| morganfainberg | Yeah. | 00:00 |
|---|---|---|
| *** ncoghlan has joined #openstack-keystone | 00:09 | |
| jamielennox | morganfainberg: are you ok to handle however you want to do the keystoneauth -> keystoneauth1 transition | 00:15 |
| morganfainberg | jamielennox: I think I know how we will do it. Should be easy enough. Will post this week. | 00:17 |
| *** emagana has joined #openstack-keystone | 00:30 | |
| *** emagana has quit IRC | 00:36 | |
| *** dimsum__ has quit IRC | 00:37 | |
| *** dims has joined #openstack-keystone | 00:44 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs https://review.openstack.org/187027 | 01:13 |
| *** markvoelker has quit IRC | 01:18 | |
| *** emagana has joined #openstack-keystone | 01:25 | |
| *** tobe has joined #openstack-keystone | 01:30 | |
| *** emagana has quit IRC | 01:30 | |
| openstackgerrit | liusheng proposed openstack/keystone: Remove the useless config_files parameter of service entry https://review.openstack.org/186987 | 01:32 |
| *** dylan has joined #openstack-keystone | 01:34 | |
| *** dims has quit IRC | 01:37 | |
| *** dims has joined #openstack-keystone | 01:38 | |
| *** woodster_ has quit IRC | 01:40 | |
| *** dims has quit IRC | 01:43 | |
| jamielennox | 10 make devstack change | 01:54 |
| jamielennox | 20 wait 20 minutes | 01:54 |
| jamielennox | 30 goto 10 | 01:54 |
| jamielennox | ... | 01:54 |
| *** samueldmq has joined #openstack-keystone | 02:08 | |
| *** emagana has joined #openstack-keystone | 02:19 | |
| *** emagana has quit IRC | 02:23 | |
| *** HT_sergio has joined #openstack-keystone | 02:28 | |
| *** markvoelker has joined #openstack-keystone | 02:34 | |
| *** woodster_ has joined #openstack-keystone | 02:37 | |
| *** HT_sergio has quit IRC | 02:37 | |
| *** markvoelker has quit IRC | 02:39 | |
| *** davechen_ has joined #openstack-keystone | 02:42 | |
| *** davechen__ has joined #openstack-keystone | 02:42 | |
| *** emagana has joined #openstack-keystone | 03:13 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add EC2 CRUD credential support to v3 API https://review.openstack.org/187094 | 03:15 |
| *** emagana has quit IRC | 03:17 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add EC2 CRUD credential support to v3 API https://review.openstack.org/187094 | 03:18 |
| *** samueldmq has quit IRC | 03:41 | |
| *** outsdset has quit IRC | 03:47 | |
| jamielennox | morganfainberg: i create a 1.6 release for ksc on launchpad and targetted ^ to it with high priority | 03:59 |
| jamielennox | i need it, then expose via OSC to do devstack with v3 | 03:59 |
| jamielennox | so everyone please review | 04:00 |
| *** emagana has joined #openstack-keystone | 04:07 | |
| *** emagana has quit IRC | 04:11 | |
| *** markvoelker has joined #openstack-keystone | 04:23 | |
| morganfainberg | Ah ok. | 04:26 |
| morganfainberg | Yeah. | 04:26 |
| *** markvoelker has quit IRC | 04:28 | |
| *** woodster_ has quit IRC | 04:40 | |
| *** davechen_ has joined #openstack-keystone | 04:48 | |
| *** rushiagr_away is now known as rushiagr | 04:52 | |
| openstackgerrit | Morgan Fainberg proposed openstack/python-keystoneclient: Add EC2 CRUD credential support to v3 API https://review.openstack.org/187094 | 04:53 |
| *** gokrokve has joined #openstack-keystone | 04:57 | |
| *** tobe has quit IRC | 05:01 | |
| *** emagana has joined #openstack-keystone | 05:01 | |
| *** emagana has quit IRC | 05:06 | |
| *** tobe has joined #openstack-keystone | 05:07 | |
| *** liusheng has quit IRC | 05:21 | |
| *** liusheng has joined #openstack-keystone | 05:22 | |
| *** tobe has quit IRC | 05:44 | |
| *** mabrams has joined #openstack-keystone | 05:44 | |
| *** kiran-r has joined #openstack-keystone | 05:45 | |
| *** emagana has joined #openstack-keystone | 05:55 | |
| *** emagana has quit IRC | 06:00 | |
| *** tobe has joined #openstack-keystone | 06:03 | |
| marekd | jamielennox: Hi. SO, to rename ksc-saml2 -> ksa-saml2 i basically need to recreate patches like you had done for the last project rename and that should be pretty much it? | 06:05 |
| *** yasu_ has joined #openstack-keystone | 06:07 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/186279 | 06:08 |
| *** markvoelker has joined #openstack-keystone | 06:12 | |
| jamielennox | marekd: yea, more or less | 06:12 |
| jamielennox | marekd: there hasn't been much change since then either so it will be very similar i think | 06:13 |
| marekd | jamielennox: just rename, and dep on ksa instead of ksc. | 06:13 |
| jamielennox | there is somewhat of an order to it though, you have to do governance first, and the project-config has to Depend-On: the governance one | 06:13 |
| jamielennox | i think it has a special topic name in gerrit too because it's a manual process | 06:14 |
| marekd | jamielennox: i saw openstack/governance patch - is there any docs i could read about it more? I can blindly recreate the patch but it will be dumb copy/pasa patch. | 06:14 |
| jamielennox | umm | 06:15 |
| jamielennox | i don't know and googling doesn't show anything | 06:15 |
| jamielennox | you can ask in -infra i know i did last time | 06:16 |
| marekd | jamielennox: never mind | 06:16 |
| marekd | jamielennox: ok | 06:16 |
| *** markvoelker has quit IRC | 06:16 | |
| *** gokrokve_ has joined #openstack-keystone | 06:49 | |
| *** emagana has joined #openstack-keystone | 06:50 | |
| *** gokrokve has quit IRC | 06:52 | |
| *** gokrokve_ has quit IRC | 06:54 | |
| *** emagana has quit IRC | 06:54 | |
| *** henrynash has joined #openstack-keystone | 07:08 | |
| *** ChanServ sets mode: +v henrynash | 07:08 | |
| *** afazekas has joined #openstack-keystone | 07:12 | |
| *** lufix has joined #openstack-keystone | 07:13 | |
| *** ncoghlan has quit IRC | 07:18 | |
| *** jith_ has joined #openstack-keystone | 07:19 | |
| *** gokrokve has joined #openstack-keystone | 07:20 | |
| *** gokrokve has quit IRC | 07:21 | |
| *** gokrokve has joined #openstack-keystone | 07:21 | |
| breton | morning | 07:22 |
| evrardjp | hello everyone | 07:27 |
| *** Ephur has quit IRC | 07:30 | |
| *** dguerri`away is now known as dguerri | 07:30 | |
| jamielennox | o/ | 07:33 |
| *** tobe has quit IRC | 07:37 | |
| *** jistr has joined #openstack-keystone | 07:39 | |
| *** tobe has joined #openstack-keystone | 07:39 | |
| *** dylan has quit IRC | 07:43 | |
| *** lhcheng has quit IRC | 07:44 | |
| *** emagana has joined #openstack-keystone | 07:44 | |
| *** chlong has quit IRC | 07:45 | |
| *** henrynash has quit IRC | 07:46 | |
| *** fhubik has joined #openstack-keystone | 07:48 | |
| *** emagana has quit IRC | 07:49 | |
| *** fhubik is now known as fhubik_afk | 07:54 | |
| *** fhubik_afk is now known as fhubik | 07:54 | |
| *** fhubik is now known as fhubik_afk | 07:54 | |
| *** markvoelker has joined #openstack-keystone | 08:01 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: default policy https://review.openstack.org/140113 | 08:05 |
| *** markvoelker has quit IRC | 08:06 | |
| *** marzif_ has joined #openstack-keystone | 08:21 | |
| *** tobe has quit IRC | 08:22 | |
| *** tobe has joined #openstack-keystone | 08:23 | |
| *** krykowski has joined #openstack-keystone | 08:23 | |
| *** ajayaa has joined #openstack-keystone | 08:32 | |
| *** emagana has joined #openstack-keystone | 08:38 | |
| *** emagana has quit IRC | 08:43 | |
| ajayaa | Hi guys. Does Cinder work with Keystone v3 api in Icehouse? | 08:44 |
| ajayaa | jaimelennox ^^ | 08:45 |
| ajayaa | In my test environment it is using v2.0 api of Keystone and when it tries to verify a v3 token with v2.0 api, Keystone gives a 401. | 08:45 |
| ajayaa | jamielennox ^^ | 08:45 |
| *** yogeshwars1 has joined #openstack-keystone | 08:46 | |
| ajayaa | operator99 ^^ | 08:46 |
| *** afazekas_ has joined #openstack-keystone | 08:55 | |
| *** afazekas has quit IRC | 08:59 | |
| *** e0ne has joined #openstack-keystone | 09:02 | |
| *** afazekas_ has quit IRC | 09:17 | |
| *** emagana has joined #openstack-keystone | 09:32 | |
| *** emagana has quit IRC | 09:37 | |
| *** aix has joined #openstack-keystone | 09:43 | |
| *** afazekas has joined #openstack-keystone | 09:45 | |
| *** e0ne is now known as e0ne_ | 09:48 | |
| *** markvoelker has joined #openstack-keystone | 09:49 | |
| *** e0ne_ is now known as e0ne | 09:50 | |
| *** markvoelker has quit IRC | 09:54 | |
| *** fhubik_afk is now known as fhubik | 09:55 | |
| *** dims has joined #openstack-keystone | 09:55 | |
| *** davidckennedy has joined #openstack-keystone | 10:08 | |
| *** bdossant has joined #openstack-keystone | 10:09 | |
| davidckennedy | Anyone got any time to approve https://review.openstack.org/#/c/167675/ | 10:10 |
| davidckennedy | and https://review.openstack.org/#/c/176383/ ? | 10:10 |
| *** fhubik is now known as fhubik_afk | 10:14 | |
| *** openstackstatus has quit IRC | 10:20 | |
| *** openstack has quit IRC | 10:20 | |
| *** openstack has joined #openstack-keystone | 10:25 | |
| *** openstackstatus has joined #openstack-keystone | 10:25 | |
| *** ChanServ sets mode: +v openstackstatus | 10:25 | |
| *** emagana has joined #openstack-keystone | 10:26 | |
| *** emagana has quit IRC | 10:31 | |
| *** kiran-r has joined #openstack-keystone | 10:33 | |
| *** kiran-r has quit IRC | 10:34 | |
| *** kiran-r has joined #openstack-keystone | 10:34 | |
| *** samueldmq has joined #openstack-keystone | 10:35 | |
| samueldmq | morning | 10:35 |
| *** bdossant has quit IRC | 10:40 | |
| *** bdossant has joined #openstack-keystone | 10:41 | |
| *** fhubik_lunch has joined #openstack-keystone | 10:41 | |
| *** mitz has quit IRC | 10:43 | |
| *** fhubik_afk has quit IRC | 10:43 | |
| *** Zanatoz has quit IRC | 10:43 | |
| *** mordred has quit IRC | 10:43 | |
| *** mitz has joined #openstack-keystone | 10:43 | |
| *** mordred has joined #openstack-keystone | 10:44 | |
| *** Zanatoz has joined #openstack-keystone | 10:44 | |
| *** yasu_ has quit IRC | 10:45 | |
| breton | samueldmq: morning | 11:03 |
| breton | https://review.openstack.org/#/c/171264/ -- it seems to me that no one ever used memcache_pool in keystonemiddleware. | 11:04 |
| samueldmq | breton, hi | 11:06 |
| samueldmq | breton, see https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_cache.py#L139-L147 | 11:06 |
| samueldmq | breton, and _get_cache_pool instantiates _MemcacheClientPool | 11:06 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Refactor Keystone wsgi/eventlet app https://review.openstack.org/159172 | 11:08 |
| ekarlso | what's the biggest change for keystone in L ? | 11:10 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Refactor Keystone wsgi/eventlet app https://review.openstack.org/159172 | 11:11 |
| samueldmq | ekarlso, hi | 11:12 |
| samueldmq | ekarlso, i) Dynamic Policies (affects more than Keystone) and ii) Reseller | 11:12 |
| samueldmq | ekarlso, I suppose you are talking about new features, right ? | 11:13 |
| *** fhubik_lunch is now known as fhubik_afk | 11:16 | |
| samueldmq | ekarlso, Reseller is great | 11:16 |
| *** emagana has joined #openstack-keystone | 11:20 | |
| *** e0ne has quit IRC | 11:21 | |
| *** woodster_ has joined #openstack-keystone | 11:24 | |
| *** emagana has quit IRC | 11:25 | |
| *** tobe has quit IRC | 11:25 | |
| *** mflobo has left #openstack-keystone | 11:26 | |
| *** mflobo has joined #openstack-keystone | 11:27 | |
| samueldmq | ekarlso, we will have only 5 API impacting priorities this cycle, see https://etherpad.openstack.org/p/keystone-liberty-summit-priorities | 11:27 |
| *** e0ne has joined #openstack-keystone | 11:30 | |
| *** topol has joined #openstack-keystone | 11:32 | |
| *** topol is now known as Guest26972 | 11:32 | |
| *** aix has quit IRC | 11:34 | |
| ekarlso | what you guys think of what termie said then that keystone should not be ? :D | 11:35 |
| *** markvoelker has joined #openstack-keystone | 11:35 | |
| marekd | ekarlso: he said glance should be deleted, not keystone | 11:35 |
| *** Guest26972 has quit IRC | 11:36 | |
| marekd | ekarlso: keystone no longer needs to hide in the corner, especially since it features federation, reseller and stuff :-) | 11:37 |
| *** fhubik_afk is now known as fhubik_lunch | 11:37 | |
| *** fhubik_lunch is now known as fhubik | 11:37 | |
| *** fhubik is now known as fhubik_afk | 11:37 | |
| ekarlso | markvoelker: :p | 11:39 |
| ekarlso | ehm, marekd :P | 11:39 |
| *** markvoelker has quit IRC | 11:40 | |
| breton | samueldmq: yes, but look at the review | 11:40 |
| breton | samueldmq: there is a bug that would cause an exception if used anywhere | 11:41 |
| *** aix has joined #openstack-keystone | 11:48 | |
| samueldmq | morganfainberg, I just updated Keystone Summit Etherpads page | 11:49 |
| samueldmq | morganfainberg, https://wiki.openstack.org/wiki/Design_Summit/Liberty/Etherpads#Keystone | 11:49 |
| samueldmq | morganfainberg, I am not sure we should keep the etherpad link for 'Keystone Contributors Meetup' (Friday) | 11:50 |
| samueldmq | morganfainberg, since the single information in there is : 'hi there!' :) | 11:50 |
| dstanek | samueldmq: ...but it shows that we are a fun and inviting group | 11:51 |
| *** fhubik_afk is now known as fhubik | 11:52 | |
| samueldmq | dstanek, haha yes ... I was thinking it shows we are so united that we forgot to put anything in the pad ... and just talked to ourselves in there | 11:53 |
| samueldmq | dstanek, and indeed, had fun :) | 11:53 |
| samueldmq | breton, if that pool works with the queue implementation you posted in your previous comment | 11:54 |
| samueldmq | breton, it should not raise any exception, but accept 'put()' without a restriction .. is that right ? | 11:56 |
| samueldmq | breton, well, that's weird | 11:56 |
| *** rushiagr is now known as rushiagr_away | 11:57 | |
| breton | samueldmq: it is much more weird with another parameter | 12:01 |
| breton | everything should crash if it is used like this | 12:01 |
| *** emagana has joined #openstack-keystone | 12:15 | |
| *** belmoreira has joined #openstack-keystone | 12:15 | |
| *** emagana has quit IRC | 12:19 | |
| *** topol has joined #openstack-keystone | 12:29 | |
| *** ChanServ sets mode: +v topol | 12:29 | |
| mflobo | question: is there any call to keystone to get the project list and the id of the owner y the same response? | 12:30 |
| dstanek | mflobo: when you say owner you mean those that will access to the project? | 12:33 |
| mflobo | yes | 12:33 |
| dstanek | i don't think there is a single call for all of that | 12:33 |
| mflobo | I would like to have, in the same json response, the information about the owner per project | 12:34 |
| *** markvoelker has joined #openstack-keystone | 12:34 | |
| rodrigods | dstanek, maybe list role assignments call? | 12:35 |
| *** fhubik is now known as fhubik_afk | 12:36 | |
| dstanek | rodrigods: i don't think that will have all the project data and won't include projects with no assignments | 12:36 |
| dstanek | mflobo: what is your usecase? | 12:36 |
| mflobo | dstanek, My use case: a list of projects, 3 colums, project_id | Project Name | Owner | 12:37 |
| *** yasu_ has joined #openstack-keystone | 12:38 | |
| dstanek | maybe get a list of projects and role assignments? what are you doing now? | 12:39 |
| breton | oh gawd | 12:40 |
| breton | samueldmq: that code doesn't work in Juno! | 12:40 |
| breton | since juno | 12:40 |
| *** kiran-r has quit IRC | 12:40 | |
| mflobo | dstanek, Now: projects.list() then, iterate the projects and get role_list_assignments.list(role_id='owner' project_id=project_id)[0] per project. Finally I return a list of (project info + owner) | 12:41 |
| mflobo | dstanek, That works nice with LDAP assignment backend, but with SQL assignment backend is veeery slow | 12:42 |
| mflobo | dstanek, that's the reason because I'm looking for some call faster than execute len(project_list) * role_assignment.list calls | 12:43 |
| *** fhubik_afk is now known as fhubik | 12:44 | |
| dstanek | do you have to specify the project to get the role assignments for? | 12:44 |
| mflobo | Ideally, I'd like a response like: | 12:44 |
| mflobo | [{ | 12:44 |
| mflobo | "project": { | 12:44 |
| mflobo | "description": "the description", | 12:44 |
| mflobo | "links": { | 12:44 |
| mflobo | "self": "https://localhost:5000/v3/projects/000000000000000000000000000000" | 12:44 |
| mflobo | }, | 12:44 |
| mflobo | "enabled": true, | 12:44 |
| mflobo | "id": "00000000000000000000000000000", | 12:44 |
| mflobo | "domain_id": "default", | 12:44 |
| mflobo | "name": "Project name", | 12:44 |
| mflobo | "owner": "the owner" | 12:44 |
| samueldmq | breton, oh really ? what is the side effect ? | 12:44 |
| dstanek | mflobo: use paste :-) | 12:45 |
| mflobo | dstanek, yes I do | 12:45 |
| dstanek | mflobo: i don't think we really have the concept of an owner | 12:45 |
| samueldmq | not ctrl+v paste, but paste.openstack.org instead :-) | 12:45 |
| samueldmq | dstanek, ++ | 12:45 |
| mflobo | samueldmq, sorry | 12:46 |
| samueldmq | mflobo, no worries, I am just making sure I let you know you could use paste.o.o :) | 12:46 |
| breton | samueldmq: well, if memcache_pool is used as the cache backend, ksm doesn't work at all. | 12:47 |
| mflobo | dstanek, ok, thanks for your answers ;) | 12:48 |
| mflobo | dstanek, I'll try it in other way... | 12:48 |
| *** chlong has joined #openstack-keystone | 12:49 | |
| dstanek | mflobo: if you can't just get all role assignments you can get the list of roles and iterate over that to get the assignments for those roles. | 12:49 |
| mflobo | dstanek, mmm, interesting, I'll try that way. Thanks sagain | 12:50 |
| samueldmq | breton, wow, thanks for testing that then | 12:50 |
| dstanek | mflobo: not idea, but should be much less calls | 12:50 |
| mflobo | dstanek, sure | 12:51 |
| dstanek | mflobo: are you using the REST API to get this data? | 12:51 |
| mflobo | yes | 12:51 |
| samueldmq | morganfainberg, breton ^ ksmiddleware + memcache_pool = doesn't work at all | 12:54 |
| samueldmq | morganfainberg, breton we should consider backporting 'Correct memcached parameters in TokenCache' (https://review.openstack.org/#/c/171264/) | 12:55 |
| samueldmq | breton, thanks for having the time to test that yourself :) | 12:55 |
| morganfainberg | samueldmq: this is because python-memcache is a trainwreck. | 12:55 |
| morganfainberg | samueldmq: in my opinion | 12:55 |
| morganfainberg | and we're having to monkeypatch it basically to "work" | 12:55 |
| samueldmq | morganfainberg, what are the alternatives ? | 12:55 |
| morganfainberg | samueldmq: pymemcache | 12:56 |
| morganfainberg | much much better | 12:56 |
| morganfainberg | but it's not a simple drop-in API | 12:56 |
| morganfainberg | just like ldap3 doesn't have a compat layer (yet?) - so it's a bit of work | 12:56 |
| samueldmq | morganfainberg, who is looking at that ? did any other project already migrate ? | 12:57 |
| *** fhubik is now known as fhubik_afk | 12:57 | |
| morganfainberg | samueldmq: it is in global reqs iirc | 12:58 |
| morganfainberg | so, it's just writing the code to move over... | 12:58 |
| morganfainberg | and making sure it works >.< | 12:58 |
| breton | morganfainberg: what's better in pymemcache? | 12:58 |
| morganfainberg | breton: the whole architecture | 12:58 |
| morganfainberg | ground up | 12:58 |
| morganfainberg | also, not explicitly requiring a thread.local to function | 12:59 |
| morganfainberg | which is why we have the hacky-ness in memcachepool | 12:59 |
| morganfainberg | changing to pymemcache is not backportable though | 12:59 |
| breton | well, everything doesn't work not because of that | 12:59 |
| morganfainberg | and it will break again | 12:59 |
| morganfainberg | and again | 12:59 |
| morganfainberg | and again | 12:59 |
| morganfainberg | it's really awful | 13:00 |
| breton | maybe we should drop it in ksm | 13:00 |
| morganfainberg | i think we've had 3 breaks in memcachepool now. | 13:00 |
| samueldmq | morganfainberg, I am not sure I have enough time to go in that direction (implement) .. but I can take a look to at very least get more familiar and review code when someone is up to do that :) | 13:00 |
| morganfainberg | because python-memcache changes. | 13:00 |
| morganfainberg | samueldmq: nah, we should just backport the fix. | 13:00 |
| morganfainberg | and/or i need to release ksm | 13:00 |
| breton | morganfainberg: I've put an item to tomorrow meeting's agenda about dropping memcache_pool in ksm | 13:00 |
| morganfainberg | breton: we can't backport a drop of memcachepool. | 13:01 |
| morganfainberg | fwiw | 13:01 |
| samueldmq | morganfainberg, k | 13:01 |
| morganfainberg | we should ditch memcachepool all together. | 13:01 |
| *** bknudson has quit IRC | 13:01 | |
| morganfainberg | not just in ksm | 13:01 |
| samueldmq | morganfainberg, we can't backport a drop of anything, right ? | 13:01 |
| morganfainberg | samueldmq: correct | 13:01 |
| breton | the problem is that it is completely untested | 13:03 |
| *** ajayaa has quit IRC | 13:04 | |
| morganfainberg | breton: and it will remain untested until we have functional testing scenarios up | 13:04 |
| breton | and I mean completely. Insert "assert False" anywhere in memcache_pool, run ksm tests and they will all pass | 13:04 |
| morganfainberg | you can't really unit test memcachepool | 13:04 |
| breton | morganfainberg: functional tests at least could catch https://review.openstack.org/#/c/171264/1/keystonemiddleware/auth_token/_cache.py | 13:05 |
| breton | *unit tests | 13:05 |
| *** topol has quit IRC | 13:05 | |
| morganfainberg | breton: the issue is it is almost not unit testable | 13:06 |
| morganfainberg | it's going to be mocking everything | 13:06 |
| morganfainberg | so sure we can test small bits, but it really isn't going to keep it sane/working | 13:06 |
| morganfainberg | i'd rather drop memcache pool completly | 13:06 |
| morganfainberg | tbh | 13:06 |
| breton | I wonder if we need memcache_pool after we dropped eventlet | 13:07 |
| morganfainberg | :( | 13:07 |
| morganfainberg | breton: we wont | 13:07 |
| *** toddnni has quit IRC | 13:07 | |
| morganfainberg | breton: it *might* buy a minor performance increase. | 13:07 |
| *** fhubik_afk is now known as fhubik | 13:07 | |
| *** dsirrine has joined #openstack-keystone | 13:07 | |
| morganfainberg | in KSM, it is more important | 13:07 |
| morganfainberg | since KSM runs in eventlet based things | 13:07 |
| breton | in ksm everybody uses in-process caching | 13:07 |
| morganfainberg | but KSM could easily move to pymemcache | 13:07 |
| breton | that bug is there since juno | 13:07 |
| morganfainberg | no, lots of people us ememcache | 13:07 |
| morganfainberg | but i think no one uses memcachepool | 13:08 |
| breton | we can have memcache and not memcachepool in ksm? | 13:08 |
| breton | how? | 13:08 |
| morganfainberg | the DOS that can occur is likely attributed to other bad performance in ksm | 13:08 |
| morganfainberg | the whole reason for memcachepool | 13:08 |
| morganfainberg | was to mitigate the DOS-like event for socket/FD limits | 13:09 |
| *** emagana has joined #openstack-keystone | 13:09 | |
| breton | oh, _CachePool | 13:09 |
| breton | ksm uses keystonemiddleware.openstack.common.memorycache anyway. Maybe we could switch to pymemcache there. | 13:10 |
| morganfainberg | breton: i'd like to drop memorycache | 13:10 |
| morganfainberg | it is bad | 13:10 |
| morganfainberg | it also has awful performance implications due to scanning the whole dict when not using memcache | 13:11 |
| morganfainberg | every get | 13:11 |
| *** jimbaker has quit IRC | 13:12 | |
| morganfainberg | but we could easily just not use that for the memcache mode. | 13:12 |
| breton | indeed | 13:12 |
| morganfainberg | iirc that is the last incubator thing we have in ksm | 13:12 |
| *** jimbaker has joined #openstack-keystone | 13:12 | |
| *** jimbaker has quit IRC | 13:12 | |
| *** jimbaker has joined #openstack-keystone | 13:12 | |
| breton | do we need to have backends pluggable in ksm? | 13:13 |
| *** emagana has quit IRC | 13:13 | |
| morganfainberg | we need to support memcache and in-memory | 13:13 |
| morganfainberg | minimum | 13:13 |
| morganfainberg | i'd like to see it move to dogpile | 13:14 |
| *** gokrokve_ has joined #openstack-keystone | 13:14 | |
| morganfainberg | but i was waiting for the olso.cache work to be done (there is someone actively working on that) | 13:14 |
| *** gokrokve has quit IRC | 13:17 | |
| *** radez_g0n3 is now known as radez | 13:18 | |
| *** fhubik is now known as fhubik_afk | 13:19 | |
| *** ajayaa has joined #openstack-keystone | 13:20 | |
| *** Ephur has joined #openstack-keystone | 13:21 | |
| *** jsavak has joined #openstack-keystone | 13:26 | |
| *** mattfarina has joined #openstack-keystone | 13:26 | |
| *** yasu_ has quit IRC | 13:27 | |
| samueldmq | breton, just to make sure ... you tested applying that patch on juno and then ksm + memcache_pool worked, right ? | 13:31 |
| *** bknudson has joined #openstack-keystone | 13:32 | |
| *** ChanServ sets mode: +v bknudson | 13:32 | |
| *** jsavak has quit IRC | 13:32 | |
| *** amakarov_away is now known as amakarov | 13:32 | |
| *** jsavak has joined #openstack-keystone | 13:33 | |
| *** e0ne has quit IRC | 13:35 | |
| *** dhellmann has left #openstack-keystone | 13:44 | |
| *** fhubik_afk is now known as fhubik | 13:48 | |
| ayoung | morganfainberg, samueldmq I think I am going to split "Hierarchical Roles" into two pieces. The first is going to be assignement: If Auser is assigend one role, they *can* get any other roles implied by that role | 13:56 |
| ayoung | we'll do enforcement later | 13:56 |
| ayoung | and "implied" roles will not show up in the token | 13:56 |
| ayoung | I have a spec in already that allows a user to explicitly request a role | 13:57 |
| *** ajayaa has quit IRC | 13:57 | |
| ayoung | any implied roles should be possible to have if explicitly requested | 13:57 |
| ayoung | make sense? I'm trying to keep thie granular | 13:57 |
| *** jsavak has quit IRC | 14:00 | |
| *** jsavak has joined #openstack-keystone | 14:00 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs https://review.openstack.org/187027 | 14:00 |
| *** blewis has joined #openstack-keystone | 14:02 | |
| *** emagana has joined #openstack-keystone | 14:03 | |
| *** csoukup has joined #openstack-keystone | 14:05 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:07 | |
| *** emagana has quit IRC | 14:08 | |
| *** bdossant has quit IRC | 14:09 | |
| *** mattfarina has quit IRC | 14:10 | |
| *** fhubik is now known as fhubik_afk | 14:11 | |
| *** henrynash has joined #openstack-keystone | 14:16 | |
| *** ChanServ sets mode: +v henrynash | 14:16 | |
| *** jith_ has quit IRC | 14:21 | |
| *** timcline has joined #openstack-keystone | 14:25 | |
| *** jsavak has quit IRC | 14:26 | |
| *** fhubik_afk is now known as fhubik | 14:26 | |
| morganfainberg | ayoung: ack | 14:26 |
| *** jsavak has joined #openstack-keystone | 14:26 | |
| *** krykowski has quit IRC | 14:28 | |
| *** mabrams has quit IRC | 14:39 | |
| openstackgerrit | Nikita Konovalov proposed openstack/python-keystoneclient: Fix logging of binray contentent in request https://review.openstack.org/183514 | 14:40 |
| *** dguerri is now known as dguerri`away | 14:40 | |
| *** dguerri`away is now known as dguerri | 14:40 | |
| *** nkinder has joined #openstack-keystone | 14:44 | |
| *** gokrokve has joined #openstack-keystone | 14:47 | |
| *** radez is now known as radez_g0n3 | 14:47 | |
| *** topol has joined #openstack-keystone | 14:48 | |
| *** ChanServ sets mode: +v topol | 14:48 | |
| *** topol_ has joined #openstack-keystone | 14:49 | |
| *** ChanServ sets mode: +v topol_ | 14:49 | |
| *** gokrokve_ has quit IRC | 14:50 | |
| *** radez_g0n3 is now known as radez | 14:51 | |
| *** e0ne has joined #openstack-keystone | 14:52 | |
| *** e0ne is now known as e0ne_ | 14:52 | |
| *** topol has quit IRC | 14:53 | |
| *** topol_ is now known as topol | 14:53 | |
| *** e0ne_ is now known as e0ne | 14:56 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs https://review.openstack.org/187027 | 14:56 |
| *** mattamizer has joined #openstack-keystone | 14:56 | |
| *** fhubik has quit IRC | 14:57 | |
| *** afazekas has quit IRC | 14:57 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs https://review.openstack.org/187027 | 14:59 |
| *** stevemar has joined #openstack-keystone | 15:04 | |
| *** ChanServ sets mode: +v stevemar | 15:04 | |
| *** HT_sergio has joined #openstack-keystone | 15:04 | |
| *** cyeoh has quit IRC | 15:08 | |
| *** emagana has joined #openstack-keystone | 15:09 | |
| *** emagana has quit IRC | 15:09 | |
| *** emagana has joined #openstack-keystone | 15:09 | |
| *** emagana has quit IRC | 15:10 | |
| *** hemnabeer is now known as hemna | 15:11 | |
| *** emagana has joined #openstack-keystone | 15:11 | |
| *** emagana has quit IRC | 15:12 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs https://review.openstack.org/187027 | 15:13 |
| *** emagana has joined #openstack-keystone | 15:13 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs https://review.openstack.org/187027 | 15:14 |
| *** emagana has quit IRC | 15:14 | |
| *** zzzeek has joined #openstack-keystone | 15:15 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs https://review.openstack.org/187027 | 15:15 |
| *** david-ly_ is now known as david-lyle | 15:21 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning for Fernet tokens over 255 chars https://review.openstack.org/186396 | 15:22 |
| *** emagana has joined #openstack-keystone | 15:25 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log info for Fernet tokens over 255 chars https://review.openstack.org/186396 | 15:25 |
| *** nkinder_ has joined #openstack-keystone | 15:27 | |
| *** nkinder has quit IRC | 15:31 | |
| *** nkinder_ has quit IRC | 15:33 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs https://review.openstack.org/187027 | 15:37 |
| *** bjornar has quit IRC | 15:38 | |
| *** dims has quit IRC | 15:41 | |
| *** dims_ has joined #openstack-keystone | 15:42 | |
| *** mattamizer has quit IRC | 15:42 | |
| morganfainberg | lbragstad: https://review.openstack.org/#/c/186971/ | 15:43 |
| morganfainberg | lbragstad: also we have another fernet bug it looks like with v2 tokens. | 15:43 |
| *** nkinder_ has joined #openstack-keystone | 15:44 | |
| dolphm | morganfainberg: is there a bug report? | 15:44 |
| morganfainberg | Yes. Sec. | 15:44 |
| dolphm | ah i’m guessing this is Jake? -Dolph | 15:45 |
| dolphm | lol bad paste | 15:45 |
| dolphm | https://bugs.launchpad.net/keystonemiddleware/+bug/1460225 * | 15:45 |
| openstack | Launchpad bug 1460225 in keystonemiddleware "Fernet + Memcache causes validation failures" [Medium,In progress] - Assigned to Morgan Fainberg (mdrnstm) | 15:45 |
| lbragstad | morganfainberg: reviewing | 15:45 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1459791 | 15:45 |
| openstack | Launchpad bug 1459791 in Keystone "Juno to Kilo upgrade breaks default domain id" [Undecided,New] | 15:45 |
| morganfainberg | dolphm: ^ | 15:45 |
| morganfainberg | Did I typo in the review? | 15:45 |
| morganfainberg | Sorry the memcache one is separate from the one I just linked for review. | 15:46 |
| morganfainberg | Crap | 15:46 |
| morganfainberg | Let me say that again. | 15:46 |
| morganfainberg | Memcache is that one you linked Dolph. | 15:46 |
| morganfainberg | The other one is separate and *not* memcache related. | 15:46 |
| dolphm | i think i got it straight, reviewing both | 15:46 |
| morganfainberg | K | 15:46 |
| * morganfainberg can't brain before coffee settles in. | 15:47 | |
| dolphm | so this is a v2 token being checked for domain-ness by filter_domain() | 15:48 |
| *** gyee has joined #openstack-keystone | 15:48 | |
| *** ChanServ sets mode: +v gyee | 15:48 | |
| dolphm | oh, the OP says he's using UUID, not fernet | 15:49 |
| *** e0ne is now known as e0ne_ | 15:50 | |
| sigmavirus24 | morganfainberg: I feel your pain re braining before coffee has reached the blood flow | 15:50 |
| dolphm | immediately solution? "if 'domain' in ref:" should be "if ref.get('domain')" but i'd like to know the root cause | 15:50 |
| bknudson | http://pythonhosted.org/WSME/#flask | 15:50 |
| *** jsavak has quit IRC | 15:50 | |
| *** e0ne_ is now known as e0ne | 15:51 | |
| morganfainberg | dolphm: I think it's a v2 | 15:52 |
| morganfainberg | Token with a None in the ref already. | 15:52 |
| morganfainberg | dolphm: the filter / clean methods could stand a hard look there. | 15:53 |
| *** _cjones_ has joined #openstack-keystone | 15:53 | |
| *** jsavak has joined #openstack-keystone | 15:53 | |
| lbragstad | morganfainberg: was this an issue with Fernet? https://bugs.launchpad.net/keystone/+bug/1459791 | 15:54 |
| openstack | Launchpad bug 1459791 in Keystone "Juno to Kilo upgrade breaks default domain id" [Undecided,New] | 15:54 |
| lbragstad | morganfainberg: looks like the default token provider was still being used | 15:54 |
| morganfainberg | lbragstad: turns out no. | 15:54 |
| morganfainberg | lbragstad: bigger issue it seems. | 15:54 |
| lbragstad | morganfainberg: ok, just checking | 15:55 |
| morganfainberg | bknudson: I think we determined wsme won't help us / work for us already. | 15:56 |
| bknudson | maybe it doesn't support the extras | 15:56 |
| morganfainberg | bknudson: specifically because of the lobs we have. Yeah. Extra field issues. | 15:57 |
| *** mattfarina has joined #openstack-keystone | 15:58 | |
| *** jsavak has quit IRC | 16:01 | |
| *** jsavak has joined #openstack-keystone | 16:01 | |
| *** _cjones_ has quit IRC | 16:02 | |
| *** _cjones_ has joined #openstack-keystone | 16:02 | |
| *** zzzeek has quit IRC | 16:02 | |
| *** zzzeek_ has joined #openstack-keystone | 16:02 | |
| *** lufix has quit IRC | 16:04 | |
| *** belmoreira has quit IRC | 16:05 | |
| *** jistr has quit IRC | 16:11 | |
| *** browne has joined #openstack-keystone | 16:16 | |
| *** richm has joined #openstack-keystone | 16:24 | |
| openstackgerrit | Phil Hopkins proposed openstack/keystone: updates sample_data script to use the new openstack commands https://review.openstack.org/186560 | 16:25 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Transition the domain config management API to stable https://review.openstack.org/187249 | 16:30 |
| dstanek | has anyone given thought to how we want to handle "optional" middleware? i'm getting rid of paste usage in my flask branch! | 16:31 |
| dstanek | i'm assuming we still need to handle loading middleware from a config file (the pipeline or at least part of it) | 16:31 |
| openstackgerrit | Phil Hopkins proposed openstack/keystone: updates sample_data script to use the new openstack commands https://review.openstack.org/186560 | 16:34 |
| bknudson | dstanek: stevedore allows for plugins | 16:35 |
| dstanek | bknudson: that doesn't help with middleware since you still need a place to say what plugins to load | 16:35 |
| bknudson | http://docs.openstack.org/developer/stevedore/patterns_loading.html#hooks-single-name-many-entry-points | 16:36 |
| dstanek | bknudson: how can you build a configurable pipeline using that? | 16:37 |
| *** stpierre has joined #openstack-keystone | 16:38 | |
| dstanek | isn't that name hardcoded in code? and/or what it resolves to? | 16:38 |
| stpierre | morganfainberg: ping re: keystone event notifications | 16:38 |
| morganfainberg | stpierre: heyya | 16:38 |
| stpierre | hey -- you gave me some pointers to event notification docs a while back. is there any prior art for integration with those? i.e., have any projects (that you know of) start consuming them? | 16:39 |
| bknudson | dstanek: the name is hardcoded, but the functions that get called aren't hardcoded. | 16:39 |
| morganfainberg | hmm.. i don't know. ceilometer does consume most notifications | 16:39 |
| dstanek | bknudson: how do you configure that? | 16:39 |
| morganfainberg | but not sure about anything actively consuming keystone ones yet | 16:39 |
| stpierre | okay, cool | 16:39 |
| bknudson | dstanek: I think it's in your setup.cfg | 16:40 |
| bknudson | ceilometer consumes notifications | 16:40 |
| dstanek | bknudson: ah. that won't work then. | 16:40 |
| stpierre | do you think there'd be interest in an oslo library for consuming them? if i start work on this in nova, i'm wondering how generic i should aim to be | 16:40 |
| *** blewis has quit IRC | 16:40 | |
| dstanek | bknudson: you can say "pipeline = X Y Z app" where X isn't in the Keystone codebase | 16:40 |
| bknudson | the setup.cfg can be in a different codebase | 16:41 |
| *** afazekas has joined #openstack-keystone | 16:41 | |
| bknudson | the names wind up being global somehow | 16:41 |
| dstanek | bknudson: so as a deployer you'd have to create an installable python package that depends on keystone? | 16:41 |
| bknudson | how are we going to consume oslo middleware if there's no paste pipeline? | 16:41 |
| bknudson | it doesn't have to depend on keystone, it just has its setup.cfg define the entry points | 16:42 |
| dstanek | bknudson: do you know how order would be controlled? i have ideas on what to do with the paste config (to keep the pipeline), but not use paste | 16:43 |
| bknudson | dstanek: I don't know how you control the order... probably a good question for oslo | 16:44 |
| bknudson | docs don't mention how to control the order | 16:45 |
| samueldmq | ayoung, hi, reading up | 16:45 |
| *** jsavak has quit IRC | 16:45 | |
| *** gokrokve_ has joined #openstack-keystone | 16:45 | |
| samueldmq | ayoung, if we don't put the implied roles (the leaf ones) in the token, the enforcer side will need to know the role hierarchy, right ? | 16:46 |
| *** gokrokve_ has quit IRC | 16:46 | |
| *** gokrokve_ has joined #openstack-keystone | 16:46 | |
| bknudson | dstanek: you can't do flask + paste? | 16:46 |
| dstanek | bknudson: you can, but i was hoping to get rid of the extra dep | 16:47 |
| bknudson | http://stackoverflow.com/questions/10706475/deploying-a-flask-application-using-paste | 16:47 |
| bknudson | if it gives us middleware support then seems like it's better to keep paste | 16:47 |
| *** davidckennedy has quit IRC | 16:48 | |
| *** gokrokve has quit IRC | 16:49 | |
| *** afazekas has quit IRC | 16:49 | |
| *** henrynash has quit IRC | 16:51 | |
| *** jsavak has joined #openstack-keystone | 16:54 | |
| *** ajayaa has joined #openstack-keystone | 16:55 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs https://review.openstack.org/187027 | 16:55 |
| *** e0ne has quit IRC | 16:55 | |
| ayoung | samueldmq, eventuaslly | 16:57 |
| *** henrynash has joined #openstack-keystone | 16:57 | |
| *** ChanServ sets mode: +v henrynash | 16:57 | |
| *** jsavak has quit IRC | 16:58 | |
| ayoung | samueldmq, so, first I want to just say "When I assign Admin, I also Assign Member" | 16:58 |
| ayoung | But if someone gets a token, they will only get the "Admin" role on the token | 16:58 |
| ayoung | nothing else changes | 16:58 |
| *** jsavak has joined #openstack-keystone | 16:59 | |
| *** spandhe has joined #openstack-keystone | 17:00 | |
| samueldmq | ayoung, ok, but we must be careful ... because if we allow people to create role hierarchies, tehy will be expecting to have the subordinate roles implied | 17:01 |
| samueldmq | ayoung, what if we get at the end of the release and we don't get the enforcement part merged ? :p | 17:01 |
| ayoung | samueldmq, I think the ordering I want is this: | 17:01 |
| samueldmq | ayoung, (I am not agains that, just want to make sure we have the roadmap well defined) | 17:01 |
| samueldmq | ayoung, k, go ahead | 17:02 |
| ayoung | 1. Subset Tokens https://review.openstack.org/186979 | 17:03 |
| ayoung | 2. Implied roles | 17:03 |
| ayoung | (this conversation) | 17:03 |
| ayoung | 3. Generate policy from hierarchical roles | 17:03 |
| ayoung | I don't want to change the mechanism for what goes in the token in the middle, so the implied roles is just admin to start | 17:04 |
| ayoung | er...is just administrative overhead to start | 17:04 |
| *** spandhe_ has joined #openstack-keystone | 17:07 | |
| *** spandhe has quit IRC | 17:08 | |
| *** spandhe_ is now known as spandhe | 17:08 | |
| *** someara2 has joined #openstack-keystone | 17:09 | |
| *** henrynash has quit IRC | 17:09 | |
| *** alanf-mc has joined #openstack-keystone | 17:10 | |
| *** ajayaa has quit IRC | 17:14 | |
| samueldmq | ayoung, what if we put effective roles (the leaf ones) in the token .. | 17:14 |
| samueldmq | ayoung, I know .. the token would increase etc ... but that would work in our current architecture | 17:14 |
| samueldmq | ayoung, and then we would improve it later | 17:15 |
| ayoung | samueldmq, nah, cuz changes there would still require changes to policy | 17:15 |
| ayoung | I think we just make this an interim step. | 17:16 |
| ayoung | samueldmq, siomething like "only explicitly assigned roles will appear in the token by default" | 17:16 |
| ayoung | "If you want the implied roles, you have to request them expressly." | 17:16 |
| *** radez is now known as radez_g0n3 | 17:16 | |
| samueldmq | ayoung, ok .. I will take a look at subset tokens later today | 17:16 |
| samueldmq | ayoung, need to go now (meeting), sorry | 17:17 |
| ayoung | samueldmq, it needs an API spec. I will work on that | 17:17 |
| samueldmq | ayoung, ++ | 17:17 |
| morganfainberg | amakarov: ping | 17:18 |
| amakarov | morganfainberg, pong | 17:18 |
| morganfainberg | amakarov: https://review.openstack.org/#/c/159172/4 why are we refactoring the eventlet stuff massively to be a class hierarchy when it is going to be deleted next cycle? | 17:18 |
| morganfainberg | amakarov: not saying no, just curious as to the intent of this. | 17:19 |
| *** lhcheng has joined #openstack-keystone | 17:19 | |
| *** ChanServ sets mode: +v lhcheng | 17:19 | |
| amakarov | morganfainberg, I've paused the work | 17:20 |
| morganfainberg | amakarov: ok. i just figure we can probably keep it as is until next cycle (mostly) and then merge it all down into the WSGI-only form | 17:20 |
| morganfainberg | amakarov: save some code/reviewing for the sake of code/reviewing :) | 17:20 |
| amakarov | morganfainberg, it looks more like "Let's clean it, paint, polish and throw away" | 17:20 |
| morganfainberg | yeah. lets not clean it and paint it if we're tossing it out :) | 17:21 |
| dstanek | morganfainberg: i've actually been making some changes to the wsgi code for flask integration | 17:21 |
| morganfainberg | dstanek: that is the other thing didn't want to stomp on your work | 17:21 |
| morganfainberg | unless that ^^ change is a win for Flask, which case we can absolutely grab it | 17:22 |
| * morganfainberg defers to dstanek and jamielennox on that | 17:23 | |
| bknudson | maybe the refactoring of the wsgi / eventlet startup code that's needed is to split it up more | 17:24 |
| bknudson | so that it's easy to get rid of the eventlet code | 17:24 |
| bknudson | and easier to modify the wsgi code | 17:24 |
| dstanek | bknudson: yes, that's exactly what i was having to do | 17:25 |
| morganfainberg | bknudson: thats a good reason to accept the code. | 17:25 |
| * morganfainberg wants to avoid refactoring code that is going away unless we have a real benefit. | 17:25 | |
| morganfainberg | otherwise it just introduces more potential bugs we need to suss out. | 17:26 |
| dstanek | morganfainberg: i don't think that refactoring is worth it at this point | 17:26 |
| morganfainberg | dstanek: ok | 17:27 |
| morganfainberg | wfm | 17:27 |
| morganfainberg | stevemar: https://review.openstack.org/#/c/157427/57 is trying to take the record from you on the "most number of patchsets for a single review" | 17:28 |
| ayoung | what version are we up to now in the Specs changes? 3.4 still, right? | 17:30 |
| morganfainberg | ayoung: probably | 17:30 |
| ayoung | ah, 3.5 now, right? 3.4 went out last go round? | 17:32 |
| morganfainberg | i'd defer what is in the repo | 17:36 |
| * morganfainberg will look into that more - once i'm off this call | 17:37 | |
| *** afazekas has joined #openstack-keystone | 17:40 | |
| openstackgerrit | Diane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs https://review.openstack.org/187027 | 17:43 |
| *** blewis has joined #openstack-keystone | 17:43 | |
| *** someara2 has quit IRC | 17:44 | |
| *** packet has joined #openstack-keystone | 17:44 | |
| *** someara2 has joined #openstack-keystone | 17:46 | |
| *** afazekas has quit IRC | 17:47 | |
| *** someara2_ has joined #openstack-keystone | 17:47 | |
| *** someara2 has quit IRC | 17:51 | |
| *** jsavak has quit IRC | 17:52 | |
| *** jsavak has joined #openstack-keystone | 17:58 | |
| *** blewis` has joined #openstack-keystone | 17:59 | |
| *** someara2_ has quit IRC | 18:02 | |
| *** blewis has quit IRC | 18:02 | |
| *** someara2 has joined #openstack-keystone | 18:02 | |
| ayoung | dstanek, bknudson I want to add in an additiona requirement to token-request. I want to be able to specify a subset of the endpoints in the catalog. WOuld it make sense to have ServiceCatalog element in the request dictionary, right under scope, or to put the constrains inside of "scope" | 18:02 |
| *** jsavak has quit IRC | 18:03 | |
| *** jsavak has joined #openstack-keystone | 18:03 | |
| bknudson | ayoung: if there's no scope then there's no catalog, right? | 18:03 |
| bknudson | so seems like you'd want it with the scope | 18:04 |
| ayoung | bknudson, that is right | 18:04 |
| dstanek | ayoung: i think in the scope because it's going to be used as a part of the scope | 18:04 |
| *** aix has quit IRC | 18:04 | |
| ayoung | bknudson, I could make a bunch of values, all parallel, like scope.endpoint_ids and scope.service_types | 18:04 |
| bknudson | can't you already specify a subset of the endpoints using endpoint filtering? | 18:04 |
| ayoung | bknudson, not on the token request | 18:04 |
| ayoung | that is only for all tokens for that project | 18:05 |
| ayoung | bknudson, this is designed to work in conjunction with gyee 's endpoint-binding | 18:05 |
| ayoung | bknudson, I'm also adding in the ability to request a token with a subset of roles | 18:05 |
| bknudson | it would be interesting if we could get a full story of how delegation is going to work with these | 18:06 |
| bknudson | how do I know what endpoints are needed when I give a token to heat? | 18:06 |
| bknudson | or nova | 18:06 |
| ayoung | bknudson, heh...trying to get there | 18:06 |
| ayoung | bknudson, there are two ways I can see it playing out | 18:06 |
| *** someara2 has quit IRC | 18:07 | |
| ayoung | 1. When you request an operation from, say, Heat, but without a token, it responds back with a "401: please provide tokens with the following roles" | 18:07 |
| ayoung | without a token or with an invalid token would be equivalent | 18:08 |
| ayoung | the second would be to know a-priori | 18:08 |
| bknudson | scary | 18:08 |
| ayoung | either way, we need things to be somewhat introspective | 18:08 |
| ayoung | bknudson, scary in a security way or scary in an "security just broke everything way?" | 18:08 |
| ayoung | I think that the later is closer to true | 18:08 |
| bknudson | it's scary giving a client information when they're not authenticated. | 18:08 |
| ayoung | bknudson, we wouldn't tell the user anything that is not-public knowledge | 18:08 |
| ayoung | for example, if we don;t know the project id for the resource, we would not look it up for them and tell them | 18:09 |
| bknudson | the names of roles | 18:09 |
| ayoung | its so much better than what we do today | 18:09 |
| ayoung | today we have most of the service not even checking roles | 18:09 |
| ayoung | just accepting all tokens with "" | 18:09 |
| ayoung | for policy rules | 18:09 |
| *** topol_ has joined #openstack-keystone | 18:09 | |
| ayoung | nova just checks that the projectID matches | 18:09 |
| *** ChanServ sets mode: +v topol_ | 18:09 | |
| bknudson | I don't see the relationship | 18:10 |
| ayoung | bknudson, but, we could make it an additional call to Keystione, too, which we would only answer to an authenticated user | 18:10 |
| bknudson | that makes more sense | 18:10 |
| ayoung | "what roles do I need to make this API?" "Member" | 18:10 |
| *** gokrokve has joined #openstack-keystone | 18:11 | |
| bknudson | keystone would have to know if nova is using nova-networking or neutron | 18:11 |
| ayoung | bknudson, nah, I want to get away from that, too | 18:11 |
| *** opilotte has joined #openstack-keystone | 18:11 | |
| dstanek | so i'm not entirely sold on endpoint binding - i still like the idea i had about capability based binding | 18:11 |
| ayoung | I'm still wokring through the details, but more like; nova can exchange one token for another of comparable scope, but for a different endpoint, based on a transitionws rules table | 18:11 |
| *** topol has quit IRC | 18:12 | |
| opilotte | did anyone test federation extension with heat? I get weird errors and I wonder if it's a configuration issue, rather than a problem with the federation | 18:12 |
| *** topol_ is now known as topol | 18:12 | |
| opilotte | I get 400 bad requests: Actually, having considered this for a while, I propose two changes: | 18:12 |
| opilotte | 1. Stop using heat_stack_owner, and instead delegate _member_, which is the default role created by keystone since grizzly and used to indicated project membership (thus all users should already have it, avoiding this situation) | 18:12 |
| ayoung | dstanek, I think that I'd like that, but not sure how to implement. What did you have in mind? | 18:13 |
| opilotte | sorry about that, was a bad cut and paste | 18:13 |
| ayoung | opilotte, probably ask the heat team before asking here | 18:13 |
| *** gokrokve_ has quit IRC | 18:13 | |
| ayoung | opilotte, we just build the mechanism, not monitor all the usages. | 18:13 |
| ayoung | opilotte, but _member_ was a hack to avoid a potential conflict | 18:14 |
| morganfainberg | ayoung amakarov: I marked the bug re trusts and services making trusts invalid. if we are changing that workflow we should not be considering it a bug, it is in-fact working as intended. | 18:14 |
| ayoung | not, necessaryily, something we should consider part of the contract. Instead...well, I'm pushing toward dynamic policy | 18:14 |
| morganfainberg | ayoung amakarov: as an FYI | 18:14 |
| dstanek | ayoung: come up with a list of all capabilities across openstack - then create a dependency tree | 18:14 |
| *** jsavak has quit IRC | 18:14 | |
| opilotte | ayoung: well, thanks for you answer, I wanted to know if you guys would have known any issue with Heat | 18:15 |
| ayoung | morganfainberg, I agree, and think that rthe ability to create a trust should be a role, and should be on the token and enforced in the policy on the keystone server | 18:15 |
| amakarov | morganfainberg, I knew it's a feature! )) | 18:15 |
| *** jsavak has joined #openstack-keystone | 18:15 | |
| *** gokrokve has quit IRC | 18:15 | |
| morganfainberg | amakarov: but it's something we will need a microversion API for *or* V4. | 18:16 |
| ayoung | so if a use does not want to let another service create a trust, they request a token without the createtrust role...based on the API spec I am wrirting right now | 18:16 |
| morganfainberg | amakarov: to be upfront. | 18:16 |
| morganfainberg | cc, ayoung ^^ | 18:16 |
| dolphm | ayoung: would appreciate your feedback on https://bugs.launchpad.net/keystone/+bug/1456797 | 18:16 |
| openstack | Launchpad bug 1456797 in Keystone "Old revocation events must be purged" [Low,Incomplete] - Assigned to Deepti Ramakrishna (dramakri) | 18:16 |
| dstanek | ayoung: consider making a tree like http://paste.openstack.org/show/253544/ where you scope the token to "capability:do-stuff" | 18:16 |
| dstanek | ayoung: this is could be used for any other capability under the tree | 18:16 |
| ayoung | dolphm, heh, I had forgotten I wrote that. THin the mechanism will work for list, but maybe not when we go to a push model | 18:16 |
| morganfainberg | amakarov: this does roll up reasonably well into the policy work that is being hashed out. | 18:17 |
| *** someara2 has joined #openstack-keystone | 18:17 | |
| ayoung | dstanek, there are about 5000 capapbiolties defined already for Nova, CInder, Glance, Keystone, and neutron. | 18:17 |
| ayoung | dstanek, not sure if enumerating them is the right approach. | 18:18 |
| ayoung | dstanek, but endpoint binding would still be needed | 18:18 |
| ayoung | I want it used on endpoint1 and not on endpoint2 | 18:18 |
| ayoung | cuz I get charged differntly | 18:18 |
| morganfainberg | dstanek, lbragstad, dolphm:(put this on the backburner for thought) looking over the crypto-hashing rounds patchset. I think we should go for 10k, a 30% savings seems worth it, and above glibc, since we're not going with the 300ms default (the other option is the 300ms default). | 18:19 |
| dstanek | ayoung: you can only do endpoint binding at the initial call right? bind to heat, but not to the nova, etc it uses | 18:19 |
| ayoung | dolphm, so, I think the "delete on each list" is the best I could come up with to avoid the token flush, but could potentially slow things down under load. | 18:19 |
| ayoung | dstanek, yes | 18:19 |
| ayoung | dstanek, but...heat is a different thing anyway: | 18:20 |
| ayoung | it will have to do some magic to create a trust. The real issue is the nova to glance case | 18:20 |
| dstanek | ayoung: same thing for nova and glance | 18:20 |
| ayoung | or the cinder to swift | 18:20 |
| *** amakarov is now known as amakarov_away | 18:20 | |
| ayoung | dstanek, for a first rev, I would have both glance and nova and neutron all on the token,. Then work towards mechanisms to let us do better token-for-token transitions | 18:21 |
| dolphm | morganfainberg: there's a patch for that?! | 18:21 |
| dolphm | morganfainberg: linky! | 18:21 |
| morganfainberg | dolphm: you even commented on it! | 18:21 |
| dstanek | i like the idea that as an end user i can auth and get an unscoped token that is cached on disk and then when the openstack client is used it generated a token that is specific to the operation i am asking it to perform | 18:21 |
| dolphm | morganfainberg: i'm down with 10k | 18:21 |
| dolphm | morganfainberg: oh | 18:21 |
| lbragstad | dolphm: yeah, I commented on it with the performance results | 18:21 |
| morganfainberg | dolphm: i specifies 5k atm, i was going to bump it to 10k | 18:21 |
| morganfainberg | and then +2 it | 18:21 |
| dolphm | who wrote the patch that i commented on | 18:21 |
| dolphm | haha | 18:21 |
| dstanek | i don't have any issues with 10k | 18:22 |
| * dolphm is afraid this is my own patch | 18:22 | |
| *** samuel-dmq has joined #openstack-keystone | 18:22 | |
| lbragstad | dolphm: https://review.openstack.org/#/c/165295/ | 18:22 |
| dstanek | ayoung: is there an actual list of capabilities? | 18:22 |
| dstanek | beyond what openstack client shows | 18:23 |
| *** jsavak has quit IRC | 18:23 | |
| dstanek | maybe i should write up a quick spec to explain my ideas and give examples | 18:23 |
| *** radez_g0n3 is now known as radez | 18:24 | |
| morganfainberg | dolphm: sorry you didn't comment lbragstad did | 18:24 |
| morganfainberg | dolphm: https://review.openstack.org/#/c/165295/ | 18:24 |
| morganfainberg | i read that last pre-coffee | 18:24 |
| ayoung | dstanek, there is not yet an overall list of capabilities | 18:27 |
| ayoung | dstanek, the "unified policy file" spec attempts to generate one | 18:28 |
| ayoung | but even then, we will forever play catch up as more and more camels stick their noses into the big tent | 18:28 |
| *** jsavak has joined #openstack-keystone | 18:29 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Use lower default value for sha512_crypt rounds https://review.openstack.org/165295 | 18:30 |
| *** timcline has quit IRC | 18:30 | |
| morganfainberg | dolphm: ^^ 10k | 18:30 |
| dolphm | morganfainberg: dammit, just as i post a review | 18:30 |
| morganfainberg | Ahaha | 18:31 |
| *** gokrokve has joined #openstack-keystone | 18:31 | |
| morganfainberg | feel free to update/fix. I'm +2 on the 10k based on your benchmarks | 18:31 |
| dolphm | morganfainberg: i'm +2 on 10k | 18:31 |
| morganfainberg | 5k was too low imo | 18:32 |
| morganfainberg | but 40k was excessive [unless we wanted the 300ms default] | 18:32 |
| dolphm | big performance improvement with a sufficient level of security for a default value | 18:32 |
| morganfainberg | ++ | 18:32 |
| morganfainberg | exactly | 18:32 |
| morganfainberg | we either go with a nice balance, or bias to security | 18:32 |
| morganfainberg | but 40k was very very arbitrary | 18:32 |
| dolphm | as is 10k ;) | 18:33 |
| morganfainberg | we have benchmarks on 10k though | 18:33 |
| morganfainberg | so ... less arbitrary | 18:33 |
| morganfainberg | :P | 18:33 |
| morganfainberg | somewhat | 18:33 |
| morganfainberg | btw... linux is a usable desktop now | 18:33 |
| * morganfainberg is amazed | 18:33 | |
| morganfainberg | 1.5 yrs ago i still had issues w/ it. | 18:33 |
| morganfainberg | then agian... OS X 10.10 :( | 18:34 |
| *** someara2 has quit IRC | 18:36 | |
| morganfainberg | though... i'm trying to figure out why ubuntu keeps wanting to use the british spellings of words (extra "u"s added everywhere) when i told it i was in the US. | 18:38 |
| dstanek | morganfainberg: maybe it doesn't believe you | 18:39 |
| morganfainberg | dstanek: lol | 18:40 |
| morganfainberg | dstanek: somehow my outlook calendar got wedged in UTC | 18:40 |
| morganfainberg | tz | 18:40 |
| dolphm | morganfainberg: this one would be good to put on the meeting agenda to find an assignee https://bugs.launchpad.net/keystone/+bug/1459828 it's surprising, to say the least | 18:41 |
| openstack | Launchpad bug 1459828 in Keystone "keystone-all crashes when ca_certs is not defined in conf" [Undecided,New] | 18:41 |
| morganfainberg | dstanek: it's kind of funny - freaked me out the first time "OMG MEETING NOW".. oh wait. | 18:41 |
| morganfainberg | dolphm: yeah we just got back the info on the environment recently | 18:41 |
| morganfainberg | dolphm: i wasn't able to duplicate it before. now maybe with the info I can. | 18:41 |
| *** someara2 has joined #openstack-keystone | 18:42 | |
| dolphm | morganfainberg: it sounds like it should be assigned to you then! | 18:42 |
| morganfainberg | lol | 18:42 |
| morganfainberg | it was incomplete until today. | 18:42 |
| morganfainberg | so. now i am trying to duplicate ;) | 18:42 |
| morganfainberg | so i can triage | 18:42 |
| dolphm | if you can duplicate, you can fix | 18:42 |
| dolphm | the way it's described, it's already Critical (default configuration fails terribly in our default deployment environment) so consider it triaged! | 18:44 |
| * morganfainberg dockers a 6.5 env. but needs to run errands :( | 18:45 | |
| *** timcline has joined #openstack-keystone | 18:45 | |
| *** alanf-mc has quit IRC | 18:48 | |
| *** samuel-dmq has quit IRC | 18:57 | |
| openstackgerrit | Merged openstack/keystone: Log info for Fernet tokens over 255 chars https://review.openstack.org/186396 | 19:00 |
| *** henrynash has joined #openstack-keystone | 19:07 | |
| *** ChanServ sets mode: +v henrynash | 19:07 | |
| *** e0ne has joined #openstack-keystone | 19:10 | |
| openstackgerrit | Merged openstack/keystone: updates sample_data script to use the new openstack commands https://review.openstack.org/186560 | 19:11 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Tokens with subsets of roles or endpoints https://review.openstack.org/186979 | 19:11 |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: Enforce endpoint constraint https://review.openstack.org/177661 | 19:23 |
| *** e0ne has quit IRC | 19:24 | |
| *** belmoreira has joined #openstack-keystone | 19:41 | |
| *** alanf-mc has joined #openstack-keystone | 19:43 | |
| *** radez is now known as radez_g0n3 | 19:47 | |
| *** blewis` has quit IRC | 19:49 | |
| *** blewis has joined #openstack-keystone | 19:49 | |
| *** blewis has quit IRC | 19:53 | |
| *** belmoreira has quit IRC | 19:56 | |
| *** opilotte has quit IRC | 20:07 | |
| *** henrynash has quit IRC | 20:13 | |
| *** belmoreira has joined #openstack-keystone | 20:21 | |
| *** radez_g0n3 is now known as radez | 20:35 | |
| dolphm | i assume you can still provide an out-of-tree driver using a full package path with stevedore loading, i.e. https://github.com/openstack/keystone/blob/master/keystone/common/config.py#L236-L240 ? | 20:36 |
| * stevemar stevedore | 20:36 | |
| stevemar | dolphm, reporting for duty sir | 20:37 |
| *** stevemar is now known as stevedore | 20:37 | |
| stevedore | dolphm, reporting for duty sir | 20:37 |
| * dolphm le sigh | 20:37 | |
| dolphm | sergeant stevedore, i need you to support out of tree drivers. can you do that for me? | 20:38 |
| * stevedore rubs his chin in a ponderous manner... | 20:38 | |
| stevedore | private dolphm, i believe we can. | 20:39 |
| bknudson | your package needs to have a setup.cfg with [entrypoints] http://git.openstack.org/cgit/openstack/keystone/tree/setup.cfg#n61 | 20:40 |
| bknudson | like keystone does | 20:40 |
| * lbragstad thinks we just came up with new nick friday names... | 20:40 | |
| bknudson | I always though dolphm was in the navy | 20:40 |
| *** belmoreira has quit IRC | 20:40 | |
| lbragstad | bknudson: that would make sense | 20:40 |
| bknudson | lbragstad is cavalry for sure. | 20:41 |
| lbragstad | dolphins and water, you know... | 20:41 |
| dolphm | bknudson: oh, that's easy enough | 20:41 |
| lbragstad | ugh, I hate riding horses! | 20:41 |
| bknudson | so if you have your own token provider it would be keystone.token.provider = mytokenprovider = mypackage.token.providers.mytokenprovier:Provider | 20:42 |
| bknudson | you can call it whatever you want, but I guess it better not conflict | 20:43 |
| bknudson | I haven't tried any of this myself, but dhellman described it to me. | 20:43 |
| *** samueldmq has quit IRC | 20:45 | |
| bknudson | dolphm: that's if you want to use stevedore -- keystone still supports loading using the old qualified class name. | 20:45 |
| dolphm | bknudson: no, that makes sense - i totally forgot it was just based on entry points. | 20:45 |
| dolphm | bknudson: but not forever, i assume | 20:45 |
| bknudson | dolphm: loading using the qualified class name is deprecated | 20:45 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/186932 | 20:45 |
| dolphm | stevedore: when you respawn correctly, i have a question on horizon vs k2k | 20:48 |
| rodrigods | dolphm, curious about the horizon vs k2k question | 20:51 |
| dolphm | stevedore: rodrigods: i'm just wondering what the state of horizon support is as of stable/kilo | 20:52 |
| stevedore | dolphm, back | 20:52 |
| stevedore | for SSO or for k2k? | 20:52 |
| dolphm | stevedore: k2k | 20:52 |
| stevedore | dne in kilo | 20:52 |
| dolphm | stevedore: hrm, was there not something in progress ahead of kilo's release? | 20:53 |
| rodrigods | dolphm, stevedore https://review.openstack.org/#/q/status:open+project:openstack/django_openstack_auth+branch:master+topic:bp/k2k-federation,n,z | 20:53 |
| stevedore | dolphm, yes, refer to https://review.openstack.org/#/c/172155/ and https://review.openstack.org/#/c/159910/ | 20:53 |
| rodrigods | the current impl is using the region selector though... we need to change to a "service provider" selector | 20:54 |
| rodrigods | stevedore, we have someone working in this front, btw | 20:54 |
| stevedore | rodrigods, awesome | 20:54 |
| rodrigods | he will send an email to doug-fish soon | 20:54 |
| stevedore | we need to get the k2k plugin for ksc (or ksc-fed) in for this to become real | 20:54 |
| rodrigods | and I'll try to make the k2k plugin work | 20:54 |
| rodrigods | stevedore, will do... this week | 20:55 |
| dolphm | stevedore: rodrigods: if we get this stuff completed & merged, is there anything in django_openstack_auth / keystoneclient that would prevent them from working with a kilo deploy? | 20:55 |
| dolphm | assuming we get another stable release of each soon thereafter? | 20:55 |
| rodrigods | dolphm, a keystone server stable/kilo? | 20:55 |
| stevedore | dolphm, dont think so | 20:56 |
| *** stpierre has quit IRC | 20:56 | |
| dolphm | rodrigods: keystone, yes, along with the rest of openstack | 20:56 |
| stevedore | dolphm, just an updated ksc and doa | 20:56 |
| *** samueldmq has joined #openstack-keystone | 20:56 | |
| rodrigods | stevedore, ++ | 20:56 |
| stevedore | dolphm, are you poking around this for fun or is someone at rax interested? | 20:56 |
| stevedore | cause with the right motivation i'd raise the priority of these work items for myself | 20:57 |
| dolphm | django_openstack_auth does have a stable/kilo release branch too though | 20:57 |
| dolphm | stevedore: rax private cloud is interested in putting it into production | 20:57 |
| stevedore | \o/ | 20:57 |
| rodrigods | dolphm, awesome | 20:58 |
| stevedore | dolphm, we need to decide if that plugin is going into ksc vanilla or ksc-fed | 20:58 |
| rodrigods | dolphm, will ping you for reviews in the ksc plugin | 20:58 |
| rodrigods | stevedore, vanilla | 20:58 |
| dolphm | rodrigods: thank you, i'll bookmark the ones you linked above too | 20:58 |
| rodrigods | discussed with jamielennox and marekd in the summit | 20:58 |
| stevedore | rodrigods, awesome sauce | 20:58 |
| *** jsavak has quit IRC | 20:58 | |
| stevedore | rodrigods, jamie had an interesting comment on the patch | 20:59 |
| rodrigods | dolphm, https://review.openstack.org/#/c/172155/ this one is for the auth plugin that I should be updating this week | 20:59 |
| *** jsavak has joined #openstack-keystone | 20:59 | |
| stevedore | i think he found an easier way to do things? | 20:59 |
| dolphm | rodrigods: should that be WIP until then, or is that piece ready for review? | 20:59 |
| rodrigods | dolphm, WIP, thanks for the reminder | 21:00 |
| *** pauloewerton has joined #openstack-keystone | 21:00 | |
| rodrigods | stevedore, we will get the SP info from the token (need to update AccessInfoV3) | 21:00 |
| rodrigods | stevedore, btw, pauloewerton is our horizon guy | 21:01 |
| rodrigods | dolphm, ^ | 21:01 |
| pauloewerton | rodrigods, stevedore, dolphm hey guys ;) | 21:05 |
| dolphm | pauloewerton: o/ | 21:05 |
| stevedore | pauloewerton, o/ | 21:05 |
| *** mattfarina has quit IRC | 21:07 | |
| dolphm | pauloewerton: ping me directly if you have any k2k-related reviews | 21:07 |
| dolphm | pauloewerton: or really, any federation reviews | 21:08 |
| *** jacorob has quit IRC | 21:08 | |
| *** jacorob has joined #openstack-keystone | 21:08 | |
| *** hockeynut has quit IRC | 21:09 | |
| pauloewerton | dolphm, I will, thanks | 21:10 |
| *** hockeynut has joined #openstack-keystone | 21:12 | |
| *** topol has quit IRC | 21:25 | |
| dolphm | morganfainberg: would appreciate your eyes on https://review.openstack.org/#/c/180355/ | 21:27 |
| *** timcline has quit IRC | 21:32 | |
| *** afazekas has joined #openstack-keystone | 21:34 | |
| *** jsavak has quit IRC | 21:35 | |
| *** jsavak has joined #openstack-keystone | 21:36 | |
| HT_sergio | Does anyone know if morganfainberg will be on at all today ? | 21:41 |
| HT_sergio | dolphm, rodrigods: maybe you guys would know ? | 21:41 |
| morganfainberg | I swear I'm not here :P | 21:41 |
| HT_sergio | haha well now I look silly | 21:42 |
| HT_sergio | that issue you helped me debug last week in keystonemiddleware v1.0.0 with the service token not being reset correctly | 21:42 |
| morganfainberg | HT_sergio: I have a meeting in like 10minutes and then travel. But I'm checking IRC some :) | 21:42 |
| HT_sergio | I'm about to create a launchpad issue, just so others can find it | 21:42 |
| bknudson | I thought we deprecated the service token garbage. | 21:42 |
| HT_sergio | sorry, I mean the token that the service was using. The service's token | 21:43 |
| morganfainberg | HT_sergio: I think we solved that or there was a bug / review to fix it. | 21:43 |
| morganfainberg | bknudson: this was the service user token for validating. | 21:43 |
| morganfainberg | Not the x-service-token thing. | 21:43 |
| HT_sergio | morganfainberg: yes it was already solved, but there's no launchpad issue, so I'm thinking about making one for other people that run into this issue | 21:44 |
| HT_sergio | because Ubuntu repos for 14.04 distribute the version w/ the bug | 21:44 |
| morganfainberg | HT_sergio: hmm I though we had a LP bug for it too. | 21:44 |
| HT_sergio | (and for 14.10) | 21:44 |
| HT_sergio | morganfainberg: this is what I'm asking :) | 21:44 |
| HT_sergio | I didn't find a LP bug | 21:44 |
| HT_sergio | but maybe you would know better | 21:44 |
| *** timcline has joined #openstack-keystone | 21:45 | |
| bknudson | http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token/_auth.py#n72 | 21:45 |
| bknudson | deprecated | 21:45 |
| bknudson | maybe we can remove this for keystonemiddleware 2.0 | 21:46 |
| dolphm | bknudson: x-service-token is already deprecated? | 21:46 |
| morganfainberg | dolphm: no. Admin_token | 21:46 |
| bknudson | dolphm: x-service-token is still supported. | 21:46 |
| dolphm | ah | 21:46 |
| bknudson | not sure if anyone has been able to use it yet | 21:47 |
| morganfainberg | bknudson: this was an issue where session wasn't refreshing the service user token. | 21:47 |
| dolphm | oh, i might have run into that too | 21:47 |
| morganfainberg | Because it was setting .auth_token to None not ._auth_token | 21:47 |
| morganfainberg | I think lbragstad fixed it. | 21:47 |
| bknudson | oops. blame python. | 21:47 |
| morganfainberg | bknudson: yeah I blame Python. | 21:47 |
| HT_sergio | it was fixed right away, in v1.1.0 | 21:48 |
| HT_sergio | which is already "old | 21:48 |
| morganfainberg | Hmm. | 21:49 |
| morganfainberg | Oh right. | 21:49 |
| HT_sergio | but Ubuntu (for some reason) distributes it so I just want to make sure there's a record of the bug somewhere. So others will know | 21:49 |
| morganfainberg | Because Ubuntu hasn't released a newer version. | 21:49 |
| HT_sergio | yup | 21:49 |
| HT_sergio | crummy, I know :p | 21:49 |
| *** nkinder__ has joined #openstack-keystone | 21:49 | |
| morganfainberg | Uhmm. I think you need to open a bug against Ubuntu saying the old version of middleware is broken. | 21:50 |
| HT_sergio | yes I'm doing that too | 21:50 |
| *** timcline has quit IRC | 21:50 | |
| HT_sergio | so, should I not bother opening one against keystonemiddleware also ? | 21:50 |
| morganfainberg | Not sure how we handle a bug against 1.1.0 when we don't use that as a stable for any branch ATM | 21:50 |
| HT_sergio | since it's an old version | 21:50 |
| morganfainberg | HT_sergio: you can and I'll close it as "already fixed" if it helps ;) | 21:50 |
| *** marzif_ has quit IRC | 21:50 | |
| HT_sergio | sounds good! | 21:51 |
| morganfainberg | But you don't need to open against keystonemiddleware if you don't want to. | 21:51 |
| *** e0ne has joined #openstack-keystone | 21:51 | |
| HT_sergio | morganfainberg: https://bugs.launchpad.net/keystonemiddleware/+bug/1460833 | 21:53 |
| openstack | Launchpad bug 1460833 in keystonemiddleware "admin token is not properly refreshed if it expires in v1.0.0" [Undecided,New] | 21:53 |
| HT_sergio | thank you btw! | 21:53 |
| *** nkinder_ has quit IRC | 21:54 | |
| *** afazekas has quit IRC | 21:54 | |
| *** nkinder__ has quit IRC | 21:55 | |
| *** emagana has quit IRC | 22:00 | |
| bknudson | did keystonemiddleware py34 test break by itself somehow? | 22:00 |
| *** kwills has joined #openstack-keystone | 22:01 | |
| *** openstackgerrit has quit IRC | 22:07 | |
| *** nkinder__ has joined #openstack-keystone | 22:07 | |
| *** openstackgerrit has joined #openstack-keystone | 22:08 | |
| *** emagana has joined #openstack-keystone | 22:09 | |
| bknudson | no, it didn't... something in the changes did it. | 22:10 |
| *** emagana has quit IRC | 22:10 | |
| *** jsavak has quit IRC | 22:13 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Replace blacklist_functions with blacklist_calls https://review.openstack.org/187360 | 22:14 |
| *** bknudson has quit IRC | 22:17 | |
| *** chlong has quit IRC | 22:18 | |
| *** zzzeek_ has quit IRC | 22:21 | |
| *** e0ne has quit IRC | 22:22 | |
| *** jsavak has joined #openstack-keystone | 22:29 | |
| *** jsavak has quit IRC | 22:30 | |
| *** markvoelker_ has joined #openstack-keystone | 22:35 | |
| *** markvoelker has quit IRC | 22:37 | |
| *** HT_sergio has quit IRC | 22:37 | |
| *** lhcheng has quit IRC | 22:38 | |
| *** lhcheng has joined #openstack-keystone | 22:38 | |
| *** ChanServ sets mode: +v lhcheng | 22:38 | |
| *** zzzeek has joined #openstack-keystone | 22:48 | |
| *** mattfarina has joined #openstack-keystone | 22:50 | |
| *** openstackgerrit has quit IRC | 22:51 | |
| *** csoukup has quit IRC | 22:52 | |
| *** openstackgerrit has joined #openstack-keystone | 22:52 | |
| *** dims__ has joined #openstack-keystone | 22:53 | |
| *** stevedore is now known as stevemar | 22:55 | |
| *** dsirrine has quit IRC | 22:55 | |
| *** stevemar is now known as stevedoor | 22:55 | |
| morganfainberg | ah HT_sergio disappeared | 22:55 |
| *** dims___ has joined #openstack-keystone | 22:56 | |
| *** dims_ has quit IRC | 22:56 | |
| *** dims__ has quit IRC | 22:58 | |
| *** nkinder__ has quit IRC | 22:58 | |
| *** zzzeek has quit IRC | 23:00 | |
| jamielennox | can i get some eyes on https://review.openstack.org/187094 | 23:06 |
| jamielennox | i need it in a release so i can do OSC for v3 devstack | 23:06 |
| *** Ephur has quit IRC | 23:07 | |
| jamielennox | stevedoor: ^ | 23:09 |
| *** dguerri is now known as dguerri`away | 23:09 | |
| *** csoukup has joined #openstack-keystone | 23:09 | |
| *** mattfarina has quit IRC | 23:10 | |
| *** sbasam has quit IRC | 23:12 | |
| *** zzzeek has joined #openstack-keystone | 23:12 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:12 | |
| *** csoukup has quit IRC | 23:14 | |
| *** chlong has joined #openstack-keystone | 23:41 | |
| *** stevedoor is now known as stevemar | 23:47 | |
| stevemar | jamielennox, rgr dgr | 23:48 |
| stevemar | it was already in an open tab in chrome, just needed to get to it eventually | 23:48 |
| stevemar | i was reviewing your devstack stuff | 23:48 |
| *** blewis has joined #openstack-keystone | 23:50 | |
| jamielennox | stevemar: yea, it's all interrelated | 23:50 |
| bigjools | hey morganfainberg, can I generalise that k2k stuff from Friday as 1. write SP switcher for Horizon, 2. generate saml assertions in d-o-a | 23:51 |
| bigjools | ? | 23:51 |
| jamielennox | stevemar: i got excited when samueldmq said that there was only a couple of problems running devstack without v2 and tried it :( | 23:51 |
| stevemar | bigjools, we already have some PoC code for SP switcher in horizon :O | 23:52 |
| bigjools | sweet! | 23:52 |
| stevemar | and DOA should not generate the saml assertions, but rather use an auth plugin | 23:52 |
| * stevemar finds reviews | 23:52 | |
| bigjools | oh I vagely remember seeing a review for that | 23:53 |
| stevemar | bigjools, k2k auth plugin: https://review.openstack.org/#/c/172155/ | 23:53 |
| bigjools | that's the badger | 23:53 |
| jamielennox | yea, we need to do some more on the k2k plugin | 23:53 |
| stevemar | bigjools, horizon stuff: https://review.openstack.org/#/c/159910/ | 23:53 |
| stevemar | jamielennox, yes, good feedback on that btw | 23:53 |
| *** hemna is now known as hemnafk | 23:54 | |
| jamielennox | there's a review or a bug or something for exposing service providers via accessinfo which we need, and then a way to expose service providers via auth plugin | 23:54 |
| *** blewis has quit IRC | 23:54 | |
| bigjools | nice one, thanks | 23:54 |
| bigjools | stevemar: is there anything else that needs doing? | 23:55 |
| stevemar | bigjools, reviews are always welcomed! and super necessary | 23:55 |
| bigjools | yeah :) | 23:56 |
| bigjools | I'll dive in this week some time | 23:56 |
| bigjools | how strict do you want it? :) | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!