| *** annasort has quit IRC | 00:01 | |
| *** dims has joined #openstack-keystone | 00:01 | |
| openstackgerrit | Merged openstack/keystone: Add unit test for fernet provider https://review.openstack.org/197649 | 00:07 |
|---|---|---|
| *** chlong has quit IRC | 00:08 | |
| *** piyanai has quit IRC | 00:09 | |
| openstackgerrit | Merged openstack/keystone: Update federation docstring https://review.openstack.org/198872 | 00:09 |
| *** _cjones_ has quit IRC | 00:11 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/196485 | 00:11 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/196485 | 00:12 |
| *** TheIntern has quit IRC | 00:12 | |
| *** dramakri has quit IRC | 00:12 | |
| *** r-daneel has quit IRC | 00:13 | |
| *** annasort has joined #openstack-keystone | 00:15 | |
| *** dramakri has joined #openstack-keystone | 00:20 | |
| *** dramakri has left #openstack-keystone | 00:21 | |
| *** dramakri has quit IRC | 00:21 | |
| *** btully has joined #openstack-keystone | 00:32 | |
| *** zzzeek has quit IRC | 00:35 | |
| *** tqtran has quit IRC | 00:39 | |
| *** ankita_wagh has quit IRC | 00:43 | |
| *** dims has quit IRC | 00:50 | |
| *** lhcheng has quit IRC | 00:52 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: AuthContextMiddleware admin token handling https://review.openstack.org/198931 | 00:55 |
| *** dims has joined #openstack-keystone | 00:58 | |
| *** woodster_ has quit IRC | 01:01 | |
| *** fangzhou_ has joined #openstack-keystone | 01:06 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/197277 | 01:07 |
| *** fangzhou has quit IRC | 01:07 | |
| *** fangzhou_ is now known as fangzhou | 01:07 | |
| *** ankita_wagh has joined #openstack-keystone | 01:12 | |
| *** gyee has quit IRC | 01:13 | |
| *** piyanai has joined #openstack-keystone | 01:16 | |
| *** chlong has joined #openstack-keystone | 01:30 | |
| *** shaleh_ has joined #openstack-keystone | 01:33 | |
| *** davechen1 has joined #openstack-keystone | 01:34 | |
| *** shaleh has quit IRC | 01:36 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the invalid testcase https://review.openstack.org/198629 | 01:40 |
| *** stevemar has joined #openstack-keystone | 01:41 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the invalid testcase https://review.openstack.org/198629 | 01:43 |
| *** davechen has joined #openstack-keystone | 01:44 | |
| *** davechen2 has joined #openstack-keystone | 01:45 | |
| *** davechen1 has quit IRC | 01:46 | |
| *** davechen has quit IRC | 01:48 | |
| *** btully has quit IRC | 01:53 | |
| *** ankita_wagh has quit IRC | 01:53 | |
| *** ankita_wagh has joined #openstack-keystone | 01:54 | |
| *** davechen has joined #openstack-keystone | 01:56 | |
| *** davechen2 has quit IRC | 01:57 | |
| *** ajayaa has joined #openstack-keystone | 01:58 | |
| *** fangzhou has quit IRC | 02:04 | |
| *** lhcheng has joined #openstack-keystone | 02:11 | |
| *** ChanServ sets mode: +v lhcheng | 02:11 | |
| *** shaleh_ has quit IRC | 02:13 | |
| *** hrou has joined #openstack-keystone | 02:28 | |
| *** richm has quit IRC | 02:33 | |
| *** chenhong has joined #openstack-keystone | 02:35 | |
| *** lhcheng has quit IRC | 02:40 | |
| *** iamjarvo has joined #openstack-keystone | 02:51 | |
| *** stevemar has quit IRC | 02:54 | |
| *** hakimo has quit IRC | 02:54 | |
| *** stevemar has joined #openstack-keystone | 02:54 | |
| *** hakimo has joined #openstack-keystone | 02:55 | |
| *** ankita_wagh has quit IRC | 02:58 | |
| *** iamjarvo has quit IRC | 03:01 | |
| *** dikonoor has joined #openstack-keystone | 03:08 | |
| *** jkomg has joined #openstack-keystone | 03:38 | |
| *** dims has quit IRC | 03:39 | |
| *** piyanai has quit IRC | 03:42 | |
| *** piyanai has joined #openstack-keystone | 03:43 | |
| *** piyanai has quit IRC | 03:43 | |
| *** piyanai has joined #openstack-keystone | 03:44 | |
| *** ankita_wagh has joined #openstack-keystone | 03:48 | |
| *** piyanai has quit IRC | 03:48 | |
| *** ankita_wagh has joined #openstack-keystone | 03:50 | |
| *** ankita_w_ has joined #openstack-keystone | 04:00 | |
| *** ankita_wagh has quit IRC | 04:04 | |
| *** davechen has quit IRC | 04:07 | |
| *** davechen has joined #openstack-keystone | 04:07 | |
| *** davechen1 has joined #openstack-keystone | 04:11 | |
| *** btully has joined #openstack-keystone | 04:12 | |
| *** davechen has quit IRC | 04:13 | |
| *** chenhong has quit IRC | 04:16 | |
| *** davechen1 is now known as davechen | 04:17 | |
| *** davechen2 has joined #openstack-keystone | 04:22 | |
| *** davechen has quit IRC | 04:23 | |
| *** ankita_w_ has quit IRC | 04:24 | |
| *** jkomg has quit IRC | 04:33 | |
| *** ankita_wagh has joined #openstack-keystone | 04:34 | |
| *** dims has joined #openstack-keystone | 04:40 | |
| *** lhcheng has joined #openstack-keystone | 04:41 | |
| *** ChanServ sets mode: +v lhcheng | 04:41 | |
| *** dims_ has joined #openstack-keystone | 04:41 | |
| *** _cjones_ has joined #openstack-keystone | 04:43 | |
| *** dims has quit IRC | 04:45 | |
| *** dims_ has quit IRC | 04:46 | |
| *** ajayaa has quit IRC | 04:47 | |
| *** _cjones_ has quit IRC | 04:56 | |
| *** _cjones_ has joined #openstack-keystone | 04:57 | |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/196485 | 05:17 |
| *** e0ne has joined #openstack-keystone | 05:22 | |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Reject user creation using admin token without explicitly passing the domain. https://review.openstack.org/196942 | 05:24 |
| *** ajayaa has joined #openstack-keystone | 05:28 | |
| *** ankita_wagh has quit IRC | 05:32 | |
| *** ankita_wagh has joined #openstack-keystone | 05:33 | |
| *** iamjarvo has joined #openstack-keystone | 05:36 | |
| *** iamjarvo has quit IRC | 05:37 | |
| *** iamjarvo has joined #openstack-keystone | 05:37 | |
| *** ankita_wagh has quit IRC | 05:41 | |
| *** henrynash has joined #openstack-keystone | 05:42 | |
| *** ChanServ sets mode: +v henrynash | 05:42 | |
| *** e0ne has quit IRC | 05:44 | |
| *** Trozz_ has left #openstack-keystone | 05:45 | |
| *** henrynash has quit IRC | 05:47 | |
| *** ig0r_ has joined #openstack-keystone | 05:51 | |
| *** mabrams has joined #openstack-keystone | 05:53 | |
| *** _hrou_ has joined #openstack-keystone | 05:54 | |
| *** lhcheng has quit IRC | 05:55 | |
| *** ig0r__ has quit IRC | 05:55 | |
| *** hrou has quit IRC | 05:57 | |
| marekd | lbragstad: sorry, i was already at home (and not monitoring this time). What's up? | 05:59 |
| *** kiran-r has joined #openstack-keystone | 06:02 | |
| marekd | jamielennox: hey | 06:02 |
| jamielennox | marekd: hey | 06:03 |
| marekd | jamielennox: do you happen do understand syntax like in branch line in https://review.openstack.org/#/c/190631/3/zuul/layout.yaml ? | 06:04 |
| marekd | i must confess i was blindly following your patches without deeper understanding it. | 06:04 |
| marekd | and apparently some 'proboblems' arose. | 06:05 |
| jamielennox | marekd: i think you just want voting: false there | 06:06 |
| marekd | jamielennox: hm? | 06:06 |
| jamielennox | so the branch syntax is saying ignore this for specific branch | 06:06 |
| jamielennox | so in mine, i want to run it so long as it's not the keystoneauth_integration branch | 06:07 |
| jamielennox | it's a regexp, there is a reason it's written so complicated but i can't remember what it is | 06:07 |
| marekd | it looks kind of regexpy byt defiitely not a regexp i know and understand :-) | 06:07 |
| marekd | so it says don't run gate-keystoneauth-saml2-requirements job against master branch? | 06:08 |
| jamielennox | in this case cause you want to disable it for a while if you just say voting: false (there are examples of this elsewhere in the file) then it will make it a check only job for all branches | 06:08 |
| jamielennox | i think it's a lookahead in regexp | 06:08 |
| jamielennox | ^$ are anchors, start line, end line | 06:09 |
| jamielennox | (? ) is an optional group i think | 06:09 |
| jamielennox | then !master is anything but master | 06:09 |
| marekd | yep | 06:09 |
| jamielennox | so i'm thinking your syntax is right, just unnecessary in this case because you want to disable it for all branches | 06:10 |
| *** _hrou_ has quit IRC | 06:10 | |
| marekd | i think you made it disable due to ksa not being released yet for a feature keystoneauth_integration - where did you mark certain patches being under that 'feature' tag? | 06:10 |
| jamielennox | tag? it's a branch | 06:11 |
| marekd | aha | 06:11 |
| jamielennox | marekd: i filed bug 1472060 which is me ranting about websso | 06:13 |
| openstack | bug 1472060 in Keystone "websso callback is in the wrong place" [Undecided,New] https://launchpad.net/bugs/1472060 | 06:13 |
| jamielennox | i dont understand why it's not related to an IDP | 06:13 |
| *** henrynash has joined #openstack-keystone | 06:15 | |
| *** ChanServ sets mode: +v henrynash | 06:15 | |
| marekd | jamielennox: let me check | 06:18 |
| marekd | jamielennox: let me respond in the bug comment. | 06:23 |
| *** _cjones_ has quit IRC | 06:25 | |
| *** henrynash has quit IRC | 06:29 | |
| *** joe1_ has quit IRC | 06:37 | |
| *** belmoreira has joined #openstack-keystone | 06:43 | |
| *** fifieldt has joined #openstack-keystone | 06:43 | |
| *** afazekas has joined #openstack-keystone | 06:50 | |
| *** btully has quit IRC | 06:54 | |
| *** annasort has quit IRC | 06:56 | |
| *** lufix has joined #openstack-keystone | 06:56 | |
| *** e0ne has joined #openstack-keystone | 06:57 | |
| *** fhubik has joined #openstack-keystone | 06:57 | |
| *** stevemar has quit IRC | 06:59 | |
| *** stevemar has joined #openstack-keystone | 07:00 | |
| *** e0ne has quit IRC | 07:04 | |
| jamielennox | marekd: will two saml providers with websso work with our current setup > | 07:10 |
| marekd | yes, why wouldn't they ? | 07:11 |
| *** stevemar has quit IRC | 07:11 | |
| *** iamjarvo has quit IRC | 07:12 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Delete extra parentheses in assertEqual message https://review.openstack.org/198990 | 07:15 |
| jamielennox | marekd: i put a reply on that bug | 07:15 |
| jamielennox | marekd: so in setups i've seen you need to specify that the /websso path is protected by mellon/shib. This triggers the browser to be sent off to the idp found in the metadata | 07:16 |
| jamielennox | if you had two saml providers then how does httpd know which idp this should be redirected to | 07:17 |
| jamielennox | marekd: for example this is a template i'm working off: https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-federation-setup/vm-post-cloud-init-rdo.sh#L82 | 07:18 |
| jamielennox | that /v3/auth/OS-FEDERATION/websso/saml2 is protected by one idp defined by all those metadata and certs above. How would you have it protected by a different one? | 07:19 |
| *** belmoreira has quit IRC | 07:26 | |
| marekd | jamielennox: sorry, i am running between meetings and so. | 07:28 |
| jamielennox | marekd: that's ok, i'm about to finish as well | 07:28 |
| jamielennox | i've just been banging my head against federation all day and i'm just not sure why websso is different in this sense | 07:28 |
| marekd | jamielennox: so in normal WebSSO usecase, when a browser hits a protected url and there more than 1 IdP defineda user is usually redirected to a Discovery Service where he chooses an IdP of his choice | 07:29 |
| marekd | jamielennox: if you want example go to openstack.cern.ch . you will be redirected to OUR IdP website, but you will also be able from a dropdown box a list of other federated IdPs you can use. | 07:30 |
| marekd | jamielennox: i can risk we could possibly use link without idp specified in an url but it's likely that clients would still need to know IdP's address | 07:33 |
| marekd | IdP URL | 07:33 |
| *** browne has quit IRC | 07:33 | |
| jamielennox | marekd: are all those idps set up as individual IDPs in keystone | 07:34 |
| jamielennox | like each with a unique idp_id? | 07:34 |
| *** fhubik is now known as fhubik_afk | 07:35 | |
| marekd | idp_id is a user defined name, that's one. | 07:35 |
| jamielennox | like /OS-FEDERATION/identity_provider/{idp_id}/... | 07:35 |
| marekd | you can create one IdP and put multiple remote_id in there and this object can server for multiple real IdPs if you wish to for instance share a mapping between them (because you are in one federation). | 07:36 |
| jamielennox | ok, so you are proxying that a whole bunch of actual IDPs are going through the same keystone IDP | 07:36 |
| *** e0ne has joined #openstack-keystone | 07:36 | |
| marekd | jamielennox: what realy matters is a mapping - note keystone idp is just instance with almost no data in there. | 07:37 |
| *** jistr has joined #openstack-keystone | 07:37 | |
| jamielennox | in which case i think i am still right because this should still be going through /identity_provider/{idp_id}/protocol/saml/websso | 07:37 |
| jamielennox | it's just that you use one idp_id as a proxy to a bunch of real idps | 07:38 |
| jamielennox | marekd: my problem with this is that there are now two ways to define the relationship | 07:38 |
| marekd | jamielennox: how come? | 07:38 |
| jamielennox | you need to define identity_provider/{id}/protocol/{id} and then you need to define protocol + remote_id -> idp_id | 07:39 |
| jamielennox | i have no objection to remote_ids on identity_provider so that in your case you can check that the response is from a known place | 07:39 |
| jamielennox | but i think in general that the websso response should be tied to a keystone idp_id | 07:40 |
| jamielennox | because remote_ids is not just a security feature at the moment, if you don't set up remote_ids then you can't use websso | 07:40 |
| marekd | jamielennox: that's true, but not setting remote_id will expose you to a serious security risk. | 07:41 |
| jamielennox | marekd: how? | 07:41 |
| *** lhcheng has joined #openstack-keystone | 07:42 | |
| *** ChanServ sets mode: +v lhcheng | 07:42 | |
| jamielennox | assertions should be validated against the signatures in the metadata files | 07:42 |
| jamielennox | if you use an invalid assertion it should never make it past the first step | 07:42 |
| *** dims has joined #openstack-keystone | 07:43 | |
| *** btully has joined #openstack-keystone | 07:43 | |
| marekd | Ok, I work for Pepsi, you for Cola, our copanies has federated access to HP public cloud. Imagine there is no remote_id configured. No, we are both softengs in our companies, and somehoor mapping for Pepsi and Cola says "if the guy is softeng give him access to group ENGINEERING" <- this is of course per company. Now, I want to steal your code, so I, working for Cola say: /v3/OS-FEDERATION/identity_providers/PEPSI/protocols/saml2/auth -> however i | 07:44 |
| marekd | oups, i flipped companies - let's say I work for Cola, your for Pepsi. | 07:45 |
| jamielennox | i get it | 07:45 |
| jamielennox | why wouldn't mellon or shib say this assertion is not signed by the idp registered in this location - reject | 07:45 |
| marekd | the problem is that keystone must be aware who issues the assertion, and can validate it only via remote_id which is a part of an assertion. | 07:46 |
| jamielennox | why? i don't think this should ever get to keystone, shib/mellon should reject assertions not signed by the expected idp | 07:46 |
| marekd | jamielennox: you could also do this, and nkinder stated this when we discussed this, but afair the problem is every chae need mellon configuration reload and this is somewhat inconvenient as opposed to api call. | 07:46 |
| *** abhishekk has joined #openstack-keystone | 07:47 | |
| jamielennox | i think that's a seperate issue as you are still going to need to configure metadata files etc in httpd settings | 07:47 |
| *** AYs has joined #openstack-keystone | 07:48 | |
| marekd | also, can you configure multiple IdPs per <Location> ? | 07:48 |
| marekd | this is also a use-case. | 07:48 |
| *** btully has quit IRC | 07:48 | |
| *** dims has quit IRC | 07:48 | |
| jamielennox | marekd: no - i don't think you can | 07:48 |
| jamielennox | which is why i'm not sure if i can have multiple saml providers now | 07:48 |
| jamielennox | but i think this is a side effect of the websso problem | 07:49 |
| marekd | jamielennox: so, that's also kind of problem - i had a request for some users saying: i have federations with 100s of users, and you want me to make up names for those 100s IdPs in keystone? | 07:49 |
| jamielennox | if the route was /identity_providers/{id}/protocol/saml/websso then you wouldn't have overlapping Locations | 07:49 |
| marekd | ah, and they all shared same mapping. | 07:49 |
| jamielennox | marekd: that's fine, you are already doing that by having your proxy idp that handles everything | 07:50 |
| jamielennox | because that's what your mapping is associated with | 07:50 |
| jamielennox | that should still exist per idp_id | 07:50 |
| marekd | jamielennox: and i want to be able to handle 100 IdPs (explicitely specified) not all of them. | 07:50 |
| *** amirosh has joined #openstack-keystone | 07:51 | |
| jamielennox | again, i don't have a problem with the remote_ids as a security feature for that proxying case. I just don't think i should need it for the simple websso case | 07:51 |
| marekd | jamielennox: i honestly don't think {idp_id} should be specified in websso url - look how other websso are being done - you enter a website, say jamielennox.net and than a popupshows :login with google, login with facebook, login with redhat | 07:51 |
| jamielennox | and also i think that could be handled by here are all the certificates that are allowed to sign assertions for this url | 07:52 |
| marekd | it's a single entry point | 07:52 |
| jamielennox | marekd: no it's not | 07:52 |
| jamielennox | you just listed 3 | 07:52 |
| jamielennox | google, facebook, redhat | 07:52 |
| marekd | yes, but i didn't have to go to jamielennox.net/google/auth to authenticate via Google IdP. | 07:53 |
| jamielennox | well you did it was just hidden by the button you pressed | 07:53 |
| jamielennox | in the same way that you have a drop down on horizon | 07:53 |
| jamielennox | you could have them all there as seperate options | 07:53 |
| jamielennox | at some point the user has to pick an idp and the URLs will be different | 07:53 |
| jamielennox | the mappings will be different | 07:54 |
| *** jaosorior has joined #openstack-keystone | 07:55 | |
| jamielennox | i think that's proving my point - having those three idps that contain different mappings all coming back to the same /websso endpoint is crazy - you want to return to the websso point for that idp | 07:55 |
| breton | morning | 07:58 |
| marekd | jamielennox: hm. | 07:58 |
| marekd | jamielennox: is it somehow complicating any work you are dong or it just feels wrong? | 07:58 |
| marekd | jamielennox: in fact i liked an idea of 'single entrypoint' and would probably prefer to have it for CLI as well. | 07:59 |
| jamielennox | marekd: right, from memory you were anti having idp_id in the url at all | 07:59 |
| jamielennox | marekd: it feels wrong because we are establishing two relationships between the same concepts. It also means i don't know how i would run two saml protected endpoints on the same websso macine | 08:00 |
| jamielennox | because if you look at https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-federation-setup/vm-post-cloud-init-rdo.sh#L109 | 08:00 |
| marekd | jamielennox: we could probably satisfy websso with idp/protocol in url - it's a matter of patch recognizing http headers | 08:00 |
| jamielennox | that whole /v3 route is protected by one mellon instance | 08:01 |
| *** e0ne is now known as e0ne_ | 08:01 | |
| marekd | which probably wrong | 08:01 |
| jamielennox | and it's purely because it's shared between the ipsilon provider and websso, if it was /identity_provider/{id}/protocol/{id}/websso then it would be a single entry and i could easily have different providers side by side | 08:01 |
| *** amirosh has quit IRC | 08:02 | |
| *** fhubik_afk is now known as fhubik | 08:02 | |
| marekd | so why not protect /OS-FEDERATION/webbso/saml2 only ? | 08:02 |
| jamielennox | marekd: i'm doing this because i'm presenting on it at the end of the month and the story is off | 08:02 |
| marekd | and install DS like https://wiki.shibboleth.net/confluence/display/EDS10/2.+Installation | 08:03 |
| *** e0ne_ is now known as e0ne | 08:03 | |
| jamielennox | marekd: say i had two idps, idp_A and idp_B which were both saml | 08:03 |
| jamielennox | which would i use to protect /websso/saml2? | 08:03 |
| marekd | configure /websso/saml2 to redirect to a Discovery Service | 08:03 |
| marekd | users is redirected to this kind of popup "login with {Google, Facebook, RedHat}" | 08:04 |
| jamielennox | that is very much relying on a feature of shiboleth | 08:04 |
| jamielennox | why isn't horizon my discovery service? | 08:05 |
| marekd | this is an example, http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-idp-discovery.pdf | 08:05 |
| marekd | DS is more like a concept around protocol. | 08:05 |
| marekd | maybe mellon is missing that, but i think mellon is still missing some other features | 08:06 |
| jamielennox | ok, so this is the first time i'm seeing a discovery service as a seperate concept | 08:06 |
| jamielennox | like something you would do in addition to what horizon is already doing by offering you multiple idp choices | 08:06 |
| marekd | jamielennox: i see your point, the battle whether horizon should have it or not has been live for a longer time. | 08:07 |
| jamielennox | marekd: so i guess my point is that in your proxy example the /identity_providers/{id}/protocol/saml2/websso should be the discovery path, not /websso | 08:08 |
| marekd | so, users starts with typing /identity_providers/{id}/protocol/saml2/websso ? | 08:08 |
| jamielennox | if your single keystone IDP id represents many real idps then that should be an idp specific thing | 08:09 |
| jamielennox | users never type that, they never type the /websso url either - that's all horizon config | 08:09 |
| jamielennox | as it sits now i can't run two saml providers on the same system without this discovery service | 08:11 |
| jamielennox | and in my fairly simple case i just want to hardcode some options to horizon and i can't | 08:11 |
| *** stevemar has joined #openstack-keystone | 08:12 | |
| marekd | jamielennox: I'd say DS is a standard way for more than one IdP and probably more popular than url per IdP. | 08:12 |
| *** chlong has quit IRC | 08:13 | |
| jamielennox | i'll play with the mellon discovery service, it will at least mean i don't need to protect the entire /v3 location with mellon | 08:14 |
| marekd | jamielennox: if you really want this - let's propose a change, where a depending on http headers keystone will respond with either standard websso workflow or with ecp one. | 08:14 |
| jamielennox | marekd: i don't think it's a headers thing, ECP uses /auth and websso would be /websso | 08:15 |
| jamielennox | they should live side by side | 08:15 |
| marekd | maybe. | 08:15 |
| *** stevemar has quit IRC | 08:16 | |
| marekd | part of the problem here is that we are mixing some functionalities here - we would like keystone to be protocol agnostic (apache handles all the protocol details) byt keyston will handle DS. | 08:16 |
| jamielennox | marekd: i don't think keystone should handle discovery | 08:17 |
| jamielennox | not websso style discovery | 08:17 |
| jamielennox | but anyway | 08:17 |
| marekd | jamielennox: if horizon will be able to query keystone for available idps and build dynamic liknks idp/{idp}/protocol/saml2/websso to me it's kind of handling discovery | 08:17 |
| jamielennox | marekd: i thought we decided against that? being able to query keystone for idps | 08:18 |
| jamielennox | this was why i was saying that the choices would be hard coded into horizon config | 08:18 |
| jamielennox | ideally later you could configure the horizon config via horizon | 08:18 |
| marekd | jamielennox: uh, oh, so, imagine you have multiple horizons and suddently you remove one IdP and then what - an email "hey, please remove this IdP from your choices" ? | 08:19 |
| jamielennox | marekd: how is this different to doing it in keystone? | 08:20 |
| jamielennox | you still need to remote the idp from the discovery somehow | 08:20 |
| marekd | jamielennox: not if you control that DS | 08:20 |
| marekd | sorry, | 08:20 |
| marekd | yes, you still do, but you do this once, in your service | 08:21 |
| jamielennox | what does controlling a DS involve? how is it different to querying keystone for IDPs | 08:21 |
| *** amaretskiy has joined #openstack-keystone | 08:22 | |
| marekd | querying keystone for IDPs would be automatized here, because you remove IdP from Keystone and next time all horizons don't see that IdP. I was referring to having hardcoded choices in client's horizons | 08:22 |
| marekd | keystone is yours, horizons are not. | 08:22 |
| *** _cjones_ has joined #openstack-keystone | 08:22 | |
| marekd | if , on the other hand you controll DS, you can remove it from DS as well as Keystone without this out of band "please remove" e-mails or tickets. | 08:23 |
| *** fhubik is now known as fhubik_afk | 08:23 | |
| marekd | i still hope we will one day mature enough to say let's make Keystone a 1st class SP and we will handle all those stuff into Keystone | 08:23 |
| marekd | i really hate configuing SAML w/ Apache | 08:23 |
| marekd | no matter whether it is mellon or shibboleth. | 08:24 |
| jamielennox | marekd: so i think the discovery service only when you have a proxying idp makes sense | 08:25 |
| jamielennox | if you are adding/removing lots then that makes sense | 08:25 |
| jamielennox | i don't think adding/removing keystone IDPs are common enough there | 08:25 |
| *** fhubik_afk is now known as fhubik | 08:25 | |
| marekd | btw, are you attending meetup next week ? | 08:25 |
| jamielennox | marekd: mellon does have discovery https://github.com/UNINETT/mod_auth_mellon/blob/master/README#L444 i haven't seen how to use it yet | 08:26 |
| jamielennox | marekd: no | 08:26 |
| marekd | jamielennox: too bad. | 08:26 |
| jamielennox | yea | 08:26 |
| jamielennox | would be good | 08:26 |
| marekd | :( | 08:27 |
| marekd | we would drag others attention | 08:27 |
| marekd | and maybe have some bigger decisions | 08:27 |
| jamielennox | hopefully they'll do some VOIP or video links | 08:27 |
| marekd | however, i doubt keystone will ever become a 1st class SP given the nature of the project. | 08:27 |
| jamielennox | anyway - it's in the kilo release so it's not getting changed any time soon | 08:28 |
| jamielennox | i'll have a look and see if i can fix my issue with discovery | 08:28 |
| jamielennox | i'm done for the day though | 08:29 |
| marekd | btw, i will be on holiday until next monday, so i may not respond here, e-mails would be much better way of communication. | 08:29 |
| jamielennox | marekd: thanks for arguing :) | 08:29 |
| jamielennox | marekd: no worries | 08:29 |
| marekd | jamielennox: always a pleasure, especially given that you always have lots of valid points :-) | 08:29 |
| jamielennox | marekd: i always discover these things when i have to do my once a year federation presentation | 08:30 |
| jamielennox | never early enough to catch them in spec time | 08:30 |
| marekd | we made some mistakes with saml, but i am not convinced websso is not one of them :-) | 08:31 |
| marekd | anyway, need to run too! | 08:31 |
| marekd | cheers! | 08:31 |
| jamielennox | cya | 08:31 |
| *** henrynash has joined #openstack-keystone | 08:36 | |
| *** ChanServ sets mode: +v henrynash | 08:36 | |
| *** lhcheng has quit IRC | 08:42 | |
| *** _cjones_ has quit IRC | 08:57 | |
| *** fhubik has quit IRC | 08:59 | |
| *** krykowski has joined #openstack-keystone | 09:05 | |
| *** e0ne is now known as e0ne_ | 09:11 | |
| *** boris-42 has quit IRC | 09:22 | |
| *** e0ne_ is now known as e0ne | 09:24 | |
| *** btully has joined #openstack-keystone | 09:32 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/197254 | 09:32 |
| *** henrynash has quit IRC | 09:32 | |
| *** btully has quit IRC | 09:36 | |
| *** fhubik has joined #openstack-keystone | 09:38 | |
| *** dims has joined #openstack-keystone | 09:44 | |
| *** dims_ has joined #openstack-keystone | 09:45 | |
| *** dims__ has joined #openstack-keystone | 09:46 | |
| odyssey4me | marekd jamielennox Shibboleth has an Embedded Discovery Service which is really just a set of css/js files: https://wiki.shibboleth.net/confluence/display/EDS10/2.+Installation | 09:47 |
| odyssey4me | Ideally that should actually be used as a base to have an embedded DS in Horizon/Keystone for Federation SP's | 09:47 |
| *** dims has quit IRC | 09:48 | |
| jamielennox | odyssey4me: when you are using one keystone idp to represent a bunch of real idps with the same mapping i agree | 09:48 |
| jamielennox | that seems to be the cern case | 09:48 |
| odyssey4me | jamielennox erm, no - that would be a case for an enterprise discovery service | 09:49 |
| odyssey4me | each SP may have multiple IDP's | 09:49 |
| odyssey4me | that's the use case for an embedded DS | 09:49 |
| *** dims_ has quit IRC | 09:50 | |
| odyssey4me | so in the case you're describing where you have two saml IDP's for a SP, if you had an embedded DS then you wouldn't have any issues - you could present the choice to the end-user through horizon | 09:50 |
| *** dims__ has quit IRC | 09:50 | |
| *** fhubik is now known as fhubik_afk | 09:51 | |
| odyssey4me | I unfortunately haven't had the time to get that working in some sort of prototype, but it is something I'd like to see happen and will possibly give that a go some time | 09:51 |
| jamielennox | yep, i understand that, but horizon already has a drop down of WEBSSO sources for identity | 09:52 |
| jamielennox | and at the moment i can't link to individual idps | 09:52 |
| odyssey4me | jamielennox yep, for the moment it appears that the use-case was built largely around one IDP per SSO type | 09:53 |
| jamielennox | i also need to check the mod_auth_mellon support for discover | 09:53 |
| jamielennox | y | 09:53 |
| odyssey4me | jamielennox discovery just parses the metadata for the appropriate endpoints and names as I recall (it's been a while since I looked in detail) | 09:53 |
| odyssey4me | all it needs to determine is the entityID | 09:54 |
| jamielennox | odyssey4me: so actually my problem with the whole thing is that there are multiple ways you have to configure things, you need to associate idp -> protocol, then in the websso route you need to configure based on idp url | 09:54 |
| *** fhubik_afk is now known as fhubik | 09:54 | |
| jamielennox | so here's a scenario | 09:55 |
| jamielennox | i deploy a horizon that is limited to one domain on top of a shared openstack | 09:55 |
| *** davechen2 has left #openstack-keystone | 09:55 | |
| jamielennox | this would be how you set up like a coke front end on a multi-tenant cloud | 09:56 |
| odyssey4me | it might be nice if Horizon's WEBSSO_CHOICES could include the protocol, a friendly name, and optionally the IDP name? that might be a simple way of providing the option of multiple IDP's to end-users? | 09:56 |
| jamielennox | i want to limit the horizon login to just the coke idp | 09:56 |
| jamielennox | i don't have that choice at the moment, i have to send users to the shared /websso route | 09:56 |
| jamielennox | odyssey4me: it already contains the protoocl | 09:57 |
| jamielennox | so ideally i'd like to add a /websso route to the identity_providers/{id}/protocol/saml/ location | 09:57 |
| jamielennox | if you provide an idp_id to django_openstack_auth then it uses that route, if you don't it uses the shared /websso/saml route | 09:58 |
| odyssey4me | jamielennox yep, that sounds sensible - it won't be dynamic, but it will provide more options | 09:58 |
| jamielennox | there's no reason that identity_providers/{id}/protocol/saml/websso can't be a discovery service | 09:58 |
| jamielennox | that's what marekd's case is | 09:58 |
| jamielennox | where he has 100s of idps that all use the exact same mapping so he wants to accept assertions from any of those as valid for that keystone idp | 09:59 |
| jamielennox | anyway - i think those two things can exist side by side | 10:00 |
| odyssey4me | jamielennox I agree | 10:00 |
| *** fhubik is now known as fhubik_afk | 10:04 | |
| *** fhubik_afk is now known as fhubik | 10:06 | |
| *** fhubik is now known as fhubik_afk | 10:06 | |
| *** piyanai has joined #openstack-keystone | 10:07 | |
| *** e0ne is now known as e0ne_ | 10:07 | |
| *** e0ne_ is now known as e0ne | 10:21 | |
| *** viktors|afk is now known as viktors | 10:30 | |
| *** ericksonsantos has joined #openstack-keystone | 10:40 | |
| *** AYs has quit IRC | 10:43 | |
| *** radez is now known as radez_g0n3 | 10:45 | |
| *** dims has joined #openstack-keystone | 10:46 | |
| *** iamjarvo has joined #openstack-keystone | 10:47 | |
| *** dims has quit IRC | 10:51 | |
| *** iamjarvo has quit IRC | 10:52 | |
| *** e0ne is now known as e0ne_ | 11:25 | |
| samueldmq | morning | 11:30 |
| *** e0ne_ is now known as e0ne | 11:45 | |
| *** fhubik_afk is now known as fhubik | 11:47 | |
| *** stevemar has joined #openstack-keystone | 11:50 | |
| samueldmq | ayoung: morning | 11:50 |
| samueldmq | ayoung: I had a thought on 'how identify the endpoint' at middleware, get the policy, etc | 11:51 |
| samueldmq | do we really need different endpoint entities to represent different URL/interface of the same endpoint ? | 11:53 |
| samueldmq | maybe the answer is in the question above ... | 11:53 |
| *** stevemar has quit IRC | 11:54 | |
| ayoung | samueldmq, Im not really in work mode, still have to drop off a kid, but..fire away | 11:55 |
| samueldmq | ayoung: there we go .. :) | 11:55 |
| samueldmq | ayoung: what if we had a single endpoint entity (owning multiple interfaces/URLs) | 11:55 |
| samueldmq | ayoung: that imply in a single endpoint_id | 11:55 |
| samueldmq | ayoung: if we have custom id/label to that endpoint entity, we use that in middleware to say 'this is what I am' | 11:56 |
| samueldmq | ayoung: that's all the thing I was thinking .. :) | 11:56 |
| ayoung | samueldmq, so, I think we are overdoing this. The URL is a label of sorts. We have sufficient granularity with that for practical purposes | 11:57 |
| ayoung | we can say that multple URLs that have the same endpoint_id will all get the same policy | 11:57 |
| ayoung | good enough | 11:57 |
| ayoung | samueldmq, I'm putting together a presentaion on the rest of Dyn Pol. Rough draft is already 30+ dense pages | 11:57 |
| samueldmq | ayoung: I think that's the opposite .. in your sentence above :) | 11:57 |
| samueldmq | ayoung: oh lol | 11:58 |
| ayoung | right now, Im not even sure if the rest of the weorld accepts that we should fetch policy at all, vs Puppet | 11:58 |
| samueldmq | ayoung: is that to the midcycle ? | 11:58 |
| ayoung | yeah | 11:58 |
| ayoung | samueldmq, I'll send you a copy when it is ~90% finished | 11:58 |
| samueldmq | ayoung: so that will cover the whole midcycle :-) | 11:58 |
| ayoung | heh | 11:58 |
| samueldmq | ayoung: sure, please do :) | 11:58 |
| samueldmq | ayoung: popcorns and soda ... watch adam's midcycle dude | 11:59 |
| ayoung | should be no surprises in it, but trying to lay it out clearly, rationale, and sequence | 11:59 |
| samueldmq | ayoung: ++ | 11:59 |
| *** markvoelker has quit IRC | 11:59 | |
| ayoung | samueldmq, OK...I'll be back in aboiut an hour | 11:59 |
| *** markvoelker has joined #openstack-keystone | 11:59 | |
| samueldmq | ayoung: go :) o/ | 11:59 |
| *** dims has joined #openstack-keystone | 12:02 | |
| *** dtantsur has joined #openstack-keystone | 12:02 | |
| *** gordc has joined #openstack-keystone | 12:02 | |
| *** bknudson has quit IRC | 12:03 | |
| dtantsur | hey folks! could you please make a release of keystonemiddleware? | 12:03 |
| dtantsur | released requirements contain old cap on pbr, which makes devstack downgrade pbr to 0.11 and fail | 12:03 |
| *** chlong has joined #openstack-keystone | 12:05 | |
| *** kiran-r has quit IRC | 12:06 | |
| *** dims has quit IRC | 12:07 | |
| *** ajayaa has quit IRC | 12:15 | |
| *** browne has joined #openstack-keystone | 12:18 | |
| *** piyanai has quit IRC | 12:20 | |
| *** fhubik is now known as fhubik_afk | 12:25 | |
| *** bknudson has joined #openstack-keystone | 12:27 | |
| *** ChanServ sets mode: +v bknudson | 12:27 | |
| *** ajayaa has joined #openstack-keystone | 12:31 | |
| *** markvoelker has quit IRC | 12:31 | |
| *** fhubik_afk is now known as fhubik | 12:33 | |
| *** edmondsw has joined #openstack-keystone | 12:38 | |
| *** tjcocozz has joined #openstack-keystone | 12:39 | |
| *** dguerri` is now known as dguerri | 12:39 | |
| *** markvoelker has joined #openstack-keystone | 12:40 | |
| *** fhubik is now known as fhubik_afk | 12:43 | |
| *** krykowski has quit IRC | 12:59 | |
| *** krykowski_ has joined #openstack-keystone | 12:59 | |
| *** browne has quit IRC | 13:10 | |
| *** jsavak has joined #openstack-keystone | 13:11 | |
| *** hrou has joined #openstack-keystone | 13:12 | |
| *** fhubik_afk is now known as fhubik | 13:12 | |
| *** _hrou_ has joined #openstack-keystone | 13:12 | |
| *** mylu has joined #openstack-keystone | 13:13 | |
| *** annasort has joined #openstack-keystone | 13:13 | |
| *** hrou has quit IRC | 13:16 | |
| *** _hrou_ has quit IRC | 13:17 | |
| *** hrou has joined #openstack-keystone | 13:18 | |
| *** kiran-r has joined #openstack-keystone | 13:18 | |
| ayoung | dtantsur, need to bug morganfainberg about that | 13:19 |
| *** dims has joined #openstack-keystone | 13:19 | |
| dtantsur | morganfainberg, hi! may I bug you about making a release of keystonemiddleware? (see above) | 13:20 |
| *** bdossant has joined #openstack-keystone | 13:21 | |
| samueldmq | ayoung: I suppose you're back :-) | 13:21 |
| samueldmq | ayoung: I've put a point on the meeting to talk about that endpoint URL vs ID vs policy custom id thing in the meeting | 13:22 |
| EmilienM | hello Keystone folks! I have a question for you guys: do we need to restart keystone service after creating the default domain? | 13:22 |
| samueldmq | ayoung: and another topic for voting on making Dynamic Policy in its own middleware ... makes sense? | 13:23 |
| bknudson | EmilienM: my experience is that you do have to restart keystone to get it to read the domain-specific config files | 13:23 |
| ayoung | EmilienM, default domain is created by migration. DO you mean changing default domain? | 13:23 |
| *** jdennis has quit IRC | 13:24 | |
| ayoung | samueldmq, so...on that second thing | 13:24 |
| ayoung | yes and no | 13:24 |
| ayoung | we make auth token into a facade that calls other middlewares | 13:24 |
| ayoung | then we can deploy policy either under the AUTH token facade or on its own | 13:24 |
| lbragstad | marekd: no worries, I think I figured it out :) | 13:26 |
| ayoung | samueldmq, for the fetch question: the label used to fetch the policy needs to be a) calculated ahead of time and b) resolvable to an endpoint | 13:26 |
| *** csoukup has joined #openstack-keystone | 13:26 | |
| ayoung | URL is the obvious candidate. Any other values need to be just as obvious | 13:26 |
| *** piyanai has joined #openstack-keystone | 13:29 | |
| EmilienM | ayoung: richm and I are working on puppet-keystone/v3 implementation and he told me we need to restart keystone to take in account a change into default_domain_id | 13:29 |
| ayoung | EmilienM, that is correct | 13:29 |
| dstanek | EmilienM: if you are changing the config you will need to restart to read in the new values | 13:29 |
| EmilienM | ayoung: so during the deployment, he wants to: configure keystone, start keystone, manage domains, etc, and then restart keystone to take default_domain_id in account | 13:29 |
| EmilienM | is that correct ^ ? | 13:29 |
| ayoung | EmilienM, config changes are only read with a server restart | 13:29 |
| samueldmq | ayoung: k, let's make that clear in the meeting and have an agreement | 13:30 |
| *** browne has joined #openstack-keystone | 13:30 | |
| samueldmq | ayoung: so we can implement it | 13:30 |
| samueldmq | ayoung: we need to get eyes on those things | 13:31 |
| EmilienM | ayoung: I know what. What I wanted to be sure is, if this just about restarting keystone *after* a config change or do we also need to restart it after the creation of the domain | 13:31 |
| EmilienM | ayoung: it's a dumb question I know but I want to be sure | 13:31 |
| amakarov | dolphm, hi! I have a change you asked for: https://review.openstack.org/#/c/189810/ (it was some time ago :) ) | 13:32 |
| dstanek | EmilienM: it should only be about reading configs. if you add/edit/delete domains the server should be able to use those | 13:32 |
| EmilienM | dstanek: cool | 13:32 |
| EmilienM | thanks guys o/ | 13:32 |
| *** boris-42 has joined #openstack-keystone | 13:33 | |
| raildo | ayoung, do you have some minutes to take a look on this https://review.openstack.org/#/c/153007/ ? :) | 13:35 |
| *** csoukup has quit IRC | 13:36 | |
| *** e0ne is now known as e0ne_ | 13:37 | |
| ayoung | raildo, I could, but both Henrynash and topol have +2ed it. One of them should have the courage of their convictions and +a it. | 13:37 |
| *** richm has joined #openstack-keystone | 13:38 | |
| ayoung | raildo, +2a. | 13:38 |
| samueldmq | ayoung: it should have at least 2 +2 from different organizations, shouldn't it ? | 13:38 |
| raildo | ayoung, but both are from IBM , henrynash told me that it’s not good practice for us to push it | 13:38 |
| *** jecarey has joined #openstack-keystone | 13:38 | |
| ayoung | samueldmq, nope. Since the writer was not an IBMer | 13:38 |
| raildo | ayoung, thanks :) | 13:38 |
| *** csoukup has joined #openstack-keystone | 13:38 | |
| *** stevemar has joined #openstack-keystone | 13:39 | |
| *** Ctina has joined #openstack-keystone | 13:39 | |
| *** e0ne_ is now known as e0ne | 13:39 | |
| openstackgerrit | Merged openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 13:41 |
| *** stevemar has quit IRC | 13:42 | |
| *** ajayaa has quit IRC | 13:45 | |
| *** blewis has joined #openstack-keystone | 13:47 | |
| amakarov | ayoung, hi! I need you support. Again :) https://review.openstack.org/#/c/141854/ | 13:47 |
| *** piyanai_ has joined #openstack-keystone | 13:49 | |
| *** piyanai has quit IRC | 13:49 | |
| *** piyanai_ is now known as piyanai | 13:49 | |
| ayoung | amakarov, done | 13:49 |
| *** TheIntern has joined #openstack-keystone | 13:50 | |
| amakarov | ayoung, cool, thanks! | 13:51 |
| amakarov | morganfainberg, greetings! | 13:51 |
| amakarov | morganfainberg, can you please review my revocation fix again? https://review.openstack.org/#/c/141854/ | 13:52 |
| *** blewis has quit IRC | 13:53 | |
| *** msno has joined #openstack-keystone | 13:54 | |
| msno | i have a Juno instalation on tripleo method and my keystone command fails in under cloud | 13:55 |
| msno | Traceback (most recent call last): | 13:55 |
| msno | File "/opt/stack/venvs/openstack/bin/keystone", line 6, in <module> | 13:55 |
| msno | from keystoneclient.shell import main | 13:55 |
| msno | File "/opt/stack/venvs/openstack/local/lib/python2.7/site-packages/keystoneclient/__init__.py", line 28, in <module> | 13:55 |
| msno | from keystoneclient import client | 13:55 |
| msno | File "/opt/stack/venvs/openstack/local/lib/python2.7/site-packages/keystoneclient/client.py", line 13, in <module> | 13:55 |
| msno | from keystoneclient import discover | 13:55 |
| msno | File "/opt/stack/venvs/openstack/local/lib/python2.7/site-packages/keystoneclient/discover.py", line 19, in <module> | 13:55 |
| msno | from keystoneclient import session as client_session | 13:55 |
| msno | File "/opt/stack/venvs/openstack/local/lib/python2.7/site-packages/keystoneclient/session.py", line 21, in <module> | 13:55 |
| msno | from oslo.serialization import jsonutils | 13:55 |
| msno | ImportError: No module named serialization | 13:55 |
| msno | 13:55 | |
| msno | 13:55 | |
| msno | can anyone give me a pointer | 13:56 |
| dstanek | msno: use paste.openstack.org next time | 13:56 |
| msno | this is the output of keystone user-list command | 13:56 |
| msno | dstanek, sure .. will do | 13:56 |
| *** r-daneel has joined #openstack-keystone | 13:56 | |
| dstanek | msno: it looks like no all of the dependencies were properly installed | 13:56 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:57 | |
| msno | dstanek, oslo.serialization package is installed actually | 13:58 |
| msno | # pip freeze | grep oslo.serialization | 13:58 |
| msno | oslo.serialization==1.7.0 | 13:58 |
| dstanek | msno: what happens when you try to import it directly from within Python? | 13:59 |
| msno | dstanek, let me check | 14:00 |
| *** Ctina has quit IRC | 14:00 | |
| *** Ctina has joined #openstack-keystone | 14:00 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Project tree deletion https://review.openstack.org/148730 | 14:01 |
| *** jsavak has quit IRC | 14:02 | |
| *** jsavak has joined #openstack-keystone | 14:03 | |
| *** Kennan2 has joined #openstack-keystone | 14:03 | |
| *** Kennan has quit IRC | 14:03 | |
| ayoung | samueldmq, http://interactive.blockdiag.com/?compression=deflate&src=eJxtjsFuwjAQRO_5itFeOPEF9FIVpUItl1I-YJ1sgtW1F9nmEFX9d5wgpLbi-ubNaJxa99V7HvHd0DH6wUuP1qsQ8LQGvao5Vmxl4IsW2qChd-8Sp4mW_MVCsIjOeqHNv6yV0p3QJgt4kykXi3W1eYxnf8-RR4GP2HJhx3nhtAtnnV99mEq-mYdKClZ7CU7Siqp0PPdcBJ-cRil5vvK3VpXnnP0Y8ZtTc6cWdUKaVfBCqlEMWXRYTjws_1wBda1l-A | 14:06 |
| ayoung | samueldmq, the arrow means "depends on" | 14:06 |
| ayoung | msno, my guess is that serialization depends on something it can't load | 14:07 |
| msno | ayoung, may be jsonutils | 14:08 |
| msno | which package provides this module | 14:08 |
| *** iamjarvo has joined #openstack-keystone | 14:09 | |
| *** iamjarvo has quit IRC | 14:09 | |
| *** iamjarvo has joined #openstack-keystone | 14:10 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Enable retrieval of default values of domain config options https://review.openstack.org/185650 | 14:10 |
| ayoung | msno, I thought that was an oslo library | 14:12 |
| dstanek | msno: what happened when you imported it? if it has a dep missing you'll see an error | 14:12 |
| msno | dstanek, i am not a python dev.. to import it in a python program and test .. let me check how to do it | 14:13 |
| *** tjcocozz has quit IRC | 14:13 | |
| dstanek | just type python in the shell | 14:13 |
| dstanek | and in the python shell type 'from oslo.serialization import jsonutils' | 14:13 |
| msno | >>> from oslo.serialization import jsonutils | 14:14 |
| msno | Traceback (most recent call last): | 14:14 |
| msno | File "<stdin>", line 1, in <module> | 14:14 |
| msno | ImportError: No module named oslo.serialization | 14:14 |
| msno | >>> | 14:14 |
| msno | btw: its python 2.7.9 | 14:14 |
| *** krykowski_ has quit IRC | 14:14 | |
| *** amrith has joined #openstack-keystone | 14:14 | |
| *** amrith has left #openstack-keystone | 14:15 | |
| *** fangzhou has joined #openstack-keystone | 14:15 | |
| lbragstad | msno: did you try installing oslo.serialization? | 14:16 |
| msno | lbragstad, its already installted .. when i check pip freeze | 14:16 |
| lbragstad | msno: what version are you using? | 14:20 |
| msno | pip freeze | grep oslo.serialization | 14:21 |
| msno | oslo.serialization==1.7.0 | 14:21 |
| lbragstad | msno: what if you do from oslo_serialization import jsonutils | 14:21 |
| lbragstad | does that work? | 14:21 |
| msno | ok.. now i checked it my venv .. | 14:22 |
| msno | it works | 14:22 |
| lbragstad | msno: you might have a version of oslo.serialization that is too new | 14:22 |
| msno | with python Python 2.7.8 | 14:22 |
| msno | ok.. let me try to install 1.6.0 | 14:22 |
| lbragstad | I am able to do 'from oslo.serialization import jsonutils' and 'from oslo_serialization import jsonutils' with 1.6.0 | 14:22 |
| lbragstad | s/1.6.0/oslo.serialization 1.6.0/ | 14:23 |
| *** btully has joined #openstack-keystone | 14:24 | |
| *** chlong has quit IRC | 14:25 | |
| msno | lbragstad, with 1.6.0 .. the error is now gone with keystone user-list | 14:25 |
| lbragstad | msno: cool | 14:26 |
| msno | but my tempest is still failing .. let me work on it :) | 14:26 |
| msno | thanks a lot..!!! | 14:26 |
| lbragstad | msno: no problem! | 14:26 |
| dstanek | msno: we've had tons of issues with conflicting dependency versions between projects | 14:26 |
| msno | dstanek, yes.. the version mismatch issues between diff modules i a nightmare to troubleshoot :) | 14:27 |
| *** krykowski has joined #openstack-keystone | 14:27 | |
| *** toddnni_ has joined #openstack-keystone | 14:29 | |
| *** toddnni has quit IRC | 14:29 | |
| *** toddnni_ is now known as toddnni | 14:29 | |
| *** annasort has quit IRC | 14:30 | |
| mordred | hey everybody! (especially ayoung) | 14:31 |
| mordred | I would like to argue about my need to supply OS_USER_DOMAIN_NAME=default on clouds that have one and only one domain and it's called "default" | 14:32 |
| mordred | (I say especially ayoung, because I assume that if he agrees with me I'm golden) | 14:32 |
| ayoung | mordred, nope. I have no such power | 14:33 |
| mordred | ayoung: it has been suggested to me that things don't actually fallback to default as a value for "security" | 14:33 |
| ayoung | my agreement usually dealys things, not expedites. Sorry | 14:33 |
| mordred | ayoung: blast | 14:33 |
| dstanek | mordred: i don' | 14:34 |
| ayoung | mordred longer conversation than I can have now. Short is "Agree but irrelevant?" | 14:34 |
| dstanek | t know about security for that | 14:34 |
| dstanek | i would have assumed that's it's so a user can't mess up and get things in the wrong domain | 14:34 |
| mordred | I would assume that most users are only scoped to have access to one domain anyway | 14:35 |
| bknudson | the default domain is actually named "Default" not "default" | 14:35 |
| bknudson | the ID is "default" | 14:35 |
| dstanek | it would make scripts moving from one cloud to another broken in some cases | 14:35 |
| mordred | bknudson: ok. so that's two things I'd like to complain about | 14:35 |
| bknudson | The default domain ID is configurable. | 14:36 |
| mordred | well, not to bikeshed, but I'd suggest that a name of 'Default' and an id of $(uuidgen) would be more appropriate | 14:36 |
| bknudson | whereas the default domain name is not. | 14:36 |
| mordred | but I don't _really_ care | 14:36 |
| mordred | other than that of all the things you can kind of pass either to either parameter name, so learning how to do it 'right' is not well served by having Default vs. default - except you can use them seemingly interchangably | 14:37 |
| bknudson | you can go ahead and delete the default domain. Things should work fine but you wouldn't be able to use v2. | 14:37 |
| mordred | I just want keystone v3 to work on devstack, actually | 14:38 |
| bknudson | jamielennox is working on it and looks like he's got it working. | 14:38 |
| mordred | and the devstack currently has a default domain set which does not behave like a default domain in v3 beacuse I have to set it - but it does not add the parameter to openrc anywhere | 14:38 |
| bknudson | mordred: jamielennox has a change for openrc | 14:38 |
| mordred | awesome | 14:38 |
| mordred | that excites me | 14:38 |
| mordred | I still don't think I should have to specify the domain AT ALL if there is one and only one domain | 14:39 |
| *** woodster_ has joined #openstack-keystone | 14:39 | |
| mordred | regions work 'correctly' here | 14:39 |
| *** jsavak has quit IRC | 14:39 | |
| bknudson | it would get confusing when the admin adds a domain... things that worked would now fail. | 14:39 |
| *** jsavak has joined #openstack-keystone | 14:40 | |
| bknudson | once we get rid of v2 we won't need a default domain anymore. | 14:40 |
| mordred | v2 isn't going anywhere for like 3 years at least | 14:40 |
| mordred | in the mean time, both need to be supported in parallel | 14:40 |
| mordred | in any case- my config is updated now - so I'm really just reporting "I'm an end user and have foudn this experience painful" | 14:41 |
| bknudson | devstack should also be updating your clouds.yaml so you can use that | 14:45 |
| *** fangzhou has quit IRC | 14:46 | |
| *** krykowski has quit IRC | 14:47 | |
| openstackgerrit | janonymous proposed openstack/keystone: Python 3: Replace assertRaisesRegexp to six implementation for py3 compatibility https://review.openstack.org/193866 | 14:48 |
| *** ajayaa has joined #openstack-keystone | 14:49 | |
| *** krykowski has joined #openstack-keystone | 14:49 | |
| *** radez_g0n3 is now known as radez | 14:50 | |
| *** jsavak has quit IRC | 14:52 | |
| *** jsavak has joined #openstack-keystone | 14:52 | |
| *** bradjones|away is now known as bradjones | 14:56 | |
| *** abhishekk has quit IRC | 14:57 | |
| *** jkomg has joined #openstack-keystone | 14:57 | |
| ayoung | mordred, we all want Keystone V3 to work on Devstack | 14:57 |
| ayoung | ?me back now | 14:57 |
| *** slberger has joined #openstack-keystone | 14:57 | |
| mordred | bknudson: yah - also missing domain - but if jamie is already on it - awesome! | 14:58 |
| ayoung | mordred, so....one Idea I've had shot down a couple times is the ability tio read the Keystone config (minus secure values) from an un-authenticated API | 14:58 |
| mordred | ayoung: YES!!!!!!!!! | 14:58 |
| ayoung | and that would, at least, let the client fill in the default domain if one is not specified | 14:58 |
| mordred | ayoung: literally everyone in the world wants this | 14:58 |
| ayoung | mordred, sadly, only figuratively | 14:59 |
| ayoung | at least one person does not want it | 14:59 |
| mordred | that's sad for them | 14:59 |
| mordred | ayoung: what do they want me to purchase them? | 14:59 |
| ayoung | I think he might work for you, though, so you could apply undue pressure on him | 14:59 |
| mordred | ayoung: darn. I'm much more comfortable applying undue pressure on people who do not work for me | 14:59 |
| ayoung | mordred, heh | 14:59 |
| mordred | ayoung: I actually want such a thing from more things than keystone | 15:00 |
| ayoung | mordred, the other place I want that to work is for policy enforcement | 15:00 |
| ayoung | I want to know the name of the admin domain | 15:00 |
| mordred | ayoung: I would like an unauthenticated list of the informatino I currently keep in vendor data in os-client-config | 15:00 |
| *** jsavak has quit IRC | 15:01 | |
| ayoung | we could either read it from config, or do statement replacement upon upload/download of the to policy file...I know which I would prefer | 15:01 |
| *** jsavak has joined #openstack-keystone | 15:01 | |
| ayoung | hint, it is the one that doesn't change the content of the policy file | 15:01 |
| mordred | ayoung: I'm fine with either - as long as as a user I have a way to get the information | 15:01 |
| *** fhubik has quit IRC | 15:01 | |
| mordred | ayoung: btw - folks in defcore would like something similar to this capability as well | 15:01 |
| ayoung | mordred, https://review.openstack.org/#/c/186926/ | 15:01 |
| *** zzzeek has joined #openstack-keystone | 15:02 | |
| mordred | because, you know what - if your cloud DECLARES that it has a particular thing, then testing to see if it has that thing is less crazy than just testing all the things your cloud might have | 15:02 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 15:02 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 15:03 |
| mordred | ayoung: I am not opposed to that spec | 15:03 |
| ayoung | mordred, I'll get it on the agenda for the meeting today | 15:04 |
| morganfainberg | ayoung: make the config readable from an api. Sure. Go for it. | 15:05 |
| ayoung | morganfainberg, so the discussion was whether to do that for policy. Maybe I should have emphasized that it had enough value on its own | 15:05 |
| *** _kiran_ has joined #openstack-keystone | 15:05 | |
| *** thedodd has joined #openstack-keystone | 15:05 | |
| ayoung | morganfainberg, I was thinking in terms of "admin_domain" when we discussed it | 15:06 |
| *** _kiran_ has quit IRC | 15:06 | |
| morganfainberg | Sure. | 15:06 |
| ayoung | I think you favored the text replacement approach | 15:06 |
| morganfainberg | Im not being sarcastic here im fine with it | 15:06 |
| ayoung | morganfainberg, so, if we do that, then we can also use that data in enforcing policy. Cache values done the same way. You are OK with that? I don't think it makes sense to do both the API and text replacement in the policy file | 15:08 |
| morganfainberg | ayoung: yep. | 15:08 |
| *** slberger has left #openstack-keystone | 15:08 | |
| ayoung | morganfainberg, ++. I'm putting to gether a presentation for the midcycle on the policy stuff, to make sure we have a common understanding. I'll add that | 15:09 |
| morganfainberg | If you argue strictly policy, ill say text replacement. But you have a general use case beyond it | 15:09 |
| morganfainberg | So lets cater to the general use. | 15:09 |
| dstanek | ayoung: ++ on the presentation | 15:09 |
| * morganfainberg isn't unreasonable about this stuff. | 15:10 | |
| ayoung | dstanek, I think I owe you an apology. I was wayyyyy to aggro last time we talked about this. | 15:10 |
| ayoung | dstanek, the more I work on the presentation, the more I realize we have to communicate | 15:10 |
| * mordred likes communication! | 15:10 | |
| dstanek | ayoung: i don't think so | 15:10 |
| ayoung | and I have had all this stuff in my head, trying to make it clear is frustrating,....so face to face should help | 15:11 |
| morganfainberg | mordred: only if we communicate after coffee. | 15:11 |
| dstanek | ayoung: about aggro, not communication | 15:11 |
| morganfainberg | dstanek: lol | 15:11 |
| morganfainberg | ^_^ | 15:11 |
| mordred | mmm. coffee | 15:11 |
| mordred | so ... | 15:11 |
| mordred | keystoneclient.openstack.common.apiclient.exceptions.NotFound: Could not find token: secretsecret (HTTP 404) (Request-ID: req-19599388-650a-4203-a996-39723924ac52) | 15:11 |
| dstanek | ayoung: it's good that you are passionate about your ideas...just remember that very few of us can see what's in your head | 15:11 |
| mordred | I'm trying to use this token auth plugin | 15:11 |
| mordred | and I feel like I might be doing something wrong | 15:12 |
| ayoung | mordred, that looks wrong on a couple accounts.... | 15:12 |
| ayoung | mordred, I am going to make a guess | 15:12 |
| ayoung | you are trying to get shade to use a single token for multiple calls, and want to pass the token from request to request, because each happens in its own process. Right? | 15:13 |
| mordred | nope | 15:13 |
| ayoung | darn | 15:13 |
| mordred | I'm trying to debug use of the admin token for service registration bootstrapping | 15:13 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 15:13 |
| morganfainberg | This is bootstrap stu.. Yeah | 15:13 |
| ayoung | mordred, AH | 15:13 |
| mordred | however - I'm not ACTUALLY bootstrapping anything righ tnow | 15:13 |
| mordred | right now I'm just trying to use that auth and print the catalog it gets | 15:14 |
| *** mabrams has quit IRC | 15:14 | |
| morganfainberg | ayoung: we need the plugin that doesnt do catalog mangling / lookup | 15:14 |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Catch exception.Unauthorized when checking for admin https://review.openstack.org/198071 | 15:14 |
| mordred | it's possible that's a wrong choice | 15:14 |
| morganfainberg | Thats the token endpoint option set, right? | 15:14 |
| ayoung | jamielennox, wrote that, as I recall...let me see.... | 15:14 |
| *** jkomg has quit IRC | 15:14 | |
| mordred | morganfainberg: is there a good way for me to verify that I'm passing the right creds and being authed? | 15:14 |
| mordred | (I just tried v3token instead of token fwiw) | 15:15 |
| ayoung | mordred, that is a client side error, I think. Maybe it is the wrong auth plugin ...one sec | 15:15 |
| mordred | ayoung: /home/mordred/src/openstack/python-keystoneclient/keystoneclient/auth/identity/v3/base.py | 15:15 |
| *** e0ne is now known as e0ne_ | 15:16 | |
| morganfainberg | mordred: you can always use curl to 100% check, but let ayoung look at this for a sec, he'll have a better answer than i will pre-coffee | 15:16 |
| mordred | cool | 15:16 |
| *** dims has quit IRC | 15:16 | |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Catch exception.Unauthorized when checking for admin https://review.openstack.org/198071 | 15:18 |
| ayoung | mordred, OK, first things first. I can do `openstack user list ` with only the OS_SERVICE* env vars set | 15:20 |
| ayoung | I think that uses the plugin | 15:20 |
| *** TrevorV has joined #openstack-keystone | 15:20 | |
| ayoung | nope I lied | 15:20 |
| ayoung | excellent...ok | 15:21 |
| ayoung | let me now get this onto a debugable system | 15:21 |
| * morganfainberg tries to context switch from bed to keystoneclient to be useful in this convo. | 15:22 | |
| *** stevemar has joined #openstack-keystone | 15:22 | |
| *** _cjones_ has joined #openstack-keystone | 15:23 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Fix diagram representation in rst https://review.openstack.org/199148 | 15:23 |
| mordred | https://gist.github.com/emonty/81612fc0ee759b56eaec | 15:25 |
| mordred | there is my clouds.yaml and a small test program taht fails | 15:25 |
| mordred | the URL there is to a thing that just ran a default devstack | 15:26 |
| *** e0ne_ is now known as e0ne | 15:26 | |
| * mordred still digging - just wanted other people to be able to follow along if they want | 15:26 | |
| morganfainberg | amakarov: +2/+A on group revocation fixes. | 15:27 |
| amakarov | morganfainberg, thanks! | 15:27 |
| *** _cjones_ has quit IRC | 15:28 | |
| *** _cjones_ has joined #openstack-keystone | 15:28 | |
| amakarov | morganfainberg, I have a question about Tokyo: I'd like to conduct a talk about trusts/delegations or whatever it will be called that time. A deadline to submit a talk is Jul 15. Have these talks to be discussed in the team or anybody may tell anything? | 15:30 |
| morganfainberg | amakarov: you want to do a design summit session or a conference presentation? | 15:31 |
| morganfainberg | amakarov: if its the user conference part, submit a talk ;). You should do it. We dont discuss those internal to the dev team here. | 15:31 |
| morganfainberg | If its a design summit session thing, that will be later on / closer to the summit. | 15:32 |
| *** diazjf has joined #openstack-keystone | 15:33 | |
| *** annasort has joined #openstack-keystone | 15:33 | |
| mordred | morganfainberg: while I'm bugging you ... what's the 'right' way for me to enable http request tracing when using keystoneclient as a library | 15:33 |
| *** kiran-r has quit IRC | 15:33 | |
| amakarov | morganfainberg, I've discovered that despite the presence of the trust feature other components still prefer using tokens to perform long operations in hope that tokens survive long enough for operation to end :) | 15:33 |
| *** jkomg has joined #openstack-keystone | 15:33 | |
| amakarov | morganfainberg, so it's more technical then customer-oriented. | 15:34 |
| *** slberger has joined #openstack-keystone | 15:35 | |
| amakarov | morganfainberg, I feel it'll be better done on design summit... | 15:36 |
| mordred | ayoung: this is what it's doing: | 15:38 |
| mordred | REQ: curl -g -i -X POST http://192.168.1.231:5000/v3/auth/tokens -H "User-Agent: python-keystoneclient" -H "Content-Type: application/json" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}e579c4fea528a36862a0a5352587a30d58da532f" -d '{"auth": {"scope": {"project": {"domain": {"id": "default"}, "name": "admin"}}, "identity": {"token": {"id": "secretsecret"}, "methods": ["token"]}}}' | 15:38 |
| ayoung | mordred, try this: | 15:39 |
| ayoung | http://fpaste.org/240934/83560143/ | 15:39 |
| ayoung | OK..lets get some debugging in there.... | 15:39 |
| morganfainberg | mordred: if you enable debug logging for the keystoneclient https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/session.py#L166 you'll get debug output | 15:39 |
| morganfainberg | mordred: for http tracing. | 15:40 |
| *** solomondg has joined #openstack-keystone | 15:40 | |
| morganfainberg | amakarov: that is user-conference side and part of the july 15th deadline | 15:40 |
| morganfainberg | amakarov: my recommendation: submit your talk :) | 15:40 |
| morganfainberg | mordred: that debug output should likely be just the logger defaults | 15:41 |
| ayoung | morganfainberg, so...don't use the ADMIN_TOKEN to request a token | 15:41 |
| morganfainberg | ayoung: oh yeah don't do that | 15:41 |
| morganfainberg | it *can't* work | 15:41 |
| morganfainberg | we don't have any of that wired up in keystone | 15:41 |
| ayoung | that does not work. What are you trying to do? Register an endpoint or some other setup call? | 15:41 |
| mordred | ayoung: ok - your script works | 15:42 |
| mordred | and yes - I was just trying to print the catalog to verify I was logged in | 15:42 |
| mordred | so, it's possible I picked a bad thing to verify | 15:42 |
| amakarov | morganfainberg, thanks :) | 15:42 |
| *** dims has joined #openstack-keystone | 15:43 | |
| mordred | morganfainberg: just setting debug logging does not get the curl calls - I had to edit session.py to get that, fwiw | 15:43 |
| morganfainberg | mordred: admin token doesn't get a catalog either | 15:43 |
| mordred | nod | 15:43 |
| mordred | I will try a new synthetic test armed with this information! | 15:43 |
| morganfainberg | mordred: hm. the session logging should work as long as the logger is enabled for debug | 15:43 |
| *** bdossant has quit IRC | 15:44 | |
| *** lufix has quit IRC | 15:45 | |
| morganfainberg | mordred: the logger *may* be overridden and passed through on the <session>.request() method as well | 15:45 |
| morganfainberg | mordred: but as long as that logger is enabled for debug you should get curl output. the default is to use logging.getLogger(__name__) | 15:45 |
| *** TrevorV has left #openstack-keystone | 15:45 | |
| mordred | aha! | 15:45 |
| mordred | morganfainberg: nope. that definitely does not work | 15:46 |
| morganfainberg | s/curl output/curl log lines | 15:46 |
| mordred | ayoung, morganfainberg: so - for the other thing - I'm in a slight bit of a pickle ... | 15:46 |
| mordred | in order for me to get a keystone_client object | 15:46 |
| mordred | I do this: auth_url=self.get_session_endpoint('identity'), | 15:46 |
| mordred | because of how auth plugins work - I can't assume I have an endpoint without asking the session infrastructure for it | 15:46 |
| mordred | however, that does catalog lookups | 15:47 |
| ayoung | mordred, | 15:47 |
| ayoung | for endpoint in keystone_client.endpoints.list(): | 15:47 |
| ayoung | print(endpoint) | 15:47 |
| mordred | ayoung: I have to construct a keystone_client first | 15:47 |
| morganfainberg | mordred: this is chicken egg? where you're trying to bootstrap [long term goal] so you can do things? | 15:47 |
| mordred | oh! when did it start working that I can just pass in a session? | 15:47 |
| mordred | lemme try something ... | 15:47 |
| ayoung | mordred, the short of it is that the ADMIN_TOKEN really should be used for setting up the first admin user and then use the admin user to do everything else | 15:48 |
| morganfainberg | mordred: since the very begining of session land. | 15:48 |
| morganfainberg | mordred: we should have always supported that afaik | 15:48 |
| mordred | I have an auth_url param in my keystoen_client constructor call, I believe because ksc was unhappy not getting one | 15:48 |
| ayoung | morganfainberg, nope...jamie added a new auth plugin for Admin token .... mumbe ago | 15:48 |
| mordred | BECAUSE it assumes admin acess | 15:48 |
| morganfainberg | ayoung: ah | 15:48 |
| *** slberger has quit IRC | 15:48 | |
| ayoung | morganfainberg, jamielennox is kindof sneaky in a cool sort of way | 15:48 |
| ayoung | or | 15:48 |
| ayoung | morganfainberg, jamielennox is kindof cool in a sneaky sort of way | 15:49 |
| mordred | Error constructing keystone client: Not enough information to determine URL. Provide either auth_url or endpoint | 15:49 |
| *** Akshay00 has joined #openstack-keystone | 15:49 | |
| morganfainberg | mordred: yeah so you need to pass the endpoint in for this case, making discovery not happen | 15:49 |
| mordred | but ayound did not do that in his code | 15:49 |
| morganfainberg | *or* need a real token so discovery can happen | 15:49 |
| ayoung | mordred, give me the larger use case, and maybe I can help out. | 15:49 |
| *** anhhuynx has joined #openstack-keystone | 15:50 | |
| mordred | ayoung: so - I'm trying to write code that gets a keystone client object from input parameters | 15:50 |
| morganfainberg | stevemar: you're on the hook for things today [see the email i reply to for henry] | 15:50 |
| morganfainberg | stevemar: :) | 15:50 |
| ayoung | import logging | 15:50 |
| ayoung | logging.basicConfig(level=logging.DEBUG) | 15:50 |
| ayoung | ^^ should get you logging | 15:50 |
| mordred | it gets me logging | 15:50 |
| morganfainberg | ayoung: ++ | 15:51 |
| mordred | it does not get me curl output | 15:51 |
| morganfainberg | mordred: you can pass a logger with debug to .request() (logger=) | 15:51 |
| mordred | http://paste.openstack.org/show/352289 | 15:51 |
| ayoung | mordred, weeeeeeieeeird | 15:51 |
| mordred | I had to do that to get curl output | 15:51 |
| morganfainberg | or .. hm | 15:51 |
| mordred | I got other debug output | 15:51 |
| ayoung | DEBUG:keystoneclient.session:REQ: curl -g -i -X GET http://10.16.18.219:35357/v2.0/users -H "User-Agent: python-keystoneclient" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}7c0eb3ba0dba3fadaf5c8810303ad8d74286682d" | 15:52 |
| mordred | yup. I did not get that without that patch | 15:52 |
| mordred | but - I'll circle back and debug that next | 15:52 |
| mordred | if that's the intended operation - I'm sure I'm doing something wrong | 15:52 |
| morganfainberg | oh something is setting log=False maybe on .request() | 15:52 |
| mordred | and it's good to know that's how it's supposed to work | 15:52 |
| ayoung | mordred, I have it as the first line of the script | 15:52 |
| morganfainberg | mordred: yeah if you're commenting out if log, that means something is doing .request(..., log=False, ...) | 15:53 |
| ayoung | mordred, OK. So back to the larger question: is this for Shade and ansible consumption? | 15:53 |
| mordred | yes | 15:54 |
| mordred | ayoung: back to the hard problem ... I was hoping that I could use Client() and a plugin name to construct a Client object in a general way | 15:54 |
| ayoung | and you want to have a way to build the auth plugin based on parameters. | 15:54 |
| mordred | but - it's seeming liek I'm going to have to have "if plugin_name: 'endpoint' then: construct the Client differently" | 15:54 |
| mordred | yes | 15:54 |
| ayoung | you should be able to do that, we use stevedore to load them....shade should be OK with that | 15:55 |
| anhhuynx | Will someone please take a look at my short patch to the v3 API documentation? https://review.openstack.org/#/c/198921/ | 15:55 |
| ayoung | I had it in an eraly copy of some Dajngo openstack auth code | 15:55 |
| mordred | ayoung: nono- shade does a fine job with that | 15:55 |
| mordred | ayoung: it's that the sequence for constructing things and the arguments are different depending on executional context | 15:55 |
| mordred | which is potentially fair in this case | 15:55 |
| ayoung | mordred, so... https://github.com/admiyo/ossipee/blob/master/ossipee.py#L625 | 15:56 |
| mordred | so I think what I need to do is override my keystone_client method in the OperatorCloud class so that it has a different behavior if the user has specified a token auth plugin | 15:56 |
| mordred | ayoung: right. that is not nearly genearl enough | 15:56 |
| mordred | ayoung: because you're tying to v3.auth | 15:56 |
| ayoung | mordred, heh...V2 MUST DIE! | 15:56 |
| mordred | right. good luck with that. | 15:57 |
| mordred | seriously | 15:57 |
| mordred | I get it | 15:57 |
| mordred | v3 is better | 15:57 |
| mordred | HOWEVER | 15:57 |
| ayoung | we'll ignore the fact that the public cloud I have access to blows up with V3 auth | 15:57 |
| mordred | reality also exists where there are no usable public clouds running v3 | 15:57 |
| mordred | (unitedstack is, but I can't figure out how to pay them for my account, so it is not on) | 15:57 |
| mordred | ayoung: I tink I have a path forward - i'll paste in the patch here in just a sec so you can check me | 15:58 |
| mordred | ayoung: thanks! this has been _super_ helpful | 15:58 |
| ayoung | mordred, we have logic along these lines in the openstack common CLI | 15:58 |
| ayoung | let's see.... | 15:58 |
| mordred | ayoung: yah. although it sadly uses its own magical auth plugins | 15:58 |
| mordred | I would love a world where this logic was in either ksc or ksa | 15:58 |
| mordred | hrm | 15:58 |
| mordred | maybe I should make a patch to ksa once I get this sorted | 15:59 |
| ayoung | ksa.auth.factory() | 15:59 |
| ayoung | returns and auth plugin based on the env vars. | 15:59 |
| ayoung | something like that? | 15:59 |
| *** jistr has quit IRC | 16:00 | |
| *** mgarza_ has joined #openstack-keystone | 16:00 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor _supports_bind_authentication method https://review.openstack.org/197699 | 16:00 |
| ayoung | mordred, how does shade do this today? | 16:00 |
| *** slberger has joined #openstack-keystone | 16:01 | |
| mordred | ayoung: possibly - except I don't want something else processing env vars right now | 16:01 |
| *** slberger has left #openstack-keystone | 16:02 | |
| mordred | ayoung: we do this: https://github.com/openstack-infra/shade/blob/master/shade/__init__.py#L399 | 16:02 |
| mordred | to get a session | 16:02 |
| mordred | ayoung: and this; https://github.com/openstack-infra/shade/blob/master/shade/__init__.py#L429 to get a Client | 16:03 |
| mordred | ayoung: it's the second thign I need to make smarter | 16:03 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor _supports_bind_authentication method https://review.openstack.org/197699 | 16:03 |
| mordred | ayoung: since it's not accounting for admin tokens not being able to look into the catalog | 16:03 |
| *** solomondg has quit IRC | 16:03 | |
| ayoung | mordred, so I don't think you need to pass auth_url to the session | 16:04 |
| morganfainberg | it's another sign we need to kill the whole "admin token" concept | 16:04 |
| ayoung | and, in fact, I don;t think you are supposed to | 16:04 |
| *** solomondg has joined #openstack-keystone | 16:04 | |
| mordred | ayoung: I don't | 16:04 |
| mordred | I pass it to the Client | 16:04 |
| *** dtantsur is now known as dtantsur|afk | 16:04 | |
| mordred | I pass an auth plugin to the session | 16:04 |
| ayoung | mordred, https://github.com/openstack-infra/shade/blob/master/shade/__init__.py#L434 | 16:04 |
| mordred | https://github.com/openstack-infra/shade/blob/master/shade/__init__.py#L419 | 16:04 |
| mordred | right. that's the Client constructor | 16:05 |
| mordred | it is required to pass an auth_url to that | 16:05 |
| ayoung | nope | 16:05 |
| ayoung | I think that might again be an ADMIN_TOKEN workaround | 16:05 |
| ayoung | self.keystone = keystone_v3.Client(session=session) | 16:05 |
| mordred | ayoung: I promise: Error constructing keystone client: Not enough information to determine URL. Provide either auth_url or endpoint | 16:06 |
| mordred | ayoung: I'm not constructing a keystone_v3.Client | 16:06 |
| solomondg | Question: Is it acceptable to modify a "base" function, such as the keystone-manage script, for a patch? Or should I try to have as little impact as possible? I'm pretty much writing a script that checks for the keystone.conf file when you run keystone-manage, and I'm not sure if I should have it run when keystone-manage is called, or only when the | 16:06 |
| solomondg | subject of the bug (db_sync) is called. | 16:06 |
| ayoung | mordred, let me try a V2.... | 16:06 |
| mordred | I'm constructing a ke keystoneclient.client.Client | 16:06 |
| openstackgerrit | Nathan Jewell proposed openstack/keystone: Saves output of run_tests.sh to .log file https://review.openstack.org/196285 | 16:06 |
| dstanek | solomondg: what are you checking? | 16:07 |
| *** jistr has joined #openstack-keystone | 16:07 | |
| *** Akshay00 has quit IRC | 16:07 | |
| *** dikonoor has quit IRC | 16:07 | |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Catch exception.Unauthorized when checking for admin https://review.openstack.org/198071 | 16:08 |
| ayoung | mordred, http://paste.openstack.org/show/352401/ | 16:08 |
| ayoung | let me try with password | 16:08 |
| *** Akshay00 has joined #openstack-keystone | 16:08 | |
| solomondg | It has to do with a wishlist item where db_sync doesn't have any effect when run without access to keystone.conf (whether file not found or not enough user permissions), but does not report any errors. | 16:09 |
| mordred | ayoung: but can you do it with keystoneclient.client.Client ? | 16:09 |
| ayoung | mordred, I'll check | 16:10 |
| dstanek | solomondg: link? | 16:10 |
| solomondg | https://bugs.launchpad.net/keystone/+bug/1273273 | 16:11 |
| openstack | Launchpad bug 1273273 in Keystone "keystone-manage should produce a friendlier error when it cannot read the config files" [Wishlist,In progress] - Assigned to Solomon (solomongreenberg) | 16:11 |
| ayoung | mordred, http://paste.openstack.org/show/352402/ | 16:12 |
| stevemar | morganfainberg: ayoung want to review this ldap patch? https://review.openstack.org/#/c/198270/ | 16:13 |
| stevemar | henry and i have +2ed, but it's coming from an ibmer, so we're on hold | 16:13 |
| mordred | ayoung: that's still v2_0.client | 16:13 |
| ayoung | mordred, hmmm. | 16:14 |
| ayoung | yep, that does complain. | 16:15 |
| ayoung | let's see... | 16:15 |
| mordred | ayoung: I'd be more than happy to make a ksc patch if this is behavior you expect to work | 16:15 |
| ayoung | mordred, OK, so I'm passing in session.... | 16:15 |
| ayoung | which kicks us in to discover | 16:16 |
| mordred | ayoung: (btw, if you solve this, you will be my new favorite pony) | 16:16 |
| openstackgerrit | Merged openstack/keystone-specs: Fix diagram representation in rst https://review.openstack.org/199148 | 16:16 |
| stevemar | amakarov: did someone on the keystone team ask you to open https://bugs.launchpad.net/keystone/+bug/1472306 ? | 16:16 |
| openstack | Launchpad bug 1472306 in Keystone "Broken ascii diagram in materialized path spec" [Undecided,Fix committed] - Assigned to Alexander Makarov (amakarov) | 16:16 |
| *** fangzhou has joined #openstack-keystone | 16:17 | |
| ayoung | mordred, OK, so I agree, it is not working. It looks to me like he (jamie) has intentionally bypassed the session in the discovery stage. | 16:20 |
| *** ajayaa has quit IRC | 16:20 | |
| *** hogepodge has quit IRC | 16:21 | |
| mordred | ayoung: ok. cool | 16:21 |
| ayoung | and...since you already have a session...that seems wierd. http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/discover.py#n286 | 16:21 |
| ayoung | I wonder if he is expecting people to do someothing like | 16:21 |
| ayoung | keystoneclient.discover.create_client() | 16:21 |
| mordred | jamielennox: ^^ when you awaken ... | 16:22 |
| *** slberger has joined #openstack-keystone | 16:22 | |
| dstanek | solomondg: do you need to do more than revive the existing change? | 16:23 |
| *** krykowski has quit IRC | 16:23 | |
| ayoung | mordred, https://review.openstack.org/#/c/182118/ | 16:23 |
| ayoung | mordred, so jamielennox is battling that himself. | 16:25 |
| amakarov | stevemar, good day! Nobody asked for it | 16:25 |
| *** solomondg has quit IRC | 16:27 | |
| ayoung | amakarov, https://review.openstack.org/#/c/186926/3 please remove -1. New rule, don;'t -1 specs just for questions. | 16:30 |
| ayoung | bother me directly instead, please! | 16:30 |
| *** solomondg has joined #openstack-keystone | 16:30 | |
| solomondg | Sorry about that, had internet problems | 16:31 |
| dstanek | solomondg: do you need to do more than revive the existing change? | 16:31 |
| amakarov | ayoung, done | 16:31 |
| ayoung | amakarov, thanks. Did my answer make sense? Did I post my answer? | 16:31 |
| ayoung | I didn;t | 16:32 |
| ayoung | ok...now posted | 16:32 |
| *** slberger has quit IRC | 16:32 | |
| *** e0ne has quit IRC | 16:33 | |
| amakarov | ayoung, I see. The question is: can exposed whitelist be changed from the outside to expose something secret? | 16:33 |
| ayoung | amakarov, this is a read only API | 16:33 |
| ayoung | "query configuration via web API " | 16:34 |
| mordred | ayoung: \o/ | 16:34 |
| ayoung | not "set configuration via web API" | 16:34 |
| amakarov | ayoung, oh, well... Missed my attention :) | 16:34 |
| *** jistr has quit IRC | 16:35 | |
| *** msno has quit IRC | 16:35 | |
| ayoung | amakarov, No problem...always feel free to question me directly, and you can put questions in the code. Just remember that a -1 stops the bus. | 16:35 |
| ayoung | so only -1 if there is risk you can see, please | 16:35 |
| ayoung | and ,since spec is not code, we can amend a spec after acceptance | 16:35 |
| solomondg | dstanek: I believe so... It seems that much of the functionality of the old keystone-manage (from that patch) has been moved to other files, most notably cli.py, from my understanding. I'd also like to have a slightly more eloquent response than simply reporting the absence of the config file and/or permissions needed to read it. | 16:35 |
| amakarov | ayoung, that's good: I had a feeling that -1 is just a heads-up for almost everything :) | 16:36 |
| dstanek | solomondg: what else would be in the response? | 16:36 |
| ayoung | amakarov, not your fault. It is a norm we've created in the team culture, and something I'd like to change. | 16:37 |
| amakarov | ayoung, is our new culture described? It'd be nice to have basic values written down somewhere :) | 16:38 |
| ayoung | culture makes me thing " fungal rot, bacterial formation/Microbes, enzymes, mould and oxidation" | 16:38 |
| ayoung | amakarov, I think that there is a doc that describes the spec process. It might be Nova specific. | 16:39 |
| solomondg | dstanek: At least in its current state, the user can re-define the keystone.conf path, abort the operation or ignore the absence of files/permissions and force the operation. It can also copy the keystone.conf.sample file into the keystone.conf file, with the paths to the two files being definable by the user (with default values given, of course). | 16:40 |
| amakarov | ayoung, hm, I assusiate culture with arts :) | 16:40 |
| amakarov | s/assusiate/associate/ | 16:40 |
| ayoung | Я некультурным | 16:41 |
| diazjf | uncultured? | 16:42 |
| amakarov | ayoung, google translate makes funny attempts sometimes :) | 16:42 |
| ayoung | amakarov, not sure about the Я but pretty sure I meant "NEEECULTOOOORNIE!" | 16:43 |
| *** lufix has joined #openstack-keystone | 16:44 | |
| ayoung | Некултурний versus некультурны | 16:44 |
| *** htruta_ has joined #openstack-keystone | 16:46 | |
| amakarov | ayoung: "Ovvvercoming langage beariers!" | 16:46 |
| ayoung | I support the right to carry and arm bears | 16:47 |
| *** kiran-r has joined #openstack-keystone | 16:47 | |
| amakarov | ayoung, bears will surely appreciate :) | 16:48 |
| *** dikonoor has joined #openstack-keystone | 16:50 | |
| breton | amakarov: there was a big discussion on the ml about it | 16:51 |
| *** slberger has joined #openstack-keystone | 16:52 | |
| amakarov | breton, about what exactly? | 16:53 |
| stevemar | morganfainberg: gonna push that ldap patch | 16:53 |
| breton | amakarov: about asking questions and putting -1 | 16:53 |
| breton | amakarov: http://lists.openstack.org/pipermail/openstack-dev/2015-April/thread.html#62492 | 16:53 |
| morganfainberg | stevemar ok | 16:53 |
| stevemar | amakarov: sry, i was afk. i was going to say you don't need to open a bug to fix typos in keystone-specs :P | 16:54 |
| stevemar | amakarov: cause i plan on using the resolved bugs at the end of the release for creating release notes about keystone :) | 16:54 |
| *** lufix has quit IRC | 16:55 | |
| *** Lactem has joined #openstack-keystone | 16:55 | |
| stevemar | its closed now with fix commited, but next time, just make the change to keystone-specs :) | 16:55 |
| *** mylu has quit IRC | 16:56 | |
| amakarov | stevemar, ok, I understand | 16:56 |
| amakarov | stevemar, so specs cannot have bugs, or is there some policy about it? | 16:58 |
| dstanek | solomondg: so you don't want to just give them a better error message? you want to allow them to ignore the error? | 16:58 |
| *** jsavak has quit IRC | 16:59 | |
| *** afazekas has quit IRC | 17:01 | |
| stevemar | amakarov: no policy about it - just the | 17:02 |
| solomondg | dstanek: I don't think it would be that bad of an idea. At least from my (limited) experience, I've found that it's usually good to at least have the option of ignoring an error message that won't result in a crash/exception. I'm probably wrong though, haha. | 17:02 |
| amakarov | stevemar, common sense? ) | 17:02 |
| stevemar | the keystone project should try to be about keystone server bugs | 17:02 |
| amakarov | stevemar, ok | 17:02 |
| dstanek | solomondg: i think in this case if you can't read the config file then we shouldn't go any further | 17:03 |
| solomondg | dstanek: Okay, then. I'll remove the part that allows you to ignore the error. | 17:03 |
| *** aix has quit IRC | 17:08 | |
| *** piyanai has quit IRC | 17:08 | |
| solomondg | dstanek: So, a change directly to keystone-manage is acceptable? | 17:09 |
| *** amaretskiy has quit IRC | 17:09 | |
| dstanek | solomondg: sure, i don't see why not | 17:09 |
| *** amaretskiy has joined #openstack-keystone | 17:09 | |
| *** e0ne has joined #openstack-keystone | 17:09 | |
| solomondg | Great. Thanks for the help! | 17:09 |
| *** jsavak has joined #openstack-keystone | 17:09 | |
| *** ajayaa has joined #openstack-keystone | 17:10 | |
| *** lhcheng has joined #openstack-keystone | 17:10 | |
| *** ChanServ sets mode: +v lhcheng | 17:10 | |
| *** gyee has joined #openstack-keystone | 17:12 | |
| *** ChanServ sets mode: +v gyee | 17:12 | |
| *** piyanai has joined #openstack-keystone | 17:15 | |
| *** zzzeek has quit IRC | 17:16 | |
| anhhuynx | Will someone please take a look at my short patch to the v3 API documentation? https://review.openstack.org/#/c/198921/ | 17:17 |
| *** e0ne is now known as e0ne_ | 17:18 | |
| *** david-lyle has quit IRC | 17:19 | |
| ayoung | anhhuynx, looking | 17:20 |
| ayoung | anhhuynx, so, why? | 17:21 |
| *** e0ne_ is now known as e0ne | 17:21 | |
| anhhuynx | Because there is a functionality that was missing documentation | 17:21 |
| anhhuynx | So I added it | 17:21 |
| ayoung | anhhuynx, hmmm, not sure where that doc comes from. | 17:21 |
| dstanek | is that what the #openstack-docs folks maintain? | 17:22 |
| anhhuynx | ayoung: It is the Identity API v3 http://developer.openstack.org/api-ref-identity-v3.html#listCredentials | 17:22 |
| *** browne has quit IRC | 17:22 | |
| anhhuynx | dstanek: It seems so, but they seem to always be inactive | 17:23 |
| *** kiran-r has quit IRC | 17:23 | |
| ayoung | anhhuynx, http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n773 is the doc that we've produced from this team. Not sure who translated it to docbook | 17:23 |
| openstackgerrit | Akshay Aggarwal proposed openstack/keystone: Catch exception.Unauthorized when checking for admin https://review.openstack.org/198071 | 17:24 |
| dstanek | anhhuynx: i don't know anything about WADL so i can't help you there - if you need +2s you should talk with the docs folds, but i thought that site what driven from Keystone's documentation | 17:24 |
| ayoung | anhhuynx, it certainly looks like it was missing | 17:25 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n4521 | 17:25 |
| *** TheIntern has quit IRC | 17:25 | |
| anhhuynx | but not /v3/credentials?user_id=<user_id> | 17:26 |
| *** e0ne is now known as e0ne_ | 17:26 | |
| anhhuynx | not sure why that didn't send | 17:26 |
| anhhuynx | the /v3/credentials/<user_id> was documented* | 17:27 |
| *** e0ne_ is now known as e0ne | 17:27 | |
| anhhuynx | ayoung: Thank you for the +1 | 17:29 |
| ayoung | anhhuynx, keep up the good work | 17:30 |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Catch exception.Unauthorized when checking for admin https://review.openstack.org/198071 | 17:31 |
| Lactem | : D | 17:31 |
| Akshay00 | can someone please review my patch: https://review.openstack.org/#/c/198924/1 ? | 17:31 |
| dstanek | Akshay00: patience :-) too many patches and not enough time | 17:32 |
| *** e0ne is now known as e0ne_ | 17:33 | |
| *** njnjnj has joined #openstack-keystone | 17:34 | |
| *** zzzeek has joined #openstack-keystone | 17:35 | |
| dstanek | uggg...i still have 159 patches in my next-review queue | 17:35 |
| Lactem | Sorry to hear dstanek. Hard life | 17:35 |
| raildo | or core life? :P | 17:36 |
| *** piyanai has quit IRC | 17:36 | |
| Lactem | Yeah core life. | 17:36 |
| *** blewis has joined #openstack-keystone | 17:36 | |
| *** mylu has joined #openstack-keystone | 17:37 | |
| *** blewis` has joined #openstack-keystone | 17:37 | |
| *** Akshay00 has quit IRC | 17:38 | |
| *** Lactem has quit IRC | 17:39 | |
| *** piyanai has joined #openstack-keystone | 17:39 | |
| *** e0ne_ is now known as e0ne | 17:39 | |
| *** piyanai has quit IRC | 17:39 | |
| *** piyanai has joined #openstack-keystone | 17:40 | |
| openstackgerrit | janonymous proposed openstack/keystone: Python 3: Replace assertRaisesRegexp to six implementation for py3 compatibility https://review.openstack.org/193866 | 17:40 |
| *** blewis has quit IRC | 17:41 | |
| *** njnjnj has quit IRC | 17:41 | |
| *** diazjf has quit IRC | 17:45 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Modified command used to run keystone-all. https://review.openstack.org/198924 | 17:46 |
| *** Akshay00 has joined #openstack-keystone | 17:46 | |
| *** dguerri is now known as dguerri` | 17:47 | |
| ayoung | mordred, do services other than keystone expose APIs to manage resources not in projects or owned by users? THe only example I've come across thus far is Hypervisors by Nova | 17:51 |
| morganfainberg | I solved the core life issue dstanek has. I use a coin. Heads is a -1 tails is a -1, if it lands on its edge its a +2 (/sarcasm) | 17:51 |
| dstanek | morganfainberg: i could just write a bot that gives every review a '-1' with a 'needs a little work' comment - that would probably be pretty accurate | 17:52 |
| *** diazjf has joined #openstack-keystone | 17:53 | |
| morganfainberg | dstanek: lol | 17:53 |
| lbragstad | dstanek: nice | 17:53 |
| lbragstad | dstanek: make it pick from a list of responses = ['almost there', 'needs just a little more work', 'I'd like to see another test'] | 17:54 |
| mordred | ayoung: I have no idea - I have not gone far enough down the rabbit hoel to nkow that | 17:54 |
| dstanek | "I'd liek to see another test" is a good one | 17:55 |
| morganfainberg | lbragstad: and every 1 | 17:55 |
| mordred | ayoung: btw - there does not seem to be a way for me to construct the same auth plugin you constructed in your sample code via get_plugin_class | 17:55 |
| ayoung | mordred, fair enough. I'm thinking, though, that everything should be scoped | 17:55 |
| morganfainberg | In 1000 -2 "oh hell no" | 17:55 |
| lbragstad | lol | 17:55 |
| mordred | ayoung: if I try "token_endpoint" - I get <class 'openstackclient.api.auth_plugin.TokenEndpoint'> | 17:55 |
| mordred | :) | 17:55 |
| ayoung | morganfainberg, I already have a bot that looks for all +1/+2 and adds a +A | 17:55 |
| ayoung | mordred, hemmm | 17:56 |
| *** topol has joined #openstack-keystone | 17:56 | |
| *** ChanServ sets mode: +v topol | 17:56 | |
| morganfainberg | ayoung: its ok the bot im working on looks for +2/+A and slaps it with a -1 workflow *shiftyeyes* | 17:56 |
| *** Akshay00 has quit IRC | 17:57 | |
| morganfainberg | topol: after meeting today need to bug you. | 17:57 |
| topol | morganfainberg sure | 17:57 |
| mordred | ayoung: WOOT! | 17:57 |
| mordred | ayoung: with two ugly hacks, I have working code | 17:57 |
| ayoung | mordred, looks like the entrypoint is missing, too... | 17:58 |
| mordred | ayoung, morganfainberg: http://paste.openstack.org/show/352613 | 17:58 |
| dstanek | mordred: ugly hacks means that we gave you a learning opportunity | 17:58 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/setup.cfg#n30 should be inthere, I think | 17:58 |
| mordred | dstanek: and I'm eversothankful | 17:58 |
| mordred | ayoung: I agree | 17:58 |
| *** anhhuynx has quit IRC | 17:58 | |
| dstanek | mordred: then you are welcome! | 17:59 |
| morganfainberg | mordred: ive seen worse. >.> | 17:59 |
| morganfainberg | in keystone /hushed whisper | 17:59 |
| * mordred hands dstanek a mostly unmuddy donkey that hasn't taken many amphetamines in gratitude | 17:59 | |
| *** browne has joined #openstack-keystone | 17:59 | |
| ayoung | morganfainberg, I'm not certain how the auth plugin would be built from stevedore, but it has to be smart enough to pull the right varaialbes out of the envvars/CLI params | 17:59 |
| *** dikonoor has quit IRC | 18:00 | |
| stevemar | mordred gives the strangest gifts | 18:00 |
| * mordred eyes stevemar for a gift next! | 18:00 | |
| *** mgarza_ has quit IRC | 18:00 | |
| morganfainberg | mordred: you hand people the weirdest gifts from .. Some kind of really strange zoo -- or you have access to some odd purchasing system i havent found yet.... | 18:00 |
| mordred | morganfainberg: HP has at least one of _everything_ | 18:01 |
| morganfainberg | I didnt know we could expense a mostly unmuddy donkey... That is only slightly strung out on amphetamines. | 18:01 |
| *** TheIntern has joined #openstack-keystone | 18:01 | |
| morganfainberg | ayoung: the auth plugin for admin token is hard | 18:02 |
| morganfainberg | ayoung: but thenrest are fairly straight forward. | 18:02 |
| *** solomondg has quit IRC | 18:02 | |
| *** jsavak has quit IRC | 18:02 | |
| *** jsavak has joined #openstack-keystone | 18:03 | |
| *** solomondg has joined #openstack-keystone | 18:03 | |
| *** marzif_ has joined #openstack-keystone | 18:03 | |
| *** njnjnj has joined #openstack-keystone | 18:04 | |
| *** ajayaa has quit IRC | 18:04 | |
| *** anhhuynx has joined #openstack-keystone | 18:05 | |
| *** mgarza_ has joined #openstack-keystone | 18:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix code-block in federation documentation https://review.openstack.org/199208 | 18:08 |
| *** hogepodge has joined #openstack-keystone | 18:11 | |
| *** dikonoor has joined #openstack-keystone | 18:13 | |
| *** jsavak has quit IRC | 18:15 | |
| *** jsavak has joined #openstack-keystone | 18:16 | |
| *** e0ne is now known as e0ne_ | 18:17 | |
| *** anhhuynhx has joined #openstack-keystone | 18:19 | |
| *** anhhuynx_ has joined #openstack-keystone | 18:20 | |
| *** hogepodge has quit IRC | 18:20 | |
| *** anhhuynx has quit IRC | 18:20 | |
| *** marzif_ has quit IRC | 18:21 | |
| *** anhhuynhx is now known as anhhuynx | 18:21 | |
| *** njnjnj has quit IRC | 18:21 | |
| *** anhhuynx_ has quit IRC | 18:24 | |
| *** piyanai has quit IRC | 18:25 | |
| *** dikonoor has quit IRC | 18:25 | |
| *** evb1007 has joined #openstack-keystone | 18:26 | |
| *** njnjnj has joined #openstack-keystone | 18:33 | |
| *** piyanai has joined #openstack-keystone | 18:33 | |
| *** blewis` has quit IRC | 18:38 | |
| *** mgarza_ has quit IRC | 18:38 | |
| *** e0ne_ is now known as e0ne | 18:39 | |
| *** mylu has quit IRC | 18:41 | |
| *** shaleh has joined #openstack-keystone | 18:41 | |
| *** mylu has joined #openstack-keystone | 18:41 | |
| *** mgarza_ has joined #openstack-keystone | 18:45 | |
| *** njnjnj has quit IRC | 18:46 | |
| mordred | morganfainberg, ayoung: should I expect that in a devstack install with only the default domain named "Domain" with id of "domain" that running GET http://192.168.1.231:5000/v3/auth/domains should return me an empty list? | 18:46 |
| morganfainberg | That... Seems odd? Oh wait you dont have roles on the domain itself | 18:46 |
| morganfainberg | That url should show what domains you have direct access too afaik | 18:47 |
| mordred | but I have to specify it to log in | 18:47 |
| morganfainberg | Yes. But the role is on the project | 18:47 |
| mordred | *headdesk* | 18:47 |
| ayoung | mordred, Keystone Meeting right now...answer in 13 minutes | 18:47 |
| mordred | ayoung: k. thanks! | 18:47 |
| morganfainberg | Not on the domain. If you are specifying project name | 18:47 |
| morganfainberg | You need domain to resolve which project | 18:47 |
| morganfainberg | If you are using project id, you dont need domain | 18:48 |
| morganfainberg | To auth | 18:48 |
| *** iamjarvo has quit IRC | 18:48 | |
| morganfainberg | This is because you can have projects with the same name in different domains. | 18:48 |
| morganfainberg | Its a namespace thing. | 18:48 |
| mordred | morganfainberg: all of those words make sense | 18:48 |
| mordred | morganfainberg: HOWEVER | 18:49 |
| *** njnjnj has joined #openstack-keystone | 18:49 | |
| mordred | morganfainberg: I'd like to register a niggle that at some point, as a user, being able to ask the question "what domains can I see/am I a part of" might be a nice thing to get an answer to | 18:49 |
| mordred | but I'll let you finish the meeting before I niggle more | 18:50 |
| morganfainberg | Sure. Though i think you can mostly derive that from what projects you have access to atm (until we get the rfe youre advocating added) | 18:50 |
| morganfainberg | V3/auth/projects | 18:50 |
| *** e0ne has quit IRC | 18:50 | |
| morganfainberg | As a workaround today | 18:50 |
| *** njnjnj has quit IRC | 18:51 | |
| * morganfainberg made | 18:51 | |
| *** dims has quit IRC | 18:53 | |
| mordred | morganfainberg: ok | 18:54 |
| jamielennox | mordred: did you make everything work? | 18:55 |
| morganfainberg | mordred: i can see benefit to knowing what domains you can see into. But the api you referenced above really is what domains you have roles directly on to scope to | 18:55 |
| jamielennox | i've got a lot of highlights in scrollback and no idea which are still relevant | 18:55 |
| jamielennox | sessions don't work with keystoneclient.client.Client, they should there's a bug, there is something about that code that makes it difficult to work with a session and i can't remember what | 18:57 |
| *** dims has joined #openstack-keystone | 18:58 | |
| jamielennox | i'm not a great fan of keystoneclient.client.Client (i wrote it pre-session stuff) because the v2 and v3 clients have very different APIs and i thinks it's confusing to have them returned from the same function depending on whats happening on the server | 18:58 |
| *** solomondg has quit IRC | 18:59 | |
| mordred | jamielennox: well, I wrote this: https://review.openstack.org/#/c/199209/ | 18:59 |
| mordred | jamielennox: which I think will do what I need it to | 18:59 |
| mordred | jamielennox: so the session-in-client.Client is less pressing | 18:59 |
| mordred | morganfainberg: nod. the projects list does seem to work | 18:59 |
| mordred | morganfainberg: althoguh I'll say that against my devstack, I get this: | 19:00 |
| mordred | http://paste.openstack.org/show/352784 | 19:00 |
| morganfainberg | jamielennox: so, let me look at ksa today again. What is left? So we can get that rolled up for ksc 2.0 | 19:00 |
| *** hogepodge has joined #openstack-keystone | 19:00 | |
| ayoung | gyee, I think you misunderstand | 19:00 |
| ayoung | the URL is not the Hostname | 19:00 |
| ayoung | the URL is the full URL to the endpoint | 19:00 |
| mordred | please note that's running as the demo user | 19:00 |
| lbragstad | quick note on weekly bugs, we had a good amount of them opened this week (19 in keystone alone). still in the process of triaging, but feel free to hop in (http://keystone-weekly-bug-report.tempusfrangit.org/weekly-bug-reports/keystone-weekly-bug-report.html) | 19:00 |
| ayoung | so even if both /kleystone and /nova are on the same machine, they have different URLS | 19:00 |
| mordred | so apparently either a) the call is broken or b) the devstack install gives the demo user roles into the admin project | 19:01 |
| morganfainberg | mordred: yeah. I think it does. | 19:01 |
| jamielennox | morganfainberg: i'm waiting to get it tested again | 19:01 |
| mordred | morganfainberg: ok. so, I'll just file that as "wow, that's not expected" | 19:01 |
| morganfainberg | jamielennox: ok. Let me get a release cut with the new namespace | 19:01 |
| ayoung | gyee so, the real issue is that you can't set a different policy for https://hostname:5000 vs https://hostname:35357 if they both map to the same endpoint_id | 19:01 |
| gyee | ayoung, oh, you mean like https://host:port/v3/instance? | 19:01 |
| jamielennox | morganfainberg: the -e requirements.txt doesn't work so all my ksc on ksa | 19:01 |
| ayoung | gyee, YES! | 19:01 |
| jamielennox | morganfainberg: that would fix it temporarily yes | 19:01 |
| mordred | ayoung: are you advocating for getting rid of teh port numbers and moving to sane URLs????? | 19:02 |
| * mordred hands ayoung a fluffy marmot | 19:02 | |
| morganfainberg | jamielennox: and ill get the base project to install the ksa1 version too today | 19:02 |
| ayoung | mordred, orthoganal | 19:02 |
| gyee | ayoung, wow, that would be policy per API | 19:02 |
| ayoung | morganfainberg, I mean, yes, I've been for that for 3+ years now | 19:02 |
| * mordred rescinds the marmot | 19:02 | |
| ayoung | gyee, no. | 19:02 |
| ayoung | gyee, I mean the URL for the endpoint entry | 19:02 |
| *** harlowja_ has joined #openstack-keystone | 19:02 | |
| *** harlowja has quit IRC | 19:03 | |
| morganfainberg | mordred: yes we should be doing thst too. Yes yes yes. And it has been a slow march. Now thst horizon can play nice. we can do it | 19:03 |
| gyee | ayoung, I don't get it | 19:03 |
| mordred | morganfainberg: yay! | 19:03 |
| * mordred gives the marmot to morganfainberg | 19:03 | |
| ayoung | gyee, http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n2899 this value | 19:03 |
| gyee | ayoung, https://host:port/v3, that keystone or nova? | 19:03 |
| ayoung | mordred, I wrote https://wiki.openstack.org/wiki/URLs | 19:03 |
| jamielennox | mordred: oh yea, OSC stole the token_endpoint entrypoint, it's a PITA | 19:03 |
| jamielennox | mordred: where is self.api_versions coming from there? | 19:03 |
| morganfainberg | jamielennox: ill respin my two ksc 2.0 patches | 19:03 |
| morganfainberg | jamielennox: so we can land them too | 19:04 |
| gyee | ayoung, unless we go with namespaceing, like https://host:port/nova/v3, https://host:port/identity/v3, etc | 19:04 |
| morganfainberg | jamielennox: but honestly i think we are close. | 19:04 |
| ayoung | mordred, Date of page creation21:07, 1 May 2012 | 19:04 |
| morganfainberg | gyee: that would be needed in devstack | 19:04 |
| morganfainberg | gyee: but not everywhere. | 19:04 |
| gyee | morganfainberg, exactly | 19:04 |
| samueldmq | ayoung: gyee what if we add a new field to endpoints called 'label', that'd unique and equals to the id in a migration, then you specify that label in the middleware config | 19:04 |
| ayoung | samueldmq, stop | 19:05 |
| ayoung | no new labels | 19:05 |
| morganfainberg | gyee: json home can also discover that for us. | 19:05 |
| mordred | jamielennox: I have dictionary of them | 19:05 |
| morganfainberg | gyee: from / | 19:05 |
| morganfainberg | gyee: if we wanted. | 19:05 |
| ayoung | samueldmq, until people understand why this is sufficient, do not offer any alternatives. It just muddies the water | 19:05 |
| mordred | jamielennox: from vendor cloud configs for the most part | 19:05 |
| gyee | morgainfainberg, ayoung, soure service.example.com would work | 19:05 |
| samueldmq | ayoung: ok then, I am out of solutions/ideas, I will wait for you guys find what works for you both | 19:05 |
| samueldmq | ayoung: either work for me | 19:05 |
| *** Rockyg has joined #openstack-keystone | 19:06 | |
| ayoung | samueldmq, URL is the endpoint value. It is already unique enough to identify the endpoint by id, and it is generated by the CMS when registering the CMS | 19:06 |
| ayoung | er | 19:06 |
| ayoung | when registereing the endpoint | 19:06 |
| gyee | wait, service.example.com wrong work for public endpoint | 19:06 |
| mordred | the url, by definition, kind of has to be unique | 19:06 |
| gyee | API proxy I mean | 19:07 |
| jamielennox | mordred: so what you should be able to do there is just if session.get_endpoint(interface='auth', service_type='compute', version=(3, 0)): to discover that | 19:07 |
| gyee | should be like example.com/service/ | 19:07 |
| mordred | jamielennox: to discover what? | 19:07 |
| jamielennox | mordred: unfortunately the success of that will vary on service because we never came up with a standard way of listing available versions | 19:07 |
| jamielennox | mordred: rather than hard code what clouds have what apis | 19:07 |
| *** diazjf has quit IRC | 19:07 | |
| mordred | ah. yeah. I've given up on that for now | 19:08 |
| *** jsavak has quit IRC | 19:08 | |
| samueldmq | ayoung: both you and gyee have valid arguments imo, both solution work for me, you guys have more experience with deployments than me, I can't vote what is better since I have not deployed a single keystone endpoint in production | 19:08 |
| *** slberger has quit IRC | 19:08 | |
| mordred | the existing state of the world is not good enough, so I _must_ declare it for some of them | 19:08 |
| ayoung | samueldmq, gyee, does not have a valid argument. He is stumbling towards clarity | 19:08 |
| mordred | which means it's easier/less work to declare for all of them | 19:08 |
| samueldmq | ayoung: does URL uniquely identify an endpoint ? | 19:08 |
| mordred | I look forward to the future when I can delete that code | 19:08 |
| *** dramakri has joined #openstack-keystone | 19:08 | |
| ayoung | gyee, you mean to tell me that you have a service catalog where the nova and the keystone endpoitns have the EXACT.SAME.URL configured? | 19:08 |
| ayoung | I know that to be a lie | 19:09 |
| ayoung | that does not work | 19:09 |
| ayoung | you know that, too | 19:09 |
| ayoung | so, you are not lying, you are just confusing two things. | 19:09 |
| dstanek | so... | 19:09 |
| jamielennox | mordred: yep, regarding fixing token_endpoint, when we go to keystoneauth we will need to declare a new name for entrypoints to live in so i will make sure to grab token_endpoint away from OSC | 19:09 |
| dstanek | ayoung: if you just take URL out of what you are saying then really you just have a unique ID that keystone looks at and passed out a policy. right? | 19:10 |
| david8hu | gyee, service catalog would have the service name for each endpoints | 19:10 |
| ayoung | dstanek, I have a unique Id that is already part of the domain model | 19:10 |
| dstanek | you just know the unique ID ahead of time (which we don't for endpoint id) | 19:10 |
| ayoung | and part of the workflow | 19:10 |
| mordred | jamielennox: yay! | 19:10 |
| dstanek | ayoung: which id? | 19:10 |
| ayoung | the only other thing I have that falls into that category is the endpoint_id | 19:10 |
| *** radez is now known as radez_g0n3 | 19:10 | |
| ayoung | url is unique for endpoint. | 19:10 |
| mordred | jamielennox: when I switch to ksa in shade, I'll remove that silly little workaround | 19:11 |
| *** slberger has joined #openstack-keystone | 19:11 | |
| *** slberger has left #openstack-keystone | 19:11 | |
| *** jsavak has joined #openstack-keystone | 19:11 | |
| *** spandhe has joined #openstack-keystone | 19:12 | |
| ayoung | dstanek, look at it this way: I really just want one, global policy file that all the services and endpoints use. I want the endpoint to say "give me the right one" and let Keystone resolve it: | 19:12 |
| *** htruta_ has quit IRC | 19:12 | |
| ayoung | start with : is there one for this endpoint. If not,, then "is there one for this serivces" ... | 19:12 |
| ayoung | that code already existst, by the way | 19:13 |
| dstanek | ayoung: i'm on board with what i think you want to do generally. there are two reason why i didn't like URL as the unique id. 1. have to deal with encoding which sucks and 2. some endpoints can have multiple URLs (which one do i use?) | 19:13 |
| mordred | endpoints should not have multiple URLs | 19:13 |
| ayoung | I mneed to run | 19:13 |
| mordred | if they do - how does an end user use them? | 19:13 |
| ayoung | back in about 1/2 hour | 19:13 |
| *** ayoung is now known as ayoung-afk | 19:13 | |
| dstanek | when i say endpoint i am really saying 'service process' | 19:13 |
| mordred | that is different - there are definitely different service processes | 19:14 |
| gyee | mordred, yeah, I just confirmed it, we have different external endpoints for each service | 19:14 |
| *** mgarza_ has quit IRC | 19:14 | |
| mordred | gyee: I was just about to pastebin my hp service catalog :) | 19:14 |
| gyee | mordred, I just checked it myself | 19:14 |
| gyee | there's region baked in too | 19:15 |
| gyee | so we are OK | 19:15 |
| dstanek | so what do you do if the internal and external URLs point to the same daemon? | 19:15 |
| gyee | dstanek, they point to a VIP | 19:16 |
| gyee | which is load balanced across multiple instances | 19:16 |
| mordred | it sounds like there are two problems being conjoined here ... one is "what are the URLs that a consumer should use" - the other is "what are the currently existing service processes that provide a service | 19:17 |
| mordred | both are interesting pieces of information - but to VASTLY different people | 19:17 |
| gyee | yeah, external versus internal | 19:18 |
| mordred | whether or not a service URL points to a load balancer vip or directly to a process is not interesting to a consumer - because the web is awesome | 19:18 |
| gyee | right, but policies admin care about preciseness | 19:19 |
| dstanek | my question continues to be which URL do use use the specify the policy? can we have different policy if the user hits the daemon via a different URL? | 19:19 |
| mordred | gyee: I don't think it's internal vs. external | 19:19 |
| samueldmq | dstanek: URL does not uniquely identify an endpoint id, that what you're saying, right? | 19:19 |
| samueldmq | dstanek: and this is right, we don't enforce that anywhere | 19:19 |
| mordred | gyee: even internal you want a service to have a URL - unless you are talking about scripts that want to target a single backend process by its rest API | 19:20 |
| mordred | and if that's needed, somethign else seems rather broken | 19:20 |
| gyee | sorry I gotta run too, be back in 45 mins | 19:21 |
| *** mgarza has joined #openstack-keystone | 19:24 | |
| *** mylu has quit IRC | 19:24 | |
| dstanek | samueldmq: sorta. url is many-to-one with a service. a single url will only point to one service, but there may be multiple urls that point to it | 19:25 |
| samueldmq | dstanek: hmm, even if endpoint ids we may have some trouble .. | 19:25 |
| samueldmq | dstanek: different interfaces will have different endpoint ids, which one do I configure my middleware with ? | 19:26 |
| dstanek | samueldmq: i have to go and read ayoung's summary spec; i've only read a few of the specs and that's not enough to understand the full picture | 19:26 |
| dstanek | are we using the correct terms here? is this about endpoint enforcement or server enforcement? | 19:26 |
| samueldmq | dstanek: sure. btw, see the SFE email to see what is targeted to L https://www.mail-archive.com/openstack-dev@lists.openstack.org/msg57416.html | 19:27 |
| samueldmq | dstanek: endpoint enforcement .. a service process will have a single middleware process, but can be represented to multiple endpoint ids inside keystone | 19:28 |
| samueldmq | dstanek: mapping to different interfaces, that's what I meant | 19:29 |
| dstanek | samueldmq: so if http://keystone/v2 and http://keystone/v3 were in the catalog as separate endpoints they could potentially have different policies? | 19:30 |
| *** htruta_ has joined #openstack-keystone | 19:31 | |
| samueldmq | dstanek: we can't, we don't allow multiple policies per service process, what adam proposes is: pick one and use it | 19:31 |
| *** mylu has joined #openstack-keystone | 19:31 | |
| samueldmq | dstanek: associate the policy to the same URL you will tell middleware to fetch the policy for | 19:31 |
| dstanek | samueldmq: so it's policy per service process and not endpoint | 19:33 |
| samueldmq | dstanek: we can't do per endpoint (as represented in keystone server) | 19:33 |
| samueldmq | dstanek: a single service process will read from a single policy file | 19:33 |
| samueldmq | dstanek: taht's how we've been doing all the time | 19:34 |
| dstanek | samueldmq: yep, exactly. that's why URL seems arbitrary to me and we keep getting hung up on it | 19:34 |
| *** htruta_ has quit IRC | 19:35 | |
| jamielennox | bknudson: hvae you had a chance to look at https://review.openstack.org/#/c/190940/ ? It changes behaviour slightly in the way we cache which we have discussed before but i want to make sure i get it right | 19:36 |
| bknudson | jamielennox: I haven't looked at it | 19:37 |
| jamielennox | bknudson: ok | 19:37 |
| bknudson | jamielennox: there's a lot of reviews out there to look at. | 19:37 |
| bknudson | and this one doesn't have a bug or blueprint | 19:37 |
| *** piyanai has quit IRC | 19:38 | |
| jamielennox | bknudson: yep, i need to find other people to look at them as well, just you were following that chain | 19:38 |
| *** piyanai has joined #openstack-keystone | 19:39 | |
| jamielennox | gyee, morganfainberg: do you mind having a look at https://review.openstack.org/#/c/190940/ - it changes the caching behaviour of auth_token middleware slightly | 19:44 |
| *** ajayaa has joined #openstack-keystone | 19:45 | |
| stevemar | jamielennox: for ksm, we don't want folks using identity_uri right? | 19:45 |
| stevemar | https://github.com/openstack/keystonemiddleware/blob/647f2ab9c437e2bcd6fd9a12a6f52a39553c9a80/keystonemiddleware/auth_token/_auth.py#L34-L39 | 19:45 |
| jamielennox | stevemar: it's better than auth_host, auth_port etc but it won't work with plugins | 19:46 |
| morganfainberg | jamielennox: im sure its fine but will look. | 19:46 |
| *** jasonsb has joined #openstack-keystone | 19:47 | |
| *** dims has quit IRC | 19:48 | |
| jasonsb | hi all. i'm trying to configure openidc with keystone using steve's gist pages. | 19:48 |
| jamielennox | morganfainberg: let me know when you release the next ksa so i can recheck a bunch of these reviews | 19:48 |
| jasonsb | i'm stuck on openstack identity provider create part | 19:48 |
| jasonsb | openstack identity provider create idp1 | 19:49 |
| jasonsb | ERROR: openstack Could not change immutable attribute(s) 'remote_ids' in target IdentityProvider (HTTP 403) | 19:49 |
| jasonsb | advice appreciated! | 19:49 |
| jamielennox | stevemar: ^, i had this problem as well - i ended up putting it in the database directly | 19:49 |
| jamielennox | marekd: ^ | 19:49 |
| stevemar | jasonsb: did i not include remote-ids in the instructions? | 19:50 |
| *** david-lyle has joined #openstack-keystone | 19:50 | |
| stevemar | jasonsb: `openstack identity provider create bluepages --remote-id bluepages` | 19:50 |
| jasonsb | stevemar: i tried this too | 19:50 |
| jasonsb | openstack identity provider create idp1 --remote-id http://localhost:8080 | 19:50 |
| jasonsb | ERROR: openstack Could not change immutable attribute(s) 'remote_ids' in target IdentityProvider (HTTP 403) | 19:50 |
| jamielennox | stevemar: why is it immutable though? | 19:51 |
| stevemar | jamielennox: thats a good question, i didn't think it would be | 19:51 |
| jamielennox | i thought the point was so you could add new remote idps without restarting apache | 19:51 |
| stevemar | jasonsb: is the idp in the table? | 19:51 |
| stevemar | jasonsb: `openstack identity provider list` ? | 19:52 |
| *** ayoung-afk is now known as ayoung | 19:52 | |
| *** shaleh has quit IRC | 19:52 | |
| *** slberger has joined #openstack-keystone | 19:52 | |
| ayoung | dstanek, to be honest, I don't love the URL approach myself. I would prefer to use the endpoint ID. But I think the URL is good enough | 19:52 |
| *** slberger has left #openstack-keystone | 19:53 | |
| jasonsb | stevemar: my provider list is empty | 19:53 |
| dstanek | ayoung: you couldn't use the endpoint ID because there may be multiple IDs pointing to that service | 19:53 |
| *** e0ne has joined #openstack-keystone | 19:54 | |
| jasonsb | stevemar: i'm using policy v2 still | 19:54 |
| dstanek | ayoung: that's why i said it could be identity-dfw if the cloud provider wanted to do that | 19:54 |
| jasonsb | stevemar: does that cause problem? | 19:54 |
| stevemar | jasonsb: that should be okay | 19:54 |
| ayoung | dstanek, dfw? | 19:54 |
| ayoung | Dallas Fort Worth? | 19:54 |
| dstanek | ayoung: yeah, service_type-region or whatever | 19:54 |
| dstanek | that's why i find endpoint enforcement confusing because it's really service enforcement we are talking about | 19:55 |
| ayoung | dstanek, have you seen the http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3-os-endpoint-policy.rst spec? | 19:55 |
| jasonsb | stevemar: oh, worth mentioning, i'm using juno keystone | 19:55 |
| ayoung | Er...API | 19:55 |
| jasonsb | stevemar: should i use kilo instead? | 19:55 |
| stevemar | jasonsb: oh that might be why | 19:55 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3-os-endpoint-policy.rst#n220 | 19:55 |
| stevemar | jasonsb: so try issuing the command without --remote-id, it doesn't work? | 19:56 |
| *** shaleh has joined #openstack-keystone | 19:56 | |
| dstanek | ayoung: which is another reason i find this confusing...seems like we are defining another way to do this | 19:56 |
| *** mylu has quit IRC | 19:56 | |
| jasonsb | openstack identity provider create idp1 | 19:56 |
| jasonsb | ERROR: openstack Could not change immutable attribute(s) 'remote_ids' in target IdentityProvider (HTTP 403) | 19:56 |
| ayoung | dstanek, I planned on juist using the API as written | 19:57 |
| ayoung | it was morganfainberg that threw this particular wrench in my plans | 19:57 |
| ayoung | his argument is that to use that approach, we need to register, capture the ID, then stick it in the config file...potentially restarting the service | 19:57 |
| ayoung | nasty, but...meh | 19:57 |
| dstanek | ayoung: i though you couldn't because you didn't know the endpoint ids ahead of time | 19:57 |
| morganfainberg | dstanek: ^^ yep | 19:58 |
| ayoung | dstanek, you can register the endpoint before you create the endpoint, actually. You just need to remember the ID you get back | 19:58 |
| *** mylu has joined #openstack-keystone | 19:58 | |
| dstanek | or we just need to be able to specify the ID or "some ID" that corresponds with endpoint_id | 19:59 |
| ayoung | dstanek, so, the URL is a compromise; the Configm Mgmt System knows the URL it is telling to Keystone, so it can record that at the same time | 19:59 |
| ayoung | I ... I really don't care. I think it is agoing to be a mess no matter what, as it, again, requires touching the mnost painful part of the system, namely the installation | 20:00 |
| ayoung | I wish there were a way around it. I'm willing to listen | 20:00 |
| ayoung | listen intentley | 20:00 |
| ayoung | to anyone that has a better Idea | 20:00 |
| *** mgarza has quit IRC | 20:00 | |
| morganfainberg | Consul | 20:01 |
| dstanek | you still have the problem there | 20:01 |
| morganfainberg | And we could transmit policy via it's service kvs/registration | 20:01 |
| dstanek | i like the URL approach, but dislike the URL | 20:01 |
| *** ducttape_ has joined #openstack-keystone | 20:01 | |
| *** diazjf has joined #openstack-keystone | 20:02 | |
| morganfainberg | No rest get needed. And it can be pushed on change by keystone with a lowish cost | 20:02 |
| morganfainberg | And picked up quickly on the far end | 20:02 |
| morganfainberg | In fact... We could even have the endpoints push thier policy up to keystone too (the local seed of truth) | 20:03 |
| *** mgarza_ has joined #openstack-keystone | 20:03 | |
| morganfainberg | This is probably more work/out of scope for liberty | 20:03 |
| morganfainberg | But it *could* be used. | 20:03 |
| * morganfainberg is throwing an idea at the wall. | 20:04 | |
| morganfainberg | dstanek: you could use an arbitrary id, i would use urls as the example though. | 20:05 |
| * dstanek rolls dice | 20:06 | |
| *** jaosorior has quit IRC | 20:06 | |
| *** chlong has joined #openstack-keystone | 20:06 | |
| morganfainberg | E.g host.tld/nova or whatever | 20:06 |
| dstanek | "you have died of dysentery" | 20:06 |
| jasonsb | stevemar: yessir. error msg is same | 20:06 |
| dstanek | morganfainberg: what id didn't like about that what the encoding needed for the spec to work | 20:06 |
| stevemar | jasonsb: err... try kilo :\ | 20:06 |
| morganfainberg | dstanek: bandits have stolen your supplies | 20:06 |
| jasonsb | okedokey | 20:07 |
| jasonsb | stevemar: oddly, google doesn't have this error in it | 20:07 |
| *** marzif_ has joined #openstack-keystone | 20:07 | |
| morganfainberg | jamielennox: tagged ksa1 | 20:07 |
| morganfainberg | 0.3.0 | 20:07 |
| jasonsb | stevemar: thank you for help | 20:07 |
| jamielennox | morganfainberg: cheers | 20:07 |
| jasonsb | stevemar: i still owe you runthrough on google oauth2 workflow for google compute engine | 20:08 |
| jasonsb | stevemar: is it still relevant? | 20:08 |
| morganfainberg | jamielennox: and it is published to pypi | 20:08 |
| openstackgerrit | Matt Riedemann proposed openstack/keystone: Remove comment for doc building bug 1260495 https://review.openstack.org/199239 | 20:08 |
| openstack | bug 1260495 in python-keystoneclient "Setting autodoc_tree_index_modules makes documentation builds fail" [Low,Fix released] https://launchpad.net/bugs/1260495 - Assigned to David Stanek (dstanek) | 20:08 |
| jamielennox | morganfainberg: it's still showing me 0.2.0, but i can wait for it | 20:08 |
| stevemar | jasonsb: ohhh that jason | 20:08 |
| jasonsb | stevemar: (sheepish) yes | 20:09 |
| stevemar | jasonsb: i think i figured that stuff out, i might need to create another oidc plugin for keystoneclient, but its all good | 20:09 |
| jasonsb | stevemar: i got sidetracked on google because they introduced a new format which didn't work well with my python script | 20:09 |
| jasonsb | stevemar: and then i never made the video | 20:09 |
| stevemar | ah that happens | 20:10 |
| jasonsb | stevemar: would still like to help if there is anything. but sounds like your good | 20:10 |
| morganfainberg | jamielennox: look at keystoneauth1 | 20:10 |
| jasonsb | do you have bp? | 20:10 |
| morganfainberg | jamielennox: in pypi. Totally new package place | 20:10 |
| jasonsb | stevemar: i would like to read | 20:10 |
| jamielennox | morganfainberg: oh - right you changed the entire package | 20:11 |
| breton | wow, py3.5 has coroutines | 20:11 |
| morganfainberg | jamielennox: keystoneauth will become a virtual package tomorrow (ish) that will just install all keystoneauth* packages | 20:11 |
| morganfainberg | At least that is my hope. | 20:11 |
| *** diazjf has quit IRC | 20:11 | |
| stevemar | jasonsb: no bp yet, basically i want to enable oidc with just an access token key | 20:12 |
| stevemar | i have frantic notes in a notebook somewhere | 20:12 |
| morganfainberg | breton: meh. | 20:13 |
| morganfainberg | breton: /me | 20:13 |
| morganfainberg | Likes real threading and/or full processes | 20:13 |
| jasonsb | stevemar: you generate token via http workflow? | 20:13 |
| jasonsb | stevemar: and then renew from client? | 20:13 |
| morganfainberg | breton: how are we looking for alembic stuff? | 20:15 |
| morganfainberg | breton: since I see you here. | 20:15 |
| openstackgerrit | Merged openstack/keystone: Group role revocation invalidates all user tokens https://review.openstack.org/141854 | 20:16 |
| *** marzif__ has joined #openstack-keystone | 20:16 | |
| *** marzif_ has quit IRC | 20:18 | |
| *** Ctina has quit IRC | 20:20 | |
| *** piyanai has quit IRC | 20:23 | |
| stevemar | jasonsb: pretty much, authenticate with your idp via a browser, get the access pin/code whatever it's called | 20:24 |
| stevemar | then use that against keystone | 20:24 |
| *** marzif__ has quit IRC | 20:26 | |
| *** dramakri has quit IRC | 20:26 | |
| *** dramakri has joined #openstack-keystone | 20:27 | |
| morganfainberg | ayoung: you here? | 20:28 |
| ayoung | morganfainberg, yes, but in team meeting | 20:28 |
| morganfainberg | ayoung: ping me when done. Need to ask a question re: jacket | 20:29 |
| *** ducttape_ has quit IRC | 20:30 | |
| *** htruta has quit IRC | 20:31 | |
| *** htruta has joined #openstack-keystone | 20:34 | |
| *** mylu has quit IRC | 20:41 | |
| *** jamielennox is now known as jamielennox|away | 20:41 | |
| *** njnjnj has joined #openstack-keystone | 20:42 | |
| *** piyanai has joined #openstack-keystone | 20:43 | |
| *** e0ne has quit IRC | 20:44 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove fileutils from oslo-incubator https://review.openstack.org/199266 | 20:46 |
| stevemar | bknudson: ^ | 20:46 |
| bknudson | stevemar: freedom from oslo-incubator!!! | 20:47 |
| stevemar | bknudson: i may have been too ambitious in removing openstack-common.conf | 20:48 |
| stevemar | i think we still need it for junk in tools/ | 20:48 |
| bknudson | what about tools/colorizer? | 20:48 |
| stevemar | y, refer to my previous comment | 20:48 |
| bknudson | we want things in color, not black and white. | 20:48 |
| *** diazjf has joined #openstack-keystone | 20:49 | |
| mtreinish | bknudson: that colorizer.py script is straight up copy and paste from nova | 20:49 |
| mtreinish | it's not oslo synced | 20:49 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove fileutils from oslo-incubator https://review.openstack.org/199266 | 20:49 |
| stevemar | bknudson: now with less deleting ^ | 20:50 |
| bknudson | mtreinish: http://git.openstack.org/cgit/openstack/oslo-incubator/tree/tools/colorizer.py ? | 20:50 |
| *** mylu has joined #openstack-keystone | 20:50 | |
| bknudson | we also have install_venv_common | 20:50 |
| bknudson | stevemar: do we actually use colorizer and install_venv_common? | 20:51 |
| bknudson | maybe in run_tests | 20:51 |
| *** annasort has quit IRC | 20:51 | |
| mtreinish | bknudson: oh, that didn't used to be something you could sync | 20:51 |
| *** jamielennox|away is now known as jamielennox | 20:52 | |
| mtreinish | stevemar: yeah it's only ever been used in run_tests, or by people manually | 20:52 |
| *** Akshay00 has joined #openstack-keystone | 20:52 | |
| mtreinish | personally I've never understood the point of it, the colors are basically meaningless | 20:53 |
| dstanek | bknudson: isn't install_venv_common used to make the venv for tools/with_venv.sh? | 20:53 |
| *** Lactem has joined #openstack-keystone | 20:54 | |
| mtreinish | dstanek: yeah the run_tests.sh script ends up depending on it. tools/install_venv.py calls to install_venv_common.py | 20:54 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/tools/with_venv.sh | 20:54 |
| dstanek | i just want to get rid of run_tests.sh | 20:54 |
| bknudson | I haven't used run_tests.sh in years. | 20:55 |
| mtreinish | bknudson: http://git.openstack.org/cgit/openstack/keystone/tree/run_tests.sh#n112 | 20:55 |
| mtreinish | all that stuff is there just for run_tests | 20:55 |
| mtreinish | colorizer: http://git.openstack.org/cgit/openstack/keystone/tree/run_tests.sh#n91 | 20:55 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path mixin https://review.openstack.org/198418 | 20:55 |
| dstanek | i wanted to remove it a while back and there were detractors | 20:55 |
| *** christx2 has joined #openstack-keystone | 20:56 | |
| mtreinish | dstanek: people love those scripts, that's another thing I've never understood | 20:56 |
| christx2 | hi keystone | 20:56 |
| bknudson | I'm guessing we'll never sync oslo-incubator again. | 20:56 |
| mtreinish | especially considering I did a lot of the clean up on them a long time ago | 20:57 |
| mtreinish | I know how ugly they are | 20:57 |
| christx2 | quick quetion: do we have a slideshare deck with what is going into liberty ? | 20:57 |
| bknudson | when you need to run tests, a script called run_tests.sh seems like the logical choice | 20:57 |
| mtreinish | dstanek: the big thing I've heard is that run_tests lets you run without a venv | 20:57 |
| mtreinish | while tox doesn't give you that option | 20:57 |
| dstanek | bknudson: that's exactly why it should go! nobody uses it and new devs assume that's what they should use | 20:57 |
| *** marzif__ has joined #openstack-keystone | 20:58 | |
| mordred | you still have a run_Tests.sh ? | 20:58 |
| mordred | (btw - if you want to run without a venv ... "testr run") | 20:59 |
| bknudson | mordred: how do I stop on first failure? | 21:00 |
| dstanek | mtreinish: tox just automates the test commands. you can always run them manually | 21:00 |
| dstanek | bknudson: --fastfail | 21:00 |
| dstanek | bknudson: (i think) | 21:00 |
| mtreinish | mordred, dstanek: yes exactly, but we've tried to kill this several times before and that is one argument that keeps coming back | 21:00 |
| *** shaleh has quit IRC | 21:00 | |
| bknudson | maybe change it to print some help instead. | 21:01 |
| mordred | or - just do what I do - and just push unfinished patches to the gate :) | 21:01 |
| mtreinish | mordred: that's my normal operating procedure too :) | 21:01 |
| mordred | mtreinish: sss.h don't let clarkb hear you | 21:02 |
| bknudson | setup.py: error: no such option: --fastfail | 21:02 |
| mordred | sorry ... | 21:02 |
| njnjnj | this patch would make run_tests much more useful https://review.openstack.org/#/c/196285/ | 21:02 |
| mordred | bknudson: failfast | 21:03 |
| stevemar | bknudson: thats the hope | 21:03 |
| dstanek | njnjnj: i'd rather kill it | 21:04 |
| Lactem | lol | 21:04 |
| bknudson | I think your testrepository contains all the output? | 21:04 |
| stevemar | mtreinish: yeah, thats the only plus side to it | 21:04 |
| Akshay00 | destanek: nice one haha | 21:04 |
| *** rdo has quit IRC | 21:04 | |
| stevemar | i had to run tests outside of venv,.... once | 21:04 |
| Akshay00 | dstanek | 21:04 |
| mordred | njnjnj: yah. that's right. it's all in testr | 21:05 |
| *** amakarov is now known as amakarov_away | 21:05 | |
| mtreinish | mordred: heh, I just blame rax for taking away my free account. Now I have to get my free cloud through a proxy | 21:06 |
| Lactem | Akshay00: I made a new patch set: https://review.openstack.org/#/c/198071/4 | 21:06 |
| *** rdo has joined #openstack-keystone | 21:06 | |
| bknudson | tox -e py27 -- -- --failfast | 21:06 |
| bknudson | it's not really stopping, though | 21:07 |
| bknudson | maybe one of the child procs exited | 21:07 |
| dstanek | bknudson: how i wish for the simple days of nose | 21:08 |
| *** shaleh has joined #openstack-keystone | 21:08 | |
| bknudson | if we had proper unit tests that didn't take so long to run we could run in serial | 21:09 |
| gyee | jamielennox, looking, just got back | 21:09 |
| mtreinish | bknudson: it's probably related to: https://bugs.launchpad.net/testrepository/+bug/1411804 | 21:09 |
| openstack | Launchpad bug 1411804 in Testrepository "--subunit makes --until-failure not actually work" [Undecided,New] | 21:09 |
| anhhuynx | I'm working on this bug: https://bugs.launchpad.net/keystone/+bug/1460492 that has to do with API calls, | 21:09 |
| openstack | Launchpad bug 1460492 in Keystone "List credentials by type" [Wishlist,Triaged] - Assigned to Anh Huynh (anhx-huynh) | 21:09 |
| bknudson | it must take 30 mins to run the tests in serial | 21:09 |
| anhhuynx | how do you modify driver hints and DB call? | 21:09 |
| *** pgbridge has quit IRC | 21:10 | |
| *** pgbridge has joined #openstack-keystone | 21:11 | |
| anhhuynx | I narrowed it down to this location for API handling: https://github.com/openstack/keystone/blob/master/keystone/credential/controllers.py#L84-L90 | 21:11 |
| anhhuynx | But I'm not sure how to proceed with adding a new query | 21:11 |
| mtreinish | bknudson: it's probably something we can add a dirty hack around for in os-testr | 21:12 |
| mtreinish | if it's really broken with --subunit output | 21:12 |
| *** dims has joined #openstack-keystone | 21:13 | |
| bknudson | mtreinish: failfast might only make sense when running in serial | 21:13 |
| bknudson | maybe there's an option to run in serial. | 21:13 |
| *** piyanai has quit IRC | 21:14 | |
| bknudson | (the help text doesn't mention --failfast) | 21:14 |
| breton | morganfainberg: this week, I'll prepare it for the midcycle | 21:14 |
| *** piyanai has joined #openstack-keystone | 21:14 | |
| morganfainberg | breton: cool | 21:15 |
| *** jdennis has joined #openstack-keystone | 21:15 | |
| mtreinish | bknudson: yeah it probably only makes sense in serial, unless you want to try and sigterm all the other processes with failfast enabled | 21:15 |
| mtreinish | which seems like it would be messy | 21:16 |
| *** dramakri has quit IRC | 21:16 | |
| dstanek | bknudson: the only way i know to run in serial is the TEST_RUN_CONCURRENCY env var | 21:17 |
| *** dramakri has joined #openstack-keystone | 21:17 | |
| *** piyanai has quit IRC | 21:17 | |
| dstanek | maybe test_run_concurrency is also a command line option? | 21:17 |
| mtreinish | dstanek: by default testr runs serially, our wrapper layers (in keystone's case from pbr) defaults the other way | 21:17 |
| mtreinish | dstanek: there is a flag for setup.py test to run serially | 21:18 |
| mtreinish | I think it's --no-parallel but I'm probably wrong | 21:18 |
| dstanek | anhhuynx: can you just add it to the list of filters passed into filterprotected? | 21:18 |
| bknudson | TEST_RUN_CONCURRENCY doesn't seem to work. | 21:18 |
| anhhuynx | I tried doing @controller.filterprotected('user_id', 'type') | 21:19 |
| *** Akshay00 has quit IRC | 21:19 | |
| dstanek | bknudson: in the past i was able to set it to 1 so that it only ran a single process | 21:19 |
| anhhuynx | and then tried callign /v3/credentials?user_id=xxx&type=ec2 | 21:19 |
| anhhuynx | it didn't work | 21:20 |
| anhhuynx | it showed every type of credentials | 21:20 |
| mtreinish | bknudson: just call testr manually | 21:20 |
| bknudson | dstanek: y, I wonder if we broke it. | 21:20 |
| *** iurygregory has left #openstack-keystone | 21:20 | |
| *** Akshay00 has joined #openstack-keystone | 21:20 | |
| *** Akshay00 is now known as Akshay04 | 21:20 | |
| mtreinish | it'll be serial unless you use --parallel | 21:20 |
| bknudson | `.tox/py27/bin/testr run -- --failfast` seems to work | 21:21 |
| dstanek | anhhuynx: no idea, i think you just need to debug what's happening there | 21:22 |
| bknudson | dstanek: btw - the keystoneclient module index is kind of messed up -- http://docs.openstack.org/developer/python-keystoneclient/py-modindex.html | 21:22 |
| anhhuynx | dstanek: I talked to jamielennox before, and he said I also have to modify the driver hint and DB call | 21:23 |
| anhhuynx | dstanek: but I really don't know how to do that | 21:23 |
| dstanek | anhhuynx: not sure what you have to do. do the hints get into the SQL backend's list_credentials call? | 21:24 |
| *** mylu has quit IRC | 21:24 | |
| *** evb1007 has quit IRC | 21:25 | |
| dstanek | bknudson: what's wrong with it? looks ok | 21:25 |
| dstanek | bknudson: we still have the tree here: http://docs.openstack.org/developer/python-keystoneclient/api/modules.html | 21:26 |
| *** marzif_ has joined #openstack-keystone | 21:26 | |
| *** marzif__ has quit IRC | 21:26 | |
| bknudson | dstanek: http://docs.openstack.org/developer/keystone/py-modindex.html -- keystone has a b c | 21:26 |
| bknudson | whereas keystoneclient only has k | 21:26 |
| bknudson | so somehow keystone's index is down a level | 21:26 |
| dstanek | bknudson: ah, i see. i can fix that | 21:27 |
| bknudson | dstanek: awesome | 21:27 |
| *** dims has quit IRC | 21:30 | |
| *** christx2 has quit IRC | 21:30 | |
| *** jsavak has quit IRC | 21:30 | |
| *** marzif_ has quit IRC | 21:32 | |
| *** dims has joined #openstack-keystone | 21:35 | |
| *** dims has quit IRC | 21:35 | |
| *** Guest7393 has joined #openstack-keystone | 21:35 | |
| *** christx2 has joined #openstack-keystone | 21:36 | |
| anhhuynx | dstanek: I don't understand exactly how the API calls relates to the DB | 21:36 |
| anhhuynx | dstanek: can you explain it to me? | 21:36 |
| dstanek | anhhuynx: the API URLs are translated into controller calls based on the routers. in this case keystone.credentials.routers | 21:39 |
| dstanek | anhhuynx: then you just follow the controller to see what it calls | 21:39 |
| dstanek | anhhuynx: at a high level the controller generally uses a manager and that in turn uses a backend | 21:39 |
| dstanek | anhhuynx: the reason for the indirection is so that the backends can more easily vary (SQL, LDAP, etc) | 21:40 |
| *** christx2 has quit IRC | 21:40 | |
| anhhuynx | dstanek: Thank you. Can you explain how to "follow the controller"? | 21:43 |
| anhhuynx | dstanek: I'm very new to this. | 21:44 |
| dstanek | anhhuynx: read the logic and see what it calls | 21:44 |
| *** browne has quit IRC | 21:44 | |
| *** topol has quit IRC | 21:45 | |
| dstanek | anhhuynx: also you can use pdb to set breakpoints and do investigation that way | 21:47 |
| *** Lactem has quit IRC | 21:47 | |
| *** shaleh has quit IRC | 21:49 | |
| jamielennox | anhhuynx: sorry - that look longer than expected, people are helping with what you need? | 21:51 |
| anhhuynx | jamielennox: yes, although I'm still having trouble | 21:51 |
| *** piyanai has joined #openstack-keystone | 21:52 | |
| jamielennox | anhhuynx: anything particular or you just need to work through it? | 21:54 |
| *** mgarza_ has quit IRC | 21:57 | |
| anhhuynx | jamielennox: If I understand what dstanek said correctly, when I call the API URL, the router file translates that into method calls in the controller right? | 21:57 |
| dstanek | anhhuynx: yep, that's correct | 21:57 |
| anhhuynx | so If I do GET /v3/credentials?user_id=xxx I am basically calling the list_credentials method in the controller file | 21:58 |
| dstanek | anhhuynx: the routers are just mappings used by keystone's internals to know what controller method to call | 21:58 |
| dstanek | anhhuynx: that sounds about correct | 21:58 |
| anhhuynx | dstanek: parameters are also passed in the same way? | 21:59 |
| anhhuynx | so the list_credentials method have parameters called context and filter | 21:59 |
| anhhuynx | I'm assuming filter is when I do user_id=xxx | 21:59 |
| anhhuynx | but what is context? | 21:59 |
| *** mgarza has joined #openstack-keystone | 21:59 | |
| anhhuynx | the referenced code is here: https://github.com/openstack/keystone/blob/master/keystone/credential/controllers.py#L84-L90 | 22:00 |
| jamielennox | anhhuynx: context is like information about the current request | 22:00 |
| jamielennox | anhhuynx: it has things like the user information and the token the request is being made with | 22:00 |
| anhhuynx | ok | 22:01 |
| dstanek | anhhuynx: right, see https://github.com/openstack/keystone/blob/master/keystone/common/wsgi.py#L198-224 | 22:01 |
| dstanek | anhhuynx: wsgi.py is the basic framework that actually calls the controller methods | 22:01 |
| jamielennox | until dstanek gets around to replacing it | 22:02 |
| dstanek | jamielennox: ++ | 22:02 |
| openstackgerrit | David Stanek proposed openstack/python-keystoneclient: Fixes modules index generates by Sphinx https://review.openstack.org/199320 | 22:05 |
| *** zzzeek has quit IRC | 22:05 | |
| anhhuynx | and so context and filter is passed to create driver hints | 22:06 |
| anhhuynx | what are driver hints on a high level? | 22:06 |
| *** zzzeek has joined #openstack-keystone | 22:07 | |
| dstanek | anhhuynx: simple filters: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/driver_hints.py | 22:07 |
| jamielennox | right, they're a generic way of passing filters to drivers | 22:07 |
| anhhuynx | what are drivers in this context? | 22:08 |
| jamielennox | the context is not passed to drivers so you need to tell things like which users as well as type etc to list credentials for | 22:08 |
| jamielennox | anhhuynx: the workes | 22:08 |
| jamielennox | workers | 22:08 |
| dstanek | anhhuynx: drivers and backends are the same thing; the implementation to actually talk to a datastore | 22:09 |
| jamielennox | like there is an SQL driver, there may be an LDAP driver | 22:09 |
| anhhuynx | oh ok | 22:09 |
| anhhuynx | so I can think of it as synonymous to database? | 22:09 |
| dstanek | it's the code that interfaces with it | 22:09 |
| anhhuynx | I see | 22:09 |
| dstanek | i think you just need to spend a little time walking around the code; that will help you get a feel for things | 22:10 |
| anhhuynx | dstanek: I'm still inexperienced with this type of low level python code, but thank you very much for the help. | 22:11 |
| jamielennox | right, try pdb - or ipdb - and try and follow through what happens when you make a request | 22:11 |
| bknudson | you calling keystone low-level ?! hehe | 22:12 |
| *** g2` has quit IRC | 22:12 | |
| dstanek | anhhuynx: yeah, that's why i think just digging in will help; it'll be intimidating at first, but you should just write down your questions and move on. i think that you'll find you'll start answering your own questions | 22:13 |
| morganfainberg | bknudson: low-brow? | 22:13 |
| anhhuynx | dstanek: thank you for the advice | 22:13 |
| *** jecarey has quit IRC | 22:13 | |
| bknudson | morganfainberg: y, very low-brow. We need to raise the level of abstraction | 22:13 |
| dstanek | anhhuynx: np, good luck. i'm sure you'll do fine | 22:13 |
| anhhuynx | jamielennox: thank you for your help too. | 22:13 |
| *** g2` has joined #openstack-keystone | 22:15 | |
| *** njnjnj has quit IRC | 22:15 | |
| *** Raildo_ has joined #openstack-keystone | 22:20 | |
| morganfainberg | bknudson: sounds good. lets do eet | 22:20 |
| *** njnj` has joined #openstack-keystone | 22:22 | |
| *** njnj` has quit IRC | 22:22 | |
| *** diazjf has quit IRC | 22:23 | |
| openstackgerrit | David Stanek proposed openstack/oslo.policy: Fixes up the API docs and module index https://review.openstack.org/199328 | 22:24 |
| dstanek | you know what they say about abstraction...one more layer to simplify the top and make the bottom that much more complicated | 22:25 |
| bknudson | dstanek: going to pyohio? | 22:25 |
| dstanek | bknudson: of course. you? | 22:26 |
| bknudson | dstanek: no, too far | 22:26 |
| bknudson | dhellmann said he'd be there | 22:26 |
| bknudson | flask: http://www.pyohio.org/schedule/presentation/184/ | 22:26 |
| dstanek | bknudson: cool. i was asking him about submitting something | 22:27 |
| dstanek | the guy who is doing that talk put together pytennessee | 22:28 |
| anhhuynx | jamielennox: If i want to use pdb for debugging, which file would I call on? | 22:28 |
| anhhuynx | call it on* | 22:28 |
| jamielennox | anhhuynx: i would use the import ipdb; ipdb.set_trace() syntax so it will trigger when the command is hit | 22:29 |
| dstanek | if you run it during the unit tests you should use 'tox -e debug' | 22:29 |
| *** shaleh has joined #openstack-keystone | 22:31 | |
| *** bknudson has quit IRC | 22:31 | |
| *** piyanai has quit IRC | 22:32 | |
| *** edmondsw has quit IRC | 22:33 | |
| dstanek | whoa...this fixes a very, very old bug: https://review.openstack.org/#/c/198071/4 | 22:34 |
| lifeless | morganfainberg: what was the project you started using extras on ? | 22:35 |
| morganfainberg | lifeless: hmm? none yet afaik | 22:35 |
| morganfainberg | lifeless: but we want to | 22:35 |
| *** henrynash has joined #openstack-keystone | 22:35 | |
| *** ChanServ sets mode: +v henrynash | 22:35 | |
| lifeless | ah kk | 22:36 |
| morganfainberg | afaik keystone and keystonemiddleware would be the targets | 22:36 |
| *** gordc has quit IRC | 22:36 | |
| morganfainberg | keystone for the different backends/deps, and ksm for caching | 22:36 |
| morganfainberg | lifeless: if i am remembering what extras is (aka pip install keystone[ldap] ?) | 22:36 |
| *** ASDFJKL has joined #openstack-keystone | 22:37 | |
| *** browne has joined #openstack-keystone | 22:37 | |
| *** ASDFJKL has quit IRC | 22:37 | |
| *** solomon_greenber has joined #openstack-keystone | 22:38 | |
| *** solomon_greenber has quit IRC | 22:38 | |
| *** csoukup has quit IRC | 22:40 | |
| lifeless | yeah | 22:41 |
| lifeless | someone wanted an example was all | 22:41 |
| lifeless | I've refreshed my oslo.db patch | 22:42 |
| *** Raildo_ has quit IRC | 22:43 | |
| *** hrou has quit IRC | 22:44 | |
| *** Lactem has joined #openstack-keystone | 22:44 | |
| Lactem | dstanek: That's my patch! : D | 22:44 |
| jasonsb | stevemar: your right sir. kilo got past where i was stuck | 22:45 |
| jasonsb | stevemar: openstack identity provider create idp1 --remote-id http://localhost:8080 is working | 22:45 |
| *** jk|osx has joined #openstack-keystone | 22:45 | |
| jasonsb | stevemar: i hope i have the syntax right | 22:46 |
| dstanek | jasonsb: i think that every time i push a new commit :) | 22:46 |
| *** njnjnj has joined #openstack-keystone | 22:46 | |
| *** chlong has quit IRC | 22:46 | |
| jasonsb | dstanek: dont worry pep8 will find it. even if its not there | 22:47 |
| Lactem | ^^^^^^^ | 22:47 |
| dstanek | once i push it's not my problem | 22:48 |
| *** jkomg has quit IRC | 22:48 | |
| dstanek | if a bug is never found does it actually exist | 22:48 |
| dstanek | Lactem: yes | 22:48 |
| dstanek | njnjnj: do you really use run_tests.sh? | 22:49 |
| lifeless | and there is proof that code never des | 22:49 |
| lifeless | dies | 22:49 |
| Lactem | dstanek: Are you yessing that the bug actually exists? If so, why are you just yessing me? | 22:49 |
| dstanek | Lactem: your review | 22:49 |
| Lactem | Oh. | 22:49 |
| Lactem | ty | 22:49 |
| Lactem | Does that mean +2? | 22:49 |
| Lactem | Wait my review or my patch? | 22:50 |
| njnjnj | dstanek: not really i was just trying to add that feature since it seems like some people do use run_tests | 22:50 |
| dstanek | Lactem: your patch...i just have to circle back around to it. at this rate i'm about 20 reviews away | 22:50 |
| Lactem | Alright. Good to hear! | 22:50 |
| Lactem | You had 170 earlier, so 20 doesn't sound like a lot to me anymore. | 22:51 |
| dstanek | Lactem: i use a couple of different things that show me what reviews i have to do and one neat this is that they are prioritized partially by things i've already reviewed floating to the top. i go nowhere near the 170 | 22:53 |
| Lactem | Oh. | 22:53 |
| dstanek | Lactem: depending on what gets submitted between now and when i get to your review it may be bumped a little further down the list | 22:53 |
| Lactem | Good luck. Happy reviewing. | 22:54 |
| dstanek | there's typically nothing happy about it :-) | 22:54 |
| dstanek | although on the bright side, I could be stuck writing Java! | 22:55 |
| Akshay04 | ^^^^^ | 22:55 |
| anhhuynx | Java isn't so bad :( | 22:55 |
| Lactem | Umm Java is so much better than Python, though. | 22:55 |
| Akshay04 | ^^^^^^^ agreed | 22:55 |
| Lactem | I would argue this right now, but I don't want to distract you from getting around to my patch. | 22:55 |
| dstanek | i spent too may years doing Java. i'll never go back | 22:55 |
| dstanek | haha | 22:55 |
| Lactem | Akshay04: You just agreed with both sides of the argument... | 22:56 |
| anhhuynx | ^ | 22:56 |
| Lactem | dstanek: I like Java because I actually understand it well, unlike Python. | 22:56 |
| dstanek | it's 7PM here, i'm on break doing other things for a little while | 22:56 |
| dstanek | Lactem: once you understand Python and the philosophy you'll want to stick with it | 22:56 |
| anhhuynx | python is easier to understand than java though | 22:56 |
| *** Rockyg has quit IRC | 22:57 | |
| Lactem | Ah alright. I probably wouldn't get second +2 by tomorrow anyway. | 22:57 |
| anhhuynx | and also it looks nicer | 22:57 |
| Lactem | It kind of looks nice. | 22:57 |
| Lactem | But Java is just so much better for me because I know it. | 22:57 |
| dstanek | Lactem: i've been doing python for a little over 15 years now. there's no hope of me turning back now | 22:58 |
| Lactem | And I much prefer coding in an IDE over Vim. The most annoying thing about Python for me is that you can't look at all the classes to see the methods and what they do. I have to do assertEqual(None, dir(variable)) in order to see the functions. | 22:58 |
| morganfainberg | dstanek: we should rewrite keystone in Rust | 22:58 |
| Lactem | dstanek: I've been doing life for little over 15 years now. | 22:58 |
| dstanek | morganfainberg: i'm not a rust fan; how about something like erlang or haskell? | 22:59 |
| morganfainberg | dstanek: eeeuuuuwww functional? | 22:59 |
| dstanek | Lactem: i use vim and love it. you need ctags | 22:59 |
| Lactem | dstanek: I'll look into it. | 23:00 |
| morganfainberg | dstanek: how about C++ | 23:00 |
| *** topol has joined #openstack-keystone | 23:00 | |
| *** ChanServ sets mode: +v topol | 23:00 | |
| *** r-daneel has quit IRC | 23:00 | |
| dstanek | Lactem: also with python there are several good IDEs. i think the JetBrains one if free for open source development | 23:00 |
| * bigjools hopes nobody says Go | 23:00 | |
| morganfainberg | dstanek: we could write it as an apache module: mod_keystone | 23:00 |
| dstanek | morganfainberg: C sure, C++ hurts my brain | 23:00 |
| morganfainberg | bigjools: ^ trust me, apache_module would be worse | 23:00 |
| bigjools | :) | 23:00 |
| Lactem | dstanek: But not from a VM. | 23:01 |
| morganfainberg | dstanek: C++ shouldn't hurt your brain more than python | 23:01 |
| *** topol has quit IRC | 23:01 | |
| *** Akshay04 has quit IRC | 23:01 | |
| morganfainberg | dstanek: now apache bucket brigade code... | 23:01 |
| morganfainberg | that is a different story | 23:01 |
| dstanek | Lactem: usually editors allow you to edit remotely - i use macvim to edit things on cloud nodes | 23:01 |
| njnjnj | I have some c++ experience | 23:01 |
| Lactem | Interesting. I only know how to edit on vim with putty on the VM right now. | 23:02 |
| morganfainberg | dstanek: lets use pascal..or cobol | 23:02 |
| morganfainberg | dstanek: wait wait... i know... this is a perfect app to write in ColdFusion | 23:02 |
| morganfainberg | nodejs? | 23:02 |
| dstanek | if you are going that direction then PHP - it's known for it's security | 23:03 |
| dstanek | solid choice | 23:03 |
| njnjnj | how about assembly the performance gainz | 23:03 |
| morganfainberg | dstanek: lets write the upstart/systemd/etc interfaces in php (the shell scripts) and then we need to use Ruby on Rails for keystone itself | 23:03 |
| dstanek | we may just need a new "cloud" language; a new paradigm to write the cloud operating system | 23:03 |
| morganfainberg | dstanek: we totally need to make a standard so everyone can standardize on it and talk the same language | 23:04 |
| Lactem | Good talk guys. See you tomorrow. | 23:04 |
| morganfainberg | dstanek: /xkcd | 23:04 |
| morganfainberg | Lactem: sorry just a little punchy | 23:04 |
| morganfainberg | Lactem: didn't mean to scare you off/hijack the convo | 23:04 |
| Lactem | Haha no you didn't. It's just about time for me to go. | 23:05 |
| morganfainberg | have a good day then | 23:05 |
| Lactem | You too | 23:05 |
| *** Lactem has quit IRC | 23:05 | |
| *** njnjnj has quit IRC | 23:06 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes docstring to make it more precise https://review.openstack.org/199338 | 23:07 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone-specs: IDP specific websso https://review.openstack.org/199339 | 23:08 |
| gyee | morganfainberg, bknudson, can I get a verdict on this one? https://review.openstack.org/#/c/194733/ | 23:11 |
| gyee | may need to backport to Kilo as well | 23:11 |
| dstanek | gyee: guilty? | 23:11 |
| gyee | hah | 23:11 |
| *** thedodd has quit IRC | 23:11 | |
| morganfainberg | dstanek: special circumstances | 23:11 |
| morganfainberg | dstanek: so.. not just guilty :P | 23:11 |
| gyee | heh | 23:12 |
| dstanek | sorry..too much people's court | 23:12 |
| gyee | judge judy | 23:12 |
| morganfainberg | query = u'(&%s%s)' % (query or '', ''.join(filter_list)) | 23:12 |
| morganfainberg | wouldn't that work? | 23:12 |
| gyee | it would, but I like it easier to read | 23:13 |
| gyee | basically, query need to be a string | 23:13 |
| dstanek | gyee: is someone passing query=None into the filter_quest method? | 23:14 |
| gyee | dstanek, yes | 23:14 |
| dstanek | err...filter_query | 23:14 |
| gyee | it is None by default | 23:14 |
| dstanek | it's '' by default | 23:14 |
| morganfainberg | dstanek, ++ | 23:14 |
| dstanek | shouldn't it be caught up there instead of in a loop? | 23:15 |
| gyee | up where? | 23:15 |
| morganfainberg | dstanek: yes | 23:15 |
| openstackgerrit | Merged openstack/keystone: Fix code-block in federation documentation https://review.openstack.org/199208 | 23:15 |
| morganfainberg | dstanek: someone is overriding the arg with None | 23:15 |
| morganfainberg | instead of just not passing it | 23:15 |
| gyee | it passing down from identity backend | 23:15 |
| gyee | one sec | 23:15 |
| bigjools | morganfainberg: so unless I am reading things badly, does the ldap driver really need write access to store group memberships? | 23:15 |
| morganfainberg | gyee: at the top if query is None: query = '' | 23:15 |
| morganfainberg | bigjools: the ldap driver only needs that power if run in read/write mode | 23:16 |
| morganfainberg | bigjools: typically it's run in read-only, all writes fail | 23:16 |
| bigjools | would that mean that group memberships won't work? | 23:16 |
| bigjools | or is there another mechanism? | 23:16 |
| morganfainberg | bigjools: you'd manage group memberships in LDAP directly | 23:16 |
| morganfainberg | not via keystone | 23:16 |
| bigjools | ah ok | 23:17 |
| morganfainberg | for SAML you'd map the users into a group [possibly something in a SQL domain] | 23:17 |
| morganfainberg | but you could also use a group from LDAP | 23:17 |
| bigjools | one of my constraints is that we can't rely on LDAP *at all* for group info | 23:17 |
| morganfainberg | nothing in the identity store is directly changed for federated-ephemeral users | 23:17 |
| gyee | morganfainberg, dstanek, its passing down from here https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L399 | 23:17 |
| bigjools | I'm looking at potentially mapping to local users | 23:18 |
| morganfainberg | gyee: so either we should fix it higher up to *not* pass if None, or at the top of the method if query is None: query = '' [actually if not isinstance(string) is probably more correct] | 23:18 |
| morganfainberg | bigjools: then you use groups in an SQL backed domain | 23:18 |
| dstanek | morganfainberg: gyee: yes, i agree. i commented on the review, but if you can fix it even higher up I think you should | 23:18 |
| bigjools | morganfainberg: right - but that doesn't work with just LDAP, right? | 23:19 |
| *** shaleh has quit IRC | 23:19 | |
| bigjools | (ignoring federation for now) | 23:19 |
| openstackgerrit | David Stanek proposed openstack/keystone: Can we really get rid of oslo and run_tests.sh? https://review.openstack.org/199343 | 23:20 |
| gyee | dstanek, line 1689? | 23:20 |
| gyee | build_filter is nested func | 23:20 |
| morganfainberg | bigjools: you would need the identity driver to either be SQL, with an ldap-specific driver for the domain users are in, or LDAP identity driver, and then override a specific domain for a SQL back | 23:20 |
| gyee | it does not use query yet | 23:20 |
| morganfainberg | bigjools: in both cases, it's V3 only | 23:20 |
| morganfainberg | gyee: before the for loop | 23:21 |
| morganfainberg | gyee: just not in the loop itself | 23:21 |
| *** jk|osx has quit IRC | 23:21 | |
| gyee | morganfainberg, its not in any loop | 23:21 |
| morganfainberg | probably before "if hints" | 23:21 |
| *** shaleh has joined #openstack-keystone | 23:21 | |
| gyee | can't, if hints is None, we need to return None | 23:21 |
| dstanek | gyee: yes, in the outer method | 23:21 |
| gyee | otherwise, it will break LDAP filter | 23:21 |
| morganfainberg | no | 23:21 |
| morganfainberg | query != None there | 23:22 |
| morganfainberg | query should be '' | 23:22 |
| gyee | can't | 23:22 |
| morganfainberg | then our whole system is broken | 23:22 |
| gyee | query needs to be either LDAP query or None | 23:22 |
| gyee | can't be an empty string | 23:22 |
| morganfainberg | it shouldn't default to '' in the method signature | 23:22 |
| morganfainberg | otherwise it is also very broken | 23:22 |
| morganfainberg | or we shouldn't do blind substitutions. | 23:23 |
| gyee | yes, that code needs a whole lot of refactoring | 23:23 |
| gyee | one thing at a time :) | 23:23 |
| morganfainberg | gyee: so if it *needs* to be None not '' | 23:23 |
| morganfainberg | fix the method sig too | 23:23 |
| bigjools | morganfainberg: ok thanks | 23:23 |
| morganfainberg | otherwise we can return '' if hints is None | 23:23 |
| bigjools | sounds like coding work :) | 23:24 |
| morganfainberg | bigjools: and the hybrid driver i wrote needs to die a horrible death :P | 23:24 |
| gyee | morganfainberg, k, lemme fix the method sig, don't think the default is being used anywhere | 23:24 |
| bigjools | morganfainberg: that's my plan :) | 23:24 |
| morganfainberg | gyee: yeah it's one of those "be consistent in expectations" | 23:24 |
| gyee | you got it boss | 23:24 |
| morganfainberg | gyee: otherwise we haven't fixed the issue, we end up with other problems. | 23:24 |
| morganfainberg | we just get different stack traces potentially | 23:25 |
| gyee | afaict, that default is not being used | 23:25 |
| morganfainberg | the other option is not to pass query to the LDAP connector code if string is '' | 23:25 |
| morganfainberg | gyee: then why is it a default? ;) | 23:25 |
| morganfainberg | maybe we shouldn't provide a default | 23:26 |
| dstanek | gyee: what breaks if an '' is returned instead of a None? | 23:26 |
| *** dramakri has left #openstack-keystone | 23:26 | |
| morganfainberg | dstanek: python-ldap afaict | 23:26 |
| gyee | dstanek, '' is not a valid LDAP filter | 23:26 |
| morganfainberg | due to crap coding on their end | 23:26 |
| dstanek | hmmm...odd. i started digging into the callers then they all seem to use boolean logic on the return value | 23:27 |
| dstanek | i'll just write it off as "not my mess" for right now | 23:28 |
| morganfainberg | dstanek: python-ldap should be removed in favour of ldap3 if we are putting any energy into it | 23:28 |
| gyee | dstanek, if you continue to follow the rabbit hole, it will eventually ended up in here https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L1458 | 23:28 |
| gyee | that's where if ldap_filter is None it will use the default one | 23:28 |
| dstanek | gyee: that's what i was looking at | 23:29 |
| gyee | but if we pass '', we will end up in a world of shit | 23:29 |
| dstanek | that logic should work find with None or '' | 23:29 |
| morganfainberg | dstanek: it's because we already constructed a filter | 23:29 |
| morganfainberg | &(objectclass=*)(group='') | 23:29 |
| morganfainberg | isn't valid | 23:29 |
| dstanek | where does that get constructed? | 23:30 |
| morganfainberg | it's just really really bad filter construction | 23:30 |
| morganfainberg | dstanek: don't look too deep, it's a rats nest of code | 23:30 |
| lifeless | artisinal filters 4 lyfe | 23:31 |
| gyee | dstanek, morganfainberg, sorry, I see what you mean now, I'll move the code up | 23:31 |
| gyee | and fix the method sig | 23:32 |
| morganfainberg | gyee: hehe | 23:32 |
| morganfainberg | lifeless: worse.. python-ldap + artisanal filters | 23:32 |
| gyee | morganfainberg, you agree we also need backport to Kilo? | 23:32 |
| *** hrou has joined #openstack-keystone | 23:32 | |
| morganfainberg | gyee: do we have cases of people really hitting this? | 23:33 |
| gyee | morganfainberg, yes, our QA discovered it with just the default attributes against openldap | 23:33 |
| bigjools | morganfainberg: hypothetically, if I did a change to make the LDAP driver pull group info from SQL backing for a configured list of domains, is that something upstream would take? | 23:33 |
| morganfainberg | bigjools: the thing is you don't need to change code really to do that | 23:34 |
| dstanek | this is my favorite review title of all time: | 23:34 |
| dstanek | Jesse Pretorius proposed stackforge/os-ansible-deployment: Enable all services to use Keystone 'insecurely' https://review.openstack.org/199307 | 23:34 |
| bigjools | morganfainberg: oh! tell me more ... | 23:34 |
| morganfainberg | bigjools: create a group in SQL - add user <from ldap> to group | 23:34 |
| morganfainberg | bigjools: ???; profit | 23:34 |
| morganfainberg | again, requires V3 | 23:35 |
| bigjools | umm ok maybe I misread the code, I thought it always went to ldap | 23:35 |
| dstanek | gyee: let me know if you need another -1 on something; itchy trigger finger this evening | 23:35 |
| morganfainberg | bigjools: this requires the multi-domain (with specific domains having different identity drivers) configured | 23:35 |
| gyee | dstanek, go for it, I am uploading another patch | 23:35 |
| morganfainberg | gyee: -1 | 23:36 |
| morganfainberg | gyee: -(-2)? | 23:36 |
| gyee | thanks, may I have another one? | 23:36 |
| gyee | nooooh | 23:36 |
| morganfainberg | *cough* do the math | 23:36 |
| anhhuynx | dstanek: It seems that I have been modifying the wrong files the whole time which is why my code isn't working | 23:36 |
| anhhuynx | dstanek: how do you find the file that handles API calls in devstack? | 23:37 |
| bigjools | morganfainberg: so there's already a driver that pulls users from ldap and groups from sql? sorry for being thick, still learning things. | 23:38 |
| morganfainberg | bigjools: you can configure a specific domain to use a different backing store | 23:38 |
| bigjools | that makes sense | 23:39 |
| morganfainberg | bigjools: so you'd either configure one of the domains to be LDAP or you'd configure one to be SQL | 23:39 |
| morganfainberg | in a domain that is SQL backed - you create the groups | 23:39 |
| morganfainberg | then add the users from LDAP to the SQL groups. | 23:39 |
| openstackgerrit | guang-yee proposed openstack/keystone: Fix for LDAP filter on group search by name https://review.openstack.org/194733 | 23:39 |
| morganfainberg | it *should* work. | 23:39 |
| morganfainberg | afaicr | 23:39 |
| bigjools | ah ok - it's the manually adding things I want to avoid | 23:39 |
| gyee | morganfainberg, dstanek, patch #3 | 23:40 |
| dstanek | anhhuynx: what do you mean? | 23:40 |
| openstackgerrit | Merged openstack/keystone: Remove comment for doc building bug 1260495 https://review.openstack.org/199239 | 23:40 |
| openstack | bug 1260495 in python-keystoneclient "Setting autodoc_tree_index_modules makes documentation builds fail" [Low,Fix released] https://launchpad.net/bugs/1260495 - Assigned to David Stanek (dstanek) | 23:40 |
| morganfainberg | bigjools: you're going to have to do some manual things unless you manage groups in LDAP directly | 23:40 |
| morganfainberg | bigjools: which case - it's someone else's problem | 23:40 |
| * morganfainberg likes SEPs | 23:40 | |
| *** stevemar has quit IRC | 23:40 | |
| bigjools | heh :) well that was the point of my suggestion, pulling users from LDAP and their group memberships from SQL (which is fine to manually maintain) | 23:40 |
| morganfainberg | bigjools: the automatic mapping is a federated thing. | 23:40 |
| gyee | btw, we don't support nested LDAP groups | 23:41 |
| morganfainberg | gyee: we don't support referral chasing either really | 23:41 |
| gyee | nor do we support memberOf | 23:41 |
| anhhuynx | dstanek: I'm not sure you are using the same development environment as I am, but it seems that the keystone repository i'm workign on isn't the one handling the API call | 23:41 |
| bigjools | consider large enterprises that have an existing LDAP server, and they are not willing to make any changes to it | 23:41 |
| morganfainberg | i don't know how you get automatic group management your way | 23:42 |
| dstanek | anhhuynx: if you are working in a devstack env it uses the code from /opt/stack/keystone | 23:42 |
| bigjools | it's not automatic | 23:42 |
| morganfainberg | you still need users -> groups somehow | 23:42 |
| morganfainberg | i don't want to make drivers that source some things from LDAP and somethings from SQL | 23:42 |
| dstanek | you'll have to restart keystone though <- anhhuynx | 23:42 |
| morganfainberg | it's what the multi-driver story is for | 23:42 |
| morganfainberg | we just require it to be a V3 story | 23:42 |
| bigjools | the existing ldap driver puts groups in a particular user attribute, I would just want to switch that to an SQL source | 23:43 |
| morganfainberg | bigjools: a lot of times the groups in LDAP already mirror the applications someone wants to manage | 23:43 |
| morganfainberg | bigjools: or security wants to do so. | 23:43 |
| anhhuynx | dstanek: what do you mean? | 23:43 |
| morganfainberg | bigjools: i'm clearly missing what benefit you're describing by doing a hybrid driver | 23:44 |
| dstanek | anhhuynx: about the location or restart? | 23:44 |
| morganfainberg | vs. what i'm describing | 23:44 |
| anhhuynx | dstanek: about the restart | 23:44 |
| morganfainberg | bigjools: you could configure keystone to never return a group via the config if you're worried someone would assign a role to an LDAP group | 23:44 |
| dstanek | anhhuynx: assuming you ran ./stack.sh you have an instance of keystone running. if you change the code you will have to restart the instance to load the changed code | 23:45 |
| morganfainberg | (objectClass="NotAValidObjectClass") | 23:45 |
| morganfainberg | will never return match | 23:45 |
| anhhuynx | dstanek: oh ok | 23:45 |
| dstanek | anhhuynx: if it's running under apache you can just restart that. i don't remember when current devstack uses | 23:45 |
| bigjools | morganfainberg: ignoring federation, it's the situation where we have an existing enterprise LDAP that we cannot write to, nor are they willing to make changes to group info | 23:45 |
| anhhuynx | ddstanek: thank you very much | 23:45 |
| dstanek | anhhuynx: np | 23:45 |
| morganfainberg | bigjools: so, configure keystone with another domain to be SQL backed | 23:45 |
| morganfainberg | bigjools: assign the LDAP user into a group in that SQL backed domain | 23:46 |
| morganfainberg | assign roles to SQL group | 23:46 |
| morganfainberg | win | 23:46 |
| bigjools | but that means manually configuring the user in SQL? | 23:46 |
| morganfainberg | oh nvm | 23:47 |
| morganfainberg | you can't we explicitly deny this | 23:47 |
| bigjools | ok | 23:47 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L937-L938 | 23:47 |
| morganfainberg | you can't bridge backends | 23:48 |
| morganfainberg | bigjools: /me doesn't remember that code. but eh lots of code in keystone | 23:48 |
| bigjools | :) | 23:48 |
| morganfainberg | you could make an RFE to somehow allow that | 23:48 |
| morganfainberg | but i personally am against having an in-tree driver that straddles these things | 23:49 |
| bigjools | it sounds non-trivial | 23:49 |
| bigjools | well, invasive I mean | 23:49 |
| bigjools | fair enough | 23:49 |
| morganfainberg | bigjools: probably a simple config to allow domain X to have users in groups where the users are in domain Y | 23:49 |
| *** TheIntern has quit IRC | 23:49 | |
| morganfainberg | would probably be easy code and not too invasive | 23:49 |
| morganfainberg | but it would be an RFE | 23:50 |
| bigjools | yeah | 23:50 |
| morganfainberg | and likely not until M-cycle | 23:50 |
| bigjools | I think federation recognises this problem FWIW, with the group mapping stuff. | 23:50 |
| morganfainberg | bigjools: federation was designed in a very different manner | 23:51 |
| bigjools | sure | 23:51 |
| * morganfainberg recommends federation where possible for non-service users. | 23:51 | |
| *** gyee has quit IRC | 23:51 | |
| bigjools | I have an odd situation that I think you're aware of :) | 23:52 |
| morganfainberg | yeah i know your customers | 23:52 |
| morganfainberg | and i know the PITA your stuck in atm | 23:52 |
| morganfainberg | i regret some of those choices. | 23:53 |
| bigjools | websso with K2K would fix things, but I need a solution that works RSN | 23:55 |
| openstackgerrit | Doug Fish proposed openstack/python-keystoneclient: List federated projects from keystoneauth https://review.openstack.org/199347 | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!