| *** lhcheng has quit IRC | 00:01 | |
| *** chlong has joined #openstack-keystone | 00:04 | |
| *** mylu has joined #openstack-keystone | 00:25 | |
| *** notmyname has quit IRC | 00:27 | |
| *** notmyname has joined #openstack-keystone | 00:28 | |
| *** Kennan2 is now known as Kennan | 00:33 | |
| *** arunkant__ has joined #openstack-keystone | 00:51 | |
| *** arunkant_ has quit IRC | 00:54 | |
| *** dims__ has joined #openstack-keystone | 00:55 | |
| *** stevemar has quit IRC | 00:55 | |
| *** stevemar has joined #openstack-keystone | 00:56 | |
| *** dims_ has quit IRC | 00:56 | |
| *** mylu has quit IRC | 01:02 | |
| *** dims__ has quit IRC | 01:06 | |
| *** dims_ has joined #openstack-keystone | 01:07 | |
| *** mylu has joined #openstack-keystone | 01:11 | |
| *** dims_ has quit IRC | 01:15 | |
| *** btully has joined #openstack-keystone | 01:17 | |
| *** davechen has joined #openstack-keystone | 01:26 | |
| *** mylu has quit IRC | 01:28 | |
| *** mylu has joined #openstack-keystone | 01:35 | |
| *** mylu has quit IRC | 01:36 | |
| *** lhcheng has joined #openstack-keystone | 01:50 | |
| *** ChanServ sets mode: +v lhcheng | 01:50 | |
| *** jamielennox is now known as jamielennox|away | 01:51 | |
| *** stevemar has quit IRC | 01:51 | |
| *** stevemar has joined #openstack-keystone | 01:52 | |
| *** stevemar has quit IRC | 01:54 | |
| *** lhcheng has quit IRC | 01:54 | |
| *** jamielennox|away is now known as jamielennox | 02:02 | |
| *** ayoung has joined #openstack-keystone | 02:11 | |
| *** ChanServ sets mode: +v ayoung | 02:11 | |
| *** ayoung has quit IRC | 02:16 | |
| *** marzif has quit IRC | 02:22 | |
| *** lhcheng has joined #openstack-keystone | 02:22 | |
| *** ChanServ sets mode: +v lhcheng | 02:22 | |
| *** ayoung has joined #openstack-keystone | 02:28 | |
| *** ChanServ sets mode: +v ayoung | 02:28 | |
| *** hakimo has joined #openstack-keystone | 02:51 | |
| *** stevemar has joined #openstack-keystone | 02:53 | |
| *** hakimo_ has quit IRC | 02:55 | |
| *** piyanai has quit IRC | 02:56 | |
| *** stevemar has quit IRC | 02:58 | |
| *** stevemar_ has joined #openstack-keystone | 02:58 | |
| *** tobe has joined #openstack-keystone | 03:31 | |
| *** BrAsS_mOnKeY has quit IRC | 03:32 | |
| *** jamielennox is now known as jamielennox|away | 03:38 | |
| *** btully has quit IRC | 03:45 | |
| *** jamielennox|away is now known as jamielennox | 03:49 | |
| *** hrou has quit IRC | 03:54 | |
| *** hrou has joined #openstack-keystone | 03:54 | |
| jamielennox | do we have a logout path for saml? | 03:59 |
|---|---|---|
| *** dims_ has joined #openstack-keystone | 04:12 | |
| *** arunkant has joined #openstack-keystone | 04:14 | |
| *** dims__ has joined #openstack-keystone | 04:16 | |
| *** arunkant__ has quit IRC | 04:16 | |
| *** dims_ has quit IRC | 04:18 | |
| *** dims__ has quit IRC | 04:20 | |
| *** dims__ has joined #openstack-keystone | 04:21 | |
| *** dims___ has joined #openstack-keystone | 04:22 | |
| *** dims__ has quit IRC | 04:26 | |
| *** dims___ has quit IRC | 04:27 | |
| *** tobe has quit IRC | 04:51 | |
| bigjools | jamielennox: I've not seen one, assuming you're talking about logging out of the IdP? | 05:12 |
| jamielennox | bigjools: i think it's a SAML or mod_mellon thing, i'm not sure keystone is supposed to handle it | 05:17 |
| jamielennox | bigjools: i think i was confusing myself trying to do the metadata generation | 05:18 |
| bigjools | yeah, this stuff is confusing enough already | 05:18 |
| *** chenhong has joined #openstack-keystone | 05:26 | |
| bigjools | jamielennox: I don't suppose you've tried to use testshib lately have you? | 05:29 |
| *** btully has joined #openstack-keystone | 05:29 | |
| chenhong | hi, May I ask for reviewing for these two changes: https://review.openstack.org/#/c/197184/ and https://review.openstack.org/#/c/187899/ , they adding new test cases | 05:29 |
| jamielennox | bigjools: no, i'm doing all this on centos and i don't think anything shib is packaged there | 05:30 |
| bigjools | fair enough | 05:30 |
| bigjools | you're using mellon I guess? | 05:30 |
| *** chenhong has quit IRC | 05:31 | |
| *** henrynash has joined #openstack-keystone | 05:31 | |
| *** ChanServ sets mode: +v henrynash | 05:31 | |
| jamielennox | bigjools: yes | 05:32 |
| *** chenhong has joined #openstack-keystone | 05:32 | |
| jamielennox | chenhong: reviewed | 05:35 |
| *** arunkant_ has joined #openstack-keystone | 05:37 | |
| chenhong | jamielennox: thanks. I don't quite understand 'you don't need to/shouldn't maintain backwards compatibility in tests. '. Do you mean I should just use the new functions or keep test_v3_assignment.py intact? | 05:38 |
| jamielennox | chenhong: i mean you should just use the new functions | 05:39 |
| chenhong | jamielennox: And you think we should put these new functions in test_v3.AuthTestMixin? | 05:40 |
| *** arunkant has quit IRC | 05:41 | |
| jamielennox | chenhong: i don't know on that one, it's probably going in test_v3 somewhere. I just mean that it should be around other functions that do similar tasks | 05:42 |
| chenhong | jamielennox: well, I thought to put those functions in the TestMixin class. It seems reasonable to put them together. I agree with you. | 05:44 |
| chenhong | jamielennox: I'm going to modify it. Thanks for review. | 05:46 |
| jamielennox | chenhong: np | 05:46 |
| chenhong | jamielennox: B.T.W, what does 'np' mean? | 05:46 |
| jamielennox | chenhong: no problem | 05:47 |
| chenhong | jamielennox: :-) | 05:47 |
| *** dikonoor has joined #openstack-keystone | 05:48 | |
| *** ig0r__ has joined #openstack-keystone | 05:51 | |
| *** ig0r_ has quit IRC | 05:55 | |
| *** arunkant_ has quit IRC | 05:55 | |
| *** scorpio-xiatian has joined #openstack-keystone | 05:59 | |
| *** henrynash has quit IRC | 06:05 | |
| *** dims_ has joined #openstack-keystone | 06:10 | |
| *** hrou has quit IRC | 06:13 | |
| *** dims_ has quit IRC | 06:15 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Centralizing build_role_assignment_* functions https://review.openstack.org/197184 | 06:20 |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Add testcases for list_role_assignments of v3 domains https://review.openstack.org/187899 | 06:25 |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 06:29 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Add testcases for list_role_assignments of v3 domains https://review.openstack.org/187899 | 06:36 |
| *** tobe has joined #openstack-keystone | 06:38 | |
| *** belmoreira has joined #openstack-keystone | 06:53 | |
| *** stevemar_ has quit IRC | 06:56 | |
| *** henrynash has joined #openstack-keystone | 06:57 | |
| *** ChanServ sets mode: +v henrynash | 06:57 | |
| *** browne has quit IRC | 07:04 | |
| *** henrynash has quit IRC | 07:05 | |
| *** tobe has quit IRC | 07:08 | |
| *** dims_ has joined #openstack-keystone | 07:12 | |
| *** dims_ has quit IRC | 07:16 | |
| *** tobe has joined #openstack-keystone | 07:20 | |
| *** ankita_wagh has joined #openstack-keystone | 07:23 | |
| *** mikedillion has joined #openstack-keystone | 07:26 | |
| *** mikedillion has left #openstack-keystone | 07:28 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor: Don't hard code the error code https://review.openstack.org/198623 | 07:30 |
| *** ankita_wagh has quit IRC | 07:34 | |
| *** chlong has quit IRC | 07:35 | |
| *** joe__ has joined #openstack-keystone | 07:36 | |
| *** viktors|afk is now known as viktors | 07:37 | |
| *** joe__ has quit IRC | 07:40 | |
| chenhong | jamielennox: May I ask you to review these two changes again, https://review.openstack.org/#/c/197184/, https://review.openstack.org/#/c/187899/ | 07:46 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the invalid testcase https://review.openstack.org/198629 | 07:53 |
| *** scorpio-xiatian is now known as chengkunye | 07:55 | |
| davechen | chenhong: may be you can add him as the reviewer, he could help to review those patches when he got a chance. :) | 07:56 |
| chenhong | davechen: ok, thanks | 07:56 |
| davechen | chenhong: btw, what do you focus on? upstream or product? just curious, you needn't reply me if this is confidential. :) | 07:59 |
| chenhong | davechen: I think both. If you want, we can talk by other tools, not to disrupt others in irc. :-) | 08:03 |
| *** bdossant has joined #openstack-keystone | 08:18 | |
| *** btully has quit IRC | 08:23 | |
| *** chenhong has quit IRC | 08:50 | |
| *** chenhong has joined #openstack-keystone | 08:53 | |
| *** jamielennox is now known as jamielennox|away | 09:11 | |
| *** stevemar has joined #openstack-keystone | 09:12 | |
| *** stevemar has quit IRC | 09:15 | |
| *** jamielennox|away is now known as jamielennox | 09:18 | |
| *** lufix has joined #openstack-keystone | 09:30 | |
| *** lhcheng has quit IRC | 09:53 | |
| *** davechen has left #openstack-keystone | 09:54 | |
| *** mtruck has joined #openstack-keystone | 09:58 | |
| *** mtruck has quit IRC | 09:59 | |
| *** Kennan has quit IRC | 10:05 | |
| marekd | odyssey4me: ping. | 10:05 |
| odyssey4me | marekd pong :) | 10:06 |
| marekd | odyssey4me: what client did you use for your Friday tests? | 10:06 |
| marekd | odyssey4me: hi, btw :-) | 10:06 |
| odyssey4me | marekd howdy :) hope you had a good weekend! | 10:06 |
| odyssey4me | marekd I was using Horizon for most tests, but eventually extracted the token and was using openstackclient for further tests | 10:07 |
| marekd | and you were using pdb or something like that. | 10:09 |
| marekd | to debug. | 10:09 |
| odyssey4me | marekd nope, I just set nova and keystone to the log level of debug and added extra information to the debug output where necessary | 10:10 |
| *** marzif has joined #openstack-keystone | 10:12 | |
| odyssey4me | marekd I also set Horizon into debug mode | 10:15 |
| marekd | odyssey4me: aha, ok | 10:17 |
| *** Kennan has joined #openstack-keystone | 10:21 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Depend on keystoneauth https://review.openstack.org/186854 | 10:26 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 10:26 |
| *** marzif_ has joined #openstack-keystone | 10:33 | |
| *** chenhong has quit IRC | 10:38 | |
| *** Kennan2 has joined #openstack-keystone | 10:39 | |
| *** Kennan has quit IRC | 10:41 | |
| *** dims_ has joined #openstack-keystone | 10:47 | |
| *** Kennan2 is now known as Kennan | 10:48 | |
| *** dims_ has quit IRC | 10:52 | |
| *** tobe has quit IRC | 11:01 | |
| *** chengkunye has quit IRC | 11:04 | |
| *** chlong has joined #openstack-keystone | 11:05 | |
| *** e0ne has joined #openstack-keystone | 11:17 | |
| *** jaosorior has joined #openstack-keystone | 11:34 | |
| amaretskiy | Hi all! Please review https://review.openstack.org/#/c/188457/ | 11:38 |
| breton | davechen_afk: hi | 11:41 |
| breton | davechen_afk: are messages in https://review.openstack.org/#/c/198280/ visible to the user? | 11:41 |
| *** lhcheng has joined #openstack-keystone | 11:42 | |
| *** ChanServ sets mode: +v lhcheng | 11:42 | |
| *** e0ne has quit IRC | 11:45 | |
| *** lhcheng has quit IRC | 11:47 | |
| *** ajayaa has joined #openstack-keystone | 11:55 | |
| *** e0ne has joined #openstack-keystone | 11:57 | |
| *** bradjones has joined #openstack-keystone | 12:01 | |
| *** bradjones has quit IRC | 12:01 | |
| *** bradjones has joined #openstack-keystone | 12:01 | |
| *** amirosh has joined #openstack-keystone | 12:01 | |
| *** piyanai has joined #openstack-keystone | 12:02 | |
| amirosh | Hello, could somebody check https://review.openstack.org/#/c/198270/ there are two +2 but no workflow | 12:02 |
| *** radez_g0n3 is now known as radez | 12:02 | |
| *** dims_ has joined #openstack-keystone | 12:04 | |
| *** dims_ has quit IRC | 12:08 | |
| *** hrou has joined #openstack-keystone | 12:09 | |
| breton | davechen_afk: nevermind :) | 12:14 |
| *** joe1_ has joined #openstack-keystone | 12:15 | |
| joe1_ | Hello. May I ask keystone v3 questions here? | 12:15 |
| *** nzeer has quit IRC | 12:15 | |
| *** raildo has joined #openstack-keystone | 12:15 | |
| *** nzeer has joined #openstack-keystone | 12:15 | |
| breton | sure | 12:17 |
| joe1_ | 1. I set up keystone v3 (kilo) and created a domain and a domain user by cloud_admin. | 12:19 |
| joe1_ | 2. Authenticate this user with this domain scope. | 12:19 |
| joe1_ | 3. Create a project in this domain. | 12:20 |
| joe1_ | 4. Now I wanna list projects with the same token that created the project. | 12:20 |
| joe1_ | All I got is "You are not authorized to perform the requested action: identity:list_projects". | 12:20 |
| joe1_ | If I take out the rule domain_id:%(domain_id)s in policy.v3cloudsample.json for "identity:list_projects", everything works well. | 12:20 |
| joe1_ | Why cannot I list projects with the rule domain_id:%(domain_id)s? | 12:20 |
| joe1_ | Thanks. | 12:21 |
| *** edmondsw has joined #openstack-keystone | 12:24 | |
| *** gordc has joined #openstack-keystone | 12:27 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Depend on keystoneauth https://review.openstack.org/186854 | 12:27 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Depend on keystoneauth https://review.openstack.org/186854 | 12:28 |
| breton | in my policy.v3cloudsample.json from kilo I have | 12:28 |
| breton | "identity:list_projects": "rule:cloud_admin or rule:admin_and_matching_domain_id", | 12:28 |
| breton | "admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s" | 12:29 |
| breton | "admin_required": "role:admin", | 12:29 |
| *** afaranha has joined #openstack-keystone | 12:31 | |
| *** afaranha has left #openstack-keystone | 12:31 | |
| joe1_ | It still has "domain_id:%(domain_id)s". I got token with domain scope and list the project in the domain. It seems to be verified failed with this rule. | 12:31 |
| *** ajayaa has quit IRC | 12:38 | |
| *** jraim has quit IRC | 12:43 | |
| *** jraim has joined #openstack-keystone | 12:43 | |
| breton | joe1_: do you specify a domain when try to list projects? | 12:45 |
| *** jecarey has quit IRC | 12:46 | |
| joe1_ | How do I SEPCIFY a domain? Doesn't it get a token with domain scope? | 12:46 |
| breton | joe1_: it does. But that's just token and you (I think) make a request to list all projects. You need to pass domain using something like http://keystone:35357/v3/projects/?domain_id=your_domain | 12:48 |
| *** stevemar has joined #openstack-keystone | 12:51 | |
| joe1_ | Work! It works. | 12:53 |
| *** stevemar has quit IRC | 12:55 | |
| *** dims_ has joined #openstack-keystone | 12:55 | |
| joe1_ | But Identity API v3 on OpenStack.org about listing projects only presents "/v3/projects" without any filter in URI. | 12:55 |
| breton | joe1_: go to http://developer.openstack.org/api-ref-identity-v3.html#listProjects , click "detail" | 12:57 |
| *** dims__ has joined #openstack-keystone | 12:57 | |
| joe1_ | Yes. I saw it. Filters on domain...... | 12:57 |
| *** e0ne is now known as e0ne_ | 12:57 | |
| joe1_ | So "domain_id:%(domain_id)s", the first domain_id means the domain in token and the second one means domain in URI filter, right? | 12:58 |
| *** csoukup has joined #openstack-keystone | 12:59 | |
| *** amirosh_ has joined #openstack-keystone | 12:59 | |
| *** dims___ has joined #openstack-keystone | 13:00 | |
| *** dims_ has quit IRC | 13:00 | |
| *** dims_ has joined #openstack-keystone | 13:01 | |
| *** amirosh has quit IRC | 13:03 | |
| *** amirosh_ has quit IRC | 13:03 | |
| *** dims__ has quit IRC | 13:03 | |
| joe1_ | Thanks. breton | 13:04 |
| *** dims___ has quit IRC | 13:05 | |
| *** dims__ has joined #openstack-keystone | 13:06 | |
| marekd | lbragstad: dolph. Hi. I have a fernet token intercepted, I would like now to be able to see what it was built from (original data), any easy way to do this? | 13:07 |
| marekd | dolphm: ^^ | 13:09 |
| *** dims_ has quit IRC | 13:09 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 13:11 |
| *** dims__ has quit IRC | 13:11 | |
| *** chengkunye has joined #openstack-keystone | 13:12 | |
| *** dsirrine has joined #openstack-keystone | 13:14 | |
| *** henrynash has joined #openstack-keystone | 13:16 | |
| *** ChanServ sets mode: +v henrynash | 13:16 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:24 | |
| *** annasort has joined #openstack-keystone | 13:24 | |
| *** davidckennedy has joined #openstack-keystone | 13:24 | |
| *** e0ne_ is now known as e0ne | 13:24 | |
| *** TheIntern has joined #openstack-keystone | 13:24 | |
| *** lhcheng has joined #openstack-keystone | 13:31 | |
| *** ChanServ sets mode: +v lhcheng | 13:31 | |
| davidckennedy | Hello, I'm getting an issue trying to run tox in keystone: | 13:32 |
| davidckennedy | ValueError: ("Expected ',' or end-of-list in", "python-ldap>=2.4;python_version=='2.7'", 'at', ";python_version=='2.7'") | 13:32 |
| davidckennedy | ERROR: could not install deps [-r/home/david/development/git_repositories/keystone_wip/requirements.txt, -r/home/david/development/git_repositories/keystone_wip/test-requirements.txt] | 13:32 |
| *** mylu has joined #openstack-keystone | 13:32 | |
| davidckennedy | Has anyone any suggestions? This is on master so I'm a little suprised. | 13:33 |
| *** browne has joined #openstack-keystone | 13:33 | |
| *** btully has joined #openstack-keystone | 13:34 | |
| *** amakarov_away is now known as amakarov | 13:34 | |
| *** jsavak has joined #openstack-keystone | 13:35 | |
| *** lhcheng has quit IRC | 13:36 | |
| *** davechen has joined #openstack-keystone | 13:36 | |
| marekd | davidckennedy: versions mismatching? | 13:37 |
| marekd | have you tried tox -r ? | 13:37 |
| davechen | breton: ping? :) | 13:37 |
| davechen | breton: are you around? | 13:37 |
| amakarov | davechen, hi! He'll return 2 hours later | 13:38 |
| *** chlong has quit IRC | 13:39 | |
| davechen | amakarov: thanks, that fine. I will reply him and may catch him in the next day. | 13:39 |
| *** chlong has joined #openstack-keystone | 13:40 | |
| *** zzzeek has joined #openstack-keystone | 13:40 | |
| *** ajayaa has joined #openstack-keystone | 13:41 | |
| lbragstad | marekd: do you have the key that was used to generate the token? | 13:43 |
| *** lastops has joined #openstack-keystone | 13:43 | |
| lbragstad | marekd: you should be able to do something like this if you have the key http://cdn.pasteraw.com/nm4zd59j6551enibxjz03zr92oysaca | 13:44 |
| *** richm has joined #openstack-keystone | 13:45 | |
| davechen | lbragstad, marekd: hi, may I ask you a question? | 13:46 |
| davidckennedy | Thanks marekd, I'll take another look in a little while. Doesn't see to help. I've blown away my venv and recreated as far as possible but maybe I've missed something. | 13:46 |
| *** davidckennedy has quit IRC | 13:46 | |
| davechen | maybe quite easy for you guys, but i am not quite sure about it. | 13:47 |
| davechen | can we get the exception message if we invoke the method like 'self.post'? | 13:47 |
| *** ctracey has quit IRC | 13:47 | |
| *** ctracey has joined #openstack-keystone | 13:48 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Enable retrieval of default values of domain config options https://review.openstack.org/185650 | 13:49 |
| *** henrynash has quit IRC | 13:49 | |
| *** lxsli has joined #openstack-keystone | 13:51 | |
| lxsli | Hi there, when Keystone starts up it seems to need 5 seconds settle time before it will accept requests. Does anyone know what it's doing in that time please? And is there a way to tell it not to say it's started until it really, really is? | 13:53 |
| lbragstad | davechen: for what exactly? (I might be missing some context here) | 13:53 |
| lbragstad | lxsli: how are you running Keystone (i.e. Apache/Eventlet)? | 13:54 |
| lxsli | lbragstad: via Apache | 13:54 |
| davechen | lbragstad: ah, acutally, that's the patch you may reviewed for an while. | 13:54 |
| lxsli | in a modwsgi container I believe | 13:54 |
| davechen | https://review.openstack.org/#/c/195903/ | 13:54 |
| lbragstad | davechen: thanks | 13:54 |
| davechen | lbragstad: this is the link, can you help to give a look at Boris's comments. | 13:55 |
| lbragstad | lxsli: what does Keystone do after you start apache? Does is deny requests, or just hang? | 13:55 |
| davechen | lbragstad:why thanks me, :) | 13:55 |
| lbragstad | davechen: yep | 13:55 |
| davechen | lbragstad: i need thanks you instead. | 13:55 |
| lbragstad | davechen: you saved me from going to dig for the link! | 13:55 |
| davechen | lbragstad: :P | 13:55 |
| *** r-daneel has joined #openstack-keystone | 13:56 | |
| davechen | lbragstad: I once considered to fetch the error message via rest api calls, such as self.post, self.patch etc. | 13:56 |
| davechen | lbragstad: but it's seems impossible. | 13:57 |
| lxsli | lbragstad: the client connects but the server doesn't send a response | 13:57 |
| davechen | lbragstad: And I know Boris want us to to do like that, is that really possible? | 13:57 |
| davechen | If not possible, I can just reply to him that's impossible since that's not the way we fetch the error message. | 13:58 |
| davechen | lbragstad: and Lance, thanks for you comment in the initial patch, as you said, we need address three cases, so far, the last patch will be submit soon to address the last case you metioned, possbily tomorrow in my time. | 14:00 |
| lbragstad | davechen: hmmm, interesting... so we want to do a separate post to keystone to retrieve an error message from a previous call? | 14:01 |
| lbragstad | not sure I'm understanding that right | 14:01 |
| lbragstad | lxsli: what does your apache config look like? | 14:02 |
| *** jecarey_ has joined #openstack-keystone | 14:02 | |
| davechen | lbragstad: may be not. | 14:02 |
| davechen | lbragstad: what I did right now to fetch the exception message is by this way: `e = self.assertRaises(exception.ValidationError`, you see this in the patch. | 14:03 |
| lbragstad | lxsli: we've done some perf testing against a keystone cluster with this config https://github.com/dolph/keystone-deploy/blob/master/playbooks/roles/keystone/templates/apache/keystone.vhost | 14:04 |
| lbragstad | lxsli: ^ if that helps you | 14:04 |
| dstanek | davechen: why are you creating controllers and catching exceptions in that patch? the v3 tests should be web based and use the client | 14:04 |
| lxsli | lbragstad: I'll have to go and check, thanks for now | 14:04 |
| lbragstad | lxsli: yep | 14:05 |
| davechen | lbragstad: beacuse, we need fetch the exception and verfiy that exception is really helpful for end user. | 14:05 |
| davechen | lbragstad: exception message. | 14:05 |
| davechen | dstanek: sorry, since we need the exception message. | 14:06 |
| dstanek | davechen: that's not the place for those types of tests. if you wanted to do a web request and check the body then that's different | 14:06 |
| *** r-daneel has quit IRC | 14:07 | |
| davechen | dstanek: I don't want to check the body, just want to check the exception message, as the bug desc, current exeption is not useful, it's python error. | 14:08 |
| dstanek | davechen: right. so the tests don't belong there. | 14:09 |
| davechen | dstanek: where? | 14:09 |
| davechen | dstanek: where they should belong? | 14:09 |
| davechen | dstanek: do you know if it possible to fetch the exception message if we do a web request like 'self.post'? | 14:10 |
| *** Ephur has joined #openstack-keystone | 14:11 | |
| davechen | dstanek: if we could, then it seems okay to align with other testcases, but seems it's impossible. | 14:12 |
| dstanek | davechen: why do you need the exception message? why not just check the returned body? | 14:13 |
| davechen | dstanek: good question :), that | 14:13 |
| dstanek | davechen: why isn't the validation catching this already? | 14:14 |
| *** stevemar has joined #openstack-keystone | 14:15 | |
| davechen | dstanek: that's what the patch want to address the bug. | 14:15 |
| davechen | dstanek: currently, it will return python error, that kinds of error is not useful for the end use. | 14:15 |
| davechen | dstanek: let | 14:15 |
| davechen | dstanek: let's paste the bug link, one mins. | 14:15 |
| dstanek | davechen: i read the bug already | 14:15 |
| dstanek | what i don't get is why the schema validation isn't catching this | 14:15 |
| davechen | if there is no request body, it will not go to schema validation. | 14:16 |
| marekd | davechen: sure | 14:16 |
| dstanek | davechen: really? why not? | 14:17 |
| marekd | lbragstad: sorry, missed your msg. | 14:17 |
| davechen | it will go to the api, but parameters number is not matched at all, so the python error is throw | 14:17 |
| marekd | lbragstad: the token was generated by my server, so yes, I can have whatever I need. | 14:17 |
| davechen | dstanek: mins, let's me paste the code link. | 14:17 |
| *** amirosh has joined #openstack-keystone | 14:18 | |
| dstanek | maybe keystone.common.validation.validated is broken | 14:18 |
| davechen | https://github.com/openstack/keystone/blob/master/keystone/common/validation/__init__.py#L34. | 14:18 |
| lbragstad | marekd: then that should be the process for viewing the payload of the token, without having to give it back to keystone | 14:19 |
| dstanek | in what case is that the right thing to do? | 14:19 |
| davechen | see this line, since resource_to_validate is *not* in kwargs, then it will go to API | 14:19 |
| *** bdossant has quit IRC | 14:20 | |
| lbragstad | davechen: I think that is because the keyword arguments aren't matching and it's throwing a python error, which happens before the validation module can do anything about it | 14:20 |
| *** r-daneel has joined #openstack-keystone | 14:20 | |
| lbragstad | I think? | 14:20 |
| davechen | dstanek: so, I think we need check it in the controller layer, if no parameter is passed in, it will raise the ValidationError exception. | 14:20 |
| *** woodster_ has joined #openstack-keystone | 14:21 | |
| dstanek | davechen: read my comments above | 14:21 |
| davechen | lbragstad: cannot agree more with you. :) | 14:21 |
| dstanek | lbragstad: no, the decorator is called first. | 14:21 |
| *** mylu has quit IRC | 14:21 | |
| dstanek | lbragstad: the decorator decides not to validate the request and i can't think of a case where that's the correct behavior | 14:22 |
| *** mylu has joined #openstack-keystone | 14:22 | |
| davechen | dstanek, lbragstad, decorator is called first but it will skip if there is no parameters passed in. | 14:22 |
| lbragstad | this is on a post operation, | 14:22 |
| lbragstad | oh... | 14:22 |
| dstanek | davechen: right :-) so you don't agree with lbragstad | 14:23 |
| lbragstad | I would expect the validation module to fail and thrown an error because it can't find the required attributes in the request, even if the request is non | 14:23 |
| lbragstad | none* | 14:23 |
| davechen | dstanek, my mistake. | 14:23 |
| davechen | lbragstad: see this line: https://github.com/openstack/keystone/blob/master/keystone/common/validation/__init__.py#L34 | 14:23 |
| davechen | dstanek, lbragstad, so I think if the parameters is not passed in, we should catch it in the controller layer. | 14:24 |
| dstanek | davechen: why wouldn't we want the validation to catch it? | 14:24 |
| lbragstad | why can't we make the validation layer look in args too? | 14:24 |
| lbragstad | it'd be nice to have all the validation logic in one place | 14:25 |
| lbragstad | instead of all over the different controllers | 14:25 |
| davechen | dstanek: validation current designed cannot do that. | 14:25 |
| dstanek | right, otherwise you'll have to change controllers all over the place | 14:25 |
| lbragstad | can't we change the validation logic | 14:25 |
| dstanek | davechen: why? just delete the if? | 14:25 |
| davechen | hmmm... | 14:26 |
| lbragstad | or look for the resource to validate in the args too | 14:26 |
| lbragstad | (and the kwargs)? | 14:26 |
| davechen | kwargs[resource_to_validate] | 14:26 |
| lbragstad | dstanek: probably has a more elegant way to fix that | 14:26 |
| dstanek | i think it's already passed as kwargs | 14:26 |
| davechen | what will this being? kwargs[resource_to_validate] | 14:27 |
| lbragstad | davechen: it's that just being passed in as None? | 14:27 |
| dstanek | it's empty right now in the error case | 14:27 |
| lbragstad | kwargs['service'] = None | 14:27 |
| davechen | lbragstad: I think so. | 14:27 |
| dstanek | lbragstad: i think the key just won't exist | 14:28 |
| dstanek | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/wsgi.py#n240 | 14:28 |
| davechen | lbragstad, dstanek, resource to validate this kind of issue seems okay. | 14:29 |
| dstanek | arguments are always passed to controller methods as kwargs (not the context though) | 14:29 |
| dstanek | in theory you can remove the 'if' and change the item lookup to a .get() | 14:29 |
| dstanek | i don't know if that would break other cases | 14:30 |
| *** topol has joined #openstack-keystone | 14:30 | |
| *** ChanServ sets mode: +v topol | 14:30 | |
| *** blewis has joined #openstack-keystone | 14:30 | |
| davechen | dstanek: seems a good approach, need have a debug on that. :) | 14:32 |
| *** marzif_ has quit IRC | 14:32 | |
| *** marzif_ has joined #openstack-keystone | 14:33 | |
| *** bdossant has joined #openstack-keystone | 14:33 | |
| davechen | dstanek, lbragstad: if get none, jsonschema will not has the useful message as well. | 14:34 |
| davechen | dstanek, lbragstad: it will throw no enough properties, and nothing more. | 14:34 |
| davechen | dstanek, lbragstad: it's thrown by the jsonschema. | 14:35 |
| *** bdossant has quit IRC | 14:35 | |
| davechen | dstanek, lbragstad, marekd, thanks guys for your input, let's stick to current approach until we find a better one. I will reply to Brois comment in each of the patch, sirs, pls kindly drop your comments if there is a good way to fix it. | 14:40 |
| amaretskiy | Sirs, can someone review patch https://review.openstack.org/#/c/188457/ | 14:45 |
| *** davechen has left #openstack-keystone | 14:45 | |
| dstanek | davechen_afk: i don't understand why you can't change validated() | 14:46 |
| *** mylu has quit IRC | 14:48 | |
| *** chenhong has joined #openstack-keystone | 14:52 | |
| *** Lactem has joined #openstack-keystone | 15:00 | |
| *** Ephur has quit IRC | 15:01 | |
| *** jsavak has quit IRC | 15:03 | |
| *** jsavak has joined #openstack-keystone | 15:04 | |
| *** slberger has joined #openstack-keystone | 15:04 | |
| *** serverascode has quit IRC | 15:05 | |
| *** serverascode has joined #openstack-keystone | 15:07 | |
| *** dims_ has joined #openstack-keystone | 15:09 | |
| *** viktors is now known as viktors|afk | 15:09 | |
| *** markvoelker has quit IRC | 15:14 | |
| *** lhcheng has joined #openstack-keystone | 15:20 | |
| *** ChanServ sets mode: +v lhcheng | 15:20 | |
| *** jsavak has quit IRC | 15:21 | |
| *** jsavak has joined #openstack-keystone | 15:21 | |
| *** lhcheng has quit IRC | 15:25 | |
| marekd | lbragstad: the token i should use is AccessInfo.auth_token roght? | 15:26 |
| marekd | right? | 15:26 |
| *** belmoreira has quit IRC | 15:27 | |
| lbragstad | ? | 15:27 |
| lbragstad | marekd: are you talking about the token to decrypt? | 15:27 |
| marekd | i get a token in a client | 15:27 |
| lbragstad | yeah | 15:27 |
| marekd | fernetfed token. | 15:27 |
| marekd | it's usually AccessInfo instance, so I the token to be decrypted is access.auth_token | 15:27 |
| marekd | (making sure) | 15:27 |
| lbragstad | I haven't tested that I don't think, it should be | 15:28 |
| lbragstad | I'm not sure | 15:28 |
| marekd | and the key is one of the files from server's /etc/keystone/fernet-keys | 15:28 |
| marekd | i have two files there 0 and 1, which one is better? | 15:28 |
| lbragstad | marekd: yeah, which ever key was primary | 15:28 |
| lbragstad | use 1 | 15:28 |
| marekd | ok | 15:28 |
| lbragstad | so cat the contents of it and use that string in the Fernet() instantiation from cryptography | 15:29 |
| *** davechen has joined #openstack-keystone | 15:29 | |
| marekd | hm, it raises InvalidToken | 15:30 |
| *** tjcocozz has joined #openstack-keystone | 15:30 | |
| lbragstad | marekd: how long do your tokens live? | 15:31 |
| lbragstad | marekd: cryptography does the validation of the token expiry *in* cryptography | 15:31 |
| lbragstad | marekd: so, if it's a stale token, it will be invalid | 15:31 |
| marekd | lbragstad: standard devstack expiration, but i am generating the token and trying them out seconds later. | 15:31 |
| lbragstad | ok | 15:31 |
| davechen | dstanek: Just reply all of your comments in that patch, pls kindly let me know if there is any other concerns. I need heads off to bed. Have a good day, sir. | 15:32 |
| *** amirosh has quit IRC | 15:32 | |
| *** davechen has left #openstack-keystone | 15:32 | |
| *** amirosh has joined #openstack-keystone | 15:32 | |
| *** amirosh has quit IRC | 15:37 | |
| openstackgerrit | Richard Megginson proposed openstack/keystone: add federation docs for mod_auth_mellon https://review.openstack.org/198083 | 15:37 |
| dstanek | davechen_afk: i'll propose an alternative patch | 15:37 |
| *** Lactem has quit IRC | 15:38 | |
| *** slberger has quit IRC | 15:40 | |
| *** thedodd has joined #openstack-keystone | 15:42 | |
| *** btully has quit IRC | 15:47 | |
| mordred | morganfainberg: morning! so - if an ansible user comes up to me and asks about using an "admin token" with keystone for bootstrapping purposes ... | 15:47 |
| *** henrynash has joined #openstack-keystone | 15:47 | |
| *** ChanServ sets mode: +v henrynash | 15:47 | |
| *** zhiyan has quit IRC | 15:47 | |
| *** gyee has joined #openstack-keystone | 15:47 | |
| *** ChanServ sets mode: +v gyee | 15:47 | |
| mordred | morganfainberg: I'm correct at pointing them to the token_url auth plugin, yeah? | 15:47 |
| *** zhiyan has joined #openstack-keystone | 15:47 | |
| *** jkomg has joined #openstack-keystone | 15:48 | |
| stevemar | richm: your patch was gating lol | 15:49 |
| morganfainberg | mordred: ahaha. Guess i cant lurk here too much more this morning :P | 15:49 |
| stevemar | richm: could have done the changes in a follow on patch | 15:49 |
| mordred | morganfainberg: oops. I outed you | 15:49 |
| morganfainberg | mordred: token_url ? I am unfamiliar with this one | 15:49 |
| mordred | uh - or whatever the one is that is token based | 15:49 |
| mordred | token_endpoint | 15:50 |
| morganfainberg | mordred: admin token is special for bootstrapping. It should work. But honestly i want to kill yhat whole thing and male bootstrap part of keystone-manage | 15:50 |
| morganfainberg | Wow. Typos | 15:50 |
| morganfainberg | Make* | 15:50 |
| * morganfainberg kills non autocorrect phone today. | 15:50 | |
| mordred | well...... | 15:50 |
| mordred | sake of argument here ... | 15:51 |
| morganfainberg | But the token plugin should work. | 15:51 |
| morganfainberg | Afaik | 15:51 |
| morganfainberg | The one you said because it doesnt need a catalog | 15:51 |
| mordred | if you make it part of keystone-manage, I'm then probably going to need to write a keystone-manage ansible module separate from the os-keystone-service and os-keystone-endpoint modules | 15:51 |
| mordred | which is fine | 15:51 |
| mordred | but also is different than normal day to day operations | 15:52 |
| mordred | it's possible this is the right choice - I have very few opinions on this subject | 15:52 |
| dstanek | morganfainberg: interesting idea. how would you do that? more like django fixtures? | 15:52 |
| morganfainberg | The reason is it means you dont need to restart keystone to make it secure. Thibk of admin token as a root passwd | 15:52 |
| dstanek | right now i bootstrap in ansible by using auth_token and remove it when i am done | 15:52 |
| mordred | morganfainberg: so what actions do you do with the admin token? | 15:52 |
| morganfainberg | dstanek: kindof. | 15:53 |
| morganfainberg | mordred: usually, create a basic user, project, and admin role on the project | 15:53 |
| morganfainberg | Then you do the rest kf the setup | 15:53 |
| * mordred assumes a domain too ... since the world is keystone v3 of course :) | 15:53 | |
| morganfainberg | The admin token is a passwordtype thing in the keystone.conf and a special middleware that gives admin access | 15:53 |
| morganfainberg | Default domain is created with migrations. | 15:54 |
| morganfainberg | So we jusy usually use that. | 15:54 |
| mordred | ah - well, I can certainly see doing something that doesn't require a special middleware | 15:54 |
| mordred | because that does seem a bit craycray | 15:54 |
| morganfainberg | mordred: yeah. And not requiring a restsrt to make keystone secure is good. | 15:54 |
| morganfainberg | We could also just bootstrap a user with migrations like we do domain. But i feel like that will leave to insecure default deploys. | 15:56 |
| * morganfainberg goes for a bike ride. | 15:56 | |
| morganfainberg | Be back in a bit. | 15:56 |
| richm | stevemar: ? | 15:58 |
| stevemar | richm: i had approved your patch | 15:59 |
| richm | ah, sorry | 15:59 |
| richm | do I need revoke my latest patch and submit a new one? | 16:00 |
| *** slberger has joined #openstack-keystone | 16:02 | |
| marekd | odyssey4me: hi | 16:03 |
| stevemar | richm: nah, we can just re-approve | 16:03 |
| *** rwsu has joined #openstack-keystone | 16:04 | |
| *** markvoelker has joined #openstack-keystone | 16:10 | |
| *** _hrou_ has joined #openstack-keystone | 16:11 | |
| *** hrou has quit IRC | 16:12 | |
| * morganfainberg sneaks out while no one is looking. Shhhh. | 16:13 | |
| odyssey4me | marekd o/ | 16:17 |
| marekd | odyssey4me: i am looking at fenet + fed tokens. | 16:17 |
| *** ankita_wagh has joined #openstack-keystone | 16:17 | |
| marekd | i can list images | 16:17 |
| marekd | but yeah, something is crashing on nova for instance. | 16:17 |
| marekd | Can you giv me more details on what exactly crashes? | 16:17 |
| marekd | updating bug is fine. | 16:18 |
| marekd | it will be attached to the bug history | 16:18 |
| odyssey4me | marekd interesting that you can get an image list - I couldn't get anything at all | 16:18 |
| odyssey4me | I was getting a crash simply on trying to list instances | 16:18 |
| marekd | list instances is different than listing images. | 16:19 |
| stevemar | gordc: wth is up with rbac in ceilometer :P | 16:20 |
| odyssey4me | marekd so I saw the crash in nova-api-os-compute when trying to list instances - the error appeared to be that the token wasn't scoped to the project | 16:20 |
| odyssey4me | marekd note that the error was seen when using websso with horizon | 16:21 |
| marekd | odyssey4me: oh, wait | 16:22 |
| marekd | and how about CLI ? | 16:22 |
| odyssey4me | marekd through CLI the issue was also there when using the same token that was provided to horizon | 16:22 |
| marekd | let's cut off Horizon for now. | 16:23 |
| marekd | did CLI work by itself? | 16:23 |
| odyssey4me | marekd when using an internal user, everything worked fine | 16:24 |
| marekd | odyssey4me: no, federated user. | 16:24 |
| odyssey4me | when using a federated user, it did not | 16:24 |
| marekd | odyssey4me: ok, and what was the error when you tried to list images from glance? | 16:24 |
| marekd | because it works for me. | 16:24 |
| *** btully has joined #openstack-keystone | 16:24 | |
| gordc | stevemar: you asked this question 1 month ago | 16:24 |
| marekd | lbragstad: o/ | 16:25 |
| odyssey4me | I didn't try accessing glance - I got a little fixated on the nova issue :/ | 16:25 |
| marekd | lbragstad: remind me, when we use fernet federated tokens, we store groups in the token, right? | 16:25 |
| lbragstad | marekd: o/ | 16:25 |
| *** ankita_wagh has quit IRC | 16:25 | |
| lbragstad | marekd: yes | 16:25 |
| lbragstad | marekd: https://github.com/openstack/keystone/blob/992d9ecbf4f563c42848147d4d66f8ec8efd4df0/keystone/token/providers/fernet/token_formatters.py#L512-L514 | 16:26 |
| marekd | ok, so I have a funny situation, where I get a fed fernet token , scoped to a valid project, I can then list images for that project, but my token (glance logs) look like this: http://cdn.pasteraw.com/crbcl7gsj2kx5eqq0o11yrwi5q73qbf | 16:26 |
| odyssey4me | marekd it seemed to me that the lack of groups in the token was the issue, and it seemed that the mapping was being done right, but the fernet token was somehow missing the groups in the token... whereas uuid tokens were perfectly fine | 16:27 |
| marekd | odyssey4me: yep | 16:27 |
| marekd | odyssey4me: and...actually i am not so sure, without groups keystone should return HTTP 401 | 16:27 |
| odyssey4me | marekd yep, you've got the same missing groups issue that I had - happy to see it validated! | 16:27 |
| *** jk|osx has joined #openstack-keystone | 16:29 | |
| *** chenhong has quit IRC | 16:30 | |
| marekd | odyssey4me: yes but on the other hand I can interacti with glance.... | 16:30 |
| marekd | let me do another test. | 16:30 |
| odyssey4me | marekd that could very easily be a failure in the glance api somewhere :o | 16:31 |
| *** jkomg has quit IRC | 16:32 | |
| lbragstad | marekd: that's strange, because the fernet provider is using the same logic to issue_v3_tokens that the uuid provider is https://github.com/openstack/keystone/blob/992d9ecbf4f563c42848147d4d66f8ec8efd4df0/keystone/token/providers/common.py#L496 | 16:33 |
| lbragstad | https://github.com/openstack/keystone/commit/91a0b29809cb71c1b2df1642d6c34a3f60a801ed | 16:33 |
| odyssey4me | marekd I've got to run, but I'll be online tomorrow again. Thanks again for looking into this! | 16:34 |
| *** chengkunye has quit IRC | 16:35 | |
| *** jaosorior has quit IRC | 16:36 | |
| *** packet has joined #openstack-keystone | 16:39 | |
| *** sp4wnr0ot_ has joined #openstack-keystone | 16:42 | |
| openstackgerrit | Nathan Jewell proposed openstack/keystone: Saves output of run_tests.sh to .log file https://review.openstack.org/196285 | 16:43 |
| *** Akshay00 has joined #openstack-keystone | 16:43 | |
| *** ankita_wagh has joined #openstack-keystone | 16:44 | |
| *** ankita_wagh has quit IRC | 16:46 | |
| *** ankita_wagh has joined #openstack-keystone | 16:46 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 16:46 |
| *** e0ne has quit IRC | 16:47 | |
| openstackgerrit | Nathan Jewell proposed openstack/keystone: Saves output of run_tests.sh to .log file https://review.openstack.org/196285 | 16:47 |
| marekd | lbragstad: i think we have a problem.... | 16:49 |
| lbragstad | marekd: ? | 16:50 |
| *** mylu has joined #openstack-keystone | 16:51 | |
| *** tqtran has joined #openstack-keystone | 16:53 | |
| marekd | lbragstad: looks like we need another fernet format. | 16:57 |
| marekd | lbragstad: for federated *scoped* token | 16:57 |
| *** shaleh has joined #openstack-keystone | 16:58 | |
| *** _cjones_ has joined #openstack-keystone | 17:00 | |
| marekd | lbragstad: look what happens: we first get unscoped token, and there we only need some OS-FEDERATION information like groups - and then token_provider works fine. But later, a user wants to scope his token, and have brand new token with project/domain inside but also some OS-FEDERATION leftovers (no groups this time) | 17:00 |
| marekd | lbragstad: see http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-federation-ext.html#request-a-scoped-os-federation-token | 17:01 |
| *** amaretskiy has quit IRC | 17:03 | |
| *** lhcheng has joined #openstack-keystone | 17:03 | |
| *** ChanServ sets mode: +v lhcheng | 17:03 | |
| *** tjcocozz has quit IRC | 17:03 | |
| *** _hrou_ has quit IRC | 17:04 | |
| *** _hrou_ has joined #openstack-keystone | 17:04 | |
| *** Akshay00 has quit IRC | 17:05 | |
| *** Akshay00 has joined #openstack-keystone | 17:06 | |
| *** piyanai has quit IRC | 17:09 | |
| *** henrynash has quit IRC | 17:14 | |
| *** lhcheng_ has joined #openstack-keystone | 17:18 | |
| *** lhcheng has quit IRC | 17:20 | |
| *** jk|osx has quit IRC | 17:21 | |
| *** jk|osx has joined #openstack-keystone | 17:22 | |
| openstackgerrit | Richard Megginson proposed openstack/keystone: add federation docs for mod_auth_mellon https://review.openstack.org/198083 | 17:24 |
| *** btully has quit IRC | 17:26 | |
| *** albertom has quit IRC | 17:28 | |
| *** marzif_ has quit IRC | 17:28 | |
| *** iamjarvo has joined #openstack-keystone | 17:29 | |
| *** jsavak has quit IRC | 17:32 | |
| *** jsavak has joined #openstack-keystone | 17:32 | |
| lbragstad | marekd: ah, that makes sense | 17:32 |
| lbragstad | marekd: yeah, that's not supported by the current federated tokenm | 17:33 |
| lbragstad | federated fernet token | 17:33 |
| *** solomondg has joined #openstack-keystone | 17:34 | |
| marekd | lbragstad: I will be on a leave until next Monday, but if you don't do this by that time I will be happy to work on it together during the meetup. | 17:34 |
| marekd | Actually this would be nice topic for those 3 days. | 17:34 |
| lbragstad | marekd: agreed, I have a pretty tight schedule at the moment, but working on this at the meetup is a great idea | 17:35 |
| marekd | lbragstad: cool | 17:35 |
| lbragstad | marekd: thanks for reporting it, do you think we need a blueprint for this or a bug? | 17:35 |
| *** albertom has joined #openstack-keystone | 17:35 | |
| marekd | lbragstad: it was not me reporting, i just confirmed and maanaged to trace down (i think) the reason: https://bugs.launchpad.net/keystone/+bug/1471289 | 17:36 |
| openstack | Launchpad bug 1471289 in Keystone "Fernet tokens and Federated Identities result in token scope failures" [Undecided,Confirmed] - Assigned to Marek Denis (marek-denis) | 17:36 |
| *** amit213 has quit IRC | 17:39 | |
| *** amit213 has joined #openstack-keystone | 17:39 | |
| *** amit213 has quit IRC | 17:40 | |
| *** amit213 has joined #openstack-keystone | 17:40 | |
| *** amit213 has quit IRC | 17:41 | |
| *** amit213 has joined #openstack-keystone | 17:42 | |
| *** amit213 has quit IRC | 17:42 | |
| *** amit213 has joined #openstack-keystone | 17:42 | |
| *** topol has quit IRC | 17:45 | |
| *** slberger has quit IRC | 17:45 | |
| *** mylu has quit IRC | 17:50 | |
| *** janonymous has joined #openstack-keystone | 17:53 | |
| *** e0ne has joined #openstack-keystone | 17:54 | |
| *** jk|osx is now known as jkomg | 17:55 | |
| *** jaosorior has joined #openstack-keystone | 17:59 | |
| *** mylu has joined #openstack-keystone | 17:59 | |
| *** fangzhou has joined #openstack-keystone | 18:00 | |
| *** ankita_w_ has joined #openstack-keystone | 18:00 | |
| *** ankita_wagh has quit IRC | 18:03 | |
| *** Kennan2 has joined #openstack-keystone | 18:03 | |
| *** Kennan has quit IRC | 18:04 | |
| *** e0ne is now known as e0ne_ | 18:04 | |
| *** slberger has joined #openstack-keystone | 18:06 | |
| *** Lactem has joined #openstack-keystone | 18:07 | |
| *** gyee has quit IRC | 18:07 | |
| *** med_` is now known as med_ | 18:07 | |
| *** med_ has joined #openstack-keystone | 18:07 | |
| *** Lactem has quit IRC | 18:08 | |
| *** jsavak has quit IRC | 18:12 | |
| *** jsavak has joined #openstack-keystone | 18:12 | |
| *** nathan has joined #openstack-keystone | 18:13 | |
| nathan | d | 18:13 |
| *** nathan has quit IRC | 18:14 | |
| *** nathanj has joined #openstack-keystone | 18:14 | |
| *** nathanj has quit IRC | 18:14 | |
| *** dims_ has quit IRC | 18:20 | |
| *** jsavak has quit IRC | 18:20 | |
| *** jk|osx has joined #openstack-keystone | 18:23 | |
| *** jsavak has joined #openstack-keystone | 18:23 | |
| *** jkomg has quit IRC | 18:24 | |
| *** dikonoor has quit IRC | 18:24 | |
| *** mylu has quit IRC | 18:24 | |
| *** e0ne_ is now known as e0ne | 18:24 | |
| *** ajayaa has quit IRC | 18:26 | |
| *** Akshay00 has quit IRC | 18:28 | |
| *** mylu has joined #openstack-keystone | 18:28 | |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Reject user creation using admin token without explicitly passing the domain. https://review.openstack.org/196942 | 18:28 |
| *** jsavak has quit IRC | 18:31 | |
| *** jsavak has joined #openstack-keystone | 18:32 | |
| *** diazjf has joined #openstack-keystone | 18:32 | |
| *** btully has joined #openstack-keystone | 18:32 | |
| *** _hrou_ has quit IRC | 18:39 | |
| *** hrou has joined #openstack-keystone | 18:40 | |
| *** browne has quit IRC | 18:41 | |
| *** gyee has joined #openstack-keystone | 18:42 | |
| *** ChanServ sets mode: +v gyee | 18:42 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 18:46 |
| *** Rockyg has joined #openstack-keystone | 18:55 | |
| *** piyanai has joined #openstack-keystone | 18:57 | |
| *** e0ne has quit IRC | 19:06 | |
| openstackgerrit | Richard Megginson proposed openstack/keystone: add federation docs for mod_auth_mellon https://review.openstack.org/198083 | 19:09 |
| *** browne has joined #openstack-keystone | 19:14 | |
| *** mylu has quit IRC | 19:14 | |
| *** piyanai has quit IRC | 19:17 | |
| *** mylu has joined #openstack-keystone | 19:19 | |
| *** piyanai has joined #openstack-keystone | 19:19 | |
| *** solomondg has quit IRC | 19:21 | |
| *** iamjarvo has quit IRC | 19:22 | |
| *** piyanai has quit IRC | 19:24 | |
| *** janonymous has quit IRC | 19:24 | |
| *** iamjarvo has joined #openstack-keystone | 19:26 | |
| *** iamjarvo has quit IRC | 19:26 | |
| *** e0ne has joined #openstack-keystone | 19:26 | |
| *** iamjarvo has joined #openstack-keystone | 19:26 | |
| *** piyanai has joined #openstack-keystone | 19:27 | |
| *** shaleh has quit IRC | 19:28 | |
| *** Ephur has joined #openstack-keystone | 19:30 | |
| sigmavirus24 | stevemar: ping | 19:35 |
| *** ngupta has quit IRC | 19:35 | |
| stevemar | sigmavirus24: whaddup | 19:35 |
| *** dims_ has joined #openstack-keystone | 19:36 | |
| sigmavirus24 | Hm, hold on | 19:36 |
| sigmavirus24 | sorry for the premature ping | 19:36 |
| stevemar | sigmavirus24: all good | 19:38 |
| sigmavirus24 | Trying to figure out why jamielennox's nova changes allowing for neutronv2 module to use Keystone v3 for auth aren't working | 19:39 |
| sigmavirus24 | Think it might be that we're specifying admin_tenant_name in our nova config file and am investigating | 19:39 |
| sigmavirus24 | yep, that looks like it | 19:40 |
| sigmavirus24 | time to test this | 19:40 |
| sigmavirus24 | sorry for the ping | 19:40 |
| *** mylu has quit IRC | 19:44 | |
| *** e0ne has quit IRC | 19:47 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Update federation docstring https://review.openstack.org/198872 | 19:47 |
| *** mylu has joined #openstack-keystone | 19:49 | |
| *** mylu has quit IRC | 19:53 | |
| *** Akshay00 has joined #openstack-keystone | 19:55 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add unit test for fernet provider https://review.openstack.org/197649 | 19:57 |
| *** fangzhou has quit IRC | 19:57 | |
| *** mylu has joined #openstack-keystone | 19:58 | |
| *** njnjnj has joined #openstack-keystone | 20:00 | |
| njnjnj | hello | 20:00 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 20:01 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 20:01 |
| *** fangzhou has joined #openstack-keystone | 20:04 | |
| lbragstad | marekd: you're not still around are you? | 20:09 |
| *** Akshay00 has quit IRC | 20:11 | |
| lbragstad | oh, maybe stevemar? | 20:13 |
| stevemar | lbragstad: whaddup | 20:14 |
| lbragstad | stevemar: quick federation question for you | 20:14 |
| lbragstad | stevemar: and it might be silly, but I wanted to double check | 20:14 |
| stevemar | lbragstad: shoot | 20:14 |
| *** lhcheng_ is now known as lhcheng | 20:15 | |
| *** ChanServ sets mode: +v lhcheng | 20:15 | |
| *** mylu has quit IRC | 20:15 | |
| lbragstad | stevemar: I've done a little digging in the federation code and it doesn't look like there is any specific apis that the federation code needs in order to operate, hence the federation api not needing any dependencies on other keystone apis (https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/core.py#L50) | 20:16 |
| *** dims_ has quit IRC | 20:17 | |
| *** mylu has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 20:19 |
| *** piyanai has quit IRC | 20:20 | |
| *** mylu has quit IRC | 20:20 | |
| *** slberger has quit IRC | 20:21 | |
| *** mylu has joined #openstack-keystone | 20:21 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Adding Documentation for Mapping Combinations https://review.openstack.org/192850 | 20:22 |
| *** piyanai has joined #openstack-keystone | 20:22 | |
| *** _hrou_ has joined #openstack-keystone | 20:23 | |
| *** hrou has quit IRC | 20:24 | |
| *** packet has quit IRC | 20:25 | |
| *** dramakri has joined #openstack-keystone | 20:26 | |
| *** shaleh has joined #openstack-keystone | 20:29 | |
| *** jsavak has quit IRC | 20:31 | |
| *** jsavak has joined #openstack-keystone | 20:31 | |
| stevemar | lbragstad: i think you're right? | 20:31 |
| stevemar | lbragstad: what are you getting at? :) | 20:32 |
| *** mylu has quit IRC | 20:32 | |
| lbragstad | stevemar: I thought that sounded right but I wanted to double check to make sure I wasn't missing something blatantly obvious. I am imagining the case where keystone may be using different backends or they are stood up in different orders, so would there be a case where x would have to be done before federation in order for it to work, for example. | 20:33 |
| stevemar | so a quick clarification | 20:35 |
| stevemar | lbragstad: the federation code itself doesn't need any other APIs | 20:35 |
| lbragstad | stevemar: makes sense | 20:36 |
| stevemar | but the federation branches of say the token handler doesn't needs assignment/group api | 20:36 |
| *** slberger has joined #openstack-keystone | 20:36 | |
| *** Akshay00 has joined #openstack-keystone | 20:37 | |
| *** mylu has joined #openstack-keystone | 20:39 | |
| *** jsavak has quit IRC | 20:43 | |
| *** jsavak has joined #openstack-keystone | 20:43 | |
| *** bradjones is now known as bradjones|away | 20:44 | |
| *** Rockyg has quit IRC | 20:45 | |
| *** RichardRaseley has joined #openstack-keystone | 20:46 | |
| *** mylu has quit IRC | 20:47 | |
| *** gordc has quit IRC | 20:49 | |
| *** mylu has joined #openstack-keystone | 20:49 | |
| *** Akshay00 has quit IRC | 20:49 | |
| *** thedodd has quit IRC | 20:51 | |
| dstanek | htruta: does that last patch pass all of the tests for you? | 20:53 |
| htruta | dstanek: which one? the change project name constraint? | 20:54 |
| htruta | it did | 20:54 |
| dstanek | htruta: yes, it seems to be failing on the test_list_group_role_assignment for me | 20:55 |
| *** mylu has quit IRC | 20:56 | |
| htruta | just ran it again and it passed | 20:57 |
| htruta | dstanek: ^ | 20:57 |
| *** piyanai has quit IRC | 20:58 | |
| *** stevemar has quit IRC | 20:58 | |
| dstanek | htruta: i'm see lots of logging errors | 20:59 |
| dstanek | "Donflict domain: (sqlite3.IntegrityError) column name is not unique"... | 20:59 |
| *** Akshay00 has joined #openstack-keystone | 20:59 | |
| dstanek | s/D/C | 20:59 |
| htruta | dstanek: shall we wait for jenkins? | 21:08 |
| *** dims_ has joined #openstack-keystone | 21:09 | |
| *** slberger has left #openstack-keystone | 21:12 | |
| *** dims_ has quit IRC | 21:14 | |
| *** jaosorior has quit IRC | 21:16 | |
| *** dims has joined #openstack-keystone | 21:16 | |
| *** piyanai has joined #openstack-keystone | 21:18 | |
| *** Akshay00 has quit IRC | 21:23 | |
| *** jk|osx is now known as jkomg | 21:24 | |
| *** piyanai has quit IRC | 21:27 | |
| *** bknudson has joined #openstack-keystone | 21:27 | |
| *** ChanServ sets mode: +v bknudson | 21:27 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor TokenCache store takes auth_ref https://review.openstack.org/189019 | 21:30 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor use auth_ref.version rather than _token_is_v* https://review.openstack.org/189018 | 21:30 |
| *** jsavak has quit IRC | 21:34 | |
| *** jsavak has joined #openstack-keystone | 21:34 | |
| *** jecarey_ has quit IRC | 21:36 | |
| *** iamjarvo has quit IRC | 21:36 | |
| *** csoukup has quit IRC | 21:47 | |
| *** jsavak has quit IRC | 21:53 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Enable bandit check for password_config_option_not_marked_secret https://review.openstack.org/194420 | 21:57 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Bandit config updates https://review.openstack.org/194417 | 21:57 |
| *** njnjnj has quit IRC | 22:01 | |
| *** diazjf has left #openstack-keystone | 22:02 | |
| *** Kennan has joined #openstack-keystone | 22:02 | |
| *** Kennan2 has quit IRC | 22:03 | |
| *** dramakri has quit IRC | 22:04 | |
| *** njnjnj has joined #openstack-keystone | 22:04 | |
| *** zzzeek has quit IRC | 22:25 | |
| *** hogepodge has quit IRC | 22:30 | |
| jamielennox | sigmavirus24: all good? | 22:32 |
| sigmavirus24 | jamielennox: yeah eventually figured out how to use auth_plugin, etc. | 22:32 |
| *** Akshay00 has joined #openstack-keystone | 22:32 | |
| sigmavirus24 | The docs /could/ be better and not reference teh class names instead of the entry-points you're expected to use, but I figured it out | 22:32 |
| jamielennox | sigmavirus24: yea, it's not a hard concept but i can never seem to explain it well | 22:33 |
| sigmavirus24 | jamielennox: yeah, I could probably take a crack at those docs, but I won't =P | 22:34 |
| sigmavirus24 | I have lots on my plate like getting this test cloud properly deployed on v3 with osad | 22:35 |
| sigmavirus24 | It'd also be good to know what the base options are, e.g., user-name, password, etc. for each of the plugins | 22:35 |
| sigmavirus24 | fwiw | 22:35 |
| *** Akshay00 has quit IRC | 22:36 | |
| jamielennox | yea, with keystoneauth we get a chance to essentially start from scratch so i'm going to sink some time into the docs there | 22:36 |
| *** Akshay00 has joined #openstack-keystone | 22:36 | |
| *** blewis has quit IRC | 22:37 | |
| jamielennox | sigmavirus24: in the mean time i link https://gist.github.com/jamielennox/7f5cfabd64a6922e643c#file-list-plugins-py from one of my blogs which is useful | 22:37 |
| sigmavirus24 | jamielennox: yeah feel free to add me to reviews for those docs | 22:38 |
| *** dramakri has joined #openstack-keystone | 22:41 | |
| *** hogepodge has joined #openstack-keystone | 22:46 | |
| *** edmondsw has quit IRC | 22:47 | |
| *** chlong_ has joined #openstack-keystone | 22:50 | |
| *** chlong_ has quit IRC | 22:50 | |
| *** chlong has quit IRC | 22:51 | |
| *** chlong has joined #openstack-keystone | 22:51 | |
| *** browne has quit IRC | 22:54 | |
| *** piyanai has joined #openstack-keystone | 22:54 | |
| *** dims has quit IRC | 22:54 | |
| *** Akshay00 has quit IRC | 23:01 | |
| *** Akshay00 has joined #openstack-keystone | 23:02 | |
| *** ankita_wagh has joined #openstack-keystone | 23:04 | |
| *** Akshay00 has quit IRC | 23:06 | |
| *** _hrou_ has quit IRC | 23:06 | |
| *** ankita_w_ has quit IRC | 23:07 | |
| *** Ephur has quit IRC | 23:07 | |
| *** jamielennox is now known as jamielennox|away | 23:11 | |
| *** ankita_wagh has quit IRC | 23:12 | |
| *** ankita_wagh has joined #openstack-keystone | 23:12 | |
| *** piyanai_ has joined #openstack-keystone | 23:12 | |
| *** shaleh has quit IRC | 23:14 | |
| *** shaleh has joined #openstack-keystone | 23:14 | |
| *** piyanai has quit IRC | 23:15 | |
| *** piyanai_ is now known as piyanai | 23:15 | |
| *** piyanai has quit IRC | 23:16 | |
| *** btully has quit IRC | 23:21 | |
| *** jamielennox|away is now known as jamielennox | 23:22 | |
| *** jkomg has quit IRC | 23:29 | |
| openstackgerrit | Chloe Jensen proposed openstack/keystone: Modified command used to run keystone-all. https://review.openstack.org/198924 | 23:34 |
| *** browne has joined #openstack-keystone | 23:38 | |
| *** piyanai has joined #openstack-keystone | 23:38 | |
| njnjnj | I was wondering where the source code for commands like "keystone endpoint-create" is for a bug that I am working on. | 23:39 |
| openstackgerrit | Merged openstack/keystonemiddleware: Don't allow webob to set a default content type https://review.openstack.org/194470 | 23:40 |
| jamielennox | njnjnj: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/shell.py | 23:44 |
| jamielennox | njnjnj: but we aren't accepting new features to the CLI, you should look to use openstackclient instead o | 23:45 |
| njnjnj | thanks | 23:46 |
| *** njnjnj has quit IRC | 23:49 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:52 | |
| *** RichardRaseley has quit IRC | 23:54 | |
| *** jkomg has joined #openstack-keystone | 23:55 | |
| *** zzzeek has joined #openstack-keystone | 23:55 | |
| *** lufix has quit IRC | 23:58 | |
| *** jkomg has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!