| *** zzzeek has quit IRC | 00:11 | |
| *** mylu has quit IRC | 00:13 | |
| *** mylu has joined #openstack-keystone | 00:14 | |
| *** btully has quit IRC | 00:14 | |
| *** hrou has joined #openstack-keystone | 00:15 | |
| *** shoutm has quit IRC | 00:17 | |
| *** stevemar has joined #openstack-keystone | 00:18 | |
| *** ChanServ sets mode: +v stevemar | 00:18 | |
| *** shoutm has joined #openstack-keystone | 00:20 | |
| *** shadower has quit IRC | 00:23 | |
| *** shadower has joined #openstack-keystone | 00:23 | |
| *** topol has joined #openstack-keystone | 00:26 | |
| *** ChanServ sets mode: +v topol | 00:26 | |
| *** shoutm_ has joined #openstack-keystone | 00:29 | |
| *** shoutm has quit IRC | 00:32 | |
| *** darrenc is now known as darrenc_afk | 00:37 | |
| *** markvoelker has joined #openstack-keystone | 00:37 | |
| *** dims_ has joined #openstack-keystone | 00:38 | |
| *** lhcheng has quit IRC | 00:39 | |
| *** david-lyle has quit IRC | 00:40 | |
| *** zzzeek has joined #openstack-keystone | 00:41 | |
| *** markvoelker has quit IRC | 00:42 | |
| *** zzzeek has quit IRC | 00:42 | |
| *** dims_ has quit IRC | 00:43 | |
| *** dims_ has joined #openstack-keystone | 00:43 | |
| *** david-lyle has joined #openstack-keystone | 00:44 | |
| *** martinus__ has quit IRC | 00:45 | |
| *** ankita_wagh has quit IRC | 00:46 | |
| *** markvoelker has joined #openstack-keystone | 00:51 | |
| *** stevemar has quit IRC | 00:55 | |
| *** stevemar has joined #openstack-keystone | 00:55 | |
| *** ChanServ sets mode: +v stevemar | 00:55 | |
| *** stevemar has quit IRC | 00:58 | |
| dstanek | jamielennox: ok, thx. my openstack-ansible cluster is misbehaving because the openstack client is loading plugins with keyauth1 | 00:58 |
|---|---|---|
| *** Guest60900 is now known as tsymanczyk | 00:58 | |
| dstanek | jamielennox: osc registers auth plugins using the ksc namespace, but for whatever reason ksa1 is being invoked and it expects plugins to be registered with its namespace | 00:59 |
| *** darrenc_afk is now known as darrenc | 01:00 | |
| *** su_zhang has quit IRC | 01:00 | |
| dstanek | hmmm.....the version of os_client_config i have installed is using ksa1 directly | 01:00 |
| jamielennox | dstanek: oh, yea os_client_config updated itself for ksa | 01:01 |
| jamielennox | i haven't heard the conclusion on this, mordred, dtroyer, stevemar were debating it last night | 01:01 |
| jamielennox | IMO we don't release anything with a ksa dependency for liberty | 01:02 |
| jamielennox | that at least gives us some time to work through the transition early next cycle | 01:02 |
| jamielennox | so if you can i'd pin os_client_config below what the last release was | 01:02 |
| jamielennox | i'm surprised this isn't having more effect on the gate | 01:02 |
| dstanek | the only problem i've run into so far is that osc can't load the correct plugin. i've not tried other clients | 01:03 |
| *** martinus__ has joined #openstack-keystone | 01:04 | |
| *** _cjones_ has quit IRC | 01:12 | |
| *** dims_ has quit IRC | 01:27 | |
| *** ankita_wagh has joined #openstack-keystone | 01:27 | |
| *** dims_ has joined #openstack-keystone | 01:29 | |
| *** davechen has joined #openstack-keystone | 01:30 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Make a new AuthToken object https://review.openstack.org/224954 | 01:30 |
| *** dims_ has quit IRC | 01:37 | |
| *** tonytan4ever has joined #openstack-keystone | 01:39 | |
| *** stevemar has joined #openstack-keystone | 01:42 | |
| *** ChanServ sets mode: +v stevemar | 01:42 | |
| *** erhudy1 has quit IRC | 01:51 | |
| *** topol has quit IRC | 01:57 | |
| *** topol has joined #openstack-keystone | 01:58 | |
| *** ChanServ sets mode: +v topol | 01:58 | |
| *** mylu has quit IRC | 02:05 | |
| *** csoukup has joined #openstack-keystone | 02:06 | |
| *** geoffarnold is now known as geoffarnoldX | 02:07 | |
| *** sdake_ has joined #openstack-keystone | 02:10 | |
| *** dyasny has quit IRC | 02:11 | |
| *** sdake has quit IRC | 02:13 | |
| *** diazjf has joined #openstack-keystone | 02:16 | |
| *** mylu has joined #openstack-keystone | 02:16 | |
| openstackgerrit | Merged openstack/keystone: Issue deprecation warning if domain_id not specified in create call https://review.openstack.org/209848 | 02:21 |
| *** gyee has quit IRC | 02:30 | |
| *** ankita_wagh has quit IRC | 02:37 | |
| *** shoutm_ has quit IRC | 02:38 | |
| *** erhudy1 has joined #openstack-keystone | 02:39 | |
| *** lhcheng has joined #openstack-keystone | 02:40 | |
| *** ChanServ sets mode: +v lhcheng | 02:40 | |
| stevemar | jamielennox: poke for when you're around | 02:40 |
| jamielennox | stevemar: maybe | 02:40 |
| stevemar | jamielennox: hi hi - i noticed in the keystoneauth repo that the oidc plugin didn't make it | 02:41 |
| stevemar | was that intentional? | 02:41 |
| jamielennox | the oidc plugin is there i think, just not the launcher | 02:41 |
| stevemar | hmm https://github.com/openstack/keystoneauth/tree/master/keystoneauth1 | 02:41 |
| stevemar | i'm looking here: https://github.com/openstack/keystoneauth/tree/master/keystoneauth1/identity/v3 | 02:41 |
| jamielennox | oh - maybe its not | 02:41 |
| stevemar | i see the basic federation one | 02:41 |
| jamielennox | no, no reason | 02:42 |
| stevemar | jamielennox: alright, i'll propose a move | 02:42 |
| stevemar | jamielennox: someone started a patch that implements a new flow to oidc, but did it against ksc, i wanted to suggest doing it against ksa but then... | 02:42 |
| jamielennox | stevemar: anything that needs to be improved now's your chance | 02:43 |
| stevemar | jamielennox: yep, i'm going to propose a move then a refactor... then the new flow | 02:44 |
| *** lhcheng has quit IRC | 02:45 | |
| *** lhcheng has joined #openstack-keystone | 02:45 | |
| *** ChanServ sets mode: +v lhcheng | 02:45 | |
| *** richm has quit IRC | 02:46 | |
| *** mylu has quit IRC | 02:48 | |
| *** shoutm has joined #openstack-keystone | 02:49 | |
| *** su_zhang has joined #openstack-keystone | 02:50 | |
| *** mylu has joined #openstack-keystone | 02:51 | |
| *** lhcheng_ has joined #openstack-keystone | 02:54 | |
| *** lhcheng has quit IRC | 02:54 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystonemiddleware: only make token invalid when it really is https://review.openstack.org/217373 | 02:57 |
| stevemar | jamielennox: we got rid of all the conf/cfg stuff that ksc handled? | 02:57 |
| *** ankita_wagh has joined #openstack-keystone | 02:57 | |
| *** markvoelker has quit IRC | 03:01 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystonemiddleware: Cleanup a few auth_token comments https://review.openstack.org/224970 | 03:02 |
| *** humble_ has joined #openstack-keystone | 03:02 | |
| jamielennox | stevemar: it's there, just done differently | 03:03 |
| jamielennox | stevemar: it got moved under the loading/ directory | 03:03 |
| *** edmondsw has quit IRC | 03:04 | |
| *** mylu has quit IRC | 03:05 | |
| stevemar | jamielennox: the federation options are not there? | 03:06 |
| jamielennox | stevemar: they may not have come over :( | 03:06 |
| stevemar | oh wait - they are | 03:06 |
| stevemar | oofff, this is not an easy copy/paste | 03:07 |
| jamielennox | nope | 03:10 |
| jamielennox | probably why it got left behind | 03:10 |
| jamielennox | it's not _that_ different though | 03:10 |
| jamielennox | it just makes you think about what's the auth plugin and what is a loading option which i don't think people did in ksc | 03:11 |
| humble_ | jamielennox: I find that auth_plugin is not generated by oslo-config-generator. | 03:12 |
| jamielennox | humble_: regarding auth_token middlewarew? | 03:12 |
| humble_ | jamielennox: yes | 03:13 |
| jamielennox | hmmm | 03:13 |
| humble_ | jamielennox: I think it is a bug | 03:13 |
| stevemar | jamielennox: no tests for those options? | 03:17 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Ensure auth_plugin options are in generated CONF https://review.openstack.org/224975 | 03:18 |
| jamielennox | humble_: does that fix it for you ^ | 03:18 |
| jamielennox | stevemar: which opts? | 03:18 |
| stevemar | FederatedBase options | 03:18 |
| humble_ | jamielennox: Thank you | 03:18 |
| jamielennox | stevemar: no idea - they don't work? | 03:18 |
| *** tonytan4ever has quit IRC | 03:19 | |
| stevemar | jamielennox: no idea, haven't tried yt | 03:19 |
| jamielennox | that one probably needs a bug filed... | 03:19 |
| *** jecarey has joined #openstack-keystone | 03:20 | |
| *** mylu has joined #openstack-keystone | 03:22 | |
| *** dims_ has joined #openstack-keystone | 03:22 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Ensure auth_plugin options are in generated CONF https://review.openstack.org/224975 | 03:24 |
| *** geoffarnoldX is now known as geoffarnold | 03:27 | |
| *** dims_ has quit IRC | 03:28 | |
| *** EinstCrazy has joined #openstack-keystone | 03:29 | |
| *** sdake has joined #openstack-keystone | 03:29 | |
| *** sdake_ has quit IRC | 03:32 | |
| *** cloud_zhanglei has joined #openstack-keystone | 03:36 | |
| *** cloud_zhanglei has quit IRC | 03:38 | |
| *** sdake_ has joined #openstack-keystone | 03:38 | |
| *** sdake_ has quit IRC | 03:39 | |
| *** sdake_ has joined #openstack-keystone | 03:40 | |
| *** sdake has quit IRC | 03:41 | |
| *** erhudy1 has quit IRC | 03:42 | |
| *** ankita_wagh has quit IRC | 03:45 | |
| *** sdake_ is now known as sdake | 03:48 | |
| *** jecarey has quit IRC | 03:52 | |
| *** ankita_wagh has joined #openstack-keystone | 03:55 | |
| *** lhcheng_ has quit IRC | 03:59 | |
| *** shoutm_ has joined #openstack-keystone | 04:00 | |
| *** markvoelker has joined #openstack-keystone | 04:02 | |
| *** shoutm has quit IRC | 04:02 | |
| *** markvoelker has quit IRC | 04:06 | |
| *** mylu has quit IRC | 04:18 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: add openid connect plugins https://review.openstack.org/224993 | 04:19 |
| *** lhcheng has joined #openstack-keystone | 04:22 | |
| *** ChanServ sets mode: +v lhcheng | 04:22 | |
| *** ankita_wagh has quit IRC | 04:30 | |
| openstackgerrit | Craige McWhirter proposed openstack/python-keystoneclient: Add drivers to the documentation https://review.openstack.org/218099 | 04:36 |
| jamielennox | stevemar: reviewed | 04:40 |
| stevemar | jamielennox: uh... it wasn't quite ready | 04:40 |
| jamielennox | stevemar: i saw | 04:41 |
| stevemar | jamielennox: i just wanted to give this guy a heads up: https://review.openstack.org/#/c/223946/ | 04:41 |
| stevemar | that he should feel free to override my patch | 04:41 |
| stevemar | instead of proceeding with that one, since i assume that one is a hard -2 with the reason "no more plugins" | 04:42 |
| jamielennox | not sure about the subclass there | 04:42 |
| jamielennox | you could have a base OIDC plugin and pass it a method which is either password or authentication code | 04:42 |
| jamielennox | probably doesn't matter unless we see people wanting to use methods other than what we do upstream | 04:44 |
| *** lhcheng_ has joined #openstack-keystone | 04:44 | |
| stevemar | i'm good with either | 04:47 |
| stevemar | this is what i thought of at first | 04:47 |
| *** lhcheng has quit IRC | 04:47 | |
| *** briancline has joined #openstack-keystone | 04:50 | |
| briancline | sometime in the last few days, fresh openstackclient installs from pypi started complaining about not being able to find keystoneclient's auth plugins... is this a known issue? | 04:52 |
| openstackgerrit | Craige McWhirter proposed openstack/python-keystoneclient: Add drivers to the documentation https://review.openstack.org/218099 | 04:53 |
| *** shoutm has joined #openstack-keystone | 04:55 | |
| *** shoutm_ has quit IRC | 04:59 | |
| *** csoukup has quit IRC | 05:01 | |
| *** kiran-r has joined #openstack-keystone | 05:01 | |
| *** geoffarnold is now known as geoffarnoldX | 05:03 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor: Don't hard code the error code https://review.openstack.org/224545 | 05:04 |
| *** kiran-r has quit IRC | 05:07 | |
| briancline | nevermind, the problem is os-client-config 1.7.x. downgrading to 1.6.x worked... | 05:09 |
| *** urulama__ is now known as urulama | 05:11 | |
| stevemar | jamielennox: i hate the @utils.positions thing | 05:13 |
| jamielennox | stevemar: i wish it was everywhere | 05:13 |
| stevemar | briancline: yeah, its an occ thing | 05:13 |
| stevemar | still working on getting it fixed | 05:13 |
| stevemar | jamielennox: it becomes hard when subclassing things | 05:14 |
| jamielennox | why is it different to otherwise using the lib? | 05:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: add openid connect plugins https://review.openstack.org/224993 | 05:14 |
| jamielennox | s/lib/object | 05:15 |
| briancline | stevemar: thanks, yeah, just found the bug report and subscribed to get email bombed about it | 05:15 |
| *** shoutm_ has joined #openstack-keystone | 05:17 | |
| *** shoutm has quit IRC | 05:17 | |
| *** shoutm has joined #openstack-keystone | 05:20 | |
| *** lost_ing has quit IRC | 05:21 | |
| *** shoutm_ has quit IRC | 05:22 | |
| *** lost_ing has joined #openstack-keystone | 05:22 | |
| openstackgerrit | Craige McWhirter proposed openstack/python-keystoneclient: Add plugin doco generated with stevedore.sphinxext https://review.openstack.org/218099 | 05:30 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor: Don't hard code the error code https://review.openstack.org/224545 | 05:30 |
| stevemar | jamielennox: so i don't need the @property stuff any longer? | 05:30 |
| stevemar | neat | 05:30 |
| jamielennox | stevemar: not sure why you ever did, they are public attributes | 05:31 |
| stevemar | nope! | 05:31 |
| *** openstackgerrit has quit IRC | 05:31 | |
| stevemar | it was in the old one, so i moved it over | 05:31 |
| *** openstackgerrit has joined #openstack-keystone | 05:32 | |
| jamielennox | i'm surprised it didn't go into an infinite recursion | 05:33 |
| jamielennox | or maybe it did and just noone tested it | 05:33 |
| *** tonytan4ever has joined #openstack-keystone | 05:37 | |
| *** tonytan4ever has quit IRC | 05:41 | |
| jamielennox | i can still never figure out the project-config repo, every time i get it wrong | 05:42 |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: add openid connect plugins https://review.openstack.org/224993 | 05:44 |
| stevemar | jamielennox: i feel like that with positional args | 05:44 |
| jamielennox | lol | 05:44 |
| jamielennox | they're not that bad | 05:44 |
| jamielennox | stevemar: is this the occ bug we're using | 05:46 |
| jamielennox | https://bugs.launchpad.net/os-client-config/+bug/1496624 | 05:46 |
| openstack | Launchpad bug 1496624 in os-client-config "NoMatchingPlugin: The plugin osc_password could not be found" [Undecided,New] | 05:46 |
| stevemar | i still dont get it | 05:46 |
| stevemar | jamielennox: yes | 05:46 |
| stevemar | err | 05:46 |
| stevemar | no | 05:46 |
| *** lhcheng_ has quit IRC | 05:46 | |
| stevemar | i am using this | 05:47 |
| stevemar | https://bugs.launchpad.net/python-openstackclient/+bug/1496689 | 05:47 |
| openstack | Launchpad bug 1496689 in python-openstackclient "osc unit tests fail with newest occ and keystoneauth" [High,New] | 05:47 |
| stevemar | marked the one you mention as a dupe | 05:47 |
| *** kiran-r has joined #openstack-keystone | 05:48 | |
| jamielennox | any idea what the plan is there, i've got another group asking me what keystoneauth is and how is it breaking everyone | 05:49 |
| *** sdake has quit IRC | 05:49 | |
| stevemar | jamielennox: not really tbh | 05:49 |
| *** ankita_wagh has joined #openstack-keystone | 05:49 | |
| stevemar | aside from 'fix it' | 05:50 |
| stevemar | monty had a good patch https://review.openstack.org/#/c/224444/4 | 05:50 |
| stevemar | but its not passing | 05:50 |
| jamielennox | yea, i don't think it's worth it | 05:50 |
| jamielennox | i think we release a new os-client-config which reverts the ksa change | 05:50 |
| jamielennox | and wait till we have the liberty split | 05:50 |
| jamielennox | otherwise we have to ensure that all the clients that osc depends on are going to play nice with ksa plugins rather than ksc plugins | 05:51 |
| jamielennox | which should be fine, but not something i want to mess with this close to a release | 05:51 |
| stevemar | right | 05:52 |
| stevemar | depending on ksa for occ may have been ambitious | 05:52 |
| jamielennox | i always forget about the osc/occ thing | 05:52 |
| jamielennox | i think because i don't like how it's done i block it out | 05:52 |
| stevemar | we all do that to certain thinsg | 05:52 |
| stevemar | thigns | 05:52 |
| stevemar | things**** | 05:52 |
| stevemar | fack | 05:52 |
| stevemar | like me and typing? | 05:53 |
| jamielennox | stevemar: hopefully https://review.openstack.org/#/c/212386/2 will help | 05:54 |
| *** hrou has quit IRC | 05:56 | |
| jamielennox | stevemar: the problem with mordred's patch is that under ksa there is no osc_password plugin so it's all going to fall apart | 06:00 |
| jamielennox | ksa/occ can't load something it knows nothing about | 06:01 |
| *** shoutm has quit IRC | 06:03 | |
| *** markvoelker has joined #openstack-keystone | 06:03 | |
| *** shoutm has joined #openstack-keystone | 06:06 | |
| *** markvoelker has quit IRC | 06:07 | |
| *** topol has quit IRC | 06:07 | |
| *** stevemar has quit IRC | 06:09 | |
| *** stevemar has joined #openstack-keystone | 06:11 | |
| *** ChanServ sets mode: +v stevemar | 06:11 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/224242 | 06:12 |
| *** exploreshaifali has joined #openstack-keystone | 06:12 | |
| *** ankita_wagh has quit IRC | 06:17 | |
| *** urulama has quit IRC | 06:24 | |
| *** urulama has joined #openstack-keystone | 06:24 | |
| *** dolphm has quit IRC | 06:26 | |
| *** dolphm has joined #openstack-keystone | 06:27 | |
| *** eglute has quit IRC | 06:27 | |
| *** kiran-r has quit IRC | 06:32 | |
| *** kiran-r has joined #openstack-keystone | 06:33 | |
| *** eglute has joined #openstack-keystone | 06:33 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor: Don't hard code the error code https://review.openstack.org/224545 | 06:38 |
| stevemar | jamielennox: i think reverting occ might be the right thing to do | 06:40 |
| *** shoutm has quit IRC | 06:40 | |
| *** e0ne has joined #openstack-keystone | 06:42 | |
| *** e0ne has quit IRC | 06:45 | |
| *** shoutm has joined #openstack-keystone | 06:45 | |
| *** e0ne has joined #openstack-keystone | 06:48 | |
| mordred | wait, why? | 06:48 |
| mordred | we just set occ to not validate when we create the object, then osc will continue as normal | 06:49 |
| *** lsmola has joined #openstack-keystone | 06:50 | |
| mordred | I'm about to take off ... lemme make a patch that should allow non revert and see what you think | 06:50 |
| mordred | because the only reason ksa code is being executed is because of occ arg validation. | 06:54 |
| *** e0ne has quit IRC | 06:55 | |
| mordred | we certainly don't need to port osc to ksa this instant | 06:58 |
| *** e0ne has joined #openstack-keystone | 06:59 | |
| *** su_zhang has quit IRC | 07:00 | |
| *** woodster_ has quit IRC | 07:09 | |
| *** e0ne has quit IRC | 07:10 | |
| *** browne has quit IRC | 07:13 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: check if tokenless auth is configured before validating https://review.openstack.org/225039 | 07:15 |
| *** HenryG has quit IRC | 07:21 | |
| *** diazjf has quit IRC | 07:27 | |
| *** EinstCrazy has quit IRC | 07:33 | |
| *** pnavarro has joined #openstack-keystone | 07:36 | |
| *** e0ne has joined #openstack-keystone | 07:37 | |
| *** martinus__ is now known as martin-h | 07:39 | |
| *** aix has joined #openstack-keystone | 07:42 | |
| *** e0ne has quit IRC | 07:44 | |
| jamielennox | mordred: that would work for now, if ksa doesn't find a plugin with the supplied name then no validation is performed, osc will fall back to using the existing loading which is ksc based | 07:48 |
| jamielennox | this is a possible future compatibility issue in that we'll turn it on one day - but if we're ok with that it'll solve the problem for now | 07:49 |
| *** stevemar has quit IRC | 07:49 | |
| jamielennox | however is it possible to for os-client-config to stable/liberty now so we can keep working on these ksa things without getting in the way of liberty in future | 07:49 |
| *** stevemar has joined #openstack-keystone | 07:50 | |
| *** ChanServ sets mode: +v stevemar | 07:50 | |
| jamielennox | i'd be happy to not see ksa get included in the official liberty release at all | 07:50 |
| *** stevemar has quit IRC | 07:52 | |
| *** tsymancz2k has quit IRC | 07:54 | |
| *** fhubik has joined #openstack-keystone | 07:59 | |
| *** markvoelker has joined #openstack-keystone | 08:04 | |
| *** jistr has joined #openstack-keystone | 08:07 | |
| *** markvoelker has quit IRC | 08:08 | |
| *** topol has joined #openstack-keystone | 08:08 | |
| *** ChanServ sets mode: +v topol | 08:08 | |
| *** HenryG has joined #openstack-keystone | 08:12 | |
| *** aix has quit IRC | 08:13 | |
| *** topol has quit IRC | 08:13 | |
| *** HenryG has quit IRC | 08:16 | |
| *** henrynash has quit IRC | 08:25 | |
| *** aix has joined #openstack-keystone | 08:27 | |
| *** dims_ has joined #openstack-keystone | 08:30 | |
| *** HenryG has joined #openstack-keystone | 08:30 | |
| *** dims_ has quit IRC | 08:34 | |
| *** shoutm has quit IRC | 08:36 | |
| *** tsymancz2k has joined #openstack-keystone | 08:38 | |
| *** chlong has quit IRC | 08:47 | |
| *** stevemar has joined #openstack-keystone | 08:51 | |
| *** ChanServ sets mode: +v stevemar | 08:51 | |
| *** kiran-r has quit IRC | 08:54 | |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: Deprecate class AuthTokenPlugin properly https://review.openstack.org/220509 | 08:55 |
| *** kiran-r has joined #openstack-keystone | 09:01 | |
| *** henrynash has joined #openstack-keystone | 09:05 | |
| *** ChanServ sets mode: +v henrynash | 09:05 | |
| *** stevemar has quit IRC | 09:05 | |
| *** exploreshaifali has quit IRC | 09:15 | |
| *** henrynash has quit IRC | 09:17 | |
| openstackgerrit | Konstantin Maximov proposed openstack/keystone: Add test for domains list filtering and limiting https://review.openstack.org/207456 | 09:20 |
| *** fhubik is now known as fhubik_afk | 09:23 | |
| *** e0ne has joined #openstack-keystone | 09:27 | |
| *** fhubik_afk is now known as fhubik | 09:28 | |
| *** dims_ has joined #openstack-keystone | 09:32 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: check if tokenless auth is configured before validating https://review.openstack.org/225039 | 09:34 |
| *** dims_ has quit IRC | 09:36 | |
| *** rob_d has joined #openstack-keystone | 09:39 | |
| *** davechen has left #openstack-keystone | 09:44 | |
| rob_d | hopefully someone can help an awful sys admin- Is is possible to sync keystone domain specific users (ldap) to the sql database, that is, so their usernames are readable in keystone.users table, the docs state that this command "keystone-manage domain_config_upload --domain-name DOMAINA" can be userd to 'migrate' from domain specific to sql, futhermore it states that "Once uploaded, these domain-configuration options will be visible via the Identi | 09:49 |
| *** dims_ has joined #openstack-keystone | 09:50 | |
| *** fhubik has quit IRC | 09:58 | |
| *** fhubik has joined #openstack-keystone | 09:59 | |
| *** markvoelker has joined #openstack-keystone | 10:04 | |
| *** markvoelker has quit IRC | 10:10 | |
| *** urulama has quit IRC | 10:18 | |
| *** urulama has joined #openstack-keystone | 10:18 | |
| *** exploreshaifali has joined #openstack-keystone | 10:22 | |
| *** fhubik has quit IRC | 10:40 | |
| *** exploreshaifali has quit IRC | 10:51 | |
| *** flwang has quit IRC | 10:53 | |
| *** katkapilatova has joined #openstack-keystone | 11:02 | |
| *** e0ne has quit IRC | 11:10 | |
| *** flwang has joined #openstack-keystone | 11:10 | |
| *** markvoelker has joined #openstack-keystone | 11:21 | |
| *** kiran-r has quit IRC | 11:22 | |
| *** fhubik has joined #openstack-keystone | 11:24 | |
| *** markvoelker has quit IRC | 11:26 | |
| *** ChanServ sets mode: +o dolphm | 11:31 | |
| *** e0ne has joined #openstack-keystone | 11:33 | |
| *** stevemar has joined #openstack-keystone | 11:33 | |
| *** ChanServ sets mode: +v stevemar | 11:33 | |
| *** stevemar has quit IRC | 11:37 | |
| *** urulama has quit IRC | 11:38 | |
| *** urulama has joined #openstack-keystone | 11:39 | |
| *** gordc has joined #openstack-keystone | 11:41 | |
| *** tellesnobrega is now known as tellesnobrega_af | 11:45 | |
| *** tellesnobrega_af is now known as tellesnobrega | 11:46 | |
| *** exploreshaifali has joined #openstack-keystone | 11:47 | |
| *** chlong has joined #openstack-keystone | 12:06 | |
| *** chlong has quit IRC | 12:07 | |
| *** chlong has joined #openstack-keystone | 12:07 | |
| *** topol has joined #openstack-keystone | 12:11 | |
| *** ChanServ sets mode: +v topol | 12:11 | |
| *** tobasco has quit IRC | 12:13 | |
| *** topol has quit IRC | 12:16 | |
| *** markvoelker has joined #openstack-keystone | 12:20 | |
| *** lsmola has quit IRC | 12:22 | |
| *** topol has joined #openstack-keystone | 12:22 | |
| *** ChanServ sets mode: +v topol | 12:22 | |
| *** raildo-afk is now known as raildo | 12:27 | |
| *** edmondsw has joined #openstack-keystone | 12:33 | |
| *** lsmola has joined #openstack-keystone | 12:35 | |
| *** exploreshaifali has quit IRC | 12:43 | |
| *** doug-fish has joined #openstack-keystone | 12:49 | |
| *** zzzeek has joined #openstack-keystone | 12:59 | |
| *** topol has quit IRC | 12:59 | |
| *** su_zhang has joined #openstack-keystone | 12:59 | |
| *** fifieldt has quit IRC | 13:00 | |
| *** hrou has joined #openstack-keystone | 13:09 | |
| *** exploreshaifali has joined #openstack-keystone | 13:11 | |
| *** jecarey has joined #openstack-keystone | 13:14 | |
| *** amoturi has joined #openstack-keystone | 13:15 | |
| *** amakarov_away is now known as amakarov | 13:20 | |
| *** dsirrine has joined #openstack-keystone | 13:23 | |
| *** jsavak has joined #openstack-keystone | 13:30 | |
| *** woodster_ has joined #openstack-keystone | 13:32 | |
| *** stevemar has joined #openstack-keystone | 13:34 | |
| *** ChanServ sets mode: +v stevemar | 13:34 | |
| *** geoffarnoldX is now known as geoffarnold | 13:36 | |
| *** stevemar has quit IRC | 13:37 | |
| *** openstackgerrit has quit IRC | 13:46 | |
| *** grantbow has quit IRC | 13:46 | |
| *** openstackgerrit has joined #openstack-keystone | 13:47 | |
| odyssey4me | jamielennox mordred stevemar what're the next steps for https://bugs.launchpad.net/python-openstackclient/+bug/1496689 ? what's the best workaround for us to implement now to unbreak our master gate (which is on Liberty-3) - should we cap the openstackclient version? | 13:48 |
| openstack | Launchpad bug 1496689 in python-openstackclient "osc broken with newest occ and keystoneauth" [High,Confirmed] | 13:48 |
| *** grantbow has joined #openstack-keystone | 13:48 | |
| *** pnavarro has quit IRC | 13:56 | |
| *** markvoelker has quit IRC | 13:57 | |
| *** jsavak has quit IRC | 13:59 | |
| *** markvoelker_ has joined #openstack-keystone | 14:00 | |
| *** jsavak has joined #openstack-keystone | 14:00 | |
| openstackgerrit | Gerhard Muntingh proposed openstack/keystone: Fix the referred [app:app_v3] into [pipeline:api_v3] https://review.openstack.org/225160 | 14:02 |
| *** KarthikB has joined #openstack-keystone | 14:03 | |
| *** richm has joined #openstack-keystone | 14:03 | |
| *** gabriel-1 is now known as gabriel-bezerra | 14:06 | |
| *** gerhardqux has joined #openstack-keystone | 14:06 | |
| *** gabriel-bezerra is now known as gabrielbezerra | 14:09 | |
| openstackgerrit | Gerhard Muntingh proposed openstack/keystone: Fix the referred [app:app_v3] into [pipeline:api_v3] https://review.openstack.org/225160 | 14:13 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:14 | |
| *** dims_ has quit IRC | 14:20 | |
| *** dims_ has joined #openstack-keystone | 14:21 | |
| *** phalmos has joined #openstack-keystone | 14:21 | |
| *** sdake has joined #openstack-keystone | 14:27 | |
| *** raildo is now known as raildo-afk | 14:27 | |
| *** roxanaghe has joined #openstack-keystone | 14:29 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Deprecate local conf in paste-ini https://review.openstack.org/134124 | 14:30 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add the missing parameter https://review.openstack.org/225177 | 14:30 |
| *** david-lyle has quit IRC | 14:31 | |
| *** slberger has joined #openstack-keystone | 14:32 | |
| *** roxanaghe has quit IRC | 14:35 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add the missing parameter https://review.openstack.org/225177 | 14:35 |
| *** agireud has quit IRC | 14:35 | |
| *** agireud has joined #openstack-keystone | 14:37 | |
| *** stevemar has joined #openstack-keystone | 14:39 | |
| *** ChanServ sets mode: +v stevemar | 14:39 | |
| *** tonytan4ever has joined #openstack-keystone | 14:40 | |
| *** shoutm has joined #openstack-keystone | 14:42 | |
| *** btully has joined #openstack-keystone | 14:42 | |
| *** richm has quit IRC | 14:43 | |
| *** diazjf has joined #openstack-keystone | 14:46 | |
| *** richm has joined #openstack-keystone | 14:46 | |
| *** csoukup has joined #openstack-keystone | 14:48 | |
| mfisch | stevemar: morning | 14:48 |
| mfisch | stevemar: wrt CADF on V2/V3, I do see initiator events for some v2 stuff like getting a token (auth) | 14:49 |
| *** browne has joined #openstack-keystone | 14:49 | |
| dolphm | mfisch: but no result? | 14:49 |
| *** jsavak has quit IRC | 14:49 | |
| mfisch | sorry what? | 14:50 |
| mfisch | steve and were talking about some CADF events are missing some fields | 14:50 |
| dolphm | mfisch: ah, okay | 14:50 |
| *** exploreshaifali has quit IRC | 14:52 | |
| bknudson | what do you think about having tempest runs for the different token formats? | 14:52 |
| bknudson | like we have gate-tempest-dsvm-postgres-full for eventlet now | 14:53 |
| dolphm | bknudson: it'd be nice, is the short term effort worth the long term utility? | 14:53 |
| bknudson | that one should be switching soon | 14:53 |
| dolphm | we can't matrix test every feature in tempest, obviously, but tokens are an obvious candidate | 14:54 |
| bknudson | I'm hoping the effort is minimal | 14:54 |
| bknudson | since devstack already supports the token format as a config option | 14:54 |
| *** jsavak has joined #openstack-keystone | 14:55 | |
| *** geoffarnold is now known as geoffarnoldX | 14:55 | |
| *** EinstCrazy has joined #openstack-keystone | 14:56 | |
| dolphm | then it's just a matter of whether infra is willing to give us 3 more jobs per patch lol | 14:56 |
| dolphm | 3 more *tempest* jobs, no less | 14:56 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Clarify documentation about scope https://review.openstack.org/224792 | 14:56 |
| bknudson | I was thinking switch an existing one | 14:56 |
| bknudson | or, we could pick a random token format for each test | 14:56 |
| dolphm | transient by design? | 14:57 |
| lbragstad | I feel like that might be confusing.. | 14:57 |
| bknudson | since we never break things we should be fine | 14:59 |
| *** henrynash has joined #openstack-keystone | 15:01 | |
| *** ChanServ sets mode: +v henrynash | 15:01 | |
| *** jistr is now known as jistr|call | 15:02 | |
| *** dims_ is now known as dimsum__ | 15:03 | |
| *** jsavak has quit IRC | 15:04 | |
| *** jsavak has joined #openstack-keystone | 15:04 | |
| henrynash | bknudson: ping | 15:05 |
| bknudson | henrynash: what's up? | 15:06 |
| henrynash | bknudson: hi…just wondering if you would have a change to look at teh new patch for https://review.openstack.org/#/c/191976/ hopefully fixed up most of your concerns | 15:07 |
| *** geoffarnoldX is now known as geoffarnold | 15:07 | |
| bknudson | henrynash: I will take a look... maybe I can figure it out this time. | 15:07 |
| bknudson | (not sure why everything we do needs to be so complicated) | 15:08 |
| henrynash | bknudson: I know, I know | 15:08 |
| *** topol has joined #openstack-keystone | 15:09 | |
| *** ChanServ sets mode: +v topol | 15:09 | |
| *** EinstCrazy has quit IRC | 15:09 | |
| *** jsavak has quit IRC | 15:11 | |
| *** jsavak has joined #openstack-keystone | 15:12 | |
| mfisch | stevemar: as it turns out, auth events are useful to me. its some kind of compliance thing | 15:21 |
| *** mylu has joined #openstack-keystone | 15:21 | |
| stevemar | mfisch: yeah, that was the thought when we created them | 15:22 |
| stevemar | mfisch: re: initiator, yes, its there on all auth requests - regardless of v2 or v3 | 15:22 |
| mfisch | its interesting to see who's using up all my tokens | 15:23 |
| mfisch | its Icinga and Monasca actually | 15:23 |
| *** mylu has quit IRC | 15:25 | |
| *** mylu has joined #openstack-keystone | 15:25 | |
| stevemar | could get some nice data / analytics out of that | 15:29 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: check if tokenless auth is configured before validating https://review.openstack.org/225039 | 15:33 |
| *** tsymancz2k has quit IRC | 15:34 | |
| *** jsavak has quit IRC | 15:34 | |
| stevemar | dolphm: https://review.openstack.org/#/c/225039/ & anyone else | 15:34 |
| *** jsavak has joined #openstack-keystone | 15:34 | |
| *** tsymanczyk has quit IRC | 15:35 | |
| *** jsavak has quit IRC | 15:39 | |
| *** r-daneel has joined #openstack-keystone | 15:39 | |
| mordred | stevemar: I made a working patch on the plane but had no internet | 15:40 |
| stevemar | mordred: awesomeo | 15:40 |
| mordred | stevemar: turns out the problem is a one line silly | 15:40 |
| stevemar | everything is coming up stevemar today! | 15:40 |
| mordred | heck yeah | 15:41 |
| mordred | I'll upload it in about 30 | 15:41 |
| mordred | stevemar: I also have 80% of a complete conversion of osc done | 15:41 |
| mordred | stevemar: obvs for next cycle :) | 15:41 |
| *** gyee has joined #openstack-keystone | 15:42 | |
| *** ChanServ sets mode: +v gyee | 15:42 | |
| *** jsavak has joined #openstack-keystone | 15:43 | |
| *** david-lyle has joined #openstack-keystone | 15:43 | |
| *** erhudy has joined #openstack-keystone | 15:46 | |
| *** phalmos has quit IRC | 15:47 | |
| *** jsavak has quit IRC | 15:47 | |
| *** jsavak has joined #openstack-keystone | 15:49 | |
| *** pece has joined #openstack-keystone | 15:49 | |
| *** fhubik has quit IRC | 15:50 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Deprecate httpd/keystone.py https://review.openstack.org/221975 | 15:50 |
| mfisch | stevemar: on a user.authenticate event the target id is odd: "openstack:90ba969b-805a-4ced-94ff-34feef1e70d0" what is that? its not a user | 15:51 |
| mfisch | is that a token hash? | 15:51 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: check if tokenless auth is configured before validating https://review.openstack.org/225039 | 15:52 |
| *** su_zhang has quit IRC | 15:54 | |
| *** katkapilatova has left #openstack-keystone | 15:56 | |
| *** phalmos has joined #openstack-keystone | 16:01 | |
| mfisch | stevemar: also I'd like to put initiator into v2, is that doable? I'm happy to do the work | 16:02 |
| mfisch | so much stuff still uses it | 16:02 |
| *** tsymanczyk has joined #openstack-keystone | 16:02 | |
| *** tsymanczyk is now known as Guest26288 | 16:03 | |
| stevemar | mfisch: it should definitely be doable, its just a matter of moving the context around i think | 16:03 |
| dstanek | everyone seems to be so worried about switching away from apache, but what would we be switching? | 16:04 |
| bknudson | I thought we wrote the code to work with any wsgi container already? | 16:05 |
| *** e0ne has quit IRC | 16:05 | |
| bknudson | we're not using apache. | 16:05 |
| *** roxanaghe has joined #openstack-keystone | 16:06 | |
| stevemar | mfisch: its basically this patch, but for the v2 routes https://review.openstack.org/#/c/155660/14 | 16:06 |
| dstanek | bknudson: exactly | 16:07 |
| mfisch | thanks stevemar I'll look at it | 16:07 |
| *** diazjf has quit IRC | 16:08 | |
| stevemar | mfisch: its just added an initiator arg to the manager (and then calling notifications.create.x), and the controller has to find the initiator from the context and pass it to the manager | 16:09 |
| lbragstad | dolphm: ping; i'm looking at the revocation stuff + fernet tokens again | 16:09 |
| mfisch | stevemar: step 1 for me will be figuring out the v2 vs v3 path in that code | 16:09 |
| stevemar | mfisch: v2 https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L34 | 16:10 |
| stevemar | v3 https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L194 | 16:10 |
| lbragstad | if i have this straight - if we err on the side of revoking tokens that have been issued in the same second a revocation event was created; we would be re-introducing bug 1484237 | 16:10 |
| openstack | bug 1484237 in Keystone kilo "token revocations not always respected when using fernet tokens" [Undecided,In progress] https://launchpad.net/bugs/1484237 - Assigned to Dolph Mathews (dolph) | 16:10 |
| *** fhubik has joined #openstack-keystone | 16:15 | |
| dstanek | lbragstad: i only read the description, but from that i wouldn't expect it to be the same | 16:16 |
| dstanek | lbragstad: why were the tokens not being revoked? | 16:16 |
| lbragstad | so, this issue that we were having, is we could get a fernet token | 16:17 |
| lbragstad | immediately revoke it | 16:17 |
| *** tsymancz1k has joined #openstack-keystone | 16:17 | |
| lbragstad | and then *immediately* validate that token | 16:17 |
| lbragstad | in some cases you'll get a 200 back | 16:17 |
| lbragstad | and in some cases you'd get a 404 | 16:17 |
| lbragstad | and you'd should expect a 404 always; right? | 16:18 |
| *** raildo-afk is now known as raildo | 16:19 | |
| dstanek | lbragstad: yeah | 16:19 |
| *** david-lyle has quit IRC | 16:19 | |
| dstanek | it looks like the fix for that was to revoke the tokens for that second instead of just before | 16:19 |
| lbragstad | dstanek: that wasn't recreateable with uuid tokens because they included subsecond precision and so did the revocation model | 16:19 |
| dstanek | previously if a token was created and revoked in the same second it wouldn't be revoked | 16:20 |
| lbragstad | right, because the comparison was done at the subsecond level of precision | 16:20 |
| *** mylu has quit IRC | 16:20 | |
| mordred | stevemar: https://review.openstack.org/225217 fwiw | 16:20 |
| *** ankita_wagh has joined #openstack-keystone | 16:20 | |
| *** mylu has joined #openstack-keystone | 16:21 | |
| dstanek | lbragstad: that missing equal sign was still a bug with sub-seconds precision. just a much harder one to recreate | 16:21 |
| lbragstad | so, if we do decide to revoke tokens that were issued in the same second as the creation of the revocation event, we'd need to document that behavior | 16:21 |
| lbragstad | but we would also need to add sometime to our tests that would make sure we don't hit that failure when we have tests that run in less than a second | 16:22 |
| dstanek | lbragstad: yep, we should document it anyway since that's an important part of Keystone | 16:22 |
| *** mylu has quit IRC | 16:25 | |
| *** david-lyle has joined #openstack-keystone | 16:26 | |
| dstanek | lbragstad: i'm surprised that we didn't start running into that at all when we started to run tests in parallel | 16:27 |
| lbragstad | dstanek: so, when the code was just `return revoke_map['issued_before'] > token_data['issued_at']` mfisch was hitting bug 1484237 | 16:28 |
| openstack | bug 1484237 in Keystone kilo "token revocations not always respected when using fernet tokens" [Undecided,In progress] https://launchpad.net/bugs/1484237 - Assigned to Dolph Mathews (dolph) | 16:28 |
| *** jistr|call is now known as jistr | 16:28 | |
| mfisch | yes under certain test circumstances | 16:29 |
| *** lhcheng has joined #openstack-keystone | 16:30 | |
| *** ChanServ sets mode: +v lhcheng | 16:30 | |
| *** jistr has quit IRC | 16:30 | |
| dstanek | lbragstad: sure | 16:30 |
| *** lhcheng has quit IRC | 16:30 | |
| *** lhcheng has joined #openstack-keystone | 16:30 | |
| *** ChanServ sets mode: +v lhcheng | 16:30 | |
| *** david-lyle has quit IRC | 16:31 | |
| lbragstad | ahhh... | 16:31 |
| lbragstad | because the sub-second level precision of the revoke_map['issued_before'] is in fact greater than the token_data['issued_at'] time of the fernet token... | 16:32 |
| * lbragstad lightbulb... | 16:32 | |
| *** lsmola has quit IRC | 16:32 | |
| lbragstad | so, the true fix for this (as it was discussed before) is the following: | 16:33 |
| lbragstad | - remove subsecond level precision from keystone revocation events | 16:33 |
| lbragstad | - and switch `return revoke_map['issued_before'] >= token_data['issued_at']` back to `return revoke_map['issued_before'] > token_data['issued_at']` | 16:34 |
| *** mylu has joined #openstack-keystone | 16:37 | |
| dstanek | lbragstad: you'd have to make sure that both sides of the operation don't have sub-seconds | 16:37 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/225222 | 16:38 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/225224 | 16:38 |
| dolphm | dstanek: ++ | 16:40 |
| *** tsymancz1k is now known as tsymanczyk | 16:42 | |
| *** hrou has quit IRC | 16:42 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/225232 | 16:42 |
| dolphm | and it's still possible for the revocation event to cause tokens in the immediate future to be invalidated, but you *could* also avoid that by introducing an artificial sleep when revocation events are created. so if the revocation event is created, delay the operation from returning successfully for a full second. things that follow that operation will never have the same timestamp as the revocation event | 16:42 |
| lbragstad | dstanek: so, the first step in fixing this is removing sub-second precision from the revocation model | 16:42 |
| *** hrou has joined #openstack-keystone | 16:42 | |
| *** tonytan4ever has quit IRC | 16:42 | |
| *** ankita_wagh has quit IRC | 16:43 | |
| lbragstad | so, to clarify, tokens created at times are rounded up? | 16:48 |
| lbragstad | they have to be in order for this all to be true? | 16:48 |
| lbragstad | so if a token is created at .374657 seconds the time of the creation as Fernet knows about it is actually 1.000000 | 16:49 |
| dolphm | lbragstad: 0.0 in that example :) | 16:51 |
| lbragstad | yes | 16:51 |
| dolphm | lbragstad: they should be truncated by mysql | 16:51 |
| dolphm | err, not fernet create timestamps. mysql truncates revocation event times | 16:52 |
| dolphm | fernet timestamps are probably truncated as well, but by pypi/cryptography | 16:52 |
| lbragstad | ah, right | 16:52 |
| lbragstad | ugh, I keep forgetting about the subsecond precision thing with SQL! | 16:53 |
| dolphm | this is a complicated issue | 16:54 |
| *** su_zhang has joined #openstack-keystone | 16:54 | |
| *** tonytan4ever has joined #openstack-keystone | 16:54 | |
| dolphm | are all the tempest failures hinging on this? | 16:54 |
| *** mylu has quit IRC | 16:54 | |
| lbragstad | dolphm: yes | 16:54 |
| dolphm | 100% sure? | 16:54 |
| lbragstad | to the best of my knowledge | 16:54 |
| dolphm | k | 16:54 |
| dolphm | at castle? | 16:54 |
| lbragstad | dolphm: let me grab the bug | 16:54 |
| lbragstad | dolphm: nope | 16:55 |
| dolphm | i think my afternoon project got delayed. i'll help you tackle this after food | 16:55 |
| lbragstad | ok | 16:55 |
| lbragstad | dolphm: i'll be back on in thirty minutes | 16:56 |
| *** tsymanczyk has quit IRC | 16:56 | |
| *** Guest26288 has quit IRC | 16:56 | |
| *** lhcheng has quit IRC | 16:57 | |
| *** lhcheng has joined #openstack-keystone | 16:57 | |
| *** ChanServ sets mode: +v lhcheng | 16:57 | |
| *** david-lyle has joined #openstack-keystone | 16:57 | |
| *** mylu has joined #openstack-keystone | 16:59 | |
| *** ankita_wagh has joined #openstack-keystone | 17:01 | |
| *** _cjones_ has joined #openstack-keystone | 17:03 | |
| *** mylu has quit IRC | 17:03 | |
| *** mylu has joined #openstack-keystone | 17:04 | |
| *** roxanaghe has quit IRC | 17:04 | |
| *** su_zhang has quit IRC | 17:06 | |
| *** roxanaghe has joined #openstack-keystone | 17:06 | |
| dstanek | gyee: rip apache out of what? | 17:06 |
| gyee | dstanek, out of Keystone | 17:06 |
| dstanek | gyee: it's not in Keystone | 17:07 |
| dstanek | we don't use it or need it | 17:07 |
| gyee | federation? | 17:07 |
| gyee | external auth? | 17:07 |
| dstanek | optional features that "may" require apache. keystone itself doesn't require it | 17:08 |
| gyee | if we are moving away from identity management, we need a backup | 17:08 |
| dstanek | also uwsgi doesn't replace apache | 17:08 |
| *** mylu has quit IRC | 17:08 | |
| gyee | I understand | 17:08 |
| gyee | my point is federation and external will may a major role, especially since Keystone's identity management capability is unawesome right now | 17:09 |
| gyee | external auth | 17:09 |
| dstanek | gyee: sure there is nothing in keystone that actually requires Apache except our example config. i'm not sure how that thread got so out of whack | 17:10 |
| gyee | then how do we gate federation, websso, etc? | 17:11 |
| gyee | we don't at the moment, but eventually | 17:11 |
| dstanek | gyee: devstack uses Apache | 17:11 |
| dstanek | if i said today that "Keystone would no longer use Apache" - there would be nothing in the project that would change | 17:12 |
| gyee | unless you have not intention to support federation and external auth | 17:13 |
| gyee | unless the default user management capability is good enough for you in production | 17:13 |
| dstanek | gyee: you as a deployer can use Apache | 17:13 |
| dstanek | but that doesn't change the fact that Keystone doesn't actually use Apache at all even with federation. it gets environment variables that does stuff. technically this could be done using IIS and it's set of federation capabilities (as long and the standards match) | 17:15 |
| gyee | if you can make it work, please do share :) | 17:15 |
| dstanek | https://wiki.shibboleth.net/confluence/display/SHIB2/Integrating+Nginx+and+a+Shibboleth+SP+with+FastCGI | 17:16 |
| dstanek | done | 17:16 |
| openstackgerrit | henry-nash proposed openstack/keystone: Relax newly imposed sql driver restriction for domain config https://review.openstack.org/191976 | 17:16 |
| gyee | have you done it? | 17:16 |
| dstanek | gyee: i haven't but someone has :-) | 17:17 |
| gyee | k, will have to give it a try then | 17:17 |
| dstanek | i guess i just don't understand what people think will be changing | 17:18 |
| henrynash | bknduson: thx for your comments on https://review.openstack.org/#/c/191976/ see new patch | 17:18 |
| henrynash | morgan: Working with bknduson to get https://review.openstack.org/#/c/191976/ in for RC1 - think this is important since without it you can’t create a non-defaulrt service domain with the API-based domain config method | 17:19 |
| henrynash | morgan: new patch posted that hopefully addresses his concerns | 17:19 |
| gyee | dstanek, my concern is with the uncertainty in web servers handling external auth | 17:19 |
| gyee | and how to gate them | 17:19 |
| henrynash | lbragstad: since you +2d a previous version, if you could give your veiw as well that would be great | 17:20 |
| *** phalmos has quit IRC | 17:20 | |
| dstanek | gyee: you simply do what we do now. test the recommended configuration. | 17:20 |
| gyee | like what, mock the env vars? | 17:21 |
| dstanek | devstack uses apache right now | 17:22 |
| *** browne has quit IRC | 17:22 | |
| dstanek | if nginx had modules that adhere to the standards (like it does now for shib) then saying the recommended setup is nginx would be a change to devstack and not keystone. that's all i'm saying. you as a deploy should be free to deploy on the web server and application server of your choice. | 17:24 |
| gyee | so keystone requires devstack in order to fully test certain features | 17:25 |
| *** e0ne has joined #openstack-keystone | 17:26 | |
| dstanek | gyee: yes, it always has and i don't see that changing at all | 17:26 |
| *** henrynash has quit IRC | 17:27 | |
| gyee | is it fair to say Keystone depends on devstack then? | 17:28 |
| dstanek | gyee: when was the last time you deployed devstack to production? | 17:30 |
| dstanek | gyee: it's just our testing infrastructure | 17:30 |
| dstanek | i think it's fair to say our process depends on devstack | 17:31 |
| *** tsymancz1k has joined #openstack-keystone | 17:31 | |
| dstanek | gyee: i think of this like ldap. keystone can use ldap, but doesn't depend on it | 17:32 |
| *** mylu has joined #openstack-keystone | 17:33 | |
| *** tsymancz2k has joined #openstack-keystone | 17:33 | |
| bknudson | time to vote... who do I vote for? | 17:34 |
| dstanek | pedro? | 17:34 |
| bknudson | write-in | 17:34 |
| *** diazjf has joined #openstack-keystone | 17:35 | |
| *** tsymancz2k has quit IRC | 17:38 | |
| *** tsymancz1k has quit IRC | 17:38 | |
| gyee | dstanek, k, fair enough, I don't care its nginx or apache, we just need to have test coverage on that stuff, especially if we are moving away from identity management | 17:38 |
| gyee | bknudson, no hanging chad OK | 17:39 |
| bknudson | should just get the votes from here: http://russellbryant.net/openstack-stats/keystone-reviewers-90.txt | 17:39 |
| *** c_soukup has joined #openstack-keystone | 17:41 | |
| *** e0ne has quit IRC | 17:41 | |
| * gyee cast a vote for henrynash | 17:41 | |
| *** lhcheng has quit IRC | 17:43 | |
| *** lhcheng has joined #openstack-keystone | 17:43 | |
| *** ChanServ sets mode: +v lhcheng | 17:43 | |
| dstanek | bknudson: if i would have known that i would have done more reviews these last 2 weeks :-) | 17:43 |
| gyee | dstanek, just have to bots do that for you :) | 17:44 |
| *** csoukup has quit IRC | 17:44 | |
| *** david-lyle has quit IRC | 17:44 | |
| gyee | since reviews does not require captcha | 17:45 |
| dstanek | gyee: i'll automate "-1 getting close" on everything | 17:45 |
| gyee | hah | 17:45 |
| *** e0ne has joined #openstack-keystone | 17:49 | |
| *** boris-42 has quit IRC | 17:50 | |
| ayoung | gyee, http://adam.younglogic.com/2015/09/using-the-ipa-cli-from-an-unenrolled-workstation/ | 17:56 |
| gyee | ayoung, cool, I'll take a look | 17:58 |
| *** ankita_wagh has quit IRC | 17:58 | |
| *** harlowja has quit IRC | 17:58 | |
| *** harlowja has joined #openstack-keystone | 17:58 | |
| *** amakarov has quit IRC | 17:58 | |
| *** ankita_wagh has joined #openstack-keystone | 17:58 | |
| *** amakarov has joined #openstack-keystone | 17:59 | |
| *** tsymancz2k has joined #openstack-keystone | 18:01 | |
| *** tsymancz2k has quit IRC | 18:02 | |
| *** browne has joined #openstack-keystone | 18:02 | |
| *** su_zhang has joined #openstack-keystone | 18:06 | |
| *** su_zhang_ has joined #openstack-keystone | 18:09 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Add documentation for configuring IdP WebSSO https://review.openstack.org/218353 | 18:10 |
| *** su_zhang has quit IRC | 18:12 | |
| *** david-lyle has joined #openstack-keystone | 18:17 | |
| *** tsymancz2k has joined #openstack-keystone | 18:21 | |
| *** phalmos has joined #openstack-keystone | 18:23 | |
| *** tsymanczyk has joined #openstack-keystone | 18:27 | |
| *** tsymanczyk is now known as Guest41066 | 18:27 | |
| *** roxanaghe has quit IRC | 18:28 | |
| *** jsavak has quit IRC | 18:30 | |
| dolphm | sample* configuration | 18:31 |
| *** jsavak has joined #openstack-keystone | 18:31 | |
| * dolphm 's client refuses to autoscroll, dammit. | 18:31 | |
| *** e0ne has quit IRC | 18:39 | |
| *** manjeet has joined #openstack-keystone | 18:42 | |
| * dolphm returns from ranting on the mailing list | 18:43 | |
| dolphm | lbragstad: how goes that bug? | 18:43 |
| manjeet | how can i manually upgrade my client from v2 to v3 ? | 18:43 |
| manjeet | any documentation link, comments or suggestions ? | 18:43 |
| dolphm | manjeet: which client? it probably supports v3 already, and you just need to tell it to use the v3 API | 18:43 |
| lbragstad | dolphm: tinkering with it now | 18:45 |
| *** singh has joined #openstack-keystone | 18:45 | |
| lbragstad | dolphm: i guess the fix depends on what we target it to | 18:45 |
| dolphm | lbragstad: how can i help? | 18:45 |
| singh | dolphm: sorry I lost connection this is manjeet | 18:46 |
| singh | which conf file I can specify client ? | 18:46 |
| singh | version | 18:46 |
| *** manjeet has quit IRC | 18:48 | |
| lbragstad | dolphm: I started messing around with the revocation code, and i tried recreating mfisch's bug but I added a sleep(1) here - https://github.com/openstack/keystone/blob/master/keystone/contrib/revoke/core.py#L231 | 18:48 |
| dolphm | singh: which client are you referring to? | 18:48 |
| mfisch | I thought that bug was closed? | 18:48 |
| dolphm | lbragstad: after that line? | 18:48 |
| lbragstad | dolphm: before it | 18:49 |
| lbragstad | dolphm: http://cdn.pasteraw.com/luqxfajqjhotlkf6944vopxfqammzte | 18:49 |
| dolphm | mfisch: technically, it is. but tempest is still failing us on a tightly related edge case | 18:49 |
| *** singh_ has joined #openstack-keystone | 18:49 | |
| singh_ | dolphm: keystone ? | 18:49 |
| dolphm | mfisch: before, we were erring on the side of insecure. now we're erring on the side of secure. tempest basically fails us either way ;) | 18:49 |
| lbragstad | those edge cases being; tempest runs tests in less than a second | 18:49 |
| dolphm | singh_: python-keystoneclient? | 18:49 |
| mfisch | well then sleep(1) is my go-to fix for anything ;) | 18:49 |
| singh_ | yes | 18:50 |
| dolphm | singh_: are you using it as a python library? as a CLI? via middleware? | 18:50 |
| singh_ | cli | 18:50 |
| dolphm | singh_: switch to python-openstackclient then | 18:51 |
| *** singh has quit IRC | 18:51 | |
| dolphm | singh_: per the deprecation warnings you see in --help | 18:51 |
| lbragstad | dolphm: mfisch so, ensuring a revocation event doesn't have the same issue_before time as a token's issue_at time will get us around the problem with tempest | 18:52 |
| singh_ | thank you so much dolphm | 18:52 |
| lbragstad | then, after that, we should start removing all the subsecond precision in keystone, right? | 18:52 |
| dolphm | lbragstad: do you have a unit test for this condition in keystone? | 18:52 |
| lbragstad | no; not yet | 18:53 |
| dolphm | lbragstad: like set the clock to 1.0 seconds, generate a token, set the clock to 1.1 seconds, issue a revoke, set the clock to 1.2 seconds, generate a token? | 18:53 |
| dolphm | we can do what tempest can't in that regard, but we can't run mysql | 18:53 |
| *** amakarov has quit IRC | 18:53 | |
| lbragstad | dolphm: right, where should that live, in the test_v3_os_revoke.py module or the test_v3_auth.py module? | 18:54 |
| lbragstad | it seems revocation event specific | 18:54 |
| dolphm | lbragstad: i'm looking to see if i wrote a similar test already we can modify or copy pasta | 18:54 |
| lbragstad | dolphm: you had a few lines of an existing test commented out.. I remember that | 18:54 |
| dolphm | i don't | 18:55 |
| lbragstad | dolphm: https://review.openstack.org/#/c/216236/4/keystone/tests/unit/test_auth.py | 18:55 |
| *** phalmos has quit IRC | 18:55 | |
| dolphm | lbragstad: this is not familiar | 18:56 |
| dolphm | despite being < 1 month old | 18:56 |
| lbragstad | dolphm: that was the commit that relaxed the revocation logic to err on the side of insecure | 18:56 |
| lbragstad | and since it's fresh | 18:56 |
| dolphm | lbragstad: secure*, right? | 18:56 |
| lbragstad | we didn't see the failures that we are seeing now with tempest | 18:57 |
| lbragstad | the failures we are seeing with tempest now are things like -- 1.) get a token 2.) do some operation that requires a revocation event 3.) confirm an operation fails - but keystone does return the a token | 18:58 |
| *** e0ne has joined #openstack-keystone | 18:58 | |
| *** phalmos has joined #openstack-keystone | 18:58 | |
| dolphm | lbragstad: https://review.openstack.org/#/c/216367/3/keystone/tests/unit/test_auth.py,unified | 18:59 |
| *** r-daneel has quit IRC | 18:59 | |
| *** jsavak has quit IRC | 18:59 | |
| dolphm | lbragstad: so, similar to before, those tests *could* be fixed by either sleeping in the test, or sleeping in keystone, right? | 18:59 |
| dolphm | just as a hacky solution to illustrate the problem? | 18:59 |
| lbragstad | dolphm: here is one of the tempest tests that are currently failing - https://github.com/openstack/tempest/blob/master/tempest/api/identity/v3/test_users.py#L37 | 19:00 |
| *** jsavak has joined #openstack-keystone | 19:00 | |
| dolphm | lbragstad: but all those failures in tempest are transient, right? | 19:01 |
| lbragstad | dolphm: transient because they are occuring on sql? | 19:01 |
| lbragstad | s/sql/mysql/ | 19:01 |
| dolphm | lbragstad: transient.... because they're transiently based on the current clock | 19:02 |
| lbragstad | dolphm: then they should be transient in our tests too, right? | 19:03 |
| dolphm | lbragstad: i don't think any of our tests are transient | 19:04 |
| dolphm | lbragstad: oh, that's what you meant by mysql. yes: we don't have transients because we're running with sqlite | 19:04 |
| lbragstad | dolphm: because the subsecond precision generated is actually stored | 19:04 |
| lbragstad | ++ | 19:04 |
| * dolphm shakes fist at sqlite | 19:04 | |
| lbragstad | so, if you're looking at the tempest failures | 19:05 |
| * dolphm shakes fist at mysql | 19:05 | |
| dolphm | lbragstad: have you run tempest against your sleep patch on https://github.com/openstack/keystone/blob/master/keystone/contrib/revoke/core.py#L231 | 19:05 |
| lbragstad | it seems we, as in Keystone, are erring on the side of insecurity | 19:05 |
| lbragstad | dolphm: no, but i can push it as wip and add depends on to the devstack patch | 19:05 |
| *** Guest41066 has quit IRC | 19:06 | |
| *** tsymancz2k has quit IRC | 19:06 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Document token provider support https://review.openstack.org/224888 | 19:07 |
| lbragstad | dolphm: //cdn.pasteraw.com/t4dqexhvvw3qgss1vukqviyjp00w05t running against tempest should give us an idea of what will happen when we remove *all* subsecond support in keystone and run on sql | 19:08 |
| lbragstad | s/sql/mysql/ | 19:08 |
| lbragstad | proper link - http://cdn.pasteraw.com/t4dqexhvvw3qgss1vukqviyjp00w05t | 19:08 |
| *** david-lyle has quit IRC | 19:11 | |
| *** david-lyle has joined #openstack-keystone | 19:11 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: WIP: implement wait on revocation events https://review.openstack.org/225283 | 19:14 |
| *** e0ne has quit IRC | 19:17 | |
| *** erhudy has quit IRC | 19:19 | |
| *** david-lyle has quit IRC | 19:19 | |
| lbragstad | dolphm: if your patch (comparing revoke_map['issue_before'] >= token_data['issued_at']) has landed; how is tempest failing on tests that happen within the same second? | 19:20 |
| dstanek | lbragstad: tempest is still failing? | 19:25 |
| lbragstad | dstanek: as of the last run I checked on bknudson's patch (https://review.openstack.org/#/c/195780/) | 19:25 |
| *** roxanaghe has joined #openstack-keystone | 19:25 | |
| lbragstad | I just retriggered it and I have it dependent on https://review.openstack.org/225283 | 19:25 |
| dstanek | lbragstad: is it possible that tests from different processes are interfering with eachother? | 19:26 |
| lbragstad | dstanek: I haven't thought about that case much.. | 19:27 |
| dstanek | if two tests run in the same second and one happens to be revoking tokens there may be an issue | 19:27 |
| lbragstad | dstanek: would that only be an issue if both tests were using the same token? | 19:28 |
| dstanek | i think, unlike our unit tests, the tempest tests share a DB instance with all processes | 19:28 |
| dstanek | lbragstad: is it only revoking a specific token? or tokens for a user, etc? | 19:28 |
| lbragstad | oh, i guess that would be dependent on the tests | 19:29 |
| lbragstad | so, a test that exercises a user changing their password would fall under that case... | 19:29 |
| *** urulama has quit IRC | 19:33 | |
| morgan | So there are two options | 19:34 |
| morgan | 1 revocation events are matched with < event time. Giving a 1 second gap | 19:34 |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: add openid connect plugins https://review.openstack.org/224993 | 19:34 |
| morgan | Or tokens can be issued 1 second ahead | 19:34 |
| morgan | Same gap | 19:34 |
| morgan | I think a 1 second gap is far from the end of the world | 19:35 |
| morgan | This prevents the case of a token being issued and already being revoked | 19:35 |
| morgan | lbragstad: ^ | 19:35 |
| dolphm | lbragstad: it's failing, it's just failing on the other half of the second, so to speak | 19:36 |
| dolphm | lbragstad: we were erring *insecurely* before my patch, and now we're *erring* securely. | 19:36 |
| dolphm | lbragstad: to make tempest happy, we must not err | 19:36 |
| morgan | dolphm: yes | 19:37 |
| morgan | dolphm: which is a compromise in either case. But minimally impactful | 19:37 |
| lbragstad | hmmm | 19:37 |
| lbragstad | how does not erring make tempest happy? | 19:37 |
| lbragstad | the part i can't figure out is | 19:38 |
| dolphm | lbragstad: we traded an error condition in one edge case for a similar error condition in a different edge case | 19:38 |
| dolphm | lbragstad: tempest catches it and fails either way | 19:39 |
| dstanek | so i'm thinking that g-r needs to be updated to restrict os-client-config versions /cc stevemar (i heard you were talking about this the other day) | 19:40 |
| lbragstad | 1.) tempest asks for a token at 2.000001, and that token ends up with a creation time of 2.000000 2.) tempest changes the password at 2.000002 and the revocation event has an issued_before time of 2.000000 3.) we go to validate the token and that *should* return a 404 since the logic is >=... | 19:40 |
| bknudson | Do we have a fix for http://logs.openstack.org/57/221157/10/check/gate-tempest-dsvm-full/18eb440/logs/devstacklog.txt.gz#_2015-09-18_13_51_46_902 already? | 19:40 |
| bknudson | it's mentioned on the mailing list. | 19:40 |
| bknudson | keystoneauth? | 19:41 |
| dstanek | bknudson: on -dev? | 19:41 |
| dolphm | lbragstad: 3 is <= | 19:41 |
| bknudson | dstanek: y, -dev mailing list | 19:41 |
| lbragstad | dolphm: yes, thanks | 19:41 |
| lbragstad | dolphm: so that would mean the token would be revoked right? (i'm not seeing that in the current results from tempest) | 19:41 |
| *** su_zhang_ has quit IRC | 19:42 | |
| dstanek | bknudson: i think that's caused by what i was just talking about - os-client-config can't be unbounded on the top | 19:42 |
| bknudson | looks related to http://git.openstack.org/cgit/openstack/keystoneauth/commit/?id=835dfb8528088a6fb6c223c0e0c4f905854dd7c0 | 19:42 |
| dstanek | bknudson: they added a dep on ksa and that breaks osc | 19:42 |
| dstanek | looking for the thread.... | 19:42 |
| dolphm | lbragstad: but then you issue a token after the revocation event? | 19:43 |
| bknudson | look like mordred is all over it. | 19:43 |
| lbragstad | because revoke_map['issued_before'] is greater than token_data['issued_at'] (2.000000 >= 2.000000) | 19:43 |
| dstanek | bknudson: cool. then that will fix my issue too | 19:43 |
| lbragstad | given ^ that logic, the tokens in tempest should be revoked if they are generated within the same second after the revocation event is stored | 19:44 |
| *** sdake has quit IRC | 19:46 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/225222 | 19:46 |
| dstanek | dolphm: lbragstad: it's entirely possible. maybe the tempest revocation tests should use a different user and be pinned to the same process. | 19:47 |
| *** tsymanczyk has joined #openstack-keystone | 19:47 | |
| *** tsymanczyk is now known as Guest12691 | 19:48 | |
| lbragstad | dstanek: we should find out after the current jobs finish https://review.openstack.org/#/c/195780/ | 19:48 |
| dolphm | lbragstad: ++ this is making my head hurt without more test failures to look at | 19:48 |
| lbragstad | dolphm: agreed... | 19:49 |
| * lbragstad is -> <- close to switching to i-beer-prophen | 19:49 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/225224 | 19:51 |
| dstanek | lbragstad: what's different in that test run? | 19:51 |
| openstackgerrit | Merged openstack/keystone: check if tokenless auth is configured before validating https://review.openstack.org/225039 | 19:52 |
| lbragstad | dstanek: i made it dependent on https://review.openstack.org/#/c/225283/ | 19:52 |
| *** sdake has joined #openstack-keystone | 19:53 | |
| dstanek | lbragstad: i would still expect transient failures with that change | 19:53 |
| lbragstad | dstanek: with the revocations happening in another tempest test thread, right | 19:54 |
| dstanek | lbragstad: yes, i'm assuming that tempest has tests that revoke by something more coarse grained than a single token | 19:54 |
| lbragstad | dstanek: yeah, i know they revoke by user and timestamp because they revoke on password events | 19:55 |
| dstanek | it just depends on test ordering and timing :-( | 19:55 |
| lbragstad | dstanek: fun! | 19:55 |
| *** jsavak has quit IRC | 19:55 | |
| lbragstad | dolphm: dstanek morgan - so, if we implement revocation events 1 second in the future, then we should still remove all the subsecond precision, no? | 19:59 |
| morgan | Erm no | 19:59 |
| morgan | Do a < vs <= | 19:59 |
| morgan | or always issues tokens 1 second ahead | 19:59 |
| lbragstad | i'm not completely convinced we can issue tokens on second early because in Fernet, we don't control the token creation time | 20:00 |
| lbragstad | s/on/one/ | 20:00 |
| morgan | Then we do < on revocation events | 20:00 |
| morgan | It is a one line change | 20:00 |
| morgan | Well and some of our tests | 20:00 |
| morgan | I think* | 20:00 |
| lbragstad | ok, so at this point, we'll still support subsecond precision and that's what we will test against | 20:01 |
| lbragstad | if we go with the fix above | 20:01 |
| morgan | we may have an issue where tempest is assuming tokens and events have greater than 1 second precision | 20:01 |
| morgan | Which is a larger issue that isn't always true | 20:01 |
| lbragstad | hmmm, we don't hit that with fernet because we populate subsecond accuracy, it's always at .000000 though | 20:02 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Deprecate httpd/keystone.py https://review.openstack.org/221975 | 20:02 |
| *** doug-fish has quit IRC | 20:03 | |
| morgan | Well we do hit that | 20:03 |
| dstanek | morgan: re: mail thread | 20:03 |
| dstanek | it's osc loading its own plugins plugins | 20:04 |
| morgan | Ah | 20:04 |
| morgan | Ok | 20:04 |
| *** su_zhang has joined #openstack-keystone | 20:04 | |
| morgan | Fantastic. | 20:04 |
| *** tonytan4ever has quit IRC | 20:04 | |
| morgan | mordred: ^ cc | 20:04 |
| dstanek | osc just needs to use the correct entrypoints now that ksa is being used to load the plugins | 20:05 |
| *** lhcheng has quit IRC | 20:05 | |
| mordred | dstanek: but it's not | 20:05 |
| *** lhcheng has joined #openstack-keystone | 20:05 | |
| *** ChanServ sets mode: +v lhcheng | 20:05 | |
| dstanek | mordred: what else is it? | 20:05 |
| mordred | dstanek: because that's using occ 1.6.3 | 20:05 |
| dstanek | mordred: hmm....that's odd. i had to downgrade to that to fix my problem | 20:06 |
| *** tonytan4ever has joined #openstack-keystone | 20:06 | |
| mordred | dstanek: grep for os-client-config in that devstack output... it's VERY weird | 20:06 |
| mordred | dstanek: because the thing you described is what I expect that error to look like | 20:06 |
| dstanek | mordred: in the devstack.log it's showing 1,7.1 | 20:07 |
| mordred | really? | 20:07 |
| *** tsymancz2k has joined #openstack-keystone | 20:08 | |
| mordred | dstanek: http://logs.openstack.org/51/224451/3/check/gate-tempest-dsvm-neutron-src-python-openstackclient/3da6cb0/logs/devstacklog.txt.gz#_2015-09-18_19_28_06_610 | 20:08 |
| dstanek | mordred: that's odd. from the log mentioned in the thread http://logs.openstack.org/57/221157/10/check/gate-tempest-dsvm-full/18eb440/logs/devstacklog.txt.gz#_2015-09-18_13_50_01_291 | 20:09 |
| mordred | dstanek: BWAHAHAHAHAHAHA | 20:10 |
| morgan | Ooh pinning not working? | 20:10 |
| mordred | nope | 20:10 |
| mordred | hang on - can we move this to infra? | 20:10 |
| morgan | Yah | 20:10 |
| *** david-lyle has joined #openstack-keystone | 20:10 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Bring bandit config up-to-date https://review.openstack.org/194417 | 20:15 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Clean up bandit profiles https://review.openstack.org/225304 | 20:15 |
| *** Guest12691 is now known as tsymanczyk | 20:20 | |
| *** jecarey has quit IRC | 20:20 | |
| lbragstad | dolphm: so far so good - http://status.openstack.org/zuul/ | 20:20 |
| dolphm | lbragstad: it's in the gate twice? | 20:21 |
| dstanek | in case it fails the first time? | 20:22 |
| *** iurygregory has quit IRC | 20:23 | |
| *** gordc has quit IRC | 20:24 | |
| *** gabrielbezerra is now known as gbezerra | 20:25 | |
| *** gbezerra is now known as gabriel-bezerra | 20:25 | |
| lbragstad | dolphm: I don't think so | 20:26 |
| lbragstad | dolphm: 195780,6 is the one I'm look at | 20:26 |
| *** phalmos has quit IRC | 20:28 | |
| *** iurygregory has joined #openstack-keystone | 20:28 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Bring bandit config up-to-date https://review.openstack.org/194417 | 20:29 |
| *** jsavak has joined #openstack-keystone | 20:30 | |
| *** pece has quit IRC | 20:34 | |
| *** jsavak has quit IRC | 20:36 | |
| *** jsavak has joined #openstack-keystone | 20:37 | |
| dolphm | lbragstad: the second time it's in the gate is because a devstack patch Depends-On it | 20:38 |
| lbragstad | dolphm: oh | 20:38 |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: add openid connect plugins https://review.openstack.org/224993 | 20:38 |
| stevemar | jamielennox: finally done ^ | 20:38 |
| lbragstad | dolphm: it looks like it's going to pass | 20:38 |
| dolphm | lbragstad: minus py27 | 20:40 |
| *** amoturi has left #openstack-keystone | 20:42 | |
| *** ankita_wagh has quit IRC | 20:43 | |
| *** ankita_w_ has joined #openstack-keystone | 20:43 | |
| lbragstad | dolphm: strange, I was able to run those tests locally. | 20:54 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update bandit blacklist_calls config https://review.openstack.org/225327 | 20:57 |
| mordred | dstanek: https://review.openstack.org/225328 <-- this should fix osc without needing any patches for osc | 20:59 |
| lbragstad | dolphm: latest patch - http://cdn.pasteraw.com/icqe31td9i4qzr7pmbs2ili7sk49fcs | 20:59 |
| dolphm | lbragstad: revoke in the future? | 21:00 |
| *** lhcheng has quit IRC | 21:00 | |
| *** lhcheng has joined #openstack-keystone | 21:00 | |
| *** ChanServ sets mode: +v lhcheng | 21:00 | |
| dolphm | lbragstad: that would exacerbate the problem tempest is seeing now, i think | 21:01 |
| lbragstad | oh... that would be issue token in the future? | 21:05 |
| *** david8hu has quit IRC | 21:07 | |
| lbragstad | dolphm: it fails our unit tests, but didn't fail in tempest... | 21:08 |
| lbragstad | tempest passed with time.sleep(1) when storing a revocation event | 21:08 |
| *** mylu has quit IRC | 21:09 | |
| mordred | dstanek: updated https://review.openstack.org/225328 | 21:11 |
| *** tonytan4ever has quit IRC | 21:12 | |
| *** jsavak has quit IRC | 21:13 | |
| *** mylu has joined #openstack-keystone | 21:14 | |
| *** chlong has quit IRC | 21:14 | |
| *** jsavak has joined #openstack-keystone | 21:14 | |
| *** mylu has quit IRC | 21:15 | |
| *** stevemar has quit IRC | 21:16 | |
| *** singh_ has quit IRC | 21:19 | |
| *** raildo is now known as raildo-afk | 21:22 | |
| dstanek | mordred: that seems to have taken care of my env issue | 21:25 |
| dstanek | mordred: took me a seconds to realize that _validate_auth_ksc is the old version of _validate_auth | 21:27 |
| *** dims_ has joined #openstack-keystone | 21:29 | |
| *** iurygregory has quit IRC | 21:31 | |
| *** jsavak has quit IRC | 21:31 | |
| *** jsavak has joined #openstack-keystone | 21:31 | |
| *** tsymanczyk has quit IRC | 21:31 | |
| *** tsymancz2k has quit IRC | 21:31 | |
| *** dimsum__ has quit IRC | 21:32 | |
| *** stevemar has joined #openstack-keystone | 21:32 | |
| *** ChanServ sets mode: +v stevemar | 21:32 | |
| *** stevemar has quit IRC | 21:32 | |
| *** stevemar has joined #openstack-keystone | 21:33 | |
| *** ChanServ sets mode: +v stevemar | 21:33 | |
| *** edmondsw has quit IRC | 21:35 | |
| *** topol has quit IRC | 21:37 | |
| mordred | yea | 21:38 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: federation.idp use correct subprocess https://review.openstack.org/225340 | 21:39 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update bandit blacklist_imports config https://review.openstack.org/225341 | 21:39 |
| *** BAKfr has quit IRC | 21:41 | |
| *** topol has joined #openstack-keystone | 21:41 | |
| *** ChanServ sets mode: +v topol | 21:41 | |
| *** david8hu has joined #openstack-keystone | 21:43 | |
| *** BAKfr has joined #openstack-keystone | 21:43 | |
| *** topol has quit IRC | 21:44 | |
| *** hrou has quit IRC | 21:47 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Enable Bandit 0.13.2 tests https://review.openstack.org/225347 | 21:57 |
| *** tsymanczyk has joined #openstack-keystone | 21:58 | |
| *** tsymanczyk is now known as Guest89726 | 21:58 | |
| *** c_soukup has quit IRC | 22:00 | |
| *** su_zhang has quit IRC | 22:02 | |
| *** Guest89726 has quit IRC | 22:03 | |
| *** su_zhang has joined #openstack-keystone | 22:04 | |
| *** david-lyle has quit IRC | 22:06 | |
| *** jsavak has quit IRC | 22:07 | |
| browne | question: in launchpad if a bug isn't completely fixed, should i open a separate bug or change the state of the existing bug? | 22:08 |
| stevemar | browne: is the patch to fix it, still in progress or closed/merged? | 22:09 |
| browne | https://bugs.launchpad.net/keystone/+bug/1459382 | 22:10 |
| openstack | Launchpad bug 1459382 in Keystone kilo "Fernet tokens can fail with LDAP identity backends" [High,Fix committed] - Assigned to Dolph Mathews (dolph) | 22:10 |
| browne | stevemar: one piece is released and one commited | 22:10 |
| stevemar | browne: what's not working for you? | 22:10 |
| browne | it still fails for some users | 22:10 |
| stevemar | ah | 22:10 |
| stevemar | browne: open a new bug then, if it's for a specific case | 22:11 |
| stevemar | utf8 characters in user name? | 22:11 |
| browne | stevemar: ok thanks | 22:11 |
| browne | nope, just "Eric Brown 72620" | 22:11 |
| browne | more details here: https://bugs.launchpad.net/keystone/+bug/1497461 | 22:12 |
| openstack | Launchpad bug 1497461 in Keystone "Fernet tokens fail for some users with LDAP identity backend" [High,New] | 22:12 |
| stevemar | browne: add details about what opertaion you did to trigger that exception | 22:15 |
| browne | stevemar: sure, i just logged into horizon | 22:16 |
| stevemar | ugh, brutal | 22:16 |
| stevemar | browne: are you using multiple backends? or just the one ldap? | 22:16 |
| stevemar | like, do you have sql users at all? for admin accounts and such? | 22:16 |
| *** slberger has left #openstack-keystone | 22:17 | |
| browne | stevemar: just one backend, ldap | 22:18 |
| browne | old school | 22:18 |
| stevemar | browne: truly | 22:18 |
| *** NM has quit IRC | 22:19 | |
| anteaya | anyone care to cruise by #openstack-dev? | 22:22 |
| anteaya | it looks to me like someone is asking a keystone question | 22:22 |
| stevemar | anteaya: way ahead of you :O | 22:23 |
| anteaya | :) | 22:25 |
| *** ptoohill is now known as pc-pothole | 22:29 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:32 | |
| *** erhudy1 has joined #openstack-keystone | 22:32 | |
| dolphm | browne: the code you're tripping on was actually written to solve another, similar issue with LDAP + Fernet. it looks like another edge case :-/ | 22:34 |
| *** markvoelker_ has quit IRC | 22:36 | |
| dolphm | browne: it should be using these methods somewhere it appears not to be https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/token_formatters.py#L336-L362 | 22:37 |
| *** sdake_ has joined #openstack-keystone | 22:40 | |
| *** tsymancz1k has joined #openstack-keystone | 22:42 | |
| *** sdake has quit IRC | 22:43 | |
| browne | dolphm: those methods are used, but because a ValueError is not raised, the user_id is set to a UUID | 22:45 |
| browne | which doesn't exist later when looking up the user_id in ldap server | 22:45 |
| *** geoffarnold has quit IRC | 22:46 | |
| *** openstackgerrit has quit IRC | 22:46 | |
| *** openstackgerrit has joined #openstack-keystone | 22:47 | |
| *** sdake has joined #openstack-keystone | 22:48 | |
| *** sdake_ has quit IRC | 22:51 | |
| *** dims_ has quit IRC | 22:56 | |
| *** tsymancz2k has joined #openstack-keystone | 22:57 | |
| *** hrou has joined #openstack-keystone | 22:59 | |
| *** diazjf has quit IRC | 23:08 | |
| *** dimsum__ has joined #openstack-keystone | 23:23 | |
| *** ankita_w_ has quit IRC | 23:25 | |
| *** stevemar has quit IRC | 23:26 | |
| *** ankita_wagh has joined #openstack-keystone | 23:27 | |
| *** lhcheng has quit IRC | 23:27 | |
| *** KarthikB has quit IRC | 23:29 | |
| *** henrynash has joined #openstack-keystone | 23:31 | |
| *** ChanServ sets mode: +v henrynash | 23:31 | |
| *** ankita_wagh has quit IRC | 23:34 | |
| *** markvoelker has joined #openstack-keystone | 23:37 | |
| *** zzzeek has quit IRC | 23:38 | |
| *** lhcheng has joined #openstack-keystone | 23:38 | |
| *** ChanServ sets mode: +v lhcheng | 23:38 | |
| *** browne has quit IRC | 23:39 | |
| *** henrynash has quit IRC | 23:39 | |
| *** lhcheng has quit IRC | 23:39 | |
| *** lhcheng_ has joined #openstack-keystone | 23:39 | |
| *** markvoelker has quit IRC | 23:42 | |
| *** lhcheng has joined #openstack-keystone | 23:43 | |
| *** ChanServ sets mode: +v lhcheng | 23:43 | |
| *** erhudy1 has quit IRC | 23:43 | |
| *** lhcheng_ has quit IRC | 23:43 | |
| *** btully has quit IRC | 23:52 | |
| *** richm has quit IRC | 23:54 | |
| *** dsirrine has quit IRC | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!