| *** sigmavirus24 is now known as sigmavirus24_awa | 00:06 | |
| openstackgerrit | Merged openstack/keystone: Use wsgi_scripts to create admin and public httpd files https://review.openstack.org/194442 | 00:08 |
|---|---|---|
| *** jasonsb has quit IRC | 00:08 | |
| *** r-daneel has joined #openstack-keystone | 00:09 | |
| *** HT_sergio has quit IRC | 00:14 | |
| jamielennox | dolphm: if you're still around i replied to your comment on https://review.openstack.org/#/c/216088/ | 00:22 |
| *** shadower has quit IRC | 00:23 | |
| *** shadower has joined #openstack-keystone | 00:23 | |
| *** dave-mcc_ has joined #openstack-keystone | 00:24 | |
| openstackgerrit | Merged openstack/keystone: Use entrypoints for paste middleware and apps https://review.openstack.org/214720 | 00:25 |
| openstackgerrit | Merged openstack/keystone: Prevent exception for invalidly encoded parameters https://review.openstack.org/213796 | 00:25 |
| *** dave-mccowan has quit IRC | 00:27 | |
| *** HT_sergio has joined #openstack-keystone | 00:30 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 00:33 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 00:39 |
| *** asd112z has joined #openstack-keystone | 00:41 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Set max on max_password_length to passlib max https://review.openstack.org/217449 | 00:41 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 00:42 |
| *** shoutm has joined #openstack-keystone | 00:54 | |
| *** shoutm_ has quit IRC | 00:57 | |
| *** spandhe has quit IRC | 00:59 | |
| *** _cjones_ has quit IRC | 01:05 | |
| *** shoutm has quit IRC | 01:10 | |
| *** shoutm has joined #openstack-keystone | 01:14 | |
| *** jasonsb has joined #openstack-keystone | 01:27 | |
| *** jasonsb has quit IRC | 01:28 | |
| *** jasonsb has joined #openstack-keystone | 01:29 | |
| *** HT_sergio has quit IRC | 01:31 | |
| *** doug-fish has joined #openstack-keystone | 01:31 | |
| *** jasonsb has quit IRC | 01:32 | |
| *** btully has quit IRC | 01:35 | |
| *** r-daneel has quit IRC | 01:35 | |
| *** doug-fish has quit IRC | 01:36 | |
| *** dims has joined #openstack-keystone | 01:43 | |
| *** fangzhou has quit IRC | 01:50 | |
| *** doug-fish has joined #openstack-keystone | 01:52 | |
| *** lhcheng has quit IRC | 01:53 | |
| *** doug-fish has quit IRC | 01:56 | |
| *** lhcheng has joined #openstack-keystone | 01:56 | |
| *** ChanServ sets mode: +v lhcheng | 01:56 | |
| *** lhcheng has quit IRC | 01:57 | |
| *** lhcheng has joined #openstack-keystone | 01:57 | |
| *** ChanServ sets mode: +v lhcheng | 01:57 | |
| *** lhcheng has quit IRC | 01:59 | |
| *** btully has joined #openstack-keystone | 02:00 | |
| *** jlk has left #openstack-keystone | 02:04 | |
| *** btully has quit IRC | 02:04 | |
| *** btully has joined #openstack-keystone | 02:06 | |
| *** lhcheng has joined #openstack-keystone | 02:09 | |
| *** ChanServ sets mode: +v lhcheng | 02:09 | |
| *** mylu has quit IRC | 02:10 | |
| dstanek | is gerrit down or is it just me? | 02:11 |
| dstanek | hmmm....seems to be back | 02:18 |
| *** spandhe has joined #openstack-keystone | 02:19 | |
| *** ankita_wagh has joined #openstack-keystone | 02:27 | |
| *** HT_sergio has joined #openstack-keystone | 02:29 | |
| *** mylu has joined #openstack-keystone | 02:30 | |
| *** zzzeek has joined #openstack-keystone | 02:34 | |
| *** jasonsb has joined #openstack-keystone | 02:35 | |
| *** zzzeek has quit IRC | 02:47 | |
| *** asd112z has quit IRC | 02:50 | |
| *** jlk has joined #openstack-keystone | 02:50 | |
| *** hakimo_ has joined #openstack-keystone | 02:52 | |
| *** dave-mcc_ has quit IRC | 02:54 | |
| *** hakimo has quit IRC | 02:55 | |
| *** richm has quit IRC | 02:55 | |
| *** dims has quit IRC | 02:56 | |
| *** mylu has quit IRC | 03:11 | |
| *** mylu has joined #openstack-keystone | 03:11 | |
| *** mylu_ has joined #openstack-keystone | 03:14 | |
| *** mylu has quit IRC | 03:14 | |
| *** lhcheng has quit IRC | 03:17 | |
| *** esp has left #openstack-keystone | 03:20 | |
| *** esp has joined #openstack-keystone | 03:22 | |
| *** urulama has quit IRC | 03:27 | |
| *** urulama has joined #openstack-keystone | 03:28 | |
| *** EinstCrazy has joined #openstack-keystone | 03:32 | |
| *** lhcheng has joined #openstack-keystone | 03:35 | |
| *** ChanServ sets mode: +v lhcheng | 03:35 | |
| *** lhcheng_ has joined #openstack-keystone | 03:40 | |
| *** dikonoor has joined #openstack-keystone | 03:42 | |
| *** lhcheng has quit IRC | 03:42 | |
| *** alex_xu has quit IRC | 03:45 | |
| *** alex_xu has joined #openstack-keystone | 03:46 | |
| *** mylu_ has quit IRC | 03:55 | |
| *** mylu has joined #openstack-keystone | 03:56 | |
| *** ankita_w_ has joined #openstack-keystone | 03:56 | |
| *** mylu has quit IRC | 03:57 | |
| *** mylu has joined #openstack-keystone | 03:57 | |
| *** ankita_wagh has quit IRC | 03:58 | |
| *** jamielennox is now known as jamielennox|away | 04:04 | |
| *** jamielennox|away is now known as jamielennox | 04:05 | |
| *** mylu has quit IRC | 04:13 | |
| *** mylu has joined #openstack-keystone | 04:14 | |
| *** ankita_w_ has quit IRC | 04:14 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/214509 | 04:14 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/217482 | 04:14 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth-saml2: Updated from global requirements https://review.openstack.org/217483 | 04:14 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/217158 | 04:14 |
| *** mylu has quit IRC | 04:17 | |
| *** mylu has joined #openstack-keystone | 04:17 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/217496 | 04:18 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf: Updated from global requirements https://review.openstack.org/217501 | 04:18 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/217205 | 04:18 |
| *** ajayaa has joined #openstack-keystone | 04:20 | |
| *** mylu has quit IRC | 04:21 | |
| *** spandhe has quit IRC | 04:27 | |
| *** ankita_wagh has joined #openstack-keystone | 04:28 | |
| *** spandhe has joined #openstack-keystone | 04:30 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Set max on max_password_length to passlib max https://review.openstack.org/217449 | 04:30 |
| *** ankita_wagh has quit IRC | 04:31 | |
| *** ankita_wagh has joined #openstack-keystone | 04:31 | |
| *** links has joined #openstack-keystone | 04:38 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 04:42 |
| *** davechen has joined #openstack-keystone | 04:53 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds warning when no domain configs were uploaded https://review.openstack.org/214287 | 04:55 |
| *** _hrou_ has joined #openstack-keystone | 04:59 | |
| *** Guest53419 has quit IRC | 05:01 | |
| *** ajayaa has quit IRC | 05:01 | |
| *** hrou has quit IRC | 05:02 | |
| *** zeus has joined #openstack-keystone | 05:03 | |
| *** zeus is now known as Guest22530 | 05:04 | |
| *** openstackgerrit has quit IRC | 05:16 | |
| *** openstackgerrit has joined #openstack-keystone | 05:17 | |
| *** fangzhou has joined #openstack-keystone | 05:26 | |
| *** albertom has quit IRC | 05:29 | |
| *** albertom has joined #openstack-keystone | 05:30 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor: Don't hard code the error code https://review.openstack.org/198623 | 05:40 |
| *** dims has joined #openstack-keystone | 05:46 | |
| *** ajayaa has joined #openstack-keystone | 05:49 | |
| *** Nirupama has joined #openstack-keystone | 05:49 | |
| *** EinstCrazy has quit IRC | 05:50 | |
| *** ankita_w_ has joined #openstack-keystone | 05:51 | |
| *** dims has quit IRC | 05:52 | |
| *** EinstCrazy has joined #openstack-keystone | 05:54 | |
| *** ankita_wagh has quit IRC | 05:55 | |
| *** paulose has joined #openstack-keystone | 05:55 | |
| paulose | hello all how can i change the role of a user from _member_ to admin | 05:56 |
| *** afazekas_ has joined #openstack-keystone | 06:06 | |
| *** _hrou_ has quit IRC | 06:12 | |
| paulose | i have a user whose role was _member_ later changed to heat_stack_user and again back to _member_ but now the user is not able to do any heat commands as it returns error not authorised .Any idea about this error? | 06:14 |
| openstackgerrit | majianjun proposed openstack/keystone: Possible refactor of keystone.common.validate_token_bind's code Fixes Bug1488451 https://review.openstack.org/217535 | 06:16 |
| *** btully has quit IRC | 06:16 | |
| *** ankita_w_ has quit IRC | 06:23 | |
| *** ankita_wagh has joined #openstack-keystone | 06:25 | |
| *** ankita_wagh has quit IRC | 06:27 | |
| *** ankita_wagh has joined #openstack-keystone | 06:28 | |
| *** albertom has quit IRC | 06:34 | |
| openstackgerrit | majianjun proposed openstack/keystone: Return the tenant_id as early as possible Fixes Bug1488715 https://review.openstack.org/217543 | 06:37 |
| *** albertom has joined #openstack-keystone | 06:39 | |
| *** ankita_w_ has joined #openstack-keystone | 06:46 | |
| *** btully has joined #openstack-keystone | 06:47 | |
| *** ankita_wagh has quit IRC | 06:49 | |
| *** ankita_w_ has quit IRC | 06:50 | |
| *** doug-fish has joined #openstack-keystone | 06:56 | |
| *** henrynash has joined #openstack-keystone | 06:57 | |
| *** ChanServ sets mode: +v henrynash | 06:57 | |
| *** doug-fish has quit IRC | 07:01 | |
| *** browne has quit IRC | 07:01 | |
| *** tobasco_ is now known as tobasco | 07:14 | |
| *** e0ne has joined #openstack-keystone | 07:18 | |
| *** mylu has joined #openstack-keystone | 07:22 | |
| *** mylu has quit IRC | 07:28 | |
| *** mylu has joined #openstack-keystone | 07:29 | |
| *** paulose has quit IRC | 07:30 | |
| *** mylu has quit IRC | 07:30 | |
| *** mylu has joined #openstack-keystone | 07:31 | |
| *** katkapilatova has joined #openstack-keystone | 07:32 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Validate Mapped User object. https://review.openstack.org/217049 | 07:34 |
| *** dims has joined #openstack-keystone | 07:35 | |
| *** mylu has quit IRC | 07:35 | |
| *** dims has quit IRC | 07:40 | |
| *** vivekd has joined #openstack-keystone | 07:41 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Update apache-httpd.rst https://review.openstack.org/217565 | 07:44 |
| *** fhubik has joined #openstack-keystone | 07:55 | |
| *** shoutm_ has joined #openstack-keystone | 07:57 | |
| *** fhubik is now known as fhubik_brb | 07:58 | |
| *** lhcheng has joined #openstack-keystone | 07:59 | |
| *** ChanServ sets mode: +v lhcheng | 07:59 | |
| *** shoutm has quit IRC | 08:00 | |
| *** e0ne has quit IRC | 08:01 | |
| *** jaosorior has joined #openstack-keystone | 08:02 | |
| *** lhcheng_ has quit IRC | 08:03 | |
| *** fhubik_brb is now known as fhubik | 08:05 | |
| *** boris-42 has quit IRC | 08:10 | |
| *** urulama has quit IRC | 08:10 | |
| *** urulama has joined #openstack-keystone | 08:11 | |
| *** kiran-r has joined #openstack-keystone | 08:11 | |
| openstackgerrit | Merged openstack/keystone: Remove references to keystone.openstack.common https://review.openstack.org/215337 | 08:13 |
| *** pnavarro has joined #openstack-keystone | 08:14 | |
| *** jistr has joined #openstack-keystone | 08:15 | |
| openstackgerrit | Merged openstack/keystoneauth-saml2: Updated from global requirements https://review.openstack.org/217483 | 08:16 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 08:17 |
| *** spandhe has quit IRC | 08:19 | |
| *** shoutm_ has quit IRC | 08:32 | |
| *** henrynash has quit IRC | 08:37 | |
| *** lhcheng has quit IRC | 08:44 | |
| *** urulama has quit IRC | 08:51 | |
| *** henrynash has joined #openstack-keystone | 08:51 | |
| *** ChanServ sets mode: +v henrynash | 08:51 | |
| *** urulama has joined #openstack-keystone | 08:51 | |
| *** jistr has quit IRC | 08:54 | |
| *** jistr has joined #openstack-keystone | 08:56 | |
| *** e0ne has joined #openstack-keystone | 08:59 | |
| *** wuhg has joined #openstack-keystone | 09:00 | |
| *** davechen has quit IRC | 09:01 | |
| *** jistr has quit IRC | 09:01 | |
| *** jistr has joined #openstack-keystone | 09:05 | |
| *** spandhe has joined #openstack-keystone | 09:11 | |
| *** kiran-r has quit IRC | 09:27 | |
| openstackgerrit | Merged openstack/keystone: Simplify rule in sample v3 policy file https://review.openstack.org/213338 | 09:35 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/217158 | 09:35 |
| *** fhubik is now known as fhubik_brb | 09:39 | |
| *** lhcheng has joined #openstack-keystone | 09:39 | |
| *** ChanServ sets mode: +v lhcheng | 09:39 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 09:42 |
| *** fhubik_brb is now known as fhubik | 09:45 | |
| *** urulama has quit IRC | 09:49 | |
| *** urulama has joined #openstack-keystone | 09:50 | |
| *** dims has joined #openstack-keystone | 09:50 | |
| *** btully has quit IRC | 09:54 | |
| *** katkapilatova has left #openstack-keystone | 09:57 | |
| *** jistr has quit IRC | 10:06 | |
| *** lhcheng has quit IRC | 10:07 | |
| *** eandersson has joined #openstack-keystone | 10:10 | |
| *** EinstCrazy has quit IRC | 10:13 | |
| *** henrynash has quit IRC | 10:16 | |
| *** jistr has joined #openstack-keystone | 10:18 | |
| eandersson | Morning | 10:21 |
| eandersson | When you are using domain-tokens and authenticate as admin with the default domain. Does API request necessarily come with X-Tenant-ID? Trying to figure out if a bug in an update for Designate is well a bug. :D | 10:23 |
| openstackgerrit | Merged openstack/keystone: Expose exception due to missing id of LDAP entity https://review.openstack.org/211088 | 10:23 |
| *** spandhe has quit IRC | 10:24 | |
| openstackgerrit | Merged openstack/keystone: Prevent exception due to missing id of LDAP entity https://review.openstack.org/207960 | 10:25 |
| openstackgerrit | Merged openstack/keystone: Update docs for stevedore drivers https://review.openstack.org/210590 | 10:26 |
| openstackgerrit | Merged openstack/keystone: Sample config help for supplied drivers https://review.openstack.org/210739 | 10:26 |
| openstackgerrit | Merged openstack/keystone: update links in http-api to point to specs repo https://review.openstack.org/214441 | 10:26 |
| *** henrynash has joined #openstack-keystone | 10:31 | |
| *** ChanServ sets mode: +v henrynash | 10:31 | |
| *** henrynash has quit IRC | 10:33 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 10:36 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 10:38 |
| *** Kennan has quit IRC | 10:38 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 10:39 |
| *** kiran-r has joined #openstack-keystone | 10:40 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 10:41 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 10:42 |
| *** vivekd has quit IRC | 10:48 | |
| *** Kennan has joined #openstack-keystone | 10:55 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Make application initialization a critical section https://review.openstack.org/210001 | 10:57 |
| *** vivekd has joined #openstack-keystone | 10:57 | |
| *** dtantsur has joined #openstack-keystone | 10:57 | |
| dtantsur | hey folks! are there any examples on how to create a keystoneclient instance that works? | 10:58 |
| dtantsur | e.g. http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html#authenticating-using-sessions results in client instance that fails for every request | 10:58 |
| dtantsur | the same problem with other examples... | 10:58 |
| dtantsur | nevermind, v2 examples seem to work, should be enough for me | 11:00 |
| *** aix has quit IRC | 11:02 | |
| *** Fdaisuke has joined #openstack-keystone | 11:03 | |
| *** alex_xu has quit IRC | 11:20 | |
| *** HT_sergio has quit IRC | 11:20 | |
| *** HT_sergio has joined #openstack-keystone | 11:21 | |
| *** alex_xu has joined #openstack-keystone | 11:23 | |
| *** dave-mccowan has joined #openstack-keystone | 11:30 | |
| *** aix has joined #openstack-keystone | 11:33 | |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/217496 | 11:35 |
| *** fhubik has quit IRC | 11:37 | |
| *** fhubik has joined #openstack-keystone | 11:37 | |
| *** e0ne has quit IRC | 11:42 | |
| *** fhubik_ has joined #openstack-keystone | 11:43 | |
| *** samueldmq has joined #openstack-keystone | 11:44 | |
| samueldmq | morning | 11:44 |
| *** gordc has joined #openstack-keystone | 11:45 | |
| *** pnavarro is now known as pnavarro|lunch | 11:46 | |
| *** fhubik is now known as fhubik_brb | 11:47 | |
| dtantsur | hey folks! is it correct that `openstack endpoint list` is empty on a fresh devstack? Oo | 11:49 |
| dtantsur | samueldmq, morning, maybe you know ^^ | 11:50 |
| *** vivekd has quit IRC | 11:52 | |
| *** lhcheng has joined #openstack-keystone | 11:55 | |
| *** ChanServ sets mode: +v lhcheng | 11:55 | |
| *** kiran-r has quit IRC | 11:58 | |
| samueldmq | dtantsur, try again adding : '--os-url <your_keystone_url/v3> --os-identity-api-version=3' | 11:58 |
| samueldmq | jamielennox, cc ^ so we changed endpoint creation to use v3 in (https://review.openstack.org/#/c/186681) | 11:59 |
| dtantsur | samueldmq, that's using v3, which is fine for CLI, but in software I write I have to use v2 | 11:59 |
| dtantsur | (mostly because I can't make v3 work) | 11:59 |
| samueldmq | dstanek, v3 works fine :) | 11:59 |
| samueldmq | dstanek, not you, dtantsur | 12:00 |
| samueldmq | dstanek, you know that already | 12:00 |
| samueldmq | :) | 12:00 |
| *** lhcheng has quit IRC | 12:00 | |
| dtantsur | I suppose it does :) however, in my environment http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html#authenticating-using-sessions results in client instance that fails for every request | 12:00 |
| *** urulama has quit IRC | 12:00 | |
| samueldmq | dtantsur, I can't help with any debugging now, have a meeting in a bit | 12:01 |
| *** urulama has joined #openstack-keystone | 12:01 | |
| dtantsur | ack, thanks anyway.. | 12:01 |
| jamielennox | samueldmq: not sure what you mean | 12:01 |
| samueldmq | dtantsur, but feel free to ask any question here in the channel, I am sure someone will have answers for your question | 12:01 |
| samueldmq | jamielennox, so v3 endpoints can't be seen in v2 | 12:02 |
| samueldmq | jamielennox, and as devstack still defaults to v2, when in a fresh devstack one tris 'openstack endpoint list' | 12:02 |
| jamielennox | ergh | 12:02 |
| samueldmq | jamielennox, it's returned an empty list | 12:02 |
| samueldmq | yeah :-) | 12:02 |
| jamielennox | um | 12:03 |
| jamielennox | i'm not sure what i want to do about that | 12:03 |
| jamielennox | if naything | 12:03 |
| dtantsur | so, with v3 (kilo tripleo, not devstack this time), I get Unauthorized: Could not find project: admin | 12:06 |
| dtantsur | it seems to be like I need some code that can use both v2 and v3 at the same time. any hints? | 12:06 |
| *** raildo-afk is now known as raildo | 12:10 | |
| *** dims has quit IRC | 12:14 | |
| *** fhubik_ has quit IRC | 12:14 | |
| *** fhubik_ has joined #openstack-keystone | 12:14 | |
| dstanek | jamielennox: there is the start of a review to see v3 endpoints on v2, we need to deprecate harder | 12:17 |
| jamielennox | dstanek: i would love to, but i just don't think operators care | 12:18 |
| jamielennox | dstanek: on the other hand we are currently talking about devstack and i feel no need to worry about people there | 12:18 |
| amakarov | A question from Horizon folks: what about pagination support in (domain|project|user|whatever)-list ? | 12:18 |
| *** ajayaa has quit IRC | 12:23 | |
| *** dims has joined #openstack-keystone | 12:29 | |
| *** openstackgerrit has quit IRC | 12:31 | |
| *** openstackgerrit has joined #openstack-keystone | 12:32 | |
| *** edmondsw has joined #openstack-keystone | 12:32 | |
| *** Nirupama has quit IRC | 12:36 | |
| *** wuhg has quit IRC | 12:41 | |
| *** doug-fish has joined #openstack-keystone | 12:41 | |
| *** e0ne has joined #openstack-keystone | 12:44 | |
| *** fhubik_ has quit IRC | 12:44 | |
| *** afaranha has joined #openstack-keystone | 12:44 | |
| *** afaranha has left #openstack-keystone | 12:44 | |
| *** fhubik has joined #openstack-keystone | 12:44 | |
| *** fhubik_brb has quit IRC | 12:45 | |
| *** fhubik has quit IRC | 12:45 | |
| *** fhubik has joined #openstack-keystone | 12:45 | |
| *** fhubik is now known as fhubik_brb | 12:45 | |
| *** pnavarro|lunch is now known as pnavarro | 12:51 | |
| *** hrou has joined #openstack-keystone | 12:55 | |
| marekd | what's Sam Leong's IRC handle? | 12:57 |
| *** richm has joined #openstack-keystone | 13:00 | |
| *** fhubik_brb is now known as fhubik | 13:00 | |
| raildo | marekd: problably is chioleong (this is the gerrit login) | 13:02 |
| marekd | raildo: oh, thanks | 13:02 |
| marekd | and he probably lives in California :( | 13:03 |
| raildo | yeap | 13:03 |
| marekd | morgan: Does this change need a spec? https://review.openstack.org/#/c/216308/2 ? | 13:03 |
| dstanek | marekd: i think so because it's changing the API | 13:06 |
| *** fhubik is now known as fhubik_brb | 13:08 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/217482 | 13:09 |
| *** pgbridge has joined #openstack-keystone | 13:09 | |
| *** doug-fish has quit IRC | 13:15 | |
| *** nicodemos has joined #openstack-keystone | 13:15 | |
| *** doug-fish has joined #openstack-keystone | 13:15 | |
| *** tellesnobrega has quit IRC | 13:15 | |
| *** tellesnobrega has joined #openstack-keystone | 13:15 | |
| marekd | dstanek: yeah, i wasn't sure. | 13:19 |
| marekd | dstanek: so a change where say..we add a new feature to the mapping rules is considered API change | 13:19 |
| *** doug-fish has quit IRC | 13:19 | |
| *** doug-fish has joined #openstack-keystone | 13:22 | |
| *** zzzeek has joined #openstack-keystone | 13:22 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:24 | |
| *** afazekas_ has quit IRC | 13:26 | |
| *** urulama has quit IRC | 13:29 | |
| *** urulama has joined #openstack-keystone | 13:29 | |
| *** bknudson has joined #openstack-keystone | 13:33 | |
| *** ChanServ sets mode: +v bknudson | 13:33 | |
| *** thiagop has joined #openstack-keystone | 13:37 | |
| *** dtantsur has left #openstack-keystone | 13:44 | |
| *** lhcheng has joined #openstack-keystone | 13:45 | |
| *** ChanServ sets mode: +v lhcheng | 13:45 | |
| marekd | bknudson, dstanek: and this? https://review.openstack.org/#/c/217049/2 does it need a bp/bug ? | 13:47 |
| *** fhubik_brb is now known as fhubik | 13:48 | |
| bknudson | marekd: does it fix something that a user would see? | 13:48 |
| *** lhcheng has quit IRC | 13:49 | |
| marekd | bknudson: no, it makes our tests better IMHO. | 13:49 |
| *** claudiub has joined #openstack-keystone | 13:49 | |
| bknudson | marekd: doesn't need a bug or blueprint then imo. | 13:50 |
| bknudson | doesn't hurt to have a bug or blueprint either. | 13:50 |
| *** petertr7_away is now known as petertr7 | 13:51 | |
| bknudson | could put a note in the commit message that says it makes the tests better. | 13:51 |
| marekd | bknudson: ok | 13:51 |
| bknudson | kind of obvious since the only change is a test file. | 13:51 |
| marekd | i will add the bug anyway. | 13:51 |
| claudiub | hi. still need reviews for the python-keystone client patch regarding missing socket attrubte error during init_poolmanager: https://review.openstack.org/#/c/211686/ | 13:51 |
| *** mpmsimo has joined #openstack-keystone | 13:55 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Validate Mapped User object. https://review.openstack.org/217049 | 13:55 |
| *** HT_sergio has quit IRC | 13:58 | |
| *** exploreshaifali has joined #openstack-keystone | 13:59 | |
| *** petertr7 is now known as petertr7_away | 14:01 | |
| *** Kennan has quit IRC | 14:02 | |
| *** Kennan has joined #openstack-keystone | 14:03 | |
| amakarov | bknudson, greetings! I've moved addressed your comment in https://review.openstack.org/#/c/210001/ Please look at that again! | 14:03 |
| amakarov | s/moved// | 14:04 |
| bknudson | amakarov: the comment says it's protecting global variable but there's no global variable | 14:04 |
| *** doug-fish has quit IRC | 14:04 | |
| *** doug-fish has joined #openstack-keystone | 14:05 | |
| bknudson | maybe initialize_admin_application needs to cache the return value? | 14:05 |
| *** doug-fish has quit IRC | 14:05 | |
| bknudson | or maybe the change actually goes in pbr now? | 14:05 |
| *** doug-fish has joined #openstack-keystone | 14:06 | |
| bknudson | amakarov: here's the change in pbr: https://review.openstack.org/#/c/195292/ | 14:06 |
| bknudson | that added support | 14:06 |
| *** doug-fish has quit IRC | 14:07 | |
| amakarov | bknudson, thanks, I'm looking there | 14:07 |
| *** doug-fish has joined #openstack-keystone | 14:07 | |
| *** lhcheng has joined #openstack-keystone | 14:09 | |
| *** ChanServ sets mode: +v lhcheng | 14:09 | |
| *** lhcheng has quit IRC | 14:14 | |
| amakarov | bknudson, as I can see pbr change protects nothing | 14:15 |
| amakarov | and mine does exactly what you said: caches application | 14:15 |
| bknudson | if you could make the fix in pbr then everybody that uses it will get the fix. | 14:16 |
| amakarov | with respect to the naming (main and admin are separate) | 14:16 |
| bknudson | rather than just keystone | 14:16 |
| amakarov | bknudson, ah, see your point | 14:16 |
| bknudson | I think it's only keystone using the pbr support for now | 14:16 |
| *** shoutm has joined #openstack-keystone | 14:18 | |
| *** fhubik is now known as fhubik_brb | 14:19 | |
| amakarov | bknudson, https://review.openstack.org/#/c/217733/ | 14:27 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134124 | 14:28 |
| bknudson | amakarov: neat! | 14:28 |
| *** fangzhou has quit IRC | 14:30 | |
| amakarov | bknudson, I suppose PBR is used with devstack? | 14:30 |
| bknudson | amakarov: it's used when you do pip install -e /opt/stack/keystone | 14:30 |
| bknudson | if you want to try it out | 14:30 |
| *** browne has joined #openstack-keystone | 14:31 | |
| amakarov | bknudson, so we still need my change for keystone | 14:31 |
| amakarov | and now it'll be double protected :) | 14:32 |
| bknudson | amakarov: the pbr fix wouldn't take care of it? | 14:32 |
| *** fangzhou has joined #openstack-keystone | 14:32 | |
| amakarov | bknudson, if pip is the only way - yes | 14:33 |
| *** doug-fish has quit IRC | 14:36 | |
| bknudson | amakarov: pip is the way. | 14:36 |
| *** links has quit IRC | 14:37 | |
| *** doug-fish has joined #openstack-keystone | 14:37 | |
| bknudson | amakarov: we still have keystone.py ... I think it should be marked as deprecated. | 14:37 |
| bknudson | also, I think you should go back to making the change to keystone.py ... I wasn't sure if the pbr change would be accepted so I asked to have it moved down. | 14:39 |
| amakarov | bknudson, there was a change: main and admin app initialization functions added | 14:40 |
| *** csoukup has joined #openstack-keystone | 14:40 | |
| *** petertr7_away is now known as petertr7 | 14:40 | |
| amakarov | bknudson, I'll try to be careful ) | 14:41 |
| *** csoukup has quit IRC | 14:42 | |
| *** diazjf has joined #openstack-keystone | 14:42 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 14:42 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 14:42 |
| openstackgerrit | Nina Goradia proposed openstack/keystone: Correct docstrings in resource/core.py https://review.openstack.org/217400 | 14:44 |
| *** doug-fish has quit IRC | 14:46 | |
| *** fangzhou has quit IRC | 14:48 | |
| *** fhubik_brb is now known as fhubik | 14:49 | |
| *** fhubik has quit IRC | 14:49 | |
| amakarov | bknudson, if I move critical section to keystone.py, initialize_(admin|public)_application will be unprotected | 14:50 |
| amakarov | bknudson, ops, sorry - missed the order | 14:51 |
| *** dims has quit IRC | 14:51 | |
| *** dims has joined #openstack-keystone | 14:51 | |
| openstackgerrit | Olivier Pilotte proposed openstack/keystone-specs: Accepts Group IDs from the IdP without domain https://review.openstack.org/216308 | 14:52 |
| *** afazekas_ has joined #openstack-keystone | 14:54 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Protect WSGI application with a critical section https://review.openstack.org/210001 | 14:55 |
| amakarov | bknudson, ^^ | 14:55 |
| *** hrou has quit IRC | 14:57 | |
| *** tonytan4ever has joined #openstack-keystone | 14:58 | |
| *** petertr7 is now known as petertr7_away | 15:11 | |
| *** Fdaisuke has left #openstack-keystone | 15:13 | |
| *** Guest5469 is now known as brianl | 15:13 | |
| brianl | word up | 15:14 |
| lbragstad | brianl: o/ | 15:14 |
| brianl | sorry, lots of issues this morning :) | 15:14 |
| lbragstad | dolphm: ^ | 15:14 |
| *** petertr7_away is now known as petertr7 | 15:15 | |
| *** thedodd has joined #openstack-keystone | 15:15 | |
| *** HT_sergio has joined #openstack-keystone | 15:17 | |
| dstanek | brianl: that doesn't sound good | 15:17 |
| dstanek | amakarov: did you run into an issue or are you just trying to be careful? | 15:21 |
| dstanek | amakarov: the way i understood mod_wsgi is that it would call that callable in each thread so you don't need to protect it | 15:21 |
| *** exploreshaifali has quit IRC | 15:22 | |
| amakarov | dstanek, yes, under high load | 15:22 |
| *** links has joined #openstack-keystone | 15:22 | |
| *** urulama has quit IRC | 15:22 | |
| amakarov | dstanek, I've provided a link in the bug description - Apache required to protect it | 15:22 |
| amakarov | http://code.google.com/p/modwsgi/wiki/ProcessesAndThreading#Building_A_Portable_Application | 15:23 |
| *** urulama has joined #openstack-keystone | 15:23 | |
| dstanek | amakarov: so what does your critical section do? just prevent setup_backends from running in multple threads? | 15:24 |
| *** brianl is now known as blewis | 15:25 | |
| amakarov | dstanek, configure_region - to be more specific | 15:25 |
| dstanek | amakarov: why is this a load induced problem? it would seem to be that in a multi threaded Apache setup that we'd always see a failure | 15:27 |
| *** afazekas_ has quit IRC | 15:27 | |
| morgan | I dont think that spec means what this fix is assuming | 15:28 |
| morgan | What is "high load" btw in this context? | 15:29 |
| morgan | The assignment of application also happens at import time. Multiple threads should never be impacted. | 15:30 |
| morgan | S/assignment/binding | 15:30 |
| morgan | dstanek: ^ cc | 15:30 |
| morgan | amakarov: ^ cc | 15:30 |
| amakarov | dstanek, morgan we have to run it multi-threaded as memcache pool backend for tokens must be shared in order to reduce failover when one controller goes up/down | 15:30 |
| amakarov | morgan, "high load" is Rally test on 200 nodes env | 15:32 |
| morgan | Is this using memcache as a backend for storing tokens or for straight caching | 15:32 |
| morgan | What is the error you are seeing with rally? | 15:32 |
| dstanek | amakarov: what is the load per node? | 15:32 |
| amakarov | memcache pool token backend | 15:32 |
| morgan | amakarov: stop storing tokens in memcache | 15:32 |
| morgan | Seriously. Stop it. | 15:33 |
| morgan | That driver needs to die, it is usig the wrong tool for the job and causes a lot of associated issues. | 15:33 |
| *** henrynash has joined #openstack-keystone | 15:33 | |
| *** ChanServ sets mode: +v henrynash | 15:33 | |
| dstanek | morgan: maybe it should be deprecated this cycle | 15:34 |
| dstanek | amakarov: you'll have to give some steps to reproduce in the bug | 15:34 |
| morgan | dstanek: yeah probably | 15:34 |
| amakarov | morgan, this is our best solution now until we adopt Fernet | 15:34 |
| morgan | amakarov: sql is better even with its issues | 15:35 |
| morgan | Memcache is never a better choice | 15:35 |
| dstanek | amakarov: does it fail always in threaded mode? | 15:35 |
| *** afazekas_ has joined #openstack-keystone | 15:35 | |
| morgan | dstanek: lets deprecate memcache backend next cycle when we make fernet default | 15:36 |
| *** tellesnobrega has quit IRC | 15:36 | |
| dstanek | morgan: iirc, mod_wsgi is basically doing an eval in each thread and not importing this code - i can't find a reference to confirm or deny though | 15:36 |
| amakarov | dstanek, it's race condition - it does not :) But the problem was quite persistent. Searching our QA team report | 15:36 |
| morgan | dstanek: still should be isolated with an eval. | 15:37 |
| morgan | But regardless the locking there wont do us much good | 15:37 |
| *** tellesnobrega has joined #openstack-keystone | 15:37 | |
| morgan | Look at my comment | 15:37 |
| *** henrynash has quit IRC | 15:37 | |
| morgan | We are moving to pbr generated wsgi-app files | 15:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Update endpoint filter documentation https://review.openstack.org/211681 | 15:38 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Improve endpoint filtering docs https://review.openstack.org/208660 | 15:38 |
| morgan | Also locking at the top level like that worries me that we have other oversights | 15:38 |
| dstanek | amakarov: so no load induced at all. if the app starts up in such a way that multiple threads and setting up the cache at the same time it fails. | 15:38 |
| morgan | That looks like a poor bandaid | 15:38 |
| amakarov | dstanek, here is from the modwsgi doc: 2. Access to and modification of shared data in an external data store must be protected so as to prevent multiple threads in the same or different processes from interfering with each other. This would normally be achieved through a locking mechanism visible to all child processes. | 15:39 |
| amakarov | 4. Where global data in a module local to a child process is still used, for example as a cache, access to and modification of the global data must be protected by local thread locking mechanisms. | 15:39 |
| dstanek | amakarov: i am not saying you are wrong | 15:40 |
| dstanek | morgan: this is why decorators suck and i hate them | 15:40 |
| morgan | dstanek: this isnt really a decorator issue | 15:40 |
| dstanek | amakarov: the critical section should be around the cache initialization | 15:40 |
| *** jlk has left #openstack-keystone | 15:41 | |
| morgan | This is the kvs interface for the token backend issue | 15:41 |
| dstanek | amakarov: what i am saying is that this has nothing to do with high load other than your may be recycling threads more often | 15:41 |
| amakarov | dstanek, we'll end up with application re-initialized several times | 15:41 |
| amakarov | dstanek, even in the middle of some request handling | 15:41 |
| dstanek | amakarov: yes, i know | 15:42 |
| dstanek | amakarov: see my comments above | 15:42 |
| amakarov | dstanek, ah. I'm ebout what to protect | 15:42 |
| amakarov | s/ebout/about/ | 15:42 |
| *** shoutm has quit IRC | 15:43 | |
| dstanek | amakarov: move the protection higher up like bknudson suggested | 15:44 |
| dstanek | morgan: it sort of is a decorator issue. dogpile.cache is designed around global regions and that is the issue | 15:44 |
| morgan | It isnt dogpile.cache in this case really | 15:45 |
| amakarov | dstanek, thought I've done it | 15:45 |
| morgan | Sure that is impacted too. Somewhat | 15:45 |
| amakarov | dstanek, what do you mean as "higher up" ? | 15:45 |
| morgan | But this is the kvs interface - which isnt driven by decorators | 15:45 |
| morgan | amakarov: protect the cache initialization | 15:45 |
| dstanek | amakarov: not in keystone/http.py - closer to the thing that needs the locking | 15:45 |
| morgan | Not the wsgi app | 15:45 |
| dstanek | morgan: ++ | 15:46 |
| morgan | And we need to protect it in 2-3 places | 15:46 |
| morgan | Iirc | 15:46 |
| dstanek | this, right now, is like an uber level diaper pattern | 15:46 |
| morgan | In common.cache and common.kvs | 15:46 |
| amakarov | dstanek, morgan: so are we ok, that application is re-created for every thread> | 15:46 |
| amakarov | ? | 15:46 |
| morgan | amakarov: it shouldnt matter. | 15:46 |
| *** vivekd has joined #openstack-keystone | 15:47 | |
| dstanek | morgan: application is really just a function | 15:47 |
| dstanek | amakarov: ^ | 15:47 |
| morgan | ++ | 15:47 |
| dstanek | it's the initialization that happens that we may need to protect | 15:47 |
| amakarov | dstanek, application is the object returned by the function | 15:48 |
| amakarov | dstanek, found this bug description (it's from fuel) https://bugs.launchpad.net/fuel/+bug/1457037 | 15:48 |
| openstack | Launchpad bug 1457037 in Fuel for OpenStack 7.0.x "Keystone client is not available. Please, refer to OpenStack logs to fix this problem" [Critical,Fix released] - Assigned to Boris Bobrov (bbobrov) | 15:48 |
| morgan | If this is being done via eval like dstanek says. Your locking doesnt help much | 15:48 |
| morgan | In preventing the recreate | 15:49 |
| dstanek | morgan: did you find a doc or looking through code? | 15:49 |
| morgan | It is putting a bandaid in a place that solves the issue but is not surgical | 15:49 |
| morgan | dstanek: going by your assertion | 15:49 |
| morgan | dstanek: havent looked at mod_wsgi code | 15:49 |
| dstanek | morgan: ah, the 'if' didn't register | 15:50 |
| morgan | This is another reason i want to move to uwsgi | 15:50 |
| amakarov | bknudson, cc ^ | 15:50 |
| dstanek | amakarov: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/server/wsgi.py#n46 | 15:50 |
| *** afazekas_ has quit IRC | 15:50 | |
| amakarov | morgan, uwsgi is cool, but how shall we use mods for oauth, openid and shibboleth? | 15:51 |
| morgan | amakarov: apache still runs in front | 15:51 |
| dstanek | amakarov: apache | 15:51 |
| morgan | Uwsgi just manages keystone app | 15:51 |
| morgan | Mod_proxy_uwsgi | 15:51 |
| morgan | Also makes it easier for folks to use nginx | 15:51 |
| amakarov | morgan, why not gunicorn then? - It's more pythonic than uwsgi :) | 15:52 |
| morgan | amakarov: uwsgi is my personal choice. But moving to uwsgi wouldnt prevent someone from using gunicorn. Uwsgi is better architected in a purely personally subjective view | 15:53 |
| morgan | I also like that i can use a unix socket and speak uwsgi protocol vs needing a full tcp stack | 15:53 |
| morgan | And/or do raw http termination | 15:54 |
| morgan | Also uwsgi iirc plays better with individual venvs even is uwsgi is installed at the system level | 15:55 |
| amakarov | morgan, btw, our QA complained that keystone with mod_wsgi have some problems with graceful restart (sleep is needed) | 15:55 |
| morgan | Look at devstack. Known issue with apache and mod_wsgi | 15:55 |
| morgan | That is solved with uwsgi/unicorn | 15:55 |
| amakarov | morgan, +1 | 15:55 |
| morgan | Another reason i want to move our recommendation | 15:56 |
| *** gustavo has joined #openstack-keystone | 15:58 | |
| amakarov | dstanek, will protecting setup_backends be enough? | 16:00 |
| *** jasonsb has quit IRC | 16:00 | |
| *** doug-fish has joined #openstack-keystone | 16:01 | |
| *** jasonsb has joined #openstack-keystone | 16:01 | |
| *** pnavarro has quit IRC | 16:03 | |
| *** bknudson has quit IRC | 16:03 | |
| *** henrynash has joined #openstack-keystone | 16:04 | |
| *** ChanServ sets mode: +v henrynash | 16:04 | |
| *** jasonsb has quit IRC | 16:05 | |
| gustavo | Hi guys. I have a Swift cluster with swauth as authentication middleware and I would like to migrate to Keystone, but I need to configure the endpoint URL using tenant_name instead of tenant_id as a substitution keyword. Is it posible ? Example: http://storage-endpoint:8080/v1/AUTH_%(tenant_name)s | 16:06 |
| samueldmq | dstanek, hey | 16:06 |
| samueldmq | dstanek, have you committed your ksclient Cache-Control changes ? | 16:06 |
| samueldmq | dstanek, I am preparing a demo | 16:07 |
| morgan | amakarov: maybe. Though you might have more luck just targeting the cache setups - again, i really want to isolate what we put locks around and address the specific issues not just throw locking around everything | 16:08 |
| *** afazekas_ has joined #openstack-keystone | 16:08 | |
| amakarov | morgan, got it | 16:08 |
| morgan | But at least load_backends is portable to the pbr generated app files | 16:08 |
| morgan | So it is better than in http/eystone.py | 16:09 |
| *** btully has joined #openstack-keystone | 16:10 | |
| *** mylu has joined #openstack-keystone | 16:11 | |
| *** mylu has quit IRC | 16:12 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Protect WSGI application with a critical section https://review.openstack.org/210001 | 16:13 |
| amakarov | morgan, dstanek ^^ | 16:13 |
| *** mylu has joined #openstack-keystone | 16:13 | |
| *** btully has quit IRC | 16:14 | |
| amakarov | wait... | 16:14 |
| openstackgerrit | Merged openstack/keystone: Refactor: rename Fernet's unscoped federated payload https://review.openstack.org/202190 | 16:14 |
| morgan | Hehe | 16:14 |
| *** doug-fish has quit IRC | 16:14 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Protect WSGI application with a critical section https://review.openstack.org/210001 | 16:15 |
| *** doug-fish has joined #openstack-keystone | 16:15 | |
| amakarov | morgan, :) | 16:15 |
| amakarov | done | 16:15 |
| morgan | amakarov: also make sure you look at the common.kvs initializer. You arent solving your issue with memcsche token driver | 16:15 |
| morgan | https://github.com/openstack/keystone/blob/master/keystone/common/kvs/core.py | 16:16 |
| morgan | You are only solving the legitimate cache layer which has next to nothing to do with keystone memcache token driver | 16:16 |
| *** bknudson has joined #openstack-keystone | 16:16 | |
| *** ChanServ sets mode: +v bknudson | 16:16 | |
| amakarov | morgan, I see... | 16:17 |
| openstackgerrit | Merged openstack/keystone: Refactor: Provider._rebuild_federated_info() https://review.openstack.org/208872 | 16:17 |
| morgan | And please let me know if the fix solves your issue. | 16:18 |
| morgan | Before we merge it | 16:18 |
| *** e0ne has quit IRC | 16:18 | |
| *** doug-fish has quit IRC | 16:19 | |
| *** woodster_ has joined #openstack-keystone | 16:20 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 16:21 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 16:22 |
| *** henrynash has quit IRC | 16:22 | |
| *** hrou has joined #openstack-keystone | 16:23 | |
| *** jistr has quit IRC | 16:24 | |
| *** jaosorior has quit IRC | 16:25 | |
| dstanek | morgan: dolphm: i'm thinking of marking https://bugs.launchpad.net/keystone/+bug/1462152 as wontfix - any objections? | 16:26 |
| openstack | Launchpad bug 1462152 in Keystone "python-memcache (and therefore) token memcache persistence driver does not support ipv6" [Wishlist,Triaged] | 16:26 |
| *** exploreshaifali has joined #openstack-keystone | 16:26 | |
| *** _cjones_ has joined #openstack-keystone | 16:26 | |
| morgan | Yep | 16:27 |
| morgan | Go for it | 16:27 |
| *** lhcheng has joined #openstack-keystone | 16:27 | |
| *** ChanServ sets mode: +v lhcheng | 16:27 | |
| *** marzif has joined #openstack-keystone | 16:27 | |
| *** afazekas_ has quit IRC | 16:27 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Protect WSGI application with a critical section https://review.openstack.org/210001 | 16:28 |
| *** claudiub has quit IRC | 16:29 | |
| *** spandhe has joined #openstack-keystone | 16:32 | |
| *** spandhe has quit IRC | 16:32 | |
| *** urulama has quit IRC | 16:36 | |
| *** doug-fish has joined #openstack-keystone | 16:36 | |
| *** merimus has joined #openstack-keystone | 16:37 | |
| *** urulama has joined #openstack-keystone | 16:37 | |
| merimus | is it possible ot use keystone as a user database ala ldap? Is there a nss module for it? | 16:38 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Protect initialization with critical sections https://review.openstack.org/210001 | 16:39 |
| *** doug-fis_ has joined #openstack-keystone | 16:39 | |
| *** boris-42 has joined #openstack-keystone | 16:39 | |
| *** fangzhou has joined #openstack-keystone | 16:40 | |
| *** doug-fish has quit IRC | 16:41 | |
| *** roxanaghe has joined #openstack-keystone | 16:42 | |
| *** mpmsimo has quit IRC | 16:43 | |
| htruta | hey morgan, is this a good day for a workflow? :D | 16:44 |
| *** links has quit IRC | 16:45 | |
| *** petertr7 is now known as petertr7_away | 16:46 | |
| *** browne has quit IRC | 16:47 | |
| *** browne has joined #openstack-keystone | 16:47 | |
| *** petertr7_away is now known as petertr7 | 16:48 | |
| *** arunkant_ has joined #openstack-keystone | 16:49 | |
| *** EinstCrazy has joined #openstack-keystone | 16:51 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystonemiddleware: Centralized Policy Fetch and Cache https://review.openstack.org/188561 | 16:51 |
| *** browne has quit IRC | 16:51 | |
| *** afazekas_ has joined #openstack-keystone | 16:52 | |
| *** browne has joined #openstack-keystone | 16:54 | |
| samueldmq | dstanek's patch : "WIP: WIPier and most WIPs - ..." | 16:55 |
| samueldmq | hehe | 16:55 |
| *** marzif has quit IRC | 16:55 | |
| *** harlowja has joined #openstack-keystone | 16:55 | |
| dstanek | samueldmq: did you find this? https://review.openstack.org/#/c/211396/ | 16:56 |
| samueldmq | dstanek, yeah found it in this exact moment | 16:56 |
| samueldmq | :) | 16:56 |
| samueldmq | dstanek, gonna add it to my ksclient in devstack and see what happens | 16:56 |
| dstanek | samueldmq: if it catches on fire it's not my fault | 16:57 |
| *** aix has quit IRC | 16:58 | |
| samueldmq | dstanek, hehe are you expecting something to go wrong already? | 16:58 |
| samueldmq | dstanek, I remember you mentioning something about the X-Vary needed to be updated | 16:59 |
| samueldmq | or something like that | 16:59 |
| dstanek | samueldmq: https://review.openstack.org/#/c/211693/ | 16:59 |
| dstanek | samueldmq: it's software and software is always broken | 17:00 |
| samueldmq | dstanek, I can't look at that | 17:00 |
| samueldmq | dstanek, it's said: "please don't review me" | 17:00 |
| samueldmq | dstanek, ehhe | 17:00 |
| samueldmq | dstanek, what would be the effect of having X-Auth-TOken inside X-Vary | 17:03 |
| samueldmq | dstanek, the client wouldn't respect the given max-age at all? | 17:03 |
| *** Guest22530 has quit IRC | 17:04 | |
| *** doug-fis_ has quit IRC | 17:04 | |
| *** doug-fish has joined #openstack-keystone | 17:04 | |
| *** doug-fish has quit IRC | 17:04 | |
| *** doug-fish has joined #openstack-keystone | 17:05 | |
| dstanek | samueldmq: when something goes to cache it uses the URL and the values of the headers that are pointed to by Vary | 17:06 |
| dstanek | samueldmq: to hitting the same URL with two different tokens (assuming Vary: X-Auth-Token) would result in two responses being cached | 17:06 |
| *** merimus has quit IRC | 17:06 | |
| dstanek | the Vary header points to headers in the request and not the response | 17:07 |
| *** henrynash has joined #openstack-keystone | 17:07 | |
| *** ChanServ sets mode: +v henrynash | 17:07 | |
| *** afazekas_ has quit IRC | 17:07 | |
| *** jasonsb has joined #openstack-keystone | 17:08 | |
| samueldmq | dstanek, ++ thanks | 17:08 |
| *** topol has joined #openstack-keystone | 17:08 | |
| *** ChanServ sets mode: +v topol | 17:08 | |
| *** afazekas_ has joined #openstack-keystone | 17:09 | |
| *** petertr7 is now known as petertr7_away | 17:11 | |
| *** henrynash has quit IRC | 17:11 | |
| *** doug-fish has quit IRC | 17:14 | |
| *** doug-fish has joined #openstack-keystone | 17:14 | |
| *** afazekas_ has quit IRC | 17:15 | |
| *** afazekas_ has joined #openstack-keystone | 17:27 | |
| *** urulama has quit IRC | 17:30 | |
| *** urulama has joined #openstack-keystone | 17:31 | |
| *** browne has quit IRC | 17:33 | |
| gustavo | Hi guys. I have a Swift cluster with swauth as authentication middleware and I would like to migrate to Keystone, but I need to configure the endpoint URL using tenant_name instead of tenant_id as a substitution keyword. Is it posible ? Example: http://storage-endpoint:8080/v1/AUTH_%(tenant_name)s | 17:37 |
| *** roxanaghe has quit IRC | 17:37 | |
| *** mpmsimo has joined #openstack-keystone | 17:38 | |
| *** ankita_wagh has joined #openstack-keystone | 17:41 | |
| openstackgerrit | Merged openstack/keystoneauth-saml2: Remove translation https://review.openstack.org/212964 | 17:41 |
| *** samleon has joined #openstack-keystone | 17:42 | |
| *** e0ne has joined #openstack-keystone | 17:45 | |
| *** roxanaghe has joined #openstack-keystone | 17:48 | |
| *** afazekas_ has quit IRC | 17:48 | |
| *** exploreshaifali has quit IRC | 17:48 | |
| *** EinstCrazy has quit IRC | 17:48 | |
| krotscheck | morgan: Remember that conversation about CORS the other day? The dependencies finally went in and cleared gate -> https://review.openstack.org/#/c/216387/ | 17:51 |
| *** topol has quit IRC | 17:55 | |
| morgan | Yay! | 17:55 |
| morgan | Please dont update the sample config (i mean you can) but we have an auto proposal to do that for us | 17:56 |
| morgan | I'll take a look shortly at it for you other than that. | 17:56 |
| *** btully has joined #openstack-keystone | 17:57 | |
| *** topol has joined #openstack-keystone | 17:58 | |
| *** ChanServ sets mode: +v topol | 17:58 | |
| mtreinish | morgan: fwiw, we recently moved it to be autogenerated and put in the docs for tempest: http://docs.openstack.org/developer/tempest/sampleconf.html | 18:01 |
| *** btully has quit IRC | 18:02 | |
| mtreinish | then we don't have to worry about an autoproposal bot or things getting out sync | 18:02 |
| mtreinish | morgan: there's even an oslo.config sphinx extension to do it now | 18:02 |
| *** topol has quit IRC | 18:02 | |
| *** Kennan has quit IRC | 18:03 | |
| *** tonytan4ever has quit IRC | 18:03 | |
| *** Kennan has joined #openstack-keystone | 18:03 | |
| morgan | mtreinish: we have been asked for the config to stay in tree for now. But.. Sure thst is also an option :) | 18:05 |
| mtreinish | morgan: yeah, we also added the sample generation to tempest init when you setup a local working dir to try and mitigate that | 18:06 |
| mtreinish | figured in the docs + autogenerated when you setup tempest ~= in tree sample | 18:07 |
| morgan | It was an operator ask to have it in git | 18:07 |
| morgan | Not just generated | 18:07 |
| bknudson | I | 18:07 |
| bknudson | I'd be happy with developer docs | 18:07 |
| mtreinish | that's roughly equal not not equal (forgot != isn't the only way to do that) | 18:07 |
| morgan | I'd be happy to see it in both places, then the in-git one being less relevant/evnetually disappearing | 18:07 |
| bknudson | I don't think I'd want it only in a separate doc | 18:08 |
| bknudson | that should be easy enough. | 18:08 |
| morgan | mtreinish: at least you didnt do =~ (perl regex match) | 18:08 |
| bknudson | mtreinish: do you know what change in tempest was made to generate the sample conf? | 18:09 |
| mtreinish | bknudson: yes, I do since I did the most recent couple of revs, one sec | 18:10 |
| mtreinish | bknudson: https://review.openstack.org/216438 | 18:10 |
| mtreinish | that's switching tempest to use the oslo.config module dhellmann and I made based on what I did in tempest | 18:10 |
| bknudson | mtreinish: I also found this: https://review.openstack.org/#/c/207612/ | 18:11 |
| bknudson | I should just go over and talk to mrodden. | 18:11 |
| *** dikonoor has quit IRC | 18:11 | |
| mtreinish | bknudson: yeah that was the first draft of doing it, had some issues because it broke the interface contract for generating docs | 18:11 |
| mtreinish | because it required things to be manually run before running sphinx | 18:11 |
| mtreinish | which is where the oslo.config sphinx ext comes in | 18:12 |
| mtreinish | bknudson: oh, right you sit near mrodden, just poke him | 18:12 |
| mtreinish | he knows all the gory details | 18:12 |
| bapalm | mrodden is out today | 18:12 |
| *** telemonster is now known as group | 18:19 | |
| *** group is now known as telemonster | 18:20 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: MappingNotFound should be a UnexpectedError https://review.openstack.org/217835 | 18:21 |
| *** spandhe has joined #openstack-keystone | 18:29 | |
| *** petertr7_away is now known as petertr7 | 18:33 | |
| *** browne has joined #openstack-keystone | 18:35 | |
| *** tonytan4ever has joined #openstack-keystone | 18:35 | |
| *** exploreshaifali has joined #openstack-keystone | 18:40 | |
| *** andreaf has quit IRC | 18:41 | |
| *** andreaf has joined #openstack-keystone | 18:42 | |
| *** csoukup has joined #openstack-keystone | 18:50 | |
| *** pnavarro has joined #openstack-keystone | 18:51 | |
| *** e0ne has quit IRC | 18:53 | |
| *** ankita_wagh has quit IRC | 18:54 | |
| *** mylu has quit IRC | 18:54 | |
| *** mylu has joined #openstack-keystone | 18:55 | |
| *** topol has joined #openstack-keystone | 18:58 | |
| *** ChanServ sets mode: +v topol | 18:58 | |
| *** topol has quit IRC | 19:03 | |
| *** mylu has quit IRC | 19:03 | |
| *** mylu has joined #openstack-keystone | 19:04 | |
| *** henrynash has joined #openstack-keystone | 19:05 | |
| *** ChanServ sets mode: +v henrynash | 19:05 | |
| *** mylu_ has joined #openstack-keystone | 19:05 | |
| *** mylu has quit IRC | 19:06 | |
| *** henrynash has quit IRC | 19:08 | |
| *** vivekd has quit IRC | 19:08 | |
| *** btully has joined #openstack-keystone | 19:09 | |
| *** aix has joined #openstack-keystone | 19:11 | |
| *** Guest85823 has joined #openstack-keystone | 19:11 | |
| *** btully has quit IRC | 19:14 | |
| *** Guest85823 has quit IRC | 19:16 | |
| *** pauloewerton has joined #openstack-keystone | 19:24 | |
| *** mylu_ has quit IRC | 19:33 | |
| *** mylu has joined #openstack-keystone | 19:33 | |
| *** e0ne has joined #openstack-keystone | 19:37 | |
| *** stevemar has joined #openstack-keystone | 19:43 | |
| *** ChanServ sets mode: +v stevemar | 19:43 | |
| *** tqtran_ has joined #openstack-keystone | 19:45 | |
| *** fangzhou has quit IRC | 19:45 | |
| *** nicodemos has quit IRC | 19:48 | |
| *** roxanaghe has quit IRC | 19:48 | |
| *** nicodemos has joined #openstack-keystone | 19:49 | |
| stevemar | dstanek: poke | 19:50 |
| stevemar | dolphm: also poke | 19:50 |
| dstanek | ouch | 19:50 |
| stevemar | dstanek: :) | 19:50 |
| *** roxanaghe has joined #openstack-keystone | 19:51 | |
| stevemar | dstanek: anything in particular you did to mentally grasp: https://review.openstack.org/#/c/149178/45/keystone/tests/unit/test_backend.py | 19:51 |
| dolphm | stevemar: stab | 19:51 |
| stevemar | i'm not a big fan of the approach, but it's test code | 19:51 |
| stevemar | dolphm: are you going to be in austin soon? | 19:52 |
| dolphm | stevemar: stanek is coming into town on sunday | 19:52 |
| stevemar | dolphm: nice | 19:52 |
| stevemar | i'm here til the 5th | 19:52 |
| bknudson | IdentityTests(AssignmentTestHelperMixin) | 19:52 |
| bknudson | why does IdentityTest have AssignmentTest mixin? | 19:52 |
| stevemar | bknudson: to create setup data | 19:53 |
| stevemar | looks like that anyway | 19:53 |
| dstanek | stevemar: nothing particular. i started with the tests to get a feel for how the data vs. code looks and then dug into impl | 19:53 |
| dstanek | stevemar: why not a fan? | 19:53 |
| stevemar | the use of indexes seems weird | 19:54 |
| dstanek | bknudson: stevemar: yes, for the assignment setup | 19:54 |
| bknudson | shouldn't that be AssignmentTests need the mixin? | 19:54 |
| dstanek | stevemar: yeah, but it makes sense because all you know if the order of the data and no the ids for reference | 19:55 |
| dstanek | bknudson: i haven't gone through all of the reviews yes, but he does use the data infrastructure quite a bit more | 19:55 |
| *** mylu has quit IRC | 19:55 | |
| *** gustavo has quit IRC | 19:55 | |
| *** mylu has joined #openstack-keystone | 19:56 | |
| bknudson | seems like we're just making tests that are too complicated already more complicated. | 19:57 |
| *** diazjf has quit IRC | 19:57 | |
| bknudson | when we should be working towards simplifying the test architecture | 19:57 |
| *** nicodemos has quit IRC | 19:58 | |
| bknudson | for example, assignment tests should be in an assignments test class rather than identity test class. | 19:58 |
| *** mylu has quit IRC | 20:01 | |
| *** diazjf has joined #openstack-keystone | 20:01 | |
| dolphm | stevemar: dstanek: lbragstad: doodle survey sent | 20:01 |
| *** thiagop_ has joined #openstack-keystone | 20:01 | |
| lbragstad | \o/ meat shoveling! | 20:05 |
| dstanek | tmi | 20:05 |
| *** jasonsb has quit IRC | 20:06 | |
| *** jasonsb has joined #openstack-keystone | 20:06 | |
| dstanek | i don't land on Sunday until 5:30 | 20:06 |
| dolphm | that's late if we're going to austin, or austin-ish | 20:06 |
| dolphm | it'd be 7 before you got there | 20:06 |
| dolphm | even to drippin' | 20:06 |
| *** doug-fish has quit IRC | 20:07 | |
| dolphm | stevemar: have a car? | 20:07 |
| stevemar | dolphm: yessir | 20:07 |
| *** doug-fish has joined #openstack-keystone | 20:07 | |
| dstanek | dolphm: also on Monday we have the 30 min meeting at 5pm | 20:08 |
| dolphm | dstanek: WE DO TOO! | 20:08 |
| dolphm | dstanek: oh that's the same meeting. | 20:09 |
| dstanek | lol | 20:09 |
| dolphm | dstanek: i thought you were stevemar, even after i ds<Tab-complete>'d you | 20:09 |
| *** tjcocozz has joined #openstack-keystone | 20:10 | |
| *** doug-fish has quit IRC | 20:12 | |
| morgan | bknudson: sure. | 20:13 |
| morgan | i don't like test "mixins" btw | 20:13 |
| *** e0ne has quit IRC | 20:13 | |
| morgan | i think they make testing harder to understand | 20:13 |
| lifeless | morgan: vs | 20:14 |
| lifeless | morgan: (like, whats your preferred pattern - parameterisation? composition? subclassing? | 20:14 |
| morgan | lifeless: in this case, sane breaking up of testcases into logical groupings. - composition where we can, but testcases tend to be subclassing | 20:14 |
| morgan | so i'd argue rather than using a "mixin" we should have a few sane classes that are structural but properly inherit from testcase | 20:15 |
| lifeless | morgan: we have enough facilities to avoid subclassing entirely in our environment, AFAIK. | 20:15 |
| morgan | and if a mixin is needed for testing, it is a sign we should have broken the tests up more logically | 20:15 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: MappingNotFound should be a UnexpectedError https://review.openstack.org/217835 | 20:15 |
| *** thiagop_ has quit IRC | 20:15 | |
| lifeless | morgan: that said, http://bugs.python.org/issue14534 - mixins are currently a necessary thing when using subclasses for parameterisation | 20:16 |
| lifeless | morgan: (which is why I'd say use testscenarios for parameterisation) | 20:16 |
| morgan | sure | 20:16 |
| lifeless | morgan: [because I agree with you - multiple inheritance is fundamentally harder to reason about) | 20:16 |
| morgan | in our cases our parameterization isn't why we have mixins.we have mixins because our previous architecture didn't allow us to do setup cleanly | 20:17 |
| morgan | and we never dug ourselves out of that (keystone specific) | 20:17 |
| lifeless | ack | 20:17 |
| morgan | and ++ on testscenarios | 20:18 |
| bknudson | we actually have lots of testcase mixins already | 20:20 |
| bknudson | tjat | 20:20 |
| bknudson | that's not what this is | 20:20 |
| bknudson | well, maybe it is... scenarios | 20:21 |
| *** thiagop_ has joined #openstack-keystone | 20:21 | |
| *** thiagop_ has quit IRC | 20:21 | |
| bknudson | I guess this is kind of neat but I wish it wasn't specific to assignments... we could use this for any test type | 20:22 |
| lifeless | bknudson: what 'it' do you refer to ? | 20:23 |
| bknudson | lifeless: https://review.openstack.org/#/c/149178/45/keystone/tests/unit/test_backend.py is the change under discussion | 20:24 |
| lifeless | ok, I meant in the sentence 'I wish it wasn't specific to assignments' | 20:24 |
| lifeless | ah | 20:24 |
| bknudson | y, the mixin is called AssignmentTest but it looks like it's somewhat generic. | 20:25 |
| lifeless | I'd be inclined to have it be a Fixture | 20:25 |
| bknudson | you can define a test_plan with entities and tests | 20:25 |
| lifeless | parameterised with the plan | 20:26 |
| dolphm | lbragstad: see the mention of tokens: https://mitakadesignsummit.sched.org/event/90e7afebccf16fcb30ab93f9b333afab | 20:26 |
| lifeless | it could expose a matcher trivially | 20:26 |
| lifeless | but also | 20:26 |
| lifeless | you could transform that to be a testscenarios scenarios list | 20:26 |
| lifeless | with a little thought. Mmmm, might have too much cross-linked state for that | 20:27 |
| lifeless | subtests aren't exposed in testtools yet, or I'd suggest that | 20:27 |
| bknudson | there is a lot of state in keystone unit tests :( | 20:27 |
| *** diazjf has quit IRC | 20:30 | |
| bknudson | don't dig into it too much or you'll have to gouge your eyes out. | 20:30 |
| bknudson | and we can't make the tests better, just pile more garbage on the garbage. | 20:30 |
| *** exploreshaifali has quit IRC | 20:30 | |
| *** markvoelker has quit IRC | 20:33 | |
| dstanek | morgan: lifeless: i like mixins when there are lots of tests that require several types of setup. | 20:34 |
| dstanek | bknudson: that's not entirely true. there has been lots of progress in making the tests not suck, but there are still too many bad thing to remove | 20:36 |
| morgan | dstanek: I would say we should be making a base test-case class and then subclassing correctly for the setup. the mixin is hard to follow :( | 20:36 |
| *** diazjf has joined #openstack-keystone | 20:36 | |
| dstanek | morgan: you have the make the tests subclass object so they don't run on their own | 20:37 |
| morgan | the fact we just dump tons of things all into the same test case(s) as giant uber tests, is where this pattern seems to stem from | 20:37 |
| morgan | dstanek: isn't that easily done with a _ prefix? | 20:37 |
| * morgan remembers something similar to that in the way the runner worked. | 20:37 | |
| *** dave-mccowan has quit IRC | 20:37 | |
| *** exploreshaifali has joined #openstack-keystone | 20:39 | |
| *** jasonsb has quit IRC | 20:43 | |
| dstanek | morgan: some of the test runners just find all subclasses of unittest.TestCase, not sure what testtools does exactly | 20:43 |
| morgan | we should check. | 20:44 |
| dstanek | morgan: that's what you would do for nose since if only cared about naming conventions | 20:44 |
| dstanek | morgan: doing that right now:-) | 20:44 |
| morgan | we could also just do a .setUp() calls .skip_test if ._initialized() isn't run | 20:44 |
| morgan | worst case | 20:44 |
| morgan | and just call .init() or something before super()ing up. | 20:45 |
| *** pnavarro has quit IRC | 20:45 | |
| *** exploreshaifali has quit IRC | 20:45 | |
| morgan | dstanek: lol I was just doing the same thing, but was slower at setting it up :P | 20:45 |
| * morgan lets you do it | 20:45 | |
| *** jasonsb has joined #openstack-keystone | 20:46 | |
| dstanek | morgan: naming the class with an _ doesn't help. the tests are still run | 20:46 |
| morgan | hm | 20:47 |
| *** samleon has quit IRC | 20:47 | |
| morgan | dstanek: http://testrepository.readthedocs.org/en/latest/MANUAL.html#hiding-tests | 20:47 |
| * dstanek just tried a class named __ for fun | 20:47 | |
| dstanek | morgan: how does tagging apply here? | 20:48 |
| bknudson | there's all sorts of handy features... http://testrepository.readthedocs.org/en/latest/MANUAL.html#automated-test-isolation-bisection | 20:48 |
| lifeless | morgan: no, I linked you the bug about this | 20:48 |
| lifeless | morgan: using subclasses to provide the parameters implies mixins | 20:49 |
| lifeless | morgan: its a unittest limitation today | 20:49 |
| *** fangzhou has joined #openstack-keystone | 20:49 | |
| morgan | bah, we could just do an explicit skipTest in .setUp | 20:49 |
| lifeless | sure, but remember you have to upcall always | 20:49 |
| lifeless | or else testtools will error the test | 20:50 |
| morgan | that is easy to detect if we are a subclass or the partent | 20:50 |
| * morgan has done this before. | 20:50 | |
| lifeless | k, sure | 20:50 |
| lifeless | anyhow, since i"m not offering to cut code here right now | 20:50 |
| morgan | and then the skip can go away once that thing is done :) | 20:50 |
| lifeless | all I can do is offer some options and get out of your way :) | 20:51 |
| morgan | oh sure! :) | 20:51 |
| dstanek | morgan: then you are inflating skips | 20:51 |
| morgan | and it is appreciated. | 20:51 |
| lifeless | for now -> PLANE | 20:51 |
| morgan | lifeless: safe travels | 20:51 |
| *** gyee has joined #openstack-keystone | 20:51 | |
| *** ChanServ sets mode: +v gyee | 20:51 | |
| morgan | dstanek: i care less about skips and more about runs. I'm ok if we never ever ever ever ever ever ever look at skips | 20:51 |
| morgan | dstanek: but we should track # of tests run | 20:51 |
| bknudson | I think we skip 1/4 tests already | 20:52 |
| *** claudiub|2 has joined #openstack-keystone | 20:52 | |
| * morgan finds skips with our current setup to be largely a useless number | 20:52 | |
| morgan | bknudson: yah | 20:52 |
| *** samleon has joined #openstack-keystone | 20:53 | |
| bknudson | just shows that our backend drivers aren't compatible | 20:53 |
| dstanek | morgan: so lets fix it, not make it more meaningless | 20:53 |
| dstanek | this is the pattern that i am used to: http://paste.openstack.org/show/430077/ | 20:54 |
| dstanek | shared setUp is basically a no-no | 20:54 |
| morgan | see that just makes me unhappy. | 20:54 |
| dstanek | morgan: i don't get why | 20:55 |
| dstanek | the alternative you are talking about is even harder to understand because it's not how the tooling works | 20:55 |
| morgan | dstanek: it's because of the way we initialize all the attributes on the test cases | 20:55 |
| morgan | if we moved our initialization of stuff into a shared thing so we can tell what attrributes are on the test cases it would make me happier | 20:56 |
| morgan | TestCase(object) | 20:56 |
| bknudson | we have a TestCase with a setUp, and then it calls methods overridden in the subclasses. | 20:56 |
| *** raildo is now known as raildo-afk | 20:56 | |
| morgan | doesn't have a ton of the stuff that basetest case setups | 20:56 |
| morgan | so it's really painful to follow | 20:56 |
| morgan | because setUp() in the base testcase adds all the self.identity_api etc | 20:57 |
| dstanek | bknudson: yeah, i truely hate that pattern because it causes use to do all sorts of dumb stuff | 20:57 |
| morgan | things | 20:57 |
| *** pnavarro has joined #openstack-keystone | 20:57 | |
| *** ankita_wagh has joined #openstack-keystone | 20:57 | |
| bknudson | we do all sorts of dumb stuff because we're too lazy to refactor | 20:57 |
| dstanek | in some subclass you have to load_backends *before* super().setUp and in some cases *after* | 20:58 |
| morgan | dstanek: that I'm trying to fix. | 20:58 |
| dstanek | and the only way to know is to do it wrong and try again | 20:58 |
| morgan | dstanek: once i fix the load_fixtures one to not be called 4000000 places | 20:58 |
| morgan | then load backends is next | 20:58 |
| morgan | call it once. | 20:58 |
| morgan | never more than once | 20:58 |
| bknudson | somehow the keystone server is able to get by calling load_backends only once. | 20:59 |
| bknudson | tests should be able to also | 20:59 |
| morgan | bknudson: the reason we do it in tests is because we call it on .setUP, then the test modifies config | 20:59 |
| morgan | then needs to reload | 20:59 |
| dstanek | bknudson: it's not changing its configuration are runtime a few hundred times | 20:59 |
| morgan | i'm working on solving that | 20:59 |
| bknudson | oops! | 21:00 |
| morgan | i've isolated a chunk of those already, next is fix load_fixtures to only be callable once | 21:00 |
| morgan | then load_backends | 21:00 |
| morgan | i've already made .reload_backends go away | 21:00 |
| morgan | (thankfully) | 21:00 |
| bknudson | add a check to the base test case to ensure load_backends is only called once | 21:00 |
| morgan | bknudson: yep | 21:00 |
| morgan | will be doing that | 21:00 |
| morgan | same as I did for .config_overrides | 21:00 |
| bknudson | nice | 21:00 |
| morgan | :) | 21:00 |
| morgan | the real culprit for all this uglyness is the ldap tests | 21:01 |
| *** henrynash has joined #openstack-keystone | 21:01 | |
| *** ChanServ sets mode: +v henrynash | 21:01 | |
| *** thedodd has quit IRC | 21:01 | |
| *** tsymanczyk has quit IRC | 21:01 | |
| morgan | and the root of all this is to make it so we can isolate the ldap tests in a way to not need a clean reset midway through a test cases | 21:02 |
| morgan | which will then open the door to allow us to not need a "clean" db every test case (functional testing!) | 21:02 |
| *** thiagop has quit IRC | 21:04 | |
| dstanek | uuuugggg.... that reminds me i have to finish up that commit for the stable driver interfaces | 21:06 |
| lbragstad | dolphm: re: https://mitakadesignsummit.sched.org/event/90e7afebccf16fcb30ab93f9b333afab#.Vd97Y9NVhBc didn't we already do that? | 21:07 |
| *** pauloewerton has quit IRC | 21:08 | |
| morgan | lbragstad: somewhat, but it also doesn't hurt to hear what else people have done :) | 21:08 |
| lbragstad | morgan: ++, so they *are* using PKIZ? | 21:09 |
| morgan | yeah looks like | 21:09 |
| lbragstad | morgan: cool, looks like I'm going to that one | 21:09 |
| morgan | I totally plan to be at that one | 21:09 |
| * lbragstad loves trolling the list of summit talks | 21:09 | |
| *** petertr7 is now known as petertr7_away | 21:09 | |
| dolphm | lbragstad: switch to UUID! | 21:10 |
| morgan | dolphm: UDID? wait i didn't think keystone was used on iOS or android >.> | 21:10 |
| * morgan goes back under the rock. | 21:10 | |
| morgan | it's too warm out ... I feel loopy today | 21:10 |
| dolphm | morgan: two factor, yo | 21:11 |
| *** tsymanczyk has joined #openstack-keystone | 21:12 | |
| tonytan4ever | Hi keystone folks, any boday can help me with an V3 authenticate issue? | 21:12 |
| *** tsymanczyk is now known as Guest74351 | 21:12 | |
| tonytan4ever | I am trying to post something to <my_keystone_server>/v3/auth/tokens | 21:13 |
| tonytan4ever | And response I got is this: | 21:13 |
| *** ankita_w_ has joined #openstack-keystone | 21:13 | |
| tonytan4ever | { | 21:13 |
| tonytan4ever | "error": { | 21:13 |
| tonytan4ever | "message": "The request you have made requires authentication.", | 21:13 |
| tonytan4ever | "code": 401, | 21:13 |
| tonytan4ever | "title": "Unauthorized" | 21:13 |
| tonytan4ever | } | 21:13 |
| tonytan4ever | } | 21:13 |
| tonytan4ever | The post body I am using is: | 21:13 |
| lbragstad | tonytan4ever: would you be able toput that in paste? | 21:13 |
| lbragstad | tonytan4ever: http://pasteraw.com | 21:13 |
| tonytan4ever | Sure | 21:14 |
| lbragstad | tonytan4ever: thank you :) | 21:14 |
| tonytan4ever | This is the post body: http://cdn.pasteraw.com/iftsn6r5l5rba9zo3s9iq2urea5azc9 | 21:14 |
| tonytan4ever | And this is the response I got: http://cdn.pasteraw.com/jqookcxcgfaxc2qyi01uhjjuyyr4wlb | 21:15 |
| tonytan4ever | Wonder I missed anything there. | 21:15 |
| openstackgerrit | Merged openstack/keystone: Enforce .config_overrides is called exactly once https://review.openstack.org/216892 | 21:15 |
| *** ankita_wagh has quit IRC | 21:16 | |
| morgan | is it a post to /auth/tokens? | 21:18 |
| * morgan checks quickly | 21:18 | |
| morgan | that doesn't look right | 21:18 |
| tonytan4ever | Yes | 21:18 |
| *** urulama has quit IRC | 21:18 | |
| morgan | oh i guess it is | 21:18 |
| morgan | i've been looking at other bits so much i haven't done curl stuff lately | 21:18 |
| *** urulama has joined #openstack-keystone | 21:18 | |
| morgan | or post that is. | 21:19 |
| *** henrynash has quit IRC | 21:21 | |
| morgan | tonytan4ever: hm. | 21:21 |
| tonytan4ever | Anything wrong I did there ? | 21:21 |
| tonytan4ever | morgan: ? | 21:21 |
| morgan | that looks well formed | 21:21 |
| lbragstad | tonytan4ever: can you verify that your user has a role on the default domain? | 21:21 |
| morgan | what are you using to post the data? curl? | 21:21 |
| dstanek | tonytan4ever: do you have access to the server logs to see if there is a hint there? | 21:22 |
| tonytan4ever | Postman | 21:22 |
| tonytan4ever | I am testing on a local docker keystone server. | 21:22 |
| morgan | the post body looks sane fwiw | 21:23 |
| morgan | but if somehow you're issuing a GET instead, that would be an error I would expect | 21:23 |
| lbragstad | tonytan4ever: see if you can get an unscoped token. http://cdn.pasteraw.com/epapqo0bjof10j34d6t0gdrv0fpozu | 21:23 |
| morgan | lbragstad: that wont work | 21:23 |
| dstanek | tonytan4ever: yeah, what does your curl command look like? | 21:23 |
| morgan | lbragstad: auth via username | 21:23 |
| morgan | lbragstad: the domain_id is used to identify the user not the scope | 21:24 |
| morgan | there | 21:24 |
| lbragstad | http://cdn.pasteraw.com/39ect846c5x4kl4rlclk89ev5k2goz9 | 21:24 |
| morgan | domain is in the user{} block | 21:24 |
| lbragstad | yep, fixed | 21:24 |
| * morgan nods | 21:24 | |
| lbragstad | morgan: nice catch | 21:24 |
| morgan | lbragstad: ;) | 21:24 |
| morgan | lbragstad: i'm occasionally useful for something. | 21:24 |
| dstanek | tonytan4ever: also make sure the domain is enabled | 21:25 |
| tonytan4ever | OK | 21:25 |
| tonytan4ever | Let me try | 21:25 |
| morgan | dstanek: context switch - would you prefer to call .use_fixture in setUp() where appropriate or do a .use_fixtures like we do with config_overrides | 21:26 |
| tonytan4ever | This time gets an 500 Internal Error | 21:26 |
| tonytan4ever | Let me check the logs | 21:26 |
| morgan | dstanek: where it is overridden but it means we call the fixture use at the same point each time (not the load_fixture, but lke ldapdb) | 21:26 |
| morgan | tonytan4ever: yeah logs will help with that | 21:26 |
| dstanek | morgan: i'd rather use it explicitly in the setup so that we don't run into the same templating issues we have now | 21:27 |
| morgan | hm. ok some fixtures have to be used before we .super() up though. | 21:27 |
| dstanek | and for whatever reason it leads people to think they need to inherit for setup | 21:27 |
| morgan | a lot of the issue is we rely on .setup to populate data | 21:28 |
| morgan | so, if we didn't do that, a lot of these issues go away | 21:28 |
| *** tjcocozz has quit IRC | 21:28 | |
| morgan | since config has to be before we add data to the store | 21:29 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/216998 | 21:29 |
| dstanek | morgan: yeah, i started to break off tests that weren't using the backend or fixture data to directly use BaseTestCase and not have all that created on every run | 21:29 |
| morgan | dstanek: well we have a bigger issue | 21:30 |
| tonytan4ever | Got logs: http://cdn.pasteraw.com/hza9lt2dytfnpylkp1qz6b6kpl5v0du | 21:30 |
| tonytan4ever | And the post body I got is: | 21:30 |
| dstanek | ha, that doesn't surprise me! | 21:30 |
| *** pnavarro has quit IRC | 21:30 | |
| morgan | dstanek: when we load data it's based on .load_backends which is based on config | 21:30 |
| morgan | dstanek: so maybe we whittle this down to calling these in one place (templating issues known) | 21:30 |
| morgan | then start breaking it back up so we know what we're breaking out | 21:31 |
| morgan | it's more work, but it at least will be more consistent than today? | 21:31 |
| tonytan4ever | http://cdn.pasteraw.com/glfgpa1l1s4ze4n5y7u7w7yjlfl227d | 21:31 |
| tonytan4ever | This is the post body | 21:31 |
| morgan | dstanek: i'm asking since I don't want to do a ton of work if it's really a bad idea | 21:31 |
| morgan | tonytan4ever: you can't have domain: be a string | 21:32 |
| morgan | that should be a 400 not a 500 but that asign | 21:32 |
| morgan | aside | 21:32 |
| dstanek | morgan: that sounds like a good plan. i've been down many false paths trying to fix the tests | 21:32 |
| morgan | lbragstad: ^ our validator isn't doing it's job | 21:32 |
| dstanek | morgan: i'd find that what i really wanted to do was too insane for the current architecture | 21:32 |
| morgan | dstanek: ok I'll isolate .use_fixture to one place in our path. and then isolate the .load_fixtures | 21:33 |
| morgan | and .load_backends | 21:33 |
| morgan | and i think that'll put us in a happier place to unwind the other issues | 21:33 |
| morgan | and i'll make sure .use_fixtures is called only once (might cause slight up-tick in memory usage) | 21:33 |
| morgan | and same with .load_backends and .load_fixtures | 21:33 |
| dstanek | tonytan4ever: your example showed that domain was a dict. why did that change? | 21:34 |
| lbragstad | morgan: you mean for /auth and /token paths? | 21:34 |
| morgan | lbragstad: yeah see the 500 error when domain in the user block was a string | 21:34 |
| dstanek | morgan: i didn't think we had schema yet for auth | 21:34 |
| morgan | dstanek: ah we might not | 21:35 |
| lbragstad | morgan: we don't have a schema for auth | 21:35 |
| morgan | lbragstad: ahah we should fix that :) | 21:35 |
| dstanek | alright.... i need to walk away for a bit | 21:35 |
| tonytan4ever | dstanek: That's the previous one. Now I am getting 400 | 21:36 |
| tonytan4ever | http://cdn.pasteraw.com/mm894xdt9rwag9h0396z3qlsf0zi4p6 | 21:36 |
| lbragstad | morgan: we could introduce jsonschema validation on versionless auth? | 21:36 |
| morgan | lbragstad: yes | 21:36 |
| tonytan4ever | Post body and response are all in there. | 21:37 |
| morgan | lbragstad: 100% | 21:37 |
| tonytan4ever | Seems like I still need to put in domain in user dict | 21:37 |
| morgan | yep expected 400. you need to swithc to the user_id in that syntax | 21:37 |
| morgan | not the username | 21:37 |
| morgan | username is unique within a domain | 21:37 |
| lbragstad | morgan: we can mark that as a reason to do versionless auth instead of implementing two auth jsonschema validators, one for /auth and one for /token | 21:37 |
| morgan | lbragstad: ++ | 21:37 |
| tonytan4ever | so id: <username>, like this ? | 21:38 |
| morgan | id: <user_id> | 21:38 |
| morgan | the user_id would be a uuid if the user is in the SQL user db | 21:38 |
| tonytan4ever | Ok | 21:38 |
| tonytan4ever | This time goes back to 401 Unauthorized | 21:41 |
| tonytan4ever | http://cdn.pasteraw.com/jfulyesc4ejdou6jmgjmbaomwenw9al | 21:41 |
| *** ankita_wagh has joined #openstack-keystone | 21:44 | |
| *** HT_sergio has quit IRC | 21:44 | |
| tonytan4ever | Nevermind, I got the password wrong. Now I got it working now. | 21:45 |
| tonytan4ever | Thanks a lot guys | 21:45 |
| lbragstad | tonytan4ever: good deal, glad you got it | 21:46 |
| *** henrynash has joined #openstack-keystone | 21:47 | |
| *** ChanServ sets mode: +v henrynash | 21:47 | |
| *** ankita_w_ has quit IRC | 21:47 | |
| morgan | tonytan4ever: np! | 21:49 |
| *** doug-fish has joined #openstack-keystone | 21:50 | |
| *** diazjf has left #openstack-keystone | 21:52 | |
| *** doug-fish has quit IRC | 21:54 | |
| lbragstad | marekd: jamielennox o/ I'd value any feedback you all have on this guy when you have a minute - https://review.openstack.org/#/c/214766/ | 21:56 |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Added CORS support to Keystone https://review.openstack.org/216387 | 22:02 |
| openstackgerrit | Nina Goradia proposed openstack/keystone: Correct docstrings in resource/core.py https://review.openstack.org/217400 | 22:02 |
| *** Guest74351 is now known as tsymanczyk_ | 22:14 | |
| *** tsymanczyk_ is now known as Guest75495 | 22:14 | |
| *** Guest75495 has quit IRC | 22:14 | |
| *** tsymanczyk has joined #openstack-keystone | 22:16 | |
| *** hrou has quit IRC | 22:16 | |
| *** mpmsimo has quit IRC | 22:19 | |
| *** csoukup has quit IRC | 22:19 | |
| *** pgbridge has quit IRC | 22:20 | |
| morgan | dstanek: ping re flask stuff... | 22:20 |
| morgan | dstanek: or is it jamielennox at this point? | 22:20 |
| * morgan is wants to see if we can get flask happily in liberty | 22:20 | |
| morgan | if possible | 22:20 |
| *** zzzeek has quit IRC | 22:26 | |
| *** bknudson has quit IRC | 22:26 | |
| *** btully has joined #openstack-keystone | 22:26 | |
| *** gordc has quit IRC | 22:27 | |
| *** btully has quit IRC | 22:30 | |
| *** tonytan4ever has quit IRC | 22:36 | |
| *** Ephur has quit IRC | 22:36 | |
| dstanek | morgan: yes, i've been working on getting it shaped up | 22:39 |
| morgan | dstanek: cool | 22:39 |
| morgan | :) | 22:39 |
| morgan | just checking in | 22:39 |
| morgan | let me know if i can do anything to help | 22:39 |
| dstanek | i'll let you know when i have more patches that need merged. if i get 2 or 3 queued up for a given branch i move on temporarily to another branch | 22:41 |
| *** samleon has quit IRC | 22:42 | |
| *** samleon has joined #openstack-keystone | 22:43 | |
| *** stevemar has quit IRC | 22:50 | |
| *** edmondsw has quit IRC | 22:51 | |
| *** henrynash has quit IRC | 23:02 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:02 | |
| *** claudiub|2 has quit IRC | 23:09 | |
| *** shoutm has joined #openstack-keystone | 23:12 | |
| *** dims_ has joined #openstack-keystone | 23:18 | |
| jamielennox | morgan: do we want this yet: https://review.openstack.org/#/c/217806/ ? | 23:19 |
| morgan | no. i want a 1.x before it hits g-r (feel free to disagree with me) | 23:20 |
| *** arunkant_ has quit IRC | 23:20 | |
| morgan | jamielennox: the 0.4.0 was so we can do a last pass before cutting 1.x incase we still have a "OMG THIS IS BROKEN" moment | 23:21 |
| morgan | but i don't see that being super likely | 23:21 |
| jamielennox | morgan: that was my understanding, i don't mind if we have it in g-r as i don't think anyone will pick it up | 23:21 |
| jamielennox | i just saw it and was surprised | 23:21 |
| jamielennox | i think SDK wants to do some proper testing with ti | 23:22 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/214509 | 23:22 |
| *** dims has quit IRC | 23:22 | |
| morgan | i think if we let 0.4.0 hit g-r we are going to be very stuck with it in the pre-1.0 form | 23:22 |
| jamielennox | morgan: i don't mind | 23:22 |
| jamielennox | sounds ok to me | 23:22 |
| morgan | so, i'll defer to you here. do we want 0.4.0 in g-r? | 23:23 |
| morgan | or should we do one last pass with the ksc integration branch | 23:24 |
| morgan | and then go 1.0 if nothing is out of whack | 23:24 |
| morgan | because before it goes in g-r i want to remove the "WARNING THE APIs ARE GOING TO CHANGE" | 23:24 |
| morgan | line | 23:24 |
| morgan | from the readme | 23:24 |
| jamielennox | morgan: the ksc-integration branch is somewhat useless at this point anyway | 23:24 |
| jamielennox | because we are breaking APIs | 23:25 |
| jamielennox | i'm happy to wait till 1.0 | 23:25 |
| jamielennox | SDK can get a requirements exception like the integration branch did | 23:25 |
| morgan | ok. how far from 1.0 do you think we are? I think maybe a couple minor patches. | 23:25 |
| morgan | ? | 23:25 |
| jamielennox | i need to fix up https://review.openstack.org/#/c/216512/ | 23:26 |
| jamielennox | umm | 23:26 |
| jamielennox | and i still feel a little funny about the session loading stuff | 23:26 |
| jamielennox | but i don't have any other plans | 23:26 |
| morgan | i thought we were going to hide session loading | 23:27 |
| morgan | so we could use internally but not expose it | 23:27 |
| jamielennox | morgan: we need to provide something like session loading for CLIs and CONF | 23:28 |
| jamielennox | i moved it under loading because everything else is there | 23:28 |
| jamielennox | i'm thinking the best way to do it for now is have just the register and load methods as standalone methods and completely hide the details | 23:31 |
| morgan | ok | 23:31 |
| jamielennox | ergh, there's a reason that stuff is on the class for session | 23:33 |
| *** dims_ has quit IRC | 23:38 | |
| *** hrou has joined #openstack-keystone | 23:48 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove plugin.load_from_conf_options and argparse https://review.openstack.org/216512 | 23:49 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Give easy entry points for session loading https://review.openstack.org/217972 | 23:49 |
| jamielennox | morgan: that would make me happy enough regarding session loading i think ^ | 23:49 |
| morgan | let me take a look | 23:50 |
| morgan | those look good to me | 23:51 |
| morgan | provided jenkins doesn't really complain | 23:51 |
| jamielennox | i'm not sure it's perfect, but i don't think perfect is the goal - they should work for what we ned | 23:51 |
| morgan | nod | 23:52 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!