ask the TC to make pycadf it's own project | 20:35 |
| morganfainberg | stevemar, it really is | 20:37 |
| morganfainberg | stevemar, already | 20:37 |
| morganfainberg | the only difference is that i'm the "PTL" | 20:37 |
| morganfainberg | but it has a core team that is separate from everything else | 20:37 |
| morganfainberg | etc | 20:37 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient-saml2: Update "federation" to "saml2" in README https://review.openstack.org/177442 | 20:37 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: client_socket_timeout has a default value https://review.openstack.org/177443 | 20:37 |
| stevemar | morganfainberg, exactly, we're tired of living under your tyrannical rule | 20:37 |
| morganfainberg | stevemar, lol | 20:38 |
| gyee | what does the TC do anyway? | 20:39 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove randomness from test_client_socket_timeout https://review.openstack.org/177444 | 20:41 |
| bknudson | they eat fancy lunches. | 20:41 |
| gyee | hah | 20:41 |
| bknudson | I assume there's a TC party that's even fancier than the core pary. | 20:41 |
| bknudson | party | 20:41 |
| gyee | you may be right | 20:42 |
| dolphm | bknudson: probably just a dinner | 20:43 |
| *** ashishjain has quit IRC | 20:44 | |
| *** ashishjain has joined #openstack-keystone | 20:44 | |
| *** ashishjain has left #openstack-keystone | 20:45 | |
| openstackgerrit | Merged openstack/keystone: Correct path in request logging https://review.openstack.org/166012 | 20:45 |
| *** mattfarina has quit IRC | 20:45 | |
| bknudson | gordc: you want me to just post the change? | 20:46 |
| *** rm_work is now known as rm_work|away | 20:47 | |
| *** rm_work|away is now known as rm_work | 20:47 | |
| bknudson | gordc: too late, here it is: https://review.openstack.org/#/c/177446/ | 20:48 |
| * bknudson pads stats | 20:48 | |
| gordc | bknudson: ... how the hell. i kept getting stupid rebase madness... oh well good enough | 20:49 |
| *** pnavarro has joined #openstack-keystone | 20:49 | |
| gordc | bknudson: want to connect it to this: https://bugs.launchpad.net/pycadf/+bug/1448297 | 20:49 |
| openstack | Launchpad bug 1448297 in pycadf "oslo.messaging should be a optional req" [Medium,Triaged] - Assigned to gordon chung (chungg) | 20:49 |
| bknudson | gordc: updated commit message: https://review.openstack.org/#/c/177446/ | 20:51 |
| *** rushil_ has quit IRC | 20:51 | |
| gordc | cool cool. | 20:51 |
| gordc | hmm. i think this is going to fail req check | 20:52 |
| bknudson | gordc: different g-r in stable? | 20:53 |
| bknudson | maybe we need proposal bot to update the new branch reqs. | 20:53 |
| gordc | bknudson: yeah... i guess we'll wait for that. or maybe this will pass with no issues. | 20:54 |
| bknudson | I don't think it's going to happen automatically. | 20:55 |
| *** lhcheng has joined #openstack-keystone | 20:55 | |
| *** ChanServ sets mode: +v lhcheng | 20:55 | |
| gordc | bknudson: it should (at least it did for clients) | 20:55 |
| bknudson | gordc: according to http://status.openstack.org/zuul/ it passed -requirements. | 20:55 |
| bknudson | https://jenkins05.openstack.org/job/gate-pycadf-requirements/26/ | 20:56 |
| *** rm_work is now known as rm_work|away | 20:57 | |
| *** dguerri is now known as _dguerri | 20:57 | |
| gordc | bknudson: :( py34 test failed | 20:58 |
| bknudson | gordc: can't blame me for that. | 20:59 |
| *** csoukup has quit IRC | 20:59 | |
| * gordc looks around for someone else. | 20:59 | |
| bknudson | disable the test? | 20:59 |
| bknudson | we can just disable it for that branch | 21:00 |
| gordc | bknudson: yeah... i guess that's a quick fix. | 21:01 |
| gordc | i can't remember fixing py3 stuff personally | 21:01 |
| *** htruta has quit IRC | 21:01 | |
| *** gyee has quit IRC | 21:02 | |
| *** gyee has joined #openstack-keystone | 21:02 | |
| *** ChanServ sets mode: +v gyee | 21:02 | |
| bknudson | gordc: did it the old fashioned way. https://review.openstack.org/#/c/177452/ | 21:03 |
| *** ayoung has joined #openstack-keystone | 21:04 | |
| *** ChanServ sets mode: +v ayoung | 21:04 | |
| bknudson | gordc: do you want the reqs update in 0.6.1 ? I think we do. | 21:04 |
| bknudson | I guess none of these is going to pass without the py3 fix. | 21:04 |
| gordc | bknudson: cool cool. this grew in scope. :( i'll keep an eye on it. will check with doug on that before release | 21:04 |
| *** raildo has quit IRC | 21:05 | |
| bknudson | gordc: are you making the py3 fix or did you want to skip the test? | 21:05 |
| gordc | bknudson: skipping might be better. | 21:06 |
| bknudson | gordc: ok, I'll propose the change to -infra. | 21:06 |
| gordc | bknudson: seems like the py3 stuff came with oslo-incubator to oslo lib switch | 21:06 |
| bknudson | looks like the error is https://jenkins07.openstack.org/job/gate-pycadf-python34/12/console | 21:07 |
| bknudson | No module named mox3 | 21:07 |
| bknudson | so maybe it's just missing mox3 from test-requirements.txt? | 21:08 |
| gordc | possibly? we can add it in if you'd like | 21:08 |
| bknudson | actually, it looks like that error is coming from six.py... so maybe something with the level of six? | 21:08 |
| bknudson | Let me just post a change to add it and see. | 21:08 |
| gordc | kk. i'll probably only have time sunday night to confirm everything. | 21:09 |
| bknudson | gordc: https://review.openstack.org/#/c/177456/ -- adds mox3 | 21:10 |
| bknudson | all of these reqs changes are going to conflict, so they'll have to be rebased. | 21:11 |
| gordc | right. i'll track the mox3 one for now. | 21:11 |
| * gordc is not sure oslo.messaging stable/juno was py3 compatible | 21:12 | |
| bknudson | if that doesn't pass then I'll propose the infra change to disable py33 for stable/juno branch | 21:13 |
| * bknudson really padding my stats now. | 21:14 | |
| *** e0ne has joined #openstack-keystone | 21:27 | |
| *** e0ne has quit IRC | 21:29 | |
| *** e0ne has joined #openstack-keystone | 21:33 | |
| dstanek | bknudson: why use mox at all? | 21:33 |
| sigmavirus24 | I thought mox was deprecated in favor of mock in openstack | 21:34 |
| dstanek | sigmavirus24: it is | 21:34 |
| bknudson | dstanek: on pycadf stable/juno? wasn't my choice | 21:34 |
| bknudson | although it might still be in pycadf master | 21:34 |
| openstackgerrit | Merged openstack/keystone: Tests use Database fixture https://review.openstack.org/164340 | 21:34 |
| dstanek | bknudson: ah, stable branch - i didn't realize that pycadf in juno supported py3 | 21:35 |
| bknudson | it's in the tox.ini... although maybe it was never run | 21:35 |
| bknudson | I should be able to find a review and see if py3 test were run. | 21:36 |
| openstackgerrit | Merged openstack/keystone: Eventlet green threads not released back to pool https://review.openstack.org/130824 | 21:36 |
| openstackgerrit | Merged openstack/keystone: Add fernet to test_supported_token_providers https://review.openstack.org/167069 | 21:36 |
| *** gordc has quit IRC | 21:44 | |
| bknudson | looks like py33 wasn't run on pycadf 0.6, so should probably disable it rather than try to get it to work: | 21:49 |
| bknudson | https://review.openstack.org/#/c/124878/ | 21:49 |
| *** bknudson has quit IRC | 21:49 | |
| ayoung | morganfainberg, just got a Federated unscoped token using Ipsilon, Kerberos, and SAML. I think we are going to have to somehow make Kerberos not an auth plugin, or make auth plugins stackable. But it works. | 21:51 |
| *** stevemar has quit IRC | 21:53 | |
| *** e0ne has quit IRC | 22:00 | |
| *** pnavarro has quit IRC | 22:05 | |
| *** lhcheng has quit IRC | 22:09 | |
| *** _dguerri is now known as dguerri | 22:12 | |
| *** r-daneel has quit IRC | 22:15 | |
| ayoung | dstanek, do you know how to get debugging info out of a client app? | 22:15 |
| ayoung | morganfainberg, dstanek, I have a really simple app that just fetches an unscoped fed token, and I want to see what url it is sending to. basically, I want it to dump its guts on the command line | 22:16 |
| *** jdennis has quit IRC | 22:21 | |
| *** dguerri is now known as _dguerri | 22:22 | |
| *** jdennis has joined #openstack-keystone | 22:25 | |
| *** lhcheng has joined #openstack-keystone | 22:33 | |
| *** ChanServ sets mode: +v lhcheng | 22:33 | |
| *** ayoung is now known as ayoung-noms | 22:40 | |
| *** harlowja_ has joined #openstack-keystone | 22:41 | |
| *** harlowja has quit IRC | 22:41 | |
| *** bandwidth has quit IRC | 22:42 | |
| *** lhcheng has quit IRC | 22:46 | |
| *** lhcheng has joined #openstack-keystone | 22:48 | |
| *** ChanServ sets mode: +v lhcheng | 22:48 | |
| *** lhcheng_ has joined #openstack-keystone | 22:50 | |
| *** lhcheng has quit IRC | 22:53 | |
| lhcheng_ | samueldmq: on your v3 testing, are you consuming the v3 policy file? | 23:04 |
| *** lhcheng_ is now known as lhcheng | 23:04 | |
| *** ChanServ sets mode: +v lhcheng | 23:04 | |
| *** alexsyip has quit IRC | 23:11 | |
| *** topol has quit IRC | 23:25 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:25 | |
| *** samleon has quit IRC | 23:42 | |
| *** jdennis has quit IRC | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!