*** markvoelker has quit IRC | 00:01 | |
*** topol has joined #openstack-keystone | 00:02 | |
*** ChanServ sets mode: +v topol | 00:02 | |
openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/222000 | 00:04 |
---|---|---|
*** ankita_wagh has quit IRC | 00:05 | |
*** topol has quit IRC | 00:07 | |
*** stevemar has joined #openstack-keystone | 00:09 | |
*** ChanServ sets mode: +v stevemar | 00:09 | |
*** KarthikB has joined #openstack-keystone | 00:12 | |
*** stevemar has quit IRC | 00:13 | |
*** shoutm has quit IRC | 00:17 | |
openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Identity plugin thread safety https://review.openstack.org/221738 | 00:18 |
jamielennox | dolphm: here? | 00:19 |
jamielennox | was wondering if you could have a look at https://review.openstack.org/#/c/216088/ as you previously had a -1 on it | 00:20 |
*** shoutm has joined #openstack-keystone | 00:20 | |
*** shadower has quit IRC | 00:23 | |
*** shadower has joined #openstack-keystone | 00:23 | |
*** mylu has joined #openstack-keystone | 00:32 | |
*** darrenc_afk is now known as darrenc | 00:32 | |
*** mylu has quit IRC | 00:33 | |
*** btully has quit IRC | 00:39 | |
*** gyee has quit IRC | 00:41 | |
*** jecarey has joined #openstack-keystone | 00:42 | |
*** KarthikB has quit IRC | 00:45 | |
*** dave-mccowan has joined #openstack-keystone | 00:50 | |
*** markvoelker has joined #openstack-keystone | 00:58 | |
*** markvoelker has quit IRC | 01:02 | |
*** dsirrine has quit IRC | 01:06 | |
*** geoffarnold is now known as geoffarnoldX | 01:10 | |
*** dims_ has joined #openstack-keystone | 01:16 | |
*** btully has joined #openstack-keystone | 01:17 | |
*** dims has quit IRC | 01:19 | |
*** btully has quit IRC | 01:21 | |
*** ankita_wagh has joined #openstack-keystone | 01:36 | |
*** ankita_wagh has quit IRC | 01:45 | |
*** csoukup has joined #openstack-keystone | 01:46 | |
*** mylu has joined #openstack-keystone | 01:51 | |
*** roxanaghe has quit IRC | 01:53 | |
*** erhudy1 has quit IRC | 01:55 | |
*** ebalduf_ has joined #openstack-keystone | 01:57 | |
*** r-daneel has quit IRC | 01:57 | |
*** mylu has quit IRC | 01:59 | |
*** mylu has joined #openstack-keystone | 02:02 | |
*** humble_ has joined #openstack-keystone | 02:04 | |
humble_ | jamielennox:ping | 02:04 |
jamielennox | humble_: hello | 02:04 |
humble_ | how can I init a keystone client with conf | 02:05 |
humble_ | do you have any tutorial about it | 02:05 |
jamielennox | humble_: i do, sec | 02:05 |
jamielennox | humble_: http://www.jamielennox.net/blog/2015/02/17/loading-authentication-plugins/ is how to get a session object and auth plugin from CONF | 02:06 |
jamielennox | http://www.jamielennox.net/blog/2014/09/15/how-to-use-keystoneclient-sessions/ is nmore indepth as to what they do | 02:06 |
humble_ | But there is no auth_plugin in keystone_authtoken group | 02:07 |
jamielennox | but basically keystoneclient.v3.Client(session=session, auth=auth) | 02:07 |
jamielennox | humble_: ah you mean how to use all this with authtoken middlewarew? | 02:07 |
humble_ | yes | 02:07 |
jamielennox | humble_: you actually want to use middleware, because we really don't like services reaching into keystonemiddleware options for their own uses | 02:08 |
jamielennox | humble_: http://www.jamielennox.net/blog/2015/02/23/v3-authentication-with-auth-token-middleware/ is for v3 password | 02:08 |
jamielennox | other plugins are small variations around that depending on what plugin you are trying to laod | 02:08 |
humble_ | Thank you. | 02:09 |
jamielennox | humble_: no problem | 02:09 |
*** ankita_wagh has joined #openstack-keystone | 02:10 | |
openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add common options for loading an adapter https://review.openstack.org/222013 | 02:13 |
*** stevemar has joined #openstack-keystone | 02:15 | |
*** ChanServ sets mode: +v stevemar | 02:15 | |
*** dave-mccowan has quit IRC | 02:16 | |
*** spandhe has quit IRC | 02:18 | |
*** jasonsb has joined #openstack-keystone | 02:21 | |
*** humble__ has joined #openstack-keystone | 02:22 | |
*** humble_ has quit IRC | 02:25 | |
*** jecarey has quit IRC | 02:27 | |
*** humble__ has quit IRC | 02:27 | |
*** alejandrito has joined #openstack-keystone | 02:28 | |
*** stevemar has quit IRC | 02:32 | |
openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Move session loading tests into loading section https://review.openstack.org/222016 | 02:34 |
*** dave-mccowan has joined #openstack-keystone | 02:34 | |
*** roxanaghe has joined #openstack-keystone | 02:36 | |
openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Move session loading tests into loading section https://review.openstack.org/222016 | 02:38 |
*** fangzhou has quit IRC | 02:38 | |
*** Nirupama has joined #openstack-keystone | 02:42 | |
*** roxanaghe has quit IRC | 02:48 | |
*** geoffarnoldX is now known as geoffarnold | 02:50 | |
*** markvoelker has joined #openstack-keystone | 02:55 | |
*** sdake has quit IRC | 02:58 | |
*** doug-fish has quit IRC | 03:00 | |
*** doug-fish has joined #openstack-keystone | 03:00 | |
*** jecarey has joined #openstack-keystone | 03:01 | |
*** dave-mccowan has quit IRC | 03:04 | |
*** lhcheng has quit IRC | 03:05 | |
*** btully has joined #openstack-keystone | 03:05 | |
*** topol has joined #openstack-keystone | 03:06 | |
*** ChanServ sets mode: +v topol | 03:06 | |
*** btully has quit IRC | 03:09 | |
*** alejandrito has quit IRC | 03:10 | |
*** humble_ has joined #openstack-keystone | 03:17 | |
humble_ | jamielennox: Can I init a auth_plugin with load_from_conf_options instead of v3.Password by the keystone_authtoken group | 03:18 |
*** btully has joined #openstack-keystone | 03:19 | |
*** dims_ has quit IRC | 03:23 | |
*** btully has quit IRC | 03:23 | |
jamielennox | humble_: yes, any plugin should work there, v3.Password is just the most common | 03:23 |
humble_ | jamielennox: But there is no auth_plugin opt in the opts which is registered by keystone_middleware | 03:25 |
*** dolphm has quit IRC | 03:27 | |
*** sigmavirus24 has quit IRC | 03:27 | |
*** eglute has quit IRC | 03:27 | |
*** d34dh0r53 has quit IRC | 03:27 | |
*** d34dh0r53 has joined #openstack-keystone | 03:28 | |
*** eglute has joined #openstack-keystone | 03:28 | |
*** dolphm has joined #openstack-keystone | 03:28 | |
*** sigmavirus24 has joined #openstack-keystone | 03:29 | |
*** links has joined #openstack-keystone | 03:30 | |
jamielennox | humble_: registered https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_auth.py#L193 | 03:31 |
*** stevemar has joined #openstack-keystone | 03:33 | |
*** ChanServ sets mode: +v stevemar | 03:33 | |
*** topol has quit IRC | 03:34 | |
*** stevemar has quit IRC | 03:36 | |
*** sigmavirus24 is now known as sigmavirus24_awa | 03:39 | |
*** richm has quit IRC | 03:40 | |
*** davechen has joined #openstack-keystone | 03:45 | |
*** mylu has quit IRC | 03:48 | |
*** roxanaghe has joined #openstack-keystone | 03:48 | |
*** jecarey has quit IRC | 03:48 | |
*** mylu has joined #openstack-keystone | 03:49 | |
*** stevemar has joined #openstack-keystone | 03:50 | |
*** ChanServ sets mode: +v stevemar | 03:50 | |
*** geoffarnold is now known as geoffarnoldX | 03:51 | |
*** roxanaghe has quit IRC | 03:53 | |
*** mylu has quit IRC | 03:54 | |
*** lhcheng has joined #openstack-keystone | 04:00 | |
*** ChanServ sets mode: +v lhcheng | 04:00 | |
*** morgan has quit IRC | 04:06 | |
*** morganfainberg has joined #openstack-keystone | 04:07 | |
*** ChanServ sets mode: +v morganfainberg | 04:07 | |
*** morganfainberg is now known as morgan | 04:09 | |
morgan | . | 04:10 |
*** marzif has joined #openstack-keystone | 04:10 | |
openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add load_from_options_getter to plugin loading https://review.openstack.org/222029 | 04:16 |
stevemar | lhcheng: poke | 04:16 |
lhcheng | hey stevemar | 04:18 |
stevemar | lhcheng: whats up with L246 here: https://review.openstack.org/#/c/219041/5/openstack_auth/utils.py | 04:18 |
lhcheng | ah that is take care the case where there is no mapping defined | 04:19 |
lhcheng | *is to take care | 04:19 |
*** geoffarnoldX is now known as geoffarnold | 04:19 | |
lhcheng | if no mapping found, return a tuple (None, <protocol_id) | 04:20 |
*** geoffarnold is now known as geoffarnoldX | 04:20 | |
stevemar | ah | 04:20 |
stevemar | the tuple bits was confusing me | 04:21 |
stevemar | i've been out of it | 04:21 |
lhcheng | yeah, the tuple format is not great | 04:22 |
lhcheng | need to have an extra step to figure out | 04:23 |
jamielennox | i prefer it - but whatever :P | 04:23 |
*** dims has joined #openstack-keystone | 04:23 | |
lhcheng | If I am configuring the settings, I might prefer the tuple. I am lazy and prefer less things to write. | 04:25 |
lhcheng | :P | 04:25 |
lhcheng | stevemar: while you're around, got a quick question on: https://review.openstack.org/#/c/216501/ | 04:26 |
lhcheng | do you prefer the region arg to be deprecated just on the List method? | 04:27 |
*** dims has quit IRC | 04:30 | |
stevemar | lhcheng: i was just looking at that | 04:30 |
*** mflobo has joined #openstack-keystone | 04:32 | |
stevemar | lhcheng: yeah, i was thinking of deprecating region arg for that function... whats the issue there? | 04:32 |
stevemar | just a warning / deprecation message if `region` is not None | 04:33 |
stevemar | unless i'm being too picky, jamielennox thoughts? you +2'ed it before | 04:33 |
jamielennox | stevemar: hmm? | 04:34 |
stevemar | OTOH - filtering by region never worked, so we're not really breaking anyone | 04:34 |
stevemar | jamielennox: https://review.openstack.org/#/c/216501/4 | 04:34 |
jamielennox | didn't we fix this recently? | 04:34 |
stevemar | we added region to keystone server proper | 04:35 |
stevemar | before that, it never worked | 04:35 |
lhcheng | jamielennox: it was fixed in keystone, but the argument name is region_id | 04:35 |
stevemar | right | 04:35 |
jamielennox | oh, yea i +2ed an older version - i just thought it had merged | 04:35 |
stevemar | but what it someone is using region arg? don't we eventually want to remove that? | 04:35 |
lhcheng | stevemar: nah not picky, just confirming if you just want it in the List before I make the change. | 04:35 |
jamielennox | stevemar: a note would be good but more so we know what to remove with v2 | 04:36 |
jamielennox | thing is if you remove it from list it just ends up in kwargs and gets passed through anyway | 04:36 |
stevemar | ohhhh right | 04:36 |
jamielennox | i think my concern here was that no-one really uses region_id, it's always regoin_name | 04:36 |
stevemar | the ID is a user defined name, but yeah, i understand your concern | 04:37 |
jamielennox | regions have ids because someone thought it would be a good idea to have htem nested but then never followed through | 04:37 |
stevemar | the ID *may* be a user defined name | 04:37 |
stevemar | ah nesting things | 04:38 |
lhcheng | I think that was for the at&t use case | 04:38 |
jamielennox | i do wonder if they ever got it to where the can use it for there own case and just dropped the rest | 04:38 |
jamielennox | or they just thought it would be a good idea at some point and did like 80% | 04:39 |
jamielennox | but had no real use case | 04:39 |
lhcheng | because they couldn't make a global keystone, due to token replication issue. but with fernet, maybe they don't need it now. | 04:39 |
* jamielennox is convinced that "this sounds like it might be useful one day" is a reason for a bunch of unnecessary options in openstack | 04:40 | |
lhcheng | heh | 04:40 |
lhcheng | okay, so for the region filtering patch. I'll just add the deprecation warning for the region arg on List. | 04:41 |
davechen | lhcheng: does your duplicate config issue worked out? | 04:47 |
lhcheng | just confirming, do we want a deprecation warning or just a note? :) | 04:47 |
lhcheng | davechen: I haven't got the chance to try out today | 04:47 |
lhcheng | davechen: tox should pick the latest oslo-config, so still don't know what's going on. I tried tox -r to rebuild, but still no luck | 04:49 |
*** roxanaghe has joined #openstack-keystone | 04:49 | |
davechen | lhcheng: something mistery happened in your env. :) | 04:50 |
*** roxanaghe has quit IRC | 04:55 | |
*** ankita_wagh has quit IRC | 04:55 | |
*** markvoelker has quit IRC | 04:55 | |
lhcheng | davechen: I won't be surprised, since my vm has been running for a year of devstack update :P | 04:56 |
*** fifieldt has joined #openstack-keystone | 04:58 | |
*** urulama has joined #openstack-keystone | 04:58 | |
*** btully has joined #openstack-keystone | 05:03 | |
*** hrou has quit IRC | 05:07 | |
lhcheng | davechen: I booted another vm, still getting random test failure on KSM related to oslo.config | 05:11 |
*** roxanaghe has joined #openstack-keystone | 05:12 | |
*** roxanaghe has quit IRC | 05:13 | |
*** sdake_ has joined #openstack-keystone | 05:18 | |
*** roxanagh_ has joined #openstack-keystone | 05:18 | |
*** ankita_wagh has joined #openstack-keystone | 05:19 | |
*** ankita_wagh has quit IRC | 05:19 | |
stevemar | i tuned out for a while there | 05:19 |
*** ankita_wagh has joined #openstack-keystone | 05:20 | |
stevemar | lhcheng: a note works, jamie reminded me that useless args get thrown into kwargs | 05:20 |
*** ankita_wagh has quit IRC | 05:20 | |
stevemar | so its cool with just a note | 05:21 |
lhcheng | stevemar: gotcha | 05:21 |
*** ankita_wagh has joined #openstack-keystone | 05:21 | |
*** sdake_ is now known as sdake | 05:21 | |
*** spandhe has joined #openstack-keystone | 05:21 | |
lhcheng | stevemar: I would also be tuned out if its 1:20am | 05:22 |
lhcheng | :P | 05:22 |
stevemar | :) | 05:23 |
lhcheng | davechen: I'll check the test failure with josh harlow tom, his oslo knowledge will be useful to help me find a clue. | 05:24 |
lhcheng | davechen: thanks for asking, btw :) | 05:24 |
*** spandhe_ has joined #openstack-keystone | 05:26 | |
*** spandhe has quit IRC | 05:26 | |
*** spandhe_ is now known as spandhe | 05:26 | |
*** stevemar has quit IRC | 05:28 | |
davechen | lhcheng: good luck lin | 05:28 |
*** stevemar has joined #openstack-keystone | 05:29 | |
*** ChanServ sets mode: +v stevemar | 05:29 | |
*** sdake_ has joined #openstack-keystone | 05:29 | |
*** sdake has quit IRC | 05:30 | |
*** spandhe has quit IRC | 05:34 | |
*** urulama has quit IRC | 05:40 | |
*** urulama has joined #openstack-keystone | 05:40 | |
*** stevemar has quit IRC | 05:43 | |
*** stevemar has joined #openstack-keystone | 05:43 | |
*** ChanServ sets mode: +v stevemar | 05:43 | |
*** jerrygb has joined #openstack-keystone | 05:53 | |
*** fifieldt has quit IRC | 05:56 | |
*** markvoelker has joined #openstack-keystone | 05:56 | |
*** csoukup has quit IRC | 05:57 | |
*** markvoelker has quit IRC | 06:01 | |
*** sdake has joined #openstack-keystone | 06:08 | |
*** woodster_ has quit IRC | 06:09 | |
*** roxanagh_ has quit IRC | 06:10 | |
*** ajayaa has joined #openstack-keystone | 06:11 | |
*** sdake_ has quit IRC | 06:11 | |
*** roxanaghe has joined #openstack-keystone | 06:11 | |
*** humble__ has joined #openstack-keystone | 06:13 | |
*** roxanaghe has quit IRC | 06:16 | |
*** humble_ has quit IRC | 06:17 | |
*** jerrygb has quit IRC | 06:19 | |
*** ParsectiX has joined #openstack-keystone | 06:22 | |
*** ajayaa has quit IRC | 06:25 | |
*** humble_ has joined #openstack-keystone | 06:25 | |
humble_ | jamielennox: How can I use keystone.token_auth which is returned by keystonemiddleware to init a keystoneclient? | 06:26 |
jamielennox | humble_: just writing that post :) | 06:26 |
jamielennox | but essentially you just use it as the auth plugin | 06:27 |
jamielennox | so you create session as per normal | 06:27 |
jamielennox | and you pass auth=request.env['keystone.token_auth'] | 06:27 |
humble_ | Can I directly pass auth in keystoneclient without creating a session | 06:27 |
*** sdake has quit IRC | 06:28 | |
jamielennox | humble_: no you will always need a session as well | 06:28 |
*** humble__ has quit IRC | 06:28 | |
humble_ | keystoneclient create a session automatic? | 06:29 |
*** sdake has joined #openstack-keystone | 06:29 | |
jamielennox | no, have to do it manually | 06:29 |
jamielennox | but it's like two lines | 06:29 |
jamielennox | and you should reuse it always so you get things like connecction pooling | 06:29 |
humble_ | When I create keystoneclient, I don't create session. When I use other client, I can use keystoneclient.session to init | 06:30 |
humble_ | I think It should work. | 06:31 |
jamielennox | that's kind of a bad idea, you're taking the compatibility mode that keystoneclient did and reusing it for other people | 06:31 |
jamielennox | if you're doing it that way you can just do session=session.Session() | 06:31 |
jamielennox | pass the session to keystoneclient - it's cleaner | 06:32 |
humble_ | If we pass the session, what is the usage of auth | 06:33 |
humble_ | We already use it in session | 06:33 |
jamielennox | humble_: so there are two ways to use session and auth | 06:34 |
jamielennox | if you are doing a cli or something where you always use the same auth you can attach auth to session and then just always use the same auth plugin for everything | 06:35 |
jamielennox | if you are writing a service and so you are always using different auth you shouldn't need to recreate the session every time | 06:35 |
jamielennox | the session is thread safe so you can create it once and then store it on the process and refer to it as global | 06:35 |
jamielennox | then you can create each client using Client(session=SESSION, auth=user_auth) | 06:36 |
jamielennox | both ways get you a similar outcome but you tend to use the different modes differently depending on how long your auth object lives | 06:36 |
humble_ | When using different auth, session = session.Session()? | 06:37 |
*** ajayaa has joined #openstack-keystone | 06:37 | |
openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Return default value for pkg_version if missing https://review.openstack.org/222042 | 06:38 |
*** ankita_wagh has quit IRC | 06:39 | |
jamielennox | session.Session() is the simplest object, you haven't let the admin define things like TLS certificates or any connection values | 06:39 |
jamielennox | loading session from a config file is two lines | 06:39 |
jamielennox | session.Session.register_conf_options(CONF, group_name) | 06:40 |
jamielennox | s = session.Session.load_from_conf_options(CONF, group_name) | 06:40 |
humble_ | What is usage case of loading from config | 06:41 |
humble_ | Oh, I know | 06:42 |
jamielennox | it registers these options: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/session.py#L794-L810 | 06:43 |
humble_ | One more question, if other client want to share the session, which way is better, use global session or use keystoneclient.session | 06:43 |
jamielennox | and in future if we need to do something like fix a TLS problem again we can fix it in one place, or add new options to all the services at once | 06:43 |
jamielennox | forget about keystoneclient.Client().session it's only there for internal use because keystoneclient has some weird compatibility to maintain | 06:44 |
jamielennox | always create the session yourself and pass it around | 06:44 |
humble_ | OK | 06:44 |
humble_ | I find that serveral clients don't support session now | 06:44 |
jamielennox | humble_: what's left? i know swift doesn't but there's a lot of problems there | 06:46 |
humble_ | glance | 06:46 |
jamielennox | i did most of the core services but i haven't used a lot of the newer projects | 06:47 |
openstackgerrit | Lin Hua Cheng proposed openstack/python-keystoneclient: Use region_id filter for List Endpoints https://review.openstack.org/216501 | 06:47 |
jamielennox | glance is fixed in the most recent release, i think it's 1.0 | 06:47 |
humble_ | OK | 06:48 |
humble_ | Thank you for your help | 06:48 |
*** henrynash has joined #openstack-keystone | 06:48 | |
*** ChanServ sets mode: +v henrynash | 06:48 | |
jamielennox | humble_: np | 06:49 |
humble_ | jamielennox: When I use keystone.token_auth to init a keystoneclient, and query service_catalog, it fails | 06:49 |
jamielennox | why are you querying the service catalog? it's not something you need to manage with auth_plugins | 06:50 |
jamielennox | the plugins will do the right thing if you pass it to the services | 06:50 |
jamielennox | you don't need to ever get that value yourself | 06:51 |
humble_ | self._barbican = barbicanclient.Client(session=session, | 06:51 |
humble_ | endpoint=endpoint) | 06:51 |
humble_ | I need a endpoint to init the client | 06:52 |
humble_ | jamielennox: Is there a better way | 06:52 |
jamielennox | just session=session, auth=auth should be enough | 06:53 |
humble_ | I think service_type and service_name are necessary | 06:53 |
jamielennox | when barbican makes a request it gives it's service_type and the session and auth plugin do the rest | 06:53 |
humble_ | nice | 06:54 |
jamielennox | barbicanclient should know it's own service_type, you shouldn't need to tell it | 06:54 |
humble_ | is auth necessary | 06:54 |
jamielennox | yes, otherwise you don't have a token or a service catalog to look up from | 06:54 |
humble_ | So we should use gloabl auth? | 06:56 |
humble_ | If not, how other clients get the auth | 06:56 |
jamielennox | the same way keystoneclient did | 06:58 |
jamielennox | ENV['keystone.token_auth] | 06:58 |
humble_ | jamielennox:I think session should store the auth | 06:58 |
jamielennox | humble_: you can but you would need to create a new session object for each request then | 06:59 |
humble_ | jamielennox:If the auth in all client is same | 06:59 |
humble_ | Can I just use session to init a client without auth | 07:00 |
*** lsmola has joined #openstack-keystone | 07:02 | |
jamielennox | you can - there's not much you can do without auth though | 07:03 |
jamielennox | sorry, if you have auth stored on the session then you don't need to pass it to Client.__init__ | 07:03 |
humble_ | I think so | 07:04 |
humble_ | jamielennox:endpoint is necessary in glanceclient | 07:06 |
jamielennox | humble_: which version of glanceclient do you have | 07:07 |
humble_ | v2 version | 07:07 |
*** browne has quit IRC | 07:08 | |
humble_ | jamielennox:v1 and v2 both need endpoint. | 07:08 |
jamielennox | humble_: which version of the library | 07:08 |
humble_ | 0.19.0 | 07:10 |
humble_ | jamielennox:sorry, maybe it is outdated. | 07:11 |
jamielennox | yea, need 1.0 for glance which is not all that old | 07:11 |
humble_ | jamielennox: I will have a try | 07:12 |
*** roxanaghe has joined #openstack-keystone | 07:13 | |
*** stevemar has quit IRC | 07:13 | |
*** roxanaghe has quit IRC | 07:18 | |
*** martinus__ has joined #openstack-keystone | 07:21 | |
*** btully has quit IRC | 07:39 | |
jamielennox | humble_: http://www.jamielennox.net/blog/2015/09/10/user-auth-in-openstack-services/ | 07:40 |
*** bigjools has quit IRC | 07:43 | |
*** telemonster has quit IRC | 07:44 | |
*** telemonster has joined #openstack-keystone | 07:45 | |
*** bigjools has joined #openstack-keystone | 07:46 | |
*** bigjools has quit IRC | 07:46 | |
*** bigjools has joined #openstack-keystone | 07:46 | |
*** markvoelker has joined #openstack-keystone | 07:57 | |
*** fhubik has joined #openstack-keystone | 07:58 | |
*** bapalm has quit IRC | 07:58 | |
*** jmccrory has quit IRC | 07:59 | |
*** shoutm_ has joined #openstack-keystone | 08:00 | |
*** bapalm has joined #openstack-keystone | 08:00 | |
*** jistr has joined #openstack-keystone | 08:01 | |
*** shoutm has quit IRC | 08:01 | |
*** markvoelker has quit IRC | 08:02 | |
*** fhubik is now known as fhubik_brb | 08:02 | |
*** jmccrory has joined #openstack-keystone | 08:03 | |
*** marzif has quit IRC | 08:13 | |
*** roxanaghe has joined #openstack-keystone | 08:14 | |
*** pnavarro has joined #openstack-keystone | 08:17 | |
*** sdake has quit IRC | 08:17 | |
*** jerrygb has joined #openstack-keystone | 08:19 | |
*** stevemar has joined #openstack-keystone | 08:20 | |
*** ChanServ sets mode: +v stevemar | 08:20 | |
*** henrynash has quit IRC | 08:21 | |
*** roxanaghe has quit IRC | 08:21 | |
*** stevemar has quit IRC | 08:24 | |
*** jerrygb has quit IRC | 08:24 | |
*** claudiub has joined #openstack-keystone | 08:29 | |
*** lhcheng has quit IRC | 08:31 | |
*** fhubik_brb is now known as fhubik | 08:34 | |
*** bigjools has quit IRC | 08:38 | |
*** bigjools has joined #openstack-keystone | 08:40 | |
*** claudiub has quit IRC | 08:42 | |
*** fhubik is now known as fhubik_brb | 08:44 | |
*** topol has joined #openstack-keystone | 08:46 | |
*** ChanServ sets mode: +v topol | 08:46 | |
*** topol has quit IRC | 08:51 | |
*** e0ne has joined #openstack-keystone | 08:57 | |
*** markvoelker has joined #openstack-keystone | 08:58 | |
*** fhubik_brb is now known as fhubik | 08:59 | |
*** markvoelker has quit IRC | 09:02 | |
*** jmccrory has quit IRC | 09:04 | |
*** shoutm has joined #openstack-keystone | 09:05 | |
*** jmccrory has joined #openstack-keystone | 09:06 | |
*** shoutm_ has quit IRC | 09:07 | |
*** e0ne has quit IRC | 09:07 | |
*** jmccrory has quit IRC | 09:12 | |
*** e0ne has joined #openstack-keystone | 09:12 | |
*** jmccrory has joined #openstack-keystone | 09:15 | |
*** urulama has quit IRC | 09:17 | |
*** urulama has joined #openstack-keystone | 09:17 | |
*** jerrygb has joined #openstack-keystone | 09:20 | |
*** jerrygb has quit IRC | 09:26 | |
*** dims has joined #openstack-keystone | 09:31 | |
*** e0ne has quit IRC | 09:35 | |
*** dims has quit IRC | 09:38 | |
*** davechen has left #openstack-keystone | 09:40 | |
*** e0ne has joined #openstack-keystone | 09:42 | |
*** aix has quit IRC | 09:45 | |
*** dims has joined #openstack-keystone | 09:49 | |
*** rajesht has joined #openstack-keystone | 09:50 | |
rajesht | hi cores, | 09:51 |
rajesht | need one more +2 and its small fix | 09:51 |
rajesht | https://review.openstack.org/#/c/210365/ | 09:51 |
*** roxanaghe has joined #openstack-keystone | 10:03 | |
*** fhubik is now known as fhubik_brb | 10:03 | |
*** roxanaghe has quit IRC | 10:08 | |
*** aix has joined #openstack-keystone | 10:13 | |
*** amakarov_away is now known as amakarov | 10:27 | |
*** humble__ has joined #openstack-keystone | 10:40 | |
*** humble_ has quit IRC | 10:40 | |
*** markvoelker has joined #openstack-keystone | 10:59 | |
*** fhubik_brb is now known as fhubik | 11:00 | |
*** markvoelker has quit IRC | 11:04 | |
*** fhubik is now known as fhubik_brb | 11:06 | |
*** humble__ has quit IRC | 11:12 | |
*** gordc has joined #openstack-keystone | 11:17 | |
*** jerrygb has joined #openstack-keystone | 11:21 | |
*** martinus__ has quit IRC | 11:22 | |
*** shoutm has quit IRC | 11:24 | |
*** jerrygb has quit IRC | 11:26 | |
*** shoutm has joined #openstack-keystone | 11:26 | |
*** aix has quit IRC | 11:34 | |
*** aix has joined #openstack-keystone | 11:35 | |
*** fhubik_brb is now known as fhubik | 11:36 | |
*** dave-mccowan has joined #openstack-keystone | 11:38 | |
*** rajesht has quit IRC | 11:48 | |
*** jamielennox is now known as jamielennox|away | 11:49 | |
*** roxanaghe has joined #openstack-keystone | 11:51 | |
*** rajesht has joined #openstack-keystone | 11:51 | |
*** henrynash has joined #openstack-keystone | 11:51 | |
*** ChanServ sets mode: +v henrynash | 11:51 | |
*** markvoelker has joined #openstack-keystone | 11:55 | |
*** gordc has quit IRC | 11:56 | |
*** gordc has joined #openstack-keystone | 11:56 | |
*** roxanaghe has quit IRC | 11:57 | |
*** dsirrine has joined #openstack-keystone | 12:02 | |
*** jistr is now known as jistr|mtg | 12:03 | |
*** henrynash_ has joined #openstack-keystone | 12:05 | |
*** ChanServ sets mode: +v henrynash_ | 12:05 | |
*** henrynash has quit IRC | 12:06 | |
*** henrynash_ is now known as henrynash | 12:06 | |
*** nakamura has quit IRC | 12:19 | |
*** gordc has quit IRC | 12:19 | |
*** samueldmq has joined #openstack-keystone | 12:21 | |
*** dims has quit IRC | 12:22 | |
*** dims has joined #openstack-keystone | 12:23 | |
*** zzzeek has joined #openstack-keystone | 12:29 | |
*** gordc has joined #openstack-keystone | 12:34 | |
*** henrynash_ has joined #openstack-keystone | 12:36 | |
*** ChanServ sets mode: +v henrynash_ | 12:36 | |
*** henrynash has quit IRC | 12:36 | |
*** henrynash_ is now known as henrynash | 12:36 | |
*** linkmark has joined #openstack-keystone | 12:36 | |
*** e0ne has quit IRC | 12:37 | |
*** nicodemos has joined #openstack-keystone | 12:39 | |
*** henrynash has quit IRC | 12:40 | |
*** jerrygb has joined #openstack-keystone | 12:40 | |
*** henrynash has joined #openstack-keystone | 12:42 | |
*** ChanServ sets mode: +v henrynash | 12:42 | |
*** jerrygb has quit IRC | 12:45 | |
openstackgerrit | Alexander Makarov proposed openstack/keystone: Move region configuration to a critical section https://review.openstack.org/222173 | 12:46 |
*** henrynash has quit IRC | 12:48 | |
*** Nirupama has quit IRC | 12:48 | |
*** jistr|mtg is now known as jistr | 12:52 | |
*** topol has joined #openstack-keystone | 12:53 | |
*** ChanServ sets mode: +v topol | 12:53 | |
*** henrynash has joined #openstack-keystone | 12:55 | |
*** ChanServ sets mode: +v henrynash | 12:55 | |
*** henrynash has quit IRC | 12:57 | |
*** richm has joined #openstack-keystone | 13:00 | |
*** tiny-hands has joined #openstack-keystone | 13:01 | |
*** edmondsw has joined #openstack-keystone | 13:12 | |
*** fhubik is now known as fhubik_brb | 13:14 | |
*** fhubik_brb is now known as fhubik | 13:17 | |
*** fhubik is now known as fhubik_brb | 13:19 | |
*** bknudson has joined #openstack-keystone | 13:19 | |
*** ChanServ sets mode: +v bknudson | 13:19 | |
*** links has quit IRC | 13:23 | |
bknudson | Requirements update is failing: https://review.openstack.org/#/c/222000/ | 13:30 |
*** jsavak has joined #openstack-keystone | 13:32 | |
*** e0ne has joined #openstack-keystone | 13:33 | |
*** jecarey has joined #openstack-keystone | 13:33 | |
*** hrou has joined #openstack-keystone | 13:33 | |
*** browne has joined #openstack-keystone | 13:36 | |
edmondsw | anyone know why I keystonemiddleware UTs sometimes (pretty often, but not consistently) fail with a DuplicateOptError as seen here: http://logs.openstack.org/73/217373/6/check/gate-keystonemiddleware-python34/03e20d0/console.html | 13:37 |
edmondsw | opened https://bugs.launchpad.net/keystonemiddleware/+bug/1494327 | 13:39 |
openstack | Launchpad bug 1494327 in keystonemiddleware "DuplicateOptError intermittently breaks UT" [Undecided,New] | 13:39 |
*** roxanaghe has joined #openstack-keystone | 13:39 | |
bknudson | edmondsw: I think this started with the latest release of oslo.config... haven't had a chance to look into it. | 13:40 |
*** fhubik_brb is now known as fhubik | 13:41 | |
*** jerrygb has joined #openstack-keystone | 13:41 | |
*** henrynash has joined #openstack-keystone | 13:41 | |
*** ChanServ sets mode: +v henrynash | 13:41 | |
*** roxanaghe has quit IRC | 13:45 | |
*** jerrygb has quit IRC | 13:45 | |
*** dsirrine has quit IRC | 13:47 | |
*** dsirrine has joined #openstack-keystone | 13:48 | |
*** browne has quit IRC | 13:48 | |
bknudson | Filed a bug for the requirements update issue: https://bugs.launchpad.net/keystone/+bug/1494330 | 13:49 |
openstack | Launchpad bug 1494330 in Keystone "Requirements update is failing" [Undecided,New] | 13:49 |
*** ajayaa has quit IRC | 13:51 | |
*** shoutm has quit IRC | 13:55 | |
openstackgerrit | Tom Cocozzello proposed openstack/python-keystoneclient: Move pot file for traslation https://review.openstack.org/221473 | 13:57 |
*** ChanServ sets mode: +o dolphm | 13:59 | |
*** topol has quit IRC | 14:00 | |
*** mrutkows has joined #openstack-keystone | 14:02 | |
*** topol has joined #openstack-keystone | 14:02 | |
*** ChanServ sets mode: +v topol | 14:02 | |
*** ParsectiX has quit IRC | 14:03 | |
*** sigmavirus24_awa is now known as sigmavirus24 | 14:03 | |
*** btully has joined #openstack-keystone | 14:04 | |
*** browne has joined #openstack-keystone | 14:05 | |
*** bigjools has quit IRC | 14:05 | |
*** henrynash has quit IRC | 14:05 | |
*** mrutkows has quit IRC | 14:06 | |
*** shoutm has joined #openstack-keystone | 14:07 | |
*** bigjools has joined #openstack-keystone | 14:07 | |
*** bigjools has quit IRC | 14:07 | |
*** bigjools has joined #openstack-keystone | 14:07 | |
*** roxanaghe has joined #openstack-keystone | 14:08 | |
*** fhubik is now known as fhubik_brb | 14:08 | |
openstackgerrit | Alexander Makarov proposed openstack/keystone: Move region configuration to a critical section https://review.openstack.org/222173 | 14:10 |
*** fhubik_brb is now known as fhubik | 14:12 | |
*** jerrygb has joined #openstack-keystone | 14:15 | |
edmondsw | seeking a second +2 on simple fix: https://review.openstack.org/#/c/221897/ | 14:16 |
*** mflobo1 has joined #openstack-keystone | 14:16 | |
*** roxanaghe has quit IRC | 14:16 | |
*** henrynash has joined #openstack-keystone | 14:16 | |
*** ChanServ sets mode: +v henrynash | 14:16 | |
dstanek | bknudson: you around? | 14:17 |
bknudson | dstanek: where else would I be? | 14:17 |
dstanek | bknudson: good question :-) | 14:17 |
dstanek | bknudson: that wsgi change means that you can't just take the stock paste.ini anymore | 14:17 |
bknudson | dstanek: how? It shouldn't have changed anything. | 14:18 |
bknudson | there's no change to the paste.ini | 14:18 |
dstanek | mod_wsgi looks for the app or composite section by name so in this case it's looking for one named keystone-wsgi-admin/keystone-wsgi-public | 14:19 |
dstanek | bknudson: http://paste.openstack.org/show/uQ3hIC3Pf2uWzdAQ2ayH/ | 14:19 |
bknudson | Here's the devstack change, no mucking with paste.ini: https://review.openstack.org/#/c/194729/ | 14:19 |
*** samueldmq has quit IRC | 14:19 | |
bknudson | dstanek: is there a bug in the script that pbr generates? | 14:20 |
bknudson | pbr generates /usr/local/bin/keystone-wsgi-admin | 14:20 |
*** roxanaghe has joined #openstack-keystone | 14:21 | |
dstanek | bknudson: oh, i bet it's that you can't use that config with a slightly older keystone clone | 14:21 |
dstanek | yep, that has to be what it is | 14:21 |
bknudson | the wsgi script is going to call keystone.server.wsgi:initialize_admin_application to create the application | 14:21 |
*** mrutkows_ has joined #openstack-keystone | 14:21 | |
bknudson | or keystone.server.wsgi:initialize_public_application | 14:22 |
bknudson | the old initilize_application took the name. | 14:22 |
bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/server/wsgi.py#n50 | 14:22 |
*** roxanaghe has quit IRC | 14:22 | |
*** marzif has joined #openstack-keystone | 14:23 | |
*** mflobo1 has left #openstack-keystone | 14:23 | |
dstanek | bknudson: yeah, i saw that. i think what they were running into was taking a newish version of keystone and converting it to use Apache. | 14:24 |
dstanek | the default goto for configs is in our repo, but that one only works with the version it was committed in or above (unless you modify paste.ini) | 14:25 |
*** mrutkows_ is now known as mrutkows | 14:25 | |
*** tdurakov has quit IRC | 14:26 | |
*** marzif has quit IRC | 14:30 | |
*** marzif has joined #openstack-keystone | 14:31 | |
*** topol has quit IRC | 14:35 | |
dstanek | the same issue exists with my paste.ini changes | 14:36 |
*** tonytan4ever has joined #openstack-keystone | 14:40 | |
*** shoutm has quit IRC | 14:42 | |
*** slberger has joined #openstack-keystone | 14:47 | |
*** geoffarnoldX is now known as geoffarnold | 14:48 | |
*** tdurakov has joined #openstack-keystone | 14:53 | |
*** aix has quit IRC | 14:53 | |
*** hrou has quit IRC | 14:55 | |
*** e0ne has quit IRC | 14:55 | |
*** hrou has joined #openstack-keystone | 14:55 | |
*** stevemar has joined #openstack-keystone | 14:58 | |
*** ChanServ sets mode: +v stevemar | 14:58 | |
*** marzif has quit IRC | 14:59 | |
*** e0ne has joined #openstack-keystone | 15:03 | |
*** roxanaghe has joined #openstack-keystone | 15:03 | |
*** roxanaghe has quit IRC | 15:08 | |
bknudson | https://review.openstack.org/#/c/222236/ in requirements should fix the reqs update issue. | 15:10 |
*** mrutkows has quit IRC | 15:10 | |
*** jistr is now known as jistr|mtg | 15:14 | |
*** roxanaghe has joined #openstack-keystone | 15:14 | |
*** samueldmq has joined #openstack-keystone | 15:16 | |
*** ebalduf_ has quit IRC | 15:18 | |
*** roxanaghe has quit IRC | 15:22 | |
*** jistr|mtg is now known as jistr | 15:26 | |
*** aix has joined #openstack-keystone | 15:26 | |
*** topol has joined #openstack-keystone | 15:28 | |
*** ChanServ sets mode: +v topol | 15:28 | |
*** dave-mccowan has quit IRC | 15:30 | |
*** csoukup has joined #openstack-keystone | 15:30 | |
*** fhubik has quit IRC | 15:33 | |
*** gyee has joined #openstack-keystone | 15:34 | |
*** ChanServ sets mode: +v gyee | 15:34 | |
*** jsavak has quit IRC | 15:34 | |
*** jsavak has joined #openstack-keystone | 15:39 | |
*** dave-mccowan has joined #openstack-keystone | 15:43 | |
*** browne has quit IRC | 15:44 | |
*** tdurakov has quit IRC | 15:46 | |
*** tdurakov_ has joined #openstack-keystone | 15:52 | |
*** jsavak has quit IRC | 15:54 | |
*** jsavak has joined #openstack-keystone | 15:54 | |
*** e0ne has quit IRC | 15:56 | |
*** e0ne has joined #openstack-keystone | 16:02 | |
*** tonytan4ever has quit IRC | 16:03 | |
*** ebalduf_ has joined #openstack-keystone | 16:05 | |
openstackgerrit | Tom Cocozzello proposed openstack/python-keystoneclient: Move pot file for traslation https://review.openstack.org/221473 | 16:05 |
*** diazjf has joined #openstack-keystone | 16:06 | |
*** jasonsb has quit IRC | 16:08 | |
*** jasonsb has joined #openstack-keystone | 16:08 | |
*** ebalduf_ has quit IRC | 16:10 | |
*** jasonsb has quit IRC | 16:23 | |
ayoung | autopep8 makes me happy: http://paste.openstack.org/show/455367/ | 16:24 |
*** ankita_wagh has joined #openstack-keystone | 16:25 | |
gyee | ayoung, nice! | 16:25 |
ayoung | gyee, yeah. It only changes lines that have warnings. So you don't have arbitrary shifting around | 16:26 |
*** woodster_ has joined #openstack-keystone | 16:26 | |
gyee | time to integrate it into git review | 16:27 |
*** jasonsb has joined #openstack-keystone | 16:27 | |
*** browne has joined #openstack-keystone | 16:27 | |
htruta | ayoung: I really like running flake8 every time I write in the file, as in dolphm's .vimrc | 16:32 |
openstackgerrit | Merged openstack/keystonemiddleware: Use ConnectionRefused for auth_token tests https://review.openstack.org/221897 | 16:35 |
*** diazjf has quit IRC | 16:35 | |
openstackgerrit | Merged openstack/python-keystoneclient: Use region_id filter for List Endpoints https://review.openstack.org/216501 | 16:37 |
ayoung | htruta, autopep8 -i on save would be wonderful | 16:38 |
*** ParsectiX has joined #openstack-keystone | 16:38 | |
*** jistr has quit IRC | 16:40 | |
*** bradjones|away is now known as bradjones | 16:42 | |
*** diazjf has joined #openstack-keystone | 16:45 | |
*** lhcheng has joined #openstack-keystone | 16:47 | |
*** ChanServ sets mode: +v lhcheng | 16:47 | |
*** dims_ has joined #openstack-keystone | 16:48 | |
*** dims has quit IRC | 16:51 | |
*** lsmola has quit IRC | 16:53 | |
*** e0ne has quit IRC | 16:54 | |
*** ankita_wagh has quit IRC | 16:57 | |
*** pgbridge has quit IRC | 16:58 | |
*** arunkant_ has joined #openstack-keystone | 17:04 | |
*** raildo is now known as raildo-afk | 17:04 | |
*** raildo-afk is now known as raildo | 17:07 | |
*** aix has quit IRC | 17:09 | |
*** ankita_wagh has joined #openstack-keystone | 17:15 | |
*** pnavarro has quit IRC | 17:20 | |
*** gyee has quit IRC | 17:21 | |
amakarov | bknudson, hi! I'd really appreciate if you help me to decide what to do with the bug: https://bugs.launchpad.net/keystone/+bug/1494398 | 17:23 |
openstack | Launchpad bug 1494398 in Keystone "AuthN fails if the tenant is recreated in the process" [Undecided,New] | 17:23 |
amakarov | I understand the case is weird, but still seems valid... | 17:24 |
lbragstad | bknudson: whoop whoop! https://review.openstack.org/#/c/220272/ | 17:25 |
bknudson | lbragstad: devstack with fernet works now? | 17:26 |
lbragstad | bknudson: we're going to find out | 17:26 |
lbragstad | bknudson: dolphm retriggered your patch | 17:26 |
lbragstad | it might take another retrigger after 220272 merges? | 17:26 |
lbragstad | bknudson: but I can keep eyes on it | 17:26 |
bknudson | lbragstad: I thought you had depends-on? | 17:27 |
lbragstad | bknudson: you added that | 17:27 |
lbragstad | I believe | 17:27 |
bknudson | if there's depends-on then the tempest change isn't going to make it pass | 17:27 |
*** tonytan4ever has joined #openstack-keystone | 17:28 | |
*** mylu has joined #openstack-keystone | 17:36 | |
morgan | lbragstad: why did we opt to truncate fernet instead of just moving everything towards microsecond? | 17:36 |
morgan | lbragstad: if I recall the truncate was the opposite of the discussion we had before | 17:36 |
lbragstad | morgan: the fernet library provided by cryptography doesn't support creating tokens with subsecond precision | 17:36 |
bknudson | it would be easier if all tokens worked the same way | 17:37 |
morgan | lbragstad: ah. then can we just move towards everything being not subsecond? | 17:37 |
morgan | audit_ids mean subsecond isn't needed | 17:37 |
morgan | the whole reason for subsecond was to make PKI tokens "unique" | 17:37 |
morgan | so they didn't hash to the same value | 17:37 |
bknudson | I think we've got audit IDs in revocation events | 17:37 |
morgan | lbragstad: I'd be ok with this being filed as a simple bug. | 17:38 |
morgan | bknudson: yeah. they get used there too | 17:38 |
dolphm | bknudson: so eliminate all inferior token formats | 17:38 |
dolphm | bknudson: but we're not using them correctly, afaict | 17:38 |
dolphm | (audit_ids) | 17:38 |
morgan | dolphm: next cycle: deprecate PKI[z] and UUID in favour of fernet! ;) | 17:38 |
bknudson | also revocation events need to remove subsecond precision | 17:39 |
dolphm | bknudson: remove? | 17:39 |
morgan | bknudson: yes we should do that. | 17:39 |
dolphm | why? | 17:39 |
morgan | dolphm: subsecond precision is pointless in the revocation events | 17:39 |
bknudson | the revocation events say > x.xxxx | 17:39 |
dolphm | because mysql 5.5 doesn't support them? | 17:39 |
bknudson | but tokens can be issued "in the past" | 17:39 |
morgan | dolphm: that too | 17:39 |
bknudson | because fernet doesn't support them | 17:39 |
morgan | dolphm: but because it isn't really needed | 17:40 |
dolphm | bknudson: oh, interesting. | 17:40 |
dolphm | bknudson: i haven't thought about it that way | 17:40 |
dolphm | morgan: i'd be in favor of that | 17:40 |
morgan | dolphm: i think it's worth filing a bug and doing the cleanup | 17:41 |
dolphm | morgan: subsecond precision served a hacky purpose with PKI, but audit IDs have superceded that entirely | 17:41 |
morgan | not really a BP. just a "hey make tokens consistent in this regard" | 17:41 |
morgan | dolphm: exactly | 17:41 |
*** mylu has quit IRC | 17:41 | |
dolphm | morgan: i bet we already have an open bug that would be applicable to resolving... | 17:41 |
dolphm | lbragstad: what's the bug that werner and jorge were working last week? | 17:41 |
morgan | dolphm: we have enough bugs, one of them somewhere has to cover it | 17:41 |
lbragstad | dolphm: digging | 17:41 |
dolphm | lbragstad: they were doing a migration to the revocation table to workaround the same sort of issue | 17:42 |
dolphm | morgan: =) | 17:42 |
* morgan should respond to the PTL thread. | 17:42 | |
morgan | dolphm: got a few moments to proofread something for me? | 17:42 |
lbragstad | dolphm: https://bugs.launchpad.net/keystone/+bug/1484237 | 17:43 |
openstack | Launchpad bug 1484237 in Keystone "token revocations not always respected when using fernet tokens" [Medium,In progress] - Assigned to werner mendizabal (nonameentername) | 17:43 |
dolphm | morgan: sure | 17:44 |
*** samueldmq has quit IRC | 17:45 | |
*** samueldmq has joined #openstack-keystone | 17:45 | |
dolphm | lbragstad: thanks, copy pasta'd morgan's comments into that bug. https://bugs.launchpad.net/keystone/+bug/1484237/comments/26 | 17:46 |
openstack | Launchpad bug 1484237 in Keystone "token revocations not always respected when using fernet tokens" [Medium,In progress] - Assigned to werner mendizabal (nonameentername) | 17:46 |
morgan | woo | 17:46 |
morgan | :) | 17:46 |
lbragstad | ok, so the new fix for that would be to rip out subsecond precision from revocation events. | 17:47 |
lbragstad | https://github.com/openstack/keystone/blob/master/keystone/contrib/revoke/model.py#L118 | 17:48 |
stevemar | lbragstad: dolphm nice job dudes :) | 17:48 |
* lbragstad high fives stevemar | 17:56 | |
*** dave-mccowan has quit IRC | 18:00 | |
*** doug-fish has quit IRC | 18:01 | |
bknudson | lbragstad: if it's issued_before then that shouldn't be a problem... | 18:02 |
*** doug-fish has joined #openstack-keystone | 18:02 | |
bknudson | here's the mysql workaround: https://github.com/openstack/keystone/blob/master/keystone/contrib/revoke/model.py#L88 | 18:02 |
*** dave-mccowan has joined #openstack-keystone | 18:03 | |
lbragstad | bknudson: yeah, i don't think sqlalchemy model supports subsecond precision anyway | 18:06 |
*** doug-fish has quit IRC | 18:06 | |
lbragstad | bknudson: https://github.com/openstack/keystone/blob/master/keystone/contrib/revoke/migrate_repo/versions/001_revoke_table.py#L33 sql.DateTime isn't accurate to the subsecond by default | 18:07 |
bknudson | lbragstad: I think in sqlite the timestamps were subsecond | 18:10 |
bknudson | that's why the unit tests passed | 18:10 |
lbragstad | bknudson: that would make sense | 18:10 |
*** bknudson has quit IRC | 18:10 | |
dstanek | yay for sqlite! | 18:11 |
dstanek | dolphm: any reason why you didn't close this one for keystone? https://bugs.launchpad.net/keystone/+bug/1101404 | 18:12 |
openstack | Launchpad bug 1101404 in OpenStack Compute (nova) "nova syslog logging to /dev/log race condition in python 2.6 and 2.7" [Medium,Confirmed] | 18:12 |
lbragstad | bkn<tab><tab><tab><tab>.... (sigh) | 18:13 |
*** e0ne has joined #openstack-keystone | 18:13 | |
*** madhu_ak has quit IRC | 18:14 | |
dolphm | lbragstad: ++ | 18:15 |
dolphm | st<tab><tab> surprise, stevemar's on! | 18:15 |
*** bknudson has joined #openstack-keystone | 18:16 | |
*** ChanServ sets mode: +v bknudson | 18:16 | |
lbragstad | stevemar: is bkn<tab><tab><tab> hidding on ST? | 18:16 |
lbragstad | I was going to leave him this - since it's relevant https://review.openstack.org/#/c/216236/ | 18:16 |
bknudson | I had to reboot | 18:16 |
lbragstad | bknudson: \o/ | 18:16 |
lbragstad | https://review.openstack.org/#/c/216236/ | 18:17 |
stevemar | dolphm: i've been bad lately :( | 18:17 |
*** e0ne has quit IRC | 18:17 | |
dolphm | stevemar: bknudson: znc. both of you. now. | 18:18 |
bknudson | znc? | 18:18 |
stevemar | dolphm: lbragstad: bknudson is like beetlejuice, just say his name three times and he appears | 18:18 |
lbragstad | stevemar: ++ | 18:18 |
stevemar | dolphm: i need to disconnect completely every now and then :P | 18:19 |
bknudson | I need a server | 18:19 |
dolphm | bknudson: you work for a public cloud provider, right? | 18:19 |
stevemar | you think we get things for free? | 18:19 |
lbragstad | bknudson: have mrodden give you one | 18:20 |
bknudson | lbragstad: he's just got systems under his desk | 18:20 |
dolphm | stevemar: yes, especially service-y things | 18:20 |
lbragstad | bknudson: those will work | 18:20 |
dstanek | are we in string freeze now? | 18:20 |
bknudson | dstanek: yes | 18:20 |
dstanek | bknudson: ok, that's what i thought | 18:20 |
bknudson | maybe topol can get free time on softlayer but not us | 18:23 |
*** doug-fish has joined #openstack-keystone | 18:23 | |
lbragstad | #action topol to get znc servers for everyone | 18:24 |
dolphm | but string freeze only affects changing strings, not adding strings, at the moment.... right? | 18:24 |
*** doug-fish has quit IRC | 18:24 | |
topol | what do we need from softlayer? | 18:24 |
*** doug-fish has joined #openstack-keystone | 18:25 | |
dolphm | topol: you need a single znc server for y'all to share | 18:25 |
lbragstad | topol: bknudson and stevemar need znc servers... | 18:25 |
lbragstad | or a znc server | 18:25 |
topol | through Monty and the BlueBox folks we may steal some of their resources | 18:25 |
dstanek | dolphm: yes, only changing | 18:25 |
topol | bknudson let's goto work with Monty on this. do you have the details | 18:26 |
*** doug-fish has quit IRC | 18:27 | |
*** doug-fish has joined #openstack-keystone | 18:27 | |
dstanek | topol: Rax has a developer account that you can give to your team. :-P | 18:28 |
morgan | stevemar: so it's official, I also just announced I wont be running for PTL next cycle. | 18:29 |
stevemar | morgan: i just finished reading https://www.morganfainberg.com/blog/2015/09/09/openstack-career-act-3-scene-1/ | 18:30 |
stevemar | dstanek: y u no +A?! | 18:30 |
morgan | I figured a bit more formal post was warranted than a "omg joining" tweet | 18:30 |
dstanek | stevemar: ? | 18:30 |
stevemar | dstanek: https://review.openstack.org/#/c/221473/ | 18:30 |
*** iurygregory has quit IRC | 18:30 | |
dstanek | stevemar: oh, gertty didn't show any other reviews at the time | 18:31 |
*** mflobo has quit IRC | 18:31 | |
morgan | jenkins | 18:31 |
morgan | maybe? | 18:31 |
stevemar | dstanek: tsk tsk gerrty | 18:31 |
bknudson | dolphm: dstanek: https://wiki.openstack.org/wiki/StringFreeze was recently updated | 18:32 |
dstanek | morgan: short and sweet post | 18:33 |
topol | mordred ^ | 18:33 |
dstanek | bknudson: yeah, that's why i was even thinking about it :-) otherwise i would have had to be reminded | 18:33 |
*** pgbridge has joined #openstack-keystone | 18:34 | |
dstanek | morgan: i'm curious to know how it all plays out and what will happen in the second scene | 18:34 |
*** iurygregory has joined #openstack-keystone | 18:34 | |
morgan | dstanek: second scene will be the next post. | 18:35 |
*** mflobo has joined #openstack-keystone | 18:35 | |
morgan | but that will be waiting untill the end of september/early october | 18:35 |
stevemar | dstanek: act 3 scene 2 will be good, it'll all be good! | 18:35 |
stevemar | the rest of the play ends with everyone happy | 18:35 |
*** ankita_wagh has quit IRC | 18:35 | |
bknudson | scene 2 is usually where the hero comes up with a bold plan | 18:36 |
morgan | bknudson: I think I did that.. PTL of keystone ;) | 18:36 |
morgan | oh act ii | 18:36 |
morgan | i do have a bold plan for scene 2 | 18:36 |
morgan | in act three | 18:36 |
bknudson | act 2 is when the hero is in trouble and hits rock bottom | 18:37 |
morgan | hah | 18:37 |
morgan | anyway | 18:37 |
amakarov | morgan, don't forget to take away that rifle from the wall prior to the end of act iii :) | 18:37 |
morgan | LOL | 18:37 |
* bknudson hopes this isn't a 3-act play | 18:38 | |
bknudson | might be taking the analogy too far | 18:38 |
mordred | morgan: great post | 18:39 |
morgan | bknudson: even if it's a 3-act play, you can have many many many scenes | 18:39 |
*** tonytan4ever has quit IRC | 18:40 | |
*** amakarov is now known as amakarov_away | 18:44 | |
*** phalmos has joined #openstack-keystone | 18:52 | |
*** tonytan4ever has joined #openstack-keystone | 18:52 | |
*** jecarey has quit IRC | 18:58 | |
*** nicodemos has quit IRC | 19:00 | |
topol | morgan, Enjoyed your post as well! | 19:04 |
topol | I like how morgan popped up on our internal messaging system and gave henrynash the shock of his life!!! | 19:05 |
morgan | topol: hehe | 19:06 |
topol | even not being with him in the same room I know the exact facial expression henrynash would have made :-) | 19:06 |
*** doug-fish has quit IRC | 19:08 | |
*** doug-fish has joined #openstack-keystone | 19:09 | |
*** dims_ has quit IRC | 19:11 | |
*** dims has joined #openstack-keystone | 19:11 | |
*** doug-fish has quit IRC | 19:13 | |
*** roxanaghe has joined #openstack-keystone | 19:14 | |
*** doug-fish has joined #openstack-keystone | 19:16 | |
*** doug-fish has quit IRC | 19:16 | |
*** doug-fish has joined #openstack-keystone | 19:17 | |
*** roxanaghe has quit IRC | 19:24 | |
morgan | topol: hehe mdrnstm@us.ibm.com | 19:27 |
morgan | topol: *shiftyeyes* | 19:27 |
*** roxanaghe has joined #openstack-keystone | 19:28 | |
dims | morgan: congrats! :) | 19:29 |
*** urulama has quit IRC | 19:31 | |
*** urulama has joined #openstack-keystone | 19:31 | |
topol | morgan, great email choice! | 19:31 |
morgan | topol: :) | 19:31 |
samueldmq | morgan, well .. liked the post as well | 19:32 |
samueldmq | morgan, congrats :) | 19:32 |
morgan | now i jsut have to get through the new hire insanity | 19:32 |
dims | bknudson: morgan: seen this before? devstack with Only /v3 API fails under eventlet (and NOT apache) - http://logs.openstack.org/00/221300/17/check/gate-tempest-dsvm-postgres-full/7a42555//logs/screen-key.txt.gz?#_2015-09-10_19_20_01_494 | 19:33 |
*** roxanaghe has quit IRC | 19:33 | |
morgan | lookinb | 19:34 |
morgan | no i haven't seen that before | 19:34 |
*** geoffarnold has quit IRC | 19:34 | |
*** roxanaghe has joined #openstack-keystone | 19:35 | |
dstanek | do we need to be strict about string freeze in ksc now that we are working on getting translations working? | 19:35 |
morgan | dims: and clearly not happening every single pass, or we'd have a much more explod-y gate | 19:35 |
morgan | dstanek: I'd say yes. but not until translations are actually being done for keystoneclient | 19:35 |
dims | morgan: y, like i said postgres job is using eventlet and i see it only when i disable /v2 | 19:36 |
morgan | dims: hm. | 19:36 |
morgan | dims: oh | 19:36 |
morgan | "default" is the domain ID "Default" is the naem... but weird it happens in eventlet only when v2 is disabled | 19:36 |
*** roxanagh_ has joined #openstack-keystone | 19:36 | |
morgan | i am so happy eventlet is dead to us soon | 19:37 |
*** ninag has joined #openstack-keystone | 19:37 | |
*** ninag has quit IRC | 19:37 | |
dims | morgan: i hear you...same review large ops job under apache - http://logs.openstack.org/00/221300/17/check/gate-tempest-dsvm-large-ops/f979690//logs/apache/keystone.txt.gz#_2015-09-10_19_09_23_331167 | 19:39 |
dims | with /v2 disabled | 19:39 |
stevemar | morgan: da fack, you got to pick your email? | 19:39 |
dstanek | morgan: k. how do we start submitting ksc strings to the translators? i have no idea how that process works | 19:39 |
morgan | dstanek: automatically should be done | 19:40 |
morgan | basicaally it is part of the _() logic and the extract strings | 19:40 |
dims | stevemar: you can add an additional email address alias! | 19:40 |
dstanek | morgan: right but something has to run extract_strings to hand over to the translators | 19:41 |
stevemar | dims: whaaat | 19:41 |
morgan | dstanek: yes. | 19:41 |
dims | stevemar: yep | 19:41 |
dstanek | dims: do they have to be approved? | 19:41 |
topol | morgan, eventlet is already dead to me! | 19:42 |
dstanek | cto@us.ibm.com would be a cool one to snag | 19:42 |
morgan | topol: in a few weeks eventlet in keystone gets rm -rf'd | 19:43 |
dims | dstanek: stevemar: was quite easy to get it, wasn't too cumbersome if i remember right. | 19:43 |
topol | morgan. NIce!!! | 19:43 |
morgan | dims: it was pretty much just automated. | 19:43 |
*** zzzeek has quit IRC | 19:44 | |
ayoung | morgan, you going to move to Poughkeepsie now? | 19:48 |
morgan | no | 19:48 |
morgan | staying in California for the immediate timeframe | 19:48 |
ayoung | RDU? | 19:48 |
morgan | looking at NYC after the winter (i'd move now but tokyo and other timing makes cross country hard) | 19:48 |
ayoung | morgan, congrats...again | 19:49 |
morgan | :) | 19:49 |
ayoung | that is a lot of IBMers on Keystone now. | 19:49 |
morgan | yes there is | 19:49 |
stevemar | yeah, too many, we should eliminate a few -_- | 19:51 |
dstanek | that's a harsh punishment just for working at IBM | 19:52 |
ayoung | dstanek, I think the punishment for working on Keystone is that you might end up at IBM | 19:54 |
ayoung | Unless you work at IBM already. Then you end up at Rackspace | 19:54 |
stevemar | hehe | 19:54 |
stevemar | i doubt topol is going anywhere | 19:54 |
dstanek | lol | 19:54 |
*** jecarey has joined #openstack-keystone | 19:54 | |
dstanek | stevemar: once they make you a king it's hard to step away | 19:55 |
stevemar | lol | 19:55 |
*** sdake has joined #openstack-keystone | 19:55 | |
lbragstad | ayoung: lol | 19:56 |
topol | Having way too much fun to leave IBM. you havent lived until drinking and strategizing with mordred and the bluebox folks | 19:57 |
ayoung | stevemar, topol hardly can claim to work on Keystone. Approving specs just adds to the backlog of work to be done for Keystone. | 19:57 |
topol | ayoung, ouch | 19:57 |
ayoung | topol, I didn't need to go to IBM to do that | 19:57 |
ayoung | topol, its ok, these days I can't even get specs approved | 19:57 |
topol | I'll try harder. They made me buy companies. thankfully that work is done for a while | 19:57 |
*** jerrygb has quit IRC | 19:58 | |
morgan | ok now that the fun of the twitter storm is done.... i need breakfast^wlunch | 19:59 |
topol | and then I had to recruit all these folks... It all took time... But was a great investment of my time | 19:59 |
*** roxanagh_ has quit IRC | 20:00 | |
stevemar | topol: we had a rebuilding year is all! | 20:00 |
ayoung | topol, You now pay for the effort you were getting for free before | 20:01 |
stevemar | rebuilding cycle* | 20:01 |
stevemar | just like the steelers, we were rebuilding! | 20:01 |
*** gyee has joined #openstack-keystone | 20:01 | |
*** ChanServ sets mode: +v gyee | 20:01 | |
*** sdake_ has joined #openstack-keystone | 20:02 | |
*** elmiko has joined #openstack-keystone | 20:05 | |
*** sdake has quit IRC | 20:05 | |
*** pnavarro has joined #openstack-keystone | 20:07 | |
elmiko | hi all, i'm running into an issue creating trusts. i attempt to create the trust and i'm passing in the role name to be delegated, but i am getting an error back from keystone: | 20:08 |
elmiko | {"error": {"message": "Could not find role: 256950ce723741028122c1eb445abbc1", "code": 404, "title": "Not Found"}} | 20:08 |
elmiko | i passed the role in by name, and that uuid is the correct id for the role, but why would keystone report not found? | 20:09 |
*** dave-mccowan has quit IRC | 20:09 | |
stevemar | elmiko: that's strange, how are you creating the trust? | 20:09 |
elmiko | stevemar: using the keystoneclient, i can paste the rest body | 20:10 |
stevemar | sure, use a paste site | 20:10 |
elmiko | yea, 1sec | 20:10 |
elmiko | http://paste.openstack.org/show/455625/ | 20:11 |
elmiko | that's what our logs show | 20:11 |
morgan | jamielennox|away: chatted with dhellmann, we'll do v2.0 work on master once liberty is forked for keystoneclient | 20:13 |
morgan | no feature branch. | 20:13 |
morgan | it does mean things will be slow to merge in some cases. | 20:14 |
*** csoukup has quit IRC | 20:19 | |
*** ankita_wagh has joined #openstack-keystone | 20:26 | |
*** pnavarro has quit IRC | 20:28 | |
*** jerrygb has joined #openstack-keystone | 20:30 | |
*** ParsectiX has quit IRC | 20:31 | |
*** dave-mccowan has joined #openstack-keystone | 20:31 | |
*** ParsectiX has joined #openstack-keystone | 20:33 | |
openstackgerrit | Merged openstack/python-keystoneclient: Move pot file for traslation https://review.openstack.org/221473 | 20:36 |
*** aix has joined #openstack-keystone | 20:40 | |
*** pnavarro has joined #openstack-keystone | 20:41 | |
*** gordc has quit IRC | 20:44 | |
*** topol has quit IRC | 20:49 | |
*** geoffarnold has joined #openstack-keystone | 20:51 | |
*** tonytan4ever has quit IRC | 20:52 | |
dolphm | bknudson: why is this critical? https://bugs.launchpad.net/keystone/+bug/1494330 | 20:54 |
openstack | Launchpad bug 1494330 in Keystone "Requirements update is failing" [Critical,Confirmed] - Assigned to Brant Knudson (blk-u) | 20:54 |
bknudson | dolphm: we can't update the requirements without it. | 20:54 |
stevemar | dolphm: we need that to ship? | 20:54 |
*** ParsectiX has quit IRC | 20:55 | |
bknudson | dolphm: although I agree it's not critical or even valid for keystone | 20:55 |
dolphm | stevemar: blocking release is valid, i suppose | 20:55 |
bknudson | it's not a bug in keystone | 20:55 |
dolphm | bknudson: is there no LP project to track against openstack/requirements? i was looking for one the other day | 20:55 |
*** jasonsb has quit IRC | 20:55 | |
dolphm | never checked infra config though | 20:55 |
bknudson | dolphm: no, I looked for one and didn't find it | 20:55 |
bknudson | I asked on infra and no response | 20:55 |
bknudson | I checked the README and there's no info on where to post bugs | 20:56 |
*** ankita_w_ has joined #openstack-keystone | 20:57 | |
bknudson | https://bugs.launchpad.net/openstack-ci -- no bugs there | 20:57 |
dolphm | stevemar: "the gating on this unmerged patch won't pass" just didn't strike me as anywhere near critical | 20:57 |
dolphm | but we do need to sync before releaswe | 20:57 |
*** tonytan4ever has joined #openstack-keystone | 20:57 | |
bknudson | I don't care what the importance is on it. | 20:58 |
*** raildo is now known as raildo-afk | 20:58 | |
*** ankita_wagh has quit IRC | 20:59 | |
bknudson | when I changed it to critical the page wasn't showing that it was set to medium already | 20:59 |
dolphm | bknudson: i was surprised that you set the priority on a bug at all ;) | 20:59 |
dolphm | bknudson: yeah, we did that at the same time. just wanted to follow up and better understand the impact | 20:59 |
*** csoukup has joined #openstack-keystone | 21:04 | |
*** pnavarro has quit IRC | 21:05 | |
*** dave-mccowan has quit IRC | 21:06 | |
openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Remove shadowed ConnectionError https://review.openstack.org/222366 | 21:11 |
*** sdake_ has quit IRC | 21:13 | |
*** samueldmq has quit IRC | 21:13 | |
*** jasonsb has joined #openstack-keystone | 21:14 | |
*** samueldmq has joined #openstack-keystone | 21:15 | |
*** urulama is now known as urulama__ | 21:16 | |
*** edmondsw has quit IRC | 21:19 | |
*** ayoung has quit IRC | 21:21 | |
*** mylu has joined #openstack-keystone | 21:22 | |
*** tiny-hands has quit IRC | 21:24 | |
*** sdake has joined #openstack-keystone | 21:26 | |
*** jsavak has quit IRC | 21:31 | |
*** jsavak has joined #openstack-keystone | 21:31 | |
*** mylu has quit IRC | 21:33 | |
*** jecarey has quit IRC | 21:38 | |
*** geoffarnold has quit IRC | 21:41 | |
*** urulama__ has quit IRC | 21:41 | |
*** urulama__ has joined #openstack-keystone | 21:42 | |
*** phalmos has quit IRC | 21:43 | |
*** geoffarnold has joined #openstack-keystone | 21:44 | |
elmiko | stevemar: pbkac error, sorry for the wasted time | 21:50 |
stevemar | elmiko: aint that always the case! | 21:51 |
openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Docstring updates https://review.openstack.org/208213 | 21:51 |
elmiko | stevemar: sigh.. yea. but i learned more about the keystone code, so that's a win =) | 21:51 |
*** tonytan4ever has quit IRC | 21:54 | |
*** mylu has joined #openstack-keystone | 21:59 | |
*** bknudson has quit IRC | 22:04 | |
*** slberger has left #openstack-keystone | 22:08 | |
*** geoffarnold has quit IRC | 22:09 | |
*** marzif has joined #openstack-keystone | 22:10 | |
*** marzif_ has joined #openstack-keystone | 22:18 | |
*** sigmavirus24 is now known as sigmavirus24_awa | 22:18 | |
*** marzif has quit IRC | 22:18 | |
*** pgbridge has quit IRC | 22:19 | |
*** pgbridge has joined #openstack-keystone | 22:20 | |
*** dims_ has joined #openstack-keystone | 22:20 | |
*** ayoung has joined #openstack-keystone | 22:21 | |
*** ChanServ sets mode: +v ayoung | 22:21 | |
*** henrynash has quit IRC | 22:21 | |
*** dims has quit IRC | 22:23 | |
*** geoffarnold has joined #openstack-keystone | 22:24 | |
*** doug-fish has quit IRC | 22:27 | |
*** ebalduf_ has joined #openstack-keystone | 22:30 | |
*** ebalduf_ has quit IRC | 22:34 | |
*** tonytan4ever has joined #openstack-keystone | 22:35 | |
*** linkmark has quit IRC | 22:38 | |
*** dave-mccowan has joined #openstack-keystone | 22:39 | |
*** mylu has quit IRC | 22:42 | |
*** hrou has quit IRC | 22:46 | |
*** ankita_w_ has quit IRC | 22:47 | |
*** ankita_wagh has joined #openstack-keystone | 22:47 | |
*** mylu has joined #openstack-keystone | 22:48 | |
*** mylu has quit IRC | 22:49 | |
*** mylu has joined #openstack-keystone | 22:49 | |
*** ankita_w_ has joined #openstack-keystone | 22:52 | |
*** ankita_wagh has quit IRC | 22:52 | |
*** marzif_ has quit IRC | 22:52 | |
*** tonytan4ever has quit IRC | 22:56 | |
*** bknudson has joined #openstack-keystone | 23:05 | |
*** ChanServ sets mode: +v bknudson | 23:05 | |
*** samueldmq has quit IRC | 23:06 | |
*** roxanagh_ has joined #openstack-keystone | 23:07 | |
*** mylu has quit IRC | 23:07 | |
*** ayoung has quit IRC | 23:10 | |
*** arunkant_ has quit IRC | 23:12 | |
*** geoffarnold has quit IRC | 23:15 | |
*** browne has quit IRC | 23:20 | |
*** jsavak has quit IRC | 23:28 | |
*** dave-mccowan has quit IRC | 23:39 | |
*** hrou has joined #openstack-keystone | 23:49 | |
*** shoutm has joined #openstack-keystone | 23:51 | |
*** fangzhou has joined #openstack-keystone | 23:53 | |
*** aix has quit IRC | 23:53 | |
*** geoffarnold has joined #openstack-keystone | 23:55 | |
*** tonytan4ever has joined #openstack-keystone | 23:57 | |
*** roxanagh_ has quit IRC | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!